npm - @kody-ade/kody-engine - Versions diffs - 0.4.307 → 0.4.309 - Mend

@kody-ade/kody-engine 0.4.307 → 0.4.309

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/dist/bin/kody.js +581 -316
package/package.json +1 -1

package/dist/bin/kody.js CHANGED Viewed

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.307",
+      version: "0.4.309",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
       license: "MIT",
       type: "module",
@@ -1610,7 +1610,7 @@ function cmsHeaders(opts) {
     }
   };
 }
-async function callDashboardCms(opts, path50, init = {}) {
+async function callDashboardCms(opts, path51, init = {}) {
   const baseUrl = dashboardBaseUrl(opts);
   if (!baseUrl) {
     return {
@@ -1622,7 +1622,7 @@ async function callDashboardCms(opts, path50, init = {}) {
   const headerResult = cmsHeaders(opts);
   if (!headerResult.ok) return headerResult;
   try {
-    const res = await fetch(`${baseUrl}${path50}`, {
+    const res = await fetch(`${baseUrl}${path51}`, {
       ...init,
       headers: {
         ...headerResult.headers,
@@ -1694,8 +1694,8 @@ function documentArg(value) {
 function normalizeCmsDocumentIdInput(input) {
   const trimmed = stripWrappingQuotes(input.trim());
   const withoutQuery = trimmed.split(/[?#]/, 1)[0] ?? trimmed;
-  const path50 = parseDocumentPath(withoutQuery);
-  return path50 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
+  const path51 = parseDocumentPath(withoutQuery);
+  return path51 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
 }
 function stripWrappingQuotes(value) {
   let current = value;
@@ -1706,9 +1706,9 @@ function stripWrappingQuotes(value) {
   }
 }
 function parseDocumentPath(value) {
-  const path50 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
-  if (!path50?.includes("/content/entries/")) return null;
-  const parts = path50.split("/").filter(Boolean).map(decodePathPart);
+  const path51 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
+  if (!path51?.includes("/content/entries/")) return null;
+  const parts = path51.split("/").filter(Boolean).map(decodePathPart);
   const entriesIndex = parts.findIndex((part, index) => part === "content" && parts[index + 1] === "entries");
   const idPart = parts[entriesIndex + 3];
   if (!idPart || idPart === "new") return null;
@@ -2041,6 +2041,23 @@ function getCompanyStoreAssetRoot(kind) {
   if (fs5.existsSync(rootLayoutPath)) return rootLayoutPath;
   return path7.join(root, ".kody", folderByKind[kind]);
 }
+function resetCompanyStoreCacheForTests() {
+  memo = null;
+}
+function applyCompanyStoreRuntimeConfig(input, env = process.env) {
+  const repo = stringValue(input?.storeRepoUrl ?? input?.storeRepo);
+  const ref = stringValue(input?.storeRef);
+  let changed = false;
+  if (repo && env[STORE_ENV] !== repo) {
+    env[STORE_ENV] = repo;
+    changed = true;
+  }
+  if (ref && env[REF_ENV] !== ref) {
+    env[REF_ENV] = ref;
+    changed = true;
+  }
+  if (changed) resetCompanyStoreCacheForTests();
+}
 function resolveCompanyStore() {
   const envStore = process.env[STORE_ENV]?.trim();
   if (!envStore && process.env.VITEST) return null;
@@ -2050,6 +2067,9 @@ function resolveCompanyStore() {
   if (!ref) return null;
   return { repo, ref };
 }
+function stringValue(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
 function fetchCompanyStore(repo, ref) {
   const localRoot = localStoreRoot(repo);
   if (localRoot) return localRoot;
@@ -6897,10 +6917,10 @@ var init_state2 = __esm({
     "use strict";
     VALID_STATES = /* @__PURE__ */ new Set(["active", "abandoned", "closed", "done"]);
     GoalStateError = class extends Error {
-      constructor(path50, message) {
-        super(`Invalid goal state at ${path50}:
+      constructor(path51, message) {
+        super(`Invalid goal state at ${path51}:
   ${message}`);
-        this.path = path50;
+        this.path = path51;
         this.name = "GoalStateError";
       }
       path;
@@ -6913,9 +6933,9 @@ import * as fs25 from "fs";
 function stageGoalRunLogEvent(data, goalId, event, at = nowIso()) {
   const logs = goalRunLogs(data);
   const existing = logs[goalId];
-  const path50 = existing?.path ?? goalRunLogPath(goalId, data);
+  const path51 = existing?.path ?? goalRunLogPath(goalId, data);
   logs[goalId] = {
-    path: path50,
+    path: path51,
     events: [...existing?.events ?? [], buildGoalRunLogEvent(data, goalId, event, at)]
   };
 }
@@ -7002,7 +7022,7 @@ function goalRunStartedAt(data) {
 function goalRunId(data) {
   const existing = data[LOG_RUN_KEY];
   if (typeof existing === "string" && existing.length > 0) return existing;
-  const raw = stringValue(data.jobId) ?? githubRunId() ?? `local-${process.pid}-${Date.now()}`;
+  const raw = stringValue2(data.jobId) ?? githubRunId() ?? `local-${process.pid}-${Date.now()}`;
   const safe = safePathSegment(raw);
   data[LOG_RUN_KEY] = safe;
   return safe;
@@ -7032,17 +7052,77 @@ function enrichGoalRunLogEvent(config, data, logPath, event) {
   const stateRepo = stateRepoContext(config, event.goalId, logPath);
   const trigger = event.trigger ?? triggerContext();
   const job = event.job ?? jobContext(data);
-  return pruneUndefined({
+  const run = event.run ?? runContext(data);
+  const links = event.links ?? linkContext(stateRepo);
+  const enriched = pruneUndefined({
     ...event,
-    run: event.run ?? runContext(data),
+    run,
     repo: event.repo ?? repoContext(config),
     stateRepo: event.stateRepo ?? stateRepo,
     trigger,
     job,
     dispatchContext: event.dispatchContext ?? dispatchContext(event, trigger, job),
-    links: event.links ?? linkContext(stateRepo)
+    links
+  });
+  enriched.trace = event.trace ?? goalRunTrace(enriched);
+  return enriched;
+}
+function goalRunTrace(event) {
+  const run = recordValue2(event.run);
+  const trigger = recordValue2(event.trigger);
+  const goal = recordValue2(event.goal);
+  const inspection = recordValue2(event.inspection);
+  const capabilityOutput = recordValue2(inspection?.capabilityOutput);
+  return pruneUndefined({
+    version: 1,
+    runId: stringValue2(run?.id) ?? void 0,
+    workflowRunId: stringValue2(run?.githubRunId) ?? void 0,
+    triggerKind: stringValue2(trigger?.kind) ?? void 0,
+    source: event.source,
+    event: event.event,
+    goal: pruneUndefined({
+      id: event.goalId,
+      type: event.goalType ?? stringValue2(goal?.type) ?? void 0,
+      state: event.goalState ?? stringValue2(goal?.state) ?? void 0,
+      stage: event.stage ?? stringValue2(goal?.stage) ?? void 0
+    }),
+    evidence: goalTraceEvidence(event, goal, inspection),
+    capability: event.dispatch ?? capabilityDispatchFromOutput(capabilityOutput),
+    result: goalTraceResult(event, capabilityOutput),
+    change: event.change,
+    links: event.links
   });
 }
+function goalTraceEvidence(event, goal, inspection) {
+  const expectedEvidence = recordValue2(inspection?.expectedEvidence);
+  const out = pruneUndefined({
+    current: event.evidence,
+    required: stringArrayValue(goal?.requiredEvidence) ?? stringArrayValue(inspection?.requiredEvidence) ?? void 0,
+    satisfied: stringArrayValue(goal?.satisfiedEvidence) ?? stringArrayValue(inspection?.satisfiedEvidence) ?? void 0,
+    missing: stringArrayValue(goal?.missingEvidence) ?? stringArrayValue(inspection?.missingEvidence) ?? stringArrayValue(expectedEvidence?.missingBefore) ?? void 0,
+    pending: stringValue2(goal?.pendingEvidence) ?? stringValue2(inspection?.pendingEvidence) ?? stringValue2(expectedEvidence?.pendingBefore) ?? void 0,
+    values: event.evidenceValues
+  });
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function capabilityDispatchFromOutput(output) {
+  if (!output) return void 0;
+  const dispatch2 = pruneUndefined({
+    capability: stringValue2(output.capability) ?? void 0,
+    executable: stringValue2(output.executable) ?? void 0,
+    action: stringValue2(output.action) ?? void 0
+  });
+  return Object.keys(dispatch2).length > 0 ? dispatch2 : void 0;
+}
+function goalTraceResult(event, capabilityOutput) {
+  const result = pruneUndefined({
+    status: event.status ?? stringValue2(capabilityOutput?.status) ?? void 0,
+    summary: event.reason ?? stringValue2(capabilityOutput?.summary) ?? void 0,
+    blockers: event.inspection ? stringArrayValue(capabilityOutput?.blockers) ?? void 0 : void 0,
+    artifacts: event.artifacts
+  });
+  return Object.keys(result).length > 0 ? result : void 0;
+}
 function runContext(data) {
   const runId = process.env.GITHUB_RUN_ID?.trim();
   const attempt = process.env.GITHUB_RUN_ATTEMPT?.trim();
@@ -7101,7 +7181,7 @@ function triggerContext() {
     issue: numberValue(recordValue2(event?.issue)?.number),
     pullRequest: numberValue(recordValue2(event?.pull_request)?.number),
     comment: numberValue(recordValue2(event?.comment)?.id),
-    schedule: stringValue(event?.schedule),
+    schedule: stringValue2(event?.schedule),
     inputs: inputs ? pickRecord(inputs, ["issue_number", "sessionId", "message", "model", "title", "executable", "base"]) : void 0
   });
   return Object.keys(trigger).length > 0 ? trigger : void 0;
@@ -7120,16 +7200,16 @@ function triggerActorRole(eventName) {
 }
 function jobContext(data) {
   const job = pruneUndefined({
-    id: stringValue(data.jobId) ?? void 0,
-    key: stringValue(data.jobKey) ?? void 0,
-    flavor: stringValue(data.jobFlavor) ?? void 0,
-    action: stringValue(data.jobAction) ?? void 0,
-    capability: stringValue(data.jobCapability) ?? void 0,
-    executable: stringValue(data.jobExecutable) ?? void 0,
-    agent: stringValue(data.jobAgent) ?? void 0,
-    schedule: stringValue(data.jobSchedule) ?? void 0,
+    id: stringValue2(data.jobId) ?? void 0,
+    key: stringValue2(data.jobKey) ?? void 0,
+    flavor: stringValue2(data.jobFlavor) ?? void 0,
+    action: stringValue2(data.jobAction) ?? void 0,
+    capability: stringValue2(data.jobCapability) ?? void 0,
+    executable: stringValue2(data.jobExecutable) ?? void 0,
+    agent: stringValue2(data.jobAgent) ?? void 0,
+    schedule: stringValue2(data.jobSchedule) ?? void 0,
     target: data.jobTarget ?? void 0,
-    why: truncateString(stringValue(data.jobWhy), 1e3),
+    why: truncateString(stringValue2(data.jobWhy), 1e3),
     saveReport: data.jobSaveReport === true ? true : void 0
   });
   return Object.keys(job).length > 0 ? job : void 0;
@@ -7139,21 +7219,21 @@ function dispatchContext(event, trigger, job) {
   const dispatch2 = event.dispatch ?? {};
   const context = pruneUndefined({
     triggeredBy: triggerLabel(trigger),
-    triggerKind: stringValue(trigger?.kind),
+    triggerKind: stringValue2(trigger?.kind),
     dispatchMode: dispatchMode(trigger),
-    githubActor: stringValue(trigger?.githubActor) ?? stringValue(trigger?.actor),
-    githubActorRole: stringValue(trigger?.actorRole),
+    githubActor: stringValue2(trigger?.githubActor) ?? stringValue2(trigger?.actor),
+    githubActorRole: stringValue2(trigger?.actorRole),
     decidedBy: event.source,
     dispatchedBy: event.source,
     target: event.target,
-    action: dispatch2.action ?? stringValue(job?.action),
-    capability: dispatch2.capability ?? stringValue(job?.capability),
+    action: dispatch2.action ?? stringValue2(job?.action),
+    capability: dispatch2.capability ?? stringValue2(job?.capability),
     reason: event.reason
   });
   return Object.keys(context).length > 0 ? context : void 0;
 }
 function triggerLabel(trigger) {
