@oxagen/cli 2.1.4-725 → 2.1.4-926

package/oxagen.mjs

@@ -7374,6 +7374,9 @@ function principalsFor(cedar, harness, agent) {
 function isOxagenTool(toolName3) {
   return toolName3.startsWith(OXAGEN_TOOL_PREFIX);
 }
+function kernelDecides(toolName3, oxagenServerVerified2) {
+  return isOxagenTool(toolName3) && oxagenServerVerified2 === true;
+}
 function mcpActionFor(toolName3) {
   if (!toolName3.startsWith(MCP_PREFIX)) return void 0;
   const id2 = toolName3.slice(MCP_PREFIX.length);
@@ -7447,7 +7450,7 @@ function hookRequest(call2, tools) {
   return { action, tool: BUILTIN_TOOLS[action], argSets, errors: [] };
 }
 function hookCallClass(call2, tools) {
-  if (isOxagenTool(call2.toolName)) return null;
+  if (kernelDecides(call2.toolName, call2.oxagenServerVerified)) return null;
   const request3 = hookRequest(call2, tools);
   const targets = [];
   for (const args of request3.argSets) {
@@ -7458,7 +7461,7 @@ function hookCallClass(call2, tools) {
   return { action: request3.action, tool: request3.tool, targets };
 }
 function evaluateHookCall(call2) {
-  if (isOxagenTool(call2.toolName)) return null;
+  if (kernelDecides(call2.toolName, call2.oxagenServerVerified)) return null;
   const request3 = hookRequest(call2, call2.cedar.tools);
   const { action } = request3;
   const principals = principalsFor(call2.cedar, call2.harness, call2.agent);
@@ -7790,8 +7793,8 @@ function candidatePaths(path2, context) {
     const base2 = fold(lib.normalize(root)).replace(/\/+$/, "");
     return resolved.startsWith(`${base2}/`) ? resolved.slice(base2.length + 1) : void 0;
   };
-  const relative10 = cwd !== void 0 ? under2(cwd) : void 0;
-  if (relative10 !== void 0) out.push(relative10);
+  const relative11 = cwd !== void 0 ? under2(cwd) : void 0;
+  if (relative11 !== void 0) out.push(relative11);
   const fromHome = home !== void 0 ? under2(home) : void 0;
   if (fromHome !== void 0) out.push(`~/${fromHome}`);
   return out;
@@ -8002,7 +8005,7 @@ function evaluatePreToolUse(input) {
     input.now,
     input.mandateConfirmedAt
   );
-  const staleSafe = readOnly && (bundle2.cedar === void 0 || input.cedar === void 0 || isOxagenTool(toolName3) || cedarReadOnly(
+  const staleSafe = readOnly && (bundle2.cedar === void 0 || input.cedar === void 0 || kernelDecides(toolName3, input.cedar.oxagenServerVerified) || cedarReadOnly(
     bundle2.cedar,
     toolName3,
     input.cedar.harness,
@@ -8126,7 +8129,8 @@ function cedarReadOnly(cedarBundle, toolName3, harness, action) {
 function decideWithCedar(input) {
   const cedarBundle = input.bundle.cedar;
   if (cedarBundle === void 0 || input.cedar === void 0) return void 0;
-  if (isOxagenTool(input.toolName)) return void 0;
+  if (kernelDecides(input.toolName, input.cedar.oxagenServerVerified))
+    return void 0;
   const { runtime, harness, agent, skill, action, harness_tool, facts } = input.cedar;
   const readOnly = cedarReadOnly(cedarBundle, input.toolName, harness, action);
   if (runtime === null) {
@@ -8164,6 +8168,7 @@ function decideWithCedar(input) {
       ...action !== void 0 ? { action } : {},
       ...skill !== void 0 ? { skill } : {},
       ...facts !== void 0 ? { facts } : {},
+      ...input.cedar.oxagenServerVerified !== void 0 ? { oxagenServerVerified: input.cedar.oxagenServerVerified } : {},
       now: input.now
     });
   } catch (error) {
@@ -8750,6 +8755,18 @@ function commandHookEntry(config, timeoutS, harness = "claude-code", absentAnswe
     timeout: timeoutS
   };
 }
+function steerWaitEntry(config) {
+  return {
+    type: "command",
+    command: `${config.hookCommand} ${hookMarker(config.enrollmentId)} ${STEER_WAIT_FLAG}`,
+    async: true,
+    asyncRewake: true,
+    timeout: STEER_WAIT_TIMEOUT_S
+  };
+}
+function isSteerWaitEntry(entry2) {
+  return entry2.type === "command" && typeof entry2.command === "string" && entry2.command.endsWith(` ${STEER_WAIT_FLAG}`);
+}
 function hookMarker(enrollmentId) {
   return `--enrollment ${enrollmentId}`;
 }
@@ -8790,7 +8807,8 @@ function tachoHookEntries(config) {
   const out = {};
   for (const event of COMMAND_HOOK_EVENTS) {
     out[event] = [
-      { hooks: [commandHookEntry(config, COMMAND_HOOK_TIMEOUTS_S[event])] }
+      { hooks: [commandHookEntry(config, COMMAND_HOOK_TIMEOUTS_S[event])] },
+      ...STEER_WAIT_EVENTS.includes(event) ? [{ hooks: [steerWaitEntry(config)] }] : []
     ];
   }
   for (const event of SPOOLED_HOOK_EVENTS) {
@@ -8943,7 +8961,12 @@ function tachoHookPresence(existing, enrollmentId) {
     if (ours.length > 0) {
       present.push(event);
       const type = writtenHookType(event);
-      if (ours.some((group) => group.hooks.some((entry2) => entry2.type !== type)))
+      if (ours.some(
+        (group) => group.hooks.some((entry2) => entry2.type !== type)
+      ) || // An enrollment before the steer waiter wrote none on the events
+      // where a session goes idle, so a steer sent then waits for a person
+      // to type. `oxagen agent enroll` writes it.
+      STEER_WAIT_EVENTS.includes(event) && !ours.some((group) => group.hooks.some(isSteerWaitEntry)))
         stale.push(event);
     } else {
       missing.push(event);
@@ -8968,7 +8991,7 @@ function renderManagedSettings(config) {
     disableBypassPermissionsMode: "disable"
   };
 }
-var COMMAND_HOOK_EVENTS, SPOOLED_HOOK_EVENTS, SESSION_END_TIMEOUT_S, HTTP_HOOK_EVENTS, RETIRED_HOOK_EVENTS, ALL_HOOK_EVENTS, HTTP_TIMEOUT_S, TACHO_LOCAL_TOKEN_ENV, TACHO_ENROLLMENT_ENV, COMMAND_HOOK_TIMEOUTS_S, ANY_ENROLLMENT, entryPatterns, TACHO_ENV_KEYS, STATIC_TACHO_ENV;
+var COMMAND_HOOK_EVENTS, SPOOLED_HOOK_EVENTS, SESSION_END_TIMEOUT_S, HTTP_HOOK_EVENTS, RETIRED_HOOK_EVENTS, ALL_HOOK_EVENTS, HTTP_TIMEOUT_S, TACHO_LOCAL_TOKEN_ENV, TACHO_ENROLLMENT_ENV, STEER_WAIT_EVENTS, STEER_WAIT_FLAG, STEER_WAIT_TIMEOUT_S, COMMAND_HOOK_TIMEOUTS_S, ANY_ENROLLMENT, entryPatterns, TACHO_ENV_KEYS, STATIC_TACHO_ENV;
 var init_settings_writer = __esm({
   "../../packages/tacho/src/host/settings-writer.ts"() {
     "use strict";
@@ -9021,6 +9044,12 @@ var init_settings_writer = __esm({
     HTTP_TIMEOUT_S = 5;
     TACHO_LOCAL_TOKEN_ENV = "TACHO_LOCAL_TOKEN";
     TACHO_ENROLLMENT_ENV = "TACHO_ENROLLMENT";
+    STEER_WAIT_EVENTS = [
+      "SessionStart",
+      "Stop"
+    ];
+    STEER_WAIT_FLAG = "--await-steer";
+    STEER_WAIT_TIMEOUT_S = 86400;
     COMMAND_HOOK_TIMEOUTS_S = {
       SessionStart: 10,
       UserPromptSubmit: 10,
@@ -10329,14 +10358,14 @@ function psExecWithin(timeoutMs) {
   return (command2, args) => psExec(command2, args, timeoutMs);
 }
 function psExecAsync(command2, args) {
-  return new Promise((resolve22) => {
+  return new Promise((resolve23) => {
     execFile(
       command2,
       args,
       { encoding: "utf8", env: PS_ENV, timeout: PROCESS_START_TIMEOUT_MS },
       (error, stdout) => {
         const code = error?.code;
-        resolve22({
+        resolve23({
           status: error === null ? 0 : typeof code === "number" ? code : null,
           stdout: typeof stdout === "string" ? stdout : "",
           stderr: ""
@@ -12280,7 +12309,7 @@ function enrollmentFromArgv(argv) {
   return parsed2.success ? parsed2.data : void 0;
 }
 function postUnix(options) {
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve23, reject) => {
     const req = request(
       {
         ...options.socketPath !== void 0 ? { socketPath: options.socketPath } : { host: "127.0.0.1", port: options.loopbackPort },
@@ -12312,7 +12341,7 @@ function postUnix(options) {
         });
         res.on("end", () => {
           clearTimeout(deadline);
-          resolve22({
+          resolve23({
             status: res.statusCode ?? 0,
             body: Buffer.concat(chunks).toString("utf8")
           });
@@ -12791,6 +12820,9 @@ async function runTachoHook(deps) {
   const killMs = harnessKillMs(harness, input.hook_event_name, cursorEvent);
   const elapsed = deps.elapsedMs ?? (() => 0);
   const responseBudget = () => responseBudgetMs(killMs, elapsed());
+  const answerBy = () => ({
+    answer_by: now() + responseBudget()
+  });
   const workOrder = workOrderIdOf(deps.env[WORK_ORDER_ENV]);
   const env = {
     ...snapshotEnv(deps.env, DEFAULT_SECRET_ENV_PATTERN),
@@ -12830,7 +12862,8 @@ async function runTachoHook(deps) {
               payload: raw,
               env,
               hook_id: hookId,
-              ...label2
+              ...label2,
+              ...answerBy()
             }),
             connectTimeoutMs: deps.connectTimeoutMs ?? 50,
             responseTimeoutMs: responseBudget()
@@ -12878,7 +12911,13 @@ async function runTachoHook(deps) {
         Authorization: `Bearer ${host.local_token}`,
         "x-tacho-envelope": "1"
       },
-      body: JSON.stringify({ payload: raw, env, hook_id: hookId, ...label2 }),
+      body: JSON.stringify({
+        payload: raw,
+        env,
+        hook_id: hookId,
+        ...label2,
+        ...answerBy()
+      }),
       connectTimeoutMs: deps.connectTimeoutMs ?? 50,
       responseTimeoutMs: responseBudget()
     });
@@ -12984,14 +13023,136 @@ var init_hook_client = __esm({
   }
 });
 
+// ../../packages/tacho/src/claude-code/steer-wait.ts
+function sessionOf(stdin) {
+  let payload;
+  try {
+    payload = JSON.parse(stdin);
+  } catch {
+    return void 0;
+  }
+  if (typeof payload !== "object" || payload === null) return void 0;
+  const fields = payload;
+  if (fields["agent_id"] !== void 0) return void 0;
+  const sessionId = fields["session_id"];
+  return typeof sessionId === "string" && sessionId.length > 0 ? sessionId : void 0;
+}
+function readAnswer(body2) {
+  let answer;
+  try {
+    answer = JSON.parse(body2);
+  } catch {
+    return "wait";
+  }
+  if (typeof answer !== "object" || answer === null) return "wait";
+  const fields = answer;
+  const text5 = fields["text"];
+  if (typeof text5 === "string" && text5.length > 0) return text5;
+  return fields["done"] === true ? "done" : "wait";
+}
+async function runSteerWait(deps) {
+  const now = deps.now ?? (() => Date.now());
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve23) => setTimeout(resolve23, ms)));
+  const post2 = deps.post ?? postUnix;
+  const sessionId = sessionOf(deps.stdin);
+  if (sessionId === void 0) return DONE;
+  const useTcp = deps.platform === "win32";
+  const startedAt = now();
+  const deadline = startedAt + (deps.lifetimeMs ?? STEER_WAIT_TIMEOUT_S * 1e3 - STEER_WAIT_EXIT_MARGIN_MS);
+  const body2 = JSON.stringify({
+    session_id: sessionId,
+    harness: deps.harness,
+    started_at: startedAt
+  });
+  let failures = 0;
+  const backOff = async () => {
+    failures += 1;
+    await sleep2(
+      Math.min(
+        STEER_WAIT_RETRY_MS * 2 ** (failures - 1),
+        STEER_WAIT_MAX_RETRY_MS
+      )
+    );
+  };
+  while (now() < deadline) {
+    const routing = readHostRouting(deps.paths.hostFile);
+    if (routing === void 0) return DONE;
+    if (useTcp && routing.port === void 0) return DONE;
+    const askedAt = now();
+    let result2;
+    try {
+      result2 = await post2({
+        ...useTcp ? { loopbackPort: routing.port } : { socketPath: deps.paths.socket },
+        path: `/steer-wait/${routing.host_enrollment_id}`,
+        headers: { Authorization: `Bearer ${routing.local_token}` },
+        body: body2,
+        connectTimeoutMs: 1e3,
+        responseTimeoutMs: STEER_WAIT_REQUEST_MS
+      });
+    } catch {
+      await backOff();
+      continue;
+    }
+    if (result2.status === 404) return DONE;
+    if (result2.status !== 200) {
+      await backOff();
+      continue;
+    }
+    failures = 0;
+    const answer = readAnswer(result2.body);
+    if (answer === "done") return DONE;
+    if (answer !== "wait") return { exitCode: 2, stderr: `${answer}
+` };
+    if (now() - askedAt < STEER_WAIT_MIN_HOLD_MS)
+      await sleep2(STEER_WAIT_MIN_HOLD_MS);
+  }
+  return DONE;
+}
+async function runSteerWaitProcess(argv, stdin) {
+  const harness = harnessFromArgv(argv);
+  let result2;
+  try {
+    result2 = await runSteerWait({
+      paths: agentPathsForEnrollment(
+        tachoHome(process.env),
+        enrollmentFromArgv(argv),
+        harness
+      ),
+      stdin,
+      harness,
+      platform: process.platform
+    });
+  } catch {
+    result2 = DONE;
+  }
+  if (result2.stderr.length > 0) process.stderr.write(result2.stderr);
+  process.exitCode = result2.exitCode;
+}
+var STEER_WAIT_REQUEST_MS, STEER_WAIT_RETRY_MS, STEER_WAIT_MAX_RETRY_MS, STEER_WAIT_MIN_HOLD_MS, STEER_WAIT_EXIT_MARGIN_MS, DONE;
+var init_steer_wait = __esm({
+  "../../packages/tacho/src/claude-code/steer-wait.ts"() {
+    "use strict";
+    init_agents();
+    init_paths();
+    init_settings_writer();
+    init_hook_client();
+    STEER_WAIT_REQUEST_MS = 35e3;
+    STEER_WAIT_RETRY_MS = 2e3;
+    STEER_WAIT_MAX_RETRY_MS = 3e4;
+    STEER_WAIT_MIN_HOLD_MS = 1e3;
+    STEER_WAIT_EXIT_MARGIN_MS = 6e4;
+    DONE = { exitCode: 0, stderr: "" };
+  }
+});
+
 // ../../packages/tacho/src/claude-code/hook-process.ts
 async function readStdin(source = process.stdin, deadlineMs = STDIN_READ_DEADLINE_MS, maxBytes = MAX_HOOK_STDIN_BYTES) {
   const chunks = [];
   let bytes = 0;
   let overflowed = false;
   let timer;
-  const deadline = new Promise((resolve22) => {
-    timer = setTimeout(() => resolve22("timeout"), deadlineMs);
+  const deadline = new Promise((resolve23) => {
+    timer = setTimeout(() => resolve23("timeout"), deadlineMs);
     timer.unref?.();
   });
   const read2 = (async () => {
@@ -13032,6 +13193,11 @@ function runHookCall(payload, argv, env = process.env) {
   });
 }
 async function runHookProcess(argv = process.argv) {
+  if (argv.includes(STEER_WAIT_FLAG)) {
+    const read2 = await readStdin();
+    await runSteerWaitProcess(argv, read2.text);
+    return;
+  }
   const agent = agentFromArgv(argv);
   let stdin = "";
   try {
@@ -13083,8 +13249,10 @@ var init_hook_process = __esm({
     "use strict";
     init_agents();
     init_paths();
+    init_settings_writer();
     init_ids();
     init_hook_client();
+    init_steer_wait();
     MAX_HOOK_STDIN_BYTES = 8 * 1024 * 1024;
     STDIN_READ_DEADLINE_MS = 2e3;
   }
@@ -18978,6 +19146,47 @@ var init_registry = __esm({
         if (over > 0) this.expiredOnSeal.splice(0, over);
         return withdrawn;
       }
+      /**
+       * Take every queued message whose deadline passed off its session's queue,
+       * and hand each to `takeExpiredOnSeal` as `expired`. A boundary drops such
+       * a message too, but an agent idle at its prompt reaches no boundary, and
+       * its steer read `received` long past its expiry. Answers how many went.
+       */
+      expireQueuedPrompts(now) {
+        let expired = 0;
+        let room = MAX_EXPIRED_ON_SEAL - this.expiredOnSeal.length;
+        for (const record of this.sessions.values()) {
+          const kept = [];
+          for (const message of record.control.messages) {
+            const due = !(message.expiresAt === null || Date.parse(message.expiresAt) >= now);
+            if (!due) {
+              kept.push(message);
+              continue;
+            }
+            if (!this.expiredOnSeal.some((ack) => ack.command_id === message.id)) {
+              if (room <= 0) {
+                kept.push(message);
+                continue;
+              }
+              this.expiredOnSeal.push({
+                command_id: message.id,
+                status: "expired",
+                session_uuid: record.recorder.sessionUuid,
+                detail: "expired before a boundary"
+              });
+              room -= 1;
+            }
+            expired += 1;
+          }
+          if (kept.length !== record.control.messages.length)
+            record.control.messages.splice(
+              0,
+              record.control.messages.length,
+              ...kept
+            );
+        }
+        return expired;
+      }
       /**
        * The `expired` acknowledgements for messages whose session sealed before
        * a boundary delivered them, drained. The daemon sends them with the rest.
@@ -19384,7 +19593,7 @@ async function statIfExists(path2) {
   }
 }
 function yieldTurn() {
-  return new Promise((resolve22) => setImmediate(resolve22));
+  return new Promise((resolve23) => setImmediate(resolve23));
 }
 async function readAt(path2, offset, length) {
   const handle = await fs.open(path2, "r");
@@ -20388,7 +20597,7 @@ async function runBackfill(request3, deps) {
   const aborted = () => deps.signal?.aborted === true;
   const between = async () => {
     if (aborted()) throw new Stopped();
-    await new Promise((resolve22) => setImmediate(resolve22));
+    await new Promise((resolve23) => setImmediate(resolve23));
     if (deps.now() - checkedAt < CHECK_EVERY_MS) return;
     checkedAt = deps.now();
     deps.progress?.({ finished: false, ...counts2() });
@@ -20410,7 +20619,7 @@ async function runBackfill(request3, deps) {
       else pending.push(candidate);
       if (aborted()) throw new Stopped();
       if (index % LOCAL_CHECKS_PER_TURN === LOCAL_CHECKS_PER_TURN - 1)
-        await new Promise((resolve22) => setImmediate(resolve22));
+        await new Promise((resolve23) => setImmediate(resolve23));
     }
     const server = await askServer(pending, deps);
     for (const candidate of pending) {
@@ -20852,7 +21061,7 @@ async function resultAgentIds(path2) {
     await readSlices(path2, SEAL_SLICE_BYTES, async (lines) => {
       for (const line of lines)
         if (line.text !== void 0) resultAgentIdsOf(line.text, out);
-      await new Promise((resolve22) => setImmediate(resolve22));
+      await new Promise((resolve23) => setImmediate(resolve23));
     });
   } catch {
   }
@@ -21400,6 +21609,20 @@ function stripClaudeCodeMcpConfig(existing, enrollmentId, restore = {}) {
 function claudeCodeMcpPresence(existing, enrollmentId) {
   return oxagenMcpPresence(existing, enrollmentId);
 }
+function isEnrolledOxagenEntry(entry2, enrollmentId, enrolled) {
+  const server = asRecord(entry2);
+  if (server === void 0) return false;
+  const args = Array.isArray(server.args) ? server.args : [];
+  const at2 = args.indexOf("mcp-stdio");
+  const env = asRecord(server.env);
+  return (enrolled.shimCommand === void 0 || server.command === enrolled.shimCommand) && at2 >= 0 && JSON.stringify(args.slice(at2)) === JSON.stringify([
+    "mcp-stdio",
+    "--enrollment",
+    enrollmentId,
+    "--port",
+    String(enrolled.port)
+  ]) && env?.["TACHO_LOCAL_TOKEN"] === enrolled.localToken;
+}
 function claudeCodeSessionHasOxagenTools(check2) {
   if (!check2.hasGatewayKey || check2.registeredAt === void 0) return false;
   const registered = Date.parse(check2.registeredAt);
@@ -21409,6 +21632,12 @@ function claudeCodeSessionHasOxagenTools(check2) {
   const userConfig = check2.readUserConfig();
   if (!claudeCodeMcpPresence(userConfig, check2.enrollmentId).present)
     return false;
+  if (check2.enrolled !== void 0 && !isEnrolledOxagenEntry(
+    member2(member2(userConfig, "mcpServers"), OXAGEN_MCP_SERVER_KEY),
+    check2.enrollmentId,
+    check2.enrolled
+  ))
+    return false;
   return check2.cwd === void 0 || !shadowedInProject(
     userConfig,
     check2.cwd,
@@ -23946,9 +24175,9 @@ function failure3(problem, count12) {
 }
 function codexAppServerClient(options) {
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  return (requests) => new Promise((resolve22) => {
+  return (requests) => new Promise((resolve23) => {
     if (requests.length === 0) {
-      resolve22({ answers: [] });
+      resolve23({ answers: [] });
       return;
     }
     let child;
@@ -23961,7 +24190,7 @@ function codexAppServerClient(options) {
         ...invocation.windowsVerbatimArguments === true ? { windowsVerbatimArguments: true } : {}
       });
     } catch (error) {
-      resolve22(
+      resolve23(
         failure3(
           `could not run \`codex app-server\`: ${error instanceof Error ? error.message : String(error)}`,
           requests.length
@@ -23986,7 +24215,7 @@ function codexAppServerClient(options) {
       child.stdin.end();
       child.kill();
       const said = stderr.trim();
-      resolve22(
+      resolve23(
         problem === void 0 ? { answers } : {
           answers,
           problem: said.length === 0 ? problem : `${problem}: ${said}`
@@ -24941,7 +25170,7 @@ import { readFileSync as readFileSync10 } from "node:fs";
 import { dirname as dirname9, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function readVersion() {
-  if (true) return "2.1.4-725";
+  if (true) return "2.1.4-926";
   try {
     const here = dirname9(fileURLToPath(import.meta.url));
     const pkg = JSON.parse(
@@ -25203,11 +25432,11 @@ function harnessFacts(exec4, name, platform = process.platform, env = process.en
     path2 ??= shellExecutable(exec4("sh", ["-lc", `command -v ${name}`]));
   }
   if (path2 === void 0) {
-    const sep12 = platform === "win32" ? "\\" : "/";
+    const sep13 = platform === "win32" ? "\\" : "/";
     const names2 = platform === "win32" ? [`${name}.exe`, `${name}.cmd`] : [name];
     outer: for (const dir of wellKnownBinDirs(home, platform, env)) {
       for (const file of names2) {
-        const candidate = `${dir}${sep12}${file}`;
+        const candidate = `${dir}${sep13}${file}`;
         if (exists(candidate)) {
           path2 = candidate;
           break outer;
@@ -26304,6 +26533,29 @@ function loadOrCreateDeviceKey(path2) {
   writeSensitiveFileAtomic(path2, deviceKeyPem(key));
   return { key, created: true };
 }
+function credentialDigest(credential) {
+  return createHash4("sha256").update(credential, "utf8").digest("hex");
+}
+function deviceKeyProofMessage(claims) {
+  return JSON.stringify([
+    DEVICE_KEY_PROOF_DOMAIN,
+    claims.credentialDigest,
+    claims.devicePublicKey,
+    claims.hostname,
+    claims.osUser,
+    claims.platform,
+    [...claims.harnesses],
+    claims.signedAtUnixS
+  ]);
+}
+function signDeviceKeyProof(key, claims) {
+  return {
+    signedAtUnixS: claims.signedAtUnixS,
+    signature: key.sign(
+      deviceKeyProofMessage({ ...claims, devicePublicKey: key.publicKey })
+    )
+  };
+}
 function verifyDeviceSignature(publicKey, message, signatureBase64) {
   if (!publicKey.startsWith("ed25519:")) return false;
   const raw = Buffer.from(publicKey.slice("ed25519:".length), "base64");
@@ -26323,12 +26575,13 @@ function verifyDeviceSignature(publicKey, message, signatureBase64) {
     return false;
   }
 }
-var SPKI_ED25519_PREFIX_BYTES;
+var SPKI_ED25519_PREFIX_BYTES, DEVICE_KEY_PROOF_DOMAIN;
 var init_device_key = __esm({
   "../../packages/tacho/src/host/device-key.ts"() {
     "use strict";
     init_fs();
     SPKI_ED25519_PREFIX_BYTES = 12;
+    DEVICE_KEY_PROOF_DOMAIN = "oxagen.tacho.device-key-proof.v1";
   }
 });
 
