@kitman-sh/sdk 0.8.0 → 0.10.52

package/dist/{chunk-36jhc745.js → chunk-tcbgb4wm.js}

@@ -1,5 +1,5 @@
 // @bun
-// packages/core/src/package-declarations.ts
+// packages/core/src/kit-declarations.ts
 import * as Schema14 from "effect/Schema";
 
 // packages/core/src/agent-sandbox-policy.ts
@@ -21,13 +21,58 @@ var AgentSandboxPolicy = Schema.Struct({
 // packages/core/src/loop-version.ts
 import * as Schema4 from "effect/Schema";
 
+// packages/core/src/runtime-type.ts
+import * as Predicate from "effect/Predicate";
+var UnsafeJsonObjectKeys = new Set(["__proto__", "constructor", "prototype"]);
+function isBigInt2(value) {
+  return Predicate.isBigInt(value);
+}
+function isBoolean2(value) {
+  return Predicate.isBoolean(value);
+}
+function isFunction2(value) {
+  return Predicate.isFunction(value);
+}
+function isNumber2(value) {
+  return Predicate.isNumber(value);
+}
+function isObject(value) {
+  return Predicate.isObjectOrArray(value);
+}
+function isString2(value) {
+  return Predicate.isString(value);
+}
+function isSymbol2(value) {
+  return Predicate.isSymbol(value);
+}
+function isUndefined2(value) {
+  return Predicate.isUndefined(value);
+}
+function kindOf(value) {
+  if (isString2(value))
+    return "string";
+  if (isNumber2(value))
+    return "number";
+  if (isBoolean2(value))
+    return "boolean";
+  if (isBigInt2(value))
+    return "bigint";
+  if (isSymbol2(value))
+    return "symbol";
+  if (isUndefined2(value))
+    return "undefined";
+  if (isFunction2(value))
+    return "function";
+  return "object";
+}
+
 // packages/core/src/common.ts
 import * as Schema3 from "effect/Schema";
 
 // packages/core/src/schema.ts
 import * as Exit from "effect/Exit";
 import * as JsonSchema from "effect/JsonSchema";
-import * as Predicate from "effect/Predicate";
+import * as Predicate2 from "effect/Predicate";
 import * as Schema2 from "effect/Schema";
 var Days = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
 var DatePattern = /^(\d\d\d\d)-(\d\d)-(\d\d)$/;
@@ -82,7 +127,7 @@ var guards = new WeakMap;
 function hasUndefinedProperty(value) {
   if (Array.isArray(value))
     return value.some(hasUndefinedProperty);
-  if (!Predicate.isObject(value))
+  if (!Predicate2.isObject(value))
     return false;
   return Object.values(value).some((entry) => entry === undefined || hasUndefinedProperty(entry));
 }
@@ -90,7 +135,7 @@ function withoutUndefined(value) {
   if (Array.isArray(value)) {
     return value.map(withoutUndefined);
   }
-  if (!Predicate.isObject(value) || Object.getPrototypeOf(value) !== Object.prototype)
+  if (!Predicate2.isObject(value) || Object.getPrototypeOf(value) !== Object.prototype)
     return value;
   return Object.fromEntries(Object.entries(value).flatMap(([key, entry]) => entry === undefined ? [] : [[key, withoutUndefined(entry)]]));
 }
@@ -134,962 +179,183 @@ var LoopReferenceSchema = Schema4.Union([
     digest: Schema4.String.check(Schema4.isMinLength(64), Schema4.isMaxLength(64), Schema4.isPattern(new RegExp("^[a-f0-9]{64}$", "u")))
   })
 ]);
+function canonicalJson(value) {
+  return canonicalJsonValue(value);
+}
+function canonicalJsonValue(value, propertyName) {
+  if (value === null)
+    return "null";
+  if (isString2(value))
+    return JSON.stringify(propertyName !== undefined && /(?:digest|sha256)$/i.test(propertyName) ? value.toLowerCase() : value);
+  if (isBoolean2(value))
+    return value ? "true" : "false";
+  if (isNumber2(value)) {
+    if (!Number.isFinite(value))
+      throw new TypeError("Canonical JSON cannot contain non-finite numbers");
+    return JSON.stringify(value);
+  }
+  if (isUndefined2(value))
+    throw new TypeError("Canonical JSON cannot contain undefined values");
+  if (isBigInt2(value) || isFunction2(value) || isSymbol2(value))
+    throw new TypeError(`Canonical JSON cannot contain ${kindOf(value)}`);
+  if (Array.isArray(value))
+    return `[${value.map((item) => canonicalJsonValue(item)).join(",")}]`;
+  if (isObject(value))
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonValue(Object.getOwnPropertyDescriptor(value, key)?.value, key)}`).join(",")}}`;
+  throw new TypeError("Canonical JSON value is not supported");
+}
 
-// packages/core/src/agent-environment.ts
+// packages/core/src/kit.ts
 import * as Schema5 from "effect/Schema";
-var AgentEnvironmentPolicy = Schema5.Union([Schema5.Literal("recommended"), Schema5.Literal("required")]);
-var AgentHarnessId = Schema5.Union([
-  Schema5.Literal("opencode"),
-  Schema5.Literal("claude-code"),
-  Schema5.Literal("codex"),
-  Schema5.Literal("pi")
-]);
-var Sha256 = Schema5.String.check(Schema5.isPattern(new RegExp("^[a-fA-F0-9]{64}$", "u")));
-var relativePathPattern = "^(?!/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.\\.?($|/)).+$";
-var skillNamePattern = "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$";
-var SourcePath = Schema5.String.check(Schema5.isMinLength(1), Schema5.isPattern(new RegExp(relativePathPattern, "u")));
-var SkillSource = Schema5.Union([
-  Schema5.Struct({
-    kind: Schema5.Literal("skills_sh"),
-    slug: Schema5.String.check(Schema5.isMinLength(1)),
-    version: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
-  }),
-  Schema5.Struct({
-    kind: Schema5.Literal("kitman"),
-    skillId: Schema5.optionalKey(Id),
-    name: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1))),
-    contentMarkdown: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1))),
-    files: Schema5.optionalKey(Schema5.Record(SourcePath, Schema5.String))
-  }),
-  Schema5.Struct({
-    kind: Schema5.Literal("git"),
-    url: Schema5.String.check(Schema5.isMinLength(1)),
-    ref: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1))),
-    path: Schema5.optionalKey(SourcePath),
-    sha256: Schema5.optionalKey(Sha256)
-  }),
-  Schema5.Struct({
-    kind: Schema5.Literal("package"),
-    packageName: Schema5.String.check(Schema5.isMinLength(1)),
-    version: Schema5.String.check(Schema5.isMinLength(1)),
-    path: Schema5.optionalKey(SourcePath),
-    sha256: Schema5.optionalKey(Sha256)
-  }),
-  Schema5.Struct({ kind: Schema5.Literal("url"), url: Schema5.String.check(Schema5.isMinLength(1)), sha256: Sha256 }),
-  Schema5.Struct({ kind: Schema5.Literal("local_path"), path: Schema5.String.check(Schema5.isMinLength(1)) })
-]);
-var PluginSource = Schema5.Union([
-  Schema5.Struct({
-    kind: Schema5.Literal("package"),
-    packageName: Schema5.String.check(Schema5.isMinLength(1)),
-    version: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
-  }),
-  Schema5.Struct({
-    kind: Schema5.Literal("git"),
-    url: Schema5.String.check(Schema5.isMinLength(1)),
-    ref: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
-  }),
-  Schema5.Struct({
-    kind: Schema5.Literal("url"),
-    url: Schema5.String.check(Schema5.isMinLength(1)),
-    sha256: Schema5.String.check(Schema5.isPattern(new RegExp("^[a-fA-F0-9]{64}$", "u")))
-  }),
-  Schema5.Struct({ kind: Schema5.Literal("local_path"), path: Schema5.String.check(Schema5.isMinLength(1)) })
-]);
-var McpServerTransport = Schema5.Union([
-  Schema5.Struct({
-    kind: Schema5.Literal("stdio"),
-    command: Schema5.String.check(Schema5.isMinLength(1)),
-    args: Schema5.optionalKey(Schema5.Array(Schema5.String)),
-    env: Schema5.optionalKey(Schema5.Record(Schema5.String, Schema5.String))
-  }),
-  Schema5.Struct({
-    kind: Schema5.Literal("streamable_http"),
-    url: Schema5.String.check(Schema5.isMinLength(1)),
-    headers: Schema5.optionalKey(Schema5.Record(Schema5.String, Schema5.String))
-  })
-]);
-var ProviderAuthRef = Schema5.Union([
-  Schema5.Struct({
-    provider: Schema5.String.check(Schema5.isMinLength(1)),
-    policy: AgentEnvironmentPolicy,
-    kind: Schema5.Literal("existing_harness_login"),
-    accountHint: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
-  }),
-  Schema5.Struct({
-    provider: Schema5.String.check(Schema5.isMinLength(1)),
-    policy: AgentEnvironmentPolicy,
-    kind: Schema5.Literal("local_env"),
-    envName: Schema5.String.check(Schema5.isMinLength(1))
-  }),
-  Schema5.Struct({
-    provider: Schema5.String.check(Schema5.isMinLength(1)),
-    policy: AgentEnvironmentPolicy,
-    kind: Schema5.Literal("runner_secret"),
-    runnerSecretName: Schema5.String.check(Schema5.isMinLength(1))
-  }),
-  Schema5.Struct({
-    provider: Schema5.String.check(Schema5.isMinLength(1)),
-    policy: AgentEnvironmentPolicy,
-    kind: Schema5.Literal("managed_oauth"),
-    grantId: Schema5.optionalKey(Id)
-  })
-]);
-var RunnerSecretSource = Schema5.Union([
-  Schema5.Struct({ kind: Schema5.Literal("env"), envName: Schema5.String.check(Schema5.isMinLength(1)) }),
-  Schema5.Struct({ kind: Schema5.Literal("file"), pathRef: Schema5.String.check(Schema5.isMinLength(1)) }),
-  Schema5.Struct({ kind: Schema5.Literal("exec"), commandRef: Schema5.String.check(Schema5.isMinLength(1)) })
-]);
-var RunnerSecretRef = Schema5.Struct({
-  name: Schema5.String.check(Schema5.isMinLength(1)),
-  policy: AgentEnvironmentPolicy,
-  source: RunnerSecretSource,
-  capabilities: Schema5.optionalKey(Schema5.Array(Schema5.String.check(Schema5.isMinLength(1))))
-});
-var AgentSkillRequirement = Schema5.Struct({
-  name: Schema5.String.check(Schema5.isMinLength(1)),
-  policy: AgentEnvironmentPolicy,
-  source: SkillSource
-});
-var AgentPluginRequirement = Schema5.Struct({
-  name: Schema5.String.check(Schema5.isMinLength(1)),
-  policy: AgentEnvironmentPolicy,
-  sources: Schema5.NonEmptyArray(PluginSource)
-});
-var AgentMcpServerRequirement = Schema5.Struct({
-  name: Schema5.String.check(Schema5.isMinLength(1)),
-  policy: AgentEnvironmentPolicy,
-  transport: McpServerTransport
-});
-var AgentHarnessSetting = Schema5.Struct({
-  harness: AgentHarnessId,
-  key: Schema5.String.check(Schema5.isMinLength(1)),
-  policy: AgentEnvironmentPolicy,
-  value: Schema5.Unknown
-});
-var AgentRuntimeConstraint = Schema5.Struct({
-  key: Schema5.String.check(Schema5.isMinLength(1)),
-  policy: AgentEnvironmentPolicy,
-  value: Schema5.Unknown
-});
-var AgentPermissionRequirement = Schema5.Struct({
-  key: Schema5.String.check(Schema5.isMinLength(1)),
-  policy: AgentEnvironmentPolicy,
-  value: Schema5.Unknown
-});
-var AgentHookRequirement = Schema5.Struct({
-  name: Schema5.String.check(Schema5.isMinLength(1)),
-  event: Schema5.String.check(Schema5.isMinLength(1)),
-  policy: AgentEnvironmentPolicy,
-  command: Schema5.String.check(Schema5.isMinLength(1)),
-  args: Schema5.optionalKey(Schema5.Array(Schema5.String)),
-  timeoutMs: Schema5.optionalKey(Schema5.Finite.check(Schema5.isGreaterThanOrEqualTo(1)))
-});
-var AgentSandboxPolicyRequirement = Schema5.Struct({
-  key: Schema5.String.check(Schema5.isMinLength(1)),
-  policy: AgentEnvironmentPolicy,
-  value: Schema5.Unknown
-});
-var AgentEnvironmentFragment = Schema5.Struct({
-  skills: Schema5.optionalKey(Schema5.Array(AgentSkillRequirement)),
-  plugins: Schema5.optionalKey(Schema5.Array(AgentPluginRequirement)),
-  mcpServers: Schema5.optionalKey(Schema5.Array(AgentMcpServerRequirement)),
-  harnessSettings: Schema5.optionalKey(Schema5.Array(AgentHarnessSetting)),
-  providerAuthRefs: Schema5.optionalKey(Schema5.Array(ProviderAuthRef)),
-  runnerSecretRefs: Schema5.optionalKey(Schema5.Array(RunnerSecretRef)),
-  permissions: Schema5.optionalKey(Schema5.Array(AgentPermissionRequirement)),
-  hooks: Schema5.optionalKey(Schema5.Array(AgentHookRequirement)),
-  runtimeConstraints: Schema5.optionalKey(Schema5.Array(AgentRuntimeConstraint)),
-  sandboxPolicyRequirements: Schema5.optionalKey(Schema5.Array(AgentSandboxPolicyRequirement))
-});
-var HarnessKitActivation = Schema5.Struct({
-  harness: AgentHarnessId,
-  kitId: Id,
-  enabled: Schema5.Boolean,
-  policy: Schema5.optionalKey(AgentEnvironmentPolicy)
-});
-var AgentModelPreference = Schema5.Struct({
-  harness: AgentHarnessId,
-  profileRef: Schema5.String.check(Schema5.isMinLength(1)),
-  provider: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1))),
-  model: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
-});
-var UserAgentPreferences = Schema5.Struct({
-  userId: Schema5.optionalKey(Id),
-  defaultHarness: Schema5.optionalKey(AgentHarnessId),
-  perHarnessKitActivations: Schema5.optionalKey(Schema5.Array(HarnessKitActivation)),
-  modelPreferences: Schema5.optionalKey(Schema5.Array(AgentModelPreference)),
-  providerAuthRefs: Schema5.optionalKey(Schema5.Array(ProviderAuthRef)),
-  ui: Schema5.optionalKey(Schema5.Record(Schema5.String, Schema5.Unknown)),
-  agentEnvironment: Schema5.optionalKey(AgentEnvironmentFragment)
-});
-var AgentSyncProfileSource = Schema5.Union([
-  Schema5.Struct({
-    kind: Schema5.Literal("personal_kit_defaults"),
-    harness: Schema5.optionalKey(AgentHarnessId),
-    enabled: Schema5.Boolean
-  }),
-  Schema5.Struct({ kind: Schema5.Literal("workspace_assignments"), workspaceId: Id, enabled: Schema5.Boolean }),
-  Schema5.Struct({
-    kind: Schema5.Literal("team_defaults"),
-    workspaceId: Id,
-    teamId: Schema5.optionalKey(Id),
-    enabled: Schema5.Boolean
-  }),
-  Schema5.Struct({ kind: Schema5.Literal("team_kits"), teamId: Id, enabled: Schema5.Boolean })
-]);
-var AgentSyncProfile = Schema5.Struct({
-  id: Schema5.optionalKey(Id),
-  userId: Id,
-  name: Schema5.String.check(Schema5.isMinLength(1)),
-  default: Schema5.optionalKey(Schema5.Boolean),
-  harnesses: Schema5.optionalKey(Schema5.Array(AgentHarnessId)),
-  sources: Schema5.Array(AgentSyncProfileSource)
-});
-var AgentKitSourceFields = {
-  kitRef: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1), Schema5.isMaxLength(240))),
-  kitVersion: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1), Schema5.isMaxLength(120))),
-  kitSha256: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(64), Schema5.isMaxLength(64), Schema5.isPattern(new RegExp("^[a-fA-F0-9]{64}$", "u")))),
-  kitActivationId: Schema5.optionalKey(Id),
-  kitActivationType: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1), Schema5.isMaxLength(80)))
+var KitName = Schema5.String.check(Schema5.isMinLength(1), Schema5.isMaxLength(214), Schema5.isPattern(new RegExp("^(@[a-z0-9-~][a-z0-9-._~]*/)?[a-z0-9-~][a-z0-9-._~]*$", "u")));
+var KitDigest = Schema5.String.check(Schema5.isPattern(new RegExp("^[a-f0-9]{64}$", "u")));
+var KitLayer = Schema5.Union([Schema5.Literal("team"), Schema5.Literal("workspace"), Schema5.Literal("shipped")]);
+var KitProvenance = Schema5.Struct({
+  repository: Schema5.optionalKey(Schema5.String),
+  commit: Schema5.optionalKey(Schema5.String),
+  clean: Schema5.Boolean
+});
+var KitBundleUpload = Schema5.Struct({ bundle: Schema5.String.check(Schema5.isMinLength(1)) });
+var kitBuild = {
+  name: KitName,
+  teamId: Schema5.optionalKey(Id),
+  digest: KitDigest,
+  declarations: Schema5.Record(Schema5.String, Schema5.Unknown),
+  protocolVersion: Schema5.Int.check(Schema5.isGreaterThanOrEqualTo(1)),
+  provenance: KitProvenance
 };
-var AgentEnvironmentSource = Schema5.Union([
-  Schema5.Struct({
-    kind: Schema5.Literal("built_in"),
-    label: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
-  }),
-  Schema5.Struct({
-    kind: Schema5.Literal("user_preferences"),
-    userId: Id,
-    label: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
-  }),
+var KitPlanRequest = Schema5.Struct(kitBuild);
+var KitDeployRequest = Schema5.Struct({
+  ...kitBuild,
+  expectedVersion: Schema5.Union([Schema5.Int.check(Schema5.isGreaterThanOrEqualTo(1)), Schema5.Null])
+});
+var { name: _name, teamId: _teamId, ...devBuild } = kitBuild;
+var KitDevRequest = Schema5.Struct(devBuild);
+var KitDevVersion = Schema5.Struct({ id: Id, digest: KitDigest, loops: Schema5.Array(Schema5.String) });
+var KitChanges = Schema5.Struct({
+  created: Schema5.Array(Schema5.String),
+  changed: Schema5.Array(Schema5.String),
+  removed: Schema5.Array(Schema5.String)
+});
+var KitPlanConflict = Schema5.Union([
   Schema5.Struct({
-    kind: Schema5.Literal("user_kit"),
-    userId: Id,
-    kitId: Id,
-    ...AgentKitSourceFields,
-    label: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
+    kind: Schema5.Literal("id_taken"),
+    resource: Schema5.Union([Schema5.Literal("loop"), Schema5.Literal("agent")]),
+    id: Schema5.String,
+    kit: Schema5.String
   }),
+  Schema5.Struct({ kind: Schema5.Literal("not_for_team"), declaration: Schema5.String }),
   Schema5.Struct({
-    kind: Schema5.Literal("agent_sync_profile"),
-    profileId: Schema5.optionalKey(Id),
-    userId: Id,
-    label: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
+    kind: Schema5.Literal("schedule_team"),
+    key: Schema5.String,
+    problem: Schema5.Union([Schema5.Literal("missing"), Schema5.Literal("not_allowed"), Schema5.Literal("unknown")])
   }),
   Schema5.Struct({
-    kind: Schema5.Literal("device_local"),
-    label: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
-  }),
-  Schema5.Struct({
-    kind: Schema5.Literal("workspace_kit"),
-    kitId: Id,
-    ...AgentKitSourceFields,
-    label: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
-  }),
-  Schema5.Struct({
-    kind: Schema5.Literal("team_default_kit"),
-    teamId: Id,
-    kitId: Id,
-    ...AgentKitSourceFields,
-    label: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
-  }),
-  Schema5.Struct({
-    kind: Schema5.Literal("team_kit"),
-    kitId: Id,
-    ...AgentKitSourceFields,
-    provenance: Schema5.optionalKey(Schema5.Union([
-      Schema5.Literal("explicit"),
-      Schema5.Literal("workspace_default"),
-      Schema5.Literal("workspace_mandatory")
-    ])),
-    policyRevision: Schema5.optionalKey(Schema5.Int.check(Schema5.isGreaterThanOrEqualTo(1))),
-    label: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
-  }),
-  Schema5.Struct({
-    kind: Schema5.Literal("marketplace_kit"),
-    kitSourceId: Id,
-    kitVersionId: Schema5.optionalKey(Id),
-    kitInstallationId: Schema5.optionalKey(Id),
-    kitActivationId: Schema5.optionalKey(Id),
-    label: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
-  }),
-  Schema5.Struct({
-    kind: Schema5.Literal("step_attempt_override"),
-    stepAttemptId: Id,
-    label: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
-  }),
-  Schema5.Struct({
-    kind: Schema5.Literal("command_override"),
-    label: Schema5.optionalKey(Schema5.String.check(Schema5.isMinLength(1)))
+    kind: Schema5.Literal("loop_unresolved"),
+    record: Schema5.Literal("schedule"),
+    key: Schema5.String,
+    loop: Schema5.String
   })
 ]);
-var ResolvedAgentSkillRequirement = Schema5.Struct({
-  item: AgentSkillRequirement,
-  source: AgentEnvironmentSource
-});
-var ResolvedAgentPluginRequirement = Schema5.Struct({
-  item: AgentPluginRequirement,
-  source: AgentEnvironmentSource
-});
-var ResolvedAgentMcpServerRequirement = Schema5.Struct({
-  item: AgentMcpServerRequirement,
-  source: AgentEnvironmentSource
-});
-var ResolvedAgentHarnessSetting = Schema5.Struct({ item: AgentHarnessSetting, source: AgentEnvironmentSource });
-var ResolvedProviderAuthRef = Schema5.Struct({ item: ProviderAuthRef, source: AgentEnvironmentSource });
-var ResolvedRunnerSecretRef = Schema5.Struct({ item: RunnerSecretRef, source: AgentEnvironmentSource });
-var ResolvedAgentPermissionRequirement = Schema5.Struct({
-  item: AgentPermissionRequirement,
-  source: AgentEnvironmentSource
-});
-var ResolvedAgentHookRequirement = Schema5.Struct({ item: AgentHookRequirement, source: AgentEnvironmentSource });
-var ResolvedAgentRuntimeConstraint = Schema5.Struct({
-  item: AgentRuntimeConstraint,
-  source: AgentEnvironmentSource
-});
-var ResolvedAgentSandboxPolicyRequirement = Schema5.Struct({
-  item: AgentSandboxPolicyRequirement,
-  source: AgentEnvironmentSource
-});
-var AgentEnvironment = Schema5.Struct({
-  harness: AgentHarnessId,
-  skills: Schema5.Array(ResolvedAgentSkillRequirement),
-  plugins: Schema5.Array(ResolvedAgentPluginRequirement),
-  mcpServers: Schema5.Array(ResolvedAgentMcpServerRequirement),
-  harnessSettings: Schema5.Array(ResolvedAgentHarnessSetting),
-  providerAuthRefs: Schema5.Array(ResolvedProviderAuthRef),
-  runnerSecretRefs: Schema5.Array(ResolvedRunnerSecretRef),
-  permissions: Schema5.Array(ResolvedAgentPermissionRequirement),
-  hooks: Schema5.Array(ResolvedAgentHookRequirement),
-  runtimeConstraints: Schema5.Array(ResolvedAgentRuntimeConstraint),
-  sandboxPolicyRequirements: Schema5.Array(ResolvedAgentSandboxPolicyRequirement),
-  warnings: Schema5.Array(Schema5.String)
-});
-var KitMarketplaceAgentEnvironmentSyncStates = ["ready", "needs_sync", "blocked"];
-var KitMarketplaceAgentEnvironmentEffectKinds = [
-  "skill",
-  "plugin",
-  "mcp_server",
-  "harness_setting",
-  "provider_auth_ref",
-  "runner_secret_ref",
-  "permission",
-  "hook",
-  "runtime_constraint",
-  "sandbox_policy_requirement"
-];
-var KitMarketplaceAgentEnvironmentMaterializerRequirements = [
-  "config_writer",
-  "provider_auth",
-  "runner_secret",
-  "bun",
-  "sandbox_policy"
-];
-var KitMarketplaceAgentEnvironmentEffect = Schema5.Struct({
-  kind: Schema5.Literals(KitMarketplaceAgentEnvironmentEffectKinds),
-  name: Schema5.String.check(Schema5.isMinLength(1)),
-  policy: AgentEnvironmentPolicy,
-  source: AgentEnvironmentSource,
-  materializerRequirements: Schema5.Array(Schema5.Literals(KitMarketplaceAgentEnvironmentMaterializerRequirements))
-});
-var KitMarketplaceAgentEnvironmentSyncPreview = Schema5.Struct({
-  state: Schema5.Literals(KitMarketplaceAgentEnvironmentSyncStates),
-  agentEnvironment: AgentEnvironment,
-  effects: Schema5.Array(KitMarketplaceAgentEnvironmentEffect),
-  blockers: Schema5.Array(Schema5.String),
-  drift: Schema5.Array(Schema5.String)
-});
-var AgentEnvironmentSyncPlanStatuses = ["ready", "needs_apply", "blocked"];
-var AgentEnvironmentSyncPlanItemKinds = [
-  "skill",
-  "plugin",
-  "mcp_server",
-  "harness_setting",
-  "provider_auth_ref",
-  "runner_secret_ref",
-  "permission",
-  "hook",
-  "runtime_constraint",
-  "sandbox_policy_requirement"
-];
-var AgentEnvironmentSyncPlanApplyModes = ["automatic", "manual", "verify_only"];
-var AgentEnvironmentSyncPlanItem = Schema5.Struct({
-  kind: Schema5.Literals(AgentEnvironmentSyncPlanItemKinds),
-  name: Schema5.String.check(Schema5.isMinLength(1)),
-  policy: AgentEnvironmentPolicy,
-  source: AgentEnvironmentSource,
-  materializerRequirements: Schema5.Array(Schema5.Literals(KitMarketplaceAgentEnvironmentMaterializerRequirements)),
-  applyMode: Schema5.Literals(AgentEnvironmentSyncPlanApplyModes)
-});
-var AgentEnvironmentSyncPlan = Schema5.Struct({
-  status: Schema5.Literals(AgentEnvironmentSyncPlanStatuses),
-  targetHarness: AgentHarnessId,
-  agentEnvironment: AgentEnvironment,
-  items: Schema5.Array(AgentEnvironmentSyncPlanItem),
-  blockers: Schema5.Array(Schema5.String),
-  drift: Schema5.Array(Schema5.String)
-});
-
-// packages/core/src/kit.ts
-import * as Schema6 from "effect/Schema";
-import * as Struct6 from "effect/Struct";
-var KitKinds = ["technology", "brand", "domain", "process", "other"];
-var TeamKitProvenanceKinds = ["explicit", "workspace_default", "workspace_mandatory"];
-var KitKind = Schema6.Union([
-  Schema6.Literal("technology"),
-  Schema6.Literal("brand"),
-  Schema6.Literal("domain"),
-  Schema6.Literal("process"),
-  Schema6.Literal("other")
-]);
-var Kit = Schema6.Struct({
-  id: Id,
-  workspaceId: Id,
-  name: Schema6.String,
-  slug: Slug,
-  kind: KitKind,
-  description: Schema6.optionalKey(Schema6.String),
-  contentMarkdown: Schema6.String,
-  metadata: Schema6.Record(Schema6.String, Schema6.Unknown),
-  teamAttachment: Schema6.optionalKey(Schema6.Struct({
-    provenance: Schema6.Literals(TeamKitProvenanceKinds),
-    workspaceKitAssignmentId: Schema6.optionalKey(Id),
-    policyRevision: Schema6.optionalKey(Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(1))),
-    package: Schema6.optionalKey(Schema6.String)
-  })),
-  package: Schema6.optionalKey(Schema6.String),
-  agentEnvironment: Schema6.optionalKey(AgentEnvironmentFragment),
-  agentInstructions: Schema6.optionalKey(Schema6.String),
-  doNotDo: Schema6.optionalKey(Schema6.String),
-  createdAt: Timestamp,
-  updatedAt: Timestamp
-});
-var KitPublisherIdentity = Schema6.Struct({
-  name: Schema6.String.check(Schema6.isMinLength(1)),
-  type: Schema6.optionalKey(Schema6.Union([
-    Schema6.Literal("kitman"),
-    Schema6.Literal("workspace"),
-    Schema6.Literal("organization"),
-    Schema6.Literal("individual")
-  ])),
-  url: Schema6.optionalKey(Schema6.String),
-  verified: Schema6.optionalKey(Schema6.Boolean)
-});
-var KitSourceType = Schema6.Union([
-  Schema6.Literal("hosted"),
-  Schema6.Literal("git"),
-  Schema6.Literal("package"),
-  Schema6.Literal("url"),
-  Schema6.Literal("skills_sh")
-]);
-var KitTrustStatus = Schema6.Union([
-  Schema6.Literal("unreviewed"),
-  Schema6.Literal("trusted"),
-  Schema6.Literal("reviewed"),
-  Schema6.Literal("rejected"),
-  Schema6.Literal("deprecated")
-]);
-var KitReviewStatus = Schema6.Union([
-  Schema6.Literal("pending"),
-  Schema6.Literal("approved"),
-  Schema6.Literal("rejected"),
-  Schema6.Literal("deprecated")
-]);
-var KitSourceVisibility = Schema6.Union([
-  Schema6.Literal("public"),
-  Schema6.Literal("organization"),
-  Schema6.Literal("workspace")
-]);
-var SpdxLicenseExpression = Schema6.String.check(Schema6.isMinLength(1), Schema6.isMaxLength(240), Schema6.isPattern(new RegExp("^[A-Za-z0-9][A-Za-z0-9.+:()\\-\\s]*$", "u")));
-var KitLifecycleStatus = Schema6.Union([
-  Schema6.Literal("active"),
-  Schema6.Literal("deprecated"),
-  Schema6.Literal("rejected")
-]);
-var KitMarketplaceInstallState = Schema6.Union([
-  Schema6.Literal("not_installed"),
-  Schema6.Literal("installed"),
-  Schema6.Literal("active"),
-  Schema6.Literal("update_available")
-]);
-var KitMarketplaceRuntimeState = Schema6.Union([
-  Schema6.Literal("ready"),
-  Schema6.Literal("needs_sync"),
-  Schema6.Literal("proposal_required"),
-  Schema6.Literal("deprecated"),
-  Schema6.Literal("blocked")
-]);
-var KitMarketplaceLifecycleOperation = Schema6.Union([
-  Schema6.Literal("install"),
-  Schema6.Literal("activate"),
-  Schema6.Literal("update"),
-  Schema6.Literal("rollback"),
-  Schema6.Literal("disable"),
-  Schema6.Literal("uninstall")
-]);
-var KitCompatibility = Schema6.Struct({
-  harnesses: Schema6.optionalKey(Schema6.Array(Schema6.String)),
-  capabilities: Schema6.optionalKey(Schema6.Array(Schema6.String)),
-  minimumKitmanVersion: Schema6.optionalKey(Schema6.String),
-  runtimeRequirements: Schema6.optionalKey(Schema6.Array(Schema6.String))
-});
-var Sha2562 = Schema6.String.check(Schema6.isPattern(new RegExp("^[a-fA-F0-9]{64}$", "u")));
-var SourcePath2 = Schema6.String.check(Schema6.isMinLength(1), Schema6.isPattern(new RegExp("^(?!/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.\\.?($|/))(?!.*\\s).+$", "u")));
-var HostedKitSourceProvenance = Schema6.Struct({
-  sourceType: Schema6.Literal("hosted"),
-  path: Schema6.optionalKey(SourcePath2),
-  sha256: Schema6.optionalKey(Sha2562)
-});
-var GitKitSourceProvenance = Schema6.Struct({
-  sourceType: Schema6.Literal("git"),
-  repositoryUrl: Schema6.String.check(Schema6.isMinLength(1)),
-  ref: Schema6.String.check(Schema6.isMinLength(1)),
-  path: Schema6.optionalKey(SourcePath2),
-  sha256: Schema6.optionalKey(Sha2562)
-});
-var PackageKitSourceProvenance = Schema6.Struct({
-  sourceType: Schema6.Literal("package"),
-  packageName: Schema6.String.check(Schema6.isMinLength(1)),
-  version: Schema6.String.check(Schema6.isMinLength(1)),
-  path: Schema6.optionalKey(SourcePath2),
-  sha256: Schema6.optionalKey(Sha2562)
-});
-var UrlKitSourceProvenance = Schema6.Struct({
-  sourceType: Schema6.Literal("url"),
-  url: Schema6.String.check(Schema6.isMinLength(1)),
-  sha256: Sha2562
-});
-var SkillsShKitSourceProvenance = Schema6.Struct({
-  sourceType: Schema6.Literal("skills_sh"),
-  skillsSlug: Schema6.String.check(Schema6.isMinLength(1)),
-  version: Schema6.optionalKey(Schema6.String.check(Schema6.isMinLength(1))),
-  sha256: Schema6.optionalKey(Sha2562)
-});
-var KitSourceProvenance = Schema6.Union([
-  HostedKitSourceProvenance,
-  GitKitSourceProvenance,
-  PackageKitSourceProvenance,
-  UrlKitSourceProvenance,
-  SkillsShKitSourceProvenance
-]);
-var KitSourceBase = Schema6.Struct({
-  id: Id,
-  workspaceId: Schema6.optionalKey(Id),
-  name: Schema6.String,
-  slug: Slug,
-  summary: Schema6.String,
-  publisher: KitPublisherIdentity,
-  visibility: KitSourceVisibility,
-  licenseExpression: Schema6.optionalKey(SpdxLicenseExpression),
-  tags: Schema6.Array(Schema6.String),
-  compatibleHarnesses: Schema6.Array(Schema6.String),
-  capabilitySummaries: Schema6.Array(Schema6.String),
-  trustStatus: KitTrustStatus,
-  reviewStatus: KitReviewStatus,
-  lifecycleStatus: KitLifecycleStatus,
-  installable: Schema6.Boolean,
-  createdAt: Timestamp,
-  updatedAt: Timestamp
-});
-var KitSource = Schema6.Union([
-  Schema6.Struct({
-    ...KitSourceBase.fields,
-    ...Schema6.Struct({ sourceType: Schema6.Literal("hosted"), provenance: HostedKitSourceProvenance }).fields
-  }),
-  Schema6.Struct({
-    ...KitSourceBase.fields,
-    ...Schema6.Struct({ sourceType: Schema6.Literal("git"), provenance: GitKitSourceProvenance }).fields
-  }),
-  Schema6.Struct({
-    ...KitSourceBase.fields,
-    ...Schema6.Struct({ sourceType: Schema6.Literal("package"), provenance: PackageKitSourceProvenance }).fields
-  }),
-  Schema6.Struct({
-    ...KitSourceBase.fields,
-    ...Schema6.Struct({ sourceType: Schema6.Literal("url"), provenance: UrlKitSourceProvenance }).fields
-  }),
-  Schema6.Struct({
-    ...KitSourceBase.fields,
-    ...Schema6.Struct({ sourceType: Schema6.Literal("skills_sh"), provenance: SkillsShKitSourceProvenance }).fields
-  })
-]);
-var KitVersion = Schema6.Struct({
-  id: Id,
-  kitSourceId: Id,
-  version: Schema6.String,
-  provenance: KitSourceProvenance,
-  contentKitId: Schema6.optionalKey(Id),
-  compatibility: KitCompatibility,
-  trustStatus: KitTrustStatus,
-  reviewStatus: KitReviewStatus,
-  lifecycleStatus: KitLifecycleStatus,
-  reviewMetadata: Schema6.Record(Schema6.String, Schema6.Unknown),
-  publishedAt: Schema6.optionalKey(Timestamp),
-  createdAt: Timestamp,
-  updatedAt: Timestamp
-});
-var KitInstallationScope = Schema6.Union([
-  Schema6.Literal("user"),
-  Schema6.Literal("workspace"),
-  Schema6.Literal("team")
-]);
-var KitInstallationBase = Schema6.Struct({
-  id: Id,
-  kitSourceId: Id,
-  scopeType: KitInstallationScope,
-  scopeId: Id,
-  trustStatus: KitTrustStatus,
-  reviewStatus: KitReviewStatus,
-  lifecycleStatus: KitLifecycleStatus,
-  installedByActorType: Schema6.optionalKey(Schema6.String),
-  installedByActorId: Schema6.optionalKey(Id),
-  enabled: Schema6.Boolean,
-  package: Schema6.optionalKey(Schema6.String),
-  createdAt: Timestamp,
-  updatedAt: Timestamp
-});
-var KitInstallation = Schema6.Union([
-  Schema6.Struct({
-    ...KitInstallationBase.fields,
-    ...Schema6.Struct({ pinned: Schema6.Literal(true), kitVersionId: Id }).fields
-  }),
-  Schema6.Struct({
-    ...KitInstallationBase.fields,
-    ...Schema6.Struct({ pinned: Schema6.Literal(false), kitVersionId: Schema6.optionalKey(Id) }).fields
-  })
-]);
-var KitRegistrySearchItem = Schema6.Struct({
-  id: Id,
-  name: Schema6.String,
-  slug: Slug,
-  summary: Schema6.String,
-  publisher: KitPublisherIdentity,
-  visibility: KitSourceVisibility,
-  licenseExpression: Schema6.optionalKey(SpdxLicenseExpression),
-  sourceType: KitSourceType,
-  versions: Schema6.Array(Schema6.String),
-  tags: Schema6.Array(Schema6.String),
-  compatibleHarnesses: Schema6.Array(Schema6.String),
-  capabilitySummaries: Schema6.Array(Schema6.String),
-  trustStatus: KitTrustStatus,
-  reviewStatus: KitReviewStatus,
-  lifecycleStatus: KitLifecycleStatus,
-  installable: Schema6.Boolean
-});
-var KitActivation = Schema6.Struct({
-  id: Id,
-  kitInstallationId: Id,
-  kitSourceId: Id,
-  kitVersionId: Schema6.optionalKey(Id),
-  scopeType: KitInstallationScope,
-  scopeId: Id,
-  activationType: Schema6.Union([
-    Schema6.Literal("workspace_default"),
-    Schema6.Literal("team_default"),
-    Schema6.Literal("team_attachment"),
-    Schema6.Literal("personal_default"),
-    Schema6.Literal("harness")
-  ]),
-  active: Schema6.Boolean,
-  activeThrough: Schema6.optionalKey(Schema6.String),
-  metadata: Schema6.Record(Schema6.String, Schema6.Unknown),
-  createdAt: Timestamp,
-  updatedAt: Timestamp
-});
-var KitRegistrySearch = Schema6.Struct({
-  items: Schema6.Array(KitRegistrySearchItem)
-});
-var KitMarketplaceCatalogItem = Schema6.Struct({
-  id: Id,
-  name: Schema6.String,
-  slug: Slug,
-  summary: Schema6.String,
-  publisher: KitPublisherIdentity,
-  visibility: KitSourceVisibility,
-  licenseExpression: Schema6.optionalKey(SpdxLicenseExpression),
-  sourceType: KitSourceType,
-  trustStatus: KitTrustStatus,
-  reviewStatus: KitReviewStatus,
-  lifecycleStatus: KitLifecycleStatus,
-  installable: Schema6.Boolean,
-  latestVersion: Schema6.optionalKey(Schema6.String),
-  installedVersion: Schema6.optionalKey(Schema6.String),
-  installState: KitMarketplaceInstallState,
-  runtimeState: KitMarketplaceRuntimeState,
-  activeThrough: Schema6.optionalKey(Schema6.String),
-  compatibleHarnesses: Schema6.Array(Schema6.String),
-  capabilitySummaries: Schema6.Array(Schema6.String),
-  tags: Schema6.Array(Schema6.String),
-  installedByPackage: Schema6.optionalKey(Schema6.String)
-});
-var KitMarketplacePageInfo = Schema6.Struct({
-  hasNextPage: Schema6.Boolean,
-  endCursor: Schema6.optionalKey(Schema6.String.check(Schema6.isMinLength(1)))
-});
-var KitMarketplaceCatalog = Schema6.Struct({
-  items: Schema6.Array(KitMarketplaceCatalogItem).check(Schema6.isMaxLength(100)),
-  total: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
-  pageInfo: KitMarketplacePageInfo
-});
-var KitMarketplaceDetail = Schema6.Struct({
-  ...KitMarketplaceCatalogItem.fields,
-  ...Schema6.Struct({
-    provenance: KitSourceProvenance,
-    versions: Schema6.Array(KitVersion),
-    installations: Schema6.Array(KitInstallation),
-    activations: Schema6.Array(KitActivation)
-  }).fields
-});
-var KitMarketplaceCatalogValidator = guard(KitMarketplaceCatalog);
-var KitMarketplaceDetailValidator = guard(KitMarketplaceDetail);
-var KitMarketplacePreviewInput = Schema6.Struct({
-  operation: KitMarketplaceLifecycleOperation,
-  source: Schema6.String.check(Schema6.isMinLength(1)),
-  version: Schema6.optionalKey(Schema6.String.check(Schema6.isMinLength(1))),
-  scopeType: Schema6.optionalKey(KitInstallationScope),
-  scopeId: Schema6.optionalKey(Id),
-  activationType: Schema6.optionalKey(Schema6.Union([
-    Schema6.Literal("workspace_default"),
-    Schema6.Literal("team_default"),
-    Schema6.Literal("team_attachment"),
-    Schema6.Literal("personal_default"),
-    Schema6.Literal("harness")
-  ]))
-});
-var KitMarketplaceSyncReadiness = Schema6.Struct({
-  state: Schema6.Union([Schema6.Literal("ready"), Schema6.Literal("needs_sync"), Schema6.Literal("blocked")]),
-  blockers: Schema6.Array(Schema6.String)
-});
-var KitMarketplacePreview = Schema6.Struct({
-  previewToken: Schema6.String.check(Schema6.isMinLength(1)),
-  operation: KitMarketplaceLifecycleOperation,
-  sourceId: Id,
-  sourceSlug: Slug,
-  scopeType: KitInstallationScope,
-  scopeId: Id,
-  fromVersion: Schema6.optionalKey(Schema6.String),
-  toVersion: Schema6.optionalKey(Schema6.String),
-  installState: KitMarketplaceInstallState,
-  runtimeState: KitMarketplaceRuntimeState,
-  contextImpact: Schema6.Array(Schema6.String),
-  agentEnvironmentEffects: Schema6.Array(Schema6.String),
-  activeThrough: Schema6.optionalKey(Schema6.String),
-  conflicts: Schema6.Array(Schema6.String),
-  warnings: Schema6.Array(Schema6.String),
-  syncReadiness: KitMarketplaceSyncReadiness,
-  requiresProposal: Schema6.Boolean
-});
-var KitMarketplaceApplyPreviewInput = Schema6.Struct({
-  ...KitMarketplacePreviewInput.fields,
-  ...Schema6.Struct({ previewToken: Schema6.String.check(Schema6.isMinLength(1)) }).fields
-});
-var KitMarketplaceLifecycleResult = Schema6.Struct({
-  status: Schema6.Union([
-    Schema6.Literal("installed"),
-    Schema6.Literal("activated"),
-    Schema6.Literal("updated"),
-    Schema6.Literal("rolled_back"),
-    Schema6.Literal("disabled"),
-    Schema6.Literal("uninstalled")
-  ]),
-  previewToken: Schema6.String.check(Schema6.isMinLength(1)),
-  installation: Schema6.optionalKey(KitInstallation),
-  activation: Schema6.optionalKey(KitActivation),
-  syncReadiness: KitMarketplaceSyncReadiness
-});
-var KitCreate = Schema6.Struct({
-  name: Schema6.String.check(Schema6.isMinLength(1), Schema6.isMaxLength(160)),
-  slug: Schema6.optionalKey(Slug),
-  kind: Schema6.optionalKey(KitKind),
-  description: Schema6.optionalKey(Schema6.String),
-  contentMarkdown: Schema6.String.check(Schema6.isMinLength(1)),
-  metadata: Schema6.optionalKey(Schema6.Record(Schema6.String, Schema6.Unknown)),
-  agentEnvironment: Schema6.optionalKey(AgentEnvironmentFragment),
-  agentInstructions: Schema6.optionalKey(Schema6.String),
-  doNotDo: Schema6.optionalKey(Schema6.String)
-});
-var KitUpdate = Schema6.Struct(Struct6.map(KitCreate.fields, Schema6.optionalKey));
-var KitDeleteResult = Schema6.Struct({ deleted: Schema6.Boolean });
-var KitList = Schema6.Struct({
-  items: Schema6.Array(Kit),
-  policyOptOuts: Schema6.optionalKey(Schema6.Array(Schema6.Struct({
-    workspaceKitAssignmentId: Id,
-    kitId: Id,
-    policyRevision: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(1))
-  })))
-});
-var TeamKitAttachResult = Schema6.Struct({
-  status: Schema6.Union([Schema6.Literal("attached"), Schema6.Literal("already_attached")]),
-  teamId: Id,
-  kitId: Id
-});
-var TeamKitDetachResult = Schema6.Struct({
-  status: Schema6.Union([Schema6.Literal("detached"), Schema6.Literal("not_attached")]),
-  teamId: Id,
-  kitId: Id
-});
-var WorkspacePolicyKitMode = Schema6.Union([Schema6.Literal("default"), Schema6.Literal("mandatory")]);
-var TeamKitProvenanceKind = Schema6.Union([
-  Schema6.Literal("explicit"),
-  Schema6.Literal("workspace_default"),
-  Schema6.Literal("workspace_mandatory")
-]);
-var WorkspacePolicyKitAssignment = Schema6.Struct({
-  id: Id,
-  workspaceId: Id,
-  kitId: Id,
-  mode: WorkspacePolicyKitMode,
-  revision: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(1)),
-  createdByActorType: Schema6.optionalKey(ActorType),
-  createdByActorId: Schema6.optionalKey(Id),
-  package: Schema6.optionalKey(Schema6.String),
-  createdAt: Timestamp,
-  updatedAt: Timestamp
-});
-var WorkspacePolicyKitAssignmentList = Schema6.Struct({
-  items: Schema6.Array(WorkspacePolicyKitAssignment)
-});
-var WorkspacePolicyKitCandidate = Schema6.Struct({
-  kitId: Id,
-  name: Schema6.String,
-  kind: KitKind,
-  trustStatus: KitTrustStatus,
-  installationState: Schema6.Literal("active")
-});
-var WorkspacePolicyKitCandidateList = Schema6.Struct({ items: Schema6.Array(WorkspacePolicyKitCandidate) });
-var WorkspacePolicyKitAssignmentCreate = Schema6.Struct({
-  kitId: Id,
-  mode: WorkspacePolicyKitMode
-});
-var WorkspacePolicyKitAssignmentUpdate = Schema6.Struct({
-  mode: WorkspacePolicyKitMode,
-  expectedRevision: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(1))
-});
-var WorkspacePolicyKitAssignmentDelete = Schema6.Struct({
-  expectedRevision: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(1))
-});
-var WorkspacePolicyKitAssignmentDeleteResult = Schema6.Struct({
-  deleted: Schema6.Boolean,
-  assignmentId: Id
-});
-var TeamKitPolicyOverride = Schema6.Struct({
+var OwnedRecordKind = Schema5.Literal("schedule");
+var KitRecordChanges = Schema5.Struct({
+  created: Schema5.Array(Schema5.String),
+  changed: Schema5.Array(Schema5.String),
+  removed: Schema5.Array(Schema5.String),
+  adopted: Schema5.Array(Schema5.Struct({ key: Schema5.String, id: Schema5.String }))
+});
+var KitDrift = Schema5.Struct({
+  kind: OwnedRecordKind,
+  key: Schema5.String,
+  field: Schema5.String,
+  declared: Schema5.Unknown,
+  live: Schema5.Unknown,
+  changedBy: Schema5.optionalKey(Schema5.Struct({ actorType: Schema5.String, actorId: Schema5.String })),
+  changedAt: Schema5.optionalKey(Timestamp)
+});
+var KitPlanWarning = Schema5.Struct({
+  kind: Schema5.Literal("still_named"),
+  resource: Schema5.Union([Schema5.Literal("loop"), Schema5.Literal("agent")]),
+  id: Schema5.String,
+  record: Schema5.String
+});
+var KitPlanResult = Schema5.Struct({
+  name: KitName,
+  layer: KitLayer,
+  currentVersion: Schema5.Union([Schema5.Int.check(Schema5.isGreaterThanOrEqualTo(1)), Schema5.Null]),
+  currentCommit: Schema5.optionalKey(Schema5.String),
+  loops: KitChanges,
+  agents: KitChanges,
+  schedules: KitRecordChanges,
+  drift: Schema5.Array(KitDrift),
+  conflicts: Schema5.Array(KitPlanConflict),
+  warnings: Schema5.Array(KitPlanWarning),
+  secretsWithoutValue: Schema5.Array(Schema5.String)
+});
+var KitVersionSummary = Schema5.Struct({
+  number: Schema5.Int.check(Schema5.isGreaterThanOrEqualTo(1)),
+  digest: KitDigest,
+  protocolVersion: Schema5.Int.check(Schema5.isGreaterThanOrEqualTo(1)),
+  provenance: KitProvenance,
+  deployedByActorType: ActorType,
+  deployedByActorId: Schema5.String,
+  deployBindingId: Schema5.optionalKey(Id),
+  carried: Schema5.optionalKey(Schema5.Array(Schema5.Struct({ name: KitName, version: Schema5.String, setup: KitDigest }))),
+  deployedAt: Timestamp,
+  status: Schema5.Union([
+    Schema5.Literal("current"),
+    Schema5.Literal("superseded"),
+    Schema5.Literal("dev"),
+    Schema5.Literal("removed")
+  ])
+});
+var kitFields = {
+  name: KitName,
+  layer: KitLayer,
+  teamId: Schema5.optionalKey(Id),
+  current: Schema5.optionalKey(KitVersionSummary),
+  loops: Schema5.Array(Schema5.String),
+  agents: Schema5.Array(Schema5.String)
+};
+var KitSummary = Schema5.Struct(kitFields);
+var KitList = Schema5.Struct({ items: Schema5.Array(KitSummary) });
+var KitDetail = Schema5.Struct({
+  ...kitFields,
+  versions: Schema5.Array(KitVersionSummary),
+  schedules: Schema5.Array(Schema5.Struct({ key: Schema5.String, id: Id, name: Schema5.optionalKey(Schema5.String) })),
+  drift: Schema5.Array(KitDrift)
+});
+var KitScopeQuery = Schema5.Struct({ teamId: Schema5.optionalKey(Id) });
+var DeployBinding = Schema5.Struct({
   id: Id,
-  workspaceId: Id,
-  teamId: Id,
-  workspaceKitAssignmentId: Id,
-  kind: Schema6.Literal("opt_out"),
-  reason: Schema6.optionalKey(Schema6.String),
-  createdByActorType: ActorType,
-  createdByActorId: Id,
+  repoBindingId: Id,
+  repository: Schema5.String,
+  branch: Schema5.String.check(Schema5.isMinLength(1), Schema5.isMaxLength(255)),
+  kitName: KitName,
+  layer: KitLayer,
+  teamId: Schema5.optionalKey(Id),
+  createdByUserId: Schema5.String,
   createdAt: Timestamp
 });
-var TeamKitPolicyOverrideCreate = Schema6.Struct({
-  expectedRevision: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(1)),
-  reason: Schema6.optionalKey(Schema6.String.check(Schema6.isMinLength(1), Schema6.isMaxLength(1000)))
-});
-var TeamKitPolicyOverrideDelete = Schema6.Struct({
-  expectedRevision: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(1))
-});
-var TeamKitPolicyOverrideDeleteResult = Schema6.Struct({
-  deleted: Schema6.Boolean,
-  teamId: Id,
-  workspaceKitAssignmentId: Id
-});
-var TeamPolicyKitConvergenceResult = Schema6.Struct({
-  teamId: Id,
-  state: Schema6.Union([Schema6.Literal("current"), Schema6.Literal("degraded")]),
-  highestPolicyRevision: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
-  scanned: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0), Schema6.isLessThanOrEqualTo(100)),
-  applied: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0), Schema6.isLessThanOrEqualTo(100)),
-  replayed: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0), Schema6.isLessThanOrEqualTo(100)),
-  explicitAttachmentsPreserved: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0), Schema6.isLessThanOrEqualTo(100)),
-  hasMore: Schema6.Boolean,
-  retry: Schema6.Boolean,
-  repairAvailable: Schema6.Boolean,
-  nextCursor: Schema6.optionalKey(Id)
-});
-var TeamPolicyKitConvergenceInput = Schema6.Struct({ cursor: Schema6.optionalKey(Id) });
-var WorkspacePolicyKitBackfillPreviewKinds = [
-  "affected",
-  "unchanged",
-  "opted_out",
-  "inaccessible",
-  "conflict"
-];
-var WorkspacePolicyKitBackfillApplyStatuses = [
-  "pending",
-  "applied",
-  "skipped",
-  "conflict",
-  "retryable_failure",
-  "cancelled"
-];
-var WorkspacePolicyKitBackfillStates = ["previewed", "running", "partial", "completed", "cancelled"];
-var WorkspacePolicyKitBackfillPreviewKind = Schema6.Literals(WorkspacePolicyKitBackfillPreviewKinds);
-var WorkspacePolicyKitBackfillApplyStatus = Schema6.Literals(WorkspacePolicyKitBackfillApplyStatuses);
-var WorkspacePolicyKitBackfillState = Schema6.Literals(WorkspacePolicyKitBackfillStates);
-var WorkspacePolicyKitBackfillCounts = Schema6.Struct({
-  affected: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
-  unchanged: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
-  optedOut: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
-  inaccessible: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
-  conflict: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
-  pending: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
-  applied: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
-  skipped: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
-  retryableFailure: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
-  cancelled: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0))
-});
-var WorkspacePolicyKitBackfillItem = Schema6.Struct({
-  teamId: Id,
-  teamName: Schema6.String,
-  previewKind: WorkspacePolicyKitBackfillPreviewKind,
-  applyStatus: WorkspacePolicyKitBackfillApplyStatus,
-  attempts: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
-  errorCode: Schema6.optionalKey(Schema6.String),
-  errorMessage: Schema6.optionalKey(Schema6.String)
-});
-var WorkspacePolicyKitBackfillPage = Schema6.Struct({
-  backfillId: Id,
-  workspaceId: Id,
-  policyRevision: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
-  previewToken: Schema6.String.check(Schema6.isMinLength(1)),
-  state: WorkspacePolicyKitBackfillState,
-  counts: WorkspacePolicyKitBackfillCounts,
-  items: Schema6.Array(WorkspacePolicyKitBackfillItem).check(Schema6.isMaxLength(100)),
-  hasMore: Schema6.Boolean,
-  nextCursor: Schema6.optionalKey(Id),
-  createdAt: Timestamp,
-  updatedAt: Timestamp
-});
-var WorkspacePolicyKitBackfillPreviewInput = Schema6.Struct({
-  limit: Schema6.optionalKey(Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(1), Schema6.isLessThanOrEqualTo(100))),
-  cursor: Schema6.optionalKey(Id)
-});
-var WorkspacePolicyKitBackfillApplyInput = Schema6.Struct({
-  previewToken: Schema6.String.check(Schema6.isMinLength(1)),
-  limit: Schema6.optionalKey(Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(1), Schema6.isLessThanOrEqualTo(100))),
-  cursor: Schema6.optionalKey(Id)
-});
-var WorkspacePolicyKitBackfillStatusQuery = Schema6.Struct({
-  limit: Schema6.optionalKey(Numeric.check(isWholeNumber, Schema6.isGreaterThanOrEqualTo(1), Schema6.isLessThanOrEqualTo(100))),
-  cursor: Schema6.optionalKey(Id)
-});
-var WorkspacePolicyKitBackfillCancelResult = Schema6.Struct({
-  backfillId: Id,
-  state: Schema6.Literal("cancelled")
+var DeployBindingCreate = Schema5.Struct({
+  repoBindingId: Id,
+  branch: Schema5.String.check(Schema5.isMinLength(1), Schema5.isMaxLength(255)),
+  kitName: KitName,
+  teamId: Schema5.optionalKey(Id)
 });
+var DeployBindingList = Schema5.Struct({ items: Schema5.Array(DeployBinding) });
 
