@m8t-stack/cli 0.2.46 → 0.2.48

package/dist/cli.js

@@ -1329,7 +1329,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.46";
+var CLI_VERSION = "0.2.48";
 
 // src/lib/render-error.ts
 init_errors();
@@ -16225,19 +16225,135 @@ var BrainListCommand = class extends M8tCommand {
   }
 };
 
-// src/commands/brain/show.ts
+// src/commands/brain/orgs.ts
 import { Command as Command21, Option as Option20 } from "clipanion";
+
+// src/lib/github-orgs.ts
+var ORG_QUERY = "{ viewer { organizations(first:50) { nodes { login viewerCanAdminister enterpriseOwners(first:1) { totalCount } } } } }";
+function classifyOrgs(result) {
+  if (!result.ok) return { verdict: "undetermined", candidates: [], orgs: [] };
+  const orgs = result.orgs;
+  if (orgs.length === 0) return { verdict: "no-orgs", candidates: [], orgs };
+  const enterprise = orgs.filter((o) => o.enterprise);
+  if (enterprise.length === 1) {
+    return { verdict: "enterprise-single", selected: enterprise[0].login, candidates: enterprise, orgs };
+  }
+  if (enterprise.length > 1) {
+    return { verdict: "enterprise-multiple", candidates: enterprise, orgs };
+  }
+  return { verdict: "no-enterprise", candidates: orgs, orgs };
+}
+async function fetchOrgGraph(exec = defaultGhExec) {
+  const r = await exec("gh", ["api", "graphql", "-f", `query=${ORG_QUERY}`]);
+  if (r.exitCode !== 0) {
+    return { ok: false, reason: r.stderr.trim() || `gh exited ${r.exitCode.toString()}` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(r.stdout);
+  } catch {
+    return { ok: false, reason: "gh returned output that is not JSON" };
+  }
+  if (Array.isArray(parsed.errors) && parsed.errors.length > 0) {
+    return { ok: false, reason: "the org query returned a partial result" };
+  }
+  const nodes = parsed.data?.viewer?.organizations?.nodes;
+  if (!Array.isArray(nodes)) return { ok: false, reason: "unexpected response shape" };
+  const orgs = [];
+  for (const raw of nodes) {
+    if (raw === null) return { ok: false, reason: "unexpected response shape" };
+    const login = raw.login;
+    const total = raw.enterpriseOwners?.totalCount;
+    if (typeof login !== "string" || typeof total !== "number") {
+      return { ok: false, reason: "unexpected response shape" };
+    }
+    orgs.push({ login, enterprise: total > 0, canAdminister: raw.viewerCanAdminister === true });
+  }
+  return { ok: true, orgs };
+}
+
+// src/lib/github-orgs-copy.ts
+function enterpriseSingleNotice(org) {
+  return `Using your GitHub Enterprise org ${org} for your workers' brains.`;
+}
+function enterpriseMultiplePrompt(logins) {
+  return `You belong to more than one GitHub Enterprise org: ${logins.join(", ")}. Which one should your workers' brains live in?`;
+}
+function noEnterpriseNotice(selectedOrg) {
+  return `No GitHub Enterprise org detected; if you have the Microsoft for Startups benefit, your workers' brains can live there - continuing with ${selectedOrg} for now.`;
+}
+function undeterminedNotice() {
+  return `Could not check your GitHub orgs automatically - listing them instead.`;
+}
+function noOrgsRefusal() {
+  return `Your workers' brains are created by a GitHub App, which can only make repositories in an organization, and this account belongs to none. Creating a free GitHub organization and then running \`m8t brain app-create --org <org>\` is enough.`;
+}
+
+// src/commands/brain/orgs.ts
+var BrainOrgsCommand = class extends M8tCommand {
+  static paths = [["brain", "orgs"]];
+  static usage = Command21.Usage({
+    description: "Show which GitHub org your workers' brains should live in.",
+    details: "Read-only. Lists the organizations you belong to and prefers one linked to a GitHub Enterprise account. Advisory: `m8t brain app-create --org <org>` decides where the App is installed, so an explicit choice always wins.",
+    examples: [
+      ["Show the recommendation", "$0 brain orgs"],
+      ["Machine-readable", "$0 brain orgs --output json"]
+    ]
+  });
+  output = Option20.String("--output");
+  async executeCommand() {
+    const outputFlag = this.output === "json" || this.output === "auto" || this.output === "pretty" ? this.output : "pretty";
+    const mode = resolveOutputMode(outputFlag, this.context.stdout);
+    const classification = classifyOrgs(await fetchOrgGraph());
+    if (mode === "json") {
+      this.context.stdout.write(renderJson(classification) + "\n");
+      return exitCodeFor(classification);
+    }
+    this.renderPretty(classification);
+    return exitCodeFor(classification);
+  }
+  renderPretty(c) {
+    const out = (s) => this.context.stdout.write(s + "\n");
+    switch (c.verdict) {
+      case "enterprise-single":
+        out(`${colors.success("\u2713")} ${enterpriseSingleNotice(c.selected ?? "")}`);
+        return;
+      case "enterprise-multiple":
+        out(enterpriseMultiplePrompt(c.candidates.map((o) => o.login)));
+        return;
+      case "no-enterprise":
+        out(noEnterpriseNotice(c.candidates[0]?.login ?? ""));
+        if (c.candidates.length > 1) {
+          out(`  ${colors.dim(`orgs: ${c.candidates.map((o) => o.login).join(", ")}`)}`);
+        }
+        return;
+      case "undetermined":
+        out(undeterminedNotice());
+        return;
+      case "no-orgs":
+        this.context.stderr.write(`${colors.error("\u2717")} ${noOrgsRefusal()}
+`);
+        return;
+    }
+  }
+};
+function exitCodeFor(c) {
+  return c.verdict === "no-orgs" ? 1 : 0;
+}
+
+// src/commands/brain/show.ts
+import { Command as Command22, Option as Option21 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential7 } from "@azure/identity";
 init_errors();
 init_foundry_agent_get();
 init_esm();
 var BrainShowCommand = class extends M8tCommand {
   static paths = [["brain", "show"]];
-  static usage = Command21.Usage({ description: "Show a worker's brain link + connection diagnostics." });
-  worker = Option20.String();
-  subscription = Option20.String("--subscription");
-  endpoint = Option20.String("--endpoint");
-  output = Option20.String("--output");
+  static usage = Command22.Usage({ description: "Show a worker's brain link + connection diagnostics." });
+  worker = Option21.String();
+  subscription = Option21.String("--subscription");
+  endpoint = Option21.String("--endpoint");
+  output = Option21.String("--output");
   async executeCommand() {
     const worker = typeof this.worker === "string" ? this.worker : void 0;
     if (!worker) {
@@ -16296,7 +16412,7 @@ var BrainShowCommand = class extends M8tCommand {
 };
 
 // src/commands/brain/unlink.ts
-import { Command as Command22, Option as Option21 } from "clipanion";
+import { Command as Command23, Option as Option22 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential8 } from "@azure/identity";
 init_errors();
 
@@ -16456,7 +16572,7 @@ ${text.slice(0, 300)}`
 // src/commands/brain/unlink.ts
 var BrainUnlinkCommand = class extends M8tCommand {
   static paths = [["brain", "unlink"]];
-  static usage = Command22.Usage({
+  static usage = Command23.Usage({
     description: "Unlink a worker from its brain repo (cascade teardown).",
     details: "Re-deploys the agent without the brain loader + MCP tool, deletes the Foundry connection, and (unless --keep-app-install) uninstalls the GitHub App on the repo. The repo itself is NOT deleted.",
     examples: [
@@ -16464,13 +16580,13 @@ var BrainUnlinkCommand = class extends M8tCommand {
       ["Unlink but keep the App install", "$0 brain unlink cmo --yes --keep-app-install"]
     ]
   });
-  worker = Option21.String();
-  yes = Option21.Boolean("--yes", false);
-  keepAppInstall = Option21.Boolean("--keep-app-install", false);
-  kvUri = Option21.String("--kv-uri");
-  subscription = Option21.String("--subscription");
-  endpoint = Option21.String("--endpoint");
-  output = Option21.String("--output");
+  worker = Option22.String();
+  yes = Option22.Boolean("--yes", false);
+  keepAppInstall = Option22.Boolean("--keep-app-install", false);
+  kvUri = Option22.String("--kv-uri");
+  subscription = Option22.String("--subscription");
+  endpoint = Option22.String("--endpoint");
+  output = Option22.String("--output");
   async executeCommand() {
     const worker = typeof this.worker === "string" ? this.worker : void 0;
     if (!worker) {
@@ -16560,7 +16676,7 @@ var BrainUnlinkCommand = class extends M8tCommand {
 };
 
 // src/commands/agent/deploy-advisor.ts
-import { Command as Command23, Option as Option22 } from "clipanion";
+import { Command as Command24, Option as Option23 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential9 } from "@azure/identity";
 init_errors();
 
@@ -16651,7 +16767,7 @@ async function deployPromptAdvisor(args) {
 // src/commands/agent/deploy-advisor.ts
 var AgentDeployAdvisorCommand = class extends M8tCommand {
   static paths = [["agent", "deploy-advisor"]];
-  static usage = Command23.Usage({
+  static usage = Command24.Usage({
     description: "Deploy a brain-eligible prompt advisor headlessly from its persona frontmatter.",
     details: "Reads the persona frontmatter (model, reasoning effort, fillable-field defaults) from personas/<persona>/persona.md, renders the instructions, and creates a new Foundry prompt-agent version under <name>. Idempotent \u2014 re-running creates a new version. Used by the cloud installer to seed the default advisor worker set.",
     examples: [
@@ -16669,25 +16785,25 @@ var AgentDeployAdvisorCommand = class extends M8tCommand {
       ]
     ]
   });
-  persona = Option22.String("--persona", {
+  persona = Option23.String("--persona", {
     description: "Persona directory name under personas/ (e.g. startup-advisor)."
   });
-  name = Option22.String("--name", {
+  name = Option23.String("--name", {
     description: "The agent instance name to deploy as (e.g. stacey)."
   });
-  model = Option22.String("--model", {
+  model = Option23.String("--model", {
     description: "Override the model from persona frontmatter."
   });
-  endpoint = Option22.String("--endpoint", {
+  endpoint = Option23.String("--endpoint", {
     description: "Foundry project endpoint URL. If omitted, resolved from the subscription."
   });
-  subscription = Option22.String("--subscription", {
+  subscription = Option23.String("--subscription", {
     description: "Azure subscription ID. Defaults to the current az account."
   });
-  repoRootFlag = Option22.String("--repo-root", {
+  repoRootFlag = Option23.String("--repo-root", {
     description: "Path to the m8t repo checkout. Defaults to the ~/.m8t/repo-root marker."
   });
-  output = Option22.String("--output", {
+  output = Option23.String("--output", {
     description: "Output format: pretty (default) or json."
   });
   async executeCommand() {
@@ -16753,7 +16869,7 @@ var AgentDeployAdvisorCommand = class extends M8tCommand {
 };
 
