@hasna/todos 0.11.94 → 0.12.1

package/dist/storage.js

@@ -62,15 +62,15 @@ __export(exports_config, {
   TODOS_STORAGE_FALLBACK_ENV: () => TODOS_STORAGE_FALLBACK_ENV,
   TODOS_STORAGE_ENV: () => TODOS_STORAGE_ENV,
   STORAGE_TABLES: () => STORAGE_TABLES,
-  CANONICAL_TODOS_RDS_RUNTIME_PATH: () => CANONICAL_TODOS_RDS_RUNTIME_PATH,
+  CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV: () => CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV,
   CANONICAL_TODOS_RDS_DATABASE: () => CANONICAL_TODOS_RDS_DATABASE,
-  CANONICAL_TODOS_RDS_CLUSTER: () => CANONICAL_TODOS_RDS_CLUSTER
+  CANONICAL_TODOS_RDS_CLUSTER_ENV: () => CANONICAL_TODOS_RDS_CLUSTER_ENV
 });
-function getCanonicalTodosRdsConfig() {
+function getCanonicalTodosRdsConfig(env = process.env) {
   return {
-    cluster: CANONICAL_TODOS_RDS_CLUSTER,
+    cluster: clean(env[CANONICAL_TODOS_RDS_CLUSTER_ENV]) ?? null,
     database: CANONICAL_TODOS_RDS_DATABASE,
-    runtimeSecretPath: CANONICAL_TODOS_RDS_RUNTIME_PATH,
+    runtimeSecretPath: clean(env[CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV]) ?? null,
     primaryEnv: TODOS_STORAGE_ENV.databaseUrl,
     fallbackEnv: TODOS_STORAGE_FALLBACK_ENV.databaseUrl
   };
@@ -203,7 +203,7 @@ function parsePositiveInteger(value, fallback) {
   }
   return parsed;
 }
-var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER = "hasna-xyz-infra-apps-prod-postgres", CANONICAL_TODOS_RDS_DATABASE = "todos", CANONICAL_TODOS_RDS_RUNTIME_PATH = "hasna/xyz/opensource/todos/prod/rds";
+var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos";
 var init_config = __esm(() => {
   TODOS_STORAGE_TABLES = [
     "todos_sync_records",
@@ -246,144 +246,6 @@ var init_config = __esm(() => {
   };
 });
 
-// src/types/index.ts
-var TASK_STATUSES, TASK_PRIORITIES, PLAN_STATUSES, VersionConflictError, TaskNotFoundError, ProjectNotFoundError, ResourceConflictError, PlanNotFoundError, LockError, AgentNotFoundError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError, DISPATCH_STATUSES, DispatchNotFoundError;
-var init_types = __esm(() => {
-  TASK_STATUSES = [
-    "pending",
-    "in_progress",
-    "completed",
-    "failed",
-    "cancelled"
-  ];
-  TASK_PRIORITIES = [
-    "low",
-    "medium",
-    "high",
-    "critical"
-  ];
-  PLAN_STATUSES = ["active", "completed", "archived"];
-  VersionConflictError = class VersionConflictError extends Error {
-    taskId;
-    expectedVersion;
-    actualVersion;
-    static code = "VERSION_CONFLICT";
-    static suggestion = "Fetch the task with get_task to get the current version before updating.";
-    constructor(taskId, expectedVersion, actualVersion) {
-      super(`Version conflict for task ${taskId}: expected ${expectedVersion}, got ${actualVersion}`);
-      this.taskId = taskId;
-      this.expectedVersion = expectedVersion;
-      this.actualVersion = actualVersion;
-      this.name = "VersionConflictError";
-    }
-  };
-  TaskNotFoundError = class TaskNotFoundError extends Error {
-    taskId;
-    static code = "TASK_NOT_FOUND";
-    static suggestion = "Verify the task ID. Use list_tasks or search_tasks to find the correct ID.";
-    constructor(taskId) {
-      super(`Task not found: ${taskId}`);
-      this.taskId = taskId;
-      this.name = "TaskNotFoundError";
-    }
-  };
-  ProjectNotFoundError = class ProjectNotFoundError extends Error {
-    projectId;
-    static code = "PROJECT_NOT_FOUND";
-    static suggestion = "Use list_projects to see available projects.";
-    constructor(projectId) {
-      super(`Project not found: ${projectId}`);
-      this.projectId = projectId;
-      this.name = "ProjectNotFoundError";
-    }
-  };
-  ResourceConflictError = class ResourceConflictError extends Error {
-    code;
-    constructor(code, message) {
-      super(message);
-      this.code = code;
-      this.name = "ResourceConflictError";
-    }
-  };
-  PlanNotFoundError = class PlanNotFoundError extends Error {
-    planId;
-    static code = "PLAN_NOT_FOUND";
-    static suggestion = "Use list_plans to see available plans.";
-    constructor(planId) {
-      super(`Plan not found: ${planId}`);
-      this.planId = planId;
-      this.name = "PlanNotFoundError";
-    }
-  };
-  LockError = class LockError extends Error {
-    taskId;
-    lockedBy;
-    static code = "LOCK_ERROR";
-    static suggestion = "Wait for the lock to expire (30 min) or contact the lock holder.";
-    constructor(taskId, lockedBy) {
-      super(`Task ${taskId} is locked by ${lockedBy}`);
-      this.taskId = taskId;
-      this.lockedBy = lockedBy;
-      this.name = "LockError";
-    }
-  };
-  AgentNotFoundError = class AgentNotFoundError extends Error {
-    agentId;
-    static code = "AGENT_NOT_FOUND";
-    static suggestion = "Use register_agent to create the agent first, or list_agents to find existing ones.";
-    constructor(agentId) {
-      super(`Agent not found: ${agentId}`);
-      this.agentId = agentId;
-      this.name = "AgentNotFoundError";
-    }
-  };
-  TaskListNotFoundError = class TaskListNotFoundError extends Error {
-    taskListId;
-    static code = "TASK_LIST_NOT_FOUND";
-    static suggestion = "Use list_task_lists to see available lists.";
-    constructor(taskListId) {
-      super(`Task list not found: ${taskListId}`);
-      this.taskListId = taskListId;
-      this.name = "TaskListNotFoundError";
-    }
-  };
-  DependencyCycleError = class DependencyCycleError extends Error {
-    taskId;
-    dependsOn;
-    static code = "DEPENDENCY_CYCLE";
-    static suggestion = "Check the dependency chain with get_task to avoid circular references.";
-    constructor(taskId, dependsOn) {
-      super(`Adding dependency ${taskId} -> ${dependsOn} would create a cycle`);
-      this.taskId = taskId;
-      this.dependsOn = dependsOn;
-      this.name = "DependencyCycleError";
-    }
-  };
-  CompletionGuardError = class CompletionGuardError extends Error {
-    reason;
-    retryAfterSeconds;
-    static code = "COMPLETION_BLOCKED";
-    static suggestion = "Wait for the cooldown period, then retry.";
-    constructor(reason, retryAfterSeconds) {
-      super(reason);
-      this.reason = reason;
-      this.retryAfterSeconds = retryAfterSeconds;
-      this.name = "CompletionGuardError";
-    }
-  };
-  DISPATCH_STATUSES = ["pending", "sent", "failed", "cancelled"];
-  DispatchNotFoundError = class DispatchNotFoundError extends Error {
-    dispatchId;
-    static code = "DISPATCH_NOT_FOUND";
-    static suggestion = "Check the dispatch ID with list_dispatches.";
-    constructor(dispatchId) {
-      super(`Dispatch not found: ${dispatchId}`);
-      this.dispatchId = dispatchId;
-      this.name = "DispatchNotFoundError";
-    }
-  };
-});
-
 // src/db/migrations.ts
 var MIGRATIONS;
 var init_migrations = __esm(() => {
@@ -1548,27 +1410,478 @@ var init_migrations = __esm(() => {
   ALTER TABLE plans ADD COLUMN slug TEXT;
   CREATE INDEX IF NOT EXISTS idx_plans_slug ON plans(slug);
   INSERT OR IGNORE INTO _migrations (id) VALUES (64);
+  `,
+    `
+  ALTER TABLE agents ADD COLUMN identity_id TEXT;
+  ALTER TABLE agents ADD COLUMN project_id TEXT;
+  ALTER TABLE agents ADD COLUMN runtime_instance_id TEXT;
+
+  CREATE TABLE IF NOT EXISTS agent_identity_source_mappings (
+    id TEXT PRIMARY KEY,
+    local_agent_id TEXT REFERENCES agents(id) ON DELETE RESTRICT,
+    identity_id TEXT,
+    source_authority TEXT NOT NULL CHECK(length(trim(source_authority)) > 0),
+    source_tenant_id TEXT NOT NULL CHECK(length(trim(source_tenant_id)) > 0),
+    source_namespace TEXT NOT NULL CHECK(length(trim(source_namespace)) > 0),
+    source_entity_type TEXT NOT NULL CHECK(length(trim(source_entity_type)) > 0),
+    source_record_id TEXT NOT NULL CHECK(length(trim(source_record_id)) > 0),
+    observed_label TEXT,
+    evidence TEXT NOT NULL DEFAULT '{}',
+    mapping_basis TEXT NOT NULL CHECK(mapping_basis IN ('authoritative', 'imported', 'candidate', 'name_similarity')),
+    status TEXT NOT NULL CHECK(status IN ('active', 'retired', 'quarantined', 'revoked')),
+    revision INTEGER NOT NULL CHECK(revision > 0),
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    CHECK(mapping_basis IN ('authoritative', 'imported') OR status IN ('quarantined', 'revoked')),
+    CHECK(status != 'active' OR (mapping_basis IN ('authoritative', 'imported') AND identity_id IS NOT NULL))
+  );
+  DROP INDEX IF EXISTS idx_agent_identity_source_active_unique;
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_identity_source_revision_unique
+    ON agent_identity_source_mappings (
+      source_authority, source_tenant_id, source_namespace, source_entity_type, source_record_id, revision
+    )
+    WHERE mapping_basis IN ('authoritative', 'imported');
+  CREATE INDEX IF NOT EXISTS idx_agent_identity_source_identity
+    ON agent_identity_source_mappings(identity_id);
+  CREATE INDEX IF NOT EXISTS idx_agent_identity_source_local
+    ON agent_identity_source_mappings(local_agent_id);
+  CREATE TABLE IF NOT EXISTS agent_identity_aliases (
+    id TEXT PRIMARY KEY,
+    local_agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE RESTRICT,
+    label TEXT NOT NULL,
+    normalized_label TEXT NOT NULL,
+    alias_kind TEXT NOT NULL CHECK(alias_kind IN ('historical', 'candidate')),
+    status TEXT NOT NULL CHECK(status IN ('active', 'quarantined', 'revoked')),
+    created_at TEXT NOT NULL,
+    UNIQUE(local_agent_id, normalized_label)
+  );
+  CREATE INDEX IF NOT EXISTS idx_agent_identity_alias_lookup
+    ON agent_identity_aliases(normalized_label, status);
+
+  CREATE TRIGGER IF NOT EXISTS trg_agents_identity_id_immutable
+  BEFORE UPDATE OF identity_id ON agents
+  WHEN OLD.identity_id IS NOT NULL AND OLD.identity_id IS NOT NEW.identity_id
+  BEGIN
+    SELECT RAISE(ABORT, 'IDENTITY_ID_IMMUTABLE');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS trg_agent_identity_mapping_identity_immutable
+  BEFORE UPDATE OF identity_id ON agent_identity_source_mappings
+  WHEN OLD.identity_id IS NOT NEW.identity_id
+  BEGIN
+    SELECT RAISE(ABORT, 'IDENTITY_ID_IMMUTABLE');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS trg_agent_identity_mapping_lineage_immutable
+  BEFORE UPDATE OF source_authority, source_tenant_id, source_namespace, source_entity_type, source_record_id
+    ON agent_identity_source_mappings
+  WHEN OLD.source_authority IS NOT NEW.source_authority
+    OR OLD.source_tenant_id IS NOT NEW.source_tenant_id
+    OR OLD.source_namespace IS NOT NEW.source_namespace
+    OR OLD.source_entity_type IS NOT NEW.source_entity_type
+    OR OLD.source_record_id IS NOT NEW.source_record_id
+  BEGIN
+    SELECT RAISE(ABORT, 'IDENTITY_SOURCE_LINEAGE_IMMUTABLE');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS trg_agent_identity_mapping_history_immutable
+  BEFORE UPDATE OF local_agent_id, observed_label, evidence, mapping_basis, status, revision, created_at
+    ON agent_identity_source_mappings
+  BEGIN
+    SELECT RAISE(ABORT, 'IDENTITY_MAPPING_HISTORY_IMMUTABLE');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS trg_agent_identity_mapping_history_append_only
+  BEFORE DELETE ON agent_identity_source_mappings
+  BEGIN
+    SELECT RAISE(ABORT, 'IDENTITY_MAPPING_HISTORY_IMMUTABLE');
+  END;
+
+  INSERT OR IGNORE INTO _migrations (id) VALUES (65);
+  `,
+    `
+  CREATE TABLE IF NOT EXISTS pr_groups (
+    schema_version INTEGER NOT NULL DEFAULT 1,
+    id TEXT PRIMARY KEY,
+    identity_key TEXT NOT NULL UNIQUE,
+    root_request_id TEXT NOT NULL,
+    repository TEXT NOT NULL,
+    state TEXT NOT NULL,
+    active_attempt_id TEXT,
+    active_generation TEXT,
+    terminal_attempt_id TEXT,
+    terminal_generation TEXT,
+    terminal_outcome TEXT,
+    terminal_head_sha TEXT,
+    terminal_at TEXT,
+    cleanup_eligible_at TEXT,
+    revision INTEGER NOT NULL DEFAULT 1,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_pr_groups_identity ON pr_groups(identity_key);
+  CREATE INDEX IF NOT EXISTS idx_pr_groups_root_repository ON pr_groups(root_request_id, repository);
+  CREATE INDEX IF NOT EXISTS idx_pr_groups_active_generation ON pr_groups(active_generation);
+
+  CREATE TABLE IF NOT EXISTS pr_group_attempts (
+    schema_version INTEGER NOT NULL DEFAULT 1,
+    id TEXT PRIMARY KEY,
+    group_id TEXT NOT NULL REFERENCES pr_groups(id) ON DELETE CASCADE,
+    leaf_task_id TEXT NOT NULL,
+    dispatch_attempt TEXT NOT NULL,
+    writer_generation TEXT NOT NULL,
+    previous_attempt_id TEXT REFERENCES pr_group_attempts(id) ON DELETE SET NULL,
+    worktree TEXT NOT NULL,
+    branch TEXT NOT NULL,
+    provider TEXT,
+    provider_run_id TEXT,
+    profile_alias TEXT,
+    status TEXT NOT NULL,
+    admitted_at TEXT NOT NULL,
+    started_at TEXT,
+    last_heartbeat_at TEXT,
+    handed_off_at TEXT,
+    fenced_at TEXT,
+    terminal_at TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    UNIQUE(group_id, leaf_task_id, dispatch_attempt),
+    UNIQUE(group_id, writer_generation)
+  );
+  CREATE INDEX IF NOT EXISTS idx_pr_group_attempts_group ON pr_group_attempts(group_id, created_at, id);
+  CREATE INDEX IF NOT EXISTS idx_pr_group_attempts_generation ON pr_group_attempts(group_id, writer_generation);
+
+  CREATE TABLE IF NOT EXISTS pr_group_events (
+    schema_version INTEGER NOT NULL DEFAULT 1,
+    id TEXT PRIMARY KEY,
+    group_id TEXT NOT NULL REFERENCES pr_groups(id) ON DELETE CASCADE,
+    attempt_id TEXT NOT NULL REFERENCES pr_group_attempts(id) ON DELETE CASCADE,
+    writer_generation TEXT NOT NULL,
+    sequence INTEGER NOT NULL,
+    idempotency_key TEXT NOT NULL,
+    event_type TEXT NOT NULL,
+    state TEXT NOT NULL,
+    message TEXT,
+    head_sha TEXT,
+    receipt_key TEXT,
+    outcome TEXT,
+    metadata TEXT NOT NULL DEFAULT '{}',
+    payload_hash TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    UNIQUE(group_id, sequence),
+    UNIQUE(group_id, idempotency_key),
+    UNIQUE(group_id, receipt_key)
+  );
+  CREATE INDEX IF NOT EXISTS idx_pr_group_events_group_sequence ON pr_group_events(group_id, sequence);
+  CREATE INDEX IF NOT EXISTS idx_pr_group_events_attempt ON pr_group_events(attempt_id, sequence);
+  CREATE INDEX IF NOT EXISTS idx_pr_group_events_receipt ON pr_group_events(group_id, receipt_key);
+  INSERT OR IGNORE INTO _migrations (id) VALUES (66);
+  `,
+    `
+  ALTER TABLE pr_groups ADD COLUMN leaf_task_id TEXT;
+  ALTER TABLE pr_groups ADD COLUMN branch TEXT;
+  ALTER TABLE pr_groups ADD COLUMN pr_number INTEGER;
+  ALTER TABLE pr_groups ADD COLUMN base_sha TEXT;
+  ALTER TABLE pr_groups ADD COLUMN repair_cycle_count INTEGER NOT NULL DEFAULT 0;
+  ALTER TABLE pr_groups ADD COLUMN repair_cycle_limit INTEGER NOT NULL DEFAULT 2;
+  ALTER TABLE pr_group_attempts ADD COLUMN repository TEXT;
+  ALTER TABLE pr_group_attempts ADD COLUMN pr_number INTEGER;
+  ALTER TABLE pr_group_attempts ADD COLUMN base_sha TEXT;
+  ALTER TABLE pr_group_events ADD COLUMN review_receipt_key TEXT;
+  ALTER TABLE pr_group_events ADD COLUMN conditional_merge_receipt_key TEXT;
+  ALTER TABLE pr_group_events ADD COLUMN repository TEXT;
+  ALTER TABLE pr_group_events ADD COLUMN pr_number INTEGER;
+  ALTER TABLE pr_group_events ADD COLUMN base_sha TEXT;
+  ALTER TABLE pr_group_events ADD COLUMN actor_id TEXT;
+  ALTER TABLE pr_group_events ADD COLUMN actor_run_id TEXT;
+  ALTER TABLE pr_group_events ADD COLUMN expected_reviewer_id TEXT;
+  ALTER TABLE pr_group_events ADD COLUMN expected_reviewer_run_id TEXT;
+  ALTER TABLE pr_group_events ADD COLUMN repair_cycle INTEGER;
+  ALTER TABLE pr_group_events ADD COLUMN cleanup_proof TEXT;
+
+  UPDATE pr_groups
+  SET leaf_task_id = COALESCE(leaf_task_id, (
+        SELECT attempt.leaf_task_id
+        FROM pr_group_attempts AS attempt
+        WHERE attempt.group_id = pr_groups.id
+        ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+                 attempt.created_at ASC, attempt.id ASC
+        LIMIT 1
+      )),
+      branch = COALESCE(branch, (
+        SELECT attempt.branch
+        FROM pr_group_attempts AS attempt
+        WHERE attempt.group_id = pr_groups.id
+        ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+                 attempt.created_at ASC, attempt.id ASC
+        LIMIT 1
+      ));
+
+  UPDATE pr_group_attempts
+  SET repository = COALESCE(repository, (
+        SELECT groups.repository FROM pr_groups AS groups
+        WHERE groups.id = pr_group_attempts.group_id
+      )),
+      pr_number = COALESCE(pr_number, (
+        SELECT groups.pr_number FROM pr_groups AS groups
+        WHERE groups.id = pr_group_attempts.group_id
+      )),
+      base_sha = COALESCE(base_sha, (
+        SELECT groups.base_sha FROM pr_groups AS groups
+        WHERE groups.id = pr_group_attempts.group_id
+      ));
+
+  UPDATE pr_groups
+  SET pr_number = COALESCE(pr_number, (
+        SELECT attempt.pr_number
+        FROM pr_group_attempts AS attempt
+        WHERE attempt.group_id = pr_groups.id AND attempt.pr_number IS NOT NULL
+        ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+                 attempt.created_at ASC, attempt.id ASC
+        LIMIT 1
+      )),
+      base_sha = COALESCE(base_sha, (
+        SELECT attempt.base_sha
+        FROM pr_group_attempts AS attempt
+        WHERE attempt.group_id = pr_groups.id AND attempt.base_sha IS NOT NULL
+        ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+                 attempt.created_at ASC, attempt.id ASC
+        LIMIT 1
+      ));
+
+  UPDATE pr_group_attempts
+  SET pr_number = COALESCE(pr_number, (
+        SELECT groups.pr_number FROM pr_groups AS groups
+        WHERE groups.id = pr_group_attempts.group_id
+      )),
+      base_sha = COALESCE(base_sha, (
+        SELECT groups.base_sha FROM pr_groups AS groups
+        WHERE groups.id = pr_group_attempts.group_id
+      ));
+
+  UPDATE pr_group_events
+  SET repository = COALESCE(repository, (
+        SELECT attempt.repository FROM pr_group_attempts AS attempt
+        WHERE attempt.id = pr_group_events.attempt_id
+      ), (
+        SELECT groups.repository FROM pr_groups AS groups
+        WHERE groups.id = pr_group_events.group_id
+      )),
+      pr_number = COALESCE(pr_number, (
+        SELECT attempt.pr_number FROM pr_group_attempts AS attempt
+        WHERE attempt.id = pr_group_events.attempt_id
+      ), (
+        SELECT groups.pr_number FROM pr_groups AS groups
+        WHERE groups.id = pr_group_events.group_id
+      )),
+      base_sha = COALESCE(base_sha, (
+        SELECT attempt.base_sha FROM pr_group_attempts AS attempt
+        WHERE attempt.id = pr_group_events.attempt_id
+      ), (
+        SELECT groups.base_sha FROM pr_groups AS groups
+        WHERE groups.id = pr_group_events.group_id
+      ));
+
+  INSERT OR IGNORE INTO _migrations (id)
+  SELECT 66
+  WHERE NOT EXISTS (
+    SELECT 1 FROM pr_groups WHERE leaf_task_id IS NULL OR branch IS NULL
+  )
+    AND NOT EXISTS (
+      SELECT 1 FROM pr_group_attempts WHERE repository IS NULL
+    )
+    AND NOT EXISTS (
+      SELECT 1 FROM pr_group_events WHERE repository IS NULL
+    );
+  `,
+    `
+  PRAGMA foreign_keys = OFF;
+  BEGIN IMMEDIATE;
+
+  ALTER TABLE pr_group_events RENAME TO pr_group_events_v66;
+  ALTER TABLE pr_group_attempts RENAME TO pr_group_attempts_v66;
+  ALTER TABLE pr_groups RENAME TO pr_groups_v66;
+
+  CREATE TABLE pr_groups (
+    schema_version INTEGER NOT NULL DEFAULT 1,
+    id TEXT PRIMARY KEY,
+    identity_key TEXT NOT NULL UNIQUE,
+    root_request_id TEXT NOT NULL,
+    repository TEXT NOT NULL,
+    leaf_task_id TEXT NOT NULL,
+    branch TEXT NOT NULL,
+    pr_number INTEGER,
+    base_sha TEXT,
+    state TEXT NOT NULL,
+    active_attempt_id TEXT,
+    active_generation TEXT,
+    repair_cycle_count INTEGER NOT NULL DEFAULT 0,
+    repair_cycle_limit INTEGER NOT NULL DEFAULT 2,
+    terminal_attempt_id TEXT,
+    terminal_generation TEXT,
+    terminal_outcome TEXT,
+    terminal_head_sha TEXT,
+    terminal_at TEXT,
+    cleanup_eligible_at TEXT,
+    revision INTEGER NOT NULL DEFAULT 1,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+
+  CREATE TABLE pr_group_attempts (
+    schema_version INTEGER NOT NULL DEFAULT 1,
+    id TEXT PRIMARY KEY,
+    group_id TEXT NOT NULL REFERENCES pr_groups(id) ON DELETE CASCADE,
+    leaf_task_id TEXT NOT NULL,
+    dispatch_attempt TEXT NOT NULL,
+    writer_generation TEXT NOT NULL,
+    previous_attempt_id TEXT REFERENCES pr_group_attempts(id) ON DELETE SET NULL,
+    worktree TEXT NOT NULL,
+    branch TEXT NOT NULL,
+    repository TEXT NOT NULL,
+    pr_number INTEGER,
+    base_sha TEXT,
+    provider TEXT,
+    provider_run_id TEXT,
+    profile_alias TEXT,
+    status TEXT NOT NULL,
+    admitted_at TEXT NOT NULL,
+    started_at TEXT,
+    last_heartbeat_at TEXT,
+    handed_off_at TEXT,
+    fenced_at TEXT,
+    terminal_at TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    UNIQUE(group_id, leaf_task_id, dispatch_attempt),
+    UNIQUE(group_id, writer_generation)
+  );
+
+  CREATE TABLE pr_group_events (
+    schema_version INTEGER NOT NULL DEFAULT 1,
+    id TEXT PRIMARY KEY,
+    group_id TEXT NOT NULL REFERENCES pr_groups(id) ON DELETE CASCADE,
+    attempt_id TEXT NOT NULL REFERENCES pr_group_attempts(id) ON DELETE CASCADE,
+    writer_generation TEXT NOT NULL,
+    sequence INTEGER NOT NULL,
+    idempotency_key TEXT NOT NULL,
+    event_type TEXT NOT NULL,
+    state TEXT NOT NULL,
+    message TEXT,
+    head_sha TEXT,
+    receipt_key TEXT UNIQUE,
+    review_receipt_key TEXT,
+    conditional_merge_receipt_key TEXT,
+    outcome TEXT,
+    repository TEXT NOT NULL,
+    pr_number INTEGER,
+    base_sha TEXT,
+    actor_id TEXT,
+    actor_run_id TEXT,
+    expected_reviewer_id TEXT,
+    expected_reviewer_run_id TEXT,
+    repair_cycle INTEGER,
+    ci_proof TEXT,
+    cleanup_proof TEXT,
+    metadata TEXT NOT NULL DEFAULT '{}',
+    payload_hash TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    UNIQUE(group_id, sequence),
+    UNIQUE(group_id, idempotency_key)
+  );
+
+  INSERT INTO pr_groups (
+    schema_version,id,identity_key,root_request_id,repository,leaf_task_id,branch,
+    pr_number,base_sha,state,active_attempt_id,active_generation,
+    repair_cycle_count,repair_cycle_limit,terminal_attempt_id,terminal_generation,
+    terminal_outcome,terminal_head_sha,terminal_at,cleanup_eligible_at,
+    revision,created_at,updated_at
+  )
+  SELECT
+    schema_version,id,identity_key,root_request_id,repository,leaf_task_id,branch,
+    pr_number,base_sha,state,active_attempt_id,active_generation,
+    repair_cycle_count,repair_cycle_limit,terminal_attempt_id,terminal_generation,
+    terminal_outcome,terminal_head_sha,terminal_at,cleanup_eligible_at,
+    revision,created_at,updated_at
+  FROM pr_groups_v66;
+
+  INSERT INTO pr_group_attempts (
+    schema_version,id,group_id,leaf_task_id,dispatch_attempt,writer_generation,
+    previous_attempt_id,worktree,branch,repository,pr_number,base_sha,
+    provider,provider_run_id,profile_alias,status,admitted_at,started_at,
+    last_heartbeat_at,handed_off_at,fenced_at,terminal_at,created_at,updated_at
+  )
+  SELECT
+    schema_version,id,group_id,leaf_task_id,dispatch_attempt,writer_generation,
+    previous_attempt_id,worktree,branch,repository,pr_number,base_sha,
+    provider,provider_run_id,profile_alias,status,admitted_at,started_at,
+    last_heartbeat_at,handed_off_at,fenced_at,terminal_at,created_at,updated_at
+  FROM pr_group_attempts_v66;
+
+  INSERT INTO pr_group_events (
+    schema_version,id,group_id,attempt_id,writer_generation,sequence,
+    idempotency_key,event_type,state,message,head_sha,receipt_key,
+    review_receipt_key,conditional_merge_receipt_key,outcome,repository,
+    pr_number,base_sha,actor_id,actor_run_id,expected_reviewer_id,
+    expected_reviewer_run_id,repair_cycle,ci_proof,cleanup_proof,
+    metadata,payload_hash,created_at
+  )
+  SELECT
+    schema_version,id,group_id,attempt_id,writer_generation,sequence,
+    idempotency_key,event_type,state,message,head_sha,receipt_key,
+    review_receipt_key,conditional_merge_receipt_key,outcome,repository,
+    pr_number,base_sha,actor_id,actor_run_id,expected_reviewer_id,
+    expected_reviewer_run_id,repair_cycle,NULL,cleanup_proof,
+    metadata,payload_hash,created_at
+  FROM pr_group_events_v66;
+
+  DROP TABLE pr_group_events_v66;
+  DROP TABLE pr_group_attempts_v66;
+  DROP TABLE pr_groups_v66;
+
+  CREATE UNIQUE INDEX idx_pr_groups_identity ON pr_groups(identity_key);
+  CREATE INDEX idx_pr_groups_root_repository ON pr_groups(root_request_id, repository);
+  CREATE INDEX idx_pr_groups_active_generation ON pr_groups(active_generation);
+  CREATE INDEX idx_pr_group_attempts_group ON pr_group_attempts(group_id, created_at, id);
+  CREATE INDEX idx_pr_group_attempts_generation ON pr_group_attempts(group_id, writer_generation);
+  CREATE INDEX idx_pr_group_events_group_sequence ON pr_group_events(group_id, sequence);
+  CREATE INDEX idx_pr_group_events_attempt ON pr_group_events(attempt_id, sequence);
+  CREATE INDEX idx_pr_group_events_receipt ON pr_group_events(receipt_key);
+
+  INSERT OR IGNORE INTO _migrations (id) VALUES (68);
+  COMMIT;
+  PRAGMA foreign_keys = ON;
   `
   ];
 });
 
