@mrciphersmith/keryx 0.2.52 → 0.2.54

package/dist/cli.js

@@ -14032,6 +14032,9 @@ var init_assembly = () => {};
 // src/session/slate.ts
 import { mkdir as mkdir25, readFile as readFile31, rm as rm4 } from "fs/promises";
 import path69 from "path";
+function isSlateSeedKind(value) {
+  return typeof value === "string" && SLATE_SEED_KINDS.includes(value);
+}
 function slatePath(dir) {
   return path69.join(dir, "slate.json");
 }
@@ -14171,12 +14174,20 @@ function renderAnchorsBlock(anchors, opts) {
   return lines.join(`
 `);
 }
-var DEFAULT_RENDER_MAX_TOKENS = 2000;
+var SLATE_SEED_KINDS, SEED_TEXT_MAX_LENGTH = 4000, DEFAULT_RENDER_MAX_TOKENS = 2000;
 var init_slate = __esm(() => {
   init_fs();
   init_assembly();
   init_repomap();
   init_redact();
+  SLATE_SEED_KINDS = [
+    "decision",
+    "wiki-update",
+    "memory-entry",
+    "follow-up",
+    "contract-change",
+    "risk"
+  ];
 });
 
 // src/flow/store.ts
@@ -16372,6 +16383,7 @@ async function writeWrapUpOutcomeArtifact(dir, trigger, now, groups) {
   } catch {}
 }
 async function proposeOneGroup(params) {
+  const wrapUpSource = params.wrapUpSource ?? "flow";
   try {
     const resolved = await resolveMachineWrapUp({
       cwd: params.cwd,
@@ -16393,8 +16405,8 @@ async function proposeOneGroup(params) {
     const wrapUpAuthority = createTrustedWrapUpAuthority({
       now: params.now,
       resolveExplicitWrapUp: async (request) => {
-        if (request.source !== "flow") {
-          throw new Error(`machine-wrap-up only resolves "flow" wrap-ups, got "${request.source}"`);
+        if (request.source !== wrapUpSource) {
+          throw new Error(`machine-wrap-up only resolves "${wrapUpSource}" wrap-ups, got "${request.source}"`);
         }
         return resolved.resolution;
       }
@@ -16407,7 +16419,7 @@ async function proposeOneGroup(params) {
     const actor = await authorizationServer.actorContextFor(undefined, requestCorrelationId);
     if (!actor)
       throw new Error("trusted ActorContext is required for a machine wrap-up propose");
-    const provenance = await wrapUpAuthority.issue({ actor, source: "flow", sourceRef });
+    const provenance = await wrapUpAuthority.issue({ actor, source: wrapUpSource, sourceRef });
     try {
       const proposal = await service.create({
         request: undefined,
@@ -16450,6 +16462,7 @@ async function runWrapUp(input2) {
     slate: input2.slate,
     kind,
     now,
+    ...input2.wrapUpSource !== undefined ? { wrapUpSource: input2.wrapUpSource } : {},
     ...input2.env !== undefined ? { env: input2.env } : {},
     ...input2.providerFactory !== undefined ? { providerFactory: input2.providerFactory } : {},
     ...input2.modelTurnTimeoutMs !== undefined ? { modelTurnTimeoutMs: input2.modelTurnTimeoutMs } : {}
@@ -33541,7 +33554,8 @@ function fileRuntime(id, relativePath) {
     merge: mcpMerge,
     strip: mcpStrip,
     validate: mcpValidate(id),
-    hasManaged: mcpHasManaged
+    hasManaged: mcpHasManaged,
+    listServers: (settings) => Object.keys(readServers(settings))
   };
 }
 var CURSOR_RUNTIME = fileRuntime("cursor", ".cursor/mcp.json");
@@ -33607,7 +33621,8 @@ var OPENCODE_RUNTIME = {
   merge: opencodeMerge,
   strip: opencodeStrip,
   validate: opencodeValidate,
-  hasManaged: opencodeHasManaged
+  hasManaged: opencodeHasManaged,
+  listServers: (settings) => Object.keys(readOpencodeMcp(settings))
 };
 var GENERIC_RUNTIME = {
   id: "generic",
@@ -33615,7 +33630,8 @@ var GENERIC_RUNTIME = {
   merge: mcpMerge,
   strip: mcpStrip,
   validate: mcpValidate("generic"),
-  hasManaged: mcpHasManaged
+  hasManaged: mcpHasManaged,
+  listServers: (settings) => Object.keys(readServers(settings))
 };
 function readVscodeServers(settings) {
   return typeof settings.servers === "object" && settings.servers !== null && !Array.isArray(settings.servers) ? { ...settings.servers } : {};
@@ -33676,7 +33692,8 @@ var VSCODE_RUNTIME = {
   merge: vscodeMerge,
   strip: vscodeStrip,
   validate: vscodeValidate,
-  hasManaged: vscodeHasManaged
+  hasManaged: vscodeHasManaged,
+  listServers: (settings) => Object.keys(readVscodeServers(settings))
 };
 var MCP_CLIENT_RUNTIMES = [
   CURSOR_RUNTIME,
@@ -33716,11 +33733,12 @@ async function mcpClientStatus(projectRoot, ids = mcpRuntimeIds()) {
   for (const runtime of runtimes) {
     const file = runtime.settingsPath(absoluteProjectRoot);
     if (file === null) {
-      statuses.push({ id: runtime.id, filePath: null, connected: false });
+      statuses.push({ id: runtime.id, filePath: null, connected: false, otherServers: [] });
       continue;
     }
     const settings = await readSettings2(file);
-    statuses.push({ id: runtime.id, filePath: file, connected: runtime.hasManaged(settings) });
+    const otherServers = runtime.listServers(settings).filter((name) => name !== MCP_SERVER_NAME).sort();
+    statuses.push({ id: runtime.id, filePath: file, connected: runtime.hasManaged(settings), otherServers });
   }
   return statuses;
 }
@@ -33767,7 +33785,7 @@ function buildMcpModuleEntry() {
     expose: {
       tools: true,
       resources: true,
-      modules: ["gdgraph", "gdctx", "security", "flow", "memory", "health", "testing", "wiki", "standard", "sac", "gdskills"]
+      modules: ["gdgraph", "gdctx", "security", "flow", "memory", "health", "testing", "wiki", "standard", "sac", "slate", "gdskills"]
     }
   };
 }
@@ -43429,7 +43447,7 @@ function printSecurityHelp() {
 
 // src/commands/mcp.ts
 init_args();
-import path136 from "path";
+import path137 from "path";
 
 // src/mcp/discovery.ts
 init_fs();
@@ -43444,7 +43462,8 @@ var MODULE_MANIFEST_KEY = {
   wiki: "gdwiki",
   standard: null,
   mcp: null,
-  sac: null
+  sac: null,
+  slate: null
 };
 function readMcpEntry(manifest) {
   const entry = manifest.modules?.mcp;
@@ -43510,7 +43529,7 @@ init_metaproject_adapter();
 init_service6();
 init_service3();
 init_service7();
-import { readFile as readFile75, writeFile as writeFile47 } from "fs/promises";
+import { readFile as readFile76, writeFile as writeFile47 } from "fs/promises";
 
 // src/mcp/metaproject-tools.ts
 init_metaproject_adapter();
@@ -44401,12 +44420,116 @@ function normalizeCollaborationResult(value) {
 // src/sac/service.ts
 init_workspace_service();
 
+// src/session/external-slate.ts
+init_fs();
+init_machine_wrap_up();
+import { mkdir as mkdir54, readdir as readdir23, readFile as readFile75 } from "fs/promises";
+import path135 from "path";
+function externalSlatesDir(cwd) {
+  return path135.join(cwd, ".keryx", "external-slates");
+}
+var EXTERNAL_SESSION_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+function assertValidExternalSessionId(externalSessionId) {
+  if (!EXTERNAL_SESSION_ID_PATTERN.test(externalSessionId)) {
+    throw new Error(`invalid externalSessionId ${JSON.stringify(externalSessionId)} \u2014 must match ${EXTERNAL_SESSION_ID_PATTERN.source} (letters, digits, "-", "_", 1-128 chars, no path separators)`);
+  }
+}
+function externalSlatePath(cwd, externalSessionId) {
+  assertValidExternalSessionId(externalSessionId);
+  return path135.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
+}
+function externalSlateLockPath(cwd, externalSessionId) {
+  return `${externalSlatePath(cwd, externalSessionId)}.lock`;
+}
+function externalSlateEvidenceDir(cwd, externalSessionId) {
+  assertValidExternalSessionId(externalSessionId);
+  return path135.join(externalSlatesDir(cwd), externalSessionId);
+}
+async function readExternalSlate(cwd, externalSessionId) {
+  try {
+    const raw = await readFile75(externalSlatePath(cwd, externalSessionId), "utf8");
+    return JSON.parse(raw);
+  } catch (error2) {
+    if (isNotFound(error2))
+      return;
+    throw error2;
+  }
+}
+async function writeExternalSlate(cwd, externalSessionId, update) {
+  await mkdir54(externalSlatesDir(cwd), { recursive: true });
+  return withFileLock2(externalSlateLockPath(cwd, externalSessionId), async () => {
+    const prev = await readExternalSlate(cwd, externalSessionId);
+    const next = update(prev);
+    await writeFileAtomic(externalSlatePath(cwd, externalSessionId), `${JSON.stringify(next, null, 2)}
+`);
+    return next;
+  });
+}
+async function listExternalSlateIds(cwd) {
+  try {
+    const entries = await readdir23(externalSlatesDir(cwd));
+    return entries.filter((name) => name.endsWith(".json")).map((name) => name.slice(0, -".json".length));
+  } catch (error2) {
+    if (isNotFound(error2))
+      return [];
+    throw error2;
+  }
+}
+function isExternalSlateStale(slate, now = () => new Date) {
+  const lastWriteMs = new Date(slate.lastWriteAt).getTime();
+  if (!Number.isFinite(lastWriteMs))
+    return true;
+  return now().getTime() - lastWriteMs > DEFAULT_LOCK_STALE_MS;
+}
+async function closeExternalSlate(cwd, externalSessionId, trigger, now = () => new Date) {
+  await mkdir54(externalSlatesDir(cwd), { recursive: true });
+  return withFileLock2(externalSlateLockPath(cwd, externalSessionId), async () => {
+    const external = await readExternalSlate(cwd, externalSessionId);
+    if (!external || external.closedAt !== undefined)
+      return;
+    const shimSlate = {
+      ...external.workspaceId !== undefined ? { workspaceId: external.workspaceId } : {},
+      anchors: { root: external.anchors.root, touched: external.anchors.touched ?? [] },
+      course: {},
+      seeds: external.seeds
+    };
+    await runWrapUp({
+      cwd,
+      dir: externalSlateEvidenceDir(cwd, externalSessionId),
+      slate: shimSlate,
+      trigger,
+      wrapUpSource: "external-slate",
+      now
+    });
+    const next = { ...external, closedAt: now().toISOString() };
+    await writeFileAtomic(externalSlatePath(cwd, externalSessionId), `${JSON.stringify(next, null, 2)}
+`);
+  });
+}
+async function reclaimStaleExternalSlates(cwd, now = () => new Date) {
+  const ids = await listExternalSlateIds(cwd);
+  for (const id of ids) {
+    try {
+      const slate = await readExternalSlate(cwd, id);
+      if (slate && isExternalSlateStale(slate, now)) {
+        await closeExternalSlate(cwd, id, "external-slate-idle-reclaim", now);
+      }
+    } catch {}
+  }
+}
+
+// src/sac/service.ts
+init_slate();
+init_workspace_resolve();
+init_redact();
+
 // src/mcp/tools.ts
 import { randomUUID as randomUUID17 } from "crypto";
 function stringParam2(params, key) {
   const value = params[key];
   return typeof value === "string" ? value : undefined;
 }
+var MAX_EXTERNAL_SLATE_SEEDS = 200;
 async function loadGraphSafe(cwd) {
   try {
     return await loadGraph(cwd);
@@ -44427,6 +44550,38 @@ function readOnlyFlowService() {
     now: () => new Date
   });
 }
+async function handleSlateOpen(params) {
+  const { cwd, externalSessionId, resolveWorkspace } = params;
+  if (externalSessionId.length === 0)
+    throw new Error("slate.open requires a non-empty 'externalSessionId'");
+  await reclaimStaleExternalSlates(cwd);
+  const existing = await readExternalSlate(cwd, externalSessionId);
+  if (existing)
+    return existing;
+  const rawAnchors = params.anchors && typeof params.anchors === "object" ? params.anchors : {};
+  const anchors = {
+    root: typeof rawAnchors.root === "string" ? rawAnchors.root : "",
+    ...Array.isArray(rawAnchors.touched) ? { touched: rawAnchors.touched.filter((t) => typeof t === "string") } : {},
+    ...typeof rawAnchors.note === "string" ? { note: rawAnchors.note } : {}
+  };
+  let workspaceId = params.workspaceId;
+  if (workspaceId === undefined) {
+    const resolver = resolveWorkspace ?? resolveOrCreateWorkspace;
+    const topicHint = anchors.note ?? (anchors.root.length > 0 ? anchors.root : externalSessionId);
+    try {
+      const resolved = await resolver({ cwd, topicHint });
+      if (resolved.ok)
+        workspaceId = resolved.workspaceId;
+    } catch {}
+  }
+  return writeExternalSlate(cwd, externalSessionId, () => ({
+    externalSessionId,
+    ...workspaceId ? { workspaceId } : {},
+    anchors,
+    seeds: [],
+    lastWriteAt: new Date().toISOString()
+  }));
+}
 function buildToolRegistry() {
   return [
     ...toMcpTools(),
@@ -44558,6 +44713,102 @@ function buildToolRegistry() {
         return workspace;
       }
     },
+    {
+      name: "slate.open",
+      module: "slate",
+      description: "Open (or idempotently re-open) this external hand's own private, task-local Slate \u2014 never readable/writable by a different externalSessionId. `anchors` is stored verbatim (root/touched/note), never harness-enriched.",
+      inputSchema: OBJECT_SCHEMA({
+        externalSessionId: { type: "string" },
+        workspaceId: { type: "string", description: "Bind this slate to an already-known SAC workspace up front; omit to stay unbound (slate.close then preserves Seeds as a local unbound-candidate artifact)." },
+        anchors: {
+          type: "object",
+          description: "{ root: string, touched?: string[], note?: string } \u2014 this hand's own self-report, stored exactly as given.",
+          properties: { root: { type: "string" }, touched: { type: "array", items: { type: "string" } }, note: { type: "string" } }
+        }
+      }, ["externalSessionId"]),
+      mutating: true,
+      async invoke(cwd, params, context) {
+        if (context?.transport === "http")
+          return { code: "slate_transport_denied" };
+        const externalSessionId = stringParam2(params, "externalSessionId") ?? "";
+        const workspaceId = stringParam2(params, "workspaceId");
+        return handleSlateOpen({
+          cwd,
+          externalSessionId,
+          ...workspaceId !== undefined ? { workspaceId } : {},
+          anchors: params.anchors
+        });
+      }
+    },
+    {
+      name: "slate.writeSeed",
+      module: "slate",
+      description: "Append a draft Seed (task-local hypothesis, not yet reviewed knowledge) to this external hand's own Slate. `origin`/`trust` are always server-set \u2014 a caller-supplied value for either is never used.",
+      inputSchema: OBJECT_SCHEMA({ externalSessionId: { type: "string" }, text: { type: "string" }, kind: { type: "string", description: "decision | wiki-update | memory-entry | follow-up | contract-change | risk" } }, ["externalSessionId", "text"]),
+      mutating: true,
+      async invoke(cwd, params, context) {
+        if (context?.transport === "http")
+          return { code: "slate_transport_denied" };
+        const externalSessionId = stringParam2(params, "externalSessionId") ?? "";
+        const rawText = stringParam2(params, "text") ?? "";
+        if (externalSessionId.length === 0)
+          throw new Error("slate.writeSeed requires a non-empty 'externalSessionId'");
+        if (rawText.length === 0)
+          throw new Error("slate.writeSeed requires a non-empty 'text'");
+        if (rawText.length > SEED_TEXT_MAX_LENGTH) {
+          throw new Error(`slate.writeSeed: 'text' exceeds the ${SEED_TEXT_MAX_LENGTH}-character limit (got ${rawText.length})`);
+        }
+        await reclaimStaleExternalSlates(cwd);
+        const rawKind = stringParam2(params, "kind");
+        let kind;
+        if (rawKind !== undefined) {
+          if (!isSlateSeedKind(rawKind)) {
+            throw new Error(`slate.writeSeed: unrecognized 'kind' "${rawKind}"`);
+          }
+          kind = rawKind;
+        }
+        const text = redactSensitiveText(rawText);
+        const ts = new Date().toISOString();
+        const seed = {
+          id: `seed-${randomUUID17()}`,
+          text,
+          ts,
+          ...kind ? { kind } : {},
+          origin: { harness: "mcp-external" },
+          trust: "external-unverified"
+        };
+        return writeExternalSlate(cwd, externalSessionId, (prev) => {
+          if (!prev)
+            throw new Error(`slate.writeSeed: no open external slate for "${externalSessionId}" \u2014 call slate.open first`);
+          if (prev.closedAt !== undefined)
+            throw new Error(`slate.writeSeed: external slate "${externalSessionId}" is already closed`);
+          if (prev.seeds.length >= MAX_EXTERNAL_SLATE_SEEDS) {
+            throw new Error(`slate.writeSeed: external slate "${externalSessionId}" already has ${MAX_EXTERNAL_SLATE_SEEDS} seeds (the maximum) \u2014 close it and open a fresh one`);
+          }
+          return { ...prev, seeds: [...prev.seeds, seed], lastWriteAt: ts };
+        });
+      }
+    },
+    {
+      name: "slate.close",
+      module: "slate",
+      description: "Close this external hand's Slate: dispatches into the existing SAC propose/review pipeline (mirrors SLATE-18's autonomous workspace_propose) when a workspaceId is bound, else preserves its Seeds as a local unbound-candidate artifact \u2014 never a proposal against a guessed workspaceId.",
+      inputSchema: OBJECT_SCHEMA({ externalSessionId: { type: "string" } }, ["externalSessionId"]),
+      mutating: true,
+      async invoke(cwd, params, context) {
+        if (context?.transport === "http")
+          return { code: "slate_transport_denied" };
+        const externalSessionId = stringParam2(params, "externalSessionId") ?? "";
+        if (externalSessionId.length === 0)
+          throw new Error("slate.close requires a non-empty 'externalSessionId'");
+        await reclaimStaleExternalSlates(cwd);
+        const existing = await readExternalSlate(cwd, externalSessionId);
+        if (!existing)
+          return { externalSessionId, closed: true, alreadyClosed: true };
+        await closeExternalSlate(cwd, externalSessionId, "external-slate-close");
+        return { externalSessionId, closed: true };
+      }
+    },
     {
       name: "gdgraph.affected",
       module: "gdgraph",
@@ -44620,7 +44871,7 @@ function buildToolRegistry() {
       async invoke(cwd, params) {
         const filePath = stringParam2(params, "path");
         const inline = stringParam2(params, "content");
-        const content = inline ?? (filePath ? await readFile75(filePath, "utf8") : "");
+        const content = inline ?? (filePath ? await readFile76(filePath, "utf8") : "");
         const result = await runScan(cwd, {
           content,
           source: "trusted-project",
@@ -44741,8 +44992,8 @@ function buildToolRegistry() {
 
