@kitman-sh/sdk 0.8.0 → 0.10.52

package/dist/{chunk-160ww64c.js → chunk-zvzw3zs4.js}

@@ -1,283 +1,406 @@
 // @bun
 import {
-  AgentSandboxNetwork,
   Numeric,
   isWholeNumber,
   guard,
   Id,
   Timestamp,
-  LoopStepOutput,
-  StepBrief,
   LoopManifest,
+  capabilitiesOf2,
   ManifestInvalid2,
   loopManifest2,
+  questionAdvice,
   StepFailed2,
-  agentWorkDeferred2,
   answerDeferred2,
   childDeferred2,
   eventDeferred2,
   verifyDeferred2,
+  ResourceName,
+  claimDeferred2,
+  letGoDeferred2,
+  WorkUnitRepoBinding,
+  ProgramWorkUnit,
+  ApprovedCheck,
+  MeasurePlan2,
+  WorkUnitClaimResult,
+  WorkUnitClaimInput,
+  WorkUnitHeartbeatInput,
+  WorkUnitHeartbeatResult,
+  WorkUnitReleaseInput,
+  WorkUnitCompletion,
+  measureDeferred2,
   loopWorkflow2,
   executeLoop2,
   LoopCheckError2,
   checkLoop2
-} from "./chunk-36jhc745.js";
-// packages/core/src/repo-binding.ts
+} from "./chunk-tcbgb4wm.js";
+// packages/core/src/agent-environment.ts
 import * as Schema from "effect/Schema";
-var ForgeKinds = ["github", "gitlab", "forgejo", "gitea", "gitee", "bitbucket", "azure-devops"];
-var ForgeKind = Schema.Literals(ForgeKinds);
-var RepoBindingProviders = [...ForgeKinds, "generic_git"];
-var RepoBindingPathPrefixPattern = "^(?!/)(?!.*\\\\)(?!.*(?:^|/)\\.\\.?(?:/|$))(?!.*//)\\S+$";
-var RepoBindingProvider = Schema.Literals(RepoBindingProviders);
-var RepoBindingStatus = Schema.Union([Schema.Literal("active"), Schema.Literal("disabled")]);
-var RepoBindingCredentialProviderType = Schema.Union([
-  Schema.Literal("env"),
-  Schema.Literal("file"),
-  Schema.Literal("exec")
+var AgentEnvironmentPolicy = Schema.Union([Schema.Literal("recommended"), Schema.Literal("required")]);
+var AgentHarnessId = Schema.Union([
+  Schema.Literal("opencode"),
+  Schema.Literal("claude-code"),
+  Schema.Literal("codex"),
+  Schema.Literal("pi")
 ]);
-var RepoBindingAccessMode = Schema.Union([
-  Schema.Literal("local_checkout"),
-  Schema.Literal("managed_clone"),
-  Schema.Literal("runner_secret_provider")
+var Sha256 = Schema.String.check(Schema.isPattern(new RegExp("^[a-fA-F0-9]{64}$", "u")));
+var relativePathPattern = "^(?!/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.\\.?($|/)).+$";
+var SourcePath = Schema.String.check(Schema.isMinLength(1), Schema.isPattern(new RegExp(relativePathPattern, "u")));
+var SkillSource = Schema.Union([
+  Schema.Struct({
+    kind: Schema.Literal("skills_sh"),
+    slug: Schema.String.check(Schema.isMinLength(1)),
+    version: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("kitman"),
+    skillId: Schema.optionalKey(Id),
+    name: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
+    contentMarkdown: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
+    files: Schema.optionalKey(Schema.Record(SourcePath, Schema.String))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("git"),
+    url: Schema.String.check(Schema.isMinLength(1)),
+    ref: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
+    path: Schema.optionalKey(SourcePath),
+    sha256: Schema.optionalKey(Sha256)
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("package"),
+    packageName: Schema.String.check(Schema.isMinLength(1)),
+    version: Schema.String.check(Schema.isMinLength(1)),
+    path: Schema.optionalKey(SourcePath),
+    sha256: Schema.optionalKey(Sha256)
+  }),
+  Schema.Struct({ kind: Schema.Literal("url"), url: Schema.String.check(Schema.isMinLength(1)), sha256: Sha256 }),
+  Schema.Struct({ kind: Schema.Literal("local_path"), path: Schema.String.check(Schema.isMinLength(1)) })
 ]);
-var RepoBindingCredentialRef = Schema.Union([
-  Schema.Struct({ kind: Schema.Literal("none") }),
-  Schema.Struct({ kind: Schema.Literal("local_env"), envName: Schema.String.check(Schema.isMinLength(1)) }),
+var PluginSource = Schema.Union([
   Schema.Struct({
+    kind: Schema.Literal("package"),
+    packageName: Schema.String.check(Schema.isMinLength(1)),
+    version: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("git"),
+    url: Schema.String.check(Schema.isMinLength(1)),
+    ref: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("url"),
+    url: Schema.String.check(Schema.isMinLength(1)),
+    sha256: Schema.String.check(Schema.isPattern(new RegExp("^[a-fA-F0-9]{64}$", "u")))
+  }),
+  Schema.Struct({ kind: Schema.Literal("local_path"), path: Schema.String.check(Schema.isMinLength(1)) })
+]);
+var McpServerTransport = Schema.Union([
+  Schema.Struct({
+    kind: Schema.Literal("stdio"),
+    command: Schema.String.check(Schema.isMinLength(1)),
+    args: Schema.optionalKey(Schema.Array(Schema.String)),
+    env: Schema.optionalKey(Schema.Record(Schema.String, Schema.String))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("streamable_http"),
+    url: Schema.String.check(Schema.isMinLength(1)),
+    headers: Schema.optionalKey(Schema.Record(Schema.String, Schema.String))
+  })
+]);
+var ProviderAuthRef = Schema.Union([
+  Schema.Struct({
+    provider: Schema.String.check(Schema.isMinLength(1)),
+    policy: AgentEnvironmentPolicy,
+    kind: Schema.Literal("existing_harness_login"),
+    accountHint: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    provider: Schema.String.check(Schema.isMinLength(1)),
+    policy: AgentEnvironmentPolicy,
+    kind: Schema.Literal("local_env"),
+    envName: Schema.String.check(Schema.isMinLength(1))
+  }),
+  Schema.Struct({
+    provider: Schema.String.check(Schema.isMinLength(1)),
+    policy: AgentEnvironmentPolicy,
     kind: Schema.Literal("runner_secret"),
-    runnerSecretName: Schema.String.check(Schema.isMinLength(1)),
-    providerType: RepoBindingCredentialProviderType
+    runnerSecretName: Schema.String.check(Schema.isMinLength(1))
   }),
-  Schema.Struct({ kind: Schema.Literal("ssh_agent") })
+  Schema.Struct({
+    provider: Schema.String.check(Schema.isMinLength(1)),
+    policy: AgentEnvironmentPolicy,
+    kind: Schema.Literal("managed_oauth"),
+    grantId: Schema.optionalKey(Id)
+  })
 ]);
-var RepoBinding = Schema.Struct({
-  id: Id,
-  workspaceId: Id,
-  teamId: Schema.optionalKey(Id),
-  provider: RepoBindingProvider,
-  host: Schema.String.check(Schema.isMinLength(1)),
-  owner: Schema.String.check(Schema.isMinLength(1)),
+var RunnerSecretSource = Schema.Union([
+  Schema.Struct({ kind: Schema.Literal("env"), envName: Schema.String.check(Schema.isMinLength(1)) }),
+  Schema.Struct({ kind: Schema.Literal("file"), pathRef: Schema.String.check(Schema.isMinLength(1)) }),
+  Schema.Struct({ kind: Schema.Literal("exec"), commandRef: Schema.String.check(Schema.isMinLength(1)) })
+]);
+var RunnerSecretRef = Schema.Struct({
   name: Schema.String.check(Schema.isMinLength(1)),
-  repositoryUrl: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
-  pathPrefix: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1), Schema.isPattern(new RegExp(RepoBindingPathPrefixPattern, "u")))),
-  defaultTargetBranch: Schema.String.check(Schema.isMinLength(1)),
-  expectedBranch: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
-  expectedCommitSha: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
-  credentialRefs: Schema.Array(RepoBindingCredentialRef),
-  status: RepoBindingStatus,
-  webhook: Schema.optionalKey(Schema.Struct({
-    status: Schema.Literals(["active", "missing", "unavailable"]),
-    message: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(240)))
-  })),
-  createdAt: Timestamp,
-  updatedAt: Timestamp
+  policy: AgentEnvironmentPolicy,
+  source: RunnerSecretSource,
+  capabilities: Schema.optionalKey(Schema.Array(Schema.String.check(Schema.isMinLength(1))))
 });
-var RepoBindingCreate = Schema.Struct({
-  teamId: Schema.optionalKey(Id),
-  provider: RepoBindingProvider,
-  host: Schema.String.check(Schema.isMinLength(1)),
-  owner: Schema.String.check(Schema.isMinLength(1)),
+var Patterns = Schema.Array(Schema.String.check(Schema.isMinLength(1)));
+var AgentSkillRequirement = Schema.Struct({
   name: Schema.String.check(Schema.isMinLength(1)),
-  repositoryUrl: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
-  pathPrefix: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1), Schema.isPattern(new RegExp(RepoBindingPathPrefixPattern, "u")))),
-  defaultTargetBranch: Schema.String.check(Schema.isMinLength(1)),
-  expectedBranch: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
-  expectedCommitSha: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
-  credentialRefs: Schema.optionalKey(Schema.Array(RepoBindingCredentialRef))
+  policy: AgentEnvironmentPolicy,
+  source: SkillSource,
+  appliesTo: Schema.optionalKey(Schema.Struct({ dependencies: Schema.optionalKey(Patterns), files: Schema.optionalKey(Patterns) }))
 });
-var RepoBindingTargetOverride = Schema.Struct({
-  targetBranch: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+var AgentPluginRequirement = Schema.Struct({
+  name: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  sources: Schema.NonEmptyArray(PluginSource)
 });
-var RepoBindingList = Schema.Struct({ items: Schema.Array(RepoBinding) });
-var RunnerRepoBindingCapability = Schema.Struct({
-  repoBindingId: Id,
-  provider: RepoBindingProvider,
-  host: Schema.String.check(Schema.isMinLength(1)),
-  accessModes: Schema.Array(RepoBindingAccessMode),
-  credentialProviderTypes: Schema.Array(RepoBindingCredentialProviderType),
-  authenticated: Schema.Boolean,
-  canPush: Schema.optionalKey(Schema.Boolean)
+var AgentMcpServerRequirement = Schema.Struct({
+  name: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  transport: McpServerTransport
 });
-
-// packages/core/src/work-unit.ts
-import * as Schema2 from "effect/Schema";
-import * as Struct3 from "effect/Struct";
-var WorkUnitLease = Schema2.Struct({
-  leaseOwnerId: Id,
-  runnerReplicaId: Id,
-  leaseId: Id,
-  attempt: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1)),
-  fencingToken: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240), Schema2.isPattern(new RegExp("^[A-Za-z0-9._:-]+$", "u"))),
-  capacitySlot: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  leaseExpiresAt: Timestamp,
-  lastHeartbeatAt: Timestamp
+var AgentHarnessSetting = Schema.Struct({
+  harness: AgentHarnessId,
+  key: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  value: Schema.Unknown
 });
-var WorkUnitLeaseProjection = Schema2.Struct(Struct3.map(WorkUnitLease.fields, Schema2.optionalKey));
-var WorkUnitRepoBinding = Schema2.Struct({
-  id: Id,
-  provider: RepoBindingProvider,
-  host: Schema2.String.check(Schema2.isMinLength(1)),
-  owner: Schema2.String.check(Schema2.isMinLength(1)),
-  name: Schema2.String.check(Schema2.isMinLength(1)),
-  repositoryUrl: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
-  pathPrefix: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
-  defaultTargetBranch: Schema2.String.check(Schema2.isMinLength(1)),
-  expectedBranch: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
-  expectedCommitSha: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1)))
+var AgentRuntimeConstraint = Schema.Struct({
+  key: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  value: Schema.Unknown
 });
-var WorkUnitLeaseInput = Schema2.Struct({
-  leaseOwnerId: Id,
-  runnerReplicaId: Id,
-  leaseId: Id,
-  attempt: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1)),
-  fencingToken: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240), Schema2.isPattern(new RegExp("^[A-Za-z0-9._:-]+$", "u"))),
-  capacitySlot: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240))
+var AgentPermissionRequirement = Schema.Struct({
+  key: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  value: Schema.Unknown
 });
-var WorkUnitStatus = Schema2.Union([
-  Schema2.Literal("pending"),
-  Schema2.Literal("claimed"),
-  Schema2.Literal("running"),
-  Schema2.Literal("waiting"),
-  Schema2.Literal("blocked"),
-  Schema2.Literal("completed"),
-  Schema2.Literal("failed"),
-  Schema2.Literal("canceled"),