 // packages/core/src/loop-layers.ts
 var LoopLayers = ["team", "workspace", "shipped"];
 var AgentEfforts = ["low", "medium", "high", "xhigh"];
+var AgentCapabilities = ["web", "subagents", "artifacts", "browser"];
 
 // packages/core/src/loop.ts
 import * as Effect from "effect/Effect";
 import * as Schema12 from "effect/Schema";
 
 // packages/core/src/context-pack.ts
-import * as Schema7 from "effect/Schema";
+import * as Schema6 from "effect/Schema";
 var ContextPackIndexEntryKinds = [
   "task",
   "team",
@@ -1116,162 +382,162 @@ var ContextPackRetrievalRefKinds = [
   "agent_environment",
   "loop_step"
 ];
-var ContextPackMode = Schema7.Union([
-  Schema7.Literal("planning"),
-  Schema7.Literal("implementation"),
-  Schema7.Literal("debugging"),
-  Schema7.Literal("review"),
-  Schema7.Literal("handoff")
+var ContextPackMode = Schema6.Union([
+  Schema6.Literal("planning"),
+  Schema6.Literal("implementation"),
+  Schema6.Literal("debugging"),
+  Schema6.Literal("review"),
+  Schema6.Literal("handoff")
 ]);
-var ContextPackIndexEntryKind = Schema7.Literals(ContextPackIndexEntryKinds);
-var ContextPackRetrievalRefKind = Schema7.Literals(ContextPackRetrievalRefKinds);
-var ContextPackLaunchBrief = Schema7.Struct({
+var ContextPackIndexEntryKind = Schema6.Literals(ContextPackIndexEntryKinds);
+var ContextPackRetrievalRefKind = Schema6.Literals(ContextPackRetrievalRefKinds);
+var ContextPackLaunchBrief = Schema6.Struct({
   mode: ContextPackMode,
-  taskTitle: Schema7.String.check(Schema7.isMinLength(1)),
-  teamName: Schema7.optionalKey(Schema7.String.check(Schema7.isMinLength(1))),
-  summary: Schema7.String.check(Schema7.isMinLength(1))
+  taskTitle: Schema6.String.check(Schema6.isMinLength(1)),
+  teamName: Schema6.optionalKey(Schema6.String.check(Schema6.isMinLength(1))),
+  summary: Schema6.String.check(Schema6.isMinLength(1))
 });
-var ContextPackIndexEntry = Schema7.Struct({
+var ContextPackIndexEntry = Schema6.Struct({
   kind: ContextPackIndexEntryKind,
   id: Id,
-  title: Schema7.String.check(Schema7.isMinLength(1)),
-  reason: Schema7.String.check(Schema7.isMinLength(1))
+  title: Schema6.String.check(Schema6.isMinLength(1)),
+  reason: Schema6.String.check(Schema6.isMinLength(1))
 });
-var ContextPackRetrievalRef = Schema7.Struct({
+var ContextPackRetrievalRef = Schema6.Struct({
   kind: ContextPackRetrievalRefKind,
   id: Id,
-  label: Schema7.String.check(Schema7.isMinLength(1))
-});
-var ContextPackReadinessEvidence = Schema7.Struct({
-  scopeAvailable: Schema7.Boolean,
-  acceptanceCriteriaAvailable: Schema7.Boolean,
-  dependenciesSatisfied: Schema7.Boolean,
-  executionPlanAvailable: Schema7.Boolean,
-  repoBindingAvailable: Schema7.Boolean,
-  verificationCommands: Schema7.Array(Schema7.String.check(Schema7.isMinLength(1), Schema7.isMaxLength(500))).check(Schema7.isMaxLength(50)),
-  deliveryTargetAvailable: Schema7.Boolean
-});
-var ContextPackRelevanceSummary = Schema7.Struct({
-  included: Schema7.Array(Schema7.String.check(Schema7.isMinLength(1))),
-  omitted: Schema7.Array(Schema7.String.check(Schema7.isMinLength(1))),
-  notes: Schema7.Array(Schema7.String.check(Schema7.isMinLength(1))),
-  readiness: Schema7.optionalKey(ContextPackReadinessEvidence)
-});
-var ContextPackBudget = Schema7.Struct({
-  maxMarkdownChars: Schema7.Int.check(Schema7.isGreaterThanOrEqualTo(1)),
-  markdownChars: Schema7.Int.check(Schema7.isGreaterThanOrEqualTo(0)),
-  indexedItemCount: Schema7.Int.check(Schema7.isGreaterThanOrEqualTo(0)),
-  retrievalRefCount: Schema7.Int.check(Schema7.isGreaterThanOrEqualTo(0))
-});
-var ContextPack = Schema7.Struct({
+  label: Schema6.String.check(Schema6.isMinLength(1))
+});
+var ContextPackReadinessEvidence = Schema6.Struct({
+  scopeAvailable: Schema6.Boolean,
+  acceptanceCriteriaAvailable: Schema6.Boolean,
+  dependenciesSatisfied: Schema6.Boolean,
+  executionPlanAvailable: Schema6.Boolean,
+  repoBindingAvailable: Schema6.Boolean,
+  verificationCommands: Schema6.Array(Schema6.String.check(Schema6.isMinLength(1), Schema6.isMaxLength(500))).check(Schema6.isMaxLength(50)),
+  deliveryTargetAvailable: Schema6.Boolean
+});
+var ContextPackRelevanceSummary = Schema6.Struct({
+  included: Schema6.Array(Schema6.String.check(Schema6.isMinLength(1))),
+  omitted: Schema6.Array(Schema6.String.check(Schema6.isMinLength(1))),
+  notes: Schema6.Array(Schema6.String.check(Schema6.isMinLength(1))),
+  readiness: Schema6.optionalKey(ContextPackReadinessEvidence)
+});
+var ContextPackBudget = Schema6.Struct({
+  maxMarkdownChars: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(1)),
+  markdownChars: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
+  indexedItemCount: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0)),
+  retrievalRefCount: Schema6.Int.check(Schema6.isGreaterThanOrEqualTo(0))
+});
+var ContextPack = Schema6.Struct({
   contextPackId: Id,
   workspaceId: Id,
-  teamId: Schema7.optionalKey(Id),
+  teamId: Schema6.optionalKey(Id),
   taskId: Id,
   mode: ContextPackMode,
-  contentMarkdown: Schema7.String.check(Schema7.isMinLength(1)),
+  contentMarkdown: Schema6.String.check(Schema6.isMinLength(1)),
   launchBrief: ContextPackLaunchBrief,
-  contextIndex: Schema7.Array(ContextPackIndexEntry),
-  retrievalRefs: Schema7.Array(ContextPackRetrievalRef),
+  contextIndex: Schema6.Array(ContextPackIndexEntry),
+  retrievalRefs: Schema6.Array(ContextPackRetrievalRef),
   relevanceSummary: ContextPackRelevanceSummary,
   budget: ContextPackBudget,
-  includedKitIds: Schema7.Array(Id),
-  includedMemoryIds: Schema7.Array(Id),
-  includedDecisionIds: Schema7.Array(Id),
-  includedProposalIds: Schema7.Array(Id),
-  includedSessionIds: Schema7.Array(Id),
+  includedKitIds: Schema6.Array(Id),
+  includedMemoryIds: Schema6.Array(Id),
+  includedDecisionIds: Schema6.Array(Id),
+  includedProposalIds: Schema6.Array(Id),
+  includedSessionIds: Schema6.Array(Id),
   createdByActorType: ActorType,
   createdByActorId: Id,
   createdAt: Timestamp
 });
-var ContextPackGenerate = Schema7.Struct({
-  mode: Schema7.optionalKey(ContextPackMode)
+var ContextPackGenerate = Schema6.Struct({
+  mode: Schema6.optionalKey(ContextPackMode)
 });
-var ContextPackLatestQuery = Schema7.Struct({
-  mode: Schema7.optionalKey(ContextPackMode)
+var ContextPackLatestQuery = Schema6.Struct({
+  mode: Schema6.optionalKey(ContextPackMode)
 });
-var ContextPackResult = Schema7.Struct({
+var ContextPackResult = Schema6.Struct({
   contextPackId: Id,
   mode: ContextPackMode,
-  contentMarkdown: Schema7.String.check(Schema7.isMinLength(1)),
-  launchBrief: Schema7.optionalKey(ContextPackLaunchBrief),
-  contextIndex: Schema7.optionalKey(Schema7.Array(ContextPackIndexEntry)),
-  retrievalRefs: Schema7.optionalKey(Schema7.Array(ContextPackRetrievalRef)),
-  relevanceSummary: Schema7.optionalKey(ContextPackRelevanceSummary),
-  budget: Schema7.optionalKey(ContextPackBudget),
-  includedDecisionIds: Schema7.optionalKey(Schema7.Array(Id)),
-  includedProposalIds: Schema7.optionalKey(Schema7.Array(Id))
-});
-var ContextPackRetrievalInput = Schema7.Struct({
+  contentMarkdown: Schema6.String.check(Schema6.isMinLength(1)),
+  launchBrief: Schema6.optionalKey(ContextPackLaunchBrief),
+  contextIndex: Schema6.optionalKey(Schema6.Array(ContextPackIndexEntry)),
+  retrievalRefs: Schema6.optionalKey(Schema6.Array(ContextPackRetrievalRef)),
+  relevanceSummary: Schema6.optionalKey(ContextPackRelevanceSummary),
+  budget: Schema6.optionalKey(ContextPackBudget),
+  includedDecisionIds: Schema6.optionalKey(Schema6.Array(Id)),
+  includedProposalIds: Schema6.optionalKey(Schema6.Array(Id))
+});
+var ContextPackRetrievalInput = Schema6.Struct({
   contextPackId: Id,
   ref: ContextPackRetrievalRef
 });
-var ContextPackRetrievedContext = Schema7.Struct({
+var ContextPackRetrievedContext = Schema6.Struct({
   contextPackId: Id,
   ref: ContextPackRetrievalRef,
-  contentMarkdown: Schema7.String.check(Schema7.isMinLength(1)),
-  safety: Schema7.Struct({
-    rawContentIncluded: Schema7.Boolean,
-    notes: Schema7.Array(Schema7.String.check(Schema7.isMinLength(1)))
+  contentMarkdown: Schema6.String.check(Schema6.isMinLength(1)),
+  safety: Schema6.Struct({
+    rawContentIncluded: Schema6.Boolean,
+    notes: Schema6.Array(Schema6.String.check(Schema6.isMinLength(1)))
   })
 });
 
