@mrciphersmith/keryx 0.2.110 → 0.2.111

package/dist/cli.js

@@ -589,6 +589,44 @@ var init_grants = __esm(() => {
   ];
 });
 
+// src/lib/caller-session.ts
+function resolveCallerSession(input = {}) {
+  const pair = (provider, model, source) => ({
+    providerId: (provider ?? "").trim(),
+    modelId: (model ?? "").trim(),
+    source
+  });
+  if (input.flagProvider !== undefined || input.flagModel !== undefined) {
+    return pair(input.flagProvider, input.flagModel, "flags");
+  }
+  const env = input.env ?? process.env;
+  const envProvider = env[ENV_SESSION_PROVIDER];
+  const envModel = env[ENV_SESSION_MODEL];
+  if ((envProvider ?? "").trim() !== "" || (envModel ?? "").trim() !== "") {
+    return pair(envProvider, envModel, "env");
+  }
+  if (input.fromShellConfig === true) {
+    const config = loadShellConfig(input.configDir);
+    return pair(config.provider, config.model, "shell-config");
+  }
+  return pair(undefined, undefined, "none");
+}
+function exportCallerSession(providerId, modelId, env = process.env) {
+  const provider = providerId.trim();
+  const model = modelId.trim();
+  if (provider === "" || model === "") {
+    delete env[ENV_SESSION_PROVIDER];
+    delete env[ENV_SESSION_MODEL];
+    return;
+  }
+  env[ENV_SESSION_PROVIDER] = provider;
+  env[ENV_SESSION_MODEL] = model;
+}
+var ENV_SESSION_PROVIDER = "KERYX_SESSION_PROVIDER", ENV_SESSION_MODEL = "KERYX_SESSION_MODEL";
+var init_caller_session = __esm(() => {
+  init_shell_config();
+});
+
 // src/lib/args.ts
 import { parseArgs } from "util";
 function optionValue(args, name) {
@@ -907,21 +945,23 @@ function runCrossFamily(args) {
   const decision = crossFamilyReviewForSession(args.includes("--opt-in"), {
     providerId: optionValue(args, "--session-provider"),
     modelId: optionValue(args, "--session-model")
-  });
+  }, { fromShellConfig: args.includes("--from-shell-config") });
   if (args.includes("--json")) {
     console.log(JSON.stringify({ cross_family_review: decision }, null, 2));
     return;
   }
   console.log(renderCrossFamilyDecision(decision));
 }
-function crossFamilyReviewForSession(optIn, session = {}) {
-  const config = loadShellConfig();
+function crossFamilyReviewForSession(optIn, session = {}, options = {}) {
+  const resolved = resolveCallerSession({
+    flagProvider: session.providerId,
+    flagModel: session.modelId,
+    fromShellConfig: options.fromShellConfig,
+    env: options.env
+  });
   return decideCrossFamilyReview({
     optIn,
-    session: {
-      providerId: (session.providerId ?? config.provider ?? "").trim(),
-      modelId: (session.modelId ?? config.model ?? "").trim()
-    },
+    session: { providerId: resolved.providerId, modelId: resolved.modelId },
     configured: configuredProviders(envWithOAuthAccess(envWithSavedApiKeys()))
   });
 }
@@ -963,7 +1003,7 @@ function printProvidersHelp() {
 
 Usage:
   keryx providers list [--json]
-  keryx providers cross-family [--opt-in] [--session-provider <id>] [--session-model <id>] [--json]
+  keryx providers cross-family [--opt-in] [--session-provider <id>] [--session-model <id>] [--from-shell-config] [--json]
 
 Commands:
   list          Providers this operator has configured, and the family of each
@@ -982,6 +1022,7 @@ var init_providers = __esm(() => {
   init_provider_config();
   init_catalog();
   init_grants();
+  init_caller_session();
   init_shell_config();
   init_args();
   OPENAI_COMPAT_PROVIDERS = [
@@ -8724,6 +8765,7 @@ function parseSkillFrontmatter(content) {
   let inTriggers = false;
   let inMetadata = false;
   let metadataCategory;
+  let metadataVersion;
   let compatibleHarnesses;
   let awaitingHarnessesList = false;
   let descriptionBlock = null;
@@ -8785,6 +8827,11 @@ function parseSkillFrontmatter(content) {
           metadataCategory = stripSkillFieldQuotes(categoryMatch[1].trim());
           continue;
         }
+        const versionMatch = /^\s+version:\s*(.+)$/.exec(line);
+        if (versionMatch !== null && versionMatch[1] !== undefined) {
+          metadataVersion = stripSkillFieldQuotes(versionMatch[1].trim());
+          continue;
+        }
         const harnessesMatch = /^\s+compatible_harnesses:\s*(.*)$/.exec(line);
         if (harnessesMatch !== null) {
           const inline = parseInlineHarnesses((harnessesMatch[1] ?? "").trim());
@@ -8805,6 +8852,7 @@ function parseSkillFrontmatter(content) {
     ...description !== undefined ? { description } : {},
     ...triggers.length > 0 ? { triggers } : {},
     ...metadataCategory !== undefined ? { metadataCategory } : {},
+    ...metadataVersion !== undefined ? { metadataVersion } : {},
     ...compatibleHarnesses !== undefined ? { compatibleHarnesses } : {}
   };
 }
@@ -25690,7 +25738,7 @@ async function createProjectSkill(projectRoot, options) {
         name: skillName,
         target: options.target,
         path: relativeSkillPath,
-        version: VERSION,
+        version: options.version ?? VERSION,
         status: "active",
         updatedAt: new Date().toISOString()
       });
@@ -33188,7 +33236,7 @@ function guardGitHubRequest(request) {
   if (allowed.some((pattern) => pattern.test(request.path))) {
     return;
   }
-  throw new Error(`Refusing a GitHub ${request.method} to \`${request.path}\`: it is not one of the five endpoints this module may touch. ` + `Reads: pulls/{n}/comments, pulls/{n}/reviews, issues/{n}/comments. Writes: pulls/{n}/comments/{id}/replies, issues/{n}/comments. ` + `Resolving, hiding, minimising, editing and dismissing are deliberately unreachable \u2014 replying is ours, resolving is the reviewer's call, and a bot that auto-resolves is a bot that silences a human.`);
+  throw new Error(`Refusing a GitHub ${request.method} to \`${request.path}\`: it is not one of the six endpoints this module may touch. ` + `Reads: pulls/{n}, pulls/{n}/comments, pulls/{n}/reviews, issues/{n}/comments. Writes: pulls/{n}/comments/{id}/replies, issues/{n}/comments. ` + `Resolving, hiding, minimising, editing and dismissing are deliberately unreachable \u2014 replying is ours, resolving is the reviewer's call, and a bot that auto-resolves is a bot that silences a human.`);
 }
 async function callGitHub(port, request) {
   guardGitHubRequest(request);
@@ -33272,6 +33320,8 @@ function createFixturePort(files, options = {}) {
 }
 function fixtureKey(apiPath) {
   const withoutQuery = apiPath.split("?")[0] ?? apiPath;
+  if (/\/pulls\/\d+$/.test(withoutQuery))
+    return "pull";
   if (/\/pulls\/\d+\/comments$/.test(withoutQuery))
     return "pull-comments";
   if (/\/pulls\/\d+\/reviews$/.test(withoutQuery))
@@ -33280,12 +33330,37 @@ function fixtureKey(apiPath) {
     return "issue-comments";
   return withoutQuery;
 }
+function parsePullRequest(raw) {
+  const object = Array.isArray(raw) ? raw[0] : raw;
+  const state = stringProperty(object, "state");
+  const mergedAt = stringProperty(object, "merged_at") ?? null;
+  const mergedFlag = object !== null && typeof object === "object" && object.merged === true;
+  const head = object !== null && typeof object === "object" ? object.head : undefined;
+  const headSha = stringProperty(head, "sha") ?? null;
+  return {
+    state: state === "open" || state === "closed" ? state : "unknown",
+    merged: mergedFlag || mergedAt !== null,
+    mergedAt,
+    headSha: headSha === null ? null : headSha.toLowerCase()
+  };
+}
+function describePullRequest(pull) {
+  const status = pull.merged ? `merged${pull.mergedAt === null ? "" : ` at ${pull.mergedAt}`}` : pull.state;
+  return `${status}, head ${pull.headSha ?? "not reported"}`;
+}
+function shaMatchesHead(sha, headSha) {
+  if (headSha === null)
+    return false;
+  const wanted = sha.trim().toLowerCase();
+  return wanted === headSha || wanted.length >= 7 && headSha.startsWith(wanted);
+}
 async function collectPrComments(input) {
   if (input.self.trim() === "") {
     throw new Error("Refusing to collect PR comments with no `self` identity: without it our own replies are indistinguishable from a reviewer's, and the reply pass answers itself every round. Resolve the acting login (`gh api user --jq .login`) and pass it.");
   }
   const base = `repos/${input.repo}`;
-  const [rawReviewComments, rawReviews, rawIssueComments] = await Promise.all([
+  const [rawPull, rawReviewComments, rawReviews, rawIssueComments] = await Promise.all([
+    callGitHub(input.port, { method: "GET", path: `${base}/pulls/${input.number}` }),
     callGitHub(input.port, { method: "GET", path: `${base}/pulls/${input.number}/comments` }),
     callGitHub(input.port, { method: "GET", path: `${base}/pulls/${input.number}/reviews` }),
     callGitHub(input.port, { method: "GET", path: `${base}/issues/${input.number}/comments` })
@@ -33363,6 +33438,7 @@ async function collectPrComments(input) {
     });
   }
   return {
+    pull: parsePullRequest(rawPull),
     comments,
     skipped,
     counts: {
@@ -33884,10 +33960,23 @@ function unansweredComments(state) {
   const answered = new Set(state.handled_comments.filter((entry) => entry.reply_url !== null).map((entry) => entry.id));
   return state.seen.filter((entry) => !answered.has(entry.id));
 }
+function assertReplyTarget(input) {
+  const where = `${input.repo}#${input.number}`;
+  if (input.pull.state === "unknown") {
+    throw new Error(`Refusing to reply on ${where}: the pull request's state could not be read, so nothing shows it is open or that ${input.sha} is its head. Re-run with a reachable \`gh\`, or supply \`pull.json\` with \`--fixtures\`.`);
+  }
+  if ((input.pull.merged || input.pull.state === "closed") && input.allowClosed !== true) {
+    throw new Error(`Refusing to reply on ${where}: the pull request is ${describePullRequest(input.pull)}. Replies are for an open review; posting to a finished one is an outward action nobody gated. Pass \`--allow-closed-pr\` only if answering after close is intended.`);
+  }
+  if (!shaMatchesHead(input.sha, input.pull.headSha)) {
+    throw new Error(`Refusing to reply on ${where}: \`--sha ${input.sha}\` is not the pull request's head (${input.pull.headSha ?? "not reported"}). Every reply would describe a commit the pull request no longer points at. Collect and review the current head, then reply with its SHA.`);
+  }
+}
 async function postReplyPass(input) {
   if (!input.round.isFinal) {
     throw new Error(`Refusing to post replies during round ${input.round.index}: comments are collected every round and answered ONCE, after the final round and before the completion gate. Replying per round turns one review thread into six, and every reply would state an intention rather than a settled outcome.`);
   }
+  assertReplyTarget(input);
   const now = (input.now ?? new Date).toISOString();
   const alreadyAnswered = new Map(input.state.handled_comments.map((entry) => [entry.id, entry]));
   const posted = [];
@@ -34102,6 +34191,7 @@ var init_pr_comments = __esm(() => {
   init_fs();
   init_types3();
   ALLOWED_GITHUB_READS = [
+    /^repos\/[^/]+\/[^/]+\/pulls\/\d+$/,
     /^repos\/[^/]+\/[^/]+\/pulls\/\d+\/comments(\?[^\s]*)?$/,
     /^repos\/[^/]+\/[^/]+\/pulls\/\d+\/reviews(\?[^\s]*)?$/,
     /^repos\/[^/]+\/[^/]+\/issues\/\d+\/comments(\?[^\s]*)?$/
@@ -40936,9 +41026,9 @@ var init_memory = __esm(() => {
 
 // src/lib/serve-config.ts
 import { existsSync as existsSync26 } from "fs";
-import path176 from "path";
+import path177 from "path";
 function serveConfigPath(dir) {
-  return path176.join(keryxConfigDir(dir), "serve.json");
+  return path177.join(keryxConfigDir(dir), "serve.json");
 }
 function parseIpv4(value) {
   const parts = value.split(".");
@@ -48687,7 +48777,7 @@ import path47 from "path";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.110",
+  version: "0.2.111",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -56982,7 +57072,7 @@ init_args();
 init_fs();
 init_json();
 import { readdir as readdir25, readFile as readFile83 } from "fs/promises";
-import path147 from "path";
+import path148 from "path";
 
 // src/lib/route-tokens.ts
 var ROUTE_STOPWORDS = new Set([
@@ -57669,8 +57759,32 @@ init_project_skills();
 // src/gdskills/import-skills.ts
 init_args();
 init_fs();
-import { readdir as readdir24, readFile as readFile81, stat as stat15 } from "fs/promises";
+import { mkdir as mkdir50, readdir as readdir24, readFile as readFile81, stat as stat15 } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import path145 from "path";
+
+// src/gdskills/rule-references.ts
+init_fs();
 import path144 from "path";
+function ruleReferences(content) {
+  const refs = new Set;
+  for (const match of content.matchAll(/`(?:\.metaproject\/)?(?:rules\/)?([a-z0-9_-]+\/[a-z0-9._-]+\.mdc)`/gi)) {
+    if (match[1])
+      refs.add(match[1]);
+  }
+  return [...refs].sort();
+}
+async function unresolvedRuleReferences(projectRoot, content) {
+  const missing = [];
+  for (const ref of ruleReferences(content)) {
+    if (!await pathExists(path144.join(projectRoot, ".metaproject", "rules", ref))) {
+      missing.push(ref);
+    }
+  }
+  return missing;
+}
+
+// src/gdskills/import-skills.ts
 init_project_skills();
 init_guard2();
 var BUNDLED_NAMES = new Set(BUNDLED_GDSKILLS.map((entry) => entry.name));
@@ -57687,9 +57801,11 @@ async function importProjectSkills(options) {
   for (const source of sources) {
     imported.push(await importOne(options, source));
   }
+  const rules = await importReferencedRules(options, sources.filter((source) => options.force === true || !BUNDLED_NAMES.has(source.name)));
   return {
     from: options.from,
     imported,
+    rules,
     dryRun: options.dryRun === true,
     force: options.force === true
   };
@@ -57707,6 +57823,7 @@ async function updateProjectSkills(options) {
   return {
     from: options.from ?? "(each skill Origin)",
     imported,
+    rules: [],
     dryRun: options.dryRun === true,
     force: true
   };
@@ -57727,6 +57844,14 @@ function renderImportProjectSkillsMarkdown(result) {
     lines.push(`- ${row.module}/${row.name}: ${row.status}${extra ? ` \u2014 ${extra}` : ""}`);
   }
   lines.push("");
+  if (result.rules.length > 0) {
+    lines.push("## rules the skills cite", "");
+    for (const rule of result.rules) {
+      const detail = [rule.origin ? `from ${rule.origin}` : undefined, rule.reason].filter(Boolean).join(" \u2014 ");
+      lines.push(`- ${rule.ref}: ${rule.status}${detail ? ` \u2014 ${detail}` : ""} (cited by ${rule.citedBy.join(", ")})`);
+    }
+    lines.push("");
+  }
   if (result.imported.some((row) => row.module === "review" && row.status !== "skipped")) {
     lines.push("Reviewers: `keryx review reviewers` must list every imported review/* name. That is the same call review-orchestrator makes.");
   }
@@ -57752,6 +57877,21 @@ function githubBlobToRaw(url) {
 function isHttpsSkillUrl(from) {
   return /^https:\/\//i.test(from.trim());
 }
+function isInside4(parent, child) {
+  const relative = path145.relative(parent, child);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path145.sep}`) && !path145.isAbsolute(relative);
+}
+function portableOriginRef(absolute, projectRoot, home = homedir4()) {
+  const resolved = path145.resolve(absolute);
+  const root = path145.resolve(projectRoot);
+  if (isInside4(root, resolved)) {
+    return toPosix(path145.relative(root, resolved));
+  }
+  if (isInside4(home, resolved)) {
+    return `~/${toPosix(path145.relative(home, resolved))}`;
+  }
+  return resolved;
+}
 async function resolveImportSources(options) {
   if (isHttpsSkillUrl(options.from)) {
     return [await sourceFromUrl(options)];
@@ -57762,7 +57902,7 @@ async function resolveImportSources(options) {
   }
   const stats = await stat15(resolved);
   if (stats.isFile()) {
-    return [await sourceFromFile(options, resolved, options.from)];
+    return [await sourceFromFile(options, resolved)];
   }
   if (!stats.isDirectory()) {
     throw new Error(`keryx skills import: --from ${options.from} is not a file or directory`);
@@ -57787,49 +57927,55 @@ async function sourceFromUrl(options) {
   const moduleName = options.module ?? inferModule2(name, response.text);
   return { name, module: moduleName, origin: url, content: response.text };
 }
-async function sourceFromFile(options, absolute, originRef) {
+async function sourceFromFile(options, absolute) {
   const content = await readFile81(absolute, "utf8");
   const name = options.name ?? inferNameFromPath(absolute, content);
   const moduleName = options.module ?? inferModule2(name, content);
-  return { name, module: moduleName, origin: originRef, content };
+  return { name, module: moduleName, origin: portableOriginRef(absolute, options.projectRoot), content, sourcePath: absolute };
 }
 async function sourceFromDirectory(options, absolute) {
   const roots = await skillPackageDirs(absolute);
   const sources = [];
   for (const dir of roots) {
-    const name = path144.basename(dir);
+    const name = path145.basename(dir);
     if (options.namePrefix && !name.startsWith(options.namePrefix))
       continue;
     if (options.name && name !== options.name)
       continue;
-    const skillMd = path144.join(dir, "SKILL.md");
+    const skillMd = path145.join(dir, "SKILL.md");
     const content = await readFile81(skillMd, "utf8");
     const moduleName = options.module ?? inferModule2(name, content);
-    sources.push({ name, module: moduleName, origin: skillMd, content });
+    sources.push({
+      name,
+      module: moduleName,
+      origin: portableOriginRef(skillMd, options.projectRoot),
+      content,
+      sourcePath: skillMd
+    });
   }
   return sources.sort((a, b) => `${a.module}/${a.name}`.localeCompare(`${b.module}/${b.name}`));
 }
 async function skillPackageDirs(root) {
-  if (await pathExists(path144.join(root, "SKILL.md"))) {
+  if (await pathExists(path145.join(root, "SKILL.md"))) {
     return [root];
   }
-  const nestedSkills = path144.join(root, "skills");
+  const nestedSkills = path145.join(root, "skills");
   const scan = await pathExists(nestedSkills) ? nestedSkills : root;
   const entries = await readdir24(scan, { withFileTypes: true });
   const dirs = [];
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const dir = path144.join(scan, entry.name);
-    if (await pathExists(path144.join(dir, "SKILL.md"))) {
+    const dir = path145.join(scan, entry.name);
+    if (await pathExists(path145.join(dir, "SKILL.md"))) {
       dirs.push(dir);
     }
   }
   return dirs;
 }
 async function importOne(options, source) {
-  const dest = path144.posix.join(".metaproject", "project-skills", source.module, source.name);
-  const destAbs = path144.join(options.projectRoot, dest, "SKILL.md");
+  const dest = path145.posix.join(".metaproject", "project-skills", source.module, source.name);
+  const destAbs = path145.join(options.projectRoot, dest, "SKILL.md");
   const exists = await pathExists(destAbs);
   const bundled = BUNDLED_NAMES.has(source.name);
   if (bundled && !options.force) {
@@ -57870,6 +58016,7 @@ async function importOne(options, source) {
     note: `Imported from ${options.from}`,
     origin: source.origin,
     originContent: source.content,
+    ...versionOption(source.content),
     format: "single"
   });
   await overwriteImportedSkill(options.projectRoot, created, source.content);
@@ -57883,9 +58030,9 @@ async function importOne(options, source) {
   };
 }
 async function updateOne(options, entry) {
-  const skillMd = path144.join(options.projectRoot, entry.path, "SKILL.md");
+  const skillMd = path145.join(options.projectRoot, entry.path, "SKILL.md");
   const current = await readFile81(skillMd, "utf8");
-  const origin = options.from ?? metadataLine(current, "Origin");
+  let origin = options.from ?? metadataLine(current, "Origin");
   if (!origin) {
     return {
       name: entry.name,
@@ -57924,6 +58071,7 @@ async function updateOne(options, entry) {
       };
     }
     content = await readFile81(resolved, "utf8");
+    origin = portableOriginRef(resolved, options.projectRoot);
   }
   if (options.dryRun) {
     return {
@@ -57942,6 +58090,7 @@ async function updateOne(options, entry) {
     note: `Updated from origin ${origin}`,
     origin,
     originContent: content,
+    ...versionOption(content),
     format: "single"
   });
   await overwriteImportedSkill(options.projectRoot, created, content);
@@ -57955,11 +58104,11 @@ async function updateOne(options, entry) {
   };
 }
 async function overwriteImportedSkill(projectRoot, created, source) {
-  const skillPath = path144.join(projectRoot, created.skillPath, "SKILL.md");
+  const skillPath = path145.join(projectRoot, created.skillPath, "SKILL.md");
   const scaffold = await readFile81(skillPath, "utf8");
-  const originLines = extractOriginBlock(scaffold);
-  const stamped = stampOrigin(source, originLines);
-  const relative = toPosix(path144.join(created.skillPath, "SKILL.md"));
+  const header = extractImportHeader(scaffold, parseSkillFrontmatter(source).metadataVersion);
+  const stamped = stampImportHeader(source, header);
+  const relative = toPosix(path145.join(created.skillPath, "SKILL.md"));
   const guard = await guardOutput({
     cwd: projectRoot,
     content: stamped,
@@ -57973,15 +58122,26 @@ async function overwriteImportedSkill(projectRoot, created, source) {
   }
   await writeFileAtomic(skillPath, output.content);
 }
-function extractOriginBlock(scaffold) {
+var IMPORT_HEADER_LABELS = [
+  "Version",
+  "Target",
+  "Module",
+  "Origin",
+  "Origin Hash",
+  "Imported At",
+  "Status",
+  "Last Verified"
+];
+var IMPORT_HEADER_LINE = new RegExp(`^(${IMPORT_HEADER_LABELS.join("|")}):\\s`);
+function extractImportHeader(scaffold, version) {
   const lines = scaffold.split(`
-`).filter((line) => /^(Origin:|Origin Hash:|Imported At:)\s/.test(line));
+`).filter((line) => IMPORT_HEADER_LINE.test(line)).map((line) => version && line.startsWith("Version:") ? `Version: ${version}` : line);
   return lines.length > 0 ? `${lines.join(`
 `)}
 ` : "";
 }
-function stampOrigin(source, originBlock) {
-  if (!originBlock)
+function stampImportHeader(source, header) {
+  if (!header)
     return source;
   const stripped = source.replace(/^Origin Hash:.*\n/gm, "").replace(/^Origin:.*\n/gm, "").replace(/^Imported At:.*\n/gm, "");
   if (stripped.startsWith("---")) {
@@ -57992,19 +58152,108 @@ function stampOrigin(source, originBlock) {
 ---`.length;
       const insertAt = stripped[afterFence] === `
 ` ? afterFence + 1 : afterFence;
-      return `${stripped.slice(0, insertAt)}${originBlock}${stripped.slice(insertAt)}`;
+      let bodyStart = insertAt;
+      while (true) {
+        const lineEnd = stripped.indexOf(`
+`, bodyStart);
+        const line = stripped.slice(bodyStart, lineEnd === -1 ? stripped.length : lineEnd);
+        if (!IMPORT_HEADER_LINE.test(line))
+          break;
+        bodyStart = lineEnd === -1 ? stripped.length : lineEnd + 1;
+      }
+      return `${stripped.slice(0, insertAt)}${header}${stripped.slice(bodyStart)}`;
     }
   }
-  return `${originBlock}${stripped}`;
+  return `${header}${stripped}`;
+}
+function versionOption(content) {
+  const version = parseSkillFrontmatter(content).metadataVersion;
+  return version ? { version } : {};
+}
+async function findOverlayRule(sourcePath, ref) {
+  let dir = path145.dirname(sourcePath);
+  for (let depth = 0;depth <= 3; depth += 1) {
+    const candidate = path145.join(dir, "rules", ref);
+    if (await pathExists(candidate))
+      return candidate;
+    const parent = path145.dirname(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return;
+}
+async function importReferencedRules(options, sources) {
+  const citedBy = new Map;
+  for (const source of sources) {
+    for (const ref of ruleReferences(source.content)) {
+      const entry = citedBy.get(ref) ?? { names: [], sourcePaths: [] };
+      entry.names.push(source.name);
+      if (source.sourcePath)
+        entry.sourcePaths.push(source.sourcePath);
+      citedBy.set(ref, entry);
+    }
+  }
+  const bundledRules = bundledRulesSourcePath();
+  const rules = [];
+  for (const [ref, cited] of [...citedBy.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+    const base = { ref, citedBy: cited.names.sort() };
+    const target = path145.join(options.projectRoot, ".metaproject", "rules", ref);
+    if (await pathExists(target)) {
+      rules.push({ ...base, status: "present" });
+      continue;
+    }
+    if (ref.startsWith("core/") && await pathExists(path145.join(bundledRules, path145.basename(ref)))) {
+      rules.push({ ...base, status: "unresolved", reason: "ships with keryx \u2014 run `keryx install` to restore it" });
+      continue;
+    }
+    let found;
+    for (const sourcePath of cited.sourcePaths) {
+      found = await findOverlayRule(sourcePath, ref);
+      if (found)
+        break;
+    }
+    if (!found) {
+      rules.push({
+        ...base,
+        status: "unresolved",
+        reason: cited.sourcePaths.length > 0 ? "no rules/ directory beside the source has it" : "remote source; rules are not fetched"
+      });
+      continue;
+    }
+    const origin = portableOriginRef(found, options.projectRoot);
+    if (options.dryRun) {
+      rules.push({ ...base, status: "would-import", origin });
+      continue;
+    }
+    const content = await readFile81(found, "utf8");
+    const relative = toPosix(path145.relative(options.projectRoot, target));
+    const guard = await guardOutput({
+      cwd: options.projectRoot,
+      content,
+      target: "skill",
+      source: "untrusted-external",
+      path: relative
+    });
+    const output = prepareOutputForPersistence(guard, content);
+    if (!output.allowed) {
+      rules.push({ ...base, status: "unresolved", origin, reason: `blocked by the security gate: ${output.reason}` });
+      continue;
+    }
+    await mkdir50(path145.dirname(target), { recursive: true });
+    await writeFileAtomic(target, output.content);
+    rules.push({ ...base, status: "imported", origin });
+  }
+  return rules;
 }
 function inferNameFromPath(filePath, content) {
   const fromFrontmatter = frontmatterName(content);
   if (fromFrontmatter)
     return fromFrontmatter;
-  const parent = path144.basename(path144.dirname(filePath));
+  const parent = path145.basename(path145.dirname(filePath));
   if (parent && parent !== "skills" && parent !== ".")
     return parent;
-  return path144.basename(filePath, path144.extname(filePath));
+  return path145.basename(filePath, path145.extname(filePath));
 }
 function inferNameFromUrl(url) {
   const cleaned = url.replace(/\/SKILL\.md$/i, "");
@@ -58043,7 +58292,7 @@ function metadataLine(content, label) {
 }
 async function readRegistry(projectRoot) {
   await Promise.resolve().then(() => init_json());
-  const manifestPath = path144.join(projectRoot, ".metaproject", "metaproject.json");
+  const manifestPath = path145.join(projectRoot, ".metaproject", "metaproject.json");
   const manifest = await readJsonFileOr(manifestPath, {});
   return manifest.modules?.gdskills?.projectSkillRegistry ?? [];
 }
@@ -58165,10 +58414,10 @@ init_fs();
 init_json();
 init_relevant();
 init_service3();
-import { mkdir as mkdir50, readFile as readFile82, writeFile as writeFile46 } from "fs/promises";
-import path145 from "path";
+import { mkdir as mkdir51, readFile as readFile82, writeFile as writeFile46 } from "fs/promises";
+import path146 from "path";
 async function verifyProjectSkill(projectRoot, options) {
-  const metaprojectRoot = path145.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path146.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
@@ -58178,11 +58427,11 @@ async function verifyProjectSkill(projectRoot, options) {
   if (!resolved) {
     throw new Error(`Project skill not found for: ${options.input}`);
   }
-  const skillMdPath = path145.join(resolved.packageRoot, "SKILL.md");
+  const skillMdPath = path146.join(resolved.packageRoot, "SKILL.md");
   const skillMd = await readFile82(skillMdPath, "utf8");
-  const metadata = parseSkillMetadata(skillMd);
+  const metadata = parseSkillMetadata(skillMd, resolved.entry);
   const moduleName = metadata.module ?? resolved.entry?.module ?? inferModuleFromPath(resolved.packageRoot);
-  const skillName = resolved.entry?.name ?? path145.basename(resolved.packageRoot);
+  const skillName = resolved.entry?.name ?? path146.basename(resolved.packageRoot);
   const target = metadata.target ?? resolved.entry?.target ?? options.input;
   const verifiedAt = new Date().toISOString();
   const signals = await collectVerificationSignals({
@@ -58195,15 +58444,15 @@ async function verifyProjectSkill(projectRoot, options) {
   });
   const status = classifyStatus(signals, metadata);
   const recommendations = recommendationsFor(signals, status);
-  const reportPath = path145.join(metaprojectRoot, "data", "gdskills", "reports", `${moduleName}-${skillName}-verification.json`);
-  const relativeReportPath = toPosix(path145.relative(projectRoot, reportPath));
+  const reportPath = path146.join(metaprojectRoot, "data", "gdskills", "reports", `${moduleName}-${skillName}-verification.json`);
+  const relativeReportPath = toPosix(path146.relative(projectRoot, reportPath));
   const report = {
     schemaVersion: 1,
     status,
     module: moduleName,
     name: skillName,
     target,
-    skillPath: toPosix(path145.relative(projectRoot, resolved.packageRoot)),
+    skillPath: toPosix(path146.relative(projectRoot, resolved.packageRoot)),
     reportPath: relativeReportPath,
     verifiedAt,
     signals,
@@ -58211,16 +58460,16 @@ async function verifyProjectSkill(projectRoot, options) {
     dryRun: options.dryRun === true
   };
   if (!options.dryRun) {
-    await mkdir50(path145.dirname(reportPath), { recursive: true });
+    await mkdir51(path146.dirname(reportPath), { recursive: true });
     await writeFile46(reportPath, `${JSON.stringify(report, null, 2)}
 `, "utf8");
-    await writeFile46(path145.join(resolved.packageRoot, "verification.md"), renderVerificationMarkdown(report), "utf8");
+    await writeFile46(path146.join(resolved.packageRoot, "verification.md"), renderVerificationMarkdown(report), "utf8");
     await writeFile46(skillMdPath, updateLastVerified(skillMd, verifiedAt), "utf8");
   }
   return report;
 }
 async function readManifest2(projectRoot) {
-  const manifestPath = path145.join(projectRoot, ".metaproject", "metaproject.json");
+  const manifestPath = path146.join(projectRoot, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return {};
   }
@@ -58240,31 +58489,31 @@ async function collectVerificationSignals({
     "skill-changelog.md"
   ];
   for (const requiredFile of requiredFiles) {
-    const filePath = path145.join(packageRoot, requiredFile);
+    const filePath = path146.join(packageRoot, requiredFile);
     signals.push({
       name: `required:${requiredFile}`,
       status: await pathExists(filePath) ? "pass" : "fail",
       message: await pathExists(filePath) ? "Required package file exists." : "Required package file is missing.",
-      path: toPosix(path145.relative(projectRoot, filePath))
+      path: toPosix(path146.relative(projectRoot, filePath))
     });
   }
   signals.push({
     name: "metadata:version",
     status: metadata.version ? "pass" : "fail",
     message: metadata.version ? `Version ${metadata.version}` : "SKILL.md is missing Version metadata.",
-    path: toPosix(path145.relative(projectRoot, skillMdPath))
+    path: toPosix(path146.relative(projectRoot, skillMdPath))
   });
   signals.push({
     name: "metadata:target",
     status: metadata.target ? "pass" : "fail",
     message: metadata.target ? `Target ${metadata.target}` : "SKILL.md is missing Target metadata.",
-    path: toPosix(path145.relative(projectRoot, skillMdPath))
+    path: toPosix(path146.relative(projectRoot, skillMdPath))
   });
   signals.push({
     name: "metadata:last-verified",
     status: metadata.lastVerified && metadata.lastVerified !== "never" ? "pass" : "warn",
     message: metadata.lastVerified && metadata.lastVerified !== "never" ? `Last verified at ${metadata.lastVerified}` : "Skill has not been verified before.",
-    path: toPosix(path145.relative(projectRoot, skillMdPath))
+    path: toPosix(path146.relative(projectRoot, skillMdPath))
   });
   signals.push({
     name: "registry",
@@ -58272,14 +58521,14 @@ async function collectVerificationSignals({
     message: registryEntry ? "Skill is registered in metaproject manifest." : "Skill package is not registered in metaproject manifest.",
     path: ".metaproject/metaproject.json"
   });
-  const targetPath = path145.resolve(projectRoot, target);
+  const targetPath = path146.resolve(projectRoot, target);
   const targetLooksLikePath = target.includes("/") || target.includes(".") || target.startsWith(".");
   const targetExists = targetLooksLikePath && await pathExists(targetPath);
   signals.push({
     name: "target",
     status: !targetLooksLikePath || targetExists ? "pass" : "fail",
     message: targetLooksLikePath ? targetExists ? "Target path exists." : "Target path is missing." : "Target is treated as a symbol or concept.",
-    path: targetLooksLikePath ? toPosix(path145.relative(projectRoot, targetPath)) : undefined
+    path: targetLooksLikePath ? toPosix(path146.relative(projectRoot, targetPath)) : undefined
   });
   await pushArtifactSignal(projectRoot, signals, "gdgraph", [
     ".metaproject/data/gdgraph/artifacts/summary.md",
@@ -58309,7 +58558,7 @@ async function collectVerificationSignals({
 async function pushArtifactSignal(projectRoot, signals, name, candidates) {
   const existing = [];
   for (const candidate of candidates) {
-    if (await pathExists(path145.join(projectRoot, candidate))) {
+    if (await pathExists(path146.join(projectRoot, candidate))) {
       existing.push(candidate);
     }
   }
@@ -58322,7 +58571,7 @@ async function pushArtifactSignal(projectRoot, signals, name, candidates) {
 }
 async function pushGdwikiSignal(projectRoot, signals) {
   const indexPath = ".metaproject/wiki/index.md";
-  if (!await pathExists(path145.join(projectRoot, indexPath))) {
+  if (!await pathExists(path146.join(projectRoot, indexPath))) {
     signals.push({
       name: "evidence:gdwiki",
       status: "warn",
@@ -58420,10 +58669,10 @@ ${signalRows}
 ${recommendations}
 `;
 }
-function parseSkillMetadata(skillMd) {
+function parseSkillMetadata(skillMd, registryEntry) {
   return {
-    version: readMetadataLine(skillMd, "Version"),
-    target: readMetadataLine(skillMd, "Target"),
+    version: readMetadataLine(skillMd, "Version") ?? parseSkillFrontmatter(skillMd).metadataVersion,
+    target: readMetadataLine(skillMd, "Target") ?? registryEntry?.target,
     module: readMetadataLine(skillMd, "Module"),
     status: readMetadataLine(skillMd, "Status"),
     lastVerified: readMetadataLine(skillMd, "Last Verified")
@@ -58441,6 +58690,22 @@ function updateLastVerified(skillMd, verifiedAt) {
     return skillMd.replace(/^Status:.*$/m, (line) => `${line}
 Last Verified: ${verifiedAt}`);
   }
+  if (/^Imported At:.*$/m.test(skillMd)) {
+    return skillMd.replace(/^Imported At:.*$/m, (line) => `${line}
+Last Verified: ${verifiedAt}`);
+  }
+  if (skillMd.startsWith("---")) {
+    const end = skillMd.indexOf(`
+---`, 3);
+    if (end !== -1) {
+      const afterFence = end + `
+---`.length;
+      const insertAt = skillMd[afterFence] === `
+` ? afterFence + 1 : afterFence;
+      return `${skillMd.slice(0, insertAt)}Last Verified: ${verifiedAt}
+${skillMd.slice(insertAt)}`;
+    }
+  }
   return skillMd;
 }
 function inferModuleFromPath(packageRoot) {
@@ -58455,7 +58720,7 @@ function escapeRegExp6(value) {
 