 // src/mcp/resources.ts
 init_fs();
-import path135 from "path";
-import { readdir as readdir23, readFile as readFile76, stat as stat7 } from "fs/promises";
+import path136 from "path";
+import { readdir as readdir24, readFile as readFile77, stat as stat7 } from "fs/promises";
 var URI_PREFIX = "metaproject://";
 function mimeForPath(filePath) {
   if (filePath.endsWith(".json") || filePath.endsWith(".jsonl")) {
@@ -44754,13 +45005,13 @@ function mimeForPath(filePath) {
   return "text/plain";
 }
 function dataRoot3(cwd) {
-  return path135.join(cwd, ".metaproject", "data");
+  return path136.join(cwd, ".metaproject", "data");
 }
 function wikiRoot(cwd) {
-  return path135.join(cwd, ".metaproject", "wiki");
+  return path136.join(cwd, ".metaproject", "wiki");
 }
 function memoryRoot2(cwd) {
-  return path135.join(cwd, ".metaproject", "memory");
+  return path136.join(cwd, ".metaproject", "memory");
 }
 async function walkFiles(root) {
   if (!await pathExists(root)) {
@@ -44769,12 +45020,12 @@ async function walkFiles(root) {
   const out = [];
   let entries;
   try {
-    entries = await readdir23(root, { withFileTypes: true });
+    entries = await readdir24(root, { withFileTypes: true });
   } catch {
     return [];
   }
   for (const entry of entries) {
-    const full = path135.join(root, entry.name);
+    const full = path136.join(root, entry.name);
     if (entry.isDirectory()) {
       out.push(...await walkFiles(full));
     } else if (entry.isFile()) {
@@ -44791,7 +45042,7 @@ async function listArtifacts(cwd) {
   const listings = [];
   let modules;
   try {
-    modules = await readdir23(base, { withFileTypes: true });
+    modules = await readdir24(base, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -44799,9 +45050,9 @@ async function listArtifacts(cwd) {
     if (!moduleEntry.isDirectory()) {
       continue;
     }
-    const artifactsDir2 = path135.join(base, moduleEntry.name, "artifacts");
+    const artifactsDir2 = path136.join(base, moduleEntry.name, "artifacts");
     for (const file of await walkFiles(artifactsDir2)) {
-      const rel = toPosix(path135.relative(artifactsDir2, file));
+      const rel = toPosix(path136.relative(artifactsDir2, file));
       const relPath = `${moduleEntry.name}/${rel}`;
       listings.push({
         uri: `${URI_PREFIX}artifacts/${relPath}`,
@@ -44815,7 +45066,7 @@ async function listArtifacts(cwd) {
 async function listUnderRoot(cwd, cls, root) {
   const listings = [];
   for (const file of await walkFiles(root)) {
-    const rel = toPosix(path135.relative(root, file));
+    const rel = toPosix(path136.relative(root, file));
     listings.push({
       uri: `${URI_PREFIX}${cls}/${rel}`,
       name: rel,
@@ -44865,12 +45116,12 @@ function resolveConfined(cwd, cls, relPath) {
     if (moduleName.includes("..") || moduleName.length === 0) {
       return null;
     }
-    const root2 = path135.join(dataRoot3(cwd), moduleName, "artifacts");
-    const absolute2 = path135.resolve(root2, rest);
+    const root2 = path136.join(dataRoot3(cwd), moduleName, "artifacts");
+    const absolute2 = path136.resolve(root2, rest);
     return isPathInside(root2, absolute2) ? { root: root2, absolute: absolute2 } : null;
   }
   const root = cls === "wiki" ? wikiRoot(cwd) : memoryRoot2(cwd);
-  const absolute = path135.resolve(root, relPath);
+  const absolute = path136.resolve(root, relPath);
   return isPathInside(root, absolute) ? { root, absolute } : null;
 }
 async function readResource(cwd, roots, uri) {
@@ -44889,7 +45140,7 @@ async function readResource(cwd, roots, uri) {
   if (!info || !info.isFile()) {
     throw new Error(`Resource not found: ${uri}`);
   }
-  const text = await readFile76(resolved.absolute, "utf8");
+  const text = await readFile77(resolved.absolute, "utf8");
   return { uri, mimeType: mimeForPath(resolved.absolute), text };
 }
 
@@ -45070,7 +45321,7 @@ async function mcpCommand(args2 = [], cwd = process.cwd()) {
   }
   if (!subcommand || subcommand === "serve") {
     const http = args2.includes("--http");
-    const projectRoot = path136.resolve(optionValue(args2, "--cwd") ?? cwd);
+    const projectRoot = path137.resolve(optionValue(args2, "--cwd") ?? cwd);
     try {
       await serveMcp({ cwd: projectRoot, http });
     } catch (error2) {
@@ -45104,7 +45355,7 @@ async function handleInstall2(cwd, args2) {
       console.log(outcome.snippet ?? "");
       continue;
     }
-    const rel = path136.relative(cwd, outcome.filePath);
+    const rel = path137.relative(cwd, outcome.filePath);
     if (outcome.errors.length > 0) {
       for (const e of outcome.errors) {
         console.log(`  ${style.red(symbols.cross)} ${e}`);
@@ -45144,7 +45395,7 @@ async function handleUninstall2(cwd, args2) {
       console.log(`  ${style.gray(symbols.off)} ${outcome.id} ${style.dim("no file to change")}`);
       continue;
     }
-    const rel = path136.relative(cwd, outcome.filePath);
+    const rel = path137.relative(cwd, outcome.filePath);
     console.log(`  ${outcome.removed ? style.green(symbols.ok) : style.gray(symbols.off)} ${outcome.id} ${style.dim(outcome.removed ? `removed from ${rel}` : "nothing to remove")}`);
   }
 }
@@ -45174,14 +45425,14 @@ function printMcpHelp() {
 // src/commands/status.ts
 init_fs();
 init_json();
-import path137 from "path";
+import path138 from "path";
 async function statusCommand(args2 = []) {
   if (args2.includes("--help") || args2.includes("-h")) {
     printHelp14();
     return;
   }
-  const root = path137.join(process.cwd(), ".metaproject");
-  const manifestPath = path137.join(root, "metaproject.json");
+  const root = path138.join(process.cwd(), ".metaproject");
+  const manifestPath = path138.join(root, "metaproject.json");
   if (!await pathExists(root)) {
     console.log("Metaproject: not initialized");
     console.log("Run: keryx init");
@@ -45221,7 +45472,7 @@ Reports the workspace root and one enabled/disabled line per module. Use
 
 // src/commands/harness.ts
 import { readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "fs";
-import path141 from "path";
+import path142 from "path";
 import { randomUUID as randomUUID18 } from "crypto";
 
 // src/security/harness-scan.ts
@@ -46294,7 +46545,7 @@ ${command.argv.join(" ")}`);
 }
 
 // src/harness/process/sandbox/profile.ts
-import path138 from "path";
+import path139 from "path";
 var DEFAULT_SECRET_SUBPATHS = [
   ".ssh",
   ".gnupg",
@@ -46319,7 +46570,7 @@ function defaultReadDenyList(home) {
   if (!home) {
     return [];
   }
-  return DEFAULT_SECRET_SUBPATHS.map((sub) => path138.join(home, sub));
+  return DEFAULT_SECRET_SUBPATHS.map((sub) => path139.join(home, sub));
 }
 function defaultSandboxProfile(cwd, tmpDir, home) {
   return {
@@ -46337,7 +46588,7 @@ function dedupe2(values) {
 
 // src/harness/process/sandbox/detect.ts
 import { existsSync as realExistsSync } from "fs";
-import path139 from "path";
+import path140 from "path";
 
