@mrciphersmith/keryx 0.2.54 → 0.2.56

package/dist/cli.js

@@ -19314,6 +19314,8 @@ async function runAgentTurnCore(io, deps, history, userLine, options = {}) {
     const spawnConcurrencyCandidates = calls.filter((call) => call.name === "spawn_subagent" && reservationByCallId.get(call.id)?.ok === true);
     const untrustedGateBlocksSpawns = untrustedContentSeen || batchContainsUntrustedWeb;
     const concurrentSpawnResults = spawnConcurrencyCandidates.length >= 2 && !untrustedGateBlocksSpawns ? await runConcurrentSpawnBatch(spawnConcurrencyCandidates, toolByName, io, deps) : undefined;
+    let anchorsToAnnounce;
+    let repeatedFailureHint;
     for (const call of calls) {
       if (isAborted()) {
         system(`
@@ -19375,8 +19377,7 @@ ${modelOutput}` : modelOutput,
             runtime: { provider: deps.providerId, model: deps.modelId }
           });
           if (touch.changed) {
-            history.push({ role: "user", content: renderAnchorsBlock(touch.slate.anchors), provenance: "project" });
-            io.onHistoryChange?.("tool");
+            anchorsToAnnounce = touch.slate.anchors;
           }
         } catch (err) {
           io.onSystem?.(`slate touch update failed (ignored): ${err instanceof Error ? err.message : String(err)}
@@ -19397,14 +19398,21 @@ ${modelOutput}` : modelOutput,
           system(`
 ${hint}
 `);
-          history.push({ role: "user", content: hint, provenance: "project" });
-          io.onHistoryChange?.("tool");
+          repeatedFailureHint = hint;
         }
       } else {
         lastErrorByHash.delete(reservation.hash);
         errorStreakByHash.delete(reservation.hash);
       }
     }
+    if (anchorsToAnnounce !== undefined) {
+      history.push({ role: "user", content: renderAnchorsBlock(anchorsToAnnounce), provenance: "project" });
+      io.onHistoryChange?.("tool");
+    }
+    if (repeatedFailureHint !== undefined) {
+      history.push({ role: "user", content: repeatedFailureHint, provenance: "project" });
+      io.onHistoryChange?.("tool");
+    }
     const noProgress = !executedAny && calls.length > 0;
     if (exhaustedBudget !== undefined || noProgress) {
       const finishReason = exhaustedBudget !== undefined ? "budget" : "no-progress";
@@ -26103,6 +26111,10 @@ ${markdown.slice(4)}`;
   }
   return markdown;
 }
+function extractFrontmatterStatus(markdown) {
+  const bodyMatch = /\nStatus:\s*(\S+)/i.exec(markdown) ?? /^Status:\s*(\S+)/im.exec(markdown);
+  return bodyMatch?.[1] ?? "draft";
+}
 async function mapPool(items, concurrency, worker) {
   const results = new Array(items.length);
   let next = 0;
@@ -26129,7 +26141,6 @@ async function wikiEnrich(input2) {
   const concurrency = Math.max(1, Math.min(MAX_CONCURRENCY, input2.concurrency ?? DEFAULT_CONCURRENCY));
   const maxOutputTokens = input2.maxOutputTokens ?? DEFAULT_MAX_OUTPUT_TOKENS;
   const validate = input2.validate !== false;
-  const markAccepted = input2.keepStatus === true ? false : input2.markAccepted !== false;
   const wikiConfig = await loadWikiConfig(input2.cwd);
   const result = {
     provider,
@@ -26223,9 +26234,7 @@ async function wikiEnrich(input2) {
             return { path: page.relativePath, action: "failed", reason: `validation: ${structural}` };
           }
         }
-        if (markAccepted) {
-          enriched = setFrontmatterStatus(enriched, "accepted");
-        }
+        enriched = setFrontmatterStatus(enriched, extractFrontmatterStatus(original));
         if (input2.dryRun) {
           onPage({ index, total, path: page.relativePath, status, phase: "done" });
           return {
@@ -26239,7 +26248,7 @@ async function wikiEnrich(input2) {
         await writeFile36(page.absolutePath, `${enriched.endsWith(`
 `) ? enriched : `${enriched}
 `}`, "utf8");
-        onPage({ index, total, path: page.relativePath, status: markAccepted ? "accepted" : status, phase: "done" });
+        onPage({ index, total, path: page.relativePath, status, phase: "done" });
         return {
           path: page.relativePath,
           action: "enriched",
@@ -26265,7 +26274,6 @@ async function wikiEnrich(input2) {
       model,
       maxOutputTokens,
       validate,
-      markAccepted,
       concurrency,
       total,
       onPage,
@@ -26348,8 +26356,8 @@ function finalizeEnrichedText(original, rawText, options) {
   if (options.validate) {
     structuralError = validateEnrichedMarkdown(original, content);
   }
-  if (structuralError === null && options.markAccepted) {
-    content = setFrontmatterStatus(content, "accepted");
+  if (structuralError === null) {
+    content = setFrontmatterStatus(content, extractFrontmatterStatus(original));
   }
   return { content, structuralError };
 }
@@ -26376,7 +26384,7 @@ async function finishSuccess(ctx, page, originalRaw, content, keyFiles, extra) {
     index,
     total: ctx.total,
     path: page.relativePath,
-    status: ctx.markAccepted ? "accepted" : status,
+    status,
     phase: "done"
   });
   return {
@@ -26420,8 +26428,7 @@ async function runDeepSingle(ctx, item) {
     let content = null;
     if (rawText !== null) {
       const finalized = finalizeEnrichedText(original, rawText, {
-        validate: ctx.validate,
-        markAccepted: ctx.markAccepted
+        validate: ctx.validate
       });
       if (finalized.structuralError === null) {
         content = finalized.content;
@@ -26606,8 +26613,7 @@ async function runLightBatch(ctx, items) {
       continue;
     }
     const finalized = finalizeEnrichedText(item.original, rawText, {
-      validate: ctx.validate,
-      markAccepted: ctx.markAccepted
