@kynver-app/runtime 0.1.39 → 0.1.47

package/dist/index.js

@@ -35,16 +35,43 @@ function handleCliVersionFlag(argv, moduleUrl = import.meta.url, binName) {
 }
 
 // src/dispatch.ts
-import path16 from "node:path";
+import path17 from "node:path";
 
 // src/config.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import path3 from "node:path";
+
+// src/path-values.ts
 import { homedir } from "node:os";
-import path2 from "node:path";
+import path from "node:path";
+function expandHomePath(value) {
+  if (value === "~") return homedir();
+  if (value.startsWith("~/") || value.startsWith("~\\")) {
+    return path.join(homedir(), value.slice(2));
+  }
+  return value;
+}
+function resolveUserPath(value) {
+  return path.resolve(expandHomePath(value));
+}
+function redactHomePath(value) {
+  const expanded = expandHomePath(value);
+  const resolved = path.resolve(expanded);
+  const home = path.resolve(homedir());
+  if (resolved === home) return "~";
+  if (resolved.startsWith(`${home}${path.sep}`)) {
+    return `~/${path.relative(home, resolved).split(path.sep).join("/")}`;
+  }
+  return resolved.replace(/^\/home\/[^/]+(?=\/|$)/, "~").replace(/^\/Users\/[^/]+(?=\/|$)/, "~");
+}
+function displayUserPath(value) {
+  return redactHomePath(value);
+}
 
 // src/util.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, readdirSync, statSync, writeFileSync } from "node:fs";
-import path from "node:path";
+import path2 from "node:path";
 function fail(message) {
   console.error(message);
   process.exit(1);
@@ -73,7 +100,7 @@ function readJson(file, fallback) {
   }
 }
 function writeJson(file, value) {
-  mkdirSync(path.dirname(file), { recursive: true });
+  mkdirSync(path2.dirname(file), { recursive: true });
   writeFileSync(file, `${JSON.stringify(value, null, 2)}
 `);
 }
@@ -109,7 +136,7 @@ function tailFile(file, lines) {
   return data.split("\n").slice(-lines).join("\n");
 }
 function readMaybeFile(file) {
-  return file ? readFileSync2(path.resolve(file), "utf8") : "";
+  return file ? readFileSync2(path2.resolve(file), "utf8") : "";
 }
 function listRunIds(runsDir) {
   if (!existsSync2(runsDir)) return [];
@@ -152,9 +179,9 @@ function secsAgo(ms) {
 }
 
 // src/config.ts
-var CONFIG_DIR = path2.join(homedir(), ".kynver");
-var CONFIG_FILE = path2.join(CONFIG_DIR, "config.json");
-var CREDENTIALS_FILE = path2.join(CONFIG_DIR, "credentials");
+var CONFIG_DIR = path3.join(homedir2(), ".kynver");
+var CONFIG_FILE = path3.join(CONFIG_DIR, "config.json");
+var CREDENTIALS_FILE = path3.join(CONFIG_DIR, "credentials");
 function loadUserConfig() {
   if (!existsSync3(CONFIG_FILE)) return {};
   try {
@@ -165,9 +192,33 @@ function loadUserConfig() {
 }
 function saveUserConfig(config) {
   mkdirSync2(CONFIG_DIR, { recursive: true });
-  writeFileSync2(CONFIG_FILE, `${JSON.stringify(config, null, 2)}
+  writeFileSync2(CONFIG_FILE, `${JSON.stringify(normalizeConfigPaths(config), null, 2)}
 `, { mode: 384 });
 }
+function normalizeConfigPaths(config) {
+  return {
+    ...config,
+    ...config.harnessRoot?.trim() ? { harnessRoot: redactHomePath(config.harnessRoot.trim()) } : {},
+    ...config.defaultRepo?.trim() ? { defaultRepo: redactHomePath(config.defaultRepo.trim()) } : {}
+  };
+}
+function presentUserConfig(config) {
+  return normalizeConfigPaths(config);
+}
+function inferSetupFields(existing, args) {
+  const creds = loadCredentialsFile();
+  const apiBaseUrl = (typeof args.apiBaseUrl === "string" ? args.apiBaseUrl : void 0) || existing.apiBaseUrl?.trim() || process.env.KYNVER_API_URL?.trim() || process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim();
+  const agentOsId = (typeof args.agentOsId === "string" ? args.agentOsId : void 0) || existing.agentOsId?.trim() || process.env.KYNVER_AGENT_OS_ID?.trim() || (creds.runnerToken?.trim().startsWith("krc1.") ? creds.runnerTokenAgentOsId?.trim() : void 0);
+  const defaultRepo = (typeof args.repo === "string" ? args.repo : void 0) || existing.defaultRepo?.trim() || process.env.KYNVER_DEFAULT_REPO?.trim() || process.env.KYNVER_HARNESS_REPO?.trim();
+  const harnessRoot = (typeof args.harnessRoot === "string" ? args.harnessRoot : void 0) || existing.harnessRoot?.trim() || process.env.KYNVER_HARNESS_ROOT?.trim() || process.env.OPUS_HARNESS_ROOT?.trim();
+  return {
+    ...apiBaseUrl ? { apiBaseUrl: trimTrailingSlash(apiBaseUrl) } : {},
+    ...agentOsId ? { agentOsId } : {},
+    ...defaultRepo ? { defaultRepo } : {},
+    ...harnessRoot ? { harnessRoot } : {},
+    ...typeof args.agentOsSlug === "string" ? { agentOsSlug: args.agentOsSlug } : existing.agentOsSlug ? { agentOsSlug: existing.agentOsSlug } : {}
+  };
+}
 function loadCredentialsFile() {
   if (!existsSync3(CREDENTIALS_FILE)) return {};
   try {
@@ -320,7 +371,7 @@ async function mintRunnerCredential(args) {
         {
           ok: true,
           agentOsId,
-          credentialsPath: CREDENTIALS_FILE,
+          credentialsPath: displayUserPath(CREDENTIALS_FILE),
           tokenPrefix: `${token.slice(0, 12)}\u2026`,
           note: "Scoped runner token saved; callbacks use X-Kynver-Runner-Token."
         },
@@ -355,16 +406,12 @@ function parseArgs(argv) {
 async function runSetup(args) {
   const existing = loadUserConfig();
   const maxWorkersRaw = typeof args.maxWorkers === "string" ? args.maxWorkers : typeof args.maxConcurrentWorkers === "string" ? args.maxConcurrentWorkers : void 0;
-  const config = {
+  const config = normalizeConfigPaths({
     ...existing,
-    ...typeof args.apiBaseUrl === "string" ? { apiBaseUrl: args.apiBaseUrl } : {},
-    ...typeof args.agentOsSlug === "string" ? { agentOsSlug: args.agentOsSlug } : {},
-    ...typeof args.agentOsId === "string" ? { agentOsId: args.agentOsId } : {},
-    ...typeof args.repo === "string" ? { defaultRepo: args.repo } : {},
-    ...typeof args.harnessRoot === "string" ? { harnessRoot: args.harnessRoot } : {},
+    ...inferSetupFields(existing, args),
     ...maxWorkersRaw ? { maxConcurrentWorkers: Math.max(1, Math.floor(Number(maxWorkersRaw))) } : {},
     workerProvider: typeof args.provider === "string" ? args.provider : existing.workerProvider || "claude"
-  };
+  });
   saveUserConfig(config);
   let runnerCredentialNote;
   const apiKey = loadApiKey();
@@ -385,8 +432,8 @@ async function runSetup(args) {
     JSON.stringify(
       {
         ok: true,
-        configPath: CONFIG_FILE,
-        config,
+        configPath: displayUserPath(CONFIG_FILE),
+        config: presentUserConfig(config),
         note: runnerCredentialNote ?? "Set worker limit once with --max-workers N (or omit to auto-size from RAM). Run `kynver login` + `kynver runner credential` for scoped callbacks."
       },
       null,
@@ -398,7 +445,7 @@ async function runLogin(args) {
   const apiKey = typeof args.apiKey === "string" ? args.apiKey : process.env.KYNVER_API_KEY;
   if (!apiKey) failConfig("kynver login requires --api-key or KYNVER_API_KEY");
   saveApiKey(apiKey);
-  console.log(JSON.stringify({ ok: true, credentialsPath: CREDENTIALS_FILE }, null, 2));
+  console.log(JSON.stringify({ ok: true, credentialsPath: displayUserPath(CREDENTIALS_FILE) }, null, 2));
 }
 
 // src/callback-headers.ts
@@ -461,12 +508,12 @@ var DEFAULT_CRITICAL_FREE_BYTES = 15 * 1024 * 1024 * 1024;
 var DEFAULT_MAX_USED_PERCENT = 80;
 var DEFAULT_HARD_MAX_USED_PERCENT = 90;
 function observeRunnerDiskGate(input = {}) {
-  const path32 = input.diskPath?.trim() || "/";
+  const path38 = input.diskPath?.trim() || "/";
   const warnBelowBytes = input.diskFreeWarnBytes ?? DEFAULT_WARN_FREE_BYTES;
   const criticalBelowBytes = input.diskFreeCriticalBytes ?? DEFAULT_CRITICAL_FREE_BYTES;
   const maxUsedPercent = input.diskMaxUsedPercent ?? DEFAULT_MAX_USED_PERCENT;
   const hardMaxUsedPercent = input.diskHardMaxUsedPercent ?? DEFAULT_HARD_MAX_USED_PERCENT;
-  const stats = statfsSync(path32);
+  const stats = statfsSync(path38);
   const freeBytes = Number(stats.bavail) * Number(stats.bsize);
   const totalBytes = Number(stats.blocks) * Number(stats.bsize);
   const usedPercent = totalBytes > 0 ? (totalBytes - freeBytes) / totalBytes * 100 : 100;
@@ -486,7 +533,7 @@ function observeRunnerDiskGate(input = {}) {
   }
   return {
     ok,
-    path: path32,
+    path: path38,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -499,23 +546,46 @@ function observeRunnerDiskGate(input = {}) {
 }
 
 // src/resource-gate.ts
-import { readFileSync as readFileSync6 } from "node:fs";
+import os2 from "node:os";
+
+// src/bounded-build/meminfo.ts
+import { readFileSync as readFileSync4 } from "node:fs";
 import os from "node:os";
-import path5 from "node:path";
+function readMemAvailableBytes(meminfoText) {
+  if (meminfoText !== void 0) {
+    const match = meminfoText.match(/^MemAvailable:\s+(\d+)\s*kB/m);
+    if (match) return Number(match[1]) * 1024;
+    return os.freemem();
+  }
+  if (process.platform === "linux") {
+    try {
+      const meminfo = readFileSync4("/proc/meminfo", "utf8");
+      const match = meminfo.match(/^MemAvailable:\s+(\d+)\s*kB/m);
+      if (match) return Number(match[1]) * 1024;
+    } catch {
+    }
+  }
+  return os.freemem();
+}
+
+// src/resource-gate.ts
+import path6 from "node:path";
 
 // src/run-store.ts
 import { existsSync as existsSync5, readdirSync as readdirSync2 } from "node:fs";
-import path4 from "node:path";
+import path5 from "node:path";
 
 // src/paths.ts
 import { existsSync as existsSync4 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import path3 from "node:path";
-var LEGACY_ROOT = path3.join(homedir2(), ".openclaw", "harness");
+import { homedir as homedir3 } from "node:os";
+import path4 from "node:path";
+var LEGACY_ROOT = path4.join(homedir3(), ".openclaw", "harness");
 function resolveHarnessRoot() {
   const env = process.env.KYNVER_HARNESS_ROOT || process.env.OPUS_HARNESS_ROOT;
-  if (env) return path3.resolve(env);
-  const kynverRoot = path3.join(homedir2(), ".kynver", "harness");
+  if (env) return resolveUserPath(env);
+  const configured = loadUserConfig().harnessRoot?.trim();
+  if (configured) return resolveUserPath(configured);
+  const kynverRoot = path4.join(homedir3(), ".kynver", "harness");
   if (existsSync4(kynverRoot)) return kynverRoot;
   if (existsSync4(LEGACY_ROOT)) return LEGACY_ROOT;
   return kynverRoot;
@@ -524,12 +594,12 @@ function getHarnessPaths() {
   const harnessRoot = resolveHarnessRoot();
   return {
     harnessRoot,
-    runsDir: path3.join(harnessRoot, "runs"),
-    worktreesDir: path3.join(harnessRoot, "worktrees")
+    runsDir: path4.join(harnessRoot, "runs"),
+    worktreesDir: path4.join(harnessRoot, "worktrees")
   };
 }
 function runDir(runsDir, id) {
-  return path3.join(runsDir, safeSlug(id));
+  return path4.join(runsDir, safeSlug(id));
 }
 
 // src/run-store.ts
@@ -538,7 +608,7 @@ function getPaths() {
 }
 function loadRun(id) {
   const { runsDir } = getPaths();
-  return readJson(path4.join(runDir(runsDir, safeSlug(id)), "run.json"));
+  return readJson(path5.join(runDir(runsDir, safeSlug(id)), "run.json"));
 }
 function listRunRecords() {
   const { runsDir } = getPaths();
@@ -547,7 +617,7 @@ function listRunRecords() {
   for (const entry of readdirSync2(runsDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     const run = readJson(
-      path4.join(runsDir, entry.name, "run.json"),
+      path5.join(runsDir, entry.name, "run.json"),
       void 0
     );
     if (run?.id) runs.push(run);
@@ -557,16 +627,16 @@ function listRunRecords() {
 function loadWorker(runId, name) {
   const { runsDir } = getPaths();
   return readJson(
-    path4.join(runDir(runsDir, safeSlug(runId)), "workers", safeSlug(name), "worker.json")
+    path5.join(runDir(runsDir, safeSlug(runId)), "workers", safeSlug(name), "worker.json")
   );
 }
 function saveRun(run) {
   const { runsDir } = getPaths();
-  writeJson(path4.join(runDir(runsDir, run.id), "run.json"), run);
+  writeJson(path5.join(runDir(runsDir, run.id), "run.json"), run);
 }
 function saveWorker(runId, worker) {
   const { runsDir } = getPaths();
-  writeJson(path4.join(runDir(runsDir, runId), "workers", worker.name, "worker.json"), worker);
+  writeJson(path5.join(runDir(runsDir, runId), "workers", worker.name, "worker.json"), worker);
 }
 function runDirectory(id) {
   const { runsDir } = getPaths();
@@ -574,7 +644,7 @@ function runDirectory(id) {
 }
 
 // src/heartbeat.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "node:fs";
 var HEARTBEAT_FUTURE_SKEW_MS = 6e4;
 function isTerminalHeartbeatPhase(phase) {
   return phase === "complete";
@@ -596,7 +666,7 @@ function parseHeartbeat(file) {
   if (!existsSync6(file)) return result;
   const maxFutureMs = Date.now() + HEARTBEAT_FUTURE_SKEW_MS;
   const clampedTo = new Date(maxFutureMs).toISOString();
-  const lines = readFileSync4(file, "utf8").split("\n").filter(Boolean);
+  const lines = readFileSync5(file, "utf8").split("\n").filter(Boolean);
   for (const line of lines) {
     const entry = safeJson(line);
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
@@ -623,7 +693,155 @@ function parseHeartbeat(file) {
 }
 