-  const kind = stringValue(trigger?.kind);
+  const kind = stringValue2(trigger?.kind);
   if (kind === "schedule") return "GitHub schedule";
   if (kind === "manual-workflow-dispatch") return "manual workflow dispatch";
   if (kind === "issue_comment") return "GitHub issue comment";
@@ -7162,7 +7242,7 @@ function triggerLabel(trigger) {
   return "local run";
 }
 function dispatchMode(trigger) {
-  const kind = stringValue(trigger?.kind);
+  const kind = stringValue2(trigger?.kind);
   if (kind === "schedule") return "automated";
   if (kind === "manual-workflow-dispatch") return "manual";
   if (kind) return "event-driven";
@@ -7174,10 +7254,10 @@ function linkContext(stateRepo) {
   const repository = process.env.GITHUB_REPOSITORY?.trim();
   const server = process.env.GITHUB_SERVER_URL?.trim() || "https://github.com";
   if (runId && repository) links.workflowRun = `${server}/${repository}/actions/runs/${runId}`;
-  const repo = stringValue(stateRepo?.repo);
-  const branch = stringValue(stateRepo?.branch);
-  const goalStatePath2 = stringValue(stateRepo?.goalStatePath);
-  const logPath = stringValue(stateRepo?.logPath);
+  const repo = stringValue2(stateRepo?.repo);
+  const branch = stringValue2(stateRepo?.branch);
+  const goalStatePath2 = stringValue2(stateRepo?.goalStatePath);
+  const logPath = stringValue2(stateRepo?.logPath);
   if (repo && branch && goalStatePath2) links.goalState = githubBlobUrl(repo, branch, goalStatePath2);
   if (repo && branch && logPath) links.log = githubBlobUrl(repo, branch, logPath);
   return Object.keys(links).length > 0 ? links : void 0;
@@ -7257,7 +7337,7 @@ function truncateString(value, max) {
   if (!value) return void 0;
   return value.length > max ? `${value.slice(0, max)}...` : value;
 }
-function stringValue(value) {
+function stringValue2(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
 }
 function safePathSegment(value) {
@@ -7430,6 +7510,8 @@ var init_managedTodoState = __esm({
 });
 // src/goal/stateStore.ts
+import * as fs26 from "fs";
+import * as path24 from "path";
 function goalStatePath(goalId) {
   return `todos/${goalId}.json`;
 }
@@ -7438,7 +7520,55 @@ function fetchGoalState(config, goalId, cwd) {
   const loaded = readStateText(config, cwd, filePath);
   if (!loaded) return null;
   if (!isManagedTodoRaw(loaded.content)) return null;
-  return parseTodoGoalState(goalId, loaded.path, loaded.content);
+  return resolveStoreBackedGoalState(parseTodoGoalState(goalId, loaded.path, loaded.content));
+}
+function resolveStoreBackedGoalState(state) {
+  const templateId = templateIdFromGoalState(state);
+  if (!templateId) return state;
+  const template = readStoreGoalTemplate(templateId);
+  if (!template) return state;
+  const nextExtra = { ...state.extra };
+  for (const key of [
+    "type",
+    "destination",
+    "capabilities",
+    "route",
+    "schedule",
+    "scheduleMode",
+    "loopTarget",
+    "preferredRunTime",
+    "saveReport"
+  ]) {
+    if (Object.hasOwn(template, key)) nextExtra[key] = template[key];
+    else if (["schedule", "loopTarget", "preferredRunTime", "saveReport"].includes(key)) delete nextExtra[key];
+  }
+  nextExtra.facts = {
+    ...recordField2(template.facts) ?? {},
+    ...recordField2(state.extra.facts) ?? {}
+  };
+  return { ...state, extra: nextExtra };
+}
+function templateIdFromGoalState(state) {
+  for (const key of ["sourceTemplate", "templateId", "template"]) {
+    const value = state.extra[key];
+    if (typeof value === "string" && value.trim()) return value.trim();
+  }
+  return "";
+}
+function readStoreGoalTemplate(templateId) {
+  const root = getCompanyStoreAssetRoot("goals");
+  if (!root) return null;
+  const file = path24.join(root, "templates", templateId, "state.json");
+  if (!fs26.existsSync(file)) return null;
+  try {
+    const parsed = JSON.parse(fs26.readFileSync(file, "utf8"));
+    return recordField2(parsed);
+  } catch {
+    return null;
+  }
+}
+function recordField2(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function putGoalState(config, goalId, state, message = `chore(goals): update ${goalId}`, cwd) {
   const previous = readStateText(config, cwd, goalStatePath(goalId));
@@ -7463,12 +7593,13 @@ var init_stateStore = __esm({
     "use strict";
     init_stateRepo();
     init_managedTodoState();
+    init_companyStore();
   }
 });
 // src/goal/targetLoopResolution.ts
-import * as fs26 from "fs";
-import * as path24 from "path";
+import * as fs27 from "fs";
+import * as path25 from "path";
 function resolveActiveGoalLoopTarget(config, cwd, loopGoalId, loopGoal) {
   const targetId = loopGoal.loopTarget?.id.trim() ?? "";
   assertSafeGoalId(targetId, "loop target");
@@ -7554,16 +7685,16 @@ function goalInstanceTime(state) {
   return Number.isNaN(parsed) ? 0 : parsed;
 }
 function loadGoalTemplate(cwd, targetId) {
-  const local = path24.join(cwd, ".kody", "goals", "templates", targetId, "state.json");
+  const local = path25.join(cwd, ".kody", "goals", "templates", targetId, "state.json");
   const localTemplate = readJsonObject(local);
   if (localTemplate) return localTemplate;
   const storeGoalRoot = getCompanyStoreAssetRoot("goals");
   if (!storeGoalRoot) return null;
-  return readJsonObject(path24.join(storeGoalRoot, "templates", targetId, "state.json"));
+  return readJsonObject(path25.join(storeGoalRoot, "templates", targetId, "state.json"));
 }
 function readJsonObject(filePath) {
-  if (!fs26.existsSync(filePath)) return null;
-  const parsed = JSON.parse(fs26.readFileSync(filePath, "utf8"));
+  if (!fs27.existsSync(filePath)) return null;
+  const parsed = JSON.parse(fs27.readFileSync(filePath, "utf8"));
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error(`goal template ${filePath} must be a JSON object`);
   }
@@ -7959,8 +8090,8 @@ var init_contentsApiBackend = __esm({
 });
 // src/scripts/jobState/localFileBackend.ts
-import * as fs27 from "fs";
-import * as path25 from "path";
+import * as fs28 from "fs";
+import * as path26 from "path";
 function sanitizeKey(s) {
   return s.replace(/[^A-Za-z0-9._-]/g, "-");
 }
@@ -8016,7 +8147,7 @@ var init_localFileBackend = __esm({
         if (!opts.owner || !opts.repo) throw new Error("LocalFileBackend: owner and repo are required");
         this.cwd = opts.cwd;
         this.jobsDir = opts.jobsDir;
-        this.absDir = path25.join(opts.cwd, opts.jobsDir);
+        this.absDir = path26.join(opts.cwd, opts.jobsDir);
         this.owner = opts.owner;
         this.repo = opts.repo;
         this.cache = opts.cache ?? defaultCacheAdapter();
@@ -8031,7 +8162,7 @@ var init_localFileBackend = __esm({
 `);
           return;
         }
-        fs27.mkdirSync(this.absDir, { recursive: true });
+        fs28.mkdirSync(this.absDir, { recursive: true });
         const prefix = this.cacheKeyPrefix();
         const probeKey = `${prefix}probe-${Date.now()}`;
         try {
@@ -8060,7 +8191,7 @@ var init_localFileBackend = __esm({
 `);
           return;
         }
-        if (!fs27.existsSync(this.absDir)) {
+        if (!fs28.existsSync(this.absDir)) {
           return;
         }
         const key = `${this.cacheKeyPrefix()}${process.env.GITHUB_RUN_ID ?? "norunid"}-${Date.now()}`;
@@ -8076,11 +8207,11 @@ var init_localFileBackend = __esm({
       }
       load(slug2) {
         const relPath = stateFilePath(this.jobsDir, slug2);
-        const absPath = path25.join(this.cwd, relPath);
-        if (!fs27.existsSync(absPath)) {
+        const absPath = path26.join(this.cwd, relPath);
+        if (!fs28.existsSync(absPath)) {
           return { path: relPath, handle: null, state: initialStateEnvelope("seed"), created: true };
         }
-        const raw = fs27.readFileSync(absPath, "utf-8");
+        const raw = fs28.readFileSync(absPath, "utf-8");
         let parsed;
         try {
           parsed = JSON.parse(raw);
@@ -8097,13 +8228,13 @@ var init_localFileBackend = __esm({
         if (!loaded.created && isStateUnchanged(loaded.state, next)) {
           return false;
         }
-        const absPath = path25.join(this.cwd, loaded.path);
-        fs27.mkdirSync(path25.dirname(absPath), { recursive: true });
+        const absPath = path26.join(this.cwd, loaded.path);
+        fs28.mkdirSync(path26.dirname(absPath), { recursive: true });
         const body = `${JSON.stringify(next, null, 2)}
 `;
         const tmpPath = `${absPath}.${process.pid}.tmp`;
-        fs27.writeFileSync(tmpPath, body, "utf-8");
-        fs27.renameSync(tmpPath, absPath);
+        fs28.writeFileSync(tmpPath, body, "utf-8");
+        fs28.renameSync(tmpPath, absPath);
         return true;
       }
       cacheKeyPrefix() {
@@ -8143,7 +8274,7 @@ var init_jobState = __esm({
 });
 // src/scripts/goalCapabilityScheduling.ts
-import * as path26 from "path";
+import * as path27 from "path";
 function isCapabilityCadenceGoal(goal, extra) {
   return extra.scheduleMode === "agentLoop" || extra.scheduler === "agentLoop" || goal.type === "standing" && goal.capabilities.length > 0;
 }
@@ -8199,7 +8330,7 @@ function planTargetLoopSchedule(opts) {
 }
 async function planGoalCapabilitySchedule(opts) {
   const jobsDir = opts.jobsDir ?? ".kody/capabilities";
-  const jobsRoot = path26.join(opts.cwd, jobsDir);
+  const jobsRoot = path27.join(opts.cwd, jobsDir);
   const now = opts.now ?? /* @__PURE__ */ new Date();
   const at = now.toISOString();
   const backend = resolveBackend({ config: opts.config, cwd: opts.cwd, jobsDir });
@@ -9010,13 +9141,13 @@ function companyIntentPath(id) {
   assertIntentId(id);
   return `intents/${id}/intent.json`;
 }
-function normalizeCompanyIntent(path50, raw) {
+function normalizeCompanyIntent(path51, raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    throw new Error(`${path50}: intent must be JSON object`);
+    throw new Error(`${path51}: intent must be JSON object`);
   }
   const input = raw;
   const id = stringField3(input.id);
-  if (!id || !isCompanyIntentId(id)) throw new Error(`${path50}: invalid intent id`);
+  if (!id || !isCompanyIntentId(id)) throw new Error(`${path51}: invalid intent id`);
   const createdAt = stringField3(input.createdAt) || nowIso();
   const updatedAt = stringField3(input.updatedAt) || createdAt;
   const description = stringField3(input.description);
@@ -9033,21 +9164,21 @@ function normalizeCompanyIntent(path50, raw) {
       "balanced"
     ),
     scope: {
-      repos: stringArray4(recordField2(input.scope)?.repos),
-      areas: stringArray4(recordField2(input.scope)?.areas)
+      repos: stringArray4(recordField3(input.scope)?.repos),
+      areas: stringArray4(recordField3(input.scope)?.areas)
     },
     principles: stringArray4(input.principles),
     metrics: stringArray4(input.metrics),
     policy: {
-      release: normalizeReleasePolicy(recordField2(recordField2(input.policy)?.release)),
-      automation: normalizeAutomationPolicy(recordField2(recordField2(input.policy)?.automation))
+      release: normalizeReleasePolicy(recordField3(recordField3(input.policy)?.release)),
+      automation: normalizeAutomationPolicy(recordField3(recordField3(input.policy)?.automation))
     },
     portfolio: {
-      goals: stringArray4(recordField2(input.portfolio)?.goals).filter(isCompanyIntentId),
-      loops: stringArray4(recordField2(input.portfolio)?.loops).filter(isCompanyIntentId),
-      capabilities: stringArray4(recordField2(input.portfolio)?.capabilities).filter(isCompanyIntentId)
+      goals: stringArray4(recordField3(input.portfolio)?.goals).filter(isCompanyIntentId),
