@m8t-stack/cli 0.2.18 → 0.2.20

package/dist/cli.js

@@ -1227,7 +1227,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.18";
+var CLI_VERSION = "0.2.20";
 
 // src/lib/render-error.ts
 init_errors();
@@ -3326,12 +3326,12 @@ function encodeURIPath(str4) {
   return str4.replace(/[^A-Za-z0-9\-._~!$&'()*+,;=:@]+/g, encodeURIComponent);
 }
 var EMPTY = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.create(null));
-var createPathTagFunction = (pathEncoder = encodeURIPath) => function path32(statics, ...params) {
+var createPathTagFunction = (pathEncoder = encodeURIPath) => function path37(statics, ...params) {
   if (statics.length === 1)
     return statics[0];
   let postPath = false;
   const invalidSegments = [];
-  const path33 = statics.reduce((previousValue, currentValue, index) => {
+  const path38 = statics.reduce((previousValue, currentValue, index) => {
     if (/[?#]/.test(currentValue)) {
       postPath = true;
     }
@@ -3348,7 +3348,7 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path32(sta
     }
     return previousValue + currentValue + (index === params.length ? "" : encoded);
   }, "");
-  const pathOnly = path33.split(/[?#]/, 1)[0];
+  const pathOnly = path38.split(/[?#]/, 1)[0];
   const invalidSegmentPattern = /(?<=^|\/)(?:\.|%2e){1,2}(?=\/|$)/gi;
   let match;
   while ((match = invalidSegmentPattern.exec(pathOnly)) !== null) {
@@ -3369,10 +3369,10 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path32(sta
     }, "");
     throw new OpenAIError(`Path parameters result in path with invalid segments:
 ${invalidSegments.map((e) => e.error).join("\n")}
-${path33}
+${path38}
 ${underline}`);
   }
-  return path33;
+  return path38;
 };
 var path = /* @__PURE__ */ createPathTagFunction(encodeURIPath);
 
@@ -10889,9 +10889,9 @@ var OpenAI = class {
     this.apiKey = token;
     return true;
   }
-  buildURL(path32, query, defaultBaseURL) {
+  buildURL(path37, query, defaultBaseURL) {
     const baseURL = !__classPrivateFieldGet(this, _OpenAI_instances, "m", _OpenAI_baseURLOverridden).call(this) && defaultBaseURL || this.baseURL;
-    const url = isAbsoluteURL(path32) ? new URL(path32) : new URL(baseURL + (baseURL.endsWith("/") && path32.startsWith("/") ? path32.slice(1) : path32));
+    const url = isAbsoluteURL(path37) ? new URL(path37) : new URL(baseURL + (baseURL.endsWith("/") && path37.startsWith("/") ? path37.slice(1) : path37));
     const defaultQuery = this.defaultQuery();
     const pathQuery = Object.fromEntries(url.searchParams);
     if (!isEmptyObj(defaultQuery) || !isEmptyObj(pathQuery)) {
@@ -10919,24 +10919,24 @@ var OpenAI = class {
    */
   async prepareRequest(request, { url, options }) {
   }
-  get(path32, opts) {
-    return this.methodRequest("get", path32, opts);
+  get(path37, opts) {
+    return this.methodRequest("get", path37, opts);
   }
-  post(path32, opts) {
-    return this.methodRequest("post", path32, opts);
+  post(path37, opts) {
+    return this.methodRequest("post", path37, opts);
   }
-  patch(path32, opts) {
-    return this.methodRequest("patch", path32, opts);
+  patch(path37, opts) {
+    return this.methodRequest("patch", path37, opts);
   }
-  put(path32, opts) {
-    return this.methodRequest("put", path32, opts);
+  put(path37, opts) {
+    return this.methodRequest("put", path37, opts);
   }
-  delete(path32, opts) {
-    return this.methodRequest("delete", path32, opts);
+  delete(path37, opts) {
+    return this.methodRequest("delete", path37, opts);
   }
-  methodRequest(method, path32, opts) {
+  methodRequest(method, path37, opts) {
     return this.request(Promise.resolve(opts).then((opts2) => {
-      return { method, path: path32, ...opts2 };
+      return { method, path: path37, ...opts2 };
     }));
   }
   request(options, remainingRetries = null) {
@@ -11058,8 +11058,8 @@ var OpenAI = class {
     }));
     return { response, options, controller, requestLogID, retryOfRequestLogID, startTime };
   }
-  getAPIList(path32, Page2, opts) {
-    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path32, ...opts2 })) : { method: "get", path: path32, ...opts });
+  getAPIList(path37, Page2, opts) {
+    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path37, ...opts2 })) : { method: "get", path: path37, ...opts });
   }
   requestAPIList(Page2, options) {
     const request = this.makeRequest(options, null, void 0);
@@ -11153,8 +11153,8 @@ var OpenAI = class {
   }
   async buildRequest(inputOptions, { retryCount = 0 } = {}) {
     const options = { ...inputOptions };
-    const { method, path: path32, query, defaultBaseURL } = options;
-    const url = this.buildURL(path32, query, defaultBaseURL);
+    const { method, path: path37, query, defaultBaseURL } = options;
+    const url = this.buildURL(path37, query, defaultBaseURL);
     if ("timeout" in options)
       validatePositiveInteger("timeout", options.timeout);
     options.timeout = options.timeout ?? this.timeout;
@@ -12156,10 +12156,10 @@ var BindListCommand = class extends M8tCommand {
     const qs = new URLSearchParams();
     if (this.channel) qs.set("channel", this.channel);
     if (this.status) qs.set("status", this.status);
-    const path32 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
+    const path37 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
     const data = await apiCall(
       { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },
-      { method: "GET", path: path32 },
+      { method: "GET", path: path37 },
       (msg) => this.context.stderr.write(msg + "\n")
     );
     if (mode === "json") {
@@ -13197,6 +13197,13 @@ var defaultGhExec = (cmd, args) => new Promise((resolve3) => {
   const child = spawn2(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
   let stdout = "";
   let stderr = "";
+  let settled = false;
+  const done = (r) => {
+    if (!settled) {
+      settled = true;
+      resolve3(r);
+    }
+  };
   child.stdout.on("data", (d) => {
     stdout += d.toString();
   });
@@ -13204,7 +13211,10 @@ var defaultGhExec = (cmd, args) => new Promise((resolve3) => {
     stderr += d.toString();
   });
   child.on("close", (code) => {
-    resolve3({ stdout, stderr, exitCode: code ?? -1 });
+    done({ stdout, stderr, exitCode: code ?? -1 });
+  });
+  child.on("error", (err) => {
+    done({ stdout, stderr: stderr || err.message, exitCode: -1 });
   });
 });
 async function isGhAuthed(exec = defaultGhExec) {
@@ -13360,8 +13370,8 @@ ${r.stderr}`;
         message: `gh api /repos/${slug} failed (exit ${r.exitCode.toString()}): ${(r.stderr || r.stdout).slice(0, 200)}`
       });
     },
-    getFile: async (path32) => {
-      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path32}`]);
+    getFile: async (path37) => {
+      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path37}`]);
       return r.exitCode === 0 ? r.stdout : null;
     },
     isEmpty: async () => {
@@ -13535,15 +13545,21 @@ function discoverKvUri(env, override) {
     hint: "Pass --kv-uri or set AZURE_KEYVAULT_URI / KEYVAULT_URI."
   });
 }
-function resolveRepoRoot() {
+function tryResolveRepoRoot() {
   const marker = path5.join(os2.homedir(), ".m8t-stack", "repo-root");
-  if (!fs5.existsSync(marker)) {
+  if (!fs5.existsSync(marker)) return null;
+  const root = fs5.readFileSync(marker, "utf8").trim();
+  return root.length > 0 ? root : null;
+}
+function resolveRepoRoot() {
+  const root = tryResolveRepoRoot();
+  if (root === null) {
     throw new LocalCliError({
       code: "M8T_REPO_ROOT_MISSING",
       message: "~/.m8t-stack/repo-root marker missing \u2014 m8t install never completed."
     });
   }
-  return fs5.readFileSync(marker, "utf8").trim();
+  return root;
 }
 
 // src/commands/brain/check-app.ts
@@ -13599,11 +13615,11 @@ var BrainCheckAppCommand = class extends M8tCommand {
 // src/commands/brain/create.ts
 init_esm2();
 import { Command as Command18, Option as Option17 } from "clipanion";
-import { spawnSync } from "child_process";
+import { execFileSync, spawnSync } from "child_process";
 import { readFileSync as readFileSync6 } from "fs";
-import * as fs10 from "fs";
+import * as fs11 from "fs";
 import * as os4 from "os";
-import * as path9 from "path";
+import * as path10 from "path";
 import * as readline2 from "readline/promises";
 import { DefaultAzureCredential as DefaultAzureCredential4 } from "@azure/identity";
 init_errors();
@@ -14119,11 +14135,66 @@ async function createBrainEnabledVersion(args) {
 
 // src/lib/brain-seed.ts
 init_errors();
+import * as fs10 from "fs";
+import * as path9 from "path";
+
+// src/lib/seed-manifest.ts
 import * as fs9 from "fs";
 import * as path8 from "path";
+var SEED_MANIFEST_PATH = ".m8t/seed-manifest.json";
+var SEED_PATHS = ["skills", "references", "targets"];
+function isLineage(v) {
+  if (!v || typeof v !== "object") return false;
+  const l = v;
+  return typeof l.name === "string" && typeof l.refreshedToCommit === "string" && typeof l.refreshedToVersion === "string" && Array.isArray(l.ownedPaths) && l.ownedPaths.every((p) => typeof p === "string");
+}
+function parseSeedManifest(text) {
+  if (!text?.trim()) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const m = parsed;
+  if (m.schemaVersion !== 1 || !Array.isArray(m.seeds) || !m.seeds.every(isLineage)) return null;
+  return { schemaVersion: 1, seeds: m.seeds };
+}
+function buildSeedManifest(seeds) {
+  return { schemaVersion: 1, seeds };
+}
+function upsertLineage(manifest, lineage) {
+  const prior = manifest?.seeds ?? [];
+  const others = prior.filter((s) => s.name !== lineage.name);
+  return { schemaVersion: 1, seeds: [...others, lineage].sort((a, b) => a.name.localeCompare(b.name)) };
+}
+function serializeSeedManifest(m) {
+  return JSON.stringify(m, null, 2) + "\n";
+}
+function walkFiles(root, rel = "") {
+  const abs = path8.join(root, rel);
+  if (!fs9.existsSync(abs)) return [];
+  const out = [];
+  for (const entry of fs9.readdirSync(abs, { withFileTypes: true })) {
+    const childRel = rel ? `${rel}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) out.push(...walkFiles(root, childRel));
+    else if (entry.isFile()) out.push(childRel);
+  }
+  return out;
+}
+function deriveOwnedPaths(seedDir) {
+  const owned = /* @__PURE__ */ new Set([SEED_MANIFEST_PATH]);
+  for (const sub of SEED_PATHS) {
+    for (const rel of walkFiles(path8.join(seedDir, sub))) owned.add(`${sub}/${rel}`);
+  }
+  return [...owned].sort((a, b) => a.localeCompare(b));
+}
+
+// src/lib/brain-seed.ts
 function resolveSeed(name) {
-  const dir = path8.join(resolveRepoRoot(), "brain-seeds", name);
-  if (!fs9.existsSync(dir)) {
+  const dir = path9.join(resolveRepoRoot(), "brain-seeds", name);
+  if (!fs10.existsSync(dir)) {
     throw new LocalCliError({
       code: "SEED_NOT_FOUND",
       message: `--seed "${name}": no brain-seeds/${name}/ directory found.`,
@@ -14133,11 +14204,22 @@ function resolveSeed(name) {
   return dir;
 }
 function materializeBrainTree(opts) {
-  fs9.cpSync(opts.templateSrc, opts.destDir, { recursive: true });
+  fs10.cpSync(opts.templateSrc, opts.destDir, { recursive: true });
   if (opts.seedDir) {
-    fs9.cpSync(opts.seedDir, opts.destDir, { recursive: true });
+    fs10.cpSync(opts.seedDir, opts.destDir, { recursive: true });
   }
 }
+function writeSeedMarker(args) {
+  const manifest = buildSeedManifest([{
+    name: args.seedName,
+    refreshedToCommit: args.refreshedToCommit,
+    refreshedToVersion: args.version,
+    ownedPaths: deriveOwnedPaths(args.seedDir)
+  }]);
+  const dest = path9.join(args.destDir, SEED_MANIFEST_PATH);
+  fs10.mkdirSync(path9.dirname(dest), { recursive: true });
+  fs10.writeFileSync(dest, serializeSeedManifest(manifest));
+}
 
 // src/lib/github-app-repo.ts
 init_errors();
@@ -14244,18 +14326,32 @@ async function mintInstallationTokenFromPem(args) {
 }
 async function readRepoFileViaApp(args) {
   const doFetch = args.fetchImpl ?? fetch;
-  const res = await doFetch(`${GH_API}/repos/${args.repo}/contents/${args.path}`, { headers: ghHeaders(args.token), signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
+  const q = args.ref ? `?ref=${encodeURIComponent(args.ref)}` : "";
+  const res = await doFetch(`${GH_API}/repos/${args.repo}/contents/${args.path}${q}`, { headers: ghHeaders(args.token), signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
   if (res.status === 404) return null;
   const text = await res.text();
   if (!res.ok) {
     throw new LocalCliError({
       code: "GH_APP_FILE_READ_FAILED",
-      message: `GET /repos/${args.repo}/contents/${args.path} HTTP ${res.status.toString()}: ${text.slice(0, 300)}`
+      message: `GET /repos/${args.repo}/contents/${args.path}${q} HTTP ${res.status.toString()}: ${text.slice(0, 300)}`
     });
   }
   const data = JSON.parse(text);
   return Buffer.from(data.content ?? "", "base64").toString("utf8");
 }
+async function getInitialSeedCommitSha(args) {
+  const doFetch = args.fetchImpl ?? fetch;
+  const H = ghHeaders(args.token);
+  const first = await doFetch(`${GH_API}/repos/${args.repo}/commits?per_page=1`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
+  if (!first.ok) return null;
+  const link = first.headers.get("link");
+  const lastUrl = /<([^>]+)>;\s*rel="last"/.exec(link ?? "")?.[1];
+  const url = lastUrl ?? `${GH_API}/repos/${args.repo}/commits?per_page=1`;
+  const res = await doFetch(url, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
+  if (!res.ok) return null;
+  const commits = JSON.parse(await res.text());
+  return commits.length > 0 ? commits[commits.length - 1].sha ?? null : null;
+}
 async function commitFilesViaApp(args) {
   const doFetch = args.fetchImpl ?? fetch;
   const H = ghHeaders(args.token);
@@ -14273,19 +14369,68 @@ async function commitFilesViaApp(args) {
   const ref = await api(`/git/ref/heads/${args.branch}`);
   const baseCommitSha = ref.object.sha;
   const baseCommit = await api(`/git/commits/${baseCommitSha}`);
-  const blobs = await Promise.all(args.files.map((f) => api(`/git/blobs`, { method: "POST", body: JSON.stringify({ content: f.content, encoding: "utf-8" }) })));
-  const tree = await api(`/git/trees`, {
+  const upserts = args.files.filter((f) => !("delete" in f));
+  const blobs = await Promise.all(upserts.map((f) => api(`/git/blobs`, { method: "POST", body: JSON.stringify({ content: f.content, encoding: "utf-8" }) })));
+  const tree = args.files.map((f) => "delete" in f ? { path: f.path, mode: "100644", type: "blob", sha: null } : { path: f.path, mode: "100644", type: "blob", sha: blobs[upserts.indexOf(f)].sha });
+  const newTree = await api(`/git/trees`, { method: "POST", body: JSON.stringify({ base_tree: baseCommit.tree.sha, tree }) });
+  const commit = await api(`/git/commits`, {
     method: "POST",
-    body: JSON.stringify({
-      base_tree: baseCommit.tree.sha,
-      tree: args.files.map((f, i) => ({ path: f.path, mode: "100644", type: "blob", sha: blobs[i].sha }))
-    })
+    body: JSON.stringify({ message: args.message, tree: newTree.sha, parents: [baseCommitSha] })
+  });
+  await api(`/git/refs/heads/${args.branch}`, { method: "PATCH", body: JSON.stringify({ sha: commit.sha }) });
+}
+async function createBranchViaApp(args) {
+  const doFetch = args.fetchImpl ?? fetch;
+  const H = ghHeaders(args.token);
+  const res = await doFetch(`${GH_API}/repos/${args.repo}/git/refs`, {
+    method: "POST",
+    headers: H,
+    signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS),
+    body: JSON.stringify({ ref: `refs/heads/${args.branch}`, sha: args.fromSha })
+  });
+  if (res.ok) return;
+  if (res.status === 422) {
+    const patch = await doFetch(`${GH_API}/repos/${args.repo}/git/refs/heads/${args.branch}`, {
+      method: "PATCH",
+      headers: H,
+      signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS),
+      body: JSON.stringify({ sha: args.fromSha, force: true })
+    });
+    if (patch.ok) return;
+    throw new LocalCliError({
+      code: "GH_APP_BRANCH_FAILED",
+      message: `PATCH refs/heads/${args.branch} HTTP ${patch.status.toString()}: ${(await patch.text()).slice(0, 300)}`
+    });
+  }
+  throw new LocalCliError({
+    code: "GH_APP_BRANCH_FAILED",
+    message: `POST /git/refs HTTP ${res.status.toString()}: ${(await res.text()).slice(0, 300)}`
   });
+}
+async function commitFilesFromBaseViaApp(args) {
+  const doFetch = args.fetchImpl ?? fetch;
+  const H = ghHeaders(args.token);
+  const api = async (p, init) => {
+    const res = await doFetch(`${GH_API}/repos/${args.repo}${p}`, init ? { ...init, headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) } : { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
+    const text = await res.text();
+    if (!res.ok) {
+      throw new LocalCliError({
+        code: "GH_APP_COMMIT_FAILED",
+        message: `${init?.method ?? "GET"} ${p} HTTP ${res.status.toString()}: ${text.slice(0, 300)}`
+      });
+    }
+    return text ? JSON.parse(text) : {};
+  };
+  const baseCommit = await api(`/git/commits/${args.baseSha}`);
+  const upserts = args.files.filter((f) => !("delete" in f));
+  const blobs = await Promise.all(upserts.map((f) => api(`/git/blobs`, { method: "POST", body: JSON.stringify({ content: f.content, encoding: "utf-8" }) })));
+  const tree = args.files.map((f) => "delete" in f ? { path: f.path, mode: "100644", type: "blob", sha: null } : { path: f.path, mode: "100644", type: "blob", sha: blobs[upserts.indexOf(f)].sha });
+  const newTree = await api(`/git/trees`, { method: "POST", body: JSON.stringify({ base_tree: baseCommit.tree.sha, tree }) });
   const commit = await api(`/git/commits`, {
     method: "POST",
-    body: JSON.stringify({ message: args.message, tree: tree.sha, parents: [baseCommitSha] })
+    body: JSON.stringify({ message: args.message, tree: newTree.sha, parents: [args.baseSha] })
   });
-  await api(`/git/refs/heads/${args.branch}`, { method: "PATCH", body: JSON.stringify({ sha: commit.sha }) });
+  await createBranchViaApp({ token: args.token, repo: args.repo, branch: args.branch, fromSha: commit.sha, fetchImpl: args.fetchImpl });
 }
 async function probeRepoState(probe) {
   const status = await probe.repoStatus();
@@ -14309,13 +14454,66 @@ function appRepoProbe(args) {
       const res = await doFetch(`${GH_API}/repos/${args.repo}`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status;
     },
-    getFile: (path32) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path32, fetchImpl: args.fetchImpl }),
+    getFile: (path37) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path37, fetchImpl: args.fetchImpl }),
     isEmpty: async () => {
       const res = await doFetch(`${GH_API}/repos/${args.repo}/contents`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status === 404;
     }
   };
 }
+async function openPullRequestViaApp(args) {
+  const doFetch = args.fetchImpl ?? fetch;
+  const res = await doFetch(`${GH_API}/repos/${args.repo}/pulls`, {
+    method: "POST",
+    headers: ghHeaders(args.token),
+    signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS),
+    body: JSON.stringify({ base: args.base, head: args.head, title: args.title, body: args.body })
+  });
+  const text = await res.text();
+  if (!res.ok) throw new LocalCliError({ code: "GH_APP_PR_OPEN_FAILED", message: `POST /pulls HTTP ${res.status.toString()}: ${text.slice(0, 300)}` });
+  const j = JSON.parse(text);
+  return { number: j.number, htmlUrl: j.html_url };
+}
+async function findOpenPr(args) {
+  const doFetch = args.fetchImpl ?? fetch;
+  const owner = args.repo.split("/")[0];
+  const res = await doFetch(`${GH_API}/repos/${args.repo}/pulls?state=open&head=${owner}:${args.head}`, { headers: ghHeaders(args.token), signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
+  if (!res.ok) return null;
+  const list = JSON.parse(await res.text());
+  return list.length > 0 ? { number: list[0].number, htmlUrl: list[0].html_url } : null;
+}
+async function updatePullRequestViaApp(args) {
+  const doFetch = args.fetchImpl ?? fetch;
+  const patch = {};
+  if (args.title !== void 0) patch.title = args.title;
+  if (args.body !== void 0) patch.body = args.body;
+  const res = await doFetch(`${GH_API}/repos/${args.repo}/pulls/${args.number.toString()}`, {
+    method: "PATCH",
+    headers: ghHeaders(args.token),
+    signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS),
+    body: JSON.stringify(patch)
+  });
+  if (!res.ok) throw new LocalCliError({ code: "GH_APP_PR_UPDATE_FAILED", message: `PATCH /pulls/${args.number.toString()} HTTP ${res.status.toString()}: ${(await res.text()).slice(0, 300)}` });
+}
+async function closePullRequestViaApp(args) {
+  const doFetch = args.fetchImpl ?? fetch;
+  const H = ghHeaders(args.token);
+  if (args.comment) {
+    await doFetch(`${GH_API}/repos/${args.repo}/issues/${args.number.toString()}/comments`, {
+      method: "POST",
+      headers: H,
+      signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS),
+      body: JSON.stringify({ body: args.comment })
+    });
+  }
+  const res = await doFetch(`${GH_API}/repos/${args.repo}/pulls/${args.number.toString()}`, {
+    method: "PATCH",
+    headers: H,
+    signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS),
+    body: JSON.stringify({ state: "closed" })
+  });
+  if (!res.ok) throw new LocalCliError({ code: "GH_APP_PR_CLOSE_FAILED", message: `PATCH /pulls/${args.number.toString()} HTTP ${res.status.toString()}: ${(await res.text()).slice(0, 300)}` });
+}
 