 // src/db/schema.ts
 function runMigrations(db) {
+  let strictMigrationFailure = null;
+  const executeMigration = (migration, index) => {
+    try {
+      db.exec(migration);
+    } catch (error) {
+      try {
+        db.exec("ROLLBACK");
+      } catch {}
+      if (index + 1 >= 68)
+        strictMigrationFailure = error;
+    }
+  };
   try {
     const result = db.query("SELECT MAX(id) as max_id FROM _migrations").get();
     const currentLevel = result?.max_id ?? 0;
     for (let i = currentLevel;i < MIGRATIONS.length; i++) {
-      try {
-        db.exec(MIGRATIONS[i]);
-      } catch {}
+      executeMigration(MIGRATIONS[i], i);
     }
   } catch {
-    for (const migration of MIGRATIONS) {
-      try {
-        db.exec(migration);
-      } catch {}
+    for (const [index, migration] of MIGRATIONS.entries()) {
+      executeMigration(migration, index);
     }
   }
+  if (strictMigrationFailure)
+    throw strictMigrationFailure;
   ensureSchema(db);
 }
 function planSlugBase(value) {
@@ -2737,6 +3050,246 @@ function ensureSchema(db) {
     )`);
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_api_keys_prefix ON api_keys(prefix)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_api_keys_active ON api_keys(revoked_at, expires_at)");
+  ensureTable("pr_groups", `
+    CREATE TABLE pr_groups (
+      schema_version INTEGER NOT NULL DEFAULT 1,
+      id TEXT PRIMARY KEY,
+      identity_key TEXT NOT NULL UNIQUE,
+      root_request_id TEXT NOT NULL,
+      repository TEXT NOT NULL,
+      leaf_task_id TEXT NOT NULL,
+      branch TEXT NOT NULL,
+      pr_number INTEGER,
+      base_sha TEXT,
+      state TEXT NOT NULL,
+      active_attempt_id TEXT,
+      active_generation TEXT,
+      repair_cycle_count INTEGER NOT NULL DEFAULT 0,
+      repair_cycle_limit INTEGER NOT NULL DEFAULT 2,
+      terminal_attempt_id TEXT,
+      terminal_generation TEXT,
+      terminal_outcome TEXT,
+      terminal_head_sha TEXT,
+      terminal_at TEXT,
+      cleanup_eligible_at TEXT,
+      revision INTEGER NOT NULL DEFAULT 1,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    )`);
+  ensureIndex("CREATE UNIQUE INDEX IF NOT EXISTS idx_pr_groups_identity ON pr_groups(identity_key)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_pr_groups_root_repository ON pr_groups(root_request_id, repository)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_pr_groups_active_generation ON pr_groups(active_generation)");
+  ensureTable("pr_group_attempts", `
+    CREATE TABLE pr_group_attempts (
+      schema_version INTEGER NOT NULL DEFAULT 1,
+      id TEXT PRIMARY KEY,
+      group_id TEXT NOT NULL REFERENCES pr_groups(id) ON DELETE CASCADE,
+      leaf_task_id TEXT NOT NULL,
+      dispatch_attempt TEXT NOT NULL,
+      writer_generation TEXT NOT NULL,
+      previous_attempt_id TEXT REFERENCES pr_group_attempts(id) ON DELETE SET NULL,
+      worktree TEXT NOT NULL,
+      branch TEXT NOT NULL,
+      repository TEXT NOT NULL,
+      pr_number INTEGER,
+      base_sha TEXT,
+      provider TEXT,
+      provider_run_id TEXT,
+      profile_alias TEXT,
+      status TEXT NOT NULL,
+      admitted_at TEXT NOT NULL,
+      started_at TEXT,
+      last_heartbeat_at TEXT,
+      handed_off_at TEXT,
+      fenced_at TEXT,
+      terminal_at TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      UNIQUE(group_id, leaf_task_id, dispatch_attempt),
+      UNIQUE(group_id, writer_generation)
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_pr_group_attempts_group ON pr_group_attempts(group_id, created_at, id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_pr_group_attempts_generation ON pr_group_attempts(group_id, writer_generation)");
+  ensureTable("pr_group_events", `
+    CREATE TABLE pr_group_events (
+      schema_version INTEGER NOT NULL DEFAULT 1,
+      id TEXT PRIMARY KEY,
+      group_id TEXT NOT NULL REFERENCES pr_groups(id) ON DELETE CASCADE,
+      attempt_id TEXT NOT NULL REFERENCES pr_group_attempts(id) ON DELETE CASCADE,
+      writer_generation TEXT NOT NULL,
+      sequence INTEGER NOT NULL,
+      idempotency_key TEXT NOT NULL,
+      event_type TEXT NOT NULL,
+      state TEXT NOT NULL,
+      message TEXT,
+      head_sha TEXT,
+      receipt_key TEXT UNIQUE,
+      review_receipt_key TEXT,
+      conditional_merge_receipt_key TEXT,
+      outcome TEXT,
+      repository TEXT NOT NULL,
+      pr_number INTEGER,
+      base_sha TEXT,
+      actor_id TEXT,
+      actor_run_id TEXT,
+      expected_reviewer_id TEXT,
+      expected_reviewer_run_id TEXT,
+      repair_cycle INTEGER,
+      ci_proof TEXT,
+      cleanup_proof TEXT,
+      metadata TEXT NOT NULL DEFAULT '{}',
+      payload_hash TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      UNIQUE(group_id, sequence),
+      UNIQUE(group_id, idempotency_key)
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_pr_group_events_group_sequence ON pr_group_events(group_id, sequence)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_pr_group_events_attempt ON pr_group_events(attempt_id, sequence)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_pr_group_events_receipt ON pr_group_events(receipt_key)");
+  ensureColumn("pr_groups", "leaf_task_id", "TEXT");
+  ensureColumn("pr_groups", "branch", "TEXT");
+  ensureColumn("pr_groups", "pr_number", "INTEGER");
+  ensureColumn("pr_groups", "base_sha", "TEXT");
+  ensureColumn("pr_groups", "repair_cycle_count", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn("pr_groups", "repair_cycle_limit", "INTEGER NOT NULL DEFAULT 2");
+  ensureColumn("pr_group_attempts", "repository", "TEXT");
+  ensureColumn("pr_group_attempts", "pr_number", "INTEGER");
+  ensureColumn("pr_group_attempts", "base_sha", "TEXT");
+  ensureColumn("pr_group_events", "review_receipt_key", "TEXT");
+  ensureColumn("pr_group_events", "conditional_merge_receipt_key", "TEXT");
+  ensureColumn("pr_group_events", "repository", "TEXT");
+  ensureColumn("pr_group_events", "pr_number", "INTEGER");
+  ensureColumn("pr_group_events", "base_sha", "TEXT");
+  ensureColumn("pr_group_events", "actor_id", "TEXT");
+  ensureColumn("pr_group_events", "actor_run_id", "TEXT");
+  ensureColumn("pr_group_events", "expected_reviewer_id", "TEXT");
+  ensureColumn("pr_group_events", "expected_reviewer_run_id", "TEXT");
+  ensureColumn("pr_group_events", "repair_cycle", "INTEGER");
+  ensureColumn("pr_group_events", "ci_proof", "TEXT");
+  ensureColumn("pr_group_events", "cleanup_proof", "TEXT");
+  try {
+    db.exec(`
+      UPDATE pr_groups
+      SET leaf_task_id = COALESCE(leaf_task_id, (
+            SELECT attempt.leaf_task_id
+            FROM pr_group_attempts AS attempt
+            WHERE attempt.group_id = pr_groups.id
+            ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+                     attempt.created_at ASC, attempt.id ASC
+            LIMIT 1
+          )),
+          branch = COALESCE(branch, (
+            SELECT attempt.branch
+            FROM pr_group_attempts AS attempt
+            WHERE attempt.group_id = pr_groups.id
+            ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+                     attempt.created_at ASC, attempt.id ASC
+            LIMIT 1
+          ));
+      UPDATE pr_group_attempts
+      SET repository = COALESCE(repository, (
+            SELECT groups.repository FROM pr_groups AS groups
+            WHERE groups.id = pr_group_attempts.group_id
+          )),
+          pr_number = COALESCE(pr_number, (
+            SELECT groups.pr_number FROM pr_groups AS groups
+            WHERE groups.id = pr_group_attempts.group_id
+          )),
+          base_sha = COALESCE(base_sha, (
+            SELECT groups.base_sha FROM pr_groups AS groups
+            WHERE groups.id = pr_group_attempts.group_id
+          ));
+      UPDATE pr_groups
+      SET pr_number = COALESCE(pr_number, (
+            SELECT attempt.pr_number
+            FROM pr_group_attempts AS attempt
+            WHERE attempt.group_id = pr_groups.id AND attempt.pr_number IS NOT NULL
+            ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+                     attempt.created_at ASC, attempt.id ASC
+            LIMIT 1
+          )),
+          base_sha = COALESCE(base_sha, (
+            SELECT attempt.base_sha
+            FROM pr_group_attempts AS attempt
+            WHERE attempt.group_id = pr_groups.id AND attempt.base_sha IS NOT NULL
+            ORDER BY CASE WHEN attempt.id = pr_groups.active_attempt_id THEN 0 ELSE 1 END,
+                     attempt.created_at ASC, attempt.id ASC
+            LIMIT 1
+          ));
+      UPDATE pr_group_attempts
+      SET pr_number = COALESCE(pr_number, (
+            SELECT groups.pr_number FROM pr_groups AS groups
+            WHERE groups.id = pr_group_attempts.group_id
+          )),
+          base_sha = COALESCE(base_sha, (
+            SELECT groups.base_sha FROM pr_groups AS groups
+            WHERE groups.id = pr_group_attempts.group_id
+          ));
+      UPDATE pr_group_events
+      SET repository = COALESCE(repository, (
+            SELECT attempt.repository FROM pr_group_attempts AS attempt
+            WHERE attempt.id = pr_group_events.attempt_id
+          ), (
+            SELECT groups.repository FROM pr_groups AS groups
+            WHERE groups.id = pr_group_events.group_id
+          )),
+          pr_number = COALESCE(pr_number, (
+            SELECT attempt.pr_number FROM pr_group_attempts AS attempt
+            WHERE attempt.id = pr_group_events.attempt_id
+          ), (
+            SELECT groups.pr_number FROM pr_groups AS groups
+            WHERE groups.id = pr_group_events.group_id
+          )),
+          base_sha = COALESCE(base_sha, (
+            SELECT attempt.base_sha FROM pr_group_attempts AS attempt
+            WHERE attempt.id = pr_group_events.attempt_id
+          ), (
+            SELECT groups.base_sha FROM pr_groups AS groups
+            WHERE groups.id = pr_group_events.group_id
+          ));
+      INSERT OR IGNORE INTO _migrations (id)
+      SELECT 66
+      WHERE NOT EXISTS (
+        SELECT 1 FROM pr_groups WHERE leaf_task_id IS NULL OR branch IS NULL
+      )
+        AND NOT EXISTS (
+          SELECT 1 FROM pr_group_attempts WHERE repository IS NULL
+        )
+        AND NOT EXISTS (
+          SELECT 1 FROM pr_group_events WHERE repository IS NULL
+        );
+    `);
+  } catch {}
+  const strictColumns = [
+    ["pr_groups", "leaf_task_id"],
+    ["pr_groups", "branch"],
+    ["pr_group_attempts", "repository"],
+    ["pr_group_events", "repository"]
+  ];
+  for (const [table, column] of strictColumns) {
+    const definition = db.query(`PRAGMA table_info(${table})`).all();
+    if (definition.find((entry) => entry.name === column)?.notnull !== 1) {
+      throw new Error(`PR-group schema integrity failure: ${table}.${column} is not NOT NULL`);
+    }
+  }
+  const eventColumns = db.query("PRAGMA table_info(pr_group_events)").all();
+  if (!eventColumns.some((entry) => entry.name === "ci_proof")) {
+    throw new Error("PR-group schema integrity failure: pr_group_events.ci_proof is missing");
+  }
+  const receiptIndexes = db.query("PRAGMA index_list(pr_group_events)").all();
+  const hasGlobalReceiptUniqueness = receiptIndexes.some((index) => {
+    if (index.unique !== 1)
+      return false;
+    const columns = db.query(`PRAGMA index_info(${JSON.stringify(index.name)})`).all();
+    return columns.length === 1 && columns[0]?.name === "receipt_key";
+  });
+  if (!hasGlobalReceiptUniqueness) {
+    throw new Error("PR-group schema integrity failure: receipt_key is not globally unique");
+  }
+  const strictMigration = db.query("SELECT 1 AS ok FROM _migrations WHERE id = 68").get();
+  if (strictMigration?.ok !== 1) {
+    throw new Error("PR-group schema integrity failure: migration 68 is not recorded");
+  }
 }
 function backfillTaskTags(db) {
   try {
@@ -3077,6 +3630,334 @@ var init_machines = __esm(() => {
   ];
 });
 