 // src/gdskills/bundled-eval.ts
 import { existsSync as existsSync25, readFileSync as readFileSync7, readdirSync as readdirSync2 } from "fs";
-import path146 from "path";
+import path147 from "path";
 
 // src/gdskills/model-tier.ts
 var MODEL_TIERS = ["light", "standard", "deep"];
@@ -58785,7 +59050,7 @@ var CEILINGS_BY_KEY = {
   "review/review-highload": 550,
   "review/review-layout": 238,
   "review/review-logic": 377,
-  "review/review-orchestrator": 1907,
+  "review/review-orchestrator": 1895,
   "review/review-performance": 374,
   "review/review-pr-feedback": 895,
   "review/review-regression": 216,
@@ -58912,8 +59177,8 @@ function evaluatorSource() {
     if (here.protocol !== "file:")
       return "unknown";
     const dir = decodeURIComponent(here.pathname);
-    const rel = path146.relative(process.cwd(), dir);
-    return rel.length > 0 && !rel.startsWith("..") && !path146.isAbsolute(rel) ? rel : dir;
+    const rel = path147.relative(process.cwd(), dir);
+    return rel.length > 0 && !rel.startsWith("..") && !path147.isAbsolute(rel) ? rel : dir;
   } catch {
     return "unknown";
   }
@@ -59315,7 +59580,7 @@ function scanCrossReferences(text, root, known, checkSkillNames, add) {
       if (GENERATED_PATH_ROOTS.some((entry) => resolved === entry.prefix.replace(/\/$/, "") || resolved.startsWith(entry.prefix))) {
         continue;
       }
-      if (existsSync25(path146.join(root, resolved)))
+      if (existsSync25(path147.join(root, resolved)))
         continue;
       add("xref:path", index + 1, `path \`${raw}\` resolves to nothing under the shipped tree (looked for \`${resolved}\`).`);
     }
@@ -59325,7 +59590,7 @@ var SKILL_DOCUMENT_NAMES = new Set(HARNESS_SKILL_RUNTIMES.map((runtime) => skill
 var KNOWN_SKILL_COMPANION_DOCUMENTS = new Map([
   [
     "SKILL.detail.md",
-    "overflow reference for `orchestration/feature-analyzer`, linked from its SKILL.md; carries no frontmatter and is not addressed by any runtime"
+    "overflow reference linked from its skill's SKILL.md (`orchestration/feature-analyzer`, `review/review-orchestrator`); carries no frontmatter and is not addressed by any runtime"
   ],
   [
     "orchestrator-prompt.md",
@@ -59338,7 +59603,7 @@ function walkSkillDocuments(root, accept) {
   const out = [];
   const walk = (dir) => {
     for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-      const full = path146.join(dir, entry.name);
+      const full = path147.join(dir, entry.name);
       if (entry.isDirectory()) {
         walk(full);
         continue;
@@ -59360,26 +59625,26 @@ function bundledSkillCompanionDocuments(root) {
   return walkSkillDocuments(root, (name) => KNOWN_SKILL_COMPANION_DOCUMENTS.has(name));
 }
 function bundledRuleFiles(root) {
-  const rulesRoot = path146.join(root, "rules", "core");
+  const rulesRoot = path147.join(root, "rules", "core");
   if (!existsSync25(rulesRoot))
     return [];
-  return readdirSync2(rulesRoot, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => path146.join(rulesRoot, entry.name)).sort();
+  return readdirSync2(rulesRoot, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => path147.join(rulesRoot, entry.name)).sort();
 }
 function defaultBundledRoot() {
-  const directPath = path146.join(import.meta.dir, "bundled");
+  const directPath = path147.join(import.meta.dir, "bundled");
   if (existsSync25(directPath))
     return directPath;
-  const packagedPath = path146.join(import.meta.dir, "..", "src", "gdskills", "bundled");
+  const packagedPath = path147.join(import.meta.dir, "..", "src", "gdskills", "bundled");
   if (existsSync25(packagedPath))
     return packagedPath;
   return directPath;
 }
 function evaluateBundledTree(root = defaultBundledRoot()) {
-  const skillsRoot = path146.join(root, "skills");
+  const skillsRoot = path147.join(root, "skills");
   const canonical = bundledSkillFiles(skillsRoot);
   const files = bundledSkillDocuments(skillsRoot);
   const companionDocuments = bundledSkillCompanionDocuments(skillsRoot);
-  const skillNames = [...new Set(canonical.map((file) => path146.basename(path146.dirname(file))))].sort();
+  const skillNames = [...new Set(canonical.map((file) => path147.basename(path147.dirname(file))))].sort();
   const known = new Set(skillNames);
   const findings = [];
   const declaredNames = new Map;
@@ -59389,10 +59654,10 @@ function evaluateBundledTree(root = defaultBundledRoot()) {
   const redFlagsByKey = new Map;
   const redFlagsFileByKey = new Map;
   for (const file of files) {
-    const skillDir = path146.dirname(file);
-    const skill = path146.basename(skillDir);
-    const rel = path146.relative(skillsRoot, file).split(path146.sep).join("/");
-    const category = path146.dirname(rel).split("/")[0] ?? "";
+    const skillDir = path147.dirname(file);
+    const skill = path147.basename(skillDir);
+    const rel = path147.relative(skillsRoot, file).split(path147.sep).join("/");
+    const category = path147.dirname(rel).split("/")[0] ?? "";
     const text = readFileSync7(file, "utf8");
     const add = (check, line, message) => {
       findings.push({ check, skill, file: rel, line, message });
@@ -59426,7 +59691,7 @@ function evaluateBundledTree(root = defaultBundledRoot()) {
         if (served.length === 0) {
           add("frontmatter:description", 1, "frontmatter `description` is present but resolves to nothing a harness can match a request against; a block scalar (`description: |`) needs its text on the following indented lines.");
         } else {
-          if (path146.basename(file) === "SKILL.md") {
+          if (path147.basename(file) === "SKILL.md") {
             const key = `${category}/${skill}`;
             descriptionsByKey.set(key, served);
             descriptionFileByKey.set(key, rel);
@@ -59453,14 +59718,14 @@ function evaluateBundledTree(root = defaultBundledRoot()) {
           add("frontmatter:category", 1, `frontmatter \`metadata.category\` is "${declaredCategory}" but this skill ships under \`${category}/${skill}\`; set it to "${category}" or drop the field.`);
         }
       }
-      if (path146.basename(file) === "SKILL.md" && parsed.compatibleHarnesses !== undefined) {
+      if (path147.basename(file) === "SKILL.md" && parsed.compatibleHarnesses !== undefined) {
         const harnesses = parsed.compatibleHarnesses;
         if (!harnesses.includes("claude")) {
           add("frontmatter:harness-claude", 1, `frontmatter \`compatible_harnesses\` ("${harnesses.join(",")}") omits \`claude\`, but this file IS the Claude build \u2014 add \`claude\` to the list.`);
         }
       }
     }
-    if (path146.basename(file) === "SKILL.md") {
+    if (path147.basename(file) === "SKILL.md") {
       const exemptionKey = `${category}/${skill}`;
       redFlagsByKey.set(exemptionKey, redFlagsTableBody(text));
       redFlagsFileByKey.set(exemptionKey, rel);
@@ -59481,7 +59746,7 @@ function evaluateBundledTree(root = defaultBundledRoot()) {
         add("anatomy:sections", null, `missing ${ANATOMY_SECTION_LABELS[section]}.`);
       }
     }
-    if (path146.basename(file) === "SKILL.md") {
+    if (path147.basename(file) === "SKILL.md") {
       const ceilingKey = `${category}/${skill}`;
       const recordedCeiling = SKILL_LENGTH_CEILINGS.get(ceilingKey);
       const ceiling = recordedCeiling ?? DEFAULT_SKILL_LENGTH_CEILING;
@@ -59542,24 +59807,24 @@ function evaluateBundledTree(root = defaultBundledRoot()) {
     }
   }
   for (const file of bundledRuleFiles(root)) {
-    const rel = path146.relative(root, file).split(path146.sep).join("/");
+    const rel = path147.relative(root, file).split(path147.sep).join("/");
     const text = readFileSync7(file, "utf8");
     const add = (check, line, message) => {
-      findings.push({ check, skill: path146.basename(file, path146.extname(file)), file: rel, line, message });
+      findings.push({ check, skill: path147.basename(file, path147.extname(file)), file: rel, line, message });
     };
     scanCrossReferences(text, root, known, false, add);
   }
   for (const file of companionDocuments) {
-    const skillDir = path146.dirname(file);
-    const skill = path146.basename(skillDir);
-    const rel = path146.relative(skillsRoot, file).split(path146.sep).join("/");
+    const skillDir = path147.dirname(file);
+    const skill = path147.basename(skillDir);
+    const rel = path147.relative(skillsRoot, file).split(path147.sep).join("/");
     const text = readFileSync7(file, "utf8");
     const add = (check, line, message) => {
       findings.push({ check, skill, file: rel, line, message });
     };
     scanCrossReferences(text, root, known, true, add);
   }
-  for (const dir of [...new Set(files.map((file) => path146.dirname(file)))].sort()) {
+  for (const dir of [...new Set(files.map((file) => path147.dirname(file)))].sort()) {
     for (const entry of readdirSync2(dir, { withFileTypes: true })) {
       if (!entry.isFile())
         continue;
@@ -59571,15 +59836,15 @@ function evaluateBundledTree(root = defaultBundledRoot()) {
         continue;
       findings.push({
         check: "document:addressable",
-        skill: path146.basename(dir),
-        file: path146.relative(skillsRoot, path146.join(dir, entry.name)).split(path146.sep).join("/"),
+        skill: path147.basename(dir),
+        file: path147.relative(skillsRoot, path147.join(dir, entry.name)).split(path147.sep).join("/"),
         line: null,
         message: `\`${entry.name}\` is spelled like a harness build, but no runtime in HARNESS_SKILL_RUNTIMES resolves to it (${[...SKILL_DOCUMENT_NAMES].join(", ")}). Nothing exports it, installs it, or reads it \u2014 delete it, rename it to the build it was meant to be, or register it in KNOWN_SKILL_COMPANION_DOCUMENTS with a reason.`
       });
     }
   }
   for (const file of canonical) {
-    const dir = path146.dirname(file);
+    const dir = path147.dirname(file);
     let canonicalComparable;
     try {
       canonicalComparable = buildComparableText(readFileSync7(file, "utf8"));
@@ -59588,9 +59853,9 @@ function evaluateBundledTree(root = defaultBundledRoot()) {
     }
     for (const runtime of HARNESS_SKILL_RUNTIMES) {
       const buildName = skillBuildFileName(runtime);
-      if (buildName === path146.basename(file))
+      if (buildName === path147.basename(file))
         continue;
-      const buildPath = path146.join(dir, buildName);
+      const buildPath = path147.join(dir, buildName);
       if (!existsSync25(buildPath))
         continue;
       let buildComparable;
@@ -59603,8 +59868,8 @@ function evaluateBundledTree(root = defaultBundledRoot()) {
         continue;
       findings.push({
         check: "document:build-parity",
-        skill: path146.basename(dir),
-        file: path146.relative(skillsRoot, buildPath).split(path146.sep).join("/"),
+        skill: path147.basename(dir),
+        file: path147.relative(skillsRoot, buildPath).split(path147.sep).join("/"),
         line: null,
         message: `\`${buildName}\` no longer carries the content of its \`SKILL.md\`, ignoring the fields a build may set for itself (${[...BUILD_DIVERGENCE_ALLOWED_FIELDS].join(", ")}). An agent on that runtime reads this file, not the canonical one \u2014 re-export the build.`
       });
@@ -59673,7 +59938,7 @@ async function skillsCommand(args) {
   }
   if (command === "install") {
     const profile = normalizeGdskillsProfile(optionValue(args, "--profile"));
-    const metaprojectRoot = path147.join(process.cwd(), ".metaproject");
+    const metaprojectRoot = path148.join(process.cwd(), ".metaproject");
     banner("keryx skills install", `Profile: ${profile}`);
     if (!await pathExists(metaprojectRoot)) {
       console.log(`  ${style.red(symbols.cross)} Metaproject is not initialized.`);
@@ -59799,11 +60064,11 @@ async function inspectProjectSkill(args) {
     process.exitCode = 1;
     return;
   }
-  const skillRoot = path147.resolve(process.cwd(), entry.path);
-  const skillMdPath = path147.join(skillRoot, "SKILL.md");
-  const verificationPath = path147.join(skillRoot, "verification.md");
-  const changelogPath = path147.join(skillRoot, "skill-changelog.md");
-  const reportPath = path147.join(process.cwd(), ".metaproject", "data", "gdskills", "reports", `${entry.module}-${entry.name}-verification.json`);
+  const skillRoot = path148.resolve(process.cwd(), entry.path);
+  const skillMdPath = path148.join(skillRoot, "SKILL.md");
+  const verificationPath = path148.join(skillRoot, "verification.md");
+  const changelogPath = path148.join(skillRoot, "skill-changelog.md");
+  const reportPath = path148.join(process.cwd(), ".metaproject", "data", "gdskills", "reports", `${entry.module}-${entry.name}-verification.json`);
   const metadata = await pathExists(skillMdPath) ? parseProjectSkillMetadata(await readFile83(skillMdPath, "utf8")) : {};
   const inspection = {
     module: entry.module,
@@ -59837,7 +60102,7 @@ async function inspectProjectSkill(args) {
   console.log(`- latest report: ${inspection.files.latestReport}`);
 }
 async function readProjectSkillRegistryFromManifest() {
-  const manifestPath = path147.join(process.cwd(), ".metaproject", "metaproject.json");
+  const manifestPath = path148.join(process.cwd(), ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return [];
   }
@@ -59997,7 +60262,7 @@ function scoreProjectSkillRoute(entry, query) {
     return { entry, score: 0, reasons: [] };
   }
   const key = `${entry.module}/${entry.name}`;
-  const targetBase = path147.basename(entry.target).replace(/\.[^.]+$/, "");
+  const targetBase = path148.basename(entry.target).replace(/\.[^.]+$/, "");
   const fields = {
     key: normalizeRouteText(key),
     module: normalizeRouteText(entry.module),
@@ -60266,7 +60531,7 @@ function verifyBundledSkills(args) {
   }
   if (evaluation.skills === 0) {
     console.error(`
-No SKILL.md found under ${path147.join(root, "skills")}. Nothing was evaluated, so nothing was verified.`);
+No SKILL.md found under ${path148.join(root, "skills")}. Nothing was evaluated, so nothing was verified.`);
     process.exitCode = 1;
     return;
   }
@@ -60275,7 +60540,7 @@ No SKILL.md found under ${path147.join(root, "skills")}. Nothing was evaluated,
   }
 }
 async function verifyAllProjectSkills(args) {
-  const manifestPath = path147.join(process.cwd(), ".metaproject", "metaproject.json");
+  const manifestPath = path148.join(process.cwd(), ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     console.error("Metaproject is not initialized. Run: keryx init");
     process.exitCode = 1;
@@ -60379,7 +60644,7 @@ async function contractsCommand(args) {
       return;
     }
     try {
-      const result = await validateContractFile(path147.resolve(filePath), schemaName);
+      const result = await validateContractFile(path148.resolve(filePath), schemaName);
       if (result.valid) {
         console.log(`valid: ${result.file}`);
         console.log(`schema: ${result.schema}`);
@@ -60424,10 +60689,10 @@ async function printGdskillsStatus(args) {
   console.log(`learning proposals: ${summary.learningProposals.total} ` + `(pending ${summary.learningProposals.pending}, applied ${summary.learningProposals.applied})`);
 }
 async function getGdskillsStatusSummary() {
-  const root = path147.join(process.cwd(), ".metaproject");
-  const manifestPath = path147.join(root, "metaproject.json");
-  const catalogPath = path147.join(root, "skills", "catalog.md");
-  const skillsRoot = path147.join(root, "skills", "gdskills");
+  const root = path148.join(process.cwd(), ".metaproject");
+  const manifestPath = path148.join(root, "metaproject.json");
+  const catalogPath = path148.join(root, "skills", "catalog.md");
+  const skillsRoot = path148.join(root, "skills", "gdskills");
   if (!await pathExists(root)) {
     return {
       initialized: false,
@@ -60464,9 +60729,9 @@ async function getGdskillsStatusSummary() {
     profile = normalizeGdskillsProfile(manifest.modules?.gdskills?.profile);
     projectSkillRegistry = manifest.modules?.gdskills?.projectSkillRegistry ?? [];
   }
-  const reports = await readVerificationReports(path147.join(root, "data", "gdskills", "reports"));
+  const reports = await readVerificationReports(path148.join(root, "data", "gdskills", "reports"));
   const reportKeys = new Set(reports.map((report) => `${report.module}/${report.name}`));
-  const proposals = await readProposalFiles(path147.join(root, "data", "gdskills", "proposals"));
+  const proposals = await readProposalFiles(path148.join(root, "data", "gdskills", "proposals"));
   const statusCounts = countVerificationStatuses(reports);
   return {
     initialized: true,
@@ -60510,8 +60775,8 @@ async function readVerificationReports(reportsRoot) {
 }
 async function readProposalFiles(proposalsRoot) {
   const files = await listJsonFiles(proposalsRoot);
-  const appliedIds = new Set(files.filter((filePath) => filePath.endsWith(".applied.json")).map((filePath) => path147.basename(filePath).replace(/\.applied\.json$/, "")));
-  const proposalIds = files.filter((filePath) => !filePath.endsWith(".applied.json")).map((filePath) => path147.basename(filePath).replace(/\.json$/, ""));
+  const appliedIds = new Set(files.filter((filePath) => filePath.endsWith(".applied.json")).map((filePath) => path148.basename(filePath).replace(/\.applied\.json$/, "")));
+  const proposalIds = files.filter((filePath) => !filePath.endsWith(".applied.json")).map((filePath) => path148.basename(filePath).replace(/\.json$/, ""));
   return {
     total: proposalIds.length,
     pending: proposalIds.filter((id) => !appliedIds.has(id)).length,
@@ -60523,7 +60788,7 @@ async function listJsonFiles(root) {
     return [];
   }
   const entries = await readdir25(root, { withFileTypes: true });
-  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => path147.join(root, entry.name));
+  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => path148.join(root, entry.name));
 }
 function countVerificationStatuses(reports) {
   return reports.reduce((acc, report) => {
@@ -60541,7 +60806,7 @@ function latest(values) {
   return sorted.at(-1) ?? "never";
 }
 function relativeToCwd(filePath) {
-  return path147.relative(process.cwd(), filePath) || ".";
+  return path148.relative(process.cwd(), filePath) || ".";
 }
 function printSkillsHelp() {
   console.log(`keryx skills
@@ -60763,9 +61028,9 @@ init_service7();
 init_fs();
 init_util();
 import { readdir as readdir26, readFile as readFile84 } from "fs/promises";
-import path148 from "path";
+import path149 from "path";
 async function loadHistory(cwd, limit = 20) {
-  const dir = path148.join(dataRoot2(cwd), "history");
+  const dir = path149.join(dataRoot2(cwd), "history");
   if (!await pathExists(dir)) {
     return [];
   }
@@ -60773,7 +61038,7 @@ async function loadHistory(cwd, limit = 20) {
   const points = [];
   for (const file of files.slice(-limit)) {
     try {
-      const report = JSON.parse(await readFile84(path148.join(dir, file), "utf8"));
+      const report = JSON.parse(await readFile84(path149.join(dir, file), "utf8"));
       const scores = {};
       for (const metric of report.metrics ?? []) {
         scores[metric.key] = metric.health_score;
@@ -61508,7 +61773,7 @@ init_github();
 init_flow_move();
 init_service7();
 init_guard2();
-import path149 from "path";
+import path150 from "path";
 init_machine();
 
