@odla-ai/cli 0.27.3 → 0.27.4

package/dist/bin.cjs

@@ -32,6 +32,7 @@ var import_node_process7 = __toESM(require("process"), 1);
 
 // src/token.ts
 var import_db = require("@odla-ai/db");
+var import_node_crypto = require("crypto");
 var import_node_process4 = __toESM(require("process"), 1);
 
 // src/handshake-approval.ts
@@ -386,6 +387,7 @@ async function freshHandshake(ctx, waitMs) {
       endpoint: ctx.cfg.platformUrl,
       email: ctx.email,
       label: `${ctx.cfg.app.id} provisioner`,
+      agentHandle: projectAgentHandle(ctx.cfg.app.id),
       projectIds: [ctx.cfg.app.id],
       fetch: ctx.doFetch,
       waitMs,
@@ -421,6 +423,12 @@ async function freshHandshake(ctx, waitMs) {
     stopReminder?.();
   }
 }
+function projectAgentHandle(appId) {
+  const candidate = /^[a-z]/.test(appId) ? appId : `app-${appId}`;
+  if (candidate.length <= 32) return candidate;
+  const digest = (0, import_node_crypto.createHash)("sha256").update(appId).digest("hex").slice(0, 8);
+  return `${candidate.slice(0, 23).replace(/-+$/, "")}-${digest}`;
+}
 function stillPending(pending, email) {
   return new import_db.OdlaError(
     "handshake_pending",
@@ -2633,8 +2641,8 @@ async function calendarCalendars(options) {
 async function calendarConnect(options) {
   const { cfg, ctx, out } = await lifecycleContext(options);
   productionConsent(ctx.env, options.yes, "connect calendar");
-  const page = calendarBookingPageUrl(cfg, ctx.env);
-  const applied = page === void 0 ? await readCalendarStatus(ctx) : await applyCalendarSettings(ctx, page);
+  const page2 = calendarBookingPageUrl(cfg, ctx.env);
+  const applied = page2 === void 0 ? await readCalendarStatus(ctx) : await applyCalendarSettings(ctx, page2);
   const connectOptions = connectionOptions(options, out);
   return await continueConnectedCalendar(ctx, applied, connectOptions) ?? connectWithContext(ctx, connectOptions);
 }
@@ -2883,12 +2891,12 @@ var import_apps3 = require("@odla-ai/apps");
 var import_node_fs10 = require("fs");
 
 // src/config-reconcile-digest.ts
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 function canonicalJson(value2) {
   return JSON.stringify(canonicalValue(value2));
 }
 function configDigest(value2) {
-  return `sha256:${(0, import_node_crypto.createHash)("sha256").update(canonicalJson(value2)).digest("hex")}`;
+  return `sha256:${(0, import_node_crypto2.createHash)("sha256").update(canonicalJson(value2)).digest("hex")}`;
 }
 function canonicalValue(value2) {
   if (value2 === null || typeof value2 === "string" || typeof value2 === "boolean") return value2;
@@ -4461,9 +4469,10 @@ For work that creates an odla app or adds odla services, read and follow
 \`.agents/skills/odla-migrate/SKILL.md\`. For production telemetry triage, use
 \`.agents/skills/odla-o11y-debug/SKILL.md\`.
 
-Track the work in odla's PM as you go \u2014 record decisions when you make them, file
-bugs when you notice them, and move tasks when the work moves
-(\`npx @odla-ai/cli pm task list\`). The conventions and the full command set are
+Track the work in odla's PM as you go. Before project-mutating work, run
+\`npx @odla-ai/cli pm next --app <appId>\`, confirm alignment to an open goal,
+and atomically claim a refined Ready task. Record decisions when you make them
+and file bugs when you notice them. The conventions and the full command set are
 in \`.agents/skills/odla/references/pm.md\`.
 
 The setup runbooks and their references are installed in this repository, pinned
@@ -5687,7 +5696,7 @@ function dependenciesOf(values, influence = "data") {
   return [...unique3.values()];
 }
 
-// ../camel/dist/chunk-S7EVNA2U.js
+// ../camel/dist/chunk-4DQ6BIHP.js
 var camelValueBrand = /* @__PURE__ */ Symbol("@odla-ai/camel/value");
 var authenticCamelValues = /* @__PURE__ */ new WeakSet();
 function isCamelValue(value2) {
@@ -5699,13 +5708,13 @@ function isSafe(value2) {
 function isUnsafe(value2) {
   return isCamelValue(value2) && value2.label.promptSafety === "unsafe";
 }
-function createSafeInternal(value2, safeBasis, metadata2) {
+function createSafeInternal(value2, safeBasis, metadata2, extra) {
   return createValue(value2, {
     schemaVersion: 1,
     promptSafety: "safe",
     safeBasis,
     ...copyMetadata(metadata2)
-  });
+  }, extra);
 }
 function createUnsafeInternal(value2, metadata2) {
   return createValue(value2, {
@@ -5714,8 +5723,8 @@ function createUnsafeInternal(value2, metadata2) {
     ...copyMetadata(metadata2)
   });
 }
-function createValue(value2, label) {
-  const result = { value: value2, label: Object.freeze(label) };
+function createValue(value2, label, extra) {
+  const result = { value: value2, label: Object.freeze(label), ...extra };
   Object.defineProperty(result, camelValueBrand, { value: label.promptSafety, enumerable: false });
   authenticCamelValues.add(result);
   return Object.freeze(result);
@@ -5976,7 +5985,7 @@ var import_path8 = require("path");
 var import_promises10 = require("fs/promises");
 var import_path9 = require("path");
 
-// ../camel/dist/chunk-LAXU2AVK.js
+// ../camel/dist/chunk-4EIRFS3A.js
 function conversionPolicyDigest(policy) {
   return sha256Hex(canonicalJson2(policy));
 }
@@ -6064,10 +6073,18 @@ async function convert(source, policy, value2, counts) {
   const count = counts.get(countKey) ?? 0;
   if (count >= policy.maximumOutputsPerArtifact) throw new CamelError("limit_exceeded", "Conversion output count exceeds its per-source bound.");
   counts.set(countKey, count + 1);
+  const conversionRecordId = await sha256Hex(canonicalJson2({ conversionId: policy.conversionId, digest: policy.digest, source: sourceKey, ordinal: count }));
+  const datumId = await sha256Hex(canonicalJson2({ conversionRecordId, value: value2 }));
   return createSafeInternal(value2, "atomic_conversion", {
     readers: source.label.readers,
     provenance: [...source.label.provenance, { kind: "converter", id: policy.conversionId, digest: policy.digest }],
     dependencies: dependenciesOf([source])
+  }, {
+    datumId,
+    kind: policy.output.kind,
+    conversionId: policy.conversionId,
+    conversionDigest: policy.digest,
+    conversionRecordId
   });
 }
 function validatePolicyShape(policy) {
@@ -6132,7 +6149,7 @@ function missingPolicy() {
   throw new CamelError("conversion_rejected", "Conversion policy is not registered.");
 }
 
