@hasna/loops 0.3.56 → 0.3.58

package/dist/cli/index.js

@@ -461,6 +461,9 @@ function validateTarget(value, label, opts) {
     }
     if (value.model !== undefined)
       assertString(value.model, `${label}.model`);
+    if (value.provider === "opencode" && (typeof value.model !== "string" || value.model.trim() === "")) {
+      throw new Error(`${label}.model is required for provider opencode; pass a provider/model id such as openrouter/google/gemini-2.5-flash`);
+    }
     if (value.variant !== undefined)
       assertString(value.variant, `${label}.variant`);
     if (value.agent !== undefined)
@@ -1257,12 +1260,21 @@ class Store {
     if (!row)
       throw new Error("daemon lease lost");
   }
+  assertNoNestedWorkflowGoal(target, goal) {
+    if (!goal || target.type !== "workflow")
+      return;
+    const workflow = this.getWorkflow(target.workflowId);
+    if (workflow?.goal) {
+      throw new Error(`workflow loop cannot define a loop-level goal when workflow ${workflow.name} already has a top-level goal; remove one goal wrapper`);
+    }
+  }
   createLoop(input, from = new Date) {
     const now = nowIso();
     const target = input.target.type === "workflow" ? input.target : normalizeCreateWorkflowInput({
       name: "loop-target-validation",
       steps: [{ id: "target", target: input.target }]
     }).steps[0].target;
+    this.assertNoNestedWorkflowGoal(target, input.goal);
     const loop = {
       id: genId(),
       name: input.name,
@@ -1434,6 +1446,9 @@ class Store {
       if (this.hasRunningRun(current.id))
         throw new Error(`refusing to retarget running loop: ${current.id}`);
       const workflow = this.requireWorkflow(workflowId);
+      if (current.goal && workflow.goal) {
+        throw new Error(`workflow loop cannot retarget ${current.name} to workflow ${workflow.name} because both define top-level goals`);
+      }
       const target = { ...current.target, workflowId: workflow.id };
       if (opts.workflowTimeoutMs !== undefined)
         target.timeoutMs = opts.workflowTimeoutMs;
@@ -1472,6 +1487,9 @@ class Store {
         throw new Error(`loop is not a workflow loop: ${idOrName}`);
       if (this.hasRunningRun(current.id))
         throw new Error(`refusing to retarget running loop: ${current.id}`);
+      if (current.goal && normalized.goal) {
+        throw new Error(`workflow loop cannot retarget ${current.name} to a workflow that also defines a top-level goal`);
+      }
       const previousWorkflow = this.requireWorkflow(current.target.workflowId);
       const workflow = {
         id: genId(),
@@ -1763,7 +1781,7 @@ class Store {
     if (!sourceDedupeKey)
       throw new Error("cannot refresh workflow invocation without sourceRef.dedupeKey");
     const now = nowIso();
-    const claimableStatuses = ["queued", "deferred", "failed", "dead_letter", "cancelled"];
+    const claimableStatuses = ["queued", "deferred"];
     const statusBindings = Object.fromEntries(claimableStatuses.map((status, index) => [`$status${index}`, status]));
     const placeholders = claimableStatuses.map((_, index) => `$status${index}`).join(",");
     const result = this.db.query(`UPDATE workflow_invocations
@@ -1844,28 +1862,35 @@ class Store {
           project_group=excluded.project_group,
           priority=excluded.priority,
           status=CASE
-            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running')
+            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running', 'failed', 'dead_letter', 'cancelled')
               THEN workflow_work_items.status
             ELSE excluded.status
           END,
           workflow_id=CASE
-            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running') THEN workflow_work_items.workflow_id
+            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running', 'failed', 'dead_letter', 'cancelled') THEN workflow_work_items.workflow_id
             ELSE NULL
           END,
           loop_id=CASE
-            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running') THEN workflow_work_items.loop_id
+            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running', 'failed', 'dead_letter', 'cancelled') THEN workflow_work_items.loop_id
             ELSE NULL
           END,
           workflow_run_id=CASE
-            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running') THEN workflow_work_items.workflow_run_id
+            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running', 'failed', 'dead_letter', 'cancelled') THEN workflow_work_items.workflow_run_id
             ELSE NULL
           END,
           lease_expires_at=CASE
-            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running') THEN workflow_work_items.lease_expires_at
+            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running', 'failed', 'dead_letter', 'cancelled') THEN workflow_work_items.lease_expires_at
             ELSE NULL
           END,
           next_attempt_at=excluded.next_attempt_at,
-          last_reason=COALESCE(excluded.last_reason, workflow_work_items.last_reason),
+          last_reason=CASE
+            WHEN workflow_work_items.attempts > 0
+              AND workflow_work_items.status IN ('queued', 'deferred')
+              AND workflow_work_items.last_reason IS NOT NULL
+              AND excluded.last_reason IS NOT NULL
+              THEN workflow_work_items.last_reason || '; ' || excluded.last_reason
+            ELSE COALESCE(excluded.last_reason, workflow_work_items.last_reason)
+          END,
           updated_at=excluded.updated_at`).run({
       $id: id,
       $routeKey: input.routeKey,
@@ -1918,11 +1943,39 @@ class Store {
     const projectGroup = args.projectGroup ? this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders}) AND project_group = ?`).get(...active, args.projectGroup)?.count ?? 0 : undefined;
     return { global, project, ...projectGroup !== undefined ? { projectGroup } : {} };
   }
+  requeueWorkflowWorkItem(id, patch = {}) {
+    const current = this.getWorkflowWorkItem(id);
+    if (!current)
+      throw new Error(`workflow work item not found: ${id}`);
+    const requeueableStatuses = ["succeeded", "failed", "dead_letter", "cancelled"];
+    if (!requeueableStatuses.includes(current.status)) {
+      throw new Error(`workflow work item is not requeueable: ${id} status=${current.status}`);
+    }
+    const now = nowIso();
+    const reason = patch.reason?.trim() || `requeued from ${current.status}`;
+    const placeholders = requeueableStatuses.map(() => "?").join(",");
+    const res = this.db.query(`UPDATE workflow_work_items
+         SET status='queued', workflow_id=NULL, loop_id=NULL, workflow_run_id=NULL,
+          next_attempt_at=NULL, lease_expires_at=NULL, last_reason=?, updated_at=?
+         WHERE id=? AND status IN (${placeholders})`).run(reason, now, id, ...requeueableStatuses);
+    const item = this.getWorkflowWorkItem(id);
+    if (!item)
+      throw new Error(`workflow work item not found after requeue: ${id}`);
+    if (res.changes !== 1)
+      throw new Error(`workflow work item was not requeued: ${id} status=${item.status}`);
+    return item;
+  }
   admitWorkflowWorkItem(id, patch) {
     const now = nowIso();
     const res = this.db.query(`UPDATE workflow_work_items
          SET status='admitted', attempts=attempts + 1, workflow_id=$workflowId, loop_id=$loopId,
-          next_attempt_at=NULL, lease_expires_at=NULL, last_reason=$reason, updated_at=$updated
+          next_attempt_at=NULL,
+          lease_expires_at=NULL,
+          last_reason=CASE
+            WHEN last_reason IS NOT NULL AND $reason IS NOT NULL THEN last_reason || '; ' || $reason
+            ELSE COALESCE($reason, last_reason)
+          END,
+          updated_at=$updated
          WHERE id=$id AND status IN ('queued', 'deferred')`).run({
       $id: id,
       $workflowId: patch.workflowId,
@@ -3105,7 +3158,7 @@ class Store {
 
 // src/cli/index.ts
 import { createHash as createHash3, randomUUID } from "crypto";
-import { closeSync, existsSync as existsSync5, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync2, openSync as openSync2, readFileSync as readFileSync4, realpathSync, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
+import { closeSync, existsSync as existsSync6, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync2, openSync as openSync2, readFileSync as readFileSync5, realpathSync, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
 import { spawnSync as spawnSync5 } from "child_process";
 import { dirname as dirname4, join as join6, resolve as resolve3 } from "path";
 import { tmpdir as tmpdir2 } from "os";
@@ -3580,6 +3633,9 @@ function assertSupportedAgentOptions(target) {
   assertStringOption(target.agent, `${target.provider}.agent`);
   assertStringOption(target.authProfile, `${target.provider}.authProfile`);
   assertStringOption(target.configIsolation, `${target.provider}.configIsolation`);
+  if (target.provider === "opencode" && (target.model === undefined || target.model.trim() === "")) {
+    throw new Error("opencode.model is required; pass a provider/model id such as openrouter/google/gemini-2.5-flash");
+  }
   if (target.configIsolation !== undefined && target.configIsolation !== "safe" && target.configIsolation !== "none") {
     throw new Error(`${target.provider}.configIsolation must be safe or none`);
   }
@@ -4352,6 +4408,78 @@ function sameBlockerKey(values) {
   return values.map((value) => value.trim()).filter(Boolean).join(`
 `) || "goal completion remains unproven";
 }
+function planStatusForGoal(goal) {
+  if (goal.status === "usageLimited")
+    return "blocked";
+  return goal.status;
+}
+function syncReadyFlags(store, goal, nodes, opts) {
+  const withReady = updateReadyFlags(nodes, planStatusForGoal(goal));
+  for (const node of withReady) {
+    const current = nodes.find((entry) => entry.key === node.key);
+    if (current && current.ready !== node.ready) {
+      store.updateGoalPlanNode(goal.goalId, node.key, { ready: node.ready }, { daemonLeaseId: opts.daemonLeaseId });
+    }
+  }
+  return withReady;
+}
+function summarizeLabels(values, limit = 5) {
+  if (values.length <= limit)
+    return values.join(", ");
+  return `${values.slice(0, limit).join(", ")} and ${values.length - limit} more`;
+}
+function noReadyDiagnostic(goal, nodes) {
+  const planStatus = planStatusForGoal(goal);
+  const byKey = new Map(nodes.map((node) => [node.key, node]));
+  const pendingNodes = nodes.filter((node) => node.status === "pending");
+  const incompleteNodes = nodes.filter((node) => node.status !== "complete");
+  const pendingDetails = pendingNodes.map((node) => ({
+    key: node.key,
+    status: node.status,
+    ready: node.ready,
+    tokenBudget: node.tokenBudget,
+    tokensUsed: node.tokensUsed,
+    budgetExhausted: nodeBudgetExhausted(node),
+    unmetDependencies: node.dependsOn.map((dependency) => ({ key: dependency, status: byKey.get(dependency)?.status ?? "missing" })).filter((dependency) => dependency.status !== "complete")
+  }));
+  const incompleteDetails = incompleteNodes.map((node) => ({
+    key: node.key,
+    status: node.status,
+    ready: node.ready
+  }));
+  let owner = "goal-plan";
+  let cause = "goal plan has no ready nodes";
+  if (planStatus !== "active") {
+    owner = "goal";
+    cause = `goal status is ${goal.status}`;
+  } else if (pendingNodes.length === 0) {
+    owner = "goal-plan";
+    cause = `goal plan has no pending runnable nodes; incomplete nodes: ${summarizeLabels(incompleteDetails.map((node) => `${node.key}:${node.status}`))}`;
+  } else if (pendingDetails.every((node) => node.budgetExhausted)) {
+    owner = "goal-plan-node";
+    cause = `all pending nodes are budget-exhausted: ${summarizeLabels(pendingDetails.map((node) => node.key))}`;
+  } else {
+    const missingDependencies = pendingDetails.flatMap((node) => node.unmetDependencies.filter((dependency) => dependency.status === "missing").map((dependency) => `${node.key}->${dependency.key}`));
+    if (missingDependencies.length > 0) {
+      owner = "goal-plan";
+      cause = `pending nodes reference missing dependencies: ${summarizeLabels(missingDependencies)}`;
+    } else if (pendingDetails.every((node) => node.unmetDependencies.length > 0 || node.budgetExhausted)) {
+      owner = "goal-plan-node";
+      const waiting = pendingDetails.filter((node) => node.unmetDependencies.length > 0).map((node) => `${node.key} waits on ${node.unmetDependencies.map((dependency) => `${dependency.key}:${dependency.status}`).join(",")}`);
+      const exhausted = pendingDetails.filter((node) => node.budgetExhausted).map((node) => `${node.key} budget exhausted`);
+      cause = `pending nodes are blocked by prerequisites: ${summarizeLabels([...waiting, ...exhausted])}`;
+    }
+  }
+  const blocker = `${cause}; owner=${owner}`;
+  return {
+    owner,
+    blocker,
+    planStatus,
+    rollup: rollupSummary(nodes),
+    pendingNodes: pendingDetails,
+    incompleteNodes: incompleteDetails
+  };
+}
 function metadataFor(goal, node, context) {
   return {
     loopId: context?.loopId,
@@ -4412,13 +4540,14 @@ async function planGoal(store, goal, spec, model, opts) {
   }, { daemonLeaseId: opts.daemonLeaseId });
   return store.createGoalPlanNodes(goal.goalId, rawNodes, { daemonLeaseId: opts.daemonLeaseId });
 }
-function stdoutFor(goal, nodes, evidence, validation) {
+function stdoutFor(goal, nodes, evidence, validation, diagnostics) {
   return JSON.stringify({
     goal,
     rollup: rollupSummary(nodes),
     nodes,
     evidence,
-    validation
+    validation,
+    diagnostics
   }, null, 2);
 }
 async function runGoal(store, input, opts = {}) {
@@ -4451,6 +4580,7 @@ async function runGoal(store, input, opts = {}) {
   let validation;
   let lastBlocker = "";
   let repeatedBlockerCount = 0;
+  let lastDiagnostic;
   if (budgetExhausted(goal)) {
     goal = store.updateGoalStatus(goal.goalId, "budgetLimited", { daemonLeaseId: opts.daemonLeaseId });
     return resultFromGoal(goal, "failed", stdoutFor(goal, nodes, evidence), "goal token budget exhausted after planning", startedAt);
@@ -4461,13 +4591,13 @@ async function runGoal(store, input, opts = {}) {
       return resultFromGoal(goal, "failed", stdoutFor(goal, nodes, evidence), "goal cancelled", startedAt);
     }
     goal = store.requireGoal(goal.goalId);
-    nodes = store.listGoalPlanNodes(goal.goalId);
+    nodes = syncReadyFlags(store, goal, store.listGoalPlanNodes(goal.goalId), opts);
     if (budgetExhausted(goal)) {
       goal = store.updateGoalStatus(goal.goalId, "budgetLimited", { daemonLeaseId: opts.daemonLeaseId });
       return resultFromGoal(goal, "failed", stdoutFor(goal, nodes, evidence), "goal token budget exhausted", startedAt);
     }
     const readyKeys = readyNodeKeys({
-      status: goal.status === "active" ? "active" : goal.status === "budgetLimited" ? "budgetLimited" : "blocked",
+      status: planStatusForGoal(goal),
       nodes
     });
     if (readyKeys.length > 0) {
@@ -4566,7 +4696,9 @@ ${result.stderr}`);
       }
       continue;
     }
-    const blocker = "no ready goal nodes and goal plan is incomplete";
+    const diagnostic = noReadyDiagnostic(goal, nodes);
+    lastDiagnostic = diagnostic;
+    const blocker = diagnostic.blocker;
     if (blocker === lastBlocker)
       repeatedBlockerCount += 1;
     else {
@@ -4578,15 +4710,16 @@ ${result.stderr}`);
       turn,
       phase: "status",
       status: repeatedBlockerCount >= 3 ? "blocked" : "active",
-      evidence: { blocker }
+      evidence: diagnostic
     }, { daemonLeaseId: opts.daemonLeaseId });
     if (repeatedBlockerCount >= 3) {
       goal = store.updateGoalStatus(goal.goalId, "blocked", { daemonLeaseId: opts.daemonLeaseId });
-      return resultFromGoal(goal, "failed", stdoutFor(goal, nodes, evidence, validation), blocker, startedAt);
+      return resultFromGoal(goal, "failed", stdoutFor(goal, nodes, evidence, validation, diagnostic), blocker, startedAt);
     }
   }
   goal = store.updateGoalStatus(goal.goalId, "usageLimited", { daemonLeaseId: opts.daemonLeaseId });
-  return resultFromGoal(goal, "failed", stdoutFor(goal, store.listGoalPlanNodes(goal.goalId), evidence, validation), "goal max turns exhausted", startedAt);
+  const exhaustedError = lastDiagnostic?.blocker ?? (lastBlocker ? `${lastBlocker}; max turns exhausted` : "goal max turns exhausted");
+  return resultFromGoal(goal, "failed", stdoutFor(goal, store.listGoalPlanNodes(goal.goalId), evidence, validation, lastDiagnostic), exhaustedError, startedAt);
 }
 
 // src/lib/workflow-runner.ts
@@ -4615,6 +4748,7 @@ async function executeWorkflow(store, workflow, opts = {}) {
     const workflowWithoutGoal = { ...workflow, goal: undefined };
     return runGoal(store, workflow.goal, {
       ...opts,
+      model: opts.goalModel,
       context: {
         loopId: opts.loop?.id,
         loopName: opts.loop?.name,
@@ -4707,6 +4841,7 @@ async function executeWorkflow(store, workflow, opts = {}) {
       if (step.goal) {
         result = await runGoal(store, step.goal, {
           ...opts,
+          model: opts.goalModel,
           target: targetWithStepAccount(step),
           signal: controller.signal,
           context: {
@@ -4848,6 +4983,7 @@ async function executeLoopTarget(store, loop, run, opts = {}) {
     if (loop.goal) {
       return runGoal(store, loop.goal, {
         ...opts,
+        model: opts.goalModel,
         target: loop.target,
         context: {
           loopId: loop.id,
@@ -4869,8 +5005,10 @@ async function executeLoopTarget(store, loop, run, opts = {}) {
     }
   }
   if (loop.goal) {
+    const workflowForLoopGoal = workflow.goal ? { ...workflow, goal: undefined } : workflow;
     return runGoal(store, loop.goal, {
       ...opts,
+      model: opts.goalModel,
       context: {
         loopId: loop.id,
         loopName: loop.name,
@@ -4879,7 +5017,7 @@ async function executeLoopTarget(store, loop, run, opts = {}) {
         workflowId: workflow.id,
         workflowName: workflow.name
       },
-      executeNode: async (node) => executeWorkflow(store, workflow, {
+      executeNode: async (node) => executeWorkflow(store, workflowForLoopGoal, {
         ...opts,
         loop,
         loopRun: run,
@@ -5708,6 +5846,7 @@ function runDoctor(store) {
 
 // src/lib/health.ts
 import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
 var EVIDENCE_CHARS = 2000;
 var FINGERPRINT_EVIDENCE_CHARS = 120;
 var CLASSIFICATIONS = [
@@ -5718,6 +5857,7 @@ var CLASSIFICATIONS = [
   "schema_response_format",
   "node_init",
   "preflight",
+  "route_functional",
   "timeout",
   "sigsegv",
   "skipped_previous_active",
@@ -5738,6 +5878,25 @@ function searchableText(run) {
   return [run.error, run.stderr, run.stdout].filter(Boolean).join(`
 `).toLowerCase();
 }