 // src/flow/types.ts
@@ -62015,7 +62280,7 @@ async function runSchema(args) {
 `;
   const out = optionValue(args, "--out");
   if (out) {
-    const target = path149.isAbsolute(out) ? out : path149.join(process.cwd(), out);
+    const target = path150.isAbsolute(out) ? out : path150.join(process.cwd(), out);
     await writeFileAtomic(target, json);
     console.log(`  ${style.green(symbols.ok)} Wrote flow-state schema ${style.cyan(symbols.arrow)} ${out}`);
     return;
@@ -62113,8 +62378,8 @@ init_args();
 
 // src/job/service.ts
 init_fs();
-import { copyFile as copyFile5, mkdir as mkdir52 } from "fs/promises";
-import path151 from "path";
+import { copyFile as copyFile5, mkdir as mkdir53 } from "fs/promises";
+import path152 from "path";
 
 // src/job/types.ts
 var JOB_INTENTS = ["implement", "analyze", "review", "custom"];
@@ -62252,17 +62517,17 @@ function defaultPlan(intent) {
 
 // src/job/store.ts
 init_validator();
-import { appendFile as appendFile6, mkdir as mkdir51, readFile as readFile85, readdir as readdir27 } from "fs/promises";
-import path150 from "path";
+import { appendFile as appendFile6, mkdir as mkdir52, readFile as readFile85, readdir as readdir27 } from "fs/promises";
+import path151 from "path";
 init_fs();
 function jobsRoot(cwd) {
-  return path150.join(cwd, ".metaproject", "jobs");
+  return path151.join(cwd, ".metaproject", "jobs");
 }
 function jobDir(cwd, name) {
-  return path150.join(jobsRoot(cwd), name);
+  return path151.join(jobsRoot(cwd), name);
 }
 function jobStatePath(cwd, name) {
-  return path150.join(jobDir(cwd, name), "state.json");
+  return path151.join(jobDir(cwd, name), "state.json");
 }
 var JOB_NAME_PATTERN = /^[a-z0-9-]+$/;
 function assertJobName(name) {
@@ -62299,12 +62564,12 @@ async function writeJob(cwd, name, state) {
 `));
   }
   const file = jobStatePath(cwd, name);
-  await mkdir51(path150.dirname(file), { recursive: true });
+  await mkdir52(path151.dirname(file), { recursive: true });
   await writeFileAtomic(file, `${JSON.stringify(state, null, 2)}
 `);
 }
 async function appendJournal2(cwd, name, at, line) {
-  await appendFile6(path150.join(jobDir(cwd, name), "journal.md"), `- ${at} - ${line}
+  await appendFile6(path151.join(jobDir(cwd, name), "journal.md"), `- ${at} - ${line}
 `, "utf8");
 }
 function renderJournal2(name, at) {
@@ -62325,7 +62590,7 @@ function assertDocumentType(raw) {
   return raw;
 }
 function documentFileName(type, sourcePath) {
-  const extension = path150.extname(sourcePath) || ".md";
+  const extension = path151.extname(sourcePath) || ".md";
   return `${type}${extension}`;
 }
 
@@ -62333,7 +62598,7 @@ function documentFileName(type, sourcePath) {
 function createJobService(deps) {
   const now = () => deps.now().toISOString();
   function lockPath(cwd, name) {
-    return path151.join(jobsRoot(cwd), `.job-lock-${name}`);
+    return path152.join(jobsRoot(cwd), `.job-lock-${name}`);
   }
   async function mutate(cwd, name, run) {
     assertJobName(name);
@@ -62371,7 +62636,7 @@ function createJobService(deps) {
       if (await pathExists(absolute)) {
         throw new Error(`Job package already exists: .metaproject/jobs/${name}. ` + `Run: keryx job status ${name}`);
       }
-      await mkdir52(absolute, { recursive: true });
+      await mkdir53(absolute, { recursive: true });
       const createdAt = now();
       const state = {
         phase: "PLAN",
@@ -62382,20 +62647,20 @@ function createJobService(deps) {
         },
         plan: { steps: defaultPlan(intent) },
         documentation: {
-          job_path: path151.join(".metaproject", "jobs", name),
+          job_path: path152.join(".metaproject", "jobs", name),
           documents_created: []
         },
         metrics: { steps: [] },
-        jobs_root: path151.join(".metaproject", "jobs"),
+        jobs_root: path152.join(".metaproject", "jobs"),
         updated_at: createdAt
       };
       const first = firstOpenStep(state.plan.steps);
       if (first) {
         state.plan.current_step = first.id;
       }
-      await writeFileAtomic(path151.join(absolute, "journal.md"), renderJournal2(name, createdAt));
+      await writeFileAtomic(path152.join(absolute, "journal.md"), renderJournal2(name, createdAt));
       await writeJob(input.cwd, name, state);
-      return { state, dir: path151.relative(input.cwd, absolute) };
+      return { state, dir: path152.relative(input.cwd, absolute) };
     },
     async status({ cwd, name }) {
       assertJobName(name);
@@ -62407,7 +62672,7 @@ function createJobService(deps) {
       }
       return {
         state,
-        dir: path151.join(".metaproject", "jobs", name),
+        dir: path152.join(".metaproject", "jobs", name),
         stepsDone: state.plan.steps.filter((step) => isTerminalStep(step.status)).length,
         stepsTotal: state.plan.steps.length,
         nextStep: firstOpenStep(state.plan.steps),
@@ -62464,23 +62729,23 @@ function createJobService(deps) {
       if (!input.file) {
         throw new Error("Missing --file. Usage: keryx job document <name> --type <type> --file <path>");
       }
-      const source = path151.isAbsolute(input.file) ? input.file : path151.join(input.cwd, input.file);
+      const source = path152.isAbsolute(input.file) ? input.file : path152.join(input.cwd, input.file);
       if (!await pathExists(source)) {
         throw new Error(`--file not found: ${input.file}. Write the document first, then record it.`);
       }
       let recorded;
       await mutate(input.cwd, input.name, async (state) => {
         const fileName = documentFileName(type, source);
-        const target = path151.join(jobDir(input.cwd, state.job_name), fileName);
+        const target = path152.join(jobDir(input.cwd, state.job_name), fileName);
         await copyFile5(source, target);
         state.documentation ??= {};
-        state.documentation.job_path ??= path151.join(".metaproject", "jobs", state.job_name);
+        state.documentation.job_path ??= path152.join(".metaproject", "jobs", state.job_name);
         const created = state.documentation.documents_created ?? [];
         state.documentation.documents_created = created.includes(fileName) ? created : [...created, fileName];
         recorded = {
           state,
           document: fileName,
-          path: path151.join(".metaproject", "jobs", state.job_name, fileName)
+          path: path152.join(".metaproject", "jobs", state.job_name, fileName)
         };
         return { state, event: "document", detail: `${type} -> ${fileName}` };
       });
@@ -62515,7 +62780,7 @@ function createJobService(deps) {
             name: state.job_name,
             phase: state.phase,
             intent: state.intent,
-            dir: path151.join(".metaproject", "jobs", name),
+            dir: path152.join(".metaproject", "jobs", name),
             stepsDone: state.plan.steps.filter((step) => isTerminalStep(step.status)).length,
             stepsTotal: state.plan.steps.length,
             nextStep: firstOpenStep(state.plan.steps)?.id ?? null
@@ -62724,17 +62989,17 @@ function printHelp11() {
 // src/commands/review.ts
 init_args();
 init_fs();
-import { mkdir as mkdir54, readdir as readdir30, readFile as readFile88 } from "fs/promises";
-import path155, { join as join3 } from "path";
+import { mkdir as mkdir55, readdir as readdir30, readFile as readFile88 } from "fs/promises";
+import path156, { join as join3 } from "path";
 
 // src/review/review-learning.ts
 init_fs();
 init_json();
 init_pr_comments();
-import path152 from "path";
+import path153 from "path";
 var REVIEW_LEARNING_CONFIG_SCHEMA_VERSION = 1;
 function reviewLearningConfigPath(cwd) {
-  return path152.join(cwd, ".metaproject", "review-learning.config.json");
+  return path153.join(cwd, ".metaproject", "review-learning.config.json");
 }
 async function loadReviewLearningConfig(cwd) {
   const file = reviewLearningConfigPath(cwd);
@@ -62742,7 +63007,7 @@ async function loadReviewLearningConfig(cwd) {
     return null;
   }
   const raw = await readJsonFile(file);
-  const where = path152.relative(cwd, file);
+  const where = path153.relative(cwd, file);
   if (raw.schemaVersion !== REVIEW_LEARNING_CONFIG_SCHEMA_VERSION) {
     throw new Error(`${where}: schemaVersion must be ${REVIEW_LEARNING_CONFIG_SCHEMA_VERSION}, got ${JSON.stringify(raw.schemaVersion)}.`);
   }
@@ -62784,10 +63049,10 @@ function selectLearnableComments(state, authors) {
   return { kept, unconfigured, bodyless };
 }
 function learningSourcePath(cwd, repo, number) {
-  return path152.join(cwd, ".metaproject", "data", "gdskills", "learning-sources", `${slug3(repo)}__${number}.json`);
+  return path153.join(cwd, ".metaproject", "data", "gdskills", "learning-sources", `${slug3(repo)}__${number}.json`);
 }
 function learningRecordPath(cwd, repo, number) {
-  return path152.join(cwd, ".metaproject", "data", "gdskills", "learning-sources", `${slug3(repo)}__${number}.md`);
+  return path153.join(cwd, ".metaproject", "data", "gdskills", "learning-sources", `${slug3(repo)}__${number}.md`);
 }
 function slug3(repo) {
   return repo.replace(/\//g, "__");
@@ -62849,8 +63114,8 @@ ${learningSourceLessons(selection).map((lesson) => `- ${lesson}
 
 // src/review/managed.ts
 init_validator();
-import { mkdir as mkdir53, readFile as readFile86, readdir as readdir28, realpath as realpath8, rm as rm11, stat as stat16 } from "fs/promises";
-import path153 from "path";
+import { mkdir as mkdir54, readFile as readFile86, readdir as readdir28, realpath as realpath8, rm as rm11, stat as stat16 } from "fs/promises";
+import path154 from "path";
 init_fs();
 init_store2();
 
@@ -64962,7 +65227,7 @@ init_review_notes();
 init_types3();
 var REQUIRED_ARTIFACTS = ["scope", "coverage", "report", "findings", "learning", "decisions"];
 function reviewsRoot(cwd) {
-  return path153.join(cwd, ".metaproject", "reviews");
+  return path154.join(cwd, ".metaproject", "reviews");
 }
 async function resolveGitHead2(cwd) {
   try {
@@ -65095,27 +65360,27 @@ async function createManagedReviewPackage(input) {
   if (contractErrors.length > 0) {
     throw new Error(`Refusing to record findings that do not satisfy review-finding.schema.json: ${contractErrors.map((error) => `${error.path} ${error.message}`).join("; ")}`);
   }
-  await mkdir53(packageDir, { recursive: true });
-  await writeFileAtomic(path153.join(packageDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+  await mkdir54(packageDir, { recursive: true });
+  await writeFileAtomic(path154.join(packageDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `);
-  await writeFileAtomic(path153.join(packageDir, "scope.md"), renderScope(input, flowMatch, at, verification, carried, caps, externalReclaims, scopeB.record, filterStats));
-  await writeFileAtomic(path153.join(packageDir, "coverage.md"), renderCoverage(coverage));
-  await writeFileAtomic(path153.join(packageDir, "report.md"), renderReport(report, input.mode));
-  await writeFileAtomic(path153.join(packageDir, "findings.json"), `${JSON.stringify(findings.map(toContractFinding), null, 2)}
+  await writeFileAtomic(path154.join(packageDir, "scope.md"), renderScope(input, flowMatch, at, verification, carried, caps, externalReclaims, scopeB.record, filterStats));
+  await writeFileAtomic(path154.join(packageDir, "coverage.md"), renderCoverage(coverage));
+  await writeFileAtomic(path154.join(packageDir, "report.md"), renderReport(report, input.mode));
+  await writeFileAtomic(path154.join(packageDir, "findings.json"), `${JSON.stringify(findings.map(toContractFinding), null, 2)}
 `);
-  await writeFileAtomic(path153.join(packageDir, "learning.md"), renderLearning(findings));
-  await writeFileAtomic(path153.join(packageDir, "decisions.md"), renderDecisions(findings));
+  await writeFileAtomic(path154.join(packageDir, "learning.md"), renderLearning(findings));
+  await writeFileAtomic(path154.join(packageDir, "decisions.md"), renderDecisions(findings));
   await persistScreenRadius(packageDir, scopeB.resolved);
   const reviewNotes = await writeReviewNotes(findings, {
     cwd: input.cwd,
     reviewId,
     head,
-    packagePath: path153.relative(input.cwd, packageDir),
+    packagePath: path154.relative(input.cwd, packageDir),
     ...input.now === undefined ? {} : { now: input.now }
   });
   return {
     reviewId,
-    path: path153.relative(input.cwd, packageDir),
+    path: path154.relative(input.cwd, packageDir),
     manifest,
     verification: verification.counts,
     verificationRejections: verification.rejections,
@@ -65132,7 +65397,7 @@ async function screenScopeBFindings(input, packageDir, findings) {
   const scopeB = findings.filter((finding) => isBlastRadiusScopedFinding(finding, reviewers));
   if (resolved === undefined) {
     if (scopeB.length > 0) {
-      throw new Error(`Refusing to record ${scopeB.length} finding(s) raised under scope B (${scopeB.map((finding) => `${finding.id} by ${finding.reviewer}`).join(", ")}) with no blast-radius record: AC3 is enforced in code, and the screen cannot be applied without the computed set the round was dispatched over. Two ways out, and the first is the one that always works: (1) compute the set with \`keryx review blast-radius --json > <file>\` and pass \`--blast-radius <file>\` to this ingest; (2) write that record to \`${path153.relative(input.cwd, handoffBlastRadiusPath(packageDir))}\` and ingest again \u2014 the ingest reads it from there and consumes it. Do NOT write it to \`${path153.relative(input.cwd, path153.join(packageDir, BLAST_RADIUS_ARTIFACT))}\`: a round that names no --review-id has not allocated that directory yet, so creating it makes the next ingest take the NEXT free name and find nothing there either.`);
+      throw new Error(`Refusing to record ${scopeB.length} finding(s) raised under scope B (${scopeB.map((finding) => `${finding.id} by ${finding.reviewer}`).join(", ")}) with no blast-radius record: AC3 is enforced in code, and the screen cannot be applied without the computed set the round was dispatched over. Two ways out, and the first is the one that always works: (1) compute the set with \`keryx review blast-radius --json > <file>\` and pass \`--blast-radius <file>\` to this ingest; (2) write that record to \`${path154.relative(input.cwd, handoffBlastRadiusPath(packageDir))}\` and ingest again \u2014 the ingest reads it from there and consumes it. Do NOT write it to \`${path154.relative(input.cwd, path154.join(packageDir, BLAST_RADIUS_ARTIFACT))}\`: a round that names no --review-id has not allocated that directory yet, so creating it makes the next ingest take the NEXT free name and find nothing there either.`);
     }
     return { retained: [...findings], record: { source: "none", scopeBFindings: 0 }, resolved: undefined };
   }
@@ -65149,13 +65414,13 @@ async function screenScopeBFindings(input, packageDir, findings) {
   };
 }
 function handoffBlastRadiusPath(packageDir) {
-  return path153.join(path153.dirname(packageDir), BLAST_RADIUS_ARTIFACT);
+  return path154.join(path154.dirname(packageDir), BLAST_RADIUS_ARTIFACT);
 }
 async function resolveScreenRadius(input, packageDir) {
   if (input.blastRadius !== undefined) {
     return { radius: input.blastRadius, source: "input" };
   }
-  const inPackage = path153.join(packageDir, BLAST_RADIUS_ARTIFACT);
+  const inPackage = path154.join(packageDir, BLAST_RADIUS_ARTIFACT);
   const fromPackage = await readBlastRadiusRecordFile(inPackage);
   if (fromPackage !== undefined) {
     return { radius: fromPackage, source: "package", file: inPackage };
@@ -65181,7 +65446,7 @@ async function persistScreenRadius(packageDir, resolved) {
   if (resolved === undefined) {
     return;
   }
-  const inPackage = path153.join(packageDir, BLAST_RADIUS_ARTIFACT);
+  const inPackage = path154.join(packageDir, BLAST_RADIUS_ARTIFACT);
   if (resolved.source !== "package") {
     await writeFileAtomic(inPackage, `${JSON.stringify(resolved.radius, null, 2)}
 `);
@@ -65212,12 +65477,12 @@ function fromVerifierRefutations(findings) {
   }));
 }
 async function getManagedReviewStatus(cwd, ref) {
-  const manifestPath = ref.endsWith("manifest.json") ? path153.resolve(cwd, ref) : path153.join(await resolveReviewPackagePath(cwd, ref), "manifest.json");
+  const manifestPath = ref.endsWith("manifest.json") ? path154.resolve(cwd, ref) : path154.join(await resolveReviewPackagePath(cwd, ref), "manifest.json");
   return JSON.parse(await readFile86(manifestPath, "utf8"));
 }
 async function completeManagedReview(cwd, ref, options = {}) {
   const packageDir = await resolveReviewPackagePath(cwd, ref);
-  const manifestPath = path153.join(packageDir, "manifest.json");
+  const manifestPath = path154.join(packageDir, "manifest.json");
   const manifest = JSON.parse(await readFile86(manifestPath, "utf8"));
   const missing = await missingArtifacts(packageDir);
   if (missing.length > 0) {
@@ -65238,12 +65503,12 @@ async function completeManagedReview(cwd, ref, options = {}) {
   }
   await writeFileAtomic(manifestPath, `${JSON.stringify(updated, null, 2)}
 `);
-  const recorded = JSON.parse(await readFile86(path153.join(packageDir, "findings.json"), "utf8"));
+  const recorded = JSON.parse(await readFile86(path154.join(packageDir, "findings.json"), "utf8"));
   const reviewNotes = await writeReviewNotes(recorded, {
     cwd,
     reviewId: updated.reviewId,
     head: updated.target.head ?? null,
-    packagePath: path153.relative(cwd, packageDir),
+    packagePath: path154.relative(cwd, packageDir),
     ...options.now === undefined ? {} : { now: options.now }
   });
   return { manifest: updated, reviewNotes, dispositions: tallyDispositions(recorded) };
@@ -65309,16 +65574,16 @@ async function resolvePackageFlow(input) {
 }
 function packagePath(cwd, mode, reviewId, flowMatch) {
   if ((mode === "attach-review" || mode === "ingest") && flowMatch) {
-    return path153.join(flowsRoot(cwd), flowMatch.dir, "reviews", reviewId);
+    return path154.join(flowsRoot(cwd), flowMatch.dir, "reviews", reviewId);
   }
   if (mode === "attach-review") {
     throw new Error("attach-review requires an explicit or matched flow");
   }
-  return path153.join(reviewsRoot(cwd), reviewId);
+  return path154.join(reviewsRoot(cwd), reviewId);
 }
 function buildManifest2(args) {
   const crossFamily = args.input.crossFamilyReview;
-  const artifactPath = (name) => path153.relative(args.input.cwd, path153.join(args.packageDir, name));
+  const artifactPath = (name) => path154.relative(args.input.cwd, path154.join(args.packageDir, name));
   const manifest = {
     schemaVersion: 1,
     reviewId: args.reviewId,
@@ -65365,7 +65630,7 @@ async function readReport(input) {
     return input.reportText;
   }
   if (input.reportPath) {
-    return readFile86(path153.resolve(input.cwd, input.reportPath), "utf8");
+    return readFile86(path154.resolve(input.cwd, input.reportPath), "utf8");
   }
   if (input.mode === "ingest") {
     throw new Error("ingest requires --report or reportText");
@@ -65376,7 +65641,7 @@ No reviewer findings recorded yet.
 `;
 }
 function reportLabel(input) {
-  return input.reportPath ? path153.resolve(input.cwd, input.reportPath) : "the report text passed to keryx review";
+  return input.reportPath ? path154.resolve(input.cwd, input.reportPath) : "the report text passed to keryx review";
 }
 async function normalizeFindings(args) {
   if (args.source !== undefined) {
@@ -65431,16 +65696,16 @@ async function anchorFindings(findings, input, head) {
   }
 }
 async function containedRelativePath(cwd, relative) {
-  const root = await realpath8(cwd).catch(() => path153.resolve(cwd));
-  const resolved = path153.resolve(root, relative);
+  const root = await realpath8(cwd).catch(() => path154.resolve(cwd));
+  const resolved = path154.resolve(root, relative);
   const real = await realpath8(resolved).catch(() => null);
-  if (real === null || real !== root && !real.startsWith(`${root}${path153.sep}`)) {
+  if (real === null || real !== root && !real.startsWith(`${root}${path154.sep}`)) {
     return null;
   }
   return real;
 }
 async function readFileAtCommit(cwd, commit, absolute) {
-  const relative = path153.relative(await realpath8(cwd).catch(() => path153.resolve(cwd)), absolute);
+  const relative = path154.relative(await realpath8(cwd).catch(() => path154.resolve(cwd)), absolute);
   try {
     const proc = Bun.spawn(["git", "show", `${commit}:${relative}`], {
       cwd,
@@ -65459,10 +65724,10 @@ async function readFileAtCommit(cwd, commit, absolute) {
 }
 function readFromWorkingTree(input) {
   return async (relative) => {
-    const root = await realpath8(input.cwd).catch(() => path153.resolve(input.cwd));
-    const resolved = path153.resolve(root, relative);
+    const root = await realpath8(input.cwd).catch(() => path154.resolve(input.cwd));
+    const resolved = path154.resolve(root, relative);
     const real = await realpath8(resolved).catch(() => null);
-    if (real === null || real !== root && !real.startsWith(`${root}${path153.sep}`)) {
+    if (real === null || real !== root && !real.startsWith(`${root}${path154.sep}`)) {
       return null;
     }
     try {
@@ -65594,7 +65859,7 @@ function refutedClassification(state) {
   return state === "dismissed-incorrect" ? "false_positive" : "out_of_scope";
 }
 async function recordDispositions(packageDir, records) {
-  const findingsPath = path153.join(packageDir, "findings.json");
+  const findingsPath = path154.join(packageDir, "findings.json");
   const findings = JSON.parse(await readFile86(findingsPath, "utf8"));
   const schema = await loadSchema("review-finding");
   const dispositionSchema = schema.properties?.["disposition"];
@@ -65930,7 +66195,7 @@ function upsertPreFilterScopeBlock(text, block) {
 ${body}`;
 }
 async function readPreFilterScopeBlock(packageDir) {
-  const scopePath = path153.join(packageDir, "scope.md");
+  const scopePath = path154.join(packageDir, "scope.md");
   if (!await pathExists(scopePath)) {
     return;
   }
@@ -66111,39 +66376,39 @@ function matchReason(flow, dir, kind, ref) {
 async function missingArtifacts(packageDir) {
   const missing = [];
   for (const artifact of ["scope.md", "coverage.md", "report.md", "findings.json", "learning.md", "decisions.md"]) {
-    if (!await pathExists(path153.join(packageDir, artifact))) {
+    if (!await pathExists(path154.join(packageDir, artifact))) {
       missing.push(artifact);
     }
   }
   return missing;
 }
 async function resolveReviewPackagePath(cwd, ref) {
-  const absolute = path153.resolve(cwd, ref);
-  if (await pathExists(path153.join(absolute, "manifest.json"))) {
+  const absolute = path154.resolve(cwd, ref);
+  if (await pathExists(path154.join(absolute, "manifest.json"))) {
     return absolute;
   }
   if (await pathExists(absolute) && absolute.endsWith("manifest.json")) {
-    return path153.dirname(absolute);
+    return path154.dirname(absolute);
   }
-  const standalone = path153.join(reviewsRoot(cwd), ref);
-  if (await pathExists(path153.join(standalone, "manifest.json"))) {
+  const standalone = path154.join(reviewsRoot(cwd), ref);
+  if (await pathExists(path154.join(standalone, "manifest.json"))) {
     return standalone;
   }
   for (const flowDir of await listFlowDirs(cwd)) {
-    const reviewsDir = path153.join(flowsRoot(cwd), flowDir, "reviews");
+    const reviewsDir = path154.join(flowsRoot(cwd), flowDir, "reviews");
     if (!await pathExists(reviewsDir)) {
       continue;
     }
     for (const entry of await readdir28(reviewsDir, { withFileTypes: true })) {
       if (entry.isDirectory() && entry.name === ref) {
-        return path153.join(reviewsDir, entry.name);
+        return path154.join(reviewsDir, entry.name);
       }
     }
   }
   throw new Error(`Managed review package not found: ${ref}`);
 }
 async function loadDocpackSchema(cwd) {
-  const schemaPath = path153.join(cwd, "docs", "requirements", "managed-review-feedback-loop", "schemas", "managed-review-package.schema.json");
+  const schemaPath = path154.join(cwd, "docs", "requirements", "managed-review-feedback-loop", "schemas", "managed-review-package.schema.json");
   if (!await pathExists(schemaPath)) {
     return null;
   }
@@ -66221,7 +66486,190 @@ function renderCostPerFinding(cost, retained) {
 // src/review/reviewers.ts
 init_project_skills();
 import { readFile as readFile87, readdir as readdir29 } from "fs/promises";
-import path154 from "path";
+import path155 from "path";
+// src/review/stack.ts
+var STACK_TAGS = ["nestjs", "react", "mobx", "prisma", "playwright", "sql", "http-server"];
+function isStackTag(value) {
+  return STACK_TAGS.includes(value);
+}
+var TAG_MARKERS = {
+  react: ["react", "react-dom"],
+  mobx: ["mobx", "mobx-react", "mobx-react-lite"],
+  prisma: ["prisma", "@prisma/client"],
+  playwright: ["@playwright/test", "playwright"],
+  sql: ["prisma", "@prisma/client", "typeorm", "sequelize", "knex", "drizzle-orm", "pg", "mysql2", "better-sqlite3", "kysely"],
+  "http-server": ["express", "fastify", "koa", "hono", "@nestjs/core", "@hapi/hapi"]
+};
+var DEPENDENCY_FIELDS = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
+async function detectProjectStack(cwd, options = {}) {
+  const readFile = options.readFile ?? defaultReadFile;
+  const manifestPath = `${cwd.replace(/\/+$/, "")}/package.json`;
+  let raw;
+  try {
+    raw = await readFile(manifestPath);
+  } catch {
+    return uncertainStack(`package.json not found at ${manifestPath}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    return uncertainStack(`package.json at ${manifestPath} did not parse as JSON: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return uncertainStack(`package.json at ${manifestPath} is not a JSON object`);
+  }
+  const record = parsed;
+  const names = new Set;
+  for (const field of DEPENDENCY_FIELDS) {
+    const value = record[field];
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+      for (const name of Object.keys(value)) {
+        names.add(name);
+      }
+    }
+  }
+  const workspaceGlobs = workspacePatterns(record);
+  if (workspaceGlobs.length > 0) {
+    return uncertainStack(`package.json at ${manifestPath} declares workspaces (${workspaceGlobs.join(", ")}); the dependencies that decide the stack live in the sub-packages, which this module does not walk`);
+  }
+  if (names.size === 0) {
+    return uncertainStack(`package.json at ${manifestPath} declares no dependencies in ${DEPENDENCY_FIELDS.join("/")} \u2014 a manifest that declares nothing has not said the repository uses nothing`);
+  }
+  const matched = [];
+  const nestjsMatches = [...names].filter((name) => name.startsWith("@nestjs/")).sort();
+  matched.push(...nestjsMatches);
+  const tags = { nestjs: nestjsMatches.length > 0 };
+  for (const tag of Object.keys(TAG_MARKERS)) {
+    const hit = TAG_MARKERS[tag].filter((marker) => names.has(marker));
+    tags[tag] = hit.length > 0;
+    matched.push(...hit);
+  }
+  return {
+    tags,
+    uncertain: false,
+    reason: `detected from ${manifestPath} (${names.size} declared dependenc${names.size === 1 ? "y" : "ies"})`,
+    matched
+  };
+}
+function workspacePatterns(record) {
+  const declared = record["workspaces"];
+  const list = Array.isArray(declared) ? declared : typeof declared === "object" && declared !== null ? declared["packages"] : undefined;
+  return Array.isArray(list) ? list.filter((item) => typeof item === "string" && item !== "") : [];
+}
+function uncertainStack(reason) {
+  const tags = Object.fromEntries(STACK_TAGS.map((tag) => [tag, true]));
+  return { tags, uncertain: true, reason, matched: [] };
+}
+async function defaultReadFile(path) {
+  return await Bun.file(path).text();
+}
+function parseStackRequires(value) {
+  if (value === undefined) {
+    return [];
+  }
+  const seen = new Set;
+  for (const token of value.split(",")) {
+    const trimmed = token.trim().toLowerCase();
+    if (isStackTag(trimmed)) {
+      seen.add(trimmed);
+    }
+  }
+  return [...seen];
+}
+function extractStackRequiresField(skillMdContent) {
+  if (!skillMdContent.startsWith("---")) {
+    return;
+  }
+  const end = skillMdContent.indexOf(`
+---`, 3);
+  if (end === -1) {
+    return;
+  }
+  const lines = skillMdContent.slice(3, end).split(`
+`);
+  let inMetadata = false;
+  for (const line of lines) {
+    const topMatch = /^([A-Za-z_][A-Za-z0-9_-]*):\s*(.*)$/.exec(line);
+    if (topMatch) {
+      inMetadata = topMatch[1] === "metadata";
+      continue;
+    }
+    if (!inMetadata) {
+      continue;
+    }
+    const fieldMatch = /^\s+stack_requires:\s*(.+)$/.exec(line);
+    if (fieldMatch && fieldMatch[1] !== undefined) {
+      return stripQuotes(fieldMatch[1].trim());
+    }
+  }
+  return;
+}
+function stripQuotes(value) {
+  if (value.length >= 2) {
+    const first = value[0];
+    const last = value[value.length - 1];
+    if (first === '"' && last === '"' || first === "'" && last === "'") {
+      return value.slice(1, -1);
+    }
+  }
+  return value;
+}
+function scopeReviewerByStack(reviewer, requires, detected) {
+  const requiresCopy = [...requires];
+  if (requiresCopy.length === 0) {
+    return { reviewer, requires: requiresCopy, include: true, reason: "no stack requirement declared \u2014 generic reviewer" };
+  }
+  if (detected.uncertain) {
+    return {
+      reviewer,
+      requires: requiresCopy,
+      include: true,
+      reason: `stack detection uncertain (${detected.reason}); failing open`
+    };
+  }
+  const present = requiresCopy.filter((tag) => detected.tags[tag]);
+  if (present.length > 0) {
+    return { reviewer, requires: requiresCopy, include: true, reason: `detected: ${present.join(", ")}` };
+  }
+  return {
+    reviewer,
+    requires: requiresCopy,
+    include: false,
+    reason: `none of [${requiresCopy.join(", ")}] detected in package.json (${detected.reason})`
+  };
+}
+function renderStackScopingMarkdown(detected, decisions) {
+  const lines = [];
+  lines.push("## Stack scoping");
+  lines.push("");
+  lines.push(detected.uncertain ? `stack detection: uncertain \u2014 ${detected.reason}. Every stack-gated reviewer is included; uncertain never excludes.` : `stack detection: ${detected.reason}`);
+  if (!detected.uncertain) {
+    const present = STACK_TAGS.filter((tag) => detected.tags[tag]);
+    lines.push(`tags present: ${present.length > 0 ? present.join(", ") : "none"}`);
+    if (detected.matched.length > 0) {
+      lines.push(`matched dependencies: ${detected.matched.join(", ")}`);
+    }
+  }
+  lines.push("");
+  if (decisions.length === 0) {
+    lines.push("_no stack-gated reviewers were evaluated_");
+    return lines.join(`
+`);
+  }
+  lines.push("| reviewer | requires | include | reason |");
+  lines.push("|---|---|---|---|");
+  for (const decision of decisions) {
+    lines.push(`| ${decision.reviewer} | ${decision.requires.length > 0 ? decision.requires.join(", ") : "-"} | ${decision.include ? "yes" : "no"} | ${decision.reason} |`);
+  }
+  const excluded = decisions.filter((decision) => !decision.include);
+  lines.push("");
+  lines.push(excluded.length === 0 ? "No reviewer was excluded by stack scoping." : `Excluded (never run this round): ${excluded.map((decision) => decision.reviewer).join(", ")}.`);
+  return lines.join(`
+`);
+}
+
+// src/review/reviewers.ts
 var PROJECT_REVIEWER_MODULE = "review";
 function escapeRegexLiteral(literal) {
   return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -66242,12 +66690,60 @@ async function skillDirs(root) {
     if (!entry.isDirectory())
       continue;
     try {
-      await readFile87(path154.join(root, entry.name, "SKILL.md"), "utf8");
+      await readFile87(path155.join(root, entry.name, "SKILL.md"), "utf8");
       names.push(entry.name);
     } catch {}
   }
   return names.sort();
 }
+function metadataList(content, key) {
+  if (!content.startsWith("---"))
+    return [];
+  const end = content.indexOf(`
+---`, 3);
+  if (end === -1)
+    return [];
+  let inMetadata = false;
+  for (const line of content.slice(3, end).split(`
+`)) {
+    const top = /^([A-Za-z_][A-Za-z0-9_-]*):\s*(.*)$/.exec(line);
+    if (top) {
+      inMetadata = top[1] === "metadata";
+      continue;
+    }
+    if (!inMetadata)
+      continue;
+    const field = new RegExp(`^\\s+${escapeRegexLiteral(key)}:\\s*(.+)$`).exec(line);
+    if (field?.[1]) {
+      return field[1].trim().replace(/^["'[]|["'\]]$/g, "").split(",").map((entry) => entry.trim().replace(/^["']|["']$/g, "")).filter(Boolean);
+    }
+  }
+  return [];
+}
+function descriptionPathTriggers(description) {
+  const globs = new Set;
+  for (const raw of description.split(/\s+/)) {
+    const token = raw.replace(/^[("'`]+/, "").replace(/[,.;:"'`]+$/, "");
+    if (!token.includes("*") || !(token.includes("/") || token.startsWith("*.")))
+      continue;
+    const optional = /^(.*)\(([a-z0-9]+)\)$/i.exec(token);
+    if (optional?.[1] && optional[2]) {
+      globs.add(optional[1]);
+      globs.add(`${optional[1]}${optional[2]}`);
+    } else {
+      globs.add(token.replace(/\)+$/, ""));
+    }
+  }
+  return [...globs];
+}
+function descriptionFlags(description) {
+  const flags = new Set;
+  for (const match of description.matchAll(/(?:^|[\s(,])(--[a-z][a-z0-9-]*)/g)) {
+    if (match[1] && match[1] !== "--all")
+      flags.add(match[1]);
+  }
+  return [...flags];
+}
 async function driftFor(projectRoot, origin, recordedHash) {
   if (!origin || !recordedHash) {
     return "none";
@@ -66263,24 +66759,34 @@ async function driftFor(projectRoot, origin, recordedHash) {
   }
 }
 async function collectReviewers(projectRoot) {
-  const bundledRoot = path154.join(projectRoot, ".metaproject", "skills", "gdskills", "review");
+  const bundledRoot = path155.join(projectRoot, ".metaproject", "skills", "gdskills", "review");
   const bundled = (await skillDirs(bundledRoot)).map((name) => ({
     name,
     source: "bundled",
-    path: path154.posix.join(".metaproject", "skills", "gdskills", "review", name)
+    path: path155.posix.join(".metaproject", "skills", "gdskills", "review", name)
   }));
-  const projectRoot_ = path154.join(projectRoot, ".metaproject", "project-skills", PROJECT_REVIEWER_MODULE);
+  const projectRoot_ = path155.join(projectRoot, ".metaproject", "project-skills", PROJECT_REVIEWER_MODULE);
   const project = [];
   for (const name of await skillDirs(projectRoot_)) {
-    const relative = path154.posix.join(".metaproject", "project-skills", PROJECT_REVIEWER_MODULE, name);
-    const content = await readFile87(path154.join(projectRoot_, name, "SKILL.md"), "utf8");
+    const relative = path155.posix.join(".metaproject", "project-skills", PROJECT_REVIEWER_MODULE, name);
+    const content = await readFile87(path155.join(projectRoot_, name, "SKILL.md"), "utf8");
     const origin = metadataLine2(content, "Origin");
     const originHash = metadataLine2(content, "Origin Hash");
     const importedAt = metadataLine2(content, "Imported At");
+    const description = parseSkillFrontmatter(content).description;
+    const declaredPaths = metadataList(content, "paths");
+    const describedPaths = description ? descriptionPathTriggers(description) : [];
+    const pathsSource = declaredPaths.length > 0 ? "metadata" : describedPaths.length > 0 ? "description" : "none";
     project.push({
       name,
       source: "project-skill",
       path: relative,
+      ...description ? { description } : {},
+      paths: pathsSource === "metadata" ? declaredPaths : describedPaths,
+      pathsSource,
+      flags: description ? descriptionFlags(description) : [],
+      stackRequires: parseStackRequires(extractStackRequiresField(content)),
+      unresolvedRules: await unresolvedRuleReferences(projectRoot, content),
       ...origin ? { origin } : {},
       ...originHash ? { originHash } : {},
       ...importedAt ? { importedAt } : {},
@@ -66312,6 +66818,18 @@ function renderReviewerInventoryMarkdown(inventory) {
   for (const reviewer of inventory.project) {
     const provenance = reviewer.drift === "none" ? "no recorded origin" : `${reviewer.origin ?? "?"} \u2014 ${reviewer.drift}`;
     lines.push(`- ${reviewer.name} (${provenance})`);
+    lines.push(`  - paths: ${reviewer.paths.length > 0 ? reviewer.paths.join(", ") : "none \u2014 dispatched on every round"} [${reviewer.pathsSource}]`);
+    if (reviewer.flags.length > 0) {
+      lines.push(`  - flags: ${reviewer.flags.join(", ")}`);
+    }
+  }
+  const unresolved = inventory.project.filter((reviewer) => reviewer.unresolvedRules.length > 0);
+  if (unresolved.length > 0) {
+    lines.push("", "## rules cited but not in .metaproject/rules", "");
+    for (const reviewer of unresolved) {
+      lines.push(`- ${reviewer.name}: ${reviewer.unresolvedRules.join(", ")}`);
+    }
+    lines.push("", "The reviewer names these as its standard and the project does not have them. Re-run", "`keryx review import --from <overlay>` to copy them from the overlay, or add them by hand.");
   }
   const changed = inventory.project.filter((reviewer) => reviewer.drift === "changed");
   const missing = inventory.project.filter((reviewer) => reviewer.drift === "missing");
@@ -67187,194 +67705,11 @@ async function pickProviderModel(io, detected, deps = {}) {
 }
 