 // packages/core/src/extension.ts
-import * as Schema10 from "effect/Schema";
+import * as Schema9 from "effect/Schema";
 
 // packages/core/src/run.ts
-import * as Schema9 from "effect/Schema";
+import * as Schema8 from "effect/Schema";
 
 // packages/core/src/redaction.ts
-import * as Schema8 from "effect/Schema";
+import * as Schema7 from "effect/Schema";
 import * as Data from "effect/Data";
 var EvidenceRefContractVersion = "evidence-ref.v1";
-var RedactionClassificationSchema = Schema8.Union([
-  Schema8.Literal("secret"),
-  Schema8.Literal("credential"),
-  Schema8.Literal("pii"),
-  Schema8.Literal("source"),
-  Schema8.Literal("log"),
-  Schema8.Literal("diff"),
-  Schema8.Literal("transcript"),
-  Schema8.Literal("provider_payload"),
-  Schema8.Literal("url"),
-  Schema8.Literal("path"),
-  Schema8.Literal("unknown")
+var RedactionClassificationSchema = Schema7.Union([
+  Schema7.Literal("secret"),
+  Schema7.Literal("credential"),
+  Schema7.Literal("pii"),
+  Schema7.Literal("source"),
+  Schema7.Literal("log"),
+  Schema7.Literal("diff"),
+  Schema7.Literal("transcript"),
+  Schema7.Literal("provider_payload"),
+  Schema7.Literal("url"),
+  Schema7.Literal("path"),
+  Schema7.Literal("unknown")
 ]);
-var RedactionFindingSchema = Schema8.Struct({
-  path: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(512)),
+var RedactionFindingSchema = Schema7.Struct({
+  path: Schema7.String.check(Schema7.isMinLength(1), Schema7.isMaxLength(512)),
   classification: RedactionClassificationSchema,
-  rule: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(120)),
-  preview: Schema8.String.check(Schema8.isMaxLength(160)),
-  sha256: Schema8.String.check(Schema8.isPattern(new RegExp("^[a-f0-9]{64}$", "u")))
-});
-var EvidenceRef = Schema8.Struct({
-  contractVersion: Schema8.Literal(EvidenceRefContractVersion),
-  kind: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(80)),
-  summary: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(240)),
-  sha256: Schema8.String.check(Schema8.isPattern(new RegExp("^[a-f0-9]{64}$", "u"))),
-  redaction: Schema8.Literal("redacted"),
-  findingCount: Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(0)),
-  classifications: Schema8.Array(RedactionClassificationSchema).check(Schema8.isMaxLength(20))
+  rule: Schema7.String.check(Schema7.isMinLength(1), Schema7.isMaxLength(120)),
+  preview: Schema7.String.check(Schema7.isMaxLength(160)),
+  sha256: Schema7.String.check(Schema7.isPattern(new RegExp("^[a-f0-9]{64}$", "u")))
+});
+var EvidenceRef = Schema7.Struct({
+  contractVersion: Schema7.Literal(EvidenceRefContractVersion),
+  kind: Schema7.String.check(Schema7.isMinLength(1), Schema7.isMaxLength(80)),
+  summary: Schema7.String.check(Schema7.isMinLength(1), Schema7.isMaxLength(240)),
+  sha256: Schema7.String.check(Schema7.isPattern(new RegExp("^[a-f0-9]{64}$", "u"))),
+  redaction: Schema7.Literal("redacted"),
+  findingCount: Schema7.Int.check(Schema7.isGreaterThanOrEqualTo(0)),
+  classifications: Schema7.Array(RedactionClassificationSchema).check(Schema7.isMaxLength(20))
 });
 var RedactionSurfaceKinds = ["api", "mcp", "cli", "web", "event", "log", "evidence", "export"];
-var RedactionSurfaceKindSchema = Schema8.Literals(RedactionSurfaceKinds);
-var RedactionWaiver = Schema8.Struct({
-  contractVersion: Schema8.Literal("redaction-waiver.v1"),
-  id: Schema8.String.check(Schema8.isMinLength(1)),
-  workspaceId: Schema8.String.check(Schema8.isMinLength(1)),
-  findingId: Schema8.String.check(Schema8.isMinLength(1)),
-  reason: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(1000)),
-  authorityActorType: Schema8.Union([
-    Schema8.Literal("human"),
-    Schema8.Literal("delegated_agent"),
-    Schema8.Literal("agent")
+var RedactionSurfaceKindSchema = Schema7.Literals(RedactionSurfaceKinds);
+var RedactionWaiver = Schema7.Struct({
+  contractVersion: Schema7.Literal("redaction-waiver.v1"),
+  id: Schema7.String.check(Schema7.isMinLength(1)),
+  workspaceId: Schema7.String.check(Schema7.isMinLength(1)),
+  findingId: Schema7.String.check(Schema7.isMinLength(1)),
+  reason: Schema7.String.check(Schema7.isMinLength(1), Schema7.isMaxLength(1000)),
+  authorityActorType: Schema7.Union([
+    Schema7.Literal("human"),
+    Schema7.Literal("delegated_agent"),
+    Schema7.Literal("agent")
   ]),
-  authorityActorId: Schema8.String.check(Schema8.isMinLength(1)),
-  authorityRole: Schema8.Union([Schema8.Literal("owner"), Schema8.Literal("admin")]),
-  expiresAt: Schema8.optionalKey(Schema8.String.check(isDateTime)),
-  createdAt: Schema8.String.check(isDateTime)
+  authorityActorId: Schema7.String.check(Schema7.isMinLength(1)),
+  authorityRole: Schema7.Union([Schema7.Literal("owner"), Schema7.Literal("admin")]),
+  expiresAt: Schema7.optionalKey(Schema7.String.check(isDateTime)),
+  createdAt: Schema7.String.check(isDateTime)
 });
 class DurableSurfaceScanError extends Data.TaggedError("DurableSurfaceScanError") {
   constructor(findings) {
@@ -1321,7 +587,7 @@ var LOCAL_PATH_KEYS = new Set([
 ]);
 var VALUE_RULES = [
   ["secret", /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/u, "private-key"],
-  ["credential", /\bBearer\s+[A-Za-z0-9._~+/-]+=*/iu, "bearer-token"],
+  ["credential", /\bBearer\s+(?=[A-Za-z]*(?:[0-9]|[._~+/-][A-Za-z0-9]))[A-Za-z0-9._~+/-]+=*/iu, "bearer-token"],
   [
     "credential",
     /(?:^|[^A-Za-z0-9])(?:ghp_|github_pat_|glpat-|ksa1\.|sk-[A-Za-z0-9_-]{8,}|xox[baprs]-)[A-Za-z0-9._-]+/u,
@@ -1342,115 +608,121 @@ var VALUE_RULES = [
   ["log", /(?:^|\n)\s*\d{4}-\d{2}-\d{2}T\S+\s+(?:ERROR|WARN|INFO|DEBUG)\b/u, "structured-log"],
   ["transcript", /(?:^|\n)\s*(?:user|assistant|system)\s*:/iu, "transcript-content"]
 ];
+var credentialUrl = /\b(?:https?|ftp):\/\/(?:[^\s/?#]*@|[^\s?#]*\?)[^\s]*/iu;
+var keptClassifications = new Set(["secret", "credential", "unknown"]);
 var normalizedKeys = new Map;
 var CREDENTIAL_RULES = VALUE_RULES.flatMap(([classification, pattern]) => classification === "secret" || classification === "credential" ? [[classification, new RegExp(pattern.source, `${pattern.flags}g`)]] : []);
+var RESPONSE_RULES = [
+  ...CREDENTIAL_RULES,
+  ["url", new RegExp(credentialUrl.source, "giu")]
+];
 
 // packages/core/src/run.ts
-var RunContractVersion = Schema9.Literal("run.v1");
-var ImmutableExecutionClosureContractVersion = Schema9.Literal("immutable-execution-closure.v1");
-var Sha2563 = Schema9.String.check(Schema9.isPattern(new RegExp("^[a-f0-9]{64}$", "u")));
-var BoundedText = Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(4000));
-var SafeKey = Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(120), Schema9.isPattern(new RegExp("^[A-Za-z][A-Za-z0-9_-]*$", "u")));
-var SafeJson = Schema9.Union([
-  Schema9.Null,
-  Schema9.Boolean,
-  Schema9.Finite.check(Schema9.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER), Schema9.isGreaterThanOrEqualTo(Number.MIN_SAFE_INTEGER)),
+var RunContractVersion = Schema8.Literal("run.v1");
+var ImmutableExecutionClosureContractVersion = Schema8.Literal("immutable-execution-closure.v1");
+var Sha256 = Schema8.String.check(Schema8.isPattern(new RegExp("^[a-f0-9]{64}$", "u")));
+var BoundedText = Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(4000));
+var SafeKey = Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(120), Schema8.isPattern(new RegExp("^[A-Za-z][A-Za-z0-9_-]*$", "u")));
+var SafeJson = Schema8.Union([
+  Schema8.Null,
+  Schema8.Boolean,
+  Schema8.Finite.check(Schema8.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER), Schema8.isGreaterThanOrEqualTo(Number.MIN_SAFE_INTEGER)),
   BoundedText,
-  Schema9.Array(Schema9.suspend(() => SafeJson)).check(Schema9.isMaxLength(200)),
-  Schema9.Record(SafeKey, Schema9.suspend(() => SafeJson)).check(Schema9.isMaxProperties(200))
+  Schema8.Array(Schema8.suspend(() => SafeJson)).check(Schema8.isMaxLength(200)),
+  Schema8.Record(SafeKey, Schema8.suspend(() => SafeJson)).check(Schema8.isMaxProperties(200))
 ]).annotate({ identifier: "RunSafeJson" });
-var RunActorRef = Schema9.Struct({
-  actorType: Schema9.Union([ActorType, Schema9.Literal("runner")]),
+var RunActorRef = Schema8.Struct({
+  actorType: Schema8.Union([ActorType, Schema8.Literal("runner")]),
   actorId: Id,
-  delegatedByUserId: Schema9.optionalKey(Id),
-  agentIdentityId: Schema9.optionalKey(Id),
-  runnerId: Schema9.optionalKey(Id)
+  delegatedByUserId: Schema8.optionalKey(Id),
+  agentIdentityId: Schema8.optionalKey(Id),
+  runnerId: Schema8.optionalKey(Id)
 });
-var RunResourceRef = Schema9.Struct({
-  kind: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(80)),
+var RunResourceRef = Schema8.Struct({
+  kind: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(80)),
   id: Id
 });
-var RunSchemaRef = Schema9.Struct({
-  kind: Schema9.Literal("typebox_ref"),
-  name: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(160)),
-  version: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(40)),
-  sha256: Sha2563
+var RunSchemaRef = Schema8.Struct({
+  kind: Schema8.Literal("typebox_ref"),
+  name: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(160)),
+  version: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(40)),
+  sha256: Sha256
 });
-var AgentPinnedKitRef = Schema9.Struct({
+var AgentPinnedKitRef = Schema8.Struct({
   kitId: Id,
-  version: Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(1)),
-  sha256: Sha2563,
-  precedence: Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(0)),
-  required: Schema9.Boolean
-});
-var AgentSkillRef = Schema9.Struct({
-  sourceId: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(240)),
-  name: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(160)),
-  version: Schema9.optionalKey(Schema9.String.check(Schema9.isMaxLength(80))),
-  sha256: Schema9.optionalKey(Sha2563),
-  required: Schema9.Boolean
-});
-var AgentReference = Schema9.Union([
-  Schema9.Struct({ agentId: Id, alias: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(80)) }),
-  Schema9.Struct({ agentId: Id, version: Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(1)), digest: Sha2563 })
+  version: Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(1)),
+  sha256: Sha256,
+  precedence: Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(0)),
+  required: Schema8.Boolean
+});
+var AgentSkillRef = Schema8.Struct({
+  sourceId: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(240)),
+  name: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(160)),
+  version: Schema8.optionalKey(Schema8.String.check(Schema8.isMaxLength(80))),
+  sha256: Schema8.optionalKey(Sha256),
+  required: Schema8.Boolean
+});
+var AgentReference = Schema8.Union([
+  Schema8.Struct({ agentId: Id, alias: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(80)) }),
+  Schema8.Struct({ agentId: Id, version: Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(1)), digest: Sha256 })
 ]);
-var AgentToolGrant = Schema9.Struct({
-  ref: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(240)),
-  inputSchema: Schema9.optionalKey(RunSchemaRef),
-  scope: Schema9.optionalKey(RunResourceRef),
-  approval: Schema9.Union([Schema9.Literal("none"), Schema9.Literal("human_each_call"), Schema9.Literal("human_once")]),
-  delegable: Schema9.Boolean
-});
-var AgentHarnessSelector = Schema9.Struct({
-  mode: Schema9.Union([Schema9.Literal("direct_model"), Schema9.Literal("harness_v1"), Schema9.Literal("native")]),
-  harness: Schema9.optionalKey(Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(80))),
-  adapterRef: Schema9.optionalKey(Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(240))),
-  requiredCapabilities: Schema9.Array(Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(80))).check(Schema9.isMaxLength(40)),
-  allowedFallbacks: Schema9.Array(Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(160))).check(Schema9.isMaxLength(20))
-});
-var AgentModelSelector = Schema9.Struct({
-  providerRef: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(160)),
-  modelRef: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(160)),
-  profile: Schema9.optionalKey(Schema9.String.check(Schema9.isMaxLength(80))),
-  reasoning: Schema9.optionalKey(Schema9.String.check(Schema9.isMaxLength(80)))
-});
-var AgentPolicy = Schema9.Struct({
-  requestedCapabilities: Schema9.Array(Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(120))).check(Schema9.isMaxLength(100)),
-  maxChildDepth: Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(0), Schema9.isLessThanOrEqualTo(32)),
-  allowSubdelegation: Schema9.Boolean,
-  maxWallSeconds: Schema9.optionalKey(Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(1), Schema9.isLessThanOrEqualTo(31536000))),
-  maxInputTokens: Schema9.optionalKey(Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(0), Schema9.isLessThanOrEqualTo(1e8))),
-  maxOutputTokens: Schema9.optionalKey(Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(0), Schema9.isLessThanOrEqualTo(1e8))),
-  hardLimit: Schema9.Boolean
-});
-var AgentProvenance = Schema9.Struct({
-  source: Schema9.Union([
-    Schema9.Literal("kitman"),
-    Schema9.Literal("workspace"),
-    Schema9.Literal("team"),
-    Schema9.Literal("git"),
-    Schema9.Literal("package"),
-    Schema9.Literal("import")
+var AgentToolGrant = Schema8.Struct({
+  ref: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(240)),
+  inputSchema: Schema8.optionalKey(RunSchemaRef),
+  scope: Schema8.optionalKey(RunResourceRef),
+  approval: Schema8.Union([Schema8.Literal("none"), Schema8.Literal("human_each_call"), Schema8.Literal("human_once")]),
+  delegable: Schema8.Boolean
+});
+var AgentHarnessSelector = Schema8.Struct({
+  mode: Schema8.Union([Schema8.Literal("direct_model"), Schema8.Literal("harness_v1"), Schema8.Literal("native")]),
+  harness: Schema8.optionalKey(Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(80))),
+  adapterRef: Schema8.optionalKey(Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(240))),
+  requiredCapabilities: Schema8.Array(Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(80))).check(Schema8.isMaxLength(40)),
+  allowedFallbacks: Schema8.Array(Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(160))).check(Schema8.isMaxLength(20))
+});
+var AgentModelSelector = Schema8.Struct({
+  providerRef: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(160)),
+  modelRef: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(160)),
+  profile: Schema8.optionalKey(Schema8.String.check(Schema8.isMaxLength(80))),
+  reasoning: Schema8.optionalKey(Schema8.String.check(Schema8.isMaxLength(80)))
+});
+var AgentPolicy = Schema8.Struct({
+  requestedCapabilities: Schema8.Array(Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(120))).check(Schema8.isMaxLength(100)),
+  maxChildDepth: Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(0), Schema8.isLessThanOrEqualTo(32)),
+  allowSubdelegation: Schema8.Boolean,
+  maxWallSeconds: Schema8.optionalKey(Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(1), Schema8.isLessThanOrEqualTo(31536000))),
+  maxInputTokens: Schema8.optionalKey(Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(0), Schema8.isLessThanOrEqualTo(1e8))),
+  maxOutputTokens: Schema8.optionalKey(Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(0), Schema8.isLessThanOrEqualTo(1e8))),
+  hardLimit: Schema8.Boolean
+});
+var AgentProvenance = Schema8.Struct({
+  source: Schema8.Union([
+    Schema8.Literal("kitman"),
+    Schema8.Literal("workspace"),
+    Schema8.Literal("team"),
+    Schema8.Literal("git"),
+    Schema8.Literal("package"),
+    Schema8.Literal("import")
   ]),
-  sourceRef: Schema9.optionalKey(Schema9.String.check(Schema9.isMaxLength(240))),
-  sourceCommitSha: Schema9.optionalKey(Schema9.String.check(Schema9.isMaxLength(128))),
-  contentSha256: Sha2563,
-  reviewedBy: Schema9.optionalKey(Schema9.Array(RunActorRef).check(Schema9.isMaxLength(20)))
+  sourceRef: Schema8.optionalKey(Schema8.String.check(Schema8.isMaxLength(240))),
+  sourceCommitSha: Schema8.optionalKey(Schema8.String.check(Schema8.isMaxLength(128))),
+  contentSha256: Sha256,
+  reviewedBy: Schema8.optionalKey(Schema8.Array(RunActorRef).check(Schema8.isMaxLength(20)))
 });
-var Agent = Schema9.Struct({
+var Agent = Schema8.Struct({
   contractVersion: RunContractVersion,
   id: Id,
   workspaceId: Id,
-  teamId: Schema9.optionalKey(Id),
-  name: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(160)),
-  slug: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(160), Schema9.isPattern(new RegExp("^[a-z0-9]+(?:-[a-z0-9]+)*$", "u"))),
-  currentVersion: Schema9.optionalKey(Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(1))),
-  status: Schema9.Union([
-    Schema9.Literal("draft"),
-    Schema9.Literal("published"),
-    Schema9.Literal("deprecated"),
-    Schema9.Literal("disabled"),
-    Schema9.Literal("archived")
+  teamId: Schema8.optionalKey(Id),
+  name: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(160)),
+  slug: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(160), Schema8.isPattern(new RegExp("^[a-z0-9]+(?:-[a-z0-9]+)*$", "u"))),
+  currentVersion: Schema8.optionalKey(Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(1))),
+  status: Schema8.Union([
+    Schema8.Literal("draft"),
+    Schema8.Literal("published"),
+    Schema8.Literal("deprecated"),
+    Schema8.Literal("disabled"),
+    Schema8.Literal("archived")
   ]),
   createdBy: RunActorRef,
   createdAt: Timestamp,
@@ -1468,78 +740,78 @@ var RunMessageTypes = [
   "instruction",
   "notice"
 ];
-var RunMessageType = Schema9.Literals(RunMessageTypes);
-var MessageEvidenceRefs = Schema9.Array(RunResourceRef).check(Schema9.isMaxLength(100));
-var MessageProgressPayload = Schema9.Struct({
-  type: Schema9.Literal("progress"),
+var RunMessageType = Schema8.Literals(RunMessageTypes);
+var MessageEvidenceRefs = Schema8.Array(RunResourceRef).check(Schema8.isMaxLength(100));
+var MessageProgressPayload = Schema8.Struct({
+  type: Schema8.Literal("progress"),
   summary: BoundedText,
-  phase: Schema9.optionalKey(Schema9.String.check(Schema9.isMaxLength(120))),
-  percent: Schema9.optionalKey(Schema9.Finite.check(Schema9.isGreaterThanOrEqualTo(0), Schema9.isLessThanOrEqualTo(100))),
-  evidenceRefs: Schema9.optionalKey(MessageEvidenceRefs)
+  phase: Schema8.optionalKey(Schema8.String.check(Schema8.isMaxLength(120))),
+  percent: Schema8.optionalKey(Schema8.Finite.check(Schema8.isGreaterThanOrEqualTo(0), Schema8.isLessThanOrEqualTo(100))),
+  evidenceRefs: Schema8.optionalKey(MessageEvidenceRefs)
 });
-var MessageQuestionPayload = Schema9.Struct({
-  type: Schema9.Literal("question"),
-  questionId: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(160)),
+var MessageQuestionPayload = Schema8.Struct({
+  type: Schema8.Literal("question"),
+  questionId: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(160)),
   prompt: BoundedText,
   answerSchema: RunSchemaRef,
-  urgency: Schema9.Union([Schema9.Literal("normal"), Schema9.Literal("blocking")]),
+  urgency: Schema8.Union([Schema8.Literal("normal"), Schema8.Literal("blocking")]),
   waitId: Id
 });
-var MessageAnswerPayload = Schema9.Struct({
-  type: Schema9.Literal("answer"),
-  questionId: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(160)),
+var MessageAnswerPayload = Schema8.Struct({
+  type: Schema8.Literal("answer"),
+  questionId: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(160)),
   answer: SafeJson,
   answerSchema: RunSchemaRef,
   waitId: Id
 });
-var MessageContextRequestPayload = Schema9.Struct({
-  type: Schema9.Literal("context_request"),
-  requestId: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(160)),
-  refs: Schema9.Array(RunResourceRef).check(Schema9.isMaxLength(100)),
+var MessageContextRequestPayload = Schema8.Struct({
+  type: Schema8.Literal("context_request"),
+  requestId: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(160)),
+  refs: Schema8.Array(RunResourceRef).check(Schema8.isMaxLength(100)),
   reason: BoundedText
 });
-var MessageContextResponsePayload = Schema9.Struct({
-  type: Schema9.Literal("context_response"),
-  requestId: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(160)),
-  refs: Schema9.Array(RunResourceRef).check(Schema9.isMaxLength(100)),
-  summaries: Schema9.Array(SafeJson).check(Schema9.isMaxLength(100))
-});
-var MessageFindingPayload = Schema9.Struct({
-  type: Schema9.Literal("finding"),
-  severity: Schema9.Union([
-    Schema9.Literal("info"),
-    Schema9.Literal("low"),
-    Schema9.Literal("medium"),
-    Schema9.Literal("high"),
-    Schema9.Literal("critical")
+var MessageContextResponsePayload = Schema8.Struct({
+  type: Schema8.Literal("context_response"),
+  requestId: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(160)),
+  refs: Schema8.Array(RunResourceRef).check(Schema8.isMaxLength(100)),
+  summaries: Schema8.Array(SafeJson).check(Schema8.isMaxLength(100))
+});
+var MessageFindingPayload = Schema8.Struct({
+  type: Schema8.Literal("finding"),
+  severity: Schema8.Union([
+    Schema8.Literal("info"),
+    Schema8.Literal("low"),
+    Schema8.Literal("medium"),
+    Schema8.Literal("high"),
+    Schema8.Literal("critical")
   ]),
-  category: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(120)),
+  category: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(120)),
   summary: BoundedText,
   evidenceRefs: MessageEvidenceRefs
 });
-var MessagePartialResultPayload = Schema9.Struct({
-  type: Schema9.Literal("partial_result"),
+var MessagePartialResultPayload = Schema8.Struct({
+  type: Schema8.Literal("partial_result"),
   outputSchema: RunSchemaRef,
   data: SafeJson,
-  complete: Schema9.Literal(false)
+  complete: Schema8.Literal(false)
 });
-var MessageHandoffPayload = Schema9.Struct({
-  type: Schema9.Literal("handoff"),
+var MessageHandoffPayload = Schema8.Struct({
+  type: Schema8.Literal("handoff"),
   summary: BoundedText,
-  nextAction: Schema9.optionalKey(Schema9.String.check(Schema9.isMaxLength(4000))),
-  evidenceRefs: Schema9.optionalKey(MessageEvidenceRefs)
+  nextAction: Schema8.optionalKey(Schema8.String.check(Schema8.isMaxLength(4000))),
+  evidenceRefs: Schema8.optionalKey(MessageEvidenceRefs)
 });
-var MessageInstructionPayload = Schema9.Struct({
-  type: Schema9.Literal("instruction"),
+var MessageInstructionPayload = Schema8.Struct({
+  type: Schema8.Literal("instruction"),
   instruction: BoundedText,
-  authority: Schema9.Union([Schema9.Literal("normal"), Schema9.Literal("operator")])
+  authority: Schema8.Union([Schema8.Literal("normal"), Schema8.Literal("operator")])
 });
-var MessageNoticePayload = Schema9.Struct({
-  type: Schema9.Literal("notice"),
-  code: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(120)),
+var MessageNoticePayload = Schema8.Struct({
+  type: Schema8.Literal("notice"),
+  code: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(120)),
   summary: BoundedText
 });
-var RunMessagePayload = Schema9.Union([
+var RunMessagePayload = Schema8.Union([
   MessageProgressPayload,
   MessageQuestionPayload,
   MessageAnswerPayload,
@@ -1551,94 +823,94 @@ var RunMessagePayload = Schema9.Union([
   MessageInstructionPayload,
   MessageNoticePayload
 ]);
-var RunMessage = Schema9.Struct({
+var RunMessage = Schema8.Struct({
   contractVersion: RunContractVersion,
   id: Id,
   workspaceId: Id,
-  teamId: Schema9.optionalKey(Id),
+  teamId: Schema8.optionalKey(Id),
   rootRunId: Id,
-  sender: Schema9.Union([
-    Schema9.Struct({ kind: Schema9.Union([Schema9.Literal("run"), Schema9.Literal("step_attempt")]), id: Id }),
+  sender: Schema8.Union([
+    Schema8.Struct({ kind: Schema8.Union([Schema8.Literal("run"), Schema8.Literal("step_attempt")]), id: Id }),
     RunActorRef
   ]),
-  recipient: Schema9.Struct({ kind: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(80)), id: Id }),
+  recipient: Schema8.Struct({ kind: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(80)), id: Id }),
   type: RunMessageType,
-  streamKey: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(240)),
-  sequence: Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(1)),
-  correlationId: Schema9.optionalKey(Id),
-  causationId: Schema9.optionalKey(Id),
-  replyToMessageId: Schema9.optionalKey(Id),
-  payloadSchema: Schema9.optionalKey(RunSchemaRef),
+  streamKey: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(240)),
+  sequence: Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(1)),
+  correlationId: Schema8.optionalKey(Id),
+  causationId: Schema8.optionalKey(Id),
+  replyToMessageId: Schema8.optionalKey(Id),
+  payloadSchema: Schema8.optionalKey(RunSchemaRef),
   payload: RunMessagePayload,
-  delivery: Schema9.Union([
-    Schema9.Literal("created"),
-    Schema9.Literal("queued"),
-    Schema9.Literal("delivered"),
-    Schema9.Literal("acknowledged"),
-    Schema9.Literal("expired"),
-    Schema9.Literal("failed")
+  delivery: Schema8.Union([
+    Schema8.Literal("created"),
+    Schema8.Literal("queued"),
+    Schema8.Literal("delivered"),
+    Schema8.Literal("acknowledged"),
+    Schema8.Literal("expired"),
+    Schema8.Literal("failed")
   ]),
-  idempotencyKey: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(240)),
-  expiresAt: Schema9.optionalKey(Timestamp),
+  idempotencyKey: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(240)),
+  expiresAt: Schema8.optionalKey(Timestamp),
   createdAt: Timestamp,
-  acknowledgedAt: Schema9.optionalKey(Timestamp)
+  acknowledgedAt: Schema8.optionalKey(Timestamp)
 });
-var RunResult = Schema9.Struct({
+var RunResult = Schema8.Struct({
   contractVersion: RunContractVersion,
   id: Id,
   workspaceId: Id,
-  teamId: Schema9.optionalKey(Id),
+  teamId: Schema8.optionalKey(Id),
   runId: Id,
   rootRunId: Id,
-  attempt: Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(1)),
-  outcome: Schema9.Union([
-    Schema9.Literal("succeeded"),
-    Schema9.Literal("failed"),
-    Schema9.Literal("canceled"),
-    Schema9.Literal("blocked"),
-    Schema9.Literal("expired")
+  attempt: Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(1)),
+  outcome: Schema8.Union([
+    Schema8.Literal("succeeded"),
+    Schema8.Literal("failed"),
+    Schema8.Literal("canceled"),
+    Schema8.Literal("blocked"),
+    Schema8.Literal("expired")
   ]),
-  output: Schema9.optionalKey(Schema9.Struct({ schema: RunSchemaRef, data: SafeJson, digest: Sha2563 })),
-  failure: Schema9.optionalKey(Schema9.Struct({
-    code: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(120)),
-    category: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(80)),
+  output: Schema8.optionalKey(Schema8.Struct({ schema: RunSchemaRef, data: SafeJson, digest: Sha256 })),
+  failure: Schema8.optionalKey(Schema8.Struct({
+    code: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(120)),
+    category: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(80)),
     summary: BoundedText,
-    retryable: Schema9.Boolean,
-    details: Schema9.optionalKey(SafeJson)
+    retryable: Schema8.Boolean,
+    details: Schema8.optionalKey(SafeJson)
   })),
-  evidenceRefs: Schema9.Array(Schema9.Union([RunResourceRef, EvidenceRef])).check(Schema9.isMaxLength(100)),
-  childSummary: Schema9.Struct({
-    awaited: Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(0)),
-    detached: Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(0)),
-    succeeded: Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(0)),
-    failed: Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(0)),
-    canceled: Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(0))
+  evidenceRefs: Schema8.Array(Schema8.Union([RunResourceRef, EvidenceRef])).check(Schema8.isMaxLength(100)),
+  childSummary: Schema8.Struct({
+    awaited: Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(0)),
+    detached: Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(0)),
+    succeeded: Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(0)),
+    failed: Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(0)),
+    canceled: Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(0))
   }),
-  usage: Schema9.optionalKey(Schema9.Record(SafeKey, SafeJson).check(Schema9.isMaxProperties(20))),
-  producedBy: Schema9.Struct({
-    workUnitId: Schema9.optionalKey(Id),
-    leaseId: Schema9.optionalKey(Id),
-    fencingTokenDigest: Schema9.optionalKey(Sha2563)
+  usage: Schema8.optionalKey(Schema8.Record(SafeKey, SafeJson).check(Schema8.isMaxProperties(20))),
+  producedBy: Schema8.Struct({
+    workUnitId: Schema8.optionalKey(Id),
+    leaseId: Schema8.optionalKey(Id),
+    fencingTokenDigest: Schema8.optionalKey(Sha256)
   }),
   createdAt: Timestamp,
   finalizedAt: Timestamp
 });
-var RunEvent = Schema9.Struct({
+var RunEvent = Schema8.Struct({
   contractVersion: RunContractVersion,
   id: Id,
-  eventVersion: Schema9.Literal(1),
+  eventVersion: Schema8.Literal(1),
   streamId: Id,
-  sequence: Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(1)),
+  sequence: Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(1)),
   workspaceId: Id,
-  teamId: Schema9.optionalKey(Id),
+  teamId: Schema8.optionalKey(Id),
   subject: RunResourceRef,
   rootRunId: Id,
-  type: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(100)),
-  actor: Schema9.optionalKey(RunActorRef),
-  correlationId: Schema9.optionalKey(Id),
-  causationId: Schema9.optionalKey(Id),
+  type: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(100)),
+  actor: Schema8.optionalKey(RunActorRef),
+  correlationId: Schema8.optionalKey(Id),
+  causationId: Schema8.optionalKey(Id),
   occurredAt: Timestamp,
-  data: Schema9.Struct({ type: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(100)), value: SafeJson })
+  data: Schema8.Struct({ type: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(100)), value: SafeJson })
 });
 var WaitKinds = [
   "timer",
@@ -1650,44 +922,44 @@ var WaitKinds = [
   "provider_quota",
   "resource"
 ];
-var WaitKind = Schema9.Literals(WaitKinds);
-var Wait = Schema9.Struct({
+var WaitKind = Schema8.Literals(WaitKinds);
+var Wait = Schema8.Struct({
   contractVersion: RunContractVersion,
   id: Id,
   workspaceId: Id,
-  teamId: Schema9.optionalKey(Id),
+  teamId: Schema8.optionalKey(Id),
   runId: Id,
   rootRunId: Id,
-  stepKey: Schema9.optionalKey(Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(160))),
+  stepKey: Schema8.optionalKey(Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(160))),
   kind: WaitKind,
-  state: Schema9.Union([
-    Schema9.Literal("open"),
-    Schema9.Literal("resolved"),
-    Schema9.Literal("expired"),
-    Schema9.Literal("canceled")
+  state: Schema8.Union([
+    Schema8.Literal("open"),
+    Schema8.Literal("resolved"),
+    Schema8.Literal("expired"),
+    Schema8.Literal("canceled")
   ]),
-  correlation: Schema9.Record(SafeKey, SafeJson).check(Schema9.isMaxProperties(20)),
-  expectedSchema: Schema9.optionalKey(RunSchemaRef),
-  timeout: Schema9.Struct({
-    dueAt: Schema9.optionalKey(Timestamp),
-    onTimeout: Schema9.Union([
-      Schema9.Literal("fail"),
-      Schema9.Literal("block"),
-      Schema9.Literal("cancel"),
-      Schema9.Literal("default"),
-      Schema9.Literal("escalate")
+  correlation: Schema8.Record(SafeKey, SafeJson).check(Schema8.isMaxProperties(20)),
+  expectedSchema: Schema8.optionalKey(RunSchemaRef),
+  timeout: Schema8.Struct({
+    dueAt: Schema8.optionalKey(Timestamp),
+    onTimeout: Schema8.Union([
+      Schema8.Literal("fail"),
+      Schema8.Literal("block"),
+      Schema8.Literal("cancel"),
+      Schema8.Literal("default"),
+      Schema8.Literal("escalate")
     ]),
-    defaultValue: Schema9.optionalKey(SafeJson)
+    defaultValue: Schema8.optionalKey(SafeJson)
   }),
-  responderScope: Schema9.optionalKey(RunResourceRef),
-  resolution: Schema9.optionalKey(Schema9.Struct({
-    kind: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(80)),
-    data: Schema9.optionalKey(SafeJson),
-    digest: Sha2563,
-    actor: Schema9.optionalKey(RunActorRef)
+  responderScope: Schema8.optionalKey(RunResourceRef),
+  resolution: Schema8.optionalKey(Schema8.Struct({
+    kind: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(80)),
+    data: Schema8.optionalKey(SafeJson),
+    digest: Sha256,
+    actor: Schema8.optionalKey(RunActorRef)
   })),
   createdAt: Timestamp,
-  resolvedAt: Schema9.optionalKey(Timestamp)
+  resolvedAt: Schema8.optionalKey(Timestamp)
 });
 var ControlCommandKinds = [
   "pause",
@@ -1713,74 +985,74 @@ var ControlCommandKinds = [
   "request_status",
   "request_handoff"
 ];
-var ControlCommandKind = Schema9.Literals(ControlCommandKinds);
-var ControlCommand = Schema9.Struct({
+var ControlCommandKind = Schema8.Literals(ControlCommandKinds);
+var ControlCommand = Schema8.Struct({
   contractVersion: RunContractVersion,
   id: Id,
   workspaceId: Id,
-  teamId: Schema9.optionalKey(Id),
+  teamId: Schema8.optionalKey(Id),
   target: RunResourceRef,
   kind: ControlCommandKind,
-  payload: Schema9.Struct({ kind: ControlCommandKind, data: SafeJson }),
+  payload: Schema8.Struct({ kind: ControlCommandKind, data: SafeJson }),
   requestedBy: RunActorRef,
-  idempotencyKey: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(240)),
-  expectedResourceVersion: Schema9.optionalKey(Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(1))),
-  status: Schema9.Union([
-    Schema9.Literal("accepted"),
-    Schema9.Literal("queued"),
-    Schema9.Literal("applied"),
-    Schema9.Literal("rejected"),
-    Schema9.Literal("expired"),
-    Schema9.Literal("superseded")
+  idempotencyKey: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(240)),
+  expectedResourceVersion: Schema8.optionalKey(Schema8.Int.check(Schema8.isGreaterThanOrEqualTo(1))),
+  status: Schema8.Union([
+    Schema8.Literal("accepted"),
+    Schema8.Literal("queued"),
+    Schema8.Literal("applied"),
+    Schema8.Literal("rejected"),
+    Schema8.Literal("expired"),
+    Schema8.Literal("superseded")
   ]),
-  rejection: Schema9.optionalKey(Schema9.Struct({ code: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(120)), summary: BoundedText })),
+  rejection: Schema8.optionalKey(Schema8.Struct({ code: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(120)), summary: BoundedText })),
   createdAt: Timestamp,
-  appliedAt: Schema9.optionalKey(Timestamp)
-});
-var ControlCommandList = Schema9.Struct({ items: Schema9.Array(ControlCommand).check(Schema9.isMaxLength(50)) });
-var RunCommandCenterSnapshot = Schema9.Struct({
-  source: Schema9.Literal("http_snapshot"),
-  collection: Schema9.Literal("run_command_center"),
-  scope: Schema9.Struct({
-    kind: Schema9.Literal("run"),
+  appliedAt: Schema8.optionalKey(Timestamp)
+});
+var ControlCommandList = Schema8.Struct({ items: Schema8.Array(ControlCommand).check(Schema8.isMaxLength(50)) });
+var RunCommandCenterSnapshot = Schema8.Struct({
+  source: Schema8.Literal("http_snapshot"),
+  collection: Schema8.Literal("run_command_center"),
+  scope: Schema8.Struct({
+    kind: Schema8.Literal("run"),
     workspaceId: Id,
-    teamId: Schema9.optionalKey(Id),
+    teamId: Schema8.optionalKey(Id),
     runId: Id
   }),
   capturedAt: Timestamp,
-  consistency: Schema9.Literal("lower_bound"),
-  lowerBound: Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(512)),
-  isComplete: Schema9.Literal(true)
+  consistency: Schema8.Literal("lower_bound"),
+  lowerBound: Schema8.String.check(Schema8.isMinLength(1), Schema8.isMaxLength(512)),
+  isComplete: Schema8.Literal(true)
 });
 
