@kody-ade/kody-engine 0.4.306 → 0.4.308

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.306",
+      version: "0.4.308",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
       license: "MIT",
       type: "module",
@@ -549,11 +549,11 @@ function branchApiPath(config, targetPath) {
 }
 function ensureStateBranch(config, cwd) {
   const parsed = parseStateRepo(config);
-  const cacheKey3 = `${parsed.owner}/${parsed.repo}:${parsed.branch}`;
-  if (ensuredStateBranches.has(cacheKey3)) return;
+  const cacheKey4 = `${parsed.owner}/${parsed.repo}:${parsed.branch}`;
+  if (ensuredStateBranches.has(cacheKey4)) return;
   try {
     gh(["api", `/repos/${parsed.owner}/${parsed.repo}/git/ref/heads/${parsed.branch}`], { cwd });
-    ensuredStateBranches.add(cacheKey3);
+    ensuredStateBranches.add(cacheKey4);
     return;
   } catch (err) {
     if (!is404(err)) throw err;
@@ -572,7 +572,7 @@ function ensureStateBranch(config, cwd) {
   } catch (err) {
     if (!isAlreadyExists(err)) throw err;
   }
-  ensuredStateBranches.add(cacheKey3);
+  ensuredStateBranches.add(cacheKey4);
 }
 function readStateText(config, cwd, filePath) {
   const targetPath = stateRepoPath(config, filePath);
@@ -1610,7 +1610,7 @@ function cmsHeaders(opts) {
     }
   };
 }
-async function callDashboardCms(opts, path50, init = {}) {
+async function callDashboardCms(opts, path51, init = {}) {
   const baseUrl = dashboardBaseUrl(opts);
   if (!baseUrl) {
     return {
@@ -1622,7 +1622,7 @@ async function callDashboardCms(opts, path50, init = {}) {
   const headerResult = cmsHeaders(opts);
   if (!headerResult.ok) return headerResult;
   try {
-    const res = await fetch(`${baseUrl}${path50}`, {
+    const res = await fetch(`${baseUrl}${path51}`, {
       ...init,
       headers: {
         ...headerResult.headers,
@@ -1694,8 +1694,8 @@ function documentArg(value) {
 function normalizeCmsDocumentIdInput(input) {
   const trimmed = stripWrappingQuotes(input.trim());
   const withoutQuery = trimmed.split(/[?#]/, 1)[0] ?? trimmed;
-  const path50 = parseDocumentPath(withoutQuery);
-  return path50 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
+  const path51 = parseDocumentPath(withoutQuery);
+  return path51 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
 }
 function stripWrappingQuotes(value) {
   let current = value;
@@ -1706,9 +1706,9 @@ function stripWrappingQuotes(value) {
   }
 }
 function parseDocumentPath(value) {
-  const path50 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
-  if (!path50?.includes("/content/entries/")) return null;
-  const parts = path50.split("/").filter(Boolean).map(decodePathPart);
+  const path51 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
+  if (!path51?.includes("/content/entries/")) return null;
+  const parts = path51.split("/").filter(Boolean).map(decodePathPart);
   const entriesIndex = parts.findIndex((part, index) => part === "content" && parts[index + 1] === "entries");
   const idPart = parts[entriesIndex + 3];
   if (!idPart || idPart === "new") return null;
@@ -2041,6 +2041,23 @@ function getCompanyStoreAssetRoot(kind) {
   if (fs5.existsSync(rootLayoutPath)) return rootLayoutPath;
   return path7.join(root, ".kody", folderByKind[kind]);
 }
+function resetCompanyStoreCacheForTests() {
+  memo = null;
+}
+function applyCompanyStoreRuntimeConfig(input, env = process.env) {
+  const repo = stringValue(input?.storeRepoUrl ?? input?.storeRepo);
+  const ref = stringValue(input?.storeRef);
+  let changed = false;
+  if (repo && env[STORE_ENV] !== repo) {
+    env[STORE_ENV] = repo;
+    changed = true;
+  }
+  if (ref && env[REF_ENV] !== ref) {
+    env[REF_ENV] = ref;
+    changed = true;
+  }
+  if (changed) resetCompanyStoreCacheForTests();
+}
 function resolveCompanyStore() {
   const envStore = process.env[STORE_ENV]?.trim();
   if (!envStore && process.env.VITEST) return null;
@@ -2050,6 +2067,9 @@ function resolveCompanyStore() {
   if (!ref) return null;
   return { repo, ref };
 }
+function stringValue(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
 function fetchCompanyStore(repo, ref) {
   const localRoot = localStoreRoot(repo);
   if (localRoot) return localRoot;
@@ -6897,10 +6917,10 @@ var init_state2 = __esm({
     "use strict";
     VALID_STATES = /* @__PURE__ */ new Set(["active", "abandoned", "closed", "done"]);
     GoalStateError = class extends Error {
-      constructor(path50, message) {
-        super(`Invalid goal state at ${path50}:
+      constructor(path51, message) {
+        super(`Invalid goal state at ${path51}:
   ${message}`);
-        this.path = path50;
+        this.path = path51;
         this.name = "GoalStateError";
       }
       path;
@@ -6913,9 +6933,9 @@ import * as fs25 from "fs";
 function stageGoalRunLogEvent(data, goalId, event, at = nowIso()) {
   const logs = goalRunLogs(data);
   const existing = logs[goalId];
-  const path50 = existing?.path ?? goalRunLogPath(goalId, data);
+  const path51 = existing?.path ?? goalRunLogPath(goalId, data);
   logs[goalId] = {
-    path: path50,
+    path: path51,
     events: [...existing?.events ?? [], buildGoalRunLogEvent(data, goalId, event, at)]
   };
 }
@@ -7002,7 +7022,7 @@ function goalRunStartedAt(data) {
 function goalRunId(data) {
   const existing = data[LOG_RUN_KEY];
   if (typeof existing === "string" && existing.length > 0) return existing;
-  const raw = stringValue(data.jobId) ?? githubRunId() ?? `local-${process.pid}-${Date.now()}`;
+  const raw = stringValue2(data.jobId) ?? githubRunId() ?? `local-${process.pid}-${Date.now()}`;
   const safe = safePathSegment(raw);
   data[LOG_RUN_KEY] = safe;
   return safe;
@@ -7101,7 +7121,7 @@ function triggerContext() {
     issue: numberValue(recordValue2(event?.issue)?.number),
     pullRequest: numberValue(recordValue2(event?.pull_request)?.number),
     comment: numberValue(recordValue2(event?.comment)?.id),
-    schedule: stringValue(event?.schedule),
+    schedule: stringValue2(event?.schedule),
     inputs: inputs ? pickRecord(inputs, ["issue_number", "sessionId", "message", "model", "title", "executable", "base"]) : void 0
   });
   return Object.keys(trigger).length > 0 ? trigger : void 0;
@@ -7120,16 +7140,16 @@ function triggerActorRole(eventName) {
 }
 function jobContext(data) {
   const job = pruneUndefined({
-    id: stringValue(data.jobId) ?? void 0,
-    key: stringValue(data.jobKey) ?? void 0,
-    flavor: stringValue(data.jobFlavor) ?? void 0,
-    action: stringValue(data.jobAction) ?? void 0,
-    capability: stringValue(data.jobCapability) ?? void 0,
-    executable: stringValue(data.jobExecutable) ?? void 0,
-    agent: stringValue(data.jobAgent) ?? void 0,
-    schedule: stringValue(data.jobSchedule) ?? void 0,
+    id: stringValue2(data.jobId) ?? void 0,
+    key: stringValue2(data.jobKey) ?? void 0,
+    flavor: stringValue2(data.jobFlavor) ?? void 0,
+    action: stringValue2(data.jobAction) ?? void 0,
+    capability: stringValue2(data.jobCapability) ?? void 0,
+    executable: stringValue2(data.jobExecutable) ?? void 0,
+    agent: stringValue2(data.jobAgent) ?? void 0,
+    schedule: stringValue2(data.jobSchedule) ?? void 0,
     target: data.jobTarget ?? void 0,
-    why: truncateString(stringValue(data.jobWhy), 1e3),
+    why: truncateString(stringValue2(data.jobWhy), 1e3),
     saveReport: data.jobSaveReport === true ? true : void 0
   });
   return Object.keys(job).length > 0 ? job : void 0;
@@ -7139,21 +7159,21 @@ function dispatchContext(event, trigger, job) {
   const dispatch2 = event.dispatch ?? {};
   const context = pruneUndefined({
     triggeredBy: triggerLabel(trigger),
-    triggerKind: stringValue(trigger?.kind),
+    triggerKind: stringValue2(trigger?.kind),
     dispatchMode: dispatchMode(trigger),
-    githubActor: stringValue(trigger?.githubActor) ?? stringValue(trigger?.actor),
-    githubActorRole: stringValue(trigger?.actorRole),
+    githubActor: stringValue2(trigger?.githubActor) ?? stringValue2(trigger?.actor),
+    githubActorRole: stringValue2(trigger?.actorRole),
     decidedBy: event.source,
     dispatchedBy: event.source,
     target: event.target,
-    action: dispatch2.action ?? stringValue(job?.action),
-    capability: dispatch2.capability ?? stringValue(job?.capability),
+    action: dispatch2.action ?? stringValue2(job?.action),
+    capability: dispatch2.capability ?? stringValue2(job?.capability),
     reason: event.reason
   });
   return Object.keys(context).length > 0 ? context : void 0;
 }
 function triggerLabel(trigger) {
-  const kind = stringValue(trigger?.kind);
+  const kind = stringValue2(trigger?.kind);
   if (kind === "schedule") return "GitHub schedule";
   if (kind === "manual-workflow-dispatch") return "manual workflow dispatch";
   if (kind === "issue_comment") return "GitHub issue comment";
@@ -7162,7 +7182,7 @@ function triggerLabel(trigger) {
   return "local run";
 }
 function dispatchMode(trigger) {
-  const kind = stringValue(trigger?.kind);
+  const kind = stringValue2(trigger?.kind);
   if (kind === "schedule") return "automated";
   if (kind === "manual-workflow-dispatch") return "manual";
   if (kind) return "event-driven";
@@ -7174,10 +7194,10 @@ function linkContext(stateRepo) {
   const repository = process.env.GITHUB_REPOSITORY?.trim();
   const server = process.env.GITHUB_SERVER_URL?.trim() || "https://github.com";
   if (runId && repository) links.workflowRun = `${server}/${repository}/actions/runs/${runId}`;
-  const repo = stringValue(stateRepo?.repo);
-  const branch = stringValue(stateRepo?.branch);
-  const goalStatePath2 = stringValue(stateRepo?.goalStatePath);
-  const logPath = stringValue(stateRepo?.logPath);
+  const repo = stringValue2(stateRepo?.repo);
+  const branch = stringValue2(stateRepo?.branch);
+  const goalStatePath2 = stringValue2(stateRepo?.goalStatePath);
+  const logPath = stringValue2(stateRepo?.logPath);
   if (repo && branch && goalStatePath2) links.goalState = githubBlobUrl(repo, branch, goalStatePath2);
   if (repo && branch && logPath) links.log = githubBlobUrl(repo, branch, logPath);
   return Object.keys(links).length > 0 ? links : void 0;
@@ -7257,7 +7277,7 @@ function truncateString(value, max) {
   if (!value) return void 0;
   return value.length > max ? `${value.slice(0, max)}...` : value;
 }
-function stringValue(value) {
+function stringValue2(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
 }
 function safePathSegment(value) {
@@ -7430,6 +7450,8 @@ var init_managedTodoState = __esm({
 });
 
 // src/goal/stateStore.ts
+import * as fs26 from "fs";
+import * as path24 from "path";
 function goalStatePath(goalId) {
   return `todos/${goalId}.json`;
 }
@@ -7438,7 +7460,55 @@ function fetchGoalState(config, goalId, cwd) {
   const loaded = readStateText(config, cwd, filePath);
   if (!loaded) return null;
   if (!isManagedTodoRaw(loaded.content)) return null;
-  return parseTodoGoalState(goalId, loaded.path, loaded.content);
+  return resolveStoreBackedGoalState(parseTodoGoalState(goalId, loaded.path, loaded.content));
+}
+function resolveStoreBackedGoalState(state) {
+  const templateId = templateIdFromGoalState(state);
+  if (!templateId) return state;
+  const template = readStoreGoalTemplate(templateId);
+  if (!template) return state;
+  const nextExtra = { ...state.extra };
+  for (const key of [
+    "type",
+    "destination",
+    "capabilities",
+    "route",
+    "schedule",
+    "scheduleMode",
+    "loopTarget",
+    "preferredRunTime",
+    "saveReport"
+  ]) {
+    if (Object.hasOwn(template, key)) nextExtra[key] = template[key];
+    else if (["schedule", "loopTarget", "preferredRunTime", "saveReport"].includes(key)) delete nextExtra[key];
+  }
+  nextExtra.facts = {
+    ...recordField2(template.facts) ?? {},
+    ...recordField2(state.extra.facts) ?? {}
+  };
+  return { ...state, extra: nextExtra };
+}
+function templateIdFromGoalState(state) {
+  for (const key of ["sourceTemplate", "templateId", "template"]) {
+    const value = state.extra[key];
+    if (typeof value === "string" && value.trim()) return value.trim();
+  }
+  return "";
+}
+function readStoreGoalTemplate(templateId) {
+  const root = getCompanyStoreAssetRoot("goals");
+  if (!root) return null;
+  const file = path24.join(root, "templates", templateId, "state.json");
+  if (!fs26.existsSync(file)) return null;
+  try {
+    const parsed = JSON.parse(fs26.readFileSync(file, "utf8"));
+    return recordField2(parsed);
+  } catch {
+    return null;
+  }
+}
+function recordField2(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function putGoalState(config, goalId, state, message = `chore(goals): update ${goalId}`, cwd) {
   const previous = readStateText(config, cwd, goalStatePath(goalId));
@@ -7463,12 +7533,13 @@ var init_stateStore = __esm({
     "use strict";
     init_stateRepo();
     init_managedTodoState();
+    init_companyStore();
   }
 });
 
 // src/goal/targetLoopResolution.ts
-import * as fs26 from "fs";
-import * as path24 from "path";
+import * as fs27 from "fs";
+import * as path25 from "path";
 function resolveActiveGoalLoopTarget(config, cwd, loopGoalId, loopGoal) {
   const targetId = loopGoal.loopTarget?.id.trim() ?? "";
   assertSafeGoalId(targetId, "loop target");
@@ -7554,16 +7625,16 @@ function goalInstanceTime(state) {
   return Number.isNaN(parsed) ? 0 : parsed;
 }
 function loadGoalTemplate(cwd, targetId) {
-  const local = path24.join(cwd, ".kody", "goals", "templates", targetId, "state.json");
+  const local = path25.join(cwd, ".kody", "goals", "templates", targetId, "state.json");
   const localTemplate = readJsonObject(local);
   if (localTemplate) return localTemplate;
   const storeGoalRoot = getCompanyStoreAssetRoot("goals");
   if (!storeGoalRoot) return null;
-  return readJsonObject(path24.join(storeGoalRoot, "templates", targetId, "state.json"));
+  return readJsonObject(path25.join(storeGoalRoot, "templates", targetId, "state.json"));
 }
 function readJsonObject(filePath) {
-  if (!fs26.existsSync(filePath)) return null;
-  const parsed = JSON.parse(fs26.readFileSync(filePath, "utf8"));
+  if (!fs27.existsSync(filePath)) return null;
+  const parsed = JSON.parse(fs27.readFileSync(filePath, "utf8"));
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error(`goal template ${filePath} must be a JSON object`);
   }
@@ -7959,8 +8030,8 @@ var init_contentsApiBackend = __esm({
 });
 
 // src/scripts/jobState/localFileBackend.ts
-import * as fs27 from "fs";
-import * as path25 from "path";
+import * as fs28 from "fs";
+import * as path26 from "path";
 function sanitizeKey(s) {
   return s.replace(/[^A-Za-z0-9._-]/g, "-");
 }
@@ -8016,7 +8087,7 @@ var init_localFileBackend = __esm({
         if (!opts.owner || !opts.repo) throw new Error("LocalFileBackend: owner and repo are required");
         this.cwd = opts.cwd;
         this.jobsDir = opts.jobsDir;
-        this.absDir = path25.join(opts.cwd, opts.jobsDir);
+        this.absDir = path26.join(opts.cwd, opts.jobsDir);
         this.owner = opts.owner;
         this.repo = opts.repo;
         this.cache = opts.cache ?? defaultCacheAdapter();
@@ -8031,7 +8102,7 @@ var init_localFileBackend = __esm({
 `);
           return;
         }
-        fs27.mkdirSync(this.absDir, { recursive: true });
+        fs28.mkdirSync(this.absDir, { recursive: true });
         const prefix = this.cacheKeyPrefix();
         const probeKey = `${prefix}probe-${Date.now()}`;
         try {
@@ -8060,7 +8131,7 @@ var init_localFileBackend = __esm({
 `);
           return;
         }
-        if (!fs27.existsSync(this.absDir)) {
+        if (!fs28.existsSync(this.absDir)) {
           return;
         }
         const key = `${this.cacheKeyPrefix()}${process.env.GITHUB_RUN_ID ?? "norunid"}-${Date.now()}`;
@@ -8076,11 +8147,11 @@ var init_localFileBackend = __esm({
       }
       load(slug2) {
         const relPath = stateFilePath(this.jobsDir, slug2);
-        const absPath = path25.join(this.cwd, relPath);
-        if (!fs27.existsSync(absPath)) {
+        const absPath = path26.join(this.cwd, relPath);
+        if (!fs28.existsSync(absPath)) {
           return { path: relPath, handle: null, state: initialStateEnvelope("seed"), created: true };
         }
-        const raw = fs27.readFileSync(absPath, "utf-8");
+        const raw = fs28.readFileSync(absPath, "utf-8");
         let parsed;
         try {
           parsed = JSON.parse(raw);
@@ -8097,13 +8168,13 @@ var init_localFileBackend = __esm({
         if (!loaded.created && isStateUnchanged(loaded.state, next)) {
           return false;
         }
-        const absPath = path25.join(this.cwd, loaded.path);
-        fs27.mkdirSync(path25.dirname(absPath), { recursive: true });
+        const absPath = path26.join(this.cwd, loaded.path);
+        fs28.mkdirSync(path26.dirname(absPath), { recursive: true });
         const body = `${JSON.stringify(next, null, 2)}
 `;
         const tmpPath = `${absPath}.${process.pid}.tmp`;
-        fs27.writeFileSync(tmpPath, body, "utf-8");
-        fs27.renameSync(tmpPath, absPath);
+        fs28.writeFileSync(tmpPath, body, "utf-8");
+        fs28.renameSync(tmpPath, absPath);
         return true;
       }
       cacheKeyPrefix() {
@@ -8143,7 +8214,7 @@ var init_jobState = __esm({
 });
 