 // src/lib/brain-repo-collision.ts
 init_errors();
@@ -14497,15 +14695,15 @@ var BrainCreateCommand = class extends M8tCommand {
       agentEndpoint
     });
     const repoRoot = resolveRepoRoot();
-    const templateSrc = path9.join(repoRoot, "brain-template");
-    if (!fs10.existsSync(templateSrc)) {
+    const templateSrc = path10.join(repoRoot, "brain-template");
+    if (!fs11.existsSync(templateSrc)) {
       throw new LocalCliError({
         code: "TEMPLATE_MISSING",
         message: `brain-template/ missing at ${templateSrc}`,
         hint: "Ensure brain-template/ exists at the repo root (same level as apps/)."
       });
     }
-    const tmpDir = fs10.mkdtempSync(path9.join(os4.tmpdir(), `m8t-brain-create-${worker}-`));
+    const tmpDir = fs11.mkdtempSync(path10.join(os4.tmpdir(), `m8t-brain-create-${worker}-`));
     let result;
     let resolvedInstallationId = null;
     const force = this.reuse === true ? "reuse" : this.newName === true ? "new" : void 0;
@@ -14542,6 +14740,10 @@ var BrainCreateCommand = class extends M8tCommand {
     try {
       if (needsPush) {
         materializeBrainTree({ templateSrc, destDir: tmpDir, seedDir });
+        if (seedName && seedDir) {
+          const headSha = execFileSync("git", ["rev-parse", "HEAD"], { cwd: repoRoot, encoding: "utf8" }).trim();
+          writeSeedMarker({ destDir: tmpDir, seedName, seedDir, refreshedToCommit: headSha, version: "(scaffold)" });
+        }
         this.context.stdout.write(
           seedName ? `${colors.dim("\u2192")} copied brain-template/ + overlaid seed ${colors.field(seedName)} to ${tmpDir}
 ` : `${colors.dim("\u2192")} copied brain-template/ to ${tmpDir}
@@ -14633,7 +14835,7 @@ var BrainCreateCommand = class extends M8tCommand {
         project
       });
     } finally {
-      fs10.rmSync(tmpDir, { recursive: true, force: true });
+      fs11.rmSync(tmpDir, { recursive: true, force: true });
     }
     if (mode === "json") {
       this.context.stdout.write(
@@ -14970,9 +15172,9 @@ init_errors();
 // src/lib/brain-unlink.ts
 init_esm2();
 init_errors();
-import * as fs11 from "fs";
+import * as fs12 from "fs";
 import * as os5 from "os";
-import * as path10 from "path";
+import * as path11 from "path";
 init_foundry_agent_get();
 var FOUNDRY_ARM_API2 = "2025-04-01-preview";
 var FOUNDRY_DATA_SCOPE2 = "https://ai.azure.com/.default";
@@ -15003,15 +15205,15 @@ async function unlinkBrain(args) {
   if (yaml?.personaPath) {
     let personaPath = yaml.personaPath;
     if (!personaPath.startsWith("/")) {
-      const marker = path10.join(args.home ?? os5.homedir(), ".m8t-stack", "repo-root");
-      if (!fs11.existsSync(marker)) {
+      const marker = path11.join(args.home ?? os5.homedir(), ".m8t-stack", "repo-root");
+      if (!fs12.existsSync(marker)) {
         throw new LocalCliError({
           code: "PERSONA_PATH_NOT_ABSOLUTE",
           message: `personaPath '${personaPath}' is relative and the repo-root marker is missing.`,
           hint: "Re-run 'm8t install' from a fresh m8t-stack checkout (writes ~/.m8t-stack/repo-root) \u2014 or edit the personaPath to absolute."
         });
       }
-      personaPath = path10.join(fs11.readFileSync(marker, "utf8").trim(), personaPath);
+      personaPath = path11.join(fs12.readFileSync(marker, "utf8").trim(), personaPath);
     }
     strippedInstructions = renderPersonaBody(personaPath, yaml.fillableFieldValues ?? {}, args.agentName);
   } else {
@@ -15251,27 +15453,27 @@ import { DefaultAzureCredential as DefaultAzureCredential9 } from "@azure/identi
 init_errors();
 
 // src/lib/deploy-prompt-advisor.ts
-import * as fs12 from "fs";
-import * as path11 from "path";
+import * as fs13 from "fs";
+import * as path12 from "path";
 import { parse as parseYaml6 } from "yaml";
 init_foundry_agents();
 init_errors();
 function findPersonasRoot(hint) {
-  let dir = path11.resolve(hint);
-  const fsRoot = path11.parse(dir).root;
+  let dir = path12.resolve(hint);
+  const fsRoot = path12.parse(dir).root;
   for (; ; ) {
-    if (fs12.existsSync(path11.join(dir, "personas"))) return dir;
-    const parent = path11.dirname(dir);
+    if (fs13.existsSync(path12.join(dir, "personas"))) return dir;
+    const parent = path12.dirname(dir);
     if (parent === dir || dir === fsRoot) return null;
     dir = parent;
   }
 }
 async function deployPromptAdvisor(args) {
   const resolvedRoot = findPersonasRoot(args.repoRoot);
-  const personaPath = resolvedRoot ? path11.join(resolvedRoot, "personas", args.persona, "persona.md") : path11.join(args.repoRoot, "personas", args.persona, "persona.md");
+  const personaPath = resolvedRoot ? path12.join(resolvedRoot, "personas", args.persona, "persona.md") : path12.join(args.repoRoot, "personas", args.persona, "persona.md");
   let raw;
   try {
-    raw = fs12.readFileSync(personaPath, "utf8");
+    raw = fs13.readFileSync(personaPath, "utf8");
   } catch (e) {
     throw new LocalCliError({
       code: "ADVISOR_PERSONA_MISSING",
@@ -15433,7 +15635,7 @@ init_errors();
 // src/lib/agent-remove.ts
 init_errors();
 init_foundry_agent_get();
-import * as fs14 from "fs";
+import * as fs15 from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
 
 // src/lib/a2a-enable.ts
@@ -15547,12 +15749,12 @@ async function awaitAgentQueryable(args) {
 // src/lib/persona-a2a.ts
 init_errors();
 init_esm();
-import * as fs13 from "fs";
+import * as fs14 from "fs";
 import { parse as parseYaml7 } from "yaml";
 function readPersonaA2aCard(personaPath) {
   let raw;
   try {
-    raw = fs13.readFileSync(personaPath, "utf8");
+    raw = fs14.readFileSync(personaPath, "utf8");
   } catch (e) {
     throw new LocalCliError({ code: "PERSONA_READ_FAILED", message: `Could not read persona '${personaPath}': ${e.message}` });
   }
@@ -15877,7 +16079,7 @@ function defaultRemoveAgentDeps(args) {
     },
     removeLocalYaml(agentName) {
       const p = agentYamlPath(agentName, home);
-      if (fs14.existsSync(p)) fs14.rmSync(p);
+      if (fs15.existsSync(p)) fs15.rmSync(p);
     }
   };
 }
@@ -16019,16 +16221,16 @@ ${colors.success("\u2713")} removed ${colors.field(name)}.
 };
 
 // src/commands/a2a/enable.ts
-import * as path13 from "path";
+import * as path14 from "path";
 import { Command as Command25, Option as Option24 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential11 } from "@azure/identity";
 init_errors();
 
 // src/lib/bridge-url.ts
 init_errors();
-import * as fs15 from "fs";
+import * as fs16 from "fs";
 import * as os6 from "os";
-import * as path12 from "path";
+import * as path13 from "path";
 import { parse as parseYaml8 } from "yaml";
 var A2A_PATH = "/api/a2a/mcp";
 function resolveBridgeUrl(opts) {
@@ -16050,10 +16252,10 @@ function clean(v) {
   return t.length ? t : void 0;
 }
 function readConfigGatewayUrl(home) {
-  const cfg = path12.join(home ?? os6.homedir(), ".m8t-stack", "config.yaml");
-  if (!fs15.existsSync(cfg)) return void 0;
+  const cfg = path13.join(home ?? os6.homedir(), ".m8t-stack", "config.yaml");
+  if (!fs16.existsSync(cfg)) return void 0;
   try {
-    const o = parseYaml8(fs15.readFileSync(cfg, "utf8"));
+    const o = parseYaml8(fs16.readFileSync(cfg, "utf8"));
     return typeof o.gatewayUrl === "string" ? o.gatewayUrl : void 0;
   } catch {
     return void 0;
@@ -16122,11 +16324,11 @@ var A2aEnableCommand = class extends M8tCommand {
   resolvePersonaPath() {
     if (typeof this.persona === "string" && this.persona.length > 0) {
       if (this.persona.includes("/") || this.persona.endsWith(".md")) return this.persona;
-      return path13.join(resolveRepoRoot(), "personas", this.persona, "persona.md");
+      return path14.join(resolveRepoRoot(), "personas", this.persona, "persona.md");
     }
     const yaml = readAgentYaml(this.worker);
     if (yaml?.personaPath) {
-      return yaml.personaPath.startsWith("/") ? yaml.personaPath : path13.join(resolveRepoRoot(), yaml.personaPath);
+      return yaml.personaPath.startsWith("/") ? yaml.personaPath : path14.join(resolveRepoRoot(), yaml.personaPath);
     }
     throw new LocalCliError({ code: "A2A_NO_PERSONA", message: `Could not resolve a persona for '${this.worker}'. Pass --persona <name>.` });
   }
@@ -16182,12 +16384,12 @@ import { Command as Command27 } from "clipanion";
 
 // src/lib/architect-version.ts
 import { createHash as createHash2 } from "crypto";
-import * as fs16 from "fs";
+import * as fs17 from "fs";
 import * as os7 from "os";
-import * as path14 from "path";
+import * as path15 from "path";
 function readVersionFrontmatter(file) {
-  if (!fs16.existsSync(file)) return "";
-  const text = fs16.readFileSync(file, "utf8");
+  if (!fs17.existsSync(file)) return "";
+  const text = fs17.readFileSync(file, "utf8");
   if (!text.startsWith("---")) return "";
   const closeIdx = text.indexOf("\n---", 3);
   if (closeIdx < 0) return "";
@@ -16196,23 +16398,23 @@ function readVersionFrontmatter(file) {
   return m ? m[1].trim() : "";
 }
 function sha256File(filePath) {
-  return createHash2("sha256").update(fs16.readFileSync(filePath)).digest("hex");
+  return createHash2("sha256").update(fs17.readFileSync(filePath)).digest("hex");
 }
 function checkArchitectDrift() {
-  const sourcePath = path14.join(
+  const sourcePath = path15.join(
     resolveRepoRoot(),
     "personas",
     "m8t-architect",
     "persona.md"
   );
-  const sidecarPath = path14.join(
+  const sidecarPath = path15.join(
     os7.homedir(),
     ".claude",
     "skills",
     "m8t-architect",
     ".m8t-skill.json"
   );
-  if (!fs16.existsSync(sourcePath)) {
+  if (!fs17.existsSync(sourcePath)) {
     return {
       match: false,
       sourceVersion: "",
@@ -16222,9 +16424,9 @@ function checkArchitectDrift() {
   }
   const sourceVersion = readVersionFrontmatter(sourcePath);
   let sidecar = null;
-  if (fs16.existsSync(sidecarPath)) {
+  if (fs17.existsSync(sidecarPath)) {
     try {
-      const raw = JSON.parse(fs16.readFileSync(sidecarPath, "utf8"));
+      const raw = JSON.parse(fs17.readFileSync(sidecarPath, "utf8"));
       if (raw !== null && typeof raw === "object") {
         const r = raw;
         sidecar = {
@@ -16287,7 +16489,7 @@ var ArchitectCheckCommand = class extends M8tCommand {
 
 // src/commands/coder/deploy.ts
 init_esm2();
-import * as path16 from "path";
+import * as path17 from "path";
 import { Command as Command28, Option as Option26 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential13 } from "@azure/identity";
 init_errors();
@@ -16554,14 +16756,14 @@ async function deployHostedWorker(args) {
 }
 
 // src/lib/persona.ts
-import * as fs17 from "fs";
-import * as path15 from "path";
+import * as fs18 from "fs";
+import * as path16 from "path";
 import { parse as parseYaml9 } from "yaml";
 function findRepoRoot(startDir) {
-  let dir = path15.resolve(startDir);
+  let dir = path16.resolve(startDir);
   for (; ; ) {
-    if (fs17.existsSync(path15.join(dir, "personas"))) return dir;
-    const parent = path15.dirname(dir);
+    if (fs18.existsSync(path16.join(dir, "personas"))) return dir;
+    const parent = path16.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -16569,10 +16771,10 @@ function findRepoRoot(startDir) {
 function resolvePersona(persona, cwd = process.cwd()) {
   const root = findRepoRoot(cwd);
   if (!root) return { persona, personaVersion: null };
-  const file = path15.join(root, "personas", persona, "persona.md");
+  const file = path16.join(root, "personas", persona, "persona.md");
   let raw;
   try {
-    raw = fs17.readFileSync(file, "utf-8");
+    raw = fs18.readFileSync(file, "utf-8");
   } catch {
     return { persona, personaVersion: null };
   }
@@ -16909,7 +17111,7 @@ var CoderDeployCommand = class extends M8tCommand {
         projectEndpoint: project.endpoint,
         projectArmId: `${project.accountScope}/projects/${project.projectName}`,
         agentName: this.name,
-        personaPath: path16.join(resolveRepoRoot(), "personas", personaName, "persona.md"),
+        personaPath: path17.join(resolveRepoRoot(), "personas", personaName, "persona.md"),
         bridgeUrl,
         onProgress
       });
@@ -17035,7 +17237,7 @@ var CoderTeardownCommand = class extends M8tCommand {
 
 // src/commands/azure-exec/deploy.ts
 init_esm2();
-import * as path17 from "path";
+import * as path18 from "path";
 import { Command as Command30, Option as Option28 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential15 } from "@azure/identity";
 init_errors();
@@ -17305,7 +17507,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
       kvUri
     });
     onProgress?.("a2a-enabling as a target\u2026");
-    const personaPath = path17.join(resolveRepoRoot(), "personas", "azure-executor", "persona.md");
+    const personaPath = path18.join(resolveRepoRoot(), "personas", "azure-executor", "persona.md");
     const bridgeUrl = resolveBridgeUrl({
       flag: typeof this.gatewayUrl === "string" ? this.gatewayUrl : void 0,
       env: processEnv
@@ -17447,8 +17649,8 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Pass a ghcr.io/<owner>/<name> repo, or use the BYOC private-ACR deploy flow."
     });
   }
-  const path32 = repo.replace(/^ghcr\.io\//, "");
-  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path32}:pull`);
+  const path37 = repo.replace(/^ghcr\.io\//, "");
+  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path37}:pull`);
   if (!tokenRes.ok) {
     throw new LocalCliError({
       code: "PLATFORM_GHCR_TOKEN_FAILED",
@@ -17464,7 +17666,7 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Make the package public (deploy/ghcr-package-visibility.md), then retry."
     });
   }
-  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path32}/tags/list`, {
+  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path37}/tags/list`, {
     headers: { Authorization: `Bearer ${token}` }
   });
   if (!tagsRes.ok) {
@@ -17478,7 +17680,7 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
 }
 
 // src/lib/release-channel.ts
-import * as fs18 from "fs";
+import * as fs19 from "fs";
 
 // ../../packages/platform-release/dist/esm/manifest.js
 var SEVERITIES = ["critical", "recommended", "optional"];
@@ -17601,14 +17803,51 @@ function entityToStamp(e) {
 
 // ../../packages/platform-release/dist/esm/channel-url.js
 var CHANNEL_LATEST_URL = "https://github.com/m8t-run/m8t/releases/latest/download/manifest.json";
-function channelUrlForVersion(tag) {
-  return `https://github.com/m8t-run/m8t/releases/download/${tag}/manifest.json`;
+function platformTag(version) {
+  const bare = version.trim().replace(/^platform-/, "").replace(/^v/, "");
+  return `platform-v${bare}`;
+}
+function channelUrlForVersion(version) {
+  return `https://github.com/m8t-run/m8t/releases/download/${platformTag(version)}/manifest.json`;
+}
+
+// ../../packages/platform-release/dist/esm/apply-request.js
+var APPLY_REQUEST_PK = "system";
+var APPLY_REQUEST_RK = "apply-request";
+var IN_FLIGHT = ["claimed", "applying"];
+function isInFlight(status) {
+  return IN_FLIGHT.includes(status);
+}
+function applyRequestToEntity(r) {
+  return { partitionKey: APPLY_REQUEST_PK, rowKey: APPLY_REQUEST_RK, value: JSON.stringify(r), updatedAt: r.updatedAt };
+}
+function entityToApplyRequest(e) {
+  return JSON.parse(e.value);
+}
+
+// ../../packages/platform-release/dist/esm/infra-params.js
+var INFRA_PARAMS_PK = "system";
+var INFRA_PARAMS_RK = "infra-params";
+function infraParamsToEntity(p) {
+  return { partitionKey: INFRA_PARAMS_PK, rowKey: INFRA_PARAMS_RK, value: JSON.stringify(p) };
+}
+function entityToInfraParams(e) {
+  return JSON.parse(e.value);
 }
 
 // src/lib/release-channel.ts
 init_errors();
+function manifestSourceForVersionTag(channelUrl, version) {
+  const tag = platformTag(version);
+  const custom = channelUrl.trim();
+  if (!custom || custom === CHANNEL_LATEST_URL) return { channel: true, version: tag };
+  if (custom.includes("/releases/latest/download/")) {
+    return { url: custom.replace("/releases/latest/download/", `/releases/download/${tag}/`) };
+  }
+  return { url: custom };
+}
 async function fetchManifest(source, deps = {}) {
-  const readFile8 = deps.readFile ?? ((p) => fs18.readFileSync(p, "utf8"));
+  const readFile8 = deps.readFile ?? ((p) => fs19.readFileSync(p, "utf8"));
   const fetchImpl = deps.fetchImpl ?? fetch;
   const ghToken = deps.ghToken ?? getGhToken;
   let raw;
@@ -17654,10 +17893,10 @@ async function fetchManifest(source, deps = {}) {
 }
 
 // src/lib/release-content.ts
-import * as fs19 from "fs";
+import * as fs20 from "fs";
 import * as os8 from "os";
-import * as path18 from "path";
-import { execFileSync } from "child_process";
+import * as path19 from "path";
+import { execFileSync as execFileSync2 } from "child_process";
 init_errors();
 var OWNER_REPO = "m8t-run/m8t";
 function parseTreeResponse(body) {
@@ -17695,15 +17934,15 @@ function verifyPersonaTrees(manifest, tree) {
 }
 async function resolveReleaseContent(manifest, opts = {}) {
   if (opts.contentDir) {
-    if (!fs19.existsSync(path18.join(opts.contentDir, "personas"))) {
+    if (!fs20.existsSync(path19.join(opts.contentDir, "personas"))) {
       throw new LocalCliError({ code: "PLATFORM_CONTENT_DIR_INVALID", message: `--content-dir '${opts.contentDir}' has no personas/ \u2014 not a repo checkout.` });
     }
     return opts.contentDir;
   }
   const commit = manifest.platform.commit;
-  const cacheRoot = opts.cacheRoot ?? path18.join(os8.homedir(), ".m8t-stack", "cache");
-  const dest = path18.join(cacheRoot, `release-${commit}`);
-  if (fs19.existsSync(path18.join(dest, "personas"))) return dest;
+  const cacheRoot = opts.cacheRoot ?? path19.join(os8.homedir(), ".m8t-stack", "cache");
+  const dest = path19.join(cacheRoot, `release-${commit}`);
+  if (fs20.existsSync(path19.join(dest, "personas"))) return dest;
   const fetchImpl = opts.fetchImpl ?? fetch;
   const ghToken = opts.ghToken ?? getGhToken;
   let token;
@@ -17717,19 +17956,19 @@ async function resolveReleaseContent(manifest, opts = {}) {
   if (!res.ok) {
     throw new LocalCliError({ code: "PLATFORM_TARBALL_FETCH_FAILED", message: `GET ${url} \u2192 HTTP ${res.status.toString()}.` });
   }
-  fs19.mkdirSync(cacheRoot, { recursive: true });
-  const tmp = fs19.mkdtempSync(path18.join(cacheRoot, `.dl-${commit.slice(0, 8)}-`));
+  fs20.mkdirSync(cacheRoot, { recursive: true });
+  const tmp = fs20.mkdtempSync(path19.join(cacheRoot, `.dl-${commit.slice(0, 8)}-`));
   try {
-    const tgz = path18.join(tmp, "src.tar.gz");
-    fs19.writeFileSync(tgz, Buffer.from(await res.arrayBuffer()));
-    const unpacked = path18.join(tmp, "unpacked");
-    fs19.mkdirSync(unpacked);
+    const tgz = path19.join(tmp, "src.tar.gz");
+    fs20.writeFileSync(tgz, Buffer.from(await res.arrayBuffer()));
+    const unpacked = path19.join(tmp, "unpacked");
+    fs20.mkdirSync(unpacked);
     extractTarGz(tgz, unpacked);
     try {
-      fs19.renameSync(unpacked, dest);
+      fs20.renameSync(unpacked, dest);
     } catch (e) {
       const err = e;
-      const isBenignRace = (err.code === "EEXIST" || err.code === "ENOTEMPTY") && fs19.existsSync(path18.join(dest, "personas"));
+      const isBenignRace = (err.code === "EEXIST" || err.code === "ENOTEMPTY") && fs20.existsSync(path19.join(dest, "personas"));
       if (!isBenignRace) {
         throw new LocalCliError({
           code: "PLATFORM_CACHE_PUBLISH_FAILED",
@@ -17738,12 +17977,12 @@ async function resolveReleaseContent(manifest, opts = {}) {
       }
     }
   } finally {
-    fs19.rmSync(tmp, { recursive: true, force: true });
+    fs20.rmSync(tmp, { recursive: true, force: true });
   }
   return dest;
 }
 function extractTarGz(tgz, into) {
-  execFileSync("tar", ["-xzf", tgz, "-C", into, "--strip-components=1"]);
+  execFileSync2("tar", ["-xzf", tgz, "-C", into, "--strip-components=1"]);
 }
 
