@mrciphersmith/keryx 0.3.89 → 0.3.91

package/dist/cli.js

@@ -21105,7 +21105,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mrciphersmith/keryx",
-    version: "0.3.89",
+    version: "0.3.91",
     description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
     private: false,
     publishConfig: {
@@ -98346,7 +98346,7 @@ var init_registry3 = __esm(() => {
 // src/harness/tool/builtin/spawn-subagent-tool.ts
 import { createHash as createHash64, randomUUID as randomUUID26 } from "crypto";
 import { execFile as execFile7 } from "child_process";
-import { lstat as lstat15, mkdtemp as mkdtemp2, readFile as readFile108, realpath as realpath19, rm as rm15, stat as stat27 } from "fs/promises";
+import { lstat as lstat15, mkdir as mkdir56, mkdtemp as mkdtemp2, readFile as readFile108, realpath as realpath19, rm as rm15, stat as stat27, writeFile as writeFile36 } from "fs/promises";
 import { tmpdir as tmpdir6 } from "os";
 import path222 from "path";
 import { promisify as promisify5 } from "util";
@@ -98413,6 +98413,57 @@ ${blocks.join(`
 
 `)}` };
 }
+async function resolveSaveResultPath(root, target) {
+  if (target === undefined)
+    return { ok: true, abs: undefined };
+  if (typeof target !== "string" || target.trim() === "") {
+    return { ok: false, reason: "spawn_subagent save_result_to must be a non-empty project-relative path" };
+  }
+  const abs = confineToRoot(root, target);
+  if (abs === null)
+    return { ok: false, reason: `spawn_subagent save_result_to path escapes the project root: ${target}` };
+  if (CONTEXT_FILE_DENYLIST.test(path222.relative(root, abs).split(path222.sep).join("/"))) {
+    return { ok: false, reason: `spawn_subagent save_result_to refuses a credential or VCS-internal path: ${target}` };
+  }
+  try {
+    const realRoot = await realpath19(root);
+    let probe = abs;
+    for (;; ) {
+      try {
+        const real = await realpath19(probe);
+        const rel = path222.relative(realRoot, real);
+        if (rel.startsWith("..") || path222.isAbsolute(rel)) {
+          return { ok: false, reason: `spawn_subagent save_result_to resolves outside the project root: ${target}` };
+        }
+        if (probe === abs && !(await stat27(abs)).isFile()) {
+          return { ok: false, reason: `spawn_subagent save_result_to is not a regular file: ${target}` };
+        }
+        break;
+      } catch (err) {
+        if (err.code !== "ENOENT")
+          throw err;
+        const parent = path222.dirname(probe);
+        if (parent === probe)
+          throw err;
+        probe = parent;
+      }
+    }
+  } catch {
+    return { ok: false, reason: `spawn_subagent save_result_to cannot be used: ${target}` };
+  }
+  return { ok: true, abs };
+}
+async function saveChildResult(abs, text) {
+  try {
+    await mkdir56(path222.dirname(abs), { recursive: true });
+    await writeFile36(abs, text.endsWith(`
+`) ? text : `${text}
+`, "utf8");
+    return;
+  } catch (err) {
+    return err.message;
+  }
+}
 function resolveSubagentMaxToolCalls(env = process.env) {
   const n = parseIntEnvVar(env, ENV_SUBAGENT_MAX_TOOL_CALLS);
   return n === undefined || n <= 0 ? undefined : n;
@@ -98618,7 +98669,7 @@ function createSpawnSubagentTool(deps) {
   return {
     definition: {
       name: "spawn_subagent",
-      description: "Spawn a bounded subagent to work on a focused subtask in parallel-safe isolation " + "(MAE multi-agent). Use for independent investigations, reviews, or research while " + "you continue the main plan. Input: { task: string, mode?: 'read_only'|'general', " + "label?: string, max_tool_calls?: integer, max_rounds?: integer, context_files?: string[] }. " + "max_tool_calls is ADVISORY: it never stops the child, it only sets when the child is warned " + "(from 80% of it) to return its result; a hard tool-call cap exists only when the operator " + `configures ${ENV_SUBAGENT_MAX_TOOL_CALLS}. max_rounds limits model rounds (default 40, capped ` + "at 200). A child that hits its round budget or the operator's call cap gets one final round to " + "submit a partial result, and the output's first line is then 'status: BudgetExhausted (...)'. " + "External runtimes cannot accept these limits. " + "Default mode is read_only (no shell). " + "Returns the child's summary. Prefer one clear task per spawn; do not spawn for " + "trivial questions (answer yourself). Optionally accepts a 'model_tier' " + "(light|standard|deep) to size the child's model against your own, and a 'runtime' " + "block to delegate the child to an external vendor coding CLI instead of running it " + "in-process. Optional 'cwd' runs the child's tools against a different directory than " + "yours (e.g. a review worktree checked out at a PR head) \u2014 accepted only when it is your " + "own project root, a descendant of it, or one of its git worktrees; a relative path " + "resolves against your own cwd. Not supported for external (runtime.kind='external') children.",
+      description: "Spawn a bounded subagent to work on a focused subtask in parallel-safe isolation " + "(MAE multi-agent). Use for independent investigations, reviews, or research while " + "you continue the main plan. Input: { task: string, mode?: 'read_only'|'general', " + "label?: string, max_tool_calls?: integer, max_rounds?: integer, context_files?: string[], save_result_to?: string }. " + "max_tool_calls is ADVISORY: it never stops the child, it only sets when the child is warned " + "(from 80% of it) to return its result; a hard tool-call cap exists only when the operator " + `configures ${ENV_SUBAGENT_MAX_TOOL_CALLS}. max_rounds limits model rounds (default 40, capped ` + "at 200). A child that hits its round budget or the operator's call cap gets one final round to " + "submit a partial result, and the output's first line is then 'status: BudgetExhausted (...)'. " + "External runtimes cannot accept these limits. " + "Default mode is read_only (no shell). " + "Returns the child's summary. Prefer one clear task per spawn; do not spawn for " + "trivial questions (answer yourself). Optionally accepts a 'model_tier' " + "(light|standard|deep) to size the child's model against your own, and a 'runtime' " + "block to delegate the child to an external vendor coding CLI instead of running it " + "in-process. Optional 'cwd' runs the child's tools against a different directory than " + "yours (e.g. a review worktree checked out at a PR head) \u2014 accepted only when it is your " + "own project root, a descendant of it, or one of its git worktrees; a relative path " + "resolves against your own cwd. Not supported for external (runtime.kind='external') children.",
       inputSchema: {
         type: "object",
         properties: {
@@ -98640,6 +98691,10 @@ function createSpawnSubagentTool(deps) {
             items: { type: "string" },
             description: "Project-relative files (e.g. review slices) the host copies into the child's task, so " + "you do not paste them yourself. Resolved against your own project root (not 'cwd'); native " + "children only; credential files (.env*, keys) are refused. Up to 40 files and 400000 bytes in total."
           },
+          save_result_to: {
+            type: "string",
+            description: "Project-relative file the host writes the child's complete final text to when it ends, " + "so the result survives your own context (e.g. .metaproject/data/review/raw/<reviewer>.txt). " + "Native children only; credential and VCS paths are refused."
+          },
           max_rounds: {
             type: "integer",
             minimum: 1,
@@ -98718,6 +98773,17 @@ function createSpawnSubagentTool(deps) {
       if (!attached.ok) {
         return { status: "Error", output: attached.reason, isError: true };
       }
+      if (input.save_result_to !== undefined && isExternalRuntimeRequest) {
+        return {
+          status: "Error",
+          output: "spawn_subagent save_result_to is not supported for external (runtime.kind='external') children.",
+          isError: true
+        };
+      }
+      const saveTarget = await resolveSaveResultPath(deps.cwd, input.save_result_to);
+      if (!saveTarget.ok) {
+        return { status: "Error", output: saveTarget.reason, isError: true };
+      }
       const task = taskText;
       const labelRaw = typeof input.label === "string" ? input.label.trim() : "";
       childSeq += 1;
@@ -99191,9 +99257,11 @@ ${boundSummary(foldedPartial)}` : ""),
 ` + `MAE reservation: rounds\u2264${maxRounds} ` + (configuredMaxToolCalls === undefined ? "" : `calls\u2264${configuredMaxToolCalls} `) + (advisoryToolCalls === undefined ? "" : `calls~${advisoryToolCalls}(advisory) `) + `runtime\u2264${spawned.reservation.maxRuntimeMs}ms children=${ledger.childCount}
 ` + (tierRecord === undefined ? "" : `${tierRecord}
 `);
+          const saveNote = saveTarget.abs === undefined ? "" : `
+[full result ${await saveChildResult(saveTarget.abs, raw) === undefined ? "saved to" : "could NOT be saved to"} ${String(input.save_result_to)}]`;
           if (status === "Completed") {
             return { status, isError, output: `${header}--- summary ---
-${boundSummary(folded.text)}` };
+${boundSummary(folded.text)}${saveNote}` };
           }
           const statusLine = formatStoppedStatusLine(status, turnResult);
           const submitted = turnResult?.submittedResult;
@@ -99208,7 +99276,7 @@ ${raw}`).text;
             status,
             isError,
             output: `${statusLine}
-${header}${boundedResult}`,
+${header}${boundedResult}${saveNote}`,
             partial: boundedResult
           };
         } catch (cause) {
@@ -100926,7 +100994,7 @@ var init_dispatch2 = __esm(() => {
 