 // src/scripts/goalCapabilityScheduling.ts
-import * as path26 from "path";
+import * as path27 from "path";
 function isCapabilityCadenceGoal(goal, extra) {
   return extra.scheduleMode === "agentLoop" || extra.scheduler === "agentLoop" || goal.type === "standing" && goal.capabilities.length > 0;
 }
@@ -8199,7 +8270,7 @@ function planTargetLoopSchedule(opts) {
 }
 async function planGoalCapabilitySchedule(opts) {
   const jobsDir = opts.jobsDir ?? ".kody/capabilities";
-  const jobsRoot = path26.join(opts.cwd, jobsDir);
+  const jobsRoot = path27.join(opts.cwd, jobsDir);
   const now = opts.now ?? /* @__PURE__ */ new Date();
   const at = now.toISOString();
   const backend = resolveBackend({ config: opts.config, cwd: opts.cwd, jobsDir });
@@ -8828,12 +8899,12 @@ var init_appendCompanyActivity = __esm({
   }
 });
 
-// src/companyManagerDecision.ts
-function parseCompanyManagerDecisionText(finalText) {
+// src/agencyArchitectDecision.ts
+function parseAgencyArchitectDecisionText(finalText) {
   const raw = extractDecisionJson(finalText);
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("company-manager decision must be JSON object");
+    throw new Error("agency-architect decision must be JSON object");
   }
   const input = parsed;
   const actions = Array.isArray(input.actions) ? input.actions.map(parseAction) : [];
@@ -8881,15 +8952,15 @@ function buildAgentLoopState(action) {
   };
 }
 function extractDecisionJson(finalText) {
-  const fence = finalText.match(/```(?:kody-company-manager-decision|json)\s*([\s\S]*?)```/i);
+  const fence = finalText.match(/```(?:kody-agency-architect-decision|json)\s*([\s\S]*?)```/i);
   if (fence?.[1]) return fence[1].trim();
-  const line = finalText.match(/KODY_COMPANY_MANAGER_DECISION=(\{[\s\S]*\})/);
+  const line = finalText.match(/KODY_AGENCY_ARCHITECT_DECISION=(\{[\s\S]*\})/);
   if (line?.[1]) return line[1].trim();
-  throw new Error("missing kody-company-manager-decision JSON");
+  throw new Error("missing kody-agency-architect-decision JSON");
 }
 function parseAction(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("company-manager action must be object");
+    throw new Error("agency-architect action must be object");
   }
   const input = value;
   const kind = input.kind;
@@ -8898,7 +8969,7 @@ function parseAction(value) {
   if (kind === "setGoalLifecycle") return parseSetGoalLifecycle(input);
   if (kind === "updateIntentPortfolio") return parseUpdateIntentPortfolio(input);
   if (kind === "note") return parseNote(input);
-  throw new Error(`unsupported company-manager action kind: ${String(kind)}`);
+  throw new Error(`unsupported agency-architect action kind: ${String(kind)}`);
 }
 function parseCreateManagedGoal(input) {
   const route = Array.isArray(input.route) ? input.route.map(parseRouteStep) : [];
@@ -8994,8 +9065,8 @@ function oneOf(value, allowed, fallback) {
   return typeof value === "string" && allowed.includes(value) ? value : fallback;
 }
 var SLUG_RE;
-var init_companyManagerDecision = __esm({
-  "src/companyManagerDecision.ts"() {
+var init_agencyArchitectDecision = __esm({
+  "src/agencyArchitectDecision.ts"() {
     "use strict";
     init_state2();
     SLUG_RE = /^[a-z][a-z0-9-]{0,63}$/;
@@ -9010,20 +9081,22 @@ function companyIntentPath(id) {
   assertIntentId(id);
   return `intents/${id}/intent.json`;
 }
-function normalizeCompanyIntent(path50, raw) {
+function normalizeCompanyIntent(path51, raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    throw new Error(`${path50}: intent must be JSON object`);
+    throw new Error(`${path51}: intent must be JSON object`);
   }
   const input = raw;
   const id = stringField3(input.id);
-  if (!id || !isCompanyIntentId(id)) throw new Error(`${path50}: invalid intent id`);
+  if (!id || !isCompanyIntentId(id)) throw new Error(`${path51}: invalid intent id`);
   const createdAt = stringField3(input.createdAt) || nowIso();
   const updatedAt = stringField3(input.updatedAt) || createdAt;
+  const description = stringField3(input.description);
   return {
     version: 1,
     id,
     status: oneOf2(input.status, ["active", "paused", "archived"], "active"),
     for: stringField3(input.for),
+    ...description ? { description } : {},
     priority: numberField(input.priority, 100),
     posture: oneOf2(
       input.posture,
@@ -9031,21 +9104,21 @@ function normalizeCompanyIntent(path50, raw) {
       "balanced"
     ),
     scope: {
-      repos: stringArray4(recordField2(input.scope)?.repos),
-      areas: stringArray4(recordField2(input.scope)?.areas)
+      repos: stringArray4(recordField3(input.scope)?.repos),
+      areas: stringArray4(recordField3(input.scope)?.areas)
     },
     principles: stringArray4(input.principles),
     metrics: stringArray4(input.metrics),
     policy: {
-      release: normalizeReleasePolicy(recordField2(recordField2(input.policy)?.release)),
-      automation: normalizeAutomationPolicy(recordField2(recordField2(input.policy)?.automation))
+      release: normalizeReleasePolicy(recordField3(recordField3(input.policy)?.release)),
+      automation: normalizeAutomationPolicy(recordField3(recordField3(input.policy)?.automation))
     },
     portfolio: {
-      goals: stringArray4(recordField2(input.portfolio)?.goals).filter(isCompanyIntentId),
-      loops: stringArray4(recordField2(input.portfolio)?.loops).filter(isCompanyIntentId),
-      capabilities: stringArray4(recordField2(input.portfolio)?.capabilities).filter(isCompanyIntentId)
+      goals: stringArray4(recordField3(input.portfolio)?.goals).filter(isCompanyIntentId),
+      loops: stringArray4(recordField3(input.portfolio)?.loops).filter(isCompanyIntentId),
+      capabilities: stringArray4(recordField3(input.portfolio)?.capabilities).filter(isCompanyIntentId)
     },
-    manager: normalizeManager(recordField2(input.manager)),
+    manager: normalizeManager(recordField3(input.manager)),
     createdAt,
     updatedAt
   };
@@ -9055,8 +9128,8 @@ function listCompanyIntents(config, cwd) {
   const records = [];
   for (const entry of entries) {
     if (entry.type !== "dir" || !entry.name || !isCompanyIntentId(entry.name)) continue;
-    const path50 = companyIntentPath(entry.name);
-    const file = readStateText(config, cwd, path50);
+    const path51 = companyIntentPath(entry.name);
+    const file = readStateText(config, cwd, path51);
     if (!file) continue;
     records.push({
       id: entry.name,
@@ -9067,8 +9140,8 @@ function listCompanyIntents(config, cwd) {
   return records.sort((a, b) => a.intent.priority - b.intent.priority || a.id.localeCompare(b.id));
 }
 function readCompanyIntent(config, cwd, id) {
-  const path50 = companyIntentPath(id);
-  const file = readStateText(config, cwd, path50);
+  const path51 = companyIntentPath(id);
+  const file = readStateText(config, cwd, path51);
   if (!file) return null;
   return { id, path: file.path, intent: normalizeCompanyIntent(file.path, JSON.parse(file.content)) };
 }
@@ -9086,7 +9159,7 @@ function listCompanyPortfolio(config, cwd) {
     if (!isCompanyIntentId(id)) continue;
     const state = fetchGoalState(config, id, cwd);
     if (!state) continue;
-    const destination = recordField2(state.extra.destination);
+    const destination = recordField3(state.extra.destination);
     goals.push({
       id,
       state: state.state,
@@ -9112,7 +9185,7 @@ function stringField3(value) {
 function numberField(value, fallback) {
   return typeof value === "number" && Number.isFinite(value) ? value : fallback;
 }
-function recordField2(value) {
+function recordField3(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function stringArray4(value) {
@@ -9142,8 +9215,8 @@ function normalizeAutomationPolicy(raw) {
 function normalizeManager(raw) {
   return {
     agent: "cto",
-    loop: "company-manager-loop",
-    capability: "company-manager",
+    loop: "agency-architect-loop",
+    capability: "agency-architect",
     reviewEvery: oneOf2(raw?.reviewEvery, ["1d", "1w"], "1d"),
     ...typeof raw?.lastReviewedAt === "string" ? { lastReviewedAt: raw.lastReviewedAt } : {}
   };
@@ -9159,7 +9232,7 @@ var init_companyIntent = __esm({
   }
 });
 
-// src/scripts/applyCompanyManagerDecision.ts
+// src/scripts/applyAgencyArchitectDecision.ts
 function applyAction(config, cwd, action) {
   if (action.kind === "createManagedGoal") {
     const existing = fetchGoalState(config, action.id, cwd);
@@ -9228,7 +9301,7 @@ function applied(action, changed, reason, resource) {
 function mergeUnique(left, right) {
   return [.../* @__PURE__ */ new Set([...left, ...right])].sort();
 }
-function logAppliedCompanyManagerActions(config, cwd, appliedActions) {
+function logAppliedAgencyArchitectActions(config, cwd, appliedActions) {
   const at = nowIso();
   for (const action of appliedActions) {
     if (!action.intentId) continue;
@@ -9243,24 +9316,24 @@ function logAppliedCompanyManagerActions(config, cwd, appliedActions) {
     });
   }
 }
-var applyCompanyManagerDecision;
-var init_applyCompanyManagerDecision = __esm({
-  "src/scripts/applyCompanyManagerDecision.ts"() {
+var applyAgencyArchitectDecision;
+var init_applyAgencyArchitectDecision = __esm({
+  "src/scripts/applyAgencyArchitectDecision.ts"() {
     "use strict";
-    init_companyManagerDecision();
+    init_agencyArchitectDecision();
     init_companyIntent();
     init_stateStore();
     init_state2();
-    applyCompanyManagerDecision = async (ctx) => {
-      const decision = ctx.data.companyManagerDecision;
+    applyAgencyArchitectDecision = async (ctx) => {
+      const decision = ctx.data.agencyArchitectDecision;
       if (!decision || !Array.isArray(decision.actions)) return;
       if (ctx.output.exitCode !== 0) return;
       const applied2 = [];
       for (const action of decision.actions) {
         applied2.push(applyAction(ctx.config, ctx.cwd, action));
       }
-      ctx.data.companyManagerApplied = applied2;
-      ctx.data.companyManagerApplySummary = `company-manager applied ${applied2.filter((item) => item.changed).length}/${applied2.length} action(s)`;
+      ctx.data.agencyArchitectApplied = applied2;
+      ctx.data.agencyArchitectApplySummary = `agency-architect applied ${applied2.filter((item) => item.changed).length}/${applied2.length} action(s)`;
     };
   }
 });
@@ -9270,15 +9343,15 @@ var appendCompanyIntentDecision2;
 var init_appendCompanyIntentDecision = __esm({
   "src/scripts/appendCompanyIntentDecision.ts"() {
     "use strict";
-    init_applyCompanyManagerDecision();
+    init_applyAgencyArchitectDecision();
     appendCompanyIntentDecision2 = async (ctx) => {
-      const applied2 = ctx.data.companyManagerApplied;
+      const applied2 = ctx.data.agencyArchitectApplied;
       if (!applied2 || applied2.length === 0) return;
       try {
-        logAppliedCompanyManagerActions(ctx.config, ctx.cwd, applied2);
+        logAppliedAgencyArchitectActions(ctx.config, ctx.cwd, applied2);
       } catch (err) {
         process.stderr.write(
-          `[company-manager] failed append intent decision log: ${err instanceof Error ? err.message : String(err)}
+          `[agency-architect] failed append intent decision log: ${err instanceof Error ? err.message : String(err)}
 `
         );
       }
@@ -9500,7 +9573,7 @@ function capabilityEvidenceOutput(evidence) {
 function goalReportBody(goalId, state, snapshot, latestEvent, evidenceItems) {
   const outputs = evidenceItems.map(capabilityEvidenceOutput);
   const latestOutput = outputs.at(-1);
-  const facts = recordField3(snapshot, "facts") ?? recordField3(state.extra, "facts") ?? {};
+  const facts = recordField4(snapshot, "facts") ?? recordField4(state.extra, "facts") ?? {};
   const blockers = uniqueStrings2([
     ...stringArrayField(snapshot, "blockers"),
     ...stringArrayField(latestEvent, "blockers"),
@@ -9552,7 +9625,7 @@ function capabilityEvidenceMarkdown(outputs) {
 function decisionReason(state, latestEvent, latestOutput, missingEvidence, blockers) {
   if (state.state === "done") return "destination evidence satisfied";
   if (blockers.length > 0) return blockers[0] ?? "blocked";
-  const eventReason = stringField4(latestEvent, "reason") ?? stringField4(recordField3(latestEvent, "decision"), "reason");
+  const eventReason = stringField4(latestEvent, "reason") ?? stringField4(recordField4(latestEvent, "decision"), "reason");
   if (eventReason) return eventReason;
   const summary = stringField4(latestOutput, "summary");
   if (summary) return summary;
@@ -9565,18 +9638,18 @@ function evidenceOutputMarkdown(index, output) {
     `- Status: ${stringField4(output, "status") ?? "unknown"}`,
     `- Summary: ${stringField4(output, "summary") ?? "no summary"}`,
     `- Sources: ${listOrNone(stringArrayField(output, "sources"))}`,
-    `- Evidence values: ${inlineJson(recordField3(output, "evidence") ?? {})}`,
+    `- Evidence values: ${inlineJson(recordField4(output, "evidence") ?? {})}`,
     `- Missing evidence: ${listOrNone(stringArrayField(output, "missingEvidence"))}`,
     `- Blockers: ${listOrNone(stringArrayField(output, "blockers"))}`,
     ""
   ];
 }
 function dispatchContextMarkdown(latestEvent) {
-  const context = recordField3(latestEvent, "dispatchContext");
+  const context = recordField4(latestEvent, "dispatchContext");
   if (!context) return ["- none"];
   const githubActor = stringField4(context, "githubActor");
   const githubActorRole = stringField4(context, "githubActorRole");
-  const target = dispatchTargetLabel(recordField3(context, "target"));
+  const target = dispatchTargetLabel(recordField4(context, "target"));
   return [
     `- Triggered by: ${stringField4(context, "triggeredBy") ?? "unknown"}`,
     `- Mode: ${stringField4(context, "dispatchMode") ?? "unknown"}`,
@@ -9615,7 +9688,7 @@ function stringField4(record2, key) {
   const value = record2?.[key];
   return typeof value === "string" && value.trim() ? value : void 0;
 }
-function recordField3(record2, key) {
+function recordField4(record2, key) {
   const value = record2?.[key];
   return value && typeof value === "object" && !Array.isArray(value) ? { ...value } : void 0;
 }
@@ -9648,7 +9721,7 @@ ${artifact.path ?? ""}`;
 }
 function nextStepFromEvent(state, goalAfter, capabilityOutput, latestEvent) {
   if (state.state === "done") return "done";
-  const decisionKind = stringField4(recordField3(latestEvent, "decision"), "kind") ?? stringField4(latestEvent, "status");
+  const decisionKind = stringField4(recordField4(latestEvent, "decision"), "kind") ?? stringField4(latestEvent, "status");
   if (decisionKind === "done") return "done";
   if (decisionKind === "dispatch") return "dispatch";
   if (decisionKind === "blocked" || decisionKind === "reject-evidence") return "block";
@@ -10111,8 +10184,8 @@ var init_classifyByLabel = __esm({
 });
 
 // src/scripts/commitAndPush.ts
-import * as fs28 from "fs";
-import * as path27 from "path";
+import * as fs29 from "fs";
+import * as path28 from "path";
 function sentinelPathForStage(cwd, profileName) {
   const runId = resolveRunId();
   return runtimeStatePath(cwd, "agent-runs", runId, `commit-${profileName}.lock`);
@@ -10133,9 +10206,9 @@ var init_commitAndPush = __esm({
       }
       const idempotencyEnabled = process.env.KODY_COMMIT_IDEMPOTENCY !== "0";
       const sentinel = idempotencyEnabled ? sentinelPathForStage(ctx.cwd, profile.name) : null;
-      if (sentinel && fs28.existsSync(sentinel)) {
+      if (sentinel && fs29.existsSync(sentinel)) {
         try {
-          const replay = JSON.parse(fs28.readFileSync(sentinel, "utf-8"));
+          const replay = JSON.parse(fs29.readFileSync(sentinel, "utf-8"));
           ctx.data.commitResult = replay.commitResult ?? { committed: false, pushed: false };
           if (Array.isArray(replay.changedFiles)) ctx.data.changedFiles = replay.changedFiles;
           if (typeof replay.hasCommitsAhead === "boolean") ctx.data.hasCommitsAhead = replay.hasCommitsAhead;
@@ -10188,8 +10261,8 @@ var init_commitAndPush = __esm({
       const result = ctx.data.commitResult;
       if (sentinel && result?.committed) {
         try {
-          fs28.mkdirSync(path27.dirname(sentinel), { recursive: true });
-          fs28.writeFileSync(
+          fs29.mkdirSync(path28.dirname(sentinel), { recursive: true });
+          fs29.writeFileSync(
             sentinel,
             JSON.stringify(
               {
@@ -10280,8 +10353,8 @@ var init_commitGoalState = __esm({
 });
 