 // src/lib/platform-stamp.ts
@@ -17865,14 +18104,14 @@ function sleep2(ms) {
 }
 
 // src/lib/platform-converge.ts
-import * as fs21 from "fs";
-import * as path20 from "path";
+import * as fs22 from "fs";
+import * as path21 from "path";
 import { parse as parseYaml10 } from "yaml";
 
 // src/lib/deploy.ts
-import * as fs20 from "fs/promises";
+import * as fs21 from "fs/promises";
 import * as os9 from "os";
-import * as path19 from "path";
+import * as path20 from "path";
 init_errors();
 var FOUNDRY_TRACING_MODES = ["project", "account", "skip"];
 function parseFoundryTracingMode(v) {
@@ -17899,12 +18138,30 @@ function buildBicepParams(p) {
     `acrResourceId=${p.acrResourceId}`
   ];
   if (p.foundryTracingMode) params.push(`foundryTracingMode=${p.foundryTracingMode}`);
+  if (p.assignSubscriptionRoles !== void 0) params.push(`assignSubscriptionRoles=${String(p.assignSubscriptionRoles)}`);
+  if (p.provisionUpdater !== void 0) params.push(`provisionUpdater=${String(p.provisionUpdater)}`);
+  if (p.installerImage !== void 0) params.push(`installerImage=${p.installerImage}`);
+  if (p.updateCron !== void 0) params.push(`updateCron=${p.updateCron}`);
+  if (p.channelUrl !== void 0) params.push(`channelUrl=${p.channelUrl}`);
+  if (p.gatewayCpu) params.push(`gatewayCpu=${p.gatewayCpu}`);
+  if (p.gatewayMemory) params.push(`gatewayMemory=${p.gatewayMemory}`);
+  if (p.refereeEnabled) params.push(`refereeEnabled=${p.refereeEnabled}`);
+  if (p.refereeBrainRepos) params.push(`refereeBrainRepos=${p.refereeBrainRepos}`);
+  if (p.refereeFeedRepo) params.push(`refereeFeedRepo=${p.refereeFeedRepo}`);
+  if (p.refereeInstallationId) params.push(`refereeInstallationId=${p.refereeInstallationId}`);
+  if (p.refereeWebhookHmacKvUri) params.push(`refereeWebhookHmacKvUri=${p.refereeWebhookHmacKvUri}`);
+  if (p.examKvUri) params.push(`examKvUri=${p.examKvUri}`);
+  if (p.examLaWorkspaceId) params.push(`examLaWorkspaceId=${p.examLaWorkspaceId}`);
+  if (p.brainEvalDeployment) params.push(`brainEvalDeployment=${p.brainEvalDeployment}`);
+  if (p.brainAppLogin) params.push(`brainAppLogin=${p.brainAppLogin}`);
+  if (p.refereeCheckpointDir) params.push(`refereeCheckpointDir=${p.refereeCheckpointDir}`);
+  if (p.examApiBase) params.push(`examApiBase=${p.examApiBase}`);
   return params;
 }
 async function resolveRepoRoot2(home = os9.homedir()) {
-  const marker = path19.join(home, ".m8t-stack", "repo-root");
+  const marker = path20.join(home, ".m8t-stack", "repo-root");
   try {
-    const root = (await fs20.readFile(marker, "utf8")).trim();
+    const root = (await fs21.readFile(marker, "utf8")).trim();
     if (!root) throw new Error("empty");
     return root;
   } catch {
@@ -17981,7 +18238,7 @@ function resolveAcrPullIdentity(opts) {
   return opts.explicit ?? "";
 }
 async function runBicepDeployment(opts) {
-  const bicepPath = path19.join(opts.repoRoot, "deploy", "main.bicep");
+  const bicepPath = path20.join(opts.repoRoot, "deploy", "main.bicep");
   const result = JSON.parse(
     await runAz([
       "deployment",
@@ -18052,7 +18309,16 @@ function sortObj(o) {
 }
 
 // src/lib/platform-converge.ts
-var ORDER = ["infra", "gateway", "codingAgent", "azureExecutor", "personas"];
+var ORDER = ["infra", "gateway", "codingAgent", "azureExecutor", "personas", "brainSeeds"];
+function seedSetRev(manifest) {
+  const items = manifest.components.brainSeeds.items;
+  const parts = [];
+  for (const name of Object.keys(items).sort()) {
+    const subs = items[name].subtrees;
+    for (const sub of Object.keys(subs).sort()) parts.push(`${name}:${sub}:${subs[sub] ?? "-"}`);
+  }
+  return parts.join("|");
+}
 function infraTargetSha(manifest, tree) {
   return manifest.components.infra?.treeSha ?? tree.treeShaOf("deploy") ?? "";
 }
@@ -18088,6 +18354,16 @@ function diffPlan(manifest, stamp, tree, opts = {}) {
       }
       continue;
     }
+    if (component === "brainSeeds") {
+      const to = seedSetRev(manifest);
+      const from2 = stamp?.components.brainSeeds?.seedRev ?? null;
+      const targeted = opts.only === "brainSeeds";
+      if (adopt) actions.push({ component, reason: "adopt", from: from2, to });
+      else if (targeted) actions.push({ component, reason: from2 === to ? "forced" : "changed", from: from2, to });
+      else if (from2 !== to) actions.push({ component, reason: "changed", from: from2, to });
+      else skipped.push({ component, reason: "up-to-date" });
+      continue;
+    }
     const img = manifest.components[component];
     const cur = stamp?.components[component];
     if (cur?.state === "external") {
@@ -18131,6 +18407,7 @@ function installedValueOf(stamp, component, personaName) {
     if (!personaName || !Object.hasOwn(stamp.components.personas, personaName)) return "-";
     return stamp.components.personas[personaName].treeSha;
   }
+  if (component === "brainSeeds") return stamp.components.brainSeeds?.seedRev ?? "-";
   return stamp.components[component].tag;
 }
 function targetValueOf(manifest, tree, component, personaName) {
@@ -18139,6 +18416,7 @@ function targetValueOf(manifest, tree, component, personaName) {
     if (!personaName || !Object.hasOwn(manifest.components.personas.items, personaName)) return "-";
     return manifest.components.personas.items[personaName].treeSha;
   }
+  if (component === "brainSeeds") return seedSetRev(manifest) || "-";
   return manifest.components[component].tag;
 }
 async function applyPlan(plan, deps, ctx) {
@@ -18154,22 +18432,34 @@ async function applyPlan(plan, deps, ctx) {
         stamp.components.gateway = await deps.applyGateway(a, ctx);
       } else if (a.component === "codingAgent" || a.component === "azureExecutor") {
         const r = await deps.applyAgent(a, ctx);
-        if (r !== "absent") {
-          stamp.components[a.component] = { ...r, state: "managed" };
-        } else {
-          ctx.onProgress?.(`${a.component}: not deployed on this install \u2014 stamp left unchanged.`);
+        if (r === "absent") {
+          ctx.onProgress?.(`${a.component}: not deployed on this install \u2014 skipped (not gated).`);
+          continue;
+        }
+        stamp.components[a.component] = { ...r, state: "managed" };
+      } else if (a.component === "brainSeeds") {
+        if (!deps.applySeedRefresh) {
+          ctx.onProgress?.("brainSeeds: seed refresh is not supported by this driver (CLI-only in v1) \u2014 skipped.");
+          continue;
         }
+        const r = await deps.applySeedRefresh(a, ctx);
+        ctx.onProgress?.(`brainSeeds: delivered to ${r.delivered.toString()} repo(s), ${r.noop.toString()} already current.`);
+        if (!r.converged) {
+          ctx.onProgress?.("brainSeeds: not fully delivered (no Key Vault, or some repos failed) \u2014 stamp NOT advanced; will retry next converge.");
+          continue;
+        }
+        stamp.components.brainSeeds = { seedRev: a.to };
       } else {
         if (!a.personaName) {
           throw new LocalCliError({ code: "PLATFORM_PERSONA_NO_NAME", message: "persona action missing personaName" });
         }
         const r = await deps.applyPersona(a, ctx);
         if (r === "absent") {
-          ctx.onProgress?.(`persona '${a.personaName}': not deployed on this install \u2014 stamp left unchanged.`);
-        } else {
-          const prev = Object.hasOwn(stamp.components.personas, a.personaName) ? stamp.components.personas[a.personaName] : void 0;
-          stamp.components.personas[a.personaName] = r === "noop" ? { treeSha: a.to, foundryVersion: prev?.foundryVersion ?? "" } : r;
+          ctx.onProgress?.(`persona '${a.personaName}': not deployed on this install \u2014 skipped (not gated).`);
+          continue;
         }
+        const prev = Object.hasOwn(stamp.components.personas, a.personaName) ? stamp.components.personas[a.personaName] : void 0;
+        stamp.components.personas[a.personaName] = r === "noop" ? { treeSha: a.to, foundryVersion: prev?.foundryVersion ?? "" } : r;
       }
       applied.push(a);
       stamp.lastResult = "partial";
@@ -18186,6 +18476,9 @@ async function applyPlan(plan, deps, ctx) {
     }
     stamp.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     await deps.writeStamp(stamp);
+    if (!isTargeted && ctx.suffix && deps.writeInfraParams) {
+      await deps.writeInfraParams(ctx, ctx.suffix);
+    }
     return { stamp, applied };
   } catch (e) {
     stamp.lastResult = "failed";
@@ -18208,7 +18501,14 @@ function seedStamp(prior, manifest, plan) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     lastResult: "partial",
     cli: "",
-    components: { gateway: blankImg(), codingAgent: blankImg(), azureExecutor: blankImg(), personas: {}, infra: { treeSha: "" } }
+    components: {
+      gateway: blankImg(),
+      codingAgent: blankImg(),
+      azureExecutor: blankImg(),
+      personas: {},
+      infra: { treeSha: "" },
+      brainSeeds: { seedRev: "" }
+    }
   };
 }
 async function applyGatewayImage(a, ctx, gatewayResourceId) {
@@ -18277,7 +18577,8 @@ async function resolveBicepParamsForConverge(ctx, opts = {}) {
     foundryProjectEndpoint: opts.foundryEndpoint ?? "",
     acrPullIdentityResourceId,
     acrResourceId,
-    foundryTracingMode: opts.foundryTracingMode
+    foundryTracingMode: opts.foundryTracingMode,
+    ...opts.assignSubscriptionRoles !== void 0 ? { assignSubscriptionRoles: opts.assignSubscriptionRoles } : {}
   };
 }
 function swapHostedImage(def, newImage) {
@@ -18301,7 +18602,7 @@ async function applyAgentImage(a, ctx, opts) {
 function declaredFillableFields(personaPath) {
   let raw;
   try {
-    raw = fs21.readFileSync(personaPath, "utf8");
+    raw = fs22.readFileSync(personaPath, "utf8");
   } catch {
     return [];
   }
@@ -18327,7 +18628,7 @@ function injectAndRender(personaPath, values, agentName) {
 function loaderText(loaderPath) {
   if (!loaderPath) return null;
   try {
-    return fs21.readFileSync(loaderPath, "utf8");
+    return fs22.readFileSync(loaderPath, "utf8");
   } catch {
     return null;
   }
@@ -18344,7 +18645,7 @@ function brainRepoOf(current) {
 }
 async function applyPersona(a, ctx, opts) {
   const current = await getAgentVersion({ credential: ctx.credential, projectEndpoint: opts.project.endpoint, agentName: opts.agentName });
-  const personaPath = path20.join(opts.personaDir, "persona.md");
+  const personaPath = path21.join(opts.personaDir, "persona.md");
   const yamlValues = readAgentYaml(opts.agentName)?.fillableFieldValues ?? null;
   const values = resolveFillableValues(current, yamlValues);
   const declared = declaredFillableFields(personaPath);
@@ -18543,8 +18844,411 @@ import { confirm as confirm5 } from "@inquirer/prompts";
 import { DefaultAzureCredential as DefaultAzureCredential17 } from "@azure/identity";
 
