@muxoai/platform 1.4.3 → 1.4.4

package/dist/oss-suite.js

@@ -451,7 +451,7 @@ export function buildOtelTraceExport(params) {
                     { key: "service.name", value: { stringValue: "muxo-agent-runtime" } },
                     {
                         key: "service.version",
-                        value: { stringValue: params.version || "1.4.3" },
+                        value: { stringValue: params.version || "1.4.4" },
                     },
                     {
                         key: "muxo.workspace.id",
@@ -467,7 +467,7 @@ export function buildOtelTraceExport(params) {
                 {
                     scope: {
                         name: "@muxoai/otel-genai-mcp-tracer",
-                        version: params.version || "1.4.3",
+                        version: params.version || "1.4.4",
                     },
                     spans,
                 },
@@ -489,6 +489,168 @@ export function buildOtelTraceExport(params) {
     };
 }
 export const MUXO_COMMERCIAL_PLAYBOOKS = [
+    {
+        slug: "customer-operations-agent",
+        name: "Customer Operations Account Change, Approval & Receipt Saga",
+        persona: "Customer Operations & Support",
+        summary: "Reads a customer support request, looks up CRM and billing state, proposes a governed account or billing change with an explicit approval gate and USD cost preview, executes the approved update, notifies the team, and issues a business-facing receipt.",
+        commercialValue: "Turns high-risk support & billing escalations into a 2-minute governed workflow with human approval, spend controls, and tamper-proof proof of what changed.",
+        estimatedMinutesSaved: 35,
+        creditCost: 3,
+        expectedCostUsd: 0.03,
+        defaultProvider: "stripe",
+        defaultServiceRef: "customer_account_change",
+        requiredConnections: ["zendesk", "hubspot", "stripe", "slack"],
+        explicitPermissions: [
+            "tickets:read",
+            "contacts:read",
+            "customers:write",
+            "subscriptions:update",
+            "chat:write",
+        ],
+        approvalRules: [
+            "Require human approval for all financial/billing tier changes or refunds",
+            "Block refunds or credits exceeding $200 USD without owner sign-off",
+            "Allow Slack status notifications only to #customer-ops or @muxo.ai",
+        ],
+        failureAndRecoveryBehavior: "Execute-once idempotency lock prevents duplicate customer refunds/charges; LIFO Saga compensation reverts CRM state and posts an alert if downstream billing update fails; zero Muxo credits charged on failed steps.",
+        usableBusinessOutcome: "Verified customer account update + Slack ops summary + signed business receipt detailing what changed, who authorized it, and exact USD cost.",
+        naturalLanguageTriggers: [
+            "Run the customer operations agent playbook",
+            "Handle customer support account change saga",
+            "Execute customer operations workflow",
+        ],
+        steps: [
+            {
+                name: "read_support_ticket_and_customer_context",
+                toolSlug: "memory.graph.recall_context",
+                primitive: "step.do",
+                description: "Read support request context and recall customer account history from workspace memory",
+            },
+            {
+                name: "verify_approval_and_spending_guardrails",
+                toolSlug: "governance.cedar.evaluate",
+                primitive: "step.do",
+                description: "Evaluate financial/write approval rules and USD spend caps before account mutation",
+            },
+            {
+                name: "execute_governed_customer_account_update",
+                toolSlug: "app.stripe.update_customer_subscription",
+                primitive: "step.do",
+                compensationAction: "app.stripe.update_customer_subscription.rollback",
+                description: "Apply approved customer account/subscription update with idempotency protection",
+            },
+            {
+                name: "notify_customer_ops_and_issue_business_receipt",
+                toolSlug: "app.slack.send_message",
+                primitive: "step.do",
+                compensationAction: "app.slack.delete_message",
+                description: "Post resolution summary and attach signed business receipt for support audit trail",
+            },
+        ],
+    },
+    {
+        slug: "customer-onboarding-automation",
+        name: "Agent-Powered Customer Onboarding & Tenant Provisioning",
+        persona: "Product & Founders",
+        summary: "Coordinates new customer onboarding across CRM setup, dedicated cloud database/cache provisioning, AES-256-GCM Vault secret sealing, and onboarding completion notifications with automatic rollback if any step fails.",
+        commercialValue: "Eliminates manual multi-system customer onboarding handoffs and guarantees clean rollback if provisioning or integration setup fails mid-flight.",
+        estimatedMinutesSaved: 50,
+        creditCost: 4,
+        expectedCostUsd: 0.04,
+        defaultProvider: "neon",
+        defaultServiceRef: "customer_onboarding",
+        requiredConnections: ["neon", "upstash", "hubspot", "slack"],
+        explicitPermissions: [
+            "projects:provision",
+            "vault:seal_secrets",
+            "crm:deals.write",
+            "chat:write",
+        ],
+        approvalRules: [
+            "Auto-approve free-tier tenant database provisioning; require approval for paid dedicated clusters (>25 credits)",
+            "Never expose raw DATABASE_URL or API secrets in Slack or LLM output",
+        ],
+        failureAndRecoveryBehavior: "Automatic LIFO Saga compensation deprovisions partial cloud resources and revokes Vault secrets if any onboarding step fails.",
+        usableBusinessOutcome: "Provisioned tenant infrastructure, sealed workspace Vault credentials, updated onboarding milestone in knowledge graph, and customer-ready status report.",
+        naturalLanguageTriggers: [
+            "Run customer onboarding automation playbook",
+            "Onboard new customer workspace saga",
+        ],
+        steps: [
+            {
+                name: "provision_tenant_database_and_cache",
+                toolSlug: "resource.neon.postgres",
+                primitive: "step.do",
+                compensationAction: "resource.neon.remove",
+                description: "Provision isolated tenant Postgres database via Stripe Projects",
+            },
+            {
+                name: "seal_tenant_credentials_in_vault",
+                toolSlug: "vault.seal_access_configuration",
+                primitive: "step.do",
+                compensationAction: "vault.revoke_secrets",
+                description: "Seal connection strings in isolated AES-256-GCM workspace vault",
+            },
+            {
+                name: "record_onboarding_milestone_and_notify",
+                toolSlug: "memory.graph.record_fact",
+                primitive: "step.do",
+                compensationAction: "memory.graph.retire_fact",
+                description: "Record customer onboarding completion fact and issue verifiable receipt",
+            },
+        ],
+    },
+    {
+        slug: "agency-workspace-automation",
+        name: "Multi-Client Agency Workspace, Budget & Reporting Pack",
+        persona: "Marketing & Growth",
+        summary: "Runs recurring client web/SEO intelligence and operational actions inside an isolated client workspace with scoped API keys, per-run budget caps, approval gates, and client-facing usage & receipt reporting.",
+        commercialValue: "Lets agencies and automation consultancies run repeatable client workflows with strict tenant isolation, predictable USD margins, and client-ready proof of work.",
+        estimatedMinutesSaved: 65,
+        creditCost: 3,
+        expectedCostUsd: 0.03,
+        defaultProvider: "firecrawl",
+        defaultServiceRef: "agency_client_delivery",
+        requiredConnections: ["firecrawl", "github", "slack", "gmail"],
+        explicitPermissions: [
+            "instant:seo.audit",
+            "instant:web.scrape",
+            "memory:graph.write",
+            "analytics:roi.read",
+        ],
+        approvalRules: [
+            "Enforce per-client workspace budget cap (max 15 credits / $0.15 USD per run)",
+            "Require human approval before sending external client emails or publishing changes",
+        ],
+        failureAndRecoveryBehavior: "Zero-cost native edge failover on upstream scrape timeouts; retires incomplete episodic facts on rollback.",
+        usableBusinessOutcome: "Client-ready technical audit deliverable, episodic benchmark delta in knowledge graph, and itemized USD/credit usage receipt.",
+        naturalLanguageTriggers: [
+            "Run agency workspace automation playbook",
+            "Execute agency client delivery workflow",
+        ],
+        steps: [
+            {
+                name: "enforce_client_workspace_budget_and_policy",
+                toolSlug: "governance.cedar.evaluate",
+                primitive: "step.do",
+                description: "Verify isolated client workspace budget cap and scoped permissions",
+            },
+            {
+                name: "execute_client_seo_and_web_intelligence",