 // packages/core/src/extension.ts
 var NativeExtensionTargets = ["runner_backend", "harness", "sandbox"];
-var NativeExtensionTarget = Schema10.Literals(NativeExtensionTargets);
+var NativeExtensionTarget = Schema9.Literals(NativeExtensionTargets);
 var NativeExtensionPolicies = ["optional", "required"];
-var NativeExtensionPolicy = Schema10.Literals(NativeExtensionPolicies);
-var NativeExtensionIdentity = Schema10.String.check(Schema10.isMinLength(3), Schema10.isMaxLength(120), Schema10.isPattern(new RegExp("^[a-z0-9][a-z0-9_-]*(\\.[a-z0-9][a-z0-9_-]*)+$", "u")));
-var NativeExtensionRef = Schema10.Struct({
+var NativeExtensionPolicy = Schema9.Literals(NativeExtensionPolicies);
+var NativeExtensionIdentity = Schema9.String.check(Schema9.isMinLength(3), Schema9.isMaxLength(120), Schema9.isPattern(new RegExp("^[a-z0-9][a-z0-9_-]*(\\.[a-z0-9][a-z0-9_-]*)+$", "u")));
+var NativeExtensionRef = Schema9.Struct({
   extensionId: NativeExtensionIdentity,
-  version: Schema10.Int.check(Schema10.isGreaterThanOrEqualTo(1), Schema10.isLessThanOrEqualTo(10)),
+  version: Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(1), Schema9.isLessThanOrEqualTo(10)),
   policy: NativeExtensionPolicy,
-  requiredCapabilities: Schema10.optionalKey(Schema10.Array(Schema10.String.check(Schema10.isMinLength(1), Schema10.isMaxLength(120))).check(Schema10.isMaxLength(50))),
-  configuration: Schema10.optionalKey(Schema10.Record(Schema10.String.check(Schema10.isMinLength(1), Schema10.isMaxLength(120)), SafeJson).check(Schema10.isMaxProperties(40)))
+  requiredCapabilities: Schema9.optionalKey(Schema9.Array(Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(120))).check(Schema9.isMaxLength(50))),
+  configuration: Schema9.optionalKey(Schema9.Record(Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(120)), SafeJson).check(Schema9.isMaxProperties(40)))
 });
-var NativeExtensionDescriptor = Schema10.Struct({
+var NativeExtensionDescriptor = Schema9.Struct({
   extensionId: NativeExtensionIdentity,
-  version: Schema10.Int.check(Schema10.isGreaterThanOrEqualTo(1), Schema10.isLessThanOrEqualTo(10)),
+  version: Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(1), Schema9.isLessThanOrEqualTo(10)),
   target: NativeExtensionTarget,
-  requiredCapabilities: Schema10.Array(Schema10.String.check(Schema10.isMinLength(1), Schema10.isMaxLength(120))).check(Schema10.isMaxLength(50)),
-  configurationSchema: Schema10.optionalKey(Schema10.Record(Schema10.String.check(Schema10.isMinLength(1), Schema10.isMaxLength(120)), SafeJson).check(Schema10.isMaxProperties(80))),
-  resultSchema: Schema10.optionalKey(Schema10.Record(Schema10.String.check(Schema10.isMinLength(1), Schema10.isMaxLength(120)), SafeJson).check(Schema10.isMaxProperties(80))),
-  observability: Schema10.Struct({
-    transcriptPolicy: Schema10.Literal("metadata_only"),
-    maxMetadataChars: Schema10.optionalKey(Schema10.Int.check(Schema10.isGreaterThanOrEqualTo(1), Schema10.isLessThanOrEqualTo(65536)))
+  requiredCapabilities: Schema9.Array(Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(120))).check(Schema9.isMaxLength(50)),
+  configurationSchema: Schema9.optionalKey(Schema9.Record(Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(120)), SafeJson).check(Schema9.isMaxProperties(80))),
+  resultSchema: Schema9.optionalKey(Schema9.Record(Schema9.String.check(Schema9.isMinLength(1), Schema9.isMaxLength(120)), SafeJson).check(Schema9.isMaxProperties(80))),
+  observability: Schema9.Struct({
+    transcriptPolicy: Schema9.Literal("metadata_only"),
+    maxMetadataChars: Schema9.optionalKey(Schema9.Int.check(Schema9.isGreaterThanOrEqualTo(1), Schema9.isLessThanOrEqualTo(65536)))
   })
 });
 