+      validate: ctx.validate
     });
     if (finalized.structuralError !== null) {
       ctx.onPage({ index, total: ctx.total, path: item.page.relativePath, status, phase: "failed" });
@@ -26658,7 +26664,6 @@ async function runRlmPipeline(ctxInput) {
     model: ctxInput.model,
     maxOutputTokens: ctxInput.maxOutputTokens,
     validate: ctxInput.validate,
-    markAccepted: ctxInput.markAccepted,
     total: ctxInput.total,
     onPage: ctxInput.onPage,
     input: input2,
@@ -36667,7 +36672,6 @@ async function runEnrich(args2) {
   const resume = args2.includes("--resume");
   const refreshGraph = args2.includes("--refresh-graph");
   const dryRun = args2.includes("--dry-run");
-  const keepStatus = args2.includes("--keep-status");
   const noValidate = args2.includes("--no-validate");
   const valueFlags = new Set([
     "--page",
@@ -36736,9 +36740,7 @@ async function runEnrich(args2) {
     resume,
     refreshGraph,
     dryRun,
-    keepStatus,
     validate: !noValidate,
-    markAccepted: !keepStatus,
     ...prompt ? { prompt } : {},
     ...provider ? { provider } : {},
     ...model ? { model } : {},
@@ -36815,10 +36817,12 @@ Usage:
   keryx wiki validate
   keryx wiki ask "<question>" [--k <n>] [--rerank]
   keryx wiki enrich [<page>|--all] [--force] [--list] [--resume] [--limit N] [--concurrency N]
-                    [--refresh-graph] [--max-tokens N] [--keep-status] [--no-validate]
+                    [--refresh-graph] [--max-tokens N] [--no-validate]
                     [--prompt "<i>"] [--provider <p>] [--model <m>] [--dry-run] [--json]
                          # defaults: drafts only; provider/model from auth.json; validate on;
-                         # mark Status: accepted; concurrency 1 (raise for parallel page swarm)
+                         # concurrency 1 (raise for parallel page swarm)
+                         # rewrites prose only \u2014 Status is always left exactly as it was
+                         # before the run; enrich can never itself accept a page (issue #391)
   keryx wiki context
   keryx wiki backlinks <wiki-page-or-code-file>
 
@@ -49933,7 +49937,8 @@ var PREFIX_BANNED = new Set([
   "osascript",
   "open",
   "tee",
-  "cd"
+  "cd",
+  "keryx"
 ]);
 var PREFIX_BANNED_READERS = new Set([
   "cat",
@@ -50004,6 +50009,17 @@ function validateShellPattern(pattern) {
   }
   return { ok: true };
 }
+function getRunningBinaryName() {
+  try {
+    const argv0 = process.argv0;
+    if (!argv0)
+      return "";
+    const name = argv0.split(/[\\/]/).pop() ?? "";
+    return name.toLowerCase();
+  } catch {
+    return "";
+  }
+}
 function bannedPrefixGrant(pattern, firstToken) {
   const rest = pattern.slice(firstToken.length).trim();
   const wildcardOnly = /^\*+$/.test(rest) || rest.length === 0 && /\*+$/.test(firstToken);
@@ -50016,6 +50032,13 @@ function bannedPrefixGrant(pattern, firstToken) {
       reason: `\`${word} *\` grants arbitrary execution: ${word} is an interpreter or wrapper, so its first token does not constrain what runs`
     };
   }
+  const runningBinary = getRunningBinaryName();
+  if (runningBinary && word === runningBinary) {
+    return {
+      word,
+      reason: `\`${word} *\` grants arbitrary execution: ${word} can run arbitrary subcommands, so remembering this grant would silently approve mutating/destructive operations forever`
+    };
+  }
   if (PREFIX_BANNED_READERS.has(word)) {
     return {
       word,
@@ -53100,8 +53123,10 @@ init_slate();
 init_workspace_service();
 init_workspace_resolve();
 init_service7();
+init_store2();
 init_fs();
 import path149 from "path";
+import { readFile as readFile79 } from "fs/promises";
 var POSITIVE_INTEGER = /^[1-9][0-9]*$/;
 var DEFAULT_AUTO_GOAL_ROUNDS = 8;
 function parseGoalArgs(rest) {
@@ -53203,9 +53228,20 @@ async function autoProvisionFlow(cwd, goalText) {
   await service5.start({ cwd, id: result.flow.id });
   return result.flow.id;
 }
+var ROUND_DONE_MARKER = "GOAL_ROUND_COMPLETE";
+function continuationRoundClaimsDone(history) {
+  for (let i = history.length - 1;i >= 0; i--) {
+    const message2 = history[i];
+    if (message2?.role === "assistant") {
+      return message2.content.includes(ROUND_DONE_MARKER);
+    }
+  }
+  return false;
+}
 async function buildContinuationMessage(cwd, slateSession, round4, roundsCap) {
   const totalRounds = roundsCap + 1;
-  const generic = `Continue working toward the stated goal (round ${round4} of ${totalRounds}).`;
+  const doneInstruction = `If \u2014 and only if \u2014 the stated goal is now FULLY achieved and there is nothing further to do this round, ` + `end your reply with the exact line ${ROUND_DONE_MARKER} on its own, and nothing else on that line. ` + `Otherwise do not include that line at all.`;
+  const generic = `Continue working toward the stated goal (round ${round4} of ${totalRounds}). ${doneInstruction}`;
   const slate = await readSlate(slateSession.dir).catch(() => {
     return;
   });
@@ -53243,11 +53279,61 @@ function parseVerifierVerdict(output2) {
     return;
   }
 }
-async function runGoalVerifier(deps, goalText) {
+var MAX_EVIDENCE_SEEDS = 10;
+function summarizeRecentSeeds(seeds) {
+  return seeds.slice(-MAX_EVIDENCE_SEEDS).map((seed) => `- Seed${seed.kind !== undefined ? ` [${seed.kind}]` : ""}: ${seed.text}`);
+}
+function summarizeWorkspaceProposals(history) {
+  const lines = [];
+  for (const message2 of history) {
+    if (message2.role !== "assistant" || message2.toolCalls === undefined) {
+      continue;
+    }
+    for (const call of message2.toolCalls) {