+// src/types/index.ts
+var TASK_STATUSES, TASK_PRIORITIES, PLAN_STATUSES, VersionConflictError, TaskNotFoundError, ProjectNotFoundError, ResourceConflictError, PlanNotFoundError, LockError, AgentNotFoundError, IdentityAliasAmbiguousError, IdentityIdImmutableError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError, DISPATCH_STATUSES, DispatchNotFoundError;
+var init_types = __esm(() => {
+  TASK_STATUSES = [
+    "pending",
+    "in_progress",
+    "completed",
+    "failed",
+    "cancelled"
+  ];
+  TASK_PRIORITIES = [
+    "low",
+    "medium",
+    "high",
+    "critical"
+  ];
+  PLAN_STATUSES = ["active", "completed", "archived"];
+  VersionConflictError = class VersionConflictError extends Error {
+    taskId;
+    expectedVersion;
+    actualVersion;
+    static code = "VERSION_CONFLICT";
+    static suggestion = "Fetch the task with get_task to get the current version before updating.";
+    constructor(taskId, expectedVersion, actualVersion) {
+      super(`Version conflict for task ${taskId}: expected ${expectedVersion}, got ${actualVersion}`);
+      this.taskId = taskId;
+      this.expectedVersion = expectedVersion;
+      this.actualVersion = actualVersion;
+      this.name = "VersionConflictError";
+    }
+  };
+  TaskNotFoundError = class TaskNotFoundError extends Error {
+    taskId;
+    static code = "TASK_NOT_FOUND";
+    static suggestion = "Verify the task ID. Use list_tasks or search_tasks to find the correct ID.";
+    constructor(taskId) {
+      super(`Task not found: ${taskId}`);
+      this.taskId = taskId;
+      this.name = "TaskNotFoundError";
+    }
+  };
+  ProjectNotFoundError = class ProjectNotFoundError extends Error {
+    projectId;
+    static code = "PROJECT_NOT_FOUND";
+    static suggestion = "Use list_projects to see available projects.";
+    constructor(projectId) {
+      super(`Project not found: ${projectId}`);
+      this.projectId = projectId;
+      this.name = "ProjectNotFoundError";
+    }
+  };
+  ResourceConflictError = class ResourceConflictError extends Error {
+    code;
+    constructor(code, message) {
+      super(message);
+      this.code = code;
+      this.name = "ResourceConflictError";
+    }
+  };
+  PlanNotFoundError = class PlanNotFoundError extends Error {
+    planId;
+    static code = "PLAN_NOT_FOUND";
+    static suggestion = "Use list_plans to see available plans.";
+    constructor(planId) {
+      super(`Plan not found: ${planId}`);
+      this.planId = planId;
+      this.name = "PlanNotFoundError";
+    }
+  };
+  LockError = class LockError extends Error {
+    taskId;
+    lockedBy;
+    static code = "LOCK_ERROR";
+    static suggestion = "Wait for the lock to expire (30 min) or contact the lock holder.";
+    constructor(taskId, lockedBy) {
+      super(`Task ${taskId} is locked by ${lockedBy}`);
+      this.taskId = taskId;
+      this.lockedBy = lockedBy;
+      this.name = "LockError";
+    }
+  };
+  AgentNotFoundError = class AgentNotFoundError extends Error {
+    agentId;
+    static code = "AGENT_NOT_FOUND";
+    static suggestion = "Use register_agent to create the agent first, or list_agents to find existing ones.";
+    constructor(agentId) {
+      super(`Agent not found: ${agentId}`);
+      this.agentId = agentId;
+      this.name = "AgentNotFoundError";
+    }
+  };
+  IdentityAliasAmbiguousError = class IdentityAliasAmbiguousError extends Error {
+    code = "IDENTITY_ALIAS_AMBIGUOUS";
+    candidates;
+    constructor(subject, candidates = []) {
+      super(`Identity alias or source is ambiguous: ${subject}`);
+      this.name = "IdentityAliasAmbiguousError";
+      this.candidates = [...new Set(candidates)].sort();
+    }
+  };
+  IdentityIdImmutableError = class IdentityIdImmutableError extends Error {
+    code = "IDENTITY_ID_IMMUTABLE";
+    constructor(agentId) {
+      super(`IDENTITY_ID_IMMUTABLE: canonical identity for agent ${agentId} cannot be replaced`);
+      this.name = "IdentityIdImmutableError";
+    }
+  };
+  TaskListNotFoundError = class TaskListNotFoundError extends Error {
+    taskListId;
+    static code = "TASK_LIST_NOT_FOUND";
+    static suggestion = "Use list_task_lists to see available lists.";
+    constructor(taskListId) {
+      super(`Task list not found: ${taskListId}`);
+      this.taskListId = taskListId;
+      this.name = "TaskListNotFoundError";
+    }
+  };
+  DependencyCycleError = class DependencyCycleError extends Error {
+    taskId;
+    dependsOn;
+    static code = "DEPENDENCY_CYCLE";
+    static suggestion = "Check the dependency chain with get_task to avoid circular references.";
+    constructor(taskId, dependsOn) {
+      super(`Adding dependency ${taskId} -> ${dependsOn} would create a cycle`);
+      this.taskId = taskId;
+      this.dependsOn = dependsOn;
+      this.name = "DependencyCycleError";
+    }
+  };
+  CompletionGuardError = class CompletionGuardError extends Error {
+    reason;
+    retryAfterSeconds;
+    static code = "COMPLETION_BLOCKED";
+    static suggestion = "Wait for the cooldown period, then retry.";
+    constructor(reason, retryAfterSeconds) {
+      super(reason);
+      this.reason = reason;
+      this.retryAfterSeconds = retryAfterSeconds;
+      this.name = "CompletionGuardError";
+    }
+  };
+  DISPATCH_STATUSES = ["pending", "sent", "failed", "cancelled"];
+  DispatchNotFoundError = class DispatchNotFoundError extends Error {
+    dispatchId;
+    static code = "DISPATCH_NOT_FOUND";
+    static suggestion = "Check the dispatch ID with list_dispatches.";
+    constructor(dispatchId) {
+      super(`Dispatch not found: ${dispatchId}`);
+      this.dispatchId = dispatchId;
+      this.name = "DispatchNotFoundError";
+    }
+  };
+});
+
+// src/db/identity-mapping.ts
+function timestamp() {
+  return new Date().toISOString();
+}
+function mappingId() {
+  return crypto.randomUUID();
+}
+function normalizedAlias(label) {
+  const normalized = label.trim().toLocaleLowerCase("en-US");
+  if (!normalized)
+    throw new Error("IDENTITY_ALIAS_INVALID: label is required");
+  return normalized;
+}
+function ensureColumn(db, table, column, type) {
+  const columns = db.query(`PRAGMA table_info(${table})`).all();
+  if (!columns.some((item) => item.name === column)) {
+    db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${type}`);
+  }
+}
+function ensureAgentIdentitySchema(db) {
+  const install = db.transaction(() => {
+    ensureColumn(db, "agents", "identity_id", "TEXT");
+    ensureColumn(db, "agents", "project_id", "TEXT");
+    ensureColumn(db, "agents", "runtime_instance_id", "TEXT");
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS agent_identity_source_mappings (
+        id TEXT PRIMARY KEY,
+        local_agent_id TEXT REFERENCES agents(id) ON DELETE RESTRICT,
+        identity_id TEXT,
+        source_authority TEXT NOT NULL CHECK(length(trim(source_authority)) > 0),
+        source_tenant_id TEXT NOT NULL CHECK(length(trim(source_tenant_id)) > 0),
+        source_namespace TEXT NOT NULL CHECK(length(trim(source_namespace)) > 0),
+        source_entity_type TEXT NOT NULL CHECK(length(trim(source_entity_type)) > 0),
+        source_record_id TEXT NOT NULL CHECK(length(trim(source_record_id)) > 0),
+        observed_label TEXT,
+        evidence TEXT NOT NULL DEFAULT '{}',
+        mapping_basis TEXT NOT NULL CHECK(mapping_basis IN ('authoritative', 'imported', 'candidate', 'name_similarity')),
+        status TEXT NOT NULL CHECK(status IN ('active', 'retired', 'quarantined', 'revoked')),
+        revision INTEGER NOT NULL CHECK(revision > 0),
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        CHECK(mapping_basis IN ('authoritative', 'imported') OR status IN ('quarantined', 'revoked')),
+        CHECK(status != 'active' OR (mapping_basis IN ('authoritative', 'imported') AND identity_id IS NOT NULL))
+      );
+    `);
+    ensureColumn(db, "agent_identity_source_mappings", "revision", "INTEGER NOT NULL DEFAULT 1");
+    ensureColumn(db, "agent_identity_source_mappings", "evidence", "TEXT NOT NULL DEFAULT '{}'");
+    db.exec(`
+      DROP INDEX IF EXISTS idx_agent_identity_source_active_unique;
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_identity_source_revision_unique
+        ON agent_identity_source_mappings (
+          source_authority, source_tenant_id, source_namespace, source_entity_type, source_record_id, revision
+        )
+        WHERE mapping_basis IN ('authoritative', 'imported');
+      CREATE INDEX IF NOT EXISTS idx_agent_identity_source_identity
+        ON agent_identity_source_mappings(identity_id);
+      CREATE INDEX IF NOT EXISTS idx_agent_identity_source_local
+        ON agent_identity_source_mappings(local_agent_id);
+      DROP INDEX IF EXISTS idx_agents_identity_unique;
+
+      CREATE TABLE IF NOT EXISTS agent_identity_aliases (
+        id TEXT PRIMARY KEY,
+        local_agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE RESTRICT,
+        label TEXT NOT NULL,
+        normalized_label TEXT NOT NULL,
+        alias_kind TEXT NOT NULL CHECK(alias_kind IN ('historical', 'candidate')),
+        status TEXT NOT NULL CHECK(status IN ('active', 'quarantined', 'revoked')),
+        created_at TEXT NOT NULL,
+        UNIQUE(local_agent_id, normalized_label)
+      );
+      CREATE INDEX IF NOT EXISTS idx_agent_identity_alias_lookup
+        ON agent_identity_aliases(normalized_label, status);
+
+      CREATE TRIGGER IF NOT EXISTS trg_agents_identity_id_immutable
+      BEFORE UPDATE OF identity_id ON agents
+      WHEN OLD.identity_id IS NOT NULL AND OLD.identity_id IS NOT NEW.identity_id
+      BEGIN
+        SELECT RAISE(ABORT, 'IDENTITY_ID_IMMUTABLE');
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS trg_agent_identity_mapping_identity_immutable
+      BEFORE UPDATE OF identity_id ON agent_identity_source_mappings
+      WHEN OLD.identity_id IS NOT NEW.identity_id
+      BEGIN
+        SELECT RAISE(ABORT, 'IDENTITY_ID_IMMUTABLE');
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS trg_agent_identity_mapping_lineage_immutable
+      BEFORE UPDATE OF source_authority, source_tenant_id, source_namespace, source_entity_type, source_record_id
+        ON agent_identity_source_mappings
+      WHEN OLD.source_authority IS NOT NEW.source_authority
+        OR OLD.source_tenant_id IS NOT NEW.source_tenant_id
+        OR OLD.source_namespace IS NOT NEW.source_namespace
+        OR OLD.source_entity_type IS NOT NEW.source_entity_type
+        OR OLD.source_record_id IS NOT NEW.source_record_id
+      BEGIN
+        SELECT RAISE(ABORT, 'IDENTITY_SOURCE_LINEAGE_IMMUTABLE');
+      END;
+
+      DROP TRIGGER IF EXISTS trg_agent_identity_mapping_history_immutable;
+      CREATE TRIGGER trg_agent_identity_mapping_history_immutable
+      BEFORE UPDATE OF local_agent_id, observed_label, evidence, mapping_basis, status, revision, created_at
+        ON agent_identity_source_mappings
+      BEGIN
+        SELECT RAISE(ABORT, 'IDENTITY_MAPPING_HISTORY_IMMUTABLE');
+      END;
+
+      DROP TRIGGER IF EXISTS trg_agent_identity_mapping_history_append_only;
+      CREATE TRIGGER trg_agent_identity_mapping_history_append_only
+      BEFORE DELETE ON agent_identity_source_mappings
+      BEGIN
+        SELECT RAISE(ABORT, 'IDENTITY_MAPPING_HISTORY_IMMUTABLE');
+      END;
+    `);
+    db.run("INSERT OR IGNORE INTO _migrations (id) VALUES (?)", [IDENTITY_MIGRATION_ID]);
+  });
+  install.immediate();
+}
+function storeAgentAliasInCurrentTransaction(agentId, label, aliasKind, status, db) {
+  const normalized = normalizedAlias(label);
+  const exists = db.query("SELECT id FROM agents WHERE id = ?").get(agentId);
+  if (!exists)
+    throw new Error(`Agent not found: ${agentId}`);
+  const existing = db.query(`
+    SELECT * FROM agent_identity_aliases
+    WHERE local_agent_id = ? AND normalized_label = ?
+  `).get(agentId, normalized);
+  if (existing) {
+    if (aliasKind === "historical" && (existing.alias_kind !== "historical" || existing.status !== "active")) {
+      db.run("UPDATE agent_identity_aliases SET label = ?, alias_kind = 'historical', status = 'active' WHERE id = ?", [label.trim(), existing.id]);
+      return db.query("SELECT * FROM agent_identity_aliases WHERE id = ?").get(existing.id);
+    }
+    return existing;
+  }
+  const id = mappingId();
+  db.run(`
+    INSERT INTO agent_identity_aliases (
+      id, local_agent_id, label, normalized_label, alias_kind, status, created_at
+    ) VALUES (?, ?, ?, ?, ?, ?, ?)
+  `, [id, agentId, label.trim(), normalized, aliasKind, status, timestamp()]);
+  return db.query("SELECT * FROM agent_identity_aliases WHERE id = ?").get(id);
+}
+function storeAgentAlias(agentId, label, aliasKind, status, db) {
+  if (db.inTransaction) {
+    return storeAgentAliasInCurrentTransaction(agentId, label, aliasKind, status, db);
+  }
+  const store = db.transaction(() => storeAgentAliasInCurrentTransaction(agentId, label, aliasKind, status, db));
+  return store.immediate();
+}
+function recordAgentAlias(agentId, label, db) {
+  return storeAgentAlias(agentId, label, "historical", "active", db);
+}
+var IDENTITY_PROJECTION_CONTRACT, IDENTITY_MIGRATION_ID = 65;
+var init_identity_mapping = __esm(() => {
+  init_types();
+  init_types();
+  IDENTITY_PROJECTION_CONTRACT = Object.freeze({
+    name: "hasna.todos.agent-identity-projection/v1",
+    version: 1,
+    foundation_repository: "hasna/identities",
+    foundation_pull_request: 14,
+    foundation_contract: "hasna.identities.agent-identity/v1",
+    foundation_version: 1,
+    foundation_commit: "14d83e3e45df5748944a871a07c4aacece893169",
+    foundation_fixture_id: "hasna.identities.agent-identity/v1/conformance/1",
+    foundation_fixture_source_path: "docs/fixtures/agent-identity-v1.conformance.json",
+    foundation_fixture_local_path: "src/db/fixtures/agent-identity-v1.conformance.json",
+    foundation_fixture_sha256: "sha256:2d22e72b7315d0b06b3c67c71674cfd8c2dff552727eea00efb325f52c9420af",
+    foundation_default_read_preference: "canonical_first",
+    consumer_rollout_default_read_preference: "legacy_first",
+    lease_fence_authority: "external Runtime Coordination"
+  });
+});
+
 // src/storage/shadow-outbox-schema.ts
 var exports_shadow_outbox_schema = {};
 __export(exports_shadow_outbox_schema, {
@@ -3096,7 +3977,7 @@ function installShadowOutboxSchema(db) {
     status TEXT NOT NULL DEFAULT 'pending',
     revision INTEGER NOT NULL DEFAULT 0
   )`);
-  ensureColumn(db, "shadow_outbox", "revision", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn2(db, "shadow_outbox", "revision", "INTEGER NOT NULL DEFAULT 0");
   db.run(`CREATE UNIQUE INDEX IF NOT EXISTS shadow_outbox_pending_uq
        ON shadow_outbox(object_type, object_id) WHERE status='pending'`);
   db.run(`CREATE INDEX IF NOT EXISTS shadow_outbox_ready_idx
@@ -3118,7 +3999,7 @@ function installShadowOutboxSchema(db) {
     }
   }
 }
-function ensureColumn(db, table, column, definition) {
+function ensureColumn2(db, table, column, definition) {
   const rows = db.query(`PRAGMA table_info(${table})`).all();
   if (rows.some((row) => row.name === column))
     return;
@@ -3246,6 +4127,7 @@ function openDatabase(path) {
   db.run("PRAGMA busy_timeout = 5000");
   db.run("PRAGMA foreign_keys = ON");
   runMigrations(db);
+  ensureAgentIdentitySchema(db);
   backfillTaskTags(db);
   backfillMachineId(db);
   maybeInstallShadowCapture(db);
@@ -3354,9 +4236,19 @@ function resolvePartialId(db, table, partialId) {
       return nameRow.id;
   }
   if (table === "agents") {
-    const nameRow = db.query("SELECT id FROM agents WHERE lower(name) = ?").get(partialId.toLowerCase());
-    if (nameRow)
-      return nameRow.id;
+    const normalized = partialId.trim().toLowerCase();
+    const matches = db.query(`
+      SELECT id FROM agents WHERE lower(name) = ?
+      UNION
+      SELECT local_agent_id AS id FROM agent_identity_aliases
+        WHERE normalized_label = ? AND status = 'active'
+      ORDER BY id
+    `).all(normalized, normalized);
+    if (matches.length === 1)
+      return matches[0].id;
+    if (matches.length > 1) {
+      throw new IdentityAliasAmbiguousError(partialId, matches.map((match) => match.id));
+    }
   }
   return null;
 }
@@ -3364,6 +4256,8 @@ var LOCK_EXPIRY_MINUTES = 30, _db = null, _dbPath = null, ALLOWED_TABLES;
 var init_database = __esm(() => {
   init_schema();
   init_machines();
+  init_identity_mapping();
+  init_types();
   ALLOWED_TABLES = new Set(["tasks", "projects", "agents", "plans", "task_lists", "task_templates", "project_knowledge_records", "project_risks", "local_retrospectives"]);
 });
 
@@ -3706,7 +4600,7 @@ function createProject(input, db) {
   const d = db || getDatabase();
   return d.transaction(() => {
     const id = uuid();
-    const timestamp = now();
+    const timestamp2 = now();
     const derivedSlug = slugify(input.name);
     const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : slugify(input.task_list_id);
     if (!derivedSlug || !taskListId)
@@ -3718,7 +4612,7 @@ function createProject(input, db) {
     const taskPrefix = input.task_prefix || generatePrefix(input.name, d);
     const machineId = currentStorageMachineId(d);
     d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, created_at, updated_at, machine_id)
-       VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, timestamp, timestamp, machineId]);
+       VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, timestamp2, timestamp2, machineId]);
     return getProject(id, d);
   })();
 }
@@ -3831,7 +4725,7 @@ function rowToSource(row) {
 function addProjectSource(input, db) {
   const d = db || getDatabase();
   const id = uuid();
-  const timestamp = now();
+  const timestamp2 = now();
   d.run(`INSERT INTO project_sources (id, project_id, type, name, uri, description, metadata, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
@@ -3841,8 +4735,8 @@ function addProjectSource(input, db) {
     input.uri,
     input.description || null,
     JSON.stringify(input.metadata || {}),
-    timestamp,
-    timestamp
+    timestamp2,
+    timestamp2
   ]);
   return rowToSource(d.query("SELECT * FROM project_sources WHERE id = ?").get(id));
 }
@@ -4060,6 +4954,11 @@ function customPatterns() {
 function secretPatterns() {
   return [...customPatterns(), ...DEFAULT_SECRET_PATTERNS];
 }
+function isRedactionPlaceholderMatch(match) {
+  const placeholder = String.raw`\[REDACTED(?:_[A-Z_]+)?\]`;
+  const trimmed = match.trim();
+  return new RegExp(`^${placeholder}$`).test(trimmed) || new RegExp(`=\\s*['"]?${placeholder}['"]?$`).test(trimmed);
+}
 function isSecretKey(key) {
   if (NON_SECRET_USAGE_KEYS.has(key.toLowerCase()))
     return false;
@@ -4097,7 +4996,7 @@ function redactValue(value) {
 function listSecretFindings(value) {
   const findings = [];
   for (const pattern of secretPatterns()) {
-    const matches = value.match(cloneRegex(pattern.regex));
+    const matches = value.match(cloneRegex(pattern.regex))?.filter((match) => !isRedactionPlaceholderMatch(match));
     if (matches?.length)
       findings.push({ pattern: pattern.name, count: matches.length });
   }
@@ -4128,6 +5027,9 @@ var init_redaction = __esm(() => {
     { name: "aws-access-key", regex: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/g, replacement: "[REDACTED_AWS_KEY]" },
     { name: "private-key", regex: /-----BEGIN (?:RSA |EC |OPENSSH |)PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |)PRIVATE KEY-----/g, replacement: "[REDACTED_PRIVATE_KEY]" },
     { name: "openai-token", regex: /\bsk-[A-Za-z0-9_-]{12,}\b/g, replacement: "[REDACTED_TOKEN]" },
+    { name: "npm-token", regex: /\bnpm_[A-Za-z0-9]{20,}\b/g, replacement: "[REDACTED_NPM_TOKEN]" },
+    { name: "github-fine-grained-token", regex: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, replacement: "[REDACTED_GITHUB_TOKEN]" },
+    { name: "github-token", regex: /\bgh[opsu]_[A-Za-z0-9]{20,}\b/g, replacement: "[REDACTED_GITHUB_TOKEN]" },
     { name: "env-secret-assignment", regex: /\b([A-Za-z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD)[A-Za-z0-9_]*)\s*=\s*['"]?[^'"\s]{8,}/gi, replacement: "$1=[REDACTED]" },
     { name: "bearer-token", regex: /\b(bearer)\s+[A-Za-z0-9._~+/=-]{12,}/gi, replacement: "$1 [REDACTED]" }
   ];
@@ -4202,7 +5104,7 @@ function upsertWorkspaceTrustProfile(input) {
   const preset = input.preset || existing?.preset || "standard";
   const presetChanged = Boolean(existing && input.preset && input.preset !== existing.preset);
   const base = presetChanged ? defaultProfile(root, preset) : existing || defaultProfile(root, preset);
-  const timestamp = new Date().toISOString();
+  const timestamp2 = new Date().toISOString();
   const profile = {
     ...base,
     ...PRESET_DEFAULTS[preset],
@@ -4215,8 +5117,8 @@ function upsertWorkspaceTrustProfile(input) {
     write_scopes: unique2(input.write_scopes ?? base.write_scopes ?? PRESET_DEFAULTS[preset].write_scopes),
     env_redactions: unique2(input.env_redactions ?? base.env_redactions ?? PRESET_DEFAULTS[preset].env_redactions),
     require_prompt_for_unsafe: input.require_prompt_for_unsafe ?? base.require_prompt_for_unsafe ?? PRESET_DEFAULTS[preset].require_prompt_for_unsafe,
-    created_at: existing?.created_at || timestamp,
-    updated_at: timestamp
+    created_at: existing?.created_at || timestamp2,
+    updated_at: timestamp2
   };
   saveConfig({
     ...config,
@@ -4417,7 +5319,7 @@ function upsertRunnerSandboxProfile(input) {
   const existing = config.runner_sandboxes?.[input.name];
   const root = normalizePath2(input.root || existing?.root || process.cwd());
   const base = existing || defaultProfile2(input.name, root);
-  const timestamp = new Date().toISOString();
+  const timestamp2 = new Date().toISOString();
   const profile = {
     ...base,
     name: input.name,
@@ -4431,8 +5333,8 @@ function upsertRunnerSandboxProfile(input) {
     network_policy: input.network_policy || base.network_policy,
     require_approval: input.require_approval ?? base.require_approval,
     audit_evidence: input.audit_evidence ?? base.audit_evidence,
-    created_at: existing?.created_at || timestamp,
-    updated_at: timestamp
+    created_at: existing?.created_at || timestamp2,
+    updated_at: timestamp2
   };
   saveConfig({
     ...config,
@@ -4549,7 +5451,7 @@ function normalizeHook(input, existing) {
     throw new Error("socket event hooks require socket_path");
   if (input.target === "script" && !input.command && !existing?.command)
     throw new Error("script event hooks require command");
-  const timestamp = new Date().toISOString();
+  const timestamp2 = new Date().toISOString();
   return {
     ...existing,
     name: safeName(input.name),
@@ -4566,8 +5468,8 @@ function normalizeHook(input, existing) {
       attempts: clampAttempts(input.retry?.attempts ?? existing?.retry?.attempts ?? 1),
       backoff_ms: Math.max(0, input.retry?.backoff_ms ?? existing?.retry?.backoff_ms ?? 0)
     },
-    created_at: existing?.created_at || timestamp,
-    updated_at: timestamp
+    created_at: existing?.created_at || timestamp2,
+    updated_at: timestamp2
   };
 }
 function clampAttempts(value) {
@@ -4581,11 +5483,11 @@ function eventMatches(hook, eventType) {
 function canonicalEvent(input) {
   return JSON.stringify(input);
 }
-function buildEnvelope(type, payload, timestamp = new Date().toISOString()) {
+function buildEnvelope(type, payload, timestamp2 = new Date().toISOString()) {
   const base = {
     id: randomUUID(),
     type,
-    timestamp,
+    timestamp: timestamp2,
     payload: redactValue(payload ?? {}),
     source: { package: "@hasna/todos", local_only: true }
   };
@@ -4999,11 +5901,11 @@ class JsonEventsStore {
     });
   }
 }
-function buildSignatureBase(timestamp, body) {
-  return `${timestamp}.${body}`;
+function buildSignatureBase(timestamp2, body) {
+  return `${timestamp2}.${body}`;
 }
-function signPayload(secret, timestamp, body) {
-  const digest = createHmac("sha256", secret).update(buildSignatureBase(timestamp, body)).digest("hex");
+function signPayload(secret, timestamp2, body) {
+  const digest = createHmac("sha256", secret).update(buildSignatureBase(timestamp2, body)).digest("hex");
   return `sha256=${digest}`;
 }
 function now2() {
@@ -5016,17 +5918,17 @@ function buildWebhookRequest(event, channel) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
   const body = JSON.stringify(event);
-  const timestamp = event.time;
+  const timestamp2 = event.time;
   const headers = {
     "Content-Type": "application/json",
     "User-Agent": "@hasna/events",
     "X-Hasna-Event-Id": event.id,
     "X-Hasna-Event-Type": event.type,
-    "X-Hasna-Timestamp": timestamp,
+    "X-Hasna-Timestamp": timestamp2,
     ...channel.webhook.headers
   };
   if (channel.webhook.secret) {
-    headers["X-Hasna-Signature"] = signPayload(channel.webhook.secret, timestamp, body);
+    headers["X-Hasna-Signature"] = signPayload(channel.webhook.secret, timestamp2, body);
   }
   return { body, headers };
 }
@@ -5180,11 +6082,11 @@ class EventsClient {
     this.transportOptions = { fetchImpl: options.fetchImpl };
   }
   async addChannel(input) {
-    const timestamp = new Date().toISOString();
+    const timestamp2 = new Date().toISOString();
     return this.store.addChannel({
       ...input,
-      createdAt: input.createdAt ?? timestamp,
-      updatedAt: input.updatedAt ?? timestamp
+      createdAt: input.createdAt ?? timestamp2,
+      updatedAt: input.updatedAt ?? timestamp2
     });
   }
   async listChannels() {
@@ -5256,12 +6158,12 @@ class EventsClient {
     const match = await this.matchChannel(id, input);
     const event = match.event;
     if (options.honorFilters && !match.matched) {
-      const timestamp = new Date().toISOString();
+      const timestamp2 = new Date().toISOString();
       const result2 = createDeliveryResult(event, channel, [{
         attempt: 1,
         status: "skipped",
-        startedAt: timestamp,
-        completedAt: timestamp,
+        startedAt: timestamp2,
+        completedAt: timestamp2,
         error: match.reason
       }]);
       result2.metadata = { reason: "filter_mismatch" };
@@ -5382,7 +6284,7 @@ function createTaskList(input, db) {
   const d = db || getDatabase();
   return d.transaction(() => {
     const id = uuid();
-    const timestamp = now();
+    const timestamp2 = now();
     const slug = normalizeSlug(input.slug === undefined ? input.name : input.slug);
     if (!slug)
       throw new Error("Invalid task-list slug \u2014 must be non-empty kebab-case");
@@ -5393,7 +6295,7 @@ function createTaskList(input, db) {
       throw new ResourceConflictError("TASK_LIST_SLUG_CONFLICT", `Task list with slug "${slug}" already exists in this scope`);
     }
     d.run(`INSERT INTO task_lists (id, project_id, slug, name, description, metadata, created_at, updated_at, machine_id)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [id, input.project_id || null, slug, input.name, input.description || null, JSON.stringify(input.metadata || {}), timestamp, timestamp, machineId]);
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [id, input.project_id || null, slug, input.name, input.description || null, JSON.stringify(input.metadata || {}), timestamp2, timestamp2, machineId]);
     return getTaskList(id, d);
   })();
 }
@@ -5866,6 +6768,110 @@ var init_secret_redaction = __esm(() => {
   customRedactors = [];
 });
 
