@lucern/events 0.3.0-alpha.10 → 0.3.0-alpha.12

package/dist/webhooks.js

@@ -1,6 +1,20 @@
 import { z } from 'zod';
 import { v } from 'convex/values';
 
+// ../contracts/src/types/reasoning-method.ts
+var REASONING_METHODS = [
+  "deductive",
+  "inductive",
+  "abductive",
+  "analogical",
+  "causal",
+  "correlational",
+  "testimonial",
+  "statistical",
+  "implicit",
+  "pattern_match"
+];
+
 // ../contracts/src/graph-intelligence.contract.ts
 var GRAPH_INTELLIGENCE_MODE_TOOL_NAMES = {
   core: [
@@ -692,7 +706,7 @@ defineTable({
 });
 defineTable({
   name: "agents",
-  component: "identity",
+  component: "control-plane",
   category: "agent",
   shape: z.object({
     "slug": z.string(),
@@ -723,6 +737,7 @@ defineTable({
   category: "tenant",
   shape: z.object({
     "tenantId": idOf("tenants"),
+    "workspaceId": idOf("workspaces").optional(),
     "keyPrefix": z.enum(["luc", "stk"]),
     "keyHash": z.string(),
     "keyHint": z.string(),
@@ -750,7 +765,7 @@ defineTable({
   shape: z.object({
     "tenantId": idOf("tenants").optional(),
     "apiKeyId": idOf("apiKeys").optional(),
-    "action": z.enum(["key_created", "key_revoked", "key_expired", "key_used", "tenant_secret_created", "tenant_secret_rotated", "tenant_secret_revoked", "tenant_slot_binding_upserted", "tenant_slot_binding_revoked", "proxy_token_minted", "proxy_request_recorded", "tenant_created", "tenant_updated", "tenant_suspended", "tenant_archived", "tenant_reactivated", "principal_created", "principal_updated", "principal_suspended", "membership_created", "membership_updated", "membership_revoked", "group_created", "group_updated", "group_deleted", "group_member_added", "group_member_removed", "workspace_created", "workspace_updated", "workspace_archived", "workspace_deployment_set", "workspace_deployment_removed", "service_key_created", "service_key_rotated", "service_key_revoked", "service_key_used", "service_key_auth_failed", "session_created", "session_validated", "session_revoked", "session_cascade_revoked", "session_expired", "sandbox_created", "sandbox_secret_injected", "sandbox_execution_started", "sandbox_execution_completed", "sandbox_limit_violated", "policy_created", "policy_updated", "policy_enforced", "policy_archived", "agent_registered", "agent_updated", "tool_registered", "tool_updated", "pack_entitled", "pack_installed", "pack_enabled", "pack_disabled", "pack_entitlement_revoked", "pack_upgraded", "pack_upgrade_committed", "pack_upgrade_rolled_back", "pack_group_assigned", "pack_group_unassigned", "methodology_pack_created", "methodology_pack_updated", "methodology_pack_assigned", "methodology_pack_removed", "pack_assigned_to_group", "pack_revoked_from_group", "pack_ontology_materialized", "pack_ontology_topic_bound", "cutover_flag_set", "cutover_flag_cleared"]),
+    "action": z.enum(["key_created", "key_revoked", "key_expired", "key_used", "tenant_secret_created", "tenant_secret_rotated", "tenant_secret_revoked", "tenant_slot_binding_upserted", "tenant_slot_binding_revoked", "proxy_token_minted", "proxy_token_lease_issued", "proxy_token_lease_renewed", "proxy_token_lease_revoked", "proxy_request_recorded", "tenant_created", "tenant_updated", "tenant_suspended", "tenant_archived", "tenant_reactivated", "principal_created", "principal_updated", "principal_suspended", "principal_identity_alias_upserted", "principal_identity_alias_revoked", "membership_created", "membership_updated", "membership_revoked", "group_created", "group_updated", "group_deleted", "group_member_added", "group_member_removed", "workspace_created", "workspace_updated", "workspace_archived", "workspace_deployment_set", "workspace_deployment_removed", "deployment_host_registered", "deployment_host_revoked", "service_key_created", "service_key_rotated", "service_key_revoked", "service_key_used", "service_key_auth_failed", "session_created", "session_validated", "session_revoked", "session_cascade_revoked", "session_expired", "sandbox_created", "sandbox_secret_injected", "sandbox_execution_started", "sandbox_execution_completed", "sandbox_limit_violated", "policy_created", "policy_updated", "policy_enforced", "policy_archived", "permit_sync_enqueued", "permit_sync_succeeded", "permit_sync_failed", "permit_sync_skipped", "agent_registered", "agent_updated", "tool_registered", "tool_updated", "pack_entitled", "pack_installed", "pack_enabled", "pack_disabled", "pack_entitlement_revoked", "pack_upgraded", "pack_upgrade_committed", "pack_upgrade_rolled_back", "pack_group_assigned", "pack_group_unassigned", "methodology_pack_created", "methodology_pack_updated", "methodology_pack_assigned", "methodology_pack_removed", "pack_assigned_to_group", "pack_revoked_from_group", "pack_ontology_materialized", "pack_ontology_topic_bound", "cutover_flag_set", "cutover_flag_cleared"]),
     "actorClerkId": z.string(),
     "details": z.any().optional(),
     "createdAt": z.number()
@@ -1629,29 +1644,37 @@ defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "shimId": z.string(),
-    "gateId": z.string(),
-    "removalDate": z.string(),
-    "removalPriority": z.enum(["P1", "P2", "P3"]),
-    "description": z.string(),
-    "owner": z.string(),
-    "createdAt": z.string(),
-    "status": z.enum(["active", "overdue", "removed"]),
-    "bridgeType": z.enum(["tool", "agent"]),
-    "bridgeTarget": z.object({
-      "type": z.enum(["tool", "agent"]),
-      "legacyPath": z.string(),
-      "harnessPath": z.string()
+    shimId: z.string(),
+    gateId: z.string(),
+    removalDate: z.string(),
+    removalPriority: z.enum(["P1", "P2", "P3"]),
+    description: z.string(),
+    owner: z.string(),
+    createdAt: z.string(),
+    status: z.enum(["active", "overdue", "removed"]),
+    bridgeType: z.enum(["tool", "agent"]),
+    bridgeTarget: z.object({
+      type: z.enum(["tool", "agent"]),
+      legacyPath: z.string(),
+      harnessPath: z.string()
     }),
-    "shimBehavior": z.enum(["passthrough_with_logging", "adapter", "feature_flag_gate"]),
-    "producesLedgerEntries": z.boolean(),
-    "lastAuditedAt": z.number(),
-    "metadata": z.record(z.any()).optional()
+    shimBehavior: z.enum([
+      "passthrough_with_logging",
+      "adapter",
+      "feature_flag_gate"
+    ]),
+    producesLedgerEntries: z.boolean(),
+    lastAuditedAt: z.number(),
+    metadata: z.record(z.any()).optional()
   }),
   indices: [
     { kind: "index", name: "by_shimId", columns: ["shimId"] },
     { kind: "index", name: "by_status", columns: ["status"] },
-    { kind: "index", name: "by_bridgeType_status", columns: ["bridgeType", "status"] }
+    {
+      kind: "index",
+      name: "by_bridgeType_status",
+      columns: ["bridgeType", "status"]
+    }
   ]
 });
 defineTable({
@@ -1659,12 +1682,23 @@ defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "domain": z.enum(["graph", "schema", "identity", "policy", "audit", "admin", "agent", "tool", "prompt", "intelligence"]),
-    "state": z.enum(["legacy", "cutover", "disabled"]),
-    "metadata": z.record(z.any()).optional(),
-    "updatedBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    domain: z.enum([
+      "graph",
+      "schema",
+      "identity",
+      "policy",
+      "audit",
+      "admin",
+      "agent",
+      "tool",
+      "prompt",
+      "intelligence"
+    ]),
+    state: z.enum(["legacy", "cutover", "disabled"]),
+    metadata: z.record(z.any()).optional(),
+    updatedBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_domain", columns: ["domain"] },
@@ -1676,57 +1710,193 @@ defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "credentialRef": z.string(),
-    "tenantId": idOf("tenants"),
-    "target": z.enum(["kernelDeployment", "appDeployment"]),
-    "environment": z.enum(["dev", "staging", "prod"]),
-    "encryptedDeployKey": z.string(),
-    "encryptionVersion": z.string(),
-    "keyFingerprint": z.string(),
-    "keyHint": z.string(),
-    "status": z.enum(["active", "revoked"]),
-    "rotatedFromCredentialRef": z.string().optional(),
-    "revokedAt": z.number().optional(),
-    "revokedBy": z.string().optional(),
-    "lastUsedAt": z.number().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    credentialRef: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    target: z.enum(["kernelDeployment", "appDeployment"]),
+    environment: z.enum(["dev", "staging", "prod"]),
+    encryptedDeployKey: z.string(),
+    encryptionVersion: z.string(),
+    keyFingerprint: z.string(),
+    keyHint: z.string(),
+    status: z.enum(["active", "revoked"]),
+    rotatedFromCredentialRef: z.string().optional(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    lastUsedAt: z.number().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_credentialRef", columns: ["credentialRef"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_tenant_target", columns: ["tenantId", "target"] },
-    { kind: "index", name: "by_tenant_target_environment", columns: ["tenantId", "target", "environment"] },
-    { kind: "index", name: "by_tenant_target_environment_status", columns: ["tenantId", "target", "environment", "status"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    {
+      kind: "index",
+      name: "by_tenant_target",
+      columns: ["tenantId", "target"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_target_environment",
+      columns: ["tenantId", "target", "environment"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_target_environment_status",
+      columns: ["tenantId", "target", "environment", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_workspace_target_environment_status",
+      columns: ["tenantId", "workspaceId", "target", "environment", "status"]
+    },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
+defineTable({
+  name: "permitSyncStates",
+  component: "mc",
+  category: "runtime",
+  shape: z.object({
+    syncKey: z.string(),
+    objectType: z.enum([
+      "resource",
+      "role",
+      "resource_role",
+      "resource_relation",
+      "tenant",
+      "workspace",
+      "principal",
+      "membership",
+      "group",
+      "resource_instance",
+      "relationship_tuple",
+      "role_assignment"
+    ]),
+    objectId: z.string(),
+    tenantId: idOf("tenants").optional(),
+    workspaceId: idOf("workspaces").optional(),
+    principalId: z.string().optional(),
+    permitTenantKey: z.string().optional(),
+    permitResourceType: z.string().optional(),
+    permitResourceKey: z.string().optional(),
+    desiredPayload: z.record(z.any()),
+    lastAppliedPayloadHash: z.string().optional(),
+    status: z.enum(["pending", "synced", "error", "skipped"]),
+    attemptCount: z.number(),
+    lastError: z.string().optional(),
+    nextAttemptAt: z.number().optional(),
+    lastSyncedAt: z.number().optional(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_workspace_status",
+      columns: ["workspaceId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_principal_status",
+      columns: ["principalId", "status"]
+    }
+  ]
+});
+defineTable({
+  name: "secretSyncDriftReports",
+  component: "mc",
+  category: "runtime",
+  shape: z.object({
+    reportId: z.string(),
+    source: z.enum(["infisical_manifest", "manual", "ci"]),
+    generatedAt: z.number(),
+    recordedAt: z.number(),
+    recordedBy: z.string(),
+    status: z.enum([
+      "in_sync",
+      "drift",
+      "exception",
+      "blocked",
+      "not_observed"
+    ]),
+    reportHash: z.string(),
+    manifestHash: z.string().optional(),
+    dryRunReceiptId: z.string().optional(),
+    appliedReceiptId: z.string().optional(),
+    summary: z.object({
+      totalPipelines: z.number(),
+      inSync: z.number(),
+      drift: z.number(),
+      exception: z.number(),
+      blocked: z.number(),
+      notObserved: z.number(),
+      missingKeys: z.number(),
+      valueDriftKeys: z.number(),
+      extraKeys: z.number(),
+      deniedConvexLeakage: z.number(),
+      approvedExceptions: z.number()
+    }),
+    redactedReport: z.record(z.any()),
+    metadata: z.record(z.any()).optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_reportId", columns: ["reportId"] },
+    { kind: "index", name: "by_reportHash", columns: ["reportHash"] },
+    { kind: "index", name: "by_generatedAt", columns: ["generatedAt"] },
+    {
