@obsunified/collector 2.1.1 → 2.2.0

package/dist/index.js

@@ -18,7 +18,7 @@ import {
   askEvidenceReferences,
   generateNarrative,
   sourceLinkEvidenceReferences
-} from "./chunk-XKQTVIRE.js";
+} from "./chunk-ZSF5XP3B.js";
 
 // src/framework/collector.ts
 import { getConfiguredRetentionHours } from "@obsunified/types/constants";
@@ -2487,6 +2487,1569 @@ var NOOP_HANDLE = {
 };
 var passthroughChildSpan = async (_name, fn) => fn(NOOP_HANDLE);
 
+// src/lib/autosre-remediation-gate.ts
+import { AgentAutonomyLevel } from "@obsunified/types/constants";
+
+// src/lib/autosre-findings.ts
+import { buildCanonicalNodeId, buildFindingFingerprint } from "@obsunified/types";
+var mapFindingRow = (row) => {
+  const rawFpInput = parseJsonRecord(row.fingerprint_input_json);
+  const fingerprintInput = {
+    environment: typeof rawFpInput.environment === "string" ? rawFpInput.environment : row.environment,
+    originatingNodeId: typeof rawFpInput.originatingNodeId === "string" ? rawFpInput.originatingNodeId : row.fault_locus_entity_id,
+    normalizedOperation: typeof rawFpInput.normalizedOperation === "string" ? rawFpInput.normalizedOperation : row.title,
+    errorSignature: typeof rawFpInput.errorSignature === "string" ? rawFpInput.errorSignature : "ERROR",
+    downstreamTargetNodeId: typeof rawFpInput.downstreamTargetNodeId === "string" ? rawFpInput.downstreamTargetNodeId : null
+  };
+  const rawBreakdown = parseJsonRecord(row.confidence_breakdown_json);
+  const confidenceBreakdown = {
+    relationshipScore: Number(rawBreakdown.relationshipScore ?? 0.5),
+    cohortLiftScore: Number(rawBreakdown.cohortLiftScore ?? 0),
+    temporalProximityScore: Number(rawBreakdown.temporalProximityScore ?? 0.5),
+    counterfactualBonus: Number(rawBreakdown.counterfactualBonus ?? 0),
+    priorRecurrenceBonus: Number(rawBreakdown.priorRecurrenceBonus ?? 0),
+    finalConfidence: Number(rawBreakdown.finalConfidence ?? row.confidence)
+  };
+  let counterfactualProof = null;
+  if (row.counterfactual_proof_json) {
+    const rawCf = parseJsonRecord(row.counterfactual_proof_json);
+    if (typeof rawCf.evalCaseId === "string") {
+      counterfactualProof = {
+        evalCaseId: rawCf.evalCaseId,
+        inputPayloadHash: String(rawCf.inputPayloadHash ?? ""),
+        failingRunId: String(rawCf.failingRunId ?? ""),
+        failingVersion: typeof rawCf.failingVersion === "string" ? rawCf.failingVersion : null,
+        failingCommitSha: typeof rawCf.failingCommitSha === "string" ? rawCf.failingCommitSha : null,
+        failureFingerprint: String(rawCf.failureFingerprint ?? row.fingerprint),
+        passingRunIds: Array.isArray(rawCf.passingRunIds) ? rawCf.passingRunIds.map(String) : [],
+        passingVersion: typeof rawCf.passingVersion === "string" ? rawCf.passingVersion : null,
+        passingCommitSha: typeof rawCf.passingCommitSha === "string" ? rawCf.passingCommitSha : null,
+        requiredTrials: Number(rawCf.requiredTrials ?? 1),
+        verifiedAt: String(rawCf.verifiedAt ?? row.updated_at)
+      };
+    }
+  }
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    environment: row.environment,
+    incidentId: row.incident_id,
+    fingerprint: row.fingerprint,
+    fingerprintInput,
+    title: row.title,
+    summary: row.summary,
+    causalProofTier: row.causal_proof_tier || "unverified_locus",
+    confidence: Number(row.confidence),
+    confidenceBreakdown,
+    symptomEntityKind: row.symptom_entity_kind,
+    symptomEntityId: row.symptom_entity_id,
+    faultLocusEntityKind: row.fault_locus_entity_kind,
+    faultLocusEntityId: row.fault_locus_entity_id,
+    rootCauseEntityKind: row.root_cause_entity_kind ?? null,
+    rootCauseEntityId: row.root_cause_entity_id,
+    contributingChangeId: row.contributing_change_id,
+    cohortVerdict: row.cohort_verdict ?? null,
+    contendingTraceId: row.contending_trace_id,
+    causalChain: parseJsonArray(row.causal_chain_json),
+    citedEvidenceIds: parseJsonArray(row.cited_evidence_ids_json).map(String),
+    codeReferences: parseJsonArray(
+      row.code_references_json ?? "[]"
+    ),
+    counterfactualProof,
+    recoveryStatus: row.recovery_status || "not_applicable",
+    causalVerificationStatus: row.causal_verification_status || "unverified",
+    watchdogStep: Number(row.watchdog_step ?? 0),
+    baselineRequestRatePerMin: row.baseline_request_rate_per_min === null ? null : Number(row.baseline_request_rate_per_min),
+    nextWatchdogCheckAt: row.next_watchdog_check_at,
+    actorType: row.actor_type,
+    actorId: row.actor_id,
+    agentRunId: row.agent_run_id,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    expiresAt: row.expires_at
+  };
+};
+function resolveSafeCausalProofTier(input) {
+  if (input.cohortVerdict === "isolated_to_new_version") {
+    return "cohort_rate_isolated";
+  }
+  if (input.cohortVerdict === "sequential_post_cutover_regression" || input.cohortVerdict === "shared_degradation_new_version_aggressor") {
+    return "corroborated_candidate";
+  }
+  const hasCodeOverlapOrContention = input.causalChain.some(
+    (t) => t.predicate === "touched_same_code_path" || t.predicate === "contended_on_shared_resource" || t.predicate === "induced_shared_resource_contention" || t.predicate === "degraded_after_change"
+  );
+  if (input.causalProofTier === "cohort_rate_isolated") {
+    const hasIsolatedTriple = input.causalChain.some(
+      (t) => t.predicate === "isolated_to_version_cohort"
+    );
+    if (hasIsolatedTriple) return "cohort_rate_isolated";
+  }
+  if (hasCodeOverlapOrContention || input.causalProofTier === "corroborated_candidate") {
+    return "corroborated_candidate";
+  }
+  return "unverified_locus";
+}
+async function recordInvestigationFinding(db, projectId, input) {
+  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  const environment = (input.environment ?? input.fingerprintInput?.environment ?? "default").trim().toLowerCase();
+  const defaultOriginNode = input.faultLocusEntityId.includes(":") ? input.faultLocusEntityId : buildCanonicalNodeId({
+    kind: "service",
+    environment,
+    serviceName: input.faultLocusEntityId
+  }).id;
+  const fpResult = buildFindingFingerprint(
+    input.fingerprintInput ?? {
+      environment,
+      originatingNodeId: defaultOriginNode,
+      normalizedOperation: input.title,
+      errorSignature: input.summary.slice(0, 120),
+      downstreamTargetNodeId: null
+    }
+  );
+  const priorRow = await db.prepare(
+    `SELECT id, causal_verification_status FROM investigation_findings
+			 WHERE project_id = ? AND environment = ? AND fingerprint = ?
+			 ORDER BY created_at DESC
+			 LIMIT 1`
+  ).bind(projectId, environment, fpResult.fingerprint).first();
+  const causalProofTier = resolveSafeCausalProofTier(input);
+  const relationshipScore = input.causalChain.some(
+    (c) => c.relationshipCertainty === "exact"
+  ) ? 0.9 : input.causalChain.some((c) => c.relationshipCertainty === "inferred") ? 0.65 : 0.4;
+  const cohortLiftScore = causalProofTier === "cohort_rate_isolated" ? 0.9 : causalProofTier === "corroborated_candidate" ? 0.6 : 0.2;
+  const priorBonus = priorRow?.causal_verification_status === "counterfactual_verified" || priorRow?.causal_verification_status === "operationally_corroborated" ? 0.1 : 0;
+  const computedConfidence = Math.min(
+    0.99,
+    Number(
+      (0.4 * relationshipScore + 0.4 * cohortLiftScore + 0.2 * 0.7 + priorBonus).toFixed(2)
+    )
+  );
+  const confidence = input.confidence ?? computedConfidence;
+  const confidenceBreakdown = {
+    relationshipScore: input.confidenceBreakdown?.relationshipScore ?? relationshipScore,
+    cohortLiftScore: input.confidenceBreakdown?.cohortLiftScore ?? cohortLiftScore,
+    temporalProximityScore: input.confidenceBreakdown?.temporalProximityScore ?? 0.7,
+    counterfactualBonus: input.confidenceBreakdown?.counterfactualBonus ?? 0,
+    priorRecurrenceBonus: input.confidenceBreakdown?.priorRecurrenceBonus ?? priorBonus,
+    finalConfidence: confidence
+  };
+  const id = input.id?.trim() || `fnd_${randomHex(10)}`;
+  const expiresAt = new Date(
+    Date.now() + 90 * 24 * 36e5
+  ).toISOString();
+  await db.prepare(
+    `INSERT INTO investigation_findings (
+				project_id, environment, id, incident_id, fingerprint,
+				fingerprint_input_json, title, summary, causal_proof_tier,
+				confidence, confidence_breakdown_json, symptom_entity_kind,
+				symptom_entity_id, fault_locus_entity_kind, fault_locus_entity_id,
+				root_cause_entity_kind, root_cause_entity_id, contributing_change_id,
+				cohort_verdict, contending_trace_id, causal_chain_json,
+				cited_evidence_ids_json, code_references_json,
+				recovery_status, causal_verification_status, watchdog_step,
+				actor_type, actor_id, agent_run_id, created_at, updated_at, expires_at
+			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'not_applicable', 'unverified', 0, ?, ?, ?, ?, ?, ?)
+			ON CONFLICT (project_id, environment, id) DO UPDATE SET
+				title = excluded.title,
+				summary = excluded.summary,
+				causal_proof_tier = excluded.causal_proof_tier,
+				confidence = excluded.confidence,
+				confidence_breakdown_json = excluded.confidence_breakdown_json,
+				contributing_change_id = COALESCE(excluded.contributing_change_id, investigation_findings.contributing_change_id),
+				cohort_verdict = COALESCE(excluded.cohort_verdict, investigation_findings.cohort_verdict),
+				causal_chain_json = excluded.causal_chain_json,
+				cited_evidence_ids_json = excluded.cited_evidence_ids_json,
+				updated_at = excluded.updated_at`
+  ).bind(
+    projectId,
+    environment,
+    id,
+    input.incidentId ?? null,
+    fpResult.fingerprint,
+    JSON.stringify(fpResult.normalizedInput),
+    input.title,
+    input.summary,
+    causalProofTier,
+    confidence,
+    JSON.stringify(confidenceBreakdown),
+    input.symptomEntityKind,
+    input.symptomEntityId,
+    input.faultLocusEntityKind,
+    input.faultLocusEntityId,
+    input.rootCauseEntityKind ?? null,
+    input.rootCauseEntityId ?? null,
+    input.contributingChangeId ?? null,
+    input.cohortVerdict ?? null,
+    input.contendingTraceId ?? null,
+    JSON.stringify(input.causalChain),
+    JSON.stringify(input.citedEvidenceIds),
+    JSON.stringify(input.codeReferences ?? []),
+    input.actorType ?? "agent",
+    input.actorId ?? "autosre-agent",
+    input.agentRunId ?? null,
+    nowIso,
+    nowIso,
+    expiresAt
+  ).run();
+  const created = await getInvestigationFinding(db, projectId, id, environment);
+  if (!created) {
+    throw new Error(`Failed to load created finding ${id}`);
+  }
+  return created;
+}
+async function getInvestigationFinding(db, projectId, findingId, environment) {
+  const row = environment ? await db.prepare(
+    `SELECT * FROM investigation_findings
+					 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, environment.toLowerCase(), findingId).first() : await db.prepare(
+    `SELECT * FROM investigation_findings
+					 WHERE project_id = ? AND id = ?
+					 ORDER BY created_at DESC
+					 LIMIT 1`
+  ).bind(projectId, findingId).first();
+  return row ? mapFindingRow(row) : null;
+}
+async function searchInvestigationFindings(db, options) {
+  const conditions = ["project_id = ?"];
+  const binds = [options.projectId];
+  if (options.environment) {
+    conditions.push("environment = ?");
+    binds.push(options.environment.toLowerCase());
+  }
+  if (options.fingerprint) {
+    conditions.push("fingerprint = ?");
+    binds.push(options.fingerprint);
+  }
+  if (options.symptomEntityId) {
+    conditions.push("symptom_entity_id = ?");
+    binds.push(options.symptomEntityId);
+  }
+  if (options.rootCauseEntityId) {
+    conditions.push(
+      "(root_cause_entity_id = ? OR fault_locus_entity_id = ?)"
+    );
+    binds.push(options.rootCauseEntityId, options.rootCauseEntityId);
+  }
+  if (options.causalVerificationStatus) {
+    conditions.push("causal_verification_status = ?");
+    binds.push(options.causalVerificationStatus);
+  }
+  if (options.incidentId) {
+    conditions.push("incident_id = ?");
+    binds.push(options.incidentId);
+  }
+  const limit = Math.max(1, Math.min(100, options.limit ?? 25));
+  binds.push(limit);
+  const rows = await db.prepare(
+    `SELECT * FROM investigation_findings
+			 WHERE ${conditions.join(" AND ")}
+			 ORDER BY created_at DESC
+			 LIMIT ?`
+  ).bind(...binds).all();
+  return rows.results.map(mapFindingRow);
+}
+var CounterfactualVerificationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CounterfactualVerificationError";
+  }
+};
+async function verifyPairedCounterfactualProof(db, projectId, findingId, input) {
+  const finding = await getInvestigationFinding(
+    db,
+    projectId,
+    findingId,
+    input.environment
+  );
+  if (!finding) {
+    throw new CounterfactualVerificationError(
+      `Finding ${findingId} not found in project ${projectId}`
+    );
+  }
+  const requiredTrials = Math.max(1, input.requiredTrials ?? 1);
+  const uniquePassingIds = Array.from(new Set(input.passingRunIds));
+  if (uniquePassingIds.length < requiredTrials) {
+    throw new CounterfactualVerificationError(
+      `Counterfactual requires at least ${requiredTrials} passing trial run(s), got ${uniquePassingIds.length}`
+    );
+  }
+  if (uniquePassingIds.includes(input.failingRunId)) {
+    throw new CounterfactualVerificationError(
+      "failingRunId cannot also be listed in passingRunIds"
+    );
+  }
+  const loadRunVerification = async (runId) => {
+    const row = await db.prepare(
+      `SELECT
+					r.id AS run_id,
+					COALESCE(cr.eval_case_id, r.eval_case_id) AS eval_case_id,
+					r.service_version,
+					r.commit_sha,
+					r.candidate_agent_version,
+					r.candidate_prompt_version,
+					r.input_payload_hash AS run_input_hash,
+					r.failure_fingerprint AS run_failure_fp,
+					r.pass_count,
+					r.fail_count,
+					cr.passed AS result_passed,
+					cr.input_payload_hash AS result_input_hash,
+					cr.failure_fingerprint AS result_failure_fp
+				 FROM eval_runs r
+				 LEFT JOIN eval_case_results cr
+				   ON cr.project_id = r.project_id AND cr.run_id = r.id AND cr.eval_case_id = ?
+				 WHERE r.project_id = ? AND r.id = ?
+				 LIMIT 1`
+    ).bind(input.evalCaseId, projectId, runId).first();
+    return row;
+  };
+  const failingRow = await loadRunVerification(input.failingRunId);
+  if (!failingRow) {
+    throw new CounterfactualVerificationError(
+      `Failing eval run ${input.failingRunId} not found in project ${projectId}`
+    );
+  }
+  if (failingRow.eval_case_id !== input.evalCaseId) {
+    throw new CounterfactualVerificationError(
+      `Failing eval run ${input.failingRunId} does not match evalCaseId ${input.evalCaseId}`
+    );
+  }
+  const failingPassed = failingRow.result_passed !== null ? Number(failingRow.result_passed) === 1 : Number(failingRow.fail_count) === 0 && Number(failingRow.pass_count) > 0;
+  if (failingPassed) {
+    throw new CounterfactualVerificationError(
+      `Baseline run ${input.failingRunId} did not fail (passed=1)`
+    );
+  }
+  const failingInputHash = failingRow.result_input_hash ?? failingRow.run_input_hash;
+  if (!failingInputHash) {
+    throw new CounterfactualVerificationError(
+      `Failing eval run ${input.failingRunId} is missing input_payload_hash`
+    );
+  }
+  const failingFp = failingRow.result_failure_fp ?? failingRow.run_failure_fp;
+  if (failingFp !== finding.fingerprint) {
+    throw new CounterfactualVerificationError(
+      `Failing run fingerprint (${failingFp ?? "null"}) does not match finding fingerprint (${finding.fingerprint})`
+    );
+  }
+  const failingVersion = failingRow.service_version ?? failingRow.candidate_agent_version ?? failingRow.candidate_prompt_version;
+  let passingVersion = null;
+  let passingCommitSha = null;
+  for (const passRunId of uniquePassingIds) {
+    const passRow = await loadRunVerification(passRunId);
+    if (!passRow) {
+      throw new CounterfactualVerificationError(
+        `Passing eval run ${passRunId} not found in project ${projectId}`
+      );
+    }
+    if (passRow.eval_case_id !== input.evalCaseId) {
+      throw new CounterfactualVerificationError(
+        `Passing eval run ${passRunId} does not match evalCaseId ${input.evalCaseId}`
+      );
+    }
+    const didPass = passRow.result_passed !== null ? Number(passRow.result_passed) === 1 : Number(passRow.pass_count) > 0 && Number(passRow.fail_count) === 0;
+    if (!didPass) {
+      throw new CounterfactualVerificationError(
+        `Candidate run ${passRunId} did not pass`
+      );
+    }
+    const passInputHash = passRow.result_input_hash ?? passRow.run_input_hash;
+    if (passInputHash !== failingInputHash) {
+      throw new CounterfactualVerificationError(
+        `Candidate run ${passRunId} input_payload_hash (${passInputHash ?? "null"}) does not match failing run (${failingInputHash})`
+      );
+    }
+    passingVersion = passRow.service_version ?? passRow.candidate_agent_version ?? passRow.candidate_prompt_version ?? passingVersion;
+    passingCommitSha = passRow.commit_sha ?? passingCommitSha;
+  }
+  if (!failingVersion && !failingRow.commit_sha && !passingVersion && !passingCommitSha) {
+    throw new CounterfactualVerificationError(
+      "Counterfactual runs must record version, commit_sha, or candidate version lineage"
+    );
+  }
+  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  const proof = {
+    evalCaseId: input.evalCaseId,
+    inputPayloadHash: failingInputHash,
+    failingRunId: input.failingRunId,
+    failingVersion: failingVersion ?? null,
+    failingCommitSha: failingRow.commit_sha ?? null,
+    failureFingerprint: finding.fingerprint,
+    passingRunIds: uniquePassingIds,
+    passingVersion,
+    passingCommitSha,
+    requiredTrials,
+    verifiedAt: nowIso
+  };
+  const updatedChain = [
+    ...finding.causalChain,
+    {
+      subjectKind: "finding",
+      subjectId: finding.id,
+      predicate: "verified_by_counterfactual",
+      objectKind: "eval",
+      objectId: input.evalCaseId,
+      relationshipCertainty: "exact",
+      causalProofTier: "counterfactual_verified",
+      confidence: 0.99,
+      reason: `Paired counterfactual verified on evalCase ${input.evalCaseId}: run ${input.failingRunId} (${failingVersion ?? "baseline"}) failed with ${finding.fingerprint} and ${uniquePassingIds.join(", ")} (${passingVersion ?? "candidate"}) passed on payload ${failingInputHash}`
+    }
+  ];
+  const updatedBreakdown = {
+    ...finding.confidenceBreakdown,
+    counterfactualBonus: 0.25,
+    finalConfidence: 0.99
+  };
+  await db.prepare(
+    `UPDATE investigation_findings
+			 SET causal_proof_tier = 'counterfactual_verified',
+			     causal_verification_status = 'counterfactual_verified',
+			     confidence = 0.99,
+			     confidence_breakdown_json = ?,
+			     counterfactual_proof_json = ?,
+			     causal_chain_json = ?,
+			     updated_at = ?
+			 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(
+    JSON.stringify(updatedBreakdown),
+    JSON.stringify(proof),
+    JSON.stringify(updatedChain),
+    nowIso,
+    projectId,
+    finding.environment,
+    finding.id
+  ).run();
+  const updated = await getInvestigationFinding(
+    db,
+    projectId,
+    finding.id,
+    finding.environment
+  );
+  if (!updated) {
+    throw new Error(`Failed to reload finding ${finding.id}`);
+  }
+  return updated;
+}
+
+// src/lib/webhook-url.ts
+var WebhookUrlError = class extends Error {
+};
+var parseIpv4 = (host) => {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!m) return null;
+  const octets = m.slice(1).map((o) => Number.parseInt(o, 10));
+  return octets.every((o) => o <= 255) ? octets : null;
+};
+var isPrivateIpv4 = (o) => o[0] === 0 || // "this" network / unspecified
+o[0] === 10 || o[0] === 127 || o[0] === 100 && o[1] >= 64 && o[1] <= 127 || // CGNAT
+o[0] === 169 && o[1] === 254 || // link-local incl. cloud metadata
+o[0] === 172 && o[1] >= 16 && o[1] <= 31 || o[0] === 192 && o[1] === 168 || o[0] >= 224;
+var isPrivateIpv6 = (host) => {
+  const literal = host.replace(/^\[|\]$/g, "").toLowerCase();
+  if (literal === "::" || literal === "::1") return true;
+  const dotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(literal);
+  if (dotted) {
+    const v4 = parseIpv4(dotted[1]);
+    return v4 ? isPrivateIpv4(v4) : true;
+  }
+  const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(literal);
+  if (hex) {
+    const hi = Number.parseInt(hex[1], 16);
+    const lo = Number.parseInt(hex[2], 16);
+    return isPrivateIpv4([hi >> 8, hi & 255, lo >> 8, lo & 255]);
+  }
+  const first = Number.parseInt(literal.split(":")[0] || "0", 16);
+  if (Number.isNaN(first)) return true;
+  if ((first & 65024) === 64512) return true;
+  if ((first & 65472) === 65152) return true;
+  if ((first & 65280) === 65280) return true;
+  return false;
+};
+var isPrivateWebhookHost = (hostname) => {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  if (!host) return true;
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  if (host.endsWith(".local") || host.endsWith(".internal")) return true;
+  if (host.startsWith("[")) return isPrivateIpv6(host);
+  const v4 = parseIpv4(host);
+  if (v4) return isPrivateIpv4(v4);
+  return !host.includes(".");
+};
+var assertSafeWebhookUrl = (raw, options = {}) => {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new WebhookUrlError("channel.url must be an absolute http(s) URL");
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new WebhookUrlError("channel.url must be http(s)://");
+  }
+  if (url.username || url.password) {
+    throw new WebhookUrlError(
+      "channel.url must not embed credentials; use channel.headers"
+    );
+  }
+  if (!options.allowPrivateNetworks && isPrivateWebhookHost(url.hostname)) {
+    throw new WebhookUrlError(
+      `channel.url host "${url.hostname}" is not a public address (set ALERT_WEBHOOK_ALLOW_PRIVATE=true to allow internal receivers)`
+    );
+  }
+  return url;
+};
+var resolveWebhookHost = async (hostname, lookup) => {
+  if (parseIpv4(hostname) || hostname.startsWith("[")) return "public";
+  let addresses;
+  try {
+    addresses = await lookup(hostname);
+  } catch {
+    return "unresolvable";
+  }
+  if (addresses.length === 0) return "unresolvable";
+  const isPrivate = addresses.some((address) => {
+    const v4 = parseIpv4(address);
+    if (v4) return isPrivateIpv4(v4);
+    return isPrivateIpv6(`[${address}]`);
+  });
+  return isPrivate ? "private" : "public";
+};
+var redactWebhookUrl = (raw) => {
+  try {
+    const url = new URL(raw);
+    const hasPath = url.pathname !== "/" || url.search !== "";
+    return `${url.protocol}//${url.host}${hasPath ? "/\u2026" : ""}`;
+  } catch {
+    return "<invalid url>";
+  }
+};
+
+// src/lib/autosre-remediation-gate.ts
+var mapIncidentRow = (row) => ({
+  id: row.id,
+  projectId: row.project_id,
+  environment: row.environment,
+  dedupKey: row.dedup_key,
+  status: row.status,
+  targetNodeId: row.target_node_id,
+  symptomAnchorKind: row.symptom_anchor_kind,
+  symptomAnchorId: row.symptom_anchor_id,
+  symptomFingerprint: row.symptom_fingerprint,
+  alertCount: Number(row.alert_count ?? 1),
+  latestBundle: row.latest_bundle_json ? parseJsonRecord(row.latest_bundle_json) : null,
+  leaseOwnerId: row.lease_owner_id,
+  leaseExpiresAt: row.lease_expires_at,
+  dispatchAttempts: Number(row.dispatch_attempts ?? 0),
+  lastDispatchedAt: row.last_dispatched_at,
+  openedAt: row.opened_at,
+  updatedAt: row.updated_at,
+  resolvedAt: row.resolved_at,
+  expiresAt: row.expires_at
+});
+async function openOrDeduplicateIncident(db, projectId, input) {
+  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  const environment = (input.environment || "default").trim().toLowerCase();
+  const category = (input.symptomCategory ?? input.symptomFingerprint ?? `${input.symptomAnchorKind}:${input.symptomAnchorId}`).trim();
+  const dedupKey = await sha256Hex(
+    `${projectId}::${environment}::${input.targetNodeId}::${category}`
+  );
+  const existing = await db.prepare(
+    `SELECT * FROM incident_investigations
+			 WHERE project_id = ?
