@lucern/contracts 0.3.0-alpha.1 → 0.3.0-alpha.10

package/dist/index.js

@@ -1,5 +1,6 @@
 import { z, ZodFirstPartyTypeKind } from 'zod';
 import { v } from 'convex/values';
+import { ALL_FUNCTION_CONTRACTS } from './function-registry/index.js';
 export * from './function-registry/index.js';
 
 var __defProp = Object.defineProperty;
@@ -224,6 +225,209 @@ function lastDelegator(delegationChain) {
   return delegationChain[delegationChain.length - 1]?.principalId;
 }
 
+// src/generated/tableOwnership.ts
+var TABLE_OWNERSHIP = {
+  "agentMessages": "K",
+  "agentRegistryEntries": "L",
+  "agents": "I",
+  "agentSessions": "K",
+  "apiKeys": "L",
+  "auditLog": "L",
+  "autofixJobs": "K",
+  "backgroundJobRuns": "K",
+  "backgroundJobSettings": "K",
+  "beliefConfidence": "K",
+  "beliefEvidenceLinks": "K",
+  "beliefHistory": "K",
+  "beliefScenarios": "K",
+  "beliefVotes": "K",
+  "calibrationScores": "K",
+  "compatibilityShims": "L",
+  "contractEvaluations": "K",
+  "contradictions": "K",
+  "controlPlaneTenantModelSlotBindings": "L",
+  "controlPlaneTenantProviderSecrets": "L",
+  "controlPlaneTenantProxyGatewayUsage": "L",
+  "controlPlaneToolAcls": "L",
+  "crossProjectConnections": "K",
+  "cutoverFlags": "L",
+  "decisionComputedSummaries": "K",
+  "decisionEvents": "K",
+  "decisionParticipants": "K",
+  "decisionRiskLedger": "K",
+  "decisionSnapshots": "K",
+  "deliberationContributions": "K",
+  "deliberationSessions": "K",
+  "epistemicAudit": "K",
+  "epistemicContracts": "K",
+  "epistemicEdges": "K",
+  "epistemicNodeEmbeddings": "K",
+  "epistemicNodes": "K",
+  "graphAnalysisCache": "K",
+  "graphAnalysisResults": "K",
+  "graphSuggestions": "K",
+  "groupMemberships": "L",
+  "groups": "L",
+  "harnessReplays": "K",
+  "harnessRuns": "K",
+  "idempotencyTokens": "K",
+  "lenses": "K",
+  "lensTopicBindings": "K",
+  "mcpWritePolicy": "I",
+  "memberships": "L",
+  "methodologyPacks": "L",
+  "modelCallLogs": "I",
+  "modelFunctionSlots": "I",
+  "modelRegistry": "I",
+  "modelSlotConfigs": "I",
+  "neo4jSyncQueue": "K",
+  "oauthDeviceCodes": "L",
+  "ontologyDefinitions": "K",
+  "ontologyVersions": "K",
+  "packAssignments": "L",
+  "packDefinitions": "L",
+  "packEntitlements": "L",
+  "packGroupAssignments": "L",
+  "packInstallations": "L",
+  "packVersions": "L",
+  "platformAgentRunPolicyDecisions": "K",
+  "platformAgentRunPromptResolutions": "K",
+  "platformAgentRuns": "K",
+  "platformAgentRunToolCalls": "K",
+  "platformAudienceGrants": "I",
+  "platformAudiences": "I",
+  "platformHarnessShadowAudit": "K",
+  "platformPolicyDecisionLogs": "I",
+  "policyBundles": "L",
+  "policyDecisionLogs": "L",
+  "policySimulations": "L",
+  "principals": "L",
+  "projectGrants": "I",
+  "publicationRules": "K",
+  "questionEvidenceLinks": "K",
+  "rateLimitWindows": "L",
+  "reasoningPermissions": "I",
+  "researchJobs": "K",
+  "schemaEnumConfig": "K",
+  "servicePrincipalKeys": "L",
+  "stakeholderGroups": "K",
+  "systemLogs": "K",
+  "tasks": "K",
+  "tenantApiKeys": "I",
+  "tenantConfig": "I",
+  "tenantDeploymentCredentials": "L",
+  "tenantIntegrations": "I",
+  "tenantMethodologyAssignments": "L",
+  "tenantModelSlotBindings": "I",
+  "tenantPolicies": "I",
+  "tenantProviderSecrets": "I",
+  "tenantProxyGatewayUsage": "I",
+  "tenantProxyTokenMints": "I",
+  "tenants": "L",
+  "tenantSandboxAuditEvents": "I",
+  "tenantSecrets": "I",
+  "toolAcls": "I",
+  "toolCatalog": "L",
+  "toolRegistry": "I",
+  "toolRegistryEntries": "L",
+  "topics": "K",
+  "users": "I",
+  "userSessions": "L",
+  "workflowDefinitions": "K",
+  "workflowPullRequests": "K",
+  "workflowStages": "K",
+  "workspaces": "L",
+  "worktreeBeliefCluster": "K",
+  "worktrees": "K"
+};
+
+// src/component-boundary.contract.ts
+var COMPONENT_BOUNDARY_CONTRACT_VERSION = "2026-04-27";
+var COMPONENT_BOUNDARY_COMPONENT_LAYERS = [
+  "I",
+  "K"
+];
+var COMPONENT_BOUNDARY_DIRECT_DB_METHODS = [
+  "insert",
+  "patch",
+  "replace",
+  "delete",
+  "query"
+];
+var COMPONENT_BOUNDARY_HOST_SOURCE_ROOTS = [
+  "services",
+  "apps",
+  "convex"
+];
+var COMPONENT_BOUNDARY_HIGH_RISK_TABLES = [
+  "backgroundJobRuns",
+  "backgroundJobSettings",
+  "systemLogs",
+  "epistemicAudit",
+  "platformPolicyDecisionLogs",
+  "tenantApiKeys",
+  "projectGrants",
+  "userSessions"
+];
+function getComponentBoundaryTableLayer(tableName) {
+  return TABLE_OWNERSHIP[tableName];
+}
+function isComponentBoundaryComponentOwnedTable(tableName) {
+  const layer = getComponentBoundaryTableLayer(tableName);
+  return layer === "I" || layer === "K";
+}
+
+// src/component-host-boundary.contract.ts
+var COMPONENT_HOST_BOUNDARY_CONTRACT_VERSION = "2026-04-28";
+var COMPONENT_HOST_PROTECTED_TABLES = [
+  "backgroundJobRuns",
+  "backgroundJobSettings",
+  "systemLogs",
+  "epistemicAudit",
+  "platformPolicyDecisionLogs",
+  "tenantApiKeys",
+  "projectGrants",
+  "userSessions"
+];
+var COMPONENT_HOST_PROTECTED_TABLE_OWNERS = {
+  backgroundJobRuns: "kernel_component",
+  backgroundJobSettings: "kernel_component",
+  systemLogs: "kernel_component",
+  epistemicAudit: "reasoning_kernel_component",
+  platformPolicyDecisionLogs: "identity_component",
+  tenantApiKeys: "identity_component",
+  projectGrants: "identity_component",
+  userSessions: "tenant_or_control_plane_schema"
+};
+var COMPONENT_HOST_DB_WRITE_OPERATIONS = [
+  "insert",
+  "patch",
+  "replace",
+  "delete"
+];
+var COMPONENT_HOST_DB_READ_OPERATIONS = ["query"];
+var COMPONENT_HOST_WRITE_AUDIT_ROOTS = [
+  "apps/web/convex",
+  "packages/server-core/src",
+  "services/kernel-template/convex",
+  "services/identity-template/convex",
+  "services/master-control/convex"
+];
+var COMPONENT_HOST_WRITE_ALLOWED_EXCEPTIONS = [
+  {
+    file: "services/master-control/convex/userSessions.ts",
+    table: "userSessions",
+    operation: "insert",
+    reason: "Master Control declares and owns its own userSessions table for gateway session validation."
+  },
+  {
+    file: "services/master-control/convex/userSessions.ts",
+    table: "userSessions",
+    operation: "query",
+    reason: "Master Control declares and owns its own userSessions table for gateway session validation."
+  }
+];
+
 // src/gateway.contract.ts
 function requireActorPrincipalId(authContext) {
   const principalId = typeof authContext.principalId === "string" ? authContext.principalId.trim() : "";
@@ -233,6 +437,598 @@ function requireActorPrincipalId(authContext) {
   throw new Error("Access denied: federated principal context required.");
 }
 
+// src/graph-intelligence.contract.ts
+var GRAPH_INTELLIGENCE_QUERY_CATALOG_VERSION = "graph_intelligence_query_catalog.v1";
+var GRAPH_INTELLIGENCE_QUERY_MODES = [
+  "core",
+  "bias",
+  "stress",
+  "operational",
+  "alpha",
+  "semantic",
+  "evidence"
+];
+var GRAPH_INTELLIGENCE_PUBLIC_TOOL_NAMES = [
+  "get_graph_structure_analysis",
+  "detect_confirmation_bias",
+  "get_graph_gaps",
+  "get_topic_coverage",
+  "find_contradictions",
+  "get_falsification_questions",
+  "search_beliefs",
+  "search_evidence",
+  "list_beliefs",
+  "list_questions",
+  "traverse_graph",
+  "query_lineage",
+  "get_graph_neighborhood"
+];
+var GRAPH_INTELLIGENCE_MODE_TOOL_NAMES = {
+  core: [
+    "get_graph_structure_analysis",
+    "get_topic_coverage",
+    "get_graph_gaps",
+    "list_beliefs",
+    "list_questions",
+    "search_evidence"
+  ],
+  bias: [
+    "get_graph_structure_analysis",
+    "detect_confirmation_bias",
+    "find_contradictions",
+    "search_evidence",
+    "list_beliefs"
+  ],
+  stress: [
+    "get_graph_structure_analysis",
+    "get_graph_gaps",
+    "find_contradictions",
+    "get_falsification_questions",
+    "list_beliefs",
+    "list_questions"
+  ],
+  operational: [
+    "get_topic_coverage",
+    "get_graph_gaps",
+    "list_beliefs",
+    "list_questions",
+    "search_evidence"
+  ],
+  alpha: [
+    "get_graph_structure_analysis",
+    "detect_confirmation_bias",
+    "find_contradictions",
+    "search_beliefs",
+    "search_evidence"
+  ],
+  semantic: [
+    "get_graph_structure_analysis",
+    "search_beliefs",
+    "search_evidence",
+    "traverse_graph",
+    "query_lineage",
+    "get_graph_neighborhood"
+  ],
+  evidence: [
+    "get_graph_structure_analysis",
+    "get_topic_coverage",
+    "search_evidence",
+    "get_falsification_questions",
+    "find_contradictions"
+  ]
+};
+var GRAPH_INTELLIGENCE_QUERY_CATEGORIES = [
+  {
+    id: "problems",
+    name: "Find Problems",
+    description: "Risk, contradiction, bias, and structural weakness queries."
+  },
+  {
+    id: "gaps",
+    name: "Find Gaps",
+    description: "Missing evidence, unanswered questions, and sparse areas."
+  },
+  {
+    id: "reasoning",
+    name: "Reasoning Quality",
+    description: "Assumption chains, evidence convergence, and weak links."
+  },
+  {
+    id: "strategic",
+    name: "Strategic Analysis",
+    description: "Pre-mortems, falsification, contrarian signals, and bets."
+  },
+  {
+    id: "deep",
+    name: "Deep Graph Analysis",
+    description: "Centrality, propagation, underdetermination, and topology."
+  },
+  {
+    id: "browse",
+    name: "Browse and Explore",
+    description: "Narrative summaries, search, theme exploration, and bridges."
+  },
+  {
+    id: "prep",
+    name: "Meeting Prep",
+    description: "Company, entity, and question prep from graph context."
+  }
+];
+var byMode = (mode) => GRAPH_INTELLIGENCE_MODE_TOOL_NAMES[mode];
+var GRAPH_INTELLIGENCE_QUERIES = [
+  {
+    id: "confirmation-bias",
+    categoryId: "problems",
+    mode: "bias",
+    name: "Find Confirmation Bias",
+    description: "Find beliefs supported mainly by confirming evidence.",
+    prompt: "Find beliefs where supporting evidence overwhelms challenging evidence. Prioritize high-conviction beliefs with few defeaters.",
+    highlightStrategy: "bias-risk",
+    riskLevel: "high"
+  },
+  {
+    id: "contradiction-map",
+    categoryId: "problems",
+    mode: "stress",
+    name: "Map Contradictions",
+    description: "Surface direct and indirect contradiction clusters.",
+    prompt: "Map the graph's contradiction clusters and explain which tensions matter most.",
+    highlightStrategy: "contradictions",
+    riskLevel: "high"
+  },
+  {
+    id: "weak-evidence",
+    categoryId: "problems",
+    mode: "stress",
+    name: "Weak Evidence Chains",
+    description: "Find important claims with thin or indirect evidence.",
+    prompt: "Find high-importance beliefs whose evidence support is thin, indirect, stale, or low quality.",
+    highlightStrategy: "weak-support",
+    riskLevel: "medium"
+  },
+  {
+    id: "single-source",
+    categoryId: "problems",
+    mode: "bias",
+    name: "Single-Source Risk",
+    description: "Find claims overly dependent on one source or source type.",
+    prompt: "Identify beliefs that rely on a single source, one methodology, or one repeated perspective.",
+    highlightStrategy: "source-concentration",
+    riskLevel: "medium"
+  },
+  {
+    id: "untested-assumptions",
+    categoryId: "problems",
+    mode: "stress",
+    name: "Untested Assumptions",
+    description: "Find load-bearing assumptions without falsification paths.",
+    prompt: "Find assumptions that appear load-bearing but do not have direct testing questions or falsification evidence.",
+    highlightStrategy: "untested",
+    riskLevel: "high"
+  },
+  {
+    id: "load-bearing-beliefs",
+    categoryId: "problems",
+    mode: "stress",
+    name: "Load-Bearing Beliefs",
+    description: "Find central beliefs whose failure would affect many claims.",
+    prompt: "Find the beliefs with the largest downstream impact if they are wrong.",
+    highlightStrategy: "load-bearing",
+    riskLevel: "high"
+  },
+  {
+    id: "cascade-analysis",
+    categoryId: "problems",
+    mode: "stress",
+    name: "Cascade Analysis",
+    description: "Trace what changes if a belief is weakened or invalidated.",
+    prompt: "Analyze likely downstream cascades if the most central or uncertain beliefs are weakened.",
+    highlightStrategy: "cascade",
+    riskLevel: "high"
+  },
+  {
+    id: "unanswered-questions",
+    categoryId: "gaps",
+    mode: "operational",
+    name: "Unanswered Questions",
+    description: "Find important open questions that block confidence.",
+    prompt: "Identify the most important unanswered questions and explain which beliefs they block.",
+    highlightStrategy: "open-questions"
+  },
+  {
+    id: "thin-themes",
+    categoryId: "gaps",
+    mode: "operational",
+    name: "Thin Themes",
+    description: "Find topics with shallow belief or evidence coverage.",
+    prompt: "Find themes that look underdeveloped relative to their role in the graph.",
+    highlightStrategy: "thin-themes"
+  },
+  {
+    id: "missing-evidence",
+    categoryId: "gaps",
+    mode: "stress",
+    name: "Missing Evidence",
+    description: "Find beliefs that need specific missing evidence.",
+    prompt: "Find the most valuable missing evidence needed to strengthen or falsify the graph.",
+    highlightStrategy: "missing-evidence"
+  },
+  {
+    id: "isolated-clusters",
+    categoryId: "gaps",
+    mode: "operational",
+    name: "Isolated Clusters",
+    description: "Find clusters not connected to the broader graph.",
+    prompt: "Find isolated graph clusters and recommend bridge questions or bridge evidence.",
+    highlightStrategy: "isolated-clusters"
+  },
+  {
+    id: "source-contribution",
+    categoryId: "gaps",
+    mode: "evidence",
+    name: "Source Contribution",
+    description: "Assess how source mix shapes the graph.",
+    prompt: "Assess whether the source mix is balanced enough for the graph's strongest claims.",
+    highlightStrategy: "source-mix"
+  },
+  {
+    id: "stale-beliefs",
+    categoryId: "gaps",
+    mode: "operational",
+    name: "Stale Beliefs",
+    description: "Find beliefs that need review because they are old or stale.",
+    prompt: "Find beliefs that should be revisited because they are stale, unsupported by recent evidence, or contradicted by newer context.",
+    highlightStrategy: "staleness"
+  },
+  {
+    id: "assumption-pyramid",
+    categoryId: "reasoning",
+    mode: "operational",
+    name: "Assumption Pyramid",
+    description: "Show which conclusions rest on which assumptions.",
+    prompt: "Build an assumption pyramid from the graph: foundational assumptions, intermediate claims, and top-level conclusions.",
+    highlightStrategy: "assumptions"
+  },
+  {
+    id: "converging-evidence",
+    categoryId: "reasoning",
+    mode: "evidence",
+    name: "Converging Evidence",
+    description: "Find claims supported by independent evidence streams.",
+    prompt: "Find beliefs with genuinely independent converging evidence and explain why they are robust.",
+    highlightStrategy: "convergence"
+  },
+  {
+    id: "weakest-links",
+    categoryId: "reasoning",
+    mode: "stress",
+    name: "Weakest Links",
+    description: "Find the weakest links in important reasoning chains.",
+    prompt: "Find the weakest links in important reasoning chains and explain how to test them.",
+    highlightStrategy: "weak-links",
+    riskLevel: "medium"
+  },
+  {
+    id: "challenged-beliefs",
+    categoryId: "reasoning",
+    mode: "stress",
+    name: "Challenged Beliefs",
+    description: "Find beliefs with active challenges or defeaters.",
+    prompt: "Find beliefs with active challenges, contradiction edges, or unresolved defeaters.",
+    highlightStrategy: "challenged"
+  },
+  {
+    id: "contrarian-map",
+    categoryId: "strategic",
+    mode: "alpha",
+    name: "Contrarian Map",
+    description: "Find non-consensus beliefs and where they are grounded.",
+    prompt: "Find the graph's strongest contrarian or non-consensus beliefs and explain their support.",
+    highlightStrategy: "contrarian"
+  },
+  {
+    id: "irreversibility-audit",
+    categoryId: "strategic",
+    mode: "stress",
+    name: "Irreversibility Audit",
+    description: "Find irreversible bets and assumptions behind them.",
+    prompt: "Audit irreversible decisions or beliefs and identify what must be true before acting.",
+    highlightStrategy: "irreversible",
+    riskLevel: "high"
+  },
+  {
+    id: "pre-mortem",
+    categoryId: "strategic",
+    mode: "stress",
+    name: "Pre-Mortem",
+    description: "Explain how the graph could be wrong.",
+    prompt: "Run a pre-mortem: assume the current thesis fails and identify the most plausible failure paths.",
+    highlightStrategy: "failure-paths",
+    riskLevel: "high"
+  },
+  {
+    id: "devils-advocate",
+    categoryId: "strategic",
+    mode: "stress",
+    name: "Devil's Advocate",
+    description: "Generate the strongest critique of the graph.",
+    prompt: "Produce the strongest evidence-grounded critique of the current graph and its main thesis.",
+    highlightStrategy: "critique"
+  },
+  {
+    id: "falsification-map",
+    categoryId: "strategic",
+    mode: "stress",
+    name: "Falsification Map",
+    description: "Find the cheapest tests that would disprove key beliefs.",
+    prompt: "Map the cheapest, clearest falsification tests for the graph's key claims.",
+    highlightStrategy: "falsification",
+    riskLevel: "high"
+  },
+  {
+    id: "prediction-tracker",
+    categoryId: "strategic",
+    mode: "evidence",
+    name: "Prediction Tracker",
+    description: "Find beliefs that imply measurable predictions.",
+    prompt: "Find beliefs that imply measurable predictions and suggest tracking signals.",
+    highlightStrategy: "predictions"
+  },
+  {
+    id: "belief-pagerank",
+    categoryId: "deep",
+    mode: "semantic",
+    name: "Belief PageRank",
+    description: "Identify structurally central beliefs.",
+    prompt: "Use graph centrality to identify the most structurally important beliefs.",