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function stringValue(value) {
+  return typeof value === "string" && value.trim() ? value : undefined;
+}
+function objectField(value, key) {
+  if (!value)
+    return;
+  const field = value[key];
+  return isRecord(field) ? field : undefined;
+}
+function tagsFromValue(value) {
+  if (Array.isArray(value))
+    return value.map((entry) => String(entry).trim()).filter(Boolean);
+  if (typeof value === "string")
+    return value.split(",").map((entry) => entry.trim()).filter(Boolean);
+  return [];
+}
 function stableFingerprint(parts) {
   return createHash2("sha256").update(parts.join(`
 `)).digest("hex").slice(0, 16);
@@ -5751,6 +5910,13 @@ function stableFailureFingerprint(run, classification) {
     (run.error ?? run.stderr ?? run.stdout ?? "").replace(/\d{4}-\d{2}-\d{2}T\S+/g, "<timestamp>").slice(0, FINGERPRINT_EVIDENCE_CHARS)
   ]);
 }
+function stableRouteFunctionalFingerprint(loop, reason) {
+  return stableFingerprint([
+    loop.id,
+    "route_functional",
+    reason.replace(/\d{4}-\d{2}-\d{2}T\S+/g, "<timestamp>").slice(0, FINGERPRINT_EVIDENCE_CHARS)
+  ]);
+}
 function healthRun(run) {
   return {
     ...run,
@@ -5795,6 +5961,148 @@ function classifyRunFailure(run) {
     }
   };
 }
+var ROUTE_FUNCTIONAL_DISALLOWED_TAGS = new Set([
+  "no-auto",
+  "manual",
+  "manual-required",
+  "approval-required",
+  "blocked",
+  "completed",
+  "done",
+  "cancelled",
+  "canceled",
+  "failed",
+  "archived"
+]);
+var ROUTE_FUNCTIONAL_DISALLOWED_STATUSES = new Set([
+  "blocked",
+  "completed",
+  "done",
+  "cancelled",
+  "canceled",
+  "failed",
+  "archived"
+]);
+function parseJsonObject(raw) {
+  if (!raw?.trim())
+    return;
+  try {
+    const parsed = JSON.parse(raw);
+    return isRecord(parsed) ? parsed : undefined;
+  } catch {
+    return;
+  }
+}
+function routeEvidenceReport(run) {
+  const stdoutReport = parseJsonObject(run.stdout);
+  const evidencePath = stringValue(stdoutReport?.evidencePath);
+  if (evidencePath && existsSync4(evidencePath)) {
+    try {
+      return parseJsonObject(readFileSync3(evidencePath, "utf8")) ?? stdoutReport;
+    } catch {
+      return stdoutReport;
+    }
+  }
+  return stdoutReport;
+}
+function commandName(command) {
+  return command.split(/[\\/]/).at(-1) ?? command;
+}
+function argsContainSequence(args, sequence) {
+  for (let index = 0;index <= args.length - sequence.length; index += 1) {
+    if (sequence.every((part, offset) => args[index + offset] === part))
+      return true;
+  }
+  return false;
+}
+function isRouteDrainLoop(loop) {
+  if (loop.target.type !== "command")
+    return false;
+  if (commandName(loop.target.command) !== "loops")
+    return false;
+  const args = loop.target.args ?? [];
+  return argsContainSequence(args, ["events", "drain", "todos-task"]) || argsContainSequence(args, ["routes", "drain", "todos-task"]) || argsContainSequence(args, ["route", "drain", "todos-task"]);
+}
+function routeResultTaskState(result) {
+  const event = objectField(result, "event");
+  const data = objectField(event, "data");
+  const task = objectField(data, "task");
+  const payload = objectField(data, "payload");
+  const payloadTask = objectField(payload, "task");
+  const metadata = objectField(data, "metadata");
+  const records = [data, task, payload, payloadTask, metadata].filter(isRecord);
+  const tags = new Set;
+  for (const record of records) {
+    for (const tag of tagsFromValue(record.tags ?? record.task_tags ?? record.taskTags)) {
+      tags.add(tag.toLowerCase());
+    }
+  }
+  const status = records.map((record) => stringValue(record.status ?? record.task_status ?? record.taskStatus)?.toLowerCase()).find(Boolean);
+  return {
+    taskId: stringValue(event?.subject) ?? stringValue(data?.id) ?? stringValue(task?.id) ?? stringValue(payloadTask?.id),
+    tags: [...tags],
+    status
+  };
+}
+function detectRouteFunctionalFailure(store, loop, run) {
+  if (run.status !== "succeeded")
+    return;
+  if (!isRouteDrainLoop(loop))
+    return;
+  const report = routeEvidenceReport(run);
+  const rawResults = Array.isArray(report?.results) ? report.results.filter(isRecord) : [];
+  for (const result of rawResults) {
+    const kind = stringValue(result.kind);
+    const task = routeResultTaskState(result);
+    const disallowedTag = task.tags.find((tag) => ROUTE_FUNCTIONAL_DISALLOWED_TAGS.has(tag));
+    if (kind && kind !== "skipped" && disallowedTag) {
+      const reason2 = `route drain ${kind} task ${task.taskId ?? "unknown"} with disallowed tag ${disallowedTag}`;
+      return {
+        classification: "route_functional",
+        fingerprint: stableRouteFunctionalFingerprint(loop, reason2),
+        evidence: { error: reason2, stdout: redactedEvidence(run.stdout), exitCode: run.exitCode }
+      };
+    }
+    if (kind && kind !== "skipped" && task.status && ROUTE_FUNCTIONAL_DISALLOWED_STATUSES.has(task.status)) {
+      const reason2 = `route drain ${kind} task ${task.taskId ?? "unknown"} with non-routable status ${task.status}`;
+      return {
+        classification: "route_functional",
+        fingerprint: stableRouteFunctionalFingerprint(loop, reason2),
+        evidence: { error: reason2, stdout: redactedEvidence(run.stdout), exitCode: run.exitCode }
+      };
+    }
+    const reason = stringValue(result.reason);
+    if (kind === "skipped" && reason === "task metadata requires manual or approval-gated handling") {
+      const message = `route drain skipped task ${task.taskId ?? "unknown"} with ambiguous manual-gate reason`;
+      return {
+        classification: "route_functional",
+        fingerprint: stableRouteFunctionalFingerprint(loop, message),
+        evidence: { error: message, stdout: redactedEvidence(run.stdout), exitCode: run.exitCode }
+      };
+    }
+    const sourceTaskUpdate = objectField(result, "sourceTaskUpdate");
+    if (kind === "skipped" && sourceTaskUpdate && sourceTaskUpdate.ok === false) {
+      const updateError = stringValue(sourceTaskUpdate.error);
+      const message = `route drain skipped task ${task.taskId ?? "unknown"} but failed to update source task${updateError ? `: ${updateError}` : ""}`;
+      return {
+        classification: "route_functional",
+        fingerprint: stableRouteFunctionalFingerprint(loop, message),
+        evidence: { error: message, stdout: redactedEvidence(run.stdout), exitCode: run.exitCode }
+      };
+    }
+    const childLoopId = stringValue(objectField(result, "loop")?.id) ?? stringValue(result.loopId);
+    const childRun = childLoopId ? store.listRuns({ loopId: childLoopId, limit: 1 })[0] : undefined;
+    if (childRun && !["succeeded", "running"].includes(childRun.status)) {
+      const message = `route drain ${kind ?? "handled"} task ${task.taskId ?? "unknown"} but child loop ${childLoopId} latest run is ${childRun.status}`;
+      return {
+        classification: "route_functional",
+        fingerprint: stableRouteFunctionalFingerprint(loop, message),
+        evidence: { error: message, stdout: redactedEvidence(run.stdout), stderr: redactedEvidence(childRun.stderr), exitCode: childRun.exitCode }
+      };
+    }
+  }
+  return;
+}
 function targetRoute(loop) {
   if (loop.target.type === "agent") {
     return {
@@ -5882,6 +6190,18 @@ function expectationForLoop(store, loop) {
       route
     };
   }
+  const routeFailure = detectRouteFunctionalFailure(store, loop, latestRun);
+  if (routeFailure) {
+    return {
+      loop: { id: loop.id, name: loop.name, status: loop.status, nextRunAt: loop.nextRunAt },
+      ok: false,
+      check: { id: "route-functional-health", status: "fail", message: routeFailure.evidence.error ?? "route functional blocker detected" },
+      latestRun: healthRun(latestRun),
+      failure: routeFailure,
+      route,
+      recommendedTask: recommendedTask(loop, latestRun, routeFailure, route)
+    };
+  }
   if (latestRun.status === "succeeded") {
     return {
       loop: { id: loop.id, name: loop.name, status: loop.status, nextRunAt: loop.nextRunAt },
@@ -5940,6 +6260,8 @@ var PROVIDER_TOKENS = new Set([
   "agent"
 ]);
 var REPO_GENERIC_TOKENS = new Set(["repo", "repoops"]);
+var CADENCE_SUFFIX_TOKENS = new Set(["hourly", "daily", "weekly", "monthly"]);
+var CADENCE_SUFFIX_PATTERN = /^(?:every-?)?\d+(?:s|m|h|d|w)$/;
 function slugify(value) {
   return value.normalize("NFKD").replace(/[^\w\s.-]/g, "-").replace(/[_\s.:/]+/g, "-").replace(/[^a-zA-Z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").toLowerCase();
 }
@@ -5992,6 +6314,16 @@ function taskSlug(loop, scope) {
     if (deduped[deduped.length - 1] !== token)
       deduped.push(token);
   }
+  while (deduped.length) {
+    const last = deduped[deduped.length - 1];
+    if (CADENCE_SUFFIX_TOKENS.has(last) || CADENCE_SUFFIX_PATTERN.test(last)) {
+      deduped.pop();
+      if (deduped[deduped.length - 1] === "every")
+        deduped.pop();
+      continue;
+    }
+    break;
+  }
   return deduped.join("-") || "loop";
 }
 function canonicalName(loop) {
@@ -6165,14 +6497,15 @@ function buildScriptInventoryReport(store, opts = {}) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.3.56",
+  version: "0.3.58",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
   types: "dist/index.d.ts",
   bin: {
     loops: "dist/cli/index.js",
-    "loops-daemon": "dist/daemon/index.js"
+    "loops-daemon": "dist/daemon/index.js",
+    "loops-mcp": "dist/mcp/index.js"
   },
   exports: {
     ".": {
@@ -6183,6 +6516,10 @@ var package_default = {
       types: "./dist/sdk/index.d.ts",
       import: "./dist/sdk/index.js"
     },
+    "./mcp": {
+      types: "./dist/mcp/index.d.ts",
+      import: "./dist/mcp/index.js"
+    },
     "./storage": {
       types: "./dist/lib/store.d.ts",
       import: "./dist/lib/store.js"
@@ -6195,7 +6532,7 @@ var package_default = {
     "LICENSE"
   ],
   scripts: {
-    build: "rm -rf dist && bun build src/cli/index.ts src/daemon/index.ts src/index.ts src/sdk/index.ts src/lib/store.ts --outdir dist --target bun --packages external && chmod +x dist/cli/index.js dist/daemon/index.js && tsc -p tsconfig.build.json --emitDeclarationOnly --outDir dist",
+    build: "rm -rf dist && bun build src/cli/index.ts src/daemon/index.ts src/mcp/index.ts src/index.ts src/sdk/index.ts src/lib/store.ts --outdir dist --target bun --packages external && chmod +x dist/cli/index.js dist/daemon/index.js dist/mcp/index.js && tsc -p tsconfig.build.json --emitDeclarationOnly --outDir dist",
     "build:bin": "bun build src/cli/index.ts --compile --outfile dist/loops",
     typecheck: "tsc --noEmit",
     test: "bun test",
@@ -6231,6 +6568,7 @@ var package_default = {
   dependencies: {
     "@hasna/events": "^0.1.9",
     "@hasna/machines": "0.0.49",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "@openrouter/ai-sdk-provider": "2.9.1",
     ai: "6.0.204",
     commander: "^13.1.0",
@@ -6255,7 +6593,7 @@ function packageVersion() {
 
 // src/lib/templates.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync5, lstatSync, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir3 } from "os";
 import { basename as basename3, isAbsolute as isAbsolute2, join as join5, relative, resolve as resolve2 } from "path";
 var TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID = "todos-task-worker-verifier";
@@ -6296,7 +6634,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "worktreeMode", default: "auto", description: "Worktree isolation mode: auto, required, off, or main." },
       { name: "worktreeRoot", default: "~/.hasna/loops/worktrees", description: "Base directory for OpenLoops-managed git worktrees." },
       { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated task/event worktree branches." },
-      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." },
+      { name: "verifierIdleTimeoutMs", default: "900000", description: "Verifier idle watchdog in milliseconds; use none/off to disable when an external heartbeat exists." }
     ]
   },
   {
@@ -6327,7 +6666,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "worktreeMode", default: "auto", description: "Worktree isolation mode: auto, required, off, or main." },
       { name: "worktreeRoot", default: "~/.hasna/loops/worktrees", description: "Base directory for OpenLoops-managed git worktrees." },
       { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated event worktree branches." },
-      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." },
+      { name: "verifierIdleTimeoutMs", default: "900000", description: "Verifier idle watchdog in milliseconds; use none/off to disable when an external heartbeat exists." }
     ]
   },
   {
@@ -6355,7 +6695,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "worktreeMode", default: "auto", description: "Worktree isolation mode: auto, required, off, or main." },
       { name: "worktreeRoot", default: "~/.hasna/loops/worktrees", description: "Base directory for OpenLoops-managed git worktrees." },
       { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated bounded-agent worktree branches." },
-      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." },
+      { name: "verifierIdleTimeoutMs", default: "900000", description: "Verifier idle watchdog in milliseconds; use none/off to disable when an external heartbeat exists." }
     ]
   },
   {
@@ -6374,8 +6715,10 @@ var TEMPLATE_SUMMARIES = [
       { name: "accountPool", description: "Comma-separated OpenAccounts profiles for non-Codewith providers." },
       { name: "provider", default: "codewith", description: "Agent provider." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
+      { name: "prHandoff", default: "false", description: "Add a bounded network-enabled PR handoff task step after the worker." },
       { name: "worktreeMode", default: "required", description: "Worktree isolation mode." },
-      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." },
+      { name: "verifierIdleTimeoutMs", default: "900000", description: "Verifier idle watchdog in milliseconds; use none/off to disable when an external heartbeat exists." }
     ]
   },
   {
@@ -6390,7 +6733,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "authProfilePool", description: "Comma-separated Codewith profiles for worker/verifier rotation." },
       { name: "provider", default: "codewith", description: "Agent provider." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
-      { name: "worktreeMode", default: "required", description: "Worktree isolation mode." }
+      { name: "worktreeMode", default: "required", description: "Worktree isolation mode." },
+      { name: "verifierIdleTimeoutMs", default: "900000", description: "Verifier idle watchdog in milliseconds; use none/off to disable when an external heartbeat exists." }
     ]
   },
   {
@@ -6404,7 +6748,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "authProfilePool", description: "Comma-separated Codewith profiles for worker/verifier rotation." },
       { name: "provider", default: "codewith", description: "Agent provider." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
-      { name: "worktreeMode", default: "required", description: "Worktree isolation mode." }
+      { name: "worktreeMode", default: "required", description: "Worktree isolation mode." },
+      { name: "verifierIdleTimeoutMs", default: "900000", description: "Verifier idle watchdog in milliseconds; use none/off to disable when an external heartbeat exists." }
     ]
   },
   {
@@ -6418,7 +6763,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "authProfilePool", description: "Comma-separated Codewith profiles for worker/verifier rotation." },
       { name: "provider", default: "codewith", description: "Agent provider." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
-      { name: "worktreeMode", default: "required", description: "Worktree isolation mode." }
+      { name: "worktreeMode", default: "required", description: "Worktree isolation mode." },
+      { name: "verifierIdleTimeoutMs", default: "900000", description: "Verifier idle watchdog in milliseconds; use none/off to disable when an external heartbeat exists." }
     ]
   },
   {
@@ -6432,7 +6778,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "authProfilePool", description: "Comma-separated Codewith profiles for worker/verifier rotation." },
       { name: "provider", default: "codewith", description: "Agent provider." },
       { name: "sandbox", default: "read-only", description: "Provider sandbox mode." },
-      { name: "worktreeMode", default: "main", description: "Report-only workflows normally inspect the main checkout read-only." }
+      { name: "worktreeMode", default: "main", description: "Report-only workflows normally inspect the main checkout read-only." },
+      { name: "verifierIdleTimeoutMs", default: "900000", description: "Verifier idle watchdog in milliseconds; use none/off to disable when an external heartbeat exists." }
     ]
   },
   {
@@ -6447,7 +6794,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "authProfilePool", description: "Comma-separated Codewith profiles for worker/verifier rotation." },
       { name: "provider", default: "codewith", description: "Agent provider." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
-      { name: "worktreeMode", default: "required", description: "Worktree isolation mode." }
+      { name: "worktreeMode", default: "required", description: "Worktree isolation mode." },
+      { name: "verifierIdleTimeoutMs", default: "900000", description: "Verifier idle watchdog in milliseconds; use none/off to disable when an external heartbeat exists." }
     ]
   },
   {
@@ -6481,9 +6829,25 @@ function taskLabel(input) {
   return head.length > 160 ? `${head.slice(0, 157)}...` : head;
 }
 var UNLIMITED_AGENT_TIMEOUT_MS = null;
+var DEFAULT_VERIFIER_IDLE_TIMEOUT_MS = 15 * 60000;
 function agentTimeoutMs(input) {
   return input.timeoutMs === undefined ? UNLIMITED_AGENT_TIMEOUT_MS : input.timeoutMs;
 }
+function verifierIdleTimeoutMs(input) {
+  if (input.verifierIdleTimeoutMs === undefined)
+    return DEFAULT_VERIFIER_IDLE_TIMEOUT_MS;
+  return input.verifierIdleTimeoutMs > 0 ? input.verifierIdleTimeoutMs : undefined;
+}
+function verifierRuntimeGuidance(input) {
+  const idleTimeout = verifierIdleTimeoutMs(input);
+  return [
+    "Verifier runtime contract:",
+    idleTimeout ? `- OpenLoops will mark this verifier timed_out after ${idleTimeout}ms without stdout/stderr. Emit a concise heartbeat/progress line before long checks.` : "- The verifier idle watchdog is disabled for this workflow; still emit concise progress before long checks.",
+    "- Keep final evidence compact: summarize changed files, validation commands/results, findings, and the task decision instead of pasting bulky logs.",
+    "- If validation cannot finish, record a clear blocked/failed task comment with the last completed check and the next concrete action."