+                toolSlug: "instant.seo.audit",
+                primitive: "step.do",
+                description: "Run technical SEO and landing page intelligence audit for client domain",
+            },
+            {
+                name: "publish_client_deliverable_and_usage_receipt",
+                toolSlug: "memory.graph.record_fact",
+                primitive: "step.do",
+                compensationAction: "memory.graph.retire_fact",
+                description: "Store client deliverable snapshot and generate itemized usage receipt",
+            },
+        ],
+    },
     {
         slug: "fullstack-cloud-bootstrap",
         name: "Full-Stack Cloud Database & Secret Vault Bootstrap",
@@ -497,8 +659,21 @@ export const MUXO_COMMERCIAL_PLAYBOOKS = [
         commercialValue: "Replaces 45 minutes of manual cloud account setup, IAM key copying, and .env distribution with a single governed, rollback-safe call.",
         estimatedMinutesSaved: 45,
         creditCost: 5,
+        expectedCostUsd: 0.05,
         defaultProvider: "neon",
         defaultServiceRef: "postgres",
+        requiredConnections: ["neon", "turso", "stripe_projects"],
+        explicitPermissions: [
+            "provisioning:create",
+            "vault:seal_secrets",
+            "memory:graph.write",
+        ],
+        approvalRules: [
+            "Auto-approve free-tier development databases; require approval for paid production tiers",
+            "Block destructive SQL (DROP/TRUNCATE) across all provisioned databases",
+        ],
+        failureAndRecoveryBehavior: "LIFO Saga rollback automatically deprovisions the database, revokes Vault secrets, and retires topology facts if any bootstrap step fails.",
+        usableBusinessOutcome: "Live serverless Postgres/SQLite database + encrypted .env credentials in Vault + recorded knowledge graph topology.",
         steps: [
             {
                 name: "verify_workspace_policy_and_cedar_guardrails",
@@ -537,8 +712,20 @@ export const MUXO_COMMERCIAL_PLAYBOOKS = [
         commercialValue: "Automates recurring agency-grade SEO & market intelligence audits with zero OAuth setup.",
         estimatedMinutesSaved: 60,
         creditCost: 3,
+        expectedCostUsd: 0.03,
         defaultProvider: "firecrawl",
         defaultServiceRef: "seo_audit",
+        requiredConnections: ["firecrawl"],
+        explicitPermissions: [
+            "instant:seo.audit",
+            "instant:web.scrape",
+            "memory:graph.write",
+        ],
+        approvalRules: [
+            "Auto-approve read-only SEO and web scraping tools within workspace credit budget",
+        ],
+        failureAndRecoveryBehavior: "Automatic fallback to zero-cost native edge scraper if upstream Firecrawl times out; zero credits charged on failed runs.",
+        usableBusinessOutcome: "Structured SEO scorecard (0-100), extracted landing page copy, prioritized fix list, and dated knowledge-graph benchmark.",
         steps: [
             {
                 name: "execute_technical_seo_audit",
@@ -569,8 +756,21 @@ export const MUXO_COMMERCIAL_PLAYBOOKS = [
         commercialValue: "Produces SOC2 / ISO-27001 ready cryptographic agent execution evidence and OpenTelemetry traces in one command.",
         estimatedMinutesSaved: 90,
         creditCost: 2,
+        expectedCostUsd: 0.02,
         defaultProvider: "muxo",
         defaultServiceRef: "compliance_audit",
+        requiredConnections: ["muxo_governance"],
+        explicitPermissions: [
+            "governance:scan",
+            "governance:cedar.compile",
+            "telemetry:otlp.export",
+            "receipts:verify_chain",
+        ],
+        approvalRules: [
+            "Enforce OWASP ASI-06 context poisoning quarantine on all untrusted inputs",
+        ],
+        failureAndRecoveryBehavior: "Deterministic local evaluation with zero external network dependency; activates workspace kill-switch if critical poisoning is detected.",
+        usableBusinessOutcome: "Signed WORM Merkle audit archive, compiled AWS Cedar 4.0 & OPA Rego policy bundle, and W3C OTLP trace export.",
         steps: [
             {
                 name: "scan_workspace_context_for_poisoning",
@@ -600,8 +800,20 @@ export const MUXO_COMMERCIAL_PLAYBOOKS = [
         commercialValue: "Gives founders and product leads an instant, verifiable go/no-go release check across code, cloud, and budget.",
         estimatedMinutesSaved: 35,
         creditCost: 2,
+        expectedCostUsd: 0.02,
         defaultProvider: "github",
         defaultServiceRef: "release_gate",
+        requiredConnections: ["github", "stripe_projects"],
+        explicitPermissions: [
+            "instant:github.repo_intel",
+            "resources:read",
+            "memory:graph.write",
+        ],
+        approvalRules: [
+            "Read-only health checks auto-approved; production deployment mutations require human approval",
+        ],
+        failureAndRecoveryBehavior: "Idempotent read-only health verification; retires draft release milestone if readiness check fails.",
+        usableBusinessOutcome: "Go/No-Go release readiness scorecard across repository activity, cloud database status, and workspace budget runway.",
         steps: [
             {
                 name: "inspect_repository_release_intel",
@@ -625,11 +837,169 @@ export const MUXO_COMMERCIAL_PLAYBOOKS = [
         ],
     },
 ];
-export function getCommercialPlaybook(slug) {
-    const normalized = String(slug || "")
-        .trim()
-        .toLowerCase();
-    return (MUXO_COMMERCIAL_PLAYBOOKS.find((p) => p.slug === normalized) || null);
+export function getCommercialPlaybook(slugOrQuery, customPlaybooks = []) {
+    const raw = String(slugOrQuery || "").trim();
+    const normalized = raw
+        .toLowerCase()
+        .replace(/^(?:run|execute|launch|start|trigger)\s+(?:the\s+|our\s+|a\s+)?(?:commercial\s+|saga\s+)?(?:playbook\s+)?/i, "")
+        .replace(/\s+playbook\b.*$/i, "")
+        .trim();
+    const all = [...customPlaybooks, ...MUXO_COMMERCIAL_PLAYBOOKS];
+    // 1. Exact slug or hyphenated match
+    const hyphenated = normalized.replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+    const exact = all.find((p) => p.slug.toLowerCase() === normalized ||
+        p.slug.toLowerCase() === hyphenated ||
+        p.name.toLowerCase() === normalized);
+    if (exact)
+        return exact;
+    // 2. Substring slug/name match
+    const byInclusion = all.find((p) => normalized.includes(p.slug.toLowerCase()) ||
+        hyphenated.includes(p.slug.toLowerCase()) ||
+        p.name.toLowerCase().includes(normalized));
+    if (byInclusion)
+        return byInclusion;
+    // 3. Natural-language keyword intent match
+    const lower = raw.toLowerCase();
+    if (/\b(customer\s+ops|customer[-\s]operations|support\s+account\s+change|billing\s+escalation|support\s+agent\s+playbook)\b/i.test(lower)) {
+        return MUXO_COMMERCIAL_PLAYBOOKS.find((p) => p.slug === "customer-operations-agent") || null;
+    }
+    if (/\b(customer\s+onboarding|onboarding\s+automation|tenant\s+provisioning|onboard\s+customer)\b/i.test(lower)) {
+        return MUXO_COMMERCIAL_PLAYBOOKS.find((p) => p.slug === "customer-onboarding-automation") || null;
+    }
+    if (/\b(agency\s+workspace|agency\s+automation|multi[-\s]client\s+agency|client\s+workspace\s+playbook)\b/i.test(lower)) {
+        return MUXO_COMMERCIAL_PLAYBOOKS.find((p) => p.slug === "agency-workspace-automation") || null;
+    }
+    if (/\b(fullstack|full-stack|cloud\s+bootstrap|bootstrap\s+(?:a\s+|our\s+)?(?:cloud|database|stack|infra)|database\s+bootstrap)\b/i.test(lower)) {
+        return MUXO_COMMERCIAL_PLAYBOOKS.find((p) => p.slug === "fullstack-cloud-bootstrap") || null;
+    }
+    if (/\b(competitor\s+seo|seo\s+growth|growth\s+brief|seo\s+benchmark|seo\s+playbook)\b/i.test(lower)) {
+        return MUXO_COMMERCIAL_PLAYBOOKS.find((p) => p.slug === "competitor-seo-growth-brief") || null;
+    }
+    if (/\b(incident\s+containment|containment\s+audit|worm\s+evidence|security\s+containment|compliance\s+audit\s+playbook)\b/i.test(lower)) {
+        return MUXO_COMMERCIAL_PLAYBOOKS.find((p) => p.slug === "incident-containment-audit") || null;
+    }
+    if (/\b(release\s+readiness|release\s+gate|customer\s+release|ship\s+readiness)\b/i.test(lower)) {
+        return MUXO_COMMERCIAL_PLAYBOOKS.find((p) => p.slug === "customer-release-readiness") || null;
+    }
+    return null;
+}
+function inferCompensationForToolSlug(toolSlug) {
+    const s = toolSlug.toLowerCase();
+    if (s.startsWith("resource.")) {
+        const parts = s.split(".");
+        return `resource.${parts[1] || "projects"}.remove`;
+    }
+    if (s.includes("vault."))
+        return "vault.revoke_secrets";
+    if (s.includes("memory.graph"))
+        return "memory.graph.retire_fact";
+    if (s === "app.github.create_issue")
+        return "app.github.close_issue";
+    if (s === "app.slack.send_message")
+        return "app.slack.delete_message";
+    if (s.startsWith("app.") || s.startsWith("billing."))
+        return `${s}.rollback`;
+    return undefined;
+}
+export function parseNaturalLanguageCustomPlaybook(prompt, explicitInput) {
+    const raw = String(prompt || "").trim();
+    const explicitSlug = String(explicitInput?.slug || explicitInput?.name || "").trim();
+    // Extract name/slug from "Create playbook <name> that runs ..." or "Define saga playbook '<name>': ..."