+      kind: "index",
+      name: "by_status_generatedAt",
+      columns: ["status", "generatedAt"]
+    }
+  ]
+});
 defineTable({
   name: "controlPlaneTenantModelSlotBindings",
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "bindingId": z.string(),
-    "tenantId": idOf("tenants"),
-    "providerId": z.string(),
-    "modelSlotId": z.string(),
-    "secretRef": z.string(),
-    "status": z.enum(["active", "revoked"]),
-    "passThroughOnly": z.boolean(),
-    "revokedAt": z.number().optional(),
-    "revokedBy": z.string().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    bindingId: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    environment: z.enum(["dev", "staging", "prod"]).optional(),
+    providerId: z.string(),
+    modelSlotId: z.string(),
+    secretRef: z.string(),
+    status: z.enum(["active", "revoked"]),
+    passThroughOnly: z.boolean(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_bindingId", columns: ["bindingId"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_tenant_slot", columns: ["tenantId", "modelSlotId"] },
-    { kind: "index", name: "by_tenant_provider_slot", columns: ["tenantId", "providerId", "modelSlotId"] },
+    {
+      kind: "index",
+      name: "by_tenant_slot",
+      columns: ["tenantId", "modelSlotId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_provider_slot",
+      columns: ["tenantId", "providerId", "modelSlotId"]
+    },
     { kind: "index", name: "by_secretRef", columns: ["secretRef"] },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
@@ -1736,29 +1906,42 @@ defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "secretRef": z.string(),
-    "tenantId": idOf("tenants"),
-    "providerId": z.string(),
-    "label": z.string().optional(),
-    "encryptedSecret": z.string(),
-    "encryptionVersion": z.string(),
-    "secretFingerprint": z.string(),
-    "keyHint": z.string(),
-    "status": z.enum(["active", "revoked"]),
-    "rotatedFromSecretRef": z.string().optional(),
-    "revokedAt": z.number().optional(),
-    "revokedBy": z.string().optional(),
-    "lastUsedAt": z.number().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    secretRef: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    environment: z.enum(["dev", "staging", "prod"]).optional(),
+    providerId: z.string(),
+    label: z.string().optional(),
+    encryptedSecret: z.string().optional(),
+    infisicalPath: z.string().optional(),
+    infisicalSecretKey: z.string().optional(),
+    infisicalProjectId: z.string().optional(),
+    encryptionVersion: z.string(),
+    secretFingerprint: z.string(),
+    keyHint: z.string(),
+    status: z.enum(["active", "revoked"]),
+    rotatedFromSecretRef: z.string().optional(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    lastUsedAt: z.number().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_secretRef", columns: ["secretRef"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_tenant_provider", columns: ["tenantId", "providerId"] },
-    { kind: "index", name: "by_tenant_provider_status", columns: ["tenantId", "providerId", "status"] },
+    {
+      kind: "index",
+      name: "by_tenant_provider",
+      columns: ["tenantId", "providerId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_provider_status",
+      columns: ["tenantId", "providerId", "status"]
+    },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
@@ -1767,35 +1950,93 @@ defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "usageId": z.string(),
-    "tenantId": idOf("tenants"),
-    "providerId": z.string(),
-    "modelSlotId": z.string(),
-    "secretRef": z.string(),
-    "proxyTokenId": z.string(),
-    "sessionId": z.string(),
-    "principalId": z.string(),
-    "workspaceId": z.string().optional(),
-    "modelId": z.string().optional(),
-    "requestPath": z.string(),
-    "status": z.enum(["success", "error"]),
-    "responseStatus": z.number().optional(),
-    "inputTokens": z.number().optional(),
-    "outputTokens": z.number().optional(),
-    "tokenCount": z.number().optional(),
-    "latencyMs": z.number(),
-    "estimatedCostUsd": z.number().optional(),
-    "failureCode": z.string().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    usageId: z.string(),
+    tenantId: idOf("tenants"),
+    providerId: z.string(),
+    modelSlotId: z.string(),
+    secretRef: z.string(),
+    proxyTokenId: z.string(),
+    sessionId: z.string(),
+    principalId: z.string(),
+    workspaceId: z.string().optional(),
+    modelId: z.string().optional(),
+    requestPath: z.string(),
+    status: z.enum(["success", "error"]),
+    responseStatus: z.number().optional(),
+    inputTokens: z.number().optional(),
+    outputTokens: z.number().optional(),
+    tokenCount: z.number().optional(),
+    latencyMs: z.number(),
+    estimatedCostUsd: z.number().optional(),
+    failureCode: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_usageId", columns: ["usageId"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId", "createdAt"] },
-    { kind: "index", name: "by_tenant_provider", columns: ["tenantId", "providerId", "createdAt"] },
-    { kind: "index", name: "by_proxyTokenId", columns: ["proxyTokenId", "createdAt"] },
-    { kind: "index", name: "by_sessionId", columns: ["sessionId", "createdAt"] }
+    {
+      kind: "index",
+      name: "by_tenant_provider",
+      columns: ["tenantId", "providerId", "createdAt"]
+    },
+    {
+      kind: "index",
+      name: "by_proxyTokenId",
+      columns: ["proxyTokenId", "createdAt"]
+    },
+    {
+      kind: "index",
+      name: "by_sessionId",
+      columns: ["sessionId", "createdAt"]
+    }
+  ]
+});
+defineTable({
+  name: "controlPlaneTenantProxyTokenLeases",
+  component: "mc",
+  category: "runtime",
+  shape: z.object({
+    leaseId: z.string(),
+    proxyTokenId: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    environment: z.enum(["dev", "staging", "prod"]),
+    providerId: z.string(),
+    modelSlotId: z.string(),
+    bindingId: z.string(),
+    secretRef: z.string(),
+    sessionId: z.string(),
+    principalId: z.string(),
+    agentSessionId: z.string().optional(),
+    status: z.enum(["active", "revoked"]),
+    expiresAt: z.number(),
+    renewedAt: z.number().optional(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    revokeReason: z.string().optional(),
+    permitDecisionLogId: idOf("policyDecisionLogs").optional(),
+    permitTraceId: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_leaseId", columns: ["leaseId"] },
+    { kind: "index", name: "by_proxyTokenId", columns: ["proxyTokenId"] },
+    { kind: "index", name: "by_tenantId", columns: ["tenantId", "createdAt"] },
+    { kind: "index", name: "by_sessionId", columns: ["sessionId", "createdAt"] },
+    {
+      kind: "index",
+      name: "by_principalId",
+      columns: ["principalId", "createdAt"]
+    },
+    {
+      kind: "index",
+      name: "by_status_expiresAt",
+      columns: ["status", "expiresAt"]
+    }
   ]
 });
 defineTable({
@@ -2128,6 +2369,7 @@ defineTable({
     "questionType": z.enum(["validation", "falsification", "assumption_probe", "prediction_test", "counterfactual", "discovery", "clarification", "comparison", "causal", "mechanism", "general"]).optional(),
     "questionPriority": z.enum(["critical", "high", "medium", "low"]).optional(),
     "answerQuality": z.enum(["definitive", "strong", "moderate", "weak", "speculative", "unanswered"]).optional(),
+    "themeStatus": z.enum(["emerging", "active", "mature", "declining", "archived"]).optional(),
     "themeConviction": z.enum(["high", "medium", "low", "negative"]).optional(),
     "decisionType": z.enum(["invest", "pass", "follow_on", "exit", "deep_dive", "monitor", "deprioritize", "thesis_adopt", "thesis_revise", "thesis_abandon"]).optional(),
     "decisionOutcome": z.enum(["pending", "successful", "unsuccessful", "mixed", "unknown"]).optional(),
@@ -2278,6 +2520,7 @@ defineTable({
   indices: [
     { kind: "index", name: "by_principalId", columns: ["principalId"] },
     { kind: "index", name: "by_principal_tenant", columns: ["principalId", "tenantId"] },
+    { kind: "index", name: "by_principal_tenant_workspace", columns: ["principalId", "tenantId", "workspaceId"] },
     { kind: "index", name: "by_workspace_principal", columns: ["workspaceId", "principalId"] },
     { kind: "index", name: "by_tenant_role", columns: ["tenantId", "role"] },
     { kind: "index", name: "by_status", columns: ["status"] }
@@ -2309,6 +2552,36 @@ defineTable({
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
+defineTable({
+  name: "principalIdentityAliases",
+  component: "mc",
+  category: "identity",
+  shape: z.object({
+    "principalId": z.string(),
+    "principalRefId": idOf("principals").optional(),
+    "provider": z.string(),
+    "providerProjectId": z.string().optional(),
+    "externalSubjectId": z.string(),
+    "tenantId": idOf("tenants").optional(),
+    "workspaceId": idOf("workspaces").optional(),
+    "email": z.string().optional(),
+    "status": z.enum(["active", "revoked"]),
+    "metadata": z.record(z.any()).optional(),
+    "createdBy": z.string(),
+    "revokedAt": z.number().optional(),
+    "revokedBy": z.string().optional(),
+    "createdAt": z.number(),
+    "updatedAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_provider_subject", columns: ["provider", "externalSubjectId"] },
+    { kind: "index", name: "by_provider_project_subject", columns: ["provider", "providerProjectId", "externalSubjectId"] },
+    { kind: "index", name: "by_principalId", columns: ["principalId"] },
+    { kind: "index", name: "by_principal_status", columns: ["principalId", "status"] },
+    { kind: "index", name: "by_tenant_provider_subject", columns: ["tenantId", "provider", "externalSubjectId"] },
+    { kind: "index", name: "by_workspace_provider_subject", columns: ["workspaceId", "provider", "externalSubjectId"] }
+  ]
+});
 defineTable({
   name: "rateLimitWindows",
   component: "mc",
@@ -2898,7 +3171,7 @@ defineTable({
 });
 defineTable({
   name: "mcpWritePolicy",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "topicId": z.string().optional(),
@@ -2921,7 +3194,7 @@ defineTable({
 });
 defineTable({
   name: "platformAudienceGrants",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2947,7 +3220,7 @@ defineTable({
 });
 defineTable({
   name: "platformAudiences",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2972,7 +3245,7 @@ defineTable({
 });
 defineTable({
   name: "platformPolicyDecisionLogs",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "principalId": z.string(),
@@ -3008,7 +3281,7 @@ defineTable({
 });
 defineTable({
   name: "tenantApiKeys",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -3035,7 +3308,7 @@ defineTable({
 });
 defineTable({
   name: "tenantConfig",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -3054,7 +3327,7 @@ defineTable({
 });
 defineTable({
   name: "tenantIntegrations",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -3109,7 +3382,7 @@ defineTable({
 });
 defineTable({
   name: "tenantModelSlotBindings",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "bindingId": z.string(),
@@ -3137,7 +3410,7 @@ defineTable({
 });
 defineTable({
   name: "tenantPolicies",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -3162,7 +3435,7 @@ defineTable({
 });
 defineTable({
   name: "tenantProviderSecrets",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "secretRef": z.string(),
@@ -3193,7 +3466,7 @@ defineTable({
 });
 defineTable({
   name: "tenantProxyGatewayUsage",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "usageId": z.string(),
@@ -3228,7 +3501,7 @@ defineTable({
 });
 defineTable({
   name: "tenantProxyTokenMints",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "proxyTokenId": z.string(),
@@ -3251,7 +3524,7 @@ defineTable({
 });
 defineTable({
   name: "tenantSandboxAuditEvents",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "eventId": z.string(),
@@ -3285,7 +3558,7 @@ defineTable({
 });
 defineTable({
   name: "tenantSecrets",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -3307,7 +3580,7 @@ defineTable({
 });
 defineTable({
   name: "toolAcls",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "role": z.enum(["platform_admin", "tenant_admin", "workspace_admin", "editor", "viewer", "auditor", "service_agent"]),