+  ].join(`
+`);
+}
 function parseTemplateTimeoutMs(raw) {
   if (raw === undefined || raw.trim() === "")
     return;
@@ -6496,6 +6860,18 @@ function parseTemplateTimeoutMs(raw) {
   }
   return value;
 }
+function parseTemplateIdleTimeoutMs(raw) {
+  if (raw === undefined || raw.trim() === "")
+    return;
+  const normalized = raw.trim().toLowerCase();
+  if (["unlimited", "none", "null", "never", "off", "false"].includes(normalized))
+    return 0;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value <= 0) {
+    throw new Error("verifierIdleTimeoutMs must be a positive integer number of milliseconds, or none/off");
+  }
+  return value;
+}
 function parseDeterministicTimeoutMs(raw, fallbackMs, label = "timeoutMs") {
   if (raw === undefined || raw.trim() === "")
     return fallbackMs;
@@ -6556,6 +6932,179 @@ function stableHex(seed) {
 function shellQuote2(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+function prHandoffArtifactPath(plan, taskId) {
+  return join5(plan.cwd, ".openloops", "pr-handoff", `${slugSegment(taskId, "task")}.json`);
+}
+function prHandoffCommand(input, plan, todosProjectPath) {
+  const artifactPath = prHandoffArtifactPath(plan, input.taskId);
+  return [
+    "set -euo pipefail",
+    `export OPENLOOPS_PR_HANDOFF_ARTIFACT=${shellQuote2(artifactPath)}`,
+    `export OPENLOOPS_PR_HANDOFF_TASK_ID=${shellQuote2(input.taskId)}`,
+    `export OPENLOOPS_PR_HANDOFF_TODOS_PROJECT=${shellQuote2(todosProjectPath)}`,
+    `export OPENLOOPS_PR_HANDOFF_WORKTREE=${shellQuote2(plan.cwd)}`,
+    `export OPENLOOPS_PR_HANDOFF_WORKTREE_ROOT=${shellQuote2(plan.path ?? plan.cwd)}`,
+    `export OPENLOOPS_PR_HANDOFF_EXPECTED_BRANCH=${shellQuote2(plan.branch ?? "")}`,
+    'if [ ! -s "$OPENLOOPS_PR_HANDOFF_ARTIFACT" ]; then',
+    `  printf 'no PR handoff artifact at %s\\n' "$OPENLOOPS_PR_HANDOFF_ARTIFACT"`,
+    "  exit 0",
+    "fi",
+    "bun - <<'BUN'",
+    "const { readFileSync, realpathSync } = await import('node:fs');",
+    "const { spawnSync } = await import('node:child_process');",
+    "const artifactPath = process.env.OPENLOOPS_PR_HANDOFF_ARTIFACT || '';",
+    "const taskId = process.env.OPENLOOPS_PR_HANDOFF_TASK_ID || '';",
+    "const todosProject = process.env.OPENLOOPS_PR_HANDOFF_TODOS_PROJECT || '';",
+    "const fallbackWorktree = process.env.OPENLOOPS_PR_HANDOFF_WORKTREE || process.cwd();",
+    "const expectedRoot = process.env.OPENLOOPS_PR_HANDOFF_WORKTREE_ROOT || fallbackWorktree;",
+    "const expectedBranch = process.env.OPENLOOPS_PR_HANDOFF_EXPECTED_BRANCH || '';",
+    "const todosBin = process.env.OPENLOOPS_PR_HANDOFF_TODOS_BIN || 'todos';",
+    "const gitBin = process.env.OPENLOOPS_PR_HANDOFF_GIT_BIN || 'git';",
+    "const ghBin = process.env.OPENLOOPS_PR_HANDOFF_GH_BIN || 'gh';",
+    "const raw = readFileSync(artifactPath, 'utf8');",
+    "const artifact = JSON.parse(raw);",
+    "const stringField = (...keys) => {",
+    "  for (const key of keys) {",
+    "    const value = artifact[key];",
+    "    if (typeof value === 'string' && value.trim()) return value.trim();",
+    "  }",
+    "  return undefined;",
+    "};",
+    "const run = (command, args, options = {}) => spawnSync(command, args, { encoding: 'utf8', ...options });",
+    "const todosArgs = (...args) => todosProject ? ['--project', todosProject, ...args] : args;",
+    "const todos = (...args) => run(todosBin, todosArgs(...args));",
+    "const comment = (text) => {",
+    "  const result = todos('comment', taskId, text);",
+    "  if (result.status !== 0) console.error(`failed to comment original task: ${result.stderr || result.stdout || result.status}`);",
+    "};",
+    "const repoPath = stringField('worktreePath', 'localRepoPath', 'repoPath', 'cwd') || fallbackWorktree;",
+    "const artifactTaskId = stringField('taskId', 'sourceTaskId', 'originalTaskId');",
+    "const branch = stringField('branch', 'headBranch');",
+    "const base = stringField('base', 'baseBranch') || 'main';",
+    "const remote = stringField('remote') || 'origin';",
+    "let commit = stringField('commit', 'commitSha', 'sha');",
+    "const repo = stringField('githubRepo', 'repoSlug', 'repository');",
+    "const prUrl = stringField('prUrl', 'pullRequestUrl');",
+    "const title = stringField('title', 'prTitle') || `PR handoff for ${taskId}`;",
+    "const body = stringField('body', 'prBody') || [",
+    "  `OpenLoops PR handoff for task ${taskId}.`,",
+    "  `Commit: ${commit || 'unknown'}`,",
+    "  `Branch: ${branch || 'unknown'}`,",
+    "  artifact.validation ? `Validation: ${artifact.validation}` : undefined,",
+    "  artifact.error ? `Worker network error: ${artifact.error}` : undefined,",
+    "].filter(Boolean).join('\\n\\n');",
+    "const fingerprint = stringField('fingerprint') || `openloops:pr-handoff:${taskId}:${branch || 'missing-branch'}:${commit || 'missing-commit'}`;",
+    "const repoTagSource = (repo || stringField('repo', 'remoteUrl') || repoPath).split(/[/:]/).filter(Boolean).at(-1) || 'unknown';",
+    "const repoTag = `repo:${repoTagSource.toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'unknown'}`;",
+    "const metadata = {",
+    "  route_enabled: true,",
+    "  source: 'openloops.pr-handoff',",
+    "  original_task_id: taskId,",
+    "  repo: repo || stringField('repo', 'remoteUrl') || '',",
+    "  branch: branch || '',",
+    "  base,",
+    "  commit: commit || '',",
+    "  artifact_path: artifactPath,",
+    "  fingerprint,",
+    "  automation: { allowed: true, mode: 'auto' },",
+    "  no_tmux_dispatch: true,",
+    "};",
+    "const upsertTask = (why) => {",
+    "  const description = [",
+    "    `OpenLoops could not complete network PR handoff for original task ${taskId}.`,",
+    "    `Reason: ${why}`,",
+    "    `Fingerprint: ${fingerprint}`,",
+    "    `Repository: ${repo || stringField('repo', 'remoteUrl') || 'unknown'}`,",
+    "    `Worktree: ${repoPath}`,",
+    "    `Branch: ${branch || 'unknown'}`,",
+    "    `Base: ${base}`,",
+    "    `Commit: ${commit || 'unknown'}`,",
+    "    `Artifact: ${artifactPath}`,",
+    "    artifact.validation ? `Validation: ${artifact.validation}` : undefined,",
+    "    artifact.error ? `Worker error: ${artifact.error}` : undefined,",
+    "    'Do not rerun implementation work. Push the recorded commit/branch, open or update the PR, then comment the original task with the PR URL and validation evidence.',",
+    "  ].filter(Boolean).join('\\n\\n');",
+    "  const result = todos(",
+    "    'task',",
+    "    'upsert',",
+    "    '--fingerprint', fingerprint,",
+    "    '--title', `PR handoff for ${taskId}`,",
+    "    '-d', description,",
+    "    '-p', 'high',",
+    "    '-t', ['auto:route', 'pr-handoff', 'github', 'network', repoTag].join(','),",
+    "    '--metadata-json', JSON.stringify(metadata),",
+    "    '--working-dir', repoPath,",
+    "  );",
+    "  if (result.status !== 0) throw new Error(`todos task upsert failed: ${result.stderr || result.stdout || result.status}`);",
+    "  comment(`openloops:pr-handoff=pending task=${taskId} artifact=${artifactPath} fingerprint=${fingerprint} reason=${why}`);",
+    "  console.log(`queued PR handoff task fingerprint=${fingerprint}`);",
+    "};",
+    "const queueNetworkHandoff = (why) => { upsertTask(why); process.exit(0); };",
+    "const invalidArtifact = (why) => {",
+    "  comment(`openloops:pr-handoff=invalid task=${taskId} artifact=${artifactPath} reason=${why}`);",
+    "  console.error(`invalid PR handoff artifact: ${why}`);",
+    "  process.exit(0);",
+    "};",
+    "const canonicalPath = (path) => {",
+    "  try { return realpathSync(path); } catch { return path; }",
+    "};",
+    "if (artifactTaskId && artifactTaskId !== taskId) invalidArtifact(`artifact task id ${artifactTaskId} does not match expected ${taskId}`);",
+    "if (!branch || !commit) invalidArtifact('artifact missing branch or commit');",
+    "const topLevel = run(gitBin, ['-C', repoPath, 'rev-parse', '--show-toplevel']);",
+    "if (topLevel.status !== 0) invalidArtifact(`artifact repoPath is not a git worktree: ${String(topLevel.stderr || topLevel.stdout || topLevel.status).slice(0, 300)}`);",
+    "const actualRoot = canonicalPath(String(topLevel.stdout || '').trim());",
+    "const wantedRoot = canonicalPath(expectedRoot);",
+    "if (actualRoot !== wantedRoot) invalidArtifact(`artifact repo root mismatch: expected ${wantedRoot}, got ${actualRoot}`);",
+    "const currentBranch = run(gitBin, ['-C', repoPath, 'branch', '--show-current']);",
+    "const actualBranch = String(currentBranch.stdout || '').trim();",
+    "if (currentBranch.status !== 0 || !actualBranch) invalidArtifact(`could not resolve current branch for artifact repo: ${String(currentBranch.stderr || currentBranch.stdout || currentBranch.status).slice(0, 300)}`);",
+    "if (expectedBranch && branch !== expectedBranch) invalidArtifact(`artifact branch ${branch} does not match expected ${expectedBranch}`);",
+    "if (branch !== actualBranch) invalidArtifact(`artifact branch ${branch} does not match current worktree branch ${actualBranch}`);",
+    "const resolvedCommit = run(gitBin, ['-C', repoPath, 'rev-parse', '--verify', `${commit}^{commit}`]);",
+    "if (resolvedCommit.status !== 0) invalidArtifact(`artifact commit is not present in repo: ${String(resolvedCommit.stderr || resolvedCommit.stdout || resolvedCommit.status).slice(0, 300)}`);",
+    "commit = String(resolvedCommit.stdout || commit).trim();",
+    "const reachable = run(gitBin, ['-C', repoPath, 'merge-base', '--is-ancestor', commit, 'HEAD']);",
+    "if (reachable.status !== 0) invalidArtifact(`artifact commit ${commit} is not reachable from HEAD`);",
+    "if (prUrl) {",
+    `  const viewed = run(ghBin, ['pr', 'view', prUrl, '--json', 'url,headRefName', '--jq', '.url + "\\\\n" + .headRefName']);`,
+    "  if (viewed.status !== 0) queueNetworkHandoff(`could not verify existing PR URL: ${String(viewed.stderr || viewed.stdout || viewed.status).slice(0, 300)}`);",
+    "  const [verifiedUrl, verifiedHead] = String(viewed.stdout || '').trim().split(/\\r?\\n/);",
+    "  if (!verifiedUrl || !/^https?:\\/\\//.test(verifiedUrl)) invalidArtifact('verified PR URL was missing or invalid');",
+    "  if (verifiedHead && verifiedHead !== branch) invalidArtifact(`verified PR head ${verifiedHead} does not match artifact branch ${branch}`);",
+    "  comment(`openloops:pr-handoff=done task=${taskId} pr=${verifiedUrl} commit=${commit} branch=${branch}`);",
+    "  console.log(`PR handoff already complete: ${verifiedUrl}`);",
+    "  process.exit(0);",
+    "}",
+    "const push = run(gitBin, ['-C', repoPath, 'push', remote, `${commit}:refs/heads/${branch}`]);",
+    "if (push.status !== 0) {",
+    "  upsertTask(`git push failed: ${String(push.stderr || push.stdout || push.status).slice(0, 300)}`);",
+    "  process.exit(0);",
+    "}",
+    "const ghRepoArgs = repo ? ['--repo', repo] : [];",
+    "const existing = run(ghBin, ['pr', 'list', ...ghRepoArgs, '--head', branch, '--state', 'all', '--json', 'url', '--jq', '.[0].url']);",
+    "let finalPrUrl = existing.status === 0 ? String(existing.stdout || '').trim() : '';",
+    "if (!finalPrUrl) {",
+    "  const created = run(ghBin, ['pr', 'create', ...ghRepoArgs, '--base', base, '--head', branch, '--title', title, '--body', body], { cwd: repoPath });",
+    "  if (created.status !== 0) {",
+    "    upsertTask(`gh pr create failed: ${String(created.stderr || created.stdout || created.status).slice(0, 300)}`);",
+    "    process.exit(0);",
+    "  }",
+    "  finalPrUrl = String(created.stdout || '').trim().split(/\\r?\\n/).find((line) => /^https?:\\/\\//.test(line)) || String(created.stdout || '').trim();",
+    "}",
+    "comment(`openloops:pr-handoff=done task=${taskId} pr=${finalPrUrl} commit=${commit} branch=${branch}`);",
+    "console.log(`PR handoff complete: ${finalPrUrl}`);",
+    "BUN"
+  ].join(`
+`);
+}
+function sourceTaskGateCommand(todosProjectPath, taskId) {
+  return [
+    "set -euo pipefail",
+    `todos --project ${shellQuote2(todosProjectPath)} --json inspect ${shellQuote2(taskId)} >/dev/null`,
+    `printf "source task %s resolved in todos project %s\\n" ${shellQuote2(taskId)} ${shellQuote2(todosProjectPath)}`
+  ].join(`
+`);
+}
 function normalizeWorktreeMode(mode) {
   const value = mode ?? "auto";
   if (!["auto", "required", "off", "main"].includes(value)) {
@@ -6571,7 +7120,7 @@ function defaultWorktreeRoot(root) {
   return join5(homedir3(), ".hasna", "loops", "worktrees");
 }
 function gitRootFor(path) {
-  if (!existsSync4(path))
+  if (!existsSync5(path))
     return;
   try {
     return execFileSync("git", ["-C", path, "rev-parse", "--show-toplevel"], {
@@ -6583,7 +7132,7 @@ function gitRootFor(path) {
   }
 }
 function gitCommonDirFor(path) {
-  if (!existsSync4(path))
+  if (!existsSync5(path))
     return;
   try {
     const raw = execFileSync("git", ["-C", path, "rev-parse", "--git-common-dir"], {
@@ -6795,7 +7344,8 @@ function agentTarget(input, prompt, role, seed, plan) {
       ...input.projectGroup ? { projectGroup: input.projectGroup } : {}
     },
     account: accountForRole(input, role, seed),
-    timeoutMs: agentTimeoutMs(input)
+    timeoutMs: agentTimeoutMs(input),
+    idleTimeoutMs: role === "verifier" ? verifierIdleTimeoutMs(input) : undefined
   };
 }
 function workflowStepsWithWorktree(plan, steps) {
@@ -6975,7 +7525,7 @@ function customTemplateSummary(definition, sourcePath) {
 function readCustomTemplateFile(file) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync3(file, "utf8"));
+    parsed = JSON.parse(readFileSync4(file, "utf8"));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`failed to read custom template ${file}: ${message}`);
@@ -7001,7 +7551,7 @@ function assertNoTemplateCollisions(entries) {
 }
 function loadCustomLoopTemplatesRaw() {
   const dir = customLoopTemplatesDir();
-  if (!existsSync4(dir))
+  if (!existsSync5(dir))
     return [];
   return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const file = join5(dir, entry.name);
@@ -7125,7 +7675,7 @@ function importCustomLoopTemplate(file, opts = {}) {
   const entry = readCustomTemplateFile(source);
   const dir = ensureCustomLoopTemplatesDir();
   const destination = join5(dir, `${entry.definition.id}.json`);
-  const replaced = existsSync4(destination);
+  const replaced = existsSync5(destination);
   const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve2(template.path) !== resolve2(destination));
   assertNoTemplateCollisions([...existing, { ...entry, path: destination, summary: customTemplateSummary(entry.definition, destination) }]);
   if (replaced) {
@@ -7221,6 +7771,7 @@ function renderTodosTaskWorkerVerifierWorkflow(input) {
     `- Record verification: todos --project ${todosProjectPath} comment ${input.taskId} "<verification evidence or blocker>"`,
     `- If valid and complete: todos --project ${todosProjectPath} done ${input.taskId}`,