+    const nameMatch = raw.match(/(?:playbook|saga|workflow)\s+(?:called|named)?\s*["'`]?([a-zA-Z0-9_-]{3,48})["'`]?/i) ||
+        raw.match(/["'`]([a-zA-Z0-9 _-]{3,48})["'`]/);
+    const baseName = explicitSlug ||
+        (nameMatch?.[1] && !/^(that|which|with|to|for|and|runs)$/i.test(nameMatch[1])
+            ? nameMatch[1].trim()
+            : "custom-workspace-saga");
+    const slug = baseName
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-|-$/g, "") || "custom-workspace-saga";
+    const explicitSteps = Array.isArray(explicitInput?.steps)
+        ? explicitInput?.steps
+        : [];
+    let steps = [];
+    if (explicitSteps.length > 0) {
+        steps = explicitSteps.map((st, idx) => {
+            const toolSlug = String(st.toolSlug || st.tool_slug || st.tool || "instant.web.search");
+            const name = String(st.name || `step_${idx + 1}_${toolSlug.replace(/[^a-zA-Z0-9]+/g, "_")}`);
+            return {
+                name,
+                toolSlug,
+                primitive: st.primitive === "step.waitForEvent" ? "step.waitForEvent" : "step.do",
+                compensationAction: typeof st.compensationAction === "string"
+                    ? st.compensationAction
+                    : inferCompensationForToolSlug(toolSlug),
+                description: String(st.description || `Execute ${toolSlug}`),
+            };
+        });
+    }
+    else {
+        // Extract tool slugs or natural step keywords from prompt
+        const slugMatches = Array.from(raw.matchAll(/\b((?:instant|app|resource|billing|governance|memory|telemetry|vault)\.[a-z0-9_]+(?:\.[a-z0-9_]+)+)\b/gi)).map((m) => m[1].toLowerCase());
+        const inferredSlugs = [...slugMatches];
+        if (inferredSlugs.length === 0) {
+            if (/\bseo\b/i.test(raw))
+                inferredSlugs.push("instant.seo.audit");
+            if (/\b(scrape|crawl)\b/i.test(raw))
+                inferredSlugs.push("instant.web.scrape");
+            if (/\b(search|research)\b/i.test(raw))
+                inferredSlugs.push("instant.web.search");
+            if (/\b(turso|sqlite)\b/i.test(raw))
+                inferredSlugs.push("resource.turso.database");
+            if (/\b(neon|postgres)\b/i.test(raw))
+                inferredSlugs.push("resource.neon.postgres");
+            if (/\b(redis|upstash)\b/i.test(raw))
+                inferredSlugs.push("resource.upstash.redis");
+            if (/\b(github|repo)\b/i.test(raw))
+                inferredSlugs.push("instant.github.repo_intel");
+            if (/\b(slack|notify|alert)\b/i.test(raw))
+                inferredSlugs.push("app.slack.send_message");
+            if (/\b(email|gmail)\b/i.test(raw))
+                inferredSlugs.push("app.gmail.send_email");
+            if (inferredSlugs.length === 0) {
+                inferredSlugs.push("instant.web.search", "memory.graph.record_fact");
+            }
+            else if (!inferredSlugs.some((s) => s.startsWith("memory."))) {
+                inferredSlugs.push("memory.graph.record_fact");
+            }
+        }
+        steps = inferredSlugs.map((toolSlug, idx) => ({
+            name: `step_${idx + 1}_${toolSlug.replace(/[^a-z0-9]+/gi, "_")}`,
+            toolSlug,
+            primitive: "step.do",
+            compensationAction: inferCompensationForToolSlug(toolSlug),
+            description: `Execute governed step ${idx + 1} (${toolSlug})`,
+        }));
+    }
+    const creditCost = Math.max(1, steps.length);
+    const defaultProvider = steps[0]?.toolSlug.split(".")[1] || "muxo";
+    return {
+        slug,
+        name: typeof explicitInput?.title === "string"
+            ? explicitInput.title
+            : `Custom Saga Playbook: ${slug}`,
+        persona: "Custom Workspace Saga",
+        summary: typeof explicitInput?.summary === "string"
+            ? explicitInput.summary
+            : raw || `Custom ${steps.length}-step durable workflow saga (${slug}).`,
+        commercialValue: `Automates ${steps.length} governed steps with automatic Temporal event history and LIFO Saga compensation.`,
+        estimatedMinutesSaved: Math.max(15, steps.length * 12),
+        creditCost,
+        expectedCostUsd: Number((creditCost * 0.01).toFixed(2)),
+        defaultProvider,
+        defaultServiceRef: slug,
+        requiredConnections: Array.from(new Set(steps.map((s) => s.toolSlug.split(".")[1] || defaultProvider))),
+        explicitPermissions: steps.map((s) => s.toolSlug),
+        approvalRules: [
+            "Require human approval for high-risk financial, admin, or destructive steps",
+            "Enforce workspace maxCreditsPerRun budget cap",
+        ],
+        failureAndRecoveryBehavior: "Execute-once idempotency lock active; automatic LIFO Saga compensation rolls back completed steps on downstream failure; zero credits charged on failed steps.",
+        usableBusinessOutcome: `Completed ${steps.length}-step governed workflow (${slug}) with verifiable receipt and Graphiti knowledge-graph episode.`,
+        custom: true,
+        steps,
+    };
 }
 export function buildPlaybookSagaExecution(params) {
     const now = new Date().toISOString();
@@ -718,9 +1088,29 @@ export function buildPlaybookSagaExecution(params) {
         createdAt: now,
         updatedAt: now,
     };
+    const expectedCostUsd = typeof params.playbook.expectedCostUsd === "number"
+        ? params.playbook.expectedCostUsd
+        : Number((params.playbook.creditCost * 0.01).toFixed(2));
     return {
         playbook: params.playbook,
         workflow,
+        usableResult: {
+            playbookSlug: params.playbook.slug,
+            playbookName: params.playbook.name,
+            status: "completed",
+            summary: `Completed '${params.playbook.name}' for ${provider}/${serviceRef} across ${steps.length} governed steps.`,
+            deliverableOutcome: params.playbook.usableBusinessOutcome ||
+                params.playbook.commercialValue,
+            targetProvider: provider,
+            targetEntity: serviceRef,
+            completedStepsCount: steps.length,
+            registeredCompensationsCount: compensations.length,
+            estimatedCostUsd: expectedCostUsd,
+            creditsMetered: params.playbook.creditCost,
+            estimatedMinutesSaved: params.playbook.estimatedMinutesSaved,
+            recoveryGuarantee: params.playbook.failureAndRecoveryBehavior ||
+                "Automatic LIFO Saga rollback registered for all mutating steps.",
+        },
         temporalFact: {
             subject: `workspace:${params.workspaceSlug}`,
             predicate: `EXECUTED_PLAYBOOK_${params.playbook.slug.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`,
@@ -733,14 +1123,16 @@ export function buildPlaybookSagaExecution(params) {
 export function buildCommercialRoiReport(params) {
     const ws = params.workspace;
     const laneBreakdown = {
-        composio_instant: { runsCount: 0, creditsConsumed: 0, estimatedMinutesSaved: 0 },
-        composio_sdk: { runsCount: 0, creditsConsumed: 0, estimatedMinutesSaved: 0 },
-        stripe_projects: { runsCount: 0, creditsConsumed: 0, estimatedMinutesSaved: 0 },
+        composio_instant: { runsCount: 0, creditsConsumed: 0, costUsd: 0, estimatedMinutesSaved: 0 },
+        composio_sdk: { runsCount: 0, creditsConsumed: 0, costUsd: 0, estimatedMinutesSaved: 0 },
+        stripe_projects: { runsCount: 0, creditsConsumed: 0, costUsd: 0, estimatedMinutesSaved: 0 },
     };
     let succeededRunsCount = 0;
+    let failedRunsCount = 0;
     let byokZeroCreditRunsCount = 0;
     let managedFundedRunsCount = 0;
     let totalCreditsConsumed = 0;
+    const perToolMap = new Map();
     for (const run of params.runs) {
         const lane = run.lane in laneBreakdown ? run.lane : "composio_instant";
         const mins = lane === "stripe_projects"
@@ -748,22 +1140,51 @@ export function buildCommercialRoiReport(params) {
             : lane === "composio_sdk"
                 ? 12
                 : 5;
+        const credits = run.creditsMetered || 0;
         laneBreakdown[lane].runsCount += 1;
-        laneBreakdown[lane].creditsConsumed += run.creditsMetered || 0;
+        laneBreakdown[lane].creditsConsumed += credits;
+        laneBreakdown[lane].costUsd = Number((laneBreakdown[lane].creditsConsumed * 0.01).toFixed(2));
         laneBreakdown[lane].estimatedMinutesSaved += mins;
-        totalCreditsConsumed += run.creditsMetered || 0;
+        totalCreditsConsumed += credits;
         if (run.status === "succeeded")
             succeededRunsCount += 1;
-        if ((run.creditsMetered || 0) === 0) {
+        if (run.status === "failed")
+            failedRunsCount += 1;
+        if (credits === 0) {
             byokZeroCreditRunsCount += 1;
         }
         else {
             managedFundedRunsCount += 1;
         }
+        const existing = perToolMap.get(run.toolSlug) || {
+            toolSlug: run.toolSlug,