-// ../camel/dist/chunk-P2WQIAG6.js
+// ../camel/dist/chunk-VEAUXH4F.js
 function createCamelIngress(constants2 = []) {
   const byId = /* @__PURE__ */ new Map();
   for (const item of constants2) {
@@ -8122,7 +8139,7 @@ async function defaultReadOrigin(cwd) {
 
 // src/code-local-source.ts
 var import_node_child_process5 = require("child_process");
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var SOURCE_LIMITS2 = { maxFiles: 2e4, maxBytes: 512 * 1024 * 1024 };
 async function prepareCodeLocalSource(cwd, repository, readHead = readGitHead) {
   const headCommitSha = await readHead(cwd);
@@ -8173,12 +8190,12 @@ async function readGitHead(cwd) {
   return value2;
 }
 function digestText(value2) {
-  return `sha256:${(0, import_node_crypto2.createHash)("sha256").update(value2).digest("hex")}`;
+  return `sha256:${(0, import_node_crypto3.createHash)("sha256").update(value2).digest("hex")}`;
 }
 
 // src/code-images.ts
 var import_node_child_process6 = require("child_process");
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var import_promises11 = require("fs/promises");
 var import_node_os3 = require("os");
 var import_node_path14 = require("path");
@@ -8264,7 +8281,7 @@ async function embeddedPiImageName() {
   const bundle = await (0, import_promises11.readFile)(embeddedPiAssetPath()).catch(() => {
     throw new Error("CLI-embedded Pi runtime is missing; reinstall this exact @odla-ai/cli version");
   });
-  return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto3.createHash)("sha256").update(bundle).digest("hex")}`;
+  return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto4.createHash)("sha256").update(bundle).digest("hex")}`;
 }
 async function buildEmbeddedPiImage(engine, image, run) {
   const context = await (0, import_promises11.mkdtemp)((0, import_node_path14.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
@@ -8692,16 +8709,22 @@ Usage:
   odla-ai app owners remove <email> [--email <odla-account>] [--json]
   odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
   odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
-  odla-ai pm task list [--app <id>] [--column <c>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm task list [--app <id>] [--column <backlog|ready|doing|review|done>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm bug list [--app <id>] [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm goal add --app <id> --title <t> [--status <s>] [--proof <text>] [--target <pct>] [--mutation-id <id>] [--json]
-  odla-ai pm task add --app <id> --title <t> [--column <c>] [--goal <id>] [--assignee <id>] [--description <text>|--body <text>] [--due <epoch-ms>] [--mutation-id <id>] [--json]
+  odla-ai pm task add --app <id> --title <t> [--column <backlog|ready|doing|review|done>] [--goal <id>|--alignment-decision <id>] [--assignee <id>] [--description <text>|--body <text>] [--acceptance <text>] [--execution <human|agent|either>] [--due <epoch-ms>] [--mutation-id <id>] [--json]
+  odla-ai pm next --app <id> [--json]
+  odla-ai pm watch --app <id> [--cursor <cursor>] [--entity goal|task|decision|bug] [--action created|updated|deleted|comment.created|comment.updated] [--state <state>] [--by <principalId>] [--self <principalId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
+  odla-ai pm task ready <id> --expected-revision <n> [--goal <id>|--alignment-decision <id>] [--description <text>|--body <text>] [--acceptance <text>] [--execution <human|agent|either>] [--mutation-id <id>] [--json]
+  odla-ai pm task claim <id> --expected-revision <n> [--mutation-id <id>] [--json]
+  odla-ai pm task release <id> --expected-revision <n> [--mutation-id <id>] [--json]
   odla-ai pm decision add --app <id> --title <t> --body <text> [--status <s>] [--mutation-id <id>] [--json]
   odla-ai pm bug add --app <id> --title <t> (--description <text>|--body <text>) [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--mutation-id <id>] [--json]
   odla-ai pm <goal|task|decision|bug> get <id> [--json]
+  odla-ai pm <goal|task|decision|bug> ref <id> [--json]
   odla-ai pm goal set <id> [--title <t>|--status <s>|--proof <text>|--no-proof|--target <pct>|--no-target] [--mutation-id <id>] [--json]
-  odla-ai pm task set <id> [--title <t>|--column <c>|--rank <n>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--description <text>|--body <text>|--due <epoch-ms>|--no-due] [--mutation-id <id>] [--json]
+  odla-ai pm task set <id> [--title <t>|--column <backlog|ready|doing|review|done>|--rank <n>|--goal <id>|--no-goal|--alignment-decision <id>|--no-alignment-decision|--execution <human|agent|either>|--assignee <id>|--no-assignee|--description <text>|--body <text>|--acceptance <text>|--no-acceptance|--due <epoch-ms>|--no-due|--expected-revision <n>] [--mutation-id <id>] [--json]
   odla-ai pm decision set <id> [--title <t>|--status <s>|--body <text>] [--mutation-id <id>] [--json]
   odla-ai pm bug set <id> [--title <t>|--status <s>|--severity <s>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--decision <id>|--no-decision|--description <text>|--body <text>] [--mutation-id <id>] [--json]
   odla-ai pm <goal|task|decision> done <id> [--mutation-id <id>]
@@ -9020,11 +9043,11 @@ async function discussList(ctx, parsed) {
     if (value2) query.set(param, value2);
   }
   const qs = query.toString();
-  const page = await request(ctx, "GET", `/topics${qs ? `?${qs}` : ""}`);
-  emit(ctx, page, () => {
-    ctx.out.log(`topics \u2014 ${page.topics.length} of ${page.total}`);
+  const page2 = await request(ctx, "GET", `/topics${qs ? `?${qs}` : ""}`);
+  emit(ctx, page2, () => {
+    ctx.out.log(`topics \u2014 ${page2.topics.length} of ${page2.total}`);
     ctx.out.log("id	state	app	replies	subject");
-    for (const topic of page.topics) {
+    for (const topic of page2.topics) {
       ctx.out.log(
         `${topic.id}	${state(topic)}	${topic.appId ?? ""}	${topic.replyCount}	${topic.subject}`
       );
@@ -9039,11 +9062,11 @@ async function discussRead(ctx, id, parsed) {
       limit: requestedLimit ?? "200",
       offset: requestedOffset ?? "0"
     });
-    const page = await request(ctx, "GET", `/topics/${encodeURIComponent(id)}?${query}`);
+    const page2 = await request(ctx, "GET", `/topics/${encodeURIComponent(id)}?${query}`);
     emit(
       ctx,
-      page,
-      () => renderDiscussRead(ctx, page.topic, page.posts, page)
+      page2,
+      () => renderDiscussRead(ctx, page2.topic, page2.posts, page2)
     );
     return;
   }
@@ -9056,20 +9079,20 @@ async function discussRead(ctx, id, parsed) {
     let topic = null;
     let offset = 0;
     for (; ; ) {
-      const page = await request(
+      const page2 = await request(
         ctx,
         "GET",
         `/topics/${encodeURIComponent(id)}?limit=200&offset=${offset}`
       );
-      topic = page.topic;
-      for (const post of page.posts) posts.set(post.id, post);
-      mergeDiscussPrincipals(projection, page);
+      topic = page2.topic;
+      for (const post of page2.posts) posts.set(post.id, post);
+      mergeDiscussPrincipals(projection, page2);
       if (posts.size > 1e4) throw new Error("discuss read failed: conversation exceeds 10000 posts");
-      if (!page.page?.hasMore) break;
-      if (page.page.nextOffset === null || page.page.nextOffset <= offset) {
+      if (!page2.page?.hasMore) break;
+      if (page2.page.nextOffset === null || page2.page.nextOffset <= offset) {
         throw new Error("discuss read failed: registry returned a non-advancing post page");
       }
-      offset = page.page.nextOffset;
+      offset = page2.page.nextOffset;
     }
     const ordered = [...posts.values()].sort(
       (a, b) => a.createdAt - b.createdAt || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0)
@@ -9237,9 +9260,9 @@ async function discussWatch(ctx, topicId, parsed) {
   let firstSuccess = true;
   let consecutiveFailures = 0;
   for (; ; ) {
-    let page;
+    let page2;
     try {
-      page = await getWatchPage(ctx, requestPath(topicId, app, cursor));
+      page2 = await getWatchPage(ctx, requestPath(topicId, app, cursor));
       consecutiveFailures = 0;
     } catch (error) {
       if (!(error instanceof WatchRequestError) || !error.retryable) {
@@ -9275,25 +9298,25 @@ async function discussWatch(ctx, topicId, parsed) {
       await sleep(deadline === void 0 ? backoff : Math.min(backoff, Math.max(0, deadline - now())));
       continue;
     }
-    cursor = page.cursor;
-    const baseline = firstSuccess && page.events.length === 0;
+    cursor = page2.cursor;
+    const baseline = firstSuccess && page2.events.length === 0;
     if (baseline) {
       jsonl(ctx, parsed, {
         type: "checkpoint",
-        streamId: page.streamId,
+        streamId: page2.streamId,
         cursor,
-        serverTime: page.serverTime
+        serverTime: page2.serverTime
       });
     }
     firstSuccess = false;
-    const matching = page.events.filter((event) => {
+    const matching = page2.events.filter((event) => {
       if (topicId && (event.type !== "message" || event.action !== "created")) return false;
       return (!by || event.actor.id === by) && (!self || event.actor.id !== self);
     });
     for (const event of matching) {
       jsonl(ctx, parsed, {
         type: "event",
-        streamId: page.streamId,
+        streamId: page2.streamId,
         eventId: event.id,
         cursor: event.cursor,
         event
@@ -9302,9 +9325,9 @@ async function discussWatch(ctx, topicId, parsed) {
     if (matching.length > 0) {
       jsonl(ctx, parsed, {
         type: "checkpoint",
-        streamId: page.streamId,
+        streamId: page2.streamId,
         cursor,
-        serverTime: page.serverTime
+        serverTime: page2.serverTime
       });
       const posts = topicId ? matching.filter((event) => event.type === "message").map((event) => event.payload) : void 0;
       const topics = topicId ? void 0 : matching.filter((event) => event.type === "activity").map((event) => event.payload);
@@ -9312,28 +9335,28 @@ async function discussWatch(ctx, topicId, parsed) {
         found: true,
         cursor,
         events: matching,
-        ...page.authors ? { authors: page.authors } : {},
-        ...page.principals ? { principals: page.principals } : {},
+        ...page2.authors ? { authors: page2.authors } : {},
+        ...page2.principals ? { principals: page2.principals } : {},
         ...posts && posts.length > 0 ? { posts } : {},
         ...topics && topics.length > 0 ? { topics } : {}
       });
     }
-    if (page.events.length > 0) {
+    if (page2.events.length > 0) {
       jsonl(ctx, parsed, {
         type: "checkpoint",
-        streamId: page.streamId,
+        streamId: page2.streamId,
         cursor,
-        serverTime: page.serverTime
+        serverTime: page2.serverTime
       });
     } else if (!baseline) {
       jsonl(ctx, parsed, {
         type: "heartbeat",
-        streamId: page.streamId,
+        streamId: page2.streamId,
         cursor,
-        serverTime: page.serverTime
+        serverTime: page2.serverTime
       });
     }
-    if (page.hasMore) continue;
+    if (page2.hasMore) continue;
     if (deadline !== void 0 && now() >= deadline) {
       return report2(ctx, parsed, { found: false, cursor });
     }
@@ -9452,7 +9475,13 @@ async function discussCommand(parsed, deps = {}) {
   }
 }
 