 // packages/core/src/proposal.ts
-import * as Schema11 from "effect/Schema";
+import * as Schema10 from "effect/Schema";
 var ProposalStatuses = [
   "proposed",
   "in_review",
@@ -1798,16 +1070,6 @@ var KitMarketplaceProposalTargetTypes = [
   "kit_activation",
   "kit_trust_policy"
 ];
-var KitMarketplaceProposalActions = [
-  "source_publish",
-  "version_publish",
-  "source_update",
-  "trust_change",
-  "visibility_change",
-  "broad_activation",
-  "risky_agent_environment_effect",
-  "rollback"
-];
 var ProposalTargetTypes = [
   "memory",
   "kit",
@@ -1903,115 +1165,105 @@ var ForbiddenProposalNormalizedKeySet = new Set(ForbiddenProposalNormalizedKeys)
 var ProposalSafePayloadKeyPattern = `^(?!(?:${proposalForbiddenKeyVariants().map(escapeRegExp).join("|")})$).+$`;
 var ProposalForbiddenContentPattern = "sk-[A-Za-z0-9_-]{8,}|ghp_[A-Za-z0-9_]+|glpat-[A-Za-z0-9_-]+|\\bBearer\\s+[A-Za-z0-9._~+/=-]+|eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+|[dD][iI][fF][fF]\\s+--git|[rR][aA][wW]\\s+(?:[tT][eE][rR][mM][iI][nN][aA][lL]\\s+)?[lL][oO][gG]s?|[tT][eE][rR][mM][iI][nN][aA][lL]\\s+[oO][uU][tT][pP][uU][tT]|[rR][aA][wW]\\s+[tT][rR][aA][nN][sS][cC][rR][iI][pP][tT]s?|[sS][oO][uU][rR][cC][eE]\\s+[cC][oO][dD][eE]|[fF][iI][lL][eE]\\s+[cC][oO][nN][tT][eE][nN][tT]";
 var ProposalSafeStringPattern = `^(?!.*(?:${ProposalForbiddenContentPattern})).*$`;
-var ProposalStatus = Schema11.Literals(ProposalStatuses);
-var ProposalTargetType = Schema11.Literals(ProposalTargetTypes);
-var ProposalRiskLevel = Schema11.Literals(ProposalRiskLevels);
-var ProposalApprovalPolicyMode = Schema11.Literals(ProposalApprovalPolicyModes);
-var ProposalPolicyViolationCode = Schema11.Literals(ProposalPolicyViolationCodes);
-var ProposalPolicyViolationSeverity = Schema11.Literals(ProposalPolicyViolationSeverities);
-var ProposalCheckKind = Schema11.Literals(ProposalCheckKinds);
-var ProposalCheckStatus = Schema11.Literals(ProposalCheckStatuses);
-var ProposalApplicationAction = Schema11.Literals(ProposalApplicationActions);
-var ProposalRenderedDiffFormat = Schema11.Literals(ProposalRenderedDiffFormats);
-var ProposalRenderedDiffSectionRisk = Schema11.Literals(ProposalRenderedDiffSectionRisks);
-var ProposalRenderedDiffRefKind = Schema11.Literals(ProposalRenderedDiffRefKinds);
-var ProposalSafeString = Schema11.String.check(Schema11.isMaxLength(4000), Schema11.isPattern(new RegExp(ProposalSafeStringPattern, "u")));
-var ProposalSafeMetadataScalar = Schema11.Union([ProposalSafeString, Schema11.Finite, Schema11.Boolean, Schema11.Null]);
-var ProposalSafeMetadataValue = Schema11.Union([
+var ProposalStatus = Schema10.Literals(ProposalStatuses);
+var ProposalTargetType = Schema10.Literals(ProposalTargetTypes);
+var ProposalRiskLevel = Schema10.Literals(ProposalRiskLevels);
+var ProposalApprovalPolicyMode = Schema10.Literals(ProposalApprovalPolicyModes);
+var ProposalPolicyViolationCode = Schema10.Literals(ProposalPolicyViolationCodes);
+var ProposalPolicyViolationSeverity = Schema10.Literals(ProposalPolicyViolationSeverities);
+var ProposalCheckKind = Schema10.Literals(ProposalCheckKinds);
+var ProposalCheckStatus = Schema10.Literals(ProposalCheckStatuses);
+var ProposalApplicationAction = Schema10.Literals(ProposalApplicationActions);
+var ProposalRenderedDiffFormat = Schema10.Literals(ProposalRenderedDiffFormats);
+var ProposalRenderedDiffSectionRisk = Schema10.Literals(ProposalRenderedDiffSectionRisks);
+var ProposalRenderedDiffRefKind = Schema10.Literals(ProposalRenderedDiffRefKinds);
+var ProposalSafeString = Schema10.String.check(Schema10.isMaxLength(4000), Schema10.isPattern(new RegExp(ProposalSafeStringPattern, "u")));
+var ProposalSafeMetadataScalar = Schema10.Union([ProposalSafeString, Schema10.Finite, Schema10.Boolean, Schema10.Null]);
+var ProposalSafeMetadataValue = Schema10.Union([
   ProposalSafeMetadataScalar,
-  Schema11.Array(ProposalSafeMetadataScalar).check(Schema11.isMaxLength(100))
+  Schema10.Array(ProposalSafeMetadataScalar).check(Schema10.isMaxLength(100))
 ]);
-var ProposalSafeMetadata = Schema11.Record(Schema11.String.check(Schema11.isMinLength(1), Schema11.isPattern(new RegExp(ProposalSafePayloadKeyPattern, "u"))), ProposalSafeMetadataValue);
-var ProposalPayload = Schema11.Struct({
-  memory: Schema11.optionalKey(ProposalSafeMetadata),
-  kit: Schema11.optionalKey(ProposalSafeMetadata),
-  kit_source: Schema11.optionalKey(ProposalSafeMetadata),
-  kit_version: Schema11.optionalKey(ProposalSafeMetadata),
-  kit_installation: Schema11.optionalKey(ProposalSafeMetadata),
-  kit_activation: Schema11.optionalKey(ProposalSafeMetadata),
-  kit_trust_policy: Schema11.optionalKey(ProposalSafeMetadata),
-  agent_environment_policy: Schema11.optionalKey(ProposalSafeMetadata),
-  decision: Schema11.optionalKey(ProposalSafeMetadata),
-  task: Schema11.optionalKey(ProposalSafeMetadata),
-  team_context: Schema11.optionalKey(ProposalSafeMetadata),
-  context_relevance: Schema11.optionalKey(ProposalSafeMetadata)
-});
-var ProposalTargetRef = Schema11.Struct({
+var ProposalSafeMetadata = Schema10.Record(Schema10.String.check(Schema10.isMinLength(1), Schema10.isPattern(new RegExp(ProposalSafePayloadKeyPattern, "u"))), ProposalSafeMetadataValue);
+var ProposalPayload = Schema10.Struct({
+  memory: Schema10.optionalKey(ProposalSafeMetadata),
+  kit: Schema10.optionalKey(ProposalSafeMetadata),
+  kit_source: Schema10.optionalKey(ProposalSafeMetadata),
+  kit_version: Schema10.optionalKey(ProposalSafeMetadata),
+  kit_installation: Schema10.optionalKey(ProposalSafeMetadata),
+  kit_activation: Schema10.optionalKey(ProposalSafeMetadata),
+  kit_trust_policy: Schema10.optionalKey(ProposalSafeMetadata),
+  agent_environment_policy: Schema10.optionalKey(ProposalSafeMetadata),
+  decision: Schema10.optionalKey(ProposalSafeMetadata),
+  task: Schema10.optionalKey(ProposalSafeMetadata),
+  team_context: Schema10.optionalKey(ProposalSafeMetadata),
+  context_relevance: Schema10.optionalKey(ProposalSafeMetadata)
+});
+var ProposalTargetRef = Schema10.Struct({
   type: ProposalTargetType,
-  id: Schema11.optionalKey(Id),
-  scopeType: Schema11.optionalKey(Schema11.Union([Schema11.Literal("workspace"), Schema11.Literal("team"), Schema11.Literal("task"), Schema11.Literal("kit")])),
-  scopeId: Schema11.optionalKey(Id)
+  id: Schema10.optionalKey(Id),
+  scopeType: Schema10.optionalKey(Schema10.Union([Schema10.Literal("workspace"), Schema10.Literal("team"), Schema10.Literal("task"), Schema10.Literal("kit")])),
+  scopeId: Schema10.optionalKey(Id)
 });
-var ProposalApprovalPolicy = Schema11.Struct({
+var ProposalApprovalPolicy = Schema10.Struct({
   mode: ProposalApprovalPolicyMode,
-  requireDifferentApprover: Schema11.optionalKey(Schema11.Boolean),
-  autonomousAgentApprovalAllowed: Schema11.Literal(false),
-  deniedViolationCodes: Schema11.Array(ProposalPolicyViolationCode)
+  requireDifferentApprover: Schema10.optionalKey(Schema10.Boolean),
+  autonomousAgentApprovalAllowed: Schema10.Literal(false),
+  deniedViolationCodes: Schema10.Array(ProposalPolicyViolationCode)
 });
-var ProposalPolicyViolation = Schema11.Struct({
+var ProposalPolicyViolation = Schema10.Struct({
   code: ProposalPolicyViolationCode,
   severity: ProposalPolicyViolationSeverity,
   message: ProposalSafeString,
-  actorId: Schema11.optionalKey(Id),
-  target: Schema11.optionalKey(ProposalTargetRef),
-  metadata: Schema11.optionalKey(ProposalSafeMetadata)
+  actorId: Schema10.optionalKey(Id),
+  target: Schema10.optionalKey(ProposalTargetRef),
+  metadata: Schema10.optionalKey(ProposalSafeMetadata)
 });
-var ProposalRenderedDiffRef = Schema11.Struct({
+var ProposalRenderedDiffRef = Schema10.Struct({
   kind: ProposalRenderedDiffRefKind,
-  id: Schema11.optionalKey(Id),
-  externalId: Schema11.optionalKey(Schema11.String.check(Schema11.isMinLength(1))),
-  url: Schema11.optionalKey(Schema11.String.check(Schema11.isMinLength(1))),
-  title: Schema11.optionalKey(Schema11.String.check(Schema11.isMinLength(1), Schema11.isMaxLength(240)))
-});
-var ProposalRenderedDiffSection = Schema11.Struct({
-  title: Schema11.String.check(Schema11.isMinLength(1), Schema11.isMaxLength(240), Schema11.isPattern(new RegExp(ProposalSafeStringPattern, "u"))),
-  beforeSummary: Schema11.optionalKey(ProposalSafeString),
-  afterSummary: Schema11.optionalKey(ProposalSafeString),
+  id: Schema10.optionalKey(Id),
+  externalId: Schema10.optionalKey(Schema10.String.check(Schema10.isMinLength(1))),
+  url: Schema10.optionalKey(Schema10.String.check(Schema10.isMinLength(1))),
+  title: Schema10.optionalKey(Schema10.String.check(Schema10.isMinLength(1), Schema10.isMaxLength(240)))
+});
+var ProposalRenderedDiffSection = Schema10.Struct({
+  title: Schema10.String.check(Schema10.isMinLength(1), Schema10.isMaxLength(240), Schema10.isPattern(new RegExp(ProposalSafeStringPattern, "u"))),
+  beforeSummary: Schema10.optionalKey(ProposalSafeString),
+  afterSummary: Schema10.optionalKey(ProposalSafeString),
   risk: ProposalRenderedDiffSectionRisk
 });
-var ProposalRenderedDiff = Schema11.Struct({
+var ProposalRenderedDiff = Schema10.Struct({
   format: ProposalRenderedDiffFormat,
-  title: Schema11.String.check(Schema11.isMinLength(1), Schema11.isMaxLength(240), Schema11.isPattern(new RegExp(ProposalSafeStringPattern, "u"))),
+  title: Schema10.String.check(Schema10.isMinLength(1), Schema10.isMaxLength(240), Schema10.isPattern(new RegExp(ProposalSafeStringPattern, "u"))),
   summary: ProposalSafeString,
-  sections: Schema11.Array(ProposalRenderedDiffSection),
-  refs: Schema11.Array(ProposalRenderedDiffRef)
+  sections: Schema10.Array(ProposalRenderedDiffSection),
+  refs: Schema10.Array(ProposalRenderedDiffRef)
 });
-var ProposalRiskSummary = Schema11.Struct({
+var ProposalRiskSummary = Schema10.Struct({
   level: ProposalRiskLevel,
   summary: ProposalSafeString,
-  reasons: Schema11.Array(ProposalSafeString)
+  reasons: Schema10.Array(ProposalSafeString)
 });
-var KitMarketplaceProposalAction = Schema11.Literals(KitMarketplaceProposalActions);
-var KitMarketplaceProposalReview = Schema11.Struct({
-  action: KitMarketplaceProposalAction,
-  target: ProposalTargetRef,
-  payload: ProposalPayload,
-  renderedDiff: ProposalRenderedDiff,
-  riskSummary: ProposalRiskSummary,
-  validationFindings: Schema11.Array(ProposalPolicyViolation),
-  approvalPolicy: ProposalApprovalPolicy
-});
-var Proposal = Schema11.Struct({
+var Proposal = Schema10.Struct({
   id: Id,
   workspaceId: Id,
-  teamId: Schema11.optionalKey(Id),
-  taskId: Schema11.optionalKey(Id),
+  teamId: Schema10.optionalKey(Id),
+  taskId: Schema10.optionalKey(Id),
   target: ProposalTargetRef,
-  title: Schema11.String.check(Schema11.isMinLength(1), Schema11.isMaxLength(240), Schema11.isPattern(new RegExp(ProposalSafeStringPattern, "u"))),
+  title: Schema10.String.check(Schema10.isMinLength(1), Schema10.isMaxLength(240), Schema10.isPattern(new RegExp(ProposalSafeStringPattern, "u"))),
   summary: ProposalSafeString,
   status: ProposalStatus,
   riskLevel: ProposalRiskLevel,
   approvalPolicy: ProposalApprovalPolicy,
   proposedByActorType: ActorType,
   proposedByActorId: Id,
-  delegatedByUserId: Schema11.optionalKey(Id),
+  delegatedByUserId: Schema10.optionalKey(Id),
   createdAt: Timestamp,
   updatedAt: Timestamp
 });
-var ProposalRevision = Schema11.Struct({
+var ProposalRevision = Schema10.Struct({
   id: Id,
   proposalId: Id,
-  revisionNumber: Schema11.Int.check(Schema11.isGreaterThanOrEqualTo(1)),
+  revisionNumber: Schema10.Int.check(Schema10.isGreaterThanOrEqualTo(1)),
   payload: ProposalPayload,
   renderedDiff: ProposalRenderedDiff,
   riskSummary: ProposalRiskSummary,
@@ -2019,32 +1271,32 @@ var ProposalRevision = Schema11.Struct({
   createdByActorId: Id,
   createdAt: Timestamp
 });
-var ProposalCommentAnchor = Schema11.Struct({
-  path: Schema11.Array(Schema11.String.check(Schema11.isMinLength(1), Schema11.isPattern(new RegExp(ProposalSafePayloadKeyPattern, "u")))),
-  label: Schema11.optionalKey(Schema11.String.check(Schema11.isMinLength(1), Schema11.isMaxLength(120), Schema11.isPattern(new RegExp(ProposalSafeStringPattern, "u"))))
+var ProposalCommentAnchor = Schema10.Struct({
+  path: Schema10.Array(Schema10.String.check(Schema10.isMinLength(1), Schema10.isPattern(new RegExp(ProposalSafePayloadKeyPattern, "u")))),
+  label: Schema10.optionalKey(Schema10.String.check(Schema10.isMinLength(1), Schema10.isMaxLength(120), Schema10.isPattern(new RegExp(ProposalSafeStringPattern, "u"))))
 });
-var ProposalComment = Schema11.Struct({
+var ProposalComment = Schema10.Struct({
   id: Id,
   proposalId: Id,
-  revisionId: Schema11.optionalKey(Id),
+  revisionId: Schema10.optionalKey(Id),
   body: ProposalSafeString,
-  anchor: Schema11.optionalKey(ProposalCommentAnchor),
+  anchor: Schema10.optionalKey(ProposalCommentAnchor),
   actorType: ActorType,
   actorId: Id,
-  delegatedByUserId: Schema11.optionalKey(Id),
+  delegatedByUserId: Schema10.optionalKey(Id),
   createdAt: Timestamp
 });
-var ProposalCheck = Schema11.Struct({
+var ProposalCheck = Schema10.Struct({
   id: Id,
   proposalId: Id,
-  revisionId: Schema11.optionalKey(Id),
+  revisionId: Schema10.optionalKey(Id),
   kind: ProposalCheckKind,
   status: ProposalCheckStatus,
   summary: ProposalSafeString,
-  details: Schema11.optionalKey(ProposalSafeMetadata),
+  details: Schema10.optionalKey(ProposalSafeMetadata),
   createdAt: Timestamp
 });
-var ProposalApplication = Schema11.Struct({
+var ProposalApplication = Schema10.Struct({
   id: Id,
   proposalId: Id,
   revisionId: Id,
@@ -2052,9 +1304,9 @@ var ProposalApplication = Schema11.Struct({
   target: ProposalTargetRef,
   appliedByActorType: ActorType,
   appliedByActorId: Id,
-  targetVersionBefore: Schema11.optionalKey(Schema11.String.check(Schema11.isMinLength(1), Schema11.isMaxLength(240), Schema11.isPattern(new RegExp(ProposalSafeStringPattern, "u")))),
-  targetVersionAfter: Schema11.optionalKey(Schema11.String.check(Schema11.isMinLength(1), Schema11.isMaxLength(240), Schema11.isPattern(new RegExp(ProposalSafeStringPattern, "u")))),
-  rollbackRef: Schema11.optionalKey(Schema11.String.check(Schema11.isMinLength(1), Schema11.isMaxLength(240), Schema11.isPattern(new RegExp(ProposalSafeStringPattern, "u")))),
+  targetVersionBefore: Schema10.optionalKey(Schema10.String.check(Schema10.isMinLength(1), Schema10.isMaxLength(240), Schema10.isPattern(new RegExp(ProposalSafeStringPattern, "u")))),
+  targetVersionAfter: Schema10.optionalKey(Schema10.String.check(Schema10.isMinLength(1), Schema10.isMaxLength(240), Schema10.isPattern(new RegExp(ProposalSafeStringPattern, "u")))),
+  rollbackRef: Schema10.optionalKey(Schema10.String.check(Schema10.isMinLength(1), Schema10.isMaxLength(240), Schema10.isPattern(new RegExp(ProposalSafeStringPattern, "u")))),
   appliedAt: Timestamp
 });
 function proposalForbiddenKeyVariants() {
@@ -2068,6 +1320,13 @@ function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// packages/core/src/waiting-on.ts
+import * as Schema11 from "effect/Schema";
+var WaitingOn = Schema11.Struct({ keys: Schema11.Array(Schema11.String), hidden: Schema11.Int });
+
+// packages/core/src/run-queue.ts
+var ClaimRanks = ["in_progress", "finishing", "new"];
+
 // packages/core/src/loop.ts
 var LoopStatuses = ["draft", "active", "disabled", "archived"];
 var LoopStepImplementationKinds = [
@@ -2223,7 +1482,8 @@ var LoopRequiredRunStepStatus = Schema12.Literals(LoopRequiredRunStepStatuses);
 var LoopSafeRefKind = Schema12.Literals(LoopSafeRefKinds);
 var LoopSha256 = Schema12.String.check(Schema12.isPattern(new RegExp("^[a-fA-F0-9]{64}$", "u")));
 var LoopGitCommitSha = Schema12.String.check(Schema12.isPattern(new RegExp("^[a-fA-F0-9]{40}$|^[a-fA-F0-9]{64}$", "u")));
-var LoopReferenceForbiddenContentPattern = "(?:^|[^A-Za-z0-9])sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9_]+|github_pat_[A-Za-z0-9_]+|glpat-[A-Za-z0-9_-]+|\\b[Bb][Ee][Aa][Rr][Ee][Rr]\\s+[A-Za-z0-9._~+/=-]+|eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+|[dD][iI][fF][fF]\\s+--git|[rR][aA][wW]\\s+(?:[tT][eE][rR][mM][iI][nN][aA][lL]\\s+)?[lL][oO][gG]s?|[tT][eE][rR][mM][iI][nN][aA][lL]\\s+[oO][uU][tT][pP][uU][tT]|[rR][aA][wW]\\s+[tT][rR][aA][nN][sS][cC][rR][iI][pP][tT]s?|[sS][oO][uU][rR][cC][eE]\\s+[cC][oO][dD][eE]|[fF][iI][lL][eE]\\s+[cC][oO][nN][tT][eE][nN][tT]";
+var LoopCredentialContentPattern = "(?:^|[^A-Za-z0-9])sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9_]+|github_pat_[A-Za-z0-9_]+|glpat-[A-Za-z0-9_-]+|\\b[Bb][Ee][Aa][Rr][Ee][Rr]\\s+[A-Za-z0-9._~+/=-]+|eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+";
+var LoopReferenceForbiddenContentPattern = `${LoopCredentialContentPattern}|[dD][iI][fF][fF]\\s+--git|[rR][aA][wW]\\s+(?:[tT][eE][rR][mM][iI][nN][aA][lL]\\s+)?[lL][oO][gG]s?|[tT][eE][rR][mM][iI][nN][aA][lL]\\s+[oO][uU][tT][pP][uU][tT]|[rR][aA][wW]\\s+[tT][rR][aA][nN][sS][cC][rR][iI][pP][tT]s?|[sS][oO][uU][rR][cC][eE]\\s+[cC][oO][dD][eE]|[fF][iI][lL][eE]\\s+[cC][oO][nN][tT][eE][nN][tT]`;
 var LoopReferenceAndUrlForbiddenContentPattern = `${LoopReferenceForbiddenContentPattern}|[A-Za-z][A-Za-z0-9+.-]*://\\S+`;
 var LoopSafeReferencePattern = `^(?!.*(?:${LoopReferenceAndUrlForbiddenContentPattern})).*$`;
 var LoopScopeValueForbiddenContentPattern = LoopReferenceAndUrlForbiddenContentPattern;
@@ -2290,7 +1550,9 @@ var LoopForbiddenDataflowKeyRegExp = new RegExp(LoopForbiddenDataflowKeyPattern)
 var LoopForbiddenContentRegExp = new RegExp(LoopReferenceAndUrlForbiddenContentPattern);
 var LoopSafeReferenceString = Schema12.String.check(Schema12.isMinLength(1), Schema12.isMaxLength(240), Schema12.isPattern(new RegExp(LoopSafeReferencePattern, "u")));
 var LoopSafeInternalReferenceString = Schema12.String.check(Schema12.isMinLength(1), Schema12.isMaxLength(240), Schema12.isPattern(new RegExp(LoopSafeInternalReferencePattern, "u")));
-var LoopSafeText = Schema12.String.check(Schema12.isMaxLength(4000), Schema12.isPattern(new RegExp(LoopSafeReferencePattern, "u")));
+var LoopSafeText = Schema12.String.check(Schema12.isMaxLength(4000), Schema12.isPattern(new RegExp(`^(?![\\s\\S]*(?:${LoopCredentialContentPattern}|[A-Za-z][A-Za-z0-9+.-]*://(?:[^\\s/?#]*@|[^\\s?#]*\\?)))[\\s\\S]*$`, "u")));
+var recommendedDefault = (recommended) => recommended !== undefined && Schema12.is(LoopSafeText)(recommended) ? recommended : undefined;
+var QuestionText = Schema12.String;
 var LoopSafeOutputDataString = Schema12.String.check(Schema12.isMaxLength(4000), Schema12.isPattern(new RegExp(LoopSafeInternalReferencePattern, "u")));
 var LoopSafePackageName = Schema12.String.check(Schema12.isMinLength(1), Schema12.isMaxLength(200), Schema12.isPattern(new RegExp(LoopSafeReferencePattern, "u")));
 var LoopSafeScopeValue = Schema12.String.check(Schema12.isMinLength(1), Schema12.isMaxLength(240), Schema12.isPattern(new RegExp(LoopSafeScopeValuePattern, "u")));
@@ -2598,6 +1860,14 @@ var RunWaiting = Schema12.Union([
     kind: Schema12.Literal("verification"),
     name: Schema12.String.check(Schema12.isMinLength(1)),
     verificationId: Id
+  }),
+  Schema12.Struct({
+    kind: Schema12.Literal("queue"),
+    name: Schema12.String.check(Schema12.isMinLength(1)),
+    workUnitId: Id,
+    rank: Schema12.Literals(ClaimRanks),
+    position: Schema12.Int.check(Schema12.isGreaterThanOrEqualTo(1)),
+    reason: Schema12.String
   })
 ]);
 var RunEvidence = Schema12.Struct({
@@ -2620,6 +1890,7 @@ var ApprovedVerification = Schema12.Struct({
   name: Schema12.String,
   command: Schema12.String,
   workingDirectory: Schema12.optionalKey(Schema12.String),
+  pipeline: Schema12.optionalKey(Schema12.Boolean),
   approvedByUserId: Schema12.String,
   createdAt: Timestamp
 });
@@ -2667,14 +1938,16 @@ var Run = Schema12.Struct({
   taskId: Schema12.optionalKey(Id),
   sessionId: Schema12.optionalKey(Id),
   loopId: Id,
-  packageVersionId: Schema12.optionalKey(Id),
+  kitVersionId: Schema12.optionalKey(Id),
   resourceVersion: Schema12.Int.check(Schema12.isGreaterThanOrEqualTo(1)),
   status: RunStatus,
   trigger: RunTrigger,
   state: RunState,
   loopDigest: Schema12.optionalKey(BundleDigest),
   loopLayer: Schema12.optionalKey(Schema12.Literals(["team", "workspace", "shipped"])),
+  loopVersion: Schema12.optionalKey(Schema12.String),
   parentRunId: Schema12.optionalKey(Id),
+  continuesRunId: Schema12.optionalKey(Id),
   waiting: Schema12.optionalKey(Schema12.Array(RunWaiting)),
   output: Schema12.optionalKey(Schema12.Unknown),
   failureSummary: Schema12.optionalKey(Schema12.String),
@@ -2765,11 +2038,14 @@ var StepBrief = Schema12.Struct({
     contentMarkdown: Schema12.String.check(Schema12.isMinLength(1))
   })),
   outputSchema: JsonDocumentObject,
-  skills: Schema12.optionalKey(Schema12.Array(Schema12.Struct({
-    name: Schema12.String.check(Schema12.isPattern(new RegExp(skillNamePattern, "u"))),
-    files: Schema12.Record(Schema12.String.check(Schema12.isPattern(new RegExp(relativePathPattern, "u"))), Schema12.String)
+  kits: Schema12.optionalKey(Schema12.Array(Schema12.Struct({
+    name: Schema12.String.check(Schema12.isMinLength(1)),
+    version: Schema12.String.check(Schema12.isMinLength(1)),
+    setupDigest: Schema12.String.check(Schema12.isPattern(/^[a-f0-9]{64}$/u))
   }))),
-  toolless: Schema12.optionalKey(Schema12.Literal(true))
+  toolless: Schema12.optionalKey(Schema12.Literal(true)),
+  tools: Schema12.optionalKey(Schema12.Array(Schema12.Literals(AgentCapabilities))),
+  listedSkills: Schema12.optionalKey(Schema12.Array(Schema12.String.check(Schema12.isMinLength(1))))
 });
 var StepOutputSubmission = Schema12.Struct({ output: JsonDocumentObject });
 var StepSessionUpdate = Schema12.Struct({
@@ -2795,6 +2071,15 @@ var StepOutputSubmissionResult = Schema12.Union([
   }),
   Schema12.Struct({ status: Schema12.Literal("failed"), message: Schema12.String })
 ]);
+var HarnessHoldReasons = ["out_of_quota", "failed_to_start"];
+var SkippedChoiceReasons = ["not_on_runner", ...HarnessHoldReasons];
+var SkippedChoice = Schema12.Struct({
+  harness: Schema12.optionalKey(Schema12.String),
+  model: Schema12.optionalKey(Schema12.String),
+  effort: Schema12.optionalKey(Schema12.Literals(AgentEfforts)),
+  reason: Schema12.Literals(SkippedChoiceReasons),
+  until: Schema12.optionalKey(Timestamp)
+});
 var StepAttempt = Schema12.Struct({
   id: Id,
   workspaceId: Id,
@@ -2815,6 +2100,7 @@ var StepAttempt = Schema12.Struct({
   brief: Schema12.optionalKey(StepBrief),
   failureSummary: Schema12.optionalKey(LoopSafeText),
   reviewEvidence: Schema12.Array(LoopSafeRef),
+  skippedChoices: Schema12.optionalKey(Schema12.Array(SkippedChoice)),
   lease: Schema12.optionalKey(StepAttemptLease),
   claimIdempotencyKey: Schema12.optionalKey(LoopSafeReferenceString),
   terminalIdempotencyKey: Schema12.optionalKey(LoopSafeReferenceString),
@@ -2830,7 +2116,8 @@ var QuestionResponderPolicy = Schema12.Struct({
 });
 var QuestionAnswer = Schema12.Struct({
   value: LoopSafeText,
-  answeredByUserId: Id,
+  answeredByUserId: Schema12.optionalKey(Id),
+  byDefault: Schema12.optionalKey(Schema12.Boolean),
   answeredAt: Timestamp,
   idempotencyKey: Schema12.String.check(Schema12.isMinLength(1), Schema12.isMaxLength(240))
 });
@@ -2843,9 +2130,15 @@ var Question = Schema12.Struct({
   stepKey: Schema12.String.check(Schema12.isMinLength(1), Schema12.isMaxLength(240)),
   waitId: Id,
   taskThreadEntryId: Schema12.optionalKey(Id),
-  prompt: LoopSafeText,
-  options: Schema12.optionalKey(Schema12.Array(LoopSafeText)),
+  prompt: QuestionText,
+  options: Schema12.optionalKey(Schema12.Array(QuestionText)),
   freeText: Schema12.optionalKey(Schema12.Boolean),
+  optionDescriptions: Schema12.optionalKey(Schema12.Record(Schema12.String, QuestionText)),
+  recommended: Schema12.optionalKey(QuestionText),
+  recommendationReason: Schema12.optionalKey(QuestionText),
+  informationOnly: Schema12.optionalKey(Schema12.Boolean),
+  default: Schema12.optionalKey(LoopSafeText),
+  defaultAt: Schema12.optionalKey(Timestamp),
   responderPolicy: QuestionResponderPolicy,
   status: QuestionStatus,
   answer: Schema12.optionalKey(QuestionAnswer),
@@ -2876,8 +2169,11 @@ var RunStart = Schema12.Struct({
   input: Schema12.optionalKey(Schema12.Record(Schema12.String, Schema12.Unknown)),
   context: Schema12.optionalKey(RunLaunchContext),
   devVersionId: Schema12.optionalKey(Id),
-  constraints: Schema12.optionalKey(Schema12.Array(Schema12.String.check(Schema12.isMinLength(1), Schema12.isMaxLength(1000))).check(Schema12.isMaxLength(20)))
+  constraints: Schema12.optionalKey(Schema12.Array(Schema12.String.check(Schema12.isMinLength(1), Schema12.isMaxLength(1000))).check(Schema12.isMaxLength(20))),
+  fresh: Schema12.optionalKey(Schema12.Boolean),
+  overrideBlockers: Schema12.optionalKey(Schema12.Boolean)
 });
+var RunActionTake = Schema12.Struct({ overrideBlockers: Schema12.optionalKey(Schema12.Boolean) });
 var RunStarted = Schema12.Struct({
   run: Run,
   task: Schema12.optionalKey(Schema12.Struct({ id: Id, taskKey: Schema12.String })),
@@ -2917,6 +2213,12 @@ var RunSteerInput = Schema12.Struct({
   stepAttemptId: Schema12.optionalKey(Id),
   idempotencyKey: Schema12.String.check(Schema12.isMinLength(1), Schema12.isMaxLength(240))
 });
+var RunResumeInput = Schema12.Struct({
+  steer: Schema12.optionalKey(Schema12.Struct({
+    text: LoopSafeText,
+    idempotencyKey: Schema12.String.check(Schema12.isMinLength(1), Schema12.isMaxLength(240))
+  }))
+});
 var RunSteerSent = Schema12.Struct({
   steer: RunSteer,
   target: Schema12.Literals(["session", "next_step"])
@@ -2983,7 +2285,13 @@ var RunShow = Schema12.Struct({
   graph: RunGraph,
   steps: Schema12.Array(RunStepSummary),
   questions: Schema12.Array(Question),
-  children: Schema12.Array(Schema12.Struct({ runId: Id, name: Schema12.String, status: RunStatus, createdAt: Timestamp })),
+  children: Schema12.Array(Schema12.Struct({
+    runId: Id,
+    name: Schema12.String,
+    status: RunStatus,
+    createdAt: Timestamp,
+    unsettled: Schema12.optional(Schema12.Array(Schema12.String))
+  })),
   activities: Schema12.Array(Schema12.Struct({
     name: Schema12.String,
     attempt: Schema12.Int.check(Schema12.isGreaterThanOrEqualTo(1)),
@@ -3003,6 +2311,8 @@ var RunStartPreview = Schema12.Struct({
   inputSchema: Schema12.Record(Schema12.String, Schema12.Unknown),
   input: Schema12.Record(Schema12.String, Schema12.Unknown),
   missing: Schema12.Array(Schema12.String),
+  message: Schema12.optionalKey(Schema12.String),
+  waitingOn: Schema12.optionalKey(WaitingOn),
   teamId: Schema12.optionalKey(Id),
   inferred: Schema12.Struct({
     repoBindingId: Schema12.optionalKey(Id),
@@ -3012,15 +2322,22 @@ var RunStartPreview = Schema12.Struct({
     outcome: Schema12.optionalKey(Schema12.String)
   })
 });
+var LoopVersion = Schema12.String.check(Schema12.isPattern(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/));
 var ProgramLoop = Schema12.Struct({
   id: Schema12.String,
   title: Schema12.String,
+  version: Schema12.optionalKey(LoopVersion),
   layer: Schema12.Literals(["team", "workspace", "shipped"]),
   digest: Schema12.String,
   outcome: Schema12.optionalKey(Schema12.String),
-  offers: Schema12.Array(Schema12.Struct({ id: Schema12.String, title: Schema12.String, loop: Schema12.String })),
+  offers: Schema12.Array(Schema12.Struct({
+    id: Schema12.String,
+    title: Schema12.String,
+    loop: Schema12.String,
+    from: Schema12.optionalKey(Schema12.String)
+  })),
   publishedAt: Timestamp,
-  package: Schema12.String
+  kit: Schema12.String
 });
 var AutomaticStart = Schema12.Struct({
   eventId: Schema12.String,
@@ -3032,16 +2349,23 @@ var AutomaticStart = Schema12.Struct({
   at: Schema12.String
 });
 var AutomaticStartList = Schema12.Struct({ items: Schema12.Array(AutomaticStart) });
+var AgentFallback = Schema12.Struct({
+  harness: Schema12.String,
+  model: Schema12.optionalKey(Schema12.String),
+  effort: Schema12.optionalKey(Schema12.Literals(AgentEfforts))
+});
 var ProgramAgent = Schema12.Struct({
   id: Schema12.String,
   layer: Schema12.Literals(["team", "workspace", "shipped"]),
-  package: Schema12.String,
+  kit: Schema12.String,
   extends: Schema12.optionalKey(Schema12.String),
   instructions: Schema12.optionalKey(Schema12.String),
   harness: Schema12.optionalKey(Schema12.String),
   model: Schema12.optionalKey(Schema12.String),
   effort: Schema12.optionalKey(Schema12.Literals(AgentEfforts)),
-  kits: Schema12.optionalKey(Schema12.Array(Schema12.String)),
+  fallbacks: Schema12.optionalKey(Schema12.Array(AgentFallback)),
+  tools: Schema12.optionalKey(Schema12.Array(Schema12.Literals(AgentCapabilities))),
+  skills: Schema12.optionalKey(Schema12.Array(Schema12.String)),
   network: Schema12.optionalKey(AgentSandboxNetwork),
   sandbox: Schema12.optionalKey(Schema12.Literal("docker")),
   fieldLayers: Schema12.optionalKey(Schema12.Struct({
@@ -3049,7 +2373,9 @@ var ProgramAgent = Schema12.Struct({
     harness: Schema12.optionalKey(Schema12.Literals(LoopLayers)),
     model: Schema12.optionalKey(Schema12.Literals(LoopLayers)),
     effort: Schema12.optionalKey(Schema12.Literals(LoopLayers)),
-    kits: Schema12.optionalKey(Schema12.Literals(LoopLayers)),
+    fallbacks: Schema12.optionalKey(Schema12.Literals(LoopLayers)),
+    tools: Schema12.optionalKey(Schema12.Literals(LoopLayers)),
+    skills: Schema12.optionalKey(Schema12.Literals(LoopLayers)),
     network: Schema12.optionalKey(Schema12.Literals(LoopLayers)),
     sandbox: Schema12.optionalKey(Schema12.Literals(LoopLayers))
   }))
@@ -3171,7 +2497,7 @@ var ScheduleVersion = Schema13.Struct({
 var zones = new Map;
 var resolvedLocalDateTimes = new Map;
 
-// packages/core/src/package-declarations.ts
+// packages/core/src/kit-declarations.ts
 var LoopCapabilities2 = [
   "agent_work",
   "ask",
@@ -3182,33 +2508,40 @@ var LoopCapabilities2 = [
   "post_comment",
   "create_tasks",
   "merge_change_request",
+  "approve_change_request",
   "publish_release",
   "read_transcripts",
+  "read_change_request",
+  "measure",
+  "claim",
   "propose",
   "read_project",
   "draft_update"
 ];
 var JsonObject2 = Schema14.Record(Schema14.String, Schema14.Json);
-var recordKeyedBy = (pattern, value) => Schema14.Record(Schema14.String, value).check(Schema14.makeFilter((record) => {
-  const bad = Object.keys(record).find((key) => !new RegExp(pattern).test(key));
-  return bad === undefined ? true : `${JSON.stringify(bad)} is not a valid name or relative path`;
-}));
 var SecretName = Schema14.String.check(Schema14.isPattern(/^[A-Za-z_][A-Za-z0-9_]{0,127}$/));
 var EventFilterValue = Schema14.Union([Schema14.String, Schema14.Finite, Schema14.Boolean, Schema14.Null]);
 var LoopManifest = Schema14.Struct({
   id: Schema14.String,
   title: Schema14.String,
+  version: Schema14.optionalKey(LoopVersion),
   input: JsonObject2,
   output: JsonObject2,
-  outcome: Schema14.optionalKey(Schema14.Literals(["feature", "bug", "refactor", "investigation", "docs", "migration"])),
+  outcome: Schema14.optionalKey(Schema14.Literals(["feature", "bug", "refactor", "investigation", "docs", "migration", "performance"])),
   agents: Schema14.Record(Schema14.String, Schema14.String),
   checkout: Schema14.Literals(["none", "read", "write"]),
   when: Schema14.Array(Schema14.Struct({
     event: Schema14.String,
     filter: Schema14.optionalKey(Schema14.Record(Schema14.String, Schema14.Union([EventFilterValue, Schema14.Array(EventFilterValue)]))),
-    input: Schema14.Record(Schema14.String, Schema14.String)
+    input: Schema14.Record(Schema14.String, Schema14.String),
+    values: Schema14.optionalKey(JsonObject2)
+  })),
+  offers: Schema14.Array(Schema14.Struct({
+    id: Schema14.String,
+    title: Schema14.String,
+    loop: Schema14.String,
+    from: Schema14.optionalKey(Schema14.String)
   })),
-  offers: Schema14.Array(Schema14.Struct({ id: Schema14.String, title: Schema14.String, loop: Schema14.String })),
   capabilities: Schema14.Array(Schema14.Literals(LoopCapabilities2)),
   secrets: Schema14.optionalKey(Schema14.Array(SecretName)),
   network: Schema14.optionalKey(AgentSandboxNetwork),
@@ -3234,7 +2567,9 @@ var AgentDeclaration = Schema14.Struct({
   harness: Schema14.optionalKey(Schema14.String),
   model: Schema14.optionalKey(Schema14.String),
   effort: Schema14.optionalKey(Schema14.Literals(AgentEfforts)),
-  kits: Schema14.optionalKey(Schema14.Array(Schema14.String)),
+  fallbacks: Schema14.optionalKey(Schema14.Array(AgentFallback)),
+  tools: Schema14.optionalKey(Schema14.Array(Schema14.Literals(AgentCapabilities))),
+  skills: Schema14.optionalKey(Schema14.Array(Schema14.String.check(Schema14.isMinLength(1)))),
   network: Schema14.optionalKey(Schema14.Union([Schema14.Struct({ hosts: Schema14.Array(Schema14.String) }), Schema14.Literal("open")])),
   sandbox: Schema14.optionalKey(Schema14.Literal("docker"))
 });
@@ -3259,32 +2594,18 @@ var ScheduleDeclaration = Schema14.Union([
     })
   })
 ]);
-var AuthoredKitDeclaration = Schema14.Struct({
-  name: Schema14.String.check(Schema14.isMinLength(1)),
-  kind: Schema14.optionalKey(Schema14.Literals(KitKinds)),
-  description: Schema14.optionalKey(Schema14.String),
-  context: Schema14.String,
-  skills: Schema14.optionalKey(recordKeyedBy(skillNamePattern, recordKeyedBy(relativePathPattern, Schema14.String)))
-});
-var KitInstallationDeclaration = Schema14.Struct({
-  source: Schema14.String.check(Schema14.isMinLength(1)),
-  version: Schema14.optionalKey(Schema14.String)
-});
-var KitAssignmentDeclaration = Schema14.Struct({
-  kit: Schema14.String.check(Schema14.isMinLength(1)),
-  workspace: Schema14.optionalKey(Schema14.Literals(["default", "mandatory"])),
-  teams: Schema14.optionalKey(Schema14.Array(Schema14.String))
-});
-var KitDeclaration = Schema14.Union([
-  KitInstallationDeclaration,
-  KitAssignmentDeclaration,
-  AuthoredKitDeclaration
-]);
-var PackageDeclarations = Schema14.Struct({
+var CarriedKit = Schema14.Struct({
+  name: KitName,
+  version: Schema14.String.check(Schema14.isMinLength(1)),
+  setup: KitDigest,
+  loops: Schema14.Array(Schema14.String),
+  agents: Schema14.Array(Schema14.String)
+});
+var KitDeclarations = Schema14.Struct({
   loops: Schema14.Array(LoopManifest),
   agents: Schema14.Record(Schema14.String, AgentDeclaration),
   schedules: Schema14.optionalKey(Schema14.Record(Schema14.String, ScheduleDeclaration)),
-  kits: Schema14.optionalKey(Schema14.Record(Schema14.String, KitDeclaration))
+  carried: Schema14.optionalKey(Schema14.Array(CarriedKit))
 });
 var sameLoop = Schema14.toEquivalence(LoopManifest);
 var sameAgent = Schema14.toEquivalence(AgentDeclaration);
@@ -3292,7 +2613,33 @@ var sameAgent = Schema14.toEquivalence(AgentDeclaration);
 // packages/sdk/src/loop/define.ts
 import * as Effect2 from "effect/Effect";
 import * as Schema15 from "effect/Schema";
-var LoopOutcome2 = Schema15.Literals(["feature", "bug", "refactor", "investigation", "docs", "migration"]);
+var LoopOutcome2 = Schema15.Literals([
+  "feature",
+  "bug",
+  "refactor",
+  "investigation",
+  "docs",
+  "migration",
+  "performance"
+]);
+var capabilitiesOf2 = (loop) => {
+  const seen = new Set;
+  const granted = new Set;
+  const visit = (current) => {
+    if (seen.has(current))
+      return;
+    seen.add(current);
+    for (const capability of current.capabilities)
+      granted.add(capability);
+    const called = current.calls?.() ?? [];
+    if (called.length > 0)
+      granted.add("call");
+    for (const child of called)
+      visit(child);
+  };
+  visit(loop);
+  return [...granted];
+};
 var defineLoop2 = (definition) => definition;
 
 class ManifestInvalid2 extends Schema15.TaggedError()("ManifestInvalid", {
@@ -3313,9 +2660,15 @@ var declarationsAreData = (definition) => Schema15.decodeEffect(JsonObjectSchema
 }).pipe(Effect2.mapError((error) => new ManifestInvalid2({ loop: definition.id, message: `Declarations must be data: ${error.message}` })));
 var loopManifest2 = (definition) => Effect2.gen(function* () {
   yield* declarationsAreData(definition);
+  if (definition.version !== undefined && !Schema15.is(LoopVersion)(definition.version))
+    return yield* new ManifestInvalid2({
+      loop: definition.id,
+      message: `version "${String(definition.version)}" is not semver, such as 2.0.0`
+    });
   return {
     id: definition.id,
     title: definition.title,
+    ...definition.version === undefined ? undefined : { version: definition.version },
     input: yield* jsonSchemaOf2(definition.id, definition.input),
     output: yield* jsonSchemaOf2(definition.id, definition.output),
     ...definition.outcome === undefined ? undefined : { outcome: definition.outcome },
@@ -3323,7 +2676,7 @@ var loopManifest2 = (definition) => Effect2.gen(function* () {
     checkout: definition.checkout,
     when: definition.when ?? [],
     offers: definition.offers ?? [],
-    capabilities: definition.capabilities,
+    capabilities: capabilitiesOf2(definition),
     ...definition.secrets === undefined ? undefined : { secrets: definition.secrets },
     ...definition.network === undefined ? undefined : { network: definition.network },
     ...definition.schedule === undefined ? undefined : { schedule: definition.schedule }
@@ -3338,6 +2691,39 @@ import * as Exit2 from "effect/Exit";
 import * as Schema17 from "effect/Schema";
 import { Activity, DurableDeferred } from "effect/workflow";
 