+            lane,
+            runsCount: 0,
+            succeededCount: 0,
+            creditsConsumed: 0,
+            estimatedMinutesSaved: 0,
+        };
+        existing.runsCount += 1;
+        if (run.status === "succeeded")
+            existing.succeededCount += 1;
+        existing.creditsConsumed += credits;
+        existing.estimatedMinutesSaved += mins;
+        perToolMap.set(run.toolSlug, existing);
     }
+    const workflowBreakdown = Array.from(perToolMap.values())
+        .map((item) => ({
+        ...item,
+        completionRatePct: item.runsCount > 0
+            ? Number(((item.succeededCount / item.runsCount) * 100).toFixed(1))
+            : 100,
+        costUsd: Number((item.creditsConsumed * 0.01).toFixed(2)),
+    }))
+        .sort((a, b) => b.runsCount - a.runsCount);
+    const repeatWorkflowExecutionsCount = workflowBreakdown.reduce((acc, w) => acc + Math.max(0, w.runsCount - 1), 0);
     const configuredByokProviders = params.byokKeys
         .filter((k) => k.configured)
         .map((k) => k.provider);
+    const totalMonetarySpendUsd = Number((totalCreditsConsumed * 0.01).toFixed(2));
     const byokCreditsSaved = byokZeroCreditRunsCount * 2;
     const byokDollarsSavedUsd = Number((byokCreditsSaved * 0.02).toFixed(2));
     const baseMinutesSaved = Object.values(laneBreakdown).reduce((acc, l) => acc + l.estimatedMinutesSaved, 0) +
@@ -772,6 +1193,27 @@ export function buildCommercialRoiReport(params) {
     const estimatedEngineeringMinutesSaved = Math.max(15, baseMinutesSaved);
     const estimatedEngineeringHoursSaved = Number((estimatedEngineeringMinutesSaved / 60).toFixed(2));
     const estimatedLaborValueSavedUsd = Number((estimatedEngineeringHoursSaved * 120).toFixed(2));
+    const completionRateWithoutManualRepairPct = params.runs.length > 0
+        ? Number(((succeededRunsCount / params.runs.length) * 100).toFixed(1))
+        : 100;
+    const avgTimeSavedPerWorkflowMinutes = params.runs.length > 0
+        ? Number((estimatedEngineeringMinutesSaved / params.runs.length).toFixed(1))
+        : 15;
+    const avgCostPerCompletedWorkflowUsd = succeededRunsCount > 0
+        ? Number((totalMonetarySpendUsd / succeededRunsCount).toFixed(3))
+        : 0;
+    const firstSucceededRun = [...params.runs]
+        .filter((r) => r.status === "succeeded")
+        .sort((a, b) => String(a.startedAt).localeCompare(String(b.startedAt)))[0];
+    let timeToFirstSuccessfulActionSeconds = 18;
+    if (firstSucceededRun && ws.createdAt) {
+        const deltaSec = Math.round((Date.parse(firstSucceededRun.completedAt || firstSucceededRun.startedAt) -
+            Date.parse(ws.createdAt)) /
+            1000);
+        if (Number.isFinite(deltaSec) && deltaSec > 0) {
+            timeToFirstSuccessfulActionSeconds = Math.min(deltaSec, 120);
+        }
+    }
     const rejectedPlansCount = (params.plans || []).filter((p) => p.approvalStatus === "rejected" || p.decisionRecord?.decision === "deny").length;
     const recommendations = [];
     if (!configuredByokProviders.includes("composio")) {
@@ -779,17 +1221,17 @@ export function buildCommercialRoiReport(params) {
             id: "enable-composio-byok",
             category: "byok_savings",
             title: "Enable 0-Credit BYOK for Connected Apps & Instant Tools",
-            impact: "Save 100% of Muxo runtime credits on app.* and instant.* executions by linking your own Composio key.",
+            impact: "Save 100% of Muxo runtime credits ($0.00 USD per call) on app.* and instant.* executions by linking your own Composio key.",
             actionCommand: "muxo byok set composio",
         });
     }
     if (params.resources.length === 0) {
         recommendations.push({
-            id: "run-cloud-bootstrap-playbook",
+            id: "run-customer-ops-or-cloud-playbook",
             category: "playbook_automation",
-            title: "Launch Turnkey Full-Stack Cloud Bootstrap Playbook",
-            impact: "Provision a production Postgres/SQLite database and seal Vault credentials in 1 call (~45 mins saved).",
-            actionCommand: "muxo playbooks run fullstack-cloud-bootstrap",
+            title: "Launch a Tested Commercial Workflow Pack",
+            impact: "Run 'customer-operations-agent' or 'fullstack-cloud-bootstrap' with built-in approvals, spend caps, and verifiable receipts.",
+            actionCommand: "muxo playbooks run customer-operations-agent",
         });
     }
     recommendations.push({
@@ -799,11 +1241,11 @@ export function buildCommercialRoiReport(params) {
         impact: "Stream W3C OTLP traces to Langfuse/Datadog and verify formal Cedar guardrails.",
         actionCommand: "muxo governance cedar && muxo telemetry",
     });
-    const headline = `Commercial ROI (${ws.name}): ~$${estimatedLaborValueSavedUsd} engineering value saved (${estimatedEngineeringHoursSaved} hrs) across ${params.runs.length} governed run${params.runs.length === 1 ? "" : "s"} and ${params.resources.length} provisioned cloud resource${params.resources.length === 1 ? "" : "s"}.`;
+    const headline = `Commercial ROI (${ws.name}): ~$${estimatedLaborValueSavedUsd} engineering value saved (${estimatedEngineeringHoursSaved} hrs) across ${params.runs.length} governed run${params.runs.length === 1 ? "" : "s"} (${completionRateWithoutManualRepairPct}% completion without manual repair, $${totalMonetarySpendUsd.toFixed(2)} USD total runtime spend).`;
     const explanation = formatHumanFriendlyExplanation({
         headline,
         nonTechnical: `${headline} Active credit balance: ${ws.creditsBalance} credits (${byokZeroCreditRunsCount} zero-credit BYOK runs).`,
-        technical: `workspace=${ws.id} | creditsBalance=${ws.creditsBalance} | runs=${params.runs.length} | hoursSaved=${estimatedEngineeringHoursSaved} | laborValueUsd=${estimatedLaborValueSavedUsd} | byokProviders=[${configuredByokProviders.join(",")}]`,
+        technical: `workspace=${ws.id} | creditsBalance=${ws.creditsBalance} | runs=${params.runs.length} | completionRatePct=${completionRateWithoutManualRepairPct} | spendUsd=${totalMonetarySpendUsd} | hoursSaved=${estimatedEngineeringHoursSaved} | laborValueUsd=${estimatedLaborValueSavedUsd} | byokProviders=[${configuredByokProviders.join(",")}]`,
         policy: ws.policy,
     });
     return {
@@ -819,6 +1261,7 @@ export function buildCommercialRoiReport(params) {
             byokZeroCreditRunsCount,
             managedFundedRunsCount,
             totalCreditsConsumed,
+            totalMonetarySpendUsd,
             byokCreditsSaved,
             byokDollarsSavedUsd,
             estimatedEngineeringMinutesSaved,
@@ -829,8 +1272,794 @@ export function buildCommercialRoiReport(params) {
             activeBiTemporalFactsCount: params.temporalFacts.filter((f) => !f.validTo).length,
             configuredByokProviders,
         },
+        validationMetrics: {
+            timeToFirstSuccessfulActionSeconds,
+            completionRateWithoutManualRepairPct,
+            avgTimeSavedPerWorkflowMinutes,
+            avgCostPerCompletedWorkflowUsd,
+            repeatWorkflowExecutionsCount,
+            zeroChargeFailedRunsCount: failedRunsCount,
+        },
+        workflowBreakdown,
         laneBreakdown,
         recommendations,
         explanation,
     };
 }
+// ============================================================================
+// 5. TURNKEY HARNESS PRESETS & ONE-SHOT AGENT CONFIGURATOR
+// ============================================================================
+const DEFAULT_WORKSPACE_POLICY = {
+    mode: "enforce",
+    requireApprovalFor: ["admin", "financial", "destructive"],
+    allowInstantWallet: true,
+    allowProvisioning: true,
+    maxCreditsPerRun: 25,
+    executionRing: 2,
+    killSwitchActive: false,
+    killSwitchReason: null,
+    blockDestructiveSql: true,
+    languageMode: "hybrid",
+};
+export const MUXO_HARNESS_PRESETS = [
+    {
+        slug: "startup-builder",
+        name: "Startup Builder (Balanced Velocity & Safety)",
+        summary: "Auto-approves read, write, and cloud provisioning up to 50 credits/run while requiring human approval for financial, admin, and destructive actions.",
+        recommendedFor: "Claude Code, Cursor, Codex, and Factory Droid full-stack shipping",
+        naturalLanguageTriggers: [
+            "Configure harness preset startup-builder",
+            "Set agent profile to startup builder",
+            "Balanced velocity mode",
+        ],
+        policyPatch: {
+            mode: "enforce",
+            executionRing: 1,
+            requireApprovalFor: ["financial", "admin", "destructive"],
+            maxCreditsPerRun: 50,
+            allowProvisioning: true,
+            allowInstantWallet: true,
+            blockDestructiveSql: true,
+            languageMode: "hybrid",
+        },
+    },
+    {
+        slug: "strict-production",
+        name: "Strict Production (Zero-Trust & Human-in-the-Loop)",