 // src/commands/agent/remove.ts
-import { Command as Command24, Option as Option23 } from "clipanion";
+import { Command as Command25, Option as Option24 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential10 } from "@azure/identity";
 init_errors();
 
@@ -17213,7 +17329,7 @@ function defaultRemoveAgentDeps(args) {
 // src/commands/agent/remove.ts
 var AgentRemoveCommand = class extends M8tCommand {
   static paths = [["agent", "remove"]];
-  static usage = Command24.Usage({
+  static usage = Command25.Usage({
     description: "Cascade-remove an agent and all its associated resources.",
     details: "Removes, in order: channel bindings (table row + KV secret + conversations), a2a connection, brain connection (GitHub repo kept by default), the agent itself, and its local yaml. Idempotent and partial-failure resilient.",
     examples: [
@@ -17222,18 +17338,18 @@ var AgentRemoveCommand = class extends M8tCommand {
       ["Remove without touching bindings", "$0 agent remove my-agent --yes --keep-bindings"]
     ]
   });
-  name = Option23.String();
-  yes = Option23.Boolean("--yes", false);
-  keepBindings = Option23.Boolean("--keep-bindings", false);
-  keepA2a = Option23.Boolean("--keep-a2a", false);
-  deleteBrainRepo = Option23.Boolean("--delete-brain-repo", false);
-  endpoint = Option23.String("--endpoint");
-  subscription = Option23.String("--subscription");
-  kvUri = Option23.String("--kv-uri");
-  resourceGroup = Option23.String("--resource-group", {
+  name = Option24.String();
+  yes = Option24.Boolean("--yes", false);
+  keepBindings = Option24.Boolean("--keep-bindings", false);
+  keepA2a = Option24.Boolean("--keep-a2a", false);
+  deleteBrainRepo = Option24.Boolean("--delete-brain-repo", false);
+  endpoint = Option24.String("--endpoint");
+  subscription = Option24.String("--subscription");
+  kvUri = Option24.String("--kv-uri");
+  resourceGroup = Option24.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  output = Option23.String("--output");
+  output = Option24.String("--output");
   async executeCommand() {
     const name = typeof this.name === "string" ? this.name : void 0;
     if (!name) {
@@ -17348,7 +17464,7 @@ ${colors.success("\u2713")} removed ${colors.field(name)}.
 
 // src/commands/a2a/enable.ts
 import * as path14 from "path";
-import { Command as Command25, Option as Option24 } from "clipanion";
+import { Command as Command26, Option as Option25 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential11 } from "@azure/identity";
 init_errors();
 
@@ -17391,17 +17507,17 @@ function readConfigGatewayUrl(home) {
 // src/commands/a2a/enable.ts
 var A2aEnableCommand = class extends M8tCommand {
   static paths = [["a2a", "enable"]];
-  static usage = Command25.Usage({
+  static usage = Command26.Usage({
     description: "Enable a worker for agent-to-agent delegation (caller + callee). Idempotent (rotates the bearer).",
     details: "Attaches the A2A tool[type:mcp] (discover_workers + invoke_worker), provisions a CustomKeys connection holding a freshly-minted bearer, and projects the persona's a2a-card + sha256(bearer) into Foundry agent metadata. The bridge then lists this worker in discover_workers and recognizes it as a caller by the bearer hash.",
     examples: [["Enable the cmo persona", "$0 a2a enable cmo --persona cmo --gateway-url https://<gateway-fqdn>"]]
   });
-  worker = Option24.String();
-  persona = Option24.String("--persona");
-  gatewayUrl = Option24.String("--gateway-url");
-  endpoint = Option24.String("--endpoint");
-  subscription = Option24.String("--subscription");
-  output = Option24.String("--output");
+  worker = Option25.String();
+  persona = Option25.String("--persona");
+  gatewayUrl = Option25.String("--gateway-url");
+  endpoint = Option25.String("--endpoint");
+  subscription = Option25.String("--subscription");
+  output = Option25.String("--output");
   async executeCommand() {
     const env = this.context.env;
     const outputFlag = this.output === "json" || this.output === "auto" || this.output === "pretty" ? this.output : "pretty";
@@ -17461,18 +17577,18 @@ var A2aEnableCommand = class extends M8tCommand {
 };
 
 // src/commands/a2a/disable.ts
-import { Command as Command26, Option as Option25 } from "clipanion";
+import { Command as Command27, Option as Option26 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential12 } from "@azure/identity";
 var A2aDisableCommand = class extends M8tCommand {
   static paths = [["a2a", "disable"]];
-  static usage = Command26.Usage({
+  static usage = Command27.Usage({
     description: "Disable agent-to-agent delegation for a worker (remove tool + connection + metadata). Idempotent.",
     examples: [["Disable the cmo persona", "$0 a2a disable cmo"]]
   });
-  worker = Option25.String();
-  endpoint = Option25.String("--endpoint");
-  subscription = Option25.String("--subscription");
-  output = Option25.String("--output");
+  worker = Option26.String();
+  endpoint = Option26.String("--endpoint");
+  subscription = Option26.String("--subscription");
+  output = Option26.String("--output");
   async executeCommand() {
     const outputFlag = this.output === "json" || this.output === "auto" || this.output === "pretty" ? this.output : "pretty";
     const mode = resolveOutputMode(outputFlag, this.context.stdout);
@@ -17506,7 +17622,7 @@ var A2aDisableCommand = class extends M8tCommand {
 };
 
 // src/commands/architect/check.ts
-import { Command as Command27 } from "clipanion";
+import { Command as Command28 } from "clipanion";
 
 // src/lib/architect-version.ts
 import { createHash as createHash2 } from "crypto";
@@ -17645,7 +17761,7 @@ function checkArchitectDrift() {
 // src/commands/architect/check.ts
 var ArchitectCheckCommand = class extends M8tCommand {
   static paths = [["architect-check"]];
-  static usage = Command27.Usage({
+  static usage = Command28.Usage({
     description: "Verify the installed m8t-architect persona matches the repo source.",
     details: "Compares a render-time content hash (stored in a per-persona `<name>.m8t-skill.json` sidecar, checked across every host m8t can render into \u2014 Claude Code, VS Code Copilot Chat, GitHub Copilot CLI) against a fresh hash of <repo-root>/personas/m8t-architect/persona.md. Exits 0 when they match, 1 with remediation advice when they don't. Used as a pre-flight gate by the architect persona body and as a verification step in guides/install/m8t.md.",
     examples: [
@@ -17672,7 +17788,7 @@ var ArchitectCheckCommand = class extends M8tCommand {
 // src/commands/coder/deploy.ts
 init_esm2();
 import * as path17 from "path";
-import { Command as Command28, Option as Option26 } from "clipanion";
+import { Command as Command29, Option as Option27 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential13 } from "@azure/identity";
 init_errors();
 init_foundry_agent_get();
@@ -18086,7 +18202,7 @@ var DEFAULT_MODEL = "gpt-4.1-mini";
 var NAME_RE = /^[a-z0-9-]+$/;
 var CoderDeployCommand = class extends M8tCommand {
   static paths = [["coder", "deploy"]];
-  static usage = Command28.Usage({
+  static usage = Command29.Usage({
     description: "Deploy the curated coding agent as a hosted Foundry worker.",
     details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-labs/m8t-coding-agent). Post-2026-06-25 Foundry projects require an authenticated pull, so a public image is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 a server-side copy, no local build) and the agent is deployed from that ACR ref. Re-running with a newer --image-tag imports the new tag and rolls out a new agent version \u2014 that is how you update a worker's image. Override --image with a private ACR ref to bring your own registry.",
     examples: [
@@ -18095,22 +18211,22 @@ var CoderDeployCommand = class extends M8tCommand {
       ["Override the exec timeout", "$0 coder deploy my-coder --env M8T_CODER_EXEC_TIMEOUT_SECONDS=300"]
     ]
   });
-  name = Option26.String();
-  persona = Option26.String("--persona");
-  image = Option26.String("--image");
-  imageTag = Option26.String("--image-tag");
-  size = Option26.String("--size");
-  modelDeployment = Option26.String("--model-deployment");
-  env = Option26.Array("--env");
-  endpoint = Option26.String("--endpoint");
-  subscription = Option26.String("--subscription");
-  output = Option26.String("--output");
-  brain = Option26.String("--brain");
-  brainBranch = Option26.String("--branch");
-  brainKv = Option26.String("--brain-kv");
-  allowNonReasoning = Option26.Boolean("--allow-non-reasoning", false);
-  skipQuotaCheck = Option26.Boolean("--skip-quota-check", false);
-  gatewayUrl = Option26.String("--gateway-url", { description: "Base gateway URL for the a2a bridge (e.g. https://<gateway-fqdn>); enables this coder as an a2a target." });
+  name = Option27.String();
+  persona = Option27.String("--persona");
+  image = Option27.String("--image");
+  imageTag = Option27.String("--image-tag");
+  size = Option27.String("--size");
+  modelDeployment = Option27.String("--model-deployment");
+  env = Option27.Array("--env");
+  endpoint = Option27.String("--endpoint");
+  subscription = Option27.String("--subscription");
+  output = Option27.String("--output");
+  brain = Option27.String("--brain");
+  brainBranch = Option27.String("--branch");
+  brainKv = Option27.String("--brain-kv");
+  allowNonReasoning = Option27.Boolean("--allow-non-reasoning", false);
+  skipQuotaCheck = Option27.Boolean("--skip-quota-check", false);
+  gatewayUrl = Option27.String("--gateway-url", { description: "Base gateway URL for the a2a bridge (e.g. https://<gateway-fqdn>); enables this coder as an a2a target." });
   async executeCommand() {
     if (!NAME_RE.test(this.name)) {
       throw new LocalCliError({
@@ -18345,13 +18461,13 @@ var CoderDeployCommand = class extends M8tCommand {
 