+    highlightStrategy: "centrality"
+  },
+  {
+    id: "underdetermination",
+    categoryId: "deep",
+    mode: "semantic",
+    name: "Underdetermination",
+    description: "Find places where evidence supports multiple explanations.",
+    prompt: "Find places where the same evidence could support multiple incompatible explanations.",
+    highlightStrategy: "underdetermination"
+  },
+  {
+    id: "confidence-propagation",
+    categoryId: "deep",
+    mode: "semantic",
+    name: "Confidence Propagation",
+    description: "Assess how uncertainty moves through the graph.",
+    prompt: "Explain how uncertainty propagates from weak or contested beliefs through downstream conclusions.",
+    highlightStrategy: "confidence-flow"
+  },
+  {
+    id: "argument-depth",
+    categoryId: "deep",
+    mode: "evidence",
+    name: "Argument Depth",
+    description: "Assess reasoning depth and chain quality.",
+    prompt: "Assess reasoning depth: where claims are shallow, deeply supported, or overextended.",
+    highlightStrategy: "depth"
+  },
+  {
+    id: "information-edge",
+    categoryId: "deep",
+    mode: "alpha",
+    name: "Information Edge",
+    description: "Find differentiated evidence or signals.",
+    prompt: "Find evidence, sources, or beliefs that could represent differentiated information edge.",
+    highlightStrategy: "information-edge"
+  },
+  {
+    id: "thesis-summary",
+    categoryId: "browse",
+    mode: "semantic",
+    name: "Thesis Summary",
+    description: "Summarize the graph's core thesis and support.",
+    prompt: "Summarize the graph's core thesis, strongest support, weakest support, and open questions.",
+    highlightStrategy: "summary"
+  },
+  {
+    id: "theme-deep-dive",
+    categoryId: "browse",
+    mode: "semantic",
+    name: "Theme Deep Dive",
+    description: "Deep dive into a named theme.",
+    prompt: "Deep dive into {input}. Explain the key beliefs, evidence, contradictions, and open questions.",
+    inputType: "theme",
+    highlightStrategy: "theme"
+  },
+  {
+    id: "belief-detail",
+    categoryId: "browse",
+    mode: "semantic",
+    name: "Belief Detail",
+    description: "Explain one belief and its graph neighborhood.",
+    prompt: "Explain {input} and its support, challenges, related beliefs, and downstream implications.",
+    inputType: "belief",
+    highlightStrategy: "belief"
+  },
+  {
+    id: "strongest-beliefs",
+    categoryId: "browse",
+    mode: "operational",
+    name: "Strongest Beliefs",
+    description: "Find the graph's strongest current beliefs.",
+    prompt: "Find the strongest current beliefs and explain why each one deserves confidence.",
+    highlightStrategy: "strongest"
+  },
+  {
+    id: "cross-theme-connection",
+    categoryId: "browse",
+    mode: "semantic",
+    name: "Cross-Theme Connections",
+    description: "Find bridges between themes.",
+    prompt: "Find meaningful connections across themes and explain which bridge beliefs matter.",
+    highlightStrategy: "bridges"
+  },
+  {
+    id: "research-velocity",
+    categoryId: "browse",
+    mode: "operational",
+    name: "Research Velocity",
+    description: "Summarize recent graph movement and momentum.",
+    prompt: "Assess research velocity: what changed recently, where progress is fastest, and what is stuck.",
+    highlightStrategy: "velocity"
+  },
+  {
+    id: "search",
+    categoryId: "browse",
+    mode: "semantic",
+    name: "Graph Search",
+    description: "Search the graph with semantic context.",
+    prompt: "Search the graph for {input}. Return the most relevant beliefs, evidence, and questions.",
+    inputType: "search",
+    highlightStrategy: "search"
+  },
+  {
+    id: "expert-coverage",
+    categoryId: "browse",
+    mode: "semantic",
+    name: "Expert Coverage",
+    description: "Assess coverage from expert/source perspectives.",
+    prompt: "Assess whether the graph has enough expert, primary, and dissenting coverage.",
+    highlightStrategy: "expert-coverage"
+  },
+  {
+    id: "value-chain-map",
+    categoryId: "browse",
+    mode: "semantic",
+    name: "Value Chain Map",
+    description: "Map entities, dependencies, and value-chain logic.",
+    prompt: "Map the value chain implied by this graph: entities, dependencies, pressure points, and missing links.",
+    highlightStrategy: "value-chain"
+  },
+  {
+    id: "meeting-brief",
+    categoryId: "prep",
+    mode: "semantic",
+    name: "Meeting Brief",
+    description: "Prepare a meeting brief from graph context.",
+    prompt: "Prepare a concise meeting brief using the graph: thesis, open questions, risks, and recommended asks.",
+    highlightStrategy: "brief"
+  },
+  {
+    id: "open-questions-entity",
+    categoryId: "prep",
+    mode: "semantic",
+    name: "Entity Open Questions",
+    description: "Find open questions about a specific entity.",
+    prompt: "Find the most important open questions about {input} and the beliefs those questions would unlock.",
+    inputType: "entity",
+    highlightStrategy: "entity-questions"
+  },
+  {
+    id: "company-context",
+    categoryId: "prep",
+    mode: "semantic",
+    name: "Company Context",
+    description: "Summarize graph context about a company.",
+    prompt: "Summarize what the graph knows about {input}: thesis relevance, evidence, risks, and open questions.",
+    inputType: "company",
+    highlightStrategy: "company"
+  },
+  {
+    id: "company-theme-fit",
+    categoryId: "prep",
+    mode: "semantic",
+    name: "Company Theme Fit",
+    description: "Assess how a company fits graph themes.",
+    prompt: "Assess how {input} fits the graph's themes and where the fit is weak or uncertain.",
+    inputType: "company",
+    highlightStrategy: "fit"
+  },
+  {
+    id: "company-comparison",
+    categoryId: "prep",
+    mode: "semantic",
+    name: "Company Comparison",
+    description: "Compare companies through graph context.",
+    prompt: "Compare {input} using graph beliefs, evidence, risks, and open questions.",
+    inputType: "company-list",
+    highlightStrategy: "comparison"
+  },
+  {
+    id: "questions-to-ask",
+    categoryId: "prep",
+    mode: "operational",
+    name: "Questions to Ask",
+    description: "Generate high-signal questions from graph gaps.",
+    prompt: "Generate the highest-signal questions to ask next, grounded in current graph gaps.",
+    highlightStrategy: "questions"
+  },
+  {
+    id: "beliefs-to-test",
+    categoryId: "prep",
+    mode: "stress",
+    name: "Beliefs to Test",
+    description: "Prioritize beliefs that should be tested next.",
+    prompt: "Prioritize the beliefs that should be tested next and explain the cheapest test for each.",
+    highlightStrategy: "tests",
+    riskLevel: "medium"
+  }
+];
+var GRAPH_INTELLIGENCE_QUERIES_WITH_TOOLS = GRAPH_INTELLIGENCE_QUERIES.map((query) => {
+  const definition = query;
+  return {
+    ...definition,
+    tools: definition.tools ?? byMode(definition.mode)
+  };
+});
+var GRAPH_INTELLIGENCE_QUICK_QUERIES = [
+  {
+    id: "health-check",
+    name: "Health Check",
+    queryId: "thesis-summary",
+    prompt: "Give me a fast graph health check: biggest strengths, biggest risks, and next best action."
+  },
+  {
+    id: "find-risks",
+    name: "Find Risks",
+    queryId: "weakest-links",
+    prompt: "Find the most important risks in this graph and the beliefs or evidence behind each one."
+  },
+  {
+    id: "pre-mortem",
+    name: "Pre-Mortem",
+    queryId: "pre-mortem",
+    prompt: "Assume this thesis fails. Explain the most plausible failure paths and what would reveal them early."
+  },
+  {
+    id: "whats-next",
+    name: "What's Next",
+    queryId: "questions-to-ask",
+    prompt: "What should I learn or test next to make this graph more useful?"
+  }
+];
+function isGraphIntelligenceQueryMode(value) {
+  return typeof value === "string" && GRAPH_INTELLIGENCE_QUERY_MODES.includes(value);
+}
+function getGraphIntelligenceQuery(queryId) {
+  return GRAPH_INTELLIGENCE_QUERIES_WITH_TOOLS.find(
+    (query) => query.id === queryId
+  );
+}
+function listGraphIntelligenceQueries(filter = {}) {
+  return GRAPH_INTELLIGENCE_QUERIES_WITH_TOOLS.filter((query) => {
+    if (filter.categoryId && query.categoryId !== filter.categoryId) {
+      return false;
+    }
+    if (filter.mode && query.mode !== filter.mode) {
+      return false;
+    }
+    return true;
+  });
+}
+function fillGraphIntelligencePromptTemplate(prompt, input) {
+  const replacement = input?.trim() || "the current topic";
+  return prompt.split("{input}").join(replacement);
+}
+
 // src/context-pack.contract.ts
 var CONTEXT_PACK_SCHEMA_VERSION = "1.0.0";
 var CONTEXT_RANKING_PROFILES = [
@@ -712,9 +1508,6 @@ function encodeLiteral(value) {
   }
   return JSON.stringify(value);
 }
-function quoteKey(value) {
-  return JSON.stringify(value);
-}
 function sortEntries(entries) {
   return [...entries].sort(([left], [right]) => left.localeCompare(right));
 }
@@ -877,7 +1670,7 @@ function convertSchemaInner(schema, state, path) {
         convertSchema(value, state, [...path, key])
       ]);
       return {
-        source: `v.object({ ${convertedFields.map(([key, converted]) => `${quoteKey(key)}: ${converted.source}`).join(", ")} })`,
+        source: `v.object({ ${convertedFields.map(([key, converted]) => `${JSON.stringify(key)}: ${converted.source}`).join(", ")} })`,
         defaults: convertedFields.flatMap(([, converted]) => converted.defaults)
       };
     }
@@ -1183,11 +1976,14 @@ __export(schemas_exports, {
   ALL_TABLE_CONTRACTS: () => ALL_TABLE_CONTRACTS,
   ComponentTableManifestSchema: () => ComponentTableManifestSchema,
   EDGE_TYPE: () => EDGE_TYPE,
+  EDGE_TYPE_VALUES: () => EDGE_TYPE_VALUES,
   IDENTITY_TABLE_CONTRACTS: () => IDENTITY_TABLE_CONTRACTS,
   KERNEL_TABLE_CONTRACTS: () => KERNEL_TABLE_CONTRACTS,
   MC_TABLE_CONTRACTS: () => MC_TABLE_CONTRACTS,
   NODE_TYPE: () => NODE_TYPE,
   SLOpinionInputSchema: () => SLOpinionInputSchema,
+  STORAGE_EDGE_TYPE: () => STORAGE_EDGE_TYPE,
+  STORAGE_EDGE_TYPE_VALUES: () => STORAGE_EDGE_TYPE_VALUES,
   TABLE_CONTRACTS_BY_COMPONENT: () => TABLE_CONTRACTS_BY_COMPONENT,
   TOPIC_STATUS: () => TOPIC_STATUS,
   TOPIC_VISIBILITY: () => TOPIC_VISIBILITY,
@@ -1195,7 +1991,10 @@ __export(schemas_exports, {
   listTableContractsByName: () => listTableContractsByName
 });
 var NODE_TYPE = z.enum(["decision", "belief", "question", "theme", "deal", "topic", "claim", "evidence", "synthesis", "answer", "atomic_fact", "excerpt", "source", "company", "person", "investor", "function", "value_chain"]);
-var EDGE_TYPE = z.enum(["supports", "informs", "depends_on", "extracted_from", "contains", "tests", "supersedes", "responds_to", "belongs_to", "relates_to_thesis", "works_at", "invested_in", "competes_with", "participates_in", "founded_by", "evaluates", "performs", "function_in", "impacts", "raised_from", "mentioned_in", "perspective_on", "plays_theme", "answers", "explores", "qualifies", "based_on", "based_on_belief", "based_on_question", "blocked_by_contradiction", "informed_by_theme", "same_as", "reinforces", "parent_of", "child_of", "falsified_by", "exclusive_with", "collapses_if", "cascade_from", "counterfactual_of", "cascade_to", "mutually_exclusive", "correlates_with", "amplifies", "precondition_for", "in_tension_with", "strengthened_by", "weakened_by", "alternative_to", "subsumes", "validated_by", "required_for", "blocks", "prerequisite_for", "parallel_to", "corroborates", "extends", "same_source_as", "same_theme_as", "assumes", "would_predict", "analogous_to", "independent_of", "implements", "violates", "co_changes_with", "migrating_from", "migrating_to", "scoped_by", "about_entity", "entity_referenced_in", "contradicts", "cites", "summarizes", "related_to", "partially_answers", "refines", "branches_from"]);
+var EDGE_TYPE_VALUES = ["supports", "informs", "depends_on", "derived_from", "contains", "tests", "supersedes", "responds_to", "belongs_to", "relates_to_thesis", "works_at", "invested_in", "competes_with", "participates_in", "founded_by", "evaluates", "performs", "function_in", "impacts", "raised_from", "mentioned_in", "perspective_on", "plays_theme", "answers", "explores", "qualifies", "based_on", "based_on_belief", "based_on_question", "blocked_by_contradiction", "informed_by_theme", "same_as", "reinforces", "parent_of", "child_of", "falsified_by", "exclusive_with", "collapses_if", "cascade_from", "counterfactual_of", "cascade_to", "mutually_exclusive", "correlates_with", "amplifies", "precondition_for", "in_tension_with", "strengthened_by", "weakened_by", "alternative_to", "subsumes", "validated_by", "required_for", "blocks", "prerequisite_for", "parallel_to", "corroborates", "extends", "same_source_as", "same_theme_as", "assumes", "would_predict", "analogous_to", "independent_of", "implements", "violates", "co_changes_with", "migrating_from", "migrating_to", "scoped_by", "about_entity", "entity_referenced_in", "contradicts", "cites", "summarizes", "related_to", "partially_answers", "refines", "branches_from"];
+var STORAGE_EDGE_TYPE_VALUES = [...EDGE_TYPE_VALUES, "extracted_from"];
+var EDGE_TYPE = z.enum(EDGE_TYPE_VALUES);
+var STORAGE_EDGE_TYPE = z.enum(STORAGE_EDGE_TYPE_VALUES);
 var TOPIC_STATUS = z.enum(["active", "archived", "watching"]);
 var TOPIC_VISIBILITY = z.enum(["private", "team", "firm", "external", "public"]);
 var agentMessages = defineTable({
@@ -2680,7 +3479,7 @@ var epistemicEdges = defineTable({
     "toNodeId": z.string().optional(),
     "sourceGlobalId": z.string().optional(),
     "targetGlobalId": z.string().optional(),
-    "edgeType": EDGE_TYPE,
+    "edgeType": STORAGE_EDGE_TYPE,
     "edgeTier": z.string().optional(),
     "domainNamespace": z.string().optional(),
     "constraint": z.string().optional(),
@@ -3023,6 +3822,40 @@ var rateLimitWindows = defineTable({
     { kind: "index", name: "by_tier_window_end", columns: ["tier", "windowEndMs"] }
   ]
 });
+var oauthDeviceCodes = defineTable({
+  name: "oauthDeviceCodes",
+  component: "mc",
+  category: "identity",
+  shape: z.object({
+    "deviceCodeHash": z.string(),
+    "userCode": z.string(),
+    "clientId": z.string(),
+    "scope": z.string(),
+    "status": z.enum(["pending", "approved", "denied", "expired", "consumed"]),
+    "expiresAt": z.number(),
+    "intervalSeconds": z.number(),
+    "lastPolledAt": z.number().optional(),
+    "slowDownCount": z.number().optional(),
+    "clerkUserId": z.string().optional(),
+    "tenantId": idOf("tenants").optional(),
+    "workspaceId": z.string().optional(),
+    "principalId": z.string().optional(),
+    "role": z.string().optional(),
+    "scopes": z.array(z.string()).optional(),
+    "sessionId": z.string().optional(),
+    "approvedAt": z.number().optional(),
+    "deniedAt": z.number().optional(),
+    "consumedAt": z.number().optional(),
+    "createdAt": z.number(),
+    "updatedAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_deviceCodeHash", columns: ["deviceCodeHash"] },
+    { kind: "index", name: "by_userCode", columns: ["userCode"] },
+    { kind: "index", name: "by_status_expiresAt", columns: ["status", "expiresAt"] },
+    { kind: "index", name: "by_sessionId", columns: ["sessionId"] }
+  ]
+});
 var servicePrincipalKeys = defineTable({
   name: "servicePrincipalKeys",
   component: "mc",
@@ -4855,6 +5688,7 @@ var topics = defineTable({
     "updatedAt": z.number()
   }),
   indices: [
+    { kind: "index", name: "by_globalId", columns: ["globalId"] },
     { kind: "index", name: "by_parent", columns: ["parentTopicId"] },
     { kind: "index", name: "by_type", columns: ["type"] },
     { kind: "index", name: "by_graph_scope_project", columns: ["graphScopeProjectId"] },
@@ -4979,7 +5813,9 @@ var workspaces = defineTable({
     "defaultProjectVisibility": z.enum(["private", "team", "firm", "external", "public"]).optional(),
     "deployments": z.record(z.object({
       "url": z.string(),
-      "encryptedDeployKey": z.string()
+      "target": z.enum(["kernelDeployment", "appDeployment"]).optional(),
+      "encryptedDeployKey": z.string().optional(),
+      "credentialRef": z.string().optional()
     })).optional(),
     "metadata": z.record(z.any()).optional(),
     "createdBy": z.string().optional(),
@@ -5387,6 +6223,7 @@ var MC_TABLE_CONTRACTS = [
   groupMemberships,
   groups,
   memberships,
+  oauthDeviceCodes,
   principals,
   rateLimitWindows,
   servicePrincipalKeys,
@@ -5467,17 +6304,44 @@ var SLOpinionInputSchema = z.object({
     message: "SL invariant b+d+u=1 violated at API boundary"
   }
 );
-var EpistemicNodeTypeSchema = z.enum([
+
+// src/schema-helpers/spine/tables/epistemicNodes.ts
+var NODE_TYPES = [
+  "decision",
   "belief",
-  "evidence",
   "question",
-  "answer",
+  "theme",
+  "deal",
   "topic",
+  "claim",
+  "evidence",
+  "synthesis",
+  "answer",
+  "atomic_fact",
+  "excerpt",
+  "source",
+  "company",
+  "person",
+  "investor",
+  "function",
+  "value_chain"
+];
+new Set(NODE_TYPES);
+
+// src/types/graph-ref.ts
+var GRAPH_REF_EXTRA_NODE_TYPES = [
   "edge",
   "ontology",
   "lens",
   "contradiction"
-]);
+];
+var GRAPH_REF_NODE_TYPES = [
+  ...NODE_TYPES,
+  ...GRAPH_REF_EXTRA_NODE_TYPES
+];
+var EpistemicNodeTypeSchema = z.enum(
+  GRAPH_REF_NODE_TYPES
+);
 var GraphRefSchema = z.discriminatedUnion("kind", [
   z.object({
     kind: z.literal("epistemic_node"),
@@ -5525,97 +6389,797 @@ function assertEdgePolicyAllowed(manifest, edgeType, from, to) {
 }
 
 // src/manifests/edge-policy-manifest.data.ts
+var publicEpistemicNodeEdgePolicy = (edgeType) => ({
+  edgeType,
+  fromKinds: ["epistemic_node"],
+  toKinds: ["epistemic_node"],
+  description: "Canonical public create_edge policy for graph-node relationships. The policy layer gates edge-type membership, not endpoint semantics."