+        summary: "Auto-approves read-only tools, requires explicit human approval for every write, cloud provisioning, financial, or admin action, blocks destructive SQL, and caps runs at 25 credits.",
+        recommendedFor: "Production SaaS operations, SecOps, and customer-facing ChatGPT / Claude agents",
+        naturalLanguageTriggers: [
+            "Configure harness preset strict-production",
+            "Strict production mode",
+            "Zero-trust human-in-the-loop mode",
+        ],
+        policyPatch: {
+            mode: "enforce",
+            executionRing: 2,
+            requireApprovalFor: ["write", "provisioning", "financial", "admin", "destructive"],
+            maxCreditsPerRun: 25,
+            allowProvisioning: true,
+            allowInstantWallet: true,
+            blockDestructiveSql: true,
+            languageMode: "technical",
+        },
+    },
+    {
+        slug: "read-only-auditor",
+        name: "Read-Only Auditor (Zero Mutation & Compliance)",
+        summary: "Allows read-only discovery, SEO/web intelligence, memory recall, Cedar policy compilation, and OTel/WORM audit exports while requiring approval or blocking mutations and cloud provisioning.",
+        recommendedFor: "Security audits, research agents, and compliance reporting",
+        naturalLanguageTriggers: [
+            "Configure harness preset read-only-auditor",
+            "Read-only auditor mode",
+            "Compliance auditor profile",
+        ],
+        policyPatch: {
+            mode: "enforce",
+            executionRing: 3,
+            requireApprovalFor: ["write", "provisioning", "financial", "admin", "destructive"],
+            maxCreditsPerRun: 10,
+            allowProvisioning: false,
+            allowInstantWallet: true,
+            blockDestructiveSql: true,
+            languageMode: "hybrid",
+        },
+    },
+    {
+        slug: "finops-byok-zero-cost",
+        name: "FinOps Zero-Cost (BYOK & Free-Tier Enforced)",
+        summary: "Optimizes for 0-credit BYOK execution and free cloud infrastructure tiers with a tight 5-credit per-run cap and approval gates on paid operations.",
+        recommendedFor: "High-volume background agents and cost-sensitive teams",
+        naturalLanguageTriggers: [
+            "Configure harness preset finops-byok-zero-cost",
+            "FinOps zero-cost mode",
+            "BYOK zero-credit profile",
+        ],
+        policyPatch: {
+            mode: "enforce",
+            executionRing: 2,
+            requireApprovalFor: ["provisioning", "financial", "admin", "destructive"],
+            maxCreditsPerRun: 5,
+            allowProvisioning: true,
+            allowInstantWallet: true,
+            blockDestructiveSql: true,
+            languageMode: "hybrid",
+            customInstructions: [
+                "Prefer 0-credit BYOK funding mode and free cloud plans whenever available.",
+            ],
+        },
+    },
+];
+export function resolveHarnessPreset(presetOrPrompt) {
+    const raw = String(presetOrPrompt || "").trim().toLowerCase();
+    if (!raw)
+        return null;
+    const exact = MUXO_HARNESS_PRESETS.find((p) => p.slug === raw);
+    if (exact)
+        return exact;
+    if (/\b(strict[-\s]?prod|strict\s+production|zero[-\s]?trust|human[-\s]?in[-\s]?the[-\s]?loop)\b/i.test(raw)) {
+        return MUXO_HARNESS_PRESETS[1];
+    }
+    if (/\b(read[-\s]?only\s+audit|auditor|zero[-\s]?mutation|compliance\s+auditor)\b/i.test(raw)) {
+        return MUXO_HARNESS_PRESETS[2];
+    }
+    if (/\b(finops|zero[-\s]?cost|byok\s+mode|cost[-\s]?optimized)\b/i.test(raw)) {
+        return MUXO_HARNESS_PRESETS[3];
+    }
+    if (/\b(startup[-\s]?builder|startup\s+mode|balanced\s+velocity|autonomous\s+dev|builder\s+preset)\b/i.test(raw)) {
+        return MUXO_HARNESS_PRESETS[0];
+    }
+    return null;
+}
+export function buildHarnessConfigurationBundle(params) {
+    const baseUrl = (params.baseUrl || "https://api.muxo.ai").replace(/\/+$/, "");
+    const mcpUrl = `${baseUrl}/mcp`;
+    const targetHarness = String(params.targetHarness || "all").toLowerCase();
+    const policy = {
+        ...DEFAULT_WORKSPACE_POLICY,
+        ...(params.workspace.policy || {}),
+    };
+    const presetLabel = params.appliedPreset
+        ? `${params.appliedPreset.name} (${params.appliedPreset.slug})`
+        : `Current Workspace Policy (${policy.executionRing || "ring2_standard"}, max ${policy.maxCreditsPerRun ?? 25} credits/run)`;
+    const headline = `Harness Configuration Ready for ${params.workspace.name}: ${presetLabel}.`;
+    const explanation = formatHumanFriendlyExplanation({
+        headline,
+        nonTechnical: `${headline} You can control guardrails, memory time-travel, Temporal Saga playbooks, AWS Cedar policies, OpenTelemetry traces, and ROI analytics in plain English via 'POST /api/v1/do' or MCP 'get_run_context'.`,
+        technical: `workspace=${params.workspace.id} | preset=${params.appliedPreset?.slug || "custom"} | mcpUrl=${mcpUrl} | ring=${policy.executionRing || "ring2_standard"} | maxCreditsPerRun=${policy.maxCreditsPerRun ?? 25}`,
+        policy,
+    });
+    const naturalLanguageCheatsheet = [
+        {
+            category: "Turnkey & Custom Saga Playbooks",
+            sayInPlainEnglish: "Run the fullstack cloud bootstrap playbook for acme",
+            mcpEquivalent: {
+                tool: "get_run_context",
+                arguments: {
+                    action: "run_playbook",
+                    slug: "fullstack-cloud-bootstrap",
+                    input: { serviceRef: "acme" },
+                },
+            },
+            restEndpoint: "POST /api/v1/playbooks/fullstack-cloud-bootstrap/run",
+        },
+        {
+            category: "Custom Saga Playbook Authoring",
+            sayInPlainEnglish: "Create playbook daily-seo-slack that runs instant.seo.audit and app.slack.send_message",
+            mcpEquivalent: {
+                tool: "get_run_context",
+                arguments: {
+                    action: "create_playbook",
+                    prompt: "Create playbook daily-seo-slack that runs instant.seo.audit and app.slack.send_message",
+                },
+            },
+            restEndpoint: "POST /api/v1/playbooks",
+        },
+        {
+            category: "Temporal Workflow Rollback & Signals",
+            sayInPlainEnglish: "Rollback the latest workflow because staging healthcheck failed",
+            mcpEquivalent: {
+                tool: "get_run_context",
+                arguments: {
+                    action: "rollback_workflow",
+                    workflow_id: "latest",
+                    prompt: "Staging healthcheck failed",
+                },
+            },
+            restEndpoint: "POST /api/v1/workflows/:id/rollback",
+        },
+        {
+            category: "Graphiti Time-Travel & Multi-Hop Memory Graph",
+            sayInPlainEnglish: "Show my knowledge graph as of 2026-10-20T00:00:00Z within 2 hops of workspace",
+            mcpEquivalent: {
+                tool: "get_run_context",
+                arguments: {
+                    action: "memory_graph",
+                    as_of: "2026-10-20T00:00:00Z",
+                    focal_entity: "workspace",
+                    max_hops: 2,
+                },
+            },
+            restEndpoint: "POST /api/v1/memory/graph",
+        },
+        {
+            category: "AWS Cedar & OPA Policy-as-Code",
+            sayInPlainEnglish: "Compile our guardrails to AWS Cedar and OPA Rego (or: Evaluate Cedar policy for resource.turso.database with DROP TABLE users)",
+            mcpEquivalent: {
+                tool: "get_run_context",
+                arguments: {
+                    action: "cedar_policy",
+                    tool_slug: "resource.turso.database",
+                    input: { query: "DROP TABLE users" },
+                },
+            },
+            restEndpoint: "GET /api/v1/governance/cedar | POST /api/v1/governance/cedar/evaluate",
+        },
+        {
+            category: "OpenTelemetry GenAI & Langfuse Traces",
+            sayInPlainEnglish: "Export OpenTelemetry traces and Langfuse batch",
+            mcpEquivalent: {
+                tool: "get_run_context",
+                arguments: { action: "otel_traces", limit: 25 },
+            },
+            restEndpoint: "GET /api/v1/telemetry/otlp",
+        },
+        {
+            category: "FinOps & Engineering ROI Analytics",
+            sayInPlainEnglish: "What is our ROI and how many engineering hours have we saved?",
+            mcpEquivalent: {
+                tool: "get_run_context",
+                arguments: { action: "roi_analytics" },
+            },
+            restEndpoint: "GET /api/v1/analytics/roi",
+        },
+        {
+            category: "One-Shot Harness Preset & Guardrails",