 // src/lib/platform-converge-cli.ts
-import * as path21 from "path";
+import * as path25 from "path";
+
+// src/lib/platform-infra-params.ts
+import { TableClient as TableClient2 } from "@azure/data-tables";
+async function openInfraParamsTable(opts) {
+  const { tableEndpoint } = await discoverStampStorage(opts);
+  return new TableClient2(tableEndpoint, "Metadata", opts.credential);
+}
+async function readInfraParams(client) {
+  try {
+    return entityToInfraParams(await client.getEntity(INFRA_PARAMS_PK, INFRA_PARAMS_RK));
+  } catch {
+    return null;
+  }
+}
+async function writeInfraParams(client, p) {
+  await client.upsertEntity(infraParamsToEntity(p), "Replace");
+}
+async function deriveSuffixVerified(opts) {
+  const list = JSON.parse(
+    await runAz([
+      "containerapp",
+      "list",
+      "-g",
+      opts.resourceGroup,
+      "--subscription",
+      opts.subscriptionId,
+      "--query",
+      "[?starts_with(name, 'm8t-gateway-')].name",
+      "-o",
+      "json"
+    ])
+  );
+  if (list.length !== 1) return null;
+  const suffix = list[0].replace(/^m8t-gateway-/, "");
+  const cae = JSON.parse(
+    await runAz([
+      "containerapp",
+      "env",
+      "list",
+      "-g",
+      opts.resourceGroup,
+      "--subscription",
+      opts.subscriptionId,
+      "--query",
+      `[?name=='m8t-cae-${suffix}'].name`,
+      "-o",
+      "json"
+    ])
+  );
+  return cae.length === 1 ? suffix : null;
+}
+
+// src/lib/platform-converge-cli.ts
+init_errors();
+
+// src/lib/seed-refresh-driver.ts
+init_esm2();
+import * as path24 from "path";
+
+// src/lib/seed-refresh.ts
 init_errors();
+import * as fs24 from "fs";
+import * as path23 from "path";
+
+// src/lib/seed-merge.ts
+import * as fs23 from "fs";
+import * as os10 from "os";
+import * as path22 from "path";
+import { spawnSync as spawnSync3 } from "child_process";
+function isProbablyText(s) {
+  return !s.includes("\0");
+}
+function mergeThreeWay(ours, base, theirs) {
+  if (![ours, base, theirs].every(isProbablyText)) {
+    return { ok: false, merged: "" };
+  }
+  const lf = (s) => s.replace(/\r\n/g, "\n");
+  const dir = fs23.mkdtempSync(path22.join(os10.tmpdir(), "seed-merge-"));
+  try {
+    const o = path22.join(dir, "ours");
+    const b = path22.join(dir, "base");
+    const t = path22.join(dir, "theirs");
+    fs23.writeFileSync(o, lf(ours));
+    fs23.writeFileSync(b, lf(base));
+    fs23.writeFileSync(t, lf(theirs));
+    const res = spawnSync3(
+      "git",
+      ["merge-file", "-p", "--diff3", o, b, t],
+      {
+        encoding: "utf8",
+        maxBuffer: 32 * 1024 * 1024
+      }
+    );
+    if (res.status === 0) {
+      return { ok: true, merged: res.stdout };
+    }
+    return { ok: false, merged: "" };
+  } finally {
+    fs23.rmSync(dir, { recursive: true, force: true });
+  }
+}
+var skip = (path37, skipReason) => ({ path: path37, kind: "skip", skipReason });
+function classifyCandidate(c) {
+  const { path: path37, base, ours, theirs } = c;
+  if (theirs === base) return { path: path37, kind: "noop" };
+  if (base === null) {
+    if (theirs === null) return { path: path37, kind: "noop" };
+    if (ours === null) return { path: path37, kind: "add", content: theirs };
+    if (ours === theirs) return { path: path37, kind: "noop" };
+    return skip(path37, "you already have a file at this path");
+  }
+  if (ours === null) {
+    return theirs === null ? { path: path37, kind: "noop" } : skip(path37, "you removed this file; upstream changed it");
+  }
+  if (theirs === null) {
+    return ours === base ? { path: path37, kind: "delete" } : skip(path37, "you edited this file; upstream removed it");
+  }
+  if (ours === base) return { path: path37, kind: "update", content: theirs };
+  const m = mergeThreeWay(ours, base, theirs);
+  return m.ok ? { path: path37, kind: "update", content: m.merged } : skip(path37, "your edits conflict with the update");
+}
+
+// src/lib/seed-pr-body.ts
+function composeSeedPrTitle(s) {
+  return `Update your ${s.advisorLabel}'s built-in skills & guides (${s.version})`;
+}
+var basename = (p) => p.split("/").filter(Boolean).slice(-2).join("/");
+function composeSeedPrBody(s) {
+  const lines = [];
+  lines.push(`This refreshes the skills and reference guides that came built into your ${s.advisorLabel}, bringing them up to date with platform release **${s.version}**.`);
+  lines.push("");
+  if (s.updated.length || s.added.length || s.deleted.length) {
+    lines.push("**What changed**");
+    if (s.updated.length) lines.push(`- \u270F\uFE0F Updated ${s.updated.length.toString()}: ${s.updated.map(basename).join(", ")}`);
+    if (s.added.length) lines.push(`- \u2795 Added ${s.added.length.toString()}: ${s.added.map(basename).join(", ")}`);
+    if (s.deleted.length) lines.push(`- \u{1F5D1}\uFE0F Removed ${s.deleted.length.toString()}: ${s.deleted.map(basename).join(", ")}`);
+    lines.push("");
+  }
+  lines.push("**Your own content is untouched.** Only built-in files change here \u2014 nothing you or your advisor wrote (your memory, your inbox, skills your advisor learned on its own) is modified.");
+  if (s.skipped.length) {
+    lines.push("");
+    lines.push(`**${s.skipped.length.toString()} file(s) were left as-is** because you've customized them and we won't overwrite your edits. To take an update anyway, open that file in the latest release and copy the changes over by hand:`);
+    for (const sk of s.skipped) lines.push(`- \`${sk.path}\` \u2014 ${sk.skipReason}`);
+  }
+  lines.push("");
+  lines.push("Your advisor's review workflow will check this PR automatically. Merge whenever you're ready.");
+  lines.push("");
+  lines.push(`\u2014 Opened by the m8t platform \xB7 release ${s.version}${s.notesUrl ? ` \xB7 [release notes](${s.notesUrl})` : ""}`);
+  return lines.join("\n");
+}
+
+// src/lib/seed-refresh.ts
+function readIf(dir, rel) {
+  if (!dir) return null;
+  const abs = path23.join(dir, rel);
+  return fs24.existsSync(abs) ? fs24.readFileSync(abs, "utf8") : null;
+}
+async function assembleCandidates(args) {
+  const paths = /* @__PURE__ */ new Set([...args.lineage?.ownedPaths ?? [], ...args.trees.ownedAtTheirs]);
+  const out = [];
+  for (const p of [...paths].sort((a, b) => a.localeCompare(b))) {
+    out.push({ path: p, base: readIf(args.trees.baseDir, p), theirs: readIf(args.trees.theirsDir, p), ours: await args.source.readOurs(p) });
+  }
+  return out;
+}
+function assertNoDanglingIndexRefs(finalPaths, repoHas, indexBodies) {
+  const refRe = /skills\/[^)\s]+\/SKILL\.md/g;
+  for (const idx of indexBodies) {
+    for (const m of idx.body.matchAll(refRe)) {
+      const ref = m[0];
+      if (!finalPaths.has(ref) && !repoHas(ref)) {
+        throw new LocalCliError({
+          code: "PLATFORM_SEED_INDEX_DANGLING",
+          message: `Refusing to open a PR: ${idx.path} would reference a missing skill '${ref}'. The brain loader only opens indexed paths.`
+        });
+      }
+    }
+  }
+}
+async function refreshBrainRepo(args) {
+  const cands = await assembleCandidates({ lineage: args.lineage, trees: args.trees, source: args.source, seedName: args.seedName });
+  const outcomes = cands.map(classifyCandidate);
+  const files = [];
+  const updated = [];
+  const added = [];
+  const deleted = [];
+  const skipped = [];
+  const indexBodies = [];
+  const finalPaths = /* @__PURE__ */ new Set();
+  for (const o of outcomes) {
+    if (o.path === SEED_MANIFEST_PATH) continue;
+    if (o.kind === "update") {
+      files.push({ path: o.path, content: o.content ?? "" });
+      updated.push(o.path);
+      finalPaths.add(o.path);
+    } else if (o.kind === "add") {
+      files.push({ path: o.path, content: o.content ?? "" });
+      added.push(o.path);
+      finalPaths.add(o.path);
+    } else if (o.kind === "delete") {
+      files.push({ path: o.path, delete: true });
+      deleted.push(o.path);
+    } else if (o.kind === "skip") {
+      skipped.push({ path: o.path, skipReason: o.skipReason ?? "left as-is" });
+    }
+    if (o.path.endsWith("/_index.md") && (o.kind === "update" || o.kind === "add")) {
+      indexBodies.push({ path: o.path, body: o.content ?? "" });
+    }
+  }
+  const contentChanged = updated.length + added.length + deleted.length > 0;
+  if (!contentChanged) {
+    return { repo: args.repo, prUrl: null, action: "noop", updated, added, deleted, skipped };
+  }
+  const ownedNow = new Set(args.trees.ownedAtTheirs);
+  assertNoDanglingIndexRefs(finalPaths, (p) => ownedNow.has(p), indexBodies);
+  const newOwned = deriveOwnedPaths(args.trees.theirsDir);
+  const nextManifest = upsertLineage(
+    args.priorManifest ?? (args.lineage ? { schemaVersion: 1, seeds: [args.lineage] } : null),
+    {
+      name: args.seedName,
+      refreshedToCommit: args.targetCommit ?? "",
+      refreshedToVersion: args.version,
+      ownedPaths: newOwned
+    }
+  );
+  files.push({ path: SEED_MANIFEST_PATH, content: serializeSeedManifest(nextManifest) });
+  for (const sb of args.supersedeBranches ?? []) {
+    if (sb === args.branch) continue;
+    const stale = await args.api.findOpenPr(sb);
+    if (stale) await args.api.closePr(stale.number, `superseded by the newer update on \`${args.branch}\`.`);
+  }
+  const opened = await args.api.findOpenPr(args.branch);
+  const headSha = await args.api.getHeadSha(args.base);
+  await args.api.commitFromBase(files, args.branch, headSha, `chore(seed): refresh built-in skills & guides (${args.version})`);
+  const summary = {
+    advisorLabel: args.advisorLabel,
+    version: args.version,
+    notesUrl: args.notesUrl,
+    repo: args.repo,
+    updated,
+    added,
+    deleted,
+    skipped
+  };
+  const title = composeSeedPrTitle(summary);
+  const body = composeSeedPrBody(summary);
+  if (opened) {
+    await args.api.updatePr(opened.number, title, body);
+    return { repo: args.repo, prUrl: opened.htmlUrl, action: "updated", updated, added, deleted, skipped };
+  }
+  const pr = await args.api.openPr(args.branch, args.base, title, body);
+  return { repo: args.repo, prUrl: pr.htmlUrl, action: args.lineage ? "opened" : "bootstrapped", updated, added, deleted, skipped };
+}
+
+// src/lib/seed-refresh-driver.ts
+var PERSONA_SEED_MAP = {
+  "startup-advisor": "startup-advisor",
+  "azure-advisor": "azure-advisor"
+};
+var ADVISOR_LABEL = {
+  "startup-advisor": "Startup Advisor",
+  "azure-advisor": "Azure Advisor"
+};
+function dedupeBrainRepos(agents) {
+  const byRepo = /* @__PURE__ */ new Map();
+  for (const a of agents) {
+    const raw = a.metadata.brain;
+    if (!raw) continue;
+    let repo;
+    let installationId;
+    try {
+      const parsed = JSON.parse(raw);
+      repo = parsed.repo;
+      installationId = parsed.installationId;
+    } catch {
+      repo = void 0;
+      installationId = void 0;
+    }
+    if (!repo || !installationId) continue;
+    const seedName = a.metadata.persona ? PERSONA_SEED_MAP[a.metadata.persona] ?? null : null;
+    if (!byRepo.has(repo)) byRepo.set(repo, { repo, seedName, installationId });
+  }
+  return [...byRepo.values()];
+}
+function seedContentDir(contentRoot, manifest, seedName) {
+  const items = manifest.components.brainSeeds.items;
+  if (!Object.hasOwn(items, seedName)) return null;
+  return path24.join(contentRoot, items[seedName].path);
+}
+function bindRepoApi(token, repo) {
+  return {
+    getDefaultBranch: () => Promise.resolve("main"),
+    getHeadSha: async (branch) => {
+      const res = await fetch(`https://api.github.com/repos/${repo}/git/ref/heads/${branch}`, {
+        headers: { Authorization: `token ${token}`, Accept: "application/vnd.github+json", "User-Agent": "m8t" }
+      });
+      const j = await res.json();
+      return j.object?.sha ?? "";
+    },
+    findOpenPr: (head) => findOpenPr({ token, repo, head }),
+    commitFromBase: (files, branch, baseSha, message) => commitFilesFromBaseViaApp({ token, repo, branch, baseSha, files, message }),
+    openPr: (head, base, title, body) => openPullRequestViaApp({ token, repo, base, head, title, body }),
+    updatePr: (n, title, body) => updatePullRequestViaApp({ token, repo, number: n, title, body }),
+    closePr: (n, comment) => closePullRequestViaApp({ token, repo, number: n, comment }),
+    readFileAtRef: (path37, ref) => readRepoFileViaApp({ token, repo, path: path37, ref })
+  };
+}
+async function runSeedRefresh(args) {
+  const targetCommit = args.manifest.platform.commit;
+  const theirsRoot = await resolveReleaseContent(args.manifest, {});
+  const repos = dedupeBrainRepos(args.agents);
+  const results = [];
+  let delivered = 0;
+  let noop2 = 0;
+  let failed = 0;
+  for (const ref of repos) {
+    try {
+      const minted = await mintInstallationToken({
+        credential: args.credential,
+        kvUri: args.kvUri,
+        installationId: ref.installationId,
+        repository: ref.repo,
+        permissions: { contents: "write", pull_requests: "write" }
+      });
+      const token = minted.token;
+      const probe = appRepoProbe({ token, repo: ref.repo });
+      const state = await probeRepoState(probe);
+      if (state !== "m8t-brain") {
+        args.onWarn?.(`${ref.repo}: not a reachable m8t brain (${state}) \u2014 skipped.`);
+        continue;
+      }
+      const markerText = await readRepoFileViaApp({ token, repo: ref.repo, path: SEED_MANIFEST_PATH });
+      const marker = parseSeedManifest(markerText);
+      const seedName = ref.seedName ?? marker?.seeds[0]?.name ?? null;
+      if (!seedName) {
+        args.onWarn?.(`${ref.repo}: cannot determine seed lineage \u2014 skipped.`);
+        continue;
+      }
+      const theirsDir = seedContentDir(theirsRoot, args.manifest, seedName);
+      if (!theirsDir) {
+        args.onWarn?.(`${ref.repo}: seed '${seedName}' is not in this release \u2014 skipped.`);
+        continue;
+      }
+      const advisorLabel = ADVISOR_LABEL[seedName] ?? seedName;
+      let lineage = marker?.seeds.find((s) => s.name === seedName) ?? null;
+      let baseDir = null;
+      if (lineage) {
+        try {
+          const baseRoot = await resolveReleaseContent(
+            { ...args.manifest, platform: { ...args.manifest.platform, commit: lineage.refreshedToCommit } },
+            {}
+          );
+          baseDir = seedContentDir(baseRoot, args.manifest, seedName);
+        } catch {
+          baseDir = null;
+          args.onWarn?.(`${ref.repo}: base rev ${lineage.refreshedToCommit} unfetchable \u2014 falling back to marker-only re-adopt.`);
+          lineage = null;
+        }
+      } else {
+        const initSha = await getInitialSeedCommitSha({ token, repo: ref.repo });
+        if (initSha) {
+          try {
+            const baseRoot = await resolveReleaseContent(
+              { ...args.manifest, platform: { ...args.manifest.platform, commit: initSha } },
+              {}
+            );
+            baseDir = seedContentDir(baseRoot, args.manifest, seedName);
+            lineage = baseDir ? { name: seedName, refreshedToCommit: initSha, refreshedToVersion: "(bootstrap)", ownedPaths: deriveOwnedPaths(baseDir) } : null;
+          } catch {
+            baseDir = null;
+          }
+        }
+      }
+      const trees = { baseDir, theirsDir, ownedAtTheirs: deriveOwnedPaths(theirsDir) };
+      const source = { readOurs: (p) => readRepoFileViaApp({ token, repo: ref.repo, path: p }) };
+      const res = await refreshBrainRepo({
+        repo: ref.repo,
+        branch: `m8t/seed-update-${args.version}`,
+        base: "main",
+        version: args.version,
+        notesUrl: args.manifest.platform.notesUrl,
+        advisorLabel,
+        seedName,
+        lineage,
+        trees,
+        source,
+        api: bindRepoApi(token, ref.repo),
+        targetCommit,
+        priorManifest: marker
+      });
+      results.push(res);
+      if (res.action === "noop") noop2++;
+      else delivered++;
+      args.onProgress?.(`${ref.repo}: ${res.action}${res.prUrl ? ` \u2192 ${res.prUrl}` : ""}`);
+    } catch (e) {
+      failed++;
+      args.onWarn?.(`${ref.repo}: seed refresh failed \u2014 ${e.message}; skipped this repo.`);
+      continue;
+    }
+  }
+  return { delivered, noop: noop2, failed, results };
+}
+
+// src/lib/platform-converge-cli.ts
 var HOSTED_AGENT_PERSONA_DIR = {
   codingAgent: "coding-agent",
   azureExecutor: "azure-executor"
@@ -18558,7 +19262,7 @@ async function buildConvergeDeps(args) {
     const persona = a.metadata.persona;
     if (persona) discovered[persona] = a.name;
   }
-  const loaderPath = path21.join(args.contentDir, "targets/foundry/brain-loader.md");
+  const loaderPath = path25.join(args.contentDir, "targets/foundry/brain-loader.md");
   return {
     async applyPersona(a, ctx) {
       const personaName = a.personaName;
@@ -18574,7 +19278,7 @@ async function buildConvergeDeps(args) {
       return applyPersona(a, ctx, {
         agentName,
         project: args.project,
-        personaDir: path21.join(ctx.contentDir, personaItem.path),
+        personaDir: path25.join(ctx.contentDir, personaItem.path),
         loaderPath
       });
     },
@@ -18603,7 +19307,23 @@ async function buildConvergeDeps(args) {
     },
     async applyInfra(a, ctx) {
       const target = infraTargetSha(ctx.manifest, args.tree);
-      return applyInfraDeploy(a, ctx, target, { suffix: args.suffix });
+      const infraTable = await openInfraParamsTable({ credential: args.credential, subscriptionId: args.subscriptionId, resourceGroup: args.resourceGroup });
+      const stamped = (await readInfraParams(infraTable))?.bicep;
+      args.onProgress?.("subscription-scoped modules skipped: updater is RG-scoped; sub-level changes require a founder-run CLI converge.");
+      const opts = {
+        suffix: args.suffix,
+        assignSubscriptionRoles: false,
+        ...stamped ? {
+          tenantId: stamped.tenantId,
+          clientId: stamped.clientId,
+          foundryEndpoint: stamped.foundryProjectEndpoint,
+          foundryResourceId: stamped.foundryResourceId,
+          acrPullIdentity: stamped.acrPullIdentityResourceId,
+          acrResourceId: stamped.acrResourceId,
+          ...stamped.foundryTracingMode ? { foundryTracingMode: stamped.foundryTracingMode } : {}
+        } : {}
+      };
+      return applyInfraDeploy(a, ctx, target, opts);
     },
     async healthGate(_ctx, applied) {
       for (const a of applied) {
@@ -18644,6 +19364,47 @@ async function buildConvergeDeps(args) {
         stamp: { ...s, cli: CLI_VERSION },
         onProgress: args.onProgress
       });
+    },
+    async writeInfraParams(ctx, _suffix) {
+      const table = await openInfraParamsTable({ credential: args.credential, subscriptionId: args.subscriptionId, resourceGroup: args.resourceGroup });
+      const existing = await readInfraParams(table);
+      if (!existing) {
+        warn("infra-params re-stamp skipped: no existing row to refresh (deploy/enable-auto-update writes the authoritative row).");
+        return;
+      }
+      await writeInfraParams(table, {
+        ...existing,
+        bicep: {
+          ...existing.bicep,
+          imageRef: `${ctx.manifest.components.gateway.ref}:${ctx.manifest.components.gateway.tag}`
+        },
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    },
+    async applySeedRefresh(_a3, ctx) {
+      let kvUri;
+      try {
+        kvUri = discoverKvUri(process.env);
+      } catch {
+        kvUri = void 0;
+      }
+      if (!kvUri) {
+        warn("brainSeeds: no Key Vault URI (set AZURE_KEYVAULT_URI) \u2014 skipping seed refresh.");
+        return { delivered: 0, noop: 0, converged: false };
+      }
+      const { delivered, noop: noop2, failed } = await runSeedRefresh({
+        credential: args.credential,
+        kvUri,
+        manifest: ctx.manifest,
+        agents: discoveredAgents,
+        version: ctx.manifest.platform.version,
+        onProgress: args.onProgress,
+        onWarn: args.onWarn
+      });
+      if (failed > 0) {
+        warn(`brainSeeds: ${failed.toString()} repo(s) failed to receive a seed update \u2014 re-run 'm8t platform update --only brainSeeds' to retry.`);
+      }
+      return { delivered, noop: noop2, converged: failed === 0 };
     }
   };
 }
@@ -18683,7 +19444,7 @@ var PlatformUpdateCommand = class extends M8tCommand {
     description: "Pin the platform version to converge to (defaults to the current release channel)."
   });
   only = Option30.String("--only", {
-    description: "Converge only one component: infra | gateway | codingAgent | azureExecutor | personas."
+    description: "Converge only one component: infra | gateway | codingAgent | azureExecutor | personas | brainSeeds."
   });
   check = Option30.Boolean("--check", false);
   yes = Option30.Boolean("--yes", false);
@@ -18799,40 +19560,529 @@ var PlatformUpdateCommand = class extends M8tCommand {
       onProgress,
       onWarn
     });
-    await applyPlan(plan, deps, { credential: credential2, subscriptionId, resourceGroup, contentDir, manifest, onProgress });
+    await applyPlan(plan, deps, { credential: credential2, subscriptionId, resourceGroup, contentDir, manifest, onProgress, suffix });
     if (mode === "json") this.context.stdout.write(renderJson({ ...plan, applied: true }) + "\n");
     else log(colors.success(`converged \u2192 ${plan.targetVersion} \u2713`));
     return 0;
   }
-  renderPlan(plan, mode) {
-    if (mode === "json") return;
-    const rows = [
-      ...plan.actions.map((a) => ({
-        component: a.personaName ? `personas:${a.personaName}` : a.component,
-        from: a.from ?? "(none)",
-        to: a.to,
-        reason: a.reason
-      })),
-      ...plan.skipped.map((s) => ({
-        component: s.personaName ? `personas:${s.personaName}` : s.component,
-        from: "-",
-        to: "-",
-        reason: s.reason
-      }))
-    ];
-    this.context.stdout.write(
-      renderTable(rows, [
-        { key: "component", label: "COMPONENT" },
-        { key: "from", label: "FROM" },
-        { key: "to", label: "TO" },
-        { key: "reason", label: "REASON" }
-      ]) + "\n"
-    );
+  renderPlan(plan, mode) {
+    if (mode === "json") return;
+    const rows = [
+      ...plan.actions.map((a) => ({
+        component: a.personaName ? `personas:${a.personaName}` : a.component,
+        from: a.from ?? "(none)",
+        to: a.to,
+        reason: a.reason
+      })),
+      ...plan.skipped.map((s) => ({
+        component: s.personaName ? `personas:${s.personaName}` : s.component,
+        from: "-",
+        to: "-",
+        reason: s.reason
+      }))
+    ];
+    this.context.stdout.write(
+      renderTable(rows, [
+        { key: "component", label: "COMPONENT" },
+        { key: "from", label: "FROM" },
+        { key: "to", label: "TO" },
+        { key: "reason", label: "REASON" }
+      ]) + "\n"
+    );
+  }
+};
+
+// src/commands/platform/converge.ts
+import { Command as Command33 } from "clipanion";
+
+// src/lib/platform-converge-mi.ts
+import { ManagedIdentityCredential } from "@azure/identity";
+init_errors();
+function resolveHeadlessContextFromEnv(env) {
+  const need = (k) => {
+    const v = (env[k] ?? "").trim();
+    if (!v) throw new LocalCliError({ code: "HEADLESS_ENV_MISSING", message: `converge: required env ${k} is unset` });
+    return v;
+  };
+  const miClientId = need("MI_CLIENT_ID");
+  return {
+    credential: new ManagedIdentityCredential({ clientId: miClientId }),
+    miClientId,
+    subscriptionId: need("SUBSCRIPTION_ID"),
+    resourceGroup: need("RESOURCE_GROUP"),
+    endpoint: need("FOUNDRY_ENDPOINT"),
+    channelUrl: (env.M8T_UPDATE_CHANNEL_URL ?? "").trim() || CHANNEL_LATEST_URL
+  };
+}
+
+// src/lib/apply-request-store.ts
+import { TableClient as TableClient3 } from "@azure/data-tables";
+async function openApplyTable(opts) {
+  const { tableEndpoint } = await discoverStampStorage(opts);
+  return new TableClient3(tableEndpoint, "Metadata", opts.credential);
+}
+function hasStatus(e, n) {
+  return e.statusCode === n;
+}
+async function readApplyRequest(client) {
+  try {
+    const row = await client.getEntity(APPLY_REQUEST_PK, APPLY_REQUEST_RK);
+    return { ...entityToApplyRequest(row), etag: row.etag };
+  } catch (e) {
+    if (hasStatus(e, 404)) return null;
+    throw e;
+  }
+}
+async function claimApplyRequest(client, executionId, nowIso, leaseMs) {
+  const cur = await readApplyRequest(client);
+  if (!cur) return null;
+  const leaseExpired = cur.status === "claimed" && cur.leaseUntil !== null && Date.parse(cur.leaseUntil) < Date.parse(nowIso);
+  const claimable = cur.status === "pending" || cur.status === "awaiting-engine-update" || leaseExpired;
+  if (!claimable) return null;
+  const nowMs = Date.parse(nowIso);
+  const leaseUntil = new Date((Number.isNaN(nowMs) ? Date.now() : nowMs) + leaseMs).toISOString();
+  const claimed = { ...cur, status: "claimed", claimedBy: executionId, leaseUntil, updatedAt: nowIso };
+  try {
+    await client.updateEntity({ ...applyRequestToEntity(claimed), etag: cur.etag }, "Merge", { etag: cur.etag });
+    return claimed;
+  } catch (e) {
+    if (hasStatus(e, 412)) return null;
+    throw e;
+  }
+}
+async function patchApplyRequest(client, mutate) {
+  const cur = await readApplyRequest(client);
+  if (!cur) return;
+  const next = mutate(cur);
+  await client.updateEntity({ ...applyRequestToEntity(next), etag: cur.etag }, "Merge", { etag: cur.etag });
+}
+
+// src/lib/platform-self-update.ts
+import * as fs25 from "fs";
+import * as path26 from "path";
+function toVTag2(v) {
+  return v.startsWith("v") ? v : `v${v}`;
+}
+function readBakedReleaseVersion(repoRoot) {
+  if (!repoRoot) return null;
+  try {
+    const raw = fs25.readFileSync(path26.join(repoRoot, "installer", "version.json"), "utf8");
+    const v = JSON.parse(raw).version;
+    return typeof v === "string" && v.length > 0 ? v : null;
+  } catch {
+    return null;
+  }
+}
+function needsEngineUpdate(manifest, runningVersion, bakedRelease) {
+  if (runningVersion === "0.0.0-dev") return false;
+  if (bakedRelease != null && bakedRelease.length > 0 && bakedRelease !== manifest.components.installer.version) return true;
+  const running = toVTag2(runningVersion);
+  const min = toVTag2(manifest.components.cli.min);
+  return compareSemver(running, min) < 0;
+}
+async function updateOwnJobImage(opts) {
+  const inst = opts.manifest.components.installer;
+  const image = `${inst.ref}:${inst.tag}`;
+  const job = opts.jobName ?? process.env.UPDATER_JOB_NAME;
+  if (!job) throw new Error("UPDATER_JOB_NAME unset \u2014 cannot self-update the updater job image");
+  await runAz([
+    "containerapp",
+    "job",
+    "update",
+    "-n",
+    job,
+    "-g",
+    opts.resourceGroup,
+    "--subscription",
+    opts.subscriptionId,
+    "--image",
+    image,
+    "--only-show-errors"
+  ]);
+}
+
+// src/lib/platform-health-gate.ts
+function nextBreaker(cur) {
+  return cur === "none" ? "rolled-back" : "held";
+}
+function gateTargetsFor(applied) {
+  const targets = [];
+  for (const a of applied) {
+    if (a.component === "gateway") {
+      targets.push({ kind: "gateway-version", expected: a.to });
+    } else if (a.component === "codingAgent" || a.component === "azureExecutor") {
+      targets.push({ kind: "agent-queryable", component: a.component });
+    } else if (a.component === "personas" && a.personaName) {
+      targets.push({ kind: "agent-queryable", persona: a.personaName });
+    }
+  }
+  return targets;
+}
+function gatePassed(probes) {
+  return probes.every((p) => p.ok);
+}
+async function runHealthGateWithRollback(args) {
+  const notify = args.notify ?? (async () => {
+  });
+  const budgetMs = args.gateBudgetMs ?? 5 * 6e4;
+  const target = args.plan.targetVersion;
+  let applied = [];
+  try {
+    const result = await applyPlan(args.plan, args.deps, args.ctx);
+    applied = result.applied;
+    const outcomes = await runGate(args, applied, budgetMs);
+    if (!gatePassed(outcomes)) {
+      const detail = outcomes.find((o) => !o.ok)?.detail ?? "a post-apply health probe failed";
+      return await rollbackOrHold(args, notify, detail);
+    }
+    await patchApplyRequest(args.client, (r) => ({
+      ...r,
+      status: "success",
+      breaker: r.breaker,
+      // unchanged — a clean apply never trips the breaker
+      result: { appliedVersion: target, error: null },
+      updatedAt: args.now().toISOString()
+    }));
+    await notify({ outcome: "success", target });
+    return "success";
+  } catch (e) {
+    return await rollbackOrHold(args, notify, e.message);
+  }
+}
+async function runGate(args, applied, budgetMs) {
+  const deadline = args.now().getTime() + budgetMs;
+  const probeGateway = args.probeGatewayVersion ?? defaultGatewayProbe;
+  const probeAgent = args.probeAgentQueryable ?? defaultAgentProbe;
+  const outcomes = [];
+  for (const t of gateTargetsFor(applied)) {
+    if (args.now().getTime() > deadline) {
+      outcomes.push({ ok: false, detail: "health gate exceeded its time budget" });
+      break;
+    }
+    if (t.kind === "gateway-version") {
+      if (!args.gatewayUrl) continue;
+      outcomes.push(await probeGateway(args.gatewayUrl, t.expected));
+    } else {
+      const agentName = "persona" in t ? t.persona : hostedAgentName(t.component);
+      outcomes.push(await probeAgent({ credential: args.credential, endpoint: args.endpoint, agentName }));
+    }
+  }
+  return outcomes;
+}
+async function rollbackOrHold(args, notify, error) {
+  const target = args.plan.targetVersion;
+  const rollbackTarget = args.stamp.previousPlatformVersion;
+  const current = await readBreaker(args.client);
+  const next = nextBreaker(current);
+  if (next === "held") {
+    await patchApplyRequest(args.client, (r) => ({
+      ...r,
+      status: "held",
+      breaker: "held",
+      result: { appliedVersion: r.result?.appliedVersion ?? null, error },
+      updatedAt: args.now().toISOString()
+    }));
+    await notify({ outcome: "held", target, error });
+    return "held";
+  }
+  if (rollbackTarget) {
+    await reconvergeToPrevious(args, rollbackTarget);
+  }
+  await patchApplyRequest(args.client, (r) => ({
+    ...r,
+    status: "rolled-back",
+    breaker: "rolled-back",
+    result: { appliedVersion: rollbackTarget, error },
+    updatedAt: args.now().toISOString()
+  }));
+  await notify({ outcome: "rolled-back", target, error });
+  return "rolled-back";
+}
+async function reconvergeToPrevious(args, previousVersion) {
+  const fetchManifestImpl = args.fetchManifestImpl ?? fetchManifest;
+  const resolveContentImpl = args.resolveReleaseContentImpl ?? resolveReleaseContent;
+  const fetchTreeImpl = args.fetchRepoTreeImpl ?? fetchRepoTree;
+  const prevManifest = await fetchManifestImpl(manifestSourceForVersionTag(args.channelUrl ?? "", previousVersion));
+  const contentDir = await resolveContentImpl(prevManifest, args.repoRoot ? { contentDir: args.repoRoot } : {});
+  const tree = prevManifest.components.infra?.treeSha ? { treeShaOf: () => void 0 } : await fetchTreeImpl(prevManifest.platform.commit);
+  const liveStamp = await args.deps.readStamp();
+  const rollbackPlan = diffPlan(prevManifest, liveStamp, tree);
+  const rollbackCtx = { ...args.ctx, manifest: prevManifest, contentDir };
+  await applyPlan(rollbackPlan, args.deps, rollbackCtx);
+}
+async function defaultGatewayProbe(gatewayUrl, expected) {
+  try {
+    const res = await fetch(`${gatewayUrl}/api/version`, { method: "GET" });
+    if (res.status === 401 || res.status === 403) return { ok: true };
+    if (!res.ok) return { ok: false, detail: `gateway /api/version returned HTTP ${res.status.toString()}` };
+    const body = await res.json().catch(() => ({}));
+    if (body.version && !versionMatches(body.version, expected)) {
+      return { ok: false, detail: `gateway reports version '${body.version}', expected '${expected}'` };
+    }
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, detail: `gateway unreachable: ${e.message}` };
+  }
+}
+function versionMatches(running, expected) {
+  const norm = (s) => s.replace(/^v/, "").trim();
+  const r = norm(running);
+  const e = norm(expected);
+  return r === e || r.startsWith(e) || e.startsWith(r);
+}
+async function defaultAgentProbe(args) {
+  try {
+    await awaitAgentQueryable({ credential: args.credential, projectEndpoint: args.endpoint, agentName: args.agentName });
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, detail: `agent '${args.agentName}' not queryable: ${e.message}` };
+  }
+}
+function hostedAgentName(component) {
+  return component === "codingAgent" ? "coder" : "azure-executor";
+}
+async function readBreaker(client) {
+  const row = await readApplyRequest(client);
+  return row?.breaker ?? "none";
+}
+
+// src/commands/platform/converge.ts
+init_errors();
+function canonicalVersion(v) {
+  const bare = v.replace(/^platform-/, "");
+  return bare.startsWith("v") ? bare : `v${bare}`;
+}
+function isForwardTarget(target, installed) {
+  if (!installed) return true;
+  return compareSemver(canonicalVersion(target), canonicalVersion(installed)) >= 0;
+}
+async function failIfStillInFlight(client, now, error) {
+  const cur = await readApplyRequest(client);
+  if (!cur || !isInFlight(cur.status)) return;
+  await patchApplyRequest(client, (r) => ({
+    ...r,
+    status: "failed",
+    result: { appliedVersion: null, error },
+    updatedAt: now()
+  }));
+}
+var PlatformConvergeCommand = class extends M8tCommand {
+  static paths = [["platform", "converge"]];
+  static usage = Command33.Usage({
+    category: "Platform",
+    description: "Headless updater-job driver: claim a pending apply-request and converge the platform to it.",
+    details: "The Managed-Identity-authenticated entry point run by the updater Container Apps job. One invocation is one tick: it claims the pending apply-request row (if any), refuses a downgrade against the installed stamp, self-fetches and validates the target manifest, self-updates its own engine image when the manifest requires a newer CLI, then drives the F02 converge engine behind the T15 health-gate + auto-rollback. Reads its subscription/RG/endpoint/channel from env (MI_CLIENT_ID, SUBSCRIPTION_ID, RESOURCE_GROUP, FOUNDRY_ENDPOINT, M8T_UPDATE_CHANNEL_URL). Not intended for interactive use \u2014 the founder-facing path is 'm8t platform update'."
+  });
+  async executeCommand() {
+    const ctx = resolveHeadlessContextFromEnv(process.env);
+    const executionId = process.env.CONTAINER_APP_JOB_EXECUTION_NAME ?? `exec-${process.pid.toString()}`;
+    const now = () => (/* @__PURE__ */ new Date()).toISOString();
+    const log = (m) => {
+      this.context.stdout.write(m + "\n");
+    };
+    const client = await openApplyTable({
+      credential: ctx.credential,
+      subscriptionId: ctx.subscriptionId,
+      resourceGroup: ctx.resourceGroup
+    });
+    const claimed = await claimApplyRequest(client, executionId, now(), 30 * 60 * 1e3);
+    if (!claimed) {
+      log("no pending apply-request \u2014 nothing to converge.");
+      return 0;
+    }
+    log(`claimed apply-request \u2192 target ${claimed.target} (execution ${executionId}).`);
+    const stamp = await readStamp({
+      credential: ctx.credential,
+      subscriptionId: ctx.subscriptionId,
+      resourceGroup: ctx.resourceGroup
+    });
+    const installed = stamp ? stamp.platformVersion : null;
+    if (!isForwardTarget(claimed.target, installed)) {
+      await patchApplyRequest(client, (r) => ({
+        ...r,
+        status: "failed",
+        result: { appliedVersion: null, error: `refused downgrade ${installed ?? "(none)"} \u2192 ${claimed.target}` },
+        updatedAt: now()
+      }));
+      log(`refused: target ${claimed.target} is a downgrade from installed ${installed ?? "(none)"}.`);
+      return 1;
+    }
+    const manifest = await fetchManifest(targetManifestSource(ctx, claimed.target));
+    if (manifest.platform.version !== claimed.target) {
+      await patchApplyRequest(client, (r) => ({
+        ...r,
+        status: "failed",
+        result: { appliedVersion: null, error: `channel manifest is version ${manifest.platform.version}, expected the claimed target ${claimed.target}` },
+        updatedAt: now()
+      }));
+      log(`refused: fetched manifest version ${manifest.platform.version} \u2260 claimed target ${claimed.target}.`);
+      return 1;
+    }
+    const repoRoot = tryResolveRepoRoot();
+    const bakedRelease = readBakedReleaseVersion(repoRoot);
+    if (needsEngineUpdate(manifest, CLI_VERSION, bakedRelease)) {
+      log(
+        `self-updating the updater image (baked release ${bakedRelease ?? "(none)"} / engine ${CLI_VERSION} \u2192 target installer ${manifest.components.installer.version}, cli.min ${manifest.components.cli.min}).`
+      );
+      await updateOwnJobImage({
+        subscriptionId: ctx.subscriptionId,
+        resourceGroup: ctx.resourceGroup,
+        manifest
+      });
+      await patchApplyRequest(client, (r) => ({
+        ...r,
+        status: "awaiting-engine-update",
+        phase: "updating the updater engine image",
+        updatedAt: now()
+      }));
+      log("updater image bumped \u2014 awaiting-engine-update. The next tick re-claims with the new engine.");
+      return 0;
+    }
+    assertCliVersionOk(manifest, CLI_VERSION, (w) => this.context.stderr.write(w + "\n"));
+    await patchApplyRequest(client, (r) => ({ ...r, status: "applying", phase: "starting", updatedAt: now() }));
+    let plan;
+    let applyCtx;
+    let deps;
+    try {
+      const project = await resolveFoundryProject({
+        credential: ctx.credential,
+        subscriptionId: ctx.subscriptionId,
+        interactive: false,
+        endpoint: ctx.endpoint
+      });
+      const contentDir = await resolveReleaseContent(manifest, repoRoot ? { contentDir: repoRoot } : {});
+      const tree = manifest.components.infra?.treeSha ? { treeShaOf: () => void 0 } : await fetchRepoTree(manifest.platform.commit);
+      const suffix = await this.recoverSuffix(ctx);
+      const gatewayResourceId = await this.resolveGatewayResourceId(ctx, suffix);
+      deps = await buildConvergeDeps({
+        credential: ctx.credential,
+        subscriptionId: ctx.subscriptionId,
+        resourceGroup: ctx.resourceGroup,
+        contentDir,
+        manifest,
+        tree,
+        project,
+        gatewayResourceId,
+        suffix,
+        onProgress: (m) => {
+          void patchApplyRequest(client, (r) => ({ ...r, phase: m, updatedAt: now() })).catch(() => void 0);
+          log(m);
+        },
+        onWarn: (m) => this.context.stderr.write(m + "\n")
+      });
+      plan = diffPlan(manifest, stamp, tree, { forceInfra: true });
+      applyCtx = {
+        credential: ctx.credential,
+        subscriptionId: ctx.subscriptionId,
+        resourceGroup: ctx.resourceGroup,
+        contentDir,
+        manifest,
+        suffix,
+        onProgress: (m) => {
+          log(m);
+        }
+      };
+    } catch (e) {
+      await failIfStillInFlight(client, now, e.message);
+      throw e;
+    }
+    const outcome = await runHealthGateWithRollback({
+      client,
+      deps,
+      plan,
+      ctx: applyCtx,
+      stamp: stamp ?? seedStampFor(plan),
+      manifest,
+      credential: ctx.credential,
+      endpoint: ctx.endpoint,
+      // The rollback re-converge needs the SAME zero-repo-auth inputs as the
+      // forward path: baked content (repoRoot) + the channel to resolve the
+      // PREVIOUS version's manifest (never GitHub repo auth). Without these the
+      // rollback would 404 on the private pre-OSS repo just like the forward
+      // path did before this fix.
+      channelUrl: ctx.channelUrl,
+      repoRoot,
+      now: () => /* @__PURE__ */ new Date()
+    });
+    log(`converge outcome: ${outcome}.`);
+    return outcome === "success" ? 0 : 1;
+  }
+  /**
+   * Recover the real bicep suffix WITHOUT guessing: prefer the stamped
+   * `system/infra-params` row (written by deploy + every full converge), and
+   * fall back to deriving it from the live gateway container-app name — but only
+   * when that derivation VERIFIES (exactly one gateway + a matching CAE). If
+   * both fail, throw rather than provision a duplicate stack.
+   */
+  async recoverSuffix(ctx) {
+    const infraTable = await openInfraParamsTable({
+      credential: ctx.credential,
+      subscriptionId: ctx.subscriptionId,
+      resourceGroup: ctx.resourceGroup
+    });
+    const stamped = (await readInfraParams(infraTable))?.suffix;
+    const suffix = stamped ?? await deriveSuffixVerified({
+      credential: ctx.credential,
+      subscriptionId: ctx.subscriptionId,
+      resourceGroup: ctx.resourceGroup
+    });
+    if (!suffix) {
+      throw new LocalCliError({
+        code: "PLATFORM_INFRA_SUFFIX_UNRECOVERABLE",
+        message: "Could not recover the deployment's resource-name suffix: no system/infra-params row is stamped, and deriving it from the live gateway did not verify (0 or >1 gateway, or no matching CAE).",
+        hint: "Run a full 'm8t platform update --force-infra --suffix <suffix>' once to stamp system/infra-params, then re-run the updater."
+      });
+    }
+    return suffix;
+  }
+  /** Resolve the gateway container-app ARM resource id for the recovered suffix. */
+  async resolveGatewayResourceId(ctx, suffix) {
+    const id = (await runAz([
+      "containerapp",
+      "show",
+      "-n",
+      `m8t-gateway-${suffix}`,
+      "-g",
+      ctx.resourceGroup,
+      "--subscription",
+      ctx.subscriptionId,
+      "--query",
+      "id",
+      "-o",
+      "tsv"
+    ])).trim();
+    if (!id) {
+      throw new LocalCliError({
+        code: "PLATFORM_GATEWAY_NOT_FOUND",
+        message: `Could not resolve the gateway container app 'm8t-gateway-${suffix}' in resource group ${ctx.resourceGroup}.`
+      });
+    }
+    return id;
   }
 };
+function seedStampFor(plan) {
+  return {
+    schemaVersion: 1,
+    platformVersion: plan.targetVersion,
+    previousPlatformVersion: null,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    lastResult: "success",
+    cli: CLI_VERSION,
+    components: {
+      gateway: { tag: "", digest: "", state: "managed" },
+      codingAgent: { tag: "", digest: "", state: "managed" },
+      azureExecutor: { tag: "", digest: "", state: "managed" },
+      personas: {},
+      infra: { treeSha: "" }
+    }
+  };
+}
+function targetManifestSource(ctx, target) {
+  return manifestSourceForVersionTag(ctx.channelUrl, target);
+}
 
