@mrciphersmith/keryx 0.2.43 → 0.2.45

package/dist/cli.js

@@ -12095,6 +12095,10 @@ function touchesAgentCredentials(command) {
   const text = command.toLowerCase();
   return CREDENTIAL_MARKERS.some((marker2) => text.includes(marker2));
 }
+function touchesSacConfirmReview(command) {
+  const text = command.toLowerCase();
+  return SAC_REVIEW_MARKERS.some((marker2) => text.includes(marker2));
+}
 var CATASTROPHIC_TARGETS, RECURSIVE_FLAG, PRIVILEGE, INTERPRETERS, DOWNLOADERS, CONTAINER_RUNTIMES, PROTECTED_BRANCHES, BLOCK_DEVICE, rulePrivilege = (v) => PRIVILEGE.has(v.cmd), ruleBlockDeviceRedirect = (v) => BLOCK_DEVICE.test(v.raw) && /(?:^|\s)(?:>|>>)\s*\/dev\//.test(v.raw), ruleRm = (v) => v.cmd === "rm" && v.positionals.some(isCatastrophicTarget), ruleDd = (v) => v.cmd === "dd" && v.args.some((x) => /^of=/i.test(x) && BLOCK_DEVICE.test(x)), rulePermissionSweep = (v) => (v.cmd === "chmod" || v.cmd === "chown" || v.cmd === "chgrp") && hasRecursive(v.words) && v.positionals.some(isCatastrophicTarget), ruleHostState = (v) => {
   if (v.cmd === "shutdown" || v.cmd === "reboot" || v.cmd === "halt" || v.cmd === "poweroff")
     return true;
@@ -12115,7 +12119,7 @@ var CATASTROPHIC_TARGETS, RECURSIVE_FLAG, PRIVILEGE, INTERPRETERS, DOWNLOADERS,
     return true;
   const named = after.map((x) => x.split("/").pop()?.toLowerCase() ?? "");
   return named.some((n) => PROTECTED_BRANCHES.includes(n));
-}, RULES3, CREDENTIAL_MARKERS;
+}, RULES3, CREDENTIAL_MARKERS, SAC_REVIEW_MARKERS;
 var init_command_risk = __esm(() => {
   init_shell_syntax();
   CATASTROPHIC_TARGETS = new Set([
@@ -12180,6 +12184,7 @@ var init_command_risk = __esm(() => {
     ".local/share/keryx",
     ".config/keryx"
   ];
+  SAC_REVIEW_MARKERS = ["confirm-review", "workspace review"];
 });
 
 // src/commands/permission-mode.ts
@@ -12187,11 +12192,11 @@ function isPermissionMode(value) {
   return PERMISSION_MODES.includes(value);
 }
 function resolveApprovalDecision(input2) {
-  const { mode, risk, destructive, credentials } = input2;
+  const { mode, risk, destructive, credentials, sacReviewConfirmation } = input2;
   if (risk === "read") {
     return "auto";
   }
-  if (credentials) {
+  if (credentials || sacReviewConfirmation) {
     return "ask";
   }
   if (mode === "auto") {
@@ -12208,6 +12213,304 @@ var init_permission_mode = __esm(() => {
   PERMISSION_MODES = ["ask", "trust", "auto"];
 });
 