 // src/stream.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "node:fs";
+
+// src/shell-command-outcome.ts
+var NPM_AUDIT_RE = /\bnpm\s+audit\b/i;
+function tidy(text, max = 200) {
+  const one = text.replace(/\s+/g, " ").trim();
+  return one.length > max ? `${one.slice(0, max - 1)}\u2026` : one;
+}
+function extractJsonObject(text) {
+  const trimmed = text.trim();
+  if (!trimmed) return null;
+  if (trimmed.startsWith("{")) {
+    try {
+      return JSON.parse(trimmed);
+    } catch {
+    }
+  }
+  const start = trimmed.indexOf("{");
+  const end = trimmed.lastIndexOf("}");
+  if (start >= 0 && end > start) {
+    try {
+      return JSON.parse(trimmed.slice(start, end + 1));
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function summarizeNpmAuditReport(report) {
+  const meta = report.metadata;
+  if (!isRecord(meta)) return null;
+  const vuln = meta.vulnerabilities;
+  if (!isRecord(vuln)) return null;
+  const num = (key) => typeof vuln[key] === "number" ? vuln[key] : 0;
+  const summary = {
+    info: num("info"),
+    low: num("low"),
+    moderate: num("moderate"),
+    high: num("high"),
+    critical: num("critical"),
+    total: num("total")
+  };
+  if (typeof vuln.total !== "number" && !summary.critical && !summary.high && !summary.moderate && !summary.low && !summary.info) {
+    return null;
+  }
+  return summary;
+}
+function formatAuditSummaryLine(audit) {
+  const parts = [];
+  if (audit.critical) parts.push(`${audit.critical} critical`);
+  if (audit.high) parts.push(`${audit.high} high`);
+  if (audit.moderate) parts.push(`${audit.moderate} moderate`);
+  if (audit.low) parts.push(`${audit.low} low`);
+  if (audit.info) parts.push(`${audit.info} info`);
+  const breakdown = parts.length ? parts.join(", ") : "see report";
+  return `npm audit: ${audit.total} vulnerabilit${audit.total === 1 ? "y" : "ies"} (${breakdown}) \u2014 remediation required`;
+}
+function npmAuditFailureReason(report, stderr) {
+  const err = report.error;
+  if (isRecord(err)) {
+    const summary = typeof err.summary === "string" ? err.summary.trim() : "";
+    const code = typeof err.code === "string" ? err.code.trim() : "";
+    if (summary) return code ? `${code}: ${summary}` : summary;
+    if (code) return code;
+  }
+  const detail = typeof report.message === "string" ? report.message.trim() : "";
+  if (detail) return detail;
+  const errTail = stderr.trim();
+  if (errTail) return tidy(errTail.split("\n").find(Boolean) ?? errTail, 160);
+  return "npm audit failed";
+}
+function classifyNpmAuditOutcome(input) {
+  const combined = `${input.stdout}
+${input.stderr}`.trim();
+  const parsed = extractJsonObject(combined);
+  if (!parsed || !isRecord(parsed)) {
+    const tail = tidy(combined || `exit ${input.exitCode}`, 180);
+    return {
+      kind: "command_failure",
+      exitCode: input.exitCode,
+      summary: `npm audit failed (invalid or missing JSON): ${tail}`,
+      parseError: "invalid_json"
+    };
+  }
+  if (isRecord(parsed.error)) {
+    return {
+      kind: "command_failure",
+      exitCode: input.exitCode,
+      summary: `npm audit command failed: ${npmAuditFailureReason(parsed, input.stderr)}`
+    };
+  }
+  const audit = summarizeNpmAuditReport(parsed);
+  if (!audit) {
+    return {
+      kind: "command_failure",
+      exitCode: input.exitCode,
+      summary: "npm audit failed: JSON response missing vulnerability metadata",
+      parseError: "missing_metadata"
+    };
+  }
+  if (input.exitCode === 0 && audit.total === 0) {
+    return {
+      kind: "success",
+      exitCode: 0,
+      summary: "npm audit: no vulnerabilities reported",
+      audit
+    };
+  }
+  return {
+    kind: "audit_findings",
+    exitCode: input.exitCode,
+    summary: formatAuditSummaryLine(audit),
+    audit
+  };
+}
+function isNpmAuditCommand(command) {
+  return NPM_AUDIT_RE.test(command);
+}
+function classifyShellCommandOutcome(input) {
+  const stdout = input.stdout ?? "";
+  const stderr = input.stderr ?? "";
+  const interleaved = input.interleavedOutput ?? "";
+  if (isNpmAuditCommand(input.command)) {
+    const body = stdout.trim() || interleaved.trim() || stderr.trim();
+    return classifyNpmAuditOutcome({
+      exitCode: input.exitCode,
+      stdout: body,
+      stderr
+    });
+  }
+  if (input.exitCode === 0) {
+    return {
+      kind: "success",
+      exitCode: 0,
+      summary: `command succeeded (exit 0)`
+    };
+  }
+  const tail = tidy(interleaved || stdout || stderr || `exit ${input.exitCode}`, 180);
+  return {
+    kind: "command_failure",
+    exitCode: input.exitCode,
+    summary: `command failed (exit ${input.exitCode}): ${tail}`
+  };
+}
+
+// src/stream.ts
 function eventTimestampIso(event) {
   const tsMs = event.timestamp_ms;
   return event.timestamp || event.ts || (tsMs ? new Date(tsMs).toISOString() : void 0);
@@ -644,16 +862,43 @@ function recordStreamResult(result, event) {
     result.error = String(event.result || event.api_error_status || "stream result error");
   }
 }
+function shellPayloadFromCursorEvent(event) {
+  if (event.type !== "tool_call" || event.subtype !== "completed") return null;
+  const toolCall = event.tool_call && typeof event.tool_call === "object" && !Array.isArray(event.tool_call) ? event.tool_call : null;
+  const shell = toolCall?.shellToolCall;
+  if (!shell || typeof shell !== "object" || Array.isArray(shell)) return null;
+  const shellObj = shell;
+  const args = shellObj.args;
+  const command = args && typeof args === "object" && !Array.isArray(args) && typeof args.command === "string" ? String(args.command) : "";
+  const result = shellObj.result;
+  if (!result || typeof result !== "object" || Array.isArray(result)) return null;
+  const body = result.success ?? result.failure;
+  if (!body || typeof body !== "object" || Array.isArray(body)) return null;
+  const row = body;
+  const exitCode = typeof row.exitCode === "number" ? row.exitCode : 0;
+  return {
+    command,
+    exitCode,
+    stdout: typeof row.stdout === "string" ? row.stdout : "",
+    stderr: typeof row.stderr === "string" ? row.stderr : "",
+    interleaved: typeof row.interleavedOutput === "string" ? row.interleavedOutput : ""
+  };
+}
+function applyShellOutcome(parsed, outcome) {
+  if (outcome.kind === "success") return;
+  parsed.lastShellOutcome = outcome;
+}
 function parseHarnessStream(file) {
   const result = {
     firstEventAt: null,
     lastEventAt: null,
     currentTool: null,
     finalResult: null,
-    error: null
+    error: null,
+    lastShellOutcome: null
   };
   if (!existsSync7(file)) return result;
-  const lines = readFileSync5(file, "utf8").split("\n").filter(Boolean);
+  const lines = readFileSync6(file, "utf8").split("\n").filter(Boolean);
   for (const line of lines) {
     const event = safeJson(line);
     if (!event) continue;
@@ -678,6 +923,19 @@ function parseHarnessStream(file) {
       const name = cursorToolNameFromCall(toolCall);
       if (name) result.currentTool = name;
     }
+    const shell = shellPayloadFromCursorEvent(event);
+    if (shell) {
+      applyShellOutcome(
+        result,
+        classifyShellCommandOutcome({
+          command: shell.command,
+          exitCode: shell.exitCode,
+          stdout: shell.stdout,
+          stderr: shell.stderr,
+          interleavedOutput: shell.interleaved
+        })
+      );
+    }
     if (event.type === "result") {
       recordStreamResult(result, event);
     }
@@ -687,6 +945,25 @@ function parseHarnessStream(file) {
 function parseClaudeStream(file) {
   return parseHarnessStream(file);
 }
+function summarizeShellToolCallEvent(event) {
+  const shell = shellPayloadFromCursorEvent(event);
+  if (!shell) return void 0;
+  const outcome = classifyShellCommandOutcome({
+    command: shell.command,
+    exitCode: shell.exitCode,
+    stdout: shell.stdout,
+    stderr: shell.stderr,
+    interleavedOutput: shell.interleaved
+  });
+  const cmd = oneLine(shell.command).slice(0, 120);
+  if (outcome.kind === "audit_findings") {
+    return `[audit:findings] ${outcome.summary}${cmd ? ` \xB7 ${cmd}` : ""}`;
+  }
+  if (outcome.kind === "command_failure") {
+    return `[command:failed] ${outcome.summary}${cmd ? ` \xB7 ${cmd}` : ""}`;
+  }
+  return `[command:ok] exit 0${cmd ? ` \xB7 ${cmd}` : ""}`;
+}
 function summarizeEvent(event) {
   if (event.type === "system" && event.subtype) {
     return `[system:${event.subtype}] ${String(event.status || event.cwd || "")}`.trim();
@@ -719,6 +996,8 @@ function summarizeEvent(event) {
   }
   if (event.type === "tool_call") {
     const subtype = String(event.subtype || "");
+    const shellSummary = subtype === "completed" ? summarizeShellToolCallEvent(event) : void 0;
+    if (shellSummary) return shellSummary;
     const toolCall = event.tool_call && typeof event.tool_call === "object" && !Array.isArray(event.tool_call) ? event.tool_call : void 0;
     const name = cursorToolNameFromCall(toolCall) ?? "tool";
     return `[tool:${subtype}] ${name}`;
@@ -760,7 +1039,7 @@ var FAILURE_PATTERNS = [
     label: "provider authentication failed"
   }
 ];
-function tidy(errorText, max = 240) {
+function tidy2(errorText, max = 240) {
   const oneLine2 = errorText.replace(/\s+/g, " ").trim();
   return oneLine2.length > max ? `${oneLine2.slice(0, max - 1)}\u2026` : oneLine2;
 }
@@ -769,7 +1048,7 @@ function classifyExitFailure(errorText) {
   if (!text) return null;
   for (const pattern of FAILURE_PATTERNS) {
     if (pattern.test.test(text)) {
-      return { blocked: true, reason: `${pattern.label}: ${tidy(text)}` };
+      return { blocked: true, reason: `${pattern.label}: ${tidy2(text)}` };
     }
   }
   return null;
@@ -835,6 +1114,63 @@ function assessExitedWorkerSalvage(input) {
 
 // src/git.ts
 import { spawnSync } from "node:child_process";
+
+// src/worker-env.ts
+var FORBIDDEN_WORKER_ENV_KEYS = [
+  "ANTHROPIC_API_KEY",
+  "ANALYST_API_KEY",
+  "RECRUITER_API_KEY",
+  "AUTH_SECRET",
+  "NEXTAUTH_SECRET",
+  "DATABASE_URL",
+  "PRODUCTION_DATABASE_URL",
+  "REDIS_URL",
+  "GOOGLE_CLIENT_SECRET",
+  "GITHUB_CLIENT_SECRET",
+  "KYNVER_API_KEY",
+  "KYNVER_SERVICE_SECRET",
+  "KYNVER_RUNTIME_SECRET",
+  "OPENCLAW_CRON_SECRET",
+  "QSTASH_TOKEN",
+  "QSTASH_CURRENT_SIGNING_KEY",
+  "QSTASH_NEXT_SIGNING_KEY",
+  "TOOL_SECRETS_KEK",
+  "TOOL_EXECUTOR_DISPATCH_SECRET",
+  "CLOUDFLARE_API_TOKEN",
+  "STRIPE_SECRET_KEY",
+  "STRIPE_WEBHOOK_SECRET",
+  "STRIPE_IDENTITY_WEBHOOK_SECRET",
+  "VOYAGE_API_KEY",
+  "PERPLEXITY_API_KEY",
+  "FRED_API_KEY",
+  "FMP_API_KEY",
+  "CURSOR_API_KEY"
+];
+var FORBIDDEN_KEY_SET = new Set(FORBIDDEN_WORKER_ENV_KEYS);
+var FORBIDDEN_SUFFIXES = ["_SECRET", "_API_KEY"];
+function isForbiddenWorkerEnvKey(key) {
+  if (FORBIDDEN_KEY_SET.has(key)) return true;
+  return FORBIDDEN_SUFFIXES.some((suffix) => key.endsWith(suffix));
+}
+function listForbiddenWorkerEnvKeys(env) {
+  return Object.keys(env).filter(isForbiddenWorkerEnvKey).sort();
+}
+function scrubWorkerEnv(env) {
+  const next = { ...env };
+  for (const key of Object.keys(next)) {
+    if (isForbiddenWorkerEnvKey(key)) delete next[key];
+  }
+  return next;
+}
+function auditWorkerEnv(env) {
+  const forbiddenPresent = listForbiddenWorkerEnvKeys(env);
+  return { forbiddenPresent, safe: forbiddenPresent.length === 0 };
+}
+function scrubClaudeEnv(env) {
+  return scrubWorkerEnv(env);
+}
+
+// src/git.ts
 function git(cwd, args, options = {}) {
   const res = spawnSync("git", args, { cwd, encoding: "utf8" });
   if (res.status !== 0 && !options.allowFailure) {
@@ -950,11 +1286,6 @@ function unknownAncestry(base, error, head = null) {
     error
   };
 }
-function scrubClaudeEnv(env) {
-  const next = { ...env };
-  delete next.ANTHROPIC_API_KEY;
-  return next;
-}
 
 // src/landing-gate.ts
 function trimOrNull2(value) {
@@ -1304,15 +1635,7 @@ function computeAutoMaxWorkers(totalMemBytes, opts = {}) {
   return Math.min(raw, AUTO_MAX_WORKERS_CEILING);
 }
 function readAvailableMemBytes() {
-  if (process.platform === "linux") {
-    try {
-      const meminfo = readFileSync6("/proc/meminfo", "utf8");
-      const match = meminfo.match(/^MemAvailable:\s+(\d+)\s*kB/m);
-      if (match) return Number(match[1]) * 1024;
-    } catch {
-    }
-  }
-  return os.freemem();
+  return readMemAvailableBytes();
 }
 function isActiveHarnessWorker(worker) {
   const status = computeWorkerStatus(worker);
@@ -1322,7 +1645,7 @@ function countActiveWorkersForRun(run) {
   let active = 0;
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path5.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path6.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker || !isActiveHarnessWorker(worker)) continue;
@@ -1340,7 +1663,7 @@ function observeRunnerResourceGate(input) {
     input.config,
     input.configuredMaxWorkersOverride
   );
-  const totalMemBytes = input.totalMemBytes ?? os.totalmem();
+  const totalMemBytes = input.totalMemBytes ?? os2.totalmem();
   const freeMemBytes = input.freeMemBytes ?? readAvailableMemBytes();
   const activeWorkers = input.activeWorkers ?? countActiveWorkersGlobal();
   const budgetBytes = Math.max(0, Math.floor(totalMemBytes * memUtilization) - memReserveBytes);
@@ -1530,6 +1853,7 @@ var claudeProvider = {
     const model = preflight.model;
     const stdoutFd = openSync(opts.stdoutPath, "a");
     const stderrFd = openSync(opts.stderrPath, "a");
+    const stdio = ["ignore", stdoutFd, stderrFd];
     const child = spawn(
       "claude",
       [
@@ -1547,8 +1871,8 @@ var claudeProvider = {
       hiddenSpawnOptions({
         cwd: opts.worktreePath,
         detached: true,
-        stdio: ["ignore", stdoutFd, stderrFd],
-        env: scrubClaudeEnv(process.env)
+        stdio,
+        env: scrubWorkerEnv(process.env)
       })
     );
     closeSync(stdoutFd);
@@ -1706,10 +2030,10 @@ function readHarnessRetryLimits() {
 }
 
 // src/lease-renewal.ts
-import path6 from "node:path";
+import path7 from "node:path";
 function workerRecord(runId, name) {
   return readJson(
-    path6.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
+    path7.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
     void 0
   );
 }
@@ -1776,7 +2100,7 @@ function hasLiveWorkerForTask(runId, taskId) {
 
 // src/supervisor.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync3 } from "node:fs";
-import path12 from "node:path";
+import path13 from "node:path";
 
 // src/prompt.ts
 function buildPrompt(input) {
@@ -1795,6 +2119,16 @@ function buildPrompt(input) {
     "- After implementation: wait for report_reviewer then deep_reviewer confirmation (via MCP/session agents) before follow-up rows close.",
     input.planId ? `Active planId: ${input.planId}${input.taskId ? ` \xB7 taskId: ${input.taskId}` : ""}` : "No planId on this worker \u2014 still emit progress when you touch plan-scoped work."
   ];
+  const mergeGateLines = compact ? [
+    "Merge-gate cost control: run `node scripts/verify-pr-local.mjs --emit-json` and `node scripts/collect-pr-vercel-evidence.mjs --pr <url> --emit-json` (trusts GitHub Vercel status for dashboard target_url; never passes dashboard URLs to `vercel inspect`) before any GitHub Actions run; request merge-gate only via POST pr-merge-gate/request-run (one Actions run per PR head unless human approves extra)."
+  ] : [
+    "GitHub Actions merge-gate cost control (Kynver/Hermes PRs):",
+    "- Prefer local cached package verification (`node scripts/verify-pr-local.mjs --emit-json`) and Vercel preview evidence before GitHub Actions.",
+    "- Do not push empty commits to re-trigger CI. One budgeted merge-gate Actions run per PR candidate (head SHA) unless a human approves extra.",
+    "- Record evidence: POST `/api/agent-os/by-id/<agentOsId>/pr-merge-gate/refresh` with prUrl + local/vercel payloads.",
+    "- Request the final Actions run only when local + Vercel are green: POST `.../pr-merge-gate/request-run` (applies `merge-gate` label).",
+    "- Empty failed Actions jobs (no runner/steps/logs) are infra/quota \u2014 do not enter repair loops; escalate to operator."
+  ];
   const planArtifactLines = compact ? [
     "Plan artifacts: when authoring/revising docs/superpowers/plans/, open a GitHub PR early and iterate from that PR branch; do not leave the canonical plan only in the harness worktree."
   ] : [
@@ -1816,10 +2150,14 @@ function buildPrompt(input) {
     "Completion handoff (required): before you stop, ensure the harness records a final result \u2014 summarize outcome in your last message and append a heartbeat line with phase `complete`. If you leave uncommitted changes or committed work without a PR, the orchestrator blocks completion until a GitHub PR exists (or you discard/commit cleanly). Exiting with only dirty files and no PR routes to salvage review, not production review.",
     "PR-ready handoff: for substantial implementation work, commit, push, and open a GitHub PR (draft OK) on your branch before finishing \u2014 or rely on the harness to run `gh pr create` at completion when `gh` is authenticated.",
     "Worker resource guard: do not run full monorepo verification (`npm run typecheck`, `npm run build`, or equivalent) from this worker lane unless an operator explicitly requests it. Use targeted checks for touched paths and rely on CI/operator lanes for heavy gates.",
+    "npm publish boundary: do not run `npm publish`, do not republish `@kynver-app/*` packages, and do not block on an operator to publish. When you need newer runtime code than npm, use this repo checkout (`npm run kynver:build`, `npm run kynver`) and record evidence: packages/kynver-runtime/package.json version + git ref in your completion report.",
     "If verification fails (including OOM), append a heartbeat line immediately with the last command, failure reason, dirty-file status, commit/PR handoff state, and next action so recovery does not require log spelunking.",
+    "Landing-wrapper cleanup on a git ref: use `node scripts/agent-os-land-pr-cleanup-verify.mjs --ref origin/main` (JSON, exit 0). Do not use `git show <ref>:scripts/agent-os-land-pr.mjs | rg \u2026` \u2014 ripgrep exit 1 when markers are absent is reported as a failed command in Telegram/status tooling.",
     "",
     ...progressLines,
     "",
+    ...mergeGateLines,
+    "",
     ...planArtifactLines,
     "",
     ...input.personaMarkdown?.trim() ? [input.personaMarkdown.trim(), ""] : [],
@@ -1832,11 +2170,11 @@ function buildPrompt(input) {
 // src/providers/cursor.ts
 import { closeSync as closeSync2, existsSync as existsSync9, openSync as openSync2 } from "node:fs";
 import { spawn as spawn2 } from "node:child_process";
-import path8 from "node:path";
+import path9 from "node:path";
 