     "Use fresh context. Inspect the task, repository state, commits, tests, and worker evidence. Act as an adversarial reviewer focused on correctness, regressions, missing tests, security, and incomplete requirements.",
+    verifierRuntimeGuidance(input),
     "If the work is valid, record verification evidence in todos and mark/leave the task in the correct completed state according to the todos CLI. If it is not valid, add precise follow-up tasks or comments and leave the original task open or blocked with clear evidence.",
     "Do not dispatch or paste prompts into tmux panes. If additional work is required, create or update deduped todos tasks so task-created routing can start a fresh headless workflow.",
     "Do not make broad unrelated changes. Only apply tiny verification fixes when they are necessary and low risk; otherwise create follow-up tasks.",
@@ -7233,10 +7784,24 @@ function renderTodosTaskWorkerVerifierWorkflow(input) {
     description: `Task-triggered worker/verifier workflow for ${taskLabel(input)}`,
     version: 1,
     steps: workflowStepsWithWorktree(plan, [
+      {
+        id: "source-task-gate",
+        name: "Source Task Gate",
+        description: "Fail before worker execution when the source todos task is not resolvable.",
+        target: {
+          type: "command",
+          command: "bash",
+          args: ["-lc", sourceTaskGateCommand(todosProjectPath, input.taskId)],
+          cwd: plan.cwd,
+          timeoutMs: 60000
+        },
+        timeoutMs: 60000
+      },
       {
         id: "worker",
         name: "Worker",
         description: "Implement the todos task and record evidence.",
+        dependsOn: ["source-task-gate"],
         target: agentTarget(input, workerPrompt, "worker", input.taskId, plan),
         timeoutMs: agentTimeoutMs(input)
       },
@@ -7277,6 +7842,14 @@ function renderTaskLifecycleWorkflow(input) {
       reason: plan.reason
     }
   };
+  const handoffArtifactPath = prHandoffArtifactPath(plan, input.taskId);
+  const prHandoffGuidance = input.prHandoff ? [
+    "PR handoff mode is enabled for this lifecycle.",
+    `If implementation and validation pass but git push or gh PR creation fails because DNS, network, or sandbox policy blocks GitHub access, write a JSON artifact to: ${handoffArtifactPath}`,
+    "The artifact must include taskId, worktreePath or repoPath, branch, base, commit, remote, validation, and error. Include githubRepo, title, and body when known.",
+    "After writing the artifact, comment the source task with the artifact path and exit without marking the task done. The bounded PR handoff step will push/open the PR or queue a network-enabled handoff task without rerunning implementation."
+  ].join(`
+`) : "";
   const shared = [
     worktreePrompt(plan),
     `Todos project path: ${todosProjectPath}`,
@@ -7286,7 +7859,8 @@ function renderTaskLifecycleWorkflow(input) {
     "Do not dispatch or paste prompts into tmux panes. If additional work is required, create or update deduped todos tasks so task-created routing can start a fresh headless workflow.",
     "Preserve unrelated user changes and keep scope tied to the task acceptance criteria.",
     "",
-    `Task context JSON: ${compactJson(taskContext)}`
+    `Task context JSON: ${compactJson(taskContext)}`,
+    prHandoffGuidance
   ].join(`
 `);
   const gateMarker = (stage, state) => `openloops:${stage}=${state} task=${input.taskId}${input.eventId ? ` event=${input.eventId}` : ""}`;
@@ -7330,7 +7904,7 @@ function renderTaskLifecycleWorkflow(input) {
     "const latestMarker = markers.at(-1)?.state;",
     "const blockers = [];",
     "if (blockedStatuses.has(status)) blockers.push(`task status is ${status}`);",
-    "for (const tag of ['no-auto', 'manual', 'manual-required', 'approval-required']) {",
+    "for (const tag of ['no-auto', 'manual', 'manual-required', 'approval-required', 'blocked', 'completed', 'done', 'cancelled', 'canceled', 'failed', 'archived']) {",
     "  if (tags.has(tag)) blockers.push(`task has disallowed tag ${tag}`);",
     "}",
     "for (const [key, source] of records.entries()) {",
@@ -7359,7 +7933,7 @@ function renderTaskLifecycleWorkflow(input) {
     "Include the triage decision, duplicates/dependencies found, and any follow-up tasks created in that same comment.",
     `If the task should not proceed automatically, run: todos --project ${todosProjectPath} update ${input.taskId} --status blocked`,
     `Then add a task comment whose first line is exactly: ${gateMarker("triage", "blocked")}`,
-    "The deterministic triage gate will stop later steps unless the latest triage marker is the exact go marker and the task has no blocked/no-auto/manual/approval-required state."
+    "The deterministic triage gate will stop later steps unless the latest triage marker is the exact go marker and the task has no blocked/completed/done/cancelled/failed/archived/no-auto/manual/approval-required state."
   ].join(`
 `);
   const plannerPrompt = [
@@ -7372,7 +7946,7 @@ function renderTaskLifecycleWorkflow(input) {
     "In that same comment, include a concise implementation plan: files/areas to inspect, validation commands, risk checks, expected commit/PR behavior, and any cross-repo tasks that should be created separately.",
     `Do not implement repo changes in this step. If the task is too broad or unsafe for automation, run: todos --project ${todosProjectPath} update ${input.taskId} --status blocked`,
     `Then add a task comment whose first line is exactly: ${gateMarker("planner", "blocked")}`,
-    "Create smaller deduped tasks and record evidence. The deterministic planner gate will stop the worker unless the latest planner marker is the exact go marker and the task has no blocked/no-auto/manual/approval-required state."
+    "Create smaller deduped tasks and record evidence. The deterministic planner gate will stop the worker unless the latest planner marker is the exact go marker and the task has no blocked/completed/done/cancelled/failed/archived/no-auto/manual/approval-required state."
   ].join(`
 `);
   const workerPrompt = [
@@ -7382,8 +7956,9 @@ function renderTaskLifecycleWorkflow(input) {
     shared,
     `- Claim/start if appropriate: todos --project ${todosProjectPath} start ${input.taskId}`,
     "Read the triage and planner comments first. Implement only the scoped task, run focused validation, and record changed files, commits, evidence, blockers, and residual risks.",
+    input.prHandoff ? `When only GitHub network access is blocked after a successful commit/validation, record the handoff artifact at ${handoffArtifactPath} instead of repeatedly retrying push/PR creation.` : undefined,
     "Do not mark the task complete in the worker step; the verifier step owns completion after independent validation."
-  ].join(`
+  ].filter(Boolean).join(`
 `);
   const verifierPrompt = [
     `/goal Verify todos task ${input.taskId} after the full lifecycle worker step.`,
@@ -7393,75 +7968,108 @@ function renderTaskLifecycleWorkflow(input) {
     `- Record verification: todos --project ${todosProjectPath} comment ${input.taskId} "<verification evidence or blocker>"`,
     `- If valid and complete: todos --project ${todosProjectPath} done ${input.taskId}`,
     "Use fresh context. Inspect triage, plan, worker evidence, repo state, commits, tests, and acceptance criteria. Act as an adversarial reviewer focused on correctness, regressions, missing tests, security, and incomplete requirements.",
+    verifierRuntimeGuidance(input),
+    input.prHandoff ? `If ${handoffArtifactPath} exists and there is no PR URL evidence, verify that the PR handoff step queued or completed a bounded handoff; leave the original task open or blocked until PR evidence is recorded.` : undefined,
     "If the work is valid, record verification evidence in todos and mark/leave the task completed according to the todos CLI. If not valid, add precise follow-up tasks or comments and leave the original task open or blocked with clear evidence.",
     "Do not make broad unrelated changes. Only apply tiny verification fixes when they are necessary and low risk; otherwise create follow-up tasks."
-  ].join(`
+  ].filter(Boolean).join(`
 `);
-  return {
-    name: `task-lifecycle-${input.taskId.slice(0, 8)}-triage-plan-worker-verifier`,
-    description: `Full task lifecycle workflow for ${taskLabel(input)}`,
-    version: 1,
-    steps: workflowStepsWithWorktree(plan, [
-      {
-        id: "triage",
-        name: "Triage",
-        description: "Check task eligibility, duplicates, dependencies, and automation gates.",
-        target: agentTarget(input, triagePrompt, "triage", input.taskId, plan),
-        timeoutMs: agentTimeoutMs(input)
+  const steps = [
+    {
+      id: "source-task-gate",
+      name: "Source Task Gate",
+      description: "Fail before lifecycle agents execute when the source todos task is not resolvable.",
+      target: {
+        type: "command",
+        command: "bash",
+        args: ["-lc", sourceTaskGateCommand(todosProjectPath, input.taskId)],
+        cwd: plan.cwd,
+        timeoutMs: 60000
       },
-      {
-        id: "triage-gate",
-        name: "Triage Gate",
-        description: "Stop the lifecycle before planning when triage blocked or disallowed automation.",
-        dependsOn: ["triage"],
-        target: {
-          type: "command",
-          command: "bash",
-          args: ["-lc", gateCommand("triage")],
-          cwd: plan.cwd,
-          timeoutMs: 2 * 60000
-        },
+      timeoutMs: 60000
+    },
+    {
+      id: "triage",
+      name: "Triage",
+      description: "Check task eligibility, duplicates, dependencies, and automation gates.",
+      dependsOn: ["source-task-gate"],
+      target: agentTarget(input, triagePrompt, "triage", input.taskId, plan),
+      timeoutMs: agentTimeoutMs(input)
+    },
+    {
+      id: "triage-gate",
+      name: "Triage Gate",
+      description: "Stop the lifecycle before planning when triage blocked or disallowed automation.",
+      dependsOn: ["triage"],
+      target: {
+        type: "command",
+        command: "bash",
+        args: ["-lc", gateCommand("triage")],
+        cwd: plan.cwd,
         timeoutMs: 2 * 60000
       },
-      {
-        id: "planner",
-        name: "Planner",
-        description: "Create a concise implementation plan and split unsafe scope before work starts.",
-        dependsOn: ["triage-gate"],
-        target: agentTarget(input, plannerPrompt, "planner", input.taskId, plan),
-        timeoutMs: agentTimeoutMs(input)
-      },
-      {
-        id: "planner-gate",
-        name: "Planner Gate",
-        description: "Stop the lifecycle before implementation when planning blocked or disallowed automation.",
-        dependsOn: ["planner"],
-        target: {
-          type: "command",
-          command: "bash",
-          args: ["-lc", gateCommand("planner")],
-          cwd: plan.cwd,
-          timeoutMs: 2 * 60000
-        },
+      timeoutMs: 2 * 60000
+    },
+    {
+      id: "planner",
+      name: "Planner",
+      description: "Create a concise implementation plan and split unsafe scope before work starts.",
+      dependsOn: ["triage-gate"],
+      target: agentTarget(input, plannerPrompt, "planner", input.taskId, plan),
+      timeoutMs: agentTimeoutMs(input)
+    },
+    {
+      id: "planner-gate",
+      name: "Planner Gate",
+      description: "Stop the lifecycle before implementation when planning blocked or disallowed automation.",
+      dependsOn: ["planner"],
+      target: {
+        type: "command",
+        command: "bash",
+        args: ["-lc", gateCommand("planner")],
+        cwd: plan.cwd,
         timeoutMs: 2 * 60000
       },
-      {
-        id: "worker",
-        name: "Worker",
-        description: "Implement the todos task according to triage and planner evidence.",
-        dependsOn: ["planner-gate"],
-        target: agentTarget(input, workerPrompt, "worker", input.taskId, plan),
-        timeoutMs: agentTimeoutMs(input)
+      timeoutMs: 2 * 60000
+    },
+    {
+      id: "worker",
+      name: "Worker",
+      description: "Implement the todos task according to triage and planner evidence.",
+      dependsOn: ["planner-gate"],
+      target: agentTarget(input, workerPrompt, "worker", input.taskId, plan),
+      timeoutMs: agentTimeoutMs(input)
+    }
+  ];
+  if (input.prHandoff) {
+    steps.push({
+      id: "pr-handoff",
+      name: "PR Handoff",
+      description: "Push/open a PR from a worker handoff artifact or queue a bounded network handoff task.",
+      dependsOn: ["worker"],
+      target: {
+        type: "command",
+        command: "bash",
+        args: ["-lc", prHandoffCommand(input, plan, todosProjectPath)],
+        cwd: plan.cwd,
+        timeoutMs: 2 * 60000
       },
-      {
-        id: "verifier",
-        name: "Verifier",
-        description: "Adversarially verify worker output and update todos.",
-        dependsOn: ["worker"],
-        target: agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
-        timeoutMs: agentTimeoutMs(input)
-      }
-    ])
+      timeoutMs: 2 * 60000
+    });
+  }
+  steps.push({
+    id: "verifier",
+    name: "Verifier",
+    description: "Adversarially verify worker output and update todos.",
+    dependsOn: [input.prHandoff ? "pr-handoff" : "worker"],
+    target: agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
+    timeoutMs: agentTimeoutMs(input)
+  });
+  return {
+    name: `task-lifecycle-${input.taskId.slice(0, 8)}-triage-plan-worker-verifier`,
+    description: `Full task lifecycle workflow for ${taskLabel(input)}`,
+    version: 1,
+    steps: workflowStepsWithWorktree(plan, steps)
   };
 }
 function renderEventWorkerVerifierWorkflow(input) {
@@ -7513,6 +8121,7 @@ function renderEventWorkerVerifierWorkflow(input) {
     "You are the verifier agent for an event-triggered OpenLoops workflow.",
     worktreePrompt(plan),
     "Use fresh context. Inspect the event, repository/project state, worker evidence, tests, and any created tasks or notes. Act as an adversarial reviewer focused on correctness, regressions, security, missing evidence, and incomplete requirements.",
+    verifierRuntimeGuidance(input),
     "If the work is valid, record verification evidence in the relevant local system. If it is not valid, add precise follow-up tasks/comments and leave the event handling state open or blocked with clear evidence.",
     "",
     `Event context JSON: ${compactJson(eventContext)}`,
@@ -7567,6 +8176,7 @@ function renderBoundedAgentWorkerVerifierWorkflow(input) {
     "You are the verifier step for a bounded OpenLoops agent workflow.",
     worktreePrompt(plan),
     "Use fresh context. Review the worker result for correctness, regressions, missing tests, safety, runaway-agent risk, output bounds, and incomplete evidence.",
+    verifierRuntimeGuidance(input),
     "If valid, record verification evidence. If invalid, create precise follow-up tasks or comments and leave the original work open. Do not make broad unrelated changes."