+      loops: stringArray4(recordField3(input.portfolio)?.loops).filter(isCompanyIntentId),
+      capabilities: stringArray4(recordField3(input.portfolio)?.capabilities).filter(isCompanyIntentId)
     },
-    manager: normalizeManager(recordField2(input.manager)),
+    manager: normalizeManager(recordField3(input.manager)),
     createdAt,
     updatedAt
   };
@@ -9057,8 +9188,8 @@ function listCompanyIntents(config, cwd) {
   const records = [];
   for (const entry of entries) {
     if (entry.type !== "dir" || !entry.name || !isCompanyIntentId(entry.name)) continue;
-    const path50 = companyIntentPath(entry.name);
-    const file = readStateText(config, cwd, path50);
+    const path51 = companyIntentPath(entry.name);
+    const file = readStateText(config, cwd, path51);
     if (!file) continue;
     records.push({
       id: entry.name,
@@ -9069,8 +9200,8 @@ function listCompanyIntents(config, cwd) {
   return records.sort((a, b) => a.intent.priority - b.intent.priority || a.id.localeCompare(b.id));
 }
 function readCompanyIntent(config, cwd, id) {
-  const path50 = companyIntentPath(id);
-  const file = readStateText(config, cwd, path50);
+  const path51 = companyIntentPath(id);
+  const file = readStateText(config, cwd, path51);
   if (!file) return null;
   return { id, path: file.path, intent: normalizeCompanyIntent(file.path, JSON.parse(file.content)) };
 }
@@ -9088,7 +9219,7 @@ function listCompanyPortfolio(config, cwd) {
     if (!isCompanyIntentId(id)) continue;
     const state = fetchGoalState(config, id, cwd);
     if (!state) continue;
-    const destination = recordField2(state.extra.destination);
+    const destination = recordField3(state.extra.destination);
     goals.push({
       id,
       state: state.state,
@@ -9114,7 +9245,7 @@ function stringField3(value) {
 function numberField(value, fallback) {
   return typeof value === "number" && Number.isFinite(value) ? value : fallback;
 }
-function recordField2(value) {
+function recordField3(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function stringArray4(value) {
@@ -9502,7 +9633,7 @@ function capabilityEvidenceOutput(evidence) {
 function goalReportBody(goalId, state, snapshot, latestEvent, evidenceItems) {
   const outputs = evidenceItems.map(capabilityEvidenceOutput);
   const latestOutput = outputs.at(-1);
-  const facts = recordField3(snapshot, "facts") ?? recordField3(state.extra, "facts") ?? {};
+  const facts = recordField4(snapshot, "facts") ?? recordField4(state.extra, "facts") ?? {};
   const blockers = uniqueStrings2([
     ...stringArrayField(snapshot, "blockers"),
     ...stringArrayField(latestEvent, "blockers"),
@@ -9554,7 +9685,7 @@ function capabilityEvidenceMarkdown(outputs) {
 function decisionReason(state, latestEvent, latestOutput, missingEvidence, blockers) {
   if (state.state === "done") return "destination evidence satisfied";
   if (blockers.length > 0) return blockers[0] ?? "blocked";
-  const eventReason = stringField4(latestEvent, "reason") ?? stringField4(recordField3(latestEvent, "decision"), "reason");
+  const eventReason = stringField4(latestEvent, "reason") ?? stringField4(recordField4(latestEvent, "decision"), "reason");
   if (eventReason) return eventReason;
   const summary = stringField4(latestOutput, "summary");
   if (summary) return summary;
@@ -9567,18 +9698,18 @@ function evidenceOutputMarkdown(index, output) {
     `- Status: ${stringField4(output, "status") ?? "unknown"}`,
     `- Summary: ${stringField4(output, "summary") ?? "no summary"}`,
     `- Sources: ${listOrNone(stringArrayField(output, "sources"))}`,
-    `- Evidence values: ${inlineJson(recordField3(output, "evidence") ?? {})}`,
+    `- Evidence values: ${inlineJson(recordField4(output, "evidence") ?? {})}`,
     `- Missing evidence: ${listOrNone(stringArrayField(output, "missingEvidence"))}`,
     `- Blockers: ${listOrNone(stringArrayField(output, "blockers"))}`,
     ""
   ];
 }
 function dispatchContextMarkdown(latestEvent) {
-  const context = recordField3(latestEvent, "dispatchContext");
+  const context = recordField4(latestEvent, "dispatchContext");
   if (!context) return ["- none"];
   const githubActor = stringField4(context, "githubActor");
   const githubActorRole = stringField4(context, "githubActorRole");
-  const target = dispatchTargetLabel(recordField3(context, "target"));
+  const target = dispatchTargetLabel(recordField4(context, "target"));
   return [
     `- Triggered by: ${stringField4(context, "triggeredBy") ?? "unknown"}`,
     `- Mode: ${stringField4(context, "dispatchMode") ?? "unknown"}`,
@@ -9617,7 +9748,7 @@ function stringField4(record2, key) {
   const value = record2?.[key];
   return typeof value === "string" && value.trim() ? value : void 0;
 }
-function recordField3(record2, key) {
+function recordField4(record2, key) {
   const value = record2?.[key];
   return value && typeof value === "object" && !Array.isArray(value) ? { ...value } : void 0;
 }
@@ -9650,7 +9781,7 @@ ${artifact.path ?? ""}`;
 }
 function nextStepFromEvent(state, goalAfter, capabilityOutput, latestEvent) {
   if (state.state === "done") return "done";
-  const decisionKind = stringField4(recordField3(latestEvent, "decision"), "kind") ?? stringField4(latestEvent, "status");
+  const decisionKind = stringField4(recordField4(latestEvent, "decision"), "kind") ?? stringField4(latestEvent, "status");
   if (decisionKind === "done") return "done";
   if (decisionKind === "dispatch") return "dispatch";
   if (decisionKind === "blocked" || decisionKind === "reject-evidence") return "block";
@@ -10113,8 +10244,8 @@ var init_classifyByLabel = __esm({
 });
 // src/scripts/commitAndPush.ts
-import * as fs28 from "fs";
-import * as path27 from "path";
+import * as fs29 from "fs";
+import * as path28 from "path";
 function sentinelPathForStage(cwd, profileName) {
   const runId = resolveRunId();
   return runtimeStatePath(cwd, "agent-runs", runId, `commit-${profileName}.lock`);
@@ -10135,9 +10266,9 @@ var init_commitAndPush = __esm({
       }
       const idempotencyEnabled = process.env.KODY_COMMIT_IDEMPOTENCY !== "0";
       const sentinel = idempotencyEnabled ? sentinelPathForStage(ctx.cwd, profile.name) : null;
-      if (sentinel && fs28.existsSync(sentinel)) {
+      if (sentinel && fs29.existsSync(sentinel)) {
         try {
-          const replay = JSON.parse(fs28.readFileSync(sentinel, "utf-8"));
+          const replay = JSON.parse(fs29.readFileSync(sentinel, "utf-8"));
           ctx.data.commitResult = replay.commitResult ?? { committed: false, pushed: false };
           if (Array.isArray(replay.changedFiles)) ctx.data.changedFiles = replay.changedFiles;
           if (typeof replay.hasCommitsAhead === "boolean") ctx.data.hasCommitsAhead = replay.hasCommitsAhead;
@@ -10190,8 +10321,8 @@ var init_commitAndPush = __esm({
       const result = ctx.data.commitResult;
       if (sentinel && result?.committed) {
         try {
-          fs28.mkdirSync(path27.dirname(sentinel), { recursive: true });
-          fs28.writeFileSync(
+          fs29.mkdirSync(path28.dirname(sentinel), { recursive: true });
+          fs29.writeFileSync(
             sentinel,
             JSON.stringify(
               {
@@ -10282,8 +10413,8 @@ var init_commitGoalState = __esm({
 });
 // src/scripts/composePrompt.ts
-import * as fs29 from "fs";
-import * as path28 from "path";
+import * as fs30 from "fs";
+import * as path29 from "path";
 function fenceUntrusted(value) {
   if (value.trim().length === 0) return value;
   const safe = value.replace(/-{3,}\s*END UNTRUSTED INPUT\s*-{3,}/gi, "[END UNTRUSTED INPUT]");
@@ -10406,10 +10537,10 @@ var init_composePrompt = __esm({
       const explicit = ctx.data.promptTemplate;
       const mode = ctx.args.mode;
       const candidates = [
-        explicit ? path28.join(profile.dir, explicit) : null,
-        mode ? path28.join(profile.dir, "prompts", `${mode}.md`) : null,
-        path28.join(profile.dir, "prompt.md"),
-        path28.join(profile.dir, "capability.md")
+        explicit ? path29.join(profile.dir, explicit) : null,
+        mode ? path29.join(profile.dir, "prompts", `${mode}.md`) : null,
+        path29.join(profile.dir, "prompt.md"),
+        path29.join(profile.dir, "capability.md")
       ].filter(Boolean);
       let templatePath = "";
       let template = "";
@@ -10422,7 +10553,7 @@ var init_composePrompt = __esm({
           break;
         }
         try {
-          template = fs29.readFileSync(c, "utf-8");
+          template = fs30.readFileSync(c, "utf-8");
           templatePath = c;
           break;
         } catch (err) {
@@ -10433,7 +10564,7 @@ var init_composePrompt = __esm({
       if (!templatePath) {
         let dirState;
         try {
-          dirState = `dir contents: [${fs29.readdirSync(profile.dir).join(", ")}]`;
+          dirState = `dir contents: [${fs30.readdirSync(profile.dir).join(", ")}]`;
         } catch (err) {
           dirState = `readdir(${profile.dir}) failed: ${err?.code ?? String(err)}`;
         }
@@ -11118,19 +11249,19 @@ var init_deriveQaScopeFromIssue = __esm({
 // src/scripts/diagMcp.ts
 import { execFileSync as execFileSync10 } from "child_process";
-import * as fs30 from "fs";
+import * as fs31 from "fs";
 import * as os6 from "os";
-import * as path29 from "path";
+import * as path30 from "path";
 var diagMcp;
 var init_diagMcp = __esm({
   "src/scripts/diagMcp.ts"() {
     "use strict";
     diagMcp = async (_ctx) => {
       const home = os6.homedir();
-      const cacheDir = path29.join(home, ".cache", "ms-playwright");
+      const cacheDir = path30.join(home, ".cache", "ms-playwright");
       let entries = [];
       try {
-        entries = fs30.readdirSync(cacheDir);
+        entries = fs31.readdirSync(cacheDir);
       } catch {
       }
       const hasChromium = entries.some((e) => e.startsWith("chromium"));
@@ -11158,13 +11289,13 @@ var init_diagMcp = __esm({
 });
 // src/scripts/frameworkDetectors.ts
-import * as fs31 from "fs";
-import * as path30 from "path";
+import * as fs32 from "fs";
+import * as path31 from "path";
 function detectFrameworks(cwd) {
   const out = [];
   let deps = {};
   try {
-    const pkg = JSON.parse(fs31.readFileSync(path30.join(cwd, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs32.readFileSync(path31.join(cwd, "package.json"), "utf-8"));
     deps = { ...pkg.dependencies, ...pkg.devDependencies };
   } catch {
     return out;
@@ -11201,25 +11332,25 @@ function detectFrameworks(cwd) {
 }
 function findFile(cwd, candidates) {
   for (const c of candidates) {
-    if (fs31.existsSync(path30.join(cwd, c))) return c;
+    if (fs32.existsSync(path31.join(cwd, c))) return c;
   }
   return null;
 }
 function discoverPayloadCollections(cwd) {
   const out = [];
   for (const dir of COLLECTION_DIRS) {
-    const full = path30.join(cwd, dir);
-    if (!fs31.existsSync(full)) continue;
+    const full = path31.join(cwd, dir);
+    if (!fs32.existsSync(full)) continue;
     let files;
     try {
-      files = fs31.readdirSync(full).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+      files = fs32.readdirSync(full).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
     } catch {
       continue;
     }
     for (const file of files) {
       try {
-        const filePath = path30.join(full, file);
-        const content = fs31.readFileSync(filePath, "utf-8").slice(0, 1e4);
+        const filePath = path31.join(full, file);