+      if (call.name !== "workspace_propose") {
+        continue;
+      }
+      const resultMessage = history.find((candidate) => candidate.role === "tool" && candidate.toolCallId === call.id);
+      let argSummary = call.arguments;
+      try {
+        const parsedArgs = JSON.parse(call.arguments);
+        const kind2 = typeof parsedArgs.kind === "string" ? parsedArgs.kind : "?";
+        const note2 = typeof parsedArgs.note === "string" ? parsedArgs.note : undefined;
+        argSummary = `kind=${kind2}${note2 !== undefined ? `, note=${note2}` : ""}`;
+      } catch {}
+      const outcome = resultMessage !== undefined ? resultMessage.content : "(no result recorded this run)";
+      lines.push(`- workspace_propose: ${argSummary} -> ${outcome}`);
+    }
+  }
+  return lines;
+}
+async function flowDefersCompletionToVerifier(cwd, flowId) {
+  try {
+    const dir = await resolveFlowDir(cwd, flowId);
+    const text = await readFile79(acPath(cwd, dir), "utf8");
+    const normalized = text.replace(/\s+/g, " ");
+    return normalized.includes("judged by the verifier subagent");
+  } catch {
+    return false;
+  }
+}
+async function buildVerifierEvidence(cwd, slateSession, history) {
+  const slate = await readSlate(slateSession.dir).catch(() => {
+    return;
+  });
+  const lines = [...slate !== undefined ? summarizeRecentSeeds(slate.seeds) : [], ...summarizeWorkspaceProposals(history)];
+  const evidenceText = lines.length > 0 ? lines.join(`
+`) : "(no Seeds or workspace_propose records were recorded this run)";
+  const flowId = slate?.course.flowRef;
+  const deferToVerifier = flowId !== undefined ? await flowDefersCompletionToVerifier(cwd, flowId) : false;
+  return { evidenceText, deferToVerifier };
+}
+async function runGoalVerifier(deps, goalText, cwd, slateSession, history, io, mintCallId) {
   const tool = deps.tools.find((candidate) => candidate.definition.name === "spawn_subagent");
   if (tool === undefined) {
     return;
   }
+  const { evidenceText, deferToVerifier } = await buildVerifierEvidence(cwd, slateSession, history);
   const task = [
     "Independently verify whether the following goal has ACTUALLY been achieved, based on the",
     "current, real state of the repository (read the real files/tests \u2014 never trust a prior",
@@ -53255,17 +53341,49 @@ async function runGoalVerifier(deps, goalText) {
     "",
     `Goal: "${goalText}"`,
     "",
+    "Evidence this run already produced (recent Slate Seeds and workspace_propose records) \u2014",
+    "weigh this as real evidence of what was actually done, not merely a claim:",
+    evidenceText,
+    "",
+    ...deferToVerifier ? [
+      "This run's Task Manager flow acceptance criteria explicitly defer the completion",
+      "judgment to THIS verifier check, not to the flow's own task checkboxes \u2014 its tasks",
+      "are expected to remain unchecked even when the goal is genuinely achieved. Do NOT",
+      "treat an incomplete/unchecked flow task list, by itself, as evidence the goal is NOT",
+      "achieved; judge achievement from the real repository state and the evidence above.",
+      ""
+    ] : [],
     "Reply with EXACTLY one JSON object and nothing else, no prose before or after it:",
     '{"achieved": true or false, "gaps": ["specific reason it is not fully achieved", ...]}',
     '"gaps" must be empty when "achieved" is true.'
   ].join(`
 `);
+  const input2 = { task, mode: "read_only", label: "goal-verifier" };
+  const callId = mintCallId();
+  io.onToolCall?.("spawn_subagent", JSON.stringify(input2));
+  history.push({
+    role: "assistant",
+    content: "",
+    provenance: "model",
+    toolCalls: [{ id: callId, name: "spawn_subagent", arguments: JSON.stringify(input2) }]
+  });
+  io.onHistoryChange?.("tool");
   let result;
   try {
-    result = await tool.invoke({ task, mode: "read_only", label: "goal-verifier" });
-  } catch {
+    result = await tool.invoke(input2);
+  } catch (err) {
+    const errorResult = {
+      output: `spawn_subagent dispatch failed: ${err instanceof Error ? err.message : String(err)}`,
+      isError: true
+    };
+    io.onToolResult?.("spawn_subagent", errorResult);
+    history.push({ role: "tool", content: errorResult.output, provenance: "tool", toolCallId: callId });
+    io.onHistoryChange?.("tool");
     return;
   }
+  io.onToolResult?.("spawn_subagent", result);
+  history.push({ role: "tool", content: result.output, provenance: "tool", toolCallId: callId });
+  io.onHistoryChange?.("tool");
   if (result.isError) {
     return;
   }
@@ -53355,10 +53473,21 @@ async function runGoalCommand(params) {
       systemLine(io, `/goal --auto: round ${round4}/${roundsCap + 1} \u2014 continuing toward the goal.
 `);
       await runAgentTurn(io, deps, history, continuationText, turnOptions);
+      if (continuationRoundClaimsDone(history)) {
+        systemLine(io, `/goal --auto: model signaled this round's work is complete (round ${round4}/${roundsCap + 1}) \u2014 ` + `ending the round budget early; the verifier will confirm.
+`);
+        break;
+      }
     }
     const wasOpenBeforeVerifier = slateSession.opened;
-    const verdict = await runGoalVerifier(deps, parsed.text);
-    if (verdict !== undefined && !verdict.achieved) {
+    const verdict = await runGoalVerifier(deps, parsed.text, cwd, slateSession, history, io, mintAttemptId);
+    if (verdict === undefined) {
+      systemLine(io, `/goal --auto: verifier unavailable \u2014 outcome not independently checked.
+`);
+    } else if (verdict.achieved) {
+      systemLine(io, `/goal --auto: verifier confirmed the goal is achieved.