   ].join(`
 `);
@@ -7617,7 +8227,8 @@ function renderLifecycleBoundedTemplate(id, values) {
     worktreeMode: values.worktreeMode ?? (id === REPORT_ONLY_TEMPLATE_ID ? "main" : "required"),
     worktreeRoot: values.worktreeRoot,
     worktreeBranchPrefix: values.worktreeBranchPrefix,
-    timeoutMs: parseTemplateTimeoutMs(values.timeoutMs)
+    timeoutMs: parseTemplateTimeoutMs(values.timeoutMs),
+    verifierIdleTimeoutMs: parseTemplateIdleTimeoutMs(values.verifierIdleTimeoutMs ?? values.verifierIdleTimeout)
   };
   if (id === TASK_LIFECYCLE_TEMPLATE_ID) {
     const taskId = values.taskId ?? "";
@@ -7651,10 +8262,12 @@ function renderLifecycleBoundedTemplate(id, values) {
       permissionMode: values.permissionMode,
       sandbox: values.sandbox,
       manualBreakGlass: booleanVar(values.manualBreakGlass),
+      prHandoff: booleanVar(values.prHandoff),
       worktreeMode: values.worktreeMode ?? "required",
       worktreeRoot: values.worktreeRoot,
       worktreeBranchPrefix: values.worktreeBranchPrefix,
       timeoutMs: parseTemplateTimeoutMs(values.timeoutMs),
+      verifierIdleTimeoutMs: parseTemplateIdleTimeoutMs(values.verifierIdleTimeoutMs ?? values.verifierIdleTimeout),
       eventId: values.eventId,
       eventType: values.eventType
     });
@@ -7779,6 +8392,7 @@ function renderBuiltinLoopTemplate(id, values) {
       worktreeRoot: values.worktreeRoot,
       worktreeBranchPrefix: values.worktreeBranchPrefix,
       timeoutMs: parseTemplateTimeoutMs(values.timeoutMs),
+      verifierIdleTimeoutMs: parseTemplateIdleTimeoutMs(values.verifierIdleTimeoutMs ?? values.verifierIdleTimeout),
       eventId: values.eventId,
       eventType: values.eventType
     });
@@ -7811,7 +8425,8 @@ function renderBuiltinLoopTemplate(id, values) {
       worktreeMode: values.worktreeMode,
       worktreeRoot: values.worktreeRoot,
       worktreeBranchPrefix: values.worktreeBranchPrefix,
-      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs)
+      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs),
+      verifierIdleTimeoutMs: parseTemplateIdleTimeoutMs(values.verifierIdleTimeoutMs ?? values.verifierIdleTimeout)
     });
   }
   if (id === BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID) {
@@ -7839,7 +8454,8 @@ function renderBuiltinLoopTemplate(id, values) {
       worktreeMode: values.worktreeMode,
       worktreeRoot: values.worktreeRoot,
       worktreeBranchPrefix: values.worktreeBranchPrefix,
-      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs)
+      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs),
+      verifierIdleTimeoutMs: parseTemplateIdleTimeoutMs(values.verifierIdleTimeoutMs ?? values.verifierIdleTimeout)
     });
   }
   throw new Error(`unknown template: ${id}`);
@@ -7946,7 +8562,7 @@ function normalizeWorkflowForStorage(body, context) {
 function workflowBodyFromFile(file, fallbackName, context) {
   try {
     const resolved = resolve3(file);
-    return workflowBodyFromJson(JSON.parse(readFileSync4(resolved, "utf8")), fallbackName, { baseDir: dirname4(resolved) });
+    return workflowBodyFromJson(JSON.parse(readFileSync5(resolved, "utf8")), fallbackName, { baseDir: dirname4(resolved) });
   } catch (error) {
     validationFailed(error, context);
   }
@@ -8021,6 +8637,21 @@ function workflowTimeoutMigrationName(workflow, timeoutMs) {
   const suffix = randomUUID().replace(/-/g, "").slice(0, 8);
   return `${workflow.name}-${policy}-${suffix}`;
 }
+function workflowWithoutGoalWrapper(workflow, opts = {}) {
+  return {
+    body: {
+      name: opts.name ?? workflow.name,
+      description: workflow.description,
+      version: workflow.version,
+      steps: workflow.steps
+    },
+    changed: workflow.goal !== undefined
+  };
+}
+function workflowGoalWrapperMigrationName(workflow) {
+  const suffix = randomUUID().replace(/-/g, "").slice(0, 8);
+  return `${workflow.name}-no-workflow-goal-${suffix}`;
+}
 function printTextOutput(value) {
   for (const line of textOutputBlocks(value, { indent: "  " }))
     console.log(line);
@@ -8072,6 +8703,10 @@ function timeoutDuration(raw, label) {
     throw new Error(`${label} must be a duration greater than zero, or none/unlimited`);
   return value;
 }
+function idleTimeoutDuration(raw, label) {
+  const value = timeoutDuration(raw, label);
+  return value === null ? undefined : value;
+}
 function parsePolicy(opts) {
   const catchUp = opts.catchUp ?? "latest";
   if (!["none", "latest", "all"].includes(catchUp))
@@ -8088,6 +8723,45 @@ function parsePolicy(opts) {
     leaseMs: positiveDuration(opts.lease, "--lease")
   };
 }
+function durationLabel(ms) {
+  if (!ms || !Number.isFinite(ms))
+    return "";
+  const units = [
+    [7 * 24 * 60 * 60 * 1000, "w"],
+    [24 * 60 * 60 * 1000, "d"],
+    [60 * 60 * 1000, "h"],
+    [60 * 1000, "m"],
+    [1000, "s"]
+  ];
+  for (const [unitMs, label] of units) {
+    if (ms % unitMs === 0)
+      return `${ms / unitMs}${label}`;
+  }
+  return `${ms}ms`;
+}
+function scheduleLabel(schedule) {
+  if (schedule.type === "once")
+    return `once:${schedule.at}`;
+  if (schedule.type === "interval")
+    return `every:${durationLabel(schedule.everyMs) || `${schedule.everyMs}ms`}`;
+  if (schedule.type === "cron")
+    return `cron:${schedule.expression}`;
+  return schedule.minIntervalMs ? `dynamic:min-${durationLabel(schedule.minIntervalMs) || `${schedule.minIntervalMs}ms`}` : "dynamic";
+}
+function targetLabel(target) {
+  if (target.type === "command")
+    return `runs command ${target.command}`;
+  if (target.type === "agent")
+    return `runs ${target.provider} agent${target.cwd ? ` in ${target.cwd}` : ""}`;
+  return `runs workflow ${target.workflowId}`;
+}
+function defaultLoopDescription(name, schedule, target) {
+  return [
+    `Why: keep ${name} running as an OpenLoops scheduled automation.`,
+    `How: ${targetLabel(target)} on cadence ${scheduleLabel(schedule)}.`,
+    "Outcome: record each run, status, retries, and evidence in OpenLoops for operator review."
+  ].join(" ");
+}
 function baseCreateInput(name, opts, target) {
   const schedule = parseSchedule({
     at: typeof opts.at === "string" ? opts.at : undefined,
@@ -8103,9 +8777,10 @@ function baseCreateInput(name, opts, target) {
     retryDelay: typeof opts.retryDelay === "string" ? opts.retryDelay : undefined,
     lease: typeof opts.lease === "string" ? opts.lease : undefined
   });
+  const explicitDescription = typeof opts.description === "string" && opts.description.trim() ? opts.description : undefined;
   return {
     name,
-    description: typeof opts.description === "string" ? opts.description : undefined,
+    description: explicitDescription ?? defaultLoopDescription(name, schedule, target),
     schedule,
     target,
     goal: goalFromOpts(opts),
@@ -8228,7 +8903,7 @@ function runLocalCommandWithStdoutFile(command, args, opts = {}) {
     return {
       ok: result.status === 0,
       status: result.status,
-      stdout: readFileSync4(stdoutPath, "utf8"),
+      stdout: readFileSync5(stdoutPath, "utf8"),
       stderr: typeof result.stderr === "string" ? result.stderr : result.stderr?.toString() || "",
       error: result.error ? String(result.error.message || result.error) : ""
     };
@@ -8269,10 +8944,10 @@ function routeCursorsPath() {
 }
 function readRouteCursors() {
   const path = routeCursorsPath();
-  if (!existsSync5(path))
+  if (!existsSync6(path))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    const parsed = JSON.parse(readFileSync5(path, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
@@ -8436,31 +9111,46 @@ function taskEventField(data, keys) {
   }
   return;
 }
-function objectField(value) {
+function objectField2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
 }
 function nestedObject(input, key) {
-  return objectField(input[key]);
+  return objectField2(input[key]);
 }
 function taskEventRecords(data, metadata) {
   const records = [data];
   const dataTask = nestedObject(data, "task");
-  if (dataTask)
+  if (dataTask) {
     records.push(dataTask);
+    const dataTaskMetadata = nestedObject(dataTask, "metadata");
+    if (dataTaskMetadata)
+      records.push(dataTaskMetadata);
+  }
   const dataPayload = nestedObject(data, "payload");
   if (dataPayload) {
     records.push(dataPayload);
+    const payloadMetadata = nestedObject(dataPayload, "metadata");
+    if (payloadMetadata)
+      records.push(payloadMetadata);
     const payloadTask = nestedObject(dataPayload, "task");
-    if (payloadTask)
+    if (payloadTask) {
       records.push(payloadTask);
+      const payloadTaskMetadata = nestedObject(payloadTask, "metadata");
+      if (payloadTaskMetadata)
+        records.push(payloadTaskMetadata);
+    }
   }
   const dataMetadata = nestedObject(data, "metadata");
   if (dataMetadata)
     records.push(dataMetadata);
   records.push(metadata);
   const metadataTask = nestedObject(metadata, "task");
-  if (metadataTask)
+  if (metadataTask) {
     records.push(metadataTask);
+    const metadataTaskMetadata = nestedObject(metadataTask, "metadata");
+    if (metadataTaskMetadata)
+      records.push(metadataTaskMetadata);
+  }
   const metadataAutomation = nestedObject(metadata, "automation");
   if (metadataAutomation)
     records.push(metadataAutomation);
@@ -8472,6 +9162,15 @@ function booleanLike(value) {
 function hasTruthyField(records, keys) {
   return records.some((record) => keys.some((key) => booleanLike(record[key])));
 }
+function firstTruthyField(records, keys) {
+  for (const record of records) {
+    for (const key of keys) {
+      if (booleanLike(record[key]))
+        return key;
+    }
+  }
+  return;
+}
 function automationRecords(data, metadata) {
   const records = [];
   const dataAutomation = nestedObject(data, "automation");
@@ -8481,14 +9180,26 @@ function automationRecords(data, metadata) {
   const dataTaskAutomation = dataTask ? nestedObject(dataTask, "automation") : undefined;
   if (dataTaskAutomation)
     records.push(dataTaskAutomation);
+  const dataTaskMetadata = dataTask ? nestedObject(dataTask, "metadata") : undefined;
+  const dataTaskMetadataAutomation = dataTaskMetadata ? nestedObject(dataTaskMetadata, "automation") : undefined;
+  if (dataTaskMetadataAutomation)
+    records.push(dataTaskMetadataAutomation);
   const dataPayload = nestedObject(data, "payload");
   const payloadAutomation = dataPayload ? nestedObject(dataPayload, "automation") : undefined;
   if (payloadAutomation)
     records.push(payloadAutomation);
+  const payloadMetadata = dataPayload ? nestedObject(dataPayload, "metadata") : undefined;
+  const payloadMetadataAutomation = payloadMetadata ? nestedObject(payloadMetadata, "automation") : undefined;
+  if (payloadMetadataAutomation)
+    records.push(payloadMetadataAutomation);
   const payloadTask = dataPayload ? nestedObject(dataPayload, "task") : undefined;
   const payloadTaskAutomation = payloadTask ? nestedObject(payloadTask, "automation") : undefined;
   if (payloadTaskAutomation)
     records.push(payloadTaskAutomation);
+  const payloadTaskMetadata = payloadTask ? nestedObject(payloadTask, "metadata") : undefined;
+  const payloadTaskMetadataAutomation = payloadTaskMetadata ? nestedObject(payloadTaskMetadata, "automation") : undefined;
+  if (payloadTaskMetadataAutomation)
+    records.push(payloadTaskMetadataAutomation);
   const dataMetadata = nestedObject(data, "metadata");
   const dataMetadataAutomation = dataMetadata ? nestedObject(dataMetadata, "automation") : undefined;
   if (dataMetadataAutomation)
@@ -8500,9 +9211,13 @@ function automationRecords(data, metadata) {
   const metadataTaskAutomation = metadataTask ? nestedObject(metadataTask, "automation") : undefined;
   if (metadataTaskAutomation)
     records.push(metadataTaskAutomation);
+  const metadataTaskMetadata = metadataTask ? nestedObject(metadataTask, "metadata") : undefined;
+  const metadataTaskMetadataAutomation = metadataTaskMetadata ? nestedObject(metadataTaskMetadata, "automation") : undefined;
+  if (metadataTaskMetadataAutomation)
+    records.push(metadataTaskMetadataAutomation);
   return records;
 }
-function tagsFromValue(value) {
+function tagsFromValue2(value) {
   if (Array.isArray(value))
     return value.map((entry) => String(entry).trim()).filter(Boolean);
   if (typeof value === "string")
@@ -8512,40 +9227,381 @@ function tagsFromValue(value) {
 function taskEventTags(records) {
   const tags = new Set;
   for (const record of records) {
-    for (const tag of tagsFromValue(record.tags ?? record.task_tags ?? record.taskTags))
+    for (const tag of tagsFromValue2(record.tags ?? record.task_tags ?? record.taskTags))
       tags.add(tag);
   }
   return [...tags];
 }
+var ROUTE_DISALLOWED_TASK_TAGS = new Set([
+  "no-auto",
+  "manual",
+  "manual-required",
+  "approval-required",
+  "blocked",
+  "completed",
+  "done",
+  "cancelled",
+  "canceled",
+  "failed",
+  "archived"
+]);
+var ROUTE_MANUAL_GATE_FIELDS = [
+  "no_auto",
+  "noAuto",
+  "manual",
+  "manual_required",
+  "manualRequired",
+  "requires_approval",
+  "requiresApproval",
+  "approval_required",
+  "approvalRequired"
+];
 function taskRouteEligibility(data, metadata) {
   const records = taskEventRecords(data, metadata);
+  const automation = automationRecords(data, metadata);
   const tags = taskEventTags(records);
-  const hasRouteOptIn = tags.includes("auto:route") || hasTruthyField(records, ["route_enabled", "routeEnabled", "automation_allowed", "automationAllowed"]) || hasTruthyField(automationRecords(data, metadata), ["allowed"]);
+  const hasRouteOptIn = tags.includes("auto:route") || hasTruthyField(records, ["route_enabled", "routeEnabled", "automation_allowed", "automationAllowed"]) || hasTruthyField(automation, ["allowed"]);
   if (!hasRouteOptIn)
     return { eligible: false, reason: "missing explicit route opt-in", tags };
   const status = taskEventField(data, ["status", "task_status", "taskStatus"])?.toLowerCase();
   if (status && ["blocked", "completed", "done", "cancelled", "canceled", "failed", "archived"].includes(status)) {
     return { eligible: false, reason: `task status is not routable: ${status}`, tags };
   }
-  const disallowedTags = tags.filter((tag) => ["no-auto", "manual", "manual-required", "approval-required"].includes(tag));
+  const disallowedTags = tags.filter((tag) => ROUTE_DISALLOWED_TASK_TAGS.has(tag.toLowerCase()));
   if (disallowedTags.length)
     return { eligible: false, reason: `task has disallowed tag: ${disallowedTags[0]}`, tags };
-  if (hasTruthyField(records, [
-    "no_auto",
-    "noAuto",
-    "manual",
-    "manual_required",
-    "manualRequired",
-    "requires_approval",
-    "requiresApproval",
-    "approval_required",
-    "approvalRequired"
-  ])) {
-    return { eligible: false, reason: "task metadata requires manual or approval-gated handling", tags };
+  const manualGateField = firstTruthyField([...records, ...automation], ROUTE_MANUAL_GATE_FIELDS);
+  if (manualGateField) {
+    return { eligible: false, reason: `task metadata requires manual or approval-gated handling: ${manualGateField}`, tags };
   }
   return { eligible: true, tags };
 }
-function skippedDrainTask(task, event, reason) {
+var PR_AUTHOR_FIELDS = [
+  "github_author",
+  "githubAuthor",
+  "github_pr_author",
+  "githubPrAuthor",
+  "pr_author",
+  "prAuthor",
+  "pull_request_author",
+  "pullRequestAuthor",
+  "author_login",
+  "authorLogin"
+];
+var PR_REVIEWER_FIELDS = [
+  "github_reviewer",
+  "githubReviewer",
+  "github_review_actor",
+  "githubReviewActor",
+  "github_review_login",
+  "githubReviewLogin",
+  "github_actor",
+  "githubActor",
+  "reviewer_login",
+  "reviewerLogin",
+  "review_actor",
+  "reviewActor",
+  "merge_actor",
+  "mergeActor"
+];
+var PR_REVIEWER_POOL_FIELDS = [
+  "github_reviewer_pool",
+  "githubReviewerPool",
+  "github_review_pool",
+  "githubReviewPool",
+  "github_reviewers",
+  "githubReviewers",
+  "reviewer_pool",
+  "reviewerPool",
+  "reviewers"
+];
+var PR_REVIEW_REQUIRED_FIELDS = [
+  "github_review_required",
+  "githubReviewRequired",
+  "pr_review_required",
+  "prReviewRequired",
+  "review_required",
+  "reviewRequired",
+  "requires_non_author_review",