-// src/pm-actions.ts
+// src/pm-action-core.ts
+var DONE = {
+  goal: { status: "met", currentPct: 100 },
+  task: { column: "done" },
+  decision: { status: "accepted" },
+  bug: { status: "fixed" }
+};
 var writeMutationId2 = (parsed) => stringOpt(parsed.options["mutation-id"]) ?? crypto.randomUUID();
 var FIELD_MAP = {
   title: { key: "title" },
@@ -9468,22 +9497,27 @@ var FIELD_MAP = {
   body: { key: "body" },
   target: { key: "targetPct", num: true },
   description: { key: "description" },
-  desc: { key: "description" }
-};
-var DONE = {
-  goal: { status: "met", currentPct: 100 },
-  task: { column: "done" },
-  decision: { status: "accepted" },
-  bug: { status: "fixed" }
+  desc: { key: "description" },
+  acceptance: { key: "acceptanceCriteria" },
+  "alignment-decision": { key: "alignmentDecisionId" },
+  execution: { key: "executionMode" },
+  "expected-revision": { key: "expectedRevision", num: true }
 };
 async function pmRequest(ctx, method, path, body) {
-  const res = await ctx.doFetch(`${ctx.platformUrl}/registry/pm${path}`, {
+  const response2 = await ctx.doFetch(`${ctx.platformUrl}/registry/pm${path}`, {
     method,
-    headers: { authorization: `Bearer ${ctx.token}`, "content-type": "application/json" },
+    headers: {
+      authorization: `Bearer ${ctx.token}`,
+      "content-type": "application/json"
+    },
     body: body === void 0 ? void 0 : JSON.stringify(body)
   });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok) throw new Error(`pm ${method} ${path} failed: ${data.error ?? `registry returned ${res.status}`}`);
+  const data = await response2.json().catch(() => ({}));
+  if (!response2.ok) {
+    throw new Error(
+      `pm ${method} ${path} failed: ${data.error ?? `registry returned ${response2.status}`}`
+    );
+  }
   return data;
 }
 function collectFields(parsed, allowClear) {
@@ -9506,20 +9540,32 @@ function collectEntityFields(entity, parsed, allowClear) {
     if (fields.description === void 0) fields.description = fields.body;
     delete fields.body;
   }
+  if (entity === "task" && fields.column === "ready") fields.column = "todo";
   return fields;
 }
-function statusCol(entity, r) {
-  if (entity === "bug") return `${r.status ?? ""}/${r.severity ?? ""}`;
-  if (entity === "task") return String(r.column ?? "");
-  return String(r.status ?? "");
+function statusCol(entity, record10) {
+  if (entity === "bug") return `${record10.status ?? ""}/${record10.severity ?? ""}`;
+  if (entity === "task") {
+    const state2 = record10.column === "todo" ? "ready" : String(record10.column ?? "");
+    return record10.revision ? `${state2}; r${record10.revision}` : state2;
+  }
+  return String(record10.status ?? "");
 }
-function printRecord(ctx, entity, r) {
-  ctx.out.log(`${r.id}	[${statusCol(entity, r)}]	${r.appId}	${r.title ?? ""}`);
+function referenceMarkup(entity, record10) {
+  const label = (record10.title?.trim() || `${entity} ${record10.id}`).replaceAll("]", ")");
+  return `@[${label}](pm:${entity}/${record10.id})`;
+}
+function printRecord(ctx, entity, record10) {
+  ctx.out.log(
+    `${record10.id}	[${statusCol(entity, record10)}]	${record10.appId}	${record10.title ?? ""}`
+  );
 }
 function emit2(ctx, value2, human) {
   if (ctx.json) ctx.out.log(JSON.stringify(value2, null, 2));
   else human();
 }
+
+// src/pm-actions.ts
 async function pmList(ctx, entity, parsed) {
   const q = new URLSearchParams();
   const filters = {
@@ -9533,7 +9579,8 @@ async function pmList(ctx, entity, parsed) {
   const app = stringOpt(parsed.options.app) ?? ctx.appId;
   if (app) q.set("app", app);
   for (const [flag, param] of Object.entries(filters)) {
-    const v = stringOpt(parsed.options[flag]);
+    const raw = stringOpt(parsed.options[flag]);
+    const v = entity === "task" && flag === "column" && raw === "ready" ? "todo" : raw;
     if (v) q.set(param, v);
   }
   for (const opt of ["q", "limit", "offset"]) {
@@ -9541,11 +9588,11 @@ async function pmList(ctx, entity, parsed) {
     if (v) q.set(opt, v);
   }
   const qs = q.toString();
-  const page = await pmRequest(ctx, "GET", `/${entity}${qs ? `?${qs}` : ""}`);
-  emit2(ctx, page, () => {
-    ctx.out.log(`${entity} \u2014 ${page.records.length} of ${page.total}`);
+  const page2 = await pmRequest(ctx, "GET", `/${entity}${qs ? `?${qs}` : ""}`);
+  emit2(ctx, page2, () => {
+    ctx.out.log(`${entity} \u2014 ${page2.records.length} of ${page2.total}`);
     ctx.out.log("id	state	app	title");
-    for (const r of page.records) printRecord(ctx, entity, r);
+    for (const r of page2.records) printRecord(ctx, entity, r);
   });
 }
 async function pmAdd(ctx, entity, parsed) {
@@ -9566,6 +9613,17 @@ async function pmGet(ctx, entity, id) {
   const { record: record10 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
   emit2(ctx, record10, () => printRecord(ctx, entity, record10));
 }
+async function pmReference(ctx, entity, id) {
+  const { record: record10 } = await pmRequest(
+    ctx,
+    "GET",
+    `/${entity}/${encodeURIComponent(id)}`
+  );
+  const markup = referenceMarkup(entity, record10);
+  emit2(ctx, { kind: `pm:${entity}`, id: record10.id, label: record10.title ?? "", markup }, () => {
+    ctx.out.log(markup);
+  });
+}
 async function pmSet(ctx, entity, id, parsed) {
   const patch2 = collectEntityFields(entity, parsed, true);
   if (Object.keys(patch2).length === 0)
@@ -9586,6 +9644,36 @@ async function pmDone(ctx, entity, id, parsed) {
   });
   emit2(ctx, res, () => ctx.out.log(`${entity} ${id} \u2192 done`));
 }
+async function pmTaskLifecycle(ctx, id, action2, parsed) {
+  const rawRevision = stringOpt(parsed.options["expected-revision"]);
+  const expectedRevision = Number(rawRevision);
+  if (!rawRevision || !Number.isSafeInteger(expectedRevision) || expectedRevision < 1) {
+    throw new Error(`pm task ${action2} needs --expected-revision <n>`);
+  }
+  const mutationId = writeMutationId2(parsed);
+  const res = action2 === "ready" ? await pmRequest(
+    ctx,
+    "PATCH",
+    `/task/${encodeURIComponent(id)}`,
+    {
+      patch: {
+        ...collectEntityFields("task", parsed, true),
+        column: "todo",
+        expectedRevision
+      },
+      mutationId
+    }
+  ) : await pmRequest(
+    ctx,
+    "POST",
+    `/task/${encodeURIComponent(id)}/${action2}`,
+    { expectedRevision, mutationId }
+  );
+  emit2(ctx, res, () => {
+    const state2 = res.record ? statusCol("task", res.record) : action2;
+    ctx.out.log(`task ${id} \u2192 ${state2}`);
+  });
+}
 async function allRecords(ctx, entity, appId) {
   const records = [];
   for (; ; ) {
@@ -9594,11 +9682,48 @@ async function allRecords(ctx, entity, appId) {
       limit: "100",
       offset: String(records.length)
     });
-    const page = await pmRequest(ctx, "GET", `/${entity}?${q}`);
-    records.push(...page.records);
-    if (records.length >= page.total || page.records.length === 0) return records;
+    const page2 = await pmRequest(ctx, "GET", `/${entity}?${q}`);
+    records.push(...page2.records);
+    if (records.length >= page2.total || page2.records.length === 0) return records;
   }
 }
+async function pmNext(ctx, parsed) {
+  const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  if (!appId) throw new Error("pm next needs --app <appId>");
+  const [goals, tasks] = await Promise.all([
+    allRecords(ctx, "goal", appId),
+    allRecords(ctx, "task", appId)
+  ]);
+  const result = {
+    appId,
+    openGoals: goals.filter((record10) => record10.status === "open"),
+    doing: tasks.filter((record10) => record10.column === "doing"),
+    ready: tasks.filter((record10) => record10.column === "todo")
+  };
+  emit2(ctx, result, () => {
+    ctx.out.log(`${appId}: goal-aligned work intake (read only)`);
+    for (const [label, records] of [
+      ["doing", result.doing],
+      ["ready", result.ready],
+      ["open goals", result.openGoals]
+    ]) {
+      ctx.out.log(`${label}:`);
+      if (!records.length) ctx.out.log("- (none)");
+      else for (const record10 of records) printRecord(
+        ctx,
+        label === "open goals" ? "goal" : "task",
+        record10
+      );
+    }
+    if (!result.openGoals.length) {
+      ctx.out.log("next: discuss alignment with the user before creating or claiming project work");
+    } else if (!result.ready.length) {
+      ctx.out.log("next: refine a linked Backlog task and mark it Ready");
+    } else {
+      ctx.out.log("next: review a Ready task, then claim it with its revision");
+    }
+  });
+}
 async function pmHandoff(ctx, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
   if (!appId) throw new Error("pm handoff needs --app <appId>");
@@ -9638,6 +9763,12 @@ async function pmHandoff(ctx, parsed) {