 // src/commands/coder/teardown.ts
 import { confirm as confirm4 } from "@inquirer/prompts";
-import { Command as Command29, Option as Option27 } from "clipanion";
+import { Command as Command30, Option as Option28 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential14 } from "@azure/identity";
 init_foundry_agents();
 init_errors();
 var CoderTeardownCommand = class extends M8tCommand {
   static paths = [["coder", "teardown"]];
-  static usage = Command29.Usage({
+  static usage = Command30.Usage({
     description: "Delete a deployed hosted coder (removes its container + identity + role assignment).",
     details: "Idempotent: tearing down a missing coder reports 'already gone'. Only the named agent is touched. Discovery self-heals on the next worker list.",
     examples: [
@@ -18359,11 +18475,11 @@ var CoderTeardownCommand = class extends M8tCommand {
       ["Skip the confirm (scripts)", "$0 coder teardown my-coder --yes"]
     ]
   });
-  name = Option27.String();
-  yes = Option27.Boolean("--yes", false);
-  endpoint = Option27.String("--endpoint");
-  subscription = Option27.String("--subscription");
-  output = Option27.String("--output");
+  name = Option28.String();
+  yes = Option28.Boolean("--yes", false);
+  endpoint = Option28.String("--endpoint");
+  subscription = Option28.String("--subscription");
+  output = Option28.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -18428,7 +18544,7 @@ var CoderTeardownCommand = class extends M8tCommand {
 // src/commands/azure-exec/deploy.ts
 init_esm2();
 import * as path18 from "path";
-import { Command as Command30, Option as Option28 } from "clipanion";
+import { Command as Command31, Option as Option29 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential15 } from "@azure/identity";
 init_errors();
 init_foundry_agent_get();
@@ -18490,7 +18606,7 @@ var DEFAULT_MODEL2 = "gpt-5-mini";
 var NAME_RE2 = /^[a-z0-9-]+$/;
 var AzureExecDeployCommand = class extends M8tCommand {
   static paths = [["azure-exec", "deploy"]];
-  static usage = Command30.Usage({
+  static usage = Command31.Usage({
     description: "Deploy the Azure executor as a hosted Foundry worker (az CLI + tiered ops).",
     details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-labs/m8t-azure-executor \u2014 no local build needed), grants its identity Foundry User + Contributor (at --scope) + Key Vault Secrets User (brain KV), polls to active, and a2a-enables it as a target. Override with --image/--image-tag for a bring-your-own-registry image (e.g. a private ACR ref, which must be pushed first). Contributor scope is REQUIRED \u2014 pass --scope or --resource-group. Pass --grant-access-admin to additionally grant User Access Administrator (enables human-approved Tier-2 role/delete ops). Post-2026-06-25 Foundry projects require an authenticated pull, so the public image (default ghcr.io/m8t-labs/m8t-azure-executor) is staged into the customer's Azure Container Registry first (created if missing, then `az acr import` \u2014 server-side, no local build) and deployed from that ACR ref; re-running with a newer --image-tag updates the image.",
     examples: [
@@ -18500,23 +18616,23 @@ var AzureExecDeployCommand = class extends M8tCommand {
       ]
     ]
   });
-  name = Option28.String();
-  image = Option28.String("--image");
-  imageTag = Option28.String("--image-tag");
-  size = Option28.String("--size");
-  scope = Option28.String("--scope");
-  resourceGroup = Option28.String("--resource-group");
-  modelDeployment = Option28.String("--model-deployment");
-  env = Option28.Array("--env");
-  brain = Option28.String("--brain");
-  kvUri = Option28.String("--kv-uri");
-  gatewayUrl = Option28.String("--gateway-url");
-  endpoint = Option28.String("--endpoint");
-  subscription = Option28.String("--subscription");
-  output = Option28.String("--output");
-  skipQuotaCheck = Option28.Boolean("--skip-quota-check", false);
-  grantAccessAdmin = Option28.Boolean("--grant-access-admin", false);
-  enableEmail = Option28.Boolean("--enable-email", false);
+  name = Option29.String();
+  image = Option29.String("--image");
+  imageTag = Option29.String("--image-tag");
+  size = Option29.String("--size");
+  scope = Option29.String("--scope");
+  resourceGroup = Option29.String("--resource-group");
+  modelDeployment = Option29.String("--model-deployment");
+  env = Option29.Array("--env");
+  brain = Option29.String("--brain");
+  kvUri = Option29.String("--kv-uri");
+  gatewayUrl = Option29.String("--gateway-url");
+  endpoint = Option29.String("--endpoint");
+  subscription = Option29.String("--subscription");
+  output = Option29.String("--output");
+  skipQuotaCheck = Option29.Boolean("--skip-quota-check", false);
+  grantAccessAdmin = Option29.Boolean("--grant-access-admin", false);
+  enableEmail = Option29.Boolean("--enable-email", false);
   async executeCommand() {
     if (!NAME_RE2.test(this.name)) {
       throw new LocalCliError({
@@ -18761,7 +18877,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/status.ts
-import { Command as Command31, Option as Option29 } from "clipanion";
+import { Command as Command32, Option as Option30 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential16 } from "@azure/identity";
 
 // src/lib/platform-update.ts
@@ -19958,30 +20074,30 @@ async function applyPersona(a, ctx, opts) {
 // src/commands/platform/status.ts
 var PlatformStatusCommand = class extends M8tCommand {
   static paths = [["platform", "status"]];
-  static usage = Command31.Usage({
+  static usage = Command32.Usage({
     description: "Show per-component platform drift against a release manifest.",
     details: "Fetches a release manifest (the current channel by default), reads the installed-state stamp, and reports each component's installed vs target version and drift status. Read-only \u2014 never writes the stamp, never converges anything (use 'm8t platform update' for that). --verify additionally probes the live gateway (image tag + /api/version) best-effort."
   });
-  subscription = Option29.String("--subscription");
-  resourceGroup = Option29.String("--resource-group", {
+  subscription = Option30.String("--subscription");
+  resourceGroup = Option30.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  to = Option29.String("--to", {
+  to = Option30.String("--to", {
     description: "Check status against a pinned platform version (defaults to the current release channel)."
   });
-  contentDir = Option29.String("--content-dir", {
+  contentDir = Option30.String("--content-dir", {
     description: "Path to a local m8t repo checkout (skips the tarball tree-SHA fetch)."
   });
-  manifestUrl = Option29.String("--manifest-url", {
+  manifestUrl = Option30.String("--manifest-url", {
     description: "Fetch the release manifest from this URL instead of the release channel."
   });
-  manifestFile = Option29.String("--manifest-file", {
+  manifestFile = Option30.String("--manifest-file", {
     description: "Read the release manifest from this local file instead of the release channel."
   });
-  verify = Option29.Boolean("--verify", false, {
+  verify = Option30.Boolean("--verify", false, {
     description: "Additionally probe the live gateway (image tag + /api/version) and report stamp-vs-live."
   });
-  output = Option29.String("--output");
+  output = Option30.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -20099,7 +20215,7 @@ var PlatformStatusCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/update.ts
-import { Command as Command32, Option as Option30 } from "clipanion";
+import { Command as Command33, Option as Option31 } from "clipanion";
 import { confirm as confirm5 } from "@inquirer/prompts";
 import { DefaultAzureCredential as DefaultAzureCredential17 } from "@azure/identity";
 
@@ -20742,40 +20858,40 @@ function assertCliVersionOk(manifest, runningVersion, onWarn = () => {
 // src/commands/platform/update.ts
 var PlatformUpdateCommand = class extends M8tCommand {
   static paths = [["platform", "update"]];
-  static usage = Command32.Usage({
+  static usage = Command33.Usage({
     description: "Converge the whole platform (gateway, hosted agents, personas, infra) to a release manifest.",
     details: "Fetches a release manifest (the current channel by default), diffs it against the installed-state stamp, and converges each changed component via its own executor: rolls the gateway/hosted-agent images, re-versions prompt personas (compose-preserving), and records infra state. A deploy/ tree drift is reported but NOT applied unless --force-infra is passed. Use --check to preview, --only to converge a single component, --yes to skip the confirmation prompt."
   });
-  subscription = Option30.String("--subscription");
-  resourceGroup = Option30.String("--resource-group", {
+  subscription = Option31.String("--subscription");
+  resourceGroup = Option31.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  to = Option30.String("--to", {
+  to = Option31.String("--to", {
     description: "Pin the platform version to converge to (defaults to the current release channel)."
   });
-  only = Option30.String("--only", {
+  only = Option31.String("--only", {
     description: "Converge only one component: infra | gateway | codingAgent | azureExecutor | personas | brainSeeds."
   });
-  check = Option30.Boolean("--check", false);
-  yes = Option30.Boolean("--yes", false);
-  skipInfra = Option30.Boolean("--skip-infra", false);
-  forceInfra = Option30.Boolean("--force-infra", false);
-  suffix = Option30.String("--suffix", {
+  check = Option31.Boolean("--check", false);
+  yes = Option31.Boolean("--yes", false);
+  skipInfra = Option31.Boolean("--skip-infra", false);
+  forceInfra = Option31.Boolean("--force-infra", false);
+  suffix = Option31.String("--suffix", {
     description: "Required with --force-infra \u2014 the existing deployment's resource-name suffix (avoids provisioning duplicates)."
   });
-  contentDir = Option30.String("--content-dir", {
+  contentDir = Option31.String("--content-dir", {
     description: "Path to a local m8t repo checkout (skips the tarball fetch + tree-drift check)."
   });
-  manifestUrl = Option30.String("--manifest-url", {
+  manifestUrl = Option31.String("--manifest-url", {
     description: "Fetch the release manifest from this URL instead of the release channel."
   });
-  manifestFile = Option30.String("--manifest-file", {
+  manifestFile = Option31.String("--manifest-file", {
     description: "Read the release manifest from this local file instead of the release channel."
   });
-  endpoint = Option30.String("--endpoint", {
+  endpoint = Option31.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
   });
-  output = Option30.String("--output");
+  output = Option31.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -20903,7 +21019,7 @@ var PlatformUpdateCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/converge.ts
-import { Command as Command33 } from "clipanion";
+import { Command as Command34 } from "clipanion";
 
