@m8t-stack/cli 0.2.29 → 0.2.30

package/dist/cli.js

@@ -1247,7 +1247,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.29";
+var CLI_VERSION = "0.2.30";
 
 // src/lib/render-error.ts
 init_errors();
@@ -1335,7 +1335,7 @@ var BACKEND_RULES = [
     reason: "unknown_channel",
     hint: () => "channel must be one of: telegram, slack, teams."
   },
-  // BAD_REQUEST — F4 binding-validation reasons
+  // BAD_REQUEST — binding-validation reasons
   {
     code: "BAD_REQUEST",
     reason: "no_adapter_registered",
@@ -1391,13 +1391,13 @@ var BACKEND_RULES = [
       return `no binding '${bindingId}' found. Run 'm8t bind list' to see all bindings.`;
     }
   },
-  // BAD_REQUEST — F6 webhook-registration rejection
+  // BAD_REQUEST — webhook-registration rejection
   {
     code: "BAD_REQUEST",
     reason: "webhook_registration_rejected",
     hint: () => "Telegram rejected the bot token. Double-check the token from BotFather and that it isn't revoked."
   },
-  // UPSTREAM_FAILED — F6 webhook-registration transient failure
+  // UPSTREAM_FAILED — webhook-registration transient failure
   {
     code: "UPSTREAM_FAILED",
     reason: "webhook_registration_failed",
@@ -1452,7 +1452,7 @@ var LOCAL_RULES = {
   APP_HEALTH_FAILED: "Run `m8t brain check-app` for details, then re-run this command.",
   APP_UNINSTALL_FAILED: "GitHub App-uninstall DELETE failed. Re-run with `--keep-app-install` if you want to skip this step.",
   ARM_AUTH: "Run `az login` and retry.",
-  // F2 smoke fix — m8t brain create: stageAsGitRepo step
+  // m8t brain create: stageAsGitRepo step
   BRAIN_GIT_INIT_FAILED: "If git is not installed, install it. Otherwise re-run with --verbose.",
   BRAIN_NOT_LINKED: "The worker has no brain link. Use `m8t brain link` or `m8t brain create` first.",
   BRAIN_YAML_MIRROR_FAILED: "GitHub Contents API PUT failed. Verify the App has `contents: write` permission on the repo.",
@@ -1468,7 +1468,6 @@ var LOCAL_RULES = {
   PERSONA_PATH_NOT_ABSOLUTE: "The persona path in ~/.m8t/foundry/<worker>.yaml must be absolute. Re-deploy the worker via the architect.",
   PERSONA_PLACEHOLDER_UNSATISFIED: "Re-deploy the worker via the architect to repopulate fillableFieldValues, OR edit ~/.m8t/foundry/<worker>.yaml manually.",
   PERSONA_READ_FAILED: "Verify the persona path in ~/.m8t/foundry/<worker>.yaml; the architect should have populated it at deploy time.",
-  // ── pre-existing entries ──────────────────────────────────────────────────
   AUTH_NOT_SIGNED_IN: "you are not signed in to Azure \u2014 run 'az login' first.",
   AUTH_EXPIRED: "your Azure login expired \u2014 run 'az login' to re-authenticate.",
   AUTH_WRONG_TENANT: "your active Azure session may be in a different tenant \u2014 run 'az login --tenant <id>'.",
@@ -14262,8 +14261,8 @@ function isM8tBrainMarker(yamlText) {
   }
   if (!parsed || typeof parsed !== "object") return false;
   const root = parsed;
-  const isObj3 = (v) => typeof v === "object" && v !== null;
-  return isObj3(root.engine) || isObj3(root.processes) || isObj3(root.link);
+  const isObj4 = (v) => typeof v === "object" && v !== null;
+  return isObj4(root.engine) || isObj4(root.processes) || isObj4(root.link);
 }
 async function createBlankRepo(args) {
   const res = await fetch(`https://api.github.com/orgs/${args.org}/repos`, {
@@ -20184,8 +20183,181 @@ function targetManifestSource(ctx, target) {
   return manifestSourceForVersionTag(ctx.channelUrl, target);
 }
 