 // src/harness/external/acp-fs.ts
 import { constants as constants2, realpathSync as realpathSync15, statSync as statSync12 } from "fs";
-import { mkdir as mkdir56, open as open10, readFile as readFile109 } from "fs/promises";
+import { mkdir as mkdir57, open as open10, readFile as readFile109 } from "fs/promises";
 import path225 from "path";
 function refusedMethodError(method, reason) {
   return new AcpError(JSON_RPC_ERROR_CODES.methodNotFound, `${method} refused: ${reason}`, { reason });
@@ -100985,7 +101053,7 @@ async function writeTextFileInWorktree(worktree, target, content, requested, hoo
   }
   await hooks.beforeWrite?.();
   const parent = path225.dirname(target);
-  await mkdir56(parent, { recursive: true });
+  await mkdir57(parent, { recursive: true });
   const rootReal = realpathSync15(worktree);
   const parentReal = realpathSync15(parent);
   const rel = path225.relative(rootReal, parentReal);
@@ -103087,7 +103155,7 @@ var init_codec2 = __esm(() => {
 });
 
 // src/harness/external/runtime.ts
-import { mkdtemp as mkdtemp4, rm as rm17, writeFile as writeFile36 } from "fs/promises";
+import { mkdtemp as mkdtemp4, rm as rm17, writeFile as writeFile37 } from "fs/promises";
 import { tmpdir as tmpdir8 } from "os";
 import path227 from "path";
 function refuse2(status, output) {
@@ -103100,7 +103168,7 @@ async function prepareResultSchema() {
     const schemaText = JSON.stringify(schema, null, 2);
     schemaDir = await mkdtemp4(path227.join(tmpdir8(), "keryx-external-result-schema-"));
     const schemaPath = path227.join(schemaDir, "subagent-result.schema.json");
-    await writeFile36(schemaPath, schemaText, "utf8");
+    await writeFile37(schemaPath, schemaText, "utf8");
     return { ok: true, schema, schemaText, schemaPath, schemaDir };
   } catch (error) {
     if (schemaDir !== undefined) {
@@ -103209,7 +103277,7 @@ async function runExternalChild(input, deps) {
   if (codexStrict) {
     resultSchemaPathForCodec = path227.join(schemaDir, STRICT_SCHEMA_FILE);
     try {
-      await writeFile36(resultSchemaPathForCodec, JSON.stringify(toStrictOutputSchema(bundledResultSchema)), "utf8");
+      await writeFile37(resultSchemaPathForCodec, JSON.stringify(toStrictOutputSchema(bundledResultSchema)), "utf8");
     } catch (error) {
       await rm17(schemaDir, { recursive: true, force: true }).catch(() => {
         return;
@@ -103475,7 +103543,7 @@ var init_runtime2 = __esm(() => {
 // src/harness/run-external-factory.ts
 import { randomUUID as randomUUID27 } from "crypto";
 import { execFile as execFile10 } from "child_process";
-import { mkdir as mkdir57 } from "fs/promises";
+import { mkdir as mkdir58 } from "fs/promises";
 import { tmpdir as tmpdir9 } from "os";
 import path228 from "path";
 import { promisify as promisify8 } from "util";
@@ -103505,7 +103573,7 @@ async function defaultWorkingDiff(cwd) {
 function ensuringParentDir(port, worktreesDir) {
   return {
     async create(worktreeId) {
-      await mkdir57(worktreesDir, { recursive: true });
+      await mkdir58(worktreesDir, { recursive: true });
       return port.create(worktreeId);
     },
     remove: (worktreeId) => port.remove(worktreeId),
@@ -117740,7 +117808,7 @@ var init_repair = __esm(() => {
 });
 
 // src/review/managed.ts
-import { mkdir as mkdir58, readFile as readFile121, readdir as readdir39, realpath as realpath20, rm as rm18, stat as stat29 } from "fs/promises";
+import { mkdir as mkdir59, readFile as readFile121, readdir as readdir39, realpath as realpath20, rm as rm18, stat as stat29 } from "fs/promises";
 import path252 from "path";
 function reviewsRoot(cwd) {
   return path252.join(cwd, ".metaproject", "reviews");
@@ -117876,7 +117944,7 @@ async function createManagedReviewPackage(input) {
   if (contractErrors.length > 0) {
     throw new Error(`Refusing to record findings that do not satisfy review-finding.schema.json: ${contractErrors.map((error) => `${error.path} ${error.message}`).join("; ")}`);
   }
-  await mkdir58(packageDir, { recursive: true });
+  await mkdir59(packageDir, { recursive: true });
   await writeFileAtomic(path252.join(packageDir, "research.json"), `${JSON.stringify(input.research ?? PENDING_RESEARCH, null, 2)}
 `);
   await writeFileAtomic(path252.join(packageDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
@@ -118152,7 +118220,13 @@ async function readReport(input) {
     return input.reportText;
   }
   if (input.reportPath) {
-    return readFile121(path252.resolve(input.cwd, input.reportPath), "utf8");
+    try {
+      return await readFile121(path252.resolve(input.cwd, input.reportPath), "utf8");
+    } catch (error) {
+      const code = error.code;
+      if (input.mode === "ingest" || code !== "ENOENT" && code !== "EISDIR")
+        throw error;
+    }
   }
   if (input.mode === "ingest") {
     throw new Error("ingest requires --report or reportText");
@@ -125399,7 +125473,7 @@ var init_aggregate = __esm(() => {
 });
 
