@mrciphersmith/keryx 0.2.43 → 0.2.44

package/dist/cli.js

@@ -12095,6 +12095,10 @@ function touchesAgentCredentials(command) {
   const text = command.toLowerCase();
   return CREDENTIAL_MARKERS.some((marker2) => text.includes(marker2));
 }
+function touchesSacConfirmReview(command) {
+  const text = command.toLowerCase();
+  return SAC_REVIEW_MARKERS.some((marker2) => text.includes(marker2));
+}
 var CATASTROPHIC_TARGETS, RECURSIVE_FLAG, PRIVILEGE, INTERPRETERS, DOWNLOADERS, CONTAINER_RUNTIMES, PROTECTED_BRANCHES, BLOCK_DEVICE, rulePrivilege = (v) => PRIVILEGE.has(v.cmd), ruleBlockDeviceRedirect = (v) => BLOCK_DEVICE.test(v.raw) && /(?:^|\s)(?:>|>>)\s*\/dev\//.test(v.raw), ruleRm = (v) => v.cmd === "rm" && v.positionals.some(isCatastrophicTarget), ruleDd = (v) => v.cmd === "dd" && v.args.some((x) => /^of=/i.test(x) && BLOCK_DEVICE.test(x)), rulePermissionSweep = (v) => (v.cmd === "chmod" || v.cmd === "chown" || v.cmd === "chgrp") && hasRecursive(v.words) && v.positionals.some(isCatastrophicTarget), ruleHostState = (v) => {
   if (v.cmd === "shutdown" || v.cmd === "reboot" || v.cmd === "halt" || v.cmd === "poweroff")
     return true;
@@ -12115,7 +12119,7 @@ var CATASTROPHIC_TARGETS, RECURSIVE_FLAG, PRIVILEGE, INTERPRETERS, DOWNLOADERS,
     return true;
   const named = after.map((x) => x.split("/").pop()?.toLowerCase() ?? "");
   return named.some((n) => PROTECTED_BRANCHES.includes(n));
-}, RULES3, CREDENTIAL_MARKERS;
+}, RULES3, CREDENTIAL_MARKERS, SAC_REVIEW_MARKERS;
 var init_command_risk = __esm(() => {
   init_shell_syntax();
   CATASTROPHIC_TARGETS = new Set([
@@ -12180,6 +12184,7 @@ var init_command_risk = __esm(() => {
     ".local/share/keryx",
     ".config/keryx"
   ];
+  SAC_REVIEW_MARKERS = ["confirm-review", "workspace review"];
 });
 
 // src/commands/permission-mode.ts
@@ -12187,11 +12192,11 @@ function isPermissionMode(value) {
   return PERMISSION_MODES.includes(value);
 }
 function resolveApprovalDecision(input2) {
-  const { mode, risk, destructive, credentials } = input2;
+  const { mode, risk, destructive, credentials, sacReviewConfirmation } = input2;
   if (risk === "read") {
     return "auto";
   }
-  if (credentials) {
+  if (credentials || sacReviewConfirmation) {
     return "ask";
   }
   if (mode === "auto") {
@@ -17667,7 +17672,8 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, on
     const command = typeof input2.command === "string" ? input2.command : "";
     const destructive = risk === "destructive" || isDestructiveCommand(command);
     const credentials = touchesAgentCredentials(command);
-    const decision = resolveApprovalDecision({ mode, risk, destructive, credentials });
+    const sacReviewConfirmation = touchesSacConfirmReview(command);
+    const decision = resolveApprovalDecision({ mode, risk, destructive, credentials, sacReviewConfirmation });
     if (decision === "auto") {
       onAutoApproved?.(call.name, call.input, { destructive, credentials });
     } else {
@@ -17682,7 +17688,7 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, on
       }
     }
   } else if (risk === "delegate") {
-    const decision = resolveApprovalDecision({ mode, risk, destructive: false, credentials: false });
+    const decision = resolveApprovalDecision({ mode, risk, destructive: false, credentials: false, sacReviewConfirmation: false });
     if (decision === "auto") {
       onAutoApproved?.(call.name, call.input, { destructive: false, credentials: false });
     } else {
@@ -45817,7 +45823,7 @@ function harnessWave(args2, deps) {
 init_make_provider();
 init_orient();
 init_metaproject_adapter();
-import { randomUUID as randomUUID23 } from "crypto";
+import { randomUUID as randomUUID25 } from "crypto";
 import * as readline2 from "readline";
 
 // src/commands/agent-approval-context.ts
@@ -47104,6 +47110,9 @@ function buildInteractiveAgentTools(input2) {
   ];
 }
 
+// src/commands/shell-approval.ts
+init_command_risk();
+
 // src/lib/shell-permissions.ts
 init_config_dir();
 init_shell_config();
@@ -47254,6 +47263,12 @@ function validateShellPattern(pattern) {
       reason: "touches the agent's own permission/credential files; remembering it would let one approved command disable the approval gate for every future session"
     };
   }
+  if (touchesSacConfirmReview(trimmed)) {
+    return {
+      ok: false,
+      reason: "touches SAC's proposal-review/confirm-token family; that guarantee depends on a human answering a real approval prompt, so it is never remembered"
+    };
+  }
   const banned = bannedPrefixGrant(trimmed, firstToken);
   if (banned !== undefined) {
     return { ok: false, reason: banned.reason };
@@ -47391,6 +47406,9 @@ function isShellCommandAllowed(command, allow) {
   if (touchesAgentCredentials(cmd)) {
     return false;
   }
+  if (touchesSacConfirmReview(cmd)) {
+    return false;
+  }
   return allow.some((pat) => matchShellPattern(pat, cmd));
 }
 function shellPermissionsFingerprint(dir) {
@@ -47416,12 +47434,12 @@ function suggestShellPatterns(command) {
   const collapsed = firstLine2.replace(/\s+/g, " ").trim();
   const first = collapsed.split(" ")[0] ?? collapsed;
   const prefix = first.length > 0 ? `${first} *` : exact;
-  const destructive = trimmed.length > 0 && isDestructiveCommand(trimmed);
+  const neverRemember = trimmed.length > 0 && (isDestructiveCommand(trimmed) || touchesSacConfirmReview(trimmed));
   return {
     exact,
     prefix,
-    offerExact: !destructive && validateShellPattern(exact).ok,
-    offerPrefix: !destructive && validateShellPattern(prefix).ok
+    offerExact: !neverRemember && validateShellPattern(exact).ok,
+    offerPrefix: !neverRemember && validateShellPattern(prefix).ok
   };
 }
 function parseShellExecCommand(inputJson) {
@@ -47444,16 +47462,18 @@ function evaluateShellApproval(input2) {
   const command = parseShellExecCommand(input2.inputJson);
   const destructive = input2.meta?.destructive === true;
   const credentials = input2.meta?.credentials === true;
+  const sacReviewConfirmation = touchesSacConfirmReview(command);
   const audit = io.loadAudit();
   for (const pattern of audit.permissions.allow) {
     input2.sessionAllow.add(pattern);
   }
   const tampered = io.fingerprint() !== input2.fingerprintAtStart;
-  const autoApprove = !destructive && !credentials && isShellCommandAllowed(command, [...input2.sessionAllow]);
+  const autoApprove = !destructive && !credentials && !sacReviewConfirmation && isShellCommandAllowed(command, [...input2.sessionAllow]);
   return {
     command,
     destructive,
     credentials,
+    sacReviewConfirmation,
     autoApprove,
     rejected: audit.rejected,
     tampered
@@ -47478,6 +47498,9 @@ function formatShellApprovalHints(evaled) {
   if (evaled.credentials) {
     lines.push("touches agent credentials \u2014 will not be remembered");
   }
+  if (evaled.sacReviewConfirmation) {
+    lines.push("SAC proposal review/confirm-token \u2014 will not be remembered");
+  }
   return lines;
 }
 