 // src/harness/process/sandbox/seatbelt.ts
 var SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
@@ -46531,9 +46782,9 @@ function detectSandboxLauncher(opts = {}) {
   }
   if (platform === "linux") {
     const env = opts.env ?? process.env;
-    const dirs = (env.PATH ?? "").split(path139.delimiter).filter(Boolean);
+    const dirs = (env.PATH ?? "").split(path140.delimiter).filter(Boolean);
     for (const dir of dirs) {
-      const candidate = path139.join(dir, BWRAP_PROGRAM);
+      const candidate = path140.join(dir, BWRAP_PROGRAM);
       if (exists2(candidate)) {
         return { available: true, platform, path: candidate };
       }
@@ -46563,10 +46814,10 @@ function resolveSandboxAdapter(profile, inner, opts = {}) {
 init_config_dir();
 init_shell_config();
 import { existsSync as existsSync22 } from "fs";
-import path140 from "path";
+import path141 from "path";
 var SECRET_KEY_PATTERN2 = /api[_-]?key|secret|token|password|credential/i;
 function sandboxConfigPath(dir) {
-  return path140.join(path140.dirname(shellConfigPath(dir)), "sandbox.json");
+  return path141.join(path141.dirname(shellConfigPath(dir)), "sandbox.json");
 }
 function isShellDefault(v) {
   return v === "off" || v === "workspace" || v === "strict" || v === "1";
@@ -47685,7 +47936,7 @@ async function harnessExec(args2, deps) {
     env: commandEnv,
     cwd
   };
-  const worktreeRoot = path141.parse(path141.resolve(cwd, commandPath)).root || cwd;
+  const worktreeRoot = path142.parse(path142.resolve(cwd, commandPath)).root || cwd;
   const budget = {
     reservationId: idSeq(),
     maxRuntimeMs: maxRuntimeMs ?? EXEC_DEFAULT_RUNTIME_MS
@@ -47921,7 +48172,7 @@ async function buildApprovalContext(port, command) {
 import { randomUUID as randomUUID20 } from "crypto";
 
 // src/harness/tool/builtin/interactive-tools.ts
-import { readdir as readdir24 } from "fs/promises";
+import { readdir as readdir25 } from "fs/promises";
 import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2, sep } from "path";
 import { realpathSync as realpathSync4 } from "fs";
 var MAX_READ_BYTES = 20000;
@@ -47973,7 +48224,7 @@ function builtinReadOnlyTools(root) {
         return { output: `path escapes the project root: ${requested}`, isError: true };
       }
       try {
-        const entries = await readdir24(target, { withFileTypes: true });
+        const entries = await readdir25(target, { withFileTypes: true });
         const lines = entries.map((e) => e.isDirectory() ? `${e.name}/` : e.name).sort();
         return { output: lines.length > 0 ? lines.join(`
 `) : "(empty)", isError: false };
@@ -48887,13 +49138,13 @@ function builtinMetaprojectTools(root, run = makeKeryxRunner(root), port) {
       if ("error" in pattern) {
         return pattern.error;
       }
-      const path142 = typeof input2.path === "string" && input2.path.length > 0 ? input2.path : undefined;
+      const path143 = typeof input2.path === "string" && input2.path.length > 0 ? input2.path : undefined;
       const args2 = ["ctx", "rg", pattern.value];
-      if (path142 !== undefined) {
-        const confined = confineToRoot(root, path142);
+      if (path143 !== undefined) {
+        const confined = confineToRoot(root, path143);
         if (confined === null) {
           return {
-            output: `search_code: path escapes the project root: ${path142}`,
+            output: `search_code: path escapes the project root: ${path143}`,
             isError: true
           };
         }
@@ -48949,18 +49200,6 @@ function builtinMetaprojectTools(root, run = makeKeryxRunner(root), port) {
 init_slate();
 init_slate_course();
 init_redact();
-var SEED_TEXT_MAX_LENGTH = 4000;
-var SLATE_SEED_KINDS = [
-  "decision",
-  "wiki-update",
-  "memory-entry",
-  "follow-up",
-  "contract-change",
-  "risk"
-];
-function isSlateSeedKind(value) {
-  return typeof value === "string" && SLATE_SEED_KINDS.includes(value);
-}
 function slateReadTool(cwd, getSessionDir) {
   return {
     definition: {
@@ -49609,7 +49848,7 @@ init_shell_config();
 init_command_risk();
 init_shell_syntax();
 import { existsSync as existsSync24 } from "fs";
-import path142 from "path";
+import path143 from "path";
 import { createHash as createHash31 } from "crypto";
 var PREFIX_BANNED = new Set([
   "sh",
@@ -49795,7 +50034,7 @@ function emptyShellPermissions() {
   return { allow: [] };
 }
 function shellPermissionsPath(dir) {
-  return path142.join(path142.dirname(shellConfigPath(dir)), "permissions.json");
+  return path143.join(path143.dirname(shellConfigPath(dir)), "permissions.json");
 }
 function loadShellPermissionsWithAudit(dir) {
   try {
@@ -49833,7 +50072,7 @@ function loadShellPermissions(dir) {
 function saveShellPermissions(perms, dir, options = {}) {
   try {
     const file = shellPermissionsPath(dir);
-    ensureKeryxConfigDir(path142.dirname(file));
+    ensureKeryxConfigDir(path143.dirname(file));
     const cleaned = Array.from(new Set(perms.allow.map((p) => p.trim()).filter((p) => p.length > 0)));
     const body = {
       allow: options.skipValidation === true ? cleaned : cleaned.filter((p) => validateShellPattern(p).ok)
@@ -50150,12 +50389,12 @@ function remoteRequest(providerId, endpoint, query, key) {
 // src/lib/search-config.ts
 init_config_dir();
 import { existsSync as existsSync25 } from "fs";
-import path143 from "path";
+import path144 from "path";
 function searchConfigPath(dir) {
-  return path143.join(keryxConfigDir(dir), "search-providers.json");
+  return path144.join(keryxConfigDir(dir), "search-providers.json");
 }
 function searchCredentialPath(dir) {
-  return path143.join(keryxConfigDir(dir), "search-credentials.json");
+  return path144.join(keryxConfigDir(dir), "search-credentials.json");
 }
 function readJson(file) {
   try {
@@ -50284,7 +50523,7 @@ function createDefaultSearchProviderController(configDir) {
 import { createHash as createHash32, randomUUID as randomUUID21 } from "crypto";
 import { mkdtemp, rm as rm8 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
-import path144 from "path";
+import path145 from "path";
 init_metaproject_adapter();
 init_ledger();
 init_orchestrate();
@@ -50535,8 +50774,8 @@ function createSpawnSubagentTool(deps) {
       let dispatchId = "";
       let closing = false;
       try {
-        ephemeralDir = await mkdtemp(path144.join(tmpdir4(), "keryx-subagent-slate-"));
-        dispatchId = path144.basename(ephemeralDir);
+        ephemeralDir = await mkdtemp(path145.join(tmpdir4(), "keryx-subagent-slate-"));
+        dispatchId = path145.basename(ephemeralDir);
         openedChildSlate = await openSlate({
           dir: ephemeralDir,
           cwd,
@@ -50778,9 +51017,9 @@ ${boundSummary(folded.text)}`,
 // src/harness/run-external-factory.ts
 import { randomUUID as randomUUID22 } from "crypto";
 import { execFile as execFile4 } from "child_process";
-import { mkdir as mkdir54 } from "fs/promises";
+import { mkdir as mkdir55 } from "fs/promises";
 import { tmpdir as tmpdir6 } from "os";
-import path146 from "path";
+import path147 from "path";
 import { promisify as promisify4 } from "util";
 
 // src/harness/child/git-worktree-port.ts
@@ -50793,27 +51032,27 @@ function createGitWorktreePort(options) {
   const paths = new Map;
   return {
     async create(worktreeId) {
-      const path145 = `${worktreesDir}/${worktreeId}`;
-      await execFileAsync3("git", ["worktree", "add", "--detach", path145, ref], { cwd: repoRoot });
-      paths.set(worktreeId, path145);
-      return { worktreeId, path: path145 };
+      const path146 = `${worktreesDir}/${worktreeId}`;
+      await execFileAsync3("git", ["worktree", "add", "--detach", path146, ref], { cwd: repoRoot });
+      paths.set(worktreeId, path146);
+      return { worktreeId, path: path146 };
     },
     async remove(worktreeId) {
-      const path145 = paths.get(worktreeId);
-      if (path145 === undefined)
+      const path146 = paths.get(worktreeId);
+      if (path146 === undefined)
         return;
-      await execFileAsync3("git", ["worktree", "remove", "--force", path145], { cwd: repoRoot });
+      await execFileAsync3("git", ["worktree", "remove", "--force", path146], { cwd: repoRoot });
       paths.delete(worktreeId);
       await execFileAsync3("git", ["worktree", "prune"], { cwd: repoRoot }).catch(() => {
         return;
       });
     },
     async merge(worktreeId, into) {
-      const path145 = paths.get(worktreeId);
-      if (path145 === undefined) {
+      const path146 = paths.get(worktreeId);
+      if (path146 === undefined) {
         return { worktreeId, ok: false, conflicts: [`worktree "${worktreeId}" was not created by this port`] };
       }
-      const status = await execFileAsync3("git", ["status", "--porcelain"], { cwd: path145 });
+      const status = await execFileAsync3("git", ["status", "--porcelain"], { cwd: path146 });
       if (status.stdout.trim().length === 0) {
         return { worktreeId, ok: true };
       }
@@ -51079,7 +51318,7 @@ function canNestExternalChild(env, maxDepth) {
 // src/harness/external/runtime.ts
 import { mkdtemp as mkdtemp2, rm as rm9, writeFile as writeFile48 } from "fs/promises";
 import { tmpdir as tmpdir5 } from "os";
-import path145 from "path";
+import path146 from "path";
 
 // src/harness/external/prompt.ts
 var EXTERNAL_RUNTIME_DIRECTIVE = [
@@ -52122,8 +52361,8 @@ async function prepareResultSchema() {
   try {
     const schema = await loadSchema("subagent-result");
     const schemaText = JSON.stringify(schema, null, 2);
-    schemaDir = await mkdtemp2(path145.join(tmpdir5(), "keryx-external-result-schema-"));
-    const schemaPath = path145.join(schemaDir, "subagent-result.schema.json");
+    schemaDir = await mkdtemp2(path146.join(tmpdir5(), "keryx-external-result-schema-"));
+    const schemaPath = path146.join(schemaDir, "subagent-result.schema.json");
     await writeFile48(schemaPath, schemaText, "utf8");
     return { ok: true, schema, schemaText, schemaPath, schemaDir };
   } catch (error2) {
@@ -52350,7 +52589,7 @@ async function defaultWorkingDiff(cwd) {
 function ensuringParentDir(port, worktreesDir) {
   return {
     async create(worktreeId) {
-      await mkdir54(worktreesDir, { recursive: true });
+      await mkdir55(worktreesDir, { recursive: true });
       return port.create(worktreeId);
     },
     remove: (worktreeId) => port.remove(worktreeId),
@@ -52380,7 +52619,7 @@ async function createRunExternal(options) {
   }
   const config = gate.config;
   const idSeq = options.idSeq ?? (() => randomUUID22());
-  const worktreesDir = options.worktreesDir ?? path146.join(tmpdir6(), "keryx-external-worktrees");
+  const worktreesDir = options.worktreesDir ?? path147.join(tmpdir6(), "keryx-external-worktrees");
   const spawn5 = options.spawn ?? createBunSpawnPort();
   const worktree = options.worktree ?? ensuringParentDir(createGitWorktreePort({ repoRoot: options.cwd, worktreesDir }), worktreesDir);
   const readWorkingDiff = options.readWorkingDiff ?? (() => defaultWorkingDiff(options.cwd));
@@ -52565,12 +52804,12 @@ async function approveExternalSpawn(request) {
 import { homedir as homedir6 } from "os";
 var ESC = "\x1B";
 var CSI = `${ESC}[`;
-function collapseHome(path147) {
+function collapseHome(path148) {
   const home = homedir6();
-  if (home.length > 0 && (path147 === home || path147.startsWith(`${home}/`))) {
-    return `~${path147.slice(home.length)}`;
+  if (home.length > 0 && (path148 === home || path148.startsWith(`${home}/`))) {
+    return `~${path148.slice(home.length)}`;
   }
-  return path147;
+  return path148;
 }
 