     }
   });
 }
+async function pmRemove(ctx, entity, id) {
+  await pmRequest(ctx, "DELETE", `/${entity}/${encodeURIComponent(id)}`);
+  ctx.out.log(`deleted ${entity} ${id}`);
+}
+
+// src/pm-comments.ts
 async function pmComment(ctx, entity, id, parsed) {
   const body = stringOpt(parsed.options.body);
   if (!body) throw new Error('pm comment needs --body "..."');
@@ -9648,19 +9779,218 @@ async function pmComment(ctx, entity, id, parsed) {
   ctx.out.log(`commented on ${entity} ${id}`);
 }
 async function pmComments(ctx, entity, id) {
-  const { messages } = await pmRequest(
-    ctx,
-    "GET",
-    `/${entity}/${encodeURIComponent(id)}/comments`
-  );
+  const { messages } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}/comments`);
   emit2(ctx, messages, () => {
     if (messages.length === 0) ctx.out.log("(no comments)");
-    else for (const m of messages) ctx.out.log(`[${m.authorId ?? "?"}] ${m.body ?? ""}`);
+    else for (const message2 of messages) {
+      ctx.out.log(
+        `[${message2.authorId ?? "?"}] ${message2.markup ?? message2.body ?? ""}`
+      );
+    }
   });
 }
-async function pmRemove(ctx, entity, id) {
-  await pmRequest(ctx, "DELETE", `/${entity}/${encodeURIComponent(id)}`);
-  ctx.out.log(`deleted ${entity} ${id}`);
+
+// src/pm-watch-types.ts
+var PmWatchCheckpointError = class extends Error {
+  constructor(cursor, streamId) {
+    super("PM work cursor requires a new checkpoint");
+    this.cursor = cursor;
+    this.streamId = streamId;
+    this.name = "PmWatchCheckpointError";
+  }
+  cursor;
+  streamId;
+  code = "checkpoint_required";
+};
+var PmWatchRequestError = class extends Error {
+  constructor(message2, retryable, status) {
+    super(message2);
+    this.retryable = retryable;
+    this.status = status;
+    this.name = "PmWatchRequestError";
+  }
+  retryable;
+  status;
+};
+
+// src/pm-watch.ts
+var DEFAULT_INTERVAL_MS2 = 15e3;
+var MAX_CONSECUTIVE_FAILURES2 = 5;
+var MAX_BACKOFF_MS2 = 3e4;
+function positiveNumber(parsed, flag, fallback) {
+  const raw = stringOpt(parsed.options[flag]);
+  const value2 = raw == null ? NaN : Number(raw);
+  return Number.isFinite(value2) && value2 > 0 ? value2 : fallback;
+}
+function jsonl2(ctx, parsed, value2) {
+  if (parsed.options.jsonl === true) ctx.out.log(JSON.stringify({ v: 1, ...value2 }));
+}
+async function page(ctx, appId, cursor) {
+  const params = new URLSearchParams({ app: appId });
+  if (cursor) params.set("cursor", cursor);
+  let response2;
+  try {
+    response2 = await ctx.doFetch(`${ctx.platformUrl}/registry/pm/work/watch?${params}`, {
+      headers: { authorization: `Bearer ${ctx.token}` }
+    });
+  } catch (error) {
+    throw new PmWatchRequestError(
+      `pm watch request failed: ${error instanceof Error ? error.message : String(error)}`,
+      true
+    );
+  }
+  const data = await response2.json().catch(() => ({}));
+  if (response2.status === 409 && data.code === "checkpoint_required") {
+    throw new PmWatchCheckpointError(data.cursor, data.streamId);
+  }
+  if (!response2.ok) {
+    throw new PmWatchRequestError(
+      `pm watch failed: ${data.error ?? `registry returned ${response2.status}`}`,
+      response2.status === 429 || response2.status >= 500,
+      response2.status
+    );
+  }
+  return data;
+}
+function recordState(record10) {
+  if (record10.column) return record10.column === "todo" ? "ready" : record10.column;
+  return String(record10.status ?? "");
+}
+function eventRecord(event) {
+  return event.payload.payload;
+}
+function eventLabel(event) {
+  const record10 = eventRecord(event);
+  if (record10) return String(record10.title ?? event.payload.entityId);
+  const body = event.payload.message?.body?.replace(/\s+/g, " ").trim();
+  return body || event.payload.entityId;
+}
+function report3(ctx, parsed, result) {
+  if (ctx.json) ctx.out.log(JSON.stringify(result, null, 2));
+  else if (parsed.options.jsonl !== true && result.found) {
+    for (const event of result.events ?? []) {
+      const record10 = eventRecord(event);
+      const state2 = record10 ? recordState(record10) : "comment";
+      ctx.out.log(
+        `${event.id}	${event.type}	${state2}${record10?.revision ? `; r${record10.revision}` : ""}	${eventLabel(event)}`
+      );
+    }
+  }
+  return result;
+}
+async function pmWatch(ctx, parsed) {
+  if (ctx.json && parsed.options.jsonl === true) {
+    throw new Error("--json and --jsonl cannot be combined");
+  }
+  const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  if (!appId) throw new Error("pm watch needs --app <appId>");
+  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve13) => setTimeout(resolve13, ms)));
+  const now = ctx.now ?? Date.now;
+  const intervalMs = (positiveNumber(parsed, "interval", DEFAULT_INTERVAL_MS2 / 1e3) ?? DEFAULT_INTERVAL_MS2 / 1e3) * 1e3;
+  const timeoutSeconds = positiveNumber(parsed, "timeout");
+  const deadline = timeoutSeconds === void 0 ? void 0 : now() + timeoutSeconds * 1e3;
+  const entity = stringOpt(parsed.options.entity);
+  const action2 = stringOpt(parsed.options.action);
+  const wantedState = stringOpt(parsed.options.state)?.toLowerCase();
+  const by = stringOpt(parsed.options.by);
+  const self = stringOpt(parsed.options.self);
+  let cursor = stringOpt(parsed.options.cursor);
+  let firstSuccess = true;
+  let consecutiveFailures = 0;
+  for (; ; ) {
+    let current;
+    try {
+      current = await page(ctx, appId, cursor);
+      consecutiveFailures = 0;
+    } catch (error) {
+      if (error instanceof PmWatchCheckpointError) {
+        jsonl2(ctx, parsed, {
+          type: "status",
+          state: "checkpoint_required",
+          retryable: false,
+          ...error.cursor ? { cursor: error.cursor } : {},
+          ...error.streamId ? { streamId: error.streamId } : {}
+        });
+        throw error;
+      }
+      if (!(error instanceof PmWatchRequestError) || !error.retryable) throw error;
+      consecutiveFailures++;
+      jsonl2(ctx, parsed, {
+        type: "status",
+        state: "degraded",
+        retryable: true,
+        attempt: consecutiveFailures,
+        ...cursor ? { cursor } : {},
+        ...error.status ? { status: error.status } : {}
+      });
+      if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES2) throw error;
+      if (deadline !== void 0 && now() >= deadline) {
+        return report3(ctx, parsed, { found: false, cursor: cursor ?? "" });
+      }
+      const backoff = Math.min(
+        MAX_BACKOFF_MS2,
+        Math.min(intervalMs, 1e3) * 2 ** (consecutiveFailures - 1)
+      );
+      await sleep(deadline === void 0 ? backoff : Math.min(backoff, Math.max(0, deadline - now())));
+      continue;
+    }
+    cursor = current.cursor;
+    const baseline = firstSuccess && current.events.length === 0;
+    if (baseline) {
+      jsonl2(ctx, parsed, {
+        type: "checkpoint",
+        streamId: current.streamId,
+        cursor,
+        serverTime: current.serverTime
+      });
+    }
+    firstSuccess = false;
+    const matching = current.events.filter((event) => {
+      const record10 = eventRecord(event);
+      const state2 = record10 ? recordState(record10).toLowerCase() : "";
+      return (!entity || event.payload.entityKind === entity) && (!action2 || event.payload.action === action2) && (!wantedState || state2 === wantedState || wantedState === "todo" && state2 === "ready") && (!by || event.actor.id === by) && (!self || event.actor.id !== self);
+    });
+    for (const event of matching) {
+      jsonl2(ctx, parsed, {
+        type: "event",
+        streamId: current.streamId,
+        eventId: event.id,
+        cursor: event.cursor,
+        event
+      });
+    }
+    if (matching.length > 0) {
+      jsonl2(ctx, parsed, {
+        type: "checkpoint",
+        streamId: current.streamId,
+        cursor,
+        serverTime: current.serverTime
+      });
+      return report3(ctx, parsed, { found: true, cursor, events: matching });
+    }
+    if (current.events.length > 0) {
+      jsonl2(ctx, parsed, {
+        type: "checkpoint",
+        streamId: current.streamId,
+        cursor,
+        serverTime: current.serverTime
+      });
+    } else if (!baseline) {
+      jsonl2(ctx, parsed, {
+        type: "heartbeat",
+        streamId: current.streamId,
+        cursor,
+        serverTime: current.serverTime
+      });
+    }
+    if (current.hasMore) continue;
+    if (deadline !== void 0 && now() >= deadline) {
+      return report3(ctx, parsed, { found: false, cursor });
+    }
+    await sleep(
+      deadline === void 0 ? intervalMs : Math.min(intervalMs, Math.max(0, deadline - now()))
+    );
+  }
 }
 