 // src/providers/cursor-windows.ts
 import { existsSync as existsSync8, readdirSync as readdirSync3 } from "node:fs";
-import path7 from "node:path";
+import path8 from "node:path";
 var CURSOR_VERSION_DIR = /^\d{4}\.\d{1,2}\.\d{1,2}-[a-f0-9]+$/i;
 function parseCursorVersionSortKey(versionName) {
   const datePart = versionName.split("-")[0];
@@ -1847,7 +2185,7 @@ function parseCursorVersionSortKey(versionName) {
   return Number(`${year}${month.padStart(2, "0")}${day.padStart(2, "0")}`);
 }
 function pickLatestCursorVersionDir(agentRoot) {
-  const versionsRoot = path7.join(agentRoot, "versions");
+  const versionsRoot = path8.join(agentRoot, "versions");
   if (!existsSync8(versionsRoot)) return null;
   let bestDir = null;
   let bestKey = -1;
@@ -1856,21 +2194,21 @@ function pickLatestCursorVersionDir(agentRoot) {
     const key = parseCursorVersionSortKey(entry.name);
     if (key == null || key <= bestKey) continue;
     bestKey = key;
-    bestDir = path7.join(versionsRoot, entry.name);
+    bestDir = path8.join(versionsRoot, entry.name);
   }
   return bestDir;
 }
 function resolveWindowsCursorBundled(agentRoot) {
-  const root = agentRoot?.trim() || path7.join(process.env.LOCALAPPDATA || "", "cursor-agent");
-  const directNode = path7.join(root, "node.exe");
-  const directIndex = path7.join(root, "index.js");
+  const root = agentRoot?.trim() || path8.join(process.env.LOCALAPPDATA || "", "cursor-agent");
+  const directNode = path8.join(root, "node.exe");
+  const directIndex = path8.join(root, "index.js");
   if (existsSync8(directNode) && existsSync8(directIndex)) {
     return { nodeExe: directNode, indexJs: directIndex, versionDir: root };
   }
   const versionDir = pickLatestCursorVersionDir(root);
   if (!versionDir) return null;
-  const nodeExe = path7.join(versionDir, "node.exe");
-  const indexJs = path7.join(versionDir, "index.js");
+  const nodeExe = path8.join(versionDir, "node.exe");
+  const indexJs = path8.join(versionDir, "index.js");
   if (!existsSync8(nodeExe) || !existsSync8(indexJs)) return null;
   return { nodeExe, indexJs, versionDir };
 }
@@ -1889,13 +2227,13 @@ function bundledSpawnTarget(nodeExe, indexJs, versionDir) {
 function resolveCursorSpawn(agentBin) {
   if (process.platform === "win32") {
     const isCursorWrapper = /\.(cmd|bat)$/i.test(agentBin);
-    const isBundledNode = /node\.exe$/i.test(agentBin) && existsSync9(path8.join(path8.dirname(agentBin), "index.js"));
+    const isBundledNode = /node\.exe$/i.test(agentBin) && existsSync9(path9.join(path9.dirname(agentBin), "index.js"));
     const isDefaultShim = agentBin === "agent";
     if (isCursorWrapper || isBundledNode || isDefaultShim) {
-      const bundled = isCursorWrapper ? resolveWindowsCursorBundled(path8.dirname(agentBin)) : isBundledNode ? {
+      const bundled = isCursorWrapper ? resolveWindowsCursorBundled(path9.dirname(agentBin)) : isBundledNode ? {
         nodeExe: agentBin,
-        indexJs: path8.join(path8.dirname(agentBin), "index.js"),
-        versionDir: path8.dirname(agentBin)
+        indexJs: path9.join(path9.dirname(agentBin), "index.js"),
+        versionDir: path9.dirname(agentBin)
       } : resolveWindowsCursorBundled();
       if (bundled) {
         return bundledSpawnTarget(bundled.nodeExe, bundled.indexJs, bundled.versionDir);
@@ -1915,18 +2253,18 @@ function resolveAgentBin() {
       process.env.KYNVER_CURSOR_AGENT_ROOT?.trim() || void 0
     );
     if (bundled) return bundled.nodeExe;
-    const localAgent = path8.join(process.env.LOCALAPPDATA || "", "cursor-agent", "agent.cmd");
+    const localAgent = path9.join(process.env.LOCALAPPDATA || "", "cursor-agent", "agent.cmd");
     if (existsSync9(localAgent)) return localAgent;
   }
   return "agent";
 }
 function cursorWorkerEnv(agentBin, spawnTarget) {
-  return {
+  return scrubWorkerEnv({
     ...process.env,
     CI: "1",
     NO_COLOR: "1",
-    ...spawnTarget.bundledVersionDir ? { CURSOR_INVOKED_AS: path8.basename(agentBin) || "agent.cmd" } : {}
-  };
+    ...spawnTarget.bundledVersionDir ? { CURSOR_INVOKED_AS: path9.basename(agentBin) || "agent.cmd" } : {}
+  });
 }
 var cursorProvider = {
   name: "cursor",
@@ -1942,6 +2280,7 @@ var cursorProvider = {
     const model = preflight.model;
     const stdoutFd = openSync2(opts.stdoutPath, "a");
     const stderrFd = openSync2(opts.stderrPath, "a");
+    const stdio = ["ignore", stdoutFd, stderrFd];
     const agentBin = resolveAgentBin();
     const spawnTarget = resolveCursorSpawn(agentBin);
     const child = spawn2(
@@ -1964,7 +2303,7 @@ var cursorProvider = {
         cwd: opts.worktreePath,
         detached: spawnTarget.detached,
         shell: spawnTarget.shell,
-        stdio: ["ignore", stdoutFd, stderrFd],
+        stdio,
         env: cursorWorkerEnv(agentBin, spawnTarget)
       })
     );
@@ -1999,7 +2338,7 @@ function resolveWorkerProvider(name) {
 // src/auto-complete.ts
 import { spawn as spawn3 } from "node:child_process";
 import { existsSync as existsSync10, openSync as openSync3, closeSync as closeSync3 } from "node:fs";
-import path11 from "node:path";
+import path12 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/completion-ack.ts
@@ -2016,7 +2355,40 @@ function persistCompletionAck(worker, runId, fields) {
 }
 
 // src/worker-ops.ts
-import path10 from "node:path";
+import path11 from "node:path";
+
+// src/completion-response.ts
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function asString(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length ? trimmed : null;
+}
+var ADVANCED_OUTCOMES = /* @__PURE__ */ new Set([
+  "review_scheduled",
+  "review_already_scheduled"
+]);
+function summarizeHarnessCompletionResponse(parsed) {
+  const record = asRecord(parsed);
+  if (!record) {
+    return { routeOutcome: null, taskAdvanced: false, detail: null };
+  }
+  const outcome = asString(record.outcome);
+  const detail = asString(record.detail) ?? asString(record.error);
+  const task = asRecord(record.task);
+  const taskStatus = task ? asString(task.status) : null;
+  const taskAdvanced = outcome !== null && ADVANCED_OUTCOMES.has(outcome) || taskStatus === "awaiting_review" || taskStatus === "done";
+  return {
+    routeOutcome: outcome,
+    taskAdvanced,
+    detail
+  };
+}
+function completionPostSucceeded(summary) {
+  return summary.taskAdvanced;
+}
 
 // src/pr-handoff/pr-handoff-assess.ts
 var REVIEW_LANE_RULE = /^(lane:)?(review|deep_review|planning|landing)(:|$)/i;
@@ -2078,6 +2450,36 @@ function buildPrHandoffSnapshotFromStatus(status, extras) {
 
 // src/pr-handoff/pr-handoff-gh.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
+
+// src/github-repo.ts
+function parseGithubOwnerRepo(remoteUrl) {
+  const trimmed = remoteUrl.trim();
+  if (!trimmed) return null;
+  const ssh = trimmed.match(/^git@github\.com:([^/]+\/[^/\s]+?)(?:\.git)?$/i);
+  if (ssh) return normalizeOwnerRepo(ssh[1]);
+  const scp = trimmed.match(/^ssh:\/\/git@github\.com\/([^/]+\/[^/\s]+?)(?:\.git)?$/i);
+  if (scp) return normalizeOwnerRepo(scp[1]);
+  try {
+    const url = new URL(trimmed.includes("://") ? trimmed : `https://${trimmed}`);
+    if (url.hostname.toLowerCase() !== "github.com") return null;
+    const parts = url.pathname.replace(/^\/+|\/+$/g, "").split("/");
+    if (parts.length < 2) return null;
+    const [owner, repo] = parts;
+    if (!owner || !repo) return null;
+    return `${owner}/${repo.replace(/\.git$/i, "")}`;
+  } catch {
+    return null;
+  }
+}
+function normalizeOwnerRepo(value) {
+  const parts = value.split("/").filter(Boolean);
+  if (parts.length < 2) return null;
+  const owner = parts[0];
+  const repo = parts[1].replace(/\.git$/i, "");
+  return owner && repo ? `${owner}/${repo}` : null;
+}
+
+// src/pr-handoff/pr-handoff-gh.ts
 function capture(bin, cwd, args) {
   try {
     const res = spawnSync2(bin, args, { cwd, encoding: "utf8" });
@@ -2100,21 +2502,13 @@ var defaultPrHandoffExec = {
   git: (cwd, args) => gitCapture(cwd, args),
   gh: (cwd, args) => capture("gh", cwd, args)
 };
-function parseGithubRepo(remoteUrl) {
-  const trimmed = remoteUrl.trim();
-  const ssh = trimmed.match(/git@github\.com:([^/]+\/[^/.]+)(?:\.git)?/i);
-  if (ssh) return ssh[1];
-  const https = trimmed.match(/github\.com[/:]([^/]+\/[^/.]+?)(?:\.git)?/i);
-  if (https) return https[1];
-  return null;
-}
 function firstLine(text) {
   return text.split("\n").map((l) => l.trim()).find(Boolean) ?? "";
 }
 function resolveGithubRepo(worktreePath, exec) {
   const remote = exec.git(worktreePath, ["remote", "get-url", "origin"]);
   if (remote.status !== 0) return null;
-  return parseGithubRepo(remote.stdout);
+  return parseGithubOwnerRepo(remote.stdout);
 }
 function resolveHeadCommit(worktreePath, exec) {
   const head = exec.git(worktreePath, ["rev-parse", "HEAD"]);
@@ -2353,7 +2747,7 @@ function ensurePrReadyHandoff(input, exec = defaultPrHandoffExec) {
 }
 
 // src/worker-lifecycle.ts
-import path9 from "node:path";
+import path10 from "node:path";
 var TASK_LEFT_RUNNING = /* @__PURE__ */ new Set([
   "awaiting_review",
   "blocked",
@@ -2409,7 +2803,7 @@ function syncCompletionAcknowledgedFromOperatorTick(runId, operatorTick) {
   const synced = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path9.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path10.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.taskId || isCompletionAcknowledged(worker)) continue;
@@ -2448,10 +2842,10 @@ function completionErrorText(parsed) {
   }
   return void 0;
 }
-function asRecord(value) {
+function asRecord2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function asString(value) {
+function asString2(value) {
   if (typeof value !== "string") return null;
   const trimmed = value.trim();
   return trimmed.length ? trimmed : null;
@@ -2571,7 +2965,27 @@ async function tryCompleteWorker(args) {
     }
   }
   if (result.ok) {
+    const summary = summarizeHarnessCompletionResponse(result.parsed);
+    if (!completionPostSucceeded(summary)) {
+      const detail2 = summary.detail ?? (summary.routeOutcome ? `harness completion returned ${summary.routeOutcome}` : "harness completion did not advance the linked task");
+      const reason2 = `completion acknowledged but board not advanced: ${detail2}`;
+      persistCompletionBlocker(worker, reason2);
+      const ack2 = {
+        completionReportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        completionOutcome: "rejected",
+        completionResponse: result.parsed
+      };
+      persistCompletionAck(worker, worker.runId, ack2);
+      return {
+        ok: false,
+        httpStatus: result.status,
+        response: result.parsed,
+        reason: reason2,
+        completionBlocked: true
+      };
+    }
     persistCompletionBlocker(worker, void 0);
+    const routeOutcome = summary.routeOutcome ?? "acknowledged";
     const ack = {
       completionReportedAt: (/* @__PURE__ */ new Date()).toISOString(),
       completionOutcome: "acknowledged",
@@ -2584,6 +2998,7 @@ async function tryCompleteWorker(args) {
       ok: true,
       httpStatus: result.status,
       response: result.parsed,
+      reason: routeOutcome,
       ...prUrl ? { prHandoff: { prUrl } } : {}
     };
   }
@@ -2646,7 +3061,7 @@ function workerStatus(args) {
   const worker = loadWorker(String(args.run), String(args.name));
   const run = loadRun(worker.runId);
   const status = computeWorkerStatus(worker, workerStatusOptions(run));
-  writeJson(path10.join(worker.workerDir, "last-status.json"), status);
+  writeJson(path11.join(worker.workerDir, "last-status.json"), status);
   console.log(JSON.stringify(status, null, 2));
 }
 function buildRunBoard(runId) {
@@ -2654,7 +3069,7 @@ function buildRunBoard(runId) {
   const names = Object.keys(run.workers || {});
   const workers = names.map((name) => {
     const worker = readJson(
-      path10.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path11.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker) {
@@ -2676,22 +3091,23 @@ function buildRunBoard(runId) {
     const completionBlocker = typeof rawBlocker === "string" && rawBlocker ? rawBlocker : void 0;
     const boardStatus = completionBlocker ? "blocked" : status.status;
     const boardAttention = completionBlocker ? "blocked" : status.attention.state;
-    const completionResponse = asRecord(worker.completionResponse);
-    const completionTask = asRecord(completionResponse?.task);
-    const completionOutcome = asString(completionResponse?.outcome);
-    const completionRouteStatus = asString(completionResponse?.status);
+    const completionResponse = asRecord2(worker.completionResponse);
+    const completionTask = asRecord2(completionResponse?.task);
+    const completionOutcome = asString2(completionResponse?.outcome);
+    const completionRouteStatus = asString2(completionResponse?.status);
     const completionWarnings = Array.isArray(completionResponse?.warnings) ? completionResponse.warnings.filter((w) => typeof w === "string" && w.trim().length > 0) : [];
-    const prUrl = asString(completionTask?.prUrl) ?? asString(completionResponse?.prUrl);
+    const prUrl = asString2(completionTask?.prUrl) ?? asString2(completionResponse?.prUrl);
+    const completionReportedAt = asString2(worker.completionReportedAt);
     const lifecycleStage = deriveLifecycleStage({
       finished: isFinishedWorkerStatus(status),
       completionBlocker,
       completionOutcome,
-      completionReportedAt: worker.completionReportedAt ?? null
+      completionReportedAt
     });
     const nextAction = deriveNextAction({
       completionBlocker,
       completionOutcome,
-      completionReportedAt: worker.completionReportedAt ?? null,
+      completionReportedAt,
       finished: isFinishedWorkerStatus(status)
     });
     const handoffState = deriveHandoffState({
@@ -2737,7 +3153,7 @@ function buildRunBoard(runId) {
       gitAncestry: status.gitAncestry,
       finalResult: status.finalResult,
       lifecycleStage,
-      completionReportedAt: worker.completionReportedAt ?? null,
+      completionReportedAt,
       completionOutcome: worker.completionOutcome ?? null,
       completionRouteStatus,
       completionRouteOutcome: completionOutcome,
@@ -2764,7 +3180,7 @@ function buildRunBoard(runId) {
     needsAttention: workers.filter((w) => w.attention && w.attention !== "ok" && w.attention !== "done").map((w) => w.worker),
     workers
   };
-  writeJson(path10.join(runDirectory(run.id), "last-board.json"), board);
+  writeJson(path11.join(runDirectory(run.id), "last-board.json"), board);
   return board;
 }
 async function publishHarnessBoardSnapshot(args, source) {
@@ -2953,12 +3369,12 @@ async function autoCompleteWorkerCli(raw) {
   }
 }
 function resolveDefaultCliPath() {
-  return path11.join(fileURLToPath2(new URL(".", import.meta.url)), "cli.js");
+  return path12.join(fileURLToPath2(new URL(".", import.meta.url)), "cli.js");
 }
 function spawnCompletionSidecar(opts) {
   const cliPath = opts.cliPath ?? resolveDefaultCliPath();
   if (!existsSync10(cliPath)) return void 0;
-  const logPath = path11.join(opts.workerDir, "auto-complete.log");
+  const logPath = path12.join(opts.workerDir, "auto-complete.log");
   let logFd;
   try {
     logFd = openSync3(logPath, "a");
@@ -3040,16 +3456,16 @@ function spawnWorkerProcess(run, opts) {
     launchModel = preflight.model;
   }
   const { worktreesDir } = getPaths();
-  const workerDir = path12.join(runDirectory(run.id), "workers", name);
+  const workerDir = path13.join(runDirectory(run.id), "workers", name);
   mkdirSync3(workerDir, { recursive: true });
-  const worktreePath = path12.join(worktreesDir, run.id, name);
+  const worktreePath = path13.join(worktreesDir, run.id, name);
   const branch = opts.branch || `agent/${run.id}/${name}`;
   if (existsSync11(worktreePath)) throw new Error(`worktree path already exists: ${worktreePath}`);
   git(run.repo, ["fetch", "origin", "--prune"], { allowFailure: true });
   git(run.repo, ["worktree", "add", "-b", branch, worktreePath, run.baseCommit], { throwError: true });
-  const stdoutPath = path12.join(workerDir, "stdout.jsonl");
-  const stderrPath = path12.join(workerDir, "stderr.log");
-  const heartbeatPath = path12.join(workerDir, "heartbeat.jsonl");
+  const stdoutPath = path13.join(workerDir, "stdout.jsonl");
+  const stderrPath = path13.join(workerDir, "stderr.log");
+  const heartbeatPath = path13.join(workerDir, "heartbeat.jsonl");
   const prompt = buildPrompt({
     task: opts.task,
     ownedPaths: opts.ownedPaths || [],
@@ -3110,7 +3526,7 @@ function spawnWorkerProcess(run, opts) {
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   saveWorker(run.id, worker);
-  run.workers = { ...run.workers || {}, [name]: { workerDir, statusPath: path12.join(workerDir, "worker.json") } };
+  run.workers = { ...run.workers || {}, [name]: { workerDir, statusPath: path13.join(workerDir, "worker.json") } };
   run.status = "running";
   saveRun(run);
   if (worker.agentOsId && worker.taskId) {
@@ -3402,18 +3818,18 @@ function buildPlanPersistIdempotencyKey(input) {
 