 // src/lib/live-render.ts
@@ -52676,7 +52915,7 @@ class LiveMarkdownBlock {
 // src/tui/theme.ts
 init_config_dir();
 import { existsSync as existsSync26 } from "fs";
-import path147 from "path";
+import path148 from "path";
 var THEME_NAMES = ["groknight", "grokday", "tokyonight", "keryx"];
 var THEME_IDS = ["auto", ...THEME_NAMES];
 var DEFAULT_THEME_ID = "groknight";
@@ -52806,7 +53045,7 @@ function onThemeChange(listener4) {
   };
 }
 function tuiConfigPath(dir) {
-  return path147.join(keryxConfigDir(dir), "tui.json");
+  return path148.join(keryxConfigDir(dir), "tui.json");
 }
 function loadPersistedThemeId(dir) {
   try {
@@ -52860,28 +53099,63 @@ init_slate_lifecycle();
 init_slate();
 init_workspace_service();
 init_workspace_resolve();
+init_service7();
+init_fs();
+import path149 from "path";
+var POSITIVE_INTEGER = /^[1-9][0-9]*$/;
+var DEFAULT_AUTO_GOAL_ROUNDS = 8;
 function parseGoalArgs(rest) {
   const trimmed = rest.trim();
   if (trimmed.length === 0) {
-    return { error: "a goal <text> is required, e.g. /goal implement the login flow [--workspace <id>]" };
+    return {
+      error: "a goal <text> is required, e.g. /goal implement the login flow [--workspace <id>] [--auto [N]]"
+    };
   }
-  const tokens = trimmed.split(/\s+/);
-  const lastToken = tokens[tokens.length - 1];
-  const secondLastToken = tokens[tokens.length - 2];
+  let tokens = trimmed.split(/\s+/);
   let workspaceId;
-  let textTokens = tokens;
-  if (lastToken === "--workspace") {
-    return { error: "--workspace requires a value, e.g. /goal <text> --workspace <id>" };
-  }
-  if (secondLastToken === "--workspace") {
-    workspaceId = lastToken;
-    textTokens = tokens.slice(0, tokens.length - 2);
+  let auto;
+  let sawWorkspace = false;
+  let sawAuto = false;
+  for (let i = 0;i < 2; i++) {
+    const last = tokens[tokens.length - 1];
+    const secondLast = tokens[tokens.length - 2];
+    if (!sawAuto && secondLast === "--auto" && last !== undefined && POSITIVE_INTEGER.test(last)) {
+      auto = { rounds: Number(last) };
+      sawAuto = true;
+      tokens = tokens.slice(0, tokens.length - 2);
+      continue;
+    }
+    if (!sawAuto && last === "--auto") {
+      auto = {};
+      sawAuto = true;
+      tokens = tokens.slice(0, tokens.length - 1);
+      continue;
+    }
+    if (!sawWorkspace && last === "--workspace") {
+      return { error: "--workspace requires a value, e.g. /goal <text> --workspace <id>" };
+    }
+    if (!sawWorkspace && secondLast === "--workspace") {
+      workspaceId = last;
+      sawWorkspace = true;
+      tokens = tokens.slice(0, tokens.length - 2);
+      continue;
+    }
+    break;
   }
-  const text = textTokens.join(" ").trim();
+  const text = tokens.join(" ").trim();
   if (text.length === 0) {
-    return { error: "a goal <text> is required, e.g. /goal implement the login flow [--workspace <id>]" };
+    return {
+      error: "a goal <text> is required, e.g. /goal implement the login flow [--workspace <id>] [--auto [N]]"
+    };
+  }
+  const parsed = { text };
+  if (workspaceId !== undefined) {
+    parsed.workspaceId = workspaceId;
   }
-  return workspaceId !== undefined ? { text, workspaceId } : { text };
+  if (auto !== undefined) {
+    parsed.auto = auto;
+  }
+  return parsed;
 }
 function systemLine(io, text) {
   if (io.onSystem !== undefined) {
@@ -52890,6 +53164,113 @@ function systemLine(io, text) {
     io.write(text);
   }
 }
+var flowService;
+function getFlowService() {
+  flowService ??= createFlowService({
+    tracker: null,
+    healthGate: async () => ({ status: "skipped", reasons: [] }),
+    now: () => new Date
+  });
+  return flowService;
+}
+async function autoProvisionFlow(cwd, goalText) {
+  const service5 = getFlowService();
+  const result = await service5.init({ cwd, title: goalText });
+  const acFile = path149.join(cwd, result.dir, "acceptance-criteria.md");
+  await writeFileAtomic(acFile, [
+    "# Acceptance Criteria",
+    "",
+    "Rules:",
+    "",
+    "- Criteria lines use the exact format `- ACn: <criterion>`.",
+    "- After `flow freeze` this file is checksum-protected: any edit outside",
+    "  `keryx flow ac update` fails every gate and status transition.",
+    "- Completion requires every ACn to be confirmed via",
+    "  `keryx flow ac confirm <id> <ACn>`.",
+    "",
+    "Source: auto-provisioned by `/goal --auto` (SLATE-27, flow 186) \u2014 the",
+    "goal text itself is the spec; no separate description/plan pair exists.",
+    "",
+    "## Criteria",
+    "",
+    `- AC1: The stated goal \u2014 "${goalText}" \u2014 is achieved, judged by the`,
+    "  verifier subagent this session's continuation loop runs before",
+    "  stopping (flow 186 T10).",
+    ""
+  ].join(`
+`));
+  await service5.freeze({ cwd, id: result.flow.id });
+  await service5.start({ cwd, id: result.flow.id });
+  return result.flow.id;
+}
+async function buildContinuationMessage(cwd, slateSession, round4, roundsCap) {
+  const totalRounds = roundsCap + 1;
+  const generic = `Continue working toward the stated goal (round ${round4} of ${totalRounds}).`;
+  const slate = await readSlate(slateSession.dir).catch(() => {
+    return;
+  });
+  const flowId = slate?.course.flowRef;
+  if (flowId === undefined) {
+    return generic;
+  }
+  try {
+    const flow = await getFlowService().get({ cwd, id: flowId });
+    const remaining = flow.tasks.filter((task) => task.status !== "done");
+    const remainingList = remaining.length > 0 ? remaining.map((task) => `${task.id}: ${task.title}`).join("; ") : "(no open tasks recorded)";
+    return `${generic} Flow ${flowId} tasks remaining: ${remainingList}.`;
+  } catch {
+    return generic;
+  }
+}
+function parseVerifierVerdict(output2) {
+  const match = output2.match(/\{[\s\S]*\}/);
+  if (match === null) {
+    return;
+  }
+  try {
+    const parsed = JSON.parse(match[0]);
+    if (typeof parsed !== "object" || parsed === null || !("achieved" in parsed)) {
+      return;
+    }
+    const achieved = parsed.achieved;
+    if (typeof achieved !== "boolean") {
+      return;
+    }
+    const gapsRaw = parsed.gaps;
+    const gaps = Array.isArray(gapsRaw) ? gapsRaw.filter((g) => typeof g === "string") : [];
+    return { achieved, gaps };
+  } catch {
+    return;
+  }
+}
+async function runGoalVerifier(deps, goalText) {
+  const tool = deps.tools.find((candidate) => candidate.definition.name === "spawn_subagent");
+  if (tool === undefined) {
+    return;
+  }
+  const task = [
+    "Independently verify whether the following goal has ACTUALLY been achieved, based on the",
+    "current, real state of the repository (read the real files/tests \u2014 never trust a prior",
+    "claim in conversation history without checking it yourself).",
+    "",
+    `Goal: "${goalText}"`,
+    "",
+    "Reply with EXACTLY one JSON object and nothing else, no prose before or after it:",
+    '{"achieved": true or false, "gaps": ["specific reason it is not fully achieved", ...]}',
+    '"gaps" must be empty when "achieved" is true.'
+  ].join(`
+`);
+  let result;
+  try {
+    result = await tool.invoke({ task, mode: "read_only", label: "goal-verifier" });
+  } catch {
+    return;
+  }
+  if (result.isError) {
+    return;
+  }
+  return parseVerifierVerdict(result.output);
+}
 async function runGoalCommand(params) {
   const { raw, cwd, io, deps, history, slateSession, mintAttemptId, resolveWorkspace } = params;
   const parsed = parseGoalArgs(raw);
@@ -52898,6 +53279,8 @@ async function runGoalCommand(params) {
 `);
     return;
   }
+  let boundFlowRef;
+  let boundWorkspaceId;
   if (parsed.workspaceId !== undefined) {
     const resolved2 = await resolveWorkspaceForActor(cwd, parsed.workspaceId);
     if (!resolved2.ok) {
@@ -52937,12 +53320,84 @@ async function runGoalCommand(params) {
           }
         }
       }
+      if (parsed.auto !== undefined) {
+        const forCourse = await readSlate(slateSession.dir);
+        let flowRefForBinding = forCourse?.course.flowRef;
+        if (forCourse !== undefined && forCourse.course.flowRef === undefined) {
+          const flowId = await autoProvisionFlow(cwd, parsed.text);
+          await writeSlate(slateSession.dir, (prev) => {
+            if (!prev)
+              throw new Error(`SLATE-27 bind: no open slate in ${slateSession.dir}`);
+            return { ...prev, course: { ...prev.course, flowRef: flowId } };
+          });
+          flowRefForBinding = flowId;
+        }
+        slateSession.autoGoalRounds = parsed.auto.rounds ?? DEFAULT_AUTO_GOAL_ROUNDS;
+        boundFlowRef = flowRefForBinding;
+        boundWorkspaceId = forCourse?.workspaceId;
+      }
     } catch (err) {
       systemLine(io, `/goal: slate bookkeeping failed (ignored): ${err instanceof Error ? err.message : String(err)}
 `);
     }
   }
-  await runAgentTurn(io, deps, history, parsed.text, slateSession !== undefined ? { slateSession, skipCloseTrigger: true } : {});
+  const turnOptions = slateSession !== undefined ? { slateSession, skipCloseTrigger: true } : {};
+  await runAgentTurn(io, deps, history, parsed.text, turnOptions);
+  if (slateSession !== undefined && slateSession.autoGoalRounds !== undefined) {
+    const roundsCap = slateSession.autoGoalRounds;
+    delete slateSession.autoGoalRounds;
+    let roundsLeft = roundsCap;
+    let round4 = 1;
+    while (roundsLeft > 0 && slateSession.opened) {
+      roundsLeft -= 1;
+      round4 += 1;
+      const continuationText = await buildContinuationMessage(cwd, slateSession, round4, roundsCap);
+      systemLine(io, `/goal --auto: round ${round4}/${roundsCap + 1} \u2014 continuing toward the goal.
+`);
+      await runAgentTurn(io, deps, history, continuationText, turnOptions);
+    }
+    const wasOpenBeforeVerifier = slateSession.opened;
+    const verdict = await runGoalVerifier(deps, parsed.text);
+    if (verdict !== undefined && !verdict.achieved) {
+      systemLine(io, `/goal --auto: verifier found the goal not fully achieved${verdict.gaps.length > 0 ? ` \u2014 ${verdict.gaps.join("; ")}` : " (no specific gaps reported)"}
+`);
+      if (roundsLeft > 0) {
+        let reopenOk = true;
+        if (!wasOpenBeforeVerifier) {
+          try {
+            await ensureSlateOpened(slateSession, mintAttemptId, { provider: deps.providerId, model: deps.modelId });
+            const reopened = await readSlate(slateSession.dir);
+            if (reopened !== undefined) {
+              history.push({ role: "user", content: renderAnchorsBlock(reopened.anchors), provenance: "project" });
+              io.onHistoryChange?.("tool");
+            }
+            await writeSlate(slateSession.dir, (prev) => {
+              if (!prev)
+                throw new Error(`SLATE-27 verifier-reopen: no open slate in ${slateSession.dir}`);
+              return {
+                ...prev,
+                course: { ...prev.course, ...boundFlowRef !== undefined ? { flowRef: boundFlowRef } : {} },
+                ...boundWorkspaceId !== undefined ? { workspaceId: boundWorkspaceId } : {}
+              };
+            });
+          } catch (err) {
+            reopenOk = false;
+            systemLine(io, `/goal --auto: could not reopen the slate for one more round (ignored): ${err instanceof Error ? err.message : String(err)}
+`);
+          }
+        }
+        if (!reopenOk) {
+          return;
+        }
+        roundsLeft -= 1;
+        round4 += 1;
+        const continuationText = await buildContinuationMessage(cwd, slateSession, round4, roundsCap);
+        systemLine(io, `/goal --auto: round ${round4}/${roundsCap + 1} \u2014 one more round after the verifier found gaps.
+`);
+        await runAgentTurn(io, deps, history, continuationText, turnOptions);
+      }
+    }
+  }
 }
 
 // src/tui/tui-shell.ts
@@ -52951,7 +53406,7 @@ import { spawnSync as spawnSync2 } from "child_process";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.52",
+  version: "0.2.54",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -54211,8 +54666,8 @@ init_store3();
 init_proposal_lifecycle();
 init_workspace_service();
 import { randomUUID as randomUUID24 } from "crypto";
-import { readdir as readdir25 } from "fs/promises";
-import path148 from "path";
+import { readdir as readdir26 } from "fs/promises";
+import path150 from "path";
 