@@ -27441,7 +27694,7 @@ ${lines.join("\n")}
       async bodiesForAsync(events) {
         const found = /* @__PURE__ */ new Map();
         for (let at2 = 0; at2 < events.length; at2 += BODY_READ_SLICE) {
-          if (at2 > 0) await new Promise((resolve22) => setImmediate(resolve22));
+          if (at2 > 0) await new Promise((resolve23) => setImmediate(resolve23));
           let slice = events.slice(at2, at2 + BODY_READ_SLICE);
           for (let attempt = 0; attempt < 2 && slice.length > 0; attempt += 1) {
             const stale = /* @__PURE__ */ new Set();
@@ -27638,7 +27891,7 @@ ${lines.join("\n")}
         let blanked = 0;
         let moved = false;
         for (let next = 0; next < found.length; ) {
-          if (next > 0) await new Promise((resolve22) => setImmediate(resolve22));
+          if (next > 0) await new Promise((resolve23) => setImmediate(resolve23));
           const slice = this.blankSlice(path2, found, next, idems);
           if (slice === void 0) break;
           blanked += slice.blanked;
@@ -30417,8 +30670,8 @@ function harnessFileProblems(harnesses, deps) {
   if (harnesses.includes("codex"))
     check2(deps.paths.codexHooks, deps.readCodexHooks, hooksShapeProblem);
   if (harnesses.includes("cursor")) {
-    const relative10 = absoluteHookCommandProblem(deps.runtime.hookCommand);
-    if (relative10 !== void 0) problems.push(relative10);
+    const relative11 = absoluteHookCommandProblem(deps.runtime.hookCommand);
+    if (relative11 !== void 0) problems.push(relative11);
     for (const path2 of deps.paths.cursorHooks)
       check2(path2, () => deps.readCursorHooks(path2), cursorHooksShapeProblem);
   }
@@ -30760,9 +31013,22 @@ ${problems.map((problem) => `  ${problem}`).join("\n")}`
     let response;
     let tenant;
     let agentId;
+    const deviceKeyProof = signDeviceKeyProof(key, {
+      credentialDigest: credentialDigest(
+        credentials2 ? credentials2.token : options.enrollmentToken ?? ""
+      ),
+      hostname: facts.hostname,
+      osUser: facts.osUser,
+      platform: facts.platform,
+      harnesses: facts.harnesses,
+      signedAtUnixS: Math.floor(deps.now() / 1e3)
+    });
     try {
       if (credentials2) {
-        response = await callEnrollment(deps, credentials2, facts);
+        response = await callEnrollment(deps, credentials2, {
+          ...facts,
+          deviceKeyProof
+        });
         tenant = {
           orgSlug: credentials2.org,
           workspaceSlug: credentials2.workspace
@@ -30772,6 +31038,7 @@ ${problems.map((problem) => `  ${problem}`).join("\n")}`
         const answer = await callTokenEnrollment(deps, apiUrl, {
           token: options.enrollmentToken,
           ...facts,
+          deviceKeyProof,
           ...remote !== void 0 ? { repositoryRemote: remote } : {}
         });
         response = answer;
@@ -33098,7 +33365,7 @@ function runLineOf(raw) {
   return void 0;
 }
 function streamDaemon(options) {
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve23, reject) => {
     const req = request2(
       {
         ...options.socketPath !== void 0 ? { socketPath: options.socketPath } : { host: "127.0.0.1", port: options.loopbackPort },
@@ -33126,7 +33393,7 @@ function streamDaemon(options) {
         });
         res.on("end", () => {
           if (buffered.length > 0) options.onLine(buffered);
-          resolve22(res.statusCode ?? 0);
+          resolve23(res.statusCode ?? 0);
         });
         res.on("error", reject);
       }
@@ -33299,7 +33566,7 @@ function spawnAgent(command2, args, options) {
     process.platform,
     options.env
   );
-  return new Promise((resolve22) => {
+  return new Promise((resolve23) => {
     const child = spawn2(invocation.command, invocation.args, {
       cwd: options.cwd,
       env: options.env,
@@ -33315,7 +33582,7 @@ function spawnAgent(command2, args, options) {
       process.off("SIGINT", stay);
       process.off("SIGTERM", forward);
       process.off("SIGHUP", forward);
-      resolve22(exit);
+      resolve23(exit);
     };
     if (options.onSpawn !== void 0) child.once("spawn", options.onSpawn);
     child.once("error", (error) => done({ code: null, signal: null, error }));
@@ -37805,17 +38072,17 @@ async function startContainedBridge(options) {
     "upgrade",
     (_request, socket) => socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n")
   );
-  await new Promise((resolve22, reject) => {
+  await new Promise((resolve23, reject) => {
     server.once("error", reject);
     server.listen(options.socketPath, () => {
       chmodSync6(options.socketPath, 384);
-      resolve22();
+      resolve23();
     });
   });
   return {
     close: async () => {
       server.closeAllConnections();
-      await new Promise((resolve22) => server.close(() => resolve22()));
+      await new Promise((resolve23) => server.close(() => resolve23()));
     }
   };
 }
@@ -37843,7 +38110,7 @@ var init_bridge = __esm({
 
 // ../../packages/tacho/src/contained/workspace.ts
 import { lstatSync as lstatSync6, readFileSync as readFileSync14, readdirSync as readdirSync11, realpathSync as realpathSync3 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join23, relative as relative2, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join23, relative as relative2, resolve as resolve9, sep as sep2 } from "node:path";
 function within(root, path2) {
   const rel = relative2(root, path2);
   return rel === "" || !isAbsolute3(rel) && rel !== ".." && !rel.startsWith(`..${sep2}`);
@@ -37905,6 +38172,54 @@ function validateContainedWorkspace(workspace, sessionDirectory, mountInfo = rea
   };
   visit2(root);
 }
+function gitDirectoryMounts(workspace) {
+  const root = realpathSync3(workspace);
+  const dotGit = join23(root, ".git");
+  let stat7;
+  try {
+    stat7 = lstatSync6(dotGit);
+  } catch {
+    throw new Error(
+      "Contained repository has no .git at its root; launch from the repository root"
+    );
+  }
+  if (stat7.isSymbolicLink())
+    throw new Error(
+      "Contained repository's .git is a symbolic link; replace it with the directory it points to before launch"
+    );
+  const mounts = [dotGit];
+  if (stat7.isDirectory()) return mounts;
+  if (!stat7.isFile())
+    throw new Error(
+      "Contained repository's .git is neither a directory nor a file"
+    );
+  const pointer = /^gitdir:\s*(.+?)\s*$/m.exec(readFileSync14(dotGit, "utf8"));
+  if (pointer === null)
+    throw new Error(
+      "Contained repository's .git file names no git directory"
+    );
+  const addInside = (path2) => {
+    let real;
+    try {
+      real = realpathSync3(path2);
+    } catch {
+      return void 0;
+    }
+    if (within(root, real) && !mounts.includes(real)) mounts.push(real);
+    return real;
+  };
+  const gitDir = addInside(resolve9(root, pointer[1]));
+  if (gitDir !== void 0) {
+    let common;
+    try {
+      common = readFileSync14(join23(gitDir, "commondir"), "utf8").trim();
+    } catch {
+      common = void 0;
+    }
+    if (common) addInside(resolve9(gitDir, common));
+  }
+  return mounts;
+}
 var CREDENTIAL_PATHS;
 var init_workspace = __esm({
   "../../packages/tacho/src/contained/workspace.ts"() {
@@ -37921,8 +38236,74 @@ var init_workspace = __esm({
   }
 });
 
+// ../../packages/tacho/src/collector/hardened-git.ts
+function hardenedGitArgs(cwd, args, globals = []) {
+  const subcommand = args[0];
+  const end = args.indexOf("--");
+  const options = end < 0 ? args : args.slice(0, end);
+  const extra = subcommand !== void 0 && DIFF_SUBCOMMANDS.has(subcommand) ? DIFF_FLAGS.filter((flag2) => !options.includes(flag2)) : [];
+  return [
+    "-C",
+    cwd,
+    ...HARDENED_GIT_CONFIG,
+    ...globals,
+    ...options,
+    ...extra,
+    ...end < 0 ? [] : args.slice(end)
+  ];
+}
+function hardenedGitShellPrefix() {
+  return ["git", ...HARDENED_GIT_CONFIG.map(shellQuote2)].join(" ");
+}
+function shellQuote2(value) {
+  return /^[A-Za-z0-9_./=:-]+$/.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
+}
+var HARDENED_GIT_CONFIG, HARDENED_GIT_ENV, DIFF_SUBCOMMANDS, DIFF_FLAGS;
+var init_hardened_git = __esm({
+  "../../packages/tacho/src/collector/hardened-git.ts"() {
+    "use strict";
+    HARDENED_GIT_CONFIG = [
+      "-c",
+      "core.fsmonitor=false",
+      "-c",
+      "core.hooksPath=/dev/null",
+      "-c",
+      "diff.external=",
+      "-c",
+      "core.pager=cat",
+      "-c",
+      "log.showSignature=false"
+    ];
+    HARDENED_GIT_ENV = {
+      GIT_CONFIG_NOSYSTEM: "1",
+      GIT_TERMINAL_PROMPT: "0"
+    };
+    DIFF_SUBCOMMANDS = /* @__PURE__ */ new Set(["diff", "show", "log"]);
+    DIFF_FLAGS = ["--no-ext-diff", "--no-textconv"];
+  }
+});
+
 // ../../packages/tacho/src/contained/profile.ts
 import { createHash as createHash6 } from "node:crypto";
+import { isAbsolute as isAbsolute4, join as join24, relative as relative3, sep as sep3 } from "node:path";
+function containerPath(workspace, path2) {
+  const inside2 = relative3(workspace, path2);
+  if (inside2 === "" || isAbsolute4(inside2) || inside2 === ".." || inside2.startsWith(`..${sep3}`))
+    throw new Error(
+      "A contained git mount must lie inside the workspace it protects"
+    );
+  return `/workspace/${inside2.split(sep3).join("/")}`;
+}
+function gitMountPairs(spec) {
+  if (!spec.gitMounts.includes(join24(spec.workspace, ".git")))
+    throw new Error(
+      "Contained execution must mount the repository's .git read-only"
+    );
+  return spec.gitMounts.map((src) => ({
+    src: mountPath(src),
+    dst: containerPath(spec.workspace, src)
+  }));
+}
 function mountPath(path2) {
   if (!path2.startsWith("/") || /[,\r\n\0]/.test(path2)) {
     throw new Error(
@@ -37940,6 +38321,7 @@ function containerArguments(spec) {
     throw new Error("Contained execution requires an unprivileged Linux user");
   if (!CONTAINED_HARNESSES.includes(spec.harness))
     throw new Error("Unsupported contained harness");
+  const gitMounts = gitMountPairs(spec);
   return [
     "create",
     "--name",
@@ -37968,6 +38350,10 @@ function containerArguments(spec) {
     `type=bind,src=${mountPath(spec.workspace)},dst=/workspace`,
     "--mount",
     `type=bind,src=${mountPath(spec.sessionDirectory)},dst=/opt/oxagen/session,readonly`,
+    ...gitMounts.flatMap(({ src, dst }) => [
+      "--mount",
+      `type=bind,src=${src},dst=${dst},readonly`
+    ]),
     "--workdir",
     "/workspace",
     "--env",
@@ -37990,12 +38376,24 @@ function measureContainer(raw, spec, configuration) {
   const mounts = value?.Mounts;
   const containerId = value?.Id ?? "";
   const expectedCommand = ["/opt/oxagen/entry.mjs", spec.harness, ...spec.args];
+  let gitMounts;
+  try {
+    gitMounts = gitMountPairs(spec);
+  } catch {
+    gitMounts = void 0;
+  }
   const safe = /^([a-f0-9]{64})$/.test(containerId) && value?.Image === spec.image && host?.NetworkMode === "none" && host.ReadonlyRootfs === true && host.Privileged === false && (host.CapAdd?.length ?? 0) === 0 && host.CapDrop?.includes("ALL") === true && host.SecurityOpt?.some(
     (option) => option === "no-new-privileges" || option === "no-new-privileges=true"
-  ) === true && host.PidMode === "" && host.IpcMode === "private" && host.UsernsMode === "" && host.CgroupnsMode === "private" && (host.Devices?.length ?? 0) === 0 && (host.DeviceRequests?.length ?? 0) === 0 && config?.User === `${spec.uid}:${spec.gid}` && config.WorkingDir === "/workspace" && JSON.stringify(config.Entrypoint) === JSON.stringify(["/usr/local/bin/node"]) && JSON.stringify(config.Cmd) === JSON.stringify(expectedCommand) && mounts?.length === 2 && mounts.some(
+  ) === true && host.PidMode === "" && host.IpcMode === "private" && host.UsernsMode === "" && host.CgroupnsMode === "private" && (host.Devices?.length ?? 0) === 0 && (host.DeviceRequests?.length ?? 0) === 0 && config?.User === `${spec.uid}:${spec.gid}` && config.WorkingDir === "/workspace" && JSON.stringify(config.Entrypoint) === JSON.stringify(["/usr/local/bin/node"]) && JSON.stringify(config.Cmd) === JSON.stringify(expectedCommand) && gitMounts !== void 0 && mounts?.length === 2 + gitMounts.length && mounts.some(
     (mount) => mount.Type === "bind" && mount.Source === spec.workspace && mount.Destination === "/workspace" && mount.RW === true
   ) && mounts.some(
     (mount) => mount.Type === "bind" && mount.Source === spec.sessionDirectory && mount.Destination === "/opt/oxagen/session" && mount.RW === false
+  ) && // Each git mount read-only where it was asked for, so the agent cannot
+  // write the configuration the daemon's host-side git reads (F-2284).
+  gitMounts.every(
+    ({ src, dst }) => mounts.some(
+      (mount) => mount.Type === "bind" && mount.Source === src && mount.Destination === dst && mount.RW === false
+    )
   );
   if (!safe)
     throw new Error(
@@ -38064,7 +38462,7 @@ import {
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute4, join as join24 } from "node:path";
+import { isAbsolute as isAbsolute5, join as join25 } from "node:path";
 import { promisify } from "node:util";
 function reason(error) {
   return error instanceof Error ? error.message : String(error);
@@ -38077,13 +38475,13 @@ async function launchContainedAgent(options) {
     throw new Error(
       "Contained execution requires an unprivileged Linux runner with Docker"
     );
-  if (!isAbsolute4(options.request.workspace))
+  if (!isAbsolute5(options.request.workspace))
     throw new Error("Contained workspace must be an absolute repository path");
   const workspace = realpathSync4(options.request.workspace);
   const root = await exec(
     "git",
-    ["-C", workspace, "rev-parse", "--show-toplevel"],
-    { timeout: 15e3 }
+    hardenedGitArgs(workspace, ["rev-parse", "--show-toplevel"]),
+    { timeout: 15e3, env: { ...process.env, ...HARDENED_GIT_ENV } }
   );
   if (realpathSync4(root.stdout.trim()) !== workspace)
     throw new Error("Contained workspace must be the repository root");
@@ -38103,7 +38501,7 @@ async function launchContainedAgent(options) {
   if (digest6 === void 0)
     throw new Error("The operator's contained image is not installed");
   const sessionId = `contained-${randomBytes8(16).toString("hex")}`;
-  const directory = mkdtempSync(join24(tmpdir(), "oxagen-contained-"));
+  const directory = mkdtempSync(join25(tmpdir(), "oxagen-contained-"));
   chmodSync7(directory, 448);
   let prepared;
   let containerCreated = false;
@@ -38116,6 +38514,7 @@ async function launchContainedAgent(options) {
         "Contained configuration must be outside the writable repository"
       );
     validateContainedWorkspace(workspace, directory);
+    const gitMounts = gitDirectoryMounts(workspace);
     prepared = await options.prepare({ sessionId, directory, workspace });
     const entries2 = Object.entries(prepared.files).sort(
       ([a], [b3]) => a.localeCompare(b3)
@@ -38123,7 +38522,7 @@ async function launchContainedAgent(options) {
     for (const [name2, contents] of entries2) {
       if (!/^[a-z0-9.-]+$/.test(name2))
         throw new Error("Invalid contained configuration filename");
-      writeFileSync2(join24(directory, name2), contents, {
+      writeFileSync2(join25(directory, name2), contents, {
         mode: 256,
         flag: "wx"
       });
@@ -38136,7 +38535,8 @@ async function launchContainedAgent(options) {
       uid: process.getuid?.() ?? 0,
       gid: process.getgid?.() ?? 0,
       harness: options.request.harness,
-      args: options.request.args
+      args: options.request.args,
+      gitMounts
     };
     await exec("docker", containerArguments(spec), { timeout: 3e4 });
     containerCreated = true;
@@ -38152,7 +38552,7 @@ async function launchContainedAgent(options) {
     admitted = true;
     if (options.signal?.aborted)
       throw new Error("Contained run cancelled before start");
-    exitCode = await new Promise((resolve22, reject) => {
+    exitCode = await new Promise((resolve23, reject) => {
       const child = spawn3("docker", ["start", "--attach", name], {
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -38175,7 +38575,7 @@ async function launchContainedAgent(options) {
       child.once("error", reject);
       child.once("close", (code) => {
         options.signal?.removeEventListener("abort", stop);
-        resolve22(code ?? 1);
+        resolve23(code ?? 1);
       });
     });
     return { sessionId, exitCode, measurement };
@@ -38204,6 +38604,7 @@ var init_launcher = __esm({
     init_zod();
     init_configuration();
     init_workspace();
+    init_hardened_git();
     init_profile();
     exec = promisify(execFile2);
     imageInspectSchema = external_exports.array(external_exports.object({ Id: external_exports.string().optional() }));
@@ -38264,16 +38665,16 @@ async function startSandboxGateway(options, port = SANDBOX_GATEWAY_PORT) {
     "upgrade",
     (_request, socket) => socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n")
   );
-  await new Promise((resolve22, reject) => {
+  await new Promise((resolve23, reject) => {
     server.once("error", reject);
-    server.listen(port, "127.0.0.1", () => resolve22());
+    server.listen(port, "127.0.0.1", () => resolve23());
   });
   const address = server.address();
   return {
     port: typeof address === "object" && address !== null ? address.port : port,
     close: async () => {
       server.closeAllConnections();
-      await new Promise((resolve22) => server.close(() => resolve22()));
+      await new Promise((resolve23) => server.close(() => resolve23()));
     }
   };
 }
@@ -38520,8 +38921,8 @@ var init_privilege = __esm({
 
