@kontextmind/kxm 0.7.104 → 0.7.105

package/plugins/kxm/dist/cli.js

@@ -2987,7 +2987,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve35.call(this, root, ref);
+      let _sch = resolve34.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -3014,7 +3014,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve35(root, ref) {
+    function resolve34(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3835,11 +3835,11 @@ var require_fast_uri = __commonJS({
         normalizeString(uri, options);
       } else if (typeof uri === "object") {
         uri = /** @type {T} */
-        parse12(serialize(uri, options), options);
+        parse11(serialize(uri, options), options);
       }
       return uri;
     }
-    function resolve35(baseURI, relativeURI, options) {
+    function resolve34(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const {
         parsed: baseParsed,
@@ -3875,8 +3875,8 @@ var require_fast_uri = __commonJS({
     function resolveComponent(base, relative8, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
-        base = parse12(serialize(base, options), options);
-        relative8 = parse12(serialize(relative8, options), options);
+        base = parse11(serialize(base, options), options);
+        relative8 = parse11(serialize(relative8, options), options);
       }
       options = options || {};
       if (!options.tolerant && relative8.scheme) {
@@ -4168,7 +4168,7 @@ var require_fast_uri = __commonJS({
       }
       return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
     }
-    function parse12(uri, opts) {
+    function parse11(uri, opts) {
       return parseWithStatus(uri, opts).parsed;
     }
     function normalizeString(uri, opts) {
@@ -4201,11 +4201,11 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve35,
+      resolve: resolve34,
       resolveComponent,
       equal,
       serialize,
-      parse: parse12
+      parse: parse11
     };
     module.exports = fastUri;
     module.exports.default = fastUri;
@@ -14678,7 +14678,7 @@ var require_public_api = __commonJS({
       }
       return doc;
     }
-    function parse12(src, reviver, options) {
+    function parse11(src, reviver, options) {
       let _reviver = void 0;
       if (typeof reviver === "function") {
         _reviver = reviver;
@@ -14719,7 +14719,7 @@ var require_public_api = __commonJS({
         return value.toString(options);
       return new Document.Document(value, _replacer, options).toString(options);
     }
-    exports.parse = parse12;
+    exports.parse = parse11;
     exports.parseAllDocuments = parseAllDocuments;
     exports.parseDocument = parseDocument2;
     exports.stringify = stringify12;
@@ -14779,7 +14779,7 @@ var require_dist = __commonJS({
 });
 
 // plugins/kxm/src/cli.ts
-import { resolve as resolve34 } from "node:path";
+import { resolve as resolve33 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // node_modules/commander/lib/error.js
@@ -19751,7 +19751,7 @@ var HubClient = class {
       if (signal?.aborted) throw new MeshWaitError("aborted", messageId);
       const message = await this.getMessage(messageId);
       if (["replied", "cancelled", "expired", "error"].includes(message.status)) return message;
-      await new Promise((resolve35, reject) => {
+      await new Promise((resolve34, reject) => {
         const onAbort = () => {
           signal?.removeEventListener("abort", onAbort);
           clearTimeout(timer);
@@ -19759,7 +19759,7 @@ var HubClient = class {
         };
         const timer = setTimeout(() => {
           signal?.removeEventListener("abort", onAbort);
-          resolve35();
+          resolve34();
         }, Math.min(500, Math.max(1, deadline - Date.now())));
         signal?.addEventListener("abort", onAbort, { once: true });
         if (signal?.aborted) onAbort();
@@ -19814,7 +19814,7 @@ var HubClient = class {
       } catch (error) {
         if (this.stopped || error instanceof Error && error.name === "AbortError") return;
       }
-      if (!this.stopped) await new Promise((resolve35) => setTimeout(resolve35, this.options.reconnectMs));
+      if (!this.stopped) await new Promise((resolve34) => setTimeout(resolve34, this.options.reconnectMs));
     }
   }
   headers(includeIdentity = true) {
@@ -21350,7 +21350,7 @@ function defaultSpawn(command, args, options) {
   if (options.signal?.aborted) {
     return Promise.resolve({ stdout: "", stderr: "", code: null, started: false, observedChildExit: false, error: new Error("process_aborted") });
   }
-  return new Promise((resolve35) => {
+  return new Promise((resolve34) => {
     const stdout = [];
     const stderr = [];
     let outputBytes = 0;
@@ -21381,7 +21381,7 @@ function defaultSpawn(command, args, options) {
       const started = Boolean(child?.pid);
       if (started && !observedChildExit) error ??= new Error("process_exit_unobserved");
       const unverifiedDescendants = stopping || started && !observedChildExit;
-      resolve35({
+      resolve34({
         stdout: Buffer.concat(stdout).toString("utf8"),
         stderr: Buffer.concat(stderr).toString("utf8"),
         code,
@@ -21790,6 +21790,12 @@ var WRITER_ONESHOT_ARGS = Object.freeze({
   pi: Object.freeze(["-a", "--no-extensions", "--no-skills", "--no-prompt-templates", "--no-session"]),
   grok: Object.freeze(["--always-approve", "--no-subagents", "--disable-web-search"])
 });
+function oneShotWriterArgs(harness) {
+  return Object.hasOwn(WRITER_ONESHOT_ARGS, harness) ? WRITER_ONESHOT_ARGS[harness] : void 0;
+}
+function oneShotPermissionArgs(harness, permission) {
+  return permission === "edit" ? oneShotWriterArgs(harness) : oneShotReadOnlyArgs(harness);
+}
 var BUILTIN_HARNESSES = Object.freeze([
   {
     id: "pi",
@@ -22167,7 +22173,7 @@ function probeEntry(entry, runCommand, timeoutMs, platform, probe = {}) {
   return {
     id: entry.id,
     label: entry.label,
-    default: entry.default,
+    default: entry.id === (probe.defaultHarness ?? DEFAULT_HARNESS),
     mode: entry.mode,
     detected,
     authenticated,
@@ -22188,7 +22194,7 @@ function probeHarnesses(options = {}) {
   const runCommand = options.runCommand ?? defaultRunner(options.env ?? process.env);
   const platform = options.platform ?? process.platform;
   return {
-    defaultHarness: DEFAULT_HARNESS,
+    defaultHarness: options.defaultHarness ?? DEFAULT_HARNESS,
     harnesses: BUILTIN_HARNESSES.map((entry) => probeEntry(entry, runCommand, timeoutMs, platform, options))
   };
 }
@@ -22432,7 +22438,7 @@ function formatHarnessInventory(inventory) {
     ].join(" ");
   });
   return [
-    `default harness: ${inventory.defaultHarness} (omit agent harness: to use headless Pi)`,
+    `default harness: ${inventory.defaultHarness} (used when an agent omits harness:)`,
     "enable/disable = Git YAML (.kxm/agents, .kxm/models) or the harness's own plugin CLI",
     "governed kxm skills are not auto-updated",
     header,
@@ -23094,8 +23100,8 @@ function validateWorkflow(workflow, agents, models, repositories, gates, issues)
       const writable = Object.values(objectValue(step.repositories) ?? {}).filter((access) => access === "write").length;
       if (maxWriteRepositories > writable) issues.push(issue2("semantic", "write_repository_bound_invalid", file, `${stepId} maxWriteRepositories exceeds writable repository scope`));
     }
-    const join51 = objectValue(step.join);
-    const minimumPassed = join51 && typeof join51.minimumPassed === "number" ? join51.minimumPassed : void 0;
+    const join52 = objectValue(step.join);
+    const minimumPassed = join52 && typeof join52.minimumPassed === "number" ? join52.minimumPassed : void 0;
     if (minimumPassed !== void 0 && minimumPassed > maximum) issues.push(issue2("semantic", "join_impossible", file, `${stepId} minimumPassed exceeds assignment maximum`));
     const distinctBy = names(assignment?.distinctBy);
     if (distinctBy.length > 0) {
@@ -23659,9 +23665,9 @@ function planKxmInitialization(start = process.cwd(), options = {}) {
 
 // plugins/kxm/src/runtime-supervisor.ts
 import { spawn as spawn2 } from "node:child_process";
-import { createHash as createHash13, createHmac as createHmac2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync16, lstatSync as lstatSync6, mkdirSync as mkdirSync11, readFileSync as readFileSync14, renameSync as renameSync5, rmSync as rmSync5, writeFileSync as writeFileSync12 } from "node:fs";
-import { dirname as dirname11, isAbsolute as isAbsolute7, join as join16 } from "node:path";
+import { createHash as createHash14, createHmac as createHmac2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+import { chmodSync as chmodSync4, existsSync as existsSync17, lstatSync as lstatSync6, mkdirSync as mkdirSync11, readFileSync as readFileSync15, renameSync as renameSync5, rmSync as rmSync5, writeFileSync as writeFileSync12 } from "node:fs";
+import { dirname as dirname11, isAbsolute as isAbsolute7, join as join17 } from "node:path";
 
 // plugins/kxm/src/runtime-store.ts
 import { existsSync as existsSync10, lstatSync as lstatSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
@@ -25062,6 +25068,9 @@ var EVENT_STORE_TABLES = {
 };
 var KXM_EVENT_STORE_TABLE_NAMES = Object.keys(EVENT_STORE_TABLES).sort();
 
+// plugins/kxm/src/engine-plan.ts
+import { createHash as createHash11 } from "node:crypto";
+
 // plugins/kxm/src/engine-compile.ts
 var KXM_COMPILED_WORKFLOW_SCHEMA = "kxm.compiled-workflow.v1";
 var WORKFLOW_SCHEMA = "kxm.workflow.v1";
@@ -25210,7 +25219,7 @@ function compileStep(step, index, stepIndex, requirePlanHash, sink) {
   const maxAttempts = compileCountField(step.maxAttempts, 1, `${id}.maxAttempts`, id, sink);
   const timeoutMs = compileOptionalDuration(step.timeoutMs, `${id}.timeoutMs`, id, sink);
   const assignments = compileAssignments(step, id, agent, sink);
-  const join51 = compileJoin(step, id, sink);
+  const join52 = compileJoin(step, id, sink);
   const requiredEvidence = compileEvidence(step, id, sink);
   const transitions = compileTransitions(step, id, index, stepIndex, sink);
   const outcomes = Object.keys(transitions).sort(compareCodeUnits4);
@@ -25238,7 +25247,7 @@ function compileStep(step, index, stepIndex, requirePlanHash, sink) {
     transitions: orderedTransitions,
     requiresPlanHash: requirePlanHash.includes(id),
     assignments,
-    join: join51
+    join: join52
   };
   if (kind === "agent" || kind === "moa") {
     if (!agent) return void 0;
@@ -25288,15 +25297,15 @@ function compileAssignments(step, stepId, primaryAgentId, sink) {
   };
 }
 function compileJoin(step, stepId, sink) {
-  const join51 = objectValue2(step.join);
-  if (!join51) return { strategy: "all" };
-  const declared = stringValue2(join51.strategy);
+  const join52 = objectValue2(step.join);
+  if (!join52) return { strategy: "all" };
+  const declared = stringValue2(join52.strategy);
   const strategy = declared && JOIN_STRATEGIES.has(declared) ? declared : "all";
-  const minimumPassed = compileOptionalCount(join51.minimumPassed, `${stepId}.join.minimumPassed`, stepId, sink);
+  const minimumPassed = compileOptionalCount(join52.minimumPassed, `${stepId}.join.minimumPassed`, stepId, sink);
   const compiled = {
     strategy,
     ...minimumPassed !== void 0 ? { minimumPassed } : {},
-    ...typeof join51.cancelRemaining === "boolean" ? { cancelRemaining: join51.cancelRemaining } : {}
+    ...typeof join52.cancelRemaining === "boolean" ? { cancelRemaining: join52.cancelRemaining } : {}
   };
   return compiled;
 }
@@ -25565,7 +25574,110 @@ function pushIssue(sink, issue3) {
   sink.issues.push({ workflowId: sink.workflowId, ...issue3 });
 }
 
+// plugins/kxm/src/engine-plan.ts
+function kxmSha256(input) {
+  return `sha256:${createHash11("sha256").update(input, "utf8").digest("hex")}`;
+}
+function parseGateDefinition(raw, gateId, runId) {
+  const value = asObject(raw, runId, `gates.definitions.${gateId}`);
+  const kind = asString(value.kind, runId, `gates.definitions.${gateId}.kind`);
+  if (kind === "command") {
+    assertExactKeys(value, ["kind", "argv", "timeoutMs"], ["cwd"], runId, `gates.definitions.${gateId}`);
+    const argv = asStringArray(value.argv, runId, `gates.definitions.${gateId}.argv`);
+    if (argv.length < 1 || argv.length > 64) {
+      throw runtimeError("run_plan_corrupt", runId, `gates.definitions.${gateId}.argv length is invalid`);
+    }
+    for (const [index, entry] of argv.entries()) {
+      if (entry.length === 0 || entry.length > 4096 || entry.includes("\0")) {
+        throw runtimeError("run_plan_corrupt", runId, `gates.definitions.${gateId}.argv[${index}] is invalid`);
+      }
+    }
+    const executable = argv[0];
+    if (executable === "." || executable === ".." || executable.includes("\\") || !executable.startsWith("/") && executable.includes("/")) {
+      throw runtimeError("run_plan_corrupt", runId, `gates.definitions.${gateId} argv[0] must be a bare executable or absolute POSIX path`);
+    }
+    const timeoutMs = value.timeoutMs;
+    if (typeof timeoutMs !== "number" || !Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647) {
+      throw runtimeError("run_plan_corrupt", runId, `gates.definitions.${gateId}.timeoutMs is invalid`);
+    }
+    if (value.cwd !== void 0 && value.cwd !== "control") {
+      throw runtimeError("run_plan_corrupt", runId, `gates.definitions.${gateId}.cwd is invalid`);
+    }
+    return {
+      kind: "command",
+      argv,
+      timeoutMs,
+      ...value.cwd === "control" ? { cwd: "control" } : {}
+    };
+  }
+  if (kind === "artifacts-exist") {
+    assertExactKeys(value, ["kind", "paths"], [], runId, `gates.definitions.${gateId}`);
+    const paths = asStringArray(value.paths, runId, `gates.definitions.${gateId}.paths`);
+    if (paths.length < 1 || paths.length > 64) {
+      throw runtimeError("run_plan_corrupt", runId, `gates.definitions.${gateId}.paths length is invalid`);
+    }
+    if (new Set(paths).size !== paths.length) {
+      throw runtimeError("run_plan_corrupt", runId, `gates.definitions.${gateId}.paths are not unique`);
+    }
+    for (const path4 of paths) {
+      if (path4 === "." || !kxmPortablePath(path4) || path4.startsWith("/") || path4.includes("\\")) {
+        throw runtimeError("run_plan_corrupt", runId, `gates.definitions.${gateId} path is not a portable relative path`);
+      }
+    }
+    return { kind: "artifacts-exist", paths };
+  }
+  if (kind === "reserved") {
+    assertExactKeys(value, ["kind"], [], runId, `gates.definitions.${gateId}`);
+    return { kind: "reserved" };
+  }
+  throw runtimeError("run_plan_corrupt", runId, `gates.definitions.${gateId} kind is invalid`);
+}
+function asObject(value, runId, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw runtimeError("run_plan_corrupt", runId, `${label} is not an object`);
+  }
+  return value;
+}
+function assertExactKeys(value, required, optional, runId, label) {
+  const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
+  for (const key of required) {
+    if (!(key in value)) throw runtimeError("run_plan_corrupt", runId, `${label} is missing ${key}`);
+  }
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) throw runtimeError("run_plan_corrupt", runId, `${label} has unexpected key ${key}`);
+  }
+}
+function asString(value, runId, label) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw runtimeError("run_plan_corrupt", runId, `${label} is not a non-empty string`);
+  }
+  return value;
+}
+function asStringArray(value, runId, label) {
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+    throw runtimeError("run_plan_corrupt", runId, `${label} is not a string array`);
+  }
+  return [...value];
+}
+
+// plugins/kxm/src/gate-hash.ts
+function gateRegistryHash(registryValue) {
+  return kxmSha256(kxmCanonicalJson(registryValue));
+}
+
 // plugins/kxm/src/runtime-service.ts
+function objectValue3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function kxmProjectAdmissionLimits(bundle) {
+  const limits = objectValue3(bundle.project.value.limits);
+  const maxConcurrentRuns = typeof limits?.maxConcurrentRuns === "number" && Number.isInteger(limits.maxConcurrentRuns) && limits.maxConcurrentRuns >= 1 ? limits.maxConcurrentRuns : 1;
+  return {
+    maxConcurrentRuns,
+    ...typeof limits?.maxRunDurationMs === "number" ? { maxRunDurationMs: limits.maxRunDurationMs } : {},
+    ...typeof limits?.maxAgentTimeMs === "number" ? { maxAgentTimeMs: limits.maxAgentTimeMs } : {}
+  };
+}
 var RUNTIME_EPOCH_NS = process.hrtime.bigint();
 
 // plugins/kxm/src/oneshot-evidence.ts
@@ -25575,7 +25687,7 @@ var RECORD_LIMIT = 16 * 1024 * 1024;
 
 // plugins/kxm/src/prices.ts
 var import_yaml3 = __toESM(require_dist(), 1);
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 import { existsSync as existsSync11, readFileSync as readFileSync9, statSync, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join11 } from "node:path";
 
@@ -25638,7 +25750,7 @@ function hashPriceCatalog(catalog) {
       }))
     })).sort((a, b2) => a.id.localeCompare(b2.id))
   };
-  return createHash11("sha256").update(JSON.stringify(canonical2), "utf8").digest("hex");
+  return createHash12("sha256").update(JSON.stringify(canonical2), "utf8").digest("hex");
 }
 function parsePriceCatalog(text) {
   const parsed = (0, import_yaml3.parse)(text);
@@ -25776,6 +25888,8 @@ function acknowledgePriceCatalog(projectRoot, now = /* @__PURE__ */ new Date())
 
 // plugins/kxm/src/engine.ts
 var import_yaml7 = __toESM(require_dist(), 1);
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "node:fs";
+import { join as join15 } from "node:path";
 
 // plugins/kxm/src/routes.ts
 var import_yaml4 = __toESM(require_dist(), 1);
@@ -25835,6 +25949,10 @@ function listRoleBindings(root) {
   }
   return result;
 }
+function isRouteAdmitted(root, modelId2) {
+  const policy = loadRoutePolicy(root);
+  return policy.admitted.includes(modelId2) && !policy.disabled.includes(modelId2);
+}
 function listInventoryModels(root) {
   const path4 = join12(root, ".kxm", "models", "inventory.yaml");
   if (!existsSync12(path4)) return [];
@@ -26120,7 +26238,7 @@ function syncHarnessMemory(repoRoot, options = {}) {
 
 // plugins/kxm/src/skills.ts
 var import_yaml6 = __toESM(require_dist(), 1);
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 import { existsSync as existsSync14, mkdirSync as mkdirSync9, readdirSync as readdirSync5, readFileSync as readFileSync12, renameSync as renameSync3, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync10 } from "node:fs";
 import { dirname as dirname9, join as join14 } from "node:path";
 var SKILL_CANDIDATE_SCHEMA = "kxm.skill-candidate.v1";
@@ -26145,7 +26263,7 @@ var SkillLifecycleError = class extends Error {
   }
 };
 function skillContentSha256(content) {
-  return createHash12("sha256").update(content, "utf8").digest("hex");
+  return createHash13("sha256").update(content, "utf8").digest("hex");
 }
 function skillIdFor(name, contentSha256) {
   const slug = name.toLowerCase().replaceAll(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
@@ -27159,13 +27277,418 @@ function formatRoutingReport(report2, options = {}) {
 }
 