-  Schema2.Literal("expired")
-]);
-var LoopCheckout = Schema2.Union([Schema2.Literal("none"), Schema2.Literal("read"), Schema2.Literal("write")]);
-var StorageOrigin = Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(2048)));
-var AgentStepWorkUnit = Schema2.Struct({
-  kind: Schema2.Literal("agent_step"),
-  id: Id,
-  teamId: Schema2.optionalKey(Id),
-  runId: Id,
-  stepKey: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  attempt: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1)),
-  lease: WorkUnitLease,
-  brief: StepBrief,
-  stepCredential: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(512)),
-  checkout: LoopCheckout,
-  repoBinding: Schema2.optionalKey(WorkUnitRepoBinding),
-  branch: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
-  baseRevision: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
-  network: Schema2.optionalKey(AgentSandboxNetwork),
-  sandbox: Schema2.optionalKey(Schema2.Literal("docker")),
-  secrets: Schema2.optionalKey(Schema2.Record(Schema2.String, Schema2.String)),
-  runBaseRevision: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
-  storageOrigin: StorageOrigin
+var AgentHookRequirement = Schema.Struct({
+  name: Schema.String.check(Schema.isMinLength(1)),
+  event: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  command: Schema.String.check(Schema.isMinLength(1)),
+  args: Schema.optionalKey(Schema.Array(Schema.String)),
+  timeoutMs: Schema.optionalKey(Schema.Finite.check(Schema.isGreaterThanOrEqualTo(1)))
 });
-var RunJournal = Schema2.Struct({
-  activities: Schema2.Record(Schema2.String, Schema2.Unknown),
-  deferreds: Schema2.Record(Schema2.String, Schema2.Unknown)
+var AgentSandboxPolicyRequirement = Schema.Struct({
+  key: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  value: Schema.Unknown
 });
-var OrchestrationWorkUnit = Schema2.Struct({
-  kind: Schema2.Literal("orchestration"),
-  id: Id,
-  teamId: Schema2.optionalKey(Id),
-  runId: Id,
-  loopDigest: Schema2.String.check(Schema2.isMinLength(64), Schema2.isMaxLength(64), Schema2.isPattern(new RegExp("^[a-f0-9]{64}$", "u"))),
-  input: Schema2.Unknown,
-  granted: Schema2.Array(Schema2.String),
-  lease: WorkUnitLease,
-  journal: RunJournal,
-  network: Schema2.optionalKey(AgentSandboxNetwork),
-  storageOrigin: StorageOrigin,
-  program: Schema2.Struct({
-    loopId: Schema2.String.check(Schema2.isMinLength(1)),
-    credential: Schema2.String.check(Schema2.isMinLength(1))
-  })
+var AgentEnvironmentFragment = Schema.Struct({
+  skills: Schema.optionalKey(Schema.Array(AgentSkillRequirement)),
+  plugins: Schema.optionalKey(Schema.Array(AgentPluginRequirement)),
+  mcpServers: Schema.optionalKey(Schema.Array(AgentMcpServerRequirement)),
+  harnessSettings: Schema.optionalKey(Schema.Array(AgentHarnessSetting)),
+  providerAuthRefs: Schema.optionalKey(Schema.Array(ProviderAuthRef)),
+  runnerSecretRefs: Schema.optionalKey(Schema.Array(RunnerSecretRef)),
+  permissions: Schema.optionalKey(Schema.Array(AgentPermissionRequirement)),
+  hooks: Schema.optionalKey(Schema.Array(AgentHookRequirement)),
+  runtimeConstraints: Schema.optionalKey(Schema.Array(AgentRuntimeConstraint)),
+  sandboxPolicyRequirements: Schema.optionalKey(Schema.Array(AgentSandboxPolicyRequirement))
 });
-var ProgramWorkUnit = OrchestrationWorkUnit.mapFields(Struct3.omit(["program"]));
-var ApprovedCheck = Schema2.Struct({
-  name: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(120), Schema2.isPattern(new RegExp("^[A-Za-z0-9][A-Za-z0-9._:-]*$", "u"))),
-  command: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(2000)),
-  workingDirectory: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(500)))
+var AgentModelPreference = Schema.Struct({
+  harness: AgentHarnessId,
+  profileRef: Schema.String.check(Schema.isMinLength(1)),
+  provider: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
+  model: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
 });
-var VerificationWorkUnit = Schema2.Struct({
-  kind: Schema2.Literal("verification"),
-  id: Id,
-  teamId: Schema2.optionalKey(Id),
-  runId: Id,
-  stepKey: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  lease: WorkUnitLease,
-  repoBinding: WorkUnitRepoBinding,
-  revision: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  checks: Schema2.Array(ApprovedCheck).check(Schema2.isMinLength(1), Schema2.isMaxLength(50)),
-  storageOrigin: StorageOrigin
+var UserAgentPreferences = Schema.Struct({
+  userId: Schema.optionalKey(Id),
+  defaultHarness: Schema.optionalKey(AgentHarnessId),
+  modelPreferences: Schema.optionalKey(Schema.Array(AgentModelPreference))
+});
+var AgentKitSourceFields = {
+  kitRef: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(240))),
+  kitVersion: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(120))),
+  kitSha256: Schema.optionalKey(Schema.String.check(Schema.isMinLength(64), Schema.isMaxLength(64), Schema.isPattern(new RegExp("^[a-fA-F0-9]{64}$", "u")))),
+  kitActivationId: Schema.optionalKey(Id),
+  kitActivationType: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(80)))
+};
+var AgentEnvironmentSource = Schema.Union([
+  Schema.Struct({
+    kind: Schema.Literal("built_in"),
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("user_preferences"),
+    userId: Id,
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("user_kit"),
+    userId: Id,
+    kitId: Id,
+    ...AgentKitSourceFields,
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("agent_sync_profile"),
+    profileId: Schema.optionalKey(Id),
+    userId: Id,
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("device_local"),
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("workspace_kit"),
+    kitId: Id,
+    ...AgentKitSourceFields,
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("team_default_kit"),
+    teamId: Id,
+    kitId: Id,
+    ...AgentKitSourceFields,
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("team_kit"),
+    kitId: Id,
+    ...AgentKitSourceFields,
+    provenance: Schema.optionalKey(Schema.Union([
+      Schema.Literal("explicit"),
+      Schema.Literal("workspace_default"),
+      Schema.Literal("workspace_mandatory")
+    ])),
+    policyRevision: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThanOrEqualTo(1))),
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("marketplace_kit"),
+    kitSourceId: Id,
+    kitVersionId: Schema.optionalKey(Id),
+    kitInstallationId: Schema.optionalKey(Id),
+    kitActivationId: Schema.optionalKey(Id),
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("step_attempt_override"),
+    stepAttemptId: Id,
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("command_override"),
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  })
+]);
+var ResolvedAgentSkillRequirement = Schema.Struct({
+  item: AgentSkillRequirement,
+  source: AgentEnvironmentSource
 });
-var WorkUnit = Schema2.Union([OrchestrationWorkUnit, AgentStepWorkUnit, VerificationWorkUnit]);
-var WorkUnitClaimResult = Schema2.Struct({ workUnit: Schema2.optionalKey(WorkUnit) });
-var WorkUnitClaimInput = Schema2.Struct({
-  teamId: Schema2.optionalKey(Id),
-  runnerReplicaId: Id,
-  capacitySlot: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  idempotencyKey: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  leaseDurationSeconds: Schema2.optionalKey(Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1), Schema2.isLessThanOrEqualTo(3600)))
+var ResolvedAgentPluginRequirement = Schema.Struct({
+  item: AgentPluginRequirement,
+  source: AgentEnvironmentSource
 });
-var WorkUnitHeartbeatInput = Schema2.Struct({
-  workUnitId: Id,
-  lease: WorkUnitLeaseInput,
-  leaseDurationSeconds: Schema2.optionalKey(Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1), Schema2.isLessThanOrEqualTo(3600)))
+var ResolvedAgentMcpServerRequirement = Schema.Struct({
+  item: AgentMcpServerRequirement,
+  source: AgentEnvironmentSource
 });
-var WorkUnitHeartbeatResult = Schema2.Struct({
-  settled: Schema2.Boolean,
-  outputSubmitted: Schema2.optionalKey(Schema2.Boolean)
+var ResolvedAgentHarnessSetting = Schema.Struct({ item: AgentHarnessSetting, source: AgentEnvironmentSource });
+var ResolvedProviderAuthRef = Schema.Struct({ item: ProviderAuthRef, source: AgentEnvironmentSource });
+var ResolvedRunnerSecretRef = Schema.Struct({ item: RunnerSecretRef, source: AgentEnvironmentSource });
+var ResolvedAgentPermissionRequirement = Schema.Struct({
+  item: AgentPermissionRequirement,
+  source: AgentEnvironmentSource
 });
-var WorkUnitReleaseInput = Schema2.Struct({
-  workUnitId: Id,
-  lease: WorkUnitLeaseInput
+var ResolvedAgentHookRequirement = Schema.Struct({ item: AgentHookRequirement, source: AgentEnvironmentSource });
+var ResolvedAgentRuntimeConstraint = Schema.Struct({
+  item: AgentRuntimeConstraint,
+  source: AgentEnvironmentSource
 });
-var CheckEvidence = Schema2.Struct({
-  name: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(120)),
-  command: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(2000)),
-  status: Schema2.Union([Schema2.Literal("passed"), Schema2.Literal("failed")]),
-  exitCode: Schema2.optionalKey(Schema2.Int),
-  durationMs: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(0)),
-  outputTail: Schema2.String.check(Schema2.isMaxLength(8000)),
-  fileIds: Schema2.optionalKey(Schema2.Array(Schema2.String).check(Schema2.isMaxLength(51)))
+var ResolvedAgentSandboxPolicyRequirement = Schema.Struct({
+  item: AgentSandboxPolicyRequirement,
+  source: AgentEnvironmentSource
 });
-var TreeEvidence = Schema2.Struct({
-  revision: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  tree: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(120)),
-  checks: Schema2.Array(CheckEvidence).check(Schema2.isMaxLength(50))
+var AgentEnvironment = Schema.Struct({
+  harness: AgentHarnessId,
+  skills: Schema.Array(ResolvedAgentSkillRequirement),
+  plugins: Schema.Array(ResolvedAgentPluginRequirement),
+  mcpServers: Schema.Array(ResolvedAgentMcpServerRequirement),
+  harnessSettings: Schema.Array(ResolvedAgentHarnessSetting),
+  providerAuthRefs: Schema.Array(ResolvedProviderAuthRef),
+  runnerSecretRefs: Schema.Array(ResolvedRunnerSecretRef),
+  permissions: Schema.Array(ResolvedAgentPermissionRequirement),
+  hooks: Schema.Array(ResolvedAgentHookRequirement),
+  runtimeConstraints: Schema.Array(ResolvedAgentRuntimeConstraint),
+  sandboxPolicyRequirements: Schema.Array(ResolvedAgentSandboxPolicyRequirement),
+  warnings: Schema.Array(Schema.String)
 });
-var VerificationEvidence = Schema2.Struct({ head: TreeEvidence, baseline: Schema2.optionalKey(TreeEvidence) });
-var BoundaryChange = Schema2.Struct({
-  kind: Schema2.Literal("change"),
-  changedPaths: Schema2.Array(Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(4096))).check(Schema2.isMaxLength(1000)),
-  omittedPaths: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(0)),
-  files: Schema2.Array(Schema2.Struct({
-    path: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(4096)),
-    excerpt: Schema2.String.check(Schema2.isMaxLength(250000)),
-    redacted: Schema2.Boolean,
-    truncated: Schema2.Boolean
-  })).check(Schema2.isMaxLength(20)),
-  truncated: Schema2.Boolean
+var KitMarketplaceAgentEnvironmentSyncStates = ["ready", "needs_sync", "blocked"];
+var KitMarketplaceAgentEnvironmentEffectKinds = [
+  "skill",
+  "plugin",
+  "mcp_server",
+  "harness_setting",
+  "provider_auth_ref",
+  "runner_secret_ref",
+  "permission",
+  "hook",
+  "runtime_constraint",
+  "sandbox_policy_requirement"
+];
+var KitMarketplaceAgentEnvironmentMaterializerRequirements = [
+  "config_writer",
+  "provider_auth",
+  "runner_secret",
+  "bun",
+  "sandbox_policy"
+];
+var KitMarketplaceAgentEnvironmentEffect = Schema.Struct({
+  kind: Schema.Literals(KitMarketplaceAgentEnvironmentEffectKinds),
+  name: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  source: AgentEnvironmentSource,