 // ../../packages/tacho/src/contained/sandbox/launcher.ts
 import { randomBytes as randomBytes9 } from "node:crypto";
-import { join as join25 } from "node:path";
-function shellQuote2(value) {
+import { join as join26 } from "node:path";
+function shellQuote3(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function sandboxHarnessEnvironment(request3, gatewayPort) {
@@ -38547,7 +38948,7 @@ function ptyCommand(argv) {
       "-f",
       "-e",
       "-c",
-      `exec ${argv.map(shellQuote2).join(" ")}`,
+      `exec ${argv.map(shellQuote3).join(" ")}`,
       "/dev/null"
     ]
   };
@@ -38610,7 +39011,7 @@ async function launchSandboxAgent(options) {
       { ...asAgent, cwd: SANDBOX_AGENT_HOME, timeoutMs: 15 * 6e4 }
     );
     for (const [name, contents] of Object.entries(claudeCodeUserState())) {
-      const path2 = join25(SANDBOX_AGENT_HOME, name);
+      const path2 = join26(SANDBOX_AGENT_HOME, name);
       system.writeFile(path2, contents, 384);
       system.chown(path2, SANDBOX_AGENT_UID, SANDBOX_AGENT_GID);
     }
@@ -38772,9 +39173,9 @@ var init_system = __esm({
           ...options.env !== void 0 ? { env: options.env } : {},
           stdio: ["pipe", "pipe", "inherit"]
         });
-        const exited = new Promise((resolve22) => {
-          child.once("error", () => resolve22(1));
-          child.once("close", (code) => resolve22(code ?? 1));
+        const exited = new Promise((resolve23) => {
+          child.once("error", () => resolve23(1));
+          child.once("close", (code) => resolve23(code ?? 1));
         });
         return {
           pid: child.pid,
@@ -38816,10 +39217,10 @@ var init_system = __esm({
 });
 
 // ../../packages/tacho/src/contained/runner.ts
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 function containedHookEnv(harness, workspace) {
-  const home = join26(workspace, ".oxagen-contained", "home");
-  return harness === "codex" ? { CODEX_HOME: join26(home, ".codex") } : { CLAUDE_CONFIG_DIR: join26(home, ".claude") };
+  const home = join27(workspace, ".oxagen-contained", "home");
+  return harness === "codex" ? { CODEX_HOME: join27(home, ".codex") } : { CLAUDE_CONFIG_DIR: join27(home, ".claude") };
 }
 function containedLaunchEndpoint(host) {
   const ingest = new URL(host.endpoints.ingest);
@@ -39017,7 +39418,7 @@ function createContainedRunner(options) {
             sessionUuid2 = started.recorder.sessionUuid;
             active2.set(sessionUuid2, controller);
             const bridge = await startContainedBridge({
-              socketPath: join26(directory, "bridge.sock"),
+              socketPath: join27(directory, "bridge.sock"),
               ...bridgeRoutes({
                 sessionId,
                 workspace,
@@ -39101,7 +39502,7 @@ function createContainedRunner(options) {
       const abort = () => controller.abort();
       signal?.addEventListener("abort", abort, { once: true });
       if (signal?.aborted) abort();
-      const env = { CLAUDE_CONFIG_DIR: join26(SANDBOX_AGENT_HOME, ".claude") };
+      const env = { CLAUDE_CONFIG_DIR: join27(SANDBOX_AGENT_HOME, ".claude") };
       let sessionUuid2;
       let launchedSessionId;
       let opened = false;
@@ -39236,7 +39637,7 @@ var init_runner = __esm({
 
 // ../../packages/tacho/src/collector/detector.ts
 import { promises as fs3 } from "node:fs";
-import { basename as basename5, join as join27 } from "node:path";
+import { basename as basename5, join as join28 } from "node:path";
 async function eachLimited(items, limit, task) {
   let next = 0;
   const workers = Array.from(
@@ -39262,7 +39663,7 @@ async function scanProject(dir) {
   await eachLimited(names2, SCAN_CONCURRENCY, async (name) => {
     const match = SESSION_FILE.exec(name);
     if (match === null) return;
-    const path2 = join27(dir, name);
+    const path2 = join28(dir, name);
     try {
       const st = await fs3.stat(path2);
       out.push({ sessionId: match[1], path: path2, mtimeMs: st.mtimeMs });
@@ -39303,7 +39704,7 @@ var init_detector = __esm({
             continue;
           }
           await eachLimited(names2, SCAN_CONCURRENCY, async (name) => {
-            const dir = join27(root, name);
+            const dir = join28(root, name);
             try {
               const st = await fs3.stat(dir);
               if (st.isDirectory()) dirs.push({ dir, mtimeMs: st.mtimeMs });
@@ -39543,7 +39944,7 @@ var init_detector = __esm({
                 transcript_path: transcript.path,
                 transcript_mtime: new Date(transcript.mtimeMs).toISOString(),
                 claude_pids: processes.map((p) => p.pid),
-                project: basename5(join27(transcript.path, ".."))
+                project: basename5(join28(transcript.path, ".."))
               }
             })
           );
@@ -39621,14 +40022,15 @@ async function git2(exec4, cwd, args, okStatus = [0]) {
 }
 async function runGit(exec4, cwd, args) {
   try {
-    return await exec4("git", [
-      "-C",
-      cwd,
-      "--no-optional-locks",
-      "-c",
-      "core.quotePath=false",
-      ...args
-    ]);
+    return await exec4(
+      "git",
+      hardenedGitArgs(cwd, args, [
+        "--no-optional-locks",
+        "-c",
+        "core.quotePath=false"
+      ]),
+      { env: HARDENED_GIT_ENV }
+    );
   } catch (error) {
     return {
       status: null,
@@ -39899,6 +40301,7 @@ var init_git_facts = __esm({
     init_digest();
     init_envelope();
     init_remote();
+    init_hardened_git();
     EMPTY_TREE_OBJECT = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
     MAX_STDOUT_BYTES = 2 * 1024 * 1024;
     MAX_CHANGED_PATHS = 2e3;
@@ -39967,7 +40370,7 @@ import {
   rm,
   unlink
 } from "node:fs/promises";
-import { dirname as dirname16, join as join28 } from "node:path";
+import { dirname as dirname16, join as join29 } from "node:path";
 function byPath(a, b3) {
   return a.path < b3.path ? -1 : a.path > b3.path ? 1 : 0;
 }
@@ -40010,7 +40413,7 @@ async function contentHash(absolutePath, kind, keep) {
   if (keep !== void 0) {
     try {
       await mkdir(keep.dir, { recursive: true, mode: 448 });
-      const temp2 = join28(keep.dir, `.partial-${randomUUID3()}`);
+      const temp2 = join29(keep.dir, `.partial-${randomUUID3()}`);
       copy = {
         temp: temp2,
         handle: await open3(temp2, "wx", keep.executable ? 448 : 384)
@@ -40054,7 +40457,7 @@ async function settleCopy(temp, name) {
   if (temp === void 0) return;
   if (name !== void 0)
     try {
-      await rename(temp, join28(dirname16(temp), name));
+      await rename(temp, join29(dirname16(temp), name));
       return;
     } catch {
     }
@@ -40070,7 +40473,7 @@ async function copiedBytes(dir) {
   let total2 = 0;
   for (const name of names2) {
     try {
-      total2 += (await lstat(join28(dir, name))).size;
+      total2 += (await lstat(join29(dir, name))).size;
     } catch {
     }
   }
@@ -40086,7 +40489,7 @@ async function removeCopiesOutside(root, live) {
   const keep = new Set(live());
   await Promise.all(
     names2.filter((name) => !keep.has(name)).map(
-      (name) => rm(join28(root, name), { recursive: true, force: true }).catch(
+      (name) => rm(join29(root, name), { recursive: true, force: true }).catch(
         () => void 0
       )
     )
@@ -40193,7 +40596,7 @@ async function contributionOf(exec4, cwd, root, repoRelative, entry2, copies) {
   let copy = null;
   if (entry2 !== null) {
     if (copies === void 0 || !COPY_NAME.test(entry2[0])) return void 0;
-    copy = join28(copies, entry2[0]);
+    copy = join29(copies, entry2[0]);
     const kept = await statOf(copy);
     if (kept === void 0 || kept === "absent" || kept.kind !== "file")
       return void 0;
@@ -40595,7 +40998,7 @@ var init_session_changes = __esm({
 });
 
 // ../../packages/tacho/src/collector/session-commits.ts
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 function parseMeta(stdout) {
   const out = [];
   for (const record of stdout.split("\0")) {
@@ -40636,7 +41039,9 @@ async function patchIds(exec4, cwd, shas) {
   const out = /* @__PURE__ */ new Map();
   if (shas.length === 0) return out;
   try {
-    const result2 = await exec4("sh", ["-c", PATCH_IDS, "sh", cwd, ...shas]);
+    const result2 = await exec4("sh", ["-c", PATCH_IDS, "sh", cwd, ...shas], {
+      env: HARDENED_GIT_ENV
+    });
     if (result2.status !== 0) return out;
     for (const line of (result2.stdout ?? "").split("\n")) {
       const [patchId, sha2] = line.trim().split(" ");
@@ -40716,7 +41121,7 @@ async function readSessionCommits(exec4, cwd, input) {
     const test = input.tests[commit.sha];
     const toolUseId = callAt(times.get(commit.sha), calls);
     const written2 = input.written;
-    const outside = merge || written2 === void 0 || root === void 0 ? void 0 : files2.some((file) => !written2.has(join29(root, file.path)));
+    const outside = merge || written2 === void 0 || root === void 0 ? void 0 : files2.some((file) => !written2.has(join30(root, file.path)));
     return {
       sha: commit.sha,
       parent_shas: commit.parents.slice(0, MAX_COMMIT_PARENTS),
@@ -40747,22 +41152,24 @@ var init_session_commits = __esm({
     init_envelope();
     init_timestamp();
     init_git_facts();
+    init_hardened_git();
     init_session_changes();
     META_FORMAT = "--format=%H%x1f%P%x1f%at%x1f%ct%x1f%s";
     PATCH_IDS = [
       'cd "$1" && shift &&',
-      "git --no-optional-locks -c core.quotePath=false",
+      hardenedGitShellPrefix(),
+      "--no-optional-locks -c core.quotePath=false",
       "-c diff.noprefix=false -c diff.mnemonicPrefix=false",
       "log --no-walk=unsorted --ignore-missing -p --no-color --no-ext-diff",
       '--no-textconv --find-renames --format="commit %H" "$@" --',
-      "| git patch-id --stable"
+      `| ${hardenedGitShellPrefix()} patch-id --stable`
     ].join(" ");
   }
 });
 
 // ../../packages/tacho/src/collector/worktree-snapshot.ts
 import { lstat as lstat2 } from "node:fs/promises";
-import { join as join30 } from "node:path";
+import { join as join31 } from "node:path";
 function headerPath(prefix, path2) {
   const name = `${prefix}${path2}`;
   let quoted3 = false;
@@ -40837,7 +41244,7 @@ async function worktreeFingerprint(status2, root) {
       const path2 = statusPath(record);
       if (path2 === null) return "";
       try {
-        const info = await lstat2(join30(root, path2));
+        const info = await lstat2(join31(root, path2));
         return `${info.size}:${info.mtimeMs}:${info.ctimeMs}`;
       } catch {
         return "absent";
@@ -40866,14 +41273,15 @@ async function readWorktreeSnapshot(exec4, cwd, baseline, measured) {
   let directory = cwd;
   const read2 = async (args, statuses = [0]) => {
     try {
-      const result2 = await exec4("git", [
-        "-C",
-        directory,
-        "--no-optional-locks",
-        "-c",
-        "core.quotePath=false",
-        ...args
-      ]);
+      const result2 = await exec4(
+        "git",
+        hardenedGitArgs(directory, args, [
+          "--no-optional-locks",
+          "-c",
+          "core.quotePath=false"
+        ]),
+        { env: HARDENED_GIT_ENV }
+      );
       return result2.status !== null && statuses.includes(result2.status) ? result2.stdout : void 0;
     } catch {
       return void 0;
@@ -40943,7 +41351,7 @@ async function readWorktreeSnapshot(exec4, cwd, baseline, measured) {
       }
       let present;
       try {
-        present = (await lstat2(join30(root, path2))).isFile();
+        present = (await lstat2(join31(root, path2))).isFile();
       } catch {
         present = false;
       }
@@ -41036,6 +41444,7 @@ var WORKTREE_PATCH_MAX_BYTES, WORKTREE_UNTRACKED_MAX, HASH, WORKTREE_FINGERPRINT
 var init_worktree_snapshot = __esm({
   "../../packages/tacho/src/collector/worktree-snapshot.ts"() {
     "use strict";
+    init_hardened_git();
     WORKTREE_PATCH_MAX_BYTES = 256 * 1024;
     WORKTREE_UNTRACKED_MAX = 32;
     HASH = /^[a-f0-9]{40,64}$/i;
@@ -41044,10 +41453,10 @@ var init_worktree_snapshot = __esm({
 });
 
 // ../../packages/tacho/src/collector/git-lane.ts
-import { join as join31 } from "node:path";
+import { join as join32 } from "node:path";
 function copiesDirOf(root, session) {
   const uuid = session.recorder.sessionUuid;
-  return /^[0-9a-f-]{36}$/i.test(uuid) ? join31(root, uuid) : void 0;
+  return /^[0-9a-f-]{36}$/i.test(uuid) ? join32(root, uuid) : void 0;
 }
 function holdsBaseline(session) {
   return session.baselineCommit !== void 0 || Object.keys(session.baselines ?? {}).length > 0;
@@ -41846,7 +42255,7 @@ var init_interjection2 = __esm({
 });
 
 // ../../packages/tacho/src/collector/recall-hints.ts
-import { isAbsolute as isAbsolute5, relative as relative3, resolve as resolve9, sep as sep3 } from "node:path";
+import { isAbsolute as isAbsolute6, relative as relative4, resolve as resolve10, sep as sep4 } from "node:path";
 function retryDelay(failures) {
   return Math.min(
     REPOSITORY_RETRY_FIRST_MS * 2 ** (failures - 1),
@@ -41861,10 +42270,10 @@ function inFront(list2, entry2, max2) {
   return [entry2, ...list2.filter((held) => held !== entry2)].slice(0, max2);
 }
 function relativeTo(root, path2) {
-  const inside2 = relative3(root, path2);
-  if (inside2 === ".." || inside2.startsWith(`..${sep3}`)) return void 0;
-  if (isAbsolute5(inside2)) return void 0;
-  return inside2.split(sep3).join("/");
+  const inside2 = relative4(root, path2);
+  if (inside2 === ".." || inside2.startsWith(`..${sep4}`)) return void 0;
+  if (isAbsolute6(inside2)) return void 0;
+  return inside2.split(sep4).join("/");
 }
 function recalledToolName(seen) {
   const rest = seen.startsWith(MCP_PREFIX2) ? seen.slice(MCP_PREFIX2.length) : "";
@@ -41882,7 +42291,7 @@ function noteRecallHints(record, toolName3, toolInput) {
     const value = toolInput?.[key];
     if (typeof value !== "string" || value.length === 0) continue;
     const cwd = record.cwd;
-    const absolute = isAbsolute5(value) ? resolve9(value) : cwd !== void 0 && isAbsolute5(cwd) ? resolve9(cwd, value) : void 0;
+    const absolute = isAbsolute6(value) ? resolve10(value) : cwd !== void 0 && isAbsolute6(cwd) ? resolve10(cwd, value) : void 0;
     if (absolute !== void 0)
       hints.paths = inFront(hints.paths, absolute, RECALL_PATHS_KEPT);
   }
@@ -41971,7 +42380,8 @@ function notePolicyRunCall(record, call2) {
     {
       harness: call2.harness,
       toolName: call2.toolName,
-      ...call2.toolInput !== void 0 ? { toolInput: call2.toolInput } : {}
+      ...call2.toolInput !== void 0 ? { toolInput: call2.toolInput } : {},
+      ...call2.oxagenServerVerified !== void 0 ? { oxagenServerVerified: call2.oxagenServerVerified } : {}
     },
     call2.cedar.tools
   );
@@ -41995,7 +42405,7 @@ var init_policy_run = __esm({
 
 // ../../packages/tacho/src/collector/hook-handler.ts
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname17, isAbsolute as isAbsolute6 } from "node:path";
+import { dirname as dirname17, isAbsolute as isAbsolute7 } from "node:path";
 function containmentUnmet(view, record) {
   return view.verified && view.bundle.mode === "enforce" && view.bundle.containment?.required === true && view.launchedContained?.(record.harnessSessionId) !== true;
 }
@@ -42119,9 +42529,13 @@ function deliversMessages(harness, hookEventName) {
     return hookEventName === "SessionStart" || hookEventName === "Stop" || hookEventName === "PreToolUse";
   return MESSAGE_BOUNDARIES.has(hookEventName);
 }
+function answerInTime(deps, now) {
+  return deps.answerBy === void 0 || now + DRAIN_ANSWER_MARGIN_MS <= deps.answerBy;
+}
 function drainMessages(record, deps, events, used = 0) {
   const delivered = [];
   const now = deps.now();
+  if (!answerInTime(deps, now)) return delivered;
   const max2 = hookAnswerMaxChars(record.harness);
   const queue = record.control.messages.splice(0);
   for (const [index, message] of queue.entries()) {
@@ -42202,6 +42616,22 @@ function drainContinuation(record, events) {
   );
   return RESUMED_TEXT;
 }
+function drainForWaiter(record, deps, events) {
+  if (record.control.paused !== null || record.control.cancelled !== null)
+    return [];
+  if (record.harness !== void 0 && record.harness !== "claude-code")
+    return [];
+  const owed = record.control.resumeOwed === void 0 ? 0 : RESUMED_TEXT.length + CONTEXT_JOINER.length;
+  const texts = drainMessages(
+    record,
+    deps,
+    events,
+    WAKE_LEAD.length + CONTEXT_JOINER.length + owed
+  ).map((message) => message.text);
+  const continuation = drainContinuation(record, events);
+  if (continuation !== void 0) texts.push(continuation);
+  return texts;
+}
 function drainMidTurn(input, record, deps, events, replay, used = 0) {
   if (replay !== void 0 || input.agent_id !== void 0 || !deliversMessages(record.harness, input.hook_event_name))
     return [];
@@ -42252,11 +42682,12 @@ async function handleHookEvent(raw, env, deps, replay, harness, agent, hookId) {
     ...hookKey === void 0 ? {} : { hookKey }
   };
 }
-async function cedarCallFor(view, record, input, deps, action) {
+async function cedarCallFor(view, record, input, deps, toolName3, action) {
   if (view.bundle.cedar === void 0) return void 0;
   const custom2 = record.customAgent;
   const facts = policyRunFacts(record);
   return {
+    ...oxagenServerVerified(view, record, input, deps, toolName3) ? { oxagenServerVerified: true } : {},
     // No loader means no evaluator: a mutating tool is refused rather than
     // decided without the bundle's policies.
     runtime: deps.cedar !== void 0 ? await deps.cedar() : null,
@@ -42270,6 +42701,22 @@ async function cedarCallFor(view, record, input, deps, action) {
     facts
   };
 }
+function oxagenServerVerified(view, record, input, deps, toolName3) {
+  if (!isOxagenTool(toolName3) || deps.oxagenServerServes === void 0)
+    return false;
+  if (record.customAgent !== void 0) return false;
+  if ((record.harness ?? "claude-code") !== "claude-code") return false;
+  if (view.launchedContained?.(record.harnessSessionId) === true) return false;
+  const cwd = record.cwd ?? input.cwd;
+  try {
+    return deps.oxagenServerServes({
+      startedAt: record.startedAt,
+      ...cwd !== void 0 ? { cwd } : {}
+    });
+  } catch {
+    return false;
+  }
+}
 function evaluationRequestFor(view, toolName3, toolInput, record, deps, input, cedar) {
   return {
     ...cedar !== void 0 ? { cedar } : {},
@@ -42301,7 +42748,14 @@ async function decideToolCall(view, record, input, deps, replay, call2) {
       record,
       deps,
       input,
-      await cedarCallFor(current2, record, input, deps, call2.action)
+      await cedarCallFor(
+        current2,
+        record,
+        input,
+        deps,
+        call2.toolName,
+        call2.action
+      )
     )
   );
   let current = view;
@@ -42488,7 +42942,9 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
       const block = operatorBlock(view, record);
       const steering = block === void 0 && replay === void 0 ? await runSteeringBundle(record, deps) ?? view.bundle : view.bundle;
       const context = steering.context.system;
-      const messages = block === void 0 && replay === void 0 ? drainMessages(record, deps, events, context?.length ?? 0) : [];
+      if (block === void 0 && replay === void 0)
+        await placeSessionSkills(view, record, deps, env);
+      const messages = block === void 0 && replay === void 0 && input.agent_id === void 0 ? drainMessages(record, deps, events, context?.length ?? 0) : [];
       const additional = block === void 0 ? [context ?? "", ...messages.map((m) => m.text)].filter((s2) => s2.length > 0).join(CONTEXT_JOINER) : "";
       const delivered = replay === void 0 ? void 0 : readDeliveredContext(replay.deliveredContext);
       const deliveryAttrs = replay === void 0 ? {
@@ -42537,8 +42993,6 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
           record
         };
       }
-      if (replay === void 0)
-        await placeSessionSkills(view, record, deps, env);
       const manifest = steering.context.manifest;
       if (manifest !== void 0 && (replay === void 0 || delivered?.bundle_etag === steering.etag && manifest.text_digest === (delivered.digest ?? null))) {
         events.push(
@@ -42577,7 +43031,7 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
       events.push(...asked);
       const block = promptBlock(view, record);
       const notice = block === void 0 && timedOut !== void 0 ? INTERJECTION_TIMED_OUT_TEXT : void 0;
-      const messages = block === void 0 && replay === void 0 && deliversMessages(record.harness, input.hook_event_name) ? drainMessages(record, deps, events, notice?.length ?? 0) : [];
+      const messages = block === void 0 && replay === void 0 && input.agent_id === void 0 && deliversMessages(record.harness, input.hook_event_name) ? drainMessages(record, deps, events, notice?.length ?? 0) : [];
       const delivered = [
         ...notice !== void 0 ? [notice] : [],
         ...messages.map((m) => m.text)
@@ -42590,7 +43044,8 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
         delivered.join(CONTEXT_JOINER).length,
         hookAnswerMaxChars(record.harness)
       ) : void 0;
-      if (block === void 0) record.control.resumeOwed = void 0;
+      if (block === void 0 && input.agent_id === void 0)
+        record.control.resumeOwed = void 0;
       if (block === void 0) notePrompt(record, promptText(input));
       const handed = [
         ...delivered,
@@ -42809,7 +43264,9 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
           cedar: view.bundle.cedar,
           harness: record.customAgent !== void 0 ? "custom" : record.harness ?? "claude-code",
           toolName: input.tool_name,
-          ...input.tool_input !== void 0 ? { toolInput: input.tool_input } : {}
+          ...input.tool_input !== void 0 ? { toolInput: input.tool_input } : {},
+          // Counted unless the kernel decided it, as the hook judged it.
+          ...oxagenServerVerified(view, record, input, deps, input.tool_name) ? { oxagenServerVerified: true } : {}
         });
       if (input.hook_event_name === "PostToolUseFailure")
         noteToolFailure(record, input.tool_name);
@@ -42896,7 +43353,7 @@ function writtenPath(input) {
     return void 0;
   if (!FILE_WRITING_TOOLS.has(input.tool_name ?? "")) return void 0;
   const path2 = input.tool_input?.["file_path"] ?? input.tool_input?.["notebook_path"];
-  if (typeof path2 !== "string" || !isAbsolute6(path2)) return void 0;
+  if (typeof path2 !== "string" || !isAbsolute7(path2)) return void 0;
   return path2;
 }
 function noteActivity(record, input, payload, at2, created) {
@@ -42935,7 +43392,7 @@ function recallView(record) {
     }
   };
 }
-var CONTAINMENT_REQUIRED_REASON, MESSAGE_BOUNDARIES, RESUMED_TEXT, ADDITIONAL_CONTEXT_MAX_CHARS, CONTEXT_JOINER, TOOL_CALL_HOOK_EVENTS, CREDENTIAL_BASIS_READ_ERROR_ATTR, MAX_BASIS_READ_ERROR_CHARS, RECALL_HEADING, FILE_WRITING_TOOLS, recallDirs;
+var CONTAINMENT_REQUIRED_REASON, MESSAGE_BOUNDARIES, RESUMED_TEXT, ADDITIONAL_CONTEXT_MAX_CHARS, CONTEXT_JOINER, DRAIN_ANSWER_MARGIN_MS, WAKE_LEAD, TOOL_CALL_HOOK_EVENTS, CREDENTIAL_BASIS_READ_ERROR_ATTR, MAX_BASIS_READ_ERROR_CHARS, RECALL_HEADING, FILE_WRITING_TOOLS, recallDirs;
 var init_hook_handler = __esm({
   "../../packages/tacho/src/collector/hook-handler.ts"() {
     "use strict";
@@ -42947,6 +43404,7 @@ var init_hook_handler = __esm({
     init_timestamp();
     init_wire();
     init_bundle();
+    init_hook();
     init_registry();
     init_session_activity();
     init_reflection_ask();
@@ -42965,6 +43423,8 @@ var init_hook_handler = __esm({
     RESUMED_TEXT = "Resumed by the operator. Continue the task.";
     ADDITIONAL_CONTEXT_MAX_CHARS = hookAnswerMaxChars(void 0);
     CONTEXT_JOINER = "\n\n";
+    DRAIN_ANSWER_MARGIN_MS = 750;
+    WAKE_LEAD = "A message reached you through Oxagen while you were idle at your prompt. Read it and act on it now.";
     TOOL_CALL_HOOK_EVENTS = /* @__PURE__ */ new Set([
       "PreToolUse",
       "PermissionRequest",
@@ -42984,6 +43444,133 @@ var init_hook_handler = __esm({
   }
 });
 