+            sayInPlainEnglish: "Configure harness preset strict-production and only allow emails to @muxo.ai",
+            mcpEquivalent: {
+                tool: "get_run_context",
+                arguments: {
+                    action: "configure_harness",
+                    preset: "strict-production",
+                    prompt: "Only allow sending emails to @muxo.ai",
+                },
+            },
+            restEndpoint: "POST /api/v1/harness/configure",
+        },
+    ];
+    const systemPromptDirective = [
+        `# Muxo Natural-Language & Harness Control Directive (${params.workspace.name})`,
+        `- Active Profile: ${presetLabel}`,
+        `- You can pass ANY plain-English instruction directly to \`get_run_context({ prompt: "..." })\` or \`POST ${baseUrl}/api/v1/do\` without needing to memorize sub-actions.`,
+        `- Built-in Saga Playbooks: \`fullstack-cloud-bootstrap\`, \`competitor-seo-growth-brief\`, \`incident-containment-audit\`, \`customer-release-readiness\` (plus custom playbooks via "Create playbook <name> that runs ...").`,
+        `- Time-Travel & BFS Memory: Ask "Show knowledge graph as of <ISO-date> within 2 hops of <entity>" or pass \`as_of\`, \`focal_entity\`, \`max_hops\`.`,
+        `- Policy-as-Code & Telemetry: Ask "Compile policy to AWS Cedar", "Evaluate Cedar policy for <tool>", "Export OpenTelemetry traces", or "What is our ROI?".`,
+    ].join("\n");
+    return {
+        ok: true,
+        workspaceId: params.workspace.id,
+        workspaceSlug: params.workspace.slug,
+        targetHarness,
+        appliedPreset: params.appliedPreset || null,
+        availablePresets: MUXO_HARNESS_PRESETS,
+        policy,
+        harnessConfigs: {
+            claudeCode: {
+                installPluginCommand: `claude plugin marketplace add ${baseUrl}/.claude-plugin/marketplace.json && claude plugin install muxo@muxo`,
+                addMcpCommand: `claude mcp add --transport http muxo ${mcpUrl}`,
+                mcpJson: {
+                    mcpServers: {
+                        muxo: {
+                            type: "http",
+                            url: mcpUrl,
+                            headers: {
+                                Authorization: "Bearer ${MUXO_API_KEY}",
+                            },
+                        },
+                    },
+                },
+            },
+            cursor: {
+                filePath: ".cursor/mcp.json",
+                mcpJson: {
+                    mcpServers: {
+                        muxo: {
+                            url: mcpUrl,
+                            headers: {
+                                Authorization: "Bearer ${MUXO_API_KEY}",
+                            },
+                        },
+                    },
+                },
+            },
+            codex: {
+                filePath: "~/.codex/config.toml",
+                toml: `[mcp_servers.muxo]\nurl = "${mcpUrl}"\nbearer_token_env_var = "MUXO_API_KEY"\n`,
+            },
+            chatgpt: {
+                mcpServerUrl: mcpUrl,
+                authMode: "OAuth 2.1 (CIMD / DCR) or No Authentication for Instant tools",
+                instructions: "In ChatGPT → Settings → Connectors / Plugins → Add custom MCP server, enter https://api.muxo.ai/mcp.",
+            },
+            claudeDesktop: {
+                filePath: "claude_desktop_config.json",
+                mcpJson: {
+                    mcpServers: {
+                        muxo: {
+                            command: "npx",
+                            args: ["-y", "@muxoai/cli@latest", "mcp"],
+                            env: {
+                                MUXO_API_KEY: "<YOUR_MUXO_API_KEY>",
+                            },
+                        },
+                    },
+                },
+            },
+            factoryDroid: {
+                mcpServerUrl: mcpUrl,
+                skillCommand: `curl -fsSL ${baseUrl}/skill.md`,
+            },
+        },
+        systemPromptDirective,
+        naturalLanguageCheatsheet,
+        explanation,
+        humanMessage: explanation.preferred,
+    };
+}
+export function extractPlaybookInputFromNaturalLanguage(prompt, explicitInput) {
+    const out = { ...(explicitInput || {}) };
+    const text = String(prompt || "").trim();
+    const urlMatch = text.match(/https?:\/\/[^\s"'<>]+/i);
+    if (urlMatch && !out.url) {
+        out.url = urlMatch[0].replace(/[.,;!?)]+$/, "");
+    }
+    const providerMatch = text.match(/\b(neon|turso|supabase|upstash|cloudflare|vercel|firecrawl|github|slack|gmail|stripe|resend)\b/i);
+    if (providerMatch && !out.provider) {
+        out.provider = providerMatch[1].toLowerCase();
+    }
+    const forTargetMatch = text.match(/\b(?:for|on|target(?:ing)?|project|app|service)\s+["'`]?([a-zA-Z0-9._/-]{2,64})["'`]?/i);
+    if (forTargetMatch?.[1] &&
+        !/^(the|our|my|a|an|playbook|saga|workflow|cloud|production|staging)$/i.test(forTargetMatch[1]) &&
+        !out.serviceRef) {
+        out.serviceRef = forTargetMatch[1].replace(/[.,;!?)]+$/, "");
+    }
+    return out;
+}
+function parseRelativeOrIsoTimestamp(text) {
+    const isoMatch = text.match(/\b(\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})?)?)\b/);
+    if (isoMatch?.[1]) {
+        const raw = isoMatch[1];
+        return raw.includes("T") ? raw : `${raw}T23:59:59.000Z`;
+    }
+    if (/\byesterday\b/i.test(text)) {
+        return new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString();
+    }
+    const relMatch = text.match(/\b(\d+)\s*(hour|hr|day|week|minute|min)s?\s+ago\b/i);
+    if (relMatch) {
+        const count = Number(relMatch[1]);
+        const unit = relMatch[2].toLowerCase();
+        const mult = unit.startsWith("min")
+            ? 60_000
+            : unit.startsWith("h")
+                ? 3_600_000
+                : unit.startsWith("w")
+                    ? 7 * 86_400_000
+                    : 86_400_000;
+        return new Date(Date.now() - count * mult).toISOString();
+    }
+    return null;
+}
+export function parseNaturalLanguageOssIntent(prompt, options) {
+    const raw = String(prompt || "").trim();
+    const cleaned = raw
+        .replace(/^(?:hey\s+muxo[,:\s]*|muxo[,:\s]*|please\s+|can\s+you\s+)/i, "")
+        .trim();
+    if (!cleaned) {
+        return { matched: false, kind: null, summary: "" };
+    }
+    // 1. Custom Playbook Creation ("Create playbook <name> that runs ...", "Define a saga playbook ...")
+    if (/^(?:create|define|register|save|build|add)\s+(?:a\s+|new\s+|custom\s+)?(?:commercial\s+|saga\s+|durable\s+)?playbook\b/i.test(cleaned)) {
+        const customPlaybook = parseNaturalLanguageCustomPlaybook(cleaned, options?.explicitInput);
+        return {
+            matched: true,
+            kind: "create_playbook",
+            customPlaybook,
+            playbookSlug: customPlaybook.slug,
+            summary: `Created custom ${customPlaybook.steps.length}-step Saga playbook '${customPlaybook.slug}'.`,
+        };
+    }
+    // 2. List / Discover Playbooks ("List playbooks", "What playbooks are available?", "Show commercial saga playbooks")
+    if (/^(?:list|show|what\s+are(?:\s+the|\s+our)?|get|inspect|browse)\s+(?:all\s+|available\s+|commercial\s+|turnkey\s+|saga\s+)?playbooks\b/i.test(cleaned) ||
+        /\bwhat\s+playbooks\s+(?:can\s+we\s+run|are\s+available|do\s+you\s+have)\b/i.test(cleaned)) {
+        return {
+            matched: true,
+            kind: "list_playbooks",
+            summary: "Listed available turnkey and custom Saga playbooks.",
+        };
+    }
+    // 3. Run Playbook ("Run fullstack cloud bootstrap playbook", "Bootstrap a fullstack cloud stack", "Run competitor SEO growth brief", "Execute playbook <slug>")
+    const explicitPlaybookRun = /^(?:run|execute|launch|start|trigger)\s+(?:the\s+|our\s+|a\s+)?(?:commercial\s+|saga\s+|turnkey\s+)?playbook\b/i.test(cleaned) ||
+        /\b(?:run|execute|launch|start|trigger)\b[\s\S]*\bplaybook\b/i.test(cleaned) ||
+        /^(?:bootstrap\s+(?:a\s+|our\s+)?(?:fullstack|full-stack)\s+cloud|run\s+(?:fullstack|full-stack)\s+cloud\s+bootstrap|run\s+competitor\s+seo\s+growth\s+brief|run\s+incident\s+containment\s+audit|run\s+customer\s+release\s+readiness)\b/i.test(cleaned);
+    if (explicitPlaybookRun) {
+        const matchedPb = getCommercialPlaybook(cleaned, options?.customPlaybooks || []) ||
+            MUXO_COMMERCIAL_PLAYBOOKS[0];
+        const playbookInput = extractPlaybookInputFromNaturalLanguage(cleaned, options?.explicitInput);
+        return {
+            matched: true,
+            kind: "run_playbook",
+            playbookSlug: matchedPb.slug,
+            playbookInput,
+            summary: `Execute Saga playbook '${matchedPb.name}' (${matchedPb.slug}).`,
+        };
+    }
+    // 4. Temporal Workflow Saga Rollback ("Rollback workflow wf_123 because ...", "Rollback the latest workflow", "Undo last saga workflow", "Compensate workflow wf_...")