+  materializerRequirements: Schema.Array(Schema.Literals(KitMarketplaceAgentEnvironmentMaterializerRequirements))
 });
-var WorkUnitOutcome = Schema2.Struct({
-  status: Schema2.Union([
-    Schema2.Literal("completed"),
-    Schema2.Literal("failed"),
-    Schema2.Literal("blocked"),
-    Schema2.Literal("canceled")
-  ]),
-  result: Schema2.optionalKey(LoopStepOutput),
-  revision: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(120))),
-  evidence: Schema2.optionalKey(VerificationEvidence),
-  boundary: Schema2.optionalKey(BoundaryChange),
-  failureSummary: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(4000)))
+var KitMarketplaceAgentEnvironmentSyncPreview = Schema.Struct({
+  state: Schema.Literals(KitMarketplaceAgentEnvironmentSyncStates),
+  agentEnvironment: AgentEnvironment,
+  effects: Schema.Array(KitMarketplaceAgentEnvironmentEffect),
+  blockers: Schema.Array(Schema.String),
+  drift: Schema.Array(Schema.String)
 });
-var WorkUnitCompletion = Schema2.Struct({
-  workUnitId: Id,
-  lease: WorkUnitLeaseInput,
-  idempotencyKey: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  outcome: WorkUnitOutcome
+var AgentEnvironmentSyncPlanStatuses = ["ready", "needs_apply", "blocked"];
+var AgentEnvironmentSyncPlanItemKinds = [
+  "skill",
+  "plugin",
+  "mcp_server",
+  "harness_setting",
+  "provider_auth_ref",
+  "runner_secret_ref",
+  "permission",
+  "hook",
+  "runtime_constraint",
+  "sandbox_policy_requirement"
+];
+var AgentEnvironmentSyncPlanApplyModes = ["automatic", "manual", "verify_only"];
+var AgentEnvironmentSyncPlanItem = Schema.Struct({
+  kind: Schema.Literals(AgentEnvironmentSyncPlanItemKinds),
+  name: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  source: AgentEnvironmentSource,
+  materializerRequirements: Schema.Array(Schema.Literals(KitMarketplaceAgentEnvironmentMaterializerRequirements)),
+  applyMode: Schema.Literals(AgentEnvironmentSyncPlanApplyModes)
+});
+var AgentEnvironmentSyncPlan = Schema.Struct({
+  status: Schema.Literals(AgentEnvironmentSyncPlanStatuses),
+  targetHarness: AgentHarnessId,
+  agentEnvironment: AgentEnvironment,
+  items: Schema.Array(AgentEnvironmentSyncPlanItem),
+  blockers: Schema.Array(Schema.String),
+  drift: Schema.Array(Schema.String)
 });
 // packages/core/src/run-file.ts
-import * as Schema4 from "effect/Schema";
+import * as Schema3 from "effect/Schema";
 
 // packages/core/src/storage.ts
-import * as Schema3 from "effect/Schema";
+import * as Schema2 from "effect/Schema";
 var units = ["B", "KiB", "MiB", "GiB", "TiB"];
 var formatBytes = (bytes) => {
   const exponent = Math.min(units.length - 1, Math.floor(Math.log(Math.max(bytes, 1)) / Math.log(1024)));
@@ -289,16 +412,16 @@ var storageLimitWords = {
   run: (filesPerRun) => `${filesPerRun} files per Run`
 };
 var maxRunFileRetentionDays = 3650;
-var RunFileRetentionDays = Schema3.NullOr(Schema3.Int.check(Schema3.isGreaterThanOrEqualTo(1), Schema3.isLessThanOrEqualTo(maxRunFileRetentionDays)));
-var WorkspaceStorageSettings = Schema3.Struct({
-  usedBytes: Schema3.Int,
-  quotaBytes: Schema3.Int,
-  byPurpose: Schema3.Struct({ runFile: Schema3.Int, taskAsset: Schema3.Int, checkpoint: Schema3.Int }),
-  limits: Schema3.Struct({ fileBytes: Schema3.Int, filesPerRun: Schema3.Int }),
+var RunFileRetentionDays = Schema2.NullOr(Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1), Schema2.isLessThanOrEqualTo(maxRunFileRetentionDays)));
+var WorkspaceStorageSettings = Schema2.Struct({
+  usedBytes: Schema2.Int,
+  quotaBytes: Schema2.Int,
+  byPurpose: Schema2.Struct({ runFile: Schema2.Int, taskAsset: Schema2.Int, checkpoint: Schema2.Int }),
+  limits: Schema2.Struct({ fileBytes: Schema2.Int, filesPerRun: Schema2.Int }),
   runFileRetentionDays: RunFileRetentionDays
 });
-var WorkspaceStorageUpdate = Schema3.Struct({ runFileRetentionDays: RunFileRetentionDays });
-var WorkspaceStorageSaved = Schema3.Struct({ ...WorkspaceStorageSettings.fields, willExpire: Schema3.Int });
+var WorkspaceStorageUpdate = Schema2.Struct({ runFileRetentionDays: RunFileRetentionDays });
+var WorkspaceStorageSaved = Schema2.Struct({ ...WorkspaceStorageSettings.fields, willExpire: Schema2.Int });
 
 // packages/core/src/run-file.ts
 var RunFileRefusalReasons = ["type", "too_large", "too_many", "quota", "name_taken"];
@@ -317,10 +440,10 @@ var runFileRefusalWords = (refusal) => {
   }
 };
 
-class RunFileRefused extends Schema4.TaggedError()("RunFileRefused", {
-  reason: Schema4.Literals(RunFileRefusalReasons),
-  limit: Schema4.optionalKey(Schema4.Int),
-  actual: Schema4.optionalKey(Schema4.Int)
+class RunFileRefused extends Schema3.TaggedError()("RunFileRefused", {
+  reason: Schema3.Literals(RunFileRefusalReasons),
+  limit: Schema3.optionalKey(Schema3.Int),
+  actual: Schema3.optionalKey(Schema3.Int)
 }) {
   get message() {
     return runFileRefusalWords(this);
@@ -356,72 +479,72 @@ var RunFileStatuses = [
   "removed",
   "expired"
 ];
-var RunFileRecord = Schema4.Struct({
-  id: Schema4.String,
-  runId: Schema4.String,
-  step: Schema4.String,
-  name: Schema4.String,
-  caption: Schema4.optionalKey(Schema4.String),
-  contentType: Schema4.String,
-  kind: Schema4.Literals(RunFileKinds),
-  byteSize: Schema4.Int,
-  sha256: Schema4.String,
-  status: Schema4.Literals(RunFileStatuses)
+var RunFileRecord = Schema3.Struct({
+  id: Schema3.String,
+  runId: Schema3.String,
+  step: Schema3.String,
+  name: Schema3.String,
+  caption: Schema3.optionalKey(Schema3.String),
+  contentType: Schema3.String,
+  kind: Schema3.Literals(RunFileKinds),
+  byteSize: Schema3.Int,
+  sha256: Schema3.String,
+  status: Schema3.Literals(RunFileStatuses)
 });
 var RunFileMakers = ["program", "agent", "check"];
-var RunFileView = Schema4.Struct({
-  id: Schema4.String,
-  runId: Schema4.String,
-  step: Schema4.String,
-  stepAttemptId: Schema4.optionalKey(Schema4.String),
-  verificationId: Schema4.optionalKey(Schema4.String),
-  madeBy: Schema4.Literals(RunFileMakers),
-  name: Schema4.String,
-  caption: Schema4.optionalKey(Schema4.String),
-  kind: Schema4.Literals(RunFileKinds),
-  contentType: Schema4.String,
-  byteSize: Schema4.Int,
-  sha256: Schema4.String,
-  status: Schema4.Literals(RunFileStatuses),
-  reason: Schema4.optionalKey(Schema4.String),
-  limit: Schema4.optionalKey(Schema4.Int),
-  actual: Schema4.optionalKey(Schema4.Int),
-  removedBy: Schema4.optionalKey(Schema4.String),
-  removedAt: Schema4.optionalKey(Timestamp),
+var RunFileView = Schema3.Struct({
+  id: Schema3.String,
+  runId: Schema3.String,
+  step: Schema3.String,
+  stepAttemptId: Schema3.optionalKey(Schema3.String),
+  verificationId: Schema3.optionalKey(Schema3.String),
+  madeBy: Schema3.Literals(RunFileMakers),
+  name: Schema3.String,
+  caption: Schema3.optionalKey(Schema3.String),
+  kind: Schema3.Literals(RunFileKinds),
+  contentType: Schema3.String,
+  byteSize: Schema3.Int,
+  sha256: Schema3.String,
+  status: Schema3.Literals(RunFileStatuses),
+  reason: Schema3.optionalKey(Schema3.String),
+  limit: Schema3.optionalKey(Schema3.Int),
+  actual: Schema3.optionalKey(Schema3.Int),
+  removedBy: Schema3.optionalKey(Schema3.String),
+  removedAt: Schema3.optionalKey(Timestamp),
   createdAt: Timestamp
 });
-var RunFileList = Schema4.Union([
-  Schema4.Struct({ files: Schema4.Array(RunFileView) }),
-  Schema4.Struct({ count: Schema4.Int })
+var RunFileList = Schema3.Union([
+  Schema3.Struct({ files: Schema3.Array(RunFileView) }),
+  Schema3.Struct({ count: Schema3.Int })
 ]);
-var RunFileUrlsRequest = Schema4.Struct({
-  ids: Schema4.Array(Id).check(Schema4.isMinLength(1), Schema4.isMaxLength(200)),
-  use: Schema4.Literals(["view", "download"])
+var RunFileUrlsRequest = Schema3.Struct({
+  ids: Schema3.Array(Id).check(Schema3.isMinLength(1), Schema3.isMaxLength(200)),
+  use: Schema3.Literals(["view", "download"])
 });
-var RunFileRemoveRequest = Schema4.Struct({
-  note: Schema4.optionalKey(Schema4.String.check(Schema4.isMaxLength(500)))
+var RunFileRemoveRequest = Schema3.Struct({
+  note: Schema3.optionalKey(Schema3.String.check(Schema3.isMaxLength(500)))
 });
-var RunFileUrl = Schema4.Struct({ id: Schema4.String, url: Schema4.String, expiresAt: Timestamp });
-var RunFileUrls = Schema4.Struct({ urls: Schema4.Array(RunFileUrl) });
+var RunFileUrl = Schema3.Struct({ id: Schema3.String, url: Schema3.String, expiresAt: Timestamp });
+var RunFileUrls = Schema3.Struct({ urls: Schema3.Array(RunFileUrl) });
 var PresignedRequest = {
-  url: Schema4.String,
-  headers: Schema4.optionalKey(Schema4.Record(Schema4.String, Schema4.String)),
-  expiresAt: Schema4.String
+  url: Schema3.String,
+  headers: Schema3.optionalKey(Schema3.Record(Schema3.String, Schema3.String)),
+  expiresAt: Schema3.String
 };
-var RunFilePartUrl = Schema4.Struct({ partNumber: Schema4.Int, ...PresignedRequest });
-var RunFileUpload = Schema4.Union([
-  Schema4.Struct({ kind: Schema4.Literal("single"), ...PresignedRequest }),
-  Schema4.Struct({ kind: Schema4.Literal("multipart"), partSize: Schema4.Int, parts: Schema4.Array(RunFilePartUrl) })
+var RunFilePartUrl = Schema3.Struct({ partNumber: Schema3.Int, ...PresignedRequest });
+var RunFileUpload = Schema3.Union([
+  Schema3.Struct({ kind: Schema3.Literal("single"), ...PresignedRequest }),
+  Schema3.Struct({ kind: Schema3.Literal("multipart"), partSize: Schema3.Int, parts: Schema3.Array(RunFilePartUrl) })
 ]);
-var UploadedRunFilePart = Schema4.Struct({ partNumber: Schema4.Int, etag: Schema4.String });
-var StepRunFileRequest = Schema4.Struct({
-  name: Schema4.String.check(Schema4.isMinLength(1), Schema4.isMaxLength(255)),
-  caption: Schema4.optionalKey(Schema4.String.check(Schema4.isMaxLength(1000))),
-  contentType: Schema4.String.check(Schema4.isMinLength(1), Schema4.isMaxLength(255)),
-  byteSize: Schema4.Int.check(Schema4.isGreaterThanOrEqualTo(0)),
-  sha256: Schema4.String.check(Schema4.isPattern(/^[0-9a-f]{64}$/))
+var UploadedRunFilePart = Schema3.Struct({ partNumber: Schema3.Int, etag: Schema3.String });
+var StepRunFileRequest = Schema3.Struct({
+  name: Schema3.String.check(Schema3.isMinLength(1), Schema3.isMaxLength(255)),
+  caption: Schema3.optionalKey(Schema3.String.check(Schema3.isMaxLength(1000))),
+  contentType: Schema3.String.check(Schema3.isMinLength(1), Schema3.isMaxLength(255)),
+  byteSize: Schema3.Int.check(Schema3.isGreaterThanOrEqualTo(0)),
+  sha256: Schema3.String.check(Schema3.isPattern(/^[0-9a-f]{64}$/))
 });
-var RunFileSlotted = Schema4.Struct({ file: RunFileRecord, upload: Schema4.optionalKey(RunFileUpload) });
+var RunFileSlotted = Schema3.Struct({ file: RunFileRecord, upload: Schema3.optionalKey(RunFileUpload) });
 // packages/core/src/crypto.ts
 import { createHash, createHmac, createSign, randomBytes, timingSafeEqual } from "crypto";
 function digestSha256(data, encoding) {
@@ -430,6 +553,12 @@ function digestSha256(data, encoding) {
     hash.update(part);
   return hash.digest(encoding);
 }
+function digestSha512(data, encoding) {
+  return createHash("sha512").update(data).digest(encoding);
+}
+function digestWith(algorithm, data, encoding) {
+  return createHash(algorithm).update(data).digest(encoding);
+}
 function sha256Hasher() {
   const hash = createHash("sha256");
   return {
@@ -440,97 +569,115 @@ function sha256Hasher() {
   };
 }
 // packages/core/src/transcript.ts
-import * as Schema5 from "effect/Schema";
-var Text = Schema5.String.check(Schema5.isMaxLength(200000));
-var AgentEvent = Schema5.Union([
-  Schema5.Struct({ kind: Schema5.Literal("message"), role: Schema5.Literals(["assistant", "user"]), text: Text }),
-  Schema5.Struct({
-    kind: Schema5.Literal("tool_call"),
-    callId: Schema5.String,
-    name: Schema5.String.check(Schema5.isMinLength(1), Schema5.isMaxLength(240)),
-    arguments: Schema5.Json
+import * as Schema4 from "effect/Schema";
+var Text = Schema4.String.check(Schema4.isMaxLength(200000));