+			   AND environment = ?
+			   AND dedup_key = ?
+			   AND status IN ('open', 'dispatched', 'leased', 'remediating', 'verifying')
+			 ORDER BY opened_at DESC
+			 LIMIT 1`
+  ).bind(projectId, environment, dedupKey).first();
+  if (existing) {
+    await db.prepare(
+      `UPDATE incident_investigations
+				 SET alert_count = alert_count + 1,
+				     latest_bundle_json = COALESCE(?, latest_bundle_json),
+				     symptom_fingerprint = COALESCE(?, symptom_fingerprint),
+				     updated_at = ?
+				 WHERE project_id = ? AND environment = ? AND id = ?`
+    ).bind(
+      input.latestBundle ? JSON.stringify(input.latestBundle) : null,
+      input.symptomFingerprint ?? null,
+      nowIso,
+      projectId,
+      environment,
+      existing.id
+    ).run();
+    const updated = await getIncidentInvestigation(
+      db,
+      projectId,
+      existing.id,
+      environment
+    );
+    return {
+      incident: updated ?? mapIncidentRow(existing),
+      deduplicated: true
+    };
+  }
+  const id = input.id?.trim() || `inc_${randomHex(10)}`;
+  const expiresAt = new Date(
+    Date.now() + 30 * 24 * 36e5
+  ).toISOString();
+  await db.prepare(
+    `INSERT INTO incident_investigations (
+				project_id, environment, id, dedup_key, status, target_node_id,
+				symptom_anchor_kind, symptom_anchor_id, symptom_fingerprint,
+				alert_count, latest_bundle_json, dispatch_attempts,
+				opened_at, updated_at, expires_at
+			) VALUES (?, ?, ?, ?, 'open', ?, ?, ?, ?, 1, ?, 0, ?, ?, ?)`
+  ).bind(
+    projectId,
+    environment,
+    id,
+    dedupKey,
+    input.targetNodeId,
+    input.symptomAnchorKind,
+    input.symptomAnchorId,
+    input.symptomFingerprint ?? null,
+    input.latestBundle ? JSON.stringify(input.latestBundle) : null,
+    nowIso,
+    nowIso,
+    expiresAt
+  ).run();
+  const created = await getIncidentInvestigation(db, projectId, id, environment);
+  if (!created) {
+    throw new Error(`Failed to load created incident ${id}`);
+  }
+  return { incident: created, deduplicated: false };
+}
+async function getIncidentInvestigation(db, projectId, incidentId, environment) {
+  const row = environment ? await db.prepare(
+    `SELECT * FROM incident_investigations
+					 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, environment.toLowerCase(), incidentId).first() : await db.prepare(
+    `SELECT * FROM incident_investigations
+					 WHERE project_id = ? AND id = ?
+					 ORDER BY opened_at DESC
+					 LIMIT 1`
+  ).bind(projectId, incidentId).first();
+  return row ? mapIncidentRow(row) : null;
+}
+async function listIncidentInvestigations(db, options) {
+  const conditions = ["project_id = ?"];
+  const binds = [options.projectId];
+  if (options.environment) {
+    conditions.push("environment = ?");
+    binds.push(options.environment.toLowerCase());
+  }
+  if (options.status) {
+    conditions.push("status = ?");
+    binds.push(options.status);
+  }
+  const limit = Math.max(1, Math.min(100, options.limit ?? 50));
+  binds.push(limit);
+  const rows = await db.prepare(
+    `SELECT * FROM incident_investigations
+			 WHERE ${conditions.join(" AND ")}
+			 ORDER BY opened_at DESC
+			 LIMIT ?`
+  ).bind(...binds).all();
+  return rows.results.map(mapIncidentRow);
+}
+async function acquireIncidentLease(db, projectId, incidentId, input) {
+  const nowIso = input.nowIso ?? (/* @__PURE__ */ new Date()).toISOString();
+  const incident = await getIncidentInvestigation(
+    db,
+    projectId,
+    incidentId,
+    input.environment
+  );
+  if (!incident) {
+    return {
+      acquired: false,
+      reason: `Incident ${incidentId} not found`,
+      conflictOwnerId: null,
+      leaseExpiresAt: null
+    };
+  }
+  if (incident.leaseOwnerId && incident.leaseOwnerId !== input.runnerId && incident.leaseExpiresAt && incident.leaseExpiresAt > nowIso) {
+    return {
+      acquired: false,
+      reason: `Incident ${incidentId} is already leased by runner ${incident.leaseOwnerId} until ${incident.leaseExpiresAt}`,
+      conflictOwnerId: incident.leaseOwnerId,
+      leaseExpiresAt: incident.leaseExpiresAt
+    };
+  }
+  const durationSec = Math.max(
+    15,
+    Math.min(600, input.leaseDurationSeconds ?? 120)
+  );
+  const leaseExpiresAt = new Date(
+    Date.parse(nowIso) + durationSec * 1e3
+  ).toISOString();
+  const nextStatus = incident.status === "open" || incident.status === "dispatched" ? "leased" : incident.status;
+  await db.prepare(
+    `UPDATE incident_investigations
+			 SET lease_owner_id = ?,
+			     lease_expires_at = ?,
+			     status = ?,
+			     updated_at = ?
+			 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(
+    input.runnerId,
+    leaseExpiresAt,
+    nextStatus,
+    nowIso,
+    projectId,
+    incident.environment,
+    incident.id
+  ).run();
+  const updated = await getIncidentInvestigation(
+    db,
+    projectId,
+    incident.id,
+    incident.environment
+  );
+  return {
+    acquired: true,
+    incident: updated ?? {
+      ...incident,
+      leaseOwnerId: input.runnerId,
+      leaseExpiresAt,
+      status: nextStatus,
+      updatedAt: nowIso
+    }
+  };
+}
+async function computeHmacSha256Hex(secret, body) {
+  const enc = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(body));
+  const bytes = new Uint8Array(sig);
+  let hex = "";
+  for (const b of bytes) hex += b.toString(16).padStart(2, "0");
+  return hex;
+}
+async function dispatchIncidentWebhook(db, projectId, incidentId, webhook) {
+  const incident = await getIncidentInvestigation(db, projectId, incidentId);
+  if (!incident) {
+    return { delivered: false, error: "Incident not found" };
+  }
+  if (incident.dispatchAttempts >= 5) {
+    return { delivered: false, error: "MAX_DISPATCH_ATTEMPTS (5) exceeded" };
+  }
+  const safeUrl = assertSafeWebhookUrl(webhook.url, {
+    allowPrivateNetworks: webhook.allowPrivateNetworks
+  });
+  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  const body = JSON.stringify({
+    event: "autosre.incident.opened",
+    incidentId: incident.id,
+    projectId: incident.projectId,
+    environment: incident.environment,
+    targetNodeId: incident.targetNodeId,
+    dedupKey: incident.dedupKey,
+    symptomAnchor: {
+      kind: incident.symptomAnchorKind,
+      id: incident.symptomAnchorId
+    },
+    bundle: incident.latestBundle,
+    dispatchedAt: nowIso
+  });
+  const headers = {
+    "Content-Type": "application/json",
+    "X-Obs-Incident-Id": incident.id,
+    "X-Obs-Deduplication-Key": incident.dedupKey
+  };
+  if (webhook.secret) {
+    const hmac = await computeHmacSha256Hex(webhook.secret, body);
+    headers["X-Obs-Signature-256"] = `sha256=${hmac}`;
+  }
+  const fetchFn = webhook.fetchImpl ?? fetch;
+  let delivered = false;
+  let status;
+  let errorMsg;
+  try {
+    const res = await fetchFn(safeUrl.toString(), {
+      method: "POST",
+      headers,
+      body
+    });
+    status = res.status;
+    delivered = res.ok;
+    if (!res.ok) {
+      errorMsg = `HTTP ${res.status}`;
+    }
+  } catch (err) {
+    errorMsg = err instanceof Error ? err.message : String(err);
+  }
+  await db.prepare(
+    `UPDATE incident_investigations
+			 SET dispatch_attempts = dispatch_attempts + 1,
+			     last_dispatched_at = ?,
+			     status = CASE WHEN ? = 1 AND status = 'open' THEN 'dispatched' ELSE status END,
+			     updated_at = ?
+			 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(
+    nowIso,
+    delivered ? 1 : 0,
+    nowIso,
+    projectId,
+    incident.environment,
+    incident.id
+  ).run();
+  return { delivered, status, error: errorMsg };
+}
+var mapProposalRow = (row, grantToken) => ({
+  id: row.id,
+  projectId: row.project_id,
+  environment: row.environment,
+  incidentId: row.incident_id,
+  findingId: row.finding_id,
+  idempotencyKey: row.idempotency_key,
+  actionKind: row.action_kind,
+  targetNodeId: row.target_node_id,
+  expectedCurrentState: parseJsonRecord(
+    row.expected_current_state_json
+  ),
+  desiredTargetState: parseJsonRecord(
+    row.desired_target_state_json
+  ),
+  requestedAutonomy: row.requested_autonomy,
+  effectiveAutonomy: row.effective_autonomy,
+  policyDecisionReason: row.policy_decision_reason,
+  status: row.status,
+  grantExpiresAt: row.grant_expires_at,
+  approvedByUserId: row.approved_by_user_id,
+  approvedAt: row.approved_at,
+  claimedByRunnerId: row.claimed_by_runner_id,
+  claimedAt: row.claimed_at,
+  claimExpiresAt: row.claim_expires_at,
+  remediationAgentRunId: row.remediation_agent_run_id,
+  resultingChangeId: row.resulting_change_id,
+  failureReason: row.failure_reason,
+  createdAt: row.created_at,
+  updatedAt: row.updated_at,
+  expiresAt: row.expires_at,
+  ...grantToken ? { grantToken } : {}
+});
+function evaluateActionPolicyMatrix(actionKind, causalProofTier, recentProposalsLastHour) {
+  if (recentProposalsLastHour >= 3) {
+    return {
+      effectiveAutonomy: AgentAutonomyLevel.BlockedByPolicy,
+      reason: `Circuit breaker tripped: ${recentProposalsLastHour} remediation proposals already recorded in the last hour for this target/fingerprint (max 3/hr)`
+    };
+  }
+  switch (actionKind) {
+    case "open_code_pr": {
+      if (causalProofTier === "counterfactual_verified" || causalProofTier === "cohort_rate_isolated" || causalProofTier === "corroborated_candidate") {
+        return {
+          effectiveAutonomy: AgentAutonomyLevel.AutonomousWrite,
+          reason: `Non-merging PR creation permitted as autonomous_write for causalProofTier=${causalProofTier}`
+        };
+      }
+      return {
+        effectiveAutonomy: AgentAutonomyLevel.HumanApprovedWrite,
+        reason: `open_code_pr requires human_approved_write when causalProofTier=${causalProofTier}`
+      };
+    }
+    case "toggle_feature_flag":
+    case "rollback_deploy": {
+      if (causalProofTier === "counterfactual_verified" || causalProofTier === "cohort_rate_isolated") {
+        return {
+          effectiveAutonomy: AgentAutonomyLevel.AutonomousWrite,
+          reason: `${actionKind} authorized as autonomous_write with causalProofTier=${causalProofTier}`
+        };
+      }
+      if (causalProofTier === "corroborated_candidate") {
+        return {
+          effectiveAutonomy: AgentAutonomyLevel.HumanApprovedWrite,
+          reason: `${actionKind} with causalProofTier=corroborated_candidate (structural overlap or sequential cutover without concurrent cohort isolation) requires human_approved_write`
+        };
+      }
+      return {
+        effectiveAutonomy: AgentAutonomyLevel.BlockedByPolicy,
+        reason: `${actionKind} blocked_by_policy: causalProofTier=${causalProofTier} (unverified fault locus cannot authorize production ${actionKind})`
+      };
+    }
+    case "apply_config":
+    case "promote_agent_prompt": {
+      if (causalProofTier === "counterfactual_verified") {
+        return {
+          effectiveAutonomy: AgentAutonomyLevel.AutonomousWrite,
+          reason: `${actionKind} authorized as autonomous_write with counterfactual_verified proof`
+        };
+      }
+      if (causalProofTier === "cohort_rate_isolated" || causalProofTier === "corroborated_candidate") {
+        return {
+          effectiveAutonomy: AgentAutonomyLevel.HumanApprovedWrite,
+          reason: `${actionKind} requires counterfactual_verified for autonomous_write; parked for human_approved_write (tier=${causalProofTier})`
+        };
+      }
+      return {
+        effectiveAutonomy: AgentAutonomyLevel.BlockedByPolicy,
+        reason: `${actionKind} blocked_by_policy: causalProofTier=${causalProofTier}`
+      };
+    }
+  }
+}
+var RemediationGateError = class extends Error {
+  constructor(message, statusCode = 400) {
+    super(message);
+    this.statusCode = statusCode;
+    this.name = "RemediationGateError";
+  }
+};
+async function proposeRemediationAction(db, projectId, input) {
+  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  const environment = (input.environment || "default").trim().toLowerCase();
+  const existing = await db.prepare(
+    `SELECT * FROM remediation_proposals
+			 WHERE project_id = ? AND environment = ? AND idempotency_key = ?`
+  ).bind(projectId, environment, input.idempotencyKey).first();
+  if (existing) {
+    if (existing.action_kind !== input.actionKind || existing.target_node_id !== input.targetNodeId) {
+      throw new RemediationGateError(
+        `Idempotency key ${input.idempotencyKey} already used for a different action or target node`,
+        409
+      );
+    }
+    return mapProposalRow(existing);
+  }
+  const finding = await getInvestigationFinding(
+    db,
+    projectId,
+    input.findingId,
+    environment
+  );
+  if (!finding) {
+    throw new RemediationGateError(
+      `Finding ${input.findingId} not found in environment ${environment}`,
+      404
+    );
+  }
+  const oneHourAgo = new Date(Date.now() - 36e5).toISOString();
+  const recentCountRow = await db.prepare(
+    `SELECT COUNT(*) AS cnt FROM remediation_proposals
+			 WHERE project_id = ?
+			   AND environment = ?
+			   AND target_node_id = ?
+			   AND created_at >= ?`
+  ).bind(projectId, environment, input.targetNodeId, oneHourAgo).first();
+  const recentCount = Number(recentCountRow?.cnt ?? 0);
+  const requestedAutonomy = input.requestedAutonomy ?? AgentAutonomyLevel.AutonomousWrite;
+  const policy = evaluateActionPolicyMatrix(
+    input.actionKind,
+    finding.causalProofTier,
+    recentCount
+  );
+  let effectiveAutonomy = policy.effectiveAutonomy;
+  let policyReason = policy.reason;
+  if (requestedAutonomy === AgentAutonomyLevel.HumanApprovedWrite && effectiveAutonomy === AgentAutonomyLevel.AutonomousWrite) {
+    effectiveAutonomy = AgentAutonomyLevel.HumanApprovedWrite;
+    policyReason = `Caller explicitly requested human_approved_write (${policy.reason})`;
+  }
+  let status = "pending_human_approval";
+  let grantToken;
+  let grantTokenHash = null;
+  let grantExpiresAt = null;
+  if (effectiveAutonomy === AgentAutonomyLevel.AutonomousWrite) {
+    status = "grant_issued";
+    grantToken = `rgt_${randomHex(16)}`;
+    grantTokenHash = await sha256Hex(grantToken);
+    grantExpiresAt = new Date(Date.now() + 5 * 6e4).toISOString();
+  } else if (effectiveAutonomy === AgentAutonomyLevel.BlockedByPolicy) {
+    status = "rejected";
+  }
+  const id = `rem_${randomHex(10)}`;
+  const expiresAt = new Date(
+    Date.now() + 30 * 24 * 36e5
+  ).toISOString();
+  await db.prepare(
+    `INSERT INTO remediation_proposals (
+				project_id, environment, id, incident_id, finding_id,
+				idempotency_key, action_kind, target_node_id,
+				expected_current_state_json, desired_target_state_json,
+				requested_autonomy, effective_autonomy, policy_decision_reason,
+				status, grant_token_hash, grant_expires_at,
+				created_at, updated_at, expires_at
+			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  ).bind(
+    projectId,
+    environment,
+    id,
+    input.incidentId,
+    input.findingId,
+    input.idempotencyKey,
+    input.actionKind,
+    input.targetNodeId,
+    JSON.stringify(input.expectedCurrentState),
+    JSON.stringify(input.desiredTargetState),
+    requestedAutonomy,
+    effectiveAutonomy,
+    policyReason,
+    status,
+    grantTokenHash,
+    grantExpiresAt,
+    nowIso,
+    nowIso,
+    expiresAt
+  ).run();
+  const created = await db.prepare(
+    `SELECT * FROM remediation_proposals
+			 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, environment, id).first();
+  if (!created) {
+    throw new Error(`Failed to load created remediation proposal ${id}`);
+  }
+  return mapProposalRow(created, grantToken);
+}
+async function getRemediationProposal(db, projectId, proposalId, environment) {
+  const row = environment ? await db.prepare(
+    `SELECT * FROM remediation_proposals
+					 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, environment.toLowerCase(), proposalId).first() : await db.prepare(
+    `SELECT * FROM remediation_proposals
+					 WHERE project_id = ? AND id = ?
+					 ORDER BY created_at DESC
+					 LIMIT 1`
+  ).bind(projectId, proposalId).first();
+  return row ? mapProposalRow(row) : null;
+}
+async function listRemediationProposals(db, options) {
+  const conditions = ["project_id = ?"];
+  const binds = [options.projectId];
+  if (options.environment) {
+    conditions.push("environment = ?");
+    binds.push(options.environment.toLowerCase());
+  }
+  if (options.status) {
+    conditions.push("status = ?");
+    binds.push(options.status);
+  }
+  if (options.incidentId) {
+    conditions.push("incident_id = ?");
+    binds.push(options.incidentId);
+  }
+  if (options.findingId) {
+    conditions.push("finding_id = ?");
+    binds.push(options.findingId);
+  }
+  const limit = Math.max(1, Math.min(100, options.limit ?? 50));
+  binds.push(limit);
+  const rows = await db.prepare(
+    `SELECT * FROM remediation_proposals
+			 WHERE ${conditions.join(" AND ")}
+			 ORDER BY created_at DESC
+			 LIMIT ?`
+  ).bind(...binds).all();
+  return rows.results.map((r) => mapProposalRow(r));
+}
+async function approveRemediationProposal(db, projectId, proposalId, options) {
+  const row = options.environment ? await db.prepare(
+    `SELECT * FROM remediation_proposals
+					 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, options.environment.toLowerCase(), proposalId).first() : await db.prepare(
+    `SELECT * FROM remediation_proposals
+					 WHERE project_id = ? AND id = ?
+					 LIMIT 1`
+  ).bind(projectId, proposalId).first();
+  if (!row) {
+    throw new RemediationGateError(`Proposal ${proposalId} not found`, 404);
+  }
+  if (row.status !== "pending_human_approval") {
+    throw new RemediationGateError(
+      `Proposal ${proposalId} cannot be approved from status=${row.status}`,
+      409
+    );
+  }
+  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  const grantToken = `rgt_${randomHex(16)}`;
+  const grantTokenHash = await sha256Hex(grantToken);
+  const grantExpiresAt = new Date(Date.now() + 5 * 6e4).toISOString();
+  await db.prepare(
+    `UPDATE remediation_proposals
+			 SET status = 'grant_issued',
+			     grant_token_hash = ?,
+			     grant_expires_at = ?,
+			     approved_by_user_id = ?,
+			     approved_at = ?,
+			     updated_at = ?
+			 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(
+    grantTokenHash,
+    grantExpiresAt,
+    options.approvedByUserId,
+    nowIso,
+    nowIso,
+    projectId,
+    row.environment,
+    row.id
+  ).run();
+  const updated = await db.prepare(
+    `SELECT * FROM remediation_proposals
+			 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, row.environment, row.id).first();
+  return mapProposalRow(updated ?? row, grantToken);
+}
+async function rejectRemediationProposal(db, projectId, proposalId, options) {
+  const row = options.environment ? await db.prepare(
+    `SELECT * FROM remediation_proposals
+					 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, options.environment.toLowerCase(), proposalId).first() : await db.prepare(
+    `SELECT * FROM remediation_proposals
+					 WHERE project_id = ? AND id = ?
+					 LIMIT 1`
+  ).bind(projectId, proposalId).first();
+  if (!row) {
+    throw new RemediationGateError(`Proposal ${proposalId} not found`, 404);
+  }
+  if (row.status !== "pending_human_approval" && row.status !== "grant_issued") {
+    throw new RemediationGateError(
+      `Proposal ${proposalId} cannot be rejected from status=${row.status}`,
+      409
+    );
+  }
+  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  const reason = options.reason ? `Rejected by ${options.rejectedByUserId}: ${options.reason}` : `Rejected by ${options.rejectedByUserId}`;
+  await db.prepare(
+    `UPDATE remediation_proposals
+			 SET status = 'rejected',
+			     grant_token_hash = NULL,
+			     failure_reason = ?,
+			     updated_at = ?
+			 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(reason, nowIso, projectId, row.environment, row.id).run();
+  const updated = await db.prepare(
+    `SELECT * FROM remediation_proposals
+			 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, row.environment, row.id).first();
+  return mapProposalRow(updated ?? row);
+}
+async function claimRemediationGrant(db, projectId, proposalId, options) {
+  const nowIso = options.nowIso ?? (/* @__PURE__ */ new Date()).toISOString();
+  const row = options.environment ? await db.prepare(
+    `SELECT * FROM remediation_proposals
+					 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, options.environment.toLowerCase(), proposalId).first() : await db.prepare(
+    `SELECT * FROM remediation_proposals
+					 WHERE project_id = ? AND id = ?
+					 LIMIT 1`
+  ).bind(projectId, proposalId).first();
+  if (!row) {
+    throw new RemediationGateError(`Proposal ${proposalId} not found`, 404);
+  }
+  if (row.status !== "grant_issued") {
+    throw new RemediationGateError(
+      `Grant cannot be claimed from status=${row.status} (grants are single-use)`,
+      409
+    );
+  }
+  if (row.grant_expires_at && row.grant_expires_at <= nowIso) {
+    await db.prepare(
+      `UPDATE remediation_proposals
+				 SET status = 'expired', updated_at = ?
+				 WHERE project_id = ? AND environment = ? AND id = ?`
+    ).bind(nowIso, projectId, row.environment, row.id).run();
+    throw new RemediationGateError(
+      `Grant for proposal ${proposalId} expired at ${row.grant_expires_at}`,
+      410
+    );
+  }
+  const incomingHash = await sha256Hex(options.grantToken);
+  if (!row.grant_token_hash || incomingHash !== row.grant_token_hash) {
+    throw new RemediationGateError("Invalid grantToken", 403);
+  }
+  const expected = parseJsonRecord(
+    row.expected_current_state_json
+  );
+  const targetNode = await db.prepare(
+    `SELECT current_version, current_commit_sha, current_config_digest
+			 FROM ontology_nodes
+			 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, row.environment, row.target_node_id).first();
+  if (targetNode) {
+    if (expected.version && targetNode.current_version && targetNode.current_version !== expected.version) {
+      throw new RemediationGateError(
+        `Optimistic version lock failed on ${row.target_node_id}: expected version "${expected.version}", but current version is "${targetNode.current_version}"`,
+        409
+      );
+    }
+    if (expected.commitSha && targetNode.current_commit_sha && targetNode.current_commit_sha !== expected.commitSha) {
+      throw new RemediationGateError(
+        `Optimistic commit lock failed on ${row.target_node_id}: expected commit "${expected.commitSha}", but current commit is "${targetNode.current_commit_sha}"`,
+        409
+      );
+    }
+    if (expected.configDigest && targetNode.current_config_digest && targetNode.current_config_digest !== expected.configDigest) {
+      throw new RemediationGateError(
+        `Optimistic config lock failed on ${row.target_node_id}: expected digest "${expected.configDigest}", but current digest is "${targetNode.current_config_digest}"`,
+        409
+      );
+    }
+  }
+  const claimExpiresAt = new Date(
+    Date.parse(nowIso) + 5 * 6e4
+  ).toISOString();
+  await db.batch([
+    db.prepare(
+      `UPDATE remediation_proposals
+				 SET status = 'claimed_executing',
+				     grant_token_hash = NULL,
+				     claimed_by_runner_id = ?,
+				     claimed_at = ?,
+				     claim_expires_at = ?,
+				     updated_at = ?