 // src/pm-command.ts
@@ -9681,7 +10011,11 @@ var ACTION_OPTIONS = {
   done: ["mutation-id"],
   comment: ["body", "mutation-id"],
   comments: [],
-  rm: []
+  rm: [],
+  ready: ["goal", "alignment-decision", "execution", "description", "desc", "body", "acceptance", "expected-revision", "mutation-id"],
+  claim: ["expected-revision", "mutation-id"],
+  release: ["expected-revision", "mutation-id"],
+  ref: []
 };
 var ENTITY_OPTIONS = {
   goal: {
@@ -9692,8 +10026,8 @@ var ENTITY_OPTIONS = {
   },
   task: {
     list: ["column", "goal", "assignee"],
-    add: ["column", "goal", "assignee", "due", "description", "desc", "body"],
-    set: ["title", "column", "rank", "goal", "assignee", "due", "description", "desc", "body"],
+    add: ["column", "goal", "alignment-decision", "execution", "assignee", "due", "description", "desc", "body", "acceptance"],
+    set: ["title", "column", "rank", "goal", "alignment-decision", "execution", "assignee", "due", "description", "desc", "body", "acceptance", "expected-revision"],
     done: []
   },
   decision: {
@@ -9744,11 +10078,33 @@ async function buildContext2(parsed, deps) {
     json: parsed.options.json === true,
     // Preserve PM's existing cross-project default when a config is present;
     // only an explicit remote-agent environment or profile selects an app.
-    appId: context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : void 0
+    appId: context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : void 0,
+    ...deps.sleep ? { sleep: deps.sleep } : {},
+    ...deps.now ? { now: deps.now } : {}
   };
 }
 async function pmCommand(parsed, deps = {}) {
   const word = parsed.positionals[1] ?? "";
+  if (word === "next") {
+    assertArgs(parsed, [...COMMON_OPTIONS, "app"], 2);
+    return pmNext(await buildContext2(parsed, deps), parsed);
+  }
+  if (word === "watch") {
+    assertArgs(parsed, [
+      ...COMMON_OPTIONS,
+      "app",
+      "cursor",
+      "interval",
+      "timeout",
+      "jsonl",
+      "entity",
+      "action",
+      "state",
+      "by",
+      "self"
+    ], 2);
+    return pmWatch(await buildContext2(parsed, deps), parsed).then(() => void 0);
+  }
   if (word === "handoff") {
     assertArgs(parsed, [...COMMON_OPTIONS, "app"], 2);
     return pmHandoff(await buildContext2(parsed, deps), parsed);
@@ -9759,6 +10115,9 @@ async function pmCommand(parsed, deps = {}) {
   const action2 = canonicalAction(requestedAction);
   if (!action2) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|comment|comments|rm.`);
   assertArgs(parsed, allowedOptions(entity, action2), 4);
+  if ((action2 === "ready" || action2 === "claim" || action2 === "release") && entity !== "task") {
+    throw new Error(`pm ${action2} is only valid for tasks`);
+  }
   const ctx = await buildContext2(parsed, deps);
   const id = parsed.positionals[3];
   switch (action2) {
@@ -9778,6 +10137,12 @@ async function pmCommand(parsed, deps = {}) {
       return pmComments(ctx, entity, requireId2(id, action2));
     case "rm":
       return pmRemove(ctx, entity, requireId2(id, action2));
+    case "ref":
+      return pmReference(ctx, entity, requireId2(id, action2));
+    case "ready":
+    case "claim":
+    case "release":
+      return pmTaskLifecycle(ctx, requireId2(id, action2), action2, parsed);
   }
 }
 