 // src/commands/platform/enable-cost-report.ts
-import { Command as Command33, Option as Option31 } from "clipanion";
+import { Command as Command34, Option as Option31 } from "clipanion";
 
 // src/lib/wire-gateway-acs.ts
 init_rbac();
@@ -18872,7 +20122,7 @@ async function wireGatewayForAcs(args) {
 init_errors();
 var PlatformEnableCostReportCommand = class extends M8tCommand {
   static paths = [["platform", "enable-cost-report"]];
-  static usage = Command33.Usage({
+  static usage = Command34.Usage({
     description: "Wire the deployed gateway to send the bi-weekly cost report via ACS Email.",
     details: "Discovers the live gateway Container App, grants its managed identity Contributor at the ACS resource scope (authorising the ACS Email send), and sets M8T_ACS_ENDPOINT / M8T_ACS_SENDER / M8T_ENABLE_COST_REPORTER=1 on the gateway. Idempotent \u2014 safely re-runnable. ACS is created during the executor deploy; pass its endpoint, sender, and resource id (from that deploy or 'az communication list')."
   });
@@ -18956,8 +20206,161 @@ var PlatformEnableCostReportCommand = class extends M8tCommand {
   }
 };
 
+// src/commands/platform/enable-auto-update.ts
+import { Command as Command35, Option as Option32 } from "clipanion";
+import { confirm as confirm6 } from "@inquirer/prompts";
+import { DefaultAzureCredential as DefaultAzureCredential18 } from "@azure/identity";
+init_errors();
+var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
+  static paths = [["platform", "enable-auto-update"]];
+  static usage = Command35.Usage({
+    category: "Platform",
+    description: "Retrofit the auto-updater (MI + cron job + role assignments) onto an existing install.",
+    details: "For an install that predates the Platform Update Framework: recovers the deployment's resource-name suffix (from the stamped system/infra-params row, or by verified derivation from the live gateway), recovers the other bicep params from live state (WITHOUT changing the deployed gateway image), and re-runs deploy/main.bicep with provisionUpdater=true \u2014 which provisions the updater managed identity, the cron Container Apps Job, and every role assignment (Owner@RG + Foundry User@account + Storage Table + Storage Blob + AcrPull), all scoped to the resource group. On success, backfills system/infra-params so future converges never have to re-derive the suffix. Idempotent \u2014 safe to re-run."
+  });
+  subscription = Option32.String("--subscription");
+  resourceGroup = Option32.String("--resource-group", {
+    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+  });
+  suffix = Option32.String("--suffix", {
+    description: "The existing deployment's resource-name suffix. Required when it cannot be recovered from system/infra-params or the live gateway."
+  });
+  installerImage = Option32.String("--installer-image", {
+    required: true,
+    description: "Updater CA-Job image ref (the converge engine at the current release). Required \u2014 an empty image would skip provisioning."
+  });
+  updateCron = Option32.String("--update-cron", {
+    description: "Cron schedule for the updater job (bicep default applies when omitted)."
+  });
+  channelUrl = Option32.String("--channel-url", {
+    description: "Release-channel URL the updater job polls (bicep default applies when omitted)."
+  });
+  endpoint = Option32.String("--endpoint", {
+    description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
+  });
+  yes = Option32.Boolean("--yes", false);
+  output = Option32.String("--output");
+  async executeCommand() {
+    const mode = resolveOutputMode(
+      this.output,
+      this.context.stdout
+    );
+    const interactive = this.context.stdout.isTTY === true;
+    const log = (msg) => {
+      if (mode !== "json") this.context.stdout.write(msg + "\n");
+    };
+    const onProgress = (m) => {
+      log(colors.dim(m));
+    };
+    const gw = await resolveGatewayContext({
+      interactive: mode !== "json",
+      subscriptionId: this.subscription,
+      resourceGroup: this.resourceGroup
+    });
+    const { resourceGroup, name: gatewayName } = parseContainerAppResourceId(gw.containerAppResourceId);
+    const credential2 = new DefaultAzureCredential18();
+    const account = await getAzAccount();
+    const subscriptionId = this.subscription ?? account.subscriptionId;
+    const explicitSuffix = typeof this.suffix === "string" && this.suffix.length > 0 ? this.suffix : void 0;
+    onProgress("recovering the deployment's resource-name suffix\u2026");
+    const infraTable = await openInfraParamsTable({ credential: credential2, subscriptionId, resourceGroup });
+    const stampedParams = await readInfraParams(infraTable);
+    const derivedSuffix = explicitSuffix ? void 0 : stampedParams?.suffix ?? await deriveSuffixVerified({ credential: credential2, subscriptionId, resourceGroup }) ?? void 0;
+    const suffix = explicitSuffix ?? derivedSuffix;
+    if (!suffix) {
+      throw new LocalCliError({
+        code: "PLATFORM_ENABLE_AUTO_UPDATE_SUFFIX_UNRECOVERABLE",
+        message: "Could not recover the deployment's resource-name suffix: no --suffix was given, no system/infra-params row is stamped, and deriving it from the live gateway did not verify (0 or >1 gateway, or no matching CAE).",
+        hint: "Pass --suffix <existing-suffix> explicitly (from the deployed resource names, e.g. m8t-gateway-<suffix>)."
+      });
+    }
+    if (!explicitSuffix && !stampedParams && !this.yes && interactive) {
+      const ok = await confirm6({
+        message: `Derived suffix '${suffix}' from the live gateway \u2014 proceed?`,
+        default: true
+      });
+      if (!ok) {
+        log(colors.dim("aborted \u2014 no change. Re-run with --suffix <suffix> to specify it explicitly."));
+        return 0;
+      }
+    }
+    onProgress("resolving Foundry project\u2026");
+    const project = await resolveFoundryProject({
+      credential: credential2,
+      subscriptionId,
+      interactive,
+      endpoint: typeof this.endpoint === "string" ? this.endpoint : void 0
+    });
+    onProgress("reading the live gateway image (left unchanged)\u2026");
+    const imageRef = (await runAz(["containerapp", "show", "-n", gatewayName, "-g", resourceGroup, "--query", "properties.template.containers[0].image", "-o", "tsv"])).trim();
+    if (!imageRef) {
+      throw new LocalCliError({
+        code: "PLATFORM_ENABLE_AUTO_UPDATE_NO_IMAGE",
+        message: `Could not read the live image for gateway '${gatewayName}' in resource group ${resourceGroup}.`
+      });
+    }
+    const location = (await runAz(["resource", "list", "-g", resourceGroup, "--subscription", subscriptionId, "--query", "[0].location", "-o", "tsv"])).trim();
+    if (!location) {
+      throw new LocalCliError({
+        code: "PLATFORM_ENABLE_AUTO_UPDATE_NO_LOCATION",
+        message: `Could not resolve a location for resource group ${resourceGroup} \u2014 it may be empty.`
+      });
+    }
+    const foundryResourceId = await resolveFoundryResourceId(project.endpoint);
+    const acrPullIdentityResourceId = resolveAcrPullIdentity({});
+    const acrResourceId = acrPullIdentityResourceId ? "" : await resolveAcrResourceId({ imageRef });
+    const recoveredParams = {
+      location,
+      suffix,
+      imageRef,
+      tenantId: gw.gatewayTenantId,
+      clientId: gw.gatewayClientId,
+      foundryResourceId,
+      foundryProjectEndpoint: project.endpoint,
+      acrPullIdentityResourceId,
+      acrResourceId
+    };
+    onProgress("running Bicep deployment to provision the updater (~2-4 min)\u2026");
+    const repoRoot = await resolveRepoRoot2();
+    await runBicepDeployment({
+      resourceGroup,
+      repoRoot,
+      params: buildBicepParams({
+        ...recoveredParams,
+        provisionUpdater: true,
+        installerImage: this.installerImage,
+        ...typeof this.updateCron === "string" ? { updateCron: this.updateCron } : {},
+        ...typeof this.channelUrl === "string" ? { channelUrl: this.channelUrl } : {}
+      }),
+      deploymentName: `m8t-enable-auto-update-${suffix.slice(0, 12)}`
+    });
+    onProgress("backfilling system/infra-params\u2026");
+    await writeInfraParams(infraTable, {
+      schemaVersion: 1,
+      suffix,
+      bicep: recoveredParams,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    if (mode === "json") {
+      this.context.stdout.write(renderJson({ suffix, resourceGroup, installerImage: this.installerImage, enabled: true }) + "\n");
+      return 0;
+    }
+    this.context.stdout.write(
+      renderKeyValueBlock([
+        { key: "suffix", value: suffix },
+        { key: "resource group", value: resourceGroup },
+        { key: "installer image", value: this.installerImage },
+        { key: "infra-params", value: "backfilled" }
+      ]) + "\n"
+    );
+    log(colors.success("auto-update enabled \u2014 the updater job will start converging on its next cron tick \u2713"));
+    log(colors.dim("next: 'm8t platform status' to check drift, or 'm8t platform update' to converge interactively at any time."));
+    return 0;
+  }
+};
+
 // src/commands/deploy.ts
-import { Command as Command34, Option as Option32 } from "clipanion";
+import { Command as Command36, Option as Option33 } from "clipanion";
 
 // src/lib/app-reg.ts
 init_errors();
@@ -19218,7 +20621,7 @@ async function patchRedirectUris(appObjectId, fqdn) {
 init_errors();
 