+// src/lib/prewrite-secrets.ts
+function mergeFindings(findings) {
+  const byPattern = new Map;
+  for (const finding of findings) {
+    const existing = byPattern.get(finding.pattern);
+    if (!existing) {
+      byPattern.set(finding.pattern, {
+        pattern: finding.pattern,
+        count: finding.count,
+        lines: Array.from(new Set(finding.lines)).sort((a, b) => a - b)
+      });
+      continue;
+    }
+    existing.count += finding.count;
+    existing.lines = Array.from(new Set([...existing.lines, ...finding.lines])).sort((a, b) => a - b);
+  }
+  return [...byPattern.values()].sort((left, right) => left.pattern.localeCompare(right.pattern));
+}
+function redactPreWriteText(value) {
+  return redactText(redactEvidenceText(value));
+}
+function scanPreWriteText(value, context = "text") {
+  const redacted = redactPreWriteText(value);
+  if (redacted === value) {
+    return {
+      schema_version: PREWRITE_SECRET_SCAN_SCHEMA,
+      clean: true,
+      context,
+      findings: []
+    };
+  }
+  const structural = scanTextForSecrets(value).matches.map((match) => ({
+    pattern: match.pattern,
+    count: 1,
+    lines: match.line ? [match.line] : []
+  }));
+  const configured = listSecretFindings(value).map((finding) => ({
+    pattern: finding.pattern,
+    count: finding.count,
+    lines: []
+  }));
+  return {
+    schema_version: PREWRITE_SECRET_SCAN_SCHEMA,
+    clean: false,
+    context,
+    findings: mergeFindings([...structural, ...configured])
+  };
+}
+function assertPreWriteTextClean(value, context = "text") {
+  const scan = scanPreWriteText(value, context);
+  if (!scan.clean)
+    throw new PreWriteSecretError(context, scan.findings);
+}
+function sanitizePreWriteText(value, context = "text", options = {}) {
+  const mode = options.mode ?? "redact";
+  if (mode === "block") {
+    assertPreWriteTextClean(value, context);
+    return value;
+  }
+  return redactPreWriteText(value);
+}
+function sanitizePreWriteValue(value, context = "value", options = {}) {
+  if (typeof value === "string")
+    return sanitizePreWriteText(value, context, options);
+  if (Array.isArray(value)) {
+    return value.map((item, index) => sanitizePreWriteValue(item, `${context}[${index}]`, options));
+  }
+  if (value && typeof value === "object") {
+    const sanitized = {};
+    for (const [key, child] of Object.entries(value)) {
+      const safeKey = sanitizePreWriteText(key, `${context}.$key`, options);
+      sanitized[safeKey] = sanitizePreWriteValue(child, `${context}.${safeKey}`, options);
+    }
+    return redactValue(sanitized);
+  }
+  return value;
+}
+function sanitizePreWriteJsonString(value, context = "json") {
+  if (value === undefined || value === null)
+    return null;
+  try {
+    return JSON.stringify(sanitizePreWriteValue(JSON.parse(value), context));
+  } catch {
+    return sanitizePreWriteText(value, context);
+  }
+}
+var PREWRITE_SECRET_SCAN_SCHEMA, PreWriteSecretError;
+var init_prewrite_secrets = __esm(() => {
+  init_redaction();
+  init_secret_redaction();
+  PREWRITE_SECRET_SCAN_SCHEMA = ["todos", "prewrite_secret_scan", "v1"].join(".");
+  PreWriteSecretError = class PreWriteSecretError extends Error {
+    context;
+    findings;
+    constructor(context, findings) {
+      const summary = findings.map((finding) => `${finding.pattern}:${finding.count}`).join(", ");
+      super(`Secret pattern detected before persistence in ${context}: ${summary}`);
+      this.name = "PreWriteSecretError";
+      this.context = context;
+      this.findings = findings;
+    }
+  };
+});
+
 // src/lib/activity-audit.ts
 var exports_activity_audit = {};
 __export(exports_activity_audit, {
@@ -5914,6 +6920,9 @@ function logActivity(input, db) {
   const id = uuid();
   const ts = input.created_at ?? now();
   const machineId = input.machine_id ?? getMachineId2();
+  const oldValue = input.old_value == null ? null : sanitizePreWriteText(input.old_value, "activity.old_value");
+  const newValue = input.new_value == null ? null : sanitizePreWriteText(input.new_value, "activity.new_value");
+  const metadata = sanitizePreWriteValue(input.metadata ?? {}, "activity.metadata");
   d.run(`INSERT INTO activity_log (
       id, entity_type, entity_id, action, field, old_value, new_value,
       actor_id, session_id, machine_id, metadata, created_at
@@ -5923,12 +6932,12 @@ function logActivity(input, db) {
     input.entity_id,
     input.action,
     input.field ?? null,
-    input.old_value ?? null,
-    input.new_value ?? null,
+    oldValue,
+    newValue,
     input.actor_id ?? null,
     input.session_id ?? null,
     machineId,
-    JSON.stringify(input.metadata ?? {}),
+    JSON.stringify(metadata),
     ts
   ]);
   return getActivityRecord(id, d);
@@ -6039,6 +7048,7 @@ var ACTIVITY_LOG_SCHEMA = "todos.activity_log.v1", ACTIVITY_ENTITY_TYPES;
 var init_activity_audit = __esm(() => {
   init_database();
   init_secret_redaction();
+  init_prewrite_secrets();
   ACTIVITY_ENTITY_TYPES = [
     "task",
     "project",
@@ -6051,13 +7061,18 @@ var init_activity_audit = __esm(() => {
 });
 
 // src/db/audit.ts
+function sanitizeHistoryValue(value, context) {
+  return value === undefined || value === null ? null : sanitizePreWriteText(String(value), context);
+}
 function logTaskChange(taskId, action, field, oldValue, newValue, agentId, db) {
   const d = db || getDatabase();
   const id = uuid();
-  const timestamp = now();
+  const timestamp2 = now();
   const machineId = currentStorageMachineId(d);
+  const safeOldValue = sanitizeHistoryValue(oldValue, "task_history.old_value");
+  const safeNewValue = sanitizeHistoryValue(newValue, "task_history.new_value");
   d.run(`INSERT INTO task_history (id, task_id, action, field, old_value, new_value, agent_id, created_at, machine_id)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [id, taskId, action, field || null, oldValue ?? null, newValue ?? null, agentId || null, timestamp, machineId]);
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [id, taskId, action, field || null, safeOldValue, safeNewValue, agentId || null, timestamp2, machineId]);
   try {
     const { logActivity: logActivity2 } = (init_activity_audit(), __toCommonJS(exports_activity_audit));
     logActivity2({
@@ -6065,12 +7080,12 @@ function logTaskChange(taskId, action, field, oldValue, newValue, agentId, db) {
       entity_id: taskId,
       action,
       field,
-      old_value: oldValue ?? null,
-      new_value: newValue ?? null,
+      old_value: safeOldValue,
+      new_value: safeNewValue,
       actor_id: agentId ?? undefined
     }, d);
   } catch {}
-  return { id, task_id: taskId, action, field: field || null, old_value: oldValue ?? null, new_value: newValue ?? null, agent_id: agentId || null, created_at: timestamp, machine_id: machineId };
+  return { id, task_id: taskId, action, field: field || null, old_value: safeOldValue, new_value: safeNewValue, agent_id: agentId || null, created_at: timestamp2, machine_id: machineId };
 }
 function getTaskHistory(taskId, db) {
   const d = db || getDatabase();
@@ -6109,6 +7124,7 @@ function getRecap(hours = 8, projectId, db) {
 var init_audit = __esm(() => {
   init_database();
   init_storage_tombstones();
+  init_prewrite_secrets();
 });
 
 // src/db/webhooks.ts
@@ -6341,27 +7357,27 @@ function getChecklist(taskId, db) {
 function addChecklistItem(input, db) {
   const d = db || getDatabase();
   const id = uuid();
-  const timestamp = now();
+  const timestamp2 = now();
   let position = input.position;
   if (position === undefined) {
     const maxRow = d.query("SELECT MAX(position) as max_pos FROM task_checklists WHERE task_id = ?").get(input.task_id);
     position = (maxRow?.max_pos ?? -1) + 1;
   }
-  d.run("INSERT INTO task_checklists (id, task_id, position, text, checked, created_at, updated_at) VALUES (?, ?, ?, ?, 0, ?, ?)", [id, input.task_id, position, input.text, timestamp, timestamp]);
+  d.run("INSERT INTO task_checklists (id, task_id, position, text, checked, created_at, updated_at) VALUES (?, ?, ?, ?, 0, ?, ?)", [id, input.task_id, position, input.text, timestamp2, timestamp2]);
   return rowToItem(d.query("SELECT * FROM task_checklists WHERE id = ?").get(id));
 }
 function checkChecklistItem(id, checked, db) {
   const d = db || getDatabase();
-  const timestamp = now();
-  const result = d.run("UPDATE task_checklists SET checked = ?, updated_at = ? WHERE id = ?", [checked ? 1 : 0, timestamp, id]);
+  const timestamp2 = now();
+  const result = d.run("UPDATE task_checklists SET checked = ?, updated_at = ? WHERE id = ?", [checked ? 1 : 0, timestamp2, id]);
   if (result.changes === 0)
     return null;
   return rowToItem(d.query("SELECT * FROM task_checklists WHERE id = ?").get(id));
 }
 function updateChecklistItemText(id, text, db) {
   const d = db || getDatabase();
-  const timestamp = now();
-  const result = d.run("UPDATE task_checklists SET text = ?, updated_at = ? WHERE id = ?", [text, timestamp, id]);
+  const timestamp2 = now();
+  const result = d.run("UPDATE task_checklists SET text = ?, updated_at = ? WHERE id = ?", [text, timestamp2, id]);
   if (result.changes === 0)
     return null;
   return rowToItem(d.query("SELECT * FROM task_checklists WHERE id = ?").get(id));
@@ -6483,6 +7499,50 @@ var init_recurrence = __esm(() => {
   };
 });
 
+// src/lib/template-semantics.ts
+function resolveTemplateVariables(templateVars, provided) {
+  const merged = { ...provided };
+  for (const variable of templateVars) {
+    if (merged[variable.name] === undefined && variable.default !== undefined) {
+      merged[variable.name] = variable.default;
+    }
+  }
+  const missing = templateVars.filter((variable) => variable.required && merged[variable.name] === undefined).map((variable) => variable.name);
+  if (missing.length > 0) {
+    throw new Error(`Missing required template variable(s): ${missing.join(", ")}`);
+  }
+  return merged;
+}
+function substituteTemplateVariables(text, variables) {
+  let result = text;
+  for (const [key, value] of Object.entries(variables)) {
+    result = result.replace(new RegExp(`\\{${key}\\}`, "g"), value);
+  }
+  return result;
+}
+function evaluateTemplateCondition(condition, variables) {
+  if (!condition || condition.trim() === "")
+    return true;
+  const trimmed = condition.trim();
+  const equal = trimmed.match(/^\{([^}]+)\}\s*==\s*(.+)$/);
+  if (equal)
+    return (variables[equal[1]] ?? "") === equal[2].trim();
+  const unequal = trimmed.match(/^\{([^}]+)\}\s*!=\s*(.+)$/);
+  if (unequal)
+    return (variables[unequal[1]] ?? "") !== unequal[2].trim();
+  const falsy = trimmed.match(/^!\{([^}]+)\}$/);
+  if (falsy) {
+    const value = variables[falsy[1]];
+    return !value || value === "" || value === "false";
+  }
+  const truthy = trimmed.match(/^\{([^}]+)\}$/);
+  if (truthy) {
+    const value = variables[truthy[1]];
+    return !!value && value !== "" && value !== "false";
+  }
+  return true;
+}
+
 // src/db/templates.ts
 function rowToTemplate(row) {
   return {
@@ -6558,6 +7618,14 @@ function deleteTemplate(id, db) {
     payload: template,
     version: template.version
   }, d);
+  for (const task of getTemplateTasks(resolved, d)) {
+    recordStorageTombstone({
+      object_type: "template_tasks",
+      object_id: task.id,
+      payload: task,
+      version: 1
+    }, d);
+  }
   return d.run("DELETE FROM task_templates WHERE id = ?", [resolved]).changes > 0;
 }
 function updateTemplate(id, updates, db) {
@@ -6689,34 +7757,7 @@ function getTemplateTasks(templateId, db) {
   return rows.map(rowToTemplateTask);
 }
 function evaluateCondition(condition, variables) {
-  if (!condition || condition.trim() === "")
-    return true;
-  const trimmed = condition.trim();
-  const eqMatch = trimmed.match(/^\{([^}]+)\}\s*==\s*(.+)$/);
-  if (eqMatch) {
-    const varName = eqMatch[1];
-    const expected = eqMatch[2].trim();
-    return (variables[varName] ?? "") === expected;
-  }
-  const neqMatch = trimmed.match(/^\{([^}]+)\}\s*!=\s*(.+)$/);
-  if (neqMatch) {
-    const varName = neqMatch[1];
-    const expected = neqMatch[2].trim();
-    return (variables[varName] ?? "") !== expected;
-  }
-  const falsyMatch = trimmed.match(/^!\{([^}]+)\}$/);
-  if (falsyMatch) {
-    const varName = falsyMatch[1];
-    const val = variables[varName];
-    return !val || val === "" || val === "false";
-  }
-  const truthyMatch = trimmed.match(/^\{([^}]+)\}$/);
-  if (truthyMatch) {
-    const varName = truthyMatch[1];
-    const val = variables[varName];
-    return !!val && val !== "" && val !== "false";
-  }
-  return true;
+  return evaluateTemplateCondition(condition, variables);
 }
 function exportTemplate(id, db) {
   const d = db || getDatabase();
@@ -6789,29 +7830,10 @@ function listTemplateVersions(id, db) {
   return d.query("SELECT * FROM template_versions WHERE template_id = ? ORDER BY version DESC").all(resolved);
 }
 function resolveVariables(templateVars, provided) {
-  const merged = { ...provided };
-  for (const v of templateVars) {
-    if (merged[v.name] === undefined && v.default !== undefined) {
-      merged[v.name] = v.default;
-    }
-  }
-  const missing = [];
-  for (const v of templateVars) {
-    if (v.required && merged[v.name] === undefined) {
-      missing.push(v.name);
-    }
-  }
-  if (missing.length > 0) {
-    throw new Error(`Missing required template variable(s): ${missing.join(", ")}`);
-  }
-  return merged;
+  return resolveTemplateVariables(templateVars, provided);
 }
 function substituteVars(text, variables) {
-  let result = text;
-  for (const [key, val] of Object.entries(variables)) {
-    result = result.replace(new RegExp(`\\{${key}\\}`, "g"), val);
-  }
-  return result;
+  return substituteTemplateVariables(text, variables);
 }
 function tasksFromTemplate(templateId, projectId, variables, taskListId, db, _visitedTemplateIds) {
   const d = db || getDatabase();
@@ -7133,9 +8155,9 @@ function startTask(id, agentId, db) {
     throw new Error(`Task is blocked by ${blocking.length} unfinished dependency(ies): ${blockerIds}`);
   }
   const cutoff = lockExpiryCutoff();
-  const timestamp = now();
+  const timestamp2 = now();
   const result = d.run(`UPDATE tasks SET status = 'in_progress', assigned_to = ?, locked_by = ?, locked_at = ?, started_at = COALESCE(started_at, ?), version = version + 1, updated_at = ?
-     WHERE id = ? AND status IN ('pending', 'in_progress') AND (locked_by IS NULL OR locked_by = ? OR locked_at < ?)`, [agentId, agentId, timestamp, timestamp, timestamp, id, agentId, cutoff]);
+     WHERE id = ? AND status IN ('pending', 'in_progress') AND (locked_by IS NULL OR locked_by = ? OR locked_at < ?)`, [agentId, agentId, timestamp2, timestamp2, timestamp2, id, agentId, cutoff]);
   if (result.changes === 0) {
     const current = getTask(id, d);
     if (!current)
@@ -7147,7 +8169,7 @@ function startTask(id, agentId, db) {
     throw new Error(`Task ${id} could not be started because it changed during claim`);
   }
   logTaskChange(id, "start", "status", "pending", "in_progress", agentId, d);
-  const startedTask = { ...task, status: "in_progress", assigned_to: agentId, locked_by: agentId, locked_at: timestamp, started_at: task.started_at || timestamp, version: task.version + 1, updated_at: timestamp };
+  const startedTask = { ...task, status: "in_progress", assigned_to: agentId, locked_by: agentId, locked_at: timestamp2, started_at: task.started_at || timestamp2, version: task.version + 1, updated_at: timestamp2 };
   const payload = taskEventData(startedTask, { agent_id: agentId });
   dispatchWebhook2("task.started", payload, d).catch(() => {});
   emitLocalEventHooksQuiet({ type: "task.started", payload, databasePath });
@@ -7170,7 +8192,13 @@ function completeTask(id, agentId, db, options) {
     throw new LockError(id, task.locked_by);
   }
   checkCompletionGuard(task, agentId || null, d);
-  const evidence = options ? { files_changed: options.files_changed, test_results: options.test_results, commit_hash: options.commit_hash, notes: options.notes, attachment_ids: options.attachment_ids } : undefined;
+  const evidence = options ? sanitizePreWriteValue({
+    files_changed: options.files_changed,
+    test_results: options.test_results,
+    commit_hash: options.commit_hash,
+    notes: options.notes,
+    attachment_ids: options.attachment_ids
+  }, "task.completion_evidence") : undefined;
   const hasEvidence = evidence && (evidence.files_changed || evidence.test_results || evidence.commit_hash || evidence.notes || evidence.attachment_ids);
   const completionMeta = {};
   if (hasEvidence)
@@ -7179,21 +8207,21 @@ function completeTask(id, agentId, db, options) {
     completionMeta._completion = { confidence: options.confidence };
   }
   const hasMeta = Object.keys(completionMeta).length > 0;
-  const timestamp = options?.completed_at || now();
+  const timestamp2 = options?.completed_at || now();
   const confidence = options?.confidence !== undefined ? options.confidence : task.confidence;
   const versionBeforeStatus = task.version + (hasMeta ? 1 : 0);
   const finalVersion = versionBeforeStatus + 1;
   const tx = d.transaction(() => {
     if (hasMeta) {
-      const meta2 = { ...task.metadata, ...completionMeta };
-      const metaResult = d.run("UPDATE tasks SET metadata = ?, version = version + 1, updated_at = ? WHERE id = ? AND version = ?", [JSON.stringify(meta2), timestamp, id, task.version]);
+      const meta2 = sanitizePreWriteValue({ ...task.metadata, ...completionMeta }, "task.metadata");
+      const metaResult = d.run("UPDATE tasks SET metadata = ?, version = version + 1, updated_at = ? WHERE id = ? AND version = ?", [JSON.stringify(meta2), timestamp2, id, task.version]);
       if (metaResult.changes === 0) {
         const current = getTask(id, d);
         throw new VersionConflictError(id, task.version, current?.version ?? -1);
       }
     }
     const statusResult = d.run(`UPDATE tasks SET status = 'completed', locked_by = NULL, locked_at = NULL, completed_at = ?, confidence = ?, version = version + 1, updated_at = ?
-       WHERE id = ? AND version = ?`, [timestamp, confidence, timestamp, id, versionBeforeStatus]);
+       WHERE id = ? AND version = ?`, [timestamp2, confidence, timestamp2, id, versionBeforeStatus]);
     if (statusResult.changes === 0) {
       const current = getTask(id, d);
       throw new VersionConflictError(id, versionBeforeStatus, current?.version ?? -1);
@@ -7206,20 +8234,20 @@ function completeTask(id, agentId, db, options) {
     status: "completed",
     locked_by: null,
     locked_at: null,
-    completed_at: timestamp,
+    completed_at: timestamp2,
     confidence,
     version: finalVersion,
-    updated_at: timestamp,
+    updated_at: timestamp2,
     metadata: hasMeta ? { ...task.metadata, ...completionMeta } : task.metadata
   };
-  const completionPayload = taskEventData(completedTaskForEvent, { agent_id: agentId, completed_at: timestamp });
+  const completionPayload = taskEventData(completedTaskForEvent, { agent_id: agentId, completed_at: timestamp2 });
   dispatchWebhook2("task.completed", completionPayload, d).catch(() => {});
   emitLocalEventHooksQuiet({ type: "task.completed", payload: completionPayload, databasePath });
-  emitSharedTaskEventQuiet({ type: "task.completed", task: completedTaskForEvent, data: { agent_id: agentId, completed_at: timestamp }, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.completed", task: completedTaskForEvent, data: { agent_id: agentId, completed_at: timestamp2 }, databasePath });
   let spawnedTask = null;
   if (task.recurrence_rule && !options?.skip_recurrence) {
     try {
-      spawnedTask = spawnNextRecurrence(task, d, timestamp);
+      spawnedTask = spawnNextRecurrence(task, d, timestamp2);
     } catch (e) {
       spawnedTask = null;
       console.warn(`[tasks] failed to spawn next recurrence for ${id}: ${e instanceof Error ? e.message : String(e)}`);
@@ -7269,7 +8297,7 @@ function completeTask(id, agentId, db, options) {
         emitSharedTaskEventQuiet({ type: "task.unblocked", task: depTask, data: { unblocked_by: id }, databasePath });
     }
   }
-  return { ...task, status: "completed", locked_by: null, locked_at: null, completed_at: timestamp, confidence, version: finalVersion, updated_at: timestamp, metadata: meta };
+  return { ...task, status: "completed", locked_by: null, locked_at: null, completed_at: timestamp2, confidence, version: finalVersion, updated_at: timestamp2, metadata: meta };
 }
 function lockTask(id, agentId, db) {
   const d = db || getDatabase();
@@ -7283,15 +8311,15 @@ function lockTask(id, agentId, db) {
     };
   }
   if (task.locked_by === agentId && !isLockExpired(task.locked_at)) {
-    const timestamp2 = now();
-    d.run(`UPDATE tasks SET locked_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND locked_by = ?`, [timestamp2, timestamp2, id, agentId]);
+    const timestamp3 = now();
+    d.run(`UPDATE tasks SET locked_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND locked_by = ?`, [timestamp3, timestamp3, id, agentId]);
     logTaskChange(id, "lock_renew", "locked_by", agentId, agentId, agentId, d);
-    return { success: true, locked_by: agentId, locked_at: timestamp2, expires_at: lockExpiresAt(timestamp2) };
+    return { success: true, locked_by: agentId, locked_at: timestamp3, expires_at: lockExpiresAt(timestamp3) };
   }
   const cutoff = lockExpiryCutoff();
-  const timestamp = now();
+  const timestamp2 = now();
   const result = d.run(`UPDATE tasks SET locked_by = ?, locked_at = ?, version = version + 1, updated_at = ?
-     WHERE id = ? AND status NOT IN ('completed', 'cancelled') AND (locked_by IS NULL OR locked_by = ? OR locked_at < ?)`, [agentId, timestamp, timestamp, id, agentId, cutoff]);
+     WHERE id = ? AND status NOT IN ('completed', 'cancelled') AND (locked_by IS NULL OR locked_by = ? OR locked_at < ?)`, [agentId, timestamp2, timestamp2, id, agentId, cutoff]);
   if (result.changes === 0) {
     const current = getTask(id, d);
     if (!current)
@@ -7316,7 +8344,7 @@ function lockTask(id, agentId, db) {
     };
   }
   logTaskChange(id, "lock", "locked_by", task.locked_by, agentId, agentId, d);
-  return { success: true, locked_by: agentId, locked_at: timestamp, expires_at: lockExpiresAt(timestamp) };
+  return { success: true, locked_by: agentId, locked_at: timestamp2, expires_at: lockExpiresAt(timestamp2) };
 }
 function unlockTask(id, agentId, db) {
   const d = db || getDatabase();
@@ -7326,9 +8354,9 @@ function unlockTask(id, agentId, db) {
   if (agentId && task.locked_by && task.locked_by !== agentId) {
     throw new LockError(id, task.locked_by);
   }
-  const timestamp = now();
+  const timestamp2 = now();
   d.run(`UPDATE tasks SET locked_by = NULL, locked_at = NULL, version = version + 1, updated_at = ?
-     WHERE id = ?`, [timestamp, id]);
+     WHERE id = ?`, [timestamp2, id]);
   return true;
 }
 function getTaskLockStatus(id, db) {
@@ -7410,7 +8438,7 @@ function getNextTask(agentId, filters, db) {
   }
   sql += `CASE priority WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 END, created_at ASC LIMIT 1`;
   const row = d.query(sql).get(...params);
-  return row ? rowToTask(row) : null;
+  return row ? rowToTask2(row) : null;
 }
 function getActiveWork(filters, db) {
   const d = db || getDatabase();
@@ -7445,7 +8473,7 @@ function getTasksChangedSince(since, filters, db) {
   }
   const where = conditions.join(" AND ");
   const rows = d.query(`SELECT * FROM tasks WHERE ${where} ORDER BY updated_at DESC`).all(...params);
-  return rows.map(rowToTask);
+  return rows.map(rowToTask2);
 }
 function failTask(id, agentId, reason, options, db) {
   const d = db || getDatabase();
@@ -7453,20 +8481,23 @@ function failTask(id, agentId, reason, options, db) {
   const task = getTask(id, d);
   if (!task)
     throw new TaskNotFoundError(id);
+  const safeReason = sanitizePreWriteText(reason || "Unknown failure", "task.failure.reason");
+  const safeErrorCode = options?.error_code ? sanitizePreWriteText(options.error_code, "task.failure.error_code") : null;
   const meta = {
     ...task.metadata,
     _failure: {
-      reason: reason || "Unknown failure",
-      error_code: options?.error_code || null,
+      reason: safeReason,
+      error_code: safeErrorCode,
       failed_by: agentId || null,
       failed_at: now(),
       retry_requested: options?.retry || false
     }
   };
-  const timestamp = now();
+  const safeMeta = sanitizePreWriteValue(meta, "task.failure.metadata");
+  const timestamp2 = now();
   const failTx = d.transaction(() => {
     const res = d.run(`UPDATE tasks SET status = 'failed', locked_by = NULL, locked_at = NULL, metadata = ?, version = version + 1, updated_at = ?
-       WHERE id = ? AND version = ?`, [JSON.stringify(meta), timestamp, id, task.version]);
+       WHERE id = ? AND version = ?`, [JSON.stringify(safeMeta), timestamp2, id, task.version]);
     if (res.changes === 0) {
       const current = getTask(id, d);
       throw new VersionConflictError(id, task.version, current?.version ?? -1);
@@ -7478,22 +8509,22 @@ function failTask(id, agentId, reason, options, db) {
     status: "failed",
     locked_by: null,
     locked_at: null,
-    metadata: meta,
+    metadata: safeMeta,
     version: task.version + 1,
-    updated_at: timestamp
+    updated_at: timestamp2
   };
   logTaskChange(id, "fail", "status", task.status, "failed", agentId || null, d);
-  const failurePayload = taskEventData(failedTask, { reason, error_code: options?.error_code, agent_id: agentId });
+  const failurePayload = taskEventData(failedTask, { reason: safeReason, error_code: safeErrorCode, agent_id: agentId });
   dispatchWebhook2("task.failed", failurePayload, d).catch(() => {});
   emitLocalEventHooksQuiet({ type: "task.failed", payload: failurePayload, databasePath });
-  emitSharedTaskEventQuiet({ type: "task.failed", task: failedTask, data: { reason, error_code: options?.error_code, agent_id: agentId }, severity: "warning", databasePath });
+  emitSharedTaskEventQuiet({ type: "task.failed", task: failedTask, data: { reason: safeReason, error_code: safeErrorCode, agent_id: agentId }, severity: "warning", databasePath });
   let retryTask;
   if (options?.retry) {
     const retryCount = (task.retry_count || 0) + 1;
     const maxRetries = task.max_retries || 3;
     if (retryCount > maxRetries) {
       d.run("UPDATE tasks SET metadata = ? WHERE id = ?", [
-        JSON.stringify({ ...meta, _retry_exhausted: { retry_count: retryCount - 1, max_retries: maxRetries } }),
+        JSON.stringify(sanitizePreWriteValue({ ...safeMeta, _retry_exhausted: { retry_count: retryCount - 1, max_retries: maxRetries } }, "task.retry_exhausted.metadata")),
         id
       ]);
     } else {
@@ -7512,7 +8543,7 @@ function failTask(id, agentId, reason, options, db) {
         plan_id: task.plan_id ?? undefined,
         assigned_to: task.assigned_to ?? undefined,
         tags: task.tags,
-        metadata: { ...task.metadata, _retry: { original_id: task.id, retry_count: retryCount, max_retries: maxRetries, retry_after: retryAfter, failure_reason: reason } },
+        metadata: { ...task.metadata, _retry: { original_id: task.id, retry_count: retryCount, max_retries: maxRetries, retry_after: retryAfter, failure_reason: safeReason } },
         estimated_minutes: task.estimated_minutes ?? undefined,
         recurrence_rule: task.recurrence_rule ?? undefined,
         due_at: retryAfter
@@ -7542,7 +8573,7 @@ function getStaleTasks(staleQuery = 30, filters, db) {
   }
   const where = conditions.join(" AND ");
   const rows = d.query(`SELECT * FROM tasks WHERE ${where} ORDER BY updated_at ASC`).all(...params);
-  return rows.map(rowToTask);
+  return rows.map(rowToTask2);
 }
 function stealTask(agentId, opts, db) {
   const d = db || getDatabase();
@@ -7554,15 +8585,15 @@ function stealTask(agentId, opts, db) {
   const priorityOrder = { critical: 0, high: 1, medium: 2, low: 3 };
   staleTasks.sort((a, b) => (priorityOrder[a.priority] ?? 9) - (priorityOrder[b.priority] ?? 9));
   const target = staleTasks[0];
-  const timestamp = now();
+  const timestamp2 = now();
   const cutoff = new Date(Date.now() - staleMinutes * 60 * 1000).toISOString();
   const result = d.run(`UPDATE tasks SET assigned_to = ?, locked_by = ?, locked_at = ?, updated_at = ?, version = version + 1
-     WHERE id = ? AND status = 'in_progress' AND (updated_at < ? OR (locked_at IS NOT NULL AND locked_at < ?))`, [agentId, agentId, timestamp, timestamp, target.id, cutoff, cutoff]);
+     WHERE id = ? AND status = 'in_progress' AND (updated_at < ? OR (locked_at IS NOT NULL AND locked_at < ?))`, [agentId, agentId, timestamp2, timestamp2, target.id, cutoff, cutoff]);
   if (result.changes === 0)
     return null;
   logTaskChange(target.id, "steal", "assigned_to", target.assigned_to, agentId, agentId, d);
   logTaskChange(target.id, "steal", "locked_by", target.locked_by, agentId, agentId, d);
-  const stolenTask = { ...target, assigned_to: agentId, locked_by: agentId, locked_at: timestamp, updated_at: timestamp, version: target.version + 1 };
+  const stolenTask = { ...target, assigned_to: agentId, locked_by: agentId, locked_at: timestamp2, updated_at: timestamp2, version: target.version + 1 };
   const payload = taskEventData(stolenTask, { agent_id: agentId, stolen_from: target.assigned_to });
   dispatchWebhook2("task.assigned", payload, d).catch(() => {});
   emitLocalEventHooksQuiet({ type: "task.assigned", payload, databasePath });
@@ -7623,10 +8654,11 @@ var init_task_lifecycle = __esm(() => {
   init_templates();
   init_task_crud();
   init_task_graph();
+  init_prewrite_secrets();
 });
 