+        const content = fs32.readFileSync(filePath, "utf-8").slice(0, 1e4);
         const slugMatch = content.match(/slug:\s*['"]([a-z0-9-]+)['"]/);
         if (!slugMatch) continue;
         const slug2 = slugMatch[1];
@@ -11233,7 +11364,7 @@ function discoverPayloadCollections(cwd) {
         out.push({
           name,
           slug: slug2,
-          filePath: path30.relative(cwd, filePath),
+          filePath: path31.relative(cwd, filePath),
           fields: fields.slice(0, 20),
           hasAdmin
         });
@@ -11246,28 +11377,28 @@ function discoverPayloadCollections(cwd) {
 function discoverAdminComponents(cwd, collections) {
   const out = [];
   for (const dir of ADMIN_COMPONENT_DIRS) {
-    const full = path30.join(cwd, dir);
-    if (!fs31.existsSync(full)) continue;
+    const full = path31.join(cwd, dir);
+    if (!fs32.existsSync(full)) continue;
     let entries;
     try {
-      entries = fs31.readdirSync(full, { withFileTypes: true });
+      entries = fs32.readdirSync(full, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const entryPath = path30.join(full, entry.name);
+      const entryPath = path31.join(full, entry.name);
       let name;
       let filePath;
       if (entry.isDirectory()) {
         const indexFile = ["index.tsx", "index.ts", "index.jsx", "index.js"].find(
-          (f) => fs31.existsSync(path30.join(entryPath, f))
+          (f) => fs32.existsSync(path31.join(entryPath, f))
         );
         if (!indexFile) continue;
         name = entry.name;
-        filePath = path30.relative(cwd, path30.join(entryPath, indexFile));
+        filePath = path31.relative(cwd, path31.join(entryPath, indexFile));
       } else if (/\.(tsx?|jsx?)$/.test(entry.name)) {
         name = entry.name.replace(/\.(tsx?|jsx?)$/, "");
-        filePath = path30.relative(cwd, entryPath);
+        filePath = path31.relative(cwd, entryPath);
       } else {
         continue;
       }
@@ -11275,7 +11406,7 @@ function discoverAdminComponents(cwd, collections) {
       if (collections) {
         for (const col of collections) {
           try {
-            const colContent = fs31.readFileSync(path30.join(cwd, col.filePath), "utf-8");
+            const colContent = fs32.readFileSync(path31.join(cwd, col.filePath), "utf-8");
             if (colContent.includes(name)) {
               usedInCollection = col.slug;
               break;
@@ -11293,8 +11424,8 @@ function scanApiRoutes(cwd) {
   const out = [];
   const appDirs = ["src/app", "app"];
   for (const appDir of appDirs) {
-    const apiDir = path30.join(cwd, appDir, "api");
-    if (!fs31.existsSync(apiDir)) continue;
+    const apiDir = path31.join(cwd, appDir, "api");
+    if (!fs32.existsSync(apiDir)) continue;
     walkApiRoutes(apiDir, "/api", cwd, out);
     break;
   }
@@ -11303,14 +11434,14 @@ function scanApiRoutes(cwd) {
 function walkApiRoutes(dir, prefix, cwd, out) {
   let entries;
   try {
-    entries = fs31.readdirSync(dir, { withFileTypes: true });
+    entries = fs32.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
   const routeFile = entries.find((e) => e.isFile() && /^route\.(ts|js|tsx|jsx)$/.test(e.name));
   if (routeFile) {
     try {
-      const content = fs31.readFileSync(path30.join(dir, routeFile.name), "utf-8").slice(0, 5e3);
+      const content = fs32.readFileSync(path31.join(dir, routeFile.name), "utf-8").slice(0, 5e3);
       const methods = HTTP_METHODS.filter(
         (m) => new RegExp(`export\\s+(?:async\\s+)?function\\s+${m}\\b`).test(content)
       );
@@ -11318,7 +11449,7 @@ function walkApiRoutes(dir, prefix, cwd, out) {
         out.push({
           path: prefix,
           methods,
-          filePath: path30.relative(cwd, path30.join(dir, routeFile.name))
+          filePath: path31.relative(cwd, path31.join(dir, routeFile.name))
         });
       }
     } catch {
@@ -11329,7 +11460,7 @@ function walkApiRoutes(dir, prefix, cwd, out) {
     if (entry.name === "node_modules" || entry.name === ".next") continue;
     let segment = entry.name;
     if (segment.startsWith("(") && segment.endsWith(")")) {
-      walkApiRoutes(path30.join(dir, entry.name), prefix, cwd, out);
+      walkApiRoutes(path31.join(dir, entry.name), prefix, cwd, out);
       continue;
     }
     if (segment.startsWith("[[") && segment.endsWith("]]")) {
@@ -11337,16 +11468,16 @@ function walkApiRoutes(dir, prefix, cwd, out) {
     } else if (segment.startsWith("[") && segment.endsWith("]")) {
       segment = `:${segment.slice(1, -1)}`;
     }
-    walkApiRoutes(path30.join(dir, entry.name), `${prefix}/${segment}`, cwd, out);
+    walkApiRoutes(path31.join(dir, entry.name), `${prefix}/${segment}`, cwd, out);
   }
 }
 function scanEnvVars(cwd) {
   const candidates = [".env.example", ".env.local.example", ".env.template"];
   for (const envFile of candidates) {
-    const envPath = path30.join(cwd, envFile);
-    if (!fs31.existsSync(envPath)) continue;
+    const envPath = path31.join(cwd, envFile);
+    if (!fs32.existsSync(envPath)) continue;
     try {
-      const content = fs31.readFileSync(envPath, "utf-8");
+      const content = fs32.readFileSync(envPath, "utf-8");
       const vars = [];
       for (const line of content.split("\n")) {
         const trimmed = line.trim();
@@ -11391,8 +11522,8 @@ var init_frameworkDetectors = __esm({
 });
 // src/scripts/discoverQaContext.ts
-import * as fs32 from "fs";
-import * as path31 from "path";
+import * as fs33 from "fs";
+import * as path32 from "path";
 function runQaDiscovery(cwd) {
   const out = {
     routes: [],
@@ -11423,9 +11554,9 @@ function runQaDiscovery(cwd) {
 }
 function detectDevServer(cwd, out) {
   try {
-    const pkg = JSON.parse(fs32.readFileSync(path31.join(cwd, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs33.readFileSync(path32.join(cwd, "package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-    const pm = fs32.existsSync(path31.join(cwd, "pnpm-lock.yaml")) ? "pnpm" : fs32.existsSync(path31.join(cwd, "yarn.lock")) ? "yarn" : fs32.existsSync(path31.join(cwd, "bun.lockb")) ? "bun" : "npm";
+    const pm = fs33.existsSync(path32.join(cwd, "pnpm-lock.yaml")) ? "pnpm" : fs33.existsSync(path32.join(cwd, "yarn.lock")) ? "yarn" : fs33.existsSync(path32.join(cwd, "bun.lockb")) ? "bun" : "npm";
     if (pkg.scripts?.dev) out.devCommand = `${pm} dev`;
     if (allDeps.next || allDeps.nuxt) out.devPort = 3e3;
     else if (allDeps.vite) out.devPort = 5173;
@@ -11435,8 +11566,8 @@ function detectDevServer(cwd, out) {
 function scanFrontendRoutes(cwd, out) {
   const appDirs = ["src/app", "app"];
   for (const appDir of appDirs) {
-    const full = path31.join(cwd, appDir);
-    if (!fs32.existsSync(full)) continue;
+    const full = path32.join(cwd, appDir);
+    if (!fs33.existsSync(full)) continue;
     walkFrontendRoutes(full, "", out);
     break;
   }
@@ -11444,7 +11575,7 @@ function scanFrontendRoutes(cwd, out) {
 function walkFrontendRoutes(dir, prefix, out) {
   let entries;
   try {
-    entries = fs32.readdirSync(dir, { withFileTypes: true });
+    entries = fs33.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -11461,7 +11592,7 @@ function walkFrontendRoutes(dir, prefix, out) {
     if (entry.name === "node_modules" || entry.name === ".next") continue;
     let segment = entry.name;
     if (segment.startsWith("(") && segment.endsWith(")")) {
-      walkFrontendRoutes(path31.join(dir, entry.name), prefix, out);
+      walkFrontendRoutes(path32.join(dir, entry.name), prefix, out);
       continue;
     }
     if (segment.startsWith("[[") && segment.endsWith("]]")) {
@@ -11469,7 +11600,7 @@ function walkFrontendRoutes(dir, prefix, out) {
     } else if (segment.startsWith("[") && segment.endsWith("]")) {
       segment = `:${segment.slice(1, -1)}`;
     }
-    walkFrontendRoutes(path31.join(dir, entry.name), `${prefix}/${segment}`, out);
+    walkFrontendRoutes(path32.join(dir, entry.name), `${prefix}/${segment}`, out);
   }
 }
 function detectAuthFiles(cwd, out) {
@@ -11486,23 +11617,23 @@ function detectAuthFiles(cwd, out) {
     "src/app/api/oauth"
   ];
   for (const c of candidates) {
-    if (fs32.existsSync(path31.join(cwd, c))) out.authFiles.push(c);
+    if (fs33.existsSync(path32.join(cwd, c))) out.authFiles.push(c);
   }
 }
 function detectRoles(cwd, out) {
   const rolePaths = ["src/types", "src/lib", "src/utils", "src/constants", "src/access", "src/collections"];
   for (const rp of rolePaths) {
-    const dir = path31.join(cwd, rp);
-    if (!fs32.existsSync(dir)) continue;
+    const dir = path32.join(cwd, rp);
+    if (!fs33.existsSync(dir)) continue;
     let files;
     try {
-      files = fs32.readdirSync(dir).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+      files = fs33.readdirSync(dir).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
     } catch {
       continue;
     }
     for (const f of files) {
       try {
-        const content = fs32.readFileSync(path31.join(dir, f), "utf-8").slice(0, 5e3);
+        const content = fs33.readFileSync(path32.join(dir, f), "utf-8").slice(0, 5e3);
         const roleMatches = content.match(/(?:role|Role|ROLE)\s*[=:]\s*['"](\w+)['"]/g);
         if (roleMatches) {
           for (const m of roleMatches) {
@@ -12147,6 +12278,126 @@ var init_ensurePr = __esm({
   }
 });
+// src/agencyBoundaryEval.ts
+function evaluateAgencyBoundaries(input) {
+  const findings = [];
+  const results = input.results ?? [];
+  findings.push(evaluateObserveBoundary(input.capabilityKind, results));
+  findings.push(evaluateVerifyBoundary(input.capabilityKind, results));
+  findings.push(evaluateGoalOwnershipBoundary(results));
+  return {
+    version: 1,
+    status: findings.some((finding) => finding.status === "fail") ? "fail" : "pass",
+    ...input.capability ? { capability: input.capability } : {},
+    ...input.capabilityKind ? { capabilityKind: input.capabilityKind } : {},
+    findings
+  };
+}
+function evaluateObserveBoundary(capabilityKind, results) {
+  if (capabilityKind !== "observe") {
+    return pass("observe-does-not-act", "capability is not observe", { capabilityKind });
+  }
+  const actionResults = results.filter(resultLooksLikeAction);
+  if (actionResults.length === 0) {
+    return pass("observe-does-not-act", "observe capability reported facts without action output", {
+      resultCount: results.length
+    });
+  }
+  return fail2("observe-does-not-act", "observe capability returned action-shaped output", {
+    resultCount: results.length,
+    actionResults: actionResults.map(resultSummary)
+  });
+}
+function evaluateVerifyBoundary(capabilityKind, results) {
+  if (capabilityKind !== "verify") {
+    return pass("verify-does-not-fix", "capability is not verify", { capabilityKind });
+  }
+  const actionResults = results.filter(resultLooksLikeAction);
+  if (actionResults.length === 0) {
+    return pass("verify-does-not-fix", "verify capability returned verdict evidence without action output", {
+      resultCount: results.length
+    });
+  }
+  return fail2("verify-does-not-fix", "verify capability returned fix/change output", {
+    resultCount: results.length,
+    actionResults: actionResults.map(resultSummary)
+  });
+}
+function evaluateGoalOwnershipBoundary(results) {
+  const targetBearing = results.filter((result) => result.target?.type === "goal");
+  if (targetBearing.length === 0) {
+    return pass("capability-does-not-own-goal-progress", "capability output is parent-neutral", {