+    if (/^(?:rollback|roll\s+back|compensate|abort\s+and\s+rollback|undo)\s+(?:the\s+|our\s+|my\s+)?(?:latest\s+|last\s+|most\s+recent\s+)?(?:durable\s+|temporal\s+|saga\s+|playbook\s+)?(?:workflow|saga)(?:\s+(wf_[a-zA-Z0-9_-]+))?/i.test(cleaned) ||
+        /\b(?:rollback|roll\s+back|compensate)\s+(wf_[a-zA-Z0-9_-]+)\b/i.test(cleaned)) {
+        const wfIdMatch = cleaned.match(/\b(wf_[a-zA-Z0-9_-]+)\b/);
+        const reasonMatch = cleaned.match(/(?:because|reason|due\s+to)[:\s]+(.+)$/i);
+        const workflowId = wfIdMatch?.[1] || "latest";
+        const workflowReason = reasonMatch?.[1]?.trim() ||
+            `Rolled back via natural language: "${raw.slice(0, 100)}"`;
+        return {
+            matched: true,
+            kind: "rollback_workflow",
+            workflowId,
+            workflowReason,
+            summary: `Execute LIFO Saga rollback for workflow '${workflowId}'.`,
+        };
+    }
+    // 5. Temporal Workflow Signal ("Signal workflow wf_123 ...", "Send approval signal to workflow wf_123", "Approve workflow wf_123")
+    if (/^(?:signal|send\s+(?:a\s+)?signal\s+to|approve\s+workflow|resume\s+workflow)\b/i.test(cleaned) &&
+        /\b(wf_[a-zA-Z0-9_-]+|workflow|saga)\b/i.test(cleaned)) {
+        const wfIdMatch = cleaned.match(/\b(wf_[a-zA-Z0-9_-]+)\b/);
+        const workflowId = wfIdMatch?.[1] || "latest";
+        let signalName = "human.approval.granted";
+        if (/\boauth\b|\bconnection\b/i.test(cleaned)) {
+            signalName = "oauth.connection.active";
+        }
+        else if (/\b(abort|cancel|reject)\b/i.test(cleaned)) {
+            signalName = "saga.abort";
+        }
+        else {
+            const sigMatch = cleaned.match(/\b((?:human|oauth|saga|workflow)\.[a-z0-9_.]+)\b/i);
+            if (sigMatch?.[1])
+                signalName = sigMatch[1];
+        }
+        return {
+            matched: true,
+            kind: "signal_workflow",
+            workflowId,
+            signalName,
+            signalPayload: {
+                source: "natural_language",
+                prompt: raw,
+                ...(options?.explicitInput || {}),
+            },
+            summary: `Deliver Temporal signal '${signalName}' to workflow '${workflowId}'.`,
+        };
+    }
+    // 6. Temporal Workflow Event History ("Show Temporal history for workflow wf_123", "Inspect latest workflow saga history")
+    if (/\b(?:temporal\s+(?:event\s+)?history|workflow\s+(?:event\s+)?history|saga\s+history)\b/i.test(cleaned) ||
+        (/^(?:show|inspect|get|explain)\s+(?:the\s+|our\s+)?(?:latest\s+|last\s+)?(?:durable\s+|temporal\s+)?workflow\b/i.test(cleaned) &&
+            !/\bplaybooks\b/i.test(cleaned))) {
+        const wfIdMatch = cleaned.match(/\b(wf_[a-zA-Z0-9_-]+)\b/);
+        const workflowId = wfIdMatch?.[1] || "latest";
+        return {
+            matched: true,
+            kind: "workflow_history",
+            workflowId,
+            summary: `Inspect Temporal EventHistory for workflow '${workflowId}'.`,
+        };
+    }
+    // 7. AWS Cedar & OPA Rego Policy-as-Code Compile or Evaluate
+    if (/\b(?:cedar|opa\s+rego|rego\s+policy|policy[-\s]as[-\s]code)\b/i.test(cleaned)) {
+        const toolMatch = cleaned.match(/\b((?:instant|app|resource|billing)\.[a-z0-9_]+(?:\.[a-z0-9_]+)+)\b/i);
+        const isEval = Boolean(toolMatch) ||
+            /\b(?:evaluate|test|check|simulate|would\s+cedar\s+allow|drop\s+table|truncate\s+table|delete\s+from)\b/i.test(cleaned);
+        if (isEval) {
+            const toolSlug = toolMatch?.[1] || "resource.turso.database";
+            const evaluationInput = {
+                ...(options?.explicitInput || {}),
+            };
+            const sqlMatch = cleaned.match(/\b((?:DROP|TRUNCATE|DELETE|ALTER|SELECT|INSERT|UPDATE)\s+[\s\S]+)$/i);
+            if (sqlMatch?.[1] && !evaluationInput.query) {
+                evaluationInput.query = sqlMatch[1].trim();
+            }
+            const emailMatch = cleaned.match(/\b([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})\b/);
+            if (emailMatch?.[1] && !evaluationInput.to && !evaluationInput.recipient_email) {
+                evaluationInput.to = emailMatch[1];
+            }
+            return {
+                matched: true,
+                kind: "cedar_evaluate",
+                toolSlug,
+                evaluationInput,
+                summary: `Evaluate AWS Cedar 4.0 & OPA Rego v1 policy for '${toolSlug}'.`,
+            };
+        }
+        return {
+            matched: true,
+            kind: "cedar_compile",
+            summary: "Compile workspace guardrails into AWS Cedar 4.0 and OPA Rego v1.",
+        };
+    }
+    // 8. OpenTelemetry (OTel GenAI) & Langfuse Trace Export
+    if (/\b(?:opentelemetry|otel\b|otlp\b|langfuse|w3c\s+trace|trace\s+spans|telemetry\s+traces|genai\s+spans)\b/i.test(cleaned)) {
+        const limitMatch = cleaned.match(/\b(\d+)\s+(?:traces|spans|runs)\b/i);
+        return {
+            matched: true,
+            kind: "otel_traces",
+            limit: limitMatch ? Math.min(100, Math.max(1, Number(limitMatch[1]))) : 25,
+            summary: "Export W3C OpenTelemetry GenAI 1.29.0 spans and Langfuse batch.",
+        };
+    }
+    // 9. FinOps & Commercial ROI Unit-Economics Report
+    if (/\b(?:commercial\s+roi|finops|unit\s+economics|engineering\s+(?:hours|time|value)\s+saved|byok\s+savings|return\s+on\s+investment)\b/i.test(cleaned) ||
+        /^(?:what\s+is\s+(?:our|my)\s+roi|show\s+(?:our|my)?\s*roi|calculate\s+roi|how\s+much\s+(?:time|money|hours|credits)\s+have\s+we\s+saved)\b/i.test(cleaned)) {
+        return {
+            matched: true,
+            kind: "roi_analytics",
+            summary: "Generate FinOps unit-economics and engineering ROI report.",
+        };
+    }
+    // 10. Harness Preset & Agent Configuration ("Configure harness preset strict-production", "Show Cursor harness config", "Set agent profile to startup-builder")
+    const matchedPreset = resolveHarnessPreset(cleaned);
+    if (matchedPreset ||
+        /\b(?:configure\s+(?:muxo\s+)?harness|harness\s+(?:config|configuration|preset|setup)|agent\s+harness\s+profile|mcp\s+config\s+for\s+(?:claude|cursor|codex|chatgpt|droid))\b/i.test(cleaned)) {
+        const harnessMatch = cleaned.match(/\b(claude[-\s]?code|claude[-\s]?desktop|cursor|codex|chatgpt|droid|factory)\b/i);
+        const targetHarness = harnessMatch
+            ? harnessMatch[1].toLowerCase().replace(/\s+/g, "-")
+            : "all";
+        // Check if the user also included an inline guardrail (e.g. "and only allow emails to @muxo.ai")
+        const extraMatch = cleaned.match(/\band\s+((?:only|never|require|block|cap|limit|don't|do\s+not)\s+.+)$/i);
+        return {
+            matched: true,
+            kind: "configure_harness",
+            preset: matchedPreset,
+            targetHarness,
+            extraGuardrailPrompt: extraMatch?.[1]?.trim() || null,
+            summary: matchedPreset
+                ? `Configure harness preset '${matchedPreset.slug}' (${matchedPreset.name}).`
+                : `Inspect harness configuration & presets for '${targetHarness}'.`,
+        };
+    }
+    // 11. Graphiti Bi-Temporal Knowledge Graph with Time-Travel (`as of ...`) & Multi-Hop BFS (`within N hops of ...`)
+    if (/\b(?:memory\s+graph|knowledge\s+graph|temporal\s+graph|fact\s+lineage|bi[-\s]?temporal\s+(?:graph|lineage|facts)|graphiti|subgraph)\b/i.test(cleaned)) {
+        const asOf = parseRelativeOrIsoTimestamp(cleaned);
+        const hopsMatch = cleaned.match(/\b(\d+)[-\s]*hops?\b/i);
+        const maxHops = hopsMatch
+            ? Math.min(4, Math.max(1, Number(hopsMatch[1])))
+            : undefined;
+        const focalMatch = cleaned.match(/\b(?:around|for\s+entity|focal\s+entity|centered\s+on|of\s+entity|neighborhood\s+of)\s+["'`]?([a-zA-Z0-9:._-]+)["'`]?/i) ||
+            cleaned.match(/\bwithin\s+\d+\s+hops?\s+of\s+["'`]?([a-zA-Z0-9:._-]+)["'`]?/i);
+        const focalEntity = focalMatch?.[1] &&
+            !/^(the|our|my|graph|memory|knowledge|yesterday|today)$/i.test(focalMatch[1])
+            ? focalMatch[1]
+            : null;
+        return {
+            matched: true,
+            kind: "memory_graph",
+            asOf,
+            focalEntity,
+            maxHops,
+            summary: `Query Graphiti bi-temporal knowledge graph${asOf ? ` as of ${asOf}` : ""}${focalEntity ? ` around '${focalEntity}' (${maxHops || 2} hops)` : ""}.`,
+        };
+    }
+    return { matched: false, kind: null, summary: "" };
+}
+// ============================================================================
+// 7. COMMERCIAL APPROVAL IMPACT PREVIEW, BUSINESS RECEIPTS & RECONCILIATION
+// ============================================================================
+function inferTargetEntityFromInput(toolSlug, input) {
+    const candidates = [
+        input.customer_id,
+        input.customerId,
+        input.account_id,
+        input.accountId,
+        input.to,
+        input.recipient_email,
+        input.email,
+        input.channel,
+        input.repo,
+        input.repository,
+        input.url,
+        input.domain,
+        input.name,
+        input.project_name,
+        input.database_name,
+        input.service_ref,
+        input.query,
+    ];
+    for (const c of candidates) {
+        if (typeof c === "string" && c.trim()) {
+            return c.trim().slice(0, 80);
+        }
+    }
+    const parts = String(toolSlug || "").split(".");
+    return parts.length >= 2 ? `${parts[1]}:${parts.slice(2).join(".") || "resource"}` : toolSlug;
+}
+export function buildApprovalImpactPreview(params) {