 // src/governance/report.ts
-import { mkdir as mkdir59 } from "fs/promises";
+import { mkdir as mkdir60 } from "fs/promises";
 import path261 from "path";
 function governanceDataRoot(cwd) {
   return path261.join(cwd, ".metaproject", "data", "governance");
@@ -125585,7 +125659,7 @@ function renderTriggerSpendLine(spend) {
 }
 async function writeGovernanceArtifacts(cwd, report) {
   const { markdown, json } = artifactPaths(cwd);
-  await mkdir59(path261.dirname(markdown), { recursive: true });
+  await mkdir60(path261.dirname(markdown), { recursive: true });
   await writeFileAtomic(markdown, renderGovernanceMarkdown(report));
   await writeFileAtomic(json, `${JSON.stringify(report, null, 2)}
 `);
@@ -128773,7 +128847,7 @@ var init_granted_json_ids = __esm(() => {
 // src/commands/trigger-agent-task.ts
 import { execFile as execFile11 } from "child_process";
 import { randomUUID as randomUUID35 } from "crypto";
-import { mkdtemp as mkdtemp5, mkdir as mkdir60, readdir as readdir42, rm as rm19, writeFile as writeFile37 } from "fs/promises";
+import { mkdtemp as mkdtemp5, mkdir as mkdir61, readdir as readdir42, rm as rm19, writeFile as writeFile38 } from "fs/promises";
 import { homedir as homedir12, tmpdir as tmpdir11 } from "os";
 import path268 from "path";
 function scrubGrantedOutput(text, env, secrets = [], json = false) {
@@ -128944,9 +129018,9 @@ async function runLocked(projectRoot, entry, action, deps, runId, now) {
   const workdir = path268.join(scratch, "work");
   const scratchHome = path268.join(scratch, "home");
   const grantedCwd = path268.join(scratch, "granted-cwd");
-  await mkdir60(workdir, { recursive: true });
-  await mkdir60(scratchHome, { recursive: true });
-  await mkdir60(grantedCwd, { recursive: true, mode: 448 });
+  await mkdir61(workdir, { recursive: true });
+  await mkdir61(scratchHome, { recursive: true });
+  await mkdir61(grantedCwd, { recursive: true, mode: 448 });
   const cleanup = async () => {
     await rm19(scratch, { recursive: true, force: true }).catch(() => {});
   };
@@ -129114,9 +129188,9 @@ async function runLocked(projectRoot, entry, action, deps, runId, now) {
     try {
       await ensureTriggerDataIgnored(projectRoot);
       const dir = path268.join(triggerReportsDir(projectRoot), entry.name);
-      await mkdir60(dir, { recursive: true });
+      await mkdir61(dir, { recursive: true });
       const file = path268.join(dir, `${runId}.md`);
-      await writeFile37(file, renderReport3({ entry, action, runId, at: now().toISOString(), outcome, why, cost, grantedCalls, denials, sandboxNote, summary, networkDecisions }), "utf8");
+      await writeFile38(file, renderReport3({ entry, action, runId, at: now().toISOString(), outcome, why, cost, grantedCalls, denials, sandboxNote, summary, networkDecisions }), "utf8");
       await pruneReports(dir, action.report.keep);
       reportPath = path268.relative(projectRoot, file);
     } catch (error) {
@@ -129663,18 +129737,18 @@ var init_types10 = __esm(() => {
 
 // src/intake/store.ts
 import { createHash as createHash70 } from "crypto";
-import { appendFile as appendFile14, mkdir as mkdir61, readFile as readFile128, writeFile as writeFile38 } from "fs/promises";
+import { appendFile as appendFile14, mkdir as mkdir62, readFile as readFile128, writeFile as writeFile39 } from "fs/promises";
 import path272 from "path";
 async function ensureIntakeDataIgnored(root) {
   const dir = intakeDataDir(root);
-  await mkdir61(dir, { recursive: true });
+  await mkdir62(dir, { recursive: true });
   const file = path272.join(dir, ".gitignore");
   try {
     await readFile128(file, "utf8");
   } catch (error) {
     if (!isNotFound(error))
       throw error;
-    await writeFile38(file, `# Work intake: the card registry, the ledger and the poll state. Never committed.
+    await writeFile39(file, `# Work intake: the card registry, the ledger and the poll state. Never committed.
 *
 !.gitignore
 `, "utf8");
@@ -130815,7 +130889,7 @@ var init_events = __esm(() => {
 
 // src/intake/poll.ts
 import { randomUUID as randomUUID36 } from "crypto";
-import { mkdir as mkdir62, mkdtemp as mkdtemp6, rm as rm21, writeFile as writeFile39 } from "fs/promises";
+import { mkdir as mkdir63, mkdtemp as mkdtemp6, rm as rm21, writeFile as writeFile40 } from "fs/promises";
 import path275 from "path";
 function intakePollDue(config, state, now) {
   if (!config.enabled || state.paused || config.repos.length === 0)
@@ -130924,7 +130998,7 @@ async function pollLocked(root, config, deps, runId, now) {
   try {
     if (scratch !== undefined) {
       const cwd = path275.join(scratch, "granted-cwd");
-      await mkdir62(cwd, { recursive: true, mode: 448 });
+      await mkdir63(cwd, { recursive: true, mode: 448 });
       const gh = await verifyGh(root, env);
       if (!gh.ok)
         failures.push({ source: "gh", detail: `refusing to run: ${gh.reason}` });
@@ -131113,9 +131187,9 @@ async function writeReport2(root, r) {
   try {
     await ensureIntakeDataIgnored(root);
     const dir = intakeReportsDir(root);
-    await mkdir62(dir, { recursive: true });
+    await mkdir63(dir, { recursive: true });
     const file = path275.join(dir, `${r.runId}.md`);
-    await writeFile39(file, scrubGrantedOutput(lines.join(`
+    await writeFile40(file, scrubGrantedOutput(lines.join(`
 `), r.env), "utf8");
     await pruneReports(dir, REPORTS_KEEP);
     return path275.relative(root, file);
@@ -132412,7 +132486,7 @@ var init_decisions_surface = __esm(() => {
 });
 
 // src/scheduler/research-sync-job.ts
-import { mkdir as mkdir63, readFile as readFile131, readdir as readdir44, rm as rm22, writeFile as writeFile40 } from "fs/promises";
+import { mkdir as mkdir64, readFile as readFile131, readdir as readdir44, rm as rm22, writeFile as writeFile41 } from "fs/promises";
 import path276 from "path";
 function researchSyncDataDir(projectRoot) {
   return path276.join(projectRoot, ".metaproject", "data", "research-sync");
@@ -132451,14 +132525,14 @@ async function writeFired2(projectRoot, state) {
 }
 async function ensureIgnored(projectRoot) {
   const dir = researchSyncDataDir(projectRoot);
-  await mkdir63(dir, { recursive: true });
+  await mkdir64(dir, { recursive: true });
   const file = path276.join(dir, ".gitignore");
   try {
     await readFile131(file, "utf8");
   } catch (error) {
     if (!isNotFound(error))
       throw error;
-    await writeFile40(file, `# Daily research sync: the entry and the day it last ran. Never staged.
+    await writeFile41(file, `# Daily research sync: the entry and the day it last ran. Never staged.
 *
 !.gitignore
 `, "utf8");
@@ -132490,7 +132564,7 @@ async function claimFiles(projectRoot) {
 }
 async function claimDay(projectRoot, day, at) {
   try {
-    await writeFile40(researchSyncClaimPath(projectRoot, day), `${JSON.stringify({ pid: process.pid, claimedAt: at.toISOString() })}
+    await writeFile41(researchSyncClaimPath(projectRoot, day), `${JSON.stringify({ pid: process.pid, claimedAt: at.toISOString() })}
 `, { flag: "wx" });
   } catch (error) {
     if (error.code === "EEXIST")
@@ -132688,7 +132762,7 @@ var STATUS_TITLE = "# \u0422\u0435\u043A\u0443\u0449\u0435\u0435 \u0441\u043E\u0
 