 // src/plan-persist/paths.ts
 import { mkdirSync as mkdirSync4 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import path13 from "node:path";
+import { homedir as homedir4 } from "node:os";
+import path14 from "node:path";
 function resolveKynverStateRoot() {
   const env = process.env.KYNVER_STATE_ROOT;
-  if (env) return path13.resolve(env);
-  return path13.join(homedir3(), ".kynver", "state");
+  if (env) return path14.resolve(env);
+  return path14.join(homedir4(), ".kynver", "state");
 }
 function planOutboxDir() {
-  return path13.join(resolveKynverStateRoot(), "plan-outbox");
+  return path14.join(resolveKynverStateRoot(), "plan-outbox");
 }
 function planOutboxArchiveDir() {
-  return path13.join(resolveKynverStateRoot(), "plan-outbox-archive");
+  return path14.join(resolveKynverStateRoot(), "plan-outbox-archive");
 }
 function ensurePlanOutboxDirs() {
   const outboxDir = planOutboxDir();
@@ -3424,8 +3840,8 @@ function ensurePlanOutboxDirs() {
 }
 function isTmpOnlyPath(filePath) {
   if (filePath.startsWith("/tmp/") || filePath.startsWith("/var/folders/")) return true;
-  const resolved = path13.resolve(filePath);
-  return resolved.startsWith("/tmp/") || resolved.startsWith(path13.join("/var", "folders"));
+  const resolved = path14.resolve(filePath);
+  return resolved.startsWith("/tmp/") || resolved.startsWith(path14.join("/var", "folders"));
 }
 
 // src/plan-persist/outbox-store.ts
@@ -3437,7 +3853,7 @@ import {
   writeFileSync as writeFileSync3,
   unlinkSync
 } from "node:fs";
-import path14 from "node:path";
+import path15 from "node:path";
 import { randomUUID } from "node:crypto";
 var DEFAULT_MAX_RETRIES = 12;
 function listOutboxItems() {
@@ -3445,7 +3861,7 @@ function listOutboxItems() {
   const files = readdirSync4(outboxDir).filter((f) => f.endsWith(".json"));
   const items = [];
   for (const file of files) {
-    const item = readOutboxItem(path14.join(outboxDir, file));
+    const item = readOutboxItem(path15.join(outboxDir, file));
     if (item && item.queueStatus === "queued") items.push(item);
   }
   return items.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
@@ -3466,7 +3882,7 @@ function readOutboxItem(jsonPath) {
 }
 function readOutboxBody(item) {
   const { outboxDir } = ensurePlanOutboxDirs();
-  const bodyFile = path14.join(outboxDir, item.bodyPath);
+  const bodyFile = path15.join(outboxDir, item.bodyPath);
   return readFileSync7(bodyFile, "utf8");
 }
 function writeOutboxItem(input, opts) {
@@ -3474,8 +3890,8 @@ function writeOutboxItem(input, opts) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const id = opts.existing?.id ?? randomUUID();
   const bodyPath = opts.existing?.bodyPath ?? `${id}.body.md`;
-  const jsonPath = path14.join(outboxDir, `${id}.json`);
-  const bodyFile = path14.join(outboxDir, bodyPath);
+  const jsonPath = path15.join(outboxDir, `${id}.json`);
+  const bodyFile = path15.join(outboxDir, bodyPath);
   if (!opts.existing) {
     writeFileSync3(bodyFile, input.body, "utf8");
   }
@@ -3511,24 +3927,24 @@ function writeOutboxItem(input, opts) {
 }
 function saveOutboxItem(item) {
   const { outboxDir } = ensurePlanOutboxDirs();
-  const jsonPath = path14.join(outboxDir, `${item.id}.json`);
+  const jsonPath = path15.join(outboxDir, `${item.id}.json`);
   writeFileSync3(jsonPath, `${JSON.stringify(item, null, 2)}
 `, { mode: 384 });
 }
 function archiveOutboxItem(item) {
   const { outboxDir, archiveDir } = ensurePlanOutboxDirs();
-  const jsonSrc = path14.join(outboxDir, `${item.id}.json`);
-  const bodySrc = path14.join(outboxDir, item.bodyPath);
-  const jsonDst = path14.join(archiveDir, `${item.id}.json`);
-  const bodyDst = path14.join(archiveDir, item.bodyPath);
+  const jsonSrc = path15.join(outboxDir, `${item.id}.json`);
+  const bodySrc = path15.join(outboxDir, item.bodyPath);
+  const jsonDst = path15.join(archiveDir, `${item.id}.json`);
+  const bodyDst = path15.join(archiveDir, item.bodyPath);
   if (existsSync13(jsonSrc)) renameSync(jsonSrc, jsonDst);
   if (existsSync13(bodySrc)) renameSync(bodySrc, bodyDst);
 }
 function outboxItemPaths(item) {
   const { outboxDir } = ensurePlanOutboxDirs();
   return {
-    jsonPath: path14.join(outboxDir, `${item.id}.json`),
-    bodyPath: path14.join(outboxDir, item.bodyPath)
+    jsonPath: path15.join(outboxDir, `${item.id}.json`),
+    bodyPath: path15.join(outboxDir, item.bodyPath)
   };
 }
 function outboxInputFromItem(item, body) {
@@ -3714,7 +4130,7 @@ function markOutboxFailed(item, message) {
 }
 
 // src/plan-persist/drain.ts
-import path15 from "node:path";
+import path16 from "node:path";
 async function drainPlanOutbox(opts = {}, deps = {}) {
   const items = listOutboxItems().filter(
     (item) => opts.outboxId ? item.id === opts.outboxId : true
@@ -3748,7 +4164,7 @@ async function drainPlanOutbox(opts = {}, deps = {}) {
   return result;
 }
 function loadOutboxById(outboxId) {
-  const jsonPath = path15.join(planOutboxDir(), `${outboxId}.json`);
+  const jsonPath = path16.join(planOutboxDir(), `${outboxId}.json`);
   return readOutboxItem(jsonPath);
 }
 
@@ -3848,7 +4264,7 @@ async function dispatchRun(args) {
     const activeHarnessWorkers = [];
     for (const name of Object.keys(run.workers || {})) {
       const worker = readJson(
-        path16.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+        path17.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
         void 0
       );
       if (!worker?.taskId || !isPidAlive(worker.pid)) continue;
@@ -3872,7 +4288,8 @@ async function dispatchRun(args) {
       harnessBoardSnapshot: buildRunBoard(run.id),
       ...args.lane ? { lane: String(args.lane) } : {},
       executor: args.executor ? String(args.executor) : "harness",
-      ...args.diskPath ? { diskPath: String(args.diskPath) } : {}
+      ...args.diskPath ? { diskPath: String(args.diskPath) } : {},
+      ...args.targetTaskId ? { targetTaskId: String(args.targetTaskId) } : {}
     };
     const dispatch = await postJsonWithCredentialRefresh(dispatchUrl, secret, body, { agentOsId, baseUrl: base });
     const responseBody = dispatch.response;
@@ -4051,6 +4468,13 @@ async function dispatchRun(args) {
   }
 }
 
+// src/fortress-engagement-gate.ts
+function isEngagementRequiredSkip(skip) {
+  if (skip.skipReason === "engagement_required") return true;
+  const reason = skip.reason ?? "";
+  return reason.includes("engagement_required") || reason.includes("engagement_not_found") || reason.includes("engagement_expired") || reason.includes("engagement_revoked");
+}
+
 // src/redact.ts
 function redactHarness(text, secret) {
   let out = text;
@@ -4061,7 +4485,7 @@ function redactHarness(text, secret) {
 }
 
 // src/validate.ts
-import path17 from "node:path";
+import path18 from "node:path";
 var RUN_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/i;
 var WORKER_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
 function validateRunId(runId) {
@@ -4075,15 +4499,15 @@ function validateWorkerName(name) {
   return trimmed;
 }
 function validateRepo(repo) {
-  const resolved = path17.resolve(repo);
+  const resolved = path18.resolve(repo);
   if (resolved.includes("..")) throw new Error("repo path must not contain .. segments");
   return resolved;
 }
 function validateOwnedPaths(repoRoot, ownedPaths) {
   return ownedPaths.map((owned) => {
-    const resolved = path17.resolve(repoRoot, owned);
-    const rel = path17.relative(repoRoot, resolved);
-    if (rel.startsWith("..") || path17.isAbsolute(rel)) {
+    const resolved = path18.resolve(repoRoot, owned);
+    const rel = path18.relative(repoRoot, resolved);
+    if (rel.startsWith("..") || path18.isAbsolute(rel)) {
       throw new Error(`owned path escapes repo: ${owned}`);
     }
     return resolved;
@@ -4096,7 +4520,7 @@ function validateTailLines(lines) {
 
 // src/worktree.ts
 import { existsSync as existsSync14, mkdirSync as mkdirSync5 } from "node:fs";
-import path18 from "node:path";
+import path19 from "node:path";
 function createRun(args) {
   const repo = validateRepo(required(String(args.repo || ""), "--repo"));
   ensureGitRepo(repo);
@@ -4116,12 +4540,12 @@ function createRun(args) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     workers: {}
   };
-  writeJson(path18.join(dir, "run.json"), run);
+  writeJson(path19.join(dir, "run.json"), run);
   console.log(JSON.stringify({ runId: id, runDir: dir, repo, base, baseCommit }, null, 2));
 }
 function listRuns() {
   const { runsDir } = getPaths();
-  const rows = listRunIds(runsDir).map((id) => readJson(path18.join(runDirectory(id), "run.json"), void 0)).filter(Boolean).map((run) => ({
+  const rows = listRunIds(runsDir).map((id) => readJson(path19.join(runDirectory(id), "run.json"), void 0)).filter(Boolean).map((run) => ({
     id: run.id,
     name: run.name,
     status: run.status,
@@ -4136,7 +4560,7 @@ function failExists(message) {
 }
 
 // src/sweep.ts
-import path19 from "node:path";
+import path20 from "node:path";
 async function sweepRun(args) {
   const pipeline = args.pipeline === true || args.pipeline === "true";
   try {
@@ -4149,7 +4573,7 @@ async function sweepRun(args) {
     const releasedLocalOrphans = [];
     for (const name of Object.keys(run.workers || {})) {
       const worker = readJson(
-        path19.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+        path20.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
         void 0
       );
       if (!worker || !worker.dispatched || !worker.taskId) continue;
@@ -4196,7 +4620,7 @@ import { mkdirSync as mkdirSync7, realpathSync } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/pipeline-tick.ts
-import path28 from "node:path";
+import path30 from "node:path";
 
 // src/pipeline-dispatch.ts
 var RESERVED_REVIEW_STARTS = 1;
@@ -4250,10 +4674,10 @@ async function runPipelineDispatch(args, slots) {
 }
 
 // src/stale-reconcile.ts
-import path21 from "node:path";
+import path22 from "node:path";
 
 // src/finalize.ts
-import path20 from "node:path";
+import path21 from "node:path";
 var ACTIVE_RUN_STATUSES = /* @__PURE__ */ new Set(["running", "dispatching", "pending", "queued"]);
 function terminalStatusFor(run) {
   const names = Object.keys(run.workers || {});
@@ -4264,7 +4688,7 @@ function terminalStatusFor(run) {
   let anyLandingBlocked = false;
   for (const name of names) {
     const worker = readJson(
-      path20.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path21.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker) continue;
@@ -4316,7 +4740,7 @@ function reconcileStaleWorkers() {
   const now = Date.now();
   for (const run of listRunRecords()) {
     for (const name of Object.keys(run.workers || {})) {
-      const workerPath = path21.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
+      const workerPath = path22.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
       const worker = readJson(workerPath, void 0);
       if (!worker || worker.status !== "running") {
         outcomes.push({
@@ -4410,7 +4834,7 @@ function reconcileRunsCli() {
 }
 
 // src/plan-progress-daemon-sync.ts
-import path22 from "node:path";
+import path23 from "node:path";
 
 // src/plan-progress-sync.ts
 async function syncPlanProgress(args) {
@@ -4434,7 +4858,7 @@ async function syncActiveWorkerPlanProgress(runId, args) {
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path22.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path23.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.dispatched || !worker.taskId) continue;
@@ -4483,7 +4907,7 @@ async function fetchWorkspaceRuntimePreferences(agentOsId, args) {
 }
 
 // src/cleanup.ts
-import path27 from "node:path";
+import path28 from "node:path";
 
 // src/cleanup-types.ts
 var DEFAULT_NODE_MODULES_AGE_MS = 6 * 60 * 60 * 1e3;
@@ -4555,11 +4979,11 @@ function skipNodeModulesRemoval(input) {
 
 // src/cleanup-execute.ts
 import { existsSync as existsSync16, rmSync } from "node:fs";
-import path24 from "node:path";
+import path25 from "node:path";
 
 // src/cleanup-dir-size.ts
 import { existsSync as existsSync15, readdirSync as readdirSync5, statSync as statSync2 } from "node:fs";
-import path23 from "node:path";
+import path24 from "node:path";
 function directorySizeBytes(root, maxEntries = 5e4) {
   if (!existsSync15(root)) return 0;
   let total = 0;
@@ -4575,7 +4999,7 @@ function directorySizeBytes(root, maxEntries = 5e4) {
     }
     for (const name of entries) {
       if (seen++ > maxEntries) return null;
-      const full = path23.join(current, name);
+      const full = path24.join(current, name);
       let st;
       try {
         st = statSync2(full);
@@ -4659,20 +5083,20 @@ function removeWorktree(candidate, execute) {
   }
 }
 function isHarnessNodeModulesPath(targetPath, harnessRoot, worktreesDir) {
-  const resolved = path24.resolve(targetPath);
-  const nm = resolved.endsWith(`${path24.sep}node_modules`) ? resolved : null;
+  const resolved = path25.resolve(targetPath);
+  const nm = resolved.endsWith(`${path25.sep}node_modules`) ? resolved : null;
   if (!nm) return "path_outside_harness";
-  const rel = path24.relative(worktreesDir, nm);
-  if (rel.startsWith("..") || path24.isAbsolute(rel)) return "path_outside_harness";
-  const parts = rel.split(path24.sep);
+  const rel = path25.relative(worktreesDir, nm);
+  if (rel.startsWith("..") || path25.isAbsolute(rel)) return "path_outside_harness";
+  const parts = rel.split(path25.sep);
   if (parts.length < 3 || parts[parts.length - 1] !== "node_modules") return "path_outside_harness";
-  if (!resolved.startsWith(path24.resolve(harnessRoot))) return "path_outside_harness";
+  if (!resolved.startsWith(path25.resolve(harnessRoot))) return "path_outside_harness";
   return null;
 }
 