 // plugins/kxm/src/engine.ts
+function resolveProducerRoute(projectRoot, step, agentId) {
+  let agentModel;
+  const agentFile = join15(projectRoot, ".kxm", "agents", `${agentId}.yaml`);
+  if (existsSync15(agentFile)) {
+    try {
+      const parsed = (0, import_yaml7.parse)(readFileSync13(agentFile, "utf8"));
+      if (typeof parsed?.model === "string") {
+        agentModel = parsed.model;
+      } else if (parsed?.model && typeof parsed.model === "object" && !Array.isArray(parsed.model)) {
+        const declared = parsed.model;
+        const providerOk = typeof declared.provider === "string" && declared.provider.length > 0 && !declared.provider.includes("/");
+        const modelOk = typeof declared.model === "string" && declared.model.length > 0 && !declared.model.startsWith("/") && !declared.model.endsWith("/");
+        if (providerOk && modelOk) {
+          agentModel = `${declared.provider}/${declared.model}`;
+        } else {
+          return {
+            error: {
+              reason: "step_unsupported",
+              field: "model",
+              detail: "producer_route_unsupported: invalid model declaration"
+            }
+          };
+        }
+      }
+    } catch {
+    }
+  }
+  let selector = typeof step.model === "string" ? step.model : agentModel;
+  if (!selector) {
+    if (agentId === "implementer") {
+      selector = "xai/grok-4.6";
+    }
+  }
+  if (!selector) {
+    return {
+      error: {
+        reason: "step_unsupported",
+        field: "model",
+        detail: "producer_route_unsupported: agent or step has no model declared"
+      }
+    };
+  }
+  const slash = selector.indexOf("/");
+  if (slash <= 0 || slash === selector.length - 1) {
+    return {
+      error: {
+        reason: "step_unsupported",
+        field: "model",
+        detail: `producer_route_unsupported: invalid selector '${selector}'`
+      }
+    };
+  }
+  if (!isRouteAdmitted(projectRoot, selector)) {
+    return {
+      error: {
+        reason: "step_unsupported",
+        field: "model",
+        detail: `producer_route_unsupported: model '${selector}' is not admitted`
+      }
+    };
+  }
+  const role = agentId === "implementer" ? "writer" : agentId;
+  const roleBindings = listRoleBindings(projectRoot);
+  const roster = roleBindings[role];
+  if (roster && !roster.includes(selector)) {
+    return {
+      error: {
+        reason: "step_unsupported",
+        field: "model",
+        detail: `producer_route_unsupported: model '${selector}' not in role '${role}' roster`
+      }
+    };
+  }
+  const provider = selector.slice(0, slash);
+  const model = selector.slice(slash + 1);
+  return { provider, model, selector };
+}
 var ENGINE_ROUTING_METADATA_KEYS = /* @__PURE__ */ new Set(["workflowId", "askSha256", "objectiveSha256", "stepWrites"]);
 var MAX_PRODUCER_ROUTING_METADATA_FIELDS = MAX_PROVIDER_METADATA_FIELDS - ENGINE_ROUTING_METADATA_KEYS.size;
+function kxmLiveRunPrerequisites(bundle, workflowId, projectRoot) {
+  const workflow = bundle.workflows.get(workflowId);
+  if (!workflow) throw runtimeError("run_workflow_unknown", workflowId, `workflow ${workflowId} does not exist in this project`);
+  const plan = compileKxmWorkflow({ id: workflowId, value: workflow.value, logicalPath: workflow.logicalPath });
+  const envelope = { plan, projectLimits: kxmProjectAdmissionLimits(bundle), gates: pinnedGatesForCompiledPlan(plan, bundle, projectRoot) };
+  const prerequisites = [];
+  const limit = unsupportedLimit(envelope);
+  if (limit) prerequisites.push(limit);
+  const visited = /* @__PURE__ */ new Set();
+  const pending = [plan.entryStepId];
+  while (pending.length > 0) {
+    const stepId = pending.pop();
+    if (visited.has(stepId)) continue;
+    visited.add(stepId);
+    const step = plan.steps[stepId];
+    for (const transition2 of Object.values(step.transitions)) {
+      if (transition2.to === "step") pending.push(transition2.target);
+    }
+    const unsupported = step.kind === "gate" ? unsupportedGateStep(plan, step, envelope, { projectRoot }) ?? starterGatePrerequisite(step, envelope.gates, projectRoot) : unsupportedStep(plan, step, "oneshot");
+    if (unsupported) {
+      prerequisites.push({ ...unsupported, stepId });
+      continue;
+    }
+    if (step.kind !== "agent" && step.kind !== "moa") continue;
+    const agentIds = step.assignments.allowedAgents.length > 0 ? step.assignments.allowedAgents : [step.agent];
+    for (const agentId of agentIds) {
+      const agent = bundle.agents.get(agentId);
+      const harness = String(agent?.value.harness ?? bundle.project.value.defaultHarness ?? "pi");
+      const permission = Object.values(step.repositories).includes("write") ? "edit" : "read-only";
+      if (!BUILTIN_HARNESSES.some((entry) => entry.id === harness && entry.oneShot) || !oneShotPermissionArgs(harness, permission)) {
+        prerequisites.push({ reason: "step_unsupported", stepId, field: "harness", detail: `${agentId}: ${harness} has no audited ${permission} one-shot profile; use a supported workflow or execute this work directly in ${harness}, without substituting another harness` });
+        continue;
+      }
+      const route = resolveProducerRoute(projectRoot, step, agentId);
+      if ("error" in route) {
+        prerequisites.push({ ...route.error, stepId, detail: `${agentId}: ${route.error.detail}; configure its model in .kxm/agents/${agentId}.yaml and admit the installed model with kxm routes admit --model <provider/model>` });
+        continue;
+      }
+      const writeRefusal = unsupportedLiveWrite(projectRoot, step, agentId, route.selector, envelope.projectLimits.maxConcurrentRuns);
+      if (writeRefusal) {
+        prerequisites.push({ ...writeRefusal, stepId });
+        continue;
+      }
+      const compatible = validateHarnessModelPair(harness, route);
+      if (!compatible.valid) {
+        prerequisites.push({ reason: "step_unsupported", stepId, field: "model", detail: `${agentId}: ${compatible.message ?? `${harness} cannot run ${route.selector}`}; configure a model supported by ${harness} in .kxm/agents/${agentId}.yaml` });
+      }
+    }
+  }
+  return prerequisites;
+}
+function starterGatePrerequisite(step, gates, projectRoot) {
+  const definition = gates.definitions[step.gate];
+  if (!definition || definition.kind !== "command" || definition.argv.length !== 2 || definition.argv[0] !== "npm" || definition.argv[1] !== "test") return void 0;
+  let testScript;
+  try {
+    const manifest = JSON.parse(readFileSync13(join15(projectRoot, "package.json"), "utf8"));
+    if (manifest && typeof manifest === "object" && "scripts" in manifest) {
+      const scripts = manifest.scripts;
+      if (scripts && typeof scripts === "object" && "test" in scripts) testScript = scripts.test;
+    }
+  } catch {
+  }
+  if (typeof testScript !== "string" || testScript.trim().length === 0) {
+    return { reason: "gate_unsupported", field: `gates.${step.gate}.argv`, detail: `gate ${step.gate} runs npm test but this repository has no readable package.json with scripts.test; configure .kxm/gates.yaml gates.${step.gate}.argv for the repository's actual test runner before driving this workflow` };
+  }
+  return void 0;
+}
+function unsupportedLimit(envelope) {
+  if (envelope.plan.limits.maxAgentTimeMs !== void 0) {
+    return { reason: "limit_unsupported", field: "limits.maxAgentTimeMs", detail: "agent-time budget enforcement is not available in this slice" };
+  }
+  if (envelope.projectLimits.maxAgentTimeMs !== void 0) {
+    return { reason: "limit_unsupported", field: "project.limits.maxAgentTimeMs", detail: "agent-time budget enforcement is not available in this slice" };
+  }
+  return void 0;
+}
+function unsupportedStep(plan, step, producerId) {
+  if (step.kind === "gate") throw runtimeError("run_plan_corrupt", plan.workflowId, `unsupportedStep called on gate without envelope; use unsupportedGateStep instead`);
+  if (step.kind !== "agent" && step.kind !== "moa" && step.kind !== "approval" && step.kind !== "wait") {
+    return { reason: "step_unsupported", field: "kind", detail: `step kind ${step.kind} is not executed in this slice` };
+  }
+  if (step.assignments.maxAttemptsPerAssignment > 2) {
+    return { reason: "step_unsupported", field: "assignments.maxAttemptsPerAssignment", detail: "only up to two physical attempts are supported in this slice" };
+  }
+  if (step.join.strategy !== "all" && step.join.strategy !== "all-settled") {
+    return { reason: "step_unsupported", field: "join.strategy", detail: "only join all or all-settled is supported" };
+  }
+  if (step.join.strategy === "all" && step.join.minimumPassed !== void 0) {
+    return { reason: "step_unsupported", field: "join.minimumPassed", detail: "minimumPassed requires join strategy all-settled" };
+  }
+  if (step.join.cancelRemaining) {
+    return { reason: "step_unsupported", field: "join.cancelRemaining", detail: "cancelRemaining is not executed in this slice" };
+  }
+  if (step.assignments.distinctBy.some((d2) => d2 !== "provider")) {
+    return { reason: "step_unsupported", field: "assignments.distinctBy", detail: "only distinctBy provider is supported in this slice" };
+  }
+  if (step.assignments.maxWriteRepositories !== void 0 && step.assignments.maxWriteRepositories > 1) {
+    return { reason: "step_unsupported", field: "assignments.maxWriteRepositories", detail: "at most one write repository is supported in this slice" };
+  }
+  for (const evidence of step.requiredEvidence) {
+    if (!evidence || !["artifact", "assignment-result", "gate", "approval", "receipt"].includes(evidence.kind)) {
+      return { reason: "step_unsupported", field: "requiredEvidence", detail: `evidence kind '${evidence?.kind}' is not supported in this slice` };
+    }
+  }
+  if (step.timeoutMs !== void 0 && step.timeoutMs <= 0) {
+    return { reason: "step_unsupported", field: "timeoutMs", detail: "timeoutMs must be positive" };
+  }
+  if (step.safeSpeculation) return { reason: "step_unsupported", field: "safeSpeculation", detail: "speculation is not executed in this slice" };
+  if (step.tools) return { reason: "step_unsupported", field: "tools", detail: "tools are not executed in this slice" };
+  if (step.secrets.length > 0) return { reason: "step_unsupported", field: "secrets", detail: "secrets are not executed in this slice" };
+  for (const [repoId, access] of Object.entries(step.repositories)) {
+    if (access !== "read" && access !== "write" && access !== "none") {
+      return { reason: "step_unsupported", field: "repositories", detail: `invalid repository access '${access}' on ${repoId}` };
+    }
+  }
+  return void 0;
+}
+function readYamlRecord(path4) {
+  if (!existsSync15(path4)) return void 0;
+  try {
+    const parsed = (0, import_yaml7.parse)(readFileSync13(path4, "utf8"));
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+function agentHarness(projectRoot, agentId) {
+  const harness = readYamlRecord(join15(projectRoot, ".kxm", "agents", `${agentId}.yaml`))?.harness;
+  return typeof harness === "string" && harness.length > 0 ? harness : void 0;
+}
+function projectDefaultHarness(projectRoot) {
+  const harness = readYamlRecord(join15(projectRoot, ".kxm", "project.yaml"))?.defaultHarness;
+  return typeof harness === "string" && harness.length > 0 ? harness : "pi";
+}
+function unsupportedLiveWrite(projectRoot, step, agentId, selector, maxConcurrentRuns) {
+  if (!Object.values(step.repositories).some((access) => access === "write")) return void 0;
+  if (step.assignments.maximum !== 1) {
+    return {
+      reason: "step_unsupported",
+      field: "assignments.maximum",
+      detail: "live write steps run a single assignment; the checkout witness cannot attribute edits between writers"
+    };
+  }
+  if (maxConcurrentRuns !== 1) {
+    return {
+      reason: "step_unsupported",
+      field: "limits.maxConcurrentRuns",
+      detail: "live write steps require limits.maxConcurrentRuns of 1; concurrent runs share one checkout"
+    };
+  }
+  const harness = agentHarness(projectRoot, agentId) ?? projectDefaultHarness(projectRoot);
+  if (!oneShotWriterArgs(harness)) {
+    return {
+      reason: "step_unsupported",
+      field: "repositories",
+      detail: `live write steps require an audited writer profile; ${harness} has none`
+    };
+  }
+  const rosterPath = join15(projectRoot, ".kxm", "roster.yaml");
+  if (!existsSync15(rosterPath)) return void 0;
+  const roster = readYamlRecord(rosterPath);
+  if (!roster || roster.schema !== "kxm.developer-roster.v1") {
+    return { reason: "step_unsupported", field: "model", detail: "live write steps require a readable kxm.developer-roster.v1" };
+  }
+  const routes = roster.routes;
+  const lineup = roster.lineup;
+  const writerIds = lineup && typeof lineup === "object" && !Array.isArray(lineup) ? lineup.writer : void 0;
+  if (!routes || typeof routes !== "object" || Array.isArray(routes) || !Array.isArray(writerIds)) {
+    return { reason: "step_unsupported", field: "model", detail: "developer roster has no writer lineup" };
+  }
+  const allowed = writerIds.some((id) => {
+    if (typeof id !== "string") return false;
+    const route = routes[id];
+    if (!route || typeof route !== "object" || Array.isArray(route)) return false;
+    const record = route;
+    if (record.harness !== harness || record.status !== "admitted") return false;
+    if (!Array.isArray(record.permissions) || !record.permissions.includes("edit")) return false;
+    const model = typeof record.model === "string" ? record.model : "";
+    const vendor = typeof record.vendor === "string" ? record.vendor : "";
+    return model === selector || vendor.length > 0 && `${vendor}/${model}` === selector;
+  });
+  if (!allowed) {
+    return {
+      reason: "step_unsupported",
+      field: "model",
+      detail: `live write route ${selector} on ${harness} is not on the developer roster writer lineup`
+    };
+  }
+  return void 0;
+}
+function unsupportedGateStep(plan, step, envelope, context) {
+  if (!step.gate) return { reason: "step_unsupported", field: "gate", detail: "gate step is missing gate id" };
+  if (envelope.gates.registry === null) {
+    return { reason: "step_unsupported", field: "gate", detail: `step ${step.id} refers to a gate but registry is null` };
+  }
+  const definition = envelope.gates.definitions[step.gate];
+  if (!definition) {
+    return { reason: "step_unsupported", field: "gate", detail: `gate definition ${step.gate} not found in registry` };
+  }
+  if (definition.kind === "reserved") {
+    return { reason: "gate_unsupported", field: "gate", detail: `gate ${step.gate} is reserved and cannot be executed` };
+  }
+  if (step.assignments.allowedAgents && step.assignments.allowedAgents.length > 0) {
+    return { reason: "step_unsupported", field: "assignments.allowedAgents", detail: "gate steps do not support allowedAgents" };
+  }
+  if (step.assignments.minimum !== 1 || step.assignments.target !== 1 || step.assignments.maximum !== 1) {
+    return { reason: "step_unsupported", field: "assignments", detail: "gate steps require exactly 1 agent assignment" };
+  }
+  if (step.assignments.maxParallel !== 1) {
+    return { reason: "step_unsupported", field: "assignments.maxParallel", detail: "gate steps require maxParallel of 1" };
+  }
+  if (step.assignments.maxAttemptsPerAssignment !== 1) {
+    return { reason: "step_unsupported", field: "assignments.maxAttemptsPerAssignment", detail: "gate steps require maxAttemptsPerAssignment of 1" };
+  }
+  if (step.assignments.distinctBy && step.assignments.distinctBy.length > 0) {
+    return { reason: "step_unsupported", field: "assignments.distinctBy", detail: "gate steps do not support distinctBy" };
+  }
+  if (step.assignments.maxWriteRepositories) {
+    return { reason: "step_unsupported", field: "assignments.maxWriteRepositories", detail: "gate steps do not support maxWriteRepositories" };
+  }
+  if (step.join.strategy !== "all") {
+    return { reason: "step_unsupported", field: "join", detail: `gate steps require join strategy 'all', not '${step.join.strategy}'` };
+  }
+  if (step.join.minimumPassed !== void 0) {
+    return { reason: "step_unsupported", field: "join", detail: "gate steps do not support minimumPassed" };
+  }
+  if (step.join.cancelRemaining) {
+    return { reason: "step_unsupported", field: "join", detail: "gate steps do not support cancelRemaining" };
+  }
+  for (const evidence of step.requiredEvidence) {
+    if (!evidence || !["gate", "artifact", "receipt", "assignment-result", "approval"].includes(evidence.kind)) {
+      return { reason: "step_unsupported", field: "requiredEvidence", detail: `gate steps do not support evidence kind '${evidence?.kind}'` };
+    }
+  }
+  if (step.safeSpeculation) {
+    return { reason: "step_unsupported", field: "safeSpeculation", detail: "gate steps do not support safeSpeculation" };
+  }
+  if (step.tools) {
+    return { reason: "step_unsupported", field: "tools", detail: "gate steps do not support tools" };
+  }
+  if (step.secrets && step.secrets.length > 0) {
+    return { reason: "step_unsupported", field: "secrets", detail: "gate steps do not support secrets" };
+  }
+  if (step.model) {
+    return { reason: "step_unsupported", field: "model", detail: "gate steps do not support model" };
+  }
+  if (plan.reproOracle?.stageId === step.id) {
+    return { reason: "step_unsupported", field: "reproOracle", detail: "gate steps cannot be repro oracle" };
+  }
+  if (plan.planHash?.stageId === step.id) {
+    return { reason: "step_unsupported", field: "planHash", detail: "gate steps cannot be plan hash oracle" };
+  }
+  if (step.timeoutMs !== void 0) {
+    if (definition.kind === "artifacts-exist") {
+      return { reason: "step_unsupported", field: "timeoutMs", detail: "artifacts-exist gates do not support timeoutMs" };
+    }
+    if (definition.kind === "command" && definition.timeoutMs !== void 0 && step.timeoutMs < definition.timeoutMs) {
+      return { reason: "step_unsupported", field: "timeoutMs", detail: "command step timeoutMs narrower than the registry timeout is refused" };
+    }
+  }
+  const repositories = step.repositories;
+  if (!repositories || Object.keys(repositories).length === 0) {
+    return { reason: "step_unsupported", field: "repositories", detail: "gate steps require repository declarations" };
+  }
+  if (definition.kind === "artifacts-exist") {
+    const controlAccess = repositories.control;
+    if (controlAccess !== "read" && controlAccess !== "write") {
+      return { reason: "step_unsupported", field: "repositories", detail: "artifacts-exist gates require control repository access as read or write" };
+    }
+    for (const [repoId, access] of Object.entries(repositories)) {
+      if (repoId !== "control" && access !== "none") {
+        return { reason: "step_unsupported", field: "repositories", detail: "artifacts-exist gates require other repositories to have access 'none'" };
+      }
+    }
+  } else if (definition.kind === "command") {
+    for (const [repoId, access] of Object.entries(repositories)) {
+      if (access !== "read" && access !== "write" && access !== "none") {
+        return { reason: "step_unsupported", field: "repositories", detail: `invalid repository access '${access}' on ${repoId}` };
+      }
+    }
+    const hasWrite = Object.values(repositories).some((access) => access === "write");
+    if (!hasWrite) {
+      return { reason: "step_unsupported", field: "repositories", detail: "command gates require at least one repository with write access" };
+    }
+  }
+  const expectPass = step.expect === "pass";
+  if (expectPass) {
+    if (!step.outcomes.includes("passed")) {
+      return { reason: "gate_outcome_undeclared", field: "outcomes", detail: "step expects pass but missing required outcome passed; spell it as 'passed'" };
+    }
+    if (!step.outcomes.includes("implementation-failure") && !step.outcomes.includes("failed")) {
+      return { reason: "gate_outcome_undeclared", field: "outcomes", detail: "step expects pass but missing required failure outcome; declare implementation-failure or failed" };
+    }
+  } else {
+    if (!step.outcomes.includes("repro-missing")) {
+      return { reason: "gate_outcome_undeclared", field: "outcomes", detail: "step expects fail but missing required outcome repro-missing; spell it as 'repro-missing'" };
+    }
+    if (!step.outcomes.includes("implementation-failure") && !step.outcomes.includes("failed")) {
+      return { reason: "gate_outcome_undeclared", field: "outcomes", detail: "step expects fail but missing required failure outcome; declare implementation-failure or failed" };
+    }
+  }
+  if (context && projectRuntimeKey(context.projectRoot) !== envelope.gates.controlRoot.projectKey) {
+    throw runtimeError("run_owner_mismatch", plan.workflowId, `gate control root does not match project`);
+  }
+  if (definition.kind === "artifacts-exist" && step.expect === "fail") {
+    return { reason: "step_unsupported", field: "expect", detail: "artifacts-exist gates cannot expect fail" };
+  }
+  return void 0;
+}
+function pinnedGatesForCompiledPlan(plan, bundle, projectRoot) {
+  const referenced = /* @__PURE__ */ new Set();
+  for (const step of Object.values(plan.steps)) {
+    if (step.kind === "gate") referenced.add(step.gate);
+  }
+  const definitions = /* @__PURE__ */ Object.create(null);
+  const registryValue = bundle.gateRegistry?.value;
+  const gatesObject = registryValue && typeof registryValue.gates === "object" && registryValue.gates && !Array.isArray(registryValue.gates) ? registryValue.gates : {};
+  for (const gateId of referenced) {
+    definitions[gateId] = parseGateDefinition(gatesObject[gateId], gateId, plan.workflowId);
+  }
+  return {
+    registry: referenced.size > 0 && bundle.gateRegistry ? { schema: "kxm.gate-registry.v1", hash: gateRegistryHash(bundle.gateRegistry.value) } : bundle.gateRegistry && referenced.size === 0 ? { schema: "kxm.gate-registry.v1", hash: gateRegistryHash(bundle.gateRegistry.value) } : null,
+    definitions,
+    controlRoot: { repositoryId: "control", projectKey: projectRuntimeKey(projectRoot) }
+  };
+}
 
 // plugins/kxm/src/hub-binding.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync13, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync10, readFileSync as readFileSync14, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync11 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname10, isAbsolute as isAbsolute6, join as join15, resolve as resolve11 } from "node:path";
+import { dirname as dirname10, isAbsolute as isAbsolute6, join as join16, resolve as resolve11 } from "node:path";
 var HUB_BINDING_SCHEMA = "kxm.hub-binding.v1";
 var HUB_HEALTH_PROBE_MS = 300;
 var HubBindingError = class extends Error {
@@ -27182,16 +27705,16 @@ function resolveUserStateRoot2(env) {
   }
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    const base2 = localAppData && isAbsolute6(localAppData) ? localAppData : join15(homedir4(), "AppData", "Local");
+    const base2 = localAppData && isAbsolute6(localAppData) ? localAppData : join16(homedir4(), "AppData", "Local");
     return resolve11(base2, "KXM");
   }
   if (process.platform === "darwin") return resolve11(homedir4(), "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
-  const base = xdgState && isAbsolute6(xdgState) ? xdgState : join15(homedir4(), ".local", "state");
+  const base = xdgState && isAbsolute6(xdgState) ? xdgState : join16(homedir4(), ".local", "state");
   return resolve11(base, "kxm");
 }
 function hubBindingFile(env = process.env) {
-  return join15(resolveUserStateRoot2(env), "hub-binding.json");
+  return join16(resolveUserStateRoot2(env), "hub-binding.json");
 }
 function validateHubUrl(raw) {
   let parsed;
@@ -27227,10 +27750,10 @@ function isAbortError(error) {
 }
 function readHubBinding(env = process.env) {
   const file = hubBindingFile(env);
-  if (!existsSync15(file)) return void 0;
+  if (!existsSync16(file)) return void 0;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync13(file, "utf8"));
+    parsed = JSON.parse(readFileSync14(file, "utf8"));
   } catch {
     throw new HubBindingError(`malformed hub binding at ${file}`);
   }
@@ -27253,7 +27776,7 @@ function readHubBinding(env = process.env) {
 function writeHubBinding(record, env = process.env) {
   const file = hubBindingFile(env);
   mkdirSync10(dirname10(file), { recursive: true, mode: 448 });
-  const temporary = join15(dirname10(file), `.hub-binding-${process.pid}.tmp`);
+  const temporary = join16(dirname10(file), `.hub-binding-${process.pid}.tmp`);
   try {
     writeFileSync11(temporary, `${JSON.stringify(record, null, 2)}
 `, { encoding: "utf8", mode: 384 });
@@ -27302,7 +27825,7 @@ var DEFAULT_LOG_MAX_BYTES = 10 * 1024 * 1024;
 
 // plugins/kxm/src/runtime-supervisor.ts
 function kxmSupervisorTokenFile(paths) {
-  return join16(paths.runtimeDir, "supervisor.token");
+  return join17(paths.runtimeDir, "supervisor.token");
 }
 function readKxmSupervisorToken(paths) {
   const file = kxmSupervisorTokenFile(paths);
@@ -27311,7 +27834,7 @@ function readKxmSupervisorToken(paths) {
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw runtimeError("runtime_path_invalid", file, "supervisor token file must be a regular file, not a link");
   }
-  const token = readFileSync14(file, "utf8").trim();
+  const token = readFileSync15(file, "utf8").trim();
   return token.length >= 32 ? token : void 0;
 }
 function processAlive(pid) {
@@ -27325,11 +27848,11 @@ function processAlive(pid) {
 var HEARTBEAT_STALE_MS = 15e3;
 var SUPERVISOR_ERROR_MAX_AGE_MS = 3e4;
 function supervisorErrorFile(paths) {
-  return join16(paths.runtimeDir, "supervisor.error");
+  return join17(paths.runtimeDir, "supervisor.error");
 }
 function clearSupervisorError(paths) {
   const file = supervisorErrorFile(paths);
-  if (existsSync16(file)) rmSync5(file, { force: true });
+  if (existsSync17(file)) rmSync5(file, { force: true });
 }
 function readRecentSupervisorError(paths) {
   const file = supervisorErrorFile(paths);
@@ -27338,7 +27861,7 @@ function readRecentSupervisorError(paths) {
   const ageMs = Date.now() - stat.mtimeMs;
   if (ageMs > SUPERVISOR_ERROR_MAX_AGE_MS) return void 0;
   try {
-    return readFileSync14(file, "utf8").trim();
+    return readFileSync15(file, "utf8").trim();
   } catch {
     return void 0;
   }
@@ -27359,7 +27882,7 @@ function supervisorStatusOf(record) {
   };
 }
 function kxmSupervisorStatus(paths, options = {}) {
-  if (!existsSync16(paths.registryDb)) return { running: false };
+  if (!existsSync17(paths.registryDb)) return { running: false };
   if (options.readOnly) {
     const database = openReadOnlyDatabase(paths.registryDb);
     try {
@@ -27425,7 +27948,7 @@ async function ensureKxmSupervisor(options = {}) {
     throw runtimeError("runtime_supervisor_unreachable", paths.registryDb, `runtime supervisor pid ${status.pid} is registered as running but cannot be probed`);
   }
   clearSupervisorError(paths);
-  const scriptPath = join16(findKxmRepoRoot(import.meta.url), "scripts", "kxm-runtime-supervisor.mjs");
+  const scriptPath = join17(findKxmRepoRoot(import.meta.url), "scripts", "kxm-runtime-supervisor.mjs");
   const spawnImpl = options.spawnImpl ?? ((script, env) => {
     const child = spawn2(process.execPath, [script], {
       detached: true,
@@ -27489,11 +28012,11 @@ function handoffSuffix(handoff) {
 
 // plugins/kxm/src/cli/types.ts
 import { spawn as spawn3 } from "node:child_process";
-import { join as join18, resolve as resolve12 } from "node:path";
+import { join as join19, resolve as resolve12 } from "node:path";
 
 // plugins/kxm/src/telemetry.ts
-import { appendFileSync, mkdirSync as mkdirSync12, readFileSync as readFileSync15 } from "node:fs";
-import { dirname as dirname12, join as join17 } from "node:path";
+import { appendFileSync, mkdirSync as mkdirSync12, readFileSync as readFileSync16 } from "node:fs";
+import { dirname as dirname12, join as join18 } from "node:path";
 var TELEMETRY_SCHEMA = "kxm.telemetry.v1";
 function inferImprovementTarget(input) {
   const explicit = input.env?.KXM_IMPROVE_TARGET?.trim();
@@ -27508,7 +28031,7 @@ function appendTelemetry(path4, event) {
 `, { encoding: "utf8", mode: 384 });
 }
 function telemetryPath(logsDir) {
-  return join17(logsDir, "telemetry.jsonl");
+  return join18(logsDir, "telemetry.jsonl");
 }
 function makeTelemetryEvent(input) {
   return {
@@ -27523,7 +28046,7 @@ function makeTelemetryEvent(input) {
 function readRoutingRecords(path4) {
   const records = [];
   try {
-    const raw = readFileSync15(path4, "utf8");
+    const raw = readFileSync16(path4, "utf8");
     for (const line of raw.split(/\r?\n/)) {
       if (!line.trim()) continue;
       try {
@@ -27602,7 +28125,7 @@ function workerResult(worker, payload) {
 // plugins/kxm/src/cli/types.ts
 function spawnScript(scriptName, extraEnv = {}) {
   return new Promise((resolveExit) => {
-    const child = spawn3(process.execPath, [join18(findKxmRepoRoot(import.meta.url), "scripts", scriptName)], {
+    const child = spawn3(process.execPath, [join19(findKxmRepoRoot(import.meta.url), "scripts", scriptName)], {
       stdio: "inherit",
       env: { ...process.env, ...extraEnv }
     });
@@ -27703,10 +28226,10 @@ function workspaceDirs(cwd, workspaceFlag, env) {
   return {
     workdir,
     workspace,
-    config: derive ? join18(workspace, "config") : resolve12(workdir, env.KXM_CONFIG_DIR?.trim() || join18(workspace, "config")),
-    logs: derive ? join18(workspace, "logs") : resolve12(workdir, env.KXM_LOGS_DIR?.trim() || join18(workspace, "logs")),
-    assets: derive ? join18(workspace, "assets") : resolve12(workdir, env.KXM_ASSETS_DIR?.trim() || join18(workspace, "assets")),
-    state: derive ? join18(workspace, "state") : resolve12(workdir, env.KXM_STATE_DIR?.trim() || join18(workspace, "state"))
+    config: derive ? join19(workspace, "config") : resolve12(workdir, env.KXM_CONFIG_DIR?.trim() || join19(workspace, "config")),
+    logs: derive ? join19(workspace, "logs") : resolve12(workdir, env.KXM_LOGS_DIR?.trim() || join19(workspace, "logs")),
+    assets: derive ? join19(workspace, "assets") : resolve12(workdir, env.KXM_ASSETS_DIR?.trim() || join19(workspace, "assets")),
+    state: derive ? join19(workspace, "state") : resolve12(workdir, env.KXM_STATE_DIR?.trim() || join19(workspace, "state"))
   };
 }
 function maskEnvName(name) {
@@ -27774,20 +28297,20 @@ function workspaceEnv(runtime) {
 // plugins/kxm/src/cli/roles.ts
 var import_yaml10 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { existsSync as existsSync19, readFileSync as readFileSync18 } from "node:fs";
-import { join as join21, resolve as resolve15 } from "node:path";
+import { existsSync as existsSync20, readFileSync as readFileSync19 } from "node:fs";
+import { join as join22, resolve as resolve15 } from "node:path";
 import { createInterface } from "node:readline";
 
 // plugins/kxm/src/role.ts
 var import_yaml9 = __toESM(require_dist(), 1);
-import { existsSync as existsSync18, mkdirSync as mkdirSync14, readdirSync as readdirSync6, readFileSync as readFileSync17, rmSync as rmSync6, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync14, readdirSync as readdirSync6, readFileSync as readFileSync18, rmSync as rmSync6, writeFileSync as writeFileSync14 } from "node:fs";
+import { join as join21 } from "node:path";
 
 // plugins/kxm/src/config.ts
 var import_yaml8 = __toESM(require_dist(), 1);
-import { existsSync as existsSync17, mkdirSync as mkdirSync13, readFileSync as readFileSync16, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync13, readFileSync as readFileSync17, writeFileSync as writeFileSync13 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname13, join as join19, resolve as resolve13 } from "node:path";
+import { dirname as dirname13, join as join20, resolve as resolve13 } from "node:path";
 var KXM_CONFIG_SCHEMA = "kxm.config.v1";
 var IMPROVEMENT_PROMOTION_POLICIES = ["manual_pr", "critic_quorum", "auto_threshold"];
 var DEFAULT_KXM_CONFIG = {
@@ -27842,7 +28365,7 @@ var DEFAULT_KXM_CONFIG = {
 };
 function userConfigDirectory(overrideDir) {
   if (overrideDir) return resolve13(overrideDir);
-  return resolve13(process.env.KXM_USER_CONFIG_DIR?.trim() || join19(homedir5(), ".config", "kxm"));
+  return resolve13(process.env.KXM_USER_CONFIG_DIR?.trim() || join20(homedir5(), ".config", "kxm"));
 }
 function repoConfigDirectory(repoRoot) {
   return resolve13(repoRoot, ".kxm");
@@ -27889,14 +28412,14 @@ function normalizeImprovementConfig(raw) {
 }
 function loadKxmConfig(repoRoot = process.cwd(), options = {}) {
   const userDir = userConfigDirectory(options.userConfigDir);
-  const userConfigFile = join19(userDir, "config.yaml");
+  const userConfigFile = join20(userDir, "config.yaml");
   const repoDir = repoConfigDirectory(repoRoot);
-  const repoConfigFile = join19(repoDir, "config.yaml");
+  const repoConfigFile = join20(repoDir, "config.yaml");
   let userRaw = {};
   let userLoadedPath;
-  if (existsSync17(userConfigFile)) {
+  if (existsSync18(userConfigFile)) {
     try {
-      const text = readFileSync16(userConfigFile, "utf8");
+      const text = readFileSync17(userConfigFile, "utf8");
       userRaw = (0, import_yaml8.parse)(text) ?? {};
       userLoadedPath = userConfigFile;
     } catch (error) {
@@ -27905,9 +28428,9 @@ function loadKxmConfig(repoRoot = process.cwd(), options = {}) {
   }
   let repoRaw = {};
   let repoLoadedPath;
-  if (existsSync17(repoConfigFile)) {
+  if (existsSync18(repoConfigFile)) {
     try {
-      const text = readFileSync16(repoConfigFile, "utf8");
+      const text = readFileSync17(repoConfigFile, "utf8");
       repoRaw = (0, import_yaml8.parse)(text) ?? {};
       repoLoadedPath = repoConfigFile;
     } catch (error) {
@@ -27943,7 +28466,7 @@ function getKxmConfigValue(config, keyPath) {
   return current;
 }
 function kxmConfigFileForScope(repoRoot, scope, userConfigDir) {
-  return scope === "user" ? join19(userConfigDirectory(userConfigDir), "config.yaml") : join19(repoConfigDirectory(repoRoot), "config.yaml");
+  return scope === "user" ? join20(userConfigDirectory(userConfigDir), "config.yaml") : join20(repoConfigDirectory(repoRoot), "config.yaml");
 }
 function configKeyParts(keyPath) {
   const parts = keyPath.split(".");
@@ -27954,9 +28477,9 @@ function configKeyParts(keyPath) {
 }
 function readConfigFile(targetFile2) {
   let existing = {};
-  if (existsSync17(targetFile2)) {
+  if (existsSync18(targetFile2)) {
     try {
-      existing = (0, import_yaml8.parse)(readFileSync16(targetFile2, "utf8")) ?? {};
+      existing = (0, import_yaml8.parse)(readFileSync17(targetFile2, "utf8")) ?? {};
     } catch {
       existing = {};
     }
@@ -28074,21 +28597,21 @@ var DEFAULT_ROLES = {
 };
 function rolesDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
   if (scope === "global") {
-    return join20(userConfigDirectory(userConfigDir), "roles");
+    return join21(userConfigDirectory(userConfigDir), "roles");
   }
-  return join20(repoConfigDirectory(repoRoot), "roles");
+  return join21(repoConfigDirectory(repoRoot), "roles");
 }
 function ensureRolesDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
   const dir = rolesDirectory(scope, repoRoot, userConfigDir);
-  if (!existsSync18(dir)) {
+  if (!existsSync19(dir)) {
     mkdirSync14(dir, { recursive: true });
   }
   return dir;
 }
 function parseRoleFile(filePath) {
-  if (!existsSync18(filePath)) return void 0;
+  if (!existsSync19(filePath)) return void 0;
   try {
-    const raw = readFileSync17(filePath, "utf8");
+    const raw = readFileSync18(filePath, "utf8");
     const parsed = (0, import_yaml9.parse)(raw);
     if (!parsed || typeof parsed !== "object" || parsed.schema !== KXM_ROLE_SCHEMA) {
       return void 0;
@@ -28115,10 +28638,10 @@ function listRoles(options = {}) {
   const globalDir = rolesDirectory("global", repoRoot, options.userConfigDir);
   const localDir = rolesDirectory("local", repoRoot, options.userConfigDir);
   const localRoles = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "global" && existsSync18(localDir)) {
+  if (scopeFilter !== "global" && existsSync19(localDir)) {
     for (const entry of readdirSync6(localDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join20(localDir, entry);
+        const filePath = join21(localDir, entry);
         const parsed = parseRoleFile(filePath);
         if (parsed) {
           localRoles.set(parsed.id, { role: parsed, filePath });
@@ -28127,10 +28650,10 @@ function listRoles(options = {}) {
     }
   }
   const globalRoles = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "local" && existsSync18(globalDir)) {
+  if (scopeFilter !== "local" && existsSync19(globalDir)) {
     for (const entry of readdirSync6(globalDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join20(globalDir, entry);
+        const filePath = join21(globalDir, entry);
         const parsed = parseRoleFile(filePath);
         if (parsed) {
           globalRoles.set(parsed.id, { role: parsed, filePath });
@@ -28178,13 +28701,13 @@ function getRole(roleId, options = {}) {
   const repoRoot = options.repoRoot ?? process.cwd();
   if (scope !== "global") {
     const localDir = rolesDirectory("local", repoRoot, options.userConfigDir);
-    const localFile = join20(localDir, `${roleId}.yaml`);
+    const localFile = join21(localDir, `${roleId}.yaml`);
     const parsed = parseRoleFile(localFile);
     if (parsed) return { role: parsed, scope: "local", filePath: localFile };
   }
   if (scope !== "local") {
     const globalDir = rolesDirectory("global", repoRoot, options.userConfigDir);
-    const globalFile = join20(globalDir, `${roleId}.yaml`);
+    const globalFile = join21(globalDir, `${roleId}.yaml`);
     const parsed = parseRoleFile(globalFile);
     if (parsed) return { role: parsed, scope: "global", filePath: globalFile };
   }
@@ -28194,8 +28717,8 @@ function addRole(role, options = {}) {
   const scope = options.scope ?? "local";
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = options.dryRun ? rolesDirectory(scope, repoRoot, options.userConfigDir) : ensureRolesDirectory(scope, repoRoot, options.userConfigDir);
-  const filePath = join20(dir, `${role.id}.yaml`);
-  if (existsSync18(filePath) && !options.overwrite) {
+  const filePath = join21(dir, `${role.id}.yaml`);
+  if (existsSync19(filePath) && !options.overwrite) {
     throw new Error(`role_already_exists: role '${role.id}' already exists at ${filePath}`);
   }
   if (!options.dryRun) writeFileSync14(filePath, (0, import_yaml9.stringify)(role), "utf8");
@@ -28205,8 +28728,8 @@ function removeRole(roleId, options = {}) {
   const scope = options.scope ?? "local";
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = rolesDirectory(scope, repoRoot, options.userConfigDir);
-  const filePath = join20(dir, `${roleId}.yaml`);
-  if (!existsSync18(filePath)) {
+  const filePath = join21(dir, `${roleId}.yaml`);
+  if (!existsSync19(filePath)) {
     throw new Error(`role_not_found: role '${roleId}' not found in ${scope} directory (${filePath})`);
   }
   if (options.dryRun) return { id: roleId, removed: false, filePath, scope };
@@ -28228,7 +28751,7 @@ function modifyRole(roleId, updates, options = {}) {
   const scope = options.scope ?? target.scope;
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = options.dryRun ? rolesDirectory(scope, repoRoot, options.userConfigDir) : ensureRolesDirectory(scope, repoRoot, options.userConfigDir);
-  const filePath = join20(dir, `${roleId}.yaml`);
+  const filePath = join21(dir, `${roleId}.yaml`);
   if (!options.dryRun) writeFileSync14(filePath, (0, import_yaml9.stringify)(updated), "utf8");
   return { id: roleId, role: updated, filePath, scope };
 }
@@ -28277,18 +28800,18 @@ var DEFAULT_ROLE_SEATS = {
 };
 function findExistingRoleHostsFile(scope, repoRoot = process.cwd(), userConfigDir) {
   const dir = scope === "global" ? userConfigDirectory(userConfigDir) : repoConfigDirectory(repoRoot);
-  const yamlPath = join20(dir, "role-hosts.yaml");
-  const ymlPath = join20(dir, "role-hosts.yml");
-  const jsonPath = join20(dir, "role-hosts.json");
-  if (existsSync18(yamlPath)) return { filePath: yamlPath, exists: true, format: "yaml" };
-  if (existsSync18(ymlPath)) return { filePath: ymlPath, exists: true, format: "yaml" };
-  if (existsSync18(jsonPath)) return { filePath: jsonPath, exists: true, format: "json" };
+  const yamlPath = join21(dir, "role-hosts.yaml");
+  const ymlPath = join21(dir, "role-hosts.yml");
+  const jsonPath = join21(dir, "role-hosts.json");
+  if (existsSync19(yamlPath)) return { filePath: yamlPath, exists: true, format: "yaml" };
+  if (existsSync19(ymlPath)) return { filePath: ymlPath, exists: true, format: "yaml" };
+  if (existsSync19(jsonPath)) return { filePath: jsonPath, exists: true, format: "json" };
   return { filePath: yamlPath, exists: false, format: "yaml" };
 }
 function parseRoleHostsFile(filePath) {
-  if (!existsSync18(filePath)) return void 0;
+  if (!existsSync19(filePath)) return void 0;
   try {
-    const raw = readFileSync17(filePath, "utf8");
+    const raw = readFileSync18(filePath, "utf8");
     const parsed = (0, import_yaml9.parse)(raw);
     if (!parsed || typeof parsed !== "object") return void 0;
     if (parsed.schema && parsed.schema !== KXM_ROLE_HOSTS_SCHEMA) return void 0;
@@ -28361,9 +28884,9 @@ function saveRoleHostsConfig(config, options = {}) {
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = scope === "global" ? userConfigDirectory(options.userConfigDir) : repoConfigDirectory(repoRoot);
   const format = options.format ?? "yaml";
-  const filePath = join20(dir, format === "json" ? "role-hosts.json" : "role-hosts.yaml");
+  const filePath = join21(dir, format === "json" ? "role-hosts.json" : "role-hosts.yaml");
   if (options.dryRun) return { filePath, scope };
-  if (!existsSync18(dir)) {
+  if (!existsSync19(dir)) {
     mkdirSync14(dir, { recursive: true });
   }
   const payload = {
@@ -28613,7 +29136,7 @@ async function cmdRoleAdd(runtime, roleId, options) {
   let roleDef;
   if (options.file) {
     const filePath = resolve15(runtime.cwd, options.file);
-    const content = readFileSync18(filePath, "utf8");
+    const content = readFileSync19(filePath, "utf8");
     roleDef = (0, import_yaml10.parse)(content);
     roleDef.id = roleId;
   } else {
@@ -28942,8 +29465,8 @@ async function cmdRoleResume(runtime, runId, ruling) {
       return 1;
     }
   }
-  const dbPath = join21(runtime.cwd, ".kxm", "state", "kxm.db");
-  if (existsSync19(dbPath)) {
+  const dbPath = join22(runtime.cwd, ".kxm", "state", "kxm.db");
+  if (existsSync20(dbPath)) {
     try {
       const database = runtime.dryRun ? openReadOnlyDatabase(dbPath) : new DatabaseSync(dbPath);
       try {
@@ -29015,8 +29538,8 @@ async function cmdRoleResume(runtime, runId, ruling) {
 // plugins/kxm/src/cli/workflows.ts
 var import_yaml12 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { existsSync as existsSync21, readFileSync as readFileSync20 } from "node:fs";
-import { join as join23, resolve as resolve18 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync21 } from "node:fs";
+import { join as join24, resolve as resolve17 } from "node:path";
 
