@mrciphersmith/keryx 0.2.38 → 0.2.39

package/dist/cli.js

@@ -191,7 +191,9 @@ __export(exports_fs, {
   toPosix: () => toPosix,
   pathExists: () => pathExists,
   isPathInside: () => isPathInside,
-  isNotFound: () => isNotFound
+  isNotFound: () => isNotFound,
+  isLockHeld: () => isLockHeld,
+  DEFAULT_LOCK_STALE_MS: () => DEFAULT_LOCK_STALE_MS
 });
 import { randomUUID as randomUUID4 } from "crypto";
 import { access, mkdir, readFile, rename, rm, stat, utimes, writeFile } from "fs/promises";
@@ -229,7 +231,7 @@ async function writeFileAtomic(filePath, content) {
 async function withFileLock2(lockPath, fn, options = {}) {
   const timeoutMs = options.timeoutMs ?? 5000;
   const retryMs = options.retryMs ?? 25;
-  const staleMs = options.staleMs ?? 30000;
+  const staleMs = options.staleMs ?? DEFAULT_LOCK_STALE_MS;
   const heartbeatMs = options.heartbeatMs ?? Math.max(100, Math.floor(staleMs / 3));
   const startedAt = Date.now();
   const owner = { pid: process.pid, token: randomUUID4() };
@@ -270,6 +272,17 @@ async function withFileLock2(lockPath, fn, options = {}) {
     }
   }
 }
+async function isLockHeld(lockPath, staleMs = DEFAULT_LOCK_STALE_MS) {
+  try {
+    const stats = await stat(lockPath);
+    if (Date.now() - stats.mtimeMs <= staleMs)
+      return true;
+    const owner = await readLockOwner(path5.join(lockPath, "owner.json"));
+    return owner !== undefined && processIsAlive(owner.pid);
+  } catch {
+    return false;
+  }
+}
 function isAlreadyExistsError(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
 }
@@ -308,6 +321,7 @@ function processIsAlive(pid) {
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+var DEFAULT_LOCK_STALE_MS = 30000;
 var init_fs = () => {};
 
 // src/lib/git-hooks.ts
@@ -14016,6 +14030,9 @@ function projectSessionsDir(projectPath, dataDir) {
 function sessionDir(projectPath, sessionId, dataDir) {
   return path8.join(projectSessionsDir(projectPath, dataDir), sessionId);
 }
+function resolveOneShotWrapUpSessionDir(cwd, mintSessionId) {
+  return sessionDir(cwd, mintSessionId());
+}
 
 // src/harness/process/sandbox/network-run.ts
 import { Worker } from "worker_threads";
@@ -35531,6 +35548,9 @@ function createSacAuthorizationServer(input2) {
     return actor;
   } });
 }
+function isTrustedActorContext(actorContext) {
+  return isRecord2(actorContext) && trustedActors.has(actorContext);
+}
 var roleRank = { viewer: 1, editor: 2, owner: 3 };
 function authorizationResult(allowed, code, baseline, required2, workspaceId) {
   return { allowed, code, authorizeAtUse: async (resolve2) => {
@@ -35697,6 +35717,15 @@ class WorkspaceService {
   async list(input2) {
     const actor = await this.requireActor(input2.request, input2.requestCorrelationId);
     await this.requireStrict("read");
+    return this.enumerateVisible(actor, input2.includeArchived);
+  }
+  async listForActor(input2) {
+    await this.requireStrict("read");
+    if (!isTrustedActorContext(input2.actorContext))
+      throw new WorkspaceServiceError("access_denied", "untrusted actor");
+    return this.enumerateVisible(input2.actorContext, input2.includeArchived);
+  }
+  async enumerateVisible(actor, includeArchived) {
     try {
       await mkdir46(this.storageRoot, { recursive: true, mode: 448 });
     } catch {
@@ -35710,7 +35739,7 @@ class WorkspaceService {
       try {
         const manifest = await this.readManifest(entry.name);
         const role = currentRole(manifest, actor.subject);
-        if (role && (input2.includeArchived === true || manifest.status !== "archived"))
+        if (role && (includeArchived === true || manifest.status !== "archived"))
           visible.push(manifest);
       } catch {}
     }
@@ -35951,6 +35980,25 @@ function localWorkspaceAuthorizationServer(subject = `user:local-${process.getui
 function newWorkspaceId() {
   return `workspace-${randomUUID7().replace(/-/g, "").slice(0, 16)}`;
 }
+async function resolveWorkspaceForActor(cwd, workspaceId) {
+  const service4 = new WorkspaceService({
+    workspaceRoot: cwd,
+    authorizationServer: localWorkspaceAuthorizationServer(),
+    strictGuard: { mode: "strict", availability: "available", decision: "pass", policyRevision: "local-offline-v1" }
+  });
+  try {
+    const manifest = await service4.show({ request: undefined, requestCorrelationId: randomUUID7(), workspaceId });
+    return { ok: true, manifest };
+  } catch (error2) {
+    if (error2 instanceof WorkspaceServiceError) {
+      return { ok: false, error: error2 };
+    }
+    return {
+      ok: false,
+      error: new WorkspaceServiceError("not_found", error2 instanceof Error ? error2.message : "workspace could not be resolved")
+    };
+  }
+}
 
 // src/sac/fwk-service.ts
 init_store2();
@@ -36706,7 +36754,7 @@ function normalizeFwkResult(result) {
 // src/sac/proposal-lifecycle.ts
 init_fs();
 import { createHash as createHash18, randomUUID as randomUUID11 } from "crypto";
-import { appendFile as appendFile5, mkdir as mkdir50, readFile as readFile69 } from "fs/promises";
+import { appendFile as appendFile5, mkdir as mkdir50, readdir as readdir20, readFile as readFile69 } from "fs/promises";
 import path124 from "path";
 
 // src/sac/trusted-wrap-up.ts
@@ -36945,7 +36993,9 @@ function readSummaryFile(file) {
       compactCount: typeof o.compactCount === "number" ? o.compactCount : 0,
       ...typeof o.provider === "string" ? { provider: o.provider } : {},
       ...typeof o.model === "string" ? { model: o.model } : {},
-      ...typeof o.parentSessionId === "string" ? { parentSessionId: o.parentSessionId } : {}
+      ...typeof o.parentSessionId === "string" ? { parentSessionId: o.parentSessionId } : {},
+      ...o.runMode === "interactive" || o.runMode === "unattended" ? { runMode: o.runMode } : {},
+      ...o.courseStatus === "unbound" || o.courseStatus === "active" || o.courseStatus === "blocked" || o.courseStatus === "done" ? { courseStatus: o.courseStatus } : {}
     };
   } catch {
     return;
@@ -37703,6 +37753,51 @@ class ProposalLifecycleService {
       });
     } });
   }
+  async listProposedProposals(workspaceId) {
+    const proposalsDir = path124.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals");
+    let entries;
+    try {
+      entries = (await readdir20(proposalsDir)).filter((name) => name.endsWith(".json"));
+    } catch (error2) {
+      if (isNotFound(error2))
+        return [];
+      throw error2;
+    }
+    const proposals = [];
+    for (const entry of entries) {
+      try {
+        const parsed = JSON.parse(await readFile69(path124.join(proposalsDir, entry), "utf8"));
+        if (parsed.recordType === "proposal-created")
+          proposals.push(parsed);
+      } catch {}
+    }
+    const terminalIds = new Set((await this.records(this.ledgerPath(workspaceId))).filter((record) => record.recordType === "proposal-transition").map((record) => record.proposalId));
+    return proposals.filter((proposal) => !terminalIds.has(proposal.id));
+  }
+  async listVisibleProposedProposals(actor) {
+    const workspaces = await this.options.workspaces.listForActor({ actorContext: actor, includeArchived: true });
+    const groups = [];
+    for (const workspace of workspaces) {
+      const proposals = await this.listProposedProposals(workspace.id);
+      if (proposals.length > 0)
+        groups.push({ workspace, proposals });
+    }
+    return groups;
+  }
+  async isEvidenceFresh(proposal, _actor) {
+    const readEvidenceFile = this.options.readEvidenceFile ?? readWorkspaceFileNoFollow;
+    for (const item of proposal.evidence) {
+      try {
+        const resolved = await resolveWorkspaceReference({ workspaceRoot: this.root, kind: item.kind, uri: item.uri });
+        const content = readEvidenceFile(this.root, resolved).toString("utf8");
+        if (hash(content) !== item.revision)
+          return false;
+      } catch {
+        return false;
+      }
+    }
+    return true;
+  }
   async targetWriteOrStale(proposal, actor, reviewerAuthority, input2, approvalRef, writeIntent, policyRevision) {
     await this.options.beforeTargetWrite?.();
     try {
@@ -37940,14 +38035,23 @@ function recordHash(value) {
 function isPlatformUnavailableSecureReadError(error2) {
   return error2 instanceof Error && error2.message === "safe descriptor source reads are unavailable on this platform";
 }
-function createHarnessProposalLifecycleService(cwd, opts) {
+function createLocalProposalLifecycleService(cwd) {
   const authorizationServer = localWorkspaceAuthorizationServer();
   const workspaces = new WorkspaceService({ workspaceRoot: cwd, authorizationServer, strictGuard: { mode: "strict", availability: "available", decision: "pass", policyRevision: "local-offline-v1" } });
+  return new ProposalLifecycleService({ workspaceRoot: cwd, workspaces, authorizationServer, guard: { mode: "strict", availability: "available", decision: "pass", policyRevision: "local-offline-v1" }, policyRef: "./security/policy/local", policyRevision: "local-offline-v1", targetWriters: createLocalOwnerWriterAdapters(), wrapUpAuthority: createTrustedWrapUpAuthority({ now: () => new Date(0), resolveExplicitWrapUp: async () => {
+    throw new Error("trusted wrap-up boundary unavailable");
+  } }) });
+}
+function createHarnessProposalLifecycleService(cwd, opts) {
+  const authorizationServer = localWorkspaceAuthorizationServer();
+  const nowOpt = opts.now !== undefined ? { now: opts.now } : {};
+  const workspaces = new WorkspaceService({ workspaceRoot: cwd, authorizationServer, strictGuard: { mode: "strict", availability: "available", decision: "pass", policyRevision: "local-offline-v1" }, ...nowOpt });
   const wrapUpAuthority = createTrustedWrapUpAuthority({
+    ...nowOpt,
     resolveExplicitWrapUp: async (request) => {
       if (request.source !== "session")
         throw new Error(`this composition only resolves "session" wrap-ups, got "${request.source}"`);
-      return resolveSessionWrapUp({ cwd, workspaceId: opts.workspaceId, sourceRef: request.sourceRef });
+      return resolveSessionWrapUp({ cwd, workspaceId: opts.workspaceId, sourceRef: request.sourceRef, ...nowOpt });
     }
   });
   const noteOpt = opts.note !== undefined ? { note: opts.note } : {};
@@ -37957,7 +38061,7 @@ function createHarnessProposalLifecycleService(cwd, opts) {
     wiki: createWikiGuardedTargetWriter(createRealWikiOwnerWriter(cwd, noteOpt)),
     skill: createSkillGuardedTargetWriter(createRealSkillOwnerWriter(cwd, noteOpt))
   };
-  const service4 = new ProposalLifecycleService({ workspaceRoot: cwd, workspaces, authorizationServer, guard: { mode: "strict", availability: "available", decision: "pass", policyRevision: "local-offline-v1" }, policyRef: "./security/policy/local", policyRevision: "local-offline-v1", targetWriters, wrapUpAuthority });
+  const service4 = new ProposalLifecycleService({ workspaceRoot: cwd, workspaces, authorizationServer, guard: { mode: "strict", availability: "available", decision: "pass", policyRevision: "local-offline-v1" }, policyRef: "./security/policy/local", policyRevision: "local-offline-v1", targetWriters, wrapUpAuthority, ...nowOpt });
   return { service: service4, wrapUpAuthority, authorizationServer };
 }
 function createWikiGuardedTargetWriter(input2) {
@@ -38361,7 +38465,7 @@ function buildToolRegistry() {
 // src/mcp/resources.ts
 init_fs();
 import path126 from "path";
-import { readdir as readdir20, readFile as readFile72, stat as stat7 } from "fs/promises";
+import { readdir as readdir21, readFile as readFile72, stat as stat7 } from "fs/promises";
 var URI_PREFIX = "metaproject://";
 function mimeForPath(filePath) {
   if (filePath.endsWith(".json") || filePath.endsWith(".jsonl")) {
@@ -38388,7 +38492,7 @@ async function walkFiles(root) {
   const out = [];
   let entries;
   try {
-    entries = await readdir20(root, { withFileTypes: true });
+    entries = await readdir21(root, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -38410,7 +38514,7 @@ async function listArtifacts(cwd) {
   const listings = [];
   let modules;
   try {
-    modules = await readdir20(base, { withFileTypes: true });
+    modules = await readdir21(base, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -38840,8 +38944,8 @@ Reports the workspace root and one enabled/disabled line per module. Use
 
 // src/commands/harness.ts
 import { readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "fs";
-import path132 from "path";
-import { randomUUID as randomUUID14 } from "crypto";
+import path134 from "path";
+import { randomUUID as randomUUID15 } from "crypto";
 
 // src/security/harness-scan.ts
 init_guard();
@@ -40782,6 +40886,427 @@ function resolveAllowedDomains(env, projectRoot) {
 