@@ -3322,7 +3595,7 @@ defineTable({
 });
 defineTable({
   name: "toolRegistry",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "toolName": z.string(),
@@ -3403,7 +3676,7 @@ defineTable({
 });
 defineTable({
   name: "modelCallLogs",
-  component: "identity",
+  component: "control-plane",
   category: "model",
   shape: z.object({
     "slot": z.string(),
@@ -3429,7 +3702,7 @@ defineTable({
 });
 defineTable({
   name: "modelFunctionSlots",
-  component: "identity",
+  component: "control-plane",
   category: "model",
   shape: z.object({
     "slot": z.string(),
@@ -3454,7 +3727,7 @@ defineTable({
 });
 defineTable({
   name: "modelRegistry",
-  component: "identity",
+  component: "control-plane",
   category: "model",
   shape: z.object({
     "key": z.string(),
@@ -3481,7 +3754,7 @@ defineTable({
 });
 defineTable({
   name: "modelSlotConfigs",
-  component: "identity",
+  component: "control-plane",
   category: "model",
   shape: z.object({
     "slot": z.string(),
@@ -3868,7 +4141,7 @@ defineTable({
     "workspaceId": idOf("workspaces").optional(),
     "resourceType": z.string(),
     "resourceId": z.string(),
-    "action": z.enum(["read", "summarize", "export", "mutate", "admin", "comment", "escalate", "resolve", "vote"]),
+    "action": z.enum(["read", "summarize", "export", "mutate", "admin", "comment", "escalate", "resolve", "vote", "route", "invoke", "manage", "deploy", "promote", "rollback", "audit", "read_ref", "fetch_value", "rotate", "administer", "mint", "delegate", "revoke"]),
     "decision": z.enum(["allow", "deny"]),
     "reasonCode": z.string(),
     "policyVersion": z.string(),
@@ -3930,7 +4203,7 @@ defineTable({
 });
 defineTable({
   name: "projectGrants",
-  component: "identity",
+  component: "control-plane",
   category: "project",
   shape: z.object({
     "projectId": z.string().optional(),
@@ -3962,9 +4235,650 @@ defineTable({
     { kind: "index", name: "by_topic_cluster_status", columns: ["topicId", "beliefClusterId", "status"] }
   ]
 });
+var permitActorType = z.enum([
+  "human",
+  "agent",
+  "service_principal",
+  "external_stakeholder",
+  "system"
+]);
+var permitMembershipStatus = z.enum([
+  "active",
+  "invited",
+  "revoked",
+  "suspended",
+  "disabled"
+]);
+var permitDecision = z.enum(["allow", "deny"]);
+var permitAccessReviewStatus = z.enum([
+  "open",
+  "in_progress",
+  "approved",
+  "denied",
+  "expired",
+  "cancelled"
+]);
+var permitReviewScope = z.enum([
+  "tenant",
+  "workspace",
+  "resource_instance",
+  "group",
+  "principal",
+  "api_key",
+  "admin_action"
+]);
+var permitRecordStatus = z.enum([
+  "queued",
+  "inflight",
+  "completed",
+  "failed",
+  "skipped",
+  "stale"
+]);
+var permitObjectType = z.enum([
+  "resource",
+  "role",
+  "resource_role",
+  "resource_relation",
+  "tenant",
+  "workspace",
+  "principal",
+  "membership",
+  "group",
+  "resource_instance",
+  "relationship_tuple",
+  "role_assignment",
+  "attribute_binding",
+  "policy_bundle"
+]);
+var permitOutboxOperation = z.enum([
+  "upsert",
+  "delete",
+  "sync",
+  "resync",
+  "delete_sync",
+  "noop"
+]);
+var permitPolicyBundleStatus = z.enum([
+  "draft",
+  "validated",
+  "enforced",
+  "archived"
+]);
+var permitSyncStatus = z.enum([
+  "pending",
+  "synced",
+  "error",
+  "skipped"
+]);
+var permitAccessReviewSubjectType = z.enum([
+  "principal",
+  "group",
+  "role_assignment",
+  "resource_instance"
+]);
+var permitAttributeType = z.enum([
+  "string",
+  "number",
+  "bool",
+  "json",
+  "time"
+]);
+var permitAttributeOperator = z.enum([
+  "eq",
+  "neq",
+  "in",
+  "not_in",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "contains",
+  "not_contains",
+  "matches"
+]);
+var permitRoleBindingTarget = z.enum([
+  "principal",
+  "group"
+]);
+defineTable({
+  name: "permitPrincipals",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    principalId: z.string(),
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    principalType: permitActorType,
+    status: permitMembershipStatus,
+    displayName: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    updatedBy: z.string().optional(),
+    lastSeenAt: z.number().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_tenant_principalId", columns: ["tenantId", "principalId"] },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
+    {
+      kind: "index",
+      name: "by_tenant_principalType_status",
+      columns: ["tenantId", "principalType", "status"]
+    }
+  ]
+});
+defineTable({
+  name: "permitPrincipalAliases",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    principalId: z.string(),
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    provider: z.string(),
+    providerSubjectId: z.string(),
+    providerProjectId: z.string().optional(),
+    alias: z.string(),
+    aliasKind: z.string(),
+    status: permitMembershipStatus,
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    revokedBy: z.string().optional(),
+    revokedAt: z.number().optional(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_principalId", columns: ["principalId"] },
+    { kind: "index", name: "by_tenant_provider_subject", columns: ["tenantId", "provider", "providerSubjectId"] },
+    {
+      kind: "index",
+      name: "by_tenant_provider_alias",
+      columns: ["tenantId", "provider", "alias"]
+    },
+    { kind: "index", name: "by_tenant_alias", columns: ["tenantId", "alias"] },
+    {
+      kind: "index",
+      name: "by_tenant_provider_status",
+      columns: ["tenantId", "provider", "status"]
+    }
+  ]
+});
+defineTable({
+  name: "permitGroups",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    groupId: z.string(),
+    groupKey: z.string(),
+    groupName: z.string(),
+    groupType: z.enum(["tenant", "workspace", "external", "system", "dynamic"]),
+    status: permitMembershipStatus,
+    description: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_tenant_groupId", columns: ["tenantId", "groupId"] },
+    { kind: "index", name: "by_tenant_groupKey", columns: ["tenantId", "groupKey"] },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
+  ]
+});
+defineTable({
+  name: "permitGroupMemberships",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    groupId: z.string(),
+    memberType: z.enum(["principal", "group"]),
+    memberId: z.string(),
+    principalId: z.string().optional(),
+    childGroupId: z.string().optional(),
+    status: permitMembershipStatus,
+    addedBy: z.string().optional(),
+    revokedBy: z.string().optional(),
+    expiresAt: z.number().optional(),
+    revocationReason: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenant_principal", columns: ["tenantId", "principalId"] },
+    { kind: "index", name: "by_tenant_member", columns: ["tenantId", "memberType", "memberId"] },
+    {
+      kind: "index",
+      name: "by_tenant_member_group",
+      columns: ["tenantId", "memberType", "memberId", "groupId"]
+    },
+    { kind: "index", name: "by_tenant_group", columns: ["tenantId", "groupId"] },
+    { kind: "index", name: "by_member_group", columns: ["memberType", "memberId", "groupId"] },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
+    {
+      kind: "index",
+      name: "by_workspace_principal",
+      columns: ["workspaceId", "principalId"]
+    }
+  ]
+});
+defineTable({
+  name: "permitResourceInstances",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    resourceType: z.string(),
+    resourceKey: z.string(),
+    resourceId: z.string(),
+    status: z.enum(["active", "deleted", "archived"]),
+    attributes: z.record(z.any()).optional(),
+    ownerPrincipalId: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    {
+      kind: "index",
+      name: "by_tenant_resource_type",
+      columns: ["tenantId", "resourceType"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_resource_key",
+      columns: ["tenantId", "resourceType", "resourceKey"]
+    },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_ownerPrincipalId",
+      columns: ["ownerPrincipalId"]
+    }
+  ]
+});
+defineTable({
+  name: "permitRoleAssignments",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    role: z.string(),
+    targetType: permitRoleBindingTarget,
+    targetId: z.string(),
+    resourceType: z.string(),
+    resourceKey: z.string(),
+    resourceInstanceId: z.string().optional(),
+    status: permitMembershipStatus,
+    expiresAt: z.number().optional(),
+    attributes: z.record(z.any()).optional(),
+    grantedBy: z.string().optional(),
+    updatedBy: z.string().optional(),
+    revokedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    {
+      kind: "index",
+      name: "by_tenant_target",
+      columns: ["tenantId", "targetType", "targetId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_resource",
+      columns: ["tenantId", "resourceType", "resourceKey"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_role",
+      columns: ["tenantId", "role", "status"]
+    },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_workspace_resource",
+      columns: ["workspaceId", "resourceType", "resourceKey"]
+    }
+  ]
+});
+defineTable({
+  name: "permitRelationshipTuples",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    relation: z.string(),
+    subject: z.string(),
+    object: z.string(),
+    resourceType: z.string().optional(),
+    resourceKey: z.string().optional(),
+    status: permitRecordStatus,
+    attributes: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    lastSeenAt: z.number().optional(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenant_subject", columns: ["tenantId", "subject"] },
+    { kind: "index", name: "by_tenant_object", columns: ["tenantId", "object"] },
+    { kind: "index", name: "by_tenant_relation", columns: ["tenantId", "relation"] },
+    {
+      kind: "index",
+      name: "by_tenant_relation_subject",
+      columns: ["tenantId", "relation", "subject"]
+    },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
+  ]
+});
+defineTable({
+  name: "permitAttributeBindings",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    targetType: permitRoleBindingTarget,
+    targetId: z.string(),
+    attributeName: z.string(),
+    attributeType: permitAttributeType,
+    attributeOperator: permitAttributeOperator,
+    attributeValue: z.any(),
+    status: permitRecordStatus,
+    source: z.string().optional(),
+    sourceRef: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    expiresAt: z.number().optional()
+  }),
+  indices: [
+    {
+      kind: "index",
+      name: "by_tenant_target",
+      columns: ["tenantId", "targetType", "targetId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_target_attribute",
+      columns: ["tenantId", "targetType", "targetId", "attributeName"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_name",
+      columns: ["tenantId", "attributeName"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    }
+  ]
+});
+defineTable({
+  name: "permitPolicyBundles",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    bundleKey: z.string(),
+    version: z.number(),
+    status: permitPolicyBundleStatus,
+    policyHash: z.string().optional(),
+    policyPayload: z.record(z.any()),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    reviewedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    retiredAt: z.number().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    {
+      kind: "index",
+      name: "by_tenant_bundleKey",
+      columns: ["tenantId", "bundleKey"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_bundle_version",
+      columns: ["tenantId", "bundleKey", "version"]
+    },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
+  ]
+});
+defineTable({
+  name: "permitProjectionOutbox",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    syncKey: z.string(),
+    objectType: permitObjectType,
+    objectId: z.string(),
+    operation: permitOutboxOperation,
+    payload: z.record(z.any()),
+    status: permitRecordStatus,
+    attemptCount: z.number(),
+    nextAttemptAt: z.number().optional(),
+    lastError: z.string().optional(),
+    tenantId: z.string().optional(),
+    workspaceId: z.optional(z.string()),
+    principalId: z.string().optional(),
+    permitTenantKey: z.string().optional(),