 // plugins/kxm/src/retrospective.ts
 import { mkdirSync as mkdirSync15, renameSync as renameSync6, writeFileSync as writeFileSync15 } from "node:fs";
@@ -29344,7 +29867,7 @@ async function watchGithubChecks(input) {
   }
   const fetchImpl = input.fetchImpl ?? fetch;
   const now = input.now ?? Date.now;
-  const sleep = input.sleep ?? ((ms) => new Promise((resolve35) => setTimeout(resolve35, ms)));
+  const sleep = input.sleep ?? ((ms) => new Promise((resolve34) => setTimeout(resolve34, ms)));
   const deadline = now() + input.timeoutMs;
   const headers = {
     authorization: `Bearer ${token}`,
@@ -29443,8 +29966,22 @@ async function watchGithubChecks(input) {
 
 // plugins/kxm/src/workflow-manager.ts
 var import_yaml11 = __toESM(require_dist(), 1);
-import { existsSync as existsSync20, mkdirSync as mkdirSync16, readdirSync as readdirSync7, readFileSync as readFileSync19, rmSync as rmSync7, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync16, readdirSync as readdirSync7, readFileSync as readFileSync20, rmSync as rmSync7, writeFileSync as writeFileSync16 } from "node:fs";
+import { join as join23 } from "node:path";
+function assertWorkflowId(workflowId) {
+  if (!kxmResourceIdentifier(workflowId)) {
+    throw new Error(`workflow_id_invalid: '${workflowId}' must be a flat lowercase slug of at most 64 characters, starting with a letter and using letters, digits, single hyphens or underscores; paths and platform-reserved names are not allowed (use 'bug-fix', not 'software-engineering/bug-fix')`);
+  }
+}
+var workflowSchemaRegistry;
+function workflowPayload(workflowId, content, filePath) {
+  const payload = typeof content === "string" ? content : (0, import_yaml11.stringify)(content);
+  const value = parseRestrictedYaml2(payload, filePath);
+  const issues = (workflowSchemaRegistry ??= new KxmSchemaRegistry()).validate("workflow", value, filePath);
+  if (issues.length > 0) throw new KxmConfigError(issues);
+  compileKxmWorkflow({ id: workflowId, value, logicalPath: filePath });
+  return payload;
+}
 var completed = () => ({ target: "$terminal", terminalStatus: "completed" });
 var failed = () => ({ target: "$terminal", terminalStatus: "failed" });
 function verifyStep(retryStep) {
@@ -29581,24 +30118,22 @@ function scaffoldWorkflowDefinition(description) {
 var DEFAULT_WORKFLOW_TEMPLATE = WORKFLOW_TEMPLATES["implement-and-verify"];
 function workflowsDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
   if (scope === "global") {
-    return join22(userConfigDirectory(userConfigDir), "workflows");
+    return join23(userConfigDirectory(userConfigDir), "workflows");
   }
-  return join22(repoConfigDirectory(repoRoot), "workflows");
+  return join23(repoConfigDirectory(repoRoot), "workflows");
 }
 function ensureWorkflowsDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
   const dir = workflowsDirectory(scope, repoRoot, userConfigDir);
-  if (!existsSync20(dir)) {
+  if (!existsSync21(dir)) {
     mkdirSync16(dir, { recursive: true });
   }
   return dir;
 }
 function parseWorkflowFile(filePath) {
-  if (!existsSync20(filePath)) return void 0;
+  if (!existsSync21(filePath)) return void 0;
   try {
-    const raw = readFileSync19(filePath, "utf8");
-    const parsed = (0, import_yaml11.parse)(raw);
-    if (!parsed || typeof parsed !== "object") return void 0;
-    return parsed;
+    const raw = readFileSync20(filePath, "utf8");
+    return parseRestrictedYaml2(raw, filePath);
   } catch {
     return void 0;
   }
@@ -29609,26 +30144,26 @@ function listWorkflowDefinitions(options = {}) {
   const globalDir = workflowsDirectory("global", repoRoot, options.userConfigDir);
   const localDir = workflowsDirectory("local", repoRoot, options.userConfigDir);
   const localDefs = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "global" && existsSync20(localDir)) {
+  if (scopeFilter !== "global" && existsSync21(localDir)) {
     for (const entry of readdirSync7(localDir)) {
-      if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join22(localDir, entry);
+      const id = entry.endsWith(".yaml") ? entry.slice(0, -5) : entry.endsWith(".yml") ? entry.slice(0, -4) : void 0;
+      if (id && kxmResourceIdentifier(id)) {
+        const filePath = join23(localDir, entry);
         const def = parseWorkflowFile(filePath);
         if (def) {
-          const id = def.id || entry.replace(/\.ya?ml$/i, "");
           localDefs.set(id, { def, filePath });
         }
       }
     }
   }
   const globalDefs = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "local" && existsSync20(globalDir)) {
+  if (scopeFilter !== "local" && existsSync21(globalDir)) {
     for (const entry of readdirSync7(globalDir)) {
-      if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join22(globalDir, entry);
+      const id = entry.endsWith(".yaml") ? entry.slice(0, -5) : entry.endsWith(".yml") ? entry.slice(0, -4) : void 0;
+      if (id && kxmResourceIdentifier(id)) {
+        const filePath = join23(globalDir, entry);
         const def = parseWorkflowFile(filePath);
         if (def) {
-          const id = def.id || entry.replace(/\.ya?ml$/i, "");
           globalDefs.set(id, { def, filePath });
         }
       }
@@ -29639,7 +30174,7 @@ function listWorkflowDefinitions(options = {}) {
     const steps = Array.isArray(def.steps) ? def.steps : [];
     for (const step of steps) {
       if (step && typeof step === "object") {
-        const role = step.role || step.agent;
+        const role = step.agent;
         if (typeof role === "string" && !roles.includes(role)) {
           roles.push(role);
         }
@@ -29677,40 +30212,46 @@ function listWorkflowDefinitions(options = {}) {
   return result;
 }
 function getWorkflowDefinition(workflowId, options = {}) {
+  assertWorkflowId(workflowId);
   const scope = options.scope ?? "all";
   const repoRoot = options.repoRoot ?? process.cwd();
   if (scope !== "global") {
     const localDir = workflowsDirectory("local", repoRoot, options.userConfigDir);
-    const localFile = join22(localDir, `${workflowId}.yaml`);
+    const localFile = join23(localDir, `${workflowId}.yaml`);
     const parsed = parseWorkflowFile(localFile);
     if (parsed) return { workflow: parsed, scope: "local", filePath: localFile };
   }
   if (scope !== "local") {
     const globalDir = workflowsDirectory("global", repoRoot, options.userConfigDir);
-    const globalFile = join22(globalDir, `${workflowId}.yaml`);
+    const globalFile = join23(globalDir, `${workflowId}.yaml`);
     const parsed = parseWorkflowFile(globalFile);
     if (parsed) return { workflow: parsed, scope: "global", filePath: globalFile };
   }
   return void 0;
 }
 function addWorkflowDefinition(workflowId, content = DEFAULT_WORKFLOW_TEMPLATE, options = {}) {
+  assertWorkflowId(workflowId);
   const scope = options.scope ?? "local";
   const repoRoot = options.repoRoot ?? process.cwd();
-  const dir = options.dryRun ? workflowsDirectory(scope, repoRoot, options.userConfigDir) : ensureWorkflowsDirectory(scope, repoRoot, options.userConfigDir);
-  const filePath = join22(dir, `${workflowId}.yaml`);
-  if (existsSync20(filePath) && !options.overwrite) {
+  const dir = workflowsDirectory(scope, repoRoot, options.userConfigDir);
+  const filePath = join23(dir, `${workflowId}.yaml`);
+  if (existsSync21(filePath) && !options.overwrite) {
     throw new Error(`workflow_already_exists: workflow '${workflowId}' already exists at ${filePath}`);
   }
-  const payload = typeof content === "string" ? content : (0, import_yaml11.stringify)(content);
-  if (!options.dryRun) writeFileSync16(filePath, payload, "utf8");
+  const payload = workflowPayload(workflowId, content, filePath);
+  if (!options.dryRun) {
+    ensureWorkflowsDirectory(scope, repoRoot, options.userConfigDir);
+    writeFileSync16(filePath, payload, "utf8");
+  }
   return { id: workflowId, filePath, scope };
 }
 function removeWorkflowDefinition(workflowId, options = {}) {
+  assertWorkflowId(workflowId);
   const scope = options.scope ?? "local";
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = workflowsDirectory(scope, repoRoot, options.userConfigDir);
-  const filePath = join22(dir, `${workflowId}.yaml`);
-  if (!existsSync20(filePath)) {
+  const filePath = join23(dir, `${workflowId}.yaml`);
+  if (!existsSync21(filePath)) {
     throw new Error(`workflow_not_found: workflow '${workflowId}' not found in ${scope} directory (${filePath})`);
   }
   if (options.dryRun) return { id: workflowId, removed: false, filePath, scope };
@@ -29728,16 +30269,20 @@ function modifyWorkflowDefinition(workflowId, updates, options = {}) {
   };
   const scope = options.scope ?? target.scope;
   const repoRoot = options.repoRoot ?? process.cwd();
-  const dir = options.dryRun ? workflowsDirectory(scope, repoRoot, options.userConfigDir) : ensureWorkflowsDirectory(scope, repoRoot, options.userConfigDir);
-  const filePath = join22(dir, `${workflowId}.yaml`);
-  if (!options.dryRun) writeFileSync16(filePath, (0, import_yaml11.stringify)(updated), "utf8");
+  const dir = workflowsDirectory(scope, repoRoot, options.userConfigDir);
+  const filePath = join23(dir, `${workflowId}.yaml`);
+  const payload = workflowPayload(workflowId, updated, filePath);
+  if (!options.dryRun) {
+    ensureWorkflowsDirectory(scope, repoRoot, options.userConfigDir);
+    writeFileSync16(filePath, payload, "utf8");
+  }
   return { id: workflowId, workflow: updated, filePath, scope };
 }
 
 // plugins/kxm/src/cli/workflows.ts
 var CLI_NAME = "kxm";
 function localWorkflowSnapshot(dataPath, runId) {
-  if (!existsSync21(dataPath)) throw new Error("state_database_not_found");
+  if (!existsSync22(dataPath)) throw new Error("state_database_not_found");
   const database = openReadOnlyDatabase(dataPath);
   try {
     const rows = runId ? database.prepare("SELECT record FROM workflow_runs WHERE id = ?").all(runId) : database.prepare("SELECT record FROM workflow_runs ORDER BY rowid DESC LIMIT 200").all();
@@ -29817,7 +30362,7 @@ function activeWorkflowDefinition(runtime, definitionId) {
   let raw;
   if (file) {
     try {
-      raw = readFileSync20(resolve18(runtime.cwd, file), "utf8");
+      raw = readFileSync21(resolve17(runtime.cwd, file), "utf8");
     } catch {
       throw new Error("workflow definition file is unavailable");
     }
@@ -29865,60 +30410,56 @@ async function cmdWorkflowDefinitions(runtime, options) {
 }
 async function cmdWorkflowAdd(runtime, workflowId, options) {
   const scope = options.scope ?? "local";
-  const refuse = (error, text) => {
-    print(runtime.io, runtime.json, { ok: false, command: "workflow add", error }, `workflow add failed: ${text}`);
-    return 2;
+  const refuse = (error, message, code = 2) => {
+    print(runtime.io, runtime.json, { ok: false, command: "workflow add", error, message }, `workflow add failed: ${message}`);
+    return code;
   };
-  let content;
-  if (options.template !== void 0) {
-    if (options.file !== void 0 || options.pick !== void 0) {
-      return refuse("workflow_add_conflict", "--template cannot be combined with --file or --pick");
-    }
-    if (!workflowId) return refuse("workflow_id_required", "usage: kxm workflow add <workflowId> --template <name>");
-    const template = Object.hasOwn(WORKFLOW_TEMPLATES, options.template) ? WORKFLOW_TEMPLATES[options.template] : void 0;
-    if (!template) {
-      return refuse("workflow_template_unknown", `unknown template ${options.template}; choose ${Object.keys(WORKFLOW_TEMPLATES).join(", ")}`);
-    }
-    content = { ...template, ...options.description ? { description: options.description } : {} };
-  } else if (!workflowId || options.pick) {
-    const candidates = Object.entries(WORKFLOW_TEMPLATES).map(([id, tmpl]) => ({
-      id,
-      description: String(tmpl.description ?? id),
-      label: "template",
-      payload: tmpl
-    }));
-    if (scope === "local") {
-      const globalDefs = listWorkflowDefinitions({ scope: "global", userConfigDir: runtime.env.KXM_USER_CONFIG_DIR });
-      for (const gd of globalDefs) {
-        const definition = parseWorkflowFile(gd.filePath);
-        if (definition && !candidates.some((c) => c.id === gd.id)) {
-          candidates.push({ id: gd.id, description: gd.description, label: "global", payload: definition });
+  try {
+    let content;
+    if (options.template !== void 0) {
+      if (options.file !== void 0 || options.pick !== void 0) {
+        return refuse("workflow_add_conflict", "--template cannot be combined with --file or --pick");
+      }
+      if (!workflowId) return refuse("workflow_id_required", "usage: kxm workflow add <workflowId> --template <name>");
+      const template = Object.hasOwn(WORKFLOW_TEMPLATES, options.template) ? WORKFLOW_TEMPLATES[options.template] : void 0;
+      if (!template) {
+        return refuse("workflow_template_unknown", `unknown template ${options.template}; choose ${Object.keys(WORKFLOW_TEMPLATES).join(", ")}`);
+      }
+      content = { ...template, ...options.description !== void 0 ? { description: options.description } : {} };
+    } else if (!workflowId || options.pick) {
+      const candidates = Object.entries(WORKFLOW_TEMPLATES).map(([id, tmpl]) => ({
+        id,
+        description: String(tmpl.description ?? id),
+        label: "template",
+        payload: tmpl
+      }));
+      if (scope === "local") {
+        const globalDefs = listWorkflowDefinitions({ scope: "global", userConfigDir: runtime.env.KXM_USER_CONFIG_DIR });
+        for (const gd of globalDefs) {
+          if (!candidates.some((c) => c.id === gd.id)) {
+            candidates.push({ id: gd.id, description: gd.description, label: "global", payload: gd.filePath });
+          }
         }
       }
-    }
-    const picked = await resolvePickItem(runtime.io, `Select a workflow template to add (${scope})`, candidates, options.pick, runtime.env);
-    if (!picked) {
-      if (!workflowId) {
-        runtime.io.stderr("workflow add failed: missing workflowId or pick selection\n");
-        return 1;
+      const picked = await resolvePickItem(runtime.io, `Select a workflow template to add (${scope})`, candidates, options.pick, runtime.env);
+      if (!picked) {
+        return refuse("workflow_id_required", "provide a workflowId or select an available workflow with --pick <id>", 1);
       }
-    } else {
-      workflowId = picked.id;
-      if (!options.file && picked.payload) {
-        content = {
-          ...picked.payload,
-          ...options.description ? { description: options.description } : {}
-        };
+      workflowId ??= picked.id;
+      if (options.file === void 0) {
+        const pickedContent = typeof picked.payload === "string" ? readFileSync21(picked.payload, "utf8") : picked.payload;
+        content = options.description !== void 0 ? {
+          ...typeof pickedContent === "string" ? parseRestrictedYaml2(pickedContent, String(picked.payload)) : pickedContent,
+          description: options.description
+        } : pickedContent;
       }
     }
-  }
-  if (options.file) {
-    const filePath = resolve18(runtime.cwd, options.file);
-    content = readFileSync20(filePath, "utf8");
-  } else if (!content) {
-    content = scaffoldWorkflowDefinition(options.description || `Workflow ${workflowId}`);
-  }
-  try {
+    if (options.file !== void 0) {
+      const filePath = resolve17(runtime.cwd, options.file);
+      content = readFileSync21(filePath, "utf8");
+    } else if (!content) {
+      content = scaffoldWorkflowDefinition(options.description || `Workflow ${workflowId}`);
+    }
     const document = typeof content === "string" ? content : (0, import_yaml12.stringify)(content);
     let repoRoot = runtime.cwd;
     if (scope === "local") {
@@ -29931,7 +30472,7 @@ async function cmdWorkflowAdd(runtime, workflowId, options) {
         print(
           runtime.io,
           runtime.json,
-          { ok: false, command: "workflow add", error: "workflow_invalid", issues },
+          { ok: false, command: "workflow add", error: "workflow_invalid", message: "with this workflow the project would not load, so nothing was written", issues },
           `workflow add failed: with this workflow the project would not load, so nothing was written
 ${issues.map((entry) => `  ${entry.file}: ${entry.code}: ${entry.message}`).join("\n")}`
         );
@@ -29959,9 +30500,7 @@ ${issues.map((entry) => `  ${entry.file}: ${entry.code}: ${entry.message}`).join
     );
     return 0;
   } catch (err) {
-    runtime.io.stderr(`workflow add failed: ${err.message}
-`);
-    return 1;
+    return refuse("workflow_add_failed", err instanceof Error ? err.message : String(err), 1);
   }
 }
 async function cmdWorkflowRemove(runtime, workflowId, options) {
@@ -30093,7 +30632,7 @@ async function cmdWorkflowStart(runtime, definitionIdArg, options) {
   }
   let payload;
   try {
-    const raw = payloadFlag.startsWith("@") ? readFileSync20(resolve18(runtime.cwd, payloadFlag.slice(1)), "utf8") : payloadFlag;
+    const raw = payloadFlag.startsWith("@") ? readFileSync21(resolve17(runtime.cwd, payloadFlag.slice(1)), "utf8") : payloadFlag;
     const value = JSON.parse(raw);
     if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("object required");
     payload = value;
@@ -30160,7 +30699,7 @@ async function cmdWorkflowDegrade(runtime, runId, stageId, options) {
   }
 }
 async function cmdWorkflowInspect(runtime, action, runId) {
-  const dataPath = resolve18(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join23(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve17(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join24(runtime.dirs.state, "kxm.db"));
   if (action === "get" && !runId) {
     runtime.io.stderr(`Usage: ${CLI_NAME} workflow get <runId>
 `);
@@ -30329,14 +30868,14 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
     return 2;
   }
   const snapshotFlag = String(options.input || "");
-  const snapshotPath = snapshotFlag ? resolve18(runtime.cwd, snapshotFlag) : "";
+  const snapshotPath = snapshotFlag ? resolve17(runtime.cwd, snapshotFlag) : "";
   let snapshot;
   try {
     if (snapshotPath) {
-      if (!existsSync21(snapshotPath)) throw new Error("snapshot_missing");
-      snapshot = JSON.parse(readFileSync20(snapshotPath, "utf8"));
+      if (!existsSync22(snapshotPath)) throw new Error("snapshot_missing");
+      snapshot = JSON.parse(readFileSync21(snapshotPath, "utf8"));
     } else {
-      const dataPath = resolve18(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join23(runtime.dirs.state, "kxm.db"));
+      const dataPath = resolve17(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join24(runtime.dirs.state, "kxm.db"));
       const local = localWorkflowSnapshot(dataPath, runId);
       if (!local.runs[0]) throw new Error("workflow_not_found");
       snapshot = { run: local.runs[0], journal: local.journal };
@@ -30348,8 +30887,8 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
     return 1;
   }
   const doc = buildRetrospective(snapshot.run, snapshot.journal);
-  const outDir = resolve18(runtime.cwd, String(options.outDir || join23(runtime.dirs.assets, "retrospectives")));
-  const assetsRoot = resolve18(runtime.dirs.assets);
+  const outDir = resolve17(runtime.cwd, String(options.outDir || join24(runtime.dirs.assets, "retrospectives")));
+  const assetsRoot = resolve17(runtime.dirs.assets);
   const assetsPrefix = `${assetsRoot}${process.platform === "win32" ? "\\" : "/"}`;
   if (outDir !== assetsRoot && !outDir.startsWith(assetsPrefix)) {
     print(runtime.io, runtime.json, { ok: false, command: "retrospective export", error: "output_outside_workspace_assets" }, "retrospectives must stay under the workspace assets directory");
@@ -30366,133 +30905,174 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
 
 // plugins/kxm/src/cli/tasks.ts
 var import_yaml15 = __toESM(require_dist(), 1);
-import { existsSync as existsSync27, readFileSync as readFileSync26, readdirSync as readdirSync10 } from "node:fs";
-import { basename as basename7, join as join31, resolve as resolve24 } from "node:path";
+import { existsSync as existsSync28, readFileSync as readFileSync27, readdirSync as readdirSync10 } from "node:fs";
+import { basename as basename7, join as join32, resolve as resolve23 } from "node:path";
 