 // src/commands/harness.ts
 init_providers();
+
+// src/sac/machine-wrap-up.ts
+init_fs();
+import { createHash as createHash27, randomUUID as randomUUID14 } from "crypto";
+import { execFile } from "child_process";
+import { mkdir as mkdir53 } from "fs/promises";
+import path133 from "path";
+import { promisify } from "util";
+
+// src/session/slate.ts
+init_fs();
+import { mkdir as mkdir52, readFile as readFile73, rm as rm7 } from "fs/promises";
+import path132 from "path";
+init_repomap();
+init_redact();
+function slatePath(dir) {
+  return path132.join(dir, "slate.json");
+}
+function slateLockPath(dir) {
+  return `${slatePath(dir)}.lock`;
+}
+async function readSlate(dir) {
+  try {
+    const raw = await readFile73(slatePath(dir), "utf8");
+    return JSON.parse(raw);
+  } catch (error2) {
+    if (isNotFound(error2))
+      return;
+    throw error2;
+  }
+}
+async function writeSlate(dir, update) {
+  await mkdir52(dir, { recursive: true });
+  return withFileLock2(slateLockPath(dir), async () => {
+    const prev = await readSlate(dir);
+    const next = update(prev);
+    await writeFileAtomic(slatePath(dir), `${JSON.stringify(next, null, 2)}
+`);
+    return next;
+  });
+}
+async function archiveSlate(dir, attemptId) {
+  if (!/^[A-Za-z0-9._-]+$/.test(attemptId))
+    throw new Error(`invalid attemptId: ${JSON.stringify(attemptId)}`);
+  await mkdir52(dir, { recursive: true });
+  return withFileLock2(slateLockPath(dir), () => archiveIfExistsLocked(dir, attemptId));
+}
+async function archiveIfExistsLocked(dir, attemptId) {
+  let raw;
+  try {
+    raw = await readFile73(slatePath(dir), "utf8");
+  } catch (error2) {
+    if (isNotFound(error2))
+      return;
+    throw error2;
+  }
+  const archiveDir = path132.join(dir, "slate-archive");
+  await mkdir52(archiveDir, { recursive: true });
+  await writeFileAtomic(path132.join(archiveDir, `${attemptId}.json`), raw);
+  await rm7(slatePath(dir), { force: true });
+}
+async function openSlateAtomic(dir, mintAttemptId, build) {
+  await mkdir52(dir, { recursive: true });
+  return withFileLock2(slateLockPath(dir), async () => {
+    const existing = await readSlate(dir);
+    if (existing !== undefined) {
+      await archiveIfExistsLocked(dir, mintAttemptId());
+    }
+    const next = build();
+    await writeFileAtomic(slatePath(dir), `${JSON.stringify(next, null, 2)}
+`);
+    await rm7(path132.join(dir, "terminal-state.json"), { force: true });
+    return next;
+  });
+}
+async function appendSeed(dir, seed) {
+  return writeSlate(dir, (prev) => {
+    if (!prev)
+      throw new Error(`appendSeed: no open slate in ${dir}`);
+    return { ...prev, seeds: [...prev.seeds, seed] };
+  });
+}
+function dedupeSeeds(seeds) {
+  const seen = new Set;
+  const result = [];
+  for (const seed of seeds) {
+    const key = seed.text.trim();
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    result.push(seed);
+  }
+  return result;
+}
+var DEFAULT_RENDER_MAX_TOKENS = 2000;
+function redactAndBoundTouched(touched, budget, ctx) {
+  const recentFirstRedacted = [...touched].reverse().map((entry) => redactSensitiveText(entry));
+  const candidates = recentFirstRedacted.map((text, i) => ({
+    id: `touched:${i}`,
+    required: false,
+    tokens: estimateTokens(text)
+  }));
+  const assembly = assembleContext({
+    candidates,
+    maxItems: candidates.length,
+    maxTokens: Math.max(0, budget),
+    ...ctx
+  });
+  const selectedIds = new Set("code" in assembly ? [] : assembly.selected);
+  return recentFirstRedacted.map((text, i) => ({ id: `touched:${i}`, text })).filter((entry) => selectedIds.has(entry.id)).reverse().map((entry) => entry.text);
+}
+function renderAnchorsBlock(anchors, opts) {
+  const maxTokens = opts?.maxTokens ?? DEFAULT_RENDER_MAX_TOKENS;
+  const rootLine = `root: ${anchors.root}`;
+  const treeLine = anchors.tree !== undefined ? `tree: ${anchors.tree}` : undefined;
+  const runtimeLine = anchors.runtime !== undefined ? `runtime: ${anchors.runtime.provider}/${anchors.runtime.model}` : undefined;
+  const headEntries = [{ id: "root", text: rootLine, required: true }];
+  if (treeLine !== undefined)
+    headEntries.push({ id: "tree", text: treeLine, required: false });
+  if (runtimeLine !== undefined)
+    headEntries.push({ id: "runtime", text: runtimeLine, required: false });
+  const headCandidates = headEntries.map((entry) => ({
+    id: entry.id,
+    required: entry.required,
+    tokens: estimateTokens(entry.text)
+  }));
+  const headAssembly = assembleContext({
+    candidates: headCandidates,
+    maxItems: headCandidates.length,
+    maxTokens,
+    traceRef: "slate-anchors",
+    configurationRevision: "slate-anchors-v1",
+    policyRef: "slate-anchors",
+    policyRevision: "v1"
+  });
+  const headSelectedIds = "code" in headAssembly ? new Set(["root"]) : new Set(headAssembly.selected);
+  const headTokensUsed = "code" in headAssembly ? 0 : headCandidates.filter((c) => headSelectedIds.has(c.id)).reduce((sum, c) => sum + c.tokens, 0);
+  const touchedBudget = "code" in headAssembly ? 0 : Math.max(0, maxTokens - headTokensUsed);
+  const touchedLines = redactAndBoundTouched(anchors.touched, touchedBudget, {
+    traceRef: "slate-anchors-touched",
+    configurationRevision: "slate-anchors-v1",
+    policyRef: "slate-anchors",
+    policyRevision: "v1"
+  }).map((text) => `- ${text}`);
+  const lines = ["Anchors:", rootLine];
+  if (treeLine !== undefined && headSelectedIds.has("tree"))
+    lines.push(treeLine);
+  if (runtimeLine !== undefined && headSelectedIds.has("runtime"))
+    lines.push(runtimeLine);
+  if (touchedLines.length > 0) {
+    lines.push("touched:", ...touchedLines);
+  }
+  return lines.join(`
+`);
+}
+
+// src/session/slate-course.ts
+init_store2();
+var unbound = { state: "unbound" };
+async function readCourse(cwd, flowRef) {
+  if (!flowRef)
+    return unbound;
+  try {
+    const dir = await resolveFlowDir(cwd, flowRef);
+    const flow = await readFlow(cwd, dir);
+    return { state: "bound", ...deriveFlowWork(flow, flowRef) };
+  } catch {
+    return unbound;
+  }
+}
+async function courseFromSlate(cwd, slate) {
+  return readCourse(cwd, slate?.course.flowRef);
+}
+
+// src/sac/machine-wrap-up.ts
+init_single_turn();
+var execFileAsync = promisify(execFile);
+var WRAP_UP_TTL_MS2 = 60 * 60 * 1000;
+var DEFAULT_MODEL_TURN_TIMEOUT_MS = 30000;
+function describeSource(source) {
+  return source === "parent" ? "parent" : `child:${source.childDispatchId}`;
+}
+function dedupedAttributedSeeds(slate) {
+  const seen = new Set;
+  const result = [];
+  const take = (seeds, source) => {
+    for (const seed of dedupeSeeds(seeds)) {
+      const key = seed.text.trim();
+      if (seen.has(key))
+        continue;
+      seen.add(key);
+      result.push({ text: seed.text, kind: seed.kind ?? "follow-up", source });
+    }
+  };
+  take(slate.seeds, "parent");
+  const childDispatches = slate.childDispatches ?? {};
+  for (const [dispatchId, dispatch] of Object.entries(childDispatches)) {
+    take(dispatch.seeds, { childDispatchId: dispatchId });
+  }
+  return result;
+}
+function groupSeedsByKind(slate) {
+  const map = new Map;
+  for (const seed of dedupedAttributedSeeds(slate)) {
+    const bucket = map.get(seed.kind);
+    if (bucket)
+      bucket.push(seed);
+    else
+      map.set(seed.kind, [seed]);
+  }
+  return map;
+}
+function sha2568(value) {
+  return createHash27("sha256").update(value).digest("hex");
+}
+async function gitDiff(cwd) {
+  try {
+    const { stdout: stdout2 } = await execFileAsync("git", ["diff"], { cwd, maxBuffer: 16 * 1024 * 1024 });
+    return stdout2;
+  } catch {
+    return "";
+  }
+}
+function diffStatLine(diffText) {
+  if (diffText.trim().length === 0)
+    return "no working-tree changes";
+  const added = (diffText.match(/^\+(?!\+\+)/gm) ?? []).length;
+  const removed = (diffText.match(/^-(?!--)/gm) ?? []).length;
+  return `working-tree diff: +${added}/-${removed} line(s)`;
+}
+function courseStatusLine(course) {
+  if (course.state !== "bound")
+    return "flow: unbound";
+  return `flow ${course.flowRef.uri} snapshot=${course.flowRef.snapshot} completed=${course.completed.length} next=${course.next.length} blocked=${course.blocked.length}`;
+}
+function mechanicalSummary(diffText, course) {
+  return `Mechanical wrap-up summary (model turn unavailable or timed out):
+${diffStatLine(diffText)}
+${courseStatusLine(course)}`;
+}
+async function resolveMachineWrapUp(input2) {
+  const now = input2.now ?? (() => new Date);
+  const diffText = await gitDiff(input2.cwd);
+  const course = await readCourse(input2.cwd, input2.slate.course.flowRef);
+  const seedsForKind = dedupedAttributedSeeds(input2.slate).filter((seed) => seed.kind === input2.kind);
+  const flowSnapshotJson = `${JSON.stringify(course, null, 2)}
+`;
+  const seedsJson = `${JSON.stringify(seedsForKind.map((seed) => ({ text: seed.text, source: describeSource(seed.source) })), null, 2)}
+`;
+  const sourceRevision = sha2568([diffText, flowSnapshotJson, seedsJson].join("\x00"));
+  const shortHash = sourceRevision.slice(0, 16);
+  const system = "Summarize ONLY the machine evidence provided below \u2014 a git diff, a Flow snapshot, and the Seeds captured " + "this session for one proposal kind. Never invent facts that are not present in the evidence.";
+  const user = `--- git diff ---
+${diffText.length > 0 ? diffText : "(no working-tree changes)"}
+
+` + `--- flow snapshot ---
+${flowSnapshotJson}
+` + `--- seeds (${input2.kind}) ---
+${seedsJson}`;
+  let modelResult;
+  const modelTurnTimeoutMs = input2.modelTurnTimeoutMs ?? DEFAULT_MODEL_TURN_TIMEOUT_MS;
+  const turn = runModelTurn({
+    system,
+    user,
+    requestId: `machine-wrap-up-${shortHash}`,
+    ...input2.env !== undefined ? { env: input2.env } : {},
+    ...input2.providerFactory !== undefined ? { providerFactory: input2.providerFactory } : {}
+  }).then((result) => {
+    modelResult = result;
+    return "done";
+  });
+  let timer;
+  const expired = new Promise((resolve2) => {
+    timer = setTimeout(() => resolve2("timeout"), modelTurnTimeoutMs);
+  });
+  let raceOutcome;
+  try {
+    raceOutcome = await Promise.race([turn, expired]);
+  } finally {
+    if (timer !== undefined)
+      clearTimeout(timer);
+  }
+  let summary;
+  if (raceOutcome === "timeout") {
+    turn.catch(() => {});
+    summary = mechanicalSummary(diffText, course);
+  } else {
+    const result = modelResult;
+    if (result.text.trim().length === 0 && !result.credentialAvailable) {
+      return { ok: false, code: "no_credential" };
+    }
+    summary = result.text.trim().length > 0 ? result.text.trim() : mechanicalSummary(diffText, course);
+  }
+  const evidenceDir = path133.join(input2.cwd, ".metaproject", "workspaces", input2.workspaceId, "machine-evidence");
+  await mkdir53(evidenceDir, { recursive: true });
+  const diffFile = `${input2.kind}.${shortHash}.diff.txt`;
+  const flowFile = `${input2.kind}.${shortHash}.flow.json`;
+  const seedsFile = `${input2.kind}.${shortHash}.seeds.json`;
+  await writeFileAtomic(path133.join(evidenceDir, diffFile), diffText);
+  await writeFileAtomic(path133.join(evidenceDir, flowFile), flowSnapshotJson);
+  await writeFileAtomic(path133.join(evidenceDir, seedsFile), seedsJson);
+  const observedAt = now().toISOString();
+  const relBase = `./.metaproject/workspaces/${input2.workspaceId}/machine-evidence`;
+  const evidence = [
+    { kind: "diff", uri: `${relBase}/${diffFile}`, revision: sha2568(diffText), observedAt },
+    { kind: "flow", uri: `${relBase}/${flowFile}`, revision: sha2568(flowSnapshotJson), observedAt },
+    { kind: "seeds", uri: `${relBase}/${seedsFile}`, revision: sha2568(seedsJson), observedAt }
+  ];
+  return {
+    ok: true,
+    resolution: {
+      workspaceId: input2.workspaceId,
+      sourceRevision,
+      summary,
+      evidence,
+      expiresAt: new Date(now().getTime() + WRAP_UP_TTL_MS2).toISOString()
+    }
+  };
+}
+async function writeUnboundCandidateArtifact(dir, trigger, now, grouped, nonEmptyKinds) {
+  const archiveDir = path133.join(dir, "slate-archive");
+  await mkdir53(archiveDir, { recursive: true });
+  const nowIso3 = now().toISOString();
+  const filename = `${nowIso3.replace(/[:.]/g, "-")}-unbound-candidate.json`;
+  const content = {
+    recordType: "unbound-candidate",
+    trigger,
+    generatedAt: nowIso3,
+    groups: nonEmptyKinds.map((kind) => ({
+      kind,
+      seeds: (grouped.get(kind) ?? []).map((seed) => ({ text: seed.text, source: describeSource(seed.source) }))
+    }))
+  };
+  await writeFileAtomic(path133.join(archiveDir, filename), `${JSON.stringify(content, null, 2)}
+`);
+}
+async function proposeOneGroup(params) {
+  try {
+    const resolved = await resolveMachineWrapUp({
+      cwd: params.cwd,
+      workspaceId: params.workspaceId,
+      slate: params.slate,
+      kind: params.kind,
+      now: params.now,
+      ...params.env !== undefined ? { env: params.env } : {},
+      ...params.providerFactory !== undefined ? { providerFactory: params.providerFactory } : {},
+      ...params.modelTurnTimeoutMs !== undefined ? { modelTurnTimeoutMs: params.modelTurnTimeoutMs } : {}
+    });
+    if (!resolved.ok)
+      return { kind: params.kind, outcome: "no_credential" };
+    const flowEvidence = resolved.resolution.evidence.find((item) => item.kind === "flow");
+    const sourceRef = (flowEvidence ?? resolved.resolution.evidence[0]).uri;
+    const flowRef = params.slate.course.flowRef ?? "";
+    const dedupHash = sha2568(`${params.workspaceId}:${flowRef}:${resolved.resolution.sourceRevision}:${params.kind}`);
+    const proposalId = `wrapup-${dedupHash.slice(0, 32)}`;
+    const wrapUpAuthority = createTrustedWrapUpAuthority({
+      now: params.now,
+      resolveExplicitWrapUp: async (request) => {
+        if (request.source !== "flow") {
+          throw new Error(`machine-wrap-up only resolves "flow" wrap-ups, got "${request.source}"`);
+        }
+        return resolved.resolution;
+      }
+    });
+    const { service: service4, authorizationServer } = createHarnessProposalLifecycleService(params.cwd, {
+      workspaceId: params.workspaceId,
+      now: params.now
+    });
+    const requestCorrelationId = randomUUID14();
+    const actor = await authorizationServer.actorContextFor(undefined, requestCorrelationId);
+    if (!actor)
+      throw new Error("trusted ActorContext is required for a machine wrap-up propose");
+    const provenance = await wrapUpAuthority.issue({ actor, source: "flow", sourceRef });
+    try {
+      const proposal = await service4.create({
+        request: undefined,
+        requestCorrelationId,
+        workspaceId: params.workspaceId,
+        id: proposalId,
+        proposalRevision: "1",
+        kind: params.kind,
+        wrapUp: provenance
+      });
+      return { kind: params.kind, outcome: "proposed", proposalId: proposal.id };
+    } catch (error2) {
+      if (error2 instanceof ProposalLifecycleError && error2.code === "conflict") {
+        return { kind: params.kind, outcome: "conflict" };
+      }
+      throw error2;
+    }
+  } catch (error2) {
+    const message2 = error2 instanceof Error ? error2.message : String(error2);
+    return { kind: params.kind, outcome: "error", message: message2 };
+  }
+}
+async function runWrapUp(input2) {
+  const now = input2.now ?? (() => new Date);
+  const grouped = groupSeedsByKind(input2.slate);
+  const nonEmptyKinds = [...grouped.keys()].filter((kind) => (grouped.get(kind)?.length ?? 0) > 0);
+  if (nonEmptyKinds.length === 0) {
+    return { groups: [] };
+  }
+  if (input2.slate.workspaceId === undefined) {
+    await writeUnboundCandidateArtifact(input2.dir, input2.trigger, now, grouped, nonEmptyKinds);
+    return { groups: nonEmptyKinds.map((kind) => ({ kind, outcome: "unbound-candidate" })) };
+  }
+  const workspaceId = input2.slate.workspaceId;
+  const groups = await Promise.all(nonEmptyKinds.map((kind) => proposeOneGroup({
+    cwd: input2.cwd,
+    workspaceId,
+    slate: input2.slate,
+    kind,
+    now,
+    ...input2.env !== undefined ? { env: input2.env } : {},
+    ...input2.providerFactory !== undefined ? { providerFactory: input2.providerFactory } : {},
+    ...input2.modelTurnTimeoutMs !== undefined ? { modelTurnTimeoutMs: input2.modelTurnTimeoutMs } : {}
+  })));
+  return { groups };
+}
+
+// src/commands/harness.ts
 init_shell_config();
 import { realpathSync as realpathSync3 } from "fs";
 import { homedir as homedir3, tmpdir as tmpdir2 } from "os";
@@ -41201,7 +41726,7 @@ function resolveRuntime(deps) {
   const env = deps?.env ?? process.env;
   const clock = deps?.clock ?? (() => new Date().toISOString());
   let idCounter = 0;
-  const idSeq = deps?.idSeq ?? (() => `${randomUUID14()}-${idCounter++}`);
+  const idSeq = deps?.idSeq ?? (() => `${randomUUID15()}-${idCounter++}`);
   return { env, clock, idSeq };
 }
 function shellAllowProfile() {
@@ -41225,12 +41750,23 @@ var denyingExecutor = {
     throw new Error(`no tool executor is configured for the harness CLI: ${invocation.call.toolName}`);
   }
 };
+var KNOWN_HARNESS_RUN_FLAGS = new Set([
+  "--provider",
+  "--model",
+  "--base-url",
+  "--record",
+  "--unattended",
+  "--goal",
+  "--workspace"
+]);
 function parseArgs2(args) {
   let provider = "";
   let model = "";
   let baseUrl;
   let record;
   let unattended;
+  let goal;
+  let workspace;
   const positional = [];
   for (let i = 1;i < args.length; i++) {
     const arg = args[i];
@@ -41244,17 +41780,27 @@ function parseArgs2(args) {
       record = args[++i];
     } else if (arg === "--unattended") {
       unattended = true;
+    } else if (arg === "--goal") {
+      const next = args[i + 1];
+      goal = next !== undefined && !KNOWN_HARNESS_RUN_FLAGS.has(next) ? args[++i] : undefined;
+    } else if (arg === "--workspace") {
+      const next = args[i + 1];
+      workspace = next !== undefined && !KNOWN_HARNESS_RUN_FLAGS.has(next) ? args[++i] : undefined;
     } else if (arg !== undefined) {
       positional.push(arg);
     }
   }
-  const parsed = { provider, model, prompt: positional.join(" ") };
+  const parsed = { provider, model, prompt: goal !== undefined && goal.length > 0 ? goal : positional.join(" ") };
   if (baseUrl !== undefined)
     parsed.baseUrl = baseUrl;
   if (record !== undefined)
     parsed.record = record;
   if (unattended !== undefined)
     parsed.unattended = unattended;
+  if (goal !== undefined)
+    parsed.goal = goal;
+  if (workspace !== undefined)
+    parsed.workspace = workspace;
   return parsed;
 }
 function toStructured(result) {
@@ -41288,16 +41834,27 @@ async function harnessCommand(args, deps) {
     console.log(USAGE);
     return;
   }
-  const { provider, model, baseUrl, prompt, record, unattended } = parseArgs2(args);
+  const { provider, model, baseUrl, prompt, record, unattended, workspace } = parseArgs2(args);
   const validProviders = new Set(HARNESS_PROVIDER_OPTIONS);
   if (!validProviders.has(provider) || prompt.length === 0) {
     console.log(USAGE);
     return;
   }
+  if (args.includes("--workspace") && (workspace === undefined || workspace.length === 0)) {
+    console.log('--workspace requires a value, e.g. keryx harness run --provider <p> --model <m> --workspace <id> "<prompt>". No run was started.');
+    return;
+  }
+  if (workspace !== undefined && workspace.length > 0) {
+    const resolved = await resolveWorkspaceForActor(process.cwd(), workspace);
+    if (!resolved.ok) {
+      console.log(`--workspace "${workspace}" was rejected (${resolved.error.code}): ${resolved.error.message}. No run was started.`);
+      return;
+    }
+  }
   const env = deps?.env ?? process.env;
   const clock = deps?.clock ?? (() => new Date().toISOString());
   let idCounter = 0;
-  const idSeq = deps?.idSeq ?? (() => `${randomUUID14()}-${idCounter++}`);
+  const idSeq = deps?.idSeq ?? (() => `${randomUUID15()}-${idCounter++}`);
   const fetchImpl = deps?.fetch ?? globalThis.fetch;
   if (provider === "anthropic") {
     const apiKey = env.ANTHROPIC_API_KEY;
@@ -41363,6 +41920,16 @@ async function harnessCommand(args, deps) {
     };
   }
   console.log(JSON.stringify(structured));
+  try {
+    const wrapUpDir = resolveOneShotWrapUpSessionDir(process.cwd(), idSeq);
+    const prior = await readSlate(wrapUpDir);
+    const wrapUpSlate = prior ?? { anchors: { root: process.cwd(), touched: [] }, course: {}, seeds: [] };
+    if (workspace !== undefined && workspace.length > 0)
+      wrapUpSlate.workspaceId = workspace;
+    await runWrapUp({ trigger: "process-termination", cwd: process.cwd(), dir: wrapUpDir, slate: wrapUpSlate });
+  } catch (error2) {
+    console.error(`harness run: wrap-up trigger failed (ignored): ${error2 instanceof Error ? error2.message : String(error2)}`);
+  }
 }
 function parseReplayArgs(args) {
   const parsed = { json: false };
@@ -41414,7 +41981,7 @@ function harnessReplay(args, deps) {
   }
   const clock = deps?.clock ?? (() => new Date().toISOString());
   let idCounter = 0;
-  const idSeq = deps?.idSeq ?? (() => `${randomUUID14()}-${idCounter++}`);
+  const idSeq = deps?.idSeq ?? (() => `${randomUUID15()}-${idCounter++}`);
   const fixture = (() => {
     if (parsed.fixture === undefined || parsed.fixture.length === 0) {
       return { ok: true, value: buildReplayFixture(run, { idSeq }), built: true };
@@ -41665,7 +42232,7 @@ async function harnessExec(args, deps) {
     env: commandEnv,
     cwd
   };
-  const worktreeRoot = path132.parse(path132.resolve(cwd, commandPath)).root || cwd;
+  const worktreeRoot = path134.parse(path134.resolve(cwd, commandPath)).root || cwd;
   const budget = {
     reservationId: idSeq(),
     maxRuntimeMs: maxRuntimeMs ?? EXEC_DEFAULT_RUNTIME_MS
@@ -41854,7 +42421,7 @@ function harnessWave(args, deps) {
 // src/commands/shell.ts
 init_make_provider();
 init_orient();
-import { randomUUID as randomUUID18 } from "crypto";
+import { randomUUID as randomUUID20 } from "crypto";
 import * as readline2 from "readline";
 