@@ -48582,7 +48605,7 @@ import { spawnSync as spawnSync2 } from "child_process";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.43",
+  version: "0.2.44",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -49832,8 +49855,195 @@ function openModal(otui, chrome, input2) {
 // src/tui/inspector-sources.ts
 init_store2();
 init_workspace_service();
+import { randomUUID as randomUUID24 } from "crypto";
+
+// src/sac/catch-up.ts
+init_fs();
+init_config_dir();
+init_paths();
 init_slate();
+init_store3();
+init_proposal_lifecycle();
+init_workspace_service();
+import { randomUUID as randomUUID23 } from "crypto";
+import { readdir as readdir24 } from "fs/promises";
+import path145 from "path";
+
+// src/sac/lifecycle-flag.ts
+init_store();
+init_service3();
+init_decision_dedup();
+init_workspace_service();
 import { randomUUID as randomUUID22 } from "crypto";
+function normalize3(raw) {
+  return raw.replace(/^\.\//, "");
+}
+function isStillPresent(recorded, valid) {
+  const normalized = normalize3(recorded);
+  return valid.has(normalized) || valid.has(moduleNameFromProjectPath(normalized));
+}
+async function computeLifecycleFlags(cwd, now = () => new Date) {
+  const valid = await validModuleNames(cwd);
+  if (valid === undefined)
+    return [];
+  const flaggedAt = now().toISOString();
+  const flags = [];
+  const workspaceService = new WorkspaceService({
+    workspaceRoot: cwd,
+    authorizationServer: localWorkspaceAuthorizationServer(),
+    strictGuard: { mode: "strict", availability: "available", decision: "pass", policyRevision: "local-offline-v1" }
+  });
+  const workspaces = await workspaceService.list({ request: undefined, requestCorrelationId: randomUUID22(), includeArchived: true });
+  for (const workspace of workspaces) {
+    const component = workspace.resources.find((r) => r.kind === "component")?.uri;
+    if (component !== undefined && !isStillPresent(component, valid)) {
+      flags.push({ kind: "workspace", ref: workspace.id, missingComponent: normalize3(component), flaggedAt });
+    }
+  }
+  for (const entry of await collectEntries(cwd)) {
+    const module = entry.scopes.module;
+    if (module !== null && module.length > 0 && !isStillPresent(module, valid)) {
+      flags.push({ kind: "memory-entry", ref: entry.relativePath, missingComponent: normalize3(module), flaggedAt });
+    }
+  }
+  for (const decision of await collectWikiDecisionEntries(cwd)) {
+    const module = decision.scopes.module;
+    if (module !== null && module.length > 0 && !isStillPresent(module, valid)) {
+      flags.push({ kind: "wiki-decision", ref: decision.relativePath, missingComponent: normalize3(module), flaggedAt });
+    }
+  }
+  return flags;
+}
+
+// src/sac/catch-up.ts
+async function buildCatchUp(input2) {
+  const [proposals, sessionCategories, lifecycleFlagsAll] = await Promise.all([
+    collectProposals(input2.cwd, input2.workspaceId),
+    collectSessionCategories(input2.cwd),
+    computeLifecycleFlags(input2.cwd)
+  ]);
+  const lifecycleFlags = input2.workspaceId === undefined ? lifecycleFlagsAll : lifecycleFlagsAll.filter((flag) => flag.kind !== "workspace" || flag.ref === input2.workspaceId);
+  return { proposals, ...sessionCategories, lifecycleFlags };
+}
+async function collectProposals(cwd, workspaceId) {
+  const authorizationServer = localWorkspaceAuthorizationServer();
+  const actor = await authorizationServer.actorContextFor(undefined, randomUUID23());
+  if (!actor)
+    throw new Error("trusted ActorContext is required for catch-up");
+  const proposalService = createLocalProposalLifecycleService(cwd);
+  const groups = await proposalService.listVisibleProposedProposals(actor);
+  const scoped = workspaceId === undefined ? groups : groups.filter((group) => group.workspace.id === workspaceId);
+  const flattened = scoped.flatMap((group) => group.proposals.map((proposal) => ({ group, proposal })));
+  return Promise.all(flattened.map(async ({ group, proposal }) => {
+    const fresh = await proposalService.isEvidenceFresh(proposal, actor);
+    return { type: "proposal", workspaceId: group.workspace.id, proposalId: proposal.id, fresh };
+  }));
+}
+async function classifySession(session) {
+  const dir = sessionDir(session.projectPath, session.id);
+  if (await isLockHeld(slateLockPath(dir)))
+    return;
+  const terminalState = await readTerminalState(dir);
+  if (terminalState !== undefined) {
+    const workspaceId2 = (await safeReadSlate(dir))?.workspaceId;
+    return { kind: "blocked", item: { type: "blocked", sessionId: session.id, ...workspaceId2 !== undefined ? { workspaceId: workspaceId2 } : {}, terminalState } };
+  }
+  const unboundCandidate = await readNewestUnboundCandidate(dir);
+  if (unboundCandidate !== undefined) {
+    return {
+      kind: "unbound-candidate",
+      item: { type: "unbound-candidate", sessionId: session.id, evidencePath: unboundCandidate.evidencePath, summary: unboundCandidate.summary }
+    };
+  }
+  if (!await isSlateEngaged(dir))
+    return;
+  const workspaceId = (await safeReadSlate(dir))?.workspaceId;
+  return { kind: "unknown", item: { type: "unknown", sessionId: session.id, ...workspaceId !== undefined ? { workspaceId } : {}, lastSeenAt: session.updatedAt } };
+}
+async function collectSessionCategories(cwd) {
+  const classified = await Promise.all(listSessions(cwd).map((session) => classifySession(session)));
+  const blocked2 = [];
+  const unboundCandidates = [];
+  const unknown = [];
+  for (const category of classified) {
+    if (category === undefined)
+      continue;
+    if (category.kind === "blocked")
+      blocked2.push(category.item);
+    else if (category.kind === "unbound-candidate")
+      unboundCandidates.push(category.item);
+    else
+      unknown.push(category.item);
+  }
+  return { blocked: blocked2, unboundCandidates, unknown };
+}
+async function isSlateEngaged(dir) {
+  if (await pathExists(path145.join(dir, "slate.json")))
+    return true;
+  if (await pathExists(path145.join(dir, "terminal-state.json")))
+    return true;
+  try {
+    const entries = await readdir24(path145.join(dir, "slate-archive"));
+    return entries.length > 0;
+  } catch {
+    return false;
+  }
+}
+async function safeReadSlate(dir) {
+  try {
+    return await readSlate(dir);
+  } catch {
+    return;
+  }
+}
+async function readTerminalState(dir) {
+  const result = readConfigFile(path145.join(dir, "terminal-state.json"));
+  if (!result.ok) {
+    return;
+  }
+  try {
+    return JSON.parse(result.text);
+  } catch {
+    return;
+  }
+}
+async function readNewestUnboundCandidate(dir) {
+  const archiveDir = path145.join(dir, "slate-archive");
+  let entries;
+  try {
+    entries = (await readdir24(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
+  } catch {
+    return;
+  }
+  entries.sort();
+  for (let i = entries.length - 1;i >= 0; i--) {
+    const evidencePath = path145.join(archiveDir, entries[i]);
+    const result = readConfigFile(evidencePath);
+    if (!result.ok) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(result.text);
+      if (parsed.recordType !== "unbound-candidate")
+        continue;
+      return { evidencePath, summary: summarizeUnboundCandidate(parsed.groups) };
+    } catch {
+      continue;
+    }
+  }
+  return;
+}
+function summarizeUnboundCandidate(groups) {
+  const safeGroups = groups ?? [];
+  if (safeGroups.length === 0)
+    return "no seeds captured";
+  const seedCount = safeGroups.reduce((sum, group) => sum + (group.seeds?.length ?? 0), 0);
+  const kinds = safeGroups.map((group) => typeof group.kind === "string" ? group.kind : "unknown").join(", ");
+  return `${seedCount} untriaged seed(s) across ${safeGroups.length} kind(s) (${kinds})`;
+}
+
+// src/tui/inspector-sources.ts
+init_slate();
 
 // src/session/index.ts
 init_paths();
@@ -49912,7 +50122,7 @@ async function loadInspectorWorkspaces(cwd) {
       authorizationServer: localWorkspaceAuthorizationServer(),
       strictGuard: localSacGuard()
     });
-    const listed = await service5.list({ request: undefined, requestCorrelationId: randomUUID22() });
+    const listed = await service5.list({ request: undefined, requestCorrelationId: randomUUID24() });
     return listed.map(workspaceFromManifest);
   } catch {
     return [];
@@ -49925,7 +50135,7 @@ async function loadInspectorWorkspace(cwd, workspaceId) {
       authorizationServer: localWorkspaceAuthorizationServer(),
       strictGuard: localSacGuard()
     });
-    const manifest = await service5.show({ request: undefined, requestCorrelationId: randomUUID22(), workspaceId });
+    const manifest = await service5.show({ request: undefined, requestCorrelationId: randomUUID24(), workspaceId });
     return workspaceFromManifest(manifest);
   } catch {
     return;
@@ -49998,6 +50208,16 @@ function formatWorkspaceLines(workspaces) {
   const width = workspaces.reduce((max, workspace) => Math.max(max, workspace.id.length), 0);
   return workspaces.map((workspace) => `${workspace.id.padEnd(width)}  ${workspace.status}  ${workspace.title}`);
 }
+async function loadInspectorCatchUp(cwd) {
+  try {
+    return await buildCatchUp({ cwd });
+  } catch {
+    return { proposals: [], blocked: [], unboundCandidates: [], unknown: [], lifecycleFlags: [] };
+  }
+}
+function catchUpItems(report) {
+  return [...report.proposals, ...report.blocked, ...report.unboundCandidates, ...report.unknown];
+}
 function formatSessionFlowLines(flows) {
   if (flows.length === 0) {
     return ["No flows recorded in this session."];
@@ -50490,6 +50710,332 @@ function openWorkspace(otui, chrome, options) {
   return presentWorkspace((hostOtui, hostChrome, input2) => openModal(hostOtui, hostChrome, input2), otui, chrome, options);
 }
 