 // src/commands/review.ts
+init_caller_session();
 init_shell_config();
 init_selection();
 init_pr_comments();
 init_loop();
-
-// src/review/stack.ts
-var STACK_TAGS = ["nestjs", "react", "mobx", "prisma", "playwright", "sql", "http-server"];
-function isStackTag(value) {
-  return STACK_TAGS.includes(value);
-}
-var TAG_MARKERS = {
-  react: ["react", "react-dom"],
-  mobx: ["mobx", "mobx-react", "mobx-react-lite"],
-  prisma: ["prisma", "@prisma/client"],
-  playwright: ["@playwright/test", "playwright"],
-  sql: ["prisma", "@prisma/client", "typeorm", "sequelize", "knex", "drizzle-orm", "pg", "mysql2", "better-sqlite3", "kysely"],
-  "http-server": ["express", "fastify", "koa", "hono", "@nestjs/core", "@hapi/hapi"]
-};
-var DEPENDENCY_FIELDS = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
-async function detectProjectStack(cwd, options = {}) {
-  const readFile = options.readFile ?? defaultReadFile;
-  const manifestPath = `${cwd.replace(/\/+$/, "")}/package.json`;
-  let raw;
-  try {
-    raw = await readFile(manifestPath);
-  } catch {
-    return uncertainStack(`package.json not found at ${manifestPath}`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (error) {
-    return uncertainStack(`package.json at ${manifestPath} did not parse as JSON: ${error instanceof Error ? error.message : String(error)}`);
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    return uncertainStack(`package.json at ${manifestPath} is not a JSON object`);
-  }
-  const record = parsed;
-  const names = new Set;
-  for (const field of DEPENDENCY_FIELDS) {
-    const value = record[field];
-    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
-      for (const name of Object.keys(value)) {
-        names.add(name);
-      }
-    }
-  }
-  const workspaceGlobs = workspacePatterns(record);
-  if (workspaceGlobs.length > 0) {
-    return uncertainStack(`package.json at ${manifestPath} declares workspaces (${workspaceGlobs.join(", ")}); the dependencies that decide the stack live in the sub-packages, which this module does not walk`);
-  }
-  if (names.size === 0) {
-    return uncertainStack(`package.json at ${manifestPath} declares no dependencies in ${DEPENDENCY_FIELDS.join("/")} \u2014 a manifest that declares nothing has not said the repository uses nothing`);
-  }
-  const matched = [];
-  const nestjsMatches = [...names].filter((name) => name.startsWith("@nestjs/")).sort();
-  matched.push(...nestjsMatches);
-  const tags = { nestjs: nestjsMatches.length > 0 };
-  for (const tag of Object.keys(TAG_MARKERS)) {
-    const hit = TAG_MARKERS[tag].filter((marker) => names.has(marker));
-    tags[tag] = hit.length > 0;
-    matched.push(...hit);
-  }
-  return {
-    tags,
-    uncertain: false,
-    reason: `detected from ${manifestPath} (${names.size} declared dependenc${names.size === 1 ? "y" : "ies"})`,
-    matched
-  };
-}
-function workspacePatterns(record) {
-  const declared = record["workspaces"];
-  const list = Array.isArray(declared) ? declared : typeof declared === "object" && declared !== null ? declared["packages"] : undefined;
-  return Array.isArray(list) ? list.filter((item) => typeof item === "string" && item !== "") : [];
-}
-function uncertainStack(reason) {
-  const tags = Object.fromEntries(STACK_TAGS.map((tag) => [tag, true]));
-  return { tags, uncertain: true, reason, matched: [] };
-}
-async function defaultReadFile(path) {
-  return await Bun.file(path).text();
-}
-function parseStackRequires(value) {
-  if (value === undefined) {
-    return [];
-  }
-  const seen = new Set;
-  for (const token of value.split(",")) {
-    const trimmed = token.trim().toLowerCase();
-    if (isStackTag(trimmed)) {
-      seen.add(trimmed);
-    }
-  }
-  return [...seen];
-}
-function extractStackRequiresField(skillMdContent) {
-  if (!skillMdContent.startsWith("---")) {
-    return;
-  }
-  const end = skillMdContent.indexOf(`
----`, 3);
-  if (end === -1) {
-    return;
-  }
-  const lines = skillMdContent.slice(3, end).split(`
-`);
-  let inMetadata = false;
-  for (const line of lines) {
-    const topMatch = /^([A-Za-z_][A-Za-z0-9_-]*):\s*(.*)$/.exec(line);
-    if (topMatch) {
-      inMetadata = topMatch[1] === "metadata";
-      continue;
-    }
-    if (!inMetadata) {
-      continue;
-    }
-    const fieldMatch = /^\s+stack_requires:\s*(.+)$/.exec(line);
-    if (fieldMatch && fieldMatch[1] !== undefined) {
-      return stripQuotes(fieldMatch[1].trim());
-    }
-  }
-  return;
-}
-function stripQuotes(value) {
-  if (value.length >= 2) {
-    const first = value[0];
-    const last = value[value.length - 1];
-    if (first === '"' && last === '"' || first === "'" && last === "'") {
-      return value.slice(1, -1);
-    }
-  }
-  return value;
-}
-function scopeReviewerByStack(reviewer, requires, detected) {
-  const requiresCopy = [...requires];
-  if (requiresCopy.length === 0) {
-    return { reviewer, requires: requiresCopy, include: true, reason: "no stack requirement declared \u2014 generic reviewer" };
-  }
-  if (detected.uncertain) {
-    return {
-      reviewer,
-      requires: requiresCopy,
-      include: true,
-      reason: `stack detection uncertain (${detected.reason}); failing open`
-    };
-  }
-  const present = requiresCopy.filter((tag) => detected.tags[tag]);
-  if (present.length > 0) {
-    return { reviewer, requires: requiresCopy, include: true, reason: `detected: ${present.join(", ")}` };
-  }
-  return {
-    reviewer,
-    requires: requiresCopy,
-    include: false,
-    reason: `none of [${requiresCopy.join(", ")}] detected in package.json (${detected.reason})`
-  };
-}
-function renderStackScopingMarkdown(detected, decisions) {
-  const lines = [];
-  lines.push("## Stack scoping");
-  lines.push("");
-  lines.push(detected.uncertain ? `stack detection: uncertain \u2014 ${detected.reason}. Every stack-gated reviewer is included; uncertain never excludes.` : `stack detection: ${detected.reason}`);
-  if (!detected.uncertain) {
-    const present = STACK_TAGS.filter((tag) => detected.tags[tag]);
-    lines.push(`tags present: ${present.length > 0 ? present.join(", ") : "none"}`);
-    if (detected.matched.length > 0) {
-      lines.push(`matched dependencies: ${detected.matched.join(", ")}`);
-    }
-  }
-  lines.push("");
-  if (decisions.length === 0) {
-    lines.push("_no stack-gated reviewers were evaluated_");
-    return lines.join(`
-`);
-  }
-  lines.push("| reviewer | requires | include | reason |");
-  lines.push("|---|---|---|---|");
-  for (const decision of decisions) {
-    lines.push(`| ${decision.reviewer} | ${decision.requires.length > 0 ? decision.requires.join(", ") : "-"} | ${decision.include ? "yes" : "no"} | ${decision.reason} |`);
-  }
-  const excluded = decisions.filter((decision) => !decision.include);
-  lines.push("");
-  lines.push(excluded.length === 0 ? "No reviewer was excluded by stack scoping." : `Excluded (never run this round): ${excluded.map((decision) => decision.reviewer).join(", ")}.`);
-  return lines.join(`
-`);
-}
-
-// src/commands/review.ts
 init_types3();
 var CREATE_FLAGS = [
   "--target",
@@ -67416,6 +67751,7 @@ var COMMENTS_REPLY_FLAGS = [
   "--self",
   "--outcomes",
   "--result",
+  "--review",
   "--sha",
   "--round",
   "--final",
@@ -67424,7 +67760,8 @@ var COMMENTS_REPLY_FLAGS = [
   "--max-sentences",
   "--max-chars",
   "--flow-link",
-  "--fixtures"
+  "--fixtures",
+  "--allow-closed-pr"
 ];
 var LOOP_FLAGS = ["--flow", "--task"];
 var LEARN_FLAGS = ["--pr", "--dry-run", "--json"];
@@ -67473,6 +67810,7 @@ var TIER_FLAGS = [
   "--security",
   "--session-provider",
   "--session-model",
+  "--from-shell-config",
   "--catalog",
   "--json"
 ];
@@ -67752,7 +68090,7 @@ async function runBudget(args) {
 async function runTier(args) {
   rejectUnknownFlags(args, TIER_FLAGS, "tier");
   const signals = tierSignalsFromArgs(args);
-  const session = sessionModelFromArgs(args);
+  const { session, source } = sessionModelFromArgs(args);
   const catalog = await tierCatalog(args, session);
   const decision = decideDispatchModel(session, signals, catalog);
   const block = dispatchModelBlock(decision);
@@ -67765,8 +68103,13 @@ async function runTier(args) {
   console.log("");
   console.log(`tier: ${decision.tier}`);
   console.log(`tier_reasons: ${decision.tier_reasons.join(", ")}`);
-  console.log(`provider: ${decision.provider === "" ? "not resolved (no --session-provider, and none persisted by `keryx shell`)" : decision.provider}`);
-  console.log(`model: ${decision.model === "" ? "not resolved \u2014 run this dispatch on YOUR OWN model (never a downgrade)" : decision.model}`);
+  console.log(`session_source: ${SESSION_SOURCE_LABELS[source]}`);
+  if (pinsModel(decision)) {
+    console.log(`provider: ${decision.provider}`);
+    console.log(`model: ${decision.model}`);
+  } else {
+    console.log(`model: inherit \u2014 ${ADAPTIVE_GUIDANCE[decision.tier]}`);
+  }
   console.log(`tier_resolution: ${decision.tier_resolution}`);
   console.log(`model_discovery: provider=${discovery.provider === "" ? "none" : discovery.provider} candidates=${discovery.candidates.length} ranked=${discovery.ranked.length} session_rank=${discovery.session_rank ?? "none"}`);
   console.log(`fallback_reason: ${discovery.fallback_reason ?? "none (ranking was not refused)"}`);
@@ -67795,12 +68138,25 @@ function tierSignalsFromArgs(args) {
     hasSecurityFinding: args.includes("--security")
   };
 }
-function sessionModelFromArgs(args) {
-  const config = loadShellConfig();
-  return {
-    providerId: (optionValue(args, "--session-provider") ?? config.provider ?? "").trim(),
-    modelId: (optionValue(args, "--session-model") ?? config.model ?? "").trim()
-  };
+var SESSION_SOURCE_LABELS = {
+  flags: "flags (--session-provider/--session-model)",
+  env: "environment (KERYX_SESSION_PROVIDER/KERYX_SESSION_MODEL)",
+  "shell-config": "the selection `keryx shell` persisted (--from-shell-config)",
+  none: "none \u2014 the caller named no model, so the block is adaptive"
+};
+var ADAPTIVE_GUIDANCE = {
+  light: "dispatch on a lighter model your own runtime offers (its fast/small class), or on your session model if it offers no choice",
+  standard: "dispatch on your session model",
+  deep: "dispatch on the most capable model your own runtime offers, or on your session model if it offers no choice"
+};
+function sessionModelFromArgs(args, env = process.env) {
+  const resolved = resolveCallerSession({
+    flagProvider: optionValue(args, "--session-provider"),
+    flagModel: optionValue(args, "--session-model"),
+    fromShellConfig: args.includes("--from-shell-config"),
+    env
+  });
+  return { session: { providerId: resolved.providerId, modelId: resolved.modelId }, source: resolved.source };
 }
 async function tierCatalog(args, session) {
   const file = optionValue(args, "--catalog");
@@ -67833,12 +68189,14 @@ async function tierCatalog(args, session) {
   }
   return await detectProviders({ fetch, env: envWithSavedApiKeys() });
 }
+function pinsModel(decision) {
+  return decision.tier_resolution === "discovered" && decision.provider !== "" && decision.model !== "";
+}
 function dispatchModelBlock(decision) {
-  const named = decision.provider !== "" && decision.model !== "";
   return {
     tier: decision.tier,
     tier_reasons: decision.tier_reasons,
-    ...named ? { provider: decision.provider, model: decision.model } : { inherit: true },
+    ...pinsModel(decision) ? { provider: decision.provider, model: decision.model } : { inherit: true },
     tier_resolution: decision.tier_resolution,
     model_discovery: decision.model_discovery
   };
@@ -67887,6 +68245,15 @@ async function runCommentsCollect(args) {
   console.log(renderPrCommentsMarkdown({ repo, number, round, result }));
   console.log(`findings: ${findings.length}${out === undefined ? "" : ` (written to ${out})`}`);
   console.log(`collected against: ${sha} (round ${round})`);
+  console.log(`pull request: ${describePullRequest(result.pull)}`);
+  if (result.pull.state === "unknown") {
+    console.log("WARNING: the pull request's state could not be read \u2014 `comments reply` will refuse this pull request.");
+  } else if (result.pull.merged || result.pull.state === "closed") {
+    console.log("WARNING: the pull request is no longer open \u2014 `comments reply` will refuse it unless --allow-closed-pr is passed.");
+  }
+  if (result.pull.headSha !== null && !shaMatchesHead(sha, result.pull.headSha)) {
+    console.log(`WARNING: --sha ${sha} is not the pull request's head (${result.pull.headSha}) \u2014 this collection is stale, and \`comments reply\` refuses a SHA that is not the head.`);
+  }
   console.log(`unanswered so far: ${unansweredComments(recorded).length} \u2014 replies are posted ONCE, after the final round.`);
 }
 async function runCommentsReply(args) {
@@ -67897,6 +68264,7 @@ async function runCommentsReply(args) {
   const isFinal = args.includes("--final");
   const dryRun = args.includes("--dry-run");
   await refuseInvalidResult(optionValue(args, "--result"), optionValue(args, "--outcomes"));
+  await refuseUnmanagedReply(args, repo, number, dryRun || !isFinal);
   const cwd = process.cwd();
   const port = await resolvePort(args);
   const state = await readPrCommentState(cwd, repo, number);
@@ -67924,7 +68292,9 @@ async function runCommentsReply(args) {
     repo,
     number,
     pass,
-    sha: requiredOption(args, "--sha", "comments reply"),
+    sha: requiredSha(args, "--sha", "comments reply"),
+    pull: collected.pull,
+    allowClosed: args.includes("--allow-closed-pr"),
     round: { index: round, isFinal },
     state,
     dryRun
@@ -67950,7 +68320,7 @@ async function resolvePort(args) {
     return createGhPort();
   }
   const files = {};
-  for (const key of ["pull-comments", "pull-reviews", "issue-comments"]) {
+  for (const key of ["pull", "pull-comments", "pull-reviews", "issue-comments"]) {
     const file = join3(fixtures, `${key}.json`);
     try {
       files[key] = JSON.parse(await readFile88(file, "utf8"));
@@ -67976,6 +68346,28 @@ async function resolveSelfLogin(args) {
   }
   return login;
 }
+async function refuseUnmanagedReply(args, repo, number, postsNothing) {
+  if (postsNothing || optionValue(args, "--result") !== undefined) {
+    return;
+  }
+  const where = `${repo}#${number}`;
+  const ref = optionValue(args, "--review");
+  if (ref === undefined) {
+    throw new Error(`Refusing to reply on ${where}: posting is for a MANAGED review, and nothing here shows one. Pass \`--review <review-id-or-path>\` (the package \`keryx review start/attach\` wrote for this pull request) or \`--result <file>\` (a review-pr-feedback run). A lightweight review is report-only \u2014 it answers nobody. \`--dry-run\` still shows what would be posted.`);
+  }
+  let manifest;
+  try {
+    manifest = await getManagedReviewStatus(process.cwd(), ref);
+  } catch (error) {
+    throw new Error(`Refusing to reply on ${where}: \`--review ${ref}\` is not a readable managed review package (${error instanceof Error ? error.message : String(error)}).`);
+  }
+  const target = manifest.target;
+  const refNumber = /(?:^|[/#])(\d+)\/?$/.exec(target.ref.trim())?.[1];
+  const repoMismatch = target.repository !== undefined && target.repository !== "" && !target.repository.toLowerCase().endsWith(repo.toLowerCase());
+  if (target.kind !== "pr" || refNumber !== String(number) || repoMismatch) {
+    throw new Error(`Refusing to reply on ${where}: \`--review ${ref}\` reviewed ${target.kind} \`${target.ref}\`${target.repository ? ` in ${target.repository}` : ""}, not this pull request. A reply pass answers the review that produced its outcomes.`);
+  }
+}
 async function refuseInvalidResult(source, outcomesSource) {
   if (source === undefined) {
     return;
@@ -68035,20 +68427,20 @@ async function runLearn(args) {
   const cwd = process.cwd();
   const config = await loadReviewLearningConfig(cwd);
   if (config === null) {
-    console.log(`no review learning configured: ${path155.relative(cwd, reviewLearningConfigPath(cwd))} is absent, so this project does not learn from pull-request comments.`);
+    console.log(`no review learning configured: ${path156.relative(cwd, reviewLearningConfigPath(cwd))} is absent, so this project does not learn from pull-request comments.`);
     return;
   }
   const number = requiredInteger(args, "--pr");
   const statePath = prCommentsStatePath(cwd, config.repo, number);
   if (!await pathExists(statePath)) {
-    throw new Error(`No collected comments for ${config.repo}#${number}: ${path155.relative(cwd, statePath)} does not exist. Run \`keryx review comments collect --repo ${config.repo} --pr ${number} --sha <head-sha>\` first \u2014 this command reads that record and never fetches from GitHub.`);
+    throw new Error(`No collected comments for ${config.repo}#${number}: ${path156.relative(cwd, statePath)} does not exist. Run \`keryx review comments collect --repo ${config.repo} --pr ${number} --sha <head-sha>\` first \u2014 this command reads that record and never fetches from GitHub.`);
   }
   const state = await readPrCommentState(cwd, config.repo, number);
   const selection = selectLearnableComments(state, config.authors);
   const sourcePath = learningSourcePath(cwd, config.repo, number);
   const recordPath = learningRecordPath(cwd, config.repo, number);
-  const relativeSourcePath = toPosix(path155.relative(cwd, sourcePath));
-  await mkdir54(path155.dirname(sourcePath), { recursive: true });
+  const relativeSourcePath = toPosix(path156.relative(cwd, sourcePath));
+  await mkdir55(path156.dirname(sourcePath), { recursive: true });
   await writeFileAtomic(sourcePath, renderLearningSource(selection));
   await writeFileAtomic(recordPath, renderLearningRecord({
     repo: config.repo,
@@ -68071,7 +68463,7 @@ async function runLearn(args) {
     }
     console.log(`nothing to learn from ${config.repo}#${number} \u2014 ${detail}.`);
     console.log(`Source: ${relativeSourcePath}`);
-    console.log(`Record: ${toPosix(path155.relative(cwd, recordPath))}`);
+    console.log(`Record: ${toPosix(path156.relative(cwd, recordPath))}`);
     return;
   }
   const proposal = await learnProjectSkill(cwd, {
@@ -68087,7 +68479,7 @@ async function runLearn(args) {
   console.log(`${proposal.dryRun ? "Would create" : "Created"} learning proposal: ${proposal.proposalId}`);
   console.log(`Skill: ${proposal.skill.module}/${proposal.skill.name}`);
   console.log(`Source: ${relativeSourcePath}`);
-  console.log(`Record: ${toPosix(path155.relative(cwd, recordPath))}`);
+  console.log(`Record: ${toPosix(path156.relative(cwd, recordPath))}`);
   console.log(`Authors: ${config.authors.join(", ")}`);
   console.log(`Comments: ${selection.kept.length} used, ${selection.unconfigured.length} excluded as unconfigured, ${selection.bodyless.length} with no recorded body`);
   console.log(`Confidence: ${proposal.confidence}`);
@@ -68775,7 +69167,9 @@ comments:
   UNOBSERVED, on the same rule as no record at all.
   \`reply\` refuses without --final: replying per round turns one review thread
   into six, and a reply written mid-flow states an intention rather than an
-  outcome. Each reply is at most ${DEFAULT_MAX_SENTENCES_PER_REPLY} sentences (--max-sentences) AND ${DEFAULT_MAX_REPLY_CHARS} characters
+  outcome. It also refuses a pull request that is closed or merged (override:
+  --allow-closed-pr), one whose state could not be read, and a --sha that is not
+  the pull request's head \u2014 the answers must describe the commit it points at. Each reply is at most ${DEFAULT_MAX_SENTENCES_PER_REPLY} sentences (--max-sentences) AND ${DEFAULT_MAX_REPLY_CHARS} characters
   (--max-chars) \u2014 CUT to both in code, with the remainder replaced by a link,
   because a sentence budget alone lets one 4,000-character sentence through \u2014
   threaded where GitHub gives a thread, and capped
@@ -68805,11 +69199,13 @@ tier:
   that produced it, the resolved provider/model, \`tier_resolution\`, and what was
   on the table when it resolved; --json prints the block alone.
   NO MODEL NAME EXISTS IN THIS COMMAND. The session's provider/model come from
-  the selection \`keryx shell\` persisted (override with --session-provider /
-  --session-model), and the candidate set comes from live provider detection
-  (override with --catalog, the \`detectProviders()\` shape). When the environment
-  cannot be worked out, the block says \`inherit\` and the dispatch runs on YOUR
-  OWN model: never a downgrade, never a non-zero exit. Detection is skipped
+  the caller: --session-provider / --session-model, else KERYX_SESSION_PROVIDER /
+  KERYX_SESSION_MODEL, else (only with --from-shell-config) the selection
+  \`keryx shell\` persisted. The candidate set comes from live provider detection
+  (override with --catalog, the \`detectProviders()\` shape). A model is named
+  only when discovery assigned one other than the session's; otherwise the block
+  says \`inherit\` with the tier, and the host picks its own model for that tier
+  (standard: the session model). Never a non-zero exit. Detection is skipped
   entirely when the session names no provider and model, because ranking is
   refused without an anchor whatever the catalogue holds.
 