+// ../../packages/tacho/src/collector/steer-waiters.ts
+function owesText(session) {
+  return session.control.messages.length > 0 || session.control.resumeOwed !== void 0;
+}
+var STEER_WAIT_HOLD_MS, STEER_WAIT_BUSY_KEPT, STEER_WAIT_RELEASING_EVENTS, SteerWaiters;
+var init_steer_waiters = __esm({
+  "../../packages/tacho/src/collector/steer-waiters.ts"() {
+    "use strict";
+    STEER_WAIT_HOLD_MS = 25e3;
+    STEER_WAIT_BUSY_KEPT = 4096;
+    STEER_WAIT_RELEASING_EVENTS = /* @__PURE__ */ new Set([
+      "UserPromptSubmit",
+      "PreToolUse",
+      "PostToolUse",
+      "PostToolUseFailure",
+      "SessionEnd"
+    ]);
+    SteerWaiters = class {
+      constructor(deps) {
+        this.deps = deps;
+        this.holdMs = deps.holdMs ?? STEER_WAIT_HOLD_MS;
+      }
+      deps;
+      waiting = /* @__PURE__ */ new Map();
+      /** When each session last showed its agent working, by key, oldest first. */
+      busyAt = /* @__PURE__ */ new Map();
+      holdMs;
+      /** How many waiters hold a request now. */
+      get size() {
+        return this.waiting.size;
+      }
+      /**
+       * Hold one waiter request for the session `key` names. `signal` aborts
+       * when the waiter's connection closes. `startedAt` is when the waiter
+       * started; one whose session was busy since is told to stop.
+       */
+      wait(key, signal, startedAt) {
+        this.waiting.get(key)?.settle({ done: true });
+        const busy = this.busyAt.get(key);
+        if (startedAt !== void 0 && busy !== void 0 && busy >= startedAt)
+          return Promise.resolve({ done: true });
+        const session = this.deps.find(key);
+        if (session !== void 0 && (session.sealed || session.pendingTerminal === true))
+          return Promise.resolve({ done: true });
+        return new Promise((resolve23) => {
+          let settled2 = false;
+          const timer = setTimeout(() => waiter.settle({ wait: true }), this.holdMs);
+          timer.unref?.();
+          const onAbort = () => waiter.settle({ done: true });
+          const waiter = {
+            delivering: false,
+            released: false,
+            signal,
+            settle: (answer) => {
+              if (settled2) return;
+              settled2 = true;
+              clearTimeout(timer);
+              signal.removeEventListener("abort", onAbort);
+              if (this.waiting.get(key) === waiter) this.waiting.delete(key);
+              resolve23(answer);
+            }
+          };
+          if (signal.aborted) {
+            waiter.settle({ done: true });
+            return;
+          }
+          signal.addEventListener("abort", onAbort, { once: true });
+          this.waiting.set(key, waiter);
+          this.tryDeliver(key);
+        });
+      }
+      /**
+       * The session is working again (`at`), or ended: its waiter stops, and so
+       * does any waiter that started before `at` and asks again later.
+       */
+      release(key, at2) {
+        if (at2 !== void 0) {
+          this.busyAt.delete(key);
+          this.busyAt.set(key, at2);
+          for (const oldest of this.busyAt.keys()) {
+            if (this.busyAt.size <= STEER_WAIT_BUSY_KEPT) break;
+            this.busyAt.delete(oldest);
+          }
+        }
+        const waiter = this.waiting.get(key);
+        if (waiter === void 0) return;
+        if (waiter.delivering) waiter.released = true;
+        else waiter.settle({ done: true });
+      }
+      /** Messages may have been queued: offer them to every waiter. */
+      nudge() {
+        for (const key of [...this.waiting.keys()]) this.tryDeliver(key);
+      }
+      /**
+       * The daemon is stopping: every waiter is told to ask again, so it reaches
+       * the next daemon rather than leave its idle session with no waiter.
+       */
+      releaseAll() {
+        for (const waiter of [...this.waiting.values()])
+          waiter.settle({ wait: true });
+      }
+      tryDeliver(key) {
+        const waiter = this.waiting.get(key);
+        if (waiter === void 0 || waiter.delivering) return;
+        const session = this.deps.find(key);
+        if (session === void 0 || !owesText(session)) return;
+        waiter.delivering = true;
+        const alive = () => this.waiting.get(key) === waiter && !waiter.released && !waiter.signal.aborted;
+        this.deps.deliver(session, alive).then(
+          (text5) => {
+            waiter.delivering = false;
+            if (text5 !== void 0) waiter.settle({ text: text5 });
+            else if (waiter.released) waiter.settle({ done: true });
+          },
+          (error) => {
+            waiter.delivering = false;
+            this.deps.log?.(
+              `steer waiter: delivery failed: ${error instanceof Error ? error.message : String(error)}`
+            );
+            if (waiter.released) waiter.settle({ done: true });
+          }
+        );
+      }
+    };
+  }
+});
+
 // ../../packages/tacho/src/collector/hook-id-journal.ts
 import { appendFileSync as appendFileSync3, existsSync as existsSync18, readFileSync as readFileSync16, rmSync as rmSync7 } from "node:fs";
 function hookIdJournalEntry(session, key, at2, events) {
@@ -43119,12 +43706,13 @@ function applyToSession(record, command2, deps, undo) {
       const effect = record.control.pauseEffect;
       record.control.paused = null;
       record.control.pauseEffect = void 0;
-      if (effect === "refused") record.control.resumeOwed = command2.id;
+      if (effect === "refused" || effect === "stopped")
+        record.control.resumeOwed = command2.id;
       events.push(applied(record.recorder, command2, "session_resumed"));
       return effect === "stopped" ? {
         events,
         status: "applied",
-        detail: "The agent ended its turn while paused and stays idle until its next prompt."
+        detail: RESUMED_IDLE_DETAIL
       } : { events, status: "applied" };
     }
     case "cancel":
@@ -43417,7 +44005,7 @@ function sealCommands(commands, deps, now) {
     }
   };
 }
-var HANDLED_COMMANDS_KEPT, HandledCommands, MAX_ACK_DETAIL_CHARS;
+var RESUMED_IDLE_DETAIL, HANDLED_COMMANDS_KEPT, HandledCommands, MAX_ACK_DETAIL_CHARS;
 var init_inbox = __esm({
   "../../packages/tacho/src/collector/inbox.ts"() {
     "use strict";
@@ -43425,6 +44013,7 @@ var init_inbox = __esm({
     init_wire();
     init_interjection2();
     init_registry();
+    RESUMED_IDLE_DETAIL = "The agent ended its turn while paused. A Claude Code agent is woken to continue. Any other agent stays idle until its next prompt.";
     HANDLED_COMMANDS_KEPT = 1024;
     HandledCommands = class {
       constructor(limit = HANDLED_COMMANDS_KEPT) {
@@ -43529,7 +44118,7 @@ function recordOnChain(chain, seal2, record) {
 }
 function onSessionQueue(exclusive, session, apply) {
   if (exclusive !== void 0) return exclusive(session, apply);
-  return new Promise((resolve22) => resolve22(apply()));
+  return new Promise((resolve23) => resolve23(apply()));
 }
 var init_chain_write = __esm({
   "../../packages/tacho/src/collector/chain-write.ts"() {
@@ -43541,7 +44130,7 @@ var init_chain_write = __esm({
 import { randomBytes as randomBytes10, createHash as createHash9 } from "node:crypto";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
-import { resolve as resolve10 } from "node:path";
+import { resolve as resolve11 } from "node:path";
 function logLine(event, fields) {
   const pairs = Object.entries(fields).filter(
     (field) => field[1] !== void 0
@@ -43638,7 +44227,7 @@ function createGithubProxy(deps) {
   }
   function receiptMatches(host, repository, cwd, harness) {
     return cwd !== void 0 && (host.github_repositories ?? []).some(
-      (receipt) => receipt.repository.toLowerCase() === repository.toLowerCase() && resolve10(receipt.cwd) === resolve10(cwd) && receipt.harness === harness
+      (receipt) => receipt.repository.toLowerCase() === repository.toLowerCase() && resolve11(receipt.cwd) === resolve11(cwd) && receipt.harness === harness
     );
   }
   function issue(input) {
@@ -43669,7 +44258,7 @@ function createGithubProxy(deps) {
         }
       };
     const matches = deps.registry.live().filter(
-      (s2) => !s2.pendingTerminal && s2.cwd && resolve10(s2.cwd) === resolve10(input.cwd) && deps.registry.agentOf(s2).harness === input.harness
+      (s2) => !s2.pendingTerminal && s2.cwd && resolve11(s2.cwd) === resolve11(input.cwd) && deps.registry.agentOf(s2).harness === input.harness
     );
     if (matches.length !== 1)
       return {
@@ -44135,7 +44724,7 @@ var init_hook_queues = __esm({
 
 // ../../packages/tacho/src/collector/memory-capture/memory-reader.ts
 import { createRequire as createRequire2 } from "node:module";
-import { isAbsolute as isAbsolute7, join as join32, sep as sep4 } from "node:path";
+import { isAbsolute as isAbsolute8, join as join33, sep as sep5 } from "node:path";
 function claudeCodeLocation(projectsDir, memoryDir) {
   return {
     harness: "claude-code",
@@ -44147,13 +44736,13 @@ function claudeCodeLocation(projectsDir, memoryDir) {
 }
 function claudeCodeMemoryLocations(configDir, projectDirs = []) {
   const locations = [
-    claudeCodeLocation(() => join32(configDir, "projects"), "memory"),
-    claudeCodeLocation(() => join32(configDir, "agent-memory"), "")
+    claudeCodeLocation(() => join33(configDir, "projects"), "memory"),
+    claudeCodeLocation(() => join33(configDir, "agent-memory"), "")
   ];
   for (const dir of projectDirs.slice(0, MEMORY_PROJECT_DIRS_MAX))
     locations.push(
-      claudeCodeLocation(() => join32(dir, ".claude", "agent-memory"), ""),
-      claudeCodeLocation(() => join32(dir, ".claude", "agent-memory-local"), "")
+      claudeCodeLocation(() => join33(dir, ".claude", "agent-memory"), ""),
+      claudeCodeLocation(() => join33(dir, ".claude", "agent-memory-local"), "")
     );
   return locations;
 }
@@ -44165,7 +44754,7 @@ function projectDirsOf(sessions) {
     if (session.harness !== void 0 && session.harness !== "claude-code")
       continue;
     for (const dir of [session.cwd, ...Object.keys(session.baselines ?? {})])
-      if (dir !== void 0 && isAbsolute7(dir)) dirs.add(dir);
+      if (dir !== void 0 && isAbsolute8(dir)) dirs.add(dir);
     if (dirs.size >= MEMORY_PROJECT_DIRS_MAX) break;
   }
   return [...dirs].slice(0, MEMORY_PROJECT_DIRS_MAX);
@@ -44338,13 +44927,13 @@ function createMemoryReader(deps) {
       const projects = await list2(top);
       let complete = projects.complete;
       for (const project2 of projects.names) {
-        const dir = location.memoryDir === "" ? join32(top, project2) : join32(top, project2, location.memoryDir);
+        const dir = location.memoryDir === "" ? join33(top, project2) : join33(top, project2, location.memoryDir);
         const files2 = await list2(dir);
         if (!files2.complete) complete = false;
         for (const name of files2.names) {
           if (!name.endsWith(location.extension)) continue;
           if (location.skip.includes(name)) continue;
-          const path2 = join32(dir, name);
+          const path2 = join33(dir, name);
           const file = await readAt2(location.harness, path2);
           if (file.kind === "absent" || file.kind === "empty") continue;
           paths.push(path2);
@@ -44430,14 +45019,14 @@ var init_memory_reader = __esm({
     MEMORY_TYPE_PATTERN = /^[a-z][a-z0-9_-]{0,31}$/;
     MEMORY_PROJECT_DIRS_MAX = 200;
     HARNESS_MEMORY_LOCATIONS = [
-      claudeCodeLocation((home) => join32(home, ".claude", "projects"), "memory"),
-      claudeCodeLocation((home) => join32(home, ".claude", "agent-memory"), "")
+      claudeCodeLocation((home) => join33(home, ".claude", "projects"), "memory"),
+      claudeCodeLocation((home) => join33(home, ".claude", "agent-memory"), "")
     ];
     FRONTMATTER = /^---[ \t]*\r?\n(?:([\s\S]*?)\r?\n)?---[ \t]*(?:\r?\n|$)/;
     FRONTMATTER_LINE = /^([ \t]*)([A-Za-z_][\w-]*)[ \t]*:[ \t]*(.*)$/;
     keyOf = (harness, path2) => `${harness}
 ${path2}`;
-    withSep = (dir) => dir.endsWith(sep4) ? dir : `${dir}${sep4}`;
+    withSep = (dir) => dir.endsWith(sep5) ? dir : `${dir}${sep5}`;
   }
 });
 
@@ -44873,10 +45462,10 @@ function createMemoryRecall(deps) {
     if (now() < pausedUntil) return [];
     const controller = new AbortController();
     let timer;
-    const timedOut = new Promise((resolve22) => {
+    const timedOut = new Promise((resolve23) => {
       timer = setTimeout(() => {
         controller.abort();
-        resolve22(
+        resolve23(
           failed3(
             `the control plane took longer than ${timeoutMs} ms to answer`
           )
@@ -44923,10 +45512,10 @@ var init_memory_recall = __esm({
 });
 
 // ../../packages/tacho/src/collector/memory-capture/memory-uses.ts
-import { basename as basename6, dirname as dirname18, isAbsolute as isAbsolute8, join as join33, resolve as resolve11 } from "node:path";
+import { basename as basename6, dirname as dirname18, isAbsolute as isAbsolute9, join as join34, resolve as resolve12 } from "node:path";
 function memoryFileOf(path2, locations, home) {
-  if (!isAbsolute8(path2)) return void 0;
-  const file = resolve11(path2);
+  if (!isAbsolute9(path2)) return void 0;
+  const file = resolve12(path2);
   const name = basename6(file);
   const folder = dirname18(file);
   for (const location of locations) {
@@ -44935,15 +45524,15 @@ function memoryFileOf(path2, locations, home) {
     const projectDir = location.memoryDir === "" ? folder : dirname18(folder);
     if (location.memoryDir !== "" && basename6(folder) !== location.memoryDir)
       continue;
-    if (dirname18(projectDir) !== resolve11(location.projectsDir(home))) continue;
+    if (dirname18(projectDir) !== resolve12(location.projectsDir(home))) continue;
     return { harness: location.harness, path: file };
   }
   return void 0;
 }
 function pathOf(word, cwd, home) {
-  const expanded = /^(?:~|\$HOME|\$\{HOME\})\//.test(word) ? join33(home, word.slice(word.indexOf("/") + 1)) : word;
-  if (isAbsolute8(expanded)) return expanded;
-  if (cwd !== void 0 && isAbsolute8(cwd)) return resolve11(cwd, expanded);
+  const expanded = /^(?:~|\$HOME|\$\{HOME\})\//.test(word) ? join34(home, word.slice(word.indexOf("/") + 1)) : word;
+  if (isAbsolute9(expanded)) return expanded;
+  if (cwd !== void 0 && isAbsolute9(cwd)) return resolve12(cwd, expanded);
   return void 0;
 }
 function stringMember(input, key) {
@@ -45197,7 +45786,7 @@ ${use.path}`;
 });
 
 // ../../packages/tacho/src/collector/memory-capture/stella-store.ts
-import { dirname as dirname19, isAbsolute as isAbsolute9, join as join34, resolve as resolve12 } from "node:path";
+import { dirname as dirname19, isAbsolute as isAbsolute10, join as join35, resolve as resolve13 } from "node:path";
 function queryStellaStore(path2, afterSeq, limit) {
   const db = new (nodeSqlite()).DatabaseSync(path2, { readOnly: true });
   try {
@@ -45284,10 +45873,10 @@ function stellaRunOf(use, runs, now) {
   return void 0;
 }
 async function stellaStoreOf(dir, exists) {
-  if (!isAbsolute9(dir)) return void 0;
-  let at2 = resolve12(dir);
+  if (!isAbsolute10(dir)) return void 0;
+  let at2 = resolve13(dir);
   for (let depth = 0; depth < WORKSPACE_SEARCH_DEPTH; depth += 1) {
-    const candidate = join34(at2, STELLA_CONTEXT_DB);
+    const candidate = join35(at2, STELLA_CONTEXT_DB);
     if (await exists(candidate)) return candidate;
     const up = dirname19(at2);
     if (up === at2) return void 0;
@@ -45300,7 +45889,7 @@ var init_stella_store = __esm({
   "../../packages/tacho/src/collector/memory-capture/stella-store.ts"() {
     "use strict";
     init_memory_reader();
-    STELLA_CONTEXT_DB = join34(".stella", "private", "context.db");
+    STELLA_CONTEXT_DB = join35(".stella", "private", "context.db");
     STELLA_MEMORIES_VIEW = "export_memories_v1";
     STELLA_USES_VIEW = "export_memory_uses_v1";
     STELLA_USES_PER_READ = 5e3;
@@ -45962,7 +46551,7 @@ var init_cloud_link = __esm({
 