+// src/harness/policy/ranks.ts
+function axesOf(trustMode) {
+  switch (trustMode) {
+    case "read-only":
+      return { authority: "read-only", inputTrust: "vetted" };
+    case "trusted-local":
+      return { authority: "acting", inputTrust: "vetted" };
+    case "untrusted":
+      return { authority: "acting", inputTrust: "unvetted" };
+    default:
+      return;
+  }
+}
+function rankOf(map, value) {
+  return Object.prototype.hasOwnProperty.call(map, value) ? map[value] : undefined;
+}
+function exceedingAxes(ceiling, candidate) {
+  const low = axesOf(ceiling);
+  const high = axesOf(candidate);
+  if (low === undefined || high === undefined) {
+    return [AUTHORITY_AXIS, INPUT_TRUST_AXIS];
+  }
+  const exceeded = [];
+  if (AUTHORITY_RANK[high.authority] > AUTHORITY_RANK[low.authority]) {
+    exceeded.push(AUTHORITY_AXIS);
+  }
+  if (INPUT_TRUST_RANK[high.inputTrust] > INPUT_TRUST_RANK[low.inputTrust]) {
+    exceeded.push(INPUT_TRUST_AXIS);
+  }
+  return exceeded;
+}
+function broadeningAxes(parent, child) {
+  const above = axesOf(parent);
+  const below = axesOf(child);
+  if (above === undefined || below === undefined) {
+    return [AUTHORITY_AXIS, INPUT_TRUST_AXIS];
+  }
+  const broadened = [];
+  if (AUTHORITY_RANK[below.authority] > AUTHORITY_RANK[above.authority]) {
+    broadened.push(AUTHORITY_AXIS);
+  }
+  if (INPUT_TRUST_RANK[below.inputTrust] < INPUT_TRUST_RANK[above.inputTrust]) {
+    broadened.push(INPUT_TRUST_AXIS);
+  }
+  return broadened;
+}
+var AUTHORITY_RANK, INPUT_TRUST_RANK, OUTCOME_RANK, ISOLATION_RANK, AUTHORITY_AXIS = "trustMode.authority", INPUT_TRUST_AXIS = "trustMode.inputTrust";
+var init_ranks = __esm(() => {
+  AUTHORITY_RANK = {
+    "read-only": 0,
+    acting: 1
+  };
+  INPUT_TRUST_RANK = {
+    unvetted: 0,
+    vetted: 1
+  };
+  OUTCOME_RANK = {
+    deny: 0,
+    ask: 1,
+    allow: 2
+  };
+  ISOLATION_RANK = {
+    "not-required": 0,
+    "required-fail-closed": 1
+  };
+});
+
+// src/harness/child/isolation.ts
+function inheritBudget(parentRemaining, childRequest) {
+  if (childRequest.maxRuntimeMs > parentRemaining.maxRuntimeMs) {
+    return {
+      ok: false,
+      reason: `child maxRuntimeMs ${childRequest.maxRuntimeMs} exceeds parent remaining ${parentRemaining.maxRuntimeMs}`
+    };
+  }
+  if (childRequest.maxToolCalls !== undefined) {
+    if (parentRemaining.maxToolCalls === undefined) {
+      return {
+        ok: false,
+        reason: `child requests ${childRequest.maxToolCalls} tool calls but the parent exposes no tool-call budget to inherit`
+      };
+    }
+    if (childRequest.maxToolCalls > parentRemaining.maxToolCalls) {
+      return {
+        ok: false,
+        reason: `child maxToolCalls ${childRequest.maxToolCalls} exceeds parent remaining ${parentRemaining.maxToolCalls}`
+      };
+    }
+  }
+  const reservation = {
+    reservationId: childRequest.reservationId,
+    maxRuntimeMs: childRequest.maxRuntimeMs,
+    ...childRequest.maxToolCalls !== undefined ? { maxToolCalls: childRequest.maxToolCalls } : {}
+  };
+  return { ok: true, reservation };
+}
+function isKnownCapability(value) {
+  return CAPABILITY_KEYS.includes(value);
+}
+function inheritPolicy(parent, childRequest) {
+  if (axesOf(childRequest.trustMode) === undefined || axesOf(parent.trustMode) === undefined) {
+    return {
+      ok: false,
+      reason: `unrecognized trustMode (child "${childRequest.trustMode}", parent "${parent.trustMode}")`
+    };
+  }
+  const broadened = broadeningAxes(parent.trustMode, childRequest.trustMode);
+  if (broadened.length > 0) {
+    return {
+      ok: false,
+      reason: `child trustMode "${childRequest.trustMode}" is broader than parent "${parent.trustMode}" on ${broadened.join(", ")}`
+    };
+  }
+  for (const capability of CAPABILITY_KEYS) {
+    const childOutcome = childRequest.defaults[capability];
+    const parentOutcome = parent.defaults[capability];
+    const childRank = rankOf(OUTCOME_RANK, childOutcome);
+    const parentRank = rankOf(OUTCOME_RANK, parentOutcome);
+    if (childRank === undefined || parentRank === undefined) {
+      return {
+        ok: false,
+        reason: `unrecognized capability outcome for "${capability}" (child "${childOutcome}", parent "${parentOutcome}")`
+      };
+    }
+    if (childRank > parentRank) {
+      return {
+        ok: false,
+        reason: `child capability "${capability}" default "${childOutcome}" is more permissive than parent "${parentOutcome}"`
+      };
+    }
+  }
+  const childIsolation = rankOf(ISOLATION_RANK, childRequest.requiredControls.isolation);
+  const parentIsolation = rankOf(ISOLATION_RANK, parent.requiredControls.isolation);
+  if (childIsolation === undefined || parentIsolation === undefined) {
+    return {
+      ok: false,
+      reason: `unrecognized isolation control (child "${childRequest.requiredControls.isolation}", parent "${parent.requiredControls.isolation}")`
+    };
+  }
+  if (childIsolation < parentIsolation) {
+    return {
+      ok: false,
+      reason: `child isolation "${childRequest.requiredControls.isolation}" is weaker than parent "${parent.requiredControls.isolation}"`
+    };
+  }
+  return { ok: true, policy: childRequest };
+}
+function childProvenance(parent, deps) {
+  const taintIds = [...parent.taintIds ?? [], parent.provenanceId];
+  const provenance = {
+    provenanceId: deps.idSeq(),
+    trustLevel: "derived",
+    sourceKind: parent.sourceKind,
+    taintIds
+  };
+  if (parent.sourceHash !== undefined) {
+    provenance.sourceHash = parent.sourceHash;
+  }
+  return provenance;
+}
+var CAPABILITY_KEYS;
+var init_isolation = __esm(() => {
+  init_ranks();
+  CAPABILITY_KEYS = [
+    "read",
+    "write",
+    "shell",
+    "network",
+    "delegate"
+  ];
+});
+
+// src/harness/parallel/scheduler.ts
+function byTaskId(a, b) {
+  return a.taskId < b.taskId ? -1 : a.taskId > b.taskId ? 1 : 0;
+}
+function computeExcluded(tasks) {
+  const excluded = new Set;
+  for (const t of tasks) {
+    if (t.cancelled === true)
+      excluded.add(t.taskId);
+  }
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const t of tasks) {
+      if (excluded.has(t.taskId))
+        continue;
+      if (t.dependsOn.some((dep) => excluded.has(dep))) {
+        excluded.add(t.taskId);
+        changed = true;
+      }
+    }
+  }
+  return excluded;
+}
+function decrementRemaining(remaining, reservation) {
+  const maxRuntimeMs = remaining.maxRuntimeMs - reservation.maxRuntimeMs;
+  if (remaining.maxToolCalls !== undefined && reservation.maxToolCalls !== undefined) {
+    return { maxRuntimeMs, maxToolCalls: remaining.maxToolCalls - reservation.maxToolCalls };
+  }
+  return remaining.maxToolCalls !== undefined ? { maxRuntimeMs, maxToolCalls: remaining.maxToolCalls } : { maxRuntimeMs };
+}
+function planWaves(tasks, config, _deps) {
+  if (!Number.isInteger(config.maxConcurrency) || config.maxConcurrency < 1) {
+    return { ok: false, reason: `maxConcurrency must be a positive integer, got ${config.maxConcurrency}` };
+  }
+  const excluded = computeExcluded(tasks);
+  const universe = tasks.filter((t) => !excluded.has(t.taskId));
+  const scheduled = new Set;
+  const waveTaskLists = [];
+  while (scheduled.size < universe.length) {
+    const ready = universe.filter((t) => !scheduled.has(t.taskId) && t.dependsOn.every((dep) => scheduled.has(dep))).sort(byTaskId);
+    if (ready.length === 0) {
+      return { ok: false, reason: "dependency cycle detected: no ready task set could be formed" };
+    }
+    const waveTasks = ready.slice(0, config.maxConcurrency);
+    for (const t of waveTasks)
+      scheduled.add(t.taskId);
+    waveTaskLists.push(waveTasks);
+  }
+  let remaining = config.parentRemaining;
+  const waves = [];
+  for (const waveTasks of waveTaskLists) {
+    const taskIds = [];
+    const reservations = [];
+    for (const t of waveTasks) {
+      const granted = inheritBudget(remaining, t.budgetRequest);
+      if (!granted.ok) {
+        return { ok: false, reason: granted.reason };
+      }
+      taskIds.push(t.taskId);
+      reservations.push(granted.reservation);
+      remaining = decrementRemaining(remaining, granted.reservation);
+    }
+    waves.push({ taskIds, reservations });
+  }
+  return { ok: true, waves };
+}
+async function executeWaves(tasks, waves, deps) {
+  const byTaskId2 = new Map;
+  for (const t of tasks)
+    byTaskId2.set(t.taskId, t);
+  const results = new Map;
+  for (let waveIndex = 0;waveIndex < waves.length; waveIndex++) {
+    const wave = waves[waveIndex];
+    if (wave === undefined)
+      continue;
+    const settled = await Promise.allSettled(wave.taskIds.map((taskId, i) => {
+      const task = byTaskId2.get(taskId);
+      if (task === undefined) {
+        return Promise.reject(new Error(`executeWaves: wave ${waveIndex} references unknown taskId "${taskId}" (not in \`tasks\`)`));
+      }
+      const reservation = wave.reservations[i];
+      if (reservation === undefined) {
+        return Promise.reject(new Error(`executeWaves: wave ${waveIndex} taskIds/reservations length mismatch at index ${i} (malformed Wave)`));
+      }
+      return deps.run(task, reservation);
+    }));
+    const failedTaskIds = [];
+    const causes = [];
+    for (let i = 0;i < settled.length; i++) {
+      const outcome = settled[i];
+      const taskId = wave.taskIds[i];
+      if (outcome === undefined || taskId === undefined)
+        continue;
+      if (outcome.status === "fulfilled") {
+        results.set(taskId, outcome.value);
+      } else {
+        failedTaskIds.push(taskId);
+        causes.push(outcome.reason);
+      }
+    }
+    if (failedTaskIds.length > 0) {
+      throw new WaveExecutionError(waveIndex, failedTaskIds, causes, new Map(results));
+    }
+  }
+  return results;
+}
+var WaveExecutionError;
+var init_scheduler = __esm(() => {
+  init_isolation();
+  WaveExecutionError = class WaveExecutionError extends Error {
+    waveIndex;
+    failedTaskIds;
+    causes;
+    partialResults;
+    constructor(waveIndex, failedTaskIds, causes, partialResults) {
+      super(`executeWaves: wave ${waveIndex} had ${failedTaskIds.length} rejected task(s): ${failedTaskIds.join(", ")}`);
+      this.name = "WaveExecutionError";
+      this.waveIndex = waveIndex;
+      this.failedTaskIds = failedTaskIds;
+      this.causes = causes;
+      this.partialResults = partialResults;
+    }
+  };
+});
+
 // src/ctx/assembly.ts
 import { createHash as createHash6 } from "crypto";
 import { mkdir as mkdir24, rename as rename2, writeFile as writeFile26 } from "fs/promises";
@@ -17198,7 +17501,7 @@ ${block}
 }
 async function runAgentTurn(io, deps, history, userLine, options = {}) {
   try {
-    await runAgentTurnCore(io, deps, history, userLine, options);
+    return await runAgentTurnCore(io, deps, history, userLine, options);
   } finally {
     await closeSlateOnFlowDone(io, deps, options);
   }
@@ -17240,7 +17543,7 @@ async function runAgentTurnCore(io, deps, history, userLine, options = {}) {
     io.onSystem?.(`
 [stopped] Model turn interrupted by user.
 `);
-    return;
+    return {};
   }
   const toolByName = new Map(deps.tools.map((t) => [t.definition.name, t]));
   const toolDefs = deps.tools.map((t) => t.definition);
@@ -17349,7 +17652,7 @@ async function runAgentTurnCore(io, deps, history, userLine, options = {}) {
           system(`
 [stopped] Model turn interrupted by user.
 `);
-          return;
+          return {};
         }
         if (event.kind === "reasoning_delta") {
           reasoningText += event.text ?? "";
@@ -17396,7 +17699,7 @@ async function runAgentTurnCore(io, deps, history, userLine, options = {}) {
         system(`
 [stopped] Model turn interrupted by user.
 `);
-        return;
+        return {};
       }
       system(`
 [error] ${cause instanceof Error ? cause.message : String(cause)}
@@ -17412,10 +17715,10 @@ async function runAgentTurnCore(io, deps, history, userLine, options = {}) {
       system(`
 [stopped] Model turn interrupted by user.
 `);
-      return;
+      return {};
     }
     if (errored) {
-      return;
+      return {};
     }
     if (calls.length === 0) {
       const shouldReprompt = actionRequest && (assistantText.length === 0 || modelClaimedAction(assistantText));
@@ -17436,27 +17739,35 @@ async function runAgentTurnCore(io, deps, history, userLine, options = {}) {
         system(`
 [warning] The provider/model did not emit a tool call for an explicit action request. ` + "Use a chat-safe fallback (`keryx shell --chat`) or switch to a tool-capable model.\n");
       }
-      return;
+      return {};
     }
     if (isAborted()) {
       system(`
 [stopped] Model turn interrupted by user.
 `);
-      return;
+      return {};
     }
     let exhaustedBudget;
     let executedAny = false;
     const batchContainsUntrustedWeb = calls.some((call) => call.name === "web_fetch" || call.name === "web_search");
+    const reservationByCallId = new Map;
+    for (const call of calls) {
+      const callRisk = toolByName.get(call.name)?.definition.risk;
+      reservationByCallId.set(call.id, reserveToolAttempt(budget, call.name, call.input, callRisk));
+    }
+    const spawnConcurrencyCandidates = calls.filter((call) => call.name === "spawn_subagent" && reservationByCallId.get(call.id)?.ok === true);
+    const untrustedGateBlocksSpawns = untrustedContentSeen || batchContainsUntrustedWeb;
+    const concurrentSpawnResults = spawnConcurrencyCandidates.length >= 2 && !untrustedGateBlocksSpawns ? await runConcurrentSpawnBatch(spawnConcurrencyCandidates, toolByName, io, deps) : undefined;
     for (const call of calls) {
       if (isAborted()) {
         system(`
 [stopped] Model turn interrupted by user.
 `);
-        return;
+        return {};
       }
       if (deps.unattended === true && call.name === "ask_user") {
         await emitTerminalState(io, deps, options, "ask_user_unanswerable");
-        return;
+        return {};
       }
       if (untrustedContentSeen || batchContainsUntrustedWeb && call.name !== "web_fetch" && call.name !== "web_search") {
         const result2 = {
@@ -17470,7 +17781,7 @@ async function runAgentTurnCore(io, deps, history, userLine, options = {}) {
       }
       io.onToolCall?.(call.name, call.input);
       const risk = toolByName.get(call.name)?.definition.risk;
-      const reservation = reserveToolAttempt(budget, call.name, call.input, risk);
+      const reservation = reservationByCallId.get(call.id) ?? reserveToolAttempt(budget, call.name, call.input, risk);
       if (!reservation.ok) {
         const result2 = { output: reservation.reason, isError: true };
         io.onToolResult?.(call.name, result2);
@@ -17487,7 +17798,7 @@ async function runAgentTurnCore(io, deps, history, userLine, options = {}) {
         continue;
       }
       executedAny = true;
-      const result = await executeCall(call, toolByName, io.requestApproval, io.permissionMode, io.onAutoApproved);
+      const result = concurrentSpawnResults?.get(call.id) ?? await executeCall(call, toolByName, io.requestApproval, io.permissionMode, io.onAutoApproved);
       io.onToolResult?.(call.name, result);
       const modelOutput = redactSensitiveText(result.output);
       history.push({
@@ -17539,9 +17850,10 @@ ${hint}
     }
     const noProgress = !executedAny && calls.length > 0;
     if (exhaustedBudget !== undefined || noProgress) {
+      const finishReason = exhaustedBudget !== undefined ? "budget" : "no-progress";
       if (deps.unattended === true) {
         await emitTerminalState(io, deps, options, "budget_exhausted");
-        return;
+        return { finishReason };
       }
       await finishWithBudgetSummary(io, deps, history, parentRunId, {
         maxUnique: maxToolCalls,
@@ -17555,7 +17867,7 @@ ${hint}
         ...exhaustedBudget !== undefined ? { exhaustedBudget } : {},
         noProgress
       });
-      return;
+      return { finishReason };
     }
   }
 }
@@ -17647,6 +17959,68 @@ function isApprovalFor(response, fingerprint) {
   }
   return response.fingerprint === undefined || response.fingerprint === fingerprint;
 }
+async function runConcurrentSpawnBatch(spawnCalls, toolByName, io, deps) {
+  const maxConcurrency = deps.maxSubagentConcurrency ?? DEFAULT_MAX_SUBAGENT_CONCURRENCY;
+  const perTaskRuntimeMs = NOMINAL_CONCURRENT_SPAWN_RUNTIME_MS;
+  const tasks = spawnCalls.map((call) => ({
+    taskId: call.id,
+    dependsOn: [],
+    budgetRequest: { reservationId: call.id, maxRuntimeMs: perTaskRuntimeMs }
+  }));
+  const runOne = (call) => executeCall(call, toolByName, io.requestApproval, io.permissionMode, io.onAutoApproved);
+  const plan = planWaves(tasks, {
+    maxConcurrency,
+    parentRemaining: { maxRuntimeMs: perTaskRuntimeMs * tasks.length }
+  });
+  if (!plan.ok) {
+    io.onSystem?.(`
+[warning] concurrent subagent wave planning denied (${plan.reason}); running sequentially.
+`);
+    const results = new Map;
+    for (const call of spawnCalls) {
+      try {
+        results.set(call.id, await runOne(call));
+      } catch (cause) {
+        const message2 = cause instanceof Error ? cause.message : String(cause);
+        results.set(call.id, {
+          output: `subagent call ${call.id} failed: sequential fallback error: ${message2}`,
+          isError: true
+        });
+      }
+    }
+    return results;
+  }
+  try {
+    return await executeWaves(tasks, plan.waves, {
+      run: (task) => {
+        const call = spawnCalls.find((c) => c.id === task.taskId);
+        if (call === undefined) {
+          return Promise.resolve({
+            output: `internal error: unknown concurrent spawn taskId ${task.taskId}`,
+            isError: true
+          });
+        }
+        return runOne(call);
+      }
+    });
+  } catch (cause) {
+    const message2 = cause instanceof Error ? cause.message : String(cause);
+    const isWaveError = cause instanceof WaveExecutionError;
+    io.onSystem?.(`
+[warning] concurrent subagent wave failed${isWaveError ? "" : " (unexpected)"} (degraded): ${message2}
+`);
+    const partialResults = cause instanceof WaveExecutionError ? cause.partialResults : undefined;
+    const results = new Map;
+    for (const call of spawnCalls) {
+      const settled = partialResults?.get(call.id);
+      results.set(call.id, settled ?? {
+        output: `subagent call ${call.id} failed: concurrent wave error: ${message2}`,
+        isError: true
+      });
+    }
+    return results;
+  }
+}
 async function executeCall(call, toolByName, requestApproval, permissionMode, onAutoApproved) {
   const tool = toolByName.get(call.name);
   if (tool === undefined) {
@@ -17667,7 +18041,8 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, on
     const command = typeof input2.command === "string" ? input2.command : "";
     const destructive = risk === "destructive" || isDestructiveCommand(command);
     const credentials = touchesAgentCredentials(command);
-    const decision = resolveApprovalDecision({ mode, risk, destructive, credentials });
+    const sacReviewConfirmation = touchesSacConfirmReview(command);
+    const decision = resolveApprovalDecision({ mode, risk, destructive, credentials, sacReviewConfirmation });
     if (decision === "auto") {
       onAutoApproved?.(call.name, call.input, { destructive, credentials });
     } else {
@@ -17682,7 +18057,7 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, on
       }
     }
   } else if (risk === "delegate") {
-    const decision = resolveApprovalDecision({ mode, risk, destructive: false, credentials: false });
+    const decision = resolveApprovalDecision({ mode, risk, destructive: false, credentials: false, sacReviewConfirmation: false });
     if (decision === "auto") {
       onAutoApproved?.(call.name, call.input, { destructive: false, credentials: false });
     } else {
@@ -17697,190 +18072,20 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, on
   }
   return tool.invoke(input2);
 }
-var DEFAULT_MAX_TOOL_CALLS = 48, ENV_AGENT_MAX_TOOL_CALLS = "KERYX_AGENT_MAX_TOOL_CALLS", MAX_AGENT_MAX_TOOL_CALLS = 256, DEFAULT_MAX_READ_TOOL_CALLS = 40, DEFAULT_MAX_NON_READ_TOOL_CALLS = 8, MAX_ATTEMPTS_PER_HASH = 3, ENV_AGENT_MAX_ATTEMPTS_PER_HASH = "KERYX_AGENT_MAX_ATTEMPTS_PER_HASH", MAX_AGENT_MAX_ATTEMPTS_PER_HASH = 10, REPEAT_FAILURE_HINT_THRESHOLD = 2, MAX_TOOLLESS_REPROMPTS = 1;
+var DEFAULT_MAX_TOOL_CALLS = 48, ENV_AGENT_MAX_TOOL_CALLS = "KERYX_AGENT_MAX_TOOL_CALLS", MAX_AGENT_MAX_TOOL_CALLS = 256, DEFAULT_MAX_READ_TOOL_CALLS = 40, DEFAULT_MAX_NON_READ_TOOL_CALLS = 8, DEFAULT_MAX_SUBAGENT_CONCURRENCY = 3, MAX_ATTEMPTS_PER_HASH = 3, ENV_AGENT_MAX_ATTEMPTS_PER_HASH = "KERYX_AGENT_MAX_ATTEMPTS_PER_HASH", MAX_AGENT_MAX_ATTEMPTS_PER_HASH = 10, REPEAT_FAILURE_HINT_THRESHOLD = 2, MAX_TOOLLESS_REPROMPTS = 1, NOMINAL_CONCURRENT_SPAWN_RUNTIME_MS;
 var init_agent = __esm(() => {
   init_validator();
   init_command_risk();
   init_permission_mode();
   init_redact();
+  init_scheduler();
   init_slate();
   init_slate_course();
   init_workspace_resolve();
   init_machine_wrap_up();
   init_slate_lifecycle();
   init_slate_terminal_state();
-});
-
-// src/harness/policy/ranks.ts
-function axesOf(trustMode) {
-  switch (trustMode) {
-    case "read-only":
-      return { authority: "read-only", inputTrust: "vetted" };
-    case "trusted-local":
-      return { authority: "acting", inputTrust: "vetted" };
-    case "untrusted":
-      return { authority: "acting", inputTrust: "unvetted" };
-    default:
-      return;
-  }
-}
-function rankOf(map, value) {
-  return Object.prototype.hasOwnProperty.call(map, value) ? map[value] : undefined;
-}
-function exceedingAxes(ceiling, candidate) {
-  const low = axesOf(ceiling);
-  const high = axesOf(candidate);
-  if (low === undefined || high === undefined) {
-    return [AUTHORITY_AXIS, INPUT_TRUST_AXIS];
-  }
-  const exceeded = [];
-  if (AUTHORITY_RANK[high.authority] > AUTHORITY_RANK[low.authority]) {
-    exceeded.push(AUTHORITY_AXIS);
-  }
-  if (INPUT_TRUST_RANK[high.inputTrust] > INPUT_TRUST_RANK[low.inputTrust]) {
-    exceeded.push(INPUT_TRUST_AXIS);
-  }
-  return exceeded;
-}
-function broadeningAxes(parent, child) {
-  const above = axesOf(parent);
-  const below = axesOf(child);
-  if (above === undefined || below === undefined) {
-    return [AUTHORITY_AXIS, INPUT_TRUST_AXIS];
-  }
-  const broadened = [];
-  if (AUTHORITY_RANK[below.authority] > AUTHORITY_RANK[above.authority]) {
-    broadened.push(AUTHORITY_AXIS);
-  }
-  if (INPUT_TRUST_RANK[below.inputTrust] < INPUT_TRUST_RANK[above.inputTrust]) {
-    broadened.push(INPUT_TRUST_AXIS);
-  }
-  return broadened;
-}
-var AUTHORITY_RANK, INPUT_TRUST_RANK, OUTCOME_RANK, ISOLATION_RANK, AUTHORITY_AXIS = "trustMode.authority", INPUT_TRUST_AXIS = "trustMode.inputTrust";
-var init_ranks = __esm(() => {
-  AUTHORITY_RANK = {
-    "read-only": 0,
-    acting: 1
-  };
-  INPUT_TRUST_RANK = {
-    unvetted: 0,
-    vetted: 1
-  };
-  OUTCOME_RANK = {
-    deny: 0,
-    ask: 1,
-    allow: 2
-  };
-  ISOLATION_RANK = {
-    "not-required": 0,
-    "required-fail-closed": 1
-  };
-});
-
-// src/harness/child/isolation.ts
-function inheritBudget(parentRemaining, childRequest) {
-  if (childRequest.maxRuntimeMs > parentRemaining.maxRuntimeMs) {
-    return {
-      ok: false,
-      reason: `child maxRuntimeMs ${childRequest.maxRuntimeMs} exceeds parent remaining ${parentRemaining.maxRuntimeMs}`
-    };
-  }
-  if (childRequest.maxToolCalls !== undefined) {
-    if (parentRemaining.maxToolCalls === undefined) {
-      return {
-        ok: false,
-        reason: `child requests ${childRequest.maxToolCalls} tool calls but the parent exposes no tool-call budget to inherit`
-      };
-    }
-    if (childRequest.maxToolCalls > parentRemaining.maxToolCalls) {
-      return {
-        ok: false,
-        reason: `child maxToolCalls ${childRequest.maxToolCalls} exceeds parent remaining ${parentRemaining.maxToolCalls}`
-      };
-    }
-  }
-  const reservation = {
-    reservationId: childRequest.reservationId,
-    maxRuntimeMs: childRequest.maxRuntimeMs,
-    ...childRequest.maxToolCalls !== undefined ? { maxToolCalls: childRequest.maxToolCalls } : {}
-  };
-  return { ok: true, reservation };
-}
-function isKnownCapability(value) {
-  return CAPABILITY_KEYS.includes(value);
-}
-function inheritPolicy(parent, childRequest) {
-  if (axesOf(childRequest.trustMode) === undefined || axesOf(parent.trustMode) === undefined) {
-    return {
-      ok: false,
-      reason: `unrecognized trustMode (child "${childRequest.trustMode}", parent "${parent.trustMode}")`
-    };
-  }
-  const broadened = broadeningAxes(parent.trustMode, childRequest.trustMode);
-  if (broadened.length > 0) {
-    return {
-      ok: false,
-      reason: `child trustMode "${childRequest.trustMode}" is broader than parent "${parent.trustMode}" on ${broadened.join(", ")}`
-    };
-  }
-  for (const capability of CAPABILITY_KEYS) {
-    const childOutcome = childRequest.defaults[capability];
-    const parentOutcome = parent.defaults[capability];
-    const childRank = rankOf(OUTCOME_RANK, childOutcome);
-    const parentRank = rankOf(OUTCOME_RANK, parentOutcome);
-    if (childRank === undefined || parentRank === undefined) {
-      return {
-        ok: false,
-        reason: `unrecognized capability outcome for "${capability}" (child "${childOutcome}", parent "${parentOutcome}")`
-      };
-    }
-    if (childRank > parentRank) {
-      return {
-        ok: false,
-        reason: `child capability "${capability}" default "${childOutcome}" is more permissive than parent "${parentOutcome}"`
-      };
-    }
-  }
-  const childIsolation = rankOf(ISOLATION_RANK, childRequest.requiredControls.isolation);
-  const parentIsolation = rankOf(ISOLATION_RANK, parent.requiredControls.isolation);
-  if (childIsolation === undefined || parentIsolation === undefined) {
-    return {
-      ok: false,
-      reason: `unrecognized isolation control (child "${childRequest.requiredControls.isolation}", parent "${parent.requiredControls.isolation}")`
-    };
-  }
-  if (childIsolation < parentIsolation) {
-    return {
-      ok: false,
-      reason: `child isolation "${childRequest.requiredControls.isolation}" is weaker than parent "${parent.requiredControls.isolation}"`
-    };
-  }
-  return { ok: true, policy: childRequest };
-}
-function childProvenance(parent, deps) {
-  const taintIds = [...parent.taintIds ?? [], parent.provenanceId];
-  const provenance = {
-    provenanceId: deps.idSeq(),
-    trustLevel: "derived",
-    sourceKind: parent.sourceKind,
-    taintIds
-  };
-  if (parent.sourceHash !== undefined) {
-    provenance.sourceHash = parent.sourceHash;
-  }
-  return provenance;
-}
-var CAPABILITY_KEYS;
-var init_isolation = __esm(() => {
-  init_ranks();
-  CAPABILITY_KEYS = [
-    "read",
-    "write",
-    "shell",
-    "network",
-    "delegate"
-  ];
+  NOMINAL_CONCURRENT_SPAWN_RUNTIME_MS = 5 * 60000;
 });
 