 // src/commands/research-sync.ts
 import { execFile as execFile12 } from "child_process";
-import { mkdir as mkdir64, mkdtemp as mkdtemp7, readFile as readFile132, rename as rename12, rm as rm23, writeFile as writeFile41 } from "fs/promises";
+import { mkdir as mkdir65, mkdtemp as mkdtemp7, readFile as readFile132, rename as rename12, rm as rm23, writeFile as writeFile42 } from "fs/promises";
 import { tmpdir as tmpdir12 } from "os";
 import path277 from "path";
 import { promisify as promisify9 } from "util";
@@ -132723,7 +132797,7 @@ async function runCounts(root) {
     const gitDir = (await tool("git", ["rev-parse", "--absolute-git-dir"], { cwd: root }, "git rev-parse")).trim();
     const archive = path277.join(work, "flows.tar");
     const tree = path277.join(work, "tree");
-    await mkdir64(tree);
+    await mkdir65(tree);
     await tool("git", ["archive", "--format=tar", `--output=${archive}`, "HEAD", ".metaproject/flows"], { cwd: root }, "git archive");
     await tool("tar", ["-xf", archive, "-C", tree], { cwd: work }, "tar extract");
     const python = process.platform === "win32" ? "python" : "python3";
@@ -132755,7 +132829,7 @@ function withoutTime(counts) {
 async function writeAtomic(file, content) {
   const temp = `${file}.tmp-${process.pid}`;
   try {
-    await writeFile41(temp, content, "utf8");
+    await writeFile42(temp, content, "utf8");
     await rename12(temp, file);
   } catch (error) {
     await rm23(temp, { force: true });
@@ -132808,7 +132882,7 @@ async function recordFailure(root, runAt, reason) {
   await writeIfChanged(file, text);
 }
 async function runResearchSync(input) {
-  const deps = { now: () => new Date, runCounts, headHash, writeStaged: (file, content) => writeFile41(file, content, "utf8"), renameStaged: rename12, ...input };
+  const deps = { now: () => new Date, runCounts, headHash, writeStaged: (file, content) => writeFile42(file, content, "utf8"), renameStaged: rename12, ...input };
   const { root } = deps;
   const runAt = deps.now();
   let computed;
@@ -132855,7 +132929,7 @@ async function runResearchSync(input) {
         if (item.previous === null)
           await rm23(item.file, { force: true });
         else
-          await writeFile41(item.file, item.previous, "utf8");
+          await writeFile42(item.file, item.previous, "utf8");
       } catch {}
     }
     changed.length = 0;
@@ -146613,7 +146687,7 @@ var init_jev_edit_guard_inspector = __esm(() => {
 // src/review/jev-edit-guard-log.ts
 import { appendFile as appendFile16, readFile as readFile154 } from "fs/promises";
 import path296 from "path";
-import { mkdir as mkdir65 } from "fs/promises";
+import { mkdir as mkdir66 } from "fs/promises";
 function isEditGuardLogStatus(value) {
   return typeof value === "string" && EDIT_GUARD_LOG_STATUSES.includes(value);
 }
@@ -146667,7 +146741,7 @@ async function readEditGuardLogRecords(cwd) {
 }
 async function appendEditGuardLog(cwd, record) {
   const file = path296.join(cwd, EDIT_GUARD_LOG_PATH);
-  await mkdir65(path296.dirname(file), { recursive: true });
+  await mkdir66(path296.dirname(file), { recursive: true });
   await appendFile16(file, `${JSON.stringify(record)}
 `, { mode: 384 });
 }
@@ -155309,7 +155383,7 @@ var init_execution_plan_panel = __esm(() => {
 });
 
 // src/assets/pull.ts
-import { mkdir as mkdir66, writeFile as writeFile42 } from "fs/promises";
+import { mkdir as mkdir67, writeFile as writeFile43 } from "fs/promises";
 import path301 from "path";
 async function pullAsset(id, lock, options = {}) {
   const entry = lock.assets[id];
@@ -155328,8 +155402,8 @@ async function pullAsset(id, lock, options = {}) {
   }
   const destDir = options.destDir ?? assetCacheDir();
   const destPath = path301.join(destDir, id);
-  await mkdir66(destDir, { recursive: true });
-  await writeFile42(destPath, bytes);
+  await mkdir67(destDir, { recursive: true });
+  await writeFile43(destPath, bytes);
   return { path: destPath, sha256: actual, verified: true };
 }
 var defaultFetcher = async (url) => {
@@ -156269,7 +156343,7 @@ var init_diff = __esm(() => {
 });
 
 // src/sync/hooks.ts
-import { chmod as chmod11, mkdir as mkdir67, readFile as readFile157, writeFile as writeFile43 } from "fs/promises";
+import { chmod as chmod11, mkdir as mkdir68, readFile as readFile157, writeFile as writeFile44 } from "fs/promises";
 import path303 from "path";
 function escapeRegExp8(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -156292,7 +156366,7 @@ async function writeManagedHook(projectRoot, hookName) {
   if (!hooksRoot) {
     return false;
   }
-  await mkdir67(hooksRoot, { recursive: true });
+  await mkdir68(hooksRoot, { recursive: true });
   const hookPath = path303.join(hooksRoot, hookName);
   const start = `# keryx:${BLOCK_ID}:begin`;
   const end = `# keryx:${BLOCK_ID}:end`;
@@ -156306,7 +156380,7 @@ ${end}`;
 
 ${block}
 `;
-  await writeFile43(hookPath, next, "utf8");
+  await writeFile44(hookPath, next, "utf8");
   await chmod11(hookPath, 493);
   return true;
 }
@@ -156326,7 +156400,7 @@ async function stripManagedHook(projectRoot, hookName) {
   if (!pattern.test(existing)) {
     return false;
   }
-  await writeFile43(hookPath, `${existing.replace(pattern, `
+  await writeFile44(hookPath, `${existing.replace(pattern, `
 `).trimEnd()}
 `, "utf8");
   return true;
@@ -157612,7 +157686,7 @@ var init_digest_summary = __esm(() => {
 
 // src/scheduler/digest-run.ts
 import { randomUUID as randomUUID41 } from "crypto";
-import { mkdir as mkdir68, mkdtemp as mkdtemp10, rm as rm26, writeFile as writeFile44 } from "fs/promises";
+import { mkdir as mkdir69, mkdtemp as mkdtemp10, rm as rm26, writeFile as writeFile45 } from "fs/promises";
 import path305 from "path";
 function scrubDigestReportLocator(locator, env) {
   const scrubbed = scrubGrantedOutput(locator, env);
@@ -157684,7 +157758,7 @@ async function runLocked2(projectRoot, entry, action, deps, runId, now) {
   }
   const scratch = await mkdtemp10(path305.join(parent.dir, `${entry.name.replace(/[^A-Za-z0-9._-]/g, "-")}-`));
   const grantedCwd = path305.join(scratch, "granted-cwd");
-  await mkdir68(grantedCwd, { recursive: true, mode: 448 });
+  await mkdir69(grantedCwd, { recursive: true, mode: 448 });
   const limits = startLimits({ maxSeconds: dispatch.maxSeconds, memoryLimitMb: digest.memoryLimitMb }, { ...deps.armTimeout !== undefined ? { armTimeout: deps.armTimeout } : {}, ...deps.limits ?? {} });
   let crashed;
   let collected = { items: [], failures: [], failedSources: new Set, truncatedSources: new Set, raw: [], calls: [], stopped: false };
@@ -157771,9 +157845,9 @@ async function runLocked2(projectRoot, entry, action, deps, runId, now) {
   try {
     await ensureTriggerDataIgnored(projectRoot);
     const dir = path305.join(triggerReportsDir(projectRoot), entry.name);
-    await mkdir68(dir, { recursive: true });
+    await mkdir69(dir, { recursive: true });
     const file = path305.join(dir, `${runId}.md`);
-    await writeFile44(file, renderDigestReport({
+    await writeFile45(file, renderDigestReport({
       entry,
       runId,
       at: startedAt.toISOString(),
@@ -174232,7 +174306,7 @@ var init_sweep = __esm(() => {
 });
 