+				 WHERE project_id = ? AND environment = ? AND id = ?`
+    ).bind(
+      options.runnerId ?? "autosre-runner",
+      nowIso,
+      claimExpiresAt,
+      nowIso,
+      projectId,
+      row.environment,
+      row.id
+    ),
+    db.prepare(
+      `UPDATE incident_investigations
+				 SET status = 'remediating', updated_at = ?
+				 WHERE project_id = ? AND environment = ? AND id = ?`
+    ).bind(nowIso, projectId, row.environment, row.incident_id)
+  ]);
+  const updated = await db.prepare(
+    `SELECT * FROM remediation_proposals
+			 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, row.environment, row.id).first();
+  return mapProposalRow(updated ?? row);
+}
+async function completeRemediationProposal(db, projectId, proposalId, options) {
+  const nowIso = options.nowIso ?? (/* @__PURE__ */ new Date()).toISOString();
+  const row = options.environment ? await db.prepare(
+    `SELECT * FROM remediation_proposals
+					 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, options.environment.toLowerCase(), proposalId).first() : await db.prepare(
+    `SELECT * FROM remediation_proposals
+					 WHERE project_id = ? AND id = ?
+					 LIMIT 1`
+  ).bind(projectId, proposalId).first();
+  if (!row) {
+    throw new RemediationGateError(`Proposal ${proposalId} not found`, 404);
+  }
+  if (row.status !== "claimed_executing") {
+    throw new RemediationGateError(
+      `Proposal ${proposalId} cannot be completed from status=${row.status} (must be claimed_executing)`,
+      409
+    );
+  }
+  const desired = parseJsonRecord(
+    row.desired_target_state_json
+  );
+  const nextWatchdogAt = new Date(
+    Date.parse(nowIso) + 2 * 6e4
+  ).toISOString();
+  const finding = await getInvestigationFinding(
+    db,
+    projectId,
+    row.finding_id,
+    row.environment
+  );
+  const updatedChain = finding ? [...finding.causalChain] : [];
+  if (options.resultingChangeId) {
+    updatedChain.push({
+      subjectKind: "finding",
+      subjectId: row.finding_id,
+      predicate: "mitigated_by_change",
+      objectKind: "change",
+      objectId: options.resultingChangeId,
+      relationshipCertainty: "exact",
+      causalProofTier: finding?.causalProofTier ?? "cohort_rate_isolated",
+      confidence: 0.9,
+      reason: `Remediation proposal ${row.id} (${row.action_kind}) applied change ${options.resultingChangeId}`
+    });
+  }
+  if (options.remediationAgentRunId) {
+    updatedChain.push({
+      subjectKind: "finding",
+      subjectId: row.finding_id,
+      predicate: "remediated_by_agent_run",
+      objectKind: "agent_run",
+      objectId: options.remediationAgentRunId,
+      relationshipCertainty: "exact",
+      causalProofTier: finding?.causalProofTier ?? "cohort_rate_isolated",
+      confidence: 0.9,
+      reason: `Remediation executed by agent run ${options.remediationAgentRunId}`
+    });
+  }
+  await db.batch([
+    db.prepare(
+      `UPDATE remediation_proposals
+				 SET status = 'completed',
+				     resulting_change_id = COALESCE(?, resulting_change_id),
+				     remediation_agent_run_id = COALESCE(?, remediation_agent_run_id),
+				     updated_at = ?
+				 WHERE project_id = ? AND environment = ? AND id = ?`
+    ).bind(
+      options.resultingChangeId ?? null,
+      options.remediationAgentRunId ?? null,
+      nowIso,
+      projectId,
+      row.environment,
+      row.id
+    ),
+    db.prepare(
+      `UPDATE ontology_nodes
+				 SET current_version = COALESCE(?, current_version),
+				     current_commit_sha = COALESCE(?, current_commit_sha),
+				     current_config_digest = COALESCE(?, current_config_digest),
+				     last_seen_at = ?
+				 WHERE project_id = ? AND environment = ? AND id = ?`
+    ).bind(
+      desired.version ?? null,
+      desired.commitSha ?? null,
+      desired.configDigest ?? null,
+      nowIso,
+      projectId,
+      row.environment,
+      row.target_node_id
+    ),
+    db.prepare(
+      `UPDATE investigation_findings
+				 SET recovery_status = 'monitoring',
+				     watchdog_step = 1,
+				     baseline_request_rate_per_min = COALESCE(?, baseline_request_rate_per_min),
+				     next_watchdog_check_at = ?,
+				     causal_chain_json = ?,
+				     updated_at = ?
+				 WHERE project_id = ? AND environment = ? AND id = ?`
+    ).bind(
+      options.baselineRequestRatePerMin ?? null,
+      nextWatchdogAt,
+      JSON.stringify(updatedChain),
+      nowIso,
+      projectId,
+      row.environment,
+      row.finding_id
+    ),
+    db.prepare(
+      `UPDATE incident_investigations
+				 SET status = 'verifying', updated_at = ?
+				 WHERE project_id = ? AND environment = ? AND id = ?`
+    ).bind(nowIso, projectId, row.environment, row.incident_id)
+  ]);
+  const updated = await db.prepare(
+    `SELECT * FROM remediation_proposals
+			 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, row.environment, row.id).first();
+  return mapProposalRow(updated ?? row);
+}
+async function failRemediationProposal(db, projectId, proposalId, options) {
+  const nowIso = options.nowIso ?? (/* @__PURE__ */ new Date()).toISOString();
+  const row = options.environment ? await db.prepare(
+    `SELECT * FROM remediation_proposals
+					 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, options.environment.toLowerCase(), proposalId).first() : await db.prepare(
+    `SELECT * FROM remediation_proposals
+					 WHERE project_id = ? AND id = ?
+					 LIMIT 1`
+  ).bind(projectId, proposalId).first();
+  if (!row) {
+    throw new RemediationGateError(`Proposal ${proposalId} not found`, 404);
+  }
+  await db.batch([
+    db.prepare(
+      `UPDATE remediation_proposals
+				 SET status = 'failed_execution',
+				     failure_reason = ?,
+				     updated_at = ?
+				 WHERE project_id = ? AND environment = ? AND id = ?`
+    ).bind(options.failureReason, nowIso, projectId, row.environment, row.id),
+    db.prepare(
+      `UPDATE incident_investigations
+				 SET status = 'escalated', updated_at = ?
+				 WHERE project_id = ? AND environment = ? AND id = ?`
+    ).bind(nowIso, projectId, row.environment, row.incident_id)
+  ]);
+  const updated = await db.prepare(
+    `SELECT * FROM remediation_proposals
+			 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, row.environment, row.id).first();
+  return mapProposalRow(updated ?? row);
+}
+async function evaluateRemediationWatchdogs(db, options = {}) {
+  const nowIso = options.nowIso ?? (/* @__PURE__ */ new Date()).toISOString();
+  const minComparableRequests = options.minComparableRequests ?? 50;
+  const expiredGrantsRes = await db.prepare(
+    `UPDATE remediation_proposals
+			 SET status = 'expired', grant_token_hash = NULL, updated_at = ?
+			 WHERE status = 'grant_issued'
+			   AND grant_expires_at IS NOT NULL
+			   AND grant_expires_at <= ?`
+  ).bind(nowIso, nowIso).run();
+  const timedOutRows = await db.prepare(
+    `SELECT project_id, environment, id, incident_id
+			 FROM remediation_proposals
+			 WHERE status = 'claimed_executing'
+			   AND claim_expires_at IS NOT NULL
+			   AND claim_expires_at <= ?`
+  ).bind(nowIso).all();
+  for (const t of timedOutRows.results) {
+    await db.batch([
+      db.prepare(
+        `UPDATE remediation_proposals
+					 SET status = 'execution_timed_out',
+					     failure_reason = 'Runner did not complete or fail within 5m claim window',
+					     updated_at = ?
+					 WHERE project_id = ? AND environment = ? AND id = ?`
+      ).bind(nowIso, t.project_id, t.environment, t.id),
+      db.prepare(
+        `UPDATE incident_investigations
+					 SET status = 'escalated', updated_at = ?
+					 WHERE project_id = ? AND environment = ? AND id = ?`
+      ).bind(nowIso, t.project_id, t.environment, t.incident_id)
+    ]);
+  }
+  const dueFindings = await db.prepare(
+    `SELECT
+				project_id, environment, id, incident_id,
+				fault_locus_entity_id, root_cause_entity_id,
+				watchdog_step, baseline_request_rate_per_min,
+				causal_verification_status, updated_at
+			 FROM investigation_findings
+			 WHERE recovery_status = 'monitoring'
+			   AND next_watchdog_check_at IS NOT NULL
+			   AND next_watchdog_check_at <= ?
+			 LIMIT 50`
+  ).bind(nowIso).all();
+  let recovered = 0;
+  let inconclusiveLowTraffic = 0;
+  let stillDegraded = 0;
+  for (const f of dueFindings.results) {
+    const completedProposal = await db.prepare(
+      `SELECT
+					p.updated_at,
+					p.target_node_id,
+					p.resulting_change_id,
+					c.occurred_at AS change_occurred_at
+				 FROM remediation_proposals p
+				 LEFT JOIN change_events c
+				   ON c.project_id = p.project_id
+				  AND c.environment = p.environment
+				  AND c.id = p.resulting_change_id
+				 WHERE p.project_id = ? AND p.environment = ? AND p.finding_id = ? AND p.status = 'completed'
+				 ORDER BY p.updated_at DESC
+				 LIMIT 1`
+    ).bind(f.project_id, f.environment, f.id).first();
+    const sinceTs = completedProposal?.change_occurred_at ?? completedProposal?.updated_at ?? f.updated_at;
+    const targetNodeId = completedProposal?.target_node_id ?? f.fault_locus_entity_id;
+    const parts = targetNodeId.split(":");
+    const serviceName = parts[0] === "service" && parts.length >= 4 ? parts.slice(3).join(":") : null;
+    const stats = serviceName ? await db.prepare(
+      `SELECT
+							COUNT(*) AS total_requests,
+							SUM(CASE WHEN status_code = 2 THEN 1 ELSE 0 END) AS error_requests
+						 FROM telemetry_spans
+						 WHERE project_id = ?
+						   AND environment = ?
+						   AND service_name = ?
+						   AND (parent_span_id IS NULL OR span_kind = 1)
+						   AND (start_time >= ? OR received_at >= ?)`
+    ).bind(f.project_id, f.environment, serviceName, sinceTs, sinceTs).first() : await db.prepare(
+      `SELECT
+							COUNT(*) AS total_requests,
+							SUM(CASE WHEN status_code = 2 THEN 1 ELSE 0 END) AS error_requests
+						 FROM telemetry_spans
+						 WHERE project_id = ?
+						   AND environment = ?
+						   AND (parent_span_id IS NULL OR span_kind = 1)
+						   AND (start_time >= ? OR received_at >= ?)`
+    ).bind(f.project_id, f.environment, sinceTs, sinceTs).first();
+    const totalReq = Number(stats?.total_requests ?? 0);
+    const errorReq = Number(stats?.error_requests ?? 0);
+    const errorRate = totalReq > 0 ? errorReq / totalReq : 0;
+    const requiredTraffic = Math.max(
+      minComparableRequests,
+      f.baseline_request_rate_per_min ? Math.floor(0.5 * f.baseline_request_rate_per_min * 5) : minComparableRequests
+    );
+    if (totalReq < requiredTraffic) {
+      if (f.watchdog_step < 3) {
+        const nextStep = f.watchdog_step + 1;
+        const offsetMins = nextStep === 2 ? 5 : 15;
+        const nextCheck = new Date(
+          Date.parse(nowIso) + offsetMins * 6e4
+        ).toISOString();
+        await db.prepare(
+          `UPDATE investigation_findings
+						 SET watchdog_step = ?, next_watchdog_check_at = ?, updated_at = ?
+						 WHERE project_id = ? AND environment = ? AND id = ?`
+        ).bind(nextStep, nextCheck, nowIso, f.project_id, f.environment, f.id).run();
+      } else {
+        inconclusiveLowTraffic += 1;
+        await db.prepare(
+          `UPDATE investigation_findings
+						 SET recovery_status = 'inconclusive_low_traffic',
+						     next_watchdog_check_at = NULL,
+						     updated_at = ?
+						 WHERE project_id = ? AND environment = ? AND id = ?`
+        ).bind(nowIso, f.project_id, f.environment, f.id).run();
+      }
+      continue;
+    }
+    if (errorRate >= 0.05) {
+      stillDegraded += 1;
+      await db.prepare(
+        `UPDATE investigation_findings
+					 SET recovery_status = 'still_degraded',
+					     causal_verification_status = 'refuted',
+					     next_watchdog_check_at = NULL,
+					     updated_at = ?
+					 WHERE project_id = ? AND environment = ? AND id = ?`
+      ).bind(nowIso, f.project_id, f.environment, f.id).run();
+      if (f.incident_id) {
+        await db.prepare(
+          `UPDATE incident_investigations
+						 SET status = 'escalated', updated_at = ?
+						 WHERE project_id = ? AND environment = ? AND id = ?`
+        ).bind(nowIso, f.project_id, f.environment, f.incident_id).run();
+      }
+    } else {
+      recovered += 1;
+      const nextCausalVerification = f.causal_verification_status === "counterfactual_verified" ? "counterfactual_verified" : "operationally_corroborated";
+      await db.prepare(
+        `UPDATE investigation_findings
+					 SET recovery_status = 'recovered',
+					     causal_verification_status = ?,
+					     watchdog_step = 3,
+					     next_watchdog_check_at = NULL,
+					     updated_at = ?
+					 WHERE project_id = ? AND environment = ? AND id = ?`
+      ).bind(
+        nextCausalVerification,
+        nowIso,
+        f.project_id,
+        f.environment,
+        f.id
+      ).run();
+      if (f.incident_id) {
+        await db.prepare(
+          `UPDATE incident_investigations
+						 SET status = 'resolved', resolved_at = ?, updated_at = ?
+						 WHERE project_id = ? AND environment = ? AND id = ?`
+        ).bind(nowIso, nowIso, f.project_id, f.environment, f.incident_id).run();
+      }
+    }
+  }
+  return {
+    evaluated: dueFindings.results.length,
+    recovered,
+    inconclusiveLowTraffic,
+    stillDegraded,
+    timedOutClaims: timedOutRows.results.length,
+    expiredGrants: expiredGrantsRes.meta.changes
+  };
+}
+
 // src/lib/narrate-gate.ts
 var COMPARATORS = ["<=", ">=", "==", "!=", "<", ">"];
 var stripWhitespace = (s) => s.replace(/\s+/g, "");
@@ -2855,6 +4418,14 @@ async function runDueAnalysesForProject(projectId, deps) {
               if (result.narrative) narrated += 1;
             }
             await store.insertResult(result, expiresAt);
+            if (result.status === "critical") {
+              await openOrDeduplicateIncident(db, projectId, {
+                environment: "default",
+                targetNodeId: `analysis:${def.id}`,
+                symptomAnchorKind: "analysis",
+                symptomAnchorId: def.id
+              }).catch(() => void 0);
+            }
             await store.markRan(projectId, def.id, result.generatedAt);
             ran += 1;
           } catch (error) {
@@ -2880,6 +4451,7 @@ var changes = (r) => r.meta?.changes ?? 0;
 async function purgeSecondaryRows(db, options) {
   const nowMs = options.now?.() ?? Date.now();
   const isoBefore = (hours) => new Date(nowMs - hours * 36e5).toISOString();
+  const nowIso = isoBefore(0);
   const alertEvaluations = await db.prepare(`DELETE FROM alert_evaluations WHERE evaluated_at < ?`).bind(isoBefore(ALERT_EVALUATIONS_MAX_AGE_HOURS)).run();
   const askEvents = await db.prepare(`DELETE FROM ask_evidence_events WHERE asked_at < ?`).bind(nowMs - ASK_EVIDENCE_EVENTS_MAX_AGE_HOURS * 36e5).run();
   const series = await db.prepare(
@@ -2892,7 +4464,7 @@ async function purgeSecondaryRows(db, options) {
   const refs = await db.prepare(
     `DELETE FROM evidence_retrieval_refs
 			 WHERE expires_at IS NOT NULL AND expires_at < ?`
-  ).bind(isoBefore(0)).run();
+  ).bind(nowIso).run();
   const expansions = await db.prepare(
     `DELETE FROM evidence_ref_expansions
 			 WHERE NOT EXISTS (
@@ -2900,12 +4472,75 @@ async function purgeSecondaryRows(db, options) {
 			   WHERE r.ref_id = evidence_ref_expansions.ref_id
 			 )`
   ).run();
+  const thirtyDaysAgoIso = isoBefore(30 * 24);
+  const ninetyDaysAgoIso = isoBefore(90 * 24);
+  let ontologyEdgesPurged = 0;
+  let ontologyNodesPurged = 0;
+  let changeEventsPurged = 0;
+  let incidentInvestigationsPurged = 0;
+  let investigationFindingsPurged = 0;
+  let remediationProposalsPurged = 0;
+  try {
+    const edgesRes = await db.prepare(`DELETE FROM ontology_edges WHERE last_seen_at < ?`).bind(thirtyDaysAgoIso).run();
+    ontologyEdgesPurged = changes(edgesRes);
+    const nodesRes = await db.prepare(
+      `DELETE FROM ontology_nodes
+				 WHERE last_seen_at < ?
+				   AND NOT EXISTS (
+				     SELECT 1 FROM ontology_edges e
+				     WHERE e.project_id = ontology_nodes.project_id
+				       AND e.environment = ontology_nodes.environment
+				       AND (e.source_node_id = ontology_nodes.id OR e.target_node_id = ontology_nodes.id)
+				   )`
+    ).bind(thirtyDaysAgoIso).run();
+    ontologyNodesPurged = changes(nodesRes);
+    const proposalsRes = await db.prepare(
+      `DELETE FROM remediation_proposals
+				 WHERE (expires_at IS NOT NULL AND expires_at < ?)
+				    OR (expires_at IS NULL AND created_at < ?)`
+    ).bind(nowIso, ninetyDaysAgoIso).run();
+    remediationProposalsPurged = changes(proposalsRes);
+    const findingsRes = await db.prepare(
+      `DELETE FROM investigation_findings
+				 WHERE causal_verification_status NOT IN ('counterfactual_verified', 'operationally_corroborated')
+				   AND ((expires_at IS NOT NULL AND expires_at < ?)
+				     OR (expires_at IS NULL AND created_at < ?))`
+    ).bind(nowIso, ninetyDaysAgoIso).run();
+    investigationFindingsPurged = changes(findingsRes);
+    const changesRes = await db.prepare(
+      `DELETE FROM change_events
+				 WHERE ((expires_at IS NOT NULL AND expires_at < ?)
+				     OR (expires_at IS NULL AND occurred_at < ?))
+				   AND NOT EXISTS (
+				     SELECT 1 FROM investigation_findings f
+				     WHERE f.project_id = change_events.project_id
+				       AND f.environment = change_events.environment
+				       AND f.contributing_change_id = change_events.id
+				   )`
+    ).bind(nowIso, ninetyDaysAgoIso).run();
+    changeEventsPurged = changes(changesRes);
+    const incidentsRes = await db.prepare(
+      `DELETE FROM incident_investigations
+				 WHERE status IN ('resolved', 'escalated')
+				   AND ((expires_at IS NOT NULL AND expires_at < ?)
+				     OR (expires_at IS NULL AND updated_at < ?))`
+    ).bind(nowIso, ninetyDaysAgoIso).run();
+    incidentInvestigationsPurged = changes(incidentsRes);
+    await evaluateRemediationWatchdogs(db, { nowIso });
+  } catch {
+  }
   return {
     alert_evaluations: changes(alertEvaluations),
     ask_evidence_events: changes(askEvents),
     metric_series: changes(series),
     evidence_refs: changes(refs),
-    evidence_ref_expansions: changes(expansions)
+    evidence_ref_expansions: changes(expansions),
+    ontology_edges: ontologyEdgesPurged,
+    ontology_nodes: ontologyNodesPurged,
+    change_events: changeEventsPurged,
+    incident_investigations: incidentInvestigationsPurged,
+    investigation_findings: investigationFindingsPurged,
+    remediation_proposals: remediationProposalsPurged
   };
 }
 
@@ -3641,13 +5276,630 @@ async function getTelemetryExportRows(db, options) {
   ).join("\n");
 }
 
+// src/lib/autosre-ontology.ts
+import { buildCanonicalNodeId as buildCanonicalNodeId2, normalizeErrorSignature } from "@obsunified/types";
+var pickStr = (record, ...keys) => {
+  for (const key of keys) {
+    const val = record[key];
+    if (typeof val === "string" && val.trim().length > 0) {
+      return val.trim();
+    }
+    if (typeof val === "number") {
+      return String(val);
+    }
+  }
+  return null;
+};
+function extractSpanLineageAndTopology(span) {
+  const attrs = parseJsonRecord(span.attributesJson);
+  const resource = parseJsonRecord(span.resourceAttributesJson);
+  const environment = (span.environment ?? pickStr(
+    resource,
+    "deployment.environment.name",
+    "deployment.environment",
+    "obs.environment"
+  ) ?? pickStr(
+    attrs,
+    "deployment.environment.name",
+    "deployment.environment",
+    "obs.environment"
+  ) ?? "default").toLowerCase();
+  const namespace = pickStr(resource, "service.namespace") ?? pickStr(attrs, "service.namespace") ?? "default";
+  const serviceName = span.serviceName ?? pickStr(resource, "service.name") ?? pickStr(attrs, "service.name");
+  const serviceVersion = span.serviceVersion ?? pickStr(resource, "service.version", "obs.service.version") ?? pickStr(attrs, "service.version", "obs.service.version");
+  const commitSha = span.commitSha ?? pickStr(
+    resource,
+    "vcs.commit.id",
+    "git.commit.sha",
+    "obs.commit.sha",
+    "service.commit.sha"
+  ) ?? pickStr(attrs, "vcs.commit.id", "git.commit.sha", "obs.commit.sha");
+  const configDigest = pickStr(resource, "obs.config.digest") ?? pickStr(attrs, "obs.config.digest");
+  const sourceNode = serviceName ? buildCanonicalNodeId2({
+    kind: "service",
+    environment,
+    namespace,
+    serviceName
+  }) : null;
+  let targetNode = null;
+  let edgePredicate = null;
+  const dbSystem = pickStr(attrs, "db.system");
+  const messagingSystem = pickStr(attrs, "messaging.system");
+  const peerService = pickStr(attrs, "peer.service", "obs.target.service");
+  const serverAddress = pickStr(
+    attrs,
+    "server.address",
+    "net.peer.name",
+    "db.connection_string"
+  );
+  const serverPort = pickStr(attrs, "server.port", "net.peer.port");
+  const toolName = pickStr(attrs, "obs.tool.name", "tool.name");
+  if (dbSystem) {
+    const isCache = dbSystem.toLowerCase() === "redis" || dbSystem.toLowerCase() === "memcached";
+    targetNode = buildCanonicalNodeId2({
+      kind: isCache ? "cache" : "database",
+      environment,
+      dbSystem,
+      dbName: pickStr(attrs, "db.namespace", "db.name") ?? dbSystem,
+      serverAddress,
+      serverPort
+    });
+    edgePredicate = isCache ? "queries_cache" : "queries_database";
+  } else if (messagingSystem) {
+    targetNode = buildCanonicalNodeId2({
+      kind: "queue_topic",
+      environment,
+      messagingSystem,
+      messagingDestination: pickStr(
+        attrs,
+        "messaging.destination.name",
+        "messaging.destination"
+      ) ?? "default",
+      serverAddress
+    });
+    edgePredicate = span.spanKind === 4 ? "publishes_to_queue" : "consumes_from_queue";
+  } else if (peerService) {
+    targetNode = buildCanonicalNodeId2({
+      kind: "service",
+      environment,
+      namespace: pickStr(attrs, "peer.namespace") ?? namespace,
+      serviceName: peerService
+    });
+    edgePredicate = "calls_service";
+  } else if (span.spanKind === 2 && serverAddress) {
+    targetNode = buildCanonicalNodeId2({
+      kind: "external_api",
+      environment,
+      serverAddress,
+      serverPort: serverPort ?? "443"
+    });
+    edgePredicate = "calls_external_api";
+  } else if (toolName) {
+    targetNode = buildCanonicalNodeId2({
+      kind: "tool",
+      environment,
+      serviceName: pickStr(attrs, "obs.agent.id", "agent.id") ?? serviceName ?? "default",
+      toolName
+    });
+    edgePredicate = "invokes_tool";
+  }
+  let errorSignature = span.errorSignature ?? null;
+  if (!errorSignature && span.statusCode === 2) {
+    let rawErr = pickStr(
+      attrs,
+      "exception.type",
+      "error.type",
+      "obs.tool.error_type",
+      "http.response.status_code",
+      "http.status_code",
+      "rpc.grpc.status_code"
+    ) ?? span.statusMessage;
+    if (!rawErr && span.eventsJson) {
+      const events = parseJsonArray(span.eventsJson);
+      for (const ev of events) {
+        if (ev && typeof ev === "object" && !Array.isArray(ev)) {
+          const evObj = ev;
+          if (evObj.name === "exception" && evObj.attributes) {
+            const evAttrs = typeof evObj.attributes === "object" && !Array.isArray(evObj.attributes) ? evObj.attributes : {};
+            rawErr = pickStr(evAttrs, "exception.type", "exception.message") ?? rawErr;
+          }
+        }
+      }
+    }
+    errorSignature = normalizeErrorSignature(
+      rawErr ?? `ERROR:${span.spanName}`
+    );
+  }
+  return {
+    environment,
+    namespace,
+    serviceName,
+    serviceVersion,
+    commitSha,
+    configDigest,
+    sourceNode,
+    targetNode,
+    edgePredicate,
+    errorSignature
+  };
+}
+var NODE_UPSERT_CACHE = /* @__PURE__ */ new Map();
+var CACHE_TTL_MS = 6e4;
+async function upsertOntologyFromSpans(db, spans, options = {}) {
+  if (spans.length === 0) return;
+  const nowMs = Date.now();
+  const statements = [];
+  const edgeAggregates = /* @__PURE__ */ new Map();
+  const serviceNodesToCheck = /* @__PURE__ */ new Map();
+  for (const span of spans) {
+    const lineage = extractSpanLineageAndTopology(span);
+    const ts = span.receivedAt || span.startTime || (/* @__PURE__ */ new Date()).toISOString();
+    if (lineage.sourceNode) {
+      const cacheKey = `${span.projectId}::${lineage.environment}::${lineage.sourceNode.id}::${lineage.serviceVersion ?? ""}::${lineage.commitSha ?? ""}::${lineage.configDigest ?? ""}`;
+      const cachedAt = NODE_UPSERT_CACHE.get(cacheKey);
+      if (options.bypassCache || !cachedAt || nowMs - cachedAt > CACHE_TTL_MS) {
+        NODE_UPSERT_CACHE.set(cacheKey, nowMs);
+        serviceNodesToCheck.set(
+          `${span.projectId}::${lineage.environment}::${lineage.sourceNode.id}`,
+          {
+            projectId: span.projectId,
+            environment: lineage.environment,
+            node: lineage.sourceNode,
+            version: lineage.serviceVersion,
+            commitSha: lineage.commitSha,
+            configDigest: lineage.configDigest,
+            timestamp: ts
+          }
+        );
+      }
+    }
+    if (lineage.targetNode) {
+      const targetCacheKey = `${span.projectId}::${lineage.environment}::${lineage.targetNode.id}`;
+      const cachedAt = NODE_UPSERT_CACHE.get(targetCacheKey);
+      if (options.bypassCache || !cachedAt || nowMs - cachedAt > CACHE_TTL_MS) {
+        NODE_UPSERT_CACHE.set(targetCacheKey, nowMs);
+        statements.push(
+          db.prepare(
+            `INSERT INTO ontology_nodes (
+								project_id, environment, id, kind, name, namespace_or_endpoint,
+								is_scoped_identity, attributes_json, first_seen_at, last_seen_at
+							) VALUES (?, ?, ?, ?, ?, ?, ?, '{}', ?, ?)