 // src/db/task-crud.ts
-function rowToTask(row) {
+function rowToTask2(row) {
   return {
     ...row,
     tags: JSON.parse(row.tags || "[]"),
@@ -7660,9 +8692,29 @@ function addMetadataConditions(metadata, conditions, params) {
     params.push(value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean" ? value : JSON.stringify(value));
   }
 }
+function sanitizeCreateTaskInput(input) {
+  return {
+    ...input,
+    title: sanitizePreWriteText(input.title, "task.title"),
+    description: input.description !== undefined ? sanitizePreWriteText(input.description, "task.description") : undefined,
+    tags: input.tags !== undefined ? sanitizePreWriteValue(input.tags, "task.tags") : undefined,
+    metadata: input.metadata !== undefined ? sanitizePreWriteValue(input.metadata, "task.metadata") : undefined,
+    reason: input.reason !== undefined ? sanitizePreWriteText(input.reason, "task.reason") : undefined
+  };
+}
+function sanitizeUpdateTaskInput(input) {
+  return {
+    ...input,
+    title: input.title !== undefined ? sanitizePreWriteText(input.title, "task.title") : undefined,
+    description: input.description !== undefined ? sanitizePreWriteText(input.description, "task.description") : undefined,
+    tags: input.tags !== undefined ? sanitizePreWriteValue(input.tags, "task.tags") : undefined,
+    metadata: input.metadata !== undefined ? sanitizePreWriteValue(input.metadata, "task.metadata") : undefined
+  };
+}
 function createTask(input, db) {
+  input = sanitizeCreateTaskInput(input);
   const d = db || getDatabase();
-  const timestamp = now();
+  const timestamp2 = now();
   const tags = input.tags || [];
   const machineId = currentStorageMachineId(d);
   const assignedBy = input.assigned_by || input.agent_id;
@@ -7689,8 +8741,8 @@ function createTask(input, db) {
         input.working_dir || null,
         JSON.stringify(tags),
         JSON.stringify(input.metadata || {}),
-        timestamp,
-        timestamp,
+        timestamp2,
+        timestamp2,
         input.due_at || null,
         input.estimated_minutes || null,
         input.sla_minutes ?? null,
@@ -7736,7 +8788,7 @@ function getTask(id, db) {
   const row = d.query("SELECT * FROM tasks WHERE id = ?").get(id);
   if (!row)
     return null;
-  return rowToTask(row);
+  return rowToTask2(row);
 }
 function getTaskWithRelations(id, db) {
   const d = db || getDatabase();
@@ -7744,15 +8796,15 @@ function getTaskWithRelations(id, db) {
   if (!task)
     return null;
   const subtaskRows = d.query("SELECT * FROM tasks WHERE parent_id = ? ORDER BY created_at").all(id);
-  const subtasks = subtaskRows.map(rowToTask);
+  const subtasks = subtaskRows.map(rowToTask2);
   const depRows = d.query(`SELECT t.* FROM tasks t
        JOIN task_dependencies td ON td.depends_on = t.id
        WHERE td.task_id = ?`).all(id);
-  const dependencies = depRows.map(rowToTask);
+  const dependencies = depRows.map(rowToTask2);
   const blockedByRows = d.query(`SELECT t.* FROM tasks t
        JOIN task_dependencies td ON td.task_id = t.id
        WHERE td.depends_on = ?`).all(id);
-  const blocked_by = blockedByRows.map(rowToTask);
+  const blocked_by = blockedByRows.map(rowToTask2);
   const comments = d.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at").all(id);
   const parent = task.parent_id ? getTask(task.parent_id, d) : null;
   const checklist = getChecklist(id, d);
@@ -7868,7 +8920,7 @@ function listTasks(filter = {}, db) {
     }
   }
   const rows = d.query(`SELECT * FROM tasks ${where} ORDER BY ${PRIORITY_RANK}, created_at DESC, id ASC${limitClause}`).all(...params);
-  return rows.map(rowToTask);
+  return rows.map(rowToTask2);
 }
 function getTaskByFingerprint(fingerprint, db) {
   const tasks = listTasks({ metadata: { fingerprint }, limit: 1, include_archived: true }, db);
@@ -8014,10 +9066,11 @@ function updateTask(id, input, db) {
   if (task.version !== input.version) {
     throw new VersionConflictError(id, input.version, task.version);
   }
-  const timestamp = now();
-  const completionTimestamp = input.completed_at ?? timestamp;
+  input = sanitizeUpdateTaskInput(input);
+  const timestamp2 = now();
+  const completionTimestamp = input.completed_at ?? timestamp2;
   const sets = ["version = version + 1", "updated_at = ?"];
-  const params = [timestamp];
+  const params = [timestamp2];
   if (input.title !== undefined) {
     sets.push("title = ?");
     params.push(input.title);
@@ -8166,7 +9219,7 @@ function updateTask(id, input, db) {
     tags: input.tags ?? task.tags,
     metadata: input.metadata ?? task.metadata,
     version: task.version + 1,
-    updated_at: timestamp,
+    updated_at: timestamp2,
     locked_by: completedNow ? null : task.locked_by,
     locked_at: completedNow ? null : task.locked_at,
     completed_at: completedNow ? completionTimestamp : reopened ? null : input.completed_at !== undefined ? input.completed_at : task.completed_at,
@@ -8178,7 +9231,7 @@ function updateTask(id, input, db) {
     retry_after: input.retry_after !== undefined ? input.retry_after : task.retry_after,
     requires_approval: input.requires_approval !== undefined ? input.requires_approval : task.requires_approval,
     approved_by: input.approved_by ?? task.approved_by,
-    approved_at: input.approved_by ? timestamp : task.approved_at
+    approved_at: input.approved_by ? timestamp2 : task.approved_at
   };
   const databasePath = databasePathFromDatabase(d);
   if (input.assigned_to !== undefined && input.assigned_to !== task.assigned_to) {
@@ -8210,7 +9263,7 @@ function deleteTask(id, db) {
   recordStorageTombstone({
     object_type: "tasks",
     object_id: id,
-    payload: rowToTask(row),
+    payload: rowToTask2(row),
     version: row.version
   }, d);
   const result = d.run("DELETE FROM tasks WHERE id = ?", [id]);
@@ -8227,6 +9280,7 @@ var init_task_crud = __esm(() => {
   init_webhooks();
   init_checklists();
   init_storage_tombstones();
+  init_prewrite_secrets();
 });
 
 // src/db/task-status.ts
@@ -8358,10 +9412,10 @@ function redistributeStaleTasks(agentId, options, db) {
   const maxAge = options?.max_age_minutes ?? 60;
   const stale = getStaleTasks(maxAge, options?.project_id ? { project_id: options.project_id } : undefined, d);
   const limited = options?.limit ? stale.slice(0, options.limit) : stale;
-  const timestamp = now();
+  const timestamp2 = now();
   const released = [];
   for (const t of limited) {
-    d.run(`UPDATE tasks SET locked_by = NULL, locked_at = NULL, status = 'pending', version = version + 1, updated_at = ? WHERE id = ?`, [timestamp, t.id]);
+    d.run(`UPDATE tasks SET locked_by = NULL, locked_at = NULL, status = 'pending', version = version + 1, updated_at = ? WHERE id = ?`, [timestamp2, t.id]);
     released.push({ ...t, locked_by: null, locked_at: null, status: "pending" });
   }
   const claimed = released.length > 0 ? claimNextTask(agentId, options?.project_id ? { project_id: options.project_id } : undefined, d) : null;
@@ -8501,7 +9555,7 @@ function getOverdueTasks(projectId, db, at = new Date) {
   }
   query += ` ORDER BY due_at ASC`;
   const rows = d.query(query).all(...params);
-  return rows.map(rowToTask);
+  return rows.map(rowToTask2);
 }
 function getEscalatedTasks(opts = {}, db, at = new Date) {
   const d = db || getDatabase();
@@ -8521,7 +9575,7 @@ function getEscalatedTasks(opts = {}, db, at = new Date) {
     params.push(opts.agent_id);
   }
   const rows = d.query(`SELECT * FROM tasks WHERE ${conditions.join(" AND ")} ORDER BY due_at ASC, created_at ASC`).all(...params);
-  return rows.map(rowToTask).map((task) => {
+  return rows.map(rowToTask2).map((task) => {
     const reasons = [];
     const breachedTimes = [];
     if (task.due_at) {
@@ -8833,7 +9887,7 @@ function resolveCreateSlug(input, projectId, db) {
 function createPlan(input, db) {
   const d = db || getDatabase();
   const id = uuid();
-  const timestamp = now();
+  const timestamp2 = now();
   const projectId = input.project_id || null;
   const slug = resolveCreateSlug(input, projectId, d);
   const machineId = currentStorageMachineId(d);
@@ -8847,8 +9901,8 @@ function createPlan(input, db) {
     input.name,
     input.description || null,
     input.status || "active",
-    timestamp,
-    timestamp,
+    timestamp2,
+    timestamp2,
     machineId
   ]);
   return getPlan(id, d);
@@ -8985,7 +10039,7 @@ function maybeFilter(value) {
 function createTaskBoard(input, db) {
   const d = db || getDatabase();
   const id = uuid();
-  const timestamp = now();
+  const timestamp2 = now();
   const scope = input.scope || "tasks";
   const lanes = normalizeLanes(scope, input.lanes);
   d.run(`INSERT INTO task_boards (id, name, scope, project_id, task_list_id, plan_id, agent_id, lanes, filters, created_at, updated_at)
@@ -8999,8 +10053,8 @@ function createTaskBoard(input, db) {
     input.agent_id || null,
     JSON.stringify(lanes),
     JSON.stringify(input.filters || {}),
-    timestamp,
-    timestamp
+    timestamp2,
+    timestamp2
   ]);
   return getTaskBoard(id, d);
 }
@@ -9401,14 +10455,14 @@ function storeArtifactContent(input) {
     return null;
   const sourceStat = statSync2(sourcePath);
   if (!sourceStat.isFile())
-    throw new Error(`Artifact path is not a file: ${input.path}`);
+    throw new Error(`Artifact path is not a file: ${sanitizePreWriteText(input.path, "artifact.path")}`);
   const sourceBuffer = readFileSync3(sourcePath);
   const sourceSha = sha256(sourceBuffer);
   const textLike = isTextLike(sourceBuffer, input.path);
   let storedBuffer = sourceBuffer;
   let redactionStatus = textLike ? "clean" : "binary_or_unknown";
   if (textLike) {
-    const redactedText = redactEvidenceText(sourceBuffer.toString("utf8"));
+    const redactedText = sanitizePreWriteText(sourceBuffer.toString("utf8"), "artifact.content");
     storedBuffer = Buffer.from(redactedText);
     if (!storedBuffer.equals(sourceBuffer))
       redactionStatus = "redacted";
@@ -9442,7 +10496,7 @@ function storeArtifactContent(input) {
         expires_at: retentionDays === null ? null : retentionExpiresAt(createdAt, retentionDays)
       },
       source: {
-        path: input.path,
+        path: sanitizePreWriteText(input.path, "artifact.source_path"),
         size_bytes: sourceBuffer.length,
         sha256: sourceSha
       }
@@ -9622,6 +10676,7 @@ var DEFAULT_DELETED_RETENTION_DAYS = 30;
 var init_artifact_store = __esm(() => {
   init_database();
   init_redaction();
+  init_prewrite_secrets();
 });
 
 // src/db/comments.ts
@@ -9631,17 +10686,17 @@ function addComment(input, db) {
     throw new TaskNotFoundError(input.task_id);
   }
   const id = uuid();
-  const timestamp = now();
+  const timestamp2 = now();
   d.run(`INSERT INTO task_comments (id, task_id, agent_id, session_id, content, type, progress_pct, created_at)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
     input.task_id,
     input.agent_id || null,
     input.session_id || null,
-    redactEvidenceText(input.content),
+    sanitizePreWriteText(input.content, "comment.content"),
     input.type || "comment",
     input.progress_pct ?? null,
-    timestamp
+    timestamp2
   ]);
   return getComment(id, d);
 }
@@ -9665,21 +10720,21 @@ var init_comments = __esm(() => {
   init_types();
   init_database();
   init_tasks();
-  init_redaction();
+  init_prewrite_secrets();
 });
 