 // src/lib/whatif.ts
-import * as path22 from "path";
+import * as path27 from "path";
 function deriveResourceType(resourceId) {
   if (resourceId.startsWith("[")) return "";
   const afterProviders = resourceId.split("/providers/")[1];
@@ -19229,7 +20632,7 @@ function deriveResourceType(resourceId) {
   return parts.join("/");
 }
 async function runWhatIf(opts) {
-  const bicepPath = path22.join(opts.repoRoot, "deploy", "main.bicep");
+  const bicepPath = path27.join(opts.repoRoot, "deploy", "main.bicep");
   const out = await runAz([
     "deployment",
     "group",
@@ -19294,9 +20697,9 @@ function flattenDelta(delta, prefix = "") {
   const out = [];
   for (const d of delta) {
     const segment = /^[0-9]+$/.test(d.path) ? `[${d.path}]` : prefix ? `.${d.path}` : d.path;
-    const path32 = prefix ? `${prefix}${segment}` : d.path;
-    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path32));
-    else out.push({ ...d, path: path32 });
+    const path37 = prefix ? `${prefix}${segment}` : d.path;
+    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path37));
+    else out.push({ ...d, path: path37 });
   }
   return out;
 }
@@ -19346,24 +20749,40 @@ function classifyWhatIf(changes) {
 var DEFAULT_IMAGE_REF = "ghcr.io/m8t-run/m8t:latest";
 var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
-  static usage = Command34.Usage({
+  static usage = Command36.Usage({
     description: "Deploy (or update) the m8t gateway/webapp stack via Bicep.",
     details: "Ensures the Entra app reg (or pass --client-id to reuse an existing one \u2014 required if you can't create app regs), writes ~/.m8t-stack/config.yaml, ensures the resource group, and runs deploy/main.bicep. The repo is located via ~/.m8t-stack/repo-root."
   });
-  subscription = Option32.String("--subscription");
-  resourceGroup = Option32.String("--resource-group", "rg-m8t-stack");
-  location = Option32.String("--location", "eastus");
-  suffix = Option32.String("--suffix", "");
-  imageRef = Option32.String("--image-ref", DEFAULT_IMAGE_REF);
-  acrPullIdentity = Option32.String("--acrpull-identity");
-  acrResourceId = Option32.String("--acr-resource-id");
-  foundryEndpoint = Option32.String("--foundry-endpoint");
-  foundryResourceId = Option32.String("--foundry-resource-id");
-  foundryTracing = Option32.String("--foundry-tracing");
+  subscription = Option33.String("--subscription");
+  resourceGroup = Option33.String("--resource-group", "rg-m8t-stack");
+  location = Option33.String("--location", "eastus");
+  suffix = Option33.String("--suffix", "");
+  imageRef = Option33.String("--image-ref", DEFAULT_IMAGE_REF);
+  acrPullIdentity = Option33.String("--acrpull-identity");
+  acrResourceId = Option33.String("--acr-resource-id");
+  foundryEndpoint = Option33.String("--foundry-endpoint");
+  foundryResourceId = Option33.String("--foundry-resource-id");
+  foundryTracing = Option33.String("--foundry-tracing");
   // project | account | skip (bicep default: project)
-  clientId = Option32.String("--client-id");
-  whatIf = Option32.Boolean("--what-if", false);
-  output = Option32.String("--output");
+  clientId = Option33.String("--client-id");
+  whatIf = Option33.Boolean("--what-if", false);
+  output = Option33.String("--output");
+  // Referee (E2-F5) — all optional, undefined by default ⇒ the bicep defaults
+  // apply (dormant: gatewayCpu=0.25, gatewayMemory=0.5Gi, every referee/exam var
+  // empty). Only pass these when explicitly enabling the referee exam stack.
+  gatewayCpu = Option33.String("--gateway-cpu");
+  gatewayMemory = Option33.String("--gateway-memory");
+  refereeEnabled = Option33.String("--referee-enabled");
+  refereeBrainRepos = Option33.String("--referee-brain-repos");
+  refereeFeedRepo = Option33.String("--referee-feed-repo");
+  refereeInstallationId = Option33.String("--referee-installation-id");
+  refereeWebhookHmacKvUri = Option33.String("--referee-webhook-hmac-kv-uri");
+  examKvUri = Option33.String("--exam-kv-uri");
+  examLaWorkspaceId = Option33.String("--exam-la-workspace-id");
+  brainEvalDeployment = Option33.String("--brain-eval-deployment");
+  brainAppLogin = Option33.String("--brain-app-login");
+  refereeCheckpointDir = Option33.String("--referee-checkpoint-dir");
+  examApiBase = Option33.String("--exam-api-base");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -19407,7 +20826,20 @@ var DeployCommand = class extends M8tCommand {
         foundryProjectEndpoint: foundryEndpoint,
         acrPullIdentityResourceId: acrPullIdentityResourceId2,
         acrResourceId: acrResourceId2,
-        foundryTracingMode: parseFoundryTracingMode(this.foundryTracing)
+        foundryTracingMode: parseFoundryTracingMode(this.foundryTracing),
+        gatewayCpu: this.gatewayCpu,
+        gatewayMemory: this.gatewayMemory,
+        refereeEnabled: this.refereeEnabled,
+        refereeBrainRepos: this.refereeBrainRepos,
+        refereeFeedRepo: this.refereeFeedRepo,
+        refereeInstallationId: this.refereeInstallationId,
+        refereeWebhookHmacKvUri: this.refereeWebhookHmacKvUri,
+        examKvUri: this.examKvUri,
+        examLaWorkspaceId: this.examLaWorkspaceId,
+        brainEvalDeployment: this.brainEvalDeployment,
+        brainAppLogin: this.brainAppLogin,
+        refereeCheckpointDir: this.refereeCheckpointDir,
+        examApiBase: this.examApiBase
       });
       const changes = await runWhatIf({ resourceGroup: this.resourceGroup, repoRoot: repoRoot2, params: params2 });
       const classified = classifyWhatIf(changes);
@@ -19442,7 +20874,20 @@ var DeployCommand = class extends M8tCommand {
       foundryProjectEndpoint: foundryEndpoint,
       acrPullIdentityResourceId,
       acrResourceId,
-      foundryTracingMode: parseFoundryTracingMode(this.foundryTracing)
+      foundryTracingMode: parseFoundryTracingMode(this.foundryTracing),
+      gatewayCpu: this.gatewayCpu,
+      gatewayMemory: this.gatewayMemory,
+      refereeEnabled: this.refereeEnabled,
+      refereeBrainRepos: this.refereeBrainRepos,
+      refereeFeedRepo: this.refereeFeedRepo,
+      refereeInstallationId: this.refereeInstallationId,
+      refereeWebhookHmacKvUri: this.refereeWebhookHmacKvUri,
+      examKvUri: this.examKvUri,
+      examLaWorkspaceId: this.examLaWorkspaceId,
+      brainEvalDeployment: this.brainEvalDeployment,
+      brainAppLogin: this.brainAppLogin,
+      refereeCheckpointDir: this.refereeCheckpointDir,
+      examApiBase: this.examApiBase
     });
     log("running Bicep deployment (~3-5 min)\u2026");
     const outputs = await runBicepDeployment({
@@ -19476,8 +20921,8 @@ var DeployCommand = class extends M8tCommand {
 };
 
 // src/commands/eval/skill.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { Command as Command35, Option as Option33 } from "clipanion";
+import { spawnSync as spawnSync4 } from "child_process";
+import { Command as Command37, Option as Option34 } from "clipanion";
 init_errors();
 var DECISIONS = /* @__PURE__ */ new Set(["promote", "reject", "needs_review"]);
 var JUDGE_STATUSES = /* @__PURE__ */ new Set(["ok", "skipped", "unavailable"]);
@@ -19502,14 +20947,14 @@ function parseVerdict(stdout) {
 }
 var EvalSkillCommand = class extends M8tCommand {
   static paths = [["eval", "skill"]];
-  static usage = Command35.Usage({
+  static usage = Command37.Usage({
     description: "Vet one inbox skill candidate (Brain Faculties Eval F1): promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
   });
-  candidate = Option33.String();
-  skillsDir = Option33.String("--skills-dir");
-  noJudge = Option33.Boolean("--no-judge", false);
-  deployment = Option33.String("--deployment");
-  output = Option33.String("--output");
+  candidate = Option34.String();
+  skillsDir = Option34.String("--skills-dir");
+  noJudge = Option34.Boolean("--no-judge", false);
+  deployment = Option34.String("--deployment");
+  output = Option34.String("--output");
   executeCommand() {
     return Promise.resolve(this._runCommand());
   }
@@ -19528,7 +20973,7 @@ var EvalSkillCommand = class extends M8tCommand {
     const args = ["skill", candidate2, "--skills-dir", skillsDir, "--json"];
     if (this.noJudge === true) args.push("--no-judge");
     if (typeof this.deployment === "string") args.push("--deployment", this.deployment);
-    const res = spawnSync3(bin, args, { encoding: "utf-8" });
+    const res = spawnSync4(bin, args, { encoding: "utf-8" });
     if (res.error) {
       throw new LocalCliError({
         code: "BRAIN_EVAL_SPAWN",
@@ -19565,10 +21010,10 @@ var EvalSkillCommand = class extends M8tCommand {
 };
 
 // src/commands/eval/exam.ts
-import { spawnSync as spawnSync4 } from "child_process";
-import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync15, existsSync as existsSync13, readdirSync } from "fs";
-import { join as join22 } from "path";
-import { Command as Command36, Option as Option34 } from "clipanion";
+import { spawnSync as spawnSync5 } from "child_process";
+import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync17, existsSync as existsSync15, readdirSync as readdirSync2 } from "fs";
+import { join as join27 } from "path";
+import { Command as Command38, Option as Option35 } from "clipanion";
 init_errors();
 init_esm();
 function parseArmToken(tok, opts) {
@@ -19656,7 +21101,7 @@ function parseExamVerdict(stdout) {
   }
   return v;
 }
-var DEFAULT_REPS = { impact: 3, dream_delta: 5 };
+var DEFAULT_REPS = { impact: 3, dream_delta: 5, skill_abstraction: 5 };
 function inferExamType(arms, explicit) {
   if (explicit !== void 0) {
     if (!EXAM_TYPES.has(explicit)) {
@@ -19677,6 +21122,22 @@ function inferExamType(arms, explicit) {
     message: "could not infer --exam-type from arms \u2014 pass --exam-type impact|dream_delta|tournament"
   });
 }
+function assertAbstractionArmsExplicit(examType, arms, skill) {
+  if (examType !== "skill_abstraction") return;
+  if (typeof skill !== "string" || skill.length === 0) {
+    throw new LocalCliError({
+      code: "USAGE",
+      message: "--exam-type skill_abstraction requires --skill <slug> (the promoted skill's slug)"
+    });
+  }
+  const bothPinned = arms.length === 2 && arms.every((a) => typeof a.state === "object" && "pinned" in a.state);
+  if (!bothPinned) {
+    throw new LocalCliError({
+      code: "USAGE",
+      message: "--exam-type skill_abstraction requires exactly 2 explicit pinned arms (the promotion event's base/merge shas), e.g. --arms 'pinned:<base>+pinned:<merge>'"
+    });
+  }
+}
 function resolveJudgeDeployment(flag, env) {
   if (typeof flag === "string" && flag.length > 0) return { deployment: flag };
   const fromEnv = env.EXAM_JUDGE_DEPLOYMENT;
@@ -19733,11 +21194,11 @@ function resolveRefereeHome(refereeHomeOut, env) {
   return null;
 }
 function resolveTaskSetDir(base, worker, version) {
-  if (existsSync13(join22(base, version))) return version;
+  if (existsSync15(join27(base, version))) return version;
   const prefixed = `${worker}-${version}`;
-  if (existsSync13(join22(base, prefixed))) return prefixed;
-  if (version === "latest" && existsSync13(base)) {
-    const dirs = readdirSync(base, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.startsWith(`${worker}-`)).map((d) => d.name).sort();
+  if (existsSync15(join27(base, prefixed))) return prefixed;
+  if (version === "latest" && existsSync15(base)) {
+    const dirs = readdirSync2(base, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.startsWith(`${worker}-`)).map((d) => d.name).sort();
     if (dirs.length > 0) return dirs[dirs.length - 1];
   }
   return version;
@@ -19751,11 +21212,11 @@ function readSealedTaskIds(taskSetVersion, refereeHomeOut, env = process.env) {
       message: "cannot resolve the referee home to read the sealed-task manifest \u2014 set $REFEREE_HOME (mirroring the Python runner) so the feed can be redacted; refusing to emit a possibly-unredacted feed (Law-1)"
     });
   }
-  const versionDir = resolveTaskSetDir(join22(home, "tasksets", worker), worker, version);
-  const manifestPath = join22(home, "tasksets", worker, versionDir, "manifest.yaml");
+  const versionDir = resolveTaskSetDir(join27(home, "tasksets", worker), worker, version);
+  const manifestPath = join27(home, "tasksets", worker, versionDir, "manifest.yaml");
   let text;
   try {
-    text = readFileSync15(manifestPath, "utf-8");
+    text = readFileSync17(manifestPath, "utf-8");
   } catch (e) {
     throw new LocalCliError({
       code: "EXAM_REDACTION_UNSAFE",
@@ -19782,23 +21243,24 @@ function buildPlan(args) {
 }
 var EvalExamCommand = class extends M8tCommand {
   static paths = [["eval", "exam"]];
-  static usage = Command36.Usage({
+  static usage = Command38.Usage({
     description: "Run a brain exam (Brain Referee E2-F2): impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
   });
-  worker = Option34.String();
-  arms = Option34.String("--arms");
-  taskSet = Option34.String("--task-set");
-  examType = Option34.String("--exam-type");
-  reps = Option34.String("-n,--reps");
-  probes = Option34.String("--probes");
-  pool = Option34.String("--pool");
-  out = Option34.String("--out");
-  dryRun = Option34.Boolean("--dry-run", false);
-  keepArms = Option34.Boolean("--keep-arms", false);
-  allowStub = Option34.Boolean("--allow-stub", false);
-  deployment = Option34.String("--deployment");
-  output = Option34.String("--output");
-  observeWaitS = Option34.String("--observe-wait-s");
+  worker = Option35.String();
+  arms = Option35.String("--arms");
+  taskSet = Option35.String("--task-set");
+  examType = Option35.String("--exam-type");
+  skill = Option35.String("--skill");
+  reps = Option35.String("-n,--reps");
+  probes = Option35.String("--probes");
+  pool = Option35.String("--pool");
+  out = Option35.String("--out");
+  dryRun = Option35.Boolean("--dry-run", false);
+  keepArms = Option35.Boolean("--keep-arms", false);
+  allowStub = Option35.Boolean("--allow-stub", false);
+  deployment = Option35.String("--deployment");
+  output = Option35.String("--output");
+  observeWaitS = Option35.String("--observe-wait-s");
   async executeCommand() {
     await Promise.resolve();
     const worker = typeof this.worker === "string" ? this.worker : void 0;
@@ -19807,6 +21269,7 @@ var EvalExamCommand = class extends M8tCommand {
     if (!armsRaw) throw new LocalCliError({ code: "USAGE", message: "--arms <spec> is required" });
     const arms = parseArmSpec(armsRaw, "git", { allowStub: this.allowStub === true });
     const examType = inferExamType(arms, typeof this.examType === "string" ? this.examType : void 0);
+    assertAbstractionArmsExplicit(examType, arms, typeof this.skill === "string" ? this.skill : void 0);
     let reps = DEFAULT_REPS[examType] ?? 3;
     if (typeof this.reps === "string") {
       const parsed = Number.parseInt(this.reps, 10);
@@ -19860,7 +21323,7 @@ var EvalExamCommand = class extends M8tCommand {
       return 0;
     }
     const bin = process.env.BRAIN_EXAM_BIN ?? "brain-exam";
-    const res = spawnSync4(bin, ["run", "--plan", "-", "--json"], { encoding: "utf-8", input: renderJson(plan) });
+    const res = spawnSync5(bin, ["run", "--plan", "-", "--json"], { encoding: "utf-8", input: renderJson(plan) });
     if (res.error) {
       throw new LocalCliError({
         code: "EXAM_SPAWN",
@@ -19873,10 +21336,10 @@ var EvalExamCommand = class extends M8tCommand {
     const verdict = parseExamVerdict(res.stdout);
     if (out !== void 0) {
       const sealedTaskIds = taskSetVersion ? readSealedTaskIds(taskSetVersion, out) : /* @__PURE__ */ new Set();
-      mkdirSync4(out, { recursive: true });
-      writeFileSync4(join22(out, "verdict.json"), JSON.stringify(verdict, null, 2));
+      mkdirSync5(out, { recursive: true });
+      writeFileSync6(join27(out, "verdict.json"), JSON.stringify(verdict, null, 2));
       const feed = redactForFeed(verdict, sealedTaskIds);
-      writeFileSync4(join22(out, "feed.json"), JSON.stringify(feed, null, 2));
+      writeFileSync6(join27(out, "feed.json"), JSON.stringify(feed, null, 2));
     }
     if (mode === "json") {
       this.context.stdout.write(renderJson(verdict) + "\n");
@@ -19912,10 +21375,10 @@ var EvalExamCommand = class extends M8tCommand {
 };
 
 // src/commands/version.ts
-import { Command as Command37, Option as Option35 } from "clipanion";
+import { Command as Command39, Option as Option36 } from "clipanion";
 var VersionCommand = class extends M8tCommand {
   static paths = [["version"], ["--version"], ["-v"]];
-  static usage = Command37.Usage({
+  static usage = Command39.Usage({
     description: "Print the CLI version.",
     details: "Prints the m8t CLI version. With --verbose, also prints Node version and platform.",
     examples: [
@@ -19923,8 +21386,8 @@ var VersionCommand = class extends M8tCommand {
       ["Print as JSON", "$0 version --output json"]
     ]
   });
-  output = Option35.String("--output", { description: "pretty | json | auto (default)" });
-  verbose = Option35.Boolean("--verbose", false);
+  output = Option36.String("--output", { description: "pretty | json | auto (default)" });
+  verbose = Option36.Boolean("--verbose", false);
   executeCommand() {
     const mode = resolveOutputMode(
       this.output ?? "auto",
@@ -19955,18 +21418,18 @@ var VersionCommand = class extends M8tCommand {
 };
 
 // src/commands/whoami.ts
-import { Command as Command38, Option as Option36 } from "clipanion";
+import { Command as Command40, Option as Option37 } from "clipanion";
 var WhoamiCommand = class extends M8tCommand {
   static paths = [["whoami"]];
-  static usage = Command38.Usage({
+  static usage = Command40.Usage({
     description: "Show your identity + the gateway you'll talk to. Probes the backend."
   });
-  output = Option36.String("--output");
-  verbose = Option36.Boolean("--verbose", false);
-  subscription = Option36.String("--subscription", {
+  output = Option37.String("--output");
+  verbose = Option37.Boolean("--verbose", false);
+  subscription = Option37.String("--subscription", {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
-  resourceGroup = Option36.String("--resource-group", {
+  resourceGroup = Option37.String("--resource-group", {
     description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -20031,7 +21494,7 @@ var WhoamiCommand = class extends M8tCommand {
 };
 
 // src/commands/status.ts
-import { Command as Command39, Option as Option37 } from "clipanion";
+import { Command as Command41, Option as Option38 } from "clipanion";
 
 // src/lib/azd.ts
 init_errors();
@@ -20096,10 +21559,10 @@ async function resolveLocalContext() {
 // src/commands/status.ts
 var StatusCommand = class extends M8tCommand {
   static paths = [["status"]];
-  static usage = Command39.Usage({
+  static usage = Command41.Usage({
     description: "Show the local m8t context: identity, config.yaml, gateway cache, azd mode."
   });
-  output = Option37.String("--output");
+  output = Option38.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -20137,11 +21600,11 @@ var StatusCommand = class extends M8tCommand {
 };
 
 // src/commands/doctor.ts
-import { Command as Command40, Option as Option38 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential18 } from "@azure/identity";
-import * as fs22 from "fs";
-import * as os10 from "os";
-import * as path23 from "path";
+import { Command as Command42, Option as Option39 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential19 } from "@azure/identity";
+import * as fs26 from "fs";
+import * as os11 from "os";
+import * as path28 from "path";
 
 // src/lib/doctor-checks.ts
 function checkAzSignedIn(az) {
@@ -20366,34 +21829,34 @@ async function resolveAccountLocation(accountId) {
   }
 }
 function probeRepoRoot() {
-  const marker = path23.join(os10.homedir(), ".m8t-stack", "repo-root");
-  if (!fs22.existsSync(marker)) {
+  const marker = path28.join(os11.homedir(), ".m8t-stack", "repo-root");
+  if (!fs26.existsSync(marker)) {
     return { markerExists: false, path: null, isDir: false, isGitCheckout: false };
   }
   let repoPath;
   try {
-    repoPath = fs22.readFileSync(marker, "utf8").trim();
+    repoPath = fs26.readFileSync(marker, "utf8").trim();
   } catch {
     return { markerExists: true, path: null, isDir: false, isGitCheckout: false };
   }
   if (!repoPath) return { markerExists: true, path: null, isDir: false, isGitCheckout: false };
   let isDir = false;
   try {
-    isDir = fs22.statSync(repoPath).isDirectory();
+    isDir = fs26.statSync(repoPath).isDirectory();
   } catch {
     isDir = false;
   }
-  const isGitCheckout = isDir && fs22.existsSync(path23.join(repoPath, ".git"));
+  const isGitCheckout = isDir && fs26.existsSync(path28.join(repoPath, ".git"));
   return { markerExists: true, path: repoPath, isDir, isGitCheckout };
 }
 var DoctorCommand = class extends M8tCommand {
   static paths = [["doctor"]];
-  static usage = Command40.Usage({
+  static usage = Command42.Usage({
     description: "Diagnose the local m8t setup: az login, config.yaml, gateway, Foundry data-plane."
   });
-  output = Option38.String("--output");
-  agent = Option38.String("--agent");
-  resourceGroup = Option38.String("--resource-group", {
+  output = Option39.String("--output");
+  agent = Option39.String("--agent");
+  resourceGroup = Option39.String("--resource-group", {
     description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -20466,7 +21929,7 @@ var DoctorCommand = class extends M8tCommand {
       if (typeof this.agent === "string" && this.agent) {
         checking(`delivery grant for ${this.agent}`);
         try {
-          const credential2 = new DefaultAzureCredential18();
+          const credential2 = new DefaultAzureCredential19();
           const cur = await getAgentVersion({
             credential: credential2,
             projectEndpoint: foundry.projectEndpoint,
@@ -20509,18 +21972,18 @@ var DoctorCommand = class extends M8tCommand {
 };
 