+      resultCount: results.length
+    });
+  }
+  return fail2("capability-does-not-own-goal-progress", "capability output names a goal target", {
+    resultCount: results.length,
+    targetBearingResults: targetBearing.map(resultSummary)
+  });
+}
+function resultLooksLikeAction(result) {
+  if (result.status === "changed") return true;
+  return Object.keys(result.facts).some((key) => ACTION_FACT_KEYS.has(key));
+}
+function resultSummary(result) {
+  return {
+    status: result.status,
+    summary: result.summary,
+    target: result.target,
+    actionFactKeys: Object.keys(result.facts).filter((key) => ACTION_FACT_KEYS.has(key))
+  };
+}
+function pass(rule, message, evidence) {
+  return { rule, status: "pass", message, evidence };
+}
+function fail2(rule, message, evidence) {
+  return { rule, status: "fail", message, evidence };
+}
+var ACTION_FACT_KEYS;
+var init_agencyBoundaryEval = __esm({
+  "src/agencyBoundaryEval.ts"() {
+    "use strict";
+    ACTION_FACT_KEYS = /* @__PURE__ */ new Set(["changedResources", "createdResources", "actionResult"]);
+  }
+});
+// src/scripts/evaluateAgencyBoundaries.ts
+function collectResults2(raw, agentResult) {
+  const out = [];
+  if (Array.isArray(raw)) {
+    for (const item of raw) {
+      const parsed = parseCapabilityResult(item);
+      if (parsed) out.push(parsed);
+    }
+  }
+  if (agentResult?.finalText) out.push(...parseCapabilityResultsFromText(agentResult.finalText));
+  return out;
+}
+var evaluateAgencyBoundariesScript;
+var init_evaluateAgencyBoundaries = __esm({
+  "src/scripts/evaluateAgencyBoundaries.ts"() {
+    "use strict";
+    init_agencyBoundaryEval();
+    init_capabilityResult();
+    evaluateAgencyBoundariesScript = async (ctx, profile, agentResult) => {
+      const results = collectResults2(ctx.data.capabilityResults ?? ctx.data.dutyResults, agentResult);
+      const evalResult = evaluateAgencyBoundaries({
+        capability: profile.name,
+        capabilityKind: profile.capabilityKind,
+        results
+      });
+      ctx.data.agencyBoundaryEval = evalResult;
+      process.stdout.write(`KODY_AGENCY_BOUNDARY_EVAL=${JSON.stringify(evalResult)}
+`);
+      if (evalResult.status === "fail") {
+        const failed = evalResult.findings.filter((finding) => finding.status === "fail").map((finding) => finding.rule);
+        ctx.output.exitCode = ctx.output.exitCode === 0 ? 99 : ctx.output.exitCode;
+        ctx.output.reason = ctx.output.reason ? `${ctx.output.reason}; agency boundary eval failed: ${failed.join(", ")}` : `agency boundary eval failed: ${failed.join(", ")}`;
+      }
+    };
+  }
+});
 // src/scripts/failOnceTaskJob.ts
 var failOnceTaskJob;
 var init_failOnceTaskJob = __esm({
@@ -12742,12 +12993,12 @@ var init_fixFlow = __esm({
 // src/scripts/initFlow.ts
 import { execFileSync as execFileSync15 } from "child_process";
-import * as fs33 from "fs";
-import * as path32 from "path";
+import * as fs34 from "fs";
+import * as path33 from "path";
 function detectPackageManager(cwd) {
-  if (fs33.existsSync(path32.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs33.existsSync(path32.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs33.existsSync(path32.join(cwd, "bun.lockb"))) return "bun";
+  if (fs34.existsSync(path33.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs34.existsSync(path33.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs34.existsSync(path33.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function qualityCommandsFor(pm) {
@@ -12819,22 +13070,22 @@ function performInit(cwd, force) {
   const pm = detectPackageManager(cwd);
   const ownerRepo = detectOwnerRepo(cwd);
   const defaultBranch = defaultBranchFromGit(cwd);
-  const configPath = path32.join(cwd, "kody.config.json");
-  if (fs33.existsSync(configPath) && !force) {
+  const configPath = path33.join(cwd, "kody.config.json");
+  if (fs34.existsSync(configPath) && !force) {
     skipped.push("kody.config.json");
   } else {
     const cfg = makeConfig(pm, ownerRepo, defaultBranch);
-    fs33.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
+    fs34.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
 `);
     wrote.push("kody.config.json");
   }
-  const workflowDir = path32.join(cwd, ".github", "workflows");
-  const workflowPath = path32.join(workflowDir, "kody.yml");
-  if (fs33.existsSync(workflowPath) && !force) {
+  const workflowDir = path33.join(cwd, ".github", "workflows");
+  const workflowPath = path33.join(workflowDir, "kody.yml");
+  if (fs34.existsSync(workflowPath) && !force) {
     skipped.push(".github/workflows/kody.yml");
   } else {
-    fs33.mkdirSync(workflowDir, { recursive: true });
-    fs33.writeFileSync(workflowPath, WORKFLOW_TEMPLATE);
+    fs34.mkdirSync(workflowDir, { recursive: true });
+    fs34.writeFileSync(workflowPath, WORKFLOW_TEMPLATE);
     wrote.push(".github/workflows/kody.yml");
   }
   for (const exe of listExecutables()) {
@@ -12845,12 +13096,12 @@ function performInit(cwd, force) {
       continue;
     }
     if (profile.kind !== "scheduled" || !profile.schedule) continue;
-    const target = path32.join(workflowDir, `kody-${exe.name}.yml`);
-    if (fs33.existsSync(target) && !force) {
+    const target = path33.join(workflowDir, `kody-${exe.name}.yml`);
+    if (fs34.existsSync(target) && !force) {
       skipped.push(`.github/workflows/kody-${exe.name}.yml`);
       continue;
     }
-    fs33.writeFileSync(target, renderScheduledWorkflow(exe.name, profile.schedule));
+    fs34.writeFileSync(target, renderScheduledWorkflow(exe.name, profile.schedule));
     wrote.push(`.github/workflows/kody-${exe.name}.yml`);
   }
   let labels;
@@ -12998,7 +13249,7 @@ Nothing to do. All files already present. (Use --force to overwrite.)
 });
 // src/scripts/loadAgentAdhoc.ts
-import * as fs34 from "fs";
+import * as fs35 from "fs";
 function resolveMessage(messageArg) {
   const fromComment = readCommentBody();
   if (fromComment) return stripDirective(fromComment);
@@ -13006,9 +13257,9 @@ function resolveMessage(messageArg) {
 }
 function readCommentBody() {
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventPath || !fs34.existsSync(eventPath)) return "";
+  if (!eventPath || !fs35.existsSync(eventPath)) return "";
   try {
-    const event = JSON.parse(fs34.readFileSync(eventPath, "utf-8"));
+    const event = JSON.parse(fs35.readFileSync(eventPath, "utf-8"));
     return String(event.comment?.body ?? "");
   } catch {
     return "";
@@ -13061,10 +13312,10 @@ var init_loadAgentAdhoc = __esm({
         throw new Error("loadAgentAdhoc: ctx.args.agent must be a non-empty slug");
       }
       const agentPath = resolveAgentFile(ctx.cwd, agentSlug, agentsDir);
-      if (!fs34.existsSync(agentPath)) {
+      if (!fs35.existsSync(agentPath)) {
         throw new Error(`loadAgentAdhoc: agent identity not found: ${agentPath}`);
       }
-      const { title, body } = parseAgentFile(fs34.readFileSync(agentPath, "utf-8"), agentSlug);
+      const { title, body } = parseAgentFile(fs35.readFileSync(agentPath, "utf-8"), agentSlug);
       const message = resolveMessage(ctx.args.message);
       if (!message) {
         throw new Error(
@@ -13308,8 +13559,8 @@ var init_loadIssueStateComment = __esm({
 });
 // src/scripts/loadJobFromFile.ts
-import * as fs35 from "fs";
-import * as path33 from "path";
+import * as fs36 from "fs";
+import * as path34 from "path";
 function parseJobFile(raw, slug2) {
   let stripped = raw;
   if (stripped.startsWith("---\n")) {
@@ -13347,9 +13598,9 @@ var init_loadJobFromFile = __esm({
       if (!slug2) {
         throw new Error(`loadJobFromFile: ctx.args.${slugArg} must be a non-empty slug`);
       }
-      const capability = resolveCapabilityFolder(slug2, path33.join(ctx.cwd, jobsDir));
+      const capability = resolveCapabilityFolder(slug2, path34.join(ctx.cwd, jobsDir));
       if (!capability) {
-        throw new Error(`loadJobFromFile: capability folder not found or incomplete: ${path33.join(ctx.cwd, jobsDir, slug2)}`);
+        throw new Error(`loadJobFromFile: capability folder not found or incomplete: ${path34.join(ctx.cwd, jobsDir, slug2)}`);
       }
       const { title, body, config } = capability;
       const mentions = (config.mentions ?? []).map((login) => `@${login}`).join(" ");
@@ -13358,12 +13609,12 @@ var init_loadJobFromFile = __esm({
       let agentIdentity = "";
       if (agentSlug) {
         const agentPath = resolveAgentFile(ctx.cwd, agentSlug, agentsDir);
-        if (!fs35.existsSync(agentPath)) {
+        if (!fs36.existsSync(agentPath)) {
           throw new Error(
             `loadJobFromFile: capability '${slug2}' declares agent '${agentSlug}' but ${agentPath} does not exist`
           );
         }
-        const agentRaw = fs35.readFileSync(agentPath, "utf-8");
+        const agentRaw = fs36.readFileSync(agentPath, "utf-8");
         const parsed = parseJobFile(agentRaw, agentSlug);
         agentTitle = parsed.title;
         agentIdentity = parsed.body;
@@ -13443,13 +13694,13 @@ ${truncate(issue.body, FINDING_BODY_MAX_BYTES)}`;
 });
 // src/scripts/kodyVariables.ts
-import * as fs36 from "fs";
-import * as path34 from "path";
+import * as fs37 from "fs";
+import * as path35 from "path";
 function readKodyVariables(cwd) {
-  const full = path34.join(cwd, KODY_VARIABLES_REL_PATH);
+  const full = path35.join(cwd, KODY_VARIABLES_REL_PATH);
   let raw;
   try {
-    raw = fs36.readFileSync(full, "utf-8");
+    raw = fs37.readFileSync(full, "utf-8");
   } catch {
     return {};
   }
@@ -13517,8 +13768,8 @@ var init_keys = __esm({
 });
 // src/stateRepoGithub.ts
-import * as fs37 from "fs";
-import * as path35 from "path";
+import * as fs38 from "fs";
+import * as path36 from "path";
 function recordValue3(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
@@ -13658,15 +13909,15 @@ function mergeJsonl(localText, remoteText) {
 async function syncJsonlFileFromGithubState(opts) {
   const remote = await readGithubStateTextWithConfig(opts);
   if (!remote) return;
-  const local = fs37.existsSync(opts.localPath) ? fs37.readFileSync(opts.localPath, "utf-8") : "";
+  const local = fs38.existsSync(opts.localPath) ? fs38.readFileSync(opts.localPath, "utf-8") : "";
   const next = mergeJsonl(local, remote.content);
   if (next === local) return;
-  fs37.mkdirSync(path35.dirname(opts.localPath), { recursive: true });
-  fs37.writeFileSync(opts.localPath, next);
+  fs38.mkdirSync(path36.dirname(opts.localPath), { recursive: true });
+  fs38.writeFileSync(opts.localPath, next);
 }
 async function persistJsonlFileToGithubState(opts) {
-  if (!fs37.existsSync(opts.localPath)) return;
-  const localText = fs37.readFileSync(opts.localPath, "utf-8");
+  if (!fs38.existsSync(opts.localPath)) return;
+  const localText = fs38.readFileSync(opts.localPath, "utf-8");
   for (let attempt = 1; attempt <= 3; attempt += 1) {
     const remote = await readGithubStateTextWithConfig(opts);
     const body = mergeJsonl(localText, remote?.content ?? "");
@@ -13805,8 +14056,8 @@ var init_runtimeSecrets = __esm({
 });
 // src/scripts/loadQaContext.ts
-import * as fs38 from "fs";
-import * as path36 from "path";
+import * as fs39 from "fs";
+import * as path37 from "path";
 function parseSlugList(value) {
   const inner = value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
   return inner.split(",").map(
@@ -13835,18 +14086,18 @@ function readProfileAgents(raw) {
   return { agent: agent ?? legacy ?? ["kody"], body };
 }
 function readProfile(cwd) {