+// packages/core/src/question-recommendation.ts
+var optionValue = (option) => isString2(option) ? option : option.value;
+var splitQuestionOptions = (options) => {
+  const descriptions = Object.fromEntries(options.flatMap((option) => isString2(option) || option.description === undefined || option.description.trim() === "" ? [] : [[option.value, option.description]]));
+  return {
+    options: options.map(optionValue),
+    ...Object.keys(descriptions).length === 0 ? undefined : { optionDescriptions: descriptions }
+  };
+};
+var recommendationProblem = (question) => {
+  const options = question.options?.map(optionValue);
+  const reason = question.recommendationReason?.trim() ?? "";
+  const recommended = question.recommended?.trim() ?? "";
+  if (question.informationOnly === true) {
+    if (options !== undefined)
+      return "A Question with options always has one to recommend: set `recommended` to one of them, and drop `informationOnly`.";
+    if (recommended !== "")
+      return "A Question that recommends an answer is not `informationOnly`: drop `informationOnly`.";
+    return reason === "" ? "Say in `recommendationReason` why you cannot suggest an answer, such as that only the person knows the secret\u2019s name." : undefined;
+  }
+  if (recommended === "")
+    return `Add \`recommended\`: the answer you would pick${options === undefined ? ", as a suggested free-text answer" : `, one of: ${options.join(", ")}`}. Add \`recommendationReason\` too, in one or two sentences. Only a Question that purely asks for information you cannot guess, such as a secret's name, may set \`informationOnly\` instead and say why in \`recommendationReason\`.`;
+  if (options !== undefined && !options.includes(question.recommended ?? ""))
+    return `The recommended answer "${question.recommended}" is not one of the options: ${options.join(", ")}.`;
+  return reason === "" ? "Add `recommendationReason`: why you recommend that answer, in one or two sentences." : undefined;
+};
+var questionAdvice = (question) => ({
+  ...question.optionDescriptions === undefined ? undefined : { optionDescriptions: question.optionDescriptions },
+  ...question.recommended === undefined ? undefined : { recommended: question.recommended },
+  ...question.recommendationReason === undefined ? undefined : { recommendationReason: question.recommendationReason },
+  ...question.informationOnly === true ? { informationOnly: true } : undefined
+});
+
 // packages/sdk/src/loop/evidence.ts
 import * as Schema16 from "effect/Schema";
 var EvidenceCheck2 = Schema16.Struct({
@@ -3346,12 +2732,15 @@ var EvidenceCheck2 = Schema16.Struct({
   status: Schema16.Literals(["passed", "failed"]),
   preExisting: Schema16.Boolean,
   durationMs: Schema16.Finite,
-  evidenceId: Schema16.String
+  evidenceId: Schema16.String,
+  outputTail: Schema16.optionalKey(Schema16.String),
+  suggested: Schema16.optionalKey(Schema16.Boolean)
 });
 var VerifyResult2 = Schema16.Struct({
   revision: Schema16.String,
   tree: Schema16.String,
   passed: Schema16.Boolean,
+  unchanged: Schema16.optionalKey(Schema16.Boolean),
   checks: Schema16.Array(EvidenceCheck2)
 });
 var OutcomeTable2 = {
@@ -3361,16 +2750,18 @@ var OutcomeTable2 = {
   investigation: "A conclusion Output with its sources; no patch needed",
   docs: "The documented commands run",
   migration: "A rollback check passes",
+  performance: "A kept final measurement against the merge base shows a gain, and approved verifications pass on the head",
   none: "Only the approved verifications"
 };
 var verdict = (reasons) => reasons.length === 0 ? { settled: true } : { settled: false, reasons };
 var missing = (side) => `No verification evidence for the ${side}`;
+var failsOn2 = (side, name, tree) => `${name} fails on the ${side} tree ${tree}`;
 var allPass = (side, result) => {
   if (result === undefined)
     return [missing(side)];
   if (result.checks.length === 0)
     return [`No approved verification ran on the ${side} tree ${result.tree}`];
-  return result.checks.filter((check) => check.status === "failed" && !check.preExisting).map((check) => `${check.name} fails on the ${side} tree ${result.tree}`);
+  return result.checks.filter((check) => check.status === "failed" && !check.preExisting).map((check) => failsOn2(side, check.name, result.tree));
 };
 var checkOn = (side, result, name) => {
   if (result === undefined)
@@ -3384,14 +2775,14 @@ var passesOnHead = (head, name) => {
   const { found, reason } = checkOn("head", head, name);
   if (found === undefined)
     return [reason];
-  return found.status === "passed" ? [] : [`${found.name} fails on the head tree ${head?.tree}`];
+  return found.status === "passed" ? [] : [failsOn2("head", found.name, head?.tree)];
 };
 var bugReasons = (input) => {
   const base = checkOn("base", input.base, input.reproducing);
   const head = checkOn("head", input.head, input.reproducing);
   return [
     ...base.found === undefined ? [base.reason] : base.found.status === "failed" ? [] : [`${base.found.name} does not fail on the base tree ${input.base?.tree}, so the bug is not reproduced`],
-    ...head.found === undefined ? [head.reason] : head.found.status === "passed" ? [] : [`${head.found.name} fails on the head tree ${input.head?.tree}`]
+    ...head.found === undefined ? [head.reason] : head.found.status === "passed" ? [] : [failsOn2("head", head.found.name, input.head?.tree)]
   ];
 };
 var conclusionReasons = (conclusion) => {
@@ -3420,6 +2811,11 @@ var evidenceGate2 = (input) => {
       return verdict((input.documented ?? []).length === 0 ? ["No documented command was named"] : (input.documented ?? []).flatMap((name) => passesOnHead(input.head, name)));
     case "migration":
       return verdict(passesOnHead(input.head, input.rollback));
+    case "performance":
+      return verdict([
+        ...input.measurement === undefined ? ["No final measurement against the merge base was kept"] : input.measurement.verdict === "gain" ? [] : [`The final measurement is ${input.measurement.verdict}: ${input.measurement.reason}`],
+        ...allPass("head", input.head)
+      ]);
     default:
       return verdict(allPass("head", input.head));
   }
@@ -3454,6 +2850,12 @@ class WaitTimedOut2 extends Schema17.TaggedError()("WaitTimedOut", {
 }) {
 }
 
+class ChangeRequestClosed2 extends Schema17.TaggedError()("ChangeRequestClosed", {
+  step: Schema17.String,
+  merged: Schema17.Boolean
+}) {
+}
+
 class ChildFailed2 extends Schema17.TaggedError()("ChildFailed", {
   step: Schema17.String,
   loop: Schema17.String,
@@ -3491,7 +2893,9 @@ class LoopRun2 extends Context.Service()("@kitman-sh/sdk/loop/LoopRun") {
 
 class LoopHost2 extends Context.Service()("@kitman-sh/sdk/loop/LoopHost") {
 }
-var agentWorkDeferred2 = (step) => DurableDeferred.make(`agent_work/${step}`, { success: Schema17.Json, error: StepFailed2 });
+var agentDeferredNamed2 = (deferredName) => DurableDeferred.make(deferredName, { success: Schema17.Json, error: StepFailed2 });
+var agentWorkDeferred2 = (step) => agentDeferredNamed2(`agent_work/${step}`);
+var syncDeferred2 = (step) => agentDeferredNamed2(`sync/${step}`);
 var answerDeferred2 = (step) => DurableDeferred.make(`ask/${step}`, { success: Schema17.String, error: StepFailed2 });
 var childDeferred2 = (step) => DurableDeferred.make(`call/${step}`, { success: Schema17.Json, error: ChildFailed2 });
 var eventDeferred2 = (step) => DurableDeferred.make(`wait_for/${step}`, { success: LoopEvent2, error: WaitTimedOut2 });
@@ -3516,7 +2920,7 @@ var takeStep2 = (name, kind, capability, body) => Effect3.gen(function* () {
       run.steps.push(record);
   })));
 });
-var launch = (deferred, start) => Activity.make({
+var launch2 = (deferred, start) => Activity.make({
   name: deferred.name,
   error: StepFailed2,
   execute: Effect3.gen(function* () {
@@ -3524,7 +2928,8 @@ var launch = (deferred, start) => Activity.make({
   })
 });
 var toJson = (step, schema, value) => Schema17.encodeUnknownEffect(Schema17.toCodecJson(schema))(value).pipe(Effect3.flatMap(Schema17.decodeUnknownEffect(Schema17.Json)), Effect3.mapError((error) => new StepFailed2({ step, reason: error.message })));
-var agentWork2 = (name, options) => takeStep2(name, "agent_work", "agent_work", Effect3.gen(function* () {
+var agentWork2 = (name, options) => agentWorkAs2(agentWorkDeferred2, name, options);
+var agentWorkAs2 = (deferredOf, name, options) => takeStep2(name, "agent_work", "agent_work", Effect3.gen(function* () {
   const run = yield* LoopRun2;
   const agent = run.agents[options.agent];
   const undeclared = options.secrets?.find((secret) => !run.secrets.has(secret));
@@ -3532,62 +2937,100 @@ var agentWork2 = (name, options) => takeStep2(name, "agent_work", "agent_work",
     return yield* new CapabilityDenied2({ step: name, capability: "agent_work", secret: undeclared });
   if (agent === undefined)
     return yield* new StepFailed2({ step: name, reason: `Agent role "${options.agent}" is not declared` });
-  const deferred = agentWorkDeferred2(name);
-  const output = yield* jsonSchemaOf2(run.loop, options.output).pipe(Effect3.mapError((error) => new StepFailed2({ step: name, reason: error.message })));
-  yield* launch(deferred, (host, token) => host.startAgentWork({
+  const deferred = deferredOf(name);
+  const output = yield* jsonSchemaOf2(run.loop, options.answer ?? options.output).pipe(Effect3.mapError((error) => new StepFailed2({ step: name, reason: error.message })));
+  yield* launch2(deferred, (host, token) => host.startAgentWork({
     step: name,
+    deferredName: deferred.name,
     role: options.agent,
     agent,
     prompt: options.prompt,
+    ...options.skill === undefined ? undefined : { skill: options.skill },
     output,
     ...options.secrets === undefined ? undefined : { secrets: options.secrets },
+    ...options.timeout === undefined ? undefined : { timeoutMillis: Duration.toMillis(Duration.fromInputUnsafe(options.timeout)) },
+    ...options.mergeTarget === undefined ? undefined : { mergeTarget: options.mergeTarget },
     token
   }));
   const submitted = yield* DurableDeferred.await(deferred);
   return yield* Schema17.decodeEffect(Schema17.toCodecJson(options.output))(submitted).pipe(Effect3.mapError((error) => new OutputInvalid2({ step: name, message: error.message })));
 }));
+var agentWorkOnce2 = (name, options) => agentWork2(name, options).pipe(Effect3.catchTag("OutputInvalid", (invalid) => agentWork2(`${name}:again`, {
+  ...options,
+  prompt: `${options.prompt}
+
+Your last Output was refused: ${invalid.message}. Give it again in the right shape.`
+})));
 var ask2 = (name, question) => takeStep2(name, "ask", "ask", Effect3.gen(function* () {
   const deferred = answerDeferred2(name);
-  const options = "options" in question ? question.options : undefined;
-  yield* launch(deferred, (host, token) => host.putQuestion({
+  const offered = "options" in question ? splitQuestionOptions(question.options) : undefined;
+  const options = offered?.options;
+  const recommended = "recommended" in question ? question.recommended : undefined;
+  const informationOnly = "informationOnly" in question ? question.informationOnly : undefined;
+  const advice = questionAdvice({
+    ...offered,
+    ...recommended === undefined ? undefined : { recommended },
+    recommendationReason: question.recommendationReason,
+    ...informationOnly === undefined ? undefined : { informationOnly }
+  });
+  const refused = recommendationProblem({ ...advice, ...options === undefined ? undefined : { options } });
+  if (refused !== undefined)
+    return yield* new StepFailed2({ step: name, reason: refused });
+  const fallback = question.default === undefined ? recommendedDefault(recommended) : question.default ?? undefined;
+  if (fallback !== undefined && options !== undefined && !options.includes(fallback))
+    return yield* new QuestionRefused2({ step: name, answer: fallback, options });
+  yield* launch2(deferred, (host, token) => host.putQuestion({
     step: name,
     prompt: question.prompt,
     ...options === undefined ? undefined : { options },
+    ...advice,
+    ...fallback === undefined ? undefined : { default: fallback },
+    ...question.timeout === undefined ? undefined : { timeoutMillis: Duration.toMillis(Duration.fromInputUnsafe(question.timeout)) },
     token
   }));
   const answer = yield* DurableDeferred.await(deferred);
-  if (options === undefined)
+  if (options === undefined) {
     return answer;
-  const offered = options.find((option) => option === answer);
-  if (offered === undefined)
+  }
+  const offeredAnswer = options.find((option) => option === answer);
+  if (offeredAnswer === undefined)
     return yield* new QuestionRefused2({ step: name, answer, options });
-  return offered;
+  return offeredAnswer;
 }));
 var call2 = (name, loop, input) => takeStep2(name, "call", "call", Effect3.gen(function* () {
   const deferred = childDeferred2(name);
   const encoded = yield* toJson(name, loop.input, input);
-  yield* launch(deferred, (host, token) => host.admitChild({ step: name, loop: loop.id, input: encoded, token }));
+  yield* launch2(deferred, (host, token) => host.admitChild({ step: name, loop: loop.id, input: encoded, token }));
   const result = yield* DurableDeferred.await(deferred);
   return yield* Schema17.decodeEffect(Schema17.toCodecJson(loop.output))(result).pipe(Effect3.mapError((error) => new ChildFailed2({ step: name, loop: loop.id, reason: error.message })));
 }));
 var waitFor2 = (name, wait) => takeStep2(name, "wait_for", undefined, Effect3.gen(function* () {
   const deferred = eventDeferred2(name);
   const timeoutMillis = Duration.toMillis(Duration.fromInputUnsafe(wait.timeout));
-  yield* launch(deferred, (host, token) => host.awaitEvent({
+  yield* launch2(deferred, (host, token) => host.awaitEvent({
     step: name,
     event: wait.event,
     ...wait.filter === undefined ? undefined : { filter: wait.filter },
+    ...wait.since === undefined ? undefined : { since: wait.since },
+    ...wait.or === undefined ? undefined : { or: wait.or },
     timeoutMillis,
     token
   }));
-  return yield* DurableDeferred.await(deferred);
+  const event = yield* DurableDeferred.await(deferred);
+  if (event.type === "change_request.closed" && wait.event !== event.type && wait.or?.some((other) => other.event === event.type) !== true)
+    return yield* new ChangeRequestClosed2({
+      step: name,
+      merged: event.payload.merged === true
+    });
+  return event;
 }));
 var verify2 = (name, request) => takeStep2(name, "verify", "verify", Effect3.gen(function* () {
   const deferred = verifyDeferred2(name);
-  yield* launch(deferred, (host, token) => host.startVerification({
+  yield* launch2(deferred, (host, token) => host.startVerification({
     step: name,
     ...request.revision === undefined ? undefined : { revision: request.revision },
     ...request.checks === undefined ? undefined : { checks: request.checks },
+    ...request.suggested === undefined || request.suggested.length === 0 ? undefined : { suggested: request.suggested },
     token
   }));
   return yield* DurableDeferred.await(deferred);
@@ -3595,10 +3038,16 @@ var verify2 = (name, request) => takeStep2(name, "verify", "verify", Effect3.gen
 var approval = ["Approve", "Reject"];
 var suggestVerification2 = (name, verification) => takeStep2(name, "ask", "ask", Effect3.gen(function* () {
   const deferred = answerDeferred2(name);
-  yield* launch(deferred, (host, token) => host.putQuestion({
+  yield* launch2(deferred, (host, token) => host.putQuestion({
     step: name,
     prompt: `Approve the verification "${verification.name}" for this repository? It runs \`${verification.command}\`${verification.workingDirectory === undefined ? "" : ` in ${verification.workingDirectory}`}.`,
     options: approval,
+    optionDescriptions: {
+      Approve: "Runs it on every Build of this repository from now on.",
+      Reject: "The Run goes on without this check."
+    },
+    recommended: "Approve",
+    recommendationReason: "An agent suggested it to prove its own work, and an approved check guards later Builds too. Reject it if the command is not safe to run here.",
     verification,
     token
   }));
@@ -3694,22 +3143,82 @@ var ArtifactRequest2 = Schema19.Struct({
 });
 var ArtifactResult2 = Schema19.Struct({ artifactId: Schema19.String });
 var NoteRequest2 = Schema19.Struct({ text: Schema19.String, artifactId: Schema19.optional(Schema19.String) });
-var CreateTasksRequest2 = Schema19.Struct({ tickets: Schema19.Array(PlanTicket2) });
+var CreateTasksRequest2 = Schema19.Struct({
+  tickets: Schema19.Array(PlanTicket2),
+  projectId: Schema19.optionalKey(Schema19.String)
+});
 var CreateTasksResult2 = Schema19.Struct({
   tasks: Schema19.Array(Schema19.Struct({ key: Schema19.String, taskId: Schema19.String }))
 });
+var AlertTaskRequest2 = Schema19.Struct({
+  fingerprint: Schema19.String.check(Schema19.isMinLength(1), Schema19.isMaxLength(400)),
+  title: Schema19.String,
+  windowHours: Schema19.Int.check(Schema19.isGreaterThanOrEqualTo(0), Schema19.isLessThanOrEqualTo(720)),
+  resolved: Schema19.optionalKey(Schema19.Boolean),
+  priority: Schema19.optionalKey(Schema19.Literals(["urgent", "high", "medium", "low"]))
+});
+var AlertTaskResult2 = Schema19.Struct({
+  taskId: Schema19.optionalKey(Schema19.String),
+  created: Schema19.Boolean,
+  resolved: Schema19.optionalKey(Schema19.Boolean),
+  joined: Schema19.optionalKey(Schema19.Struct({ kind: Schema19.Literals(["run", "recent"]), runId: Schema19.String }))
+});
 var IntegrationBranchRequest2 = Schema19.Struct({ repoBindingId: Schema19.optional(Schema19.String) });
 var IntegrationBranch2 = Schema19.Struct({
   repoBindingId: Schema19.String,
   branch: Schema19.String,
   revision: Schema19.String
 });
-var MergeChangeRequestRequest2 = Schema19.Struct({ changeRequestId: Schema19.String });
+var MergeChangeRequestRequest2 = Schema19.Struct({
+  changeRequestId: Schema19.String,
+  head: Schema19.optionalKey(Schema19.String)
+});
 var MergeResult2 = Schema19.Union([
   Schema19.Struct({ status: Schema19.Literal("merged"), revision: Schema19.String }),
-  Schema19.Struct({ status: Schema19.Literal("conflict") })
+  Schema19.Struct({ status: Schema19.Literal("conflict") }),
+  Schema19.Struct({ status: Schema19.Literal("moved"), head: Schema19.String })
 ]);
-var CommentRequest2 = Schema19.Struct({ changeRequestId: Schema19.String, body: Schema19.String });
+var ApproveChangeRequestRequest2 = Schema19.Struct({
+  changeRequestId: Schema19.String,
+  head: Schema19.String,
+  summary: Schema19.String,
+  review: Schema19.optionalKey(Schema19.String),
+  carries: Schema19.optionalKey(Schema19.String)
+});
+var ApproveChangeRequestResult2 = Schema19.Union([
+  Schema19.Struct({ approved: Schema19.Literal(true), reviewId: Schema19.String }),
+  Schema19.Struct({ approved: Schema19.Literal(false), reason: Schema19.String })
+]);
+var CloseChangeRequestRequest2 = Schema19.Struct({
+  number: Schema19.String,
+  head: Schema19.String,
+  note: Schema19.String
+});
+var CloseChangeRequestResult2 = Schema19.Struct({
+  closed: Schema19.Boolean,
+  head: Schema19.optionalKey(Schema19.String)
+});
+var RerunPipelineRequest2 = Schema19.Union([
+  Schema19.Struct({ changeRequestId: Schema19.String }),
+  Schema19.Struct({ ref: Schema19.String, all: Schema19.optionalKey(Schema19.Boolean) })
+]);
+var RerunPipelineResult2 = Schema19.Struct({ head: Schema19.String, pipelines: Schema19.Int });
+var ReportPipelineRequest2 = Schema19.Struct({ changeRequestId: Schema19.String, verification: Schema19.String });
+var ReportPipelineResult2 = Schema19.Struct({
+  head: Schema19.String,
+  status: Schema19.Literals(["success", "failed"])
+});
+var CommentRequest2 = Schema19.Struct({
+  changeRequestId: Schema19.String,
+  body: Schema19.String,
+  threadId: Schema19.optionalKey(Schema19.String),
+  summary: Schema19.optionalKey(Schema19.String),
+  anchors: Schema19.optionalKey(Schema19.Array(Schema19.Struct({
+    file: Schema19.String,
+    line: Schema19.Int.check(Schema19.isGreaterThanOrEqualTo(1)),
+    body: Schema19.String.check(Schema19.isMinLength(1))
+  })))
+});
 var ReleaseRequest2 = Schema19.Struct({
   tag: Schema19.String,
   revision: Schema19.optional(Schema19.String),
@@ -3717,6 +3226,49 @@ var ReleaseRequest2 = Schema19.Struct({
   notes: Schema19.String
 });
 var ReleaseResult2 = Schema19.Struct({ tag: Schema19.String, revision: Schema19.String, url: Schema19.String });
+var ChangeRequestReadRequest2 = Schema19.Struct({ changeRequestId: Schema19.String });
+var PipelineJob2 = Schema19.Struct({
+  name: Schema19.String,
+  status: Schema19.Literals(["running", "success", "failed", "skipped"]),
+  url: Schema19.optional(Schema19.String),
+  logTail: Schema19.optional(Schema19.String)
+});
+var PipelineStatus2 = Schema19.Struct({
+  head: Schema19.String,
+  status: Schema19.Literals(["none", "running", "success", "failed", "canceled"]),
+  source: Schema19.Literals(["forge", "reported"]),
+  jobs: Schema19.Array(PipelineJob2),
+  readAt: Schema19.optionalKey(Schema19.String),
+  runnerChecks: Schema19.optionalKey(Schema19.Array(Schema19.String))
+});
+var ReviewThread2 = Schema19.Struct({
+  id: Schema19.String,
+  path: Schema19.optional(Schema19.String),
+  line: Schema19.optional(Schema19.Int),
+  outdated: Schema19.optional(Schema19.Boolean),
+  comments: Schema19.Array(Schema19.Struct({ author: Schema19.optional(Schema19.String), body: Schema19.String }))
+});
+var ReviewThreads2 = Schema19.Struct({ threads: Schema19.Array(ReviewThread2) });
+var OpenChangeRequestsRequest2 = Schema19.Struct({ authors: Schema19.NonEmptyArray(Schema19.String) });
+var OpenChangeRequest2 = Schema19.Struct({
+  number: Schema19.String,
+  title: Schema19.String,
+  body: Schema19.String,
+  url: Schema19.String,
+  author: Schema19.String,
+  sourceBranch: Schema19.String,
+  head: Schema19.String
+});
+var OpenChangeRequests2 = Schema19.Struct({ changeRequests: Schema19.Array(OpenChangeRequest2) });
+var OwnChangeRequest2 = Schema19.Struct({
+  id: Schema19.String,
+  number: Schema19.String,
+  url: Schema19.String,
+  title: Schema19.String,
+  sourceBranch: Schema19.String,
+  body: Schema19.String
+});
+var OwnChangeRequests2 = Schema19.Struct({ changeRequests: Schema19.Array(OwnChangeRequest2) });
 var TranscriptPoint2 = Schema19.Struct({
   runId: Schema19.String,
   stepAttemptId: Schema19.String,
@@ -3729,8 +3281,10 @@ var TranscriptsResult2 = Schema19.Struct({
   runs: Schema19.Array(Schema19.Struct({
     runId: Schema19.String,
     loopId: Schema19.String,
+    status: Schema19.optional(Schema19.Literals(["completed", "failed", "canceled", "expired"])),
     teamId: Schema19.optional(Schema19.String),
     failure: Schema19.optional(Schema19.String),
+    retried: Schema19.optional(Schema19.Boolean),
     entries: Schema19.Array(Schema19.Struct({ stepAttemptId: Schema19.String, sequence: Schema19.Int, kind: Schema19.String, text: Schema19.String }))
   }))
 });
@@ -3747,10 +3301,15 @@ var ProposeRequest2 = Schema19.Union([
     title: Schema19.String,
     description: Schema19.String,
     teamId: Schema19.optional(Schema19.String),
+    key: Schema19.optionalKey(Schema19.String.check(Schema19.isPattern(/^[a-z0-9]+(?:-[a-z0-9]+)*$/), Schema19.isMaxLength(80))),
     citations: Citations
   })
 ]);
-var ProposeResult2 = Schema19.Struct({ kind: Schema19.Literals(["memory", "task"]), id: Schema19.String });
+var ProposeResult2 = Schema19.Struct({
+  kind: Schema19.Literals(["memory", "task"]),
+  id: Schema19.String,
+  matched: Schema19.optionalKey(Schema19.Boolean)
+});
 var Health = Schema19.Literals(["on_track", "at_risk", "off_track"]);
 var ProjectActivityRequest2 = Schema19.Struct({ projectId: Schema19.String });
 var ProjectActivityResult2 = Schema19.Struct({
@@ -3801,6 +3360,9 @@ class CommentActivity2 extends Context2.Service()("@kitman-sh/sdk/loop/CommentAc
 class CreateTasksActivity2 extends Context2.Service()("@kitman-sh/sdk/loop/CreateTasksActivity") {
 }
 
+class AlertTaskActivity2 extends Context2.Service()("@kitman-sh/sdk/loop/AlertTaskActivity") {
+}
+
 class IntegrationBranchActivity2 extends Context2.Service()("@kitman-sh/sdk/loop/IntegrationBranchActivity") {
 }
 
@@ -3821,6 +3383,9 @@ class ProjectActivityActivity2 extends Context2.Service()("@kitman-sh/sdk/loop/P
 