 // src/commands/switch.ts
-import { Command as Command41, Option as Option39 } from "clipanion";
+import { Command as Command43, Option as Option40 } from "clipanion";
 
 // src/lib/profiles.ts
-import * as fs23 from "fs/promises";
-import * as path24 from "path";
+import * as fs27 from "fs/promises";
+import * as path29 from "path";
 import { parse as parseYaml11, stringify as stringifyYaml4 } from "yaml";
 function profilesDir() {
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path24.join(home, ".m8t-stack", "profiles");
+  return path29.join(home, ".m8t-stack", "profiles");
 }
 function getProfilePath(name) {
-  return path24.join(profilesDir(), `${path24.basename(name)}.yaml`);
+  return path29.join(profilesDir(), `${path29.basename(name)}.yaml`);
 }
 function slugifyTenant(domainOrId) {
   const base = domainOrId.split(".")[0].toLowerCase();
@@ -20529,7 +21992,7 @@ function slugifyTenant(domainOrId) {
 }
 async function listProfiles() {
   try {
-    const entries = await fs23.readdir(profilesDir());
+    const entries = await fs27.readdir(profilesDir());
     return entries.filter((e) => e.endsWith(".yaml")).map((e) => e.replace(/\.yaml$/, "")).sort();
   } catch (e) {
     if (e.code === "ENOENT") return [];
@@ -20538,7 +22001,7 @@ async function listProfiles() {
 }
 async function readProfile(name) {
   try {
-    const raw = await fs23.readFile(getProfilePath(name), "utf8");
+    const raw = await fs27.readFile(getProfilePath(name), "utf8");
     const parsed = parseYaml11(raw);
     if (!parsed || typeof parsed !== "object") return null;
     return parsed;
@@ -20549,14 +22012,14 @@ async function readProfile(name) {
 }
 async function exists(p) {
   try {
-    await fs23.stat(p);
+    await fs27.stat(p);
     return true;
   } catch {
     return false;
   }
 }
 async function saveProfile(p) {
-  await fs23.mkdir(profilesDir(), { recursive: true });
+  await fs27.mkdir(profilesDir(), { recursive: true });
   let name = p.name;
   let n = 2;
   while (await exists(getProfilePath(name))) {
@@ -20565,8 +22028,8 @@ async function saveProfile(p) {
   }
   const target = getProfilePath(name);
   const tmp = `${target}.tmp`;
-  await fs23.writeFile(tmp, stringifyYaml4({ ...p, name }, { indent: 2 }), "utf8");
-  await fs23.rename(tmp, target);
+  await fs27.writeFile(tmp, stringifyYaml4({ ...p, name }, { indent: 2 }), "utf8");
+  await fs27.rename(tmp, target);
   return name;
 }
 
@@ -20649,14 +22112,14 @@ async function profileSwitch(name, asName) {
 init_errors();
 var SwitchCommand = class extends M8tCommand {
   static paths = [["switch"]];
-  static usage = Command41.Usage({
+  static usage = Command43.Usage({
     description: "Re-point local config at another deployment: --subscription <id|name> (discovery) or <profile>."
   });
-  profile = Option39.String({ required: false });
-  subscription = Option39.String("--subscription");
-  list = Option39.Boolean("--list", false);
-  as = Option39.String("--as");
-  output = Option39.String("--output");
+  profile = Option40.String({ required: false });
+  subscription = Option40.String("--subscription");
+  list = Option40.Boolean("--list", false);
+  as = Option40.String("--as");
+  output = Option40.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -20713,7 +22176,7 @@ var SwitchCommand = class extends M8tCommand {
 
 // src/commands/open.ts
 import { spawn as spawn5 } from "child_process";
-import { Command as Command42, Option as Option40 } from "clipanion";
+import { Command as Command44, Option as Option41 } from "clipanion";
 
 // src/lib/open-targets.ts
 init_errors();
@@ -20759,14 +22222,14 @@ function openUrl(url) {
 }
 var OpenCommand = class extends M8tCommand {
   static paths = [["open"]];
-  static usage = Command42.Usage({
+  static usage = Command44.Usage({
     description: "Open the deployed webapp (default), the Foundry portal, or the resource group.",
     details: "Targets: webapp (deployed app, default) | foundry (ai.azure.com) | portal (resource group in the Azure portal). Pass --print to emit the URL instead of launching a browser (also the default when stdout isn't a TTY)."
   });
-  target = Option40.String({ required: false });
-  print = Option40.Boolean("--print", false);
-  output = Option40.String("--output");
-  resourceGroup = Option40.String("--resource-group", {
+  target = Option41.String({ required: false });
+  print = Option41.Boolean("--print", false);
+  output = Option41.String("--output");
+  resourceGroup = Option41.String("--resource-group", {
     description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -20810,9 +22273,9 @@ var OpenCommand = class extends M8tCommand {
 };
 
 // src/commands/dream/run.ts
-import { Command as Command43, Option as Option41 } from "clipanion";
+import { Command as Command45, Option as Option42 } from "clipanion";
 import { AzureCliCredential } from "@azure/identity";
-import { TableClient as TableClient3 } from "@azure/data-tables";
+import { TableClient as TableClient5 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient3 } from "@azure/ai-projects";
 import { LogsQueryClient as LogsQueryClient3, LogsQueryResultStatus as LogsQueryResultStatus3 } from "@azure/monitor-query";
 
@@ -20952,6 +22415,8 @@ function odataFilter(worker, f) {
     parts.unshift(`PartitionKey eq '${esc2(worker)}'`);
   if (f.source !== "all")
     parts.push(`source eq '${esc2(f.source)}'`);
+  if (f.foundryConversationId)
+    parts.push(`foundryConversationId eq '${esc2(f.foundryConversationId)}'`);
   return parts.join(" and ");
 }
 async function fetchLedgerRows(filters, client) {
@@ -21119,7 +22584,7 @@ var ConvFetchError = class extends Error {
 };
 
 // ../../packages/brain/engine/dist/esm/cursor.js
-import { TableClient as TableClient2 } from "@azure/data-tables";
+import { TableClient as TableClient4 } from "@azure/data-tables";
 
 // ../../packages/agent-ledger/dist/esm/row-key.js
 var MAX_MS = 864e13;
@@ -21241,7 +22706,7 @@ async function commitCursorAdvance(plan, cursor) {
 }
 var CURSOR_TABLE_NAME = "BrainDreamCursor";
 function makeTableCursor(credential2, tableEndpoint) {
-  const client = new TableClient2(tableEndpoint, CURSOR_TABLE_NAME, credential2);
+  const client = new TableClient4(tableEndpoint, CURSOR_TABLE_NAME, credential2);
   return new TableCursor(client);
 }
 function formatCursorPreview(cursor) {
@@ -21735,7 +23200,7 @@ function buildAdvancePlan(worker, cursor, physicalPks, consumedRowsByPk, failedT
 // ../../packages/brain/engine/dist/esm/dream/writer.js
 var API2 = "https://api.github.com";
 var WRITER_ALLOWED_PREFIX = /^(memory|inbox|quarantine|artifacts)\//;
-var isAllowedWritePath = (path32) => WRITER_ALLOWED_PREFIX.test(path32) && !path32.split("/").includes("..");
+var isAllowedWritePath = (path37, allowedPrefix) => allowedPrefix.test(path37) && !path37.split("/").includes("..");
 var unquote = (s) => s.trim().replace(/^["']|["']$/g, "");
 function parseFrontmatter(content) {
   const m = /^---\n([\s\S]*?)\n---/.exec(content);
@@ -21774,8 +23239,12 @@ function parseFrontmatter(content) {
 function makeGitDataWriter(args) {
   const doFetch = args.fetchImpl ?? fetch;
   const repoPath = args.repository;
-  async function gh(token, method, path32, body) {
-    const res = await doFetch(`${API2}/repos/${repoPath}${path32}`, {
+  const allowedPathPrefix = args.allowedPathPrefix ?? WRITER_ALLOWED_PREFIX;
+  if (args.allowedPathPrefix && !args.allowedPathPrefix.source.startsWith("^")) {
+    throw new Error(`makeGitDataWriter: allowedPathPrefix must be anchored with "^" (got /${args.allowedPathPrefix.source}/) \u2014 an unanchored regex would widen the B1 write-path allowlist`);
+  }
+  async function gh(token, method, path37, body) {
+    const res = await doFetch(`${API2}/repos/${repoPath}${path37}`, {
       method,
       headers: {
         Authorization: `Bearer ${token}`,
@@ -21788,8 +23257,8 @@ function makeGitDataWriter(args) {
     const text = await res.text();
     return { status: res.status, ok: res.ok, json: text ? JSON.parse(text) : {} };
   }
-  async function readFileWith(token, path32) {
-    const encodedPath = path32.split("/").map(encodeURIComponent).join("/");
+  async function readFileWith(token, path37) {
+    const encodedPath = path37.split("/").map(encodeURIComponent).join("/");
     const r = await gh(token, "GET", `/contents/${encodedPath}?ref=${args.branch}`);
     if (r.status === 404)
       return null;
@@ -21805,9 +23274,9 @@ function makeGitDataWriter(args) {
         throw new Error(`fetchTip: HTTP ${String(r.status)}`);
       return r.json.object.sha;
     },
-    async readFile(path32) {
+    async readFile(path37) {
       const token = await args.mintToken();
-      return readFileWith(token, path32);
+      return readFileWith(token, path37);
     },
     async listMemory() {
       const token = await args.mintToken();
@@ -21816,15 +23285,15 @@ function makeGitDataWriter(args) {
         return [];
       const paths = r.json.tree.filter((e) => e.type === "blob" && e.path.startsWith("memory/") && e.path.endsWith(".md")).map((e) => e.path);
       const out = [];
-      for (const path32 of paths) {
-        const content = await readFileWith(token, path32);
-        out.push({ path: path32, frontmatter: content ? parseFrontmatter(content) : {} });
+      for (const path37 of paths) {
+        const content = await readFileWith(token, path37);
+        out.push({ path: path37, frontmatter: content ? parseFrontmatter(content) : {} });
       }
       return out;
     },
     async commitBatch(a) {
       try {
-        const escaping = a.changes.filter((c) => !isAllowedWritePath(c.path));
+        const escaping = a.changes.filter((c) => !isAllowedWritePath(c.path, allowedPathPrefix));
         if (escaping.length > 0) {
           return {
             ok: false,
@@ -21876,9 +23345,11 @@ function makeFoundryModelClient(openai, model) {
       const create = openai.responses.create;
       const stream = await create({
         model,
+        // Explicit `type: "message"` — the Responses API rejects untyped input
+        // items (400 `Invalid value: ''`).
         input: [
-          { role: "system", content: system },
-          { role: "user", content: user }
+          { type: "message", role: "system", content: system },
+          { type: "message", role: "user", content: user }
         ],
         stream: true
       }, signal ? { signal } : void 0);
@@ -22255,7 +23726,7 @@ async function loadMemoryContext(brain) {
   return {
     files,
     indexEntries,
-    originOf: (path32) => originByPath.get(path32) ?? "worker"
+    originOf: (path37) => originByPath.get(path37) ?? "worker"
   };
 }
 
@@ -22276,14 +23747,14 @@ function checkEvidenceMembership(delta, harvested) {
 }
 var BatchAbort = class extends Error {
   path;
-  constructor(path32, message) {
+  constructor(path37, message) {
     super(message);
-    this.path = path32;
+    this.path = path37;
     this.name = "BatchAbort";
   }
 };
-var isIndexFile = (path32) => /(^|\/)[^/]*_index\.md$/.test(path32);
-var isMemoryIndex = (path32) => path32 === "memory/MEMORY.md";
+var isIndexFile = (path37) => /(^|\/)[^/]*_index\.md$/.test(path37);
+var isMemoryIndex = (path37) => path37 === "memory/MEMORY.md";
 function targetPath(delta) {
   switch (delta.verb) {
     case "new":
@@ -22300,29 +23771,29 @@ function targetPath(delta) {
 }
 async function checkOriginTier(delta, lookup) {
   const evidence = evidenceOf(delta) ?? [];
-  const path32 = targetPath(delta);
-  if (path32 === null)
+  const path37 = targetPath(delta);
+  if (path37 === null)
     return { ok: true };
-  if (isIndexFile(path32) && !isMemoryIndex(path32)) {
-    return { ok: false, flagged: { kind: "flagged", path: path32, tension: `refused: ${path32} is an index file (only memory/MEMORY.md is editable)`, evidence } };
+  if (isIndexFile(path37) && !isMemoryIndex(path37)) {
+    return { ok: false, flagged: { kind: "flagged", path: path37, tension: `refused: ${path37} is an index file (only memory/MEMORY.md is editable)`, evidence } };
   }
-  const target = await lookup(path32);
-  const isStructural = path32.startsWith("references/");
+  const target = await lookup(path37);
+  const isStructural = path37.startsWith("references/");
   const origin = target?.frontmatter.origin ?? (isStructural ? "operator" : "worker");
   const editable = origin === "worker" || origin === "dream";
   if (editable)
     return { ok: true };
   const removesOperatorTarget = delta.verb === "retract" || delta.verb === "supersede" && delta.oldPath !== delta.newPath;
   if (removesOperatorTarget) {
-    throw new BatchAbort(path32, `supersede/retract OLD target ${path32} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
+    throw new BatchAbort(path37, `supersede/retract OLD target ${path37} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
   }
-  return { ok: false, flagged: { kind: "flagged", path: path32, tension: `operator-origin (${origin}); flag-only`, evidence } };
+  return { ok: false, flagged: { kind: "flagged", path: path37, tension: `operator-origin (${origin}); flag-only`, evidence } };
 }
 var ALLOWED_MEMORY = /^memory\/.+\.md$/;
 var ALLOWED_INBOX = /^inbox\//;
 var ALLOWED_QUARANTINE = /^quarantine\//;
 var ALLOWED_FLAG = /^memory\//;
-var hasTraversal = (path32) => path32.split("/").includes("..");
+var hasTraversal = (path37) => path37.split("/").includes("..");
 function checkPathAllowed(delta) {
   const evidence = evidenceOf(delta) ?? [];
   const reject = (detail) => ({ ok: false, rejected: { kind: "rejected", detail, evidence } });
@@ -22429,7 +23900,7 @@ ${inject}
 ---
 `);
 }
-var indexLine = (path32, title, date, tags) => `- \`${path32}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
+var indexLine = (path37, title, date, tags) => `- \`${path37}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
 function splitIndex(index) {
   const all = index.split("\n");
   const firstLineIdx = all.findIndex((l) => l.startsWith("- `memory/"));
@@ -22602,16 +24073,16 @@ function defaultDreamSeams(opts = {}) {
       const mem = await memory(deps.brain);
       const harvested = harvestedIds(input);
       const ctx = { readFile: (p) => deps.brain.readFile(p), at: deps.clock() };
-      const lookup = (path32) => Promise.resolve(mem.files.find((f) => f.path === path32) ?? null);
+      const lookup = (path37) => Promise.resolve(mem.files.find((f) => f.path === path37) ?? null);
       const digest = [...pendingRejected];
       let changes = [];
       let indexEdit;
       try {
         for (const raw of deltas) {
           const delta = forcePolicyQuarantine(raw);
-          const path32 = checkPathAllowed(delta);
-          if (!path32.ok) {
-            digest.push(path32.rejected);
+          const path37 = checkPathAllowed(delta);
+          if (!path37.ok) {
+            digest.push(path37.rejected);
             continue;
           }
           const ev = checkEvidenceMembership(delta, harvested);
@@ -22954,20 +24425,20 @@ function redactTranscripts(input) {
 }
 var DreamRunCommand = class extends M8tCommand {
   static paths = [["dream", "run"]];
-  static usage = Command43.Usage({
+  static usage = Command45.Usage({
     description: "Dry-run the brain consumption pipeline for one worker (no model call, no writes).",
     details: "Builds AzureCliCredential + resolves the Foundry project, ledger table, and Log Analytics workspace, runs the consumption pipeline, and prints the skip-ledger, the partition invariant, and harvest stats. Transcripts are metadata-only unless --show-transcripts is passed."
   });
-  worker = Option41.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
-  dryRun = Option41.Boolean("--dry-run", false, { description: "Read-only harvest; no model call, no writes." });
-  since = Option41.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
-  reset = Option41.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
-  showTranscripts = Option41.Boolean("--show-transcripts", false, {
+  worker = Option42.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
+  dryRun = Option42.Boolean("--dry-run", false, { description: "Read-only harvest; no model call, no writes." });
+  since = Option42.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
+  reset = Option42.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
+  showTranscripts = Option42.Boolean("--show-transcripts", false, {
     description: "Print transcript bodies (default: metadata only)."
   });
-  subscription = Option41.String("--subscription");
-  endpoint = Option41.String("--endpoint");
-  output = Option41.String("--output");
+  subscription = Option42.String("--subscription");
+  endpoint = Option42.String("--endpoint");
+  output = Option42.String("--output");
   // Resolution seam — overridden by tests; built lazily at runtime otherwise.
   deps;
   async executeCommand() {
@@ -23162,7 +24633,7 @@ AppDependencies
   };
 }
 function buildLiveSources(context, credential2) {
-  const ledgerClient = new TableClient3(context.ledgerTableEndpoint, LEDGER_TABLE_NAME, credential2);
+  const ledgerClient = new TableClient5(context.ledgerTableEndpoint, LEDGER_TABLE_NAME, credential2);
   const ledger = makeLedgerSource(
     async (pk, sinceTs) => fetchLedgerRows(
       { workers: [pk], source: "all", from: sinceTs, to: "9999-12-31T23:59:59.999Z" },
@@ -23315,7 +24786,7 @@ function defaultDeps(overrides) {
 }
 
 // src/commands/foundry/create.ts
-import { Command as Command44, Option as Option42 } from "clipanion";
+import { Command as Command46, Option as Option43 } from "clipanion";
 
 // src/lib/foundry-create.ts
 init_errors();
@@ -23553,7 +25024,7 @@ async function createFoundryProject(args) {
 init_errors();
 var FoundryCreateCommand = class extends M8tCommand {
   static paths = [["foundry", "create"]];
-  static usage = Command44.Usage({
+  static usage = Command46.Usage({
     description: "Create an AI Foundry (AIServices) account + project + model deployment from scratch.",
     details: "Non-interactive and idempotent. Creates the AIServices account (custom subdomain + project management), a project, and a model deployment (default gpt-4.1-mini @ capacity 50). Region must be hosted-agent-eligible. Emits the project endpoint as structured output. Re-run is a clean no-op (account/project skipped if present; deployment capacity converges UP, never down).",
     examples: [
@@ -23562,16 +25033,16 @@ var FoundryCreateCommand = class extends M8tCommand {
       ["Higher capacity for a reasoning model", "$0 foundry create --resource-group rg-m8t-stack --location eastus2 --model gpt-5-mini --capacity 250"]
     ]
   });
-  resourceGroup = Option42.String("--resource-group");
-  location = Option42.String("--location");
-  account = Option42.String("--account");
-  project = Option42.String("--project", "m8t");
-  model = Option42.String("--model", "gpt-4.1-mini");
-  modelVersion = Option42.String("--model-version", "2025-04-14");
-  capacity = Option42.String("--capacity", "50");
-  subscription = Option42.String("--subscription");
-  skipQuotaCheck = Option42.Boolean("--skip-quota-check", false);
-  output = Option42.String("--output");
+  resourceGroup = Option43.String("--resource-group");
+  location = Option43.String("--location");
+  account = Option43.String("--account");
+  project = Option43.String("--project", "m8t");
+  model = Option43.String("--model", "gpt-4.1-mini");
+  modelVersion = Option43.String("--model-version", "2025-04-14");
+  capacity = Option43.String("--capacity", "50");
+  subscription = Option43.String("--subscription");
+  skipQuotaCheck = Option43.Boolean("--skip-quota-check", false);
+  output = Option43.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -23643,22 +25114,22 @@ var FoundryCreateCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/await-ready.ts
-import { Command as Command45, Option as Option43 } from "clipanion";
+import { Command as Command47, Option as Option44 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential2 } from "@azure/identity";
 init_errors();
 var FoundryAwaitReadyCommand = class extends M8tCommand {
   static paths = [["foundry", "await-ready"]];
-  static usage = Command45.Usage({
+  static usage = Command47.Usage({
     description: "Wait until a freshly-created Foundry project's data plane reliably serves it.",
     details: "Probes the project (GET /agents) until it returns 200 on a few consecutive tries, or fails clearly after a bounded budget. A newly-created account can serve intermittent 404 'Project not found' for minutes; run this after 'foundry create' and before deploying agents so the worker phase doesn't catch the unstable window.",
     examples: [["Wait for a project to be ready", "$0 foundry await-ready --endpoint https://acc.services.ai.azure.com/api/projects/m8t"]]
   });
-  endpoint = Option43.String("--endpoint");
-  consecutive = Option43.String("--consecutive", "3");
-  attempts = Option43.String("--attempts", "60");
-  interval = Option43.String("--interval", "5");
-  subscription = Option43.String("--subscription");
-  output = Option43.String("--output");
+  endpoint = Option44.String("--endpoint");
+  consecutive = Option44.String("--consecutive", "3");
+  attempts = Option44.String("--attempts", "60");
+  interval = Option44.String("--interval", "5");
+  subscription = Option44.String("--subscription");
+  output = Option44.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const endpoint = typeof this.endpoint === "string" ? this.endpoint : void 0;
@@ -23692,7 +25163,7 @@ var FoundryAwaitReadyCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/preflight.ts
-import { Command as Command46, Option as Option44 } from "clipanion";
+import { Command as Command48, Option as Option45 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-preflight.ts
@@ -23766,7 +25237,7 @@ function buildPreflightBanner(who) {
 // src/commands/bootstrap/preflight.ts
 var BootstrapPreflightCommand = class extends M8tCommand {
   static paths = [["bootstrap", "preflight"]];
-  static usage = Command46.Usage({
+  static usage = Command48.Usage({
     description: "Loudly verify you can install m8t-stack (Owner/UAA + directory admin) and hard-stop if not.",
     details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), and registers Microsoft.ContainerInstance. Exits non-zero with the exact failing check + remedy.",
     examples: [
@@ -23774,8 +25245,8 @@ var BootstrapPreflightCommand = class extends M8tCommand {
       ["BYO app registration (directory guests)", "$0 bootstrap preflight --client-id <appId>"]
     ]
   });
-  clientId = Option44.String("--client-id");
-  subscription = Option44.String("--subscription");
+  clientId = Option45.String("--client-id");
+  subscription = Option45.String("--subscription");
   async executeCommand() {
     const clientId = typeof this.clientId === "string" ? this.clientId : void 0;
     const account = await getAzAccount();
@@ -23831,10 +25302,10 @@ ${colors.error("  " + why)}
 }
 