+  "requiresNonAuthorReview",
+  "branch_protection_review_required",
+  "branchProtectionReviewRequired"
+];
+function githubLogin(value) {
+  if (!value?.trim())
+    return;
+  const login = value.trim().replace(/^@/, "");
+  return /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(login) ? login : undefined;
+}
+function githubLogins(values) {
+  const seen = new Set;
+  const logins = [];
+  for (const value of values) {
+    const login = githubLogin(value);
+    if (!login)
+      continue;
+    const key = login.toLowerCase();
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    logins.push(login);
+  }
+  return logins;
+}
+function routeEvidenceText(records) {
+  const fields = [
+    "title",
+    "task_title",
+    "taskTitle",
+    "description",
+    "body",
+    "reason",
+    "message",
+    "fingerprint",
+    "reviewDecision",
+    "review_decision",
+    "mergeStateStatus",
+    "merge_state_status"
+  ];
+  const values = [];
+  for (const record of records) {
+    for (const field of fields)
+      values.push(...recordFieldValues(record, field));
+    values.push(...tagsFromValue2(record.tags ?? record.task_tags ?? record.taskTags));
+  }
+  return values.join(`
+`);
+}
+function authorFromPrText(text) {
+  const patterns = [
+    /\bauthor\s+(?:is\s+also|is|=|:)\s+@?([A-Za-z0-9](?:[A-Za-z0-9-]{0,38}))/i,
+    /\bPR\s*#?\d+\s+author\s+(?:is\s+also|is|=|:)\s+@?([A-Za-z0-9](?:[A-Za-z0-9-]{0,38}))/i,
+    /\bgithub\s+author\s+(?:is\s+also|is|=|:)\s+@?([A-Za-z0-9](?:[A-Za-z0-9-]{0,38}))/i
+  ];
+  for (const pattern of patterns) {
+    const match = pattern.exec(text);
+    const login = githubLogin(match?.[1]);
+    if (login)
+      return login;
+  }
+  return;
+}
+function prReviewRoutingDecision(data, metadata, opts) {
+  const records = [...taskEventRecords(data, metadata), ...automationRecords(data, metadata)];
+  const text = routeEvidenceText(records);
+  const signals = [];
+  const hasPrReference = /github\.com\/[^/\s]+\/[^/\s]+\/pull\/\d+/i.test(text) || /\bgithub-pr:[^\s]+#\d+/i.test(text) || /\bpull request\b/i.test(text) || /\bpr\s*#?\d+\b/i.test(text);
+  const reviewRequiredByField = hasTruthyField(records, PR_REVIEW_REQUIRED_FIELDS);
+  const reviewRequiredByText = /reviewdecision\s*[:=]\s*review_required/i.test(text) || /\breview_required\b/i.test(text) || /\breview required\b/i.test(text) || /\brequires?\s+\d+\s+approving review/i.test(text) || /\bbranch protection\b[\s\S]{0,160}\bapproving review/i.test(text);
+  const mergeBlockedByText = /mergestatestatus\s*[:=]\s*blocked/i.test(text) || /\bmerge state status\b[\s:=]+blocked/i.test(text);
+  const approvalIntent = /\b(approve|approval|merge|review)\b/i.test(text);
+  if (reviewRequiredByField)
+    signals.push("review-required-field");
+  if (reviewRequiredByText)
+    signals.push("review-required-text");
+  if (mergeBlockedByText)
+    signals.push("merge-blocked-text");
+  if (approvalIntent && hasPrReference)
+    signals.push("pr-approval-intent");
+  const required = hasPrReference && (reviewRequiredByField || reviewRequiredByText || mergeBlockedByText || approvalIntent);
+  if (!required)
+    return { required: false, allowed: true, reviewers: [], signals };
+  const author = githubLogin(firstRouteField(records, PR_AUTHOR_FIELDS)) ?? authorFromPrText(text);
+  const reviewers = githubLogins([
+    opts.githubReviewer,
+    ...splitList(opts.githubReviewerPool) ?? [],
+    ...PR_REVIEWER_FIELDS.flatMap((field) => routeFieldValues(records, field)),
+    ...PR_REVIEWER_POOL_FIELDS.flatMap((field) => routeFieldValues(records, field))
+  ]);
+  const selectedReviewer = author ? reviewers.find((reviewer) => reviewer.toLowerCase() !== author.toLowerCase()) : undefined;
+  if (!author) {
+    return {
+      required: true,
+      allowed: false,
+      reason: "PR approval/merge route requires PR author evidence before selecting a non-author GitHub reviewer",
+      reviewers,
+      signals
+    };
+  }
+  if (!reviewers.length) {
+    return {
+      required: true,
+      allowed: false,
+      reason: "PR approval/merge route requires --github-reviewer, --github-reviewer-pool, or task metadata github_reviewer/github_reviewer_pool with a login different from the PR author",
+      author,
+      reviewers,
+      signals
+    };
+  }
+  if (!selectedReviewer) {
+    return {
+      required: true,
+      allowed: false,
+      reason: `PR approval/merge route reviewer candidates match PR author ${author}; self-review is not routable`,
+      author,
+      reviewers,
+      signals
+    };
+  }
+  return {
+    required: true,
+    allowed: true,
+    author,
+    reviewers,
+    selectedReviewer,
+    signals
+  };
+}
+var SUPPORTED_AGENT_PROVIDERS = new Set(["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"]);
+var PROVIDER_HINT_FIELDS = ["provider_hint", "providerHint", "route_provider", "routeProvider", "agent_provider", "agentProvider"];
+var AUTH_PROFILE_HINT_FIELDS = ["auth_profile", "authProfile", "codewith_profile", "codewithProfile", "profile"];
+var AUTH_PROFILE_POOL_HINT_FIELDS = ["auth_profile_pool", "authProfilePool", "codewith_profile_pool", "codewithProfilePool", "profile_pool", "profilePool"];
+var ACCOUNT_HINT_FIELDS = ["account", "account_profile", "accountProfile", "openaccounts_profile", "openaccountsProfile"];
+var ACCOUNT_POOL_HINT_FIELDS = ["account_pool", "accountPool", "openaccounts_pool", "openaccountsPool"];
+var ACCOUNT_TOOL_HINT_FIELDS = ["account_tool", "accountTool", "openaccounts_tool", "openaccountsTool"];
+function canonicalRouteField(value) {
+  return value.replace(/[^a-z0-9]/gi, "").toLowerCase();
+}
+function normalizeAgentProvider(value, source) {
+  const provider = value?.trim().toLowerCase();
+  if (provider && SUPPORTED_AGENT_PROVIDERS.has(provider))
+    return provider;
+  const expected = [...SUPPORTED_AGENT_PROVIDERS].join(", ");
+  throw new Error(`unsupported provider${provider ? ` "${provider}"` : ""} from ${source}; expected one of: ${expected}`);
+}
+function stringValuesFromUnknown(value) {
+  if (Array.isArray(value))
+    return value.flatMap((entry) => stringValuesFromUnknown(entry));
+  if (typeof value === "string")
+    return value.split(",").map((entry) => entry.trim()).filter(Boolean);
+  if (typeof value === "number" || typeof value === "boolean")
+    return [String(value)];
+  return [];
+}
+function recordFieldValues(record, field) {
+  const expected = canonicalRouteField(field);
+  const values = [];
+  for (const [key, value] of Object.entries(record)) {
+    if (canonicalRouteField(key) === expected)
+      values.push(...stringValuesFromUnknown(value));
+  }
+  return values;
+}
+function routeFieldValues(records, field) {
+  if (canonicalRouteField(field) === "tags")
+    return taskEventTags(records);
+  return records.flatMap((record) => recordFieldValues(record, field));
+}
+function firstRouteField(records, fields) {
+  for (const field of fields) {
+    const value = routeFieldValues(records, field).find(Boolean);
+    if (value)
+      return value;
+  }
+  return;
+}
+function routeFieldList(records, fields) {
+  for (const field of fields) {
+    const values = routeFieldValues(records, field);
+    if (values.length)
+      return values;
+  }
+  return;
+}
+function parseProviderRoutingRule(raw) {
+  const rule = raw.trim();
+  const selectorIndex = rule.indexOf(":");
+  if (selectorIndex <= 0)
+    throw new Error(`invalid --provider-rule "${raw}", expected field=value:provider[:profile1,profile2]`);
+  const selector = rule.slice(0, selectorIndex).trim();
+  const route = rule.slice(selectorIndex + 1).trim();
+  const equalsIndex = selector.indexOf("=");
+  if (equalsIndex <= 0)
+    throw new Error(`invalid --provider-rule "${raw}", expected field=value:provider[:profile1,profile2]`);
+  const field = selector.slice(0, equalsIndex).trim();
+  const value = selector.slice(equalsIndex + 1).trim();
+  const providerIndex = route.indexOf(":");
+  const providerRaw = providerIndex >= 0 ? route.slice(0, providerIndex).trim() : route;
+  const profilesRaw = providerIndex >= 0 ? route.slice(providerIndex + 1).trim() : undefined;
+  if (!field || !value || !providerRaw)
+    throw new Error(`invalid --provider-rule "${raw}", expected field=value:provider[:profile1,profile2]`);
+  return {
+    raw,
+    field,
+    value,
+    provider: normalizeAgentProvider(providerRaw, `provider rule ${field}=${value}`),
+    profiles: splitList(profilesRaw)
+  };
+}
+function parseProviderRoutingRules(values) {
+  return (values ?? []).map(parseProviderRoutingRule);
+}
+function providerRuleMatches(rule, records) {
+  const expected = rule.value.trim().toLowerCase();
+  return routeFieldValues(records, rule.field).some((value) => value.trim().toLowerCase() === expected);
+}
+function accountRef(profile, tool) {
+  return profile ? { profile, tool } : undefined;
+}
+function accountRefs(profiles, tool) {
+  return profiles?.length ? profiles.map((profile) => ({ profile, tool })) : undefined;
+}
+function providerRoutingPublic(decision) {
+  return {
+    provider: decision.provider,
+    source: decision.source,
+    reason: decision.reason,
+    rule: decision.rule,
+    authProfile: decision.authProfile,
+    authProfilePool: decision.authProfilePool,
+    account: decision.account,
+    accountPool: decision.accountPool
+  };
+}
+function resolveProviderRouting(data, metadata, opts) {
+  const records = [...taskEventRecords(data, metadata), ...automationRecords(data, metadata)];
+  const matchedRule = parseProviderRoutingRules(opts.providerRule).find((rule) => providerRuleMatches(rule, records));
+  const metadataProvider = matchedRule || opts.provider ? undefined : firstRouteField(records, PROVIDER_HINT_FIELDS);
+  const provider = matchedRule ? matchedRule.provider : opts.provider ? normalizeAgentProvider(opts.provider, "--provider") : metadataProvider ? normalizeAgentProvider(metadataProvider, "task metadata provider hint") : "codewith";
+  const source = matchedRule ? "rule" : opts.provider ? "option" : metadataProvider ? "metadata" : "default";
+  const metadataProfilePool = routeFieldList(records, provider === "codewith" ? AUTH_PROFILE_POOL_HINT_FIELDS : [...ACCOUNT_POOL_HINT_FIELDS, ...AUTH_PROFILE_POOL_HINT_FIELDS]);
+  const metadataProfile = firstRouteField(records, provider === "codewith" ? AUTH_PROFILE_HINT_FIELDS : [...ACCOUNT_HINT_FIELDS, ...AUTH_PROFILE_HINT_FIELDS]);
+  const profilePool = matchedRule?.profiles ?? metadataProfilePool;
+  const profile = metadataProfile;
+  const metadataAccountTool = firstRouteField(records, ACCOUNT_TOOL_HINT_FIELDS);
+  const accountTool = opts.accountTool ?? (matchedRule?.profiles ? undefined : metadataAccountTool) ?? (provider === "codewith" ? undefined : provider);
+  const hasResolvedAccountPool = provider !== "codewith" && Boolean((profilePool?.length ?? 0) || profile);
+  if (opts.accountTool && !opts.account && !opts.accountPool && !opts.triageAccount && !opts.plannerAccount && !opts.workerAccount && !opts.verifierAccount && !hasResolvedAccountPool) {
+    throw new Error("--account-tool requires --account, --account-pool, --triage-account, --planner-account, --worker-account, --verifier-account, metadata account hints, or provider-rule profiles");
+  }
+  if (provider === "codewith") {
+    const cliAuthProfilePool = splitList(opts.authProfilePool);
+    return {
+      provider,
+      source,
+      reason: matchedRule ? `matched provider rule ${matchedRule.field}=${matchedRule.value}` : metadataProvider ? "selected provider from task metadata" : opts.provider ? "selected provider from --provider" : "selected default provider",
+      rule: matchedRule,
+      authProfile: opts.authProfile ?? profile,
+      authProfilePool: matchedRule?.profiles ?? cliAuthProfilePool ?? (opts.authProfile ? undefined : metadataProfilePool),
+      account: accountRef(opts.account, opts.accountTool),
+      accountPool: accountPoolFromOpts(opts)
+    };
+  }
+  if (opts.authProfile || opts.authProfilePool) {
+    throw new Error(`--auth-profile and --auth-profile-pool are supported only for --provider codewith; use OpenAccounts account profiles for ${provider}`);
+  }
+  const cliAccountPool = accountPoolFromOpts(opts);
+  const account = opts.account ? accountRef(opts.account, opts.accountTool ?? provider) : accountRef(profile, accountTool);
+  return {
+    provider,
+    source,
+    reason: matchedRule ? `matched provider rule ${matchedRule.field}=${matchedRule.value}` : metadataProvider ? "selected provider from task metadata" : opts.provider ? "selected provider from --provider" : "selected default provider",
+    rule: matchedRule,
+    account,
+    accountPool: matchedRule?.profiles ? accountRefs(matchedRule.profiles, accountTool) : cliAccountPool ?? (opts.account ? undefined : accountRefs(metadataProfilePool, accountTool))
+  };
+}
+function skippedDrainTask(task, event, reason, extra = {}) {
   const taskId = taskField(task, ["id", "task_id", "taskId"]) ?? event?.subject ?? "unknown";
   return {
     kind: "skipped",
@@ -8554,7 +9610,8 @@ function skippedDrainTask(task, event, reason) {
       reason,
       taskId,
       event,
-      routeError: true
+      routeError: true,
+      ...extra
     },
     human: `skipped task ${taskId}: ${reason}`
   };
@@ -8562,6 +9619,32 @@ function skippedDrainTask(task, event, reason) {
 function isSkippableDrainRouteError(message) {
   return message.startsWith("worktreeMode=required but projectPath is not an existing git repository:");
 }
+function todosMutationSummary(result) {
+  return {
+    ok: result.ok,
+    status: result.status,
+    error: result.ok ? undefined : redact(result.stderr || result.error || "todos mutation failed", 320)
+  };
+}
+function markInvalidDrainTaskNonRouteable(todosProject, task, reason) {
+  const taskId = taskField(task, ["id", "task_id", "taskId"]);
+  if (!taskId)
+    return { attempted: false, reason: "task id missing" };
+  const comment = `OpenLoops route blocked for task ${taskId}: ${reason}. Added no-auto and removed auto:route so route drains do not repeatedly route this task until its project path is fixed.`;
+  const commentResult = runLocalCommand("todos", ["--project", todosProject, "comment", taskId, comment], { timeoutMs: 30000 });
+  const tagResult = runLocalCommand("todos", ["--project", todosProject, "tag", taskId, "no-auto"], { timeoutMs: 30000 });
+  const untagResult = runLocalCommand("todos", ["--project", todosProject, "untag", taskId, "auto:route"], { timeoutMs: 30000 });
+  const ok = commentResult.ok && tagResult.ok && untagResult.ok;
+  return {
+    ok,
+    attempted: true,
+    taskId,
+    error: ok ? undefined : "one or more source task updates failed; inspect per-command results",
+    comment: todosMutationSummary(commentResult),
+    tagNoAuto: todosMutationSummary(tagResult),
+    untagAutoRoute: todosMutationSummary(untagResult)
+  };
+}
 function generatedRouteSandboxPreflight(workflow) {
   const checks = [];
   for (const step of workflow.steps) {
@@ -8687,6 +9770,28 @@ var TODOS_TASK_ROUTE_TEMPLATE_IDS = new Set([
   TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID,
   TASK_LIFECYCLE_TEMPLATE_ID
 ]);
+var UNCLEARED_ROUTE_WORK_ITEM_STATUSES = new Set([
+  "admitted",
+  "running",
+  "succeeded",
+  "failed",
+  "dead_letter",
+  "cancelled"
+]);
+function isUnclearedRouteWorkItem(item) {
+  return UNCLEARED_ROUTE_WORK_ITEM_STATUSES.has(item.status);
+}
+function isExistingGitProjectPath(path) {
+  const result = spawnSync5("git", ["-C", path, "rev-parse", "--is-inside-work-tree"], { encoding: "utf8" });
+  return result.status === 0;
+}
+function validateRequiredRouteWorktreeProjectPath(opts, projectPath) {
+  if ((opts.worktreeMode ?? "auto") !== "required")
+    return;
+  if (!isExistingGitProjectPath(projectPath)) {
+    throw new Error(`worktreeMode=required but projectPath is not an existing git repository: ${projectPath}`);
+  }
+}
 function todosTaskRouteTemplateId(opts) {
   const id = (opts.template ?? TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).trim();
   if (!TODOS_TASK_ROUTE_TEMPLATE_IDS.has(id)) {
@@ -8695,7 +9800,7 @@ function todosTaskRouteTemplateId(opts) {
   return id;
 }