+var AgentEvent = Schema4.Union([
+  Schema4.Struct({ kind: Schema4.Literal("message"), role: Schema4.Literals(["assistant", "user"]), text: Text }),
+  Schema4.Struct({
+    kind: Schema4.Literal("tool_call"),
+    callId: Schema4.String,
+    name: Schema4.String.check(Schema4.isMinLength(1), Schema4.isMaxLength(240)),
+    arguments: Schema4.Json
   }),
-  Schema5.Struct({
-    kind: Schema5.Literal("tool_result"),
-    callId: Schema5.String,
+  Schema4.Struct({
+    kind: Schema4.Literal("tool_result"),
+    callId: Schema4.String,
     output: Text,
-    isError: Schema5.optionalKey(Schema5.Boolean)
+    isError: Schema4.optionalKey(Schema4.Boolean)
   }),
-  Schema5.Struct({
-    kind: Schema5.Literal("file"),
-    path: Schema5.String.check(Schema5.isMinLength(1), Schema5.isMaxLength(4096)),
-    change: Schema5.Literals(["read", "changed"])
+  Schema4.Struct({
+    kind: Schema4.Literal("file"),
+    path: Schema4.String.check(Schema4.isMinLength(1), Schema4.isMaxLength(4096)),
+    change: Schema4.Literals(["read", "changed"])
   }),
-  Schema5.Struct({ kind: Schema5.Literal("question"), text: Text }),
-  Schema5.Struct({
-    kind: Schema5.Literal("answer"),
-    callId: Schema5.optionalKey(Schema5.String),
-    questionId: Schema5.optionalKey(Schema5.String),
+  Schema4.Struct({ kind: Schema4.Literal("question"), text: Text }),
+  Schema4.Struct({
+    kind: Schema4.Literal("answer"),
+    callId: Schema4.optionalKey(Schema4.String),
+    questionId: Schema4.optionalKey(Schema4.String),
     text: Text
   }),
-  Schema5.Struct({ kind: Schema5.Literal("steer"), messageId: Id, text: Text }),
-  Schema5.Struct({
-    kind: Schema5.Literal("lifecycle"),
-    state: Schema5.Literals(["started", "resumed", "finished", "failed", "canceled"])
+  Schema4.Struct({ kind: Schema4.Literal("steer"), messageId: Id, text: Text }),
+  Schema4.Struct({
+    kind: Schema4.Literal("secret_refused"),
+    reference: Schema4.optionalKey(Schema4.String.check(Schema4.isMinLength(1), Schema4.isMaxLength(300))),
+    host: Schema4.String.check(Schema4.isMaxLength(300)),
+    reason: Schema4.String.check(Schema4.isMaxLength(500))
+  }),
+  Schema4.Struct({
+    kind: Schema4.Literal("lifecycle"),
+    state: Schema4.Literals(["started", "resumed", "parked", "finished", "failed", "canceled"])
   })
 ]);
-var TranscriptAppendEntry = Schema5.Struct({
-  sequence: Schema5.Int.check(Schema5.isGreaterThanOrEqualTo(1)),
+var TranscriptAppendEntry = Schema4.Struct({
+  sequence: Schema4.Int.check(Schema4.isGreaterThanOrEqualTo(1)),
   event: AgentEvent
 });
-var TranscriptEntry = Schema5.Struct({
+var TranscriptEntry = Schema4.Struct({
   stepAttemptId: Id,
-  sequence: Schema5.Int.check(Schema5.isGreaterThanOrEqualTo(1)),
+  sequence: Schema4.Int.check(Schema4.isGreaterThanOrEqualTo(1)),
   event: AgentEvent,
   createdAt: Timestamp
 });
-var TranscriptPage = Schema5.Struct({
-  items: Schema5.Array(TranscriptEntry),
-  next: Schema5.optionalKey(Schema5.Int),
-  previous: Schema5.optionalKey(Schema5.Int)
+var TranscriptPage = Schema4.Struct({
+  items: Schema4.Array(TranscriptEntry),
+  next: Schema4.optionalKey(Schema4.Int),
+  previous: Schema4.optionalKey(Schema4.Int)
 });
-var TranscriptRetention = Schema5.Struct({
-  days: Schema5.NullOr(Schema5.Int.check(Schema5.isGreaterThanOrEqualTo(1)))
+var TranscriptRetention = Schema4.Struct({
+  days: Schema4.NullOr(Schema4.Int.check(Schema4.isGreaterThanOrEqualTo(1)))
 });
 var MaxTranscriptSearchLimit = 50;
-var TranscriptSearchQuery = Schema5.Struct({
-  q: Schema5.String.check(Schema5.isMinLength(1), Schema5.isMaxLength(200)),
-  limit: Schema5.optionalKey(Numeric.check(isWholeNumber, Schema5.isGreaterThanOrEqualTo(1), Schema5.isLessThanOrEqualTo(MaxTranscriptSearchLimit)))
+var TranscriptSearchQuery = Schema4.Struct({
+  q: Schema4.String.check(Schema4.isMinLength(1), Schema4.isMaxLength(200)),
+  limit: Schema4.optionalKey(Numeric.check(isWholeNumber, Schema4.isGreaterThanOrEqualTo(1), Schema4.isLessThanOrEqualTo(MaxTranscriptSearchLimit)))
 });
-var TranscriptSearchHit = Schema5.Struct({
+var TranscriptSearchHit = Schema4.Struct({
   runId: Id,
-  loop: Schema5.String,
-  task: Schema5.optionalKey(Schema5.Struct({ id: Id, key: Schema5.String, title: Schema5.String })),
+  loop: Schema4.String,
+  task: Schema4.optionalKey(Schema4.Struct({ id: Id, key: Schema4.String, title: Schema4.String })),
   stepAttemptId: Id,
-  node: Schema5.optionalKey(Schema5.String),
-  step: Schema5.String,
-  attempt: Schema5.Int,
-  agent: Schema5.optionalKey(Schema5.String),
+  node: Schema4.optionalKey(Schema4.String),
+  step: Schema4.String,
+  attempt: Schema4.Int,
+  agent: Schema4.optionalKey(Schema4.String),
   ranAt: Timestamp,
-  sequence: Schema5.Int,
-  matches: Schema5.Int,
-  excerpt: Schema5.String
+  sequence: Schema4.Int,
+  matches: Schema4.Int,
+  excerpt: Schema4.String
 });
-var TranscriptSearchResult = Schema5.Struct({
-  items: Schema5.Array(TranscriptSearchHit),
-  total: Schema5.Int
+var TranscriptSearchResult = Schema4.Struct({
+  items: Schema4.Array(TranscriptSearchHit),
+  total: Schema4.Int
 });
 // packages/core/src/run-journal.ts
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
-import * as Schema6 from "effect/Schema";
+import * as Schema5 from "effect/Schema";
 var journalEntryMaxBytes = 256 * 1024;
-var JournalExit = Schema6.toCodecJson(Schema6.Exit(Schema6.Json, Schema6.Json, Schema6.Defect()));
-var encodeJournalExit = (exit) => Schema6.encodeUnknownEffect(JournalExit)(Exit.map(exit, (value) => value ?? null));
-var decodeJournalExit = Schema6.decodeUnknownEffect(JournalExit);
-var JournalStepFailed = Schema6.TaggedStruct("StepFailed", { step: Schema6.String, reason: Schema6.String });
-var JournalChildFailed = Schema6.TaggedStruct("ChildFailed", {
-  step: Schema6.String,
-  loop: Schema6.String,
-  reason: Schema6.String
+var JournalExit = Schema5.toCodecJson(Schema5.Exit(Schema5.Json, Schema5.Json, Schema5.Defect()));
+var encodeJournalExit = (exit) => Schema5.encodeUnknownEffect(JournalExit)(Exit.map(exit, (value) => value ?? null));
+var decodeJournalExit = Schema5.decodeUnknownEffect(JournalExit);
+var JournalStepFailed = Schema5.TaggedStruct("StepFailed", { step: Schema5.String, reason: Schema5.String });
+var JournalChildFailed = Schema5.TaggedStruct("ChildFailed", {
+  step: Schema5.String,
+  loop: Schema5.String,
+  reason: Schema5.String
 });
-var JournalWaitTimedOut = Schema6.TaggedStruct("WaitTimedOut", { step: Schema6.String, event: Schema6.String });
+var JournalWaitTimedOut = Schema5.TaggedStruct("WaitTimedOut", { step: Schema5.String, event: Schema5.String });
 var journalEntryBytes = (entry) => new TextEncoder().encode(JSON.stringify(entry)).byteLength;
+// packages/core/src/kit-setup.ts
+import * as Schema6 from "effect/Schema";
+var KitSetup = Schema6.Struct({
+  ...AgentEnvironmentFragment.fields,
+  instructions: Schema6.optionalKey(Schema6.String.check(Schema6.isMinLength(1)))
+});
+var SetupFile = Schema6.Union([
+  Schema6.Struct({ utf8: Schema6.String }),
+  Schema6.Struct({ base64: Schema6.String })
+]);
+var SetupArchive = Schema6.Struct({ setup: KitSetup, files: Schema6.Record(Schema6.String, SetupFile) });
+var kitmanMcpServer = "kitman";
 // packages/sdk/src/program/engine.ts
 import * as Cause from "effect/Cause";
 import * as Clock from "effect/Clock";
@@ -544,6 +691,7 @@ import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import { isPlatformError } from "effect/PlatformError";
 import * as Schema8 from "effect/Schema";
+import * as SchemaIssue from "effect/SchemaIssue";
 import * as Stream from "effect/Stream";
 import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientRequest from "effect/http/HttpClientRequest";
@@ -553,7 +701,7 @@ import * as HttpClientResponse from "effect/http/HttpClientResponse";
 import * as Schema7 from "effect/Schema";
 import { Rpc, RpcGroup, RpcMiddleware } from "effect/rpc";
 var RunnerHeaders = { runnerId: "x-kitman-runner-id", protocolVersion: "x-kitman-rpc-protocol" };
-var RunnerRpcProtocolVersion = 4;
+var RunnerRpcProtocolVersion = 5;
 
 class RunnerRpcError extends Schema7.TaggedError()("RunnerRpcError", {
   code: Schema7.String,
@@ -630,7 +778,7 @@ var ProgramOutcome = Schema7.Union([
   Schema7.Struct({ status: Schema7.Literal("failed"), failureSummary: Schema7.String })
 ]);
 
-class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
+class RunnerReplicaRpcs extends RpcGroup.make(Rpc.make("Claim", {
   payload: WorkUnitClaimInput,
   success: WorkUnitClaimResult,
   error: RunnerRpcError
@@ -644,7 +792,70 @@ class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
 }), Rpc.make("Release", {
   payload: WorkUnitReleaseInput,
   error: RunnerRpcError
-}), Rpc.make("RecordActivity", {
+}), Rpc.make("Signals", {
+  payload: { runnerReplicaId: Schema7.String },
+  success: RunnerSignal,
+  error: RunnerRpcError,
+  stream: true
+}), Rpc.make("ReportSteer", {
+  payload: { workUnitId: Schema7.String, messageId: Schema7.String, delivered: Schema7.Boolean },
+  success: Schema7.Void,
+  error: RunnerRpcError
+}), Rpc.make("AppendTranscript", {
+  payload: { workUnitId: Schema7.String, entries: Schema7.Array(TranscriptAppendEntry).check(Schema7.isMaxLength(100)) },
+  success: Schema7.Void,
+  error: RunnerRpcError
+}), Rpc.make("CreateCheckpointFile", {
+  payload: { lease: ProgramLease, byteSize: Schema7.Int, sha256: Schema7.String },
+  success: Schema7.Struct({ file: RunFileRecord, upload: Schema7.optional(RunFileUpload) }),
+  error: Schema7.Union([RunnerRpcError, RunFileRefused])
+}), Rpc.make("CheckpointFileParts", {
+  payload: { lease: ProgramLease, fileId: Schema7.String, partNumbers: Schema7.Array(Schema7.Int) },
+  success: Schema7.Struct({ parts: Schema7.Array(RunFilePartUrl) }),
+  error: RunnerRpcError
+}), Rpc.make("CompleteCheckpointFile", {
+  payload: { lease: ProgramLease, fileId: Schema7.String, parts: Schema7.optional(Schema7.Array(UploadedRunFilePart)) },
+  success: RunFileRecord,
+  error: RunnerRpcError
+}), Rpc.make("SaveCheckpoint", {
+  payload: { lease: ProgramLease, checkpoint: StepCheckpoint },
+  success: Schema7.Void,
+  error: RunnerRpcError
+}), Rpc.make("ResumeCheckpoint", {
+  payload: { lease: ProgramLease },
+  success: Schema7.UndefinedOr(ResumedCheckpoint),
+  error: RunnerRpcError
+}), Rpc.make("SettledCheckpoints", {
+  success: Schema7.Array(Schema7.Struct({
+    stepAttemptId: Schema7.String,
+    ref: Schema7.optionalKey(Schema7.String),
+    repoBinding: Schema7.optionalKey(WorkUnitRepoBinding)
+  })),
+  error: RunnerRpcError
+}), Rpc.make("ForgetCheckpoints", {
+  payload: { stepAttemptIds: Schema7.Array(Schema7.String) },
+  success: Schema7.Void,
+  error: RunnerRpcError
+}), Rpc.make("GitCredential", {
+  payload: { repoBindingId: Schema7.String },
+  success: Schema7.UndefinedOr(Schema7.Struct({ username: Schema7.String, password: Schema7.String })),
+  error: RunnerRpcError
+}), Rpc.make("Bundle", {
+  payload: { digest: Schema7.String },
+  success: Schema7.Struct({ bundle: Schema7.String }),
+  error: RunnerRpcError
+}), Rpc.make("SettledRuns", {
+  payload: { runIds: Schema7.Array(Schema7.String) },
+  success: Schema7.Array(Schema7.String),
+  error: RunnerRpcError
+}), Rpc.make("KnownEvidence", {
+  payload: { lease: ProgramLease, trees: Schema7.Array(Schema7.String) },
+  success: Schema7.Array(Schema7.Struct({ tree: Schema7.String, name: Schema7.String, command: Schema7.String })),
+  error: RunnerRpcError
+})).middleware(RunnerAuthentication) {
+}
+
+class RunnerJournalRpcs extends RpcGroup.make(Rpc.make("RecordActivity", {
   payload: { lease: ProgramLease, name: Schema7.String, attempt: Schema7.Int, exit: Schema7.Json },
   error: RunnerRpcError
 }), Rpc.make("DeferredDone", {
@@ -653,13 +864,22 @@ class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
 }), Rpc.make("ScheduleClock", {