 // src/cleanup-scan.ts
 import { existsSync as existsSync17, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
-import path25 from "node:path";
+import path26 from "node:path";
 function pathAgeMs(target, now) {
   try {
     const mtime = statSync3(target).mtimeMs;
@@ -4682,17 +5106,17 @@ function pathAgeMs(target, now) {
   }
 }
 function isPathInside(child, parent) {
-  const rel = path25.relative(parent, child);
-  return rel === "" || !rel.startsWith("..") && !path25.isAbsolute(rel);
+  const rel = path26.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path26.isAbsolute(rel);
 }
 function scanNodeModulesCandidates(opts) {
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
   for (const entry of opts.index.values()) {
     if (opts.runIdFilter && entry.runId !== opts.runIdFilter) continue;
-    const nm = path25.join(entry.worktreePath, "node_modules");
+    const nm = path26.join(entry.worktreePath, "node_modules");
     if (!existsSync17(nm)) continue;
-    const resolved = path25.resolve(nm);
+    const resolved = path26.resolve(nm);
     if (seen.has(resolved)) continue;
     seen.add(resolved);
     candidates.push({
@@ -4708,13 +5132,13 @@ function scanNodeModulesCandidates(opts) {
   if (!opts.includeOrphans || !existsSync17(opts.worktreesDir)) return candidates;
   for (const runEntry of readdirSync6(opts.worktreesDir, { withFileTypes: true })) {
     if (!runEntry.isDirectory()) continue;
-    const runPath = path25.join(opts.worktreesDir, runEntry.name);
+    const runPath = path26.join(opts.worktreesDir, runEntry.name);
     for (const workerEntry of readdirSync6(runPath, { withFileTypes: true })) {
       if (!workerEntry.isDirectory()) continue;
-      const worktreePath = path25.join(runPath, workerEntry.name);
-      const nm = path25.join(worktreePath, "node_modules");
+      const worktreePath = path26.join(runPath, workerEntry.name);
+      const nm = path26.join(worktreePath, "node_modules");
       if (!existsSync17(nm)) continue;
-      const resolved = path25.resolve(nm);
+      const resolved = path26.resolve(nm);
       if (seen.has(resolved)) continue;
       if (!isPathInside(resolved, opts.harnessRoot)) continue;
       seen.add(resolved);
@@ -4754,17 +5178,17 @@ function scanWorktreeCandidates(opts) {
 }
 
 // src/cleanup-worktree-index.ts
-import path26 from "node:path";
+import path27 from "node:path";
 function buildWorktreeIndex() {
   const index = /* @__PURE__ */ new Map();
   for (const run of listRunRecords()) {
     for (const name of Object.keys(run.workers || {})) {
-      const workerPath = path26.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
+      const workerPath = path27.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
       const worker = readJson(workerPath, void 0);
       if (!worker?.worktreePath) continue;
       const status = computeWorkerStatus(worker, { base: run.base, baseCommit: run.baseCommit });
-      index.set(path26.resolve(worker.worktreePath), {
-        worktreePath: path26.resolve(worker.worktreePath),
+      index.set(path27.resolve(worker.worktreePath), {
+        worktreePath: path27.resolve(worker.worktreePath),
         runId: run.id,
         workerName: name,
         run,
@@ -4778,8 +5202,8 @@ function buildWorktreeIndex() {
 
 // src/cleanup.ts
 function resolveOptions(options = {}) {
-  const harnessRoot = options.harnessRoot ? path27.resolve(options.harnessRoot) : resolveHarnessRoot();
-  const { worktreesDir } = options.harnessRoot ? { worktreesDir: path27.join(harnessRoot, "worktrees") } : getHarnessPaths();
+  const harnessRoot = options.harnessRoot ? resolveUserPath(options.harnessRoot) : resolveHarnessRoot();
+  const { worktreesDir } = options.harnessRoot ? { worktreesDir: path28.join(harnessRoot, "worktrees") } : getHarnessPaths();
   const execute = options.execute === true;
   const nodeModulesAgeMs = options.nodeModulesAgeMs ?? DEFAULT_NODE_MODULES_AGE_MS;
   const worktreesAgeMs = options.worktreesAgeMs ?? 0;
@@ -4823,7 +5247,7 @@ function runHarnessCleanup(options = {}) {
       actions.push({ ...candidate, executed: false, skipped: true, skipReason: pathSkip });
       continue;
     }
-    const worktreePath = path27.resolve(candidate.path, "..");
+    const worktreePath = path28.resolve(candidate.path, "..");
     const indexed = index.get(worktreePath) ?? null;
     const guardReason = skipNodeModulesRemoval({
       indexed,
@@ -4839,7 +5263,7 @@ function runHarnessCleanup(options = {}) {
     actions.push(removeNodeModules(candidate, resolved.execute));
   }
   for (const candidate of scanWorktreeCandidates(scanOpts)) {
-    const indexed = index.get(path27.resolve(candidate.path)) ?? null;
+    const indexed = index.get(path28.resolve(candidate.path)) ?? null;
     const guardReason = skipWorktreeRemoval({
       indexed,
       includeOrphans: resolved.includeOrphans,
@@ -4902,13 +5326,62 @@ function isPipelineCleanupEnabled() {
   return process.env.KYNVER_PIPELINE_CLEANUP !== "0";
 }
 
+// src/installed-package-versions.ts
+import { readFile } from "node:fs/promises";
+import { homedir as homedir5 } from "node:os";
+import path29 from "node:path";
+var MANAGED_PACKAGES = [
+  "@kynver-app/runtime",
+  "@kynver-app/openclaw-agent-os",
+  "@kynver-app/mcp-agent-os"
+];
+function trim(value) {
+  const out = value?.trim();
+  return out ? out : null;
+}
+function unique(values) {
+  return [...new Set(values.filter((value) => Boolean(value)))];
+}
+function moduleRoots() {
+  const home = homedir5();
+  const openClawPrefix = trim(process.env.KYNVER_OPENCLAW_NPM_ROOT) ?? trim(process.env.OPENCLAW_NPM_ROOT) ?? path29.join(home, ".openclaw", "npm");
+  const npmGlobalRoot = trim(process.env.KYNVER_NPM_GLOBAL_ROOT) ?? trim(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT) ?? (trim(process.env.NPM_CONFIG_PREFIX) ? path29.join(trim(process.env.NPM_CONFIG_PREFIX), "lib", "node_modules") : path29.join(home, ".npm-global", "lib", "node_modules"));
+  return unique([
+    path29.join(openClawPrefix, "lib", "node_modules"),
+    path29.join(openClawPrefix, "node_modules"),
+    npmGlobalRoot.endsWith("node_modules") ? npmGlobalRoot : path29.join(npmGlobalRoot, "lib", "node_modules")
+  ]);
+}
+async function readVersion(packageJsonPath) {
+  try {
+    const parsed = JSON.parse(await readFile(packageJsonPath, "utf8"));
+    return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : null;
+  } catch {
+    return null;
+  }
+}
+async function collectInstalledPackageVersions(observedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const roots = moduleRoots();
+  const out = {};
+  for (const packageName of MANAGED_PACKAGES) {
+    for (const root of roots) {
+      const packageJsonPath = path29.join(root, packageName, "package.json");
+      const version = await readVersion(packageJsonPath);
+      if (!version) continue;
+      out[packageName] = { version, observedAt, path: packageJsonPath };
+      break;
+    }
+  }
+  return out;
+}
+
 // src/pipeline-tick.ts
 async function completeFinishedWorkers(runId, args) {
   const run = loadRun(runId);
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path28.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path30.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.taskId || worker.localOnly) continue;
@@ -4939,12 +5412,14 @@ async function postOperatorTick(agentOsId, runId, resourceGate, args) {
   const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
   const secret = await resolveCallbackSecretWithMint(args.secret ? String(args.secret) : void 0, agentOsId, { baseUrl: base });
   const url = `${base}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/operator/tick`;
+  const packageVersions = await collectInstalledPackageVersions();
   const res = await postJson(url, secret, {
     agentOsId,
     runId,
     ingestHarness: true,
     harnessBoardSnapshot: buildRunBoard(runId),
-    resourceGate
+    resourceGate,
+    packageVersions
   });
   return { ok: res.ok, httpStatus: res.status, response: res.response };
 }
@@ -5047,6 +5522,231 @@ async function runDaemon(args) {
   console.error(JSON.stringify({ event: "daemon_stop", runId, agentOsId }));
 }
 
+// src/plan-progress.ts
+import path31 from "node:path";
+
+// src/bounded-build/constants.ts
+var DEFAULT_BUILD_MEM_BUDGET_BYTES = 1536 * 1024 * 1024;
+var DEFAULT_BUILD_MEM_RESERVE_BYTES = 2 * 1024 * 1024 * 1024;
+var DEFAULT_NODE_OLD_SPACE_SIZE_MB = 1024;
+var DEFAULT_SYSTEMD_MEMORY_MAX = "1.5G";
+var DEFAULT_SYSTEMD_MEMORY_SWAP_MAX = "2G";
+
+// src/bounded-build/node-options.ts
+var MAX_OLD_SPACE_RE = /--max-old-space-size=(\d+)/;
+function parsePositiveInt(value, fallback) {
+  const n = Number(value);
+  if (!Number.isFinite(n) || n <= 0) return fallback;
+  return Math.floor(n);
+}
+function resolveNodeOldSpaceSizeMb() {
+  return parsePositiveInt(process.env.KYNVER_NODE_OLD_SPACE_SIZE_MB, DEFAULT_NODE_OLD_SPACE_SIZE_MB);
+}
+function mergeNodeOptionsForBuildCheck(baseEnv = process.env) {
+  const env = { ...baseEnv };
+  if (process.env.KYNVER_NODE_OLD_SPACE_SIZE_MB === "0") {
+    return env;
+  }
+  const existing = env.NODE_OPTIONS ?? "";
+  if (MAX_OLD_SPACE_RE.test(existing)) {
+    return env;
+  }
+  const mb = resolveNodeOldSpaceSizeMb();
+  const flag = `--max-old-space-size=${mb}`;
+  env.NODE_OPTIONS = existing.trim() ? `${existing.trim()} ${flag}` : flag;
+  return env;
+}
+function formatNodeOptionsFlag(mb = resolveNodeOldSpaceSizeMb()) {
+  return `--max-old-space-size=${mb}`;
+}
+
+// src/bounded-build/systemd-wrap.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
+var systemdAvailableCache;
+function isSystemdRunAvailable() {
+  if (process.env.KYNVER_BUILD_SKIP_SYSTEMD === "1" || process.env.KYNVER_BUILD_SKIP_SYSTEMD === "true") {
+    return false;
+  }
+  if (systemdAvailableCache !== void 0) return systemdAvailableCache;
+  if (process.platform !== "linux") {
+    systemdAvailableCache = false;
+    return false;
+  }
+  const res = spawnSync3("systemd-run", ["--version"], { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] });
+  systemdAvailableCache = res.status === 0;
+  return systemdAvailableCache;
+}
+function buildSystemdRunArgv(opts) {
+  const memoryMax = opts.memoryMax ?? process.env.KYNVER_BUILD_SYSTEMD_MEMORY_MAX ?? DEFAULT_SYSTEMD_MEMORY_MAX;
+  const memorySwapMax = opts.memorySwapMax ?? process.env.KYNVER_BUILD_SYSTEMD_MEMORY_SWAP_MAX ?? DEFAULT_SYSTEMD_MEMORY_SWAP_MAX;
+  const argv = [
+    "systemd-run",
+    "--scope",
+    "--collect",
+    "-p",
+    `MemoryMax=${memoryMax}`,
+    "-p",
+    `MemorySwapMax=${memorySwapMax}`
+  ];
+  if (opts.cwd) {
+    argv.push("--working-directory", opts.cwd);
+  }
+  argv.push("--", ...opts.command);
+  return argv;
+}
+
+// src/bounded-build/admission.ts
+import { spawnSync as spawnSync4 } from "node:child_process";
+function positiveInt3(value, fallback) {
+  const n = Number(value);
+  if (!Number.isFinite(n) || n <= 0) return fallback;
+  return Math.floor(n);
+}
+function resolveBuildAdmissionConfig(config = loadUserConfig()) {
+  const envBudget = process.env.KYNVER_BUILD_MEM_BUDGET_BYTES ? positiveInt3(process.env.KYNVER_BUILD_MEM_BUDGET_BYTES, DEFAULT_BUILD_MEM_BUDGET_BYTES) : void 0;
+  const envReserve = process.env.KYNVER_BUILD_MEM_RESERVE_BYTES ? positiveInt3(process.env.KYNVER_BUILD_MEM_RESERVE_BYTES, DEFAULT_BUILD_MEM_RESERVE_BYTES) : void 0;
+  return {
+    perBuildBudgetBytes: envBudget ?? positiveInt3(config.perWorkerMemBytes, DEFAULT_BUILD_MEM_BUDGET_BYTES),
+    reserveBytes: envReserve ?? positiveInt3(config.memReserveBytes, DEFAULT_BUILD_MEM_RESERVE_BYTES)
+  };
+}
+var activeBuilds = 0;
+function registerBuildStart() {
+  activeBuilds += 1;
+}
+function registerBuildEnd() {
+  activeBuilds = Math.max(0, activeBuilds - 1);
+}
+function assessBuildAdmission(opts = {}) {
+  const cfg = { ...resolveBuildAdmissionConfig(), ...opts };
+  const memAvailableBytes = opts.memAvailableBytes ?? readMemAvailableBytes();
+  const requiredBytes = cfg.perBuildBudgetBytes + cfg.reserveBytes;
+  const admitted = memAvailableBytes >= requiredBytes;
+  return {
+    admitted,
+    memAvailableBytes,
+    requiredBytes,
+    activeBuilds,
+    reason: admitted ? null : `insufficient memory: need ${requiredBytes} bytes available (budget ${cfg.perBuildBudgetBytes} + reserve ${cfg.reserveBytes}), have ${memAvailableBytes}`
+  };
+}
+function sleepMs2(ms) {
+  if (ms <= 0) return;
+  spawnSync4(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
+    stdio: "ignore"
+  });
+}
+function waitForBuildAdmission(timeoutMs, pollMs = 2e3, opts = {}) {
+  const deadline = Date.now() + Math.max(0, timeoutMs);
+  let verdict = assessBuildAdmission({
+    ...opts,
+    memAvailableBytes: opts.memAvailableBytes?.()
+  });
+  while (!verdict.admitted && Date.now() < deadline) {
+    sleepMs2(Math.min(pollMs, deadline - Date.now()));
+    verdict = assessBuildAdmission({
+      ...opts,
+      memAvailableBytes: opts.memAvailableBytes?.()
+    });
+  }
+  return verdict;
+}
+
+// src/bounded-build/exec.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
+function envArgv(env) {
+  const out = [];
+  for (const [key, value] of Object.entries(env)) {
+    if (value === void 0) continue;
+    out.push(`${key}=${value}`);
+  }
+  return out;
+}
+function runSpawn(argv, opts) {
+  const res = spawnSync5(argv[0], argv.slice(1), {
+    cwd: opts.cwd,
+    env: opts.env,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: opts.shell,
+    timeout: opts.timeoutMs
+  });
+  return {
+    exitCode: res.status ?? 1,
+    stdout: (res.stdout ?? "").trim(),
+    stderr: (res.stderr ?? "").trim()
+  };
+}
+function runBoundedBuildCheck(input) {
+  const waitMs = input.waitForAdmissionMs ?? 6e5;
+  const admission = waitMs > 0 ? waitForBuildAdmission(waitMs) : assessBuildAdmission();
+  if (!admission.admitted) {
+    return {
+      ok: false,
+      exitCode: 1,
+      stdout: "",
+      stderr: admission.reason ?? "build admission denied",
+      admitted: false,
+      wrappedWithSystemd: false,
+      nodeOptionsFlag: formatNodeOptionsFlag(),
+      admission,
+      command: input.command
+    };
+  }
+  const env = mergeNodeOptionsForBuildCheck({ ...process.env, ...input.env });
+  const nodeOptionsFlag = formatNodeOptionsFlag();
+  const useSystemd = isSystemdRunAvailable();
+  registerBuildStart();
+  try {
+    let result;
+    if (useSystemd) {
+      const argv = buildSystemdRunArgv({
+        cwd: input.cwd,
+        command: ["/usr/bin/env", ...envArgv(env), "/bin/bash", "-lc", input.command]
+      });
+      result = runSpawn(argv, { cwd: input.cwd, env, timeoutMs: input.timeoutMs });
+    } else {
+      result = runSpawn([input.command], {
+        cwd: input.cwd,
+        env,
+        shell: true,
+        timeoutMs: input.timeoutMs
+      });
+    }
+    return {
+      ok: result.exitCode === 0,
+      exitCode: result.exitCode,
+      stdout: result.stdout,
+      stderr: result.stderr,
+      admitted: true,
+      wrappedWithSystemd: useSystemd,
+      nodeOptionsFlag,
+      admission,
+      command: input.command
+    };
+  } finally {
+    registerBuildEnd();
+  }
+}
+
+// src/harness-verify.ts
+var DEFAULT_HARNESS_VERIFY_COMMANDS = ["npm run typecheck", "npm run test"];
+function runHarnessVerifyCommands(cwd, commands = DEFAULT_HARNESS_VERIFY_COMMANDS, opts = {}) {
+  const steps = [];
+  let passed = true;
+  for (const command of commands) {
+    const result = runBoundedBuildCheck({
+      cwd,
+      command,
+      waitForAdmissionMs: opts.waitForAdmissionMs,
+      timeoutMs: opts.timeoutMs
+    });
+    steps.push({ command, result });
+    if (!result.ok) passed = false;
+  }
+  return { passed, steps };
+}
+
 // src/plan-progress.ts
 function parseEvidenceArg(raw) {
   const idx = raw.indexOf(":");
@@ -5107,8 +5807,23 @@ async function emitPlanProgress(args) {
   }
   console.log(JSON.stringify(parsed, null, 2));
 }
+function verifyPlanLocal(args) {
+  const worktree = required(args.worktree ? String(args.worktree) : void 0, "worktree");
+  const cwd = path31.resolve(worktree);
+  const summary = runHarnessVerifyCommands(cwd);
+  const emitJson = args.json === true || args.json === "true";
+  const payload = { passed: summary.passed, worktree: cwd, steps: summary.steps };
+  if (emitJson) console.log(JSON.stringify(payload, null, 2));
+  else console.log(summary.passed ? "local plan verify passed" : "local plan verify failed");
+  if (!summary.passed) process.exit(1);
+}
 async function verifyPlan(args) {
   const planId = required(args.plan ? String(args.plan) : void 0, "plan");
+  const localOnly = args.local === true || args.local === "true";
+  if (localOnly) {
+    verifyPlanLocal(args);
+    return;
+  }
   const slug = loadUserConfig().agentOsSlug;
   if (!slug) {
     console.error("requires agentOsSlug in ~/.kynver/config.json for verify (session route)");
@@ -5142,6 +5857,52 @@ async function verifyPlan(args) {
   console.log(JSON.stringify(parsed, null, 2));
 }
 