+});
 var edgePolicyManifest = {
   manifestVersion: "1.0.0",
-  policies: [
-    {
-      edgeType: "evidence_derived_from_evidence",
-      fromKinds: ["epistemic_node"],
-      fromNodeTypes: ["evidence"],
-      toKinds: ["epistemic_node"],
-      toNodeTypes: ["evidence"],
-      description: "Evidence E2 was synthesized from evidence E1 by a transformation. Provides chain-of-evidence lineage."
-    },
-    {
-      edgeType: "evidence_supports_belief",
-      fromKinds: ["epistemic_node"],
-      fromNodeTypes: ["evidence"],
-      toKinds: ["epistemic_node"],
-      toNodeTypes: ["belief"],
-      description: "Existing link_evidence_to_belief semantics promoted to the create_edge policy source."
-    },
-    {
-      edgeType: "evidence_supports_question",
-      fromKinds: ["epistemic_node"],
-      fromNodeTypes: ["evidence"],
-      toKinds: ["epistemic_node"],
-      toNodeTypes: ["question"],
-      description: "Existing link_evidence_to_question semantics promoted to the create_edge policy source."
-    }
-  ]
+  policies: EDGE_TYPE_VALUES.map(publicEpistemicNodeEdgePolicy)
 };
-var InvariantManifestSchema = z.object({
-  manifestVersion: z.literal("1.0.0"),
-  rules: z.array(
-    z.object({
-      invariant: z.string(),
-      description: z.string(),
-      checker: z.enum(["ast", "manifest", "runtime"]),
-      severity: z.enum(["block_publish", "block_pr", "warn"])
-    })
-  )
-});
-
-// src/projections/projection-dsl.ts
-function defineProjection(def) {
-  return def;
-}
 
-// src/projections/create-evidence.projection.ts
-var jsonRecordSchema = z.record(z.unknown());
-var createEvidenceInputSchemaBase = z.object({
-  projectId: z.string().optional(),
-  topicId: z.string().optional(),
-  text: z.string().optional(),
-  canonicalText: z.string().optional(),
-  title: z.string().optional(),
-  content: z.string().optional(),
-  contentType: z.string().optional(),
-  kind: z.string().optional(),
-  tags: z.array(z.string()).optional(),
-  source: z.string().optional(),
-  sourceUrl: z.string().optional(),
-  sourceType: z.string().optional(),
-  externalSourceType: z.string().optional(),
-  sourceQuestionId: z.string().optional(),
-  methodology: z.string().optional(),
-  informationAsymmetry: z.string().optional(),
-  sourceDescription: z.string().optional(),
-  targetId: z.string().optional(),
-  targetNodeId: z.string().optional(),
-  linkedBeliefNodeId: z.string().optional(),
-  evidenceRelation: z.enum(["supports", "contradicts", "neutral"]).optional(),
-  confidence: z.number().optional(),
-  weight: z.number().optional(),
-  reasoning: z.string().optional(),
-  rationale: z.string(),
-  metadata: jsonRecordSchema.optional(),
-  trustedBypassAccessCheck: z.boolean().optional()
-}).passthrough();
-var createEvidenceInputSchema = createEvidenceInputSchemaBase.refine(
-  (input) => Boolean(input.text ?? input.canonicalText),
+// src/tenant-client.contract.ts
+var TENANT_CLIENT_CONTRACT_VERSION = "2026-04-27";
+var TENANT_CLIENT_AUTH_MODES = [
+  "interactive_user",
+  "service_principal",
+  "tenant_api_key",
+  "session_token"
+];
+var TENANT_CLIENT_PRINCIPAL_TYPES = [
+  "human",
+  "service",
+  "agent"
+];
+var TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS = [
+  "tenantId",
+  "workspaceId",
+  "principalId",
+  "authMode",
+  "scopes"
+];
+var TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS = [
+  "principalType",
+  "roles",
+  "sessionId",
+  "delegationChain"
+];
+var TENANT_CLIENT_INSTALL_TOKEN_ENV = "INSTALL_LUCERN_NPM";
+var TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH = "tenants/shared";
+var TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS = [
+  "/platform/publish"
+];
+var TENANT_CLIENT_FORBIDDEN_SECRET_ENV = ["NPM_TOKEN"];
+var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
   {
-    message: "create_evidence requires text",
-    path: ["text"]
-  }
-);
-function compactRecord(input) {
+    packageName: "@lucern/access-control",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/agent",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/auth",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/cli",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/client-core",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/confidence",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/config",
+    role: "configuration",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/contracts",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/control-plane",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/developer-kit",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/events",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/graph-primitives",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/graph-sync",
+    role: "host_addon_runtime",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/identity",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/mcp",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/pack-host",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/pack-installer",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/proof-compiler",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/react",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/reasoning-kernel",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/sdk",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/server-core",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/testing",
+    role: "test_support",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/types",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  }
+];
+var TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES = TENANT_CLIENT_INSTALLABLE_PACKAGES.map(
+  (entry) => entry.packageName
+);
+var TENANT_CLIENT_INSTALL_PROFILES = [
+  {
+    id: "core_app_runtime",
+    description: "Smallest tenant app/runtime install for typed Lucern API calls plus tool-access policy helpers.",
+    packageNames: ["@lucern/sdk", "@lucern/access-control"],
+    dependencyField: "dependencies"
+  },
+  {
+    id: "react_app_runtime",
+    description: "React tenant app install for hooks, provider, curated graph components, and direct SDK calls.",
+    packageNames: ["@lucern/react", "@lucern/sdk", "@lucern/access-control"],
+    dependencyField: "dependencies"
+  },
+  {
+    id: "convex_components",
+    description: "Tenant Convex host install for binding the Lucern identity and reasoning-kernel components.",
+    packageNames: ["@lucern/identity", "@lucern/reasoning-kernel"],
+    dependencyField: "dependencies"
+  },
+  {
+    id: "graph_mirroring_addon",
+    description: "Optional tenant Convex host install for Neo4j graph projection, edge topology writes, backfill, health checks, and query proxy helpers.",
+    packageNames: ["@lucern/graph-sync"],
+    dependencyField: "dependencies"
+  },
+  {
+    id: "operator_cli",
+    description: "Developer/operator install for the `lucern` binary, including tenant bootstrap seed commands.",
+    packageNames: ["@lucern/cli"],
+    dependencyField: "devDependencies"
+  },
+  {
+    id: "mcp_runtime",
+    description: "Agent runtime install for the standalone Lucern MCP server and hosted route helpers.",
+    packageNames: ["@lucern/mcp"],
+    dependencyField: "dependencies"
+  },
+  {
+    id: "contracts_and_types",
+    description: "Compile-time contract/type install for codegen, audits, and tenant integration validation.",
+    packageNames: ["@lucern/contracts", "@lucern/types"],
+    dependencyField: "dependencies"
+  },
+  {
+    id: "full_suite",
+    description: "Full coherent Lucern package suite for design-partner repos that want every published runtime, tool, component, test, and config package pinned together.",
+    packageNames: TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES,
+    dependencyField: "mixed"
+  }
+];
+var TENANT_CLIENT_PUBLIC_IMPORTS = [
+  {
+    packageName: "@lucern/sdk",
+    surface: "runtime",
+    subpaths: "published_exports",
+    description: "TypeScript SDK runtime and generated operation namespaces."
+  },
+  {
+    packageName: "@lucern/react",
+    surface: "runtime",
+    subpaths: "published_exports",
+    description: "React bindings for tenant-owned UI applications."
+  },
+  {
+    packageName: "@lucern/mcp",
+    surface: "runtime",
+    subpaths: "published_exports",
+    description: "MCP client/server entry points and hosted route helpers."
+  },
+  {
+    packageName: "@lucern/graph-sync",
+    surface: "runtime",
+    subpaths: "published_exports",
+    description: "Optional Neo4j graph mirroring host actions, edge API, query proxy, backfill, and health helpers."
+  },
+  {
+    packageName: "@lucern/contracts",
+    surface: "contract",
+    subpaths: "published_exports",
+    description: "Published type and manifest contracts."
+  },
+  {
+    packageName: "@lucern/access-control",
+    surface: "runtime",
+    subpaths: "published_exports",
+    description: "Tenant runtime access-control helpers, including effective tool access."
+  },
+  {
+    packageName: "@lucern/types",
+    surface: "contract",
+    subpaths: "published_exports",
+    description: "Published type-only helpers for tenant integration code."
+  }
+];
+var TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS = [
+  {
+    packageName: "@lucern/identity",
+    importPath: "@lucern/identity/convex.config",
+    surface: "component_config",
+    description: "Convex component binding config for tenant deployments that install Lucern identity."
+  },
+  {
+    packageName: "@lucern/reasoning-kernel",
+    importPath: "@lucern/reasoning-kernel/convex.config",
+    surface: "component_config",
+    description: "Convex component binding config for tenant deployments that install the Lucern reasoning kernel."
+  },
+  {
+    packageName: "@lucern/reasoning-kernel",
+    importPath: "@lucern/reasoning-kernel/runtime.config",
+    surface: "component_config",
+    description: "Runtime config alias for tenant deployments that install the Lucern reasoning kernel."
+  }
+];
+function findTenantClientInstallablePackage(packageName) {
+  return TENANT_CLIENT_INSTALLABLE_PACKAGES.find(
+    (entry) => entry.packageName === packageName
+  );
+}
+function isTenantClientInstallablePackage(packageName) {
+  return Boolean(findTenantClientInstallablePackage(packageName));
+}
+var TENANT_CLIENT_REQUIRED_SDK_NAMESPACES = [
+  "bootstrap",
+  "context",
+  "beliefs",
+  "evidence",
+  "questions",
+  "graph",
+  "worktrees",
+  "topics",
+  "edges",
+  "contradictions",
+  "contracts",
+  "graphIntel",
+  "graphIntelligence",
+  "graphAnalysis",
+  "graphRecommendations",
+  "orgGraphSearch",
+  "embeddings",
+  "ontologyLinks",
+  "graphStateClassifier",
+  "tools",
+  "identity",
+  "modelRuntime",
+  "events",
+  "jobs",
+  "telemetry"
+];
+var TENANT_CLIENT_CAPABILITIES = [
+  {
+    id: "identity.bootstrap_session",
+    description: "Start a scoped Lucern session for a tenant principal.",
+    surfaces: ["@lucern/sdk", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "reasoning.context.compile",
+    description: "Compile tenant and workspace scoped reasoning context.",
+    surfaces: ["@lucern/sdk", "@lucern/react", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "reasoning.graph.read",
+    description: "Read beliefs, evidence, questions, topics, graph edges, and lineage.",
+    surfaces: ["@lucern/sdk", "@lucern/react", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "reasoning.graph.write",
+    description: "Create and update graph objects through authorized APIs.",
+    surfaces: ["@lucern/sdk", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "reasoning.graph_intelligence.run",
+    description: "Discover and run Graph Intelligence query recipes for structural graph analysis.",
+    surfaces: ["@lucern/sdk", "@lucern/cli", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "reasoning.graph_mirroring.install",
+    description: "Install and run the optional Neo4j graph mirror for paid or enterprise tenant deployments.",
+    surfaces: ["@lucern/graph-sync", "@lucern/cli"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  },
+  {
+    id: "workflow.worktree_lifecycle",
+    description: "Create, review, merge, and close scoped worktrees.",
+    surfaces: ["@lucern/sdk", "@lucern/react", "@lucern/mcp"],
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS
+  }
+];
+var TENANT_CLIENT_ISOLATION_RULES = [
+  {
+    id: "tenant_workspace_scope_required",
+    description: "Runtime operations must resolve both tenantId and workspaceId before reaching Lucern reasoning state."
+  },
+  {
+    id: "principal_audit_required",
+    description: "Runtime operations must carry principalId, authMode, and scopes for audit attribution."
+  },
+  {
+    id: "no_private_lucern_imports",
+    description: "Tenant code must not import Lucern source, Convex internals, generated adapters, or unpublished package internals."
+  }
+];
+var TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS = [
+  {
+    id: "deep_src_import",
+    pattern: "^@lucern/[^/]+/src(?:/|$)",
+    description: "Published packages must not be bypassed through src paths."
+  },
+  {
+    id: "deep_dist_import",
+    pattern: "^@lucern/[^/]+/dist(?:/|$)",
+    description: "Published package exports must be used instead of dist file paths."
+  },
+  {
+    id: "generated_adapter_import",
+    pattern: "^@lucern/[^/]+/(?:adapters/)?_generated(?:/|$)",
+    description: "Generated Lucern adapters are internal deployment artifacts."
+  },
+  {
+    id: "private_runtime_import",
+    pattern: "^@lucern/[^/]+/(?:internal|private)(?:/|$)",
+    description: "Internal and private package subpaths are not public SDK API."
+  },
+  {
+    id: "workspace_source_import",
+    pattern: "^(?:packages|modules|services|lucern|apps)/(?:.+/)?src(?:/|$)",
+    description: "Tenant clients must not import source files from the Lucern monorepo."
+  },
+  {
+    id: "root_alias_lucern_import",
+    pattern: "^@/(?:lucern|packages|modules|services|apps)(?:/|$)",
+    description: "Tenant clients must not depend on Lucern repo-local path aliases."
+  },
+  {
+    id: "relative_lucern_source_import",
+    pattern: "^\\.\\.?/(?:.+/)?(?:packages|modules|services|lucern|apps)(?:/|$)",
+    description: "Tenant clients must not reach back into Lucern source through relative paths."
+  },
+  {
+    id: "monorepo_path_import",
+    pattern: "lucern-repo",
+    description: "Absolute imports that name the Lucern repository are not portable tenant code."
+  }
+];
+function matchesPublicImport(importPath) {
+  const componentConfig = TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.find(
+    (entry) => importPath === entry.importPath
+  );
+  if (componentConfig) {
+    return componentConfig;
+  }
+  return TENANT_CLIENT_PUBLIC_IMPORTS.find(
+    (entry) => importPath === entry.packageName || importPath.startsWith(`${entry.packageName}/`)
+  );
+}
+function matchesForbiddenPattern(importPath) {
+  return TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS.find(
+    (entry) => new RegExp(entry.pattern, "u").test(importPath)
+  );
+}
+function classifyTenantClientImport(importPath) {
+  const normalizedImportPath = importPath.trim();
+  const pattern = matchesForbiddenPattern(normalizedImportPath);
+  if (pattern) {
+    return {
+      importPath: normalizedImportPath,
+      decision: "forbidden",
+      pattern,
+      reason: pattern.description
+    };
+  }
+  const publicImport = matchesPublicImport(normalizedImportPath);
+  if (publicImport) {
+    return {
+      importPath: normalizedImportPath,
+      decision: "public",
+      publicImport,
+      reason: publicImport.description
+    };
+  }
+  if (normalizedImportPath.startsWith("@lucern/")) {
+    return {
+      importPath: normalizedImportPath,
+      decision: "forbidden",
+      reason: "This @lucern package is not part of the tenant client public surface."
+    };
+  }
+  if (normalizedImportPath.startsWith("./") || normalizedImportPath.startsWith("../")) {
+    return {
+      importPath: normalizedImportPath,
+      decision: "local",
+      reason: "Local tenant-owned import."
+    };
+  }
+  return {
+    importPath: normalizedImportPath,
+    decision: "external",
+    reason: "External dependency outside the Lucern package namespace."
+  };
+}
+function isTenantClientPublicImport(importPath) {
+  return classifyTenantClientImport(importPath).decision === "public";
+}
+function isTenantClientComponentConfigImport(importPath) {
+  return TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS.some(
+    (entry) => importPath === entry.importPath
+  );
+}
+function isTenantClientAllowedImport(importPath) {
+  return classifyTenantClientImport(importPath).decision === "public";
+}
+function assertTenantClientImportAllowed(importPath) {
+  const classification = classifyTenantClientImport(importPath);
+  if (classification.decision !== "forbidden") {
+    return;
+  }
+  throw new Error(formatTenantClientImportViolation(classification));
+}
+function formatTenantClientImportViolation(classification) {
+  const patternId = classification.pattern ? ` [${classification.pattern.id}]` : "";
+  return `Tenant client import is not allowed${patternId}: ${classification.importPath}. ${classification.reason}`;
+}
+
+// src/infisical-runtime.contract.ts
+var INFISICAL_RUNTIME_CONTRACT_VERSION = "2026-04-28";
+var INFISICAL_RUNTIME_DEFAULT_API_URL = "https://app.infisical.com";
+var INFISICAL_RUNTIME_DEFAULT_PROJECT_ID = "344b0526-90df-4606-ba50-22c647a36c65";
+var INFISICAL_RUNTIME_ENVIRONMENTS = [
+  "dev",
+  "staging",
+  "prod"
+];
+var INFISICAL_RUNTIME_DELIVERY_MODES = [
+  "vercel_sync",
+  "runtime_fetch",
+  "device_auth"
+];
+var INFISICAL_RUNTIME_SURFACE_IDS = [
+  "lucern-web",
+  "lucern-gateway",
+  "lucern-sdk",
+  "lucern-cli",
+  "lucern-mcp",
+  "tenant-client"
+];
+var INFISICAL_RUNTIME_BOOTSTRAP_ENV = {
+  apiUrl: ["INFISICAL_API_URL", "INFISICAL_URL"],
+  projectId: ["INFISICAL_PROJECT_ID", "INFISICAL_WORKSPACE_ID"],
+  clientId: [
+    "INFISICAL_CLIENT_ID",
+    "INFISICAL_MACHINE_CLIENT_ID",
+    "INFISICAL_UNIVERSAL_AUTH_CLIENT_ID"
+  ],
+  clientSecret: [
+    "INFISICAL_CLIENT_SECRET",
+    "INFISICAL_MACHINE_CLIENT_SECRET",
+    "INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET"
+  ],
+  environment: ["INFISICAL_ENV", "LUCERN_INFISICAL_ENV"],
+  organizationSlug: ["INFISICAL_ORG_SLUG", "INFISICAL_ORGANIZATION_SLUG"],
+  disabled: ["LUCERN_INFISICAL_DISABLE", "INFISICAL_DISABLE"]
+};
+var INFISICAL_RUNTIME_PATHS = [
+  {
+    id: "platform-auth",
+    secretPath: "/platform/auth",
+    description: "Lucern platform authentication secrets. Synced into Vercel web/gateway projects; never distributed to tenant tools.",
+    variables: [
+      {
+        name: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY",
+        required: true,
+        secret: false,
+        public: true,
+        description: "Clerk publishable key for the Lucern web origin."
