@lucern/events 0.3.0-alpha.9 → 1.0.0

package/dist/webhooks.js

@@ -1,6 +1,20 @@
 import { z } from 'zod';
 import { v } from 'convex/values';
 
+// ../contracts/src/types/reasoning-method.ts
+var REASONING_METHODS = [
+  "deductive",
+  "inductive",
+  "abductive",
+  "analogical",
+  "causal",
+  "correlational",
+  "testimonial",
+  "statistical",
+  "implicit",
+  "pattern_match"
+];
+
 // ../contracts/src/graph-intelligence.contract.ts
 var GRAPH_INTELLIGENCE_MODE_TOOL_NAMES = {
   core: [
@@ -692,7 +706,7 @@ defineTable({
 });
 defineTable({
   name: "agents",
-  component: "identity",
+  component: "control-plane",
   category: "agent",
   shape: z.object({
     "slug": z.string(),
@@ -723,6 +737,8 @@ defineTable({
   category: "tenant",
   shape: z.object({
     "tenantId": idOf("tenants"),
+    "workspaceId": idOf("workspaces").optional(),
+    "environment": z.enum(["dev", "staging", "prod"]).optional(),
     "keyPrefix": z.enum(["luc", "stk"]),
     "keyHash": z.string(),
     "keyHint": z.string(),
@@ -750,7 +766,7 @@ defineTable({
   shape: z.object({
     "tenantId": idOf("tenants").optional(),
     "apiKeyId": idOf("apiKeys").optional(),
-    "action": z.enum(["key_created", "key_revoked", "key_expired", "key_used", "tenant_secret_created", "tenant_secret_rotated", "tenant_secret_revoked", "tenant_slot_binding_upserted", "tenant_slot_binding_revoked", "proxy_token_minted", "proxy_request_recorded", "tenant_created", "tenant_updated", "tenant_suspended", "tenant_archived", "tenant_reactivated", "principal_created", "principal_updated", "principal_suspended", "membership_created", "membership_updated", "membership_revoked", "group_created", "group_updated", "group_deleted", "group_member_added", "group_member_removed", "workspace_created", "workspace_updated", "workspace_archived", "workspace_deployment_set", "workspace_deployment_removed", "service_key_created", "service_key_rotated", "service_key_revoked", "service_key_used", "service_key_auth_failed", "session_created", "session_validated", "session_revoked", "session_cascade_revoked", "session_expired", "sandbox_created", "sandbox_secret_injected", "sandbox_execution_started", "sandbox_execution_completed", "sandbox_limit_violated", "policy_created", "policy_updated", "policy_enforced", "policy_archived", "agent_registered", "agent_updated", "tool_registered", "tool_updated", "pack_entitled", "pack_installed", "pack_enabled", "pack_disabled", "pack_entitlement_revoked", "pack_upgraded", "pack_upgrade_committed", "pack_upgrade_rolled_back", "pack_group_assigned", "pack_group_unassigned", "methodology_pack_created", "methodology_pack_updated", "methodology_pack_assigned", "methodology_pack_removed", "pack_assigned_to_group", "pack_revoked_from_group", "pack_ontology_materialized", "pack_ontology_topic_bound", "cutover_flag_set", "cutover_flag_cleared"]),
+    "action": z.enum(["key_created", "key_revoked", "key_expired", "key_used", "tenant_secret_created", "tenant_secret_rotated", "tenant_secret_revoked", "tenant_slot_binding_upserted", "tenant_slot_binding_revoked", "proxy_token_minted", "proxy_token_lease_issued", "proxy_token_lease_renewed", "proxy_token_lease_revoked", "proxy_request_recorded", "tenant_created", "tenant_updated", "tenant_suspended", "tenant_archived", "tenant_reactivated", "tenant_clerk_organization_linked", "tenant_canonical_identity_repaired", "principal_created", "principal_updated", "principal_suspended", "principal_identity_alias_upserted", "principal_identity_alias_revoked", "membership_created", "membership_updated", "membership_revoked", "group_created", "group_updated", "group_deleted", "group_member_added", "group_member_removed", "workspace_created", "workspace_updated", "workspace_archived", "workspace_deployment_set", "workspace_deployment_removed", "deployment_host_registered", "deployment_host_revoked", "service_key_created", "service_key_rotated", "service_key_revoked", "service_key_used", "service_key_auth_failed", "session_created", "session_validated", "session_revoked", "session_cascade_revoked", "session_expired", "sandbox_created", "sandbox_secret_injected", "sandbox_execution_started", "sandbox_execution_completed", "sandbox_limit_violated", "policy_created", "policy_updated", "policy_enforced", "policy_archived", "permit_sync_enqueued", "permit_sync_succeeded", "permit_sync_failed", "permit_sync_skipped", "agent_registered", "agent_updated", "tool_registered", "tool_updated", "pack_entitled", "pack_installed", "pack_enabled", "pack_disabled", "pack_entitlement_revoked", "pack_upgraded", "pack_upgrade_committed", "pack_upgrade_rolled_back", "pack_group_assigned", "pack_group_unassigned", "methodology_pack_created", "methodology_pack_updated", "methodology_pack_assigned", "methodology_pack_removed", "pack_assigned_to_group", "pack_revoked_from_group", "pack_ontology_materialized", "pack_ontology_topic_bound", "cutover_flag_set", "cutover_flag_cleared"]),
     "actorClerkId": z.string(),
     "details": z.any().optional(),
     "createdAt": z.number()
@@ -974,6 +990,35 @@ defineTable({
     { kind: "index", name: "by_source", columns: ["source"] }
   ]
 });
+defineTable({
+  name: "domainEvents",
+  component: "kernel",
+  category: "events",
+  shape: z.object({
+    "eventId": z.string(),
+    "type": z.string(),
+    "version": z.string(),
+    "timestamp": z.number(),
+    "tenantId": z.string().optional(),
+    "workspaceId": z.string().optional(),
+    "topicId": z.string(),
+    "resourceId": z.string(),
+    "resourceType": z.string(),
+    "actorId": z.string(),
+    "actorType": z.enum(["human", "agent", "service"]),
+    "data": z.record(z.any()),
+    "correlationId": z.string().optional(),
+    "expiresAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_eventId", columns: ["eventId"] },
+    { kind: "index", name: "by_topic_timestamp", columns: ["topicId", "timestamp"] },
+    { kind: "index", name: "by_tenant_workspace_timestamp", columns: ["tenantId", "workspaceId", "timestamp"] },
+    { kind: "index", name: "by_type_timestamp", columns: ["type", "timestamp"] },
+    { kind: "index", name: "by_resource", columns: ["resourceType", "resourceId", "timestamp"] },
+    { kind: "index", name: "by_expiresAt", columns: ["expiresAt"] }
+  ]
+});
 defineTable({
   name: "beliefConfidence",
   component: "kernel",
@@ -1629,29 +1674,37 @@ defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "shimId": z.string(),
-    "gateId": z.string(),
-    "removalDate": z.string(),
-    "removalPriority": z.enum(["P1", "P2", "P3"]),
-    "description": z.string(),
-    "owner": z.string(),
-    "createdAt": z.string(),
-    "status": z.enum(["active", "overdue", "removed"]),
-    "bridgeType": z.enum(["tool", "agent"]),
-    "bridgeTarget": z.object({
-      "type": z.enum(["tool", "agent"]),
-      "legacyPath": z.string(),
-      "harnessPath": z.string()
+    shimId: z.string(),
+    gateId: z.string(),
+    removalDate: z.string(),
+    removalPriority: z.enum(["P1", "P2", "P3"]),
+    description: z.string(),
+    owner: z.string(),
+    createdAt: z.string(),
+    status: z.enum(["active", "overdue", "removed"]),
+    bridgeType: z.enum(["tool", "agent"]),
+    bridgeTarget: z.object({
+      type: z.enum(["tool", "agent"]),
+      legacyPath: z.string(),
+      harnessPath: z.string()
     }),
-    "shimBehavior": z.enum(["passthrough_with_logging", "adapter", "feature_flag_gate"]),
-    "producesLedgerEntries": z.boolean(),
-    "lastAuditedAt": z.number(),
-    "metadata": z.record(z.any()).optional()
+    shimBehavior: z.enum([
+      "passthrough_with_logging",
+      "adapter",
+      "feature_flag_gate"
+    ]),
+    producesLedgerEntries: z.boolean(),
+    lastAuditedAt: z.number(),
+    metadata: z.record(z.any()).optional()
   }),
   indices: [
     { kind: "index", name: "by_shimId", columns: ["shimId"] },
     { kind: "index", name: "by_status", columns: ["status"] },
-    { kind: "index", name: "by_bridgeType_status", columns: ["bridgeType", "status"] }
+    {
+      kind: "index",
+      name: "by_bridgeType_status",
+      columns: ["bridgeType", "status"]
+    }
   ]
 });
 defineTable({
@@ -1659,12 +1712,23 @@ defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "domain": z.enum(["graph", "schema", "identity", "policy", "audit", "admin", "agent", "tool", "prompt", "intelligence"]),
-    "state": z.enum(["legacy", "cutover", "disabled"]),
-    "metadata": z.record(z.any()).optional(),
-    "updatedBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    domain: z.enum([
+      "graph",
+      "schema",
+      "identity",
+      "policy",
+      "audit",
+      "admin",
+      "agent",
+      "tool",
+      "prompt",
+      "intelligence"
+    ]),
+    state: z.enum(["legacy", "cutover", "disabled"]),
+    metadata: z.record(z.any()).optional(),
+    updatedBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_domain", columns: ["domain"] },
@@ -1676,57 +1740,193 @@ defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "credentialRef": z.string(),
-    "tenantId": idOf("tenants"),
-    "target": z.enum(["kernelDeployment", "appDeployment"]),
-    "environment": z.enum(["dev", "staging", "prod"]),
-    "encryptedDeployKey": z.string(),
-    "encryptionVersion": z.string(),
-    "keyFingerprint": z.string(),
-    "keyHint": z.string(),
-    "status": z.enum(["active", "revoked"]),
-    "rotatedFromCredentialRef": z.string().optional(),
-    "revokedAt": z.number().optional(),
-    "revokedBy": z.string().optional(),
-    "lastUsedAt": z.number().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    credentialRef: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    target: z.enum(["kernelDeployment", "appDeployment"]),
+    environment: z.enum(["dev", "staging", "prod"]),
+    encryptedDeployKey: z.string(),
+    encryptionVersion: z.string(),
+    keyFingerprint: z.string(),
+    keyHint: z.string(),
+    status: z.enum(["active", "revoked"]),
+    rotatedFromCredentialRef: z.string().optional(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    lastUsedAt: z.number().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_credentialRef", columns: ["credentialRef"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_tenant_target", columns: ["tenantId", "target"] },
-    { kind: "index", name: "by_tenant_target_environment", columns: ["tenantId", "target", "environment"] },
-    { kind: "index", name: "by_tenant_target_environment_status", columns: ["tenantId", "target", "environment", "status"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    {
+      kind: "index",
+      name: "by_tenant_target",
+      columns: ["tenantId", "target"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_target_environment",
+      columns: ["tenantId", "target", "environment"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_target_environment_status",
+      columns: ["tenantId", "target", "environment", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_workspace_target_environment_status",
+      columns: ["tenantId", "workspaceId", "target", "environment", "status"]
+    },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
+defineTable({
+  name: "permitSyncStates",
+  component: "mc",
+  category: "runtime",
+  shape: z.object({
+    syncKey: z.string(),
+    objectType: z.enum([
+      "resource",
+      "role",
+      "resource_role",
+      "resource_relation",
+      "tenant",
+      "workspace",
+      "principal",
+      "membership",
+      "group",
+      "resource_instance",
+      "relationship_tuple",
+      "role_assignment"
+    ]),
+    objectId: z.string(),
+    tenantId: idOf("tenants").optional(),
+    workspaceId: idOf("workspaces").optional(),
+    principalId: z.string().optional(),
+    permitTenantKey: z.string().optional(),
+    permitResourceType: z.string().optional(),
+    permitResourceKey: z.string().optional(),
+    desiredPayload: z.record(z.any()),
+    lastAppliedPayloadHash: z.string().optional(),
+    status: z.enum(["pending", "synced", "error", "skipped"]),
+    attemptCount: z.number(),
+    lastError: z.string().optional(),
+    nextAttemptAt: z.number().optional(),
+    lastSyncedAt: z.number().optional(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_workspace_status",
+      columns: ["workspaceId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_principal_status",
+      columns: ["principalId", "status"]
+    }
+  ]
+});
+defineTable({
+  name: "secretSyncDriftReports",
+  component: "mc",
+  category: "runtime",
+  shape: z.object({
+    reportId: z.string(),
+    source: z.enum(["infisical_manifest", "manual", "ci"]),
+    generatedAt: z.number(),
+    recordedAt: z.number(),
+    recordedBy: z.string(),
+    status: z.enum([
+      "in_sync",
+      "drift",
+      "exception",
+      "blocked",
+      "not_observed"
+    ]),
+    reportHash: z.string(),
+    manifestHash: z.string().optional(),
+    dryRunReceiptId: z.string().optional(),
+    appliedReceiptId: z.string().optional(),
+    summary: z.object({
+      totalPipelines: z.number(),
+      inSync: z.number(),
+      drift: z.number(),
+      exception: z.number(),
+      blocked: z.number(),
+      notObserved: z.number(),
+      missingKeys: z.number(),
+      valueDriftKeys: z.number(),
+      extraKeys: z.number(),
+      deniedConvexLeakage: z.number(),
+      approvedExceptions: z.number()
+    }),
+    redactedReport: z.record(z.any()),
+    metadata: z.record(z.any()).optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_reportId", columns: ["reportId"] },
+    { kind: "index", name: "by_reportHash", columns: ["reportHash"] },
+    { kind: "index", name: "by_generatedAt", columns: ["generatedAt"] },
+    {
+      kind: "index",
+      name: "by_status_generatedAt",
+      columns: ["status", "generatedAt"]
+    }
+  ]
+});
 defineTable({
   name: "controlPlaneTenantModelSlotBindings",
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "bindingId": z.string(),
-    "tenantId": idOf("tenants"),
-    "providerId": z.string(),
-    "modelSlotId": z.string(),
-    "secretRef": z.string(),
-    "status": z.enum(["active", "revoked"]),
-    "passThroughOnly": z.boolean(),
-    "revokedAt": z.number().optional(),
-    "revokedBy": z.string().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    bindingId: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    environment: z.enum(["dev", "staging", "prod"]).optional(),
+    providerId: z.string(),
+    modelSlotId: z.string(),
+    secretRef: z.string(),
+    status: z.enum(["active", "revoked"]),
+    passThroughOnly: z.boolean(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_bindingId", columns: ["bindingId"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_tenant_slot", columns: ["tenantId", "modelSlotId"] },
-    { kind: "index", name: "by_tenant_provider_slot", columns: ["tenantId", "providerId", "modelSlotId"] },
+    {
+      kind: "index",
+      name: "by_tenant_slot",
+      columns: ["tenantId", "modelSlotId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_provider_slot",
+      columns: ["tenantId", "providerId", "modelSlotId"]
+    },
     { kind: "index", name: "by_secretRef", columns: ["secretRef"] },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
@@ -1736,29 +1936,42 @@ defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "secretRef": z.string(),
-    "tenantId": idOf("tenants"),
-    "providerId": z.string(),
-    "label": z.string().optional(),
-    "encryptedSecret": z.string(),
-    "encryptionVersion": z.string(),
-    "secretFingerprint": z.string(),
-    "keyHint": z.string(),
-    "status": z.enum(["active", "revoked"]),
-    "rotatedFromSecretRef": z.string().optional(),
-    "revokedAt": z.number().optional(),
-    "revokedBy": z.string().optional(),
-    "lastUsedAt": z.number().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    secretRef: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    environment: z.enum(["dev", "staging", "prod"]).optional(),
+    providerId: z.string(),
+    label: z.string().optional(),
+    encryptedSecret: z.string().optional(),
+    infisicalPath: z.string().optional(),
+    infisicalSecretKey: z.string().optional(),
+    infisicalProjectId: z.string().optional(),
+    encryptionVersion: z.string(),
+    secretFingerprint: z.string(),
+    keyHint: z.string(),
+    status: z.enum(["active", "revoked"]),
+    rotatedFromSecretRef: z.string().optional(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    lastUsedAt: z.number().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_secretRef", columns: ["secretRef"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_tenant_provider", columns: ["tenantId", "providerId"] },
-    { kind: "index", name: "by_tenant_provider_status", columns: ["tenantId", "providerId", "status"] },
+    {
+      kind: "index",
+      name: "by_tenant_provider",
+      columns: ["tenantId", "providerId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_provider_status",
+      columns: ["tenantId", "providerId", "status"]
+    },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
@@ -1767,35 +1980,93 @@ defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "usageId": z.string(),
-    "tenantId": idOf("tenants"),
-    "providerId": z.string(),
-    "modelSlotId": z.string(),
-    "secretRef": z.string(),
-    "proxyTokenId": z.string(),
-    "sessionId": z.string(),
-    "principalId": z.string(),
-    "workspaceId": z.string().optional(),
-    "modelId": z.string().optional(),
-    "requestPath": z.string(),
-    "status": z.enum(["success", "error"]),
-    "responseStatus": z.number().optional(),
-    "inputTokens": z.number().optional(),
-    "outputTokens": z.number().optional(),
-    "tokenCount": z.number().optional(),
-    "latencyMs": z.number(),
-    "estimatedCostUsd": z.number().optional(),
-    "failureCode": z.string().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    usageId: z.string(),
+    tenantId: idOf("tenants"),
+    providerId: z.string(),
+    modelSlotId: z.string(),
+    secretRef: z.string(),
+    proxyTokenId: z.string(),
+    sessionId: z.string(),
+    principalId: z.string(),
+    workspaceId: z.string().optional(),
+    modelId: z.string().optional(),
+    requestPath: z.string(),
+    status: z.enum(["success", "error"]),
+    responseStatus: z.number().optional(),
+    inputTokens: z.number().optional(),
+    outputTokens: z.number().optional(),
+    tokenCount: z.number().optional(),
+    latencyMs: z.number(),
+    estimatedCostUsd: z.number().optional(),
+    failureCode: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_usageId", columns: ["usageId"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId", "createdAt"] },
-    { kind: "index", name: "by_tenant_provider", columns: ["tenantId", "providerId", "createdAt"] },
-    { kind: "index", name: "by_proxyTokenId", columns: ["proxyTokenId", "createdAt"] },
-    { kind: "index", name: "by_sessionId", columns: ["sessionId", "createdAt"] }
+    {
+      kind: "index",
+      name: "by_tenant_provider",
+      columns: ["tenantId", "providerId", "createdAt"]
+    },
+    {
+      kind: "index",
+      name: "by_proxyTokenId",
+      columns: ["proxyTokenId", "createdAt"]
+    },
+    {
+      kind: "index",
+      name: "by_sessionId",
+      columns: ["sessionId", "createdAt"]
+    }
+  ]
+});
+defineTable({
+  name: "controlPlaneTenantProxyTokenLeases",
+  component: "mc",
+  category: "runtime",
+  shape: z.object({
+    leaseId: z.string(),
+    proxyTokenId: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    environment: z.enum(["dev", "staging", "prod"]),