 class DraftUpdateActivity2 extends Context2.Service()("@kitman-sh/sdk/loop/DraftUpdateActivity") {
 }
+
+class ChangeRequestReadActivity2 extends Context2.Service()("@kitman-sh/sdk/loop/ChangeRequestReadActivity") {
+}
 var hostActivity = (name, kind, capability, success, execute) => takeStep2(name, kind, capability, Activity2.make({ name: `${kind}/${name}`, success, error: StepFailed2, execute }));
 var changeRequest2 = (name, request) => hostActivity(name, "change_request", "change_request", ChangeRequestResult2, Effect5.gen(function* () {
   return yield* (yield* ChangeRequestActivity2).run(request, name);
@@ -3843,12 +3408,33 @@ var comment2 = (name, request) => hostActivity(name, "comment", "post_comment",
 var createTasks2 = (name, request) => hostActivity(name, "create_tasks", "create_tasks", CreateTasksResult2, Effect5.gen(function* () {
   return yield* (yield* CreateTasksActivity2).run(request, name);
 }));
+var alertTask2 = (name, request) => hostActivity(name, "create_tasks", "create_tasks", AlertTaskResult2, Effect5.gen(function* () {
+  return yield* (yield* AlertTaskActivity2).run(request, name);
+}));
 var integrationBranch2 = (name, request) => hostActivity(name, "integration_branch", "merge_change_request", IntegrationBranch2, Effect5.gen(function* () {
   return yield* (yield* IntegrationBranchActivity2).run(request, name);
 }));
 var mergeChangeRequest2 = (name, request) => hostActivity(name, "merge_change_request", "merge_change_request", MergeResult2, Effect5.gen(function* () {
   return yield* (yield* MergeChangeRequestActivity2).run(request, name);
 }));
+var approveChangeRequest2 = (name, request) => hostActivity(name, "approve_change_request", "approve_change_request", ApproveChangeRequestResult2, Effect5.gen(function* () {
+  return yield* (yield* MergeChangeRequestActivity2).approve(request, name);
+}));
+var closeChangeRequest2 = (name, request) => hostActivity(name, "close_change_request", "merge_change_request", CloseChangeRequestResult2, Effect5.gen(function* () {
+  return yield* (yield* MergeChangeRequestActivity2).close(request, name);
+}));
+var pipelineMoved2 = (name, changeRequestId, read, timeout = "6 hours") => waitFor2(name, {
+  event: "change_request.pipeline",
+  filter: read.readAt === undefined ? { changeRequestId, head: read.head } : { changeRequestId },
+  timeout,
+  ...read.readAt === undefined ? undefined : { since: read.readAt }
+});
+var rerunPipeline2 = (name, request) => hostActivity(name, "rerun_pipeline", "merge_change_request", RerunPipelineResult2, Effect5.gen(function* () {
+  return yield* (yield* MergeChangeRequestActivity2).rerun(request, name);
+}));
+var reportPipeline2 = (name, request) => hostActivity(name, "report_pipeline", "verify", ReportPipelineResult2, Effect5.gen(function* () {
+  return yield* (yield* MergeChangeRequestActivity2).report(request, name);
+}));
 var release2 = (name, request) => hostActivity(name, "release", "publish_release", ReleaseResult2, Effect5.gen(function* () {
   return yield* (yield* ReleaseActivity2).run(request, name);
 }));
@@ -3861,6 +3447,18 @@ var propose2 = (name, request) => hostActivity(name, "propose", "propose", Propo
 var projectActivity2 = (name, request) => hostActivity(name, "project_activity", "read_project", ProjectActivityResult2, Effect5.gen(function* () {
   return yield* (yield* ProjectActivityActivity2).run(request, name);
 }));
+var pipelineStatus2 = (name, request) => hostActivity(name, "pipeline_status", "read_change_request", PipelineStatus2, Effect5.gen(function* () {
+  return yield* (yield* ChangeRequestReadActivity2).pipeline(request, name);
+}));
+var reviewThreads2 = (name, request) => hostActivity(name, "review_threads", "read_change_request", ReviewThreads2, Effect5.gen(function* () {
+  return yield* (yield* ChangeRequestReadActivity2).reviewThreads(request, name);
+}));
+var openChangeRequests2 = (name, request) => hostActivity(name, "open_change_requests", "read_change_request", OpenChangeRequests2, Effect5.gen(function* () {
+  return yield* (yield* ChangeRequestReadActivity2).opened(request, name);
+}));
+var ownChangeRequests2 = (name) => hostActivity(name, "own_change_requests", "read_change_request", OwnChangeRequests2, Effect5.gen(function* () {
+  return yield* (yield* ChangeRequestReadActivity2).own(name);
+}));
 var draftUpdate2 = (name, request) => hostActivity(name, "draft_update", "draft_update", DraftUpdateResult2, Effect5.gen(function* () {
   return yield* (yield* DraftUpdateActivity2).run(request, name);
 }));
@@ -3868,15 +3466,585 @@ var draftUpdate2 = (name, request) => hostActivity(name, "draft_update", "draft_
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Context3 from "effect/Context";
 import * as Data2 from "effect/Data";
-import * as Effect6 from "effect/Effect";
+import * as Effect8 from "effect/Effect";
 import * as Exit3 from "effect/Exit";
 import * as Layer from "effect/Layer";
 import * as Option2 from "effect/Option";
+import * as Record12 from "effect/Record";
+import * as Schema27 from "effect/Schema";
+import { DurableDeferred as DurableDeferred4, Workflow, WorkflowEngine } from "effect/workflow";
+
+// packages/core/src/resource-claim.ts
 import * as Schema20 from "effect/Schema";
-import { DurableDeferred as DurableDeferred2, Workflow, WorkflowEngine } from "effect/workflow";
-var LoopJournal2 = Schema20.Struct({
-  activities: Schema20.Record(Schema20.String, Schema20.Json),
-  deferreds: Schema20.Record(Schema20.String, Schema20.Json)
+var ResourceName = Schema20.String.check(Schema20.isPattern(/^[a-z0-9][a-z0-9._:-]*$/u), Schema20.isMinLength(1), Schema20.isMaxLength(128));
+var ClaimHolder = Schema20.Struct({
+  runId: Schema20.optionalKey(Id),
+  loopId: Schema20.optionalKey(Schema20.String),
+  status: Schema20.optionalKey(RunStatus),
+  reason: Schema20.optionalKey(Schema20.String),
+  private: Schema20.optionalKey(Schema20.Literal(true)),
+  sameLoop: Schema20.Boolean
+});
+var ClaimResult2 = Schema20.Union([
+  Schema20.Struct({
+    status: Schema20.Literal("granted"),
+    resource: ResourceName,
+    takenOverFrom: Schema20.optionalKey(ClaimHolder)
+  }),
+  Schema20.Struct({ status: Schema20.Literal("kept"), resource: ResourceName, holder: ClaimHolder })
+]);
+var ResourceClaim = Schema20.Struct({
+  resource: ResourceName,
+  runId: Id,
+  loopId: Schema20.String,
+  runStatus: RunStatus,
+  claimedAt: Timestamp,
+  keptAt: Schema20.optionalKey(Timestamp),
+  keptReason: Schema20.optionalKey(Schema20.String),
+  waiting: Schema20.Array(Id)
+});
+var ResourceClaimList = Schema20.Struct({ items: Schema20.Array(ResourceClaim) });
+var ClaimRelease = Schema20.Struct({
+  reason: Schema20.String.check(Schema20.isMinLength(1), Schema20.isMaxLength(500))
+});
+
+// packages/sdk/src/loop/claims.ts
+import * as Effect6 from "effect/Effect";
+import * as Schema21 from "effect/Schema";
+import { DurableDeferred as DurableDeferred2 } from "effect/workflow";
+var claimDeferred2 = (step) => DurableDeferred2.make(`claim/${step}`, { success: ClaimResult2, error: StepFailed2 });
+var letGoDeferred2 = (step) => DurableDeferred2.make(`let_go/${step}`, { success: Schema21.Null, error: StepFailed2 });
+var claimOnce = (name, resource, action) => takeStep2(name, "claim", "claim", Effect6.gen(function* () {
+  const deferred = claimDeferred2(name);
+  yield* launch2(deferred, (host, token) => host.claimResource({ step: name, resource, action, token }));
+  return yield* DurableDeferred2.await(deferred);
+}));
+var takeOver = "Take it over";
+var holderName = (holder) => holder.private === true ? "a Run of a private Team you are not in" : `Run ${holder.runId} of ${holder.loopId}`;
+var claim2 = (name, request) => Effect6.gen(function* () {
+  const first = yield* claimOnce(name, request.resource, "claim");
+  if (first.status === "granted")
+    return first;
+  const { holder } = first;
+  const fallback = holder.sameLoop ? takeOver : "Leave it";
+  const answer = (yield* LoopRun2).granted.has("ask") ? yield* ask2(`${name}-offer`, {
+    prompt: `${request.resource} is still held by ${holderName(holder)}${holder.status === undefined ? "" : `, which ${holder.status}`}${holder.reason === undefined ? "" : `: ${holder.reason}`}. Take it over?`,
+    options: [takeOver, "Leave it"],
+    recommended: fallback,
+    recommendationReason: holder.sameLoop ? "The holder is this Loop on the same repository and settled without completing, so nothing else is using it." : "Another Loop holds it and may still need it; waiting is safer than taking it from under that Run.",
+    timeout: request.timeout ?? "10 minutes"
+  }) : fallback;
+  if (answer !== takeOver)
+    return yield* new StepFailed2({ step: name, reason: `${request.resource} was left to ${holderName(holder)}` });
+  const taken = yield* claimOnce(`${name}-take-over`, request.resource, "take_over");
+  if (taken.status === "granted")
+    return taken;
+  return yield* new StepFailed2({ step: name, reason: `${request.resource} is kept by ${holderName(taken.holder)}` });
+});
+var letGo2 = (name, held) => takeStep2(name, "let_go", "claim", Effect6.gen(function* () {
+  const deferred = letGoDeferred2(name);
+  yield* launch2(deferred, (host, token) => host.claimResource({ step: name, resource: held.resource, action: "let_go", token }));
+  yield* DurableDeferred2.await(deferred);
+}));
+
+// packages/core/src/work-unit.ts
+import * as Schema25 from "effect/Schema";
+import * as Struct23 from "effect/Struct";
+
+// packages/core/src/repo-binding.ts
+import * as Schema22 from "effect/Schema";
+var ForgeKinds = ["github", "gitlab", "forgejo", "gitea", "gitee", "bitbucket", "azure-devops"];
+var ForgeKind = Schema22.Literals(ForgeKinds);
+var RepoBindingProviders = [...ForgeKinds, "generic_git"];
+var RepoBindingPathPrefixPattern = "^(?!/)(?!.*\\\\)(?!.*(?:^|/)\\.\\.?(?:/|$))(?!.*//)\\S+$";
+var RepoBindingProvider = Schema22.Literals(RepoBindingProviders);
+var RepoBindingStatus = Schema22.Union([Schema22.Literal("active"), Schema22.Literal("disabled")]);
+var RepoBindingCredentialProviderType = Schema22.Union([
+  Schema22.Literal("env"),
+  Schema22.Literal("file"),
+  Schema22.Literal("exec")
+]);
+var RepoBindingAccessMode = Schema22.Union([
+  Schema22.Literal("local_checkout"),
+  Schema22.Literal("managed_clone"),
+  Schema22.Literal("runner_secret_provider")
+]);
+var RepoBindingCredentialRef = Schema22.Union([
+  Schema22.Struct({ kind: Schema22.Literal("none") }),
+  Schema22.Struct({ kind: Schema22.Literal("local_env"), envName: Schema22.String.check(Schema22.isMinLength(1)) }),
+  Schema22.Struct({
+    kind: Schema22.Literal("runner_secret"),
+    runnerSecretName: Schema22.String.check(Schema22.isMinLength(1)),
+    providerType: RepoBindingCredentialProviderType
+  }),
+  Schema22.Struct({ kind: Schema22.Literal("ssh_agent") })
+]);
+var RepoBinding = Schema22.Struct({
+  id: Id,
+  workspaceId: Id,
+  teamId: Schema22.optionalKey(Id),
+  provider: RepoBindingProvider,
+  host: Schema22.String.check(Schema22.isMinLength(1)),
+  owner: Schema22.String.check(Schema22.isMinLength(1)),
+  name: Schema22.String.check(Schema22.isMinLength(1)),
+  repositoryUrl: Schema22.optionalKey(Schema22.String.check(Schema22.isMinLength(1))),
+  pathPrefix: Schema22.optionalKey(Schema22.String.check(Schema22.isMinLength(1), Schema22.isPattern(new RegExp(RepoBindingPathPrefixPattern, "u")))),
+  defaultTargetBranch: Schema22.String.check(Schema22.isMinLength(1)),
+  expectedBranch: Schema22.optionalKey(Schema22.String.check(Schema22.isMinLength(1))),
+  expectedCommitSha: Schema22.optionalKey(Schema22.String.check(Schema22.isMinLength(1))),
+  credentialRefs: Schema22.Array(RepoBindingCredentialRef),
+  status: RepoBindingStatus,
+  webhook: Schema22.optionalKey(Schema22.Struct({
+    status: Schema22.Literals(["active", "missing", "unavailable"]),
+    message: Schema22.optionalKey(Schema22.String.check(Schema22.isMaxLength(240)))
+  })),
+  createdAt: Timestamp,
+  updatedAt: Timestamp
+});
+var RepoBindingCreate = Schema22.Struct({
+  teamId: Schema22.optionalKey(Id),
+  provider: RepoBindingProvider,
+  host: Schema22.String.check(Schema22.isMinLength(1)),
+  owner: Schema22.String.check(Schema22.isMinLength(1)),
+  name: Schema22.String.check(Schema22.isMinLength(1)),
+  repositoryUrl: Schema22.optionalKey(Schema22.String.check(Schema22.isMinLength(1))),
+  pathPrefix: Schema22.optionalKey(Schema22.String.check(Schema22.isMinLength(1), Schema22.isPattern(new RegExp(RepoBindingPathPrefixPattern, "u")))),
+  defaultTargetBranch: Schema22.String.check(Schema22.isMinLength(1)),
+  expectedBranch: Schema22.optionalKey(Schema22.String.check(Schema22.isMinLength(1))),
+  expectedCommitSha: Schema22.optionalKey(Schema22.String.check(Schema22.isMinLength(1))),
+  credentialRefs: Schema22.optionalKey(Schema22.Array(RepoBindingCredentialRef))
+});
+var RepoBindingTargetOverride = Schema22.Struct({
+  targetBranch: Schema22.optionalKey(Schema22.String.check(Schema22.isMinLength(1)))
+});
+var RepoBindingList = Schema22.Struct({ items: Schema22.Array(RepoBinding) });
+var RunnerRepoBindingCapability = Schema22.Struct({
+  repoBindingId: Id,
+  provider: RepoBindingProvider,
+  host: Schema22.String.check(Schema22.isMinLength(1)),
+  accessModes: Schema22.Array(RepoBindingAccessMode),
+  credentialProviderTypes: Schema22.Array(RepoBindingCredentialProviderType),
+  authenticated: Schema22.Boolean,
+  canPush: Schema22.optionalKey(Schema22.Boolean)
+});
+
+// packages/core/src/network-host.ts
+import * as Schema23 from "effect/Schema";
+var label = "[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?";
+var port = "(?:[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])";
+var NetworkHost = Schema23.String.check(Schema23.isMaxLength(260), Schema23.isPattern(new RegExp(`^(?:localhost|${label}(?:\\.${label})+|\\*\\.${label}\\.${label}(?:\\.${label})*)(?::${port})?$`, "u")));
+var NetworkHostScope = Schema23.Union([Schema23.Struct({ teamId: Id }), Schema23.Struct({ repoBindingId: Id })]);
+var NetworkHostSummary = Schema23.Struct({
+  host: NetworkHost,
+  teamId: Schema23.optionalKey(Id),
+  repoBindingId: Schema23.optionalKey(Id),
+  addedByActorType: ActorType,
+  addedByActorId: Schema23.String,
+  addedAt: Timestamp
+});
+var NetworkHostList = Schema23.Struct({ items: Schema23.Array(NetworkHostSummary) });
+var NetworkHostQuery = Schema23.Struct({
+  teamId: Schema23.optionalKey(Id),
+  repoBindingId: Schema23.optionalKey(Id)
+});
+
+// packages/core/src/secret.ts
+import * as Schema24 from "effect/Schema";
+var SecretName2 = Schema24.String.check(Schema24.isPattern(new RegExp("^[A-Za-z_][A-Za-z0-9_]*$", "u")), Schema24.isMinLength(1), Schema24.isMaxLength(128));
+var SecretScope = Schema24.Union([Schema24.Literal("workspace"), Schema24.Literal("team")]);
+var SecretHost = Schema24.String.check(Schema24.isPattern(new RegExp("^(\\*\\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*(?::[0-9]{1,5})?$", "u")), Schema24.isMaxLength(260));
+var SecretHosts = Schema24.Array(SecretHost).check(Schema24.isMaxLength(32));
+var SecretSummary = Schema24.Struct({
+  name: SecretName2,
+  scope: SecretScope,
+  teamId: Schema24.optionalKey(Id),
+  hosts: SecretHosts,
+  setByActorType: ActorType,
+  setByActorId: Schema24.String,
+  setAt: Timestamp
+});
+var SecretList = Schema24.Struct({ items: Schema24.Array(SecretSummary) });
+var SecretSet = Schema24.Struct({
+  value: Schema24.String.check(Schema24.isMinLength(1), Schema24.isMaxLength(65536)),
+  teamId: Schema24.optionalKey(Schema24.String.check(Schema24.isMinLength(1))),
+  hosts: Schema24.optionalKey(SecretHosts)
+});
+var SecretScopeQuery = Schema24.Struct({ teamId: Schema24.optionalKey(Id) });
+
+// packages/core/src/work-unit.ts
+var WorkUnitLease = Schema25.Struct({
+  leaseOwnerId: Id,
+  runnerReplicaId: Id,
+  leaseId: Id,
+  attempt: Schema25.Int.check(Schema25.isGreaterThanOrEqualTo(1)),
+  fencingToken: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(240), Schema25.isPattern(new RegExp("^[A-Za-z0-9._:-]+$", "u"))),
+  capacitySlot: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(240)),
+  leaseExpiresAt: Timestamp,
+  lastHeartbeatAt: Timestamp
+});
+var WorkUnitLeaseProjection = Schema25.Struct(Struct23.map(WorkUnitLease.fields, Schema25.optionalKey));
+var WorkUnitRepoBinding = Schema25.Struct({
+  id: Id,
+  provider: RepoBindingProvider,
+  host: Schema25.String.check(Schema25.isMinLength(1)),
+  owner: Schema25.String.check(Schema25.isMinLength(1)),
+  name: Schema25.String.check(Schema25.isMinLength(1)),
+  repositoryUrl: Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1))),
+  pathPrefix: Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1))),
+  defaultTargetBranch: Schema25.String.check(Schema25.isMinLength(1)),
+  expectedBranch: Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1))),
+  expectedCommitSha: Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1)))
+});
+var WorkUnitLeaseInput = Schema25.Struct({
+  leaseOwnerId: Id,
+  runnerReplicaId: Id,
+  leaseId: Id,
+  attempt: Schema25.Int.check(Schema25.isGreaterThanOrEqualTo(1)),
+  fencingToken: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(240), Schema25.isPattern(new RegExp("^[A-Za-z0-9._:-]+$", "u"))),
+  capacitySlot: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(240))
+});
+var WorkUnitStatus = Schema25.Union([
+  Schema25.Literal("pending"),
+  Schema25.Literal("claimed"),
+  Schema25.Literal("running"),
+  Schema25.Literal("waiting"),
+  Schema25.Literal("blocked"),
+  Schema25.Literal("completed"),
+  Schema25.Literal("failed"),
+  Schema25.Literal("canceled"),
+  Schema25.Literal("expired")
+]);
+var LoopCheckout = Schema25.Union([Schema25.Literal("none"), Schema25.Literal("read"), Schema25.Literal("write")]);
+var StorageOrigin = Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(2048)));
+var SecretDestination = Schema25.Struct({
+  scope: SecretScope,
+  hosts: SecretHosts,
+  version: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(128))
+});
+var AgentStepWorkUnit = Schema25.Struct({
+  kind: Schema25.Literal("agent_step"),
+  id: Id,
+  teamId: Schema25.optionalKey(Id),
+  runId: Id,
+  stepKey: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(240)),
+  attempt: Schema25.Int.check(Schema25.isGreaterThanOrEqualTo(1)),
+  lease: WorkUnitLease,
+  deadlineAt: Schema25.optionalKey(Timestamp),
+  brief: StepBrief,
+  stepCredential: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(512)),
+  checkout: LoopCheckout,
+  repoBinding: Schema25.optionalKey(WorkUnitRepoBinding),
+  branch: Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1))),
+  baseRevision: Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1))),
+  network: Schema25.optionalKey(AgentSandboxNetwork),
+  hosts: Schema25.optionalKey(Schema25.Array(NetworkHost)),
+  sandbox: Schema25.optionalKey(Schema25.Literal("docker")),
+  secrets: Schema25.optionalKey(Schema25.Record(Schema25.String, Schema25.String)),
+  secretDestinations: Schema25.optionalKey(Schema25.Record(Schema25.String, SecretDestination)),
+  runBaseRevision: Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1))),
+  mergeTarget: Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1))),
+  resumeNotes: Schema25.optionalKey(Schema25.Array(Schema25.String)),
+  transcriptSequence: Schema25.optionalKey(Schema25.Int.check(Schema25.isGreaterThanOrEqualTo(1))),
+  storageOrigin: StorageOrigin
+});
+var RunJournal = Schema25.Struct({
+  activities: Schema25.Record(Schema25.String, Schema25.Unknown),
+  deferreds: Schema25.Record(Schema25.String, Schema25.Unknown)
+});
+var OrchestrationWorkUnit = Schema25.Struct({
+  kind: Schema25.Literal("orchestration"),
+  id: Id,
+  teamId: Schema25.optionalKey(Id),
+  runId: Id,
+  loopDigest: Schema25.String.check(Schema25.isMinLength(64), Schema25.isMaxLength(64), Schema25.isPattern(new RegExp("^[a-f0-9]{64}$", "u"))),
+  input: Schema25.Unknown,
+  granted: Schema25.Array(Schema25.String),
+  lease: WorkUnitLease,
+  journal: RunJournal,
+  network: Schema25.optionalKey(AgentSandboxNetwork),
+  storageOrigin: StorageOrigin,
+  program: Schema25.Struct({
+    loopId: Schema25.String.check(Schema25.isMinLength(1)),
+    credential: Schema25.String.check(Schema25.isMinLength(1))
+  })
+});
+var ProgramWorkUnit = OrchestrationWorkUnit.mapFields(Struct23.omit(["program"]));
+var CheckName = Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(120), Schema25.isPattern(new RegExp("^[A-Za-z0-9][A-Za-z0-9._:-]*$", "u")));
+var ApprovedCheck = Schema25.Struct({
+  name: CheckName,
+  command: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(2000)),
+  workingDirectory: Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(500))),
+  suggested: Schema25.optionalKey(Schema25.Boolean)
+});
+var RepositoryCheck = Schema25.Struct({
+  ...ApprovedCheck.fields,
+  pipeline: Schema25.optionalKey(Schema25.Boolean)
+});
+var MetricName = Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(80), Schema25.isPattern(new RegExp("^[A-Za-z0-9][A-Za-z0-9._:-]*$", "u")));
+var MeasurePlan2 = Schema25.Struct({
+  command: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(2000)),
+  prepare: Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(2000))),
+  workingDirectory: Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(500))),
+  warmup: Schema25.optionalKey(Schema25.Int.check(Schema25.isGreaterThanOrEqualTo(0), Schema25.isLessThanOrEqualTo(10))),
+  metrics: Schema25.Array(Schema25.Struct({
+    name: MetricName,
+    direction: Schema25.Literals(["lower", "higher"]),
+    role: Schema25.Literals(["primary", "guardrail"]),
+    lowVariance: Schema25.optionalKey(Schema25.Boolean)
+  })).check(Schema25.isMinLength(1), Schema25.isMaxLength(20))
+});
+var MeasureSpec = Schema25.Struct({
+  base: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(240)),
+  plan: MeasurePlan2,
+  samples: Schema25.Int.check(Schema25.isGreaterThanOrEqualTo(1), Schema25.isLessThanOrEqualTo(50)),
+  calibrate: Schema25.Boolean
+});
+var MeasureSample = Schema25.Record(MetricName, Schema25.Finite);
+var MeasureSamples = Schema25.Array(MeasureSample).check(Schema25.isMaxLength(50));
+var MeasureEvidence = Schema25.Struct({
+  base: MeasureSamples,
+  head: MeasureSamples,
+  baseAgain: Schema25.optionalKey(MeasureSamples)
+});
+var VerificationWorkUnit = Schema25.Struct({
+  kind: Schema25.Literal("verification"),
+  id: Id,
+  teamId: Schema25.optionalKey(Id),
+  runId: Id,
+  stepKey: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(240)),
+  lease: WorkUnitLease,
+  repoBinding: WorkUnitRepoBinding,
+  revision: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(240)),
+  baseline: Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(300))),
+  checks: Schema25.Array(RepositoryCheck).check(Schema25.isMaxLength(50)),
+  measure: Schema25.optionalKey(MeasureSpec),
+  hosts: Schema25.optionalKey(Schema25.Array(NetworkHost)),
+  storageOrigin: StorageOrigin
+});
+var WorkUnit = Schema25.Union([OrchestrationWorkUnit, AgentStepWorkUnit, VerificationWorkUnit]);
+var WorkUnitClaimResult = Schema25.Struct({ workUnit: Schema25.optionalKey(WorkUnit) });
+var WorkUnitClaimInput = Schema25.Struct({
+  teamId: Schema25.optionalKey(Id),
+  runnerReplicaId: Id,
+  capacitySlot: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(240)),
+  idempotencyKey: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(240)),
+  leaseDurationSeconds: Schema25.optionalKey(Schema25.Int.check(Schema25.isGreaterThanOrEqualTo(1), Schema25.isLessThanOrEqualTo(3600)))
+});
+var WorkUnitHeartbeatInput = Schema25.Struct({
+  workUnitId: Id,
+  lease: WorkUnitLeaseInput,
+  leaseDurationSeconds: Schema25.optionalKey(Schema25.Int.check(Schema25.isGreaterThanOrEqualTo(1), Schema25.isLessThanOrEqualTo(3600))),
+  secrets: Schema25.optionalKey(Schema25.Array(Schema25.Struct({ name: SecretName2, version: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(128)) })).check(Schema25.isMaxLength(256)))
+});
+var WorkUnitHeartbeatResult = Schema25.Struct({
+  settled: Schema25.Boolean,
+  outputSubmitted: Schema25.optionalKey(Schema25.Boolean),
+  outputMerged: Schema25.optionalKey(Schema25.Boolean),
+  questionOpen: Schema25.optionalKey(Schema25.Boolean),
+  revokedSecrets: Schema25.optionalKey(Schema25.Array(SecretName2))
+});
+var WorkUnitReleaseInput = Schema25.Struct({
+  workUnitId: Id,
+  lease: WorkUnitLeaseInput,
+  crashed: Schema25.optionalKey(Schema25.Struct({ reason: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(500)) }))
+});
+var CheckEvidence = Schema25.Struct({
+  name: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(120)),
+  command: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(2000)),
+  status: Schema25.Union([Schema25.Literal("passed"), Schema25.Literal("failed")]),
+  exitCode: Schema25.optionalKey(Schema25.Int),
+  durationMs: Schema25.Int.check(Schema25.isGreaterThanOrEqualTo(0)),
+  outputTail: Schema25.String.check(Schema25.isMaxLength(8000)),
+  fileIds: Schema25.optionalKey(Schema25.Array(Schema25.String).check(Schema25.isMaxLength(51)))
+});
+var TreeEvidence = Schema25.Struct({
+  revision: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(240)),
+  tree: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(120)),
+  checks: Schema25.Array(CheckEvidence).check(Schema25.isMaxLength(50))
+});
+var VerificationEvidence = Schema25.Struct({
+  head: TreeEvidence,
+  baseline: Schema25.optionalKey(TreeEvidence),
+  measurement: Schema25.optionalKey(MeasureEvidence)
+});
+var BoundaryChange = Schema25.Struct({
+  kind: Schema25.Literal("change"),
+  changedPaths: Schema25.Array(Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(4096))).check(Schema25.isMaxLength(1000)),
+  omittedPaths: Schema25.Int.check(Schema25.isGreaterThanOrEqualTo(0)),
+  files: Schema25.Array(Schema25.Struct({
+    path: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(4096)),
+    excerpt: Schema25.String.check(Schema25.isMaxLength(250000)),
+    redacted: Schema25.Boolean,
+    truncated: Schema25.Boolean
+  })).check(Schema25.isMaxLength(20)),
+  truncated: Schema25.Boolean
+});
+var catchUpPathLimit = 200;
+var CatchUpPaths = Schema25.Array(Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(1000))).check(Schema25.isMaxLength(catchUpPathLimit));
+var Revision = Schema25.String.check(Schema25.isPattern(/^[0-9a-f]{40,64}$/));
+var CatchUp = Schema25.Struct({
+  from: Revision,
+  head: Revision,
+  conflicted: CatchUpPaths,
+  rewritten: CatchUpPaths,
+  changed: CatchUpPaths,
+  truncated: Schema25.Boolean
+});
+var HarnessHold = Schema25.Struct({
+  reason: Schema25.Literals(HarnessHoldReasons),
+  until: Schema25.optionalKey(Timestamp),
+  scope: Schema25.optionalKey(Schema25.Literal("step"))
+});
+var StepRestart = Schema25.Struct({ reason: Schema25.Literal("login_revoked") });
+var WorkUnitOutcome = Schema25.Struct({
+  status: Schema25.Union([
+    Schema25.Literal("completed"),
+    Schema25.Literal("failed"),
+    Schema25.Literal("blocked"),
+    Schema25.Literal("canceled")
+  ]),
+  result: Schema25.optionalKey(LoopStepOutput),
+  revision: Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(120))),
+  evidence: Schema25.optionalKey(VerificationEvidence),
+  boundary: Schema25.optionalKey(BoundaryChange),
+  catchUp: Schema25.optionalKey(CatchUp),
+  harnessHold: Schema25.optionalKey(HarnessHold),
+  restart: Schema25.optionalKey(StepRestart),
+  failureSummary: Schema25.optionalKey(Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(4000)))
+});
+var WorkUnitCompletion = Schema25.Struct({
+  workUnitId: Id,
+  lease: WorkUnitLeaseInput,
+  idempotencyKey: Schema25.String.check(Schema25.isMinLength(1), Schema25.isMaxLength(240)),
+  outcome: WorkUnitOutcome
+});
+
+// packages/sdk/src/loop/measure.ts
+import * as Effect7 from "effect/Effect";
+import * as Schema26 from "effect/Schema";
+import { DurableDeferred as DurableDeferred3 } from "effect/workflow";
+var MetricStats2 = Schema26.Struct({
+  samples: Schema26.Finite,
+  median: Schema26.Finite,
+  mean: Schema26.Finite,
+  min: Schema26.Finite,
+  max: Schema26.Finite,
+  stdev: Schema26.Finite
+});
+var MeasureVerdict2 = Schema26.Literals(["gain", "no_gain", "guardrail_regressed", "too_noisy"]);
+var Measurement2 = Schema26.Struct({
+  verdict: MeasureVerdict2,
+  reason: Schema26.String,
+  metrics: Schema26.Array(Schema26.Struct({
+    name: Schema26.String,
+    role: Schema26.Literals(["primary", "guardrail"]),
+    direction: Schema26.Literals(["lower", "higher"]),
+    base: MetricStats2,
+    head: MetricStats2,
+    change: Schema26.Finite,
+    noise: Schema26.Finite
+  })),
+  suggestion: Schema26.optional(Schema26.String),
+  evidence: MeasureEvidence
+});
+var measureDeferred2 = (step) => DurableDeferred3.make(`measure/${step}`, { success: MeasureEvidence, error: StepFailed2 });
+var stats = (values) => {
+  if (values.length === 0)
+    return { samples: 0, median: 0, mean: 0, min: 0, max: 0, stdev: 0 };
+  const sorted = [...values].sort((left, right) => left - right);
+  const middle = Math.floor(sorted.length / 2);
+  const mean = values.reduce((sum, value) => sum + value, 0) / values.length;
+  return {
+    samples: values.length,
+    median: sorted.length % 2 === 0 ? ((sorted[middle - 1] ?? 0) + (sorted[middle] ?? 0)) / 2 : sorted[middle] ?? 0,
+    mean,
+    min: sorted[0] ?? 0,
+    max: sorted.at(-1) ?? 0,
+    stdev: Math.sqrt(values.reduce((sum, value) => sum + (value - mean) ** 2, 0) / values.length)
+  };
+};
+var valuesOf = (samples, metric) => samples.flatMap((sample) => sample[metric] === undefined ? [] : [sample[metric]]);
+var incomplete = (plan, evidence) => plan.metrics.map((metric) => metric.name).filter((metric) => evidence.base.length === 0 || evidence.head.length === 0 || [...evidence.base, ...evidence.head, ...evidence.baseAgain ?? []].some((sample) => sample[metric] === undefined));
+var relative = (delta, of) => of === 0 ? Math.sign(delta) : delta / Math.abs(of);
+var noiseFloor2 = (plan, evidence) => Object.fromEntries(plan.metrics.map((metric) => {
+  const base = stats(valuesOf(evidence.base, metric.name));
+  const again = stats(valuesOf(evidence.baseAgain ?? [], metric.name));
+  const spread = relative(base.stdev, base.median);
+  const gap = again.samples === 0 ? 0 : relative(Math.abs(again.median - base.median), base.median);
+  return [metric.name, Math.max(spread, gap)];
+}));
+var judgeMeasurement2 = (plan, evidence, noise, limits) => {
+  const metrics = plan.metrics.map((metric) => {
+    const base = stats(valuesOf(evidence.base, metric.name));
+    const head = stats(valuesOf(evidence.head, metric.name));
+    const delta = metric.direction === "lower" ? base.median - head.median : head.median - base.median;
+    const change = base.samples === 0 || head.samples === 0 ? 0 : relative(delta, base.median);
+    return { ...metric, base, head, change, noise: noise[metric.name] ?? 0 };
+  });
+  const percent = (fraction) => `${(fraction * 100).toFixed(1)}%`;
+  const primary = metrics.find((metric) => metric.role === "primary");
+  const judged = { metrics, evidence };
+  if (primary === undefined)
+    return { ...judged, verdict: "too_noisy", reason: "The plan names no primary metric" };
+  const missing = incomplete(plan, evidence);
+  if (missing.length > 0)
+    return { ...judged, verdict: "too_noisy", reason: `${missing.join(", ")} is missing from some samples` };
+  if (!Number.isFinite(primary.noise) || primary.noise > limits.threshold) {
+    const steadier = plan.metrics.find((metric) => metric.lowVariance === true && metric.name !== primary.name);
+    return {
+      ...judged,
+      verdict: "too_noisy",
+      reason: `${primary.name} strays ${percent(primary.noise)} from itself, more than the ${percent(limits.threshold)} threshold`,
+      suggestion: steadier === undefined ? "Measure a low-variance counter (instructions, allocations, queries) and make it the primary metric" : `Make ${steadier.name}, which varies less, the primary metric`
+    };
+  }
+  const regressed = metrics.filter((metric) => metric.role === "guardrail" && metric.change < -(limits.tolerance + metric.noise));
+  if (regressed.length > 0)
+    return {
+      ...judged,
+      verdict: "guardrail_regressed",
+      reason: regressed.map((metric) => `${metric.name} got ${percent(-metric.change)} worse, beyond the ${percent(limits.tolerance)} tolerance`).join("; ")
+    };
+  return primary.change > limits.threshold + primary.noise ? {
+    ...judged,
+    verdict: "gain",
+    reason: `${primary.name} improved ${percent(primary.change)}, past the ${percent(limits.threshold)} threshold and ${percent(primary.noise)} of noise`
+  } : {
+    ...judged,
+    verdict: "no_gain",
+    reason: `${primary.name} changed ${percent(primary.change)}, within the ${percent(limits.threshold)} threshold and ${percent(primary.noise)} of noise`
+  };
+};
+var floors = new WeakMap;
+var measure2 = (name, request) => takeStep2(name, "measure", "measure", Effect7.gen(function* () {
+  const run = yield* LoopRun2;
+  const known = floors.get(run);
+  const deferred = measureDeferred2(name);
+  yield* launch2(deferred, (host, token) => host.startVerification({
+    step: name,
+    ...request.head === undefined ? undefined : { revision: request.head },
+    measure: {
+      ...request.base === undefined ? undefined : { base: request.base },
+      plan: request.plan,
+      samples: request.samples ?? 5,
+      calibrate: known === undefined
+    },
+    token
+  }));
+  const evidence = yield* DurableDeferred3.await(deferred);
+  const noise = known ?? noiseFloor2(request.plan, evidence);
+  if (known === undefined && incomplete(request.plan, evidence).length === 0)
+    floors.set(run, noise);
+  return judgeMeasurement2(request.plan, evidence, noise, {
+    threshold: request.threshold ?? 0.05,
+    tolerance: request.tolerance ?? 0.02
+  });
+}));
+
+// packages/sdk/src/loop/test-loop.ts
+var LoopJournal2 = Schema27.Struct({
+  activities: Schema27.Record(Schema27.String, Schema27.Json),
+  deferreds: Schema27.Record(Schema27.String, Schema27.Json)
 });
 