+      },
+      {
+        name: "CLERK_SECRET_KEY",
+        required: true,
+        secret: true,
+        public: false,
+        description: "Clerk backend secret key for Lucern server runtimes."
+      },
+      {
+        name: "CLERK_JWT_ISSUER_DOMAIN",
+        required: false,
+        secret: false,
+        public: false,
+        description: "Expected Clerk issuer/JWKS domain for JWT verification."
+      },
+      {
+        name: "NEXT_PUBLIC_CLERK_SIGN_IN_URL",
+        required: false,
+        secret: false,
+        public: true,
+        description: "Public sign-in URL for Lucern-owned web flows."
+      },
+      {
+        name: "NEXT_PUBLIC_CLERK_SIGN_UP_URL",
+        required: false,
+        secret: false,
+        public: true,
+        description: "Public sign-up URL for Lucern-owned web flows."
+      }
+    ]
+  },
+  {
+    id: "platform-runtime",
+    secretPath: "/platform/runtime",
+    description: "Runtime defaults shared by server-side Lucern clients and operator tooling.",
+    variables: [
+      {
+        name: "LUCERN_API_URL",
+        required: true,
+        secret: false,
+        public: false,
+        aliases: ["LUCERN_API_BASE_URL", "LUCERN_BASE_URL"],
+        description: "Canonical Lucern API gateway URL."
+      },
+      {
+        name: "LUCERN_LOGIN_BASE_URL",
+        required: false,
+        secret: false,
+        public: false,
+        aliases: ["LUCERN_AUTH_BASE_URL"],
+        description: "Browser login origin used when it differs from the API."
+      },
+      {
+        name: "LUCERN_ENVIRONMENT",
+        required: false,
+        secret: false,
+        public: false,
+        aliases: ["LUCERN_ENV"],
+        description: "Lucern environment label consumed by CLI profiles."
+      }
+    ]
+  },
+  {
+    id: "tenant-shared-install",
+    secretPath: TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH,
+    description: "Tenant package-install secrets. This is install-only and distinct from platform publish credentials.",
+    variables: [
+      {
+        name: "INSTALL_LUCERN_NPM",
+        required: true,
+        secret: true,
+        public: false,
+        description: "Read-only install token for the published @lucern/* suite."
+      }
+    ]
+  }
+];
+var INFISICAL_RUNTIME_SURFACES = [
+  {
+    id: "lucern-web",
+    delivery: "vercel_sync",
+    sourcePathIds: ["platform-auth", "platform-runtime"],
+    consumer: "apps/web on Vercel project lucern",
+    description: "Lucern web consumes Clerk and runtime config via Infisical-to-Vercel syncs."
+  },
+  {
+    id: "lucern-gateway",
+    delivery: "vercel_sync",
+    sourcePathIds: ["platform-auth", "platform-runtime"],
+    consumer: "apps/gateway on Vercel project lucern-gateway",
+    description: "Lucern gateway consumes platform config via Infisical-to-Vercel syncs."
+  },
+  {
+    id: "lucern-sdk",
+    packageName: "@lucern/sdk",
+    delivery: "runtime_fetch",
+    sourcePathIds: ["platform-runtime"],
+    consumer: "server-side SDK operator contexts with a scoped Infisical identity",
+    description: "SDK exposes the runtime Infisical resolver used by clients that have machine identity credentials."
+  },
+  {
+    id: "lucern-cli",
+    packageName: "@lucern/cli",
+    delivery: "runtime_fetch",
+    fallback: "device_auth",
+    sourcePathIds: ["platform-runtime"],
+    consumer: "developer/operator CLI processes",
+    description: "CLI hydrates runtime defaults from Infisical when configured, then authenticates users through Lucern device login."
+  },
+  {
+    id: "lucern-mcp",
+    packageName: "@lucern/mcp",
+    delivery: "runtime_fetch",
+    fallback: "device_auth",
+    sourcePathIds: ["platform-runtime"],
+    consumer: "MCP server/client processes",
+    description: "MCP hydrates runtime defaults through the SDK resolver and remains a Lucern client, not a platform secret owner."
+  },
+  {
+    id: "tenant-client",
+    delivery: "device_auth",
+    sourcePathIds: ["tenant-shared-install"],
+    consumer: "tenant-owned apps and coding agents",
+    description: "Tenant clients install the published packages and receive user/service credentials through Lucern auth surfaces."
+  }
+];
+function findInfisicalRuntimePath(pathId) {
+  return INFISICAL_RUNTIME_PATHS.find((path) => path.id === pathId);
+}
+function findInfisicalRuntimeSurface(surfaceId) {
+  return INFISICAL_RUNTIME_SURFACES.find(
+    (surface) => surface.id === surfaceId
+  );
+}
+
+// src/manifests/infisical-runtime-manifest.ts
+var INFISICAL_RUNTIME_MANIFEST = {
+  manifestVersion: "1.0.0",
+  contractVersion: INFISICAL_RUNTIME_CONTRACT_VERSION,
+  project: {
+    id: INFISICAL_RUNTIME_DEFAULT_PROJECT_ID,
+    apiUrl: INFISICAL_RUNTIME_DEFAULT_API_URL
+  },
+  environments: INFISICAL_RUNTIME_ENVIRONMENTS,
+  deliveryModes: INFISICAL_RUNTIME_DELIVERY_MODES,
+  bootstrapEnv: INFISICAL_RUNTIME_BOOTSTRAP_ENV,
+  paths: INFISICAL_RUNTIME_PATHS,
+  surfaces: INFISICAL_RUNTIME_SURFACES
+};
+var InvariantManifestSchema = z.object({
+  manifestVersion: z.literal("1.0.0"),
+  rules: z.array(
+    z.object({
+      invariant: z.string(),
+      description: z.string(),
+      checker: z.enum(["ast", "manifest", "runtime"]),
+      severity: z.enum(["block_publish", "block_pr", "warn"])
+    })
+  )
+});
+
+// src/manifests/tenant-client-manifest.ts
+var TENANT_CLIENT_MANIFEST = {
+  manifestVersion: "1.0.0",
+  contractVersion: TENANT_CLIENT_CONTRACT_VERSION,
+  auth: {
+    modes: TENANT_CLIENT_AUTH_MODES,
+    principalTypes: TENANT_CLIENT_PRINCIPAL_TYPES,
+    requiredContextFields: TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS,
+    optionalContextFields: TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS
+  },
+  installToken: {
+    env: TENANT_CLIENT_INSTALL_TOKEN_ENV,
+    infisicalPath: TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH,
+    forbiddenInfisicalPaths: TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS,
+    forbiddenSecretEnv: TENANT_CLIENT_FORBIDDEN_SECRET_ENV
+  },
+  packages: {
+    installable: TENANT_CLIENT_INSTALLABLE_PACKAGES,
+    installProfiles: TENANT_CLIENT_INSTALL_PROFILES,
+    directImports: TENANT_CLIENT_PUBLIC_IMPORTS,
+    componentConfigImports: TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS
+  },
+  sdk: {
+    requiredNamespaces: TENANT_CLIENT_REQUIRED_SDK_NAMESPACES
+  },
+  capabilities: TENANT_CLIENT_CAPABILITIES,
+  isolationRules: TENANT_CLIENT_ISOLATION_RULES,
+  forbiddenImportPatterns: TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS
+};
+
+// src/projections/projection-dsl.ts
+function defineProjection(def) {
+  return def;
+}
+
+// src/projections/create-evidence.projection.ts
+var jsonRecordSchema = z.record(z.unknown());
+var createEvidenceInputSchemaBase = z.object({
+  projectId: z.string().optional(),
+  topicId: z.string().optional(),
+  text: z.string().optional(),
+  canonicalText: z.string().optional(),
+  title: z.string().optional(),
+  content: z.string().optional(),
+  contentType: z.string().optional(),
+  kind: z.string().optional(),
+  tags: z.array(z.string()).optional(),
+  source: z.string().optional(),
+  sourceUrl: z.string().optional(),
+  sourceType: z.string().optional(),
+  externalSourceType: z.string().optional(),
+  sourceQuestionId: z.string().optional(),
+  methodology: z.string().optional(),
+  informationAsymmetry: z.string().optional(),
+  sourceDescription: z.string().optional(),
+  targetId: z.string().optional(),
+  targetNodeId: z.string().optional(),
+  linkedBeliefNodeId: z.string().optional(),
+  evidenceRelation: z.enum(["supports", "contradicts", "neutral"]).optional(),
+  confidence: z.number().optional(),
+  weight: z.number().optional(),
+  reasoning: z.string().optional(),
+  rationale: z.string(),
+  metadata: jsonRecordSchema.optional(),
+  trustedBypassAccessCheck: z.boolean().optional()
+}).passthrough();
+var createEvidenceInputSchema = createEvidenceInputSchemaBase.refine(
+  (input) => Boolean(input.text ?? input.canonicalText),
+  {
+    message: "create_evidence requires text",
+    path: ["text"]
+  }
+);
+function compactRecord(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, value]) => value !== void 0)
   );
 }
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
 function recordValue(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  return isRecord(value) ? value : {};
 }
 var createEvidenceProjection = defineProjection({
   contractName: "create_evidence",
@@ -5915,8 +7479,12 @@ __export(tool_contracts_exports, {
   APPLY_LENS_TO_TOPIC: () => APPLY_LENS_TO_TOPIC,
   APPLY_ONTOLOGY: () => APPLY_ONTOLOGY,
   ARCHIVE_BELIEF: () => ARCHIVE_BELIEF,
+  ARCHIVE_EPISTEMIC_NODE: () => ARCHIVE_EPISTEMIC_NODE,
   ARCHIVE_ONTOLOGY: () => ARCHIVE_ONTOLOGY,
   ARCHIVE_QUESTION: () => ARCHIVE_QUESTION,
+  BATCH_CREATE_EDGES: () => BATCH_CREATE_EDGES,
+  BATCH_CREATE_EPISTEMIC_NODES: () => BATCH_CREATE_EPISTEMIC_NODES,
+  BEGIN_BUILD_SESSION: () => BEGIN_BUILD_SESSION,
   BISECT_CONFIDENCE: () => BISECT_CONFIDENCE,
   BROADCAST_MESSAGE: () => BROADCAST_MESSAGE,
   CHECK_PERMISSION: () => CHECK_PERMISSION,
@@ -5927,6 +7495,7 @@ __export(tool_contracts_exports, {
   CREATE_BELIEF: () => CREATE_BELIEF,
   CREATE_EDGE: () => CREATE_EDGE,
   CREATE_EPISTEMIC_CONTRACT: () => CREATE_EPISTEMIC_CONTRACT,
+  CREATE_EPISTEMIC_NODE: () => CREATE_EPISTEMIC_NODE,
   CREATE_EVIDENCE: () => CREATE_EVIDENCE,
   CREATE_LENS: () => CREATE_LENS,
   CREATE_ONTOLOGY: () => CREATE_ONTOLOGY,
@@ -5954,6 +7523,7 @@ __export(tool_contracts_exports, {
   GET_CODE_CONTEXT: () => GET_CODE_CONTEXT,
   GET_CONFIDENCE_HISTORY: () => GET_CONFIDENCE_HISTORY,
   GET_CONTRACT_STATUS: () => GET_CONTRACT_STATUS,
+  GET_EPISTEMIC_NODE: () => GET_EPISTEMIC_NODE,
   GET_EVIDENCE: () => GET_EVIDENCE,
   GET_FAILURE_LOG: () => GET_FAILURE_LOG,
   GET_FALSIFICATION_QUESTIONS: () => GET_FALSIFICATION_QUESTIONS,
@@ -5967,6 +7537,7 @@ __export(tool_contracts_exports, {
   GET_QUESTION: () => GET_QUESTION,
   GET_TOPIC: () => GET_TOPIC,
   GET_TOPIC_COVERAGE: () => GET_TOPIC_COVERAGE,
+  GET_TOPIC_GRAPH_SPINE: () => GET_TOPIC_GRAPH_SPINE,
   GET_TOPIC_TREE: () => GET_TOPIC_TREE,
   GIT_SEMANTIC_REQUIRED_TOOLS: () => GIT_SEMANTIC_REQUIRED_TOOLS,
   HEARTBEAT_SESSION: () => HEARTBEAT_SESSION,
@@ -5979,7 +7550,9 @@ __export(tool_contracts_exports, {
   LIST_ALL_WORKTREES: () => LIST_ALL_WORKTREES,
   LIST_BELIEFS: () => LIST_BELIEFS,
   LIST_CAMPAIGNS: () => LIST_CAMPAIGNS,
+  LIST_EPISTEMIC_NODES: () => LIST_EPISTEMIC_NODES,
   LIST_EVIDENCE: () => LIST_EVIDENCE,
+  LIST_GRAPH_INTELLIGENCE_QUERIES: () => LIST_GRAPH_INTELLIGENCE_QUERIES,
   LIST_LENSES: () => LIST_LENSES,
   LIST_ONTOLOGIES: () => LIST_ONTOLOGIES,
   LIST_QUESTIONS: () => LIST_QUESTIONS,
@@ -5988,6 +7561,7 @@ __export(tool_contracts_exports, {
   LIST_WORKTREES: () => LIST_WORKTREES,
   MANAGE_WRITE_POLICY: () => MANAGE_WRITE_POLICY,
   MATCH_ENTITY_TYPE: () => MATCH_ENTITY_TYPE,
+  MATERIALIZE_TOPIC_GRAPH: () => MATERIALIZE_TOPIC_GRAPH,
   MCP_TOOL_CONTRACTS: () => MCP_TOOL_CONTRACTS,
   MERGE: () => MERGE,
   MODULATE_CONFIDENCE: () => MODULATE_CONFIDENCE,
@@ -6002,21 +7576,28 @@ __export(tool_contracts_exports, {
   REFINE_BELIEF: () => REFINE_BELIEF,
   REFINE_QUESTION: () => REFINE_QUESTION,
   REGISTER_SESSION: () => REGISTER_SESSION,
+  REMOVE_EDGE: () => REMOVE_EDGE,
+  REMOVE_EDGES_BETWEEN: () => REMOVE_EDGES_BETWEEN,
   REMOVE_LENS_FROM_TOPIC: () => REMOVE_LENS_FROM_TOPIC,
   RESOLVE_EFFECTIVE_ONTOLOGY: () => RESOLVE_EFFECTIVE_ONTOLOGY,
+  RUN_GRAPH_INTELLIGENCE_QUERY: () => RUN_GRAPH_INTELLIGENCE_QUERY,
   SEARCH_BELIEFS: () => SEARCH_BELIEFS,
   SEARCH_EVIDENCE: () => SEARCH_EVIDENCE,
   SEED_BELIEF_LATTICE: () => SEED_BELIEF_LATTICE,
   SEND_AGENT_MESSAGE: () => SEND_AGENT_MESSAGE,
+  SUPERSEDE_EPISTEMIC_NODE: () => SUPERSEDE_EPISTEMIC_NODE,
   TRACE_ENTITY_IMPACT: () => TRACE_ENTITY_IMPACT,
   TRAVERSE_GRAPH: () => TRAVERSE_GRAPH,
   TRIGGER_BELIEF_REVIEW: () => TRIGGER_BELIEF_REVIEW,
+  UPDATE_EDGE: () => UPDATE_EDGE,
+  UPDATE_EPISTEMIC_NODE: () => UPDATE_EPISTEMIC_NODE,
   UPDATE_ONTOLOGY: () => UPDATE_ONTOLOGY,
   UPDATE_QUESTION_STATUS: () => UPDATE_QUESTION_STATUS,
   UPDATE_TASK: () => UPDATE_TASK,
   UPDATE_TOPIC: () => UPDATE_TOPIC,
   UPDATE_WORKTREE_METADATA: () => UPDATE_WORKTREE_METADATA,
   UPDATE_WORKTREE_TARGETS: () => UPDATE_WORKTREE_TARGETS,
+  VERIFY_EPISTEMIC_NODE: () => VERIFY_EPISTEMIC_NODE,
   validateGitSemantics: () => validateGitSemantics
 });
 
@@ -6440,7 +8021,22 @@ var ADD_WORKTREE = {
   description: "Check out a branch into an active worktree for investigation. Like `git worktree add <branch>` \u2014 creates independent working state on a thematic branch. Beliefs committed within the worktree can be freely amended (draft code on a feature branch). When investigation is complete, `merge` integrates findings into main.",
   parameters: {
     title: { type: "string", description: "Worktree name/objective" },
-    topicId: { type: "string", description: "Optional topic scope hint" },
+    name: {
+      type: "string",
+      description: "Optional storage-name alias for callers that already use backend naming"
+    },
+    projectId: {
+      type: "string",
+      description: "Legacy topicId alias or resolver hint"
+    },
+    topicId: {
+      type: "string",
+      description: "Optional topic scope hint for resolver validation"
+    },
+    topicHint: {
+      type: "string",
+      description: "Natural-language topic hint for automatic topic resolution"
+    },
     branchId: {
       type: "string",
       description: "The branch this worktree investigates"
@@ -6453,17 +8049,106 @@ var ADD_WORKTREE = {
       type: "string",
       description: "The testable claim this worktree investigates"
     },
+    rationale: {
+      type: "string",
+      description: "Why this worktree exists and why it belongs in the campaign"
+    },
+    worktreeType: {
+      type: "string",
+      description: "Schema-enum worktree type used by the kernel lifecycle and retrieval layers"
+    },
+    gate: {
+      type: "string",
+      description: "Exit gate name for this worktree"
+    },
+    startDate: {
+      type: "number",
+      description: "Planned start timestamp in milliseconds since epoch"
+    },
+    endDate: {
+      type: "number",
+      description: "Planned end timestamp in milliseconds since epoch"
+    },
+    durationWeeks: {
+      type: "number",
+      description: "Planned duration in weeks"
+    },
+    confidenceImpact: {
+      type: "string",
+      description: "Expected confidence impact if the worktree succeeds",
+      enum: ["high", "medium", "low"]
+    },
+    beliefFocus: {
+      type: "string",
+      description: "Natural-language focus spanning the target belief neighborhood"
+    },
     beliefIds: {
       type: "array",
-      description: "Beliefs to test in this worktree"
+      description: "Legacy alias for targetBeliefIds"
+    },
+    beliefs: {
+      type: "array",
+      description: "Legacy alias for targetBeliefIds"
+    },
+    targetBeliefIds: {
+      type: "array",
+      description: "Belief node IDs this worktree is expected to test or update"
+    },
+    targetQuestionIds: {
+      type: "array",
+      description: "Question node IDs this worktree is expected to answer"
+    },
+    keyQuestions: {
+      type: "array",
+      description: "Inline key question objects with question, optional status, answer, answerConfidence, and linkedQuestionId"
+    },
+    evidenceSignals: {
+      type: "array",
+      description: "Evidence signal objects with signal, optional collected state, progress, and notes"
+    },
+    decisionGate: {
+      type: "object",
+      description: "Decision gate object with goCriteria, noGoSignals, optional verdict, rationale, decidedAt, and decidedBy"
+    },
+    goCriteria: {
+      type: "array",
+      description: "Shorthand go criteria used to build decisionGate"
+    },
+    noGoSignals: {
+      type: "array",
+      description: "Shorthand no-go signals used to build decisionGate"
+    },
+    proofArtifacts: {
+      type: "array",
+      description: "Expected proof artifacts required to close the worktree"
+    },
+    autoShape: {
+      type: "boolean",
+      description: "Whether to invoke inquiry auto-shaping during worktree creation"
+    },
+    autoFixPolicy: {
+      type: "object",
+      description: "Policy for permitted automatic remediation inside the worktree"
+    },
+    domainPackId: {
+      type: "string",
+      description: "Optional domain pack whose shaping hooks should influence generated questions and tasks"
+    },
+    tags: {
+      type: "array",
+      description: "Additional topic-resolution tags for the worktree"
+    },
+    touchedPaths: {
+      type: "array",
+      description: "File paths used as topic-resolution signals"
     },
-    autoShape: {
-      type: "boolean",
-      description: "Whether to invoke inquiry auto-shaping during worktree creation"
+    sourceRef: {
+      type: "string",
+      description: "Source reference used as a topic-resolution signal"
     },
-    domainPackId: {
+    sourceKind: {
       type: "string",
-      description: "Optional domain pack whose shaping hooks should influence generated questions and tasks"
+      description: "Source kind used as a topic-resolution signal"
     },
     campaign: {
       type: "number",
@@ -6489,12 +8174,20 @@ var ADD_WORKTREE = {
       type: "array",
       description: "Worktree IDs blocked by this worktree"
     },
-    gate: {
+    staffingHint: {
       type: "string",
-      description: "Exit gate name for this worktree"
+      description: "Suggested staffing or agent allocation note"
+    },
+    lensId: {
+      type: "string",
+      description: "Lens that scopes this worktree when applicable"
+    },
+    lastReconciledAt: {
+      type: "number",
+      description: "Timestamp when worktree metadata was last reconciled"
     }
   },
-  required: ["title", "topicId"],
+  required: ["title"],
   response: {
     description: "The created worktree",
     fields: {
@@ -6521,7 +8214,7 @@ var MERGE = {
     worktreeId: { type: "string", description: "The worktree to merge" },
     outcomes: {
       type: "array",
-      description: "Scoring outcomes for each belief: { beliefId, confidence, rationale }"
+      description: "Merge outcomes as key-finding strings, or scoring outcomes for beliefs: { beliefId, confidence, rationale }"
     },
     summary: { type: "string", description: "Overall findings summary" }
   },
@@ -6739,19 +8432,23 @@ var FIND_CONTRADICTIONS = {
 };
 var CREATE_EDGE = {
   name: "create_edge",
-  description: "Commit a typed relationship between two nodes in the reasoning graph. Like `git commit` \u2014 an atomic write that declares a dependency between nodes. The engine enforces layer transition rules \u2014 for example, L1 \u2192 L3 direct edges are forbidden (must go through L2).",
+  description: "Commit a typed relationship between two nodes in the reasoning graph. Like `git commit` \u2014 an atomic write that declares a dependency between nodes. Accepts any public epistemic edge type between public graph node refs so agents can author the full spine.",
   parameters: {
-    sourceId: {
-      type: "string",
-      description: "Source node of the relationship"
+    from: {
+      type: "object",
+      description: "Source graph ref, e.g. { kind: 'epistemic_node', nodeId: '...', nodeType: 'topic' }"
     },
-    targetId: {
-      type: "string",
-      description: "Target node of the relationship"
+    to: {
+      type: "object",
+      description: "Target graph ref, e.g. { kind: 'epistemic_node', nodeId: '...', nodeType: 'belief' }"
     },
     edgeType: {
       type: "string",
-      description: "Relationship type (informs, tests, depends_on, supersedes, etc.)"