-// src/commands/platform/enable-cost-report.ts
+// src/commands/platform/seed-stamp.ts
+import { readFileSync as readFileSync17 } from "fs";
 import { Command as Command34, Option as Option31 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential18, ManagedIdentityCredential as ManagedIdentityCredential2 } from "@azure/identity";
+init_errors();
+
+// src/lib/platform-stamp-seed.ts
+var IMAGE_COMPONENTS = ["gateway", "codingAgent", "azureExecutor"];
+var BARE_SEMVER = /^\d+\.\d+\.\d+$/;
+function isObj3(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function validateDescriptor(raw) {
+  const errors = [];
+  if (!isObj3(raw)) return ["descriptor is not an object"];
+  if (raw.schemaVersion !== 1) errors.push("schemaVersion must be the integer 1");
+  if (typeof raw.platformVersion !== "string" || !BARE_SEMVER.test(raw.platformVersion)) {
+    errors.push(`platformVersion must be a bare X.Y.Z release version, got ${JSON.stringify(raw.platformVersion)}`);
+  }
+  if (!isObj3(raw.generatedFrom)) {
+    errors.push("generatedFrom is required");
+  } else {
+    if (typeof raw.generatedFrom.commit !== "string") {
+      errors.push("generatedFrom.commit is required");
+    }
+    if (typeof raw.generatedFrom.generatedAt !== "string") {
+      errors.push("generatedFrom.generatedAt is required");
+    }
+  }
+  const images = raw.images;
+  if (!isObj3(images)) {
+    errors.push("images is required");
+  } else {
+    for (const key2 of IMAGE_COMPONENTS) {
+      const img = images[key2];
+      if (!isObj3(img)) {
+        errors.push(`images.${key2} is required`);
+        continue;
+      }
+      if (typeof img.ref !== "string" || img.ref.length === 0) errors.push(`images.${key2}.ref is required`);
+      if (typeof img.tag !== "string" || img.tag.length === 0) errors.push(`images.${key2}.tag is required`);
+      if (typeof img.digest !== "string") errors.push(`images.${key2}.digest must be a string (may be empty)`);
+    }
+  }
+  const content = raw.content;
+  if (content !== void 0) {
+    if (!isObj3(content)) {
+      errors.push("content must be an object when present");
+    } else {
+      if (!isObj3(content.personas)) errors.push("content.personas must be an object");
+      if (typeof content.infra !== "string") errors.push("content.infra must be a string");
+      if (typeof content.brainSeedsRev !== "string") errors.push("content.brainSeedsRev must be a string");
+    }
+  }
+  return errors;
+}
+function buildSeedStamp(d, cliVersion, nowIso) {
+  const img = (k) => ({
+    tag: d.images[k].tag,
+    digest: d.images[k].digest,
+    state: "managed"
+  });
+  const personas = {};
+  for (const [name, treeSha] of Object.entries(d.content?.personas ?? {})) {
+    personas[name] = { treeSha, foundryVersion: "" };
+  }
+  const stamp = {
+    schemaVersion: 1,
+    platformVersion: platformTag(d.platformVersion),
+    previousPlatformVersion: null,
+    updatedAt: nowIso,
+    lastResult: "success",
+    cli: cliVersion,
+    origin: "install-seed",
+    components: {
+      gateway: img("gateway"),
+      codingAgent: img("codingAgent"),
+      azureExecutor: img("azureExecutor"),
+      personas,
+      infra: { treeSha: d.content?.infra ?? "" }
+    }
+  };
+  if (d.content?.brainSeedsRev) stamp.components.brainSeeds = { seedRev: d.content.brainSeedsRev };
+  return stamp;
+}
+
+// src/commands/platform/seed-stamp.ts
+async function seedStamp2(args) {
+  const readFileImpl = args.readFileImpl ?? ((p) => readFileSync17(p, "utf8"));
+  const readStampImpl = args.readStampImpl ?? readStamp;
+  const writeStampImpl = args.writeStampImpl ?? ((stamp2, o) => writeStamp({ ...o, stamp: stamp2 }));
+  const discoverImpl = args.discoverImpl ?? discoverStampStorage;
+  const ctx = { credential: args.credential, subscriptionId: args.subscriptionId, resourceGroup: args.resourceGroup };
+  let raw;
+  try {
+    raw = JSON.parse(readFileImpl(args.descriptorPath));
+  } catch (e) {
+    throw new LocalCliError({
+      code: "PLATFORM_SEED_DESCRIPTOR_UNREADABLE",
+      message: `Cannot read the install descriptor at ${args.descriptorPath}.`,
+      hint: "The descriptor is generated at installer-image build time (scripts/install-descriptor-gen.mjs). An image built without that step cannot seed a stamp.",
+      cause: e
+    });
+  }
+  const errors = validateDescriptor(raw);
+  if (errors.length > 0) {
+    throw new LocalCliError({
+      code: "PLATFORM_SEED_DESCRIPTOR_INVALID",
+      message: `The install descriptor at ${args.descriptorPath} is not valid: ${errors.join("; ")}.`,
+      hint: "Regenerate it with scripts/install-descriptor-gen.mjs."
+    });
+  }
+  const descriptor = raw;
+  const { accountName } = await discoverImpl(ctx);
+  const existing = await readStampImpl(ctx);
+  if (existing) {
+    args.onProgress?.(`platform stamp already present (${existing.platformVersion}) \u2014 leaving it untouched.`);
+    return { outcome: "already-stamped", platformVersion: existing.platformVersion, storageAccount: accountName };
+  }
+  const stamp = buildSeedStamp(descriptor, CLI_VERSION, args.nowIso ?? (/* @__PURE__ */ new Date()).toISOString());
+  await writeStampImpl(stamp, { ...ctx, onProgress: args.onProgress });
+  return {
+    outcome: descriptor.content ? "seeded" : "seeded-partial",
+    platformVersion: stamp.platformVersion,
+    storageAccount: accountName,
+    components: {
+      gateway: stamp.components.gateway.tag,
+      codingAgent: stamp.components.codingAgent.tag,
+      azureExecutor: stamp.components.azureExecutor.tag
+    }
+  };
+}
+var PlatformSeedStampCommand = class extends M8tCommand {
+  static paths = [["platform", "seed-stamp"]];
+  static usage = Command34.Usage({
+    description: "INTERNAL: write the initial installed-state stamp from a build-time install descriptor.",
+    details: "Used by the cloud installer at the end of a from-zero install so the platform records which release it is running. Writes the stamp ONLY IF ABSENT \u2014 it never overwrites a stamp written by the converge engine, so a re-run or a container restart is harmless. Not a founder-facing command: to change what is installed, use 'm8t platform update'."
+  });
+  descriptor = Option31.String("--descriptor", { description: "Path to install-descriptor.json (baked into the installer image)." });
+  subscription = Option31.String("--subscription");
+  resourceGroup = Option31.String("--resource-group");
+  miClientId = Option31.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
+  output = Option31.String("--output");
+  async executeCommand() {
+    const mode = resolveOutputMode(this.output, this.context.stdout);
+    const need = (v, flag) => {
+      if (typeof v !== "string" || v.trim().length === 0) {
+        throw new LocalCliError({ code: "PLATFORM_SEED_ARG_MISSING", message: `${flag} is required.` });
+      }
+      return v.trim();
+    };
+    const onProgress = (m) => {
+      this.context.stderr.write(`${m}
+`);
+    };
+    const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential2({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential18();
+    const result = await seedStamp2({
+      descriptorPath: need(this.descriptor, "--descriptor"),
+      credential: credential2,
+      subscriptionId: need(this.subscription, "--subscription"),
+      resourceGroup: need(this.resourceGroup, "--resource-group"),
+      onProgress
+    });
+    if (mode === "json") {
+      this.context.stdout.write(renderJson(result) + "\n");
+    } else {
+      this.context.stdout.write(`${result.outcome}: ${result.platformVersion} (storage ${result.storageAccount})
+`);
+    }
+    return 0;
+  }
+};
+
+// src/commands/platform/enable-cost-report.ts
+import { Command as Command35, Option as Option32 } from "clipanion";
 
 // src/lib/wire-gateway-acs.ts
 init_rbac();
@@ -20225,18 +20397,18 @@ async function wireGatewayForAcs(args) {
 init_errors();
 var PlatformEnableCostReportCommand = class extends M8tCommand {
   static paths = [["platform", "enable-cost-report"]];
-  static usage = Command34.Usage({
+  static usage = Command35.Usage({
     description: "Wire the deployed gateway to send the bi-weekly cost report via ACS Email.",
     details: "Discovers the live gateway Container App, grants its managed identity Contributor at the ACS resource scope (authorising the ACS Email send), and sets M8T_ACS_ENDPOINT / M8T_ACS_SENDER / M8T_ENABLE_COST_REPORTER=1 on the gateway. Idempotent \u2014 safely re-runnable. ACS is created during the executor deploy; pass its endpoint, sender, and resource id (from that deploy or 'az communication list')."
   });
-  subscription = Option31.String("--subscription");
-  resourceGroup = Option31.String("--resource-group", {
+  subscription = Option32.String("--subscription");
+  resourceGroup = Option32.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  acsEndpoint = Option31.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
-  acsSender = Option31.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
-  acsResourceId = Option31.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
-  output = Option31.String("--output");
+  acsEndpoint = Option32.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
+  acsSender = Option32.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
+  acsResourceId = Option32.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
+  output = Option32.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -20310,39 +20482,39 @@ var PlatformEnableCostReportCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/enable-auto-update.ts
-import { Command as Command35, Option as Option32 } from "clipanion";
+import { Command as Command36, Option as Option33 } from "clipanion";
 import { confirm as confirm6 } from "@inquirer/prompts";
-import { DefaultAzureCredential as DefaultAzureCredential18 } from "@azure/identity";
+import { DefaultAzureCredential as DefaultAzureCredential19 } from "@azure/identity";
 init_errors();
 var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
   static paths = [["platform", "enable-auto-update"]];
-  static usage = Command35.Usage({
+  static usage = Command36.Usage({
     category: "Platform",
     description: "Retrofit the auto-updater (MI + cron job + role assignments) onto an existing install.",
     details: "For an install that predates the Platform Update Framework: recovers the deployment's resource-name suffix (from the stamped system/infra-params row, or by verified derivation from the live gateway), recovers the other bicep params from live state (WITHOUT changing the deployed gateway image), and re-runs deploy/main.bicep with provisionUpdater=true \u2014 which provisions the updater managed identity, the cron Container Apps Job, and every role assignment (Owner@RG + Foundry User@account + Storage Table + Storage Blob + AcrPull), all scoped to the resource group. On success, backfills system/infra-params so future converges never have to re-derive the suffix. Idempotent \u2014 safe to re-run."
   });
-  subscription = Option32.String("--subscription");
-  resourceGroup = Option32.String("--resource-group", {
+  subscription = Option33.String("--subscription");
+  resourceGroup = Option33.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  suffix = Option32.String("--suffix", {
+  suffix = Option33.String("--suffix", {
     description: "The existing deployment's resource-name suffix. Required when it cannot be recovered from system/infra-params or the live gateway."
   });
-  installerImage = Option32.String("--installer-image", {
+  installerImage = Option33.String("--installer-image", {
     required: true,
     description: "Updater CA-Job image ref (the converge engine at the current release). Required \u2014 an empty image would skip provisioning."
   });
-  updateCron = Option32.String("--update-cron", {
+  updateCron = Option33.String("--update-cron", {
     description: "Cron schedule for the updater job (bicep default applies when omitted)."
   });
-  channelUrl = Option32.String("--channel-url", {
+  channelUrl = Option33.String("--channel-url", {
     description: "Release-channel URL the updater job polls (bicep default applies when omitted)."
   });
-  endpoint = Option32.String("--endpoint", {
+  endpoint = Option33.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
   });
-  yes = Option32.Boolean("--yes", false);
-  output = Option32.String("--output");
+  yes = Option33.Boolean("--yes", false);
+  output = Option33.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -20361,7 +20533,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
       resourceGroup: this.resourceGroup
     });
     const { resourceGroup, name: gatewayName } = parseContainerAppResourceId(gw.containerAppResourceId);
-    const credential2 = new DefaultAzureCredential18();
+    const credential2 = new DefaultAzureCredential19();
     const account = await getAzAccount();
     const subscriptionId = this.subscription ?? account.subscriptionId;
     const explicitSuffix = typeof this.suffix === "string" && this.suffix.length > 0 ? this.suffix : void 0;
@@ -20463,7 +20635,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
 };
 