 // ../../packages/tacho/src/collector/local-servers/digest.ts
 import { createHash as createHash10 } from "node:crypto";
-import { join as join35 } from "node:path";
+import { join as join36 } from "node:path";
 function rememberBounded(map, key, value) {
   if (!map.has(key) && map.size >= MAX_REMEMBERED_DIGESTS) {
     const oldest = map.keys().next();
@@ -45999,7 +46588,7 @@ function npmNameSegment(name) {
   return name.startsWith("@") ? `@${encodeURIComponent(name.slice(1))}` : encodeURIComponent(name);
 }
 async function whichOnPath(command2, pathValue, search) {
-  const candidates = command2.includes("/") || command2.includes("\\") ? [command2] : (pathValue ?? "").split(search.delimiter).filter((dir) => dir.length > 0).map((dir) => join35(dir, command2));
+  const candidates = command2.includes("/") || command2.includes("\\") ? [command2] : (pathValue ?? "").split(search.delimiter).filter((dir) => dir.length > 0).map((dir) => join36(dir, command2));
   for (const candidate of candidates) {
     for (const extension of search.extensions) {
       if (await search.isExecutable(candidate + extension))
@@ -46637,8 +47226,8 @@ async function withSession(options, work) {
     if (failure4 !== void 0) return Promise.reject(failure4);
     const id2 = nextId;
     nextId += 1;
-    return new Promise((resolve22, reject) => {
-      pending.set(id2, { method, resolve: resolve22, reject });
+    return new Promise((resolve23, reject) => {
+      pending.set(id2, { method, resolve: resolve23, reject });
       send5({ id: id2, method, params });
     });
   }
@@ -46782,16 +47371,16 @@ var init_screen = __esm({
 
 // ../../packages/tacho/src/collector/local-servers/local-servers.ts
 function abortableSleep(ms, signal) {
-  return new Promise((resolve22) => {
+  return new Promise((resolve23) => {
     if (signal.aborted) {
-      resolve22();
+      resolve23();
       return;
     }
     const timer = setTimeout(done, ms);
     function done() {
       clearTimeout(timer);
       signal.removeEventListener("abort", done);
-      resolve22();
+      resolve23();
     }
     signal.addEventListener("abort", done, { once: true });
   });
@@ -47119,7 +47708,7 @@ var init_machine = __esm({
 });
 
 // ../../packages/tacho/src/collector/push-basis.ts
-import { resolve as resolve13 } from "node:path";
+import { resolve as resolve14 } from "node:path";
 function gitPushTarget(command2) {
   const tokens = tokenizeSimpleCommand(command2);
   if (tokens === void 0 || tokens[0] !== "git") return void 0;
@@ -47166,7 +47755,7 @@ async function pushCredentialBasis(command2, cwd, deps) {
     return TACHO_CREDENTIAL_HARNESS_HELD;
   const target2 = gitPushTarget(command2);
   if (target2 === void 0) return TACHO_CREDENTIAL_HARNESS_HELD;
-  const dir = target2.chdir.reduce((from, to) => resolve13(from, to), cwd);
+  const dir = target2.chdir.reduce((from, to) => resolve14(from, to), cwd);
   const receipt = receiptFor(receipts, dir);
   if (receipt === void 0) return TACHO_CREDENTIAL_HARNESS_HELD;
   const remote = target2.remote ?? await defaultPushRemote(dir, deps);
@@ -47180,7 +47769,7 @@ function receiptFor(receipts, dir) {
   let found;
   let depth = -1;
   for (const entry2 of receipts) {
-    const root = resolve13(entry2.cwd);
+    const root = resolve14(entry2.cwd);
     if (!isWithin(root, dir) || root.length <= depth) continue;
     found = entry2;
     depth = root.length;
@@ -47197,7 +47786,7 @@ async function containedPushBasis(command2, cwd, repository, deps) {
   const target2 = gitPushTarget(command2);
   if (cwd === void 0 || target2 === void 0)
     return TACHO_CREDENTIAL_HARNESS_HELD;
-  const dir = target2.chdir.reduce((from, to) => resolve13(from, to), cwd);
+  const dir = target2.chdir.reduce((from, to) => resolve14(from, to), cwd);
   if (!isWithin(cwd, dir)) return TACHO_CREDENTIAL_HARNESS_HELD;
   const remote = target2.remote ?? await defaultPushRemote(dir, deps);
   const urls = await pushUrls(dir, remote, deps);
@@ -47205,7 +47794,9 @@ async function containedPushBasis(command2, cwd, repository, deps) {
   return urls.length > 0 && urls.every((url) => githubRepositoryOf(url) === wanted) ? TACHO_CREDENTIAL_GATEWAY_BROKERED : TACHO_CREDENTIAL_HARNESS_HELD;
 }
 async function gitOut(dir, args, deps) {
-  const result2 = await deps.execAsync("git", ["-C", dir, ...args]);
+  const result2 = await deps.execAsync("git", hardenedGitArgs(dir, args), {
+    env: HARDENED_GIT_ENV
+  });
   return result2.status === 0 ? result2.stdout.trim() : void 0;
 }
 async function defaultPushRemote(dir, deps) {
@@ -47236,6 +47827,7 @@ var init_push_basis = __esm({
     "use strict";
     init_tools();
     init_wire();
+    init_hardened_git();
     init_recall_hints();
     PUSH_OPTIONS_WITH_VALUE = /* @__PURE__ */ new Set([
       "--repo",
@@ -47290,9 +47882,9 @@ import {
   writeFile
 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname20, join as join36 } from "node:path";
+import { dirname as dirname20, join as join37 } from "node:path";
 function stagingFolder(root, name) {
-  return join36(root, `.${name}${STAGING_SUFFIX}`);
+  return join37(root, `.${name}${STAGING_SUFFIX}`);
 }
 function isStagingName(name) {
   return name.startsWith(".") && name.endsWith(STAGING_SUFFIX);
@@ -47335,17 +47927,17 @@ function envDir(env, key) {
 function skillsRoot(harness, env = process.env, home = homedir5()) {
   switch (harness) {
     case "claude-code":
-      return join36(
-        envDir(env, "CLAUDE_CONFIG_DIR") ?? join36(home, ".claude"),
+      return join37(
+        envDir(env, "CLAUDE_CONFIG_DIR") ?? join37(home, ".claude"),
         "skills"
       );
     case "codex": {
       const codexHome = envDir(env, "CODEX_HOME");
-      return codexHome === null ? join36(home, ".agents", "skills") : join36(codexHome, "skills");
+      return codexHome === null ? join37(home, ".agents", "skills") : join37(codexHome, "skills");
     }
     case "stella":
-      return join36(
-        envDir(env, "STELLA_HOME") ?? join36(home, ".stella"),
+      return join37(
+        envDir(env, "STELLA_HOME") ?? join37(home, ".stella"),
         "skills"
       );
     case "cursor":
@@ -47406,7 +47998,7 @@ async function readMarker(folder) {
   if (!entries2.includes(SESSION_MARKER)) return { state: "foreign" };
   try {
     const parsed2 = JSON.parse(
-      await readFile2(join36(folder, SESSION_MARKER), "utf8")
+      await readFile2(join37(folder, SESSION_MARKER), "utf8")
     );
     return isMarker(parsed2) ? { state: "ours", marker: parsed2 } : { state: "foreign" };
   } catch {
@@ -47423,22 +48015,22 @@ function liveSessions(marker, now) {
   return live;
 }
 async function writeMarker(folder, marker) {
-  const temp = join36(folder, MARKER_TEMP);
+  const temp = join37(folder, MARKER_TEMP);
   await writeFile(temp, `${JSON.stringify(marker, null, 2)}
 `);
-  await rename2(temp, join36(folder, SESSION_MARKER));
+  await rename2(temp, join37(folder, SESSION_MARKER));
 }
 async function writeSkill(root, skill, marker) {
-  const folder = join36(root, skill.name);
+  const folder = join37(root, skill.name);
   const staging = stagingFolder(root, skill.name);
   await rm2(folder, { recursive: true, force: true });
   await rm2(staging, { recursive: true, force: true });
   await mkdir2(staging);
   await writeMarker(staging, { digest: UNFINISHED_DIGEST, sessions: {} });
   await rename2(staging, folder);
-  await writeFile(join36(folder, "SKILL.md"), skillMarkdown(skill));
+  await writeFile(join37(folder, "SKILL.md"), skillMarkdown(skill));
   for (const file of skill.files) {
-    const target2 = join36(folder, file.path);
+    const target2 = join37(folder, file.path);
     await mkdir2(dirname20(target2), { recursive: true });
     await writeFile(target2, file.content);
   }
@@ -47467,7 +48059,7 @@ async function placeSkills(root, sessionId, skills, now = /* @__PURE__ */ new Da
       result2.warnings.push(refusal);
       continue;
     }
-    const folder = join36(root, skill.name);
+    const folder = join37(root, skill.name);
     if (taken.has(skill.name)) {
       result2.skipped.push(skill.name);
       result2.warnings.push(
@@ -47532,7 +48124,7 @@ async function removeSkills(root, sessionId, now = /* @__PURE__ */ new Date()) {
     throw error;
   }
   for (const name of names2.sort(compareText)) {
-    const folder = join36(root, name);
+    const folder = join37(root, name);
     if (isStagingName(name)) {
       await rm2(folder, { recursive: true, force: true });
       continue;
@@ -47609,15 +48201,15 @@ function sessionSkills(options) {
   async function inTurn(task) {
     const before = tail;
     let release2 = () => void 0;
-    const mine = new Promise((resolve22) => {
-      release2 = resolve22;
+    const mine = new Promise((resolve23) => {
+      release2 = resolve23;
     });
     tail = before.then(() => mine);
-    const turn = await new Promise((resolve22) => {
-      const timer = setTimeout(() => resolve22(false), waitMs);
+    const turn = await new Promise((resolve23) => {
+      const timer = setTimeout(() => resolve23(false), waitMs);
       void before.then(() => {
         clearTimeout(timer);
-        resolve22(true);
+        resolve23(true);
       });
     });
     try {
@@ -48944,10 +49536,10 @@ async function readableBody(body2, encoding, maxOutputLength) {
   if (decode === void 0) return void 0;
   try {
     return await new Promise(
-      (resolve22, reject) => decode(
+      (resolve23, reject) => decode(
         body2,
         { maxOutputLength },
-        (error, result2) => error === null ? resolve22(result2) : reject(error)
+        (error, result2) => error === null ? resolve23(result2) : reject(error)
       )
     );
   } catch {
@@ -49392,7 +49984,7 @@ function createModelProxy(deps) {
     res.end(error.body);
   }
   function readBody3(req, attempt) {
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve23, reject) => {
       const chunks = [];
       let size = 0;
       let over = false;
@@ -49403,13 +49995,13 @@ function createModelProxy(deps) {
         if (size > maxRequestBytes) {
           over = true;
           chunks.length = 0;
-          resolve22("too_large");
+          resolve23("too_large");
           return;
         }
         chunks.push(chunk2);
       });
       req.on("end", () => {
-        if (!over) resolve22(Buffer.concat(chunks));
+        if (!over) resolve23(Buffer.concat(chunks));
       });
       req.on("error", reject);
       req.on("aborted", () => reject(new Error("client aborted the request")));
@@ -49420,12 +50012,12 @@ function createModelProxy(deps) {
     if (hook === void 0) return request3;
     let timer;
     try {
-      const timeout = new Promise((resolve22) => {
+      const timeout = new Promise((resolve23) => {
         timer = setTimeout(() => {
           deps.log(
             `model proxy: beforeForward took over ${hookTimeoutMs}ms, sending the request as it came`
           );
-          resolve22(request3);
+          resolve23(request3);
         }, hookTimeoutMs);
       });
       return await Promise.race([Promise.resolve(hook(request3)), timeout]);
@@ -49450,7 +50042,7 @@ function createModelProxy(deps) {
     const secure = target2.protocol === "https:";
     const sessionKey = record.recorder.sessionUuid;
     const startedAt = deps.now();
-    return new Promise((resolve22) => {
+    return new Promise((resolve23) => {
       let done = false;
       let answered = false;
       let upstream;
@@ -49471,7 +50063,7 @@ function createModelProxy(deps) {
         if (done) return;
         done = true;
         release2();
-        resolve22(outcome);
+        resolve23(outcome);
       };
       try {
         upstream = (secure ? httpsRequest : httpRequest2)({
@@ -50511,9 +51103,9 @@ function createModelProxyListener(options) {
     retryTimer.unref();
   }
   function bind() {
-    return new Promise((resolve22) => {
+    return new Promise((resolve23) => {
       if (closed2) {
-        resolve22();
+        resolve23();
         return;
       }
       const next = createServer4((req, res) => options.proxy.handle(req, res));
@@ -50554,7 +51146,7 @@ function createModelProxyListener(options) {
         scheduleRebind();
         if (!settledOnce) {
           settledOnce = true;
-          resolve22();
+          resolve23();
         }
       });
       next.on("close", () => {
@@ -50573,7 +51165,7 @@ function createModelProxyListener(options) {
         options.log(`model proxy listening on 127.0.0.1:${boundPort}`);
         if (!settledOnce) {
           settledOnce = true;
-          resolve22();
+          resolve23();
         }
       });
     });
@@ -50590,8 +51182,8 @@ function createModelProxyListener(options) {
       server = void 0;
       bound = false;
       if (current === void 0) return;
-      await new Promise((resolve22) => {
-        current.close(() => resolve22());
+      await new Promise((resolve23) => {
+        current.close(() => resolve23());
         current.closeAllConnections?.();
       });
     }
@@ -50617,7 +51209,7 @@ function isExportFormat(value) {
   return EXPORT_FORMATS.includes(value);
 }
 function readBody(req) {
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve23, reject) => {
     const chunks = [];
     let size = 0;
     let overflowed = false;
@@ -50632,7 +51224,7 @@ function readBody(req) {
       }
       chunks.push(chunk2);
     });
-    req.on("end", () => resolve22(Buffer.concat(chunks).toString("utf8")));
+    req.on("end", () => resolve23(Buffer.concat(chunks).toString("utf8")));
     req.on("error", reject);
   });
 }
@@ -50683,6 +51275,7 @@ function rememberMcpSession(sessions, id2) {
 function createRequestHandler(api, log, options = {}) {
   const mcpSessions = options.mcpSessions ?? /* @__PURE__ */ new Set();
   return (req, res) => {
+    const arrivedAt = Date.now();
     void (async () => {
       let url;
       try {
@@ -50852,7 +51445,13 @@ function createRequestHandler(api, log, options = {}) {
         }
         if (path2 === "/hook" || path2 === `/hook/${api.enrollmentId}`) {
           const isEnvelope = req.headers["x-tacho-envelope"] === "1";
-          let envelope2 = { payload: parsed2 };
+          let envelope2 = {
+            payload: parsed2,
+            answer_within_ms: Math.max(
+              0,
+              HTTP_HOOK_ANSWER_MS - (Date.now() - arrivedAt)
+            )
+          };
           if (isEnvelope) {
             const read2 = hookEnvelopeSchema.safeParse(parsed2);
             if (!read2.success) {
@@ -50877,6 +51476,38 @@ function createRequestHandler(api, log, options = {}) {
           send2(res, 403, { error: "hook for another enrollment" });
           return;
         }
+        if (path2 === "/steer-wait" || path2 === `/steer-wait/${api.enrollmentId}`) {
+          if (api.waitForSteer === void 0) {
+            send2(res, 404, { error: "this daemon holds no steer waiters" });
+            return;
+          }
+          const read2 = steerWaitRequestSchema.safeParse(parsed2);
+          if (!read2.success) {
+            send2(res, 400, {
+              error: `invalid steer wait: ${describeIssues(read2.error, "body")}`
+            });
+            return;
+          }
+          const closed2 = new AbortController();
+          res.on("close", () => {
+            if (!res.writableEnded) closed2.abort();
+          });
+          const answer = await api.waitForSteer(
+            {
+              sessionId: read2.data.session_id,
+              ...read2.data.harness !== void 0 ? { harness: read2.data.harness } : {},
+              ...read2.data.agent !== void 0 ? { agent: read2.data.agent } : {},
+              ...read2.data.started_at !== void 0 ? { startedAt: read2.data.started_at } : {}
+            },
+            closed2.signal
+          );
+          if (!res.destroyed) send2(res, 200, answer);
+          return;
+        }
+        if (path2.startsWith("/steer-wait/")) {
+          send2(res, 403, { error: "steer wait for another enrollment" });
+          return;
+        }
         const mcpMatch = /^\/mcp(?:\/([^/]+))?$/.exec(path2);
         if (mcpMatch !== null) {
           if (api.mcp === void 0) {
@@ -50939,21 +51570,21 @@ async function removeStaleSocket(socketPath) {
   if (!statSync9(socketPath).isSocket()) {
     throw new Error(`collector socket path is not a socket: ${socketPath}`);
   }
-  const stale = await new Promise((resolve22, reject) => {
+  const stale = await new Promise((resolve23, reject) => {
     const probe = createConnection(socketPath);
     probe.once("connect", () => {
       probe.destroy();
-      resolve22(false);
+      resolve23(false);
     });
     probe.once("error", (error) => {
       probe.destroy();
       if (error.code === "ECONNREFUSED" || error.code === "ENOENT")
-        resolve22(true);
+        resolve23(true);
       else reject(error);
     });
     probe.setTimeout(500, () => {
       probe.destroy();
-      resolve22(false);
+      resolve23(false);
     });
   });
   if (!stale)
@@ -50982,8 +51613,8 @@ function createCollectorServer(api, log = () => void 0) {
   const close = async () => {
     await Promise.all(
       servers.map(
-        (server) => new Promise((resolve22) => {
-          server.close(() => resolve22());
+        (server) => new Promise((resolve23) => {
+          server.close(() => resolve23());
           server.closeAllConnections?.();
         })
       )
@@ -50998,11 +51629,11 @@ function createCollectorServer(api, log = () => void 0) {
           let boundPort = options.port;
           const tcp = createServer5((req, res) => handle(req, res, boundPort));
           servers.push(tcp);
-          await new Promise((resolve22, reject) => {
+          await new Promise((resolve23, reject) => {
             tcp.once("error", reject);
             tcp.listen(options.port, options.host ?? "127.0.0.1", () => {
               tcp.off("error", reject);
-              resolve22();
+              resolve23();
             });
           });
           const address = tcp.address();
@@ -51013,11 +51644,11 @@ function createCollectorServer(api, log = () => void 0) {
           await removeStaleSocket(options.socketPath);
           const unix = createServer5((req, res) => handle(req, res));
           servers.push(unix);
-          await new Promise((resolve22, reject) => {
+          await new Promise((resolve23, reject) => {
             unix.once("error", reject);
             unix.listen(options.socketPath, () => {
               unix.off("error", reject);
-              resolve22();
+              resolve23();
             });
           });
           chmodSync9(options.socketPath, 384);
@@ -51031,7 +51662,7 @@ function createCollectorServer(api, log = () => void 0) {
     close
   };
 }
-var policyDecisionValueSchema, evaluationSchema, deliveredContextSchema, hookEnvelopeSchema, EXPORT_FORMATS, MAX_BODY_BYTES2, BodyTooLargeError, BEARER_REQUIRED, SESSION_KEY, MCP_SESSIONS_MAX;
+var HTTP_HOOK_ANSWER_MS, policyDecisionValueSchema, evaluationSchema, deliveredContextSchema, hookEnvelopeSchema, steerWaitRequestSchema, EXPORT_FORMATS, MAX_BODY_BYTES2, BodyTooLargeError, BEARER_REQUIRED, SESSION_KEY, MCP_SESSIONS_MAX;
 var init_server = __esm({
   "../../packages/tacho/src/collector/server.ts"() {
     "use strict";
@@ -51040,6 +51671,7 @@ var init_server = __esm({
     init_digest();
     init_wire();
     init_loopback_guard();
+    HTTP_HOOK_ANSWER_MS = 4e3;
     policyDecisionValueSchema = external_exports.enum(["allow", "deny", "ask", "defer"]);
     evaluationSchema = external_exports.object({
       decision: policyDecisionValueSchema,
@@ -51073,7 +51705,14 @@ var init_server = __esm({
       }).optional(),
       harness: tachoHarnessSchema.optional(),
       agent: external_exports.string().min(1).optional(),
-      hook_id: external_exports.string().min(1).optional()
+      hook_id: external_exports.string().min(1).optional(),
+      answer_by: external_exports.number().int().positive().optional()
+    });
+    steerWaitRequestSchema = external_exports.object({
+      session_id: external_exports.string().min(1).max(512),
+      harness: tachoHarnessSchema.optional(),
+      agent: external_exports.string().min(1).optional(),
+      started_at: external_exports.number().int().positive().optional()
     });
     EXPORT_FORMATS = [
       "tacho",
@@ -51097,7 +51736,7 @@ var init_server = __esm({
 