-  const dir = path36.join(cwd, CONTEXT_DIR_REL_PATH);
-  if (!fs38.existsSync(dir)) return "";
+  const dir = path37.join(cwd, CONTEXT_DIR_REL_PATH);
+  if (!fs39.existsSync(dir)) return "";
   let entries;
   try {
-    entries = fs38.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    entries = fs39.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return "";
   }
   const blocks = [];
   for (const file of entries) {
     try {
-      const raw = fs38.readFileSync(path36.join(dir, file), "utf-8");
+      const raw = fs39.readFileSync(path37.join(dir, file), "utf-8");
       const { agent, body } = readProfileAgents(raw);
       if (!agent.includes(QA_AGENT) && !agent.includes(ALL_AGENTS)) continue;
       blocks.push(`## ${file}
@@ -13895,8 +14146,8 @@ var init_loadQaContext = __esm({
 });
 // src/taskContext.ts
-import * as fs39 from "fs";
-import * as path37 from "path";
+import * as fs40 from "fs";
+import * as path38 from "path";
 function buildTaskContext(args) {
   return {
     schemaVersion: TASK_CONTEXT_SCHEMA_VERSION,
@@ -13912,9 +14163,9 @@ function buildTaskContext(args) {
 function persistTaskContext(cwd, ctx) {
   try {
     const dir = runtimeStatePath(cwd, "agent-runs", ctx.runId);
-    fs39.mkdirSync(dir, { recursive: true });
-    const file = path37.join(dir, "task-context.json");
-    fs39.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
+    fs40.mkdirSync(dir, { recursive: true });
+    const file = path38.join(dir, "task-context.json");
+    fs40.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
 `);
     return file;
   } catch (err) {
@@ -14017,7 +14268,7 @@ var init_markFlowSuccess = __esm({
 });
 // src/goal/operations.ts
-function fail2(err) {
+function fail3(err) {
   if (err instanceof Error) {
     const lines = err.message.split("\n").filter(Boolean);
     return { ok: false, error: lines[0] ?? err.message };
@@ -14029,7 +14280,7 @@ function commentOnIssue(issueNumber, body, cwd) {
     gh(["issue", "comment", String(issueNumber), "--body", body], { cwd });
     return { ok: true };
   } catch (err) {
-    return fail2(err);
+    return fail3(err);
   }
 }
 function mergePrSquash(prNumber, cwd) {
@@ -14037,7 +14288,7 @@ function mergePrSquash(prNumber, cwd) {
     gh(["pr", "merge", String(prNumber), "--squash", "--delete-branch"], { cwd });
     return { ok: true };
   } catch (err) {
-    return fail2(err);
+    return fail3(err);
   }
 }
 var init_operations = __esm({
@@ -16394,12 +16645,12 @@ fi
 // src/scripts/runPreviewBuild.ts
 import { copyFile, writeFile } from "fs/promises";
-import * as path38 from "path";
+import * as path39 from "path";
 import { fileURLToPath } from "url";
 function bundledDockerfilePath(mode) {
-  const here = path38.dirname(fileURLToPath(import.meta.url));
+  const here = path39.dirname(fileURLToPath(import.meta.url));
   const file = mode === "dev" ? "default-Dockerfile.preview.dev" : "default-Dockerfile.preview.prod";
-  return path38.join(here, "preview-build-templates", file);
+  return path39.join(here, "preview-build-templates", file);
 }
 function required(name) {
   const v = (process.env[name] ?? "").trim();
@@ -16650,10 +16901,10 @@ var init_runPreviewBuild = __esm({
         console.log(`[preview-build] vault: ${Object.keys(buildEnv).length} secrets, mode=${buildMode}`);
         if (Object.keys(buildEnv).length > 0) {
           const lines = Object.entries(buildEnv).map(([k, v]) => `${k}=${JSON.stringify(v)}`);
-          await writeFile(path38.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
+          await writeFile(path39.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
 `, "utf8");
         }
-        const consumerDockerfile = path38.join(ctx.cwd, "Dockerfile.preview");
+        const consumerDockerfile = path39.join(ctx.cwd, "Dockerfile.preview");
         const { stat } = await import("fs/promises");
         let hasConsumerDockerfile = false;
         try {
@@ -16837,8 +17088,8 @@ var init_tickShellRunner = __esm({
 });
 // src/scripts/runScheduledExecutableTick.ts
-import * as fs40 from "fs";
-import * as path39 from "path";
+import * as fs41 from "fs";
+import * as path40 from "path";
 var runScheduledExecutableTick;
 var init_runScheduledExecutableTick = __esm({
   "src/scripts/runScheduledExecutableTick.ts"() {
@@ -16858,14 +17109,14 @@ var init_runScheduledExecutableTick = __esm({
         ctx.output.reason = `runScheduledExecutableTick: args.slug or ctx.args.${slugArg} must be non-empty capability slug`;
         return;
       }
-      const capability = resolveCapabilityFolder(slug2, path39.join(ctx.cwd, jobsDir));
+      const capability = resolveCapabilityFolder(slug2, path40.join(ctx.cwd, jobsDir));
       if (!capability) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledExecutableTick: capability folder not found or incomplete: ${slug2} (searched ${jobsDir} and company store)`;
         return;
       }
-      const shellPath = path39.join(profile.dir, shell);
-      if (!fs40.existsSync(shellPath)) {
+      const shellPath = path40.join(profile.dir, shell);
+      if (!fs41.existsSync(shellPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledExecutableTick: shell not found: ${shell} (looked in ${profile.dir})`;
         return;
@@ -16896,8 +17147,8 @@ var init_runScheduledExecutableTick = __esm({
 });
 // src/scripts/runTickScript.ts
-import * as fs41 from "fs";
-import * as path40 from "path";
+import * as fs42 from "fs";
+import * as path41 from "path";
 var runTickScript;
 var init_runTickScript = __esm({
   "src/scripts/runTickScript.ts"() {
@@ -16916,10 +17167,10 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: ctx.args.${slugArg} must be a non-empty slug`;
         return;
       }
-      const capability = readCapabilityFolder(path40.join(ctx.cwd, jobsDir), slug2);
+      const capability = readCapabilityFolder(path41.join(ctx.cwd, jobsDir), slug2);
       if (!capability) {
         ctx.output.exitCode = 99;
-        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path40.join(ctx.cwd, jobsDir, slug2)}`;
+        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path41.join(ctx.cwd, jobsDir, slug2)}`;
         return;
       }
       const tickScript = capability.config.tickScript;
@@ -16928,8 +17179,8 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: capability ${slug2} has no \`tickScript\` in profile.json \u2014 route via capability-tick instead`;
         return;
       }
-      const scriptPath = path40.isAbsolute(tickScript) ? tickScript : path40.join(ctx.cwd, tickScript);
-      if (!fs41.existsSync(scriptPath)) {
+      const scriptPath = path41.isAbsolute(tickScript) ? tickScript : path41.join(ctx.cwd, tickScript);
+      if (!fs42.existsSync(scriptPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runTickScript: tickScript not found: ${scriptPath}`;
         return;
@@ -17752,7 +18003,7 @@ var init_warmupMcp = __esm({
 });
 // src/scripts/writeAgentRunSummary.ts
-import * as fs42 from "fs";
+import * as fs43 from "fs";
 var writeAgentRunSummary;
 var init_writeAgentRunSummary = __esm({
   "src/scripts/writeAgentRunSummary.ts"() {
@@ -17778,7 +18029,7 @@ var init_writeAgentRunSummary = __esm({
       if (reason) lines.push(`- **Reason:** ${reason}`);
       lines.push("");
       try {
-        fs42.appendFileSync(summaryPath, `${lines.join("\n")}
+        fs43.appendFileSync(summaryPath, `${lines.join("\n")}
 `);
       } catch {
       }
@@ -17917,6 +18168,7 @@ var init_scripts = __esm({
     init_dispatchClassified();
     init_dispatchNextTaskJob();
     init_ensurePr();
+    init_evaluateAgencyBoundaries();
     init_failOnceTaskJob();
     init_finalizeTerminal();
     init_finishFlow();
@@ -18061,6 +18313,7 @@ var init_scripts = __esm({
       stageMergeConflicts,
       commitAndPush: commitAndPush2,
       ensurePr: ensurePr2,
+      evaluateAgencyBoundaries: evaluateAgencyBoundariesScript,
       postAgentComment,
       postIssueComment: postIssueComment2,
       postPlanComment,
@@ -18100,53 +18353,53 @@ var init_scripts = __esm({
 // src/stateWorkspace.ts
 import { execFileSync as execFileSync24 } from "child_process";
 import * as crypto3 from "crypto";
-import * as fs43 from "fs";
+import * as fs44 from "fs";
 import * as os7 from "os";
-import * as path41 from "path";
+import * as path42 from "path";
 function writeLocalFile(cwd, relativePath, content) {
-  const fullPath = path41.join(cwd, relativePath);
-  fs43.mkdirSync(path41.dirname(fullPath), { recursive: true });
-  fs43.writeFileSync(fullPath, content);
+  const fullPath = path42.join(cwd, relativePath);
+  fs44.mkdirSync(path42.dirname(fullPath), { recursive: true });
+  fs44.writeFileSync(fullPath, content);
 }
 function copyPath(source, target) {
-  const st = fs43.lstatSync(source);
-  fs43.rmSync(target, { recursive: true, force: true });
+  const st = fs44.lstatSync(source);
+  fs44.rmSync(target, { recursive: true, force: true });
   if (st.isSymbolicLink()) return;
-  fs43.mkdirSync(path41.dirname(target), { recursive: true });
-  fs43.cpSync(source, target, { recursive: true, force: true });
+  fs44.mkdirSync(path42.dirname(target), { recursive: true });
+  fs44.cpSync(source, target, { recursive: true, force: true });
 }
 function overlayDirectoryChildren(cwd, sourceDir, localDir) {
-  if (!fs43.existsSync(sourceDir)) return;
-  for (const entry of fs43.readdirSync(sourceDir, { withFileTypes: true })) {
-    const source = path41.join(sourceDir, entry.name);
-    const target = path41.join(cwd, localDir, entry.name);
+  if (!fs44.existsSync(sourceDir)) return;
+  for (const entry of fs44.readdirSync(sourceDir, { withFileTypes: true })) {
+    const source = path42.join(sourceDir, entry.name);
+    const target = path42.join(cwd, localDir, entry.name);
     copyPath(source, target);
   }
 }
 function hydrateStateWorkspace(config, cwd) {
   if (process.env.VITEST && process.env[TEST_FETCH_ENV] !== "1") return;
   const parsed = parseStateRepo(config);
-  const hydrateKey = `${path41.resolve(cwd)}|${parsed.owner}/${parsed.repo}|${parsed.basePath}|${parsed.branch}`;
+  const hydrateKey = `${path42.resolve(cwd)}|${parsed.owner}/${parsed.repo}|${parsed.basePath}|${parsed.branch}`;
   if (hydratedWorkspaces.has(hydrateKey)) return;
   const snapshotRoot = fetchStateSnapshot(parsed);
   for (const mapping of DIR_MAPPINGS) {
-    overlayDirectoryChildren(cwd, path41.join(snapshotRoot, mapping.stateDir), mapping.localDir);
+    overlayDirectoryChildren(cwd, path42.join(snapshotRoot, mapping.stateDir), mapping.localDir);
   }
   for (const mapping of FILE_MAPPINGS) {
-    const source = path41.join(snapshotRoot, mapping.statePath);
-    if (fs43.existsSync(source) && !fs43.lstatSync(source).isSymbolicLink() && fs43.statSync(source).isFile()) {
-      writeLocalFile(cwd, mapping.localPath, fs43.readFileSync(source, "utf-8"));
+    const source = path42.join(snapshotRoot, mapping.statePath);
+    if (fs44.existsSync(source) && !fs44.lstatSync(source).isSymbolicLink() && fs44.statSync(source).isFile()) {
+      writeLocalFile(cwd, mapping.localPath, fs44.readFileSync(source, "utf-8"));
     }
   }
   hydratedWorkspaces.add(hydrateKey);
 }
 function fetchStateSnapshot(parsed) {
-  const cacheDir = path41.join(cacheRoot2(), cacheKey3(parsed));
+  const cacheDir = path42.join(cacheRoot2(), cacheKey3(parsed));
   const url = `https://github.com/${parsed.owner}/${parsed.repo}.git`;
   try {
-    fs43.mkdirSync(path41.dirname(cacheDir), { recursive: true });