 // src/commands/deploy.ts
-import { Command as Command36, Option as Option33 } from "clipanion";
+import { Command as Command37, Option as Option34 } from "clipanion";
 
 // src/lib/app-reg.ts
 init_errors();
@@ -20865,40 +21037,40 @@ function classifyWhatIf(changes) {
 var DEFAULT_IMAGE_REF = "ghcr.io/m8t-labs/m8t:latest";
 var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     description: "Deploy (or update) the m8t gateway/webapp stack via Bicep.",
     details: "Ensures the Entra app reg (or pass --client-id to reuse an existing one \u2014 required if you can't create app regs), writes ~/.m8t/config.yaml, ensures the resource group, and runs deploy/main.bicep. The repo is located via ~/.m8t/repo-root."
   });
-  subscription = Option33.String("--subscription");
-  resourceGroup = Option33.String("--resource-group", "rg-m8t-stack");
-  location = Option33.String("--location", "eastus");
-  suffix = Option33.String("--suffix", "");
-  imageRef = Option33.String("--image-ref", DEFAULT_IMAGE_REF);
-  acrPullIdentity = Option33.String("--acrpull-identity");
-  acrResourceId = Option33.String("--acr-resource-id");
-  foundryEndpoint = Option33.String("--foundry-endpoint");
-  foundryResourceId = Option33.String("--foundry-resource-id");
-  foundryTracing = Option33.String("--foundry-tracing");
+  subscription = Option34.String("--subscription");
+  resourceGroup = Option34.String("--resource-group", "rg-m8t-stack");
+  location = Option34.String("--location", "eastus");
+  suffix = Option34.String("--suffix", "");
+  imageRef = Option34.String("--image-ref", DEFAULT_IMAGE_REF);
+  acrPullIdentity = Option34.String("--acrpull-identity");
+  acrResourceId = Option34.String("--acr-resource-id");
+  foundryEndpoint = Option34.String("--foundry-endpoint");
+  foundryResourceId = Option34.String("--foundry-resource-id");
+  foundryTracing = Option34.String("--foundry-tracing");
   // project | account | skip (bicep default: project)
-  clientId = Option33.String("--client-id");
-  whatIf = Option33.Boolean("--what-if", false);
-  output = Option33.String("--output");
-  // Referee (E2-F5) — all optional, undefined by default ⇒ the bicep defaults
+  clientId = Option34.String("--client-id");
+  whatIf = Option34.Boolean("--what-if", false);
+  output = Option34.String("--output");
+  // Referee — all optional, undefined by default ⇒ the bicep defaults
   // apply (dormant: gatewayCpu=0.25, gatewayMemory=0.5Gi, every referee/exam var
   // empty). Only pass these when explicitly enabling the referee exam stack.
-  gatewayCpu = Option33.String("--gateway-cpu");
-  gatewayMemory = Option33.String("--gateway-memory");
-  refereeEnabled = Option33.String("--referee-enabled");
-  refereeBrainRepos = Option33.String("--referee-brain-repos");
-  refereeFeedRepo = Option33.String("--referee-feed-repo");
-  refereeInstallationId = Option33.String("--referee-installation-id");
-  refereeWebhookHmacKvUri = Option33.String("--referee-webhook-hmac-kv-uri");
-  examKvUri = Option33.String("--exam-kv-uri");
-  examLaWorkspaceId = Option33.String("--exam-la-workspace-id");
-  brainEvalDeployment = Option33.String("--brain-eval-deployment");
-  brainAppLogin = Option33.String("--brain-app-login");
-  refereeCheckpointDir = Option33.String("--referee-checkpoint-dir");
-  examApiBase = Option33.String("--exam-api-base");
+  gatewayCpu = Option34.String("--gateway-cpu");
+  gatewayMemory = Option34.String("--gateway-memory");
+  refereeEnabled = Option34.String("--referee-enabled");
+  refereeBrainRepos = Option34.String("--referee-brain-repos");
+  refereeFeedRepo = Option34.String("--referee-feed-repo");
+  refereeInstallationId = Option34.String("--referee-installation-id");
+  refereeWebhookHmacKvUri = Option34.String("--referee-webhook-hmac-kv-uri");
+  examKvUri = Option34.String("--exam-kv-uri");
+  examLaWorkspaceId = Option34.String("--exam-la-workspace-id");
+  brainEvalDeployment = Option34.String("--brain-eval-deployment");
+  brainAppLogin = Option34.String("--brain-app-login");
+  refereeCheckpointDir = Option34.String("--referee-checkpoint-dir");
+  examApiBase = Option34.String("--exam-api-base");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -21038,7 +21210,7 @@ var DeployCommand = class extends M8tCommand {
 
 // src/commands/eval/skill.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { Command as Command37, Option as Option34 } from "clipanion";
+import { Command as Command38, Option as Option35 } from "clipanion";
 init_errors();
 var DECISIONS = /* @__PURE__ */ new Set(["promote", "reject", "needs_review"]);
 var JUDGE_STATUSES = /* @__PURE__ */ new Set(["ok", "skipped", "unavailable"]);
@@ -21063,14 +21235,14 @@ function parseVerdict(stdout) {
 }
 var EvalSkillCommand = class extends M8tCommand {
   static paths = [["eval", "skill"]];
-  static usage = Command37.Usage({
+  static usage = Command38.Usage({
     description: "Vet one inbox skill candidate (Brain Faculties Eval F1): promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
   });
-  candidate = Option34.String();
-  skillsDir = Option34.String("--skills-dir");
-  noJudge = Option34.Boolean("--no-judge", false);
-  deployment = Option34.String("--deployment");
-  output = Option34.String("--output");
+  candidate = Option35.String();
+  skillsDir = Option35.String("--skills-dir");
+  noJudge = Option35.Boolean("--no-judge", false);
+  deployment = Option35.String("--deployment");
+  output = Option35.String("--output");
   executeCommand() {
     return Promise.resolve(this._runCommand());
   }
@@ -21127,9 +21299,9 @@ var EvalSkillCommand = class extends M8tCommand {
 