@@ -10667,12 +11032,23 @@ var PM_ACTIONS = {
   done: {},
   comment: {},
   comments: {},
+  ref: {},
   rm: {},
   delete: {}
 };
-var PM_ENTITIES = Object.fromEntries(
-  ["goal", "conformance", "task", "kanban", "decision", "bug"].map((entity) => [entity, PM_ACTIONS])
-);
+var PM_TASK_ACTIONS = {
+  ...PM_ACTIONS,
+  ready: {},
+  claim: {},
+  release: {}
+};
+var PM_ENTITIES = {
+  ...Object.fromEntries(
+    ["goal", "conformance", "decision", "bug"].map((entity) => [entity, PM_ACTIONS])
+  ),
+  task: PM_TASK_ACTIONS,
+  kanban: PM_TASK_ACTIONS
+};
 var COMMAND_SURFACE = {
   agent: { jobs: {}, retry: {} },
   admin: {
@@ -10725,7 +11101,9 @@ var COMMAND_SURFACE = {
   },
   pm: {
     ...PM_ENTITIES,
-    handoff: {}
+    handoff: {},
+    next: {},
+    watch: {}
   },
   provision: {},
   runbook: {
@@ -10889,12 +11267,12 @@ async function call(ctx, method, path, body) {
   throw new Error(message2);
 }
 async function bySlug(ctx, slug) {
-  const page = await call(
+  const page2 = await call(
     ctx,
     "GET",
     `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
   );
-  const found = page.records[0];
+  const found = page2.records[0];
   if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
   return found;
 }
@@ -10908,11 +11286,11 @@ async function runbookList(ctx, all, query) {
   const params = new URLSearchParams();
   if (!all) params.set("app", ctx.appId);
   if (query) params.set("q", query);
-  const page = await call(ctx, "GET", `/runbook${params.size ? `?${params}` : ""}`);
-  if (ctx.json) return ctx.out.log(JSON.stringify(page, null, 2));
-  if (!page.records.length) return ctx.out.log("(no runbooks)");
+  const page2 = await call(ctx, "GET", `/runbook${params.size ? `?${params}` : ""}`);
+  if (ctx.json) return ctx.out.log(JSON.stringify(page2, null, 2));
+  if (!page2.records.length) return ctx.out.log("(no runbooks)");
   ctx.out.log(["SLUG", "STATUS", "V", "SCOPE", "UPDATED", "TITLE"].join("	"));
-  for (const r of page.records)
+  for (const r of page2.records)
     ctx.out.log(
       [r.slug, r.status, `v${r.version}`, r.appId === PLATFORM_SCOPE ? "platform" : r.appId, stamp(r.updatedAt), r.title].join("	")
     );
@@ -10967,12 +11345,12 @@ async function runbookVisibility(ctx, slug, visibility) {
 }
 async function runbookHistory(ctx, slug) {
   const runbook = await bySlug(ctx, slug);
-  const page = await call(ctx, "GET", `/runbook/${encodeURIComponent(runbook.id)}/revisions`);
-  if (ctx.json) return ctx.out.log(JSON.stringify(page, null, 2));
+  const page2 = await call(ctx, "GET", `/runbook/${encodeURIComponent(runbook.id)}/revisions`);
+  if (ctx.json) return ctx.out.log(JSON.stringify(page2, null, 2));
   ctx.out.log(`${slug} is at v${runbook.version}`);
-  if (!page.records.length) return ctx.out.log("(no earlier versions)");
+  if (!page2.records.length) return ctx.out.log("(no earlier versions)");
   ctx.out.log(["V", "WHEN", "BY", "NOTE"].join("	"));
-  for (const r of page.records)
+  for (const r of page2.records)
     ctx.out.log([`v${r.version}`, stamp(r.createdAt), r.ownerEmail ?? "", r.note ?? ""].join("	"));
 }
 async function runbookRevert(ctx, slug, version) {
@@ -11047,12 +11425,12 @@ ${counts.created} created, ${counts.updated} updated, ${counts.unchanged} unchan
   );
 }
 async function upsert(ctx, r, visibility) {
-  const page = await call(
+  const page2 = await call(
     ctx,
     "GET",
     `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(r.slug)}&limit=1`
   );
-  const found = page.records[0];
+  const found = page2.records[0];
   if (!found) {
     await call(ctx, "POST", "/runbook", {
       appId: ctx.appId,
@@ -11308,7 +11686,7 @@ async function assessImpact(ctx, surfaces, all, limit) {
   return out;
 }
 var editHint = (slug, appId) => `odla-ai runbook edit ${slug}${appId === PLATFORM_SCOPE ? "" : ` --app ${appId}`} --note "<what changed>"`;
-function report3(ctx, impacts) {
+function report4(ctx, impacts) {
   const covered = impacts.filter((i) => i.runbooks.length);
   ctx.out.log(
     `${impacts.length} changed surface${impacts.length === 1 ? "" : "s"}; ${covered.length} covered by a runbook. Reread each one and fix any step this change made wrong.`
@@ -11346,7 +11724,7 @@ async function runbookImpact(ctx, options, deps = {}) {
   }
   const impacts = await assessImpact(ctx, surfaces, options.all, options.limit ?? 4);
   if (ctx.json) return ctx.out.log(JSON.stringify({ base: options.base, impacts }, null, 2));
-  report3(ctx, impacts);
+  report4(ctx, impacts);
 }
 