+    providerId: z.string(),
+    modelSlotId: z.string(),
+    bindingId: z.string(),
+    secretRef: z.string(),
+    sessionId: z.string(),
+    principalId: z.string(),
+    agentSessionId: z.string().optional(),
+    status: z.enum(["active", "revoked"]),
+    expiresAt: z.number(),
+    renewedAt: z.number().optional(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    revokeReason: z.string().optional(),
+    permitDecisionLogId: idOf("policyDecisionLogs").optional(),
+    permitTraceId: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_leaseId", columns: ["leaseId"] },
+    { kind: "index", name: "by_proxyTokenId", columns: ["proxyTokenId"] },
+    { kind: "index", name: "by_tenantId", columns: ["tenantId", "createdAt"] },
+    { kind: "index", name: "by_sessionId", columns: ["sessionId", "createdAt"] },
+    {
+      kind: "index",
+      name: "by_principalId",
+      columns: ["principalId", "createdAt"]
+    },
+    {
+      kind: "index",
+      name: "by_status_expiresAt",
+      columns: ["status", "expiresAt"]
+    }
   ]
 });
 defineTable({
@@ -2128,6 +2399,7 @@ defineTable({
     "questionType": z.enum(["validation", "falsification", "assumption_probe", "prediction_test", "counterfactual", "discovery", "clarification", "comparison", "causal", "mechanism", "general"]).optional(),
     "questionPriority": z.enum(["critical", "high", "medium", "low"]).optional(),
     "answerQuality": z.enum(["definitive", "strong", "moderate", "weak", "speculative", "unanswered"]).optional(),
+    "themeStatus": z.enum(["emerging", "active", "mature", "declining", "archived"]).optional(),
     "themeConviction": z.enum(["high", "medium", "low", "negative"]).optional(),
     "decisionType": z.enum(["invest", "pass", "follow_on", "exit", "deep_dive", "monitor", "deprioritize", "thesis_adopt", "thesis_revise", "thesis_abandon"]).optional(),
     "decisionOutcome": z.enum(["pending", "successful", "unsuccessful", "mixed", "unknown"]).optional(),
@@ -2278,6 +2550,7 @@ defineTable({
   indices: [
     { kind: "index", name: "by_principalId", columns: ["principalId"] },
     { kind: "index", name: "by_principal_tenant", columns: ["principalId", "tenantId"] },
+    { kind: "index", name: "by_principal_tenant_workspace", columns: ["principalId", "tenantId", "workspaceId"] },
     { kind: "index", name: "by_workspace_principal", columns: ["workspaceId", "principalId"] },
     { kind: "index", name: "by_tenant_role", columns: ["tenantId", "role"] },
     { kind: "index", name: "by_status", columns: ["status"] }
@@ -2309,6 +2582,36 @@ defineTable({
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
+defineTable({
+  name: "principalIdentityAliases",
+  component: "mc",
+  category: "identity",
+  shape: z.object({
+    "principalId": z.string(),
+    "principalRefId": idOf("principals").optional(),
+    "provider": z.string(),
+    "providerProjectId": z.string().optional(),
+    "externalSubjectId": z.string(),
+    "tenantId": idOf("tenants").optional(),
+    "workspaceId": idOf("workspaces").optional(),
+    "email": z.string().optional(),
+    "status": z.enum(["active", "revoked"]),
+    "metadata": z.record(z.any()).optional(),
+    "createdBy": z.string(),
+    "revokedAt": z.number().optional(),
+    "revokedBy": z.string().optional(),
+    "createdAt": z.number(),
+    "updatedAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_provider_subject", columns: ["provider", "externalSubjectId"] },
+    { kind: "index", name: "by_provider_project_subject", columns: ["provider", "providerProjectId", "externalSubjectId"] },
+    { kind: "index", name: "by_principalId", columns: ["principalId"] },
+    { kind: "index", name: "by_principal_status", columns: ["principalId", "status"] },
+    { kind: "index", name: "by_tenant_provider_subject", columns: ["tenantId", "provider", "externalSubjectId"] },
+    { kind: "index", name: "by_workspace_provider_subject", columns: ["workspaceId", "provider", "externalSubjectId"] }
+  ]
+});
 defineTable({
   name: "rateLimitWindows",
   component: "mc",
@@ -2898,7 +3201,7 @@ defineTable({
 });
 defineTable({
   name: "mcpWritePolicy",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "topicId": z.string().optional(),
@@ -2921,7 +3224,7 @@ defineTable({
 });
 defineTable({
   name: "platformAudienceGrants",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2947,7 +3250,7 @@ defineTable({
 });
 defineTable({
   name: "platformAudiences",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -2972,7 +3275,7 @@ defineTable({
 });
 defineTable({
   name: "platformPolicyDecisionLogs",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "principalId": z.string(),
@@ -3008,7 +3311,7 @@ defineTable({
 });
 defineTable({
   name: "tenantApiKeys",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -3035,7 +3338,7 @@ defineTable({
 });
 defineTable({
   name: "tenantConfig",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -3054,7 +3357,7 @@ defineTable({
 });
 defineTable({
   name: "tenantIntegrations",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -3109,7 +3412,7 @@ defineTable({
 });
 defineTable({
   name: "tenantModelSlotBindings",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "bindingId": z.string(),
@@ -3137,7 +3440,7 @@ defineTable({
 });
 defineTable({
   name: "tenantPolicies",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -3162,7 +3465,7 @@ defineTable({
 });
 defineTable({
   name: "tenantProviderSecrets",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "secretRef": z.string(),
@@ -3193,7 +3496,7 @@ defineTable({
 });
 defineTable({
   name: "tenantProxyGatewayUsage",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "usageId": z.string(),
@@ -3228,7 +3531,7 @@ defineTable({
 });
 defineTable({
   name: "tenantProxyTokenMints",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "proxyTokenId": z.string(),
@@ -3251,7 +3554,7 @@ defineTable({
 });
 defineTable({
   name: "tenantSandboxAuditEvents",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "eventId": z.string(),
@@ -3285,7 +3588,7 @@ defineTable({
 });
 defineTable({
   name: "tenantSecrets",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "tenantId": z.string(),
@@ -3307,7 +3610,7 @@ defineTable({
 });
 defineTable({
   name: "toolAcls",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "role": z.enum(["platform_admin", "tenant_admin", "workspace_admin", "editor", "viewer", "auditor", "service_agent"]),
@@ -3322,7 +3625,7 @@ defineTable({
 });
 defineTable({
   name: "toolRegistry",
-  component: "identity",
+  component: "control-plane",
   category: "platform",
   shape: z.object({
     "toolName": z.string(),
@@ -3403,7 +3706,7 @@ defineTable({
 });
 defineTable({
   name: "modelCallLogs",
-  component: "identity",
+  component: "control-plane",
   category: "model",
   shape: z.object({
     "slot": z.string(),
@@ -3429,7 +3732,7 @@ defineTable({
 });
 defineTable({
   name: "modelFunctionSlots",
-  component: "identity",
+  component: "control-plane",
   category: "model",
   shape: z.object({
     "slot": z.string(),
@@ -3454,7 +3757,7 @@ defineTable({
 });
 defineTable({
   name: "modelRegistry",
-  component: "identity",
+  component: "control-plane",
   category: "model",
   shape: z.object({
     "key": z.string(),
@@ -3481,7 +3784,7 @@ defineTable({
 });
 defineTable({
   name: "modelSlotConfigs",
-  component: "identity",
+  component: "control-plane",
   category: "model",
   shape: z.object({
     "slot": z.string(),
@@ -3868,7 +4171,7 @@ defineTable({
     "workspaceId": idOf("workspaces").optional(),
     "resourceType": z.string(),
     "resourceId": z.string(),
-    "action": z.enum(["read", "summarize", "export", "mutate", "admin", "comment", "escalate", "resolve", "vote"]),
+    "action": z.enum(["read", "summarize", "export", "mutate", "admin", "comment", "escalate", "resolve", "vote", "route", "invoke", "manage", "deploy", "promote", "rollback", "audit", "read_ref", "fetch_value", "rotate", "administer", "mint", "delegate", "revoke"]),
     "decision": z.enum(["allow", "deny"]),
     "reasonCode": z.string(),
     "policyVersion": z.string(),
@@ -3930,7 +4233,7 @@ defineTable({
 });
 defineTable({
   name: "projectGrants",
-  component: "identity",
+  component: "control-plane",
   category: "project",
   shape: z.object({
     "projectId": z.string().optional(),
@@ -3962,91 +4265,735 @@ defineTable({
     { kind: "index", name: "by_topic_cluster_status", columns: ["topicId", "beliefClusterId", "status"] }
   ]
 });
+var permitActorType = z.enum([
+  "human",
+  "agent",
+  "service_principal",
+  "external_stakeholder",
+  "system"
+]);
+var permitMembershipStatus = z.enum([
+  "active",
+  "invited",
+  "revoked",
+  "suspended",
+  "disabled"
+]);
+var permitDecision = z.enum(["allow", "deny"]);
+var permitAccessReviewStatus = z.enum([
+  "open",
+  "in_progress",
+  "approved",
+  "denied",
+  "expired",
+  "cancelled"
+]);
+var permitReviewScope = z.enum([
+  "tenant",
+  "workspace",
+  "resource_instance",
+  "group",
+  "principal",
+  "api_key",
+  "admin_action"
+]);
+var permitRecordStatus = z.enum([
+  "queued",
+  "inflight",
+  "completed",
+  "failed",
+  "skipped",
+  "stale"
+]);
+var permitObjectType = z.enum([
+  "resource",
+  "role",
+  "resource_role",
+  "resource_relation",
+  "tenant",
+  "workspace",
+  "principal",
+  "membership",
+  "group",
+  "resource_instance",
+  "relationship_tuple",
+  "role_assignment",
+  "attribute_binding",
+  "policy_bundle"
+]);
+var permitOutboxOperation = z.enum([
+  "upsert",
+  "delete",
+  "sync",
+  "resync",
+  "delete_sync",
+  "noop"
+]);
+var permitPolicyBundleStatus = z.enum([
+  "draft",
+  "validated",
+  "enforced",
+  "archived"
+]);
+var permitSyncStatus = z.enum([
+  "pending",
+  "synced",
+  "error",
+  "skipped"
+]);
+var permitAccessReviewSubjectType = z.enum([
+  "principal",
+  "group",
+  "role_assignment",
+  "resource_instance"
+]);
+var permitAttributeType = z.enum([
+  "string",
+  "number",
+  "bool",
+  "json",
+  "time"
+]);
+var permitAttributeOperator = z.enum([
+  "eq",
+  "neq",
+  "in",
+  "not_in",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "contains",
+  "not_contains",
+  "matches"
+]);
+var permitRoleBindingTarget = z.enum([
+  "principal",
+  "group"
+]);
 defineTable({
-  name: "reasoningPermissions",
-  component: "identity",
-  category: "epistemic",
+  name: "permitPrincipals",
+  component: "control-plane",
+  category: "access-control",
   shape: z.object({
-    "topicId": z.string().optional(),
-    "principalId": z.string(),
-    "nodeType": z.enum(["belief", "evidence", "action", "approval", "artifact"]),
-    "action": z.enum(["view_conclusion", "view_evidence", "propose_action", "approve_action", "view_derived_artifact"]),
-    "effect": z.enum(["allow", "deny"]),
-    "policyReference": z.string().optional(),
-    "rationale": z.string().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdAt": z.number(),
-    "createdBy": z.string(),
-    "updatedAt": z.number()
+    principalId: z.string(),
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    principalType: permitActorType,
+    status: permitMembershipStatus,
+    displayName: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    updatedBy: z.string().optional(),
+    lastSeenAt: z.number().optional()
   }),
   indices: [
-    { kind: "index", name: "by_topic_principal", columns: ["topicId", "principalId"] },
-    { kind: "index", name: "by_topic_principal_action", columns: ["topicId", "principalId", "action"] },
-    { kind: "index", name: "by_topic_principal_node_action", columns: ["topicId", "principalId", "nodeType", "action"] },
-    { kind: "index", name: "by_principal_action", columns: ["principalId", "action"] }
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_tenant_principalId", columns: ["tenantId", "principalId"] },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
+    {
+      kind: "index",
+      name: "by_tenant_principalType_status",
+      columns: ["tenantId", "principalType", "status"]
+    }
   ]
 });
 defineTable({
-  name: "schemaEnumConfig",
-  component: "kernel",
-  category: "config",
+  name: "permitPrincipalAliases",
+  component: "control-plane",
+  category: "access-control",
   shape: z.object({
-    "tenantId": z.string().optional(),
-    "category": z.string(),
-    "value": z.string(),
-    "label": z.string(),
-    "description": z.string().optional(),
-    "tier": z.enum(["platform", "tenant"]),
-    "domainNamespace": z.string().optional(),
-    "metadata": z.any().optional(),
-    "isDefault": z.boolean().optional(),
-    "sortOrder": z.number().optional(),
-    "status": z.enum(["active", "deprecated"]),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    principalId: z.string(),
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    provider: z.string(),
+    providerSubjectId: z.string(),
+    providerProjectId: z.string().optional(),
+    alias: z.string(),
+    aliasKind: z.string(),
+    status: permitMembershipStatus,
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    revokedBy: z.string().optional(),
+    revokedAt: z.number().optional(),
+    updatedBy: z.string().optional()
   }),
   indices: [
-    { kind: "index", name: "by_category", columns: ["category"] },
-    { kind: "index", name: "by_tenant_category", columns: ["tenantId", "category"] },
-    { kind: "index", name: "by_category_value", columns: ["category", "value"] }
+    { kind: "index", name: "by_principalId", columns: ["principalId"] },
+    { kind: "index", name: "by_provider_subject", columns: ["provider", "providerSubjectId"] },
+    { kind: "index", name: "by_provider_project_subject", columns: ["provider", "providerProjectId", "providerSubjectId"] },
+    { kind: "index", name: "by_tenant_provider_subject", columns: ["tenantId", "provider", "providerSubjectId"] },
+    { kind: "index", name: "by_tenant_provider_project_subject", columns: ["tenantId", "provider", "providerProjectId", "providerSubjectId"] },
+    {
+      kind: "index",
+      name: "by_tenant_provider_alias",
+      columns: ["tenantId", "provider", "alias"]
+    },
+    { kind: "index", name: "by_tenant_alias", columns: ["tenantId", "alias"] },
+    {
+      kind: "index",
+      name: "by_tenant_provider_status",
+      columns: ["tenantId", "provider", "status"]
+    }
   ]
 });
 defineTable({
-  name: "tasks",
-  component: "kernel",
-  category: "task",
+  name: "permitGroups",
+  component: "control-plane",
+  category: "access-control",
   shape: z.object({
-    "topicId": z.string().optional(),
-    "tenantId": z.string().optional(),
-    "workspaceId": z.string().optional(),
-    "title": z.string(),
-    "description": z.string().optional(),
-    "status": z.enum(["todo", "in_progress", "blocked", "done"]),
-    "priority": z.enum(["urgent", "high", "medium", "low"]),
-    "dueDate": z.number().optional(),
-    "linkedWorktreeId": idOf("worktrees").optional(),
-    "linkedBeliefId": z.string().optional(),
-    "linkedQuestionId": z.string().optional(),
-    "taskType": z.enum(["general", "find_evidence", "verify_claim", "research", "review", "interview", "analysis", "track_metrics"]).optional(),
-    "assigneeId": z.string().optional(),
-    "blockedReason": z.string().optional(),
-    "blockedBy": z.array(idOf("tasks")).optional(),
-    "blocks": z.array(idOf("tasks")).optional(),
-    "sortOrder": z.number().optional(),
-    "executionOrder": z.number().optional(),
-    "subtasks": z.array(z.object({
-      "id": z.string(),
-      "title": z.string(),
-      "completed": z.boolean(),
-      "completedAt": z.number().optional()
-    })).optional(),
-    "comments": z.array(z.object({
-      "id": z.string(),
-      "userId": z.string(),
-      "content": z.string(),
-      "createdAt": z.number()
-    })).optional(),
-    "attachments": z.array(z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    groupId: z.string(),
+    groupKey: z.string(),
+    groupName: z.string(),
+    groupType: z.enum(["tenant", "workspace", "external", "system", "dynamic"]),
+    status: permitMembershipStatus,
+    description: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_tenant_groupId", columns: ["tenantId", "groupId"] },
+    { kind: "index", name: "by_tenant_groupKey", columns: ["tenantId", "groupKey"] },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
+  ]
+});
+defineTable({
+  name: "permitGroupMemberships",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    groupId: z.string(),
+    memberType: z.enum(["principal", "group"]),
+    memberId: z.string(),
+    principalId: z.string().optional(),
+    childGroupId: z.string().optional(),
+    status: permitMembershipStatus,
+    addedBy: z.string().optional(),
+    revokedBy: z.string().optional(),
+    expiresAt: z.number().optional(),
+    revocationReason: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenant_principal", columns: ["tenantId", "principalId"] },
+    { kind: "index", name: "by_tenant_member", columns: ["tenantId", "memberType", "memberId"] },
+    {
+      kind: "index",
+      name: "by_tenant_member_group",
+      columns: ["tenantId", "memberType", "memberId", "groupId"]
+    },
+    { kind: "index", name: "by_tenant_group", columns: ["tenantId", "groupId"] },
+    { kind: "index", name: "by_member_group", columns: ["memberType", "memberId", "groupId"] },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
+    {
+      kind: "index",
+      name: "by_workspace_principal",
+      columns: ["workspaceId", "principalId"]
+    }
+  ]
+});
+defineTable({
+  name: "permitResourceInstances",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    resourceType: z.string(),
+    resourceKey: z.string(),
+    resourceId: z.string(),
+    status: z.enum(["active", "deleted", "archived"]),
+    attributes: z.record(z.any()).optional(),
+    ownerPrincipalId: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    {
+      kind: "index",
+      name: "by_tenant_resource_type",
+      columns: ["tenantId", "resourceType"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_resource_key",
+      columns: ["tenantId", "resourceType", "resourceKey"]
+    },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_ownerPrincipalId",
+      columns: ["ownerPrincipalId"]
+    }
+  ]
+});
+defineTable({
+  name: "permitRoleAssignments",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    role: z.string(),
+    targetType: permitRoleBindingTarget,
+    targetId: z.string(),
+    resourceType: z.string(),
+    resourceKey: z.string(),
+    resourceInstanceId: z.string().optional(),
+    status: permitMembershipStatus,
+    expiresAt: z.number().optional(),
+    attributes: z.record(z.any()).optional(),
+    grantedBy: z.string().optional(),
+    updatedBy: z.string().optional(),
+    revokedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    {
+      kind: "index",
+      name: "by_tenant_target",
+      columns: ["tenantId", "targetType", "targetId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_resource",
+      columns: ["tenantId", "resourceType", "resourceKey"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_role",
+      columns: ["tenantId", "role", "status"]
+    },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_workspace_resource",
+      columns: ["workspaceId", "resourceType", "resourceKey"]
+    }
+  ]
+});
+defineTable({
+  name: "permitRelationshipTuples",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    relation: z.string(),
+    subject: z.string(),
+    object: z.string(),
+    resourceType: z.string().optional(),
+    resourceKey: z.string().optional(),