@@ -68852,8 +69248,8 @@ stack:
 
 // src/commands/rules.ts
 init_fs();
-import { mkdir as mkdir55, readFile as readFile89, writeFile as writeFile47 } from "fs/promises";
-import path156 from "path";
+import { mkdir as mkdir56, readFile as readFile89, writeFile as writeFile47 } from "fs/promises";
+import path157 from "path";
 async function rulesCommand(args = [], projectRoot = process.cwd()) {
   const subcommand = args[0];
   if (!subcommand || subcommand === "--help" || subcommand === "-h") {
@@ -68871,11 +69267,11 @@ async function rulesCommand(args = [], projectRoot = process.cwd()) {
     printHelp13();
     return;
   }
-  const metaprojectRoot = path156.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path157.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run `keryx init` first.");
   }
-  const manifestPath = path156.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path157.join(metaprojectRoot, "metaproject.json");
   const manifest = await readManifest3(manifestPath);
   const enableTasks = moduleEnabled(manifest, "tasks");
   if (options.preview) {
@@ -68926,7 +69322,7 @@ async function rulesCommand(args = [], projectRoot = process.cwd()) {
     createDefault: true
   });
   const ruleSources = syncedRules.map((rule) => rule.source);
-  await mkdir55(path156.join(metaprojectRoot, "rules"), { recursive: true });
+  await mkdir56(path157.join(metaprojectRoot, "rules"), { recursive: true });
   await persistManifestEntrypoints(manifestPath, manifest, ruleSources);
   await refreshRoutingEntrypoints(metaprojectRoot, manifest, ruleSources, await hasDistilledEntrypoints(metaprojectRoot), { intent: "rules sync", resolution: options.resolution });
   console.log(`# rules sync`);
@@ -69013,17 +69409,17 @@ Options:
 }
 
 // src/commands/standard.ts
-import { mkdir as mkdir56, writeFile as writeFile48 } from "fs/promises";
-import path160 from "path";
+import { mkdir as mkdir57, writeFile as writeFile48 } from "fs/promises";
+import path161 from "path";
 
 // src/standard/service.ts
 init_fs();
-import path158 from "path";
+import path159 from "path";
 import { readFile as readFile91 } from "fs/promises";
 
 // src/standard/validate.ts
 init_fs();
-import path157 from "path";
+import path158 from "path";
 import { readFile as readFile90 } from "fs/promises";
 
 // src/standard/schemas.ts
@@ -69296,20 +69692,20 @@ var MANIFEST_TOP_LEVEL_SCHEMA = {
 async function validateWorkspace2(cwd) {
   const errors = [];
   const warnings = [];
-  const metaprojectRoot = path157.join(cwd, ".metaproject");
+  const metaprojectRoot = path158.join(cwd, ".metaproject");
   const requiredFiles = ["index.md", "README.md", "metaproject.json"];
   for (const file of requiredFiles) {
-    if (!await pathExists(path157.join(metaprojectRoot, file))) {
+    if (!await pathExists(path158.join(metaprojectRoot, file))) {
       errors.push(issue("missing-required-file", `Required file .metaproject/${file} is missing`, `Run \`keryx init\` to scaffold .metaproject/${file}.`));
     }
   }
   const requiredDirs = ["modules", "rules", "skills", "data"];
   for (const dir of requiredDirs) {
-    if (!await pathExists(path157.join(metaprojectRoot, dir))) {
+    if (!await pathExists(path158.join(metaprojectRoot, dir))) {
       errors.push(issue("missing-required-dir", `Required directory .metaproject/${dir}/ is missing`, `Run \`keryx init\` to create .metaproject/${dir}/.`));
     }
   }
-  const manifestPath = path157.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path158.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return { ok: errors.length === 0, errors, warnings };
   }
@@ -69341,7 +69737,7 @@ async function validateWorkspace2(cwd) {
       if (typeof value !== "string") {
         continue;
       }
-      if (!await pathExists(path157.join(cwd, value))) {
+      if (!await pathExists(path158.join(cwd, value))) {
         errors.push(issue("missing-declared-path", `Declared path paths.${key} -> ${value} does not exist`, `Create ${value} or remove paths.${key} from metaproject.json.`));
       }
     }
@@ -69351,7 +69747,7 @@ async function validateWorkspace2(cwd) {
       continue;
     }
     if (typeof entry.manifest === "string") {
-      if (!await pathExists(path157.join(cwd, entry.manifest))) {
+      if (!await pathExists(path158.join(cwd, entry.manifest))) {
         errors.push(issue("missing-module-manifest", `Enabled module "${key}" manifest ${entry.manifest} is missing`, `Create ${entry.manifest} or run \`keryx update\` to regenerate module manifests.`));
       }
     }
@@ -69360,14 +69756,14 @@ async function validateWorkspace2(cwd) {
       if (typeof value !== "string") {
         continue;
       }
-      if (!await pathExists(path157.join(cwd, value))) {
+      if (!await pathExists(path158.join(cwd, value))) {
         const sink = field === "data" ? warnings : errors;
         sink.push(issue("missing-module-path", `Module "${key}" declares ${String(field)} ${value}, which does not exist`, field === "data" ? `Run the module (e.g. \`keryx ${key} ...\`) to generate ${value}, or update modules.${key}.data in metaproject.json.` : `Create ${value} or update modules.${key}.${String(field)} in metaproject.json.`));
       }
     }
   }
   for (const name of ROOT_ENTRYPOINTS2) {
-    const filePath = path157.join(cwd, name);
+    const filePath = path158.join(cwd, name);
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -69421,7 +69817,7 @@ async function runDoctor(cwd) {
   return validateWorkspace2(cwd);
 }
 async function readManifest4(cwd) {
-  const manifestPath = path158.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path159.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     throw new Error("Metaproject is not initialized (missing .metaproject/metaproject.json). Run `keryx init` first.");
   }
@@ -69443,10 +69839,10 @@ async function runCapabilities(cwd) {
 // src/standard/emit-llms.ts
 init_fs();
 init_json();
-import path159 from "path";
+import path160 from "path";
 import { readdir as readdir31 } from "fs/promises";
 function llmsPath(cwd) {
-  return path159.join(cwd, ".metaproject", "llms.txt");
+  return path160.join(cwd, ".metaproject", "llms.txt");
 }
 function renderLlms(manifest, artifacts) {
   const name = manifest.name ?? "metaproject";
@@ -69489,7 +69885,7 @@ function renderLlms(manifest, artifacts) {
 `;
 }
 async function collectArtifactIndex(cwd) {
-  const dataRoot = path159.join(cwd, ".metaproject", "data");
+  const dataRoot = path160.join(cwd, ".metaproject", "data");
   if (!await pathExists(dataRoot)) {
     return [];
   }
@@ -69502,11 +69898,11 @@ async function collectArtifactIndex(cwd) {
       return;
     }
     for (const entry of entries) {
-      const full = path159.join(dir, entry.name);
+      const full = path160.join(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(full);
       } else if (entry.isFile()) {
-        const rel = toPosix(path159.relative(cwd, full));
+        const rel = toPosix(path160.relative(cwd, full));
         if (rel.includes("/artifacts/")) {
           out.push(rel);
         }
@@ -69517,7 +69913,7 @@ async function collectArtifactIndex(cwd) {
   return out.sort();
 }
 async function emitLlms(cwd) {
-  const manifestPath = path159.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path160.join(cwd, ".metaproject", "metaproject.json");
   const manifest = await readJsonFileOr(manifestPath, {});
   const artifacts = await collectArtifactIndex(cwd);
   const content = renderLlms(manifest, artifacts);
@@ -69696,11 +70092,11 @@ async function handleEmit(projectRoot, args) {
   if (args.includes("--stdout")) {
     process.stdout.write(result.content);
   } else {
-    await mkdir56(path160.dirname(result.path), { recursive: true });
+    await mkdir57(path161.dirname(result.path), { recursive: true });
     await writeFile48(result.path, result.content, "utf8");
     heading("keryx standard emit llms");
     if (problems.length === 0) {
-      console.log(`  ${style.green(symbols.ok)} wrote ${path160.relative(projectRoot, result.path)} (valid llms.txt)`);
+      console.log(`  ${style.green(symbols.ok)} wrote ${path161.relative(projectRoot, result.path)} (valid llms.txt)`);
     } else {
       for (const problem of problems) {
         console.log(`  ${style.red(symbols.cross)} ${problem}`);
@@ -70503,8 +70899,9 @@ var COMMAND_DESCRIPTORS = [
     ],
     args: [
       { name: "opt-in", type: "bool", required: false, desc: "request cross-family review; without it the answer is single-family" },
-      { name: "session-provider", type: "string", required: false, desc: "provider that authored the change; defaults to the persisted shell selection" },
-      { name: "session-model", type: "string", required: false, desc: "model that authored the change; defaults to the persisted shell selection" },
+      { name: "session-provider", type: "string", required: false, desc: "provider that authored the change; defaults to KERYX_SESSION_PROVIDER" },
+      { name: "session-model", type: "string", required: false, desc: "model that authored the change; defaults to KERYX_SESSION_MODEL" },
+      { name: "from-shell-config", type: "bool", required: false, desc: "use the selection keryx shell persisted as the session (off by default)" },
       { name: "json", type: "bool", required: false, desc: "the record a round should carry" }
     ],
     json: true,
@@ -70699,8 +71096,8 @@ Usage:
 }
 
 // src/commands/security.ts
-import { mkdir as mkdir57, readdir as readdir32, readFile as readFile93, writeFile as writeFile49 } from "fs/promises";
-import path162 from "path";
+import { mkdir as mkdir58, readdir as readdir32, readFile as readFile93, writeFile as writeFile49 } from "fs/promises";
+import path163 from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 init_args();
 init_contained_path();
@@ -70870,11 +71267,11 @@ init_detect();
 init_fs();
 init_config();
 init_detect();
-import path161 from "path";
+import path162 from "path";
 import { readFile as readFile92 } from "fs/promises";
 var DEFAULT_CORPORA = ["injection", "exfil", "structured-pii", "secret"];
 async function loadEvalCases(dir) {
-  const file = path161.join(dir, "cases.json");
+  const file = path162.join(dir, "cases.json");
   if (!await pathExists(file)) {
     return [];
   }
@@ -70916,7 +71313,7 @@ async function runEval(opts) {
   const corporaSeen = [];
   let totalCases = 0;
   for (const corpus of opts.corpora) {
-    const dir = path161.join(opts.fixturesRoot, corpus);
+    const dir = path162.join(opts.fixturesRoot, corpus);
     const cases = await loadEvalCases(dir);
     if (cases.length === 0) {
       continue;
@@ -71155,7 +71552,7 @@ async function handleScan(cwd, args) {
     ownerRoot: projectRoot,
     targetPath: contained.path,
     source,
-    path: path162.relative(projectRoot, contained.path) || ".",
+    path: path163.relative(projectRoot, contained.path) || ".",
     ...exclusions.length > 0 ? { exclusions } : {},
     ...recursive !== undefined ? { recursive } : {},
     ...maxFiles !== undefined ? { limits: { maxFiles } } : {},
@@ -71231,7 +71628,7 @@ function scanPathArgument(args) {
   return optionValue(args, "--file");
 }
 function mcpBaselinePath(cwd) {
-  return path162.join(securityDataRoot(cwd), "mcp-baseline.json");
+  return path163.join(securityDataRoot(cwd), "mcp-baseline.json");
 }
 async function readMcpBaseline(file) {
   if (!await pathExists(file)) {
@@ -71259,7 +71656,7 @@ async function collectManifestFiles(target) {
   }
   const files = [];
   for (const entry of entries) {
-    const full = path162.join(target, entry.name);
+    const full = path163.join(target, entry.name);
     if (entry.isDirectory()) {
       files.push(...await collectManifestFiles(full));
     } else if (entry.isFile() && entry.name.endsWith(".json") && entry.name !== "cases.json") {
@@ -71294,7 +71691,7 @@ async function handleScanMcp(cwd, args) {
     const { manifest } = extractManifestAndBaseline(read.value, {});
     const baseline = { schemaVersion: 1, tools: buildMcpBaseline(manifest) };
     const outPath = mcpBaselinePath(cwd);
-    await mkdir57(path162.dirname(outPath), { recursive: true });
+    await mkdir58(path163.dirname(outPath), { recursive: true });
     await writeFile49(outPath, `${JSON.stringify(baseline, null, 2)}
 `, "utf8");
     if (asJson) {
@@ -71338,7 +71735,7 @@ async function handleScanMcp(cwd, args) {
       coverage,
       baseline: baselineState.state,
       files: perFile.map((entry) => ({
-        file: path162.relative(cwd, entry.file),
+        file: path163.relative(cwd, entry.file),
         readable: entry.readable,
         findings: entry.matches.map((m) => ({
           category: m.category,
@@ -71355,7 +71752,7 @@ async function handleScanMcp(cwd, args) {
       console.log("");
       console.log(`  ${style.bold(`${unreadable} manifest(s) could not be read and were NOT scanned:`)}`);
       for (const entry of perFile.filter((e) => !e.readable)) {
-        console.log(`    ${symbols.cross} ${path162.relative(cwd, entry.file)}`);
+        console.log(`    ${symbols.cross} ${path163.relative(cwd, entry.file)}`);
       }
     }
     if (baselineState.state === "unreadable") {
@@ -71364,7 +71761,7 @@ async function handleScanMcp(cwd, args) {
     }
     for (const entry of flagged) {
       console.log("");
-      console.log(`  ${style.bold(path162.relative(cwd, entry.file))}`);
+      console.log(`  ${style.bold(path163.relative(cwd, entry.file))}`);
       for (const m of entry.matches) {
         console.log(`    ${severityMarker(m.severity)} ${m.category}/${m.policyId} ${style.dim(`(conf ${m.confidence})`)}`);
       }
@@ -71525,9 +71922,9 @@ async function handleHooks(cwd, args) {
       await installRuntimeHooks(cwd, runtime);
       const errors = runtime.validate(JSON.parse(await readFile93(runtime.settingsPath(cwd), "utf8")));
       if (errors.length === 0) {
-        console.log(`  ${style.green(symbols.ok)} ${runtime.id} \u2192 ${path162.relative(cwd, runtime.settingsPath(cwd))}`);
+        console.log(`  ${style.green(symbols.ok)} ${runtime.id} \u2192 ${path163.relative(cwd, runtime.settingsPath(cwd))}`);
         if (await modeOf(cwd) === "advisory") {
-          note(`advisory mode: ${runtime.id} will report findings and allow the call. Set \`mode\` to \`enforced\`, \`ci\` or \`gateway\` in ${path162.join(".metaproject", "security.config.json")} to make it refuse.`);
+          note(`advisory mode: ${runtime.id} will report findings and allow the call. Set \`mode\` to \`enforced\`, \`ci\` or \`gateway\` in ${path163.join(".metaproject", "security.config.json")} to make it refuse.`);
         }
       } else {
         for (const e of errors) {
@@ -71542,7 +71939,7 @@ async function handleHooks(cwd, args) {
   }
 }
 function fixturesRoot() {
-  return path162.join(path162.dirname(fileURLToPath7(import.meta.url)), "..", "..", "fixtures");
+  return path163.join(path163.dirname(fileURLToPath7(import.meta.url)), "..", "..", "fixtures");
 }
 async function handleEval(cwd, args) {
   const corpusArg = optionValue(args, "--corpus") ?? "all";
@@ -71564,7 +71961,7 @@ async function handleEval(cwd, args) {
     detect = await pureDetect(cwd);
   }
   const report = await runEval({ fixturesRoot: root, corpora, detect });
-  const thresholds = await loadThresholds(path162.join(root, "thresholds.json"));
+  const thresholds = await loadThresholds(path163.join(root, "thresholds.json"));
   const gate = gateEval(report, thresholds);
   if (asJson) {
     console.log(JSON.stringify({ report, gate }, null, 2));
@@ -71660,7 +72057,7 @@ async function policyIsUnderstood(cwd) {
   const config = await loadSecurityConfig(cwd);
   const errors = validateSecurityConfig(config);
   if (errors.length > 0) {
-    process.stderr.write(`keryx security: ${path162.relative(cwd, configPath(cwd))} does not match the policy schema, so no approval is emitted \u2014 ${errors[0]}
+    process.stderr.write(`keryx security: ${path163.relative(cwd, configPath(cwd))} does not match the policy schema, so no approval is emitted \u2014 ${errors[0]}
 `);
     return false;
   }
@@ -71710,7 +72107,7 @@ function printSecurityHelp() {
 
 // src/harness/process/sandbox/detect.ts
 import { existsSync as realExistsSync } from "fs";
-import path163 from "path";
+import path164 from "path";
 
 // src/harness/process/sandbox/seatbelt.ts
 var SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
@@ -71904,9 +72301,9 @@ function detectSandboxLauncher(opts = {}) {
   }
   if (platform === "linux") {
     const env = opts.env ?? process.env;
-    const dirs = (env.PATH ?? "").split(path163.delimiter).filter(Boolean);
+    const dirs = (env.PATH ?? "").split(path164.delimiter).filter(Boolean);
     for (const dir of dirs) {
-      const candidate = path163.join(dir, BWRAP_PROGRAM);
+      const candidate = path164.join(dir, BWRAP_PROGRAM);
       if (exists(candidate)) {
         return { available: true, platform, path: candidate };
       }
@@ -72045,7 +72442,7 @@ async function sandboxCommand(args = [], deps = {}) {
 init_args();
 
 // src/commands/integrate.ts
-import path164 from "path";
+import path165 from "path";
 var EDITOR_USAGE = `<cursor|claude|opencode|vscode|generic|all>`;
 var DEFAULT_EDITORS = ["all"];
 async function integrateCommand(args = [], cwd = process.cwd(), label) {
@@ -72078,7 +72475,7 @@ async function addIntegration(cwd, editors, dryRun, label) {
       console.log(outcome.snippet ?? "");
       continue;
     }
-    const rel = path164.relative(cwd, outcome.filePath);
+    const rel = path165.relative(cwd, outcome.filePath);
     if (outcome.errors.length > 0) {
       for (const e of outcome.errors) {
         console.log(`  ${style.red(symbols.cross)} ${e}`);
@@ -72117,7 +72514,7 @@ async function removeIntegration(cwd, editors, dryRun, label) {
       console.log(`  ${style.gray(symbols.off)} ${outcome.id} ${style.dim("no file to change")}`);
       continue;
     }
-    const rel = path164.relative(cwd, outcome.filePath);
+    const rel = path165.relative(cwd, outcome.filePath);
     console.log(`  ${outcome.removed ? style.green(symbols.ok) : style.gray(symbols.off)} ${outcome.id} ${style.dim(outcome.removed ? `${dryRun ? "would be removed from" : "removed from"} ${rel}` : "nothing to remove")}`);
   }
 }
@@ -72144,21 +72541,21 @@ init_contained_path();
 
 // src/mcp-servers/config.ts
 init_config_dir();
-import path166 from "path";
+import path167 from "path";
 
 // src/mcp-servers/compat.ts
 init_config_dir();
-import path165 from "path";
+import path166 from "path";
 import os2 from "os";
 function compatFiles(cwd, home) {
   const base = home ?? os2.homedir();
   return [
-    { source: "grok", file: path165.join(base, ".grok", "config.toml"), projectLocal: false },
-    { source: "grok", file: path165.join(cwd, ".grok", "config.toml"), projectLocal: true },
-    { source: "mcp.json", file: path165.join(cwd, ".mcp.json"), projectLocal: true },
-    { source: "cursor", file: path165.join(base, ".cursor", "mcp.json"), projectLocal: false },
-    { source: "cursor", file: path165.join(cwd, ".cursor", "mcp.json"), projectLocal: true },
-    { source: "claude", file: path165.join(base, ".claude.json"), projectLocal: false }
+    { source: "grok", file: path166.join(base, ".grok", "config.toml"), projectLocal: false },
+    { source: "grok", file: path166.join(cwd, ".grok", "config.toml"), projectLocal: true },
+    { source: "mcp.json", file: path166.join(cwd, ".mcp.json"), projectLocal: true },
+    { source: "cursor", file: path166.join(base, ".cursor", "mcp.json"), projectLocal: false },
+    { source: "cursor", file: path166.join(cwd, ".cursor", "mcp.json"), projectLocal: true },
+    { source: "claude", file: path166.join(base, ".claude.json"), projectLocal: false }
   ];
 }
 function readMcpServersShape(file, text) {
@@ -72554,25 +72951,25 @@ function parseConfigFile(file) {
 }
 function projectConfigFiles(cwd, gitRoot) {
   const files = [];
-  let dir = path166.resolve(cwd);
-  const stop = gitRoot === undefined ? undefined : path166.resolve(gitRoot);
+  let dir = path167.resolve(cwd);
+  const stop = gitRoot === undefined ? undefined : path167.resolve(gitRoot);
   for (;; ) {
-    files.push(path166.join(dir, ".keryx", "mcp-servers.json"));
+    files.push(path167.join(dir, ".keryx", "mcp-servers.json"));
     if (stop !== undefined && dir === stop)
       break;
-    const parent = path166.dirname(dir);
+    const parent = path167.dirname(dir);
     if (parent === dir)
       break;
     dir = parent;
   }
   return files.reverse();
 }
-var NO_HOME = path166.join(path166.sep, "\x00keryx-no-home");
+var NO_HOME = path167.join(path167.sep, "\x00keryx-no-home");
 function loadMcpServers(options) {
   const env = options.env ?? process.env;
   const configDir = options.configDir ?? keryxConfigDir();
   const problems = [];
-  const userFile = path166.join(configDir, "mcp-servers.json");
+  const userFile = path167.join(configDir, "mcp-servers.json");
   const user = parseConfigFile(userFile);
   problems.push(...user.problems);
   const winner = new Map;
@@ -72607,7 +73004,7 @@ function loadMcpServers(options) {
       winner.set(name, { entry, source: "project", file, projectLocal: true });
     }
   }
-  const overlayFile = path166.join(configDir, "mcp-servers-disabled.json");
+  const overlayFile = path167.join(configDir, "mcp-servers-disabled.json");
   const overlay = readOverlay(overlayFile);
   problems.push(...overlay.problems);
   const servers = [...winner.entries()].map(([name, { entry, source, file, projectLocal }]) => {
@@ -73042,11 +73439,11 @@ function createMcpInteractiveTools(deps) {
 