 // src/harness/child/ledger.ts
@@ -44890,76 +45095,8 @@ function evaluateExtensionGrant(input2, deps) {
   return { ok: true };
 }
 
-// src/harness/parallel/scheduler.ts
-init_isolation();
-function byTaskId(a, b) {
-  return a.taskId < b.taskId ? -1 : a.taskId > b.taskId ? 1 : 0;
-}
-function computeExcluded(tasks) {
-  const excluded = new Set;
-  for (const t of tasks) {
-    if (t.cancelled === true)
-      excluded.add(t.taskId);
-  }
-  let changed = true;
-  while (changed) {
-    changed = false;
-    for (const t of tasks) {
-      if (excluded.has(t.taskId))
-        continue;
-      if (t.dependsOn.some((dep) => excluded.has(dep))) {
-        excluded.add(t.taskId);
-        changed = true;
-      }
-    }
-  }
-  return excluded;
-}
-function decrementRemaining(remaining, reservation) {
-  const maxRuntimeMs = remaining.maxRuntimeMs - reservation.maxRuntimeMs;
-  if (remaining.maxToolCalls !== undefined && reservation.maxToolCalls !== undefined) {
-    return { maxRuntimeMs, maxToolCalls: remaining.maxToolCalls - reservation.maxToolCalls };
-  }
-  return remaining.maxToolCalls !== undefined ? { maxRuntimeMs, maxToolCalls: remaining.maxToolCalls } : { maxRuntimeMs };
-}
-function planWaves(tasks, config, _deps) {
-  if (!Number.isInteger(config.maxConcurrency) || config.maxConcurrency < 1) {
-    return { ok: false, reason: `maxConcurrency must be a positive integer, got ${config.maxConcurrency}` };
-  }
-  const excluded = computeExcluded(tasks);
-  const universe = tasks.filter((t) => !excluded.has(t.taskId));
-  const scheduled = new Set;
-  const waveTaskLists = [];
-  while (scheduled.size < universe.length) {
-    const ready = universe.filter((t) => !scheduled.has(t.taskId) && t.dependsOn.every((dep) => scheduled.has(dep))).sort(byTaskId);
-    if (ready.length === 0) {
-      return { ok: false, reason: "dependency cycle detected: no ready task set could be formed" };
-    }
-    const waveTasks = ready.slice(0, config.maxConcurrency);
-    for (const t of waveTasks)
-      scheduled.add(t.taskId);
-    waveTaskLists.push(waveTasks);
-  }
-  let remaining = config.parentRemaining;
-  const waves = [];
-  for (const waveTasks of waveTaskLists) {
-    const taskIds = [];
-    const reservations = [];
-    for (const t of waveTasks) {
-      const granted = inheritBudget(remaining, t.budgetRequest);
-      if (!granted.ok) {
-        return { ok: false, reason: granted.reason };
-      }
-      taskIds.push(t.taskId);
-      reservations.push(granted.reservation);
-      remaining = decrementRemaining(remaining, granted.reservation);
-    }
-    waves.push({ taskIds, reservations });
-  }
-  return { ok: true, waves };
-}
-
 // src/harness/extension/bound-wave.ts
+init_scheduler();
 function buildPlannedAttemptEvidence(extension, deps) {
   const causal = {
     runId: extension.parentRunId,
@@ -45817,7 +45954,7 @@ function harnessWave(args2, deps) {
 init_make_provider();
 init_orient();
 init_metaproject_adapter();
-import { randomUUID as randomUUID23 } from "crypto";
+import { randomUUID as randomUUID25 } from "crypto";
 import * as readline2 from "readline";
 
 // src/commands/agent-approval-context.ts
@@ -47104,6 +47241,9 @@ function buildInteractiveAgentTools(input2) {
   ];
 }
 
+// src/commands/shell-approval.ts
+init_command_risk();
+
 // src/lib/shell-permissions.ts
 init_config_dir();
 init_shell_config();
@@ -47254,6 +47394,12 @@ function validateShellPattern(pattern) {
       reason: "touches the agent's own permission/credential files; remembering it would let one approved command disable the approval gate for every future session"
     };
   }
+  if (touchesSacConfirmReview(trimmed)) {
+    return {
+      ok: false,
+      reason: "touches SAC's proposal-review/confirm-token family; that guarantee depends on a human answering a real approval prompt, so it is never remembered"
+    };
+  }
   const banned = bannedPrefixGrant(trimmed, firstToken);
   if (banned !== undefined) {
     return { ok: false, reason: banned.reason };
@@ -47391,6 +47537,9 @@ function isShellCommandAllowed(command, allow) {
   if (touchesAgentCredentials(cmd)) {
     return false;
   }
+  if (touchesSacConfirmReview(cmd)) {
+    return false;
+  }
   return allow.some((pat) => matchShellPattern(pat, cmd));
 }
 function shellPermissionsFingerprint(dir) {
@@ -47416,12 +47565,12 @@ function suggestShellPatterns(command) {
   const collapsed = firstLine2.replace(/\s+/g, " ").trim();
   const first = collapsed.split(" ")[0] ?? collapsed;
   const prefix = first.length > 0 ? `${first} *` : exact;
-  const destructive = trimmed.length > 0 && isDestructiveCommand(trimmed);
+  const neverRemember = trimmed.length > 0 && (isDestructiveCommand(trimmed) || touchesSacConfirmReview(trimmed));
   return {
     exact,
     prefix,
-    offerExact: !destructive && validateShellPattern(exact).ok,
-    offerPrefix: !destructive && validateShellPattern(prefix).ok
+    offerExact: !neverRemember && validateShellPattern(exact).ok,
+    offerPrefix: !neverRemember && validateShellPattern(prefix).ok
   };
 }
 function parseShellExecCommand(inputJson) {
@@ -47444,16 +47593,18 @@ function evaluateShellApproval(input2) {
   const command = parseShellExecCommand(input2.inputJson);
   const destructive = input2.meta?.destructive === true;
   const credentials = input2.meta?.credentials === true;
+  const sacReviewConfirmation = touchesSacConfirmReview(command);
   const audit = io.loadAudit();
   for (const pattern of audit.permissions.allow) {
     input2.sessionAllow.add(pattern);
   }
   const tampered = io.fingerprint() !== input2.fingerprintAtStart;
-  const autoApprove = !destructive && !credentials && isShellCommandAllowed(command, [...input2.sessionAllow]);
+  const autoApprove = !destructive && !credentials && !sacReviewConfirmation && isShellCommandAllowed(command, [...input2.sessionAllow]);
   return {
     command,
     destructive,
     credentials,
+    sacReviewConfirmation,
     autoApprove,
     rejected: audit.rejected,
     tampered
@@ -47478,6 +47629,9 @@ function formatShellApprovalHints(evaled) {
   if (evaled.credentials) {
     lines.push("touches agent credentials \u2014 will not be remembered");
   }
+  if (evaled.sacReviewConfirmation) {
+    lines.push("SAC proposal review/confirm-token \u2014 will not be remembered");
+  }
   return lines;
 }
 
@@ -47880,7 +48034,7 @@ function createSpawnSubagentTool(deps) {
     invoke: async (input2) => {
       const task = typeof input2.task === "string" ? input2.task.trim() : "";
       if (task.length === 0) {
-        return { output: "spawn_subagent requires a non-empty 'task'", isError: true };
+        return { status: "Error", output: "spawn_subagent requires a non-empty 'task'", isError: true };
       }
       const mode = input2.mode === "general" ? "general" : "read_only";
       const maxToolCalls = typeof input2.max_tool_calls === "number" && input2.max_tool_calls > 0 ? Math.min(MAX_SUBAGENT_MAX_TOOL_CALLS, Math.floor(input2.max_tool_calls)) : DEFAULT_SUBAGENT_MAX_TOOL_CALLS;
@@ -47931,6 +48085,7 @@ function createSpawnSubagentTool(deps) {
           task
         });
         return {
+          status: "Denied",
           output: `spawn_subagent denied by MAE: ${spawned.reason}`,
           isError: true
         };
@@ -48120,6 +48275,7 @@ function createSpawnSubagentTool(deps) {
 