 // src/scripts/composePrompt.ts
-import * as fs29 from "fs";
-import * as path28 from "path";
+import * as fs30 from "fs";
+import * as path29 from "path";
 function fenceUntrusted(value) {
   if (value.trim().length === 0) return value;
   const safe = value.replace(/-{3,}\s*END UNTRUSTED INPUT\s*-{3,}/gi, "[END UNTRUSTED INPUT]");
@@ -10404,10 +10477,10 @@ var init_composePrompt = __esm({
       const explicit = ctx.data.promptTemplate;
       const mode = ctx.args.mode;
       const candidates = [
-        explicit ? path28.join(profile.dir, explicit) : null,
-        mode ? path28.join(profile.dir, "prompts", `${mode}.md`) : null,
-        path28.join(profile.dir, "prompt.md"),
-        path28.join(profile.dir, "capability.md")
+        explicit ? path29.join(profile.dir, explicit) : null,
+        mode ? path29.join(profile.dir, "prompts", `${mode}.md`) : null,
+        path29.join(profile.dir, "prompt.md"),
+        path29.join(profile.dir, "capability.md")
       ].filter(Boolean);
       let templatePath = "";
       let template = "";
@@ -10420,7 +10493,7 @@ var init_composePrompt = __esm({
           break;
         }
         try {
-          template = fs29.readFileSync(c, "utf-8");
+          template = fs30.readFileSync(c, "utf-8");
           templatePath = c;
           break;
         } catch (err) {
@@ -10431,7 +10504,7 @@ var init_composePrompt = __esm({
       if (!templatePath) {
         let dirState;
         try {
-          dirState = `dir contents: [${fs29.readdirSync(profile.dir).join(", ")}]`;
+          dirState = `dir contents: [${fs30.readdirSync(profile.dir).join(", ")}]`;
         } catch (err) {
           dirState = `readdir(${profile.dir}) failed: ${err?.code ?? String(err)}`;
         }
@@ -11116,19 +11189,19 @@ var init_deriveQaScopeFromIssue = __esm({
 
 // src/scripts/diagMcp.ts
 import { execFileSync as execFileSync10 } from "child_process";
-import * as fs30 from "fs";
+import * as fs31 from "fs";
 import * as os6 from "os";
-import * as path29 from "path";
+import * as path30 from "path";
 var diagMcp;
 var init_diagMcp = __esm({
   "src/scripts/diagMcp.ts"() {
     "use strict";
     diagMcp = async (_ctx) => {
       const home = os6.homedir();
-      const cacheDir = path29.join(home, ".cache", "ms-playwright");
+      const cacheDir = path30.join(home, ".cache", "ms-playwright");
       let entries = [];
       try {
-        entries = fs30.readdirSync(cacheDir);
+        entries = fs31.readdirSync(cacheDir);
       } catch {
       }
       const hasChromium = entries.some((e) => e.startsWith("chromium"));
@@ -11156,13 +11229,13 @@ var init_diagMcp = __esm({
 });
 
 // src/scripts/frameworkDetectors.ts
-import * as fs31 from "fs";
-import * as path30 from "path";
+import * as fs32 from "fs";
+import * as path31 from "path";
 function detectFrameworks(cwd) {
   const out = [];
   let deps = {};
   try {
-    const pkg = JSON.parse(fs31.readFileSync(path30.join(cwd, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs32.readFileSync(path31.join(cwd, "package.json"), "utf-8"));
     deps = { ...pkg.dependencies, ...pkg.devDependencies };
   } catch {
     return out;
@@ -11199,25 +11272,25 @@ function detectFrameworks(cwd) {
 }
 function findFile(cwd, candidates) {
   for (const c of candidates) {
-    if (fs31.existsSync(path30.join(cwd, c))) return c;
+    if (fs32.existsSync(path31.join(cwd, c))) return c;
   }
   return null;
 }
 function discoverPayloadCollections(cwd) {
   const out = [];
   for (const dir of COLLECTION_DIRS) {
-    const full = path30.join(cwd, dir);
-    if (!fs31.existsSync(full)) continue;
+    const full = path31.join(cwd, dir);
+    if (!fs32.existsSync(full)) continue;
     let files;
     try {
-      files = fs31.readdirSync(full).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+      files = fs32.readdirSync(full).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
     } catch {
       continue;
     }
     for (const file of files) {
       try {
-        const filePath = path30.join(full, file);
-        const content = fs31.readFileSync(filePath, "utf-8").slice(0, 1e4);
+        const filePath = path31.join(full, file);
+        const content = fs32.readFileSync(filePath, "utf-8").slice(0, 1e4);
         const slugMatch = content.match(/slug:\s*['"]([a-z0-9-]+)['"]/);
         if (!slugMatch) continue;
         const slug2 = slugMatch[1];
@@ -11231,7 +11304,7 @@ function discoverPayloadCollections(cwd) {
         out.push({
           name,
           slug: slug2,
-          filePath: path30.relative(cwd, filePath),
+          filePath: path31.relative(cwd, filePath),
           fields: fields.slice(0, 20),
           hasAdmin
         });
@@ -11244,28 +11317,28 @@ function discoverPayloadCollections(cwd) {
 function discoverAdminComponents(cwd, collections) {
   const out = [];
   for (const dir of ADMIN_COMPONENT_DIRS) {
-    const full = path30.join(cwd, dir);
-    if (!fs31.existsSync(full)) continue;
+    const full = path31.join(cwd, dir);
+    if (!fs32.existsSync(full)) continue;
     let entries;
     try {
-      entries = fs31.readdirSync(full, { withFileTypes: true });
+      entries = fs32.readdirSync(full, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const entryPath = path30.join(full, entry.name);
+      const entryPath = path31.join(full, entry.name);
       let name;
       let filePath;
       if (entry.isDirectory()) {
         const indexFile = ["index.tsx", "index.ts", "index.jsx", "index.js"].find(
-          (f) => fs31.existsSync(path30.join(entryPath, f))
+          (f) => fs32.existsSync(path31.join(entryPath, f))
         );
         if (!indexFile) continue;
         name = entry.name;
-        filePath = path30.relative(cwd, path30.join(entryPath, indexFile));
+        filePath = path31.relative(cwd, path31.join(entryPath, indexFile));
       } else if (/\.(tsx?|jsx?)$/.test(entry.name)) {
         name = entry.name.replace(/\.(tsx?|jsx?)$/, "");
-        filePath = path30.relative(cwd, entryPath);
+        filePath = path31.relative(cwd, entryPath);
       } else {
         continue;
       }
@@ -11273,7 +11346,7 @@ function discoverAdminComponents(cwd, collections) {
       if (collections) {
         for (const col of collections) {
           try {
-            const colContent = fs31.readFileSync(path30.join(cwd, col.filePath), "utf-8");
+            const colContent = fs32.readFileSync(path31.join(cwd, col.filePath), "utf-8");
             if (colContent.includes(name)) {
               usedInCollection = col.slug;
               break;
@@ -11291,8 +11364,8 @@ function scanApiRoutes(cwd) {
   const out = [];
   const appDirs = ["src/app", "app"];
   for (const appDir of appDirs) {
-    const apiDir = path30.join(cwd, appDir, "api");
-    if (!fs31.existsSync(apiDir)) continue;
+    const apiDir = path31.join(cwd, appDir, "api");
+    if (!fs32.existsSync(apiDir)) continue;
     walkApiRoutes(apiDir, "/api", cwd, out);
     break;
   }
@@ -11301,14 +11374,14 @@ function scanApiRoutes(cwd) {
 function walkApiRoutes(dir, prefix, cwd, out) {
   let entries;
   try {
-    entries = fs31.readdirSync(dir, { withFileTypes: true });
+    entries = fs32.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
   const routeFile = entries.find((e) => e.isFile() && /^route\.(ts|js|tsx|jsx)$/.test(e.name));
   if (routeFile) {
     try {
-      const content = fs31.readFileSync(path30.join(dir, routeFile.name), "utf-8").slice(0, 5e3);
+      const content = fs32.readFileSync(path31.join(dir, routeFile.name), "utf-8").slice(0, 5e3);
       const methods = HTTP_METHODS.filter(
         (m) => new RegExp(`export\\s+(?:async\\s+)?function\\s+${m}\\b`).test(content)
       );
@@ -11316,7 +11389,7 @@ function walkApiRoutes(dir, prefix, cwd, out) {
         out.push({
           path: prefix,
           methods,
-          filePath: path30.relative(cwd, path30.join(dir, routeFile.name))
+          filePath: path31.relative(cwd, path31.join(dir, routeFile.name))
         });
       }
     } catch {
@@ -11327,7 +11400,7 @@ function walkApiRoutes(dir, prefix, cwd, out) {
     if (entry.name === "node_modules" || entry.name === ".next") continue;
     let segment = entry.name;
     if (segment.startsWith("(") && segment.endsWith(")")) {
-      walkApiRoutes(path30.join(dir, entry.name), prefix, cwd, out);
+      walkApiRoutes(path31.join(dir, entry.name), prefix, cwd, out);
       continue;
     }
     if (segment.startsWith("[[") && segment.endsWith("]]")) {
@@ -11335,16 +11408,16 @@ function walkApiRoutes(dir, prefix, cwd, out) {
     } else if (segment.startsWith("[") && segment.endsWith("]")) {
       segment = `:${segment.slice(1, -1)}`;
     }
-    walkApiRoutes(path30.join(dir, entry.name), `${prefix}/${segment}`, cwd, out);
+    walkApiRoutes(path31.join(dir, entry.name), `${prefix}/${segment}`, cwd, out);
   }
 }
 function scanEnvVars(cwd) {
   const candidates = [".env.example", ".env.local.example", ".env.template"];
   for (const envFile of candidates) {
-    const envPath = path30.join(cwd, envFile);
-    if (!fs31.existsSync(envPath)) continue;
+    const envPath = path31.join(cwd, envFile);
+    if (!fs32.existsSync(envPath)) continue;
     try {
-      const content = fs31.readFileSync(envPath, "utf-8");
+      const content = fs32.readFileSync(envPath, "utf-8");
       const vars = [];
       for (const line of content.split("\n")) {
         const trimmed = line.trim();
@@ -11389,8 +11462,8 @@ var init_frameworkDetectors = __esm({
 });
 
 // src/scripts/discoverQaContext.ts
-import * as fs32 from "fs";
-import * as path31 from "path";
+import * as fs33 from "fs";
+import * as path32 from "path";
 function runQaDiscovery(cwd) {
   const out = {
     routes: [],
@@ -11421,9 +11494,9 @@ function runQaDiscovery(cwd) {
 }
 function detectDevServer(cwd, out) {
   try {
-    const pkg = JSON.parse(fs32.readFileSync(path31.join(cwd, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs33.readFileSync(path32.join(cwd, "package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-    const pm = fs32.existsSync(path31.join(cwd, "pnpm-lock.yaml")) ? "pnpm" : fs32.existsSync(path31.join(cwd, "yarn.lock")) ? "yarn" : fs32.existsSync(path31.join(cwd, "bun.lockb")) ? "bun" : "npm";
+    const pm = fs33.existsSync(path32.join(cwd, "pnpm-lock.yaml")) ? "pnpm" : fs33.existsSync(path32.join(cwd, "yarn.lock")) ? "yarn" : fs33.existsSync(path32.join(cwd, "bun.lockb")) ? "bun" : "npm";
     if (pkg.scripts?.dev) out.devCommand = `${pm} dev`;
     if (allDeps.next || allDeps.nuxt) out.devPort = 3e3;
     else if (allDeps.vite) out.devPort = 5173;
@@ -11433,8 +11506,8 @@ function detectDevServer(cwd, out) {
 function scanFrontendRoutes(cwd, out) {
   const appDirs = ["src/app", "app"];
   for (const appDir of appDirs) {
-    const full = path31.join(cwd, appDir);
-    if (!fs32.existsSync(full)) continue;
+    const full = path32.join(cwd, appDir);
+    if (!fs33.existsSync(full)) continue;
     walkFrontendRoutes(full, "", out);
     break;
   }
@@ -11442,7 +11515,7 @@ function scanFrontendRoutes(cwd, out) {
 function walkFrontendRoutes(dir, prefix, out) {
   let entries;
   try {
-    entries = fs32.readdirSync(dir, { withFileTypes: true });
+    entries = fs33.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -11459,7 +11532,7 @@ function walkFrontendRoutes(dir, prefix, out) {
     if (entry.name === "node_modules" || entry.name === ".next") continue;
     let segment = entry.name;
     if (segment.startsWith("(") && segment.endsWith(")")) {
-      walkFrontendRoutes(path31.join(dir, entry.name), prefix, out);
+      walkFrontendRoutes(path32.join(dir, entry.name), prefix, out);
       continue;
     }
     if (segment.startsWith("[[") && segment.endsWith("]]")) {
@@ -11467,7 +11540,7 @@ function walkFrontendRoutes(dir, prefix, out) {
     } else if (segment.startsWith("[") && segment.endsWith("]")) {
       segment = `:${segment.slice(1, -1)}`;
     }
-    walkFrontendRoutes(path31.join(dir, entry.name), `${prefix}/${segment}`, out);
+    walkFrontendRoutes(path32.join(dir, entry.name), `${prefix}/${segment}`, out);
   }
 }
 function detectAuthFiles(cwd, out) {
@@ -11484,23 +11557,23 @@ function detectAuthFiles(cwd, out) {
     "src/app/api/oauth"
   ];
   for (const c of candidates) {
-    if (fs32.existsSync(path31.join(cwd, c))) out.authFiles.push(c);
+    if (fs33.existsSync(path32.join(cwd, c))) out.authFiles.push(c);
   }
 }
 function detectRoles(cwd, out) {
   const rolePaths = ["src/types", "src/lib", "src/utils", "src/constants", "src/access", "src/collections"];
   for (const rp of rolePaths) {
-    const dir = path31.join(cwd, rp);
-    if (!fs32.existsSync(dir)) continue;
+    const dir = path32.join(cwd, rp);
+    if (!fs33.existsSync(dir)) continue;
     let files;
     try {
-      files = fs32.readdirSync(dir).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+      files = fs33.readdirSync(dir).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
     } catch {
       continue;
     }
     for (const f of files) {
       try {
-        const content = fs32.readFileSync(path31.join(dir, f), "utf-8").slice(0, 5e3);
+        const content = fs33.readFileSync(path32.join(dir, f), "utf-8").slice(0, 5e3);
         const roleMatches = content.match(/(?:role|Role|ROLE)\s*[=:]\s*['"](\w+)['"]/g);
         if (roleMatches) {
           for (const m of roleMatches) {
@@ -12740,12 +12813,12 @@ var init_fixFlow = __esm({
 
 // src/scripts/initFlow.ts
 import { execFileSync as execFileSync15 } from "child_process";
-import * as fs33 from "fs";
-import * as path32 from "path";
+import * as fs34 from "fs";
+import * as path33 from "path";
 function detectPackageManager(cwd) {
-  if (fs33.existsSync(path32.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs33.existsSync(path32.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs33.existsSync(path32.join(cwd, "bun.lockb"))) return "bun";
+  if (fs34.existsSync(path33.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs34.existsSync(path33.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs34.existsSync(path33.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function qualityCommandsFor(pm) {
@@ -12817,22 +12890,22 @@ function performInit(cwd, force) {
   const pm = detectPackageManager(cwd);
   const ownerRepo = detectOwnerRepo(cwd);
   const defaultBranch = defaultBranchFromGit(cwd);
-  const configPath = path32.join(cwd, "kody.config.json");
-  if (fs33.existsSync(configPath) && !force) {
+  const configPath = path33.join(cwd, "kody.config.json");
+  if (fs34.existsSync(configPath) && !force) {
     skipped.push("kody.config.json");
   } else {
     const cfg = makeConfig(pm, ownerRepo, defaultBranch);
-    fs33.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
+    fs34.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
 `);
     wrote.push("kody.config.json");
   }
-  const workflowDir = path32.join(cwd, ".github", "workflows");
-  const workflowPath = path32.join(workflowDir, "kody.yml");
-  if (fs33.existsSync(workflowPath) && !force) {
+  const workflowDir = path33.join(cwd, ".github", "workflows");
+  const workflowPath = path33.join(workflowDir, "kody.yml");
+  if (fs34.existsSync(workflowPath) && !force) {
     skipped.push(".github/workflows/kody.yml");
   } else {
-    fs33.mkdirSync(workflowDir, { recursive: true });
-    fs33.writeFileSync(workflowPath, WORKFLOW_TEMPLATE);
+    fs34.mkdirSync(workflowDir, { recursive: true });
+    fs34.writeFileSync(workflowPath, WORKFLOW_TEMPLATE);
     wrote.push(".github/workflows/kody.yml");
   }
   for (const exe of listExecutables()) {
@@ -12843,12 +12916,12 @@ function performInit(cwd, force) {
       continue;
     }
     if (profile.kind !== "scheduled" || !profile.schedule) continue;
-    const target = path32.join(workflowDir, `kody-${exe.name}.yml`);
-    if (fs33.existsSync(target) && !force) {
+    const target = path33.join(workflowDir, `kody-${exe.name}.yml`);
+    if (fs34.existsSync(target) && !force) {
       skipped.push(`.github/workflows/kody-${exe.name}.yml`);
       continue;
     }
-    fs33.writeFileSync(target, renderScheduledWorkflow(exe.name, profile.schedule));
+    fs34.writeFileSync(target, renderScheduledWorkflow(exe.name, profile.schedule));
     wrote.push(`.github/workflows/kody-${exe.name}.yml`);
   }
   let labels;
@@ -12996,7 +13069,7 @@ Nothing to do. All files already present. (Use --force to overwrite.)
 });
 