+    status: permitRecordStatus,
+    attributes: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    lastSeenAt: z.number().optional(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenant_subject", columns: ["tenantId", "subject"] },
+    { kind: "index", name: "by_tenant_object", columns: ["tenantId", "object"] },
+    { kind: "index", name: "by_tenant_relation", columns: ["tenantId", "relation"] },
+    {
+      kind: "index",
+      name: "by_tenant_relation_subject",
+      columns: ["tenantId", "relation", "subject"]
+    },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
+  ]
+});
+defineTable({
+  name: "permitAttributeBindings",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    targetType: permitRoleBindingTarget,
+    targetId: z.string(),
+    attributeName: z.string(),
+    attributeType: permitAttributeType,
+    attributeOperator: permitAttributeOperator,
+    attributeValue: z.any(),
+    status: permitRecordStatus,
+    source: z.string().optional(),
+    sourceRef: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    expiresAt: z.number().optional()
+  }),
+  indices: [
+    {
+      kind: "index",
+      name: "by_tenant_target",
+      columns: ["tenantId", "targetType", "targetId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_target_attribute",
+      columns: ["tenantId", "targetType", "targetId", "attributeName"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_name",
+      columns: ["tenantId", "attributeName"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    }
+  ]
+});
+defineTable({
+  name: "permitPolicyBundles",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    bundleKey: z.string(),
+    version: z.number(),
+    status: permitPolicyBundleStatus,
+    policyHash: z.string().optional(),
+    policyPayload: z.record(z.any()),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    reviewedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    retiredAt: z.number().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    {
+      kind: "index",
+      name: "by_tenant_bundleKey",
+      columns: ["tenantId", "bundleKey"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_bundle_version",
+      columns: ["tenantId", "bundleKey", "version"]
+    },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
+  ]
+});
+defineTable({
+  name: "permitProjectionOutbox",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    syncKey: z.string(),
+    objectType: permitObjectType,
+    objectId: z.string(),
+    operation: permitOutboxOperation,
+    payload: z.record(z.any()),
+    status: permitRecordStatus,
+    attemptCount: z.number(),
+    nextAttemptAt: z.number().optional(),
+    lastError: z.string().optional(),
+    tenantId: z.string().optional(),
+    workspaceId: z.optional(z.string()),
+    principalId: z.string().optional(),
+    permitTenantKey: z.string().optional(),
+    permitResourceType: z.string().optional(),
+    permitResourceKey: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    lastHandledAt: z.number().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_objectType",
+      columns: ["objectType", "status"]
+    }
+  ]
+});
+defineTable({
+  name: "tenantPermitSyncStates",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    syncKey: z.string(),
+    objectType: permitObjectType,
+    objectId: z.string(),
+    tenantId: z.string().optional(),
+    workspaceId: z.string().optional(),
+    principalId: z.string().optional(),
+    permitTenantKey: z.string().optional(),
+    permitResourceType: z.string().optional(),
+    permitResourceKey: z.string().optional(),
+    desiredPayload: z.record(z.any()),
+    lastAppliedPayloadHash: z.string().optional(),
+    status: permitSyncStatus,
+    attemptCount: z.number(),
+    lastError: z.string().optional(),
+    nextAttemptAt: z.number().optional(),
+    lastSyncedAt: z.number().optional(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_workspace_status",
+      columns: ["workspaceId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_principal_status",
+      columns: ["principalId", "status"]
+    }
+  ]
+});
+defineTable({
+  name: "permitPolicyDecisionReceipts",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string().optional(),
+    workspaceId: z.string().optional(),
+    principalId: z.string(),
+    subjectType: permitAccessReviewSubjectType.optional(),
+    subjectId: z.string().optional(),
+    resourceType: z.string(),
+    resourceId: z.string(),
+    action: z.string(),
+    decision: permitDecision,
+    reasonCode: z.string(),
+    policyBundleId: z.string().optional(),
+    policyVersion: z.string(),
+    traceId: z.string().optional(),
+    requestId: z.string().optional(),
+    audienceMode: z.string().optional(),
+    audienceKey: z.string().optional(),
+    audienceClass: z.enum(["internal", "restricted_external", "public"]).optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    expiresAt: z.number().optional(),
+    createdBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_principal_createdAt", columns: ["principalId", "createdAt"] },
+    { kind: "index", name: "by_tenant_createdAt", columns: ["tenantId", "createdAt"] },
+    { kind: "index", name: "by_resource", columns: ["resourceType", "resourceId"] },
+    { kind: "index", name: "by_decision_createdAt", columns: ["decision", "createdAt"] },
+    { kind: "index", name: "by_traceId", columns: ["traceId"] },
+    { kind: "index", name: "by_action", columns: ["action"] }
+  ]
+});
+defineTable({
+  name: "permitAccessReviews",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    reviewKey: z.string(),
+    scope: permitReviewScope,
+    status: permitAccessReviewStatus,
+    subjectType: permitAccessReviewSubjectType,
+    subjectId: z.string(),
+    resourceType: z.string().optional(),
+    resourceKey: z.string().optional(),
+    outcome: z.enum(["allow", "deny"]).optional(),
+    requestedBy: z.string(),
+    reviewedBy: z.string().optional(),
+    requestedAt: z.number(),
+    reviewedAt: z.number().optional(),
+    dueAt: z.number().optional(),
+    justification: z.string().optional(),
+    rationale: z.string().optional(),
+    policyBundleId: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
+    { kind: "index", name: "by_tenant_reviewKey", columns: ["tenantId", "reviewKey"] },
+    { kind: "index", name: "by_subject", columns: ["subjectType", "subjectId"] },
+    {
+      kind: "index",
+      name: "by_tenant_subject",
+      columns: ["tenantId", "subjectType", "subjectId"]
+    },
+    { kind: "index", name: "by_outcome", columns: ["outcome"] },
+    {
+      kind: "index",
+      name: "by_workspace_status",
+      columns: ["workspaceId", "status"]
+    }
+  ]
+});
+defineTable({
+  name: "permitAccessReviewItems",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    reviewKey: z.string(),
+    itemKey: z.string(),
+    tenantId: z.string(),
+    workspaceId: z.string().optional(),
+    subjectType: permitAccessReviewSubjectType,
+    subjectId: z.string(),
+    resourceType: z.string().optional(),
+    resourceKey: z.string().optional(),
+    role: z.string().optional(),
+    relation: z.string().optional(),
+    status: z.enum(["open", "approved", "revoked", "changed", "deferred"]),
+    reviewerId: z.string().optional(),
+    decisionAt: z.number().optional(),
+    rationale: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_reviewKey", columns: ["reviewKey"] },
+    { kind: "index", name: "by_tenant_reviewKey", columns: ["tenantId", "reviewKey"] },
+    { kind: "index", name: "by_tenant_itemKey", columns: ["tenantId", "itemKey"] },
+    { kind: "index", name: "by_subject", columns: ["subjectType", "subjectId"] },
+    { kind: "index", name: "by_status", columns: ["status"] }
+  ]
+});
+defineTable({
+  name: "reasoningPermissions",
+  component: "control-plane",
+  category: "epistemic",
+  shape: z.object({
+    "topicId": z.string().optional(),
+    "principalId": z.string(),
+    "nodeType": z.enum(["belief", "evidence", "action", "approval", "artifact"]),
+    "action": z.enum(["view_conclusion", "view_evidence", "propose_action", "approve_action", "view_derived_artifact"]),
+    "effect": z.enum(["allow", "deny"]),
+    "policyReference": z.string().optional(),
+    "rationale": z.string().optional(),
+    "metadata": z.record(z.any()).optional(),
+    "createdAt": z.number(),
+    "createdBy": z.string(),
+    "updatedAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_topic_principal", columns: ["topicId", "principalId"] },
+    { kind: "index", name: "by_topic_principal_action", columns: ["topicId", "principalId", "action"] },
+    { kind: "index", name: "by_topic_principal_node_action", columns: ["topicId", "principalId", "nodeType", "action"] },
+    { kind: "index", name: "by_principal_action", columns: ["principalId", "action"] }
+  ]
+});
+defineTable({
+  name: "schemaEnumConfig",
+  component: "kernel",
+  category: "config",
+  shape: z.object({
+    "tenantId": z.string().optional(),
+    "category": z.string(),
+    "value": z.string(),
+    "label": z.string(),
+    "description": z.string().optional(),
+    "tier": z.enum(["platform", "tenant"]),
+    "domainNamespace": z.string().optional(),
+    "metadata": z.any().optional(),
+    "isDefault": z.boolean().optional(),
+    "sortOrder": z.number().optional(),
+    "status": z.enum(["active", "deprecated"]),
+    "createdAt": z.number(),
+    "updatedAt": z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_category", columns: ["category"] },
+    { kind: "index", name: "by_tenant_category", columns: ["tenantId", "category"] },
+    { kind: "index", name: "by_category_value", columns: ["category", "value"] }
+  ]
+});
+defineTable({
+  name: "tasks",
+  component: "kernel",
+  category: "task",
+  shape: z.object({
+    "topicId": z.string().optional(),
+    "tenantId": z.string().optional(),
+    "workspaceId": z.string().optional(),
+    "title": z.string(),
+    "description": z.string().optional(),
+    "status": z.enum(["todo", "in_progress", "blocked", "done"]),
+    "priority": z.enum(["urgent", "high", "medium", "low"]),
+    "dueDate": z.number().optional(),
+    "linkedWorktreeId": idOf("worktrees").optional(),
+    "linkedBeliefId": z.string().optional(),
+    "linkedQuestionId": z.string().optional(),
+    "taskType": z.enum(["general", "find_evidence", "verify_claim", "research", "review", "interview", "analysis", "track_metrics"]).optional(),
+    "assigneeId": z.string().optional(),
+    "blockedReason": z.string().optional(),
+    "blockedBy": z.array(idOf("tasks")).optional(),
+    "blocks": z.array(idOf("tasks")).optional(),
+    "sortOrder": z.number().optional(),
+    "executionOrder": z.number().optional(),
+    "subtasks": z.array(z.object({
+      "id": z.string(),
+      "title": z.string(),
+      "completed": z.boolean(),
+      "completedAt": z.number().optional()
+    })).optional(),
+    "comments": z.array(z.object({
+      "id": z.string(),
+      "userId": z.string(),
+      "content": z.string(),
+      "createdAt": z.number()
+    })).optional(),
+    "attachments": z.array(z.object({
       "id": z.string(),
       "type": z.enum(["call_script", "email_template", "research_plan", "framework", "checklist", "note", "file", "transcript"]),
       "title": z.string(),
@@ -4199,6 +5146,7 @@ defineTable({
     "updatedAt": z.number()
   }),
   indices: [
+    { kind: "index", name: "by_globalId", columns: ["globalId"] },
     { kind: "index", name: "by_parent", columns: ["parentTopicId"] },
     { kind: "index", name: "by_type", columns: ["type"] },
     { kind: "index", name: "by_graph_scope_project", columns: ["graphScopeProjectId"] },
@@ -4210,7 +5158,7 @@ defineTable({
 });
 defineTable({
   name: "users",
-  component: "identity",
+  component: "control-plane",
   category: "user",
   shape: z.object({
     "clerkId": z.string(),
@@ -4324,7 +5272,6 @@ defineTable({
     "deployments": z.record(z.object({
       "url": z.string(),
       "target": z.enum(["kernelDeployment", "appDeployment"]).optional(),
-      "encryptedDeployKey": z.string().optional(),
       "credentialRef": z.string().optional()
     })).optional(),
     "metadata": z.record(z.any()).optional(),
@@ -4339,6 +5286,39 @@ defineTable({
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
+defineTable({
+  name: "deploymentHosts",
+  component: "mc",
+  category: "workspace",
+  shape: z.object({
+    "host": z.string(),
+    "tenantId": idOf("tenants"),
+    "workspaceId": idOf("workspaces"),
+    "environment": z.enum(["dev", "staging", "prod"]),
+    "target": z.enum(["kernelDeployment", "appDeployment"]),
+    "deploymentUrl": z.string().optional(),
+    "deploymentName": z.string().optional(),
+    "vercelProjectName": z.string().optional(),
+    "vercelProjectId": z.string().optional(),
+    "vercelEnvironment": z.enum(["development", "preview", "staging", "production"]).optional(),
+    "source": z.enum(["vercel_preview", "vercel_production", "vercel_custom_environment", "custom_domain", "manual"]),
+    "status": z.enum(["active", "revoked"]),
+    "metadata": z.record(z.any()).optional(),
+    "createdBy": z.string(),
+    "createdAt": z.number(),
+    "updatedAt": z.number(),
+    "revokedAt": z.number().optional(),
+    "revokedBy": z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_host", columns: ["host"] },
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_tenant_workspace_environment", columns: ["tenantId", "workspaceId", "environment"] },
+    { kind: "index", name: "by_workspace_status", columns: ["workspaceId", "status"] },
+    { kind: "index", name: "by_status", columns: ["status"] }
+  ]
+});
 defineTable({
   name: "worktreeBeliefCluster",
   component: "kernel",
@@ -4646,8 +5626,8 @@ defineTable({
 });
 z.object({
   manifestVersion: z.string(),
-  componentName: z.enum(["kernel", "identity"]),
-  tier: z.enum(["K", "I"]),
+  componentName: z.enum(["kernel", "control-plane"]),
+  tier: z.enum(["K", "CP"]),
   packageVersion: z.string(),
   tables: z.array(
     z.object({
@@ -4814,7 +5794,7 @@ var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
   },
   {
     packageName: "@lucern/control-plane",
-    role: "platform_runtime",
+    role: "component_runtime",
     directTenantImport: false
   },
   {
@@ -4823,79 +5803,948 @@ var TENANT_CLIENT_INSTALLABLE_PACKAGES = [
     directTenantImport: false
   },
   {
-    packageName: "@lucern/events",
-    role: "sdk_dependency",
-    directTenantImport: false
+    packageName: "@lucern/events",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/graph-primitives",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/graph-sync",
+    role: "host_addon_runtime",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/mcp",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/pack-host",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/pack-installer",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/proof-compiler",
+    role: "developer_tool",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/react",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/reasoning-kernel",
+    role: "component_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/sdk",
+    role: "runtime_entrypoint",
+    directTenantImport: true
+  },
+  {
+    packageName: "@lucern/secrets",
+    role: "sdk_dependency",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/server-core",
+    role: "platform_runtime",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/testing",
+    role: "test_support",
+    directTenantImport: false
+  },
+  {
+    packageName: "@lucern/types",
+    role: "contract_entrypoint",
+    directTenantImport: true
+  }
+];
+TENANT_CLIENT_INSTALLABLE_PACKAGES.map(
+  (entry) => entry.packageName
+);
+
+// ../contracts/src/infisical-runtime.contract.ts
+var INFISICAL_TENANT_SOFTWARE_SYSTEMS = [
+  {
+    id: "stack-frontend",
+    tenantKey: "stack",
+    workspaceKey: "frontend",
+    vercelProjectName: "ai-chatbot-diao",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_PihFw8kohSSw14nZs9YQV3xVo517",
+    vercelWriterTokenEnv: "STACK_VERCEL_TOKEN",
+    repository: {
+      owner: "stack-vc",
+      name: "front-end"
+    },
+    sharedSourcePath: "/tenants/stack",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_FRONTEND_URL",
+      deployKeyEnv: "CONVEX_FRONTEND_DEPLOY_KEY",
+      preprodDeployment: "rugged-lobster-664",
+      prodDeployment: "wonderful-toucan-0"
+    }
+  },
+  {
+    id: "stackos",
+    tenantKey: "stack",
+    workspaceKey: "stackos",
+    vercelProjectName: "stackos",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_rXLAL0Z6v9p1fasKbomby6GI7kau",
+    vercelWriterTokenEnv: "STACK_VERCEL_TOKEN",
+    repository: {
+      owner: "stack-vc",
+      name: "stackos"
+    },
+    sharedSourcePath: "/tenants/stack",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_STACKOS_URL",
+      deployKeyEnv: "CONVEX_STACKOS_DEPLOY_KEY",
+      preprodDeployment: "giant-mandrill-761",
+      prodDeployment: "good-snake-515"
+    }
+  },
+  {
+    id: "stack-eng",
+    tenantKey: "stack",
+    workspaceKey: "engineering",
+    vercelProjectName: "stackos-engineering-graph",
+    vercelTeamId: "team_mZBKwvXSSu7qxrWdg2go29sK",
+    vercelProjectId: "prj_zAU0Zn9GkbHjHI63dxW4vLpmoqTJ",
+    vercelWriterTokenEnv: "STACK_VERCEL_TOKEN",
+    repository: {
+      owner: "stack-vc",
+      name: "stackos-engineering-graph"
+    },
+    sharedSourcePath: "/tenants/stack/engineering",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_STACK_ENG_URL",
+      deployKeyEnv: "CONVEX_STACK_ENG_DEPLOY_KEY",
+      preprodDeployment: "small-oyster-270",
+      prodDeployment: "bold-cuttlefish-804"
+    }
+  },
+  {
+    id: "lucern-graph",
+    tenantKey: "lucern",
+    workspaceKey: "lucern",
+    vercelProjectName: "lucern-graph",
+    vercelTeamId: "team_vTHxxs8GAoAFUe6RWMlYt7fY",
+    vercelProjectId: "prj_KJ8EKV8vGM5xURpqmwTwmECEGPgQ",
+    vercelWriterTokenEnv: "LUCERN_VERCEL_TOKEN",
+    repository: {
+      owner: "LucernAI",
+      name: "lucern-graph"
+    },
+    sharedSourcePath: "/tenants/lucern/shared",
+    sharedVariablePolicy: "tenant_shared_all_systems",
+    convex: {
+      urlEnv: "CONVEX_LUCERN_URL",
+      deployKeyEnv: "CONVEX_LUCERN_DEPLOY_KEY",
+      preprodDeployment: "good-blackbird-774",
+      prodDeployment: "precious-dog-365"
+    }
+  }
+];
+var TENANT_SHARED_SECRET_DEFINITION_TEMPLATES = [
+  {
+    idSuffix: "clerk.publishable",
+    canonicalName: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY",
+    aliases: ["CLERK_PUBLISHABLE_KEY"],
+    required: true,
+    secret: false,
+    public: true,
+    description: "Tenant-owned Clerk browser key. For Stack this is the master clerk.stack.vc project shared by front-end, StackOS, and the engineering workspace."
+  },
+  {
+    idSuffix: "clerk.secret",
+    canonicalName: "CLERK_SECRET_KEY",
+    required: true,
+    secret: true,
+    public: false,
+    description: "Tenant-owned Clerk backend secret used only by that tenant's server runtimes."
+  },
+  {
+    idSuffix: "clerk.project",
+    canonicalName: "CLERK_PROJECT_ID",
+    required: true,
+    secret: false,
+    public: false,
+    description: "Tenant-owned Clerk project id used to resolve canonical Clerk aliases."
+  },
+  {
+    idSuffix: "clerk.jwks",
+    canonicalName: "CLERK_JWT_ISSUER_DOMAIN",
+    aliases: ["CLERK_ISSUER_URL", "CLERK_JWKS_URL"],
+    required: false,
+    secret: false,
+    public: false,
+    description: "Tenant Clerk issuer/JWKS URL consumed by Convex auth.config.ts."