 // plugins/kxm/src/suggest.ts
 var WORKFLOW_PATTERNS = [
   {
-    id: "software-engineering/bug-fix",
+    id: "bug-fix",
+    template: "implement-and-verify",
     area: "software-engineering",
     keywords: ["fix", "bug", "flaky", "failure", "timeout", "error", "repro", "crash", "broken", "hang"],
-    skills: ["kxm-workflow", "kxm-runs", "kxm-context-memory"],
-    defaultCommand: (p) => `kxm run software-engineering/bug-fix "${p}"`
+    skills: ["kxm-workflow", "kxm-runs", "kxm-context-memory"]
   },
   {
-    id: "software-engineering/feature-implementation",
+    id: "feature-implementation",
+    template: "implement-and-verify",
     area: "software-engineering",
     keywords: ["feature", "implement", "add", "build", "create", "develop", "support", "endpoint", "ui", "tui"],
-    skills: ["kxm-workflow", "kxm-peer", "kxm-context-memory"],
-    defaultCommand: (p) => `kxm run software-engineering/feature-implementation "${p}"`
+    skills: ["kxm-workflow", "kxm-peer", "kxm-context-memory"]
   },
   {
-    id: "software-engineering/refactoring",
+    id: "refactoring",
+    template: "dual-critic-review",
     area: "software-engineering",
     keywords: ["refactor", "cleanup", "reorganize", "modularize", "deduplicate", "split", "simplify", "deprecate"],
-    skills: ["kxm-workflow", "kxm-runs"],
-    defaultCommand: (p) => `kxm run software-engineering/refactoring "${p}"`
+    skills: ["kxm-workflow", "kxm-runs"]
   },
   {
-    id: "security-reliability/vulnerability-remediation",
+    id: "vulnerability-remediation",
+    template: "dual-critic-review",
     area: "security-reliability",
     keywords: ["cve", "vulnerability", "security", "exploit", "sanitize", "leak", "secret", "injection", "redact", "auth"],
-    skills: ["kxm-workflow", "kxm-definitions"],
-    defaultCommand: (p) => `kxm run security-reliability/vulnerability-remediation "${p}"`
+    skills: ["kxm-workflow", "kxm-definitions"]
   },
   {
-    id: "security-reliability/reliability-hardening",
+    id: "reliability-hardening",
+    template: "dual-critic-review",
     area: "security-reliability",
     keywords: ["idempotency", "retry", "circuit-breaker", "cas", "lock", "concurrency", "deadlock", "race", "crash-recovery"],
-    skills: ["kxm-workflow", "kxm-peer"],
-    defaultCommand: (p) => `kxm run security-reliability/reliability-hardening "${p}"`
+    skills: ["kxm-workflow", "kxm-peer"]
   },
   {
-    id: "data-analytics/pipeline-migration",
+    id: "pipeline-migration",
+    template: "implement-and-verify",
     area: "data-analytics",
     keywords: ["database", "sqlite", "migration", "pipeline", "schema", "transform", "table", "wal", "foreign", "cascading"],
-    skills: ["kxm-runs", "kxm-context-memory"],
-    defaultCommand: (p) => `kxm run data-analytics/pipeline-migration "${p}"`
+    skills: ["kxm-runs", "kxm-context-memory"]
   },
   {
-    id: "research-strategy/architecture-spike",
+    id: "architecture-spike",
+    template: "spec-and-plan",
     area: "research-strategy",
     keywords: ["spike", "investigate", "prototype", "research", "feasibility", "benchmark", "explore", "evaluate"],
-    skills: ["kxm-session", "kxm-context-memory", "kxm-routing-improve"],
-    defaultCommand: (p) => `kxm run research-strategy/architecture-spike "${p}"`
+    skills: ["kxm-session", "kxm-context-memory", "kxm-routing-improve"]
   }
 ];
 function suggestWorkflowAndRoles(prompt, options = {}) {
   const normalized = prompt.toLowerCase();
   const words = normalized.split(/\W+/).filter(Boolean);
-  let bestPattern = WORKFLOW_PATTERNS[0];
-  let bestScore = -1;
-  const matchedReasons = [];
+  const claudeOnly = /\bclaude(?:\s+code)?(?:[\s-]+only|\s+exclusively)\b|\b(?:only|exclusively)(?:\s+(?:use|using|with|via))?\s+claude(?:\s+code)?\b/i.test(prompt);
+  let bestPattern = WORKFLOW_PATTERNS[1];
+  let bestScore = 0;
+  const reasons = [];
   for (const pattern of WORKFLOW_PATTERNS) {
-    let score = 0;
-    const matchedWords = [];
-    for (const keyword of pattern.keywords) {
-      if (words.includes(keyword) || normalized.includes(keyword)) {
-        score += 1;
-        matchedWords.push(keyword);
-      }
-    }
-    if (score > bestScore) {
-      bestScore = score;
+    const matchedWords = pattern.keywords.filter((keyword) => words.includes(keyword) || normalized.includes(keyword));
+    if (matchedWords.length > bestScore) {
+      bestScore = matchedWords.length;
       bestPattern = pattern;
-      matchedReasons.length = 0;
-      matchedReasons.push(`Matched keywords: ${matchedWords.join(", ")}`);
+      reasons.length = 0;
+      reasons.push(`Matched keywords: ${matchedWords.join(", ")}`);
     }
   }
-  if (bestScore <= 0) {
-    bestPattern = WORKFLOW_PATTERNS[1];
-    matchedReasons.push("Default fallback: general feature implementation workflow");
-  }
-  const activeHarnesses = new Set(
-    (options.availableHarnesses ?? []).filter((h) => h.auth === "active" || h.auth === "ready" || h.auth === "configured").map((h) => h.harness.toLowerCase())
-  );
-  const hasClaude = activeHarnesses.size === 0 || activeHarnesses.has("claude");
-  const hasGrok = activeHarnesses.size === 0 || activeHarnesses.has("grok");
-  const hasCodex = activeHarnesses.size === 0 || activeHarnesses.has("codex");
-  const planner = hasClaude ? { harness: "claude", model: "fable", role: "planner" } : { harness: "codex", model: "gpt-5.6-sol", role: "planner" };
-  const writer = hasGrok ? { harness: "grok", model: "grok-4.6", role: "writer" } : activeHarnesses.has("agy") ? { harness: "agy", model: "gemini-2.5-pro", role: "writer" } : { harness: "pi", model: "qwen/qwen3-coder-plus", role: "writer" };
-  const critics = [
-    { harness: "claude", model: "fable", role: "reviewer-arch" },
-    { harness: "codex", model: "gpt-5.6-sol", role: "reviewer-cli" }
-  ];
-  return {
+  if (bestScore === 0) reasons.push("Default fallback: general feature implementation workflow");
+  if (claudeOnly) reasons.push("Explicit Claude-only constraint; other harnesses are excluded");
+  const template = WORKFLOW_TEMPLATES[bestPattern.template];
+  const steps = template.steps;
+  const base = {
     workflowId: bestPattern.id,
+    template: bestPattern.template,
     area: bestPattern.area,
     confidence: bestScore > 0 ? Math.min(1, 0.5 + bestScore * 0.15) : 0.5,
-    reasons: matchedReasons,
+    reasons,
     suggestedSkills: bestPattern.skills,
-    roles: {
-      planner,
-      writer,
-      critics,
-      verifier: { kind: "witness", command: "npm run verify" }
-    },
-    suggestedCommand: bestPattern.defaultCommand(prompt.replace(/"/g, '\\"'))
+    suggestedCommand: `kxm workflow add ${bestPattern.id} --template ${bestPattern.template}`
+  };
+  const writeStep = steps.find((step) => step.kind === "agent" && Object.values(step.repositories ?? {}).includes("write"));
+  const available = (options.availableHarnesses ?? []).filter((entry) => BUILTIN_HARNESS_IDS.includes(entry.id) && entry.detected && entry.authenticated === true && entry.dispatch?.supported === true && entry.dispatch.status === "yes" && (!claudeOnly || entry.id === "claude"));
+  const selected = available.find((entry) => entry.id === "claude") ?? available[0];
+  if (!selected) {
+    const relevant = (options.availableHarnesses ?? []).filter((entry) => !claudeOnly || entry.id === "claude");
+    const detail = relevant.map((entry) => `${entry.id}: ${entry.dispatch?.reason ?? (!entry.detected ? "not_detected" : entry.authenticated !== true ? "authentication_unverified" : "dispatch_unavailable")}`).join("; ");
+    return {
+      ...base,
+      roles: [],
+      execution: {
+        supported: false,
+        error: "harness_unavailable",
+        reason: `${claudeOnly ? "Claude-only execution requires Claude Code" : "Execution requires a supported harness"} detected, authenticated, and ready for dispatch. ${detail || "No verified harness inventory is available."}`,
+        nextSteps: claudeOnly ? ["Install Claude Code if missing, authenticate with claude auth login, then confirm claude auth status and kxm harness list. Other harnesses will not be substituted."] : ["Install and authenticate a supported harness, then run kxm harness list to check detection, authentication, and dispatch readiness. Pi requires a configured model/provider auth context."]
+      }
+    };
+  }
+  if (writeStep && !oneShotWriterArgs(selected.id)) {
+    return {
+      ...base,
+      roles: [],
+      execution: {
+        supported: false,
+        error: "live_write_unsupported",
+        reason: `${bestPattern.template} requires repository writes at step ${writeStep.id}, but the selected ${selected.id} harness has no audited live writer profile. No other harness will be substituted.`,
+        nextSteps: [
+          `Run the implementation directly in ${claudeOnly ? "Claude Code" : selected.id} in the target worktree, and run the repository's actual verification command.`,
+          `For read-only KXM planning, try kxm suggest "Investigate an architecture spike${claudeOnly ? " using Claude only" : ""}"; the shipped spec-and-plan template does not implement changes.`,
+          "Installing a definition or creating a run does not execute it. Simulation is not evidence of a bug fix or workflow completion."
+        ]
+      }
+    };
+  }
+  const roles = [];
+  for (const step of steps) {
+    if (!step.agent) continue;
+    const role = roles.find((entry) => entry.agent === step.agent);
+    if (role) role.role += `, ${step.id}`;
+    else roles.push({ agent: step.agent, harness: selected.id, role: step.id });
+  }
+  const shell = process.platform === "win32" ? "powershell" : "posix";
+  const quotedPrompt = shell === "powershell" ? `'${prompt.replace(/['\u2018-\u201b]/g, "$&$&")}'` : `'${prompt.replace(/'/g, "'\\''")}'`;
+  return {
+    ...base,
+    roles,
+    execution: {
+      supported: true,
+      prerequisites: [
+        "Run kxm init in the target repository if needed, then install the exact template with the suggested command. If that workflow ID already exists, stop and review it; the commands below apply only to a newly installed template, not an existing definition with potentially different agents or permissions.",
+        ...roles.map((role) => `Set harness: ${role.harness} and model: <your authenticated compatible model selector> in .kxm/agents/${role.agent}.yaml. Admit that exact selector in .kxm/routes.yaml and ensure it is not disabled; this recommendation does not choose a model or change routing.`),
+        ...writeStep ? [
+          `Keep each writer step at assignments.maximum: 1 and set limits.maxConcurrentRuns: 1 in .kxm/project.yaml; the live ${selected.id} writer profile requires a lone writer in the checkout.`,
+          `If .kxm/roster.yaml exists, it must be readable kxm.developer-roster.v1 with a lineup.writer route matching harness: ${selected.id} and the selected writer model (model or vendor/model), status: admitted, and permissions containing edit.`,
+          "Configure the test gate in .kxm/gates.yaml with kind: command and argv for this repository's actual verification command. A scaffold/example command or simulation is not evidence that the implementation works."
+        ] : [],
+        `Validate the installed workflow with kxm gate validate --file .kxm/workflows/${bestPattern.id}.yaml and the project configuration with kxm init --dry-run before creating a run.`
+      ],
+      shell,
+      createCommand: `kxm run ${bestPattern.id} -- ${quotedPrompt}`,
+      driveCommand: "kxm runs drive <runId> --wait",
+      statusCommand: "kxm runs status <runId>",
+      receiptCommand: "kxm runs receipt <runId>"
+    }
   };
 }
 
 // plugins/kxm/src/task-manager.ts
 var import_yaml13 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { existsSync as existsSync22, mkdirSync as mkdirSync17, readFileSync as readFileSync21, readdirSync as readdirSync8, writeFileSync as writeFileSync17 } from "node:fs";
-import { join as join24, resolve as resolve19 } from "node:path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync17, readFileSync as readFileSync22, readdirSync as readdirSync8, writeFileSync as writeFileSync17 } from "node:fs";
+import { join as join25, resolve as resolve18 } from "node:path";
 var GOAL_SCHEMA = "kxm.goal.v1";
 var TASK_SCHEMA = "kxm.task.v1";
 function goalsDirectory(repoRoot) {
-  return resolve19(repoRoot, ".kxm", "goals");
+  return resolve18(repoRoot, ".kxm", "goals");
 }
 function tasksDirectory(repoRoot) {
-  return resolve19(repoRoot, ".kxm", "tasks");
+  return resolve18(repoRoot, ".kxm", "tasks");
 }
 function goalFilePath(repoRoot, goalId) {
-  return join24(goalsDirectory(repoRoot), `${goalId}.yaml`);
+  return join25(goalsDirectory(repoRoot), `${goalId}.yaml`);
 }
 function taskFilePath(repoRoot, taskId) {
-  return join24(tasksDirectory(repoRoot), `${taskId}.yaml`);
+  return join25(tasksDirectory(repoRoot), `${taskId}.yaml`);
 }
 function createGoal(repoRoot, input, options = {}) {
   const id = `goal_${randomUUID8().replaceAll("-", "").slice(0, 12)}`;
@@ -30515,13 +31095,13 @@ function createGoal(repoRoot, input, options = {}) {
 }
 function listGoals(repoRoot) {
   const dir = goalsDirectory(repoRoot);
-  if (!existsSync22(dir)) return [];
+  if (!existsSync23(dir)) return [];
   const goals = [];
   const entries = readdirSync8(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && (entry.name.endsWith(".yaml") || entry.name.endsWith(".yml"))) {
       try {
-        const text = readFileSync21(join24(dir, entry.name), "utf8");
+        const text = readFileSync22(join25(dir, entry.name), "utf8");
         const doc = (0, import_yaml13.parse)(text);
         if (doc && doc.schema === GOAL_SCHEMA) goals.push(doc);
       } catch {
@@ -30559,13 +31139,13 @@ function createTask(repoRoot, input, options = {}) {
 }
 function listTasks(repoRoot, options = {}) {
   const dir = tasksDirectory(repoRoot);
-  if (!existsSync22(dir)) return [];
+  if (!existsSync23(dir)) return [];
   const tasks = [];
   const entries = readdirSync8(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && (entry.name.endsWith(".yaml") || entry.name.endsWith(".yml"))) {
       try {
-        const text = readFileSync21(join24(dir, entry.name), "utf8");
+        const text = readFileSync22(join25(dir, entry.name), "utf8");
         const doc = (0, import_yaml13.parse)(text);
         if (doc && doc.schema === TASK_SCHEMA) {
           if (options.goalId && doc.goalId !== options.goalId) continue;
@@ -30580,27 +31160,16 @@ function listTasks(repoRoot, options = {}) {
 }
 function getTask(repoRoot, taskId) {
   const dir = tasksDirectory(repoRoot);
-  const filePath = join24(dir, `${taskId}.yaml`);
-  if (!existsSync22(filePath)) return void 0;
+  const filePath = join25(dir, `${taskId}.yaml`);
+  if (!existsSync23(filePath)) return void 0;
   try {
-    const text = readFileSync21(filePath, "utf8");
+    const text = readFileSync22(filePath, "utf8");
     const doc = (0, import_yaml13.parse)(text);
     return doc && doc.schema === TASK_SCHEMA ? doc : void 0;
   } catch {
     return void 0;
   }
 }
-function updateTaskStatus(repoRoot, taskId, status, options = {}) {
-  const task = getTask(repoRoot, taskId);
-  if (!task) {
-    throw new Error(`Task ${taskId} not found`);
-  }
-  task.status = status;
-  if (options.workflowRunId) task.workflowRunId = options.workflowRunId;
-  task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  if (!options.dryRun) writeFileSync17(taskFilePath(repoRoot, taskId), (0, import_yaml13.stringify)(task).trim() + "\n", "utf8");
-  return task;
-}
 function syncTaskWithTracker(repoRoot, taskId, options = {}) {
   const task = getTask(repoRoot, taskId);
   if (!task) {
@@ -31380,13 +31949,13 @@ function createStudioServer(options = {}) {
 }
 
 // plugins/kxm/src/cli/project.ts
-import { existsSync as existsSync26 } from "node:fs";
-import { dirname as dirname18, join as join30, resolve as resolve23 } from "node:path";
+import { existsSync as existsSync27 } from "node:fs";
+import { dirname as dirname17, join as join31, resolve as resolve22 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 
 // plugins/kxm/src/hub-autostart.ts
-import { closeSync as closeSync2, mkdirSync as mkdirSync18, openSync as openSync2, readFileSync as readFileSync22 } from "node:fs";
-import { join as join25, resolve as resolve20 } from "node:path";
+import { closeSync as closeSync2, mkdirSync as mkdirSync18, openSync as openSync2, readFileSync as readFileSync23 } from "node:fs";
+import { join as join26, resolve as resolve19 } from "node:path";
 function defaultProcessExists(pid) {
   try {
     process.kill(pid, 0);
@@ -31398,7 +31967,7 @@ function defaultProcessExists(pid) {
 function readLiveHubClaim(stateDir, processExists3 = defaultProcessExists) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync22(join25(stateDir, "hub.pid"), "utf8"));
+    parsed = JSON.parse(readFileSync23(join26(stateDir, "hub.pid"), "utf8"));
   } catch {
     return void 0;
   }
@@ -31416,7 +31985,7 @@ function readLiveHubClaim(stateDir, processExists3 = defaultProcessExists) {
 // plugins/kxm/src/model-inventory.ts
 var import_yaml14 = __toESM(require_dist(), 1);
 import { mkdirSync as mkdirSync19, writeFileSync as writeFileSync18 } from "node:fs";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 var OR_URL = "https://openrouter.ai/api/v1/models";
 var NOUS_URL = "https://inference-api.nousresearch.com/v1/models";
 function price(value) {
@@ -31502,41 +32071,41 @@ async function refreshModelInventory(options) {
   sources.nous = { url: nousUrl, ok: !nous.error, ...nous.error ? { error: nous.error } : {} };
   for (const item of nous.data) add(item, "nous", "discount");
   const inventory = { schema: "kxm.model-inventory.v1", fetchedAt, currency: "USD", sources, models: [...byId.values()].sort((a, b2) => a.id.localeCompare(b2.id)) };
-  mkdirSync19(join26(options.outputRoot, ".kxm", "models"), { recursive: true });
-  writeFileSync18(join26(options.outputRoot, ".kxm", "models", "inventory.yaml"), (0, import_yaml14.stringify)(inventory), "utf8");
+  mkdirSync19(join27(options.outputRoot, ".kxm", "models"), { recursive: true });
+  writeFileSync18(join27(options.outputRoot, ".kxm", "models", "inventory.yaml"), (0, import_yaml14.stringify)(inventory), "utf8");
   return inventory;
 }
 
 // plugins/kxm/src/init.ts
 import { randomUUID as randomUUID11 } from "node:crypto";
-import { existsSync as existsSync25 } from "node:fs";
-import { basename as basename6, join as join29 } from "node:path";
+import { existsSync as existsSync26 } from "node:fs";
+import { basename as basename6, join as join30 } from "node:path";
 
 // plugins/kxm/src/repair.ts
 import { randomUUID as randomUUID10 } from "node:crypto";
 import {
   chmodSync as chmodSync5,
   closeSync as closeSync3,
-  existsSync as existsSync24,
+  existsSync as existsSync25,
   fsyncSync as fsyncSync2,
   linkSync,
   lstatSync as lstatSync7,
   mkdirSync as mkdirSync21,
   openSync as openSync3,
-  readFileSync as readFileSync24,
+  readFileSync as readFileSync25,
   readdirSync as readdirSync9,
   renameSync as renameSync7,
   rmSync as rmSync9,
   writeFileSync as writeFileSync20
 } from "node:fs";
-import { dirname as dirname17, isAbsolute as isAbsolute8, join as join28, relative as relative5, resolve as resolve22 } from "node:path";
+import { dirname as dirname16, isAbsolute as isAbsolute8, join as join29, relative as relative5, resolve as resolve21 } from "node:path";
 