 // src/retention/auto-sweep.ts
-import { mkdir as mkdir69, readFile as readFile167, rm as rm27, stat as stat35, writeFile as writeFile45 } from "fs/promises";
+import { mkdir as mkdir70, readFile as readFile167, rm as rm27, stat as stat35, writeFile as writeFile46 } from "fs/promises";
 import { randomUUID as randomUUID43 } from "crypto";
 import path322 from "path";
 function autoSweepStampPath(cwd) {
@@ -174285,7 +174359,7 @@ async function acquireClaim(claimPath, staleMs) {
   const nonce = `${process.pid}:${randomUUID43()}`;
   for (let attempt = 0;attempt < 2; attempt += 1) {
     try {
-      await writeFile45(claimPath, nonce, { flag: "wx", mode: 384 });
+      await writeFile46(claimPath, nonce, { flag: "wx", mode: 384 });
       return {
         release: async () => {
           try {
@@ -174328,7 +174402,7 @@ async function maybeAutoSweepGdctx(cwd, options = {}) {
   }
   const stamp = autoSweepStampPath(cwd);
   try {
-    await mkdir69(path322.dirname(stamp), { recursive: true });
+    await mkdir70(path322.dirname(stamp), { recursive: true });
   } catch {
     return { ran: false, reason: "stamp-unwritable" };
   }
@@ -174341,7 +174415,7 @@ async function maybeAutoSweepGdctx(cwd, options = {}) {
       return { ran: false, reason: "throttled" };
     }
     try {
-      await writeFile45(stamp, `${JSON.stringify({ startedAtMs: now, completedAtMs: null }, null, 2)}
+      await writeFile46(stamp, `${JSON.stringify({ startedAtMs: now, completedAtMs: null }, null, 2)}
 `, "utf8");
     } catch {
       return { ran: false, reason: "stamp-unwritable" };
@@ -174351,7 +174425,7 @@ async function maybeAutoSweepGdctx(cwd, options = {}) {
       now
     });
     const completedAtMs = options.now ?? Date.now();
-    await writeFile45(stamp, `${JSON.stringify({ startedAtMs: now, completedAtMs, lastRunAtMs: completedAtMs }, null, 2)}
+    await writeFile46(stamp, `${JSON.stringify({ startedAtMs: now, completedAtMs, lastRunAtMs: completedAtMs }, null, 2)}
 `, "utf8").catch(() => {
       return;
     });
@@ -174371,7 +174445,7 @@ var init_auto_sweep = __esm(() => {
 
 // src/ctx/artifact-id.ts
 import { randomBytes as randomBytes14 } from "crypto";
-import { mkdir as mkdir70, readFile as readFile168, rm as rm28, writeFile as writeFile46 } from "fs/promises";
+import { mkdir as mkdir71, readFile as readFile168, rm as rm28, writeFile as writeFile47 } from "fs/promises";
 import path323 from "path";
 function pinnedClock() {
   const pin = process.env.KERYX_CTX_CLOCK_PIN_MS;
@@ -174397,7 +174471,7 @@ function isAlreadyExists(error) {
 }
 async function claim(file) {
   try {
-    await writeFile46(file, "", { encoding: "utf8", flag: "wx" });
+    await writeFile47(file, "", { encoding: "utf8", flag: "wx" });
     return true;
   } catch (error) {
     if (isAlreadyExists(error)) {
@@ -174410,8 +174484,8 @@ async function reserveArtifact(options) {
   const now = options.now ?? pinnedClock() ?? (() => new Date);
   const token = options.token ?? defaultToken;
   const maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
-  await mkdir70(options.rawDir, { recursive: true });
-  await mkdir70(options.artifactsDir, { recursive: true });
+  await mkdir71(options.rawDir, { recursive: true });
+  await mkdir71(options.artifactsDir, { recursive: true });
   for (let attempt = 0;attempt < maxAttempts; attempt += 1) {
     const id = artifactIdCandidate(options.kind, now(), token());
     const rawPath = path323.join(options.rawDir, `${id}.log`);
@@ -174584,7 +174658,7 @@ var init_structured = __esm(() => {
 });
 
 // src/commands/ctx.ts
-import { readFile as readFile169, writeFile as writeFile47 } from "fs/promises";
+import { readFile as readFile169, writeFile as writeFile48 } from "fs/promises";
 import path324 from "path";
 function structuredBudgetBytes(config) {
   return (config.compactHeadLines + config.compactTailLines) * 40;
@@ -175023,8 +175097,8 @@ async function writeArtifact({
 ${JSON.stringify(artifact, null, 2)}
 \`\`\`
 `;
-  await writeFile47(rawPath, raw, "utf8");
-  await writeFile47(summaryPath, summaryWithMeta, "utf8");
+  await writeFile48(rawPath, raw, "utf8");
+  await writeFile48(summaryPath, summaryWithMeta, "utf8");
   await writeFileAtomic(latestRawPath, raw);
   await writeFileAtomic(latestSummaryPath, summaryWithMeta);
   await maybeAutoSweepGdctx(projectRoot).catch(() => {
@@ -175920,7 +175994,7 @@ function readLiteral(source, start, quote) {
 }
 
 // src/wiki/freshness/queue.ts
-import { readFile as readFile170, rename as rename13, stat as stat36, unlink as unlink3, writeFile as writeFile48 } from "fs/promises";
+import { readFile as readFile170, rename as rename13, stat as stat36, unlink as unlink3, writeFile as writeFile49 } from "fs/promises";
 import path325 from "path";
 function queuePath(cwd) {
   return path325.join(cwd, ".metaproject", "data", "wiki", QUEUE_FILE);
@@ -176504,7 +176578,7 @@ var init_report6 = __esm(() => {
 });
 
 // src/wiki/freshness/run.ts
-import { mkdir as mkdir71, readFile as readFile172, writeFile as writeFile49 } from "fs/promises";
+import { mkdir as mkdir72, readFile as readFile172, writeFile as writeFile50 } from "fs/promises";
 import path326 from "path";
 function freshnessDir(cwd) {
   return path326.join(cwd, ".metaproject", "data", "wiki", "freshness");
@@ -176550,10 +176624,10 @@ async function runFreshness(input) {
 }
 async function persist(cwd, report) {
   const dir = freshnessDir(cwd);
-  await mkdir71(dir, { recursive: true });
-  await writeFile49(path326.join(dir, "latest.json"), `${JSON.stringify(report, null, 2)}
+  await mkdir72(dir, { recursive: true });
+  await writeFile50(path326.join(dir, "latest.json"), `${JSON.stringify(report, null, 2)}
 `, "utf8");
-  await writeFile49(path326.join(dir, "latest.md"), renderMarkdown2(report), "utf8");
+  await writeFile50(path326.join(dir, "latest.md"), renderMarkdown2(report), "utf8");
 }
 async function collectChanges(cwd, git, fromRev) {
   const status = await git(cwd, ["diff", "--name-status", "-M", fromRev, "HEAD"]);
@@ -180546,7 +180620,7 @@ var init_manifest4 = __esm(() => {
 });
 