 // src/commands/eval/exam.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync17, existsSync as existsSync15, readdirSync as readdirSync2 } from "fs";
+import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync18, existsSync as existsSync15, readdirSync as readdirSync2 } from "fs";
 import { join as join27 } from "path";
-import { Command as Command38, Option as Option35 } from "clipanion";
+import { Command as Command39, Option as Option36 } from "clipanion";
 init_errors();
 init_esm();
 function parseArmToken(tok, opts) {
@@ -21332,7 +21504,7 @@ function readSealedTaskIds(taskSetVersion, refereeHomeOut, env = process.env) {
   const manifestPath = join27(home, "tasksets", worker, versionDir, "manifest.yaml");
   let text;
   try {
-    text = readFileSync17(manifestPath, "utf-8");
+    text = readFileSync18(manifestPath, "utf-8");
   } catch (e) {
     throw new LocalCliError({
       code: "EXAM_REDACTION_UNSAFE",
@@ -21359,24 +21531,24 @@ function buildPlan(args) {
 }
 var EvalExamCommand = class extends M8tCommand {
   static paths = [["eval", "exam"]];
-  static usage = Command38.Usage({
+  static usage = Command39.Usage({
     description: "Run a brain exam (Brain Referee E2-F2): impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
   });
-  worker = Option35.String();
-  arms = Option35.String("--arms");
-  taskSet = Option35.String("--task-set");
-  examType = Option35.String("--exam-type");
-  skill = Option35.String("--skill");
-  reps = Option35.String("-n,--reps");
-  probes = Option35.String("--probes");
-  pool = Option35.String("--pool");
-  out = Option35.String("--out");
-  dryRun = Option35.Boolean("--dry-run", false);
-  keepArms = Option35.Boolean("--keep-arms", false);
-  allowStub = Option35.Boolean("--allow-stub", false);
-  deployment = Option35.String("--deployment");
-  output = Option35.String("--output");
-  observeWaitS = Option35.String("--observe-wait-s");
+  worker = Option36.String();
+  arms = Option36.String("--arms");
+  taskSet = Option36.String("--task-set");
+  examType = Option36.String("--exam-type");
+  skill = Option36.String("--skill");
+  reps = Option36.String("-n,--reps");
+  probes = Option36.String("--probes");
+  pool = Option36.String("--pool");
+  out = Option36.String("--out");
+  dryRun = Option36.Boolean("--dry-run", false);
+  keepArms = Option36.Boolean("--keep-arms", false);
+  allowStub = Option36.Boolean("--allow-stub", false);
+  deployment = Option36.String("--deployment");
+  output = Option36.String("--output");
+  observeWaitS = Option36.String("--observe-wait-s");
   async executeCommand() {
     await Promise.resolve();
     const worker = typeof this.worker === "string" ? this.worker : void 0;
@@ -21491,10 +21663,10 @@ var EvalExamCommand = class extends M8tCommand {
 };
 
 // src/commands/version.ts
-import { Command as Command39, Option as Option36 } from "clipanion";
+import { Command as Command40, Option as Option37 } from "clipanion";
 var VersionCommand = class extends M8tCommand {
   static paths = [["version"], ["--version"], ["-v"]];
-  static usage = Command39.Usage({
+  static usage = Command40.Usage({
     description: "Print the CLI version.",
     details: "Prints the m8t CLI version. With --verbose, also prints Node version and platform.",
     examples: [
@@ -21502,8 +21674,8 @@ var VersionCommand = class extends M8tCommand {
       ["Print as JSON", "$0 version --output json"]
     ]
   });
-  output = Option36.String("--output", { description: "pretty | json | auto (default)" });
-  verbose = Option36.Boolean("--verbose", false);
+  output = Option37.String("--output", { description: "pretty | json | auto (default)" });
+  verbose = Option37.Boolean("--verbose", false);
   executeCommand() {
     const mode = resolveOutputMode(
       this.output ?? "auto",
@@ -21534,18 +21706,18 @@ var VersionCommand = class extends M8tCommand {
 };
 
 // src/commands/whoami.ts
-import { Command as Command40, Option as Option37 } from "clipanion";
+import { Command as Command41, Option as Option38 } from "clipanion";
 var WhoamiCommand = class extends M8tCommand {
   static paths = [["whoami"]];
-  static usage = Command40.Usage({
+  static usage = Command41.Usage({
     description: "Show your identity + the gateway you'll talk to. Probes the backend."
   });
-  output = Option37.String("--output");
-  verbose = Option37.Boolean("--verbose", false);
-  subscription = Option37.String("--subscription", {
+  output = Option38.String("--output");
+  verbose = Option38.Boolean("--verbose", false);
+  subscription = Option38.String("--subscription", {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
-  resourceGroup = Option37.String("--resource-group", {
+  resourceGroup = Option38.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -21610,7 +21782,7 @@ var WhoamiCommand = class extends M8tCommand {
 };
 
 // src/commands/status.ts
-import { Command as Command41, Option as Option38 } from "clipanion";
+import { Command as Command42, Option as Option39 } from "clipanion";
 
 // src/lib/azd.ts
 init_errors();
@@ -21675,10 +21847,10 @@ async function resolveLocalContext() {
 // src/commands/status.ts
 var StatusCommand = class extends M8tCommand {
   static paths = [["status"]];
-  static usage = Command41.Usage({
+  static usage = Command42.Usage({
     description: "Show the local m8t context: identity, config.yaml, gateway cache, azd mode."
   });
-  output = Option38.String("--output");
+  output = Option39.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -21716,8 +21888,8 @@ var StatusCommand = class extends M8tCommand {
 };
 
 // src/commands/doctor.ts
-import { Command as Command42, Option as Option39 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential19 } from "@azure/identity";
+import { Command as Command43, Option as Option40 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential20 } from "@azure/identity";
 import * as fs26 from "fs";
 import * as os11 from "os";
 import * as path28 from "path";
@@ -21992,12 +22164,12 @@ function probeLegacyStateDir() {
 }
 var DoctorCommand = class extends M8tCommand {
   static paths = [["doctor"]];
-  static usage = Command42.Usage({
+  static usage = Command43.Usage({
     description: "Diagnose the local m8t setup: az login, config.yaml, gateway, Foundry data-plane."
   });
-  output = Option39.String("--output");
-  agent = Option39.String("--agent");
-  resourceGroup = Option39.String("--resource-group", {
+  output = Option40.String("--output");
+  agent = Option40.String("--agent");
+  resourceGroup = Option40.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -22071,7 +22243,7 @@ var DoctorCommand = class extends M8tCommand {
       if (typeof this.agent === "string" && this.agent) {
         checking(`delivery grant for ${this.agent}`);
         try {
-          const credential2 = new DefaultAzureCredential19();
+          const credential2 = new DefaultAzureCredential20();
           const cur = await getAgentVersion({
             credential: credential2,
             projectEndpoint: foundry.projectEndpoint,
@@ -22114,7 +22286,7 @@ var DoctorCommand = class extends M8tCommand {
 };
 