+`);
+    } else {
       systemLine(io, `/goal --auto: verifier found the goal not fully achieved${verdict.gaps.length > 0 ? ` \u2014 ${verdict.gaps.join("; ")}` : " (no specific gaps reported)"}
 `);
       if (roundsLeft > 0) {
@@ -53406,7 +53535,7 @@ import { spawnSync as spawnSync2 } from "child_process";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.54",
+  version: "0.2.56",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -54666,7 +54795,7 @@ init_store3();
 init_proposal_lifecycle();
 init_workspace_service();
 import { randomUUID as randomUUID24 } from "crypto";
-import { readdir as readdir26 } from "fs/promises";
+import { readdir as readdir26, stat as stat8 } from "fs/promises";
 import path150 from "path";
 
 // src/sac/lifecycle-flag.ts
@@ -54717,14 +54846,18 @@ async function computeLifecycleFlags(cwd, now = () => new Date) {
 
 // src/sac/catch-up.ts
 init_proposal_evidence();
+init_collect();
+init_store();
 async function buildCatchUp(input2) {
-  const [proposals, sessionCategories, lifecycleFlagsAll] = await Promise.all([
+  const [proposals, sessionCategories, lifecycleFlagsAll, unreviewedPathsAll] = await Promise.all([
     collectProposals(input2.cwd, input2.workspaceId),
     collectSessionCategories(input2.cwd),
-    computeLifecycleFlags(input2.cwd)
+    computeLifecycleFlags(input2.cwd),
+    detectUnreviewedSacPathChanges(input2.cwd, listSessions(input2.cwd))
   ]);
   const lifecycleFlags = input2.workspaceId === undefined ? lifecycleFlagsAll : lifecycleFlagsAll.filter((flag) => flag.kind !== "workspace" || flag.ref === input2.workspaceId);
-  return { proposals, ...sessionCategories, lifecycleFlags };
+  const unreviewedPaths = input2.workspaceId === undefined ? unreviewedPathsAll : unreviewedPathsAll.filter((item) => item.workspaceId === input2.workspaceId);
+  return { proposals, ...sessionCategories, lifecycleFlags, unreviewedPaths };
 }
 async function collectProposals(cwd, workspaceId) {
   const authorizationServer = localWorkspaceAuthorizationServer();
@@ -54787,8 +54920,82 @@ async function classifySession(session) {
   const workspaceId = (await safeReadSlate(dir))?.workspaceId;
   return { kind: "unknown", item: { type: "unknown", sessionId: session.id, ...workspaceId !== undefined ? { workspaceId } : {}, lastSeenAt: session.updatedAt } };
 }
+async function readExternalUnboundCandidates(cwd) {
+  const extDir = externalSlatesDir(cwd);
+  let externalIds;
+  try {
+    const entries = await readdir26(extDir);
+    externalIds = entries.filter((name) => name.endsWith(".json")).map((name) => name.slice(0, -".json".length));
+  } catch {
+    return [];
+  }
+  const candidates = [];
+  for (const id of externalIds) {
+    const slate = await readExternalSlate(cwd, id);
+    if (!slate)
+      continue;
+    if (slate.closedAt === undefined || slate.workspaceId !== undefined)
+      continue;
+    const unbound2 = await readNewestUnboundCandidateForExternal(cwd, id);
+    if (unbound2) {
+      candidates.push({
+        type: "unbound-candidate",
+        externalSessionId: id,
+        evidencePath: unbound2.evidencePath,
+        summary: unbound2.summary
+      });
+    } else {
+      const summary = summarizeUnboundCandidate((slate.seeds ?? []).reduce((groups, seed) => {
+        const kind2 = seed.kind ?? "follow-up";
+        const existing = groups.find((g) => g.kind === kind2);
+        if (existing) {
+          existing.seeds = (existing.seeds ?? []).concat([{ text: seed.text }]);
+        } else {
+          groups.push({ kind: kind2, seeds: [{ text: seed.text }] });
+        }
+        return groups;
+      }, []));
+      candidates.push({
+        type: "unbound-candidate",
+        externalSessionId: id,
+        evidencePath: path150.join(extDir, `${id}.json`),
+        summary
+      });
+    }
+  }
+  return candidates;
+}
+async function readNewestUnboundCandidateForExternal(cwd, externalSessionId) {
+  const evidenceDir = path150.join(externalSlatesDir(cwd), externalSessionId);
+  let entries;
+  try {
+    entries = (await readdir26(evidenceDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
+  } catch {
+    return;
+  }
+  entries.sort();
+  for (let i = entries.length - 1;i >= 0; i--) {
+    const evidencePath = path150.join(evidenceDir, entries[i]);
+    const result = readConfigFile(evidencePath);
+    if (!result.ok) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(result.text);
+      if (parsed.recordType !== "unbound-candidate")
+        continue;
+      return { evidencePath, summary: summarizeUnboundCandidate(parsed.groups) };
+    } catch {
+      continue;
+    }
+  }
+  return;
+}
 async function collectSessionCategories(cwd) {
-  const classified = await Promise.all(listSessions(cwd).map((session) => classifySession(session)));
+  const [classified, externalUnboundCandidates] = await Promise.all([
+    Promise.all(listSessions(cwd).map((session) => classifySession(session))),
+    readExternalUnboundCandidates(cwd)
+  ]);
   const blocked2 = [];
   const unboundCandidates = [];
   const unknown = [];
@@ -54802,8 +55009,151 @@ async function collectSessionCategories(cwd) {
     else
       unknown.push(category.item);
   }
+  unboundCandidates.push(...externalUnboundCandidates);
   return { blocked: blocked2, unboundCandidates, unknown };
 }
+var SESSION_ATTRIBUTION_SLACK_MS = 5 * 60000;
+var MTIME_CLOCK_SKEW_TOLERANCE_MS = 5000;
+async function collectReceiptTargets(cwd, owner) {
+  const targets = new Set;
+  const workspacesDir = path150.join(cwd, ".metaproject", "workspaces");
+  let workspaceIds;
+  try {
+    workspaceIds = (await readdir26(workspacesDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch {
+    return targets;
+  }
+  for (const workspaceId of workspaceIds) {
+    const receiptsDir = path150.join(workspacesDir, workspaceId, `${owner}-write-receipts`);