 // src/scripts/loadAgentAdhoc.ts
-import * as fs34 from "fs";
+import * as fs35 from "fs";
 function resolveMessage(messageArg) {
   const fromComment = readCommentBody();
   if (fromComment) return stripDirective(fromComment);
@@ -13004,9 +13077,9 @@ function resolveMessage(messageArg) {
 }
 function readCommentBody() {
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventPath || !fs34.existsSync(eventPath)) return "";
+  if (!eventPath || !fs35.existsSync(eventPath)) return "";
   try {
-    const event = JSON.parse(fs34.readFileSync(eventPath, "utf-8"));
+    const event = JSON.parse(fs35.readFileSync(eventPath, "utf-8"));
     return String(event.comment?.body ?? "");
   } catch {
     return "";
@@ -13059,10 +13132,10 @@ var init_loadAgentAdhoc = __esm({
         throw new Error("loadAgentAdhoc: ctx.args.agent must be a non-empty slug");
       }
       const agentPath = resolveAgentFile(ctx.cwd, agentSlug, agentsDir);
-      if (!fs34.existsSync(agentPath)) {
+      if (!fs35.existsSync(agentPath)) {
         throw new Error(`loadAgentAdhoc: agent identity not found: ${agentPath}`);
       }
-      const { title, body } = parseAgentFile(fs34.readFileSync(agentPath, "utf-8"), agentSlug);
+      const { title, body } = parseAgentFile(fs35.readFileSync(agentPath, "utf-8"), agentSlug);
       const message = resolveMessage(ctx.args.message);
       if (!message) {
         throw new Error(
@@ -13306,8 +13379,8 @@ var init_loadIssueStateComment = __esm({
 });
 
 // src/scripts/loadJobFromFile.ts
-import * as fs35 from "fs";
-import * as path33 from "path";
+import * as fs36 from "fs";
+import * as path34 from "path";
 function parseJobFile(raw, slug2) {
   let stripped = raw;
   if (stripped.startsWith("---\n")) {
@@ -13345,9 +13418,9 @@ var init_loadJobFromFile = __esm({
       if (!slug2) {
         throw new Error(`loadJobFromFile: ctx.args.${slugArg} must be a non-empty slug`);
       }
-      const capability = resolveCapabilityFolder(slug2, path33.join(ctx.cwd, jobsDir));
+      const capability = resolveCapabilityFolder(slug2, path34.join(ctx.cwd, jobsDir));
       if (!capability) {
-        throw new Error(`loadJobFromFile: capability folder not found or incomplete: ${path33.join(ctx.cwd, jobsDir, slug2)}`);
+        throw new Error(`loadJobFromFile: capability folder not found or incomplete: ${path34.join(ctx.cwd, jobsDir, slug2)}`);
       }
       const { title, body, config } = capability;
       const mentions = (config.mentions ?? []).map((login) => `@${login}`).join(" ");
@@ -13356,12 +13429,12 @@ var init_loadJobFromFile = __esm({
       let agentIdentity = "";
       if (agentSlug) {
         const agentPath = resolveAgentFile(ctx.cwd, agentSlug, agentsDir);
-        if (!fs35.existsSync(agentPath)) {
+        if (!fs36.existsSync(agentPath)) {
           throw new Error(
             `loadJobFromFile: capability '${slug2}' declares agent '${agentSlug}' but ${agentPath} does not exist`
           );
         }
-        const agentRaw = fs35.readFileSync(agentPath, "utf-8");
+        const agentRaw = fs36.readFileSync(agentPath, "utf-8");
         const parsed = parseJobFile(agentRaw, agentSlug);
         agentTitle = parsed.title;
         agentIdentity = parsed.body;
@@ -13441,13 +13514,13 @@ ${truncate(issue.body, FINDING_BODY_MAX_BYTES)}`;
 });
 
 // src/scripts/kodyVariables.ts
-import * as fs36 from "fs";
-import * as path34 from "path";
+import * as fs37 from "fs";
+import * as path35 from "path";
 function readKodyVariables(cwd) {
-  const full = path34.join(cwd, KODY_VARIABLES_REL_PATH);
+  const full = path35.join(cwd, KODY_VARIABLES_REL_PATH);
   let raw;
   try {
-    raw = fs36.readFileSync(full, "utf-8");
+    raw = fs37.readFileSync(full, "utf-8");
   } catch {
     return {};
   }
@@ -13471,155 +13544,489 @@ var init_kodyVariables = __esm({
   }
 });
 
-// src/scripts/loadQaContext.ts
-import * as fs37 from "fs";
-import * as path35 from "path";
-function parseSlugList(value) {
-  const inner = value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
-  return inner.split(",").map(
-    (s) => s.trim().replace(/^["']|["']$/g, "").toLowerCase()
-  ).filter(Boolean);
-}
-function readProfileAgents(raw) {
-  const m = FRONTMATTER_RE.exec(raw);
-  if (!m) return { agent: ["kody"], body: raw };
-  const body = raw.slice(m[0].length);
-  let agent = null;
-  let legacy = null;
-  for (const line of (m[1] ?? "").split(/\r?\n/)) {
-    const t = line.trim();
-    const c = t.indexOf(":");
-    if (c < 0) continue;
-    const key = t.slice(0, c).trim();
-    const value = t.slice(c + 1).trim();
-    if (key === "agent") {
-      agent = parseSlugList(value);
-    } else if (key === "audience" || key === "for") {
-      const mapped = parseSlugList(value).map((tok) => LEGACY_AUDIENCE_TO_AGENT[tok]).filter(Boolean);
-      if (mapped.length > 0) legacy = mapped;
-    }
+// src/pool/keys.ts
+import { hkdfSync } from "crypto";
+function masterKeyBytes(raw) {
+  const v = raw.trim();
+  if (!v) throw new Error("KODY_MASTER_KEY is empty");
+  if (/^[0-9a-fA-F]+$/.test(v) && v.length === 64) {
+    return Buffer.from(v, "hex");
   }
-  return { agent: agent ?? legacy ?? ["kody"], body };
+  return Buffer.from(v.replace(/-/g, "+").replace(/_/g, "/"), "base64");
 }
-function readProfile(cwd) {
-  const dir = path35.join(cwd, CONTEXT_DIR_REL_PATH);
-  if (!fs37.existsSync(dir)) return "";
-  let entries;
-  try {
-    entries = fs37.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
-  } catch {
-    return "";
-  }
-  const blocks = [];
-  for (const file of entries) {
-    try {
-      const raw = fs37.readFileSync(path35.join(dir, file), "utf-8");
-      const { agent, body } = readProfileAgents(raw);
-      if (!agent.includes(QA_AGENT) && !agent.includes(ALL_AGENTS)) continue;
-      blocks.push(`## ${file}
-
-${body.trim()}`);
-    } catch {
-    }
-  }
-  return blocks.join("\n\n");
+function deriveKey(master, info, length = 32) {
+  return Buffer.from(hkdfSync("sha256", master, Buffer.alloc(0), info, length)).toString("hex");
 }
-function composeAuthBlock(authProfile, login, password) {
-  if (authProfile && authProfile.trim().length > 0) {
-    return `Auth: a saved Playwright \`storageState.json\` is available at \`${authProfile}\`. Pass it to the browser via the \`storageState\` parameter so the session starts pre-authenticated.`;
-  }
-  if (login && password) {
-    return `Auth: log in once at the app's login page. Username: \`${login}\` \xB7 Password: \`${password}\`. Type each field key-by-key (Playwright \`locator.pressSequentially()\` / the MCP \`browser_type\` tool), NOT a one-shot \`fill()\` or value assignment: pasting a value in a single step often fails to fire the login form's framework onChange handler, so the form submits empty and you get a FALSE "invalid email or password". After typing, confirm the field shows the value before clicking submit; if the first attempt is rejected, re-type key-by-key before treating the credentials as wrong. If a login form's inputs don't respond to typing-by-label/placeholder, inspect the DOM and target them by their \`id\`/\`name\` attribute instead \u2014 e.g. a Payload CMS admin login at \`/admin\` uses \`#field-email\` and \`#field-password\`. The app may have TWO separate logins (a public/frontend one and a Payload \`/admin\` one); if a change you must verify lives behind the admin, log into that form too. Re-use the session afterwards.`;
-  }
-  if (login) {
-    return `Auth: username \`${login}\` is configured but no \`LOGIN_PASSWORD\` secret was found. Note auth-gated surfaces as gaps.`;
+function derivePoolApiKey(master) {
+  return deriveKey(master, POOL_API_KEY_INFO);
+}
+function deriveRunnerApiKey(master) {
+  return deriveKey(master, RUNNER_API_KEY_INFO);
+}
+function bearerOk(headerAuth, xApiKey, expected) {
+  const x = (xApiKey ?? "").trim();
+  if (x && timingEqual(x, expected)) return true;
+  const a = (headerAuth ?? "").trim();
+  if (a.toLowerCase().startsWith("bearer ")) {
+    return timingEqual(a.slice(7).trim(), expected);
   }
-  return "Auth: no QA credentials configured (set the `LOGIN_USER` variable and the `LOGIN_PASSWORD` vault secret). Browse public routes only; note auth-gated surfaces as gaps.";
+  return false;
 }
-var CONTEXT_DIR_REL_PATH, QA_AGENT, ALL_AGENTS, LEGACY_AUDIENCE_TO_AGENT, FRONTMATTER_RE, loadQaContext;
-var init_loadQaContext = __esm({
-  "src/scripts/loadQaContext.ts"() {
+function timingEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+var POOL_API_KEY_INFO, RUNNER_API_KEY_INFO;
+var init_keys = __esm({
+  "src/pool/keys.ts"() {
     "use strict";
-    init_kodyVariables();
-    CONTEXT_DIR_REL_PATH = ".kody/context";
-    QA_AGENT = "qa-engineer";
-    ALL_AGENTS = "*";
-    LEGACY_AUDIENCE_TO_AGENT = { chat: "kody", qa: QA_AGENT };
-    FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
-    loadQaContext = async (ctx) => {
-      const vars = readKodyVariables(ctx.cwd);
-      const login = vars.LOGIN_USER ?? "";
-      const password = process.env.LOGIN_PASSWORD ?? "";
-      const authProfile = ctx.args.authProfile;
-      ctx.data.qaLogin = login;
-      ctx.data.qaProfile = readProfile(ctx.cwd);
-      ctx.data.qaAuthBlock = composeAuthBlock(authProfile, login, password);
-    };
+    POOL_API_KEY_INFO = "kody-pool-api:v1";
+    RUNNER_API_KEY_INFO = "kody-runner-api:v1";
   }
 });
 