+							ON CONFLICT (project_id, environment, id) DO UPDATE SET
+								last_seen_at = excluded.last_seen_at`
+          ).bind(
+            span.projectId,
+            lineage.environment,
+            lineage.targetNode.id,
+            lineage.targetNode.kind,
+            lineage.targetNode.name,
+            lineage.targetNode.namespaceOrEndpoint,
+            lineage.targetNode.isScopedIdentity ? 1 : 0,
+            ts,
+            ts
+          )
+        );
+      }
+    }
+    if (lineage.sourceNode && lineage.targetNode && lineage.edgePredicate) {
+      const edgeId = `${lineage.sourceNode.id}--${lineage.edgePredicate}-->${lineage.targetNode.id}`;
+      const aggKey = `${span.projectId}::${lineage.environment}::${edgeId}`;
+      const certainty = lineage.sourceNode.isScopedIdentity && lineage.targetNode.isScopedIdentity ? "exact" : "inferred";
+      const existing = edgeAggregates.get(aggKey);
+      const isErr = span.statusCode === 2 ? 1 : 0;
+      if (existing) {
+        existing.callCount += 1;
+        existing.errorCount += isErr;
+        existing.lastDurationMs = span.durationMs;
+        if (ts > existing.lastSeenAt) existing.lastSeenAt = ts;
+      } else {
+        edgeAggregates.set(aggKey, {
+          projectId: span.projectId,
+          environment: lineage.environment,
+          id: edgeId,
+          sourceNodeId: lineage.sourceNode.id,
+          predicate: lineage.edgePredicate,
+          targetNodeId: lineage.targetNode.id,
+          certainty,
+          callCount: 1,
+          errorCount: isErr,
+          lastDurationMs: span.durationMs,
+          firstSeenAt: ts,
+          lastSeenAt: ts
+        });
+      }
+    }
+  }
+  for (const entry of serviceNodesToCheck.values()) {
+    if (entry.version) {
+      const existingNode = await db.prepare(
+        `SELECT current_version, current_commit_sha
+					 FROM ontology_nodes
+					 WHERE project_id = ? AND environment = ? AND id = ?`
+      ).bind(entry.projectId, entry.environment, entry.node.id).first();
+      if (existingNode?.current_version && existingNode.current_version !== entry.version) {
+        const existingChange = await db.prepare(
+          `SELECT id FROM change_events
+						 WHERE project_id = ? AND environment = ? AND target_node_id = ? AND version = ?
+						 LIMIT 1`
+        ).bind(
+          entry.projectId,
+          entry.environment,
+          entry.node.id,
+          entry.version
+        ).first();
+        if (!existingChange) {
+          const changeId = `chg_inf_${randomHex(8)}`;
+          const expiresAt = new Date(
+            Date.now() + 30 * 24 * 36e5
+          ).toISOString();
+          statements.push(
+            db.prepare(
+              `INSERT INTO change_events (
+									project_id, environment, id, target_node_id, kind, source,
+									relationship_certainty, summary, service_name, version,
+									previous_version, commit_sha, previous_commit_sha, config_digest,
+									touched_paths_json, attributes_json, occurred_at, received_at, expires_at
+								) VALUES (?, ?, ?, ?, 'deploy', 'inferred_telemetry', 'inferred', ?, ?, ?, ?, ?, ?, ?, '[]', '{}', ?, ?, ?)
+								ON CONFLICT (project_id, environment, id) DO NOTHING`
+            ).bind(
+              entry.projectId,
+              entry.environment,
+              changeId,
+              entry.node.id,
+              `Inferred version transition ${existingNode.current_version} -> ${entry.version} on ${entry.node.name}`,
+              entry.node.name,
+              entry.version,
+              existingNode.current_version,
+              entry.commitSha,
+              existingNode.current_commit_sha,
+              entry.configDigest,
+              entry.timestamp,
+              entry.timestamp,
+              expiresAt
+            )
+          );
+        }
+      }
+    }
+    statements.push(
+      db.prepare(
+        `INSERT INTO ontology_nodes (
+						project_id, environment, id, kind, name, namespace_or_endpoint,
+						is_scoped_identity, current_version, current_commit_sha,
+						current_config_digest, attributes_json, first_seen_at, last_seen_at
+					) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, '{}', ?, ?)
+					ON CONFLICT (project_id, environment, id) DO UPDATE SET
+						current_version = COALESCE(excluded.current_version, ontology_nodes.current_version),
+						current_commit_sha = COALESCE(excluded.current_commit_sha, ontology_nodes.current_commit_sha),
+						current_config_digest = COALESCE(excluded.current_config_digest, ontology_nodes.current_config_digest),
+						last_seen_at = excluded.last_seen_at`
+      ).bind(
+        entry.projectId,
+        entry.environment,
+        entry.node.id,
+        entry.node.kind,
+        entry.node.name,
+        entry.node.namespaceOrEndpoint,
+        entry.node.isScopedIdentity ? 1 : 0,
+        entry.version,
+        entry.commitSha,
+        entry.configDigest,
+        entry.timestamp,
+        entry.timestamp
+      )
+    );
+  }
+  for (const edge of edgeAggregates.values()) {
+    statements.push(
+      db.prepare(
+        `INSERT INTO ontology_edges (
+						project_id, environment, id, source_node_id, predicate, target_node_id,
+						relationship_certainty, call_count, error_count, last_duration_ms,
+						first_seen_at, last_seen_at
+					) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (project_id, environment, id) DO UPDATE SET
+						call_count = ontology_edges.call_count + excluded.call_count,
+						error_count = ontology_edges.error_count + excluded.error_count,
+						last_duration_ms = excluded.last_duration_ms,
+						last_seen_at = excluded.last_seen_at`
+      ).bind(
+        edge.projectId,
+        edge.environment,
+        edge.id,
+        edge.sourceNodeId,
+        edge.predicate,
+        edge.targetNodeId,
+        edge.certainty,
+        edge.callCount,
+        edge.errorCount,
+        edge.lastDurationMs,
+        edge.firstSeenAt,
+        edge.lastSeenAt
+      )
+    );
+  }
+  if (statements.length > 0) {
+    await db.batch(statements);
+  }
+}
+function computeTarjanScc(nodes, edges) {
+  const adjacency = /* @__PURE__ */ new Map();
+  const selfLoops = /* @__PURE__ */ new Set();
+  for (const node of nodes) {
+    adjacency.set(node.id, []);
+  }
+  for (const edge of edges) {
+    if (!adjacency.has(edge.sourceNodeId)) {
+      adjacency.set(edge.sourceNodeId, []);
+    }
+    if (!adjacency.has(edge.targetNodeId)) {
+      adjacency.set(edge.targetNodeId, []);
+    }
+    adjacency.get(edge.sourceNodeId)?.push(edge.targetNodeId);
+    if (edge.sourceNodeId === edge.targetNodeId) {
+      selfLoops.add(edge.sourceNodeId);
+    }
+  }
+  let index = 0;
+  const indices = /* @__PURE__ */ new Map();
+  const lowlink = /* @__PURE__ */ new Map();
+  const onStack = /* @__PURE__ */ new Set();
+  const stack = [];
+  const rawComponents = [];
+  const strongConnect = (nodeId) => {
+    indices.set(nodeId, index);
+    lowlink.set(nodeId, index);
+    index += 1;
+    stack.push(nodeId);
+    onStack.add(nodeId);
+    const neighbors = adjacency.get(nodeId) ?? [];
+    for (const targetId of neighbors) {
+      if (!indices.has(targetId)) {
+        strongConnect(targetId);
+        lowlink.set(
+          nodeId,
+          Math.min(lowlink.get(nodeId) ?? 0, lowlink.get(targetId) ?? 0)
+        );
+      } else if (onStack.has(targetId)) {
+        lowlink.set(
+          nodeId,
+          Math.min(lowlink.get(nodeId) ?? 0, indices.get(targetId) ?? 0)
+        );
+      }
+    }
+    if (lowlink.get(nodeId) === indices.get(nodeId)) {
+      const component = [];
+      while (stack.length > 0) {
+        const w = stack.pop();
+        onStack.delete(w);
+        component.push(w);
+        if (w === nodeId) break;
+      }
+      component.sort();
+      rawComponents.push(component);
+    }
+  };
+  for (const nodeId of adjacency.keys()) {
+    if (!indices.has(nodeId)) {
+      strongConnect(nodeId);
+    }
+  }
+  const nodeSccMap = /* @__PURE__ */ new Map();
+  const components = rawComponents.map((nodeIds, idx) => {
+    const sccId = `scc_${idx + 1}`;
+    const isCyclic = nodeIds.length > 1 || nodeIds.length === 1 && selfLoops.has(nodeIds[0]);
+    for (const id of nodeIds) {
+      nodeSccMap.set(id, { sccId, isCyclic });
+    }
+    return { sccId, nodeIds, isCyclic };
+  });
+  const annotatedNodes = nodes.map((n) => {
+    const scc = nodeSccMap.get(n.id);
+    return {
+      ...n,
+      sccId: scc?.sccId ?? "scc_0",
+      inCycle: scc?.isCyclic ?? false
+    };
+  });
+  return { annotatedNodes, components };
+}
+function localizeTraceFaultLocus(traceId, spans) {
+  if (spans.length === 0) {
+    return {
+      faultLocusSpan: null,
+      faultLocusNodeId: null,
+      relationshipCertainty: "exact",
+      causalProofTier: "unverified_locus",
+      causalTriples: []
+    };
+  }
+  const spanById = /* @__PURE__ */ new Map();
+  const childrenByParent = /* @__PURE__ */ new Map();
+  for (const s of spans) {
+    spanById.set(s.span_id, s);
+    if (s.parent_span_id) {
+      const list = childrenByParent.get(s.parent_span_id) ?? [];
+      list.push(s);
+      childrenByParent.set(s.parent_span_id, list);
+    }
+  }
+  for (const list of childrenByParent.values()) {
+    list.sort((a, b) => a.start_time.localeCompare(b.start_time));
+  }
+  const roots = spans.filter((s) => !s.parent_span_id || !spanById.has(s.parent_span_id)).sort((a, b) => a.start_time.localeCompare(b.start_time));
+  const visited = /* @__PURE__ */ new Set();
+  const causalTriples = [];
+  const leafErrorSpans = [];
+  const MAX_DEPTH = 256;
+  const walk = (span, depth) => {
+    if (visited.has(span.span_id) || depth > MAX_DEPTH) return;
+    visited.add(span.span_id);
+    const children = (childrenByParent.get(span.span_id) ?? []).filter(
+      (c) => !visited.has(c.span_id)
+    );
+    const errorChildren = children.filter((c) => c.status_code === 2);
+    if (span.status_code === 2) {
+      if (errorChildren.length === 0) {
+        leafErrorSpans.push(span);
+      } else {
+        for (const errChild of errorChildren) {
+          causalTriples.push({
+            subjectKind: "span",
+            subjectId: span.span_id,
+            predicate: "failed_due_to_child_span",
+            objectKind: "span",
+            objectId: errChild.span_id,
+            relationshipCertainty: "exact",
+            causalProofTier: "unverified_locus",
+            confidence: 0.85,
+            reason: `Parent span ${span.span_name} failed while child span ${errChild.span_name} returned ERROR`
+          });
+        }
+      }
+    }
+    for (const child of children) {
+      walk(child, depth + 1);
+    }
+  };
+  for (const root of roots) {
+    walk(root, 0);
+  }
+  for (const s of spans) {
+    if (!visited.has(s.span_id)) {
+      walk(s, 0);
+    }
+  }
+  leafErrorSpans.sort((a, b) => a.start_time.localeCompare(b.start_time));
+  const faultLocusSpan = leafErrorSpans[0] ?? spans.find((s) => s.status_code === 2) ?? null;
+  let faultLocusNodeId = null;
+  if (faultLocusSpan) {
+    const env = (faultLocusSpan.environment ?? "default").toLowerCase();
+    faultLocusNodeId = faultLocusSpan.target_node_id ?? (faultLocusSpan.service_name ? buildCanonicalNodeId2({
+      kind: "service",
+      environment: env,
+      serviceName: faultLocusSpan.service_name
+    }).id : null);
+    causalTriples.unshift({
+      subjectKind: "trace",
+      subjectId: traceId,
+      predicate: "originated_fault_in_span",
+      objectKind: "span",
+      objectId: faultLocusSpan.span_id,
+      relationshipCertainty: "exact",
+      causalProofTier: "unverified_locus",
+      confidence: 0.9,
+      reason: `Deepest/earliest failing span ${faultLocusSpan.span_name} (${faultLocusSpan.service_name ?? "unknown"}) is the trace fault locus`
+    });
+  }
+  return {
+    faultLocusSpan,
+    faultLocusNodeId,
+    relationshipCertainty: "exact",
+    causalProofTier: "unverified_locus",
+    causalTriples
+  };
+}
+async function loadTraceFaultLocusFromDb(db, projectId, traceId) {
+  const rows = await db.prepare(
+    `SELECT
+				span_id, parent_span_id, service_name, span_name, span_kind,
+				status_code, status_message, start_time, end_time, duration_ms,
+				environment, target_node_id, error_signature
+			 FROM telemetry_spans
+			 WHERE project_id = ? AND trace_id = ?
+			 ORDER BY start_time ASC
+			 LIMIT 500`
+  ).bind(projectId, traceId).all();
+  return localizeTraceFaultLocus(traceId, rows.results);
+}
+async function getOntologyGraph(db, options) {
+  const env = (options.environment ?? "default").toLowerCase();
+  const [nodeRows, edgeRows] = await Promise.all([
+    db.prepare(
+      `SELECT * FROM ontology_nodes
+				 WHERE project_id = ? AND environment = ?
+				 ORDER BY id ASC
+				 LIMIT 500`
+    ).bind(options.projectId, env).all(),
+    db.prepare(
+      `SELECT * FROM ontology_edges
+				 WHERE project_id = ? AND environment = ?