 ` + "Return a concise summary of findings and any recommended next steps for the parent agent.";
         const turn = runAgentTurn(io, childDeps, history, userLine, { signal: childAbort.signal });
+        let turnResult;
         if (deadlineMs > 0) {
           let timer;
           const expired = new Promise((resolve3) => {
@@ -48141,20 +48297,26 @@ function createSpawnSubagentTool(deps) {
             await foldChildSlateAndCleanup("incomplete");
             const partial = assistant.trim();
             return {
+              status: "Timeout",
               output: `subagent ${label} (${workerId}) timed out after ${deadlineMs}ms and was abandoned ` + `(tighten or disable with ${ENV_SUBAGENT_TIMEOUT_MS})` + (partial.length > 0 ? `
 --- partial output ---
 ${boundSummary(partial)}` : ""),
-              isError: true
+              isError: true,
+              ...partial.length > 0 ? { partial: boundSummary(partial) } : {}
             };
           }
+          turnResult = await turn;
         } else {
-          await turn;
+          turnResult = await turn;
         }
         closed = true;
         releaseBudget();
         const raw = assistant.trim().length > 0 ? assistant.trim() : history.filter((m) => m.role === "assistant").map((m) => m.content).join(`
 `).trim() || "(subagent produced no text)";
         const folded = foldChildSummary(raw);
+        const finishReason = turnResult?.finishReason;
+        const status = finishReason === "budget" ? "BudgetExhausted" : finishReason === "no-progress" ? "NoProgress" : "Completed";
+        const isError = status !== "Completed";
         emitSubagentFleet({
           kind: "upsert",
           id: workerId,
@@ -48166,11 +48328,13 @@ ${boundSummary(partial)}` : ""),
         });
         await foldChildSlateAndCleanup("completed");
         return {
+          status,
+          isError,
           output: `subagent ${label} (${workerId}) ${mode} via ${runModel.provider}/${runModel.model}
 ` + `MAE reservation: tools\u2264${spawned.reservation.maxToolCalls ?? maxToolCalls} ` + `runtime\u2264${spawned.reservation.maxRuntimeMs}ms children=${ledger.childCount}
 ` + `--- summary ---
 ${boundSummary(folded.text)}`,
-          isError: false
+          ...status !== "Completed" ? { partial: boundSummary(folded.text) } : {}
         };
       } catch (cause) {
         closed = true;
@@ -48186,7 +48350,7 @@ ${boundSummary(folded.text)}`,
           task
         });
         await foldChildSlateAndCleanup("incomplete");
-        return { output: `subagent ${label} failed: ${msg}`, isError: true };
+        return { status: "Error", output: `subagent ${label} failed: ${msg}`, isError: true };
       }
     }
   };
@@ -48582,7 +48746,7 @@ import { spawnSync as spawnSync2 } from "child_process";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.43",
+  version: "0.2.45",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -49832,8 +49996,195 @@ function openModal(otui, chrome, input2) {
 // src/tui/inspector-sources.ts
 init_store2();
 init_workspace_service();
+import { randomUUID as randomUUID24 } from "crypto";
+
+// src/sac/catch-up.ts
+init_fs();
+init_config_dir();
+init_paths();
 init_slate();
+init_store3();
+init_proposal_lifecycle();
+init_workspace_service();
+import { randomUUID as randomUUID23 } from "crypto";
+import { readdir as readdir24 } from "fs/promises";
+import path145 from "path";
+
+// src/sac/lifecycle-flag.ts
+init_store();
+init_service3();
+init_decision_dedup();
+init_workspace_service();
 import { randomUUID as randomUUID22 } from "crypto";
+function normalize3(raw) {
+  return raw.replace(/^\.\//, "");
+}
+function isStillPresent(recorded, valid) {
+  const normalized = normalize3(recorded);
+  return valid.has(normalized) || valid.has(moduleNameFromProjectPath(normalized));
+}
+async function computeLifecycleFlags(cwd, now = () => new Date) {
+  const valid = await validModuleNames(cwd);
+  if (valid === undefined)
+    return [];
+  const flaggedAt = now().toISOString();
+  const flags = [];
+  const workspaceService = new WorkspaceService({
+    workspaceRoot: cwd,
+    authorizationServer: localWorkspaceAuthorizationServer(),
+    strictGuard: { mode: "strict", availability: "available", decision: "pass", policyRevision: "local-offline-v1" }
+  });
+  const workspaces = await workspaceService.list({ request: undefined, requestCorrelationId: randomUUID22(), includeArchived: true });
+  for (const workspace of workspaces) {
+    const component = workspace.resources.find((r) => r.kind === "component")?.uri;
+    if (component !== undefined && !isStillPresent(component, valid)) {
+      flags.push({ kind: "workspace", ref: workspace.id, missingComponent: normalize3(component), flaggedAt });
+    }
+  }
+  for (const entry of await collectEntries(cwd)) {
+    const module = entry.scopes.module;
+    if (module !== null && module.length > 0 && !isStillPresent(module, valid)) {
+      flags.push({ kind: "memory-entry", ref: entry.relativePath, missingComponent: normalize3(module), flaggedAt });
+    }
+  }
+  for (const decision of await collectWikiDecisionEntries(cwd)) {
+    const module = decision.scopes.module;
+    if (module !== null && module.length > 0 && !isStillPresent(module, valid)) {
+      flags.push({ kind: "wiki-decision", ref: decision.relativePath, missingComponent: normalize3(module), flaggedAt });
+    }
+  }
+  return flags;
+}
+
+// src/sac/catch-up.ts
+async function buildCatchUp(input2) {
+  const [proposals, sessionCategories, lifecycleFlagsAll] = await Promise.all([
+    collectProposals(input2.cwd, input2.workspaceId),
+    collectSessionCategories(input2.cwd),
+    computeLifecycleFlags(input2.cwd)
+  ]);
+  const lifecycleFlags = input2.workspaceId === undefined ? lifecycleFlagsAll : lifecycleFlagsAll.filter((flag) => flag.kind !== "workspace" || flag.ref === input2.workspaceId);
+  return { proposals, ...sessionCategories, lifecycleFlags };
+}
+async function collectProposals(cwd, workspaceId) {
+  const authorizationServer = localWorkspaceAuthorizationServer();
+  const actor = await authorizationServer.actorContextFor(undefined, randomUUID23());
+  if (!actor)
+    throw new Error("trusted ActorContext is required for catch-up");
+  const proposalService = createLocalProposalLifecycleService(cwd);
+  const groups = await proposalService.listVisibleProposedProposals(actor);
+  const scoped = workspaceId === undefined ? groups : groups.filter((group) => group.workspace.id === workspaceId);
+  const flattened = scoped.flatMap((group) => group.proposals.map((proposal) => ({ group, proposal })));
+  return Promise.all(flattened.map(async ({ group, proposal }) => {
+    const fresh = await proposalService.isEvidenceFresh(proposal, actor);
+    return { type: "proposal", workspaceId: group.workspace.id, proposalId: proposal.id, fresh };
+  }));
+}
+async function classifySession(session) {
+  const dir = sessionDir(session.projectPath, session.id);
+  if (await isLockHeld(slateLockPath(dir)))
+    return;
+  const terminalState = await readTerminalState(dir);
+  if (terminalState !== undefined) {
+    const workspaceId2 = (await safeReadSlate(dir))?.workspaceId;
+    return { kind: "blocked", item: { type: "blocked", sessionId: session.id, ...workspaceId2 !== undefined ? { workspaceId: workspaceId2 } : {}, terminalState } };
+  }
+  const unboundCandidate = await readNewestUnboundCandidate(dir);
+  if (unboundCandidate !== undefined) {
+    return {
+      kind: "unbound-candidate",
+      item: { type: "unbound-candidate", sessionId: session.id, evidencePath: unboundCandidate.evidencePath, summary: unboundCandidate.summary }
+    };
+  }
+  if (!await isSlateEngaged(dir))
+    return;
+  const workspaceId = (await safeReadSlate(dir))?.workspaceId;
+  return { kind: "unknown", item: { type: "unknown", sessionId: session.id, ...workspaceId !== undefined ? { workspaceId } : {}, lastSeenAt: session.updatedAt } };
+}
+async function collectSessionCategories(cwd) {
+  const classified = await Promise.all(listSessions(cwd).map((session) => classifySession(session)));
+  const blocked2 = [];
+  const unboundCandidates = [];
+  const unknown = [];
+  for (const category of classified) {
+    if (category === undefined)
+      continue;
+    if (category.kind === "blocked")
+      blocked2.push(category.item);
+    else if (category.kind === "unbound-candidate")
+      unboundCandidates.push(category.item);
+    else
+      unknown.push(category.item);
+  }
+  return { blocked: blocked2, unboundCandidates, unknown };
+}
+async function isSlateEngaged(dir) {
+  if (await pathExists(path145.join(dir, "slate.json")))
+    return true;
+  if (await pathExists(path145.join(dir, "terminal-state.json")))
+    return true;
+  try {
+    const entries = await readdir24(path145.join(dir, "slate-archive"));
+    return entries.length > 0;
+  } catch {
+    return false;
+  }
+}
+async function safeReadSlate(dir) {
+  try {
+    return await readSlate(dir);
+  } catch {
+    return;
+  }
+}
+async function readTerminalState(dir) {
+  const result = readConfigFile(path145.join(dir, "terminal-state.json"));
+  if (!result.ok) {
+    return;
+  }
+  try {
+    return JSON.parse(result.text);
+  } catch {
+    return;
+  }
+}
+async function readNewestUnboundCandidate(dir) {
+  const archiveDir = path145.join(dir, "slate-archive");
+  let entries;
+  try {
+    entries = (await readdir24(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
+  } catch {
+    return;
+  }
+  entries.sort();
+  for (let i = entries.length - 1;i >= 0; i--) {
+    const evidencePath = path145.join(archiveDir, entries[i]);
+    const result = readConfigFile(evidencePath);
+    if (!result.ok) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(result.text);
+      if (parsed.recordType !== "unbound-candidate")
+        continue;
+      return { evidencePath, summary: summarizeUnboundCandidate(parsed.groups) };
+    } catch {
+      continue;
+    }
+  }
+  return;
+}
+function summarizeUnboundCandidate(groups) {
+  const safeGroups = groups ?? [];
+  if (safeGroups.length === 0)
+    return "no seeds captured";
+  const seedCount = safeGroups.reduce((sum, group) => sum + (group.seeds?.length ?? 0), 0);
+  const kinds = safeGroups.map((group) => typeof group.kind === "string" ? group.kind : "unknown").join(", ");
+  return `${seedCount} untriaged seed(s) across ${safeGroups.length} kind(s) (${kinds})`;
+}
+
+// src/tui/inspector-sources.ts
+init_slate();
 
 // src/session/index.ts
 init_paths();
@@ -49912,7 +50263,7 @@ async function loadInspectorWorkspaces(cwd) {
       authorizationServer: localWorkspaceAuthorizationServer(),
       strictGuard: localSacGuard()
     });
-    const listed = await service5.list({ request: undefined, requestCorrelationId: randomUUID22() });
+    const listed = await service5.list({ request: undefined, requestCorrelationId: randomUUID24() });
     return listed.map(workspaceFromManifest);
   } catch {
     return [];
@@ -49925,7 +50276,7 @@ async function loadInspectorWorkspace(cwd, workspaceId) {
       authorizationServer: localWorkspaceAuthorizationServer(),
       strictGuard: localSacGuard()
     });
-    const manifest = await service5.show({ request: undefined, requestCorrelationId: randomUUID22(), workspaceId });
+    const manifest = await service5.show({ request: undefined, requestCorrelationId: randomUUID24(), workspaceId });
     return workspaceFromManifest(manifest);
   } catch {
     return;
@@ -49998,6 +50349,16 @@ function formatWorkspaceLines(workspaces) {
   const width = workspaces.reduce((max, workspace) => Math.max(max, workspace.id.length), 0);
   return workspaces.map((workspace) => `${workspace.id.padEnd(width)}  ${workspace.status}  ${workspace.title}`);
 }
+async function loadInspectorCatchUp(cwd) {
+  try {
+    return await buildCatchUp({ cwd });
+  } catch {
+    return { proposals: [], blocked: [], unboundCandidates: [], unknown: [], lifecycleFlags: [] };
+  }
+}
+function catchUpItems(report) {
+  return [...report.proposals, ...report.blocked, ...report.unboundCandidates, ...report.unknown];
+}
 function formatSessionFlowLines(flows) {
   if (flows.length === 0) {
     return ["No flows recorded in this session."];
@@ -50490,6 +50851,332 @@ function openWorkspace(otui, chrome, options) {
   return presentWorkspace((hostOtui, hostChrome, input2) => openModal(hostOtui, hostChrome, input2), otui, chrome, options);
 }
 
+// src/tui/review-inspector.ts
+var REVIEW_COMMAND = "/review";
+var REVIEW_FOOTER = [
+  { key: "[/]", label: "item" },
+  { key: "a y", label: "accept" },
+  { key: "\u2191/\u2193", label: "scroll" },
+  { key: "\u2190/\u2192", label: "tabs" },
+  { key: "esc", label: "close" }
+];
+function isReviewCommand(line) {
+  const token = line.trim().split(/\s+/)[0] ?? "";
+  return token === REVIEW_COMMAND;
+}
+var TYPE_LABEL = {
+  proposal: "PROPOSAL",
+  blocked: "BLOCKED",
+  "unbound-candidate": "UNBOUND",
+  unknown: "UNKNOWN"
+};
+function summarizeReviewItem(item) {
+  switch (item.type) {
+    case "proposal":
+      return `${item.proposalId} in ${item.workspaceId}${item.fresh ? "" : " (stale)"}`;
+    case "blocked":
+      return `${item.sessionId} \u2014 ${item.terminalState.reason}`;
+    case "unbound-candidate":
+      return `${item.sessionId} \u2014 ${item.summary}`;
+    case "unknown":
+      return `${item.sessionId} \u2014 last seen ${item.lastSeenAt}`;
+  }
+}
+function formatReviewListLines(items, selected) {
+  if (items.length === 0) {
+    return ["Nothing needs review right now."];
+  }
+  return items.map((item, index) => {
+    const mark = index === selected ? ">" : " ";
+    return `${mark} ${TYPE_LABEL[item.type].padEnd(8)} ${summarizeReviewItem(item)}`;
+  });
+}
+function describeReviewItem(item) {
+  switch (item.type) {
+    case "proposal":
+      return [
+        `Proposal   ${item.proposalId}`,
+        `Workspace  ${item.workspaceId}`,
+        `Evidence   ${item.fresh ? "fresh" : "stale \u2014 evidence has drifted since this proposal was created; re-run wrap-up before deciding"}`,
+        "",
+        `Reject/dismiss from a terminal: keryx workspace review ${item.workspaceId} ${item.proposalId} --decision <rejected|dismissed>`
+      ];
+    case "blocked":
+      return [
+        `Session    ${item.sessionId}${item.workspaceId !== undefined ? `  (workspace ${item.workspaceId})` : ""}`,
+        `Stopped unattended: ${item.terminalState.reason}`,
+        `Occurred   ${item.terminalState.occurredAt}`,
+        "",
+        `Resume: keryx shell -r ${item.sessionId}`
+      ];
+    case "unbound-candidate":
+      return [
+        `Session    ${item.sessionId}`,
+        `Untriaged seeds: ${item.summary}`,
+        `Evidence   ${item.evidencePath}`,
+        "",
+        `Bind: keryx workspace propose <workspace-id> --kind <kind> --session ${item.sessionId}`
+      ];
+    case "unknown":
+      return [
+        `Session    ${item.sessionId}${item.workspaceId !== undefined ? `  (workspace ${item.workspaceId})` : ""}`,
+        `Last seen  ${item.lastSeenAt}`,
+        "No proposal, terminal state, or unbound-candidate artifact recorded.",
+        "",
+        `Investigate: keryx sessions list / keryx shell -r ${item.sessionId}`
+      ];
+  }
+}
+function formatReviewDetailLines(item, status) {
+  if (item === undefined) {
+    return ["No item selected.", "", "Press Enter (or click a row) on the Review tab to view one."];
+  }
+  const lines = describeReviewItem(item);
+  if (item.type !== "proposal") {
+    return lines;
+  }
+  const withAction = [...lines, ""];
+  if (status.kind === "armed") {
+    withAction.push("Press [y] to CONFIRM accept, any other key cancels.");
+  } else if (status.kind === "running") {
+    withAction.push("Accepting\u2026 running `keryx workspace confirm-review` then `keryx workspace review`.");
+  } else if (status.kind === "done" && status.outcome.ok) {
+    withAction.push("\u2713 Accepted.");
+  } else if (status.kind === "done" && !status.outcome.ok) {
+    withAction.push(`\u2717 Accept failed: ${status.outcome.message}`);
+  } else {
+    withAction.push("[a] Accept this proposal");
+  }
+  return withAction;
+}
+function clampScroll3(offset, lineCount, height) {
+  const max = Math.max(0, lineCount - height);
+  return Math.min(max, Math.max(0, offset));
+}
+function windowLines3(lines, offset, height) {
+  if (height < 1) {
+    return [];
+  }
+  const start = clampScroll3(offset, lines.length, height);
+  return lines.slice(start, start + height);
+}
+function scrollToReveal3(index, offset, height) {
+  if (index < offset) {
+    return index;
+  }
+  if (index >= offset + height) {
+    return index - height + 1;
+  }
+  return offset;
+}
+function wrapLines3(text, width) {
+  if (width === undefined || width < 8) {
+    return text;
+  }
+  return text.split(`
+`).flatMap((line) => {
+    if (line.length <= width) {
+      return [line];
+    }
+    const chunks = [];
+    for (let i = 0;i < line.length; i += width) {
+      chunks.push(line.slice(i, i + width));
+    }
+    return chunks;
+  }).join(`
+`);
+}
+function paintLines3(otui, renderer, body, lines, width) {
+  if (otui === undefined || otui === null || body === undefined || body === null) {
+    return;
+  }
+  const parent = body;
+  const ctor = otui.TextRenderable;
+  if (parent.add === undefined || ctor === undefined) {
+    return;
+  }
+  const node = new ctor(renderer, { id: "review-body", content: wrapLines3(lines.join(`
+`), width) });
+  parent.add(node);
+  return node;
+}
+function presentReview(openModal2, otui, chrome, options) {
+  const items = [...options.items];
+  let selected = 0;
+  let listScroll = 0;
+  let detailScroll = 0;
+  let status = { kind: "idle" };
+  let listNode;
+  let detailNode;
+  let unsubscribeKey;
+  const rendererHint = options.renderer ?? chrome?.renderer;
+  const bodyRows = options.visibleRows ?? (typeof rendererHint?.width === "number" && typeof rendererHint.height === "number" ? modalBodyRows(resolveModalPanelSize(rendererHint.width, rendererHint.height).height) : 13);
+  let tabWidth;
+  const listLines = () => formatReviewListLines(items, selected);
+  const detailLines = () => wrapLines3(formatReviewDetailLines(items[selected], status).join(`
+`), tabWidth).split(`
+`);
+  const paintSelection = () => {
+    listScroll = scrollToReveal3(selected, listScroll, bodyRows);
+    listScroll = clampScroll3(listScroll, items.length, bodyRows);
+    detailScroll = clampScroll3(detailScroll, detailLines().length, bodyRows);
+    if (listNode !== undefined) {
+      listNode.content = windowLines3(listLines(), listScroll, bodyRows).join(`
+`);
+    }
+    if (detailNode !== undefined) {
+      detailNode.content = windowLines3(detailLines(), detailScroll, bodyRows).join(`
+`);
+    }
+  };
+  const moveSelection = (next) => {
+    if (items.length === 0) {
+      return;
+    }
+    const clamped = Math.min(items.length - 1, Math.max(0, next));
+    if (clamped === selected) {
+      return;
+    }
+    selected = clamped;
+    detailScroll = 0;
+    status = { kind: "idle" };
+    paintSelection();
+  };
+  const runAccept = () => {
+    const item = items[selected];
+    if (item === undefined || item.type !== "proposal" || options.acceptProposal === undefined) {
+      return;
+    }
+    status = { kind: "running" };
+    paintSelection();
+    options.acceptProposal(item).then((outcome) => {
+      status = { kind: "done", outcome };
+      if (outcome.ok) {
+        options.onAccepted?.(item);
+      }
+      paintSelection();
+    });
+  };
+  const handle = openModal2(otui, chrome, {
+    title: REVIEW_COMMAND,
+    tabs: [
+      { id: "list", label: "Review" },
+      { id: "detail", label: "Detail" }
+    ],
+    initialTab: "list",
+    footer: REVIEW_FOOTER,
+    renderTab: (tabId, body, ctx) => {
+      const renderer = options.renderer ?? chrome?.renderer;
+      tabWidth = ctx?.width;
+      if (tabId === "list") {
+        listScroll = scrollToReveal3(selected, listScroll, bodyRows);
+        listNode = paintLines3(otui, renderer, body, windowLines3(listLines(), listScroll, bodyRows));
+        return;
+      }
+      detailScroll = clampScroll3(detailScroll, detailLines().length, bodyRows);
+      detailNode = paintLines3(otui, renderer, body, windowLines3(detailLines(), detailScroll, bodyRows), tabWidth);
+    },
+    onClose: () => {
+      unsubscribeKey?.();
+    }
+  });
+  if (handle === undefined) {
+    return;
+  }
+  if (options.onKeypress !== undefined) {
+    unsubscribeKey = options.onKeypress((key) => {
+      const token = key.name || key.sequence;
+      if (items.length === 0) {
+        return;
+      }
+      const onDetail = handle.activeTab() === "detail";
+      if (onDetail && status.kind === "armed") {
+        if (token === "y") {
+          runAccept();
+        } else {
+          status = { kind: "idle" };
+          paintSelection();
+        }
+        return;
+      }
+      if (token === "[" || token === "p") {
+        moveSelection(selected - 1);
+        return;
+      }
+      if (token === "]" || token === "n") {
+        moveSelection(selected + 1);
+        return;
+      }
+      if (token === "return" || token === "enter") {
+        handle.setTab("detail");
+        return;
+      }
+      if (onDetail && token === "a" && items[selected]?.type === "proposal" && options.acceptProposal !== undefined && status.kind !== "running") {
+        status = { kind: "armed" };
+        paintSelection();
+        return;
+      }
+      if (token === "up" || token === "k") {
+        if (onDetail) {
+          detailScroll = clampScroll3(detailScroll - 1, detailLines().length, bodyRows);
+          paintSelection();
+        } else {
+          moveSelection(selected - 1);
+        }
+        return;
+      }
+      if (token === "down" || token === "j") {
+        if (onDetail) {
+          detailScroll = clampScroll3(detailScroll + 1, detailLines().length, bodyRows);
+          paintSelection();
+        } else {
+          moveSelection(selected + 1);
+        }
+        return;
+      }
+      if (onDetail && (token === "pageup" || token === "pagedown")) {
+        const step = token === "pageup" ? -bodyRows : bodyRows;
+        detailScroll = clampScroll3(detailScroll + step, detailLines().length, bodyRows);
+        paintSelection();
+      }
+    });
+  }
+  return handle;
+}
+function openReview(otui, chrome, options) {
+  return presentReview((hostOtui, hostChrome, input2) => openModal(hostOtui, hostChrome, input2), otui, chrome, options);
+}
+
+// src/tui/review-accept.ts
+function shQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+async function acceptProposalViaShell(run, workspaceId, proposalId) {
+  const mint = await run(`keryx workspace confirm-review ${shQuote(workspaceId)} ${shQuote(proposalId)}`);
+  if (mint.isError) {
+    return { ok: false, message: mint.output };
+  }
+  let token;
+  try {
+    const parsed = JSON.parse(mint.output);
+    const candidate = parsed?.token;
+    if (typeof candidate !== "string" || candidate.length === 0) {
+      throw new Error("no token in confirm-review output");
+    }
+    token = candidate;
+  } catch (cause) {
+    return {
+      ok: false,
+      message: `could not parse \`keryx workspace confirm-review\` output: ${cause instanceof Error ? cause.message : String(cause)}`
+    };
+  }
+  const accept = await run(`keryx workspace review ${shQuote(workspaceId)} ${shQuote(proposalId)} --decision accepted --confirm-token ${shQuote(token)}`);
+  if (accept.isError) {
+    return { ok: false, message: accept.output };
+  }
+  return { ok: true };
+}
+
 // src/tui/tui-shell.ts
 init_slate();
 