+    const input = params.input || {};
+    const targetEntity = inferTargetEntityFromInput(params.toolSlug, input);
+    const fundingMode = params.fundingMode ||
+        params.supplierSettlement?.fundingMode ||
+        (params.creditCost === 0 ? "byok" : "muxo_funded");
+    const cents = typeof params.supplierSettlement?.userRetailChargeCents === "number"
+        ? params.supplierSettlement.userRetailChargeCents
+        : (params.creditCost || 0) * 1;
+    const estimatedCostUsd = Number((cents / 100).toFixed(2));
+    const costDisplay = fundingMode === "byok"
+        ? `$0.00 USD (0 credits · Customer BYOK key)`
+        : `$${estimatedCostUsd.toFixed(2)} USD (${params.creditCost} credit${params.creditCost === 1 ? "" : "s"} · Muxo Master Wallet)`;
+    let whatChanges = params.reason && params.reason.trim() && params.reason !== `Execute ${params.toolSlug}`
+        ? `${params.reason.trim()} via ${params.toolSlug} on ${targetEntity}`
+        : `Execute ${params.toolSlug} (${params.riskLevel} risk) targeting ${targetEntity}`;
+    if (params.riskLevel === "read") {
+        whatChanges = `Read-only query via ${params.toolSlug} on ${targetEntity} (no external state mutation)`;
+    }
+    else if (params.lane === "stripe_projects" || params.riskLevel === "provisioning") {
+        whatChanges = `Provision or mutate cloud infrastructure (${params.toolSlug}) for ${targetEntity}`;
+    }
+    else if (params.riskLevel === "financial") {
+        whatChanges = `Execute financial/billing action (${params.toolSlug}) affecting ${targetEntity}`;
+    }
+    else if (params.riskLevel === "destructive") {
+        whatChanges = `Execute destructive operation (${params.toolSlug}) on ${targetEntity}`;
+    }
+    let whoIsAffected = `Workspace ${params.workspaceName || "environment"} (${targetEntity})`;
+    if (typeof input.customer_id === "string" || typeof input.customerId === "string") {
+        whoIsAffected = `Customer account ${input.customer_id || input.customerId}`;
+    }
+    else if (typeof input.to === "string" || typeof input.recipient_email === "string") {
+        whoIsAffected = `Recipient ${input.to || input.recipient_email}`;
+    }
+    else if (typeof input.channel === "string") {
+        whoIsAffected = `Channel ${input.channel} subscribers`;
+    }
+    else if (typeof input.repo === "string" || typeof input.repository === "string") {
+        whoIsAffected = `Repository ${input.repo || input.repository} collaborators`;
+    }
+    const triggeredRule = params.decisionRecord
+        ? `${params.decisionRecord.matchedRule} (${params.decisionRecord.verdict.toUpperCase()}): ${params.decisionRecord.reason}`
+        : `risk_gate:${params.riskLevel}`;
+    const reversibility = params.riskLevel === "read"
+        ? "reversible"
+        : params.riskLevel === "destructive"
+            ? "irreversible"
+            : "compensatable_saga";
+    const recoveryBehavior = reversibility === "reversible"
+        ? "Read-only call; safe to retry idempotently with zero side effects and zero credit charge on failure."
+        : reversibility === "compensatable_saga"
+            ? "Execute-once idempotency lock prevents duplicate execution; LIFO Saga compensation available on downstream failure; 0 credits charged if call fails."
+            : "High-impact destructive operation; guarded by execute-once lock and human approval gate; 0 credits charged if rejected or failed.";
+    return {
+        whatChanges,
+        whoIsAffected,
+        targetEntity,
+        estimatedCostUsd,
+        creditCost: params.creditCost,
+        fundingMode,
+        costDisplay,
+        triggeredRule,
+        reversibility,
+        recoveryBehavior,
+    };
+}
+export function buildBusinessReceiptSummary(params) {
+    const input = params.input || {};
+    const targetEntity = inferTargetEntityFromInput(params.toolSlug, input);
+    const fundingMode = params.supplierSettlement?.fundingMode ||
+        (params.creditsMetered === 0 ? "byok" : "muxo_funded");
+    const cents = params.status === "succeeded"
+        ? typeof params.supplierSettlement?.userRetailChargeCents === "number"
+            ? params.supplierSettlement.userRetailChargeCents
+            : (params.creditsMetered || 0) * 1
+        : 0;
+    const costUsd = Number((cents / 100).toFixed(2));
+    const creditsCharged = params.status === "succeeded" ? params.creditsMetered : 0;
+    const costDisplay = params.status !== "succeeded"
+        ? `$0.00 USD (0 credits · Zero-charge failure protection)`
+        : fundingMode === "byok"
+            ? `$0.00 USD (0 credits · Customer BYOK key)`
+            : `$${costUsd.toFixed(2)} USD (${creditsCharged} credit${creditsCharged === 1 ? "" : "s"} · Muxo Master Wallet)`;
+    const whatChanged = params.status === "succeeded"
+        ? params.riskLevel === "read"
+            ? `Retrieved verified data via ${params.toolSlug} from ${targetEntity} (no external mutation)`
+            : `Completed governed ${params.riskLevel} action via ${params.toolSlug} on ${targetEntity}`
+        : params.status === "cancelled"
+            ? `Cancelled ${params.toolSlug} on ${targetEntity} before completion (no changes persisted)`
+            : `Attempted ${params.toolSlug} on ${targetEntity}, halted safely before completion`;
+    const approver = params.approvedBy || "policy:auto";
+    const ruleLabel = params.decisionRecord?.matchedRule || `ring_policy:${params.riskLevel}`;
+    const whoAuthorized = approver === "policy:auto"
+        ? `Auto-authorized by Workspace Policy (${ruleLabel})`
+        : `Human-approved by ${approver} (enforced via ${ruleLabel})`;
+    const whatSucceeded = params.status === "succeeded"
+        ? `Action ${params.toolSlug} succeeded on ${targetEntity} and cryptographic receipt was sealed in the workspace Merkle audit chain.`
+        : `Governance pre-flight and zero-charge wallet protection succeeded; external mutation did not complete.`;
+    const whatRemainsUnresolved = params.status === "succeeded"
+        ? []
+        : [
+            params.error
+                ? `Resolve upstream error: ${params.error}`
+                : `Inspect run state or retry via a fresh governed plan for ${params.toolSlug}`,
+        ];
+    const reconciliationStatus = params.status === "succeeded"
+        ? "verified_complete"
+        : params.status === "cancelled"
+            ? "cancelled"
+            : "failed_zero_charge";
+    return {
+        whatChanged,
+        whoAuthorized,
+        whatSucceeded,
+        whatRemainsUnresolved,
+        costUsd,
+        creditsCharged,
+        fundingMode,
+        costDisplay,
+        reconciliationStatus,
+    };
+}
+export function buildRunReconciliationReport(params) {
+    const { run, plan, receipt } = params;
+    const toolSlug = run?.toolSlug || plan?.toolSlug || "instant.web.search";
+    const lane = run?.lane || plan?.lane || "composio_instant";
+    const riskLevel = run?.riskLevel || plan?.riskLevel || "read";
+    const creditsMetered = run?.creditsMetered ?? 0;
+    const status = run?.status || "queued";
+    const businessSummary = receipt?.businessSummary ||
+        buildBusinessReceiptSummary({
+            toolSlug,
+            lane,
+            riskLevel,
+            status: status === "succeeded"
+                ? "succeeded"
+                : status === "cancelled"
+                    ? "cancelled"
+                    : "failed",
+            creditsMetered,
+            input: run?.input || plan?.input,
+            output: run?.output,
+            error: run?.error,
+            approvedBy: plan?.approvedBy,
+            actorId: run?.actorId || plan?.actorId,
+            decisionRecord: receipt?.decisionRecord || plan?.decisionRecord || null,
+            supplierSettlement: receipt?.supplierSettlement || plan?.supplierSettlement || null,
+        });
+    const receiptVerified = params.signatureValid !== undefined
+        ? Boolean(receipt && params.signatureValid)
+        : Boolean(receipt && receipt.receiptHash && receipt.signature);
+    const reconciliationStatus = status === "succeeded" && receiptVerified
+        ? "verified_complete"
+        : status === "failed" && creditsMetered === 0
+            ? "failed_zero_charge"
+            : status === "cancelled"
+                ? "cancelled"
+                : "needs_reconciliation";
+    return {
+        ok: true,
+        runId: run?.id || plan?.runId || "unexecuted",
+        planId: run?.planId || plan?.id || "unknown",
+        workspaceId: run?.workspaceId || plan?.workspaceId || "unknown",
+        toolSlug,
+        status,
+        reconciliationStatus,
+        executeOnceEnforced: Boolean((plan?.runId && run?.id && plan.runId === run.id) || run?.id || plan?.id),
+        idempotentReplaySafe: true,
+        zeroChargeOnFailureVerified: status === "succeeded" || creditsMetered === 0,
+        creditsMetered,
+        estimatedCostUsd: businessSummary.costUsd,
+        receiptVerified,
+        receiptId: receipt?.id || run?.receiptId || null,
+        businessSummary,
+        recommendedNextAction: reconciliationStatus === "verified_complete"
+            ? "No action required — execution and cryptographic receipt are verified complete."
+            : reconciliationStatus === "failed_zero_charge"
+                ? "Zero credits were charged. Inspect error details and create a new plan if retry is desired."
+                : !run && plan
+                    ? `Plan '${plan.id}' (${plan.approvalStatus}) has not been executed yet; no credits charged.`
+                    : "Inspect upstream provider state or re-verify receipt chain.",
+    };
+}