+    let files;
+    try {
+      files = (await readdir26(receiptsDir)).filter((name) => name.endsWith(".json"));
+    } catch {
+      continue;
+    }
+    for (const file of files) {
+      const result = readConfigFile(path150.join(receiptsDir, file));
+      if (!result.ok)
+        continue;
+      try {
+        const receipt = JSON.parse(result.text);
+        if (typeof receipt.targetRef === "string") {
+          targets.add(receipt.targetRef.replace(/^\.\//, ""));
+        }
+      } catch {
+        continue;
+      }
+    }
+  }
+  return targets;
+}
+async function attributeToSession(absolutePath, sessionsNewestFirst) {
+  let mtimeMs;
+  try {
+    mtimeMs = (await stat8(absolutePath)).mtimeMs;
+  } catch {
+    return;
+  }
+  for (const session of sessionsNewestFirst) {
+    const start = Date.parse(session.createdAt);
+    const end = Date.parse(session.updatedAt);
+    if (Number.isNaN(start) || Number.isNaN(end))
+      continue;
+    if (mtimeMs >= start - MTIME_CLOCK_SKEW_TOLERANCE_MS && mtimeMs <= end + SESSION_ATTRIBUTION_SLACK_MS) {
+      const workspaceId = (await safeReadSlate(sessionDir(session.projectPath, session.id)))?.workspaceId;
+      return { sessionId: session.id, workspaceId, changedAt: new Date(mtimeMs).toISOString() };
+    }
+  }
+  return;
+}
+async function findSkillFiles(dir) {
+  let entries;
+  try {
+    entries = await readdir26(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const found = [];
+  for (const entry of entries) {
+    const full = path150.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      found.push(...await findSkillFiles(full));
+    } else if (entry.isFile() && entry.name === "SKILL.md") {
+      found.push(full);
+    }
+  }
+  return found;
+}
+async function detectUnreviewedSacPathChanges(cwd, sessions) {
+  const scoped = [...sessions].filter((session) => session.projectPath === cwd).sort((a, b) => Date.parse(b.updatedAt) - Date.parse(a.updatedAt));
+  if (scoped.length === 0)
+    return [];
+  const [wikiReceipts, memoryReceipts, skillReceipts] = await Promise.all([
+    collectReceiptTargets(cwd, "wiki"),
+    collectReceiptTargets(cwd, "memory"),
+    collectReceiptTargets(cwd, "skill")
+  ]);
+  const items = [];
+  const wikiPages = await collectPages(cwd).catch(() => []);
+  for (const page of wikiPages) {
+    if ((page.status ?? "").toLowerCase() !== "accepted")
+      continue;
+    const targetRef = `wiki/${page.relativePath}`;
+    if (wikiReceipts.has(targetRef))
+      continue;
+    const attribution = await attributeToSession(page.absolutePath, scoped);
+    if (attribution === undefined)
+      continue;
+    items.push({
+      type: "unreviewed-sac-path",
+      sessionId: attribution.sessionId,
+      ...attribution.workspaceId !== undefined ? { workspaceId: attribution.workspaceId } : {},
+      owner: "wiki",
+      path: targetRef,
+      ...page.status !== null ? { status: page.status } : {},
+      changedAt: attribution.changedAt
+    });
+  }
+  const memoryEntries = await collectEntries(cwd).catch(() => []);
+  for (const entry of memoryEntries) {
+    if (entry.status !== "accepted")
+      continue;
+    const targetRef = `memory/${entry.relativePath}`;
+    if (memoryReceipts.has(targetRef))
+      continue;
+    const attribution = await attributeToSession(entry.absolutePath, scoped);
+    if (attribution === undefined)
+      continue;
+    items.push({
+      type: "unreviewed-sac-path",
+      sessionId: attribution.sessionId,
+      ...attribution.workspaceId !== undefined ? { workspaceId: attribution.workspaceId } : {},
+      owner: "memory",
+      path: targetRef,
+      status: entry.status,
+      changedAt: attribution.changedAt
+    });
+  }
+  const sacSkillsDir = path150.join(cwd, ".metaproject", "project-skills", "sac");
+  const skillFiles = await findSkillFiles(sacSkillsDir);
+  for (const absolutePath of skillFiles) {
+    const targetRef = path150.relative(path150.join(cwd, ".metaproject"), absolutePath).split(path150.sep).join("/");
+    if (skillReceipts.has(targetRef))
+      continue;
+    const attribution = await attributeToSession(absolutePath, scoped);
+    if (attribution === undefined)
+      continue;
+    items.push({
+      type: "unreviewed-sac-path",
+      sessionId: attribution.sessionId,
+      ...attribution.workspaceId !== undefined ? { workspaceId: attribution.workspaceId } : {},
+      owner: "skill",
+      path: targetRef,
+      changedAt: attribution.changedAt
+    });
+  }
+  return items;
+}
 async function isSlateEngaged(dir) {
   if (await pathExists(path150.join(dir, "slate.json")))
     return true;
@@ -55070,7 +55420,7 @@ async function loadInspectorCatchUp(cwd) {
   try {
     return await buildCatchUp({ cwd });
   } catch {
-    return { proposals: [], blocked: [], unboundCandidates: [], unknown: [], lifecycleFlags: [] };
+    return { proposals: [], blocked: [], unboundCandidates: [], unknown: [], lifecycleFlags: [], unreviewedPaths: [] };
   }
 }
 function catchUpItems(report) {
@@ -65145,6 +65495,22 @@ New session ${shortSessionId(live.summary.id)}.
           slateSession,
           mintAttemptId: mintTimestampAttemptId
         });
+      } else if (command === "/theme") {
+        const wanted = rest.trim();
+        if (wanted.length === 0) {
+          agentIo.onSystem?.(formatThemeList(getThemeId()));
+        } else {
+          const next = parseThemeId(wanted);
+          if (next === undefined) {
+            agentIo.onSystem?.(`Unknown theme '${wanted}'.
+${formatThemeList(getThemeId())}`);
+          } else {
+            applyThemeId(next);
+            persistThemeId(next);
+            agentIo.onSystem?.(`Theme: ${themeLabel(next)}
+`);
+          }
+        }
       } else {
         agentIo.onSystem?.(describeUnavailableCommand(command, "agent") ?? `Unknown command: ${command}. Type /help.