+      description: "Relationship type from the public epistemic edge enum."
+    },
+    globalId: {
+      type: "string",
+      description: "Optional idempotent edge global ID."
     },
     weight: {
       type: "number",
@@ -6762,9 +8459,13 @@ var CREATE_EDGE = {
       type: "string",
       description: "How this was determined",
       enum: ["deductive", "inductive", "abductive", "analogical", "empirical"]
+    },
+    metadata: {
+      type: "object",
+      description: "Optional edge metadata."
     }
   },
-  required: ["sourceId", "targetId", "edgeType"],
+  required: ["from", "to", "edgeType"],
   response: {
     description: "The created edge",
     fields: {
@@ -6778,6 +8479,240 @@ var CREATE_EDGE = {
   ontologyPrimitive: "edge",
   tier: "showcase"
 };
+var UPDATE_EDGE = {
+  name: "update_edge",
+  description: "Amend metadata on an existing graph edge. Like `git commit --amend` \u2014 changes the edge annotation without recreating the relationship.",
+  parameters: {
+    edgeId: { type: "string", description: "Edge ID or global ID to update" },
+    weight: { type: "number", description: "Updated edge weight" },
+    confidence: { type: "number", description: "Updated confidence" },
+    context: { type: "string", description: "Updated human-readable context" },
+    derivationType: { type: "string", description: "Updated derivation type" },
+    metadata: { type: "object", description: "Updated metadata" }
+  },
+  required: ["edgeId"],
+  response: {
+    description: "Edge update result",
+    fields: { success: "boolean" }
+  },
+  ownerModule: "graph-primitives",
+  ontologyPrimitive: "edge",
+  tier: "workhorse"
+};
+var REMOVE_EDGE = {
+  name: "remove_edge",
+  description: "Remove one graph edge by ID. Like `git rm` \u2014 deletes a single explicit relationship from the spine.",
+  parameters: {
+    edgeId: { type: "string", description: "Edge ID or global ID to remove" }
+  },
+  required: ["edgeId"],
+  response: {
+    description: "Edge removal result",
+    fields: { success: "boolean" }
+  },
+  ownerModule: "graph-primitives",
+  ontologyPrimitive: "edge",
+  tier: "workhorse"
+};
+var REMOVE_EDGES_BETWEEN = {
+  name: "remove_edges_between",
+  description: "Remove graph edges between two nodes. Like `git rm <pathspec>` \u2014 deletes relationships matching a source, target, and optional type.",
+  parameters: {
+    fromNodeId: { type: "string", description: "Source node ID or global ID" },
+    toNodeId: { type: "string", description: "Target node ID or global ID" },
+    edgeType: { type: "string", description: "Optional edge type filter" }
+  },
+  required: ["fromNodeId", "toNodeId"],
+  response: {
+    description: "Matched edge removal result",
+    fields: { deleted: "number" }
+  },
+  ownerModule: "graph-primitives",
+  ontologyPrimitive: "edge",
+  tier: "workhorse"
+};
+var BATCH_CREATE_EDGES = {
+  name: "batch_create_edges",
+  description: "Commit multiple typed graph edges. Like `git commit` with many staged paths \u2014 writes a batch of explicit relationships atomically per edge.",
+  parameters: {
+    edges: {
+      type: "array",
+      description: "Edges to create, each with from, to, edgeType, and optional weight/confidence/context."
+    },
+    skipLayerValidation: {
+      type: "boolean",
+      description: "Skip kernel layer validation for trusted materialization flows."
+    }
+  },
+  required: ["edges"],
+  response: {
+    description: "Batch edge creation result",
+    fields: {
+      created: "number",
+      results: "array",
+      errors: "array"
+    }
+  },
+  ownerModule: "graph-primitives",
+  ontologyPrimitive: "edge",
+  tier: "workhorse"
+};
+var CREATE_EPISTEMIC_NODE = {
+  name: "create_epistemic_node",
+  description: "Commit a generic epistemic graph node. Like `git commit` \u2014 creates a canonical node in the public spine for topics, beliefs, evidence, questions, answers, sources, and entities.",
+  parameters: {
+    globalId: { type: "string", description: "Optional idempotent node global ID" },
+    nodeType: { type: "string", description: "Public epistemic node type" },
+    canonicalText: { type: "string", description: "Canonical node text" },
+    text: { type: "string", description: "Alias for canonicalText" },
+    contentHash: { type: "string", description: "Optional idempotency content hash" },
+    sourceType: { type: "string", description: "Source type for provenance" },
+    topicId: { type: "string", description: "Optional topic scope" },
+    content: { type: "string", description: "Extended content" },
+    title: { type: "string", description: "Display title" },
+    metadata: { type: "object", description: "Optional node metadata" }
+  },
+  required: ["nodeType"],
+  response: {
+    description: "Created node result",
+    fields: {
+      nodeId: "string",
+      nodeGlobalId: "string",
+      isDuplicate: "boolean"
+    }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "showcase"
+};
+var GET_EPISTEMIC_NODE = {
+  name: "get_epistemic_node",
+  description: "Read one epistemic graph node. Like `git show` \u2014 resolves a canonical spine node by ID or global ID.",
+  parameters: {
+    nodeId: { type: "string", description: "Node ID or global ID" }
+  },
+  required: ["nodeId"],
+  response: {
+    description: "The resolved node",
+    fields: { node: "object" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var LIST_EPISTEMIC_NODES = {
+  name: "list_epistemic_nodes",
+  description: "List epistemic graph nodes. Like `git ls-tree` \u2014 lists canonical spine nodes by topic, type, status, or search query.",
+  parameters: {
+    topicId: { type: "string", description: "Optional topic scope" },
+    nodeType: { type: "string", description: "Optional node type filter" },
+    status: { type: "string", description: "Optional lifecycle status" },
+    searchQuery: { type: "string", description: "Optional text search query" },
+    limit: { type: "number", description: "Maximum nodes to return" }
+  },
+  required: [],
+  response: {
+    description: "Matching nodes",
+    fields: { nodes: "array" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var UPDATE_EPISTEMIC_NODE = {
+  name: "update_epistemic_node",
+  description: "Amend an epistemic graph node. Like `git commit --amend` \u2014 updates mutable node metadata, text, status, or verification fields.",
+  parameters: {
+    nodeId: { type: "string", description: "Node ID or global ID" },
+    canonicalText: { type: "string", description: "Updated canonical text" },
+    text: { type: "string", description: "Alias for canonicalText" },
+    contentHash: { type: "string", description: "Updated content hash" },
+    content: { type: "string", description: "Updated content" },
+    title: { type: "string", description: "Updated display title" },
+    metadata: { type: "object", description: "Updated metadata" },
+    confidence: { type: "number", description: "Updated confidence" },
+    verificationStatus: { type: "string", description: "Updated verification status" },
+    status: { type: "string", description: "Updated lifecycle status" }
+  },
+  required: ["nodeId"],
+  response: {
+    description: "Node update result",
+    fields: { success: "boolean" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var ARCHIVE_EPISTEMIC_NODE = {
+  name: "archive_epistemic_node",
+  description: "Archive an epistemic graph node. Like `git rm --cached` \u2014 removes a node from active traversal without hard-deleting it.",
+  parameters: {
+    nodeId: { type: "string", description: "Node ID or global ID" }
+  },
+  required: ["nodeId"],
+  response: {
+    description: "Archive result",
+    fields: { success: "boolean", effectiveStatus: "string" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var VERIFY_EPISTEMIC_NODE = {
+  name: "verify_epistemic_node",
+  description: "Record verification state on an epistemic graph node. Like `git tag` \u2014 marks the node with a reviewed verification state.",
+  parameters: {
+    nodeId: { type: "string", description: "Node ID or global ID" },
+    verificationStatus: { type: "string", description: "Verification status" },
+    confidence: { type: "number", description: "Optional confidence update" }
+  },
+  required: ["nodeId", "verificationStatus"],
+  response: {
+    description: "Verification result",
+    fields: { success: "boolean" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var SUPERSEDE_EPISTEMIC_NODE = {
+  name: "supersede_epistemic_node",
+  description: "Supersede an epistemic graph node with a new version. Like `git commit --amend` on an immutable history branch \u2014 creates the replacement and marks the old node superseded.",
+  parameters: {
+    oldNodeId: { type: "string", description: "Node ID or global ID to supersede" },
+    newGlobalId: { type: "string", description: "Optional replacement global ID" },
+    newCanonicalText: { type: "string", description: "Replacement canonical text" },
+    text: { type: "string", description: "Alias for newCanonicalText" },
+    newContentHash: { type: "string", description: "Optional replacement content hash" },
+    reason: { type: "string", description: "Reason for superseding" }
+  },
+  required: ["oldNodeId"],
+  response: {
+    description: "Supersede result",
+    fields: { oldNodeId: "string", newNodeId: "string" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var BATCH_CREATE_EPISTEMIC_NODES = {
+  name: "batch_create_epistemic_nodes",
+  description: "Commit multiple epistemic graph nodes. Like `git commit` with many staged files \u2014 writes a batch of canonical spine nodes.",
+  parameters: {
+    nodes: {
+      type: "array",
+      description: "Nodes to create with nodeType, canonicalText/text, and optional metadata."
+    }
+  },
+  required: ["nodes"],
+  response: {
+    description: "Batch node creation result",
+    fields: { created: "number", results: "array" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
 var RECORD_JUDGMENT = {
   name: "record_judgment",
   description: "Record a judgment \u2014 an irreversible commitment based on the current epistemic state. Like a `git tag` marking a release. A judgment synthesizes beliefs, evidence, and uncertainties into a determination. Once issued, a judgment is evaluated against the epistemic state that existed when it was made (knowledge horizon evaluation, Invariant #10).",
@@ -7075,6 +9010,74 @@ var GET_GRAPH_STRUCTURE_ANALYSIS = {
   ontologyPrimitive: "graph",
   tier: "showcase"
 };
+var LIST_GRAPH_INTELLIGENCE_QUERIES = {
+  name: "list_graph_intelligence_queries",
+  description: "List the Graph Intelligence query catalog that powers structural graph analysis experiences. Returns categories, query IDs, prompt templates, modes, and the public tool plan each query can use.",
+  parameters: {
+    categoryId: {
+      type: "string",
+      description: "Optional category filter, such as problems or strategic"
+    },
+    mode: {
+      type: "string",
+      description: "Optional mode filter: core, bias, stress, operational, alpha, semantic, or evidence"
+    }
+  },
+  required: [],
+  response: {
+    description: "Graph Intelligence query catalog and mode-to-tool mapping",
+    fields: {
+      categories: "array \u2014 query categories",
+      queries: "array \u2014 query definitions with prompt templates and tools",
+      quickQueries: "array \u2014 recommended one-click query presets",
+      publicToolNamesByMode: "object \u2014 public tool names available to each Graph Intelligence mode"
+    }
+  },
+  ownerModule: "graph-intelligence",
+  ontologyPrimitive: "graph",
+  tier: "showcase"
+};
+var RUN_GRAPH_INTELLIGENCE_QUERY = {
+  name: "run_graph_intelligence_query",
+  description: "Run a named Graph Intelligence query against a tenant topic graph. Returns the selected query, prompt, deterministic graph-analysis bundle, graph context, and public tool plan for model synthesis.",
+  parameters: {
+    topicId: { type: "string", description: "Topic to analyze" },
+    queryId: {
+      type: "string",
+      description: "Graph Intelligence query ID, such as confirmation-bias, pre-mortem, or thesis-summary"
+    },
+    prompt: {
+      type: "string",
+      description: "Optional custom prompt for custom analysis runs"
+    },
+    input: {
+      type: "string",
+      description: "Optional entity, theme, belief, company, or search text for input-driven queries"
+    },
+    mode: {
+      type: "string",
+      description: "Optional mode override: core, bias, stress, operational, alpha, semantic, or evidence"
+    },
+    limit: {
+      type: "number",
+      description: "Maximum graph context rows to return"
+    }
+  },
+  required: ["topicId"],
+  response: {
+    description: "Graph Intelligence query result bundle ready for model or prompt-library synthesis",
+    fields: {
+      query: "object \u2014 selected query definition",
+      prompt: "string \u2014 resolved prompt template",
+      toolPlan: "array \u2014 public tools and args the model can call next",
+      analysis: "object \u2014 structure, coverage, gap, and confirmation-bias analysis",
+      context: "object \u2014 sampled beliefs, questions, evidence, edges, and contradictions"
+    }
+  },
+  ownerModule: "graph-intelligence",
+  ontologyPrimitive: "graph",
+  tier: "showcase"
+};
 var GET_FALSIFICATION_QUESTIONS = {
   name: "get_falsification_questions",
   description: "Generate Popperian falsification questions for beliefs. Like `git test` \u2014 identifies the questions most likely to disprove current beliefs. Karl Popper as a tool: surfaces what would need to be true to invalidate each belief.",
@@ -7923,15 +9926,15 @@ var IDENTITY_WHOAMI = {
 };
 var COMPILE_CONTEXT = {
   name: "compile_context",
-  description: "Compile a focused reasoning context for a topic. Like `git log --graph --decorate` for the reasoning substrate \u2014 returns the canonical Pillar 3 context pack through the public API shape.",
+  description: "Compile a focused reasoning context. If topicId is omitted, Lucern resolves the best topic from the query. Like `git log --graph --decorate` for the reasoning substrate \u2014 returns the canonical Pillar 3 context pack through the public API shape.",
   parameters: {
     topicId: {
       type: "string",
-      description: "Topic scope ID to compile"
+      description: "Optional topic scope ID. Omit to resolve the topic from query."
     },
     query: {
       type: "string",
-      description: "Optional focus query used to rank context items"
+      description: "Focus query used to resolve the topic and rank context items. Required when topicId is omitted."