+// src/harness-verify-cli.ts
+import path32 from "node:path";
+function runHarnessVerifyCli(args) {
+  const cwd = path32.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
+  const emitJson = args.json === true || args.json === "true" || args.emitJson === true || args.emitJson === "true";
+  const commands = [];
+  const rawCmd = args.command;
+  if (Array.isArray(rawCmd)) {
+    for (const c of rawCmd) commands.push(String(c));
+  } else if (typeof rawCmd === "string") {
+    commands.push(rawCmd);
+  }
+  const summary = runHarnessVerifyCommands(
+    cwd,
+    commands.length ? commands : DEFAULT_HARNESS_VERIFY_COMMANDS,
+    {
+      waitForAdmissionMs: args.waitForAdmissionMs ? Number(args.waitForAdmissionMs) : void 0,
+      timeoutMs: args.timeoutMs ? Number(args.timeoutMs) : void 0
+    }
+  );
+  const payload = {
+    passed: summary.passed,
+    worktree: cwd,
+    steps: summary.steps.map((s) => ({
+      command: s.command,
+      ok: s.result.ok,
+      exitCode: s.result.exitCode,
+      admitted: s.result.admitted,
+      wrappedWithSystemd: s.result.wrappedWithSystemd,
+      nodeOptionsFlag: s.result.nodeOptionsFlag,
+      admission: s.result.admission,
+      stderr: s.result.stderr.slice(0, 4e3)
+    }))
+  };
+  if (emitJson) {
+    console.log(JSON.stringify(payload, null, 2));
+  } else {
+    console.log(summary.passed ? "harness verify passed" : "harness verify failed");
+    for (const step of payload.steps) {
+      console.log(`  ${step.ok ? "\u2713" : "\u2717"} ${step.command} (exit ${step.exitCode}, systemd=${step.wrappedWithSystemd})`);
+      if (!step.ok && step.stderr) console.log(`    ${step.stderr.split("\n")[0]}`);
+    }
+  }
+  process.exit(summary.passed ? 0 : 1);
+}
+
 // src/plan-persist-cli.ts
 import { readFileSync as readFileSync8 } from "node:fs";
 var OPERATIONS = ["create", "add_version", "update_metadata"];
@@ -5243,7 +6004,7 @@ function runCleanupCli(args) {
 }
 
 // src/monitor/monitor.service.ts
-import path30 from "node:path";
+import path34 from "node:path";
 
 // src/monitor/monitor.classify.ts
 function expectedLeaseOwner(runId) {
@@ -5300,10 +6061,10 @@ function classifyWorkerHealth(input) {
 
 // src/monitor/monitor.store.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync6, readdirSync as readdirSync7, unlinkSync as unlinkSync2 } from "node:fs";
-import path29 from "node:path";
+import path33 from "node:path";
 function monitorsDir() {
   const { harnessRoot } = getHarnessPaths();
-  const dir = path29.join(harnessRoot, "monitors");
+  const dir = path33.join(harnessRoot, "monitors");
   mkdirSync6(dir, { recursive: true });
   return dir;
 }
@@ -5311,7 +6072,7 @@ function monitorIdFor(runId, workerName) {
   return workerName ? `${safeSlug(runId)}--${safeSlug(workerName)}` : safeSlug(runId);
 }
 function monitorPath(monitorId) {
-  return path29.join(monitorsDir(), `${monitorId}.json`);
+  return path33.join(monitorsDir(), `${monitorId}.json`);
 }
 function loadMonitorSession(monitorId) {
   return readJson(monitorPath(monitorId), void 0);
@@ -5332,7 +6093,7 @@ function listMonitorSessions() {
   for (const name of readdirSync7(dir)) {
     if (!name.endsWith(".json")) continue;
     const session = readJson(
-      path29.join(dir, name),
+      path33.join(dir, name),
       void 0
     );
     if (!session?.monitorId) continue;
@@ -5423,7 +6184,7 @@ async function fetchTaskLeasesForWorkers(input) {
 // src/monitor/monitor.service.ts
 function workerRecord2(runId, name) {
   return readJson(
-    path30.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
+    path34.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
     void 0
   );
 }
@@ -5626,17 +6387,17 @@ async function runMonitorLoop(args) {
 // src/monitor/monitor-spawn.ts
 import { spawn as spawn4 } from "node:child_process";
 import { closeSync as closeSync4, existsSync as existsSync19, openSync as openSync4 } from "node:fs";
-import path31 from "node:path";
+import path35 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveDefaultCliPath2() {
-  return path31.join(fileURLToPath3(new URL(".", import.meta.url)), "..", "cli.js");
+  return path35.join(fileURLToPath3(new URL(".", import.meta.url)), "..", "cli.js");
 }
 function spawnMonitorSidecar(opts) {
   const cliPath = opts.cliPath ?? resolveDefaultCliPath2();
   if (!existsSync19(cliPath)) return void 0;
   const monitorId = monitorIdFor(opts.runId, opts.workerName);
   const { harnessRoot } = getHarnessPaths();
-  const logPath = path31.join(harnessRoot, "monitors", `${monitorId}.log`);
+  const logPath = path35.join(harnessRoot, "monitors", `${monitorId}.log`);
   let logFd;
   try {
     logFd = openSync4(logPath, "a");
@@ -5755,6 +6516,453 @@ async function monitorTickCli(args) {
   console.log(JSON.stringify(tick, null, 2));
 }
 