 async function readEventEnvelopeInput(opts = {}) {
-  const raw = opts.eventJson ?? (opts.eventFile ? readFileSync4(opts.eventFile, "utf8") : process.env.HASNA_EVENT_JSON || await Bun.stdin.text());
+  const raw = opts.eventJson ?? (opts.eventFile ? readFileSync5(opts.eventFile, "utf8") : process.env.HASNA_EVENT_JSON || await Bun.stdin.text());
   const event = JSON.parse(raw);
   if (!event || typeof event !== "object" || Array.isArray(event))
     throw new Error("event JSON must be an object");
@@ -8748,8 +9853,8 @@ function routeTodosTaskEvent(event, opts) {
     const store2 = new Store;
     try {
       const existingItem = store2.findWorkflowWorkItem("todos-task", idempotencyKey);
-      if (existingItem?.loopId && ["admitted", "running", "succeeded"].includes(existingItem.status)) {
-        const existingLoop = store2.getLoop(existingItem.loopId);
+      if (existingItem && isUnclearedRouteWorkItem(existingItem)) {
+        const existingLoop = existingItem.loopId ? store2.getLoop(existingItem.loopId) : undefined;
         const existingWorkflow = existingItem.workflowId ? store2.getWorkflow(existingItem.workflowId) : undefined;
         const existingInvocation = store2.getWorkflowInvocation(existingItem.invocationId);
         return {
@@ -8771,12 +9876,27 @@ function routeTodosTaskEvent(event, opts) {
       store2.close();
     }
   }
-  const provider = opts.provider ?? "codewith";
-  if (!["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"].includes(provider))
-    throw new Error("unsupported provider");
+  validateRequiredRouteWorktreeProjectPath(opts, projectPath);
+  const prReviewRouting = prReviewRoutingDecision(data, metadata, opts);
+  if (prReviewRouting.required && !prReviewRouting.allowed) {
+    return {
+      kind: "skipped",
+      value: {
+        skipped: true,
+        reason: prReviewRouting.reason,
+        event,
+        taskId,
+        routeError: true,
+        prReviewRouting
+      },
+      human: `skipped task ${taskId}: ${prReviewRouting.reason}`
+    };
+  }
+  const providerRouting = resolveProviderRouting(data, metadata, opts);
+  const provider = providerRouting.provider;
   const permissionMode = permissionModeFromOpts({ permissionMode: opts.permissionMode ?? "bypass" }, provider);
   const sandbox = sandboxFromOpts({ sandbox: opts.sandbox }, provider);
-  const authProfile = providerAuthProfileFromOpts({ authProfile: opts.authProfile }, provider);
+  const authProfile = providerAuthProfileFromOpts({ authProfile: providerRouting.authProfile }, provider);
   const templateId = todosTaskRouteTemplateId(opts);
   const workflowInput = {
     taskId,
@@ -8787,13 +9907,13 @@ function routeTodosTaskEvent(event, opts) {
     projectGroup,
     provider,
     authProfile,
-    authProfilePool: splitList(opts.authProfilePool),
+    authProfilePool: providerRouting.authProfilePool,
     triageAuthProfile: opts.triageAuthProfile,
     plannerAuthProfile: opts.plannerAuthProfile,
     workerAuthProfile: opts.workerAuthProfile,
     verifierAuthProfile: opts.verifierAuthProfile,
-    account: accountFromOpts(opts),
-    accountPool: accountPoolFromOpts(opts),
+    account: providerRouting.account,
+    accountPool: providerRouting.accountPool,
     triageAccount: roleAccountFromOpts(opts, opts.triageAccount),
     plannerAccount: roleAccountFromOpts(opts, opts.plannerAccount),
     workerAccount: roleAccountFromOpts(opts, opts.workerAccount),
@@ -8803,12 +9923,14 @@ function routeTodosTaskEvent(event, opts) {
     agent: opts.agent,
     addDirs: listFromRepeatedOpts(opts.addDir),
     timeoutMs: timeoutDuration(opts.timeout, "--timeout"),
+    verifierIdleTimeoutMs: idleTimeoutDuration(opts.verifierIdleTimeout, "--verifier-idle-timeout"),
     permissionMode,
     sandbox,
     manualBreakGlass: Boolean(opts.manualBreakGlass),
     worktreeMode: opts.worktreeMode ?? "auto",
     worktreeRoot: opts.worktreeRoot,
     worktreeBranchPrefix: opts.worktreeBranchPrefix ?? "openloops",
+    prHandoff: templateId === TASK_LIFECYCLE_TEMPLATE_ID ? Boolean(opts.prHandoff) : false,
     eventId: event.id,
     eventType: event.type,
     todosProjectPath: opts.todosProject
@@ -8844,7 +9966,10 @@ function routeTodosTaskEvent(event, opts) {
       worktreePolicy: opts.worktreeMode ?? "auto",
       permissions: permissionMode,
       manualBreakGlass: Boolean(opts.manualBreakGlass),
-      accountPolicy: opts.authProfilePool || opts.accountPool ? "pool" : hasExplicitRoleAccount ? "role-explicit" : "single",
+      prHandoff: templateId === TASK_LIFECYCLE_TEMPLATE_ID ? Boolean(opts.prHandoff) : false,
+      accountPolicy: providerRouting.authProfilePool?.length || providerRouting.accountPool?.length ? "pool" : hasExplicitRoleAccount ? "role-explicit" : "single",
+      providerRouting: providerRoutingPublic(providerRouting),
+      prReviewRouting: prReviewRouting.required ? prReviewRouting : undefined,
       concurrencyGroup: projectGroup ?? routeProjectPath
     },
     outputPolicy: {
@@ -8883,7 +10008,7 @@ function routeTodosTaskEvent(event, opts) {
     }, {}) : undefined;
     return {
       kind: "created",
-      value: { deduped: false, idempotencyKey, event, invocation: invocationInput, workItem: workItemInput, workflow: workflowBody, loop: loopInput, throttle, sandboxPreflight, preflight },
+      value: { deduped: false, idempotencyKey, event, providerRouting: providerRoutingPublic(providerRouting), prReviewRouting: prReviewRouting.required ? prReviewRouting : undefined, invocation: invocationInput, workItem: workItemInput, workflow: workflowBody, loop: loopInput, throttle, sandboxPreflight, preflight },
       human: `dry-run ${loopName}`
     };
   }
@@ -8899,8 +10024,8 @@ function routeTodosTaskEvent(event, opts) {
     const outcome = store.writeTransaction(() => {
       const invocation = store.createWorkflowInvocation(invocationInput);
       const existingItem = store.findWorkflowWorkItem("todos-task", idempotencyKey);
-      if (existingItem?.loopId && ["admitted", "running", "succeeded"].includes(existingItem.status)) {
-        const existingLoop = store.getLoop(existingItem.loopId);
+      if (existingItem && isUnclearedRouteWorkItem(existingItem)) {
+        const existingLoop = existingItem.loopId ? store.getLoop(existingItem.loopId) : undefined;
         const existingWorkflow = existingItem.workflowId ? store.getWorkflow(existingItem.workflowId) : undefined;
         return { kind: "deduped", existingItem, existingLoop, existingWorkflow, invocation };
       }
@@ -8911,6 +10036,11 @@ function routeTodosTaskEvent(event, opts) {
         status: throttle && !throttle.allowed ? "deferred" : "queued",
         lastReason: throttle && !throttle.allowed ? throttle.reason : undefined
       });
+      const requeue = workItem.attempts > 0 && workItem.status === "queued" ? {
+        previousWorkItemId: workItem.id,
+        previousAttempts: workItem.attempts,
+        reason: workItem.lastReason
+      } : undefined;
       const refreshedInvocation = store.refreshWorkflowInvocationForWorkItem(workItem.id, invocationInput);
       if (throttle && !throttle.allowed)
         return { kind: "throttled", invocation: refreshedInvocation, workItem, throttle };
@@ -8927,7 +10057,15 @@ function routeTodosTaskEvent(event, opts) {
         }
       });
       const admitted = store.admitWorkflowWorkItem(workItem.id, { workflowId: workflow.id, loopId: loop.id, reason: "admitted by todos-task route" });
-      return { kind: "created", invocation: refreshedInvocation, workItem: admitted, workflow, loop, throttle };
+      return {
+        kind: "created",
+        invocation: refreshedInvocation,
+        workItem: admitted,
+        workflow,
+        loop,
+        throttle,
+        requeue: requeue ? { ...requeue, attempt: admitted.attempts, newWorkflowId: workflow.id, newLoopId: loop.id } : undefined
+      };
     });
     if (outcome.kind === "deduped") {
       return {
@@ -8956,6 +10094,8 @@ function routeTodosTaskEvent(event, opts) {
           event,
           invocation: publicWorkflowInvocation(outcome.invocation),
           workItem: publicWorkflowWorkItem(outcome.workItem),
+          providerRouting: providerRoutingPublic(providerRouting),
+          prReviewRouting: prReviewRouting.required ? prReviewRouting : undefined,
           throttle: outcome.throttle,
           workflow: workflowBody,
           loop: loopInput
@@ -8971,8 +10111,11 @@ function routeTodosTaskEvent(event, opts) {
         event,
         invocation: publicWorkflowInvocation(outcome.invocation),
         workItem: publicWorkflowWorkItem(outcome.workItem),
+        providerRouting: providerRoutingPublic(providerRouting),
+        prReviewRouting: prReviewRouting.required ? prReviewRouting : undefined,
         workflow: publicWorkflow(outcome.workflow),
         loop: publicLoop(outcome.loop),
+        requeue: outcome.requeue,
         throttle: outcome.throttle,
         sandboxPreflight,
         preflight
@@ -8996,12 +10139,11 @@ function routeGenericEvent(event, opts) {
   const workflowName = `${opts.namePrefix ?? "event:generic"}:${source}:${type}:${eventSuffix}:workflow`;
   const loopName = `${opts.namePrefix ?? "event:generic"}:${source}:${type}:${eventSuffix}:run`;
   const idempotencyKey = `generic-event:${event.source}:${event.type}:${event.id}`;
-  const provider = opts.provider ?? "codewith";
-  if (!["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"].includes(provider))
-    throw new Error("unsupported provider");
+  const providerRouting = resolveProviderRouting(data, metadata, opts);
+  const provider = providerRouting.provider;
   const permissionMode = permissionModeFromOpts({ permissionMode: opts.permissionMode ?? "bypass" }, provider);
   const sandbox = sandboxFromOpts({ sandbox: opts.sandbox }, provider);
-  const authProfile = providerAuthProfileFromOpts({ authProfile: opts.authProfile }, provider);
+  const authProfile = providerAuthProfileFromOpts({ authProfile: providerRouting.authProfile }, provider);
   let workflowBody = renderEventWorkerVerifierWorkflow({
     eventId: event.id,
     eventType: event.type,
@@ -9014,11 +10156,11 @@ function routeGenericEvent(event, opts) {
     projectGroup,
     provider,
     authProfile,
-    authProfilePool: splitList(opts.authProfilePool),
+    authProfilePool: providerRouting.authProfilePool,
     workerAuthProfile: opts.workerAuthProfile,
     verifierAuthProfile: opts.verifierAuthProfile,
-    account: accountFromOpts(opts),
-    accountPool: accountPoolFromOpts(opts),
+    account: providerRouting.account,
+    accountPool: providerRouting.accountPool,
     workerAccount: roleAccountFromOpts(opts, opts.workerAccount),
     verifierAccount: roleAccountFromOpts(opts, opts.verifierAccount),
     model: opts.model,
@@ -9026,6 +10168,7 @@ function routeGenericEvent(event, opts) {
     agent: opts.agent,
     addDirs: listFromRepeatedOpts(opts.addDir),
     timeoutMs: timeoutDuration(opts.timeout, "--timeout"),
+    verifierIdleTimeoutMs: idleTimeoutDuration(opts.verifierIdleTimeout, "--verifier-idle-timeout"),
     permissionMode,
     sandbox,
     manualBreakGlass: Boolean(opts.manualBreakGlass),
@@ -9041,6 +10184,7 @@ function routeGenericEvent(event, opts) {
     event: event.id
   });
   const sandboxPreflight = generatedRouteSandboxPreflight(workflowBody);
+  const hasExplicitRoleAccount = Boolean(opts.workerAuthProfile || opts.verifierAuthProfile || opts.workerAccount || opts.verifierAccount);
   const invocationInput = {
     templateId: "event-worker-verifier",
     sourceRef: {
@@ -9062,7 +10206,8 @@ function routeGenericEvent(event, opts) {
       worktreePolicy: opts.worktreeMode ?? "auto",
       permissions: permissionMode,
       manualBreakGlass: Boolean(opts.manualBreakGlass),
-      accountPolicy: opts.authProfilePool || opts.accountPool ? "pool" : "single",
+      accountPolicy: providerRouting.authProfilePool?.length || providerRouting.accountPool?.length ? "pool" : hasExplicitRoleAccount ? "role-explicit" : "single",
+      providerRouting: providerRoutingPublic(providerRouting),
       concurrencyGroup: projectGroup ?? routeProjectPath
     },
     outputPolicy: {
@@ -9101,7 +10246,7 @@ function routeGenericEvent(event, opts) {
     }, {}) : undefined;
     return {
       kind: "created",
-      value: { event, idempotencyKey, invocation: invocationInput, workItem: workItemInput, workflow: workflowBody, loop: loopInput, throttle, sandboxPreflight, preflight },
+      value: { event, idempotencyKey, providerRouting: providerRoutingPublic(providerRouting), invocation: invocationInput, workItem: workItemInput, workflow: workflowBody, loop: loopInput, throttle, sandboxPreflight, preflight },
       human: `dry-run ${loopName}`
     };
   }
@@ -9117,8 +10262,8 @@ function routeGenericEvent(event, opts) {
     const outcome = store.writeTransaction(() => {
       const invocation = store.createWorkflowInvocation(invocationInput);
       const existingItem = store.findWorkflowWorkItem("generic-event", idempotencyKey);
-      if (existingItem?.loopId && ["admitted", "running", "succeeded"].includes(existingItem.status)) {
-        const existingLoop = store.getLoop(existingItem.loopId);
+      if (existingItem && isUnclearedRouteWorkItem(existingItem)) {
+        const existingLoop = existingItem.loopId ? store.getLoop(existingItem.loopId) : undefined;
         const existingWorkflow = existingItem.workflowId ? store.getWorkflow(existingItem.workflowId) : undefined;
         return { kind: "deduped", existingItem, existingLoop, existingWorkflow, invocation };
       }
@@ -9129,6 +10274,11 @@ function routeGenericEvent(event, opts) {
         status: throttle && !throttle.allowed ? "deferred" : "queued",
         lastReason: throttle && !throttle.allowed ? throttle.reason : undefined
       });
+      const requeue = workItem.attempts > 0 && workItem.status === "queued" ? {
+        previousWorkItemId: workItem.id,
+        previousAttempts: workItem.attempts,
+        reason: workItem.lastReason
+      } : undefined;
       const refreshedInvocation = store.refreshWorkflowInvocationForWorkItem(workItem.id, invocationInput);
       if (throttle && !throttle.allowed)
         return { kind: "throttled", invocation: refreshedInvocation, workItem, throttle };
@@ -9145,7 +10295,15 @@ function routeGenericEvent(event, opts) {
         }
       });
       const admitted = store.admitWorkflowWorkItem(workItem.id, { workflowId: workflow.id, loopId: loop.id, reason: "admitted by generic-event route" });
-      return { kind: "created", invocation: refreshedInvocation, workItem: admitted, workflow, loop, throttle };
+      return {
+        kind: "created",
+        invocation: refreshedInvocation,
+        workItem: admitted,
+        workflow,
+        loop,
+        throttle,
+        requeue: requeue ? { ...requeue, attempt: admitted.attempts, newWorkflowId: workflow.id, newLoopId: loop.id } : undefined
+      };
     });
     if (outcome.kind === "deduped") {
       return {
@@ -9155,6 +10313,7 @@ function routeGenericEvent(event, opts) {
           idempotencyKey,
           dedupedBy: "work-item",
           event,
+          providerRouting: providerRoutingPublic(providerRouting),
           invocation: publicWorkflowInvocation(outcome.invocation),
           workItem: publicWorkflowWorkItem(outcome.existingItem),
           workflow: outcome.existingWorkflow ? publicWorkflow(outcome.existingWorkflow) : undefined,
@@ -9172,6 +10331,7 @@ function routeGenericEvent(event, opts) {
           reason: outcome.throttle.reason,
           idempotencyKey,
           event,
+          providerRouting: providerRoutingPublic(providerRouting),
           invocation: publicWorkflowInvocation(outcome.invocation),
           workItem: publicWorkflowWorkItem(outcome.workItem),
           throttle: outcome.throttle,
@@ -9187,10 +10347,12 @@ function routeGenericEvent(event, opts) {
         deduped: false,
         idempotencyKey,
         event,
+        providerRouting: providerRoutingPublic(providerRouting),
         invocation: publicWorkflowInvocation(outcome.invocation),
         workItem: publicWorkflowWorkItem(outcome.workItem),
         workflow: publicWorkflow(outcome.workflow),