 // ../../packages/tacho/src/collector/spool.ts
 import { existsSync as existsSync20, readFileSync as readFileSync17 } from "node:fs";
-import { join as join37 } from "node:path";
+import { join as join38 } from "node:path";
 function sessionOwnedElsewhere(error) {
   return error.status === 403 && error.body.includes(SESSION_OWNED_ELSEWHERE);
 }
@@ -51291,7 +51930,7 @@ var init_spool = __esm({
        * gone for good.
        */
       stash(event, reason3, body2) {
-        const path2 = join37(
+        const path2 = join38(
           this.options.quarantineDir,
           `${event.session_uuid}-${String(event.seq).padStart(8, "0")}.json`
         );
@@ -51309,7 +51948,7 @@ var init_spool = __esm({
       }
       /** Add a body to a quarantine record that was written without one. */
       stashBodyBeside(event, body2) {
-        const path2 = join37(
+        const path2 = join38(
           this.options.quarantineDir,
           `${event.session_uuid}-${String(event.seq).padStart(8, "0")}.json`
         );
@@ -51846,7 +52485,7 @@ import {
 } from "node:fs";
 import { readdir as readdir3, readFile as readFile3, stat as stat2 } from "node:fs/promises";
 import { homedir as homedir7, hostname as osHostname2 } from "node:os";
-import { dirname as dirname21, join as join38 } from "node:path";
+import { dirname as dirname21, join as join39 } from "node:path";
 import { execFile as execFile4, spawnSync as spawnSync6 } from "node:child_process";
 function cloudGatewayUpstreams(origin = CLOUD_GATEWAY_ORIGIN) {
   const base2 = new URL(origin).origin;
@@ -51902,15 +52541,20 @@ function defaultExec(command2, args) {
     stderr: result2.stderr ?? ""
   };
 }
-function defaultExecAsync(command2, args) {
-  return new Promise((resolve22) => {
+function defaultExecAsync(command2, args, options) {
+  return new Promise((resolve23) => {
     execFile4(
       command2,
       args,
-      { encoding: "utf8", maxBuffer: 4 * 1024 * 1024, timeout: 1e4 },
+      {
+        encoding: "utf8",
+        maxBuffer: 4 * 1024 * 1024,
+        timeout: 1e4,
+        ...options?.env !== void 0 ? { env: { ...process.env, ...options.env } } : {}
+      },
       (error, stdout, stderr) => {
         const code = error?.code;
-        resolve22({
+        resolve23({
           status: error === null ? 0 : typeof code === "number" ? code : 1,
           stdout: stdout ?? "",
           stderr: stderr ?? ""
@@ -51929,28 +52573,28 @@ function defaultKill(pid, signal) {
 }
 function settleWithin(work, ms) {
   if (work === void 0) return Promise.resolve(true);
-  return new Promise((resolve22) => {
-    const timer = setTimeout(() => resolve22(false), ms);
+  return new Promise((resolve23) => {
+    const timer = setTimeout(() => resolve23(false), ms);
     timer.unref();
     const done = () => {
       clearTimeout(timer);
-      resolve22(true);
+      resolve23(true);
     };
     work.then(done, done);
   });
 }
 function valueWithin(work, ms) {
-  return new Promise((resolve22) => {
-    const timer = setTimeout(() => resolve22(void 0), ms);
+  return new Promise((resolve23) => {
+    const timer = setTimeout(() => resolve23(void 0), ms);
     timer.unref();
     work.then(
       (value) => {
         clearTimeout(timer);
-        resolve22(value);
+        resolve23(value);
       },
       () => {
         clearTimeout(timer);
-        resolve22(void 0);
+        resolve23(void 0);
       }
     );
   });
@@ -51959,15 +52603,15 @@ function olderBundle(candidate, held) {
   return candidate.version < held.version && !(Date.parse(candidate.issued_at) > Date.parse(held.issued_at));
 }
 function abortableSleep2(ms, signal) {
-  return new Promise((resolve22) => {
+  return new Promise((resolve23) => {
     if (signal.aborted) {
-      resolve22();
+      resolve23();
       return;
     }
     const wake = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", wake);
-      resolve22();
+      resolve23();
     };
     const timer = setTimeout(wake, ms);
     timer.unref();
@@ -52120,6 +52764,13 @@ async function initializeDaemon(options, server, port, ready) {
         hasGatewayKey: current.gateway_api_key !== void 0,
         registeredAt: current.mcp_registered_at?.["claude-code"],
         sessionStartedAt: session.startedAt,
+        // The entry must be the one enroll wrote, local token and all, and
+        // not a server that copied the enrollment id (F-2355).
+        enrolled: {
+          localToken: current.local_token,
+          port: current.port,
+          ...current.mcp_stdio_command?.[0] !== void 0 ? { shimCommand: current.mcp_stdio_command[0] } : {}
+        },
         // A local- or project-scope `oxagen` server in this directory wins
         // over ours, and would refuse the reflection.
         ...session.cwd !== void 0 ? { cwd: session.cwd } : {},
@@ -52276,17 +52927,24 @@ async function initializeDaemon(options, server, port, ready) {
   let handledWritten = handledCommands.generation;
   const applyCommands2 = (commands, deps) => applyCommands(commands, { ...deps, handled: handledCommands });
   const queues = new HookQueues();
+  const steerWaiters = new SteerWaiters({
+    find: (key) => registry2.list().find(
+      (session) => sessionMapKey(session.harnessSessionId, session) === key
+    ),
+    deliver: (session, alive) => deliverToWaiter(session, alive),
+    log
+  });
   const sessionExclusive = (session, apply) => queues.session(session.harnessSessionId, async () => apply());
   const stopping = new AbortController();
-  const hookExecAsync = (command2, args) => {
+  const hookExecAsync = (command2, args, execOptions) => {
     if (stopping.signal.aborted) return Promise.resolve(STOPPED_EXEC);
-    return new Promise((resolve22, reject) => {
-      const abandon = () => resolve22(STOPPED_EXEC);
+    return new Promise((resolve23, reject) => {
+      const abandon = () => resolve23(STOPPED_EXEC);
       stopping.signal.addEventListener("abort", abandon, { once: true });
-      execAsync(command2, args).then(
+      execAsync(command2, args, execOptions).then(
         (result2) => {
           stopping.signal.removeEventListener("abort", abandon);
-          resolve22(result2);
+          resolve23(result2);
         },
         (error) => {
           stopping.signal.removeEventListener("abort", abandon);
@@ -52463,6 +53121,42 @@ async function initializeDaemon(options, server, port, ready) {
       mark: session.recorder.markChain()
     }));
   }
+  async function deliverToWaiter(session, alive) {
+    return queues.session(session.harnessSessionId, async () => {
+      if (!alive() || session.sealed || session.pendingTerminal === true)
+        return void 0;
+      const held = [...session.control.messages];
+      const owed = session.control.resumeOwed;
+      if (held.length === 0 && owed === void 0) return void 0;
+      const mark = session.recorder.markChain();
+      const events = [];
+      const acks = [];
+      const texts = drainForWaiter(
+        session,
+        { now, acknowledge: (ack) => acks.push(ack) },
+        events
+      );
+      try {
+        if (events.length > 0) record(events);
+      } catch (error) {
+        session.recorder.rollbackChain(mark);
+        const ids = new Set(held.map((message) => message.id));
+        const arrived = session.control.messages.filter(
+          (message) => !ids.has(message.id)
+        );
+        session.control.messages.splice(
+          0,
+          session.control.messages.length,
+          ...held,
+          ...arrived
+        );
+        session.control.resumeOwed = owed;
+        throw error;
+      }
+      pendingAcks.push(...acks);
+      return texts.length > 0 ? [WAKE_LEAD, ...texts].join("\n\n") : void 0;
+    });
+  }
   async function applyCommandsRecorded(commands, deps) {
     let marks = markCommandChains(commands);
     let result2;
@@ -52535,7 +53229,7 @@ async function initializeDaemon(options, server, port, ready) {
       controlReachable: lastControlAt !== void 0 && now() - lastControlAt < 2 * timers.bundleRefreshMs
     };
   }
-  const bodyPurgeOwedPath = join38(paths.wal, "body-purge-owed");
+  const bodyPurgeOwedPath = join39(paths.wal, "body-purge-owed");
   function markBodyPurgeOwed(retention, dropped) {
     try {
       ensureDir(paths.wal);
@@ -52806,6 +53500,7 @@ async function initializeDaemon(options, server, port, ready) {
       } finally {
         interruptModelCalls(result2.applied);
       }
+      steerWaiters.nudge();
     }
   }
   const shipper = new Shipper({
@@ -53020,6 +53715,7 @@ async function initializeDaemon(options, server, port, ready) {
   }
   async function sendAcks() {
     if (shipper.hostRevoked) return;
+    registry2.expireQueuedPrompts(now());
     pendingAcks.push(...registry2.takeExpiredOnSeal());
     const lastEnvelopeAt = Math.max(
       lastIngestAt ?? -Infinity,
@@ -53030,9 +53726,11 @@ async function initializeDaemon(options, server, port, ready) {
     }
     if (now() < commandPollNextAttemptAt) return;
     const acks = pendingAcks.splice(0, 100);
+    let accepted = false;
     try {
       const { spool_oldest_at: _o, bundle_etag: _e, ...daemon } = health();
       const response = await client.commands(acks, daemon);
+      accepted = true;
       lastCommandPollAt = now();
       await onControl(response.control);
       if (commandPollFailures > 0) {
@@ -53043,7 +53741,7 @@ async function initializeDaemon(options, server, port, ready) {
       commandPollNextAttemptAt = 0;
       commandPollProtocolMismatchLogged = false;
     } catch (error) {
-      pendingAcks.unshift(...acks);
+      if (!accepted) pendingAcks.unshift(...acks);
       commandPollFailures += 1;
       if (error instanceof ControlError && isHostRevokedRefusal(error)) {
         shipper.markHostRevoked();
@@ -53306,7 +54004,7 @@ async function initializeDaemon(options, server, port, ready) {
   async function readSpoolFile(name) {
     try {
       const file = parseSpoolFile(
-        await readFile3(join38(paths.spool, name), "utf8")
+        await readFile3(join39(paths.spool, name), "utf8")
       );
       spoolFacts.set(name, spoolFactsOf(file));
       return file;
@@ -53370,6 +54068,11 @@ async function initializeDaemon(options, server, port, ready) {
             acks.push(ack);
           },
           now,
+          // A hook that queued behind others, or behind a slow read, can be
+          // answered after the harness stopped waiting. Past this instant
+          // the handler leaves the session's messages queued, rather than
+          // seal a steer as delivered into an answer nobody reads.
+          ...envelope2.answer_by !== void 0 ? { answerBy: envelope2.answer_by } : {},
           // Both reads hold this hook's session queue, and both answer no
           // answer once `stop` begins (`hookExecAsync`).
           pushCredentialBasis: (command2, cwd, harnessSessionId2) => {
@@ -53385,7 +54088,10 @@ async function initializeDaemon(options, server, port, ready) {
           skills,
           ...recallMemories !== void 0 ? { recallMemories } : {},
           ...noteMemoryReads !== void 0 ? { noteMemoryReads } : {},
-          reflectionToolRegistered
+          reflectionToolRegistered,
+          // The same check: the `oxagen` server Claude Code loaded for the
+          // session is the one this enrollment wrote (F-2355).
+          oxagenServerServes: reflectionToolRegistered
         },
         envelope2.replay,
         envelope2.harness,
@@ -53468,7 +54174,7 @@ async function initializeDaemon(options, server, port, ready) {
   function setAsideConflictingTerminal(uuid, pending, conflict) {
     const name = `${uuid}-terminal-conflict-${String(conflict.seq).padStart(8, "0")}.json`;
     writeSensitiveFileAtomic(
-      join38(paths.quarantine, name),
+      join39(paths.quarantine, name),
       JSON.stringify(
         {
           reason: conflict.message,
@@ -53548,8 +54254,8 @@ async function initializeDaemon(options, server, port, ready) {
   function moveToFailedSpool(path2, name, reason3) {
     log(`spool file ${name} moved to spool/failed/: ${reason3}`);
     try {
-      ensureDir(join38(paths.spool, "failed"));
-      renameSync4(path2, join38(paths.spool, "failed", name));
+      ensureDir(join39(paths.spool, "failed"));
+      renameSync4(path2, join39(paths.spool, "failed", name));
     } catch (error) {
       log(
         `spool file ${name} could not be moved to spool/failed/: ${error instanceof Error ? error.message : String(error)}`
@@ -53602,7 +54308,7 @@ async function initializeDaemon(options, server, port, ready) {
         continue;
       }
       reads += 1;
-      const path2 = join38(paths.spool, name);
+      const path2 = join39(paths.spool, name);
       let file;
       try {
         file = await readSpoolFile(name);
@@ -54191,7 +54897,16 @@ async function initializeDaemon(options, server, port, ready) {
         quarantineChanged();
         return Promise.reject(readable.error);
       }
-      return answerHook(envelope2, readable.data.session_id, {
+      if (envelope2.replay === void 0 && readable.data.agent_id === void 0 && STEER_WAIT_RELEASING_EVENTS.has(readable.data.hook_event_name))
+        steerWaiters.release(
+          sessionMapKey(readable.data.session_id, {
+            harness: envelope2.harness,
+            customAgent: envelope2.agent
+          }),
+          now()
+        );
+      const timed = envelope2.answer_by === void 0 && envelope2.answer_within_ms !== void 0 ? { ...envelope2, answer_by: now() + envelope2.answer_within_ms } : envelope2;
+      return answerHook(timed, readable.data.session_id, {
         drainSpoolFirst: true,
         refuseWhenStopping: true
       });
@@ -54220,6 +54935,20 @@ async function initializeDaemon(options, server, port, ready) {
         )
       );
     },
+    // An `oxagen hook --await-steer` hold for a session idle at its prompt
+    // (`steer-waiters.ts`). Once `stop` began it answers `wait`: the waiter
+    // asks again and reaches the next daemon.
+    waitForSteer: (input, signal) => {
+      if (stopped2) return Promise.resolve({ wait: true });
+      return steerWaiters.wait(
+        sessionMapKey(input.sessionId, {
+          harness: input.harness,
+          customAgent: input.agent
+        }),
+        signal,
+        input.startedAt
+      );
+    },
     health: () => ({
       ok: true,
       ...health(),
@@ -54394,7 +55123,7 @@ async function initializeDaemon(options, server, port, ready) {
     let removed = 0;
     for (const name of readdirSync12(paths.quarantine)) {
       if (!name.endsWith(".json")) continue;
-      const file = join38(paths.quarantine, name);
+      const file = join39(paths.quarantine, name);
       try {
         if (at2 - statSync10(file).mtimeMs < retainMs) continue;
         unlinkSync12(file);
@@ -54716,7 +55445,7 @@ async function initializeDaemon(options, server, port, ready) {
   let memoryScan;
   if (options.listen ?? true) {
     const codexMemories = createCodexMemoryStore({
-      path: join38(dirname21(paths.codexHooks), CODEX_MEMORY_STORE_FILE),
+      path: join39(dirname21(paths.codexHooks), CODEX_MEMORY_STORE_FILE),
       stat: (path2) => stat2(path2),
       log
     });
@@ -54809,6 +55538,7 @@ async function initializeDaemon(options, server, port, ready) {
     stop: async () => {
       if (stopped2) return;
       stopped2 = true;
+      steerWaiters.releaseAll();
       stopping.abort();
       if (timer) clearInterval(timer);
       if (memoryTimer) clearInterval(memoryTimer);
@@ -54848,6 +55578,10 @@ async function initializeDaemon(options, server, port, ready) {
         log(
           `stop: stopped shipping after ${timers.stopDrainMs} ms; the rest of the WAL ships at the next start`
         );
+      if (pendingAcks.length > 0 && !await settleWithin(sendAcks(), timers.stopDrainMs))
+        log(
+          `stop: could not send ${pendingAcks.length} command acknowledgement(s) within ${timers.stopDrainMs} ms`
+        );
       if (!await settleWithin(localServersStopped, 0))
         log(
           "stop: a local-server reply was still posting; the cloud gateway refuses that call on its side"
@@ -54894,6 +55628,7 @@ var init_daemon = __esm({
     init_session_changes();
     init_exporters();
     init_hook_handler();
+    init_steer_waiters();
     init_hook_id_journal();
     init_inbox();
     init_mcp_gateway();
@@ -55216,23 +55951,23 @@ import {
   realpathSync as realpathSync5,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { dirname as dirname22, join as join39, resolve as resolve14 } from "node:path";
-function bundlePath(root, relative10, create2 = false) {
-  const absolute = resolve14(root);
+import { dirname as dirname22, join as join40, resolve as resolve15 } from "node:path";
+function bundlePath(root, relative11, create2 = false) {
+  const absolute = resolve15(root);
   if (create2) mkdirSync6(absolute, { recursive: true, mode: 448 });
   if (lstatSync7(absolute).isSymbolicLink() || !lstatSync7(absolute).isDirectory()) {
     arpFail(`The bundle root ${absolute} must be a directory, not a symlink.`);
   }
   const base2 = realpathSync5(absolute);
   let current = base2;
-  const parts = relative10.split("/");
+  const parts = relative11.split("/");
   for (let i2 = 0; i2 < parts.length; i2++) {
-    current = join39(current, parts[i2]);
+    current = join40(current, parts[i2]);
     try {
       const stat7 = lstatSync7(current);
       if (stat7.isSymbolicLink() || i2 < parts.length - 1 && !stat7.isDirectory()) {
         arpFail(
-          `The bundle path ${relative10} passes through a symlink or a file where a directory belongs.`
+          `The bundle path ${relative11} passes through a symlink or a file where a directory belongs.`
         );
       }
     } catch (error) {
@@ -55242,35 +55977,35 @@ function bundlePath(root, relative10, create2 = false) {
     }
   }
   if (realpathSync5(dirname22(current)) !== dirname22(current)) {
-    arpFail(`The bundle directory changed while ${relative10} was read.`);
+    arpFail(`The bundle directory changed while ${relative11} was read.`);
   }
   return current;
 }
-function readBounded(root, relative10, limit = ARP_MAX_BLOB_BYTES) {
-  const path2 = bundlePath(root, relative10);
+function readBounded(root, relative11, limit = ARP_MAX_BLOB_BYTES) {
+  const path2 = bundlePath(root, relative11);
   const fd2 = openSync7(path2, constants4.O_RDONLY | constants4.O_NOFOLLOW);
   try {
     const stat7 = fstatSync2(fd2);
     if (!stat7.isFile() || stat7.size > limit)
       arpFail(
-        `The bundle file ${relative10} is not a regular file of at most ${limit} bytes.`
+        `The bundle file ${relative11} is not a regular file of at most ${limit} bytes.`
       );
     const bytes = Buffer.alloc(stat7.size);
     let offset = 0;
     while (offset < bytes.length) {
       const count12 = readSync4(fd2, bytes, offset, bytes.length - offset, offset);
-      if (!count12) arpFail(`The bundle file ${relative10} changed while it was read.`);
+      if (!count12) arpFail(`The bundle file ${relative11} changed while it was read.`);
       offset += count12;
     }
     if (readSync4(fd2, Buffer.alloc(1), 0, 1, offset) !== 0)
-      arpFail(`The bundle file ${relative10} changed while it was read.`);
+      arpFail(`The bundle file ${relative11} changed while it was read.`);
     return bytes;
   } finally {
     closeSync7(fd2);
   }
 }
-function writeNew(root, relative10, bytes) {
-  const path2 = bundlePath(root, relative10, true);
+function writeNew(root, relative11, bytes) {
+  const path2 = bundlePath(root, relative11, true);
   const fd2 = openSync7(
     path2,
     constants4.O_WRONLY | constants4.O_CREAT | constants4.O_EXCL | constants4.O_NOFOLLOW,
@@ -56188,7 +56923,7 @@ import {
   rmSync as rmSync8,
   writeFileSync as writeFileSync5
 } from "node:fs";
-import { dirname as dirname23, isAbsolute as isAbsolute10, join as join40, relative as relative4, resolve as resolve15, sep as sep5 } from "node:path";
+import { dirname as dirname23, isAbsolute as isAbsolute11, join as join41, relative as relative5, resolve as resolve16, sep as sep6 } from "node:path";
 function outsideProfile(path2) {
   return HARNESS_CONFIG_PATH.test(path2) || CREDENTIAL_PATH.test(path2);
 }
@@ -56239,12 +56974,12 @@ function rejectSecrets(label2, bytes) {
   }
 }
 function within2(root, path2) {
-  const rel = relative4(root, path2);
-  return rel === "" || !isAbsolute10(rel) && rel !== ".." && !rel.startsWith(`..${sep5}`);
+  const rel = relative5(root, path2);
+  return rel === "" || !isAbsolute11(rel) && rel !== ".." && !rel.startsWith(`..${sep6}`);
 }
 function newPath(path2) {
-  const full = resolve15(path2);
-  return join40(
+  const full = resolve16(path2);
+  return join41(
     realpathSync6(dirname23(full)),
     full.slice(dirname23(full).length + 1)
   );
@@ -56258,7 +56993,7 @@ function sourcePath(root, path2) {
   }
   let current = root;
   for (const part2 of path2.split("/")) {
-    current = join40(current, part2);
+    current = join41(current, part2);
     if (lstatSync8(current).isSymbolicLink())
       arpFail(
         `${path2} is a symlink or passes through one. Symlinks require a resource adapter.`
@@ -56525,10 +57260,10 @@ function prepareCheckpoint(options) {
   });
   mkdirSync7(destination, { mode: 448 });
   try {
-    const restored = join40(destination, "workspace");
+    const restored = join41(destination, "workspace");
     mkdirSync7(restored, { mode: 448 });
     for (const item of restore) {
-      const path2 = join40(restored, item.path);
+      const path2 = join41(restored, item.path);
       if (item.kind === "directory")
         mkdirSync7(path2, { recursive: true, mode: 448 });
       else {
@@ -56539,9 +57274,9 @@ function prepareCheckpoint(options) {
         });
       }
     }
-    const promptDir = join40(restored, ".arp");
+    const promptDir = join41(restored, ".arp");
     mkdirSync7(promptDir, { mode: 448 });
-    const promptFile = join40(promptDir, "handoff.json");
+    const promptFile = join41(promptDir, "handoff.json");
     const prompt = {
       checkpoint_digest: checkpointDigest,
       task: task.data.request,
@@ -56558,7 +57293,7 @@ function prepareCheckpoint(options) {
       flag: "wx",
       mode: 384
     });
-    const reportPath = join40(destination, "report.json");
+    const reportPath = join41(destination, "report.json");
     writeFileSync5(
       reportPath,
       jcs(
@@ -57199,7 +57934,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@oxagen/cli",
-      version: "2.1.4-725",
+      version: "2.1.4-926",
       description: "Oxagen governance CLI \u2014 spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
       type: "module",
       main: "./dist/index.js",
@@ -57266,10 +58001,10 @@ var init_package = __esm({
 
 // src/lib/atomic-write.ts
 import { writeFileSync as writeFileSync6, renameSync as renameSync5, unlinkSync as unlinkSync14, existsSync as existsSync22 } from "node:fs";
-import { dirname as dirname24, join as join41 } from "node:path";
+import { dirname as dirname24, join as join42 } from "node:path";
 function atomicWriteFileSync(path2, data, mode) {
   const dir = dirname24(path2);
-  const tmp = join41(
+  const tmp = join42(
     dir,
     `.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`
   );
@@ -57294,7 +58029,7 @@ var init_atomic_write = __esm({
 