 // src/gdskills/sync.ts
-import { copyFile as copyFile3, mkdir as mkdir72, readdir as readdir55, writeFile as writeFile50 } from "fs/promises";
+import { copyFile as copyFile3, mkdir as mkdir73, readdir as readdir55, writeFile as writeFile51 } from "fs/promises";
 import path340 from "path";
 function isGlobalSyncRuntime(runtime) {
   return Object.hasOwn(GLOBAL_SKILL_SYNC_TARGETS, runtime);
@@ -180617,12 +180691,12 @@ async function syncRuntimeSkillsToRoot(projectRoot, options) {
   const manifestPath = path340.join(targetRoot, "keryx-sync-manifest.json");
   const syncedSkills = skillDirs.map((skillDir) => path340.basename(skillDir)).sort();
   if (!options.dryRun) {
-    await mkdir72(targetRoot, { recursive: true });
+    await mkdir73(targetRoot, { recursive: true });
     for (const skillDir of skillDirs) {
       const targetSkillDir = path340.join(targetRoot, path340.basename(skillDir));
       await copyDirectory(skillDir, targetSkillDir);
     }
-    await writeFile50(manifestPath, `${JSON.stringify({
+    await writeFile51(manifestPath, `${JSON.stringify({
       schemaVersion: 1,
       runtime: options.runtime,
       sourceRoot: toPosix(path340.relative(projectRoot, sourceRoot)),
@@ -180687,7 +180761,7 @@ async function plannedSyncFiles(projectRoot, skillDirs, sourceRoot, targetRoot)
 async function copyDirectory(sourceDir, targetDir) {
   for (const filePath of await listFiles3(sourceDir)) {
     const targetPath = path340.join(targetDir, path340.relative(sourceDir, filePath));
-    await mkdir72(path340.dirname(targetPath), { recursive: true });
+    await mkdir73(path340.dirname(targetPath), { recursive: true });
     await copyFile3(filePath, targetPath);
   }
 }
@@ -182830,7 +182904,7 @@ var init_remove_skill = __esm(() => {
 });
 
 // src/gdskills/verify.ts
-import { mkdir as mkdir73, readFile as readFile181, writeFile as writeFile51 } from "fs/promises";
+import { mkdir as mkdir74, readFile as readFile181, writeFile as writeFile52 } from "fs/promises";
 import path345 from "path";
 async function verifyProjectSkill(projectRoot, options) {
   const metaprojectRoot = path345.join(projectRoot, ".metaproject");
@@ -182876,11 +182950,11 @@ async function verifyProjectSkill(projectRoot, options) {
     dryRun: options.dryRun === true
   };
   if (!options.dryRun) {
-    await mkdir73(path345.dirname(reportPath), { recursive: true });
-    await writeFile51(reportPath, `${JSON.stringify(report, null, 2)}
+    await mkdir74(path345.dirname(reportPath), { recursive: true });
+    await writeFile52(reportPath, `${JSON.stringify(report, null, 2)}
 `, "utf8");
-    await writeFile51(path345.join(resolved.packageRoot, "verification.md"), renderVerificationMarkdown(report), "utf8");
-    await writeFile51(skillMdPath, updateLastVerified(skillMd, verifiedAt), "utf8");
+    await writeFile52(path345.join(resolved.packageRoot, "verification.md"), renderVerificationMarkdown(report), "utf8");
+    await writeFile52(skillMdPath, updateLastVerified(skillMd, verifiedAt), "utf8");
   }
   return report;
 }
@@ -185586,7 +185660,7 @@ var init_plans = __esm(() => {
 });
 
 // src/job/store.ts
-import { appendFile as appendFile17, mkdir as mkdir74, readFile as readFile184, readdir as readdir61 } from "fs/promises";
+import { appendFile as appendFile17, mkdir as mkdir75, readFile as readFile184, readdir as readdir61 } from "fs/promises";
 import path348 from "path";
 function jobsRoot(cwd) {
   return path348.join(cwd, ".metaproject", "jobs");
@@ -185631,7 +185705,7 @@ async function writeJob(cwd, name, state) {
 `));
   }
   const file = jobStatePath(cwd, name);
-  await mkdir74(path348.dirname(file), { recursive: true });
+  await mkdir75(path348.dirname(file), { recursive: true });
   await writeFileAtomic(file, `${JSON.stringify(state, null, 2)}
 `);
 }
@@ -185670,7 +185744,7 @@ var init_store10 = __esm(() => {
 });
 
 // src/job/service.ts
-import { copyFile as copyFile4, mkdir as mkdir75 } from "fs/promises";
+import { copyFile as copyFile4, mkdir as mkdir76 } from "fs/promises";
 import path349 from "path";
 function createJobService(deps) {
   const now = () => deps.now().toISOString();
@@ -185713,7 +185787,7 @@ function createJobService(deps) {
       if (await pathExists(absolute)) {
         throw new Error(`Job package already exists: .metaproject/jobs/${name}. ` + `Run: keryx job status ${name}`);
       }
-      await mkdir75(absolute, { recursive: true });
+      await mkdir76(absolute, { recursive: true });
       const createdAt = now();
       const state = {
         phase: "PLAN",
@@ -187383,7 +187457,7 @@ var init_retry_plan = __esm(() => {
 
 // src/commands/review-slice.ts
 import { existsSync as existsSync58, readFileSync as readFileSync28, statSync as statSync20 } from "fs";
-import { mkdir as mkdir76, readFile as readFile188, readdir as readdir63, rm as rm29 } from "fs/promises";
+import { mkdir as mkdir77, readFile as readFile188, readdir as readdir63, rm as rm29 } from "fs/promises";
 import path351 from "path";
 function wantsHelp2(args) {
   return args.includes("--help") || args.includes("-h");
@@ -187441,7 +187515,7 @@ Attempts are remembered in ${RETRY_STATE_NAME} beside the manifest (--state to m
 `);
 }
 async function writeSliceFiles(dir, slices) {
-  await mkdir76(dir, { recursive: true });
+  await mkdir77(dir, { recursive: true });
   for (const slice of slices) {
     await writeFileAtomic(path351.join(dir, slice.path), slice.text);
   }
@@ -187460,7 +187534,7 @@ async function runSlice(args, deps) {
   const outDir = path351.resolve(optionValue(args, "--out") ?? DEFAULT_SLICE_DIR);
   const diff = diffFile !== undefined ? await deps.readDiffSource(diffFile) : await deps.gitDiff(ref, contextLines);
   const { manifest, slices } = buildSlices(sliceSourceFromDiff(diff, { contextLines }), { maxBytes });
-  await mkdir76(outDir, { recursive: true });
+  await mkdir77(outDir, { recursive: true });
   for (const entry of await readdir63(outDir)) {
     if (/^slice-\d+\.diff$/.test(entry)) {
       await rm29(path351.join(outDir, entry), { force: true });
@@ -188935,7 +189009,7 @@ var init_floor = __esm(() => {
 });
 
 // src/commands/review.ts
-import { mkdir as mkdir77, readdir as readdir64, readFile as readFile192 } from "fs/promises";
+import { mkdir as mkdir78, readdir as readdir64, readFile as readFile192 } from "fs/promises";
 import path356, { join as join11 } from "path";
 function reviewerList(args) {
   return (optionValue(args, "--reviewers") ?? "").split(",").map((item) => item.trim()).filter(Boolean);
@@ -190245,7 +190319,7 @@ async function runLearn(args) {
   const sourcePath = learningSourcePath(cwd, config.repo, number);
   const recordPath = learningRecordPath(cwd, config.repo, number);
   const relativeSourcePath = toPosix(path356.relative(cwd, sourcePath));
-  await mkdir77(path356.dirname(sourcePath), { recursive: true });
+  await mkdir78(path356.dirname(sourcePath), { recursive: true });
   await writeFileAtomic(sourcePath, renderLearningSource(selection));
   await writeFileAtomic(recordPath, renderLearningRecord({
     repo: config.repo,
@@ -191876,7 +191950,7 @@ function classifyBaselineStatuses(baseline, pr) {
 }
 