   payload: { lease: ProgramLease, name: Schema7.String, deferredName: Schema7.String, durationMillis: Schema7.Int },
   error: RunnerRpcError
-}), Rpc.make("PutQuestion", {
+}), Rpc.make("Suspend", { payload: { lease: ProgramLease }, error: RunnerRpcError }), Rpc.make("FinishProgram", { payload: { lease: ProgramLease, outcome: ProgramOutcome }, error: RunnerRpcError })).middleware(RunnerAuthentication) {
+}
+
+class RunnerCapabilityRpcs extends RpcGroup.make(Rpc.make("PutQuestion", {
   payload: {
     lease: ProgramLease,
     step: Schema7.String,
     prompt: Schema7.String,
     options: Schema7.optional(Schema7.Array(Schema7.String)),
+    optionDescriptions: Schema7.optional(Schema7.Record(Schema7.String, Schema7.String)),
+    recommended: Schema7.optional(Schema7.String),
+    recommendationReason: Schema7.optional(Schema7.String),
+    informationOnly: Schema7.optional(Schema7.Boolean),
     verification: Schema7.optional(SuggestedVerification),
+    default: Schema7.optional(Schema7.String),
+    timeoutMillis: Schema7.optional(Schema7.Finite),
     deferredName: Schema7.String
   },
   success: Schema7.Struct({ questionId: Schema7.String }),
@@ -672,8 +892,11 @@ class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
     role: Schema7.String,
     agentId: Schema7.String,
     prompt: Schema7.String,
+    skill: Schema7.optionalKey(Schema7.String.check(Schema7.isMinLength(1))),
     outputSchema: Schema7.Json,
-    secrets: Schema7.optionalKey(Schema7.Array(Schema7.String))
+    secrets: Schema7.optionalKey(Schema7.Array(Schema7.String)),
+    timeoutMillis: Schema7.optionalKey(Schema7.Int),
+    mergeTarget: Schema7.optionalKey(Schema7.String.check(Schema7.isMinLength(1)))
   },
   success: Schema7.Struct({ stepAttemptId: Schema7.String }),
   error: RunnerRpcError
@@ -683,14 +906,17 @@ class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
     step: Schema7.String,
     deferredName: Schema7.String,
     revision: Schema7.optionalKey(Schema7.String),
-    checks: Schema7.optional(Schema7.Array(Schema7.String))
+    checks: Schema7.optional(Schema7.Array(Schema7.String)),
+    suggested: Schema7.optionalKey(Schema7.Array(ApprovedCheck)),
+    measure: Schema7.optionalKey(Schema7.Struct({
+      base: Schema7.optionalKey(Schema7.String),
+      plan: MeasurePlan2,
+      samples: Schema7.Int,
+      calibrate: Schema7.Boolean
+    }))
   },
   success: Schema7.Struct({ verificationId: Schema7.String }),
   error: RunnerRpcError
-}), Rpc.make("KnownEvidence", {
-  payload: { lease: ProgramLease, trees: Schema7.Array(Schema7.String) },
-  success: Schema7.Array(Schema7.Struct({ tree: Schema7.String, name: Schema7.String, command: Schema7.String })),
-  error: RunnerRpcError
 }), Rpc.make("AwaitEvent", {
   payload: {
     lease: ProgramLease,
@@ -698,7 +924,22 @@ class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
     deferredName: Schema7.String,
     event: Schema7.String,
     filter: Schema7.optional(Schema7.Record(Schema7.String, Schema7.Union([EventFilterValue, Schema7.Array(EventFilterValue)]))),
-    timeoutMillis: Schema7.Int
+    timeoutMillis: Schema7.Int,
+    since: Schema7.optionalKey(Schema7.String),
+    or: Schema7.optionalKey(Schema7.Array(Schema7.Struct({
+      event: Schema7.String,
+      filter: Schema7.optionalKey(Schema7.Record(Schema7.String, Schema7.Union([EventFilterValue, Schema7.Array(EventFilterValue)]))),
+      since: Schema7.optionalKey(Schema7.String)
+    })))
+  },
+  error: RunnerRpcError
+}), Rpc.make("ClaimResource", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema7.String,
+    deferredName: Schema7.String,
+    resource: ResourceName,
+    action: Schema7.Literals(["claim", "take_over", "let_go"])
   },
   error: RunnerRpcError
 }), Rpc.make("AdmitChild", {
@@ -723,26 +964,6 @@ class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
   },
   success: Schema7.Struct({ artifactId: Schema7.String }),
   error: RunnerRpcError
-}), Rpc.make("CreateRunFile", {
-  payload: {
-    lease: ProgramLease,
-    step: Schema7.String,
-    name: Schema7.String,
-    caption: Schema7.optional(Schema7.String),
-    contentType: Schema7.String,
-    byteSize: Schema7.Int,
-    sha256: Schema7.String
-  },
-  success: Schema7.Struct({ file: RunFileRecord, upload: Schema7.optional(RunFileUpload) }),
-  error: Schema7.Union([RunnerRpcError, RunFileRefused])
-}), Rpc.make("RunFileParts", {
-  payload: { lease: ProgramLease, fileId: Schema7.String, partNumbers: Schema7.Array(Schema7.Int) },
-  success: Schema7.Struct({ parts: Schema7.Array(RunFilePartUrl) }),
-  error: RunnerRpcError
-}), Rpc.make("CompleteRunFile", {
-  payload: { lease: ProgramLease, fileId: Schema7.String, parts: Schema7.optional(Schema7.Array(UploadedRunFilePart)) },
-  success: RunFileRecord,
-  error: RunnerRpcError
 }), Rpc.make("RecordNote", {
   payload: {
     lease: ProgramLease,
@@ -756,7 +977,14 @@ class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
     lease: ProgramLease,
     step: Schema7.String,
     effect: Schema7.Union([
-      Schema7.Struct({ kind: Schema7.Literal("post_comment"), changeRequestId: Schema7.String, body: Schema7.String }),
+      Schema7.Struct({
+        kind: Schema7.Literal("post_comment"),
+        changeRequestId: Schema7.String,
+        body: Schema7.String,
+        threadId: Schema7.optionalKey(Schema7.String),
+        summary: Schema7.optionalKey(Schema7.String),
+        anchors: Schema7.optionalKey(Schema7.Array(Schema7.Struct({ file: Schema7.String, line: Schema7.Int, body: Schema7.String })))
+      }),
       Schema7.Struct({
         kind: Schema7.Literal("change_request"),
         title: Schema7.String,
@@ -772,14 +1000,33 @@ class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
   },
   success: Schema7.UndefinedOr(Schema7.Struct({ id: Schema7.String, number: Schema7.String, url: Schema7.String })),
   error: RunnerRpcError
+}), Rpc.make("AlertTask", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema7.String,
+    fingerprint: Schema7.String,
+    title: Schema7.String,
+    windowHours: Schema7.Int,
+    resolved: Schema7.optionalKey(Schema7.Boolean),
+    priority: Schema7.optionalKey(Schema7.Literals(["urgent", "high", "medium", "low"]))
+  },
+  success: Schema7.Struct({
+    taskId: Schema7.optionalKey(Schema7.String),
+    created: Schema7.Boolean,
+    resolved: Schema7.optionalKey(Schema7.Boolean),
+    joined: Schema7.optionalKey(Schema7.Struct({ kind: Schema7.Literals(["run", "recent"]), runId: Schema7.String }))
+  }),
+  error: RunnerRpcError
 }), Rpc.make("ReadTranscripts", {
   payload: { lease: ProgramLease, step: Schema7.String, days: Schema7.Int },
   success: Schema7.Struct({
     runs: Schema7.Array(Schema7.Struct({
       runId: Schema7.String,
       loopId: Schema7.String,
+      status: Schema7.optionalKey(Schema7.Literals(["completed", "failed", "canceled", "expired"])),
       teamId: Schema7.optionalKey(Schema7.String),
       failure: Schema7.optionalKey(Schema7.String),
+      retried: Schema7.optionalKey(Schema7.Boolean),
       entries: Schema7.Array(Schema7.Struct({
         stepAttemptId: Schema7.String,
         sequence: Schema7.Int,
@@ -789,6 +1036,65 @@ class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
     }))
   }),
   error: RunnerRpcError
+}), Rpc.make("PipelineStatus", {
+  payload: { lease: ProgramLease, step: Schema7.String, changeRequestId: Schema7.String },
+  success: Schema7.Struct({
+    head: Schema7.String,
+    status: Schema7.Literals(["none", "running", "success", "failed", "canceled"]),
+    source: Schema7.Literals(["forge", "reported"]),
+    jobs: Schema7.Array(Schema7.Struct({
+      name: Schema7.String,
+      status: Schema7.Literals(["running", "success", "failed", "skipped"]),
+      url: Schema7.optionalKey(Schema7.String),
+      logTail: Schema7.optionalKey(Schema7.String)
+    })),
+    readAt: Schema7.optionalKey(Schema7.String),
+    runnerChecks: Schema7.optionalKey(Schema7.Array(Schema7.String))
+  }),
+  error: RunnerRpcError
+}), Rpc.make("ReportPipeline", {
+  payload: { lease: ProgramLease, step: Schema7.String, changeRequestId: Schema7.String, verification: Schema7.String },
+  success: Schema7.Struct({ head: Schema7.String, status: Schema7.Literals(["success", "failed"]) }),
+  error: RunnerRpcError
+}), Rpc.make("ReviewThreads", {
+  payload: { lease: ProgramLease, step: Schema7.String, changeRequestId: Schema7.String },
+  success: Schema7.Struct({
+    threads: Schema7.Array(Schema7.Struct({
+      id: Schema7.String,
+      path: Schema7.optionalKey(Schema7.String),
+      line: Schema7.optionalKey(Schema7.Int),
+      outdated: Schema7.optionalKey(Schema7.Boolean),
+      comments: Schema7.Array(Schema7.Struct({ author: Schema7.optionalKey(Schema7.String), body: Schema7.String }))
+    }))
+  }),
+  error: RunnerRpcError
+}), Rpc.make("OpenChangeRequests", {
+  payload: { lease: ProgramLease, step: Schema7.String, authors: Schema7.NonEmptyArray(Schema7.String) },
+  success: Schema7.Struct({
+    changeRequests: Schema7.Array(Schema7.Struct({
+      number: Schema7.String,
+      title: Schema7.String,
+      body: Schema7.String,
+      url: Schema7.String,
+      author: Schema7.String,
+      sourceBranch: Schema7.String,
+      head: Schema7.String
+    }))
+  }),
+  error: RunnerRpcError
+}), Rpc.make("OwnChangeRequests", {
+  payload: { lease: ProgramLease, step: Schema7.String },
+  success: Schema7.Struct({
+    changeRequests: Schema7.Array(Schema7.Struct({
+      id: Schema7.String,
+      number: Schema7.String,
+      url: Schema7.String,
+      title: Schema7.String,
+      sourceBranch: Schema7.String,
+      body: Schema7.String
+    }))
+  }),
+  error: RunnerRpcError
 }), Rpc.make("Propose", {
   payload: {
     lease: ProgramLease,
@@ -805,11 +1111,16 @@ class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
         title: Schema7.String,
         description: Schema7.String,
         teamId: Schema7.optionalKey(Schema7.String),
+        key: Schema7.optionalKey(Schema7.String),
         citations: Schema7.NonEmptyArray(Schema7.Struct({ runId: Schema7.String, stepAttemptId: Schema7.String, sequence: Schema7.Int }))
       })
     ])
   },
-  success: Schema7.Struct({ kind: Schema7.Literals(["memory", "task"]), id: Schema7.String }),
+  success: Schema7.Struct({
+    kind: Schema7.Literals(["memory", "task"]),
+    id: Schema7.String,
+    matched: Schema7.optionalKey(Schema7.Boolean)
+  }),
   error: RunnerRpcError
 }), Rpc.make("ReadProject", {
   payload: { lease: ProgramLease, step: Schema7.String, projectId: Schema7.String },
@@ -852,13 +1163,14 @@ class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
 }), Rpc.make("CreatePlanTasks", {
   payload: {
     lease: ProgramLease,
+    projectId: Schema7.optionalKey(Schema7.String),
     tickets: Schema7.Array(Schema7.Struct({
       key: Schema7.String,
       title: Schema7.String,
       body: Schema7.String,
       acceptanceCriteria: Schema7.Array(Schema7.String),
       blockedBy: Schema7.Array(Schema7.String),
-      outcome: Schema7.optionalKey(Schema7.Literals(["feature", "bug", "refactor", "investigation", "docs", "migration"]))
+      outcome: Schema7.optionalKey(Schema7.Literals(["feature", "bug", "refactor", "investigation", "docs", "migration", "performance"]))
     }))
   },
   success: Schema7.Array(Schema7.Struct({ key: Schema7.String, taskId: Schema7.String })),
@@ -868,12 +1180,53 @@ class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
   success: Schema7.Struct({ repoBindingId: Schema7.String, branch: Schema7.String, revision: Schema7.String }),
   error: RunnerRpcError
 }), Rpc.make("MergeChangeRequest", {
-  payload: { lease: ProgramLease, step: Schema7.String, changeRequestId: Schema7.String },
+  payload: {
+    lease: ProgramLease,
+    step: Schema7.String,
+    changeRequestId: Schema7.String,
+    head: Schema7.optionalKey(Schema7.String)
+  },
   success: Schema7.Union([