-// src/taskContext.ts
+// src/stateRepoGithub.ts
 import * as fs38 from "fs";
 import * as path36 from "path";
-function buildTaskContext(args) {
-  return {
-    schemaVersion: TASK_CONTEXT_SCHEMA_VERSION,
-    builtAt: (/* @__PURE__ */ new Date()).toISOString(),
-    runId: args.runId,
-    issue: args.issue,
-    conventions: args.conventions ?? [],
-    priorArt: args.priorArt ?? "",
-    memoryContext: args.memoryContext ?? "",
-    coverageRules: args.coverageRules ?? []
-  };
+function recordValue3(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function persistTaskContext(cwd, ctx) {
-  try {
-    const dir = runtimeStatePath(cwd, "agent-runs", ctx.runId);
-    fs38.mkdirSync(dir, { recursive: true });
-    const file = path36.join(dir, "task-context.json");
-    fs38.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
-`);
-    return file;
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    process.stderr.write(`[kody taskContext] persist failed: ${msg}
-`);
-    return null;
+function contentsUrl(owner, repo, filePath) {
+  const encodedPath = filePath.split("/").filter(Boolean).map((part) => encodeURIComponent(part)).join("/");
+  return `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/contents/${encodedPath}`;
+}
+async function githubContentsFile(opts) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const res = await doFetch(contentsUrl(opts.owner, opts.repo, opts.path), {
+    headers: {
+      Authorization: `Bearer ${opts.githubToken}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "kody-engine"
+    },
+    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    throw new Error(
+      `GitHub ${opts.owner}/${opts.repo}:${opts.path}: ${res.status} ${(await res.text().catch(() => "")).slice(0, 160)}`
+    );
   }
+  return await res.json();
 }
-var TASK_CONTEXT_SCHEMA_VERSION;
-var init_taskContext = __esm({
-  "src/taskContext.ts"() {
-    "use strict";
-    init_runtimePaths();
-    TASK_CONTEXT_SCHEMA_VERSION = 1;
+function decodeContentsFile(file, label) {
+  if (file.type !== "file" || file.encoding !== "base64" || typeof file.content !== "string") {
+    throw new Error(`${label} is not a base64 file`);
   }
-});
-
-// src/scripts/loadTaskContext.ts
-var loadTaskContext;
-var init_loadTaskContext = __esm({
-  "src/scripts/loadTaskContext.ts"() {
-    "use strict";
-    init_events();
-    init_taskContext();
-    loadTaskContext = async (ctx) => {
-      const runId = resolveRunId();
-      const rawIssue = ctx.data.issue;
-      const issue = rawIssue ? {
-        ...rawIssue,
-        commentsFormatted: rawIssue.commentsFormatted ?? "",
-        labelsFormatted: rawIssue.labelsFormatted ?? ""
-      } : void 0;
-      const taskContext = buildTaskContext({
-        runId,
-        issue,
-        conventions: ctx.data.conventions,
-        priorArt: typeof ctx.data.priorArt === "string" ? ctx.data.priorArt : "",
-        memoryContext: typeof ctx.data.memoryContext === "string" ? ctx.data.memoryContext : "",
-        coverageRules: ctx.data.coverageRules
-      });
+  if (typeof file.sha !== "string") {
+    throw new Error(`${label} response missing sha`);
+  }
+  return {
+    path: label,
+    content: Buffer.from(file.content, "base64").toString("utf-8"),
+    sha: file.sha
+  };
+}
+async function loadGithubStateConfig(opts) {
+  const configFile = await githubContentsFile({
+    owner: opts.owner,
+    repo: opts.repo,
+    path: "kody.config.json",
+    githubToken: opts.githubToken,
+    fetchImpl: opts.fetchImpl
+  });
+  let raw = {};
+  if (configFile) {
+    const decoded = decodeContentsFile(configFile, "kody.config.json");
+    try {
+      raw = JSON.parse(decoded.content);
+    } catch (err) {
+      throw new Error(`kody.config.json is invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const githubRaw = recordValue3(raw.github) ?? {};
+  const github = {
+    owner: typeof githubRaw.owner === "string" && githubRaw.owner.trim() ? githubRaw.owner.trim() : opts.owner,
+    repo: typeof githubRaw.repo === "string" && githubRaw.repo.trim() ? githubRaw.repo.trim() : opts.repo
+  };
+  const nestedState = recordValue3(raw.state) ?? {};
+  const repoRaw = typeof raw.stateRepo === "string" ? raw.stateRepo : nestedState.repo;
+  const pathRaw = typeof raw.statePath === "string" ? raw.statePath : nestedState.path;
+  const stateRepo = typeof repoRaw === "string" && repoRaw.trim().length > 0 ? repoRaw.trim() : `https://github.com/${github.owner}/kody-state`;
+  parseStateRepoSlug(stateRepo);
+  const statePath = typeof pathRaw === "string" && pathRaw.trim().length > 0 ? pathRaw.trim() : github.repo;
+  return {
+    github,
+    state: {
+      repo: stateRepo,
+      path: normalizeStatePath(statePath)
+    }
+  };
+}
+async function readGithubStateText(opts) {
+  const config = await loadGithubStateConfig(opts);
+  return readGithubStateTextWithConfig({
+    config,
+    filePath: opts.filePath,
+    githubToken: opts.githubToken,
+    fetchImpl: opts.fetchImpl
+  });
+}
+async function readGithubStateTextWithConfig(opts) {
+  const target = stateRepoPath(opts.config, opts.filePath);
+  const parsed = parseStateRepo(opts.config);
+  const file = await githubContentsFile({
+    owner: parsed.owner,
+    repo: parsed.repo,
+    path: target,
+    githubToken: opts.githubToken,
+    fetchImpl: opts.fetchImpl
+  });
+  return file ? decodeContentsFile(file, target) : null;
+}
+async function writeGithubStateTextWithConfig(opts) {
+  const target = stateRepoPath(opts.config, opts.filePath);
+  const parsed = parseStateRepo(opts.config);
+  const payload = {
+    message: opts.message,
+    content: Buffer.from(opts.content, "utf-8").toString("base64")
+  };
+  if (opts.sha) payload.sha = opts.sha;
+  const doFetch = opts.fetchImpl ?? fetch;
+  const res = await doFetch(contentsUrl(parsed.owner, parsed.repo, target), {
+    method: "PUT",
+    headers: {
+      Authorization: `Bearer ${opts.githubToken}`,
+      Accept: "application/vnd.github+json",
+      "Content-Type": "application/json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "kody-engine"
+    },
+    body: JSON.stringify(payload),
+    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    throw new Error(
+      `GitHub write ${parsed.owner}/${parsed.repo}:${target}: ${res.status} ${(await res.text().catch(() => "")).slice(0, 160)}`
+    );
+  }
+}
+function jsonlLines(text) {
+  return text.split("\n").filter((line) => line.length > 0);
+}
+function renderJsonl(lines) {
+  return lines.length > 0 ? `${lines.join("\n")}
+` : "";
+}
+function mergeJsonl(localText, remoteText) {
+  const remoteLines = jsonlLines(remoteText);
+  const seen = new Set(remoteLines);
+  const localOnly = jsonlLines(localText).filter((line) => !seen.has(line));
+  return renderJsonl([...remoteLines, ...localOnly]);
+}
+async function syncJsonlFileFromGithubState(opts) {
+  const remote = await readGithubStateTextWithConfig(opts);
+  if (!remote) return;
+  const local = fs38.existsSync(opts.localPath) ? fs38.readFileSync(opts.localPath, "utf-8") : "";
+  const next = mergeJsonl(local, remote.content);
+  if (next === local) return;
+  fs38.mkdirSync(path36.dirname(opts.localPath), { recursive: true });
+  fs38.writeFileSync(opts.localPath, next);
+}
+async function persistJsonlFileToGithubState(opts) {
+  if (!fs38.existsSync(opts.localPath)) return;
+  const localText = fs38.readFileSync(opts.localPath, "utf-8");
+  for (let attempt = 1; attempt <= 3; attempt += 1) {
+    const remote = await readGithubStateTextWithConfig(opts);
+    const body = mergeJsonl(localText, remote?.content ?? "");
+    try {
+      await writeGithubStateTextWithConfig({
+        config: opts.config,
+        filePath: opts.filePath,
+        content: body,
+        message: opts.message,
+        githubToken: opts.githubToken,
+        sha: remote?.sha,
+        fetchImpl: opts.fetchImpl
+      });
+      return;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      const conflict = /409|422|does not match|is at|but expected/i.test(msg);
+      if (!conflict || attempt === 3) throw err;
+    }
+  }
+}
+var GITHUB_API, REQ_TIMEOUT_MS;
+var init_stateRepoGithub = __esm({
+  "src/stateRepoGithub.ts"() {
+    "use strict";
+    init_stateRepo();
+    GITHUB_API = "https://api.github.com";
+    REQ_TIMEOUT_MS = 3e4;
+  }
+});
+
+// src/stateRepoVault.ts
+import { createDecipheriv, createHash as createHash3 } from "crypto";
+function cacheKey2(owner, repo, masterKey) {
+  const keyHash = createHash3("sha256").update(masterKey).digest("hex").slice(0, 16);
+  return `${owner}/${repo}:${keyHash}`.toLowerCase();
+}
+function decryptVault(payload, masterKey) {
+  const parts = payload.split(":");
+  if (parts.length !== 4 || parts[0] !== "v1") {
+    throw new Error("invalid vault payload format");
+  }
+  const [, ivB64, ctB64, tagB64] = parts;
+  const iv = Buffer.from(ivB64, "base64");
+  const ct = Buffer.from(ctB64, "base64");
+  const tag = Buffer.from(tagB64, "base64");
+  const decipher = createDecipheriv("aes-256-gcm", masterKey, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
+}
+async function readVaultSecrets(opts) {
+  const key = cacheKey2(opts.owner, opts.repo, opts.masterKey);
+  const hit = cache.get(key);
+  if (hit && hit.expiresAt > Date.now()) return hit.secrets;
+  const file = await readGithubStateText({
+    owner: opts.owner,
+    repo: opts.repo,
+    filePath: VAULT_PATH,
+    githubToken: opts.githubToken,
+    fetchImpl: opts.fetchImpl
+  });
+  if (!file) {
+    cache.set(key, { secrets: {}, expiresAt: Date.now() + CACHE_TTL_MS });
+    return {};
+  }
+  const ciphertext = file.content.trim();
+  const doc = JSON.parse(decryptVault(ciphertext, opts.masterKey));
+  const flat = {};
+  for (const [name, entry] of Object.entries(doc.secrets ?? {})) {
+    if (entry && typeof entry.value === "string") flat[name] = entry.value;
+  }
+  cache.set(key, { secrets: flat, expiresAt: Date.now() + CACHE_TTL_MS });
+  return flat;
+}
+async function readRepoSecret(opts) {
+  const secrets = await readVaultSecrets(opts);
+  const v = secrets[opts.name];
+  return v?.trim() ? v : null;
+}
+async function readRepoSecrets(opts) {
+  return readVaultSecrets(opts);
+}
+var VAULT_PATH, CACHE_TTL_MS, cache;
+var init_stateRepoVault = __esm({
+  "src/stateRepoVault.ts"() {
+    "use strict";
+    init_stateRepoGithub();
+    VAULT_PATH = "secrets.enc";
+    CACHE_TTL_MS = 6e4;
+    cache = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/scripts/runtimeSecrets.ts
+function tokenFromEnv(env) {
+  return (env.KODY_TOKEN ?? env.GH_TOKEN ?? env.GITHUB_TOKEN ?? env.GH_PAT ?? "").trim();
+}
+function envSecret(name, env) {
+  const value = env[name]?.trim() ? env[name] : "";
+  return value ? { value, source: "env" } : { value: "", source: "missing" };
+}
+async function resolveRuntimeSecret(name, ctx, opts = {}) {
+  const env = opts.env ?? process.env;
+  const masterRaw = env.KODY_MASTER_KEY?.trim() ?? "";
+  const githubToken2 = tokenFromEnv(env);
+  if (!masterRaw || !githubToken2) return envSecret(name, env);
+  try {
+    const masterKey = masterKeyBytes(masterRaw);
+    if (masterKey.length !== 32) {
+      throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
+    }
+    const value = await readRepoSecret({
+      owner: ctx.config.github.owner,
+      repo: ctx.config.github.repo,
+      name,
+      githubToken: githubToken2,
+      masterKey,
+      fetchImpl: opts.fetchImpl
+    });
+    if (value) return { value, source: "vault" };
+  } catch (err) {
+    const fallback = envSecret(name, env);
+    return {
+      ...fallback,
+      warning: `vault read failed for ${name}: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  return envSecret(name, env);
+}
+var init_runtimeSecrets = __esm({
+  "src/scripts/runtimeSecrets.ts"() {
+    "use strict";
+    init_keys();
+    init_stateRepoVault();
+  }
+});
+
+// src/scripts/loadQaContext.ts
+import * as fs39 from "fs";
+import * as path37 from "path";
+function parseSlugList(value) {
+  const inner = value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
+  return inner.split(",").map(
+    (s) => s.trim().replace(/^["']|["']$/g, "").toLowerCase()
+  ).filter(Boolean);
+}
+function readProfileAgents(raw) {
+  const m = FRONTMATTER_RE.exec(raw);
+  if (!m) return { agent: ["kody"], body: raw };
+  const body = raw.slice(m[0].length);
+  let agent = null;
+  let legacy = null;
+  for (const line of (m[1] ?? "").split(/\r?\n/)) {
+    const t = line.trim();
+    const c = t.indexOf(":");
+    if (c < 0) continue;
+    const key = t.slice(0, c).trim();
+    const value = t.slice(c + 1).trim();
+    if (key === "agent") {
+      agent = parseSlugList(value);
+    } else if (key === "audience" || key === "for") {
+      const mapped = parseSlugList(value).map((tok) => LEGACY_AUDIENCE_TO_AGENT[tok]).filter(Boolean);
+      if (mapped.length > 0) legacy = mapped;
+    }
+  }
+  return { agent: agent ?? legacy ?? ["kody"], body };
+}
+function readProfile(cwd) {
+  const dir = path37.join(cwd, CONTEXT_DIR_REL_PATH);
+  if (!fs39.existsSync(dir)) return "";
+  let entries;
+  try {
+    entries = fs39.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+  } catch {
+    return "";
+  }
+  const blocks = [];
+  for (const file of entries) {
+    try {
+      const raw = fs39.readFileSync(path37.join(dir, file), "utf-8");
+      const { agent, body } = readProfileAgents(raw);
+      if (!agent.includes(QA_AGENT) && !agent.includes(ALL_AGENTS)) continue;
+      blocks.push(`## ${file}
+
+${body.trim()}`);
+    } catch {
+    }
+  }
+  return blocks.join("\n\n");
+}
+function composeAuthBlock(authProfile, login, password) {
+  if (authProfile && authProfile.trim().length > 0) {
+    return `Auth: a saved Playwright \`storageState.json\` is available at \`${authProfile}\`. Pass it to the browser via the \`storageState\` parameter so the session starts pre-authenticated.`;
+  }
+  if (login && password) {
+    return `Auth: log in once at the app's login page. Username: \`${login}\` \xB7 Password: \`${password}\`. Type each field key-by-key (Playwright \`locator.pressSequentially()\` / the MCP \`browser_type\` tool), NOT a one-shot \`fill()\` or value assignment: pasting a value in a single step often fails to fire the login form's framework onChange handler, so the form submits empty and you get a FALSE "invalid email or password". After typing, confirm the field shows the value before clicking submit; if the first attempt is rejected, re-type key-by-key before treating the credentials as wrong. If a login form's inputs don't respond to typing-by-label/placeholder, inspect the DOM and target them by their \`id\`/\`name\` attribute instead \u2014 e.g. a Payload CMS admin login at \`/admin\` uses \`#field-email\` and \`#field-password\`. The app may have TWO separate logins (a public/frontend one and a Payload \`/admin\` one); if a change you must verify lives behind the admin, log into that form too. Re-use the session afterwards.`;
+  }
+  if (login) {
+    return `Auth: username \`${login}\` is configured but no \`LOGIN_PASSWORD\` secret was found. Note auth-gated surfaces as gaps.`;
+  }
+  return "Auth: no QA credentials configured (set the `LOGIN_USER` variable and the `LOGIN_PASSWORD` vault secret). Browse public routes only; note auth-gated surfaces as gaps.";
+}
+var CONTEXT_DIR_REL_PATH, QA_AGENT, ALL_AGENTS, LEGACY_AUDIENCE_TO_AGENT, FRONTMATTER_RE, loadQaContext;
+var init_loadQaContext = __esm({
+  "src/scripts/loadQaContext.ts"() {
+    "use strict";
+    init_kodyVariables();
+    init_runtimeSecrets();
+    CONTEXT_DIR_REL_PATH = ".kody/context";
+    QA_AGENT = "qa-engineer";
+    ALL_AGENTS = "*";
+    LEGACY_AUDIENCE_TO_AGENT = { chat: "kody", qa: QA_AGENT };
+    FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
+    loadQaContext = async (ctx) => {
+      const vars = readKodyVariables(ctx.cwd);
+      const login = vars.LOGIN_USER ?? "";
+      const password = await resolveRuntimeSecret("LOGIN_PASSWORD", ctx);
+      const authProfile = ctx.args.authProfile;
+      ctx.data.qaLogin = login;
+      ctx.data.qaPasswordSource = password.source;
+      if (password.warning) ctx.data.qaPasswordWarning = password.warning;
+      ctx.data.qaProfile = readProfile(ctx.cwd);
+      ctx.data.qaAuthBlock = composeAuthBlock(authProfile, login, password.value);
+    };
+  }
+});
+
+// src/taskContext.ts
+import * as fs40 from "fs";
+import * as path38 from "path";
+function buildTaskContext(args) {
+  return {
+    schemaVersion: TASK_CONTEXT_SCHEMA_VERSION,
+    builtAt: (/* @__PURE__ */ new Date()).toISOString(),
+    runId: args.runId,
+    issue: args.issue,
+    conventions: args.conventions ?? [],
+    priorArt: args.priorArt ?? "",
+    memoryContext: args.memoryContext ?? "",
+    coverageRules: args.coverageRules ?? []
+  };
+}
+function persistTaskContext(cwd, ctx) {
+  try {
+    const dir = runtimeStatePath(cwd, "agent-runs", ctx.runId);
+    fs40.mkdirSync(dir, { recursive: true });
+    const file = path38.join(dir, "task-context.json");
+    fs40.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
+`);
+    return file;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[kody taskContext] persist failed: ${msg}
+`);
+    return null;
+  }
+}
+var TASK_CONTEXT_SCHEMA_VERSION;
+var init_taskContext = __esm({
+  "src/taskContext.ts"() {
+    "use strict";
+    init_runtimePaths();
+    TASK_CONTEXT_SCHEMA_VERSION = 1;
+  }
+});
+
+// src/scripts/loadTaskContext.ts
+var loadTaskContext;
+var init_loadTaskContext = __esm({
+  "src/scripts/loadTaskContext.ts"() {
+    "use strict";
+    init_events();
+    init_taskContext();
+    loadTaskContext = async (ctx) => {
+      const runId = resolveRunId();
+      const rawIssue = ctx.data.issue;
+      const issue = rawIssue ? {
+        ...rawIssue,
+        commentsFormatted: rawIssue.commentsFormatted ?? "",
+        labelsFormatted: rawIssue.labelsFormatted ?? ""
+      } : void 0;
+      const taskContext = buildTaskContext({
+        runId,
+        issue,
+        conventions: ctx.data.conventions,
+        priorArt: typeof ctx.data.priorArt === "string" ? ctx.data.priorArt : "",
+        memoryContext: typeof ctx.data.memoryContext === "string" ? ctx.data.memoryContext : "",
+        coverageRules: ctx.data.coverageRules
+      });
       ctx.data.taskContext = taskContext;
       const persistedPath = persistTaskContext(ctx.cwd, taskContext);
       if (persistedPath && ctx.verbose) {
@@ -14349,32 +14756,32 @@ var init_parseAgentResult = __esm({
   }
 });
 