 // src/sac/lifecycle-flag.ts
 init_store();
@@ -54350,12 +54805,12 @@ async function collectSessionCategories(cwd) {
   return { blocked: blocked2, unboundCandidates, unknown };
 }
 async function isSlateEngaged(dir) {
-  if (await pathExists(path148.join(dir, "slate.json")))
+  if (await pathExists(path150.join(dir, "slate.json")))
     return true;
-  if (await pathExists(path148.join(dir, "terminal-state.json")))
+  if (await pathExists(path150.join(dir, "terminal-state.json")))
     return true;
   try {
-    const entries = await readdir25(path148.join(dir, "slate-archive"));
+    const entries = await readdir26(path150.join(dir, "slate-archive"));
     return entries.length > 0;
   } catch {
     return false;
@@ -54369,7 +54824,7 @@ async function safeReadSlate(dir) {
   }
 }
 async function readTerminalState(dir) {
-  const result = readConfigFile(path148.join(dir, "terminal-state.json"));
+  const result = readConfigFile(path150.join(dir, "terminal-state.json"));
   if (!result.ok) {
     return;
   }
@@ -54380,16 +54835,16 @@ async function readTerminalState(dir) {
   }
 }
 async function readNewestUnboundCandidate(dir) {
-  const archiveDir = path148.join(dir, "slate-archive");
+  const archiveDir = path150.join(dir, "slate-archive");
   let entries;
   try {
-    entries = (await readdir25(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
+    entries = (await readdir26(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
   } catch {
     return;
   }
   entries.sort();
   for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path148.join(archiveDir, entries[i]);
+    const evidencePath = path150.join(archiveDir, entries[i]);
     const result = readConfigFile(evidencePath);
     if (!result.ok) {
       continue;
@@ -54417,16 +54872,16 @@ function isFailureOutcome(g) {
   return g.outcome === "error" || g.outcome === "no_credential" || g.outcome === "conflict";
 }
 async function readNewestWrapUpOutcome(dir) {
-  const archiveDir = path148.join(dir, "slate-archive");
+  const archiveDir = path150.join(dir, "slate-archive");
   let entries;
   try {
-    entries = (await readdir25(archiveDir)).filter((name) => name.endsWith("-wrap-up-outcome.json"));
+    entries = (await readdir26(archiveDir)).filter((name) => name.endsWith("-wrap-up-outcome.json"));
   } catch {
     return;
   }
   entries.sort();
   for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path148.join(archiveDir, entries[i]);
+    const evidencePath = path150.join(archiveDir, entries[i]);
     const result = readConfigFile(evidencePath);
     if (!result.ok) {
       continue;
@@ -55542,6 +55997,9 @@ function isMcpToolsCommand(line) {
   const token = line.trim().split(/\s+/)[0] ?? "";
   return token === MCP_TOOLS_COMMAND;
 }
+var TOOLS_TAB_HEADER = "Built into keryx \u2014 not from an external MCP server (keryx doesn't consume MCP servers as a client yet).";
+var MCP_TAB_HEADER_1 = "Connects/disconnects ONLY keryx's own MCP server, one editor config at a time.";
+var MCP_TAB_HEADER_2 = "Other MCP servers already configured there (context7, playwright, \u2026) show per row, read-only.";
 var RUNTIME_LABELS = {
   cursor: "Cursor",
   claude: "Claude Code",
@@ -55560,10 +56018,20 @@ function formatToolRowLine(tool) {
 function isActionable(id) {
   return id !== "generic";
 }
+var MAX_OTHER_SERVERS_SHOWN = 4;
+function formatOtherServers(otherServers) {
+  if (otherServers.length === 0) {
+    return "";
+  }
+  const shown = otherServers.slice(0, MAX_OTHER_SERVERS_SHOWN);
+  const rest = otherServers.length - shown.length;
+  const list2 = rest > 0 ? `${shown.join(", ")}, +${rest} more` : shown.join(", ");
+  return `  \xB7 also has: ${list2}`;
+}
 function formatMcpRowLine(runtime, isSelected, status) {
   const mark = isSelected ? ">" : " ";
   const label = runtimeLabel(runtime.id).padEnd(20);
-  const statusText = runtime.connected ? "\u25CF connected" : "\u25CB not connected";
+  const statusText = runtime.connected ? "\u25CF keryx connected" : "\u25CB keryx not connected";
   let action = "";
   if (!isActionable(runtime.id)) {
     action = "  (copy snippet manually)";
@@ -55576,7 +56044,7 @@ function formatMcpRowLine(runtime, isSelected, status) {
   } else {
     action = runtime.connected ? "  [d] disconnect" : "  [c] connect";
   }
-  return `${mark} ${label} ${statusText}${action}`;
+  return `${mark} ${label} ${statusText}${action}${formatOtherServers(runtime.otherServers)}`;
 }
 function asRowTarget(body) {
   const parent = body;
@@ -55607,6 +56075,7 @@ function presentMcpTools(openModal2, otui, chrome, options) {
       return;
     }
     clearTranscriptChildren(toolsBody);
+    toolsBody.add(new rowCtor(activeRenderer, { id: "mcp-tools-header", content: TOOLS_TAB_HEADER }));
     if (options.tools.length === 0) {
       toolsBody.add(new rowCtor(activeRenderer, { id: "mcp-tools-empty", content: "No tools available." }));
       return;
@@ -55621,6 +56090,8 @@ function presentMcpTools(openModal2, otui, chrome, options) {
       return;
     }
     clearTranscriptChildren(mcpBody);
+    mcpBody.add(new rowCtor(activeRenderer, { id: "mcp-mcp-header-1", content: MCP_TAB_HEADER_1 }));
+    mcpBody.add(new rowCtor(activeRenderer, { id: "mcp-mcp-header-2", content: MCP_TAB_HEADER_2 }));
     if (runtimes.length === 0) {
       mcpBody.add(new rowCtor(activeRenderer, { id: "mcp-mcp-empty", content: "No MCP client runtimes registered." }));
       return;
@@ -55706,7 +56177,7 @@ function presentMcpTools(openModal2, otui, chrome, options) {
     title: "Tools & MCP",
     tabs: [
       { id: "tools", label: "Tools" },
-      { id: "mcp", label: "MCP" }
+      { id: "mcp", label: "MCP Clients" }
     ],
     initialTab: "tools",
     footer: MCP_INSPECTOR_FOOTER,
@@ -56148,7 +56619,7 @@ var AGENT_SLASH_COMMANDS = [
   { name: "/new", description: "Start a new session (old kept on disk)", modes: BOTH },
   {
     name: "/goal",
-    description: "Deterministically start a goal \u2014 /goal <text> [--workspace <id>]",
+    description: "Deterministically start a goal \u2014 /goal <text> [--workspace <id>] [--auto [N]]",
     modes: AGENT_ONLY
   },
   { name: "/resume", description: "Resume a prior session in this project", modes: AGENT_ONLY },
@@ -56240,7 +56711,7 @@ function commandsForMode(mode) {
   }));
 }
 function filterCommands(query, mode) {
-  const q = query.trim().toLowerCase();
+  const q = query.toLowerCase();
   if (!q.startsWith("/")) {
     return [];
   }
@@ -56598,10 +57069,10 @@ function describeElicitationPrompt(tool, inputJson) {
 // src/lib/permission-mode-config.ts
 init_permission_mode();
 init_config_dir();
-import path149 from "path";
+import path151 from "path";
 var EMPTY3 = { schemaVersion: 1, projects: {} };
 function permissionModeConfigPath(dir) {
-  return path149.join(keryxConfigDir(dir), "permission-mode.json");
+  return path151.join(keryxConfigDir(dir), "permission-mode.json");
 }
 function withRegistryLock2(dir, fn) {
   return withFileLock(`${permissionModeConfigPath(dir)}.lock`, fn, {
@@ -56950,7 +57421,7 @@ function showComposerChoice(otui, r, dock, request) {
 // src/lib/version-check.ts
 init_config_dir();
 init_fs();
-import path150 from "path";
+import path152 from "path";
 var REGISTRY_URL = "https://registry.npmjs.org/@mrciphersmith%2Fkeryx/latest";
 var FIXED_INSTALL_COMMAND = "npm install -g @mrciphersmith/keryx@latest";
 var RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
@@ -57152,7 +57623,7 @@ async function checkVersion(options) {
   const now = options.now ?? Date.now;
   const timestamp = now();
   const configDir = ensureKeryxConfigDir(options.cacheDir);
-  const cacheFile = path150.join(configDir, "version-check.json");
+  const cacheFile = path152.join(configDir, "version-check.json");
   const cache = parseCache(cacheFile);
   if (cache?.latestVersion !== undefined && cache.successAt !== undefined && timestamp - cache.successAt >= 0 && timestamp - cache.successAt < SUCCESS_CACHE_TTL_MS) {
     return resultFor(options.currentVersion, current, cache.latestVersion, "cache");
@@ -57270,7 +57741,7 @@ function wrappedLineCount(text, width) {
   return total;
 }
 function prefixFilter(commands, query) {
-  const q = query.trim().toLowerCase();
+  const q = query.toLowerCase();
   if (!q.startsWith("/")) {
     return [];
   }
@@ -57688,6 +58159,17 @@ async function createShellChrome(otui, renderer, opts) {
       key.stopPropagation();
       return;
     }
+    if (key.name === "tab") {
+      const opt = menu.getSelectedOption();
+      if (opt !== null) {
+        input2.value = `${opt.name} `;
+      }
+      hideMenu();
+      input2.focus();
+      key.preventDefault();
+      key.stopPropagation();
+      return;
+    }
     if (key.name === "backspace") {
       input2.value = input2.value.slice(0, -1);
       refilter();
@@ -65193,9 +65675,9 @@ Shell:
 
 // src/commands/modules.ts
 init_fs();
-import { readFile as readFile78 } from "fs/promises";
+import { readFile as readFile79 } from "fs/promises";
 import { stdin } from "process";
-import path151 from "path";
+import path153 from "path";
 var MODULES = [
   { name: "gdgraph", flag: "--no-gdgraph", desc: "code graph, symbols, affected context", defaultEnabled: true },
   { name: "gdctx", flag: "--no-gdctx", desc: "token-aware command/read output", defaultEnabled: true },
@@ -65241,8 +65723,8 @@ async function modulesCommand(args2 = []) {
     return;
   }
   const wantsJson = args2.includes("--json") && (sub === undefined || sub === "status" || sub === "list" || sub === "--json");
-  const metaprojectRoot = path151.join(process.cwd(), ".metaproject");
-  const manifestPath = path151.join(metaprojectRoot, "metaproject.json");
+  const metaprojectRoot = path153.join(process.cwd(), ".metaproject");
+  const manifestPath = path153.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     if (wantsJson) {
       console.log(JSON.stringify({ schemaVersion: 1, error: "not-initialized", modules: [] }, null, 2));
@@ -65255,7 +65737,7 @@ async function modulesCommand(args2 = []) {
   }
   let manifest = {};
   try {
-    manifest = JSON.parse(await readFile78(manifestPath, "utf8"));
+    manifest = JSON.parse(await readFile79(manifestPath, "utf8"));
   } catch {}
   const enabled = new Set(MODULES.filter((module) => manifest.modules?.[module.name]?.enabled === true).map((module) => module.name));
   if (wantsJson) {
@@ -65361,13 +65843,13 @@ import { randomUUID as randomUUID29 } from "crypto";
 // src/lib/serve-config.ts
 init_config_dir();
 import { existsSync as existsSync27 } from "fs";
-import path152 from "path";
+import path154 from "path";
 var SERVE_CONFIG_SCHEMA_VERSION = "1.0.0";
 var DEFAULT_SERVE_BIND_ADDRESS = "127.0.0.1";
 var DEFAULT_SERVE_PORT = 7377;
 var DEFAULT_SERVE_PROFILE = "remote-restricted";
 function serveConfigPath(dir) {
-  return path152.join(keryxConfigDir(dir), "serve.json");
+  return path154.join(keryxConfigDir(dir), "serve.json");
 }
 function parseIpv4(value) {
   const parts = value.split(".");
@@ -65695,9 +66177,9 @@ import {
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync8
 } from "fs";
-import path153 from "path";
+import path155 from "path";
 function serveCredentialPath(dir) {
-  return path153.join(keryxConfigDir(dir), "serve-credentials.json");
+  return path155.join(keryxConfigDir(dir), "serve-credentials.json");
 }
 function constantTimeEqual(a, b) {
   const width = Math.max(a.length, b.length);
@@ -65931,22 +66413,22 @@ class AuthFailureThrottle {
 init_config_dir();
 import { createHash as createHash34 } from "crypto";
 import { existsSync as existsSync29, readdirSync as readdirSync2, rmSync as rmSync2 } from "fs";
-import path154 from "path";
+import path156 from "path";
 var MAX_TURN_EVENTS = 1e4;
 function turnsRoot(dir) {
-  return path154.join(keryxConfigDir(dir), "turns");
+  return path156.join(keryxConfigDir(dir), "turns");
 }
 function turnDir(turnId, dir) {
-  return path154.join(turnsRoot(dir), turnId);
+  return path156.join(turnsRoot(dir), turnId);
 }
 function keyPath(project, idempotencyKey, dir) {
   const projectBytes = Buffer.byteLength(project, "utf8");
   const digest2 = createHash34("sha256").update(`${projectBytes}:${project}\x00${idempotencyKey}`, "utf8").digest("hex");
-  return path154.join(turnsRoot(dir), "keys", `${digest2}.json`);
+  return path156.join(turnsRoot(dir), "keys", `${digest2}.json`);
 }
 function legacyKeyPath(idempotencyKey, dir) {
   const digest2 = createHash34("sha256").update(idempotencyKey, "utf8").digest("hex");
-  return path154.join(turnsRoot(dir), "keys", `${digest2}.json`);
+  return path156.join(turnsRoot(dir), "keys", `${digest2}.json`);
 }
 function adoptLegacyClaim(project, idempotencyKey, dir) {
   const legacy = legacyKeyPath(idempotencyKey, dir);
@@ -66010,7 +66492,7 @@ function ensureTurnDir(turnId, dir) {
 }
 function createTurnRecord(record, dir) {
   ensureTurnDir(record.turnId, dir);
-  writeOwnerOnlyFile(path154.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
+  writeOwnerOnlyFile(path156.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
 `);
 }
 function appendTurnEvent(event, dir, opts) {
@@ -66019,12 +66501,12 @@ function appendTurnEvent(event, dir, opts) {
   }
   const line = JSON.stringify(event);
   try {
-    appendOwnerOnlyLine(path154.join(turnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path156.join(turnDir(event.turnId, dir), "events.jsonl"), line);
   } catch (error2) {
     if (error2?.code !== "ENOENT") {
       throw error2;
     }
-    appendOwnerOnlyLine(path154.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path156.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
   }
   return true;
 }
@@ -66032,7 +66514,7 @@ function readTurnEvents(turnId, after = -1, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path154.join(turnDir(turnId, dir), "events.jsonl"));
+  const read = readTurnFile(path156.join(turnDir(turnId, dir), "events.jsonl"));
   if (!read.ok) {
     if (isDefiniteAbsence2(read.reason)) {
       return { ok: true, value: [] };
@@ -66060,7 +66542,7 @@ function readTurnRecord(turnId, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path154.join(turnDir(turnId, dir), "turn.json"));
+  const read = readTurnFile(path156.join(turnDir(turnId, dir), "turn.json"));
   if (!read.ok) {
     return { ok: false, reason: read.reason };
   }
@@ -66079,7 +66561,7 @@ function finishTurn(turnId, result, dir) {
   if (!record.ok) {
     return false;
   }
-  writeOwnerOnlyFile(path154.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
+  writeOwnerOnlyFile(path156.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
 `);
   return true;
 }
@@ -66125,7 +66607,7 @@ function releaseIdempotencyKey(project, idempotencyKey, turnId, dir) {
 