+// src/tui/review-inspector.ts
+var REVIEW_COMMAND = "/review";
+var REVIEW_FOOTER = [
+  { key: "[/]", label: "item" },
+  { key: "a y", label: "accept" },
+  { key: "\u2191/\u2193", label: "scroll" },
+  { key: "\u2190/\u2192", label: "tabs" },
+  { key: "esc", label: "close" }
+];
+function isReviewCommand(line) {
+  const token = line.trim().split(/\s+/)[0] ?? "";
+  return token === REVIEW_COMMAND;
+}
+var TYPE_LABEL = {
+  proposal: "PROPOSAL",
+  blocked: "BLOCKED",
+  "unbound-candidate": "UNBOUND",
+  unknown: "UNKNOWN"
+};
+function summarizeReviewItem(item) {
+  switch (item.type) {
+    case "proposal":
+      return `${item.proposalId} in ${item.workspaceId}${item.fresh ? "" : " (stale)"}`;
+    case "blocked":
+      return `${item.sessionId} \u2014 ${item.terminalState.reason}`;
+    case "unbound-candidate":
+      return `${item.sessionId} \u2014 ${item.summary}`;
+    case "unknown":
+      return `${item.sessionId} \u2014 last seen ${item.lastSeenAt}`;
+  }
+}
+function formatReviewListLines(items, selected) {
+  if (items.length === 0) {
+    return ["Nothing needs review right now."];
+  }
+  return items.map((item, index) => {
+    const mark = index === selected ? ">" : " ";
+    return `${mark} ${TYPE_LABEL[item.type].padEnd(8)} ${summarizeReviewItem(item)}`;
+  });
+}
+function describeReviewItem(item) {
+  switch (item.type) {
+    case "proposal":
+      return [
+        `Proposal   ${item.proposalId}`,
+        `Workspace  ${item.workspaceId}`,
+        `Evidence   ${item.fresh ? "fresh" : "stale \u2014 evidence has drifted since this proposal was created; re-run wrap-up before deciding"}`,
+        "",
+        `Reject/dismiss from a terminal: keryx workspace review ${item.workspaceId} ${item.proposalId} --decision <rejected|dismissed>`
+      ];
+    case "blocked":
+      return [
+        `Session    ${item.sessionId}${item.workspaceId !== undefined ? `  (workspace ${item.workspaceId})` : ""}`,
+        `Stopped unattended: ${item.terminalState.reason}`,
+        `Occurred   ${item.terminalState.occurredAt}`,
+        "",
+        `Resume: keryx shell -r ${item.sessionId}`
+      ];
+    case "unbound-candidate":
+      return [
+        `Session    ${item.sessionId}`,
+        `Untriaged seeds: ${item.summary}`,
+        `Evidence   ${item.evidencePath}`,
+        "",
+        `Bind: keryx workspace propose <workspace-id> --kind <kind> --session ${item.sessionId}`
+      ];
+    case "unknown":
+      return [
+        `Session    ${item.sessionId}${item.workspaceId !== undefined ? `  (workspace ${item.workspaceId})` : ""}`,
+        `Last seen  ${item.lastSeenAt}`,
+        "No proposal, terminal state, or unbound-candidate artifact recorded.",
+        "",
+        `Investigate: keryx sessions list / keryx shell -r ${item.sessionId}`
+      ];
+  }
+}
+function formatReviewDetailLines(item, status) {
+  if (item === undefined) {
+    return ["No item selected.", "", "Press Enter (or click a row) on the Review tab to view one."];
+  }
+  const lines = describeReviewItem(item);
+  if (item.type !== "proposal") {
+    return lines;
+  }
+  const withAction = [...lines, ""];
+  if (status.kind === "armed") {
+    withAction.push("Press [y] to CONFIRM accept, any other key cancels.");
+  } else if (status.kind === "running") {
+    withAction.push("Accepting\u2026 running `keryx workspace confirm-review` then `keryx workspace review`.");
+  } else if (status.kind === "done" && status.outcome.ok) {
+    withAction.push("\u2713 Accepted.");
+  } else if (status.kind === "done" && !status.outcome.ok) {
+    withAction.push(`\u2717 Accept failed: ${status.outcome.message}`);
+  } else {
+    withAction.push("[a] Accept this proposal");
+  }
+  return withAction;
+}
+function clampScroll3(offset, lineCount, height) {
+  const max = Math.max(0, lineCount - height);
+  return Math.min(max, Math.max(0, offset));
+}
+function windowLines3(lines, offset, height) {
+  if (height < 1) {
+    return [];
+  }
+  const start = clampScroll3(offset, lines.length, height);
+  return lines.slice(start, start + height);
+}
+function scrollToReveal3(index, offset, height) {
+  if (index < offset) {
+    return index;
+  }
+  if (index >= offset + height) {
+    return index - height + 1;
+  }
+  return offset;
+}
+function wrapLines3(text, width) {
+  if (width === undefined || width < 8) {
+    return text;
+  }
+  return text.split(`
+`).flatMap((line) => {
+    if (line.length <= width) {
+      return [line];
+    }
+    const chunks = [];
+    for (let i = 0;i < line.length; i += width) {
+      chunks.push(line.slice(i, i + width));
+    }
+    return chunks;
+  }).join(`
+`);
+}
+function paintLines3(otui, renderer, body, lines, width) {
+  if (otui === undefined || otui === null || body === undefined || body === null) {
+    return;
+  }
+  const parent = body;
+  const ctor = otui.TextRenderable;
+  if (parent.add === undefined || ctor === undefined) {
+    return;
+  }
+  const node = new ctor(renderer, { id: "review-body", content: wrapLines3(lines.join(`
+`), width) });
+  parent.add(node);
+  return node;
+}
+function presentReview(openModal2, otui, chrome, options) {
+  const items = [...options.items];
+  let selected = 0;
+  let listScroll = 0;
+  let detailScroll = 0;
+  let status = { kind: "idle" };
+  let listNode;
+  let detailNode;
+  let unsubscribeKey;
+  const rendererHint = options.renderer ?? chrome?.renderer;
+  const bodyRows = options.visibleRows ?? (typeof rendererHint?.width === "number" && typeof rendererHint.height === "number" ? modalBodyRows(resolveModalPanelSize(rendererHint.width, rendererHint.height).height) : 13);
+  let tabWidth;
+  const listLines = () => formatReviewListLines(items, selected);
+  const detailLines = () => wrapLines3(formatReviewDetailLines(items[selected], status).join(`
+`), tabWidth).split(`
+`);
+  const paintSelection = () => {
+    listScroll = scrollToReveal3(selected, listScroll, bodyRows);
+    listScroll = clampScroll3(listScroll, items.length, bodyRows);
+    detailScroll = clampScroll3(detailScroll, detailLines().length, bodyRows);
+    if (listNode !== undefined) {
+      listNode.content = windowLines3(listLines(), listScroll, bodyRows).join(`
+`);
+    }
+    if (detailNode !== undefined) {
+      detailNode.content = windowLines3(detailLines(), detailScroll, bodyRows).join(`
+`);
+    }
+  };
+  const moveSelection = (next) => {
+    if (items.length === 0) {
+      return;
+    }
+    const clamped = Math.min(items.length - 1, Math.max(0, next));
+    if (clamped === selected) {
+      return;
+    }
+    selected = clamped;
+    detailScroll = 0;
+    status = { kind: "idle" };
+    paintSelection();
+  };
+  const runAccept = () => {
+    const item = items[selected];
+    if (item === undefined || item.type !== "proposal" || options.acceptProposal === undefined) {
+      return;
+    }
+    status = { kind: "running" };
+    paintSelection();
+    options.acceptProposal(item).then((outcome) => {
+      status = { kind: "done", outcome };
+      if (outcome.ok) {
+        options.onAccepted?.(item);
+      }
+      paintSelection();
+    });
+  };
+  const handle = openModal2(otui, chrome, {
+    title: REVIEW_COMMAND,
+    tabs: [
+      { id: "list", label: "Review" },
+      { id: "detail", label: "Detail" }
+    ],
+    initialTab: "list",
+    footer: REVIEW_FOOTER,
+    renderTab: (tabId, body, ctx) => {
+      const renderer = options.renderer ?? chrome?.renderer;
+      tabWidth = ctx?.width;
+      if (tabId === "list") {
+        listScroll = scrollToReveal3(selected, listScroll, bodyRows);
+        listNode = paintLines3(otui, renderer, body, windowLines3(listLines(), listScroll, bodyRows));
+        return;
+      }
+      detailScroll = clampScroll3(detailScroll, detailLines().length, bodyRows);
+      detailNode = paintLines3(otui, renderer, body, windowLines3(detailLines(), detailScroll, bodyRows), tabWidth);
+    },
+    onClose: () => {
+      unsubscribeKey?.();
+    }
+  });
+  if (handle === undefined) {
+    return;
+  }
+  if (options.onKeypress !== undefined) {
+    unsubscribeKey = options.onKeypress((key) => {
+      const token = key.name || key.sequence;
+      if (items.length === 0) {
+        return;
+      }
+      const onDetail = handle.activeTab() === "detail";
+      if (onDetail && status.kind === "armed") {
+        if (token === "y") {
+          runAccept();
+        } else {
+          status = { kind: "idle" };
+          paintSelection();
+        }
+        return;
+      }
+      if (token === "[" || token === "p") {
+        moveSelection(selected - 1);
+        return;
+      }
+      if (token === "]" || token === "n") {
+        moveSelection(selected + 1);
+        return;
+      }
+      if (token === "return" || token === "enter") {
+        handle.setTab("detail");
+        return;
+      }
+      if (onDetail && token === "a" && items[selected]?.type === "proposal" && options.acceptProposal !== undefined && status.kind !== "running") {
+        status = { kind: "armed" };
+        paintSelection();
+        return;
+      }
+      if (token === "up" || token === "k") {
+        if (onDetail) {
+          detailScroll = clampScroll3(detailScroll - 1, detailLines().length, bodyRows);
+          paintSelection();
+        } else {
+          moveSelection(selected - 1);
+        }
+        return;
+      }
+      if (token === "down" || token === "j") {
+        if (onDetail) {
+          detailScroll = clampScroll3(detailScroll + 1, detailLines().length, bodyRows);
+          paintSelection();
+        } else {
+          moveSelection(selected + 1);
+        }
+        return;
+      }
+      if (onDetail && (token === "pageup" || token === "pagedown")) {
+        const step = token === "pageup" ? -bodyRows : bodyRows;
+        detailScroll = clampScroll3(detailScroll + step, detailLines().length, bodyRows);
+        paintSelection();
+      }
+    });
+  }
+  return handle;
+}
+function openReview(otui, chrome, options) {
+  return presentReview((hostOtui, hostChrome, input2) => openModal(hostOtui, hostChrome, input2), otui, chrome, options);
+}
+
+// src/tui/review-accept.ts
+function shQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+async function acceptProposalViaShell(run, workspaceId, proposalId) {
+  const mint = await run(`keryx workspace confirm-review ${shQuote(workspaceId)} ${shQuote(proposalId)}`);
+  if (mint.isError) {
+    return { ok: false, message: mint.output };
+  }
+  let token;
+  try {
+    const parsed = JSON.parse(mint.output);
+    const candidate = parsed?.token;
+    if (typeof candidate !== "string" || candidate.length === 0) {
+      throw new Error("no token in confirm-review output");
+    }
+    token = candidate;
+  } catch (cause) {
+    return {
+      ok: false,
+      message: `could not parse \`keryx workspace confirm-review\` output: ${cause instanceof Error ? cause.message : String(cause)}`
+    };
+  }
+  const accept = await run(`keryx workspace review ${shQuote(workspaceId)} ${shQuote(proposalId)} --decision accepted --confirm-token ${shQuote(token)}`);
+  if (accept.isError) {
+    return { ok: false, message: accept.output };
+  }
+  return { ok: true };
+}
+
 // src/tui/tui-shell.ts
 init_slate();
 