     },
     budget: {
       type: "number",
@@ -7955,7 +9958,7 @@ var COMPILE_CONTEXT = {
       description: "Include related ontological entities in the compiled result"
     }
   },
-  required: ["topicId"],
+  required: [],
   response: {
     description: "Compiled context pack for the requested topic",
     fields: {
@@ -8129,18 +10132,60 @@ var CREATE_TASK = {
   name: "create_task",
   description: "Create an execution task tied to the reasoning state. Like `git task` \u2014 tracks concrete work items (calls to make, data to gather, analyses to run) linked to questions, beliefs, or worktrees.",
   parameters: {
-    title: { type: "string", description: "Task description" },
+    title: { type: "string", description: "Task title" },
     topicId: { type: "string", description: "Topic scope" },
+    description: {
+      type: "string",
+      description: "Long-form task description"
+    },
     taskType: {
       type: "string",
-      description: "Type: research, interview, analysis, data_collection",
-      enum: ["research", "interview", "analysis", "data_collection"]
+      description: "Task taxonomy",
+      enum: [
+        "general",
+        "find_evidence",
+        "verify_claim",
+        "research",
+        "review",
+        "interview",
+        "analysis",
+        "track_metrics"
+      ]
+    },
+    priority: {
+      type: "string",
+      description: "Priority",
+      enum: ["urgent", "high", "medium", "low"]
+    },
+    status: {
+      type: "string",
+      description: "Initial status (defaults to todo)",
+      enum: ["todo", "in_progress", "blocked", "done"]
+    },
+    linkedWorktreeId: {
+      type: "string",
+      description: "Worktree this task belongs to"
+    },
+    linkedBeliefId: {
+      type: "string",
+      description: "Belief this task supports"
     },
     linkedQuestionId: {
       type: "string",
       description: "Question this task addresses"
     },
-    linkedWorktreeId: { type: "string", description: "Worktree scope" }
+    assigneeId: {
+      type: "string",
+      description: "Principal assigned to the task"
+    },
+    dueDate: {
+      type: "number",
+      description: "Due date as epoch milliseconds"
+    },
+    tags: {
+      type: "array",
+      description: "Free-form string tags"
+    }
   },
   required: ["title"],
   response: {
@@ -8260,6 +10305,10 @@ var CREATE_TOPIC = {
   name: "create_topic",
   description: "Create a new topic container for scoping knowledge. Like `git init` \u2014 initializes a new repository for a knowledge domain. Topics are hierarchical: a deal topic can nest under a theme topic. Types: domain, theme, deal, strategy, constitution, project, portfolio.",
   parameters: {
+    globalId: {
+      type: "string",
+      description: "Optional idempotent topic global ID"
+    },
     name: { type: "string", description: "Topic name" },
     type: {
       type: "string",
@@ -8270,6 +10319,18 @@ var CREATE_TOPIC = {
       type: "string",
       description: "Optional parent topic for nesting"
     },
+    parentTopicGlobalId: {
+      type: "string",
+      description: "Optional parent topic global ID for nesting"
+    },
+    tenantId: { type: "string", description: "Optional tenant scope" },
+    workspaceId: { type: "string", description: "Optional workspace scope" },
+    visibility: {
+      type: "string",
+      description: "Topic visibility",
+      enum: ["private", "team", "firm", "external", "public"]
+    },
+    metadata: { type: "object", description: "Optional topic metadata" },
     createdBy: { type: "string", description: "Who created this topic" }
   },
   required: ["name", "type"],
@@ -8278,6 +10339,9 @@ var CREATE_TOPIC = {
     fields: {
       id: "string \u2014 topic ID",
       globalId: "string \u2014 globally unique ID",
+      topicGlobalId: "string \u2014 topic global ID",
+      epistemicNodeId: "string \u2014 materialized topic node ID",
+      epistemicNodeGlobalId: "string \u2014 materialized topic node global ID",
       depth: "number \u2014 nesting depth"
     }
   },
@@ -8377,32 +10441,91 @@ var UPDATE_TOPIC = {
   },
   required: [],
   response: {
-    description: "The updated topic",
+    description: "The updated topic",
+    fields: {
+      id: "string \u2014 topic ID",
+      globalId: "string \u2014 globally unique ID",
+      status: "string \u2014 topic lifecycle status",
+      visibility: "string \u2014 topic visibility"
+    }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var GET_TOPIC_TREE = {
+  name: "get_topic_tree",
+  description: "Get the full topic hierarchy from a root. Like `git log --graph --all` \u2014 shows the complete tree of nested topics.",
+  parameters: {
+    rootId: { type: "string", description: "Root topic to start from" },
+    maxDepth: {
+      type: "number",
+      description: "Maximum depth to traverse (default: 5)"
+    }
+  },
+  required: ["rootId"],
+  response: {
+    description: "Tree of topics with nesting",
+    fields: { tree: "array \u2014 topics in BFS order with depth and path" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var MATERIALIZE_TOPIC_GRAPH = {
+  name: "materialize_topic_graph",
+  description: "Backfill the topic graph spine. Like `git fsck --connectivity-only` with repair enabled \u2014 creates missing topic nodes and parent-child edges idempotently.",
+  parameters: {
+    rootTopicId: {
+      type: "string",
+      description: "Optional root topic for a bounded materialization pass"
+    },
+    dryRun: {
+      type: "boolean",
+      description: "When true, report missing rows without writing them"
+    }
+  },
+  required: [],
+  response: {
+    description: "Topic graph materialization counts",
     fields: {
-      id: "string \u2014 topic ID",
-      globalId: "string \u2014 globally unique ID",
-      status: "string \u2014 topic lifecycle status",
-      visibility: "string \u2014 topic visibility"
+      topicsSeen: "number",
+      nodesCreated: "number",
+      nodesExisting: "number",
+      edgesCreated: "number",
+      edgesExisting: "number",
+      errors: "array"
     }
   },
   ownerModule: "reasoning-kernel",
   ontologyPrimitive: "graph",
   tier: "workhorse"
 };
-var GET_TOPIC_TREE = {
-  name: "get_topic_tree",
-  description: "Get the full topic hierarchy from a root. Like `git log --graph --all` \u2014 shows the complete tree of nested topics.",
+var GET_TOPIC_GRAPH_SPINE = {
+  name: "get_topic_graph_spine",
+  description: "Verify the topic graph spine. Like `git fsck` \u2014 reads topics, materialized topic nodes, parent-child edges, and missing spine rows.",
   parameters: {
-    rootId: { type: "string", description: "Root topic to start from" },
-    maxDepth: {
-      type: "number",
-      description: "Maximum depth to traverse (default: 5)"
+    rootTopicId: {
+      type: "string",
+      description: "Optional root topic for a bounded verifier pass"
+    },
+    includeTopicBeliefEdges: {
+      type: "boolean",
+      description: "Include topic -> belief edges in the verifier payload"
     }
   },
-  required: ["rootId"],
+  required: [],
   response: {
-    description: "Tree of topics with nesting",
-    fields: { tree: "array \u2014 topics in BFS order with depth and path" }
+    description: "Topic graph spine verification payload",
+    fields: {
+      ok: "boolean",
+      counts: "object",
+      topics: "array",
+      topicNodes: "array",
+      parentEdges: "array",
+      missingTopicNodes: "array",
+      missingParentEdges: "array"
+    }
   },
   ownerModule: "reasoning-kernel",
   ontologyPrimitive: "graph",
@@ -9540,6 +11663,69 @@ var GENERATE_SESSION_HANDOFF = {
   tier: "showcase",
   internal: true
 };
+var BEGIN_BUILD_SESSION = {
+  name: "begin_build_session",
+  description: "Bootstrap a coding build session for a Lucern worktree. Like `git worktree add` plus `git status` \u2014 returns the compact context packet an agent needs before editing.",
+  parameters: {
+    worktreeId: {
+      type: "string",
+      description: "The Lucern worktree ID to bootstrap."
+    },
+    branch: {
+      type: "string",
+      description: "Optional git branch name. Auto-generated from the worktree name when omitted."
+    },
+    branchBase: {
+      type: "string",
+      description: 'Base branch for the feature branch. Default: "staging".'
+    },
+    prBase: {
+      type: "string",
+      description: 'Target branch for the PR. Default: "staging".'
+    },
+    sessionMode: {
+      type: "string",
+      description: 'Session mode: "async" for Codex/headless or "interactive" for live sessions.',
+      enum: ["async", "interactive"]
+    },
+    activateIfPlanning: {
+      type: "boolean",
+      description: "When true, automatically activate a planning worktree during bootstrap."
+    }
+  },
+  required: ["worktreeId"],
+  response: {
+    description: "A compact build-session packet with worktree metadata, graph anchors, questions, dependencies, and git defaults.",
+    fields: {
+      topicId: "string \u2014 canonical topic scope",
+      topicName: "string \u2014 human-readable topic name",
+      worktreeId: "string \u2014 worktree ID",
+      worktreeName: "string \u2014 human-readable worktree name",
+      branch: "string \u2014 git branch name",
+      branchBase: "string \u2014 base branch",
+      prBase: "string \u2014 PR target branch",
+      campaign: "number | null \u2014 top-level pipeline campaign",
+      lane: "string \u2014 campaign lane",
+      gate: "string \u2014 exit gate",
+      hypothesis: "string \u2014 worktree hypothesis",
+      focus: "string \u2014 session focus",
+      status: "string \u2014 worktree status after optional activation",
+      sessionMode: "string \u2014 async | interactive",
+      targetBeliefIds: "array \u2014 scoped belief IDs",
+      targetQuestionIds: "array \u2014 scoped question IDs",
+      topBeliefs: "array \u2014 highest-confidence scoped beliefs",
+      openQuestions: "array \u2014 open scoped questions",
+      resolvedDecisions: "array \u2014 answered questions summarized for the session",
+      dependencies: "array \u2014 upstream worktrees",
+      unblocks: "array \u2014 downstream worktrees",
+      mergeOrderNotes: "string \u2014 merge ordering advisory"
+    }
+  },
+  ownerModule: "bootstrap",
+  ontologyPrimitive: "worktree",
+  tier: "showcase",
+  internal: true
+};
 var MCP_TOOL_CONTRACTS = {
   // Belief lifecycle (commit, amend, fork, archive)
   create_belief: CREATE_BELIEF,
@@ -9582,11 +11768,26 @@ var MCP_TOOL_CONTRACTS = {
   bisect_confidence: BISECT_CONFIDENCE,
   // Edges (commit)
   create_edge: CREATE_EDGE,
+  update_edge: UPDATE_EDGE,
+  remove_edge: REMOVE_EDGE,
+  remove_edges_between: REMOVE_EDGES_BETWEEN,
+  batch_create_edges: BATCH_CREATE_EDGES,
+  // Epistemic node spine (commit/amend/show)
+  create_epistemic_node: CREATE_EPISTEMIC_NODE,
+  get_epistemic_node: GET_EPISTEMIC_NODE,
+  list_epistemic_nodes: LIST_EPISTEMIC_NODES,
+  update_epistemic_node: UPDATE_EPISTEMIC_NODE,
+  archive_epistemic_node: ARCHIVE_EPISTEMIC_NODE,
+  verify_epistemic_node: VERIFY_EPISTEMIC_NODE,
+  supersede_epistemic_node: SUPERSEDE_EPISTEMIC_NODE,
+  batch_create_epistemic_nodes: BATCH_CREATE_EPISTEMIC_NODES,
   // Judgments (tag)
   record_judgment: RECORD_JUDGMENT,
   // Graph intelligence (showcase)
   detect_confirmation_bias: DETECT_CONFIRMATION_BIAS,
   get_graph_structure_analysis: GET_GRAPH_STRUCTURE_ANALYSIS,
+  list_graph_intelligence_queries: LIST_GRAPH_INTELLIGENCE_QUERIES,
+  run_graph_intelligence_query: RUN_GRAPH_INTELLIGENCE_QUERY,
   get_falsification_questions: GET_FALSIFICATION_QUESTIONS,
   // Evidence operations (workhorse)
   search_evidence: SEARCH_EVIDENCE,
@@ -9633,6 +11834,7 @@ var MCP_TOOL_CONTRACTS = {
   get_agent_inbox: GET_AGENT_INBOX,
   claim_files: CLAIM_FILES,
   generate_session_handoff: GENERATE_SESSION_HANDOFF,
+  begin_build_session: BEGIN_BUILD_SESSION,
   // Policy / ACL (workhorse)
   check_permission: CHECK_PERMISSION,
   filter_by_permission: FILTER_BY_PERMISSION,
@@ -9652,6 +11854,8 @@ var MCP_TOOL_CONTRACTS = {
   get_topic: GET_TOPIC,
   update_topic: UPDATE_TOPIC,
   get_topic_tree: GET_TOPIC_TREE,
+  materialize_topic_graph: MATERIALIZE_TOPIC_GRAPH,
+  get_topic_graph_spine: GET_TOPIC_GRAPH_SPINE,
   // Coding intelligence (code-grounded knowledge)
   get_code_context: GET_CODE_CONTEXT,
   get_change_history: GET_CHANGE_HISTORY,
@@ -11300,6 +13504,952 @@ function validateSdkGitSemantics(tool) {
   return { valid: true };
 }
 
+// src/tenant-bootstrap-seed.contract.ts
+var TENANT_BOOTSTRAP_SEED_CONTRACT_VERSION = "2026-04-30";
+var TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS = [
+  "tenantId",
+  "workspaceId",
+  "principalId",
+  "role",
+  "authMode",
+  "correlationId",
+  "auditMetadata"
+];
+var TENANT_BOOTSTRAP_SEED_COMPONENTS = {
+  kernel: {
+    componentName: "lucern",
+    migrationModule: "adapters/migration",
+    templateService: "services/kernel-template",
+    templateDeployments: {
+      staging: "kindly-goldfish-162",
+      prod: "cool-badger-368"
+    }
+  },
+  identity: {
+    componentName: "identity",
+    migrationModule: "migration",
+    templateService: "services/identity-template",
+    templateDeployments: {
+      staging: "industrious-cheetah-864",
+      prod: "combative-beagle-879"
+    }
+  }
+};
+function isCopyableSeedRequirement(entry) {
+  return (entry.copyMode === "template_global" || entry.copyMode === "template_tenant_rewrite" || entry.copyMode === "template_reference_remap") && Boolean(entry.scope) && Array.isArray(entry.uniqueKey) && entry.uniqueKey.length > 0;
+}
+var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
+  {
+    component: "kernel",
+    table: "agentMessages",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Agent coordination messages are session data, not template data."
+  },
+  {
+    component: "kernel",
+    table: "agentSessions",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Agent coordination sessions are created by active clients."
+  },
+  {
+    component: "kernel",
+    table: "autofixJobs",
+    prepopulation: "runtime_queue",
+    copyMode: "none",
+    description: "Autofix work items are runtime queue rows."
+  },
+  {
+    component: "kernel",
+    table: "backgroundJobRuns",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Background job executions are runtime logs."
+  },
+  {
+    component: "kernel",
+    table: "backgroundJobSettings",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["jobKey"],
+    description: "Default job enablement settings must come from the K template."
+  },
+  {
+    component: "kernel",
+    table: "beliefConfidence",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Belief confidence rows are created with tenant graph facts."
+  },
+  {
+    component: "kernel",
+    table: "beliefEvidenceLinks",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Belief-to-evidence links are tenant graph data."
+  },
+  {
+    component: "kernel",
+    table: "beliefHistory",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Belief history is append-only tenant graph data."
+  },
+  {
+    component: "kernel",
+    table: "beliefScenarios",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Scenario rows are tenant-authored reasoning data."
+  },
+  {
+    component: "kernel",
+    table: "beliefVotes",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Decision belief votes are tenant-authored data."
+  },
+  {
+    component: "kernel",
+    table: "calibrationScores",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Calibration scores are computed from tenant outcomes."
+  },
+  {
+    component: "kernel",
+    table: "contractEvaluations",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Contract evaluation rows are runtime computation logs."
+  },
+  {
+    component: "kernel",
+    table: "contradictions",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Contradictions are tenant graph facts."
+  },
+  {
+    component: "kernel",
+    table: "crossProjectConnections",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Cross-topic connections are tenant graph facts."
+  },
+  {
+    component: "kernel",
+    table: "decisionComputedSummaries",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Decision summaries are derived tenant outputs."
+  },
+  {
+    component: "kernel",
+    table: "decisionEvents",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Decision events are lifecycle data."
+  },
+  {
+    component: "kernel",
+    table: "decisionParticipants",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Decision participants are tenant-selected actors."
+  },
+  {
+    component: "kernel",
+    table: "decisionRiskLedger",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Decision risk rows are tenant decision data."
+  },
+  {
+    component: "kernel",
+    table: "decisionSnapshots",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Decision snapshots are derived from tenant state."
+  },
+  {
+    component: "kernel",
+    table: "deliberationContributions",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Deliberation contributions are tenant-authored data."
+  },
+  {
+    component: "kernel",
+    table: "deliberationSessions",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Deliberation sessions are created by tenant workflows."
+  },
+  {
+    component: "kernel",
+    table: "epistemicAudit",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Epistemic audit rows are append-only runtime audit data."
+  },
+  {
+    component: "kernel",
+    table: "epistemicContracts",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Epistemic contracts are tenant-authored governance data."
+  },
+  {
+    component: "kernel",
+    table: "epistemicEdges",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Edges are tenant reasoning graph data."
+  },
+  {
+    component: "kernel",
+    table: "epistemicNodeEmbeddings",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Embeddings are derived from tenant graph nodes."
+  },
+  {
+    component: "kernel",
+    table: "epistemicNodes",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Nodes are tenant reasoning graph data."
+  },
+  {
+    component: "kernel",
+    table: "graphAnalysisCache",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Graph analysis cache rows are derived from tenant graph state."
+  },
+  {
+    component: "kernel",
+    table: "graphAnalysisResults",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Graph analysis result rows are derived tenant outputs."
+  },
+  {
+    component: "kernel",
+    table: "graphSuggestions",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Graph suggestions are derived recommendations."
+  },
+  {
+    component: "kernel",
+    table: "harnessReplays",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Harness replay rows are runtime verification logs."
+  },
+  {
+    component: "kernel",
+    table: "harnessRuns",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Harness run rows are runtime verification logs."
+  },
+  {
+    component: "kernel",
+    table: "idempotencyTokens",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Idempotency tokens are request-scoped runtime guards."
+  },
+  {
+    component: "kernel",
+    table: "lenses",
+    prepopulation: "optional_template",
+    copyMode: "none",
+    description: "Reusable lens templates may live in K templates, but workspace-specific copies are not required for core SDK boot."
+  },
+  {
+    component: "kernel",
+    table: "lensTopicBindings",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Lens bindings attach runtime topics to runtime/workspace lenses."
+  },
+  {
+    component: "kernel",
+    table: "neo4jSyncQueue",
+    prepopulation: "runtime_queue",
+    copyMode: "none",
+    description: "Neo4j sync queue rows are runtime work items."
+  },
+  {
+    component: "kernel",
+    table: "ontologyDefinitions",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["ontologyKey"],
+    description: "Platform ontology definitions power taxonomy reads and effective ontology resolution."
+  },
+  {
+    component: "kernel",
+    table: "ontologyVersions",
+    prepopulation: "required_template",
+    copyMode: "template_reference_remap",
+    scope: "global",
+    uniqueKey: ["ontologyKey", "version"],
+    dependsOn: ["ontologyDefinitions"],
+    description: "Ontology versions must be copied with ontologyDefinition ID remapping."
+  },
+  {
+    component: "kernel",
+    table: "platformAgentRunPolicyDecisions",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Agent-run policy decisions are audit logs."
+  },
+  {
+    component: "kernel",
+    table: "platformAgentRunPromptResolutions",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Agent-run prompt resolution rows are runtime logs."
+  },
+  {
+    component: "kernel",
+    table: "platformAgentRuns",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Agent runs are runtime execution records."
+  },
+  {
+    component: "kernel",
+    table: "platformAgentRunToolCalls",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Agent-run tool calls are runtime execution records."
+  },
+  {
+    component: "kernel",
+    table: "platformHarnessShadowAudit",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Harness shadow audit rows are runtime audit records."
+  },
+  {
+    component: "kernel",
+    table: "publicationRules",
+    prepopulation: "required_template",
+    copyMode: "template_tenant_rewrite",
+    scope: "tenant",
+    uniqueKey: ["tenantId", "workspaceId", "name"],
+    description: "Default publication policy rules are rewritten into each tenant."
+  },
+  {
+    component: "kernel",
+    table: "questionEvidenceLinks",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Question-to-evidence links are tenant graph data."
+  },
+  {
+    component: "kernel",
+    table: "researchJobs",
+    prepopulation: "runtime_queue",
+    copyMode: "none",
+    description: "Research job rows are runtime queue items."
+  },
+  {
+    component: "kernel",
+    table: "schemaEnumConfig",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["category", "value"],
+    description: "Runtime-extensible enum defaults required by SDK graph APIs."
+  },
+  {
+    component: "kernel",
+    table: "stakeholderGroups",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Stakeholder groups are tenant decision data."
+  },
+  {
+    component: "kernel",
+    table: "systemLogs",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "System logs are runtime telemetry."
+  },
+  {
+    component: "kernel",
+    table: "tasks",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Tasks are tenant-authored work items."