 // src/commands/bootstrap/launch.ts
-import * as fs26 from "fs";
-import * as os13 from "os";
-import * as path27 from "path";
-import { Command as Command47, Option as Option45 } from "clipanion";
+import * as fs30 from "fs";
+import * as os14 from "os";
+import * as path32 from "path";
+import { Command as Command49, Option as Option46 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-mi.ts
@@ -23979,9 +25450,9 @@ async function kickInstaller(s) {
 
 // src/lib/bootstrap-status.ts
 import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
-import * as fs24 from "fs/promises";
-import * as os11 from "os";
-import * as path25 from "path";
+import * as fs28 from "fs/promises";
+import * as os12 from "os";
+import * as path30 from "path";
 init_errors();
 var STATUS_CONTAINER = "status";
 var STATUS_BLOB = "status.json";
@@ -24020,7 +25491,7 @@ async function readStatusBlob(opts) {
       cause: e
     });
   }
-  const tmpFile = path25.join(os11.tmpdir(), `m8t-status-${randomUUID2()}.json`);
+  const tmpFile = path30.join(os12.tmpdir(), `m8t-status-${randomUUID2()}.json`);
   try {
     await runAz([
       "storage",
@@ -24039,7 +25510,7 @@ async function readStatusBlob(opts) {
       "--no-progress",
       "--only-show-errors"
     ]);
-    const raw = await fs24.readFile(tmpFile, "utf8");
+    const raw = await fs28.readFile(tmpFile, "utf8");
     return JSON.parse(raw.trim());
   } catch (e) {
     throw new LocalCliError({
@@ -24049,34 +25520,34 @@ async function readStatusBlob(opts) {
       cause: e
     });
   } finally {
-    await fs24.rm(tmpFile, { force: true });
+    await fs28.rm(tmpFile, { force: true });
   }
 }
 
 // src/lib/bootstrap-state.ts
-import * as fs25 from "fs/promises";
-import * as os12 from "os";
-import * as path26 from "path";
+import * as fs29 from "fs/promises";
+import * as os13 from "os";
+import * as path31 from "path";
 function stateDir(home) {
-  return path26.join(home, ".m8t-stack");
+  return path31.join(home, ".m8t-stack");
 }
 function statePath(home) {
-  return path26.join(stateDir(home), "bootstrap.json");
+  return path31.join(stateDir(home), "bootstrap.json");
 }
-async function readBootstrapState(home = os12.homedir()) {
+async function readBootstrapState(home = os13.homedir()) {
   try {
-    const raw = await fs25.readFile(statePath(home), "utf8");
+    const raw = await fs29.readFile(statePath(home), "utf8");
     return JSON.parse(raw);
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw e;
   }
 }
-async function writeBootstrapState(state, home = os12.homedir()) {
-  await fs25.mkdir(stateDir(home), { recursive: true });
+async function writeBootstrapState(state, home = os13.homedir()) {
+  await fs29.mkdir(stateDir(home), { recursive: true });
   const tmp = `${statePath(home)}.tmp`;
-  await fs25.writeFile(tmp, JSON.stringify(state, null, 2), "utf8");
-  await fs25.rename(tmp, statePath(home));
+  await fs29.writeFile(tmp, JSON.stringify(state, null, 2), "utf8");
+  await fs29.rename(tmp, statePath(home));
 }
 
 // src/commands/bootstrap/launch.ts
@@ -24087,7 +25558,7 @@ var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
   static paths = [["bootstrap", "launch"]];
-  static usage = Command47.Usage({
+  static usage = Command49.Usage({
     description: "Create + authorize the installer managed identity, then kick the cloud installer.",
     details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t-stack app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t-stack/bootstrap.json for `status`/`reap`/`finish`.",
     examples: [
@@ -24096,13 +25567,13 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.0"]
     ]
   });
-  location = Option45.String("--location");
-  resourceGroup = Option45.String("--resource-group");
-  clientId = Option45.String("--client-id");
-  subscription = Option45.String("--subscription");
-  installerTag = Option45.String("--installer-tag");
-  gatewayImageRef = Option45.String("--gateway-image-ref");
-  githubAppCreds = Option45.String("--github-app-creds");
+  location = Option46.String("--location");
+  resourceGroup = Option46.String("--resource-group");
+  clientId = Option46.String("--client-id");
+  subscription = Option46.String("--subscription");
+  installerTag = Option46.String("--installer-tag");
+  gatewayImageRef = Option46.String("--gateway-image-ref");
+  githubAppCreds = Option46.String("--github-app-creds");
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -24116,12 +25587,12 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
     const out = (m) => this.context.stderr.write(`  ${colors.dim(m)}
 `);
-    const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path27.join(os13.homedir(), ".m8t-stack", "github-app.json");
+    const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path32.join(os14.homedir(), ".m8t-stack", "github-app.json");
     let githubApp;
-    if (fs26.existsSync(credsPath)) {
+    if (fs30.existsSync(credsPath)) {
       let parsed;
       try {
-        parsed = JSON.parse(fs26.readFileSync(credsPath, "utf8"));
+        parsed = JSON.parse(fs30.readFileSync(credsPath, "utf8"));
       } catch {
         throw new LocalCliError({
           code: "GITHUB_APP_CREDS_INVALID",
@@ -24131,7 +25602,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       }
       let pem;
       try {
-        pem = fs26.readFileSync(parsed.pemPath, "utf8");
+        pem = fs30.readFileSync(parsed.pemPath, "utf8");
       } catch {
         throw new LocalCliError({
           code: "GITHUB_APP_PEM_MISSING",
@@ -24203,7 +25674,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/status.ts
-import { Command as Command48, Option as Option46 } from "clipanion";
+import { Command as Command50, Option as Option47 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-aci-state.ts
@@ -24231,13 +25702,13 @@ async function getAciState(opts) {
 // src/commands/bootstrap/status.ts
 var BootstrapStatusCommand = class extends M8tCommand {
   static paths = [["bootstrap", "status"]];
-  static usage = Command48.Usage({
+  static usage = Command50.Usage({
     description: "Show the cloud installer's live status (phase, progress, result).",
     details: "Reads the durable status blob written by the installer. --watch polls until the install reaches done or failed.",
     examples: [["One read", "$0 bootstrap status"], ["Watch to completion", "$0 bootstrap status --watch"]]
   });
-  watch = Option46.Boolean("--watch", false);
-  output = Option46.String("--output");
+  watch = Option47.Boolean("--watch", false);
+  output = Option47.String("--output");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -24308,7 +25779,7 @@ function formatStatus(d) {
 }
 
 // src/commands/bootstrap/reap.ts
-import { Command as Command49, Option as Option47 } from "clipanion";
+import { Command as Command51, Option as Option48 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-reap.ts
@@ -24384,14 +25855,14 @@ async function reapInstaller(opts) {
 // src/commands/bootstrap/reap.ts
 var BootstrapReapCommand = class extends M8tCommand {
   static paths = [["bootstrap", "reap"]];
-  static usage = Command49.Usage({
+  static usage = Command51.Usage({
     description: "Tear down the installer scaffolding (ACI \u2192 MI \u2192 its role assignments) after a successful install.",
     details: "Runs locally on the 'done' signal (the installer can't delete its own identity). The platform RG and the gateway's own assignments persist. A failed install is left intact for diagnosis unless --force.",
     examples: [["Reap after done", "$0 bootstrap reap"]]
   });
-  force = Option47.Boolean("--force", false);
-  sweepOrphans = Option47.Boolean("--sweep-orphans", false);
-  yes = Option47.Boolean("--yes", false);
+  force = Option48.Boolean("--force", false);
+  sweepOrphans = Option48.Boolean("--sweep-orphans", false);
+  yes = Option48.Boolean("--yes", false);
   async executeCommand() {
     if (this.sweepOrphans === true) {
       const { subscriptionId: sub } = await getAzAccount();
@@ -24456,17 +25927,17 @@ Found ${String(found.length)} orphaned Owner@sub assignment(s) (dry-run). ${colo
 };
 
 // src/commands/bootstrap/finish.ts
-import * as fs27 from "fs/promises";
-import * as os15 from "os";
-import * as path29 from "path";
-import { Command as Command50, Option as Option48 } from "clipanion";
+import * as fs31 from "fs/promises";
+import * as os16 from "os";
+import * as path34 from "path";
+import { Command as Command52, Option as Option49 } from "clipanion";
 init_errors();
 
 // src/lib/company-profile-seed.ts
 import { spawn as spawn6 } from "child_process";
-import { closeSync, openSync, readFileSync as readFileSync18 } from "fs";
-import * as os14 from "os";
-import * as path28 from "path";
+import { closeSync, openSync, readFileSync as readFileSync20 } from "fs";
+import * as os15 from "os";
+import * as path33 from "path";
 init_errors();
 
 // src/lib/onboarding-profile.ts
@@ -24647,9 +26118,9 @@ function composeFounderIdentityNote(id) {
 
 // src/lib/company-profile-seed.ts
 function readGithubAppCreds(credsPath) {
-  const p = credsPath ?? path28.join(os14.homedir(), ".m8t-stack", "github-app.json");
+  const p = credsPath ?? path33.join(os15.homedir(), ".m8t-stack", "github-app.json");
   try {
-    return JSON.parse(readFileSync18(p, "utf8"));
+    return JSON.parse(readFileSync20(p, "utf8"));
   } catch {
     return null;
   }
@@ -24677,7 +26148,7 @@ async function resolveSeedContext(opts) {
 async function applyProfileToBrain(args) {
   const token = await mintInstallationTokenFromPem({
     appId: args.appCreds.appId,
-    privateKeyPem: readFileSync18(args.appCreds.pemPath, "utf8"),
+    privateKeyPem: readFileSync20(args.appCreds.pemPath, "utf8"),
     installationId: args.appCreds.installationId,
     fetchImpl: args.fetchImpl
   });
@@ -24712,7 +26183,7 @@ async function applyProfileToBrain(args) {
   });
 }
 function spawnDetachedSeedWatch() {
-  const logPath = path28.join(os14.homedir(), ".m8t-stack", "seed-profile.log");
+  const logPath = path33.join(os15.homedir(), ".m8t-stack", "seed-profile.log");
   const fd = openSync(logPath, "a");
   try {
     const child = spawn6(process.execPath, [process.argv[1] ?? "", "bootstrap", "seed-profile", "--watch"], {
@@ -24789,14 +26260,14 @@ function renderInstallSummary(args) {
 // src/commands/bootstrap/finish.ts
 var BootstrapFinishCommand = class extends M8tCommand {
   static paths = [["bootstrap", "finish"]];
-  static usage = Command50.Usage({
+  static usage = Command52.Usage({
     description: "Point your local tools at the now-live platform (repo-root marker, discovery cache, next steps).",
     details: "Final step of `m8t bootstrap` (after the install reaches done). Writes ~/.m8t-stack/repo-root, points your local tools at the live gateway, and \u2014 if you completed the onboarding questionnaire \u2014 seeds your brain-backed advisor's brain with your company profile (best-effort; never blocks finish). Run `m8t bootstrap seed-profile` to seed manually later.",
     examples: [["Finish local", "$0 bootstrap finish --repo-root /path/to/m8t"]]
   });
-  repoRoot = Option48.String("--repo-root");
-  subscription = Option48.String("--subscription");
-  resourceGroup = Option48.String("--resource-group");
+  repoRoot = Option49.String("--repo-root");
+  subscription = Option49.String("--subscription");
+  resourceGroup = Option49.String("--resource-group");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -24811,9 +26282,9 @@ var BootstrapFinishCommand = class extends M8tCommand {
       });
     }
     const repoRoot = (typeof this.repoRoot === "string" ? this.repoRoot : void 0) ?? process.cwd();
-    const markerDir = path29.join(os15.homedir(), ".m8t-stack");
-    await fs27.mkdir(markerDir, { recursive: true });
-    await fs27.writeFile(path29.join(markerDir, "repo-root"), `${repoRoot}
+    const markerDir = path34.join(os16.homedir(), ".m8t-stack");
+    await fs31.mkdir(markerDir, { recursive: true });
+    await fs31.writeFile(path34.join(markerDir, "repo-root"), `${repoRoot}
 `, "utf8");
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? state.subscriptionId;
     const resourceGroup = (typeof this.resourceGroup === "string" ? this.resourceGroup : void 0) ?? state.resourceGroup;
@@ -24849,7 +26320,7 @@ var BootstrapFinishCommand = class extends M8tCommand {
     }
     let brainOrg = null;
     try {
-      const credsRaw = await fs27.readFile(path29.join(markerDir, "github-app.json"), "utf8");
+      const credsRaw = await fs31.readFile(path34.join(markerDir, "github-app.json"), "utf8");
       const creds = JSON.parse(credsRaw);
       brainOrg = typeof creds.org === "string" ? creds.org : null;
     } catch {
@@ -24880,18 +26351,18 @@ ${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP se
 };
 
 // src/commands/bootstrap/ui.ts
-import * as fs29 from "fs";
-import * as os17 from "os";
-import * as path31 from "path";
-import { Command as Command51, Option as Option49 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential19 } from "@azure/identity";
+import * as fs33 from "fs";
+import * as os18 from "os";
+import * as path36 from "path";
+import { Command as Command53, Option as Option50 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential20 } from "@azure/identity";
 init_errors();
 
 // src/lib/bootstrap-ui.ts
-import * as fs28 from "fs";
+import * as fs32 from "fs";
 import * as net from "net";
-import * as os16 from "os";
-import * as path30 from "path";
+import * as os17 from "os";
+import * as path35 from "path";
 import { spawn as spawn7 } from "child_process";
 init_errors();
 init_rbac();
@@ -24958,9 +26429,9 @@ async function ensureFounderFoundryRole(args) {
   });
 }
 function writeWebEnvLocal(args) {
-  const envPath = path30.join(args.repoRoot, "apps", "web", ".env.local");
-  if (fs28.existsSync(envPath)) {
-    fs28.copyFileSync(envPath, envPath + ".bak");
+  const envPath = path35.join(args.repoRoot, "apps", "web", ".env.local");
+  if (fs32.existsSync(envPath)) {
+    fs32.copyFileSync(envPath, envPath + ".bak");
   }
   const body = [
     "# Written by `m8t bootstrap ui` \u2014 onboarding chat-only run (Simple Stacey).",
@@ -24974,7 +26445,7 @@ function writeWebEnvLocal(args) {
     "NEXT_PUBLIC_M8T_ONBOARDING=1",
     ""
   ].join("\n");
-  fs28.writeFileSync(envPath, body, "utf8");
+  fs32.writeFileSync(envPath, body, "utf8");
   return envPath;
 }
 function assertNodeVersion(versionString = process.version) {
@@ -25015,11 +26486,11 @@ async function installWebDeps(repoRoot) {
   });
   await runInherit("pnpm", ["install"], repoRoot, "BOOTSTRAP_UI_INSTALL_FAILED");
 }
-function onboardingUiPaths(home = os16.homedir()) {
-  const dir = path30.join(home, ".m8t-stack");
+function onboardingUiPaths(home = os17.homedir()) {
+  const dir = path35.join(home, ".m8t-stack");
   return {
-    logPath: path30.join(dir, "onboarding-ui.log"),
-    pidPath: path30.join(dir, "onboarding-ui.pid")
+    logPath: path35.join(dir, "onboarding-ui.log"),
+    pidPath: path35.join(dir, "onboarding-ui.pid")
   };
 }
 async function serveOnboardingUiDetached(args) {
@@ -25043,8 +26514,8 @@ async function serveOnboardingUiDetached(args) {
   if (await isPortOpen()) {
     return { alreadyRunning: true, logPath };
   }
-  fs28.mkdirSync(path30.dirname(logPath), { recursive: true });
-  const fd = fs28.openSync(logPath, "a");
+  fs32.mkdirSync(path35.dirname(logPath), { recursive: true });
+  const fd = fs32.openSync(logPath, "a");
   const child = spawn7("pnpm", ["--filter", "web", "dev"], {
     cwd: args.repoRoot,
     detached: true,
@@ -25052,7 +26523,7 @@ async function serveOnboardingUiDetached(args) {
     env: { ...process.env, PORT: args.port },
     shell: false
   });
-  fs28.closeSync(fd);
+  fs32.closeSync(fd);
   if (child.pid == null) {
     throw new LocalCliError({
       code: "BOOTSTRAP_UI_DEV_SPAWN_FAILED",
@@ -25061,7 +26532,7 @@ async function serveOnboardingUiDetached(args) {
     });
   }
   child.unref();
-  fs28.writeFileSync(pidPath, String(child.pid), "utf8");
+  fs32.writeFileSync(pidPath, String(child.pid), "utf8");
   const deadline = Date.now() + 45e3;
   const sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
   while (Date.now() < deadline) {
@@ -25080,11 +26551,11 @@ function autoOpenOnboardingUi(url, open = tryOpenUrl) {
   } catch {
   }
 }
-function stopOnboardingUi(home = os16.homedir()) {
+function stopOnboardingUi(home = os17.homedir()) {
   const { pidPath } = onboardingUiPaths(home);
   let pidStr;
   try {
-    pidStr = fs28.readFileSync(pidPath, "utf8").trim();
+    pidStr = fs32.readFileSync(pidPath, "utf8").trim();
   } catch {
     return false;
   }
@@ -25097,7 +26568,7 @@ function stopOnboardingUi(home = os16.homedir()) {
     }
   }
   try {
-    fs28.unlinkSync(pidPath);
+    fs32.unlinkSync(pidPath);
   } catch {
   }
   return true;
@@ -25154,7 +26625,7 @@ async function deploySimpleStacey(args) {
 // src/commands/bootstrap/ui.ts
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
-  static usage = Command51.Usage({
+  static usage = Command53.Usage({
     description: "Deploy Simple Stacey + start the local onboarding chat UI in the background (returns immediately).",
     details: [
       "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Waits for the cloud",
@@ -25172,15 +26643,15 @@ var BootstrapUiCommand = class extends M8tCommand {
       ["Foreground (blocking, old behaviour)", "$0 bootstrap ui --repo-root /path/to/m8t --foreground"]
     ]
   });
-  repoRoot = Option49.String("--repo-root");
-  port = Option49.String("--port", "3000");
-  endpoint = Option49.String("--endpoint", {
+  repoRoot = Option50.String("--repo-root");
+  port = Option50.String("--port", "3000");
+  endpoint = Option50.String("--endpoint", {
     description: "Foundry project endpoint to target \u2014 disambiguates when the subscription has multiple projects."
   });
-  prepOnly = Option49.Boolean("--prep-only", false);
-  skipInstall = Option49.Boolean("--skip-install", false);
-  stop = Option49.Boolean("--stop", false);
-  foreground = Option49.Boolean("--foreground", false);
+  prepOnly = Option50.Boolean("--prep-only", false);
+  skipInstall = Option50.Boolean("--skip-install", false);
+  stop = Option50.Boolean("--stop", false);
+  foreground = Option50.Boolean("--foreground", false);
   async executeCommand() {
     if (this.stop === true) {
       const stopped = stopOnboardingUi();
@@ -25213,10 +26684,10 @@ var BootstrapUiCommand = class extends M8tCommand {
       this.context.stderr.write(`  ${colors.dim(m)}
 `);
     };
-    if (fs29.existsSync(path31.join(os17.homedir(), ".m8t-stack", "config.yaml"))) {
+    if (fs33.existsSync(path36.join(os18.homedir(), ".m8t-stack", "config.yaml"))) {
       out(colors.error("\u26A0 an existing ~/.m8t-stack/config.yaml will override the onboarding app registration in apps/web \u2014 if Microsoft sign-in fails, move it aside and retry."));
     }
-    const credential2 = new DefaultAzureCredential19();
+    const credential2 = new DefaultAzureCredential20();
     const account = await getAzAccount();
     assertNodeVersion();
     out("waiting for Foundry (the installer's foundry-create phase)\u2026");
@@ -25287,10 +26758,10 @@ var BootstrapUiCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command52, Option as Option50 } from "clipanion";
+import { Command as Command54, Option as Option51 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command52.Usage({
+  static usage = Command54.Usage({
     description: "Seed your advisors' brains with the founder + company profile from the onboarding questionnaire.",
     details: "Reads the latest stacey-intake conversation, renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines), and commits them to both <org>/stacey-brain and <org>/azzy-brain via the GitHub App. Idempotent. --watch polls until the founder completes the questionnaire.",
     examples: [
@@ -25298,11 +26769,11 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       ["Wait for the founder to finish", "$0 bootstrap seed-profile --watch"]
     ]
   });
-  endpoint = Option50.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option50.String("--brain", { description: "Override the brain repo (default <org>/stacey-brain)." });
-  watch = Option50.Boolean("--watch", false, { description: "Poll until the questionnaire completes (or --timeout)." });
-  timeout = Option50.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option50.String("--github-app-creds");
+  endpoint = Option51.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option51.String("--brain", { description: "Override the brain repo (default <org>/stacey-brain)." });
+  watch = Option51.Boolean("--watch", false, { description: "Poll until the questionnaire completes (or --timeout)." });
+  timeout = Option51.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option51.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -25387,7 +26858,9 @@ cli.register(CoderTeardownCommand);
 cli.register(AzureExecDeployCommand);
 cli.register(PlatformStatusCommand);
 cli.register(PlatformUpdateCommand);
+cli.register(PlatformConvergeCommand);
 cli.register(PlatformEnableCostReportCommand);
+cli.register(PlatformEnableAutoUpdateCommand);
 cli.register(DeployCommand);
 cli.register(AgentDeployAdvisorCommand);
 cli.register(AgentRemoveCommand);