         loop: publicLoop(outcome.loop),
+        requeue: outcome.requeue,
         throttle: outcome.throttle,
         sandboxPreflight,
         preflight
@@ -9221,14 +10383,14 @@ function taskDescriptionProjectPath(task) {
   return match?.[1]?.trim();
 }
 function taskProjectPath(task) {
-  const metadata = objectField(task.metadata) ?? {};
+  const metadata = objectField2(task.metadata) ?? {};
   return taskField(task, ["project_path", "projectPath"]) ?? taskEventField(metadata, ["project_path", "projectPath", "project_canonical_path"]) ?? taskDescriptionProjectPath(task) ?? taskField(task, ["working_dir", "workingDir", "cwd"]) ?? taskEventField(metadata, ["working_dir", "workingDir", "cwd"]);
 }
 function taskDrainEvent(task) {
   const taskId = taskField(task, ["id", "task_id", "taskId"]);
   if (!taskId)
     throw new Error("todos ready returned a task without an id");
-  const metadata = objectField(task.metadata) ?? {};
+  const metadata = objectField2(task.metadata) ?? {};
   const workingDir = taskProjectPath(task);
   const data = {
     ...task,
@@ -9236,7 +10398,7 @@ function taskDrainEvent(task) {
     title: taskField(task, ["title"]),
     description: taskField(task, ["description", "body"]),
     status: taskField(task, ["status"]),
-    tags: tagsFromValue(task.tags),
+    tags: tagsFromValue2(task.tags),
     metadata
   };
   if (workingDir) {
@@ -9264,10 +10426,12 @@ function taskDrainEvent(task) {
 }
 function compactDrainResult(result) {
   const value = result.value;
-  const event = objectField(value.event);
-  const loop = objectField(value.loop);
-  const workflow = objectField(value.workflow);
-  const throttle = objectField(value.throttle);
+  const event = objectField2(value.event);
+  const loop = objectField2(value.loop);
+  const workflow = objectField2(value.workflow);
+  const throttle = objectField2(value.throttle);
+  const requeue = objectField2(value.requeue);
+  const providerRouting = objectField2(value.providerRouting);
   return {
     kind: result.kind,
     taskId: event?.subject,
@@ -9278,6 +10442,8 @@ function compactDrainResult(result) {
     loopName: stringField(loop?.name),
     workflowId: stringField(workflow?.id),
     workflowName: stringField(workflow?.name),
+    providerRouting,
+    requeue,
     queuedAtSource: value.queuedAtSource
   };
 }
@@ -9324,7 +10490,7 @@ function taskMatchesDrainFilters(task, filters) {
       return false;
   }
   if (filters.tags.length) {
-    const taskTags = new Set(tagsFromValue(task.tags));
+    const taskTags = new Set(tagsFromValue2(task.tags));
     for (const tag of filters.tags) {
       if (!taskTags.has(tag))
         return false;
@@ -9456,10 +10622,10 @@ var events = program.command("events").description("handle Hasna event envelopes
 var machines = program.command("machines").description("inspect OpenMachines topology for loop assignment");
 var goal = program.command("goal").description("inspect goal runs");
 function addRouteEventOptions(command) {
-  return command.option("--event-file <file>", "read event envelope JSON from a file instead of stdin/HASNA_EVENT_JSON").option("--event-json <json>", "read event envelope JSON from this string instead of stdin/HASNA_EVENT_JSON").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix").option("--preflight", "check generated workflow steps before storing the workflow loop");
+  return command.option("--event-file <file>", "read event envelope JSON from a file instead of stdin/HASNA_EVENT_JSON").option("--event-json <json>", "read event envelope JSON from this string instead of stdin/HASNA_EVENT_JSON").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider; defaults to codewith").option("--provider-rule <rule>", "task metadata provider routing rule field=value:provider[:profile1,profile2]; may be repeated", collectValues, []).option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--verifier-idle-timeout <duration>", "verifier idle watchdog; use none/off to disable when an external heartbeat exists", "15m").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated worktrees", "openloops").option("--pr-handoff", "for task-lifecycle routes, add a bounded PR handoff step after the worker").option("--github-reviewer <login>", "GitHub login expected to review/merge review-required PR routes; must differ from PR author").option("--github-reviewer-pool <logins>", "comma-separated GitHub logins eligible to review/merge review-required PR routes").option("--name-prefix <prefix>", "workflow/loop name prefix").option("--preflight", "check generated workflow steps before storing the workflow loop");
 }
 function addTodosDrainOptions(command, opts = {}) {
-  let configured = command.option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", opts.preflightDescription ?? "check generated workflow steps before storing workflow loops");
+  let configured = command.option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider; defaults to codewith").option("--provider-rule <rule>", "task metadata provider routing rule field=value:provider[:profile1,profile2]; may be repeated", collectValues, []).option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--verifier-idle-timeout <duration>", "verifier idle watchdog; use none/off to disable when an external heartbeat exists", "15m").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--pr-handoff", "for task-lifecycle routes, add a bounded PR handoff step after the worker").option("--github-reviewer <login>", "GitHub login expected to review/merge review-required PR routes; must differ from PR author").option("--github-reviewer-pool <logins>", "comma-separated GitHub logins eligible to review/merge review-required PR routes").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", opts.preflightDescription ?? "check generated workflow steps before storing workflow loops");
   if (opts.includeDryRun ?? true) {
     configured = configured.option("--dry-run", "preview selected tasks and generated workflow loops without storing anything");
   }
@@ -9494,6 +10660,8 @@ function routeDrainArgs(opts) {
   addBool("--compact", opts.compact);
   add("--template", opts.template);
   add("--provider", opts.provider);
+  for (const rule of opts.providerRule ?? [])
+    add("--provider-rule", rule);
   add("--auth-profile", opts.authProfile);
   add("--auth-profile-pool", opts.authProfilePool);
   add("--triage-auth-profile", opts.triageAuthProfile);
@@ -9513,6 +10681,7 @@ function routeDrainArgs(opts) {
   for (const dir of listFromRepeatedOpts(opts.addDir) ?? [])
     add("--add-dir", dir);
   add("--timeout", opts.timeout);
+  add("--verifier-idle-timeout", opts.verifierIdleTimeout);
   add("--permission-mode", opts.permissionMode);
   add("--sandbox", opts.sandbox);
   addBool("--manual-break-glass", opts.manualBreakGlass);
@@ -9524,6 +10693,9 @@ function routeDrainArgs(opts) {
   add("--worktree-mode", opts.worktreeMode);
   add("--worktree-root", opts.worktreeRoot);
   add("--worktree-branch-prefix", opts.worktreeBranchPrefix);
+  addBool("--pr-handoff", opts.prHandoff);
+  add("--github-reviewer", opts.githubReviewer);
+  add("--github-reviewer-pool", opts.githubReviewerPool);
   add("--name-prefix", opts.namePrefix);
   addBool("--preflight", opts.preflight);
   return args;
@@ -9559,7 +10731,8 @@ function drainTodosTaskRoutes(opts) {
       const message = error instanceof Error ? error.message : String(error);
       if (!isSkippableDrainRouteError(message))
         throw error;
-      result = skippedDrainTask(task, event, redact(message, 640) ?? "route task failed");
+      const sourceTaskUpdate = opts.dryRun ? { attempted: false, reason: "dry-run" } : markInvalidDrainTaskNonRouteable(todosProject, task, message);
+      result = skippedDrainTask(task, event, redact(message, 640) ?? "route task failed", { sourceTaskUpdate });
     }
     results.push(result);
     if (result.kind === "created" && !opts.dryRun)
@@ -9770,6 +10943,18 @@ routes.command("show <id>").description("show one admission work item").action((
     store.close();
   }
 });
+routes.command("requeue <id>").description("requeue a terminal admission work item for the next task/event delivery").option("--reason <text>", "operator reason recorded on the work item").action((id, opts) => {
+  const store = new Store;
+  try {
+    const reason = stringField(opts.reason);
+    if (!reason)
+      throw new Error("routes requeue requires --reason <text>");
+    const item = store.requeueWorkflowWorkItem(id, { reason });
+    print(publicWorkflowWorkItem(item), `requeued route work item ${item.id} (${item.routeKey})`);
+  } finally {
+    store.close();
+  }
+});
 routes.command("invocations").description("list workflow invocations").option("--limit <n>", "maximum rows", "50").action((opts) => {
   const store = new Store;
   try {
@@ -9824,7 +11009,7 @@ addScheduleOptions(addTodosDrainOptions(routes.command("schedule <kind> <name>")
   }
 });
 var eventsHandle = events.command("handle").description("handle a Hasna event envelope");
-eventsHandle.command("todos-task").description("create a one-shot worker/verifier workflow loop for a todos task event").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
+eventsHandle.command("todos-task").description("create a one-shot worker/verifier workflow loop for a todos task event").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider; defaults to codewith").option("--provider-rule <rule>", "task metadata provider routing rule field=value:provider[:profile1,profile2]; may be repeated", collectValues, []).option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--verifier-idle-timeout <duration>", "verifier idle watchdog; use none/off to disable when an external heartbeat exists", "15m").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--github-reviewer <login>", "GitHub login expected to review/merge review-required PR routes; must differ from PR author").option("--github-reviewer-pool <logins>", "comma-separated GitHub logins eligible to review/merge review-required PR routes").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
   const event = await readEventEnvelopeFromStdin();
   const result = routeTodosTaskEvent(event, opts);
   print(result.value, result.human);
@@ -9833,7 +11018,7 @@ var eventsDrain = events.command("drain").description("drain durable source queu
 addTodosDrainOptions(eventsDrain.command("todos-task").description("drain ready todos tasks into bounded worker/verifier workflow loops")).action((opts) => {
   drainTodosTaskRoutes(opts);
 });
-eventsHandle.command("generic").description("create a one-shot worker/verifier workflow loop for any Hasna event").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated event worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:generic").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
+eventsHandle.command("generic").description("create a one-shot worker/verifier workflow loop for any Hasna event").option("--provider <provider>", "agent provider", "codewith").option("--provider-rule <rule>", "event metadata provider routing rule field=value:provider[:profile1,profile2]; may be repeated", collectValues, []).option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--verifier-idle-timeout <duration>", "verifier idle watchdog; use none/off to disable when an external heartbeat exists", "15m").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated event worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:generic").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
   const event = await readEventEnvelopeFromStdin();
   const result = routeGenericEvent(event, opts);
   print(result.value, result.human);
@@ -10118,6 +11303,66 @@ workflows.command("migrate-agent-timeouts").description("append-only migrate act
     store.close();
   }
 });
+workflows.command("migrate-goal-wrappers").description("append-only migrate active workflow loops away from workflow-level goal wrappers").option("--loop <idOrName>", "migrate only one loop instead of all active workflow loops").option("--apply", "create new workflow specs and retarget eligible loops").option("--archive-old", "archive old workflow specs after retargeting when no active loops still reference them").action((opts) => {
+  const store = new Store;
+  try {
+    const candidateLoops = opts.loop ? [store.requireUniqueLoop(opts.loop)] : store.listLoops({ status: "active", limit: 1e4 }).filter((loop) => loop.target.type === "workflow");
+    const rows = [];
+    for (const loop of candidateLoops) {
+      if (loop.archivedAt) {
+        rows.push({ loop: publicLoop(loop), status: "skipped", reason: "loop is archived" });
+        continue;
+      }
+      if (loop.target.type !== "workflow") {
+        rows.push({ loop: publicLoop(loop), status: "skipped", reason: "loop is not a workflow loop" });
+        continue;
+      }
+      const workflow = store.requireWorkflow(loop.target.workflowId);
+      const nextWorkflowName = workflowGoalWrapperMigrationName(workflow);
+      const migration = workflowWithoutGoalWrapper(workflow, { name: nextWorkflowName });
+      if (!migration.changed) {
+        rows.push({ loop: publicLoop(loop), workflow: publicWorkflow(workflow), status: "skipped", reason: "workflow has no top-level goal wrapper" });
+        continue;
+      }
+      if (store.hasRunningRun(loop.id)) {
+        rows.push({ loop: publicLoop(loop), workflow: publicWorkflow(workflow), status: "blocked", reason: "loop has a running run; retry after it finishes" });
+        continue;
+      }
+      if (!opts.apply) {
+        rows.push({
+          loop: publicLoop(loop),
+          workflow: publicWorkflow(workflow),
+          status: "would_migrate",
+          nextWorkflowName,
+          removedGoal: workflow.goal
+        });
+        continue;
+      }
+      const migrated = store.createAndRetargetWorkflowLoop(loop.id, migration.body, {
+        workflowTimeoutMs: loop.target.timeoutMs,
+        archiveOld: Boolean(opts.archiveOld)
+      });
+      rows.push({
+        loop: publicLoop(migrated.loop),
+        previousWorkflow: publicWorkflow(migrated.previousWorkflow),
+        workflow: publicWorkflow(migrated.workflow),
+        archivedOld: migrated.archivedOld ? publicWorkflow(migrated.archivedOld) : undefined,
+        status: "migrated"
+      });
+    }
+    const summary = {
+      apply: Boolean(opts.apply),
+      total: rows.length,
+      migrated: rows.filter((row) => row.status === "migrated").length,
+      wouldMigrate: rows.filter((row) => row.status === "would_migrate").length,
+      blocked: rows.filter((row) => row.status === "blocked").length,
+      skipped: rows.filter((row) => row.status === "skipped").length
+    };
+    print({ summary, rows }, opts.apply ? `migrated=${summary.migrated} blocked=${summary.blocked} skipped=${summary.skipped}` : `would_migrate=${summary.wouldMigrate} blocked=${summary.blocked} skipped=${summary.skipped}`);
+  } finally {
+    store.close();
+  }
+});
 workflows.command("archive <idOrName>").action((idOrName) => {
   const store = new Store;
   try {
@@ -10139,7 +11384,7 @@ program.command("list").alias("ls").option("--status <status>", "filter by statu
       for (const loop of loops) {
         const machine = loop.machine ? `  machine=${loop.machine.id}` : "";
         const archive = loop.archivedAt ? `  archived=${loop.archivedAt} from=${loop.archivedFromStatus ?? "-"}` : "";
-        console.log(`${loop.id}  ${loop.status.padEnd(7)}  next=${loop.nextRunAt ?? "-"}  ${loop.name}${machine}${archive}`);
+        console.log(`${loop.id}  ${loop.status.padEnd(7)}  cadence=${scheduleLabel(loop.schedule)}  next=${loop.nextRunAt ?? "-"}  ${loop.name}${machine}${archive}`);
       }
     }
   } finally {
@@ -10779,11 +12024,11 @@ ${result.instructions.join(`
 });
 daemon.command("logs").option("-n, --lines <n>", "lines", "80").action((opts) => {
   const path = daemonLogPath();
-  if (!existsSync5(path)) {
+  if (!existsSync6(path)) {
     console.log("");
     return;
   }
-  const lines = readFileSync4(path, "utf8").trimEnd().split(`
+  const lines = readFileSync5(path, "utf8").trimEnd().split(`
 `);
   console.log(lines.slice(-Number(opts.lines)).join(`
 `));