+// src/doctor/runtime-takeover.ts
+import path37 from "node:path";
+
+// src/doctor/runtime-takeover.probes.ts
+import { accessSync, constants, existsSync as existsSync20, readFileSync as readFileSync9 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import path36 from "node:path";
+import { spawnSync as spawnSync6 } from "node:child_process";
+function captureCommand(bin, args) {
+  try {
+    const res = spawnSync6(bin, args, { encoding: "utf8" });
+    const stdout = (res.stdout || "").trim();
+    const stderr = (res.stderr || "").trim();
+    const ok = res.status === 0;
+    return {
+      ok,
+      stdout,
+      stderr,
+      error: res.error?.message
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      stdout: "",
+      stderr: "",
+      error: error.message
+    };
+  }
+}
+function tokenPrefix(token) {
+  const trimmed = token?.trim();
+  if (!trimmed) return void 0;
+  return trimmed.length <= 12 ? `${trimmed}\u2026` : `${trimmed.slice(0, 12)}\u2026`;
+}
+function isWritable(target) {
+  if (!existsSync20(target)) return false;
+  try {
+    accessSync(target, constants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var defaultRuntimeTakeoverProbes = {
+  packageVersion: () => PACKAGE_VERSION,
+  commandOnPath: (bin) => captureCommand(process.platform === "win32" ? "where" : "which", [bin]),
+  kynverVersion: (bin) => captureCommand(bin, ["--version"]),
+  loadConfig: () => loadUserConfig(),
+  configFilePath: () => path36.join(homedir6(), ".kynver", "config.json"),
+  credentialsFilePath: () => path36.join(homedir6(), ".kynver", "credentials"),
+  readCredentials: () => {
+    const credPath = path36.join(homedir6(), ".kynver", "credentials");
+    if (!existsSync20(credPath)) {
+      return { hasApiKey: false };
+    }
+    try {
+      const parsed = JSON.parse(readFileSync9(credPath, "utf8"));
+      return {
+        hasApiKey: Boolean(parsed.apiKey?.trim()),
+        runnerTokenPrefix: tokenPrefix(parsed.runnerToken),
+        runnerTokenAgentOsId: parsed.runnerTokenAgentOsId
+      };
+    } catch {
+      return { hasApiKey: false };
+    }
+  },
+  envSnapshot: () => ({
+    kynverApiUrl: process.env.KYNVER_API_URL?.trim() || void 0,
+    openclawCronFireBaseUrl: process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim() || void 0,
+    kynverRunnerTokenPrefix: tokenPrefix(process.env.KYNVER_RUNNER_TOKEN),
+    kynverRuntimeSecret: Boolean(process.env.KYNVER_RUNTIME_SECRET?.trim()),
+    openclawCronSecret: Boolean(process.env.OPENCLAW_CRON_SECRET?.trim()),
+    kynverHarnessRoot: process.env.KYNVER_HARNESS_ROOT?.trim() || void 0,
+    opusHarnessRoot: process.env.OPUS_HARNESS_ROOT?.trim() || void 0,
+    kynverSchedulerProvider: process.env.KYNVER_SCHEDULER_PROVIDER?.trim() || void 0
+  }),
+  harnessRoot: () => resolveHarnessRoot(),
+  legacyOpenclawHarnessRoot: () => path36.join(homedir6(), ".openclaw", "harness"),
+  pathExists: (target) => existsSync20(target),
+  pathWritable: (target) => isWritable(target),
+  vercelVersion: () => captureCommand("vercel", ["--version"]),
+  vercelWhoami: () => captureCommand("vercel", ["whoami"])
+};
+
+// src/doctor/runtime-takeover.ts
+function check(partial) {
+  return partial;
+}
+function summarizeCounts(sections) {
+  const counts = { pass: 0, warn: 0, fail: 0 };
+  for (const section of sections) {
+    for (const item of section.checks) {
+      counts[item.status] += 1;
+    }
+  }
+  return counts;
+}
+function assessCliPackage(probes) {
+  const runningVersion = probes.packageVersion();
+  const which = probes.commandOnPath("kynver");
+  const onPath = which.ok && which.stdout.length > 0;
+  const firstPath = onPath ? which.stdout.split(/\r?\n/)[0]?.trim() : void 0;
+  const displayCliPath = firstPath ? displayUserPath(firstPath) : void 0;
+  const checks = [
+    check({
+      id: "cli_running_version",
+      label: "Running @kynver-app/runtime version",
+      status: "pass",
+      summary: `@kynver-app/runtime ${runningVersion}`,
+      details: { version: runningVersion }
+    }),
+    check({
+      id: "cli_on_path",
+      label: "kynver executable on PATH",
+      status: onPath ? "pass" : "warn",
+      summary: onPath ? `Found ${displayCliPath}` : "kynver not found on PATH (invoked via node/npx?)",
+      remediation: onPath ? void 0 : "Install globally (`npm i -g @kynver-app/runtime`) or invoke via `npx @kynver-app/runtime`.",
+      details: { path: displayCliPath }
+    })
+  ];
+  if (onPath && firstPath) {
+    const versionProbe = probes.kynverVersion(firstPath);
+    const installedVersion = versionProbe.stdout.replace(/^kynver\s+/i, "").trim() || void 0;
+    const versionMatch = versionProbe.ok && (!installedVersion || installedVersion === runningVersion);
+    checks.push(
+      check({
+        id: "cli_installed_version",
+        label: "Installed kynver CLI version matches running package",
+        status: versionMatch ? "pass" : "warn",
+        summary: versionProbe.ok && installedVersion ? versionMatch ? `Installed ${installedVersion}` : `Installed ${installedVersion} differs from running ${runningVersion}` : versionProbe.error ? `Could not read installed version (${versionProbe.error})` : versionProbe.stderr || "Could not read installed version",
+        remediation: versionMatch ? void 0 : "Reinstall or rebuild @kynver-app/runtime so PATH kynver matches the harness worktree version.",
+        details: { installedVersion, runningVersion, path: displayCliPath }
+      })
+    );
+  }
+  return { id: "cli_package", label: "CLI / package", checks };
+}
+function assessUserConfig(probes) {
+  const configPath = probes.configFilePath();
+  const displayConfigPath = displayUserPath(configPath);
+  const exists = probes.pathExists(configPath);
+  const config = probes.loadConfig();
+  const checks = [
+    check({
+      id: "config_file",
+      label: "~/.kynver/config.json present",
+      status: exists ? "pass" : "fail",
+      summary: exists ? `Found ${displayConfigPath}` : `Missing ${displayConfigPath}`,
+      remediation: exists ? void 0 : "Run `kynver setup --api-base-url <url> --agent-os-id <id> --repo <path>`.",
+      details: { configPath: displayConfigPath }
+    })
+  ];
+  if (exists) {
+    const apiBaseUrl = config.apiBaseUrl?.trim();
+    const agentOsId = config.agentOsId?.trim();
+    const defaultRepo = config.defaultRepo?.trim();
+    const displayDefaultRepo = defaultRepo ? displayUserPath(defaultRepo) : null;
+    checks.push(
+      check({
+        id: "config_api_base_url",
+        label: "Default API base URL",
+        status: apiBaseUrl ? "pass" : "warn",
+        summary: apiBaseUrl ?? "Not set in config (KYNVER_API_URL / --base-url required per command)",
+        remediation: apiBaseUrl ? void 0 : "Set `apiBaseUrl` via `kynver setup --api-base-url https://\u2026`.",
+        details: { apiBaseUrl: apiBaseUrl ?? null }
+      }),
+      check({
+        id: "config_agent_os_id",
+        label: "Default AgentOS id",
+        status: agentOsId ? "pass" : "warn",
+        summary: agentOsId ?? "Not set (pass --agent-os-id on daemon/dispatch/worker commands)",
+        remediation: agentOsId ? void 0 : "Set `agentOsId` via `kynver setup --agent-os-id <uuid>`.",
+        details: { agentOsId: agentOsId ?? null, agentOsSlug: config.agentOsSlug ?? null }
+      }),
+      check({
+        id: "config_default_repo",
+        label: "Default repo path",
+        status: defaultRepo ? "pass" : "warn",
+        summary: displayDefaultRepo ?? "Not set (pass --repo on `kynver run create`)",
+        remediation: defaultRepo ? void 0 : "Set `defaultRepo` via `kynver setup --repo /path/to/repo`.",
+        details: {
+          defaultRepo: displayDefaultRepo,
+          harnessRoot: config.harnessRoot ? redactHomePath(config.harnessRoot) : null
+        }
+      })
+    );
+  }
+  return { id: "user_config", label: "User config (~/.kynver)", checks };
+}
+function assessRunnerToken(probes) {
+  const config = probes.loadConfig();
+  const targetAgentOsId = config.agentOsId?.trim();
+  const creds = probes.readCredentials();
+  const env = probes.envSnapshot();
+  const credPath = probes.credentialsFilePath();
+  const displayCredPath = displayUserPath(credPath);
+  const envToken = env.kynverRunnerTokenPrefix;
+  const savedToken = creds.runnerTokenPrefix;
+  const savedAgentOsId = creds.runnerTokenAgentOsId;
+  const scopedSaved = Boolean(savedToken) && (!targetAgentOsId || !savedAgentOsId || savedAgentOsId === targetAgentOsId);
+  const hasScoped = Boolean(envToken?.startsWith("krc1.")) || scopedSaved && savedToken?.startsWith("krc1.");
+  const checks = [
+    check({
+      id: "runner_token_scoped",
+      label: "Scoped runner token (krc1.*) ready",
+      status: hasScoped ? "pass" : "fail",
+      summary: hasScoped ? envToken ? "KYNVER_RUNNER_TOKEN is set (scoped prefix shown)" : `Saved scoped token for agentOsId ${savedAgentOsId ?? targetAgentOsId ?? "(unknown)"}` : "No scoped runner token for the configured AgentOS workspace",
+      remediation: hasScoped ? void 0 : "Run `kynver login` then `kynver runner credential --agent-os-id <id>` (or `kynver setup` with API key).",
+      details: {
+        source: envToken ? "env" : savedToken ? "credentials" : "none",
+        tokenPrefix: envToken ?? (scopedSaved ? savedToken : void 0),
+        agentOsId: targetAgentOsId ?? savedAgentOsId ?? null,
+        credentialsPath: displayCredPath
+      }
+    }),
+    check({
+      id: "runner_token_agent_os_match",
+      label: "Saved runner token matches configured agentOsId",
+      status: !savedToken || !targetAgentOsId || !savedAgentOsId || savedAgentOsId === targetAgentOsId ? "pass" : "warn",
+      summary: !savedToken || !savedAgentOsId ? "No saved token agentOsId to compare" : !targetAgentOsId ? "Config agentOsId unset \u2014 token scope not validated against config" : savedAgentOsId === targetAgentOsId ? "Saved token scoped to configured agentOsId" : `Saved token is for ${savedAgentOsId}, config expects ${targetAgentOsId}`,
+      remediation: savedToken && targetAgentOsId && savedAgentOsId && savedAgentOsId !== targetAgentOsId ? "`kynver runner credential --agent-os-id <configured-id>` to mint a workspace-bound token." : void 0,
+      details: { configuredAgentOsId: targetAgentOsId ?? null, savedAgentOsId: savedAgentOsId ?? null }
+    }),
+    check({
+      id: "runner_api_key_for_refresh",
+      label: "API key available for token refresh",
+      status: creds.hasApiKey || Boolean(process.env.KYNVER_API_KEY?.trim()) ? "pass" : "warn",
+      summary: creds.hasApiKey || process.env.KYNVER_API_KEY ? "KYNVER API key present for runner credential mint/refresh" : "No API key \u2014 401 callback recovery cannot auto-mint a replacement token",
+      remediation: creds.hasApiKey || process.env.KYNVER_API_KEY ? void 0 : "Run `kynver login --api-key \u2026`.",
+      details: { credentialsPath: displayCredPath, hasApiKey: creds.hasApiKey || Boolean(process.env.KYNVER_API_KEY) }
+    })
+  ];
+  return { id: "runner_token", label: "Runner token readiness", checks };
+}
+function assessVercelCli(probes) {
+  const version = probes.vercelVersion();
+  const whoami = probes.vercelWhoami();
+  const installed = version.ok;
+  return {
+    id: "vercel_cli",
+    label: "Vercel CLI",
+    checks: [
+      check({
+        id: "vercel_installed",
+        label: "Vercel CLI installed",
+        status: installed ? "pass" : "warn",
+        summary: installed ? version.stdout || "vercel CLI found" : version.error ?? "vercel not found on PATH",
+        remediation: installed ? void 0 : "Install Vercel CLI (`npm i -g vercel`) for deploy evidence and env pulls.",
+        details: { stderr: version.stderr || null }
+      }),
+      check({
+        id: "vercel_authenticated",
+        label: "Vercel CLI authenticated",
+        status: !installed ? "warn" : whoami.ok ? "pass" : "warn",
+        summary: !installed ? "Skipped \u2014 Vercel CLI not installed" : whoami.ok ? `Authenticated as ${whoami.stdout}` : whoami.stderr || whoami.error || "Not logged in",
+        remediation: installed && !whoami.ok ? "Run `vercel login` and link the Kynver project if needed." : void 0,
+        details: { account: whoami.ok ? whoami.stdout : null }
+      })
+    ]
+  };
+}
+function assessHarnessDirs(probes) {
+  const harnessRoot = probes.harnessRoot();
+  const runsDir = path37.join(harnessRoot, "runs");
+  const worktreesDir = path37.join(harnessRoot, "worktrees");
+  const displayHarnessRoot = redactHomePath(harnessRoot);
+  const displayRunsDir = redactHomePath(runsDir);
+  const displayWorktreesDir = redactHomePath(worktreesDir);
+  const runsExists = probes.pathExists(runsDir);
+  const worktreesExists = probes.pathExists(worktreesDir);
+  return {
+    id: "harness_dirs",
+    label: "Harness / daemon directories",
+    checks: [
+      check({
+        id: "harness_root",
+        label: "Harness root resolved",
+        status: "pass",
+        summary: displayHarnessRoot,
+        details: { harnessRoot: displayHarnessRoot }
+      }),
+      check({
+        id: "harness_runs_dir",
+        label: "Runs directory ready",
+        status: runsExists && probes.pathWritable(runsDir) ? "pass" : runsExists ? "warn" : "warn",
+        summary: runsExists ? probes.pathWritable(runsDir) ? `Writable ${displayRunsDir}` : `Exists but not writable: ${displayRunsDir}` : `Will be created on first run: ${displayRunsDir}`,
+        remediation: runsExists && !probes.pathWritable(runsDir) ? `Fix permissions on ${displayRunsDir} or set KYNVER_HARNESS_ROOT to a writable path.` : void 0,
+        details: { runsDir: displayRunsDir, exists: runsExists, writable: probes.pathWritable(runsDir) }
+      }),
+      check({
+        id: "harness_worktrees_dir",
+        label: "Worktrees directory ready",
+        status: worktreesExists && probes.pathWritable(worktreesDir) ? "pass" : "warn",
+        summary: worktreesExists ? probes.pathWritable(worktreesDir) ? `Writable ${displayWorktreesDir}` : `Exists but not writable: ${displayWorktreesDir}` : `Will be created on first worker: ${displayWorktreesDir}`,
+        remediation: worktreesExists && !probes.pathWritable(worktreesDir) ? `Fix permissions on ${displayWorktreesDir}.` : void 0,
+        details: { worktreesDir: displayWorktreesDir, exists: worktreesExists, writable: probes.pathWritable(worktreesDir) }
+      })
+    ]
+  };
+}
+function assessCallbackAuth(probes) {
+  const config = probes.loadConfig();
+  const env = probes.envSnapshot();
+  const baseUrl = env.kynverApiUrl ?? config.apiBaseUrl?.trim() ?? env.openclawCronFireBaseUrl;
+  const usingLegacyBase = !env.kynverApiUrl && !config.apiBaseUrl && Boolean(env.openclawCronFireBaseUrl);
+  const legacySecret = env.openclawCronSecret || env.kynverRuntimeSecret;
+  const envScoped = env.kynverRunnerTokenPrefix?.startsWith("krc1.");
+  const creds = probes.readCredentials();
+  const savedScoped = creds.runnerTokenPrefix?.startsWith("krc1.");
+  const checks = [
+    check({
+      id: "callback_base_url",
+      label: "Callback base URL configured",
+      status: baseUrl ? usingLegacyBase ? "warn" : "pass" : "fail",
+      summary: baseUrl ? usingLegacyBase ? `Using legacy OPENCLAW_CRON_FIRE_BASE_URL (${baseUrl})` : baseUrl : "No KYNVER_API_URL, config apiBaseUrl, or legacy OpenClaw base URL",
+      remediation: baseUrl ? usingLegacyBase ? "Migrate to KYNVER_API_URL or `kynver setup --api-base-url` and drop OPENCLAW_CRON_FIRE_BASE_URL." : void 0 : "Set KYNVER_API_URL or run `kynver setup --api-base-url https://\u2026`.",
+      details: {
+        source: env.kynverApiUrl ? "KYNVER_API_URL" : config.apiBaseUrl ? "config.apiBaseUrl" : env.openclawCronFireBaseUrl ? "OPENCLAW_CRON_FIRE_BASE_URL" : "none",
+        baseUrl: baseUrl ?? null
+      }
+    }),
+    check({
+      id: "callback_auth_mode",
+      label: "Callback auth uses scoped runner token",
+      status: envScoped || savedScoped ? "pass" : legacySecret ? "warn" : "fail",
+      summary: envScoped ? "KYNVER_RUNNER_TOKEN scoped token will be sent as X-Kynver-Runner-Token" : savedScoped ? "Saved krc1.* token in ~/.kynver/credentials" : legacySecret ? "Deployment-level KYNVER_RUNTIME_SECRET / OPENCLAW_CRON_SECRET in use (legacy headers)" : "No callback secret configured",
+      remediation: envScoped || savedScoped ? void 0 : "Mint a scoped token: `kynver runner credential --agent-os-id <id>`. Avoid shared OPENCLAW_CRON_SECRET on user runners.",
+      details: {
+        mode: envScoped || savedScoped ? "scoped" : legacySecret ? "legacy_global_secret" : "missing",
+        legacyHeadersWhenNotScoped: ["X-OpenClaw-Cron-Secret", "X-Kynver-Runtime-Secret"]
+      }
+    })
+  ];
+  return { id: "callback_auth", label: "Callback auth / config", checks };
+}
+function assessOpenclawHotspots(probes) {
+  const env = probes.envSnapshot();
+  const harnessRoot = probes.harnessRoot();
+  const legacyRoot = probes.legacyOpenclawHarnessRoot();
+  const displayHarnessRoot = redactHomePath(harnessRoot);
+  const displayLegacyRoot = redactHomePath(legacyRoot);
+  const displayOpusHarnessRoot = env.opusHarnessRoot ? redactHomePath(env.opusHarnessRoot) : null;
+  const legacyHarnessActive = harnessRoot === legacyRoot && probes.pathExists(legacyRoot);
+  const schedulerOpenclaw = !env.kynverSchedulerProvider || env.kynverSchedulerProvider === "openclaw-cron";
+  const checks = [
+    check({
+      id: "hotspot_legacy_harness_root",
+      label: "Legacy ~/.openclaw/harness still active",
+      status: legacyHarnessActive ? "warn" : "pass",
+      summary: legacyHarnessActive ? `Harness root is legacy ${displayLegacyRoot}` : env.opusHarnessRoot ? `OPUS_HARNESS_ROOT override in use (${displayOpusHarnessRoot})` : `Using ${displayHarnessRoot}`,
+      remediation: legacyHarnessActive ? "Set KYNVER_HARNESS_ROOT=~/.kynver/harness (or run setup), migrate artifacts, retire OPUS_HARNESS_ROOT." : env.opusHarnessRoot ? "Prefer KYNVER_HARNESS_ROOT over OPUS_HARNESS_ROOT." : void 0,
+      details: { harnessRoot: displayHarnessRoot, legacyRoot: displayLegacyRoot, opusHarnessRoot: displayOpusHarnessRoot }
+    }),
+    check({
+      id: "hotspot_openclaw_env_secrets",
+      label: "OpenClaw deployment secrets in runner env",
+      status: env.openclawCronSecret || env.openclawCronFireBaseUrl ? "warn" : "pass",
+      summary: env.openclawCronSecret || env.openclawCronFireBaseUrl ? [
+        env.openclawCronSecret ? "OPENCLAW_CRON_SECRET set" : null,
+        env.openclawCronFireBaseUrl ? "OPENCLAW_CRON_FIRE_BASE_URL set" : null
+      ].filter(Boolean).join("; ") : "No OpenClaw cron env overrides on this runner",
+      remediation: env.openclawCronSecret || env.openclawCronFireBaseUrl ? "Move to KYNVER_API_URL + scoped runner tokens; unset OpenClaw cron env on user-hosted runners." : void 0
+    }),
+    check({
+      id: "hotspot_openclaw_scheduler",
+      label: "openclaw-cron scheduler dependency (deployment)",
+      status: schedulerOpenclaw ? "warn" : "pass",
+      summary: schedulerOpenclaw ? env.kynverSchedulerProvider === "openclaw-cron" ? "KYNVER_SCHEDULER_PROVIDER=openclaw-cron \u2014 AgentOS ticks still routed via OpenClaw local cron adapter" : "KYNVER_SCHEDULER_PROVIDER unset \u2014 server may fall back to openclaw-cron when QStash is absent" : `KYNVER_SCHEDULER_PROVIDER=${env.kynverSchedulerProvider}`,
+      remediation: schedulerOpenclaw ? "On Kynver-hosted scheduler: set KYNVER_SCHEDULER_PROVIDER=qstash where QStash is configured; retire openclaw-cron stub when runtime daemon owns dispatch." : void 0,
+      details: { schedulerProvider: env.kynverSchedulerProvider ?? null }
+    }),
+    check({
+      id: "hotspot_lease_source_names",
+      label: "Harness lease/completion source names",
+      status: "pass",