 // src/commands/agent-approval-context.ts
@@ -41896,6 +42463,9 @@ async function buildApprovalContext(port, command) {
 `);
 }
 
+// src/commands/interactive-agent-tools.ts
+import { randomUUID as randomUUID17 } from "crypto";
+
 // src/harness/tool/builtin/ask-user-tool.ts
 function createAskUserTool(ask) {
   return {
@@ -41988,7 +42558,7 @@ function createAskUserTool(ask) {
 }
 
 // src/harness/tool/builtin/interactive-tools.ts
-import { readdir as readdir21 } from "fs/promises";
+import { readdir as readdir22 } from "fs/promises";
 import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2, sep } from "path";
 import { realpathSync as realpathSync4 } from "fs";
 var MAX_READ_BYTES = 20000;
@@ -42040,7 +42610,7 @@ function builtinReadOnlyTools(root) {
         return { output: `path escapes the project root: ${requested}`, isError: true };
       }
       try {
-        const entries = await readdir21(target, { withFileTypes: true });
+        const entries = await readdir22(target, { withFileTypes: true });
         const lines = entries.map((e) => e.isDirectory() ? `${e.name}/` : e.name).sort();
         return { output: lines.length > 0 ? lines.join(`
 `) : "(empty)", isError: false };
@@ -42189,13 +42759,13 @@ function builtinMetaprojectTools(root, run = makeKeryxRunner(root), port) {
       if ("error" in pattern) {
         return pattern.error;
       }
-      const path133 = typeof input2.path === "string" && input2.path.length > 0 ? input2.path : undefined;
+      const path135 = typeof input2.path === "string" && input2.path.length > 0 ? input2.path : undefined;
       const args = ["ctx", "rg", pattern.value];
-      if (path133 !== undefined) {
-        const confined = confineToRoot(root, path133);
+      if (path135 !== undefined) {
+        const confined = confineToRoot(root, path135);
         if (confined === null) {
           return {
-            output: `search_code: path escapes the project root: ${path133}`,
+            output: `search_code: path escapes the project root: ${path135}`,
             isError: true
           };
         }
@@ -42485,6 +43055,100 @@ function shellExecTool(root, run = makeCommandRunner(root)) {
   };
 }
 
+// src/harness/tool/builtin/slate-tool.ts
+init_redact();
+var SEED_TEXT_MAX_LENGTH = 4000;
+var SLATE_SEED_KINDS = [
+  "decision",
+  "wiki-update",
+  "memory-entry",
+  "follow-up",
+  "contract-change",
+  "risk"
+];
+function isSlateSeedKind(value) {
+  return typeof value === "string" && SLATE_SEED_KINDS.includes(value);
+}
+function slateReadTool(cwd, getSessionDir) {
+  return {
+    definition: {
+      name: "slate_read",
+      description: "Read this session's Slate: the live Course projection (derived from the bound Flow, if any) and the Seeds recorded so far (draft hypotheses, not yet accepted). Input: {} (no arguments). Course/Seeds are NEVER auto-injected into the conversation \u2014 this tool is the only way to see them.",
+      inputSchema: { type: "object", properties: {}, additionalProperties: false },
+      risk: "read"
+    },
+    invoke: async () => {
+      const dir = getSessionDir();
+      if (dir === undefined) {
+        return { output: "slate_read: no active session in this run", isError: true };
+      }
+      try {
+        const slate = await readSlate(dir);
+        const course = await courseFromSlate(cwd, slate);
+        return {
+          output: JSON.stringify({ course, seeds: slate?.seeds ?? [], workspaceId: slate?.workspaceId }, null, 2),
+          isError: false
+        };
+      } catch (cause) {
+        return {
+          output: `slate_read failed: ${cause instanceof Error ? cause.message : String(cause)}`,
+          isError: true
+        };
+      }
+    }
+  };
+}
+function slateWriteSeedTool(getSessionDir, idSeq, clock) {
+  return {
+    definition: {
+      name: "slate_write_seed",
+      description: "Record a Seed: a draft hypothesis, decision, or follow-up worth surfacing to a later review \u2014 never accepted project knowledge by itself. Input: { text: string, kind?: 'decision'|'wiki-update'|'memory-entry'|'follow-up'|'contract-change'|'risk' }.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          text: { type: "string", maxLength: SEED_TEXT_MAX_LENGTH },
+          kind: { type: "string", enum: [...SLATE_SEED_KINDS] }
+        },
+        required: ["text"],
+        additionalProperties: false
+      },
+      risk: "read"
+    },
+    invoke: async (input2) => {
+      const rawText = typeof input2.text === "string" ? input2.text : undefined;
+      const text = rawText?.trim();
+      if (text === undefined || text.length === 0) {
+        return { output: "slate_write_seed requires a non-empty 'text'", isError: true };
+      }
+      let kind;
+      if (input2.kind !== undefined) {
+        if (!isSlateSeedKind(input2.kind)) {
+          return {
+            output: `slate_write_seed: unrecognized 'kind': ${JSON.stringify(input2.kind)}`,
+            isError: true
+          };
+        }
+        kind = input2.kind;
+      }
+      const dir = getSessionDir();
+      if (dir === undefined) {
+        return { output: "slate_write_seed: no active session in this run", isError: true };
+      }
+      try {
+        const redactedText = redactSensitiveText(text);
+        const seed = { id: idSeq(), text: redactedText, ts: clock(), ...kind !== undefined ? { kind } : {} };
+        await appendSeed(dir, seed);
+        return { output: JSON.stringify({ appended: seed }, null, 2), isError: false };
+      } catch (cause) {
+        return {
+          output: `slate_write_seed failed: ${cause instanceof Error ? cause.message : String(cause)}`,
+          isError: true
+        };
+      }
+    }
+  };
+}
+
 // src/harness/web/sandboxed-web-transport.ts
 import { lookup as systemLookup } from "dns/promises";
 
@@ -42936,7 +43600,7 @@ function webSearchTool(service4) {
 }
 
 // src/harness/tool/builtin/workspace-context-tool.ts
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 function parseBudget(input2, defaultMaxItems) {
   const maxItems = input2.maxItems === undefined ? defaultMaxItems : input2.maxItems;
   const maxTokens = input2.maxTokens === undefined ? 4096 : input2.maxTokens;
@@ -42966,7 +43630,7 @@ function workspaceOverviewTool(cwd) {
       const budget = parseBudget(input2, 32);
       if ("error" in budget)
         return { output: budget.error, isError: true };
-      const result = await createLocalFwkReadService(cwd).overview({ workspaceId, request: undefined, requestCorrelationId: randomUUID15(), budget });
+      const result = await createLocalFwkReadService(cwd).overview({ workspaceId, request: undefined, requestCorrelationId: randomUUID16(), budget });
       return { output: JSON.stringify(normalizeFwkResult(result), null, 2), isError: false };
     }
   };
@@ -42994,7 +43658,7 @@ function workspaceReadTool(cwd) {
       const budget = parseBudget(input2, 1);
       if ("error" in budget)
         return { output: budget.error, isError: true };
-      const result = await createLocalFwkReadService(cwd).read({ workspaceId, itemId, request: undefined, requestCorrelationId: randomUUID15(), budget });
+      const result = await createLocalFwkReadService(cwd).read({ workspaceId, itemId, request: undefined, requestCorrelationId: randomUUID16(), budget });
       return { output: JSON.stringify(normalizeFwkResult(result), null, 2), isError: false };
     }
   };
@@ -43014,6 +43678,11 @@ async function invokeAskUserHost(request) {
 
 // src/commands/interactive-agent-tools.ts
 function buildInteractiveAgentTools(input2) {
+  const getSessionDir = input2.getSessionDir ?? (() => {
+    return;
+  });
+  const idSeq = input2.idSeq ?? (() => randomUUID17());
+  const clock = input2.clock ?? (() => new Date().toISOString());
   return [
     ...builtinReadOnlyTools(input2.cwd),
     ...builtinMetaprojectTools(input2.cwd, makeKeryxRunner(input2.cwd), input2.metaprojectPort),
@@ -43023,6 +43692,8 @@ function buildInteractiveAgentTools(input2) {
     workspaceOverviewTool(input2.cwd),
     workspaceReadTool(input2.cwd),
     createAskUserTool(invokeAskUserHost),
+    slateReadTool(input2.cwd, getSessionDir),
+    slateWriteSeedTool(getSessionDir, idSeq, clock),
     input2.spawnTool
   ];
 }
@@ -43031,7 +43702,7 @@ function buildInteractiveAgentTools(input2) {
 init_config_dir();
 init_shell_config();
 import { existsSync as existsSync24 } from "fs";
-import path133 from "path";
+import path135 from "path";
 
 // src/lib/shell-syntax.ts
 var METACHARACTERS = new Set([";", "&", "|", "<", ">", `
@@ -43344,7 +44015,7 @@ function touchesAgentCredentials(command) {
 }
 
 // src/lib/shell-permissions.ts
-import { createHash as createHash27 } from "crypto";
+import { createHash as createHash28 } from "crypto";
 var PREFIX_BANNED = new Set([
   "sh",
   "bash",
@@ -43523,7 +44194,7 @@ function emptyShellPermissions() {
   return { allow: [] };
 }
 function shellPermissionsPath(dir) {
-  return path133.join(path133.dirname(shellConfigPath(dir)), "permissions.json");
+  return path135.join(path135.dirname(shellConfigPath(dir)), "permissions.json");
 }
 function loadShellPermissionsWithAudit(dir) {
   try {
@@ -43561,7 +44232,7 @@ function loadShellPermissions(dir) {
 function saveShellPermissions(perms, dir, options = {}) {
   try {
     const file = shellPermissionsPath(dir);
-    ensureKeryxConfigDir(path133.dirname(file));
+    ensureKeryxConfigDir(path135.dirname(file));
     const cleaned = Array.from(new Set(perms.allow.map((p) => p.trim()).filter((p) => p.length > 0)));
     const body = {
       allow: options.skipValidation === true ? cleaned : cleaned.filter((p) => validateShellPattern(p).ok)
@@ -43636,7 +44307,7 @@ function shellPermissionsFingerprint(dir) {
     if (!read.ok) {
       return "";
     }
-    return createHash27("sha256").update(read.text, "utf8").digest("hex");
+    return createHash28("sha256").update(read.text, "utf8").digest("hex");
   } catch {
     return "";
   }
@@ -43870,12 +44541,12 @@ function remoteRequest(providerId, endpoint, query, key) {
 // src/lib/search-config.ts
 init_config_dir();
 import { existsSync as existsSync25 } from "fs";
-import path134 from "path";
+import path136 from "path";
 function searchConfigPath(dir) {
-  return path134.join(keryxConfigDir(dir), "search-providers.json");
+  return path136.join(keryxConfigDir(dir), "search-providers.json");
 }
 function searchCredentialPath(dir) {
-  return path134.join(keryxConfigDir(dir), "search-credentials.json");
+  return path136.join(keryxConfigDir(dir), "search-credentials.json");
 }
 function readJson(file) {
   try {
@@ -44001,7 +44672,10 @@ function createDefaultSearchProviderController(configDir) {
   return new SearchProviderController(registry, configDir);
 }
 // src/harness/tool/builtin/spawn-subagent-tool.ts
-import { createHash as createHash28, randomUUID as randomUUID16 } from "crypto";
+import { createHash as createHash29, randomUUID as randomUUID18 } from "crypto";
+import { mkdtemp, rm as rm8 } from "fs/promises";
+import { tmpdir as tmpdir4 } from "os";
+import path138 from "path";
 
 // src/harness/child/ledger.ts
 function decrement(remaining, reservation) {
@@ -44315,85 +44989,13 @@ function foldChildSummary(summary) {
 init_validator();
 init_redact();
 
-// src/session/slate.ts
-init_fs();
-import { mkdir as mkdir52, readFile as readFile74, rm as rm7 } from "fs/promises";
-import path135 from "path";
-function slatePath(dir) {
-  return path135.join(dir, "slate.json");
-}
-function slateLockPath(dir) {
-  return `${slatePath(dir)}.lock`;
-}
-async function readSlate(dir) {
-  try {
-    const raw = await readFile74(slatePath(dir), "utf8");
-    return JSON.parse(raw);
-  } catch (error2) {
-    if (isNotFound(error2))
-      return;
-    throw error2;
-  }
-}
-async function archiveSlate(dir, attemptId) {
-  if (!/^[A-Za-z0-9._-]+$/.test(attemptId))
-    throw new Error(`invalid attemptId: ${JSON.stringify(attemptId)}`);
-  await mkdir52(dir, { recursive: true });
-  return withFileLock2(slateLockPath(dir), () => archiveIfExistsLocked(dir, attemptId));
-}
-async function archiveIfExistsLocked(dir, attemptId) {
-  let raw;
-  try {
-    raw = await readFile74(slatePath(dir), "utf8");
-  } catch (error2) {
-    if (isNotFound(error2))
-      return;
-    throw error2;
-  }
-  const archiveDir = path135.join(dir, "slate-archive");
-  await mkdir52(archiveDir, { recursive: true });
-  await writeFileAtomic(path135.join(archiveDir, `${attemptId}.json`), raw);
-  await rm7(slatePath(dir), { force: true });
-}
-async function openSlateAtomic(dir, mintAttemptId, build) {
-  await mkdir52(dir, { recursive: true });
-  return withFileLock2(slateLockPath(dir), async () => {
-    const existing = await readSlate(dir);
-    if (existing !== undefined) {
-      await archiveIfExistsLocked(dir, mintAttemptId());
-    }
-    const next = build();
-    await writeFileAtomic(slatePath(dir), `${JSON.stringify(next, null, 2)}
-`);
-    return next;
-  });
-}
-
-// src/session/slate-course.ts
-init_store2();
-var unbound = { state: "unbound" };
-async function readCourse(cwd, flowRef) {
-  if (!flowRef)
-    return unbound;
-  try {
-    const dir = await resolveFlowDir(cwd, flowRef);
-    const flow = await readFlow(cwd, dir);
-    return { state: "bound", ...deriveFlowWork(flow, flowRef) };
-  } catch {
-    return unbound;
-  }
-}
-async function courseFromSlate(cwd, slate) {
-  return readCourse(cwd, slate?.course.flowRef);
-}
-
 // src/session/slate-lifecycle.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFileAsync2 = promisify2(execFile2);
 async function resolveTree(root) {
   try {
-    const { stdout: stdout2 } = await execFileAsync("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: root });
+    const { stdout: stdout2 } = await execFileAsync2("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: root });
     const branch = stdout2.trim();
     return branch.length > 0 ? branch : undefined;
   } catch {
@@ -44503,12 +45105,80 @@ function isClosePhrase(text) {
     return true;
   });
 }
+async function recordSlateTouch(dir, touched, extra) {
+  let changed = false;
+  const slate = await writeSlate(dir, (prev) => {
+    if (!prev)
+      throw new Error(`recordSlateTouch: no open slate in ${dir}`);
+    const existing = new Set(prev.anchors.touched);
+    const additions = touched.filter((entry) => !existing.has(entry));
+    const treeChanged = extra?.tree !== undefined && extra.tree !== prev.anchors.tree;
+    const runtimeChanged = extra?.runtime !== undefined && (prev.anchors.runtime === undefined || prev.anchors.runtime.provider !== extra.runtime.provider || prev.anchors.runtime.model !== extra.runtime.model);
+    changed = additions.length > 0 || treeChanged || runtimeChanged;
+    if (!changed) {
+      return prev;
+    }
+    const nextAnchors = {
+      ...prev.anchors,
+      touched: additions.length > 0 ? [...prev.anchors.touched, ...additions] : prev.anchors.touched
+    };
+    if (extra?.tree !== undefined)
+      nextAnchors.tree = extra.tree;
+    if (extra?.runtime !== undefined)
+      nextAnchors.runtime = extra.runtime;
+    return { ...prev, anchors: nextAnchors };
+  });
+  return { changed, slate };
+}
 var timestampMintCounter = 0;
 function mintTimestampAttemptId(now = new Date) {
   timestampMintCounter += 1;
   return `${now.toISOString().replace(/:/g, "-")}-${timestampMintCounter}`;
 }
 