@@ -50854,6 +51541,11 @@ var AGENT_SLASH_COMMANDS = [
     description: "Show this session's SAC workspace and its slates",
     modes: AGENT_ONLY
   },
+  {
+    name: "/review",
+    description: "Show project-wide items needing review (proposals, blocked sessions)",
+    modes: AGENT_ONLY
+  },
   {
     name: "/compact",
     description: "Compact model context \u2014 /compact [focus] (archive kept)",
@@ -51217,10 +51909,10 @@ init_shell_config();
 // src/lib/permission-mode-config.ts
 init_permission_mode();
 init_config_dir();
-import path145 from "path";
+import path146 from "path";
 var EMPTY3 = { schemaVersion: 1, projects: {} };
 function permissionModeConfigPath(dir) {
-  return path145.join(keryxConfigDir(dir), "permission-mode.json");
+  return path146.join(keryxConfigDir(dir), "permission-mode.json");
 }
 function withRegistryLock2(dir, fn) {
   return withFileLock(`${permissionModeConfigPath(dir)}.lock`, fn, {
@@ -51565,7 +52257,7 @@ function showComposerChoice(otui, r, dock, request) {
 // src/lib/version-check.ts
 init_config_dir();
 init_fs();
-import path146 from "path";
+import path147 from "path";
 var REGISTRY_URL = "https://registry.npmjs.org/@mrciphersmith%2Fkeryx/latest";
 var FIXED_INSTALL_COMMAND = "npm install -g @mrciphersmith/keryx@latest";
 var RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
@@ -51767,7 +52459,7 @@ async function checkVersion(options) {
   const now = options.now ?? Date.now;
   const timestamp = now();
   const configDir = ensureKeryxConfigDir(options.cacheDir);
-  const cacheFile = path146.join(configDir, "version-check.json");
+  const cacheFile = path147.join(configDir, "version-check.json");
   const cache = parseCache(cacheFile);
   if (cache?.latestVersion !== undefined && cache.successAt !== undefined && timestamp - cache.successAt >= 0 && timestamp - cache.successAt < SUCCESS_CACHE_TTL_MS) {
     return resultFor(options.currentVersion, current, cache.latestVersion, "cache");
@@ -53950,6 +54642,20 @@ async function launchTuiAgentShell(opts) {
       currentSlates = slates;
       sbWorkspaceV.content = workspace === undefined ? otui.t`${otui.dim("\u2014")}` : otui.t`${otui.dim(`${shortenCwd(workspace.title, SIDEBAR_TEXT_WIDTH)} \xB7 ${workspace.status} \xB7 ${slates.length} slate${slates.length === 1 ? "" : "s"}`)}`;
     };
+    sidebar.add(new otui.TextRenderable(r, { id: "sb-review-k", content: otui.t`${otui.dim("Review")}`, marginTop: 1 }));
+    const sbReviewV = new otui.TextRenderable(r, {
+      id: "sb-review-v",
+      content: otui.t`${otui.dim("\u2014")}`,
+      onMouseDown: () => {
+        showReview();
+      }
+    });
+    sidebar.add(sbReviewV);
+    const refreshReviewSidebar = async () => {
+      const cwd = opts.session?.cwd ?? process.cwd();
+      const count = catchUpItems(await loadInspectorCatchUp(cwd)).length;
+      sbReviewV.content = count === 0 ? otui.t`${otui.dim("\u2014 nothing to review")}` : otui.t`${otui.yellow(`${count} item${count === 1 ? "" : "s"} need review`)}`;
+    };
     sidebar.add(new otui.TextRenderable(r, { id: "sb-ctx-k", content: otui.t`${otui.dim("Context")}`, marginTop: 1 }));
     const sbContext = new otui.TextRenderable(r, { id: "sb-ctx-v", content: otui.t`${otui.dim("0 tokens")}` });
     sidebar.add(sbContext);
@@ -54390,6 +55096,7 @@ async function launchTuiAgentShell(opts) {
     }
     slateSession = { dir: liveSession.dir, cwd: sessionCwd, opened: false };
     refreshWorkspaceSidebar();
+    refreshReviewSidebar();
     const paintSessionHeader = () => {
       const label = `${currentSel.provider}/${currentSel.model}`;
       const sid = shortSessionId(liveSession.summary.id);
@@ -54559,6 +55266,21 @@ Staying in the current session.
         });
       })();
     };
+    const showReview = () => {
+      (async () => {
+        const cwd = inspectorCwd();
+        const items = catchUpItems(await loadInspectorCatchUp(cwd));
+        openReview(otui, chrome, {
+          items,
+          acceptProposal: (item) => acceptProposalViaShell(makeCommandRunner(cwd), item.workspaceId, item.proposalId),
+          onAccepted: () => {
+            refreshReviewSidebar();
+          },
+          renderer: r,
+          ...inspectorKeys
+        });
+      })();
+    };
     const updateModelLabels = () => {
       paintSessionHeader();
       const label = `${currentSel.provider}/${currentSel.model}`;
@@ -55078,6 +55800,7 @@ Staying in the current session.
             startNewSession();
             slateSession = { dir: liveSession.dir, cwd: sessionCwd, opened: false };
             refreshWorkspaceSidebar();
+            refreshReviewSidebar();
             sessions.clear();
             deps.resetSubagentBudget?.();
             io.onSystem?.(`New session ${shortSessionId(liveSession.summary.id)} (previous kept on disk \xB7 /resume)
@@ -55216,6 +55939,10 @@ Staying in the current session.
           showWorkspace();
           return;
         }
+        if (isReviewCommand(command.name)) {
+          showReview();
+          return;
+        }
         if (command.name === "/copy") {
           const target = newestBlock();
           if (target === undefined || !copyBlock(target.id)) {
@@ -55535,6 +56262,7 @@ ${formatThemeList(getThemeId())}`);
         const secs = ((Date.now() - startedAt) / 1000).toFixed(1);
         stopBusy();
         refreshWorkspaceSidebar();
+        refreshReviewSidebar();
         setMainAgent(turnFailed ? "failed" : "done", turnFailed ? "error" : "idle");
         try {
           flushSessionCheckpoint();
@@ -56903,7 +57631,7 @@ ${indentBlock(style.dim(context), GUTTER)}`);
         out(`${GUTTER}${style.yellow(hint)}
 `);
       }
-      const rememberable = !evaled.destructive && !evaled.credentials;
+      const rememberable = !evaled.destructive && !evaled.credentials && !evaled.sacReviewConfirmation;
       const prompt = rememberable ? "[y/N/A=always] " : "[y/N] ";
       out(`
 ${GUTTER}${style.yellow(`Run: ${evaled.command}`)} ${style.dim(prompt)}`);
@@ -57445,7 +58173,7 @@ async function shellCommand(args2, runtime = {}) {
           modelId: sel.model
         }),
         maxToolCalls: resolveAgentMaxToolCalls(),
-        idSeq: () => randomUUID23(),
+        idSeq: () => randomUUID25(),
         ...resetSubagentBudget !== undefined ? { resetSubagentBudget } : {}
       };
     };
@@ -57477,7 +58205,7 @@ async function shellCommand(args2, runtime = {}) {
         makeShellDeps: (sel) => ({
           makeProvider: chatFactory,
           clock: () => new Date().toISOString(),
-          idSeq: () => randomUUID23(),
+          idSeq: () => randomUUID25(),
           initial: sel,
           session: {
             cwd,
@@ -57548,7 +58276,7 @@ async function shellCommand(args2, runtime = {}) {
     const deps = {
       makeProvider: baseFactory,
       clock: () => new Date().toISOString(),
-      idSeq: () => randomUUID23(),
+      idSeq: () => randomUUID25(),
       initial: baseUrl2 === undefined ? { provider, model } : { provider, model, baseUrl: baseUrl2 },
       selectProviderModel: realSelectProviderModel(baseUrl2)
     };
@@ -57599,7 +58327,7 @@ async function shellCommand(args2, runtime = {}) {
           modelId: model
         }),
         maxToolCalls: resolveAgentMaxToolCalls(),
-        idSeq: () => randomUUID23(),
+        idSeq: () => randomUUID25(),
         ...resetSubagentBudget !== undefined ? { resetSubagentBudget } : {}
       };
       let resumeId = flags.resumeId;
@@ -57771,7 +58499,7 @@ Shell:
 init_fs();
 import { readFile as readFile78 } from "fs/promises";
 import { stdin } from "process";
-import path147 from "path";
+import path148 from "path";
 var MODULES = [
   { name: "gdgraph", flag: "--no-gdgraph", desc: "code graph, symbols, affected context", defaultEnabled: true },
   { name: "gdctx", flag: "--no-gdctx", desc: "token-aware command/read output", defaultEnabled: true },
@@ -57817,8 +58545,8 @@ async function modulesCommand(args2 = []) {
     return;
   }
   const wantsJson = args2.includes("--json") && (sub === undefined || sub === "status" || sub === "list" || sub === "--json");
-  const metaprojectRoot = path147.join(process.cwd(), ".metaproject");
-  const manifestPath = path147.join(metaprojectRoot, "metaproject.json");
+  const metaprojectRoot = path148.join(process.cwd(), ".metaproject");
+  const manifestPath = path148.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     if (wantsJson) {
       console.log(JSON.stringify({ schemaVersion: 1, error: "not-initialized", modules: [] }, null, 2));
@@ -57932,18 +58660,18 @@ function printHelp16() {
 }
 
 // src/commands/serve.ts
-import { randomUUID as randomUUID26 } from "crypto";
+import { randomUUID as randomUUID28 } from "crypto";
 
 // src/lib/serve-config.ts
 init_config_dir();
 import { existsSync as existsSync27 } from "fs";
-import path148 from "path";
+import path149 from "path";
 var SERVE_CONFIG_SCHEMA_VERSION = "1.0.0";
 var DEFAULT_SERVE_BIND_ADDRESS = "127.0.0.1";
 var DEFAULT_SERVE_PORT = 7377;
 var DEFAULT_SERVE_PROFILE = "remote-restricted";
 function serveConfigPath(dir) {
-  return path148.join(keryxConfigDir(dir), "serve.json");
+  return path149.join(keryxConfigDir(dir), "serve.json");
 }
 function parseIpv4(value) {
   const parts = value.split(".");
@@ -58259,7 +58987,7 @@ function saveServeConfig(config, dir, onWarn) {
 