 // src/commands/standard.ts
-import { mkdir as mkdir78, writeFile as writeFile52 } from "fs/promises";
+import { mkdir as mkdir79, writeFile as writeFile53 } from "fs/promises";
 import path359 from "path";
 async function standardCommand(args = [], projectRoot = process.cwd()) {
   const subcommand = args[0];
@@ -191987,8 +192061,8 @@ async function handleEmit(projectRoot, args) {
   if (args.includes("--stdout")) {
     process.stdout.write(result.content);
   } else {
-    await mkdir78(path359.dirname(result.path), { recursive: true });
-    await writeFile52(result.path, result.content, "utf8");
+    await mkdir79(path359.dirname(result.path), { recursive: true });
+    await writeFile53(result.path, result.content, "utf8");
     heading("keryx standard emit llms");
     if (problems.length === 0) {
       console.log(`  ${style.green(symbols.ok)} wrote ${path359.relative(projectRoot, result.path)} (valid llms.txt)`);
@@ -194732,7 +194806,7 @@ var init_security_impact_evidence = __esm(() => {
 });
 
 // src/commands/security.ts
-import { mkdir as mkdir79, readdir as readdir66, readFile as readFile195, writeFile as writeFile53 } from "fs/promises";
+import { mkdir as mkdir80, readdir as readdir66, readFile as readFile195, writeFile as writeFile54 } from "fs/promises";
 import path363 from "path";
 import { fileURLToPath as fileURLToPath10 } from "url";
 async function securityCommand(args = [], cwd = process.cwd()) {
@@ -195015,8 +195089,8 @@ async function handleScanMcp(cwd, args) {
     const { manifest } = extractManifestAndBaseline(read.value, {});
     const baseline = { schemaVersion: 1, tools: buildMcpBaseline(manifest) };
     const outPath = mcpBaselinePath(cwd);
-    await mkdir79(path363.dirname(outPath), { recursive: true });
-    await writeFile53(outPath, `${JSON.stringify(baseline, null, 2)}
+    await mkdir80(path363.dirname(outPath), { recursive: true });
+    await writeFile54(outPath, `${JSON.stringify(baseline, null, 2)}
 `, "utf8");
     if (asJson) {
       console.log(JSON.stringify({ pinned: Object.keys(baseline.tools).length, path: outPath }, null, 2));
@@ -195138,7 +195212,7 @@ async function handleRedact(cwd, args) {
     source
   });
   if (out) {
-    await writeFile53(out, redacted, "utf8");
+    await writeFile54(out, redacted, "utf8");
     heading("keryx security redact");
     console.log(`  ${style.green(symbols.ok)} redacted ${findings.length} span(s) \u2192 ${out}`);
   } else {
@@ -196399,7 +196473,7 @@ var init_metaproject_tools2 = __esm(() => {
 });
 
 // src/mcp/tools.ts
-import { readFile as readFile196, realpath as realpath24, writeFile as writeFile54 } from "fs/promises";
+import { readFile as readFile196, realpath as realpath24, writeFile as writeFile55 } from "fs/promises";
 import path365 from "path";
 import { randomUUID as randomUUID44 } from "crypto";
 function sacWorkspaceService(cwd) {
@@ -196545,7 +196619,7 @@ function buildToolRegistry() {
         const wrapUp = await wrapUpAuthority.issue({ actor, source: "session", sourceRef: sessionEvidenceRef(workspaceId, session.id) });
         const proposal = await service.create({ request: undefined, requestCorrelationId, workspaceId, id: `proposal-${randomUUID44().replace(/-/g, "").slice(0, 16)}`, proposalRevision, kind, wrapUp });
         if (note)
-          await writeFile54(proposalNotePath(cwd, workspaceId, proposal.id), note, "utf8");
+          await writeFile55(proposalNotePath(cwd, workspaceId, proposal.id), note, "utf8");
         return normalizeProposalLifecycleResult(proposal);
       }
     },
@@ -213287,7 +213361,7 @@ var PROBE_TIMEOUT_MS = 1e4;
 
 // src/commands/agents-external.ts
 import { randomUUID as randomUUID56 } from "crypto";
-import { mkdir as mkdir80 } from "fs/promises";
+import { mkdir as mkdir81 } from "fs/promises";
 import { tmpdir as tmpdir16 } from "os";
 import path386 from "path";
 import { createInterface as createInterface4 } from "readline";
@@ -213560,7 +213634,7 @@ async function runCommand4(args, deps, log) {
   const worktreesDir = path386.join(tmpdir16(), "keryx-external-worktrees");
   const worktree = seams.worktree ?? createGitWorktreePort({ repoRoot: cwd, worktreesDir });
   if (seams.worktree === undefined)
-    await mkdir80(worktreesDir, { recursive: true });
+    await mkdir81(worktreesDir, { recursive: true });
   const detect = seams.detect === null ? undefined : seams.detect ?? createVersionProbe();
   const runInput = {
     runtime: {
@@ -215535,7 +215609,7 @@ function factPreservation(rawFacts, compactFacts) {
 }
 
 // src/metrics/oracle-runner.ts
-import { mkdir as mkdir81, writeFile as writeFile55 } from "fs/promises";
+import { mkdir as mkdir82, writeFile as writeFile56 } from "fs/promises";
 import path388 from "path";
 function oracleTaskId(target) {
   return `metastore:gdgraph-affected:${target}`;
@@ -215858,8 +215932,8 @@ async function persistEvidenceBundle(outDir, bundle, ladder = "metastore") {
   const safeTarget = bundle.target.replace(/[^A-Za-z0-9._/-]/g, "_");
   const safeCase = bundle.caseId.replace(/[^A-Za-z0-9._-]/g, "_");
   const dir = path388.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
-  await mkdir81(dir, { recursive: true });
-  const write = (name, value) => writeFile55(path388.join(dir, name), `${JSON.stringify(value, null, 2)}
+  await mkdir82(dir, { recursive: true });
+  const write = (name, value) => writeFile56(path388.join(dir, name), `${JSON.stringify(value, null, 2)}
 `, "utf8");
   await Promise.all([
     write("inputs.json", bundle.inputs),
@@ -216583,7 +216657,7 @@ function formatFwkExplain(result) {
 
 // src/commands/workspace.ts
 import { randomUUID as randomUUID57 } from "crypto";
-import { writeFile as writeFile56 } from "fs/promises";
+import { writeFile as writeFile57 } from "fs/promises";
 function service8() {
   return new WorkspaceService({
     workspaceRoot: process.cwd(),
@@ -216724,7 +216798,7 @@ async function workspaceCommand(args) {
       const wrapUp = await wrapUpAuthority.issue({ actor, source: "session", sourceRef: sessionEvidenceRef(workspaceId, session.id) });
       const proposal = await service.create({ request: undefined, requestCorrelationId, workspaceId, id: proposalId, proposalRevision, kind, wrapUp });
       if (persistedNote)
-        await writeFile56(notePath, persistedNote, "utf8");
+        await writeFile57(notePath, persistedNote, "utf8");
       console.log(JSON.stringify(normalizeProposalLifecycleResult(proposal), null, 2));
       return;
     }
@@ -221044,7 +221118,7 @@ var init_learned_pattern_schema = __esm(() => {
 
