@mrciphersmith/keryx 0.2.56 → 0.2.57

package/dist/cli.js

@@ -14422,101 +14422,66 @@ var init_slate_course = __esm(() => {
   unbound = { state: "unbound" };
 });
 
-// src/sac/secure-resource-read.ts
-import { constants } from "fs";
-import path71 from "path";
-import { dlopen, FFIType, ptr } from "bun:ffi";
-function readWorkspaceFileNoFollow(workspaceRoot, absolutePath) {
-  const relativePath = path71.relative(workspaceRoot, absolutePath);
-  const components = relativePath.split(path71.sep);
-  if (!relativePath || path71.isAbsolute(relativePath) || components.some((component) => !component || component === "." || component === "..")) {
-    throw new Error("safe source path is not workspace-relative");
-  }
-  const libc = loadPosixLibrary();
-  if (!libc || !Number.isInteger(constants.O_DIRECTORY) || !Number.isInteger(constants.O_NOFOLLOW)) {
-    throw new Error("safe descriptor source reads are unavailable on this platform");
-  }
-  const directoryFlags = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;
-  const fileFlags = constants.O_RDONLY | constants.O_NOFOLLOW;
-  const opened = [];
-  try {
-    let parent = openAt(libc, atFdcwd, workspaceRoot, directoryFlags);
-    opened.push(parent);
-    for (const component of components.slice(0, -1)) {
-      parent = openAt(libc, parent, component, directoryFlags);
-      opened.push(parent);
+// src/sac/trusted-wrap-up.ts
+import { createHash as createHash8, randomUUID as randomUUID6 } from "crypto";
+function createTrustedWrapUpAuthority(input2) {
+  const now = input2.now ?? (() => new Date);
+  return Object.freeze({
+    async issue(request) {
+      const resolved = await input2.resolveExplicitWrapUp(request);
+      if (!resolved.summary.trim() || resolved.evidence.length === 0 || new Date(resolved.expiresAt).getTime() <= now().getTime())
+        throw new Error("invalid trusted wrap-up issuance");
+      const provenance = Object.freeze({ id: `wrapup-${randomUUID6().replace(/-/g, "").slice(0, 16)}`, source: request.source, sourceRef: request.sourceRef, sourceRevision: resolved.sourceRevision, workspaceId: resolved.workspaceId, actorSubject: request.actor.subject, summaryDigest: digest(resolved.summary), evidence: resolved.evidence.map((item) => ({ ...item })), issuedAt: now().toISOString(), expiresAt: resolved.expiresAt });
+      issued.add(provenance);
+      return provenance;
+    },
+    verify(provenance, request) {
+      if (!issued.has(provenance))
+        return "untrusted";
+      if (consumed.has(provenance))
+        return "replayed";
+      if (new Date(provenance.expiresAt).getTime() <= now().getTime())
+        return "expired";
+      if (provenance.workspaceId !== request.workspaceId || provenance.actorSubject !== request.actor.subject)
+        return "mismatch";
+      return "ok";
+    },
+    consume(provenance, request) {
+      const result = this.verify(provenance, request);
+      if (result === "ok")
+        consumed.add(provenance);
+      return result;
     }
-    const name = components.at(-1);
-    if (!name)
-      throw new Error("safe source path has no final component");
-    const file = openAt(libc, parent, name, fileFlags);
-    opened.push(file);
-    return readAll(libc, file);
-  } finally {
-    for (const fd of opened.reverse())
-      libc.symbols.close(fd);
-    libc.close();
-  }
-}
-function loadPosixLibrary() {
-  for (const candidate of libcCandidates) {
-    try {
-      return dlopen(candidate, {
-        openat: { args: [FFIType.i32, FFIType.cstring, FFIType.i32, FFIType.i32], returns: FFIType.i32 },
-        read: { args: [FFIType.i32, FFIType.ptr, FFIType.u64], returns: FFIType.i64 },
-        close: { args: [FFIType.i32], returns: FFIType.i32 }
-      });
-    } catch {}
-  }
-  return;
-}
-function openAt(libc, directoryFd, component, flags) {
-  const name = Buffer.from(`${component}\x00`);
-  const fd = libc.symbols.openat(directoryFd, name, flags, 0);
-  if (fd < 0)
-    throw new Error("safe source descriptor open failed");
-  return fd;
+  });
 }
-function readAll(libc, fd) {
-  const chunks = [];
-  for (;; ) {
-    const chunk = Buffer.allocUnsafe(64 * 1024);
-    const read = libc.symbols.read(fd, ptr(chunk), chunk.length);
-    if (read < 0n)
-      throw new Error("safe source descriptor read failed");
-    if (read === 0n)
-      return Buffer.concat(chunks);
-    const length = Number(read);
-    if (!Number.isSafeInteger(length) || length > chunk.length)
-      throw new Error("safe source descriptor read returned an invalid length");
-    chunks.push(chunk.subarray(0, length));
-  }
+function digest(value) {
+  return createHash8("sha256").update(value).digest("hex");
 }
-var atFdcwd, libcCandidates;
-var init_secure_resource_read = __esm(() => {
-  atFdcwd = process.platform === "darwin" ? -2 : -100;
-  libcCandidates = process.platform === "darwin" ? ["/usr/lib/libSystem.B.dylib"] : process.platform === "linux" ? ["/lib/aarch64-linux-gnu/libc.so.6", "/lib/x86_64-linux-gnu/libc.so.6", "/lib64/libc.so.6"] : [];
+var issued, consumed;
+var init_trusted_wrap_up = __esm(() => {
+  issued = new WeakSet;
+  consumed = new WeakSet;
 });
 
 // src/sac/index.ts
 import { access as access2, readFile as readFile33, realpath as realpath2 } from "fs/promises";
-import { createHash as createHash8 } from "crypto";
-import path72 from "path";
+import { createHash as createHash9 } from "crypto";
+import path71 from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 async function resolveSacNormativeSchemaPath(fileName, searchFrom = [fileURLToPath4(new URL(".", import.meta.url)), process.cwd()]) {
   const seen = new Set;
   for (const start of searchFrom) {
-    let dir = path72.resolve(start);
+    let dir = path71.resolve(start);
     for (let i = 0;i < 10; i++) {
       if (seen.has(dir))
         break;
       seen.add(dir);
-      const candidate = path72.join(dir, NORMATIVE_SCHEMA_DIR, fileName);
+      const candidate = path71.join(dir, NORMATIVE_SCHEMA_DIR, fileName);
       try {
         await access2(candidate);
         return candidate;
       } catch {}
-      const parent = path72.dirname(dir);
+      const parent = path71.dirname(dir);
       if (parent === dir)
         break;
       dir = parent;
@@ -15178,15 +15143,15 @@ async function validateSacContract(input2) {
   return { valid: errors.length === 0, errors };
 }
 function hashSacRecord(value) {
-  return createHash8("sha256").update(typeof value === "string" ? value : JSON.stringify(value)).digest("hex");
+  return createHash9("sha256").update(typeof value === "string" ? value : JSON.stringify(value)).digest("hex");
 }
 async function resolveWorkspaceReference(input2) {
-  if (!workspacePathPattern.test(input2.uri) || path72.isAbsolute(input2.uri) || /^[a-z][a-z0-9+.-]*:/i.test(input2.uri) || input2.uri.includes("\\"))
+  if (!workspacePathPattern.test(input2.uri) || path71.isAbsolute(input2.uri) || /^[a-z][a-z0-9+.-]*:/i.test(input2.uri) || input2.uri.includes("\\"))
     throw new SacReferenceError("unsafe workspace reference");
-  const lexicalRoot = path72.resolve(input2.workspaceRoot);
+  const lexicalRoot = path71.resolve(input2.workspaceRoot);
   const root = await realpath2(lexicalRoot);
-  const candidate = path72.resolve(lexicalRoot, input2.uri.slice(2));
-  if (candidate !== lexicalRoot && !candidate.startsWith(`${lexicalRoot}${path72.sep}`))
+  const candidate = path71.resolve(lexicalRoot, input2.uri.slice(2));
+  if (candidate !== lexicalRoot && !candidate.startsWith(`${lexicalRoot}${path71.sep}`))
     throw new SacReferenceError("workspace reference escapes root");
   let resolved;
   try {
@@ -15194,7 +15159,7 @@ async function resolveWorkspaceReference(input2) {
   } catch {
     throw new SacReferenceError("workspace reference is not resolvable");
   }
-  if (resolved !== root && !resolved.startsWith(`${root}${path72.sep}`))
+  if (resolved !== root && !resolved.startsWith(`${root}${path71.sep}`))
     throw new SacReferenceError("workspace reference escapes root after realpath");
   return candidate;
 }
@@ -15261,7 +15226,7 @@ var init_sac = __esm(() => {
     "review-decision": "review-decision.schema.json"
   };
   normativeSchemas = new Map;
-  NORMATIVE_SCHEMA_DIR = path72.join("docs", "requirements", "shared-agent-context", "schemas");
+  NORMATIVE_SCHEMA_DIR = path71.join("docs", "requirements", "shared-agent-context", "schemas");
   SacReferenceError = class SacReferenceError extends Error {
     code = "unsafe_workspace_reference";
   };
@@ -15269,9 +15234,85 @@ var init_sac = __esm(() => {
   roleRank = { viewer: 1, editor: 2, owner: 3 };
 });
 
+// src/sac/secure-resource-read.ts
+import { constants } from "fs";
+import path72 from "path";
+import { dlopen, FFIType, ptr } from "bun:ffi";
+function readWorkspaceFileNoFollow(workspaceRoot, absolutePath) {
+  const relativePath = path72.relative(workspaceRoot, absolutePath);
+  const components = relativePath.split(path72.sep);
+  if (!relativePath || path72.isAbsolute(relativePath) || components.some((component) => !component || component === "." || component === "..")) {
+    throw new Error("safe source path is not workspace-relative");
+  }
+  const libc = loadPosixLibrary();
+  if (!libc || !Number.isInteger(constants.O_DIRECTORY) || !Number.isInteger(constants.O_NOFOLLOW)) {
+    throw new Error("safe descriptor source reads are unavailable on this platform");
+  }
+  const directoryFlags = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;
+  const fileFlags = constants.O_RDONLY | constants.O_NOFOLLOW;
+  const opened = [];
+  try {
+    let parent = openAt(libc, atFdcwd, workspaceRoot, directoryFlags);
+    opened.push(parent);
+    for (const component of components.slice(0, -1)) {
+      parent = openAt(libc, parent, component, directoryFlags);
+      opened.push(parent);
+    }
+    const name = components.at(-1);
+    if (!name)
+      throw new Error("safe source path has no final component");
+    const file = openAt(libc, parent, name, fileFlags);
+    opened.push(file);
+    return readAll(libc, file);
+  } finally {
+    for (const fd of opened.reverse())
+      libc.symbols.close(fd);
+    libc.close();
+  }
+}
+function loadPosixLibrary() {
+  for (const candidate of libcCandidates) {
+    try {
+      return dlopen(candidate, {
+        openat: { args: [FFIType.i32, FFIType.cstring, FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+        read: { args: [FFIType.i32, FFIType.ptr, FFIType.u64], returns: FFIType.i64 },
+        close: { args: [FFIType.i32], returns: FFIType.i32 }
+      });
+    } catch {}
+  }
+  return;
+}
+function openAt(libc, directoryFd, component, flags) {
+  const name = Buffer.from(`${component}\x00`);
+  const fd = libc.symbols.openat(directoryFd, name, flags, 0);
+  if (fd < 0)
+    throw new Error("safe source descriptor open failed");
+  return fd;
+}
+function readAll(libc, fd) {
+  const chunks = [];
+  for (;; ) {
+    const chunk = Buffer.allocUnsafe(64 * 1024);
+    const read = libc.symbols.read(fd, ptr(chunk), chunk.length);
+    if (read < 0n)
+      throw new Error("safe source descriptor read failed");
+    if (read === 0n)
+      return Buffer.concat(chunks);
+    const length = Number(read);
+    if (!Number.isSafeInteger(length) || length > chunk.length)
+      throw new Error("safe source descriptor read returned an invalid length");
+    chunks.push(chunk.subarray(0, length));
+  }
+}
+var atFdcwd, libcCandidates;
+var init_secure_resource_read = __esm(() => {
+  atFdcwd = process.platform === "darwin" ? -2 : -100;
+  libcCandidates = process.platform === "darwin" ? ["/usr/lib/libSystem.B.dylib"] : process.platform === "linux" ? ["/lib/aarch64-linux-gnu/libc.so.6", "/lib/x86_64-linux-gnu/libc.so.6", "/lib64/libc.so.6"] : [];
+});
+
 // src/sac/workspace-service.ts
 import { mkdir as mkdir27, readdir as readdir9, readFile as readFile34 } from "fs/promises";
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 import path73 from "path";
 
 class WorkspaceService {
@@ -15579,7 +15620,7 @@ function localWorkspaceAuthorizationServer(subject = `user:local-${process.getui
   return createSacAuthorizationServer({ authenticateRequest: async () => ({ subject, authenticationMethod: "local-os", roleRevision: "local-os-v1" }) });
 }
 function newWorkspaceId() {
-  return `workspace-${randomUUID6().replace(/-/g, "").slice(0, 16)}`;
+  return `workspace-${randomUUID7().replace(/-/g, "").slice(0, 16)}`;
 }
 async function resolveWorkspaceForActor(cwd, workspaceId) {
   const service = new WorkspaceService({
@@ -15588,7 +15629,7 @@ async function resolveWorkspaceForActor(cwd, workspaceId) {
     strictGuard: { mode: "strict", availability: "available", decision: "pass", policyRevision: "local-offline-v1" }
   });
   try {
-    const manifest = await service.show({ request: undefined, requestCorrelationId: randomUUID6(), workspaceId });
+    const manifest = await service.show({ request: undefined, requestCorrelationId: randomUUID7(), workspaceId });
     return { ok: true, manifest };
   } catch (error2) {
     if (error2 instanceof WorkspaceServiceError) {
@@ -15614,47 +15655,6 @@ var init_workspace_service = __esm(() => {
   };
 });
 
-// src/sac/trusted-wrap-up.ts
-import { createHash as createHash9, randomUUID as randomUUID7 } from "crypto";
-function createTrustedWrapUpAuthority(input2) {
-  const now = input2.now ?? (() => new Date);
-  return Object.freeze({
-    async issue(request) {
-      const resolved = await input2.resolveExplicitWrapUp(request);
-      if (!resolved.summary.trim() || resolved.evidence.length === 0 || new Date(resolved.expiresAt).getTime() <= now().getTime())
-        throw new Error("invalid trusted wrap-up issuance");
-      const provenance = Object.freeze({ id: `wrapup-${randomUUID7().replace(/-/g, "").slice(0, 16)}`, source: request.source, sourceRef: request.sourceRef, sourceRevision: resolved.sourceRevision, workspaceId: resolved.workspaceId, actorSubject: request.actor.subject, summaryDigest: digest(resolved.summary), evidence: resolved.evidence.map((item) => ({ ...item })), issuedAt: now().toISOString(), expiresAt: resolved.expiresAt });
-      issued.add(provenance);
-      return provenance;
-    },
-    verify(provenance, request) {
-      if (!issued.has(provenance))
-        return "untrusted";
-      if (consumed.has(provenance))
-        return "replayed";
-      if (new Date(provenance.expiresAt).getTime() <= now().getTime())
-        return "expired";
-      if (provenance.workspaceId !== request.workspaceId || provenance.actorSubject !== request.actor.subject)
-        return "mismatch";
-      return "ok";
-    },
-    consume(provenance, request) {
-      const result = this.verify(provenance, request);
-      if (result === "ok")
-        consumed.add(provenance);
-      return result;
-    }
-  });
-}
-function digest(value) {
-  return createHash9("sha256").update(value).digest("hex");
-}
-var issued, consumed;
-var init_trusted_wrap_up = __esm(() => {
-  issued = new WeakSet;
-  consumed = new WeakSet;
-});
-
 // src/sac/guarded-owner-writer.ts
 import { createHash as createHash10 } from "crypto";
 function createGuardedOwnerWriter(input2) {
@@ -16208,290 +16208,16 @@ var init_store3 = __esm(() => {
   };
 });
 
-// src/sac/machine-wrap-up.ts
-import { createHash as createHash11, randomUUID as randomUUID9 } from "crypto";
-import { execFile } from "child_process";
-import { mkdir as mkdir28 } from "fs/promises";
-import path75 from "path";
-import { promisify } from "util";
-function describeSource(source) {
-  return source === "parent" ? "parent" : `child:${source.childDispatchId}`;
-}
-function dedupedAttributedSeeds(slate) {
-  const seen = new Set;
-  const result = [];
-  const take = (seeds, source) => {
-    for (const seed of dedupeSeeds(seeds)) {
-      const key = seed.text.trim();
-      if (seen.has(key))
-        continue;
-      seen.add(key);
-      result.push({ text: seed.text, kind: seed.kind ?? "follow-up", source });
-    }
-  };
-  take(slate.seeds, "parent");
-  const childDispatches = slate.childDispatches ?? {};
-  for (const [dispatchId, dispatch] of Object.entries(childDispatches)) {
-    take(dispatch.seeds, { childDispatchId: dispatchId });
-  }
-  return result;
-}
-function groupSeedsByKind(slate) {
-  const map = new Map;
-  for (const seed of dedupedAttributedSeeds(slate)) {
-    const bucket = map.get(seed.kind);
-    if (bucket)
-      bucket.push(seed);
-    else
-      map.set(seed.kind, [seed]);
-  }
-  return map;
-}
-function sha256(value) {
-  return createHash11("sha256").update(value).digest("hex");
-}
-async function gitDiff(cwd) {
-  try {
-    const { stdout: stdout2 } = await execFileAsync("git", ["diff"], { cwd, maxBuffer: 16 * 1024 * 1024 });
-    return stdout2;
-  } catch {
-    return "";
-  }
-}
-function diffStatLine(diffText) {
-  if (diffText.trim().length === 0)
-    return "no working-tree changes";
-  const added = (diffText.match(/^\+(?!\+\+)/gm) ?? []).length;
-  const removed = (diffText.match(/^-(?!--)/gm) ?? []).length;
-  return `working-tree diff: +${added}/-${removed} line(s)`;
-}
-function courseStatusLine(course) {
-  if (course.state !== "bound")
-    return "flow: unbound";
-  return `flow ${course.flowRef.uri} snapshot=${course.flowRef.snapshot} completed=${course.completed.length} next=${course.next.length} blocked=${course.blocked.length}`;
-}
-function mechanicalSummary(diffText, course) {
-  return `Mechanical wrap-up summary (model turn unavailable or timed out):
-${diffStatLine(diffText)}
-${courseStatusLine(course)}`;
-}
-async function resolveMachineWrapUp(input2) {
-  const now = input2.now ?? (() => new Date);
-  const diffText = await gitDiff(input2.cwd);
-  const course = await readCourse(input2.cwd, input2.slate.course.flowRef);
-  const seedsForKind = dedupedAttributedSeeds(input2.slate).filter((seed) => seed.kind === input2.kind);
-  const flowSnapshotJson = `${JSON.stringify(course, null, 2)}
-`;
-  const seedsJson = `${JSON.stringify(seedsForKind.map((seed) => ({ text: seed.text, source: describeSource(seed.source) })), null, 2)}
-`;
-  const sourceRevision = sha256([diffText, flowSnapshotJson, seedsJson].join("\x00"));
-  const shortHash = sourceRevision.slice(0, 16);
-  const system = "Summarize ONLY the machine evidence provided below \u2014 a git diff, a Flow snapshot, and the Seeds captured " + "this session for one proposal kind. Never invent facts that are not present in the evidence.";
-  const user = `--- git diff ---
-${diffText.length > 0 ? diffText : "(no working-tree changes)"}
-
-` + `--- flow snapshot ---
-${flowSnapshotJson}
-` + `--- seeds (${input2.kind}) ---
-${seedsJson}`;
-  let modelResult;
-  const modelTurnTimeoutMs = input2.modelTurnTimeoutMs ?? DEFAULT_MODEL_TURN_TIMEOUT_MS;
-  const turn = runModelTurn({
-    system,
-    user,
-    requestId: `machine-wrap-up-${shortHash}`,
-    ...input2.env !== undefined ? { env: input2.env } : {},
-    ...input2.providerFactory !== undefined ? { providerFactory: input2.providerFactory } : {}
-  }).then((result) => {
-    modelResult = result;
-    return "done";
-  });
-  let timer;
-  const expired = new Promise((resolve) => {
-    timer = setTimeout(() => resolve("timeout"), modelTurnTimeoutMs);
-  });
-  let raceOutcome;
-  try {
-    raceOutcome = await Promise.race([turn, expired]);
-  } finally {
-    if (timer !== undefined)
-      clearTimeout(timer);
-  }
-  let summary;
-  if (raceOutcome === "timeout") {
-    turn.catch(() => {});
-    summary = mechanicalSummary(diffText, course);
-  } else {
-    const result = modelResult;
-    if (result.text.trim().length === 0 && !result.credentialAvailable) {
-      return { ok: false, code: "no_credential" };
-    }
-    summary = result.text.trim().length > 0 ? result.text.trim() : mechanicalSummary(diffText, course);
-  }
-  const evidenceDir = path75.join(input2.cwd, ".metaproject", "workspaces", input2.workspaceId, "machine-evidence");
-  await mkdir28(evidenceDir, { recursive: true });
-  const diffFile = `${input2.kind}.${shortHash}.diff.txt`;
-  const flowFile = `${input2.kind}.${shortHash}.flow.json`;
-  const seedsFile = `${input2.kind}.${shortHash}.seeds.json`;
-  await writeFileAtomic(path75.join(evidenceDir, diffFile), diffText);
-  await writeFileAtomic(path75.join(evidenceDir, flowFile), flowSnapshotJson);
-  await writeFileAtomic(path75.join(evidenceDir, seedsFile), seedsJson);
-  const observedAt = now().toISOString();
-  const relBase = `./.metaproject/workspaces/${input2.workspaceId}/machine-evidence`;
-  const evidence = [
-    { kind: "diff", uri: `${relBase}/${diffFile}`, revision: sha256(diffText), observedAt },
-    { kind: "flow", uri: `${relBase}/${flowFile}`, revision: sha256(flowSnapshotJson), observedAt },
-    { kind: "seeds", uri: `${relBase}/${seedsFile}`, revision: sha256(seedsJson), observedAt }
-  ];
-  return {
-    ok: true,
-    resolution: {
-      workspaceId: input2.workspaceId,
-      sourceRevision,
-      summary,
-      evidence,
-      expiresAt: new Date(now().getTime() + WRAP_UP_TTL_MS).toISOString()
-    }
-  };
-}
-async function writeUnboundCandidateArtifact(dir, trigger, now, grouped, nonEmptyKinds) {
-  const archiveDir = path75.join(dir, "slate-archive");
-  await mkdir28(archiveDir, { recursive: true });
-  const nowIso2 = now().toISOString();
-  const filename = `${nowIso2.replace(/[:.]/g, "-")}-unbound-candidate.json`;
-  const content = {
-    recordType: "unbound-candidate",
-    trigger,
-    generatedAt: nowIso2,
-    groups: nonEmptyKinds.map((kind) => ({
-      kind,
-      seeds: (grouped.get(kind) ?? []).map((seed) => ({ text: seed.text, source: describeSource(seed.source) }))
-    }))
-  };
-  await writeFileAtomic(path75.join(archiveDir, filename), `${JSON.stringify(content, null, 2)}
-`);
-}
-async function writeWrapUpOutcomeArtifact(dir, trigger, now, groups) {
-  try {
-    const archiveDir = path75.join(dir, "slate-archive");
-    await mkdir28(archiveDir, { recursive: true });
-    const nowIso2 = now().toISOString();
-    const filename = `${nowIso2.replace(/[:.]/g, "-")}-wrap-up-outcome.json`;
-    const content = { recordType: "wrap-up-outcome", trigger, generatedAt: nowIso2, groups };
-    await writeFileAtomic(path75.join(archiveDir, filename), `${JSON.stringify(content, null, 2)}
-`);
-  } catch {}
-}
-async function proposeOneGroup(params) {
-  const wrapUpSource = params.wrapUpSource ?? "flow";
-  try {
-    const resolved = await resolveMachineWrapUp({
-      cwd: params.cwd,
-      workspaceId: params.workspaceId,
-      slate: params.slate,
-      kind: params.kind,
-      now: params.now,
-      ...params.env !== undefined ? { env: params.env } : {},
-      ...params.providerFactory !== undefined ? { providerFactory: params.providerFactory } : {},
-      ...params.modelTurnTimeoutMs !== undefined ? { modelTurnTimeoutMs: params.modelTurnTimeoutMs } : {}
-    });
-    if (!resolved.ok)
-      return { kind: params.kind, outcome: "no_credential" };
-    const flowEvidence = resolved.resolution.evidence.find((item) => item.kind === "flow");
-    const sourceRef = (flowEvidence ?? resolved.resolution.evidence[0]).uri;
-    const flowRef = params.slate.course.flowRef ?? "";
-    const dedupHash = sha256(`${params.workspaceId}:${flowRef}:${resolved.resolution.sourceRevision}:${params.kind}`);
-    const proposalId = `wrapup-${dedupHash.slice(0, 32)}`;
-    const wrapUpAuthority = createTrustedWrapUpAuthority({
-      now: params.now,
-      resolveExplicitWrapUp: async (request) => {
-        if (request.source !== wrapUpSource) {
-          throw new Error(`machine-wrap-up only resolves "${wrapUpSource}" wrap-ups, got "${request.source}"`);
-        }
-        return resolved.resolution;
-      }
-    });
-    const { service, authorizationServer } = createHarnessProposalLifecycleService(params.cwd, {
-      workspaceId: params.workspaceId,
-      now: params.now
-    });
-    const requestCorrelationId = randomUUID9();
-    const actor = await authorizationServer.actorContextFor(undefined, requestCorrelationId);
-    if (!actor)
-      throw new Error("trusted ActorContext is required for a machine wrap-up propose");
-    const provenance = await wrapUpAuthority.issue({ actor, source: wrapUpSource, sourceRef });
-    try {
-      const proposal = await service.create({
-        request: undefined,
-        requestCorrelationId,
-        workspaceId: params.workspaceId,
-        id: proposalId,
-        proposalRevision: "1",
-        kind: params.kind,
-        wrapUp: provenance
-      });
-      return { kind: params.kind, outcome: "proposed", proposalId: proposal.id };
-    } catch (error2) {
-      if (error2 instanceof ProposalLifecycleError && error2.code === "conflict") {
-        return { kind: params.kind, outcome: "conflict" };
-      }
-      throw error2;
-    }
-  } catch (error2) {
-    const message = error2 instanceof Error ? error2.message : String(error2);
-    return { kind: params.kind, outcome: "error", message };
-  }
-}
-async function runWrapUp(input2) {
-  const now = input2.now ?? (() => new Date);
-  const grouped = groupSeedsByKind(input2.slate);
-  const nonEmptyKinds = [...grouped.keys()].filter((kind) => (grouped.get(kind)?.length ?? 0) > 0);
-  if (nonEmptyKinds.length === 0) {
-    return { groups: [] };
-  }
-  if (input2.slate.workspaceId === undefined) {
-    await writeUnboundCandidateArtifact(input2.dir, input2.trigger, now, grouped, nonEmptyKinds);
-    const groups2 = nonEmptyKinds.map((kind) => ({ kind, outcome: "unbound-candidate" }));
-    await writeWrapUpOutcomeArtifact(input2.dir, input2.trigger, now, groups2);
-    return { groups: groups2 };
-  }
-  const workspaceId = input2.slate.workspaceId;
-  const groups = await Promise.all(nonEmptyKinds.map((kind) => proposeOneGroup({
-    cwd: input2.cwd,
-    workspaceId,
-    slate: input2.slate,
-    kind,
-    now,
-    ...input2.wrapUpSource !== undefined ? { wrapUpSource: input2.wrapUpSource } : {},
-    ...input2.env !== undefined ? { env: input2.env } : {},
-    ...input2.providerFactory !== undefined ? { providerFactory: input2.providerFactory } : {},
-    ...input2.modelTurnTimeoutMs !== undefined ? { modelTurnTimeoutMs: input2.modelTurnTimeoutMs } : {}
-  })));
-  await writeWrapUpOutcomeArtifact(input2.dir, input2.trigger, now, groups);
-  return { groups };
-}
-var execFileAsync, WRAP_UP_TTL_MS, DEFAULT_MODEL_TURN_TIMEOUT_MS = 30000;
-var init_machine_wrap_up = __esm(() => {
-  init_fs();
-  init_slate();
-  init_slate_course();
-  init_trusted_wrap_up();
-  init_proposal_lifecycle();
-  init_single_turn();
-  execFileAsync = promisify(execFile);
-  WRAP_UP_TTL_MS = 60 * 60 * 1000;
-});
-
 // src/sac/session-wrap-up.ts
-import { createHash as createHash12 } from "crypto";
-import { mkdir as mkdir29, writeFile as writeFile27 } from "fs/promises";
-import path76 from "path";
+import { createHash as createHash11 } from "crypto";
+import { mkdir as mkdir28, writeFile as writeFile27 } from "fs/promises";
+import path75 from "path";
 function sessionEvidenceRef(workspaceId, sessionId) {
   return `./.metaproject/workspaces/${workspaceId}/session-evidence/${sessionId}.md`;
 }
 async function resolveSessionWrapUp(input2) {
   const now = input2.now ?? (() => new Date);
-  const sessionId = path76.posix.basename(input2.sourceRef, ".md");
+  const sessionId = path75.posix.basename(input2.sourceRef, ".md");
   const summary = findSession(input2.cwd, sessionId);
   if (summary === undefined || input2.sourceRef !== sessionEvidenceRef(input2.workspaceId, summary.id)) {
     throw new SessionWrapUpError("session_not_found", `no session matching "${input2.sourceRef}" in this project \u2014 use \`keryx sessions list\``);
@@ -16508,9 +16234,9 @@ async function resolveSessionWrapUp(input2) {
     throw new SessionWrapUpError("session_unreadable", `session "${summary.id}" could not be read: ${cause.message}`);
   }
   const relPath = sessionEvidenceRef(input2.workspaceId, summary.id).slice(2);
-  const evidenceDir = path76.dirname(relPath);
-  await mkdir29(path76.join(input2.cwd, evidenceDir), { recursive: true });
-  await writeFile27(path76.join(input2.cwd, relPath), markdown, "utf8");
+  const evidenceDir = path75.dirname(relPath);
+  await mkdir28(path75.join(input2.cwd, evidenceDir), { recursive: true });
+  await writeFile27(path75.join(input2.cwd, relPath), markdown, "utf8");
   const slate = await readSessionSlate(input2.cwd, summary.id);
   const diffText = await gitDiff(input2.cwd);
   const course = await readCourse(input2.cwd, slate?.course.flowRef);
@@ -16530,30 +16256,30 @@ async function resolveSessionWrapUp(input2) {
     ""
   ].join(`
 `);
-  const wrapUpRelPath = path76.join(evidenceDir, `${summary.id}.wrap-up.md`);
-  const diffRelPath = path76.join(evidenceDir, `${summary.id}.diff.txt`);
-  await writeFile27(path76.join(input2.cwd, wrapUpRelPath), wrapUpMarkdown, "utf8");
-  await writeFile27(path76.join(input2.cwd, diffRelPath), diffText, "utf8");
+  const wrapUpRelPath = path75.join(evidenceDir, `${summary.id}.wrap-up.md`);
+  const diffRelPath = path75.join(evidenceDir, `${summary.id}.diff.txt`);
+  await writeFile27(path75.join(input2.cwd, wrapUpRelPath), wrapUpMarkdown, "utf8");
+  await writeFile27(path75.join(input2.cwd, diffRelPath), diffText, "utf8");
   const observedAt = now().toISOString();
   const evidence = [
-    { kind: "wrap-up", uri: `./${wrapUpRelPath}`, revision: createHash12("sha256").update(wrapUpMarkdown).digest("hex"), observedAt },
-    { kind: "diff", uri: `./${diffRelPath}`, revision: createHash12("sha256").update(diffText).digest("hex"), observedAt },
-    { kind: "session", uri: `./${relPath}`, revision: createHash12("sha256").update(markdown).digest("hex"), observedAt }
+    { kind: "wrap-up", uri: `./${wrapUpRelPath}`, revision: createHash11("sha256").update(wrapUpMarkdown).digest("hex"), observedAt },
+    { kind: "diff", uri: `./${diffRelPath}`, revision: createHash11("sha256").update(diffText).digest("hex"), observedAt },
+    { kind: "session", uri: `./${relPath}`, revision: createHash11("sha256").update(markdown).digest("hex"), observedAt }
   ];
   return {
     workspaceId: input2.workspaceId,
     sourceRevision: summary.updatedAt,
     summary: `Session "${summary.title}" (${summary.archiveMessageCount} messages${summary.model ? `, ${summary.provider ?? "?"}/${summary.model}` : ""})`,
     evidence,
-    expiresAt: new Date(now().getTime() + WRAP_UP_TTL_MS2).toISOString()
+    expiresAt: new Date(now().getTime() + WRAP_UP_TTL_MS).toISOString()
   };
 }
-var WRAP_UP_TTL_MS2, SessionWrapUpError;
+var WRAP_UP_TTL_MS, SessionWrapUpError;
 var init_session_wrap_up = __esm(() => {
   init_store3();
   init_machine_wrap_up();
   init_slate_course();
-  WRAP_UP_TTL_MS2 = 60 * 60 * 1000;
+  WRAP_UP_TTL_MS = 60 * 60 * 1000;
   SessionWrapUpError = class SessionWrapUpError extends Error {
     code;
     constructor(code, message) {
@@ -16564,17 +16290,17 @@ var init_session_wrap_up = __esm(() => {
 });
 
 // src/sac/review-confirm-token.ts
-import { createHash as createHash13, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash12, randomBytes as randomBytes2 } from "crypto";
 import { readFile as readFile35 } from "fs/promises";
-import path77 from "path";
+import path76 from "path";
 function confirmTokenPath(cwd, workspaceId, proposalId) {
-  return path77.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.confirm-token.json`);
+  return path76.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.confirm-token.json`);
 }
 function confirmReceiptPath(cwd, workspaceId, proposalId, idempotencyKey) {
-  return path77.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${sha2562(idempotencyKey)}.confirm-receipt.json`);
+  return path76.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${sha256(idempotencyKey)}.confirm-receipt.json`);
 }
-function sha2562(text) {
-  return createHash13("sha256").update(text).digest("hex");
+function sha256(text) {
+  return createHash12("sha256").update(text).digest("hex");
 }
 async function mintConfirmToken(cwd, workspaceId, proposalId, deps = {}) {
   const now = deps.now ?? (() => new Date);
@@ -16585,7 +16311,7 @@ async function mintConfirmToken(cwd, workspaceId, proposalId, deps = {}) {
   const file = confirmTokenPath(cwd, workspaceId, proposalId);
   const stored = {
     schemaVersion: 1,
-    hash: sha2562(token),
+    hash: sha256(token),
     workspaceId,
     proposalId,
     mintedAt: mintedAt.toISOString(),
@@ -16612,7 +16338,7 @@ async function consumeConfirmToken(cwd, workspaceId, proposalId, idempotencyKey,
     } catch (error2) {
       return { ok: false, reason: isNotFound(error2) ? "token_required" : "token_invalid" };
     }
-    if (stored.usedAt !== undefined || new Date(stored.expiresAt).getTime() <= now().getTime() || stored.hash !== sha2562(token) || stored.workspaceId !== workspaceId || stored.proposalId !== proposalId) {
+    if (stored.usedAt !== undefined || new Date(stored.expiresAt).getTime() <= now().getTime() || stored.hash !== sha256(token) || stored.workspaceId !== workspaceId || stored.proposalId !== proposalId) {
       return { ok: false, reason: "token_invalid" };
     }
     const consumed2 = { ...stored, usedAt: now().toISOString() };
@@ -16699,17 +16425,17 @@ function round2(value) {
 var init_dedup = () => {};
 
 // src/sac/proposal-evidence.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { readFile as readFile36 } from "fs/promises";
-import path78 from "path";
+import path77 from "path";
 function proposalPath(cwd, workspaceId, proposalId) {
-  return path78.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
+  return path77.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
 }
 function ownerReceiptPath(cwd, owner, workspaceId, idempotencyKey) {
-  return path78.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-receipts`, `${idempotencyKey}.json`);
+  return path77.join(cwd, ".metaproject", "workspaces", workspaceId, `${owner}-write-receipts`, `${idempotencyKey}.json`);
 }
 function proposalNotePath(cwd, workspaceId, proposalId) {
-  return path78.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.note.txt`);
+  return path77.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.note.txt`);
 }
 async function readVerifiedProposalEvidence(cwd, workspaceId, proposalId) {
   let proposal;
@@ -16723,11 +16449,11 @@ async function readVerifiedProposalEvidence(cwd, workspaceId, proposalId) {
     return { ok: false, code: "no_evidence_to_write" };
   let content;
   try {
-    content = await readFile36(path78.join(cwd, evidence.uri), "utf8");
+    content = await readFile36(path77.join(cwd, evidence.uri), "utf8");
   } catch {
     return { ok: false, code: "evidence_file_unreadable" };
   }
-  if (createHash14("sha256").update(content).digest("hex") !== evidence.revision) {
+  if (createHash13("sha256").update(content).digest("hex") !== evidence.revision) {
     return { ok: false, code: "evidence_revision_mismatch" };
   }
   return { proposal, evidence, content };
@@ -16741,8 +16467,8 @@ var init_proposal_evidence = () => {};
 
 // src/sac/decision-dedup.ts
 import { readFile as readFile37, readdir as readdir10 } from "fs/promises";
-import { randomUUID as randomUUID10 } from "crypto";
-import path79 from "path";
+import { randomUUID as randomUUID9 } from "crypto";
+import path78 from "path";
 function asMemoryStatus(value) {
   return MEMORY_STATUSES.includes(value) ? value : "draft";
 }
@@ -16769,14 +16495,14 @@ function extractHeaderField(content, field3) {
 async function resolveWorkspaceModule(cwd, workspaceId) {
   try {
     const service = new WorkspaceService({ workspaceRoot: cwd, authorizationServer: localWorkspaceAuthorizationServer(), strictGuard: { mode: "strict", availability: "available", decision: "pass", policyRevision: "local-offline-v1" } });
-    const manifest = await service.show({ request: undefined, requestCorrelationId: randomUUID10(), workspaceId });
+    const manifest = await service.show({ request: undefined, requestCorrelationId: randomUUID9(), workspaceId });
     return manifest.resources.find((r) => r.kind === "component")?.uri ?? null;
   } catch {
     return null;
   }
 }
 async function collectWikiDecisionEntries(cwd) {
-  const dir = path79.join(cwd, ".metaproject", "wiki", "decisions");
+  const dir = path78.join(cwd, ".metaproject", "wiki", "decisions");
   let files;
   try {
     files = (await readdir10(dir)).filter((name) => name.endsWith(".md"));
@@ -16785,12 +16511,12 @@ async function collectWikiDecisionEntries(cwd) {
   }
   const entries = [];
   for (const file of files) {
-    const absolutePath = path79.join(dir, file);
+    const absolutePath = path78.join(dir, file);
     try {
       const content = await readFile37(absolutePath, "utf8");
       entries.push({
         absolutePath,
-        relativePath: path79.posix.join("decisions", file),
+        relativePath: path78.posix.join("decisions", file),
         type: extractHeaderField(content, "Type") ?? "decision",
         title: extractTitle(content),
         version: extractHeaderField(content, "Version") ?? null,
@@ -16909,13 +16635,13 @@ var init_decision_dedup = __esm(() => {
 });
 
 // src/memory/write.ts
-import { mkdir as mkdir30, open, readFile as readFile38, rename as rename3, rm as rm5, writeFile as writeFile28 } from "fs/promises";
-import path80 from "path";
+import { mkdir as mkdir29, open, readFile as readFile38, rename as rename3, rm as rm5, writeFile as writeFile28 } from "fs/promises";
+import path79 from "path";
 async function resolveCanonicalEntryPath(cwd, relativePath) {
-  const root = path80.resolve(memoryRoot(cwd));
-  const absolutePath = path80.resolve(root, relativePath);
-  const normalized = toPosix2(path80.relative(root, absolutePath));
-  if (!normalized || normalized.startsWith("../") || path80.isAbsolute(normalized) || !normalized.endsWith(".md")) {
+  const root = path79.resolve(memoryRoot(cwd));
+  const absolutePath = path79.resolve(root, relativePath);
+  const normalized = toPosix2(path79.relative(root, absolutePath));
+  if (!normalized || normalized.startsWith("../") || path79.isAbsolute(normalized) || !normalized.endsWith(".md")) {
     return null;
   }
   return { absolutePath, relativePath: normalized };
@@ -17010,9 +16736,9 @@ function validateNextEntry(relativePath, content) {
   return null;
 }
 async function replaceAtomically(target, content) {
-  const dir = path80.dirname(target);
-  await mkdir30(dir, { recursive: true });
-  const tmp = path80.join(dir, `.${path80.basename(target)}.keryx-tmp-${process.pid}-${Math.random().toString(16).slice(2)}`);
+  const dir = path79.dirname(target);
+  await mkdir29(dir, { recursive: true });
+  const tmp = path79.join(dir, `.${path79.basename(target)}.keryx-tmp-${process.pid}-${Math.random().toString(16).slice(2)}`);
   try {
     await writeFile28(tmp, content, "utf8");
     const file = await open(tmp, "r");
@@ -17041,14 +16767,14 @@ function asPair(result, prior) {
     return { status: "skipped", paths: [...prior, result.path], warnings: result.warnings, reason: result.reason };
   return { status: "error", paths: [...prior, result.path], warnings: result.warnings, error: result.error };
 }
-function persistenceError(path81, cause, warnings) {
-  return { status: "error", path: path81, warnings, error: { code: "persistence-failed", message: message(cause) } };
+function persistenceError(path80, cause, warnings) {
+  return { status: "error", path: path80, warnings, error: { code: "persistence-failed", message: message(cause) } };
 }
 function header(content, name) {
   return content.match(new RegExp(`^${name}:\\s*(.+)$`, "mi"))?.[1]?.trim() ?? null;
 }
 function toPosix2(value) {
-  return value.split(path80.sep).join("/");
+  return value.split(path79.sep).join("/");
 }
 function message(cause) {
   return cause instanceof Error ? cause.message : String(cause);
@@ -17060,8 +16786,8 @@ var init_write = __esm(() => {
 });
 
 // src/sac/memory-owner-writer.ts
-import { mkdir as mkdir31, readFile as readFile39, writeFile as writeFile29 } from "fs/promises";
-import path81 from "path";
+import { mkdir as mkdir30, readFile as readFile39, writeFile as writeFile29 } from "fs/promises";
+import path80 from "path";
 function renderWrapUpMemoryEntry(input2) {
   const note2 = input2.note?.trim();
   return `# ${input2.title}
@@ -17146,7 +16872,7 @@ function createRealMemoryOwnerWriter(cwd, opts) {
         targetRef: `./memory/${result.path}`,
         completedAt: now().toISOString()
       };
-      await mkdir31(path81.dirname(ownerReceiptPath(cwd, "memory", intent.workspaceId, intent.idempotencyKey)), { recursive: true });
+      await mkdir30(path80.dirname(ownerReceiptPath(cwd, "memory", intent.workspaceId, intent.idempotencyKey)), { recursive: true });
       await writeFile29(ownerReceiptPath(cwd, "memory", intent.workspaceId, intent.idempotencyKey), `${JSON.stringify(receipt, null, 2)}
 `, "utf8");
       return receipt;
@@ -17161,7 +16887,7 @@ var init_memory_owner_writer = __esm(() => {
 
 // src/sac/wiki-owner-writer.ts
 import { readFile as readFile40 } from "fs/promises";
-import path82 from "path";
+import path81 from "path";
 function renderWrapUpDecisionPage(input2) {
   const note2 = input2.note?.trim();
   return `# ${input2.title}
@@ -17202,7 +16928,7 @@ export is the source of truth for what actually happened.
 `;
 }
 function wikiPageRelativePath(proposalId) {
-  return path82.posix.join("decisions", `sac-${proposalId}.md`);
+  return path81.posix.join("decisions", `sac-${proposalId}.md`);
 }
 function createRealWikiOwnerWriter(cwd, opts) {
   const now = opts?.now ?? (() => new Date);
@@ -17239,7 +16965,7 @@ function createRealWikiOwnerWriter(cwd, opts) {
       const guard = await guardOutput({ cwd, content, target: "wiki", source: "tool-output", path: `wiki/${relativePath}` });
       if (!guard.allowed)
         return { ok: false, code: `security_gate_${guard.reason ?? "blocked"}` };
-      await writeFileAtomic(path82.join(cwd, ".metaproject", "wiki", relativePath), content);
+      await writeFileAtomic(path81.join(cwd, ".metaproject", "wiki", relativePath), content);
       const receipt = {
         receiptRef: `./wiki/${relativePath.replace(/\.md$/, "")}.receipt.json`,
         targetRef: `./wiki/${relativePath}`,
@@ -17258,23 +16984,23 @@ var init_wiki_owner_writer = __esm(() => {
 });
 
 // src/gdskills/project-skills.ts
-import { mkdir as mkdir32, readFile as readFile41, stat as stat4 } from "fs/promises";
-import path83 from "path";
+import { mkdir as mkdir31, readFile as readFile41, stat as stat4 } from "fs/promises";
+import path82 from "path";
 async function createProjectSkill(projectRoot, options) {
-  const metaprojectRoot = path83.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path82.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
   const moduleName = slugify3(options.module ?? inferModule(options.target));
   const skillName = slugify3(options.name ?? inferSkillName(options.target));
   const format = options.format ?? "auto";
-  const packageRoot = path83.join(metaprojectRoot, "project-skills", moduleName, skillName);
-  const relativeSkillPath = toPosix(path83.relative(projectRoot, packageRoot));
+  const packageRoot = path82.join(metaprojectRoot, "project-skills", moduleName, skillName);
+  const relativeSkillPath = toPosix(path82.relative(projectRoot, packageRoot));
   const evidence = await collectEvidence(projectRoot, options.target);
   const warnings = collectWarnings(evidence, format);
   const files = filesForPackage(packageRoot, format);
   if (!options.dryRun) {
-    await withFileLock2(path83.join(metaprojectRoot, "data", "gdskills", "project-skills.lock"), async () => {
+    await withFileLock2(path82.join(metaprojectRoot, "data", "gdskills", "project-skills.lock"), async () => {
       await writeProjectSkillPackage({
         projectRoot,
         packageRoot,
@@ -17301,7 +17027,7 @@ async function createProjectSkill(projectRoot, options) {
     name: skillName,
     target: options.target,
     skillPath: relativeSkillPath,
-    files: files.map((filePath) => toPosix(path83.relative(projectRoot, filePath))),
+    files: files.map((filePath) => toPosix(path82.relative(projectRoot, filePath))),
     warnings,
     dryRun: options.dryRun === true
   };
@@ -17323,31 +17049,31 @@ async function writeProjectSkillPackage({
 }) {
   const packageFormat = format === "single" ? "single" : "package";
   const skillContent = renderProjectSkill({ moduleName, skillName, target, evidence, packageFormat });
-  const relativeSkillMdPath = toPosix(path83.join(path83.relative(projectRoot, packageRoot), "SKILL.md"));
+  const relativeSkillMdPath = toPosix(path82.join(path82.relative(projectRoot, packageRoot), "SKILL.md"));
   const guard = await guardOutput({ cwd: projectRoot, content: skillContent, target: "skill", source: "generated", path: relativeSkillMdPath });
   if (!guard.allowed) {
     throw new Error(`Project skill blocked by the security gate: ${guard.reason ?? "policy violation"}`);
   }
-  await mkdir32(packageRoot, { recursive: true });
-  const skillPath = path83.join(packageRoot, "SKILL.md");
+  await mkdir31(packageRoot, { recursive: true });
+  const skillPath = path82.join(packageRoot, "SKILL.md");
   await writeFileAtomic(skillPath, skillContent);
-  const changelogPath = path83.join(packageRoot, "skill-changelog.md");
+  const changelogPath = path82.join(packageRoot, "skill-changelog.md");
   if (!await pathExists(changelogPath)) {
     await writeFileAtomic(changelogPath, renderSkillChangelog({ moduleName, skillName, target }));
   }
   if (packageFormat === "package") {
-    await mkdir32(path83.join(packageRoot, "references"), { recursive: true });
-    await mkdir32(path83.join(packageRoot, "templates"), { recursive: true });
-    await writeFileAtomic(path83.join(packageRoot, "references", "context.md"), renderReferenceContext({ moduleName, skillName, target, evidence }));
-    await writeFileAtomic(path83.join(packageRoot, "templates", "README.md"), renderTemplatesReadme({ moduleName, skillName }));
-    await writeFileAtomic(path83.join(packageRoot, "verification.md"), renderVerification({ moduleName, skillName, evidence }));
+    await mkdir31(path82.join(packageRoot, "references"), { recursive: true });
+    await mkdir31(path82.join(packageRoot, "templates"), { recursive: true });
+    await writeFileAtomic(path82.join(packageRoot, "references", "context.md"), renderReferenceContext({ moduleName, skillName, target, evidence }));
+    await writeFileAtomic(path82.join(packageRoot, "templates", "README.md"), renderTemplatesReadme({ moduleName, skillName }));
+    await writeFileAtomic(path82.join(packageRoot, "verification.md"), renderVerification({ moduleName, skillName, evidence }));
   }
 }
 async function collectEvidence(projectRoot, target) {
-  const absoluteTarget = path83.resolve(projectRoot, target);
+  const absoluteTarget = path82.resolve(projectRoot, target);
   const targetExists = await pathExists(absoluteTarget);
   const targetKind = await classifyTarget(absoluteTarget, targetExists);
-  const maybeRelativeTarget = targetExists ? toPosix(path83.relative(projectRoot, absoluteTarget)) : undefined;
+  const maybeRelativeTarget = targetExists ? toPosix(path82.relative(projectRoot, absoluteTarget)) : undefined;
   const graphArtifacts = await existingRelativePaths(projectRoot, [
     ".metaproject/data/gdgraph/artifacts/summary.md",
     ".metaproject/data/gdgraph/artifacts/module-map.json"
@@ -17377,7 +17103,7 @@ async function classifyTarget(absoluteTarget, targetExists) {
 async function existingRelativePaths(projectRoot, candidates) {
   const existing = [];
   for (const candidate of candidates) {
-    if (await pathExists(path83.join(projectRoot, candidate))) {
+    if (await pathExists(path82.join(projectRoot, candidate))) {
       existing.push(candidate);
     }
   }
@@ -17404,17 +17130,17 @@ function collectWarnings(evidence, format) {
 }
 function filesForPackage(packageRoot, format) {
   const base = [
-    path83.join(packageRoot, "SKILL.md"),
-    path83.join(packageRoot, "skill-changelog.md")
+    path82.join(packageRoot, "SKILL.md"),
+    path82.join(packageRoot, "skill-changelog.md")
   ];
   if (format === "single") {
     return base;
   }
   return [
     ...base,
-    path83.join(packageRoot, "verification.md"),
-    path83.join(packageRoot, "references", "context.md"),
-    path83.join(packageRoot, "templates", "README.md")
+    path82.join(packageRoot, "verification.md"),
+    path82.join(packageRoot, "references", "context.md"),
+    path82.join(packageRoot, "templates", "README.md")
   ];
 }
 function renderProjectSkill({
@@ -17633,7 +17359,7 @@ keryx skills verify ${moduleName}/${skillName}
 `;
 }
 async function updateManifest(projectRoot, entry) {
-  const manifestPath = path83.join(projectRoot, ".metaproject", "metaproject.json");
+  const manifestPath = path82.join(projectRoot, ".metaproject", "metaproject.json");
   const manifest = await readJsonFileOr(manifestPath, {});
   manifest.modules ??= {};
   manifest.modules.gdskills ??= {};
@@ -17647,8 +17373,8 @@ async function updateManifest(projectRoot, entry) {
 `);
 }
 async function updateSkillsCatalog(projectRoot) {
-  const manifestPath = path83.join(projectRoot, ".metaproject", "metaproject.json");
-  const catalogPath = path83.join(projectRoot, ".metaproject", "skills", "catalog.md");
+  const manifestPath = path82.join(projectRoot, ".metaproject", "metaproject.json");
+  const catalogPath = path82.join(projectRoot, ".metaproject", "skills", "catalog.md");
   const manifest = await readJsonFileOr(manifestPath, {});
   const registry = manifest.modules?.gdskills?.projectSkillRegistry ?? [];
   const rows = registry.length > 0 ? registry.map((entry) => `| ${entry.module} | ${entry.name} | \`${entry.target}\` | ${entry.path}/SKILL.md |`).join(`
@@ -17688,7 +17414,7 @@ function inferModule(target) {
 }
 function inferSkillName(target) {
   const normalized = target.trim().replace(/[#:]+/g, "/");
-  const base = path83.basename(normalized).replace(/\.[^.]+$/, "");
+  const base = path82.basename(normalized).replace(/\.[^.]+$/, "");
   return base || "entity";
 }
 function slugify3(value) {
@@ -17766,9 +17492,9 @@ var init_skill_owner_writer = __esm(() => {
 });
 
 // src/sac/proposal-lifecycle.ts
-import { createHash as createHash15, randomUUID as randomUUID11 } from "crypto";
-import { appendFile as appendFile3, mkdir as mkdir33, readdir as readdir11, readFile as readFile43 } from "fs/promises";
-import path84 from "path";
+import { createHash as createHash14, randomUUID as randomUUID10 } from "crypto";
+import { appendFile as appendFile3, mkdir as mkdir32, readdir as readdir11, readFile as readFile43 } from "fs/promises";
+import path83 from "path";
 
 class ProposalLifecycleService {
   options;
@@ -17776,7 +17502,7 @@ class ProposalLifecycleService {
   now;
   constructor(options) {
     this.options = options;
-    this.root = path84.resolve(options.workspaceRoot);
+    this.root = path83.resolve(options.workspaceRoot);
     this.now = options.now ?? (() => new Date);
   }
   async create(input2) {
@@ -17795,7 +17521,7 @@ class ProposalLifecycleService {
       if (manifest.status === "archived")
         throw new ProposalLifecycleError("guard_denied", "workspace is archived");
       const file = this.proposalPath(workspaceId, proposal.id);
-      await mkdir33(path84.dirname(file), { recursive: true, mode: 448 });
+      await mkdir32(path83.dirname(file), { recursive: true, mode: 448 });
       return withFileLock2(`${file}.lock`, async () => {
         const consume = this.options.wrapUpAuthority.consume(input2.wrapUp, { actor, workspaceId });
         if (consume !== "ok")
@@ -17823,7 +17549,7 @@ class ProposalLifecycleService {
     return this.options.workspaces.withAuthorizedActor({ actorContext: actor, workspaceId: input2.workspaceId, action: "review", execute: async (manifest) => {
       const proposal = await this.loadProposal(input2.workspaceId, input2.proposalId);
       const ledger = this.ledgerPath(input2.workspaceId);
-      await mkdir33(path84.dirname(ledger), { recursive: true, mode: 448 });
+      await mkdir32(path83.dirname(ledger), { recursive: true, mode: 448 });
       return withFileLock2(`${ledger}.lock`, async () => {
         const records = (await this.records(ledger)).filter((record) => record.proposalId === proposal.id);
         const events = records.filter((record) => record.recordType === "proposal-transition");
@@ -17864,7 +17590,7 @@ class ProposalLifecycleService {
     } });
   }
   async listProposedProposals(workspaceId) {
-    const proposalsDir = path84.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals");
+    const proposalsDir = path83.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals");
     let entries;
     try {
       entries = (await readdir11(proposalsDir)).filter((name) => name.endsWith(".json"));
@@ -17876,7 +17602,7 @@ class ProposalLifecycleService {
     const proposals = [];
     for (const entry of entries) {
       try {
-        const parsed = JSON.parse(await readFile43(path84.join(proposalsDir, entry), "utf8"));
+        const parsed = JSON.parse(await readFile43(path83.join(proposalsDir, entry), "utf8"));
         if (parsed.recordType === "proposal-created")
           proposals.push(parsed);
       } catch {}
@@ -17935,7 +17661,7 @@ class ProposalLifecycleService {
   }
   async transition(input2) {
     const previous = input2.records.at(-1);
-    const base = { schemaVersion: "1.0", recordType: "proposal-transition", eventId: `event-${randomUUID11().replace(/-/g, "").slice(0, 16)}`, proposalId: input2.proposal.id, proposalRevision: input2.proposal.proposalRevision, correlationId: input2.input.requestCorrelationId, workspaceId: input2.proposal.workspaceId, sequence: input2.records.length + 1, priorEventHash: previous ? recordHash(previous) : hash("GENESIS"), fromStatus: "proposed", toStatus: input2.outcome, occurredAt: this.timestamp(), idempotencyKey: input2.input.idempotencyKey };
+    const base = { schemaVersion: "1.0", recordType: "proposal-transition", eventId: `event-${randomUUID10().replace(/-/g, "").slice(0, 16)}`, proposalId: input2.proposal.id, proposalRevision: input2.proposal.proposalRevision, correlationId: input2.input.requestCorrelationId, workspaceId: input2.proposal.workspaceId, sequence: input2.records.length + 1, priorEventHash: previous ? recordHash(previous) : hash("GENESIS"), fromStatus: "proposed", toStatus: input2.outcome, occurredAt: this.timestamp(), idempotencyKey: input2.input.idempotencyKey };
     if (input2.outcome === "accepted") {
       const write = input2.targetWrite;
       if (!write?.ok)
@@ -17982,7 +17708,7 @@ class ProposalLifecycleService {
       if (!isNotFound(error2))
         throw error2;
     }
-    const intent = { schemaVersion: "1.0", recordType: "proposal-write-intent", intentId: `intent-${randomUUID11().replace(/-/g, "").slice(0, 16)}`, proposalId: proposal.id, proposalRevision: proposal.proposalRevision, correlationId: input2.requestCorrelationId, workspaceId: proposal.workspaceId, sequence: records.length + 1, priorEventHash: records.length ? recordHash(records.at(-1)) : hash("GENESIS"), idempotencyKey: input2.idempotencyKey, reviewer: { subject: actor.subject, authority: reviewerAuthority, trustedPrincipalRef: "./principals/local" }, approvalRef, security: { gate: "pass", policyRef: this.options.policyRef, policyRevision }, evidence: proposal.evidence, createdAt: this.timestamp() };
+    const intent = { schemaVersion: "1.0", recordType: "proposal-write-intent", intentId: `intent-${randomUUID10().replace(/-/g, "").slice(0, 16)}`, proposalId: proposal.id, proposalRevision: proposal.proposalRevision, correlationId: input2.requestCorrelationId, workspaceId: proposal.workspaceId, sequence: records.length + 1, priorEventHash: records.length ? recordHash(records.at(-1)) : hash("GENESIS"), idempotencyKey: input2.idempotencyKey, reviewer: { subject: actor.subject, authority: reviewerAuthority, trustedPrincipalRef: "./principals/local" }, approvalRef, security: { gate: "pass", policyRef: this.options.policyRef, policyRevision }, evidence: proposal.evidence, createdAt: this.timestamp() };
     await this.validateRecord(intent);
     await this.writeImmutable(this.intentPath(proposal.workspaceId, proposal.id, input2.idempotencyKey), intent);
     await appendFile3(ledger, `${JSON.stringify(intent)}
@@ -18050,7 +17776,7 @@ class ProposalLifecycleService {
       throw new ProposalLifecycleError("invalid_proposal", validation.errors.map((error2) => error2.code).join(","));
   }
   async reviewDecision(proposal, actor, reviewerAuthority, input2, decision, targetWrite, policyRevision) {
-    const base = { schemaVersion: "1.0", id: `review-${randomUUID11().replace(/-/g, "").slice(0, 16)}`, proposalId: proposal.id, proposalRevision: proposal.proposalRevision, correlationId: input2.requestCorrelationId, workspaceId: proposal.workspaceId, decision, reviewer: { subject: actor.subject, authority: reviewerAuthority, trustedPrincipalRef: "./principals/local" }, decidedAt: this.timestamp(), idempotencyKey: input2.idempotencyKey };
+    const base = { schemaVersion: "1.0", id: `review-${randomUUID10().replace(/-/g, "").slice(0, 16)}`, proposalId: proposal.id, proposalRevision: proposal.proposalRevision, correlationId: input2.requestCorrelationId, workspaceId: proposal.workspaceId, decision, reviewer: { subject: actor.subject, authority: reviewerAuthority, trustedPrincipalRef: "./principals/local" }, decidedAt: this.timestamp(), idempotencyKey: input2.idempotencyKey };
     if (decision === "accepted" && targetWrite?.ok)
       Object.assign(base, { security: { gate: "pass", policyRef: this.options.policyRef, policyRevision }, freshness: { state: "fresh", verifiedAt: this.timestamp(), evidenceRevision: proposal.evidence[0].revision }, targetWrite: { receiptRef: targetWrite.receipt.receiptRef, targetRef: targetWrite.receipt.targetRef, completedAt: targetWrite.receipt.completedAt } });
     else
@@ -18082,28 +17808,28 @@ class ProposalLifecycleService {
     }
   }
   proposalPath(workspaceId, proposalId) {
-    return path84.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
+    return path83.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.json`);
   }
   decisionRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.decision.json`;
   }
   decisionPath(workspaceId, proposalId, key) {
-    return path84.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.decision.json`);
+    return path83.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.decision.json`);
   }
   approvalRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.approval.json`;
   }
   approvalPath(workspaceId, proposalId, key) {
-    return path84.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.approval.json`);
+    return path83.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.approval.json`);
   }
   writeResultPath(workspaceId, proposalId, key) {
-    return path84.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-result.json`);
+    return path83.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-result.json`);
   }
   intentRef(proposalId, key) {
     return `./proposals/${proposalId}.${hash(key)}.write-intent.json`;
   }
   intentPath(workspaceId, proposalId, key) {
-    return path84.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-intent.json`);
+    return path83.join(this.root, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${hash(key)}.write-intent.json`);
   }
   async loadWriteResult(workspaceId, proposalId, key) {
     try {
@@ -18130,14 +17856,14 @@ class ProposalLifecycleService {
     }
   }
   ledgerPath(workspaceId) {
-    return path84.join(this.root, ".metaproject", "workspaces", workspaceId, "activity.jsonl");
+    return path83.join(this.root, ".metaproject", "workspaces", workspaceId, "activity.jsonl");
   }
   timestamp() {
     return this.now().toISOString();
   }
 }
 function hash(value) {
-  return createHash15("sha256").update(value).digest("hex");
+  return createHash14("sha256").update(value).digest("hex");
 }
 function recordHash(value) {
   return hash(JSON.stringify(value));
@@ -18235,9 +17961,9 @@ var init_proposal_lifecycle = __esm(() => {
 });
 
 // src/harness/tool/builtin/workspace-lifecycle-tool.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 import { writeFile as writeFile30 } from "fs/promises";
-import path85 from "path";
+import path84 from "path";
 function service(cwd) {
   return new WorkspaceService({
     workspaceRoot: cwd,
@@ -18248,11 +17974,11 @@ function service(cwd) {
 function errorOutput(prefix, cause) {
   return { output: `${prefix}: ${cause instanceof Error ? cause.message : String(cause)}`, isError: true };
 }
-function workspaceCreateTool(cwd) {
+function workspaceCreateTool(cwd, getSessionDir) {
   return {
     definition: {
       name: "workspace_create",
-      description: "Create a new Shared Agent Context (SAC) workspace to bind this session's work to. Call workspace_list FIRST and only create when no existing workspace already fits the current topic \u2014 a workspace is meant to persist and accumulate context across sessions, not to be created per-session. Input: { title: string, component?: string }. `component` is an optional workspace-relative path this workspace is scoped to.",
+      description: "Create a new Shared Agent Context (SAC) workspace to bind this session's work to. Call workspace_list FIRST and only create when no existing workspace already fits the current topic \u2014 a workspace is meant to persist and accumulate context across sessions, not to be created per-session. The created workspace is BOUND to this session's slate (its workspaceId is written to the slate), so wrap-up can propose into it. Input: { title: string, component?: string }. `component` is an optional workspace-relative path this workspace is scoped to.",
       inputSchema: {
         type: "object",
         properties: { title: { type: "string" }, component: { type: "string" } },
@@ -18269,11 +17995,23 @@ function workspaceCreateTool(cwd) {
       try {
         const workspace = await service(cwd).create({
           request: undefined,
-          requestCorrelationId: randomUUID12(),
+          requestCorrelationId: randomUUID11(),
           id: newWorkspaceId(),
           title,
           ...component ? { component: { kind: "component", uri: component } } : {}
         });
+        const dir = getSessionDir?.();
+        if (dir !== undefined) {
+          try {
+            await writeSlate(dir, (prev) => ({
+              anchors: prev?.anchors ?? { root: "", touched: [] },
+              course: prev?.course ?? {},
+              seeds: prev?.seeds ?? [],
+              ...prev !== undefined ? { workspaceId: prev.workspaceId } : {},
+              workspaceId: workspace.id
+            }));
+          } catch {}
+        }
         return { output: JSON.stringify(workspace, null, 2), isError: false };
       } catch (cause) {
         return errorOutput("workspace_create failed", cause);
@@ -18296,7 +18034,7 @@ function workspaceListTool(cwd) {
     invoke: async (input2) => {
       const includeArchived = input2.includeArchived === true;
       try {
-        const workspaces = await service(cwd).list({ request: undefined, requestCorrelationId: randomUUID12(), includeArchived });
+        const workspaces = await service(cwd).list({ request: undefined, requestCorrelationId: randomUUID11(), includeArchived });
         return { output: JSON.stringify(workspaces, null, 2), isError: false };
       } catch (cause) {
         return errorOutput("workspace_list failed", cause);
@@ -18322,7 +18060,7 @@ function workspaceShowTool(cwd) {
       if (workspaceId.length === 0)
         return { output: "workspace_show requires a non-empty 'workspaceId'", isError: true };
       try {
-        const workspace = await service(cwd).show({ request: undefined, requestCorrelationId: randomUUID12(), workspaceId });
+        const workspace = await service(cwd).show({ request: undefined, requestCorrelationId: randomUUID11(), workspaceId });
         return { output: JSON.stringify(workspace, null, 2), isError: false };
       } catch (cause) {
         return errorOutput("workspace_show failed", cause);
@@ -18358,7 +18096,7 @@ function workspaceProposeTool(cwd, getSessionDir) {
         return { output: `workspace_propose: unrecognized 'kind' \u2014 expected one of: ${PROPOSAL_KINDS.join(", ")}`, isError: true };
       }
       const explicitSessionId = typeof input2.sessionId === "string" && input2.sessionId.length > 0 ? input2.sessionId : undefined;
-      const sessionRef = explicitSessionId ?? path85.basename(getSessionDir() ?? "");
+      const sessionRef = explicitSessionId ?? path84.basename(getSessionDir() ?? "");
       if (sessionRef.length === 0) {
         return { output: "workspace_propose: no 'sessionId' given and no active session in this run", isError: true };
       }
@@ -18367,7 +18105,7 @@ function workspaceProposeTool(cwd, getSessionDir) {
         if (!session)
           return { output: `workspace_propose: no session matching "${sessionRef}" in this project`, isError: true };
         const { service: lifecycle, wrapUpAuthority, authorizationServer } = createHarnessProposalLifecycleService(cwd, { workspaceId, ...note2 ? { note: note2 } : {} });
-        const requestCorrelationId = randomUUID12();
+        const requestCorrelationId = randomUUID11();
         const actor = await authorizationServer.actorContextFor(undefined, requestCorrelationId);
         if (!actor)
           return { output: "workspace_propose: trusted ActorContext is required", isError: true };
@@ -18376,7 +18114,7 @@ function workspaceProposeTool(cwd, getSessionDir) {
           request: undefined,
           requestCorrelationId,
           workspaceId,
-          id: `proposal-${randomUUID12().replace(/-/g, "").slice(0, 16)}`,
+          id: `proposal-${randomUUID11().replace(/-/g, "").slice(0, 16)}`,
           proposalRevision: "1",
           kind,
           wrapUp
@@ -18396,6 +18134,7 @@ var init_workspace_lifecycle_tool = __esm(() => {
   init_proposal_lifecycle();
   init_proposal_evidence();
   init_session_wrap_up();
+  init_slate();
   init_store3();
   PROPOSAL_KINDS = ["decision", "wiki-update", "memory-entry", "follow-up", "contract-change", "risk"];
 });
@@ -18445,7 +18184,7 @@ ${topicHint}
 ${existing.map((w) => `${w.id}: ${w.title}`).join(`
 `)}`;
   let modelResult;
-  const modelTurnTimeoutMs = input2.modelTurnTimeoutMs ?? DEFAULT_MODEL_TURN_TIMEOUT_MS2;
+  const modelTurnTimeoutMs = input2.modelTurnTimeoutMs ?? DEFAULT_MODEL_TURN_TIMEOUT_MS;
   const turn = runModelTurn({
     system,
     user,
@@ -18490,13 +18229,315 @@ ${existing.map((w) => `${w.id}: ${w.title}`).join(`
   const { id } = JSON.parse(created.output);
   return { ok: true, workspaceId: id, action: "created" };
 }
-var DEFAULT_MODEL_TURN_TIMEOUT_MS2 = 15000, TOPIC_HINT_MAX_LENGTH = 200;
+var DEFAULT_MODEL_TURN_TIMEOUT_MS = 15000, TOPIC_HINT_MAX_LENGTH = 200;
 var init_workspace_resolve = __esm(() => {
   init_redact();
   init_workspace_lifecycle_tool();
   init_single_turn();
 });
 
+// src/sac/machine-wrap-up.ts
+import { createHash as createHash15, randomUUID as randomUUID12 } from "crypto";
+import { execFile } from "child_process";
+import { mkdir as mkdir33 } from "fs/promises";
+import path85 from "path";
+import { promisify } from "util";
+function describeSource(source) {
+  return source === "parent" ? "parent" : `child:${source.childDispatchId}`;
+}
+function dedupedAttributedSeeds(slate) {
+  const seen = new Set;
+  const result = [];
+  const take = (seeds, source) => {
+    for (const seed of dedupeSeeds(seeds)) {
+      const key = seed.text.trim();
+      if (seen.has(key))
+        continue;
+      seen.add(key);
+      result.push({ text: seed.text, kind: seed.kind ?? "follow-up", source });
+    }
+  };
+  take(slate.seeds, "parent");
+  const childDispatches = slate.childDispatches ?? {};
+  for (const [dispatchId, dispatch] of Object.entries(childDispatches)) {
+    take(dispatch.seeds, { childDispatchId: dispatchId });
+  }
+  return result;
+}
+function groupSeedsByKind(slate) {
+  const map = new Map;
+  for (const seed of dedupedAttributedSeeds(slate)) {
+    const bucket = map.get(seed.kind);
+    if (bucket)
+      bucket.push(seed);
+    else
+      map.set(seed.kind, [seed]);
+  }
+  return map;
+}
+function sha2562(value) {
+  return createHash15("sha256").update(value).digest("hex");
+}
+async function gitDiff(cwd) {
+  try {
+    const { stdout: stdout2 } = await execFileAsync("git", ["diff"], { cwd, maxBuffer: 16 * 1024 * 1024 });
+    return stdout2;
+  } catch {
+    return "";
+  }
+}
+function diffStatLine(diffText) {
+  if (diffText.trim().length === 0)
+    return "no working-tree changes";
+  const added = (diffText.match(/^\+(?!\+\+)/gm) ?? []).length;
+  const removed = (diffText.match(/^-(?!--)/gm) ?? []).length;
+  return `working-tree diff: +${added}/-${removed} line(s)`;
+}
+function courseStatusLine(course) {
+  if (course.state !== "bound")
+    return "flow: unbound";
+  return `flow ${course.flowRef.uri} snapshot=${course.flowRef.snapshot} completed=${course.completed.length} next=${course.next.length} blocked=${course.blocked.length}`;
+}
+function mechanicalSummary(diffText, course) {
+  return `Mechanical wrap-up summary (model turn unavailable or timed out):
+${diffStatLine(diffText)}
+${courseStatusLine(course)}`;
+}
+async function resolveMachineWrapUp(input2) {
+  const now = input2.now ?? (() => new Date);
+  const diffText = await gitDiff(input2.cwd);
+  const course = await readCourse(input2.cwd, input2.slate.course.flowRef);
+  const seedsForKind = dedupedAttributedSeeds(input2.slate).filter((seed) => seed.kind === input2.kind);
+  const flowSnapshotJson = `${JSON.stringify(course, null, 2)}
+`;
+  const seedsJson = `${JSON.stringify(seedsForKind.map((seed) => ({ text: seed.text, source: describeSource(seed.source) })), null, 2)}
+`;
+  const sourceRevision = sha2562([diffText, flowSnapshotJson, seedsJson].join("\x00"));
+  const shortHash = sourceRevision.slice(0, 16);
+  const system = "Summarize ONLY the machine evidence provided below \u2014 a git diff, a Flow snapshot, and the Seeds captured " + "this session for one proposal kind. Never invent facts that are not present in the evidence.";
+  const user = `--- git diff ---
+${diffText.length > 0 ? diffText : "(no working-tree changes)"}
+
+` + `--- flow snapshot ---
+${flowSnapshotJson}
+` + `--- seeds (${input2.kind}) ---
+${seedsJson}`;
+  let modelResult;
+  const modelTurnTimeoutMs = input2.modelTurnTimeoutMs ?? DEFAULT_MODEL_TURN_TIMEOUT_MS2;
+  const turn = runModelTurn({
+    system,
+    user,
+    requestId: `machine-wrap-up-${shortHash}`,
+    ...input2.env !== undefined ? { env: input2.env } : {},
+    ...input2.providerFactory !== undefined ? { providerFactory: input2.providerFactory } : {}
+  }).then((result) => {
+    modelResult = result;
+    return "done";
+  });
+  let timer;
+  const expired = new Promise((resolve) => {
+    timer = setTimeout(() => resolve("timeout"), modelTurnTimeoutMs);
+  });
+  let raceOutcome;
+  try {
+    raceOutcome = await Promise.race([turn, expired]);
+  } finally {
+    if (timer !== undefined)
+      clearTimeout(timer);
+  }
+  let summary;
+  if (raceOutcome === "timeout") {
+    turn.catch(() => {});
+    summary = mechanicalSummary(diffText, course);
+  } else {
+    const result = modelResult;
+    if (result.text.trim().length === 0 && !result.credentialAvailable) {
+      return { ok: false, code: "no_credential" };
+    }
+    summary = result.text.trim().length > 0 ? result.text.trim() : mechanicalSummary(diffText, course);
+  }
+  const evidenceDir = path85.join(input2.cwd, ".metaproject", "workspaces", input2.workspaceId, "machine-evidence");
+  await mkdir33(evidenceDir, { recursive: true });
+  const diffFile = `${input2.kind}.${shortHash}.diff.txt`;
+  const flowFile = `${input2.kind}.${shortHash}.flow.json`;
+  const seedsFile = `${input2.kind}.${shortHash}.seeds.json`;
+  await writeFileAtomic(path85.join(evidenceDir, diffFile), diffText);
+  await writeFileAtomic(path85.join(evidenceDir, flowFile), flowSnapshotJson);
+  await writeFileAtomic(path85.join(evidenceDir, seedsFile), seedsJson);
+  const observedAt = now().toISOString();
+  const relBase = `./.metaproject/workspaces/${input2.workspaceId}/machine-evidence`;
+  const evidence = [
+    { kind: "diff", uri: `${relBase}/${diffFile}`, revision: sha2562(diffText), observedAt },
+    { kind: "flow", uri: `${relBase}/${flowFile}`, revision: sha2562(flowSnapshotJson), observedAt },
+    { kind: "seeds", uri: `${relBase}/${seedsFile}`, revision: sha2562(seedsJson), observedAt }
+  ];
+  return {
+    ok: true,
+    resolution: {
+      workspaceId: input2.workspaceId,
+      sourceRevision,
+      summary,
+      evidence,
+      expiresAt: new Date(now().getTime() + WRAP_UP_TTL_MS2).toISOString()
+    }
+  };
+}
+async function writeUnboundCandidateArtifact(dir, trigger, now, grouped, nonEmptyKinds) {
+  const archiveDir = path85.join(dir, "slate-archive");
+  await mkdir33(archiveDir, { recursive: true });
+  const nowIso2 = now().toISOString();
+  const filename = `${nowIso2.replace(/[:.]/g, "-")}-unbound-candidate.json`;
+  const content = {
+    recordType: "unbound-candidate",
+    trigger,
+    generatedAt: nowIso2,
+    groups: nonEmptyKinds.map((kind) => ({
+      kind,
+      seeds: (grouped.get(kind) ?? []).map((seed) => ({ text: seed.text, source: describeSource(seed.source) }))
+    }))
+  };
+  await writeFileAtomic(path85.join(archiveDir, filename), `${JSON.stringify(content, null, 2)}
+`);
+}
+async function writeWrapUpOutcomeArtifact(dir, trigger, now, groups) {
+  try {
+    const archiveDir = path85.join(dir, "slate-archive");
+    await mkdir33(archiveDir, { recursive: true });
+    const nowIso2 = now().toISOString();
+    const filename = `${nowIso2.replace(/[:.]/g, "-")}-wrap-up-outcome.json`;
+    const content = { recordType: "wrap-up-outcome", trigger, generatedAt: nowIso2, groups };
+    await writeFileAtomic(path85.join(archiveDir, filename), `${JSON.stringify(content, null, 2)}
+`);
+  } catch {}
+}
+async function proposeOneGroup(params) {
+  const wrapUpSource = params.wrapUpSource ?? "flow";
+  try {
+    const resolved = await resolveMachineWrapUp({
+      cwd: params.cwd,
+      workspaceId: params.workspaceId,
+      slate: params.slate,
+      kind: params.kind,
+      now: params.now,
+      ...params.env !== undefined ? { env: params.env } : {},
+      ...params.providerFactory !== undefined ? { providerFactory: params.providerFactory } : {},
+      ...params.modelTurnTimeoutMs !== undefined ? { modelTurnTimeoutMs: params.modelTurnTimeoutMs } : {}
+    });
+    if (!resolved.ok)
+      return { kind: params.kind, outcome: "no_credential" };
+    const flowEvidence = resolved.resolution.evidence.find((item) => item.kind === "flow");
+    const sourceRef = (flowEvidence ?? resolved.resolution.evidence[0]).uri;
+    const flowRef = params.slate.course.flowRef ?? "";
+    const dedupHash = sha2562(`${params.workspaceId}:${flowRef}:${resolved.resolution.sourceRevision}:${params.kind}`);
+    const proposalId = `wrapup-${dedupHash.slice(0, 32)}`;
+    const wrapUpAuthority = createTrustedWrapUpAuthority({
+      now: params.now,
+      resolveExplicitWrapUp: async (request) => {
+        if (request.source !== wrapUpSource) {
+          throw new Error(`machine-wrap-up only resolves "${wrapUpSource}" wrap-ups, got "${request.source}"`);
+        }
+        return resolved.resolution;
+      }
+    });
+    const { service: service2, authorizationServer } = createHarnessProposalLifecycleService(params.cwd, {
+      workspaceId: params.workspaceId,
+      now: params.now
+    });
+    const requestCorrelationId = randomUUID12();
+    const actor = await authorizationServer.actorContextFor(undefined, requestCorrelationId);
+    if (!actor)
+      throw new Error("trusted ActorContext is required for a machine wrap-up propose");
+    const provenance = await wrapUpAuthority.issue({ actor, source: wrapUpSource, sourceRef });
+    try {
+      const proposal = await service2.create({
+        request: undefined,
+        requestCorrelationId,
+        workspaceId: params.workspaceId,
+        id: proposalId,
+        proposalRevision: "1",
+        kind: params.kind,
+        wrapUp: provenance
+      });
+      return { kind: params.kind, outcome: "proposed", proposalId: proposal.id };
+    } catch (error2) {
+      if (error2 instanceof ProposalLifecycleError && error2.code === "conflict") {
+        return { kind: params.kind, outcome: "conflict" };
+      }
+      throw error2;
+    }
+  } catch (error2) {
+    const message2 = error2 instanceof Error ? error2.message : String(error2);
+    return { kind: params.kind, outcome: "error", message: message2 };
+  }
+}
+async function runWrapUp(input2) {
+  const now = input2.now ?? (() => new Date);
+  const grouped = groupSeedsByKind(input2.slate);
+  const nonEmptyKinds = [...grouped.keys()].filter((kind) => (grouped.get(kind)?.length ?? 0) > 0);
+  if (nonEmptyKinds.length === 0) {
+    return { groups: [] };
+  }
+  let workspaceId = input2.slate.workspaceId;
+  if (workspaceId === undefined && input2.wrapUpSource === "external-slate") {
+    await writeUnboundCandidateArtifact(input2.dir, input2.trigger, now, grouped, nonEmptyKinds);
+    const groups2 = nonEmptyKinds.map((kind) => ({ kind, outcome: "unbound-candidate" }));
+    await writeWrapUpOutcomeArtifact(input2.dir, input2.trigger, now, groups2);
+    return { groups: groups2 };
+  }
+  if (workspaceId === undefined) {
+    const topicHint = dedupedAttributedSeeds(input2.slate).map((seed) => seed.text).join("; ").trim().slice(0, 2000);
+    const resolver = input2.resolveWorkspace ?? resolveOrCreateWorkspace;
+    const resolved = await resolver({
+      cwd: input2.cwd,
+      topicHint: topicHint.length > 0 ? topicHint : "Untitled session wrap-up",
+      ...input2.env !== undefined ? { env: input2.env } : {},
+      ...input2.providerFactory !== undefined ? { providerFactory: input2.providerFactory } : {},
+      ...input2.modelTurnTimeoutMs !== undefined ? { modelTurnTimeoutMs: input2.modelTurnTimeoutMs } : {}
+    });
+    if (!resolved.ok) {
+      await writeUnboundCandidateArtifact(input2.dir, input2.trigger, now, grouped, nonEmptyKinds);
+      const groups2 = nonEmptyKinds.map((kind) => ({ kind, outcome: "unbound-candidate" }));
+      await writeWrapUpOutcomeArtifact(input2.dir, input2.trigger, now, groups2);
+      return { groups: groups2 };
+    }
+    workspaceId = resolved.workspaceId;
+    const boundWorkspaceId = resolved.workspaceId;
+    try {
+      await writeSlate(input2.dir, (prev) => ({
+        anchors: prev?.anchors ?? { root: "", touched: [] },
+        course: prev?.course ?? {},
+        seeds: prev?.seeds ?? [],
+        workspaceId: boundWorkspaceId
+      }));
+    } catch {}
+  }
+  const groups = await Promise.all(nonEmptyKinds.map((kind) => proposeOneGroup({
+    cwd: input2.cwd,
+    workspaceId,
+    slate: input2.slate,
+    kind,
+    now,
+    ...input2.wrapUpSource !== undefined ? { wrapUpSource: input2.wrapUpSource } : {},
+    ...input2.env !== undefined ? { env: input2.env } : {},
+    ...input2.providerFactory !== undefined ? { providerFactory: input2.providerFactory } : {},
+    ...input2.modelTurnTimeoutMs !== undefined ? { modelTurnTimeoutMs: input2.modelTurnTimeoutMs } : {}
+  })));
+  await writeWrapUpOutcomeArtifact(input2.dir, input2.trigger, now, groups);
+  return { groups };
+}
+var execFileAsync, WRAP_UP_TTL_MS2, DEFAULT_MODEL_TURN_TIMEOUT_MS2 = 30000;
+var init_machine_wrap_up = __esm(() => {
+  init_fs();
+  init_slate();
+  init_slate_course();
+  init_trusted_wrap_up();
+  init_proposal_lifecycle();
+  init_workspace_resolve();
+  init_single_turn();
+  execFileAsync = promisify(execFile);
+  WRAP_UP_TTL_MS2 = 60 * 60 * 1000;
+});
+
 // src/session/slate-lifecycle.ts
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -18870,8 +18911,8 @@ function buildAgentSystemInstruction(orient, ctx = {}) {
 ` + "- To find where a function/class/symbol is defined (or who calls it): call " + "**graph_symbol** with `{ name }` FIRST \u2014 it returns the exact file + line in one call. " + "read_file is capped at its first bytes only (see its own description) and cannot page " + "forward, so re-reading a large file to hunt for a symbol wastes calls without ever " + "reaching content past the cap; use graph_symbol (or search_code for a text pattern) " + `to get the location, THEN read_file only if you need surrounding context near it.
 ` + "- Prefer ONE correct shell_exec over many exploratory tool calls when the user asks " + `to run a known keryx workflow.
 ` + "- Tool-call budget: shell_exec, file-mutating shell, workspace_create/workspace_propose, and spawn_subagent " + "all share ONE small per-turn pool (distinct non-read actions), separate from the much larger read-tool pool. " + "search_code/graph_*/memory_search/read_wiki/wiki_*/test_related/health_status/flow_status/repomap/read_file/" + "list_dir do NOT touch it. Conserve the small pool: batch multiple shell steps into ONE call with `&&` instead " + "of issuing them one at a time, get a command's arguments right the first time instead of trying variants, and " + "for any check covered by a read tool above, use that tool instead of shelling out to the equivalent `keryx \u2026` " + `CLI command.
-` + "- This session has its own Slate (working-set scratch, not project knowledge): " + "**slate_read** shows the Course (if a Flow is bound) and Seeds recorded so far \u2014 nothing " + "here is auto-injected, so call it if you want to see it. **slate_write_seed** with " + "`{ text, kind? }` records a draft hypothesis/decision/follow-up worth a later human review " + "\u2014 use it for a real finding worth not losing (e.g. a root cause, a risk, a suggested " + `change), not for routine progress notes. A Seed is never accepted knowledge by itself.
-` + "- Shared Agent Context (SAC) workspaces hold accepted, evidence-backed project context " + "beyond this codebase. **workspace_list** with `{ includeArchived? }` shows every workspace " + "visible to you \u2014 call it first when the user references a shared team workspace or accepted " + "project context, or before creating a new workspace, to judge whether an existing one " + "already fits the current topic. **workspace_show** with `{ workspaceId }` shows one " + "workspace's manifest. **workspace_overview** with `{ workspaceId }`, then **workspace_read** " + "with `{ workspaceId, itemId }` for one specific item, reads its accepted Facts/Work/Know-how. " + "**workspace_create** with `{ title, component? }` creates a new workspace \u2014 only when " + "workspace_list found no fitting one; a workspace is meant to persist across sessions, so " + "prefer an existing one over creating another for the same topic. **workspace_propose** with " + "`{ workspaceId, kind, sessionId?, note? }` (sessionId defaults to this session) proposes a decision/wiki-update/memory-entry/" + "follow-up/contract-change/risk from this session for later human review \u2014 it never accepts " + "anything by itself; accepting always requires a human running `keryx workspace review` at a " + `real terminal, never this tool.
+` + "- This session has its own Slate (working-set scratch, not project knowledge): " + "**slate_read** shows the Course (if a Flow is bound) and Seeds recorded so far \u2014 nothing " + "here is auto-injected, so call it if you want to see it. **slate_write_seed** with " + "`{ text, kind? }` records a draft hypothesis/decision/follow-up worth a later human " + "review. WRITE A SEED when you: found a root cause or a bug worth remembering; changed or " + "added code (summarize WHAT changed and WHY); took a design/architecture decision; " + "identified a risk; or discovered a constraint/lesson. Use the `kind` that fits: " + "`decision` (a choice made), `wiki-update` (something a wiki page should say), " + "`memory-entry` (a lesson/constraint), `follow-up` (a TODO for a later session), " + "`risk`, or `contract-change`. Keep each Seed to 2-3 sentences, concrete and specific. " + "Do NOT write Seeds for routine progress notes, one-shot operational requests (e.g. " + '"run git pull", "count files"), or trivia \u2014 those need no workspace and no proposal. ' + "Seeds are the ONLY input wrap-up proposes from: a session whose Slate has zero Seeds " + `produces zero proposals. A Seed is never accepted knowledge by itself.
+` + "- Shared Agent Context (SAC) workspaces hold accepted, evidence-backed project context " + "beyond this codebase. **workspace_list** with `{ includeArchived? }` shows every workspace " + "visible to you \u2014 call it first when the user references a shared team workspace or accepted " + "project context, or before creating a new workspace, to judge whether an existing one " + "already fits the current topic. **workspace_show** with `{ workspaceId }` shows one " + "workspace's manifest. **workspace_overview** with `{ workspaceId }`, then **workspace_read** " + "with `{ workspaceId, itemId }` for one specific item, reads its accepted Facts/Work/Know-how. " + "**workspace_create** with `{ title, component? }` creates a new workspace AND binds it to " + "this session's slate (wrap-up then proposes into it) \u2014 only when workspace_list found no " + "fitting one and the session has real, durable results worth persisting; a workspace is " + "meant to persist across sessions, so prefer an existing one over creating another for the " + "same topic, and do NOT create one for one-shot operational requests. **workspace_propose** with " + "`{ workspaceId, kind, sessionId?, note? }` (sessionId defaults to this session) proposes a decision/wiki-update/memory-entry/" + "follow-up/contract-change/risk from this session for later human review \u2014 it never accepts " + "anything by itself; accepting always requires a human running `keryx workspace review` at a " + `real terminal, never this tool.
 ` + "- When you need a decision, interview step, or clarification: use **ask_user** with " + "2\u20136 options `{ id, label, description, recommended? }` (mark one recommended). " + `Do not dump long prose questions without options.
 ` + "- For a focused independent subtask (investigate X, review Y, research Z): use " + "**spawn_subagent** with `{ task, mode?: 'read_only'|'general', label? }`. " + "Default mode is read_only (no shell). Prefer spawn for work that can finish " + `without your intermediate turns; do not spawn for trivial one-line answers.
 
@@ -19114,22 +19155,6 @@ async function runAgentTurnCore(io, deps, history, userLine, options = {}) {
           if (freshSlate !== undefined) {
             history.push({ role: "user", content: renderAnchorsBlock(freshSlate.anchors), provenance: "project" });
             io.onHistoryChange?.("tool");
-            if (freshSlate.workspaceId === undefined) {
-              const resolver = options.resolveWorkspace ?? resolveOrCreateWorkspace;
-              const resolved = await resolver({
-                cwd: options.slateSession.cwd,
-                topicHint: userLine,
-                provider: deps.providerId,
-                model: deps.modelId
-              });
-              if (resolved.ok) {
-                await writeSlate(options.slateSession.dir, (prev) => {
-                  if (!prev)
-                    throw new Error(`SLATE-16 bind: no open slate in ${options.slateSession.dir}`);
-                  return { ...prev, workspaceId: resolved.workspaceId };
-                });
-              }
-            }
           }
         }
       }
@@ -19710,7 +19735,6 @@ var init_agent = __esm(() => {
   init_scheduler();
   init_slate();
   init_slate_course();
-  init_workspace_resolve();
   init_machine_wrap_up();
   init_slate_lifecycle();
   init_slate_terminal_state();
@@ -49832,7 +49856,7 @@ function buildInteractiveAgentTools(input2) {
     applyPatchTool(input2.cwd),
     workspaceOverviewTool(input2.cwd),
     workspaceReadTool(input2.cwd),
-    workspaceCreateTool(input2.cwd),
+    workspaceCreateTool(input2.cwd, getSessionDir),
     workspaceListTool(input2.cwd),
     workspaceShowTool(input2.cwd),
     workspaceProposeTool(input2.cwd, getSessionDir),
@@ -53121,7 +53145,6 @@ init_agent();
 init_slate_lifecycle();
 init_slate();
 init_workspace_service();
-init_workspace_resolve();
 init_service7();
 init_store2();
 init_fs();
@@ -53390,7 +53413,7 @@ async function runGoalVerifier(deps, goalText, cwd, slateSession, history, io, m
   return parseVerifierVerdict(result.output);
 }
 async function runGoalCommand(params) {
-  const { raw, cwd, io, deps, history, slateSession, mintAttemptId, resolveWorkspace } = params;
+  const { raw, cwd, io, deps, history, slateSession, mintAttemptId } = params;
   const parsed = parseGoalArgs(raw);
   if ("error" in parsed) {
     systemLine(io, `/goal: ${parsed.error}
@@ -53424,19 +53447,6 @@ async function runGoalCommand(params) {
           const base = prev ?? { anchors: { root: "", touched: [] }, course: {}, seeds: [] };
           return { ...base, workspaceId };
         });
-      } else {
-        const current = await readSlate(slateSession.dir);
-        if (current !== undefined && current.workspaceId === undefined) {
-          const resolver = resolveWorkspace ?? resolveOrCreateWorkspace;
-          const resolved2 = await resolver({ cwd, topicHint: parsed.text, provider: deps.providerId, model: deps.modelId });
-          if (resolved2.ok) {
-            await writeSlate(slateSession.dir, (prev) => {
-              if (!prev)
-                throw new Error(`SLATE-16 bind: no open slate in ${slateSession.dir}`);
-              return { ...prev, workspaceId: resolved2.workspaceId };
-            });
-          }
-        }
       }
       if (parsed.auto !== undefined) {
         const forCourse = await readSlate(slateSession.dir);
@@ -53535,7 +53545,7 @@ import { spawnSync as spawnSync2 } from "child_process";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.56",
+  version: "0.2.57",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -54688,6 +54698,13 @@ function ensureHost(otui, chrome) {
     }
     const idx = state.tabs.findIndex((tab) => tab.id === state.active);
     const onStrip = focused !== null && containsNode(state.tabStrip, focused);
+    const claimArrow = (direction) => state.input?.onArrowKeys?.(key, direction) === true;
+    if (key.name === "left" && claimArrow("left")) {
+      return;
+    }
+    if (key.name === "right" && claimArrow("right")) {
+      return;
+    }
     if (key.name === "left" || onStrip && key.name === "tab" && key.shift === true) {
       const prev = idx > 0 ? state.tabs[idx - 1] : undefined;
       if (prev !== undefined) {
@@ -55959,10 +55976,9 @@ function openWorkspace(otui, chrome, options) {
 var REVIEW_COMMAND = "/review";
 var REVIEW_FOOTER = [
   { key: "[/]", label: "item" },
-  { key: "a y", label: "accept proposal" },
-  { key: "d y", label: "decline proposal" },
+  { key: "\u2190/\u2192 a d", label: "accept/decline" },
+  { key: "enter y", label: "arm \u2192 confirm" },
   { key: "\u2191/\u2193", label: "scroll" },
-  { key: "\u2190/\u2192", label: "tabs" },
   { key: "esc", label: "close" }
 ];
 function isReviewCommand(line) {
@@ -56146,14 +56162,58 @@ function paintLines3(otui, renderer, body, lines, width) {
   parent.add(node);
   return node;
 }
+function paintActionButtons(otui, renderer, body, callbacks) {
+  if (otui === undefined || otui === null || body === undefined || body === null) {
+    return;
+  }
+  const parent = body;
+  const boxCtor = otui.BoxRenderable;
+  const textCtor = otui.TextRenderable;
+  if (parent.add === undefined || boxCtor === undefined || textCtor === undefined) {
+    return;
+  }
+  const BoxCtor = boxCtor;
+  const TextCtor = textCtor;
+  const addChild = (child) => parent.add?.(child);
+  const theme = getTheme();
+  const make = (label, id, color, onClick) => {
+    const box = new BoxCtor(renderer, {
+      id,
+      flexShrink: 0,
+      marginLeft: 1,
+      paddingLeft: 1,
+      paddingRight: 1,
+      onMouseDown: (event) => {
+        event.stopPropagation();
+        onClick();
+      }
+    });
+    const text = new TextCtor(renderer, { id: `${id}-t`, content: `[${label}]` });
+    text.fg = color;
+    box.add(text);
+    addChild(box);
+    const setActive = (active) => {
+      box.backgroundColor = active ? theme.highlight : undefined;
+      text.content = `[${label}]`;
+      text.fg = color;
+    };
+    return { setActive };
+  };
+  return {
+    accept: make("Accept", "review-accept", theme.ok, callbacks.onAccept),
+    decline: make("Decline", "review-decline", theme.error, callbacks.onDecline)
+  };
+}
 function presentReview(openModal2, otui, chrome, options) {
   const items = [...options.items];
   let selected = 0;
   let listScroll = 0;
   let detailScroll = 0;
   let status = { kind: "idle" };
+  let focusedAction = "accept";
   let listNode;
   let detailNode;
+  let actionButtons;
   let unsubscribeKey;
   const rendererHint = options.renderer ?? chrome?.renderer;
   const bodyRows = options.visibleRows ?? (typeof rendererHint?.width === "number" && typeof rendererHint.height === "number" ? modalBodyRows(resolveModalPanelSize(rendererHint.width, rendererHint.height).height) : 13);
@@ -56174,6 +56234,7 @@ function presentReview(openModal2, otui, chrome, options) {
       detailNode.content = windowLines3(detailLines(), detailScroll, bodyRows).join(`
 `);
     }
+    updateButtons();
   };
   const moveSelection = (next) => {
     if (items.length === 0) {
@@ -56189,6 +56250,22 @@ function presentReview(openModal2, otui, chrome, options) {
     paintSelection();
   };
   const handlerFor = (decision) => decision === "accept" ? options.acceptProposal : options.declineProposal;
+  const updateButtons = () => {
+    if (actionButtons === undefined) {
+      return;
+    }
+    const onProposal = items[selected]?.type === "proposal" && status.kind !== "done";
+    const highlighted = status.kind === "armed" ? status.decision : focusedAction;
+    actionButtons.accept.setActive(onProposal && highlighted === "accept");
+    actionButtons.decline.setActive(onProposal && highlighted === "decline");
+  };
+  const armDecision = (decision) => {
+    if (status.kind === "running") {
+      return;
+    }
+    status = items[selected]?.type === "proposal" && handlerFor(decision) !== undefined ? { kind: "armed", decision } : { kind: "unavailable", decision };
+    paintSelection();
+  };
   const runDecision = (decision) => {
     const item = items[selected];
     const run = handlerFor(decision);
@@ -56213,16 +56290,43 @@ function presentReview(openModal2, otui, chrome, options) {
     ],
     initialTab: "list",
     footer: REVIEW_FOOTER,
+    onArrowKeys: (key, direction) => {
+      if (items[selected]?.type === "proposal" && status.kind !== "running" && status.kind !== "done" && handle?.activeTab() === "detail") {
+        focusedAction = direction === "left" ? "accept" : "decline";
+        status = { kind: "idle" };
+        paintSelection();
+        return true;
+      }
+      return false;
+    },
     renderTab: (tabId, body, ctx) => {
       const renderer = options.renderer ?? chrome?.renderer;
       tabWidth = ctx?.width;
       if (tabId === "list") {
+        detailNode = undefined;
+        actionButtons = undefined;
         listScroll = scrollToReveal3(selected, listScroll, bodyRows);
         listNode = paintLines3(otui, renderer, body, windowLines3(listLines(), listScroll, bodyRows));
         return;
       }
+      listNode = undefined;
       detailScroll = clampScroll3(detailScroll, detailLines().length, bodyRows);
       detailNode = paintLines3(otui, renderer, body, windowLines3(detailLines(), detailScroll, bodyRows), tabWidth);
+      if (items[selected]?.type === "proposal") {
+        actionButtons = paintActionButtons(otui, renderer, body, {
+          onAccept: () => {
+            focusedAction = "accept";
+            armDecision("accept");
+          },
+          onDecline: () => {
+            focusedAction = "decline";
+            armDecision("decline");
+          }
+        });
+        updateButtons();
+      } else {
+        actionButtons = undefined;
+      }
     },
     onClose: () => {
       unsubscribeKey?.();
@@ -56239,7 +56343,7 @@ function presentReview(openModal2, otui, chrome, options) {
       }
       const onDetail = handle.activeTab() === "detail";
       if (onDetail && status.kind === "armed") {
-        if (token === "y") {
+        if (token === "y" || token === "return" || token === "enter") {
           runDecision(status.decision);
         } else {
           status = { kind: "idle" };
@@ -56256,15 +56360,29 @@ function presentReview(openModal2, otui, chrome, options) {
         return;
       }
       if (token === "return" || token === "enter") {
+        if (onDetail && items[selected]?.type === "proposal" && status.kind !== "running" && status.kind !== "done") {
+          if (status.kind === "armed") {
+            runDecision(status.decision);
+          } else {
+            armDecision(focusedAction);
+          }
+          return;
+        }
         handle.setTab("detail");
         return;
       }
-      if (onDetail && (token === "a" || token === "d") && status.kind !== "running") {
-        const decision = token === "a" ? "accept" : "decline";
-        status = items[selected]?.type === "proposal" && handlerFor(decision) !== undefined ? { kind: "armed", decision } : { kind: "unavailable", decision };
+      if (onDetail && (token === "left" || token === "right") && status.kind !== "running" && status.kind !== "done") {
+        focusedAction = token === "left" ? "accept" : "decline";
+        status = { kind: "idle" };
         paintSelection();
         return;
       }
+      if (onDetail && (token === "a" || token === "d") && status.kind !== "running" && status.kind !== "done") {
+        const decision = token === "a" ? "accept" : "decline";
+        focusedAction = decision;
+        armDecision(decision);
+        return;
+      }
       if (token === "up" || token === "k") {
         if (onDetail) {
           detailScroll = clampScroll3(detailScroll - 1, detailLines().length, bodyRows);