 // plugins/kxm/src/permission.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { createHash as createHash14 } from "node:crypto";
-import { existsSync as existsSync23, mkdtempSync, mkdirSync as mkdirSync20, readFileSync as readFileSync23, rmSync as rmSync8, writeFileSync as writeFileSync19 } from "node:fs";
+import { createHash as createHash15 } from "node:crypto";
+import { existsSync as existsSync24, mkdtempSync, mkdirSync as mkdirSync20, readFileSync as readFileSync24, rmSync as rmSync8, writeFileSync as writeFileSync19 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname16, join as join27, resolve as resolve21, sep as sep4 } from "node:path";
+import { dirname as dirname15, join as join28, resolve as resolve20, sep as sep4 } from "node:path";
 var PROSE_FIELDS = {
   project: /* @__PURE__ */ new Set(["name", "description"]),
   repository: /* @__PURE__ */ new Set(["description"]),
@@ -31552,7 +32121,7 @@ var UNTRACKED_RANK = { "tracked-only": 0, ask: 1, bounded: 2 };
 function canonical(value) {
   return kxmCanonicalJson(value === void 0 ? null : value);
 }
-function asObject(value) {
+function asObject2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function valuesOf3(value, key) {
@@ -31568,12 +32137,12 @@ function pointerEscape(segment) {
 function secretGrantKeys(grants) {
   const counts = /* @__PURE__ */ new Map();
   for (const grant of grants) {
-    const ref = stringValue3(asObject(grant)?.ref);
+    const ref = stringValue3(asObject2(grant)?.ref);
     if (ref) counts.set(ref, (counts.get(ref) ?? 0) + 1);
   }
   const keys = /* @__PURE__ */ new Map();
   for (const [index, grant] of grants.entries()) {
-    const ref = stringValue3(asObject(grant)?.ref);
+    const ref = stringValue3(asObject2(grant)?.ref);
     keys.set(index, ref && counts.get(ref) === 1 ? `by-ref/${pointerEscape(ref)}` : String(index));
   }
   return keys;
@@ -31593,21 +32162,21 @@ function kxmAuthorityEntries(resource) {
       const declarations = valuesOf3(value, "repositories");
       const declarationIds = /* @__PURE__ */ new Map();
       for (const entry of declarations) {
-        const id = stringValue3(asObject(entry)?.id);
+        const id = stringValue3(asObject2(entry)?.id);
         if (id) declarationIds.set(id, (declarationIds.get(id) ?? 0) + 1);
       }
       for (const [index, repository] of declarations.entries()) {
-        const entry = asObject(repository);
+        const entry = asObject2(repository);
         if (!entry) continue;
         const id = stringValue3(entry.id);
         const key = id && declarationIds.get(id) === 1 ? `by-id/${pointerEscape(id)}` : String(index);
         push(`/repositories/${key}`, "resource-shape", entry);
       }
-      const workspace = asObject(value.workspace);
+      const workspace = asObject2(value.workspace);
       if (workspace) push("/workspace", "snapshot-policy", workspace);
-      const sync = asObject(value.sync);
+      const sync = asObject2(value.sync);
       if (sync) push("/sync", "sync-policy", sync);
-      const limits = asObject(value.limits);
+      const limits = asObject2(value.limits);
       if (limits) push("/limits", "budget", limits);
       break;
     }
@@ -31625,7 +32194,7 @@ function kxmAuthorityEntries(resource) {
       push("/harness", "harness", value.harness ?? "pi");
       push("/tools", "tools", value.tools);
       push("/defaultRepositoryAccess", "repository-access", value.defaultRepositoryAccess);
-      const repositories = asObject(value.repositories);
+      const repositories = asObject2(value.repositories);
       for (const repositoryId of Object.keys(repositories ?? {}).sort()) {
         push(`/repositories/${pointerEscape(repositoryId)}`, "repository-access", repositories?.[repositoryId]);
       }
@@ -31635,7 +32204,7 @@ function kxmAuthorityEntries(resource) {
       }
       push("/network", "network", value.network);
       push("/resultSchema", "delivery", value.resultSchema);
-      const session = asObject(value.session);
+      const session = asObject2(value.session);
       if (session) push("/session", "resource-shape", session);
       break;
     }
@@ -31647,15 +32216,15 @@ function kxmAuthorityEntries(resource) {
       push("/capabilities", "model", value.capabilities);
       push("/priority", "model", value.priority);
       push("/fallbacks", "model", value.fallbacks);
-      const limits = asObject(value.limits);
+      const limits = asObject2(value.limits);
       if (limits) push("/limits", "budget", limits);
       break;
     }
     case "environment": {
       push("/path", "environment", value.path);
-      const envValues = asObject(value.values);
+      const envValues = asObject2(value.values);
       for (const key of Object.keys(envValues ?? {}).sort()) {
-        const entry = asObject(envValues?.[key]);
+        const entry = asObject2(envValues?.[key]);
         const projected = entry ? { ...entry, value: entry.value === void 0 ? void 0 : "<redacted>" } : envValues?.[key];
         push(`/values/${pointerEscape(key)}`, "environment", projected);
       }
@@ -31667,9 +32236,9 @@ function kxmAuthorityEntries(resource) {
     }
     case "gate-registry": {
       push("/schema", "resource-shape", value.schema);
-      const gates = asObject(value.gates) ?? {};
+      const gates = asObject2(value.gates) ?? {};
       for (const id of Object.keys(gates).sort()) {
-        const definition = asObject(gates[id]);
+        const definition = asObject2(gates[id]);
         const path4 = `/gates/${pointerEscape(id)}`;
         if (definition?.kind === "command") {
           const { timeoutMs, ...authority } = definition;
@@ -31681,13 +32250,13 @@ function kxmAuthorityEntries(resource) {
     }
     case "workflow": {
       push("/coordinator", "resource-shape", value.coordinator);
-      const limits = asObject(value.limits);
+      const limits = asObject2(value.limits);
       if (limits) push("/limits", "budget", limits);
       if (value.reproOracle !== void 0) push("/reproOracle", "evidence-quorum", value.reproOracle);
       if (value.planHash !== void 0) push("/planHash", "evidence-quorum", value.planHash);
       if (value.requirePlanHash !== void 0) push("/requirePlanHash", "evidence-quorum", value.requirePlanHash);
       for (const [index, stepEntry] of valuesOf3(value, "steps").entries()) {
-        const step = asObject(stepEntry);
+        const step = asObject2(stepEntry);
         if (!step) continue;
         const stepPath = `/steps/${index}`;
         push(`${stepPath}/id`, "resource-shape", step.id);
@@ -31699,7 +32268,7 @@ function kxmAuthorityEntries(resource) {
         push(`${stepPath}/model`, "model", step.model);
         push(`${stepPath}/maxAttempts`, "budget", step.maxAttempts);
         push(`${stepPath}/timeoutMs`, "budget", step.timeoutMs);
-        const repositories = asObject(step.repositories);
+        const repositories = asObject2(step.repositories);
         for (const repositoryId of Object.keys(repositories ?? {}).sort()) {
           push(`${stepPath}/repositories/${pointerEscape(repositoryId)}`, "repository-access", repositories?.[repositoryId]);
         }
@@ -31729,7 +32298,7 @@ function kxmProseEntries(resource) {
   }
   if (resource.kind === "workflow") {
     for (const [index, stepEntry] of valuesOf3(resource.value, "steps").entries()) {
-      const step = asObject(stepEntry);
+      const step = asObject2(stepEntry);
       if (!step) continue;
       for (const field of ["description", "instructions"]) {
         if (step[field] !== void 0) entries.set(`/steps/${index}/${field}`, canonical(step[field]));
@@ -31739,7 +32308,7 @@ function kxmProseEntries(resource) {
   return entries;
 }
 function valueHash(canonicalValue) {
-  return `sha256:${createHash14("sha256").update(canonicalValue, "utf8").digest("hex")}`;
+  return `sha256:${createHash15("sha256").update(canonicalValue, "utf8").digest("hex")}`;
 }
 function rankDirection(rank, baseValue, candidateValue) {
   const base = JSON.parse(baseValue);
@@ -31760,8 +32329,8 @@ function numericBoundDirection(baseValue, candidateValue) {
   return "neutral";
 }
 function budgetDirection(baseValue, candidateValue) {
-  const base = asObject(JSON.parse(baseValue));
-  const candidate = asObject(JSON.parse(candidateValue));
+  const base = asObject2(JSON.parse(baseValue));
+  const candidate = asObject2(JSON.parse(candidateValue));
   if (!base || !candidate) return "expansion";
   let sawExpansion = false;
   let sawNarrowing = false;
@@ -31774,8 +32343,8 @@ function budgetDirection(baseValue, candidateValue) {
   return sawNarrowing ? "narrowing" : "neutral";
 }
 function quorumDirection(baseValue, candidateValue) {
-  const base = asObject(JSON.parse(baseValue));
-  const candidate = asObject(JSON.parse(candidateValue));
+  const base = asObject2(JSON.parse(baseValue));
+  const candidate = asObject2(JSON.parse(candidateValue));
   if (!base || !candidate) return "expansion";
   if (base.strategy !== void 0 || candidate.strategy !== void 0) return "expansion";
   if (base.stageId !== void 0 || candidate.stageId !== void 0) return "expansion";
@@ -31789,13 +32358,13 @@ function quorumDirection(baseValue, candidateValue) {
   const CLASSIFIED = /* @__PURE__ */ new Set(["key", "kind", "minimum", "reusableAcrossAttempts", "strategy", "stageId", "evidenceKey"]);
   const CLASSIFIED_POLICY = /* @__PURE__ */ new Set(["minimumProducers", "eligibleAgents", "degradation"]);
   const residualOf = (value) => {
-    const parsed = asObject(JSON.parse(value));
+    const parsed = asObject2(JSON.parse(value));
     if (!parsed) return null;
     const residual = {};
     for (const [key, entry] of Object.entries(parsed)) {
       if (CLASSIFIED.has(key)) continue;
       if (key === "producerPolicy") {
-        const policy = asObject(entry);
+        const policy = asObject2(entry);
         if (!policy) {
           residual[key] = entry;
           continue;
@@ -31808,8 +32377,8 @@ function quorumDirection(baseValue, candidateValue) {
     return residual;
   };
   if (kxmCanonicalJson(residualOf(baseValue)) !== kxmCanonicalJson(residualOf(candidateValue))) return "expansion";
-  const basePolicy = asObject(base.producerPolicy);
-  const candidatePolicy = asObject(candidate.producerPolicy);
+  const basePolicy = asObject2(base.producerPolicy);
+  const candidatePolicy = asObject2(candidate.producerPolicy);
   if (!basePolicy && !candidatePolicy) return sawNarrowing ? "narrowing" : "neutral";
   if (!basePolicy || !candidatePolicy) return "expansion";
   const basePolicyMinimum = typeof basePolicy.minimumProducers === "number" ? basePolicy.minimumProducers : 1;
@@ -31818,8 +32387,8 @@ function quorumDirection(baseValue, candidateValue) {
   const baseEligible = new Set((Array.isArray(basePolicy.eligibleAgents) ? basePolicy.eligibleAgents : []).map(String));
   const candidateEligible = new Set((Array.isArray(candidatePolicy.eligibleAgents) ? candidatePolicy.eligibleAgents : []).map(String));
   for (const agent of baseEligible) if (!candidateEligible.has(agent)) return "expansion";
-  const baseDegradation = asObject(basePolicy.degradation);
-  const candidateDegradation = asObject(candidatePolicy.degradation);
+  const baseDegradation = asObject2(basePolicy.degradation);
+  const candidateDegradation = asObject2(candidatePolicy.degradation);
   if (!baseDegradation && candidateDegradation) return "expansion";
   if (baseDegradation && candidateDegradation) {
     const baseFloor = typeof baseDegradation.minimumProducers === "number" ? baseDegradation.minimumProducers : 1;
@@ -31833,11 +32402,11 @@ function quorumDirection(baseValue, candidateValue) {
   return sawNarrowing ? "narrowing" : "neutral";
 }
 function snapshotDirection(baseValue, candidateValue) {
-  const base = asObject(JSON.parse(baseValue));
-  const candidate = asObject(JSON.parse(candidateValue));
+  const base = asObject2(JSON.parse(baseValue));
+  const candidate = asObject2(JSON.parse(candidateValue));
   if (!base || !candidate) return "expansion";
-  const baseSnapshot = asObject(base.dirtySnapshot);
-  const candidateSnapshot = asObject(candidate.dirtySnapshot);
+  const baseSnapshot = asObject2(base.dirtySnapshot);
+  const candidateSnapshot = asObject2(candidate.dirtySnapshot);
   if (!baseSnapshot || !candidateSnapshot) return "expansion";
   const untracked = rankDirection(UNTRACKED_RANK, canonical(baseSnapshot.untracked), canonical(candidateSnapshot.untracked));
   if (untracked === "expansion") return "expansion";
@@ -31891,8 +32460,8 @@ function classifyChange(field, baseValue, candidateValue, context) {
     case "snapshot-policy":
       return snapshotDirection(baseValue, candidateValue);
     case "secrets": {
-      const base = asObject(JSON.parse(baseValue));
-      const candidate = asObject(JSON.parse(candidateValue));
+      const base = asObject2(JSON.parse(baseValue));
+      const candidate = asObject2(JSON.parse(candidateValue));
       if (base && candidate && base.ref === candidate.ref) {
         const { required: _b, ...baseRest } = base;
         const { required: _c, ...candidateRest } = candidate;
@@ -32057,9 +32626,9 @@ function loadKxmProjectAtRevision(root, revision, options = {}) {
   const tree = resolveTreeRevision(root, revision);
   const listing = gitBuffer(root, ["ls-tree", "-r", "-z", "--name-only", tree]).toString("utf8");
   const paths = listing.split("\0").filter((line) => line.length > 0 && (line.startsWith(".kxm/") || line.includes("/.kxm/")));
-  const shadow = mkdtempSync(join27(tmpdir(), "kxm-permission-base-"));
-  const shadowResolved = resolve21(shadow);
-  const shadowMembersDir = `.kxm-shadow-members-${createHash14("sha256").update(shadowResolved, "utf8").digest("hex").slice(0, 8)}`;
+  const shadow = mkdtempSync(join28(tmpdir(), "kxm-permission-base-"));
+  const shadowResolved = resolve20(shadow);
+  const shadowMembersDir = `.kxm-shadow-members-${createHash15("sha256").update(shadowResolved, "utf8").digest("hex").slice(0, 8)}`;
   try {
     for (const path4 of paths) {
       const segments = path4.split("/");
@@ -32071,8 +32640,8 @@ function loadKxmProjectAtRevision(root, revision, options = {}) {
           message: "Git tree entry contains a traversal or non-portable segment"
         }]);
       }
-      const absolute = join27(shadowResolved, ...segments);
-      const resolved = resolve21(absolute);
+      const absolute = join28(shadowResolved, ...segments);
+      const resolved = resolve20(absolute);
       if (!resolved.startsWith(`${shadowResolved}${sep4}`)) {
         throw new KxmConfigError([{
           phase: "path",
@@ -32082,11 +32651,11 @@ function loadKxmProjectAtRevision(root, revision, options = {}) {
         }]);
       }
       const content = gitBuffer(root, ["cat-file", "blob", `${tree}:${path4}`]);
-      mkdirSync20(dirname16(absolute), { recursive: true });
+      mkdirSync20(dirname15(absolute), { recursive: true });
       writeFileSync19(absolute, content);
     }
     initShadowGitRoot(shadowResolved);
-    const baseProjectFile = join27(shadowResolved, ".kxm", "project.yaml");
+    const baseProjectFile = join28(shadowResolved, ".kxm", "project.yaml");
     let baseProject;
     try {
       baseProject = loadBaseProjectDeclarations(baseProjectFile);
@@ -32116,8 +32685,8 @@ function loadKxmProjectAtRevision(root, revision, options = {}) {
         }]);
       }
       const boundPath = options.repositoryBindings?.[member.repositoryId];
-      const memberWorktree = boundPath ? resolve21(boundPath) : member.pathHint ? resolve21(root, ...member.pathHint.split("/")) : void 0;
-      if (!memberWorktree || !existsSync23(memberWorktree)) {
+      const memberWorktree = boundPath ? resolve20(boundPath) : member.pathHint ? resolve20(root, ...member.pathHint.split("/")) : void 0;
+      if (!memberWorktree || !existsSync24(memberWorktree)) {
         if (member.required === false) continue;
         throw new KxmConfigError([{
           phase: "discovery",
@@ -32164,8 +32733,8 @@ function loadKxmProjectAtRevision(root, revision, options = {}) {
       const memberTree = git(memberWorktree, ["rev-parse", "--verify", "--quiet", `${pinnedCommit}^{tree}`]).trim();
       const memberListing = gitBuffer(memberWorktree, ["ls-tree", "-r", "-z", "--name-only", memberTree]).toString("utf8");
       const memberPaths = memberListing.split("\0").filter((line) => line.length > 0 && (line.startsWith(".kxm/") || line.includes("/.kxm/")));
-      const memberShadowRoot = join27(shadowResolved, shadowMembersDir, member.repositoryId);
-      if (!resolve21(memberShadowRoot).startsWith(`${resolve21(shadowResolved, shadowMembersDir)}${sep4}`)) {
+      const memberShadowRoot = join28(shadowResolved, shadowMembersDir, member.repositoryId);
+      if (!resolve20(memberShadowRoot).startsWith(`${resolve20(shadowResolved, shadowMembersDir)}${sep4}`)) {
         throw new KxmConfigError([{
           phase: "path",
           code: "git_tree_path_invalid",
@@ -32178,13 +32747,13 @@ function loadKxmProjectAtRevision(root, revision, options = {}) {
         if (segments.some((segment) => segment === "" || segment === "." || segment === ".." || /[\\:]/.test(segment))) {
           throw new KxmConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path4, message: "member Git tree entry contains a traversal or non-portable segment" }]);
         }
-        const absolute = join27(memberShadowRoot, ...segments);
-        const resolved = resolve21(absolute);
-        if (!resolved.startsWith(`${resolve21(memberShadowRoot)}${sep4}`)) {
+        const absolute = join28(memberShadowRoot, ...segments);
+        const resolved = resolve20(absolute);
+        if (!resolved.startsWith(`${resolve20(memberShadowRoot)}${sep4}`)) {
           throw new KxmConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path4, message: "member Git tree entry escapes the shadow root" }]);
         }
         const content = gitBuffer(memberWorktree, ["cat-file", "blob", `${memberTree}:${path4}`]);
-        mkdirSync20(dirname16(absolute), { recursive: true });
+        mkdirSync20(dirname15(absolute), { recursive: true });
         writeFileSync19(absolute, content);
       }
       initShadowGitRoot(memberShadowRoot);
@@ -32206,8 +32775,8 @@ function portableMemberPathHint(pathHint) {
   return pathHint !== "." && kxmPortablePath(pathHint);
 }
 function loadBaseProjectDeclarations(projectFile) {
-  if (!existsSync23(projectFile)) return [];
-  const value = parseRestrictedYaml2(readFileSync23(projectFile, "utf8"), ".kxm/project.yaml");
+  if (!existsSync24(projectFile)) return [];
+  const value = parseRestrictedYaml2(readFileSync24(projectFile, "utf8"), ".kxm/project.yaml");
   const repositories = Array.isArray(value?.repositories) ? value.repositories : [];
   const members = [];
   for (const entry of repositories) {
@@ -32310,7 +32879,7 @@ function writeDurableNew(file, bytes, mode) {
   } finally {
     if (descriptor !== void 0) closeSync3(descriptor);
   }
-  syncDirectory2(dirname17(file));
+  syncDirectory2(dirname16(file));
 }
 function writeDurable(file, bytes, mode) {
   let descriptor;
@@ -32327,27 +32896,27 @@ function writeDurable(file, bytes, mode) {
   } finally {
     if (descriptor !== void 0) closeSync3(descriptor);
   }
-  syncDirectory2(dirname17(file));
+  syncDirectory2(dirname16(file));
 }
 function sameHostPath3(left, right) {
-  const first = resolve22(left);
-  const second = resolve22(right);
+  const first = resolve21(left);
+  const second = resolve21(right);
   return process.platform === "win32" ? first.toLocaleLowerCase("en-US") === second.toLocaleLowerCase("en-US") : first === second;
 }
 function transactionRoot(projectRoot) {
-  return join28(resolve22(projectRoot), TRANSACTION_NAME);
+  return join29(resolve21(projectRoot), TRANSACTION_NAME);
 }
 function operationFile(projectRoot) {
-  return join28(transactionRoot(projectRoot), OPERATION_FILE);
+  return join29(transactionRoot(projectRoot), OPERATION_FILE);
 }
 function targetFile(projectRoot, portablePath2) {
-  return join28(transactionRoot(projectRoot), "targets", ...portablePath2.split("/"));
+  return join29(transactionRoot(projectRoot), "targets", ...portablePath2.split("/"));
 }
 function shadowRoot(projectRoot) {
-  return join28(transactionRoot(projectRoot), "shadow");
+  return join29(transactionRoot(projectRoot), "shadow");
 }
 function backupFile(projectRoot, portablePath2) {
-  return join28(transactionRoot(projectRoot), "backups", ...portablePath2.split("/"));
+  return join29(transactionRoot(projectRoot), "backups", ...portablePath2.split("/"));
 }
 function portableManagedPath(path4) {
   return path4.startsWith(".kxm/") && path4 !== KXM_TEMPLATE_PROVENANCE_PATH && path4.length <= 1024 && !path4.includes("\\") && !isAbsolute8(path4) && PORTABLE_PATH.test(path4) && !/[<>:"|?*]/.test(path4);
@@ -32356,24 +32925,24 @@ function readRegularBounded(file, label) {
   const stat = lstatSync7(file);
   if (stat.isSymbolicLink() || !stat.isFile()) fail3("repair_file_invalid", label, "managed file must be a regular file, not a link or directory", "path");
   if (stat.size > MAX_MANAGED_FILE_BYTES) fail3("repair_file_too_large", label, `managed file exceeds ${MAX_MANAGED_FILE_BYTES} bytes`, "parse");
-  return readFileSync24(file);
+  return readFileSync25(file);
 }
 function readOptionalManaged(projectRoot, path4) {
-  const file = join28(projectRoot, ...path4.split("/"));
-  if (!existsSync24(file)) return void 0;
-  let parent = dirname17(file);
-  const boundary = resolve22(projectRoot);
+  const file = join29(projectRoot, ...path4.split("/"));
+  if (!existsSync25(file)) return void 0;
+  let parent = dirname16(file);
+  const boundary = resolve21(projectRoot);
   while (parent !== boundary) {
     const stat = lstatSync7(parent);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_parent_invalid", path4, "managed file parents must be regular directories", "path");
-    parent = dirname17(parent);
+    parent = dirname16(parent);
   }
   return readRegularBounded(file, path4);
 }
 function readProjectAndProvenance(projectRoot, schemasDir) {
-  const projectFile = join28(projectRoot, ".kxm", "project.yaml");
-  const provenanceFile = join28(projectRoot, ...KXM_TEMPLATE_PROVENANCE_PATH.split("/"));
-  if (!existsSync24(projectFile) || !existsSync24(provenanceFile)) return void 0;
+  const projectFile = join29(projectRoot, ".kxm", "project.yaml");
+  const provenanceFile = join29(projectRoot, ...KXM_TEMPLATE_PROVENANCE_PATH.split("/"));
+  if (!existsSync25(projectFile) || !existsSync25(provenanceFile)) return void 0;
   const projectBytes = readOptionalManaged(projectRoot, ".kxm/project.yaml");
   const provenanceBytes = readOptionalManaged(projectRoot, KXM_TEMPLATE_PROVENANCE_PATH);
   if (!projectBytes || !provenanceBytes) return void 0;
@@ -32409,7 +32978,7 @@ function readProjectAndProvenance(projectRoot, schemasDir) {
 }
 function planKxmTemplateRepair(projectRoot, options = {}) {
   assertNoRegisteredGates(options);
-  const root = resolve22(projectRoot);
+  const root = resolve21(projectRoot);
   const source = readProjectAndProvenance(root, options.schemasDir);
   if (!source) return void 0;
   const target = renderKxmTemplate(
@@ -32537,7 +33106,7 @@ function operationPlanSha(operation) {
 function writeOperation(projectRoot, operation) {
   const root = transactionRoot(projectRoot);
   const file = operationFile(projectRoot);
-  const temporary = join28(root, `.operation-${operation.operationId}-${randomUUID10()}.tmp`);
+  const temporary = join29(root, `.operation-${operation.operationId}-${randomUUID10()}.tmp`);
   try {
     writeDurableNew(temporary, Buffer.from(`${JSON.stringify(operation, null, 2)}
 `, "utf8"), 384);
@@ -32554,11 +33123,11 @@ function updatePhase(projectRoot, operation, phase) {
 }
 function readOperation(projectRoot, schemasDir) {
   const root = transactionRoot(projectRoot);
-  if (!existsSync24(root)) return void 0;
+  if (!existsSync25(root)) return void 0;
   const stat = lstatSync7(root);
   if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("init_transaction_invalid", TRANSACTION_NAME, "initialization transaction must be a regular directory", "path");
   const file = operationFile(projectRoot);
-  if (!existsSync24(file)) {
+  if (!existsSync25(file)) {
     const entries = readdirSync9(root, { withFileTypes: true });
     const recoverable = entries.every((entry) => entry.isFile() && /^\.operation-op_[a-f0-9]{32}-[a-f0-9-]{36}\.tmp$/.test(entry.name));
     if (recoverable) return void 0;
@@ -32586,15 +33155,15 @@ function readOperation(projectRoot, schemasDir) {
   return operation;
 }
 function hasKxmInitTransaction(projectRoot) {
-  return existsSync24(transactionRoot(projectRoot));
+  return existsSync25(transactionRoot(projectRoot));
 }
 function readTarget(projectRoot, path4) {
-  return readOptionalManaged(join28(transactionRoot(projectRoot), "targets"), path4);
+  return readOptionalManaged(join29(transactionRoot(projectRoot), "targets"), path4);
 }
 function writeTarget(projectRoot, path4, bytes) {
   if (bytes.byteLength > MAX_MANAGED_FILE_BYTES) fail3("template_target_too_large", path4, `target exceeds ${MAX_MANAGED_FILE_BYTES} bytes`);
   const file = targetFile(projectRoot, path4);
-  mkdirSync21(dirname17(file), { recursive: true, mode: 448 });
+  mkdirSync21(dirname16(file), { recursive: true, mode: 448 });
   writeDurableNew(file, bytes, 384);
 }
 function writeAndVerifyBackups(projectRoot, operation) {
@@ -32606,7 +33175,7 @@ function writeAndVerifyBackups(projectRoot, operation) {
       fail3("repair_preimage_changed", entry.path, "destination changed before transaction preparation; local bytes were preserved");
     }
     const file = backupFile(projectRoot, entry.path);
-    mkdirSync21(dirname17(file), { recursive: true, mode: 448 });
+    mkdirSync21(dirname16(file), { recursive: true, mode: 448 });
     writeDurableNew(file, current, 384);
   }
 }
@@ -32621,7 +33190,7 @@ function writeKnownBackups(projectRoot, operation) {
       fail3("init_transaction_backup_source_invalid", entry.path, "supported source template cannot reproduce the pinned preimage");
     }
     const file = backupFile(projectRoot, entry.path);
-    mkdirSync21(dirname17(file), { recursive: true, mode: 448 });
+    mkdirSync21(dirname16(file), { recursive: true, mode: 448 });
     writeDurableNew(file, bytes, 384);
   }
 }
@@ -32629,7 +33198,7 @@ function verifyBackups(projectRoot, operation) {
   if (operation.kind !== "repair") return;
   for (const entry of operation.files) {
     if (entry.observedSha256 === null) continue;
-    const bytes = readOptionalManaged(join28(transactionRoot(projectRoot), "backups"), entry.path);
+    const bytes = readOptionalManaged(join29(transactionRoot(projectRoot), "backups"), entry.path);
     if (!bytes || kxmContentSha256(bytes) !== entry.observedSha256) {
       fail3("init_transaction_backup_invalid", entry.path, "pinned preimage backup is missing or corrupt");
     }
@@ -32663,10 +33232,10 @@ function sourceConfigFiles(projectRoot) {
     ".kxm/repo/repo.yaml",
     ".kxm/repo/env.yaml"
   ];
-  const files = fixed.filter((path4) => existsSync24(join28(projectRoot, ...path4.split("/"))));
+  const files = fixed.filter((path4) => existsSync25(join29(projectRoot, ...path4.split("/"))));
   for (const directory of ["agents", "models", "workflows"]) {
-    const absolute = join28(projectRoot, ".kxm", directory);
-    if (!existsSync24(absolute)) continue;
+    const absolute = join29(projectRoot, ".kxm", directory);
+    if (!existsSync25(absolute)) continue;
     const stat = lstatSync7(absolute);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_directory_invalid", `.kxm/${directory}`, "configuration directory must be regular", "path");
     for (const entry of readdirSync9(absolute, { withFileTypes: true })) {
@@ -32687,8 +33256,8 @@ function absoluteMemberBindings(projectRoot, project, explicit = {}) {
     const repository = candidate;
     if (repository.role !== "member" || typeof repository.id !== "string" || Object.hasOwn(bindings, repository.id)) continue;
     if (typeof repository.pathHint === "string") {
-      const candidate2 = resolve22(projectRoot, ...repository.pathHint.split("/"));
-      if (existsSync24(candidate2)) bindings[repository.id] = candidate2;
+      const candidate2 = resolve21(projectRoot, ...repository.pathHint.split("/"));
+      if (existsSync25(candidate2)) bindings[repository.id] = candidate2;
     }
   }
   return bindings;
@@ -32702,9 +33271,9 @@ function prepareShadow(projectRoot, operation, options) {
       const bytes = readOptionalManaged(projectRoot, path4);
       if (!bytes) fail3("repair_snapshot_file_missing", path4, "configuration changed during shadow preparation");
       total += bytes.byteLength;
-      const source = join28(projectRoot, ...path4.split("/"));
-      const destination = join28(shadow, ...path4.split("/"));
-      mkdirSync21(dirname17(destination), { recursive: true, mode: 448 });
+      const source = join29(projectRoot, ...path4.split("/"));
+      const destination = join29(shadow, ...path4.split("/"));
+      mkdirSync21(dirname16(destination), { recursive: true, mode: 448 });
       writeDurableNew(destination, bytes, lstatSync7(source).mode & 511);
       if (total > MAX_MANAGED_TOTAL_BYTES) fail3("repair_snapshot_too_large", ".kxm", `configuration snapshot exceeds ${MAX_MANAGED_TOTAL_BYTES} bytes`, "parse");
     }
@@ -32712,12 +33281,12 @@ function prepareShadow(projectRoot, operation, options) {
   for (const entry of operation.files) {
     const bytes = readTarget(projectRoot, entry.path);
     if (!bytes) fail3("init_transaction_target_missing", entry.path, "pinned target artifact is missing");
-    const destination = join28(shadow, ...entry.path.split("/"));
-    mkdirSync21(dirname17(destination), { recursive: true, mode: 448 });
-    const mode = existsSync24(destination) ? lstatSync7(destination).mode & 511 : 420;
+    const destination = join29(shadow, ...entry.path.split("/"));
+    mkdirSync21(dirname16(destination), { recursive: true, mode: 448 });
+    const mode = existsSync25(destination) ? lstatSync7(destination).mode & 511 : 420;
     writeDurable(destination, bytes, mode);
   }
-  const project = parseRestrictedYaml2(readFileSync24(join28(shadow, ".kxm", "project.yaml")), ".kxm/project.yaml");
+  const project = parseRestrictedYaml2(readFileSync25(join29(shadow, ".kxm", "project.yaml")), ".kxm/project.yaml");
   const bound = absoluteMemberBindings(projectRoot, project, options.repositoryBindings);
   loadKxmProject(shadow, { ...loaderOptions(options), repositoryBindings: bound });
   const provenance = readProjectAndProvenance(shadow, options.schemasDir)?.provenance;
@@ -32726,7 +33295,7 @@ function prepareShadow(projectRoot, operation, options) {
   }
 }
 function createOperation(projectRoot, kind, rendered, files, sourceTemplateRevision) {
-  const root = resolve22(projectRoot);
+  const root = resolve21(projectRoot);
   const operationWithoutHash = {
     schema: "kxm.init-operation.v1",
     operationId: `op_${randomUUID10().replaceAll("-", "")}`,
@@ -32755,7 +33324,7 @@ function prepareOperation(projectRoot, operation, rendered, options) {
   const transaction = transactionRoot(projectRoot);
   validateOperationRecord(operation, options.schemasDir);
   validateOperationIntent(projectRoot, operation);
-  if (existsSync24(transaction)) fail3("init_transaction_exists", TRANSACTION_NAME, "an initialization transaction already exists and must be resumed");
+  if (existsSync25(transaction)) fail3("init_transaction_exists", TRANSACTION_NAME, "an initialization transaction already exists and must be resumed");
   mkdirSync21(transaction, { mode: 448 });
   syncDirectory2(projectRoot);
   writeOperation(projectRoot, operation);
@@ -32777,25 +33346,25 @@ function prepareOperation(projectRoot, operation, rendered, options) {
   }
 }
 function ensureDestinationParents(projectRoot, path4) {
-  const boundary = resolve22(projectRoot);
+  const boundary = resolve21(projectRoot);
   const segments = path4.split("/").slice(0, -1);
   let current = boundary;
   for (const segment of segments) {
-    current = join28(current, segment);
-    if (!existsSync24(current)) mkdirSync21(current, { mode: 448 });
+    current = join29(current, segment);
+    if (!existsSync25(current)) mkdirSync21(current, { mode: 448 });
     const stat = lstatSync7(current);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_destination_parent_invalid", path4, "destination parent must be a regular directory", "path");
   }
 }
 function destinationSha(projectRoot, path4) {
-  const file = join28(projectRoot, ...path4.split("/"));
-  if (!existsSync24(file)) return void 0;
+  const file = join29(projectRoot, ...path4.split("/"));
+  if (!existsSync25(file)) return void 0;
   return kxmContentSha256(readRegularBounded(file, path4));
 }
 function requireConditionalLinkSupport(directory, operationId, path4) {
   const nonce = randomUUID10();
-  const source = join28(directory, `.kxm-repair-${operationId}-${nonce}.link-source`);
-  const target = join28(directory, `.kxm-repair-${operationId}-${nonce}.link-target`);
+  const source = join29(directory, `.kxm-repair-${operationId}-${nonce}.link-source`);
+  const target = join29(directory, `.kxm-repair-${operationId}-${nonce}.link-target`);
   try {
     writeDurableNew(source, Buffer.from("kxm-link-probe\n", "utf8"), 384);
     try {
@@ -32810,19 +33379,19 @@ function requireConditionalLinkSupport(directory, operationId, path4) {
   }
 }
 function atomicInstallTarget(projectRoot, operation, entry) {
-  const destination = join28(projectRoot, ...entry.path.split("/"));
+  const destination = join29(projectRoot, ...entry.path.split("/"));
   ensureDestinationParents(projectRoot, entry.path);
-  const directory = dirname17(destination);
+  const directory = dirname16(destination);
   const temporaryPrefix = `.kxm-repair-${operation.operationId}-`;
   const pathKey = kxmContentSha256(entry.path).slice("sha256:".length, "sha256:".length + 16);
-  const displaced = join28(directory, `${temporaryPrefix}${pathKey}.preimage`);
-  if (existsSync24(displaced)) {
+  const displaced = join29(directory, `${temporaryPrefix}${pathKey}.preimage`);
+  if (existsSync25(displaced)) {
     const stat = lstatSync7(displaced);
     if (stat.isSymbolicLink() || !stat.isFile()) fail3("repair_preimage_temporary_invalid", entry.path, "stale displaced preimage is not a regular file", "path");
-    if (entry.observedSha256 === null || kxmContentSha256(readFileSync24(displaced)) !== entry.observedSha256) {
+    if (entry.observedSha256 === null || kxmContentSha256(readFileSync25(displaced)) !== entry.observedSha256) {
       fail3("repair_preimage_temporary_mismatch", entry.path, "stale displaced preimage does not match the pinned operation");
     }
-    if (!existsSync24(destination)) {
+    if (!existsSync25(destination)) {
       try {
         linkSync(displaced, destination);
       } catch {
@@ -32837,7 +33406,7 @@ function atomicInstallTarget(projectRoot, operation, entry) {
     const owned = candidate.name.startsWith(temporaryPrefix) && (candidate.name.endsWith(".tmp") || candidate.name.endsWith(".link-source") || candidate.name.endsWith(".link-target"));
     if (!owned) continue;
     if (!candidate.isFile()) fail3("repair_temporary_invalid", entry.path, "stale operation temporary is not a regular file", "path");
-    rmSync9(join28(directory, candidate.name), { force: true });
+    rmSync9(join29(directory, candidate.name), { force: true });
   }
   const current = destinationSha(projectRoot, entry.path);
   if (current === entry.targetSha256) return;
@@ -32847,15 +33416,15 @@ function atomicInstallTarget(projectRoot, operation, entry) {
   requireConditionalLinkSupport(directory, operation.operationId, entry.path);
   const bytes = readTarget(projectRoot, entry.path);
   if (!bytes) fail3("init_transaction_target_missing", entry.path, "pinned target artifact is missing");
-  const temporary = join28(directory, `${temporaryPrefix}${randomUUID10()}.tmp`);
-  const mode = existsSync24(destination) ? lstatSync7(destination).mode & 511 : 420;
+  const temporary = join29(directory, `${temporaryPrefix}${randomUUID10()}.tmp`);
+  const mode = existsSync25(destination) ? lstatSync7(destination).mode & 511 : 420;
   try {
     writeDurableNew(temporary, bytes, mode);
     if (entry.observedSha256 !== null) {
       renameSync7(destination, displaced);
       syncDirectory2(directory);
-      if (kxmContentSha256(readFileSync24(displaced)) !== entry.observedSha256) {
-        if (!existsSync24(destination)) {
+      if (kxmContentSha256(readFileSync25(displaced)) !== entry.observedSha256) {
+        if (!existsSync25(destination)) {
           try {
             linkSync(displaced, destination);
           } catch {
@@ -32871,7 +33440,7 @@ function atomicInstallTarget(projectRoot, operation, entry) {
     try {
       linkSync(temporary, destination);
     } catch {
-      if (!existsSync24(destination) && existsSync24(displaced)) {
+      if (!existsSync25(destination) && existsSync25(displaced)) {
         try {
           linkSync(displaced, destination);
         } catch {
@@ -32893,12 +33462,12 @@ function atomicInstallTarget(projectRoot, operation, entry) {
   if (destinationSha(projectRoot, entry.path) !== entry.targetSha256) fail3("repair_install_verification_failed", entry.path, "installed target hash does not match the pinned operation");
 }
 function installedCreateMatches(projectRoot, operation) {
-  const configRoot = join28(projectRoot, ".kxm");
-  if (!existsSync24(configRoot)) return false;
+  const configRoot = join29(projectRoot, ".kxm");
+  if (!existsSync25(configRoot)) return false;
   const actual = [];
   const visit2 = (directory) => {
     for (const entry of readdirSync9(directory, { withFileTypes: true })) {
-      const absolute = join28(directory, entry.name);
+      const absolute = join29(directory, entry.name);
       if (entry.isSymbolicLink()) fail3("create_resume_link", relativeConfigPath(projectRoot, absolute), "created configuration must not contain links", "path");
       if (entry.isDirectory()) visit2(absolute);
       else if (entry.isFile()) actual.push(relativeConfigPath(projectRoot, absolute));
@@ -32911,15 +33480,15 @@ function installedCreateMatches(projectRoot, operation) {
   return actual.length === expected.length && actual.every((path4, index) => path4 === expected[index]) && operation.files.every((entry) => destinationSha(projectRoot, entry.path) === entry.targetSha256);
 }
 function relativeConfigPath(projectRoot, file) {
-  return relative5(resolve22(projectRoot), file).replaceAll("\\", "/");
+  return relative5(resolve21(projectRoot), file).replaceAll("\\", "/");
 }
 function syncTreeDirectories(root) {
-  if (!existsSync24(root)) return;
+  if (!existsSync25(root)) return;
   const directories = [];
   const visit2 = (directory) => {
     directories.push(directory);
     for (const entry of readdirSync9(directory, { withFileTypes: true })) {
-      if (entry.isDirectory()) visit2(join28(directory, entry.name));
+      if (entry.isDirectory()) visit2(join29(directory, entry.name));
     }
   };
   visit2(root);
@@ -32933,7 +33502,7 @@ function rebuildCreateShadow(projectRoot, operation, options) {
   if (stat.isSymbolicLink() || !stat.isDirectory() || !installedCreateMatches(shadow, operation)) {
     fail3("create_shadow_invalid", TRANSACTION_NAME, "reconstructed create shadow does not exactly match pinned target files", "path");
   }
-  syncTreeDirectories(join28(shadow, ".kxm"));
+  syncTreeDirectories(join29(shadow, ".kxm"));
 }
 function applyOperation(projectRoot, original, options, resumed) {
   assertNoRegisteredGates(options);
@@ -32943,10 +33512,10 @@ function applyOperation(projectRoot, original, options, resumed) {
   verifyBackups(projectRoot, operation);
   operation = updatePhase(projectRoot, operation, "applying");
   if (operation.kind === "create") {
-    const destination = join28(projectRoot, ".kxm");
-    if (!existsSync24(destination)) {
+    const destination = join29(projectRoot, ".kxm");
+    if (!existsSync25(destination)) {
       rebuildCreateShadow(projectRoot, operation, effectiveOptions);
-      renameSync7(join28(shadowRoot(projectRoot), ".kxm"), destination);
+      renameSync7(join29(shadowRoot(projectRoot), ".kxm"), destination);
       syncDirectory2(projectRoot);
     } else if (!installedCreateMatches(projectRoot, operation)) {
       fail3("create_resume_conflict", ".kxm", "existing project configuration does not match the pinned create operation");
@@ -32973,7 +33542,7 @@ function applyOperation(projectRoot, original, options, resumed) {
   operation = updatePhase(projectRoot, operation, "verified");
   if (options.testFaultAt === "verified") throw new Error("injected init fault after verification");
   const files = operation.files.map((entry) => entry.path);
-  syncTreeDirectories(join28(projectRoot, ".kxm"));
+  syncTreeDirectories(join29(projectRoot, ".kxm"));
   return { kind: operation.kind, resumed, bundle, files };
 }
 function prepareAndApplyKxmCreate(projectRoot, rendered, options = {}) {
@@ -33088,7 +33657,7 @@ function finishPreparingOperation(projectRoot, operation, options) {
   const rendered = rendererForOperation(operation);
   if (!rendered) fail3("init_transaction_renderer_unavailable", TRANSACTION_NAME, "this binary cannot reproduce the pinned pre-application target");
   for (const directory of ["targets", "backups", "shadow"]) {
-    rmSync9(join28(transactionRoot(projectRoot), directory), { recursive: true, force: true });
+    rmSync9(join29(transactionRoot(projectRoot), directory), { recursive: true, force: true });
   }
   for (const entry of operation.files) {
     const bytes = rendered.files.get(entry.path);
@@ -33107,7 +33676,7 @@ function resumeKxmInitTransaction(projectRoot, options = {}) {
   let operation = readOperation(projectRoot, options.schemasDir);
   if (!operation) {
     const root = transactionRoot(projectRoot);
-    if (existsSync24(root)) {
+    if (existsSync25(root)) {
       rmSync9(root, { recursive: true, force: true });
       syncDirectory2(projectRoot);
     }
@@ -33123,7 +33692,7 @@ function commitKxmInitTransaction(projectRoot, schemasDir) {
     fail3("init_transaction_not_verified", TRANSACTION_NAME, "initialization transaction cannot commit before installed state is verified");
   }
   const transaction = transactionRoot(projectRoot);
-  const retired = join28(projectRoot, `${TRANSACTION_NAME}-cleanup-${operation.operationId}-${randomUUID10()}`);
+  const retired = join29(projectRoot, `${TRANSACTION_NAME}-cleanup-${operation.operationId}-${randomUUID10()}`);
   renameSync7(transaction, retired);
   syncDirectory2(projectRoot);
   rmSync9(retired, { recursive: true, force: true });
@@ -33232,7 +33801,7 @@ function validateBindingIdentities(bundle, persisted, explicit) {
 }
 function initializeKxmProjectAtGitRoot(start, gitRoot, options, mutationLock) {
   const storeOptions = bindingStoreOptions(options);
-  const persisted = existsSync25(join29(gitRoot, ".kxm", "project.yaml")) ? readKxmLocalBindings(gitRoot, storeOptions) : void 0;
+  const persisted = existsSync26(join30(gitRoot, ".kxm", "project.yaml")) ? readKxmLocalBindings(gitRoot, storeOptions) : void 0;
   const repositoryBindings = Object.fromEntries([
     ...Object.entries(persisted?.repositories ?? {}),
     ...Object.entries(options.repositoryBindings ?? {})
@@ -33420,7 +33989,7 @@ function initializeKxmProjectAtGitRoot(start, gitRoot, options, mutationLock) {
   const files = [...rendered.files.keys()];
   if (options.dryRun) return { action: "planned", plan, projectRoot: gitRoot, files };
   if (!mutationLock) throw new Error("project mutation lock is required to create configuration");
-  if (existsSync25(join29(gitRoot, ".kxm"))) {
+  if (existsSync26(join30(gitRoot, ".kxm"))) {
     throw new KxmConfigError([initIssue("workspace_changed", ".kxm", "workspace changed after planning; existing .kxm state was not overwritten")]);
   }
   const created = prepareAndApplyKxmCreate(gitRoot, rendered, transactionOptions);
@@ -33457,7 +34026,7 @@ function hubSourceReason(status) {
   if (status === 404) return "hub_not_found";
   return `hub_http_${status}`;
 }
-function asString(value) {
+function asString2(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
 function isObject(value) {
@@ -33505,37 +34074,37 @@ async function assembleTenantStatus(input) {
         project: body.project,
         fetchedAt: body.fetchedAt,
         agents: body.agents.filter(isObject).map((agent) => ({
-          id: asString(agent.id) ?? "",
-          name: asString(agent.name) ?? "",
+          id: asString2(agent.id) ?? "",
+          name: asString2(agent.name) ?? "",
           online: agent.online === true
         })),
         openMessageTotal: body.openMessageTotal,
         runTotal: body.runTotal,
         runs: runRows.map((run) => {
           const stages = Array.isArray(run.stages) ? run.stages.filter(isObject).map((stage) => ({
-            id: asString(stage.id) ?? "",
-            status: asString(stage.status) ?? "unknown",
+            id: asString2(stage.id) ?? "",
+            status: asString2(stage.status) ?? "unknown",
             ...typeof stage.attempts === "number" ? { attempts: stage.attempts } : {}
           })) : void 0;
           const done = stages?.filter((stage) => stage.status === "passed" || stage.status === "failed" || stage.status === "warning").length;
           return {
-            id: asString(run.id) ?? "",
-            status: asString(run.status) ?? "unknown",
-            definitionId: asString(run.definitionId) ?? "",
-            ...asString(run.currentStage) ? { currentStage: asString(run.currentStage) } : {},
-            ...asString(run.targetAgentName) ? { targetAgentName: asString(run.targetAgentName) } : {},
-            ...asString(run.updatedAt) ? { updatedAt: asString(run.updatedAt) } : {},
+            id: asString2(run.id) ?? "",
+            status: asString2(run.status) ?? "unknown",
+            definitionId: asString2(run.definitionId) ?? "",
+            ...asString2(run.currentStage) ? { currentStage: asString2(run.currentStage) } : {},
+            ...asString2(run.targetAgentName) ? { targetAgentName: asString2(run.targetAgentName) } : {},
+            ...asString2(run.updatedAt) ? { updatedAt: asString2(run.updatedAt) } : {},
             ...stages !== void 0 ? { progress: { done: done ?? 0, total: stages.length }, stages } : {},
             source: "hub-projection"
           };
         }),
         plans: (Array.isArray(body.plans) ? body.plans : []).filter(isObject).map((plan) => ({
-          id: asString(plan.id) ?? "",
-          runId: asString(plan.runId) ?? "",
-          summary: asString(plan.summary) ?? "",
-          createdAt: asString(plan.createdAt) ?? "",
-          ...asString(plan.stageId) ? { stageId: asString(plan.stageId) } : {},
-          ...asString(plan.severity) ? { severity: asString(plan.severity) } : {}
+          id: asString2(plan.id) ?? "",
+          runId: asString2(plan.runId) ?? "",
+          summary: asString2(plan.summary) ?? "",
+          createdAt: asString2(plan.createdAt) ?? "",
+          ...asString2(plan.stageId) ? { stageId: asString2(plan.stageId) } : {},
+          ...asString2(plan.severity) ? { severity: asString2(plan.severity) } : {}
         }))
       };
       return { state: "ok", observedAt: attemptedAt, value };
@@ -33676,6 +34245,11 @@ async function cmdKxmInit(runtime, options, postHooks) {
       localStateRoot: kxmUserStateRoot({ env: runtime.env }),
       dryRun: runtime.dryRun
     });
+    const starterGuidance = initialized.action === "created" || initialized.action === "planned" && initialized.plan.mode === "create" ? [
+      "defaultHarness: pi and the npm test gate are generic starter settings, not repository detection.",
+      "For Claude, set defaultHarness: claude in .kxm/project.yaml, update any explicit harness overrides in .kxm/agents/*.yaml, and configure compatible agent models.",
+      "For .NET or other non-npm repositories, set gates.test.argv in .kxm/gates.yaml to the repository's actual test runner before driving a workflow."
+    ] : [];
     const payload = {
       ok: initialized.action !== "planned" || runtime.dryRun,
       command: "init",
@@ -33688,10 +34262,11 @@ async function cmdKxmInit(runtime, options, postHooks) {
       ...initialized.repairPlan === void 0 ? {} : { repairPlan: initialized.repairPlan },
       ...initialized.resumePending === void 0 ? {} : { resumePending: initialized.resumePending },
       ...initialized.transactionKind === void 0 ? {} : { transactionKind: initialized.transactionKind },
-      plannedOnly: initialized.action === "planned"
+      plannedOnly: initialized.action === "planned",
+      ...starterGuidance.length > 0 ? { guidance: starterGuidance } : {}
     };
     const finishInit = (code, text) => {
-      print(runtime.io, runtime.json, payload, text);
+      print(runtime.io, runtime.json, payload, [text, ...starterGuidance].join("\n"));
       return code;
     };
     if (initialized.action === "created") {
@@ -33745,7 +34320,7 @@ async function cmdBackup(runtime, options) {
       projectRoot: backupProjectRoot(runtime),
       env: runtime.env,
       ...options.allProjects === true ? { allProjects: true } : {},
-      ...options.out ? { outDir: resolve23(runtime.cwd, options.out) } : {}
+      ...options.out ? { outDir: resolve22(runtime.cwd, options.out) } : {}
     };
     if (runtime.dryRun) {
       const plan = planBackup(backupOptions);
@@ -33753,8 +34328,8 @@ async function cmdBackup(runtime, options) {
         runtime,
         { command: "backup", scope: plan.scope, outDir: plan.outDir, stores: plan.stores, files: plan.files },
         [
-          ...[...plan.stores, ...plan.files].map((entry) => ({ action: "write", target: join30(plan.outDir, entry.backupFile) })),
-          { action: "write", target: join30(plan.outDir, "manifest.json") }
+          ...[...plan.stores, ...plan.files].map((entry) => ({ action: "write", target: join31(plan.outDir, entry.backupFile) })),
+          { action: "write", target: join31(plan.outDir, "manifest.json") }
         ],
         `back up ${plan.stores.length} store(s) and ${plan.files.length} file(s) (${plan.scope} scope) to ${plan.outDir} (sources are not opened, so their WAL is not checkpointed)`
       );
@@ -33773,7 +34348,7 @@ async function cmdBackup(runtime, options) {
       complete ? `Created SQLite backup with ${manifest.stores.length} store(s) (${manifest.scope ?? "project"} scope):` : `Backup is incomplete (${manifest.omitted?.length ?? 0} omitted); not ok:`,
       ...manifest.stores.map((s) => `  - ${s.storeId}: ${s.sourcePath} -> ${s.backupFile} (schema v${s.schemaVersion}, ${s.bytes} bytes, sha256 ${s.sha256.slice(0, 12)}...)`),
       ...(manifest.omitted ?? []).map((id) => `  - omitted ${id}`),
-      `Manifest: ${join30(outDir, "manifest.json")}`
+      `Manifest: ${join31(outDir, "manifest.json")}`
     ].join("\n");
     print(runtime.io, runtime.json, payload, summary);
     return complete ? 0 : 1;
@@ -33807,7 +34382,7 @@ function assertRestoreTargetsStopped(runtime, plan) {
   }
   for (const store of plan.stores) {
     if (store.storeId !== "hub-store") continue;
-    const claim = readLiveHubClaim(dirname18(store.targetPath));
+    const claim = readLiveHubClaim(dirname17(store.targetPath));
     if (claim) {
       throw databaseError(
         "restore_hub_running",
@@ -33819,7 +34394,7 @@ function assertRestoreTargetsStopped(runtime, plan) {
 }
 async function cmdRestore(runtime, manifestArg, options = {}) {
   try {
-    const plan = planRestore(resolve23(runtime.cwd, manifestArg), {
+    const plan = planRestore(resolve22(runtime.cwd, manifestArg), {
       projectRoot: backupProjectRoot(runtime),
       env: runtime.env,
       ...options.allProjects === true ? { allProjects: true } : {}
@@ -33839,7 +34414,7 @@ async function cmdRestore(runtime, manifestArg, options = {}) {
         [
           ...plan.stores.flatMap((store) => [
             { action: "write", target: store.targetPath },
-            ...[`${store.targetPath}-wal`, `${store.targetPath}-shm`].filter((file) => existsSync26(file)).map((file) => ({ action: "delete", target: file }))
+            ...[`${store.targetPath}-wal`, `${store.targetPath}-shm`].filter((file) => existsSync27(file)).map((file) => ({ action: "delete", target: file }))
           ]),
           ...plan.files.map((file) => ({ action: "write", target: file.targetPath }))
         ],
@@ -33920,11 +34495,17 @@ async function readSupervisor(runtime, command) {
   const attached = await attachKxmSupervisor({ env: runtime.env });
   return attached ?? refuseDryRun(runtime.io, runtime.json, command, "the Runtime supervisor is not running and --dry-run will not start it");
 }
-var RUN_ENGINE_PHASE = "pre-3a";
-function runEngineNotice(runId) {
-  return `drive it model-free: kxm runs drive ${runId} --simulated --wait (or cancel: kxm runs cancel ${runId})`;
+function runEngineNotice(runId, defaultHarness, prerequisites) {
+  return [
+    `No steps executed. Project default harness: ${defaultHarness}; per-agent harness settings take precedence.`,
+    ...prerequisites.map((item) => `Live prerequisite${item.stepId ? ` (${item.stepId})` : ""}: ${item.detail}`),
+    "Live execution uses one-shot harness calls; no hub or Pi worker is required. Check installation/authentication with kxm harness list.",
+    `${prerequisites.length > 0 ? "Resolve the prerequisites above, then execute" : "Execute"}: kxm runs drive ${runId} --wait`,
+    `Inspect: kxm runs status ${runId} --json; receipt: kxm runs receipt ${runId} --json; cancel: kxm runs cancel ${runId}`,
+    "These are local Runtime runs, not webhook workflows; use kxm runs, not kxm workflow get."
+  ].join("\n");
 }
-function resolveKxmRunTarget(runtime, workflow) {
+function resolveKxmRunTarget(runtime, workflow, forTask = false) {
   if (runtime.workspaceFlag !== void 0) {
     print(runtime.io, runtime.json, {
       ok: false,
@@ -33933,7 +34514,7 @@ function resolveKxmRunTarget(runtime, workflow) {
     }, "kxm run discovers the authoritative project from the current directory; --workspace is not supported");
     return 2;
   }
-  if (!workflow) {
+  if (!workflow && !forTask) {
     print(runtime.io, runtime.json, { ok: false, command: "run", error: "workflow_required" }, "usage: kxm run <workflow> [prompt]");
     return 2;
   }
@@ -33943,15 +34524,30 @@ function resolveKxmRunTarget(runtime, workflow) {
     return 1;
   }
   const bundle = loadKxmProject(projectRoot, {});
-  if (!bundle.workflows.has(workflow)) {
-    print(runtime.io, runtime.json, { ok: false, command: "run", error: "run_workflow_unknown", workflow }, `workflow ${workflow} does not exist in this project`);
+  const workflowId = workflow ?? String(bundle.project.value.defaultWorkflow ?? "default");
+  if (!bundle.workflows.has(workflowId)) {
+    print(runtime.io, runtime.json, { ok: false, command: "run", error: "run_workflow_unknown", workflow: workflowId }, `workflow ${workflowId} does not exist in this project`);
+    return 1;
+  }
+  const defaultHarness = String(bundle.project.value.defaultHarness ?? "pi");
+  const prerequisites = kxmLiveRunPrerequisites(bundle, workflowId, projectRoot);
+  if (forTask && prerequisites.length > 0) {
+    print(runtime.io, runtime.json, {
+      ok: false,
+      command: "task run",
+      error: "run_execution_unavailable",
+      workflowId,
+      defaultHarness,
+      execution: { status: "not_started", mode: "live", prerequisites }
+    }, `task run refused; no run created or task changed (default harness: ${defaultHarness}).
+${prerequisites.map((item) => `${item.stepId ?? workflowId}: ${item.detail}`).join("\n")}`);
     return 1;
   }
-  return { projectRoot, workflowId: workflow, configRevision: bundle.configRevision };
+  return { projectRoot, workflowId, configRevision: bundle.configRevision, defaultHarness, prerequisites };
 }
-async function cmdKxmRun(runtime, workflow, promptParts) {
+async function cmdKxmRun(runtime, workflow, promptParts, forTask = false) {
   try {
-    const target = resolveKxmRunTarget(runtime, workflow);
+    const target = resolveKxmRunTarget(runtime, workflow, forTask);
     if (typeof target === "number") return target;
     const { projectRoot } = target;
     if (runtime.dryRun) {
@@ -33974,12 +34570,24 @@ async function cmdKxmRun(runtime, workflow, promptParts) {
     print(runtime.io, runtime.json, {
       ok: true,
       command: "run",
-      phase: RUN_ENGINE_PHASE,
+      execution: {
+        status: "not_started",
+        mode: "live",
+        defaultHarness: target.defaultHarness,
+        authentication: "not_checked",
+        prerequisites: target.prerequisites,
+        nextSteps: {
+          harnesses: "kxm harness list",
+          drive: `kxm runs drive ${run.runId} --wait`,
+          status: `kxm runs status ${run.runId} --json`,
+          receipt: `kxm runs receipt ${run.runId} --json`
+        }
+      },
       idempotent: acceptance.idempotent === true,
       run,
       supervisor: { runtimeId: supervisor.runtimeId, port: supervisor.port, started: supervisor.started }
     }, `run ${run.status}: ${run.runId} (home ${run.homeRuntimeId.slice(0, 12)}\u2026, config ${run.configRevision.slice(0, 19)}\u2026)
-${runEngineNotice(run.runId)}`);
+${runEngineNotice(run.runId, target.defaultHarness, target.prerequisites)}`);
     return 0;
   } catch (error) {
     if (error instanceof KxmConfigError) {
@@ -34063,7 +34671,7 @@ function parseDriveWaitTimeoutMs(raw) {
   return value;
 }
 function sleepMs(ms) {
-  return new Promise((resolve35) => setTimeout(resolve35, ms));
+  return new Promise((resolve34) => setTimeout(resolve34, ms));
 }
 function driveWaitCompleted(drive) {
   return drive?.verified === true && drive.receipt?.settlement?.kind === "terminal" && drive.receipt.settlement.status === "completed";
@@ -34260,9 +34868,20 @@ async function cmdTenantStatus(runtime) {
   }
 }
 async function cmdHarnessList(runtime) {
-  const inventory = await probeHarnessesAsync({ env: runtime.env });
-  print(runtime.io, runtime.json, { ok: true, command: "harness list", ...inventory }, formatHarnessInventory(inventory));
-  return 0;
+  try {
+    const projectRoot = discoverKxmProjectRoot(runtime.cwd);
+    const defaultHarness = projectRoot ? String(loadKxmProject(projectRoot).project.value.defaultHarness ?? "pi") : void 0;
+    const inventory = await probeHarnessesAsync({ env: runtime.env, defaultHarness });
+    print(runtime.io, runtime.json, { ok: true, command: "harness list", ...inventory }, formatHarnessInventory(inventory));
+    return 0;
+  } catch (error) {
+    if (error instanceof KxmConfigError) {
+      print(runtime.io, runtime.json, { ok: false, command: "harness list", error: "harness_list_failed", issues: error.issues }, `harness list failed: ${error.message}`);
+      return 1;
+    }
+    print(runtime.io, runtime.json, { ok: false, command: "harness list", error: "harness_list_io_failed" }, "harness list failed because a local operation did not complete");
+    return 1;
+  }
 }
 async function selectInventoryModel(runtime, requested) {
   const models = listInventoryModels(runtime.dirs.workdir);
@@ -34270,7 +34889,7 @@ async function selectInventoryModel(runtime, requested) {
   if (runtime.json || !process.stdin.isTTY || models.length === 0) return void 0;
   runtime.io.stdout(models.slice(0, 100).map((model, index2) => `${index2 + 1}. ${model}`).join("\n") + "\nSelect model number: ");
   const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve35) => rl.once("line", resolve35));
+  const answer = await new Promise((resolve34) => rl.once("line", resolve34));
   rl.close();
   const index = Number.parseInt(answer.trim(), 10) - 1;
   return Number.isInteger(index) && index >= 0 && index < models.length ? models[index] : void 0;
@@ -34296,7 +34915,7 @@ async function cmdModelsScreen(runtime) {
     return 2;
   }
   const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  const ask = (q2) => new Promise((resolve35) => rl.question(q2, resolve35));
+  const ask = (q2) => new Promise((resolve34) => rl.question(q2, resolve34));
   try {
     while (true) {
       const policy = loadRoutePolicy(runtime.dirs.workdir);
@@ -34473,39 +35092,64 @@ async function cmdKxmRunReceipt(runtime, runId, options = {}) {
 }
 