+				 ORDER BY call_count DESC
+				 LIMIT 1000`
+    ).bind(options.projectId, env).all()
+  ]);
+  const rawNodes = nodeRows.results.map((r) => ({
+    projectId: r.project_id,
+    environment: r.environment,
+    id: r.id,
+    kind: r.kind,
+    name: r.name,
+    namespaceOrEndpoint: r.namespace_or_endpoint,
+    isScopedIdentity: r.is_scoped_identity === 1,
+    currentVersion: r.current_version,
+    currentCommitSha: r.current_commit_sha,
+    currentConfigDigest: r.current_config_digest,
+    attributes: parseJsonRecord(r.attributes_json ?? "{}"),
+    firstSeenAt: r.first_seen_at,
+    lastSeenAt: r.last_seen_at
+  }));
+  const edges = edgeRows.results.map((r) => ({
+    projectId: r.project_id,
+    environment: r.environment,
+    id: r.id,
+    sourceNodeId: r.source_node_id,
+    predicate: r.predicate,
+    targetNodeId: r.target_node_id,
+    relationshipCertainty: r.relationship_certainty || "exact",
+    callCount: Number(r.call_count ?? 0),
+    errorCount: Number(r.error_count ?? 0),
+    lastDurationMs: r.last_duration_ms === null ? null : Number(r.last_duration_ms),
+    firstSeenAt: r.first_seen_at,
+    lastSeenAt: r.last_seen_at
+  }));
+  const { annotatedNodes, components } = computeTarjanScc(rawNodes, edges);
+  const inboundErrorsByTarget = /* @__PURE__ */ new Map();
+  for (const e of edges) {
+    if (e.errorCount > 0) {
+      inboundErrorsByTarget.set(
+        e.targetNodeId,
+        (inboundErrorsByTarget.get(e.targetNodeId) ?? 0) + e.errorCount
+      );
+    }
+  }
+  const nodes = annotatedNodes.map((n) => ({
+    ...n,
+    isBlackoutSuspected: (inboundErrorsByTarget.get(n.id) ?? 0) >= 3 && edges.filter((e) => e.sourceNodeId === n.id).length === 0
+  }));
+  return {
+    environment: env,
+    nodes,
+    edges,
+    stronglyConnectedComponents: components
+  };
+}
+
 // src/lib/store/ingest.ts
 async function ingestTelemetrySpans(db, spans) {
   if (spans.length === 0) return { inserted: 0, traceCount: 0 };
-  const statements = spans.map((span) => {
+  const enrichedSpans = spans.map((span) => {
     if (!span.projectId)
       throw new Error("TelemetryStore.ingest: span.projectId is required");
-    return db.prepare(`
+    if (span.environment !== void 0 && span.serviceVersion !== void 0 && span.targetNodeId !== void 0) {
+      return span;
+    }
+    const lineage = extractSpanLineageAndTopology(span);
+    return {
+      ...span,
+      environment: span.environment ?? lineage.environment,
+      serviceVersion: span.serviceVersion ?? lineage.serviceVersion,
+      commitSha: span.commitSha ?? lineage.commitSha,
+      targetNodeId: span.targetNodeId ?? lineage.targetNode?.id ?? null,
+      errorSignature: span.errorSignature ?? lineage.errorSignature
+    };
+  });
+  const statements = enrichedSpans.map(
+    (span) => db.prepare(`
         INSERT OR IGNORE INTO telemetry_spans (
           project_id, trace_id, span_id, parent_span_id, trace_state,
           service_name, scope_name, scope_version, span_name, span_kind,
@@ -3655,8 +5907,9 @@ async function ingestTelemetrySpans(db, spans) {
           attributes_json, dropped_attributes_count,
           resource_attributes_json, events_json, dropped_events_count,
           links_json, dropped_links_count, received_at, expires_at,
-          session_id, interaction_id, telemetry_sdk_name
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          session_id, interaction_id, telemetry_sdk_name,
+          environment, service_version, commit_sha, target_node_id, error_signature
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       `).bind(
       span.projectId,
       span.traceId,
@@ -3684,10 +5937,69 @@ async function ingestTelemetrySpans(db, spans) {
       span.expiresAt,
       span.sessionId ?? null,
       span.interactionId ?? null,
-      span.telemetrySdkName ?? null
-    );
-  });
-  await db.batch(statements);
+      span.telemetrySdkName ?? null,
+      span.environment ?? "default",
+      span.serviceVersion ?? null,
+      span.commitSha ?? null,
+      span.targetNodeId ?? null,
+      span.errorSignature ?? null
+    )
+  );
+  try {
+    await db.batch(statements);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("no such column: environment")) {
+      const legacyStatements = enrichedSpans.map(
+        (span) => db.prepare(`
+            INSERT OR IGNORE INTO telemetry_spans (
+              project_id, trace_id, span_id, parent_span_id, trace_state,
+              service_name, scope_name, scope_version, span_name, span_kind,
+              status_code, status_message, start_time, end_time, duration_ms,
+              attributes_json, dropped_attributes_count,
+              resource_attributes_json, events_json, dropped_events_count,
+              links_json, dropped_links_count, received_at, expires_at,
+              session_id, interaction_id, telemetry_sdk_name
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          `).bind(
+          span.projectId,
+          span.traceId,
+          span.spanId,
+          span.parentSpanId,
+          span.traceState,
+          span.serviceName,
+          span.scopeName,
+          span.scopeVersion,
+          span.spanName,
+          span.spanKind,
+          span.statusCode,
+          span.statusMessage,
+          span.startTime,
+          span.endTime,
+          span.durationMs,
+          span.attributesJson,
+          span.droppedAttributesCount,
+          span.resourceAttributesJson,
+          span.eventsJson,
+          span.droppedEventsCount,
+          span.linksJson,
+          span.droppedLinksCount,
+          span.receivedAt,
+          span.expiresAt,
+          span.sessionId ?? null,
+          span.interactionId ?? null,
+          span.telemetrySdkName ?? null
+        )
+      );
+      await db.batch(legacyStatements);
+    } else {
+      throw err;
+    }
+  }
+  try {
+    await upsertOntologyFromSpans(db, enrichedSpans);
+  } catch {
+  }
   const uniqueTraces = new Set(spans.map((s) => `${s.projectId}:${s.traceId}`));
   return {
     inserted: spans.length,
@@ -8533,118 +10845,24 @@ var aiSpanPayloadsProcessorPlugin = {
                   r.receivedAt,
                   r.expiresAt,
                   r.interactionId,
-                  r.actionId
-                )
-              )
-            );
-          } catch (err) {
-            context.logger.error("[ai-span-payloads-processor] write failed", {
-              error: err instanceof Error ? err.message : String(err)
-            });
-          }
-        }
-        return transformed;
-      }
-    });
-  }
-};
-
-// src/lib/alerts-store.ts
-import { EVIDENCE_REFERENCE_CONTRACT as EVIDENCE_REFERENCE_CONTRACT4 } from "@obsunified/types";
-
-// src/lib/webhook-url.ts
-var WebhookUrlError = class extends Error {
-};
-var parseIpv4 = (host) => {
-  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
-  if (!m) return null;
-  const octets = m.slice(1).map((o) => Number.parseInt(o, 10));
-  return octets.every((o) => o <= 255) ? octets : null;
-};
-var isPrivateIpv4 = (o) => o[0] === 0 || // "this" network / unspecified
-o[0] === 10 || o[0] === 127 || o[0] === 100 && o[1] >= 64 && o[1] <= 127 || // CGNAT
-o[0] === 169 && o[1] === 254 || // link-local incl. cloud metadata
-o[0] === 172 && o[1] >= 16 && o[1] <= 31 || o[0] === 192 && o[1] === 168 || o[0] >= 224;
-var isPrivateIpv6 = (host) => {
-  const literal = host.replace(/^\[|\]$/g, "").toLowerCase();
-  if (literal === "::" || literal === "::1") return true;
-  const dotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(literal);
-  if (dotted) {
-    const v4 = parseIpv4(dotted[1]);
-    return v4 ? isPrivateIpv4(v4) : true;
-  }
-  const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(literal);
-  if (hex) {
-    const hi = Number.parseInt(hex[1], 16);
-    const lo = Number.parseInt(hex[2], 16);
-    return isPrivateIpv4([hi >> 8, hi & 255, lo >> 8, lo & 255]);
-  }
-  const first = Number.parseInt(literal.split(":")[0] || "0", 16);
-  if (Number.isNaN(first)) return true;
-  if ((first & 65024) === 64512) return true;
-  if ((first & 65472) === 65152) return true;
-  if ((first & 65280) === 65280) return true;
-  return false;
-};
-var isPrivateWebhookHost = (hostname) => {
-  const host = hostname.toLowerCase().replace(/\.$/, "");
-  if (!host) return true;
-  if (host === "localhost" || host.endsWith(".localhost")) return true;
-  if (host.endsWith(".local") || host.endsWith(".internal")) return true;
-  if (host.startsWith("[")) return isPrivateIpv6(host);
-  const v4 = parseIpv4(host);
-  if (v4) return isPrivateIpv4(v4);
-  return !host.includes(".");
-};
-var assertSafeWebhookUrl = (raw, options = {}) => {
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    throw new WebhookUrlError("channel.url must be an absolute http(s) URL");
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:") {
-    throw new WebhookUrlError("channel.url must be http(s)://");
-  }
-  if (url.username || url.password) {
-    throw new WebhookUrlError(
-      "channel.url must not embed credentials; use channel.headers"
-    );
-  }
-  if (!options.allowPrivateNetworks && isPrivateWebhookHost(url.hostname)) {
-    throw new WebhookUrlError(
-      `channel.url host "${url.hostname}" is not a public address (set ALERT_WEBHOOK_ALLOW_PRIVATE=true to allow internal receivers)`
-    );
-  }
-  return url;
-};
-var resolveWebhookHost = async (hostname, lookup) => {
-  if (parseIpv4(hostname) || hostname.startsWith("[")) return "public";
-  let addresses;
-  try {
-    addresses = await lookup(hostname);
-  } catch {
-    return "unresolvable";
-  }
-  if (addresses.length === 0) return "unresolvable";
-  const isPrivate = addresses.some((address) => {
-    const v4 = parseIpv4(address);
-    if (v4) return isPrivateIpv4(v4);
-    return isPrivateIpv6(`[${address}]`);
-  });
-  return isPrivate ? "private" : "public";
-};
-var redactWebhookUrl = (raw) => {
-  try {
-    const url = new URL(raw);
-    const hasPath = url.pathname !== "/" || url.search !== "";
-    return `${url.protocol}//${url.host}${hasPath ? "/\u2026" : ""}`;
-  } catch {
-    return "<invalid url>";
+                  r.actionId
+                )
+              )
+            );
+          } catch (err) {
+            context.logger.error("[ai-span-payloads-processor] write failed", {
+              error: err instanceof Error ? err.message : String(err)
+            });
+          }
+        }
+        return transformed;
+      }
+    });
   }
 };
 
 // src/lib/alerts-store.ts
+import { EVIDENCE_REFERENCE_CONTRACT as EVIDENCE_REFERENCE_CONTRACT4 } from "@obsunified/types";
 var parseJsonField = (value) => {
   if (typeof value === "string") return JSON.parse(value);
   return value;
@@ -9120,7 +11338,7 @@ async function mapWithConcurrency(items, concurrency, mapper) {
   );
   return results;
 }
-async function evaluateOneRule(store, rule, logger, tracer, ruleTimeoutMs, delivery) {
+async function evaluateOneRule(store, rule, logger, tracer, ruleTimeoutMs, delivery, onAlertFiring) {
   const none = { fired: 0, resolved: 0, redelivered: 0 };
   try {
     const value = await withTimeout(
@@ -9158,6 +11376,9 @@ async function evaluateOneRule(store, rule, logger, tracer, ruleTimeoutMs, deliv
     );
     if (previous !== next) {
       await store.transitionState(rule.id, rule.projectId, next, now);
+      if (next === "firing" && onAlertFiring) {
+        await onAlertFiring(rule).catch(() => void 0);
+      }
       const ok = await deliver(next);
       if (ok) {
         await store.markNotified(rule.id, rule.projectId, next, now);
@@ -9226,7 +11447,8 @@ async function evaluateRuleBatch(store, rules, options) {
       logger,
       options?.tracer,
       ruleTimeoutMs,
-      delivery
+      delivery,
+      options?.onAlertFiring
     )
   );
   return {
@@ -9240,7 +11462,8 @@ async function evaluateAllRules(env, options) {
   const logger = options?.logger ?? consoleLogger;
   const tracer = options?.tracer;
   const allowPrivateWebhookTargets = env.ALERT_WEBHOOK_ALLOW_PRIVATE === "true";
-  const store = new AlertsStore(sqlDbFor(env), { allowPrivateWebhookTargets });
+  const db = sqlDbFor(env);
+  const store = new AlertsStore(db, { allowPrivateWebhookTargets });
   const rules = await store.listEnabledRules();
   return evaluateRuleBatch(store, rules, {
     logger,
@@ -9248,7 +11471,15 @@ async function evaluateAllRules(env, options) {
     concurrency: options?.concurrency,
     ruleTimeoutMs: options?.ruleTimeoutMs,
     allowPrivateWebhookTargets,
-    hostLookup: options?.hostLookup
+    hostLookup: options?.hostLookup,
+    onAlertFiring: async (rule) => {
+      await openOrDeduplicateIncident(db, rule.projectId, {
+        environment: "default",
+        targetNodeId: `alert:${rule.id}`,
+        symptomAnchorKind: "alert",
+        symptomAnchorId: rule.id
+      });
+    }
   });
 }
 function createAlertEvaluatorHandler() {
@@ -9542,7 +11773,7 @@ var summarizeResult = (def, result) => {
 };
 async function runAsk(question, deps) {
   if (deps.llm.provider === "openai") {
-    const { runAskOpenAI } = await import("./openai-FJYOQ7WO.js");
+    const { runAskOpenAI } = await import("./openai-GSJZGFGL.js");
     return runAskOpenAI(question, deps);
   }
   return runAskAnthropic(question, deps);
@@ -9717,149 +11948,1288 @@ async function callAnthropic(config, messages, turnIndex) {
           json.usage.output_tokens
         );
     }
-    if (span && json.stop_reason)
-      span.setAttribute("gen_ai.response.finish_reason", json.stop_reason);
-    return json;
-  };
-  if (!config.tracer) return exec(null);
-  const attrs = {
-    "openinference.span.kind": "LLM",
-    "gen_ai.system": "anthropic",
-    "gen_ai.request.model": config.model,
-    "gen_ai.request.max_tokens": 1024,
-    "http.url": url
+    if (span && json.stop_reason)
+      span.setAttribute("gen_ai.response.finish_reason", json.stop_reason);
+    return json;
+  };
+  if (!config.tracer) return exec(null);
+  const attrs = {
+    "openinference.span.kind": "LLM",
+    "gen_ai.system": "anthropic",
+    "gen_ai.request.model": config.model,
+    "gen_ai.request.max_tokens": 1024,
+    "http.url": url
+  };
+  if (typeof turnIndex === "number") attrs["llm.turn"] = turnIndex;
+  return config.tracer(
+    "llm.anthropic.messages",
+    async (span) => exec(span),
+    attrs
+  );
+}
+
+// src/plugins/ask-routes.ts
+var MAX_QUESTION_CHARS = 1e3;
+var askRoutesPlugin = {
+  name: "ask-routes",
+  register(app, runtime) {
+    app.post("/internal/ask", async (c) => {
+      const body = await readJsonObject(c);
+      if (!body) {
+        return c.json(
+          { error: "Bad Request", message: "body must be a JSON object" },
+          400
+        );
+      }
+      const question = (body.question ?? "").trim();
+      if (!question) {
+        return c.json(
+          { error: "Bad Request", message: "question is required" },
+          400
+        );
+      }
+      if (question.length > MAX_QUESTION_CHARS) {
+        return c.json(
+          {
+            error: "Bad Request",
+            message: `question exceeds ${MAX_QUESTION_CHARS} chars`
+          },
+          400
+        );
+      }
+      const projectId = getProjectId(c);
+      const openaiBase = c.env.OPENAI_BASE_URL?.trim() ? c.env.OPENAI_BASE_URL : void 0;
+      const narrativeModel = c.env.NARRATIVE_MODEL?.trim() ? c.env.NARRATIVE_MODEL : void 0;
+      const llm = c.env.OPENAI_API_KEY?.trim() ? {
+        provider: "openai",
+        apiKey: c.env.OPENAI_API_KEY,
+        model: narrativeModel ?? "gpt-4o-mini",
+        apiUrl: openaiBase,
+        tracer: runtime.withChildSpan
+      } : c.env.ANTHROPIC_API_KEY?.trim() ? {
+        provider: "anthropic",
+        apiKey: c.env.ANTHROPIC_API_KEY,
+        model: narrativeModel ?? "claude-haiku-4-5",
+        tracer: runtime.withChildSpan
+      } : null;
+      if (!llm) {
+        const response = {
+          answer: null,
+          evidence: [],
+          queries: [],
+          error: "Ask is not configured \u2014 set OPENAI_API_KEY or ANTHROPIC_API_KEY on the collector to enable it.",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        return c.json(response, 503);
+      }
+      const store = new AnalysesStore(sqlDbFor(c.env));
+      try {
+        const startedAt = Date.now();
+        runtime.logger.info("[ask] llm call starting", {
+          project_id: projectId,
+          provider: llm.provider,
+          model: llm.model,
+          question_chars: question.length
+        });
+        const result = await runtime.withChildSpan(
+          "ask.runAsk",
+          () => runAsk(question, {
+            llm,
+            listAnalyses: async (filters) => {
+              const all = await getAllAnalysesForProject(projectId, {
+                db: sqlDbFor(c.env)
+              });
+              return all.filter((d) => {
+                if (filters?.group && d.group !== filters.group) return false;
+                if (filters?.view && d.view !== filters.view) return false;
+                return true;
+              });
+            },
+            getLatestResult: async (id) => {
+              const definitions = await store.listDefinitions(projectId);
+              const definition = definitions.find((d) => d.id === id);
+              if (!definition) return null;
+              const r = await store.getLatestResult(projectId, id);
+              return { definition, result: r };
+            }
+          }),
+          {
+            "llm.provider": llm.provider,
+            "llm.model": llm.model,
+            "openinference.span.kind": "LLM"
+          }
+        );
+        runtime.logger.info("[ask] llm call finished", {
+          project_id: projectId,
+          provider: llm.provider,
+          model: llm.model,
+          latency_ms: Date.now() - startedAt,
+          evidence_count: result.evidence.length,
+          query_count: result.queries.length,
+          answered: Boolean(result.answer)
+        });
+        if (result.answer && result.evidence.length > 0) {
+          await store.recordAskEvidence(
+            projectId,
+            result.evidence.map((e) => e.analysisId)
+          ).catch(
+            (err) => runtime.logger.warn("[ask] recordAskEvidence failed", {
+              error: err instanceof Error ? err.message : String(err)
+            })
+          );
+        }
+        return c.json(result);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        runtime.logger.error("[ask] failed", { error: message });
+        const response = {
+          answer: null,
+          evidence: [],
+          queries: [],
+          error: message,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        return c.json(response, 500);
+      }
+    });
+  }
+};
+
+// src/plugins/autosre-routes.ts
+import { AgentAutonomyLevel as AgentAutonomyLevel2 } from "@obsunified/types/constants";
+
+// src/lib/autosre-change-correlation.ts
+import { buildCanonicalNodeId as buildCanonicalNodeId3 } from "@obsunified/types";
+var mapChangeEventRow = (row) => ({
+  id: row.id,
+  projectId: row.project_id,
+  environment: row.environment,
+  targetNodeId: row.target_node_id,
+  kind: row.kind,
+  source: row.source,
+  relationshipCertainty: row.relationship_certainty || "exact",
+  summary: row.summary,
+  serviceName: row.service_name,
+  version: row.version,
+  previousVersion: row.previous_version,
+  commitSha: row.commit_sha,
+  previousCommitSha: row.previous_commit_sha,
+  configDigest: row.config_digest,
+  repositoryUrl: row.repository_url,
+  pullRequestUrl: row.pull_request_url,
+  actorId: row.actor_id,
+  causedByActionId: row.caused_by_action_id,
+  agentRunId: row.agent_run_id,
+  touchedPaths: parseJsonArray(row.touched_paths_json ?? "[]").filter(
+    (p) => typeof p === "string"
+  ),
+  attributes: parseJsonRecord(row.attributes_json ?? "{}"),
+  occurredAt: row.occurred_at,
+  receivedAt: row.received_at,
+  expiresAt: row.expires_at
+});
+async function recordChangeEvent(db, projectId, input) {
+  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  const occurredAt = input.occurredAt || nowIso;
+  const environment = (input.environment || "default").trim().toLowerCase();
+  const namespace = (input.namespace || "default").trim();
+  const serviceName = input.serviceName?.trim() || null;
+  const canonicalNode = input.targetNodeId ? {
+    id: input.targetNodeId,
+    environment,
+    kind: input.kind === "feature_flag" ? "feature_flag" : "service",
+    name: serviceName ?? input.targetNodeId,
+    namespaceOrEndpoint: namespace,
+    isScopedIdentity: true
+  } : input.kind === "feature_flag" ? buildCanonicalNodeId3({
+    kind: "feature_flag",
+    environment,
+    flagKey: (typeof input.attributes?.flagKey === "string" ? input.attributes.flagKey : serviceName) ?? "flag"
+  }) : buildCanonicalNodeId3({
+    kind: "service",
+    environment,
+    namespace,
+    serviceName: serviceName ?? "unknown-service"
+  });
+  const id = input.id?.trim() || `chg_${randomHex(10)}`;
+  const source = input.source ?? "explicit_api";
+  const certainty = input.relationshipCertainty ?? (source === "inferred_telemetry" ? "inferred" : "exact");
+  const touchedPaths = (input.touchedPaths ?? []).slice(0, 500);
+  const expiresAt = new Date(
+    Date.parse(occurredAt) + 30 * 24 * 36e5
+  ).toISOString();
+  await db.batch([
+    db.prepare(
+      `INSERT INTO ontology_nodes (
+					project_id, environment, id, kind, name, namespace_or_endpoint,
+					is_scoped_identity, current_version, current_commit_sha,
+					current_config_digest, attributes_json, first_seen_at, last_seen_at
+				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, '{}', ?, ?)
+				ON CONFLICT (project_id, environment, id) DO UPDATE SET
+					current_version = COALESCE(excluded.current_version, ontology_nodes.current_version),
+					current_commit_sha = COALESCE(excluded.current_commit_sha, ontology_nodes.current_commit_sha),
+					current_config_digest = COALESCE(excluded.current_config_digest, ontology_nodes.current_config_digest),
+					last_seen_at = excluded.last_seen_at`
+    ).bind(
+      projectId,
+      environment,
+      canonicalNode.id,
+      canonicalNode.kind,
+      canonicalNode.name,
+      canonicalNode.namespaceOrEndpoint,
+      canonicalNode.isScopedIdentity ? 1 : 0,
+      input.version ?? null,
+      input.commitSha ?? null,
+      input.configDigest ?? null,
+      occurredAt,
+      nowIso
+    ),
+    db.prepare(
+      `INSERT INTO change_events (
+					project_id, environment, id, target_node_id, kind, source,
+					relationship_certainty, summary, service_name, version,
+					previous_version, commit_sha, previous_commit_sha, config_digest,
+					repository_url, pull_request_url, actor_id, caused_by_action_id,
+					agent_run_id, touched_paths_json, attributes_json,
+					occurred_at, received_at, expires_at
+				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+				ON CONFLICT (project_id, environment, id) DO UPDATE SET
+					summary = excluded.summary,
+					version = COALESCE(excluded.version, change_events.version),
+					previous_version = COALESCE(excluded.previous_version, change_events.previous_version),
+					commit_sha = COALESCE(excluded.commit_sha, change_events.commit_sha),
+					touched_paths_json = excluded.touched_paths_json,
+					attributes_json = excluded.attributes_json,
+					occurred_at = excluded.occurred_at`
+    ).bind(
+      projectId,
+      environment,
+      id,
+      canonicalNode.id,
+      input.kind,
+      source,
+      certainty,
+      input.summary,
+      serviceName,
+      input.version ?? null,
+      input.previousVersion ?? null,
+      input.commitSha ?? null,
+      input.previousCommitSha ?? null,
+      input.configDigest ?? null,
+      input.repositoryUrl ?? null,
+      input.pullRequestUrl ?? null,
+      input.actorId ?? null,
+      input.causedByActionId ?? null,
+      input.agentRunId ?? null,
+      JSON.stringify(touchedPaths),
+      JSON.stringify(input.attributes ?? {}),
+      occurredAt,
+      nowIso,
+      expiresAt
+    )
+  ]);
+  return {
+    id,
+    projectId,
+    environment,
+    targetNodeId: canonicalNode.id,
+    kind: input.kind,
+    source,
+    relationshipCertainty: certainty,
+    summary: input.summary,
+    serviceName,
+    version: input.version ?? null,
+    previousVersion: input.previousVersion ?? null,
+    commitSha: input.commitSha ?? null,
+    previousCommitSha: input.previousCommitSha ?? null,
+    configDigest: input.configDigest ?? null,
+    repositoryUrl: input.repositoryUrl ?? null,
+    pullRequestUrl: input.pullRequestUrl ?? null,
+    actorId: input.actorId ?? null,
+    causedByActionId: input.causedByActionId ?? null,
+    agentRunId: input.agentRunId ?? null,
+    touchedPaths,
+    attributes: input.attributes ?? {},
+    occurredAt,
+    receivedAt: nowIso,
+    expiresAt
+  };
+}
+async function listChangeEvents(db, options) {
+  const conditions = ["project_id = ?"];
+  const binds = [options.projectId];
+  if (options.environment) {
+    conditions.push("environment = ?");
+    binds.push(options.environment.toLowerCase());
+  }
+  if (options.serviceName) {
+    conditions.push("service_name = ?");
+    binds.push(options.serviceName);
+  }
+  if (options.targetNodeId) {
+    conditions.push("target_node_id = ?");
+    binds.push(options.targetNodeId);
+  }
+  if (options.kind) {
+    conditions.push("kind = ?");
+    binds.push(options.kind);
+  }
+  if (options.since) {
+    conditions.push("occurred_at >= ?");
+    binds.push(options.since);
+  }
+  const limit = Math.max(1, Math.min(200, options.limit ?? 50));
+  binds.push(limit);
+  const rows = await db.prepare(
+    `SELECT * FROM change_events
+			 WHERE ${conditions.join(" AND ")}
+			 ORDER BY occurred_at DESC
+			 LIMIT ?`
+  ).bind(...binds).all();
+  return rows.results.map(mapChangeEventRow);
+}
+async function getChangeEvent(db, projectId, changeId, environment) {
+  const row = environment ? await db.prepare(
+    `SELECT * FROM change_events
+					 WHERE project_id = ? AND environment = ? AND id = ?`
+  ).bind(projectId, environment.toLowerCase(), changeId).first() : await db.prepare(
+    `SELECT * FROM change_events
+					 WHERE project_id = ? AND id = ?
+					 ORDER BY occurred_at DESC
+					 LIMIT 1`
+  ).bind(projectId, changeId).first();
+  return row ? mapChangeEventRow(row) : null;
+}
+var computePercentile = (sorted, p) => {
+  if (sorted.length === 0) return null;
+  const idx = Math.min(
+    sorted.length - 1,
+    Math.max(0, Math.ceil(p / 100 * sorted.length) - 1)
+  );
+  return sorted[idx];
+};
+var summarizeCohort = (cohortKey, requestSpans, downstreamSpans) => {
+  const requestCount = requestSpans.length;
+  const errorCount = requestSpans.filter((s) => s.status_code === 2).length;
+  const errorRate = requestCount > 0 ? errorCount / requestCount : 0;
+  const durations = requestSpans.map((s) => Number(s.duration_ms ?? 0)).sort((a, b) => a - b);
+  const p95DurationMs = computePercentile(durations, 95);
+  const downstreamCount = downstreamSpans.length;
+  const avgDownstreamCallsPerRequest = requestCount > 0 ? downstreamCount / requestCount : 0;
+  const avgDownstreamDurationMs = downstreamCount > 0 ? downstreamSpans.reduce((acc, s) => acc + Number(s.duration_ms ?? 0), 0) / downstreamCount : null;
+  return {
+    cohortKey,
+    requestCount,
+    errorCount,
+    errorRate,
+    p95DurationMs,
+    avgDownstreamCallsPerRequest,
+    avgDownstreamDurationMs
+  };
+};
+async function findCrossTraceContention(db, options) {
+  const env = options.environment.toLowerCase();
+  const limit = Math.max(1, Math.min(20, options.limit ?? 5));
+  const [nodeRow, contentionRows] = await Promise.all([
+    db.prepare(
+      `SELECT is_scoped_identity FROM ontology_nodes
+				 WHERE project_id = ? AND environment = ? AND id = ?`
+    ).bind(options.projectId, env, options.targetNodeId).first(),
+    db.prepare(
+      `SELECT
+					trace_id,
+					span_id,
+					service_name,
+					service_version,
+					span_name,
+					COUNT(*) AS concurrent_calls,
+					MAX(duration_ms) AS max_duration_ms,
+					SUM(duration_ms) AS total_resource_time_ms
+				 FROM telemetry_spans
+				 WHERE project_id = ?
+				   AND environment = ?
+				   AND target_node_id = ?
+				   AND trace_id <> ?
+				   AND start_time <= ?
+				   AND end_time >= ?
+				 GROUP BY trace_id, span_id, service_name, service_version, span_name
+				 ORDER BY total_resource_time_ms DESC
+				 LIMIT ?`
+    ).bind(
+      options.projectId,
+      env,
+      options.targetNodeId,
+      options.excludeTraceId,
+      options.endTime,
+      options.startTime,
+      limit
+    ).all()
+  ]);
+  const isScoped = nodeRow ? nodeRow.is_scoped_identity === 1 : !options.targetNodeId.includes(":unscoped/");
+  const relationshipCertainty = isScoped ? "exact" : "inferred";
+  return contentionRows.results.map((r) => ({
+    aggressorTraceId: r.trace_id,
+    aggressorSpanId: r.span_id,
+    aggressorServiceName: r.service_name,
+    aggressorServiceVersion: r.service_version,
+    aggressorSpanName: r.span_name,
+    sharedTargetNodeId: options.targetNodeId,
+    relationshipCertainty,
+    concurrentCalls: Number(r.concurrent_calls ?? 1),
+    maxDurationMs: Number(r.max_duration_ms ?? 0),
+    totalResourceTimeMs: Number(r.total_resource_time_ms ?? 0)
+  }));
+}
+var extractFilePathsFromSpan = (span) => {
+  const found = [];
+  const attrs = parseJsonRecord(span.attributes_json ?? "{}");
+  for (const key of ["code.filepath", "obs.code.filepath", "exception.stacktrace"]) {
+    const val = attrs[key];
+    if (typeof val === "string") {
+      found.push(val);
+    }
+  }
+  if (span.events_json) {
+    const events = parseJsonArray(span.events_json);
+    for (const ev of events) {
+      if (ev && typeof ev === "object" && !Array.isArray(ev)) {
+        const evAttrs = parseJsonRecord(
+          JSON.stringify(ev.attributes ?? {})
+        );
+        for (const key of ["code.filepath", "exception.stacktrace"]) {
+          if (typeof evAttrs[key] === "string") {
+            found.push(evAttrs[key]);
+          }
+        }
+      }
+    }
+  }
+  return found;
+};
+async function computeChangeBlastRadius(db, projectId, changeId, options = {}) {
+  const change = await getChangeEvent(
+    db,
+    projectId,
+    changeId,
+    options.environment
+  );
+  if (!change) return null;
+  const minSample = options.minComparableSample ?? 50;
+  const preWindowStart = new Date(
+    Date.parse(change.occurredAt) - 30 * 6e4
+  ).toISOString();
+  const serviceFilter = change.serviceName;
+  const spansResult = serviceFilter ? await db.prepare(
+    `SELECT
+						trace_id, span_id, parent_span_id, span_kind, status_code,
+						duration_ms, service_version, target_node_id, attributes_json,
+						events_json, start_time, end_time, received_at
+					 FROM telemetry_spans
+					 WHERE project_id = ?