-// src/scripts/parseCompanyManagerDecision.ts
+// src/scripts/parseAgencyArchitectDecision.ts
 function makeAction3(type, payload) {
   return { type, payload, timestamp: (/* @__PURE__ */ new Date()).toISOString() };
 }
-var parseCompanyManagerDecision;
-var init_parseCompanyManagerDecision = __esm({
-  "src/scripts/parseCompanyManagerDecision.ts"() {
+var parseAgencyArchitectDecision;
+var init_parseAgencyArchitectDecision = __esm({
+  "src/scripts/parseAgencyArchitectDecision.ts"() {
     "use strict";
-    init_companyManagerDecision();
-    parseCompanyManagerDecision = async (ctx, _profile, agentResult) => {
+    init_agencyArchitectDecision();
+    parseAgencyArchitectDecision = async (ctx, _profile, agentResult) => {
       if (!agentResult) {
-        ctx.data.companyManagerDecision = { summary: "", actions: [] };
-        ctx.data.action = makeAction3("COMPANY_MANAGER_NOT_RUN", { reason: "no agent result" });
+        ctx.data.agencyArchitectDecision = { summary: "", actions: [] };
+        ctx.data.action = makeAction3("AGENCY_ARCHITECT_NOT_RUN", { reason: "no agent result" });
         return;
       }
       try {
-        const decision = parseCompanyManagerDecisionText(agentResult.finalText);
-        ctx.data.companyManagerDecision = decision;
-        ctx.data.action = makeAction3("COMPANY_MANAGER_DECIDED", {
+        const decision = parseAgencyArchitectDecisionText(agentResult.finalText);
+        ctx.data.agencyArchitectDecision = decision;
+        ctx.data.action = makeAction3("AGENCY_ARCHITECT_DECIDED", {
           summary: decision.summary,
           actionCount: decision.actions.length
         });
       } catch (err) {
         const reason = err instanceof Error ? err.message : String(err);
-        ctx.data.companyManagerDecisionError = reason;
-        ctx.data.action = makeAction3("COMPANY_MANAGER_FAILED", { reason });
+        ctx.data.agencyArchitectDecisionError = reason;
+        ctx.data.action = makeAction3("AGENCY_ARCHITECT_FAILED", { reason });
         ctx.output.exitCode = 1;
         ctx.output.reason = reason;
       }
@@ -15764,301 +16171,119 @@ var init_revertFlow = __esm({
       const runUrl = getRunUrl();
       const runSuffix = runUrl ? `, run ${runUrl}` : "";
       const shaList = resolved.map((r) => `\`${r.full.slice(0, 7)}\``).join(", ");
-      tryPostPr4(prNumber, `\u2699\uFE0F kody revert started on \`${ctx.data.branch}\`${runSuffix} \u2014 reverting ${shaList}`, ctx.cwd);
-    };
-  }
-});
-
-// src/scripts/reviewFlow.ts
-function tryPostPr5(prNumber, body, cwd) {
-  try {
-    postPrReviewComment(prNumber, body, cwd);
-  } catch {
-  }
-}
-var reviewFlow;
-var init_reviewFlow = __esm({
-  "src/scripts/reviewFlow.ts"() {
-    "use strict";
-    init_branch();
-    init_gha();
-    init_issue();
-    reviewFlow = async (ctx) => {
-      const prNumber = ctx.args.pr;
-      const pr = getPr(prNumber, ctx.cwd);
-      if (pr.state !== "OPEN") {
-        ctx.output.exitCode = 1;
-        ctx.output.reason = `PR #${prNumber} is not OPEN (state: ${pr.state})`;
-        ctx.skipAgent = true;
-        return;
-      }
-      ctx.data.pr = pr;
-      ctx.data.commentTargetType = "pr";
-      ctx.data.commentTargetNumber = prNumber;
-      checkoutPrBranch(prNumber, ctx.cwd);
-      ctx.data.branch = getCurrentBranch(ctx.cwd);
-      ctx.data.prDiff = getPrDiff(prNumber, ctx.cwd);
-      const runUrl = getRunUrl();
-      const runSuffix = runUrl ? `, run ${runUrl}` : "";
-      tryPostPr5(prNumber, `\u{1F440} kody review started on PR #${prNumber}${runSuffix}`, ctx.cwd);
-    };
-  }
-});
-
-// src/scripts/runFlow.ts
-function tryPost(issueNumber, body, cwd) {
-  try {
-    postIssueComment(issueNumber, body, cwd);
-  } catch {
-  }
-}
-function resolveBaseOverride(value) {
-  if (!value) return null;
-  if (value.length > 200) return null;
-  if (value.includes("..")) return null;
-  if (!/^[a-z0-9][a-z0-9/._-]*$/.test(value)) return null;
-  return value;
-}
-var runFlow;
-var init_runFlow = __esm({
-  "src/scripts/runFlow.ts"() {
-    "use strict";
-    init_branch();
-    init_gha();
-    init_issue();
-    runFlow = async (ctx) => {
-      const issueNumber = ctx.args.issue;
-      const issue = getIssue(issueNumber, ctx.cwd);
-      const cfgCtx = ctx.config.issueContext ?? {};
-      const commentsFormatted = formatIssueComments(
-        issue.comments,
-        cfgCtx.commentLimit ?? DEFAULT_COMMENT_LIMIT,
-        cfgCtx.commentMaxBytes ?? DEFAULT_COMMENT_MAX_BYTES
-      );
-      ctx.data.issue = { ...issue, commentsFormatted };
-      if (issue.isPullRequest) {
-        ctx.data.commentTargetType = "pr";
-        ctx.data.commentTargetNumber = issueNumber;
-        ctx.skipAgent = true;
-        ctx.output.exitCode = 1;
-        ctx.output.reason = `run target #${issueNumber} is a pull request; dispatch a PR action or the source issue instead`;
-        return;
-      }
-      ctx.data.commentTargetType = "issue";
-      ctx.data.commentTargetNumber = issueNumber;
-      const argBase = resolveBaseOverride(ctx.args.base);
-      const baseRaw = ctx.args.base;
-      if (baseRaw && !argBase) {
-        process.stderr.write(`[kody runFlow] ignoring --base "${baseRaw}" (must match kody-task or goal-branch pattern)
-`);
-      }
-      const base = argBase;
-      if (base) {
-        ctx.data.baseBranch = base;
-        process.stderr.write(`[kody runFlow] resolved base branch: ${base} (from --base)
-`);
-      }
-      const branchInfo = ensureFeatureBranch(
-        issueNumber,
-        issue.title,
-        ctx.config.git.defaultBranch,
-        ctx.cwd,
-        base ?? void 0
-      );
-      ctx.data.branch = branchInfo.branch;
-      const runUrl = getRunUrl();
-      const startMsg = runUrl ? `\u2699\uFE0F kody started \u2014 branch \`${ctx.data.branch}\`, run ${runUrl}` : `\u2699\uFE0F kody started \u2014 branch \`${ctx.data.branch}\``;
-      tryPost(issueNumber, startMsg, ctx.cwd);
-    };
-  }
-});
-
-// src/stateRepoGithub.ts
-import * as fs39 from "fs";
-import * as path37 from "path";
-function recordValue3(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function contentsUrl(owner, repo, filePath) {
-  const encodedPath = filePath.split("/").filter(Boolean).map((part) => encodeURIComponent(part)).join("/");
-  return `${GITHUB_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/contents/${encodedPath}`;
-}
-async function githubContentsFile(opts) {
-  const doFetch = opts.fetchImpl ?? fetch;
-  const res = await doFetch(contentsUrl(opts.owner, opts.repo, opts.path), {
-    headers: {
-      Authorization: `Bearer ${opts.githubToken}`,
-      Accept: "application/vnd.github+json",
-      "X-GitHub-Api-Version": "2022-11-28",
-      "User-Agent": "kody-engine"
-    },
-    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
-  });
-  if (res.status === 404) return null;
-  if (!res.ok) {
-    throw new Error(
-      `GitHub ${opts.owner}/${opts.repo}:${opts.path}: ${res.status} ${(await res.text().catch(() => "")).slice(0, 160)}`
-    );
-  }
-  return await res.json();
-}
-function decodeContentsFile(file, label) {
-  if (file.type !== "file" || file.encoding !== "base64" || typeof file.content !== "string") {
-    throw new Error(`${label} is not a base64 file`);
-  }
-  if (typeof file.sha !== "string") {
-    throw new Error(`${label} response missing sha`);
-  }
-  return {
-    path: label,
-    content: Buffer.from(file.content, "base64").toString("utf-8"),
-    sha: file.sha
-  };
-}
-async function loadGithubStateConfig(opts) {
-  const configFile = await githubContentsFile({
-    owner: opts.owner,
-    repo: opts.repo,
-    path: "kody.config.json",
-    githubToken: opts.githubToken,
-    fetchImpl: opts.fetchImpl
-  });
-  let raw = {};
-  if (configFile) {
-    const decoded = decodeContentsFile(configFile, "kody.config.json");
-    try {
-      raw = JSON.parse(decoded.content);
-    } catch (err) {
-      throw new Error(`kody.config.json is invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  const githubRaw = recordValue3(raw.github) ?? {};
-  const github = {
-    owner: typeof githubRaw.owner === "string" && githubRaw.owner.trim() ? githubRaw.owner.trim() : opts.owner,
-    repo: typeof githubRaw.repo === "string" && githubRaw.repo.trim() ? githubRaw.repo.trim() : opts.repo
-  };
-  const nestedState = recordValue3(raw.state) ?? {};
-  const repoRaw = typeof raw.stateRepo === "string" ? raw.stateRepo : nestedState.repo;
-  const pathRaw = typeof raw.statePath === "string" ? raw.statePath : nestedState.path;
-  const stateRepo = typeof repoRaw === "string" && repoRaw.trim().length > 0 ? repoRaw.trim() : `https://github.com/${github.owner}/kody-state`;
-  parseStateRepoSlug(stateRepo);
-  const statePath = typeof pathRaw === "string" && pathRaw.trim().length > 0 ? pathRaw.trim() : github.repo;
-  return {
-    github,
-    state: {
-      repo: stateRepo,
-      path: normalizeStatePath(statePath)
-    }
-  };
-}
-async function readGithubStateText(opts) {
-  const config = await loadGithubStateConfig(opts);
-  return readGithubStateTextWithConfig({
-    config,
-    filePath: opts.filePath,
-    githubToken: opts.githubToken,
-    fetchImpl: opts.fetchImpl
-  });
-}
-async function readGithubStateTextWithConfig(opts) {
-  const target = stateRepoPath(opts.config, opts.filePath);
-  const parsed = parseStateRepo(opts.config);
-  const file = await githubContentsFile({
-    owner: parsed.owner,
-    repo: parsed.repo,
-    path: target,
-    githubToken: opts.githubToken,
-    fetchImpl: opts.fetchImpl
-  });
-  return file ? decodeContentsFile(file, target) : null;
-}
-async function writeGithubStateTextWithConfig(opts) {
-  const target = stateRepoPath(opts.config, opts.filePath);
-  const parsed = parseStateRepo(opts.config);
-  const payload = {
-    message: opts.message,
-    content: Buffer.from(opts.content, "utf-8").toString("base64")
-  };
-  if (opts.sha) payload.sha = opts.sha;
-  const doFetch = opts.fetchImpl ?? fetch;
-  const res = await doFetch(contentsUrl(parsed.owner, parsed.repo, target), {
-    method: "PUT",
-    headers: {
-      Authorization: `Bearer ${opts.githubToken}`,
-      Accept: "application/vnd.github+json",
-      "Content-Type": "application/json",
-      "X-GitHub-Api-Version": "2022-11-28",
-      "User-Agent": "kody-engine"
-    },
-    body: JSON.stringify(payload),
-    signal: AbortSignal.timeout(REQ_TIMEOUT_MS)
-  });
-  if (!res.ok) {
-    throw new Error(
-      `GitHub write ${parsed.owner}/${parsed.repo}:${target}: ${res.status} ${(await res.text().catch(() => "")).slice(0, 160)}`
-    );
-  }
-}
-function jsonlLines(text) {
-  return text.split("\n").filter((line) => line.length > 0);
-}
-function renderJsonl(lines) {
-  return lines.length > 0 ? `${lines.join("\n")}
-` : "";
-}
-function mergeJsonl(localText, remoteText) {
-  const remoteLines = jsonlLines(remoteText);
-  const seen = new Set(remoteLines);
-  const localOnly = jsonlLines(localText).filter((line) => !seen.has(line));
-  return renderJsonl([...remoteLines, ...localOnly]);
-}
-async function syncJsonlFileFromGithubState(opts) {
-  const remote = await readGithubStateTextWithConfig(opts);
-  if (!remote) return;
-  const local = fs39.existsSync(opts.localPath) ? fs39.readFileSync(opts.localPath, "utf-8") : "";
-  const next = mergeJsonl(local, remote.content);
-  if (next === local) return;
-  fs39.mkdirSync(path37.dirname(opts.localPath), { recursive: true });
-  fs39.writeFileSync(opts.localPath, next);
+      tryPostPr4(prNumber, `\u2699\uFE0F kody revert started on \`${ctx.data.branch}\`${runSuffix} \u2014 reverting ${shaList}`, ctx.cwd);
+    };
+  }
+});
+
+// src/scripts/reviewFlow.ts
+function tryPostPr5(prNumber, body, cwd) {
+  try {
+    postPrReviewComment(prNumber, body, cwd);
+  } catch {
+  }
 }
-async function persistJsonlFileToGithubState(opts) {
-  if (!fs39.existsSync(opts.localPath)) return;
-  const localText = fs39.readFileSync(opts.localPath, "utf-8");
-  for (let attempt = 1; attempt <= 3; attempt += 1) {
-    const remote = await readGithubStateTextWithConfig(opts);
-    const body = mergeJsonl(localText, remote?.content ?? "");
-    try {
-      await writeGithubStateTextWithConfig({
-        config: opts.config,
-        filePath: opts.filePath,
-        content: body,
-        message: opts.message,
-        githubToken: opts.githubToken,
-        sha: remote?.sha,
-        fetchImpl: opts.fetchImpl
-      });
-      return;
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      const conflict = /409|422|does not match|is at|but expected/i.test(msg);
-      if (!conflict || attempt === 3) throw err;
-    }
+var reviewFlow;
+var init_reviewFlow = __esm({
+  "src/scripts/reviewFlow.ts"() {
+    "use strict";
+    init_branch();
+    init_gha();
+    init_issue();
+    reviewFlow = async (ctx) => {
+      const prNumber = ctx.args.pr;
+      const pr = getPr(prNumber, ctx.cwd);
+      if (pr.state !== "OPEN") {
+        ctx.output.exitCode = 1;
+        ctx.output.reason = `PR #${prNumber} is not OPEN (state: ${pr.state})`;
+        ctx.skipAgent = true;
+        return;
+      }
+      ctx.data.pr = pr;
+      ctx.data.commentTargetType = "pr";
+      ctx.data.commentTargetNumber = prNumber;
+      checkoutPrBranch(prNumber, ctx.cwd);
+      ctx.data.branch = getCurrentBranch(ctx.cwd);
+      ctx.data.prDiff = getPrDiff(prNumber, ctx.cwd);
+      const runUrl = getRunUrl();
+      const runSuffix = runUrl ? `, run ${runUrl}` : "";
+      tryPostPr5(prNumber, `\u{1F440} kody review started on PR #${prNumber}${runSuffix}`, ctx.cwd);
+    };
+  }
+});
+
+// src/scripts/runFlow.ts
+function tryPost(issueNumber, body, cwd) {
+  try {
+    postIssueComment(issueNumber, body, cwd);
+  } catch {
   }
 }
-var GITHUB_API, REQ_TIMEOUT_MS;
-var init_stateRepoGithub = __esm({
-  "src/stateRepoGithub.ts"() {
+function resolveBaseOverride(value) {
+  if (!value) return null;
+  if (value.length > 200) return null;
+  if (value.includes("..")) return null;
+  if (!/^[a-z0-9][a-z0-9/._-]*$/.test(value)) return null;
+  return value;
+}
+var runFlow;
+var init_runFlow = __esm({
+  "src/scripts/runFlow.ts"() {
     "use strict";
-    init_stateRepo();
-    GITHUB_API = "https://api.github.com";
-    REQ_TIMEOUT_MS = 3e4;
+    init_branch();
+    init_gha();
+    init_issue();
+    runFlow = async (ctx) => {
+      const issueNumber = ctx.args.issue;
+      const issue = getIssue(issueNumber, ctx.cwd);
+      const cfgCtx = ctx.config.issueContext ?? {};
+      const commentsFormatted = formatIssueComments(
+        issue.comments,
+        cfgCtx.commentLimit ?? DEFAULT_COMMENT_LIMIT,
+        cfgCtx.commentMaxBytes ?? DEFAULT_COMMENT_MAX_BYTES
+      );
+      ctx.data.issue = { ...issue, commentsFormatted };
+      if (issue.isPullRequest) {
+        ctx.data.commentTargetType = "pr";
+        ctx.data.commentTargetNumber = issueNumber;
+        ctx.skipAgent = true;
+        ctx.output.exitCode = 1;
+        ctx.output.reason = `run target #${issueNumber} is a pull request; dispatch a PR action or the source issue instead`;
+        return;
+      }
+      ctx.data.commentTargetType = "issue";
+      ctx.data.commentTargetNumber = issueNumber;
+      const argBase = resolveBaseOverride(ctx.args.base);
+      const baseRaw = ctx.args.base;
+      if (baseRaw && !argBase) {
+        process.stderr.write(`[kody runFlow] ignoring --base "${baseRaw}" (must match kody-task or goal-branch pattern)
+`);
+      }
+      const base = argBase;
+      if (base) {
+        ctx.data.baseBranch = base;
+        process.stderr.write(`[kody runFlow] resolved base branch: ${base} (from --base)
+`);
+      }
+      const branchInfo = ensureFeatureBranch(
+        issueNumber,
+        issue.title,
+        ctx.config.git.defaultBranch,
+        ctx.cwd,
+        base ?? void 0
+      );
+      ctx.data.branch = branchInfo.branch;
+      const runUrl = getRunUrl();
+      const startMsg = runUrl ? `\u2699\uFE0F kody started \u2014 branch \`${ctx.data.branch}\`, run ${runUrl}` : `\u2699\uFE0F kody started \u2014 branch \`${ctx.data.branch}\``;
+      tryPost(issueNumber, startMsg, ctx.cwd);
+    };
   }
 });
 
 // src/scripts/previewBuildHelpers.ts
-import { createDecipheriv, createHash as createHash3, hkdfSync } from "crypto";
+import { createDecipheriv as createDecipheriv2, createHash as createHash4, hkdfSync as hkdfSync2 } from "crypto";
 function shortHash(s) {
-  return createHash3("sha256").update(s).digest("hex").slice(0, 6);
+  return createHash4("sha256").update(s).digest("hex").slice(0, 6);
 }
 function previewAppName(repo, pr) {
   const [owner, name] = repo.split("/");
@@ -16087,7 +16312,7 @@ function decryptVaultPayload(payload, keyRaw) {
   const iv = Buffer.from(ivB64, "base64");
   const ct = Buffer.from(ctB64, "base64");
   const tag = Buffer.from(tagB64, "base64");
-  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  const decipher = createDecipheriv2("aes-256-gcm", key, iv);
   decipher.setAuthTag(tag);
   return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
 }
@@ -16100,7 +16325,7 @@ function derivePreviewVerifyKey(masterKeyRaw) {
   if (masterKey.length !== 32) {
     throw new Error("KODY_MASTER_KEY must decode to 32 bytes");
   }
-  return Buffer.from(hkdfSync("sha256", masterKey, Buffer.alloc(0), PREVIEW_KEY_INFO, 32)).toString("hex");
+  return Buffer.from(hkdfSync2("sha256", masterKey, Buffer.alloc(0), PREVIEW_KEY_INFO, 32)).toString("hex");
 }
 function previewRuntimeEnv(args) {
   return {
@@ -16131,7 +16356,7 @@ function formatPreviewComment(args) {
   ].join("\n");
 }
 function defaultImageTag(repo, ref) {
-  return createHash3("sha256").update(`${repo}@${ref}`).digest("hex").slice(0, 12);
+  return createHash4("sha256").update(`${repo}@${ref}`).digest("hex").slice(0, 12);
 }
 var NEVER_PASS_TO_BUILD, PREVIEW_KEY_INFO;
 var init_previewBuildHelpers = __esm({
@@ -16240,12 +16465,12 @@ fi
 
 // src/scripts/runPreviewBuild.ts
 import { copyFile, writeFile } from "fs/promises";
-import * as path38 from "path";
+import * as path39 from "path";
 import { fileURLToPath } from "url";
 function bundledDockerfilePath(mode) {
-  const here = path38.dirname(fileURLToPath(import.meta.url));
+  const here = path39.dirname(fileURLToPath(import.meta.url));
   const file = mode === "dev" ? "default-Dockerfile.preview.dev" : "default-Dockerfile.preview.prod";
-  return path38.join(here, "preview-build-templates", file);
+  return path39.join(here, "preview-build-templates", file);
 }
 function required(name) {
   const v = (process.env[name] ?? "").trim();
@@ -16496,10 +16721,10 @@ var init_runPreviewBuild = __esm({
         console.log(`[preview-build] vault: ${Object.keys(buildEnv).length} secrets, mode=${buildMode}`);
         if (Object.keys(buildEnv).length > 0) {
           const lines = Object.entries(buildEnv).map(([k, v]) => `${k}=${JSON.stringify(v)}`);
-          await writeFile(path38.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
+          await writeFile(path39.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
 `, "utf8");
         }
-        const consumerDockerfile = path38.join(ctx.cwd, "Dockerfile.preview");
+        const consumerDockerfile = path39.join(ctx.cwd, "Dockerfile.preview");
         const { stat } = await import("fs/promises");
         let hasConsumerDockerfile = false;
         try {
@@ -16683,8 +16908,8 @@ var init_tickShellRunner = __esm({
 });
 
 // src/scripts/runScheduledExecutableTick.ts
-import * as fs40 from "fs";
-import * as path39 from "path";
+import * as fs41 from "fs";
+import * as path40 from "path";
 var runScheduledExecutableTick;
 var init_runScheduledExecutableTick = __esm({
   "src/scripts/runScheduledExecutableTick.ts"() {
@@ -16704,14 +16929,14 @@ var init_runScheduledExecutableTick = __esm({
         ctx.output.reason = `runScheduledExecutableTick: args.slug or ctx.args.${slugArg} must be non-empty capability slug`;
         return;
       }
-      const capability = resolveCapabilityFolder(slug2, path39.join(ctx.cwd, jobsDir));
+      const capability = resolveCapabilityFolder(slug2, path40.join(ctx.cwd, jobsDir));
       if (!capability) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledExecutableTick: capability folder not found or incomplete: ${slug2} (searched ${jobsDir} and company store)`;
         return;
       }
-      const shellPath = path39.join(profile.dir, shell);
-      if (!fs40.existsSync(shellPath)) {
+      const shellPath = path40.join(profile.dir, shell);
+      if (!fs41.existsSync(shellPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledExecutableTick: shell not found: ${shell} (looked in ${profile.dir})`;
         return;
@@ -16742,8 +16967,8 @@ var init_runScheduledExecutableTick = __esm({
 });
 
 // src/scripts/runTickScript.ts
-import * as fs41 from "fs";
-import * as path40 from "path";
+import * as fs42 from "fs";
+import * as path41 from "path";
 var runTickScript;
 var init_runTickScript = __esm({
   "src/scripts/runTickScript.ts"() {
@@ -16762,10 +16987,10 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: ctx.args.${slugArg} must be a non-empty slug`;
         return;
       }
-      const capability = readCapabilityFolder(path40.join(ctx.cwd, jobsDir), slug2);
+      const capability = readCapabilityFolder(path41.join(ctx.cwd, jobsDir), slug2);
       if (!capability) {
         ctx.output.exitCode = 99;
-        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path40.join(ctx.cwd, jobsDir, slug2)}`;
+        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path41.join(ctx.cwd, jobsDir, slug2)}`;
         return;
       }
       const tickScript = capability.config.tickScript;
@@ -16774,8 +16999,8 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: capability ${slug2} has no \`tickScript\` in profile.json \u2014 route via capability-tick instead`;
         return;
       }
-      const scriptPath = path40.isAbsolute(tickScript) ? tickScript : path40.join(ctx.cwd, tickScript);
-      if (!fs41.existsSync(scriptPath)) {
+      const scriptPath = path41.isAbsolute(tickScript) ? tickScript : path41.join(ctx.cwd, tickScript);
+      if (!fs42.existsSync(scriptPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runTickScript: tickScript not found: ${scriptPath}`;
         return;
@@ -17598,7 +17823,7 @@ var init_warmupMcp = __esm({
 });
 