 // src/lib/platform-converge-mi.ts
 import { ManagedIdentityCredential } from "@azure/identity";
@@ -21178,7 +21294,7 @@ async function failIfStillInFlight(client, now, error) {
 }
 var PlatformConvergeCommand = class extends M8tCommand {
   static paths = [["platform", "converge"]];
-  static usage = Command33.Usage({
+  static usage = Command34.Usage({
     category: "Platform",
     description: "Headless updater-job driver: claim a pending apply-request and converge the platform to it.",
     details: "The Managed-Identity-authenticated entry point run by the updater Container Apps job. One invocation is one tick: it claims the pending apply-request row (if any), refuses a downgrade against the installed stamp, self-fetches and validates the target manifest, self-updates its own engine image when the manifest requires a newer CLI, then drives the converge engine behind the health-gate + auto-rollback. Reads its subscription/RG/endpoint/channel from env (MI_CLIENT_ID, SUBSCRIPTION_ID, RESOURCE_GROUP, FOUNDRY_ENDPOINT, M8T_UPDATE_CHANNEL_URL). Not intended for interactive use \u2014 the founder-facing path is 'm8t platform update'."
@@ -21394,7 +21510,7 @@ function targetManifestSource(ctx, target) {
 
 // src/commands/platform/seed-stamp.ts
 import { readFileSync as readFileSync17 } from "fs";
-import { Command as Command34, Option as Option31 } from "clipanion";
+import { Command as Command35, Option as Option32 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential18, ManagedIdentityCredential as ManagedIdentityCredential2 } from "@azure/identity";
 init_errors();
 
@@ -21526,15 +21642,15 @@ async function seedStamp2(args) {
 }
 var PlatformSeedStampCommand = class extends M8tCommand {
   static paths = [["platform", "seed-stamp"]];
-  static usage = Command34.Usage({
+  static usage = Command35.Usage({
     description: "INTERNAL: write the initial installed-state stamp from a build-time install descriptor.",
     details: "Used by the cloud installer at the end of a from-zero install so the platform records which release it is running. Writes the stamp ONLY IF ABSENT \u2014 it never overwrites a stamp written by the converge engine, so a re-run or a container restart is harmless. Not a founder-facing command: to change what is installed, use 'm8t platform update'."
   });
-  descriptor = Option31.String("--descriptor", { description: "Path to install-descriptor.json (baked into the installer image)." });
-  subscription = Option31.String("--subscription");
-  resourceGroup = Option31.String("--resource-group");
-  miClientId = Option31.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
-  output = Option31.String("--output");
+  descriptor = Option32.String("--descriptor", { description: "Path to install-descriptor.json (baked into the installer image)." });
+  subscription = Option32.String("--subscription");
+  resourceGroup = Option32.String("--resource-group");
+  miClientId = Option32.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
+  output = Option32.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const need = (v, flag) => {
@@ -21566,7 +21682,7 @@ var PlatformSeedStampCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/stamp-build.ts
-import { Command as Command35, Option as Option32 } from "clipanion";
+import { Command as Command36, Option as Option33 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential19, ManagedIdentityCredential as ManagedIdentityCredential3 } from "@azure/identity";
 init_errors();
 
@@ -21600,17 +21716,17 @@ function buildRunningBuildStamp(input) {
 // src/commands/platform/stamp-build.ts
 var PlatformStampBuildCommand = class extends M8tCommand {
   static paths = [["platform", "stamp-build"]];
-  static usage = Command35.Usage({
+  static usage = Command36.Usage({
     description: "Record the currently running build as this install's platform version.",
     details: "For installs that are deployed continuously rather than from a published release. Unlike the install-time record, this overwrites on every run \u2014 the running build is the truth. Only components this writer deploys are reported; the rest are marked as managed elsewhere."
   });
-  version = Option32.String("--version", { description: "The running build's own version, bare X.Y.Z." });
-  gatewayTag = Option32.String("--gateway-tag", { description: "The tag of the gateway image this build deployed." });
-  gatewayDigest = Option32.String("--gateway-digest", { description: "The digest of the gateway image this build deployed." });
-  subscription = Option32.String("--subscription");
-  resourceGroup = Option32.String("--resource-group");
-  miClientId = Option32.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
-  output = Option32.String("--output");
+  version = Option33.String("--version", { description: "The running build's own version, bare X.Y.Z." });
+  gatewayTag = Option33.String("--gateway-tag", { description: "The tag of the gateway image this build deployed." });
+  gatewayDigest = Option33.String("--gateway-digest", { description: "The digest of the gateway image this build deployed." });
+  subscription = Option33.String("--subscription");
+  resourceGroup = Option33.String("--resource-group");
+  miClientId = Option33.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
+  output = Option33.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const need = (v, flag) => {
@@ -21662,7 +21778,7 @@ var PlatformStampBuildCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/policy.ts
-import { Command as Command36, Option as Option33 } from "clipanion";
+import { Command as Command37, Option as Option34 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential20, ManagedIdentityCredential as ManagedIdentityCredential4 } from "@azure/identity";
 init_errors();
 
@@ -21718,16 +21834,16 @@ async function readPolicy(opts) {
 // src/commands/platform/policy.ts
 var PlatformPolicyCommand = class extends M8tCommand {
   static paths = [["platform", "policy"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     description: "Show or set how this install handles available platform updates.",
     details: "Modes: 'notify-only' shows updates but never applies them; 'auto-critical' (the default when unset) applies critical releases without asking; 'auto-all' applies every release. Use 'notify-only' where something else already controls what is deployed.",
     examples: [["Show the current mode", "m8t platform policy"], ["Never apply automatically", "m8t platform policy --set notify-only"]]
   });
-  set = Option33.String("--set", { description: "notify-only | auto-critical | auto-all" });
-  subscription = Option33.String("--subscription");
-  resourceGroup = Option33.String("--resource-group");
-  miClientId = Option33.String("--mi-client-id");
-  output = Option33.String("--output");
+  set = Option34.String("--set", { description: "notify-only | auto-critical | auto-all" });
+  subscription = Option34.String("--subscription");
+  resourceGroup = Option34.String("--resource-group");
+  miClientId = Option34.String("--mi-client-id");
+  output = Option34.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const need = (v, flag) => {
@@ -21773,7 +21889,7 @@ var PlatformPolicyCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/enable-cost-report.ts
-import { Command as Command37, Option as Option34 } from "clipanion";
+import { Command as Command38, Option as Option35 } from "clipanion";
 
 // src/lib/wire-gateway-acs.ts
 init_rbac();
@@ -21813,18 +21929,18 @@ async function wireGatewayForAcs(args) {
 init_errors();
 var PlatformEnableCostReportCommand = class extends M8tCommand {
   static paths = [["platform", "enable-cost-report"]];
-  static usage = Command37.Usage({
+  static usage = Command38.Usage({
     description: "Wire the deployed gateway to send the bi-weekly cost report via ACS Email.",
     details: "Discovers the live gateway Container App, grants its managed identity Contributor at the ACS resource scope (authorising the ACS Email send), and sets M8T_ACS_ENDPOINT / M8T_ACS_SENDER / M8T_ENABLE_COST_REPORTER=1 on the gateway. Idempotent \u2014 safely re-runnable. ACS is created during the executor deploy; pass its endpoint, sender, and resource id (from that deploy or 'az communication list')."
   });
-  subscription = Option34.String("--subscription");
-  resourceGroup = Option34.String("--resource-group", {
+  subscription = Option35.String("--subscription");
+  resourceGroup = Option35.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  acsEndpoint = Option34.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
-  acsSender = Option34.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
-  acsResourceId = Option34.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
-  output = Option34.String("--output");
+  acsEndpoint = Option35.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
+  acsSender = Option35.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
+  acsResourceId = Option35.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
+  output = Option35.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -21898,45 +22014,45 @@ var PlatformEnableCostReportCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/enable-auto-update.ts
-import { Command as Command38, Option as Option35 } from "clipanion";
+import { Command as Command39, Option as Option36 } from "clipanion";
 import { confirm as confirm6 } from "@inquirer/prompts";
 import { DefaultAzureCredential as DefaultAzureCredential21 } from "@azure/identity";
 init_errors();
 var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
   static paths = [["platform", "enable-auto-update"]];
-  static usage = Command38.Usage({
+  static usage = Command39.Usage({
     category: "Platform",
     description: "Retrofit the auto-updater (MI + cron job + role assignments) onto an existing install.",
     details: "For an install that predates the Platform Update Framework: recovers the deployment's resource-name suffix (from the stamped system/infra-params row, or by verified derivation from the live gateway), recovers the other bicep params from live state (WITHOUT changing the deployed gateway image), and re-runs deploy/main.bicep with provisionUpdater=true \u2014 which provisions the updater managed identity, the cron Container Apps Job, and every role assignment (Owner@RG + Foundry User@account + Storage Table + Storage Blob + AcrPull), all scoped to the resource group. On success, backfills system/infra-params so future converges never have to re-derive the suffix. Idempotent \u2014 safe to re-run."
   });
-  subscription = Option35.String("--subscription");
-  resourceGroup = Option35.String("--resource-group", {
+  subscription = Option36.String("--subscription");
+  resourceGroup = Option36.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  suffix = Option35.String("--suffix", {
+  suffix = Option36.String("--suffix", {
     description: "The existing deployment's resource-name suffix. Required when it cannot be recovered from system/infra-params or the live gateway."
   });
-  installerImage = Option35.String("--installer-image", {
+  installerImage = Option36.String("--installer-image", {
     required: true,
     description: "Updater CA-Job image ref (the converge engine at the current release). Required \u2014 an empty image would skip provisioning."
   });
-  updateCron = Option35.String("--update-cron", {
+  updateCron = Option36.String("--update-cron", {
     description: "Cron schedule for the updater job (bicep default applies when omitted)."
   });
-  channelUrl = Option35.String("--channel-url", {
+  channelUrl = Option36.String("--channel-url", {
     description: "Release-channel URL the updater job polls (bicep default applies when omitted)."
   });
-  location = Option35.String("--location", {
+  location = Option36.String("--location", {
     description: "Region for the updater identity + job. Defaults to the resource group's existing resources."
   });
-  foundryTracing = Option35.String("--foundry-tracing", {
+  foundryTracing = Option36.String("--foundry-tracing", {
     description: "project | account | skip. Pass the value the install was deployed with \u2014 omitting it lets the bicep default (project) switch tracing on."
   });
-  endpoint = Option35.String("--endpoint", {
+  endpoint = Option36.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
   });
-  yes = Option35.Boolean("--yes", false);
-  output = Option35.String("--output");
+  yes = Option36.Boolean("--yes", false);
+  output = Option36.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -22073,7 +22189,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
 };
 
 // src/commands/deploy.ts
-import { Command as Command39, Option as Option36 } from "clipanion";
+import { Command as Command40, Option as Option37 } from "clipanion";
 