     Schema7.Struct({ status: Schema7.Literal("merged"), revision: Schema7.String }),
-    Schema7.Struct({ status: Schema7.Literal("conflict") })
+    Schema7.Struct({ status: Schema7.Literal("conflict") }),
+    Schema7.Struct({ status: Schema7.Literal("moved"), head: Schema7.String })
   ]),
   error: RunnerRpcError
+}), Rpc.make("ApproveChangeRequest", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema7.String,
+    changeRequestId: Schema7.String,
+    head: Schema7.String,
+    summary: Schema7.String,
+    review: Schema7.optionalKey(Schema7.String),
+    carries: Schema7.optionalKey(Schema7.String)
+  },
+  success: Schema7.Union([
+    Schema7.Struct({ approved: Schema7.Literal(true), reviewId: Schema7.String }),
+    Schema7.Struct({ approved: Schema7.Literal(false), reason: Schema7.String })
+  ]),
+  error: RunnerRpcError
+}), Rpc.make("CloseChangeRequest", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema7.String,
+    number: Schema7.String,
+    head: Schema7.String,
+    note: Schema7.String
+  },
+  success: Schema7.Struct({ closed: Schema7.Boolean, head: Schema7.optionalKey(Schema7.String) }),
+  error: RunnerRpcError
+}), Rpc.make("RerunPipeline", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema7.String,
+    changeRequestId: Schema7.optionalKey(Schema7.String),
+    ref: Schema7.optionalKey(Schema7.String),
+    all: Schema7.optionalKey(Schema7.Boolean)
+  },
+  success: Schema7.Struct({ head: Schema7.String, pipelines: Schema7.Int }),
+  error: RunnerRpcError
 }), Rpc.make("PublishRelease", {
   payload: {
     lease: ProgramLease,
@@ -885,64 +1238,37 @@ class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
   },
   success: Schema7.Struct({ tag: Schema7.String, revision: Schema7.String, url: Schema7.String }),
   error: RunnerRpcError
-}), Rpc.make("ReportSteer", {
-  payload: { workUnitId: Schema7.String, messageId: Schema7.String, delivered: Schema7.Boolean },
-  success: Schema7.Void,
-  error: RunnerRpcError
-}), Rpc.make("AppendTranscript", {
-  payload: { workUnitId: Schema7.String, entries: Schema7.Array(TranscriptAppendEntry).check(Schema7.isMaxLength(100)) },
-  success: Schema7.Void,
+}), Rpc.make("ProgramSecrets", {
+  payload: { lease: ProgramLease },
+  success: Schema7.Record(Schema7.String, Schema7.String),
   error: RunnerRpcError
-}), Rpc.make("CreateCheckpointFile", {
-  payload: { lease: ProgramLease, byteSize: Schema7.Int, sha256: Schema7.String },
+})).middleware(RunnerAuthentication) {
+}
+
+class RunnerRunFileRpcs extends RpcGroup.make(Rpc.make("CreateRunFile", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema7.String,
+    name: Schema7.String,
+    caption: Schema7.optional(Schema7.String),
+    contentType: Schema7.String,
+    byteSize: Schema7.Int,
+    sha256: Schema7.String
+  },
   success: Schema7.Struct({ file: RunFileRecord, upload: Schema7.optional(RunFileUpload) }),
   error: Schema7.Union([RunnerRpcError, RunFileRefused])
-}), Rpc.make("CheckpointFileParts", {
+}), Rpc.make("RunFileParts", {
   payload: { lease: ProgramLease, fileId: Schema7.String, partNumbers: Schema7.Array(Schema7.Int) },
   success: Schema7.Struct({ parts: Schema7.Array(RunFilePartUrl) }),
   error: RunnerRpcError
-}), Rpc.make("CompleteCheckpointFile", {
+}), Rpc.make("CompleteRunFile", {
   payload: { lease: ProgramLease, fileId: Schema7.String, parts: Schema7.optional(Schema7.Array(UploadedRunFilePart)) },
   success: RunFileRecord,
   error: RunnerRpcError
-}), Rpc.make("SaveCheckpoint", {
-  payload: { lease: ProgramLease, checkpoint: StepCheckpoint },
-  success: Schema7.Void,
-  error: RunnerRpcError
-}), Rpc.make("ResumeCheckpoint", {
-  payload: { lease: ProgramLease },
-  success: Schema7.UndefinedOr(ResumedCheckpoint),
-  error: RunnerRpcError
-}), Rpc.make("SettledCheckpoints", {
-  success: Schema7.Array(Schema7.Struct({
-    stepAttemptId: Schema7.String,
-    ref: Schema7.optionalKey(Schema7.String),
-    repoBinding: Schema7.optionalKey(WorkUnitRepoBinding)
-  })),
-  error: RunnerRpcError
-}), Rpc.make("ForgetCheckpoints", {
-  payload: { stepAttemptIds: Schema7.Array(Schema7.String) },
-  success: Schema7.Void,
-  error: RunnerRpcError
-}), Rpc.make("Bundle", {
-  payload: { digest: Schema7.String },
-  success: Schema7.Struct({ bundle: Schema7.String }),
-  error: RunnerRpcError
-}), Rpc.make("SettledRuns", {
-  payload: { runIds: Schema7.Array(Schema7.String) },
-  success: Schema7.Array(Schema7.String),
-  error: RunnerRpcError
-}), Rpc.make("ProgramSecrets", {
-  payload: { lease: ProgramLease },
-  success: Schema7.Record(Schema7.String, Schema7.String),
-  error: RunnerRpcError
-}), Rpc.make("Suspend", { payload: { lease: ProgramLease }, error: RunnerRpcError }), Rpc.make("FinishProgram", { payload: { lease: ProgramLease, outcome: ProgramOutcome }, error: RunnerRpcError }), Rpc.make("Signals", {
-  payload: { runnerReplicaId: Schema7.String },
-  success: RunnerSignal,
-  error: RunnerRpcError,
-  stream: true
 })).middleware(RunnerAuthentication) {
 }
+var ProgramRpcs = RunnerJournalRpcs.merge(RunnerCapabilityRpcs, RunnerRunFileRpcs);
+var RunnerRpcs = RunnerReplicaRpcs.merge(RunnerJournalRpcs, RunnerCapabilityRpcs, RunnerRunFileRpcs);
 
 // packages/sdk/src/program/engine.ts
 import { Workflow, WorkflowEngine } from "effect/workflow";
@@ -1044,6 +1370,8 @@ var emptyWorkflow = Workflow.make("kitman-loop/none", { payload: {}, idempotency
 var replayStatuses = new Set([401, 403, 409, 429]);
 var isRunnerRpcError = Schema8.is(RunnerRpcError);
 var isRunFileRefused = Schema8.is(RunFileRefused);
+var issues = SchemaIssue.makeFormatterStandardSchemaV1();
+var refusedFields = (issue) => [...new Set(issues(issue).issues.map(({ path }) => (path ?? []).map(String).join(".")))].join(", ");
 var refusedStep2 = (cause) => {
   if (isRunFileRefused(cause))
     return true;
@@ -1051,42 +1379,61 @@ var refusedStep2 = (cause) => {
     return true;
   return isRunnerRpcError(cause) && cause.status >= 400 && cause.status < 500 && !replayStatuses.has(cause.status);
 };
-var requested = (step, request) => request.pipe(Effect2.catch((cause) => refusedStep2(cause) ? Effect2.fail(new StepFailed2({ step, reason: cause.message })) : Effect2.die(new JournalWriteFailed2({ cause }))));
-var runnerHost = (journal) => ({
-  putQuestion: (launch) => requested(launch.step, journal.putQuestion({
+var requested2 = (step, request) => request.pipe(Effect2.catch((cause) => refusedStep2(cause) ? Effect2.fail(new StepFailed2({ step, reason: cause.message })) : Effect2.die(new JournalWriteFailed2({ cause }))), Effect2.catchDefect((defect) => defect instanceof Error && SchemaIssue.isIssue(defect.cause) ? Effect2.fail(new StepFailed2({
+  step,
+  reason: `Kitman cannot take this Step's request: invalid ${refusedFields(defect.cause)}`
+})) : Effect2.die(defect)));
+var runnerHost = (capabilities) => ({
+  putQuestion: (launch) => requested2(launch.step, capabilities.putQuestion({
     step: launch.step,
     prompt: launch.prompt,
     deferredName: answerDeferred2(launch.step).name,
+    ...questionAdvice(launch),
     ...launch.options === undefined ? undefined : { options: launch.options },
-    ...launch.verification === undefined ? undefined : { verification: launch.verification }
+    ...launch.verification === undefined ? undefined : { verification: launch.verification },
+    ...launch.default === undefined ? undefined : { default: launch.default },
+    ...launch.timeoutMillis === undefined ? undefined : { timeoutMillis: launch.timeoutMillis }
   })).pipe(Effect2.asVoid),
-  startVerification: (launch) => requested(launch.step, journal.startVerification({
+  startVerification: (launch) => requested2(launch.step, capabilities.startVerification({
     step: launch.step,
-    deferredName: verifyDeferred2(launch.step).name,
+    deferredName: (launch.measure === undefined ? verifyDeferred2 : measureDeferred2)(launch.step).name,
     ...launch.revision === undefined ? undefined : { revision: launch.revision },
-    ...launch.checks === undefined ? undefined : { checks: launch.checks }
+    ...launch.checks === undefined ? undefined : { checks: launch.checks },
+    ...launch.suggested === undefined ? undefined : { suggested: launch.suggested },
+    ...launch.measure === undefined ? undefined : { measure: launch.measure }
   })).pipe(Effect2.asVoid),
-  startAgentWork: (launch) => requested(launch.step, journal.startAgentStep({
+  startAgentWork: (launch) => requested2(launch.step, capabilities.startAgentStep({
     step: launch.step,
-    deferredName: agentWorkDeferred2(launch.step).name,
+    deferredName: launch.deferredName,
     role: launch.role,
     agentId: launch.agent,
     prompt: launch.prompt,
+    ...launch.skill === undefined ? undefined : { skill: launch.skill },
     outputSchema: launch.output,
-    ...launch.secrets === undefined ? undefined : { secrets: launch.secrets }
+    ...launch.secrets === undefined ? undefined : { secrets: launch.secrets },
+    ...launch.timeoutMillis === undefined ? undefined : { timeoutMillis: launch.timeoutMillis },
+    ...launch.mergeTarget === undefined ? undefined : { mergeTarget: launch.mergeTarget }
   })).pipe(Effect2.asVoid),
-  admitChild: (launch) => requested(launch.step, journal.admitChild({
+  admitChild: (launch) => requested2(launch.step, capabilities.admitChild({
     step: launch.step,
     loop: launch.loop,
     input: launch.input,
     deferredName: childDeferred2(launch.step).name
   })).pipe(Effect2.asVoid),
-  awaitEvent: (launch) => requested(launch.step, journal.awaitEvent({
+  claimResource: (launch) => requested2(launch.step, capabilities.claimResource({
+    step: launch.step,
+    deferredName: (launch.action === "let_go" ? letGoDeferred2 : claimDeferred2)(launch.step).name,
+    resource: launch.resource,
+    action: launch.action
+  })),
+  awaitEvent: (launch) => requested2(launch.step, capabilities.awaitEvent({
     step: launch.step,
     deferredName: eventDeferred2(launch.step).name,
     event: launch.event,
     ...launch.filter === undefined ? undefined : { filter: launch.filter },
-    timeoutMillis: launch.timeoutMillis
+    timeoutMillis: launch.timeoutMillis,
+    ...launch.since === undefined ? undefined : { since: launch.since },
+    ...launch.or === undefined ? undefined : { or: launch.or }
   }))
 });
 var put2 = (target, contentType, body) => Effect2.gen(function* () {
@@ -1122,8 +1469,8 @@ var uploadRunFile2 = (files, file) => Effect2.gen(function* () {
     return slotted;
   return yield* upload.kind === "single" ? readRange(file.path, 0, byteSize).pipe(Effect2.flatMap((body) => put2(upload, contentType, body)), Effect2.andThen(files.completeRunFile({ fileId: slotted.id }))) : Effect2.flatMap(uploadParts(files, file.path, contentType, slotted.id, upload), (parts) => files.completeRunFile({ fileId: slotted.id, parts }));
 });
-var keepFile = (journal, step, { path, caption }) => Effect2.gen(function* () {
-  const kept = yield* uploadRunFile2(journal, { step, name: path.split("/").at(-1) ?? path, path, caption }).pipe(Effect2.catch((cause) => isPlatformError(cause) ? Effect2.fail(new StepFailed2({ step, reason: `Could not read ${path}: ${cause.message}` })) : requested(step, Effect2.fail(cause))));
+var keepFile = (files, step, { path, caption }) => Effect2.gen(function* () {
+  const kept = yield* uploadRunFile2(files, { step, name: path.split("/").at(-1) ?? path, path, caption }).pipe(Effect2.catch((cause) => isPlatformError(cause) ? Effect2.fail(new StepFailed2({ step, reason: `Could not read ${path}: ${cause.message}` })) : requested2(step, Effect2.fail(cause))));
   if (kept.status !== "available")
     return yield* new StepFailed2({
       step,
@@ -1131,9 +1478,9 @@ var keepFile = (journal, step, { path, caption }) => Effect2.gen(function* () {
     });
   return { id: kept.id };
 });
-var runnerActivities = (journal, services) => ({