@@ -50854,6 +51400,11 @@ var AGENT_SLASH_COMMANDS = [
     description: "Show this session's SAC workspace and its slates",
     modes: AGENT_ONLY
   },
+  {
+    name: "/review",
+    description: "Show project-wide items needing review (proposals, blocked sessions)",
+    modes: AGENT_ONLY
+  },
   {
     name: "/compact",
     description: "Compact model context \u2014 /compact [focus] (archive kept)",
@@ -51217,10 +51768,10 @@ init_shell_config();
 // src/lib/permission-mode-config.ts
 init_permission_mode();
 init_config_dir();
-import path145 from "path";
+import path146 from "path";
 var EMPTY3 = { schemaVersion: 1, projects: {} };
 function permissionModeConfigPath(dir) {
-  return path145.join(keryxConfigDir(dir), "permission-mode.json");
+  return path146.join(keryxConfigDir(dir), "permission-mode.json");
 }
 function withRegistryLock2(dir, fn) {
   return withFileLock(`${permissionModeConfigPath(dir)}.lock`, fn, {
@@ -51565,7 +52116,7 @@ function showComposerChoice(otui, r, dock, request) {
 // src/lib/version-check.ts
 init_config_dir();
 init_fs();
-import path146 from "path";
+import path147 from "path";
 var REGISTRY_URL = "https://registry.npmjs.org/@mrciphersmith%2Fkeryx/latest";
 var FIXED_INSTALL_COMMAND = "npm install -g @mrciphersmith/keryx@latest";
 var RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
@@ -51767,7 +52318,7 @@ async function checkVersion(options) {
   const now = options.now ?? Date.now;
   const timestamp = now();
   const configDir = ensureKeryxConfigDir(options.cacheDir);
-  const cacheFile = path146.join(configDir, "version-check.json");
+  const cacheFile = path147.join(configDir, "version-check.json");
   const cache = parseCache(cacheFile);
   if (cache?.latestVersion !== undefined && cache.successAt !== undefined && timestamp - cache.successAt >= 0 && timestamp - cache.successAt < SUCCESS_CACHE_TTL_MS) {
     return resultFor(options.currentVersion, current, cache.latestVersion, "cache");
@@ -53950,6 +54501,20 @@ async function launchTuiAgentShell(opts) {
       currentSlates = slates;
       sbWorkspaceV.content = workspace === undefined ? otui.t`${otui.dim("\u2014")}` : otui.t`${otui.dim(`${shortenCwd(workspace.title, SIDEBAR_TEXT_WIDTH)} \xB7 ${workspace.status} \xB7 ${slates.length} slate${slates.length === 1 ? "" : "s"}`)}`;
     };
+    sidebar.add(new otui.TextRenderable(r, { id: "sb-review-k", content: otui.t`${otui.dim("Review")}`, marginTop: 1 }));
+    const sbReviewV = new otui.TextRenderable(r, {
+      id: "sb-review-v",
+      content: otui.t`${otui.dim("\u2014")}`,
+      onMouseDown: () => {
+        showReview();
+      }
+    });
+    sidebar.add(sbReviewV);
+    const refreshReviewSidebar = async () => {
+      const cwd = opts.session?.cwd ?? process.cwd();
+      const count = catchUpItems(await loadInspectorCatchUp(cwd)).length;
+      sbReviewV.content = count === 0 ? otui.t`${otui.dim("\u2014 nothing to review")}` : otui.t`${otui.yellow(`${count} item${count === 1 ? "" : "s"} need review`)}`;
+    };
     sidebar.add(new otui.TextRenderable(r, { id: "sb-ctx-k", content: otui.t`${otui.dim("Context")}`, marginTop: 1 }));
     const sbContext = new otui.TextRenderable(r, { id: "sb-ctx-v", content: otui.t`${otui.dim("0 tokens")}` });
     sidebar.add(sbContext);
@@ -54390,6 +54955,7 @@ async function launchTuiAgentShell(opts) {
     }
     slateSession = { dir: liveSession.dir, cwd: sessionCwd, opened: false };
     refreshWorkspaceSidebar();
+    refreshReviewSidebar();
     const paintSessionHeader = () => {
       const label = `${currentSel.provider}/${currentSel.model}`;
       const sid = shortSessionId(liveSession.summary.id);
@@ -54559,6 +55125,21 @@ Staying in the current session.
         });
       })();
     };
+    const showReview = () => {
+      (async () => {
+        const cwd = inspectorCwd();
+        const items = catchUpItems(await loadInspectorCatchUp(cwd));
+        openReview(otui, chrome, {
+          items,
+          acceptProposal: (item) => acceptProposalViaShell(makeCommandRunner(cwd), item.workspaceId, item.proposalId),
+          onAccepted: () => {
+            refreshReviewSidebar();
+          },
+          renderer: r,
+          ...inspectorKeys
+        });
+      })();
+    };
     const updateModelLabels = () => {
       paintSessionHeader();
       const label = `${currentSel.provider}/${currentSel.model}`;
@@ -55078,6 +55659,7 @@ Staying in the current session.
             startNewSession();
             slateSession = { dir: liveSession.dir, cwd: sessionCwd, opened: false };
             refreshWorkspaceSidebar();
+            refreshReviewSidebar();
             sessions.clear();
             deps.resetSubagentBudget?.();
             io.onSystem?.(`New session ${shortSessionId(liveSession.summary.id)} (previous kept on disk \xB7 /resume)
@@ -55216,6 +55798,10 @@ Staying in the current session.
           showWorkspace();
           return;
         }
+        if (isReviewCommand(command.name)) {
+          showReview();
+          return;
+        }
         if (command.name === "/copy") {
           const target = newestBlock();
           if (target === undefined || !copyBlock(target.id)) {
@@ -55535,6 +56121,7 @@ ${formatThemeList(getThemeId())}`);
         const secs = ((Date.now() - startedAt) / 1000).toFixed(1);
         stopBusy();
         refreshWorkspaceSidebar();
+        refreshReviewSidebar();
         setMainAgent(turnFailed ? "failed" : "done", turnFailed ? "error" : "idle");
         try {
           flushSessionCheckpoint();
@@ -56903,7 +57490,7 @@ ${indentBlock(style.dim(context), GUTTER)}`);
         out(`${GUTTER}${style.yellow(hint)}
 `);
       }
-      const rememberable = !evaled.destructive && !evaled.credentials;
+      const rememberable = !evaled.destructive && !evaled.credentials && !evaled.sacReviewConfirmation;
       const prompt = rememberable ? "[y/N/A=always] " : "[y/N] ";
       out(`
 ${GUTTER}${style.yellow(`Run: ${evaled.command}`)} ${style.dim(prompt)}`);
@@ -57445,7 +58032,7 @@ async function shellCommand(args2, runtime = {}) {
           modelId: sel.model
         }),
         maxToolCalls: resolveAgentMaxToolCalls(),
-        idSeq: () => randomUUID23(),
+        idSeq: () => randomUUID25(),
         ...resetSubagentBudget !== undefined ? { resetSubagentBudget } : {}
       };
     };
@@ -57477,7 +58064,7 @@ async function shellCommand(args2, runtime = {}) {
         makeShellDeps: (sel) => ({
           makeProvider: chatFactory,
           clock: () => new Date().toISOString(),
-          idSeq: () => randomUUID23(),
+          idSeq: () => randomUUID25(),
           initial: sel,
           session: {
             cwd,
@@ -57548,7 +58135,7 @@ async function shellCommand(args2, runtime = {}) {
     const deps = {
       makeProvider: baseFactory,
       clock: () => new Date().toISOString(),
-      idSeq: () => randomUUID23(),
+      idSeq: () => randomUUID25(),
       initial: baseUrl2 === undefined ? { provider, model } : { provider, model, baseUrl: baseUrl2 },
       selectProviderModel: realSelectProviderModel(baseUrl2)
     };
@@ -57599,7 +58186,7 @@ async function shellCommand(args2, runtime = {}) {
           modelId: model
         }),
         maxToolCalls: resolveAgentMaxToolCalls(),
-        idSeq: () => randomUUID23(),
+        idSeq: () => randomUUID25(),
         ...resetSubagentBudget !== undefined ? { resetSubagentBudget } : {}
       };
       let resumeId = flags.resumeId;
@@ -57771,7 +58358,7 @@ Shell:
 init_fs();
 import { readFile as readFile78 } from "fs/promises";
 import { stdin } from "process";
-import path147 from "path";
+import path148 from "path";
 var MODULES = [
   { name: "gdgraph", flag: "--no-gdgraph", desc: "code graph, symbols, affected context", defaultEnabled: true },
   { name: "gdctx", flag: "--no-gdctx", desc: "token-aware command/read output", defaultEnabled: true },
@@ -57817,8 +58404,8 @@ async function modulesCommand(args2 = []) {
     return;
   }
   const wantsJson = args2.includes("--json") && (sub === undefined || sub === "status" || sub === "list" || sub === "--json");
-  const metaprojectRoot = path147.join(process.cwd(), ".metaproject");
-  const manifestPath = path147.join(metaprojectRoot, "metaproject.json");
+  const metaprojectRoot = path148.join(process.cwd(), ".metaproject");
+  const manifestPath = path148.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     if (wantsJson) {
       console.log(JSON.stringify({ schemaVersion: 1, error: "not-initialized", modules: [] }, null, 2));
@@ -57932,18 +58519,18 @@ function printHelp16() {
 }
 
 // src/commands/serve.ts
-import { randomUUID as randomUUID26 } from "crypto";
+import { randomUUID as randomUUID28 } from "crypto";
 
 // src/lib/serve-config.ts
 init_config_dir();
 import { existsSync as existsSync27 } from "fs";
-import path148 from "path";
+import path149 from "path";
 var SERVE_CONFIG_SCHEMA_VERSION = "1.0.0";
 var DEFAULT_SERVE_BIND_ADDRESS = "127.0.0.1";
 var DEFAULT_SERVE_PORT = 7377;
 var DEFAULT_SERVE_PROFILE = "remote-restricted";
 function serveConfigPath(dir) {
-  return path148.join(keryxConfigDir(dir), "serve.json");
+  return path149.join(keryxConfigDir(dir), "serve.json");
 }
 function parseIpv4(value) {
   const parts = value.split(".");
@@ -58259,7 +58846,7 @@ function saveServeConfig(config, dir, onWarn) {
 
 // src/lib/serve-credential.ts
 init_config_dir();
-import { createHash as createHash33, randomBytes as randomBytes3, randomUUID as randomUUID24 } from "crypto";
+import { createHash as createHash33, randomBytes as randomBytes3, randomUUID as randomUUID26 } from "crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync3,
@@ -58271,9 +58858,9 @@ import {
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync8
 } from "fs";
-import path149 from "path";
+import path150 from "path";
 function serveCredentialPath(dir) {
-  return path149.join(keryxConfigDir(dir), "serve-credentials.json");
+  return path150.join(keryxConfigDir(dir), "serve-credentials.json");
 }
 function constantTimeEqual(a, b) {
   const width = Math.max(a.length, b.length);
@@ -58343,7 +58930,7 @@ function readServeCredential(dir) {
 }
 function writeStore(store, dir) {
   const file = serveCredentialPath(dir);
-  const temp = `${file}.${randomUUID24()}.tmp`;
+  const temp = `${file}.${randomUUID26()}.tmp`;
   try {
     ensureKeryxConfigDir(dir);
     const handle = openSync3(temp, "wx", 384);
@@ -58383,7 +58970,7 @@ function mintRecord(now) {
   const salt = randomBytes3(32).toString("hex");
   return {
     token,
-    record: { id: randomUUID24(), algorithm: "sha256", salt, hash: hashToken(salt, token), createdAt: now }
+    record: { id: randomUUID26(), algorithm: "sha256", salt, hash: hashToken(salt, token), createdAt: now }
   };
 }
 function issueServeToken(dir, now = () => new Date().toISOString(), onWaiting) {
@@ -58507,22 +59094,22 @@ class AuthFailureThrottle {
 init_config_dir();
 import { createHash as createHash34 } from "crypto";
 import { existsSync as existsSync29, readdirSync as readdirSync2, rmSync as rmSync2 } from "fs";
-import path150 from "path";
+import path151 from "path";
 var MAX_TURN_EVENTS = 1e4;
 function turnsRoot(dir) {
-  return path150.join(keryxConfigDir(dir), "turns");
+  return path151.join(keryxConfigDir(dir), "turns");
 }
 function turnDir(turnId, dir) {
-  return path150.join(turnsRoot(dir), turnId);
+  return path151.join(turnsRoot(dir), turnId);
 }
 function keyPath(project, idempotencyKey, dir) {
   const projectBytes = Buffer.byteLength(project, "utf8");
   const digest2 = createHash34("sha256").update(`${projectBytes}:${project}\x00${idempotencyKey}`, "utf8").digest("hex");
-  return path150.join(turnsRoot(dir), "keys", `${digest2}.json`);
+  return path151.join(turnsRoot(dir), "keys", `${digest2}.json`);
 }
 function legacyKeyPath(idempotencyKey, dir) {
   const digest2 = createHash34("sha256").update(idempotencyKey, "utf8").digest("hex");
-  return path150.join(turnsRoot(dir), "keys", `${digest2}.json`);
+  return path151.join(turnsRoot(dir), "keys", `${digest2}.json`);
 }
 function adoptLegacyClaim(project, idempotencyKey, dir) {
   const legacy = legacyKeyPath(idempotencyKey, dir);
@@ -58586,7 +59173,7 @@ function ensureTurnDir(turnId, dir) {
 }
 function createTurnRecord(record, dir) {
   ensureTurnDir(record.turnId, dir);
-  writeOwnerOnlyFile(path150.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
+  writeOwnerOnlyFile(path151.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
 `);
 }
 function appendTurnEvent(event, dir, opts) {
@@ -58595,12 +59182,12 @@ function appendTurnEvent(event, dir, opts) {
   }
   const line = JSON.stringify(event);
   try {
-    appendOwnerOnlyLine(path150.join(turnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path151.join(turnDir(event.turnId, dir), "events.jsonl"), line);
   } catch (error2) {
     if (error2?.code !== "ENOENT") {
       throw error2;
     }
-    appendOwnerOnlyLine(path150.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path151.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
   }
   return true;
 }
@@ -58608,7 +59195,7 @@ function readTurnEvents(turnId, after = -1, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path150.join(turnDir(turnId, dir), "events.jsonl"));
+  const read = readTurnFile(path151.join(turnDir(turnId, dir), "events.jsonl"));
   if (!read.ok) {
     if (isDefiniteAbsence2(read.reason)) {
       return { ok: true, value: [] };
@@ -58636,7 +59223,7 @@ function readTurnRecord(turnId, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path150.join(turnDir(turnId, dir), "turn.json"));
+  const read = readTurnFile(path151.join(turnDir(turnId, dir), "turn.json"));
   if (!read.ok) {
     return { ok: false, reason: read.reason };
   }
@@ -58655,7 +59242,7 @@ function finishTurn(turnId, result, dir) {
   if (!record.ok) {
     return false;
   }
-  writeOwnerOnlyFile(path150.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
+  writeOwnerOnlyFile(path151.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
 `);
   return true;
 }
@@ -58700,8 +59287,8 @@ function releaseIdempotencyKey(project, idempotencyKey, turnId, dir) {
 }
 