 class ScriptedFailure2 extends Data2.TaggedClass("ScriptedFailure") {
@@ -3884,106 +4052,140 @@ class ScriptedFailure2 extends Data2.TaggedClass("ScriptedFailure") {
 var scriptedFailure2 = (reason) => new ScriptedFailure2({ reason });
 var defaultActivities = {
   changeRequest: {
-    run: () => Effect6.succeed({ id: "change-request-1", number: "1", url: "test://change-requests/1" })
+    run: () => Effect8.succeed({ id: "change-request-1", number: "1", url: "test://change-requests/1" })
   },
-  writeBack: { run: () => Effect6.void },
-  artifact: { run: (request) => Effect6.succeed({ artifactId: request.title }) },
-  file: { run: (_request, step) => Effect6.succeed({ id: `file-${step}` }) },
-  note: { run: () => Effect6.void },
-  comment: { run: () => Effect6.void },
+  writeBack: { run: () => Effect8.void },
+  artifact: { run: (request) => Effect8.succeed({ artifactId: request.title }) },
+  file: { run: (_request, step) => Effect8.succeed({ id: `file-${step}` }) },
+  note: { run: () => Effect8.void },
+  comment: { run: () => Effect8.void },
   createTasks: {
-    run: (request) => Effect6.succeed({ tasks: request.tickets.map((ticket) => ({ key: ticket.key, taskId: `task-${ticket.key}` })) })
+    run: (request) => Effect8.succeed({ tasks: request.tickets.map((ticket) => ({ key: ticket.key, taskId: `task-${ticket.key}` })) })
   },
+  alertTask: { run: () => Effect8.succeed({ taskId: "task-alert", created: true }) },
   integrationBranch: {
-    run: (request) => Effect6.succeed({
+    run: (request) => Effect8.succeed({
       repoBindingId: request.repoBindingId ?? "repo",
       branch: "kitman/run/integration",
       revision: "integration-head"
     })
   },
   mergeChangeRequest: {
-    run: (request) => Effect6.succeed({ status: "merged", revision: `merged-${request.changeRequestId}` })
+    run: (request) => Effect8.succeed({ status: "merged", revision: `merged-${request.changeRequestId}` }),
+    close: () => Effect8.succeed({ closed: true }),
+    rerun: () => Effect8.succeed({ head: "head", pipelines: 1 }),
+    report: () => Effect8.succeed({ head: "head", status: "success" }),
+    approve: (request) => Effect8.succeed({ approved: true, reviewId: `review-${request.changeRequestId}` })
   },
   release: {
-    run: (request) => Effect6.succeed({
+    run: (request) => Effect8.succeed({
       tag: request.tag,
       revision: request.revision ?? "base-head",
       url: `test://releases/${request.tag}`
     })
   },
-  transcripts: { run: () => Effect6.succeed({ runs: [] }) },
-  propose: { run: (request, step) => Effect6.succeed({ kind: request.kind, id: `${request.kind}-${step}` }) },
+  transcripts: { run: () => Effect8.succeed({ runs: [] }) },
+  changeRequestRead: {
+    pipeline: () => Effect8.succeed({ head: "head", status: "success", source: "forge", jobs: [] }),
+    reviewThreads: () => Effect8.succeed({ threads: [] }),
+    opened: () => Effect8.succeed({ changeRequests: [] }),
+    own: () => Effect8.succeed({ changeRequests: [] })
+  },
+  propose: { run: (request, step) => Effect8.succeed({ kind: request.kind, id: `${request.kind}-${step}` }) },
   projectActivity: {
-    run: (request) => Effect6.succeed({ project: { id: request.projectId, name: request.projectId }, runs: [], taskChanges: [] })
+    run: (request) => Effect8.succeed({ project: { id: request.projectId, name: request.projectId }, runs: [], taskChanges: [] })
   },
-  draftUpdate: { run: (_, step) => Effect6.succeed({ id: `draft-${step}` }) }
+  draftUpdate: { run: (_, step) => Effect8.succeed({ id: `draft-${step}` }) }
 };
-var withoutServices = (effect) => Effect6.orDie(Effect6.provide(effect, Context3.empty()));
-var deferredExit = (deferred) => Schema20.Exit(Schema20.toCodecJson(deferred.successSchema), Schema20.toCodecJson(deferred.errorSchema), Schema20.toCodecJson(Schema20.Defect()));
+var withoutServices = (effect) => Effect8.orDie(Effect8.provide(effect, Context3.empty()));
+var deferredExit = (deferred) => Schema27.Exit(Schema27.toCodecJson(deferred.successSchema), Schema27.toCodecJson(deferred.errorSchema), Schema27.toCodecJson(Schema27.Defect()));
 var journaled = (engine, journal, ran) => ({
   ...engine,
-  activityExecute: (activity, attempt) => Effect6.gen(function* () {
+  activityExecute: (activity, attempt) => Effect8.gen(function* () {
     const key = `${activity.name}/${attempt}`;
     const recorded = journal.activities[key];
     if (recorded !== undefined)
       return new Workflow.Complete({
-        exit: yield* withoutServices(Schema20.decodeEffect(Schema20.toCodecJson(activity.exitSchema))(recorded))
+        exit: yield* withoutServices(Schema27.decodeEffect(Schema27.toCodecJson(activity.exitSchema))(recorded))
       });
     const result = yield* engine.activityExecute(activity, attempt);
     if (result instanceof Workflow.Complete) {
       ran.push(activity.name);
-      journal.activities[key] = yield* withoutServices(Schema20.encodeEffect(Schema20.toCodecJson(activity.exitSchema))(result.exit));
+      journal.activities[key] = yield* withoutServices(Schema27.encodeEffect(Schema27.toCodecJson(activity.exitSchema))(result.exit));
     }
     return result;
   }),
-  deferredResult: (deferred) => Effect6.gen(function* () {
+  deferredResult: (deferred) => Effect8.gen(function* () {
     const recorded = journal.deferreds[deferred.name];
     if (recorded !== undefined)
-      return Option2.some(yield* withoutServices(Schema20.decodeEffect(Schema20.toCodecJson(deferredExit(deferred)))(recorded)));
+      return Option2.some(yield* withoutServices(Schema27.decodeEffect(Schema27.toCodecJson(deferredExit(deferred)))(recorded)));
     const result = yield* engine.deferredResult(deferred);
     if (Option2.isSome(result))
-      journal.deferreds[deferred.name] = yield* withoutServices(Schema20.encodeEffect(Schema20.toCodecJson(deferredExit(deferred)))(result.value));
+      journal.deferreds[deferred.name] = yield* withoutServices(Schema27.encodeEffect(Schema27.toCodecJson(deferredExit(deferred)))(result.value));
     return result;
   })
 });
 var scriptedExit = (scripted, failure) => scripted === undefined ? Exit3.fail(failure("nothing was scripted for this Step")) : scripted instanceof ScriptedFailure2 ? Exit3.fail(failure(scripted.reason)) : Exit3.succeed(scripted);
-var scriptedHost = (script, engine, agentLaunches, childLaunches) => {
-  const resolve = (deferred, token, exit) => DurableDeferred2.done(deferred, { token, exit }).pipe(Effect6.provideService(WorkflowEngine.WorkflowEngine, engine));
+var scriptedHost = (script, engine, agentLaunches, childLaunches, waits) => {
+  const resolve = (deferred, token, exit) => DurableDeferred4.done(deferred, { token, exit }).pipe(Effect8.provideService(WorkflowEngine.WorkflowEngine, engine));
   return {
-    startAgentWork: (launch) => Effect6.andThen(Effect6.sync(() => agentLaunches.push({
+    startAgentWork: (launch) => Effect8.andThen(Effect8.sync(() => agentLaunches.push({
       step: launch.step,
       agent: launch.agent,
       prompt: launch.prompt,
-      ...launch.secrets === undefined ? undefined : { secrets: launch.secrets }
-    })), resolve(agentWorkDeferred2(launch.step), launch.token, scriptedExit(script.outputs?.[launch.step], (reason) => new StepFailed2({ step: launch.step, reason })))),
+      ...launch.skill === undefined ? undefined : { skill: launch.skill },
+      ...launch.secrets === undefined ? undefined : { secrets: launch.secrets },
+      ...launch.mergeTarget === undefined ? undefined : { mergeTarget: launch.mergeTarget }
+    })), resolve(agentDeferredNamed2(launch.deferredName), launch.token, scriptedExit(script.outputs?.[launch.step], (reason) => new StepFailed2({ step: launch.step, reason })))),
     putQuestion: (launch) => {
-      const answer = script.answers?.[launch.step];
+      const answer = script.answers?.[launch.step] ?? launch.default;
       return resolve(answerDeferred2(launch.step), launch.token, answer === undefined ? Exit3.fail(new StepFailed2({ step: launch.step, reason: "no answer was scripted" })) : Exit3.succeed(answer));
     },
-    admitChild: (launch) => Effect6.andThen(Effect6.sync(() => childLaunches.push({ step: launch.step, loop: launch.loop, input: launch.input })), resolve(childDeferred2(launch.step), launch.token, scriptedExit(script.children?.[launch.step], (reason) => new ChildFailed2({ step: launch.step, loop: launch.loop, reason })))),
+    admitChild: (launch) => Effect8.andThen(Effect8.sync(() => childLaunches.push({ step: launch.step, loop: launch.loop, input: launch.input })), resolve(childDeferred2(launch.step), launch.token, scriptedExit(script.children?.[launch.step], (reason) => new ChildFailed2({ step: launch.step, loop: launch.loop, reason })))),
     awaitEvent: (launch) => {
       const event = script.events?.[launch.step];
+      waits.push({
+        step: launch.step,
+        event: launch.event,
+        ...launch.filter === undefined ? undefined : { filter: launch.filter },
+        ...launch.since === undefined ? undefined : { since: launch.since },
+        ...launch.or === undefined ? undefined : { or: launch.or }
+      });
       return resolve(eventDeferred2(launch.step), launch.token, event === undefined ? Exit3.fail(new WaitTimedOut2({ step: launch.step, event: launch.event })) : Exit3.succeed(event));
     },
+    claimResource: (launch) => launch.action === "let_go" ? resolve(letGoDeferred2(launch.step), launch.token, Exit3.succeed(null)) : resolve(claimDeferred2(launch.step), launch.token, Exit3.succeed(script.claims?.[launch.step] ?? { status: "granted", resource: launch.resource })),
     startVerification: (launch) => {
       const scripted = script.verifications?.[launch.step];
+      if (launch.measure !== undefined) {
+        const measured = script.measurements?.[launch.step];
+        const flat = Array.from({ length: launch.measure.samples }, () => Object.fromEntries(launch.measure?.plan.metrics.map((metric) => [metric.name, 100]) ?? []));
+        return resolve(measureDeferred2(launch.step), launch.token, measured instanceof ScriptedFailure2 ? Exit3.fail(new StepFailed2({ step: launch.step, reason: measured.reason })) : Exit3.succeed(measured ?? { base: flat, head: flat, ...launch.measure.calibrate ? { baseAgain: flat } : undefined }));
+      }
       return resolve(verifyDeferred2(launch.step), launch.token, scripted instanceof ScriptedFailure2 ? Exit3.fail(new StepFailed2({ step: launch.step, reason: scripted.reason })) : Exit3.succeed(scripted ?? {
         revision: launch.revision ?? "head",
         tree: launch.revision ?? "head",
         passed: true,
-        checks: []
+        checks: (launch.suggested ?? []).map((check) => ({
+          name: check.name,
+          command: check.command,
+          status: "passed",
+          preExisting: false,
+          durationMs: 0,
+          evidenceId: `suggested-${check.name}`,
+          suggested: true
+        }))
       }));
     }
   };
 };
 var loopWorkflow2 = (loop) => Workflow.make(`kitman-loop/${loop.id}`, {
-  payload: { input: Schema20.Json },
+  payload: { input: Schema27.Json },
   idempotencyKey: () => loop.id,
   success: loop.output,
-  error: Schema20.declare((_error) => true)
+  error: Schema27.declare((_error) => true)
 });
-var executeLoop2 = (loop, runtime) => ({ input }) => Effect6.gen(function* () {
-  const decoded = yield* Schema20.decodeEffect(Schema20.toCodecJson(loop.input))(input).pipe(Effect6.mapError((error) => new InputInvalid2({ loop: loop.id, message: error.message })));
+var executeLoop2 = (loop, runtime) => ({ input }) => Effect8.gen(function* () {
+  const decoded = yield* Schema27.decodeEffect(Schema27.toCodecJson(loop.input))(input).pipe(Effect8.mapError((error) => new InputInvalid2({ loop: loop.id, message: error.message })));
   const run = LoopRun2.of({
     loop: loop.id,
     agents: loop.agents,
@@ -3993,7 +4195,7 @@ var executeLoop2 = (loop, runtime) => ({ input }) => Effect6.gen(function* () {
     steps: []
   });
   runtime.onRun?.(run);
-  return yield* loop.run(decoded).pipe(Effect6.provideService(LoopRun2, run), Effect6.provideService(LoopHost2, runtime.host), Effect6.provideService(ChangeRequestActivity2, runtime.activities.changeRequest), Effect6.provideService(WriteBackActivity2, runtime.activities.writeBack), Effect6.provideService(ArtifactActivity2, runtime.activities.artifact), Effect6.provideService(FileActivity2, runtime.activities.file), Effect6.provideService(NoteActivity2, runtime.activities.note), Effect6.provideService(CommentActivity2, runtime.activities.comment), Effect6.provideService(CreateTasksActivity2, runtime.activities.createTasks), Effect6.provideService(IntegrationBranchActivity2, runtime.activities.integrationBranch), Effect6.provideService(MergeChangeRequestActivity2, runtime.activities.mergeChangeRequest), Effect6.provideService(ReleaseActivity2, runtime.activities.release), Effect6.provideService(TranscriptsActivity2, runtime.activities.transcripts), Effect6.provideService(ProposeActivity2, runtime.activities.propose), Effect6.provideService(ProjectActivityActivity2, runtime.activities.projectActivity), Effect6.provideService(DraftUpdateActivity2, runtime.activities.draftUpdate));
+  return yield* loop.run(decoded).pipe(Effect8.provideService(LoopRun2, run), Effect8.provideService(LoopHost2, runtime.host), Effect8.provideService(ChangeRequestActivity2, runtime.activities.changeRequest), Effect8.provideService(WriteBackActivity2, runtime.activities.writeBack), Effect8.provideService(ArtifactActivity2, runtime.activities.artifact), Effect8.provideService(FileActivity2, runtime.activities.file), Effect8.provideService(NoteActivity2, runtime.activities.note), Effect8.provideService(CommentActivity2, runtime.activities.comment), Effect8.provideService(CreateTasksActivity2, runtime.activities.createTasks), Effect8.provideService(AlertTaskActivity2, runtime.activities.alertTask), Effect8.provideService(IntegrationBranchActivity2, runtime.activities.integrationBranch), Effect8.provideService(MergeChangeRequestActivity2, runtime.activities.mergeChangeRequest), Effect8.provideService(ReleaseActivity2, runtime.activities.release), Effect8.provideService(TranscriptsActivity2, runtime.activities.transcripts), Effect8.provideService(ChangeRequestReadActivity2, runtime.activities.changeRequestRead), Effect8.provideService(ProposeActivity2, runtime.activities.propose), Effect8.provideService(ProjectActivityActivity2, runtime.activities.projectActivity), Effect8.provideService(DraftUpdateActivity2, runtime.activities.draftUpdate));
 });
 var testLoop2 = (loop, script) => {
   const journal = {
@@ -4003,43 +4205,49 @@ var testLoop2 = (loop, script) => {
   const ran = [];
   const agentLaunches = [];
   const childLaunches = [];
+  const waits = [];
   let latestSteps = [];
-  const granted = new Set((script.grant ?? loop.capabilities).filter((capability) => loop.capabilities.includes(capability)));
-  const activities = { ...defaultActivities, ...script.activities };
+  const declared = capabilitiesOf2(loop);
+  const granted = new Set((script.grant ?? declared).filter((capability) => declared.includes(capability)));
+  const overrides = script.activities ?? {};
+  const activities = Record12.map(defaultActivities, (service, key) => ({
+    ...service,
+    ...overrides[key]
+  }));
   const workflow = loopWorkflow2(loop);
-  const execute = (payload) => Effect6.gen(function* () {
+  const execute = (payload) => Effect8.gen(function* () {
     const engine = yield* WorkflowEngine.WorkflowEngine;
     return yield* executeLoop2(loop, {
-      host: scriptedHost(script, engine, agentLaunches, childLaunches),
+      host: scriptedHost(script, engine, agentLaunches, childLaunches, waits),
       activities,
       granted,
       onRun: (run) => {
         latestSteps = run.steps;
       }
-    })(payload).pipe(Effect6.provideService(WorkflowEngine.WorkflowEngine, journaled(engine, journal, ran)));
+    })(payload).pipe(Effect8.provideService(WorkflowEngine.WorkflowEngine, journaled(engine, journal, ran)));
   });
-  return Effect6.gen(function* () {
-    const result = yield* Effect6.exit(workflow.execute({ input: script.input }).pipe(Effect6.provideService(ConfigProvider.ConfigProvider, ConfigProvider.fromUnknown(script.secrets ?? {}))));
-    return { result, steps: latestSteps, journal, activities: ran, agentLaunches, childLaunches };
-  }).pipe(Effect6.provide(workflow.toLayer(execute).pipe(Layer.provideMerge(WorkflowEngine.layerMemory))));
+  return Effect8.gen(function* () {
+    const result = yield* Effect8.exit(workflow.execute({ input: script.input }).pipe(Effect8.provideService(ConfigProvider.ConfigProvider, ConfigProvider.fromUnknown(script.secrets ?? {}))));
+    return { result, steps: latestSteps, journal, activities: ran, agentLaunches, childLaunches, waits };
+  }).pipe(Effect8.provide(workflow.toLayer(execute).pipe(Layer.provideMerge(WorkflowEngine.layerMemory))));
 };
 // packages/sdk/src/loop/review.ts
-import * as Schema21 from "effect/Schema";
-var Severity2 = Schema21.Literals(["blocker", "major", "minor"]);
-var Finding2 = Schema21.Struct({
+import * as Schema28 from "effect/Schema";
+var Severity2 = Schema28.Literals(["blocker", "major", "minor"]);
+var Finding2 = Schema28.Struct({
   severity: Severity2,
-  file: Schema21.String,
-  line: Schema21.Int,
-  detail: Schema21.String
+  file: Schema28.String,
+  line: Schema28.Int,
+  detail: Schema28.String
 });
-var MergedFinding2 = Schema21.Struct({
-  id: Schema21.String,
+var MergedFinding2 = Schema28.Struct({
+  id: Schema28.String,
   ...Finding2.fields,
-  seats: Schema21.Array(Schema21.String)
+  seats: Schema28.Array(Schema28.String)
 });
-var Rebuttal2 = Schema21.Struct({ findingId: Schema21.String, reason: Schema21.String });
-var RebuttalVerdict2 = Schema21.Struct({ findingId: Schema21.String, accepted: Schema21.Boolean });
-var ScopeJudgement2 = Schema21.Struct({ met: Schema21.Boolean, unmet: Schema21.Array(Schema21.String) });
+var Rebuttal2 = Schema28.Struct({ findingId: Schema28.String, reason: Schema28.String });
+var RebuttalVerdict2 = Schema28.Struct({ findingId: Schema28.String, accepted: Schema28.Boolean });
+var ScopeJudgement2 = Schema28.Struct({ met: Schema28.Boolean, unmet: Schema28.Array(Schema28.String) });
 var rank = { blocker: 0, major: 1, minor: 2 };
 var isBlocking2 = (finding) => finding.severity !== "minor";
 var mergeFindings2 = (bySeat) => {
@@ -4094,14 +4302,14 @@ var rallyStop2 = (input) => {
 var sameIds = (left, right) => left.length === right.length && left.every((id) => right.includes(id));
 // packages/sdk/src/loop/check.ts
 import * as Cause2 from "effect/Cause";
-import * as Effect7 from "effect/Effect";
+import * as Effect9 from "effect/Effect";
 import * as Exit5 from "effect/Exit";
-import * as Predicate2 from "effect/Predicate";
-import * as Schema22 from "effect/Schema";
-class CheckFailed2 extends Schema22.TaggedError()("CheckFailed", {
-  loop: Schema22.String,
-  check: Schema22.String,
-  reason: Schema22.String
+import * as Predicate3 from "effect/Predicate";
+import * as Schema29 from "effect/Schema";
+class CheckFailed2 extends Schema29.TaggedError()("CheckFailed", {
+  loop: Schema29.String,
+  check: Schema29.String,
+  reason: Schema29.String
 }) {
   get detail() {
     return `Check "${this.check}": ${this.reason}`;
@@ -4111,10 +4319,10 @@ class CheckFailed2 extends Schema22.TaggedError()("CheckFailed", {
   }
 }
 
-class StepNamedTwice2 extends Schema22.TaggedError()("StepNamedTwice", {
-  loop: Schema22.String,
-  check: Schema22.String,
-  step: Schema22.String
+class StepNamedTwice2 extends Schema29.TaggedError()("StepNamedTwice", {
+  loop: Schema29.String,
+  check: Schema29.String,
+  step: Schema29.String
 }) {
   get detail() {
     return `Check "${this.check}": Step "${this.step}" is named twice`;
@@ -4124,12 +4332,12 @@ class StepNamedTwice2 extends Schema22.TaggedError()("StepNamedTwice", {
   }
 }
 
-class ReplayDiverged2 extends Schema22.TaggedError()("ReplayDiverged", {
-  loop: Schema22.String,
-  check: Schema22.String,
-  first: Schema22.Array(Schema22.String),
-  replay: Schema22.Array(Schema22.String),
-  rerun: Schema22.Array(Schema22.String)
+class ReplayDiverged2 extends Schema29.TaggedError()("ReplayDiverged", {
+  loop: Schema29.String,
+  check: Schema29.String,
+  first: Schema29.Array(Schema29.String),
+  replay: Schema29.Array(Schema29.String),
+  rerun: Schema29.Array(Schema29.String)
 }) {
   get detail() {
     const steps = (names) => names.join(", ") || "no Steps";
@@ -4139,12 +4347,12 @@ class ReplayDiverged2 extends Schema22.TaggedError()("ReplayDiverged", {
     return `Loop "${this.loop}": ${this.detail}`;
   }
 }
-var LoopCheckError2 = Schema22.Union([CheckFailed2, StepNamedTwice2, ReplayDiverged2]);
-var checkLoop2 = (loop, check) => Effect7.gen(function* () {
+var LoopCheckError2 = Schema29.Union([CheckFailed2, StepNamedTwice2, ReplayDiverged2]);
+var checkLoop2 = (loop, check) => Effect9.gen(function* () {
   const first = yield* testLoop2(loop, check.script);
   if (Exit5.isFailure(first.result)) {
     const error = Cause2.squash(first.result.cause);
-    if (Predicate2.isTagged(error, "DuplicateStep") && Predicate2.hasProperty(error, "step"))
+    if (Predicate3.isTagged(error, "DuplicateStep") && Predicate3.hasProperty(error, "step"))
       return yield* new StepNamedTwice2({ loop: loop.id, check: check.name, step: String(error.step) });
     return yield* new CheckFailed2({
       loop: loop.id,
@@ -4164,5 +4372,64 @@ var checkLoop2 = (loop, check) => Effect7.gen(function* () {
     });
 });
 // packages/sdk/src/loop/config.ts
-var defineConfig2 = (config) => config;
-export { AgentSandboxNetwork, Numeric, isWholeNumber, guard, Id, Timestamp, LoopStepOutput, StepBrief, LoopCapabilities2, LoopManifest, AgentDeclaration, KitInstallationDeclaration, KitAssignmentDeclaration, PackageDeclarations, LoopOutcome2, defineLoop2, ManifestInvalid2, jsonSchemaOf2, loopManifest2, EvidenceCheck2, VerifyResult2, OutcomeTable2, evidenceGate2, StepFailed2, OutputInvalid2, QuestionRefused2, WaitTimedOut2, ChildFailed2, CapabilityDenied2, DuplicateStep2, InputInvalid2, LoopEvent2, LoopRun2, LoopHost2, agentWorkDeferred2, answerDeferred2, childDeferred2, eventDeferred2, verifyDeferred2, takeStep2, agentWork2, ask2, call2, waitFor2, verify2, suggestVerification2, PlanTicket2, PlanTickets2, BlockingCycle2, planWaves2, ChangeRequestRequest2, ChangeRequestResult2, WriteBackMilestones2, WriteBackRequest2, RunFile2, FileRequest2, ArtifactRequest2, ArtifactResult2, NoteRequest2, CreateTasksRequest2, CreateTasksResult2, IntegrationBranchRequest2, IntegrationBranch2, MergeChangeRequestRequest2, MergeResult2, CommentRequest2, ReleaseRequest2, ReleaseResult2, TranscriptPoint2, TranscriptsRequest2, TranscriptsResult2, ProposeRequest2, ProposeResult2, ProjectActivityRequest2, ProjectActivityResult2, DraftUpdateRequest2, DraftUpdateResult2, ChangeRequestActivity2, WriteBackActivity2, ArtifactActivity2, FileActivity2, NoteActivity2, CommentActivity2, CreateTasksActivity2, IntegrationBranchActivity2, MergeChangeRequestActivity2, ReleaseActivity2, TranscriptsActivity2, ProposeActivity2, ProjectActivityActivity2, DraftUpdateActivity2, changeRequest2, writeBack2, artifact2, file2, note2, comment2, createTasks2, integrationBranch2, mergeChangeRequest2, release2, transcripts2, propose2, projectActivity2, draftUpdate2, LoopJournal2, ScriptedFailure2, scriptedFailure2, loopWorkflow2, executeLoop2, testLoop2, Severity2, Finding2, MergedFinding2, Rebuttal2, RebuttalVerdict2, ScopeJudgement2, isBlocking2, mergeFindings2, splitDisputed2, settleRound2, rallyStop2, CheckFailed2, StepNamedTwice2, ReplayDiverged2, LoopCheckError2, checkLoop2, defineConfig2 };
+var defineKit2 = (config) => ({ ...config, loops: config.loops ?? [] });
+// packages/sdk/src/loop/sync.ts
+import * as Schema30 from "effect/Schema";
+var UpToDate = Schema30.Struct({ status: Schema30.Literal("up_to_date") });
+var Conflict = Schema30.Struct({
+  status: Schema30.Literal("conflict"),
+  files: Schema30.NonEmptyArray(Schema30.String),
+  reason: Schema30.String
+});
+var merged = {
+  status: Schema30.Literal("merged"),
+  settled: Schema30.Array(Schema30.String)
+};
+var SyncAnswer = Schema30.Union([UpToDate, Schema30.Struct(merged), Conflict]);
+var BaseSync2 = Schema30.Union([
+  UpToDate,
+  Schema30.Struct({ ...merged, catchUp: Schema30.optionalKey(CatchUp) }),
+  Conflict
+]);
+var afterMerge = "One thing comes before any answer of merged, a clean merge included, and stopping above means stopping after it: before you answer merged, do what the repository's agent instructions say to do once the target branch is merged in, such as regenerating this branch's database migrations on top of the target's. Leave what that changes in the workspace: Kitman commits it.";
+var prompt = (target) => [
+  `Kitman merged \`origin/${target}\` into this branch before you started, outside your sandbox, and says what came of it in a note after this brief. Do not fetch, as this workspace has no credential for the forge, and do not run git commands that write, such as \`git add\`, \`git commit\` or \`git merge --abort\`: Kitman finishes the merge itself from your answer.`,
+  "If it was already up to date, change nothing and answer up_to_date. If it merged cleanly, answer merged with no settled files and stop: do not review or test anything else.",
+  "If it conflicts, settle each file the note names so both sides' intent survives: leave no conflict marker, and for a file one side deleted or git could not mark, leave it as the version you want or delete it. Run the tests of the files you touched, and answer merged with those files under settled. Kitman then commits the files as you left them.",
+  "If you cannot settle a file, answer conflict with the files and why: Kitman then aborts the whole merge.",
+  "Never rebase, reset or force-push: this branch's history only grows."
+].concat(afterMerge).join(`
+
+`);
+var syncBase2 = (name, options) => agentWorkAs2(syncDeferred2, name, {
+  agent: options.agent,
+  prompt: prompt(options.target ?? "HEAD"),
+  output: BaseSync2,
+  answer: SyncAnswer,
+  mergeTarget: options.target ?? "HEAD"
+});
+// packages/sdk/src/loop/continuing.ts
+import * as Schema31 from "effect/Schema";
+var Continuing2 = Schema31.Struct({
+  changeRequestId: Schema31.String,
+  number: Schema31.String,
+  url: Schema31.String,
+  branch: Schema31.String,
+  targetBranch: Schema31.String,
+  revision: Schema31.optional(Schema31.String),
+  lastRunId: Schema31.optional(Schema31.String),
+  lastRunStatus: Schema31.optional(Schema31.String),
+  lastRunSummary: Schema31.optional(Schema31.String)
+});
+var continuingBrief2 = (continuing) => [
+  `This continues the work on ${continuing.branch}, whose ChangeRequest is ${continuing.url}. Build on what is there; do not start over.`,
+  ...continuing.lastRunId === undefined ? [] : [
+    `The last Run on it, ${continuing.lastRunId}, ended ${continuing.lastRunStatus ?? "unfinished"}${continuing.lastRunSummary === undefined ? "" : `: ${continuing.lastRunSummary}`}.`
+  ],
+  ...continuing.revision === undefined ? [] : [
+    `It last pushed ${continuing.revision}. If the branch head is newer, someone pushed since: read \`git log ${continuing.revision}..HEAD\` first and keep their work.`
+  ],
+  "The ChangeRequest's description lists what was left unsettled; settle those first."
+].join(`
+`);
+export { Numeric, isWholeNumber, guard, Id, Timestamp, canonicalJson, KitDigest, LoopCapabilities2, LoopManifest, AgentDeclaration, KitDeclarations, LoopOutcome2, capabilitiesOf2, defineLoop2, ManifestInvalid2, jsonSchemaOf2, loopManifest2, questionAdvice, EvidenceCheck2, VerifyResult2, OutcomeTable2, failsOn2, evidenceGate2, StepFailed2, OutputInvalid2, QuestionRefused2, WaitTimedOut2, ChangeRequestClosed2, ChildFailed2, CapabilityDenied2, DuplicateStep2, InputInvalid2, LoopEvent2, LoopRun2, LoopHost2, agentDeferredNamed2, agentWorkDeferred2, syncDeferred2, answerDeferred2, childDeferred2, eventDeferred2, verifyDeferred2, takeStep2, launch2, agentWork2, agentWorkAs2, agentWorkOnce2, ask2, call2, waitFor2, verify2, suggestVerification2, PlanTicket2, PlanTickets2, BlockingCycle2, planWaves2, ChangeRequestRequest2, ChangeRequestResult2, WriteBackMilestones2, WriteBackRequest2, RunFile2, FileRequest2, ArtifactRequest2, ArtifactResult2, NoteRequest2, CreateTasksRequest2, CreateTasksResult2, AlertTaskRequest2, AlertTaskResult2, IntegrationBranchRequest2, IntegrationBranch2, MergeChangeRequestRequest2, MergeResult2, ApproveChangeRequestRequest2, ApproveChangeRequestResult2, CloseChangeRequestRequest2, CloseChangeRequestResult2, RerunPipelineRequest2, RerunPipelineResult2, ReportPipelineRequest2, ReportPipelineResult2, CommentRequest2, ReleaseRequest2, ReleaseResult2, ChangeRequestReadRequest2, PipelineJob2, PipelineStatus2, ReviewThread2, ReviewThreads2, OpenChangeRequestsRequest2, OpenChangeRequest2, OpenChangeRequests2, OwnChangeRequest2, OwnChangeRequests2, TranscriptPoint2, TranscriptsRequest2, TranscriptsResult2, ProposeRequest2, ProposeResult2, ProjectActivityRequest2, ProjectActivityResult2, DraftUpdateRequest2, DraftUpdateResult2, ChangeRequestActivity2, WriteBackActivity2, ArtifactActivity2, FileActivity2, NoteActivity2, CommentActivity2, CreateTasksActivity2, AlertTaskActivity2, IntegrationBranchActivity2, MergeChangeRequestActivity2, ReleaseActivity2, TranscriptsActivity2, ProposeActivity2, ProjectActivityActivity2, DraftUpdateActivity2, ChangeRequestReadActivity2, changeRequest2, writeBack2, artifact2, file2, note2, comment2, createTasks2, alertTask2, integrationBranch2, mergeChangeRequest2, approveChangeRequest2, closeChangeRequest2, pipelineMoved2, rerunPipeline2, reportPipeline2, release2, transcripts2, propose2, projectActivity2, pipelineStatus2, reviewThreads2, openChangeRequests2, ownChangeRequests2, draftUpdate2, ResourceName, ClaimResult2, claimDeferred2, letGoDeferred2, claim2, letGo2, WorkUnitRepoBinding, ProgramWorkUnit, ApprovedCheck, MeasurePlan2, WorkUnitClaimResult, WorkUnitClaimInput, WorkUnitHeartbeatInput, WorkUnitHeartbeatResult, WorkUnitReleaseInput, WorkUnitCompletion, MetricStats2, MeasureVerdict2, Measurement2, measureDeferred2, noiseFloor2, judgeMeasurement2, measure2, LoopJournal2, ScriptedFailure2, scriptedFailure2, loopWorkflow2, executeLoop2, testLoop2, Severity2, Finding2, MergedFinding2, Rebuttal2, RebuttalVerdict2, ScopeJudgement2, isBlocking2, mergeFindings2, splitDisputed2, settleRound2, rallyStop2, CheckFailed2, StepNamedTwice2, ReplayDiverged2, LoopCheckError2, checkLoop2, defineKit2, BaseSync2, syncBase2, Continuing2, continuingBrief2 };