+var runnerActivities = (capabilities, services) => ({
   changeRequest: {
-    run: (request, step) => requested(step, journal.performHostEffect({
+    run: (request, step) => requested2(step, capabilities.performHostEffect({
       step,
       effect: {
         kind: "change_request",
@@ -1144,7 +1491,7 @@ var runnerActivities = (journal, services) => ({
     })).pipe(Effect2.filterOrFail((opened) => opened !== undefined, () => new StepFailed2({ step, reason: "Kitman opened no ChangeRequest" })))
   },
   writeBack: {
-    run: (request, step) => requested(step, journal.performHostEffect({
+    run: (request, step) => requested2(step, capabilities.performHostEffect({
       step,
       effect: {
         kind: "write_back",
@@ -1154,32 +1501,43 @@ var runnerActivities = (journal, services) => ({
     })).pipe(Effect2.asVoid)
   },
   artifact: {
-    run: ({ files, ...request }, step) => requested(step, journal.storeArtifact({
+    run: ({ files, ...request }, step) => requested2(step, capabilities.storeArtifact({
       step,
       ...request,
       ...files === undefined ? undefined : { fileIds: files.map((shown) => shown.id) }
     }))
   },
-  file: { run: (request, step) => keepFile(journal, step, request).pipe(Effect2.provideContext(services)) },
-  note: { run: (request, step) => requested(step, journal.recordNote({ step, ...request })) },
+  file: { run: (request, step) => keepFile(capabilities, step, request).pipe(Effect2.provideContext(services)) },
+  note: { run: (request, step) => requested2(step, capabilities.recordNote({ step, ...request })) },
   createTasks: {
-    run: (request, step) => requested(step, Effect2.map(journal.createPlanTasks(request.tickets), (tasks) => ({ tasks })))
+    run: (request, step) => requested2(step, Effect2.map(capabilities.createPlanTasks(request.tickets, request.projectId), (tasks) => ({ tasks })))
   },
+  alertTask: { run: (request, step) => requested2(step, capabilities.alertTask({ step, ...request })) },
   integrationBranch: {
-    run: (request, step) => requested(step, journal.integrationBranch(request.repoBindingId))
+    run: (request, step) => requested2(step, capabilities.integrationBranch(request.repoBindingId))
   },
-  transcripts: { run: (request, step) => requested(step, journal.readTranscripts({ step, ...request })) },
-  propose: { run: (proposal, step) => requested(step, journal.propose({ step, proposal })) },
-  projectActivity: { run: (request, step) => requested(step, journal.readProject({ step, ...request })) },
-  draftUpdate: { run: (request, step) => requested(step, journal.draftUpdate({ step, ...request })) },
+  transcripts: { run: (request, step) => requested2(step, capabilities.readTranscripts({ step, ...request })) },
+  changeRequestRead: {
+    pipeline: (request, step) => requested2(step, capabilities.pipelineStatus({ step, ...request })),
+    reviewThreads: (request, step) => requested2(step, capabilities.reviewThreads({ step, ...request })),
+    opened: (request, step) => requested2(step, capabilities.openChangeRequests({ step, ...request })),
+    own: (step) => requested2(step, capabilities.ownChangeRequests({ step }))
+  },
+  propose: { run: (proposal, step) => requested2(step, capabilities.propose({ step, proposal })) },
+  projectActivity: { run: (request, step) => requested2(step, capabilities.readProject({ step, ...request })) },
+  draftUpdate: { run: (request, step) => requested2(step, capabilities.draftUpdate({ step, ...request })) },
   mergeChangeRequest: {
-    run: (request, step) => requested(step, journal.mergeChangeRequest({ step, ...request }))
+    run: (request, step) => requested2(step, capabilities.mergeChangeRequest({ step, ...request })),
+    close: (request, step) => requested2(step, capabilities.closeChangeRequest({ step, ...request })),
+    rerun: (request, step) => requested2(step, capabilities.rerunPipeline({ step, ...request })),
+    report: (request, step) => requested2(step, capabilities.reportPipeline({ step, ...request })),
+    approve: (request, step) => requested2(step, capabilities.approveChangeRequest({ step, ...request }))
   },
   release: {
-    run: ({ revision, ...request }, step) => requested(step, journal.publishRelease({ step, ...request, ...revision === undefined ? undefined : { revision } }))
+    run: ({ revision, ...request }, step) => requested2(step, capabilities.publishRelease({ step, ...request, ...revision === undefined ? undefined : { revision } }))
   },
   comment: {
-    run: (request, step) => requested(step, journal.performHostEffect({ step, effect: { kind: "post_comment", ...request } })).pipe(Effect2.asVoid)
+    run: (request, step) => requested2(step, capabilities.performHostEffect({ step, effect: { kind: "post_comment", ...request } })).pipe(Effect2.asVoid)
   }
 });
 var describeFailure = (cause) => {
@@ -1188,14 +1546,14 @@ var describeFailure = (cause) => {
   return summary.slice(0, 4000) || "Program failed";
 };
 var journalLoss = (cause) => cause.reasons.flatMap((reason) => Cause.isDieReason(reason) && reason.defect instanceof JournalWriteFailed2 ? [reason.defect] : [])[0];
-var runProgram2 = (loop, work, journal) => Effect2.scoped(Effect2.gen(function* () {
+var runProgram2 = (loop, work, { journal, capabilities }) => Effect2.scoped(Effect2.gen(function* () {
   const services = yield* Effect2.context();
   const { engine, encoded } = yield* makeEncodedEngine(work.journal, journal);
   const workflow = loopWorkflow2(loop);
   const execute = executeLoop2(loop, {
-    host: runnerHost(journal),
-    activities: runnerActivities(journal, services),
-    granted: new Set(loop.capabilities.filter((capability) => work.granted.includes(capability)))
+    host: runnerHost(capabilities),
+    activities: runnerActivities(capabilities, services),
+    granted: new Set(capabilitiesOf2(loop).filter((capability) => work.granted.includes(capability)))
   });
   yield* Layer.build(workflow.toLayer(execute).pipe(Layer.provide(Layer.succeed(WorkflowEngine.WorkflowEngine)(engine))));
   const result = yield* encoded.execute(workflow, {
@@ -1236,36 +1594,47 @@ var rpcRunFiles2 = (rpc, lease) => ({
   runFileParts: (request) => Effect2.map(rpc.runFileParts({ lease, ...request, partNumbers: [...request.partNumbers] }), ({ parts }) => parts),
   completeRunFile: ({ parts, ...request }) => rpc.completeRunFile({ lease, ...request, ...parts === undefined ? undefined : { parts: [...parts] } })
 });
-var rpcProgramJournal2 = (rpc, work) => {
+var rpcProgramPorts2 = (rpc, work) => {
   const lease = programLease2(work);
-  return {
+  const journal = {
     recordActivity: (entry) => rpc.recordActivity({ lease, ...entry }),
     deferredDone: (entry) => rpc.deferredDone({ lease, ...entry }),
     scheduleClock: (clock) => rpc.scheduleClock({ lease, ...clock }),
+    suspend: rpc.suspend({ lease }),
+    finish: (outcome) => rpc.finishProgram({ lease, outcome })
+  };
+  const capabilities = {
     putQuestion: (question) => rpc.putQuestion({
       lease,
       step: question.step,
       prompt: question.prompt,
       deferredName: question.deferredName,
+      ...questionAdvice(question),
       ...question.options === undefined ? undefined : { options: [...question.options] },
-      ...question.verification === undefined ? undefined : { verification: question.verification }
+      ...question.verification === undefined ? undefined : { verification: question.verification },
+      ...question.default === undefined ? undefined : { default: question.default },
+      ...question.timeoutMillis === undefined ? undefined : { timeoutMillis: question.timeoutMillis }
     }),
     startVerification: (verification) => rpc.startVerification({
       lease,
       step: verification.step,
       deferredName: verification.deferredName,
       ...verification.revision === undefined ? undefined : { revision: verification.revision },
-      ...verification.checks === undefined ? undefined : { checks: [...verification.checks] }
+      ...verification.checks === undefined ? undefined : { checks: [...verification.checks] },
+      ...verification.suggested === undefined ? undefined : { suggested: [...verification.suggested] },
+      ...verification.measure === undefined ? undefined : { measure: verification.measure }
     }),
     startAgentStep: ({ secrets, ...step }) => rpc.startAgentStep({ lease, ...step, ...secrets === undefined ? undefined : { secrets: [...secrets] } }),
     awaitEvent: (wait) => rpc.awaitEvent({ lease, ...wait }),
+    claimResource: (claim) => rpc.claimResource({ lease, ...claim }),
     admitChild: (child) => rpc.admitChild({ lease, ...child }),
     storeArtifact: ({ fileIds, ...artifact }) => rpc.storeArtifact({ lease, ...artifact, ...fileIds === undefined ? undefined : { fileIds: [...fileIds] } }),
     ...rpcRunFiles2(rpc, lease),
     recordNote: (note) => rpc.recordNote({ lease, ...note }),
     performHostEffect: (request) => rpc.performHostEffect({ lease, ...request }),
-    createPlanTasks: (tickets) => rpc.createPlanTasks({
+    createPlanTasks: (tickets, projectId) => rpc.createPlanTasks({
       lease,
+      ...projectId === undefined ? undefined : { projectId },
       tickets: tickets.map((ticket) => ({
         key: ticket.key,
         title: ticket.title,
@@ -1276,7 +1645,13 @@ var rpcProgramJournal2 = (rpc, work) => {
       }))
     }),
     integrationBranch: (repoBindingId) => rpc.integrationBranch({ lease, ...repoBindingId === undefined ? undefined : { repoBindingId } }),
+    alertTask: (request) => rpc.alertTask({ lease, ...request }),
     readTranscripts: (request) => rpc.readTranscripts({ lease, ...request }),
+    pipelineStatus: (request) => rpc.pipelineStatus({ lease, ...request }),
+    reportPipeline: (request) => rpc.reportPipeline({ lease, ...request }),
+    reviewThreads: (request) => rpc.reviewThreads({ lease, ...request }),
+    openChangeRequests: (request) => rpc.openChangeRequests({ lease, ...request }),
+    ownChangeRequests: (request) => rpc.ownChangeRequests({ lease, ...request }),
     propose: ({ step, proposal }) => rpc.propose({
       lease,
       step,
@@ -1285,6 +1660,7 @@ var rpcProgramJournal2 = (rpc, work) => {
         title: proposal.title,
         description: proposal.description,
         ...proposal.teamId === undefined ? undefined : { teamId: proposal.teamId },
+        ...proposal.key === undefined ? undefined : { key: proposal.key },
         citations: [...proposal.citations]
       }
     }),
@@ -1299,10 +1675,12 @@ var rpcProgramJournal2 = (rpc, work) => {
       }
     }),
     mergeChangeRequest: (request) => rpc.mergeChangeRequest({ lease, ...request }),
-    publishRelease: (request) => rpc.publishRelease({ lease, ...request }),
-    suspend: rpc.suspend({ lease }),
-    finish: (outcome) => rpc.finishProgram({ lease, outcome })
+    closeChangeRequest: (request) => rpc.closeChangeRequest({ lease, ...request }),
+    approveChangeRequest: (request) => rpc.approveChangeRequest({ lease, ...request }),
+    rerunPipeline: (request) => rpc.rerunPipeline({ lease, ...request }),
+    publishRelease: (request) => rpc.publishRelease({ lease, ...request })
   };
+  return { journal, capabilities };
 };
 
 // packages/live/src/rpc/runner-client.ts
@@ -1321,30 +1699,28 @@ function runnerRpcUrl(apiUrl) {
   url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
   return url.toString();
 }
-var makeRunnerRpcClient = (options) => Effect3.gen(function* () {
+var authorizer = (options) => (call) => Effect3.flatMap(options.bearer, (token) => RpcClient.withHeaders(call, {
+  authorization: `Bearer ${token}`,
+  [RunnerHeaders.runnerId]: options.runnerId,
+  [RunnerHeaders.protocolVersion]: String(RunnerRpcProtocolVersion)
+}));
+var RunnerProcessRpcs = RunnerReplicaRpcs.merge(RunnerRunFileRpcs);
+var makeProgramRpcClient = (options) => Effect3.gen(function* () {
   const protocol = yield* Layer2.build(options.protocol);