 // src/commands/switch.ts
-import { Command as Command43, Option as Option40 } from "clipanion";
+import { Command as Command44, Option as Option41 } from "clipanion";
 
 // src/lib/profiles.ts
 import * as fs27 from "fs/promises";
@@ -22254,14 +22426,14 @@ async function profileSwitch(name, asName) {
 init_errors();
 var SwitchCommand = class extends M8tCommand {
   static paths = [["switch"]];
-  static usage = Command43.Usage({
+  static usage = Command44.Usage({
     description: "Re-point local config at another deployment: --subscription <id|name> (discovery) or <profile>."
   });
-  profile = Option40.String({ required: false });
-  subscription = Option40.String("--subscription");
-  list = Option40.Boolean("--list", false);
-  as = Option40.String("--as");
-  output = Option40.String("--output");
+  profile = Option41.String({ required: false });
+  subscription = Option41.String("--subscription");
+  list = Option41.Boolean("--list", false);
+  as = Option41.String("--as");
+  output = Option41.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -22318,7 +22490,7 @@ var SwitchCommand = class extends M8tCommand {
 
 // src/commands/open.ts
 import { spawn as spawn5 } from "child_process";
-import { Command as Command44, Option as Option41 } from "clipanion";
+import { Command as Command45, Option as Option42 } from "clipanion";
 
 // src/lib/open-targets.ts
 init_errors();
@@ -22364,14 +22536,14 @@ function openUrl(url) {
 }
 var OpenCommand = class extends M8tCommand {
   static paths = [["open"]];
-  static usage = Command44.Usage({
+  static usage = Command45.Usage({
     description: "Open the deployed webapp (default), the Foundry portal, or the resource group.",
     details: "Targets: webapp (deployed app, default) | foundry (ai.azure.com) | portal (resource group in the Azure portal). Pass --print to emit the URL instead of launching a browser (also the default when stdout isn't a TTY)."
   });
-  target = Option41.String({ required: false });
-  print = Option41.Boolean("--print", false);
-  output = Option41.String("--output");
-  resourceGroup = Option41.String("--resource-group", {
+  target = Option42.String({ required: false });
+  print = Option42.Boolean("--print", false);
+  output = Option42.String("--output");
+  resourceGroup = Option42.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -22415,7 +22587,7 @@ var OpenCommand = class extends M8tCommand {
 };
 
 // src/commands/dream/run.ts
-import { Command as Command45, Option as Option42 } from "clipanion";
+import { Command as Command46, Option as Option43 } from "clipanion";
 import { AzureCliCredential } from "@azure/identity";
 import { TableClient as TableClient5 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient3 } from "@azure/ai-projects";
@@ -22760,7 +22932,7 @@ var TableCursor = class {
    * Point-read the canonical worker's cursor row. Catches BOTH the
    * missing-table (TableNotFound) and missing-row (ResourceNotFound) 404s and
    * returns an absent (from-the-beginning) cursor WITHOUT creating the table or
-   * writing anything (DESIGN §3 — "createTable is bound only to advance()").
+   * writing anything.
    * Any other error (e.g. 403 RBAC) propagates raw.
    */
   async read(worker) {
@@ -22786,9 +22958,9 @@ var TableCursor = class {
   }
   /**
    * Persist the cursor for the canonical worker. This is the ONLY place that
-   * creates the BrainDreamCursor table (DESIGN §3 — read() never does DDL); a
-   * TableAlreadyExists race is benign. The non-dry F3 path calls this; F2 ships
-   * it wired + unit-tested. The per-PK watermark map is serialized to JSON
+   * creates the BrainDreamCursor table; a
+   * TableAlreadyExists race is benign. The non-dry path calls this, already
+   * wired and unit-tested. The per-PK watermark map is serialized to JSON
    * (Table cells are scalar — same rationale as agent-ledger's `artifacts`).
    */
   async advance(worker, cursor) {
@@ -22921,6 +23093,35 @@ function makeLedgerSource(read) {
 // ../../packages/brain/engine/dist/esm/conversation-source.js
 var TRANSIENT = 500;
 var MAX_ATTEMPTS = 5;
+var VOICE_PREFIX = "[[m8t:voice-transcript]] ";
+var MAX_VOICE_HEADER_BYTES = 4096;
+function isVoiceEnvelope(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const item = value;
+  return item.v === 1 && typeof item.callId === "string" && item.callId.length > 0 && typeof item.startedAt === "string" && item.startedAt.length > 0 && typeof item.endedAt === "string" && item.endedAt.length > 0 && typeof item.turnAt === "string" && item.turnAt.length > 0;
+}
+function stripVoiceEnvelope(value) {
+  if (!value.startsWith(VOICE_PREFIX))
+    return value;
+  const newline = value.indexOf("\n");
+  if (newline < VOICE_PREFIX.length)
+    return value;
+  const header = value.slice(VOICE_PREFIX.length, newline);
+  if (new TextEncoder().encode(header).byteLength > MAX_VOICE_HEADER_BYTES || header.length % 4 === 1 || !/^[A-Za-z0-9_-]+$/.test(header))
+    return value;
+  try {
+    const padded = header.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - header.length % 4) % 4);
+    const bytes = Uint8Array.from(Buffer.from(padded, "base64"));
+    if (Buffer.from(bytes).toString("base64url") !== header)
+      return value;
+    const json = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    const parsed = JSON.parse(json);
+    return isVoiceEnvelope(parsed) ? value.slice(newline + 1) : value;
+  } catch {
+    return value;
+  }
+}
 function statusOf(e) {
   const err = e;
   return err?.statusCode ?? err?.status;
@@ -22936,7 +23137,7 @@ function mapItems(raw) {
       continue;
     if (item.role !== "user" && item.role !== "assistant")
       continue;
-    const text = Array.isArray(item.content) ? item.content.map((c) => typeof c.text === "string" ? c.text : "").filter(Boolean).join("\n\n") : "";
+    const text = Array.isArray(item.content) ? stripVoiceEnvelope(item.content.map((c) => typeof c.text === "string" && c.text.length > 0 ? c.text : typeof c.transcript === "string" && c.transcript.length > 0 ? c.transcript : "").filter(Boolean).join("\n\n")) : "";
     const at = typeof item.created_at === "number" ? new Date(item.created_at * 1e3).toISOString() : void 0;
     acc.push(at ? { role: item.role, text, at } : { role: item.role, text });
   }
@@ -22970,7 +23171,7 @@ function makeConversationSource(client, opts = {}) {
       throw new ConvFetchError("terminal", `exhausted retries reading ${conversationId}`);
     },
     /**
-     * The a2a recovery gate's data source (DESIGN §2.3, Option A). Reads the
+     * The a2a recovery gate's data source (Option A). Reads the
      * conversation's own `metadata.app` so the recovery path can HARD-gate on the
      * real app tag rather than emit-time ledger tagging. Degrades to null on any
      * error → the caller treats an un-provable a2a conv as ungated (skipped).
@@ -23254,7 +23455,7 @@ async function runPipeline(args) {
     consumed,
     recovered,
     skipped,
-    // Wall-clock elapsed around the awaited live I/O (FIX 4) — measured from the
+    // Wall-clock elapsed around the awaited live I/O — measured from the
     // real/injected monotonic clock, NOT the pure `now` (which never moves within a run).
     latencyMs: Math.round(monotonicNow() - t0)
   };
@@ -23375,11 +23576,11 @@ var WRITER_ALLOWED_PREFIX = /^(memory|inbox|quarantine|artifacts)\//;
 var isAllowedWritePath = (path37, allowedPrefix) => allowedPrefix.test(path37) && !path37.split("/").includes("..");
 var unquote = (s) => s.trim().replace(/^["']|["']$/g, "");
 function parseFrontmatter(content) {
-  const m = /^---\n([\s\S]*?)\n---/.exec(content);
+  const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content);
   if (!m)
     return {};
   const fm = {};
-  const lines = m[1].split("\n");
+  const lines = m[1].split(/\r?\n/);
   let pendingKey = null;
   for (const line2 of lines) {
     const item = /^\s+-\s+(.*)$/.exec(line2);
@@ -24057,7 +24258,7 @@ function frontmatter(fields) {
   return lines.join("\n");
 }
 function injectFrontmatter(body, fields) {
-  const m = /^---\n([\s\S]*?)\n---\n?/.exec(body);
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(body);
   const inject = Object.entries(fields).map(([k, v]) => Array.isArray(v) ? `${k}:
 ${v.map((i) => `  - ${i}`).join("\n")}` : `${k}: ${v}`).join("\n");
   if (!m)
@@ -24066,11 +24267,11 @@ ${inject}
 ---
 ${body}`;
   const block = m[1].replace(/\s*$/, "");
-  return body.replace(m[0], `---
+  return `---
 ${block}
 ${inject}
 ---
-`);
+` + body.slice(m[0].length);
 }
 var indexLine = (path37, title, date, tags) => `- \`${path37}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
 function splitIndex(index) {
@@ -24230,7 +24431,7 @@ function defaultDreamSeams(opts = {}) {
       const user = buildUserPrompt(input, mem.files);
       const res = await propose(deps.model, system, user, {
         ...opts.sleep ? { sleep: opts.sleep } : {},
-        // The configured model NAME for the cost digest (DESIGN §4.1/§9). Without
+        // The configured model NAME for the cost digest. Without
         // this, propose falls back to its default and every cost line mis-reports
         // the model an operator actually configured (e.g. gpt-5-mini → "gpt-5.4").
         ...deps.modelName ? { model: deps.modelName } : {}
@@ -24613,20 +24814,20 @@ function redactTranscripts(input) {
 }
 var DreamRunCommand = class extends M8tCommand {
   static paths = [["dream", "run"]];
-  static usage = Command45.Usage({
+  static usage = Command46.Usage({
     description: "Dry-run the brain consumption pipeline for one worker (no model call, no writes).",
     details: "Builds AzureCliCredential + resolves the Foundry project, ledger table, and Log Analytics workspace, runs the consumption pipeline, and prints the skip-ledger, the partition invariant, and harvest stats. Transcripts are metadata-only unless --show-transcripts is passed."
   });
-  worker = Option42.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
-  dryRun = Option42.Boolean("--dry-run", false, { description: "Read-only harvest; no model call, no writes." });
-  since = Option42.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
-  reset = Option42.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
-  showTranscripts = Option42.Boolean("--show-transcripts", false, {
+  worker = Option43.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
+  dryRun = Option43.Boolean("--dry-run", false, { description: "Read-only harvest; no model call, no writes." });
+  since = Option43.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
+  reset = Option43.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
+  showTranscripts = Option43.Boolean("--show-transcripts", false, {
     description: "Print transcript bodies (default: metadata only)."
   });
-  subscription = Option42.String("--subscription");
-  endpoint = Option42.String("--endpoint");
-  output = Option42.String("--output");
+  subscription = Option43.String("--subscription");
+  endpoint = Option43.String("--endpoint");
+  output = Option43.String("--output");
   // Resolution seam — overridden by tests; built lazily at runtime otherwise.
   deps;
   async executeCommand() {
@@ -24882,7 +25083,7 @@ async function buildWriteDeps(context, credential2, cursor) {
   return {
     model: makeFoundryModelClient(openai, model),
     modelName: model,
-    // surface the resolved name for the cost digest (DESIGN §4.1/§9)
+    // surface the resolved name for the cost digest
     brain,
     cursor,
     clock: () => /* @__PURE__ */ new Date(),
@@ -24974,7 +25175,7 @@ function defaultDeps(overrides) {
 }
 