+  },
+  {
+    idSuffix: "clerk.jwt-key",
+    canonicalName: "CLERK_JWT_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    description: "Tenant Clerk JWT public verification key used by bearer-token API routes."
+  },
+  {
+    idSuffix: "clerk.authorized-parties",
+    canonicalName: "CLERK_AUTHORIZED_PARTIES",
+    aliases: ["CLERK_MOBILE_AUTHORIZED_PARTIES"],
+    required: false,
+    secret: false,
+    public: false,
+    description: "Comma-separated Clerk authorized parties for browser and mobile bearer-token validation."
+  },
+  {
+    idSuffix: "clerk.sign-in-url",
+    canonicalName: "NEXT_PUBLIC_CLERK_SIGN_IN_URL",
+    required: false,
+    secret: false,
+    public: true,
+    description: "Tenant Clerk sign-in route for custom app login surfaces."
+  },
+  {
+    idSuffix: "clerk.sign-up-url",
+    canonicalName: "NEXT_PUBLIC_CLERK_SIGN_UP_URL",
+    required: false,
+    secret: false,
+    public: true,
+    description: "Tenant Clerk sign-up route for custom app login surfaces."
+  }
+];
+INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap(
+  (system) => TENANT_SHARED_SECRET_DEFINITION_TEMPLATES.map(
+    (template) => ({
+      id: `tenant.${system.id}.${template.idSuffix}`,
+      canonicalName: template.canonicalName,
+      aliases: "aliases" in template ? template.aliases : void 0,
+      owner: "tenant",
+      scope: "tenant",
+      sourcePath: system.sharedSourcePath,
+      environmentPolicy: "environment_specific",
+      required: template.required,
+      secret: template.secret,
+      public: template.public,
+      consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+      destinations: [
+        {
+          kind: "vercel",
+          target: system.vercelProjectName,
+          environmentPolicy: "preprod_staging_prod_prod"
+        },
+        {
+          kind: "convex",
+          target: `${system.convex.preprodDeployment}|${system.convex.prodDeployment}`,
+          environmentPolicy: "preprod_staging_prod_prod"
+        }
+      ],
+      description: `${system.tenantKey}/${system.workspaceKey}: ${template.description}`
+    })
+  )
+);
+INFISICAL_TENANT_SOFTWARE_SYSTEMS.map(
+  (system) => ({
+    id: `tenant.${system.id}.install-lucern-npm`,
+    canonicalName: "INSTALL_LUCERN_NPM",
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/tenants/shared",
+    environmentPolicy: "same_all_environments",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-deploy-tooling"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: system.vercelProjectName,
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "github_actions",
+        target: `${system.repository.owner}/${system.repository.name}`,
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: `${system.tenantKey}/${system.workspaceKey}: read-only npm install token for published @lucern/* packages.`
+  })
+);
+var TENANT_PRODUCT_SOFTWARE_SYSTEM_IDS = ["stack-frontend", "stackos"];
+var TENANT_PRODUCT_RUNTIME_SECRET_DEFINITION_TEMPLATES = [
+  {
+    idSuffix: "ai.openai-api-key",
+    canonicalName: "OPENAI_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
+    description: "Tenant-owned OpenAI key for product runtime LLM calls."
+  },
+  {
+    idSuffix: "ai.anthropic-api-key",
+    canonicalName: "ANTHROPIC_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
+    description: "Tenant-owned Anthropic key for product runtime LLM calls."
+  },
+  {
+    idSuffix: "ai.gemini-api-key",
+    canonicalName: "GEMINI_API_KEY",
+    aliases: ["GOOGLE_AI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"],
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment", "tenant-ai-runtime"],
+    description: "Tenant-owned Google/Gemini key for product runtime LLM calls."
+  },
+  {
+    idSuffix: "langfuse.secret-key",
+    canonicalName: "LANGFUSE_SECRET_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-observability"
+    ],
+    description: "Tenant-owned Langfuse secret key for product AI tracing."
+  },
+  {
+    idSuffix: "langfuse.public-key",
+    canonicalName: "LANGFUSE_PUBLIC_KEY",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-observability"
+    ],
+    description: "Tenant-owned Langfuse public key for product AI tracing."
+  },
+  {
+    idSuffix: "langfuse.base-url",
+    canonicalName: "LANGFUSE_BASE_URL",
+    aliases: ["LANGFUSE_BASEURL", "LANGFUSE_HOST"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-observability"
+    ],
+    description: "Tenant-owned Langfuse API origin."
+  },
+  {
+    idSuffix: "graph.neo4j-uri",
+    canonicalName: "NEO4J_URI",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j URI for product graph-sync."
+  },
+  {
+    idSuffix: "graph.neo4j-user",
+    canonicalName: "NEO4J_USER",
+    aliases: ["NEO4J_USERNAME"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j user for product graph-sync."
+  },
+  {
+    idSuffix: "graph.neo4j-password",
+    canonicalName: "NEO4J_PASSWORD",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j password for product graph-sync."
+  },
+  {
+    idSuffix: "graph.neo4j-sync-secret",
+    canonicalName: "NEO4J_SYNC_SECRET",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned shared secret for product Convex-to-HTTP graph-sync calls."
+  },
+  {
+    idSuffix: "graph.neo4j-database",
+    canonicalName: "NEO4J_DATABASE",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-graph-sync"
+    ],
+    description: "Tenant-owned Neo4j database name for product graph-sync."
+  },
+  {
+    idSuffix: "vector.pinecone-api-key",
+    canonicalName: "PINECONE_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone API key for product vector search."
+  },
+  {
+    idSuffix: "vector.pinecone-index-name",
+    canonicalName: "PINECONE_INDEX_NAME",
+    aliases: ["PINECONE_INDEX"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone index name for product vector search."
+  },
+  {
+    idSuffix: "vector.pinecone-host",
+    canonicalName: "PINECONE_HOST",
+    aliases: ["PINECONE_INDEX_HOST"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone host for product vector search."
+  },
+  {
+    idSuffix: "vector.pinecone-namespace",
+    canonicalName: "PINECONE_NAMESPACE",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-convex-deployment",
+      "tenant-vector-store"
+    ],
+    description: "Tenant-owned Pinecone namespace for product vector search isolation."
+  },
+  {
+    idSuffix: "storage.aws-access-key-id",
+    canonicalName: "AWS_ACCESS_KEY_ID",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+    description: "Tenant-owned AWS access key id for document/file ingestion."
+  },
+  {
+    idSuffix: "storage.aws-secret-access-key",
+    canonicalName: "AWS_SECRET_ACCESS_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+    description: "Tenant-owned AWS secret access key for document/file ingestion."
   },
   {
-    packageName: "@lucern/graph-primitives",
-    role: "sdk_dependency",
-    directTenantImport: false
+    idSuffix: "storage.aws-region",
+    canonicalName: "AWS_REGION",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-convex-deployment"],
+    description: "Tenant-owned AWS region for document/file ingestion."
   },
   {
-    packageName: "@lucern/graph-sync",
-    role: "host_addon_runtime",
-    directTenantImport: true
+    idSuffix: "observability.sentry-dsn",
+    canonicalName: "NEXT_PUBLIC_SENTRY_DSN",
+    aliases: ["NEXT_PUBLIC_SENTRY_DSN_NEXTJS", "SENTRY_DSN"],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned Sentry DSN for app telemetry."
   },
   {
-    packageName: "@lucern/identity",
-    role: "component_runtime",
-    directTenantImport: false
+    idSuffix: "observability.sentry-auth-token",
+    canonicalName: "SENTRY_AUTH_TOKEN",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-deploy-tooling", "tenant-observability"],
+    description: "Tenant-owned Sentry release token for app deployments."
   },
   {
-    packageName: "@lucern/mcp",
-    role: "runtime_entrypoint",
-    directTenantImport: true
+    idSuffix: "observability.sentry-org",
+    canonicalName: "SENTRY_ORG",
+    aliases: ["SENTRY_ORG_SLUG"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-deploy-tooling", "tenant-observability"],
+    description: "Tenant-owned Sentry org slug for release uploads."
   },
   {
-    packageName: "@lucern/pack-host",
-    role: "platform_runtime",
-    directTenantImport: false
+    idSuffix: "observability.sentry-project",
+    canonicalName: "SENTRY_PROJECT",
+    aliases: ["SENTRY_PROJECT_NEXTJS"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-deploy-tooling", "tenant-observability"],
+    description: "Tenant-owned Sentry project slug for release uploads."
   },
   {
-    packageName: "@lucern/pack-installer",
-    role: "developer_tool",
-    directTenantImport: false
+    idSuffix: "observability.sentry-environment",
+    canonicalName: "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+    aliases: ["SENTRY_ENVIRONMENT"],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned Sentry environment label."
   },
   {
-    packageName: "@lucern/proof-compiler",
-    role: "developer_tool",
-    directTenantImport: false
+    idSuffix: "observability.sentry-release",
+    canonicalName: "NEXT_PUBLIC_SENTRY_RELEASE",
+    aliases: ["SENTRY_RELEASE"],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned Sentry release label."
   },
   {
-    packageName: "@lucern/react",
-    role: "runtime_entrypoint",
-    directTenantImport: true
+    idSuffix: "observability.sentry-client-options",
+    canonicalName: "NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE",
+    aliases: [
+      "NEXT_PUBLIC_SENTRY_CAPTURE_CONSOLE_LEVELS",
+      "NEXT_PUBLIC_SENTRY_CAPTURE_CONSOLE_LEVELS_NEXTJS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_BREADCRUMB_LEVELS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_BREADCRUMB_LEVELS_NEXTJS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_LOG_LEVELS",
+      "NEXT_PUBLIC_SENTRY_CONSOLE_LOG_LEVELS_NEXTJS",
+      "NEXT_PUBLIC_SENTRY_ENABLE_LOGS",
+      "NEXT_PUBLIC_SENTRY_REPLAYS_ON_ERROR_SAMPLE_RATE",
+      "NEXT_PUBLIC_SENTRY_REPLAYS_SESSION_SAMPLE_RATE",
+      "NEXT_PUBLIC_SENTRY_SEND_DEFAULT_PII",
+      "NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE_NEXTJS"
+    ],
+    required: false,
+    secret: false,
+    public: true,
+    consumers: ["tenant-vercel-app", "tenant-observability"],
+    description: "Tenant-owned public Sentry tuning values for Next.js client instrumentation."
   },
   {
-    packageName: "@lucern/reasoning-kernel",
-    role: "component_runtime",
-    directTenantImport: false
+    idSuffix: "observability.sentry-webhook-secret",
+    canonicalName: "SENTRY_WEBHOOK_SECRET",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-convex-deployment", "tenant-observability"],
+    description: "Tenant-owned Sentry webhook verification secret."
   },
   {
-    packageName: "@lucern/sdk",
-    role: "runtime_entrypoint",
-    directTenantImport: true
+    idSuffix: "lucern.gateway-api-key",
+    canonicalName: "LUCERN_API_KEY",
+    aliases: ["STACK_API_KEY"],
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Tenant-scoped Lucern/MC gateway API key for product front-door calls."
   },
   {
-    packageName: "@lucern/server-core",
-    role: "platform_runtime",
-    directTenantImport: false
+    idSuffix: "lucern.gateway-base-url",
+    canonicalName: "LUCERN_BASE_URL",
+    aliases: ["LUCERN_API_BASE_URL", "LUCERN_GATEWAY_BASE_URL"],
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Lucern/MC gateway base URL used by tenant product apps."
   },
   {
-    packageName: "@lucern/testing",
-    role: "test_support",
-    directTenantImport: false
+    idSuffix: "lucern.proxy-token-secret",
+    canonicalName: "LUCERN_PROXY_TOKEN_SECRET",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Tenant-owned secret for signing internal proxy/session tokens in product apps."
   },
   {
-    packageName: "@lucern/types",
-    role: "contract_entrypoint",
-    directTenantImport: true
+    idSuffix: "tenant.integrations.linear-api-key",
+    canonicalName: "LINEAR_API_KEY",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-agent-runtime"],
+    description: "Tenant-owned Linear API key for support/slash-command flows."
+  },
+  {
+    idSuffix: "tenant.vercel.bypass-token",
+    canonicalName: "VERCEL_AUTOMATION_BYPASS_SECRET",
+    aliases: ["NEXT_PUBLIC_VERCEL_BYPASS_TOKEN"],
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["tenant-vercel-app", "tenant-deploy-tooling"],
+    description: "Tenant-owned Vercel automation bypass token. Public alias is legacy and should be removed from app code."
   }
 ];
-TENANT_CLIENT_INSTALLABLE_PACKAGES.map(
-  (entry) => entry.packageName
+INFISICAL_TENANT_SOFTWARE_SYSTEMS.filter(
+  (system) => TENANT_PRODUCT_SOFTWARE_SYSTEM_IDS.includes(system.id)
+).flatMap(
+  (system) => TENANT_PRODUCT_RUNTIME_SECRET_DEFINITION_TEMPLATES.map(
+    (template) => ({
+      id: `tenant.${system.id}.${template.idSuffix}`,
+      canonicalName: template.canonicalName,
+      aliases: "aliases" in template ? template.aliases : void 0,
+      owner: "tenant",
+      scope: "tenant",
+      sourcePath: system.sharedSourcePath,
+      environmentPolicy: "environment_specific",
+      required: template.required,
+      secret: template.secret,
+      public: template.public,
+      consumers: template.consumers,
+      destinations: [
+        {
+          kind: "vercel",
+          target: system.vercelProjectName,
+          environmentPolicy: "preprod_staging_prod_prod"
+        },
+        {
+          kind: "convex",
+          target: `${system.convex.preprodDeployment}|${system.convex.prodDeployment}`,
+          environmentPolicy: "preprod_staging_prod_prod"
+        },
+        {
+          kind: "github_actions",
+          target: `${system.repository.owner}/${system.repository.name}`,
+          environmentPolicy: "preprod_staging_prod_prod"
+        }
+      ],
+      description: `${system.tenantKey}/${system.workspaceKey}: ${template.description}`
+    })
+  )
+);
+function tenantVercelConvexUrlWriteNames(system) {
+  const names = [system.convex.urlEnv, "NEXT_PUBLIC_CONVEX_URL"];
+  if (system.id === "stack-eng") {
+    return [...names, "STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
+  }
+  return names;
+}
+function tenantRepositoryConvexUrlWriteNames(system) {
+  if (system.id === "stack-eng") {
+    return [system.convex.urlEnv, "STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
+  }
+  return [system.convex.urlEnv];
+}
+function tenantRepositoryConvexDeployKeyWriteNames(system) {
+  if (system.id === "stack-eng") {
+    return [system.convex.deployKeyEnv, "STACKOS_ENGINEERING_GRAPH_DEPLOY_KEY"];
+  }
+  return [system.convex.deployKeyEnv];
+}
+function tenantConvexUrlAliases(system) {
+  if (system.id === "stack-frontend") {
+    return [
+      "CONVEX_PROD_URL",
+      "CONVEX_STACK_V2_PROD_URL",
+      "CONVEX_STACK_V2_STAGING_URL",
+      "STACK_CONVEX_URL"
+    ];
+  }
+  if (system.id === "stackos") {
+    return [
+      "CONVEX_CLOUD_URL",
+      "CONVEX_STACK_URL",
+      "CONVEX_URL",
+      "CONVEX_URL_DEVELOPMENT",
+      "CONVEX_URL_PRODUCTION",
+      "STACK_CONVEX_URL"
+    ];
+  }
+  if (system.id === "stack-eng") {
+    return ["STACKOS_ENGINEERING_GRAPH_CONVEX_URL"];
+  }
+  if (system.id === "lucern-graph") {
+    return [
+      "CONVEX_GRAPH_URL",
+      "LUCERN_PROD_URL",
+      "NEXT_PUBLIC_LUCERN_GRAPH_URL"
+    ];
+  }
+  return void 0;
+}
+function tenantConvexDeployKeyAliases(system) {
+  if (system.id === "stack-frontend") {
+    return [
+      "CONVEX_STACK_V2_PROD_DEPLOY_KEY",
+      "CONVEX_STACK_V2_STAGING_DEPLOY_KEY",
+      "STACK_DEPLOY_KEY"
+    ];
+  }
+  if (system.id === "stackos") {
+    return [
+      "CONVEX_DEPLOY_KEY",
+      "CONVEX_DEV_DEPLOY_KEY",
+      "CONVEX_PROD_DEPLOY_KEY",
+      "CONVEX_STACK_DEPLOY_KEY",
+      "STACK_DEPLOY_KEY"
+    ];
+  }
+  if (system.id === "stack-eng") {
+    return ["CONVEX_DEPLOY_KEY", "STACKOS_ENGINEERING_GRAPH_DEPLOY_KEY"];
+  }
+  if (system.id === "lucern-graph") {
+    return [
+      "CONVEX_DEPLOY_KEY",
+      "CONVEX_GRAPH_DEPLOY_KEY",
+      "LUCERN_CONVEX_DEPLOY_KEY",
+      "LUCERN_DEV_DEPLOY_KEY",
+      "LUCERN_PROD_DEPLOY_KEY"
+    ];
+  }
+  return void 0;
+}
+INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap(
+  (system) => {
+    if (system.id === "lucern-graph") {
+      return [
+        {
+          id: "tenant.lucern-graph.public.tenant-id",
+          canonicalName: "NEXT_PUBLIC_LUCERN_GRAPH_TENANT_ID",
+          aliases: ["NEXT_PUBLIC_LUCERN_TENANT_ID"],
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Lucern graph public tenant id used by the standalone graph explorer."
+        },
+        {
+          id: "tenant.lucern-graph.public.tenant-label",
+          canonicalName: "NEXT_PUBLIC_LUCERN_GRAPH_TENANT_LABEL",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Lucern graph public tenant label used by the standalone graph explorer."
+        }
+      ];
+    }
+    if (system.id === "stack-eng") {
+      return [
+        {
+          id: "tenant.stack-eng.public.tenant-id",
+          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_TENANT_ID",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Stack engineering graph public tenant id used by the graph explorer."
+        },
+        {
+          id: "tenant.stack-eng.public.tenant-label",
+          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_TENANT_LABEL",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Stack engineering graph public tenant label used by the graph explorer."
+        },
+        {
+          id: "tenant.stack-eng.public.environment",
+          canonicalName: "NEXT_PUBLIC_STACKOS_ENGINEERING_GRAPH_ENV",
+          owner: "tenant",
+          scope: "workspace",
+          sourcePath: system.sharedSourcePath,
+          environmentPolicy: "environment_specific",
+          required: false,
+          secret: false,
+          public: true,
+          consumers: ["tenant-vercel-app"],
+          destinations: [
+            {
+              kind: "vercel",
+              target: system.vercelProjectName,
+              environmentPolicy: "preprod_staging_prod_prod"
+            }
+          ],
+          description: "Stack engineering graph public environment label used by the graph explorer."