 // src/lib/serve-turn.ts
-import { randomUUID as randomUUID25 } from "crypto";
-import path151 from "path";
+import { randomUUID as randomUUID27 } from "crypto";
+import path152 from "path";
 init_service();
 var REMOTE_ORIGIN = "remote:http";
 var MAX_PROMPT_CHARS = 32000;
@@ -58770,9 +59357,9 @@ function isUuid(value) {
   return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value);
 }
 function resolveProject(declared, dir) {
-  const wanted = path151.resolve(declared);
+  const wanted = path152.resolve(declared);
   for (const entry of listProjects(dir, () => {})) {
-    if (path151.resolve(entry.path) === wanted) {
+    if (path152.resolve(entry.path) === wanted) {
       return { ok: true, project: entry.path };
     }
   }
@@ -58819,7 +59406,7 @@ async function redactOut(security, text) {
 async function runRemoteTurn(input2) {
   const scanRoot = input2.scanRoot;
   const security = createSecurityService(scanRoot);
-  const newId = input2.newId ?? (() => randomUUID25());
+  const newId = input2.newId ?? (() => randomUUID27());
   const clock = input2.clock ?? (() => new Date().toISOString());
   const turnId = input2.turnId ?? newId();
   const sessionId = input2.request.sessionId ?? newId();
@@ -58962,7 +59549,7 @@ function outcomeOf(status, gate, unresolvedBlockerIds) {
 }
 function createSubmitTurn(deps) {
   return async (request, project) => {
-    const turnId = (deps.newId ?? (() => randomUUID25()))();
+    const turnId = (deps.newId ?? (() => randomUUID27()))();
     const scanned = await scanPrompt(deps.dir, request.prompt);
     if (scanned.rejected) {
       return { kind: "rejected" };
@@ -59649,7 +60236,7 @@ function runConfig(args2) {
       return;
     }
     const credential2 = readServeCredential();
-    const credentialId = credential2.status === "ok" ? credential2.record.id : randomUUID26();
+    const credentialId = credential2.status === "ok" ? credential2.record.id : randomUUID28();
     const config = defaultServeConfig(credentialId, {
       address: parsed.parsed.values.get("--bind") ?? DEFAULT_SERVE_BIND_ADDRESS,
       port: port ?? DEFAULT_SERVE_PORT,
@@ -59805,9 +60392,9 @@ function printHelp17() {
 