-  const client = yield* RpcClient.make(RunnerRpcs).pipe(Effect3.provideContext(protocol));
-  const authorized = (call) => Effect3.flatMap(options.bearer, (token) => RpcClient.withHeaders(call, {
-    authorization: `Bearer ${token}`,
-    [RunnerHeaders.runnerId]: options.runnerId,
-    [RunnerHeaders.protocolVersion]: String(RunnerRpcProtocolVersion)
-  }));
+  const client = yield* RpcClient.make(ProgramRpcs).pipe(Effect3.provideContext(protocol));
+  const authorized = authorizer(options);
   return {
-    claim: (input) => authorized(client.Claim(input)),
-    heartbeat: (input) => authorized(client.Heartbeat(input)),
-    complete: (input) => authorized(client.Complete(input)),
-    release: (input) => authorized(client.Release(input)),
     recordActivity: (input) => authorized(client.RecordActivity(input)),
     deferredDone: (input) => authorized(client.DeferredDone(input)),
     scheduleClock: (input) => authorized(client.ScheduleClock(input)),
-    putQuestion: (input) => authorized(client.PutQuestion(input)),
-    programSecrets: (input) => authorized(client.ProgramSecrets(input)),
     suspend: (input) => authorized(client.Suspend(input)),
     finishProgram: (input) => authorized(client.FinishProgram(input)),
+    putQuestion: (input) => authorized(client.PutQuestion(input)),
+    programSecrets: (input) => authorized(client.ProgramSecrets(input)),
     startAgentStep: (input) => authorized(client.StartAgentStep(input)),
     startVerification: (input) => authorized(client.StartVerification(input)),
-    knownEvidence: (input) => authorized(client.KnownEvidence(input)),
     awaitEvent: (input) => authorized(client.AwaitEvent(input)),
+    claimResource: (input) => authorized(client.ClaimResource(input)),
     admitChild: (input) => authorized(client.AdmitChild(input)),
     storeArtifact: (input) => authorized(client.StoreArtifact(input)),
     createRunFile: (input) => authorized(client.CreateRunFile(input)),
@@ -1353,25 +1729,22 @@ var makeRunnerRpcClient = (options) => Effect3.gen(function* () {
     recordNote: (input) => authorized(client.RecordNote(input)),
     performHostEffect: (input) => authorized(client.PerformHostEffect(input)),
     createPlanTasks: (input) => authorized(client.CreatePlanTasks(input)),
+    alertTask: (input) => authorized(client.AlertTask(input)),
     readTranscripts: (input) => authorized(client.ReadTranscripts(input)),
+    pipelineStatus: (input) => authorized(client.PipelineStatus(input)),
+    reportPipeline: (input) => authorized(client.ReportPipeline(input)),
+    reviewThreads: (input) => authorized(client.ReviewThreads(input)),
+    openChangeRequests: (input) => authorized(client.OpenChangeRequests(input)),
+    ownChangeRequests: (input) => authorized(client.OwnChangeRequests(input)),
     propose: (input) => authorized(client.Propose(input)),
     readProject: (input) => authorized(client.ReadProject(input)),
     draftUpdate: (input) => authorized(client.DraftUpdate(input)),
     integrationBranch: (input) => authorized(client.IntegrationBranch(input)),
     mergeChangeRequest: (input) => authorized(client.MergeChangeRequest(input)),
-    publishRelease: (input) => authorized(client.PublishRelease(input)),
-    bundle: (digest) => authorized(client.Bundle({ digest })),
-    settledRuns: (runIds) => authorized(client.SettledRuns({ runIds })),
-    reportSteer: (input) => authorized(client.ReportSteer(input)),
-    appendTranscript: (input) => authorized(client.AppendTranscript(input)),
-    createCheckpointFile: (input) => authorized(client.CreateCheckpointFile(input)),
-    checkpointFileParts: (input) => authorized(client.CheckpointFileParts(input)),
-    completeCheckpointFile: (input) => authorized(client.CompleteCheckpointFile(input)),
-    saveCheckpoint: (input) => authorized(client.SaveCheckpoint(input)),
-    resumeCheckpoint: (input) => authorized(client.ResumeCheckpoint(input)),
-    settledCheckpoints: authorized(client.SettledCheckpoints()),
-    forgetCheckpoints: (stepAttemptIds) => authorized(client.ForgetCheckpoints({ stepAttemptIds })),
-    listen: (runnerReplicaId, onSignal) => authorized(Stream2.runForEach(client.Signals({ runnerReplicaId }), onSignal))
+    closeChangeRequest: (input) => authorized(client.CloseChangeRequest(input)),
+    approveChangeRequest: (input) => authorized(client.ApproveChangeRequest(input)),
+    rerunPipeline: (input) => authorized(client.RerunPipeline(input)),
+    publishRelease: (input) => authorized(client.PublishRelease(input))
   };
 });
 
@@ -1387,13 +1760,16 @@ import * as Redacted2 from "effect/Redacted";
 import * as Schema9 from "effect/Schema";
 import * as FetchHttpClient from "effect/http/FetchHttpClient";
 var describeFlag2 = "--kitman-describe";
+var DescribedKit = Schema9.Struct({
+  name: Schema9.String,
+  version: Schema9.String,
+  loops: Schema9.Array(LoopManifest),
+  agents: Schema9.Record(Schema9.String, Schema9.Json),
+  schedules: Schema9.optionalKey(Schema9.Record(Schema9.String, Schema9.Json)),
+  setup: Schema9.optionalKey(KitSetup)
+});
 var Described2 = Schema9.Union([
-  Schema9.TaggedStruct("Described", {
-    loops: Schema9.Array(LoopManifest),
-    agents: Schema9.Record(Schema9.String, Schema9.Json),
-    schedules: Schema9.optionalKey(Schema9.Record(Schema9.String, Schema9.Json)),
-    kits: Schema9.optionalKey(Schema9.Record(Schema9.String, Schema9.Json))
-  }),
+  Schema9.TaggedStruct("Described", { kits: Schema9.Array(DescribedKit) }),
   Schema9.TaggedStruct("Refused", { error: Schema9.Union([ManifestInvalid2, LoopCheckError2]) })
 ]);
 var encodeDescribed = Schema9.encodeEffect(Schema9.fromJsonString(Schema9.toCodecJson(Described2)));
@@ -1482,35 +1858,62 @@ var networkGuard2 = (input) => {
   });
   return { fetch, journal };
 };
-var describe = (config) => Effect4.gen(function* () {
-  const loops = yield* Effect4.forEach(config.loops, loopManifest2);
-  for (const loop of config.loops)
-    for (const check of loop.checks ?? [])
-      yield* checkLoop2(loop, check);
-  return {
-    _tag: "Described",
-    loops,
-    agents: config.agents ?? {},
-    ...config.schedules === undefined ? undefined : { schedules: config.schedules },
-    ...config.kits === undefined ? undefined : { kits: config.kits }
+var carriedKits2 = (config, identity, packages) => {
+  const identities = new Map(packages);
+  const carried = [];
+  const visited = new Set;
+  const visit = (kit) => {
+    if (visited.has(kit.config))
+      return;
+    visited.add(kit.config);
+    const index = carried.findIndex((known) => known.identity.name === kit.identity.name);
+    const known = carried[index];
+    if (known === undefined)
+      carried.push(kit);
+    else if (Bun.semver.order(kit.identity.version, known.identity.version) > 0)
+      carried[index] = kit;
+    for (const nested of kit.config.extends ?? []) {
+      const nestedIdentity = identities.get(nested);
+      if (nestedIdentity === undefined)
+        throw new Error(`${kit.identity.name} extends a Kit the build cannot name: import it from a package it depends on, or from a local module with its own package.json`);
+      visit({ identity: nestedIdentity, config: nested });
+    }
   };
+  visit({ identity, config });
+  return carried;
+};
+var describe = (carried) => Effect4.gen(function* () {
+  const kits = [];
+  for (const { identity, config } of carried) {
+    kits.push({
+      ...identity,
+      loops: yield* Effect4.forEach(config.loops, loopManifest2),
+      agents: config.agents ?? {},
+      ...config.schedules === undefined ? undefined : { schedules: config.schedules },
+      ...config.setup === undefined ? undefined : { setup: config.setup }
+    });
+    for (const loop of config.loops)
+      for (const check of loop.checks ?? [])
+        yield* checkLoop2(loop, check);
+  }
+  return { _tag: "Described", kits };
 }).pipe(Effect4.catch((error) => Effect4.succeed({ _tag: "Refused", error })), Effect4.flatMap(encodeDescribed), Effect4.flatMap((described) => Effect4.callback((resume) => void process.stdout.write(described, () => resume(Effect4.void)))), Effect4.as(0));
 var readStdin = Effect4.tryPromise(() => Bun.stdin.text());
 var isWorkUnit = guard(ProgramWorkUnit);
-var host = (config) => Effect4.gen(function* () {
+var host = (carried) => Effect4.gen(function* () {
   const loopId = yield* Config.String("KITMAN_LOOP_ID");
   const apiUrl = yield* Config.String("KITMAN_API_URL");
   const credential = yield* Config.Redacted("KITMAN_PROGRAM_CREDENTIAL");
   const work = yield* Schema9.decodeEffect(Schema9.fromJsonString(Schema9.Unknown))(yield* readStdin);
   if (!isWorkUnit(work))
     return yield* new ProgramRefused({ reason: "stdin holds no orchestration Work Unit" });
-  const loop = config.loops.find((candidate) => candidate.id === loopId);
+  const loop = carried.flatMap((kit) => kit.config.loops).find((candidate) => candidate.id === loopId);
   if (loop === undefined)
-    return yield* new ProgramRefused({ reason: `The Package declares no Loop "${loopId}"` });
+    return yield* new ProgramRefused({ reason: `The Kit carries no Loop "${loopId}"` });
   const hosts = yield* Config.option(Config.String(programHostsEnv2));
   const undeclared = yield* Config.option(Config.Literals(["fail", "warn"], undeclaredHostsEnv2));
   const proxy = yield* Config.option(Config.String("HTTPS_PROXY"));
-  const rpc = yield* makeRunnerRpcClient({
+  const rpc = yield* makeProgramRpcClient({
     runnerId: work.lease.leaseOwnerId,
     bearer: Effect4.sync(() => Redacted2.value(credential)),
     protocol: runnerWebSocketProtocol(runnerRpcUrl(apiUrl), Option2.isSome(proxy) ? { proxy: proxy.value } : {})
@@ -1527,12 +1930,13 @@ var host = (config) => Effect4.gen(function* () {
   });
   if (guard !== undefined)
     globalThis.fetch = Object.assign(guard.fetch, { preconnect: globalThis.fetch.preconnect });
-  const journal = rpcProgramJournal2(rpc, work);
-  return yield* runProgram2(loop, work, guard === undefined ? journal : guard.journal(journal)).pipe(Effect4.provide(Layer3.merge(BunServices.layer, FetchHttpClient.layer)), Effect4.provideService(ConfigProvider.ConfigProvider, ConfigProvider.fromUnknown(secrets.value)), Effect4.as(0), Effect4.catchTag("JournalWriteFailed", (error) => Effect4.as(Effect4.logError(error.message), 1)));
+  const ports = rpcProgramPorts2(rpc, work);
+  return yield* runProgram2(loop, work, guard === undefined ? ports : { ...ports, journal: guard.journal(ports.journal) }).pipe(Effect4.provide(Layer3.merge(BunServices.layer, FetchHttpClient.layer)), Effect4.provideService(ConfigProvider.ConfigProvider, ConfigProvider.fromUnknown(secrets.value)), Effect4.as(0), Effect4.catchTag("JournalWriteFailed", (error) => Effect4.as(Effect4.logError(error.message), 1)));
 }).pipe(Effect4.scoped, Effect4.catch((error) => Effect4.as(Effect4.logError(error.message), 2)));
-var runPackage2 = (config) => {
-  const program = process.argv.includes(describeFlag2) ? describe(config) : host(config);
+var runKit2 = (config, identity, packages) => {
+  const carried = carriedKits2(config, identity, packages);
+  const program = process.argv.includes(describeFlag2) ? describe(carried) : host(carried);
   BunRuntime.runMain(program.pipe(Effect4.flatMap((code) => Effect4.sync(() => process.exit(code)))));
 };
 
-export { digestSha256, RunnerRpcProtocolVersion, JournalWriteFailed2, refusedStep2, uploadRunFile2, runProgram2, programLease2, rpcRunFiles2, rpcProgramJournal2, describeFlag2, Described2, programSecrets2, programHostsEnv2, undeclaredHostsEnv2, networkGuard2, runPackage2 };
+export { digestSha256, digestSha512, digestWith, kitmanMcpServer, RunnerRpcProtocolVersion, JournalWriteFailed2, refusedStep2, requested2, uploadRunFile2, runProgram2, programLease2, rpcRunFiles2, rpcProgramPorts2, describeFlag2, Described2, programSecrets2, programHostsEnv2, undeclaredHostsEnv2, networkGuard2, carriedKits2, runKit2 };