+        }
+      ];
+    }
+    return [];
+  }
 );
+INFISICAL_TENANT_SOFTWARE_SYSTEMS.flatMap((system) => [
+  {
+    id: `tenant.${system.id}.convex.url`,
+    canonicalName: system.convex.urlEnv,
+    aliases: tenantConvexUrlAliases(system),
+    owner: "tenant",
+    scope: "software_system",
+    sourcePath: system.sharedSourcePath,
+    environmentPolicy: "preprod_staging_prod_prod",
+    required: true,
+    secret: false,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-agent-runtime",
+      "mc-operator-tooling"
+    ],
+    destinations: [
+      {
+        kind: "vercel",
+        target: system.vercelProjectName,
+        environmentPolicy: "preprod_staging_prod_prod",
+        writeNames: tenantVercelConvexUrlWriteNames(system)
+      },
+      {
+        kind: "github_actions",
+        target: `${system.repository.owner}/${system.repository.name}`,
+        environmentPolicy: "preprod_staging_prod_prod",
+        writeNames: tenantRepositoryConvexUrlWriteNames(system),
+        notes: "Only if that repository deploy/test workflow owns this software system."
+      }
+    ],
+    description: `${system.tenantKey}/${system.workspaceKey} Convex URL. Pre-prod resolves to ${system.convex.preprodDeployment}; prod resolves to ${system.convex.prodDeployment}.`
+  },
+  {
+    id: `tenant.${system.id}.convex.deploy-key`,
+    canonicalName: system.convex.deployKeyEnv,
+    aliases: tenantConvexDeployKeyAliases(system),
+    owner: "tenant",
+    scope: "software_system",
+    sourcePath: system.sharedSourcePath,
+    environmentPolicy: "preprod_staging_prod_prod",
+    required: true,
+    secret: true,
+    public: false,
+    consumers: [
+      "tenant-vercel-app",
+      "tenant-agent-runtime",
+      "mc-operator-tooling"
+    ],
+    destinations: [
+      {
+        kind: "vercel",
+        target: system.vercelProjectName,
+        environmentPolicy: "preprod_staging_prod_prod"
+      },
+      {
+        kind: "github_actions",
+        target: `${system.repository.owner}/${system.repository.name}`,
+        environmentPolicy: "preprod_staging_prod_prod",
+        writeNames: tenantRepositoryConvexDeployKeyWriteNames(system),
+        notes: "Only if that repository deploy/test workflow owns this software system."
+      }
+    ],
+    description: `${system.tenantKey}/${system.workspaceKey} Convex deploy/admin key. Never route to sibling workspaces.`
+  }
+]);
 z.object({
   manifestVersion: z.literal("1.0.0"),
   rules: z.array(
@@ -4936,7 +6785,7 @@ var createEvidenceInputSchemaBase = z.object({
   targetId: z.string().optional(),
   targetNodeId: z.string().optional(),
   linkedBeliefNodeId: z.string().optional(),
-  evidenceRelation: z.enum(["supports", "contradicts", "neutral"]).optional(),
+  evidenceRelation: z.enum(["supports", "contradicts"]).optional(),
   confidence: z.number().optional(),
   weight: z.number().optional(),
   reasoning: z.string().optional(),
@@ -5021,8 +6870,7 @@ var createEvidenceProjection = defineProjection({
     evidenceRelation: v.optional(
       v.union(
         v.literal("supports"),
-        v.literal("contradicts"),
-        v.literal("neutral")
+        v.literal("contradicts")
       )
     ),
     confidence: v.optional(v.number()),
@@ -5047,7 +6895,7 @@ function compactRecord2(input) {
     Object.entries(input).filter(([, value]) => value !== void 0)
   );
 }
-var listBeliefsProjection = defineProjection({
+defineProjection({
   contractName: "list_beliefs",
   inputSchema: listBeliefsInputSchema,
   project: (input) => compactRecord2({
@@ -5071,12 +6919,17 @@ var listBeliefsProjection = defineProjection({
 });
 var taskStatusSchema = z.enum(["todo", "in_progress", "blocked", "done"]).optional().describe("Filter by task status");
 var listTasksInputSchema = z.object({
-  topicId: z.string().describe("Topic scope"),
+  topicId: z.string().optional().describe("Topic scope"),
   worktreeId: z.string().optional().describe("Alias for linkedWorktreeId"),
   linkedWorktreeId: z.string().optional().describe("Filter to tasks linked to this worktree"),
   status: taskStatusSchema,
   limit: z.number().optional().describe("Maximum results")
-});
+}).refine(
+  (input) => Boolean(input.topicId || input.worktreeId || input.linkedWorktreeId),
+  {
+    message: "topicId or worktreeId is required"
+  }
+);
 function compactRecord3(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, value]) => value !== void 0)
@@ -5093,7 +6946,7 @@ var listTasksProjection = defineProjection({
     linkedWorktreeId: input.linkedWorktreeId ?? input.worktreeId
   }),
   convexArgsValidator: v.object({
-    topicId: v.string(),
+    topicId: v.optional(v.string()),
     status: v.optional(
       v.union(
         v.literal("todo"),
@@ -6071,19 +7924,23 @@ var FIND_CONTRADICTIONS = {
 };
 var CREATE_EDGE = {
   name: "create_edge",
-  description: "Commit a typed relationship between two nodes in the reasoning graph. Like `git commit` \u2014 an atomic write that declares a dependency between nodes. The engine enforces layer transition rules \u2014 for example, L1 \u2192 L3 direct edges are forbidden (must go through L2).",
+  description: "Commit a typed relationship between two nodes in the reasoning graph. Like `git commit` \u2014 an atomic write that declares a dependency between nodes. Accepts any public epistemic edge type between public graph node refs so agents can author the full spine.",
   parameters: {
-    sourceId: {
-      type: "string",
-      description: "Source node of the relationship"
+    from: {
+      type: "object",
+      description: "Source graph ref, e.g. { kind: 'epistemic_node', nodeId: '...', nodeType: 'topic' }"
     },
-    targetId: {
-      type: "string",
-      description: "Target node of the relationship"
+    to: {
+      type: "object",
+      description: "Target graph ref, e.g. { kind: 'epistemic_node', nodeId: '...', nodeType: 'belief' }"
     },
     edgeType: {
       type: "string",
-      description: "Relationship type (informs, tests, depends_on, supersedes, etc.)"
+      description: "Relationship type from the public epistemic edge enum."
+    },
+    globalId: {
+      type: "string",
+      description: "Optional idempotent edge global ID."
     },
     weight: {
       type: "number",
@@ -6093,10 +7950,14 @@ var CREATE_EDGE = {
     reasoningMethod: {
       type: "string",
       description: "How this was determined",
-      enum: ["deductive", "inductive", "abductive", "analogical", "empirical"]
+      enum: [...REASONING_METHODS]
+    },
+    metadata: {
+      type: "object",
+      description: "Optional edge metadata."
     }
   },
-  required: ["sourceId", "targetId", "edgeType"],
+  required: ["from", "to", "edgeType"],
   response: {
     description: "The created edge",
     fields: {
@@ -6110,6 +7971,240 @@ var CREATE_EDGE = {
   ontologyPrimitive: "edge",
   tier: "showcase"
 };
+var UPDATE_EDGE = {
+  name: "update_edge",
+  description: "Amend metadata on an existing graph edge. Like `git commit --amend` \u2014 changes the edge annotation without recreating the relationship.",
+  parameters: {
+    edgeId: { type: "string", description: "Edge ID or global ID to update" },
+    weight: { type: "number", description: "Updated edge weight" },
+    confidence: { type: "number", description: "Updated confidence" },
+    context: { type: "string", description: "Updated human-readable context" },
+    derivationType: { type: "string", description: "Updated derivation type" },
+    metadata: { type: "object", description: "Updated metadata" }
+  },
+  required: ["edgeId"],
+  response: {
+    description: "Edge update result",
+    fields: { success: "boolean" }
+  },
+  ownerModule: "graph-primitives",
+  ontologyPrimitive: "edge",
+  tier: "workhorse"
+};
+var REMOVE_EDGE = {
+  name: "remove_edge",
+  description: "Remove one graph edge by ID. Like `git rm` \u2014 deletes a single explicit relationship from the spine.",
+  parameters: {
+    edgeId: { type: "string", description: "Edge ID or global ID to remove" }
+  },
+  required: ["edgeId"],
+  response: {
+    description: "Edge removal result",
+    fields: { success: "boolean" }
+  },
+  ownerModule: "graph-primitives",
+  ontologyPrimitive: "edge",
+  tier: "workhorse"
+};
+var REMOVE_EDGES_BETWEEN = {
+  name: "remove_edges_between",
+  description: "Remove graph edges between two nodes. Like `git rm <pathspec>` \u2014 deletes relationships matching a source, target, and optional type.",
+  parameters: {
+    fromNodeId: { type: "string", description: "Source node ID or global ID" },
+    toNodeId: { type: "string", description: "Target node ID or global ID" },
+    edgeType: { type: "string", description: "Optional edge type filter" }
+  },
+  required: ["fromNodeId", "toNodeId"],
+  response: {
+    description: "Matched edge removal result",
+    fields: { deleted: "number" }
+  },
+  ownerModule: "graph-primitives",
+  ontologyPrimitive: "edge",
+  tier: "workhorse"
+};
+var BATCH_CREATE_EDGES = {
+  name: "batch_create_edges",
+  description: "Commit multiple typed graph edges. Like `git commit` with many staged paths \u2014 writes a batch of explicit relationships atomically per edge.",
+  parameters: {
+    edges: {
+      type: "array",
+      description: "Edges to create, each with from, to, edgeType, and optional weight/confidence/context."
+    },
+    skipLayerValidation: {
+      type: "boolean",
+      description: "Skip kernel layer validation for trusted materialization flows."
+    }
+  },
+  required: ["edges"],
+  response: {
+    description: "Batch edge creation result",
+    fields: {
+      created: "number",
+      results: "array",
+      errors: "array"
+    }
+  },
+  ownerModule: "graph-primitives",
+  ontologyPrimitive: "edge",
+  tier: "workhorse"
+};
+var CREATE_EPISTEMIC_NODE = {
+  name: "create_epistemic_node",
+  description: "Commit a generic epistemic graph node. Like `git commit` \u2014 creates a canonical node in the public spine for topics, beliefs, evidence, questions, answers, sources, and entities.",
+  parameters: {
+    globalId: { type: "string", description: "Optional idempotent node global ID" },
+    nodeType: { type: "string", description: "Public epistemic node type" },
+    canonicalText: { type: "string", description: "Canonical node text" },
+    text: { type: "string", description: "Alias for canonicalText" },
+    contentHash: { type: "string", description: "Optional idempotency content hash" },
+    sourceType: { type: "string", description: "Source type for provenance" },
+    topicId: { type: "string", description: "Optional topic scope" },
+    content: { type: "string", description: "Extended content" },
+    title: { type: "string", description: "Display title" },
+    metadata: { type: "object", description: "Optional node metadata" }
+  },
+  required: ["nodeType"],
+  response: {
+    description: "Created node result",
+    fields: {
+      nodeId: "string",
+      nodeGlobalId: "string",
+      isDuplicate: "boolean"
+    }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "showcase"
+};
+var GET_EPISTEMIC_NODE = {
+  name: "get_epistemic_node",
+  description: "Read one epistemic graph node. Like `git show` \u2014 resolves a canonical spine node by ID or global ID.",
+  parameters: {
+    nodeId: { type: "string", description: "Node ID or global ID" }
+  },
+  required: ["nodeId"],
+  response: {
+    description: "The resolved node",
+    fields: { node: "object" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var LIST_EPISTEMIC_NODES = {
+  name: "list_epistemic_nodes",
+  description: "List epistemic graph nodes. Like `git ls-tree` \u2014 lists canonical spine nodes by topic, type, status, or search query.",
+  parameters: {
+    topicId: { type: "string", description: "Optional topic scope" },
+    nodeType: { type: "string", description: "Optional node type filter" },
+    status: { type: "string", description: "Optional lifecycle status" },
+    searchQuery: { type: "string", description: "Optional text search query" },
+    limit: { type: "number", description: "Maximum nodes to return" }
+  },
+  required: [],
+  response: {
+    description: "Matching nodes",
+    fields: { nodes: "array" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var UPDATE_EPISTEMIC_NODE = {
+  name: "update_epistemic_node",
+  description: "Amend an epistemic graph node. Like `git commit --amend` \u2014 updates mutable node metadata, text, status, or verification fields.",
+  parameters: {
+    nodeId: { type: "string", description: "Node ID or global ID" },
+    canonicalText: { type: "string", description: "Updated canonical text" },
+    text: { type: "string", description: "Alias for canonicalText" },
+    contentHash: { type: "string", description: "Updated content hash" },
+    content: { type: "string", description: "Updated content" },
+    title: { type: "string", description: "Updated display title" },
+    metadata: { type: "object", description: "Updated metadata" },
+    confidence: { type: "number", description: "Updated confidence" },
+    verificationStatus: { type: "string", description: "Updated verification status" },
+    status: { type: "string", description: "Updated lifecycle status" }
+  },
+  required: ["nodeId"],
+  response: {
+    description: "Node update result",
+    fields: { success: "boolean" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var ARCHIVE_EPISTEMIC_NODE = {
+  name: "archive_epistemic_node",
+  description: "Archive an epistemic graph node. Like `git rm --cached` \u2014 removes a node from active traversal without hard-deleting it.",
+  parameters: {
+    nodeId: { type: "string", description: "Node ID or global ID" }
+  },
+  required: ["nodeId"],
+  response: {
+    description: "Archive result",
+    fields: { success: "boolean", effectiveStatus: "string" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var VERIFY_EPISTEMIC_NODE = {
+  name: "verify_epistemic_node",
+  description: "Record verification state on an epistemic graph node. Like `git tag` \u2014 marks the node with a reviewed verification state.",
+  parameters: {
+    nodeId: { type: "string", description: "Node ID or global ID" },
+    verificationStatus: { type: "string", description: "Verification status" },
+    confidence: { type: "number", description: "Optional confidence update" }
+  },
+  required: ["nodeId", "verificationStatus"],
+  response: {
+    description: "Verification result",
+    fields: { success: "boolean" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var SUPERSEDE_EPISTEMIC_NODE = {
+  name: "supersede_epistemic_node",
+  description: "Supersede an epistemic graph node with a new version. Like `git commit --amend` on an immutable history branch \u2014 creates the replacement and marks the old node superseded.",
+  parameters: {
+    oldNodeId: { type: "string", description: "Node ID or global ID to supersede" },
+    newGlobalId: { type: "string", description: "Optional replacement global ID" },
+    newCanonicalText: { type: "string", description: "Replacement canonical text" },
+    text: { type: "string", description: "Alias for newCanonicalText" },
+    newContentHash: { type: "string", description: "Optional replacement content hash" },
+    reason: { type: "string", description: "Reason for superseding" }
+  },
+  required: ["oldNodeId"],
+  response: {
+    description: "Supersede result",
+    fields: { oldNodeId: "string", newNodeId: "string" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var BATCH_CREATE_EPISTEMIC_NODES = {
+  name: "batch_create_epistemic_nodes",
+  description: "Commit multiple epistemic graph nodes. Like `git commit` with many staged files \u2014 writes a batch of canonical spine nodes.",
+  parameters: {
+    nodes: {
+      type: "array",
+      description: "Nodes to create with nodeType, canonicalText/text, and optional metadata."
+    }
+  },
+  required: ["nodes"],
+  response: {
+    description: "Batch node creation result",
+    fields: { created: "number", results: "array" }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
 var RECORD_JUDGMENT = {
   name: "record_judgment",
   description: "Record a judgment \u2014 an irreversible commitment based on the current epistemic state. Like a `git tag` marking a release. A judgment synthesizes beliefs, evidence, and uncertainties into a determination. Once issued, a judgment is evaluated against the epistemic state that existed when it was made (knowledge horizon evaluation, Invariant #10).",
@@ -7309,8 +9404,8 @@ var IDENTITY_WHOAMI = {
   response: {
     description: "Canonical identity summary for the current session",
     fields: {
-      principalId: "string \u2014 canonical federated principal identifier",
-      principalType: "string \u2014 human, service, or agent",
+      principalId: "string \u2014 canonical principal identifier; for humans this is the Clerk user_... ID",
+      principalType: "string \u2014 human, service, agent, group, or external_viewer",
       tenantId: "string | undefined \u2014 resolved tenant scope",
       workspaceId: "string | undefined \u2014 resolved workspace scope",
       scopes: "string[] | undefined \u2014 granted scopes for this session",
@@ -7321,6 +9416,49 @@ var IDENTITY_WHOAMI = {
   ontologyPrimitive: "identity",
   tier: "workhorse"
 };
+var RESOLVE_INTERACTIVE_PRINCIPAL = {
+  name: "resolve_interactive_principal",
+  description: "Read the Permit-backed Lucern principal context for an authenticated Clerk user. Like `git config --get user.email` plus the repository ACL \u2014 resolves the Clerk subject into tenant/workspace authorization context.",
+  parameters: {
+    clerkId: {
+      type: "string",
+      description: "Authenticated Clerk subject (`sub`). Clerk proves identity only; it is not the authorization record."
+    },
+    tenantId: {
+      type: "string",
+      description: "Optional tenant scope. Omit only when the Clerk alias is globally unambiguous."
+    },
+    workspaceId: {
+      type: "string",
+      description: "Optional workspace scope. Required when the principal has access to multiple workspaces and no default can be inferred."
+    },
+    providerProjectId: {
+      type: "string",
+      description: "Optional Clerk project or provider instance id for tenants with multiple identity providers."