+// src/session/slate-terminal-state.ts
+init_fs();
+init_repomap();
+init_redact();
+import path137 from "path";
+var DEFAULT_TERMINAL_STATE_MAX_TOKENS = 2000;
+function boundedRedactedAnchorsSnapshot(anchors, maxTokens) {
+  const fence = anchors.fence?.map((entry) => redactSensitiveText(entry));
+  const base = {
+    root: anchors.root,
+    ...anchors.tree !== undefined ? { tree: anchors.tree } : {},
+    ...anchors.runtime !== undefined ? { runtime: anchors.runtime } : {},
+    ...fence !== undefined ? { fence } : {},
+    touched: []
+  };
+  const baseTokens = estimateTokens(JSON.stringify(base));
+  const touchedBudget = Math.max(0, maxTokens - baseTokens);
+  const touched = redactAndBoundTouched(anchors.touched, touchedBudget, {
+    traceRef: "slate-terminal-state-anchors",
+    configurationRevision: "slate-terminal-state-anchors-v1",
+    policyRef: "slate-terminal-state-anchors",
+    policyRevision: "v1"
+  });
+  return { ...base, touched };
+}
+function renderTerminalStateBlock(state, opts) {
+  const maxTokens = opts?.maxTokens ?? DEFAULT_TERMINAL_STATE_MAX_TOKENS;
+  const anchorsSnapshot = boundedRedactedAnchorsSnapshot(state.anchorsSnapshot, maxTokens);
+  return [
+    "KERYX_TERMINAL_STATE",
+    `status: ${state.status}`,
+    `reason: ${state.reason}`,
+    `occurredAt: ${state.occurredAt}`,
+    `courseSnapshot: ${JSON.stringify(state.courseSnapshot)}`,
+    `anchorsSnapshot: ${JSON.stringify(anchorsSnapshot)}`
+  ].join(`
+`);
+}
+async function writeTerminalState(dir, state) {
+  await writeFileAtomic(path137.join(dir, "terminal-state.json"), `${JSON.stringify(state, null, 2)}
+`);
+}
+
 // src/commands/agent.ts
 var DEFAULT_MAX_TOOL_CALLS = 48;
 var ENV_AGENT_MAX_TOOL_CALLS = "KERYX_AGENT_MAX_TOOL_CALLS";
@@ -44692,6 +45362,25 @@ function parseToolInput(raw) {
     return {};
   }
 }
+function extractTouchedFromToolInput(name, input2) {
+  const pathLikeFields = ["path", "file", "dir", "target"];
+  const out = [];
+  for (const field3 of pathLikeFields) {
+    const value = input2[field3];
+    if (typeof value === "string" && value.trim().length > 0) {
+      out.push(value.trim());
+    }
+  }
+  if (name === "spawn_subagent") {
+    const label = typeof input2.label === "string" ? input2.label.trim() : "";
+    const task = typeof input2.task === "string" ? input2.task.trim() : "";
+    const marker2 = label.length > 0 ? label : task.length > 0 ? task.slice(0, 40) : "";
+    if (marker2.length > 0) {
+      out.push(`subagent:${marker2}`);
+    }
+  }
+  return out;
+}
 function stableStringify2(value) {
   if (value === null || typeof value !== "object") {
     return JSON.stringify(value);
@@ -44766,6 +45455,46 @@ function reserveToolAttempt(state, name, input2, risk) {
   state.attempts.set(hash2, attempt);
   return { ok: true, hash: hash2, attempt, chargedNew: isNew };
 }
+async function resolveTerminalStateSnapshots(options) {
+  const ref = options.slateSession;
+  if (ref !== undefined && ref.opened) {
+    try {
+      const slate = await readSlate(ref.dir);
+      if (slate !== undefined) {
+        return { courseSnapshot: slate.course, anchorsSnapshot: slate.anchors };
+      }
+    } catch {}
+  }
+  return { courseSnapshot: {}, anchorsSnapshot: { root: "", touched: [] } };
+}
+async function emitTerminalState(io, deps, options, reason) {
+  const { courseSnapshot, anchorsSnapshot } = await resolveTerminalStateSnapshots(options);
+  const now = deps.now ?? (() => new Date().toISOString());
+  const state = {
+    status: "blocked",
+    reason,
+    courseSnapshot,
+    anchorsSnapshot,
+    occurredAt: now()
+  };
+  io.onTerminalState?.(state);
+  const ref = options.slateSession;
+  if (ref !== undefined && ref.opened) {
+    try {
+      await writeTerminalState(ref.dir, state);
+    } catch {}
+  }
+  const block = renderTerminalStateBlock(state);
+  if (io.onSystem !== undefined) {
+    io.onSystem(`
+${block}
+`);
+  } else {
+    io.write(`
+${block}
+`);
+  }
+}
 async function runAgentTurn(io, deps, history, userLine, options = {}) {
   try {
     await runAgentTurnCore(io, deps, history, userLine, options);
@@ -44810,13 +45539,21 @@ async function runAgentTurnCore(io, deps, history, userLine, options = {}) {
   const actionRequest = isActionRequest(userLine);
   if (options.slateSession !== undefined) {
     try {
-      if (isClosePhrase(userLine)) {
+      if (options.skipCloseTrigger !== true && isClosePhrase(userLine)) {
         await closeSlateSession(options.slateSession, () => deps.idSeq());
       } else if (actionRequest) {
+        const wasOpened = options.slateSession.opened;
         await ensureSlateOpened(options.slateSession, () => deps.idSeq(), {
           provider: deps.providerId,
           model: deps.modelId
         });
+        if (!wasOpened && options.slateSession.opened) {
+          const freshSlate = await readSlate(options.slateSession.dir);
+          if (freshSlate !== undefined) {
+            history.push({ role: "user", content: renderAnchorsBlock(freshSlate.anchors), provenance: "project" });
+            io.onHistoryChange?.("tool");
+          }
+        }
       }
     } catch (err) {
       io.onSystem?.(`slate open/close check failed (ignored): ${err instanceof Error ? err.message : String(err)}
@@ -44984,6 +45721,10 @@ async function runAgentTurnCore(io, deps, history, userLine, options = {}) {
 `);
         return;
       }
+      if (deps.unattended === true && call.name === "ask_user") {
+        await emitTerminalState(io, deps, options, "ask_user_unanswerable");
+        return;
+      }
       if (untrustedContentSeen || batchContainsUntrustedWeb && call.name !== "web_fetch" && call.name !== "web_search") {
         const result2 = {
           output: "tool blocked: external web content cannot authorize further tool calls in this turn",
@@ -45026,6 +45767,21 @@ ${modelOutput}` : modelOutput,
       if (result.untrusted === true && !result.isError) {
         untrustedContentSeen = true;
       }
+      if (options.slateSession !== undefined && options.slateSession.opened === true) {
+        try {
+          const touchedPaths = extractTouchedFromToolInput(call.name, parseToolInput(call.input));
+          const touch = await recordSlateTouch(options.slateSession.dir, touchedPaths, {
+            runtime: { provider: deps.providerId, model: deps.modelId }
+          });
+          if (touch.changed) {
+            history.push({ role: "user", content: renderAnchorsBlock(touch.slate.anchors), provenance: "project" });
+            io.onHistoryChange?.("tool");
+          }
+        } catch (err) {
+          io.onSystem?.(`slate touch update failed (ignored): ${err instanceof Error ? err.message : String(err)}
+`);
+        }
+      }
       const shortIn = call.input.length > 80 ? `${call.input.slice(0, 77)}\u2026` : call.input;
       const riskUsage = risk === "read" ? `, read ${readBudgetUsed(budget)}/${maxReadToolCalls}` : `, non-read ${nonReadBudgetUsed(budget)}/${maxNonReadToolCalls}`;
       toolLog.push(`${call.name}(${shortIn}) \u2192 ${result.isError ? "error" : "ok"} [attempt ${reservation.attempt}/${maxAttempts}, unique ${budgetUsed(budget)}/${maxToolCalls}${riskUsage}]`);
@@ -45050,6 +45806,10 @@ ${hint}
     }
     const noProgress = !executedAny && calls.length > 0;
     if (exhaustedBudget !== undefined || noProgress) {
+      if (deps.unattended === true) {
+        await emitTerminalState(io, deps, options, "budget_exhausted");
+        return;
+      }
       await finishWithBudgetSummary(io, deps, history, parentRunId, {
         maxUnique: maxToolCalls,
         maxAttempts,
@@ -45206,6 +45966,7 @@ function emitSubagentFleet(event) {
 }
 
 // src/harness/tool/builtin/spawn-subagent-tool.ts
+init_fs();
 var MAX_CHILD_SUMMARY_CHARS = 16000;
 var ENV_SUBAGENT_TIMEOUT_MS = "KERYX_SUBAGENT_TIMEOUT_MS";
 function resolveSubagentTimeoutMs(reservationMs, env = process.env) {
@@ -45230,13 +45991,13 @@ function boundSummary(text) {
   return `${text.slice(0, MAX_CHILD_SUMMARY_CHARS)}
 \u2026(truncated: ${dropped} more characters from the subagent)`;
 }
-function sha2568(text) {
-  return createHash28("sha256").update(text).digest("hex");
+function sha2569(text) {
+  return createHash29("sha256").update(text).digest("hex");
 }
 var parentShellPolicy = shellParentProfile;
 var childReadOnlyPolicy = shellChildReadOnlyProfile;
 function createSpawnSubagentTool(deps) {
-  const idSeq = deps.idSeq ?? (() => randomUUID16());
+  const idSeq = deps.idSeq ?? (() => randomUUID18());
   const clock = deps.clock ?? (() => new Date().toISOString());
   const parentRunId = deps.parentRunId ?? idSeq();
   const parentSessionId = deps.parentSessionId ?? idSeq();
@@ -45281,7 +46042,7 @@ function createSpawnSubagentTool(deps) {
         parentRunId,
         parentSessionId,
         parentProvenance,
-        contextManifestHash: sha2568(`${parentRunId}:${parentSessionId}`),
+        contextManifestHash: sha2569(`${parentRunId}:${parentSessionId}`),
         canonicalContractVersion: "1.0.0",
         parentModel: { providerId: parent.providerId, modelId: parent.modelId },
         parentPolicy: parentShellPolicy(),
@@ -45292,7 +46053,7 @@ function createSpawnSubagentTool(deps) {
       const attemptId = idSeq();
       const branchId = idSeq();
       const reservationId = idSeq();
-      const artifactHash = sha2568(task);
+      const artifactHash = sha2569(task);
       const spawned = spawnSubagent({
         attempt: { attemptId, number: childSeq },
         branchId,
@@ -45343,7 +46104,32 @@ function createSpawnSubagentTool(deps) {
         ...builtinReadOnlyTools(cwd),
         ...builtinMetaprojectTools(cwd, makeKeryxRunner(cwd), createMetaprojectAdapter(cwd))
       ];
-      const provider = deps.makeProvider(runModel.provider, runModel.model, parent.baseUrl);
+      let ephemeralDir;
+      let openedChildSlate;
+      let dispatchId = "";
+      let closing = false;
+      try {
+        ephemeralDir = await mkdtemp(path138.join(tmpdir4(), "keryx-subagent-slate-"));
+        dispatchId = path138.basename(ephemeralDir);
+        openedChildSlate = await openSlate({
+          dir: ephemeralDir,
+          cwd,
+          mintAttemptId: () => idSeq(),
+          runtime: { provider: runModel.provider, model: runModel.model }
+        });
+        tools.push(slateWriteSeedTool(() => closing ? undefined : ephemeralDir, idSeq, clock));
+      } catch {
+        openedChildSlate = undefined;
+      }
+      let provider;
+      try {
+        provider = deps.makeProvider(runModel.provider, runModel.model, parent.baseUrl);
+      } catch (cause) {
+        if (ephemeralDir !== undefined) {
+          await rm8(ephemeralDir, { recursive: true, force: true }).catch(() => {});
+        }
+        throw cause;
+      }
       const childDeps = {
         provider,
         providerId: runModel.provider,
@@ -45417,8 +46203,63 @@ function createSpawnSubagentTool(deps) {
           maxToolCalls: childToolCalls
         });
       };
+      const foldChildSlateAndCleanup = async (status) => {
+        closing = true;
+        if (ephemeralDir === undefined) {
+          return;
+        }
+        const dirToClean = ephemeralDir;
+        try {
+          await withFileLock2(slateLockPath(dirToClean), async () => {
+            try {
+              const slateSession = deps.getSlateSession?.();
+              if (openedChildSlate !== undefined && slateSession !== undefined) {
+                try {
+                  const childSlate = await readSlate(dirToClean);
+                  const dispatch = {
+                    anchors: childSlate?.anchors ?? openedChildSlate.anchors,
+                    course: childSlate?.course ?? openedChildSlate.course,
+                    seeds: childSlate?.seeds ?? [],
+                    status
+                  };
+                  const parentDir = slateSession.dir;
+                  await writeSlate(parentDir, (prev) => {
+                    if (prev === undefined) {
+                      throw new Error(`foldChildSlateAndCleanup: no open parent slate in ${parentDir}`);
+                    }
+                    return {
+                      ...prev,
+                      childDispatches: { ...prev.childDispatches ?? {}, [dispatchId]: dispatch }
+                    };
+                  });
+                } catch (foldCause) {
+                  const foldMsg = foldCause instanceof Error ? foldCause.message : String(foldCause);
+                  emitSubagentFleet({
+                    kind: "log",
+                    id: workerId,
+                    entry: { kind: "system", text: `slate fold failed (ignored): ${foldMsg}` }
+                  });
+                }
+              }
+            } finally {
+              await rm8(dirToClean, { recursive: true, force: true }).catch(() => {});
+            }
+          });
+        } catch (lockCause) {
+          const lockMsg = lockCause instanceof Error ? lockCause.message : String(lockCause);
+          emitSubagentFleet({
+            kind: "log",
+            id: workerId,
+            entry: { kind: "system", text: `slate cleanup lock failed (ignored): ${lockMsg}` }
+          });
+          await rm8(dirToClean, { recursive: true, force: true }).catch(() => {});
+        }
+      };
       try {
         const history = [];
+        if (openedChildSlate !== undefined) {
+          history.push({ role: "user", content: renderAnchorsBlock(openedChildSlate.anchors), provenance: "project" });
+        }
         const userLine = `## Subagent task (${mode})
 ` + `${task}
 
@@ -45442,6 +46283,7 @@ function createSpawnSubagentTool(deps) {
             turn.catch(() => {});
             releaseBudget();
             emitSubagentFleet({ kind: "upsert", id: workerId, label, status: "failed", detail: "timeout", task });
+            await foldChildSlateAndCleanup("incomplete");
             const partial = assistant.trim();
             return {
               output: `subagent ${label} (${workerId}) timed out after ${deadlineMs}ms and was abandoned ` + `(tighten or disable with ${ENV_SUBAGENT_TIMEOUT_MS})` + (partial.length > 0 ? `
@@ -45467,6 +46309,7 @@ ${boundSummary(partial)}` : ""),
           model: `${runModel.provider}/${runModel.model}`,
           task
         });
+        await foldChildSlateAndCleanup("completed");
         return {
           output: `subagent ${label} (${workerId}) ${mode} via ${runModel.provider}/${runModel.model}
 ` + `MAE reservation: tools\u2264${spawned.reservation.maxToolCalls ?? maxToolCalls} ` + `runtime\u2264${spawned.reservation.maxRuntimeMs}ms children=${ledger.childCount}
@@ -45487,6 +46330,7 @@ ${boundSummary(folded.text)}`,
           detail: "error",
           task
         });
+        await foldChildSlateAndCleanup("incomplete");
         return { output: `subagent ${label} failed: ${msg}`, isError: true };
       }
     }
@@ -45497,12 +46341,12 @@ ${boundSummary(folded.text)}`,
 import { homedir as homedir6 } from "os";
 var ESC = "\x1B";
 var CSI = `${ESC}[`;
-function collapseHome(path136) {
+function collapseHome(path139) {
   const home = homedir6();
-  if (home.length > 0 && (path136 === home || path136.startsWith(`${home}/`))) {
-    return `~${path136.slice(home.length)}`;
+  if (home.length > 0 && (path139 === home || path139.startsWith(`${home}/`))) {
+    return `~${path139.slice(home.length)}`;
   }
-  return path136;
+  return path139;
 }
 
 // src/lib/live-render.ts
@@ -45605,12 +46449,85 @@ class LiveMarkdownBlock {
   }
 }
 
+// src/commands/goal-command.ts
+function parseGoalArgs(rest) {
+  const trimmed = rest.trim();
+  if (trimmed.length === 0) {
+    return { error: "a goal <text> is required, e.g. /goal implement the login flow [--workspace <id>]" };
+  }
+  const tokens = trimmed.split(/\s+/);
+  const lastToken = tokens[tokens.length - 1];
+  const secondLastToken = tokens[tokens.length - 2];
+  let workspaceId;
+  let textTokens = tokens;
+  if (lastToken === "--workspace") {
+    return { error: "--workspace requires a value, e.g. /goal <text> --workspace <id>" };
+  }
+  if (secondLastToken === "--workspace") {
+    workspaceId = lastToken;
+    textTokens = tokens.slice(0, tokens.length - 2);
+  }
+  const text = textTokens.join(" ").trim();
+  if (text.length === 0) {
+    return { error: "a goal <text> is required, e.g. /goal implement the login flow [--workspace <id>]" };
+  }
+  return workspaceId !== undefined ? { text, workspaceId } : { text };
+}
+function systemLine(io, text) {
+  if (io.onSystem !== undefined) {
+    io.onSystem(text);
+  } else {
+    io.write(text);
+  }
+}
+async function runGoalCommand(params) {
+  const { raw, cwd, io, deps, history, slateSession, mintAttemptId } = params;
+  const parsed = parseGoalArgs(raw);
+  if ("error" in parsed) {
+    systemLine(io, `/goal: ${parsed.error}
+`);
+    return;
+  }
+  if (parsed.workspaceId !== undefined) {
+    const resolved = await resolveWorkspaceForActor(cwd, parsed.workspaceId);
+    if (!resolved.ok) {
+      systemLine(io, `/goal: --workspace "${parsed.workspaceId}" was rejected (${resolved.error.code}): ${resolved.error.message}. ` + `The slate was not opened and the goal was not run.
+`);
+      return;
+    }
+  }
+  if (slateSession !== undefined) {
+    try {
+      const wasOpened = slateSession.opened;
+      await ensureSlateOpened(slateSession, mintAttemptId, { provider: deps.providerId, model: deps.modelId });
+      if (!wasOpened && slateSession.opened) {
+        const freshSlate = await readSlate(slateSession.dir);
+        if (freshSlate !== undefined) {
+          history.push({ role: "user", content: renderAnchorsBlock(freshSlate.anchors), provenance: "project" });
+          io.onHistoryChange?.("tool");
+        }
+      }
+      if (parsed.workspaceId !== undefined) {
+        const workspaceId = parsed.workspaceId;
+        await writeSlate(slateSession.dir, (prev) => {
+          const base = prev ?? { anchors: { root: "", touched: [] }, course: {}, seeds: [] };
+          return { ...base, workspaceId };
+        });
+      }
+    } catch (err) {
+      systemLine(io, `/goal: slate bookkeeping failed (ignored): ${err instanceof Error ? err.message : String(err)}
+`);
+    }
+  }
+  await runAgentTurn(io, deps, history, parsed.text, slateSession !== undefined ? { slateSession, skipCloseTrigger: true } : {});
+}
+
 // src/tui/tui-shell.ts
 import { spawnSync as spawnSync2 } from "child_process";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.38",
+  version: "0.2.39",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -46135,7 +47052,7 @@ function openFlows(otui, chrome, options) {
 