 // src/commands/update.ts
 import { spawn as spawn5 } from "child_process";
-import { chmod as chmod4, mkdir as mkdir54, readFile as readFile79, readdir as readdir24, writeFile as writeFile48 } from "fs/promises";
+import { chmod as chmod4, mkdir as mkdir54, readFile as readFile79, readdir as readdir25, writeFile as writeFile48 } from "fs/promises";
 import { access as access4, constants as constants2, existsSync as existsSync30 } from "fs";
-import path152 from "path";
+import path153 from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 init_config();
 init_config2();
@@ -59823,8 +60410,8 @@ async function updateCommand(args2 = []) {
     return;
   }
   const projectRoot = process.cwd();
-  const metaprojectRoot = path152.join(projectRoot, ".metaproject");
-  banner("keryx update", `Refreshing the .metaproject workspace in ${path152.basename(projectRoot)}/`);
+  const metaprojectRoot = path153.join(projectRoot, ".metaproject");
+  banner("keryx update", `Refreshing the .metaproject workspace in ${path153.basename(projectRoot)}/`);
   if (!await pathExists(metaprojectRoot)) {
     console.log(`  ${style.red(symbols.cross)} Metaproject is not initialized.`);
     console.log(`  ${style.cyan(symbols.arrow)} Run ${style.cyan("keryx init")} first.`);
@@ -59870,12 +60457,12 @@ async function updateCommand(args2 = []) {
   nextSteps(steps);
 }
 async function refreshServiceFiles(projectRoot, options) {
-  const metaprojectRoot = path152.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path153.join(projectRoot, ".metaproject");
   const manifestState = await readManifest5(metaprojectRoot);
   const manifest = manifestState.manifest;
   const recoveredManifest = !manifestState.exists || !manifestState.valid;
   if (manifestState.migrated) {
-    await writeFile48(path152.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+    await writeFile48(path153.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   }
   const enableGdgraph = moduleEnabled2(manifest, "gdgraph");
@@ -59912,11 +60499,11 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     enableSac
   });
-  await writeTextIfChanged4(path152.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
-  await writeTextIfChanged4(path152.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
-  await writeTextIfChanged4(path152.join(metaprojectRoot, "rules", "README.md"), renderProjectRulesReadme());
-  await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
-  await writeTextIfChanged4(path152.join(metaprojectRoot, "index.md"), renderIndexMarkdown({
+  await writeTextIfChanged4(path153.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
+  await writeTextIfChanged4(path153.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
+  await writeTextIfChanged4(path153.join(metaprojectRoot, "rules", "README.md"), renderProjectRulesReadme());
+  await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
+  await writeTextIfChanged4(path153.join(metaprojectRoot, "index.md"), renderIndexMarkdown({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -59929,7 +60516,7 @@ async function refreshServiceFiles(projectRoot, options) {
     ruleSources,
     hasDistilledEntrypoints: await hasDistilledEntrypoints(metaprojectRoot)
   }));
-  await writeTextIfChanged4(path152.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
+  await writeTextIfChanged4(path153.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -59941,7 +60528,7 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     data: dashboardData
   }));
-  await writeTextIfMissing4(path152.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
+  await writeTextIfMissing4(path153.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -59954,31 +60541,31 @@ async function refreshServiceFiles(projectRoot, options) {
   }));
   if (enableGdgraph) {
     await installGdgraphCoreScripts2(metaprojectRoot);
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
     await seedAssetsLock(metaprojectRoot);
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdgraph-post-commit", renderGdgraphPostCommitHook());
     }
   }
   if (enableGdctx) {
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
   }
   if (enableGdwiki) {
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdwiki-post-commit", renderGdwikiPostCommitHook());
     }
   }
   if (enableSac) {
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
   }
   if (enableGdskills) {
     await installGdskills(metaprojectRoot, gdskillsProfile, { createDataDirs: false });
@@ -59987,25 +60574,25 @@ async function refreshServiceFiles(projectRoot, options) {
     }
   }
   if (enableHealth) {
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
     if (manifest.modules?.health?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "health-post-commit", renderHealthPostCommitHook());
     }
   }
   if (enableTesting) {
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
       postCommitRefresh: Boolean(manifest.modules?.testing?.hooks?.gitPostCommit),
       prePushGate: Boolean(manifest.modules?.testing?.hooks?.prePush)
     }));
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
     if (enableGdwiki) {
-      await writeTextIfMissing4(path152.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
-      await writeTextIfMissing4(path152.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
+      await writeTextIfMissing4(path153.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
+      await writeTextIfMissing4(path153.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
     }
     if (manifest.modules?.testing?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "testing-post-commit", renderTestingPostCommitHook());
@@ -60018,24 +60605,24 @@ async function refreshServiceFiles(projectRoot, options) {
     await installManagedHook2(projectRoot, "post-commit", "metaproject-dashboard-post-commit", renderMetaprojectDashboardPostCommitHook());
   }
   if (enableMemory) {
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
   }
   if (enableTasks) {
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
   }
   if (enableSecurity) {
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
     if (manifest.modules?.security?.hooks?.prePush) {
       await installManagedHook2(projectRoot, "pre-push", "security-pre-push", renderSecurityPrePushHook());
     }
@@ -60086,13 +60673,13 @@ async function refreshServiceFiles(projectRoot, options) {
   };
 }
 async function buildDashboard(projectRoot = process.cwd()) {
-  const metaprojectRoot = path152.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path153.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
   const manifest = (await readManifest5(metaprojectRoot)).manifest;
   const data = await collectDashboardData(metaprojectRoot);
-  const dashboardPath = path152.join(metaprojectRoot, "keryx-dashboard.html");
+  const dashboardPath = path153.join(metaprojectRoot, "keryx-dashboard.html");
   await writeTextIfChanged4(dashboardPath, renderMetaprojectDashboardHtml({
     enableGdgraph: moduleEnabled2(manifest, "gdgraph"),
     enableGdctx: moduleEnabled2(manifest, "gdctx"),
@@ -60112,7 +60699,7 @@ async function shouldInstallDashboardPostCommitHook(projectRoot, manifest) {
   if (Object.values(modules).some((module) => Boolean(module.hooks?.gitPostCommit))) {
     return true;
   }
-  const hookPath = path152.join(projectRoot, ".git", "hooks", "post-commit");
+  const hookPath = path153.join(projectRoot, ".git", "hooks", "post-commit");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -60132,11 +60719,11 @@ async function collectDashboardData(metaprojectRoot) {
   if (testing) {
     data.testing = testing;
   }
-  const wiki = await collectMarkdownPages(path152.join(metaprojectRoot, "wiki"), "wiki");
+  const wiki = await collectMarkdownPages(path153.join(metaprojectRoot, "wiki"), "wiki");
   if (wiki.length > 0) {
     data.wiki = { pages: wiki };
   }
-  const memory = await collectMarkdownPages(path152.join(metaprojectRoot, "memory"), "memory");
+  const memory = await collectMarkdownPages(path153.join(metaprojectRoot, "memory"), "memory");
   if (memory.length > 0) {
     data.memory = { entries: memory };
   }
@@ -60151,19 +60738,19 @@ async function collectDashboardData(metaprojectRoot) {
   return data;
 }
 async function collectTasksDashboardData(metaprojectRoot) {
-  const flowsRoot2 = path152.join(metaprojectRoot, "flows");
+  const flowsRoot2 = path153.join(metaprojectRoot, "flows");
   if (!await pathExists(flowsRoot2)) {
     return null;
   }
   let dirEntries;
   try {
-    dirEntries = (await readdir24(flowsRoot2, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^\d{3}-/.test(entry.name)).map((entry) => entry.name).sort();
+    dirEntries = (await readdir25(flowsRoot2, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^\d{3}-/.test(entry.name)).map((entry) => entry.name).sort();
   } catch {
     return null;
   }
   const flows = [];
   for (const dir of dirEntries) {
-    const flowPath = path152.join(flowsRoot2, dir, "flow.json");
+    const flowPath = path153.join(flowsRoot2, dir, "flow.json");
     if (!await pathExists(flowPath)) {
       continue;
     }
@@ -60171,7 +60758,7 @@ async function collectTasksDashboardData(metaprojectRoot) {
       const flow = JSON.parse(await readFile79(flowPath, "utf8"));
       const tasks = Array.isArray(flow.tasks) ? flow.tasks : [];
       let acTotal = 0;
-      const acPath2 = path152.join(flowsRoot2, dir, "acceptance-criteria.md");
+      const acPath2 = path153.join(flowsRoot2, dir, "acceptance-criteria.md");
       if (await pathExists(acPath2)) {
         const acContent = await readFile79(acPath2, "utf8");
         acTotal = (acContent.match(/^- AC\d+:/gm) ?? []).length;
@@ -60225,7 +60812,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
     "data/testing/context.md"
   ];
   for (const href of staticHrefs) {
-    const filePath = path152.join(metaprojectRoot, ...href.split("/"));
+    const filePath = path153.join(metaprojectRoot, ...href.split("/"));
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -60242,7 +60829,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
   return docs;
 }
 async function collectHealthDashboardData(metaprojectRoot) {
-  const reportPath2 = path152.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
+  const reportPath2 = path153.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
   if (!await pathExists(reportPath2)) {
     return;
   }
@@ -60351,8 +60938,8 @@ function metricToScope(metric) {
   };
 }
 async function collectGraphDashboardData(metaprojectRoot) {
-  const nodesPath = path152.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
-  const edgesPath = path152.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
+  const nodesPath = path153.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
+  const edgesPath = path153.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
   if (!await pathExists(nodesPath) || !await pathExists(edgesPath)) {
     return;
   }
@@ -60403,8 +60990,8 @@ async function collectGraphDashboardData(metaprojectRoot) {
   };
 }
 async function collectTestingDashboardData(metaprojectRoot) {
-  const reportPath2 = path152.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
-  const contextPath = path152.join(metaprojectRoot, "data", "testing", "context.md");
+  const reportPath2 = path153.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
+  const contextPath = path153.join(metaprojectRoot, "data", "testing", "context.md");
   if (await pathExists(reportPath2)) {
     const report = JSON.parse(await readFile79(reportPath2, "utf8"));
     const totalTests = numberOrUndefined(report.total);
@@ -60433,7 +61020,7 @@ async function collectMarkdownPages(root, hrefPrefix) {
   const files = await listMarkdownFiles(root);
   const pages = [];
   for (const filePath of files.slice(0, 40)) {
-    const relativePath = path152.relative(root, filePath).split(path152.sep).join("/");
+    const relativePath = path153.relative(root, filePath).split(path153.sep).join("/");
     if (relativePath === "index.md" || relativePath.startsWith("templates/")) {
       continue;
     }
@@ -60451,10 +61038,10 @@ async function collectMarkdownPages(root, hrefPrefix) {
   return pages;
 }
 async function listMarkdownFiles(root) {
-  const entries = await readdir24(root, { withFileTypes: true });
+  const entries = await readdir25(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const fullPath = path152.join(root, entry.name);
+    const fullPath = path153.join(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listMarkdownFiles(fullPath));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -60502,7 +61089,7 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
   const manifest = {
     schemaVersion: 1,
     standardVersion: STANDARD_VERSION,
-    name: `${path152.basename(path152.dirname(metaprojectRoot))}-metaproject`,
+    name: `${path153.basename(path153.dirname(metaprojectRoot))}-metaproject`,
     createdBy: "keryx",
     profiles: computeProfiles(enabledModuleKeys2),
     paths: {
@@ -60603,11 +61190,11 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
       metaproject: ".metaproject/index.md"
     }
   };
-  await writeFile48(path152.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+  await writeFile48(path153.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
 }
 async function enableTasksInManifest(metaprojectRoot) {
-  const manifestPath = path152.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path153.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -60630,7 +61217,7 @@ async function enableTasksInManifest(metaprojectRoot) {
 `, "utf8");
 }
 async function updateManifestAgentEntrypoints(metaprojectRoot, ruleSources) {
-  const manifestPath = path152.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path153.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -60666,72 +61253,72 @@ async function updateRuntime(projectRoot) {
   }
 }
 async function findRuntimeRoot(projectRoot) {
-  const projectRuntime = path152.join(projectRoot, ".metaproject", "runtime", "keryx");
-  if (await pathExists(path152.join(projectRuntime, ".git"))) {
+  const projectRuntime = path153.join(projectRoot, ".metaproject", "runtime", "keryx");
+  if (await pathExists(path153.join(projectRuntime, ".git"))) {
     return projectRuntime;
   }
   const home = process.env.HOME;
   if (!home) {
     return null;
   }
-  const globalRuntime = path152.join(home, ".keryx", "keryx");
-  if (await pathExists(path152.join(globalRuntime, ".git"))) {
+  const globalRuntime = path153.join(home, ".keryx", "keryx");
+  if (await pathExists(path153.join(globalRuntime, ".git"))) {
     return globalRuntime;
   }
   return null;
 }
 async function createServiceDirs(metaprojectRoot, modules) {
   const dirs = [
-    path152.join(metaprojectRoot, "core"),
-    path152.join(metaprojectRoot, "hooks", "post-update.d"),
-    path152.join(metaprojectRoot, "modules"),
-    path152.join(metaprojectRoot, "rules"),
-    path152.join(metaprojectRoot, "skills", "project-rules"),
+    path153.join(metaprojectRoot, "core"),
+    path153.join(metaprojectRoot, "hooks", "post-update.d"),
+    path153.join(metaprojectRoot, "modules"),
+    path153.join(metaprojectRoot, "rules"),
+    path153.join(metaprojectRoot, "skills", "project-rules"),
     ...modules.enableGdgraph ? [
-      path152.join(metaprojectRoot, "core", "gdgraph"),
-      path152.join(metaprojectRoot, "skills", "gdgraph")
+      path153.join(metaprojectRoot, "core", "gdgraph"),
+      path153.join(metaprojectRoot, "skills", "gdgraph")
     ] : [],
     ...modules.enableGdctx ? [
-      path152.join(metaprojectRoot, "core", "gdctx"),
-      path152.join(metaprojectRoot, "skills", "gdctx")
+      path153.join(metaprojectRoot, "core", "gdctx"),
+      path153.join(metaprojectRoot, "skills", "gdctx")
     ] : [],
     ...modules.enableGdwiki ? [
-      path152.join(metaprojectRoot, "skills", "gdwiki"),
-      path152.join(metaprojectRoot, "wiki", "templates")
+      path153.join(metaprojectRoot, "skills", "gdwiki"),
+      path153.join(metaprojectRoot, "wiki", "templates")
     ] : [],
     ...modules.enableHealth ? [
-      path152.join(metaprojectRoot, "core", "health"),
-      path152.join(metaprojectRoot, "skills", "health")
+      path153.join(metaprojectRoot, "core", "health"),
+      path153.join(metaprojectRoot, "skills", "health")
     ] : [],
     ...modules.enableTesting ? [
-      path152.join(metaprojectRoot, "core", "testing"),
-      path152.join(metaprojectRoot, "skills", "testing")
+      path153.join(metaprojectRoot, "core", "testing"),
+      path153.join(metaprojectRoot, "skills", "testing")
     ] : [],
     ...modules.enableMemory ? [
-      path152.join(metaprojectRoot, "core", "memory"),
-      path152.join(metaprojectRoot, "skills", "memory"),
-      path152.join(metaprojectRoot, "memory", "templates")
+      path153.join(metaprojectRoot, "core", "memory"),
+      path153.join(metaprojectRoot, "skills", "memory"),
+      path153.join(metaprojectRoot, "memory", "templates")
     ] : [],
     ...modules.enableTasks ? [
-      path152.join(metaprojectRoot, "flows"),
-      path152.join(metaprojectRoot, "skills", "flow")
+      path153.join(metaprojectRoot, "flows"),
+      path153.join(metaprojectRoot, "skills", "flow")
     ] : [],
     ...modules.enableSecurity ? [
-      path152.join(metaprojectRoot, "core", "security")
+      path153.join(metaprojectRoot, "core", "security")
     ] : [],
     ...modules.enableSac ? [
-      path152.join(metaprojectRoot, "skills", "sac")
+      path153.join(metaprojectRoot, "skills", "sac")
     ] : []
   ];
   await Promise.all(dirs.map((dir) => mkdir54(dir, { recursive: true })));
 }
 async function installGdgraphCoreScripts2(metaprojectRoot) {
-  const gdgraphCoreRoot = path152.join(metaprojectRoot, "core", "gdgraph");
+  const gdgraphCoreRoot = path153.join(metaprojectRoot, "core", "gdgraph");
   await mkdir54(gdgraphCoreRoot, { recursive: true });
   for (const file of GDGRAPH_CORE_SOURCES) {
-    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path152.join(gdgraphCoreRoot, file));
+    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path153.join(gdgraphCoreRoot, file));
   }
-  await writeTextIfChanged4(path152.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
+  await writeTextIfChanged4(path153.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
 }
 async function installManagedHook2(projectRoot, hookName, blockId, content) {
   const hooksRoot = await resolveGitHooksRoot(projectRoot);
@@ -60739,7 +61326,7 @@ async function installManagedHook2(projectRoot, hookName, blockId, content) {
     return;
   }
   await mkdir54(hooksRoot, { recursive: true });
-  const hookPath = path152.join(hooksRoot, hookName);
+  const hookPath = path153.join(hooksRoot, hookName);
   const blockStart = `# keryx:${blockId}:begin`;
   const blockEnd = `# keryx:${blockId}:end`;
   const managedBlock = `${blockStart}
@@ -60760,7 +61347,7 @@ async function removeManagedHook2(projectRoot, hookName, blockId) {
   if (!hooksRoot) {
     return;
   }
-  const hookPath = path152.join(hooksRoot, hookName);
+  const hookPath = path153.join(hooksRoot, hookName);
   if (!await pathExists(hookPath)) {
     return;
   }
@@ -60782,7 +61369,7 @@ async function prePushHasSecurityBlock2(projectRoot) {
   if (!hooksRoot) {
     return false;
   }
-  const hookPath = path152.join(hooksRoot, "pre-push");
+  const hookPath = path153.join(hooksRoot, "pre-push");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -60797,7 +61384,7 @@ async function agentSettingsHasSecuritySentinel2(projectRoot) {
   return (await readFile79(file, "utf8")).includes(AGENT_HOOKS_SENTINEL);
 }
 async function readManifest5(metaprojectRoot) {
-  const manifestPath = path152.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path153.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return {
       exists: false,
@@ -60866,7 +61453,7 @@ async function inferManifestFromExistingMetaproject(metaprojectRoot) {
 }
 async function anyPathExists(root, candidates) {
   for (const candidate of candidates) {
-    if (await pathExists(path152.join(root, candidate))) {
+    if (await pathExists(path153.join(root, candidate))) {
       return true;
     }
   }
@@ -60887,13 +61474,13 @@ function parseUpdateArgs(args2) {
   };
 }
 async function runPostUpdateHooks(projectRoot) {
-  const hooksDir = path152.join(projectRoot, ".metaproject", "hooks", "post-update.d");
+  const hooksDir = path153.join(projectRoot, ".metaproject", "hooks", "post-update.d");
   if (!await pathExists(hooksDir)) {
     return;
   }
-  const entries = (await readdir24(hooksDir)).sort();
+  const entries = (await readdir25(hooksDir)).sort();
   for (const entry of entries) {
-    const hookPath = path152.join(hooksDir, entry);
+    const hookPath = path153.join(hooksDir, entry);
     try {
       await accessExecutable(hookPath);
     } catch {
@@ -60934,14 +61521,14 @@ async function writeTextIfChanged4(filePath, content) {
   if (await pathExists(filePath) && await readFile79(filePath, "utf8") === content) {
     return;
   }
-  await mkdir54(path152.dirname(filePath), { recursive: true });
+  await mkdir54(path153.dirname(filePath), { recursive: true });
   await writeFile48(filePath, content, "utf8");
 }
 async function writeTextIfMissing4(filePath, content) {
   if (await pathExists(filePath)) {
     return;
   }
-  await mkdir54(path152.dirname(filePath), { recursive: true });
+  await mkdir54(path153.dirname(filePath), { recursive: true });
   await writeFile48(filePath, content, "utf8");
 }
 async function copyFileIfChanged2(from, to) {
@@ -60949,7 +61536,7 @@ async function copyFileIfChanged2(from, to) {
   if (await pathExists(to) && await readFile79(to, "utf8") === next) {
     return;
   }
-  await mkdir54(path152.dirname(to), { recursive: true });
+  await mkdir54(path153.dirname(to), { recursive: true });
   await writeFile48(to, next, "utf8");
 }
 function runtimeSourcePath2(relativePath) {
@@ -60958,7 +61545,7 @@ function runtimeSourcePath2(relativePath) {
     return directPath;
   }
   if (relativePath.startsWith("../")) {
-    const packagedSourcePath = path152.join(path152.dirname(fileURLToPath7(import.meta.url)), "..", "src", relativePath.slice(3));
+    const packagedSourcePath = path153.join(path153.dirname(fileURLToPath7(import.meta.url)), "..", "src", relativePath.slice(3));
     if (existsSync30(packagedSourcePath)) {
       return packagedSourcePath;
     }
@@ -60990,7 +61577,7 @@ function printHelp18() {
 