 // src/bundle/export.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { mkdir as mkdir82, readdir as readdir71, readFile as readFile205, writeFile as writeFile57, lstat as lstat24 } from "fs/promises";
+import { mkdir as mkdir83, readdir as readdir71, readFile as readFile205, writeFile as writeFile58, lstat as lstat24 } from "fs/promises";
 import { existsSync as existsSync62 } from "fs";
 import path395 from "path";
 function globToRegExp5(glob) {
@@ -221279,12 +221353,12 @@ async function outDirIsEmpty(out) {
   }
 }
 async function writeDirectoryBundle(out, manifestBytes, files) {
-  await mkdir82(out, { recursive: true });
-  await writeFile57(path395.join(out, "bundle.json"), manifestBytes);
+  await mkdir83(out, { recursive: true });
+  await writeFile58(path395.join(out, "bundle.json"), manifestBytes);
   for (const [rel, bytes] of files) {
     const abs = path395.join(out, ...rel.split("/"));
-    await mkdir82(path395.dirname(abs), { recursive: true });
-    await writeFile57(abs, bytes);
+    await mkdir83(path395.dirname(abs), { recursive: true });
+    await writeFile58(abs, bytes);
   }
 }
 async function exportBundle(opts) {
@@ -221417,8 +221491,8 @@ async function exportBundle(opts) {
     const archive = buildBundleArchive(files, manifestBytes);
     if (!archive.ok)
       return { ok: false, refusals: [archive.refusal] };
-    await mkdir82(path395.dirname(opts.out), { recursive: true });
-    await writeFile57(opts.out, archive.value);
+    await mkdir83(path395.dirname(opts.out), { recursive: true });
+    await writeFile58(opts.out, archive.value);
   } else {
     if (existsSync62(opts.out) && !await outDirIsEmpty(opts.out)) {
       return { ok: false, refusals: [{ reason: BUNDLE_REFUSAL.notABundle, message: `${opts.out} already exists and is not empty` }] };
@@ -221601,7 +221675,7 @@ var init_applied_state = __esm(() => {
 });
 
 // src/lib/private-dir.ts
-import { lstat as lstat25, mkdir as mkdir83, open as open11, readFile as readFile207 } from "fs/promises";
+import { lstat as lstat25, mkdir as mkdir84, open as open11, readFile as readFile207 } from "fs/promises";
 import path397 from "path";
 async function checkPrivateDirGitignore(dir, root) {
   if (root !== undefined) {
@@ -221691,7 +221765,7 @@ async function ensurePrivateDirGitignore(dir, root) {
     return check;
   }
   const gitignorePath = path397.join(dir, ".gitignore");
-  await mkdir83(dir, { recursive: true });
+  await mkdir84(dir, { recursive: true });
   try {
     const handle = await open11(gitignorePath, "wx");
     try {
@@ -222106,7 +222180,7 @@ var init_plan2 = __esm(() => {
 });
 
 // src/bundle/audit.ts
-import { mkdtemp as mkdtemp11, mkdir as mkdir84, rm as rm30, writeFile as writeFile58 } from "fs/promises";
+import { mkdtemp as mkdtemp11, mkdir as mkdir85, rm as rm30, writeFile as writeFile59 } from "fs/promises";
 import { tmpdir as tmpdir17 } from "os";
 import path398 from "path";
 function entriesToStage(plan) {
@@ -222123,8 +222197,8 @@ async function auditBundlePlan(plan, opts = {}) {
     try {
       for (const entry of toStage) {
         const abs = path398.join(stagingDir, ...entry.path.split("/"));
-        await mkdir84(path398.dirname(abs), { recursive: true });
-        await writeFile58(abs, entry.bytes);
+        await mkdir85(path398.dirname(abs), { recursive: true });
+        await writeFile59(abs, entry.bytes);
       }
     } catch (err) {
       return {
@@ -222157,7 +222231,7 @@ var init_audit = __esm(() => {
 });
 
 // src/bundle/apply.ts
-import { mkdir as mkdir85, rmdir as rmdir2, stat as stat42 } from "fs/promises";
+import { mkdir as mkdir86, rmdir as rmdir2, stat as stat42 } from "fs/promises";
 import path399 from "path";
 function writableEntries(plan) {
   return plan.entries.filter((e) => e.bucket === "new" || e.bucket === "update" || e.bucket === "conflict" && e.forced);
@@ -222326,7 +222400,7 @@ async function mkdirRecordingCreated(dir) {
     }
   }
   if (missing.length > 0) {
-    await mkdir85(dir, { recursive: true });
+    await mkdir86(dir, { recursive: true });
   }
   return missing;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.3.89",
+  "version": "0.3.91",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {

package/src/gdskills/bundled/skills/review/review-orchestrator/SKILL.md

@@ -85,7 +85,7 @@ A reviewer on this host cannot open a path: its file tool reads inside its worki
 1. **Slice first.** `keryx review slice --ref <base> --out <dir>` after `keryx review scope`. It writes `slice-NN.diff` files of at most 150000 bytes each and a `manifest.json`; ledgers (csv, lockfiles, snapshots, generated files) are listed under `omissions` with a reason — list them in the report as not reviewed, never as clean.
 2. **Slices travel by `context_files`.** Write the slices under the project (the default `--out`, `.metaproject/data/review/slices`, already is) and pass each reviewer its slice paths in `spawn_subagent`'s `context_files`: the host copies the text into that reviewer's task, so you never paste or retype a slice. Put the `slices` ids in its reviewer-input. A dispatch that names a git range but no slice and no `context_files` leaves the reviewer with nothing to read — that is `BLOCKED`, not a review.
 3. **Check before dispatch.** `keryx review dispatch-check --payload <file> --manifest <dir>/manifest.json` for the wave; exit 1 means a payload names no slice, is over the ceiling, or breaks `reviewer-input.schema.json`. Fix it; do not dispatch around it.
-4. **One batch.** Dispatch the whole wave — up to 10 reviewers — in one message, not one at a time. Give each reviewer `max_rounds` of at least 40 (the default); a reviewer that spends its rounds reading the skill and the schema returns nothing. **Incomplete means retry once, then Not run.** On `INCOMPLETE` or `BLOCKED`, `keryx review retry-plan --manifest <dir>/manifest.json --result <result.json>` decides: it cuts the assigned slices in half and names the one retry, and after that prints the `- **Not run:** …` line to paste into the report. An unfinished reviewer is never counted as a clean pass.
+4. **One batch.** Dispatch the whole wave — up to 10 reviewers — in one message, not one at a time. Give each reviewer `max_rounds` of at least 40 (the default); a reviewer that spends its rounds reading the skill and the schema returns nothing. **Incomplete means retry once, then Not run.** On `INCOMPLETE` or `BLOCKED`, `keryx review retry-plan --manifest <dir>/manifest.json --result <result.json>` decides: it cuts the assigned slices in half and names the one retry, and after that prints the `- **Not run:** …` line to paste into the report. An unfinished reviewer is never counted as a clean pass. **Persist every result.** Pass each reviewer `save_result_to: .metaproject/data/review/raw/<reviewer>.txt`: the host writes its full final text there, so `review complete` has raw evidence even after the transcript is cut. Build `research.json` from those files — the ledger fields from the detail file plus one more key, `dispatch: {version:1, selected:[names], unresolvedRules:[], runs:[{reviewer, executionId:<its sub:… id>, status:"complete", scopeComplete:true, rawEvidence:<saved path>, ruleEvidence:[<rule paths>], executionRequired:false, executionReason:<why>}]}` — and ingest once with `--research`, into the package `review start` created. A refused `review complete` names what is missing: fix that with a command and run it again; it is never `blocked`. `--head` wants a SHA (`git rev-parse HEAD`), not `HEAD`.
 5. **Never print a scope or a slice.** The tool output of one call is cut at about 20 KB and `keryx review scope` of a large PR prints hundreds of KB. Run it as `keryx review scope --ref <base> --json > .metaproject/data/review/scope.json` and read the counts from the file (`keryx ctx read`, or `jq`); take `<base>` from `git symbolic-ref refs/remotes/origin/HEAD`, not a guessed `origin/main`. Create `.metaproject/data/review/` first (`mkdir -p`) — a missing directory is a command to run, not a blocker. **Machine artifacts by direct write.** Save slices, payloads and results by redirection or `keryx ctx run --raw -- <command>`; the summarized form of `keryx ctx run` drops the bytes a later step parses.
 
 ## Control