 `);
@@ -65409,6 +65775,12 @@ async function shellCommand(args2, runtime = {}) {
     }
   }
   const rl = readline2.createInterface({ input: process.stdin });
+  if (!process.stdin.isTTY) {
+    process.on("SIGINT", () => {
+      rl.close();
+      process.exit(130);
+    });
+  }
   const lineIterator = rl[Symbol.asyncIterator]();
   const sharedLines = { [Symbol.asyncIterator]: () => lineIterator };
   const { io, emitSystem, printHeader, printPrompt, destroy } = createRichIo(sharedLines, versionCheck);
@@ -65675,7 +66047,7 @@ Shell:
 
 // src/commands/modules.ts
 init_fs();
-import { readFile as readFile79 } from "fs/promises";
+import { readFile as readFile80 } from "fs/promises";
 import { stdin } from "process";
 import path153 from "path";
 var MODULES = [
@@ -65737,7 +66109,7 @@ async function modulesCommand(args2 = []) {
   }
   let manifest = {};
   try {
-    manifest = JSON.parse(await readFile79(manifestPath, "utf8"));
+    manifest = JSON.parse(await readFile80(manifestPath, "utf8"));
   } catch {}
   const enabled = new Set(MODULES.filter((module) => manifest.modules?.[module.name]?.enabled === true).map((module) => module.name));
   if (wantsJson) {
@@ -67711,7 +68083,7 @@ function printHelp17() {
 
 // src/commands/update.ts
 import { spawn as spawn5 } from "child_process";
-import { chmod as chmod4, mkdir as mkdir56, readFile as readFile80, readdir as readdir27, writeFile as writeFile49 } from "fs/promises";
+import { chmod as chmod4, mkdir as mkdir56, readFile as readFile81, readdir as readdir27, writeFile as writeFile49 } from "fs/promises";
 import { access as access4, constants as constants2, existsSync as existsSync30 } from "fs";
 import path158 from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
@@ -68022,7 +68394,7 @@ async function shouldInstallDashboardPostCommitHook(projectRoot, manifest) {
   if (!await pathExists(hookPath)) {
     return false;
   }
-  return (await readFile80(hookPath, "utf8")).includes("# keryx:");
+  return (await readFile81(hookPath, "utf8")).includes("# keryx:");
 }
 async function collectDashboardData(metaprojectRoot) {
   const data = {};
@@ -68074,12 +68446,12 @@ async function collectTasksDashboardData(metaprojectRoot) {
       continue;
     }
     try {
-      const flow = JSON.parse(await readFile80(flowPath, "utf8"));
+      const flow = JSON.parse(await readFile81(flowPath, "utf8"));
       const tasks = Array.isArray(flow.tasks) ? flow.tasks : [];
       let acTotal = 0;
       const acPath2 = path158.join(flowsRoot2, dir, "acceptance-criteria.md");
       if (await pathExists(acPath2)) {
-        const acContent = await readFile80(acPath2, "utf8");
+        const acContent = await readFile81(acPath2, "utf8");
         acTotal = (acContent.match(/^- AC\d+:/gm) ?? []).length;
       }
       flows.push({
@@ -68135,7 +68507,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
     if (!await pathExists(filePath)) {
       continue;
     }
-    const content = await readFile80(filePath, "utf8");
+    const content = await readFile81(filePath, "utf8");
     docs[href] = content.length > 40000 ? `${content.slice(0, 40000)}
 
 \u2026truncated\u2026` : content;
@@ -68152,7 +68524,7 @@ async function collectHealthDashboardData(metaprojectRoot) {
   if (!await pathExists(reportPath2)) {
     return;
   }
-  const report = JSON.parse(await readFile80(reportPath2, "utf8"));
+  const report = JSON.parse(await readFile81(reportPath2, "utf8"));
   const metrics = Array.isArray(report.metrics) ? report.metrics : [];
   const findings = Array.isArray(report.findings) ? report.findings : [];
   const project = metrics.find((metric) => metric.key === "project") ?? {};
@@ -68266,7 +68638,7 @@ async function collectGraphDashboardData(metaprojectRoot) {
   let nodes = 0;
   let files = 0;
   let assets = 0;
-  for (const node of parseJsonl2(await readFile80(nodesPath, "utf8"))) {
+  for (const node of parseJsonl2(await readFile81(nodesPath, "utf8"))) {
     nodes += 1;
     if (node.kind === "asset") {
       assets += 1;
@@ -68282,7 +68654,7 @@ async function collectGraphDashboardData(metaprojectRoot) {
   let imports = 0;
   let assetEdges = 0;
   let unresolved = 0;
-  for (const edge of parseJsonl2(await readFile80(edgesPath, "utf8"))) {
+  for (const edge of parseJsonl2(await readFile81(edgesPath, "utf8"))) {
     edges += 1;
     if (edge.kind === "imports") {
       imports += 1;
@@ -68312,7 +68684,7 @@ async function collectTestingDashboardData(metaprojectRoot) {
   const reportPath2 = path158.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
   const contextPath = path158.join(metaprojectRoot, "data", "testing", "context.md");
   if (await pathExists(reportPath2)) {
-    const report = JSON.parse(await readFile80(reportPath2, "utf8"));
+    const report = JSON.parse(await readFile81(reportPath2, "utf8"));
     const totalTests = numberOrUndefined(report.total);
     const failedTests = Array.isArray(report.failures) ? report.failures.length : numberOrUndefined(report.failed);
     return {
@@ -68343,7 +68715,7 @@ async function collectMarkdownPages(root, hrefPrefix) {
     if (relativePath === "index.md" || relativePath.startsWith("templates/")) {
       continue;
     }
-    const content = await readFile80(filePath, "utf8");
+    const content = await readFile81(filePath, "utf8");
     const embedded = content.length > 24000 ? `${content.slice(0, 24000)}
 
 \u2026truncated\u2026` : content;
@@ -68519,7 +68891,7 @@ async function enableTasksInManifest(metaprojectRoot) {
   }
   let raw;
   try {
-    raw = JSON.parse(await readFile80(manifestPath, "utf8"));
+    raw = JSON.parse(await readFile81(manifestPath, "utf8"));
   } catch {
     return;
   }
@@ -68542,7 +68914,7 @@ async function updateManifestAgentEntrypoints(metaprojectRoot, ruleSources) {
   }
   let raw;
   try {
-    raw = JSON.parse(await readFile80(manifestPath, "utf8"));
+    raw = JSON.parse(await readFile81(manifestPath, "utf8"));
   } catch {
     return;
   }
@@ -68651,7 +69023,7 @@ async function installManagedHook2(projectRoot, hookName, blockId, content) {