 // src/lib/serve-turn.ts
 import { randomUUID as randomUUID28 } from "crypto";
-import path155 from "path";
+import path157 from "path";
 init_service();
 var REMOTE_ORIGIN = "remote:http";
 var MAX_PROMPT_CHARS = 32000;
@@ -66194,9 +66676,9 @@ function isUuid(value) {
   return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value);
 }
 function resolveProject(declared, dir) {
-  const wanted = path155.resolve(declared);
+  const wanted = path157.resolve(declared);
   for (const entry of listProjects(dir, () => {})) {
-    if (path155.resolve(entry.path) === wanted) {
+    if (path157.resolve(entry.path) === wanted) {
       return { ok: true, project: entry.path };
     }
   }
@@ -67229,9 +67711,9 @@ function printHelp17() {
 
 // src/commands/update.ts
 import { spawn as spawn5 } from "child_process";
-import { chmod as chmod4, mkdir as mkdir55, readFile as readFile79, readdir as readdir26, writeFile as writeFile49 } from "fs/promises";
+import { chmod as chmod4, mkdir as mkdir56, readFile as readFile80, readdir as readdir27, writeFile as writeFile49 } from "fs/promises";
 import { access as access4, constants as constants2, existsSync as existsSync30 } from "fs";
-import path156 from "path";
+import path158 from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 init_config();
 init_config2();
@@ -67247,8 +67729,8 @@ async function updateCommand(args2 = []) {
     return;
   }
   const projectRoot = process.cwd();
-  const metaprojectRoot = path156.join(projectRoot, ".metaproject");
-  banner("keryx update", `Refreshing the .metaproject workspace in ${path156.basename(projectRoot)}/`);
+  const metaprojectRoot = path158.join(projectRoot, ".metaproject");
+  banner("keryx update", `Refreshing the .metaproject workspace in ${path158.basename(projectRoot)}/`);
   if (!await pathExists(metaprojectRoot)) {
     console.log(`  ${style.red(symbols.cross)} Metaproject is not initialized.`);
     console.log(`  ${style.cyan(symbols.arrow)} Run ${style.cyan("keryx init")} first.`);
@@ -67294,12 +67776,12 @@ async function updateCommand(args2 = []) {
   nextSteps(steps);
 }
 async function refreshServiceFiles(projectRoot, options) {
-  const metaprojectRoot = path156.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path158.join(projectRoot, ".metaproject");
   const manifestState = await readManifest5(metaprojectRoot);
   const manifest = manifestState.manifest;
   const recoveredManifest = !manifestState.exists || !manifestState.valid;
   if (manifestState.migrated) {
-    await writeFile49(path156.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+    await writeFile49(path158.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   }
   const enableGdgraph = moduleEnabled2(manifest, "gdgraph");
@@ -67336,11 +67818,11 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     enableSac
   });
-  await writeTextIfChanged4(path156.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
-  await writeTextIfChanged4(path156.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
-  await writeTextIfChanged4(path156.join(metaprojectRoot, "rules", "README.md"), renderProjectRulesReadme());
-  await writeTextIfChanged4(path156.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
-  await writeTextIfChanged4(path156.join(metaprojectRoot, "index.md"), renderIndexMarkdown({
+  await writeTextIfChanged4(path158.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
+  await writeTextIfChanged4(path158.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
+  await writeTextIfChanged4(path158.join(metaprojectRoot, "rules", "README.md"), renderProjectRulesReadme());
+  await writeTextIfChanged4(path158.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
+  await writeTextIfChanged4(path158.join(metaprojectRoot, "index.md"), renderIndexMarkdown({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -67353,7 +67835,7 @@ async function refreshServiceFiles(projectRoot, options) {
     ruleSources,
     hasDistilledEntrypoints: await hasDistilledEntrypoints(metaprojectRoot)
   }));
-  await writeTextIfChanged4(path156.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
+  await writeTextIfChanged4(path158.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -67365,7 +67847,7 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     data: dashboardData
   }));
-  await writeTextIfMissing4(path156.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
+  await writeTextIfMissing4(path158.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -67378,31 +67860,31 @@ async function refreshServiceFiles(projectRoot, options) {
   }));
   if (enableGdgraph) {
     await installGdgraphCoreScripts2(metaprojectRoot);
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
     await seedAssetsLock(metaprojectRoot);
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdgraph-post-commit", renderGdgraphPostCommitHook());
     }
   }
   if (enableGdctx) {
-    await writeTextIfMissing4(path156.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
+    await writeTextIfMissing4(path158.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
   }
   if (enableGdwiki) {
-    await writeTextIfMissing4(path156.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
+    await writeTextIfMissing4(path158.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdwiki-post-commit", renderGdwikiPostCommitHook());
     }
   }
   if (enableSac) {
-    await writeTextIfMissing4(path156.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
+    await writeTextIfMissing4(path158.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
   }
   if (enableGdskills) {
     await installGdskills(metaprojectRoot, gdskillsProfile, { createDataDirs: false });
@@ -67411,25 +67893,25 @@ async function refreshServiceFiles(projectRoot, options) {
     }
   }
   if (enableHealth) {
-    await writeTextIfMissing4(path156.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
+    await writeTextIfMissing4(path158.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
     if (manifest.modules?.health?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "health-post-commit", renderHealthPostCommitHook());
     }
   }
   if (enableTesting) {
-    await writeTextIfMissing4(path156.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
+    await writeTextIfMissing4(path158.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
       postCommitRefresh: Boolean(manifest.modules?.testing?.hooks?.gitPostCommit),
       prePushGate: Boolean(manifest.modules?.testing?.hooks?.prePush)
     }));
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
     if (enableGdwiki) {
-      await writeTextIfMissing4(path156.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
-      await writeTextIfMissing4(path156.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
+      await writeTextIfMissing4(path158.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
+      await writeTextIfMissing4(path158.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
     }
     if (manifest.modules?.testing?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "testing-post-commit", renderTestingPostCommitHook());
@@ -67442,24 +67924,24 @@ async function refreshServiceFiles(projectRoot, options) {
     await installManagedHook2(projectRoot, "post-commit", "metaproject-dashboard-post-commit", renderMetaprojectDashboardPostCommitHook());
   }
   if (enableMemory) {
-    await writeTextIfMissing4(path156.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
-    await writeTextIfMissing4(path156.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
+    await writeTextIfMissing4(path158.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
+    await writeTextIfMissing4(path158.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
   }
   if (enableTasks) {
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
   }
   if (enableSecurity) {
-    await writeTextIfMissing4(path156.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
-    await writeTextIfChanged4(path156.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
+    await writeTextIfMissing4(path158.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
+    await writeTextIfChanged4(path158.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
     if (manifest.modules?.security?.hooks?.prePush) {
       await installManagedHook2(projectRoot, "pre-push", "security-pre-push", renderSecurityPrePushHook());
     }
@@ -67510,13 +67992,13 @@ async function refreshServiceFiles(projectRoot, options) {
   };
 }
 async function buildDashboard(projectRoot = process.cwd()) {
-  const metaprojectRoot = path156.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path158.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
   const manifest = (await readManifest5(metaprojectRoot)).manifest;
   const data = await collectDashboardData(metaprojectRoot);
-  const dashboardPath = path156.join(metaprojectRoot, "keryx-dashboard.html");
+  const dashboardPath = path158.join(metaprojectRoot, "keryx-dashboard.html");
   await writeTextIfChanged4(dashboardPath, renderMetaprojectDashboardHtml({
     enableGdgraph: moduleEnabled2(manifest, "gdgraph"),
     enableGdctx: moduleEnabled2(manifest, "gdctx"),
@@ -67536,11 +68018,11 @@ async function shouldInstallDashboardPostCommitHook(projectRoot, manifest) {
   if (Object.values(modules).some((module) => Boolean(module.hooks?.gitPostCommit))) {
     return true;
   }
-  const hookPath = path156.join(projectRoot, ".git", "hooks", "post-commit");
+  const hookPath = path158.join(projectRoot, ".git", "hooks", "post-commit");
   if (!await pathExists(hookPath)) {
     return false;
   }
-  return (await readFile79(hookPath, "utf8")).includes("# keryx:");
+  return (await readFile80(hookPath, "utf8")).includes("# keryx:");
 }
 async function collectDashboardData(metaprojectRoot) {
   const data = {};
@@ -67556,11 +68038,11 @@ async function collectDashboardData(metaprojectRoot) {
   if (testing) {
     data.testing = testing;
   }
-  const wiki = await collectMarkdownPages(path156.join(metaprojectRoot, "wiki"), "wiki");
+  const wiki = await collectMarkdownPages(path158.join(metaprojectRoot, "wiki"), "wiki");
   if (wiki.length > 0) {
     data.wiki = { pages: wiki };
   }
-  const memory = await collectMarkdownPages(path156.join(metaprojectRoot, "memory"), "memory");
+  const memory = await collectMarkdownPages(path158.join(metaprojectRoot, "memory"), "memory");
   if (memory.length > 0) {
     data.memory = { entries: memory };
   }
@@ -67575,29 +68057,29 @@ async function collectDashboardData(metaprojectRoot) {
   return data;
 }
 async function collectTasksDashboardData(metaprojectRoot) {
-  const flowsRoot2 = path156.join(metaprojectRoot, "flows");
+  const flowsRoot2 = path158.join(metaprojectRoot, "flows");
   if (!await pathExists(flowsRoot2)) {
     return null;
   }
   let dirEntries;
   try {
-    dirEntries = (await readdir26(flowsRoot2, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^\d{3}-/.test(entry.name)).map((entry) => entry.name).sort();
+    dirEntries = (await readdir27(flowsRoot2, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^\d{3}-/.test(entry.name)).map((entry) => entry.name).sort();
   } catch {
     return null;
   }
   const flows = [];
   for (const dir of dirEntries) {
-    const flowPath = path156.join(flowsRoot2, dir, "flow.json");
+    const flowPath = path158.join(flowsRoot2, dir, "flow.json");
     if (!await pathExists(flowPath)) {
       continue;
     }
     try {
-      const flow = JSON.parse(await readFile79(flowPath, "utf8"));
+      const flow = JSON.parse(await readFile80(flowPath, "utf8"));
       const tasks = Array.isArray(flow.tasks) ? flow.tasks : [];
       let acTotal = 0;
-      const acPath2 = path156.join(flowsRoot2, dir, "acceptance-criteria.md");
+      const acPath2 = path158.join(flowsRoot2, dir, "acceptance-criteria.md");
       if (await pathExists(acPath2)) {
-        const acContent = await readFile79(acPath2, "utf8");
+        const acContent = await readFile80(acPath2, "utf8");
         acTotal = (acContent.match(/^- AC\d+:/gm) ?? []).length;
       }
       flows.push({
@@ -67649,11 +68131,11 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
     "data/testing/context.md"
   ];
   for (const href of staticHrefs) {
-    const filePath = path156.join(metaprojectRoot, ...href.split("/"));
+    const filePath = path158.join(metaprojectRoot, ...href.split("/"));
     if (!await pathExists(filePath)) {
       continue;
     }
-    const content = await readFile79(filePath, "utf8");
+    const content = await readFile80(filePath, "utf8");
     docs[href] = content.length > 40000 ? `${content.slice(0, 40000)}
 
 \u2026truncated\u2026` : content;
@@ -67666,11 +68148,11 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
   return docs;
 }
 async function collectHealthDashboardData(metaprojectRoot) {
-  const reportPath2 = path156.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
+  const reportPath2 = path158.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
   if (!await pathExists(reportPath2)) {
     return;
   }
-  const report = JSON.parse(await readFile79(reportPath2, "utf8"));
+  const report = JSON.parse(await readFile80(reportPath2, "utf8"));
   const metrics = Array.isArray(report.metrics) ? report.metrics : [];
   const findings = Array.isArray(report.findings) ? report.findings : [];
   const project = metrics.find((metric) => metric.key === "project") ?? {};
@@ -67775,8 +68257,8 @@ function metricToScope(metric) {
   };
 }
 async function collectGraphDashboardData(metaprojectRoot) {
-  const nodesPath = path156.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
-  const edgesPath = path156.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
+  const nodesPath = path158.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
+  const edgesPath = path158.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
   if (!await pathExists(nodesPath) || !await pathExists(edgesPath)) {
     return;
   }
@@ -67784,7 +68266,7 @@ async function collectGraphDashboardData(metaprojectRoot) {
   let nodes = 0;
   let files = 0;
   let assets = 0;
-  for (const node of parseJsonl2(await readFile79(nodesPath, "utf8"))) {
+  for (const node of parseJsonl2(await readFile80(nodesPath, "utf8"))) {
     nodes += 1;
     if (node.kind === "asset") {
       assets += 1;
@@ -67800,7 +68282,7 @@ async function collectGraphDashboardData(metaprojectRoot) {
   let imports = 0;
   let assetEdges = 0;
   let unresolved = 0;
-  for (const edge of parseJsonl2(await readFile79(edgesPath, "utf8"))) {
+  for (const edge of parseJsonl2(await readFile80(edgesPath, "utf8"))) {
     edges += 1;
     if (edge.kind === "imports") {
       imports += 1;
@@ -67827,10 +68309,10 @@ async function collectGraphDashboardData(metaprojectRoot) {
   };
 }
 async function collectTestingDashboardData(metaprojectRoot) {
-  const reportPath2 = path156.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
-  const contextPath = path156.join(metaprojectRoot, "data", "testing", "context.md");
+  const reportPath2 = path158.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
+  const contextPath = path158.join(metaprojectRoot, "data", "testing", "context.md");
   if (await pathExists(reportPath2)) {
-    const report = JSON.parse(await readFile79(reportPath2, "utf8"));
+    const report = JSON.parse(await readFile80(reportPath2, "utf8"));
     const totalTests = numberOrUndefined(report.total);
     const failedTests = Array.isArray(report.failures) ? report.failures.length : numberOrUndefined(report.failed);
     return {
@@ -67857,11 +68339,11 @@ async function collectMarkdownPages(root, hrefPrefix) {
   const files = await listMarkdownFiles(root);
   const pages = [];
   for (const filePath of files.slice(0, 40)) {
-    const relativePath = path156.relative(root, filePath).split(path156.sep).join("/");
+    const relativePath = path158.relative(root, filePath).split(path158.sep).join("/");
     if (relativePath === "index.md" || relativePath.startsWith("templates/")) {
       continue;
     }
-    const content = await readFile79(filePath, "utf8");
+    const content = await readFile80(filePath, "utf8");
     const embedded = content.length > 24000 ? `${content.slice(0, 24000)}
 