+    permitResourceType: z.string().optional(),
+    permitResourceKey: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    lastHandledAt: z.number().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_objectType",
+      columns: ["objectType", "status"]
+    }
+  ]
+});
+defineTable({
+  name: "tenantPermitSyncStates",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    syncKey: z.string(),
+    objectType: permitObjectType,
+    objectId: z.string(),
+    tenantId: z.string().optional(),
+    workspaceId: z.string().optional(),
+    principalId: z.string().optional(),
+    permitTenantKey: z.string().optional(),
+    permitResourceType: z.string().optional(),
+    permitResourceKey: z.string().optional(),
+    desiredPayload: z.record(z.any()),
+    lastAppliedPayloadHash: z.string().optional(),
+    status: permitSyncStatus,
+    attemptCount: z.number(),
+    lastError: z.string().optional(),
+    nextAttemptAt: z.number().optional(),
+    lastSyncedAt: z.number().optional(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_workspace_status",
+      columns: ["workspaceId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_principal_status",
+      columns: ["principalId", "status"]
+    }
+  ]
+});
+defineTable({
+  name: "permitPolicyDecisionReceipts",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string().optional(),
+    workspaceId: z.string().optional(),
+    principalId: z.string(),
+    subjectType: permitAccessReviewSubjectType.optional(),
+    subjectId: z.string().optional(),
+    resourceType: z.string(),
+    resourceId: z.string(),
+    action: z.string(),
+    decision: permitDecision,
+    reasonCode: z.string(),
+    policyBundleId: z.string().optional(),
+    policyVersion: z.string(),
+    traceId: z.string().optional(),
+    requestId: z.string().optional(),
+    audienceMode: z.string().optional(),
+    audienceKey: z.string().optional(),
+    audienceClass: z.enum(["internal", "restricted_external", "public"]).optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    expiresAt: z.number().optional(),
+    createdBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_principal_createdAt", columns: ["principalId", "createdAt"] },
+    { kind: "index", name: "by_tenant_createdAt", columns: ["tenantId", "createdAt"] },
+    { kind: "index", name: "by_resource", columns: ["resourceType", "resourceId"] },
+    { kind: "index", name: "by_decision_createdAt", columns: ["decision", "createdAt"] },
+    { kind: "index", name: "by_traceId", columns: ["traceId"] },
+    { kind: "index", name: "by_action", columns: ["action"] }
+  ]
+});
+defineTable({
+  name: "permitAccessReviews",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    reviewKey: z.string(),
+    scope: permitReviewScope,
+    status: permitAccessReviewStatus,
+    subjectType: permitAccessReviewSubjectType,
+    subjectId: z.string(),
+    resourceType: z.string().optional(),
+    resourceKey: z.string().optional(),
+    outcome: z.enum(["allow", "deny"]).optional(),
+    requestedBy: z.string(),
+    reviewedBy: z.string().optional(),
+    requestedAt: z.number(),
+    reviewedAt: z.number().optional(),
+    dueAt: z.number().optional(),
+    justification: z.string().optional(),
+    rationale: z.string().optional(),
+    policyBundleId: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
+    { kind: "index", name: "by_tenant_reviewKey", columns: ["tenantId", "reviewKey"] },
+    { kind: "index", name: "by_subject", columns: ["subjectType", "subjectId"] },
+    {
+      kind: "index",
+      name: "by_tenant_subject",
+      columns: ["tenantId", "subjectType", "subjectId"]
+    },
+    { kind: "index", name: "by_outcome", columns: ["outcome"] },
+    {
+      kind: "index",
+      name: "by_workspace_status",
+      columns: ["workspaceId", "status"]
+    }
+  ]
+});
+defineTable({
+  name: "permitAccessReviewItems",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    reviewKey: z.string(),
+    itemKey: z.string(),
+    tenantId: z.string(),
+    workspaceId: z.string().optional(),
+    subjectType: permitAccessReviewSubjectType,
+    subjectId: z.string(),
+    resourceType: z.string().optional(),
+    resourceKey: z.string().optional(),
+    role: z.string().optional(),
+    relation: z.string().optional(),
+    status: z.enum(["open", "approved", "revoked", "changed", "deferred"]),
+    reviewerId: z.string().optional(),
+    decisionAt: z.number().optional(),
+    rationale: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_reviewKey", columns: ["reviewKey"] },
+    { kind: "index", name: "by_tenant_reviewKey", columns: ["tenantId", "reviewKey"] },
+    { kind: "index", name: "by_tenant_itemKey", columns: ["tenantId", "itemKey"] },
+    { kind: "index", name: "by_subject", columns: ["subjectType", "subjectId"] },
+    { kind: "index", name: "by_status", columns: ["status"] }
+  ]
+});
 defineTable({
   name: "reasoningPermissions",
-  component: "identity",
+  component: "control-plane",
   category: "epistemic",
   shape: z.object({
     "topicId": z.string().optional(),
@@ -4211,7 +5125,7 @@ defineTable({
 });
 defineTable({
   name: "users",
-  component: "identity",
+  component: "control-plane",
   category: "user",
   shape: z.object({
     "clerkId": z.string(),
@@ -4325,7 +5239,6 @@ defineTable({
     "deployments": z.record(z.object({
       "url": z.string(),
       "target": z.enum(["kernelDeployment", "appDeployment"]).optional(),
-      "encryptedDeployKey": z.string().optional(),
       "credentialRef": z.string().optional()
     })).optional(),
     "metadata": z.record(z.any()).optional(),
@@ -4340,6 +5253,39 @@ defineTable({
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
+defineTable({
+  name: "deploymentHosts",
+  component: "mc",
+  category: "workspace",
+  shape: z.object({
+    "host": z.string(),
+    "tenantId": idOf("tenants"),
+    "workspaceId": idOf("workspaces"),
+    "environment": z.enum(["dev", "staging", "prod"]),
+    "target": z.enum(["kernelDeployment", "appDeployment"]),
+    "deploymentUrl": z.string().optional(),
+    "deploymentName": z.string().optional(),
+    "vercelProjectName": z.string().optional(),
+    "vercelProjectId": z.string().optional(),
+    "vercelEnvironment": z.enum(["development", "preview", "staging", "production"]).optional(),
+    "source": z.enum(["vercel_preview", "vercel_production", "vercel_custom_environment", "custom_domain", "manual"]),
+    "status": z.enum(["active", "revoked"]),
+    "metadata": z.record(z.any()).optional(),
+    "createdBy": z.string(),
+    "createdAt": z.number(),
+    "updatedAt": z.number(),
+    "revokedAt": z.number().optional(),
+    "revokedBy": z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_host", columns: ["host"] },
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_tenant_workspace_environment", columns: ["tenantId", "workspaceId", "environment"] },
+    { kind: "index", name: "by_workspace_status", columns: ["workspaceId", "status"] },
+    { kind: "index", name: "by_status", columns: ["status"] }
+  ]
+});
 defineTable({
   name: "worktreeBeliefCluster",
   component: "kernel",
@@ -4647,8 +5593,8 @@ defineTable({
 });
 z.object({
   manifestVersion: z.string(),
-  componentName: z.enum(["kernel", "identity"]),
-  tier: z.enum(["K", "I"]),
+  componentName: z.enum(["kernel", "control-plane"]),
+  tier: z.enum(["K", "CP"]),
   packageVersion: z.string(),
   tables: z.array(
     z.object({
@@ -4774,129 +5720,994 @@ var edgePolicyManifest = {
 // ../contracts/src/tenant-client.contract.ts
 var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
   {
-    packageName: "@lucern/access-control",
-    role: "runtime_entrypoint",
-    directTenantImport: true
+    packageName: "@lucern/access-control",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/agent",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/auth",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/cli",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/client-core",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/confidence",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/config",
+    role: "configuration",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/contracts",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/control-plane",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/developer-kit",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/events",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/graph-primitives",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/graph-sync",
+    role: "host_addon_runtime",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/mcp",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/pack-host",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/pack-installer",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/proof-compiler",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/react",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/reasoning-kernel",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/sdk",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/secrets",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/server-core",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/testing",
+    role: "test_support",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/types",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  }
+];
+TENANT_CLIENT_INSTALLABLE_PACKAGES.map(
+  (entry) => entry.packageName
+);
+
+// ../contracts/src/infisical-runtime.contract.ts
+var INFISICAL_TENANT_SOFTWARE_SYSTEMS = [
+  {
+    id: "stack-frontend",
+    tenantKey: "stack",
+    workspaceKey: "frontend",
+    vercelProjectName: "ai-chatbot-diao",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_PihFw8kohSSw14nZs9YQV3xVo517",
+    repository: {
+      owner: "stack-vc",
+      name: "front-end"
+    },
+    sharedSourcePath: "/tenants/stack",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_FRONTEND_URL",
+      deployKeyEnv: "CONVEX_FRONTEND_DEPLOY_KEY",
+      preprodDeployment: "rugged-lobster-664",
+      prodDeployment: "wonderful-toucan-0"
+    }
+  },
+  {
+    id: "stackos",
+    tenantKey: "stack",
+    workspaceKey: "stackos",
+    vercelProjectName: "stackos",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_rXLAL0Z6v9p1fasKbomby6GI7kau",
+    repository: {
+      owner: "stack-vc",
+      name: "stackos"
+    },
+    sharedSourcePath: "/tenants/stack",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_STACKOS_URL",
+      deployKeyEnv: "CONVEX_STACKOS_DEPLOY_KEY",
+      preprodDeployment: "giant-mandrill-761",
+      prodDeployment: "good-snake-515"
+    }
+  },
+  {
+    id: "stack-eng",
+    tenantKey: "stack",
+    workspaceKey: "engineering",
+    vercelProjectName: "stackos-engineering-graph",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_zAU0Zn9GkbHjHI63dxW4vLpmoqTJ",
+    repository: {
+      owner: "stack-vc",
+      name: "stackos-engineering-graph"
+    },
+    sharedSourcePath: "/tenants/stack/engineering",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_STACK_ENG_URL",
+      deployKeyEnv: "CONVEX_STACK_ENG_DEPLOY_KEY",
+      preprodDeployment: "small-oyster-270",
+      prodDeployment: "bold-cuttlefish-804"
+    }
+  },
+  {
+    id: "lucern-graph",
+    tenantKey: "lucern",
+    workspaceKey: "lucern",
+    vercelProjectName: "lucern-graph",
+    vercelTeamId: "team_vTHxxs8GAoAFUe6RWMlYt7fY",
+    vercelProjectId: "prj_KJ8EKV8vGM5xURpqmwTwmECEGPgQ",
+    repository: {
+      owner: "LucernAI",
+      name: "lucern-graph"
+    },
+    sharedSourcePath: "/tenants/lucern/shared",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_LUCERN_URL",
+      deployKeyEnv: "CONVEX_LUCERN_DEPLOY_KEY",
+      preprodDeployment: "good-blackbird-774",
+      prodDeployment: "precious-dog-365"
+    }
+  }
+];
+var TENANT_SHARED_SECRET_DEFINITION_TEMPLATES = [
+  {
+    idSuffix: "clerk.publishable",
+    canonicalName: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY",
+    aliases: ["CLERK_PUBLISHABLE_KEY"],
+    required: true,
+    secret: false,
+    public: true,
+    description: "Tenant-owned Clerk browser key. For Stack this is the master clerk.stack.vc project shared by front-end, StackOS, and the engineering workspace."