 // src/mcp-servers/credentials.ts
 init_config_dir();
-import path167 from "path";
+import path168 from "path";
 var FORGET_CODE_VERIFIER = { code_verifier: undefined };
 var CREDENTIALS_SCHEMA_VERSION = 1;
 function credentialsFile(configDir) {
-  return path167.join(configDir ?? ensureKeryxConfigDir(), "mcp-credentials.json");
+  return path168.join(configDir ?? ensureKeryxConfigDir(), "mcp-credentials.json");
 }
 function credentialKey(serverName, serverUrl) {
   return `${serverName}:${serverUrl}`;
@@ -73945,7 +74342,7 @@ async function connectStdioMcpServer(argv, options, handshakeTimeoutMs, signal,
 }
 
 // src/mcp-servers/runtime.ts
-import path170 from "path";
+import path171 from "path";
 
 // src/mcp-servers/manager.ts
 var DEFAULT_CONNECT_CONCURRENCY = 4;
@@ -74037,9 +74434,9 @@ async function closeServers(states) {
 // src/mcp-servers/trust.ts
 init_config_dir();
 import { createHash as createHash32 } from "crypto";
-import path168 from "path";
+import path169 from "path";
 function trustFile(configDir) {
-  return path168.join(configDir ?? ensureKeryxConfigDir(), "mcp-servers-trust.json");
+  return path169.join(configDir ?? ensureKeryxConfigDir(), "mcp-servers-trust.json");
 }
 function serverFingerprint(server) {
   const material = JSON.stringify({
@@ -74136,16 +74533,16 @@ function credentialSummary(raw) {
 // src/mcp-servers/store.ts
 init_config_dir();
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
-import path169 from "path";
+import path170 from "path";
 var SERVER_NAME_PATTERN = /^[A-Za-z0-9_-]+$/;
 function userConfigFile(configDir) {
-  return path169.join(configDir ?? ensureKeryxConfigDir(), "mcp-servers.json");
+  return path170.join(configDir ?? ensureKeryxConfigDir(), "mcp-servers.json");
 }
 function projectConfigFile(projectRoot) {
-  return path169.join(projectRoot, ".keryx", "mcp-servers.json");
+  return path170.join(projectRoot, ".keryx", "mcp-servers.json");
 }
 function overlayFile(configDir) {
-  return path169.join(configDir ?? ensureKeryxConfigDir(), "mcp-servers-disabled.json");
+  return path170.join(configDir ?? ensureKeryxConfigDir(), "mcp-servers-disabled.json");
 }
 function readForWrite(file) {
   const read = readConfigFile(file);
@@ -74184,7 +74581,7 @@ function writeDocument(file, doc, scope) {
     writeOwnerOnlyFileAtomic(file, body);
     return;
   }
-  mkdirSync6(path169.dirname(file), { recursive: true });
+  mkdirSync6(path170.dirname(file), { recursive: true });
   writeFileSync7(file, body, { encoding: "utf8" });
 }
 function addServer(options) {
@@ -74733,7 +75130,7 @@ async function defaultConnect(server, env, signal, kills, configDir) {
 function defaultServerCwd(server, fallbackCwd = process.cwd()) {
   if (server.source !== "project")
     return fallbackCwd;
-  return path170.dirname(path170.dirname(server.file));
+  return path171.dirname(path171.dirname(server.file));
 }
 
 // src/commands/mcp-servers.ts
@@ -75347,12 +75744,12 @@ function positional3(args) {
 
 // src/commands/serve-mcp.ts
 init_args();
-import path177 from "path";
+import path178 from "path";
 
 // src/mcp/discovery.ts
 init_fs();
 init_json();
-import path171 from "path";
+import path172 from "path";
 var MODULE_MANIFEST_KEY = {
   gdgraph: "gdgraph",
   security: "security",
@@ -75414,7 +75811,7 @@ function buildDiscovery(manifest) {
   };
 }
 async function loadDiscovery(cwd) {
-  const manifestPath = path171.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path172.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return buildDiscovery({});
   }
@@ -75486,8 +75883,8 @@ init_workspace_service();
 init_store2();
 init_fs();
 import { createHash as createHash35, randomUUID as randomUUID17 } from "crypto";
-import { appendFile as appendFile7, mkdir as mkdir58, open as open2, readFile as readFile94, rename as rename7, rm as rm12, stat as stat17, writeFile as writeFile50 } from "fs/promises";
-import path172 from "path";
+import { appendFile as appendFile7, mkdir as mkdir59, open as open2, readFile as readFile94, rename as rename7, rm as rm12, stat as stat17, writeFile as writeFile50 } from "fs/promises";
+import path173 from "path";
 
 // src/sac/policy-experiment.ts
 import { createHash as createHash34, createHmac as createHmac2 } from "crypto";
@@ -75843,7 +76240,7 @@ function hasReportIntegrity(report) {
   return reportHashPattern.test(reportDigest) && sha2565(body) === reportDigest;
 }
 async function resolvePolicySelection(workspaceRoot, canonicalFallback) {
-  const configPath = path172.join(workspaceRoot, ...policyExperimentConfigPath);
+  const configPath = path173.join(workspaceRoot, ...policyExperimentConfigPath);
   let configJson;
   try {
     const raw = await readFile94(configPath, "utf8").catch((error) => {
@@ -75945,7 +76342,7 @@ async function diagnosePolicyReadiness(workspaceRoot) {
     const integrityReady = steps.every((entry) => entry.step === "activation-flags" || entry.status === "pass");
     return Object.freeze({ configPresent, enabled, killSwitch, integrityReady, candidateWouldActivate: integrityReady && enabled && !killSwitch, steps: Object.freeze([...steps]) });
   };
-  const configPath = path172.join(workspaceRoot, ...policyExperimentConfigPath);
+  const configPath = path173.join(workspaceRoot, ...policyExperimentConfigPath);
   let configJson;
   try {
     const raw = await readFile94(configPath, "utf8").catch((error) => {
@@ -76200,9 +76597,9 @@ class FwkReadService {
     const recordedAt = nowIso2(now);
     const id = `receipt-${randomUUID17().replace(/-/g, "").slice(0, 16)}`;
     const base = { schemaVersion: "1.0", id, workspaceId, actor, action, decision, recordedAt, cost: { tokens: 0, toolCalls: 1, elapsedMs: 0 }, contextAssembly: { traceRef: assembly.traceRef, configurationRevision: assembly.configurationRevision, selected: assembly.selected.map((id) => `./ids/${id}`), omittedOptional: assembly.omittedOptional.map((id) => `./ids/${id}`) }, policy: { ref: assembly.policyRef, revision: assembly.policyRevision }, ...action === "resource" ? { resourceRef: `./ids/${resourceId ?? "unknown"}` } : {} };
-    const ledger = path172.join(this.options.canonical.workspaceRoot, ".metaproject", "context-operations", "access-receipts.jsonl");
-    const checkpointPath = path172.join(path172.dirname(ledger), "access-receipts.checkpoint.json");
-    await mkdir58(path172.dirname(ledger), { recursive: true, mode: 448 });
+    const ledger = path173.join(this.options.canonical.workspaceRoot, ".metaproject", "context-operations", "access-receipts.jsonl");
+    const checkpointPath = path173.join(path173.dirname(ledger), "access-receipts.checkpoint.json");
+    await mkdir59(path173.dirname(ledger), { recursive: true, mode: 448 });
     return withFileLock(`${ledger}.lock`, async () => {
       const state = await resolveLedgerState(ledger, checkpointPath, this.options.verifyReceiptLedger ?? verifyAccessReceiptLedger);
       const receipt = sealAccessReceipt(base, state.headHash);
@@ -76312,9 +76709,9 @@ init_store3();
 // src/sac/collaboration-service.ts
 init_workspace_service();
 init_sac();
-import { appendFile as appendFile8, mkdir as mkdir59, readFile as readFile95 } from "fs/promises";
+import { appendFile as appendFile8, mkdir as mkdir60, readFile as readFile95 } from "fs/promises";
 import { randomUUID as randomUUID18 } from "crypto";
-import path173 from "path";
+import path174 from "path";
 
 class CollaborationServiceError extends Error {
   code;
@@ -76330,7 +76727,7 @@ class CollaborationService {
     this.input = input;
   }
   file(id) {
-    return path173.join(this.input.workspaceRoot, ".metaproject", "workspaces", id, "activity.jsonl");
+    return path174.join(this.input.workspaceRoot, ".metaproject", "workspaces", id, "activity.jsonl");
   }
   async overview(input) {
     const manifest = await this.input.workspaces.show(input);
@@ -76367,7 +76764,7 @@ class CollaborationService {
         occurredAt: (this.input.now ?? (() => new Date))().toISOString(),
         ...suppliedHandoff ? { handoff: { ...suppliedHandoff, from: actor.subject } } : {}
       });
-      await mkdir59(path173.dirname(this.file(manifest.id)), { recursive: true, mode: 448 });
+      await mkdir60(path174.dirname(this.file(manifest.id)), { recursive: true, mode: 448 });
       await appendFile8(this.file(manifest.id), `${JSON.stringify(activity)}
 `, { mode: 384 });
       return normalizeCollaborationResult(activity);
@@ -76421,10 +76818,10 @@ init_workspace_service();
 // src/session/external-slate.ts
 init_fs();
 init_machine_wrap_up();
-import { mkdir as mkdir60, readdir as readdir33, readFile as readFile96 } from "fs/promises";
-import path174 from "path";
+import { mkdir as mkdir61, readdir as readdir33, readFile as readFile96 } from "fs/promises";
+import path175 from "path";
 function externalSlatesDir(cwd) {
-  return path174.join(cwd, ".keryx", "external-slates");
+  return path175.join(cwd, ".keryx", "external-slates");
 }
 var EXTERNAL_SESSION_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 function assertValidExternalSessionId(externalSessionId) {
@@ -76434,14 +76831,14 @@ function assertValidExternalSessionId(externalSessionId) {
 }
 function externalSlatePath(cwd, externalSessionId) {
   assertValidExternalSessionId(externalSessionId);
-  return path174.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
+  return path175.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
 }
 function externalSlateLockPath(cwd, externalSessionId) {
   return `${externalSlatePath(cwd, externalSessionId)}.lock`;
 }
 function externalSlateEvidenceDir(cwd, externalSessionId) {
   assertValidExternalSessionId(externalSessionId);
-  return path174.join(externalSlatesDir(cwd), externalSessionId);
+  return path175.join(externalSlatesDir(cwd), externalSessionId);
 }
 async function readExternalSlate(cwd, externalSessionId) {
   try {
@@ -76454,7 +76851,7 @@ async function readExternalSlate(cwd, externalSessionId) {
   }
 }
 async function writeExternalSlate(cwd, externalSessionId, update) {
-  await mkdir60(externalSlatesDir(cwd), { recursive: true });
+  await mkdir61(externalSlatesDir(cwd), { recursive: true });
   return withFileLock(externalSlateLockPath(cwd, externalSessionId), async () => {
     const prev = await readExternalSlate(cwd, externalSessionId);
     const next = update(prev);
@@ -76480,7 +76877,7 @@ function isExternalSlateStale(slate, now = () => new Date) {
   return now().getTime() - lastWriteMs > DEFAULT_LOCK_STALE_MS;
 }
 async function closeExternalSlate(cwd, externalSessionId, trigger, now = () => new Date) {
-  await mkdir60(externalSlatesDir(cwd), { recursive: true });
+  await mkdir61(externalSlatesDir(cwd), { recursive: true });
   return withFileLock(externalSlateLockPath(cwd, externalSessionId), async () => {
     const external = await readExternalSlate(cwd, externalSessionId);
     if (!external || external.closedAt !== undefined)
@@ -77086,7 +77483,7 @@ function buildToolRegistry() {
 // src/mcp/resources.ts
 init_fs();
 init_contained_read();
-import path175 from "path";
+import path176 from "path";
 import { lstat as lstat5, readdir as readdir34, realpath as realpath9, stat as stat18 } from "fs/promises";
 var URI_PREFIX = "metaproject://";
 function mimeForPath(filePath) {
@@ -77099,13 +77496,13 @@ function mimeForPath(filePath) {
   return "text/plain";
 }
 function dataRoot3(cwd) {
-  return path175.join(cwd, ".metaproject", "data");
+  return path176.join(cwd, ".metaproject", "data");
 }
 function wikiRoot(cwd) {
-  return path175.join(cwd, ".metaproject", "wiki");
+  return path176.join(cwd, ".metaproject", "wiki");
 }
 function memoryRoot2(cwd) {
-  return path175.join(cwd, ".metaproject", "memory");
+  return path176.join(cwd, ".metaproject", "memory");
 }
 var MAX_RESOURCE_BYTES = 8 * 1024 * 1024;
 async function walkFiles(root, ownerRoot = root, ancestors = new Set) {
@@ -77131,7 +77528,7 @@ async function walkFiles(root, ownerRoot = root, ancestors = new Set) {
     return [];
   }
   for (const entry of entries) {
-    const full = path175.join(root, entry.name);
+    const full = path176.join(root, entry.name);
     const info = await stat18(full).catch(() => null);
     if (!info || !isPathInside(ownerReal, await realpath9(full).catch(() => "")))
       continue;
@@ -77159,9 +77556,9 @@ async function listArtifacts(cwd) {
     if (!moduleEntry.isDirectory()) {
       continue;
     }
-    const artifactsDir = path175.join(base, moduleEntry.name, "artifacts");
+    const artifactsDir = path176.join(base, moduleEntry.name, "artifacts");
     for (const file of await walkFiles(artifactsDir)) {
-      const rel = toPosix(path175.relative(artifactsDir, file));
+      const rel = toPosix(path176.relative(artifactsDir, file));
       const relPath = `${moduleEntry.name}/${rel}`;
       listings.push({
         uri: `${URI_PREFIX}artifacts/${relPath}`,
@@ -77175,7 +77572,7 @@ async function listArtifacts(cwd) {
 async function listUnderRoot(cwd, cls, root) {
   const listings = [];
   for (const file of await walkFiles(root)) {
-    const rel = toPosix(path175.relative(root, file));
+    const rel = toPosix(path176.relative(root, file));
     listings.push({
       uri: `${URI_PREFIX}${cls}/${rel}`,
       name: rel,
@@ -77225,12 +77622,12 @@ function resolveConfined(cwd, cls, relPath) {
     if (moduleName.includes("..") || moduleName.length === 0) {
       return null;
     }
-    const root = path175.join(dataRoot3(cwd), moduleName, "artifacts");
-    const absolute = path175.resolve(root, rest);
+    const root = path176.join(dataRoot3(cwd), moduleName, "artifacts");
+    const absolute = path176.resolve(root, rest);
     return isPathInside(root, absolute) ? { root, absolute } : null;
   }
   const root = cls === "wiki" ? wikiRoot(cwd) : memoryRoot2(cwd);
-  const absolute = path175.resolve(root, relPath);
+  const absolute = path176.resolve(root, relPath);
   return isPathInside(root, absolute) ? { root, absolute } : null;
 }
 async function readResource(cwd, roots, uri) {
@@ -77441,7 +77838,7 @@ async function serveMcpCommand(args = [], cwd = process.cwd()) {
     return;
   }
   const http = args.includes("--http");
-  const projectRoot = path177.resolve(resolveServeRoot(optionValue(args, "--cwd"), cwd, process.env));
+  const projectRoot = path178.resolve(resolveServeRoot(optionValue(args, "--cwd"), cwd, process.env));
   try {
     await serveMcp({ cwd: projectRoot, http });
   } catch (error) {
@@ -77545,14 +77942,14 @@ function printMcpHelp() {
 // src/commands/status.ts
 init_fs();
 init_json();
-import path178 from "path";
+import path179 from "path";
 async function statusCommand(args = []) {
   if (args.includes("--help") || args.includes("-h")) {
     printHelp16();
     return;
   }
-  const root = path178.join(process.cwd(), ".metaproject");
-  const manifestPath = path178.join(root, "metaproject.json");
+  const root = path179.join(process.cwd(), ".metaproject");
+  const manifestPath = path179.join(root, "metaproject.json");
   if (!await pathExists(root)) {
     console.log("Metaproject: not initialized");
     console.log("Run: keryx init");
@@ -77592,7 +77989,7 @@ Reports the workspace root and one enabled/disabled line per module. Use
 
 // src/commands/harness.ts
 import { readFileSync as readFileSync8, writeFileSync as writeFileSync8 } from "fs";
-import path181 from "path";
+import path182 from "path";
 import { randomUUID as randomUUID20 } from "crypto";
 
 // src/security/harness-scan.ts
@@ -78665,7 +79062,7 @@ ${command.argv.join(" ")}`);
 }
 
 // src/harness/process/sandbox/profile.ts
-import path179 from "path";
+import path180 from "path";
 var DEFAULT_SECRET_SUBPATHS = [
   ".ssh",
   ".gnupg",
@@ -78690,7 +79087,7 @@ function defaultReadDenyList(home) {
   if (!home) {
     return [];
   }
-  return DEFAULT_SECRET_SUBPATHS.map((sub) => path179.join(home, sub));
+  return DEFAULT_SECRET_SUBPATHS.map((sub) => path180.join(home, sub));
 }
 function defaultSandboxProfile(cwd, tmpDir, home) {
   return {
@@ -78710,10 +79107,10 @@ function dedupe3(values) {
 init_config_dir();
 init_shell_config();
 import { existsSync as existsSync27 } from "fs";
-import path180 from "path";
+import path181 from "path";
 var SECRET_KEY_PATTERN2 = /api[_-]?key|secret|token|password|credential/i;
 function sandboxConfigPath(dir) {
-  return path180.join(path180.dirname(shellConfigPath(dir)), "sandbox.json");
+  return path181.join(path181.dirname(shellConfigPath(dir)), "sandbox.json");
 }
 function isShellDefault(v) {
   return v === "off" || v === "workspace" || v === "strict" || v === "1";
@@ -79039,7 +79436,7 @@ init_slate();
 init_paths();
 init_shell_config();
 import { realpathSync as realpathSync3 } from "fs";
-import { homedir as homedir4, tmpdir as tmpdir2 } from "os";
+import { homedir as homedir5, tmpdir as tmpdir2 } from "os";
 
 // src/harness/extension/registry.ts
 function registerExtension(input) {
@@ -79297,7 +79694,7 @@ function canonicalPath(p) {
 }
 function buildDefaultShellAdapter(cwd, env, profileOverride) {
   const real = new RealProcessAdapter({ allowRealSubprocess: true });
-  let profile = profileOverride ?? defaultSandboxProfile(canonicalPath(cwd), canonicalPath(tmpdir2()), homedir4());
+  let profile = profileOverride ?? defaultSandboxProfile(canonicalPath(cwd), canonicalPath(tmpdir2()), homedir5());
   if (profileOverride === undefined && env.KERYX_DANGEROUSLY_DISABLE_SANDBOX === "1") {
     profile = { ...profile, mode: "danger-full-access", required: false };
   }
@@ -79811,7 +80208,7 @@ async function harnessExec(args, deps) {
   let closeNetwork = async () => {};
   let netDecisions;
   if (restrictedDomains !== undefined && deps?.processAdapter === undefined) {
-    const baseProfile = defaultSandboxProfile(canonicalPath(cwd), canonicalPath(tmpdir2()), homedir4());
+    const baseProfile = defaultSandboxProfile(canonicalPath(cwd), canonicalPath(tmpdir2()), homedir5());
     const net = await setupNetworkRun({
       ...baseProfile,
       network: "restricted",
@@ -79832,7 +80229,7 @@ async function harnessExec(args, deps) {
     env: commandEnv,
     cwd
   };
-  const worktreeRoot = path181.parse(path181.resolve(cwd, commandPath)).root || cwd;
+  const worktreeRoot = path182.parse(path182.resolve(cwd, commandPath)).root || cwd;
   const budget = {
     reservationId: idSeq(),
     maxRuntimeMs: maxRuntimeMs ?? EXEC_DEFAULT_RUNTIME_MS
@@ -80433,7 +80830,7 @@ function createAskUserTool(ask) {
 
 // src/harness/process/shell-spawn.ts
 import { realpathSync as realpathSync5 } from "fs";
-import { homedir as homedir5, tmpdir as tmpdir3 } from "os";
+import { homedir as homedir6, tmpdir as tmpdir3 } from "os";
 init_providers();
 function resolveShellSandboxMode(env, sandboxConfigDir) {
   if (env.KERYX_DANGEROUSLY_DISABLE_SANDBOX === "1")
@@ -80463,7 +80860,7 @@ function rootsFromEnv(name, env) {
   const raw = env[name];
   if (!raw)
     return [];
-  return raw.split(",").map((p) => p.trim()).filter((p) => p.length > 0).map((p) => canonical(p.startsWith("~/") ? p.replace(/^~/, homedir5()) : p));
+  return raw.split(",").map((p) => p.trim()).filter((p) => p.length > 0).map((p) => canonical(p.startsWith("~/") ? p.replace(/^~/, homedir6()) : p));
 }
 function extraWritableRoots(env) {
   return rootsFromEnv("KERYX_SANDBOX_ALLOW_WRITE", env);
@@ -80472,7 +80869,7 @@ function extraReadDenyRoots(env) {
   return rootsFromEnv("KERYX_SANDBOX_READ_DENY", env);
 }
 function shellSandboxProfile(root, mode, env) {
-  const base = defaultSandboxProfile(canonical(root), canonical(tmpdir3()), canonical(homedir5()));
+  const base = defaultSandboxProfile(canonical(root), canonical(tmpdir3()), canonical(homedir6()));
   const writableRoots = [...base.writableRoots, ...extraWritableRoots(env)];
   const readDenyList = [...base.readDenyList, ...extraReadDenyRoots(env)];
   const domains = resolveAllowedDomains(env, root);
@@ -81900,7 +82297,7 @@ class SandboxedWebTransport {
 
 // src/harness/web/web-worker-runner.ts
 import { existsSync as existsSync29 } from "fs";
-import { homedir as homedir6 } from "os";
+import { homedir as homedir7 } from "os";
 var WORKER_TIMEOUT_MS = 1e4;
 var MAX_WORKER_OUTPUT_BYTES = 192000;
 var WORKER_SOURCE = String.raw`
@@ -81998,7 +82395,7 @@ class SystemWebWorkerRunner {
   platform;
   constructor(options = {}) {
     this.workspace = options.workspace ?? process.cwd();
-    this.home = options.home ?? homedir6();
+    this.home = options.home ?? homedir7();
     this.platform = options.platform ?? process.platform;
   }
   async run(request, signal) {
@@ -82064,7 +82461,7 @@ class SystemWebWorkerRunner {
   }
 }
 function createSystemWebWorkerRunner() {
-  return new SystemWebWorkerRunner({ workspace: process.cwd(), home: homedir6() });
+  return new SystemWebWorkerRunner({ workspace: process.cwd(), home: homedir7() });
 }
 
 // src/harness/tool/builtin/web-fetch-tool.ts
@@ -82216,7 +82613,7 @@ function workspaceReadTool(cwd) {
 // src/harness/tool/builtin/workspace-lifecycle-tool.ts
 import { randomUUID as randomUUID22 } from "crypto";
 import { writeFile as writeFile52 } from "fs/promises";
-import path182 from "path";
+import path183 from "path";
 init_slate();
 init_store3();
 init_guard2();
@@ -82362,7 +82759,7 @@ function workspaceProposeTool(cwd, getSessionDir) {
         return { output: `workspace_propose: unrecognized 'kind' \u2014 expected one of: ${PROPOSAL_KINDS.join(", ")}`, isError: true };
       }
       const explicitSessionId = typeof input.sessionId === "string" && input.sessionId.length > 0 ? input.sessionId : undefined;
-      const sessionRef = explicitSessionId ?? path182.basename(getSessionDir() ?? "");
+      const sessionRef = explicitSessionId ?? path183.basename(getSessionDir() ?? "");
       if (sessionRef.length === 0) {
         return { output: "workspace_propose: no 'sessionId' given and no active session in this run", isError: true };
       }
@@ -82540,7 +82937,7 @@ init_shell_config();
 init_command_risk();
 init_shell_syntax();
 import { existsSync as existsSync31 } from "fs";
-import path183 from "path";
+import path184 from "path";
 import { createHash as createHash42 } from "crypto";
 var PREFIX_BANNED = new Set([
   "sh",
@@ -82745,7 +83142,7 @@ function emptyShellPermissions() {
   return { allow: [] };
 }
 function shellPermissionsPath(dir) {
-  return path183.join(path183.dirname(shellConfigPath(dir)), "permissions.json");
+  return path184.join(path184.dirname(shellConfigPath(dir)), "permissions.json");
 }
 function loadShellPermissionsWithAudit(dir) {
   try {
@@ -82783,7 +83180,7 @@ function loadShellPermissions(dir) {
 function saveShellPermissions(perms, dir, options = {}) {
   try {
     const file = shellPermissionsPath(dir);
-    ensureKeryxConfigDir(path183.dirname(file));
+    ensureKeryxConfigDir(path184.dirname(file));
     const cleaned = Array.from(new Set(perms.allow.map((p) => p.trim()).filter((p) => p.length > 0)));
     const body = {
       allow: options.skipValidation === true ? cleaned : cleaned.filter((p) => validateShellPattern(p).ok)
@@ -83222,12 +83619,12 @@ function remoteRequest(providerId, endpoint, query, key) {
 // src/lib/search-config.ts
 init_config_dir();
 import { existsSync as existsSync32 } from "fs";
-import path184 from "path";
+import path185 from "path";
 function searchConfigPath(dir) {
-  return path184.join(keryxConfigDir(dir), "search-providers.json");
+  return path185.join(keryxConfigDir(dir), "search-providers.json");
 }
 function searchCredentialPath(dir) {
-  return path184.join(keryxConfigDir(dir), "search-credentials.json");
+  return path185.join(keryxConfigDir(dir), "search-credentials.json");
 }
 function readJson5(file) {
   try {
@@ -83356,7 +83753,7 @@ function createDefaultSearchProviderController(configDir) {
 import { createHash as createHash43, randomUUID as randomUUID24 } from "crypto";
 import { mkdtemp, rm as rm13 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
-import path185 from "path";
+import path186 from "path";
 init_metaproject_adapter();
 init_ledger();
 init_orchestrate();
@@ -83619,8 +84016,8 @@ function createSpawnSubagentTool(deps) {
       let dispatchId = "";
       let closing = false;
       try {
-        ephemeralDir = await mkdtemp(path185.join(tmpdir4(), "keryx-subagent-slate-"));
-        dispatchId = path185.basename(ephemeralDir);
+        ephemeralDir = await mkdtemp(path186.join(tmpdir4(), "keryx-subagent-slate-"));
+        dispatchId = path186.basename(ephemeralDir);
         openedChildSlate = await openSlate({
           dir: ephemeralDir,
           cwd,
@@ -83861,9 +84258,9 @@ ${boundSummary(folded.text)}`,
 // src/harness/run-external-factory.ts
 import { randomUUID as randomUUID25 } from "crypto";
 import { execFile as execFile4 } from "child_process";
-import { mkdir as mkdir61 } from "fs/promises";
+import { mkdir as mkdir62 } from "fs/promises";
 import { tmpdir as tmpdir6 } from "os";
-import path187 from "path";
+import path188 from "path";
 import { promisify as promisify4 } from "util";
 