+					   AND environment = ?
+					   AND service_name = ?
+					   AND received_at >= ?
+					 ORDER BY received_at DESC
+					 LIMIT 5000`
+  ).bind(projectId, change.environment, serviceFilter, preWindowStart).all() : await db.prepare(
+    `SELECT
+						trace_id, span_id, parent_span_id, span_kind, status_code,
+						duration_ms, service_version, target_node_id, attributes_json,
+						events_json, start_time, end_time, received_at
+					 FROM telemetry_spans
+					 WHERE project_id = ?
+					   AND environment = ?
+					   AND received_at >= ?
+					 ORDER BY received_at DESC
+					 LIMIT 5000`
+  ).bind(projectId, change.environment, preWindowStart).all();
+  const allSpans = spansResult.results;
+  const postSpans = allSpans.filter(
+    (s) => (s.start_time || s.received_at) >= change.occurredAt
+  );
+  const preSpans = allSpans.filter(
+    (s) => (s.start_time || s.received_at) < change.occurredAt
+  );
+  const isRootOrServer = (s) => s.parent_span_id === null || s.span_kind === 1;
+  const isDownstreamCall = (s) => Boolean(s.target_node_id) || s.span_kind === 2 || s.span_kind === 4;
+  const flagKey = change.kind === "feature_flag" ? (typeof change.attributes.flagKey === "string" ? change.attributes.flagKey : change.serviceName) ?? "flag" : null;
+  const newCohortKey = change.version ?? (typeof change.attributes.newVariant === "string" ? change.attributes.newVariant : "true");
+  const oldCohortKey = change.previousVersion ?? (typeof change.attributes.previousVariant === "string" ? change.attributes.previousVariant : "false");
+  const getCohortOfSpan = (s) => {
+    if (flagKey) {
+      const attrs = parseJsonRecord(s.attributes_json ?? "{}");
+      const direct = attrs[`obs.feature_flags.${flagKey}`];
+      if (direct !== void 0 && direct !== null) return String(direct);
+      if (attrs["feature_flag.key"] === flagKey && attrs["feature_flag.variant"] !== void 0) {
+        return String(attrs["feature_flag.variant"]);
+      }
+      const nested = attrs["obs.feature_flags"];
+      if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+        const v = nested[flagKey];
+        if (v !== void 0 && v !== null) return String(v);
+      }
+      return null;
+    }
+    return s.service_version;
+  };
+  const postNewReq = postSpans.filter(
+    (s) => isRootOrServer(s) && getCohortOfSpan(s) === newCohortKey
+  );
+  const postNewDown = postSpans.filter(
+    (s) => isDownstreamCall(s) && getCohortOfSpan(s) === newCohortKey
+  );
+  const postOldReq = postSpans.filter(
+    (s) => isRootOrServer(s) && (oldCohortKey ? getCohortOfSpan(s) === oldCohortKey : getCohortOfSpan(s) !== null && getCohortOfSpan(s) !== newCohortKey)
+  );
+  const postOldDown = postSpans.filter(
+    (s) => isDownstreamCall(s) && (oldCohortKey ? getCohortOfSpan(s) === oldCohortKey : getCohortOfSpan(s) !== null && getCohortOfSpan(s) !== newCohortKey)
+  );
+  const preOldReq = preSpans.filter(
+    (s) => isRootOrServer(s) && (!oldCohortKey || getCohortOfSpan(s) === oldCohortKey)
+  );
+  const preOldDown = preSpans.filter(
+    (s) => isDownstreamCall(s) && (!oldCohortKey || getCohortOfSpan(s) === oldCohortKey)
+  );
+  const newCohort = summarizeCohort(newCohortKey, postNewReq, postNewDown);
+  const oldCohort = summarizeCohort(oldCohortKey, postOldReq, postOldDown);
+  const preBaseline = summarizeCohort(
+    `${oldCohortKey}:pre`,
+    preOldReq,
+    preOldDown
+  );
+  const overlappingSet = /* @__PURE__ */ new Set();
+  const matchingErrorSpanIds = [];
+  if (change.touchedPaths.length > 0) {
+    for (const s of postNewReq.filter((sp) => sp.status_code === 2)) {
+      const rawPaths = extractFilePathsFromSpan(s);
+      let matchedSpan = false;
+      for (const touched of change.touchedPaths) {
+        if (rawPaths.some((raw) => raw.includes(touched))) {
+          overlappingSet.add(touched);
+          matchedSpan = true;
+        }
+      }
+      if (matchedSpan) {
+        matchingErrorSpanIds.push(s.span_id);
+      }
+    }
+  }
+  const overlappingCodePaths = Array.from(overlappingSet);
+  let cohortVerdict = "insufficient_sample";
+  let causalProofTier = "unverified_locus";
+  let rateDifference = 0;
+  let relativeRisk = 1;
+  const sharedResourceAggressors = [];
+  if (newCohort.requestCount < minSample) {
+    cohortVerdict = "insufficient_sample";
+    causalProofTier = overlappingCodePaths.length > 0 ? "corroborated_candidate" : "unverified_locus";
+  } else if (oldCohort.requestCount >= minSample) {
+    rateDifference = newCohort.errorRate - oldCohort.errorRate;
+    relativeRisk = newCohort.errorRate / Math.max(oldCohort.errorRate, 1e-3);
+    const fanoutRatio = newCohort.avgDownstreamCallsPerRequest / Math.max(oldCohort.avgDownstreamCallsPerRequest, 0.25);
+    const durationRatio = (newCohort.avgDownstreamDurationMs ?? 0) / Math.max(oldCohort.avgDownstreamDurationMs ?? 1, 1);
+    const hasNewVersionAggressorSignal = fanoutRatio >= 3 || durationRatio >= 3;
+    const hasPreChangeDegradationSignal = preBaseline.requestCount >= 10 && oldCohort.errorRate > 1.5 * Math.max(preBaseline.errorRate, 0.01);
+    const bothDegraded = newCohort.errorRate >= 0.05 && oldCohort.errorRate >= 0.05 && (hasNewVersionAggressorSignal || hasPreChangeDegradationSignal);
+    if (bothDegraded) {
+      if (hasNewVersionAggressorSignal) {
+        cohortVerdict = "shared_degradation_new_version_aggressor";
+        causalProofTier = "corroborated_candidate";
+        const sampleTarget = postNewDown.find(
+          (d) => d.target_node_id
+        )?.target_node_id;
+        if (sampleTarget) {
+          const victimTrace = postOldReq.find((r) => r.status_code === 2)?.trace_id ?? "victim";
+          const candidates = await findCrossTraceContention(db, {
+            projectId,
+            environment: change.environment,
+            targetNodeId: sampleTarget,
+            excludeTraceId: victimTrace,
+            startTime: change.occurredAt,
+            endTime: (/* @__PURE__ */ new Date()).toISOString()
+          });
+          sharedResourceAggressors.push(...candidates);
+        }
+      } else {
+        cohortVerdict = "shared_degradation_external_cause";
+        causalProofTier = "unverified_locus";
+      }
+    } else {
+      const p95Ratio = newCohort.p95DurationMs !== null && oldCohort.p95DurationMs !== null && oldCohort.p95DurationMs > 0 ? newCohort.p95DurationMs / oldCohort.p95DurationMs : 1;
+      if ((rateDifference >= 0.05 || p95Ratio >= 2.5) && (relativeRisk >= 5 || p95Ratio >= 2.5)) {
+        cohortVerdict = "isolated_to_new_version";
+        causalProofTier = "cohort_rate_isolated";
+      } else {
+        cohortVerdict = "no_regression_detected";
+        causalProofTier = "unverified_locus";
+      }
+    }
+  } else if (preBaseline.requestCount >= minSample) {
+    rateDifference = newCohort.errorRate - preBaseline.errorRate;
+    relativeRisk = newCohort.errorRate / Math.max(preBaseline.errorRate, 1e-3);
+    const p95Ratio = newCohort.p95DurationMs !== null && preBaseline.p95DurationMs !== null && preBaseline.p95DurationMs > 0 ? newCohort.p95DurationMs / preBaseline.p95DurationMs : 1;
+    if ((rateDifference >= 0.05 || p95Ratio >= 2.5) && (relativeRisk >= 5 || p95Ratio >= 2.5)) {
+      cohortVerdict = "sequential_post_cutover_regression";
+      causalProofTier = "corroborated_candidate";
+    } else {
+      cohortVerdict = "no_regression_detected";
+      causalProofTier = "unverified_locus";
+    }
+  } else if (overlappingCodePaths.length > 0) {
+    cohortVerdict = "insufficient_sample";
+    causalProofTier = "corroborated_candidate";
+  }
+  const relationshipCertainty = overlappingCodePaths.length > 0 ? "exact" : change.relationshipCertainty;
+  const summary = `Change ${change.id} (${change.kind} ${newCohortKey} in ${change.environment}): verdict=${cohortVerdict}, proofTier=${causalProofTier}, newErrorRate=${(newCohort.errorRate * 100).toFixed(1)}% (N=${newCohort.requestCount}), oldErrorRate=${(oldCohort.errorRate * 100).toFixed(1)}% (N=${oldCohort.requestCount})`;
+  return {
+    change,
+    cohortVerdict,
+    causalProofTier,
+    relationshipCertainty,
+    minComparableSample: minSample,
+    newCohort,
+    oldCohort,
+    preChangeBaselineCohort: preBaseline,
+    rateDifference,
+    relativeRisk,
+    overlappingCodePaths,
+    matchingErrorSpanIds,
+    sharedResourceAggressors,
+    summary
   };
-  if (typeof turnIndex === "number") attrs["llm.turn"] = turnIndex;
-  return config.tracer(
-    "llm.anthropic.messages",
-    async (span) => exec(span),
-    attrs
-  );
 }
 
-// src/plugins/ask-routes.ts
-var MAX_QUESTION_CHARS = 1e3;
-var askRoutesPlugin = {
-  name: "ask-routes",
+// src/plugins/autosre-routes.ts
+var CHANGE_KINDS = /* @__PURE__ */ new Set([
+  "deploy",
+  "rollback",
+  "feature_flag",
+  "config_change",
+  "prompt_rollout",
+  "agent_version",
+  "schema_migration",
+  "infra_scale"
+]);
+var REMEDIATION_ACTION_KINDS = /* @__PURE__ */ new Set([
+  "open_code_pr",
+  "toggle_feature_flag",
+  "rollback_deploy",
+  "apply_config",
+  "promote_agent_prompt"
+]);
+var parseLimit = (raw, fallback = 50) => {
+  const parsed = Number.parseInt(raw ?? String(fallback), 10);
+  if (!Number.isFinite(parsed)) return fallback;
+  return Math.max(1, Math.min(200, parsed));
+};
+var isAgentAutonomyLevel = (value) => typeof value === "string" && Object.values(AgentAutonomyLevel2).includes(value);
+function requireHumanDashboardSession(c) {
+  const authHeader = c.req.header("Authorization");
+  if (authHeader) {
+    return {
+      ok: false,
+      message: "Human approval requires an authenticated human dashboard session (obs_session cookie); agent/API bearer tokens cannot self-approve or reject remediation proposals."
+    };
+  }
+  const cookieHeader = c.req.header("Cookie") ?? "";
+  const match = cookieHeader.match(/(?:^|;\s*)obs_session=([^;]*)/);
+  if (!match || !match[1]) {
+    return {
+      ok: false,
+      message: "Human approval requires an authenticated human dashboard session (obs_session cookie)."
+    };
+  }
+  const explicitActor = c.req.header("X-Obs-User-Actor")?.trim();
+  const rawSession = decodeURIComponent(match[1]);
+  const sessionActor = explicitActor || `dashboard_session:${rawSession.slice(0, 24)}`;
+  return { ok: true, sessionActor };
+}
+var autosreRoutesPlugin = {
+  name: "autosre-routes",
   register(app, runtime) {
-    app.post("/internal/ask", async (c) => {
+    app.post("/v1/changes", async (c) => {
+      const projectId = getProjectId(c);
       const body = await readJsonObject(c);
       if (!body) {
+        return c.json({ error: "Invalid JSON body" }, 400);
+      }
+      const rawKind = typeof body.kind === "string" ? body.kind.trim() : "deploy";
+      const normalizedKind = rawKind === "agent_prompt_release" ? "prompt_rollout" : rawKind;
+      if (!CHANGE_KINDS.has(normalizedKind)) {
         return c.json(
-          { error: "Bad Request", message: "body must be a JSON object" },
+          {
+            error: `Invalid change kind: ${String(body.kind)}. Must be one of: ${Array.from(CHANGE_KINDS).join(", ")}`
+          },
           400
         );
       }
-      const question = (body.question ?? "").trim();
-      if (!question) {
+      const summary = typeof body.summary === "string" ? body.summary.trim() : "";
+      if (!summary) {
+        return c.json({ error: "summary is required" }, 400);
+      }
+      const db = runtime.getSqlDb(c.env);
+      const touchedPaths = Array.isArray(body.touchedPaths) ? body.touchedPaths.filter((p) => typeof p === "string") : void 0;
+      const rawAttrs = body.attributes ?? body.metadata;
+      const attributes = rawAttrs && typeof rawAttrs === "object" && !Array.isArray(rawAttrs) ? rawAttrs : void 0;
+      const serviceName = typeof body.serviceName === "string" ? body.serviceName : typeof body.service === "string" ? body.service : void 0;
+      const namespace = typeof body.namespace === "string" ? body.namespace : typeof body.serviceNamespace === "string" ? body.serviceNamespace : void 0;
+      const repositoryUrl = typeof body.repositoryUrl === "string" ? body.repositoryUrl : typeof body.repoUrl === "string" ? body.repoUrl : null;
+      const pullRequestUrl = typeof body.pullRequestUrl === "string" ? body.pullRequestUrl : typeof body.prUrl === "string" ? body.prUrl : null;
+      const actorId = typeof body.actorId === "string" ? body.actorId : typeof body.actor === "string" ? body.actor : null;
+      const changeEvent = await recordChangeEvent(db, projectId, {
+        id: typeof body.id === "string" ? body.id : void 0,
+        environment: typeof body.environment === "string" ? body.environment : void 0,
+        kind: normalizedKind,
+        source: body.source === "inferred_telemetry" || body.source === "autosre_remediation" ? body.source : "explicit_api",
+        targetNodeId: typeof body.targetNodeId === "string" ? body.targetNodeId : void 0,
+        serviceName,
+        namespace,
+        version: typeof body.version === "string" ? body.version : null,
+        previousVersion: typeof body.previousVersion === "string" ? body.previousVersion : null,
+        commitSha: typeof body.commitSha === "string" ? body.commitSha : null,
+        previousCommitSha: typeof body.previousCommitSha === "string" ? body.previousCommitSha : null,
+        configDigest: typeof body.configDigest === "string" ? body.configDigest : null,
+        summary,
+        actorId,
+        repositoryUrl,
+        pullRequestUrl,
+        causedByActionId: typeof body.causedByActionId === "string" ? body.causedByActionId : null,
+        agentRunId: typeof body.agentRunId === "string" ? body.agentRunId : null,
+        touchedPaths,
+        attributes,
+        occurredAt: typeof body.occurredAt === "string" ? body.occurredAt : void 0
+      });
+      return c.json({ changeEvent, change: changeEvent }, 201);
+    });
+    app.get("/internal/ontology", async (c) => {
+      const projectId = getProjectId(c);
+      const db = sqlDbFor(c.env);
+      const environment = c.req.query("environment") || void 0;
+      const traceId = c.req.query("traceId") || void 0;
+      const graph = await getOntologyGraph(db, {
+        projectId,
+        environment
+      });
+      const faultLocus = traceId ? await loadTraceFaultLocusFromDb(db, projectId, traceId) : null;
+      return c.json({
+        ...graph,
+        faultLocus
+      });
+    });
+    app.get("/internal/changes", async (c) => {
+      const projectId = getProjectId(c);
+      const db = sqlDbFor(c.env);
+      const rawKind = c.req.query("kind");
+      const normalizedKind = rawKind === "agent_prompt_release" ? "prompt_rollout" : rawKind;
+      if (normalizedKind && !CHANGE_KINDS.has(normalizedKind)) {
+        return c.json({ error: `Invalid kind: ${rawKind}` }, 400);
+      }
+      const changes2 = await listChangeEvents(db, {
+        projectId,
+        environment: c.req.query("environment") || void 0,
+        serviceName: c.req.query("serviceName") || c.req.query("service") || void 0,
+        targetNodeId: c.req.query("targetNodeId") || void 0,
+        kind: normalizedKind || void 0,
+        since: c.req.query("since") || void 0,
+        limit: parseLimit(c.req.query("limit"), 50)
+      });
+      return c.json({ changes: changes2 });
+    });
+    app.get("/internal/changes/:id/blast-radius", async (c) => {
+      const projectId = getProjectId(c);
+      const changeId = c.req.param("id");
+      if (!changeId) {
+        return c.json({ error: "changeId is required" }, 400);
+      }
+      const db = sqlDbFor(c.env);
+      const minSampleRaw = c.req.query("minSample") ?? c.req.query("minComparableSample");
+      const minSample = minSampleRaw ? Number.parseInt(minSampleRaw, 10) : void 0;
+      const blastRadius = await computeChangeBlastRadius(
+        db,
+        projectId,
+        changeId,
+        {
+          environment: c.req.query("environment") || void 0,
+          minComparableSample: minSample !== void 0 && Number.isFinite(minSample) ? minSample : void 0
+        }
+      );
+      if (!blastRadius) {
+        return c.json({ error: "Change event not found" }, 404);
+      }
+      return c.json({ blastRadius, ...blastRadius });
+    });
+    app.get("/internal/incidents", async (c) => {
+      const projectId = getProjectId(c);
+      const db = sqlDbFor(c.env);
+      const incidents = await listIncidentInvestigations(db, {
+        projectId,
+        environment: c.req.query("environment") || void 0,
+        status: c.req.query("status") || void 0,
+        limit: parseLimit(c.req.query("limit"), 50)
+      });
+      return c.json({ incidents });
+    });
+    app.post("/internal/incidents", async (c) => {
+      const projectId = getProjectId(c);
+      const body = await readJsonObject(c);
+      if (!body) {
+        return c.json({ error: "Invalid JSON body" }, 400);
+      }
+      const targetNodeId = typeof body.targetNodeId === "string" ? body.targetNodeId.trim() : typeof body.symptomNodeId === "string" ? body.symptomNodeId.trim() : "";
+      if (!targetNodeId) {
+        return c.json({ error: "targetNodeId is required" }, 400);
+      }
+      const symptomAnchorKind = typeof body.symptomAnchorKind === "string" ? body.symptomAnchorKind : typeof body.triggerKind === "string" ? body.triggerKind : "alert";
+      const symptomAnchorId = typeof body.symptomAnchorId === "string" ? body.symptomAnchorId : typeof body.triggerEntityId === "string" ? body.triggerEntityId : targetNodeId;
+      const db = sqlDbFor(c.env);
+      const result = await openOrDeduplicateIncident(db, projectId, {
+        id: typeof body.id === "string" ? body.id : void 0,
+        environment: typeof body.environment === "string" ? body.environment : void 0,
+        targetNodeId,
+        symptomCategory: typeof body.symptomCategory === "string" ? body.symptomCategory : void 0,
+        symptomAnchorKind,
+        symptomAnchorId,
+        symptomFingerprint: typeof body.symptomFingerprint === "string" ? body.symptomFingerprint : typeof body.fingerprint === "string" ? body.fingerprint : null,
+        latestBundle: body.latestBundle && typeof body.latestBundle === "object" && !Array.isArray(body.latestBundle) ? body.latestBundle : null
+      });
+      return c.json(result, result.deduplicated ? 200 : 201);
+    });
+    app.post("/internal/incidents/:id/lease", async (c) => {
+      const projectId = getProjectId(c);
+      const incidentId = c.req.param("id");
+      const body = await readJsonObject(c);
+      if (!body) {
+        return c.json({ error: "Invalid JSON body" }, 400);
+      }
+      const runnerId = typeof body.runnerId === "string" ? body.runnerId.trim() : typeof body.leaseOwner === "string" ? body.leaseOwner.trim() : "";
+      if (!runnerId) {
+        return c.json({ error: "runnerId is required" }, 400);
+      }
+      const db = sqlDbFor(c.env);
+      const leaseDurationSeconds = typeof body.leaseDurationSeconds === "number" && Number.isFinite(body.leaseDurationSeconds) ? body.leaseDurationSeconds : typeof body.leaseDurationMs === "number" && Number.isFinite(body.leaseDurationMs) ? Math.ceil(body.leaseDurationMs / 1e3) : void 0;
+      const result = await acquireIncidentLease(db, projectId, incidentId, {
+        environment: typeof body.environment === "string" ? body.environment : void 0,
+        runnerId,
+        leaseDurationSeconds
+      });
+      return c.json(result, result.acquired ? 200 : 409);
+    });
+    app.post("/internal/incidents/:id/dispatch", async (c) => {
+      const projectId = getProjectId(c);
+      const incidentId = c.req.param("id");
+      const body = await readJsonObject(c);
+      const webhookUrl = typeof body?.webhookUrl === "string" ? body.webhookUrl : typeof body?.url === "string" ? body.url : "";
+      if (!webhookUrl) {
+        return c.json({ error: "webhookUrl is required" }, 400);
+      }
+      const db = sqlDbFor(c.env);
+      const result = await dispatchIncidentWebhook(db, projectId, incidentId, {
+        url: webhookUrl,
+        secret: typeof body?.secret === "string" ? body.secret : void 0,
+        allowPrivateNetworks: Boolean(
+          body?.allowPrivateNetworks ?? body?.allowPrivateWebhookTargets
+        )
+      });
+      return c.json(result, result.delivered ? 200 : 502);
+    });
+    app.get("/internal/findings", async (c) => {
+      const projectId = getProjectId(c);
+      const db = sqlDbFor(c.env);
+      const findings = await searchInvestigationFindings(db, {
+        projectId,
+        environment: c.req.query("environment") || void 0,
+        fingerprint: c.req.query("fingerprint") || void 0,
+        symptomEntityId: c.req.query("symptomEntityId") || void 0,
+        rootCauseEntityId: c.req.query("rootCauseEntityId") || c.req.query("faultLocusEntityId") || void 0,
+        causalVerificationStatus: c.req.query("causalVerificationStatus") || void 0,
+        incidentId: c.req.query("incidentId") || void 0,
+        limit: parseLimit(c.req.query("limit"), 20)
+      });
+      return c.json({ findings });
+    });
+    app.post("/internal/findings", async (c) => {
+      const projectId = getProjectId(c);
+      const body = await readJsonObject(c);
+      if (!body) {
+        return c.json({ error: "Invalid JSON body" }, 400);
+      }
+      const title = typeof body.title === "string" ? body.title.trim() : "";
+      const summary = typeof body.summary === "string" ? body.summary.trim() : "";
+      const symptomEntityKind = typeof body.symptomEntityKind === "string" ? body.symptomEntityKind.trim() : "";
+      const symptomEntityId = typeof body.symptomEntityId === "string" ? body.symptomEntityId.trim() : "";
+      const faultLocusEntityKind = typeof body.faultLocusEntityKind === "string" ? body.faultLocusEntityKind.trim() : "";
+      const faultLocusEntityId = typeof body.faultLocusEntityId === "string" ? body.faultLocusEntityId.trim() : "";
+      if (!title || !summary || !symptomEntityKind || !symptomEntityId || !faultLocusEntityKind || !faultLocusEntityId) {
         return c.json(
-          { error: "Bad Request", message: "question is required" },
+          {
+            error: "title, summary, symptomEntityKind, symptomEntityId, faultLocusEntityKind, and faultLocusEntityId are required"
+          },
           400
         );
       }
-      if (question.length > MAX_QUESTION_CHARS) {
+      const db = sqlDbFor(c.env);
+      const input = {
+        id: typeof body.id === "string" ? body.id : void 0,
+        environment: typeof body.environment === "string" ? body.environment : void 0,
+        incidentId: typeof body.incidentId === "string" ? body.incidentId : null,
+        fingerprintInput: body.fingerprintInput && typeof body.fingerprintInput === "object" ? body.fingerprintInput : void 0,
+        title,
+        summary,
+        causalProofTier: typeof body.causalProofTier === "string" ? body.causalProofTier : void 0,
+        confidence: typeof body.confidence === "number" ? body.confidence : void 0,
+        symptomEntityKind,
+        symptomEntityId,
+        faultLocusEntityKind,
+        faultLocusEntityId,
+        rootCauseEntityKind: typeof body.rootCauseEntityKind === "string" ? body.rootCauseEntityKind : null,
+        rootCauseEntityId: typeof body.rootCauseEntityId === "string" ? body.rootCauseEntityId : null,
+        contributingChangeId: typeof body.contributingChangeId === "string" ? body.contributingChangeId : null,
+        cohortVerdict: typeof body.cohortVerdict === "string" ? body.cohortVerdict : null,
+        contendingTraceId: typeof body.contendingTraceId === "string" ? body.contendingTraceId : null,
+        causalChain: Array.isArray(body.causalChain) ? body.causalChain : [],
+        citedEvidenceIds: Array.isArray(body.citedEvidenceIds) ? body.citedEvidenceIds.filter(
+          (id) => typeof id === "string"
+        ) : [],
+        agentRunId: typeof body.agentRunId === "string" ? body.agentRunId : null
+      };
+      const finding = await recordInvestigationFinding(db, projectId, input);
+      return c.json({ finding, id: finding.id }, 201);
+    });
+    app.post("/internal/findings/:id/counterfactual", async (c) => {
+      const projectId = getProjectId(c);
+      const findingId = c.req.param("id");
+      const body = await readJsonObject(c);
+      if (!body) {
+        return c.json({ error: "Invalid JSON body" }, 400);
+      }
+      const evalCaseId = typeof body.evalCaseId === "string" ? body.evalCaseId.trim() : "";