+  },
+  {
+    idSuffix: "clerk.secret",
+    canonicalName: "CLERK_SECRET_KEY",
+    required: true,
+    secret: true,
+    public: false,
+    description: "Tenant-owned Clerk backend secret used only by that tenant's server runtimes."
+  },
+  {
+    idSuffix: "clerk.project",
+    canonicalName: "CLERK_PROJECT_ID",
+    required: true,
+    secret: false,
+    public: false,
+    description: "Tenant-owned Clerk project id used to resolve canonical Clerk aliases."
+  },
+  {
+    idSuffix: "clerk.jwks",
+    canonicalName: "CLERK_JWT_ISSUER_DOMAIN",
+    aliases: ["CLERK_ISSUER_URL", "CLERK_JWKS_URL"],
+    required: false,
+    secret: false,
+    public: false,
+    description: "Tenant Clerk issuer/JWKS URL consumed by Convex auth.config.ts."
+  },
+  {
+    idSuffix: "clerk.jwt-key",
+    canonicalName: "CLERK_JWT_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    description: "Tenant Clerk JWT public verification key used by bearer-token API routes."
+  },
+  {
+    idSuffix: "clerk.authorized-parties",
+    canonicalName: "CLERK_AUTHORIZED_PARTIES",
+    aliases: ["CLERK_MOBILE_AUTHORIZED_PARTIES"],
+    required: false,
+    secret: false,
+    public: false,
+    description: "Comma-separated Clerk authorized parties for browser and mobile bearer-token validation."
+  },
+  {
+    idSuffix: "clerk.sign-in-url",
+    canonicalName: "NEXT_PUBLIC_CLERK_SIGN_IN_URL",
+    required: false,
+    secret: false,
+    public: true,
+    description: "Tenant Clerk sign-in route for custom app login surfaces."
+  },
+  {
+    idSuffix: "clerk.sign-up-url",
+    canonicalName: "NEXT_PUBLIC_CLERK_SIGN_UP_URL",
+    required: false,
+    secret: false,
+    public: true,
+    description: "Tenant Clerk sign-up route for custom app login surfaces."
+  }
+];
+INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap(
+  (system) => TENANT_SHARED_SECRET_DEFINITION_TEMPLATES.map(
+    (template) => ({
+      id: `tenant.${system.id}.${template.idSuffix}`,
+      canonicalName: template.canonicalName,
+      aliases: "aliases" in template ? template.aliases : void 0,
+      owner: "tenant",
+      scope: "tenant",
+      sourcePath: system.sharedSourcePath,
+      environmentPolicy: "environment_specific",
+      required: template.required,
+      secret: template.secret,
+      public: template.public,
+      consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+      destinations: [
+        {
+          kind: "vercel",
+          target: system.vercelProjectName,
+          environmentPolicy: "preprod_staging_prod_prod"
+        },
+        {
+          kind: "convex",
+          target: `${system.convex.preprodDeployment}|${system.convex.prodDeployment}`,
+          environmentPolicy: "preprod_staging_prod_prod"
+        }
+      ],
+      description: `${system.tenantKey}/${system.workspaceKey}: ${template.description}`
+    })
+  )
+);
+INFISICAL_TENANT_SOFTWARE_SYSTEMS.map(
+  (system) => ({
+    id: `tenant.${system.id}.install-lucern-npm`,
+    canonicalName: "INSTALL_LUCERN_NPM",
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/tenants/shared",
+    environmentPolicy: "same_all_environments",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-deploy-tooling"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: system.vercelProjectName,
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "github_actions",
+        target: `${system.repository.owner}/${system.repository.name}`,
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: `${system.tenantKey}/${system.workspaceKey}: read-only npm install token for published @lucern/* packages.`
+  })
+);
+var TENANT_PRODUCT_SOFTWARE_SYSTEM_IDS = ["stack-frontend", "stackos"];
+var TENANT_PRODUCT_RUNTIME_SECRET_DEFINITION_TEMPLATES = [
+  {
+    idSuffix: "ai.openai-api-key",
+    canonicalName: "OPENAI_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
+    description: "Tenant-owned OpenAI key for product runtime LLM calls."
   },
   {
-    packageName: "@lucern/agent",
-    role: "platform_runtime",
-    directTenantImport: false
+    idSuffix: "ai.anthropic-api-key",
+    canonicalName: "ANTHROPIC_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
+    description: "Tenant-owned Anthropic key for product runtime LLM calls."
   },
   {
-    packageName: "@lucern/auth",
-    role: "sdk_dependency",
-    directTenantImport: false
+    idSuffix: "ai.gemini-api-key",
+    canonicalName: "GEMINI_API_KEY",
+    aliases: ["GOOGLE_AI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"],
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
+    description: "Tenant-owned Google/Gemini key for product runtime LLM calls."
   },
   {
-    packageName: "@lucern/cli",
-    role: "developer_tool",
-    directTenantImport: false
+    idSuffix: "langfuse.secret-key",
+    canonicalName: "LANGFUSE_SECRET_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-observability"
+    ],
+    description: "Tenant-owned Langfuse secret key for product AI tracing."
   },
   {
-    packageName: "@lucern/client-core",
-    role: "sdk_dependency",
-    directTenantImport: false
+    idSuffix: "langfuse.public-key",
+    canonicalName: "LANGFUSE_PUBLIC_KEY",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-observability"
+    ],
+    description: "Tenant-owned Langfuse public key for product AI tracing."
   },
   {
-    packageName: "@lucern/confidence",
-    role: "sdk_dependency",
-    directTenantImport: false
+    idSuffix: "langfuse.base-url",
+    canonicalName: "LANGFUSE_BASE_URL",
+    aliases: ["LANGFUSE_BASEURL", "LANGFUSE_HOST"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-observability"
+    ],
+    description: "Tenant-owned Langfuse API origin."
   },
   {
-    packageName: "@lucern/config",
-    role: "configuration",
-    directTenantImport: false
+    idSuffix: "graph.neo4j-uri",
+    canonicalName: "NEO4J_URI",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j URI for product graph-sync."
   },
   {
-    packageName: "@lucern/contracts",
-    role: "contract_entrypoint",
-    directTenantImport: true
+    idSuffix: "graph.neo4j-user",
+    canonicalName: "NEO4J_USER",
+    aliases: ["NEO4J_USERNAME"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j user for product graph-sync."
   },
   {
-    packageName: "@lucern/control-plane",
-    role: "platform_runtime",
-    directTenantImport: false
+    idSuffix: "graph.neo4j-password",
+    canonicalName: "NEO4J_PASSWORD",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j password for product graph-sync."
   },
   {
-    packageName: "@lucern/developer-kit",
-    role: "developer_tool",
-    directTenantImport: false
+    idSuffix: "graph.neo4j-sync-secret",
+    canonicalName: "NEO4J_SYNC_SECRET",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned shared secret for product Convex-to-HTTP graph-sync calls."
   },
   {
-    packageName: "@lucern/events",
-    role: "sdk_dependency",
-    directTenantImport: false
+    idSuffix: "graph.neo4j-database",
+    canonicalName: "NEO4J_DATABASE",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j database name for product graph-sync."
   },
   {
-    packageName: "@lucern/graph-primitives",
-    role: "sdk_dependency",
-    directTenantImport: false
+    idSuffix: "vector.pinecone-api-key",
+    canonicalName: "PINECONE_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone API key for product vector search."
   },
   {
-    packageName: "@lucern/graph-sync",
-    role: "host_addon_runtime",
-    directTenantImport: true
+    idSuffix: "vector.pinecone-index-name",
+    canonicalName: "PINECONE_INDEX_NAME",
+    aliases: ["PINECONE_INDEX"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone index name for product vector search."
   },
   {
-    packageName: "@lucern/identity",
-    role: "component_runtime",
-    directTenantImport: false
+    idSuffix: "vector.pinecone-host",
+    canonicalName: "PINECONE_HOST",
+    aliases: ["PINECONE_INDEX_HOST"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone host for product vector search."
   },
   {
-    packageName: "@lucern/mcp",
-    role: "runtime_entrypoint",
-    directTenantImport: true
+    idSuffix: "vector.pinecone-namespace",
+    canonicalName: "PINECONE_NAMESPACE",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone namespace for product vector search isolation."