 // src/commands/foundry/create.ts
-import { Command as Command46, Option as Option43 } from "clipanion";
+import { Command as Command47, Option as Option44 } from "clipanion";
 
 // src/lib/foundry-create.ts
 init_errors();
@@ -25212,7 +25413,7 @@ async function createFoundryProject(args) {
 init_errors();
 var FoundryCreateCommand = class extends M8tCommand {
   static paths = [["foundry", "create"]];
-  static usage = Command46.Usage({
+  static usage = Command47.Usage({
     description: "Create an AI Foundry (AIServices) account + project + model deployment from scratch.",
     details: "Non-interactive and idempotent. Creates the AIServices account (custom subdomain + project management), a project, and a model deployment (default gpt-4.1-mini @ capacity 50). Region must be hosted-agent-eligible. Emits the project endpoint as structured output. Re-run is a clean no-op (account/project skipped if present; deployment capacity converges UP, never down).",
     examples: [
@@ -25221,16 +25422,16 @@ var FoundryCreateCommand = class extends M8tCommand {
       ["Higher capacity for a reasoning model", "$0 foundry create --resource-group rg-m8t-stack --location eastus2 --model gpt-5-mini --capacity 250"]
     ]
   });
-  resourceGroup = Option43.String("--resource-group");
-  location = Option43.String("--location");
-  account = Option43.String("--account");
-  project = Option43.String("--project", "m8t");
-  model = Option43.String("--model", "gpt-4.1-mini");
-  modelVersion = Option43.String("--model-version", "2025-04-14");
-  capacity = Option43.String("--capacity", "50");
-  subscription = Option43.String("--subscription");
-  skipQuotaCheck = Option43.Boolean("--skip-quota-check", false);
-  output = Option43.String("--output");
+  resourceGroup = Option44.String("--resource-group");
+  location = Option44.String("--location");
+  account = Option44.String("--account");
+  project = Option44.String("--project", "m8t");
+  model = Option44.String("--model", "gpt-4.1-mini");
+  modelVersion = Option44.String("--model-version", "2025-04-14");
+  capacity = Option44.String("--capacity", "50");
+  subscription = Option44.String("--subscription");
+  skipQuotaCheck = Option44.Boolean("--skip-quota-check", false);
+  output = Option44.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -25302,22 +25503,22 @@ var FoundryCreateCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/await-ready.ts
-import { Command as Command47, Option as Option44 } from "clipanion";
+import { Command as Command48, Option as Option45 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential2 } from "@azure/identity";
 init_errors();
 var FoundryAwaitReadyCommand = class extends M8tCommand {
   static paths = [["foundry", "await-ready"]];
-  static usage = Command47.Usage({
+  static usage = Command48.Usage({
     description: "Wait until a freshly-created Foundry project's data plane reliably serves it.",
     details: "Probes the project (GET /agents) until it returns 200 on a few consecutive tries, or fails clearly after a bounded budget. A newly-created account can serve intermittent 404 'Project not found' for minutes; run this after 'foundry create' and before deploying agents so the worker phase doesn't catch the unstable window.",
     examples: [["Wait for a project to be ready", "$0 foundry await-ready --endpoint https://acc.services.ai.azure.com/api/projects/m8t"]]
   });
-  endpoint = Option44.String("--endpoint");
-  consecutive = Option44.String("--consecutive", "3");
-  attempts = Option44.String("--attempts", "60");
-  interval = Option44.String("--interval", "5");
-  subscription = Option44.String("--subscription");
-  output = Option44.String("--output");
+  endpoint = Option45.String("--endpoint");
+  consecutive = Option45.String("--consecutive", "3");
+  attempts = Option45.String("--attempts", "60");
+  interval = Option45.String("--interval", "5");
+  subscription = Option45.String("--subscription");
+  output = Option45.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const endpoint = typeof this.endpoint === "string" ? this.endpoint : void 0;
@@ -25351,7 +25552,7 @@ var FoundryAwaitReadyCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/preflight.ts
-import { Command as Command48, Option as Option45 } from "clipanion";
+import { Command as Command49, Option as Option46 } from "clipanion";
 