 // src/lib/serve-credential.ts
 init_config_dir();
-import { createHash as createHash33, randomBytes as randomBytes3, randomUUID as randomUUID24 } from "crypto";
+import { createHash as createHash33, randomBytes as randomBytes3, randomUUID as randomUUID26 } from "crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync3,
@@ -58271,9 +58999,9 @@ import {
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync8
 } from "fs";
-import path149 from "path";
+import path150 from "path";
 function serveCredentialPath(dir) {
-  return path149.join(keryxConfigDir(dir), "serve-credentials.json");
+  return path150.join(keryxConfigDir(dir), "serve-credentials.json");
 }
 function constantTimeEqual(a, b) {
   const width = Math.max(a.length, b.length);
@@ -58343,7 +59071,7 @@ function readServeCredential(dir) {
 }
 function writeStore(store, dir) {
   const file = serveCredentialPath(dir);
-  const temp = `${file}.${randomUUID24()}.tmp`;
+  const temp = `${file}.${randomUUID26()}.tmp`;
   try {
     ensureKeryxConfigDir(dir);
     const handle = openSync3(temp, "wx", 384);
@@ -58383,7 +59111,7 @@ function mintRecord(now) {
   const salt = randomBytes3(32).toString("hex");
   return {
     token,
-    record: { id: randomUUID24(), algorithm: "sha256", salt, hash: hashToken(salt, token), createdAt: now }
+    record: { id: randomUUID26(), algorithm: "sha256", salt, hash: hashToken(salt, token), createdAt: now }
   };
 }
 function issueServeToken(dir, now = () => new Date().toISOString(), onWaiting) {
@@ -58507,22 +59235,22 @@ class AuthFailureThrottle {
 init_config_dir();
 import { createHash as createHash34 } from "crypto";
 import { existsSync as existsSync29, readdirSync as readdirSync2, rmSync as rmSync2 } from "fs";
-import path150 from "path";
+import path151 from "path";
 var MAX_TURN_EVENTS = 1e4;
 function turnsRoot(dir) {
-  return path150.join(keryxConfigDir(dir), "turns");
+  return path151.join(keryxConfigDir(dir), "turns");
 }
 function turnDir(turnId, dir) {
-  return path150.join(turnsRoot(dir), turnId);
+  return path151.join(turnsRoot(dir), turnId);
 }
 function keyPath(project, idempotencyKey, dir) {
   const projectBytes = Buffer.byteLength(project, "utf8");
   const digest2 = createHash34("sha256").update(`${projectBytes}:${project}\x00${idempotencyKey}`, "utf8").digest("hex");
-  return path150.join(turnsRoot(dir), "keys", `${digest2}.json`);
+  return path151.join(turnsRoot(dir), "keys", `${digest2}.json`);
 }
 function legacyKeyPath(idempotencyKey, dir) {
   const digest2 = createHash34("sha256").update(idempotencyKey, "utf8").digest("hex");
-  return path150.join(turnsRoot(dir), "keys", `${digest2}.json`);
+  return path151.join(turnsRoot(dir), "keys", `${digest2}.json`);
 }
 function adoptLegacyClaim(project, idempotencyKey, dir) {
   const legacy = legacyKeyPath(idempotencyKey, dir);
@@ -58586,7 +59314,7 @@ function ensureTurnDir(turnId, dir) {
 }
 function createTurnRecord(record, dir) {
   ensureTurnDir(record.turnId, dir);
-  writeOwnerOnlyFile(path150.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
+  writeOwnerOnlyFile(path151.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
 `);
 }
 function appendTurnEvent(event, dir, opts) {
@@ -58595,12 +59323,12 @@ function appendTurnEvent(event, dir, opts) {
   }
   const line = JSON.stringify(event);
   try {
-    appendOwnerOnlyLine(path150.join(turnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path151.join(turnDir(event.turnId, dir), "events.jsonl"), line);
   } catch (error2) {
     if (error2?.code !== "ENOENT") {
       throw error2;
     }
-    appendOwnerOnlyLine(path150.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path151.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
   }
   return true;
 }
@@ -58608,7 +59336,7 @@ function readTurnEvents(turnId, after = -1, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path150.join(turnDir(turnId, dir), "events.jsonl"));
+  const read = readTurnFile(path151.join(turnDir(turnId, dir), "events.jsonl"));
   if (!read.ok) {
     if (isDefiniteAbsence2(read.reason)) {
       return { ok: true, value: [] };
@@ -58636,7 +59364,7 @@ function readTurnRecord(turnId, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path150.join(turnDir(turnId, dir), "turn.json"));
+  const read = readTurnFile(path151.join(turnDir(turnId, dir), "turn.json"));
   if (!read.ok) {
     return { ok: false, reason: read.reason };
   }
@@ -58655,7 +59383,7 @@ function finishTurn(turnId, result, dir) {
   if (!record.ok) {
     return false;
   }
-  writeOwnerOnlyFile(path150.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
+  writeOwnerOnlyFile(path151.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
 `);
   return true;
 }
@@ -58700,8 +59428,8 @@ function releaseIdempotencyKey(project, idempotencyKey, turnId, dir) {
 }
 
 // src/lib/serve-turn.ts
-import { randomUUID as randomUUID25 } from "crypto";
-import path151 from "path";
+import { randomUUID as randomUUID27 } from "crypto";
+import path152 from "path";
 init_service();
 var REMOTE_ORIGIN = "remote:http";
 var MAX_PROMPT_CHARS = 32000;
@@ -58770,9 +59498,9 @@ function isUuid(value) {
   return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value);
 }
 function resolveProject(declared, dir) {
-  const wanted = path151.resolve(declared);
+  const wanted = path152.resolve(declared);
   for (const entry of listProjects(dir, () => {})) {
-    if (path151.resolve(entry.path) === wanted) {
+    if (path152.resolve(entry.path) === wanted) {
       return { ok: true, project: entry.path };
     }
   }
@@ -58819,7 +59547,7 @@ async function redactOut(security, text) {
 async function runRemoteTurn(input2) {
   const scanRoot = input2.scanRoot;
   const security = createSecurityService(scanRoot);
-  const newId = input2.newId ?? (() => randomUUID25());
+  const newId = input2.newId ?? (() => randomUUID27());
   const clock = input2.clock ?? (() => new Date().toISOString());
   const turnId = input2.turnId ?? newId();
   const sessionId = input2.request.sessionId ?? newId();
@@ -58962,7 +59690,7 @@ function outcomeOf(status, gate, unresolvedBlockerIds) {
 }
 function createSubmitTurn(deps) {
   return async (request, project) => {
-    const turnId = (deps.newId ?? (() => randomUUID25()))();
+    const turnId = (deps.newId ?? (() => randomUUID27()))();
     const scanned = await scanPrompt(deps.dir, request.prompt);
     if (scanned.rejected) {
       return { kind: "rejected" };
@@ -59649,7 +60377,7 @@ function runConfig(args2) {
       return;
     }
     const credential2 = readServeCredential();
-    const credentialId = credential2.status === "ok" ? credential2.record.id : randomUUID26();
+    const credentialId = credential2.status === "ok" ? credential2.record.id : randomUUID28();
     const config = defaultServeConfig(credentialId, {
       address: parsed.parsed.values.get("--bind") ?? DEFAULT_SERVE_BIND_ADDRESS,
       port: port ?? DEFAULT_SERVE_PORT,
@@ -59805,9 +60533,9 @@ function printHelp17() {
 