   },
   {
-    packageName: "@lucern/pack-host",
-    role: "platform_runtime",
-    directTenantImport: false
+    idSuffix: "storage.aws-access-key-id",
+    canonicalName: "AWS_ACCESS_KEY_ID",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+    description: "Tenant-owned AWS access key id for document/file ingestion."
   },
   {
-    packageName: "@lucern/pack-installer",
-    role: "developer_tool",
-    directTenantImport: false
+    idSuffix: "storage.aws-secret-access-key",
+    canonicalName: "AWS_SECRET_ACCESS_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+    description: "Tenant-owned AWS secret access key for document/file ingestion."
   },
   {
-    packageName: "@lucern/proof-compiler",
-    role: "developer_tool",
-    directTenantImport: false
+    idSuffix: "storage.aws-region",
+    canonicalName: "AWS_REGION",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+    description: "Tenant-owned AWS region for document/file ingestion."
   },
   {
-    packageName: "@lucern/react",
-    role: "runtime_entrypoint",
-    directTenantImport: true
+    idSuffix: "observability.sentry-dsn",
+    canonicalName: "NEXT_PUBLIC_SENTRY_DSN",
+    aliases: ["NEXT_PUBLIC_SENTRY_DSN_NEXTJS", "SENTRY_DSN"],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned Sentry DSN for app telemetry."
   },
   {
-    packageName: "@lucern/reasoning-kernel",
-    role: "component_runtime",
-    directTenantImport: false
+    idSuffix: "observability.sentry-auth-token",
+    canonicalName: "SENTRY_AUTH_TOKEN",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-deploy-tooling", "tenant-observability"],
+    description: "Tenant-owned Sentry release token for app deployments."
   },
   {
-    packageName: "@lucern/sdk",
-    role: "runtime_entrypoint",
-    directTenantImport: true
+    idSuffix: "observability.sentry-org",
+    canonicalName: "SENTRY_ORG",
+    aliases: ["SENTRY_ORG_SLUG"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-deploy-tooling", "tenant-observability"],
+    description: "Tenant-owned Sentry org slug for release uploads."
   },
   {
-    packageName: "@lucern/server-core",
-    role: "platform_runtime",
-    directTenantImport: false
+    idSuffix: "observability.sentry-project",
+    canonicalName: "SENTRY_PROJECT",
+    aliases: ["SENTRY_PROJECT_NEXTJS"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-deploy-tooling", "tenant-observability"],
+    description: "Tenant-owned Sentry project slug for release uploads."
   },
   {
-    packageName: "@lucern/testing",
-    role: "test_support",
-    directTenantImport: false
+    idSuffix: "observability.sentry-environment",
+    canonicalName: "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+    aliases: ["SENTRY_ENVIRONMENT"],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned Sentry environment label."
   },
   {
-    packageName: "@lucern/types",
-    role: "contract_entrypoint",
-    directTenantImport: true
+    idSuffix: "observability.sentry-release",
+    canonicalName: "NEXT_PUBLIC_SENTRY_RELEASE",
+    aliases: ["SENTRY_RELEASE"],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned Sentry release label."
+  },
+  {
+    idSuffix: "observability.sentry-client-options",
+    canonicalName: "NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE",
+    aliases: [
+      "NEXT_PUBLIC_SENTRY_CAPTURE_CONSOLE_LEVELS",
+      "NEXT_PUBLIC_SENTRY_CAPTURE_CONSOLE_LEVELS_NEXTJS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_BREADCRUMB_LEVELS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_BREADCRUMB_LEVELS_NEXTJS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_LOG_LEVELS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_LOG_LEVELS_NEXTJS",
+      "NEXT_PUBLIC_SENTRY_ENABLE_LOGS",
+      "NEXT_PUBLIC_SENTRY_REPLAYS_ON_ERROR_SAMPLE_RATE",
+      "NEXT_PUBLIC_SENTRY_REPLAYS_SESSION_SAMPLE_RATE",
+      "NEXT_PUBLIC_SENTRY_SEND_DEFAULT_PII",
+      "NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE_NEXTJS"
+    ],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned public Sentry tuning values for Next.js client instrumentation."
+  },
+  {
+    idSuffix: "observability.sentry-webhook-secret",
+    canonicalName: "SENTRY_WEBHOOK_SECRET",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-convex-deployment", "tenant-observability"],
+    description: "Tenant-owned Sentry webhook verification secret."
+  },
+  {
+    idSuffix: "lucern.gateway-api-key",
+    canonicalName: "LUCERN_API_KEY",
+    aliases: ["STACK_API_KEY"],
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Tenant-scoped Lucern/MC gateway API key for product front-door calls."
+  },
+  {
+    idSuffix: "lucern.gateway-base-url",
+    canonicalName: "LUCERN_BASE_URL",
+    aliases: ["LUCERN_API_BASE_URL", "LUCERN_GATEWAY_BASE_URL"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Lucern/MC gateway base URL used by tenant product apps."
+  },
+  {
+    idSuffix: "lucern.proxy-token-secret",
+    canonicalName: "LUCERN_PROXY_TOKEN_SECRET",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Tenant-owned secret for signing internal proxy/session tokens in product apps."
+  },
+  {
+    idSuffix: "tenant.integrations.linear-api-key",
+    canonicalName: "LINEAR_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Tenant-owned Linear API key for support/slash-command flows."
+  },
+  {
+    idSuffix: "tenant.vercel.bypass-token",
+    canonicalName: "VERCEL_AUTOMATION_BYPASS_SECRET",
+    aliases: ["NEXT_PUBLIC_VERCEL_BYPASS_TOKEN"],
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-deploy-tooling"],
+    description: "Tenant-owned Vercel automation bypass token. Public alias is legacy and should be removed from app code."
   }
 ];
-TENANT_CLIENT_INSTALLABLE_PACKAGES.map(
-  (entry) => entry.packageName
+INFISICAL_TENANT_SOFTWARE_SYSTEMS.filter(
+  (system) => TENANT_PRODUCT_SOFTWARE_SYSTEM_IDS.includes(system.id)
+).flatMap(
+  (system) => TENANT_PRODUCT_RUNTIME_SECRET_DEFINITION_TEMPLATES.map(
+    (template) => ({
+      id: `tenant.${system.id}.${template.idSuffix}`,
+      canonicalName: template.canonicalName,
+      aliases: "aliases" in template ? template.aliases : void 0,
+      owner: "tenant",
+      scope: "tenant",
+      sourcePath: system.sharedSourcePath,
+      environmentPolicy: "environment_specific",
+      required: template.required,
+      secret: template.secret,
+      public: template.public,
+      consumers: template.consumers,
+      destinations: [
+        {
+          kind: "vercel",
+          target: system.vercelProjectName,
+          environmentPolicy: "preprod_staging_prod_prod"
+        },
+        {
+          kind: "convex",
+          target: `${system.convex.preprodDeployment}|${system.convex.prodDeployment}`,
+          environmentPolicy: "preprod_staging_prod_prod"
+        },
+        {
+          kind: "github_actions",
+          target: `${system.repository.owner}/${system.repository.name}`,
+          environmentPolicy: "preprod_staging_prod_prod"
+        }
+      ],
+      description: `${system.tenantKey}/${system.workspaceKey}: ${template.description}`
+    })
+  )
+);
+function tenantVercelConvexUrlWriteNames(system) {
+  const names = [system.convex.urlEnv, "NEXT_PUBLIC_CONVEX_URL"];
+  if (system.id === "stack-eng") {
+    return [...names, "STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
+  }
+  return names;
+}
+function tenantRepositoryConvexUrlWriteNames(system) {
+  if (system.id === "stack-eng") {
+    return [system.convex.urlEnv, "STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
+  }
+  return [system.convex.urlEnv];
+}
+function tenantRepositoryConvexDeployKeyWriteNames(system) {
+  if (system.id === "stack-eng") {
+    return [system.convex.deployKeyEnv, "STACKOS_ENGINEERING_GRAPH_DEPLOY_KEY"];
+  }
+  return [system.convex.deployKeyEnv];
+}
+function tenantConvexUrlAliases(system) {
+  if (system.id === "stack-frontend") {
+    return [
+      "CONVEX_PROD_URL",
+      "CONVEX_STACK_V2_PROD_URL",
+      "CONVEX_STACK_V2_STAGING_URL",
+      "STACK_CONVEX_URL"
+    ];
+  }
+  if (system.id === "stackos") {
+    return [
+      "CONVEX_CLOUD_URL",
+      "CONVEX_STACK_URL",
+      "CONVEX_URL",
+      "CONVEX_URL_DEVELOPMENT",
+      "CONVEX_URL_PRODUCTION",
+      "STACK_CONVEX_URL"
+    ];
+  }
+  if (system.id === "stack-eng") {
+    return ["STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
+  }
+  if (system.id === "lucern-graph") {
+    return [
+      "CONVEX_GRAPH_URL",
+      "LUCERN_PROD_URL",
+      "NEXT_PUBLIC_LUCERN_GRAPH_URL"
+    ];
+  }
+  return void 0;
+}
+function tenantConvexDeployKeyAliases(system) {
+  if (system.id === "stack-frontend") {
+    return [
+      "CONVEX_STACK_V2_PROD_DEPLOY_KEY",
+      "CONVEX_STACK_V2_STAGING_DEPLOY_KEY",
+      "STACK_DEPLOY_KEY"
+    ];
+  }
+  if (system.id === "stackos") {
+    return [
+      "CONVEX_DEPLOY_KEY",
+      "CONVEX_DEV_DEPLOY_KEY",
+      "CONVEX_PROD_DEPLOY_KEY",
+      "CONVEX_STACK_DEPLOY_KEY",
+      "STACK_DEPLOY_KEY"
+    ];
+  }
+  if (system.id === "stack-eng") {
+    return ["CONVEX_DEPLOY_KEY", "STACKOS_ENGINEERING_GRAPH_DEPLOY_KEY"];
+  }
+  if (system.id === "lucern-graph") {
+    return [
+      "CONVEX_DEPLOY_KEY",
+      "CONVEX_GRAPH_DEPLOY_KEY",
+      "LUCERN_CONVEX_DEPLOY_KEY",
+      "LUCERN_DEV_DEPLOY_KEY",
+      "LUCERN_PROD_DEPLOY_KEY"
+    ];
+  }
+  return void 0;
+}
+INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap(
+  (system) => {
+    if (system.id === "lucern-graph") {
+      return [
+        {
+          id: "tenant.lucern-graph.public.tenant-id",
+          canonicalName: "NEXT_PUBLIC_LUCERN_GRAPH_TENANT_ID",
+          aliases: ["NEXT_PUBLIC_LUCERN_TENANT_ID"],
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Lucern graph public tenant id used by the standalone graph explorer."
+        },
+        {
+          id: "tenant.lucern-graph.public.tenant-label",
+          canonicalName: "NEXT_PUBLIC_LUCERN_GRAPH_TENANT_LABEL",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Lucern graph public tenant label used by the standalone graph explorer."
+        }
+      ];
+    }
+    if (system.id === "stack-eng") {
+      return [
+        {
+          id: "tenant.stack-eng.public.tenant-id",
+          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_TENANT_ID",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Stack engineering graph public tenant id used by the graph explorer."
+        },
+        {
+          id: "tenant.stack-eng.public.tenant-label",
+          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_TENANT_LABEL",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Stack engineering graph public tenant label used by the graph explorer."
+        },
+        {
+          id: "tenant.stack-eng.public.environment",
+          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_ENV",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Stack engineering graph public environment label used by the graph explorer."
+        }
+      ];
+    }
+    return [];
+  }
 );
+INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap((system) => [
+  {
+    id: `tenant.${system.id}.convex.url`,
+    canonicalName: system.convex.urlEnv,
+    aliases: tenantConvexUrlAliases(system),
+    owner: "tenant",
+    scope: "software_system",
+    sourcePath: system.sharedSourcePath,
+    environmentPolicy: "preprod_staging_prod_prod",
+    required: true,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-agent-runtime",
+      "mc-operator-tooling"
+    ],
+    destinations: [
+      {
+        kind: "vercel",
+        target: system.vercelProjectName,
+        environmentPolicy: "preprod_staging_prod_prod",
+        writeNames: tenantVercelConvexUrlWriteNames(system)
+      },
+      {
+        kind: "github_actions",
+        target: `${system.repository.owner}/${system.repository.name}`,
+        environmentPolicy: "preprod_staging_prod_prod",
+        writeNames: tenantRepositoryConvexUrlWriteNames(system),
+        notes: "Only if that repository deploy/test workflow owns this software system."
+      }
+    ],
+    description: `${system.tenantKey}/${system.workspaceKey} Convex URL. Pre-prod resolves to ${system.convex.preprodDeployment}; prod resolves to ${system.convex.prodDeployment}.`
+  },
+  {
+    id: `tenant.${system.id}.convex.deploy-key`,
+    canonicalName: system.convex.deployKeyEnv,
+    aliases: tenantConvexDeployKeyAliases(system),
+    owner: "tenant",
+    scope: "software_system",
+    sourcePath: system.sharedSourcePath,
+    environmentPolicy: "preprod_staging_prod_prod",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-agent-runtime",
+      "mc-operator-tooling"
+    ],
+    destinations: [
+      {
+        kind: "vercel",
+        target: system.vercelProjectName,
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "github_actions",
+        target: `${system.repository.owner}/${system.repository.name}`,
+        environmentPolicy: "preprod_staging_prod_prod",
+        writeNames: tenantRepositoryConvexDeployKeyWriteNames(system),
+        notes: "Only if that repository deploy/test workflow owns this software system."
+      }
+    ],
+    description: `${system.tenantKey}/${system.workspaceKey} Convex deploy/admin key. Never route to sibling workspaces.`
+  }
+]);
 z.object({
   manifestVersion: z.literal("1.0.0"),
   rules: z.array(
@@ -4937,7 +6748,7 @@ var createEvidenceInputSchemaBase = z.object({
   targetId: z.string().optional(),
   targetNodeId: z.string().optional(),
   linkedBeliefNodeId: z.string().optional(),
-  evidenceRelation: z.enum(["supports", "contradicts", "neutral"]).optional(),
+  evidenceRelation: z.enum(["supports", "contradicts"]).optional(),
   confidence: z.number().optional(),
   weight: z.number().optional(),
   reasoning: z.string().optional(),
@@ -5022,8 +6833,7 @@ var createEvidenceProjection = defineProjection({
     evidenceRelation: v.optional(
       v.union(
         v.literal("supports"),
-        v.literal("contradicts"),
-        v.literal("neutral")
+        v.literal("contradicts")
       )
     ),
     confidence: v.optional(v.number()),
@@ -5072,12 +6882,17 @@ var listBeliefsProjection = defineProjection({
 });
 var taskStatusSchema = z.enum(["todo", "in_progress", "blocked", "done"]).optional().describe("Filter by task status");
 var listTasksInputSchema = z.object({
-  topicId: z.string().describe("Topic scope"),
+  topicId: z.string().optional().describe("Topic scope"),
   worktreeId: z.string().optional().describe("Alias for linkedWorktreeId"),
   linkedWorktreeId: z.string().optional().describe("Filter to tasks linked to this worktree"),
   status: taskStatusSchema,
   limit: z.number().optional().describe("Maximum results")
-});
+}).refine(
+  (input) => Boolean(input.topicId || input.worktreeId || input.linkedWorktreeId),
+  {
+    message: "topicId or worktreeId is required"
+  }
+);
 function compactRecord3(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, value]) => value !== void 0)
@@ -5094,7 +6909,7 @@ var listTasksProjection = defineProjection({
     linkedWorktreeId: input.linkedWorktreeId ?? input.worktreeId
   }),
   convexArgsValidator: v.object({
-    topicId: v.string(),
+    topicId: v.optional(v.string()),
     status: v.optional(
       v.union(
         v.literal("todo"),
@@ -6098,7 +7913,7 @@ var CREATE_EDGE = {
     reasoningMethod: {
       type: "string",
       description: "How this was determined",
-      enum: ["deductive", "inductive", "abductive", "analogical", "empirical"]
+      enum: [...REASONING_METHODS]
     },
     metadata: {
       type: "object",
@@ -7825,6 +9640,10 @@ var CREATE_TASK = {
     tags: {
       type: "array",
       description: "Free-form string tags"
+    },
+    metadata: {
+      type: "object",
+      description: "Structured task metadata for handoff context and routing hints"
     }
   },
   required: ["title"],
@@ -7898,6 +9717,10 @@ var UPDATE_TASK = {
       type: "string",
       description: "Updated status",
       enum: ["todo", "in_progress", "blocked", "done"]
+    },
+    metadata: {
+      type: "object",
+      description: "Structured task metadata to replace or refine"
     }
   },
   required: ["taskId"],
@@ -9353,6 +11176,9 @@ var BEGIN_BUILD_SESSION = {
       sessionMode: "string \u2014 async | interactive",
       targetBeliefIds: "array \u2014 scoped belief IDs",
       targetQuestionIds: "array \u2014 scoped question IDs",
+      taskIds: "array \u2014 assigned task IDs for this worktree",
+      incompleteTaskIds: "array \u2014 assigned task IDs that still require done/deferred/blocked proof",
+      tasks: "array \u2014 assigned task packet with id, title, status, priority, links, and summaries",
       topBeliefs: "array \u2014 highest-confidence scoped beliefs",
       openQuestions: "array \u2014 open scoped questions",
       resolvedDecisions: "array \u2014 answered questions summarized for the session",
@@ -9953,12 +11779,20 @@ function unwrapMcpParameterSchema(schema) {
         current = current._def.schema;
         continue;
       default:
-        return { schema: current, required, description: description ?? current.description };
+        return {
+          schema: current,
+          required,
+          description: description ?? current.description
+        };
     }
   }
 }
 function mcpParameterFromZod(fieldName, schema, contractName) {
-  const { schema: unwrapped, required, description: schemaDescription } = unwrapMcpParameterSchema(schema);
+  const {
+    schema: unwrapped,
+    required,
+    description: schemaDescription
+  } = unwrapMcpParameterSchema(schema);
   const description = schemaDescription ?? unwrapped.description ?? fieldName;
   switch (unwrapped._def.typeName) {
     case z.ZodFirstPartyTypeKind.ZodString:
@@ -10003,10 +11837,12 @@ function mcpContractFromArgsSchema(base, args, contractName) {
   const entries2 = Object.entries(getObjectShape(args)).sort(
     ([left], [right]) => left.localeCompare(right)
   );
-  const converted = entries2.map(([fieldName, schema]) => [
-    fieldName,
-    mcpParameterFromZod(fieldName, schema, contractName)
-  ]);
+  const converted = entries2.map(
+    ([fieldName, schema]) => [
+      fieldName,
+      mcpParameterFromZod(fieldName, schema, contractName)
+    ]
+  );
   return {
     ...base,
     parameters: Object.fromEntries(
@@ -10118,6 +11954,7 @@ function surfaceContract(args) {
       allowedPrincipalTypes: ["user", "service", "agent"]
     },
     convex: args.convex,
+    gateway: args.gateway,
     args: canonicalArgs,
     returns: canonicalReturns,
     input,
@@ -10604,7 +12441,7 @@ var beliefsContracts = [
   })
 ];
 var jsonRecordSchema4 = z.record(z.unknown());
-var evidenceRelationSchema = z.enum(["supports", "contradicts", "neutral"]);
+var evidenceRelationSchema = z.enum(["supports", "contradicts"]);
 var createEvidenceArgs = z.object({
   topicId: z.string().optional().describe("Topic scope for the evidence."),
   text: z.string().describe("Canonical evidence text."),
@@ -12527,7 +14364,8 @@ var createTaskArgs = z.object({
   linkedQuestionId: z.string().optional().describe("Question this task addresses."),
   assigneeId: z.string().optional().describe("Principal assigned to the task."),
   dueDate: z.number().optional().describe("Due date as epoch milliseconds."),
-  tags: z.array(z.string()).optional().describe("Free-form tags.")
+  tags: z.array(z.string()).optional().describe("Free-form tags."),
+  metadata: z.record(z.unknown()).optional().describe("Structured task metadata for handoff context and routing hints.")
 });
 var createTaskInput = (input) => compactRecord4({
   title: input.title,
@@ -12541,7 +14379,8 @@ var createTaskInput = (input) => compactRecord4({
   linkedQuestionId: input.linkedQuestionId,
   assigneeId: input.assigneeId,
   dueDate: input.dueDate,
-  tags: input.tags
+  tags: input.tags,
+  metadata: input.metadata
 });
 var taskInput = (input) => compactRecord4({
   ...input,
@@ -12558,8 +14397,7 @@ var taskTopicInput = (input) => {
 };
 var completeTaskInput = (input) => compactRecord4({
   taskId: input.taskId ?? input.id,
-  outputSummary: input.outputSummary ?? input.summary,
-  userId: input.userId
+  outputSummary: input.outputSummary ?? input.summary
 });
 var tasksContracts = [
   surfaceContract({
@@ -12577,6 +14415,7 @@ var tasksContracts = [
       kind: "mutation",
       inputProjection: createTaskInput
     },
+    gateway: { handler: "tasks.create" },
     args: createTaskArgs
   }),
   surfaceContract({
@@ -12595,6 +14434,7 @@ var tasksContracts = [
       kind: "query",
       inputProjection: taskTopicInput
     },
+    gateway: { handler: "tasks.list" },
     args: listTasksInputSchema
   }),
   surfaceContract({
@@ -12612,7 +14452,8 @@ var tasksContracts = [
       functionName: "update",
       kind: "mutation",
       inputProjection: taskInput
-    }
+    },
+    gateway: { handler: "tasks.update" }
   }),
   surfaceContract({
     name: "complete_task",
@@ -12628,12 +14469,14 @@ var tasksContracts = [
       functionName: "complete",
       kind: "mutation",
       inputProjection: completeTaskInput
-    }
+    },
+    gateway: { handler: "tasks.complete" }
   })
 ];
 var CREATE_EDGE_TYPES = edgePolicyManifest.policies.map(
   (policy) => policy.edgeType
 );
+var REASONING_METHOD_TYPES = [...REASONING_METHODS];
 var createEdgeArgs = z.object({
   from: GraphRefSchema,
   to: GraphRefSchema,
@@ -12643,6 +14486,7 @@ var createEdgeArgs = z.object({
   confidence: z.number().optional(),
   context: z.string().optional(),
   reasoning: z.string().optional(),
+  reasoningMethod: z.enum(REASONING_METHOD_TYPES).optional(),
   derivationType: z.string().optional(),
   metadata: z.record(z.unknown()).optional(),
   topicId: z.string().optional(),
@@ -12721,6 +14565,7 @@ var edgesContracts = [
             weight: parsed.weight,
             confidence: parsed.confidence,
             context: parsed.context ?? parsed.reasoning,
+            reasoningMethod: parsed.reasoningMethod,
             derivationType: parsed.derivationType,
             metadata: parsed.metadata,
             skipLayerValidation: true,
@@ -12845,6 +14690,7 @@ var edgesContracts = [
                 weight: edge.weight,
                 confidence: edge.confidence,
                 context: edge.context ?? edge.reasoning,
+                reasoningMethod: edge.reasoningMethod,
                 derivationType: edge.derivationType,
                 metadata: edge.metadata,
                 topicId: edge.topicId
@@ -13579,6 +15425,69 @@ var pipelineContracts = [
     }
   })
 ];
+function isRecord3(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function stringValues(value) {
+  if (typeof value === "string") {
+    return [value];
+  }
+  if (Array.isArray(value)) {
+    return value.flatMap((item) => stringValues(item));
+  }
+  return [];
+}
+function nestedEvidenceRows(value) {
+  if (Array.isArray(value)) {
+    return value.flatMap((item) => nestedEvidenceRows(item));
+  }
+  if (!isRecord3(value)) {
+    return [];
+  }
+  const nestedKeys = ["evidence", "items", "nodes"];
+  const nestedRows = nestedKeys.flatMap((key) => nestedEvidenceRows(value[key]));
+  return nestedRows.length > 0 ? nestedRows : [value];
+}
+function isFailedAttemptRow(row) {
+  const metadata = isRecord3(row.metadata) ? row.metadata : null;
+  return metadata?.failedApproach === true || metadata?.isFailedAttempt === true;
+}
+function failureLogSearchFields(row) {
+  const metadata = isRecord3(row.metadata) ? row.metadata : null;
+  return [
+    ...stringValues(row.id),
+    ...stringValues(row._id),
+    ...stringValues(row.title),
+    ...stringValues(row.text),
+    ...stringValues(row.canonicalText),
+    ...stringValues(row.content),
+    ...stringValues(metadata?.codeAnchor),
+    ...stringValues(metadata?.codeAnchors),
+    ...stringValues(metadata?.anchor),
+    ...stringValues(metadata?.anchors),
+    ...stringValues(metadata?.filePath),
+    ...stringValues(metadata?.filePaths),
+    ...stringValues(metadata?.path),
+    ...stringValues(metadata?.paths),
+    ...stringValues(metadata?.sourceRef),
+    ...stringValues(metadata?.touchedPaths)
+  ];
+}
+function projectFailureLog(output, input) {
+  const rawQuery = typeof input.query === "string" && input.query.trim().length > 0 ? input.query.trim() : void 0;
+  const searchKey = rawQuery?.toLowerCase();
+  const failures = nestedEvidenceRows(output).filter((row) => isFailedAttemptRow(row)).filter(
+    (row) => !searchKey ? true : failureLogSearchFields(row).some(
+      (field) => field.toLowerCase().includes(searchKey)
+    )
+  );
+  return {
+    query: rawQuery,
+    failures,
+    totalFound: failures.length,
+    showing: failures.length
+  };
+}
 var recordScopeLearningArgs = z.object({
   topicId: z.string().optional().describe("Topic scope ID"),
   summary: z.string().describe("Atomic learning statement"),
@@ -13668,6 +15577,8 @@ var attemptInput = (input, context) => withUserId(
     tags: ["code_attempt"],
     metadata: compactRecord4({
       ...recordValue2(input.metadata),
+      failedApproach: true,
+      isFailedAttempt: true,
       filePaths: input.filePaths,
       filePath: input.filePath,
       errorMessage: input.errorMessage,
@@ -13798,7 +15709,8 @@ var codingContracts = [
         limit: input.limit,
         status: input.status,
         userId: input.userId
-      })
+      }),
+      outputProjection: (output, input) => projectFailureLog(output, input)
     }
   })
 ];
@@ -14260,14 +16172,14 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Worktrees are tenant/runtime planning data."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "agents",
     prepopulation: "runtime_bootstrap",
     copyMode: "none",
     description: "Service agents are provisioned per tenant or service, not copied."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "mcpWritePolicy",
     prepopulation: "required_template",
     copyMode: "template_global",
@@ -14276,14 +16188,14 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Global write policy defaults govern service and interactive MCP writes."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "modelCallLogs",
     prepopulation: "runtime_log",
     copyMode: "none",
     description: "Model call logs are runtime telemetry."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "modelFunctionSlots",
     prepopulation: "required_template",
     copyMode: "template_global",
@@ -14292,7 +16204,7 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Function-to-model slots are required by model runtime resolution."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "modelRegistry",
     prepopulation: "required_template",
     copyMode: "template_global",
@@ -14301,7 +16213,7 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Model catalog defaults are required by model runtime clients."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "modelSlotConfigs",
     prepopulation: "required_template",
     copyMode: "template_global",
@@ -14310,14 +16222,105 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Slot-level defaults are required before tenant overrides exist."
   },
   {
-    component: "identity",
+    component: "control-plane",
+    table: "permitAccessReviewItems",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit access-review item rows are tenant review data projected from Permit."
+  },
+  {
+    component: "control-plane",
+    table: "permitAccessReviews",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit access-review campaigns are tenant review data projected from Permit."
+  },
+  {
+    component: "control-plane",
+    table: "permitAttributeBindings",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit ABAC attribute bindings are tenant policy projection rows."
+  },
+  {
+    component: "control-plane",
+    table: "permitGroups",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit groups are tenant-defined policy subjects, not template data."
+  },
+  {
+    component: "control-plane",
+    table: "permitGroupMemberships",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit group memberships are tenant-specific policy projection rows."
+  },
+  {
+    component: "control-plane",
+    table: "permitPolicyBundles",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Permit policy bundles are derived from the Permit control plane."
+  },
+  {
+    component: "control-plane",
+    table: "permitPolicyDecisionReceipts",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Permit decision receipts are runtime authorization audit logs."
+  },
+  {
+    component: "control-plane",
+    table: "permitPrincipalAliases",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit principal aliases are tenant-specific identity projection rows."
+  },
+  {
+    component: "control-plane",
+    table: "permitPrincipals",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit principals are projected from Clerk, Permit, and tenant onboarding flows."
+  },
+  {
+    component: "control-plane",
+    table: "permitProjectionOutbox",
+    prepopulation: "runtime_queue",
+    copyMode: "none",
+    description: "Permit projection outbox rows are runtime sync queue data."
+  },
+  {
+    component: "control-plane",
+    table: "permitRelationshipTuples",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit ReBAC relationship tuples are tenant policy projection rows."
+  },
+  {
+    component: "control-plane",
+    table: "permitResourceInstances",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit resource instances are tenant/workspace graph and deployment projection rows."
+  },
+  {
+    component: "control-plane",
+    table: "permitRoleAssignments",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit role assignments are tenant-specific policy projection rows."
+  },
+  {
+    component: "control-plane",
     table: "platformAudienceGrants",
     prepopulation: "runtime_data",
     copyMode: "none",
     description: "Audience grants are principal/group-specific access rows."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "platformAudiences",
     prepopulation: "required_template",
     copyMode: "template_tenant_rewrite",
@@ -14326,35 +16329,35 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Default tenant audience taxonomy rows are rewritten into each tenant."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "platformPolicyDecisionLogs",
     prepopulation: "runtime_log",
     copyMode: "none",
     description: "Policy decisions are runtime audit logs."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "projectGrants",
     prepopulation: "runtime_data",
     copyMode: "none",
     description: "Project/topic grants are principal or group-specific access rows."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "reasoningPermissions",
     prepopulation: "runtime_data",
     copyMode: "none",
     description: "Reasoning permissions are principal-specific policy rows."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantApiKeys",
     prepopulation: "runtime_secret",
     copyMode: "none",
     description: "API keys are tenant credentials and must never be copied."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantConfig",
     prepopulation: "required_template",
     copyMode: "template_tenant_rewrite",
@@ -14363,7 +16366,7 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Tenant-local config defaults are rewritten during bootstrap."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantIntegrations",
     prepopulation: "required_template",
     copyMode: "template_tenant_rewrite",
@@ -14372,14 +16375,21 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Non-secret integration descriptors are rewritten into each tenant."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantModelSlotBindings",
     prepopulation: "runtime_secret",
     copyMode: "none",
     description: "Tenant model slot bindings reference provider secrets and are runtime-only."
   },
   {
-    component: "identity",
+    component: "control-plane",
+    table: "tenantPermitSyncStates",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Tenant Permit sync state rows are runtime reconciliation state."
+  },
+  {
+    component: "control-plane",
     table: "tenantPolicies",
     prepopulation: "required_template",
     copyMode: "template_tenant_rewrite",
@@ -14388,42 +16398,42 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Default tenant policy roles are rewritten during bootstrap."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantProviderSecrets",
     prepopulation: "runtime_secret",
     copyMode: "none",
     description: "Provider secrets are credentials and must never be copied."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantProxyGatewayUsage",
     prepopulation: "runtime_log",
     copyMode: "none",
     description: "Proxy gateway usage rows are runtime telemetry."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantProxyTokenMints",
     prepopulation: "runtime_secret",
     copyMode: "none",
     description: "Proxy token mints are ephemeral secret-bearing runtime rows."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantSandboxAuditEvents",
     prepopulation: "runtime_log",
     copyMode: "none",
     description: "Sandbox audit rows are runtime security logs."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantSecrets",
     prepopulation: "runtime_secret",
     copyMode: "none",
     description: "Tenant secrets are credentials and must never be copied."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "toolAcls",
     prepopulation: "required_template",
     copyMode: "template_global",
@@ -14432,7 +16442,7 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Default role-to-tool grants are required for SDK/MCP tool access."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "toolRegistry",
     prepopulation: "required_template",
     copyMode: "template_global",
@@ -14441,7 +16451,7 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Core tool catalog rows are required before pack or tenant tools exist."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "users",
     prepopulation: "runtime_bootstrap",
     copyMode: "none",