 // src/scripts/writeAgentRunSummary.ts
-import * as fs42 from "fs";
+import * as fs43 from "fs";
 var writeAgentRunSummary;
 var init_writeAgentRunSummary = __esm({
   "src/scripts/writeAgentRunSummary.ts"() {
@@ -17624,7 +17849,7 @@ var init_writeAgentRunSummary = __esm({
       if (reason) lines.push(`- **Reason:** ${reason}`);
       lines.push("");
       try {
-        fs42.appendFileSync(summaryPath, `${lines.join("\n")}
+        fs43.appendFileSync(summaryPath, `${lines.join("\n")}
 `);
       } catch {
       }
@@ -17746,7 +17971,7 @@ var init_scripts = __esm({
     init_appendCompanyActivity();
     init_appendCompanyIntentDecision();
     init_applyCapabilityReports();
-    init_applyCompanyManagerDecision();
+    init_applyAgencyArchitectDecision();
     init_buildSyntheticPlugin();
     init_checkCoverageWithRetry();
     init_classifyByLabel();
@@ -17793,7 +18018,7 @@ var init_scripts = __esm({
     init_openAgentFactoryStatePr();
     init_openQaIssue();
     init_parseAgentResult();
-    init_parseCompanyManagerDecision();
+    init_parseAgencyArchitectDecision();
     init_parseIssueStateFromAgentResult();
     init_parseJobStateFromAgentResult();
     init_parseReproOutput();
@@ -17888,7 +18113,7 @@ var init_scripts = __esm({
     };
     postflightScripts = {
       parseAgentResult: parseAgentResult2,
-      parseCompanyManagerDecision,
+      parseAgencyArchitectDecision,
       parseIssueStateFromAgentResult,
       parseJobStateFromAgentResult,
       parseReproOutput,
@@ -17896,7 +18121,7 @@ var init_scripts = __esm({
       writeJobStateFile,
       appendCompanyActivity,
       appendCompanyIntentDecision: appendCompanyIntentDecision2,
-      applyCompanyManagerDecision,
+      applyAgencyArchitectDecision,
       requireFeedbackActions,
       requirePlanDeviations,
       verify,
@@ -17946,53 +18171,53 @@ var init_scripts = __esm({
 // src/stateWorkspace.ts
 import { execFileSync as execFileSync24 } from "child_process";
 import * as crypto3 from "crypto";
-import * as fs43 from "fs";
+import * as fs44 from "fs";
 import * as os7 from "os";
-import * as path41 from "path";
+import * as path42 from "path";
 function writeLocalFile(cwd, relativePath, content) {
-  const fullPath = path41.join(cwd, relativePath);
-  fs43.mkdirSync(path41.dirname(fullPath), { recursive: true });
-  fs43.writeFileSync(fullPath, content);
+  const fullPath = path42.join(cwd, relativePath);
+  fs44.mkdirSync(path42.dirname(fullPath), { recursive: true });
+  fs44.writeFileSync(fullPath, content);
 }
 function copyPath(source, target) {
-  const st = fs43.lstatSync(source);
-  fs43.rmSync(target, { recursive: true, force: true });
+  const st = fs44.lstatSync(source);
+  fs44.rmSync(target, { recursive: true, force: true });
   if (st.isSymbolicLink()) return;
-  fs43.mkdirSync(path41.dirname(target), { recursive: true });
-  fs43.cpSync(source, target, { recursive: true, force: true });
+  fs44.mkdirSync(path42.dirname(target), { recursive: true });
+  fs44.cpSync(source, target, { recursive: true, force: true });
 }
 function overlayDirectoryChildren(cwd, sourceDir, localDir) {
-  if (!fs43.existsSync(sourceDir)) return;
-  for (const entry of fs43.readdirSync(sourceDir, { withFileTypes: true })) {
-    const source = path41.join(sourceDir, entry.name);
-    const target = path41.join(cwd, localDir, entry.name);
+  if (!fs44.existsSync(sourceDir)) return;
+  for (const entry of fs44.readdirSync(sourceDir, { withFileTypes: true })) {
+    const source = path42.join(sourceDir, entry.name);
+    const target = path42.join(cwd, localDir, entry.name);
     copyPath(source, target);
   }
 }
 function hydrateStateWorkspace(config, cwd) {
   if (process.env.VITEST && process.env[TEST_FETCH_ENV] !== "1") return;
   const parsed = parseStateRepo(config);
-  const hydrateKey = `${path41.resolve(cwd)}|${parsed.owner}/${parsed.repo}|${parsed.basePath}|${parsed.branch}`;
+  const hydrateKey = `${path42.resolve(cwd)}|${parsed.owner}/${parsed.repo}|${parsed.basePath}|${parsed.branch}`;
   if (hydratedWorkspaces.has(hydrateKey)) return;
   const snapshotRoot = fetchStateSnapshot(parsed);
   for (const mapping of DIR_MAPPINGS) {
-    overlayDirectoryChildren(cwd, path41.join(snapshotRoot, mapping.stateDir), mapping.localDir);
+    overlayDirectoryChildren(cwd, path42.join(snapshotRoot, mapping.stateDir), mapping.localDir);
   }
   for (const mapping of FILE_MAPPINGS) {
-    const source = path41.join(snapshotRoot, mapping.statePath);
-    if (fs43.existsSync(source) && !fs43.lstatSync(source).isSymbolicLink() && fs43.statSync(source).isFile()) {
-      writeLocalFile(cwd, mapping.localPath, fs43.readFileSync(source, "utf-8"));
+    const source = path42.join(snapshotRoot, mapping.statePath);
+    if (fs44.existsSync(source) && !fs44.lstatSync(source).isSymbolicLink() && fs44.statSync(source).isFile()) {
+      writeLocalFile(cwd, mapping.localPath, fs44.readFileSync(source, "utf-8"));
     }
   }
   hydratedWorkspaces.add(hydrateKey);
 }
 function fetchStateSnapshot(parsed) {
-  const cacheDir = path41.join(cacheRoot2(), cacheKey2(parsed));
+  const cacheDir = path42.join(cacheRoot2(), cacheKey3(parsed));
   const url = `https://github.com/${parsed.owner}/${parsed.repo}.git`;
   try {
-    fs43.mkdirSync(path41.dirname(cacheDir), { recursive: true });
-    if (!fs43.existsSync(path41.join(cacheDir, ".git"))) {
-      fs43.rmSync(cacheDir, { recursive: true, force: true });
+    fs44.mkdirSync(path42.dirname(cacheDir), { recursive: true });
+    if (!fs44.existsSync(path42.join(cacheDir, ".git"))) {
+      fs44.rmSync(cacheDir, { recursive: true, force: true });
       runGit3(["clone", "--no-checkout", "--filter=blob:none", url, cacheDir]);
     }
     runGit3(["-C", cacheDir, "remote", "set-url", "origin", url]);
@@ -18007,12 +18232,12 @@ function fetchStateSnapshot(parsed) {
       `stateWorkspace: failed to fetch ${parsed.owner}/${parsed.repo}:${parsed.basePath}@${parsed.branch}: ${msg}`
     );
   }
-  return path41.join(cacheDir, parsed.basePath);
+  return path42.join(cacheDir, parsed.basePath);
 }
 function cacheRoot2() {
-  return process.env[CACHE_ENV2]?.trim() || path41.join(os7.homedir(), ".cache", "kody", "state-repo");
+  return process.env[CACHE_ENV2]?.trim() || path42.join(os7.homedir(), ".cache", "kody", "state-repo");
 }
-function cacheKey2(parsed) {
+function cacheKey3(parsed) {
   return crypto3.createHash("sha256").update(`${parsed.owner}/${parsed.repo}#${parsed.branch}#${parsed.basePath}`).digest("hex").slice(0, 24);
 }
 function runGit3(args) {
@@ -18050,15 +18275,15 @@ var init_stateWorkspace = __esm({
     "use strict";
     init_stateRepo();
     DIR_MAPPINGS = [
-      { stateDir: "capabilities", localDir: path41.join(".kody", "capabilities") },
-      { stateDir: "agents", localDir: path41.join(".kody", "agents") },
-      { stateDir: "context", localDir: path41.join(".kody", "context") },
-      { stateDir: "memory", localDir: path41.join(".kody", "memory") }
+      { stateDir: "capabilities", localDir: path42.join(".kody", "capabilities") },
+      { stateDir: "agents", localDir: path42.join(".kody", "agents") },
+      { stateDir: "context", localDir: path42.join(".kody", "context") },
+      { stateDir: "memory", localDir: path42.join(".kody", "memory") }
     ];
     FILE_MAPPINGS = [
-      { statePath: "instructions.md", localPath: path41.join(".kody", "instructions.md") },
-      { statePath: "variables.json", localPath: path41.join(".kody", "variables.json") },
-      { statePath: "secrets.enc", localPath: path41.join(".kody", "secrets.enc") }
+      { statePath: "instructions.md", localPath: path42.join(".kody", "instructions.md") },
+      { statePath: "variables.json", localPath: path42.join(".kody", "variables.json") },
+      { statePath: "secrets.enc", localPath: path42.join(".kody", "secrets.enc") }
     ];
     CACHE_ENV2 = "KODY_STATE_REPO_CACHE";
     TEST_FETCH_ENV = "KODY_STATE_WORKSPACE_FETCH_FOR_TESTS";
@@ -18132,8 +18357,8 @@ var init_tools = __esm({
 
 // src/executor.ts
 import { spawn as spawn7 } from "child_process";
-import * as fs44 from "fs";
-import * as path42 from "path";
+import * as fs45 from "fs";
+import * as path43 from "path";
 function isMutatingPostflight(scriptName) {
   return MUTATING_POSTFLIGHTS.has(scriptName ?? "");
 }
@@ -18314,7 +18539,7 @@ async function runExecutable(profileName, input) {
   const jobWhyBlock = typeof ctx.data.jobWhy === "string" ? operatorRequestBlock(ctx.data.jobWhy) : null;
   const jobRefBlock = jobReferenceBlock(profileName, profile, ctx.data);
   const invokeAgent = async (prompt) => {
-    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path42.isAbsolute(p) ? p : path42.resolve(profile.dir, p)).filter((p) => p.length > 0);
+    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path43.isAbsolute(p) ? p : path43.resolve(profile.dir, p)).filter((p) => p.length > 0);
     const syntheticPath = ctx.data.syntheticPluginPath;
     const pluginPaths = [...externalPlugins, ...syntheticPath ? [syntheticPath] : []];
     const agents = loadSubagents(profile);
@@ -18707,17 +18932,17 @@ function clearStampedLifecycleLabels(profile, ctx) {
 function resolveProfilePath(profileName) {
   const found = resolveExecutable(profileName);
   if (found) return found;
-  const here = path42.dirname(new URL(import.meta.url).pathname);
+  const here = path43.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path42.join(here, "executables", profileName, "profile.json"),
+    path43.join(here, "executables", profileName, "profile.json"),
     // same-dir sibling (dev)
-    path42.join(here, "..", "executables", profileName, "profile.json"),
+    path43.join(here, "..", "executables", profileName, "profile.json"),
     // up one (prod: dist/bin → dist/executables)
-    path42.join(here, "..", "src", "executables", profileName, "profile.json")
+    path43.join(here, "..", "src", "executables", profileName, "profile.json")
     // fallback
   ];
   for (const c of candidates) {
-    if (fs44.existsSync(c)) return c;
+    if (fs45.existsSync(c)) return c;
   }
   return candidates[0];
 }
@@ -18832,8 +19057,8 @@ function resolveShellTimeoutMs(entry) {
 }
 async function runShellEntry(entry, ctx, profile) {
   const shellName = entry.shell;
-  const shellPath = path42.join(profile.dir, shellName);
-  if (!fs44.existsSync(shellPath)) {
+  const shellPath = path43.join(profile.dir, shellName);
+  if (!fs45.existsSync(shellPath)) {
     ctx.skipAgent = true;
     ctx.output.exitCode = 99;
     ctx.output.reason = `shell script not found: ${shellName} (looked in ${profile.dir})`;
@@ -18983,8 +19208,8 @@ var init_executor = __esm({
 });
 
 // src/workflowDefinitions.ts
-import * as fs45 from "fs";
-import * as path43 from "path";
+import * as fs46 from "fs";
+import * as path44 from "path";
 function isWorkflowDefinitionId(value) {
   return WORKFLOW_ID_PATTERN.test(value);
 }
@@ -18998,13 +19223,11 @@ function normalizeWorkflowDefinition(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const raw = value;
   const name = typeof raw.name === "string" ? raw.name.trim() : "";
-  const instructions = typeof raw.instructions === "string" ? raw.instructions.trim() : "";
   const capabilities = normalizeWorkflowCapabilities(raw.capabilities);
-  if (!name || !instructions || capabilities.length === 0) return null;
+  if (!name || capabilities.length === 0) return null;
   return {
     version: 1,
     name,
-    instructions,
     capabilities,
     ...typeof raw.createdAt === "string" ? { createdAt: raw.createdAt } : {},
     ...typeof raw.updatedAt === "string" ? { updatedAt: raw.updatedAt } : {}
@@ -19018,17 +19241,17 @@ function readWorkflowDefinition(config, cwd, id) {
 function workflowDefinitionToCapabilityFolder(id, workflow, source = workflowDefinitionPath(id)) {
   return {
     slug: id,
-    dir: path43.dirname(source),
+    dir: path44.dirname(source),
     profilePath: source,
     bodyPath: source,
     title: workflow.name,
-    body: workflow.instructions,
-    rawBody: workflow.instructions,
+    body: "",
+    rawBody: "",
     rawProfile: { name: id, workflow },
     config: {
       action: id,
       workflow: workflowDefinitionToConfig(workflow),
-      describe: workflow.instructions
+      describe: workflow.name
     }
   };
 }
@@ -19053,9 +19276,9 @@ function workflowDefinitionToConfig(workflow) {
 function readCompanyStoreWorkflowDefinition(id) {
   const root = getCompanyStoreAssetRoot("workflows");
   if (!root) return null;
-  const filePath = path43.join(root, id, "workflow.json");
-  if (!fs45.existsSync(filePath)) return null;
-  return parseWorkflowDefinition(fs45.readFileSync(filePath, "utf8"));
+  const filePath = path44.join(root, id, "workflow.json");
+  if (!fs46.existsSync(filePath)) return null;
+  return parseWorkflowDefinition(fs46.readFileSync(filePath, "utf8"));
 }
 function parseWorkflowDefinition(content) {
   try {
@@ -19087,7 +19310,7 @@ __export(job_exports, {
   stableJobKey: () => stableJobKey,
   validateJob: () => validateJob
 });
-import * as path44 from "path";
+import * as path45 from "path";
 function newJobId(flavor) {
   localJobSeq += 1;
   const runId = process.env.GITHUB_RUN_ID;
@@ -19139,7 +19362,7 @@ function parseCapabilityResultTarget(raw) {
 async function runJob(job, base) {
   const valid = validateJob(job);
   const action = valid.action ?? valid.capability;
-  const projectCapabilitiesRoot = path44.join(base.cwd, ".kody", "capabilities");
+  const projectCapabilitiesRoot = path45.join(base.cwd, ".kody", "capabilities");
   const resolvedCapability = !valid.workflow && action ? resolveCapabilityAction(action, projectCapabilitiesRoot) : null;
   const capabilityIdentity = valid.capability ?? resolvedCapability?.capability;
   const capabilityContext = valid.workflow ? null : loadCapabilityContext(capabilityIdentity, base.cwd);
@@ -19152,7 +19375,7 @@ async function runJob(job, base) {
   }
   const workflow = capabilityContext?.config.workflow ?? workflowContext?.config.workflow;
   const workflowIdentity = valid.workflow ?? capabilityIdentity ?? workflowContext?.slug;
-  const capabilitySelectedExecutable = resolvedCapability?.executable ?? capabilityContext?.config.executable ?? capabilityContext?.config.executables?.[0] ?? (capabilityContext?.config.role ? capabilityContext.slug : void 0) ?? (capabilityContext?.config.tickScript ? "capability-tick-scripted" : void 0);
+  const capabilitySelectedExecutable = resolvedCapability?.executable ?? capabilityContext?.config.implementation ?? capabilityContext?.config.executable ?? capabilityContext?.config.executables?.[0] ?? (capabilityContext?.config.role ? capabilityContext.slug : void 0) ?? (capabilityContext?.config.tickScript ? "capability-tick-scripted" : void 0);
   const profileName = valid.executable ?? capabilitySelectedExecutable;
   if (workflow && shouldRunCapabilityWorkflow(valid, workflow, workflowIdentity, capabilitySelectedExecutable, base)) {
     const workflowCapability = capabilityContext ?? workflowContext;
@@ -19325,7 +19548,7 @@ function shouldRunWorkflowStep(step, data) {
   if (!step.runWhen) return true;
   const context = workflowConditionContext(data);
   return Object.entries(step.runWhen).every(
-    ([path50, expected]) => valueMatches(resolveDottedPath2(context, path50), expected)
+    ([path51, expected]) => valueMatches(resolveDottedPath2(context, path51), expected)
   );
 }
 function canContinueWorkflow(step, outcome) {
@@ -19395,7 +19618,7 @@ function composeStepWhy(parentWhy, step) {
 }
 function loadCapabilityContext(slug2, cwd) {
   if (!slug2) return null;
-  return resolveCapabilityFolder(slug2, path44.join(cwd, ".kody", "capabilities"));
+  return resolveCapabilityFolder(slug2, path45.join(cwd, ".kody", "capabilities"));
 }
 function loadWorkflowContext(slug2, base) {
   if (!slug2 || !base.config || !isWorkflowDefinitionId(slug2)) return null;
@@ -19553,9 +19776,9 @@ function translateOpenAISseToBrain(opts) {
 }
 