 // src/runbook-lint.ts
@@ -11384,17 +11762,17 @@ function lintRunbook(runbook, installed) {
 async function runbookLint(ctx, all) {
   const params = new URLSearchParams();
   if (!all) params.set("app", ctx.appId);
-  const page = await call(ctx, "GET", `/runbook${params.size ? `?${params}` : ""}`);
+  const page2 = await call(ctx, "GET", `/runbook${params.size ? `?${params}` : ""}`);
   const installed = { "@odla-ai/cli": cliVersion() };
-  const findings = page.records.flatMap((runbook) => lintRunbook(runbook, installed));
-  if (ctx.json) return ctx.out.log(JSON.stringify({ checked: page.records.length, findings }, null, 2));
-  if (!page.records.length) return ctx.out.log("(no runbooks in scope)");
+  const findings = page2.records.flatMap((runbook) => lintRunbook(runbook, installed));
+  if (ctx.json) return ctx.out.log(JSON.stringify({ checked: page2.records.length, findings }, null, 2));
+  if (!page2.records.length) return ctx.out.log("(no runbooks in scope)");
   if (!findings.length) {
     return ctx.out.log(
-      `${page.records.length} runbook${page.records.length === 1 ? "" : "s"} checked; every command they name is real for @odla-ai/cli ${cliVersion()}.`
+      `${page2.records.length} runbook${page2.records.length === 1 ? "" : "s"} checked; every command they name is real for @odla-ai/cli ${cliVersion()}.`
     );
   }
-  ctx.out.log(`${findings.length} finding${findings.length === 1 ? "" : "s"} across ${page.records.length} runbooks:`);
+  ctx.out.log(`${findings.length} finding${findings.length === 1 ? "" : "s"} across ${page2.records.length} runbooks:`);
   for (const finding of findings) {
     const scope = finding.appId === PLATFORM_SCOPE ? "" : ` --app ${finding.appId}`;
     ctx.out.log("");
@@ -11457,12 +11835,12 @@ async function runbookAsk(ctx, question, all) {
   ctx.out.log(JSDOC_POINTER);
 }
 async function runbookComment(ctx, slug, body) {
-  const page = await call(
+  const page2 = await call(
     ctx,
     "GET",
     `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
   );
-  const found = page.records[0];
+  const found = page2.records[0];
   if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
   await call(ctx, "POST", `/runbook/${encodeURIComponent(found.id)}/comments`, { body });
   ctx.out.log(`commented on ${slug} (v${found.version})`);
@@ -11514,12 +11892,12 @@ var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
 