 // plugins/kxm/src/cli/tasks.ts
-async function cmdSuggest(runtime, promptParts) {
+async function cmdSuggest(runtime, promptParts, probeHarnesses2 = probeHarnessesAsync) {
   try {
     const prompt = promptParts.join(" ").trim();
     if (!prompt) {
-      runtime.io.stderr("prompt must be non-empty\n");
+      print(runtime.io, runtime.json, { ok: false, command: "suggest", error: "prompt_required" }, "prompt must be non-empty");
       return 2;
     }
-    const inventory = await probeHarnessesAsync({ env: runtime.env });
-    const availableHarnesses = inventory.harnesses.map((h) => ({
-      harness: h.id,
-      auth: h.authenticated === true ? "authenticated" : "unauthenticated"
-    }));
-    const suggestion = suggestWorkflowAndRoles(prompt, { availableHarnesses });
+    const inventory = runtime.dryRun ? void 0 : await probeHarnesses2({ env: runtime.env });
+    const suggestion = suggestWorkflowAndRoles(prompt, { availableHarnesses: inventory?.harnesses });
+    if (suggestion.execution.supported && [".yaml", ".yml"].some((extension) => existsSync28(join32(runtime.cwd, ".kxm", "workflows", `${suggestion.workflowId}${extension}`)))) {
+      suggestion.roles = [];
+      suggestion.execution = {
+        supported: false,
+        error: "workflow_already_exists",
+        reason: `Workflow ${suggestion.workflowId} already exists; its agents and permissions may differ from the recommended template.`,
+        nextSteps: ["Review the existing definition and every agent's harness/model before running it, or install the recommended template under a fresh flat ID. No existing workflow is overwritten or recommended for execution."]
+      };
+    }
+    const execution = suggestion.execution;
     const text = [
       `Suggested Workflow: ${suggestion.workflowId} (${suggestion.area})`,
+      `Template: ${suggestion.template}`,
       `Confidence: ${(suggestion.confidence * 100).toFixed(0)}%`,
       `Reasons: ${suggestion.reasons.join("; ")}`,
       `Suggested Skills: ${suggestion.suggestedSkills.join(", ") || "none"}`,
-      `Roles:`,
-      `  Planner:     ${suggestion.roles.planner.harness} (${suggestion.roles.planner.model})`,
-      `  Writer:      ${suggestion.roles.writer.harness} (${suggestion.roles.writer.model})`,
-      `  Critics:     ${suggestion.roles.critics.map((c) => `${c.harness}:${c.model}`).join(", ")}`,
-      `  Verifier:    ${suggestion.roles.verifier.command}`,
-      ``,
-      `Execute with:`,
-      `  ${suggestion.suggestedCommand}`
+      "",
+      "Install definition only (requires kxm init; does not execute):",
+      `  ${suggestion.suggestedCommand}`,
+      "",
+      ...execution.supported ? [
+        "Suggested agent routing (not applied):",
+        ...suggestion.roles.map((role) => `  ${role.agent}: ${role.harness} (${role.role}; use a configured compatible model)`),
+        "Prerequisites:",
+        ...execution.prerequisites.map((step) => `  ${step}`),
+        `Create a run only (${execution.shell}; does not execute steps):`,
+        `  ${execution.createCommand}`,
+        "Then drive the returned run ID with live calls and inspect its result:",
+        `  ${execution.driveCommand}`,
+        `  ${execution.statusCommand}`,
+        `  ${execution.receiptCommand}`
+      ] : [
+        `Execution unavailable: ${execution.reason}`,
+        ...execution.nextSteps.map((step) => `  ${step}`),
+        ...runtime.dryRun ? ["Harness authentication was not probed during --dry-run."] : []
+      ]
     ].join("\n");
-    print(runtime.io, runtime.json, { ok: true, command: "suggest", prompt, ...suggestion }, text);
-    return 0;
+    print(runtime.io, runtime.json, {
+      ok: execution.supported,
+      command: "suggest",
+      prompt,
+      ...suggestion,
+      ...runtime.dryRun ? { dryRun: true } : {},
+      ...!execution.supported ? { error: execution.error } : {}
+    }, text);
+    return execution.supported ? 0 : 1;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    runtime.io.stderr(`suggest failed: ${message}
-`);
+    print(runtime.io, runtime.json, { ok: false, command: "suggest", error: "suggest_failed", detail: message }, `suggest failed: ${message}`);
     return 1;
   }
 }
@@ -34625,27 +35269,21 @@ async function cmdTaskRun(runtime, taskId) {
 `);
       return 1;
     }
-    const workflow = task.assignedWorkflow ?? "default";
+    const workflow = task.assignedWorkflow;
     if (runtime.dryRun) {
-      const target = resolveKxmRunTarget(runtime, workflow);
+      const target = resolveKxmRunTarget(runtime, workflow, true);
       if (typeof target === "number") return target;
-      const started = updateTaskStatus(runtime.cwd, taskId, "in_progress", { dryRun: true });
       printPlan(
         runtime,
-        { command: "task run", taskId, ...target, status: started.status },
+        { command: "task run", taskId, ...target, status: task.status, execution: { status: "not_started", mode: "live" } },
         [
-          { action: "request", target: "POST kxm-runtime /v1/runs (starts the Runtime supervisor if it is not running)" },
-          { action: "write", target: taskFilePath(runtime.cwd, taskId) }
+          { action: "request", target: "POST kxm-runtime /v1/runs (starts the Runtime supervisor if it is not running)" }
         ],
-        `run workflow ${workflow} for task ${taskId}, then mark it ${started.status}`
+        `create workflow ${target.workflowId} for task ${taskId}; task status stays ${task.status} until work actually starts`
       );
       return 0;
     }
-    const exitCode = await cmdKxmRun(runtime, workflow, [task.objective]);
-    if (exitCode === 0) {
-      updateTaskStatus(runtime.cwd, taskId, "in_progress");
-    }
-    return exitCode;
+    return await cmdKxmRun(runtime, workflow, [task.objective], true);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     runtime.io.stderr(`task run failed: ${message}
@@ -34679,12 +35317,12 @@ async function cmdStudioLayout(runtime, workflowPath) {
     const projectRoot = discoverKxmProjectRoot(runtime.cwd) ?? runtime.cwd;
     let filePath = workflowPath;
     if (!filePath) {
-      filePath = resolve24(projectRoot, ".kxm", "workflows", "default.yaml");
+      filePath = resolve23(projectRoot, ".kxm", "workflows", "default.yaml");
     }
     let yamlContent;
     let workflowId = "default";
-    if (existsSync27(filePath)) {
-      yamlContent = readFileSync26(filePath, "utf8");
+    if (existsSync28(filePath)) {
+      yamlContent = readFileSync27(filePath, "utf8");
     } else {
       yamlContent = `schema: kxm.workflow.v1
 description: Feature implementation workflow
@@ -34757,15 +35395,15 @@ async function cmdStudioServe(runtime, options) {
       sessionToken,
       planProvider: () => {
         try {
-          const wfDir = join31(runtime.cwd, ".kxm", "workflows");
-          const defaultPath = join31(wfDir, "default.yaml");
-          let targetPath = existsSync27(defaultPath) ? defaultPath : void 0;
-          if (!targetPath && existsSync27(wfDir)) {
+          const wfDir = join32(runtime.cwd, ".kxm", "workflows");
+          const defaultPath = join32(wfDir, "default.yaml");
+          let targetPath = existsSync28(defaultPath) ? defaultPath : void 0;
+          if (!targetPath && existsSync28(wfDir)) {
             const yml = readdirSync10(wfDir).find((f) => f.endsWith(".yaml") || f.endsWith(".yml"));
-            if (yml) targetPath = join31(wfDir, yml);
+            if (yml) targetPath = join32(wfDir, yml);
           }
-          if (targetPath && existsSync27(targetPath)) {
-            const raw = readFileSync26(targetPath, "utf8");
+          if (targetPath && existsSync28(targetPath)) {
+            const raw = readFileSync27(targetPath, "utf8");
             const parsed = (0, import_yaml15.parse)(raw);
             const wfId = basename7(targetPath).replace(/\.(yaml|yml)$/, "");
             return compileKxmWorkflow({ id: wfId, value: parsed });
@@ -34815,16 +35453,16 @@ Press Ctrl+C to stop.
 }
 
 // plugins/kxm/src/cli/context-skills.ts
-import { readFileSync as readFileSync27 } from "node:fs";
-import { join as join33, relative as relative6, resolve as resolve25 } from "node:path";
+import { readFileSync as readFileSync28 } from "node:fs";
+import { join as join34, relative as relative6, resolve as resolve24 } from "node:path";
 
 // plugins/kxm/src/wiki.ts
 import { mkdirSync as mkdirSync23, writeFileSync as writeFileSync21 } from "node:fs";
-import { join as join32 } from "node:path";
+import { join as join33 } from "node:path";
 function writeCompiledWiki(root, wiki) {
   const written = [];
   for (const [relativePath, content] of [...wiki.pages].sort(([left], [right]) => left.localeCompare(right))) {
-    const absolute = join32(root, relativePath);
+    const absolute = join33(root, relativePath);
     mkdirSync23(absolute.slice(0, absolute.lastIndexOf("/")), { recursive: true });
     writeFileSync21(absolute, content);
     written.push(relativePath);
@@ -34976,7 +35614,7 @@ async function cmdContextWikiCompile(runtime, project, options) {
     printPlan(
       runtime,
       { command: "context wiki-compile", project, pages: compiled.audit.pages, openContradictions: compiled.audit.contradictions, outDir },
-      compiled.pages.map((page) => ({ action: "write", target: resolve25(outDir, page.path) })),
+      compiled.pages.map((page) => ({ action: "write", target: resolve24(outDir, page.path) })),
       `write ${compiled.pages.length} compiled wiki page(s) to ${outDir}`
     );
     return 0;
@@ -35011,7 +35649,7 @@ function skillStateFromFlag(value) {
   throw new Error(`invalid skill state ${value}`);
 }
 function skillsRoot(runtime) {
-  return join33(runtime.dirs.workdir, ".kxm", "skills");
+  return join34(runtime.dirs.workdir, ".kxm", "skills");
 }
 function csv(value) {
   if (!value) return void 0;
@@ -35028,7 +35666,7 @@ async function cmdSkillsCreate(runtime, options) {
     const metadata = lifecycle.create({
       name: options.name,
       description: options.description ?? "",
-      content: readFileSync27(options.file, "utf8"),
+      content: readFileSync28(options.file, "utf8"),
       createdBy: options.createdBy,
       sources: {
         runIds: csv(options.run) ?? [],
@@ -35190,7 +35828,7 @@ async function cmdMemorySync(runtime) {
       printPlan(
         runtime,
         { command: "memory sync", ...result },
-        result.updated.map((file) => ({ action: "write", target: join33(runtime.cwd, file) })),
+        result.updated.map((file) => ({ action: "write", target: join34(runtime.cwd, file) })),
         "regenerate the project memory block in the instruction files this project already has"
       );
       return 0;
@@ -35218,8 +35856,8 @@ ${lines.join("\n")}`
 
 // plugins/kxm/src/cli/hub.ts
 import { randomUUID as randomUUID13 } from "node:crypto";
-import { existsSync as existsSync33, mkdirSync as mkdirSync27, readFileSync as readFileSync33, readdirSync as readdirSync12, rmSync as rmSync11, writeFileSync as writeFileSync24 } from "node:fs";
-import { join as join43, resolve as resolve28 } from "node:path";
+import { existsSync as existsSync34, mkdirSync as mkdirSync27, readFileSync as readFileSync34, readdirSync as readdirSync12, rmSync as rmSync11, writeFileSync as writeFileSync24 } from "node:fs";
+import { join as join44, resolve as resolve27 } from "node:path";
 