 // src/tui/inspector-sources.ts
 init_store2();
-import { randomUUID as randomUUID17 } from "crypto";
+import { randomUUID as randomUUID19 } from "crypto";
 function workspaceFromManifest(manifest) {
   return {
     id: manifest.id,
@@ -46205,7 +47122,7 @@ async function loadInspectorWorkspaces(cwd) {
         policyRevision: "local-offline-v1"
       }
     });
-    const listed = await service4.list({ request: undefined, requestCorrelationId: randomUUID17() });
+    const listed = await service4.list({ request: undefined, requestCorrelationId: randomUUID19() });
     return listed.map(workspaceFromManifest);
   } catch {
     return [];
@@ -46563,6 +47480,11 @@ var AGENT_SLASH_COMMANDS = [
     modes: AGENT_ONLY
   },
   { name: "/new", description: "Start a new session (old kept on disk)", modes: BOTH },
+  {
+    name: "/goal",
+    description: "Deterministically start a goal \u2014 /goal <text> [--workspace <id>]",
+    modes: AGENT_ONLY
+  },
   { name: "/resume", description: "Resume a prior session in this project", modes: AGENT_ONLY },
   { name: "/sessions", description: "Open the session list and switch to one", modes: AGENT_ONLY },
   {
@@ -46839,7 +47761,7 @@ function showComposerChoice(otui, r, dock, request) {
 // src/lib/version-check.ts
 init_config_dir();
 init_fs();
-import path136 from "path";
+import path139 from "path";
 var REGISTRY_URL = "https://registry.npmjs.org/@mrciphersmith%2Fkeryx/latest";
 var FIXED_INSTALL_COMMAND = "npm install -g @mrciphersmith/keryx@latest";
 var RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
@@ -47041,7 +47963,7 @@ async function checkVersion(options) {
   const now = options.now ?? Date.now;
   const timestamp = now();
   const configDir = ensureKeryxConfigDir(options.cacheDir);
-  const cacheFile = path136.join(configDir, "version-check.json");
+  const cacheFile = path139.join(configDir, "version-check.json");
   const cache = parseCache(cacheFile);
   if (cache?.latestVersion !== undefined && cache.successAt !== undefined && timestamp - cache.successAt >= 0 && timestamp - cache.successAt < SUCCESS_CACHE_TTL_MS) {
     return resultFor(options.currentVersion, current, cache.latestVersion, "cache");
@@ -49252,6 +50174,22 @@ async function pickShellApproval(otui, r, dock, command, loadContext2, destructi
   }
   return "deny";
 }
+async function applyRuntimeSwitchToSlate(params) {
+  if (params.slateSession === undefined || !params.slateSession.opened) {
+    return false;
+  }
+  const result = await recordSlateTouch(params.slateSession.dir, [], { runtime: params.runtime });
+  if (!result.changed) {
+    return false;
+  }
+  params.history.push({
+    role: "user",
+    content: renderAnchorsBlock(result.slate.anchors),
+    provenance: "project"
+  });
+  params.onHistoryChange?.("tool");
+  return true;
+}
 function fmtTokens(n) {
   return n >= 1000 ? `${(n / 1000).toFixed(1)}K` : String(n);
 }
@@ -49687,7 +50625,7 @@ async function launchTuiAgentShell(opts) {
     }
     saveShellConfig(sel.baseUrl === undefined ? { provider: sel.provider, model: sel.model } : { provider: sel.provider, model: sel.model, baseUrl: sel.baseUrl });
     let currentSel = sel;
-    let deps = await opts.makeAgentDeps(sel);
+    let deps = await opts.makeAgentDeps(sel, () => slateSession);
     const FOOTER_IDLE = "/ commands \xB7 Ctrl+O blocks \xB7 Ctrl+C to exit";
     const FOOTER_NAV = "blocks \xB7 \u2191/\u2193 move \xB7 Enter toggle \xB7 y copy \xB7 Esc exit";
     const chrome = await createShellChrome(otui, r, {
@@ -50277,7 +51215,7 @@ Staying in the current session.
     };
     const switchTo = async (ns) => {
       currentSel = ns;
-      deps = await opts.makeAgentDeps(ns);
+      deps = await opts.makeAgentDeps(ns, () => slateSession);
       saveShellConfig(ns.baseUrl === undefined ? { provider: ns.provider, model: ns.model } : { provider: ns.provider, model: ns.model, baseUrl: ns.baseUrl });
       updateModelLabels();
       input2.focus();
@@ -50375,7 +51313,7 @@ Staying in the current session.
           });
           let answer = "";
           try {
-            const base = await opts.makeAgentDeps(currentSel);
+            const base = await opts.makeAgentDeps(currentSel, () => slateSession);
             const tools = base.tools.filter((t) => t.definition.risk === "read");
             const sideDeps = {
               ...base,
@@ -50528,6 +51466,20 @@ Staying in the current session.
           })();
           return;
         }
+        if (command.name === "/goal") {
+          (async () => {
+            await runGoalCommand({
+              raw: line.slice(command.name.length).trim(),
+              cwd: sessionCwd,
+              io,
+              deps,
+              history,
+              slateSession,
+              mintAttemptId: mintTimestampAttemptId
+            });
+          })();
+          return;
+        }
         if (command.name === "/resume" || command.name === "/sessions") {
           resumeSessionInteractive();
           return;
@@ -50657,6 +51609,17 @@ Staying in the current session.
             const chosen = await chrome.withOverlay(() => pickModelInTui(otui, r, models));
             if (chosen !== undefined) {
               await switchTo(currentSel.baseUrl === undefined ? { provider: currentSel.provider, model: chosen } : { provider: currentSel.provider, model: chosen, baseUrl: currentSel.baseUrl });
+              try {
+                await applyRuntimeSwitchToSlate({
+                  slateSession,
+                  runtime: { provider: currentSel.provider, model: currentSel.model },
+                  history,
+                  onHistoryChange: io.onHistoryChange
+                });
+              } catch (err) {
+                io.onSystem?.(`slate anchors update failed (ignored): ${err instanceof Error ? err.message : String(err)}
+`);
+              }
             } else {
               input2.focus();
             }
@@ -51468,6 +52431,7 @@ var READLINE_AGENT_COMMANDS = [
   "/search-provider",
   "/search-connect",
   "/new",
+  "/goal",
   "/clear",
   "/compact",
   "/status",
@@ -51990,7 +52954,7 @@ function formatUsage(usage) {
   }
   return style.dim(`${parts.join(" ")} tokens`);
 }
-async function runAgentRepl(lines, rich, deps, metaprojectPort, sessionOpts) {
+async function runAgentRepl(lines, rich, deps, metaprojectPort, sessionOpts, slateSessionBox = { current: undefined }) {
   const out = (s) => {
     process.stdout.write(s);
   };
@@ -52238,6 +53202,7 @@ New session ${shortSessionId(live.summary.id)}.
     }
   }
   slateSession = live !== undefined ? { dir: live.dir, cwd: sessionCwd, opened: false } : undefined;
+  slateSessionBox.current = slateSession;
   const save = () => {
     if (live === undefined) {
       return;
@@ -52344,6 +53309,7 @@ New session ${shortSessionId(live.summary.id)}.
           archive = [];
           nextArchiveIndex = 0;
           slateSession = { dir: live.dir, cwd: sessionCwd, opened: false };
+          slateSessionBox.current = slateSession;
           agentIo.onSystem?.(`New session ${shortSessionId(live.summary.id)} (previous kept on disk)
 `);
         } else {
@@ -52432,6 +53398,16 @@ New session ${shortSessionId(live.summary.id)}.
         }
         agentIo.onSystem?.(`Search provider '${providerId}' selected.
 `);
+      } else if (command === "/goal") {
+        await runGoalCommand({
+          raw: rest,
+          cwd: sessionCwd,
+          io: agentIo,
+          deps,
+          history,
+          slateSession,
+          mintAttemptId: mintTimestampAttemptId
+        });
       } else {
         agentIo.onSystem?.(describeUnavailableCommand(command, "agent") ?? `Unknown command: ${command}. Type /help.
 `);
@@ -52566,7 +53542,8 @@ async function shellCommand(args2, runtime = {}) {
     const cwd = process.cwd();
     const tuiProviderFactory = realMakeProvider(() => {});
     const searchProviderController = createDefaultSearchProviderController();
-    const makeAgentDeps = async (sel) => {
+    const makeAgentDeps = async (sel, getSlateSession) => {
+      const getSessionDir = () => getSlateSession()?.dir;
       const agentProvider = tuiProviderFactory(sel.provider, sel.model, sel.baseUrl);
       let orient = "";
       try {
@@ -52589,7 +53566,8 @@ async function shellCommand(args2, runtime = {}) {
             names.add(d.name);
           }
           return [...names].map((name) => ({ name }));
-        }
+        },
+        getSlateSession
       });
       return {
         provider: agentProvider,
@@ -52599,14 +53577,15 @@ async function shellCommand(args2, runtime = {}) {
           cwd,
           metaprojectPort,
           searchController: searchProviderController,
-          spawnTool
+          spawnTool,
+          getSessionDir
         }),
         systemInstruction: buildAgentSystemInstruction(orient, {
           providerId: sel.provider,
           modelId: sel.model
         }),
         maxToolCalls: resolveAgentMaxToolCalls(),
-        idSeq: () => randomUUID18()
+        idSeq: () => randomUUID20()
       };
     };
     const redetect = () => detectProviders({
@@ -52637,7 +53616,7 @@ async function shellCommand(args2, runtime = {}) {
         makeShellDeps: (sel) => ({
           makeProvider: chatFactory,
           clock: () => new Date().toISOString(),
-          idSeq: () => randomUUID18(),
+          idSeq: () => randomUUID20(),
           initial: sel,
           session: {
             cwd,
@@ -52707,7 +53686,7 @@ async function shellCommand(args2, runtime = {}) {
     const deps = {
       makeProvider: baseFactory,
       clock: () => new Date().toISOString(),
-      idSeq: () => randomUUID18(),
+      idSeq: () => randomUUID20(),
       initial: baseUrl2 === undefined ? { provider, model } : { provider, model, baseUrl: baseUrl2 },
       selectProviderModel: realSelectProviderModel(baseUrl2)
     };
@@ -52726,6 +53705,7 @@ async function shellCommand(args2, runtime = {}) {
       const metaprojectPort = createMetaprojectAdapter(process.cwd());
       const agentCwd = process.cwd();
       const searchProviderController = createDefaultSearchProviderController();
+      const slateSessionBox = { current: undefined };
       const spawnTool = createSpawnSubagentTool({
         cwd: agentCwd,
         getParentModel: () => ({
@@ -52734,7 +53714,8 @@ async function shellCommand(args2, runtime = {}) {
           ...baseUrl2 !== undefined ? { baseUrl: baseUrl2 } : {}
         }),
         makeProvider: (providerId, modelId, childBaseUrl) => baseFactory(providerId, modelId, childBaseUrl ?? baseUrl2),
-        getDetectedProviders: () => [{ name: provider }]
+        getDetectedProviders: () => [{ name: provider }],
+        getSlateSession: () => slateSessionBox.current
       });
       const agentDeps = {
         provider: agentProvider,
@@ -52744,14 +53725,15 @@ async function shellCommand(args2, runtime = {}) {
           cwd: agentCwd,
           metaprojectPort,
           searchController: searchProviderController,
-          spawnTool
+          spawnTool,
+          getSessionDir: () => slateSessionBox.current?.dir
         }),
         systemInstruction: buildAgentSystemInstruction(orient, {
           providerId: provider,
           modelId: model
         }),
         maxToolCalls: resolveAgentMaxToolCalls(),
-        idSeq: () => randomUUID18()
+        idSeq: () => randomUUID20()
       };
       let resumeId = flags.resumeId;
       if (flags.resumePick === true && resumeId === undefined) {
@@ -52761,7 +53743,7 @@ async function shellCommand(args2, runtime = {}) {
         cwd: process.cwd(),
         ...flags.continueLast === true ? { continueLast: true } : {},
         ...resumeId !== undefined ? { resumeId } : {}
-      });
+      }, slateSessionBox);
     } else {
       let resumeId = flags.resumeId;
       if (flags.resumePick === true && resumeId === undefined) {
@@ -52922,7 +53904,7 @@ Shell:
 init_fs();
 import { readFile as readFile75 } from "fs/promises";
 import { stdin } from "process";
-import path137 from "path";
+import path140 from "path";
 var MODULES = [
   { name: "gdgraph", flag: "--no-gdgraph", desc: "code graph, symbols, affected context", defaultEnabled: true },
   { name: "gdctx", flag: "--no-gdctx", desc: "token-aware command/read output", defaultEnabled: true },
@@ -52968,8 +53950,8 @@ async function modulesCommand(args2 = []) {
     return;
   }
   const wantsJson = args2.includes("--json") && (sub === undefined || sub === "status" || sub === "list" || sub === "--json");
-  const metaprojectRoot = path137.join(process.cwd(), ".metaproject");
-  const manifestPath = path137.join(metaprojectRoot, "metaproject.json");
+  const metaprojectRoot = path140.join(process.cwd(), ".metaproject");
+  const manifestPath = path140.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     if (wantsJson) {
       console.log(JSON.stringify({ schemaVersion: 1, error: "not-initialized", modules: [] }, null, 2));
@@ -53083,18 +54065,18 @@ function printHelp16() {
 }
 
 // src/commands/serve.ts
-import { randomUUID as randomUUID21 } from "crypto";
+import { randomUUID as randomUUID23 } from "crypto";
 
 // src/lib/serve-config.ts
 init_config_dir();
 import { existsSync as existsSync26 } from "fs";
-import path138 from "path";
+import path141 from "path";
 var SERVE_CONFIG_SCHEMA_VERSION = "1.0.0";
 var DEFAULT_SERVE_BIND_ADDRESS = "127.0.0.1";
 var DEFAULT_SERVE_PORT = 7377;
 var DEFAULT_SERVE_PROFILE = "remote-restricted";
 function serveConfigPath(dir) {
-  return path138.join(keryxConfigDir(dir), "serve.json");
+  return path141.join(keryxConfigDir(dir), "serve.json");
 }
 function parseIpv4(value) {
   const parts = value.split(".");
@@ -53410,7 +54392,7 @@ function saveServeConfig(config, dir, onWarn) {
 
 // src/lib/serve-credential.ts
 init_config_dir();
-import { createHash as createHash29, randomBytes as randomBytes2, randomUUID as randomUUID19 } from "crypto";
+import { createHash as createHash30, randomBytes as randomBytes2, randomUUID as randomUUID21 } from "crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync3,
@@ -53422,9 +54404,9 @@ import {
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync8
 } from "fs";
-import path139 from "path";
+import path142 from "path";
 function serveCredentialPath(dir) {
-  return path139.join(keryxConfigDir(dir), "serve-credentials.json");
+  return path142.join(keryxConfigDir(dir), "serve-credentials.json");
 }
 function constantTimeEqual(a, b) {
   const width = Math.max(a.length, b.length);
@@ -53437,10 +54419,10 @@ function constantTimeEqual(a, b) {
   return difference === 0;
 }
 function hashToken(salt, token) {
-  return createHash29("sha256").update(Buffer.from(salt, "hex")).update(Buffer.from(token, "utf8")).digest("hex");
+  return createHash30("sha256").update(Buffer.from(salt, "hex")).update(Buffer.from(token, "utf8")).digest("hex");
 }
 function credentialFingerprint(record) {
-  return createHash29("sha256").update(`keryx-serve-fingerprint:${record.hash}`).digest("hex").slice(0, 8);
+  return createHash30("sha256").update(`keryx-serve-fingerprint:${record.hash}`).digest("hex").slice(0, 8);
 }
 function isValidRecord(value) {
   if (typeof value !== "object" || value === null) {
@@ -53494,7 +54476,7 @@ function readServeCredential(dir) {
 }
 function writeStore(store, dir) {
   const file = serveCredentialPath(dir);
-  const temp = `${file}.${randomUUID19()}.tmp`;
+  const temp = `${file}.${randomUUID21()}.tmp`;
   try {
     ensureKeryxConfigDir(dir);
     const handle = openSync3(temp, "wx", 384);
@@ -53534,7 +54516,7 @@ function mintRecord(now) {
   const salt = randomBytes2(32).toString("hex");
   return {
     token,
-    record: { id: randomUUID19(), algorithm: "sha256", salt, hash: hashToken(salt, token), createdAt: now }
+    record: { id: randomUUID21(), algorithm: "sha256", salt, hash: hashToken(salt, token), createdAt: now }
   };
 }
 function issueServeToken(dir, now = () => new Date().toISOString(), onWaiting) {
@@ -53653,24 +54635,24 @@ class AuthFailureThrottle {
 
 // src/lib/serve-turn-store.ts
 init_config_dir();
-import { createHash as createHash30 } from "crypto";
+import { createHash as createHash31 } from "crypto";
 import { existsSync as existsSync28, readdirSync as readdirSync2, rmSync as rmSync2 } from "fs";
-import path140 from "path";
+import path143 from "path";
 var MAX_TURN_EVENTS = 1e4;
 function turnsRoot(dir) {
-  return path140.join(keryxConfigDir(dir), "turns");
+  return path143.join(keryxConfigDir(dir), "turns");
 }
 function turnDir(turnId, dir) {
-  return path140.join(turnsRoot(dir), turnId);
+  return path143.join(turnsRoot(dir), turnId);
 }
 function keyPath(project, idempotencyKey, dir) {
   const projectBytes = Buffer.byteLength(project, "utf8");
-  const digest2 = createHash30("sha256").update(`${projectBytes}:${project}\x00${idempotencyKey}`, "utf8").digest("hex");
-  return path140.join(turnsRoot(dir), "keys", `${digest2}.json`);
+  const digest2 = createHash31("sha256").update(`${projectBytes}:${project}\x00${idempotencyKey}`, "utf8").digest("hex");
+  return path143.join(turnsRoot(dir), "keys", `${digest2}.json`);
 }
 function legacyKeyPath(idempotencyKey, dir) {
-  const digest2 = createHash30("sha256").update(idempotencyKey, "utf8").digest("hex");
-  return path140.join(turnsRoot(dir), "keys", `${digest2}.json`);
+  const digest2 = createHash31("sha256").update(idempotencyKey, "utf8").digest("hex");
+  return path143.join(turnsRoot(dir), "keys", `${digest2}.json`);
 }
 function adoptLegacyClaim(project, idempotencyKey, dir) {
   const legacy = legacyKeyPath(idempotencyKey, dir);
@@ -53734,7 +54716,7 @@ function ensureTurnDir(turnId, dir) {
 }
 function createTurnRecord(record, dir) {
   ensureTurnDir(record.turnId, dir);
-  writeOwnerOnlyFile(path140.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
+  writeOwnerOnlyFile(path143.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
 `);
 }
 function appendTurnEvent(event, dir, opts) {
@@ -53743,12 +54725,12 @@ function appendTurnEvent(event, dir, opts) {
   }
   const line = JSON.stringify(event);
   try {
-    appendOwnerOnlyLine(path140.join(turnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path143.join(turnDir(event.turnId, dir), "events.jsonl"), line);
   } catch (error2) {
     if (error2?.code !== "ENOENT") {
       throw error2;
     }
-    appendOwnerOnlyLine(path140.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path143.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
   }
   return true;
 }
@@ -53756,7 +54738,7 @@ function readTurnEvents(turnId, after = -1, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path140.join(turnDir(turnId, dir), "events.jsonl"));
+  const read = readTurnFile(path143.join(turnDir(turnId, dir), "events.jsonl"));
   if (!read.ok) {
     if (isDefiniteAbsence2(read.reason)) {
       return { ok: true, value: [] };
@@ -53784,7 +54766,7 @@ function readTurnRecord(turnId, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path140.join(turnDir(turnId, dir), "turn.json"));
+  const read = readTurnFile(path143.join(turnDir(turnId, dir), "turn.json"));
   if (!read.ok) {
     return { ok: false, reason: read.reason };
   }
@@ -53803,7 +54785,7 @@ function finishTurn(turnId, result, dir) {
   if (!record.ok) {
     return false;
   }
-  writeOwnerOnlyFile(path140.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
+  writeOwnerOnlyFile(path143.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
 `);
   return true;
 }
@@ -53848,8 +54830,8 @@ function releaseIdempotencyKey(project, idempotencyKey, turnId, dir) {
 }
 