-    if (!fs43.existsSync(path41.join(cacheDir, ".git"))) {
-      fs43.rmSync(cacheDir, { recursive: true, force: true });
+    fs44.mkdirSync(path42.dirname(cacheDir), { recursive: true });
+    if (!fs44.existsSync(path42.join(cacheDir, ".git"))) {
+      fs44.rmSync(cacheDir, { recursive: true, force: true });
       runGit3(["clone", "--no-checkout", "--filter=blob:none", url, cacheDir]);
     }
     runGit3(["-C", cacheDir, "remote", "set-url", "origin", url]);
@@ -18161,10 +18414,10 @@ function fetchStateSnapshot(parsed) {
       `stateWorkspace: failed to fetch ${parsed.owner}/${parsed.repo}:${parsed.basePath}@${parsed.branch}: ${msg}`
     );
   }
-  return path41.join(cacheDir, parsed.basePath);
+  return path42.join(cacheDir, parsed.basePath);
 }
 function cacheRoot2() {
-  return process.env[CACHE_ENV2]?.trim() || path41.join(os7.homedir(), ".cache", "kody", "state-repo");
+  return process.env[CACHE_ENV2]?.trim() || path42.join(os7.homedir(), ".cache", "kody", "state-repo");
 }
 function cacheKey3(parsed) {
   return crypto3.createHash("sha256").update(`${parsed.owner}/${parsed.repo}#${parsed.branch}#${parsed.basePath}`).digest("hex").slice(0, 24);
@@ -18204,15 +18457,15 @@ var init_stateWorkspace = __esm({
     "use strict";
     init_stateRepo();
     DIR_MAPPINGS = [
-      { stateDir: "capabilities", localDir: path41.join(".kody", "capabilities") },
-      { stateDir: "agents", localDir: path41.join(".kody", "agents") },
-      { stateDir: "context", localDir: path41.join(".kody", "context") },
-      { stateDir: "memory", localDir: path41.join(".kody", "memory") }
+      { stateDir: "capabilities", localDir: path42.join(".kody", "capabilities") },
+      { stateDir: "agents", localDir: path42.join(".kody", "agents") },
+      { stateDir: "context", localDir: path42.join(".kody", "context") },
+      { stateDir: "memory", localDir: path42.join(".kody", "memory") }
     ];
     FILE_MAPPINGS = [
-      { statePath: "instructions.md", localPath: path41.join(".kody", "instructions.md") },
-      { statePath: "variables.json", localPath: path41.join(".kody", "variables.json") },
-      { statePath: "secrets.enc", localPath: path41.join(".kody", "secrets.enc") }
+      { statePath: "instructions.md", localPath: path42.join(".kody", "instructions.md") },
+      { statePath: "variables.json", localPath: path42.join(".kody", "variables.json") },
+      { statePath: "secrets.enc", localPath: path42.join(".kody", "secrets.enc") }
     ];
     CACHE_ENV2 = "KODY_STATE_REPO_CACHE";
     TEST_FETCH_ENV = "KODY_STATE_WORKSPACE_FETCH_FOR_TESTS";
@@ -18286,8 +18539,8 @@ var init_tools = __esm({
 // src/executor.ts
 import { spawn as spawn7 } from "child_process";
-import * as fs44 from "fs";
-import * as path42 from "path";
+import * as fs45 from "fs";
+import * as path43 from "path";
 function isMutatingPostflight(scriptName) {
   return MUTATING_POSTFLIGHTS.has(scriptName ?? "");
 }
@@ -18468,7 +18721,7 @@ async function runExecutable(profileName, input) {
   const jobWhyBlock = typeof ctx.data.jobWhy === "string" ? operatorRequestBlock(ctx.data.jobWhy) : null;
   const jobRefBlock = jobReferenceBlock(profileName, profile, ctx.data);
   const invokeAgent = async (prompt) => {
-    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path42.isAbsolute(p) ? p : path42.resolve(profile.dir, p)).filter((p) => p.length > 0);
+    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path43.isAbsolute(p) ? p : path43.resolve(profile.dir, p)).filter((p) => p.length > 0);
     const syntheticPath = ctx.data.syntheticPluginPath;
     const pluginPaths = [...externalPlugins, ...syntheticPath ? [syntheticPath] : []];
     const agents = loadSubagents(profile);
@@ -18861,17 +19114,17 @@ function clearStampedLifecycleLabels(profile, ctx) {
 function resolveProfilePath(profileName) {
   const found = resolveExecutable(profileName);
   if (found) return found;
-  const here = path42.dirname(new URL(import.meta.url).pathname);
+  const here = path43.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path42.join(here, "executables", profileName, "profile.json"),
+    path43.join(here, "executables", profileName, "profile.json"),
     // same-dir sibling (dev)
-    path42.join(here, "..", "executables", profileName, "profile.json"),
+    path43.join(here, "..", "executables", profileName, "profile.json"),
     // up one (prod: dist/bin → dist/executables)
-    path42.join(here, "..", "src", "executables", profileName, "profile.json")
+    path43.join(here, "..", "src", "executables", profileName, "profile.json")
     // fallback
   ];
   for (const c of candidates) {
-    if (fs44.existsSync(c)) return c;
+    if (fs45.existsSync(c)) return c;
   }
   return candidates[0];
 }
@@ -18986,8 +19239,8 @@ function resolveShellTimeoutMs(entry) {
 }
 async function runShellEntry(entry, ctx, profile) {
   const shellName = entry.shell;
-  const shellPath = path42.join(profile.dir, shellName);
-  if (!fs44.existsSync(shellPath)) {
+  const shellPath = path43.join(profile.dir, shellName);
+  if (!fs45.existsSync(shellPath)) {
     ctx.skipAgent = true;
     ctx.output.exitCode = 99;
     ctx.output.reason = `shell script not found: ${shellName} (looked in ${profile.dir})`;
@@ -19137,8 +19390,8 @@ var init_executor = __esm({
 });
 // src/workflowDefinitions.ts
-import * as fs45 from "fs";
-import * as path43 from "path";
+import * as fs46 from "fs";
+import * as path44 from "path";
 function isWorkflowDefinitionId(value) {
   return WORKFLOW_ID_PATTERN.test(value);
 }
@@ -19152,13 +19405,11 @@ function normalizeWorkflowDefinition(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const raw = value;
   const name = typeof raw.name === "string" ? raw.name.trim() : "";
-  const instructions = typeof raw.instructions === "string" ? raw.instructions.trim() : "";
   const capabilities = normalizeWorkflowCapabilities(raw.capabilities);
-  if (!name || !instructions || capabilities.length === 0) return null;
+  if (!name || capabilities.length === 0) return null;
   return {
     version: 1,
     name,
-    instructions,
     capabilities,
     ...typeof raw.createdAt === "string" ? { createdAt: raw.createdAt } : {},
     ...typeof raw.updatedAt === "string" ? { updatedAt: raw.updatedAt } : {}
@@ -19172,17 +19423,17 @@ function readWorkflowDefinition(config, cwd, id) {
 function workflowDefinitionToCapabilityFolder(id, workflow, source = workflowDefinitionPath(id)) {
   return {
     slug: id,
-    dir: path43.dirname(source),
+    dir: path44.dirname(source),
     profilePath: source,
     bodyPath: source,
     title: workflow.name,
-    body: workflow.instructions,
-    rawBody: workflow.instructions,
+    body: "",
+    rawBody: "",
     rawProfile: { name: id, workflow },
     config: {
       action: id,
       workflow: workflowDefinitionToConfig(workflow),
-      describe: workflow.instructions
+      describe: workflow.name
     }
   };
 }
@@ -19207,9 +19458,9 @@ function workflowDefinitionToConfig(workflow) {
 function readCompanyStoreWorkflowDefinition(id) {
   const root = getCompanyStoreAssetRoot("workflows");
   if (!root) return null;
-  const filePath = path43.join(root, id, "workflow.json");
-  if (!fs45.existsSync(filePath)) return null;
-  return parseWorkflowDefinition(fs45.readFileSync(filePath, "utf8"));
+  const filePath = path44.join(root, id, "workflow.json");
+  if (!fs46.existsSync(filePath)) return null;
+  return parseWorkflowDefinition(fs46.readFileSync(filePath, "utf8"));
 }
 function parseWorkflowDefinition(content) {
   try {
@@ -19241,7 +19492,7 @@ __export(job_exports, {
   stableJobKey: () => stableJobKey,
   validateJob: () => validateJob
 });
-import * as path44 from "path";
+import * as path45 from "path";
 function newJobId(flavor) {
   localJobSeq += 1;
   const runId = process.env.GITHUB_RUN_ID;
@@ -19293,7 +19544,7 @@ function parseCapabilityResultTarget(raw) {
 async function runJob(job, base) {
   const valid = validateJob(job);
   const action = valid.action ?? valid.capability;
-  const projectCapabilitiesRoot = path44.join(base.cwd, ".kody", "capabilities");
+  const projectCapabilitiesRoot = path45.join(base.cwd, ".kody", "capabilities");
   const resolvedCapability = !valid.workflow && action ? resolveCapabilityAction(action, projectCapabilitiesRoot) : null;
   const capabilityIdentity = valid.capability ?? resolvedCapability?.capability;
   const capabilityContext = valid.workflow ? null : loadCapabilityContext(capabilityIdentity, base.cwd);
@@ -19306,7 +19557,7 @@ async function runJob(job, base) {
   }
   const workflow = capabilityContext?.config.workflow ?? workflowContext?.config.workflow;
   const workflowIdentity = valid.workflow ?? capabilityIdentity ?? workflowContext?.slug;
-  const capabilitySelectedExecutable = resolvedCapability?.executable ?? capabilityContext?.config.executable ?? capabilityContext?.config.executables?.[0] ?? (capabilityContext?.config.role ? capabilityContext.slug : void 0) ?? (capabilityContext?.config.tickScript ? "capability-tick-scripted" : void 0);
+  const capabilitySelectedExecutable = resolvedCapability?.executable ?? capabilityContext?.config.implementation ?? capabilityContext?.config.executable ?? capabilityContext?.config.executables?.[0] ?? (capabilityContext?.config.role ? capabilityContext.slug : void 0) ?? (capabilityContext?.config.tickScript ? "capability-tick-scripted" : void 0);
   const profileName = valid.executable ?? capabilitySelectedExecutable;
   if (workflow && shouldRunCapabilityWorkflow(valid, workflow, workflowIdentity, capabilitySelectedExecutable, base)) {
     const workflowCapability = capabilityContext ?? workflowContext;
@@ -19479,7 +19730,7 @@ function shouldRunWorkflowStep(step, data) {
   if (!step.runWhen) return true;
   const context = workflowConditionContext(data);
   return Object.entries(step.runWhen).every(
-    ([path50, expected]) => valueMatches(resolveDottedPath2(context, path50), expected)
+    ([path51, expected]) => valueMatches(resolveDottedPath2(context, path51), expected)
   );
 }
 function canContinueWorkflow(step, outcome) {
@@ -19549,7 +19800,7 @@ function composeStepWhy(parentWhy, step) {
 }
 function loadCapabilityContext(slug2, cwd) {
   if (!slug2) return null;
-  return resolveCapabilityFolder(slug2, path44.join(cwd, ".kody", "capabilities"));
+  return resolveCapabilityFolder(slug2, path45.join(cwd, ".kody", "capabilities"));
 }
 function loadWorkflowContext(slug2, base) {
   if (!slug2 || !base.config || !isWorkflowDefinitionId(slug2)) return null;
@@ -19707,9 +19958,9 @@ function translateOpenAISseToBrain(opts) {
 }
 // src/servers/brain-serve.ts
-import * as fs48 from "fs";
+import * as fs49 from "fs";
 import { createServer as createServer2 } from "http";
-import * as path47 from "path";
+import * as path48 from "path";
 // src/chat/loop.ts
 init_agent();
@@ -20385,8 +20636,8 @@ init_config();
 // src/kody-cli.ts
 import { execFileSync as execFileSync26 } from "child_process";
-import * as fs46 from "fs";
-import * as path45 from "path";
+import * as fs47 from "fs";
+import * as path46 from "path";
 // src/app-auth.ts
 import { createSign } from "crypto";
@@ -20889,6 +21140,7 @@ init_gha();
 init_issue();
 init_job();
 init_lifecycleLabels();
+init_companyStore();
 init_registry();
 // src/run-request.ts
@@ -20959,6 +21211,9 @@ var FAILED_DISPATCH_LABEL = {
   color: "e11d21",
   description: "Kody failed or rejected the run"
 };
+function objectValue2(value) {