 // src/commands/dashboard.ts
 import { spawn as spawn6 } from "child_process";
-import path153 from "path";
+import path154 from "path";
 init_args();
 async function dashboardCommand(args2 = []) {
   const options = parseOptions(args2);
@@ -61001,7 +61588,7 @@ async function dashboardCommand(args2 = []) {
   }
   if (subcommand === "build") {
     const result = await buildDashboard();
-    const rel = path153.relative(process.cwd(), result.path);
+    const rel = path154.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Dashboard built ${style.cyan(symbols.arrow)} ${style.cyan(rel)}`);
     note(`Open it: keryx dashboard open`);
     return;
@@ -61009,7 +61596,7 @@ async function dashboardCommand(args2 = []) {
   if (subcommand === "open") {
     const result = await buildDashboard();
     await openFile(result.path);
-    const rel = path153.relative(process.cwd(), result.path);
+    const rel = path154.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Opened ${style.cyan(rel)}`);
     return;
   }
@@ -61058,7 +61645,7 @@ import { readFileSync as readFileSync10 } from "fs";
 // src/agents/bootstrap.ts
 import { mkdir as mkdir55, readFile as readFile80, writeFile as writeFile49 } from "fs/promises";
 import { homedir as homedir7 } from "os";
-import path154 from "path";
+import path155 from "path";
 init_fs();
 var AGENT_BOOTSTRAP_START = "<!-- keryx:global-bootstrap -->";
 var AGENT_BOOTSTRAP_END = "<!-- /keryx:global-bootstrap -->";
@@ -61068,35 +61655,35 @@ var AGENT_BOOTSTRAP_RUNTIMES = [
     aliases: ["claude-code"],
     label: "Claude Code",
     fileName: "CLAUDE.md",
-    filePath: (homeRoot) => path154.join(homeRoot, ".claude", "CLAUDE.md")
+    filePath: (homeRoot) => path155.join(homeRoot, ".claude", "CLAUDE.md")
   },
   {
     id: "opencode",
     aliases: ["open-code"],
     label: "OpenCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path154.join(homeRoot, ".config", "opencode", "AGENTS.md")
+    filePath: (homeRoot) => path155.join(homeRoot, ".config", "opencode", "AGENTS.md")
   },
   {
     id: "zcode",
     aliases: ["zed", "zed-code"],
     label: "ZCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path154.join(homeRoot, ".zcode", "AGENTS.md")
+    filePath: (homeRoot) => path155.join(homeRoot, ".zcode", "AGENTS.md")
   },
   {
     id: "codex",
     aliases: [],
     label: "Codex",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path154.join(homeRoot, ".codex", "AGENTS.md")
+    filePath: (homeRoot) => path155.join(homeRoot, ".codex", "AGENTS.md")
   },
   {
     id: "antigravity",
     aliases: ["antigravuty", "antigravity-code"],
     label: "Antigravity",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path154.join(homeRoot, ".config", "antigravity", "AGENTS.md")
+    filePath: (homeRoot) => path155.join(homeRoot, ".config", "antigravity", "AGENTS.md")
   }
 ];
 function agentBootstrapRuntimeIds() {
@@ -61144,7 +61731,7 @@ async function installAgentBootstrap(runtime, options = {}) {
   const dryRun = options.dryRun === true;
   const wrote = next !== current;
   if (wrote && !dryRun) {
-    await mkdir55(path154.dirname(filePath), { recursive: true });
+    await mkdir55(path155.dirname(filePath), { recursive: true });
     await writeFile49(filePath, next, "utf8");
   }
   const status = dryRun ? statusFromContent(runtime, filePath, exists2, next) : await agentBootstrapStatus(runtime, homeRoot);
@@ -61492,7 +62079,7 @@ function printBootstrapHelp() {
 // src/commands/metrics.ts
 init_args();
 import { readFile as readFile81 } from "fs/promises";
-import path156 from "path";
+import path157 from "path";
 
 // src/metrics/benchmark.ts
 var RELIABILITIES2 = new Set(["exact", "estimated", "unknown"]);
@@ -62271,7 +62858,7 @@ function buildContainmentManifest(inputs, options = {}) {
 
 // src/metrics/oracle-runner.ts
 import { mkdir as mkdir56, writeFile as writeFile50 } from "fs/promises";
-import path155 from "path";
+import path156 from "path";
 