 // src/db/task-files.ts
 function addTaskFile(input, db) {
   const d = db || getDatabase();
   const id = uuid();
-  const timestamp = now();
+  const timestamp2 = now();
   const existing = d.query("SELECT id FROM task_files WHERE task_id = ? AND path = ?").get(input.task_id, input.path);
   if (existing) {
-    d.run("UPDATE task_files SET status = ?, agent_id = ?, note = ?, updated_at = ? WHERE id = ?", [input.status || "active", input.agent_id || null, input.note || null, timestamp, existing.id]);
+    d.run("UPDATE task_files SET status = ?, agent_id = ?, note = ?, updated_at = ? WHERE id = ?", [input.status || "active", input.agent_id || null, input.note || null, timestamp2, existing.id]);
     return getTaskFile(existing.id, d);
   }
   d.run(`INSERT INTO task_files (id, task_id, path, status, agent_id, note, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [id, input.task_id, input.path, input.status || "active", input.agent_id || null, input.note || null, timestamp, timestamp]);
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [id, input.task_id, input.path, input.status || "active", input.agent_id || null, input.note || null, timestamp2, timestamp2]);
   return getTaskFile(id, d);
 }
 function getTaskFile(id, db) {
@@ -9696,8 +10751,8 @@ function findTasksByFile(path, db) {
 }
 function updateTaskFileStatus(taskId, path, status, agentId, db) {
   const d = db || getDatabase();
-  const timestamp = now();
-  d.run("UPDATE task_files SET status = ?, agent_id = COALESCE(?, agent_id), updated_at = ? WHERE task_id = ? AND path = ?", [status, agentId || null, timestamp, taskId, path]);
+  const timestamp2 = now();
+  d.run("UPDATE task_files SET status = ?, agent_id = COALESCE(?, agent_id), updated_at = ? WHERE task_id = ? AND path = ?", [status, agentId || null, timestamp2, taskId, path]);
   const row = d.query("SELECT * FROM task_files WHERE task_id = ? AND path = ?").get(taskId, path);
   return row;
 }
@@ -9742,8 +10797,16 @@ function rowToVerification(row) {
 function linkTaskToCommit(input, db) {
   const d = db || getDatabase();
   const existing = d.query("SELECT * FROM task_commits WHERE task_id = ? AND sha = ?").get(input.task_id, input.sha);
-  const ciJson = input.ci_snapshot ? JSON.stringify(input.ci_snapshot) : null;
-  const traceJson = input.traceability ? JSON.stringify(input.traceability) : null;
+  const ciJson = input.ci_snapshot ? JSON.stringify(sanitizePreWriteValue(input.ci_snapshot, "commit.ci_snapshot")) : null;
+  const traceJson = input.traceability ? JSON.stringify(sanitizePreWriteValue(input.traceability, "commit.traceability")) : null;
+  const message = input.message ? sanitizePreWriteText(input.message, "commit.message") : null;
+  const author = input.author ? sanitizePreWriteText(input.author, "commit.author") : null;
+  const filesChanged = input.files_changed ? JSON.stringify(sanitizePreWriteValue(input.files_changed, "commit.files_changed")) : null;
+  const branch = input.branch ? sanitizePreWriteText(input.branch, "commit.branch") : null;
+  const prUrl = input.pr_url ? sanitizePreWriteText(input.pr_url, "commit.pr_url") : null;
+  const prState = input.pr_state ? sanitizePreWriteText(input.pr_state, "commit.pr_state") : null;
+  const releaseTag = input.release_tag ? sanitizePreWriteText(input.release_tag, "commit.release_tag") : null;
+  const repoPath = input.repo_path ? sanitizePreWriteText(input.repo_path, "commit.repo_path") : null;
   if (existing) {
     d.run(`UPDATE task_commits SET
         message = COALESCE(?, message),
@@ -9759,17 +10822,17 @@ function linkTaskToCommit(input, db) {
         repo_path = COALESCE(?, repo_path),
         traceability = COALESCE(?, traceability)
        WHERE id = ?`, [
-      input.message ?? null,
-      input.author ?? null,
-      input.files_changed ? JSON.stringify(input.files_changed) : null,
+      message,
+      author,
+      filesChanged,
       input.committed_at ?? null,
-      input.branch ?? null,
-      input.pr_url ?? null,
+      branch,
+      prUrl,
       input.pr_number ?? null,
-      input.pr_state ?? null,
+      prState,
       ciJson,
-      input.release_tag ?? null,
-      input.repo_path ?? null,
+      releaseTag,
+      repoPath,
       traceJson,
       existing.id
     ]);
@@ -9783,17 +10846,17 @@ function linkTaskToCommit(input, db) {
     id,
     input.task_id,
     input.sha,
-    input.message ?? null,
-    input.author ?? null,
-    input.files_changed ? JSON.stringify(input.files_changed) : null,
+    message,
+    author,
+    filesChanged,
     input.committed_at ?? null,
-    input.branch ?? null,
-    input.pr_url ?? null,
+    branch,
+    prUrl,
     input.pr_number ?? null,
-    input.pr_state ?? null,
+    prState,
     ciJson,
-    input.release_tag ?? null,
-    input.repo_path ?? null,
+    releaseTag,
+    repoPath,
     traceJson ?? "{}",
     now()
   ]);
@@ -9822,13 +10885,16 @@ function addTaskVerification(input, db) {
   const d = db || getDatabase();
   const id = uuid();
   const runAt = input.run_at || now();
+  const command = sanitizePreWriteText(input.command, "verification.command");
+  const outputSummary = input.output_summary ? sanitizePreWriteText(input.output_summary, "verification.output_summary") : null;
+  const artifactPath = input.artifact_path ? sanitizePreWriteText(input.artifact_path, "verification.artifact_path") : null;
   d.run("INSERT INTO task_verifications (id, task_id, command, status, output_summary, artifact_path, agent_id, run_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)", [
     id,
     input.task_id,
-    input.command,
+    command,
     input.status || "unknown",
-    input.output_summary ?? null,
-    input.artifact_path ?? null,
+    outputSummary,
+    artifactPath,
     input.agent_id ?? null,
     runAt,
     now()
@@ -9858,6 +10924,7 @@ function getTaskTraceability(taskId, db) {
 }
 var init_task_commits = __esm(() => {
   init_database();
+  init_prewrite_secrets();
 });
 
 // src/db/task-runs.ts
@@ -9968,7 +11035,7 @@ function startTaskRun(input, db) {
   if (!getTask(input.task_id, d))
     throw new TaskNotFoundError(input.task_id);
   const id = input.id ?? uuid();
-  const timestamp = input.started_at || now();
+  const timestamp2 = input.started_at || now();
   if (input.claim && input.agent_id) {
     startTask(input.task_id, input.agent_id, d);
   }
@@ -9976,12 +11043,12 @@ function startTaskRun(input, db) {
     id,
     input.task_id,
     input.agent_id ?? null,
-    input.title ? redactEvidenceText(input.title) : null,
-    input.summary ? redactEvidenceText(input.summary) : null,
-    JSON.stringify(redactValue(input.metadata || {})),
-    timestamp,
-    timestamp,
-    timestamp
+    input.title ? sanitizePreWriteText(input.title, "run.title") : null,
+    input.summary ? sanitizePreWriteText(input.summary, "run.summary") : null,
+    JSON.stringify(sanitizePreWriteValue(input.metadata || {}, "run.metadata")),
+    timestamp2,
+    timestamp2,
+    timestamp2
   ]);
   addTaskRunEvent({
     run_id: id,
@@ -9989,7 +11056,7 @@ function startTaskRun(input, db) {
     message: input.summary || input.title || "run started",
     data: { title: input.title, claim: Boolean(input.claim) },
     agent_id: input.agent_id,
-    created_at: timestamp
+    created_at: timestamp2
   }, d);
   if (input.claim && input.agent_id) {
     addTaskRunEvent({
@@ -9998,7 +11065,7 @@ function startTaskRun(input, db) {
       message: `claimed by ${input.agent_id}`,
       data: { agent_id: input.agent_id },
       agent_id: input.agent_id,
-      created_at: timestamp
+      created_at: timestamp2
     }, d);
   }
   const run = getTaskRun(id, d);
@@ -10013,7 +11080,7 @@ function beginTaskRunTransaction(input, db) {
   const d = db || getDatabase();
   if (!getTask(input.task_id, d))
     throw new TaskNotFoundError(input.task_id);
-  const timestamp = input.started_at || now();
+  const timestamp2 = input.started_at || now();
   const key = normalizeTransactionKey(input);
   const existing = findTaskRunByTransactionKey(key, input.task_id, d);
   const dryRun = !input.apply;
@@ -10022,7 +11089,7 @@ function beginTaskRunTransaction(input, db) {
       schema_version: LOOP_RUN_TRANSACTION_SCHEMA_VERSION,
       local_only: true,
       dry_run: dryRun,
-      processed_at: timestamp,
+      processed_at: timestamp2,
       action: "matched",
       key,
       run: summarizeTaskRun(existing),
@@ -10035,7 +11102,7 @@ function beginTaskRunTransaction(input, db) {
       schema_version: LOOP_RUN_TRANSACTION_SCHEMA_VERSION,
       local_only: true,
       dry_run: true,
-      processed_at: timestamp,
+      processed_at: timestamp2,
       action: "preview",
       key,
       run: null,
@@ -10043,14 +11110,14 @@ function beginTaskRunTransaction(input, db) {
       commands: loopRunCommands(null, key)
     };
   }
-  const metadata = redactValue({
+  const metadata = sanitizePreWriteValue({
     ...input.metadata || {},
     loop_transaction: {
       schema_version: LOOP_RUN_TRANSACTION_SCHEMA_VERSION,
       idempotency_key: key,
       loop_id: input.loop_id ?? null,
       loop_run_id: input.loop_run_id ?? null,
-      first_seen_at: timestamp
+      first_seen_at: timestamp2
     },
     idempotency_key: key
   });
@@ -10064,8 +11131,8 @@ function beginTaskRunTransaction(input, db) {
       input.loop_id ?? null,
       input.loop_run_id ?? null,
       JSON.stringify(metadata),
-      timestamp,
-      timestamp
+      timestamp2,
+      timestamp2
     ]);
     const transaction = getTaskRunTransactionByKey(key, input.task_id, d);
     if (!transaction)
@@ -10083,16 +11150,16 @@ function beginTaskRunTransaction(input, db) {
       summary: input.summary,
       metadata,
       claim: input.claim,
-      started_at: timestamp
+      started_at: timestamp2
     }, d);
-    d.run("UPDATE task_run_transactions SET run_id = ?, loop_id = COALESCE(?, loop_id), loop_run_id = COALESCE(?, loop_run_id), metadata = ?, updated_at = ? WHERE id = ?", [run.id, input.loop_id ?? null, input.loop_run_id ?? null, JSON.stringify(metadata), timestamp, transaction.id]);
+    d.run("UPDATE task_run_transactions SET run_id = ?, loop_id = COALESCE(?, loop_id), loop_run_id = COALESCE(?, loop_run_id), metadata = ?, updated_at = ? WHERE id = ?", [run.id, input.loop_id ?? null, input.loop_run_id ?? null, JSON.stringify(metadata), timestamp2, transaction.id]);
     return { run, action: "created" };
   })();
   return {
     schema_version: LOOP_RUN_TRANSACTION_SCHEMA_VERSION,
     local_only: true,
     dry_run: false,
-    processed_at: timestamp,
+    processed_at: timestamp2,
     action: created.action,
     key,
     run: summarizeTaskRun(created.run),
@@ -10107,19 +11174,19 @@ function addTaskRunEvent(input, db) {
   if (!run)
     throw new Error(`Run not found: ${input.run_id}`);
   const id = uuid();
-  const timestamp = input.created_at || now();
+  const timestamp2 = input.created_at || now();
   d.run("INSERT INTO task_run_events (id, run_id, task_id, event_type, message, data, agent_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)", [
     id,
     run.id,
     run.task_id,
     input.event_type,
-    input.message ? redactEvidenceText(input.message) : null,
-    JSON.stringify(redactValue(input.data || {})),
+    input.message ? sanitizePreWriteText(input.message, "run_event.message") : null,
+    JSON.stringify(sanitizePreWriteValue(input.data || {}, "run_event.data")),
     input.agent_id ?? run.agent_id,
-    timestamp
+    timestamp2
   ]);
   if (input.event_type === "comment" && input.message) {
-    addComment({ task_id: run.task_id, content: redactEvidenceText(input.message), type: "comment", agent_id: input.agent_id ?? run.agent_id ?? undefined }, d);
+    addComment({ task_id: run.task_id, content: sanitizePreWriteText(input.message, "run_event.comment"), type: "comment", agent_id: input.agent_id ?? run.agent_id ?? undefined }, d);
   }
   return rowToEvent(d.query("SELECT * FROM task_run_events WHERE id = ?").get(id));
 }
@@ -10131,10 +11198,10 @@ function addTaskRunCommand(input, db) {
     throw new Error(`Run not found: ${input.run_id}`);
   const id = uuid();
   const status = input.status || "unknown";
-  const timestamp = now();
-  const command = redactEvidenceText(input.command);
-  const outputSummary = input.output_summary ? redactEvidenceText(input.output_summary) : null;
-  const artifactPath = input.artifact_path ? redactEvidenceText(input.artifact_path) : null;
+  const timestamp2 = now();
+  const command = sanitizePreWriteText(input.command, "run_command.command");
+  const outputSummary = input.output_summary ? sanitizePreWriteText(input.output_summary, "run_command.output_summary") : null;
+  const artifactPath = input.artifact_path ? sanitizePreWriteText(input.artifact_path, "run_command.artifact_path") : null;
   d.run("INSERT INTO task_run_commands (id, run_id, task_id, command, status, exit_code, output_summary, artifact_path, agent_id, started_at, completed_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", [
     id,
     run.id,
@@ -10146,8 +11213,8 @@ function addTaskRunCommand(input, db) {
     artifactPath,
     input.agent_id ?? run.agent_id,
     input.started_at ?? null,
-    input.completed_at ?? timestamp,
-    timestamp
+    input.completed_at ?? timestamp2,
+    timestamp2
   ]);
   addTaskVerification({
     task_id: run.task_id,
@@ -10156,7 +11223,7 @@ function addTaskRunCommand(input, db) {
     output_summary: outputSummary ?? undefined,
     artifact_path: artifactPath ?? undefined,
     agent_id: input.agent_id ?? run.agent_id ?? undefined,
-    run_at: input.completed_at ?? timestamp
+    run_at: input.completed_at ?? timestamp2
   }, d);
   addTaskRunEvent({
     run_id: run.id,
@@ -10175,7 +11242,7 @@ function addTaskRunCommand(input, db) {
       }
     },
     agent_id: input.agent_id ?? run.agent_id ?? undefined,
-    created_at: timestamp
+    created_at: timestamp2
   }, d);
   return d.query("SELECT * FROM task_run_commands WHERE id = ?").get(id);
 }
@@ -10189,7 +11256,7 @@ function addTaskRunFile(input, db) {
     task_id: run.task_id,
     path: input.path,
     status: input.status || "modified",
-    note: input.note ? redactEvidenceText(input.note) : undefined,
+    note: input.note ? sanitizePreWriteText(input.note, "run_file.note") : undefined,
     agent_id: input.agent_id ?? run.agent_id ?? undefined
   }, d);
   addTaskRunEvent({
@@ -10208,19 +11275,19 @@ function addTaskRunArtifact(input, db) {
   if (!run)
     throw new Error(`Run not found: ${input.run_id}`);
   const id = uuid();
-  const timestamp = now();
-  const path = redactEvidenceText(input.path);
-  const description = input.description ? redactEvidenceText(input.description) : null;
-  const metadata = redactValue(input.metadata || {});
+  const timestamp2 = now();
+  const path = sanitizePreWriteText(input.path, "run_artifact.path");
+  const description = input.description ? sanitizePreWriteText(input.description, "run_artifact.description") : null;
+  const metadata = sanitizePreWriteValue(input.metadata || {}, "run_artifact.metadata");
   let sizeBytes = input.size_bytes ?? null;
   let digest = input.sha256 ?? null;
-  const stored = input.store_content !== false ? storeArtifactContent({ path: input.path, metadata, retention_days: input.retention_days, created_at: timestamp }) : null;
+  const stored = input.store_content !== false ? storeArtifactContent({ path: input.path, metadata, retention_days: input.retention_days, created_at: timestamp2 }) : null;
   if (stored) {
     sizeBytes = stored.size_bytes;
     digest = stored.sha256;
     metadata["artifact_store"] = stored.store;
   } else if (input.store_content === true) {
-    throw new Error(`Artifact file not found: ${input.path}`);
+    throw new Error(`Artifact file not found: ${path}`);
   }
   d.run("INSERT INTO task_run_artifacts (id, run_id, task_id, path, artifact_type, description, size_bytes, sha256, metadata, agent_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", [
     id,
@@ -10233,7 +11300,7 @@ function addTaskRunArtifact(input, db) {
     digest,
     JSON.stringify(metadata),
     input.agent_id ?? run.agent_id,
-    timestamp
+    timestamp2
   ]);
   addTaskRunEvent({
     run_id: run.id,
@@ -10241,7 +11308,7 @@ function addTaskRunArtifact(input, db) {
     message: description || path,
     data: { path, artifact_type: input.artifact_type, size_bytes: sizeBytes, sha256: digest, stored: Boolean(stored) },
     agent_id: input.agent_id ?? run.agent_id ?? undefined,
-    created_at: timestamp
+    created_at: timestamp2
   }, d);
   return rowToArtifact(d.query("SELECT * FROM task_run_artifacts WHERE id = ?").get(id));
 }
@@ -10261,28 +11328,28 @@ function finishTaskRun(input, db) {
   const run = getTaskRun(runId, d);
   if (!run)
     throw new Error(`Run not found: ${input.run_id}`);
-  const timestamp = input.completed_at || now();
-  const summary = input.summary ? redactEvidenceText(input.summary) : null;
-  d.run("UPDATE task_runs SET status = ?, summary = COALESCE(?, summary), completed_at = ?, updated_at = ? WHERE id = ?", [input.status, summary, timestamp, timestamp, run.id]);
+  const timestamp2 = input.completed_at || now();
+  const summary = input.summary ? sanitizePreWriteText(input.summary, "run.summary") : null;
+  d.run("UPDATE task_runs SET status = ?, summary = COALESCE(?, summary), completed_at = ?, updated_at = ? WHERE id = ?", [input.status, summary, timestamp2, timestamp2, run.id]);
   addTaskRunEvent({
     run_id: run.id,
     event_type: input.status,
     message: summary || `run ${input.status}`,
     data: { status: input.status },
     agent_id: input.agent_id ?? run.agent_id ?? undefined,
-    created_at: timestamp
+    created_at: timestamp2
   }, d);
   const updated = getTaskRun(run.id, d);
   emitLocalEventHooksQuiet({
     type: `run.${input.status}`,
-    payload: { id: updated.id, task_id: updated.task_id, agent_id: updated.agent_id, status: updated.status, summary: updated.summary, completed_at: timestamp },
+    payload: { id: updated.id, task_id: updated.task_id, agent_id: updated.agent_id, status: updated.status, summary: updated.summary, completed_at: timestamp2 },
     databasePath: databasePathFromDatabase(d)
   });
   return updated;
 }
 function finishTaskRunTransaction(input, db) {
   const d = db || getDatabase();
-  const timestamp = input.completed_at || now();
+  const timestamp2 = input.completed_at || now();
   const status = input.status || "completed";
   const key = input.key ? normalizeTransactionKey({ key: input.key }) : "";
   const run = input.run_id ? getTaskRun(resolveTaskRunId(input.run_id, d), d) : key ? findTaskRunByTransactionKey(key, input.task_id, d) : null;
@@ -10300,7 +11367,7 @@ function finishTaskRunTransaction(input, db) {
       schema_version: LOOP_RUN_TRANSACTION_SCHEMA_VERSION,
       local_only: true,
       dry_run: dryRun,
-      processed_at: timestamp,
+      processed_at: timestamp2,
       action: conflict ? "conflict" : "matched",
       key: resolvedKey,
       run: summarizeTaskRun(run),
@@ -10313,10 +11380,10 @@ function finishTaskRunTransaction(input, db) {
       schema_version: LOOP_RUN_TRANSACTION_SCHEMA_VERSION,
       local_only: true,
       dry_run: true,
-      processed_at: timestamp,
+      processed_at: timestamp2,
       action: "preview",
       key: resolvedKey,
-      run: summarizeTaskRun({ ...run, status, summary: input.summary ?? run.summary, completed_at: timestamp, updated_at: timestamp }),
+      run: summarizeTaskRun({ ...run, status, summary: input.summary ?? run.summary, completed_at: timestamp2, updated_at: timestamp2 }),
       warnings: [],
       commands: loopRunCommands(run, resolvedKey)
     };
@@ -10326,13 +11393,13 @@ function finishTaskRunTransaction(input, db) {
     status,
     summary: input.summary,
     agent_id: input.agent_id,
-    completed_at: timestamp
+    completed_at: timestamp2
   }, d);
   return {
     schema_version: LOOP_RUN_TRANSACTION_SCHEMA_VERSION,
     local_only: true,
     dry_run: false,
-    processed_at: timestamp,
+    processed_at: timestamp2,
     action: "finished",
     key: resolvedKey,
     run: summarizeTaskRun(finished),
@@ -10362,7 +11429,7 @@ var init_task_runs = __esm(() => {
   init_artifact_store();
   init_event_emission_safety();
   init_event_hooks();
-  init_redaction();
+  init_prewrite_secrets();
   init_types();
   init_comments();
   init_database();
@@ -10490,7 +11557,7 @@ function inWindow(event, query) {
 function createCalendarItem(input, db) {
   const d = db || getDatabase();
   const id = uuid();
-  const timestamp = now();
+  const timestamp2 = now();
   const kind = input.kind || "work_block";
   d.run(`INSERT INTO local_calendar_items (
       id, kind, title, description, starts_at, ends_at, timezone, project_id, task_id, plan_id, run_id,
@@ -10509,8 +11576,8 @@ function createCalendarItem(input, db) {
     input.run_id || null,
     input.recurrence_rule || null,
     JSON.stringify(input.metadata || {}),
-    timestamp,
-    timestamp
+    timestamp2,
+    timestamp2
   ]);
   return getCalendarItem(id, d);
 }
@@ -10757,18 +11824,172 @@ var init_tasks = __esm(() => {
 // src/storage/index.ts
 init_config();
 