 // ../../packages/telemetry-contract/artifact/tier-map.ts
 var EVENT_TIERS = {
@@ -25451,7 +25652,7 @@ function buildPreflightBanner(who) {
 // src/commands/bootstrap/preflight.ts
 var BootstrapPreflightCommand = class extends M8tCommand {
   static paths = [["bootstrap", "preflight"]];
-  static usage = Command48.Usage({
+  static usage = Command49.Usage({
     description: "Loudly verify you can install m8t (Owner/UAA + directory admin) and hard-stop if not.",
     details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), and registers Microsoft.ContainerInstance. Exits non-zero with the exact failing check + remedy.",
     examples: [
@@ -25459,8 +25660,8 @@ var BootstrapPreflightCommand = class extends M8tCommand {
       ["BYO app registration (directory guests)", "$0 bootstrap preflight --client-id <appId>"]
     ]
   });
-  clientId = Option45.String("--client-id");
-  subscription = Option45.String("--subscription");
+  clientId = Option46.String("--client-id");
+  subscription = Option46.String("--subscription");
   async executeCommand() {
     const clientId = typeof this.clientId === "string" ? this.clientId : void 0;
     const account = await getAzAccount();
@@ -25522,7 +25723,7 @@ ${colors.error("  " + why)}
 import * as fs30 from "fs";
 import * as os14 from "os";
 import * as path32 from "path";
-import { Command as Command49, Option as Option46 } from "clipanion";
+import { Command as Command50, Option as Option47 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-mi.ts
@@ -25772,12 +25973,12 @@ async function writeBootstrapState(state, home = os13.homedir()) {
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.34";
+var DEFAULT_INSTALLER_TAG = "v0.1.36";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
   static paths = [["bootstrap", "launch"]];
-  static usage = Command49.Usage({
+  static usage = Command50.Usage({
     description: "Create + authorize the installer managed identity, then kick the cloud installer.",
     details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t/bootstrap.json for `status`/`reap`/`finish`.",
     examples: [
@@ -25787,17 +25988,17 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.33"]
     ]
   });
-  location = Option46.String("--location");
-  resourceGroup = Option46.String("--resource-group");
-  clientId = Option46.String("--client-id");
-  subscription = Option46.String("--subscription");
-  installerTag = Option46.String("--installer-tag");
+  location = Option47.String("--location");
+  resourceGroup = Option47.String("--resource-group");
+  clientId = Option47.String("--client-id");
+  subscription = Option47.String("--subscription");
+  installerTag = Option47.String("--installer-tag");
   // Full image ref override (registry + repo + tag) — an escape hatch when the
   // default org/tag is wrong for the current CLI (e.g. a stale published build).
   // Wins over --installer-tag / the pinned default.
-  installerImage = Option46.String("--installer-image");
-  gatewayImageRef = Option46.String("--gateway-image-ref");
-  githubAppCreds = Option46.String("--github-app-creds");
+  installerImage = Option47.String("--installer-image");
+  gatewayImageRef = Option47.String("--gateway-image-ref");
+  githubAppCreds = Option47.String("--github-app-creds");
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -25901,7 +26102,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/status.ts
-import { Command as Command50, Option as Option47 } from "clipanion";
+import { Command as Command51, Option as Option48 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-aci-state.ts
@@ -25929,13 +26130,13 @@ async function getAciState(opts) {
 // src/commands/bootstrap/status.ts
 var BootstrapStatusCommand = class extends M8tCommand {
   static paths = [["bootstrap", "status"]];
-  static usage = Command50.Usage({
+  static usage = Command51.Usage({
     description: "Show the cloud installer's live status (phase, progress, result).",
     details: "Reads the durable status blob written by the installer. --watch polls until the install reaches done or failed.",
     examples: [["One read", "$0 bootstrap status"], ["Watch to completion", "$0 bootstrap status --watch"]]
   });
-  watch = Option47.Boolean("--watch", false);
-  output = Option47.String("--output");
+  watch = Option48.Boolean("--watch", false);
+  output = Option48.String("--output");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -26006,7 +26207,7 @@ function formatStatus(d) {
 }
 
 // src/commands/bootstrap/reap.ts
-import { Command as Command51, Option as Option48 } from "clipanion";
+import { Command as Command52, Option as Option49 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-reap.ts
@@ -26100,14 +26301,14 @@ async function reapInstaller(opts) {
 // src/commands/bootstrap/reap.ts
 var BootstrapReapCommand = class extends M8tCommand {
   static paths = [["bootstrap", "reap"]];
-  static usage = Command51.Usage({
+  static usage = Command52.Usage({
     description: "Tear down the installer scaffolding (ACI \u2192 MI \u2192 its role assignments) after a successful install.",
     details: "Runs locally on the 'done' signal (the installer can't delete its own identity). The platform RG and the gateway's own assignments persist. A failed install is left intact for diagnosis unless --force.",
     examples: [["Reap after done", "$0 bootstrap reap"]]
   });
-  force = Option48.Boolean("--force", false);
-  sweepOrphans = Option48.Boolean("--sweep-orphans", false);
-  yes = Option48.Boolean("--yes", false);
+  force = Option49.Boolean("--force", false);
+  sweepOrphans = Option49.Boolean("--sweep-orphans", false);
+  yes = Option49.Boolean("--yes", false);
   async executeCommand() {
     if (this.sweepOrphans === true) {
       const { subscriptionId: sub } = await getAzAccount();
@@ -26204,12 +26405,12 @@ Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors
 import * as fs31 from "fs/promises";
 import * as os16 from "os";
 import * as path34 from "path";
-import { Command as Command52, Option as Option49 } from "clipanion";
+import { Command as Command53, Option as Option50 } from "clipanion";
 init_errors();
 