 // src/lib/app-reg.ts
 init_errors();
@@ -22321,6 +22437,17 @@ async function ensureGatewayRedirectUri(gatewayClientId, fqdn) {
   }
   await patchRedirectUris(appObjectId, fqdn);
 }
+async function resolveAppObjectIdForWrite(opts) {
+  if (opts.appObjectId) return opts.appObjectId;
+  if (!opts.clientId) return null;
+  try {
+    return await azJson(
+      ["ad", "app", "show", "--id", opts.clientId, "--query", "id", "--output", "json"]
+    ) ?? null;
+  } catch {
+    return null;
+  }
+}
 async function patchRedirectUris(appObjectId, fqdn) {
   const targetUri = `https://${fqdn}`;
   const existing = await azJson(
@@ -22553,52 +22680,52 @@ function classifyWhatIf(changes) {
 var DEFAULT_IMAGE_REF = "ghcr.io/m8t-labs/m8t:latest";
 var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
-  static usage = Command39.Usage({
+  static usage = Command40.Usage({
     description: "Deploy (or update) the m8t gateway/webapp stack via Bicep.",
     details: "Ensures the Entra app reg (or pass --client-id to reuse an existing one \u2014 required if you can't create app regs), writes ~/.m8t/config.yaml, ensures the resource group, and runs deploy/main.bicep. The repo is located via ~/.m8t/repo-root."
   });
-  subscription = Option36.String("--subscription");
-  resourceGroup = Option36.String("--resource-group", "rg-m8t-stack");
-  location = Option36.String("--location", "eastus");
-  suffix = Option36.String("--suffix", "");
-  imageRef = Option36.String("--image-ref", DEFAULT_IMAGE_REF);
-  acrPullIdentity = Option36.String("--acrpull-identity");
-  acrResourceId = Option36.String("--acr-resource-id");
-  foundryEndpoint = Option36.String("--foundry-endpoint");
-  foundryResourceId = Option36.String("--foundry-resource-id");
-  foundryTracing = Option36.String("--foundry-tracing");
+  subscription = Option37.String("--subscription");
+  resourceGroup = Option37.String("--resource-group", "rg-m8t-stack");
+  location = Option37.String("--location", "eastus");
+  suffix = Option37.String("--suffix", "");
+  imageRef = Option37.String("--image-ref", DEFAULT_IMAGE_REF);
+  acrPullIdentity = Option37.String("--acrpull-identity");
+  acrResourceId = Option37.String("--acr-resource-id");
+  foundryEndpoint = Option37.String("--foundry-endpoint");
+  foundryResourceId = Option37.String("--foundry-resource-id");
+  foundryTracing = Option37.String("--foundry-tracing");
   // project | account | skip (bicep default: project)
-  clientId = Option36.String("--client-id");
-  whatIf = Option36.Boolean("--what-if", false);
+  clientId = Option37.String("--client-id");
+  whatIf = Option37.Boolean("--what-if", false);
   // Only meaningful with --what-if. Routes the comparison through the
   // value-free renderers (see ./lib/whatif-redact.js) instead of the default
   // before/after renderer. Defaults false so a local, interactive run keeps
   // showing values — that is the whole diagnostic point of --what-if.
   // Automation that forwards this output anywhere non-private (a CI log, an
   // issue) MUST pass --redact.
-  redact = Option36.Boolean("--redact", false);
-  output = Option36.String("--output");
+  redact = Option37.Boolean("--redact", false);
+  output = Option37.String("--output");
   // Subscription-scoped role assignments. Omitted ⇒ the template default (true).
   // Pass false when deploying as a principal scoped to the resource group only:
   // it cannot deploy at subscription scope, and those assignments persist
   // idempotently from the initial deployment anyway.
-  assignSubscriptionRoles = Option36.String("--assign-subscription-roles");
+  assignSubscriptionRoles = Option37.String("--assign-subscription-roles");
   // Referee — all optional, undefined by default ⇒ the bicep defaults
   // apply (dormant: gatewayCpu=0.25, gatewayMemory=0.5Gi, every referee/exam var
   // empty). Only pass these when explicitly enabling the referee exam stack.
-  gatewayCpu = Option36.String("--gateway-cpu");
-  gatewayMemory = Option36.String("--gateway-memory");
-  refereeEnabled = Option36.String("--referee-enabled");
-  refereeBrainRepos = Option36.String("--referee-brain-repos");
-  refereeFeedRepo = Option36.String("--referee-feed-repo");
-  refereeInstallationId = Option36.String("--referee-installation-id");
-  refereeWebhookHmacKvUri = Option36.String("--referee-webhook-hmac-kv-uri");
-  examKvUri = Option36.String("--exam-kv-uri");
-  examLaWorkspaceId = Option36.String("--exam-la-workspace-id");
-  brainEvalDeployment = Option36.String("--brain-eval-deployment");
-  brainAppLogin = Option36.String("--brain-app-login");
-  refereeCheckpointDir = Option36.String("--referee-checkpoint-dir");
-  examApiBase = Option36.String("--exam-api-base");
+  gatewayCpu = Option37.String("--gateway-cpu");
+  gatewayMemory = Option37.String("--gateway-memory");
+  refereeEnabled = Option37.String("--referee-enabled");
+  refereeBrainRepos = Option37.String("--referee-brain-repos");
+  refereeFeedRepo = Option37.String("--referee-feed-repo");
+  refereeInstallationId = Option37.String("--referee-installation-id");
+  refereeWebhookHmacKvUri = Option37.String("--referee-webhook-hmac-kv-uri");
+  examKvUri = Option37.String("--exam-kv-uri");
+  examLaWorkspaceId = Option37.String("--exam-la-workspace-id");
+  brainEvalDeployment = Option37.String("--brain-eval-deployment");
+  brainAppLogin = Option37.String("--brain-app-login");
+  refereeCheckpointDir = Option37.String("--referee-checkpoint-dir");
+  examApiBase = Option37.String("--exam-api-base");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -22684,9 +22811,6 @@ var DeployCommand = class extends M8tCommand {
     }
     log(this.clientId ? `using existing app reg ${this.clientId}` : "ensuring Entra app reg\u2026");
     const app = await ensureAppReg({ tenantId: account.tenantId, clientId: this.clientId });
-    if (app.appObjectId === null && this.clientId) {
-      log(colors.dim("  (BYO app reg \u2014 skipping Graph writes; ensure it has http://localhost:3000 + the deployed FQDN as SPA redirect URIs and Expose-an-API)"));
-    }
     await writeFoundryConfig({ tenantId: app.tenantId, clientId: app.clientId, projectEndpoint: foundryEndpoint });
     log(`ensuring resource group ${this.resourceGroup}\u2026`);
     await ensureResourceGroup(this.resourceGroup, this.location);
@@ -22732,8 +22856,16 @@ var DeployCommand = class extends M8tCommand {
       params,
       deploymentName: `m8t-deploy-${account.subscriptionId.slice(0, 8)}`
     });
-    if (app.appObjectId) {
-      await patchRedirectUris(app.appObjectId, outputs.containerAppFqdn);
+    const writableAppObjectId = await resolveAppObjectIdForWrite({
+      appObjectId: app.appObjectId,
+      clientId: this.clientId
+    });
+    if (writableAppObjectId) {
+      await patchRedirectUris(writableAppObjectId, outputs.containerAppFqdn);
+    } else {
+      log(colors.dim(
+        `  (could not register the sign-in redirect URI automatically \u2014 add https://${outputs.containerAppFqdn} as an SPA redirect URI on app registration ${app.clientId}, or sign-in will fail with AADSTS50011)`
+      ));
     }
     const webappUrl = `https://${outputs.containerAppFqdn}`;
     if (mode === "json") {
@@ -22758,7 +22890,7 @@ var DeployCommand = class extends M8tCommand {
 
 // src/commands/eval/skill.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { Command as Command40, Option as Option37 } from "clipanion";
+import { Command as Command41, Option as Option38 } from "clipanion";
 init_errors();
 var DECISIONS = /* @__PURE__ */ new Set(["promote", "reject", "needs_review"]);
 var JUDGE_STATUSES = /* @__PURE__ */ new Set(["ok", "skipped", "unavailable"]);
@@ -22783,14 +22915,14 @@ function parseVerdict(stdout) {
 }
 var EvalSkillCommand = class extends M8tCommand {
   static paths = [["eval", "skill"]];
-  static usage = Command40.Usage({
+  static usage = Command41.Usage({
     description: "Vet one inbox skill candidate: promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
   });
-  candidate = Option37.String();
-  skillsDir = Option37.String("--skills-dir");
-  noJudge = Option37.Boolean("--no-judge", false);
-  deployment = Option37.String("--deployment");
-  output = Option37.String("--output");
+  candidate = Option38.String();
+  skillsDir = Option38.String("--skills-dir");
+  noJudge = Option38.Boolean("--no-judge", false);
+  deployment = Option38.String("--deployment");
+  output = Option38.String("--output");
   executeCommand() {
     return Promise.resolve(this._runCommand());
   }
@@ -22849,7 +22981,7 @@ var EvalSkillCommand = class extends M8tCommand {
 import { spawnSync as spawnSync5 } from "child_process";
 import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync18, existsSync as existsSync15, readdirSync as readdirSync2 } from "fs";
 import { join as join27 } from "path";
-import { Command as Command41, Option as Option38 } from "clipanion";
+import { Command as Command42, Option as Option39 } from "clipanion";
 init_errors();
 init_esm();
 function parseArmToken(tok, opts) {
@@ -23079,24 +23211,24 @@ function buildPlan(args) {
 }
 var EvalExamCommand = class extends M8tCommand {
   static paths = [["eval", "exam"]];
-  static usage = Command41.Usage({
+  static usage = Command42.Usage({
     description: "Run a brain exam: impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
   });
-  worker = Option38.String();
-  arms = Option38.String("--arms");
-  taskSet = Option38.String("--task-set");
-  examType = Option38.String("--exam-type");
-  skill = Option38.String("--skill");
-  reps = Option38.String("-n,--reps");
-  probes = Option38.String("--probes");
-  pool = Option38.String("--pool");
-  out = Option38.String("--out");
-  dryRun = Option38.Boolean("--dry-run", false);
-  keepArms = Option38.Boolean("--keep-arms", false);
-  allowStub = Option38.Boolean("--allow-stub", false);
-  deployment = Option38.String("--deployment");
-  output = Option38.String("--output");
-  observeWaitS = Option38.String("--observe-wait-s");
+  worker = Option39.String();
+  arms = Option39.String("--arms");
+  taskSet = Option39.String("--task-set");
+  examType = Option39.String("--exam-type");
+  skill = Option39.String("--skill");
+  reps = Option39.String("-n,--reps");
+  probes = Option39.String("--probes");
+  pool = Option39.String("--pool");
+  out = Option39.String("--out");
+  dryRun = Option39.Boolean("--dry-run", false);
+  keepArms = Option39.Boolean("--keep-arms", false);
+  allowStub = Option39.Boolean("--allow-stub", false);
+  deployment = Option39.String("--deployment");
+  output = Option39.String("--output");
+  observeWaitS = Option39.String("--observe-wait-s");
   async executeCommand() {
     await Promise.resolve();
     const worker = typeof this.worker === "string" ? this.worker : void 0;
@@ -23211,10 +23343,10 @@ var EvalExamCommand = class extends M8tCommand {
 };
 