 // src/lib/serve-turn.ts
-import { randomUUID as randomUUID20 } from "crypto";
-import path141 from "path";
+import { randomUUID as randomUUID22 } from "crypto";
+import path144 from "path";
 init_service();
 var REMOTE_ORIGIN = "remote:http";
 var MAX_PROMPT_CHARS = 32000;
@@ -53918,9 +54900,9 @@ function isUuid(value) {
   return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value);
 }
 function resolveProject(declared, dir) {
-  const wanted = path141.resolve(declared);
+  const wanted = path144.resolve(declared);
   for (const entry of listProjects(dir, () => {})) {
-    if (path141.resolve(entry.path) === wanted) {
+    if (path144.resolve(entry.path) === wanted) {
       return { ok: true, project: entry.path };
     }
   }
@@ -53967,7 +54949,7 @@ async function redactOut(security, text) {
 async function runRemoteTurn(input2) {
   const scanRoot = input2.scanRoot;
   const security = createSecurityService(scanRoot);
-  const newId = input2.newId ?? (() => randomUUID20());
+  const newId = input2.newId ?? (() => randomUUID22());
   const clock = input2.clock ?? (() => new Date().toISOString());
   const turnId = input2.turnId ?? newId();
   const sessionId = input2.request.sessionId ?? newId();
@@ -54110,7 +55092,7 @@ function outcomeOf(status, gate, unresolvedBlockerIds) {
 }
 function createSubmitTurn(deps) {
   return async (request, project) => {
-    const turnId = (deps.newId ?? (() => randomUUID20()))();
+    const turnId = (deps.newId ?? (() => randomUUID22()))();
     const scanned = await scanPrompt(deps.dir, request.prompt);
     if (scanned.rejected) {
       return { kind: "rejected" };
@@ -54797,7 +55779,7 @@ function runConfig(args2) {
       return;
     }
     const credential2 = readServeCredential();
-    const credentialId = credential2.status === "ok" ? credential2.record.id : randomUUID21();
+    const credentialId = credential2.status === "ok" ? credential2.record.id : randomUUID23();
     const config = defaultServeConfig(credentialId, {
       address: parsed.parsed.values.get("--bind") ?? DEFAULT_SERVE_BIND_ADDRESS,
       port: port ?? DEFAULT_SERVE_PORT,
@@ -54953,9 +55935,9 @@ function printHelp17() {
 
 // src/commands/update.ts
 import { spawn as spawn5 } from "child_process";
-import { chmod as chmod4, mkdir as mkdir53, readFile as readFile76, readdir as readdir22, writeFile as writeFile47 } from "fs/promises";
+import { chmod as chmod4, mkdir as mkdir54, readFile as readFile76, readdir as readdir23, writeFile as writeFile47 } from "fs/promises";
 import { access as access4, constants as constants2, existsSync as existsSync29 } from "fs";
-import path142 from "path";
+import path145 from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 init_config();
 init_config2();
@@ -54970,8 +55952,8 @@ async function updateCommand(args2 = []) {
     return;
   }
   const projectRoot = process.cwd();
-  const metaprojectRoot = path142.join(projectRoot, ".metaproject");
-  banner("keryx update", `Refreshing the .metaproject workspace in ${path142.basename(projectRoot)}/`);
+  const metaprojectRoot = path145.join(projectRoot, ".metaproject");
+  banner("keryx update", `Refreshing the .metaproject workspace in ${path145.basename(projectRoot)}/`);
   if (!await pathExists(metaprojectRoot)) {
     console.log(`  ${style.red(symbols.cross)} Metaproject is not initialized.`);
     console.log(`  ${style.cyan(symbols.arrow)} Run ${style.cyan("keryx init")} first.`);
@@ -55017,12 +55999,12 @@ async function updateCommand(args2 = []) {
   nextSteps(steps);
 }
 async function refreshServiceFiles(projectRoot, options) {
-  const metaprojectRoot = path142.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path145.join(projectRoot, ".metaproject");
   const manifestState = await readManifest5(metaprojectRoot);
   const manifest = manifestState.manifest;
   const recoveredManifest = !manifestState.exists || !manifestState.valid;
   if (manifestState.migrated) {
-    await writeFile47(path142.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+    await writeFile47(path145.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   }
   const enableGdgraph = moduleEnabled2(manifest, "gdgraph");
@@ -55059,11 +56041,11 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     enableSac
   });
-  await writeTextIfChanged4(path142.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
-  await writeTextIfChanged4(path142.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
-  await writeTextIfChanged4(path142.join(metaprojectRoot, "rules", "README.md"), renderProjectRulesReadme());
-  await writeTextIfChanged4(path142.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
-  await writeTextIfChanged4(path142.join(metaprojectRoot, "index.md"), renderIndexMarkdown({
+  await writeTextIfChanged4(path145.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
+  await writeTextIfChanged4(path145.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
+  await writeTextIfChanged4(path145.join(metaprojectRoot, "rules", "README.md"), renderProjectRulesReadme());
+  await writeTextIfChanged4(path145.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
+  await writeTextIfChanged4(path145.join(metaprojectRoot, "index.md"), renderIndexMarkdown({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -55076,7 +56058,7 @@ async function refreshServiceFiles(projectRoot, options) {
     ruleSources,
     hasDistilledEntrypoints: await hasDistilledEntrypoints(metaprojectRoot)
   }));
-  await writeTextIfChanged4(path142.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
+  await writeTextIfChanged4(path145.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -55088,7 +56070,7 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     data: dashboardData
   }));
-  await writeTextIfMissing4(path142.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
+  await writeTextIfMissing4(path145.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -55101,31 +56083,31 @@ async function refreshServiceFiles(projectRoot, options) {
   }));
   if (enableGdgraph) {
     await installGdgraphCoreScripts2(metaprojectRoot);
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
     await seedAssetsLock(metaprojectRoot);
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdgraph-post-commit", renderGdgraphPostCommitHook());
     }
   }
   if (enableGdctx) {
-    await writeTextIfMissing4(path142.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
+    await writeTextIfMissing4(path145.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
   }
   if (enableGdwiki) {
-    await writeTextIfMissing4(path142.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
+    await writeTextIfMissing4(path145.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdwiki-post-commit", renderGdwikiPostCommitHook());
     }
   }
   if (enableSac) {
-    await writeTextIfMissing4(path142.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
+    await writeTextIfMissing4(path145.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
   }
   if (enableGdskills) {
     await installGdskills(metaprojectRoot, gdskillsProfile, { createDataDirs: false });
@@ -55134,25 +56116,25 @@ async function refreshServiceFiles(projectRoot, options) {
     }
   }
   if (enableHealth) {
-    await writeTextIfMissing4(path142.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
+    await writeTextIfMissing4(path145.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
     if (manifest.modules?.health?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "health-post-commit", renderHealthPostCommitHook());
     }
   }
   if (enableTesting) {
-    await writeTextIfMissing4(path142.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
+    await writeTextIfMissing4(path145.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
       postCommitRefresh: Boolean(manifest.modules?.testing?.hooks?.gitPostCommit),
       prePushGate: Boolean(manifest.modules?.testing?.hooks?.prePush)
     }));
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
     if (enableGdwiki) {
-      await writeTextIfMissing4(path142.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
-      await writeTextIfMissing4(path142.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
+      await writeTextIfMissing4(path145.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
+      await writeTextIfMissing4(path145.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
     }
     if (manifest.modules?.testing?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "testing-post-commit", renderTestingPostCommitHook());
@@ -55165,24 +56147,24 @@ async function refreshServiceFiles(projectRoot, options) {
     await installManagedHook2(projectRoot, "post-commit", "metaproject-dashboard-post-commit", renderMetaprojectDashboardPostCommitHook());
   }
   if (enableMemory) {
-    await writeTextIfMissing4(path142.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
-    await writeTextIfMissing4(path142.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
+    await writeTextIfMissing4(path145.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
+    await writeTextIfMissing4(path145.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
   }
   if (enableTasks) {
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
   }
   if (enableSecurity) {
-    await writeTextIfMissing4(path142.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
-    await writeTextIfChanged4(path142.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
+    await writeTextIfMissing4(path145.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
+    await writeTextIfChanged4(path145.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
     if (manifest.modules?.security?.hooks?.prePush) {
       await installManagedHook2(projectRoot, "pre-push", "security-pre-push", renderSecurityPrePushHook());
     }
@@ -55233,13 +56215,13 @@ async function refreshServiceFiles(projectRoot, options) {
   };
 }
 async function buildDashboard(projectRoot = process.cwd()) {
-  const metaprojectRoot = path142.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path145.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
   const manifest = (await readManifest5(metaprojectRoot)).manifest;
   const data = await collectDashboardData(metaprojectRoot);
-  const dashboardPath = path142.join(metaprojectRoot, "keryx-dashboard.html");
+  const dashboardPath = path145.join(metaprojectRoot, "keryx-dashboard.html");
   await writeTextIfChanged4(dashboardPath, renderMetaprojectDashboardHtml({
     enableGdgraph: moduleEnabled2(manifest, "gdgraph"),
     enableGdctx: moduleEnabled2(manifest, "gdctx"),
@@ -55259,7 +56241,7 @@ async function shouldInstallDashboardPostCommitHook(projectRoot, manifest) {
   if (Object.values(modules).some((module) => Boolean(module.hooks?.gitPostCommit))) {
     return true;
   }
-  const hookPath = path142.join(projectRoot, ".git", "hooks", "post-commit");
+  const hookPath = path145.join(projectRoot, ".git", "hooks", "post-commit");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -55279,11 +56261,11 @@ async function collectDashboardData(metaprojectRoot) {
   if (testing) {
     data.testing = testing;
   }
-  const wiki = await collectMarkdownPages(path142.join(metaprojectRoot, "wiki"), "wiki");
+  const wiki = await collectMarkdownPages(path145.join(metaprojectRoot, "wiki"), "wiki");
   if (wiki.length > 0) {
     data.wiki = { pages: wiki };
   }
-  const memory = await collectMarkdownPages(path142.join(metaprojectRoot, "memory"), "memory");
+  const memory = await collectMarkdownPages(path145.join(metaprojectRoot, "memory"), "memory");
   if (memory.length > 0) {
     data.memory = { entries: memory };
   }
@@ -55298,19 +56280,19 @@ async function collectDashboardData(metaprojectRoot) {
   return data;
 }
 async function collectTasksDashboardData(metaprojectRoot) {
-  const flowsRoot2 = path142.join(metaprojectRoot, "flows");
+  const flowsRoot2 = path145.join(metaprojectRoot, "flows");
   if (!await pathExists(flowsRoot2)) {
     return null;
   }
   let dirEntries;
   try {
-    dirEntries = (await readdir22(flowsRoot2, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^\d{3}-/.test(entry.name)).map((entry) => entry.name).sort();
+    dirEntries = (await readdir23(flowsRoot2, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^\d{3}-/.test(entry.name)).map((entry) => entry.name).sort();
   } catch {
     return null;
   }
   const flows = [];
   for (const dir of dirEntries) {
-    const flowPath = path142.join(flowsRoot2, dir, "flow.json");
+    const flowPath = path145.join(flowsRoot2, dir, "flow.json");
     if (!await pathExists(flowPath)) {
       continue;
     }
@@ -55318,7 +56300,7 @@ async function collectTasksDashboardData(metaprojectRoot) {
       const flow = JSON.parse(await readFile76(flowPath, "utf8"));
       const tasks = Array.isArray(flow.tasks) ? flow.tasks : [];
       let acTotal = 0;
-      const acPath2 = path142.join(flowsRoot2, dir, "acceptance-criteria.md");
+      const acPath2 = path145.join(flowsRoot2, dir, "acceptance-criteria.md");
       if (await pathExists(acPath2)) {
         const acContent = await readFile76(acPath2, "utf8");
         acTotal = (acContent.match(/^- AC\d+:/gm) ?? []).length;
@@ -55372,7 +56354,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
     "data/testing/context.md"
   ];
   for (const href of staticHrefs) {
-    const filePath = path142.join(metaprojectRoot, ...href.split("/"));
+    const filePath = path145.join(metaprojectRoot, ...href.split("/"));
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -55389,7 +56371,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
   return docs;
 }
 async function collectHealthDashboardData(metaprojectRoot) {
-  const reportPath2 = path142.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
+  const reportPath2 = path145.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
   if (!await pathExists(reportPath2)) {
     return;
   }
@@ -55498,8 +56480,8 @@ function metricToScope(metric) {
   };
 }
 async function collectGraphDashboardData(metaprojectRoot) {
-  const nodesPath = path142.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
-  const edgesPath = path142.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
+  const nodesPath = path145.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
+  const edgesPath = path145.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
   if (!await pathExists(nodesPath) || !await pathExists(edgesPath)) {
     return;
   }
@@ -55550,8 +56532,8 @@ async function collectGraphDashboardData(metaprojectRoot) {
   };
 }
 async function collectTestingDashboardData(metaprojectRoot) {
-  const reportPath2 = path142.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
-  const contextPath = path142.join(metaprojectRoot, "data", "testing", "context.md");
+  const reportPath2 = path145.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
+  const contextPath = path145.join(metaprojectRoot, "data", "testing", "context.md");
   if (await pathExists(reportPath2)) {
     const report = JSON.parse(await readFile76(reportPath2, "utf8"));
     const totalTests = numberOrUndefined(report.total);
@@ -55580,7 +56562,7 @@ async function collectMarkdownPages(root, hrefPrefix) {
   const files = await listMarkdownFiles(root);
   const pages = [];
   for (const filePath of files.slice(0, 40)) {
-    const relativePath = path142.relative(root, filePath).split(path142.sep).join("/");
+    const relativePath = path145.relative(root, filePath).split(path145.sep).join("/");
     if (relativePath === "index.md" || relativePath.startsWith("templates/")) {
       continue;
     }
@@ -55598,10 +56580,10 @@ async function collectMarkdownPages(root, hrefPrefix) {
   return pages;
 }
 async function listMarkdownFiles(root) {
-  const entries = await readdir22(root, { withFileTypes: true });
+  const entries = await readdir23(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const fullPath = path142.join(root, entry.name);
+    const fullPath = path145.join(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listMarkdownFiles(fullPath));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -55649,7 +56631,7 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
   const manifest = {
     schemaVersion: 1,
     standardVersion: STANDARD_VERSION,
-    name: `${path142.basename(path142.dirname(metaprojectRoot))}-metaproject`,
+    name: `${path145.basename(path145.dirname(metaprojectRoot))}-metaproject`,
     createdBy: "keryx",
     profiles: computeProfiles(enabledModuleKeys2),
     paths: {
@@ -55750,11 +56732,11 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
       metaproject: ".metaproject/index.md"
     }
   };
-  await writeFile47(path142.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+  await writeFile47(path145.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
 }
 async function enableTasksInManifest(metaprojectRoot) {
-  const manifestPath = path142.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path145.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -55777,7 +56759,7 @@ async function enableTasksInManifest(metaprojectRoot) {
 `, "utf8");
 }
 async function updateManifestAgentEntrypoints(metaprojectRoot, ruleSources) {
-  const manifestPath = path142.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path145.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -55813,80 +56795,80 @@ async function updateRuntime(projectRoot) {
   }
 }
 async function findRuntimeRoot(projectRoot) {
-  const projectRuntime = path142.join(projectRoot, ".metaproject", "runtime", "keryx");
-  if (await pathExists(path142.join(projectRuntime, ".git"))) {
+  const projectRuntime = path145.join(projectRoot, ".metaproject", "runtime", "keryx");
+  if (await pathExists(path145.join(projectRuntime, ".git"))) {
     return projectRuntime;
   }
   const home = process.env.HOME;
   if (!home) {
     return null;
   }
-  const globalRuntime = path142.join(home, ".keryx", "keryx");
-  if (await pathExists(path142.join(globalRuntime, ".git"))) {
+  const globalRuntime = path145.join(home, ".keryx", "keryx");
+  if (await pathExists(path145.join(globalRuntime, ".git"))) {
     return globalRuntime;
   }
   return null;
 }
 async function createServiceDirs(metaprojectRoot, modules) {
   const dirs = [
-    path142.join(metaprojectRoot, "core"),
-    path142.join(metaprojectRoot, "hooks", "post-update.d"),
-    path142.join(metaprojectRoot, "modules"),
-    path142.join(metaprojectRoot, "rules"),
-    path142.join(metaprojectRoot, "skills", "project-rules"),
+    path145.join(metaprojectRoot, "core"),
+    path145.join(metaprojectRoot, "hooks", "post-update.d"),
+    path145.join(metaprojectRoot, "modules"),
+    path145.join(metaprojectRoot, "rules"),
+    path145.join(metaprojectRoot, "skills", "project-rules"),
     ...modules.enableGdgraph ? [
-      path142.join(metaprojectRoot, "core", "gdgraph"),
-      path142.join(metaprojectRoot, "skills", "gdgraph")
+      path145.join(metaprojectRoot, "core", "gdgraph"),
+      path145.join(metaprojectRoot, "skills", "gdgraph")
     ] : [],
     ...modules.enableGdctx ? [
-      path142.join(metaprojectRoot, "core", "gdctx"),
-      path142.join(metaprojectRoot, "skills", "gdctx")
+      path145.join(metaprojectRoot, "core", "gdctx"),
+      path145.join(metaprojectRoot, "skills", "gdctx")
     ] : [],
     ...modules.enableGdwiki ? [
-      path142.join(metaprojectRoot, "skills", "gdwiki"),
-      path142.join(metaprojectRoot, "wiki", "templates")
+      path145.join(metaprojectRoot, "skills", "gdwiki"),
+      path145.join(metaprojectRoot, "wiki", "templates")
     ] : [],
     ...modules.enableHealth ? [
-      path142.join(metaprojectRoot, "core", "health"),
-      path142.join(metaprojectRoot, "skills", "health")
+      path145.join(metaprojectRoot, "core", "health"),
+      path145.join(metaprojectRoot, "skills", "health")
     ] : [],
     ...modules.enableTesting ? [
-      path142.join(metaprojectRoot, "core", "testing"),
-      path142.join(metaprojectRoot, "skills", "testing")
+      path145.join(metaprojectRoot, "core", "testing"),
+      path145.join(metaprojectRoot, "skills", "testing")
     ] : [],
     ...modules.enableMemory ? [
-      path142.join(metaprojectRoot, "core", "memory"),
-      path142.join(metaprojectRoot, "skills", "memory"),
-      path142.join(metaprojectRoot, "memory", "templates")
+      path145.join(metaprojectRoot, "core", "memory"),
+      path145.join(metaprojectRoot, "skills", "memory"),
+      path145.join(metaprojectRoot, "memory", "templates")
     ] : [],
     ...modules.enableTasks ? [
-      path142.join(metaprojectRoot, "flows"),
-      path142.join(metaprojectRoot, "skills", "flow")
+      path145.join(metaprojectRoot, "flows"),
+      path145.join(metaprojectRoot, "skills", "flow")
     ] : [],
     ...modules.enableSecurity ? [
-      path142.join(metaprojectRoot, "core", "security")
+      path145.join(metaprojectRoot, "core", "security")
     ] : [],
     ...modules.enableSac ? [
-      path142.join(metaprojectRoot, "skills", "sac")
+      path145.join(metaprojectRoot, "skills", "sac")
     ] : []
   ];
-  await Promise.all(dirs.map((dir) => mkdir53(dir, { recursive: true })));
+  await Promise.all(dirs.map((dir) => mkdir54(dir, { recursive: true })));
 }
 async function installGdgraphCoreScripts2(metaprojectRoot) {
-  const gdgraphCoreRoot = path142.join(metaprojectRoot, "core", "gdgraph");
-  await mkdir53(gdgraphCoreRoot, { recursive: true });
+  const gdgraphCoreRoot = path145.join(metaprojectRoot, "core", "gdgraph");
+  await mkdir54(gdgraphCoreRoot, { recursive: true });
   for (const file of GDGRAPH_CORE_SOURCES) {
-    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path142.join(gdgraphCoreRoot, file));
+    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path145.join(gdgraphCoreRoot, file));
   }
-  await writeTextIfChanged4(path142.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
+  await writeTextIfChanged4(path145.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
 }
 async function installManagedHook2(projectRoot, hookName, blockId, content) {
   const hooksRoot = await resolveGitHooksRoot(projectRoot);
   if (!hooksRoot) {
     return;
   }
-  await mkdir53(hooksRoot, { recursive: true });
-  const hookPath = path142.join(hooksRoot, hookName);
+  await mkdir54(hooksRoot, { recursive: true });
+  const hookPath = path145.join(hooksRoot, hookName);
   const blockStart = `# keryx:${blockId}:begin`;
   const blockEnd = `# keryx:${blockId}:end`;
   const managedBlock = `${blockStart}
@@ -55907,7 +56889,7 @@ async function removeManagedHook2(projectRoot, hookName, blockId) {
   if (!hooksRoot) {
     return;
   }
-  const hookPath = path142.join(hooksRoot, hookName);
+  const hookPath = path145.join(hooksRoot, hookName);
   if (!await pathExists(hookPath)) {
     return;
   }
@@ -55929,7 +56911,7 @@ async function prePushHasSecurityBlock2(projectRoot) {
   if (!hooksRoot) {
     return false;
   }
-  const hookPath = path142.join(hooksRoot, "pre-push");
+  const hookPath = path145.join(hooksRoot, "pre-push");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -55944,7 +56926,7 @@ async function agentSettingsHasSecuritySentinel2(projectRoot) {
   return (await readFile76(file, "utf8")).includes(AGENT_HOOKS_SENTINEL);
 }
 async function readManifest5(metaprojectRoot) {
-  const manifestPath = path142.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path145.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return {
       exists: false,
@@ -56013,7 +56995,7 @@ async function inferManifestFromExistingMetaproject(metaprojectRoot) {
 }
 async function anyPathExists(root, candidates) {
   for (const candidate of candidates) {
-    if (await pathExists(path142.join(root, candidate))) {
+    if (await pathExists(path145.join(root, candidate))) {
       return true;
     }
   }
@@ -56034,13 +57016,13 @@ function parseUpdateArgs(args2) {
   };
 }
 async function runPostUpdateHooks(projectRoot) {
-  const hooksDir = path142.join(projectRoot, ".metaproject", "hooks", "post-update.d");
+  const hooksDir = path145.join(projectRoot, ".metaproject", "hooks", "post-update.d");
   if (!await pathExists(hooksDir)) {
     return;
   }
-  const entries = (await readdir22(hooksDir)).sort();
+  const entries = (await readdir23(hooksDir)).sort();
   for (const entry of entries) {
-    const hookPath = path142.join(hooksDir, entry);
+    const hookPath = path145.join(hooksDir, entry);
     try {
       await accessExecutable(hookPath);
     } catch {
@@ -56081,14 +57063,14 @@ async function writeTextIfChanged4(filePath, content) {
   if (await pathExists(filePath) && await readFile76(filePath, "utf8") === content) {
     return;
   }
-  await mkdir53(path142.dirname(filePath), { recursive: true });
+  await mkdir54(path145.dirname(filePath), { recursive: true });
   await writeFile47(filePath, content, "utf8");
 }
 async function writeTextIfMissing4(filePath, content) {
   if (await pathExists(filePath)) {
     return;
   }
-  await mkdir53(path142.dirname(filePath), { recursive: true });
+  await mkdir54(path145.dirname(filePath), { recursive: true });
   await writeFile47(filePath, content, "utf8");
 }
 async function copyFileIfChanged2(from, to) {
@@ -56096,7 +57078,7 @@ async function copyFileIfChanged2(from, to) {
   if (await pathExists(to) && await readFile76(to, "utf8") === next) {
     return;
   }
-  await mkdir53(path142.dirname(to), { recursive: true });
+  await mkdir54(path145.dirname(to), { recursive: true });
   await writeFile47(to, next, "utf8");
 }
 function runtimeSourcePath2(relativePath) {
@@ -56105,7 +57087,7 @@ function runtimeSourcePath2(relativePath) {
     return directPath;
   }
   if (relativePath.startsWith("../")) {
-    const packagedSourcePath = path142.join(path142.dirname(fileURLToPath7(import.meta.url)), "..", "src", relativePath.slice(3));
+    const packagedSourcePath = path145.join(path145.dirname(fileURLToPath7(import.meta.url)), "..", "src", relativePath.slice(3));
     if (existsSync29(packagedSourcePath)) {
       return packagedSourcePath;
     }
@@ -56137,7 +57119,7 @@ function printHelp18() {
 