+// src/lib/search.ts
+init_database();
+function rowToTask(row) {
+  return {
+    ...row,
+    tags: JSON.parse(row.tags || "[]"),
+    metadata: JSON.parse(row.metadata || "{}"),
+    status: row.status,
+    priority: row.priority,
+    requires_approval: Boolean(row.requires_approval)
+  };
+}
+var DEFAULT_SEARCH_LIMIT = 1000;
+var BM25_WEIGHTS = "0.0, 10.0, 5.0, 3.0";
+function hasFts(db) {
+  try {
+    const result = db.query("SELECT 1 FROM sqlite_master WHERE type='table' AND name='tasks_fts'").get();
+    return result !== null;
+  } catch {
+    return false;
+  }
+}
+function buildFtsMatchQuery(raw) {
+  const terms = [];
+  const re = /"([^"]*)"|(\S+)/g;
+  let m;
+  while ((m = re.exec(raw)) !== null) {
+    if (m[1] !== undefined) {
+      const phrase = m[1].replace(/"/g, " ").replace(/\s+/g, " ").trim();
+      if (phrase)
+        terms.push(`"${phrase}"`);
+    } else {
+      const cleaned = m[2].replace(/["*^():]/g, " ").replace(/\s+/g, " ").trim();
+      if (cleaned)
+        terms.push(`"${cleaned}"*`);
+    }
+  }
+  return terms.join(" AND ");
+}
+function boundedLimit(limit) {
+  if (!Number.isFinite(limit) || !limit || limit <= 0)
+    return DEFAULT_SEARCH_LIMIT;
+  return Math.trunc(limit);
+}
+function searchTasks(options, projectId, taskListId, db) {
+  const opts = typeof options === "string" ? { query: options || undefined, project_id: projectId, task_list_id: taskListId } : options;
+  const d = db || getDatabase();
+  clearExpiredLocks(d);
+  const params = [];
+  let sql;
+  const raw = opts.query?.trim() ?? "";
+  const q = raw === "*" ? "" : raw;
+  const ftsMatch = q ? buildFtsMatchQuery(q) : "";
+  const useFts = hasFts(d) && q !== "" && ftsMatch !== "";
+  if (useFts) {
+    const pattern = `%${q}%`;
+    sql = `SELECT t.* FROM tasks t
+      LEFT JOIN (
+        SELECT rowid, bm25(tasks_fts, ${BM25_WEIGHTS}) AS rank
+        FROM tasks_fts WHERE tasks_fts MATCH ?
+      ) fts ON fts.rowid = t.rowid
+      WHERE (
+        fts.rowid IS NOT NULL
+        OR t.id LIKE ?
+        OR t.short_id LIKE ?
+        OR t.title LIKE ?
+        OR t.description LIKE ?
+        OR t.working_dir LIKE ?
+        OR t.metadata LIKE ?
+        OR EXISTS (SELECT 1 FROM task_tags WHERE task_tags.task_id = t.id AND tag LIKE ?)
+      )`;
+    params.push(ftsMatch, pattern, pattern, pattern, pattern, pattern, pattern, pattern);
+  } else if (q) {
+    const pattern = `%${q}%`;
+    sql = `SELECT t.* FROM tasks t WHERE (
+      t.id LIKE ?
+      OR t.short_id LIKE ?
+      OR t.title LIKE ?
+      OR t.description LIKE ?
+      OR t.working_dir LIKE ?
+      OR t.metadata LIKE ?
+      OR EXISTS (SELECT 1 FROM task_tags WHERE task_tags.task_id = t.id AND tag LIKE ?)
+    )`;
+    params.push(pattern, pattern, pattern, pattern, pattern, pattern, pattern);
+  } else {
+    sql = `SELECT t.* FROM tasks t WHERE 1=1`;
+  }
+  if (opts.project_id) {
+    sql += " AND t.project_id = ?";
+    params.push(opts.project_id);
+  }
+  if (opts.task_list_id) {
+    sql += " AND t.task_list_id = ?";
+    params.push(opts.task_list_id);
+  }
+  if (opts.status) {
+    if (Array.isArray(opts.status)) {
+      sql += ` AND t.status IN (${opts.status.map(() => "?").join(",")})`;
+      params.push(...opts.status);
+    } else {
+      sql += " AND t.status = ?";
+      params.push(opts.status);
+    }
+  }
+  if (opts.priority) {
+    if (Array.isArray(opts.priority)) {
+      sql += ` AND t.priority IN (${opts.priority.map(() => "?").join(",")})`;
+      params.push(...opts.priority);
+    } else {
+      sql += " AND t.priority = ?";
+      params.push(opts.priority);
+    }
+  }
+  if (opts.assigned_to) {
+    sql += " AND t.assigned_to = ?";
+    params.push(opts.assigned_to);
+  }
+  if (opts.agent_id) {
+    sql += " AND t.agent_id = ?";
+    params.push(opts.agent_id);
+  }
+  if (opts.created_after) {
+    sql += " AND t.created_at > ?";
+    params.push(opts.created_after);
+  }
+  if (opts.updated_after) {
+    sql += " AND t.updated_at > ?";
+    params.push(opts.updated_after);
+  }
+  if (opts.has_dependencies === true) {
+    sql += " AND t.id IN (SELECT task_id FROM task_dependencies)";
+  } else if (opts.has_dependencies === false) {
+    sql += " AND t.id NOT IN (SELECT task_id FROM task_dependencies)";
+  }
+  if (opts.is_blocked === true) {
+    sql += " AND t.id IN (SELECT td.task_id FROM task_dependencies td JOIN tasks dep ON dep.id = td.depends_on WHERE dep.status != 'completed')";
+  } else if (opts.is_blocked === false) {
+    sql += " AND t.id NOT IN (SELECT td.task_id FROM task_dependencies td JOIN tasks dep ON dep.id = td.depends_on WHERE dep.status != 'completed')";
+  }
+  if (useFts) {
+    sql += ` ORDER BY (fts.rowid IS NULL) ASC, fts.rank ASC,
+      CASE t.priority WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 END,
+      t.created_at DESC`;
+  } else {
+    sql += ` ORDER BY
+      CASE t.priority WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 END,
+      t.created_at DESC`;
+  }
+  sql += ` LIMIT ?`;
+  params.push(boundedLimit(opts.limit));
+  const rows = d.query(sql).all(...params);
+  return rows.map(rowToTask);
+}
+
 // src/storage/local-sqlite.ts
 init_tasks();
 init_projects();
 init_plans();
 
 // src/db/agents.ts
+init_types();
 init_database();
+init_identity_mapping();
 init_storage_tombstones();
 
 // src/db/agent-names.ts
-init_database();
-
 class InvalidAgentNameError extends Error {
   suggestions;
   constructor(name, reason, suggestions = []) {
@@ -11049,45 +12270,10 @@ function validateAgentName(name, existingNames = []) {
   }
   return normalized;
 }
-function tableHasColumn(db, table, column) {
-  try {
-    return db.query(`PRAGMA table_info(${table})`).all().some((row) => row.name === column);
-  } catch {
-    return false;
-  }
-}
-function updateReferences(db, oldName, newName) {
-  const refs = [
-    ["tasks", "assigned_to"],
-    ["tasks", "agent_id"],
-    ["tasks", "locked_by"],
-    ["tasks", "assigned_by"],
-    ["plans", "agent_id"],
-    ["sessions", "agent_id"],
-    ["task_comments", "agent_id"],
-    ["task_history", "agent_id"],
-    ["webhooks", "agent_id"],
-    ["task_files", "agent_id"],
-    ["task_time_logs", "agent_id"],
-    ["task_watchers", "agent_id"],
-    ["task_checkpoints", "agent_id"],
-    ["task_heartbeats", "agent_id"],
-    ["project_agent_roles", "agent_id"]
-  ];
-  let changed = 0;
-  for (const [table, column] of refs) {
-    if (!tableHasColumn(db, table, column))
-      continue;
-    try {
-      changed += db.run(`UPDATE ${table} SET ${column} = ? WHERE LOWER(${column}) = ?`, [newName, oldName]).changes;
-    } catch {}
-  }
-  return changed;
-}
 function normalizeGeneratedAgentNames(db) {
   const rows = db.query("SELECT * FROM agents ORDER BY created_at, id").all();
   const existing = new Set(rows.map((agent) => normalizeAgentNameInput(agent.name)));
-  const renamed = [];
+  const planned = [];
   for (const agent of rows) {
     const oldName = normalizeAgentNameInput(agent.name);
     if (!isBlockedAgentName(oldName))
@@ -11097,18 +12283,20 @@ function normalizeGeneratedAgentNames(db) {
     if (!replacement) {
       throw new Error("No safe agent names are available for normalization");
     }
-    existing.delete(oldName);
     existing.add(replacement);
-    db.run("UPDATE agents SET name = ?, last_seen_at = ? WHERE id = ?", [replacement, now(), agent.id]);
-    const referenceUpdates = updateReferences(db, oldName, replacement);
-    renamed.push({
+    planned.push({
       id: agent.id,
       old_name: oldName,
       new_name: replacement,
-      reference_updates: referenceUpdates
+      applied: false,
+      disposition: "candidate",
+      alias_kind: "candidate",
+      status: "quarantined",
+      name_updates: 0,
+      reference_updates: 0
     });
   }
-  return renamed;
+  return planned;
 }
 