 \u2026truncated\u2026` : content;
@@ -67875,10 +68357,10 @@ async function collectMarkdownPages(root, hrefPrefix) {
   return pages;
 }
 async function listMarkdownFiles(root) {
-  const entries = await readdir26(root, { withFileTypes: true });
+  const entries = await readdir27(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const fullPath = path156.join(root, entry.name);
+    const fullPath = path158.join(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listMarkdownFiles(fullPath));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -67926,7 +68408,7 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
   const manifest = {
     schemaVersion: 1,
     standardVersion: STANDARD_VERSION,
-    name: `${path156.basename(path156.dirname(metaprojectRoot))}-metaproject`,
+    name: `${path158.basename(path158.dirname(metaprojectRoot))}-metaproject`,
     createdBy: "keryx",
     profiles: computeProfiles(enabledModuleKeys2),
     paths: {
@@ -68027,17 +68509,17 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
       metaproject: ".metaproject/index.md"
     }
   };
-  await writeFile49(path156.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+  await writeFile49(path158.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
 }
 async function enableTasksInManifest(metaprojectRoot) {
-  const manifestPath = path156.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path158.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
   let raw;
   try {
-    raw = JSON.parse(await readFile79(manifestPath, "utf8"));
+    raw = JSON.parse(await readFile80(manifestPath, "utf8"));
   } catch {
     return;
   }
@@ -68054,13 +68536,13 @@ async function enableTasksInManifest(metaprojectRoot) {
 `, "utf8");
 }
 async function updateManifestAgentEntrypoints(metaprojectRoot, ruleSources) {
-  const manifestPath = path156.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path158.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
   let raw;
   try {
-    raw = JSON.parse(await readFile79(manifestPath, "utf8"));
+    raw = JSON.parse(await readFile80(manifestPath, "utf8"));
   } catch {
     return;
   }
@@ -68090,86 +68572,86 @@ async function updateRuntime(projectRoot) {
   }
 }
 async function findRuntimeRoot(projectRoot) {
-  const projectRuntime = path156.join(projectRoot, ".metaproject", "runtime", "keryx");
-  if (await pathExists(path156.join(projectRuntime, ".git"))) {
+  const projectRuntime = path158.join(projectRoot, ".metaproject", "runtime", "keryx");
+  if (await pathExists(path158.join(projectRuntime, ".git"))) {
     return projectRuntime;
   }
   const home = process.env.HOME;
   if (!home) {
     return null;
   }
-  const globalRuntime = path156.join(home, ".keryx", "keryx");
-  if (await pathExists(path156.join(globalRuntime, ".git"))) {
+  const globalRuntime = path158.join(home, ".keryx", "keryx");
+  if (await pathExists(path158.join(globalRuntime, ".git"))) {
     return globalRuntime;
   }
   return null;
 }
 async function createServiceDirs(metaprojectRoot, modules) {
   const dirs = [
-    path156.join(metaprojectRoot, "core"),
-    path156.join(metaprojectRoot, "hooks", "post-update.d"),
-    path156.join(metaprojectRoot, "modules"),
-    path156.join(metaprojectRoot, "rules"),
-    path156.join(metaprojectRoot, "skills", "project-rules"),
+    path158.join(metaprojectRoot, "core"),
+    path158.join(metaprojectRoot, "hooks", "post-update.d"),
+    path158.join(metaprojectRoot, "modules"),
+    path158.join(metaprojectRoot, "rules"),
+    path158.join(metaprojectRoot, "skills", "project-rules"),
     ...modules.enableGdgraph ? [
-      path156.join(metaprojectRoot, "core", "gdgraph"),
-      path156.join(metaprojectRoot, "skills", "gdgraph")
+      path158.join(metaprojectRoot, "core", "gdgraph"),
+      path158.join(metaprojectRoot, "skills", "gdgraph")
     ] : [],
     ...modules.enableGdctx ? [
-      path156.join(metaprojectRoot, "core", "gdctx"),
-      path156.join(metaprojectRoot, "skills", "gdctx")
+      path158.join(metaprojectRoot, "core", "gdctx"),
+      path158.join(metaprojectRoot, "skills", "gdctx")
     ] : [],
     ...modules.enableGdwiki ? [
-      path156.join(metaprojectRoot, "skills", "gdwiki"),
-      path156.join(metaprojectRoot, "wiki", "templates")
+      path158.join(metaprojectRoot, "skills", "gdwiki"),
+      path158.join(metaprojectRoot, "wiki", "templates")
     ] : [],
     ...modules.enableHealth ? [
-      path156.join(metaprojectRoot, "core", "health"),
-      path156.join(metaprojectRoot, "skills", "health")
+      path158.join(metaprojectRoot, "core", "health"),
+      path158.join(metaprojectRoot, "skills", "health")
     ] : [],
     ...modules.enableTesting ? [
-      path156.join(metaprojectRoot, "core", "testing"),
-      path156.join(metaprojectRoot, "skills", "testing")
+      path158.join(metaprojectRoot, "core", "testing"),
+      path158.join(metaprojectRoot, "skills", "testing")
     ] : [],
     ...modules.enableMemory ? [
-      path156.join(metaprojectRoot, "core", "memory"),
-      path156.join(metaprojectRoot, "skills", "memory"),
-      path156.join(metaprojectRoot, "memory", "templates")
+      path158.join(metaprojectRoot, "core", "memory"),
+      path158.join(metaprojectRoot, "skills", "memory"),
+      path158.join(metaprojectRoot, "memory", "templates")
     ] : [],
     ...modules.enableTasks ? [
-      path156.join(metaprojectRoot, "flows"),
-      path156.join(metaprojectRoot, "skills", "flow")
+      path158.join(metaprojectRoot, "flows"),
+      path158.join(metaprojectRoot, "skills", "flow")
     ] : [],
     ...modules.enableSecurity ? [
-      path156.join(metaprojectRoot, "core", "security")
+      path158.join(metaprojectRoot, "core", "security")
     ] : [],
     ...modules.enableSac ? [
-      path156.join(metaprojectRoot, "skills", "sac")
+      path158.join(metaprojectRoot, "skills", "sac")
     ] : []
   ];
-  await Promise.all(dirs.map((dir) => mkdir55(dir, { recursive: true })));
+  await Promise.all(dirs.map((dir) => mkdir56(dir, { recursive: true })));
 }
 async function installGdgraphCoreScripts2(metaprojectRoot) {
-  const gdgraphCoreRoot = path156.join(metaprojectRoot, "core", "gdgraph");
-  await mkdir55(gdgraphCoreRoot, { recursive: true });
+  const gdgraphCoreRoot = path158.join(metaprojectRoot, "core", "gdgraph");
+  await mkdir56(gdgraphCoreRoot, { recursive: true });
   for (const file of GDGRAPH_CORE_SOURCES) {
-    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path156.join(gdgraphCoreRoot, file));
+    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path158.join(gdgraphCoreRoot, file));
   }
-  await writeTextIfChanged4(path156.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
+  await writeTextIfChanged4(path158.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
 }
 async function installManagedHook2(projectRoot, hookName, blockId, content) {
   const hooksRoot = await resolveGitHooksRoot(projectRoot);
   if (!hooksRoot) {
     return;
   }
-  await mkdir55(hooksRoot, { recursive: true });
-  const hookPath = path156.join(hooksRoot, hookName);
+  await mkdir56(hooksRoot, { recursive: true });
+  const hookPath = path158.join(hooksRoot, hookName);
   const blockStart = `# keryx:${blockId}:begin`;
   const blockEnd = `# keryx:${blockId}:end`;
   const managedBlock = `${blockStart}
 ${content.trim()}
 ${blockEnd}`;
-  const existing = await pathExists(hookPath) ? await readFile79(hookPath, "utf8") : `#!/usr/bin/env sh
+  const existing = await pathExists(hookPath) ? await readFile80(hookPath, "utf8") : `#!/usr/bin/env sh
 `;
   const blockPattern = new RegExp(`${escapeRegExp6(blockStart)}[\\s\\S]*?${escapeRegExp6(blockEnd)}`);
   const next = blockPattern.test(existing) ? existing.replace(blockPattern, managedBlock) : `${existing.trimEnd()}
@@ -68184,11 +68666,11 @@ async function removeManagedHook2(projectRoot, hookName, blockId) {
   if (!hooksRoot) {
     return;
   }
-  const hookPath = path156.join(hooksRoot, hookName);
+  const hookPath = path158.join(hooksRoot, hookName);
   if (!await pathExists(hookPath)) {
     return;
   }
-  const existing = await readFile79(hookPath, "utf8");
+  const existing = await readFile80(hookPath, "utf8");
   const blockStart = `# keryx:${blockId}:begin`;
   const blockEnd = `# keryx:${blockId}:end`;
   const blockPattern = new RegExp(`\\n*${escapeRegExp6(blockStart)}[\\s\\S]*?${escapeRegExp6(blockEnd)}\\n*`);
@@ -68206,11 +68688,11 @@ async function prePushHasSecurityBlock2(projectRoot) {
   if (!hooksRoot) {
     return false;
   }
-  const hookPath = path156.join(hooksRoot, "pre-push");
+  const hookPath = path158.join(hooksRoot, "pre-push");
   if (!await pathExists(hookPath)) {
     return false;
   }
-  const hook = await readFile79(hookPath, "utf8");
+  const hook = await readFile80(hookPath, "utf8");
   return hook.includes("# keryx:security-pre-push:begin");
 }
 async function agentSettingsHasSecuritySentinel2(projectRoot) {
@@ -68218,10 +68700,10 @@ async function agentSettingsHasSecuritySentinel2(projectRoot) {
   if (!await pathExists(file)) {
     return false;
   }
-  return (await readFile79(file, "utf8")).includes(AGENT_HOOKS_SENTINEL);
+  return (await readFile80(file, "utf8")).includes(AGENT_HOOKS_SENTINEL);
 }
 async function readManifest5(metaprojectRoot) {
-  const manifestPath = path156.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path158.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return {
       exists: false,
@@ -68231,7 +68713,7 @@ async function readManifest5(metaprojectRoot) {
     };
   }
   try {
-    const manifest = JSON.parse(await readFile79(manifestPath, "utf8"));
+    const manifest = JSON.parse(await readFile80(manifestPath, "utf8"));
     const normalized = normalizeManifest(manifest);
     return {
       exists: true,
@@ -68290,7 +68772,7 @@ async function inferManifestFromExistingMetaproject(metaprojectRoot) {
 }
 async function anyPathExists(root, candidates) {
   for (const candidate of candidates) {
-    if (await pathExists(path156.join(root, candidate))) {
+    if (await pathExists(path158.join(root, candidate))) {
       return true;
     }
   }
@@ -68311,13 +68793,13 @@ function parseUpdateArgs(args2) {
   };
 }
 async function runPostUpdateHooks(projectRoot) {
-  const hooksDir = path156.join(projectRoot, ".metaproject", "hooks", "post-update.d");
+  const hooksDir = path158.join(projectRoot, ".metaproject", "hooks", "post-update.d");
   if (!await pathExists(hooksDir)) {
     return;
   }
-  const entries = (await readdir26(hooksDir)).sort();
+  const entries = (await readdir27(hooksDir)).sort();
   for (const entry of entries) {
-    const hookPath = path156.join(hooksDir, entry);
+    const hookPath = path158.join(hooksDir, entry);
     try {
       await accessExecutable(hookPath);
     } catch {
@@ -68355,25 +68837,25 @@ async function run(command, args2, cwd) {
   });
 }
 async function writeTextIfChanged4(filePath, content) {
-  if (await pathExists(filePath) && await readFile79(filePath, "utf8") === content) {
+  if (await pathExists(filePath) && await readFile80(filePath, "utf8") === content) {
     return;
   }
-  await mkdir55(path156.dirname(filePath), { recursive: true });
+  await mkdir56(path158.dirname(filePath), { recursive: true });
   await writeFile49(filePath, content, "utf8");
 }
 async function writeTextIfMissing4(filePath, content) {
   if (await pathExists(filePath)) {
     return;
   }
-  await mkdir55(path156.dirname(filePath), { recursive: true });
+  await mkdir56(path158.dirname(filePath), { recursive: true });
   await writeFile49(filePath, content, "utf8");
 }
 async function copyFileIfChanged2(from, to) {
-  const next = await readFile79(from, "utf8");
-  if (await pathExists(to) && await readFile79(to, "utf8") === next) {
+  const next = await readFile80(from, "utf8");
+  if (await pathExists(to) && await readFile80(to, "utf8") === next) {
     return;
   }
-  await mkdir55(path156.dirname(to), { recursive: true });
+  await mkdir56(path158.dirname(to), { recursive: true });
   await writeFile49(to, next, "utf8");
 }
 function runtimeSourcePath2(relativePath) {
@@ -68382,7 +68864,7 @@ function runtimeSourcePath2(relativePath) {
     return directPath;
   }
   if (relativePath.startsWith("../")) {
-    const packagedSourcePath = path156.join(path156.dirname(fileURLToPath7(import.meta.url)), "..", "src", relativePath.slice(3));
+    const packagedSourcePath = path158.join(path158.dirname(fileURLToPath7(import.meta.url)), "..", "src", relativePath.slice(3));
     if (existsSync30(packagedSourcePath)) {
       return packagedSourcePath;
     }
@@ -68414,7 +68896,7 @@ function printHelp18() {
 