 // src/commands/version.ts
-import { Command as Command42, Option as Option39 } from "clipanion";
+import { Command as Command43, Option as Option40 } from "clipanion";
 var VersionCommand = class extends M8tCommand {
   static paths = [["version"], ["--version"], ["-v"]];
-  static usage = Command42.Usage({
+  static usage = Command43.Usage({
     description: "Print the CLI version.",
     details: "Prints the m8t CLI version. With --verbose, also prints Node version and platform.",
     examples: [
@@ -23222,8 +23354,8 @@ var VersionCommand = class extends M8tCommand {
       ["Print as JSON", "$0 version --output json"]
     ]
   });
-  output = Option39.String("--output", { description: "pretty | json | auto (default)" });
-  verbose = Option39.Boolean("--verbose", false);
+  output = Option40.String("--output", { description: "pretty | json | auto (default)" });
+  verbose = Option40.Boolean("--verbose", false);
   executeCommand() {
     const mode = resolveOutputMode(
       this.output ?? "auto",
@@ -23254,18 +23386,18 @@ var VersionCommand = class extends M8tCommand {
 };
 
 // src/commands/whoami.ts
-import { Command as Command43, Option as Option40 } from "clipanion";
+import { Command as Command44, Option as Option41 } from "clipanion";
 var WhoamiCommand = class extends M8tCommand {
   static paths = [["whoami"]];
-  static usage = Command43.Usage({
+  static usage = Command44.Usage({
     description: "Show your identity + the gateway you'll talk to. Probes the backend."
   });
-  output = Option40.String("--output");
-  verbose = Option40.Boolean("--verbose", false);
-  subscription = Option40.String("--subscription", {
+  output = Option41.String("--output");
+  verbose = Option41.Boolean("--verbose", false);
+  subscription = Option41.String("--subscription", {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
-  resourceGroup = Option40.String("--resource-group", {
+  resourceGroup = Option41.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -23330,7 +23462,7 @@ var WhoamiCommand = class extends M8tCommand {
 };
 
 // src/commands/status.ts
-import { Command as Command44, Option as Option41 } from "clipanion";
+import { Command as Command45, Option as Option42 } from "clipanion";
 
 // src/lib/azd.ts
 init_errors();
@@ -23395,10 +23527,10 @@ async function resolveLocalContext() {
 // src/commands/status.ts
 var StatusCommand = class extends M8tCommand {
   static paths = [["status"]];
-  static usage = Command44.Usage({
+  static usage = Command45.Usage({
     description: "Show the local m8t context: identity, config.yaml, gateway cache, azd mode."
   });
-  output = Option41.String("--output");
+  output = Option42.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -23436,7 +23568,7 @@ var StatusCommand = class extends M8tCommand {
 };
 
 // src/commands/doctor.ts
-import { Command as Command45, Option as Option42 } from "clipanion";
+import { Command as Command46, Option as Option43 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential22 } from "@azure/identity";
 import * as fs26 from "fs";
 import * as os11 from "os";
@@ -23712,12 +23844,12 @@ function probeLegacyStateDir() {
 }
 var DoctorCommand = class extends M8tCommand {
   static paths = [["doctor"]];
-  static usage = Command45.Usage({
+  static usage = Command46.Usage({
     description: "Diagnose the local m8t setup: az login, config.yaml, gateway, Foundry data-plane."
   });
-  output = Option42.String("--output");
-  agent = Option42.String("--agent");
-  resourceGroup = Option42.String("--resource-group", {
+  output = Option43.String("--output");
+  agent = Option43.String("--agent");
+  resourceGroup = Option43.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -23834,7 +23966,7 @@ var DoctorCommand = class extends M8tCommand {
 };
 
 // src/commands/switch.ts
-import { Command as Command46, Option as Option43 } from "clipanion";
+import { Command as Command47, Option as Option44 } from "clipanion";
 
 // src/lib/profiles.ts
 import * as fs27 from "fs/promises";
@@ -23974,14 +24106,14 @@ async function profileSwitch(name, asName) {
 init_errors();
 var SwitchCommand = class extends M8tCommand {
   static paths = [["switch"]];
-  static usage = Command46.Usage({
+  static usage = Command47.Usage({
     description: "Re-point local config at another deployment: --subscription <id|name> (discovery) or <profile>."
   });
-  profile = Option43.String({ required: false });
-  subscription = Option43.String("--subscription");
-  list = Option43.Boolean("--list", false);
-  as = Option43.String("--as");
-  output = Option43.String("--output");
+  profile = Option44.String({ required: false });
+  subscription = Option44.String("--subscription");
+  list = Option44.Boolean("--list", false);
+  as = Option44.String("--as");
+  output = Option44.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -24038,7 +24170,7 @@ var SwitchCommand = class extends M8tCommand {
 
 // src/commands/open.ts
 import { spawn as spawn5 } from "child_process";
-import { Command as Command47, Option as Option44 } from "clipanion";
+import { Command as Command48, Option as Option45 } from "clipanion";
 
 // src/lib/open-targets.ts
 init_errors();
@@ -24084,14 +24216,14 @@ function openUrl(url) {
 }
 var OpenCommand = class extends M8tCommand {
   static paths = [["open"]];
-  static usage = Command47.Usage({
+  static usage = Command48.Usage({
     description: "Open the deployed webapp (default), the Foundry portal, or the resource group.",
     details: "Targets: webapp (deployed app, default) | foundry (ai.azure.com) | portal (resource group in the Azure portal). Pass --print to emit the URL instead of launching a browser (also the default when stdout isn't a TTY)."
   });
-  target = Option44.String({ required: false });
-  print = Option44.Boolean("--print", false);
-  output = Option44.String("--output");
-  resourceGroup = Option44.String("--resource-group", {
+  target = Option45.String({ required: false });
+  print = Option45.Boolean("--print", false);
+  output = Option45.String("--output");
+  resourceGroup = Option45.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -24135,7 +24267,7 @@ var OpenCommand = class extends M8tCommand {
 };
 
 // src/commands/dream/run.ts
-import { Command as Command48, Option as Option45 } from "clipanion";
+import { Command as Command49, Option as Option46 } from "clipanion";
 import { AzureCliCredential } from "@azure/identity";
 import { TableClient as TableClient7 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient3 } from "@azure/ai-projects";
@@ -26362,20 +26494,20 @@ function redactTranscripts(input) {
 }
 var DreamRunCommand = class extends M8tCommand {
   static paths = [["dream", "run"]];
-  static usage = Command48.Usage({
+  static usage = Command49.Usage({
     description: "Dry-run the brain consumption pipeline for one worker (no model call, no writes).",
     details: "Builds AzureCliCredential + resolves the Foundry project, ledger table, and Log Analytics workspace, runs the consumption pipeline, and prints the skip-ledger, the partition invariant, and harvest stats. Transcripts are metadata-only unless --show-transcripts is passed."
   });
-  worker = Option45.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
-  dryRun = Option45.Boolean("--dry-run", false, { description: "Read-only harvest; no model call, no writes." });
-  since = Option45.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
-  reset = Option45.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
-  showTranscripts = Option45.Boolean("--show-transcripts", false, {
+  worker = Option46.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
+  dryRun = Option46.Boolean("--dry-run", false, { description: "Read-only harvest; no model call, no writes." });
+  since = Option46.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
+  reset = Option46.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
+  showTranscripts = Option46.Boolean("--show-transcripts", false, {
     description: "Print transcript bodies (default: metadata only)."
   });
-  subscription = Option45.String("--subscription");
-  endpoint = Option45.String("--endpoint");
-  output = Option45.String("--output");
+  subscription = Option46.String("--subscription");
+  endpoint = Option46.String("--endpoint");
+  output = Option46.String("--output");
   // Resolution seam — overridden by tests; built lazily at runtime otherwise.
   deps;
   async executeCommand() {
@@ -26723,7 +26855,7 @@ function defaultDeps(overrides) {
 }
 
 // src/commands/foundry/create.ts
-import { Command as Command49, Option as Option46 } from "clipanion";
+import { Command as Command50, Option as Option47 } from "clipanion";
 