 // src/harness/child/git-worktree-port.ts
@@ -84115,7 +84512,7 @@ function readRuntimeBlock(dispatch) {
 // src/harness/external/runtime.ts
 import { mkdtemp as mkdtemp2, rm as rm14, writeFile as writeFile53 } from "fs/promises";
 import { tmpdir as tmpdir5 } from "os";
-import path186 from "path";
+import path187 from "path";
 
 // src/harness/external/prompt.ts
 var EXTERNAL_RUNTIME_DIRECTIVE = [
@@ -85158,8 +85555,8 @@ async function prepareResultSchema() {
   try {
     const schema = await loadSchema("subagent-result");
     const schemaText = JSON.stringify(schema, null, 2);
-    schemaDir = await mkdtemp2(path186.join(tmpdir5(), "keryx-external-result-schema-"));
-    const schemaPath = path186.join(schemaDir, "subagent-result.schema.json");
+    schemaDir = await mkdtemp2(path187.join(tmpdir5(), "keryx-external-result-schema-"));
+    const schemaPath = path187.join(schemaDir, "subagent-result.schema.json");
     await writeFile53(schemaPath, schemaText, "utf8");
     return { ok: true, schema, schemaText, schemaPath, schemaDir };
   } catch (error) {
@@ -85386,7 +85783,7 @@ async function defaultWorkingDiff(cwd) {
 function ensuringParentDir(port, worktreesDir) {
   return {
     async create(worktreeId) {
-      await mkdir61(worktreesDir, { recursive: true });
+      await mkdir62(worktreesDir, { recursive: true });
       return port.create(worktreeId);
     },
     remove: (worktreeId) => port.remove(worktreeId),
@@ -85416,7 +85813,7 @@ async function createRunExternal(options) {
   }
   const config = gate.config;
   const idSeq = options.idSeq ?? (() => randomUUID25());
-  const worktreesDir = options.worktreesDir ?? path187.join(tmpdir6(), "keryx-external-worktrees");
+  const worktreesDir = options.worktreesDir ?? path188.join(tmpdir6(), "keryx-external-worktrees");
   const spawn = options.spawn ?? createBunSpawnPort();
   const worktree = options.worktree ?? ensuringParentDir(createGitWorktreePort({ repoRoot: options.cwd, worktreesDir }), worktreesDir);
   const readWorkingDiff = options.readWorkingDiff ?? (() => defaultWorkingDiff(options.cwd));
@@ -85611,12 +86008,15 @@ async function approveExternalSpawn(request) {
   }
 }
 
+// src/commands/shell.ts
+init_caller_session();
+
 // src/lib/statusbar.ts
-import { homedir as homedir7 } from "os";
+import { homedir as homedir8 } from "os";
 var ESC = "\x1B";
 var CSI = `${ESC}[`;
 function collapseHome(path) {
-  const home = homedir7();
+  const home = homedir8();
   if (home.length > 0 && (path === home || path.startsWith(`${home}/`))) {
     return `~${path.slice(home.length)}`;
   }
@@ -85726,7 +86126,7 @@ class LiveMarkdownBlock {
 // src/tui/theme.ts
 init_config_dir();
 import { existsSync as existsSync33 } from "fs";
-import path188 from "path";
+import path189 from "path";
 var THEME_NAMES = ["groknight", "grokday", "tokyonight", "keryx"];
 var THEME_IDS = ["auto", ...THEME_NAMES];
 var DEFAULT_THEME_ID = "groknight";
@@ -85856,7 +86256,7 @@ function onThemeChange(listener) {
   };
 }
 function tuiConfigPath(dir) {
-  return path188.join(keryxConfigDir(dir), "tui.json");
+  return path189.join(keryxConfigDir(dir), "tui.json");
 }
 function loadPersistedThemeId(dir) {
   try {
@@ -85913,7 +86313,7 @@ init_workspace_service();
 init_service8();
 init_store2();
 init_fs();
-import path189 from "path";
+import path190 from "path";
 import { readFile as readFile98 } from "fs/promises";
 var POSITIVE_INTEGER = /^[1-9][0-9]*$/;
 var DEFAULT_AUTO_GOAL_ROUNDS = 8;
@@ -85989,7 +86389,7 @@ function getFlowService() {
 async function autoProvisionFlow(cwd, goalText) {
   const service = getFlowService();
   const result = await service.init({ cwd, title: goalText });
-  const acFile = path189.join(cwd, result.dir, "acceptance-criteria.md");
+  const acFile = path190.join(cwd, result.dir, "acceptance-criteria.md");
   await writeFileAtomic(acFile, [
     "# Acceptance Criteria",
     "",
@@ -87540,7 +87940,7 @@ init_proposal_lifecycle();
 init_workspace_service();
 import { randomUUID as randomUUID27 } from "crypto";
 import { readdir as readdir36, stat as stat19 } from "fs/promises";
-import path190 from "path";
+import path191 from "path";
 
 // src/sac/lifecycle-flag.ts
 init_store();
@@ -87699,7 +88099,7 @@ async function readExternalUnboundCandidates(cwd) {
         }
         return groups;
       }, []));
-      const metaPath = path190.join(extDir, `${id}.json`);
+      const metaPath = path191.join(extDir, `${id}.json`);
       if (await pathExists(unboundDismissedReceiptPath(metaPath)))
         continue;
       candidates.push({
@@ -87713,7 +88113,7 @@ async function readExternalUnboundCandidates(cwd) {
   return candidates;
 }
 async function readNewestUnboundCandidateForExternal(cwd, externalSessionId) {
-  const evidenceDir = path190.join(externalSlatesDir(cwd), externalSessionId);
+  const evidenceDir = path191.join(externalSlatesDir(cwd), externalSessionId);
   let entries;
   try {
     entries = (await readdir36(evidenceDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
@@ -87722,7 +88122,7 @@ async function readNewestUnboundCandidateForExternal(cwd, externalSessionId) {
   }
   entries.sort();
   for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path190.join(evidenceDir, entries[i]);
+    const evidencePath = path191.join(evidenceDir, entries[i]);
     if (await pathExists(unboundDismissedReceiptPath(evidencePath)))
       continue;
     const result = readConfigFile(evidencePath);
@@ -87765,7 +88165,7 @@ var SESSION_ATTRIBUTION_SLACK_MS = 5 * 60000;
 var MTIME_CLOCK_SKEW_TOLERANCE_MS = 5000;
 async function collectReceiptTargets(cwd, owner) {
   const targets = new Set;
-  const workspacesDir = path190.join(cwd, ".metaproject", "workspaces");
+  const workspacesDir = path191.join(cwd, ".metaproject", "workspaces");
   let workspaceIds;
   try {
     workspaceIds = (await readdir36(workspacesDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
@@ -87773,7 +88173,7 @@ async function collectReceiptTargets(cwd, owner) {
     return targets;
   }
   for (const workspaceId of workspaceIds) {
-    const receiptsDir = path190.join(workspacesDir, workspaceId, `${owner}-write-receipts`);
+    const receiptsDir = path191.join(workspacesDir, workspaceId, `${owner}-write-receipts`);
     let files;
     try {
       files = (await readdir36(receiptsDir)).filter((name) => name.endsWith(".json"));
@@ -87781,7 +88181,7 @@ async function collectReceiptTargets(cwd, owner) {
       continue;
     }
     for (const file of files) {
-      const result = readConfigFile(path190.join(receiptsDir, file));
+      const result = readConfigFile(path191.join(receiptsDir, file));
       if (!result.ok)
         continue;
       try {
@@ -87824,7 +88224,7 @@ async function findSkillFiles(dir) {
   }
   const found = [];
   for (const entry of entries) {
-    const full = path190.join(dir, entry.name);
+    const full = path191.join(dir, entry.name);
     if (entry.isDirectory()) {
       found.push(...await findSkillFiles(full));
     } else if (entry.isFile() && entry.name === "SKILL.md") {
@@ -87883,10 +88283,10 @@ async function detectUnreviewedSacPathChanges(cwd, sessions) {
       changedAt: attribution.changedAt
     });
   }
-  const sacSkillsDir = path190.join(cwd, ".metaproject", "project-skills", "sac");
+  const sacSkillsDir = path191.join(cwd, ".metaproject", "project-skills", "sac");
   const skillFiles = await findSkillFiles(sacSkillsDir);
   for (const absolutePath of skillFiles) {
-    const targetRef = path190.relative(path190.join(cwd, ".metaproject"), absolutePath).split(path190.sep).join("/");
+    const targetRef = path191.relative(path191.join(cwd, ".metaproject"), absolutePath).split(path191.sep).join("/");
     if (skillReceipts.has(targetRef))
       continue;
     const attribution = await attributeToSession(absolutePath, scoped);
@@ -87904,12 +88304,12 @@ async function detectUnreviewedSacPathChanges(cwd, sessions) {
   return items;
 }
 async function isSlateEngaged(dir) {
-  if (await pathExists(path190.join(dir, "slate.json")))
+  if (await pathExists(path191.join(dir, "slate.json")))
     return true;
-  if (await pathExists(path190.join(dir, "terminal-state.json")))
+  if (await pathExists(path191.join(dir, "terminal-state.json")))
     return true;
   try {
-    const entries = await readdir36(path190.join(dir, "slate-archive"));
+    const entries = await readdir36(path191.join(dir, "slate-archive"));
     return entries.length > 0;
   } catch {
     return false;
@@ -87923,7 +88323,7 @@ async function safeReadSlate(dir) {
   }
 }
 async function readTerminalState(dir) {
-  const result = readConfigFile(path190.join(dir, "terminal-state.json"));
+  const result = readConfigFile(path191.join(dir, "terminal-state.json"));
   if (!result.ok) {
     return;
   }
@@ -87947,7 +88347,7 @@ async function resolveUnboundCandidateTarget(cwd, target) {
   if (session === undefined) {
     throw new Error(`No session or evidence path matches "${target}"`);
   }
-  const archiveDir = path190.join(sessionDir(session.projectPath, session.id), "slate-archive");
+  const archiveDir = path191.join(sessionDir(session.projectPath, session.id), "slate-archive");
   let entries;
   try {
     entries = (await readdir36(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
@@ -87957,7 +88357,7 @@ async function resolveUnboundCandidateTarget(cwd, target) {
   if (entries.length === 0)
     throw new Error(`No unbound-candidate artifacts for session ${session.id}`);
   entries.sort();
-  return path190.join(archiveDir, entries[entries.length - 1]);
+  return path191.join(archiveDir, entries[entries.length - 1]);
 }
 async function dismissUnboundByTarget(cwd, target, reason) {
   const evidencePath = await resolveUnboundCandidateTarget(cwd, target);
@@ -87983,7 +88383,7 @@ async function dismissUnboundCandidate(candidatePath, reason) {
   return { removed: candidatePath, receipt: receiptPath };
 }
 async function readNewestUnboundCandidate(dir) {
-  const archiveDir = path190.join(dir, "slate-archive");
+  const archiveDir = path191.join(dir, "slate-archive");
   let entries;
   try {
     entries = (await readdir36(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
@@ -87992,7 +88392,7 @@ async function readNewestUnboundCandidate(dir) {
   }
   entries.sort();
   for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path190.join(archiveDir, entries[i]);
+    const evidencePath = path191.join(archiveDir, entries[i]);
     if (await pathExists(unboundDismissedReceiptPath(evidencePath)))
       continue;
     const result = readConfigFile(evidencePath);
@@ -88022,7 +88422,7 @@ function isFailureOutcome(g) {
   return g.outcome === "error" || g.outcome === "no_credential" || g.outcome === "conflict";
 }
 async function readNewestWrapUpOutcome(dir) {
-  const archiveDir = path190.join(dir, "slate-archive");
+  const archiveDir = path191.join(dir, "slate-archive");
   let entries;
   try {
     entries = (await readdir36(archiveDir)).filter((name) => name.endsWith("-wrap-up-outcome.json"));
@@ -88031,7 +88431,7 @@ async function readNewestWrapUpOutcome(dir) {
   }
   entries.sort();
   for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path190.join(archiveDir, entries[i]);
+    const evidencePath = path191.join(archiveDir, entries[i]);
     const result = readConfigFile(evidencePath);
     if (!result.ok) {
       continue;
@@ -91787,10 +92187,10 @@ function describeElicitationPrompt(tool, inputJson) {
 // src/lib/permission-mode-config.ts
 init_permission_mode();
 init_config_dir();
-import path191 from "path";
+import path192 from "path";
 var EMPTY3 = { schemaVersion: 1, projects: {} };
 function permissionModeConfigPath(dir) {
-  return path191.join(keryxConfigDir(dir), "permission-mode.json");
+  return path192.join(keryxConfigDir(dir), "permission-mode.json");
 }
 function withRegistryLock2(dir, fn) {
   return withFileLock2(`${permissionModeConfigPath(dir)}.lock`, fn, {
@@ -92308,7 +92708,7 @@ function showComposerChoice(otui, r, dock, request) {
 // src/lib/version-check.ts
 init_config_dir();
 init_fs();
-import path192 from "path";
+import path193 from "path";
 var REGISTRY_URL = "https://registry.npmjs.org/@mrciphersmith%2Fkeryx/latest";
 var FIXED_INSTALL_COMMAND = "npm install -g @mrciphersmith/keryx@latest";
 var RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
@@ -92510,7 +92910,7 @@ async function checkVersion(options) {
   const now = options.now ?? Date.now;
   const timestamp = now();
   const configDir = ensureKeryxConfigDir(options.cacheDir);
-  const cacheFile = path192.join(configDir, "version-check.json");
+  const cacheFile = path193.join(configDir, "version-check.json");
   const cache = parseCache(cacheFile);
   if (cache?.latestVersion !== undefined && cache.successAt !== undefined && timestamp - cache.successAt >= 0 && timestamp - cache.successAt < SUCCESS_CACHE_TTL_MS) {
     return resultFor(options.currentVersion, current, cache.latestVersion, "cache");
@@ -100895,6 +101295,7 @@ Example: keryx shell --provider ollama --model llama3.1:latest`);
     };
     const makeAgentDeps = async (sel, getSlateSession) => {
       const getSessionDir = () => getSlateSession()?.dir;
+      exportCallerSession(sel.provider, sel.model);
       const agentProvider = tuiProviderFactory(sel.provider, sel.model, sel.baseUrl);
       let orient;
       try {
@@ -101095,6 +101496,7 @@ Example: keryx shell --provider ollama --model llama3.1:latest`);
     const cwdLabel = collapseHome(process.cwd());
     printHeader("keryx", `${provider}/${model}${baseUrl !== undefined ? ` (${baseUrl})` : ""}${modeLabel} \xB7 ${cwdLabel}`);
     if (agentMode) {
+      exportCallerSession(provider, model);
       const agentProvider = baseFactory(provider, model, baseUrl);
       let orient;
       try {
@@ -101337,7 +101739,7 @@ Shell:
 init_fs();
 import { readFile as readFile99 } from "fs/promises";
 import { stdin } from "process";
-import path193 from "path";
+import path194 from "path";
 var MODULES = [
   { name: "gdgraph", flag: "--no-gdgraph", desc: "code graph, symbols, affected context", defaultEnabled: true },
   { name: "gdctx", flag: "--no-gdctx", desc: "token-aware command/read output", defaultEnabled: true },
@@ -101383,8 +101785,8 @@ async function modulesCommand(args = []) {
     return;
   }
   const wantsJson = args.includes("--json") && (sub === undefined || sub === "status" || sub === "list" || sub === "--json");
-  const metaprojectRoot = path193.join(process.cwd(), ".metaproject");
-  const manifestPath = path193.join(metaprojectRoot, "metaproject.json");
+  const metaprojectRoot = path194.join(process.cwd(), ".metaproject");
+  const manifestPath = path194.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     if (wantsJson) {
       console.log(JSON.stringify({ schemaVersion: 1, error: "not-initialized", modules: [] }, null, 2));
@@ -101515,9 +101917,9 @@ import {
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync9
 } from "fs";
-import path194 from "path";
+import path195 from "path";
 function serveCredentialPath(dir) {
-  return path194.join(keryxConfigDir(dir), "serve-credentials.json");
+  return path195.join(keryxConfigDir(dir), "serve-credentials.json");
 }
 function constantTimeEqual(a, b) {
   const width = Math.max(a.length, b.length);
@@ -101751,22 +102153,22 @@ class AuthFailureThrottle {
 init_config_dir();
 import { createHash as createHash45 } from "crypto";
 import { existsSync as existsSync35, readdirSync as readdirSync3, rmSync as rmSync2 } from "fs";
-import path195 from "path";
+import path196 from "path";
 var MAX_TURN_EVENTS = 1e4;
 function turnsRoot(dir) {
-  return path195.join(keryxConfigDir(dir), "turns");
+  return path196.join(keryxConfigDir(dir), "turns");
 }
 function turnDir(turnId, dir) {
-  return path195.join(turnsRoot(dir), turnId);
+  return path196.join(turnsRoot(dir), turnId);
 }
 function keyPath(project, idempotencyKey, dir) {
   const projectBytes = Buffer.byteLength(project, "utf8");
   const digest = createHash45("sha256").update(`${projectBytes}:${project}\x00${idempotencyKey}`, "utf8").digest("hex");
-  return path195.join(turnsRoot(dir), "keys", `${digest}.json`);
+  return path196.join(turnsRoot(dir), "keys", `${digest}.json`);
 }
 function legacyKeyPath(idempotencyKey, dir) {
   const digest = createHash45("sha256").update(idempotencyKey, "utf8").digest("hex");
-  return path195.join(turnsRoot(dir), "keys", `${digest}.json`);
+  return path196.join(turnsRoot(dir), "keys", `${digest}.json`);
 }
 function adoptLegacyClaim(project, idempotencyKey, dir) {
   const legacy = legacyKeyPath(idempotencyKey, dir);
@@ -101830,7 +102232,7 @@ function ensureTurnDir(turnId, dir) {
 }
 function createTurnRecord(record, dir) {
   ensureTurnDir(record.turnId, dir);
-  writeOwnerOnlyFile(path195.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
+  writeOwnerOnlyFile(path196.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
 `);
 }
 function appendTurnEvent(event, dir, opts) {
@@ -101839,12 +102241,12 @@ function appendTurnEvent(event, dir, opts) {
   }
   const line = JSON.stringify(event);
   try {
-    appendOwnerOnlyLine(path195.join(turnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path196.join(turnDir(event.turnId, dir), "events.jsonl"), line);
   } catch (error) {
     if (error?.code !== "ENOENT") {
       throw error;
     }
-    appendOwnerOnlyLine(path195.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path196.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
   }
   return true;
 }
@@ -101852,7 +102254,7 @@ function readTurnEvents(turnId, after = -1, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path195.join(turnDir(turnId, dir), "events.jsonl"));
+  const read = readTurnFile(path196.join(turnDir(turnId, dir), "events.jsonl"));
   if (!read.ok) {
     if (isDefiniteAbsence2(read.reason)) {
       return { ok: true, value: [] };
@@ -101880,7 +102282,7 @@ function readTurnRecord(turnId, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path195.join(turnDir(turnId, dir), "turn.json"));
+  const read = readTurnFile(path196.join(turnDir(turnId, dir), "turn.json"));
   if (!read.ok) {
     return { ok: false, reason: read.reason };
   }
@@ -101899,7 +102301,7 @@ function finishTurn(turnId, result, dir) {
   if (!record.ok) {
     return false;
   }
-  writeOwnerOnlyFile(path195.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
+  writeOwnerOnlyFile(path196.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
 `);
   return true;
 }
@@ -101945,7 +102347,7 @@ function releaseIdempotencyKey(project, idempotencyKey, turnId, dir) {
 
 // src/lib/serve-turn.ts
 import { randomUUID as randomUUID31 } from "crypto";
-import path196 from "path";
+import path197 from "path";
 init_service();
 var REMOTE_ORIGIN = "remote:http";
 var MAX_PROMPT_CHARS = 32000;
@@ -102014,9 +102416,9 @@ function isUuid(value) {
   return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value);
 }
 function resolveProject(declared, dir) {
-  const wanted = path196.resolve(declared);
+  const wanted = path197.resolve(declared);
   for (const entry of listProjects(dir, () => {})) {
-    if (path196.resolve(entry.path) === wanted) {
+    if (path197.resolve(entry.path) === wanted) {
       return { ok: true, project: entry.path };
     }
   }
@@ -103050,9 +103452,9 @@ function printHelp19() {
 