 // src/runbook-edit-flow.ts
 async function editRunbook(ctx, slug, deps = {}) {
-  const page = await call(
+  const page2 = await call(
     ctx,
     "GET",
     `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
   );
-  const found = page.records[0];
+  const found = page2.records[0];
   if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
   ctx.out.log(`opening ${slug} v${found.version} in your editor\u2026`);
   const body = await editText(found.body, slug, deps);
@@ -11940,31 +12318,31 @@ function printHostedJob(out, job, platform, appId) {
   url.searchParams.set("job", job.jobId);
   out.log(`  Studio: ${url.toString()}`);
 }
-function printHostedReport(out, report4) {
-  out.log(`security report ${report4.jobId}: ${report4.repository}@${report4.revision}`);
-  out.log(`  coverage: ${report4.coverageStatus} cells=${report4.metrics.coverageCells} shallow=${report4.metrics.shallowCells} blocked=${report4.metrics.blockedCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
-  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates} rejected=${report4.metrics.rejected}`);
-  out.log(`  discovery: ${report4.provenance.discovery?.provider ?? "unknown"}/${report4.provenance.discovery?.model ?? "unknown"}`);
-  out.log(`  validation: ${report4.provenance.validation?.provider ?? "unknown"}/${report4.provenance.validation?.model ?? "unknown"} independent=${String(report4.provenance.independentValidation)}`);
-  for (const finding of report4.findings) {
+function printHostedReport(out, report5) {
+  out.log(`security report ${report5.jobId}: ${report5.repository}@${report5.revision}`);
+  out.log(`  coverage: ${report5.coverageStatus} cells=${report5.metrics.coverageCells} shallow=${report5.metrics.shallowCells} blocked=${report5.metrics.blockedCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
+  out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates} rejected=${report5.metrics.rejected}`);
+  out.log(`  discovery: ${report5.provenance.discovery?.provider ?? "unknown"}/${report5.provenance.discovery?.model ?? "unknown"}`);
+  out.log(`  validation: ${report5.provenance.validation?.provider ?? "unknown"}/${report5.provenance.validation?.model ?? "unknown"} independent=${String(report5.provenance.independentValidation)}`);
+  for (const finding of report5.findings) {
     const location = finding.locations[0];
     out.log(`  [${finding.severity}] ${finding.title}${location ? ` (${location.path}:${location.line})` : ""} \xB7 ${finding.disposition}`);
   }
-  for (const limitation of report4.limitations) out.log(`  limitation: ${limitation}`);
+  for (const limitation of report5.limitations) out.log(`  limitation: ${limitation}`);
 }
-function enforceHostedReportGate(report4, parsed, out, emitSuccess) {
+function enforceHostedReportGate(report5, parsed, out, emitSuccess) {
   const failOn = hostedSeverity(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : hostedSeverity(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
   const atOrAbove = (severity, threshold) => HOSTED_SEVERITIES.indexOf(severity) >= HOSTED_SEVERITIES.indexOf(threshold);
-  const confirmed = report4.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
-  const leads = failOnCandidates ? report4.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
-  const incomplete = report4.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = report5.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
+  const leads = failOnCandidates ? report5.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
+  const incomplete = report5.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
-    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report4.coverageStatus}` : ""}`);
+    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report5.coverageStatus}` : ""}`);
   }
   if (emitSuccess) {
-    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report4.coverageStatus}. This is not proof that the application is secure.`);
+    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report5.coverageStatus}. This is not proof that the application is secure.`);
   }
 }
 function printHostedSecurityPlanRoute(out, label, route2) {
@@ -12047,17 +12425,17 @@ async function runHostedSecurity(options) {
       allowNetwork: false
     }
   });
-  const report4 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
-  await (0, import_node3.writeSecurityArtifacts)(output, report4);
-  const reportDigest = await (0, import_security.securityFingerprint)(report4);
+  const report5 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
+  await (0, import_node3.writeSecurityArtifacts)(output, report5);
+  const reportDigest = await (0, import_security.securityFingerprint)(report5);
   await hosted.complete({
     reportDigest,
-    coverageStatus: report4.coverageStatus,
-    confirmed: report4.metrics.confirmed,
-    candidates: report4.metrics.candidates
+    coverageStatus: report5.coverageStatus,
+    confirmed: report5.metrics.confirmed,
+    candidates: report5.metrics.candidates
   }, { signal: options.signal });
-  printSummary(options.stdout ?? console, appId, env, hosted.run, report4, output);
-  return Object.freeze({ report: report4, run: hosted.run, output });
+  printSummary(options.stdout ?? console, appId, env, hosted.run, report5, output);
+  return Object.freeze({ report: report5, run: hosted.run, output });
 }
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
@@ -12083,14 +12461,14 @@ function profileFor(name, maxHuntTasks) {
   if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error("maxHuntTasks must be a positive integer");
   return { ...profile, maxHuntTasks };
 }
-function printSummary(out, appId, env, run, report4, output) {
-  const complete = report4.coverage.filter((cell) => cell.state === "complete").length;
+function printSummary(out, appId, env, run, report5, output) {
+  const complete = report5.coverage.filter((cell) => cell.state === "complete").length;
   out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);
   out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);
   out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);
-  out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
-  if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
-  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
+  out.log(`  coverage: ${report5.coverageStatus} ${complete}/${report5.coverage.length} blocked=${report5.metrics.blockedCells} shallow=${report5.metrics.shallowCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
+  if (report5.callBudget) out.log(`  calls: discovery=${formatBudget(report5.callBudget.discovery)} validation=${formatBudget(report5.callBudget.validation)}`);
+  out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates}`);
   out.log(`  report: ${(0, import_node_path19.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
@@ -12326,13 +12704,13 @@ async function runSourceSecurityCommand(parsed, dependencies, sourceId) {
     }
     throw new Error(`hosted security job ${result.jobId} ended ${result.status}${result.errorCode ? `: ${result.errorCode}` : ""}`);
   }
-  const report4 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
+  const report5 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
   if (parsed.options.json === true) {
-    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report4 }, null, 2));
+    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report5 }, null, 2));
   } else {
-    printHostedReport(context.stdout, report4);
+    printHostedReport(context.stdout, report5);
   }
-  enforceHostedReportGate(report4, parsed, context.stdout, parsed.options.json !== true);
+  enforceHostedReportGate(report5, parsed, context.stdout, parsed.options.json !== true);
 }
 async function runLocalSecurityCommand(parsed, dependencies) {
   if (parsed.options.source === true) {
@@ -12399,13 +12777,13 @@ async function runLocalSecurityCommand(parsed, dependencies) {
   });
   enforceLocalGate(result.report, parsed);
 }
-function enforceLocalGate(report4, parsed) {
+function enforceLocalGate(report5, parsed) {
   const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
-  const confirmed = (0, import_security2.findingsAtOrAbove)(report4, failOn);
-  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report4, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
-  const incomplete = report4.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = (0, import_security2.findingsAtOrAbove)(report5, failOn);
+  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report5, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
+  const incomplete = report5.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
     throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
   }
@@ -12444,9 +12822,9 @@ async function securityCommand(parsed, dependencies) {
     assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 3);
     const jobId = requiredSecurityPositional(parsed, 2, "job id");
     const context = await hostedSecurityContext(parsed, dependencies);
-    const report4 = await getHostedSecurityReport({ ...context, jobId });
-    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report4, null, 2));
-    else printHostedReport(context.stdout, report4);
+    const report5 = await getHostedSecurityReport({ ...context, jobId });
+    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report5, null, 2));
+    else printHostedReport(context.stdout, report5);
     return;
   }
   if (sub !== "run") {