 // src/lib/foundry-create.ts
 init_errors();
@@ -26961,7 +27093,7 @@ async function createFoundryProject(args) {
 init_errors();
 var FoundryCreateCommand = class extends M8tCommand {
   static paths = [["foundry", "create"]];
-  static usage = Command49.Usage({
+  static usage = Command50.Usage({
     description: "Create an AI Foundry (AIServices) account + project + model deployment from scratch.",
     details: "Non-interactive and idempotent. Creates the AIServices account (custom subdomain + project management), a project, and a model deployment (default gpt-4.1-mini @ capacity 50). Region must be hosted-agent-eligible. Emits the project endpoint as structured output. Re-run is a clean no-op (account/project skipped if present; deployment capacity converges UP, never down).",
     examples: [
@@ -26970,16 +27102,16 @@ var FoundryCreateCommand = class extends M8tCommand {
       ["Higher capacity for a reasoning model", "$0 foundry create --resource-group rg-m8t-stack --location eastus2 --model gpt-5-mini --capacity 250"]
     ]
   });
-  resourceGroup = Option46.String("--resource-group");
-  location = Option46.String("--location");
-  account = Option46.String("--account");
-  project = Option46.String("--project", "m8t");
-  model = Option46.String("--model", "gpt-4.1-mini");
-  modelVersion = Option46.String("--model-version", "2025-04-14");
-  capacity = Option46.String("--capacity", "50");
-  subscription = Option46.String("--subscription");
-  skipQuotaCheck = Option46.Boolean("--skip-quota-check", false);
-  output = Option46.String("--output");
+  resourceGroup = Option47.String("--resource-group");
+  location = Option47.String("--location");
+  account = Option47.String("--account");
+  project = Option47.String("--project", "m8t");
+  model = Option47.String("--model", "gpt-4.1-mini");
+  modelVersion = Option47.String("--model-version", "2025-04-14");
+  capacity = Option47.String("--capacity", "50");
+  subscription = Option47.String("--subscription");
+  skipQuotaCheck = Option47.Boolean("--skip-quota-check", false);
+  output = Option47.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -27051,22 +27183,22 @@ var FoundryCreateCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/await-ready.ts
-import { Command as Command50, Option as Option47 } from "clipanion";
+import { Command as Command51, Option as Option48 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential2 } from "@azure/identity";
 init_errors();
 var FoundryAwaitReadyCommand = class extends M8tCommand {
   static paths = [["foundry", "await-ready"]];
-  static usage = Command50.Usage({
+  static usage = Command51.Usage({
     description: "Wait until a freshly-created Foundry project's data plane reliably serves it.",
     details: "Probes the project (GET /agents) until it returns 200 on a few consecutive tries, or fails clearly after a bounded budget. A newly-created account can serve intermittent 404 'Project not found' for minutes; run this after 'foundry create' and before deploying agents so the worker phase doesn't catch the unstable window.",
     examples: [["Wait for a project to be ready", "$0 foundry await-ready --endpoint https://acc.services.ai.azure.com/api/projects/m8t"]]
   });
-  endpoint = Option47.String("--endpoint");
-  consecutive = Option47.String("--consecutive", "3");
-  attempts = Option47.String("--attempts", "60");
-  interval = Option47.String("--interval", "5");
-  subscription = Option47.String("--subscription");
-  output = Option47.String("--output");
+  endpoint = Option48.String("--endpoint");
+  consecutive = Option48.String("--consecutive", "3");
+  attempts = Option48.String("--attempts", "60");
+  interval = Option48.String("--interval", "5");
+  subscription = Option48.String("--subscription");
+  output = Option48.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const endpoint = typeof this.endpoint === "string" ? this.endpoint : void 0;
@@ -27100,7 +27232,7 @@ var FoundryAwaitReadyCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/preflight.ts
-import { Command as Command51, Option as Option48 } from "clipanion";
+import { Command as Command52, Option as Option49 } from "clipanion";
 
 // ../../packages/telemetry-contract/artifact/tier-map.ts
 var EVENT_TIERS = {
@@ -27116,8 +27248,12 @@ var EVENT_TIERS = {
 };
 var EVENT_ENUM = Object.keys(EVENT_TIERS);
 
+// ../../packages/telemetry-contract/artifact/cadence.ts
+var HEARTBEAT_CADENCE_MS = 3 * 60 * 60 * 1e3;
+var HEARTBEAT_CADENCE_HOURS = HEARTBEAT_CADENCE_MS / (60 * 60 * 1e3);
+
 // ../../packages/telemetry-contract/src/disclosure.ts
-var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals. Your installation is identified only by a random installation ID we generate at setup \u2014 an opaque value with no information encoded in it. No name, email, company, or subscription information is sent in the enrollment record unless you explicitly choose to share contact details for support. At enrollment, we also verify a cloud identity token to confirm the request comes from a real cloud account; that token names the account making the request, and is otherwise discarded immediately and never stored. This is service data used only to operate and support the platform; it contains none of your content. Details: TELEMETRY.md.";
+var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals. Your installation is identified only by a random installation ID we generate at setup \u2014 an opaque value with no information encoded in it. No name, email, company, or subscription information is sent in the enrollment record unless you explicitly choose to share contact details for support. At enrollment, we also verify a cloud identity token to confirm the request comes from a real cloud account; that token names the account making the request, and is otherwise discarded immediately and never stored. This is service data used only to operate and support the platform; it contains none of your content. After setup, you can turn this off in the web app's Settings, under Privacy; update checks keep working. Details: TELEMETRY.md.";
 
 // ../../packages/telemetry-contract/src/endpoints.ts
 var INGEST_BASE_URL = (process.env.M8T_INGEST_BASE_URL ?? "").trim() || "https://m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io";
@@ -27211,7 +27347,7 @@ function buildPreflightBanner(who) {
 // src/commands/bootstrap/preflight.ts
 var BootstrapPreflightCommand = class extends M8tCommand {
   static paths = [["bootstrap", "preflight"]];
-  static usage = Command51.Usage({
+  static usage = Command52.Usage({
     description: "Loudly verify you can install m8t (Owner/UAA + directory admin) and hard-stop if not.",
     details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), and registers Microsoft.ContainerInstance. Exits non-zero with the exact failing check + remedy.",
     examples: [
@@ -27219,8 +27355,8 @@ var BootstrapPreflightCommand = class extends M8tCommand {
       ["BYO app registration (directory guests)", "$0 bootstrap preflight --client-id <appId>"]
     ]
   });
-  clientId = Option48.String("--client-id");
-  subscription = Option48.String("--subscription");
+  clientId = Option49.String("--client-id");
+  subscription = Option49.String("--subscription");
   async executeCommand() {
     const clientId = typeof this.clientId === "string" ? this.clientId : void 0;
     const account = await getAzAccount();
@@ -27283,7 +27419,7 @@ ${colors.error("  " + why)}
 import * as fs30 from "fs";
 import * as os14 from "os";
 import * as path32 from "path";
-import { Command as Command52, Option as Option49 } from "clipanion";
+import { Command as Command53, Option as Option50 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-mi.ts
@@ -27387,6 +27523,7 @@ function buildAciCreateArgs(s) {
   ];
   if (s.gatewayImageRef) env.push(`GATEWAY_IMAGE_REF=${s.gatewayImageRef}`);
   if (s.foundryTracing) env.push(`FOUNDRY_TRACING=${s.foundryTracing}`);
+  if (s.skipBrains) env.push("SKIP_BRAINS=true");
   if (s.updateChannelUrl) env.push(`M8T_UPDATE_CHANNEL_URL=${s.updateChannelUrl}`);
   if (s.enrollContactEmail) env.push(`M8T_ENROLL_CONTACT_EMAIL=${s.enrollContactEmail}`);
   if (s.enrollCompany) env.push(`M8T_ENROLL_COMPANY=${s.enrollCompany}`);
@@ -27622,15 +27759,36 @@ function buildOccupiedRefusal(args) {
   ].join("\n");
 }
 
+// src/lib/bootstrap-launch-guards.ts
+function buildMissingCredsRefusal(credsPath) {
+  return `
+${colors.error("\u2717")} No GitHub App credentials found at ${colors.field(credsPath)}.
+  Your workers' brains are private repositories created through that App, so the install
+  needs it before it starts.
+
+  ${colors.hint("fix:")} m8t brain app-create --org <org>
+
+`;
+}
+function buildOrgMismatchRefusal(args) {
+  return `
+${colors.error("\u2717")} The GitHub App on disk is installed on ${colors.field(args.recorded)}, but this launch asked for ${colors.field(args.requested)}.
+  Brains would land in ${args.recorded}, not ${args.requested}.
+
+  ${colors.hint("fix:")} m8t brain app-create --org ${args.requested}
+
+`;
+}
+
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.43";
+var DEFAULT_INSTALLER_TAG = "v0.1.44";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
   static paths = [["bootstrap", "launch"]];
-  static usage = Command52.Usage({
+  static usage = Command53.Usage({
     description: "Create + authorize the installer managed identity, then kick the cloud installer.",
     details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t/bootstrap.json for `status`/`reap`/`finish`.",
     examples: [
@@ -27641,24 +27799,26 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Share a support contact", "$0 bootstrap launch --location eastus2 --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  location = Option49.String("--location");
-  resourceGroup = Option49.String("--resource-group");
-  clientId = Option49.String("--client-id");
-  subscription = Option49.String("--subscription");
-  installerTag = Option49.String("--installer-tag");
+  location = Option50.String("--location");
+  resourceGroup = Option50.String("--resource-group");
+  clientId = Option50.String("--client-id");
+  subscription = Option50.String("--subscription");
+  installerTag = Option50.String("--installer-tag");
   // Full image ref override (registry + repo + tag) — an escape hatch when the
   // default org/tag is wrong for the current CLI (e.g. a stale published build).
   // Wins over --installer-tag / the pinned default.
-  installerImage = Option49.String("--installer-image");
-  gatewayImageRef = Option49.String("--gateway-image-ref");
-  githubAppCreds = Option49.String("--github-app-creds");
-  contactEmail = Option49.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  company = Option49.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  installerImage = Option50.String("--installer-image");
+  gatewayImageRef = Option50.String("--gateway-image-ref");
+  githubAppCreds = Option50.String("--github-app-creds");
+  contactEmail = Option50.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  company = Option50.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
   // Value-carrying on purpose: a bare --force would be cargo-culted into
   // runbooks and harness prompts and erode the protection, whereas a faithful
   // paste can never accidentally carry the victim group's name. It AUTHORIZES
   // the target; --resource-group is what CHOOSES it.
-  reinstallInto = Option49.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
+  reinstallInto = Option50.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
+  org = Option50.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
+  noBrains = Option50.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -27698,8 +27858,19 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       return 0;
     }
     const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path32.join(os14.homedir(), ".m8t", "github-app.json");
+    const skipBrains = this.noBrains === true;
+    const requestedOrg = typeof this.org === "string" ? this.org : void 0;
     let githubApp;
-    if (fs30.existsSync(credsPath)) {
+    if (skipBrains) {
+      out("installing without brain-backed workers; no GitHub App credentials will be used");
+    } else if (!fs30.existsSync(credsPath)) {
+      this.context.stderr.write(buildMissingCredsRefusal(credsPath));
+      throw new LocalCliError({
+        code: "GITHUB_APP_CREDS_MISSING",
+        message: `No GitHub App credentials at ${credsPath}.`,
+        hint: "Run `m8t brain app-create --org <org>` first."
+      });
+    } else {
       let parsed;
       try {
         parsed = JSON.parse(fs30.readFileSync(credsPath, "utf8"));
@@ -27710,6 +27881,14 @@ var BootstrapLaunchCommand = class extends M8tCommand {
           hint: "Run `m8t brain app-create --org <org>` to regenerate."
         });
       }
+      if (requestedOrg !== void 0 && requestedOrg.toLowerCase() !== parsed.org.toLowerCase()) {
+        this.context.stderr.write(buildOrgMismatchRefusal({ requested: requestedOrg, recorded: parsed.org }));
+        throw new LocalCliError({
+          code: "GITHUB_APP_ORG_MISMATCH",
+          message: `GitHub App creds are for '${parsed.org}', but --org named '${requestedOrg}'.`,
+          hint: `Run \`m8t brain app-create --org ${requestedOrg}\` first.`
+        });
+      }
       let pem;
       try {
         pem = fs30.readFileSync(parsed.pemPath, "utf8");
@@ -27727,9 +27906,11 @@ var BootstrapLaunchCommand = class extends M8tCommand {
         installationId: parsed.installationId,
         pemB64: Buffer.from(pem).toString("base64")
       };
+      const stillInstalled = await findValidBrainApp(credsPath, parsed.org);
+      if (stillInstalled === null) {
+        out(`warning: could not confirm the GitHub App is still installed on ${parsed.org} - continuing`);
+      }
       out(`threading GitHub App creds for org ${parsed.org} (app ${parsed.appId})\u2026`);
-    } else {
-      out(`no GitHub App creds found at ${credsPath} \u2014 skipping (brain workers will not be deployed; run \`m8t brain app-create --org <org>\` first if you want them)`);
     }
     out("registering Microsoft.ContainerInstance\u2026");
     await registerContainerInstance(subscriptionId);
@@ -27773,6 +27954,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       gatewayImageRef,
       foundryTracing: "skip",
       githubApp,
+      ...skipBrains ? { skipBrains: true } : {},
       // Opt-in only. The signed-in UPN was previously seeded here automatically;
       // an installation is identified by its random instance id, and contact
       // details are sent only when the operator asks for them.
@@ -27790,7 +27972,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/status.ts
-import { Command as Command53, Option as Option50 } from "clipanion";
+import { Command as Command54, Option as Option51 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-aci-state.ts
@@ -27818,13 +28000,13 @@ async function getAciState(opts) {
 // src/commands/bootstrap/status.ts
 var BootstrapStatusCommand = class extends M8tCommand {
   static paths = [["bootstrap", "status"]];
-  static usage = Command53.Usage({
+  static usage = Command54.Usage({
     description: "Show the cloud installer's live status (phase, progress, result).",
     details: "Reads the durable status blob written by the installer. --watch polls until the install reaches done or failed.",
     examples: [["One read", "$0 bootstrap status"], ["Watch to completion", "$0 bootstrap status --watch"]]
   });
-  watch = Option50.Boolean("--watch", false);
-  output = Option50.String("--output");
+  watch = Option51.Boolean("--watch", false);
+  output = Option51.String("--output");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -27846,6 +28028,20 @@ var BootstrapStatusCommand = class extends M8tCommand {
         doc = await readStatusBlob({ saName: state.statusSaName, resourceGroup: state.resourceGroup, subscriptionId: state.subscriptionId });
       } catch (e) {
         if (watch && e instanceof LocalCliError && e.code === "BOOTSTRAP_STATUS_UNREADABLE") {
+          const early = await getAciState({
+            aciName: state.aciName,
+            resourceGroup: state.resourceGroup,
+            subscriptionId: state.subscriptionId
+          }).catch(() => null);
+          if (early?.terminated) {
+            this.context.stderr.write(
+              `  ${colors.error("\u2717")} the installer container has terminated (exit ${String(early.exitCode ?? "?")}) and never reported a status.
+  ${colors.hint("inspect:")} az container logs -n ${state.aciName} -g ${state.resourceGroup}
+  ${colors.hint("reap:")} m8t bootstrap reap --force
+`
+            );
+            return 1;
+          }
           if (mode === "pretty") this.context.stderr.write(`  ${colors.dim("waiting for the installer to start\u2026")}
 `);
           await sleep5(1e4);
@@ -27895,7 +28091,7 @@ function formatStatus(d) {
 }
 
 // src/commands/bootstrap/reap.ts
-import { Command as Command54, Option as Option51 } from "clipanion";
+import { Command as Command55, Option as Option52 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-reap.ts
@@ -27989,14 +28185,14 @@ async function reapInstaller(opts) {
 // src/commands/bootstrap/reap.ts
 var BootstrapReapCommand = class extends M8tCommand {
   static paths = [["bootstrap", "reap"]];
-  static usage = Command54.Usage({
+  static usage = Command55.Usage({
     description: "Tear down the installer scaffolding (ACI \u2192 MI \u2192 its role assignments) after a successful install.",
     details: "Runs locally on the 'done' signal (the installer can't delete its own identity). The platform RG and the gateway's own assignments persist. A failed install is left intact for diagnosis unless --force.",
     examples: [["Reap after done", "$0 bootstrap reap"]]
   });
-  force = Option51.Boolean("--force", false);
-  sweepOrphans = Option51.Boolean("--sweep-orphans", false);
-  yes = Option51.Boolean("--yes", false);
+  force = Option52.Boolean("--force", false);
+  sweepOrphans = Option52.Boolean("--sweep-orphans", false);
+  yes = Option52.Boolean("--yes", false);
   async executeCommand() {
     if (this.sweepOrphans === true) {
       const { subscriptionId: sub } = await getAzAccount();
@@ -28093,7 +28289,7 @@ Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors
 import * as fs31 from "fs/promises";
 import * as os16 from "os";
 import * as path34 from "path";
-import { Command as Command55, Option as Option52 } from "clipanion";
+import { Command as Command56, Option as Option53 } from "clipanion";
 init_errors();
 
 // src/lib/company-profile-seed.ts
@@ -29058,14 +29254,14 @@ function renderInstallSummary(args) {
 // src/commands/bootstrap/finish.ts
 var BootstrapFinishCommand = class extends M8tCommand {
   static paths = [["bootstrap", "finish"]];
-  static usage = Command55.Usage({
+  static usage = Command56.Usage({
     description: "Point your local tools at the now-live platform (repo-root marker, discovery cache, next steps).",
     details: "Final step of `m8t bootstrap` (after the install reaches done). Writes ~/.m8t/repo-root, points your local tools at the live gateway, and \u2014 if you completed the onboarding intake \u2014 seeds your brain-backed advisor's brain with your company profile (best-effort; never blocks finish). Run `m8t bootstrap seed-profile` to seed manually later.",
     examples: [["Finish local", "$0 bootstrap finish --repo-root /path/to/m8t"]]
   });
-  repoRoot = Option52.String("--repo-root");
-  subscription = Option52.String("--subscription");
-  resourceGroup = Option52.String("--resource-group");
+  repoRoot = Option53.String("--repo-root");
+  subscription = Option53.String("--subscription");
+  resourceGroup = Option53.String("--resource-group");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -29168,7 +29364,7 @@ ${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP se
 import * as fs33 from "fs";
 import * as os18 from "os";
 import * as path36 from "path";
-import { Command as Command56, Option as Option53 } from "clipanion";
+import { Command as Command57, Option as Option54 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential23 } from "@azure/identity";
 init_errors();
 
@@ -29976,7 +30172,7 @@ function renderDeployFailure(error) {
 }
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
-  static usage = Command56.Usage({
+  static usage = Command57.Usage({
     description: "Deploy Azzy + start the local onboarding chat UI in the background (returns immediately).",
     details: [
       "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Waits for the cloud",
@@ -29997,16 +30193,16 @@ var BootstrapUiCommand = class extends M8tCommand {
       ["Experimental: start the voice relay (no effect on the text-only intake)", "$0 bootstrap ui --repo-root /path/to/m8t --voice"]
     ]
   });
-  repoRoot = Option53.String("--repo-root");
-  port = Option53.String("--port", "3000");
-  endpoint = Option53.String("--endpoint", {
+  repoRoot = Option54.String("--repo-root");
+  port = Option54.String("--port", "3000");
+  endpoint = Option54.String("--endpoint", {
     description: "Foundry project endpoint to target \u2014 disambiguates when the subscription has multiple projects."
   });
-  prepOnly = Option53.Boolean("--prep-only", false);
-  skipInstall = Option53.Boolean("--skip-install", false);
-  stop = Option53.Boolean("--stop", false);
-  foreground = Option53.Boolean("--foreground", false);
-  voice = Option53.Boolean("--voice", false, {
+  prepOnly = Option54.Boolean("--prep-only", false);
+  skipInstall = Option54.Boolean("--skip-install", false);
+  stop = Option54.Boolean("--stop", false);
+  foreground = Option54.Boolean("--foreground", false);
+  voice = Option54.Boolean("--voice", false, {
     description: "Experimental: when serving, starts the voice relay and writes the intake voice env var. The onboarding intake is text-only and is unaffected by this flag \u2014 no voice worker is registered for it."
   });
   async executeCommand() {
@@ -30168,10 +30364,10 @@ var BootstrapUiCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command57, Option as Option54 } from "clipanion";
+import { Command as Command58, Option as Option55 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command57.Usage({
+  static usage = Command58.Usage({
     description: "Seed your advisors' brains with the founder + company profile from the onboarding intake.",
     details: "Reads the latest onboarding conversation, renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines), and commits them to both <org>/stacey-brain and <org>/azzy-brain via the GitHub App. Idempotent. --watch polls until the founder finishes the intake.",
     examples: [
@@ -30179,11 +30375,11 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       ["Wait for the founder to finish", "$0 bootstrap seed-profile --watch"]
     ]
   });
-  endpoint = Option54.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option54.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/azzy-brain." });
-  watch = Option54.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
-  timeout = Option54.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option54.String("--github-app-creds");
+  endpoint = Option55.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option55.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/azzy-brain." });
+  watch = Option55.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
+  timeout = Option55.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option55.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -30246,7 +30442,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 import * as fs34 from "fs";
 import * as os19 from "os";
 import * as path37 from "path";
-import { Command as Command58, Option as Option55 } from "clipanion";
+import { Command as Command59, Option as Option56 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
@@ -30328,7 +30524,7 @@ async function resolveKeyVaultName(containerAppResourceId) {
 }
 var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
-  static usage = Command58.Usage({
+  static usage = Command59.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
     details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
     examples: [
@@ -30336,11 +30532,11 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  company = Option55.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
-  contactEmail = Option55.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  subscription = Option55.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
-  resourceGroup = Option55.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option55.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
+  company = Option56.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option56.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option56.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
+  resourceGroup = Option56.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option56.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -30421,6 +30617,7 @@ cli.register(BrainCheckAppCommand);
 cli.register(BrainCreateCommand);
 cli.register(BrainLinkCommand);
 cli.register(BrainListCommand);
+cli.register(BrainOrgsCommand);
 cli.register(BrainShowCommand);
 cli.register(BrainUnlinkCommand);
 cli.register(ArchitectCheckCommand);