 // src/commands/update.ts
 import { spawn as spawn6 } from "child_process";
-import { chmod as chmod4, mkdir as mkdir62, readFile as readFile100, readdir as readdir37, writeFile as writeFile54 } from "fs/promises";
+import { chmod as chmod4, mkdir as mkdir63, readFile as readFile100, readdir as readdir37, writeFile as writeFile54 } from "fs/promises";
 import { access as access4, constants as constants2, existsSync as existsSync36 } from "fs";
-import path197 from "path";
+import path198 from "path";
 import { fileURLToPath as fileURLToPath8 } from "url";
 init_config2();
 init_config();
@@ -103069,8 +103471,8 @@ async function updateCommand(args = []) {
     return;
   }
   const projectRoot = process.cwd();
-  const metaprojectRoot = path197.join(projectRoot, ".metaproject");
-  banner("keryx update", `Refreshing the .metaproject workspace in ${path197.basename(projectRoot)}/`);
+  const metaprojectRoot = path198.join(projectRoot, ".metaproject");
+  banner("keryx update", `Refreshing the .metaproject workspace in ${path198.basename(projectRoot)}/`);
   if (!await pathExists(metaprojectRoot)) {
     console.log(`  ${style.red(symbols.cross)} Metaproject is not initialized.`);
     console.log(`  ${style.cyan(symbols.arrow)} Run ${style.cyan("keryx init")} first.`);
@@ -103143,7 +103545,7 @@ async function updateCommand(args = []) {
   nextSteps(steps);
 }
 async function previewServiceFiles(projectRoot, options) {
-  const metaprojectRoot = path197.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path198.join(projectRoot, ".metaproject");
   const manifestState = await readManifest5(metaprojectRoot);
   const manifest = manifestState.manifest;
   const enableTasks = moduleEnabled2(manifest, "tasks") || !options.noTasks;
@@ -103172,12 +103574,12 @@ async function previewServiceFiles(projectRoot, options) {
   });
 }
 async function refreshServiceFiles(projectRoot, options) {
-  const metaprojectRoot = path197.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path198.join(projectRoot, ".metaproject");
   const manifestState = await readManifest5(metaprojectRoot);
   const manifest = manifestState.manifest;
   const recoveredManifest = !manifestState.exists || !manifestState.valid;
   if (manifestState.migrated) {
-    await writeFile54(path197.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+    await writeFile54(path198.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   }
   const enableGdgraph = moduleEnabled2(manifest, "gdgraph");
@@ -103214,9 +103616,9 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     enableSac
   });
-  await writeTextIfChanged4(path197.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
-  await writeTextIfChanged4(path197.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
-  await writeTextIfChanged4(path197.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
+  await writeTextIfChanged4(path198.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
+  await writeTextIfChanged4(path198.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
+  await writeTextIfChanged4(path198.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
   await writeRoutingEntrypointPair(metaprojectRoot, {
     enableGdgraph,
     enableGdctx,
@@ -103239,7 +103641,7 @@ async function refreshServiceFiles(projectRoot, options) {
       }
     }
   });
-  await writeTextIfChanged4(path197.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
+  await writeTextIfChanged4(path198.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -103251,7 +103653,7 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     data: dashboardData
   }));
-  await writeTextIfMissing4(path197.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
+  await writeTextIfMissing4(path198.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -103264,31 +103666,31 @@ async function refreshServiceFiles(projectRoot, options) {
   }));
   if (enableGdgraph) {
     await installGdgraphCoreScripts2(metaprojectRoot);
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
     await seedAssetsLock(metaprojectRoot);
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdgraph-post-commit", renderGdgraphPostCommitHook());
     }
   }
   if (enableGdctx) {
-    await writeTextIfMissing4(path197.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
+    await writeTextIfMissing4(path198.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
   }
   if (enableGdwiki) {
-    await writeTextIfMissing4(path197.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
+    await writeTextIfMissing4(path198.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdwiki-post-commit", renderGdwikiPostCommitHook());
     }
   }
   if (enableSac) {
-    await writeTextIfMissing4(path197.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
+    await writeTextIfMissing4(path198.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
   }
   let gdskillsWarnings = [];
   let gdskillsNotices = [];
@@ -103301,25 +103703,25 @@ async function refreshServiceFiles(projectRoot, options) {
     }
   }
   if (enableHealth) {
-    await writeTextIfMissing4(path197.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
+    await writeTextIfMissing4(path198.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
     if (manifest.modules?.health?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "health-post-commit", renderHealthPostCommitHook());
     }
   }
   if (enableTesting) {
-    await writeTextIfMissing4(path197.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
+    await writeTextIfMissing4(path198.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
       postCommitRefresh: Boolean(manifest.modules?.testing?.hooks?.gitPostCommit),
       prePushGate: Boolean(manifest.modules?.testing?.hooks?.prePush)
     }));
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
     if (enableGdwiki) {
-      await writeTextIfMissing4(path197.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
-      await writeTextIfMissing4(path197.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
+      await writeTextIfMissing4(path198.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
+      await writeTextIfMissing4(path198.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
     }
     if (manifest.modules?.testing?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "testing-post-commit", renderTestingPostCommitHook());
@@ -103332,24 +103734,24 @@ async function refreshServiceFiles(projectRoot, options) {
     await installManagedHook2(projectRoot, "post-commit", "metaproject-dashboard-post-commit", renderMetaprojectDashboardPostCommitHook());
   }
   if (enableMemory) {
-    await writeTextIfMissing4(path197.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
-    await writeTextIfMissing4(path197.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
+    await writeTextIfMissing4(path198.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
+    await writeTextIfMissing4(path198.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
   }
   if (enableTasks) {
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
   }
   if (enableSecurity) {
-    await writeTextIfMissing4(path197.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
-    await writeTextIfChanged4(path197.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
+    await writeTextIfMissing4(path198.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
+    await writeTextIfChanged4(path198.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
     if (manifest.modules?.security?.hooks?.prePush) {
       await installManagedHook2(projectRoot, "pre-push", "security-pre-push", renderSecurityPrePushHook());
     }
@@ -103402,13 +103804,13 @@ async function refreshServiceFiles(projectRoot, options) {
   };
 }
 async function buildDashboard(projectRoot = process.cwd()) {
-  const metaprojectRoot = path197.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path198.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
   const manifest = (await readManifest5(metaprojectRoot)).manifest;
   const data = await collectDashboardData(metaprojectRoot);
-  const dashboardPath = path197.join(metaprojectRoot, "keryx-dashboard.html");
+  const dashboardPath = path198.join(metaprojectRoot, "keryx-dashboard.html");
   await writeTextIfChanged4(dashboardPath, renderMetaprojectDashboardHtml({
     enableGdgraph: moduleEnabled2(manifest, "gdgraph"),
     enableGdctx: moduleEnabled2(manifest, "gdctx"),
@@ -103428,7 +103830,7 @@ async function shouldInstallDashboardPostCommitHook(projectRoot, manifest) {
   if (Object.values(modules).some((module) => Boolean(module.hooks?.gitPostCommit))) {
     return true;
   }
-  const hookPath = path197.join(projectRoot, ".git", "hooks", "post-commit");
+  const hookPath = path198.join(projectRoot, ".git", "hooks", "post-commit");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -103448,11 +103850,11 @@ async function collectDashboardData(metaprojectRoot) {
   if (testing) {
     data.testing = testing;
   }
-  const wiki = await collectMarkdownPages(path197.join(metaprojectRoot, "wiki"), "wiki");
+  const wiki = await collectMarkdownPages(path198.join(metaprojectRoot, "wiki"), "wiki");
   if (wiki.length > 0) {
     data.wiki = { pages: wiki };
   }
-  const memory = await collectMarkdownPages(path197.join(metaprojectRoot, "memory"), "memory");
+  const memory = await collectMarkdownPages(path198.join(metaprojectRoot, "memory"), "memory");
   if (memory.length > 0) {
     data.memory = { entries: memory };
   }
@@ -103467,7 +103869,7 @@ async function collectDashboardData(metaprojectRoot) {
   return data;
 }
 async function collectTasksDashboardData(metaprojectRoot) {
-  const flowsRoot = path197.join(metaprojectRoot, "flows");
+  const flowsRoot = path198.join(metaprojectRoot, "flows");
   if (!await pathExists(flowsRoot)) {
     return null;
   }
@@ -103479,7 +103881,7 @@ async function collectTasksDashboardData(metaprojectRoot) {
   }
   const flows = [];
   for (const dir of dirEntries) {
-    const flowPath = path197.join(flowsRoot, dir, "flow.json");
+    const flowPath = path198.join(flowsRoot, dir, "flow.json");
     if (!await pathExists(flowPath)) {
       continue;
     }
@@ -103487,7 +103889,7 @@ async function collectTasksDashboardData(metaprojectRoot) {
       const flow = JSON.parse(await readFile100(flowPath, "utf8"));
       const tasks = Array.isArray(flow.tasks) ? flow.tasks : [];
       let acTotal = 0;
-      const acPath = path197.join(flowsRoot, dir, "acceptance-criteria.md");
+      const acPath = path198.join(flowsRoot, dir, "acceptance-criteria.md");
       if (await pathExists(acPath)) {
         const acContent = await readFile100(acPath, "utf8");
         acTotal = (acContent.match(/^- AC\d+:/gm) ?? []).length;
@@ -103541,7 +103943,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
     "data/testing/context.md"
   ];
   for (const href of staticHrefs) {
-    const filePath = path197.join(metaprojectRoot, ...href.split("/"));
+    const filePath = path198.join(metaprojectRoot, ...href.split("/"));
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -103558,7 +103960,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
   return docs;
 }
 async function collectHealthDashboardData(metaprojectRoot) {
-  const reportPath = path197.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
+  const reportPath = path198.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
   if (!await pathExists(reportPath)) {
     return;
   }
@@ -103667,8 +104069,8 @@ function metricToScope(metric) {
   };
 }
 async function collectGraphDashboardData(metaprojectRoot) {
-  const nodesPath = path197.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
-  const edgesPath = path197.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
+  const nodesPath = path198.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
+  const edgesPath = path198.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
   if (!await pathExists(nodesPath) || !await pathExists(edgesPath)) {
     return;
   }
@@ -103719,8 +104121,8 @@ async function collectGraphDashboardData(metaprojectRoot) {
   };
 }
 async function collectTestingDashboardData(metaprojectRoot) {
-  const reportPath = path197.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
-  const contextPath = path197.join(metaprojectRoot, "data", "testing", "context.md");
+  const reportPath = path198.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
+  const contextPath = path198.join(metaprojectRoot, "data", "testing", "context.md");
   if (await pathExists(reportPath)) {
     const report = JSON.parse(await readFile100(reportPath, "utf8"));
     const totalTests = numberOrUndefined(report.total);
@@ -103749,7 +104151,7 @@ async function collectMarkdownPages(root, hrefPrefix) {
   const files = await listMarkdownFiles(root);
   const pages = [];
   for (const filePath of files.slice(0, 40)) {
-    const relativePath = path197.relative(root, filePath).split(path197.sep).join("/");
+    const relativePath = path198.relative(root, filePath).split(path198.sep).join("/");
     if (relativePath === "index.md" || relativePath.startsWith("templates/")) {
       continue;
     }
@@ -103770,7 +104172,7 @@ async function listMarkdownFiles(root) {
   const entries = await readdir37(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const fullPath = path197.join(root, entry.name);
+    const fullPath = path198.join(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listMarkdownFiles(fullPath));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -103818,7 +104220,7 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
   const manifest = {
     schemaVersion: 1,
     standardVersion: STANDARD_VERSION,
-    name: `${path197.basename(path197.dirname(metaprojectRoot))}-metaproject`,
+    name: `${path198.basename(path198.dirname(metaprojectRoot))}-metaproject`,
     createdBy: "keryx",
     profiles: computeProfiles(enabledModuleKeys),
     paths: {
@@ -103908,11 +104310,11 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
       metaproject: ".metaproject/index.md"
     }
   };
-  await writeFile54(path197.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+  await writeFile54(path198.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
 }
 async function enableTasksInManifest(metaprojectRoot) {
-  const manifestPath = path197.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path198.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -103935,7 +104337,7 @@ async function enableTasksInManifest(metaprojectRoot) {
 `, "utf8");
 }
 async function updateManifestAgentEntrypoints(metaprojectRoot, ruleSources) {
-  const manifestPath = path197.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path198.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -103971,80 +104373,80 @@ async function updateRuntime(projectRoot) {
   }
 }
 async function findRuntimeRoot(projectRoot) {
-  const projectRuntime = path197.join(projectRoot, ".metaproject", "runtime", "keryx");
-  if (await pathExists(path197.join(projectRuntime, ".git"))) {
+  const projectRuntime = path198.join(projectRoot, ".metaproject", "runtime", "keryx");
+  if (await pathExists(path198.join(projectRuntime, ".git"))) {
     return projectRuntime;
   }
   const home = process.env.HOME;
   if (!home) {
     return null;
   }
-  const globalRuntime = path197.join(home, ".keryx", "keryx");
-  if (await pathExists(path197.join(globalRuntime, ".git"))) {
+  const globalRuntime = path198.join(home, ".keryx", "keryx");
+  if (await pathExists(path198.join(globalRuntime, ".git"))) {
     return globalRuntime;
   }
   return null;
 }
 async function createServiceDirs(metaprojectRoot, modules) {
   const dirs = [
-    path197.join(metaprojectRoot, "core"),
-    path197.join(metaprojectRoot, "hooks", "post-update.d"),
-    path197.join(metaprojectRoot, "modules"),
-    path197.join(metaprojectRoot, "rules"),
-    path197.join(metaprojectRoot, "skills", "project-rules"),
+    path198.join(metaprojectRoot, "core"),
+    path198.join(metaprojectRoot, "hooks", "post-update.d"),
+    path198.join(metaprojectRoot, "modules"),
+    path198.join(metaprojectRoot, "rules"),
+    path198.join(metaprojectRoot, "skills", "project-rules"),
     ...modules.enableGdgraph ? [
-      path197.join(metaprojectRoot, "core", "gdgraph"),
-      path197.join(metaprojectRoot, "skills", "gdgraph")
+      path198.join(metaprojectRoot, "core", "gdgraph"),
+      path198.join(metaprojectRoot, "skills", "gdgraph")
     ] : [],
     ...modules.enableGdctx ? [
-      path197.join(metaprojectRoot, "core", "gdctx"),
-      path197.join(metaprojectRoot, "skills", "gdctx")
+      path198.join(metaprojectRoot, "core", "gdctx"),
+      path198.join(metaprojectRoot, "skills", "gdctx")
     ] : [],
     ...modules.enableGdwiki ? [
-      path197.join(metaprojectRoot, "skills", "gdwiki"),
-      path197.join(metaprojectRoot, "wiki", "templates")
+      path198.join(metaprojectRoot, "skills", "gdwiki"),
+      path198.join(metaprojectRoot, "wiki", "templates")
     ] : [],
     ...modules.enableHealth ? [
-      path197.join(metaprojectRoot, "core", "health"),
-      path197.join(metaprojectRoot, "skills", "health")
+      path198.join(metaprojectRoot, "core", "health"),
+      path198.join(metaprojectRoot, "skills", "health")
     ] : [],
     ...modules.enableTesting ? [
-      path197.join(metaprojectRoot, "core", "testing"),
-      path197.join(metaprojectRoot, "skills", "testing")
+      path198.join(metaprojectRoot, "core", "testing"),
+      path198.join(metaprojectRoot, "skills", "testing")
     ] : [],
     ...modules.enableMemory ? [
-      path197.join(metaprojectRoot, "core", "memory"),
-      path197.join(metaprojectRoot, "skills", "memory"),
-      path197.join(metaprojectRoot, "memory", "templates")
+      path198.join(metaprojectRoot, "core", "memory"),
+      path198.join(metaprojectRoot, "skills", "memory"),
+      path198.join(metaprojectRoot, "memory", "templates")
     ] : [],
     ...modules.enableTasks ? [
-      path197.join(metaprojectRoot, "flows"),
-      path197.join(metaprojectRoot, "skills", "flow")
+      path198.join(metaprojectRoot, "flows"),
+      path198.join(metaprojectRoot, "skills", "flow")
     ] : [],
     ...modules.enableSecurity ? [
-      path197.join(metaprojectRoot, "core", "security")
+      path198.join(metaprojectRoot, "core", "security")
     ] : [],
     ...modules.enableSac ? [
-      path197.join(metaprojectRoot, "skills", "sac")
+      path198.join(metaprojectRoot, "skills", "sac")
     ] : []
   ];
-  await Promise.all(dirs.map((dir) => mkdir62(dir, { recursive: true })));
+  await Promise.all(dirs.map((dir) => mkdir63(dir, { recursive: true })));
 }
 async function installGdgraphCoreScripts2(metaprojectRoot) {
-  const gdgraphCoreRoot = path197.join(metaprojectRoot, "core", "gdgraph");
-  await mkdir62(gdgraphCoreRoot, { recursive: true });
+  const gdgraphCoreRoot = path198.join(metaprojectRoot, "core", "gdgraph");
+  await mkdir63(gdgraphCoreRoot, { recursive: true });
   for (const file of GDGRAPH_CORE_SOURCES) {
-    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path197.join(gdgraphCoreRoot, file));
+    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path198.join(gdgraphCoreRoot, file));
   }
-  await writeTextIfChanged4(path197.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
+  await writeTextIfChanged4(path198.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
 }
 async function installManagedHook2(projectRoot, hookName, blockId, content) {
   const hooksRoot = await resolveGitHooksRoot(projectRoot);
   if (!hooksRoot) {
     return;
   }
-  await mkdir62(hooksRoot, { recursive: true });
-  const hookPath = path197.join(hooksRoot, hookName);
+  await mkdir63(hooksRoot, { recursive: true });
+  const hookPath = path198.join(hooksRoot, hookName);
   const blockStart = `# keryx:${blockId}:begin`;
   const blockEnd = `# keryx:${blockId}:end`;
   const managedBlock = `${blockStart}
@@ -104065,7 +104467,7 @@ async function removeManagedHook2(projectRoot, hookName, blockId) {
   if (!hooksRoot) {
     return;
   }
-  const hookPath = path197.join(hooksRoot, hookName);
+  const hookPath = path198.join(hooksRoot, hookName);
   if (!await pathExists(hookPath)) {
     return;
   }
@@ -104087,7 +104489,7 @@ async function prePushHasSecurityBlock2(projectRoot) {
   if (!hooksRoot) {
     return false;
   }
-  const hookPath = path197.join(hooksRoot, "pre-push");
+  const hookPath = path198.join(hooksRoot, "pre-push");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -104102,7 +104504,7 @@ async function agentSettingsHasSecuritySentinel2(projectRoot) {
   return (await readFile100(file, "utf8")).includes(AGENT_HOOKS_SENTINEL);
 }
 async function readManifest5(metaprojectRoot) {
-  const manifestPath = path197.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path198.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return {
       exists: false,
@@ -104171,7 +104573,7 @@ async function inferManifestFromExistingMetaproject(metaprojectRoot) {
 }
 async function anyPathExists(root, candidates) {
   for (const candidate of candidates) {
-    if (await pathExists(path197.join(root, candidate))) {
+    if (await pathExists(path198.join(root, candidate))) {
       return true;
     }
   }
@@ -104194,13 +104596,13 @@ function parseUpdateArgs(args) {
   };
 }
 async function runPostUpdateHooks(projectRoot) {
-  const hooksDir = path197.join(projectRoot, ".metaproject", "hooks", "post-update.d");
+  const hooksDir = path198.join(projectRoot, ".metaproject", "hooks", "post-update.d");
   if (!await pathExists(hooksDir)) {
     return;
   }
   const entries = (await readdir37(hooksDir)).sort();
   for (const entry of entries) {
-    const hookPath = path197.join(hooksDir, entry);
+    const hookPath = path198.join(hooksDir, entry);
     try {
       await accessExecutable(hookPath);
     } catch {
@@ -104241,14 +104643,14 @@ async function writeTextIfChanged4(filePath, content) {
   if (await pathExists(filePath) && await readFile100(filePath, "utf8") === content) {
     return;
   }
-  await mkdir62(path197.dirname(filePath), { recursive: true });
+  await mkdir63(path198.dirname(filePath), { recursive: true });
   await writeFile54(filePath, content, "utf8");
 }
 async function writeTextIfMissing4(filePath, content) {
   if (await pathExists(filePath)) {
     return;
   }
-  await mkdir62(path197.dirname(filePath), { recursive: true });
+  await mkdir63(path198.dirname(filePath), { recursive: true });
   await writeFile54(filePath, content, "utf8");
 }
 async function copyFileIfChanged2(from, to) {
@@ -104256,7 +104658,7 @@ async function copyFileIfChanged2(from, to) {
   if (await pathExists(to) && await readFile100(to, "utf8") === next) {
     return;
   }
-  await mkdir62(path197.dirname(to), { recursive: true });
+  await mkdir63(path198.dirname(to), { recursive: true });
   await writeFile54(to, next, "utf8");
 }
 function runtimeSourcePath2(relativePath) {
@@ -104265,7 +104667,7 @@ function runtimeSourcePath2(relativePath) {
     return directPath;
   }
   if (relativePath.startsWith("../")) {
-    const packagedSourcePath = path197.join(path197.dirname(fileURLToPath8(import.meta.url)), "..", "src", relativePath.slice(3));
+    const packagedSourcePath = path198.join(path198.dirname(fileURLToPath8(import.meta.url)), "..", "src", relativePath.slice(3));
     if (existsSync36(packagedSourcePath)) {
       return packagedSourcePath;
     }
@@ -104300,7 +104702,7 @@ function printHelp20() {
 
 // src/commands/dashboard.ts
 import { spawn as spawn7 } from "child_process";
-import path198 from "path";
+import path199 from "path";
 init_args();
 async function dashboardCommand(args = []) {
   const options = parseOptions(args);
@@ -104311,7 +104713,7 @@ async function dashboardCommand(args = []) {
   }
   if (subcommand === "build") {
     const result = await buildDashboard();
-    const rel = path198.relative(process.cwd(), result.path);
+    const rel = path199.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Dashboard built ${style.cyan(symbols.arrow)} ${style.cyan(rel)}`);
     note(`Open it: keryx dashboard open`);
     return;
@@ -104319,7 +104721,7 @@ async function dashboardCommand(args = []) {
   if (subcommand === "open") {
     const result = await buildDashboard();
     await openFile(result.path);
-    const rel = path198.relative(process.cwd(), result.path);
+    const rel = path199.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Opened ${style.cyan(rel)}`);
     return;
   }
@@ -104366,9 +104768,9 @@ function printHelp21() {
 import { readFileSync as readFileSync9 } from "fs";
 
 // src/agents/bootstrap.ts
-import { mkdir as mkdir63, readFile as readFile101, writeFile as writeFile55 } from "fs/promises";
-import { homedir as homedir8 } from "os";
-import path199 from "path";
+import { mkdir as mkdir64, readFile as readFile101, writeFile as writeFile55 } from "fs/promises";
+import { homedir as homedir9 } from "os";
+import path200 from "path";
 init_fs();
 var AGENT_BOOTSTRAP_START = "<!-- keryx:global-bootstrap -->";
 var AGENT_BOOTSTRAP_END = "<!-- /keryx:global-bootstrap -->";
@@ -104378,35 +104780,35 @@ var AGENT_BOOTSTRAP_RUNTIMES = [
     aliases: ["claude-code"],
     label: "Claude Code",
     fileName: "CLAUDE.md",
-    filePath: (homeRoot) => path199.join(homeRoot, ".claude", "CLAUDE.md")
+    filePath: (homeRoot) => path200.join(homeRoot, ".claude", "CLAUDE.md")
   },
   {
     id: "opencode",
     aliases: ["open-code"],
     label: "OpenCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path199.join(homeRoot, ".config", "opencode", "AGENTS.md")
+    filePath: (homeRoot) => path200.join(homeRoot, ".config", "opencode", "AGENTS.md")
   },
   {
     id: "zcode",
     aliases: ["zed", "zed-code"],
     label: "ZCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path199.join(homeRoot, ".zcode", "AGENTS.md")
+    filePath: (homeRoot) => path200.join(homeRoot, ".zcode", "AGENTS.md")
   },
   {
     id: "codex",
     aliases: [],
     label: "Codex",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path199.join(homeRoot, ".codex", "AGENTS.md")
+    filePath: (homeRoot) => path200.join(homeRoot, ".codex", "AGENTS.md")
   },
   {
     id: "antigravity",
     aliases: ["antigravuty", "antigravity-code"],
     label: "Antigravity",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path199.join(homeRoot, ".config", "antigravity", "AGENTS.md")
+    filePath: (homeRoot) => path200.join(homeRoot, ".config", "antigravity", "AGENTS.md")
   }
 ];
 function agentBootstrapRuntimeIds() {
@@ -104436,7 +104838,7 @@ function resolveAgentBootstrapRuntimes(ids) {
   }
   return { runtimes, unknown };
 }
-async function agentBootstrapStatus(runtime, homeRoot = homedir8()) {
+async function agentBootstrapStatus(runtime, homeRoot = homedir9()) {
   const filePath = runtime.filePath(homeRoot);
   const exists = await pathExists(filePath);
   const content = exists ? await readFile101(filePath, "utf8") : "";
@@ -104446,7 +104848,7 @@ async function agentBootstrapStatus(runtime, homeRoot = homedir8()) {
   return { runtime: runtime.id, label: runtime.label, filePath, exists, installed, current };
 }
 async function installAgentBootstrap(runtime, options = {}) {
-  const homeRoot = options.homeRoot ?? homedir8();
+  const homeRoot = options.homeRoot ?? homedir9();
   const filePath = runtime.filePath(homeRoot);
   const exists = await pathExists(filePath);
   const current = exists ? await readFile101(filePath, "utf8") : "";
@@ -104454,14 +104856,14 @@ async function installAgentBootstrap(runtime, options = {}) {
   const dryRun = options.dryRun === true;
   const wrote = next !== current;
   if (wrote && !dryRun) {
-    await mkdir63(path199.dirname(filePath), { recursive: true });
+    await mkdir64(path200.dirname(filePath), { recursive: true });
     await writeFile55(filePath, next, "utf8");
   }
   const status = dryRun ? statusFromContent(runtime, filePath, exists, next) : await agentBootstrapStatus(runtime, homeRoot);
   return { ...status, wrote, dryRun };
 }
 async function uninstallAgentBootstrap(runtime, options = {}) {
-  const homeRoot = options.homeRoot ?? homedir8();
+  const homeRoot = options.homeRoot ?? homedir9();
   const filePath = runtime.filePath(homeRoot);
   const exists = await pathExists(filePath);
   const current = exists ? await readFile101(filePath, "utf8") : "";
@@ -104991,7 +105393,7 @@ function printBootstrapHelp() {
 // src/commands/metrics.ts
 init_args();
 import { readFile as readFile102 } from "fs/promises";
-import path201 from "path";
+import path202 from "path";
 
 // src/metrics/benchmark.ts
 var RELIABILITIES2 = new Set(["exact", "estimated", "unknown"]);
@@ -105807,8 +106209,8 @@ function buildContainmentManifest(inputs, options = {}) {
 }
 
 // src/metrics/oracle-runner.ts
-import { mkdir as mkdir64, writeFile as writeFile56 } from "fs/promises";
-import path200 from "path";
+import { mkdir as mkdir65, writeFile as writeFile56 } from "fs/promises";
+import path201 from "path";
 
 // src/metrics/ir.ts
 function toIdSet(ids) {
@@ -106254,9 +106656,9 @@ function buildEvidenceBundle(input, options = {}) {
 async function persistEvidenceBundle(outDir, bundle, ladder = "metastore") {
   const safeTarget = bundle.target.replace(/[^A-Za-z0-9._/-]/g, "_");
   const safeCase = bundle.caseId.replace(/[^A-Za-z0-9._-]/g, "_");
-  const dir = path200.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
-  await mkdir64(dir, { recursive: true });
-  const write = (name, value) => writeFile56(path200.join(dir, name), `${JSON.stringify(value, null, 2)}
+  const dir = path201.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
+  await mkdir65(dir, { recursive: true });
+  const write = (name, value) => writeFile56(path201.join(dir, name), `${JSON.stringify(value, null, 2)}
 `, "utf8");
   await Promise.all([
     write("inputs.json", bundle.inputs),
@@ -106296,7 +106698,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
     console.log("# metrics status");
     console.log("");
     console.log(`root: ${root}`);
-    console.log(`enabled: ${await Bun.file(path201.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
+    console.log(`enabled: ${await Bun.file(path202.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
     const latest = await readLatestPointer(root);
     console.log(`latest: ${latest.status}`);
     return;
@@ -106308,7 +106710,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const record = JSON.parse(await readFile102(path201.resolve(projectRoot, file), "utf8"));
+    const record = JSON.parse(await readFile102(path202.resolve(projectRoot, file), "utf8"));
     const result = validateRunRecord(record);
     console.log(result.valid ? "valid: yes" : "valid: no");
     for (const error of result.errors)
@@ -106333,7 +106735,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const file = path201.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
+    const file = path202.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
     if (!await Bun.file(file).exists()) {
       console.error(`Run not found: ${runId}`);
       process.exitCode = 1;
@@ -106350,8 +106752,8 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const a = JSON.parse(await readFile102(path201.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
-    const b = JSON.parse(await readFile102(path201.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
+    const a = JSON.parse(await readFile102(path202.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
+    const b = JSON.parse(await readFile102(path202.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
     const comparison = compareExecutionRuns(a, b);
     console.log(stableJson(comparison));
     return;
@@ -106385,8 +106787,8 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       return;
     }
     const template = createPairedBenchmarkTemplate(taskIds);
-    await Bun.write(path201.resolve(projectRoot, out), stableJson(template));
-    console.log(`manifest: ${path201.relative(projectRoot, path201.resolve(projectRoot, out))}`);
+    await Bun.write(path202.resolve(projectRoot, out), stableJson(template));
+    console.log(`manifest: ${path202.relative(projectRoot, path202.resolve(projectRoot, out))}`);
     return;
   }
   if (subcommand === "benchmark" && args[1] === "run") {
@@ -106400,7 +106802,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const raw = JSON.parse(await readFile102(path201.resolve(projectRoot, file), "utf8"));
+    const raw = JSON.parse(await readFile102(path202.resolve(projectRoot, file), "utf8"));
     const input = Array.isArray(raw) ? raw : raw.runs ?? [];
     const result = validatePairedBenchmark(input);
     console.log(stableJson(result));
@@ -106412,7 +106814,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
   process.exitCode = 1;
 }
 async function loadAffectedSets(projectRoot, file) {
-  const raw = JSON.parse(await readFile102(path201.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile102(path202.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target === "string")
@@ -106483,7 +106885,7 @@ async function runHarnessLayer(projectRoot, args, ladder) {
   let tasks;
   let model;
   try {
-    const raw = JSON.parse(await readFile102(path201.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile102(path202.resolve(projectRoot, resultsPath), "utf8"));
     tasks = raw.tasks ?? [];
     model = raw.model;
   } catch (error) {
@@ -106514,7 +106916,7 @@ async function runSafetyCompletionHonestyLayer(projectRoot, args, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile102(path201.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile102(path202.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error) {
@@ -106539,7 +106941,7 @@ async function runSafetyFalsePremiseLayer(projectRoot, args, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile102(path201.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile102(path202.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error) {
@@ -106564,7 +106966,7 @@ async function runSafetyContainmentLayer(projectRoot, args, ladder, caseClass) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile102(path201.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile102(path202.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error) {
@@ -106626,12 +107028,12 @@ async function runGdgraphLayer(projectRoot, args, ladder) {
   }
   const manifests = buildOracleManifestsByGold(inputs, { ladder });
   if (outDir) {
-    const resolvedOut = path201.resolve(projectRoot, outDir);
+    const resolvedOut = path202.resolve(projectRoot, outDir);
     for (const input of inputs) {
       for (const named of input.golds) {
         const bundle = buildEvidenceBundle({ target: input.target, system: input.system, gold: named.gold }, { ladder, goldReference: goldPathFor(named.kind), timestamp: new Date().toISOString() });
-        const dir = await persistEvidenceBundle(path201.join(resolvedOut, named.kind), bundle, ladder);
-        console.error(`bundle[${named.kind}]: ${path201.relative(projectRoot, dir)}`);
+        const dir = await persistEvidenceBundle(path202.join(resolvedOut, named.kind), bundle, ladder);
+        console.error(`bundle[${named.kind}]: ${path202.relative(projectRoot, dir)}`);
       }
     }
   }
@@ -106655,7 +107057,7 @@ async function runGdgraphLayer(projectRoot, args, ladder) {
   return allValid;
 }
 async function loadCoverageMap2(projectRoot, file) {
-  const raw = JSON.parse(await readFile102(path201.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile102(path202.resolve(projectRoot, file), "utf8"));
   return raw.coverageMap ?? {};
 }
 async function runTestingLayer(projectRoot, args, ladder) {
@@ -106692,7 +107094,7 @@ async function runTestingLayer(projectRoot, args, ladder) {
   return result.valid;
 }
 async function loadMemoryGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile102(path201.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile102(path202.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 3;
 }
 async function runMemoryLayer(projectRoot, args, ladder) {
@@ -106729,11 +107131,11 @@ async function runMemoryLayer(projectRoot, args, ladder) {
   return result.valid;
 }
 async function loadWikiGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile102(path201.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile102(path202.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 5;
 }
 async function loadWikiGroundedness(projectRoot, file) {
-  const raw = JSON.parse(await readFile102(path201.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile102(path202.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target !== "string" || !Array.isArray(entry.scores) || entry.scores.length !== 3)
@@ -106789,7 +107191,7 @@ async function runWikiLayer(projectRoot, args, ladder) {
   return result.valid;
 }
 async function loadGdctxFacts(projectRoot, file) {
-  const raw = JSON.parse(await readFile102(path201.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile102(path202.resolve(projectRoot, file), "utf8"));
   const inputs = [];
   for (const entry of raw.inputs ?? []) {
     if (typeof entry.input === "string") {
@@ -106827,7 +107229,7 @@ async function collect(projectRoot, args) {
     process.exitCode = 1;
     return;
   }
-  const raw = JSON.parse(await readFile102(path201.resolve(projectRoot, eventFile), "utf8"));
+  const raw = JSON.parse(await readFile102(path202.resolve(projectRoot, eventFile), "utf8"));
   const events = Array.isArray(raw) ? raw : raw.events;
   const startedAt = optionValue(args, "--started-at") ?? events[0]?.timestamp_utc ?? new Date().toISOString();
   const finishedAt = optionValue(args, "--finished-at") ?? events.at(-1)?.timestamp_utc ?? startedAt;
@@ -106843,11 +107245,11 @@ async function collect(projectRoot, args) {
     parentRunId: optionValue(args, "--parent-run-id") ?? null
   });
   const result = await writeRunArtifacts(metricsRoot(projectRoot), record, { cwd: projectRoot });
-  console.log(`json: ${path201.relative(projectRoot, result.jsonPath)}`);
-  console.log(`markdown: ${path201.relative(projectRoot, result.markdownPath)}`);
+  console.log(`json: ${path202.relative(projectRoot, result.jsonPath)}`);
+  console.log(`markdown: ${path202.relative(projectRoot, result.markdownPath)}`);
 }
 function metricsRoot(projectRoot) {
-  return path201.join(projectRoot, ".metaproject", "data", "metrics");
+  return path202.join(projectRoot, ".metaproject", "data", "metrics");
 }
 function printMetricsHelp() {
   console.log(`keryx metrics