   const managedBlock = `${blockStart}
 ${content.trim()}
 ${blockEnd}`;
-  const existing = await pathExists(hookPath) ? await readFile80(hookPath, "utf8") : `#!/usr/bin/env sh
+  const existing = await pathExists(hookPath) ? await readFile81(hookPath, "utf8") : `#!/usr/bin/env sh
 `;
   const blockPattern = new RegExp(`${escapeRegExp6(blockStart)}[\\s\\S]*?${escapeRegExp6(blockEnd)}`);
   const next = blockPattern.test(existing) ? existing.replace(blockPattern, managedBlock) : `${existing.trimEnd()}
@@ -68670,7 +69042,7 @@ async function removeManagedHook2(projectRoot, hookName, blockId) {
   if (!await pathExists(hookPath)) {
     return;
   }
-  const existing = await readFile80(hookPath, "utf8");
+  const existing = await readFile81(hookPath, "utf8");
   const blockStart = `# keryx:${blockId}:begin`;
   const blockEnd = `# keryx:${blockId}:end`;
   const blockPattern = new RegExp(`\\n*${escapeRegExp6(blockStart)}[\\s\\S]*?${escapeRegExp6(blockEnd)}\\n*`);
@@ -68692,7 +69064,7 @@ async function prePushHasSecurityBlock2(projectRoot) {
   if (!await pathExists(hookPath)) {
     return false;
   }
-  const hook = await readFile80(hookPath, "utf8");
+  const hook = await readFile81(hookPath, "utf8");
   return hook.includes("# keryx:security-pre-push:begin");
 }
 async function agentSettingsHasSecuritySentinel2(projectRoot) {
@@ -68700,7 +69072,7 @@ async function agentSettingsHasSecuritySentinel2(projectRoot) {
   if (!await pathExists(file)) {
     return false;
   }
-  return (await readFile80(file, "utf8")).includes(AGENT_HOOKS_SENTINEL);
+  return (await readFile81(file, "utf8")).includes(AGENT_HOOKS_SENTINEL);
 }
 async function readManifest5(metaprojectRoot) {
   const manifestPath = path158.join(metaprojectRoot, "metaproject.json");
@@ -68713,7 +69085,7 @@ async function readManifest5(metaprojectRoot) {
     };
   }
   try {
-    const manifest = JSON.parse(await readFile80(manifestPath, "utf8"));
+    const manifest = JSON.parse(await readFile81(manifestPath, "utf8"));
     const normalized = normalizeManifest(manifest);
     return {
       exists: true,
@@ -68837,7 +69209,7 @@ async function run(command, args2, cwd) {
   });
 }
 async function writeTextIfChanged4(filePath, content) {
-  if (await pathExists(filePath) && await readFile80(filePath, "utf8") === content) {
+  if (await pathExists(filePath) && await readFile81(filePath, "utf8") === content) {
     return;
   }
   await mkdir56(path158.dirname(filePath), { recursive: true });
@@ -68851,8 +69223,8 @@ async function writeTextIfMissing4(filePath, content) {
   await writeFile49(filePath, content, "utf8");
 }
 async function copyFileIfChanged2(from, to) {
-  const next = await readFile80(from, "utf8");
-  if (await pathExists(to) && await readFile80(to, "utf8") === next) {
+  const next = await readFile81(from, "utf8");
+  if (await pathExists(to) && await readFile81(to, "utf8") === next) {
     return;
   }
   await mkdir56(path158.dirname(to), { recursive: true });
@@ -68962,7 +69334,7 @@ function printHelp19() {
 import { readFileSync as readFileSync10 } from "fs";
 
 // src/agents/bootstrap.ts
-import { mkdir as mkdir57, readFile as readFile81, writeFile as writeFile50 } from "fs/promises";
+import { mkdir as mkdir57, readFile as readFile82, writeFile as writeFile50 } from "fs/promises";
 import { homedir as homedir7 } from "os";
 import path160 from "path";
 init_fs();
@@ -69035,7 +69407,7 @@ function resolveAgentBootstrapRuntimes(ids) {
 async function agentBootstrapStatus(runtime, homeRoot = homedir7()) {
   const filePath = runtime.filePath(homeRoot);
   const exists2 = await pathExists(filePath);
-  const content = exists2 ? await readFile81(filePath, "utf8") : "";
+  const content = exists2 ? await readFile82(filePath, "utf8") : "";
   const expected = renderAgentBootstrapBlock(runtime.fileName).trim();
   const installed = content.includes(AGENT_BOOTSTRAP_START);
   const current = installed && extractManagedBlock(content)?.trim() === expected;
@@ -69045,7 +69417,7 @@ async function installAgentBootstrap(runtime, options = {}) {
   const homeRoot = options.homeRoot ?? homedir7();
   const filePath = runtime.filePath(homeRoot);
   const exists2 = await pathExists(filePath);
-  const current = exists2 ? await readFile81(filePath, "utf8") : "";
+  const current = exists2 ? await readFile82(filePath, "utf8") : "";
   const next = upsertManagedBlock(current || defaultAgentFile(runtime), renderAgentBootstrapBlock(runtime.fileName));
   const dryRun = options.dryRun === true;
   const wrote = next !== current;
@@ -69060,7 +69432,7 @@ async function uninstallAgentBootstrap(runtime, options = {}) {
   const homeRoot = options.homeRoot ?? homedir7();
   const filePath = runtime.filePath(homeRoot);
   const exists2 = await pathExists(filePath);
-  const current = exists2 ? await readFile81(filePath, "utf8") : "";
+  const current = exists2 ? await readFile82(filePath, "utf8") : "";
   const next = removeManagedBlock(current);
   const dryRun = options.dryRun === true;
   const removed = next !== current;
@@ -69586,7 +69958,7 @@ function printBootstrapHelp() {
 
 // src/commands/metrics.ts
 init_args();
-import { readFile as readFile82 } from "fs/promises";
+import { readFile as readFile83 } from "fs/promises";
 import path162 from "path";
 
 // src/metrics/benchmark.ts
@@ -70862,7 +71234,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const record2 = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+    const record2 = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
     const result = validateRunRecord(record2);
     console.log(result.valid ? "valid: yes" : "valid: no");
     for (const error2 of result.errors)
@@ -70893,7 +71265,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    console.log(await readFile82(file, "utf8"));
+    console.log(await readFile83(file, "utf8"));
     return;
   }
   if (subcommand === "compare") {
@@ -70904,8 +71276,8 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const a = JSON.parse(await readFile82(path162.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