+      summary: "Runtime uses kynver-harness:* lease owners and completion source kynver-harness (OpenClaw names retired in runtime)",
+      details: {
+        leaseOwnerPattern: "kynver-harness:<runId>",
+        completionSource: "kynver-harness",
+        note: "OpenClaw adapter remains optional in packages/kynver-openclaw-agent-os only"
+      }
+    })
+  ];
+  return { id: "openclaw_hotspots", label: "OpenClaw dependency hotspots", checks };
+}
+function assessRuntimeTakeoverReadiness(probes = defaultRuntimeTakeoverProbes) {
+  const sections = [
+    assessCliPackage(probes),
+    assessUserConfig(probes),
+    assessRunnerToken(probes),
+    assessVercelCli(probes),
+    assessHarnessDirs(probes),
+    assessCallbackAuth(probes),
+    assessOpenclawHotspots(probes)
+  ];
+  const counts = summarizeCounts(sections);
+  const ready = counts.fail === 0;
+  const summary = ready ? counts.warn > 0 ? `Ready with ${counts.warn} warning(s) \u2014 review remediation before retiring OpenClaw as primary runtime agent.` : "Ready \u2014 Kynver runtime can serve as primary runtime agent on this host." : `${counts.fail} blocking check(s) \u2014 fix failures before OpenClaw takeover.`;
+  return {
+    command: "doctor runtime-takeover",
+    ready,
+    summary,
+    counts,
+    sections
+  };
+}
+
+// src/doctor/runtime-takeover-cli.ts
+function runRuntimeTakeoverDoctorCli() {
+  const report = assessRuntimeTakeoverReadiness();
+  console.log(JSON.stringify(report, null, 2));
+  if (!report.ready) {
+    process.exitCode = 1;
+  }
+}
+
+// src/command-center-contract-cli.ts
+async function runCommandCenterContractCli(args) {
+  const config = loadUserConfig();
+  const agentOsId = (args.agentOsId ? String(args.agentOsId) : config.agentOsId) || "";
+  if (!agentOsId) {
+    console.error("requires --agent-os-id or agentOsId in ~/.kynver/config.json");
+    process.exit(1);
+  }
+  const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : config.apiBaseUrl);
+  const secret = await resolveCallbackSecretWithMint(
+    args.secret ? String(args.secret) : void 0,
+    agentOsId,
+    { baseUrl: base }
+  );
+  const qs = new URLSearchParams();
+  if (typeof args.since === "string" && args.since.trim()) qs.set("since", args.since.trim());
+  if (args.limit != null && String(args.limit).trim()) {
+    const n = Number(args.limit);
+    if (Number.isFinite(n) && n > 0) qs.set("limit", String(Math.floor(n)));
+  }
+  const suffix = qs.toString() ? `?${qs.toString()}` : "";
+  const url = `${base}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/command-center/dashboard-contract${suffix}`;
+  const res = await getJson(url, secret);
+  if (!res.ok) {
+    console.error(`dashboard-contract GET failed: HTTP ${res.status}`);
+    if (res.response) console.error(JSON.stringify(res.response, null, 2));
+    process.exit(1);
+  }
+  console.log(JSON.stringify(res.response, null, 2));
+}
+
 // src/cli.ts
 function isHelpFlag(arg) {
   return arg === "help" || arg === "--help" || arg === "-h";
@@ -5776,7 +6984,7 @@ function usage(code = 0) {
       "  kynver run create --repo /path/repo [--name name] [--base origin/main]",
       "  kynver run list",
       "  kynver run status --run RUN_ID",
-      "  kynver run dispatch --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--execute] [--lane any|implementation|review|landing] [--executor harness] [--max-starts 1] [--lease-ms MS] [--owned path[,path]] [--model claude-opus-4-8] [--disk-path /]",
+      "  kynver run dispatch --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--execute] [--lane any|implementation|review|landing] [--target-task-id TASK_ID] [--executor harness] [--max-starts 1] [--lease-ms MS] [--owned path[,path]] [--model claude-opus-4-8] [--disk-path /]",
       "  kynver run sweep --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--grace-ms MS]",
       '  kynver worker start --run RUN_ID --name worker --task "..." [--owned path[,path]] [--model MODEL] [--provider claude|cursor] [--agent-os-id AOS_ID] [--task-id TASK_ID] [--wait]',
       "  kynver worker status --run RUN_ID --name worker",
@@ -5786,7 +6994,8 @@ function usage(code = 0) {
       "  kynver worker auto-complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--poll-ms 5000] [--max-total-ms 21600000] [--complete-attempts 3] [--complete-backoff-ms 5000] [--base-url URL] [--secret SECRET]",
       "  kynver run reconcile",
       "  kynver plan progress --plan PLAN_ID --row ROW_KEY --role ROLE --status STATUS [--task TASK_ID] [--note NOTE] [--evidence type:value] [--agent-os-id AOS_ID]",
-      "  kynver plan verify --plan PLAN_ID [--worktree PATH] [--task TASK_ID] [--human-override]",
+      "  kynver plan verify --plan PLAN_ID [--worktree PATH] [--task TASK_ID] [--human-override] [--local]",
+      "  kynver harness verify --worktree PATH [--command CMD] [--json] [--wait-for-admission-ms MS] [--timeout-ms MS]",
       "  kynver plan persist --operation create|add_version|update_metadata --title TITLE (--body-file PATH | --body TEXT) [--slug SLUG] [--plan PLAN_ID] [--summary TEXT] [--failure-kind approval_guard|auth|network|server|tool_interruption]",
       "  kynver plan outbox list",
       "  kynver plan outbox drain [--max N] [--id OUTBOX_ID]",
@@ -5797,7 +7006,9 @@ function usage(code = 0) {
       "  kynver monitor list",
       "  kynver monitor tick --run RUN_ID [--name worker] [--agent-os-id AOS_ID] [--auto-complete] [--renew-leases]",
       "  kynver monitor auto-complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--base-url URL] [--secret SECRET]",
-      "  kynver monitor run-loop --run RUN_ID --monitor-id ID [--name worker] [--agent-os-id AOS_ID] [--poll-ms MS] [--auto-complete] [--renew-leases]"
+      "  kynver monitor run-loop --run RUN_ID --monitor-id ID [--name worker] [--agent-os-id AOS_ID] [--poll-ms MS] [--auto-complete] [--renew-leases]",
+      "  kynver doctor runtime-takeover",
+      "  kynver board contract [--agent-os-id ID] [--base-url URL] [--since ISO] [--limit N]"
     ].join("\n")
   );
   process.exit(code);
@@ -5808,7 +7019,7 @@ async function main(argv = process.argv.slice(2)) {
   const scope = argv.shift();
   let action;
   let rest;
-  if (scope === "run" || scope === "worker" || scope === "plan" || scope === "runner" || scope === "monitor") {
+  if (scope === "run" || scope === "worker" || scope === "plan" || scope === "runner" || scope === "harness" || scope === "monitor" || scope === "doctor" || scope === "board") {
     action = argv.shift();
     rest = argv;
   } else {
@@ -5825,6 +7036,7 @@ async function main(argv = process.argv.slice(2)) {
   if (scope === "daemon") return void await runDaemon(args);
   if (scope === "plan" && action === "progress") return void await emitPlanProgress(args);
   if (scope === "plan" && action === "verify") return void await verifyPlan(args);
+  if (scope === "harness" && action === "verify") return runHarnessVerifyCli(args);
   if (scope === "plan" && action === "persist") return void await runPlanPersist(args);
   if (scope === "plan" && action === "outbox") {
     const outboxAction = rest.shift();
@@ -5833,6 +7045,10 @@ async function main(argv = process.argv.slice(2)) {
     unknownCommand("plan", `outbox ${outboxAction ?? ""}`.trim());
   }
   if (scope === "cleanup") return runCleanupCli(args);
+  if (scope === "doctor" && action === "runtime-takeover") return runRuntimeTakeoverDoctorCli();
+  if (scope === "board" && action === "contract") {
+    return void await runCommandCenterContractCli(args);
+  }
   if (scope === "run" && action === "create") return createRun(args);
   if (scope === "run" && action === "list") return listRuns();
   if (scope === "run" && action === "status") return runStatus(args);
@@ -5865,19 +7081,317 @@ if (isCliEntry) {
     process.exit(1);
   });
 }
+
+// src/vercel/vercel-url.ts
+var VERCEL_HOST_RE = /(^|\.)vercel\.app$/i;
+function tryParseUrl(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  try {
+    return new URL(trimmed);
+  } catch {
+    return null;
+  }
+}
+function parseDashboardDeployment(url) {
+  const parts = url.pathname.split("/").filter(Boolean);
+  if (parts.length < 3) return null;
+  const deploymentId = parts[parts.length - 1]?.trim();
+  if (!deploymentId || deploymentId === "deployments") return null;
+  return deploymentId;
+}
+function parseDeploymentsSegment(url) {
+  const parts = url.pathname.split("/").filter(Boolean);
+  const idx = parts.indexOf("deployments");
+  if (idx < 0 || idx >= parts.length - 1) return null;
+  const deploymentId = parts[idx + 1]?.trim();
+  return deploymentId || null;
+}
+function classifyVercelUrl(raw) {
+  const empty = {
+    kind: "unknown",
+    previewUrl: null,
+    inspectTarget: null,
+    deploymentId: null
+  };
+  const trimmed = raw.trim();
+  if (!trimmed) return empty;
+  if (/^dpl_[a-z0-9]+$/i.test(trimmed)) {
+    return {
+      kind: "deployment_id",
+      previewUrl: null,
+      inspectTarget: trimmed,
+      deploymentId: trimmed
+    };
+  }
+  const url = tryParseUrl(trimmed);
+  if (!url) return empty;
+  if (VERCEL_HOST_RE.test(url.hostname)) {
+    const hostUrl = url.origin;
+    return {
+      kind: "deployment_host",
+      previewUrl: hostUrl,
+      inspectTarget: hostUrl,
+      deploymentId: null
+    };
+  }
+  if (url.hostname === "vercel.com" || url.hostname.endsWith(".vercel.com")) {
+    const deploymentId = parseDeploymentsSegment(url) ?? parseDashboardDeployment(url);
+    return {
+      kind: "dashboard",
+      previewUrl: null,
+      inspectTarget: deploymentId,
+      deploymentId
+    };
+  }
+  return empty;
+}
+function isDashboardVercelUrl(raw) {
+  return classifyVercelUrl(raw).kind === "dashboard";
+}
+
+// src/vercel/vercel-github-status.ts
+var VERCEL_CONTEXT_RE = /vercel/i;
+function normalizeGitHubStatusState(state) {
+  const value = typeof state === "string" ? state.trim().toLowerCase() : "";
+  if (value === "success") return "success";
+  if (value === "pending") return "pending";
+  if (value === "failure") return "failure";
+  if (value === "error") return "error";
+  return "unknown";
+}
+function isVercelStatusContext(context) {
+  const label = typeof context === "string" ? context.trim() : "";
+  return Boolean(label && VERCEL_CONTEXT_RE.test(label));
+}
+function pickVercelStatusContext(statuses) {
+  const rows = Array.isArray(statuses) ? statuses : [];
+  const vercelRows = rows.filter((row) => isVercelStatusContext(row.context));
+  if (vercelRows.length === 0) return null;
+  const score = (state) => {
+    if (state === "failure" || state === "error") return 0;
+    if (state === "pending") return 1;
+    if (state === "success") return 2;
+    return 1;
+  };
+  let best = null;
+  let bestScore = Infinity;
+  for (const row of vercelRows) {
+    const rowScore = score(normalizeGitHubStatusState(row.state));
+    if (rowScore < bestScore) {
+      best = row;
+      bestScore = rowScore;
+    }
+  }
+  if (!best) return null;
+  const targetUrl = typeof best.target_url === "string" && best.target_url.trim() ? best.target_url.trim() : null;
+  const classified = targetUrl ? classifyVercelUrl(targetUrl) : null;
+  return {
+    context: String(best.context ?? "Vercel").trim(),
+    state: normalizeGitHubStatusState(best.state),
+    targetUrl,
+    description: typeof best.description === "string" && best.description.trim() ? best.description.trim() : null,
+    deploymentId: classified?.deploymentId ?? null,
+    previewUrl: classified?.previewUrl ?? null,
+    dashboardUrl: classified?.kind === "dashboard" ? targetUrl : null
+  };
+}
+
+// src/vercel/vercel-evidence.ts
+import { spawnSync as spawnSync7 } from "node:child_process";
+var DEFAULT_INSPECT_WAIT_SECONDS = 120;
+function mapGitHubStateToEvidence(state) {
+  if (state === "success") return "ready";
+  if (state === "pending") return "building";
+  if (state === "failure" || state === "error") return "error";
+  return "unavailable";
+}
+function evidenceSummary(parts) {
+  return parts.filter(Boolean).join("; ");
+}
+function resolveVercelInspectTarget(rawUrl) {
+  const trimmed = typeof rawUrl === "string" ? rawUrl.trim() : "";
+  if (!trimmed) {
+    return { target: null, classified: null, reason: "missing target_url" };
+  }
+  const classified = classifyVercelUrl(trimmed);
+  if (classified.inspectTarget) {
+    return { target: classified.inspectTarget, classified, reason: null };
+  }
+  if (classified.kind === "dashboard") {
+    return {
+      target: null,
+      classified,
+      reason: "dashboard URL is not valid for vercel inspect"
+    };
+  }
+  return { target: null, classified, reason: "unrecognized Vercel URL" };
+}
+function evidenceFromGitHubVercelStatus(statuses, options = {}) {
+  const observedAt = options.observedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const row = pickVercelStatusContext(statuses);
+  if (!row) {
+    return {
+      status: "not_run",
+      previewUrl: null,
+      deploymentUrl: null,
+      summary: "No Vercel GitHub status context on commit",
+      observedAt,
+      inspectSkipped: true,
+      inspectReason: "no_vercel_status_context",
+      githubState: null,
+      vercelContext: null
+    };
+  }
+  const status = mapGitHubStateToEvidence(row.state);
+  const previewUrl = row.previewUrl ?? row.dashboardUrl;
+  const deploymentUrl = row.previewUrl ?? row.dashboardUrl;
+  return {
+    status,
+    previewUrl,
+    deploymentUrl,
+    summary: evidenceSummary([
+      `GitHub ${row.context}=${row.state}`,
+      row.description ?? "",
+      row.dashboardUrl ? "dashboard target_url (inspect skipped)" : ""
+    ]),
+    observedAt,
+    inspectSkipped: true,
+    inspectReason: row.dashboardUrl && row.state === "success" ? "trusted_github_status_dashboard_url" : row.dashboardUrl ? "dashboard_url_not_inspectable" : "github_status_only",
+    githubState: row.state,
+    vercelContext: row.context
+  };
+}
+function defaultRunVercelInspect(target, waitSeconds) {
+  const args = ["inspect", target, "--wait", String(waitSeconds)];
+  const result = spawnSync7("vercel", args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.error) {
+    return {
+      ok: false,
+      exitCode: result.status,
+      stdout: "",
+      stderr: "",
+      error: result.error.message
+    };
+  }
+  return {
+    ok: result.status === 0,
+    exitCode: result.status ?? 1,
+    stdout: (result.stdout ?? "").trim(),
+    stderr: (result.stderr ?? "").trim(),
+    error: null
+  };
+}
+function parseInspectReady(stdout, stderr) {
+  const blob = `${stdout}
+${stderr}`.toLowerCase();
+  if (/\b(status|state)\s*[:=]\s*(ready|completed)\b/.test(blob)) return true;
+  if (/\bready\b/.test(blob) && !/\bnot ready\b/.test(blob)) return true;
+  return false;
+}
+function collectVercelEvidence(input) {
+  const observedAt = input.observedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const base = evidenceFromGitHubVercelStatus(input.statuses ?? [], { observedAt });
+  const row = pickVercelStatusContext(input.statuses ?? []);
+  if (!row) return base;
+  if (row.state === "success") {
+    return {
+      ...base,
+      inspectSkipped: true,
+      inspectReason: row.dashboardUrl ? "trusted_github_status_dashboard_url" : "trusted_github_status"
+    };
+  }
+  if (!input.allowInspect) {
+    return {
+      ...base,
+      inspectSkipped: true,
+      inspectReason: "inspect_disabled"
+    };
+  }
+  const { target, reason } = resolveVercelInspectTarget(row.targetUrl);
+  if (!target) {
+    return {
+      ...base,
+      inspectSkipped: true,
+      inspectReason: reason ?? "not_inspectable",
+      summary: evidenceSummary([
+        base.summary ?? "",
+        reason ?? "skipped vercel inspect"
+      ])
+    };
+  }
+  const waitSeconds = input.waitSeconds ?? DEFAULT_INSPECT_WAIT_SECONDS;
+  const runInspect = input.runInspect ?? defaultRunVercelInspect;
+  const inspected = runInspect(target, waitSeconds);
+  const observed = (/* @__PURE__ */ new Date()).toISOString();
+  if (inspected.error?.includes("ENOENT")) {
+    return {
+      status: "unavailable",
+      previewUrl: base.previewUrl,
+      deploymentUrl: base.deploymentUrl,
+      summary: "vercel CLI not found on PATH",
+      observedAt: observed,
+      inspectSkipped: true,
+      inspectReason: "vercel_cli_missing",
+      githubState: row.state,
+      vercelContext: row.context
+    };
+  }
+  if (!inspected.ok) {
+    const detail = [inspected.stderr, inspected.stdout, inspected.error].filter(Boolean).join("\n").trim().slice(0, 500);
+    return {
+      status: row.state === "pending" ? "building" : "error",
+      previewUrl: base.previewUrl,
+      deploymentUrl: target.startsWith("http") ? target : base.deploymentUrl,
+      summary: evidenceSummary([
+        `vercel inspect ${target} failed (exit ${inspected.exitCode ?? "?"})`,
+        detail
+      ]),
+      observedAt: observed,
+      inspectSkipped: false,
+      inspectReason: null,
+      githubState: row.state,
+      vercelContext: row.context
+    };
+  }
+  const ready = parseInspectReady(inspected.stdout, inspected.stderr);
+  return {
+    status: ready ? "ready" : row.state === "pending" ? "building" : "error",
+    previewUrl: target.startsWith("http") ? target : base.previewUrl,
+    deploymentUrl: target.startsWith("http") ? target : base.deploymentUrl,
+    summary: ready ? `vercel inspect ${target} ready` : `vercel inspect ${target} completed without ready signal`,
+    observedAt: observed,
+    inspectSkipped: false,
+    inspectReason: null,
+    githubState: row.state,
+    vercelContext: row.context
+  };
+}
 export {
   DEFAULT_DISPATCH_LEASE_MS,
+  DEFAULT_HARNESS_VERIFY_COMMANDS,
+  FORBIDDEN_WORKER_ENV_KEYS,
   PACKAGE_VERSION,
   assessAutoCompleteEligibility,
+  assessBuildAdmission,
   assessExitedWorkerSalvage,
   assessPrHandoffRequirement,
   assessWorkerLanding,
   assessWorkerLandingContract,
+  auditWorkerEnv,
   autoCompleteWorker,
   autoCompleteWorkerCli,
   buildDispatchTaskText,
   buildPrompt,
+  buildSystemdRunArgv,
+  classifyNpmAuditOutcome,
+  classifyShellCommandOutcome,
+  classifyVercelUrl,
   classifyWorkerHealth,
+  collectVercelEvidence,
   completeWorker,
   computeAttention,
   computeWorkerStatus,
@@ -5886,21 +7400,29 @@ export {
   dispatchRun,
   drainPlanOutbox,
   ensurePrReadyHandoff,
+  evidenceFromGitHubVercelStatus,
   extractPlanOutboxFromTask,
   extractPrUrlFromText,
   formatPlanOutboxHandoffBlock,
   getHarnessPaths,
   getMonitorStatus,
   hashPlanBody,
+  isDashboardVercelUrl,
+  isEngagementRequiredSkip,
   isFinishedWorkerStatus,
+  isForbiddenWorkerEnvKey,
   isLandingBlockedWorkerStatus,
+  isSystemdRunAvailable,
   isTerminalHeartbeatPhase,
+  isVercelStatusContext,
   landingContractAttentionReason,
+  listForbiddenWorkerEnvKeys,
   listMonitors,
   listOutboxItems,
   listRuns,
   loadUserConfig,
   main,
+  mergeNodeOptionsForBuildCheck,
   normalizeCursorModelAlias,
   observeRunnerDiskGate,
   parseArgs,
@@ -5908,8 +7430,10 @@ export {
   parseHarnessStream,
   parseHeartbeat,
   persistPlan,
+  pickVercelStatusContext,
   postJson,
   preflightCursorModel,
+  readMemAvailableBytes,
   reconcileRunsCli,
   reconcileStaleWorkers,
   redactHarness,
@@ -5917,16 +7441,23 @@ export {
   resolveCallbackSecret,
   resolveCallbackSecretWithMint,
   resolveHarnessRoot,
+  resolveVercelInspectTarget,
+  runBoundedBuildCheck,
   runDaemon,
+  runHarnessVerifyCommands,
   runMonitorTick,
   runStatus,
   saveUserConfig,
+  scrubClaudeEnv,
+  scrubWorkerEnv,
   spawnCompletionSidecar,
   spawnMonitorSidecar,
   spawnWorkerProcess,
   startWorker,
   stopWorker,
   summarizeEvent,
+  summarizeNpmAuditReport,
+  summarizeShellToolCallEvent,
   sweepRun,
   tailWorker,
   terminalFinalResultFromHeartbeat,