 // node_modules/marked/lib/marked.esm.js
 function M() {
@@ -39381,10 +40019,10 @@ var TuiBase = class _TuiBase extends Container {
    * @returns Promise containing the parsed RGB color, or undefined if it times out or fails to parse.
    */
   queryTerminalBackgroundColor({ timeoutMs }) {
-    return new Promise((resolve35) => {
+    return new Promise((resolve34) => {
       const query = {
         settled: false,
-        resolve: resolve35,
+        resolve: resolve34,
         timer: void 0
       };
       query.timer = setTimeout(() => {
@@ -39407,7 +40045,7 @@ var TuiBase = class _TuiBase extends Container {
    * `CSI ? 997 ; 1 n` for dark or `CSI ? 997 ; 2 n` for light.
    */
   queryTerminalColorScheme({ timeoutMs }) {
-    return new Promise((resolve35) => {
+    return new Promise((resolve34) => {
       let settled = false;
       let timer;
       let unsubscribe = () => {
@@ -39421,7 +40059,7 @@ var TuiBase = class _TuiBase extends Container {
           timer = void 0;
         }
         unsubscribe();
-        resolve35(scheme);
+        resolve34(scheme);
       };
       unsubscribe = this.onTerminalColorSchemeChange(settle);
       timer = setTimeout(() => settle(void 0), timeoutMs);
@@ -41152,19 +41790,19 @@ import * as path2 from "node:path";
 
 // node_modules/@earendil-works/pi-tui/dist/native-module-path.js
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname19, join as join34 } from "node:path";
+import { dirname as dirname18, join as join35 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var moduleRequire = createRequire2(import.meta.url);
 var TUI_PACKAGE_NAME = "@earendil-works/pi-tui";
 function getNativeModuleCandidates(nativePath, options = {}) {
-  const moduleDir = dirname19(fileURLToPath2(options.moduleUrl ?? import.meta.url));
+  const moduleDir = dirname18(fileURLToPath2(options.moduleUrl ?? import.meta.url));
   const candidates = [];
   try {
     const packageEntry = (options.resolvePackage ?? moduleRequire.resolve)(TUI_PACKAGE_NAME);
-    candidates.push(join34(dirname19(packageEntry), "..", nativePath));
+    candidates.push(join35(dirname18(packageEntry), "..", nativePath));
   } catch {
   }
-  candidates.push(join34(moduleDir, "..", nativePath), join34(moduleDir, nativePath), join34(dirname19(options.execPath ?? process.execPath), nativePath));
+  candidates.push(join35(moduleDir, "..", nativePath), join35(moduleDir, nativePath), join35(dirname18(options.execPath ?? process.execPath), nativePath));
   return Array.from(new Set(candidates));
 }
 
@@ -41505,7 +42143,7 @@ var ProcessTerminal = class {
           break;
         if (now - lastDataTime >= idleMs)
           break;
-        await new Promise((resolve35) => setTimeout(resolve35, Math.min(idleMs, timeLeft)));
+        await new Promise((resolve34) => setTimeout(resolve34, Math.min(idleMs, timeLeft)));
       }
     } finally {
       process.stdin.removeListener("data", onData);
@@ -43621,7 +44259,7 @@ var MAX_RENDER_WRITE_CHARS = 1024 * 1024;
 
 // plugins/kxm/src/tui.ts
 import { mkdirSync as mkdirSync24 } from "node:fs";
-import { join as join38, resolve as resolve27, dirname as dirname20 } from "node:path";
+import { join as join39, resolve as resolve26, dirname as dirname19 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 
 // packages/core/tui/src/types/surface.ts
@@ -43762,9 +44400,9 @@ var SHARED_EFFECT_KINDS = Object.freeze([
 ]);
 
 // plugins/kxm/src/local-snapshot.ts
-import { existsSync as existsSync28, readdirSync as readdirSync11, readFileSync as readFileSync28 } from "node:fs";
+import { existsSync as existsSync29, readdirSync as readdirSync11, readFileSync as readFileSync29 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { isAbsolute as isAbsolute9, join as join37, resolve as resolve26 } from "node:path";
+import { isAbsolute as isAbsolute9, join as join38, resolve as resolve25 } from "node:path";
 var DEFAULT_BUSY_TIMEOUT_MS = 5e3;
 var RUNTIME_PROJECT_KEY = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;
 function processExists2(pid) {
@@ -43889,36 +44527,36 @@ function readOpenMessageMetadata(database, where = OPEN_MESSAGE_WHERE, params =
   return messages;
 }
 function resolveKxmSnapshotPaths(cwd, env = process.env) {
-  const stateDir = env.KXM_STATE_DIR?.trim() || join37(cwd, ".kxm", "state");
+  const stateDir = env.KXM_STATE_DIR?.trim() || join38(cwd, ".kxm", "state");
   const configured = env.KXM_DATA_PATH?.trim();
-  const dataPath = configured ? resolve26(cwd, configured) : join37(stateDir, "kxm.db");
+  const dataPath = configured ? resolve25(cwd, configured) : join38(stateDir, "kxm.db");
   return { dataPath, stateDir };
 }
 function resolveKxmStateRoot(stateDir, options) {
-  if (options?.kxmStateRoot && existsSync28(options.kxmStateRoot)) {
-    return resolve26(options.kxmStateRoot);
+  if (options?.kxmStateRoot && existsSync29(options.kxmStateRoot)) {
+    return resolve25(options.kxmStateRoot);
   }
-  if (existsSync28(join37(stateDir, "runtime", "registry.db")) || existsSync28(join37(stateDir, "runtime", "projects"))) {
+  if (existsSync29(join38(stateDir, "runtime", "registry.db")) || existsSync29(join38(stateDir, "runtime", "projects"))) {
     return stateDir;
   }
   const env = options?.env ?? process.env;
   const explicit = env.KXM_STATE_HOME?.trim() || env.KXM_USER_STATE_DIR?.trim() || env.KXM_STATE_ROOT?.trim();
-  if (explicit && isAbsolute9(explicit) && existsSync28(resolve26(explicit))) {
-    return resolve26(explicit);
+  if (explicit && isAbsolute9(explicit) && existsSync29(resolve25(explicit))) {
+    return resolve25(explicit);
   }
   let base;
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    base = localAppData && isAbsolute9(localAppData) ? localAppData : join37(homedir6(), "AppData", "Local");
-    base = resolve26(base, "KXM");
+    base = localAppData && isAbsolute9(localAppData) ? localAppData : join38(homedir6(), "AppData", "Local");
+    base = resolve25(base, "KXM");
   } else if (process.platform === "darwin") {
-    base = resolve26(homedir6(), "Library", "Application Support", "KXM");
+    base = resolve25(homedir6(), "Library", "Application Support", "KXM");
   } else {
     const xdgState = env.XDG_STATE_HOME?.trim();
-    base = xdgState && isAbsolute9(xdgState) ? xdgState : join37(homedir6(), ".local", "state");
-    base = resolve26(base, "kxm");
+    base = xdgState && isAbsolute9(xdgState) ? xdgState : join38(homedir6(), ".local", "state");
+    base = resolve25(base, "kxm");
   }
-  if (existsSync28(base)) return base;
+  if (existsSync29(base)) return base;
   return void 0;
 }
 function readRuntimeRuns(eventDb, projectId) {
@@ -43951,7 +44589,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   let legacyRuns = [];
   let legacyRunTotal = 0;
   let plans = [];
-  if (existsSync28(dataPath)) {
+  if (existsSync29(dataPath)) {
     hasLegacy = true;
     const database = openReadOnlyDatabase(dataPath);
     try {
@@ -43982,11 +44620,11 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   let kxmRunTotal = 0;
   const kxmStateRoot = scope && !scope.runtimeProjectId ? void 0 : resolveKxmStateRoot(stateDir, options);
   if (kxmStateRoot) {
-    const runtimeDir = join37(kxmStateRoot, "runtime");
-    const registryDbPath = join37(runtimeDir, "registry.db");
-    const projectsDir = join37(runtimeDir, "projects");
+    const runtimeDir = join38(kxmStateRoot, "runtime");
+    const registryDbPath = join38(runtimeDir, "registry.db");
+    const projectsDir = join38(runtimeDir, "projects");
     const projectKeys = /* @__PURE__ */ new Set();
-    if (existsSync28(registryDbPath)) {
+    if (existsSync29(registryDbPath)) {
       hasKxm = true;
       try {
         const regDb = openReadOnlyDatabase(registryDbPath);
@@ -44002,7 +44640,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
       } catch {
       }
     }
-    if (!scope && existsSync28(projectsDir)) {
+    if (!scope && existsSync29(projectsDir)) {
       try {
         for (const entry of readdirSync11(projectsDir, { withFileTypes: true })) {
           if (entry.isDirectory()) {
@@ -44014,8 +44652,8 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
     }
     for (const key of projectKeys) {
       if (scope && !RUNTIME_PROJECT_KEY.test(key)) continue;
-      const eventDbPath = join37(projectsDir, key, "run-events.db");
-      if (existsSync28(eventDbPath)) {
+      const eventDbPath = join38(projectsDir, key, "run-events.db");
+      if (existsSync29(eventDbPath)) {
         hasKxm = true;
         try {
           const eventDb = openReadOnlyDatabase(eventDbPath);
@@ -44033,10 +44671,10 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
     }
   }
   const pids = [];
-  if (existsSync28(stateDir)) {
+  if (existsSync29(stateDir)) {
     for (const file of readdirSync11(stateDir).filter((name) => name.endsWith(".pid"))) {
       try {
-        const record = JSON.parse(readFileSync28(join37(stateDir, file), "utf8"));
+        const record = JSON.parse(readFileSync29(join38(stateDir, file), "utf8"));
         pids.push({
           file,
           ...record.role ? { role: record.role } : {},
@@ -44075,8 +44713,8 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   } else {
     source = "legacy";
   }
-  const telemetryFile = join37(stateDir, "telemetry.jsonl");
-  const spend = existsSync28(telemetryFile) ? readRoutingRecords(telemetryFile) : [];
+  const telemetryFile = join38(stateDir, "telemetry.jsonl");
+  const spend = existsSync29(telemetryFile) ? readRoutingRecords(telemetryFile) : [];
   return {
     source,
     agents: agents.sort((a, b2) => Number(b2.online) - Number(a.online) || a.name.localeCompare(b2.name)),
@@ -44210,11 +44848,11 @@ function spawnDegradeWorktree(repoRoot, runId, options) {
   const cleanRunId = runId.replace(/^run_/, "");
   const desc = options?.description ? slugifyBranchPart(options.description, 30) : "degrade";
   const branchName = `kxm/run-${cleanRunId}-${desc}`;
-  const relativeWtPath = join38(".kxm", "worktrees", `run-${cleanRunId}-${desc}`);
-  const absoluteWtPath = resolve27(repoRoot, relativeWtPath);
+  const relativeWtPath = join39(".kxm", "worktrees", `run-${cleanRunId}-${desc}`);
+  const absoluteWtPath = resolve26(repoRoot, relativeWtPath);
   const jumpCommand = `cd "${absoluteWtPath}"`;
   try {
-    mkdirSync24(dirname20(absoluteWtPath), { recursive: true });
+    mkdirSync24(dirname19(absoluteWtPath), { recursive: true });
     const branchCheck = runner("git", ["rev-parse", "--verify", `refs/heads/${branchName}`]);
     let wtRes;
     if (branchCheck.status === 0) {
@@ -44612,11 +45250,11 @@ async function readJson(response) {
 }
 async function waitForReconnect(signal, milliseconds = 1e3) {
   if (signal.aborted) return;
-  await new Promise((resolve35) => {
+  await new Promise((resolve34) => {
     const done = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", done);
-      resolve35();
+      resolve34();
     };
     const timer = setTimeout(done, milliseconds);
     timer.unref();
@@ -44979,8 +45617,8 @@ async function runMeshTui(input) {
 // plugins/kxm/src/session-work.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { randomUUID as randomUUID12 } from "node:crypto";
-import { existsSync as existsSync29, mkdirSync as mkdirSync25, readFileSync as readFileSync29, renameSync as renameSync8, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync25, readFileSync as readFileSync30, renameSync as renameSync8, writeFileSync as writeFileSync22 } from "node:fs";
+import { join as join40 } from "node:path";
 var MAX_SESSION_BRIEF_TASKS = 5;
 var MAX_SESSION_BRIEF_PLANS = 5;
 var SESSION_BRIEF_SCHEMA = "kxm.session-brief.v1";
@@ -45137,10 +45775,10 @@ function buildSessionBrief(snapshot, current, hub, ship, updateLatest, cost, ses
   };
 }
 function readCachedSessionBrief(stateDir) {
-  const file = join39(stateDir, "session-brief.json");
+  const file = join40(stateDir, "session-brief.json");
   try {
-    if (!existsSync29(file)) return void 0;
-    const raw = readFileSync29(file, "utf8");
+    if (!existsSync30(file)) return void 0;
+    const raw = readFileSync30(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && parsed.schema === "kxm.session-brief.v1" && typeof parsed.generatedAt === "string") {
       const ageMs = Date.now() - Date.parse(parsed.generatedAt);
@@ -45156,7 +45794,7 @@ function readCachedSessionBrief(stateDir) {
 function writeCachedSessionBrief(stateDir, brief) {
   try {
     mkdirSync25(stateDir, { recursive: true, mode: 448 });
-    const file = join39(stateDir, "session-brief.json");
+    const file = join40(stateDir, "session-brief.json");
     const tmp = `${file}.tmp.${randomUUID12().slice(0, 8)}`;
     writeFileSync22(tmp, JSON.stringify(brief, null, 2), { encoding: "utf8", mode: 384 });
     renameSync8(tmp, file);
@@ -45165,8 +45803,8 @@ function writeCachedSessionBrief(stateDir, brief) {
 }
 function estimateSessionCost(stateDir) {
   try {
-    const telemetryFile = join39(stateDir, "telemetry.jsonl");
-    if (!existsSync29(telemetryFile)) return void 0;
+    const telemetryFile = join40(stateDir, "telemetry.jsonl");
+    if (!existsSync30(telemetryFile)) return void 0;
     const records = readRoutingRecords(telemetryFile);
     if (records.length === 0) return void 0;
     let totalCost = 0;
@@ -45334,11 +45972,11 @@ function formatSessionBriefText(brief) {
 }
 
 // plugins/kxm/src/kxm-install-kind.ts
-import { existsSync as existsSync30, readFileSync as readFileSync30 } from "node:fs";
-import { dirname as dirname21, join as join40 } from "node:path";
+import { existsSync as existsSync31, readFileSync as readFileSync31 } from "node:fs";
+import { dirname as dirname20, join as join41 } from "node:path";
 function packageIsKxm(root) {
   try {
-    const pkg = JSON.parse(readFileSync30(join40(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync31(join41(root, "package.json"), "utf8"));
     return pkg.name === "@kontextmind/kxm";
   } catch {
     return false;
@@ -45387,12 +46025,12 @@ function report(kind, root) {
   return { kind, root, instruction: installKindInstruction(kind, root) };
 }
 function classifyInstallRoot(probe) {
-  const piGitRoot = join40(probe.homeDir, ".pi", "agent", "git");
+  const piGitRoot = join41(probe.homeDir, ".pi", "agent", "git");
   if (isUnder(probe.repoRoot, piGitRoot, probe.platform)) return report("pi-git", probe.repoRoot);
-  const claudeHome = probe.env.CLAUDE_CONFIG_DIR?.trim() || join40(probe.homeDir, ".claude");
-  const pluginsRoot = join40(claudeHome, "plugins");
+  const claudeHome = probe.env.CLAUDE_CONFIG_DIR?.trim() || join41(probe.homeDir, ".claude");
+  const pluginsRoot = join41(claudeHome, "plugins");
   if (isUnder(probe.moduleDir, pluginsRoot, probe.platform)) return report("claude-marketplace", probe.moduleDir);
-  const hasGit = existsSync30(join40(probe.repoRoot, ".git"));
+  const hasGit = existsSync31(join41(probe.repoRoot, ".git"));
   if (hasGit && packageIsKxm(probe.repoRoot)) return report("source", probe.repoRoot);
   if (isNpmPackageLayout(probe.repoRoot, probe.platform) && packageIsKxm(probe.repoRoot) && !hasGit) {
     return report("npm-package", probe.repoRoot);
@@ -45406,21 +46044,21 @@ function resolveInstallKind(probe, npmGlobalRoot) {
   if (typeof globalRoot !== "string" || globalRoot.trim() === "") {
     return report("unknown", classified.root);
   }
-  const expected = dirname21(dirname21(classified.root));
+  const expected = dirname20(dirname20(classified.root));
   if (sameHostPath2(globalRoot.trim(), expected, probe.platform)) return report("npm-global", classified.root);
   return report("npm-local", classified.root);
 }
 
 // plugins/kxm/src/kxm-update-config.ts
 var import_yaml16 = __toESM(require_dist(), 1);
-import { existsSync as existsSync31, readFileSync as readFileSync31 } from "node:fs";
-import { join as join41 } from "node:path";
+import { existsSync as existsSync32, readFileSync as readFileSync32 } from "node:fs";
+import { join as join42 } from "node:path";
 function loadKxmUpdateConfig(env = process.env) {
-  const path4 = join41(kxmUserStateRoot({ env }), "update.yaml");
-  if (!existsSync31(path4)) return { schema: KXM_UPDATE_SCHEMA, auto: false, source: "github" };
+  const path4 = join42(kxmUserStateRoot({ env }), "update.yaml");
+  if (!existsSync32(path4)) return { schema: KXM_UPDATE_SCHEMA, auto: false, source: "github" };
   let parsed;
   try {
-    parsed = (0, import_yaml16.parse)(readFileSync31(path4, "utf8"));
+    parsed = (0, import_yaml16.parse)(readFileSync32(path4, "utf8"));
   } catch {
     throw new KxmUpdateConfigError("update.yaml is not valid YAML");
   }
@@ -45446,8 +46084,8 @@ function loadKxmUpdateConfig(env = process.env) {
 }
 
 // plugins/kxm/src/session.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync26, readFileSync as readFileSync32, writeFileSync as writeFileSync23 } from "node:fs";
-import { join as join42 } from "node:path";
+import { existsSync as existsSync33, mkdirSync as mkdirSync26, readFileSync as readFileSync33, writeFileSync as writeFileSync23 } from "node:fs";
+import { join as join43 } from "node:path";
 var SESSION_SCHEMA = "kxm.session.v1";
 var SessionConfigError = class extends Error {
   code = "session_config_invalid";
@@ -45457,12 +46095,12 @@ var SessionConfigError = class extends Error {
   }
 };
 function workflowAssetDirs(assetsDir, workflowId) {
-  const root = join42(assetsDir, "workflows", workflowId);
-  return [root, join42(root, "inputs"), join42(root, "outputs"), join42(root, "generated")];
+  const root = join43(assetsDir, "workflows", workflowId);
+  return [root, join43(root, "inputs"), join43(root, "outputs"), join43(root, "generated")];
 }
 function sessionAssetDirs(assetsDir, sessionId) {
-  const root = join42(assetsDir, "sessions", sessionId);
-  return [root, join42(root, "inputs"), join42(root, "outputs")];
+  const root = join43(assetsDir, "sessions", sessionId);
+  return [root, join43(root, "inputs"), join43(root, "outputs")];
 }
 function rosterNames(configDir) {
   return [...loadRosterMap(configDir).values()].map((row) => String(row.name));
@@ -45512,7 +46150,7 @@ function workerFromRosterRow(name, row, project) {
 function loadRosterMap(configDir) {
   const byName = /* @__PURE__ */ new Map();
   for (const [file, key] of [["agents.json", "agents"], ["gates.json", "gates"]]) {
-    const path4 = join42(configDir, file);
+    const path4 = join43(configDir, file);
     for (const row of loadRoster(path4, key)) {
       const name = String(row.name).trim();
       const lowered = name.toLowerCase();
@@ -45526,10 +46164,10 @@ function loadRosterMap(configDir) {
   return byName;
 }
 function loadRoster(path4, key) {
-  if (!existsSync32(path4)) return [];
+  if (!existsSync33(path4)) return [];
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync32(path4, "utf8"));
+    parsed = JSON.parse(readFileSync33(path4, "utf8"));
   } catch (error) {
     throw new SessionConfigError(
       `${key} roster at ${path4} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
@@ -45554,7 +46192,7 @@ function loadRoster(path4, key) {
   });
 }
 function createSession(input) {
-  const assetDir = input.mode === "workflow" && input.workflowId ? join42("assets", "workflows", input.workflowId) : join42("assets", "sessions", input.id);
+  const assetDir = input.mode === "workflow" && input.workflowId ? join43("assets", "workflows", input.workflowId) : join43("assets", "sessions", input.id);
   return {
     schema: SESSION_SCHEMA,
     id: input.id,
@@ -45567,8 +46205,8 @@ function createSession(input) {
   };
 }
 function writeSession(assetsDir, session, dryRun = false) {
-  const dir = join42(assetsDir, "sessions", session.id);
-  const path4 = join42(dir, "session.json");
+  const dir = join43(assetsDir, "sessions", session.id);
+  const path4 = join43(dir, "session.json");
   if (!dryRun) {
     mkdirSync26(dir, { recursive: true });
     writeFileSync23(path4, `${JSON.stringify(session, null, 2)}
@@ -45579,7 +46217,7 @@ function writeSession(assetsDir, session, dryRun = false) {
 
 // plugins/kxm/src/cli/hub.ts
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { dirname as dirname22 } from "node:path";
+import { dirname as dirname21 } from "node:path";
 import { homedir as homedir7 } from "node:os";
 async function hubGet(url, fetchImpl) {
   try {
@@ -45597,7 +46235,7 @@ async function hubGet(url, fetchImpl) {
 }
 function installProbeFrom(runtime) {
   const partial = runtime.io.installProbe ?? {};
-  const moduleDir = partial.moduleDir ?? dirname22(fileURLToPath3(import.meta.url));
+  const moduleDir = partial.moduleDir ?? dirname21(fileURLToPath3(import.meta.url));
   return {
     moduleDir,
     // Classify the install that is **running**, never the directory the caller
@@ -45618,13 +46256,13 @@ function moduleInstallRoot() {
   try {
     return findKxmRepoRoot(import.meta.url);
   } catch {
-    return dirname22(fileURLToPath3(import.meta.url));
+    return dirname21(fileURLToPath3(import.meta.url));
   }
 }
 function warnIgnoredProjectUpdateYaml(runtime) {
-  const projectFile = join43(runtime.dirs.workspace, "update.yaml");
-  if (!existsSync33(projectFile)) return;
-  const userFile = join43(kxmUserStateRoot({ env: runtime.env }), "update.yaml");
+  const projectFile = join44(runtime.dirs.workspace, "update.yaml");
+  if (!existsSync34(projectFile)) return;
+  const userFile = join44(kxmUserStateRoot({ env: runtime.env }), "update.yaml");
   runtime.io.stderr(`kxm: ignoring .kxm/update.yaml in ${runtime.dirs.workdir}; update settings are read only from ${userFile}
 `);
 }
@@ -45672,7 +46310,7 @@ async function cmdDash(runtime, options = {}) {
     return 2;
   }
   const screen = requested;
-  const dataPath = resolve28(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join43(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve27(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join44(runtime.dirs.state, "kxm.db"));
   if (runtime.dryRun) {
     print(runtime.io, runtime.json, {
       ok: true,
@@ -45718,7 +46356,7 @@ async function cmdHub(runtime) {
         config = loadKxmUpdateConfig(runtime.env);
       } catch (error) {
         if (error instanceof KxmUpdateConfigError) {
-          const yamlPath = join43(kxmUserStateRoot({ env: runtime.env }), "update.yaml");
+          const yamlPath = join44(kxmUserStateRoot({ env: runtime.env }), "update.yaml");
           runtime.io.stderr(`kxm: ${error.message}; update check skipped; fix or remove ${yamlPath}
 `);
         } else {
@@ -45905,7 +46543,7 @@ async function cmdWorker(runtime, options) {
   return await (runtime.io.spawnWorker ?? ((launchEnv) => spawnScript("kxm-worker.mjs", launchEnv)))(extraEnv);
 }
 async function cmdStop(runtime, waitMsFlag) {
-  const pids = existsSync33(runtime.dirs.state) ? readdirSync12(runtime.dirs.state).filter((name) => name.endsWith(".pid")) : [];
+  const pids = existsSync34(runtime.dirs.state) ? readdirSync12(runtime.dirs.state).filter((name) => name.endsWith(".pid")) : [];
   if (runtime.dryRun) {
     print(runtime.io, runtime.json, { ok: true, command: "stop", dryRun: true, pidFiles: pids }, "would signal pid files");
     return 0;
@@ -45920,7 +46558,7 @@ async function cmdStop(runtime, waitMsFlag) {
   const orphans = [];
   for (const file of pids) {
     try {
-      const record = JSON.parse(readFileSync33(join43(runtime.dirs.state, file), "utf8"));
+      const record = JSON.parse(readFileSync34(join44(runtime.dirs.state, file), "utf8"));
       const expectedControl = file === "hub.pid" ? "hub.stop" : file.startsWith("worker-") ? `${file.slice(0, -4)}.stop` : void 0;
       const expectedRole = file === "hub.pid" ? "hub" : file.startsWith("worker-") ? "worker" : void 0;
       if (record.version !== 1 || !Number.isInteger(record.pid) || record.pid <= 0 || !record.startedAt || !expectedControl || record.controlFile !== expectedControl || record.role !== expectedRole) {
@@ -45940,7 +46578,7 @@ async function cmdStop(runtime, waitMsFlag) {
         ignored.push(file);
         continue;
       }
-      writeFileSync24(join43(runtime.dirs.state, record.controlFile), `${JSON.stringify({ startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {}, requestedAt: (/* @__PURE__ */ new Date()).toISOString() })}
+      writeFileSync24(join44(runtime.dirs.state, record.controlFile), `${JSON.stringify({ startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {}, requestedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `, { encoding: "utf8", mode: 384 });
       requested.push(file);
       records.set(file, { pid: record.pid, startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {} });
@@ -45958,7 +46596,7 @@ async function cmdStop(runtime, waitMsFlag) {
   while (Date.now() <= deadline && stopped.size < requested.length) {
     for (const [file, record] of records) {
       try {
-        const current = JSON.parse(readFileSync33(join43(runtime.dirs.state, file), "utf8"));
+        const current = JSON.parse(readFileSync34(join44(runtime.dirs.state, file), "utf8"));
         if (current.pid !== record.pid || current.startedAt !== record.startedAt || current.generation !== record.generation || !processExists(record.pid)) stopped.add(file);
       } catch {
         stopped.add(file);
@@ -45971,7 +46609,7 @@ async function cmdStop(runtime, waitMsFlag) {
   for (const file of orphans) {
     while (Date.now() <= deadlineOrphans) {
       try {
-        const current = JSON.parse(readFileSync33(join43(runtime.dirs.state, file), "utf8"));
+        const current = JSON.parse(readFileSync34(join44(runtime.dirs.state, file), "utf8"));
         if (!Number.isInteger(current.serverPid) || !processExists(current.serverPid)) break;
       } catch {
         break;
@@ -45979,14 +46617,14 @@ async function cmdStop(runtime, waitMsFlag) {
       await (runtime.io.sleep ?? ((ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms))))(100);
     }
     try {
-      const current = JSON.parse(readFileSync33(join43(runtime.dirs.state, file), "utf8"));
+      const current = JSON.parse(readFileSync34(join44(runtime.dirs.state, file), "utf8"));
       if (Number.isInteger(current.serverPid) && processExists(current.serverPid)) {
         try {
           process.kill(current.serverPid, "SIGKILL");
         } catch {
         }
       }
-      rmSync11(join43(runtime.dirs.state, file), { force: true });
+      rmSync11(join44(runtime.dirs.state, file), { force: true });
     } catch {
     }
     stopped.add(file);
@@ -45997,11 +46635,11 @@ async function cmdStop(runtime, waitMsFlag) {
 }
 async function cmdSessionStatus(runtime) {
   const stateDir = runtime.dirs.state;
-  const names3 = existsSync33(stateDir) ? readdirSync12(stateDir) : [];
+  const names3 = existsSync34(stateDir) ? readdirSync12(stateDir) : [];
   const claims = [];
   for (const file of names3.filter((name) => name.endsWith(".pid"))) {
     try {
-      const record = JSON.parse(readFileSync33(join43(stateDir, file), "utf8"));
+      const record = JSON.parse(readFileSync34(join44(stateDir, file), "utf8"));
       claims.push({
         file,
         role: record.role,
@@ -46016,7 +46654,7 @@ async function cmdSessionStatus(runtime) {
   const recoveries = [];
   for (const file of names3.filter((name) => name.startsWith("worker-recovery-") && name.endsWith(".json"))) {
     try {
-      const envelope = JSON.parse(readFileSync33(join43(stateDir, file), "utf8"));
+      const envelope = JSON.parse(readFileSync34(join44(stateDir, file), "utf8"));
       recoveries.push({
         file,
         reason: envelope.reason,
@@ -46042,7 +46680,7 @@ async function cmdSessionStatus(runtime) {
 async function cmdAuthToken(runtime, options = {}) {
   const tokenFile = sessionTokenPath(runtime.env.KXM_USER_CONFIG_DIR);
   if (options.clear && runtime.dryRun) {
-    const present = existsSync33(tokenFile);
+    const present = existsSync34(tokenFile);
     printPlan(runtime, { command: "auth token", cleared: present }, present ? [{ action: "delete", target: tokenFile }] : [], present ? "clear the session token from disk" : "no session token file to clear");
     return 0;
   }
@@ -46131,7 +46769,7 @@ async function cmdSessionBrief(runtime, options = {}) {
     print(runtime.io, runtime.json, { ok: true, command: "session brief", sessionToken }, sessionToken);
     return 0;
   }
-  const dataPath = resolve28(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join43(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve27(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join44(runtime.dirs.state, "kxm.db"));
   const env = {
     ...runtime.env,
     KXM_STATE_DIR: runtime.dirs.state,
@@ -46157,7 +46795,7 @@ async function cmdSessionBrief(runtime, options = {}) {
     writeCache: !runtime.dryRun
   });
   if (runtime.dryRun) {
-    if (!readCachedSessionBrief(runtime.dirs.state)) planned.push({ action: "write", target: join43(runtime.dirs.state, "session-brief.json") });
+    if (!readCachedSessionBrief(runtime.dirs.state)) planned.push({ action: "write", target: join44(runtime.dirs.state, "session-brief.json") });
     print(runtime.io, runtime.json, { ...brief, dryRun: true, planned }, [
       options.status ? brief.statusLine : formatSessionBriefText(brief),
       ...planned.map((change) => `dry run: would ${change.action} ${change.target}`)
@@ -46232,16 +46870,16 @@ async function cmdSessionStart(runtime, options) {
 