-    const b = JSON.parse(await readFile82(path162.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
+    const a = JSON.parse(await readFile83(path162.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
+    const b = JSON.parse(await readFile83(path162.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
     const comparison = compareExecutionRuns(a, b);
     console.log(stableJson(comparison));
     return;
@@ -70954,7 +71326,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+    const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
     const input2 = Array.isArray(raw) ? raw : raw.runs ?? [];
     const result = validatePairedBenchmark(input2);
     console.log(stableJson(result));
@@ -70966,7 +71338,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
   process.exitCode = 1;
 }
 async function loadAffectedSets(projectRoot, file) {
-  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target === "string")
@@ -71037,7 +71409,7 @@ async function runHarnessLayer(projectRoot, args2, ladder) {
   let tasks;
   let model;
   try {
-    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, resultsPath), "utf8"));
     tasks = raw.tasks ?? [];
     model = raw.model;
   } catch (error2) {
@@ -71068,7 +71440,7 @@ async function runSafetyCompletionHonestyLayer(projectRoot, args2, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -71093,7 +71465,7 @@ async function runSafetyFalsePremiseLayer(projectRoot, args2, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -71118,7 +71490,7 @@ async function runSafetyContainmentLayer(projectRoot, args2, ladder, caseClass)
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error2) {
@@ -71209,7 +71581,7 @@ async function runGdgraphLayer(projectRoot, args2, ladder) {
   return allValid;
 }
 async function loadCoverageMap2(projectRoot, file) {
-  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
   return raw.coverageMap ?? {};
 }
 async function runTestingLayer(projectRoot, args2, ladder) {
@@ -71246,7 +71618,7 @@ async function runTestingLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadMemoryGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 3;
 }
 async function runMemoryLayer(projectRoot, args2, ladder) {
@@ -71283,11 +71655,11 @@ async function runMemoryLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadWikiGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 5;
 }
 async function loadWikiGroundedness(projectRoot, file) {
-  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target !== "string" || !Array.isArray(entry.scores) || entry.scores.length !== 3)
@@ -71343,7 +71715,7 @@ async function runWikiLayer(projectRoot, args2, ladder) {
   return result.valid;
 }
 async function loadGdctxFacts(projectRoot, file) {
-  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, file), "utf8"));
   const inputs = [];
   for (const entry of raw.inputs ?? []) {
     if (typeof entry.input === "string") {
@@ -71381,7 +71753,7 @@ async function collect(projectRoot, args2) {
     process.exitCode = 1;
     return;
   }
-  const raw = JSON.parse(await readFile82(path162.resolve(projectRoot, eventFile), "utf8"));
+  const raw = JSON.parse(await readFile83(path162.resolve(projectRoot, eventFile), "utf8"));
   const events2 = Array.isArray(raw) ? raw : raw.events;
   const startedAt = optionValue(args2, "--started-at") ?? events2[0]?.timestamp_utc ?? new Date().toISOString();
   const finishedAt = optionValue(args2, "--finished-at") ?? events2.at(-1)?.timestamp_utc ?? startedAt;
@@ -71781,6 +72153,7 @@ function renderCatchUp(report, includeLifecycleFlags = true) {
   sections.push(renderSection("Blocked sessions (stopped unattended)", report.blocked, (item) => `- Session ${item.sessionId} stopped unattended (${item.terminalState.reason}) at ${item.terminalState.occurredAt}. Resume it, or archive and move on? ` + `Recommendation: \`keryx shell -r ${item.sessionId}\` to resume and unblock it.`));
   sections.push(renderSection("Unbound candidates (wrap-up ran, no workspace bound)", report.unboundCandidates, (item) => `- Session ${item.sessionId} produced untriaged seeds with no workspace bound (${item.summary}). Bind to a workspace and propose, or discard? ` + `Recommendation: pick a workspace, then \`keryx workspace propose <workspace-id> --kind <kind> --session ${item.sessionId}\` (evidence: ${item.evidencePath}).`));
   sections.push(renderSection("Unknown (no resolution recorded)", report.unknown, (item) => `- Session ${item.sessionId} was last seen ${item.lastSeenAt} with no proposal, terminal state, or unbound-candidate artifact recorded. Investigate, or ignore? ` + `Recommendation: \`keryx sessions list\` / \`keryx shell -r ${item.sessionId}\` to see what happened.`));
+  sections.push(renderSection("Unreviewed SAC-owned changes (no proposal on record)", report.unreviewedPaths, (item) => `- Session ${item.sessionId} changed ${item.owner} path \`${item.path}\`${item.status !== undefined ? ` (Status: ${item.status})` : ""} at ${item.changedAt} with NO SAC proposal/receipt behind it \u2014 this looks like it bypassed review. Was this reviewed some other way, or should it be? ` + `Recommendation: \`keryx shell -r ${item.sessionId}\` to see what happened; if the content is good, route it through a real proposal (\`keryx workspace propose ...\`) before trusting it as durable knowledge.`));
   if (includeLifecycleFlags) {
     sections.push(renderSection("Lifecycle flags (component no longer in the graph)", report.lifecycleFlags, (item) => `- ${item.kind} \`${item.ref}\` scopes to \`${item.missingComponent}\`, which is no longer in the code graph (flagged ${item.flaggedAt}). Still relevant, or safe to clean up? ` + `Recommendation: this is report-only \u2014 nothing was archived/edited/removed automatically; ${item.kind === "workspace" ? "`keryx workspace archive " + item.ref + "`" : item.kind === "memory-entry" ? "`keryx memory supersede` or edit the entry directly" : "edit or remove the wiki page directly"} if you decide it's actually stale.`));
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.2.54",
+  "version": "0.2.56",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {