@mrciphersmith/keryx 0.2.69 → 0.2.70

package/dist/cli.js

@@ -5648,6 +5648,9 @@ var init_command = __esm(() => {
   init_pull();
 });
 
+// src/gdgraph/types.ts
+var UNKNOWN_IMPORT_KIND = "unknown-static";
+
 // src/gdgraph/config.ts
 import path47 from "path";
 function gdgraphConfigPath(cwd) {
@@ -6287,8 +6290,8 @@ async function buildGraph(projectRoot) {
     const language = getLanguage(file);
     const resolver = pickResolver(resolvers, language);
     const isLanguageAware = language === "java" || language === "python";
-    const specifiers = extractImportSpecifiers(content, language);
-    for (const specifier of specifiers) {
+    const records = extractImportRecords(content, language);
+    for (const { specifier, kind: importKind } of records) {
       const resolved = resolveImport(projectRoot, file, specifier, fileSet, resolver);
       const asset = resolved ? null : resolveAssetImport(projectRoot, file, specifier, resolver);
       const shouldTrackUnresolved = specifier.startsWith(".") || resolver.matchesAlias(specifier) || isLanguageAware;
@@ -6308,7 +6311,8 @@ async function buildGraph(projectRoot) {
         from: file,
         to: resolved ?? asset ?? specifier,
         kind: resolved ? "imports" : asset ? "asset" : "unresolved",
-        specifier
+        specifier,
+        importKind
       });
     }
   }
@@ -6352,18 +6356,33 @@ async function collectSourceFiles(projectRoot) {
   await walk3(".");
   return { files: result.sort(), skippedDirectories: skippedDirectories.sort() };
 }
-function extractImportSpecifiers(content, language) {
+function extractImportRecords(content, language) {
   if (language === "java" || language === "python") {
-    return extractImportSpecifiersFallback(content);
+    return extractImportSpecifiersFallback(content).map((specifier) => ({
+      specifier,
+      kind: UNKNOWN_IMPORT_KIND
+    }));
   }
   const scanned = scanImportsOrEmpty(content);
   const fallback = extractImportSpecifiersFallback(content);
-  return [...new Set([...scanned, ...fallback])].sort();
+  const kindBySpecifier = new Map;
+  for (const { specifier, kind } of scanned) {
+    const existing = kindBySpecifier.get(specifier);
+    if (!existing || existing === "dynamic-import" && kind !== "dynamic-import") {
+      kindBySpecifier.set(specifier, kind);
+    }
+  }
+  for (const specifier of fallback) {
+    if (!kindBySpecifier.has(specifier)) {
+      kindBySpecifier.set(specifier, UNKNOWN_IMPORT_KIND);
+    }
+  }
+  return [...kindBySpecifier.entries()].map(([specifier, kind]) => ({ specifier, kind })).sort((a, b) => a.specifier.localeCompare(b.specifier));
 }
 function scanImportsOrEmpty(content) {
   try {
     const scanner = new Bun.Transpiler({ loader: "tsx" });
-    return scanner.scanImports(content).map((entry) => entry.path).filter((specifier) => typeof specifier === "string" && specifier.length > 0);
+    return scanner.scanImports(content).filter((entry) => typeof entry.path === "string" && entry.path.length > 0).map((entry) => ({ specifier: entry.path, kind: entry.kind }));
   } catch {
     return [];
   }
@@ -6906,7 +6925,7 @@ function getCycles(graph) {
     adjacency.set(node.path, []);
   }
   for (const edge of graph.edges) {
-    if (edge.kind !== "imports") {
+    if (edge.kind !== "imports" || edge.importKind === "dynamic-import") {
       continue;
     }
     adjacency.get(edge.from)?.push(edge.to);
@@ -19200,8 +19219,8 @@ function buildAgentSystemInstruction(orient, ctx = {}) {
 ` + `  Do NOT thrash search_code/read_wiki instead of wiki enrich.
 ` + "- Optional prep: `keryx wiki collect` then enrich.\n" + "- Other keryx work (graph, health, memory, flow, testing): use the matching read tool above " + "(graph_affected/graph_query/graph_path/graph_symbol, health_status, memory_search, flow_status, test_related) " + "FIRST \u2014 they return the same data as the equivalent `keryx \u2026` CLI command without spending shell_exec's " + "scarce budget slot. Reach for `shell_exec` with the CLI only when the user wants to actually RUN a workflow " + `(mutate state, kick off a job) or needs an option no read tool covers.
 
-` + "ALWAYS use a tool to obtain facts instead of guessing; never fabricate paths, file " + "contents, or results. Be economical with output tokens: lead with the conclusion, " + "if the user asks you to run, inspect, or execute anything, call the relevant tool before " + `sending explanatory text.
-` + "give the shortest correct answer, prefer bullet points over prose, and omit preamble. " + "Do NOT paste large tool/command output back into your reply \u2014 the compact tool result " + "is already in context; reference it instead of repeating it.";
+` + "ALWAYS use a tool to obtain facts instead of guessing; never fabricate paths, file " + "contents, or results. " + "If the user asks you to run, inspect, or execute anything, call the relevant tool before " + `sending explanatory text.
+` + "Be economical with output LENGTH: lead with the conclusion, " + "give the shortest correct answer, prefer bullet points over prose, and omit preamble. " + "That economy governs prose only \u2014 never how many tools you call. " + "Do NOT paste large tool/command output back into your reply \u2014 the compact tool result " + "is already in context; reference it instead of repeating it. When a tool's result is " + "itself the deliverable you are about to report (e.g. a list of cycles, orphans, or " + "dependents) \u2014 not merely an input you go on to reason over \u2014 check it against source " + "before presenting it as fact; do not add this check to every call, only where the " + "result is the answer.";
   const trimmed = orient?.trim() ?? "";
   if (trimmed.length === 0) {
     return base;
@@ -23554,7 +23573,66 @@ function assertTransition(from, to) {
     ].join(", ") || "(none)"}`);
   }
 }
-var TRANSITIONS;
+function taskGateStatus(task) {
+  if (task.status !== "done") {
+    return "not-terminal";
+  }
+  return task.disposition === "failed" ? "terminal-fail" : "terminal-pass";
+}
+function isUnreasonedSkip(task) {
+  return task.disposition === "skipped" && !task.dispositionReason?.trim();
+}
+function isBlockedTask(task) {
+  return task.disposition === "blocked";
+}
+function isUnknownDisposition(task) {
+  if (task.disposition === undefined || task.disposition === null) {
+    return false;
+  }
+  if (task.disposition === "failed" || task.disposition === "blocked") {
+    return false;
+  }
+  return !GATE_PASSING_DISPOSITIONS.has(task.disposition);
+}
+function evaluateTaskGate(tasks) {
+  const open2 = [];
+  const failed = [];
+  const unreasonedSkips = [];
+  const blocked = [];
+  const unknownDisposition = [];
+  for (const task of tasks) {
+    const status = taskGateStatus(task);
+    if (status === "not-terminal") {
+      open2.push(task.id);
+      continue;
+    }
+    if (status === "terminal-fail") {
+      failed.push(task.id);
+      continue;
+    }
+    if (isUnknownDisposition(task)) {
+      unknownDisposition.push(task.id);
+      continue;
+    }
+    if (isBlockedTask(task)) {
+      blocked.push(task.id);
+      continue;
+    }
+    if (isUnreasonedSkip(task)) {
+      unreasonedSkips.push(task.id);
+    }
+  }
+  return {
+    passed: open2.length === 0 && failed.length === 0 && unreasonedSkips.length === 0 && blocked.length === 0 && unknownDisposition.length === 0,
+    open: open2,
+    failed,
+    unreasonedSkips,
+    blocked,
+    unknownDisposition,
+    total: tasks.length
+  };
+}
+var TRANSITIONS, GATE_PASSING_DISPOSITIONS;
 var init_machine = __esm(() => {
   TRANSITIONS = {
     initializing: ["ready", "blocked"],
@@ -23565,6 +23643,7 @@ var init_machine = __esm(() => {
     blocked: [],
     done: []
   };
+  GATE_PASSING_DISPOSITIONS = new Set(["completed", "skipped"]);
 });
 
 // src/flow/schema.ts
@@ -23603,6 +23682,17 @@ function flowStateSchema() {
         }
       },
       acChecksum: { type: ["string", "null"], description: "SHA-256 of the frozen acceptance criteria." },
+      gates: {
+        type: "object",
+        additionalProperties: true,
+        description: "Which completion gates this package opted into at creation. Absent on packages created before a gate existed, which is how a gate is added without retroactively invalidating history: an absent flag reports the gate as skipped rather than passed.",
+        properties: {
+          tasks: {
+            type: "boolean",
+            description: "Written by `flow init`. When true, `flow complete` fails while any task is non-terminal."
+          }
+        }
+      },
       acConfirmed: {
         type: "object",
         description: "Per-AC confirmation records keyed by AC id (e.g. AC1).",
@@ -23692,6 +23782,10 @@ function flowStateSchema() {
             enum: ["completed", "blocked", "failed", "skipped"],
             description: "v2: terminal outcome when status is done (distinct from status)."
           },
+          dispositionReason: {
+            type: "string",
+            description: "Why the task ended this way. Required in practice for `skipped`: the task gate treats an unreasoned skip as non-terminal, because a skip nobody has to justify is a one-flag bypass of the gate."
+          },
           acRefs: { type: "array", items: { type: "string" }, description: "v2: AC ids this task addresses." },
           evidenceRefs: { type: "array", items: { type: "string" }, description: "v2: artifact paths." },
           budget: {
@@ -24047,6 +24141,7 @@ function createFlowService(deps) {
         const createdAt = now();
         const flow = {
           schemaVersion: 1,
+          gates: { tasks: true },
           id,
           slug: slug2,
           title,
@@ -24132,7 +24227,7 @@ function createFlowService(deps) {
         return save(input2.cwd, dir, flow, "task-added", `${task.id}: ${task.title}`);
       });
     },
-    async taskDone({ cwd, id, taskId, disposition, evidenceRefs, runLink }) {
+    async taskDone({ cwd, id, taskId, disposition, reason, evidenceRefs, runLink }) {
       return mutate(cwd, id, async ({ dir, flow }) => {
         await assertAcIntact(cwd, dir, flow);
         const task = flow.tasks.find((item) => item.id.toUpperCase() === taskId.toUpperCase());
@@ -24140,7 +24235,14 @@ function createFlowService(deps) {
           throw new Error(`Task not found: ${taskId}. Known: ${flow.tasks.map((t) => t.id).join(", ")}`);
         }
         task.status = "done";
+        const previousDisposition = task.disposition;
         task.disposition = disposition ?? task.disposition ?? "completed";
+        if (disposition !== undefined && disposition !== previousDisposition) {
+          delete task.dispositionReason;
+        }
+        if (reason?.trim()) {
+          task.dispositionReason = reason.trim();
+        }
         if (evidenceRefs !== undefined) {
           task.evidenceRefs = evidenceRefs;
         }
@@ -24150,6 +24252,20 @@ function createFlowService(deps) {
         return save(cwd, dir, flow, "task-done", `${task.id}: ${task.title}`);
       });
     },
+    async taskAttempt({ cwd, id, taskId, outcome, detail }) {
+      return mutate(cwd, id, async ({ dir, flow }) => {
+        await assertAcIntact(cwd, dir, flow);
+        const task = flow.tasks.find((item) => item.id.toUpperCase() === taskId.toUpperCase());
+        if (!task) {
+          throw new Error(`Task not found: ${taskId}. Known: ${flow.tasks.map((t) => t.id).join(", ")}`);
+        }
+        const attempts = task.attempts ?? { count: 0, log: [] };
+        attempts.count += 1;
+        attempts.log.push({ at: now(), outcome, ...detail?.trim() ? { detail: detail.trim() } : {} });
+        task.attempts = attempts;
+        return save(cwd, dir, flow, "task-attempt", `${task.id}: ${outcome} (attempt ${attempts.count})${detail?.trim() ? ` \u2014 ${detail.trim()}` : ""}`);
+      });
+    },
     async acConfirm({ cwd, id, criterion, note: note2 }) {
       return mutate(cwd, id, async ({ dir, flow }) => {
         await assertAcIntact(cwd, dir, flow);
@@ -24243,6 +24359,7 @@ function createFlowService(deps) {
             detail: "tracker unavailable; verify PR checks manually"
           });
         }
+        gates.push(taskGate(flow));
         try {
           const health = await deps.healthGate(cwd);
           gates.push(health.status === "fail" ? { name: "health", status: "fail", detail: health.reasons.join("; ") || "health gate failed" } : { name: "health", status: "pass", detail: `health gate: ${health.status}` });
@@ -24436,6 +24553,40 @@ async function appendIdMap(cwd, entry) {
   await writeFileAtomic(file, `${JSON.stringify(entries, null, 2)}
 `);
 }
+function taskGate(flow) {
+  if (!flow.gates?.tasks) {
+    return {
+      name: "tasks",
+      status: "skipped",
+      detail: "task gate not enabled for this package (created before the gate); " + "flows created by this keryx version opt in automatically"
+    };
+  }
+  const verdict = evaluateTaskGate(flow.tasks);
+  if (verdict.passed) {
+    return {
+      name: "tasks",
+      status: "pass",
+      detail: `${verdict.total} task(s) terminal`
+    };
+  }
+  const reasons = [];
+  if (verdict.open.length > 0) {
+    reasons.push(`not done: ${verdict.open.join(", ")}`);
+  }
+  if (verdict.failed.length > 0) {
+    reasons.push(`failed: ${verdict.failed.join(", ")}`);
+  }
+  if (verdict.unreasonedSkips.length > 0) {
+    reasons.push(`skipped without a recorded reason: ${verdict.unreasonedSkips.join(", ")} ` + '(use: keryx flow task done <id> <Tn> --disposition skipped --reason "<why>")');
+  }
+  if (verdict.blocked.length > 0) {
+    reasons.push(`blocked: ${verdict.blocked.join(", ")} ` + "(a blocked task did not get done; resolve it, or close it as skipped with a reason)");
+  }
+  if (verdict.unknownDisposition.length > 0) {
+    reasons.push(`unrecognised disposition: ${verdict.unknownDisposition.join(", ")} ` + "(expected completed | blocked | failed | skipped)");
+  }
+  return { name: "tasks", status: "fail", detail: reasons.join("; ") };
+}
 async function isPlaceholderAc(cwd, dir) {
   const content = await Bun.file(acPath(cwd, dir)).text();
   return content.includes("<replace with a hard, verifiable criterion");
@@ -40756,6 +40907,11 @@ init_github();
 init_service6();
 init_guard();
 import path124 from "path";
+
+// src/flow/types.ts
+var ATTEMPT_CLI_OUTCOMES = ["started", "failed", "blocked"];
+
+// src/commands/flow.ts
 var VALID_TASK_KINDS = ["context", "implement", "test", "verify", "review", "docs"];
 function parseTaskKind(raw) {
   if (raw === undefined) {
@@ -40766,6 +40922,26 @@ function parseTaskKind(raw) {
   }
   return raw;
 }
+function positional(args2, index) {
+  const value = args2[index];
+  return value === undefined || value.startsWith("--") ? undefined : value;
+}
+var VALID_DISPOSITIONS = ["completed", "blocked", "failed", "skipped"];
+function parseDisposition(raw) {
+  if (raw === undefined) {
+    return;
+  }
+  if (!VALID_DISPOSITIONS.includes(raw)) {
+    throw new Error(`Invalid --disposition "${raw}". Expected one of: ${VALID_DISPOSITIONS.join(", ")}`);
+  }
+  return raw;
+}
+function parseAttemptOutcome(raw) {
+  if (raw === undefined || !ATTEMPT_CLI_OUTCOMES.includes(raw)) {
+    throw new Error(`Invalid --outcome "${raw ?? ""}". Expected one of: ${ATTEMPT_CLI_OUTCOMES.join(", ")}`);
+  }
+  return raw;
+}
 function flowStatusLabel(status) {
   if (status === "done") {
     return style.green(status);
@@ -40972,22 +41148,48 @@ async function runTask(args2) {
     return;
   }
   if (sub === "done") {
-    const id = args2[1];
-    const taskId = args2[2];
+    const id = positional(args2, 1);
+    const taskId = positional(args2, 2);
     if (!id || !taskId) {
-      throw new Error("Usage: keryx flow task done <id> <taskId> [--disposition completed|blocked|failed|skipped]");
+      throw new Error('Usage: keryx flow task done <id> <taskId> [--disposition completed|blocked|failed|skipped] [--reason "<why>"]');
     }
+    const disposition = parseDisposition(optionValue(args2, "--disposition"));
+    const reason = optionValue(args2, "--reason");
     const flow = await getService3().taskDone({
       cwd: process.cwd(),
       id,
       taskId,
-      disposition: optionValue(args2, "--disposition")
+      disposition,
+      reason
     });
     const done = flow.tasks.filter((task) => task.status === "done").length;
     console.log(`  ${style.green(symbols.ok)} Task ${style.bold(taskId.toUpperCase())} done ${style.dim(`(${done}/${flow.tasks.length})`)}`);
+    if (disposition === "skipped" && !reason?.trim()) {
+      note('A skipped task without --reason "<why>" fails the task gate at `keryx flow complete`. Re-run with a reason to record why the work was not needed.');
+    }
+    if (disposition === "blocked") {
+      note("A blocked task fails the task gate at `keryx flow complete` \u2014 it is recorded as terminal, " + "but the work did not happen. Resolve it, or close it as skipped with a reason.");
+    }
     return;
   }
-  throw new Error("Usage: keryx flow task <add|done> ...");
+  if (sub === "attempt") {
+    const id = positional(args2, 1);
+    const taskId = positional(args2, 2);
+    if (!id || !taskId) {
+      throw new Error(`Usage: keryx flow task attempt <id> <taskId> --outcome ${ATTEMPT_CLI_OUTCOMES.join("|")} [--detail "<what happened>"]`);
+    }
+    const flow = await getService3().taskAttempt({
+      cwd: process.cwd(),
+      id,
+      taskId,
+      outcome: parseAttemptOutcome(optionValue(args2, "--outcome")),
+      detail: optionValue(args2, "--detail")
+    });
+    const task = flow.tasks.find((item) => item.id.toUpperCase() === taskId.toUpperCase());
+    console.log(`  ${style.green(symbols.ok)} Attempt recorded on ${style.bold(taskId.toUpperCase())} ${style.dim(`(count ${task?.attempts?.count ?? 0})`)}`);
+    return;
+  }
+  throw new Error("Usage: keryx flow task <add|done|attempt> ...");
 }
 async function runAc(args2) {
   const sub = args2[0];
@@ -41118,7 +41320,8 @@ function printHelp10() {
     "keryx flow freeze <id>",
     "keryx flow start <id>",
     'keryx flow task add <id> --title "<t>" [--kind context|implement|test|verify|review|docs] [--depends T1,T2]',
-    "keryx flow task done <id> <taskId> [--disposition completed|blocked|failed|skipped]",
+    'keryx flow task done <id> <taskId> [--disposition completed|blocked|failed|skipped] [--reason "<why>"]',
+    'keryx flow task attempt <id> <taskId> --outcome started|failed|blocked [--detail "<what happened>"]',
     'keryx flow ac confirm <id> <ACn> [--note "<evidence>"]',
     'keryx flow ac update <id> --reason "<why>"',
     "keryx flow implemented <id> --pr <url>",
@@ -41136,16 +41339,17 @@ init_args();
 
 // src/review/managed.ts
 init_validator();
-init_fs();
-init_store2();
 import { mkdir as mkdir48, readFile as readFile66, readdir as readdir20 } from "fs/promises";
 import path125 from "path";
+init_fs();
+init_store2();
 
 // src/review/types.ts
 var MANAGED_REVIEW_MODES = ["attach-review", "review-flow", "ingest"];
 var REVIEW_TARGET_KINDS = ["pr", "issue", "branch", "path", "report"];
 var REVIEW_PACKAGE_STATUSES = ["draft", "reviewed", "decided", "learned", "closed"];
 var REVIEW_COVERAGE_STATUSES = ["run", "skipped", "failed", "needs_context"];
+var REVIEW_FINDING_CONFIDENCES = ["high", "medium", "low"];
 
 // src/review/managed.ts
 var REQUIRED_ARTIFACTS = ["scope", "coverage", "report", "findings", "learning", "decisions"];
@@ -41174,7 +41378,14 @@ async function createManagedReviewPackage(input2) {
   const packageDir = packagePath(input2.cwd, input2.mode, reviewId, flowMatch);
   const coverage = normalizeCoverage(input2.coverage, input2.reviewers);
   const report = await readReport(input2);
-  const findings = normalizeFindings(report, input2.mode, flowMatch !== null);
+  const findings = await normalizeFindings({
+    report,
+    reportLabel: reportLabel(input2),
+    mode: input2.mode,
+    attachedToFlow: flowMatch !== null,
+    source: input2.findings,
+    reviewers: coverage.filter((entry) => entry.status === "run").map((entry) => entry.reviewer)
+  });
   const manifest = buildManifest2({
     input: input2,
     reviewId,
@@ -41191,13 +41402,17 @@ async function createManagedReviewPackage(input2) {
   if (violations.length > 0) {
     throw new Error(`Refusing to record findings that do not enumerate their class: ${violations.map((finding) => `${finding.id} (${finding.severity})`).join(", ")}. A blocker or major must carry class_scope with sites and enumeration_method \u2014 every site holding the shape, and how the set was derived.`);
   }
+  const contractErrors = await schemaErrors(findings);
+  if (contractErrors.length > 0) {
+    throw new Error(`Refusing to record findings that do not satisfy review-finding.schema.json: ${contractErrors.map((error2) => `${error2.path} ${error2.message}`).join("; ")}`);
+  }
   await mkdir48(packageDir, { recursive: true });
   await writeFileAtomic(path125.join(packageDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `);
   await writeFileAtomic(path125.join(packageDir, "scope.md"), renderScope(input2, flowMatch, at));
   await writeFileAtomic(path125.join(packageDir, "coverage.md"), renderCoverage(coverage));
   await writeFileAtomic(path125.join(packageDir, "report.md"), renderReport(report, input2.mode));
-  await writeFileAtomic(path125.join(packageDir, "findings.json"), `${JSON.stringify(findings, null, 2)}
+  await writeFileAtomic(path125.join(packageDir, "findings.json"), `${JSON.stringify(findings.map(toContractFinding), null, 2)}
 `);
   await writeFileAtomic(path125.join(packageDir, "learning.md"), renderLearning(findings));
   await writeFileAtomic(path125.join(packageDir, "decisions.md"), renderDecisions(findings));
@@ -41354,7 +41569,147 @@ async function readReport(input2) {
 No reviewer findings recorded yet.
 `;
 }
-function normalizeFindings(report, mode, attachedToFlow) {
+function reportLabel(input2) {
+  return input2.reportPath ? path125.resolve(input2.cwd, input2.reportPath) : "the report text passed to keryx review";
+}
+async function normalizeFindings(args2) {
+  if (args2.source !== undefined) {
+    return triage(fromStructuredSource(args2.source, args2.reviewers), args2);
+  }
+  const structured = parseEmbeddedFindings(args2.report, args2.reportLabel);
+  if (structured !== null) {
+    return triage(fromStructuredSource(structured, args2.reviewers), args2);
+  }
+  return triage(parseLegacyReport(args2.report, args2.reviewers), args2);
+}
+function triage(findings, args2) {
+  const classification = args2.mode === "ingest" ? "valid_followup" : "skill_learning_candidate";
+  return findings.map((finding) => {
+    const triaged = {
+      ...finding,
+      classification,
+      flow_relevance: args2.attachedToFlow ? "post_flow_feedback" : "standalone_review"
+    };
+    if (finding.learning_candidate === undefined && classification === "skill_learning_candidate") {
+      triaged.learning_candidate = true;
+    }
+    return triaged;
+  });
+}
+function toContractFinding(finding) {
+  const record = {
+    id: finding.id,
+    reviewer: finding.reviewer,
+    severity: finding.severity,
+    problem: finding.problem,
+    impact: finding.impact,
+    suggested_fix: finding.suggested_fix,
+    evidence: finding.evidence,
+    confidence: finding.confidence
+  };
+  if (finding.file !== undefined) {
+    record.file = finding.file;
+  }
+  if (finding.line !== undefined) {
+    record.line = finding.line;
+  }
+  if (finding.symbol !== undefined) {
+    record.symbol = finding.symbol;
+  }
+  if (finding.dedupe_key !== undefined) {
+    record.dedupe_key = finding.dedupe_key;
+  }
+  if (finding.blocking_merge !== undefined) {
+    record.blocking_merge = finding.blocking_merge;
+  }
+  if (finding.related_skill !== undefined) {
+    record.related_skill = finding.related_skill;
+  }
+  if (finding.learning_candidate !== undefined) {
+    record.learning_candidate = finding.learning_candidate;
+  }
+  if (finding.class_scope !== undefined) {
+    record.class_scope = finding.class_scope;
+  }
+  return record;
+}
+var EMBEDDED_FINDINGS_FENCE = /^ {0,3}(`{3,}|~{3,})[^\n]*\bkeryx:findings\b[^\n]*$/gm;
+function parseEmbeddedFindings(report, reportLabel2) {
+  const fences = [...report.matchAll(EMBEDDED_FINDINGS_FENCE)];
+  if (fences.length === 0) {
+    return null;
+  }
+  if (fences.length > 1) {
+    throw new Error(`${reportLabel2} carries ${fences.length} keryx:findings blocks (at character ${fences.map((fence2) => String(fence2.index ?? 0)).join(" and ")}); exactly one is allowed. Concatenating one block per reviewer drops every block after the first \u2014 merge them into a single array.`);
+  }
+  const fence = fences[0];
+  let parsed;
+  try {
+    parsed = JSON.parse(embeddedBlockBody(report, fence));
+  } catch (error2) {
+    throw new Error(`${reportLabel2} carries a keryx:findings block that is not valid JSON: ${error2 instanceof Error ? error2.message : String(error2)}`);
+  }
+  if (!Array.isArray(parsed) && !isReviewerResult(parsed)) {
+    throw new Error(`${reportLabel2} carries a keryx:findings block that is ${describeJson(parsed)}, not an array of findings or a { reviewer, findings } result.`);
+  }
+  return parsed;
+}
+function embeddedBlockBody(report, fence) {
+  const marker2 = fence[1] ?? "```";
+  const char = marker2.startsWith("~") ? "~" : "`";
+  const afterOpen = report.slice((fence.index ?? 0) + fence[0].length).replace(/^\r?\n/, "");
+  const closing = afterOpen.match(new RegExp(`^ {0,3}\\${char}{${marker2.length},}\\s*$`, "m"));
+  return closing?.index === undefined ? afterOpen : afterOpen.slice(0, closing.index);
+}
+function describeJson(value) {
+  if (value === null) {
+    return "JSON null";
+  }
+  return `a JSON ${typeof value}`;
+}
+function fromStructuredSource(source, reviewers) {
+  const flattened = [];
+  for (const entry of Array.isArray(source) ? source : [source]) {
+    if (isReviewerResult(entry)) {
+      for (const finding of entry.findings) {
+        if (finding.reviewer || entry.reviewer === undefined) {
+          flattened.push(finding);
+          continue;
+        }
+        flattened.push({ ...finding, reviewer: entry.reviewer });
+      }
+      continue;
+    }
+    flattened.push(entry);
+  }
+  return flattened.map((finding) => coerceStructured(finding, reviewers));
+}
+function isReviewerResult(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Array.isArray(value.findings);
+}
+async function schemaErrors(findings) {
+  const schema = await loadSchema("review-finding");
+  const errors = [];
+  for (const [index, finding] of findings.entries()) {
+    for (const error2 of await validateJson(toContractFinding(finding), schema)) {
+      errors.push({ path: error2.path.replace(/^\$/, `$[${index}]`), message: error2.message });
+    }
+  }
+  return errors;
+}
+function coerceStructured(finding, reviewers) {
+  const record = { ...finding };
+  if (typeof record.reviewer !== "string" || record.reviewer === "") {
+    record.reviewer = defaultReviewer(reviewers);
+  }
+  record.summary = typeof finding.problem === "string" ? finding.problem : "";
+  record.class_scope_present = finding.class_scope !== undefined;
+  return record;
+}
+function defaultReviewer(reviewers) {
+  return reviewers.length === 1 && reviewers[0] ? reviewers[0] : "review-orchestrator";
+}
+function parseLegacyReport(report, reviewers) {
   const findings = [];
   const lines = report.split(`
 `);
@@ -41366,18 +41721,128 @@ function normalizeFindings(report, mode, attachedToFlow) {
     const id = heading2.id;
     const summary = heading2.summary || "Review finding";
     const block = findingBlock(lines, index);
-    findings.push({
+    const location = parseLocation(labelledField(block, ["file", "location"]));
+    const classScope = parseClassScope(block);
+    const finding = {
       id,
       severity: severityFor(line, block),
-      reviewer: "review-orchestrator",
+      reviewer: legacyReviewer(block, reviewers),
+      problem: labelledField(block, ["problem", "issue"]) ?? summary.replace(SEVERITY_PREFIX, ""),
+      impact: labelledField(block, ["impact", "why it matters"]) ?? NOT_RECORDED("impact"),
+      suggested_fix: labelledField(block, ["suggested fix", "suggested_fix", "fix", "recommendation"]) ?? NOT_RECORDED("suggested_fix"),
+      evidence: labelledField(block, ["evidence", "proof"]) ?? NOT_RECORDED("evidence"),
+      confidence: legacyConfidence(block),
       summary,
-      classification: mode === "ingest" ? "valid_followup" : "skill_learning_candidate",
-      flow_relevance: attachedToFlow ? "post_flow_feedback" : "standalone_review",
-      class_scope_present: hasClassScope(block)
-    });
+      class_scope_present: classScope !== null
+    };
+    if (classScope !== null) {
+      finding.class_scope = classScope;
+    }
+    if (location.file !== undefined) {
+      finding.file = location.file;
+    }
+    if (location.line !== undefined) {
+      finding.line = location.line;
+    }
+    findings.push(finding);
   }
   return findings;
 }
+var SEVERITY_PREFIX = /^\s*(?:\*\*|__)?(?:blocker|major|minor|info)(?:\*\*|__)?\s*[:\u2014\u2013-]\s*/i;
+var NOT_RECORDED = (field3) => `not recorded: derived from a markdown review report, which carried no ${field3} field`;
+function labelledField(block, labels) {
+  const lines = block.split(`
+`);
+  for (const [index, line] of lines.entries()) {
+    const match = line.match(LABEL_LINE);
+    const label = match?.[1]?.trim().toLowerCase().replace(/\*\*|__|`/g, "");
+    if (label === undefined || !labels.includes(label)) {
+      continue;
+    }
+    const parts = [(match?.[2] ?? "").trim()];
+    for (let i = index + 1;i < lines.length; i += 1) {
+      const next = lines[i] ?? "";
+      if (next.trim() === "" || /^\s*[-*+]\s/.test(next) || /^\s*(?:\*\*|__)/.test(next)) {
+        break;
+      }
+      parts.push(next.trim());
+    }
+    const value = parts.join(" ").trim().replace(/^[`*_]+|[`*_]+$/g, "").trim();
+    if (value !== "") {
+      return value;
+    }
+  }
+  return;
+}
+var LABEL_LINE = /^[\s>]*(?:[-*+]\s+)?((?:\*\*|__)?[A-Za-z][A-Za-z _-]*(?:\*\*|__)?)\s*[:=]\s*(.*)$/;
+function parseLocation(value) {
+  if (value === undefined) {
+    return {};
+  }
+  const match = value.replace(/`/g, "").trim().match(/^([^\s:]+?\.[A-Za-z0-9]+)(?::(\d+))?\b/);
+  if (!match?.[1]) {
+    return {};
+  }
+  const line = match[2] === undefined ? undefined : Number(match[2]);
+  return line === undefined || Number.isNaN(line) ? { file: match[1] } : { file: match[1], line };
+}
+function legacyReviewer(block, reviewers) {
+  const attribution = labelledField(block, ["reviewer", "found by", "found independently by", "reviewers"]);
+  const named = attribution?.match(/\breview-[a-z0-9-]+\b/i);
+  if (named?.[0]) {
+    return named[0].toLowerCase();
+  }
+  return defaultReviewer(reviewers);
+}
+function legacyConfidence(block) {
+  const declared = labelledField(block, ["confidence"])?.toLowerCase();
+  if (declared !== undefined) {
+    for (const value of REVIEW_FINDING_CONFIDENCES) {
+      if (declared.startsWith(value)) {
+        return value;
+      }
+    }
+  }
+  return "low";
+}
+function parseClassScope(block) {
+  const lines = block.split(`
+`);
+  const start = lines.findIndex((line) => /class[_ ]scope/i.test(line));
+  if (start === -1) {
+    return null;
+  }
+  const rest = lines.slice(start).join(`
+`);
+  const sitesMatch = rest.match(/\bsites\b\s*[:=]\s*([\s\S]*?)(?=\benumeration_method\b|$)/i);
+  const methodMatch = rest.match(/\benumeration_method\b\s*[:=]\s*([\s\S]*?)(?=\n\s*\n|$)/i);
+  const sites = sitesMatch?.[1] === undefined ? [] : parseSites(sitesMatch[1]);
+  const method = unquote(methodMatch?.[1]?.replace(/\s+/g, " ").trim() ?? "");
+  if (sites.length === 0 || method === "") {
+    return null;
+  }
+  return { sites, enumeration_method: method };
+}
+function unquote(value) {
+  const trimmed = value.trim().replace(/[.;,]$/, "").trim();
+  return /^(["'`])[\s\S]*\1$/.test(trimmed) ? trimmed.slice(1, -1).trim() : trimmed;
+}
+function parseSites(raw) {
+  const text = raw.replace(/\s+/g, " ").trim().replace(/[;,]\s*$/, "");
+  if (text === "") {
+    return [];
+  }
+  if (text.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(text.slice(0, text.lastIndexOf("]") + 1));
+      if (Array.isArray(parsed)) {
+        return parsed.map((item) => String(item)).filter((item) => item !== "");
+      }
+    } catch {}
+  }
+  const separator = text.includes(";") ? ";" : ",";
+  return text.split(separator).map((item) => item.replace(/^[-*+\s`"]+|[\s`",]+$/g, "").trim()).filter((item) => item !== "");
+}
 var HEADING_MARKER = /^(?:#{1,6}|[-*+])\s+/;
 var FINDING_IDENTIFIER = /^(\[)?\s*(F-\d{3,})\b\s*(\])?/i;
 var TITLE_SEPARATOR = /^\s*[:\u2014\u2013-]+\s*/;
@@ -41419,10 +41884,6 @@ function findingBlock(lines, headingIndex) {
   return out.join(`
 `);
 }
-function hasClassScope(block) {
-  const lower = block.toLowerCase();
-  return (lower.includes("class_scope") || lower.includes("class scope")) && lower.includes("sites") && lower.includes("enumeration_method");
-}
 function classScopeViolations(findings) {
   return findings.filter((finding) => (finding.severity === "blocker" || finding.severity === "major") && finding.class_scope_present !== true);
 }
@@ -41493,7 +41954,7 @@ function renderLearning(findings) {
 
 ## Skill Learning
 
-${candidates.map((finding) => `- \`review-orchestrator\` <- ${finding.id}: ${finding.summary}`).join(`
+${candidates.map((finding) => `- \`${finding.reviewer}\` <- ${finding.id}: ${finding.summary}`).join(`
 `)}
 `;
 }
@@ -41506,7 +41967,7 @@ function renderDecisions(findings) {
   }
   return `# Decisions
 
-${findings.map((finding) => `- ${finding.id}: create follow-up task or learning proposal (${finding.classification}).`).join(`
+${findings.map((finding) => `- ${finding.id}: create follow-up task or learning proposal (${finding.classification}, ${finding.flow_relevance}).`).join(`
 `)}
 `;
 }
@@ -42765,6 +43226,24 @@ var COMMAND_DESCRIPTORS = [
     read: false,
     sideEffects: ["renames .metaproject/flows/**", "writes .metaproject/flows/id-map.json"]
   },
+  {
+    module: "sandbox",
+    command: "sandbox status",
+    summary: "OS sandbox launcher availability and the per-capability containment matrix for this platform. Report only \u2014 never runs a contained command, always exits 0.",
+    intent: [
+      "\u043F\u0440\u043E\u0432\u0435\u0440\u044C sandbox",
+      "\u0441\u0442\u0430\u0442\u0443\u0441 \u043F\u0435\u0441\u043E\u0447\u043D\u0438\u0446\u044B",
+      "sandbox status",
+      "is bubblewrap installed",
+      "\u0443\u0441\u0442\u0430\u043D\u043E\u0432\u043B\u0435\u043D \u043B\u0438 bubblewrap",
+      "os containment status",
+      "check os sandbox",
+      "\u043A\u0430\u043A\u0430\u044F \u0438\u0437\u043E\u043B\u044F\u0446\u0438\u044F \u0434\u043E\u0441\u0442\u0443\u043F\u043D\u0430"
+    ],
+    args: [{ name: "json", type: "bool", required: false, desc: "structured JSON report" }],
+    json: true,
+    read: true
+  },
   {
     module: "security",
     command: "security scan",
@@ -43709,14 +44188,14 @@ async function handlePolicy(cwd, args2) {
     return;
   }
   const config = await loadSecurityConfig(cwd);
-  const schemaErrors = validateSecurityConfig(config);
+  const schemaErrors2 = validateSecurityConfig(config);
   const checksum = verifyConfigChecksum(config);
   heading("keryx security policy validate");
   console.log("");
-  if (schemaErrors.length === 0) {
+  if (schemaErrors2.length === 0) {
     console.log(`  ${style.green(symbols.ok)} config schema: valid`);
   } else {
-    for (const error2 of schemaErrors) {
+    for (const error2 of schemaErrors2) {
       console.log(`  ${style.red(symbols.cross)} ${error2}`);
     }
   }
@@ -43725,7 +44204,7 @@ async function handlePolicy(cwd, args2) {
   } else {
     console.log(`  ${style.red(symbols.cross)} configChecksum: mismatch (expected ${checksum.expected})`);
   }
-  const ok = schemaErrors.length === 0 && checksum.match;
+  const ok = schemaErrors2.length === 0 && checksum.match;
   process.exitCode = ok ? 0 : 1;
 }
 async function handleIncidents(cwd, args2) {
@@ -43940,14 +44419,347 @@ function printSecurityHelp() {
   ]);
 }
 
+// src/harness/process/sandbox/detect.ts
+import { existsSync as realExistsSync } from "fs";
+import path133 from "path";
+
+// src/harness/process/sandbox/seatbelt.ts
+var SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
+function sbplString(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+var DEVICE_WRITE_LITERALS = [
+  "/dev/null",
+  "/dev/zero",
+  "/dev/stdin",
+  "/dev/stdout",
+  "/dev/stderr",
+  "/dev/tty",
+  "/dev/dtracehelper",
+  "/dev/random",
+  "/dev/urandom"
+];
+function buildSeatbeltProfile(profile) {
+  const lines = [
+    "(version 1)",
+    "(allow default)",
+    "",
+    ";; --- filesystem writes: deny everything, then re-allow workspace roots ---",
+    '(deny file-write* (subpath "/"))'
+  ];
+  for (const root of profile.writableRoots) {
+    lines.push(`(allow file-write* (subpath ${sbplString(root)}))`);
+  }
+  lines.push(`(allow file-write-data ${DEVICE_WRITE_LITERALS.map((d) => `(literal ${sbplString(d)})`).join(" ")})`);
+  if (profile.readDenyList.length > 0) {
+    lines.push("", ";; --- secret read-deny ---");
+    for (const secret of profile.readDenyList) {
+      lines.push(`(deny file-read* (subpath ${sbplString(secret)}))`);
+    }
+  }
+  if (profile.network === "off") {
+    lines.push("", ";; --- network off ---", "(deny network*)");
+  } else if (profile.network === "restricted") {
+    lines.push("", ";; --- network restricted to loopback allowlist proxy ---", "(deny network*)");
+    if (profile.proxy) {
+      lines.push(`(allow network-outbound (remote ip ${sbplString(`localhost:${profile.proxy.port}`)}))`);
+    }
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+function wrapSeatbelt(command, profile) {
+  const profileText = buildSeatbeltProfile(profile);
+  return {
+    path: SANDBOX_EXEC_PATH,
+    argv: ["sandbox-exec", "-p", profileText, command.path, ...command.argv.slice(1)],
+    env: command.env,
+    cwd: command.cwd
+  };
+}
+
+// src/harness/process/sandbox/bwrap.ts
+import { statSync as statSync4 } from "fs";
+var BWRAP_PROGRAM = "bwrap";
+function inspectMaskTarget(target) {
+  try {
+    return statSync4(target).isDirectory() ? "dir" : "file";
+  } catch {
+    return "missing";
+  }
+}
+function buildBwrapArgs(profile, inspect = inspectMaskTarget) {
+  const args2 = [
+    "--ro-bind",
+    "/",
+    "/",
+    "--dev",
+    "/dev",
+    "--proc",
+    "/proc",
+    "--tmpfs",
+    "/tmp"
+  ];
+  for (const root of profile.writableRoots) {
+    args2.push("--bind", root, root);
+  }
+  for (const secret of profile.readDenyList) {
+    const kind = inspect(secret);
+    if (kind === "dir") {
+      args2.push("--tmpfs", secret);
+    } else if (kind === "file") {
+      args2.push("--ro-bind", "/dev/null", secret);
+    }
+  }
+  if (profile.network === "off") {
+    args2.push("--unshare-net");
+  }
+  args2.push("--unshare-pid", "--unshare-ipc", "--die-with-parent", "--new-session");
+  return args2;
+}
+function wrapBwrap(command, profile, launcherPath = BWRAP_PROGRAM) {
+  return {
+    path: launcherPath,
+    argv: [BWRAP_PROGRAM, ...buildBwrapArgs(profile), "--", command.path, ...command.argv.slice(1)],
+    env: command.env,
+    cwd: command.cwd
+  };
+}
+
+// src/harness/process/sandbox/adapter.ts
+import { createHash as createHash21 } from "crypto";
+
+// src/harness/process/sandbox/wrap.ts
+function wrapWithSandbox(command, profile, opts) {
+  if (profile.mode === "danger-full-access") {
+    return { ok: true, command, wrapped: false };
+  }
+  if (opts.platform === "darwin") {
+    return { ok: true, command: wrapSeatbelt(command, profile), wrapped: true };
+  }
+  if (opts.platform === "linux") {
+    if (profile.network === "restricted") {
+      return {
+        ok: false,
+        reason: "network=restricted is not yet enforced on Linux (needs a network namespace + proxy relay); use network off/on or run inside a container."
+      };
+    }
+    const wrapped = opts.bwrapPath ? wrapBwrap(command, profile, opts.bwrapPath) : wrapBwrap(command, profile);
+    return { ok: true, command: wrapped, wrapped: true };
+  }
+  return {
+    ok: false,
+    reason: `OS sandbox is unsupported on platform "${opts.platform}"; run inside WSL2 or a container, or use an explicit danger-full-access override.`
+  };
+}
+
+// src/harness/process/sandbox/adapter.ts
+function spawnError(command, message2) {
+  return {
+    kind: "spawn-error",
+    observedHash: createHash21("sha256").update(`${command.path}
+${command.argv.join(" ")}`, "utf8").digest("hex"),
+    errorMessage: message2
+  };
+}
+
+class SandboxedProcessAdapter {
+  opts;
+  constructor(opts) {
+    this.opts = opts;
+  }
+  spawn(command) {
+    const { profile, inner, platform, launcherAvailable, bwrapPath } = this.opts;
+    const failClosed = profile.required || profile.network === "restricted" || (this.opts.failIfUnavailable ?? true);
+    if (profile.mode === "danger-full-access") {
+      return inner.spawn(command);
+    }
+    if (!launcherAvailable) {
+      if (failClosed) {
+        return spawnError(command, `OS sandbox launcher unavailable on ${platform} for program "${command.path}"; failing closed (install bubblewrap on Linux, or relax failIfUnavailable to run unsandboxed).`);
+      }
+      return inner.spawn(command);
+    }
+    const wrap2 = wrapWithSandbox(command, profile, {
+      platform,
+      ...bwrapPath !== undefined ? { bwrapPath } : {}
+    });
+    if (!wrap2.ok) {
+      if (failClosed) {
+        return spawnError(command, `sandbox wrap refused program "${command.path}" on ${platform}: ${wrap2.reason}`);
+      }
+      return inner.spawn(command);
+    }
+    const observation = inner.spawn(wrap2.command);
+    if (observation.kind === "spawn-error") {
+      const detail = observation.errorMessage ?? "unknown spawn error";
+      return spawnError(command, `sandbox spawn failed for "${command.path}" via ${platform} launcher: ${detail}`);
+    }
+    if (observation.kind === "clean-exit" && observation.exitCode === 71 && wrap2.wrapped) {
+      return spawnError(command, `sandbox launcher returned exit 71 (EX_OSERR) for "${command.path}" on ${platform}; often missing/non-executable helper or path denied inside the sandbox`);
+    }
+    return observation;
+  }
+}
+
+// src/harness/process/sandbox/detect.ts
+function detectSandboxLauncher(opts = {}) {
+  const platform = opts.platform ?? process.platform;
+  const exists2 = opts.existsSync ?? realExistsSync;
+  if (platform === "darwin") {
+    if (exists2(SANDBOX_EXEC_PATH)) {
+      return { available: true, platform, path: SANDBOX_EXEC_PATH };
+    }
+    return { available: false, platform, reason: `${SANDBOX_EXEC_PATH} not found` };
+  }
+  if (platform === "linux") {
+    const env = opts.env ?? process.env;
+    const dirs = (env.PATH ?? "").split(path133.delimiter).filter(Boolean);
+    for (const dir of dirs) {
+      const candidate = path133.join(dir, BWRAP_PROGRAM);
+      if (exists2(candidate)) {
+        return { available: true, platform, path: candidate };
+      }
+    }
+    return {
+      available: false,
+      platform,
+      reason: "bubblewrap (bwrap) not found on PATH; install it (apt install bubblewrap / dnf install bubblewrap)"
+    };
+  }
+  return { available: false, platform, reason: `OS sandbox unsupported on platform "${platform}"` };
+}
+function resolveSandboxAdapter(profile, inner, opts = {}) {
+  const info = detectSandboxLauncher(opts);
+  const adapter = new SandboxedProcessAdapter({
+    profile,
+    inner,
+    platform: info.platform,
+    launcherAvailable: info.available,
+    ...info.path !== undefined ? { bwrapPath: info.path } : {},
+    ...opts.failIfUnavailable !== undefined ? { failIfUnavailable: opts.failIfUnavailable } : {}
+  });
+  return { adapter, info };
+}
+
+// src/harness/process/sandbox/capability-matrix.ts
+var SANDBOX_CAPABILITY_MATRIX = [
+  { capability: "Filesystem containment", linux: "supported", darwin: "supported" },
+  { capability: "Network OFF", linux: "supported", darwin: "supported" },
+  { capability: "Domain allowlist", flag: "--allowed-domains", linux: "not-implemented", darwin: "supported" },
+  { capability: "Credential masking", flag: "--mask-env", linux: "not-implemented", darwin: "supported" }
+];
+function capabilityStatusFor(row, platform) {
+  return platform === "linux" ? row.linux : row.darwin;
+}
+function isKnownSandboxPlatform(platform) {
+  return platform === "linux" || platform === "darwin";
+}
+
+// src/commands/sandbox.ts
+var LAUNCHER_NAME = {
+  linux: "bubblewrap (bwrap)",
+  darwin: "Seatbelt (sandbox-exec)"
+};
+var LAUNCHER_NOT_INSTALLED = "launcher not installed";
+var NOT_IMPLEMENTED_ON_PLATFORM = "not implemented on this platform";
+function buildSandboxReport(deps = {}) {
+  const info = detectSandboxLauncher(deps);
+  const platform = info.platform;
+  const known = isKnownSandboxPlatform(platform);
+  const makeRow = (row, kind, status) => ({
+    capability: row.capability,
+    kind,
+    status,
+    ...row.flag !== undefined ? { flag: row.flag } : {}
+  });
+  const capabilities = SANDBOX_CAPABILITY_MATRIX.map((row) => {
+    if (!known) {
+      return makeRow(row, "not-implemented", `${NOT_IMPLEMENTED_ON_PLATFORM} ("${platform}") \u2014 the OS sandbox has no support for this platform at all.`);
+    }
+    const status = capabilityStatusFor(row, platform);
+    if (status === "not-implemented") {
+      return makeRow(row, "not-implemented", `${NOT_IMPLEMENTED_ON_PLATFORM} \u2014 installing the OS sandbox launcher would not change this.`);
+    }
+    if (!info.available) {
+      return makeRow(row, "launcher-missing", `requires ${LAUNCHER_NAME[platform]}; ${LAUNCHER_NOT_INSTALLED}.`);
+    }
+    return makeRow(row, "available", "available.");
+  });
+  return {
+    platform,
+    launcher: info,
+    launcherName: known ? LAUNCHER_NAME[platform] : undefined,
+    capabilities
+  };
+}
+function renderSandboxReport(report) {
+  const lines = [];
+  lines.push("keryx sandbox status");
+  lines.push("");
+  lines.push(`Platform: ${report.platform}`);
+  if (report.launcher.available) {
+    lines.push(`Launcher: available (${report.launcherName ?? "unknown"}${report.launcher.path ? ` at ${report.launcher.path}` : ""})`);
+  } else {
+    lines.push(`Launcher: not found${report.launcherName ? ` (${report.launcherName})` : ""} \u2014 ${report.launcher.reason ?? "unavailable"}`);
+  }
+  lines.push("");
+  lines.push("Capability matrix (this platform):");
+  for (const cap of report.capabilities) {
+    const flagNote = cap.flag ? ` (${cap.flag})` : "";
+    lines.push(`  - ${cap.capability}${flagNote}: ${cap.status}`);
+  }
+  lines.push("");
+  lines.push("This is a report, not a gate \u2014 it always exits 0. A contained run still fails closed " + "regardless of what this prints; nothing here changes that behaviour.");
+  return lines.join(`
+`);
+}
+function printHelp14() {
+  console.log(`keryx sandbox status [--json] \u2014 OS sandbox launcher availability and the per-capability containment matrix
+
+Usage:
+  keryx sandbox status [--json]
+
+Reports, for the current platform, whether the OS sandbox launcher (bubblewrap
+on Linux, Seatbelt on macOS) is installed, and for each containment capability
+(filesystem containment, network-off, domain allowlist, credential masking)
+whether it is available, blocked only on the launcher being missing, or not
+implemented on this platform at all \u2014 those are different findings and are
+never worded the same way. This command never runs a contained command and
+always exits 0: it is a report, not a gate. Run it any time; installation also
+prints this same information once, up front.
+`);
+}
+async function sandboxCommand(args2 = [], deps = {}) {
+  const subcommand = args2[0];
+  if (subcommand === "--help" || subcommand === "-h") {
+    printHelp14();
+    return;
+  }
+  if (subcommand !== undefined && subcommand !== "status" && subcommand !== "--json") {
+    console.error(`Unknown sandbox command: ${subcommand}`);
+    printHelp14();
+    process.exitCode = 1;
+    return;
+  }
+  const json = args2.includes("--json");
+  const report = buildSandboxReport(deps);
+  if (json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    console.log(renderSandboxReport(report));
+  }
+}
+
 // src/commands/mcp.ts
 init_args();
-import path138 from "path";
+import path139 from "path";
 
 // src/mcp/discovery.ts
 init_fs();
 init_json();
-import path133 from "path";
+import path134 from "path";
 var MODULE_MANIFEST_KEY = {
   gdgraph: "gdgraph",
   security: "security",
@@ -44009,7 +44821,7 @@ function buildDiscovery(manifest) {
   };
 }
 async function loadDiscovery(cwd) {
-  const manifestPath = path133.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path134.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return buildDiscovery({});
   }
@@ -44037,8 +44849,8 @@ async function invokeStructured(op, port, params) {
   switch (op.name) {
     case "search_code": {
       const pattern = stringParam(params, "pattern") ?? "";
-      const path134 = stringParam(params, "path");
-      return port.searchCode({ pattern, ...path134 !== undefined ? { path: path134 } : {} });
+      const path135 = stringParam(params, "path");
+      return port.searchCode({ pattern, ...path135 !== undefined ? { path: path135 } : {} });
     }
     case "graph_affected": {
       const target = stringParam(params, "file") ?? stringParam(params, "target") ?? "";
@@ -44053,8 +44865,8 @@ async function invokeStructured(op, port, params) {
       return port.memorySearch({ query });
     }
     case "read_wiki": {
-      const path134 = stringParam(params, "path") ?? "";
-      return port.readWiki({ path: path134 });
+      const path135 = stringParam(params, "path") ?? "";
+      return port.readWiki({ path: path135 });
     }
     default:
       return op.invoke(port, params);
@@ -44080,17 +44892,17 @@ init_sac();
 init_workspace_service();
 init_store2();
 init_fs();
-import { createHash as createHash23, randomUUID as randomUUID15 } from "crypto";
+import { createHash as createHash24, randomUUID as randomUUID15 } from "crypto";
 import { appendFile as appendFile5, mkdir as mkdir52, open as open2, readFile as readFile73, rename as rename6, rm as rm7, stat as stat6, writeFile as writeFile46 } from "fs/promises";
-import path134 from "path";
+import path135 from "path";
 
 // src/sac/policy-experiment.ts
-import { createHash as createHash22, createHmac as createHmac2 } from "crypto";
+import { createHash as createHash23, createHmac as createHmac2 } from "crypto";
 
 // src/sac/receipt-integrity.ts
 init_sac();
-import { createHash as createHash21 } from "crypto";
-var sha2563 = (value) => createHash21("sha256").update(value, "utf8").digest("hex");
+import { createHash as createHash22 } from "crypto";
+var sha2563 = (value) => createHash22("sha256").update(value, "utf8").digest("hex");
 function bodyOf(receipt) {
   const { integrity: _integrity, ...body } = receipt;
   return body;
@@ -44147,7 +44959,7 @@ function stableValue(value) {
   return value;
 }
 var stableJson2 = (value) => JSON.stringify(stableValue(value));
-var sha2564 = (value) => createHash22("sha256").update(stableJson2(value), "utf8").digest("hex");
+var sha2564 = (value) => createHash23("sha256").update(stableJson2(value), "utf8").digest("hex");
 var workspacePathPattern2 = /^\.\/(?!.*(?:^|\/)\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
 var trustedOutcomes = new WeakMap;
 var trustedSandboxEvidence = new WeakMap;
@@ -44167,7 +44979,7 @@ function policyCorpusDigest(manifest, rows, quarantine) {
 function splitFor(receiptHash, outcome, split) {
   if (outcome.caseClass === "adversarial")
     return "adversarial";
-  const byte = Number.parseInt(createHash22("sha256").update(`${split.seed}\x00${receiptHash}`).digest("hex").slice(0, 2), 16);
+  const byte = Number.parseInt(createHash23("sha256").update(`${split.seed}\x00${receiptHash}`).digest("hex").slice(0, 2), 16);
   return byte / 256 * 100 < split.holdoutPercent ? "holdout" : "train";
 }
 function quarantineCounts(entries) {
@@ -44251,12 +45063,12 @@ var stableValue2 = (value) => {
   return value;
 };
 var stableJson3 = (value) => JSON.stringify(stableValue2(value));
-var sha2565 = (value) => createHash23("sha256").update(stableJson3(value), "utf8").digest("hex");
+var sha2565 = (value) => createHash24("sha256").update(stableJson3(value), "utf8").digest("hex");
 var isImmutableVersion2 = (value) => typeof value === "string" && value.length >= 3 && value.length <= 256 && /^[A-Za-z0-9][A-Za-z0-9._:+-]*$/.test(value) && /\d/.test(value) && !immutableVersionPattern.test(value);
 var receiptHashPattern2 = /^[a-f0-9]{64}$/;
 var missingIdentity = Object.freeze({ ledgerBytes: 0, device: "0", inode: "0", modifiedNs: "0", changedNs: "0" });
 var isMissing = (error2) => error2 instanceof Error && error2.code === "ENOENT";
-var checkpointHash = (body) => createHash23("sha256").update(JSON.stringify(body), "utf8").digest("hex");
+var checkpointHash = (body) => createHash24("sha256").update(JSON.stringify(body), "utf8").digest("hex");
 async function ledgerIdentity(ledger) {
   const value = await stat6(ledger, { bigint: true });
   if (value.size > BigInt(Number.MAX_SAFE_INTEGER))
@@ -44401,7 +45213,7 @@ var isConfigRecord = (value) => typeof value.enabled === "boolean" && typeof val
 async function readPinnedJson(input2) {
   const ref = await resolveWorkspaceReference({ workspaceRoot: input2.workspaceRoot, kind: "artifact", uri: input2.uri });
   const raw = await readFile73(ref, "utf8");
-  const digest2 = createHash23("sha256").update(raw).digest("hex");
+  const digest2 = createHash24("sha256").update(raw).digest("hex");
   if (digest2 !== input2.digest)
     throw new Error("policy experiment pinned artifact digest mismatch");
   return { artifact: JSON.parse(raw), digest: digest2 };
@@ -44416,7 +45228,7 @@ function hasReportIntegrity(report) {
   return reportHashPattern.test(reportDigest) && sha2565(body) === reportDigest;
 }
 async function resolvePolicySelection(workspaceRoot, canonicalFallback) {
-  const configPath3 = path134.join(workspaceRoot, ...policyExperimentConfigPath);
+  const configPath3 = path135.join(workspaceRoot, ...policyExperimentConfigPath);
   let configJson;
   try {
     const raw = await readFile73(configPath3, "utf8").catch((error2) => {
@@ -44518,7 +45330,7 @@ async function diagnosePolicyReadiness(workspaceRoot) {
     const integrityReady = steps.every((entry) => entry.step === "activation-flags" || entry.status === "pass");
     return Object.freeze({ configPresent, enabled: enabled2, killSwitch: killSwitch2, integrityReady, candidateWouldActivate: integrityReady && enabled2 && !killSwitch2, steps: Object.freeze([...steps]) });
   };
-  const configPath3 = path134.join(workspaceRoot, ...policyExperimentConfigPath);
+  const configPath3 = path135.join(workspaceRoot, ...policyExperimentConfigPath);
   let configJson;
   try {
     const raw = await readFile73(configPath3, "utf8").catch((error2) => {
@@ -44749,9 +45561,9 @@ class FwkReadService {
     const recordedAt = nowIso2(now);
     const id = `receipt-${randomUUID15().replace(/-/g, "").slice(0, 16)}`;
     const base = { schemaVersion: "1.0", id, workspaceId, actor, action, decision, recordedAt, cost: { tokens: 0, toolCalls: 1, elapsedMs: 0 }, contextAssembly: { traceRef: assembly.traceRef, configurationRevision: assembly.configurationRevision, selected: assembly.selected.map((id2) => `./ids/${id2}`), omittedOptional: assembly.omittedOptional.map((id2) => `./ids/${id2}`) }, policy: { ref: assembly.policyRef, revision: assembly.policyRevision }, ...action === "resource" ? { resourceRef: `./ids/${resourceId ?? "unknown"}` } : {} };
-    const ledger = path134.join(this.options.canonical.workspaceRoot, ".metaproject", "context-operations", "access-receipts.jsonl");
-    const checkpointPath = path134.join(path134.dirname(ledger), "access-receipts.checkpoint.json");
-    await mkdir52(path134.dirname(ledger), { recursive: true, mode: 448 });
+    const ledger = path135.join(this.options.canonical.workspaceRoot, ".metaproject", "context-operations", "access-receipts.jsonl");
+    const checkpointPath = path135.join(path135.dirname(ledger), "access-receipts.checkpoint.json");
+    await mkdir52(path135.dirname(ledger), { recursive: true, mode: 448 });
     return withFileLock2(`${ledger}.lock`, async () => {
       const state = await resolveLedgerState(ledger, checkpointPath, this.options.verifyReceiptLedger ?? verifyAccessReceiptLedger);
       const receipt = sealAccessReceipt(base, state.headHash);
@@ -44797,12 +45609,12 @@ function createLocalFwkReadService(cwd, opts) {
       const flow = manifest.resources.find((resource) => resource.kind === "flow");
       const facts = await Promise.all(manifest.resources.filter((resource) => resource.kind === "evidence").map(async (resource, index) => {
         const raw = await workspaces.readResourceForActor({ actorContext, workspaceId, resource });
-        const revision = createHash23("sha256").update(raw).digest("hex");
+        const revision = createHash24("sha256").update(raw).digest("hex");
         return { id: `fact-${index}`, uri: resource.uri, revision: resource.revision ?? revision, observedAt: manifest.updatedAt, expiresAt: "9999-12-31T23:59:59Z", trust: "primary", visible: true, statement: `Evidence reference ${resource.uri}`, status: resource.revision === revision || resource.revision === undefined ? "fresh" : "stale" };
       }));
       const knowHow = await Promise.all(manifest.resources.filter((resource) => resource.kind === "wiki" || resource.kind === "memory" || resource.kind === "skill").map(async (resource, index) => {
         const raw = await workspaces.readResourceForActor({ actorContext, workspaceId, resource, encoding: "utf8" });
-        const revision = createHash23("sha256").update(raw).digest("hex");
+        const revision = createHash24("sha256").update(raw).digest("hex");
         const accepted = /^Status:\s*(accepted|reviewed)\s*$/mi.test(raw);
         return { id: `knowhow-${index}`, kind: resource.kind, uri: resource.uri, revision: resource.revision ?? revision, trust: "accepted", status: resource.revision === revision || resource.revision === undefined ? "fresh" : "stale", accepted, visible: true };
       }));
@@ -44844,7 +45656,7 @@ init_workspace_service();
 init_sac();
 import { appendFile as appendFile6, mkdir as mkdir53, readFile as readFile74 } from "fs/promises";
 import { randomUUID as randomUUID16 } from "crypto";
-import path135 from "path";
+import path136 from "path";
 
 class CollaborationServiceError extends Error {
   code;
@@ -44860,7 +45672,7 @@ class CollaborationService {
     this.input = input2;
   }
   file(id) {
-    return path135.join(this.input.workspaceRoot, ".metaproject", "workspaces", id, "activity.jsonl");
+    return path136.join(this.input.workspaceRoot, ".metaproject", "workspaces", id, "activity.jsonl");
   }
   async overview(input2) {
     const manifest = await this.input.workspaces.show(input2);
@@ -44885,7 +45697,7 @@ class CollaborationService {
       if (!isWorkspaceOwner(manifest.members, actor.subject))
         throw new CollaborationServiceError("access_denied", "owner authority is required");
       const activity = this.validate({ schemaVersion: "1.0", id: `activity-${randomUUID16()}`, workspaceId: manifest.id, actorSubject: actor.subject, occurredAt: (this.input.now ?? (() => new Date))().toISOString(), ...input2.activity });
-      await mkdir53(path135.dirname(this.file(manifest.id)), { recursive: true, mode: 448 });
+      await mkdir53(path136.dirname(this.file(manifest.id)), { recursive: true, mode: 448 });
       await appendFile6(this.file(manifest.id), `${JSON.stringify(activity)}
 `, { mode: 384 });
       return normalizeCollaborationResult(activity);
@@ -44919,9 +45731,9 @@ init_workspace_service();
 init_fs();
 init_machine_wrap_up();
 import { mkdir as mkdir54, readdir as readdir23, readFile as readFile75 } from "fs/promises";
-import path136 from "path";
+import path137 from "path";
 function externalSlatesDir(cwd) {
-  return path136.join(cwd, ".keryx", "external-slates");
+  return path137.join(cwd, ".keryx", "external-slates");
 }
 var EXTERNAL_SESSION_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 function assertValidExternalSessionId(externalSessionId) {
@@ -44931,14 +45743,14 @@ function assertValidExternalSessionId(externalSessionId) {
 }
 function externalSlatePath(cwd, externalSessionId) {
   assertValidExternalSessionId(externalSessionId);
-  return path136.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
+  return path137.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
 }
 function externalSlateLockPath(cwd, externalSessionId) {
   return `${externalSlatePath(cwd, externalSessionId)}.lock`;
 }
 function externalSlateEvidenceDir(cwd, externalSessionId) {
   assertValidExternalSessionId(externalSessionId);
-  return path136.join(externalSlatesDir(cwd), externalSessionId);
+  return path137.join(externalSlatesDir(cwd), externalSessionId);
 }
 async function readExternalSlate(cwd, externalSessionId) {
   try {
@@ -45487,7 +46299,7 @@ function buildToolRegistry() {
 
 // src/mcp/resources.ts
 init_fs();
-import path137 from "path";
+import path138 from "path";
 import { readdir as readdir24, readFile as readFile77, stat as stat7 } from "fs/promises";
 var URI_PREFIX = "metaproject://";
 function mimeForPath(filePath) {
@@ -45500,13 +46312,13 @@ function mimeForPath(filePath) {
   return "text/plain";
 }
 function dataRoot3(cwd) {
-  return path137.join(cwd, ".metaproject", "data");
+  return path138.join(cwd, ".metaproject", "data");
 }
 function wikiRoot(cwd) {
-  return path137.join(cwd, ".metaproject", "wiki");
+  return path138.join(cwd, ".metaproject", "wiki");
 }
 function memoryRoot2(cwd) {
-  return path137.join(cwd, ".metaproject", "memory");
+  return path138.join(cwd, ".metaproject", "memory");
 }
 async function walkFiles(root) {
   if (!await pathExists(root)) {
@@ -45520,7 +46332,7 @@ async function walkFiles(root) {
     return [];
   }
   for (const entry of entries) {
-    const full = path137.join(root, entry.name);
+    const full = path138.join(root, entry.name);
     if (entry.isDirectory()) {
       out.push(...await walkFiles(full));
     } else if (entry.isFile()) {
@@ -45545,9 +46357,9 @@ async function listArtifacts(cwd) {
     if (!moduleEntry.isDirectory()) {
       continue;
     }
-    const artifactsDir2 = path137.join(base, moduleEntry.name, "artifacts");
+    const artifactsDir2 = path138.join(base, moduleEntry.name, "artifacts");
     for (const file of await walkFiles(artifactsDir2)) {
-      const rel = toPosix(path137.relative(artifactsDir2, file));
+      const rel = toPosix(path138.relative(artifactsDir2, file));
       const relPath = `${moduleEntry.name}/${rel}`;
       listings.push({
         uri: `${URI_PREFIX}artifacts/${relPath}`,
@@ -45561,7 +46373,7 @@ async function listArtifacts(cwd) {
 async function listUnderRoot(cwd, cls, root) {
   const listings = [];
   for (const file of await walkFiles(root)) {
-    const rel = toPosix(path137.relative(root, file));
+    const rel = toPosix(path138.relative(root, file));
     listings.push({
       uri: `${URI_PREFIX}${cls}/${rel}`,
       name: rel,
@@ -45611,12 +46423,12 @@ function resolveConfined(cwd, cls, relPath) {
     if (moduleName.includes("..") || moduleName.length === 0) {
       return null;
     }
-    const root2 = path137.join(dataRoot3(cwd), moduleName, "artifacts");
-    const absolute2 = path137.resolve(root2, rest);
+    const root2 = path138.join(dataRoot3(cwd), moduleName, "artifacts");
+    const absolute2 = path138.resolve(root2, rest);
     return isPathInside(root2, absolute2) ? { root: root2, absolute: absolute2 } : null;
   }
   const root = cls === "wiki" ? wikiRoot(cwd) : memoryRoot2(cwd);
-  const absolute = path137.resolve(root, relPath);
+  const absolute = path138.resolve(root, relPath);
   return isPathInside(root, absolute) ? { root, absolute } : null;
 }
 async function readResource(cwd, roots, uri) {
@@ -45816,7 +46628,7 @@ async function mcpCommand(args2 = [], cwd = process.cwd()) {
   }
   if (!subcommand || subcommand === "serve") {
     const http = args2.includes("--http");
-    const projectRoot = path138.resolve(optionValue(args2, "--cwd") ?? cwd);
+    const projectRoot = path139.resolve(optionValue(args2, "--cwd") ?? cwd);
     try {
       await serveMcp({ cwd: projectRoot, http });
     } catch (error2) {
@@ -45850,7 +46662,7 @@ async function handleInstall2(cwd, args2) {
       console.log(outcome.snippet ?? "");
       continue;
     }
-    const rel = path138.relative(cwd, outcome.filePath);
+    const rel = path139.relative(cwd, outcome.filePath);
     if (outcome.errors.length > 0) {
       for (const e of outcome.errors) {
         console.log(`  ${style.red(symbols.cross)} ${e}`);
@@ -45890,7 +46702,7 @@ async function handleUninstall2(cwd, args2) {
       console.log(`  ${style.gray(symbols.off)} ${outcome.id} ${style.dim("no file to change")}`);
       continue;
     }
-    const rel = path138.relative(cwd, outcome.filePath);
+    const rel = path139.relative(cwd, outcome.filePath);
     console.log(`  ${outcome.removed ? style.green(symbols.ok) : style.gray(symbols.off)} ${outcome.id} ${style.dim(outcome.removed ? `removed from ${rel}` : "nothing to remove")}`);
   }
 }
@@ -45920,14 +46732,14 @@ function printMcpHelp() {
 // src/commands/status.ts
 init_fs();
 init_json();
-import path139 from "path";
+import path140 from "path";
 async function statusCommand(args2 = []) {
   if (args2.includes("--help") || args2.includes("-h")) {
-    printHelp14();
+    printHelp15();
     return;
   }
-  const root = path139.join(process.cwd(), ".metaproject");
-  const manifestPath = path139.join(root, "metaproject.json");
+  const root = path140.join(process.cwd(), ".metaproject");
+  const manifestPath = path140.join(root, "metaproject.json");
   if (!await pathExists(root)) {
     console.log("Metaproject: not initialized");
     console.log("Run: keryx init");
@@ -45954,7 +46766,7 @@ async function statusCommand(args2 = []) {
     console.log(`  ${name}: ${moduleConfig.enabled ? "enabled" : "disabled"}`);
   }
 }
-function printHelp14() {
+function printHelp15() {
   console.log(`keryx status \u2014 whether this project has a .metaproject workspace, and which modules are on
 
 Usage:
@@ -46023,7 +46835,7 @@ init_make_provider();
 init_profiles();
 
 // src/harness/run/run.ts
-import { createHash as createHash27 } from "crypto";
+import { createHash as createHash28 } from "crypto";
 
 // src/harness/completion/gate.ts
 var SCHEMA_VERSION2 = 1;
@@ -46074,10 +46886,10 @@ function evaluateCompletion(input2, deps) {
 }
 
 // src/harness/evidence/redaction.ts
-import { createHash as createHash24 } from "crypto";
+import { createHash as createHash25 } from "crypto";
 var CLEAN_CATEGORY = "none";
 function hashContent(content) {
-  return createHash24("sha256").update(content, "utf8").digest("hex");
+  return createHash25("sha256").update(content, "utf8").digest("hex");
 }
 function redactForPersistence(content, deps) {
   const scan2 = deps.scan(content);
@@ -46128,7 +46940,7 @@ async function metaprojectBlastRadius(port, target) {
 }
 
 // src/harness/session/session.ts
-import { createHash as createHash25 } from "crypto";
+import { createHash as createHash26 } from "crypto";
 var SCHEMA_VERSION3 = 1;
 function canonicalStringify(value) {
   if (Array.isArray(value)) {
@@ -46142,7 +46954,7 @@ function canonicalStringify(value) {
   return JSON.stringify(value) ?? "null";
 }
 function sha2566(input2) {
-  return createHash25("sha256").update(input2, "utf8").digest("hex");
+  return createHash26("sha256").update(input2, "utf8").digest("hex");
 }
 function deepFreeze(value) {
   if (value !== null && typeof value === "object") {
@@ -46234,11 +47046,11 @@ class AppendOnlySession {
 }
 
 // src/harness/context/manifest.ts
-import { createHash as createHash26 } from "crypto";
+import { createHash as createHash27 } from "crypto";
 var MAX_CONTEXT_BYTES = 2 * 1024 * 1024;
 var MAX_CONTEXT_TOKENS = 200000;
 function sha2567(input2) {
-  return createHash26("sha256").update(input2, "utf8").digest("hex");
+  return createHash27("sha256").update(input2, "utf8").digest("hex");
 }
 function normalizeSource(value) {
   const record = typeof value === "object" && value !== null ? value : {};
@@ -46364,7 +47176,7 @@ function canonicalize2(value) {
   return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalize2(record[key])}`).join(",")}}`;
 }
 function sha2568(input2) {
-  return createHash27("sha256").update(input2, "utf8").digest("hex");
+  return createHash28("sha256").update(input2, "utf8").digest("hex");
 }
 function uniqueInOrder2(values) {
   const seen = new Set;
@@ -46802,7 +47614,7 @@ function replayOffline(fixture, run, deps) {
 }
 
 // src/harness/tool/registry.ts
-import { createHash as createHash28 } from "crypto";
+import { createHash as createHash29 } from "crypto";
 function canonicalize3(value) {
   if (value === null || typeof value !== "object") {
     return JSON.stringify(value) ?? "null";
@@ -46816,7 +47628,7 @@ function canonicalize3(value) {
   return `{${entries.join(",")}}`;
 }
 function sha2569(input2) {
-  return createHash28("sha256").update(input2, "utf8").digest("hex");
+  return createHash29("sha256").update(input2, "utf8").digest("hex");
 }
 function definitionHash(definition) {
   return sha2569(canonicalize3(definition));
@@ -46967,11 +47779,11 @@ function runContainedProcess(input2, deps) {
 
 // src/harness/process/real-process-adapter.ts
 import { spawnSync } from "child_process";
-import { createHash as createHash29 } from "crypto";
+import { createHash as createHash30 } from "crypto";
 var DEFAULT_TIMEOUT_MS = 5000;
 var DEFAULT_MAX_OUTPUT_BYTES = 10 * 1024 * 1024;
 function sha256Hex4(input2) {
-  return createHash29("sha256").update(input2, "utf8").digest("hex");
+  return createHash30("sha256").update(input2, "utf8").digest("hex");
 }
 function byteLength(chunk) {
   if (chunk === null || chunk === undefined)
@@ -47040,7 +47852,7 @@ ${command.argv.join(" ")}`);
 }
 
 // src/harness/process/sandbox/profile.ts
-import path140 from "path";
+import path141 from "path";
 var DEFAULT_SECRET_SUBPATHS = [
   ".ssh",
   ".gnupg",
@@ -47065,7 +47877,7 @@ function defaultReadDenyList(home) {
   if (!home) {
     return [];
   }
-  return DEFAULT_SECRET_SUBPATHS.map((sub) => path140.join(home, sub));
+  return DEFAULT_SECRET_SUBPATHS.map((sub) => path141.join(home, sub));
 }
 function defaultSandboxProfile(cwd, tmpDir, home) {
   return {
@@ -47081,230 +47893,6 @@ function dedupe2(values) {
   return [...new Set(values.filter((v) => v.length > 0))];
 }
 
-// src/harness/process/sandbox/detect.ts
-import { existsSync as realExistsSync } from "fs";
-import path141 from "path";
-
-// src/harness/process/sandbox/seatbelt.ts
-var SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
-function sbplString(value) {
-  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
-}
-var DEVICE_WRITE_LITERALS = [
-  "/dev/null",
-  "/dev/zero",
-  "/dev/stdin",
-  "/dev/stdout",
-  "/dev/stderr",
-  "/dev/tty",
-  "/dev/dtracehelper",
-  "/dev/random",
-  "/dev/urandom"
-];
-function buildSeatbeltProfile(profile) {
-  const lines = [
-    "(version 1)",
-    "(allow default)",
-    "",
-    ";; --- filesystem writes: deny everything, then re-allow workspace roots ---",
-    '(deny file-write* (subpath "/"))'
-  ];
-  for (const root of profile.writableRoots) {
-    lines.push(`(allow file-write* (subpath ${sbplString(root)}))`);
-  }
-  lines.push(`(allow file-write-data ${DEVICE_WRITE_LITERALS.map((d) => `(literal ${sbplString(d)})`).join(" ")})`);
-  if (profile.readDenyList.length > 0) {
-    lines.push("", ";; --- secret read-deny ---");
-    for (const secret of profile.readDenyList) {
-      lines.push(`(deny file-read* (subpath ${sbplString(secret)}))`);
-    }
-  }
-  if (profile.network === "off") {
-    lines.push("", ";; --- network off ---", "(deny network*)");
-  } else if (profile.network === "restricted") {
-    lines.push("", ";; --- network restricted to loopback allowlist proxy ---", "(deny network*)");
-    if (profile.proxy) {
-      lines.push(`(allow network-outbound (remote ip ${sbplString(`localhost:${profile.proxy.port}`)}))`);
-    }
-  }
-  return `${lines.join(`
-`)}
-`;
-}
-function wrapSeatbelt(command, profile) {
-  const profileText = buildSeatbeltProfile(profile);
-  return {
-    path: SANDBOX_EXEC_PATH,
-    argv: ["sandbox-exec", "-p", profileText, command.path, ...command.argv.slice(1)],
-    env: command.env,
-    cwd: command.cwd
-  };
-}
-
-// src/harness/process/sandbox/bwrap.ts
-import { statSync as statSync4 } from "fs";
-var BWRAP_PROGRAM = "bwrap";
-function inspectMaskTarget(target) {
-  try {
-    return statSync4(target).isDirectory() ? "dir" : "file";
-  } catch {
-    return "missing";
-  }
-}
-function buildBwrapArgs(profile, inspect = inspectMaskTarget) {
-  const args2 = [
-    "--ro-bind",
-    "/",
-    "/",
-    "--dev",
-    "/dev",
-    "--proc",
-    "/proc",
-    "--tmpfs",
-    "/tmp"
-  ];
-  for (const root of profile.writableRoots) {
-    args2.push("--bind", root, root);
-  }
-  for (const secret of profile.readDenyList) {
-    const kind = inspect(secret);
-    if (kind === "dir") {
-      args2.push("--tmpfs", secret);
-    } else if (kind === "file") {
-      args2.push("--ro-bind", "/dev/null", secret);
-    }
-  }
-  if (profile.network === "off") {
-    args2.push("--unshare-net");
-  }
-  args2.push("--unshare-pid", "--unshare-ipc", "--die-with-parent", "--new-session");
-  return args2;
-}
-function wrapBwrap(command, profile, launcherPath = BWRAP_PROGRAM) {
-  return {
-    path: launcherPath,
-    argv: [BWRAP_PROGRAM, ...buildBwrapArgs(profile), "--", command.path, ...command.argv.slice(1)],
-    env: command.env,
-    cwd: command.cwd
-  };
-}
-
-// src/harness/process/sandbox/adapter.ts
-import { createHash as createHash30 } from "crypto";
-
-// src/harness/process/sandbox/wrap.ts
-function wrapWithSandbox(command, profile, opts) {
-  if (profile.mode === "danger-full-access") {
-    return { ok: true, command, wrapped: false };
-  }
-  if (opts.platform === "darwin") {
-    return { ok: true, command: wrapSeatbelt(command, profile), wrapped: true };
-  }
-  if (opts.platform === "linux") {
-    if (profile.network === "restricted") {
-      return {
-        ok: false,
-        reason: "network=restricted is not yet enforced on Linux (needs a network namespace + proxy relay); use network off/on or run inside a container."
-      };
-    }
-    const wrapped = opts.bwrapPath ? wrapBwrap(command, profile, opts.bwrapPath) : wrapBwrap(command, profile);
-    return { ok: true, command: wrapped, wrapped: true };
-  }
-  return {
-    ok: false,
-    reason: `OS sandbox is unsupported on platform "${opts.platform}"; run inside WSL2 or a container, or use an explicit danger-full-access override.`
-  };
-}
-
-// src/harness/process/sandbox/adapter.ts
-function spawnError(command, message2) {
-  return {
-    kind: "spawn-error",
-    observedHash: createHash30("sha256").update(`${command.path}
-${command.argv.join(" ")}`, "utf8").digest("hex"),
-    errorMessage: message2
-  };
-}
-
-class SandboxedProcessAdapter {
-  opts;
-  constructor(opts) {
-    this.opts = opts;
-  }
-  spawn(command) {
-    const { profile, inner, platform, launcherAvailable, bwrapPath } = this.opts;
-    const failClosed = profile.required || profile.network === "restricted" || (this.opts.failIfUnavailable ?? true);
-    if (profile.mode === "danger-full-access") {
-      return inner.spawn(command);
-    }
-    if (!launcherAvailable) {
-      if (failClosed) {
-        return spawnError(command, `OS sandbox launcher unavailable on ${platform} for program "${command.path}"; failing closed (install bubblewrap on Linux, or relax failIfUnavailable to run unsandboxed).`);
-      }
-      return inner.spawn(command);
-    }
-    const wrap2 = wrapWithSandbox(command, profile, {
-      platform,
-      ...bwrapPath !== undefined ? { bwrapPath } : {}
-    });
-    if (!wrap2.ok) {
-      if (failClosed) {
-        return spawnError(command, `sandbox wrap refused program "${command.path}" on ${platform}: ${wrap2.reason}`);
-      }
-      return inner.spawn(command);
-    }
-    const observation = inner.spawn(wrap2.command);
-    if (observation.kind === "spawn-error") {
-      const detail = observation.errorMessage ?? "unknown spawn error";
-      return spawnError(command, `sandbox spawn failed for "${command.path}" via ${platform} launcher: ${detail}`);
-    }
-    if (observation.kind === "clean-exit" && observation.exitCode === 71 && wrap2.wrapped) {
-      return spawnError(command, `sandbox launcher returned exit 71 (EX_OSERR) for "${command.path}" on ${platform}; often missing/non-executable helper or path denied inside the sandbox`);
-    }
-    return observation;
-  }
-}
-
-// src/harness/process/sandbox/detect.ts
-function detectSandboxLauncher(opts = {}) {
-  const platform = opts.platform ?? process.platform;
-  const exists2 = opts.existsSync ?? realExistsSync;
-  if (platform === "darwin") {
-    if (exists2(SANDBOX_EXEC_PATH)) {
-      return { available: true, platform, path: SANDBOX_EXEC_PATH };
-    }
-    return { available: false, platform, reason: `${SANDBOX_EXEC_PATH} not found` };
-  }
-  if (platform === "linux") {
-    const env = opts.env ?? process.env;
-    const dirs = (env.PATH ?? "").split(path141.delimiter).filter(Boolean);
-    for (const dir of dirs) {
-      const candidate = path141.join(dir, BWRAP_PROGRAM);
-      if (exists2(candidate)) {
-        return { available: true, platform, path: candidate };
-      }
-    }
-    return {
-      available: false,
-      platform,
-      reason: "bubblewrap (bwrap) not found on PATH; install it (apt install bubblewrap / dnf install bubblewrap)"
-    };
-  }
-  return { available: false, platform, reason: `OS sandbox unsupported on platform "${platform}"` };
-}
-function resolveSandboxAdapter(profile, inner, opts = {}) {
-  const info = detectSandboxLauncher(opts);
-  const adapter = new SandboxedProcessAdapter({
-    profile,
-    inner,
-    platform: info.platform,
-    launcherAvailable: info.available,
-    ...info.path !== undefined ? { bwrapPath: info.path } : {},
-    ...opts.failIfUnavailable !== undefined ? { failIfUnavailable: opts.failIfUnavailable } : {}
-  });
-  return { adapter, info };
-}
-
 // src/lib/sandbox-config.ts
 init_config_dir();
 init_shell_config();
@@ -47952,7 +48540,7 @@ function parseArgs2(args2) {
   let unattended;
   let goal;
   let workspace;
-  const positional = [];
+  const positional2 = [];
   for (let i = 1;i < args2.length; i++) {
     const arg = args2[i];
     if (arg === "--provider") {
@@ -47972,10 +48560,10 @@ function parseArgs2(args2) {
       const next = args2[i + 1];
       workspace = next !== undefined && !KNOWN_HARNESS_RUN_FLAGS.has(next) ? args2[++i] : undefined;
     } else if (arg !== undefined) {
-      positional.push(arg);
+      positional2.push(arg);
     }
   }
-  const parsed = { provider, model, prompt: goal !== undefined && goal.length > 0 ? goal : positional.join(" ") };
+  const parsed = { provider, model, prompt: goal !== undefined && goal.length > 0 ? goal : positional2.join(" ") };
   if (baseUrl !== undefined)
     parsed.baseUrl = baseUrl;
   if (record !== undefined)
@@ -50682,7 +51270,7 @@ function suggestShellPatterns(command) {
     exact,
     prefix,
     offerExact: !neverRemember && validateShellPattern(exact).ok,
-    offerPrefix: !neverRemember && validateShellPattern(prefix).ok
+    offerPrefix: !neverRemember && validateShellPattern(prefix).ok && isShellCommandAllowed(trimmed, [prefix])
   };
 }
 function parseShellExecCommand(inputJson) {
@@ -53997,7 +54585,7 @@ import { spawnSync as spawnSync2 } from "child_process";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.69",
+  version: "0.2.70",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -67679,7 +68267,7 @@ async function shellCommand(args2, runtime = {}) {
 async function sessionsCommand(args2) {
   const sub = args2[0] ?? "list";
   if (sub === "--help" || sub === "-h" || sub === "help") {
-    printHelp15();
+    printHelp16();
     return;
   }
   const cwd = process.cwd();
@@ -67785,7 +68373,7 @@ async function sessionsCommand(args2) {
     return;
   }
   console.error(`Unknown sessions subcommand: ${sub}`);
-  printHelp15();
+  printHelp16();
   process.exitCode = 1;
 }
 function pad(s, n) {
@@ -67794,7 +68382,7 @@ function pad(s, n) {
 function clip6(s, n) {
   return s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
 }
-function printHelp15() {
+function printHelp16() {
   console.log(`keryx sessions
 
 Per-project interactive shell sessions (isolated by git root / cwd).
@@ -67857,7 +68445,7 @@ function buildInitFlags(next, profile) {
 async function modulesCommand(args2 = []) {
   const sub = args2[0];
   if (sub === "--help" || sub === "-h" || sub === "help") {
-    printHelp16();
+    printHelp17();
     return;
   }
   const wantsJson = args2.includes("--json") && (sub === undefined || sub === "status" || sub === "list" || sub === "--json");
@@ -67914,7 +68502,7 @@ async function modulesCommand(args2 = []) {
       }
     }
   } else {
-    printHelp16();
+    printHelp17();
     process.exitCode = 1;
     return;
   }
@@ -67957,7 +68545,7 @@ function setsEqual(a, b) {
   }
   return true;
 }
-function printHelp16() {
+function printHelp17() {
   helpTitle("keryx modules", "view and toggle Metaproject modules");
   helpUsage([
     "keryx modules",
@@ -69429,7 +70017,7 @@ var ENABLE_FLAG = "--enable";
 var DISABLE_FLAG = "--disable";
 async function serveCommand(args2 = []) {
   if (args2.includes("--help") || args2.includes("-h") || args2[0] === "help") {
-    printHelp17();
+    printHelp18();
     return;
   }
   const sub = args2[0];
@@ -69450,14 +70038,14 @@ async function serveCommand(args2 = []) {
     return;
   }
   console.error(`Unknown serve command: ${sanitizeForDisplay(sub)}`);
-  printHelp17();
+  printHelp18();
   process.exitCode = 1;
 }
 async function runServe(args2) {
   const parsed = parseArgs3(args2, BIND_FLAGS, [ACK_FLAG]);
   if (!parsed.ok) {
     console.error(parsed.message);
-    printHelp17();
+    printHelp18();
     process.exitCode = 1;
     return;
   }
@@ -69559,7 +70147,7 @@ function runStatus6(args2) {
   const parsed = parseArgs3(args2, [], ["--json"]);
   if (!parsed.ok) {
     console.error(parsed.message);
-    printHelp17();
+    printHelp18();
     process.exitCode = 1;
     return;
   }
@@ -69606,7 +70194,7 @@ function runToken(args2) {
   const rest = parseArgs3(args2.slice(1), [], []);
   if (!rest.ok) {
     console.error(rest.message);
-    printHelp17();
+    printHelp18();
     process.exitCode = 1;
     return;
   }
@@ -69647,7 +70235,7 @@ function runToken(args2) {
     return;
   }
   console.error(sub === undefined ? "Missing token subcommand" : `Unknown token command: ${sanitizeForDisplay(sub)}`);
-  printHelp17();
+  printHelp18();
   process.exitCode = 1;
 }
 function printTokenOnce(token) {
@@ -69672,7 +70260,7 @@ function runConfig(args2) {
     const parsed = parseArgs3(args2.slice(1), BIND_FLAGS, [ACK_FLAG, FORCE_FLAG]);
     if (!parsed.ok) {
       console.error(parsed.message);
-      printHelp17();
+      printHelp18();
       process.exitCode = 1;
       return;
     }
@@ -69722,7 +70310,7 @@ function runConfig(args2) {
     const parsed = parseArgs3(args2.slice(1), [], ["--json"]);
     if (!parsed.ok) {
       console.error(parsed.message);
-      printHelp17();
+      printHelp18();
       process.exitCode = 1;
       return;
     }
@@ -69739,14 +70327,14 @@ function runConfig(args2) {
     return;
   }
   console.error(sub === undefined ? "Missing config subcommand" : `Unknown config command: ${sanitizeForDisplay(sub)}`);
-  printHelp17();
+  printHelp18();
   process.exitCode = 1;
 }
 function runConfigSet(args2) {
   const parsed = parseArgs3(args2, BIND_FLAGS, [ACK_FLAG, NO_ACK_FLAG, ENABLE_FLAG, DISABLE_FLAG]);
   if (!parsed.ok) {
     console.error(parsed.message);
-    printHelp17();
+    printHelp18();
     process.exitCode = 1;
     return;
   }
@@ -69817,7 +70405,7 @@ function printConfig(config) {
   console.log(`  approvals:  expire after ${config.approval.expirySeconds}s, max ${config.approval.maxPendingPerSession} pending per session`);
   console.log(`  non-loopback acknowledged: ${config.bind.acknowledgeNonLoopback === true}`);
 }
-function printHelp17() {
+function printHelp18() {
   helpTitle("keryx serve", "loopback-bound HTTP entry over this install (off by default)");
   helpUsage([
     `keryx serve [--bind <addr>] [--port <n>] [--profile <name>] [${ACK_FLAG}]`,
@@ -69863,7 +70451,7 @@ init_git_hooks();
 async function updateCommand(args2 = []) {
   const options = parseUpdateArgs(args2);
   if (options.help) {
-    printHelp18();
+    printHelp19();
     return;
   }
   const projectRoot = process.cwd();
@@ -71012,7 +71600,7 @@ function runtimeSourcePath2(relativePath) {
 function escapeRegExp6(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function printHelp18() {
+function printHelp19() {
   helpTitle("keryx update", "refresh .metaproject service files (data left untouched)");
   helpUsage(["keryx update [--skip-runtime] [--hooks] [--no-tasks]"]);
   heading("Default behavior");
@@ -71040,7 +71628,7 @@ async function dashboardCommand(args2 = []) {
   const options = parseOptions(args2);
   const subcommand = options.positionals[0];
   if (!subcommand || options.help) {
-    printHelp19();
+    printHelp20();
     return;
   }
   if (subcommand === "build") {
@@ -71058,7 +71646,7 @@ async function dashboardCommand(args2 = []) {
     return;
   }
   console.log(`  ${style.red(symbols.cross)} Unknown dashboard command: ${subcommand}`);
-  printHelp19();
+  printHelp20();
   process.exitCode = 1;
 }
 function parseOptions(args2) {
@@ -71083,7 +71671,7 @@ async function openFile(filePath) {
     });
   });
 }
-function printHelp19() {
+function printHelp20() {
   helpTitle("keryx dashboard", "build and open the human dashboard");
   helpUsage([
     "keryx dashboard build",
@@ -73656,7 +74244,7 @@ function service5() {
 async function workspaceCommand(args2) {
   const subcommand = args2[0];
   if (!subcommand || subcommand === "help" || args2.includes("--help") || args2.includes("-h"))
-    return printHelp20();
+    return printHelp21();
   try {
     if (subcommand === "create") {
       rejectUnknownOptions(args2.slice(1), new Set(["--title", "--component"]));
@@ -73906,7 +74494,7 @@ function booleanFlagDefaultTrue(args2, name) {
     return false;
   throw new Error(`Unknown value for ${name}: "${value}" \u2014 expected true or false`);
 }
-function printHelp20() {
+function printHelp21() {
   console.log(`keryx workspace create --title <title> [--component <workspace-relative-ref>]
 keryx workspace list [--include-archived]
 keryx workspace show <workspace-id>
@@ -73978,6 +74566,7 @@ var CLI_ROUTES = {
   standard: standardCommand,
   commands: commandsCommand,
   security: securityCommand,
+  sandbox: sandboxCommand,
   mcp: mcpCommand,
   harness: harnessCommand,
   shell: shellCommand,
@@ -73990,7 +74579,7 @@ async function main() {
   const args2 = process.argv.slice(2);
   const command = args2[0];
   if (command === "--help" || command === "-h" || command === "help" || !command) {
-    printHelp21();
+    printHelp22();
     return;
   }
   if (command === "--version" || command === "-v") {
@@ -74003,10 +74592,10 @@ async function main() {
     return;
   }
   console.error(`Unknown command: ${command}`);
-  printHelp21();
+  printHelp22();
   process.exitCode = 1;
 }
-function printHelp21() {
+function printHelp22() {
   console.log(`keryx ${VERSION2}
 
 Usage:
@@ -74084,6 +74673,8 @@ Usage:
   keryx security scan <path> [--json]
   keryx security scan-mcp <manifest|dir> [--json]
   keryx security check-input [--source <kind>] [--file <path>]
+  keryx sandbox status [--json]
+                                               OS sandbox launcher availability + per-capability containment matrix (report, not a gate)
   keryx security check-output [--target <kind>] [--file <path>]
   keryx security redact <path> [--out <path>]
   keryx security report [--since <ref>]
@@ -74125,6 +74716,7 @@ Commands:
   standard  Validate the workspace against the Metaproject Standard
   commands  Agent-callable command registry (intents, args, output, model usage)
   security  Policy-based scanning, redaction, guardrails and audit reports
+  sandbox   Report OS sandbox launcher availability and the per-capability containment matrix
   mcp       Expose Metaproject services over the Model Context Protocol (opt-in)
 `);
 }