+    }
+  },
+  required: ["clerkId"],
+  response: {
+    description: "Permit-backed Lucern principal context for tenant SDK bootstrap",
+    fields: {
+      principalId: "string \u2014 canonical Clerk user_... ID for human sessions",
+      principalType: "string \u2014 human, service, agent, group, or external_viewer",
+      clerkId: "string \u2014 authenticated Clerk subject alias",
+      tenantId: "string \u2014 resolved tenant scope",
+      workspaceId: "string | null \u2014 resolved workspace scope",
+      roles: "string[] \u2014 effective Permit roles",
+      scopes: "string[] \u2014 effective scopes derived from Permit/control-plane projection",
+      groupIds: "string[] \u2014 active Permit group memberships",
+      principalStatus: "string \u2014 active, invited, suspended, disabled, revoked, or missing",
+      tenantStatus: "string \u2014 projected tenant resource status",
+      workspaceStatus: "string \u2014 projected workspace resource status",
+      permit: "object \u2014 Permit subject, tenant, and optional workspace tuple"
+    }
+  },
+  ownerModule: "control-plane",
+  ontologyPrimitive: "identity",
+  tier: "workhorse"
+};
 var COMPILE_CONTEXT = {
   name: "compile_context",
   description: "Compile a focused reasoning context. If topicId is omitted, Lucern resolves the best topic from the query. Like `git log --graph --decorate` for the reasoning substrate \u2014 returns the canonical Pillar 3 context pack through the public API shape.",
@@ -7582,6 +9720,10 @@ var CREATE_TASK = {
     tags: {
       type: "array",
       description: "Free-form string tags"
+    },
+    metadata: {
+      type: "object",
+      description: "Structured task metadata for handoff context and routing hints"
     }
   },
   required: ["title"],
@@ -7655,6 +9797,10 @@ var UPDATE_TASK = {
       type: "string",
       description: "Updated status",
       enum: ["todo", "in_progress", "blocked", "done"]
+    },
+    metadata: {
+      type: "object",
+      description: "Structured task metadata to replace or refine"
     }
   },
   required: ["taskId"],
@@ -7702,6 +9848,10 @@ var CREATE_TOPIC = {
   name: "create_topic",
   description: "Create a new topic container for scoping knowledge. Like `git init` \u2014 initializes a new repository for a knowledge domain. Topics are hierarchical: a deal topic can nest under a theme topic. Types: domain, theme, deal, strategy, constitution, project, portfolio.",
   parameters: {
+    globalId: {
+      type: "string",
+      description: "Optional idempotent topic global ID"
+    },
     name: { type: "string", description: "Topic name" },
     type: {
       type: "string",
@@ -7712,6 +9862,18 @@ var CREATE_TOPIC = {
       type: "string",
       description: "Optional parent topic for nesting"
     },
+    parentTopicGlobalId: {
+      type: "string",
+      description: "Optional parent topic global ID for nesting"
+    },
+    tenantId: { type: "string", description: "Optional tenant scope" },
+    workspaceId: { type: "string", description: "Optional workspace scope" },
+    visibility: {
+      type: "string",
+      description: "Topic visibility",
+      enum: ["private", "team", "firm", "external", "public"]
+    },
+    metadata: { type: "object", description: "Optional topic metadata" },
     createdBy: { type: "string", description: "Who created this topic" }
   },
   required: ["name", "type"],
@@ -7720,6 +9882,9 @@ var CREATE_TOPIC = {
     fields: {
       id: "string \u2014 topic ID",
       globalId: "string \u2014 globally unique ID",
+      topicGlobalId: "string \u2014 topic global ID",
+      epistemicNodeId: "string \u2014 materialized topic node ID",
+      epistemicNodeGlobalId: "string \u2014 materialized topic node global ID",
       depth: "number \u2014 nesting depth"
     }
   },
@@ -7850,6 +10015,65 @@ var GET_TOPIC_TREE = {
   ontologyPrimitive: "graph",
   tier: "workhorse"
 };
+var MATERIALIZE_TOPIC_GRAPH = {
+  name: "materialize_topic_graph",
+  description: "Backfill the topic graph spine. Like `git fsck --connectivity-only` with repair enabled \u2014 creates missing topic nodes and parent-child edges idempotently.",
+  parameters: {
+    rootTopicId: {
+      type: "string",
+      description: "Optional root topic for a bounded materialization pass"
+    },
+    dryRun: {
+      type: "boolean",
+      description: "When true, report missing rows without writing them"
+    }
+  },
+  required: [],
+  response: {
+    description: "Topic graph materialization counts",
+    fields: {
+      topicsSeen: "number",
+      nodesCreated: "number",
+      nodesExisting: "number",
+      edgesCreated: "number",
+      edgesExisting: "number",
+      errors: "array"
+    }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
+var GET_TOPIC_GRAPH_SPINE = {
+  name: "get_topic_graph_spine",
+  description: "Verify the topic graph spine. Like `git fsck` \u2014 reads topics, materialized topic nodes, parent-child edges, and missing spine rows.",
+  parameters: {
+    rootTopicId: {
+      type: "string",
+      description: "Optional root topic for a bounded verifier pass"
+    },
+    includeTopicBeliefEdges: {
+      type: "boolean",
+      description: "Include topic -> belief edges in the verifier payload"
+    }
+  },
+  required: [],
+  response: {
+    description: "Topic graph spine verification payload",
+    fields: {
+      ok: "boolean",
+      counts: "object",
+      topics: "array",
+      topicNodes: "array",
+      parentEdges: "array",
+      missingTopicNodes: "array",
+      missingParentEdges: "array"
+    }
+  },
+  ownerModule: "reasoning-kernel",
+  ontologyPrimitive: "graph",
+  tier: "workhorse"
+};
 var GET_CODE_CONTEXT = {
   name: "get_code_context",
   description: "Returns code-grounded beliefs, contracts, migration states, and failed attempts anchored to a specific file or function path. Like `git log -- <path>` \u2014 filters the knowledge graph to nodes anchored to a file path via metadata.codeAnchors. Results are separated by coding belief type: decisions, contracts, migrations, patterns, deprecations, and failures.",
@@ -8045,7 +10269,7 @@ var MANAGE_WRITE_POLICY = {
     },
     role: {
       type: "string",
-      description: "Role to set policy for (required for 'set'). E.g. 'agent:internal', 'user:analyst'."
+      description: "Role to set policy for (required for 'set'). E.g. 'agent:internal' or a Permit role key such as 'workspace_admin'."
     },
     permission: {
       type: "string",
@@ -9032,6 +11256,9 @@ var BEGIN_BUILD_SESSION = {
       sessionMode: "string \u2014 async | interactive",
       targetBeliefIds: "array \u2014 scoped belief IDs",
       targetQuestionIds: "array \u2014 scoped question IDs",
+      taskIds: "array \u2014 assigned task IDs for this worktree",
+      incompleteTaskIds: "array \u2014 assigned task IDs that still require done/deferred/blocked proof",
+      tasks: "array \u2014 assigned task packet with id, title, status, priority, links, and summaries",
       topBeliefs: "array \u2014 highest-confidence scoped beliefs",
       openQuestions: "array \u2014 open scoped questions",
       resolvedDecisions: "array \u2014 answered questions summarized for the session",
@@ -9087,6 +11314,19 @@ var MCP_TOOL_CONTRACTS = {
   bisect_confidence: BISECT_CONFIDENCE,
   // Edges (commit)
   create_edge: CREATE_EDGE,
+  update_edge: UPDATE_EDGE,
+  remove_edge: REMOVE_EDGE,
+  remove_edges_between: REMOVE_EDGES_BETWEEN,
+  batch_create_edges: BATCH_CREATE_EDGES,
+  // Epistemic node spine (commit/amend/show)
+  create_epistemic_node: CREATE_EPISTEMIC_NODE,
+  get_epistemic_node: GET_EPISTEMIC_NODE,
+  list_epistemic_nodes: LIST_EPISTEMIC_NODES,
+  update_epistemic_node: UPDATE_EPISTEMIC_NODE,
+  archive_epistemic_node: ARCHIVE_EPISTEMIC_NODE,
+  verify_epistemic_node: VERIFY_EPISTEMIC_NODE,
+  supersede_epistemic_node: SUPERSEDE_EPISTEMIC_NODE,
+  batch_create_epistemic_nodes: BATCH_CREATE_EPISTEMIC_NODES,
   // Judgments (tag)
   record_judgment: RECORD_JUDGMENT,
   // Graph intelligence (showcase)
@@ -9121,6 +11361,7 @@ var MCP_TOOL_CONTRACTS = {
   update_worktree_targets: UPDATE_WORKTREE_TARGETS,
   update_worktree_metadata: UPDATE_WORKTREE_METADATA,
   identity_whoami: IDENTITY_WHOAMI,
+  resolve_interactive_principal: RESOLVE_INTERACTIVE_PRINCIPAL,
   compile_context: COMPILE_CONTEXT,
   record_scope_learning: RECORD_SCOPE_LEARNING,
   pipeline_snapshot: PIPELINE_SNAPSHOT,
@@ -9160,6 +11401,8 @@ var MCP_TOOL_CONTRACTS = {
   get_topic: GET_TOPIC,
   update_topic: UPDATE_TOPIC,
   get_topic_tree: GET_TOPIC_TREE,
+  materialize_topic_graph: MATERIALIZE_TOPIC_GRAPH,
+  get_topic_graph_spine: GET_TOPIC_GRAPH_SPINE,
   // Coding intelligence (code-grounded knowledge)
   get_code_context: GET_CODE_CONTEXT,
   get_change_history: GET_CHANGE_HISTORY,
@@ -9236,6 +11479,7 @@ function entries(names, surfaceClass, surfaceIntent, surfaces, rationale) {
 var MCP_CORE_OPERATION_NAMES = [
   "compile_context",
   "identity_whoami",
+  "resolve_interactive_principal",
   "check_permission",
   "filter_by_permission",
   "create_belief",
@@ -9264,14 +11508,28 @@ var MCP_CORE_OPERATION_NAMES = [
   "find_missing_questions",
   "get_high_priority_questions",
   "get_falsification_questions",
+  "create_epistemic_node",
+  "get_epistemic_node",
+  "list_epistemic_nodes",
+  "update_epistemic_node",
+  "archive_epistemic_node",
+  "verify_epistemic_node",
+  "supersede_epistemic_node",
+  "batch_create_epistemic_nodes",
   "create_topic",
   "get_topic",
   "list_topics",
   "update_topic",
-  "get_topic_tree"
+  "get_topic_tree",
+  "materialize_topic_graph",
+  "get_topic_graph_spine"
 ];
 var MCP_ANALYSIS_PLATFORM_OPERATION_NAMES = [
   "create_edge",
+  "update_edge",
+  "remove_edge",
+  "remove_edges_between",
+  "batch_create_edges",
   "query_lineage",
   "traverse_graph",
   "get_graph_neighborhood",
@@ -9603,12 +11861,20 @@ function unwrapMcpParameterSchema(schema) {
         current = current._def.schema;
         continue;
       default:
-        return { schema: current, required, description: description ?? current.description };
+        return {
+          schema: current,
+          required,
+          description: description ?? current.description
+        };
     }
   }
 }
 function mcpParameterFromZod(fieldName, schema, contractName) {
-  const { schema: unwrapped, required, description: schemaDescription } = unwrapMcpParameterSchema(schema);
+  const {
+    schema: unwrapped,
+    required,
+    description: schemaDescription
+  } = unwrapMcpParameterSchema(schema);
   const description = schemaDescription ?? unwrapped.description ?? fieldName;
   switch (unwrapped._def.typeName) {
     case z.ZodFirstPartyTypeKind.ZodString:
@@ -9653,10 +11919,12 @@ function mcpContractFromArgsSchema(base, args, contractName) {
   const entries2 = Object.entries(getObjectShape(args)).sort(
     ([left], [right]) => left.localeCompare(right)
   );
-  const converted = entries2.map(([fieldName, schema]) => [
-    fieldName,
-    mcpParameterFromZod(fieldName, schema, contractName)
-  ]);
+  const converted = entries2.map(
+    ([fieldName, schema]) => [
+      fieldName,
+      mcpParameterFromZod(fieldName, schema, contractName)
+    ]
+  );
   return {
     ...base,
     parameters: Object.fromEntries(
@@ -9765,9 +12033,16 @@ function surfaceContract(args) {
       scopes: args.scopes ?? [
         args.kind === "query" ? `${args.domain}.read` : `${args.domain}.write`
       ],
-      allowedPrincipalTypes: ["user", "service", "agent"]
+      allowedPrincipalTypes: [
+        "user",
+        "service",
+        "agent",
+        "group",
+        "external_viewer"
+      ]
     },
     convex: args.convex,
+    gateway: args.gateway,
     args: canonicalArgs,
     returns: canonicalReturns,
     input,
@@ -9906,8 +12181,6 @@ var contextContracts = [
     args: observationContextArgs
   })
 ];
-
-// ../contracts/src/function-registry/identity.ts
 var withPrincipal = (input, context) => ({
   ...input,
   tenantId: input.tenantId ?? context.tenantId,
@@ -9926,11 +12199,30 @@ var identityContracts = [
     sdkNamespace: "identity",
     sdkMethod: "whoami",
     summary: "Describe the current gateway principal.",
+    gateway: {
+      handler: "identity.whoami"
+    }
+  }),
+  surfaceContract({
+    name: "resolve_interactive_principal",
+    kind: "query",
+    domain: "controlPlane",
+    surfaceClass: "platform_public",
+    method: "POST",
+    path: "/control-plane/identity/resolve-interactive-principal",
+    sdkNamespace: "controlPlane.identity",
+    sdkMethod: "resolveInteractivePrincipal",
+    summary: "Resolve an authenticated Clerk user into a Permit-backed Lucern principal context.",
+    args: z.object({
+      clerkId: z.string().min(1),
+      tenantId: z.string().min(1).optional(),
+      workspaceId: z.string().min(1).optional(),
+      providerProjectId: z.string().min(1).optional()
+    }),
     convex: {
-      module: "identity",
-      functionName: "whoami",
-      kind: "query",
-      inputProjection: withPrincipal
+      module: "platform",
+      functionName: "resolveInteractivePrincipal",
+      kind: "query"
     }
   }),
   surfaceContract({
@@ -10012,15 +12304,6 @@ var beliefLookupInput = (input) => compactRecord4({
 var beliefNodeInput = (input) => compactRecord4({
   nodeId: input.nodeId ?? input.id ?? input.beliefId
 });
-var beliefTopicInput = (input) => {
-  const parsed = listBeliefsProjection.inputSchema.safeParse(input);
-  if (!parsed.success) {
-    throw new Error(
-      `list_beliefs projection input rejected: ${parsed.error.message}`
-    );
-  }
-  return compactRecord4(listBeliefsProjection.project(parsed.data));
-};
 var createBeliefInput = (input, context) => {
   return withUserId(
     compactRecord4({
@@ -10109,11 +12392,8 @@ var beliefsContracts = [
     sdkNamespace: "beliefs",
     sdkMethod: "listBeliefs",
     summary: "List beliefs for a topic.",
-    convex: {
-      module: "beliefs",
-      functionName: "getByTopic",
-      kind: "query",
-      inputProjection: beliefTopicInput
+    gateway: {
+      handler: "beliefs.list"
     },
     args: listBeliefsInputSchema
   }),
@@ -10254,7 +12534,7 @@ var beliefsContracts = [
   })
 ];
 var jsonRecordSchema4 = z.record(z.unknown());
-var evidenceRelationSchema = z.enum(["supports", "contradicts", "neutral"]);
+var evidenceRelationSchema = z.enum(["supports", "contradicts"]);
 var createEvidenceArgs = z.object({
   topicId: z.string().optional().describe("Topic scope for the evidence."),
   text: z.string().describe("Canonical evidence text."),
@@ -10298,12 +12578,6 @@ var evidenceIdInput = (input) => compactRecord4({
   insightId: input.insightId,
   nodeId: input.nodeId ?? input.id ?? input.evidenceId
 });
-var evidenceTopicInput = (input) => compactRecord4({
-  topicId: input.topicId,
-  status: input.status,
-  userId: input.userId,
-  limit: input.limit
-});
 var createEvidenceInput = (input, context) => {
   const parsed = createEvidenceProjection.inputSchema.safeParse(input);
   if (!parsed.success) {
@@ -10434,11 +12708,8 @@ var evidenceContracts = [
     sdkNamespace: "evidence",
     sdkMethod: "listEvidence",
     summary: "List evidence for a topic.",
-    convex: {
-      module: "evidence",
-      functionName: "getByTopic",
-      kind: "query",
-      inputProjection: evidenceTopicInput
+    gateway: {
+      handler: "evidence.list"
     }
   }),
   surfaceContract({
@@ -10673,11 +12944,8 @@ var questionsContracts = [
     sdkNamespace: "questions",
     sdkMethod: "listQuestions",
     summary: "List questions for a topic.",
-    convex: {
-      module: "questions",
-      functionName: "getByTopic",
-      kind: "query",
-      inputProjection: questionTopicInput
+    gateway: {
+      handler: "questions.list"
     }
   }),
   surfaceContract({
@@ -10880,18 +13148,50 @@ var questionsContracts = [
     args: falsificationQuestionsArgs
   })
 ];
+var topicVisibilitySchema = z.enum([
+  "private",
+  "team",
+  "firm",
+  "external",
+  "public"
+]);
+var topicStatusSchema = z.enum(["active", "archived", "watching"]);
+var createTopicArgs = z.object({
+  globalId: z.string().optional().describe("Optional idempotent topic global ID."),
+  name: z.string().describe("Topic name."),
+  description: z.string().optional().describe("Topic description."),
+  type: z.string().describe("Topic type."),
+  parentTopicId: z.string().optional().describe("Optional parent topic ID."),
+  parentTopicGlobalId: z.string().optional().describe("Optional parent topic global ID."),
+  ontologyId: z.string().optional().describe("Ontology to bind."),
+  tenantId: z.string().optional().describe("Optional tenant scope."),
+  workspaceId: z.string().optional().describe("Optional workspace scope."),
+  visibility: topicVisibilitySchema.optional().describe("Topic visibility."),
+  metadata: z.record(z.unknown()).optional().describe("Topic metadata."),
+  graphScopeProjectId: z.string().optional(),
+  createdBy: z.string().optional()
+});
 var updateTopicArgs = z.object({
   id: z.string().describe("Topic ID."),
   topicId: z.string().optional().describe("Topic ID alias."),
   name: z.string().optional().describe("Topic name."),
   description: z.string().optional().describe("Topic description."),
   type: z.string().optional().describe("Topic type."),
-  status: z.string().optional().describe("Topic status."),
-  visibility: z.string().optional().describe("Topic visibility."),
+  status: topicStatusSchema.optional().describe("Topic status."),
+  visibility: topicVisibilitySchema.optional().describe("Topic visibility."),
   ontologyId: z.string().optional().describe("Ontology to bind."),
   clearOntologyId: z.boolean().optional().describe("Whether to clear the ontology binding."),
   metadata: z.record(z.unknown()).optional().describe("Topic metadata.")
 });
+var materializeTopicGraphArgs = z.object({
+  rootTopicId: z.string().optional().describe("Optional root topic ID."),
+  dryRun: z.boolean().optional().describe("Report missing rows without writing."),
+  createdBy: z.string().optional()
+});
+var getTopicGraphSpineArgs = z.object({
+  rootTopicId: z.string().optional().describe("Optional root topic ID."),
+  includeTopicBeliefEdges: z.boolean().optional()
+});
 var topicIdInput = (input) => compactRecord4({
   id: input.id ?? input.topicId
 });
@@ -10909,87 +13209,488 @@ var updateTopicInput = (input) => compactRecord4({
 });
 var topicsContracts = [
   surfaceContract({
-    name: "create_topic",
+    name: "create_topic",
+    kind: "mutation",
+    domain: "topics",
+    surfaceClass: "platform_public",
+    path: "/topics",
+    sdkNamespace: "topics",
+    sdkMethod: "createTopic",
+    summary: "Create a topic.",
+    convex: {
+      module: "topics",
+      functionName: "create",
+      kind: "mutation",
+      inputProjection: withCreatedBy
+    },
+    args: createTopicArgs
+  }),
+  surfaceContract({
+    name: "get_topic",
+    kind: "query",
+    domain: "topics",
+    surfaceClass: "platform_public",
+    method: "GET",
+    path: "/topics/get",
+    sdkNamespace: "topics",
+    sdkMethod: "getTopic",
+    summary: "Get a topic.",
+    convex: {
+      module: "topics",
+      functionName: "get",
+      kind: "query",
+      inputProjection: topicIdInput
+    }
+  }),
+  surfaceContract({
+    name: "list_topics",
+    kind: "query",
+    domain: "topics",
+    surfaceClass: "platform_public",
+    method: "GET",
+    path: "/topics",
+    sdkNamespace: "topics",
+    sdkMethod: "listTopics",
+    summary: "List topics.",
+    convex: {
+      module: "topics",
+      functionName: "list",
+      kind: "query"
+    }
+  }),
+  surfaceContract({
+    name: "update_topic",
+    kind: "mutation",
+    domain: "topics",
+    surfaceClass: "platform_public",
+    method: "PATCH",
+    path: "/topics",
+    sdkNamespace: "topics",
+    sdkMethod: "updateTopic",
+    summary: "Update a topic.",
+    convex: {
+      module: "topics",
+      functionName: "update",
+      kind: "mutation",
+      inputProjection: updateTopicInput
+    },
+    args: updateTopicArgs
+  }),
+  surfaceContract({
+    name: "get_topic_tree",
+    kind: "query",
+    domain: "topics",
+    surfaceClass: "platform_public",
+    method: "GET",
+    path: "/topics/tree",
+    sdkNamespace: "topics",
+    sdkMethod: "getTopicTree",
+    summary: "Get a topic tree.",
+    convex: {
+      module: "topics",
+      functionName: "getTree",
+      kind: "query"
+    }
+  }),
+  surfaceContract({
+    name: "materialize_topic_graph",
+    kind: "mutation",
+    domain: "topics",
+    surfaceClass: "platform_public",
+    path: "/topics/materialize-graph",
+    sdkNamespace: "topics",
+    sdkMethod: "materializeTopicGraph",
+    summary: "Materialize topic nodes and parent-child graph edges.",
+    convex: {
+      module: "topics",
+      functionName: "materializeTopicGraph",
+      kind: "mutation",
+      inputProjection: withCreatedBy
+    },
+    args: materializeTopicGraphArgs
+  }),
+  surfaceContract({
+    name: "get_topic_graph_spine",
+    kind: "query",
+    domain: "topics",
+    surfaceClass: "platform_public",
+    method: "GET",
+    path: "/topics/graph-spine",
+    sdkNamespace: "topics",
+    sdkMethod: "getTopicGraphSpine",
+    summary: "Verify topic nodes and parent-child graph edges.",
+    convex: {
+      module: "topics",
+      functionName: "getTopicGraphSpine",
+      kind: "query"
+    },
+    args: getTopicGraphSpineArgs
+  })
+];
+var sourceTypeSchema2 = z.enum([
+  "human",
+  "ai_extracted",
+  "ai_generated",
+  "imported",
+  "system",
+  "verified",
+  "proprietary"
+]);
+var verificationStatusSchema = z.enum([
+  "unverified",
+  "human_verified",
+  "ai_verified",
+  "contradicted",
+  "outdated"
+]);
+var nodeStatusSchema = z.enum([
+  "active",
+  "superseded",
+  "archived",
+  "deleted"
+]);
+var externalIdsArgs = z.object({
+  crunchbase: z.string().optional(),
+  linkedin: z.string().optional(),
+  pitchbook: z.string().optional(),
+  twitter: z.string().optional(),
+  website: z.string().optional()
+}).optional();
+var createEpistemicNodeItemArgs = z.object({
+  globalId: z.string().optional().describe("Optional idempotent node global ID."),
+  nodeType: NODE_TYPE.describe("Public epistemic node type."),
+  subtype: z.string().optional(),
+  canonicalText: z.string().optional().describe("Canonical node text."),
+  text: z.string().optional().describe("Alias for canonicalText."),
+  contentHash: z.string().optional().describe("Optional idempotency content hash."),
+  content: z.string().optional(),
+  contentType: z.string().optional(),
+  title: z.string().optional(),
+  tags: z.array(z.string()).optional(),
+  domain: z.string().optional(),
+  metadata: z.record(z.unknown()).optional(),
+  externalIds: externalIdsArgs,
+  sourceType: sourceTypeSchema2.optional(),
+  aiProvider: z.string().optional(),
+  extractedFromNodeId: z.string().optional(),
+  confidence: z.number().optional(),
+  verificationStatus: verificationStatusSchema.optional(),
+  topicId: z.string().optional(),
+  projectId: z.string().optional(),
+  createdBy: z.string().optional(),
+  trustedBypassAccessCheck: z.boolean().optional()
+});
+var createEpistemicNodeArgs = createEpistemicNodeItemArgs;
+var batchCreateEpistemicNodesArgs = z.object({
+  nodes: z.array(createEpistemicNodeItemArgs)
+});
+var getEpistemicNodeArgs = z.object({
+  nodeId: z.string().describe("Node ID or global ID."),
+  globalId: z.string().optional().describe("Node global ID alias.")
+});
+var listEpistemicNodesArgs = z.object({
+  topicId: z.string().optional(),
+  projectId: z.string().optional(),
+  nodeType: NODE_TYPE.optional(),
+  status: nodeStatusSchema.optional(),
+  searchQuery: z.string().optional(),
+  query: z.string().optional(),
+  limit: z.number().optional()
+});
+var updateEpistemicNodeArgs = z.object({
+  nodeId: z.string().describe("Node ID or global ID."),
+  id: z.string().optional().describe("Node ID alias."),
+  subtype: z.string().optional(),
+  canonicalText: z.string().optional(),
+  text: z.string().optional(),
+  contentHash: z.string().optional(),
+  content: z.string().optional(),
+  contentType: z.string().optional(),
+  title: z.string().optional(),
+  tags: z.array(z.string()).optional(),
+  domain: z.string().optional(),
+  metadata: z.record(z.unknown()).optional(),
+  externalIds: externalIdsArgs,
+  confidence: z.number().optional(),
+  verificationStatus: verificationStatusSchema.optional(),
+  status: nodeStatusSchema.optional(),
+  userId: z.string().optional(),
+  trustedBypassAccessCheck: z.boolean().optional()
+});
+var archiveEpistemicNodeArgs = z.object({
+  nodeId: z.string().describe("Node ID or global ID."),
+  id: z.string().optional().describe("Node ID alias."),
+  userId: z.string().optional(),
+  trustedBypassAccessCheck: z.boolean().optional()
+});
+var verifyEpistemicNodeArgs = z.object({
+  nodeId: z.string().describe("Node ID or global ID."),
+  id: z.string().optional().describe("Node ID alias."),
+  verificationStatus: verificationStatusSchema,
+  confidence: z.number().optional(),
+  userId: z.string().optional()
+});
+var supersedeEpistemicNodeArgs = z.object({
+  oldNodeId: z.string().describe("Node ID or global ID to supersede."),
+  nodeId: z.string().optional().describe("Old node ID alias."),
+  newGlobalId: z.string().optional(),
+  newCanonicalText: z.string().optional(),
+  text: z.string().optional(),
+  canonicalText: z.string().optional(),
+  newContentHash: z.string().optional(),
+  reason: z.string().optional(),
+  createdBy: z.string().optional(),
+  trustedBypassAccessCheck: z.boolean().optional()
+});
+function generatedGlobalId(prefix) {
+  return `${prefix}:${crypto.randomUUID()}`;
+}
+function resolveCanonicalText(input) {
+  const text = input.canonicalText ?? input.text ?? input.title ?? input.content;
+  if (typeof text !== "string" || text.trim().length === 0) {
+    throw new Error("canonicalText or text is required.");
+  }
+  return text;
+}
+function createNodeInput(input, context) {
+  const canonicalText = resolveCanonicalText(input);
+  const nodeType = String(input.nodeType);
+  return withCreatedBy(
+    compactRecord4({
+      globalId: typeof input.globalId === "string" && input.globalId.trim() ? input.globalId : generatedGlobalId(nodeType),
+      nodeType,
+      subtype: input.subtype,
+      canonicalText,
+      contentHash: typeof input.contentHash === "string" && input.contentHash.trim() ? input.contentHash : `${nodeType}:${canonicalText}`,
+      content: input.content,
+      contentType: input.contentType,
+      title: input.title,
+      tags: input.tags,
+      domain: input.domain,
+      metadata: input.metadata,
+      externalIds: input.externalIds,
+      sourceType: typeof input.sourceType === "string" && input.sourceType.trim() ? input.sourceType : "human",
+      aiProvider: input.aiProvider,
+      extractedFromNodeId: input.extractedFromNodeId,
+      confidence: input.confidence,
+      verificationStatus: input.verificationStatus,
+      topicId: input.topicId,
+      projectId: input.projectId
+    }),
+    context
+  );
+}
+var getNodeInput = (input) => compactRecord4({
+  nodeId: input.nodeId ?? input.globalId
+});
+var listNodesInput = (input) => compactRecord4({
+  topicId: input.topicId,
+  projectId: input.projectId,
+  nodeType: input.nodeType,
+  status: input.status,
+  searchQuery: input.searchQuery ?? input.query,
+  limit: input.limit
+});
+var updateNodeInput = (input, context) => withUserId(
+  compactRecord4({
+    nodeId: input.nodeId ?? input.id,
+    subtype: input.subtype,
+    canonicalText: input.canonicalText ?? input.text,
+    contentHash: input.contentHash,
+    content: input.content,
+    contentType: input.contentType,
+    title: input.title,
+    tags: input.tags,
+    domain: input.domain,
+    metadata: input.metadata,
+    externalIds: input.externalIds,
+    confidence: input.confidence,
+    verificationStatus: input.verificationStatus,
+    status: input.status,
+    trustedBypassAccessCheck: input.trustedBypassAccessCheck
+  }),
+  context
+);
+var archiveNodeInput = (input, context) => withUserId(
+  compactRecord4({
+    nodeId: input.nodeId ?? input.id,
+    trustedBypassAccessCheck: input.trustedBypassAccessCheck
+  }),
+  context
+);
+var verifyNodeInput = (input, context) => withUserId(
+  compactRecord4({
+    nodeId: input.nodeId ?? input.id,
+    verificationStatus: input.verificationStatus,
+    confidence: input.confidence
+  }),
+  context
+);
+var supersedeNodeInput = (input, context) => {
+  const newCanonicalText = input.newCanonicalText ?? input.canonicalText ?? input.text;
+  if (typeof newCanonicalText !== "string" || newCanonicalText.trim().length === 0) {
+    throw new Error("newCanonicalText or text is required.");
+  }
+  return {
+    oldNodeId: input.oldNodeId ?? input.nodeId,
+    newGlobalId: typeof input.newGlobalId === "string" && input.newGlobalId.trim() ? input.newGlobalId : generatedGlobalId("node"),
+    newCanonicalText,
+    newContentHash: typeof input.newContentHash === "string" && input.newContentHash.trim() ? input.newContentHash : `superseded:${newCanonicalText}`,
+    createdBy: typeof input.createdBy === "string" ? input.createdBy : authUserId(context),
+    reason: input.reason,
+    trustedBypassAccessCheck: input.trustedBypassAccessCheck
+  };
+};
+var batchCreateNodesInput = (input, context) => {
+  const nodes = Array.isArray(input.nodes) ? input.nodes : [];
+  return {
+    nodes: nodes.map(
+      (node) => createNodeInput(
+        node && typeof node === "object" ? node : {},
+        context
+      )
+    )
+  };
+};
+var nodesContracts = [
+  surfaceContract({
+    name: "create_epistemic_node",
     kind: "mutation",
-    domain: "topics",
+    domain: "nodes",
     surfaceClass: "platform_public",
-    path: "/topics",
-    sdkNamespace: "topics",
-    sdkMethod: "createTopic",
-    summary: "Create a topic.",
+    path: "/nodes",
+    sdkNamespace: "nodes",
+    sdkMethod: "createEpistemicNode",
+    summary: "Create a generic epistemic graph node.",
     convex: {
-      module: "topics",
+      module: "nodes",
       functionName: "create",
       kind: "mutation",
-      inputProjection: withCreatedBy
-    }
+      inputProjection: createNodeInput
+    },
+    args: createEpistemicNodeArgs
   }),
   surfaceContract({
-    name: "get_topic",
+    name: "get_epistemic_node",
     kind: "query",
-    domain: "topics",
+    domain: "nodes",
     surfaceClass: "platform_public",
     method: "GET",
-    path: "/topics/get",
-    sdkNamespace: "topics",
-    sdkMethod: "getTopic",
-    summary: "Get a topic.",
+    path: "/nodes/get",
+    sdkNamespace: "nodes",
+    sdkMethod: "getEpistemicNode",
+    summary: "Get a generic epistemic graph node.",
     convex: {
-      module: "topics",
+      module: "nodes",
       functionName: "get",
       kind: "query",
-      inputProjection: topicIdInput
-    }
+      inputProjection: getNodeInput
+    },
+    args: getEpistemicNodeArgs
   }),
   surfaceContract({
-    name: "list_topics",
+    name: "list_epistemic_nodes",
     kind: "query",
-    domain: "topics",
+    domain: "nodes",
     surfaceClass: "platform_public",
     method: "GET",
-    path: "/topics",
-    sdkNamespace: "topics",
-    sdkMethod: "listTopics",
-    summary: "List topics.",
+    path: "/nodes",
+    sdkNamespace: "nodes",
+    sdkMethod: "listEpistemicNodes",
+    summary: "List generic epistemic graph nodes.",
     convex: {
-      module: "topics",
+      module: "nodes",
       functionName: "list",
-      kind: "query"
-    }
+      kind: "query",
+      inputProjection: listNodesInput
+    },
+    args: listEpistemicNodesArgs
   }),
   surfaceContract({
-    name: "update_topic",
+    name: "update_epistemic_node",
     kind: "mutation",
-    domain: "topics",
+    domain: "nodes",
     surfaceClass: "platform_public",
     method: "PATCH",
-    path: "/topics",
-    sdkNamespace: "topics",
-    sdkMethod: "updateTopic",
-    summary: "Update a topic.",
+    path: "/nodes",
+    sdkNamespace: "nodes",
+    sdkMethod: "updateEpistemicNode",
+    summary: "Update a generic epistemic graph node.",
     convex: {
-      module: "topics",
+      module: "nodes",
       functionName: "update",
       kind: "mutation",
-      inputProjection: updateTopicInput
+      inputProjection: updateNodeInput
     },
-    args: updateTopicArgs
+    args: updateEpistemicNodeArgs
   }),
   surfaceContract({
-    name: "get_topic_tree",
-    kind: "query",
-    domain: "topics",
+    name: "archive_epistemic_node",
+    kind: "mutation",
+    domain: "nodes",
     surfaceClass: "platform_public",
-    method: "GET",
-    path: "/topics/tree",
-    sdkNamespace: "topics",
-    sdkMethod: "getTopicTree",
-    summary: "Get a topic tree.",
+    path: "/nodes/archive",
+    sdkNamespace: "nodes",
+    sdkMethod: "archiveEpistemicNode",
+    summary: "Archive a generic epistemic graph node.",
     convex: {
-      module: "topics",
-      functionName: "getTree",
-      kind: "query"
-    }
+      module: "nodes",
+      functionName: "archive",
+      kind: "mutation",
+      inputProjection: archiveNodeInput
+    },
+    args: archiveEpistemicNodeArgs
+  }),
+  surfaceContract({
+    name: "verify_epistemic_node",
+    kind: "mutation",
+    domain: "nodes",
+    surfaceClass: "platform_public",
+    path: "/nodes/verify",
+    sdkNamespace: "nodes",
+    sdkMethod: "verifyEpistemicNode",
+    summary: "Verify a generic epistemic graph node.",
+    convex: {
+      module: "nodes",
+      functionName: "verify",
+      kind: "mutation",
+      inputProjection: verifyNodeInput
+    },
+    args: verifyEpistemicNodeArgs
+  }),
+  surfaceContract({
+    name: "supersede_epistemic_node",
+    kind: "mutation",
+    domain: "nodes",
+    surfaceClass: "platform_public",
+    path: "/nodes/supersede",
+    sdkNamespace: "nodes",
+    sdkMethod: "supersedeEpistemicNode",
+    summary: "Supersede a generic epistemic graph node.",
+    convex: {
+      module: "nodes",
+      functionName: "supersede",
+      kind: "mutation",
+      inputProjection: supersedeNodeInput
+    },
+    args: supersedeEpistemicNodeArgs
+  }),
+  surfaceContract({
+    name: "batch_create_epistemic_nodes",
+    kind: "mutation",
+    domain: "nodes",
+    surfaceClass: "platform_public",
+    path: "/nodes/batch",
+    sdkNamespace: "nodes",
+    sdkMethod: "batchCreateEpistemicNodes",
+    summary: "Batch create generic epistemic graph nodes.",
+    convex: {
+      module: "nodes",
+      functionName: "batchCreate",
+      kind: "mutation",
+      inputProjection: batchCreateNodesInput
+    },
+    args: batchCreateEpistemicNodesArgs
   })
 ];
 var lensPerspectiveSchema = z.enum([
@@ -11349,6 +14050,19 @@ var worktreeEvidenceSignalInputSchema = z.object({
   progress: z.string().optional().describe("Collection progress note for the signal."),
   notes: z.string().optional().describe("Additional evidence collection notes.")
 }).passthrough().describe("Evidence signal embedded in the worktree plan.");
+var worktreeDocCompanionTargetSchema = z.object({
+  docPath: z.string().describe(
+    "Repo-relative path to a documentation file the worktree promises to update."
+  ),
+  sectionAnchor: z.string().optional().describe(
+    "Markdown heading anchor (e.g. '## Function-surface manifest') that scopes the promised update."
+  ),
+  reason: z.string().describe(
+    "Why this doc section must be updated for the worktree to be complete."
+  )
+}).passthrough().describe(
+  "Intent-driven docs companion target. pr-gate-reviewer verifies that the PR actually touches each declared (docPath, sectionAnchor). Distinct from the touch-driven docs-loop. See docs/development/docs-sync-discipline.md Lock 3."
+);
 var worktreeDecisionGateInputSchema = z.object({
   goCriteria: z.array(z.string()).describe("Criteria that must hold for the worktree to proceed."),
   noGoSignals: z.array(z.string()).describe("Signals that stop or redirect the worktree."),
@@ -11381,6 +14095,9 @@ var addWorktreeArgs = z.object({
   keyQuestions: z.array(worktreeKeyQuestionInputSchema).optional().describe("Inline key questions captured as part of the worktree plan."),
   evidenceSignals: z.array(worktreeEvidenceSignalInputSchema).optional().describe("Evidence signals the worktree needs to collect or validate."),
   decisionGate: worktreeDecisionGateInputSchema.optional(),
+  docCompanionTargets: z.array(worktreeDocCompanionTargetSchema).optional().describe(
+    "Doc sections the worktree promises to update at PR time. Enforced by pr-gate-reviewer (Lock 3)."
+  ),
   goCriteria: z.array(z.string()).optional().describe("Shorthand go criteria used to build decisionGate."),
   noGoSignals: z.array(z.string()).optional().describe("Shorthand no-go signals used to build decisionGate."),
   proofArtifacts: z.array(z.unknown()).optional().describe("Expected proof artifacts required to close the worktree."),
@@ -11744,7 +14461,21 @@ var createTaskArgs = z.object({
   linkedQuestionId: z.string().optional().describe("Question this task addresses."),
   assigneeId: z.string().optional().describe("Principal assigned to the task."),
   dueDate: z.number().optional().describe("Due date as epoch milliseconds."),
-  tags: z.array(z.string()).optional().describe("Free-form tags.")
+  tags: z.array(z.string()).optional().describe("Free-form tags."),
+  metadata: z.record(z.unknown()).optional().describe("Structured task metadata for handoff context and routing hints.")
+});
+var updateTaskArgs = z.object({
+  taskId: z.string().describe("Task to update."),
+  title: z.string().optional().describe("Updated task title."),
+  description: z.string().optional().describe("Updated task description."),
+  priority: taskPrioritySchema.optional().describe("Updated priority."),
+  status: taskStatusSchema2.optional().describe("Updated status."),
+  linkedWorktreeId: z.string().optional().describe("Worktree this task belongs to."),
+  linkedBeliefId: z.string().optional().describe("Belief this task supports."),
+  linkedQuestionId: z.string().optional().describe("Question this task addresses."),
+  assigneeId: z.string().optional().describe("Principal assigned to the task."),
+  blockedReason: z.string().optional().describe("Reason the task is blocked or deferred."),
+  metadata: z.record(z.unknown()).optional().describe("Structured task metadata for handoff context and routing hints.")
 });
 var createTaskInput = (input) => compactRecord4({
   title: input.title,
@@ -11758,7 +14489,8 @@ var createTaskInput = (input) => compactRecord4({
   linkedQuestionId: input.linkedQuestionId,
   assigneeId: input.assigneeId,
   dueDate: input.dueDate,
-  tags: input.tags
+  tags: input.tags,
+  metadata: input.metadata
 });
 var taskInput = (input) => compactRecord4({
   ...input,
@@ -11775,8 +14507,7 @@ var taskTopicInput = (input) => {
 };
 var completeTaskInput = (input) => compactRecord4({
   taskId: input.taskId ?? input.id,
-  outputSummary: input.outputSummary ?? input.summary,
-  userId: input.userId
+  outputSummary: input.outputSummary ?? input.summary
 });
 var tasksContracts = [
   surfaceContract({
@@ -11794,6 +14525,7 @@ var tasksContracts = [
       kind: "mutation",
       inputProjection: createTaskInput
     },
+    gateway: { handler: "tasks.create" },
     args: createTaskArgs
   }),
   surfaceContract({
@@ -11812,6 +14544,7 @@ var tasksContracts = [
       kind: "query",
       inputProjection: taskTopicInput
     },
+    gateway: { handler: "tasks.list" },
     args: listTasksInputSchema
   }),
   surfaceContract({
@@ -11829,7 +14562,9 @@ var tasksContracts = [
       functionName: "update",
       kind: "mutation",
       inputProjection: taskInput
-    }
+    },
+    gateway: { handler: "tasks.update" },
+    args: updateTaskArgs
   }),
   surfaceContract({
     name: "complete_task",
@@ -11845,12 +14580,14 @@ var tasksContracts = [
       functionName: "complete",
       kind: "mutation",
       inputProjection: completeTaskInput
-    }
+    },
+    gateway: { handler: "tasks.complete" }
   })
 ];
 var CREATE_EDGE_TYPES = edgePolicyManifest.policies.map(
   (policy) => policy.edgeType
 );
+var REASONING_METHOD_TYPES = [...REASONING_METHODS];
 var createEdgeArgs = z.object({
   from: GraphRefSchema,
   to: GraphRefSchema,
@@ -11860,10 +14597,37 @@ var createEdgeArgs = z.object({
   confidence: z.number().optional(),
   context: z.string().optional(),
   reasoning: z.string().optional(),
+  reasoningMethod: z.enum(REASONING_METHOD_TYPES).optional(),
   derivationType: z.string().optional(),
+  metadata: z.record(z.unknown()).optional(),
   topicId: z.string().optional(),
   trustedBypassAccessCheck: z.boolean().optional()
 });
+var updateEdgeArgs = z.object({
+  edgeId: z.string().describe("Edge ID or global ID."),
+  weight: z.number().optional(),
+  confidence: z.number().optional(),
+  context: z.string().optional(),
+  reasoning: z.string().optional(),
+  derivationType: z.string().optional(),
+  metadata: z.record(z.unknown()).optional(),
+  userId: z.string().optional()
+});
+var removeEdgeArgs = z.object({
+  edgeId: z.string().describe("Edge ID or global ID."),
+  userId: z.string().optional()
+});
+var removeEdgesBetweenArgs = z.object({
+  from: GraphRefSchema.optional(),
+  to: GraphRefSchema.optional(),
+  fromNodeId: z.string().optional(),
+  toNodeId: z.string().optional(),
+  edgeType: z.enum(CREATE_EDGE_TYPES).optional()
+});
+var batchCreateEdgesArgs = z.object({
+  edges: z.array(createEdgeArgs),
+  skipLayerValidation: z.boolean().optional()
+});
 var queryLineageArgs = z.object({
   nodeId: z.string().describe("Starting node to trace from."),
   startNode: z.string().optional().describe("Starting node alias accepted by traversal callers."),
@@ -11912,7 +14676,9 @@ var edgesContracts = [
             weight: parsed.weight,
             confidence: parsed.confidence,
             context: parsed.context ?? parsed.reasoning,
+            reasoningMethod: parsed.reasoningMethod,
             derivationType: parsed.derivationType,
+            metadata: parsed.metadata,
             skipLayerValidation: true,
             topicId: parsed.topicId,
             trustedBypassAccessCheck: parsed.trustedBypassAccessCheck
@@ -11923,6 +14689,131 @@ var edgesContracts = [
     },
     args: createEdgeArgs
   }),
+  surfaceContract({
+    name: "update_edge",
+    kind: "mutation",
+    domain: "edges",
+    surfaceClass: "platform_public",
+    method: "PATCH",
+    path: "/edges",
+    sdkNamespace: "edges",
+    sdkMethod: "updateEdge",
+    summary: "Update an epistemic edge.",
+    convex: {
+      module: "edges",
+      functionName: "update",
+      kind: "mutation",
+      inputProjection: (input, context) => compactRecord4({
+        edgeId: input.edgeId,
+        weight: input.weight,
+        confidence: input.confidence,
+        context: input.context ?? input.reasoning,
+        derivationType: input.derivationType,
+        metadata: input.metadata,
+        userId: input.userId ?? context.userId ?? context.principalId
+      })
+    },
+    args: updateEdgeArgs
+  }),
+  surfaceContract({
+    name: "remove_edge",
+    kind: "mutation",
+    domain: "edges",
+    surfaceClass: "platform_public",
+    method: "DELETE",
+    path: "/edges",
+    sdkNamespace: "edges",
+    sdkMethod: "removeEdge",
+    summary: "Remove an epistemic edge.",
+    convex: {
+      module: "edges",
+      functionName: "remove",
+      kind: "mutation",
+      inputProjection: (input, context) => compactRecord4({
+        edgeId: input.edgeId,
+        userId: input.userId ?? context.userId ?? context.principalId
+      })
+    },
+    args: removeEdgeArgs
+  }),
+  surfaceContract({
+    name: "remove_edges_between",
+    kind: "mutation",
+    domain: "edges",
+    surfaceClass: "platform_public",
+    method: "DELETE",
+    path: "/edges/between",
+    sdkNamespace: "edges",
+    sdkMethod: "removeEdgesBetween",
+    summary: "Remove epistemic edges between two nodes.",
+    convex: {
+      module: "edges",
+      functionName: "removeBetween",
+      kind: "mutation",
+      inputProjection: (input) => {
+        const parsed = removeEdgesBetweenArgs.parse(input);
+        const fromNodeId = parsed.from ? graphRefNodeId(parsed.from) : parsed.fromNodeId;
+        const toNodeId = parsed.to ? graphRefNodeId(parsed.to) : parsed.toNodeId;
+        if (!fromNodeId || !toNodeId) {
+          throw new Error("from/to or fromNodeId/toNodeId are required.");
+        }
+        return compactRecord4({
+          fromNodeId,
+          toNodeId,
+          edgeType: parsed.edgeType
+        });
+      }
+    },
+    args: removeEdgesBetweenArgs
+  }),
+  surfaceContract({
+    name: "batch_create_edges",
+    kind: "mutation",
+    domain: "edges",
+    surfaceClass: "platform_public",
+    path: "/edges/batch",
+    sdkNamespace: "edges",
+    sdkMethod: "batchCreateEdges",
+    summary: "Batch create epistemic edges.",
+    convex: {
+      module: "edges",
+      functionName: "batchCreate",
+      kind: "mutation",
+      inputProjection: (input, context) => {
+        const parsed = batchCreateEdgesArgs.parse(input);
+        return {
+          skipLayerValidation: parsed.skipLayerValidation ?? true,
+          edges: parsed.edges.map((edge) => {
+            assertEdgePolicyAllowed(
+              edgePolicyManifest,
+              edge.edgeType,
+              edge.from,
+              edge.to
+            );
+            const fromNodeId = graphRefNodeId(edge.from);
+            const toNodeId = graphRefNodeId(edge.to);
+            return withCreatedBy(
+              compactRecord4({
+                fromNodeId,
+                toNodeId,
+                edgeType: edge.edgeType,
+                globalId: edge.globalId ?? `edge:${fromNodeId}:${toNodeId}:${edge.edgeType}`,
+                weight: edge.weight,
+                confidence: edge.confidence,
+                context: edge.context ?? edge.reasoning,
+                reasoningMethod: edge.reasoningMethod,
+                derivationType: edge.derivationType,
+                metadata: edge.metadata,
+                topicId: edge.topicId
+              }),
+              context
+            );
+          })
+        };
+      }
+    },
+    args: batchCreateEdgesArgs
+  }),
   surfaceContract({
     name: "query_lineage",
     kind: "query",
@@ -12645,6 +15536,69 @@ var pipelineContracts = [
     }
   })
 ];
+function isRecord3(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function stringValues(value) {
+  if (typeof value === "string") {
+    return [value];
+  }
+  if (Array.isArray(value)) {
+    return value.flatMap((item) => stringValues(item));
+  }
+  return [];
+}
+function nestedEvidenceRows(value) {
+  if (Array.isArray(value)) {
+    return value.flatMap((item) => nestedEvidenceRows(item));
+  }
+  if (!isRecord3(value)) {
+    return [];
+  }
+  const nestedKeys = ["evidence", "items", "nodes"];
+  const nestedRows = nestedKeys.flatMap((key) => nestedEvidenceRows(value[key]));
+  return nestedRows.length > 0 ? nestedRows : [value];
+}
+function isFailedAttemptRow(row) {
+  const metadata = isRecord3(row.metadata) ? row.metadata : null;
+  return metadata?.failedApproach === true || metadata?.isFailedAttempt === true;
+}
+function failureLogSearchFields(row) {
+  const metadata = isRecord3(row.metadata) ? row.metadata : null;
+  return [
+    ...stringValues(row.id),
+    ...stringValues(row._id),
+    ...stringValues(row.title),
+    ...stringValues(row.text),
+    ...stringValues(row.canonicalText),
+    ...stringValues(row.content),
+    ...stringValues(metadata?.codeAnchor),
+    ...stringValues(metadata?.codeAnchors),
+    ...stringValues(metadata?.anchor),
+    ...stringValues(metadata?.anchors),
+    ...stringValues(metadata?.filePath),
+    ...stringValues(metadata?.filePaths),
+    ...stringValues(metadata?.path),
+    ...stringValues(metadata?.paths),
+    ...stringValues(metadata?.sourceRef),
+    ...stringValues(metadata?.touchedPaths)
+  ];
+}
+function projectFailureLog(output, input) {
+  const rawQuery = typeof input.query === "string" && input.query.trim().length > 0 ? input.query.trim() : void 0;
+  const searchKey = rawQuery?.toLowerCase();
+  const failures = nestedEvidenceRows(output).filter((row) => isFailedAttemptRow(row)).filter(
+    (row) => !searchKey ? true : failureLogSearchFields(row).some(
+      (field) => field.toLowerCase().includes(searchKey)
+    )
+  );
+  return {
+    query: rawQuery,
+    failures,
+    totalFound: failures.length,
+    showing: failures.length
+  };
+}
 var recordScopeLearningArgs = z.object({
   topicId: z.string().optional().describe("Topic scope ID"),
   summary: z.string().describe("Atomic learning statement"),
@@ -12734,6 +15688,8 @@ var attemptInput = (input, context) => withUserId(
     tags: ["code_attempt"],
     metadata: compactRecord4({
       ...recordValue2(input.metadata),
+      failedApproach: true,
+      isFailedAttempt: true,
       filePaths: input.filePaths,
       filePath: input.filePath,
       errorMessage: input.errorMessage,
@@ -12864,7 +15820,8 @@ var codingContracts = [
         limit: input.limit,
         status: input.status,
         userId: input.userId
-      })
+      }),
+      outputProjection: (output, input) => projectFailureLog(output, input)
     }
   })
 ];
@@ -12901,6 +15858,7 @@ var ALL_FUNCTION_CONTRACTS = [
   ...evidenceContracts,
   ...questionsContracts,
   ...topicsContracts,
+  ...nodesContracts,
   ...lensesContracts,
   ...ontologiesContracts,
   ...worktreesContracts,
@@ -13076,6 +16034,13 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     copyMode: "none",
     description: "Deliberation sessions are created by tenant workflows."
   },
+  {
+    component: "kernel",
+    table: "domainEvents",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Domain event rows are append-only runtime audit/exhaust data."
+  },
   {
     component: "kernel",
     table: "epistemicAudit",
@@ -13325,14 +16290,14 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Worktrees are tenant/runtime planning data."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "agents",
     prepopulation: "runtime_bootstrap",
     copyMode: "none",
     description: "Service agents are provisioned per tenant or service, not copied."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "mcpWritePolicy",
     prepopulation: "required_template",
     copyMode: "template_global",
@@ -13341,14 +16306,14 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Global write policy defaults govern service and interactive MCP writes."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "modelCallLogs",
     prepopulation: "runtime_log",
     copyMode: "none",
     description: "Model call logs are runtime telemetry."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "modelFunctionSlots",
     prepopulation: "required_template",
     copyMode: "template_global",
@@ -13357,7 +16322,7 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Function-to-model slots are required by model runtime resolution."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "modelRegistry",
     prepopulation: "required_template",
     copyMode: "template_global",
@@ -13366,7 +16331,7 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Model catalog defaults are required by model runtime clients."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "modelSlotConfigs",
     prepopulation: "required_template",
     copyMode: "template_global",
@@ -13375,14 +16340,105 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Slot-level defaults are required before tenant overrides exist."
   },
   {
-    component: "identity",
+    component: "control-plane",
+    table: "permitAccessReviewItems",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit access-review item rows are tenant review data projected from Permit."
+  },
+  {
+    component: "control-plane",
+    table: "permitAccessReviews",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit access-review campaigns are tenant review data projected from Permit."
+  },
+  {
+    component: "control-plane",
+    table: "permitAttributeBindings",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit ABAC attribute bindings are tenant policy projection rows."
+  },
+  {
+    component: "control-plane",
+    table: "permitGroups",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit groups are tenant-defined policy subjects, not template data."
+  },
+  {
+    component: "control-plane",
+    table: "permitGroupMemberships",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit group memberships are tenant-specific policy projection rows."
+  },
+  {
+    component: "control-plane",
+    table: "permitPolicyBundles",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Permit policy bundles are derived from the Permit control plane."
+  },
+  {
+    component: "control-plane",
+    table: "permitPolicyDecisionReceipts",
+    prepopulation: "runtime_log",
+    copyMode: "none",
+    description: "Permit decision receipts are runtime authorization audit logs."
+  },
+  {
+    component: "control-plane",
+    table: "permitPrincipalAliases",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit principal aliases are tenant-specific identity projection rows."
+  },
+  {
+    component: "control-plane",
+    table: "permitPrincipals",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit principals are projected from Clerk, Permit, and tenant onboarding flows."
+  },
+  {
+    component: "control-plane",
+    table: "permitProjectionOutbox",
+    prepopulation: "runtime_queue",
+    copyMode: "none",
+    description: "Permit projection outbox rows are runtime sync queue data."
+  },
+  {
+    component: "control-plane",
+    table: "permitRelationshipTuples",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit ReBAC relationship tuples are tenant policy projection rows."
+  },
+  {
+    component: "control-plane",
+    table: "permitResourceInstances",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit resource instances are tenant/workspace graph and deployment projection rows."
+  },
+  {
+    component: "control-plane",
+    table: "permitRoleAssignments",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Permit role assignments are tenant-specific policy projection rows."
+  },
+  {
+    component: "control-plane",
     table: "platformAudienceGrants",
     prepopulation: "runtime_data",
     copyMode: "none",
     description: "Audience grants are principal/group-specific access rows."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "platformAudiences",
     prepopulation: "required_template",
     copyMode: "template_tenant_rewrite",
@@ -13391,35 +16447,35 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Default tenant audience taxonomy rows are rewritten into each tenant."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "platformPolicyDecisionLogs",
     prepopulation: "runtime_log",
     copyMode: "none",
     description: "Policy decisions are runtime audit logs."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "projectGrants",
     prepopulation: "runtime_data",
     copyMode: "none",
     description: "Project/topic grants are principal or group-specific access rows."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "reasoningPermissions",
     prepopulation: "runtime_data",
     copyMode: "none",
     description: "Reasoning permissions are principal-specific policy rows."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantApiKeys",
     prepopulation: "runtime_secret",
     copyMode: "none",
     description: "API keys are tenant credentials and must never be copied."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantConfig",
     prepopulation: "required_template",
     copyMode: "template_tenant_rewrite",
@@ -13428,7 +16484,7 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Tenant-local config defaults are rewritten during bootstrap."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantIntegrations",
     prepopulation: "required_template",
     copyMode: "template_tenant_rewrite",
@@ -13437,14 +16493,21 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Non-secret integration descriptors are rewritten into each tenant."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantModelSlotBindings",
     prepopulation: "runtime_secret",
     copyMode: "none",
     description: "Tenant model slot bindings reference provider secrets and are runtime-only."
   },
   {
-    component: "identity",
+    component: "control-plane",
+    table: "tenantPermitSyncStates",
+    prepopulation: "runtime_derived",
+    copyMode: "none",
+    description: "Tenant Permit sync state rows are runtime reconciliation state."
+  },
+  {
+    component: "control-plane",
     table: "tenantPolicies",
     prepopulation: "required_template",
     copyMode: "template_tenant_rewrite",
@@ -13453,42 +16516,42 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Default tenant policy roles are rewritten during bootstrap."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantProviderSecrets",
     prepopulation: "runtime_secret",
     copyMode: "none",
     description: "Provider secrets are credentials and must never be copied."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantProxyGatewayUsage",
     prepopulation: "runtime_log",
     copyMode: "none",
     description: "Proxy gateway usage rows are runtime telemetry."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantProxyTokenMints",
     prepopulation: "runtime_secret",
     copyMode: "none",
     description: "Proxy token mints are ephemeral secret-bearing runtime rows."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantSandboxAuditEvents",
     prepopulation: "runtime_log",
     copyMode: "none",
     description: "Sandbox audit rows are runtime security logs."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "tenantSecrets",
     prepopulation: "runtime_secret",
     copyMode: "none",
     description: "Tenant secrets are credentials and must never be copied."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "toolAcls",
     prepopulation: "required_template",
     copyMode: "template_global",
@@ -13497,7 +16560,7 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Default role-to-tool grants are required for SDK/MCP tool access."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "toolRegistry",
     prepopulation: "required_template",
     copyMode: "template_global",
@@ -13506,7 +16569,7 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     description: "Core tool catalog rows are required before pack or tenant tools exist."
   },
   {
-    component: "identity",
+    component: "control-plane",
     table: "users",
     prepopulation: "runtime_bootstrap",
     copyMode: "none",