 // src/commands/dashboard.ts
 import { spawn as spawn6 } from "child_process";
-import path157 from "path";
+import path159 from "path";
 init_args();
 async function dashboardCommand(args2 = []) {
   const options = parseOptions(args2);
@@ -68425,7 +68907,7 @@ async function dashboardCommand(args2 = []) {
   }
   if (subcommand === "build") {
     const result = await buildDashboard();
-    const rel = path157.relative(process.cwd(), result.path);
+    const rel = path159.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Dashboard built ${style.cyan(symbols.arrow)} ${style.cyan(rel)}`);
     note(`Open it: keryx dashboard open`);
     return;
@@ -68433,7 +68915,7 @@ async function dashboardCommand(args2 = []) {
   if (subcommand === "open") {
     const result = await buildDashboard();
     await openFile(result.path);
-    const rel = path157.relative(process.cwd(), result.path);
+    const rel = path159.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Opened ${style.cyan(rel)}`);
     return;
   }
@@ -68480,9 +68962,9 @@ function printHelp19() {
 import { readFileSync as readFileSync10 } from "fs";
 
 // src/agents/bootstrap.ts
-import { mkdir as mkdir56, readFile as readFile80, writeFile as writeFile50 } from "fs/promises";
+import { mkdir as mkdir57, readFile as readFile81, writeFile as writeFile50 } from "fs/promises";
 import { homedir as homedir7 } from "os";
-import path158 from "path";
+import path160 from "path";
 init_fs();
 var AGENT_BOOTSTRAP_START = "<!-- keryx:global-bootstrap -->";
 var AGENT_BOOTSTRAP_END = "<!-- /keryx:global-bootstrap -->";
@@ -68492,35 +68974,35 @@ var AGENT_BOOTSTRAP_RUNTIMES = [
     aliases: ["claude-code"],
     label: "Claude Code",
     fileName: "CLAUDE.md",
-    filePath: (homeRoot) => path158.join(homeRoot, ".claude", "CLAUDE.md")
+    filePath: (homeRoot) => path160.join(homeRoot, ".claude", "CLAUDE.md")
   },
   {
     id: "opencode",
     aliases: ["open-code"],
     label: "OpenCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path158.join(homeRoot, ".config", "opencode", "AGENTS.md")
+    filePath: (homeRoot) => path160.join(homeRoot, ".config", "opencode", "AGENTS.md")
   },
   {
     id: "zcode",
     aliases: ["zed", "zed-code"],
     label: "ZCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path158.join(homeRoot, ".zcode", "AGENTS.md")
+    filePath: (homeRoot) => path160.join(homeRoot, ".zcode", "AGENTS.md")
   },
   {
     id: "codex",
     aliases: [],
     label: "Codex",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path158.join(homeRoot, ".codex", "AGENTS.md")
+    filePath: (homeRoot) => path160.join(homeRoot, ".codex", "AGENTS.md")
   },
   {
     id: "antigravity",
     aliases: ["antigravuty", "antigravity-code"],
     label: "Antigravity",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path158.join(homeRoot, ".config", "antigravity", "AGENTS.md")
+    filePath: (homeRoot) => path160.join(homeRoot, ".config", "antigravity", "AGENTS.md")
   }
 ];
 function agentBootstrapRuntimeIds() {
@@ -68553,7 +69035,7 @@ function resolveAgentBootstrapRuntimes(ids) {
 async function agentBootstrapStatus(runtime, homeRoot = homedir7()) {
   const filePath = runtime.filePath(homeRoot);
   const exists2 = await pathExists(filePath);
-  const content = exists2 ? await readFile80(filePath, "utf8") : "";
+  const content = exists2 ? await readFile81(filePath, "utf8") : "";
   const expected = renderAgentBootstrapBlock(runtime.fileName).trim();
   const installed = content.includes(AGENT_BOOTSTRAP_START);
   const current = installed && extractManagedBlock(content)?.trim() === expected;
@@ -68563,12 +69045,12 @@ async function installAgentBootstrap(runtime, options = {}) {
   const homeRoot = options.homeRoot ?? homedir7();
   const filePath = runtime.filePath(homeRoot);
   const exists2 = await pathExists(filePath);
-  const current = exists2 ? await readFile80(filePath, "utf8") : "";
+  const current = exists2 ? await readFile81(filePath, "utf8") : "";
   const next = upsertManagedBlock(current || defaultAgentFile(runtime), renderAgentBootstrapBlock(runtime.fileName));
   const dryRun = options.dryRun === true;
   const wrote = next !== current;
   if (wrote && !dryRun) {
-    await mkdir56(path158.dirname(filePath), { recursive: true });
+    await mkdir57(path160.dirname(filePath), { recursive: true });
     await writeFile50(filePath, next, "utf8");
   }
   const status = dryRun ? statusFromContent(runtime, filePath, exists2, next) : await agentBootstrapStatus(runtime, homeRoot);
@@ -68578,7 +69060,7 @@ async function uninstallAgentBootstrap(runtime, options = {}) {
   const homeRoot = options.homeRoot ?? homedir7();
   const filePath = runtime.filePath(homeRoot);
   const exists2 = await pathExists(filePath);
-  const current = exists2 ? await readFile80(filePath, "utf8") : "";
+  const current = exists2 ? await readFile81(filePath, "utf8") : "";
   const next = removeManagedBlock(current);
   const dryRun = options.dryRun === true;
   const removed = next !== current;
@@ -69104,8 +69586,8 @@ function printBootstrapHelp() {
 
 // src/commands/metrics.ts
 init_args();
-import { readFile as readFile81 } from "fs/promises";
-import path160 from "path";
+import { readFile as readFile82 } from "fs/promises";
+import path162 from "path";
 
 // src/metrics/benchmark.ts
 var RELIABILITIES2 = new Set(["exact", "estimated", "unknown"]);
@@ -69883,8 +70365,8 @@ function buildContainmentManifest(inputs, options = {}) {
 }
 
 // src/metrics/oracle-runner.ts
-import { mkdir as mkdir57, writeFile as writeFile51 } from "fs/promises";
-import path159 from "path";
+import { mkdir as mkdir58, writeFile as writeFile51 } from "fs/promises";
+import path161 from "path";
 
 // src/metrics/ir.ts
 function toIdSet(ids) {
@@ -70326,9 +70808,9 @@ function buildEvidenceBundle(input2, options = {}) {
 async function persistEvidenceBundle(outDir, bundle, ladder = "metastore") {
   const safeTarget = bundle.target.replace(/[^A-Za-z0-9._/-]/g, "_");
   const safeCase = bundle.caseId.replace(/[^A-Za-z0-9._-]/g, "_");
-  const dir = path159.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
-  await mkdir57(dir, { recursive: true });
-  const write = (name, value) => writeFile51(path159.join(dir, name), `${JSON.stringify(value, null, 2)}
+  const dir = path161.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
+  await mkdir58(dir, { recursive: true });
+  const write = (name, value) => writeFile51(path161.join(dir, name), `${JSON.stringify(value, null, 2)}
 `, "utf8");
   await Promise.all([
     write("inputs.json", bundle.inputs),
@@ -70368,7 +70850,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
     console.log("# metrics status");
     console.log("");
     console.log(`root: ${root}`);
-    console.log(`enabled: ${await Bun.file(path160.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
+    console.log(`enabled: ${await Bun.file(path162.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
     const latest2 = await readLatestPointer(root);
     console.log(`latest: ${latest2.status}`);
     return;
@@ -70380,7 +70862,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const record2 = JSON.parse(await readFile81(path160.resolve(projectRoot, file), "utf8"));
+    const record2 = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
     const result = validateRunRecord(record2);
     console.log(result.valid ? "valid: yes" : "valid: no");
     for (const error2 of result.errors)
@@ -70405,13 +70887,13 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const file = path160.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
+    const file = path162.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
     if (!await Bun.file(file).exists()) {
       console.error(`Run not found: ${runId}`);
       process.exitCode = 1;
       return;
     }
-    console.log(await readFile81(file, "utf8"));
+    console.log(await readFile82(file, "utf8"));
     return;
   }
   if (subcommand === "compare") {
@@ -70422,8 +70904,8 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const a = JSON.parse(await readFile81(path160.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
-    const b = JSON.parse(await readFile81(path160.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
+    const a = JSON.parse(await readFile82(path162.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
+    const b = JSON.parse(await readFile82(path162.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
     const comparison = compareExecutionRuns(a, b);
     console.log(stableJson(comparison));
     return;
@@ -70457,8 +70939,8 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       return;
     }
     const template = createPairedBenchmarkTemplate(taskIds);
-    await Bun.write(path160.resolve(projectRoot, out), stableJson(template));
-    console.log(`manifest: ${path160.relative(projectRoot, path160.resolve(projectRoot, out))}`);
+    await Bun.write(path162.resolve(projectRoot, out), stableJson(template));
+    console.log(`manifest: ${path162.relative(projectRoot, path162.resolve(projectRoot, out))}`);
     return;
   }
   if (subcommand === "benchmark" && args2[1] === "run") {
@@ -70472,7 +70954,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const raw = JSON.parse(await readFile81(path160.resolve(projectRoot, file), "utf8"));
+    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
     const input2 = Array.isArray(raw) ? raw : raw.runs ?? [];
     const result = validatePairedBenchmark(input2);
     console.log(stableJson(result));
@@ -70484,7 +70966,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
   process.exitCode = 1;
 }
 async function loadAffectedSets(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path160.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target === "string")
@@ -70555,7 +71037,7 @@ async function runHarnessLayer(projectRoot, args2, ladder) {
   let tasks;
   let model;
   try {
-    const raw = JSON.parse(await readFile81(path160.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, resultsPath), "utf8"));
     tasks = raw.tasks ?? [];
     model = raw.model;
   } catch (error2) {
@@ -70586,7 +71068,7 @@ async function runSafetyCompletionHonestyLayer(projectRoot, args2, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile81(path160.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -70611,7 +71093,7 @@ async function runSafetyFalsePremiseLayer(projectRoot, args2, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile81(path160.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -70636,7 +71118,7 @@ async function runSafetyContainmentLayer(projectRoot, args2, ladder, caseClass)
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile81(path160.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -70698,12 +71180,12 @@ async function runGdgraphLayer(projectRoot, args2, ladder) {
   }
   const manifests = buildOracleManifestsByGold(inputs, { ladder });
   if (outDir) {
-    const resolvedOut = path160.resolve(projectRoot, outDir);
+    const resolvedOut = path162.resolve(projectRoot, outDir);
     for (const input2 of inputs) {
       for (const named of input2.golds) {
         const bundle = buildEvidenceBundle({ target: input2.target, system: input2.system, gold: named.gold }, { ladder, goldReference: goldPathFor(named.kind), timestamp: new Date().toISOString() });
-        const dir = await persistEvidenceBundle(path160.join(resolvedOut, named.kind), bundle, ladder);
-        console.error(`bundle[${named.kind}]: ${path160.relative(projectRoot, dir)}`);
+        const dir = await persistEvidenceBundle(path162.join(resolvedOut, named.kind), bundle, ladder);
+        console.error(`bundle[${named.kind}]: ${path162.relative(projectRoot, dir)}`);
       }
     }
   }
@@ -70727,7 +71209,7 @@ async function runGdgraphLayer(projectRoot, args2, ladder) {
   return allValid;
 }
 async function loadCoverageMap2(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path160.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
   return raw.coverageMap ?? {};
 }
 async function runTestingLayer(projectRoot, args2, ladder) {
@@ -70764,7 +71246,7 @@ async function runTestingLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadMemoryGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path160.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 3;
 }
 async function runMemoryLayer(projectRoot, args2, ladder) {
@@ -70801,11 +71283,11 @@ async function runMemoryLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadWikiGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path160.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 5;
 }
 async function loadWikiGroundedness(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path160.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target !== "string" || !Array.isArray(entry.scores) || entry.scores.length !== 3)
@@ -70861,7 +71343,7 @@ async function runWikiLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadGdctxFacts(projectRoot, file) {
-  const raw = JSON.parse(await readFile81(path160.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
   const inputs = [];
   for (const entry of raw.inputs ?? []) {
     if (typeof entry.input === "string") {
@@ -70899,7 +71381,7 @@ async function collect(projectRoot, args2) {
     process.exitCode = 1;
     return;
   }
-  const raw = JSON.parse(await readFile81(path160.resolve(projectRoot, eventFile), "utf8"));
+  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, eventFile), "utf8"));
   const events2 = Array.isArray(raw) ? raw : raw.events;
   const startedAt = optionValue(args2, "--started-at") ?? events2[0]?.timestamp_utc ?? new Date().toISOString();
   const finishedAt = optionValue(args2, "--finished-at") ?? events2.at(-1)?.timestamp_utc ?? startedAt;
@@ -70915,11 +71397,11 @@ async function collect(projectRoot, args2) {
     parentRunId: optionValue(args2, "--parent-run-id") ?? null
   });
   const result = await writeRunArtifacts(metricsRoot(projectRoot), record2, { cwd: projectRoot });
-  console.log(`json: ${path160.relative(projectRoot, result.jsonPath)}`);
-  console.log(`markdown: ${path160.relative(projectRoot, result.markdownPath)}`);
+  console.log(`json: ${path162.relative(projectRoot, result.jsonPath)}`);
+  console.log(`markdown: ${path162.relative(projectRoot, result.markdownPath)}`);
 }
 function metricsRoot(projectRoot) {
-  return path160.join(projectRoot, ".metaproject", "data", "metrics");
+  return path162.join(projectRoot, ".metaproject", "data", "metrics");
 }
 function printMetricsHelp() {
   console.log(`keryx metrics