 // src/commands/update.ts
 import { spawn as spawn5 } from "child_process";
-import { chmod as chmod4, mkdir as mkdir54, readFile as readFile79, readdir as readdir24, writeFile as writeFile48 } from "fs/promises";
+import { chmod as chmod4, mkdir as mkdir54, readFile as readFile79, readdir as readdir25, writeFile as writeFile48 } from "fs/promises";
 import { access as access4, constants as constants2, existsSync as existsSync30 } from "fs";
-import path152 from "path";
+import path153 from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 init_config();
 init_config2();
@@ -59823,8 +60551,8 @@ async function updateCommand(args2 = []) {
     return;
   }
   const projectRoot = process.cwd();
-  const metaprojectRoot = path152.join(projectRoot, ".metaproject");
-  banner("keryx update", `Refreshing the .metaproject workspace in ${path152.basename(projectRoot)}/`);
+  const metaprojectRoot = path153.join(projectRoot, ".metaproject");
+  banner("keryx update", `Refreshing the .metaproject workspace in ${path153.basename(projectRoot)}/`);
   if (!await pathExists(metaprojectRoot)) {
     console.log(`  ${style.red(symbols.cross)} Metaproject is not initialized.`);
     console.log(`  ${style.cyan(symbols.arrow)} Run ${style.cyan("keryx init")} first.`);
@@ -59870,12 +60598,12 @@ async function updateCommand(args2 = []) {
   nextSteps(steps);
 }
 async function refreshServiceFiles(projectRoot, options) {
-  const metaprojectRoot = path152.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path153.join(projectRoot, ".metaproject");
   const manifestState = await readManifest5(metaprojectRoot);
   const manifest = manifestState.manifest;
   const recoveredManifest = !manifestState.exists || !manifestState.valid;
   if (manifestState.migrated) {
-    await writeFile48(path152.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+    await writeFile48(path153.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   }
   const enableGdgraph = moduleEnabled2(manifest, "gdgraph");
@@ -59912,11 +60640,11 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     enableSac
   });
-  await writeTextIfChanged4(path152.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
-  await writeTextIfChanged4(path152.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
-  await writeTextIfChanged4(path152.join(metaprojectRoot, "rules", "README.md"), renderProjectRulesReadme());
-  await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
-  await writeTextIfChanged4(path152.join(metaprojectRoot, "index.md"), renderIndexMarkdown({
+  await writeTextIfChanged4(path153.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
+  await writeTextIfChanged4(path153.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
+  await writeTextIfChanged4(path153.join(metaprojectRoot, "rules", "README.md"), renderProjectRulesReadme());
+  await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
+  await writeTextIfChanged4(path153.join(metaprojectRoot, "index.md"), renderIndexMarkdown({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -59929,7 +60657,7 @@ async function refreshServiceFiles(projectRoot, options) {
     ruleSources,
     hasDistilledEntrypoints: await hasDistilledEntrypoints(metaprojectRoot)
   }));
-  await writeTextIfChanged4(path152.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
+  await writeTextIfChanged4(path153.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -59941,7 +60669,7 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     data: dashboardData
   }));
-  await writeTextIfMissing4(path152.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
+  await writeTextIfMissing4(path153.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -59954,31 +60682,31 @@ async function refreshServiceFiles(projectRoot, options) {
   }));
   if (enableGdgraph) {
     await installGdgraphCoreScripts2(metaprojectRoot);
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
     await seedAssetsLock(metaprojectRoot);
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdgraph-post-commit", renderGdgraphPostCommitHook());
     }
   }
   if (enableGdctx) {
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
   }
   if (enableGdwiki) {
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdwiki-post-commit", renderGdwikiPostCommitHook());
     }
   }
   if (enableSac) {
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
   }
   if (enableGdskills) {
     await installGdskills(metaprojectRoot, gdskillsProfile, { createDataDirs: false });
@@ -59987,25 +60715,25 @@ async function refreshServiceFiles(projectRoot, options) {
     }
   }
   if (enableHealth) {
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
     if (manifest.modules?.health?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "health-post-commit", renderHealthPostCommitHook());
     }
   }
   if (enableTesting) {
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
       postCommitRefresh: Boolean(manifest.modules?.testing?.hooks?.gitPostCommit),
       prePushGate: Boolean(manifest.modules?.testing?.hooks?.prePush)
     }));
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
     if (enableGdwiki) {
-      await writeTextIfMissing4(path152.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
-      await writeTextIfMissing4(path152.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
+      await writeTextIfMissing4(path153.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
+      await writeTextIfMissing4(path153.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
     }
     if (manifest.modules?.testing?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "testing-post-commit", renderTestingPostCommitHook());
@@ -60018,24 +60746,24 @@ async function refreshServiceFiles(projectRoot, options) {
     await installManagedHook2(projectRoot, "post-commit", "metaproject-dashboard-post-commit", renderMetaprojectDashboardPostCommitHook());
   }
   if (enableMemory) {
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
   }
   if (enableTasks) {
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
   }
   if (enableSecurity) {
-    await writeTextIfMissing4(path152.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
-    await writeTextIfChanged4(path152.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
+    await writeTextIfMissing4(path153.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
+    await writeTextIfChanged4(path153.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
     if (manifest.modules?.security?.hooks?.prePush) {
       await installManagedHook2(projectRoot, "pre-push", "security-pre-push", renderSecurityPrePushHook());
     }
@@ -60086,13 +60814,13 @@ async function refreshServiceFiles(projectRoot, options) {
   };
 }
 async function buildDashboard(projectRoot = process.cwd()) {
-  const metaprojectRoot = path152.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path153.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
   const manifest = (await readManifest5(metaprojectRoot)).manifest;
   const data = await collectDashboardData(metaprojectRoot);
-  const dashboardPath = path152.join(metaprojectRoot, "keryx-dashboard.html");
+  const dashboardPath = path153.join(metaprojectRoot, "keryx-dashboard.html");
   await writeTextIfChanged4(dashboardPath, renderMetaprojectDashboardHtml({
     enableGdgraph: moduleEnabled2(manifest, "gdgraph"),
     enableGdctx: moduleEnabled2(manifest, "gdctx"),
@@ -60112,7 +60840,7 @@ async function shouldInstallDashboardPostCommitHook(projectRoot, manifest) {
   if (Object.values(modules).some((module) => Boolean(module.hooks?.gitPostCommit))) {
     return true;
   }
-  const hookPath = path152.join(projectRoot, ".git", "hooks", "post-commit");
+  const hookPath = path153.join(projectRoot, ".git", "hooks", "post-commit");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -60132,11 +60860,11 @@ async function collectDashboardData(metaprojectRoot) {
   if (testing) {
     data.testing = testing;
   }
-  const wiki = await collectMarkdownPages(path152.join(metaprojectRoot, "wiki"), "wiki");
+  const wiki = await collectMarkdownPages(path153.join(metaprojectRoot, "wiki"), "wiki");
   if (wiki.length > 0) {
     data.wiki = { pages: wiki };
   }
-  const memory = await collectMarkdownPages(path152.join(metaprojectRoot, "memory"), "memory");
+  const memory = await collectMarkdownPages(path153.join(metaprojectRoot, "memory"), "memory");
   if (memory.length > 0) {
     data.memory = { entries: memory };
   }
@@ -60151,19 +60879,19 @@ async function collectDashboardData(metaprojectRoot) {
   return data;
 }
 async function collectTasksDashboardData(metaprojectRoot) {
-  const flowsRoot2 = path152.join(metaprojectRoot, "flows");
+  const flowsRoot2 = path153.join(metaprojectRoot, "flows");
   if (!await pathExists(flowsRoot2)) {
     return null;
   }
   let dirEntries;
   try {
-    dirEntries = (await readdir24(flowsRoot2, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^\d{3}-/.test(entry.name)).map((entry) => entry.name).sort();
+    dirEntries = (await readdir25(flowsRoot2, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^\d{3}-/.test(entry.name)).map((entry) => entry.name).sort();
   } catch {
     return null;
   }
   const flows = [];
   for (const dir of dirEntries) {
-    const flowPath = path152.join(flowsRoot2, dir, "flow.json");
+    const flowPath = path153.join(flowsRoot2, dir, "flow.json");
     if (!await pathExists(flowPath)) {
       continue;
     }
@@ -60171,7 +60899,7 @@ async function collectTasksDashboardData(metaprojectRoot) {
       const flow = JSON.parse(await readFile79(flowPath, "utf8"));
       const tasks = Array.isArray(flow.tasks) ? flow.tasks : [];
       let acTotal = 0;
-      const acPath2 = path152.join(flowsRoot2, dir, "acceptance-criteria.md");
+      const acPath2 = path153.join(flowsRoot2, dir, "acceptance-criteria.md");
       if (await pathExists(acPath2)) {
         const acContent = await readFile79(acPath2, "utf8");
         acTotal = (acContent.match(/^- AC\d+:/gm) ?? []).length;
@@ -60225,7 +60953,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
     "data/testing/context.md"
   ];
   for (const href of staticHrefs) {
-    const filePath = path152.join(metaprojectRoot, ...href.split("/"));
+    const filePath = path153.join(metaprojectRoot, ...href.split("/"));
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -60242,7 +60970,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
   return docs;
 }
 async function collectHealthDashboardData(metaprojectRoot) {
-  const reportPath2 = path152.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
+  const reportPath2 = path153.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
   if (!await pathExists(reportPath2)) {
     return;
   }
@@ -60351,8 +61079,8 @@ function metricToScope(metric) {
   };
 }
 async function collectGraphDashboardData(metaprojectRoot) {
-  const nodesPath = path152.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
-  const edgesPath = path152.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
+  const nodesPath = path153.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
+  const edgesPath = path153.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
   if (!await pathExists(nodesPath) || !await pathExists(edgesPath)) {
     return;
   }
@@ -60403,8 +61131,8 @@ async function collectGraphDashboardData(metaprojectRoot) {
   };
 }
 async function collectTestingDashboardData(metaprojectRoot) {
-  const reportPath2 = path152.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
-  const contextPath = path152.join(metaprojectRoot, "data", "testing", "context.md");
+  const reportPath2 = path153.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
+  const contextPath = path153.join(metaprojectRoot, "data", "testing", "context.md");
   if (await pathExists(reportPath2)) {
     const report = JSON.parse(await readFile79(reportPath2, "utf8"));
     const totalTests = numberOrUndefined(report.total);
@@ -60433,7 +61161,7 @@ async function collectMarkdownPages(root, hrefPrefix) {
   const files = await listMarkdownFiles(root);
   const pages = [];
   for (const filePath of files.slice(0, 40)) {
-    const relativePath = path152.relative(root, filePath).split(path152.sep).join("/");
+    const relativePath = path153.relative(root, filePath).split(path153.sep).join("/");
     if (relativePath === "index.md" || relativePath.startsWith("templates/")) {
       continue;
     }
@@ -60451,10 +61179,10 @@ async function collectMarkdownPages(root, hrefPrefix) {
   return pages;
 }
 async function listMarkdownFiles(root) {
-  const entries = await readdir24(root, { withFileTypes: true });
+  const entries = await readdir25(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const fullPath = path152.join(root, entry.name);
+    const fullPath = path153.join(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listMarkdownFiles(fullPath));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -60502,7 +61230,7 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
   const manifest = {
     schemaVersion: 1,
     standardVersion: STANDARD_VERSION,
-    name: `${path152.basename(path152.dirname(metaprojectRoot))}-metaproject`,
+    name: `${path153.basename(path153.dirname(metaprojectRoot))}-metaproject`,
     createdBy: "keryx",
     profiles: computeProfiles(enabledModuleKeys2),
     paths: {
@@ -60603,11 +61331,11 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
       metaproject: ".metaproject/index.md"
     }
   };
-  await writeFile48(path152.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+  await writeFile48(path153.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
 }
 async function enableTasksInManifest(metaprojectRoot) {
-  const manifestPath = path152.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path153.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -60630,7 +61358,7 @@ async function enableTasksInManifest(metaprojectRoot) {
 `, "utf8");
 }
 async function updateManifestAgentEntrypoints(metaprojectRoot, ruleSources) {
-  const manifestPath = path152.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path153.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -60666,72 +61394,72 @@ async function updateRuntime(projectRoot) {
   }
 }
 async function findRuntimeRoot(projectRoot) {
-  const projectRuntime = path152.join(projectRoot, ".metaproject", "runtime", "keryx");
-  if (await pathExists(path152.join(projectRuntime, ".git"))) {
+  const projectRuntime = path153.join(projectRoot, ".metaproject", "runtime", "keryx");
+  if (await pathExists(path153.join(projectRuntime, ".git"))) {
     return projectRuntime;
   }
   const home = process.env.HOME;
   if (!home) {
     return null;
   }
-  const globalRuntime = path152.join(home, ".keryx", "keryx");
-  if (await pathExists(path152.join(globalRuntime, ".git"))) {
+  const globalRuntime = path153.join(home, ".keryx", "keryx");
+  if (await pathExists(path153.join(globalRuntime, ".git"))) {
     return globalRuntime;
   }
   return null;
 }
 async function createServiceDirs(metaprojectRoot, modules) {
   const dirs = [
-    path152.join(metaprojectRoot, "core"),
-    path152.join(metaprojectRoot, "hooks", "post-update.d"),
-    path152.join(metaprojectRoot, "modules"),
-    path152.join(metaprojectRoot, "rules"),
-    path152.join(metaprojectRoot, "skills", "project-rules"),
+    path153.join(metaprojectRoot, "core"),
+    path153.join(metaprojectRoot, "hooks", "post-update.d"),
+    path153.join(metaprojectRoot, "modules"),
+    path153.join(metaprojectRoot, "rules"),
+    path153.join(metaprojectRoot, "skills", "project-rules"),
     ...modules.enableGdgraph ? [
-      path152.join(metaprojectRoot, "core", "gdgraph"),
-      path152.join(metaprojectRoot, "skills", "gdgraph")
+      path153.join(metaprojectRoot, "core", "gdgraph"),
+      path153.join(metaprojectRoot, "skills", "gdgraph")
     ] : [],
     ...modules.enableGdctx ? [
-      path152.join(metaprojectRoot, "core", "gdctx"),
-      path152.join(metaprojectRoot, "skills", "gdctx")
+      path153.join(metaprojectRoot, "core", "gdctx"),
+      path153.join(metaprojectRoot, "skills", "gdctx")
     ] : [],
     ...modules.enableGdwiki ? [
-      path152.join(metaprojectRoot, "skills", "gdwiki"),
-      path152.join(metaprojectRoot, "wiki", "templates")
+      path153.join(metaprojectRoot, "skills", "gdwiki"),
+      path153.join(metaprojectRoot, "wiki", "templates")
     ] : [],
     ...modules.enableHealth ? [
-      path152.join(metaprojectRoot, "core", "health"),
-      path152.join(metaprojectRoot, "skills", "health")
+      path153.join(metaprojectRoot, "core", "health"),
+      path153.join(metaprojectRoot, "skills", "health")
     ] : [],
     ...modules.enableTesting ? [
-      path152.join(metaprojectRoot, "core", "testing"),
-      path152.join(metaprojectRoot, "skills", "testing")
+      path153.join(metaprojectRoot, "core", "testing"),
+      path153.join(metaprojectRoot, "skills", "testing")
     ] : [],
     ...modules.enableMemory ? [
-      path152.join(metaprojectRoot, "core", "memory"),
-      path152.join(metaprojectRoot, "skills", "memory"),
-      path152.join(metaprojectRoot, "memory", "templates")
+      path153.join(metaprojectRoot, "core", "memory"),
+      path153.join(metaprojectRoot, "skills", "memory"),
+      path153.join(metaprojectRoot, "memory", "templates")
     ] : [],
     ...modules.enableTasks ? [
-      path152.join(metaprojectRoot, "flows"),
-      path152.join(metaprojectRoot, "skills", "flow")
+      path153.join(metaprojectRoot, "flows"),
+      path153.join(metaprojectRoot, "skills", "flow")
     ] : [],
     ...modules.enableSecurity ? [
-      path152.join(metaprojectRoot, "core", "security")
+      path153.join(metaprojectRoot, "core", "security")
     ] : [],
     ...modules.enableSac ? [
-      path152.join(metaprojectRoot, "skills", "sac")
+      path153.join(metaprojectRoot, "skills", "sac")
     ] : []
   ];
   await Promise.all(dirs.map((dir) => mkdir54(dir, { recursive: true })));
 }
 async function installGdgraphCoreScripts2(metaprojectRoot) {
-  const gdgraphCoreRoot = path152.join(metaprojectRoot, "core", "gdgraph");
+  const gdgraphCoreRoot = path153.join(metaprojectRoot, "core", "gdgraph");
   await mkdir54(gdgraphCoreRoot, { recursive: true });
   for (const file of GDGRAPH_CORE_SOURCES) {
-    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path152.join(gdgraphCoreRoot, file));
+    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path153.join(gdgraphCoreRoot, file));
   }
-  await writeTextIfChanged4(path152.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
+  await writeTextIfChanged4(path153.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
 }
 async function installManagedHook2(projectRoot, hookName, blockId, content) {
   const hooksRoot = await resolveGitHooksRoot(projectRoot);
@@ -60739,7 +61467,7 @@ async function installManagedHook2(projectRoot, hookName, blockId, content) {
     return;
   }
   await mkdir54(hooksRoot, { recursive: true });
-  const hookPath = path152.join(hooksRoot, hookName);
+  const hookPath = path153.join(hooksRoot, hookName);
   const blockStart = `# keryx:${blockId}:begin`;
   const blockEnd = `# keryx:${blockId}:end`;
   const managedBlock = `${blockStart}
@@ -60760,7 +61488,7 @@ async function removeManagedHook2(projectRoot, hookName, blockId) {
   if (!hooksRoot) {
     return;
   }
-  const hookPath = path152.join(hooksRoot, hookName);
+  const hookPath = path153.join(hooksRoot, hookName);
   if (!await pathExists(hookPath)) {
     return;
   }
@@ -60782,7 +61510,7 @@ async function prePushHasSecurityBlock2(projectRoot) {
   if (!hooksRoot) {
     return false;
   }
-  const hookPath = path152.join(hooksRoot, "pre-push");
+  const hookPath = path153.join(hooksRoot, "pre-push");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -60797,7 +61525,7 @@ async function agentSettingsHasSecuritySentinel2(projectRoot) {
   return (await readFile79(file, "utf8")).includes(AGENT_HOOKS_SENTINEL);
 }
 async function readManifest5(metaprojectRoot) {
-  const manifestPath = path152.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path153.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return {
       exists: false,
@@ -60866,7 +61594,7 @@ async function inferManifestFromExistingMetaproject(metaprojectRoot) {
 }
 async function anyPathExists(root, candidates) {
   for (const candidate of candidates) {
-    if (await pathExists(path152.join(root, candidate))) {
+    if (await pathExists(path153.join(root, candidate))) {
       return true;
     }
   }
@@ -60887,13 +61615,13 @@ function parseUpdateArgs(args2) {
   };
 }
 async function runPostUpdateHooks(projectRoot) {
-  const hooksDir = path152.join(projectRoot, ".metaproject", "hooks", "post-update.d");
+  const hooksDir = path153.join(projectRoot, ".metaproject", "hooks", "post-update.d");
   if (!await pathExists(hooksDir)) {
     return;
   }
-  const entries = (await readdir24(hooksDir)).sort();
+  const entries = (await readdir25(hooksDir)).sort();
   for (const entry of entries) {
-    const hookPath = path152.join(hooksDir, entry);
+    const hookPath = path153.join(hooksDir, entry);
     try {
       await accessExecutable(hookPath);
     } catch {
@@ -60934,14 +61662,14 @@ async function writeTextIfChanged4(filePath, content) {
   if (await pathExists(filePath) && await readFile79(filePath, "utf8") === content) {
     return;
   }
-  await mkdir54(path152.dirname(filePath), { recursive: true });
+  await mkdir54(path153.dirname(filePath), { recursive: true });
   await writeFile48(filePath, content, "utf8");
 }
 async function writeTextIfMissing4(filePath, content) {
   if (await pathExists(filePath)) {
     return;
   }
-  await mkdir54(path152.dirname(filePath), { recursive: true });
+  await mkdir54(path153.dirname(filePath), { recursive: true });
   await writeFile48(filePath, content, "utf8");
 }
 async function copyFileIfChanged2(from, to) {
@@ -60949,7 +61677,7 @@ async function copyFileIfChanged2(from, to) {
   if (await pathExists(to) && await readFile79(to, "utf8") === next) {
     return;
   }
-  await mkdir54(path152.dirname(to), { recursive: true });
+  await mkdir54(path153.dirname(to), { recursive: true });
   await writeFile48(to, next, "utf8");
 }
 function runtimeSourcePath2(relativePath) {
@@ -60958,7 +61686,7 @@ function runtimeSourcePath2(relativePath) {
     return directPath;
   }
   if (relativePath.startsWith("../")) {
-    const packagedSourcePath = path152.join(path152.dirname(fileURLToPath7(import.meta.url)), "..", "src", relativePath.slice(3));
+    const packagedSourcePath = path153.join(path153.dirname(fileURLToPath7(import.meta.url)), "..", "src", relativePath.slice(3));
     if (existsSync30(packagedSourcePath)) {
       return packagedSourcePath;
     }
@@ -60990,7 +61718,7 @@ function printHelp18() {
 
 // src/commands/dashboard.ts
 import { spawn as spawn6 } from "child_process";
-import path153 from "path";
+import path154 from "path";
 init_args();
 async function dashboardCommand(args2 = []) {
   const options = parseOptions(args2);
@@ -61001,7 +61729,7 @@ async function dashboardCommand(args2 = []) {
   }
   if (subcommand === "build") {
     const result = await buildDashboard();
-    const rel = path153.relative(process.cwd(), result.path);
+    const rel = path154.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Dashboard built ${style.cyan(symbols.arrow)} ${style.cyan(rel)}`);
     note(`Open it: keryx dashboard open`);
     return;
@@ -61009,7 +61737,7 @@ async function dashboardCommand(args2 = []) {
   if (subcommand === "open") {
     const result = await buildDashboard();
     await openFile(result.path);
-    const rel = path153.relative(process.cwd(), result.path);
+    const rel = path154.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Opened ${style.cyan(rel)}`);
     return;
   }
@@ -61058,7 +61786,7 @@ import { readFileSync as readFileSync10 } from "fs";
 // src/agents/bootstrap.ts
 import { mkdir as mkdir55, readFile as readFile80, writeFile as writeFile49 } from "fs/promises";
 import { homedir as homedir7 } from "os";
-import path154 from "path";
+import path155 from "path";
 init_fs();
 var AGENT_BOOTSTRAP_START = "<!-- keryx:global-bootstrap -->";
 var AGENT_BOOTSTRAP_END = "<!-- /keryx:global-bootstrap -->";
@@ -61068,35 +61796,35 @@ var AGENT_BOOTSTRAP_RUNTIMES = [
     aliases: ["claude-code"],
     label: "Claude Code",
     fileName: "CLAUDE.md",
-    filePath: (homeRoot) => path154.join(homeRoot, ".claude", "CLAUDE.md")
+    filePath: (homeRoot) => path155.join(homeRoot, ".claude", "CLAUDE.md")
   },
   {
     id: "opencode",
     aliases: ["open-code"],
     label: "OpenCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path154.join(homeRoot, ".config", "opencode", "AGENTS.md")
+    filePath: (homeRoot) => path155.join(homeRoot, ".config", "opencode", "AGENTS.md")
   },
   {
     id: "zcode",
     aliases: ["zed", "zed-code"],
     label: "ZCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path154.join(homeRoot, ".zcode", "AGENTS.md")
+    filePath: (homeRoot) => path155.join(homeRoot, ".zcode", "AGENTS.md")
   },
   {
     id: "codex",
     aliases: [],
     label: "Codex",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path154.join(homeRoot, ".codex", "AGENTS.md")
+    filePath: (homeRoot) => path155.join(homeRoot, ".codex", "AGENTS.md")
   },
   {
     id: "antigravity",
     aliases: ["antigravuty", "antigravity-code"],
     label: "Antigravity",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path154.join(homeRoot, ".config", "antigravity", "AGENTS.md")
+    filePath: (homeRoot) => path155.join(homeRoot, ".config", "antigravity", "AGENTS.md")
   }
 ];
 function agentBootstrapRuntimeIds() {
@@ -61144,7 +61872,7 @@ async function installAgentBootstrap(runtime, options = {}) {
   const dryRun = options.dryRun === true;
   const wrote = next !== current;
   if (wrote && !dryRun) {
-    await mkdir55(path154.dirname(filePath), { recursive: true });
+    await mkdir55(path155.dirname(filePath), { recursive: true });
     await writeFile49(filePath, next, "utf8");
   }
   const status = dryRun ? statusFromContent(runtime, filePath, exists2, next) : await agentBootstrapStatus(runtime, homeRoot);
@@ -61492,7 +62220,7 @@ function printBootstrapHelp() {
 // src/commands/metrics.ts
 init_args();
 import { readFile as readFile81 } from "fs/promises";
-import path156 from "path";
+import path157 from "path";
 