 // src/commands/dashboard.ts
 import { spawn as spawn6 } from "child_process";
-import path143 from "path";
+import path146 from "path";
 init_args();
 async function dashboardCommand(args2 = []) {
   const options = parseOptions(args2);
@@ -56148,7 +57130,7 @@ async function dashboardCommand(args2 = []) {
   }
   if (subcommand === "build") {
     const result = await buildDashboard();
-    const rel = path143.relative(process.cwd(), result.path);
+    const rel = path146.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Dashboard built ${style.cyan(symbols.arrow)} ${style.cyan(rel)}`);
     note(`Open it: keryx dashboard open`);
     return;
@@ -56156,7 +57138,7 @@ async function dashboardCommand(args2 = []) {
   if (subcommand === "open") {
     const result = await buildDashboard();
     await openFile(result.path);
-    const rel = path143.relative(process.cwd(), result.path);
+    const rel = path146.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Opened ${style.cyan(rel)}`);
     return;
   }
@@ -56203,9 +57185,9 @@ function printHelp19() {
 import { readFileSync as readFileSync10 } from "fs";
 
 // src/agents/bootstrap.ts
-import { mkdir as mkdir54, readFile as readFile77, writeFile as writeFile48 } from "fs/promises";
+import { mkdir as mkdir55, readFile as readFile77, writeFile as writeFile48 } from "fs/promises";
 import { homedir as homedir7 } from "os";
-import path144 from "path";
+import path147 from "path";
 init_fs();
 var AGENT_BOOTSTRAP_START = "<!-- keryx:global-bootstrap -->";
 var AGENT_BOOTSTRAP_END = "<!-- /keryx:global-bootstrap -->";
@@ -56215,35 +57197,35 @@ var AGENT_BOOTSTRAP_RUNTIMES = [
     aliases: ["claude-code"],
     label: "Claude Code",
     fileName: "CLAUDE.md",
-    filePath: (homeRoot) => path144.join(homeRoot, ".claude", "CLAUDE.md")
+    filePath: (homeRoot) => path147.join(homeRoot, ".claude", "CLAUDE.md")
   },
   {
     id: "opencode",
     aliases: ["open-code"],
     label: "OpenCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path144.join(homeRoot, ".config", "opencode", "AGENTS.md")
+    filePath: (homeRoot) => path147.join(homeRoot, ".config", "opencode", "AGENTS.md")
   },
   {
     id: "zcode",
     aliases: ["zed", "zed-code"],
     label: "ZCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path144.join(homeRoot, ".zcode", "AGENTS.md")
+    filePath: (homeRoot) => path147.join(homeRoot, ".zcode", "AGENTS.md")
   },
   {
     id: "codex",
     aliases: [],
     label: "Codex",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path144.join(homeRoot, ".codex", "AGENTS.md")
+    filePath: (homeRoot) => path147.join(homeRoot, ".codex", "AGENTS.md")
   },
   {
     id: "antigravity",
     aliases: ["antigravuty", "antigravity-code"],
     label: "Antigravity",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path144.join(homeRoot, ".config", "antigravity", "AGENTS.md")
+    filePath: (homeRoot) => path147.join(homeRoot, ".config", "antigravity", "AGENTS.md")
   }
 ];
 function agentBootstrapRuntimeIds() {
@@ -56291,7 +57273,7 @@ async function installAgentBootstrap(runtime, options = {}) {
   const dryRun = options.dryRun === true;
   const wrote = next !== current;
   if (wrote && !dryRun) {
-    await mkdir54(path144.dirname(filePath), { recursive: true });
+    await mkdir55(path147.dirname(filePath), { recursive: true });
     await writeFile48(filePath, next, "utf8");
   }
   const status = dryRun ? statusFromContent(runtime, filePath, exists2, next) : await agentBootstrapStatus(runtime, homeRoot);
@@ -56639,7 +57621,7 @@ function printBootstrapHelp() {
 // src/commands/metrics.ts
 init_args();
 import { readFile as readFile78 } from "fs/promises";
-import path146 from "path";
+import path149 from "path";
 
 // src/metrics/benchmark.ts
 var RELIABILITIES2 = new Set(["exact", "estimated", "unknown"]);
@@ -57409,8 +58391,8 @@ function buildContainmentManifest(inputs, options = {}) {
 }
 
 // src/metrics/oracle-runner.ts
-import { mkdir as mkdir55, writeFile as writeFile49 } from "fs/promises";
-import path145 from "path";
+import { mkdir as mkdir56, writeFile as writeFile49 } from "fs/promises";
+import path148 from "path";
 
 // src/metrics/ir.ts
 function toIdSet(ids) {
@@ -57852,9 +58834,9 @@ function buildEvidenceBundle(input2, options = {}) {
 async function persistEvidenceBundle(outDir, bundle, ladder = "metastore") {
   const safeTarget = bundle.target.replace(/[^A-Za-z0-9._/-]/g, "_");
   const safeCase = bundle.caseId.replace(/[^A-Za-z0-9._-]/g, "_");
-  const dir = path145.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
-  await mkdir55(dir, { recursive: true });
-  const write = (name, value) => writeFile49(path145.join(dir, name), `${JSON.stringify(value, null, 2)}
+  const dir = path148.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
+  await mkdir56(dir, { recursive: true });
+  const write = (name, value) => writeFile49(path148.join(dir, name), `${JSON.stringify(value, null, 2)}
 `, "utf8");
   await Promise.all([
     write("inputs.json", bundle.inputs),
@@ -57894,7 +58876,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
     console.log("# metrics status");
     console.log("");
     console.log(`root: ${root}`);
-    console.log(`enabled: ${await Bun.file(path146.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
+    console.log(`enabled: ${await Bun.file(path149.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
     const latest2 = await readLatestPointer(root);
     console.log(`latest: ${latest2.status}`);
     return;
@@ -57906,7 +58888,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const record2 = JSON.parse(await readFile78(path146.resolve(projectRoot, file), "utf8"));
+    const record2 = JSON.parse(await readFile78(path149.resolve(projectRoot, file), "utf8"));
     const result = validateRunRecord(record2);
     console.log(result.valid ? "valid: yes" : "valid: no");
     for (const error2 of result.errors)
@@ -57931,7 +58913,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const file = path146.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
+    const file = path149.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
     if (!await Bun.file(file).exists()) {
       console.error(`Run not found: ${runId}`);
       process.exitCode = 1;
@@ -57948,8 +58930,8 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const a = JSON.parse(await readFile78(path146.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
-    const b = JSON.parse(await readFile78(path146.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
+    const a = JSON.parse(await readFile78(path149.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
+    const b = JSON.parse(await readFile78(path149.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
     const comparison = compareExecutionRuns(a, b);
     console.log(stableJson(comparison));
     return;
@@ -57983,8 +58965,8 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       return;
     }
     const template = createPairedBenchmarkTemplate(taskIds);
-    await Bun.write(path146.resolve(projectRoot, out), stableJson(template));
-    console.log(`manifest: ${path146.relative(projectRoot, path146.resolve(projectRoot, out))}`);
+    await Bun.write(path149.resolve(projectRoot, out), stableJson(template));
+    console.log(`manifest: ${path149.relative(projectRoot, path149.resolve(projectRoot, out))}`);
     return;
   }
   if (subcommand === "benchmark" && args2[1] === "run") {
@@ -57998,7 +58980,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const raw = JSON.parse(await readFile78(path146.resolve(projectRoot, file), "utf8"));
+    const raw = JSON.parse(await readFile78(path149.resolve(projectRoot, file), "utf8"));
     const input2 = Array.isArray(raw) ? raw : raw.runs ?? [];
     const result = validatePairedBenchmark(input2);
     console.log(stableJson(result));
@@ -58010,7 +58992,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
   process.exitCode = 1;
 }
 async function loadAffectedSets(projectRoot, file) {
-  const raw = JSON.parse(await readFile78(path146.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile78(path149.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target === "string")
@@ -58081,7 +59063,7 @@ async function runHarnessLayer(projectRoot, args2, ladder) {
   let tasks;
   let model;
   try {
-    const raw = JSON.parse(await readFile78(path146.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile78(path149.resolve(projectRoot, resultsPath), "utf8"));
     tasks = raw.tasks ?? [];
     model = raw.model;
   } catch (error2) {
@@ -58112,7 +59094,7 @@ async function runSafetyCompletionHonestyLayer(projectRoot, args2, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile78(path146.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile78(path149.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -58137,7 +59119,7 @@ async function runSafetyFalsePremiseLayer(projectRoot, args2, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile78(path146.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile78(path149.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -58162,7 +59144,7 @@ async function runSafetyContainmentLayer(projectRoot, args2, ladder, caseClass)
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile78(path146.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile78(path149.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -58224,12 +59206,12 @@ async function runGdgraphLayer(projectRoot, args2, ladder) {
   }
   const manifests = buildOracleManifestsByGold(inputs, { ladder });
   if (outDir) {
-    const resolvedOut = path146.resolve(projectRoot, outDir);
+    const resolvedOut = path149.resolve(projectRoot, outDir);
     for (const input2 of inputs) {
       for (const named of input2.golds) {
         const bundle = buildEvidenceBundle({ target: input2.target, system: input2.system, gold: named.gold }, { ladder, goldReference: goldPathFor(named.kind), timestamp: new Date().toISOString() });
-        const dir = await persistEvidenceBundle(path146.join(resolvedOut, named.kind), bundle, ladder);
-        console.error(`bundle[${named.kind}]: ${path146.relative(projectRoot, dir)}`);
+        const dir = await persistEvidenceBundle(path149.join(resolvedOut, named.kind), bundle, ladder);
+        console.error(`bundle[${named.kind}]: ${path149.relative(projectRoot, dir)}`);
       }
     }
   }
@@ -58253,7 +59235,7 @@ async function runGdgraphLayer(projectRoot, args2, ladder) {
   return allValid;
 }
 async function loadCoverageMap2(projectRoot, file) {
-  const raw = JSON.parse(await readFile78(path146.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile78(path149.resolve(projectRoot, file), "utf8"));
   return raw.coverageMap ?? {};
 }
 async function runTestingLayer(projectRoot, args2, ladder) {
@@ -58290,7 +59272,7 @@ async function runTestingLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadMemoryGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile78(path146.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile78(path149.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 3;
 }
 async function runMemoryLayer(projectRoot, args2, ladder) {
@@ -58327,11 +59309,11 @@ async function runMemoryLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadWikiGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile78(path146.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile78(path149.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 5;
 }
 async function loadWikiGroundedness(projectRoot, file) {
-  const raw = JSON.parse(await readFile78(path146.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile78(path149.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target !== "string" || !Array.isArray(entry.scores) || entry.scores.length !== 3)
@@ -58387,7 +59369,7 @@ async function runWikiLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadGdctxFacts(projectRoot, file) {
-  const raw = JSON.parse(await readFile78(path146.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile78(path149.resolve(projectRoot, file), "utf8"));
   const inputs = [];
   for (const entry of raw.inputs ?? []) {
     if (typeof entry.input === "string") {
@@ -58425,7 +59407,7 @@ async function collect(projectRoot, args2) {
     process.exitCode = 1;
     return;
   }
-  const raw = JSON.parse(await readFile78(path146.resolve(projectRoot, eventFile), "utf8"));
+  const raw = JSON.parse(await readFile78(path149.resolve(projectRoot, eventFile), "utf8"));
   const events2 = Array.isArray(raw) ? raw : raw.events;
   const startedAt = optionValue(args2, "--started-at") ?? events2[0]?.timestamp_utc ?? new Date().toISOString();
   const finishedAt = optionValue(args2, "--finished-at") ?? events2.at(-1)?.timestamp_utc ?? startedAt;
@@ -58441,11 +59423,11 @@ async function collect(projectRoot, args2) {
     parentRunId: optionValue(args2, "--parent-run-id") ?? null
   });
   const result = await writeRunArtifacts(metricsRoot(projectRoot), record2, { cwd: projectRoot });
-  console.log(`json: ${path146.relative(projectRoot, result.jsonPath)}`);
-  console.log(`markdown: ${path146.relative(projectRoot, result.markdownPath)}`);
+  console.log(`json: ${path149.relative(projectRoot, result.jsonPath)}`);
+  console.log(`markdown: ${path149.relative(projectRoot, result.markdownPath)}`);
 }
 function metricsRoot(projectRoot) {
-  return path146.join(projectRoot, ".metaproject", "data", "metrics");
+  return path149.join(projectRoot, ".metaproject", "data", "metrics");
 }
 function printMetricsHelp() {
   console.log(`keryx metrics
@@ -58496,7 +59478,7 @@ async function versionCommand(args2, deps = {}) {
 
 // src/commands/workspace.ts
 init_args();
-import { randomUUID as randomUUID22 } from "crypto";
+import { randomUUID as randomUUID25 } from "crypto";
 import { writeFile as writeFile50 } from "fs/promises";
 
 // src/sac/fwk-explain.ts
@@ -58544,6 +59526,136 @@ function formatFwkExplain(result) {
 `);
 }
 