+  },
+  {
+    component: "kernel",
+    table: "topics",
+    prepopulation: "runtime_bootstrap",
+    copyMode: "none",
+    description: "Default topics are created by tenant provisioning, not copied from templates."
+  },
+  {
+    component: "kernel",
+    table: "workflowDefinitions",
+    prepopulation: "optional_template",
+    copyMode: "none",
+    description: "Table-driven workflow definitions can be template data after the workflow engine leaves legacy mode."
+  },
+  {
+    component: "kernel",
+    table: "workflowPullRequests",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Workflow pull requests are tenant workflow data."
+  },
+  {
+    component: "kernel",
+    table: "workflowStages",
+    prepopulation: "optional_template",
+    copyMode: "none",
+    dependsOn: ["workflowDefinitions"],
+    description: "Workflow stages can be template data after workflowDefinitions are enabled for bootstrap copying."
+  },
+  {
+    component: "kernel",
+    table: "worktreeBeliefCluster",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Worktree cluster rows link runtime worktrees to runtime beliefs."
+  },
+  {
+    component: "kernel",
+    table: "worktrees",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Worktrees are tenant/runtime planning data."
+  },
+  {
+    component: "identity",
+    table: "agents",
+    prepopulation: "runtime_bootstrap",
+    copyMode: "none",
+    description: "Service agents are provisioned per tenant or service, not copied."
+  },
+  {
+    component: "identity",
+    table: "mcpWritePolicy",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["topicId", "role", "toolCategory"],
+    description: "Global write policy defaults govern service and interactive MCP writes."
+  },
+  {
+    component: "identity",
+    table: "modelCallLogs",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Model call logs are runtime telemetry."
+  },
+  {
+    component: "identity",
+    table: "modelFunctionSlots",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["slot"],
+    description: "Function-to-model slots are required by model runtime resolution."
+  },
+  {
+    component: "identity",
+    table: "modelRegistry",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["key"],
+    description: "Model catalog defaults are required by model runtime clients."
+  },
+  {
+    component: "identity",
+    table: "modelSlotConfigs",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["slot"],
+    description: "Slot-level defaults are required before tenant overrides exist."
+  },
+  {
+    component: "identity",
+    table: "platformAudienceGrants",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Audience grants are principal/group-specific access rows."
+  },
+  {
+    component: "identity",
+    table: "platformAudiences",
+    prepopulation: "required_template",
+    copyMode: "template_tenant_rewrite",
+    scope: "tenant",
+    uniqueKey: ["tenantId", "workspaceId", "audienceKey"],
+    description: "Default tenant audience taxonomy rows are rewritten into each tenant."
+  },
+  {
+    component: "identity",
+    table: "platformPolicyDecisionLogs",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Policy decisions are runtime audit logs."
+  },
+  {
+    component: "identity",
+    table: "projectGrants",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Project/topic grants are principal or group-specific access rows."
+  },
+  {
+    component: "identity",
+    table: "reasoningPermissions",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Reasoning permissions are principal-specific policy rows."
+  },
+  {
+    component: "identity",
+    table: "tenantApiKeys",
+    prepopulation: "runtime_secret",
+    copyMode: "none",
+    description: "API keys are tenant credentials and must never be copied."
+  },
+  {
+    component: "identity",
+    table: "tenantConfig",
+    prepopulation: "required_template",
+    copyMode: "template_tenant_rewrite",
+    scope: "tenant",
+    uniqueKey: ["tenantId"],
+    description: "Tenant-local config defaults are rewritten during bootstrap."
+  },
+  {
+    component: "identity",
+    table: "tenantIntegrations",
+    prepopulation: "required_template",
+    copyMode: "template_tenant_rewrite",
+    scope: "tenant",
+    uniqueKey: ["tenantId", "integrationKey"],
+    description: "Non-secret integration descriptors are rewritten into each tenant."
+  },
+  {
+    component: "identity",
+    table: "tenantModelSlotBindings",
+    prepopulation: "runtime_secret",
+    copyMode: "none",
+    description: "Tenant model slot bindings reference provider secrets and are runtime-only."
+  },
+  {
+    component: "identity",
+    table: "tenantPolicies",
+    prepopulation: "required_template",
+    copyMode: "template_tenant_rewrite",
+    scope: "tenant",
+    uniqueKey: ["tenantId", "workspaceId", "roleName"],
+    description: "Default tenant policy roles are rewritten during bootstrap."
+  },
+  {
+    component: "identity",
+    table: "tenantProviderSecrets",
+    prepopulation: "runtime_secret",
+    copyMode: "none",
+    description: "Provider secrets are credentials and must never be copied."
+  },
+  {
+    component: "identity",
+    table: "tenantProxyGatewayUsage",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Proxy gateway usage rows are runtime telemetry."
+  },
+  {
+    component: "identity",
+    table: "tenantProxyTokenMints",
+    prepopulation: "runtime_secret",
+    copyMode: "none",
+    description: "Proxy token mints are ephemeral secret-bearing runtime rows."
+  },
+  {
+    component: "identity",
+    table: "tenantSandboxAuditEvents",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Sandbox audit rows are runtime security logs."
+  },
+  {
+    component: "identity",
+    table: "tenantSecrets",
+    prepopulation: "runtime_secret",
+    copyMode: "none",
+    description: "Tenant secrets are credentials and must never be copied."
+  },
+  {
+    component: "identity",
+    table: "toolAcls",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["role", "toolName"],
+    description: "Default role-to-tool grants are required for SDK/MCP tool access."
+  },
+  {
+    component: "identity",
+    table: "toolRegistry",
+    prepopulation: "required_template",
+    copyMode: "template_global",
+    scope: "global",
+    uniqueKey: ["toolName"],
+    description: "Core tool catalog rows are required before pack or tenant tools exist."
+  },
+  {
+    component: "identity",
+    table: "users",
+    prepopulation: "runtime_bootstrap",
+    copyMode: "none",
+    description: "Users are created from Clerk/MC principal resolution, not copied."
+  }
+];
+var TENANT_BOOTSTRAP_SEED_TABLES = TENANT_BOOTSTRAP_TABLE_REQUIREMENTS.filter(
+  isCopyableSeedRequirement
+);
+var TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES = TENANT_BOOTSTRAP_TABLE_REQUIREMENTS.filter(
+  (entry) => !isCopyableSeedRequirement(entry)
+).map((entry) => entry.table);
+var TENANT_BOOTSTRAP_SEED_MANIFEST = {
+  contractVersion: TENANT_BOOTSTRAP_SEED_CONTRACT_VERSION,
+  authMetadataFields: TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS,
+  components: TENANT_BOOTSTRAP_SEED_COMPONENTS,
+  tableRequirements: TENANT_BOOTSTRAP_TABLE_REQUIREMENTS,
+  tables: TENANT_BOOTSTRAP_SEED_TABLES,
+  forbiddenTables: TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES
+};
+function findTenantBootstrapTableRequirement(table) {
+  return TENANT_BOOTSTRAP_TABLE_REQUIREMENTS.find(
+    (entry) => entry.table === table
+  );
+}
+function findTenantBootstrapSeedTable(table) {
+  return TENANT_BOOTSTRAP_SEED_TABLES.find((entry) => entry.table === table);
+}
+function isTenantBootstrapSeedTable(table) {
+  return Boolean(findTenantBootstrapSeedTable(table));
+}
+function isTenantBootstrapForbiddenSeedTable(table) {
+  return TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES.some((entry) => entry === table);
+}
+var TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION = "2026-04-30.1";
+var TENANT_BOOTSTRAP_TEMPLATE_TENANT_ID = "tenant_template";
+var TENANT_BOOTSTRAP_TEMPLATE_ACTOR = "system:lucern-template-seed";
+var DEFAULT_SEED_TIME = Date.UTC(2026, 3, 30);
+var ROLE_GRANTS = {
+  viewer: ["viewer", "auditor", "editor", "workspace_admin", "tenant_admin", "platform_admin", "service_agent"],
+  auditor: ["auditor", "tenant_admin", "platform_admin", "service_agent"],
+  editor: ["editor", "workspace_admin", "tenant_admin", "platform_admin", "service_agent"],
+  workspace_admin: ["workspace_admin", "tenant_admin", "platform_admin", "service_agent"],
+  tenant_admin: ["tenant_admin", "platform_admin", "service_agent"],
+  platform_admin: ["platform_admin", "service_agent"],
+  service_agent: ["service_agent"]
+};
+var ENUM_VALUES = {
+  topic_type: ["domain", "theme", "deal", "strategy", "constitution", "project", "portfolio", "architecture", "capability", "runtime", "interface", "governance", "operations", "security", "data"],
+  branch_schema: ["pillar", "track", "dimension", "axis", "phase"],
+  belief_type: ["belief", "hypothesis", "principle", "invariant", "assumption", "tenet", "prior", "preference", "goal", "forecast", "decision", "constraint", "tradeoff", "policy", "implementation_choice", "implementation_decision", "interface_contract", "migration_state", "code_pattern", "deprecation_notice"],
+  edge_type: ["supports", "informs", "depends_on", "derived_from", "contains", "tests", "supersedes", "responds_to", "belongs_to", "relates_to_thesis", "works_at", "invested_in", "competes_with", "participates_in", "founded_by", "evaluates", "performs", "function_in", "impacts", "raised_from", "mentioned_in", "perspective_on", "plays_theme"],
+  worktree_type: ["belief_test", "lens", "existential", "contradiction", "refinement", "coverage", "discovery", "clarification", "confirmation"],
+  worktree_phase: ["cluster_mapping", "hypothesis_formation", "question_generation", "evidence_collection", "synthesis", "decision", "retrospective"],
+  activity_type: ["create", "update", "review", "merge", "archive", "comment", "status_change", "evidence_added", "question_added"],
+  lens_perspective_type: ["investigation", "monitoring", "analysis", "comparison", "taxonomy"],
+  node_type: ["belief", "question", "theme", "deal", "evidence", "claim", "synthesis", "source", "excerpt", "atomic_fact", "person", "company", "investor", "value_chain", "function", "decision"]
+};
+var MODEL_REGISTRY = [
+  ["claude-sonnet-4", "Claude Sonnet 4", "claude-sonnet-4-20250514", "anthropic", 2e5, 64e3, 1, 3, 15],
+  ["claude-sonnet-4.5", "Claude Sonnet 4.5", "claude-sonnet-4-5-20250929", "anthropic", 2e5, 64e3, 1, 3, 15],
+  ["claude-opus-4", "Claude Opus 4", "claude-opus-4-20250514", "anthropic", 2e5, 32e3, 1, 15, 75],
+  ["gpt-4o", "GPT-4o", "gpt-4o", "openai", 128e3, 16e3, 0.7, 5, 15],
+  ["gpt-4o-mini", "GPT-4o Mini", "gpt-4o-mini", "openai", 128e3, 16e3, 0.7, 0.15, 0.6],
+  ["gemini-2.5-pro", "Gemini 2.5 Pro", "gemini-2.5-pro", "google", 1e6, 32e3, 0.7, 1.25, 10],
+  ["sonar-pro", "Sonar Pro", "sonar-pro", "perplexity", 128e3, 8e3, 0.3, 3, 15]
+];
+var MODEL_SLOTS = [
+  ["primer_default", "primers", "Default primer generation for general topics", "claude-sonnet-4", "agents/primer/system", 1, 4e3, ["text_generation", "reasoning"]],
+  ["primer_technical", "primers", "Technical and engineering focused primers", "claude-sonnet-4", "agents/primer/system", 0.8, 4e3, ["text_generation", "reasoning", "code"]],
+  ["primer_intelligence", "document_intelligence", "Extract evidence, beliefs, and questions from documents", "claude-sonnet-4", "agents/primer-intelligence", 0.3, 8e3, ["text_generation", "structured_output", "reasoning"]],
+  ["fact_checker", "research", "Verify claims without web search", "claude-sonnet-4", "agents/internet-fact-checker", 0.3, 4e3, ["text_generation", "reasoning"]],
+  ["fact_checker_web", "research", "Verify claims with web search", "sonar-pro", "agents/internet-fact-checker", 0.3, 4e3, ["web_search"]],
+  ["deep_research", "research", "Deep research with extended analysis", "claude-opus-4", void 0, 0.7, 8e3, ["text_generation", "reasoning", "long_context"]],
+  ["belief_classifier", "classification", "Classify beliefs by epistemic type", "claude-sonnet-4", "classification/belief-category", 0.2, 1e3, ["text_generation", "reasoning"]],
+  ["evidence_classifier", "classification", "Classify evidence methodology and quality", "claude-sonnet-4", "classification/evidence-rules", 0.3, 1e3, ["text_generation", "reasoning"]],
+  ["edge_classifier", "classification", "Classify edge reasoning method and temporal class", "claude-sonnet-4", "classification/epistemic-guidance", 0.3, 1e3, ["text_generation", "reasoning"]],
+  ["entity_extractor", "extraction", "Extract entities from text", "claude-sonnet-4", void 0, 0.2, 2e3, ["text_generation", "structured_output"]],
+  ["graph_intelligence_query", "graph_intelligence", "Analyze graph health, gaps, and structural risks", "claude-sonnet-4", "graph-intelligence/query", 0.5, 8e3, ["text_generation", "reasoning", "tool_use"]],
+  ["graph_intelligence_suggestions", "graph_intelligence", "Extract actionable graph suggestions", "claude-sonnet-4", "graph-intelligence/suggestions-extraction", 0.2, 4e3, ["text_generation", "structured_output"]],
+  ["text_to_cypher", "graph_intelligence", "Generate read-only Cypher from graph questions", "claude-sonnet-4", "graph-intelligence/text-to-cypher", 0.2, 2e3, ["text_generation", "code", "reasoning"]],
+  ["contradiction_verifier", "epistemic", "Verify semantic contradiction candidates", "claude-sonnet-4", "lucern/verify-contradiction", 0.2, 500, ["text_generation", "reasoning"]],
+  ["task_execution", "tasks", "Execute research tasks with structured analysis", "claude-sonnet-4", void 0, 0.3, 4e3, ["text_generation", "reasoning", "structured_output"]],
+  ["sprint_unified", "sprints", "Unified worktree chat across all phases", "claude-opus-4", "worktrees/unified-system-prompt", 0.7, 8e3, ["text_generation", "reasoning", "tool_use"]],
+  ["evidence_assessor", "sprints", "Assess evidence for belief valence and certainty", "claude-sonnet-4", "worktrees/scoring/evidence-assessor", 0.3, 4e3, ["text_generation", "reasoning", "structured_output"]],
+  ["title_generator", "utility", "Generate concise titles", "gpt-4o-mini", void 0, 0.7, 100, ["text_generation", "fast", "cheap"]],
+  ["help_desk_agent", "utility", "Help desk support agent for workflow guidance", "claude-sonnet-4", "agents/help-desk-agent", 0.4, 2e3, ["text_generation", "reasoning"]],
+  ["bug_detective_agent", "utility", "Bug triage assistant for structured diagnosis", "claude-sonnet-4", "agents/bug-detective-agent", 0.3, 2e3, ["text_generation", "reasoning"]]
+];
+function labelFor(value) {
+  return value.split(/[_-]/).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
+function seedContext(options) {
+  return {
+    now: options.now ?? DEFAULT_SEED_TIME,
+    templateTenantId: options.templateTenantId ?? TENANT_BOOTSTRAP_TEMPLATE_TENANT_ID,
+    actor: options.actorPrincipalId ?? TENANT_BOOTSTRAP_TEMPLATE_ACTOR,
+    version: options.version ?? TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION
+  };
+}
+function toolCategory(contract) {
+  if (contract.surfaceIntent === "system") return "system";
+  if (contract.effects.includes("admin")) return "admin";
+  if (contract.effects.includes("write") || contract.kind !== "query") return "write";
+  return "read";
+}
+function requiredRole(category) {
+  if (category === "system") return "service_agent";
+  if (category === "admin") return "tenant_admin";
+  if (category === "write") return "editor";
+  return "viewer";
+}
+function requiredAction(category) {
+  if (category === "admin" || category === "system") return "admin";
+  if (category === "write") return "mutate";
+  return "read";
+}
+function enabledSurfaces(contract) {
+  return [
+    contract.surfaces.mcp !== "none" ? "mcp" : void 0,
+    contract.surfaces.sdk !== "none" ? "sdk" : void 0,
+    contract.surfaces.cli !== "none" ? "cli" : void 0,
+    contract.surfaces.rest !== "none" ? "api" : void 0
+  ].filter((value) => Boolean(value));
+}
+function buildToolRegistry(now, actor, version) {
+  const rows = /* @__PURE__ */ new Map();
+  for (const contract of ALL_FUNCTION_CONTRACTS) {
+    const surfaces = enabledSurfaces(contract);
+    if (surfaces.length === 0) continue;
+    const category = toolCategory(contract);
+    const readOnly = category === "read";
+    const toolName = contract.mcp.toolName || contract.name;
+    rows.set(toolName, {
+      toolName,
+      description: contract.openapi.summary,
+      version,
+      status: "active",
+      requiredRole: requiredRole(category),
+      requiredAction: requiredAction(category),
+      surfaces,
+      category,