 // src/lib/config.ts
 import { homedir as homedir8 } from "os";
-import { join as join42 } from "path";
+import { join as join43 } from "path";
 import { readFileSync as readFileSync21, mkdirSync as mkdirSync8, existsSync as existsSync23, statSync as statSync11 } from "fs";
 function getConfigDir() {
   return CONFIG_DIR;
@@ -57381,8 +58116,8 @@ var CONFIG_DIR, CONFIG_FILE, STRING_FIELDS, TELEMETRY_FIELDS, cached2;
 var init_config = __esm({
   "src/lib/config.ts"() {
     init_atomic_write();
-    CONFIG_DIR = join42(homedir8(), ".config", "oxagen");
-    CONFIG_FILE = join42(CONFIG_DIR, "config.json");
+    CONFIG_DIR = join43(homedir8(), ".config", "oxagen");
+    CONFIG_FILE = join43(CONFIG_DIR, "config.json");
     STRING_FIELDS = [
       "token",
       "orgSlug",
@@ -57427,16 +58162,16 @@ import {
   writeFile as writeFile2
 } from "node:fs/promises";
 import { homedir as homedir9 } from "node:os";
-import { join as join43 } from "node:path";
+import { join as join44 } from "node:path";
 function isDebugEnabled() {
   const v = process.env[DEBUG_ENV];
   return v === "1" || v === "true";
 }
 function logsDir() {
-  return join43(homedir9(), ".oxagen", "logs");
+  return join44(homedir9(), ".oxagen", "logs");
 }
 function debugLogFile() {
-  return join43(logsDir(), "cli.output");
+  return join44(logsDir(), "cli.output");
 }
 function sanitize(value, depth = 0) {
   if (value === null || value === void 0) return value;
@@ -60685,7 +61420,7 @@ var init_git = __esm({
       signal;
     };
     ABSENT_STDERR = /not a valid object name|invalid object name|bad object|unknown revision|no such (?:object|ref)|could not get object info|does not exist in '|exists on disk, but not in '|not a git repository/i;
-    execGit = (args, { cwd, timeoutMs }) => new Promise((resolve22, reject) => {
+    execGit = (args, { cwd, timeoutMs }) => new Promise((resolve23, reject) => {
       execFile5(
         "git",
         [...args],
@@ -60714,7 +61449,7 @@ var init_git = __esm({
             );
             return;
           }
-          resolve22(stdout);
+          resolve23(stdout);
         }
       );
     });
@@ -60731,9 +61466,9 @@ var init_git = __esm({
 
 // ../../packages/steering-freshness/src/cache.ts
 import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname25, join as join44 } from "node:path";
+import { dirname as dirname25, join as join45 } from "node:path";
 function stampPath(gitCommonDir) {
-  return join44(gitCommonDir, "oxagen", "steering-freshness.json");
+  return join45(gitCommonDir, "oxagen", "steering-freshness.json");
 }
 async function readFetchStamp(gitCommonDir, io = defaultIo) {
   try {
@@ -60785,24 +61520,24 @@ var init_cache = __esm({
 // ../../packages/steering-freshness/src/hooks.ts
 import { mkdir as mkdir5, readFile as readFile7, writeFile as writeFile5 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { dirname as dirname26, join as join45 } from "node:path";
+import { dirname as dirname26, join as join46 } from "node:path";
 function hookCommand(harness) {
   return `oxagen steering gate --harness ${harness}`;
 }
 function hookConfigPath(projectRoot, harness, env = process.env, home = homedir10()) {
   switch (harness) {
     case "claude-code":
-      return join45(projectRoot, ".claude", "settings.json");
+      return join46(projectRoot, ".claude", "settings.json");
     case "codex":
-      return join45(env["CODEX_HOME"] ?? join45(home, ".codex"), "hooks.json");
+      return join46(env["CODEX_HOME"] ?? join46(home, ".codex"), "hooks.json");
     case "cursor":
-      return join45(home, ".cursor", "hooks.json");
+      return join46(home, ".cursor", "hooks.json");
     case "stella":
-      return join45(env["STELLA_HOME"] ?? join45(home, ".stella"), "stella.toml");
+      return join46(env["STELLA_HOME"] ?? join46(home, ".stella"), "stella.toml");
   }
 }
 function stellaJsonPath(env, home) {
-  return join45(env["STELLA_HOME"] ?? join45(home, ".stella"), "settings.json");
+  return join46(env["STELLA_HOME"] ?? join46(home, ".stella"), "settings.json");
 }
 function isRecord7(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
@@ -61462,7 +62197,7 @@ var init_policy = __esm({
 // ../../packages/steering-freshness/src/settings.ts
 import { readFile as readFile8 } from "node:fs/promises";
 import { homedir as homedir11 } from "node:os";
-import { join as join46 } from "node:path";
+import { join as join47 } from "node:path";
 async function readLayer(scope, path2, read2) {
   let text5;
   try {
@@ -61514,14 +62249,14 @@ function parseLayer(scope, path2, text5) {
 }
 async function loadSteeringSettings({
   projectRoot,
-  userSettingsPath = join46(homedir11(), USER_SETTINGS_RELATIVE),
+  userSettingsPath = join47(homedir11(), USER_SETTINGS_RELATIVE),
   read: read2 = readFile8,
   workspacePolicy = null
 }) {
   const targets = [
     ["user", userSettingsPath],
-    ["project", join46(projectRoot, PROJECT_DIR_NAME, PROJECT_SETTINGS_FILE)],
-    ["local", join46(projectRoot, PROJECT_DIR_NAME, LOCAL_SETTINGS_FILE)]
+    ["project", join47(projectRoot, PROJECT_DIR_NAME, PROJECT_SETTINGS_FILE)],
+    ["local", join47(projectRoot, PROJECT_DIR_NAME, LOCAL_SETTINGS_FILE)]
   ];
   const layers = [];
   const warnings = [];
@@ -61584,7 +62319,7 @@ var init_settings = __esm({
     "use strict";
     init_git();
     init_policy();
-    USER_SETTINGS_RELATIVE = join46(
+    USER_SETTINGS_RELATIVE = join47(
       ".config",
       "oxagen",
       "settings.json"
@@ -61597,7 +62332,7 @@ var init_settings = __esm({
 
 // ../../packages/steering-freshness/src/check.ts
 import { lstat as lstat3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute11, join as join47, resolve as resolve16 } from "node:path";
+import { isAbsolute as isAbsolute12, join as join48, resolve as resolve17 } from "node:path";
 function publishedCommits(platform) {
   if (platform.headCommits && platform.headCommits.length > 0)
     return platform.headCommits;
@@ -61702,7 +62437,7 @@ async function checkSteeringFreshness(opts) {
     );
   }
   const commonDir = allowNetwork ? await gitOrNull(repoCtx, "rev-parse", "--git-common-dir") : null;
-  const stampDir = commonDir ? isAbsolute11(commonDir) ? commonDir : resolve16(root, commonDir) : null;
+  const stampDir = commonDir ? isAbsolute12(commonDir) ? commonDir : resolve17(root, commonDir) : null;
   const stamp = stampDir ? await readFetchStamp(stampDir, cacheIo) : null;
   const remoteContactDue = allowNetwork && shouldContactRemote(stamp, policy.fetchIntervalSeconds, now());
   const branch = policy.branch ?? await defaultBranch(networkCtx(repoCtx), policy.remote, {
@@ -61934,7 +62669,7 @@ async function absentFromDisk(root, paths) {
   const flags = await Promise.all(
     paths.map(async (path2) => {
       try {
-        await lstat3(join47(root, path2));
+        await lstat3(join48(root, path2));
         return false;
       } catch {
         return true;
@@ -61993,7 +62728,7 @@ var init_check = __esm({
 // ../../packages/steering-freshness/src/sync.ts
 import { mkdtemp, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join48 } from "node:path";
+import { join as join49 } from "node:path";
 function refuse3(refusal, message) {
   return {
     applied: false,
@@ -62174,9 +62909,9 @@ async function syncSteering(opts) {
   };
 }
 async function commitPaths(ctx, message, paths) {
-  const dir = await mkdtemp(join48(tmpdir2(), "oxagen-steering-sync-"));
+  const dir = await mkdtemp(join49(tmpdir2(), "oxagen-steering-sync-"));
   try {
-    const list2 = join48(dir, "pathspec");
+    const list2 = join49(dir, "pathspec");
     await writeFile6(list2, `${paths.join("\0")}\0`, "utf8");
     await git3(
       ctx,
@@ -62704,9 +63439,9 @@ var init_paths2 = __esm({
 