+// src/sac/catch-up.ts
+init_fs();
+init_config_dir();
+import { randomUUID as randomUUID24 } from "crypto";
+import { readdir as readdir24 } from "fs/promises";
+import path150 from "path";
+async function buildCatchUp(input2) {
+  const [proposals, sessionCategories] = await Promise.all([
+    collectProposals(input2.cwd, input2.workspaceId),
+    collectSessionCategories(input2.cwd)
+  ]);
+  return { proposals, ...sessionCategories };
+}
+async function collectProposals(cwd, workspaceId) {
+  const authorizationServer = localWorkspaceAuthorizationServer();
+  const actor = await authorizationServer.actorContextFor(undefined, randomUUID24());
+  if (!actor)
+    throw new Error("trusted ActorContext is required for catch-up");
+  const proposalService = createLocalProposalLifecycleService(cwd);
+  const groups = await proposalService.listVisibleProposedProposals(actor);
+  const scoped = workspaceId === undefined ? groups : groups.filter((group) => group.workspace.id === workspaceId);
+  const flattened = scoped.flatMap((group) => group.proposals.map((proposal) => ({ group, proposal })));
+  return Promise.all(flattened.map(async ({ group, proposal }) => {
+    const fresh = await proposalService.isEvidenceFresh(proposal, actor);
+    return { type: "proposal", workspaceId: group.workspace.id, proposalId: proposal.id, fresh };
+  }));
+}
+async function classifySession(session) {
+  const dir = sessionDir(session.projectPath, session.id);
+  if (await isLockHeld(slateLockPath(dir)))
+    return;
+  const terminalState = await readTerminalState(dir);
+  if (terminalState !== undefined) {
+    const workspaceId2 = (await safeReadSlate(dir))?.workspaceId;
+    return { kind: "blocked", item: { type: "blocked", sessionId: session.id, ...workspaceId2 !== undefined ? { workspaceId: workspaceId2 } : {}, terminalState } };
+  }
+  const unboundCandidate = await readNewestUnboundCandidate(dir);
+  if (unboundCandidate !== undefined) {
+    return {
+      kind: "unbound-candidate",
+      item: { type: "unbound-candidate", sessionId: session.id, evidencePath: unboundCandidate.evidencePath, summary: unboundCandidate.summary }
+    };
+  }
+  if (!await isSlateEngaged(dir))
+    return;
+  const workspaceId = (await safeReadSlate(dir))?.workspaceId;
+  return { kind: "unknown", item: { type: "unknown", sessionId: session.id, ...workspaceId !== undefined ? { workspaceId } : {}, lastSeenAt: session.updatedAt } };
+}
+async function collectSessionCategories(cwd) {
+  const classified = await Promise.all(listSessions(cwd).map((session) => classifySession(session)));
+  const blocked2 = [];
+  const unboundCandidates = [];
+  const unknown = [];
+  for (const category of classified) {
+    if (category === undefined)
+      continue;
+    if (category.kind === "blocked")
+      blocked2.push(category.item);
+    else if (category.kind === "unbound-candidate")
+      unboundCandidates.push(category.item);
+    else
+      unknown.push(category.item);
+  }
+  return { blocked: blocked2, unboundCandidates, unknown };
+}
+async function isSlateEngaged(dir) {
+  if (await pathExists(path150.join(dir, "slate.json")))
+    return true;
+  if (await pathExists(path150.join(dir, "terminal-state.json")))
+    return true;
+  try {
+    const entries = await readdir24(path150.join(dir, "slate-archive"));
+    return entries.length > 0;
+  } catch {
+    return false;
+  }
+}
+async function safeReadSlate(dir) {
+  try {
+    return await readSlate(dir);
+  } catch {
+    return;
+  }
+}
+async function readTerminalState(dir) {
+  const result = readConfigFile(path150.join(dir, "terminal-state.json"));
+  if (!result.ok) {
+    return;
+  }
+  try {
+    return JSON.parse(result.text);
+  } catch {
+    return;
+  }
+}
+async function readNewestUnboundCandidate(dir) {
+  const archiveDir = path150.join(dir, "slate-archive");
+  let entries;
+  try {
+    entries = (await readdir24(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
+  } catch {
+    return;
+  }
+  entries.sort();
+  for (let i = entries.length - 1;i >= 0; i--) {
+    const evidencePath = path150.join(archiveDir, entries[i]);
+    const result = readConfigFile(evidencePath);
+    if (!result.ok) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(result.text);
+      if (parsed.recordType !== "unbound-candidate")
+        continue;
+      return { evidencePath, summary: summarizeUnboundCandidate(parsed.groups) };
+    } catch {
+      continue;
+    }
+  }
+  return;
+}
+function summarizeUnboundCandidate(groups) {
+  const safeGroups = groups ?? [];
+  if (safeGroups.length === 0)
+    return "no seeds captured";
+  const seedCount = safeGroups.reduce((sum, group) => sum + (group.seeds?.length ?? 0), 0);
+  const kinds = safeGroups.map((group) => typeof group.kind === "string" ? group.kind : "unknown").join(", ");
+  return `${seedCount} untriaged seed(s) across ${safeGroups.length} kind(s) (${kinds})`;
+}
+
 // src/commands/workspace.ts
 var PROPOSAL_KINDS = ["decision", "wiki-update", "memory-entry", "follow-up", "contract-change", "risk"];
 function service4() {
@@ -58564,14 +59676,14 @@ async function workspaceCommand(args2) {
       const component = optionValue(args2, "--component");
       if (!title)
         throw new Error("Usage: keryx workspace create --title <title> [--component <workspace-relative-ref>]");
-      const workspace = await service4().create({ request: undefined, requestCorrelationId: randomUUID22(), id: newWorkspaceId(), title, ...component ? { component: { kind: "component", uri: component } } : {} });
+      const workspace = await service4().create({ request: undefined, requestCorrelationId: randomUUID25(), id: newWorkspaceId(), title, ...component ? { component: { kind: "component", uri: component } } : {} });
       console.log(JSON.stringify(workspace, null, 2));
       return;
     }
     if (subcommand === "list") {
       rejectUnknownOptions(args2.slice(1), new Set(["--include-archived"]));
       const includeArchived = booleanFlag(args2, "--include-archived");
-      console.log(JSON.stringify(await service4().list({ request: undefined, requestCorrelationId: randomUUID22(), includeArchived }), null, 2));
+      console.log(JSON.stringify(await service4().list({ request: undefined, requestCorrelationId: randomUUID25(), includeArchived }), null, 2));
       return;
     }
     if (subcommand === "show") {
@@ -58579,7 +59691,7 @@ async function workspaceCommand(args2) {
       const id = args2[1];
       if (!id)
         throw new Error("Usage: keryx workspace show <workspace-id>");
-      console.log(JSON.stringify(await service4().show({ request: undefined, requestCorrelationId: randomUUID22(), workspaceId: id }), null, 2));
+      console.log(JSON.stringify(await service4().show({ request: undefined, requestCorrelationId: randomUUID25(), workspaceId: id }), null, 2));
       return;
     }
     if (subcommand === "add-resource") {
@@ -58590,7 +59702,7 @@ async function workspaceCommand(args2) {
       const revision = optionValue(args2, "--revision");
       if (!workspaceId || !kind || !uri)
         throw new Error("Usage: keryx workspace add-resource <workspace-id> --kind <kind> --uri <workspace-relative-ref> [--revision <revision>]");
-      console.log(JSON.stringify(await service4().addResource({ request: undefined, requestCorrelationId: randomUUID22(), workspaceId, resource: { kind, uri, ...revision ? { revision } : {} } }), null, 2));
+      console.log(JSON.stringify(await service4().addResource({ request: undefined, requestCorrelationId: randomUUID25(), workspaceId, resource: { kind, uri, ...revision ? { revision } : {} } }), null, 2));
       return;
     }
     if (subcommand === "archive") {
@@ -58598,7 +59710,7 @@ async function workspaceCommand(args2) {
       const workspaceId = args2[1];
       if (!workspaceId)
         throw new Error("Usage: keryx workspace archive <workspace-id>");
-      console.log(JSON.stringify(await service4().archive({ request: undefined, requestCorrelationId: randomUUID22(), workspaceId }), null, 2));
+      console.log(JSON.stringify(await service4().archive({ request: undefined, requestCorrelationId: randomUUID25(), workspaceId }), null, 2));
       return;
     }
     if (subcommand === "remove-resource") {
@@ -58607,7 +59719,7 @@ async function workspaceCommand(args2) {
       const uri = optionValue(args2, "--uri");
       if (!workspaceId || !uri)
         throw new Error("Usage: keryx workspace remove-resource <workspace-id> --uri <workspace-relative-ref>");
-      console.log(JSON.stringify(await service4().removeResource({ request: undefined, requestCorrelationId: randomUUID22(), workspaceId, uri }), null, 2));
+      console.log(JSON.stringify(await service4().removeResource({ request: undefined, requestCorrelationId: randomUUID25(), workspaceId, uri }), null, 2));
       return;
     }
     if (subcommand === "rename") {
@@ -58616,7 +59728,7 @@ async function workspaceCommand(args2) {
       const title = optionValue(args2, "--title");
       if (!workspaceId || !title)
         throw new Error("Usage: keryx workspace rename <workspace-id> --title <title>");
-      console.log(JSON.stringify(await service4().rename({ request: undefined, requestCorrelationId: randomUUID22(), workspaceId, title }), null, 2));
+      console.log(JSON.stringify(await service4().rename({ request: undefined, requestCorrelationId: randomUUID25(), workspaceId, title }), null, 2));
       return;
     }
     if (subcommand === "overview") {
@@ -58628,7 +59740,7 @@ async function workspaceCommand(args2) {
       const maxTokens = Number(optionValue(args2, "--max-tokens") ?? "4096");
       if (!Number.isInteger(maxItems) || !Number.isInteger(maxTokens) || maxItems < 0 || maxTokens < 0)
         throw new Error("--max-items and --max-tokens must be non-negative integers");
-      const result = await createLocalFwkReadService(process.cwd()).overview({ workspaceId, request: undefined, requestCorrelationId: randomUUID22(), budget: { maxItems, maxTokens } });
+      const result = await createLocalFwkReadService(process.cwd()).overview({ workspaceId, request: undefined, requestCorrelationId: randomUUID25(), budget: { maxItems, maxTokens } });
       const normalized = normalizeFwkResult(result);
       console.log(JSON.stringify(normalized, null, 2));
       if (args2.includes("--explain"))
@@ -58645,7 +59757,7 @@ async function workspaceCommand(args2) {
       const maxTokens = Number(optionValue(args2, "--max-tokens") ?? "4096");
       if (!Number.isInteger(maxItems) || !Number.isInteger(maxTokens) || maxItems < 0 || maxTokens < 0)
         throw new Error("--max-items and --max-tokens must be non-negative integers");
-      const result = await createLocalFwkReadService(process.cwd()).read({ workspaceId, itemId, request: undefined, requestCorrelationId: randomUUID22(), budget: { maxItems, maxTokens } });
+      const result = await createLocalFwkReadService(process.cwd()).read({ workspaceId, itemId, request: undefined, requestCorrelationId: randomUUID25(), budget: { maxItems, maxTokens } });
       const normalized = normalizeFwkResult(result);
       console.log(JSON.stringify(normalized, null, 2));
       if (args2.includes("--explain"))
@@ -58668,12 +59780,12 @@ async function workspaceCommand(args2) {
       if (!session)
         throw new Error(`no session matching "${sessionRef}" in this project \u2014 use \`keryx sessions list\``);
       const { service: service5, wrapUpAuthority, authorizationServer } = createHarnessProposalLifecycleService(cwd, { workspaceId, ...note2 ? { note: note2 } : {} });
-      const requestCorrelationId = randomUUID22();
+      const requestCorrelationId = randomUUID25();
       const actor = await authorizationServer.actorContextFor(undefined, requestCorrelationId);
       if (!actor)
         throw new Error("trusted ActorContext is required");
       const wrapUp = await wrapUpAuthority.issue({ actor, source: "session", sourceRef: sessionEvidenceRef(workspaceId, session.id) });
-      const proposal = await service5.create({ request: undefined, requestCorrelationId, workspaceId, id: `proposal-${randomUUID22().replace(/-/g, "").slice(0, 16)}`, proposalRevision, kind, wrapUp });
+      const proposal = await service5.create({ request: undefined, requestCorrelationId, workspaceId, id: `proposal-${randomUUID25().replace(/-/g, "").slice(0, 16)}`, proposalRevision, kind, wrapUp });
       if (note2)
         await writeFile50(proposalNotePath(cwd, workspaceId, proposal.id), note2, "utf8");
       console.log(JSON.stringify(normalizeProposalLifecycleResult(proposal), null, 2));
@@ -58685,10 +59797,10 @@ async function workspaceCommand(args2) {
       const proposalId = args2[2];
       const decision = optionValue(args2, "--decision");
       const reason = optionValue(args2, "--reason");
-      const idempotencyKey = optionValue(args2, "--idempotency-key") ?? randomUUID22();
+      const idempotencyKey = optionValue(args2, "--idempotency-key") ?? randomUUID25();
       if (!workspaceId || !proposalId || !decision)
         throw new Error("Usage: keryx workspace review <workspace-id> <proposal-id> --decision <accepted|rejected|dismissed> [--reason <reason>] [--idempotency-key <key>]");
-      const result = await createHarnessProposalLifecycleService(process.cwd(), { workspaceId }).service.review({ request: undefined, requestCorrelationId: randomUUID22(), workspaceId, proposalId, decision, idempotencyKey, interactive: true, ...reason ? { reason } : {} });
+      const result = await createHarnessProposalLifecycleService(process.cwd(), { workspaceId }).service.review({ request: undefined, requestCorrelationId: randomUUID25(), workspaceId, proposalId, decision, idempotencyKey, interactive: true, ...reason ? { reason } : {} });
       console.log(JSON.stringify(normalizeProposalLifecycleResult(result), null, 2));
       return;
     }
@@ -58697,7 +59809,7 @@ async function workspaceCommand(args2) {
       const workspaceId = args2[1];
       if (!workspaceId)
         throw new Error("Usage: keryx workspace collaboration <workspace-id>");
-      console.log(JSON.stringify(await createLocalCollaborationService(process.cwd()).overview({ workspaceId, request: undefined, requestCorrelationId: randomUUID22() }), null, 2));
+      console.log(JSON.stringify(await createLocalCollaborationService(process.cwd()).overview({ workspaceId, request: undefined, requestCorrelationId: randomUUID25() }), null, 2));
       return;
     }
     if (subcommand === "policy-readiness") {
@@ -58708,6 +59820,32 @@ async function workspaceCommand(args2) {
         process.exitCode = 1;
       return;
     }
+    if (subcommand === "catch-up") {
+      rejectUnknownOptions(args2.slice(1), new Set(["--workspace", "--json"]));
+      const workspaceId = optionValue(args2, "--workspace");
+      const report = await buildCatchUp({ cwd: process.cwd(), ...workspaceId ? { workspaceId } : {} });
+      if (args2.includes("--json"))
+        console.log(JSON.stringify(report, null, 2));
+      else
+        console.log(renderCatchUp(report));
+      return;
+    }
+    if (subcommand === "list-proposals") {
+      rejectUnknownOptions(args2.slice(2), new Set);
+      const workspaceId = args2[1];
+      const cwd = process.cwd();
+      const authorizationServer = localWorkspaceAuthorizationServer();
+      const actor = await authorizationServer.actorContextFor(undefined, randomUUID25());
+      if (!actor)
+        throw new Error("trusted ActorContext is required");
+      if (workspaceId) {
+        await service4().showForActor({ actorContext: actor, workspaceId });
+        console.log(JSON.stringify(await createLocalProposalLifecycleService(cwd).listProposedProposals(workspaceId), null, 2));
+        return;
+      }
+      console.log(JSON.stringify(await createLocalProposalLifecycleService(cwd).listVisibleProposedProposals(actor), null, 2));
+      return;
+    }
     throw new Error(`Unknown workspace command: ${subcommand}`);
   } catch (error2) {
     console.error(error2 instanceof Error ? error2.message : String(error2));
@@ -58752,7 +59890,29 @@ keryx workspace read <workspace-id> <item-id> [--max-items N] [--max-tokens N] [
 keryx workspace propose <workspace-id> --kind <` + PROPOSAL_KINDS.join("|") + `> --session <session-id> [--note <one-line note>]
 keryx workspace review <workspace-id> <proposal-id> --decision <accepted|rejected|dismissed> [--reason <reason>] [--idempotency-key <key>]
 keryx workspace collaboration <workspace-id>
-keryx workspace policy-readiness`);
+keryx workspace policy-readiness
+keryx workspace catch-up [--workspace <workspace-id>] [--json]
+keryx workspace list-proposals [<workspace-id>]`);
+}
+function renderCatchUp(report) {
+  const sections = [];
+  sections.push(renderSection("Pending proposals", report.proposals, (item) => `- Accept, reject, or dismiss proposal ${item.proposalId} in workspace ${item.workspaceId}? ` + `Recommendation: ${item.fresh ? "evidence is fresh \u2014 review now (`keryx workspace review " + item.workspaceId + " " + item.proposalId + " --decision <accepted|rejected|dismissed>`)" : "evidence has drifted since this proposal was created \u2014 treat as stale, re-run wrap-up before deciding"}.`));
+  sections.push(renderSection("Blocked sessions (stopped unattended)", report.blocked, (item) => `- Session ${item.sessionId} stopped unattended (${item.terminalState.reason}) at ${item.terminalState.occurredAt}. Resume it, or archive and move on? ` + `Recommendation: \`keryx shell -r ${item.sessionId}\` to resume and unblock it.`));
+  sections.push(renderSection("Unbound candidates (wrap-up ran, no workspace bound)", report.unboundCandidates, (item) => `- Session ${item.sessionId} produced untriaged seeds with no workspace bound (${item.summary}). Bind to a workspace and propose, or discard? ` + `Recommendation: pick a workspace, then \`keryx workspace propose <workspace-id> --kind <kind> --session ${item.sessionId}\` (evidence: ${item.evidencePath}).`));
+  sections.push(renderSection("Unknown (no resolution recorded)", report.unknown, (item) => `- Session ${item.sessionId} was last seen ${item.lastSeenAt} with no proposal, terminal state, or unbound-candidate artifact recorded. Investigate, or ignore? ` + `Recommendation: \`keryx sessions list\` / \`keryx shell -r ${item.sessionId}\` to see what happened.`));
+  return sections.join(`
+
+`);
+}
+function renderSection(title, items, describe) {
+  const lines = [`== ${title} ==`];
+  if (items.length === 0)
+    lines.push("(none)");
+  else
+    for (const item of items)
+      lines.push(describe(item));
+  return lines.join(`
+`);
 }
 
 // src/cli.ts