+      parameterSchema: { contract: contract.name, sdk: contract.sdk },
+      handlerRef: contract.convex ? `${contract.convex.module}.${contract.convex.functionName}` : contract.name,
+      executionAdapter: contract.convex?.kind === "action" ? "convex_action" : contract.convex?.kind === "mutation" ? "convex_mutation" : "mcp_tool",
+      safetyMetadata: {
+        readOnly,
+        idempotent: readOnly || contract.idempotent === true || contract.idempotent === "required",
+        sideEffectLevel: readOnly ? "none" : category === "admin" ? "high" : "low"
+      },
+      isCore: true,
+      mcVersion: version,
+      registeredBy: actor,
+      registeredAt: now
+    });
+  }
+  return [...rows.values()].sort(
+    (a, b) => String(a.toolName).localeCompare(String(b.toolName))
+  );
+}
+function buildToolAcls(tools, now, actor) {
+  return tools.flatMap(
+    (tool) => (ROLE_GRANTS[tool.requiredRole] ?? [tool.requiredRole]).map(
+      (role) => ({ role, toolName: tool.toolName, createdBy: actor, createdAt: now })
+    )
+  );
+}
+function buildMcpWritePolicy(now, actor) {
+  return [
+    ...["viewer", "auditor"].map((role) => ({
+      role,
+      toolCategory: "write",
+      permission: "deny",
+      enabled: true,
+      rationale: "Read-only roles cannot mutate the reasoning graph.",
+      createdAt: now,
+      updatedAt: now,
+      createdBy: actor
+    })),
+    ...["editor", "workspace_admin", "tenant_admin", "platform_admin", "service_agent"].map((role) => ({
+      role,
+      toolCategory: "write",
+      permission: "allow",
+      maxWritesPerSession: role === "editor" ? 200 : void 0,
+      enabled: true,
+      rationale: "Default global write policy for trusted graph mutation roles.",
+      createdAt: now,
+      updatedAt: now,
+      createdBy: actor
+    }))
+  ];
+}
+function buildTenantPolicies(tenantId, now, actor) {
+  const rows = [
+    ["viewer", "Read graph and runtime metadata.", [{ resource: "graph", actions: ["read"] }]],
+    ["auditor", "Read graph, audit, and policy decisions.", [{ resource: "audit", actions: ["read", "export"] }]],
+    ["editor", "Read and mutate tenant reasoning state.", [{ resource: "graph", actions: ["read", "create", "update", "mutate"] }]],
+    ["workspace_admin", "Manage workspace-scoped reasoning operations.", [{ resource: "workspace", actions: ["read", "update", "admin"] }]],
+    ["tenant_admin", "Manage tenant policy, tools, users, and publication.", [{ resource: "tenant", actions: ["read", "update", "admin"] }, { resource: "policy", actions: ["read", "create", "update", "admin"] }]],
+    ["service_agent", "Service principal execution role for automation.", [{ resource: "runtime", actions: ["read", "create", "update"] }, { resource: "graph", actions: ["read", "create", "update", "mutate"] }]]
+  ];
+  return rows.map(([roleName, description, permissions]) => ({
+    tenantId,
+    roleName,
+    description,
+    permissions,
+    groupBindings: [],
+    createdAt: now,
+    updatedAt: now,
+    createdBy: actor,
+    updatedBy: actor
+  }));
+}
+function modelRegistryRows(now) {
+  return MODEL_REGISTRY.map(([key, name, modelId, provider, contextWindow, maxOutputTokens, defaultTemperature, inputCostPer1M, outputCostPer1M]) => ({
+    key,
+    name,
+    modelId,
+    provider,
+    capabilities: ["text_generation", "reasoning"],
+    contextWindow,
+    maxOutputTokens,
+    defaultTemperature,
+    inputCostPer1M,
+    outputCostPer1M,
+    recommended: true,
+    enabled: true,
+    createdAt: now,
+    updatedAt: now
+  }));
+}
+function modelFunctionSlotRows(now) {
+  return MODEL_SLOTS.map(([slot, category, description, modelKey, promptName, temperature, maxTokens, requiredCapabilities]) => ({
+    slot,
+    category,
+    description,
+    modelKey,
+    promptName,
+    temperature,
+    maxTokens,
+    requiredCapabilities,
+    enabled: true,
+    isDefault: true,
+    notes: `Seeded by ${TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION}.`,
+    createdAt: now,
+    updatedAt: now
+  }));
+}
+function modelSlotConfigRows(now) {
+  return MODEL_SLOTS.map(([slot, , , modelKey, , temperature, maxTokens]) => ({
+    slot,
+    modelKey,
+    temperature,
+    maxTokens,
+    enabled: true,
+    notes: `Default routing for ${slot}.`,
+    createdAt: now,
+    updatedAt: now
+  }));
+}
+function schemaEnumRows(now) {
+  return Object.entries(ENUM_VALUES).flatMap(
+    ([category, values]) => values.map((value, index) => ({
+      category,
+      value,
+      label: labelFor(value),
+      description: `${labelFor(value)} ${category} value.`,
+      tier: "platform",
+      metadata: { seedVersion: TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION },
+      isDefault: index === 0,
+      sortOrder: index + 1,
+      status: "active",
+      createdAt: now,
+      updatedAt: now
+    }))
+  );
+}
+function buildTenantBootstrapTemplateSeedRows(options = {}) {
+  const ctx = seedContext(options);
+  const toolRegistry2 = buildToolRegistry(ctx.now, ctx.actor, ctx.version);
+  return {
+    kernel: {
+      backgroundJobSettings: [
+        { jobKey: "neo4j_sync", enabled: false, notes: "Disabled until graph-sync credentials are configured.", updatedAt: ctx.now, updatedBy: ctx.actor },
+        { jobKey: "calibration_rollups", enabled: true, notes: "Compute calibration rollups when calibration data exists.", updatedAt: ctx.now, updatedBy: ctx.actor }
+      ],
+      ontologyDefinitions: [
+        { ontologyKey: "lucern-core", name: "Lucern Core", description: "Core Lucern reasoning taxonomy.", tier: "platform", status: "active", createdBy: ctx.actor, createdAt: ctx.now, updatedAt: ctx.now }
+      ],
+      ontologyVersions: [
+        {
+          ontologyId: "lucern-core",
+          ontologyKey: "lucern-core",
+          version: ctx.version,
+          status: "published",
+          entityTypes: ["belief", "question", "evidence", "answer", "decision", "task", "worktree", "topic", "source"].map((value) => ({ value, label: labelFor(value) })),
+          edgeTypes: ["supports", "informs", "depends_on", "derived_from", "contains", "tests", "supersedes", "responds_to"].map((value) => ({ value, label: labelFor(value) })),
+          releaseNotes: "Initial platform ontology seed.",
+          publishedBy: ctx.actor,
+          publishedAt: ctx.now,
+          createdAt: ctx.now
+        }
+      ],
+      publicationRules: [
+        { tenantId: ctx.templateTenantId, name: "publish-high-confidence-beliefs", description: "Publish high-confidence beliefs to tenant-level consumers.", conditionType: "confidence_threshold", conditions: { minConfidence: 0.85 }, enabled: true, priority: 100, createdBy: ctx.actor, createdAt: ctx.now, updatedAt: ctx.now }
+      ],
+      schemaEnumConfig: schemaEnumRows(ctx.now)
+    },
+    identity: {
+      mcpWritePolicy: buildMcpWritePolicy(ctx.now, ctx.actor),
+      modelFunctionSlots: modelFunctionSlotRows(ctx.now),
+      modelRegistry: modelRegistryRows(ctx.now),
+      modelSlotConfigs: modelSlotConfigRows(ctx.now),
+      platformAudiences: [
+        ["internal", "Internal", "internal"],
+        ["lp", "Limited Partners", "restricted_external"],
+        ["public", "Public", "public"]
+      ].map(([audienceKey, audienceLabel, audienceClass]) => ({ tenantId: ctx.templateTenantId, audienceKey, audienceLabel, audienceClass, status: "active", metadata: { seedVersion: ctx.version }, createdBy: ctx.actor, createdAt: ctx.now, updatedAt: ctx.now })),
+      tenantConfig: [
+        { tenantId: ctx.templateTenantId, authPolicyMode: "open", defaultSessionTTL: 28800, defaultTopicVisibility: "tenant", featureFlags: { sdkBootstrapSeeds: true, interactiveRoleAuth: true }, maxWorkspaceCount: 25, defaultModelSlotOverrides: {}, updatedAt: ctx.now, updatedBy: ctx.actor }
+      ],
+      tenantIntegrations: [
+        { tenantId: ctx.templateTenantId, integrationKey: "web-search", displayName: "Web Search", description: "Tenant-configurable search integration placeholder.", category: "search", capabilities: ["search", "deep_research", "summarize"], config: { apiBaseUrl: "https://example.invalid/lucern/search", authType: "none", timeout: 3e4 }, endpoints: { search: { path: "/search", method: "POST", queryParamName: "query", resultPath: "results" } }, status: "disabled", usageCount: 0, createdAt: ctx.now, updatedAt: ctx.now, createdBy: ctx.actor }
+      ],
+      tenantPolicies: buildTenantPolicies(ctx.templateTenantId, ctx.now, ctx.actor),
+      toolAcls: buildToolAcls(toolRegistry2, ctx.now, ctx.actor),
+      toolRegistry: toolRegistry2
+    }
+  };
+}
+
 // src/v1/topics/v1.ts
 var ROOT_TOPIC_ID = "n17tm38rwet7wqgzrmwahyt1z582590y";
 function collectTopicNeighborhood(topics2, rootTopicId, maxDescendantDepth = 2) {
@@ -11593,6 +14743,6 @@ var CANONICAL_WORKFLOW_DEFINITIONS = [
   }
 ];
 
-export { BELIEF_STATUSES, BELIEF_TYPE_BONUS, BRANCH_STATUSES, CANONICAL_WORKFLOW_DEFINITIONS, CONFIDENCE_TRIGGERS, CONTEXT_PACK_SCHEMA_VERSION, CONTEXT_PACK_SECTION_KEYS, CONTEXT_RANKING_PROFILES, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, ComponentTableManifestSchema, DEFAULT_BELIEF_TYPE_BONUS, DEFAULT_COMPILATION_MODE, DEFAULT_ENTITY_LIMIT, DEFAULT_PRIORITY_SCORE, DEFAULT_RANKING_PROFILE, DEFAULT_SECTION_LIMIT, DEFAULT_SEVERITY_SCORE, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_TOKEN_BUDGET, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, DEFEAT_TYPES, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, ENTITY_RANKING_WEIGHTS, EPISTEMIC_LAYERS, EVENT_RETENTION_DEFAULT_DAYS, EdgePolicyEntrySchema, EdgePolicyManifestSchema, EpistemicNodeTypeSchema, FORK_REASONS, GraphRefSchema, INTEGRATION_EDGE_TYPES, InvariantManifestSchema, JUDGMENT_TYPES, MAX_ENTITY_LIMIT, MAX_SECTION_LIMIT, MAX_TOKEN_BUDGET, MERGE_OUTCOMES, MIN_CONTRADICTION_BUDGET, MIN_TOKEN_BUDGET, MIN_TOKEN_ESTIMATE, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, PRIORITY_SCORES, PULL_REQUEST_STATUSES, RANKING_WEIGHTS, REASONING_METHODS, RECENCY_HALF_LIFE_DAYS, RESOLVED_QUESTION_STATUSES, ROOT_TOPIC_ID, SECTION_BUDGET_RATIOS, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, SEVERITY_SCORES, SLOpinionInputSchema, TOKENS_PER_WORD, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WORKTREE_PHASES, assertEdgePolicyAllowed, bigramTokenize, buildDomainEvent, collectTopicNeighborhood, compareEventCursor, dsl_exports as contractDsl, createEventId, createEvidenceProjection, decodeEventCursor, decodePrefixedId, defineProjection, edgePolicyManifest, emitDomainEvent, encodeEventCursor, encodePrefixedId, findEdgePolicy, hasPrefixedIdPrefix, inferActorType, inferSessionPrincipalType, isAfterCursor, isLucernPrompt, jaccardSimilarity, lastDelegator, listBeliefsProjection, listTasksProjection, tool_contracts_exports as mcpToolsContract, modulateConfidenceProjection, normalizeDelegationChain, normalizeRetentionDays, prepareLexicalQuery, projections, rankEntityConnections, rankEntityTypeMatches, rankWindowScore, requireActorPrincipalId, rerankLexicalWindow, schemas_exports as schemaContracts, scoreEntityConnection, scoreEntityTypeMatch, scoreLexicalSignal, scoreLexicalSignals, sdk_tools_contract_exports as sdkToolsContract, sortEventsByCursor, stemToken, tokenOverlapScore, tokenizeSearchText, wordOverlapScore, wordTokenize };
+export { BELIEF_STATUSES, BELIEF_TYPE_BONUS, BRANCH_STATUSES, CANONICAL_WORKFLOW_DEFINITIONS, COMPONENT_BOUNDARY_COMPONENT_LAYERS, COMPONENT_BOUNDARY_CONTRACT_VERSION, COMPONENT_BOUNDARY_DIRECT_DB_METHODS, COMPONENT_BOUNDARY_HIGH_RISK_TABLES, COMPONENT_BOUNDARY_HOST_SOURCE_ROOTS, COMPONENT_HOST_BOUNDARY_CONTRACT_VERSION, COMPONENT_HOST_DB_READ_OPERATIONS, COMPONENT_HOST_DB_WRITE_OPERATIONS, COMPONENT_HOST_PROTECTED_TABLES, COMPONENT_HOST_PROTECTED_TABLE_OWNERS, COMPONENT_HOST_WRITE_ALLOWED_EXCEPTIONS, COMPONENT_HOST_WRITE_AUDIT_ROOTS, CONFIDENCE_TRIGGERS, CONTEXT_PACK_SCHEMA_VERSION, CONTEXT_PACK_SECTION_KEYS, CONTEXT_RANKING_PROFILES, CONTRADICTION_SEVERITIES, CONTRADICTION_STATUSES, ComponentTableManifestSchema, DEFAULT_BELIEF_TYPE_BONUS, DEFAULT_COMPILATION_MODE, DEFAULT_ENTITY_LIMIT, DEFAULT_PRIORITY_SCORE, DEFAULT_RANKING_PROFILE, DEFAULT_SECTION_LIMIT, DEFAULT_SEVERITY_SCORE, DEFAULT_TIER_APPROVAL_MODE, DEFAULT_TOKEN_BUDGET, DEFAULT_WORKFLOW_AUTO_FIX_POLICY, DEFEAT_TYPES, DOMAIN_EVENT_TYPES, DOMAIN_EVENT_VERSION, ENTITY_RANKING_WEIGHTS, EPISTEMIC_LAYERS, EVENT_RETENTION_DEFAULT_DAYS, EdgePolicyEntrySchema, EdgePolicyManifestSchema, EpistemicNodeTypeSchema, FORK_REASONS, GRAPH_INTELLIGENCE_MODE_TOOL_NAMES, GRAPH_INTELLIGENCE_PUBLIC_TOOL_NAMES, GRAPH_INTELLIGENCE_QUERIES, GRAPH_INTELLIGENCE_QUERIES_WITH_TOOLS, GRAPH_INTELLIGENCE_QUERY_CATALOG_VERSION, GRAPH_INTELLIGENCE_QUERY_CATEGORIES, GRAPH_INTELLIGENCE_QUERY_MODES, GRAPH_INTELLIGENCE_QUICK_QUERIES, GRAPH_REF_NODE_TYPES, GraphRefSchema, INFISICAL_RUNTIME_BOOTSTRAP_ENV, INFISICAL_RUNTIME_CONTRACT_VERSION, INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DELIVERY_MODES, INFISICAL_RUNTIME_ENVIRONMENTS, INFISICAL_RUNTIME_MANIFEST, INFISICAL_RUNTIME_PATHS, INFISICAL_RUNTIME_SURFACES, INFISICAL_RUNTIME_SURFACE_IDS, INTEGRATION_EDGE_TYPES, InvariantManifestSchema, JUDGMENT_TYPES, MAX_ENTITY_LIMIT, MAX_SECTION_LIMIT, MAX_TOKEN_BUDGET, MERGE_OUTCOMES, MIN_CONTRADICTION_BUDGET, MIN_TOKEN_BUDGET, MIN_TOKEN_ESTIMATE, MORNING_BRIEF_WORKFLOW_ID, NIGHTLY_RECONCILIATION_WORKFLOW_ID, PRIORITY_SCORES, PULL_REQUEST_STATUSES, RANKING_WEIGHTS, REASONING_METHODS, RECENCY_HALF_LIFE_DAYS, RESOLVED_QUESTION_STATUSES, ROOT_TOPIC_ID, SECTION_BUDGET_RATIOS, SESSION_AUTH_MODES, SESSION_LIFECYCLE_STATUSES, SESSION_PRINCIPAL_TYPES, SEVERITY_SCORES, SLOpinionInputSchema, TENANT_BOOTSTRAP_FORBIDDEN_SEED_TABLES, TENANT_BOOTSTRAP_SEED_AUTH_METADATA_FIELDS, TENANT_BOOTSTRAP_SEED_COMPONENTS, TENANT_BOOTSTRAP_SEED_CONTRACT_VERSION, TENANT_BOOTSTRAP_SEED_MANIFEST, TENANT_BOOTSTRAP_SEED_TABLES, TENANT_BOOTSTRAP_TABLE_REQUIREMENTS, TENANT_BOOTSTRAP_TEMPLATE_ACTOR, TENANT_BOOTSTRAP_TEMPLATE_SEED_VERSION, TENANT_BOOTSTRAP_TEMPLATE_TENANT_ID, TENANT_CLIENT_AUTH_MODES, TENANT_CLIENT_CAPABILITIES, TENANT_CLIENT_COMPONENT_CONFIG_IMPORTS, TENANT_CLIENT_CONTRACT_VERSION, TENANT_CLIENT_FORBIDDEN_IMPORT_PATTERNS, TENANT_CLIENT_FORBIDDEN_INSTALL_TOKEN_INFISICAL_PATHS, TENANT_CLIENT_FORBIDDEN_SECRET_ENV, TENANT_CLIENT_FULL_SUITE_PACKAGE_NAMES, TENANT_CLIENT_INSTALLABLE_PACKAGES, TENANT_CLIENT_INSTALL_PROFILES, TENANT_CLIENT_INSTALL_TOKEN_ENV, TENANT_CLIENT_INSTALL_TOKEN_INFISICAL_PATH, TENANT_CLIENT_ISOLATION_RULES, TENANT_CLIENT_MANIFEST, TENANT_CLIENT_OPTIONAL_CONTEXT_FIELDS, TENANT_CLIENT_PRINCIPAL_TYPES, TENANT_CLIENT_PUBLIC_IMPORTS, TENANT_CLIENT_REQUIRED_CONTEXT_FIELDS, TENANT_CLIENT_REQUIRED_SDK_NAMESPACES, TOKENS_PER_WORD, WEBHOOK_MAX_ATTEMPTS, WEBHOOK_RETRY_DELAYS_MS, WORKFLOW_ACTION_KINDS, WORKFLOW_APPROVAL_MODES, WORKFLOW_AUTO_FIX_MODES, WORKFLOW_HOOK_EVENTS, WORKFLOW_INTEGRITY_CHECKS, WORKFLOW_MUTATION_TIERS, WORKFLOW_OUTPUT_KINDS, WORKFLOW_PROOF_ARTIFACT_KINDS, WORKFLOW_RUNTIME_SCHEMA_VERSION, WORKFLOW_RUN_STATUSES, WORKFLOW_STAFFING_HINTS, WORKFLOW_TRIGGER_KINDS, WORKTREE_PHASES, assertEdgePolicyAllowed, assertTenantClientImportAllowed, bigramTokenize, buildDomainEvent, buildTenantBootstrapTemplateSeedRows, classifyTenantClientImport, collectTopicNeighborhood, compareEventCursor, dsl_exports as contractDsl, createEventId, createEvidenceProjection, decodeEventCursor, decodePrefixedId, defineProjection, edgePolicyManifest, emitDomainEvent, encodeEventCursor, encodePrefixedId, fillGraphIntelligencePromptTemplate, findEdgePolicy, findInfisicalRuntimePath, findInfisicalRuntimeSurface, findTenantBootstrapSeedTable, findTenantBootstrapTableRequirement, findTenantClientInstallablePackage, formatTenantClientImportViolation, getComponentBoundaryTableLayer, getGraphIntelligenceQuery, hasPrefixedIdPrefix, inferActorType, inferSessionPrincipalType, isAfterCursor, isComponentBoundaryComponentOwnedTable, isGraphIntelligenceQueryMode, isLucernPrompt, isTenantBootstrapForbiddenSeedTable, isTenantBootstrapSeedTable, isTenantClientAllowedImport, isTenantClientComponentConfigImport, isTenantClientInstallablePackage, isTenantClientPublicImport, jaccardSimilarity, lastDelegator, listBeliefsProjection, listGraphIntelligenceQueries, listTasksProjection, tool_contracts_exports as mcpToolsContract, modulateConfidenceProjection, normalizeDelegationChain, normalizeRetentionDays, prepareLexicalQuery, projections, rankEntityConnections, rankEntityTypeMatches, rankWindowScore, requireActorPrincipalId, rerankLexicalWindow, schemas_exports as schemaContracts, scoreEntityConnection, scoreEntityTypeMatch, scoreLexicalSignal, scoreLexicalSignals, sdk_tools_contract_exports as sdkToolsContract, sortEventsByCursor, stemToken, tokenOverlapScore, tokenizeSearchText, wordOverlapScore, wordTokenize };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map