+      const failingRunId = typeof body.failingRunId === "string" ? body.failingRunId.trim() : "";
+      const passingRunIds = Array.isArray(body.passingRunIds) ? body.passingRunIds.filter(
+        (id) => typeof id === "string" && id.trim() !== ""
+      ) : [];
+      if (!evalCaseId || !failingRunId) {
         return c.json(
+          { error: "evalCaseId and failingRunId are required" },
+          400
+        );
+      }
+      const db = sqlDbFor(c.env);
+      try {
+        const finding = await verifyPairedCounterfactualProof(
+          db,
+          projectId,
+          findingId,
           {
-            error: "Bad Request",
-            message: `question exceeds ${MAX_QUESTION_CHARS} chars`
+            environment: typeof body.environment === "string" ? body.environment : void 0,
+            evalCaseId,
+            failingRunId,
+            passingRunIds,
+            requiredTrials: typeof body.requiredTrials === "number" && Number.isFinite(body.requiredTrials) ? body.requiredTrials : void 0
+          }
+        );
+        return c.json({ verified: true, finding });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (err instanceof CounterfactualVerificationError) {
+          const isNotFound2 = message.includes("not found in project");
+          return c.json(
+            { verified: false, error: message, reason: message },
+            isNotFound2 ? 404 : 422
+          );
+        }
+        return c.json({ verified: false, error: message }, 400);
+      }
+    });
+    app.get("/internal/remediations", async (c) => {
+      const projectId = getProjectId(c);
+      const db = sqlDbFor(c.env);
+      const proposals = await listRemediationProposals(db, {
+        projectId,
+        environment: c.req.query("environment") || void 0,
+        incidentId: c.req.query("incidentId") || void 0,
+        findingId: c.req.query("findingId") || void 0,
+        status: c.req.query("status") || void 0,
+        limit: parseLimit(c.req.query("limit"), 50)
+      });
+      return c.json({ proposals });
+    });
+    app.post("/internal/remediations/propose", async (c) => {
+      const projectId = getProjectId(c);
+      const body = await readJsonObject(c);
+      if (!body) {
+        return c.json({ error: "Invalid JSON body" }, 400);
+      }
+      const incidentId = typeof body.incidentId === "string" ? body.incidentId.trim() : "";
+      const findingId = typeof body.findingId === "string" ? body.findingId.trim() : "";
+      const idempotencyKey = typeof body.idempotencyKey === "string" ? body.idempotencyKey.trim() : "";
+      const actionKind = typeof body.actionKind === "string" ? body.actionKind.trim() : "";
+      const targetNodeId = typeof body.targetNodeId === "string" ? body.targetNodeId.trim() : "";
+      if (!incidentId || !findingId || !idempotencyKey || !REMEDIATION_ACTION_KINDS.has(actionKind) || !targetNodeId) {
+        return c.json(
+          {
+            error: "incidentId, findingId, idempotencyKey, valid actionKind, and targetNodeId are required"
           },
           400
         );
       }
+      const expectedCurrentState = body.expectedCurrentState && typeof body.expectedCurrentState === "object" && !Array.isArray(body.expectedCurrentState) ? body.expectedCurrentState : {};
+      const desiredTargetState = body.desiredTargetState && typeof body.desiredTargetState === "object" && !Array.isArray(body.desiredTargetState) ? body.desiredTargetState : {};
+      const requestedAutonomy = isAgentAutonomyLevel(
+        body.requestedAutonomy
+      ) ? body.requestedAutonomy : "autonomous_write";
+      const db = sqlDbFor(c.env);
+      const input = {
+        environment: typeof body.environment === "string" ? body.environment : void 0,
+        incidentId,
+        findingId,
+        idempotencyKey,
+        actionKind,
+        targetNodeId,
+        expectedCurrentState,
+        desiredTargetState,
+        requestedAutonomy
+      };
+      try {
+        const proposal = await proposeRemediationAction(db, projectId, input);
+        return c.json(
+          {
+            proposal,
+            ...proposal,
+            grantToken: proposal.grantToken ?? null
+          },
+          201
+        );
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const status = err instanceof RemediationGateError ? err.statusCode : 400;
+        return c.json({ error: message }, status);
+      }
+    });
+    app.post("/internal/remediations/:id/approve", async (c) => {
+      const sessionCheck = requireHumanDashboardSession(c);
+      if (!sessionCheck.ok) {
+        return c.json(
+          { error: "Forbidden", message: sessionCheck.message },
+          403
+        );
+      }
       const projectId = getProjectId(c);
-      const openaiBase = c.env.OPENAI_BASE_URL?.trim() ? c.env.OPENAI_BASE_URL : void 0;
-      const narrativeModel = c.env.NARRATIVE_MODEL?.trim() ? c.env.NARRATIVE_MODEL : void 0;
-      const llm = c.env.OPENAI_API_KEY?.trim() ? {
-        provider: "openai",
-        apiKey: c.env.OPENAI_API_KEY,
-        model: narrativeModel ?? "gpt-4o-mini",
-        apiUrl: openaiBase,
-        tracer: runtime.withChildSpan
-      } : c.env.ANTHROPIC_API_KEY?.trim() ? {
-        provider: "anthropic",
-        apiKey: c.env.ANTHROPIC_API_KEY,
-        model: narrativeModel ?? "claude-haiku-4-5",
-        tracer: runtime.withChildSpan
-      } : null;
-      if (!llm) {
-        const response = {
-          answer: null,
-          evidence: [],
-          queries: [],
-          error: "Ask is not configured \u2014 set OPENAI_API_KEY or ANTHROPIC_API_KEY on the collector to enable it.",
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        };
-        return c.json(response, 503);
+      const proposalId = c.req.param("id");
+      const body = await readJsonObject(c).catch(() => null) ?? {};
+      const environment = typeof body.environment === "string" ? body.environment : void 0;
+      const approvedByUserId = typeof body.approvedByUserId === "string" && body.approvedByUserId.trim() ? body.approvedByUserId.trim() : typeof body.approvedBySession === "string" && body.approvedBySession.trim() ? body.approvedBySession.trim() : sessionCheck.sessionActor;
+      const db = sqlDbFor(c.env);
+      try {
+        const proposal = await approveRemediationProposal(
+          db,
+          projectId,
+          proposalId,
+          {
+            environment,
+            approvedByUserId
+          }
+        );
+        return c.json({
+          proposal,
+          ...proposal,
+          grantToken: proposal.grantToken ?? null
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const status = err instanceof RemediationGateError ? err.statusCode : 400;
+        return c.json({ error: message }, status);
       }
-      const store = new AnalysesStore(sqlDbFor(c.env));
+    });
+    app.post("/internal/remediations/:id/reject", async (c) => {
+      const sessionCheck = requireHumanDashboardSession(c);
+      if (!sessionCheck.ok) {
+        return c.json(
+          { error: "Forbidden", message: sessionCheck.message },
+          403
+        );
+      }
+      const projectId = getProjectId(c);
+      const proposalId = c.req.param("id");
+      const body = await readJsonObject(c).catch(() => null) ?? {};
+      const environment = typeof body.environment === "string" ? body.environment : void 0;
+      const reason = typeof body.reason === "string" ? body.reason : void 0;
+      const db = sqlDbFor(c.env);
+      try {
+        const proposal = await rejectRemediationProposal(
+          db,
+          projectId,
+          proposalId,
+          {
+            environment,
+            rejectedByUserId: sessionCheck.sessionActor,
+            reason
+          }
+        );
+        return c.json({ proposal, ...proposal });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const status = err instanceof RemediationGateError ? err.statusCode : 400;
+        return c.json({ error: message }, status);
+      }
+    });
+    app.post("/internal/remediations/:id/claim", async (c) => {
+      const projectId = getProjectId(c);
+      const proposalId = c.req.param("id");
+      const body = await readJsonObject(c);
+      if (!body) {
+        return c.json({ error: "Invalid JSON body" }, 400);
+      }
+      const grantToken = typeof body.grantToken === "string" ? body.grantToken.trim() : "";
+      if (!grantToken) {
+        return c.json({ error: "grantToken is required" }, 400);
+      }
+      const db = sqlDbFor(c.env);
+      try {
+        const proposal = await claimRemediationGrant(
+          db,
+          projectId,
+          proposalId,
+          {
+            environment: typeof body.environment === "string" ? body.environment : void 0,
+            grantToken,
+            runnerId: typeof body.runnerId === "string" ? body.runnerId : void 0
+          }
+        );
+        return c.json({ claimed: true, proposal, ...proposal });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const status = err instanceof RemediationGateError ? err.statusCode : 409;
+        return c.json({ claimed: false, error: message, reason: message }, status);
+      }
+    });
+    app.post("/internal/remediations/:id/complete", async (c) => {
+      const projectId = getProjectId(c);
+      const proposalId = c.req.param("id");
+      const body = await readJsonObject(c).catch(() => null) ?? {};
+      const db = sqlDbFor(c.env);
+      try {
+        const proposal = await completeRemediationProposal(
+          db,
+          projectId,
+          proposalId,
+          {
+            environment: typeof body.environment === "string" ? body.environment : void 0,
+            resultingChangeId: typeof body.resultingChangeId === "string" ? body.resultingChangeId : null,
+            remediationAgentRunId: typeof body.remediationAgentRunId === "string" ? body.remediationAgentRunId : null
+          }
+        );
+        return c.json({ proposal, ...proposal });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const status = err instanceof RemediationGateError ? err.statusCode : 400;
+        return c.json({ error: message }, status);
+      }
+    });
+    app.post("/internal/remediations/:id/fail", async (c) => {
+      const projectId = getProjectId(c);
+      const proposalId = c.req.param("id");
+      const body = await readJsonObject(c).catch(() => null) ?? {};
+      const db = sqlDbFor(c.env);
       try {
-        const startedAt = Date.now();
-        runtime.logger.info("[ask] llm call starting", {
-          project_id: projectId,
-          provider: llm.provider,
-          model: llm.model,
-          question_chars: question.length
-        });
-        const result = await runtime.withChildSpan(
-          "ask.runAsk",
-          () => runAsk(question, {
-            llm,
-            listAnalyses: async (filters) => {
-              const all = await getAllAnalysesForProject(projectId, {
-                db: sqlDbFor(c.env)
-              });
-              return all.filter((d) => {
-                if (filters?.group && d.group !== filters.group) return false;
-                if (filters?.view && d.view !== filters.view) return false;
-                return true;
-              });
-            },
-            getLatestResult: async (id) => {
-              const definitions = await store.listDefinitions(projectId);
-              const definition = definitions.find((d) => d.id === id);
-              if (!definition) return null;
-              const r = await store.getLatestResult(projectId, id);
-              return { definition, result: r };
-            }
-          }),
+        const proposal = await failRemediationProposal(
+          db,
+          projectId,
+          proposalId,
           {
-            "llm.provider": llm.provider,
-            "llm.model": llm.model,
-            "openinference.span.kind": "LLM"
+            environment: typeof body.environment === "string" ? body.environment : void 0,
+            failureReason: typeof body.failureReason === "string" ? body.failureReason : "Execution failed"
           }
         );
-        runtime.logger.info("[ask] llm call finished", {
-          project_id: projectId,
-          provider: llm.provider,
-          model: llm.model,
-          latency_ms: Date.now() - startedAt,
-          evidence_count: result.evidence.length,
-          query_count: result.queries.length,
-          answered: Boolean(result.answer)
-        });
-        if (result.answer && result.evidence.length > 0) {
-          await store.recordAskEvidence(
-            projectId,
-            result.evidence.map((e) => e.analysisId)
-          ).catch(
-            (err) => runtime.logger.warn("[ask] recordAskEvidence failed", {
-              error: err instanceof Error ? err.message : String(err)
-            })
-          );
-        }
-        return c.json(result);
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        runtime.logger.error("[ask] failed", { error: message });
-        const response = {
-          answer: null,
-          evidence: [],
-          queries: [],
-          error: message,
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        };
-        return c.json(response, 500);
+        return c.json({ proposal, ...proposal });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const status = err instanceof RemediationGateError ? err.statusCode : 400;
+        return c.json({ error: message }, status);
+      }
+    });
+    app.post("/internal/remediations/watchdog", async (c) => {
+      const db = sqlDbFor(c.env);
+      const body = await readJsonObject(c).catch(() => null) ?? {};
+      const summary = await evaluateRemediationWatchdogs(db, {
+        nowIso: typeof body.nowIso === "string" ? body.nowIso : void 0,
+        minComparableRequests: typeof body.minComparableRequests === "number" ? body.minComparableRequests : void 0
+      });
+      return c.json({ summary, ...summary });
+    });
+    app.get("/internal/remediations/:id", async (c) => {
+      const projectId = getProjectId(c);
+      const proposalId = c.req.param("id");
+      const db = sqlDbFor(c.env);
+      const proposal = await getRemediationProposal(
+        db,
+        projectId,
+        proposalId,
+        c.req.query("environment") || void 0
+      );
+      if (!proposal) {
+        return c.json({ error: "Proposal not found" }, 404);
+      }
+      return c.json({ proposal });
+    });
+    app.get("/internal/incidents/:id", async (c) => {
+      const projectId = getProjectId(c);
+      const incidentId = c.req.param("id");
+      const environment = c.req.query("environment") || void 0;
+      const db = sqlDbFor(c.env);
+      const incident = await getIncidentInvestigation(
+        db,
+        projectId,
+        incidentId,
+        environment
+      );
+      if (!incident) {
+        return c.json({ error: "Incident not found" }, 404);
+      }
+      const [findings, proposals] = await Promise.all([
+        searchInvestigationFindings(db, {
+          projectId,
+          environment: incident.environment,
+          incidentId: incident.id,
+          limit: 20
+        }),
+        listRemediationProposals(db, {
+          projectId,
+          environment: incident.environment,
+          incidentId: incident.id,
+          limit: 20
+        })
+      ]);
+      return c.json({ incident, findings, proposals });
+    });
+    app.get("/internal/findings/:id", async (c) => {
+      const projectId = getProjectId(c);
+      const findingId = c.req.param("id");
+      const db = sqlDbFor(c.env);
+      const finding = await getInvestigationFinding(
+        db,
+        projectId,
+        findingId,
+        c.req.query("environment") || void 0
+      );
+      if (!finding) {
+        return c.json({ error: "Finding not found" }, 404);
+      }
+      return c.json({ finding });
+    });
+    app.get("/internal/changes/:id", async (c) => {
+      const projectId = getProjectId(c);
+      const changeId = c.req.param("id");
+      const db = sqlDbFor(c.env);
+      const changeEvent = await getChangeEvent(
+        db,
+        projectId,
+        changeId,
+        c.req.query("environment") || void 0
+      );
+      if (!changeEvent) {
+        return c.json({ error: "Change event not found" }, 404);
       }
+      return c.json({ changeEvent, change: changeEvent });
     });
   }
 };
@@ -9940,7 +13310,10 @@ var KNOWN_KINDS = /* @__PURE__ */ new Set([
   "user",
   "action",
   "agent_run",
-  "tool_call"
+  "tool_call",
+  "change",
+  "finding",
+  "incident"
 ]);
 var MAX_LINKS_INLINE = 5;
 var truncate = (s, n = 80) => s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
@@ -11038,6 +14411,186 @@ var connectedRoutesPlugin = {
             manifest.rawManifest = actionManifest;
           }
         }
+      } else if (kind === "change") {
+        const db = sqlDbFor(c.env);
+        const changeRow = await db.prepare(
+          `SELECT * FROM change_events WHERE project_id = ? AND id = ? LIMIT 1`
+        ).bind(projectId, id).first();
+        if (changeRow) {
+          manifest.up = [
+            {
+              label: "Target Ontology Node",
+              links: [
+                {
+                  label: `${changeRow.target_node_id} (${changeRow.environment})`,
+                  href: `#/health?node=${encodeURIComponent(changeRow.target_node_id)}`,
+                  relationshipCertainty: "exact",
+                  reason: "Target node mutated by this change event."
+                }
+              ]
+            }
+          ];
+          const findings = await db.prepare(
+            `SELECT id, title, causal_proof_tier, confidence, incident_id
+							 FROM investigation_findings
+							 WHERE project_id = ? AND environment = ? AND contributing_change_id = ?
+							 ORDER BY created_at DESC LIMIT 10`
+          ).bind(projectId, changeRow.environment, changeRow.id).all();
+          manifest.down = [
+            {
+              label: "Attributed Findings",
+              links: findings.results.map((f) => ({
+                label: f.title,
+                href: `#/findings/${encodeURIComponent(f.id)}`,
+                entityKind: "finding",
+                entityId: f.id,
+                relationshipCertainty: "exact",
+                causalProofTier: f.causal_proof_tier,
+                confidence: f.confidence,
+                reason: "Finding attributes this change event."
+              })),
+              emptyReason: findings.results.length === 0 ? "No investigation findings cite this change event." : void 0
+            }
+          ];
+          const spans = changeRow.version ? await db.prepare(
+            `SELECT DISTINCT trace_id, span_id, service_name, span_name
+									 FROM telemetry_spans
+									 WHERE project_id = ? AND environment = ? AND service_version = ? AND status_code = 2
+									 ORDER BY start_time DESC LIMIT 5`
+          ).bind(projectId, changeRow.environment, changeRow.version).all() : { results: [] };
+          manifest.across = [
+            {
+              label: "Failing Spans on Cohort Version",
+              links: spans.results.map((s) => ({
+                label: `${s.service_name} \xB7 ${s.span_name}`,
+                href: `#/traces/${s.trace_id}#span=${s.span_id}`,
+                entityKind: "span",
+                entityId: `${s.trace_id}:${s.span_id}`,
+                relationshipCertainty: "exact",
+                reason: `Span executed on version ${changeRow.version}.`
+              })),
+              emptyReason: spans.results.length === 0 ? "No failing spans recorded on this change version." : void 0
+            }
+          ];
+        }
+      } else if (kind === "finding") {
+        const db = sqlDbFor(c.env);
+        const findingRow = await db.prepare(
+          `SELECT * FROM investigation_findings WHERE project_id = ? AND id = ? LIMIT 1`
+        ).bind(projectId, id).first();
+        if (findingRow) {
+          const proofTier = findingRow.causal_proof_tier;
+          manifest.up = [];
+          if (findingRow.incident_id) {
+            manifest.up.push({
+              label: "Incident Investigation",
+              links: [
+                {
+                  label: `incident ${findingRow.incident_id}`,
+                  href: `#/incidents/${encodeURIComponent(findingRow.incident_id)}`,
+                  entityKind: "incident",
+                  entityId: findingRow.incident_id,
+                  relationshipCertainty: "exact",
+                  causalProofTier: proofTier
+                }
+              ]
+            });
+          }
+          if (findingRow.contributing_change_id) {
+            manifest.up.push({
+              label: "Contributing Change",
+              links: [
+                {
+                  label: `change ${findingRow.contributing_change_id}`,
+                  href: `#/changes/${encodeURIComponent(findingRow.contributing_change_id)}`,
+                  entityKind: "change",
+                  entityId: findingRow.contributing_change_id,
+                  relationshipCertainty: "exact",
+                  causalProofTier: proofTier,
+                  confidence: findingRow.confidence
+                }
+              ]
+            });
+          }
+          manifest.across = [
+            {
+              label: "Fault Locus & Symptom",
+              links: [
+                {
+                  label: `fault locus: ${findingRow.fault_locus_entity_id}`,
+                  href: `#/traces?q=${encodeURIComponent(findingRow.fault_locus_entity_id)}`,
+                  relationshipCertainty: "exact",
+                  causalProofTier: proofTier
+                },
+                ...findingRow.contending_trace_id ? [
+                  {
+                    label: `contending trace ${findingRow.contending_trace_id}`,
+                    href: `#/traces/${encodeURIComponent(findingRow.contending_trace_id)}`,
+                    entityKind: "trace",
+                    entityId: findingRow.contending_trace_id,
+                    relationshipCertainty: "inferred",
+                    causalProofTier: proofTier
+                  }
+                ] : []
+              ]
+            }
+          ];
+          manifest.down = [
+            {
+              label: "Agent Lineage",
+              links: [
+                ...findingRow.agent_run_id ? [
+                  {
+                    ...linkToAgentRun(findingRow.agent_run_id),
+                    relationshipCertainty: "exact",
+                    causalProofTier: proofTier
+                  }
+                ] : []
+              ],
+              emptyReason: !findingRow.agent_run_id ? "No agent run linked to this finding." : void 0
+            }
+          ];
+        }
+      } else if (kind === "incident") {
+        const db = sqlDbFor(c.env);
+        const incRow = await db.prepare(
+          `SELECT * FROM incident_investigations WHERE project_id = ? AND id = ? LIMIT 1`
+        ).bind(projectId, id).first();
+        if (incRow) {
+          manifest.up = [
+            {
+              label: "Trigger Signal",
+              links: [
+                {
+                  label: `${incRow.symptom_anchor_kind}: ${incRow.symptom_anchor_id}`,
+                  href: `#/alerts?id=${encodeURIComponent(incRow.symptom_anchor_id)}`,
+                  entityKind: incRow.symptom_anchor_kind === "analysis" ? "analysis" : "alert",
+                  entityId: incRow.symptom_anchor_id,
+                  relationshipCertainty: "exact"
+                }
+              ]
+            }
+          ];
+          const incFindings = await db.prepare(
+            `SELECT id, title, causal_proof_tier FROM investigation_findings
+							 WHERE project_id = ? AND incident_id = ?
+							 ORDER BY created_at DESC LIMIT 5`
+          ).bind(projectId, incRow.id).all();
+          manifest.across = [
+            {
+              label: "Findings",
+              links: incFindings.results.map((f) => ({
+                label: f.title,
+                href: `#/findings/${encodeURIComponent(f.id)}`,
+                entityKind: "finding",
+                entityId: f.id,
+                relationshipCertainty: "exact",
+                causalProofTier: f.causal_proof_tier
+              })),
+              emptyReason: incFindings.results.length > 0 ? void 0 : "No finding recorded for this incident yet."