 // plugins/kxm/src/cli/system.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { createHash as createHash16 } from "node:crypto";
-import { existsSync as existsSync40, mkdtempSync as mkdtempSync3, readFileSync as readFileSync38, rmSync as rmSync13 } from "node:fs";
+import { createHash as createHash17 } from "node:crypto";
+import { existsSync as existsSync41, mkdtempSync as mkdtempSync3, readFileSync as readFileSync39, rmSync as rmSync13 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join49, resolve as resolve33 } from "node:path";
+import { basename as basename10, extname as extname3, join as join50, resolve as resolve32 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 
 // plugins/kxm/src/improve.ts
-import { createHash as createHash15 } from "node:crypto";
-import { existsSync as existsSync34, mkdirSync as mkdirSync28, writeFileSync as writeFileSync25 } from "node:fs";
-import { join as join44, relative as relative7, resolve as resolve29 } from "node:path";
+import { createHash as createHash16 } from "node:crypto";
+import { existsSync as existsSync35, mkdirSync as mkdirSync28, writeFileSync as writeFileSync25 } from "node:fs";
+import { join as join45, relative as relative7, resolve as resolve28 } from "node:path";
 var CANDIDATE_SCHEMA = "kxm.candidate.v1";
 var IMPROVEMENT_REPORT_SCHEMA = "kxm.improvement-report.v2";
 function classifyCandidateKind(stepId, agentRole) {
@@ -46456,7 +47094,7 @@ function groupRoutingRecords(records, options = {}) {
     }
     const candidateKind = isCandidate ? classifyCandidateKind(group.stepId, group.agentRole) : void 0;
     const safeSlug = group.stepId.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 16) || "step";
-    const keyHash = createHash15("sha256").update(`${group.workflowHash}:${group.stepId}:${group.agentRole}:${group.promptHash}`).digest("hex").slice(0, 10);
+    const keyHash = createHash16("sha256").update(`${group.workflowHash}:${group.stepId}:${group.agentRole}:${group.promptHash}`).digest("hex").slice(0, 10);
     const candidateId = isCandidate && candidateKind ? `cand_${candidateKind.replace(/-/g, "_")}_${safeSlug}_${keyHash}` : void 0;
     keyed.push({
       key: group.key,
@@ -46496,8 +47134,8 @@ function groupRoutingRecords(records, options = {}) {
   }).map((entry) => entry.row);
 }
 function buildImprovementReport(records, options = {}) {
-  const projectRoot = options.projectRoot ? resolve29(options.projectRoot) : process.cwd();
-  const candidatesDir = options.candidatesDir ? resolve29(options.candidatesDir) : join44(projectRoot, ".kxm", "candidates");
+  const projectRoot = options.projectRoot ? resolve28(options.projectRoot) : process.cwd();
+  const candidatesDir = options.candidatesDir ? resolve28(options.candidatesDir) : join45(projectRoot, ".kxm", "candidates");
   const promotionPolicy = options.promotionPolicy ?? "manual_pr";
   const groups = groupRoutingRecords(records, options);
   const candidates = [];
@@ -46511,7 +47149,7 @@ function buildImprovementReport(records, options = {}) {
       group.workflowId
     );
     const diffFileName = `${group.candidateId}.diff`;
-    const diffFilePath = join44(candidatesDir, diffFileName);
+    const diffFilePath = join45(candidatesDir, diffFileName);
     const relDiffPath = relative7(projectRoot, diffFilePath).replace(/\\/g, "/");
     const candidate = {
       schema: CANDIDATE_SCHEMA,
@@ -46533,11 +47171,11 @@ function buildImprovementReport(records, options = {}) {
       createdAt: nowIso()
     };
     if (!options.dryRun) {
-      if (!existsSync34(candidatesDir)) {
+      if (!existsSync35(candidatesDir)) {
         mkdirSync28(candidatesDir, { recursive: true });
       }
       writeFileSync25(diffFilePath, diff, "utf8");
-      const jsonFilePath = join44(candidatesDir, `${group.candidateId}.json`);
+      const jsonFilePath = join45(candidatesDir, `${group.candidateId}.json`);
       writeFileSync25(jsonFilePath, JSON.stringify(candidate, null, 2) + "\n", "utf8");
     }
     candidates.push(candidate);
@@ -46566,7 +47204,7 @@ function buildImprovementReport(records, options = {}) {
 }
 function writeImprovementReport(improvementsDir, report2, dryRun = false) {
   const stamp = report2.createdAt.replace(/[:.]/g, "-");
-  const path4 = join44(improvementsDir, `${stamp}.json`);
+  const path4 = join45(improvementsDir, `${stamp}.json`);
   if (!dryRun) {
     mkdirSync28(improvementsDir, { recursive: true });
     writeFileSync25(path4, `${JSON.stringify(report2, null, 2)}
@@ -46645,8 +47283,8 @@ function evaluatePromotionPolicy(candidate, policy = "manual_pr", options = {})
 }
 
 // plugins/kxm/src/improve-sources.ts
-import { existsSync as existsSync35 } from "node:fs";
-import { resolve as resolve30 } from "node:path";
+import { existsSync as existsSync36 } from "node:fs";
+import { resolve as resolve29 } from "node:path";
 var ENGINE_EVENTS_SQL = "SELECT run_id, sequence, event_type, payload FROM events WHERE event_type IN ('routing.attempt.recorded','step.entered','run.status_changed') ORDER BY run_id, sequence";
 var SIMULATED_HARNESS = "driver-simulated";
 function parsePayload(text) {
@@ -46668,7 +47306,7 @@ function readEngineRoutingRecords(path4) {
     undecided: 0,
     duplicatesDropped: 0
   };
-  if (!existsSync35(path4)) return { records: [], source };
+  if (!existsSync36(path4)) return { records: [], source };
   source.exists = true;
   let rows;
   let database;
@@ -46744,7 +47382,7 @@ function readEngineRoutingRecords(path4) {
   };
 }
 function readJsonlSource(kind, path4) {
-  const exists = existsSync35(path4);
+  const exists = existsSync36(path4);
   const records = exists ? readRoutingRecords(path4).map((entry) => entry.routing) : [];
   return { records, source: { kind, path: path4, exists, records: records.length, duplicatesDropped: 0 } };
 }
@@ -46757,7 +47395,7 @@ function loadRoutingSources(options) {
   const projectRoot = discoverKxmProjectRoot(options.cwd);
   const reads = [];
   if (options.file !== void 0) {
-    reads.push(readJsonlSource("file", resolve30(options.cwd, options.file)));
+    reads.push(readJsonlSource("file", resolve29(options.cwd, options.file)));
   } else {
     if (projectRoot !== void 0) reads.push(readEngineRoutingRecords(kxmProjectRunEventsPath(projectRoot, options.env)));
     reads.push(readJsonlSource("telemetry", telemetryPath(options.logsDir)));
@@ -46788,8 +47426,8 @@ function loadRoutingSources(options) {
 
 // plugins/kxm/src/modes.ts
 var import_yaml17 = __toESM(require_dist(), 1);
-import { existsSync as existsSync36, readFileSync as readFileSync35 } from "node:fs";
-import { join as join45 } from "node:path";
+import { existsSync as existsSync37, readFileSync as readFileSync36 } from "node:fs";
+import { join as join46 } from "node:path";
 var DEFAULT_MODES_CONFIG = Object.freeze({
   schema: "kxm.modes.v1",
   majorModes: {
@@ -46852,12 +47490,12 @@ function loadModesConfig(projectRoot) {
   if (!projectRoot) {
     return DEFAULT_MODES_CONFIG;
   }
-  const modesPath = join45(projectRoot, ".kxm", "modes.yaml");
-  if (!existsSync36(modesPath)) {
+  const modesPath = join46(projectRoot, ".kxm", "modes.yaml");
+  if (!existsSync37(modesPath)) {
     return DEFAULT_MODES_CONFIG;
   }
   try {
-    const raw = readFileSync35(modesPath, "utf8");
+    const raw = readFileSync36(modesPath, "utf8");
     const parsed = (0, import_yaml17.parse)(raw);
     if (parsed && parsed.schema === "kxm.modes.v1" && parsed.majorModes) {
       return {
@@ -46943,11 +47581,11 @@ function calculatePromptFootprint(resolved, projectRoot = process.cwd(), catalog
     estimatedTokens: estimateTokens(baseSystemPromptChars)
   });
   for (const relPath of resolved.contextFiles) {
-    const fullPath = join45(projectRoot, relPath);
+    const fullPath = join46(projectRoot, relPath);
     let chars = 0;
-    if (existsSync36(fullPath)) {
+    if (existsSync37(fullPath)) {
       try {
-        chars = readFileSync35(fullPath, "utf8").length;
+        chars = readFileSync36(fullPath, "utf8").length;
       } catch {
         chars = 0;
       }
@@ -47079,9 +47717,9 @@ ${divider}
 
 // plugins/kxm/src/ssh-remote.ts
 import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync37, mkdirSync as mkdirSync29, readFileSync as readFileSync36, readdirSync as readdirSync13, rmSync as rmSync12, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync38, mkdirSync as mkdirSync29, readFileSync as readFileSync37, readdirSync as readdirSync13, rmSync as rmSync12, statSync as statSync5 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { join as join46, resolve as resolve31 } from "node:path";
+import { join as join47, resolve as resolve30 } from "node:path";
 var MAX_SSH_OUTPUT_BYTES = 50 * 1024;
 var MAX_SSH_OUTPUT_LINES = 2e3;
 var DEFAULT_SOCKET_DIR = ".kxm/run/ssh-sockets";
@@ -47107,12 +47745,12 @@ function truncateSshOutput(raw) {
   return { text, truncated };
 }
 function parseSshConfig(configPath) {
-  const targetPath = configPath ?? join46(homedir8(), ".ssh", "config");
-  if (!existsSync37(targetPath)) {
+  const targetPath = configPath ?? join47(homedir8(), ".ssh", "config");
+  if (!existsSync38(targetPath)) {
     return [];
   }
   try {
-    const content = readFileSync36(targetPath, "utf-8");
+    const content = readFileSync37(targetPath, "utf-8");
     const lines = content.split("\n");
     const hosts = [];
     let currentHosts = [];
@@ -47189,15 +47827,15 @@ function resolveSshHostG(host, execFn = spawnSync7) {
   }
 }
 function ensureSocketDir(socketDir = DEFAULT_SOCKET_DIR) {
-  const resolved = resolve31(socketDir);
-  if (!existsSync37(resolved)) {
+  const resolved = resolve30(socketDir);
+  if (!existsSync38(resolved)) {
     mkdirSync29(resolved, { recursive: true, mode: 448 });
   }
   return resolved;
 }
 function buildSshArgs(options) {
   const socketDir = ensureSocketDir(options.socketDir ?? DEFAULT_SOCKET_DIR);
-  const controlPath = join46(socketDir, "%C");
+  const controlPath = join47(socketDir, "%C");
   const persist = options.controlPersist ?? DEFAULT_CONTROL_PERSIST;
   const args = [
     "-o",
@@ -47222,7 +47860,7 @@ function buildSshArgs(options) {
 }
 function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync7) {
   const resolvedDir = ensureSocketDir(socketDir);
-  const controlPath = join46(resolvedDir, "%C");
+  const controlPath = join47(resolvedDir, "%C");
   try {
     const result = execFn("ssh", ["-O", "check", "-o", `ControlPath=${controlPath}`, host], {
       encoding: "utf-8"
@@ -47234,7 +47872,7 @@ function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawn
 }
 function closeControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync7) {
   const resolvedDir = ensureSocketDir(socketDir);
-  const controlPath = join46(resolvedDir, "%C");
+  const controlPath = join47(resolvedDir, "%C");
   try {
     const result = execFn("ssh", ["-O", "stop", "-o", `ControlPath=${controlPath}`, host], {
       encoding: "utf-8"
@@ -47679,9 +48317,9 @@ complete -c kxm -n "__fish_seen_subcommand_from goal" -a "create list get"
 }
 
 // plugins/kxm/src/completion-install.ts
-import { existsSync as existsSync38, mkdirSync as mkdirSync30, readFileSync as readFileSync37, writeFileSync as writeFileSync26 } from "node:fs";
+import { existsSync as existsSync39, mkdirSync as mkdirSync30, readFileSync as readFileSync38, writeFileSync as writeFileSync26 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { basename as basename9, delimiter, dirname as dirname24, isAbsolute as isAbsolute10, join as join47, resolve as resolve32 } from "node:path";
+import { basename as basename9, delimiter, dirname as dirname23, isAbsolute as isAbsolute10, join as join48, resolve as resolve31 } from "node:path";
 var COMPLETION_MARKER = "# kxm completion";
 var PATH_MARKER = "# kxm path";
 function detectShell(env = process.env, platform = process.platform) {
@@ -47697,31 +48335,31 @@ function effectiveHome(options) {
   const env = options.env ?? process.env;
   if (options.homeDir) return options.homeDir;
   const envHome = env.HOME?.trim() ?? env.USERPROFILE?.trim();
-  return envHome && envHome.length > 0 ? resolve32(envHome) : homedir9();
+  return envHome && envHome.length > 0 ? resolve31(envHome) : homedir9();
 }
 function completionScriptPath(shell, options = {}) {
   const env = options.env ?? process.env;
   const explicit = options.configDir ?? env.KXM_USER_CONFIG_DIR?.trim();
-  const base = explicit && explicit.length > 0 ? resolve32(explicit) : resolve32(effectiveHome(options), ".config", "kxm");
-  return join47(base, "completions", `kxm.${shell}`);
+  const base = explicit && explicit.length > 0 ? resolve31(explicit) : resolve31(effectiveHome(options), ".config", "kxm");
+  return join48(base, "completions", `kxm.${shell}`);
 }
 function bashRcCandidate(options) {
   const home = effectiveHome(options);
-  const candidates = [join47(home, ".bashrc"), join47(home, ".bash_profile")];
-  const existing = candidates.find((candidate) => existsSync38(candidate));
+  const candidates = [join48(home, ".bashrc"), join48(home, ".bash_profile")];
+  const existing = candidates.find((candidate) => existsSync39(candidate));
   return existing ?? candidates[0];
 }
 function zshRcCandidate(options) {
   const env = options.env ?? process.env;
   const home = effectiveHome(options);
-  if (env.ZDOTDIR?.trim()) return join47(resolve32(env.ZDOTDIR.trim()), ".zshrc");
-  return join47(home, ".zshrc");
+  if (env.ZDOTDIR?.trim()) return join48(resolve31(env.ZDOTDIR.trim()), ".zshrc");
+  return join48(home, ".zshrc");
 }
 function fishCompletionTarget(shell, options) {
   const env = options.env ?? process.env;
   const home = effectiveHome(options);
-  if (env.XDG_CONFIG_HOME?.trim()) return join47(resolve32(env.XDG_CONFIG_HOME.trim()), "fish", "completions", "kxm.fish");
-  return join47(home, ".config", "fish", "completions", "kxm.fish");
+  if (env.XDG_CONFIG_HOME?.trim()) return join48(resolve31(env.XDG_CONFIG_HOME.trim()), "fish", "completions", "kxm.fish");
+  return join48(home, ".config", "fish", "completions", "kxm.fish");
 }
 function completionRcTarget(shell, options = {}) {
   if (shell === "fish") {
@@ -47753,16 +48391,16 @@ function installShellCompletion(shellInput, options = {}) {
   const scriptPath = completionScriptPath(shell, options);
   const { rcFile } = completionRcTarget(shell, options);
   const script = generateShellCompletion(shell);
-  const existingScript = existsSync38(scriptPath);
-  const existingScriptMatches = existingScript && readFileSync37(scriptPath, "utf8") === script;
+  const existingScript = existsSync39(scriptPath);
+  const existingScriptMatches = existingScript && readFileSync38(scriptPath, "utf8") === script;
   let rcModified = false;
   let alreadyInstalled = false;
   if (shell === "fish") {
     const fishTarget = fishCompletionTarget(shell, options);
-    const fishInstalled = existsSync38(fishTarget) && readFileSync37(fishTarget, "utf8") === script;
+    const fishInstalled = existsSync39(fishTarget) && readFileSync38(fishTarget, "utf8") === script;
     alreadyInstalled = fishInstalled;
     if (!options.dryRun && (!fishInstalled || options.overwrite)) {
-      mkdirSync30(resolve32(fishTarget, ".."), { recursive: true });
+      mkdirSync30(resolve31(fishTarget, ".."), { recursive: true });
       writeFileSync26(fishTarget, script, { encoding: "utf8" });
     }
     return {
@@ -47776,12 +48414,12 @@ function installShellCompletion(shellInput, options = {}) {
   }
   if (rcFile) {
     const line = sourceLine(shell, scriptPath);
-    const rcContent = existsSync38(rcFile) ? readFileSync37(rcFile, "utf8") : "";
+    const rcContent = existsSync39(rcFile) ? readFileSync38(rcFile, "utf8") : "";
     alreadyInstalled = rcContent.includes(line) || rcContent.includes(`${COMPLETION_MARKER}`);
   }
   if (!options.dryRun) {
     if (!existingScriptMatches || options.overwrite) {
-      mkdirSync30(resolve32(scriptPath, ".."), { recursive: true });
+      mkdirSync30(resolve31(scriptPath, ".."), { recursive: true });
       writeFileSync26(scriptPath, script, { encoding: "utf8" });
     }
     if (rcFile && !alreadyInstalled) {
@@ -47791,8 +48429,8 @@ function installShellCompletion(shellInput, options = {}) {
 ${marker}
 ${line}
 `;
-      mkdirSync30(resolve32(rcFile, ".."), { recursive: true });
-      writeFileSync26(rcFile, (existsSync38(rcFile) ? readFileSync37(rcFile, "utf8") : "") + stanza, { encoding: "utf8" });
+      mkdirSync30(resolve31(rcFile, ".."), { recursive: true });
+      writeFileSync26(rcFile, (existsSync39(rcFile) ? readFileSync38(rcFile, "utf8") : "") + stanza, { encoding: "utf8" });
       rcModified = true;
     }
   }
@@ -47808,14 +48446,14 @@ ${line}
 function kxmBinDir(env = process.env) {
   const argv1 = env.KXM_ENTRY ?? process.argv[1];
   if (argv1 && isAbsolute10(argv1)) {
-    const dir = dirname24(argv1);
-    if (existsSync38(join47(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
+    const dir = dirname23(argv1);
+    if (existsSync39(join48(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
   }
   const pathEnv = env.PATH ?? "";
   for (const part of pathEnv.split(delimiter)) {
     if (!part) continue;
-    const candidate = resolve32(part, process.platform === "win32" ? "kxm.cmd" : "kxm");
-    if (existsSync38(candidate)) return resolve32(part);
+    const candidate = resolve31(part, process.platform === "win32" ? "kxm.cmd" : "kxm");
+    if (existsSync39(candidate)) return resolve31(part);
   }
   return void 0;
 }
@@ -47833,10 +48471,10 @@ function installPathEntry(shellInput, options = {}) {
   }
   const { rcFile } = completionRcTarget(shell, options);
   const line = pathLine(binDir);
-  const rcContent = existsSync38(rcFile ?? "") ? readFileSync37(rcFile, "utf8") : "";
+  const rcContent = existsSync39(rcFile ?? "") ? readFileSync38(rcFile, "utf8") : "";
   const alreadyInstalled = rcContent.includes(binDir) || (options.env?.PATH ?? process.env.PATH ?? "").split(delimiter).includes(binDir);
   if (!options.dryRun && rcFile && !alreadyInstalled) {
-    mkdirSync30(dirname24(rcFile), { recursive: true });
+    mkdirSync30(dirname23(rcFile), { recursive: true });
     writeFileSync26(rcFile, rcContent + `
 ${PATH_MARKER}
 ${line}
@@ -47847,8 +48485,8 @@ ${line}
 
 // plugins/kxm/src/init-guide-setup.ts
 var import_yaml18 = __toESM(require_dist(), 1);
-import { existsSync as existsSync39, mkdirSync as mkdirSync31, writeFileSync as writeFileSync27 } from "node:fs";
-import { dirname as dirname25, join as join48 } from "node:path";
+import { existsSync as existsSync40, mkdirSync as mkdirSync31, writeFileSync as writeFileSync27 } from "node:fs";
+import { dirname as dirname24, join as join49 } from "node:path";
 var ADMITTED_GUIDE_BINDINGS = Object.freeze({
   "anthropic/claude-fable-5.1": { harness: "claude", provider: "anthropic", model: "fable" },
   "anthropic/fable": { harness: "claude", provider: "anthropic", model: "fable" },
@@ -48239,13 +48877,13 @@ function renderGuideSetupFiles(projectRoot, plan) {
     const stage = roleStages.get(role);
     if (!stage) continue;
     files.push({
-      path: join48(projectRoot, ".kxm", "agents", `${role}.yaml`),
+      path: join49(projectRoot, ".kxm", "agents", `${role}.yaml`),
       content: (0, import_yaml18.stringify)(agentDocument(role, stage, binding))
     });
   }
   for (const workflow of plan.workflows) {
     files.push({
-      path: join48(projectRoot, ".kxm", "workflows", `${workflow.slug}.yaml`),
+      path: join49(projectRoot, ".kxm", "workflows", `${workflow.slug}.yaml`),
       content: (0, import_yaml18.stringify)(workflowDocument(workflow))
     });
   }
@@ -48262,8 +48900,8 @@ function mergeGuideRouteAdmission(projectRoot, plan) {
   }
   if (added.length === 0) return added;
   policy.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const path4 = join48(projectRoot, ".kxm", "routes.yaml");
-  mkdirSync31(dirname25(path4), { recursive: true });
+  const path4 = join49(projectRoot, ".kxm", "routes.yaml");
+  mkdirSync31(dirname24(path4), { recursive: true });
   writeFileSync27(path4, (0, import_yaml18.stringify)(policy), "utf8");
   return added;
 }
@@ -48271,11 +48909,11 @@ function writeGuideSetupFiles(files) {
   const written = [];
   const existed = [];
   for (const file of files) {
-    if (existsSync39(file.path)) {
+    if (existsSync40(file.path)) {
       existed.push(file.path);
       continue;
     }
-    mkdirSync31(dirname25(file.path), { recursive: true });
+    mkdirSync31(dirname24(file.path), { recursive: true });
     writeFileSync27(file.path, file.content, "utf8");
     written.push(file.path);
   }
@@ -48339,7 +48977,7 @@ function applyKxmPackageUpdate(runtime, notice) {
       detail: `release v${notice.latest} has no sha256 digest for ${name}; refusing to install`
     };
   }
-  const releaseDir = mkdtempSync3(join49(tmpdir2(), "kxm-pkg-update-"));
+  const releaseDir = mkdtempSync3(join50(tmpdir2(), "kxm-pkg-update-"));
   try {
     const planned = planKxmPackageUpdate(notice.source, notice.latest, releaseDir, notice.asset);
     if (runtime.dryRun) {
@@ -48348,7 +48986,7 @@ function applyKxmPackageUpdate(runtime, notice) {
     for (const step of planned) {
       if (step.kind === "verify") {
         if (!verifyReleaseAssetDigest(step.path, step.sha256)) {
-          const actual = existsSync40(step.path) ? createHash16("sha256").update(readFileSync38(step.path)).digest("hex") : "missing";
+          const actual = existsSync41(step.path) ? createHash17("sha256").update(readFileSync39(step.path)).digest("hex") : "missing";
           return {
             ok: false,
             error: "release_digest_mismatch",
@@ -48625,13 +49263,27 @@ async function cmdValidate(runtime, fileFlag) {
     return 2;
   }
   const selectedFile = explicitFile || configuredFile;
-  const file = selectedFile ? resolve33(runtime.cwd, selectedFile) : void 0;
-  if (file && !existsSync40(file)) {
+  const file = selectedFile ? resolve32(runtime.cwd, selectedFile) : void 0;
+  if (file && !existsSync41(file)) {
     printWorker(runtime, worker, { ok: false, command: "validate", error: "file_not_found", file }, `workflow file not found: ${file}`);
     return 1;
   }
   try {
-    const raw = file ? readFileSync38(file, "utf8") : inline;
+    const raw = file ? readFileSync39(file, "utf8") : inline;
+    if (explicitFile && file && !raw.trimStart().startsWith("[")) {
+      const value = parseRestrictedYaml2(raw, file);
+      const issues = new KxmSchemaRegistry().validate("workflow", value, file);
+      if (issues.length > 0) throw new KxmConfigError(issues);
+      const id = basename10(file, extname3(file));
+      compileKxmWorkflow({ id, value, logicalPath: file });
+      printWorker(
+        runtime,
+        worker,
+        { ok: true, command: "validate", source: "file", file, workflows: [{ id, schema: value.schema }], warnings: [] },
+        `validated local workflow ${id} (schema and transitions); kxm init validates project references`
+      );
+      return 0;
+    }
     const warnings = [];
     const definitions = parseWorkflowDefinitions(raw, runtime.env, (message) => warnings.push(message));
     const secretEnvs = definitions.map((definition) => ({
@@ -48656,7 +49308,7 @@ async function cmdValidate(runtime, fileFlag) {
 }
 async function cmdArtifactsExist(runtime, pathFlag) {
   const worker = gateOf(runtime, "artifacts-exist");
-  const checked = verifyArtifactExists(runtime.dirs.assets, resolve33(runtime.cwd, pathFlag));
+  const checked = verifyArtifactExists(runtime.dirs.assets, resolve32(runtime.cwd, pathFlag));
   if (!checked.ok) {
     printWorker(
       runtime,
@@ -48712,7 +49364,7 @@ async function cmdImprove(runtime, options = {}) {
     print(runtime.io, runtime.json, { ok: false, command: "improve", error: "config_invalid", detail: message }, `config_invalid: ${message}`);
     return 1;
   }
-  const candidatesDir = options.outDir ? resolve33(runtime.cwd, options.outDir) : join49(root, ".kxm", "candidates");
+  const candidatesDir = options.outDir ? resolve32(runtime.cwd, options.outDir) : join50(root, ".kxm", "candidates");
   const report2 = buildImprovementReport(loaded.records, {
     candidatesDir,
     projectRoot: root,
@@ -48721,7 +49373,7 @@ async function cmdImprove(runtime, options = {}) {
     autoThreshold: config.improvement.autoThreshold,
     halfLifeDays: config.improvement.telemetryHalfLifeDays
   });
-  const reportDir = join49(runtime.dirs.assets, "improvements");
+  const reportDir = join50(runtime.dirs.assets, "improvements");
   const reportPath = writeImprovementReport(reportDir, report2, runtime.dryRun);
   const text = [
     "Sources:",
@@ -48865,9 +49517,9 @@ async function maybeOfferCompletionInstall(runtime) {
   if (!pathNeeded) {
     const scriptPath = completionScriptPath(shell, { env: runtime.env, configDir: runtime.env.KXM_USER_CONFIG_DIR });
     const { rcFile } = completionRcTarget(shell, { env: runtime.env });
-    if (rcFile && existsSync40(rcFile)) {
+    if (rcFile && existsSync41(rcFile)) {
       try {
-        if (readFileSync38(rcFile, "utf8").includes(scriptPath)) return;
+        if (readFileSync39(rcFile, "utf8").includes(scriptPath)) return;
       } catch {
       }
     }
@@ -49030,7 +49682,7 @@ async function cmdRoutingReport(runtime, options) {
   let catalog;
   if (includeEquivalentListCost) {
     try {
-      const pricesPath = options.prices ? resolve33(runtime.cwd, options.prices) : join49(runtime.dirs.workspace, "prices.yaml");
+      const pricesPath = options.prices ? resolve32(runtime.cwd, options.prices) : join50(runtime.dirs.workspace, "prices.yaml");
       catalog = loadPriceCatalog(pricesPath);
     } catch {
     }
@@ -49414,7 +50066,7 @@ function createProgram(ctx, result) {
   addGlobalOptions(program2.command("restore <manifest>").description("Restore this project's SQLite stores from a verified backup manifest; refuses while the Runtime or hub is running")).option("--all-projects", "Also restore the shared Runtime registry and other projects' event stores the backup holds").action(async function restoreAction(manifest, options) {
     result.code = await cmdRestore(runtimeFrom(ctx, this), manifest, options);
   });
-  addGlobalOptions(program2.command("run").description("Create a KXM run (offline-first; kxm runs drive <runId> --simulated executes it model-free)").argument("[workflow]", "Workflow id to run").argument("[prompt...]", "Run prompt (events keep its hash; the full text is kept in a local 0600 sidecar file)").action(async function runAction(workflow2, promptParts) {
+  addGlobalOptions(program2.command("run").description("Create a KXM run without executing steps; follow its prerequisites, then kxm runs drive <runId> --wait").argument("[workflow]", "Workflow id to run").argument("[prompt...]", "Run prompt (events keep its hash; the full text is kept in a local 0600 sidecar file)").action(async function runAction(workflow2, promptParts) {
     result.code = await cmdKxmRun(runtimeFrom(ctx, this), workflow2, promptParts);
   }));
   const runCmd = addGlobalOptions(program2.command("runs").description("Inspect KXM runs"));
@@ -49879,7 +50531,7 @@ async function runCli(argv, env = process.env, io = { stdout: (text) => process.
     throw error;
   }
 }
-if (process.argv[1] && resolve34(process.argv[1]) === fileURLToPath4(import.meta.url)) {
+if (process.argv[1] && resolve33(process.argv[1]) === fileURLToPath4(import.meta.url)) {
   const code = await runCli(process.argv.slice(2));
   process.exitCode = code;
 }