 // src/metrics/ir.ts
 function toIdSet(ids) {
@@ -62713,9 +63300,9 @@ function buildEvidenceBundle(input2, options = {}) {
 async function persistEvidenceBundle(outDir, bundle, ladder = "metastore") {
   const safeTarget = bundle.target.replace(/[^A-Za-z0-9._/-]/g, "_");
   const safeCase = bundle.caseId.replace(/[^A-Za-z0-9._-]/g, "_");
-  const dir = path155.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
+  const dir = path156.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
   await mkdir56(dir, { recursive: true });
-  const write = (name, value) => writeFile50(path155.join(dir, name), `${JSON.stringify(value, null, 2)}
+  const write = (name, value) => writeFile50(path156.join(dir, name), `${JSON.stringify(value, null, 2)}
 `, "utf8");
   await Promise.all([
     write("inputs.json", bundle.inputs),
@@ -62755,7 +63342,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
     console.log("# metrics status");
     console.log("");
     console.log(`root: ${root}`);
-    console.log(`enabled: ${await Bun.file(path156.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
+    console.log(`enabled: ${await Bun.file(path157.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
     const latest2 = await readLatestPointer(root);
     console.log(`latest: ${latest2.status}`);
     return;
@@ -62767,7 +63354,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const record2 = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+    const record2 = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
     const result = validateRunRecord(record2);
     console.log(result.valid ? "valid: yes" : "valid: no");
     for (const error2 of result.errors)
@@ -62792,7 +63379,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const file = path156.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
+    const file = path157.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
     if (!await Bun.file(file).exists()) {
       console.error(`Run not found: ${runId}`);
       process.exitCode = 1;
@@ -62809,8 +63396,8 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const a = JSON.parse(await readFile81(path156.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
-    const b = JSON.parse(await readFile81(path156.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
+    const a = JSON.parse(await readFile81(path157.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
+    const b = JSON.parse(await readFile81(path157.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
     const comparison = compareExecutionRuns(a, b);
     console.log(stableJson(comparison));
     return;
@@ -62844,8 +63431,8 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       return;
     }
     const template = createPairedBenchmarkTemplate(taskIds);
-    await Bun.write(path156.resolve(projectRoot, out), stableJson(template));
-    console.log(`manifest: ${path156.relative(projectRoot, path156.resolve(projectRoot, out))}`);
+    await Bun.write(path157.resolve(projectRoot, out), stableJson(template));
+    console.log(`manifest: ${path157.relative(projectRoot, path157.resolve(projectRoot, out))}`);
     return;
   }
   if (subcommand === "benchmark" && args2[1] === "run") {
@@ -62859,7 +63446,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+    const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
     const input2 = Array.isArray(raw) ? raw : raw.runs ?? [];
     const result = validatePairedBenchmark(input2);
     console.log(stableJson(result));
@@ -62871,7 +63458,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
   process.exitCode = 1;
 }
 async function loadAffectedSets(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target === "string")
@@ -62942,7 +63529,7 @@ async function runHarnessLayer(projectRoot, args2, ladder) {
   let tasks;
   let model;
   try {
-    const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, resultsPath), "utf8"));
     tasks = raw.tasks ?? [];
     model = raw.model;
   } catch (error2) {
@@ -62973,7 +63560,7 @@ async function runSafetyCompletionHonestyLayer(projectRoot, args2, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -62998,7 +63585,7 @@ async function runSafetyFalsePremiseLayer(projectRoot, args2, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -63023,7 +63610,7 @@ async function runSafetyContainmentLayer(projectRoot, args2, ladder, caseClass)
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -63085,12 +63672,12 @@ async function runGdgraphLayer(projectRoot, args2, ladder) {
   }
   const manifests = buildOracleManifestsByGold(inputs, { ladder });
   if (outDir) {
-    const resolvedOut = path156.resolve(projectRoot, outDir);
+    const resolvedOut = path157.resolve(projectRoot, outDir);
     for (const input2 of inputs) {
       for (const named of input2.golds) {
         const bundle = buildEvidenceBundle({ target: input2.target, system: input2.system, gold: named.gold }, { ladder, goldReference: goldPathFor(named.kind), timestamp: new Date().toISOString() });
-        const dir = await persistEvidenceBundle(path156.join(resolvedOut, named.kind), bundle, ladder);
-        console.error(`bundle[${named.kind}]: ${path156.relative(projectRoot, dir)}`);
+        const dir = await persistEvidenceBundle(path157.join(resolvedOut, named.kind), bundle, ladder);
+        console.error(`bundle[${named.kind}]: ${path157.relative(projectRoot, dir)}`);
       }
     }
   }
@@ -63114,7 +63701,7 @@ async function runGdgraphLayer(projectRoot, args2, ladder) {
   return allValid;
 }
 async function loadCoverageMap2(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
   return raw.coverageMap ?? {};
 }
 async function runTestingLayer(projectRoot, args2, ladder) {
@@ -63151,7 +63738,7 @@ async function runTestingLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadMemoryGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 3;
 }
 async function runMemoryLayer(projectRoot, args2, ladder) {
@@ -63188,11 +63775,11 @@ async function runMemoryLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadWikiGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 5;
 }
 async function loadWikiGroundedness(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target !== "string" || !Array.isArray(entry.scores) || entry.scores.length !== 3)
@@ -63248,7 +63835,7 @@ async function runWikiLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadGdctxFacts(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
   const inputs = [];
   for (const entry of raw.inputs ?? []) {
     if (typeof entry.input === "string") {
@@ -63286,7 +63873,7 @@ async function collect(projectRoot, args2) {
     process.exitCode = 1;
     return;
   }
-  const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, eventFile), "utf8"));
+  const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, eventFile), "utf8"));
   const events2 = Array.isArray(raw) ? raw : raw.events;
   const startedAt = optionValue(args2, "--started-at") ?? events2[0]?.timestamp_utc ?? new Date().toISOString();
   const finishedAt = optionValue(args2, "--finished-at") ?? events2.at(-1)?.timestamp_utc ?? startedAt;
@@ -63302,11 +63889,11 @@ async function collect(projectRoot, args2) {
     parentRunId: optionValue(args2, "--parent-run-id") ?? null
   });
   const result = await writeRunArtifacts(metricsRoot(projectRoot), record2, { cwd: projectRoot });
-  console.log(`json: ${path156.relative(projectRoot, result.jsonPath)}`);
-  console.log(`markdown: ${path156.relative(projectRoot, result.markdownPath)}`);
+  console.log(`json: ${path157.relative(projectRoot, result.jsonPath)}`);
+  console.log(`markdown: ${path157.relative(projectRoot, result.markdownPath)}`);
 }
 function metricsRoot(projectRoot) {
-  return path156.join(projectRoot, ".metaproject", "data", "metrics");
+  return path157.join(projectRoot, ".metaproject", "data", "metrics");
 }
 function printMetricsHelp() {
   console.log(`keryx metrics
@@ -63412,193 +63999,6 @@ init_session_wrap_up();
 init_proposal_evidence();
 init_review_confirm_token();
 init_store3();
-
-// src/sac/catch-up.ts
-init_fs();
-init_config_dir();
-init_paths();
-init_slate();
-init_store3();
-init_proposal_lifecycle();
-init_workspace_service();
-import { randomUUID as randomUUID28 } from "crypto";
-import { readdir as readdir25 } from "fs/promises";
-import path157 from "path";
-
-// src/sac/lifecycle-flag.ts
-init_store();
-init_service3();
-init_decision_dedup();
-init_workspace_service();
-import { randomUUID as randomUUID27 } from "crypto";
-function normalize3(raw) {
-  return raw.replace(/^\.\//, "");
-}
-function isStillPresent(recorded, valid) {
-  const normalized = normalize3(recorded);
-  return valid.has(normalized) || valid.has(moduleNameFromProjectPath(normalized));
-}
-async function computeLifecycleFlags(cwd, now = () => new Date) {
-  const valid = await validModuleNames(cwd);
-  if (valid === undefined)
-    return [];
-  const flaggedAt = now().toISOString();
-  const flags = [];
-  const workspaceService = new WorkspaceService({
-    workspaceRoot: cwd,
-    authorizationServer: localWorkspaceAuthorizationServer(),
-    strictGuard: { mode: "strict", availability: "available", decision: "pass", policyRevision: "local-offline-v1" }
-  });
-  const workspaces = await workspaceService.list({ request: undefined, requestCorrelationId: randomUUID27(), includeArchived: true });
-  for (const workspace of workspaces) {
-    const component = workspace.resources.find((r) => r.kind === "component")?.uri;
-    if (component !== undefined && !isStillPresent(component, valid)) {
-      flags.push({ kind: "workspace", ref: workspace.id, missingComponent: normalize3(component), flaggedAt });
-    }
-  }
-  for (const entry of await collectEntries(cwd)) {
-    const module = entry.scopes.module;
-    if (module !== null && module.length > 0 && !isStillPresent(module, valid)) {
-      flags.push({ kind: "memory-entry", ref: entry.relativePath, missingComponent: normalize3(module), flaggedAt });
-    }
-  }
-  for (const decision of await collectWikiDecisionEntries(cwd)) {
-    const module = decision.scopes.module;
-    if (module !== null && module.length > 0 && !isStillPresent(module, valid)) {
-      flags.push({ kind: "wiki-decision", ref: decision.relativePath, missingComponent: normalize3(module), flaggedAt });
-    }
-  }
-  return flags;
-}
-
-// src/sac/catch-up.ts
-async function buildCatchUp(input2) {
-  const [proposals, sessionCategories, lifecycleFlagsAll] = await Promise.all([
-    collectProposals(input2.cwd, input2.workspaceId),
-    collectSessionCategories(input2.cwd),
-    computeLifecycleFlags(input2.cwd)
-  ]);
-  const lifecycleFlags = input2.workspaceId === undefined ? lifecycleFlagsAll : lifecycleFlagsAll.filter((flag) => flag.kind !== "workspace" || flag.ref === input2.workspaceId);
-  return { proposals, ...sessionCategories, lifecycleFlags };
-}
-async function collectProposals(cwd, workspaceId) {
-  const authorizationServer = localWorkspaceAuthorizationServer();
-  const actor = await authorizationServer.actorContextFor(undefined, randomUUID28());
-  if (!actor)
-    throw new Error("trusted ActorContext is required for catch-up");
-  const proposalService = createLocalProposalLifecycleService(cwd);
-  const groups = await proposalService.listVisibleProposedProposals(actor);
-  const scoped = workspaceId === undefined ? groups : groups.filter((group) => group.workspace.id === workspaceId);
-  const flattened = scoped.flatMap((group) => group.proposals.map((proposal) => ({ group, proposal })));
-  return Promise.all(flattened.map(async ({ group, proposal }) => {
-    const fresh = await proposalService.isEvidenceFresh(proposal, actor);
-    return { type: "proposal", workspaceId: group.workspace.id, proposalId: proposal.id, fresh };
-  }));
-}
-async function classifySession(session) {
-  const dir = sessionDir(session.projectPath, session.id);
-  if (await isLockHeld(slateLockPath(dir)))
-    return;
-  const terminalState = await readTerminalState(dir);
-  if (terminalState !== undefined) {
-    const workspaceId2 = (await safeReadSlate(dir))?.workspaceId;
-    return { kind: "blocked", item: { type: "blocked", sessionId: session.id, ...workspaceId2 !== undefined ? { workspaceId: workspaceId2 } : {}, terminalState } };
-  }
-  const unboundCandidate = await readNewestUnboundCandidate(dir);
-  if (unboundCandidate !== undefined) {
-    return {
-      kind: "unbound-candidate",
-      item: { type: "unbound-candidate", sessionId: session.id, evidencePath: unboundCandidate.evidencePath, summary: unboundCandidate.summary }
-    };
-  }
-  if (!await isSlateEngaged(dir))
-    return;
-  const workspaceId = (await safeReadSlate(dir))?.workspaceId;
-  return { kind: "unknown", item: { type: "unknown", sessionId: session.id, ...workspaceId !== undefined ? { workspaceId } : {}, lastSeenAt: session.updatedAt } };
-}
-async function collectSessionCategories(cwd) {
-  const classified = await Promise.all(listSessions(cwd).map((session) => classifySession(session)));
-  const blocked2 = [];
-  const unboundCandidates = [];
-  const unknown = [];
-  for (const category of classified) {
-    if (category === undefined)
-      continue;
-    if (category.kind === "blocked")
-      blocked2.push(category.item);
-    else if (category.kind === "unbound-candidate")
-      unboundCandidates.push(category.item);
-    else
-      unknown.push(category.item);
-  }
-  return { blocked: blocked2, unboundCandidates, unknown };
-}
-async function isSlateEngaged(dir) {
-  if (await pathExists(path157.join(dir, "slate.json")))
-    return true;
-  if (await pathExists(path157.join(dir, "terminal-state.json")))
-    return true;
-  try {
-    const entries = await readdir25(path157.join(dir, "slate-archive"));
-    return entries.length > 0;
-  } catch {
-    return false;
-  }
-}
-async function safeReadSlate(dir) {
-  try {
-    return await readSlate(dir);
-  } catch {
-    return;
-  }
-}
-async function readTerminalState(dir) {
-  const result = readConfigFile(path157.join(dir, "terminal-state.json"));
-  if (!result.ok) {
-    return;
-  }
-  try {
-    return JSON.parse(result.text);
-  } catch {
-    return;
-  }
-}
-async function readNewestUnboundCandidate(dir) {
-  const archiveDir = path157.join(dir, "slate-archive");
-  let entries;
-  try {
-    entries = (await readdir25(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
-  } catch {
-    return;
-  }
-  entries.sort();
-  for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path157.join(archiveDir, entries[i]);
-    const result = readConfigFile(evidencePath);
-    if (!result.ok) {
-      continue;
-    }
-    try {
-      const parsed = JSON.parse(result.text);
-      if (parsed.recordType !== "unbound-candidate")
-        continue;
-      return { evidencePath, summary: summarizeUnboundCandidate(parsed.groups) };
-    } catch {
-      continue;
-    }
-  }
-  return;
-}
-function summarizeUnboundCandidate(groups) {
-  const safeGroups = groups ?? [];
-  if (safeGroups.length === 0)
-    return "no seeds captured";
-  const seedCount = safeGroups.reduce((sum, group) => sum + (group.seeds?.length ?? 0), 0);
-  const kinds = safeGroups.map((group) => typeof group.kind === "string" ? group.kind : "unknown").join(", ");
-  return `${seedCount} untriaged seed(s) across ${safeGroups.length} kind(s) (${kinds})`;
-}
-
-// src/commands/workspace.ts
 var PROPOSAL_KINDS2 = ["decision", "wiki-update", "memory-entry", "follow-up", "contract-change", "risk"];
 function service5() {
   return new WorkspaceService({