 // src/lib/company-profile-seed.ts
 import { spawn as spawn6 } from "child_process";
-import { closeSync, openSync, readFileSync as readFileSync20 } from "fs";
+import { closeSync, openSync, readFileSync as readFileSync21 } from "fs";
 import * as os15 from "os";
 import * as path33 from "path";
 init_errors();
@@ -26394,7 +26595,7 @@ function composeFounderIdentityNote(id) {
 function readGithubAppCreds(credsPath) {
   const p = credsPath ?? path33.join(os15.homedir(), ".m8t", "github-app.json");
   try {
-    return JSON.parse(readFileSync20(p, "utf8"));
+    return JSON.parse(readFileSync21(p, "utf8"));
   } catch {
     return null;
   }
@@ -26422,7 +26623,7 @@ async function resolveSeedContext(opts) {
 async function applyProfileToBrain(args) {
   const token = await mintInstallationTokenFromPem({
     appId: args.appCreds.appId,
-    privateKeyPem: readFileSync20(args.appCreds.pemPath, "utf8"),
+    privateKeyPem: readFileSync21(args.appCreds.pemPath, "utf8"),
     installationId: args.appCreds.installationId,
     fetchImpl: args.fetchImpl
   });
@@ -26534,14 +26735,14 @@ function renderInstallSummary(args) {
 // src/commands/bootstrap/finish.ts
 var BootstrapFinishCommand = class extends M8tCommand {
   static paths = [["bootstrap", "finish"]];
-  static usage = Command52.Usage({
+  static usage = Command53.Usage({
     description: "Point your local tools at the now-live platform (repo-root marker, discovery cache, next steps).",
     details: "Final step of `m8t bootstrap` (after the install reaches done). Writes ~/.m8t/repo-root, points your local tools at the live gateway, and \u2014 if you completed the onboarding questionnaire \u2014 seeds your brain-backed advisor's brain with your company profile (best-effort; never blocks finish). Run `m8t bootstrap seed-profile` to seed manually later.",
     examples: [["Finish local", "$0 bootstrap finish --repo-root /path/to/m8t"]]
   });
-  repoRoot = Option49.String("--repo-root");
-  subscription = Option49.String("--subscription");
-  resourceGroup = Option49.String("--resource-group");
+  repoRoot = Option50.String("--repo-root");
+  subscription = Option50.String("--subscription");
+  resourceGroup = Option50.String("--resource-group");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -26644,8 +26845,8 @@ ${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP se
 import * as fs33 from "fs";
 import * as os18 from "os";
 import * as path36 from "path";
-import { Command as Command53, Option as Option50 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential20 } from "@azure/identity";
+import { Command as Command54, Option as Option51 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential21 } from "@azure/identity";
 init_errors();
 
 // src/lib/bootstrap-ui.ts
@@ -27039,7 +27240,7 @@ function renderDeployFailure(error) {
 }
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
-  static usage = Command53.Usage({
+  static usage = Command54.Usage({
     description: "Deploy Simple Stacey + start the local onboarding chat UI in the background (returns immediately).",
     details: [
       "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Waits for the cloud",
@@ -27057,15 +27258,15 @@ var BootstrapUiCommand = class extends M8tCommand {
       ["Foreground (blocking, old behaviour)", "$0 bootstrap ui --repo-root /path/to/m8t --foreground"]
     ]
   });
-  repoRoot = Option50.String("--repo-root");
-  port = Option50.String("--port", "3000");
-  endpoint = Option50.String("--endpoint", {
+  repoRoot = Option51.String("--repo-root");
+  port = Option51.String("--port", "3000");
+  endpoint = Option51.String("--endpoint", {
     description: "Foundry project endpoint to target \u2014 disambiguates when the subscription has multiple projects."
   });
-  prepOnly = Option50.Boolean("--prep-only", false);
-  skipInstall = Option50.Boolean("--skip-install", false);
-  stop = Option50.Boolean("--stop", false);
-  foreground = Option50.Boolean("--foreground", false);
+  prepOnly = Option51.Boolean("--prep-only", false);
+  skipInstall = Option51.Boolean("--skip-install", false);
+  stop = Option51.Boolean("--stop", false);
+  foreground = Option51.Boolean("--foreground", false);
   async executeCommand() {
     if (this.stop === true) {
       const stopped = stopOnboardingUi();
@@ -27101,7 +27302,7 @@ var BootstrapUiCommand = class extends M8tCommand {
     if (fs33.existsSync(path36.join(os18.homedir(), ".m8t", "config.yaml"))) {
       out(colors.error("\u26A0 an existing ~/.m8t/config.yaml will override the onboarding app registration in apps/web \u2014 if Microsoft sign-in fails, move it aside and retry."));
     }
-    const credential2 = new DefaultAzureCredential20();
+    const credential2 = new DefaultAzureCredential21();
     const account = await getAzAccount();
     assertNodeVersion();
     out("waiting for Foundry (the installer's foundry-create phase)\u2026");
@@ -27199,10 +27400,10 @@ var BootstrapUiCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command54, Option as Option51 } from "clipanion";
+import { Command as Command55, Option as Option52 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command54.Usage({
+  static usage = Command55.Usage({
     description: "Seed your advisors' brains with the founder + company profile from the onboarding questionnaire.",
     details: "Reads the latest stacey-intake conversation, renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines), and commits them to both <org>/stacey-brain and <org>/azzy-brain via the GitHub App. Idempotent. --watch polls until the founder completes the questionnaire.",
     examples: [
@@ -27210,11 +27411,11 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       ["Wait for the founder to finish", "$0 bootstrap seed-profile --watch"]
     ]
   });
-  endpoint = Option51.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option51.String("--brain", { description: "Override the brain repo (default <org>/stacey-brain)." });
-  watch = Option51.Boolean("--watch", false, { description: "Poll until the questionnaire completes (or --timeout)." });
-  timeout = Option51.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option51.String("--github-app-creds");
+  endpoint = Option52.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option52.String("--brain", { description: "Override the brain repo (default <org>/stacey-brain)." });
+  watch = Option52.Boolean("--watch", false, { description: "Poll until the questionnaire completes (or --timeout)." });
+  timeout = Option52.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option52.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -27260,7 +27461,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 };
 
 // src/commands/telemetry/enroll.ts
-import { Command as Command55, Option as Option52 } from "clipanion";
+import { Command as Command56, Option as Option53 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
@@ -27318,16 +27519,16 @@ async function resolveKeyVaultName(containerAppResourceId) {
 }
 var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
-  static usage = Command55.Usage({
+  static usage = Command56.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
     details: "Mints an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Idempotent: refuses if a key already exists unless --force.",
     examples: [["Enroll", "$0 telemetry enroll"]]
   });
-  company = Option52.String("--company", { description: "Your company name (optional)." });
-  contactEmail = Option52.String("--contact-email", { description: "Contact email (default: your signed-in az UPN)." });
-  subscription = Option52.String("--subscription", { description: "Azure subscription id (default: your active az subscription)." });
-  resourceGroup = Option52.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option52.Boolean("--force", false, { description: "Re-enroll even if a key is already stored (mints a new instance id)." });
+  company = Option53.String("--company", { description: "Your company name (optional)." });
+  contactEmail = Option53.String("--contact-email", { description: "Contact email (default: your signed-in az UPN)." });
+  subscription = Option53.String("--subscription", { description: "Azure subscription id (default: your active az subscription)." });
+  resourceGroup = Option53.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option53.Boolean("--force", false, { description: "Re-enroll even if a key is already stored (mints a new instance id)." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -27406,6 +27607,7 @@ cli.register(AzureExecDeployCommand);
 cli.register(PlatformStatusCommand);
 cli.register(PlatformUpdateCommand);
 cli.register(PlatformConvergeCommand);
+cli.register(PlatformSeedStampCommand);
 cli.register(PlatformEnableCostReportCommand);
 cli.register(PlatformEnableAutoUpdateCommand);
 cli.register(DeployCommand);