 // src/metrics/benchmark.ts
 var RELIABILITIES2 = new Set(["exact", "estimated", "unknown"]);
@@ -62271,7 +62999,7 @@ function buildContainmentManifest(inputs, options = {}) {
 
 // src/metrics/oracle-runner.ts
 import { mkdir as mkdir56, writeFile as writeFile50 } from "fs/promises";
-import path155 from "path";
+import path156 from "path";
 
 // src/metrics/ir.ts
 function toIdSet(ids) {
@@ -62713,9 +63441,9 @@ function buildEvidenceBundle(input2, options = {}) {
 async function persistEvidenceBundle(outDir, bundle, ladder = "metastore") {
   const safeTarget = bundle.target.replace(/[^A-Za-z0-9._/-]/g, "_");
   const safeCase = bundle.caseId.replace(/[^A-Za-z0-9._-]/g, "_");
-  const dir = path155.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
+  const dir = path156.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
   await mkdir56(dir, { recursive: true });
-  const write = (name, value) => writeFile50(path155.join(dir, name), `${JSON.stringify(value, null, 2)}
+  const write = (name, value) => writeFile50(path156.join(dir, name), `${JSON.stringify(value, null, 2)}
 `, "utf8");
   await Promise.all([
     write("inputs.json", bundle.inputs),
@@ -62755,7 +63483,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
     console.log("# metrics status");
     console.log("");
     console.log(`root: ${root}`);
-    console.log(`enabled: ${await Bun.file(path156.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
+    console.log(`enabled: ${await Bun.file(path157.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
     const latest2 = await readLatestPointer(root);
     console.log(`latest: ${latest2.status}`);
     return;
@@ -62767,7 +63495,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const record2 = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+    const record2 = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
     const result = validateRunRecord(record2);
     console.log(result.valid ? "valid: yes" : "valid: no");
     for (const error2 of result.errors)
@@ -62792,7 +63520,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const file = path156.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
+    const file = path157.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
     if (!await Bun.file(file).exists()) {
       console.error(`Run not found: ${runId}`);
       process.exitCode = 1;
@@ -62809,8 +63537,8 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const a = JSON.parse(await readFile81(path156.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
-    const b = JSON.parse(await readFile81(path156.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
+    const a = JSON.parse(await readFile81(path157.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
+    const b = JSON.parse(await readFile81(path157.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
     const comparison = compareExecutionRuns(a, b);
     console.log(stableJson(comparison));
     return;
@@ -62844,8 +63572,8 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       return;
     }
     const template = createPairedBenchmarkTemplate(taskIds);
-    await Bun.write(path156.resolve(projectRoot, out), stableJson(template));
-    console.log(`manifest: ${path156.relative(projectRoot, path156.resolve(projectRoot, out))}`);
+    await Bun.write(path157.resolve(projectRoot, out), stableJson(template));
+    console.log(`manifest: ${path157.relative(projectRoot, path157.resolve(projectRoot, out))}`);
     return;
   }
   if (subcommand === "benchmark" && args2[1] === "run") {
@@ -62859,7 +63587,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+    const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
     const input2 = Array.isArray(raw) ? raw : raw.runs ?? [];
     const result = validatePairedBenchmark(input2);
     console.log(stableJson(result));
@@ -62871,7 +63599,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
   process.exitCode = 1;
 }
 async function loadAffectedSets(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target === "string")
@@ -62942,7 +63670,7 @@ async function runHarnessLayer(projectRoot, args2, ladder) {
   let tasks;
   let model;
   try {
-    const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, resultsPath), "utf8"));
     tasks = raw.tasks ?? [];
     model = raw.model;
   } catch (error2) {
@@ -62973,7 +63701,7 @@ async function runSafetyCompletionHonestyLayer(projectRoot, args2, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -62998,7 +63726,7 @@ async function runSafetyFalsePremiseLayer(projectRoot, args2, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -63023,7 +63751,7 @@ async function runSafetyContainmentLayer(projectRoot, args2, ladder, caseClass)
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -63085,12 +63813,12 @@ async function runGdgraphLayer(projectRoot, args2, ladder) {
   }
   const manifests = buildOracleManifestsByGold(inputs, { ladder });
   if (outDir) {
-    const resolvedOut = path156.resolve(projectRoot, outDir);
+    const resolvedOut = path157.resolve(projectRoot, outDir);
     for (const input2 of inputs) {
       for (const named of input2.golds) {
         const bundle = buildEvidenceBundle({ target: input2.target, system: input2.system, gold: named.gold }, { ladder, goldReference: goldPathFor(named.kind), timestamp: new Date().toISOString() });
-        const dir = await persistEvidenceBundle(path156.join(resolvedOut, named.kind), bundle, ladder);
-        console.error(`bundle[${named.kind}]: ${path156.relative(projectRoot, dir)}`);
+        const dir = await persistEvidenceBundle(path157.join(resolvedOut, named.kind), bundle, ladder);
+        console.error(`bundle[${named.kind}]: ${path157.relative(projectRoot, dir)}`);
       }
     }
   }
@@ -63114,7 +63842,7 @@ async function runGdgraphLayer(projectRoot, args2, ladder) {
   return allValid;
 }
 async function loadCoverageMap2(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
   return raw.coverageMap ?? {};
 }
 async function runTestingLayer(projectRoot, args2, ladder) {
@@ -63151,7 +63879,7 @@ async function runTestingLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadMemoryGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 3;
 }
 async function runMemoryLayer(projectRoot, args2, ladder) {
@@ -63188,11 +63916,11 @@ async function runMemoryLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadWikiGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 5;
 }
 async function loadWikiGroundedness(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target !== "string" || !Array.isArray(entry.scores) || entry.scores.length !== 3)
@@ -63248,7 +63976,7 @@ async function runWikiLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadGdctxFacts(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, file), "utf8"));
   const inputs = [];
   for (const entry of raw.inputs ?? []) {
     if (typeof entry.input === "string") {
@@ -63286,7 +64014,7 @@ async function collect(projectRoot, args2) {
     process.exitCode = 1;
     return;
   }
-  const raw = JSON.parse(await readFile81(path156.resolve(projectRoot, eventFile), "utf8"));
+  const raw = JSON.parse(await readFile81(path157.resolve(projectRoot, eventFile), "utf8"));
   const events2 = Array.isArray(raw) ? raw : raw.events;
   const startedAt = optionValue(args2, "--started-at") ?? events2[0]?.timestamp_utc ?? new Date().toISOString();
   const finishedAt = optionValue(args2, "--finished-at") ?? events2.at(-1)?.timestamp_utc ?? startedAt;
@@ -63302,11 +64030,11 @@ async function collect(projectRoot, args2) {
     parentRunId: optionValue(args2, "--parent-run-id") ?? null
   });
   const result = await writeRunArtifacts(metricsRoot(projectRoot), record2, { cwd: projectRoot });
-  console.log(`json: ${path156.relative(projectRoot, result.jsonPath)}`);
-  console.log(`markdown: ${path156.relative(projectRoot, result.markdownPath)}`);
+  console.log(`json: ${path157.relative(projectRoot, result.jsonPath)}`);
+  console.log(`markdown: ${path157.relative(projectRoot, result.markdownPath)}`);
 }
 function metricsRoot(projectRoot) {
-  return path156.join(projectRoot, ".metaproject", "data", "metrics");
+  return path157.join(projectRoot, ".metaproject", "data", "metrics");
 }
 function printMetricsHelp() {
   console.log(`keryx metrics
@@ -63412,193 +64140,6 @@ init_session_wrap_up();
 init_proposal_evidence();
 init_review_confirm_token();
 init_store3();
-
-// src/sac/catch-up.ts
-init_fs();
-init_config_dir();
-init_paths();
-init_slate();
-init_store3();
-init_proposal_lifecycle();
-init_workspace_service();
-import { randomUUID as randomUUID28 } from "crypto";
-import { readdir as readdir25 } from "fs/promises";
-import path157 from "path";
-
-// src/sac/lifecycle-flag.ts
-init_store();
-init_service3();
-init_decision_dedup();
-init_workspace_service();
-import { randomUUID as randomUUID27 } from "crypto";
-function normalize3(raw) {
-  return raw.replace(/^\.\//, "");
-}
-function isStillPresent(recorded, valid) {
-  const normalized = normalize3(recorded);
-  return valid.has(normalized) || valid.has(moduleNameFromProjectPath(normalized));
-}
-async function computeLifecycleFlags(cwd, now = () => new Date) {
-  const valid = await validModuleNames(cwd);
-  if (valid === undefined)
-    return [];
-  const flaggedAt = now().toISOString();
-  const flags = [];
-  const workspaceService = new WorkspaceService({
-    workspaceRoot: cwd,
-    authorizationServer: localWorkspaceAuthorizationServer(),
-    strictGuard: { mode: "strict", availability: "available", decision: "pass", policyRevision: "local-offline-v1" }
-  });
-  const workspaces = await workspaceService.list({ request: undefined, requestCorrelationId: randomUUID27(), includeArchived: true });
-  for (const workspace of workspaces) {
-    const component = workspace.resources.find((r) => r.kind === "component")?.uri;
-    if (component !== undefined && !isStillPresent(component, valid)) {
-      flags.push({ kind: "workspace", ref: workspace.id, missingComponent: normalize3(component), flaggedAt });
-    }
-  }
-  for (const entry of await collectEntries(cwd)) {
-    const module = entry.scopes.module;
-    if (module !== null && module.length > 0 && !isStillPresent(module, valid)) {
-      flags.push({ kind: "memory-entry", ref: entry.relativePath, missingComponent: normalize3(module), flaggedAt });
-    }
-  }
-  for (const decision of await collectWikiDecisionEntries(cwd)) {
-    const module = decision.scopes.module;
-    if (module !== null && module.length > 0 && !isStillPresent(module, valid)) {
-      flags.push({ kind: "wiki-decision", ref: decision.relativePath, missingComponent: normalize3(module), flaggedAt });
-    }
-  }
-  return flags;
-}
-
-// src/sac/catch-up.ts
-async function buildCatchUp(input2) {
-  const [proposals, sessionCategories, lifecycleFlagsAll] = await Promise.all([
-    collectProposals(input2.cwd, input2.workspaceId),
-    collectSessionCategories(input2.cwd),
-    computeLifecycleFlags(input2.cwd)
-  ]);
-  const lifecycleFlags = input2.workspaceId === undefined ? lifecycleFlagsAll : lifecycleFlagsAll.filter((flag) => flag.kind !== "workspace" || flag.ref === input2.workspaceId);
-  return { proposals, ...sessionCategories, lifecycleFlags };
-}
-async function collectProposals(cwd, workspaceId) {
-  const authorizationServer = localWorkspaceAuthorizationServer();
-  const actor = await authorizationServer.actorContextFor(undefined, randomUUID28());
-  if (!actor)
-    throw new Error("trusted ActorContext is required for catch-up");
-  const proposalService = createLocalProposalLifecycleService(cwd);
-  const groups = await proposalService.listVisibleProposedProposals(actor);
-  const scoped = workspaceId === undefined ? groups : groups.filter((group) => group.workspace.id === workspaceId);
-  const flattened = scoped.flatMap((group) => group.proposals.map((proposal) => ({ group, proposal })));
-  return Promise.all(flattened.map(async ({ group, proposal }) => {
-    const fresh = await proposalService.isEvidenceFresh(proposal, actor);
-    return { type: "proposal", workspaceId: group.workspace.id, proposalId: proposal.id, fresh };
-  }));
-}
-async function classifySession(session) {
-  const dir = sessionDir(session.projectPath, session.id);
-  if (await isLockHeld(slateLockPath(dir)))
-    return;
-  const terminalState = await readTerminalState(dir);
-  if (terminalState !== undefined) {
-    const workspaceId2 = (await safeReadSlate(dir))?.workspaceId;
-    return { kind: "blocked", item: { type: "blocked", sessionId: session.id, ...workspaceId2 !== undefined ? { workspaceId: workspaceId2 } : {}, terminalState } };
-  }
-  const unboundCandidate = await readNewestUnboundCandidate(dir);
-  if (unboundCandidate !== undefined) {
-    return {
-      kind: "unbound-candidate",
-      item: { type: "unbound-candidate", sessionId: session.id, evidencePath: unboundCandidate.evidencePath, summary: unboundCandidate.summary }
-    };
-  }
-  if (!await isSlateEngaged(dir))
-    return;
-  const workspaceId = (await safeReadSlate(dir))?.workspaceId;
-  return { kind: "unknown", item: { type: "unknown", sessionId: session.id, ...workspaceId !== undefined ? { workspaceId } : {}, lastSeenAt: session.updatedAt } };
-}
-async function collectSessionCategories(cwd) {
-  const classified = await Promise.all(listSessions(cwd).map((session) => classifySession(session)));
-  const blocked2 = [];
-  const unboundCandidates = [];
-  const unknown = [];
-  for (const category of classified) {
-    if (category === undefined)
-      continue;
-    if (category.kind === "blocked")
-      blocked2.push(category.item);
-    else if (category.kind === "unbound-candidate")
-      unboundCandidates.push(category.item);
-    else
-      unknown.push(category.item);
-  }
-  return { blocked: blocked2, unboundCandidates, unknown };
-}
-async function isSlateEngaged(dir) {
-  if (await pathExists(path157.join(dir, "slate.json")))
-    return true;
-  if (await pathExists(path157.join(dir, "terminal-state.json")))
-    return true;
-  try {
-    const entries = await readdir25(path157.join(dir, "slate-archive"));
-    return entries.length > 0;
-  } catch {
-    return false;
-  }
-}
-async function safeReadSlate(dir) {
-  try {
-    return await readSlate(dir);
-  } catch {
-    return;
-  }
-}
-async function readTerminalState(dir) {
-  const result = readConfigFile(path157.join(dir, "terminal-state.json"));
-  if (!result.ok) {
-    return;
-  }
-  try {
-    return JSON.parse(result.text);
-  } catch {
-    return;
-  }
-}
-async function readNewestUnboundCandidate(dir) {
-  const archiveDir = path157.join(dir, "slate-archive");
-  let entries;
-  try {
-    entries = (await readdir25(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
-  } catch {
-    return;
-  }
-  entries.sort();
-  for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path157.join(archiveDir, entries[i]);
-    const result = readConfigFile(evidencePath);
-    if (!result.ok) {
-      continue;
-    }
-    try {
-      const parsed = JSON.parse(result.text);
-      if (parsed.recordType !== "unbound-candidate")
-        continue;
-      return { evidencePath, summary: summarizeUnboundCandidate(parsed.groups) };
-    } catch {
-      continue;
-    }
-  }
-  return;
-}
-function summarizeUnboundCandidate(groups) {
-  const safeGroups = groups ?? [];
-  if (safeGroups.length === 0)
-    return "no seeds captured";
-  const seedCount = safeGroups.reduce((sum, group) => sum + (group.seeds?.length ?? 0), 0);
-  const kinds = safeGroups.map((group) => typeof group.kind === "string" ? group.kind : "unknown").join(", ");
-  return `${seedCount} untriaged seed(s) across ${safeGroups.length} kind(s) (${kinds})`;
-}
-
-// src/commands/workspace.ts
 var PROPOSAL_KINDS2 = ["decision", "wiki-update", "memory-entry", "follow-up", "contract-change", "risk"];
 function service5() {
   return new WorkspaceService({