 // src/servers/brain-serve.ts
-import * as fs48 from "fs";
+import * as fs49 from "fs";
 import { createServer as createServer2 } from "http";
-import * as path47 from "path";
+import * as path48 from "path";
 
 // src/chat/loop.ts
 init_agent();
@@ -20231,8 +20454,8 @@ init_config();
 
 // src/kody-cli.ts
 import { execFileSync as execFileSync26 } from "child_process";
-import * as fs46 from "fs";
-import * as path45 from "path";
+import * as fs47 from "fs";
+import * as path46 from "path";
 
 // src/app-auth.ts
 import { createSign } from "crypto";
@@ -20735,6 +20958,7 @@ init_gha();
 init_issue();
 init_job();
 init_lifecycleLabels();
+init_companyStore();
 init_registry();
 
 // src/run-request.ts
@@ -20805,6 +21029,9 @@ var FAILED_DISPATCH_LABEL = {
   color: "e11d21",
   description: "Kody failed or rejected the run"
 };
+function objectValue2(value) {
+  return value && typeof value === "object" ? value : void 0;
+}
 var CI_HELP = `kody ci \u2014 minimal-YAML autonomous engineer (CI preflight + run)
 
 Usage:
@@ -20962,9 +21189,9 @@ async function resolveAuthToken(env = process.env) {
   return void 0;
 }
 function detectPackageManager2(cwd) {
-  if (fs46.existsSync(path45.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs46.existsSync(path45.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs46.existsSync(path45.join(cwd, "bun.lockb"))) return "bun";
+  if (fs47.existsSync(path46.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs47.existsSync(path46.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs47.existsSync(path46.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function shouldChainScheduledWatch(match) {
@@ -21057,8 +21284,8 @@ function postFailureTail(issueNumber, cwd, reason) {
   const logPath = lastRunLogPath(cwd);
   let tail = "";
   try {
-    if (fs46.existsSync(logPath)) {
-      const content = fs46.readFileSync(logPath, "utf-8");
+    if (fs47.existsSync(logPath)) {
+      const content = fs47.readFileSync(logPath, "utf-8");
       tail = content.slice(-3e3);
     }
   } catch {
@@ -21087,7 +21314,7 @@ async function runCi(argv) {
     return 0;
   }
   const args = parseCiArgs(argv);
-  const cwd = args.cwd ? path45.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path46.resolve(args.cwd) : process.cwd();
   let earlyConfig;
   let earlyConfigError;
   try {
@@ -21110,6 +21337,9 @@ async function runCi(argv) {
 `);
     return 64;
   }
+  if (parsedRunRequest && "request" in parsedRunRequest) {
+    applyCompanyStoreRuntimeConfig(parsedRunRequest.request.input);
+  }
   if (!args.issueNumber && !autoFallback && parsedRunRequest && "request" in parsedRunRequest) {
     const route = routeRunRequest(parsedRunRequest.request);
     if (route.kind === "error") {
@@ -21133,13 +21363,15 @@ async function runCi(argv) {
       forceRunCliArgs = { goal: envForceMessage };
     }
   }
-  if (!args.issueNumber && !autoFallback && !forceRunAction && !runRequestFanOut && eventName === "workflow_dispatch" && dispatchEventPath && fs46.existsSync(dispatchEventPath)) {
+  if (!args.issueNumber && !autoFallback && !forceRunAction && !runRequestFanOut && eventName === "workflow_dispatch" && dispatchEventPath && fs47.existsSync(dispatchEventPath)) {
     try {
-      const evt = JSON.parse(fs46.readFileSync(dispatchEventPath, "utf-8"));
-      const issueInput = parseInt(String(evt?.inputs?.issue_number ?? ""), 10);
-      const sessionInput = String(evt?.inputs?.sessionId ?? "");
-      const capabilityInput = String(evt?.inputs?.capability ?? evt?.inputs?.executable ?? "").trim();
-      const messageInput = String(evt?.inputs?.message ?? "").trim();
+      const evt = JSON.parse(fs47.readFileSync(dispatchEventPath, "utf-8"));
+      const inputs = objectValue2(evt.inputs);
+      applyCompanyStoreRuntimeConfig(inputs);
+      const issueInput = parseInt(String(inputs?.issue_number ?? ""), 10);
+      const sessionInput = String(inputs?.sessionId ?? "");
+      const capabilityInput = String(inputs?.capability ?? inputs?.executable ?? "").trim();
+      const messageInput = String(inputs?.message ?? "").trim();
       const noTarget = !sessionInput && !(Number.isFinite(issueInput) && issueInput > 0);
       if (noTarget && capabilityInput) {
         forceRunAction = capabilityInput;
@@ -21497,8 +21729,8 @@ init_repoWorkspace();
 
 // src/scripts/brainTurnLog.ts
 init_runtimePaths();
-import * as fs47 from "fs";
-import * as path46 from "path";
+import * as fs48 from "fs";
+import * as path47 from "path";
 import posixPath4 from "path/posix";
 var live = /* @__PURE__ */ new Map();
 function brainEventsFilePath(dir, chatId) {
@@ -21509,8 +21741,8 @@ function brainEventsStatePath(chatId) {
 }
 function lastPersistedSeq(dir, chatId) {
   const p = brainEventsFilePath(dir, chatId);
-  if (!fs47.existsSync(p)) return 0;
-  const lines = fs47.readFileSync(p, "utf-8").split("\n").filter(Boolean);
+  if (!fs48.existsSync(p)) return 0;
+  const lines = fs48.readFileSync(p, "utf-8").split("\n").filter(Boolean);
   if (lines.length === 0) return 0;
   try {
     return JSON.parse(lines[lines.length - 1]).seq || 0;
@@ -21520,9 +21752,9 @@ function lastPersistedSeq(dir, chatId) {
 }
 function readSince(dir, chatId, since) {
   const p = brainEventsFilePath(dir, chatId);
-  if (!fs47.existsSync(p)) return [];
+  if (!fs48.existsSync(p)) return [];
   const out = [];
-  for (const line of fs47.readFileSync(p, "utf-8").split("\n")) {
+  for (const line of fs48.readFileSync(p, "utf-8").split("\n")) {
     if (!line) continue;
     try {
       const rec = JSON.parse(line);
@@ -21548,12 +21780,12 @@ function beginTurn(dir, chatId) {
   };
   live.set(chatId, state);
   const p = brainEventsFilePath(dir, chatId);
-  fs47.mkdirSync(path46.dirname(p), { recursive: true });
+  fs48.mkdirSync(path47.dirname(p), { recursive: true });
   return (event) => {
     state.seq += 1;
     const rec = { seq: state.seq, turn, ts: Date.now(), event };
     try {
-      fs47.appendFileSync(p, `${JSON.stringify(rec)}
+      fs48.appendFileSync(p, `${JSON.stringify(rec)}
 `);
     } catch (err) {
       process.stderr.write(
@@ -21592,7 +21824,7 @@ function endTurnIfUnterminated(dir, chatId, errMessage) {
     event: { type: "error", error: errMessage || "turn ended unexpectedly", chatId }
   };
   try {
-    fs47.appendFileSync(brainEventsFilePath(dir, chatId), `${JSON.stringify(rec)}
+    fs48.appendFileSync(brainEventsFilePath(dir, chatId), `${JSON.stringify(rec)}
 `);
   } catch {
   }
@@ -21916,7 +22148,7 @@ async function handleChatTurn(req, res, chatId, opts) {
       );
     }
   }
-  fs48.mkdirSync(path47.dirname(sessionFile), { recursive: true });
+  fs49.mkdirSync(path48.dirname(sessionFile), { recursive: true });
   appendTurn(sessionFile, {
     role: "user",
     content: message,
@@ -21991,7 +22223,7 @@ async function handleChatTurn(req, res, chatId, opts) {
 function buildServer(opts) {
   const runTurn = opts.runTurn ?? runChatTurn;
   const cloneRepo = opts.cloneRepo ?? defaultCloneRepo;
-  const reposRoot = opts.reposRoot ?? path47.join(path47.dirname(path47.resolve(opts.cwd)), "repos");
+  const reposRoot = opts.reposRoot ?? path48.join(path48.dirname(path48.resolve(opts.cwd)), "repos");
   return createServer2(async (req, res) => {
     if (!req.method || !req.url) {
       sendJson(res, 400, { error: "bad request" });
@@ -22594,8 +22826,8 @@ async function loadConfigSafe() {
 }
 
 // src/chat-cli.ts
-import * as fs50 from "fs";
-import * as path49 from "path";
+import * as fs51 from "fs";
+import * as path50 from "path";
 
 // src/chat/inbox.ts
 import { execFileSync as execFileSync27 } from "child_process";
@@ -22667,8 +22899,8 @@ function currentBranch(cwd) {
 
 // src/chat/state-sync.ts
 init_stateRepo();
-import * as fs49 from "fs";
-import * as path48 from "path";
+import * as fs50 from "fs";
+import * as path49 from "path";
 function jsonlLines2(text) {
   return text.split("\n").filter((line) => line.length > 0);
 }
@@ -22685,15 +22917,15 @@ function mergeJsonl2(localText, remoteText) {
 function syncJsonlFileFromState(opts) {
   const remote = readStateText(opts.config, opts.cwd, opts.statePath);
   if (!remote) return;
-  const local = fs49.existsSync(opts.localPath) ? fs49.readFileSync(opts.localPath, "utf-8") : "";
+  const local = fs50.existsSync(opts.localPath) ? fs50.readFileSync(opts.localPath, "utf-8") : "";
   const next = mergeJsonl2(local, remote.content);
   if (next === local) return;
-  fs49.mkdirSync(path48.dirname(opts.localPath), { recursive: true });
-  fs49.writeFileSync(opts.localPath, next);
+  fs50.mkdirSync(path49.dirname(opts.localPath), { recursive: true });
+  fs50.writeFileSync(opts.localPath, next);
 }
 function persistJsonlFileToState(opts) {
-  if (!fs49.existsSync(opts.localPath)) return;
-  const localText = fs49.readFileSync(opts.localPath, "utf-8");
+  if (!fs50.existsSync(opts.localPath)) return;
+  const localText = fs50.readFileSync(opts.localPath, "utf-8");
   for (let attempt = 1; attempt <= 3; attempt += 1) {
     const remote = readStateText(opts.config, opts.cwd, opts.statePath);
     const body = mergeJsonl2(localText, remote?.content ?? "");
@@ -22877,6 +23109,7 @@ async function emit2(sink, type, sessionId, suffix, payload) {
 init_config();
 init_litellm();
 init_stateWorkspace();
+init_companyStore();
 var DEFAULT_MODEL2 = "claude/claude-haiku-4-5-20251001";
 var CHAT_HELP = `kody chat \u2014 dashboard-driven chat session
 
@@ -22957,8 +23190,12 @@ async function runChat(argv) {
 ${CHAT_HELP}`);
     return 64;
   }
-  const cwd = args.cwd ? path49.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path50.resolve(args.cwd) : process.cwd();
   const sessionId = args.sessionId;
+  const runRequest = readRunRequestFromEnv();
+  if (runRequest && "request" in runRequest) {
+    applyCompanyStoreRuntimeConfig(runRequest.request.input);
+  }
   const unpackedSecrets = unpackAllSecrets();
   if (unpackedSecrets > 0) {
     process.stdout.write(`\u2192 kody: unpacked ${unpackedSecrets} secret(s) from ALL_SECRETS
@@ -23018,7 +23255,7 @@ ${CHAT_HELP}`);
   const sink = buildSink(cwd, sessionId, args.dashboardUrl);
   const meta = readMeta(sessionFile);
   process.stdout.write(
-    `\u2192 kody:chat: session file=${sessionFile} exists=${fs50.existsSync(sessionFile)} meta=${meta ? meta.mode : "none"}
+    `\u2192 kody:chat: session file=${sessionFile} exists=${fs51.existsSync(sessionFile)} meta=${meta ? meta.mode : "none"}
 `
   );
   try {
@@ -23130,42 +23367,8 @@ async function runCapabilityFallbackTick(deps) {
   return { ran: true, claimed };
 }
 
-// src/pool/keys.ts
-import { hkdfSync as hkdfSync2 } from "crypto";
-var POOL_API_KEY_INFO = "kody-pool-api:v1";
-var RUNNER_API_KEY_INFO = "kody-runner-api:v1";
-function masterKeyBytes(raw) {
-  const v = raw.trim();
-  if (!v) throw new Error("KODY_MASTER_KEY is empty");
-  if (/^[0-9a-fA-F]+$/.test(v) && v.length === 64) {
-    return Buffer.from(v, "hex");
-  }
-  return Buffer.from(v.replace(/-/g, "+").replace(/_/g, "/"), "base64");
-}
-function deriveKey(master, info, length = 32) {
-  return Buffer.from(hkdfSync2("sha256", master, Buffer.alloc(0), info, length)).toString("hex");
-}
-function derivePoolApiKey(master) {
-  return deriveKey(master, POOL_API_KEY_INFO);
-}
-function deriveRunnerApiKey(master) {
-  return deriveKey(master, RUNNER_API_KEY_INFO);
-}
-function bearerOk(headerAuth, xApiKey, expected) {
-  const x = (xApiKey ?? "").trim();
-  if (x && timingEqual(x, expected)) return true;
-  const a = (headerAuth ?? "").trim();
-  if (a.toLowerCase().startsWith("bearer ")) {
-    return timingEqual(a.slice(7).trim(), expected);
-  }
-  return false;
-}
-function timingEqual(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
+// src/servers/pool-serve.ts
+init_keys();
 
 // src/pool/fly.ts
 var FLY_API_BASE = "https://api.machines.dev/v1";
@@ -23182,8 +23385,8 @@ var FlyClient = class {
   get fetch() {
     return this.opts.fetchImpl ?? fetch;
   }
-  async call(path50, init = {}) {
-    const res = await this.fetch(`${FLY_API_BASE}${path50}`, {
+  async call(path51, init = {}) {
+    const res = await this.fetch(`${FLY_API_BASE}${path51}`, {
       method: init.method ?? "GET",
       headers: {
         Authorization: `Bearer ${this.opts.token}`,
@@ -23194,7 +23397,7 @@ var FlyClient = class {
     if (res.status === 404 && init.allow404) return null;
     if (!res.ok) {
       const text = await res.text().catch(() => "");
-      throw new Error(`Fly API ${res.status} on ${path50}: ${text.slice(0, 200) || res.statusText}`);
+      throw new Error(`Fly API ${res.status} on ${path51}: ${text.slice(0, 200) || res.statusText}`);
     }
     if (res.status === 204) return null;
     const raw = await res.text();
@@ -23530,59 +23733,8 @@ function isSuspendedWithIp(m) {
   return (m.state === "suspended" || m.state === "suspending") && !!m.private_ip;
 }
 
-// src/pool/vault.ts
-init_stateRepoGithub();
-import { createDecipheriv as createDecipheriv2 } from "crypto";
-var VAULT_PATH = "secrets.enc";
-var CACHE_TTL_MS = 6e4;
-var cache = /* @__PURE__ */ new Map();
-function decryptVault(payload, masterKey) {
-  const parts = payload.split(":");
-  if (parts.length !== 4 || parts[0] !== "v1") {
-    throw new Error("invalid vault payload format");
-  }
-  const [, ivB64, ctB64, tagB64] = parts;
-  const iv = Buffer.from(ivB64, "base64");
-  const ct = Buffer.from(ctB64, "base64");
-  const tag = Buffer.from(tagB64, "base64");
-  const decipher = createDecipheriv2("aes-256-gcm", masterKey, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
-}
-async function readVaultSecrets(opts) {
-  const key = `${opts.owner}/${opts.repo}`.toLowerCase();
-  const hit = cache.get(key);
-  if (hit && hit.expiresAt > Date.now()) return hit.secrets;
-  const file = await readGithubStateText({
-    owner: opts.owner,
-    repo: opts.repo,
-    filePath: VAULT_PATH,
-    githubToken: opts.githubToken,
-    fetchImpl: opts.fetchImpl
-  });
-  if (!file) {
-    cache.set(key, { secrets: {}, expiresAt: Date.now() + CACHE_TTL_MS });
-    return {};
-  }
-  const ciphertext = file.content.trim();
-  const doc = JSON.parse(decryptVault(ciphertext, opts.masterKey));
-  const flat = {};
-  for (const [name, entry] of Object.entries(doc.secrets ?? {})) {
-    if (entry && typeof entry.value === "string") flat[name] = entry.value;
-  }
-  cache.set(key, { secrets: flat, expiresAt: Date.now() + CACHE_TTL_MS });
-  return flat;
-}
-async function readRepoSecret(opts) {
-  const secrets = await readVaultSecrets(opts);
-  const v = secrets[opts.name];
-  return v?.trim() ? v : null;
-}
-async function readRepoSecrets(opts) {
-  return readVaultSecrets(opts);
-}
-
 // src/pool/registry.ts
+init_stateRepoVault();
 var POOL_MIN_VAULT_KEY = "POOL_MIN";
 var POOL_MIN_MAX = 10;
 function parsePoolMin(raw, dflt) {
@@ -23963,7 +24115,7 @@ async function poolServe() {
 
 // src/servers/runner-serve.ts
 import { spawn as spawn8 } from "child_process";
-import * as fs51 from "fs";
+import * as fs52 from "fs";
 import { createServer as createServer6 } from "http";
 var DEFAULT_PORT2 = 8080;
 var DEFAULT_WORKDIR = "/workspace/repo";
@@ -24098,8 +24250,8 @@ async function defaultRunJob(job) {
   const workdir = process.env.RUNNER_WORKDIR ?? DEFAULT_WORKDIR;
   const branch = job.ref ?? "main";
   const authUrl = `https://x-access-token:${job.githubToken}@github.com/${job.repo}.git`;
-  fs51.rmSync(workdir, { recursive: true, force: true });
-  fs51.mkdirSync(workdir, { recursive: true });
+  fs52.rmSync(workdir, { recursive: true, force: true });
+  fs52.mkdirSync(workdir, { recursive: true });
   const allSecrets = typeof job.allSecrets === "string" ? job.allSecrets : JSON.stringify(job.allSecrets ?? {});
   const target = job.runRequest.target;
   const interactive = target.type === "chat";