 // src/db/agents.ts
@@ -11130,7 +12318,6 @@ function autoReleaseStaleAgents(db) {
   return result.changes;
 }
 function getAvailableNamesFromPool(pool, db) {
-  autoReleaseStaleAgents(db);
   const cutoff = new Date(Date.now() - getActiveWindowMs()).toISOString();
   const activeNames = new Set(db.query("SELECT name FROM agents WHERE status = 'active' AND last_seen_at > ?").all(cutoff).map((r) => r.name.toLowerCase()));
   return pool.map(normalizeAgentNameInput).filter((name) => !activeNames.has(name));
@@ -11141,6 +12328,10 @@ function shortUuid() {
 function rowToAgent(row) {
   return {
     ...row,
+    identity_id: row.identity_id ?? null,
+    project_id: row.project_id ?? null,
+    runtime_instance_id: row.runtime_instance_id ?? null,
+    machine_id: row.machine_id ?? null,
     permissions: JSON.parse(row.permissions || '["*"]'),
     capabilities: JSON.parse(row.capabilities || "[]"),
     status: row.status || "active",
@@ -11149,11 +12340,37 @@ function rowToAgent(row) {
 }
 function registerAgent(input, db) {
   const d = db || getDatabase();
+  const register = d.transaction(() => registerAgentInCurrentTransaction(input, d));
+  return register.immediate();
+}
+function registerAgentInCurrentTransaction(input, d) {
   const machineId = currentStorageMachineId(d);
+  const identityId = input.identity_id === undefined ? null : input.identity_id.trim();
+  if (input.identity_id !== undefined && !identityId) {
+    throw new Error("identity_id must be a non-empty canonical identifier");
+  }
   const existingNames = d.query("SELECT name FROM agents").all().map((row) => row.name);
   const normalizedName = validateAgentName(input.name, existingNames);
-  const existing = getAgentByName(normalizedName, d);
+  const existingByName = getAgentByNameProjection(normalizedName, d);
+  const identityRows = identityId ? d.query("SELECT id FROM agents WHERE identity_id = ? ORDER BY id").all(identityId) : [];
+  if (identityRows.length > 1) {
+    throw new IdentityAliasAmbiguousError(identityId, identityRows.map((row) => row.id));
+  }
+  const existingByIdentity = identityRows[0] ? getAgent(identityRows[0].id, d) : null;
+  if (existingByIdentity && existingByName && existingByIdentity.id !== existingByName.id) {
+    throw new IdentityAliasAmbiguousError(normalizedName, [existingByIdentity.id, existingByName.id]);
+  }
+  if (identityId && existingByName && !existingByIdentity && existingByName.identity_id !== identityId) {
+    throw new IdentityAliasAmbiguousError(normalizedName, [existingByName.id]);
+  }
+  const existing = existingByIdentity || existingByName;
   if (existing) {
+    if (existing.identity_id && !identityId) {
+      return buildConflictError(existing, new Date(existing.last_seen_at).getTime(), input.pool, d);
+    }
+    if (identityId && existing.identity_id && identityId !== existing.identity_id) {
+      throw new IdentityIdImmutableError(existing.id);
+    }
     const lastSeenMs = new Date(existing.last_seen_at).getTime();
     const activeWindowMs = getActiveWindowMs();
     const isActive = Date.now() - lastSeenMs < activeWindowMs;
@@ -11190,6 +12407,14 @@ function registerAgent(input, db) {
       updates.push("active_project_id = ?");
       params.push(input.project_id);
     }
+    if (input.project_id) {
+      updates.push("project_id = ?");
+      params.push(input.project_id);
+    }
+    if (input.runtime_instance_id) {
+      updates.push("runtime_instance_id = ?");
+      params.push(input.runtime_instance_id);
+    }
     if (!existing.machine_id && machineId) {
       updates.push("machine_id = ?");
       params.push(machineId);
@@ -11199,11 +12424,12 @@ function registerAgent(input, db) {
     return getAgent(existing.id, d);
   }
   const id = shortUuid();
-  const timestamp = now();
-  d.run(`INSERT INTO agents (id, name, description, role, title, level, permissions, capabilities, reports_to, org_id, metadata, created_at, last_seen_at, session_id, working_dir, active_project_id, machine_id)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+  const timestamp2 = now();
+  d.run(`INSERT INTO agents (id, name, identity_id, description, role, title, level, permissions, capabilities, reports_to, org_id, metadata, created_at, last_seen_at, session_id, working_dir, project_id, runtime_instance_id, active_project_id, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
     normalizedName,
+    identityId,
     input.description || null,
     input.role || "agent",
     input.title || null,
@@ -11213,10 +12439,12 @@ function registerAgent(input, db) {
     input.reports_to || null,
     input.org_id || null,
     JSON.stringify(input.metadata || {}),
-    timestamp,
-    timestamp,
+    timestamp2,
+    timestamp2,
     input.session_id || null,
     input.working_dir || null,
+    input.project_id || null,
+    input.runtime_instance_id || null,
     input.project_id && input.session_id ? input.project_id : null,
     machineId
   ]);
@@ -11256,12 +12484,15 @@ function getAgent(id, db) {
   const row = d.query("SELECT * FROM agents WHERE id = ?").get(id);
   return row ? rowToAgent(row) : null;
 }
-function getAgentByName(name, db) {
-  const d = db || getDatabase();
+function getAgentByNameProjection(name, d) {
   const normalizedName = name.trim().toLowerCase();
   const row = d.query("SELECT * FROM agents WHERE LOWER(name) = ?").get(normalizedName);
   return row ? rowToAgent(row) : null;
 }
+function getAgentByName(name, db) {
+  const agent = getAgentByNameProjection(name, db || getDatabase());
+  return agent ? { ...agent, identity_id: null } : null;
+}
 function listAgents(opts, db) {
   let d;
   let includeArchived = false;
@@ -11271,7 +12502,6 @@ function listAgents(opts, db) {
     includeArchived = opts?.include_archived ?? false;
     d = db || getDatabase();
   }
-  autoReleaseStaleAgents(d);
   if (includeArchived) {
     return d.query("SELECT * FROM agents ORDER BY name").all().map(rowToAgent);
   }
@@ -11288,21 +12518,19 @@ function updateAgent(id, input, db) {
     throw new Error(`Agent not found: ${id}`);
   const sets = ["last_seen_at = ?"];
   const params = [now()];
+  let historicalLabel = null;
   if (input.name !== undefined) {
     const existingNames = d.query("SELECT name FROM agents WHERE id != ?").all(id).map((row) => row.name);
     const newName = validateAgentName(input.name, existingNames);
-    const holder = getAgentByName(newName, d);
-    if (holder && holder.id !== id) {
-      const lastSeenMs = new Date(holder.last_seen_at).getTime();
-      const isActive = Date.now() - lastSeenMs < getActiveWindowMs();
-      if (isActive && holder.status === "active") {
-        throw new Error(`Cannot rename: name "${newName}" is held by active agent ${holder.id} (last seen ${Math.round((Date.now() - lastSeenMs) / 60000)}m ago)`);
+    if (newName !== agent.name) {
+      const holder = getAgentByName(newName, d);
+      if (holder && holder.id !== id) {
+        throw new IdentityAliasAmbiguousError(newName, [holder.id, id]);
       }
-      const evictedName = `${holder.name}__evicted_${holder.id}`;
-      d.run("UPDATE agents SET name = ? WHERE id = ?", [evictedName, holder.id]);
+      historicalLabel = agent.name;
+      sets.push("name = ?");
+      params.push(newName);
     }
-    sets.push("name = ?");
-    params.push(newName);
   }
   if (input.description !== undefined) {
     sets.push("description = ?");
@@ -11341,7 +12569,12 @@ function updateAgent(id, input, db) {
     params.push(JSON.stringify(input.metadata));
   }
   params.push(id);
-  d.run(`UPDATE agents SET ${sets.join(", ")} WHERE id = ?`, params);
+  const apply = d.transaction(() => {
+    if (historicalLabel)
+      recordAgentAlias(id, historicalLabel, d);
+    d.run(`UPDATE agents SET ${sets.join(", ")} WHERE id = ?`, params);
+  });
+  apply.immediate();
   return getAgent(id, d);
 }
 function deleteAgent(id, db) {
@@ -11499,6 +12732,21 @@ var TEMPLATE_COLUMNS = [
   "machine_id",
   "synced_at"
 ];
+var TEMPLATE_TASK_COLUMNS = [
+  "id",
+  "template_id",
+  "position",
+  "title_pattern",
+  "description",
+  "priority",
+  "tags",
+  "task_type",
+  "condition",
+  "include_template_id",
+  "depends_on_positions",
+  "metadata",
+  "created_at"
+];
 var TASK_COLUMNS = [
   "id",
   "short_id",
@@ -11567,7 +12815,7 @@ var AUDIT_COLUMNS = [
   "created_at",
   "machine_id"
 ];
-var JSON_COLUMNS = new Set(["tags", "metadata", "permissions", "capabilities", "variables"]);
+var JSON_COLUMNS = new Set(["tags", "metadata", "permissions", "capabilities", "variables", "depends_on_positions"]);
 var BOOLEAN_COLUMNS = new Set(["requires_approval"]);
 function exportSqliteTodosStorageSnapshot(db) {
   const d = db ?? getDatabase();
@@ -11581,6 +12829,7 @@ function exportSqliteTodosStorageSnapshot(db) {
     agents: listAgents({ include_archived: true }, d),
     taskLists: listTaskLists(undefined, d),
     templates: listTemplates(d),
+    templateTasks: listTemplates(d).flatMap((template) => getTemplateTasks(template.id, d)),
     auditHistory: getRecentActivity(Number.MAX_SAFE_INTEGER, d),
     tombstones: listStorageTombstones(d)
   };
@@ -11630,6 +12879,7 @@ function importSqliteTodosStorageSnapshot(snapshot, db) {
   applyRows("task_lists", "task_lists", TASK_LIST_COLUMNS, snapshot.taskLists, "updated_at");
   applyRows("plans", "plans", PLAN_COLUMNS, snapshot.plans, "updated_at");
   applyRows("templates", "task_templates", TEMPLATE_COLUMNS, snapshot.templates);
+  applyRows("template_tasks", "template_tasks", TEMPLATE_TASK_COLUMNS, snapshot.templateTasks ?? []);
   applyRows("tasks", "tasks", TASK_COLUMNS, sortedTasks(snapshot.tasks), "updated_at", (row, changed) => {
     if (changed && Array.isArray(row["tags"]) && typeof row["id"] === "string") {
       replaceTaskTags(row["id"], row["tags"].filter((tag) => typeof tag === "string"), d);
@@ -11734,6 +12984,8 @@ function tableForTombstone(objectType) {
     return "task_lists";
   if (objectType === "templates")
     return "task_templates";
+  if (objectType === "template_tasks")
+    return "template_tasks";
   return "task_history";
 }
 function listRows(db, table, columns) {
@@ -11793,6 +13045,52 @@ function resolveTaskRefLocal(db, ref) {
     return getTask(shortIdRows[0].id, db);
   return null;
 }
+function isSearchQuery(filter) {
+  const q = filter.query?.trim();
+  return !!q && q !== "*";
+}
+function matchesExtraFilters(task, filter) {
+  if (filter.ids && !filter.ids.includes(task.id))
+    return false;
+  if (filter.parent_id !== undefined && (task.parent_id ?? null) !== filter.parent_id)
+    return false;
+  if (filter.plan_id !== undefined && task.plan_id !== filter.plan_id)
+    return false;
+  if (filter.session_id !== undefined && task.session_id !== filter.session_id)
+    return false;
+  if (filter.has_recurrence !== undefined && Boolean(task.recurrence_rule) !== filter.has_recurrence)
+    return false;
+  if (filter.task_type !== undefined) {
+    const allowed = Array.isArray(filter.task_type) ? filter.task_type : [filter.task_type];
+    if (!allowed.includes(task.task_type ?? ""))
+      return false;
+  }
+  if (filter.tags?.length) {
+    const taskTags = new Set(task.tags ?? []);
+    if (!filter.tags.every((tag) => taskTags.has(tag)))
+      return false;
+  }
+  if (filter.include_subtasks !== true && filter.parent_id === undefined && task.parent_id)
+    return false;
+  return true;
+}
+function listTasksMaybeSearch(filter, db) {
+  if (!isSearchQuery(filter))
+    return listTasks(filter, db);
+  const matched = searchTasks({
+    query: filter.query,
+    project_id: filter.project_id,
+    task_list_id: filter.task_list_id,
+    status: filter.status,
+    priority: filter.priority,
+    assigned_to: filter.assigned_to,
+    agent_id: filter.agent_id
+  }, undefined, undefined, db).filter((task) => matchesExtraFilters(task, filter));
+  const offset = filter.offset && filter.offset > 0 ? Math.trunc(filter.offset) : 0;
+  if (filter.limit !== undefined && filter.limit >= 0)
+    return matched.slice(offset, offset + filter.limit);
+  return offset ? matched.slice(offset) : matched;
+}
 function createLocalSqliteTodosStorageAdapter(options = {}) {
   const database = () => options.db ?? getDatabase();
   let adapter;
@@ -11809,8 +13107,8 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       create: (input) => createTask(input, database()),
       get: (id) => getTask(id, database()),
       resolveRef: (ref) => resolveTaskRefLocal(database(), ref),
-      list: (filter = {}) => listTasks(filter, database()),
-      count: (filter = {}) => countTasks(filter, database()),
+      list: (filter = {}) => listTasksMaybeSearch(filter, database()),
+      count: (filter = {}) => isSearchQuery(filter) ? listTasksMaybeSearch({ ...filter, limit: undefined, offset: undefined }, database()).length : countTasks(filter, database()),
       update: (id, input) => updateTask(id, input, database()),
       unlock: (id, agentId) => {
         unlockTask(id, agentId, database());
@@ -11920,6 +13218,27 @@ function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABL
     `CREATE INDEX IF NOT EXISTS ${tableName}_task_status_idx ON ${tableName} ((payload->>'status')) WHERE object_type = 'tasks' AND deleted_at IS NULL`,
     `CREATE INDEX IF NOT EXISTS ${tableName}_task_project_idx ON ${tableName} ((payload->>'project_id')) WHERE object_type = 'tasks' AND deleted_at IS NULL`,
     `CREATE INDEX IF NOT EXISTS ${tableName}_payload_gin ON ${tableName} USING gin (payload jsonb_path_ops)`,
+    `CREATE EXTENSION IF NOT EXISTS pg_trgm`,
+    `CREATE EXTENSION IF NOT EXISTS unaccent`,
+    `CREATE OR REPLACE FUNCTION todos_immutable_unaccent(text)
+      RETURNS text
+      LANGUAGE sql IMMUTABLE PARALLEL SAFE STRICT
+      AS $$ SELECT unaccent('unaccent', $1) $$`,
+    `ALTER TABLE ${tableName}
+      ADD COLUMN IF NOT EXISTS task_search_tsv tsvector
+      GENERATED ALWAYS AS (
+        setweight(to_tsvector('simple', todos_immutable_unaccent(COALESCE(payload->>'title', ''))), 'A')
+        || setweight(to_tsvector('simple', todos_immutable_unaccent(COALESCE(payload->>'description', ''))), 'B')
+        || setweight(to_tsvector('simple', todos_immutable_unaccent(translate(COALESCE(payload->>'tags', '[]'), '[]",', '    '))), 'C')
+      ) STORED`,
+    `CREATE INDEX IF NOT EXISTS ${tableName}_task_search_tsv_idx
+      ON ${tableName} USING gin (task_search_tsv)
+      WHERE object_type = 'tasks' AND deleted_at IS NULL`,
+    `CREATE INDEX IF NOT EXISTS ${tableName}_task_search_trgm_idx
+      ON ${tableName} USING gin (
+        todos_immutable_unaccent(COALESCE(payload->>'title', '') || ' ' || COALESCE(payload->>'description', '')) gin_trgm_ops
+      )
+      WHERE object_type = 'tasks' AND deleted_at IS NULL`,
     `CREATE TABLE IF NOT EXISTS ${cursorTableName} (
       service text NOT NULL,
       cursor_name text NOT NULL,
@@ -12152,6 +13471,7 @@ function snapshotEntries(snapshot) {
     ...snapshot.agents.map((payload) => entry("agents", payload, snapshot.exportedAt)),
     ...snapshot.taskLists.map((payload) => entry("task_lists", payload, snapshot.exportedAt)),
     ...snapshot.templates.map((payload) => entry("templates", payload, snapshot.exportedAt)),
+    ...(snapshot.templateTasks ?? []).map((payload) => entry("template_tasks", payload, snapshot.exportedAt)),
     ...snapshot.auditHistory.map((payload) => entry("audit_history", payload, snapshot.exportedAt)),
     ...(snapshot.tombstones ?? []).map((tombstone) => ({
       type: tombstone.object_type,
@@ -12203,6 +13523,7 @@ function rowsToSnapshot(rows) {
     agents: [],
     taskLists: [],
     templates: [],
+    templateTasks: [],
     auditHistory: [],
     tombstones: []
   };
@@ -12237,6 +13558,8 @@ function rowsToSnapshot(rows) {
       snapshot.taskLists.push(payload);
     else if (row.object_type === "templates")
       snapshot.templates.push(payload);
+    else if (row.object_type === "template_tasks")
+      snapshot.templateTasks.push(payload);
     else if (row.object_type === "audit_history")
       snapshot.auditHistory.push(payload);
   }
@@ -12399,10 +13722,13 @@ function createPostgresTodosStorageAdapter(options) {
       get: (id) => store.get("templates", id),
       list: async () => (await store.list("templates")).sort((a, b) => a.name.localeCompare(b.name)),
       update: (id, input) => updateTemplate2(id, input, store),
-      delete: (id, context) => store.delete("templates", id, context),
+      delete: (id, context) => deleteTemplate2(id, store, context),
       getWithTasks: async (id) => {
         const template = await store.get("templates", id);
-        return template ? { ...template, tasks: [] } : null;
+        if (!template)
+          return null;
+        const tasks = (await store.list("template_tasks")).filter((task) => task.template_id === id).sort((left, right) => left.position - right.position || left.id.localeCompare(right.id));
+        return { ...template, tasks };
       }
     },
     audit: {
@@ -12550,12 +13876,23 @@ class PostgresJsonRecordStore {
     }
     if (filter.include_subtasks !== true)
       conds.push(`(payload->>'parent_id' IS NULL OR payload->>'parent_id' = '')`);
-    return { where: conds.join(" AND "), params };
+    let queryRef;
+    const rawQuery = filter.query?.trim() ?? "";
+    if (rawQuery && rawQuery !== "*") {
+      queryRef = p(rawQuery);
+      const clauses = [`task_search_tsv @@ websearch_to_tsquery('simple', todos_immutable_unaccent(${queryRef}))`];
+      if (!/\s/.test(rawQuery)) {
+        clauses.push(`todos_immutable_unaccent(${queryRef}) <% todos_immutable_unaccent(` + `COALESCE(payload->>'title', '') || ' ' || COALESCE(payload->>'description', ''))`);
+      }
+      conds.push(`(${clauses.join(" OR ")})`);
+    }
+    return { where: conds.join(" AND "), params, queryRef };
   }
   async listTasks(filter) {
     await this.ensureSchema();
-    const { where, params } = this.buildTaskFilterSql(filter);
-    let sql = `/* todos:list-tasks */ SELECT payload FROM ${this.tableName} WHERE ${where} ${TASK_ORDER_BY}`;
+    const { where, params, queryRef } = this.buildTaskFilterSql(filter);
+    const orderBy = queryRef ? `ORDER BY ts_rank_cd(task_search_tsv, websearch_to_tsquery('simple', todos_immutable_unaccent(${queryRef}))) DESC, ${TASK_ORDER_TIEBREAK}` : TASK_ORDER_BY;
+    let sql = `/* todos:list-tasks */ SELECT payload FROM ${this.tableName} WHERE ${where} ${orderBy}`;
     if (filter.limit !== undefined) {
       params.push(filter.limit);
       sql += ` LIMIT $${params.length}`;
@@ -12690,6 +14027,57 @@ class PostgresJsonRecordStore {
     }
     return value;
   }
+  async createTemplateWithTasks(template, tasks, context = {}) {
+    await this.ensureSchema();
+    const records = [
+      { object_type: "templates", object_id: template.id, payload: template, updated_at: template.created_at, version: template.version },
+      ...tasks.map((task) => ({ object_type: "template_tasks", object_id: task.id, payload: task, updated_at: task.created_at, version: 1 }))
+    ];
+    const result = await this.options.client.query(`/* todos:create-template-with-tasks-atomic */ WITH input AS (
+         SELECT value->>'object_type' AS object_type,
+           value->>'object_id' AS object_id,
+           value->'payload' AS payload,
+           value->>'updated_at' AS updated_at,
+           COALESCE((value->>'version')::integer, 1) AS version
+         FROM jsonb_array_elements($2::jsonb) AS value
+       ) INSERT INTO ${this.tableName} (
+         service, object_type, object_id, payload, updated_at,
+         deleted_at, source_machine_id, version
+       ) SELECT $1, object_type, object_id, payload, updated_at::timestamptz,
+         NULL, $3, version
+       FROM input
+       ON CONFLICT (service, object_type, object_id) DO UPDATE SET
+         payload = EXCLUDED.payload,
+         updated_at = EXCLUDED.updated_at,
+         deleted_at = NULL,
+         source_machine_id = EXCLUDED.source_machine_id,
+         version = EXCLUDED.version
+       WHERE ${this.tableName}.updated_at IS NULL
+          OR ${this.tableName}.updated_at < EXCLUDED.updated_at
+          OR (${this.tableName}.updated_at = EXCLUDED.updated_at
+              AND COALESCE(${this.tableName}.version, 0) <= COALESCE(EXCLUDED.version, 0))
+       RETURNING object_type, object_id`, [this.service, jsonbParam(records), this.machineId(context)]);
+    if (result.rows.length !== records.length) {
+      throw new Error("Template checklist write was rejected before completion; no partial template was committed");
+    }
+  }
+  async deleteTemplateWithTasks(id, context = {}) {
+    await this.ensureSchema();
+    const timestamp2 = new Date().toISOString();
+    const result = await this.options.client.query(`/* todos:delete-template-with-tasks-atomic */ WITH target AS (
+         SELECT 1 FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'templates' AND object_id = $2 AND deleted_at IS NULL
+       ) UPDATE ${this.tableName} AS record SET
+         deleted_at = $3::timestamptz,
+         updated_at = $3::timestamptz,
+         source_machine_id = COALESCE($4, record.source_machine_id),
+         version = COALESCE(record.version, 0) + 1
+       WHERE record.service = $1 AND record.deleted_at IS NULL AND EXISTS (SELECT 1 FROM target)
+         AND (record.object_type = 'templates' AND record.object_id = $2
+           OR record.object_type = 'template_tasks' AND record.payload->>'template_id' = $2)
+       RETURNING record.object_type`, [this.service, id, timestamp2, this.machineId(context)]);
+    return result.rows.some((row) => row.object_type === "templates");
+  }
   async completeTask(id, agentId, options) {
     await this.ensureSchema();
     const operationTimestamp = new Date().toISOString();
@@ -12751,7 +14139,7 @@ class PostgresJsonRecordStore {
     const normalizedSlug = slugifyRaw(newSlug);
     if (!normalizedSlug)
       throw new Error("Invalid slug \u2014 must be non-empty kebab-case");
-    const timestamp = new Date().toISOString();
+    const timestamp2 = new Date().toISOString();
     try {
       const result = await this.options.client.query(`/* todos:rename-project-atomic */ WITH target AS (
           SELECT payload, payload->>'task_list_id' AS old_slug
@@ -12799,7 +14187,7 @@ class PostgresJsonRecordStore {
           EXISTS (SELECT 1 FROM project_conflict) AS project_conflict,
           EXISTS (SELECT 1 FROM task_list_conflict) AS task_list_conflict,
           COALESCE((SELECT payload FROM updated_project), (SELECT payload FROM target)) AS project,
-          (SELECT count(*) FROM updated_lists) AS task_lists_updated`, [this.service, id, normalizedSlug, name ?? null, timestamp, this.machineId(context)]);
+          (SELECT count(*) FROM updated_lists) AS task_lists_updated`, [this.service, id, normalizedSlug, name ?? null, timestamp2, this.machineId(context)]);
       const row = result.rows[0];
       if (!row?.found)
         throw new ProjectNotFoundError(id);
@@ -12852,19 +14240,19 @@ class PostgresJsonRecordStore {
     const existing = await this.get(type, id);
     if (!existing)
       return false;
-    const timestamp = new Date().toISOString();
+    const timestamp2 = new Date().toISOString();
     return this.tombstone({
       object_type: type,
       object_id: id,
-      deleted_at: timestamp,
-      updated_at: timestamp,
+      deleted_at: timestamp2,
+      updated_at: timestamp2,
       payload: existing,
       version: numberValue2(existing["version"])
     }, context);
   }
   async deletePlan(id, context = {}) {
     await this.ensureSchema();
-    const timestamp = new Date().toISOString();
+    const timestamp2 = new Date().toISOString();
     const result = await this.options.client.query(`/* todos:delete-plan-atomic */ WITH target AS (
         SELECT payload FROM ${this.tableName}
         WHERE service = $1 AND object_type = 'plans' AND object_id = $2 AND deleted_at IS NULL
@@ -12894,7 +14282,7 @@ class PostgresJsonRecordStore {
         RETURNING 1
       ) SELECT
         EXISTS (SELECT 1 FROM target) AS found,
-        (SELECT count(*) FROM updated_tasks) AS tasks_updated`, [this.service, id, timestamp, this.machineId(context)]);
+        (SELECT count(*) FROM updated_tasks) AS tasks_updated`, [this.service, id, timestamp2, this.machineId(context)]);
     return Boolean(result.rows[0]?.found);
   }
   async tombstone(tombstone, context = {}) {
@@ -12955,7 +14343,7 @@ class PostgresJsonRecordStore {
   }
 }
 async function createTask2(input, store, context) {
-  const timestamp = new Date().toISOString();
+  const timestamp2 = new Date().toISOString();
   const shortId = input.project_id ? await nextTaskShortId2(input.project_id, store, context) : null;
   const task = {
     id: randomUUID3(),
@@ -12977,8 +14365,8 @@ async function createTask2(input, store, context) {
     version: 1,
     locked_by: null,
     locked_at: null,
-    created_at: timestamp,
-    updated_at: timestamp,
+    created_at: timestamp2,
+    updated_at: timestamp2,
     started_at: null,
     completed_at: null,
     due_at: input.due_at ?? null,
@@ -13110,9 +14498,9 @@ async function lockTask2(id, agentId, store) {
   if (task.locked_by && task.locked_by !== agentId && !cloudLockExpired(task.locked_at)) {
     return { success: false, locked_by: task.locked_by, locked_at: task.locked_at ?? undefined, error: `Task is locked by ${task.locked_by}` };
   }
-  const timestamp = new Date().toISOString();
-  await patchTask(task, { locked_by: agentId, locked_at: timestamp }, store);
-  return { success: true, locked_by: agentId, locked_at: timestamp, expires_at: cloudLockExpiresAt(timestamp) };
+  const timestamp2 = new Date().toISOString();
+  await patchTask(task, { locked_by: agentId, locked_at: timestamp2 }, store);
+  return { success: true, locked_by: agentId, locked_at: timestamp2, expires_at: cloudLockExpiresAt(timestamp2) };
 }
 async function unlockTask2(id, agentId, store) {
   const task = await requireRecord("tasks", id, store);
@@ -13151,8 +14539,8 @@ async function addDependency2(taskId, dependsOn, store, context) {
     for (const next of adjacency.get(node) ?? [])
       queue.push(next);
   }
-  const timestamp = new Date().toISOString();
-  const record = { id: dependencyId(taskId, dependsOn), task_id: taskId, depends_on: dependsOn, created_at: timestamp, updated_at: timestamp };
+  const timestamp2 = new Date().toISOString();
+  const record = { id: dependencyId(taskId, dependsOn), task_id: taskId, depends_on: dependsOn, created_at: timestamp2, updated_at: timestamp2 };
   await store.upsert("dependencies", record, context);
   return { task_id: taskId, depends_on: dependsOn };
 }
@@ -13173,7 +14561,7 @@ async function listDependencies(taskId, store) {
 async function addVerification(input, store, context) {
   if (!await store.get("tasks", input.task_id))
     throw new Error(`Task not found: ${input.task_id}`);
-  const timestamp = new Date().toISOString();
+  const timestamp2 = new Date().toISOString();
   const verification = {
     id: randomUUID3(),
     task_id: input.task_id,
@@ -13182,10 +14570,10 @@ async function addVerification(input, store, context) {
     output_summary: input.output_summary ?? null,
     artifact_path: input.artifact_path ?? null,
     agent_id: input.agent_id ?? context?.agentId ?? null,
-    run_at: timestamp,
-    created_at: timestamp
+    run_at: timestamp2,
+    created_at: timestamp2
   };
-  await store.upsert("verifications", { ...verification, updated_at: timestamp }, context);
+  await store.upsert("verifications", { ...verification, updated_at: timestamp2 }, context);
   return verification;
 }
 async function listVerifications(taskId, store) {
@@ -13194,7 +14582,7 @@ async function listVerifications(taskId, store) {
 async function addCommit(input, store, context) {
   if (!await store.get("tasks", input.task_id))
     throw new Error(`Task not found: ${input.task_id}`);
-  const timestamp = new Date().toISOString();
+  const timestamp2 = new Date().toISOString();
   const commit = {
     id: randomUUID3(),
     task_id: input.task_id,
@@ -13202,9 +14590,9 @@ async function addCommit(input, store, context) {
     message: input.message ?? null,
     author: input.author ?? null,
     files_changed: input.files_changed ?? null,
-    created_at: timestamp
+    created_at: timestamp2
   };
-  await store.upsert("commits", { ...commit, updated_at: timestamp }, context);
+  await store.upsert("commits", { ...commit, updated_at: timestamp2 }, context);
   return commit;
 }
 async function listCommits(taskId, store) {
@@ -13217,7 +14605,7 @@ async function findCommit(sha, store) {
 async function addGitRef(input, store, context) {
   if (!await store.get("tasks", input.task_id))
     throw new Error(`Task not found: ${input.task_id}`);
-  const timestamp = new Date().toISOString();
+  const timestamp2 = new Date().toISOString();
   const gitRef = {
     id: randomUUID3(),
     task_id: input.task_id,
@@ -13226,8 +14614,8 @@ async function addGitRef(input, store, context) {
     url: input.url ?? null,
     provider: input.provider ?? null,
     metadata: input.metadata ?? {},
-    created_at: timestamp,
-    updated_at: timestamp
+    created_at: timestamp2,
+    updated_at: timestamp2
   };
   await store.upsert("refs", gitRef, context);
   return gitRef;
@@ -13238,7 +14626,8 @@ async function listGitRefs(taskId, store) {
 async function findGitRefs(ref, store) {
   return (await store.list("refs")).filter((r) => r.name === ref).sort((a, b) => b.created_at.localeCompare(a.created_at));
 }
-var TASK_ORDER_BY = "ORDER BY CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC";
+var TASK_ORDER_TIEBREAK = "CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC";
+var TASK_ORDER_BY = `ORDER BY ${TASK_ORDER_TIEBREAK}`;
 function toFilterArray(value) {
   return Array.isArray(value) ? value : [value];
 }
@@ -13284,7 +14673,7 @@ async function getChangedSince(since, filters, store) {
   return (await listTasks2(filters ?? {}, store)).filter((task) => task.updated_at > since);
 }
 async function createProject2(input, store, context) {
-  const timestamp = new Date().toISOString();
+  const timestamp2 = new Date().toISOString();
   const derivedSlug = slugifyRaw(input.name);
   const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : slugifyRaw(input.task_list_id);
   if (!derivedSlug || !taskListId)
@@ -13297,8 +14686,8 @@ async function createProject2(input, store, context) {
     task_list_id: taskListId,
     task_prefix: input.task_prefix ?? await generateProjectPrefix(input.name, store),
     task_counter: 0,
-    created_at: timestamp,
-    updated_at: timestamp,
+    created_at: timestamp2,
+    updated_at: timestamp2,
     machine_id: store.machineId(context),
     synced_at: null
   };
@@ -13313,7 +14702,7 @@ async function updateProject2(id, input, store) {
   return store.upsert("projects", updated);
 }
 async function createPlan2(input, store, context) {
-  const timestamp = new Date().toISOString();
+  const timestamp2 = new Date().toISOString();
   const projectId = input.project_id ?? context?.projectId ?? null;
   const slug = await resolvePostgresPlanSlug({
     name: input.name,
@@ -13330,8 +14719,8 @@ async function createPlan2(input, store, context) {
     name: input.name,
     description: input.description ?? null,
     status: input.status ?? "active",
-    created_at: timestamp,
-    updated_at: timestamp,
+    created_at: timestamp2,
+    updated_at: timestamp2,
     machine_id: store.machineId(context),
     synced_at: null
   }, context);
@@ -13355,7 +14744,7 @@ async function registerAgent2(input, store, context) {
   if (existing && !input.force && existing.session_id && existing.session_id !== input.session_id) {
     return { conflict: true, message: `Agent name '${input.name}' is already active` };
   }
-  const timestamp = new Date().toISOString();
+  const timestamp2 = new Date().toISOString();
   const agent = {
     id: existing?.id ?? randomUUID3().slice(0, 8),
     name: input.name,
@@ -13369,8 +14758,8 @@ async function registerAgent2(input, store, context) {
     capabilities: input.capabilities ?? existing?.capabilities ?? [],
     status: "active",
     metadata: input.metadata ?? existing?.metadata ?? {},
-    created_at: existing?.created_at ?? timestamp,
-    last_seen_at: timestamp,
+    created_at: existing?.created_at ?? timestamp2,
+    last_seen_at: timestamp2,
     session_id: input.session_id ?? context?.sessionId ?? existing?.session_id ?? null,
     working_dir: input.working_dir ?? existing?.working_dir ?? null,
     active_project_id: input.project_id ?? context?.projectId ?? existing?.active_project_id ?? null,
@@ -13415,7 +14804,7 @@ async function releaseAgent2(idOrName, sessionId, store, context) {
   return { agent: updated, released: true };
 }
 async function createTaskList2(input, store, context) {
-  const timestamp = new Date().toISOString();
+  const timestamp2 = new Date().toISOString();
   const slug = slugifyRaw(input.slug === undefined ? input.name : input.slug);
   if (!slug)
     throw new Error("Invalid task-list slug \u2014 must be non-empty kebab-case");
@@ -13426,8 +14815,8 @@ async function createTaskList2(input, store, context) {
     name: input.name,
     description: input.description ?? null,
     metadata: input.metadata ?? {},
-    created_at: timestamp,
-    updated_at: timestamp,
+    created_at: timestamp2,
+    updated_at: timestamp2,
     machine_id: store.machineId(context),
     synced_at: null
   }, context);
@@ -13453,8 +14842,8 @@ async function updateTaskList2(id, input, store) {
   });
 }
 async function createTemplate2(input, store, context) {
-  const timestamp = new Date().toISOString();
-  return store.upsert("templates", {
+  const timestamp2 = new Date().toISOString();
+  const template = {
     id: randomUUID3(),
     name: input.name,
     title_pattern: input.title_pattern,
@@ -13466,10 +14855,33 @@ async function createTemplate2(input, store, context) {
     project_id: input.project_id ?? context?.projectId ?? null,
     plan_id: input.plan_id ?? null,
     metadata: input.metadata ?? {},
-    created_at: timestamp,
+    created_at: timestamp2,
     machine_id: store.machineId(context),
     synced_at: null
-  }, context);
+  };
+  const tasks = buildTemplateTasks(template.id, input.tasks ?? [], timestamp2);
+  await store.createTemplateWithTasks(template, tasks, context);
+  return template;
+}
+function buildTemplateTasks(templateId, inputs, timestamp2) {
+  return inputs.map((input, position) => ({
+    id: randomUUID3(),
+    template_id: templateId,
+    position,
+    title_pattern: input.title_pattern,
+    description: input.description ?? null,
+    priority: input.priority ?? "medium",
+    tags: input.tags ?? [],
+    task_type: input.task_type ?? null,
+    condition: input.condition ?? null,
+    include_template_id: input.include_template_id ?? null,
+    depends_on_positions: input.depends_on ?? [],
+    metadata: input.metadata ?? {},
+    created_at: timestamp2
+  }));
+}
+async function deleteTemplate2(id, store, context) {
+  return store.deleteTemplateWithTasks(id, context);
 }
 async function updateTemplate2(id, input, store) {
   const template = await store.get("templates", id);
@@ -13525,6 +14937,7 @@ async function exportSnapshot(store) {
     agents: await store.list("agents"),
     taskLists: await store.list("task_lists"),
     templates: await store.list("templates"),
+    templateTasks: await store.list("template_tasks"),
     auditHistory: await store.list("audit_history"),
     tombstones: await store.listTombstones()
   };
@@ -13549,6 +14962,7 @@ async function importSnapshot(snapshot, store, context) {
     ...snapshot.agents.map((row) => ["agents", row]),
     ...snapshot.taskLists.map((row) => ["task_lists", row]),
     ...snapshot.templates.map((row) => ["templates", row]),
+    ...(snapshot.templateTasks ?? []).map((row) => ["template_tasks", row]),
     ...snapshot.auditHistory.map((row) => ["audit_history", row])
   ];
   for (const [type, row] of entries) {
@@ -13694,6 +15108,7 @@ var SNAPSHOT_TO_OBJECT_TYPE = {
   agents: "agents",
   taskLists: "task_lists",
   templates: "templates",
+  templateTasks: "template_tasks",
   auditHistory: "audit_history"
 };
 
@@ -13885,6 +15300,7 @@ function emptySnapshot() {
     agents: [],
     taskLists: [],
     templates: [],
+    templateTasks: [],
     auditHistory: [],
     tombstones: []
   };
@@ -14088,10 +15504,23 @@ function createTodosCloudQueryClient(url, options = {}) {
     idleTimeout: options.idleTimeout ?? 20,
     connectionTimeout: options.connectionTimeout ?? 15
   });
-  return {
-    async query(text, values = []) {
-      const result = await sql.unsafe(text, values.length ? [...values] : []);
-      return { rows: toRows(result) };
+  const queryWith = async (handle, text, values = []) => {
+    const result = await handle.unsafe(text, values.length ? [...values] : []);
+    return { rows: toRows(result) };
+  };
+  const client = {
+    query(text, values = []) {
+      return queryWith(sql, text, values);
+    },
+    async transaction(fn) {
+      if (typeof sql.begin !== "function") {
+        throw new Error("PR_GROUP_ATOMICITY_UNAVAILABLE: Bun.SQL transaction support is required");
+      }
+      return sql.begin(async (handle) => fn({
+        query(text, values = []) {
+          return queryWith(handle, text, values);
+        }
+      }));
     },
     async close() {
       if (typeof sql.end === "function")
@@ -14100,6 +15529,7 @@ function createTodosCloudQueryClient(url, options = {}) {
         await sql.close();
     }
   };
+  return client;
 }
 function createTodosCloudQueryClientFromEnv(env = process.env, options = {}) {
   const url = getTodosStorageDatabaseUrl(env);
@@ -14341,6 +15771,9 @@ class TodosShadowOutbox {
       case "templates":
         snapshot.templates.push(record);
         break;
+      case "template_tasks":
+        snapshot.templateTasks.push(record);
+        break;
       case "audit_history":
         snapshot.auditHistory.push(record);
         break;
@@ -14407,6 +15840,7 @@ function emptySnapshot2() {
     agents: [],
     taskLists: [],
     templates: [],
+    templateTasks: [],
     auditHistory: [],
     tombstones: []
   };
@@ -15065,7 +16499,7 @@ export {
   PostgresScopedSlugMigrationConflictError,
   PostgresScopedSlugIndexBuildError,
   COMMENT_REDACTION_BACKFILL_CONFIRMATION,
-  CANONICAL_TODOS_RDS_RUNTIME_PATH,
+  CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV,
   CANONICAL_TODOS_RDS_DATABASE,
-  CANONICAL_TODOS_RDS_CLUSTER
+  CANONICAL_TODOS_RDS_CLUSTER_ENV
 };