+  return value && typeof value === "object" ? value : void 0;
+}
 var CI_HELP = `kody ci \u2014 minimal-YAML autonomous engineer (CI preflight + run)
 Usage:
@@ -21116,9 +21371,9 @@ async function resolveAuthToken(env = process.env) {
   return void 0;
 }
 function detectPackageManager2(cwd) {
-  if (fs46.existsSync(path45.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs46.existsSync(path45.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs46.existsSync(path45.join(cwd, "bun.lockb"))) return "bun";
+  if (fs47.existsSync(path46.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs47.existsSync(path46.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs47.existsSync(path46.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function shouldChainScheduledWatch(match) {
@@ -21211,8 +21466,8 @@ function postFailureTail(issueNumber, cwd, reason) {
   const logPath = lastRunLogPath(cwd);
   let tail = "";
   try {
-    if (fs46.existsSync(logPath)) {
-      const content = fs46.readFileSync(logPath, "utf-8");
+    if (fs47.existsSync(logPath)) {
+      const content = fs47.readFileSync(logPath, "utf-8");
       tail = content.slice(-3e3);
     }
   } catch {
@@ -21241,7 +21496,7 @@ async function runCi(argv) {
     return 0;
   }
   const args = parseCiArgs(argv);
-  const cwd = args.cwd ? path45.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path46.resolve(args.cwd) : process.cwd();
   let earlyConfig;
   let earlyConfigError;
   try {
@@ -21264,6 +21519,9 @@ async function runCi(argv) {
 `);
     return 64;
   }
+  if (parsedRunRequest && "request" in parsedRunRequest) {
+    applyCompanyStoreRuntimeConfig(parsedRunRequest.request.input);
+  }
   if (!args.issueNumber && !autoFallback && parsedRunRequest && "request" in parsedRunRequest) {
     const route = routeRunRequest(parsedRunRequest.request);
     if (route.kind === "error") {
@@ -21287,13 +21545,15 @@ async function runCi(argv) {
       forceRunCliArgs = { goal: envForceMessage };
     }
   }
-  if (!args.issueNumber && !autoFallback && !forceRunAction && !runRequestFanOut && eventName === "workflow_dispatch" && dispatchEventPath && fs46.existsSync(dispatchEventPath)) {
+  if (!args.issueNumber && !autoFallback && !forceRunAction && !runRequestFanOut && eventName === "workflow_dispatch" && dispatchEventPath && fs47.existsSync(dispatchEventPath)) {
     try {
-      const evt = JSON.parse(fs46.readFileSync(dispatchEventPath, "utf-8"));
-      const issueInput = parseInt(String(evt?.inputs?.issue_number ?? ""), 10);
-      const sessionInput = String(evt?.inputs?.sessionId ?? "");
-      const capabilityInput = String(evt?.inputs?.capability ?? evt?.inputs?.executable ?? "").trim();
-      const messageInput = String(evt?.inputs?.message ?? "").trim();
+      const evt = JSON.parse(fs47.readFileSync(dispatchEventPath, "utf-8"));
+      const inputs = objectValue2(evt.inputs);
+      applyCompanyStoreRuntimeConfig(inputs);
+      const issueInput = parseInt(String(inputs?.issue_number ?? ""), 10);
+      const sessionInput = String(inputs?.sessionId ?? "");
+      const capabilityInput = String(inputs?.capability ?? inputs?.executable ?? "").trim();
+      const messageInput = String(inputs?.message ?? "").trim();
       const noTarget = !sessionInput && !(Number.isFinite(issueInput) && issueInput > 0);
       if (noTarget && capabilityInput) {
         forceRunAction = capabilityInput;
@@ -21651,8 +21911,8 @@ init_repoWorkspace();
 // src/scripts/brainTurnLog.ts
 init_runtimePaths();
-import * as fs47 from "fs";
-import * as path46 from "path";
+import * as fs48 from "fs";
+import * as path47 from "path";
 import posixPath4 from "path/posix";
 var live = /* @__PURE__ */ new Map();
 function brainEventsFilePath(dir, chatId) {
@@ -21663,8 +21923,8 @@ function brainEventsStatePath(chatId) {
 }
 function lastPersistedSeq(dir, chatId) {
   const p = brainEventsFilePath(dir, chatId);
-  if (!fs47.existsSync(p)) return 0;
-  const lines = fs47.readFileSync(p, "utf-8").split("\n").filter(Boolean);
+  if (!fs48.existsSync(p)) return 0;
+  const lines = fs48.readFileSync(p, "utf-8").split("\n").filter(Boolean);
   if (lines.length === 0) return 0;
   try {
     return JSON.parse(lines[lines.length - 1]).seq || 0;
@@ -21674,9 +21934,9 @@ function lastPersistedSeq(dir, chatId) {
 }
 function readSince(dir, chatId, since) {
   const p = brainEventsFilePath(dir, chatId);
-  if (!fs47.existsSync(p)) return [];
+  if (!fs48.existsSync(p)) return [];
   const out = [];
-  for (const line of fs47.readFileSync(p, "utf-8").split("\n")) {
+  for (const line of fs48.readFileSync(p, "utf-8").split("\n")) {
     if (!line) continue;
     try {
       const rec = JSON.parse(line);
@@ -21702,12 +21962,12 @@ function beginTurn(dir, chatId) {
   };
   live.set(chatId, state);
   const p = brainEventsFilePath(dir, chatId);
-  fs47.mkdirSync(path46.dirname(p), { recursive: true });
+  fs48.mkdirSync(path47.dirname(p), { recursive: true });
   return (event) => {
     state.seq += 1;
     const rec = { seq: state.seq, turn, ts: Date.now(), event };
     try {
-      fs47.appendFileSync(p, `${JSON.stringify(rec)}
+      fs48.appendFileSync(p, `${JSON.stringify(rec)}
 `);
     } catch (err) {
       process.stderr.write(
@@ -21746,7 +22006,7 @@ function endTurnIfUnterminated(dir, chatId, errMessage) {
     event: { type: "error", error: errMessage || "turn ended unexpectedly", chatId }
   };
   try {
-    fs47.appendFileSync(brainEventsFilePath(dir, chatId), `${JSON.stringify(rec)}
+    fs48.appendFileSync(brainEventsFilePath(dir, chatId), `${JSON.stringify(rec)}
 `);
   } catch {
   }
@@ -22070,7 +22330,7 @@ async function handleChatTurn(req, res, chatId, opts) {
       );
     }
   }
-  fs48.mkdirSync(path47.dirname(sessionFile), { recursive: true });
+  fs49.mkdirSync(path48.dirname(sessionFile), { recursive: true });
   appendTurn(sessionFile, {
     role: "user",
     content: message,
@@ -22145,7 +22405,7 @@ async function handleChatTurn(req, res, chatId, opts) {
 function buildServer(opts) {
   const runTurn = opts.runTurn ?? runChatTurn;
   const cloneRepo = opts.cloneRepo ?? defaultCloneRepo;
-  const reposRoot = opts.reposRoot ?? path47.join(path47.dirname(path47.resolve(opts.cwd)), "repos");
+  const reposRoot = opts.reposRoot ?? path48.join(path48.dirname(path48.resolve(opts.cwd)), "repos");
   return createServer2(async (req, res) => {
     if (!req.method || !req.url) {
       sendJson(res, 400, { error: "bad request" });
@@ -22748,8 +23008,8 @@ async function loadConfigSafe() {
 }
 // src/chat-cli.ts
-import * as fs50 from "fs";
-import * as path49 from "path";
+import * as fs51 from "fs";
+import * as path50 from "path";
 // src/chat/inbox.ts
 import { execFileSync as execFileSync27 } from "child_process";
@@ -22821,8 +23081,8 @@ function currentBranch(cwd) {
 // src/chat/state-sync.ts
 init_stateRepo();
-import * as fs49 from "fs";
-import * as path48 from "path";
+import * as fs50 from "fs";
+import * as path49 from "path";
 function jsonlLines2(text) {
   return text.split("\n").filter((line) => line.length > 0);
 }
@@ -22839,15 +23099,15 @@ function mergeJsonl2(localText, remoteText) {
 function syncJsonlFileFromState(opts) {
   const remote = readStateText(opts.config, opts.cwd, opts.statePath);
   if (!remote) return;
-  const local = fs49.existsSync(opts.localPath) ? fs49.readFileSync(opts.localPath, "utf-8") : "";
+  const local = fs50.existsSync(opts.localPath) ? fs50.readFileSync(opts.localPath, "utf-8") : "";
   const next = mergeJsonl2(local, remote.content);
   if (next === local) return;
-  fs49.mkdirSync(path48.dirname(opts.localPath), { recursive: true });
-  fs49.writeFileSync(opts.localPath, next);
+  fs50.mkdirSync(path49.dirname(opts.localPath), { recursive: true });
+  fs50.writeFileSync(opts.localPath, next);
 }
 function persistJsonlFileToState(opts) {
-  if (!fs49.existsSync(opts.localPath)) return;
-  const localText = fs49.readFileSync(opts.localPath, "utf-8");
+  if (!fs50.existsSync(opts.localPath)) return;
+  const localText = fs50.readFileSync(opts.localPath, "utf-8");
   for (let attempt = 1; attempt <= 3; attempt += 1) {
     const remote = readStateText(opts.config, opts.cwd, opts.statePath);
     const body = mergeJsonl2(localText, remote?.content ?? "");
@@ -23031,6 +23291,7 @@ async function emit2(sink, type, sessionId, suffix, payload) {
 init_config();
 init_litellm();
 init_stateWorkspace();
+init_companyStore();
 var DEFAULT_MODEL2 = "claude/claude-haiku-4-5-20251001";
 var CHAT_HELP = `kody chat \u2014 dashboard-driven chat session
@@ -23111,8 +23372,12 @@ async function runChat(argv) {
 ${CHAT_HELP}`);
     return 64;
   }
-  const cwd = args.cwd ? path49.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path50.resolve(args.cwd) : process.cwd();
   const sessionId = args.sessionId;
+  const runRequest = readRunRequestFromEnv();
+  if (runRequest && "request" in runRequest) {
+    applyCompanyStoreRuntimeConfig(runRequest.request.input);
+  }
   const unpackedSecrets = unpackAllSecrets();
   if (unpackedSecrets > 0) {
     process.stdout.write(`\u2192 kody: unpacked ${unpackedSecrets} secret(s) from ALL_SECRETS
@@ -23172,7 +23437,7 @@ ${CHAT_HELP}`);
   const sink = buildSink(cwd, sessionId, args.dashboardUrl);
   const meta = readMeta(sessionFile);
   process.stdout.write(
-    `\u2192 kody:chat: session file=${sessionFile} exists=${fs50.existsSync(sessionFile)} meta=${meta ? meta.mode : "none"}
+    `\u2192 kody:chat: session file=${sessionFile} exists=${fs51.existsSync(sessionFile)} meta=${meta ? meta.mode : "none"}
 `
   );
   try {
@@ -23302,8 +23567,8 @@ var FlyClient = class {
   get fetch() {
     return this.opts.fetchImpl ?? fetch;
   }
-  async call(path50, init = {}) {
-    const res = await this.fetch(`${FLY_API_BASE}${path50}`, {
+  async call(path51, init = {}) {
+    const res = await this.fetch(`${FLY_API_BASE}${path51}`, {
       method: init.method ?? "GET",
       headers: {
         Authorization: `Bearer ${this.opts.token}`,
@@ -23314,7 +23579,7 @@ var FlyClient = class {
     if (res.status === 404 && init.allow404) return null;
     if (!res.ok) {
       const text = await res.text().catch(() => "");
-      throw new Error(`Fly API ${res.status} on ${path50}: ${text.slice(0, 200) || res.statusText}`);
+      throw new Error(`Fly API ${res.status} on ${path51}: ${text.slice(0, 200) || res.statusText}`);
     }
     if (res.status === 204) return null;
     const raw = await res.text();
@@ -24032,7 +24297,7 @@ async function poolServe() {
 // src/servers/runner-serve.ts
 import { spawn as spawn8 } from "child_process";
-import * as fs51 from "fs";
+import * as fs52 from "fs";
 import { createServer as createServer6 } from "http";
 var DEFAULT_PORT2 = 8080;
 var DEFAULT_WORKDIR = "/workspace/repo";
@@ -24167,8 +24432,8 @@ async function defaultRunJob(job) {
   const workdir = process.env.RUNNER_WORKDIR ?? DEFAULT_WORKDIR;
   const branch = job.ref ?? "main";
   const authUrl = `https://x-access-token:${job.githubToken}@github.com/${job.repo}.git`;
-  fs51.rmSync(workdir, { recursive: true, force: true });
-  fs51.mkdirSync(workdir, { recursive: true });
+  fs52.rmSync(workdir, { recursive: true, force: true });
+  fs52.mkdirSync(workdir, { recursive: true });
   const allSecrets = typeof job.allSecrets === "string" ? job.allSecrets : JSON.stringify(job.allSecrets ?? {});
   const target = job.runRequest.target;
   const interactive = target.type === "chat";