+            }
+          ];
+        }
       } else if (kind === "alert" || kind === "analysis") {
         manifest.related = [
           {
@@ -11143,7 +14696,7 @@ var defaultSpanEnrichmentPlugin = {
           const sessionId = typeof attributes[SESSION_ID_KEY2] === "string" && attributes[SESSION_ID_KEY2].length > 0 ? attributes[SESSION_ID_KEY2] : null;
           const interactionId = typeof attributes[INTERACTION_ID_KEY2] === "string" && attributes[INTERACTION_ID_KEY2].length > 0 ? attributes[INTERACTION_ID_KEY2] : null;
           const telemetrySdkName = typeof resourceAttributes["telemetry.sdk.name"] === "string" && resourceAttributes["telemetry.sdk.name"].length > 0 ? resourceAttributes["telemetry.sdk.name"] : null;
-          return {
+          const candidate = {
             ...span,
             serviceName,
             attributesJson: JSON.stringify(normalizedAttributes),
@@ -11151,6 +14704,15 @@ var defaultSpanEnrichmentPlugin = {
             interactionId,
             telemetrySdkName
           };
+          const lineage = extractSpanLineageAndTopology(candidate);
+          return {
+            ...candidate,
+            environment: lineage.environment,
+            serviceVersion: lineage.serviceVersion,
+            commitSha: lineage.commitSha,
+            targetNodeId: lineage.targetNode?.id ?? null,
+            errorSignature: lineage.errorSignature
+          };
         });
       }
     });
@@ -11311,8 +14873,18 @@ var rowToEvalRun = (row) => {
       promptVersion: row.candidate_prompt_version ?? null,
       modelProvider: row.candidate_model_provider ?? null,
       model: row.candidate_model ?? null,
-      modelVersion: row.candidate_model_version ?? null
+      modelVersion: row.candidate_model_version ?? null,
+      environment: row.environment ?? "default",
+      serviceVersion: row.service_version ?? null,
+      commitSha: row.commit_sha ?? null,
+      configDigest: row.config_digest ?? null
     },
+    environment: row.environment ?? "default",
+    serviceVersion: row.service_version ?? null,
+    commitSha: row.commit_sha ?? null,
+    configDigest: row.config_digest ?? null,
+    inputPayloadHash: row.input_payload_hash ?? null,
+    failureFingerprint: row.failure_fingerprint ?? null,
     startedAt: row.started_at ?? null,
     endedAt: row.ended_at ?? null,
     totalCount: row.total_count ?? 0,
@@ -11443,6 +15015,12 @@ var EvalCasesStore = class {
       if (!evalCase) throw new Error("evalCaseId does not reference a case");
     }
     const candidate = input.candidate ?? {};
+    const environment = input.environment?.trim() || candidate.environment?.trim() || "default";
+    const serviceVersion = input.serviceVersion?.trim() || candidate.serviceVersion?.trim() || null;
+    const commitSha = input.commitSha?.trim() || candidate.commitSha?.trim() || null;
+    const configDigest = input.configDigest?.trim() || candidate.configDigest?.trim() || null;
+    const inputPayloadHash = input.inputPayloadHash?.trim() || null;
+    const failureFingerprint = input.failureFingerprint?.trim() || null;
     const totalCount = nonNegativeInteger(input.totalCount);
     const passCount = nonNegativeInteger(input.passCount);
     const failCount = nonNegativeInteger(input.failCount);
@@ -11456,10 +15034,12 @@ var EvalCasesStore = class {
 					candidate_agent_id, candidate_agent_version,
 					candidate_prompt_id, candidate_prompt_version,
 					candidate_model_provider, candidate_model, candidate_model_version,
+					environment, service_version, commit_sha, config_digest,
+					input_payload_hash, failure_fingerprint,
 					status, started_at, ended_at,
 					total_count, pass_count, fail_count, average_score,
 					metadata_json, created_at
-				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
     ).bind(
       id,
       projectId,
@@ -11471,6 +15051,12 @@ var EvalCasesStore = class {
       candidate.modelProvider ?? null,
       candidate.model ?? null,
       candidate.modelVersion ?? null,
+      environment,
+      serviceVersion,
+      commitSha,
+      configDigest,
+      inputPayloadHash,
+      failureFingerprint,
       status,
       startedAt,
       endedAt,
@@ -11537,6 +15123,14 @@ var EvalCasesStore = class {
 					average_score = (
 						SELECT AVG(score) FROM eval_case_results
 						WHERE project_id = ? AND run_id = ? AND score IS NOT NULL
+					),
+					input_payload_hash = COALESCE(
+						input_payload_hash,
+						(SELECT input_payload_hash FROM eval_case_results WHERE project_id = ? AND run_id = ? AND input_payload_hash IS NOT NULL LIMIT 1)
+					),
+					failure_fingerprint = COALESCE(
+						failure_fingerprint,
+						(SELECT failure_fingerprint FROM eval_case_results WHERE project_id = ? AND run_id = ? AND failure_fingerprint IS NOT NULL LIMIT 1)
 					)
 				WHERE project_id = ? AND id = ?`
     ).bind(
@@ -11549,6 +15143,10 @@ var EvalCasesStore = class {
       projectId,
       id,
       projectId,
+      id,
+      projectId,
+      id,
+      projectId,
       id
     ).run();
   }
@@ -11829,7 +15427,7 @@ var badRequest = (message) => ({
   error: "Bad Request",
   message
 });
-var parseLimit = (value) => {
+var parseLimit2 = (value) => {
   const parsed = Number.parseInt(value ?? "50", 10);
   if (!Number.isFinite(parsed)) return 50;
   return Math.min(200, Math.max(1, parsed));
@@ -11928,7 +15526,7 @@ var evalCasesRoutesPlugin = {
         projectId: getProjectId(c),
         sourceEntityType,
         sourceEntityId: c.req.query("sourceEntityId"),
-        limit: parseLimit(c.req.query("limit"))
+        limit: parseLimit2(c.req.query("limit"))
       });
       return c.json({ evalCases });
     });
@@ -12000,6 +15598,12 @@ var evalCasesRoutesPlugin = {
         id: id ?? void 0,
         evalCaseId,
         status,
+        environment: asOptionalString(body.environment) ?? asOptionalString(candidate.environment),
+        serviceVersion: asOptionalString(body.serviceVersion) ?? asOptionalString(candidate.serviceVersion),
+        commitSha: asOptionalString(body.commitSha) ?? asOptionalString(candidate.commitSha),
+        configDigest: asOptionalString(body.configDigest) ?? asOptionalString(candidate.configDigest),
+        inputPayloadHash: asOptionalString(body.inputPayloadHash),
+        failureFingerprint: asOptionalString(body.failureFingerprint),
         candidate: {
           agentId: asOptionalString(candidate.agentId),
           agentVersion: asOptionalString(candidate.agentVersion),
@@ -12007,7 +15611,11 @@ var evalCasesRoutesPlugin = {
           promptVersion: asOptionalString(candidate.promptVersion),
           modelProvider: asOptionalString(candidate.modelProvider),
           model: asOptionalString(candidate.model),
-          modelVersion: asOptionalString(candidate.modelVersion)
+          modelVersion: asOptionalString(candidate.modelVersion),
+          environment: asOptionalString(candidate.environment) ?? asOptionalString(body.environment),
+          serviceVersion: asOptionalString(candidate.serviceVersion) ?? asOptionalString(body.serviceVersion),
+          commitSha: asOptionalString(candidate.commitSha) ?? asOptionalString(body.commitSha),
+          configDigest: asOptionalString(candidate.configDigest) ?? asOptionalString(body.configDigest)
         },
         startedAt: asOptionalString(body.startedAt),
         endedAt: asOptionalString(body.endedAt),
@@ -12040,7 +15648,7 @@ var evalCasesRoutesPlugin = {
         projectId: getProjectId(c),
         evalCaseId: c.req.query("evalCaseId"),
         status,
-        limit: parseLimit(c.req.query("limit"))
+        limit: parseLimit2(c.req.query("limit"))
       });
       return c.json({ evalRuns });
     });
@@ -12089,12 +15697,15 @@ var evalCasesRoutesPlugin = {
       const passed = body.passed ? 1 : 0;
       const score = typeof body.score === "number" && Number.isFinite(body.score) ? body.score : null;
       const actualOutcome = typeof body.actualOutcome === "string" ? body.actualOutcome : null;
+      const inputPayloadHash = typeof body.inputPayloadHash === "string" && body.inputPayloadHash.trim() ? body.inputPayloadHash.trim() : null;
+      const failureFingerprint = typeof body.failureFingerprint === "string" && body.failureFingerprint.trim() ? body.failureFingerprint.trim() : null;
       const details_json = body.details === void 0 ? null : JSON.stringify(body.details);
       const now = (/* @__PURE__ */ new Date()).toISOString();
       await db.prepare(
         `INSERT INTO eval_case_results (
-					id, project_id, eval_case_id, run_id, passed, score, actual_outcome, details_json, created_at
-				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+					id, project_id, eval_case_id, run_id, passed, score, actual_outcome,
+					input_payload_hash, failure_fingerprint, details_json, created_at
+				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
       ).bind(
         id,
         projectId,
@@ -12103,6 +15714,8 @@ var evalCasesRoutesPlugin = {
         passed,
         score,
         actualOutcome,
+        inputPayloadHash,
+        failureFingerprint,
         details_json,
         now
       ).run();
@@ -12116,6 +15729,8 @@ var evalCasesRoutesPlugin = {
         passed: body.passed,
         score,
         actualOutcome,
+        inputPayloadHash,
+        failureFingerprint,
         details: body.details ?? null,
         createdAt: now,
         evidenceReferences: evalCaseResultEvidenceReferences(evalCase, id),
@@ -12155,6 +15770,8 @@ var evalCasesRoutesPlugin = {
           passed: row.passed === 1,
           score: row.score,
           actualOutcome: row.actual_outcome,
+          inputPayloadHash: row.input_payload_hash ?? null,
+          failureFingerprint: row.failure_fingerprint ?? null,
           details: parseJsonMaybe(row.details_json),
           createdAt: row.created_at,
           evidenceReferences: evalCaseResultEvidenceReferences(
@@ -12417,6 +16034,7 @@ var DEFAULT_PROFILE_FRAME_LIMIT = 50;
 var MAX_PROFILE_FRAME_LIMIT = 200;
 var EVIDENCE_INTENTS = /* @__PURE__ */ new Set([
   "debug_failure",
+  "triage_incident",
   "explain_latency",
   "explain_cost",
   "inspect_agent_run",
@@ -13464,6 +17082,156 @@ var buildActionGraphBundle = (projectId, anchorKind, anchorId, manifest, profile
   };
   return bundle;
 };
+var attachAutoSreTriageContext = async (db, projectId, traceId, bundle) => {
+  try {
+    const faultLocus = traceId ? await loadTraceFaultLocusFromDb(db, projectId, traceId) : null;
+    const environment = (faultLocus?.faultLocusSpan?.environment ?? bundle.environment ?? "default").toLowerCase();
+    const recentChanges = await listChangeEvents(db, {
+      projectId,
+      environment,
+      limit: 5
+    });
+    const blastRadii = (await Promise.all(
+      recentChanges.slice(0, 3).map(
+        (ch) => computeChangeBlastRadius(db, projectId, ch.id, { environment })
+      )
+    )).filter((br) => Boolean(br));
+    const candidateChanges = blastRadii.map((br) => ({
+      changeId: br.change.id,
+      kind: br.change.kind,
+      version: br.change.version,
+      previousVersion: br.change.previousVersion,
+      occurredAt: br.change.occurredAt,
+      cohortVerdict: br.cohortVerdict,
+      causalProofTier: br.causalProofTier,
+      rateNew: br.newCohort.errorRate,
+      rateOld: br.oldCohort.errorRate,
+      sampleNew: br.newCohort.requestCount,
+      sampleOld: br.oldCohort.requestCount,
+      overlappingCodePaths: br.overlappingCodePaths
+    }));
+    const contentionCandidates = blastRadii.flatMap((br) => br.sharedResourceAggressors).map((ag) => ({
+      aggressorTraceId: ag.aggressorTraceId,
+      aggressorSpanId: ag.aggressorSpanId,
+      aggressorServiceName: ag.aggressorServiceName,
+      sharedTargetNodeId: ag.sharedTargetNodeId,
+      relationshipCertainty: ag.relationshipCertainty,
+      totalResourceTimeMs: ag.totalResourceTimeMs
+    }));
+    let priorFindingsList = await searchInvestigationFindings(db, {
+      projectId,
+      environment,
+      rootCauseEntityId: faultLocus?.faultLocusNodeId ?? faultLocus?.faultLocusSpan?.span_id ?? void 0,
+      limit: 5
+    });
+    if (priorFindingsList.length === 0 && faultLocus?.faultLocusSpan?.span_id) {
+      priorFindingsList = await searchInvestigationFindings(db, {
+        projectId,
+        environment,
+        rootCauseEntityId: faultLocus.faultLocusSpan.span_id,
+        limit: 5
+      });
+    }
+    if (priorFindingsList.length === 0) {
+      priorFindingsList = await searchInvestigationFindings(db, {
+        projectId,
+        environment,
+        limit: 5
+      });
+    }
+    const priorFindings = priorFindingsList.map((f) => ({
+      findingId: f.id,
+      title: f.title,
+      causalProofTier: f.causalProofTier,
+      causalVerificationStatus: f.causalVerificationStatus,
+      recoveryStatus: f.recoveryStatus,
+      contributingChangeId: f.contributingChangeId,
+      occurredAt: f.createdAt
+    }));
+    for (const br of blastRadii) {
+      const changeId = br.change.id;
+      const changeRoute = `#/changes/${encodeURIComponent(changeId)}`;
+      bundle.evidenceReferences.push({
+        evidenceId: `change:${changeId}`,
+        entityKind: "change",
+        entityId: changeId,
+        route: changeRoute,
+        source: br.overlappingCodePaths.length ? "stack_frame_overlap" : "cohort_comparison",
+        confidence: br.cohortVerdict === "isolated_to_new_version" ? 0.9 : 0.65,
+        relationshipCertainty: br.relationshipCertainty,
+        causalProofTier: br.causalProofTier,
+        reason: br.summary,
+        citations: [
+          {
+            label: `change ${changeId} (${br.change.version ?? br.change.kind})`,
+            entityKind: "change",
+            entityId: changeId,
+            route: changeRoute
+          }
+        ],
+        suggestedNextPivots: [
+          {
+            label: "Inspect change blast radius",
+            entityKind: "change",
+            entityId: changeId,
+            route: changeRoute,
+            reason: "Inspect traffic-normalized cohort lift and contention."
+          }
+        ]
+      });
+    }
+    for (const finding of priorFindingsList) {
+      const findingRoute = `#/findings/${encodeURIComponent(finding.id)}`;
+      bundle.evidenceReferences.push({
+        evidenceId: `finding:${finding.id}`,
+        entityKind: "finding",
+        entityId: finding.id,
+        route: findingRoute,
+        source: "incident_memory_fingerprint",
+        confidence: finding.confidence,
+        relationshipCertainty: "exact",
+        causalProofTier: finding.causalProofTier,
+        reason: `Prior finding (${finding.causalProofTier}): ${finding.title}`,
+        citations: [
+          {
+            label: finding.title,
+            entityKind: "finding",
+            entityId: finding.id,
+            route: findingRoute
+          }
+        ],
+        suggestedNextPivots: [
+          {
+            label: "Open prior finding",
+            entityKind: "finding",
+            entityId: finding.id,
+            route: findingRoute,
+            reason: "Search incident memory for similar recurring findings."
+          }
+        ]
+      });
+    }
+    bundle.autosre = {
+      faultLocus: faultLocus?.faultLocusNodeId ? {
+        nodeId: faultLocus.faultLocusNodeId,
+        spanId: faultLocus.faultLocusSpan?.span_id,
+        relationshipCertainty: faultLocus.relationshipCertainty,
+        isBlackoutSuspected: false
+      } : void 0,
+      candidateChanges,
+      contentionCandidates,
+      priorFindings
+    };
+    if (bundle.budget) {
+      bundle.budget = {
+        ...bundle.budget,
+        estimatedTokens: estimateTokens(bundle)
+      };
+    }
+  } catch {
+  }
+  return bundle;
+};
 var parseBundleRequest = async (request) => {
   try {
     const body = await request.json();
@@ -13529,7 +17297,7 @@ var evidenceRetrievalRoutesPlugin = {
         )).flat().filter(
           (profile, index, all) => all.findIndex((candidate) => candidate.id === profile.id) === index
         );
-        const bundle2 = buildActionGraphBundle(
+        let bundle2 = buildActionGraphBundle(
           projectId,
           anchor.entityKind,
           anchor.entityId,
@@ -13539,13 +17307,107 @@ var evidenceRetrievalRoutesPlugin = {
           targetTokens,
           detailLevel
         );
+        if (intent === "triage_incident") {
+          bundle2 = await attachAutoSreTriageContext(
+            db,
+            projectId,
+            traceIds[0] ?? null,
+            bundle2
+          );
+        }
         return c.json(await materializeBundle(db, projectId, bundle2));
       }
+      if (anchor.entityKind === "incident") {
+        const incident = await getIncidentInvestigation(
+          db,
+          projectId,
+          anchor.entityId
+        );
+        if (!incident) {
+          return c.json(
+            { error: "Not Found", message: "Incident not found" },
+            404
+          );
+        }
+        const recentErrSpan = await db.prepare(
+          `SELECT trace_id FROM telemetry_spans
+						 WHERE project_id = ? AND environment = ? AND status_code = 2
+						 ORDER BY start_time DESC LIMIT 1`
+        ).bind(projectId, incident.environment).first();
+        const incRoute = `#/incidents/${encodeURIComponent(incident.id)}`;
+        const baseBundle = {
+          schemaVersion: BUNDLE_SCHEMA_VERSION,
+          intent,
+          environment: incident.environment,
+          incidentId: incident.id,
+          symptomFingerprint: incident.symptomFingerprint ?? void 0,
+          anchor: { entityKind: "incident", entityId: incident.id },
+          budget: { targetTokens, detailLevel },
+          summary: `Incident ${incident.id} (${incident.status}) on ${incident.targetNodeId} in environment ${incident.environment}.`,
+          derivedSummaries: [
+            {
+              title: `Incident ${incident.id}`,
+              reason: `Trigger ${incident.symptomAnchorKind}:${incident.symptomAnchorId} on ${incident.targetNodeId} (status=${incident.status}).`,
+              confidence: 1,
+              evidenceIds: [`incident:${incident.id}`],
+              retrievalRefIds: []
+            }
+          ],
+          findings: [],
+          compactions: [],
+          evidenceReferences: [
+            {
+              evidenceId: `incident:${incident.id}`,
+              entityKind: "incident",
+              entityId: incident.id,
+              route: incRoute,
+              source: "incident_investigations",
+              confidence: 1,
+              relationshipCertainty: "exact",
+              reason: `Incident triggered by ${incident.symptomAnchorKind}:${incident.symptomAnchorId}.`,
+              citations: [
+                {
+                  label: incident.targetNodeId,
+                  entityKind: "incident",
+                  entityId: incident.id,
+                  route: incRoute
+                }
+              ],
+              suggestedNextPivots: [
+                {
+                  label: "Open incident",
+                  entityKind: "incident",
+                  entityId: incident.id,
+                  route: incRoute,
+                  reason: "Inspect incident investigation and candidate changes."
+                }
+              ]
+            }
+          ],
+          retrievalRefs: [],
+          suggestedNextPivots: [
+            {
+              label: "Open incident",
+              entityKind: "incident",
+              entityId: incident.id,
+              route: incRoute,
+              reason: "Inspect incident investigation and candidate changes."
+            }
+          ]
+        };
+        const enriched = await attachAutoSreTriageContext(
+          db,
+          projectId,
+          recentErrSpan?.trace_id ?? null,
+          baseBundle
+        );
+        return c.json(await materializeBundle(db, projectId, enriched));
+      }
       if (anchor.entityKind !== "trace") {
         return c.json(
           {
             error: "Bad Request",
-            message: "Supported evidence bundle anchors are trace, action, agent_run, and tool_call."
+            message: "Supported evidence bundle anchors are trace, action, agent_run, tool_call, and incident."
           },
           400
         );
@@ -13563,7 +17425,7 @@ var evidenceRetrievalRoutesPlugin = {
         limit: MAX_LOGS_FOR_BUNDLE
       });
       const profiles = await profilesForTrace(db, projectId, traceId);
-      const bundle = await buildTraceBundle(
+      let bundle = await buildTraceBundle(
         projectId,
         detail,
         logs.logs,
@@ -13573,6 +17435,14 @@ var evidenceRetrievalRoutesPlugin = {
         detailLevel,
         hours
       );
+      if (intent === "triage_incident" || intent === "debug_failure") {
+        bundle = await attachAutoSreTriageContext(
+          db,
+          projectId,
+          traceId,
+          bundle
+        );
+      }
       return c.json(await materializeBundle(db, projectId, bundle));
     });
     app.get("/internal/evidence/stats", async (c) => {
@@ -14492,7 +18362,7 @@ var parseHours = (rawValue) => Math.min(
     Number.parseInt(rawValue || String(DEFAULT_WINDOW_HOURS2), 10) || DEFAULT_WINDOW_HOURS2
   )
 );
-var parseLimit2 = (rawValue) => Math.min(
+var parseLimit3 = (rawValue) => Math.min(
   MAX_ISSUE_ROWS,
   Math.max(
     1,
@@ -14511,7 +18381,7 @@ var issueInsightsPlugin = {
         service: c.req.query("service") || void 0,
         category: c.req.query("category") === "error" || c.req.query("category") === "latency" || c.req.query("category") === "dependency" ? c.req.query("category") : "all",
         includeInternal: c.req.query("includeInternal") === "true",
-        limit: parseLimit2(c.req.query("limit"))
+        limit: parseLimit3(c.req.query("limit"))
       });
       return c.json({
         ...overview,
@@ -18682,6 +22552,7 @@ var allPlugins = [
   analysesRoutesPlugin,
   actionRoutesPlugin,
   evalCasesRoutesPlugin,
+  autosreRoutesPlugin,
   evidenceRetrievalRoutesPlugin,
   askRoutesPlugin,
   tailRoutesPlugin,
@@ -18704,6 +22575,7 @@ export {
   ActionStore,
   AlertsStore,
   BlobStoreToR2Adapter,
+  CounterfactualVerificationError,
   D1Adapter,
   EvalCaseSourceNotFoundError,
   EvalCasesStore,
@@ -18711,8 +22583,10 @@ export {
   PostgresAdapter,
   ProjectsStore,
   R2BlobStore,
+  RemediationGateError,
   S3BlobStore,
   TailHub,
+  acquireIncidentLease,
   actionRetentionCutoff,
   actionRoutesPlugin,
   aiReceiverPlugin,
@@ -18720,9 +22594,15 @@ export {
   alertsRoutesPlugin,
   allPlugins,
   analysesRoutesPlugin,
+  approveRemediationProposal,
   askRoutesPlugin,
+  autosreRoutesPlugin,
   botFilterPlugin,
+  claimRemediationGrant,
   compareValue,
+  completeRemediationProposal,
+  computeChangeBlastRadius,
+  computeTarjanScc,
   configurePostgresTypeParsers,
   connectedRoutesPlugin,
   consoleLogger,
@@ -18736,35 +22616,58 @@ export {
   dashboardRoutesPlugin,
   src_default as default,
   defaultSpanEnrichmentPlugin,
+  dispatchIncidentWebhook,
   evalCasesRoutesPlugin,
   evaluateAllRules,
+  evaluateRemediationWatchdogs,
   evidenceRetrievalRoutesPlugin,
+  extractSpanLineageAndTopology,
+  failRemediationProposal,
+  findCrossTraceContention,
   genAiNormalizerPlugin,
+  getChangeEvent,
+  getIncidentInvestigation,
+  getInvestigationFinding,
+  getOntologyGraph,
+  getRemediationProposal,
   identityReceiverPlugin,
   isEvalCaseSourceType,
   isEvalRunStatus,
   issueEnrichmentPlugin,
   issueInsightsPlugin,
+  listChangeEvents,
+  listIncidentInvestigations,
+  listRemediationProposals,
+  loadTraceFaultLocusFromDb,
+  localizeTraceFaultLocus,
   logsReceiverPlugin,
   metricsReceiverPlugin,
   onboardingRoutesPlugin,
+  openOrDeduplicateIncident,
   otlpReceiverPlugin,
   platformRoutesPlugin,
   profileRoutesPlugin,
   projectsRoutesPlugin,
+  proposeRemediationAction,
   purgeExpiredActionGraph,
   queryRoutesPlugin,
+  recordChangeEvent,
+  recordInvestigationFinding,
   redactionProcessorPlugin,
+  rejectRemediationProposal,
   replayQueryRoutesPlugin,
   replayReceiverPlugin,
+  searchInvestigationFindings,
   tailRoutesPlugin,
   timelineRoutesPlugin,
   uaEnrichmentPlugin,
+  upsertOntologyFromSpans,
   usageNormalizationPlugin,
   usagePrivacyPlugin,
   usageQueryRoutesPlugin,
   usageReceiverPlugin,
   usersQueryRoutesPlugin,
-  utmEnrichmentPlugin
+  utmEnrichmentPlugin,
+  verifyPairedCounterfactualProof
 };
 //# sourceMappingURL=index.js.map