 // src/commands/workspace-link.ts
 import { existsSync as existsSync24, mkdirSync as mkdirSync9, readFileSync as readFileSync22 } from "node:fs";
-import { dirname as dirname27, join as join49 } from "node:path";
+import { dirname as dirname27, join as join50 } from "node:path";
 function workspaceLinkPath(cwd) {
-  return join49(cwd, WORKSPACE_LINK_PATH);
+  return join50(cwd, WORKSPACE_LINK_PATH);
 }
 function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -62796,7 +63531,7 @@ __export(steering_exports, {
 });
 import { execFileSync } from "node:child_process";
 import { existsSync as existsSync25, realpathSync as realpathSync7 } from "node:fs";
-import { dirname as dirname28, join as join50, normalize, parse as parsePath } from "node:path";
+import { dirname as dirname28, join as join51, normalize, parse as parsePath } from "node:path";
 function findProjectRoot(start) {
   const { root } = parsePath(start);
   const rawGitRoot = gitRootOr(start);
@@ -62805,7 +63540,7 @@ function findProjectRoot(start) {
   if (gitRoot !== null) return gitRoot;
   let dir = from;
   for (; ; ) {
-    if (existsSync25(join50(dir, PROJECT_DIR_NAME))) return dir;
+    if (existsSync25(join51(dir, PROJECT_DIR_NAME))) return dir;
     if (dir === root) return from;
     const parent = dirname28(dir);
     if (parent === dir) return from;
@@ -69064,10 +69799,10 @@ var require_resolve_block_map = __commonJS({
       let offset = bm.offset;
       let commentEnd = null;
       for (const collItem of bm.items) {
-        const { start, key, sep: sep12, value } = collItem;
+        const { start, key, sep: sep13, value } = collItem;
         const keyProps = resolveProps.resolveProps(start, {
           indicator: "explicit-key-ind",
-          next: key ?? sep12?.[0],
+          next: key ?? sep13?.[0],
           offset,
           onError,
           parentIndent: bm.indent,
@@ -69081,7 +69816,7 @@ var require_resolve_block_map = __commonJS({
             else if ("indent" in key && key.indent !== bm.indent)
               onError(offset, "BAD_INDENT", startColMsg);
           }
-          if (!keyProps.anchor && !keyProps.tag && !sep12) {
+          if (!keyProps.anchor && !keyProps.tag && !sep13) {
             commentEnd = keyProps.end;
             if (keyProps.comment) {
               if (map.comment)
@@ -69105,7 +69840,7 @@ var require_resolve_block_map = __commonJS({
         ctx.atKey = false;
         if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
           onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-        const valueProps = resolveProps.resolveProps(sep12 ?? [], {
+        const valueProps = resolveProps.resolveProps(sep13 ?? [], {
           indicator: "map-value-ind",
           next: value,
           offset: keyNode.range[2],
@@ -69121,7 +69856,7 @@ var require_resolve_block_map = __commonJS({
             if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
               onError(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep12, null, valueProps, onError);
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep13, null, valueProps, onError);
           if (ctx.schema.compat)
             utilFlowIndentCheck.flowIndentCheck(bm.indent, value, onError);
           offset = valueNode.range[2];
@@ -69212,7 +69947,7 @@ var require_resolve_end = __commonJS({
       let comment = "";
       if (end) {
         let hasSpace = false;
-        let sep12 = "";
+        let sep13 = "";
         for (const token of end) {
           const { source, type } = token;
           switch (type) {
@@ -69226,13 +69961,13 @@ var require_resolve_end = __commonJS({
               if (!comment)
                 comment = cb;
               else
-                comment += sep12 + cb;
-              sep12 = "";
+                comment += sep13 + cb;
+              sep13 = "";
               break;
             }
             case "newline":
               if (comment)
-                sep12 += source;
+                sep13 += source;
               hasSpace = true;
               break;
             default:
@@ -69275,18 +70010,18 @@ var require_resolve_flow_collection = __commonJS({
       let offset = fc.offset + fc.start.source.length;
       for (let i2 = 0; i2 < fc.items.length; ++i2) {
         const collItem = fc.items[i2];
-        const { start, key, sep: sep12, value } = collItem;
+        const { start, key, sep: sep13, value } = collItem;
         const props = resolveProps.resolveProps(start, {
           flow: fcName,
           indicator: "explicit-key-ind",
-          next: key ?? sep12?.[0],
+          next: key ?? sep13?.[0],
           offset,
           onError,
           parentIndent: fc.indent,
           startOnNewline: false
         });
         if (!props.found) {
-          if (!props.anchor && !props.tag && !sep12 && !value) {
+          if (!props.anchor && !props.tag && !sep13 && !value) {
             if (i2 === 0 && props.comma)
               onError(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
             else if (i2 < fc.items.length - 1)
@@ -69340,8 +70075,8 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap3 && !sep12 && !props.found) {
-          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep12, null, props, onError);
+        if (!isMap3 && !sep13 && !props.found) {
+          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep13, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
           if (isBlock(value))
@@ -69353,7 +70088,7 @@ var require_resolve_flow_collection = __commonJS({
           if (isBlock(key))
             onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
           ctx.atKey = false;
-          const valueProps = resolveProps.resolveProps(sep12 ?? [], {
+          const valueProps = resolveProps.resolveProps(sep13 ?? [], {
             flow: fcName,
             indicator: "map-value-ind",
             next: value,
@@ -69364,8 +70099,8 @@ var require_resolve_flow_collection = __commonJS({
           });
           if (valueProps.found) {
             if (!isMap3 && !props.found && ctx.options.strict) {
-              if (sep12)
-                for (const st of sep12) {
+              if (sep13)
+                for (const st of sep13) {
                   if (st === valueProps.found)
                     break;
                   if (st.type === "newline") {
@@ -69382,7 +70117,7 @@ var require_resolve_flow_collection = __commonJS({
             else
               onError(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep12, null, valueProps, onError) : null;
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep13, null, valueProps, onError) : null;
           if (valueNode) {
             if (isBlock(value))
               onError(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -69562,7 +70297,7 @@ var require_resolve_block_scalar = __commonJS({
           chompStart = i2 + 1;
       }
       let value = "";
-      let sep12 = "";
+      let sep13 = "";
       let prevMoreIndented = false;
       for (let i2 = 0; i2 < contentStart; ++i2)
         value += lines[i2][0].slice(trimIndent) + "\n";
@@ -69579,24 +70314,24 @@ var require_resolve_block_scalar = __commonJS({
           indent = "";
         }
         if (type === Scalar.Scalar.BLOCK_LITERAL) {
-          value += sep12 + indent.slice(trimIndent) + content;
-          sep12 = "\n";
+          value += sep13 + indent.slice(trimIndent) + content;
+          sep13 = "\n";
         } else if (indent.length > trimIndent || content[0] === "	") {
-          if (sep12 === " ")
-            sep12 = "\n";
-          else if (!prevMoreIndented && sep12 === "\n")
-            sep12 = "\n\n";
-          value += sep12 + indent.slice(trimIndent) + content;
-          sep12 = "\n";
+          if (sep13 === " ")
+            sep13 = "\n";
+          else if (!prevMoreIndented && sep13 === "\n")
+            sep13 = "\n\n";
+          value += sep13 + indent.slice(trimIndent) + content;
+          sep13 = "\n";
           prevMoreIndented = true;
         } else if (content === "") {
-          if (sep12 === "\n")
+          if (sep13 === "\n")
             value += "\n";
           else
-            sep12 = "\n";
+            sep13 = "\n";
         } else {
-          value += sep12 + content;
-          sep12 = " ";
+          value += sep13 + content;
+          sep13 = " ";
           prevMoreIndented = false;
         }
       }
@@ -69779,25 +70514,25 @@ var require_resolve_flow_scalar = __commonJS({
         trimBoth = /^[ \t]+|[ \t]+$/g;
       }
       let res = match[1].replace(trimEnd, "");
-      let sep12 = " ";
+      let sep13 = " ";
       let pos = line.lastIndex;
       while (match = line.exec(source)) {
         const lm = match[1].replace(trimBoth, "");
         if (lm === "") {
-          if (sep12 === "\n")
-            res += sep12;
+          if (sep13 === "\n")
+            res += sep13;
           else
-            sep12 = "\n";
+            sep13 = "\n";
         } else {
-          res += sep12 + lm;
-          sep12 = " ";
+          res += sep13 + lm;
+          sep13 = " ";
         }
         pos = line.lastIndex;
       }
       const last = /[ \t]*(.*)/sy;
       last.lastIndex = pos;
       match = last.exec(source);
-      return res + sep12 + (match?.[1] ?? "");
+      return res + sep13 + (match?.[1] ?? "");
     }
     function doubleQuotedValue(source, onError) {
       let res = "";
@@ -70607,14 +71342,14 @@ var require_cst_stringify = __commonJS({
         }
       }
     }
-    function stringifyItem({ start, key, sep: sep12, value }) {
+    function stringifyItem({ start, key, sep: sep13, value }) {
       let res = "";
       for (const st of start)
         res += st.source;
       if (key)
         res += stringifyToken(key);
-      if (sep12)
-        for (const st of sep12)
+      if (sep13)
+        for (const st of sep13)
           res += st.source;
       if (value)
         res += stringifyToken(value);
@@ -71781,18 +72516,18 @@ var require_parser = __commonJS({
         if (this.type === "map-value-ind") {
           const prev = getPrevProps(this.peek(2));
           const start = getFirstKeyStartProps(prev);
-          let sep12;
+          let sep13;
           if (scalar2.end) {
-            sep12 = scalar2.end;
-            sep12.push(this.sourceToken);
+            sep13 = scalar2.end;
+            sep13.push(this.sourceToken);
             delete scalar2.end;
           } else
-            sep12 = [this.sourceToken];
+            sep13 = [this.sourceToken];
           const map = {
             type: "block-map",
             offset: scalar2.offset,
             indent: scalar2.indent,
-            items: [{ start, key: scalar2, sep: sep12 }]
+            items: [{ start, key: scalar2, sep: sep13 }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map;
@@ -71945,15 +72680,15 @@ var require_parser = __commonJS({
                 } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                   const start2 = getFirstKeyStartProps(it.start);
                   const key = it.key;
-                  const sep12 = it.sep;
-                  sep12.push(this.sourceToken);
+                  const sep13 = it.sep;
+                  sep13.push(this.sourceToken);
                   delete it.key;
                   delete it.sep;
                   this.stack.push({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key, sep: sep12 }]
+                    items: [{ start: start2, key, sep: sep13 }]
                   });
                 } else if (start.length > 0) {
                   it.sep = it.sep.concat(start, this.sourceToken);
@@ -72147,13 +72882,13 @@ var require_parser = __commonJS({
             const prev = getPrevProps(parent);
             const start = getFirstKeyStartProps(prev);
             fixFlowSeqItems(fc);
-            const sep12 = fc.end.splice(1, fc.end.length);
-            sep12.push(this.sourceToken);
+            const sep13 = fc.end.splice(1, fc.end.length);
+            sep13.push(this.sourceToken);
             const map = {
               type: "block-map",
               offset: fc.offset,
               indent: fc.indent,
-              items: [{ start, key: fc, sep: sep12 }]
+              items: [{ start, key: fc, sep: sep13 }]
             };
             this.onKeyLine = true;
             this.stack[this.stack.length - 1] = map;
@@ -75312,7 +76047,7 @@ function codegraphSettingsGroupOf(path2) {
     (entry2) => codegraphSettingsPath(entry2.group) === path2
   ) ?? null;
 }
-var share, confidence, sourceTagSchema, codegraphSourcesSchema, CODEGRAPH_SOURCES_DEFAULTS, CODEGRAPH_FILE_SIZE_LIMIT_BYTES_DEFAULT, CODEGRAPH_SKIPPED_PATHS_DEFAULT, codegraphIndexingSchema, CODEGRAPH_INDEXING_DEFAULTS, codegraphKeySourceSchema, codegraphCallModeSchema, modelId, codegraphModelsSchema, CODEGRAPH_MODELS_DEFAULTS, codegraphEmbeddingProviderSchema, CODEGRAPH_EMBEDDING_DIMENSIONS_MAX, CODEGRAPH_OXAGEN_EMBEDDING_MODEL, CODEGRAPH_ENDPOINT_URL_PATTERN, codegraphEmbeddingsSchema, CODEGRAPH_EMBEDDINGS_DEFAULTS, codegraphLocalSchema, CODEGRAPH_LOCAL_DEFAULTS, CODEGRAPH_PROVENANCE_CONFIDENCE_DEFAULTS, codegraphConfidenceSchema, CODEGRAPH_CONFIDENCE_DEFAULTS, codegraphDomainIdSchema, written, domainName, domainDefinition, codegraphDomainChangeSchema, codegraphDomainsSchema, CODEGRAPH_DOMAINS_DEFAULTS, CODEGRAPH_BOT_AUTHORS_DEFAULT, codegraphHistorySchema, CODEGRAPH_HISTORY_DEFAULTS, codegraphDecisionsSchema, CODEGRAPH_DECISIONS_DEFAULTS, codegraphHostDefaultSchema, CODEGRAPH_HOST_DEFAULTS, codegraphScriptsSchema, CODEGRAPH_SCRIPTS_DEFAULTS, codegraphBoundariesSchema, CODEGRAPH_BOUNDARIES_DEFAULTS, codegraphBudgetsSchema, CODEGRAPH_BUDGETS_DEFAULTS, codegraphFreshnessSchema, CODEGRAPH_FRESHNESS_DEFAULTS, CODEGRAPH_SETTINGS_GROUPS;
+var share, confidence, sourceTagSchema, codegraphSourcesSchema, CODEGRAPH_SOURCES_DEFAULTS, CODEGRAPH_FILE_SIZE_LIMIT_BYTES_DEFAULT, CODEGRAPH_SKIPPED_PATHS_DEFAULT, CODEGRAPH_INVENTORY_ROLE_ARN, codegraphIndexingSchema, CODEGRAPH_INDEXING_DEFAULTS, codegraphKeySourceSchema, codegraphCallModeSchema, modelId, LINKER_ROUNDS_MAX, codegraphModelsSchema, CODEGRAPH_MODELS_DEFAULTS, codegraphEmbeddingProviderSchema, CODEGRAPH_EMBEDDING_DIMENSIONS_MAX, CODEGRAPH_OXAGEN_EMBEDDING_MODEL, CODEGRAPH_ENDPOINT_URL_PATTERN, codegraphEmbeddingsSchema, CODEGRAPH_EMBEDDINGS_DEFAULTS, codegraphLocalSchema, CODEGRAPH_LOCAL_DEFAULTS, CODEGRAPH_PROVENANCE_CONFIDENCE_DEFAULTS, codegraphConfidenceSchema, CODEGRAPH_CONFIDENCE_DEFAULTS, codegraphDomainIdSchema, written, domainName, domainDefinition, codegraphDomainChangeSchema, codegraphDomainsSchema, CODEGRAPH_DOMAINS_DEFAULTS, CODEGRAPH_BOT_AUTHORS_DEFAULT, codegraphHistorySchema, CODEGRAPH_HISTORY_DEFAULTS, codegraphDecisionsSchema, CODEGRAPH_DECISIONS_DEFAULTS, codegraphHostDefaultSchema, CODEGRAPH_HOST_DEFAULTS, codegraphScriptsSchema, CODEGRAPH_SCRIPTS_DEFAULTS, codegraphBoundariesSchema, CODEGRAPH_BOUNDARIES_DEFAULTS, codegraphBudgetsSchema, CODEGRAPH_BUDGETS_DEFAULTS, codegraphFreshnessSchema, CODEGRAPH_FRESHNESS_DEFAULTS, CODEGRAPH_SETTINGS_GROUPS;
 var init_codegraph_settings = __esm({
   "../../packages/oxagen/src/steering-repo/codegraph-settings.ts"() {
     "use strict";
@@ -75352,6 +76087,7 @@ var init_codegraph_settings = __esm({
       "**/*.key",
       "**/id_rsa*"
     ];
+    CODEGRAPH_INVENTORY_ROLE_ARN = /^arn:aws(?:-[a-z]+)*:iam::\d{12}:role\/oxagen-codegraph-inventory[\w+=,.@-]{0,32}$/;
     codegraphIndexingSchema = external_exports.object({
       file_size_limit_bytes: setting(
         external_exports.number().int().min(1).describe("Skip a file larger than this many bytes."),
@@ -75367,6 +76103,34 @@ var init_codegraph_settings = __esm({
         external_exports.boolean().describe("Read the live cloud inventory as well as the code."),
         false
       ),
+      cloud_accounts: uniqueArray(
+        external_exports.object({
+          provider: external_exports.literal("aws").describe("The cloud. AWS is the only one read so far."),
+          role_arn: external_exports.string().regex(
+            CODEGRAPH_INVENTORY_ROLE_ARN,
+            "the role is an IAM role whose name starts with oxagen-codegraph-inventory"
+          ).describe(
+            "The read-only role the template in services/codegraph/worker/inventory/ creates."
+          ),
+          regions: uniqueArray(
+            external_exports.string().regex(
+              /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/,
+              "a region is written like us-east-1"
+            ),
+            "regions",
+            1
+          ).describe("The regions read, such as us-east-1."),
+          environment: external_exports.string().min(1).max(64).optional().describe(
+            "The stage this account holds, such as production. Declared resources of another stage are not compared."
+          ),
+          repos: uniqueArray(repoRefSchema, "repos", 1).describe(
+            "The repositories whose infrastructure code declares this account."
+          )
+        }).strict(),
+        "cloud_accounts"
+      ).optional().describe(
+        "One row per cloud account live inventory reads, when live_cloud_inventory is on."
+      ),
       repos: uniqueArray(
         external_exports.object({
           url: repoRefSchema,
@@ -75390,11 +76154,13 @@ var init_codegraph_settings = __esm({
       file_size_limit_bytes: CODEGRAPH_FILE_SIZE_LIMIT_BYTES_DEFAULT,
       skipped_paths: CODEGRAPH_SKIPPED_PATHS_DEFAULT,
       live_cloud_inventory: false,
+      cloud_accounts: [],
       repos: []
     };
     codegraphKeySourceSchema = external_exports.enum(["oxagen", "organization"]);
     codegraphCallModeSchema = external_exports.enum(["batch", "standard"]);
     modelId = () => external_exports.string().min(1).max(200);
+    LINKER_ROUNDS_MAX = 5;
     codegraphModelsSchema = external_exports.object({
       key_source: setting(
         codegraphKeySourceSchema.describe(
@@ -75447,6 +76213,12 @@ var init_codegraph_settings = __esm({
         ),
         0.4
       ),
+      linker_rounds: setting(
+        external_exports.number().int().min(0).max(LINKER_ROUNDS_MAX).describe(
+          "The most model requests the linker sends for one node, across the default and the stronger model. 0 turns the linker off."
+        ),
+        4
+      ),
       spending_cap_micros_per_month: external_exports.number().int().min(0).optional().describe(
         "The workspace's monthly limit for code graph token calls, in millionths of a dollar. Unset: the plan's cap."
       )
@@ -75457,7 +76229,8 @@ var init_codegraph_settings = __esm({
       zero_data_retention: false,
       agent_reserved_share: 0.5,
       escalate_below: 0.6,
-      stronger_model_acceptance_floor: 0.4
+      stronger_model_acceptance_floor: 0.4,
+      linker_rounds: 4
     };
     codegraphEmbeddingProviderSchema = external_exports.enum(["oxagen", "custom"]);
     CODEGRAPH_EMBEDDING_DIMENSIONS_MAX = 4e3;
@@ -75830,7 +76603,7 @@ var init_codegraph_settings = __esm({
         group: "models",
         id: "codegraph-models/v1",
         title: "Code graph AI models and keys",
-        description: "codegraph/models.toml: the key source, the model for each task, call mode, providers, and escalation limits. The key itself is never stored here.",
+        description: "codegraph/models.toml: the key source, the model for each task, call mode, providers, escalation limits, and linker rounds. The key itself is never stored here.",
         schema: codegraphModelsSchema,
         defaults: CODEGRAPH_MODELS_DEFAULTS,
         timing: "next_build"
@@ -76225,7 +76998,8 @@ var init_run_list = __esm({
       "run_sealed",
       "no_host",
       "host_revoked",
-      "host_offline"
+      "host_offline",
+      "daemon_chain"
     ];
     STEER_BLOCKS = ["no_prompt_carrier"];
     HOST_POLL_WINDOW_MS = 5 * 6e4;
@@ -76700,6 +77474,14 @@ var init_run_list = __esm({
          * the hostname, and a ledger run's goal.
          */
         query: external_exports.string().trim().min(1).max(200).optional(),
+        /**
+         * Only the runs of this agent, by its key (`org_ns.ws_ns.slug`,
+         * ADR-024), matched exactly in the database. Absent lists every agent's
+         * runs. A ledger run that names no agent never matches. The agent page
+         * sets it, so an agent whose runs are all older than the workspace's
+         * newest page still lists them (#5786).
+         */
+        agentKey: external_exports.string().trim().min(1).max(200).optional(),
         /**
          * The order of the list. Absent means `started` descending. Nulls sort
          * last in both directions.
@@ -79843,20 +80625,20 @@ import { readFile as readFile9 } from "node:fs/promises";
 import {
   basename as basename7,
   dirname as dirname29,
-  isAbsolute as isAbsolute12,
-  relative as relative5,
-  resolve as resolve17,
-  sep as sep6
+  isAbsolute as isAbsolute13,
+  relative as relative6,
+  resolve as resolve18,
+  sep as sep7
 } from "node:path";
 function inside(rel) {
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute12(rel);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute13(rel);
 }
 function importFilename(path2, folder) {
-  let rel = relative5(process.cwd(), path2);
+  let rel = relative6(process.cwd(), path2);
   if (!inside(rel) && folder !== void 0) {
-    rel = relative5(dirname29(resolve17(folder)), resolve17(path2));
+    rel = relative6(dirname29(resolve18(folder)), resolve18(path2));
   }
-  const name = inside(rel) ? rel.split(sep6).join("/") : basename7(path2);
+  const name = inside(rel) ? rel.split(sep7).join("/") : basename7(path2);
   return name.length > 256 ? basename7(path2).slice(-256) : name;
 }
 async function readImportDocuments(sources, target2, writer) {
@@ -80141,7 +80923,7 @@ __export(steering_import_exports, {
 });
 import { readdir as readdir4, realpath as realpath2, stat as stat4 } from "node:fs/promises";
 import { homedir as homedir12 } from "node:os";
-import { basename as basename8, extname, join as join51, relative as relative6, sep as sep7 } from "node:path";
+import { basename as basename8, extname, join as join52, relative as relative7, sep as sep8 } from "node:path";
 function envDir2(env, key) {
   const value = env[key];
   return value === void 0 || value.trim() === "" ? null : value;
@@ -80149,34 +80931,34 @@ function envDir2(env, key) {
 function harnessHome(harness, env = process.env, home = homedir12()) {
   switch (harness) {
     case "claude-code": {
-      const config = envDir2(env, "CLAUDE_CONFIG_DIR") ?? join51(home, ".claude");
+      const config = envDir2(env, "CLAUDE_CONFIG_DIR") ?? join52(home, ".claude");
       return {
         harness,
         folders: [
           {
-            dir: skillsRoot("claude-code", env, home) ?? join51(config, "skills"),
+            dir: skillsRoot("claude-code", env, home) ?? join52(config, "skills"),
             mount: ".claude/skills"
           },
-          { dir: join51(config, "commands"), mount: ".claude/commands" },
-          { dir: join51(config, "agents"), mount: ".claude/agents" }
+          { dir: join52(config, "commands"), mount: ".claude/commands" },
+          { dir: join52(config, "agents"), mount: ".claude/agents" }
         ],
         instructions: [
-          { file: join51(config, "CLAUDE.md"), filename: ".claude/CLAUDE.md" }
+          { file: join52(config, "CLAUDE.md"), filename: ".claude/CLAUDE.md" }
         ]
       };
     }
     case "codex": {
-      const codexHome = envDir2(env, "CODEX_HOME") ?? join51(home, ".codex");
+      const codexHome = envDir2(env, "CODEX_HOME") ?? join52(home, ".codex");
       return {
         harness,
         folders: [
           {
-            dir: skillsRoot("codex", env, home) ?? join51(home, ".agents", "skills"),
+            dir: skillsRoot("codex", env, home) ?? join52(home, ".agents", "skills"),
             mount: ".agents/skills"
           }
         ],
         instructions: ["AGENTS.override.md", "AGENTS.md"].map((name) => ({
-          file: join51(codexHome, name),
+          file: join52(codexHome, name),
           filename: `.codex/${name}`
         }))
       };
@@ -80185,8 +80967,8 @@ function harnessHome(harness, env = process.env, home = homedir12()) {
       return {
         harness,
         folders: [
-          { dir: join51(home, ".cursor", "skills"), mount: ".cursor/skills" },
-          { dir: join51(home, ".cursor", "commands"), mount: ".cursor/commands" }
+          { dir: join52(home, ".cursor", "skills"), mount: ".cursor/skills" },
+          { dir: join52(home, ".cursor", "commands"), mount: ".cursor/commands" }
         ],
         instructions: []
       };
@@ -80196,7 +80978,7 @@ function byName(a, b3) {
   return a.name < b3.name ? -1 : 1;
 }
 function under(root, path2) {
-  return relative6(root, path2).split(sep7).join("/");
+  return relative7(root, path2).split(sep8).join("/");
 }
 function isPersonal(rel) {
   return classifyHarnessFile(rel)?.kind === "personal";
@@ -80232,7 +81014,7 @@ async function findMarkdownFiles(paths, harness) {
     }
     const found = [];
     for (const entry2 of entries2.sort(byName)) {
-      const path2 = join51(dir, entry2.name);
+      const path2 = join52(dir, entry2.name);
       if (entry2.isDirectory()) {
         if (!entry2.name.startsWith(".") && entry2.name !== "node_modules")
           found.push(...await filesUnder(path2, from));
@@ -80254,7 +81036,7 @@ async function findMarkdownFiles(paths, harness) {
     const { folder } = frame;
     const named = (rel) => frame.fixedNames ? { filename: rel } : {};
     for (const entry2 of entries2) {
-      const path2 = join51(dir, entry2.name);
+      const path2 = join52(dir, entry2.name);
       const rel = frame.relOf(path2);
       if (entry2.isDirectory()) {
         if (entry2.name === "node_modules") continue;
@@ -80313,7 +81095,7 @@ async function findMarkdownFiles(paths, harness) {
     }
     if (folderGiven) {
       const catalogue = CATALOGUE_FOLDERS.has(basename8(path2));
-      const root = catalogue ? join51(path2, "..") : path2;
+      const root = catalogue ? join52(path2, "..") : path2;
       await walk2(path2, {
         relOf: (p) => under(root, p),
         folder: path2,
@@ -80643,7 +81425,7 @@ __export(run_exports, {
 });
 import { createHash as createHash16 } from "node:crypto";
 import { createWriteStream, renameSync as renameSync6, rmSync as rmSync9 } from "node:fs";
-import { resolve as resolve18 } from "node:path";
+import { resolve as resolve19 } from "node:path";
 import { Readable as Readable2 } from "node:stream";
 import { pipeline as pipeline2 } from "node:stream/promises";
 async function runExport(runId, opts = {}, writer = stdoutWriter) {
@@ -80741,7 +81523,7 @@ async function runDownload(exportId, opts = {}, writer = stdoutWriter) {
     return;
   }
   const url = resolveDownloadUrl(status2.download.url, getApiUrl());
-  const path2 = resolve18(opts.out ?? `${status2.runId}-${exportId}.zip`);
+  const path2 = resolve19(opts.out ?? `${status2.runId}-${exportId}.zip`);
   const partial = `${path2}.${process.pid}.partial`;
   const hash3 = createHash16("sha256");
   let size = 0;
@@ -81973,10 +82755,10 @@ __export(verify_exports, {
   verifyBundle: () => verifyBundle3
 });
 import { existsSync as existsSync26, readFileSync as readFileSync23, statSync as statSync12 } from "node:fs";
-import { join as join52 } from "node:path";
+import { join as join53 } from "node:path";
 function readDirectory(dir) {
   const read2 = (name) => {
-    const path2 = join52(dir, name);
+    const path2 = join53(dir, name);
     return existsSync26(path2) ? readFileSync23(path2, "utf8") : void 0;
   };
   return assemble(read2, dir);
@@ -83105,7 +83887,7 @@ import {
   writeFileSync as writeFileSync7
 } from "node:fs";
 import { homedir as homedir13, hostname as osHostname3 } from "node:os";
-import { join as join53, relative as relative7, resolve as resolve19, sep as sep8 } from "node:path";
+import { join as join54, relative as relative8, resolve as resolve20, sep as sep9 } from "node:path";
 function git4(cwd, args) {
   return new Promise((done) => {
     try {
@@ -83126,7 +83908,7 @@ function git4(cwd, args) {
 }
 async function projectRootFor(cwd) {
   const top = await git4(cwd, ["rev-parse", "--show-toplevel"]);
-  return top ? resolve19(top) : resolve19(cwd);
+  return top ? resolve20(top) : resolve20(cwd);
 }
 function parseRemoteRepository(url) {
   const raw = url.trim();
@@ -83152,7 +83934,7 @@ function parseRemoteRepository(url) {
 }
 function oxagenPresent(root) {
   try {
-    return readdirSync13(join53(root, ".oxagen")).some(
+    return readdirSync13(join54(root, ".oxagen")).some(
       (name) => name !== "workspace.json"
     );
   } catch {
@@ -83161,22 +83943,22 @@ function oxagenPresent(root) {
 }
 function symlinkState(root) {
   try {
-    if (!lstatSync9(join53(root, ".stella")).isDirectory()) return "none";
+    if (!lstatSync9(join54(root, ".stella")).isDirectory()) return "none";
   } catch {
     return "none";
   }
   let oxagenReal;
   try {
-    oxagenReal = realpathSync8(join53(root, ".oxagen"));
+    oxagenReal = realpathSync8(join54(root, ".oxagen"));
   } catch {
     return "missing";
   }
   for (const link of STELLA_LINKS) {
-    const at2 = join53(root, link);
+    const at2 = join54(root, link);
     try {
       if (!lstatSync9(at2).isSymbolicLink()) return "missing";
       const target2 = realpathSync8(at2);
-      if (target2 !== oxagenReal && !target2.startsWith(oxagenReal + sep8)) {
+      if (target2 !== oxagenReal && !target2.startsWith(oxagenReal + sep9)) {
         return "missing";
       }
     } catch {
@@ -83186,7 +83968,7 @@ function symlinkState(root) {
   return "linked";
 }
 function machineId(configDir = getConfigDir()) {
-  const file = join53(configDir, MACHINE_ID_FILE);
+  const file = join54(configDir, MACHINE_ID_FILE);
   let secret = null;
   try {
     if (existsSync27(file)) {
@@ -83226,7 +84008,7 @@ async function probeWorkingCopy(opts) {
   return {
     machineId: machineId(opts.configDir),
     hostname: host.length > 0 ? host : "unknown",
-    directory: resolve19(root),
+    directory: resolve20(root),
     repository: remote ? parseRemoteRepository(remote) : null,
     // `HEAD` is git's answer on a detached head.
     branch: branch && branch !== "HEAD" ? branch.slice(0, 255) : null,
@@ -83259,21 +84041,21 @@ function realpathOr2(path2) {
   try {
     return realpathSync8(path2);
   } catch {
-    return resolve19(path2);
+    return resolve20(path2);
   }
 }
 async function ensureWorkspaceLinkIgnored(root) {
   const top = await git4(root, ["rev-parse", "--show-toplevel"]);
   if (!top) return null;
-  const topDir = resolve19(top);
-  const entry2 = relative7(
+  const topDir = resolve20(top);
+  const entry2 = relative8(
     topDir,
-    join53(realpathOr2(root), ".oxagen", "workspace.json")
-  ).split(sep8).join("/");
+    join54(realpathOr2(root), ".oxagen", "workspace.json")
+  ).split(sep9).join("/");
   if (entry2.startsWith("../")) return null;
   const rule = await git4(topDir, ["check-ignore", "--no-index", "-v", entry2]);
   if (rule !== null) return null;
-  const gitignore = join53(resolve19(top), ".gitignore");
+  const gitignore = join54(resolve20(top), ".gitignore");
   let existing = "";
   try {
     existing = readFileSync24(gitignore, "utf8");
@@ -83797,11 +84579,11 @@ import {
 } from "node:fs";
 import {
   dirname as dirname30,
-  isAbsolute as isAbsolute13,
-  join as join54,
+  isAbsolute as isAbsolute14,
+  join as join55,
   parse as parsePath2,
   posix as posix4,
-  sep as sep9
+  sep as sep10
 } from "node:path";
 function isPublishedSteering(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -83818,7 +84600,7 @@ function checkSteeringPath(path2) {
   if (path2.includes("\\")) {
     return { ok: false, reason: "contains a backslash" };
   }
-  if (posix4.isAbsolute(path2) || isAbsolute13(path2) || /^[A-Za-z]:/.test(path2)) {
+  if (posix4.isAbsolute(path2) || isAbsolute14(path2) || /^[A-Za-z]:/.test(path2)) {
     return { ok: false, reason: "absolute path" };
   }
   const normalized = posix4.normalize(path2);
@@ -83918,7 +84700,7 @@ function findLinkedRoot(start) {
 }
 function fsReader(root) {
   return (path2) => {
-    const abs = join54(root, ...path2.split("/"));
+    const abs = join55(root, ...path2.split("/"));
     try {
       const st = lstatSync10(abs);
       if (!st.isFile()) return Buffer.from(`\0not-a-file:${abs}`);
@@ -83929,14 +84711,14 @@ function fsReader(root) {
   };
 }
 function assertInsideOxagen(root, path2) {
-  const oxagenAbs = join54(root, OXAGEN_DIR);
+  const oxagenAbs = join55(root, OXAGEN_DIR);
   let oxagenReal;
   try {
     oxagenReal = realpathSync9(oxagenAbs);
   } catch {
     return;
   }
-  const abs = join54(root, ...path2.split("/"));
+  const abs = join55(root, ...path2.split("/"));
   try {
     if (lstatSync10(abs).isSymbolicLink()) {
       throw new Error(
@@ -83955,7 +84737,7 @@ function assertInsideOxagen(root, path2) {
       real = null;
     }
     if (real !== null) {
-      if (real !== oxagenReal && !real.startsWith(oxagenReal + sep9)) {
+      if (real !== oxagenReal && !real.startsWith(oxagenReal + sep10)) {
         throw new Error(`${path2} resolves outside .oxagen/`);
       }
       return;
@@ -83966,9 +84748,9 @@ function assertInsideOxagen(root, path2) {
   }
 }
 function pruneEmptyDirs(root, path2) {
-  const stop = join54(root, OXAGEN_DIR);
-  let dir = dirname30(join54(root, ...path2.split("/")));
-  while (dir.startsWith(stop + sep9)) {
+  const stop = join55(root, OXAGEN_DIR);
+  let dir = dirname30(join55(root, ...path2.split("/")));
+  while (dir.startsWith(stop + sep10)) {
     try {
       if (readdirSync14(dir).length > 0) return;
       rmdirSync7(dir);
@@ -83982,12 +84764,12 @@ function applyPlan(root, plan) {
   for (const w of plan.writes) assertInsideOxagen(root, w.path);
   for (const d of plan.deletes) assertInsideOxagen(root, d);
   for (const w of plan.writes) {
-    const abs = join54(root, ...w.path.split("/"));
+    const abs = join55(root, ...w.path.split("/"));
     mkdirSync11(dirname30(abs), { recursive: true });
     atomicWriteFileSync(abs, w.content);
   }
   for (const d of plan.deletes) {
-    rmSync10(join54(root, ...d.split("/")), { force: true });
+    rmSync10(join55(root, ...d.split("/")), { force: true });
     pruneEmptyDirs(root, d);
   }
 }
@@ -89994,7 +90776,7 @@ function createFileRegistry(...args) {
         if (seen.has(protoFileName)) {
           continue;
         }
-        const dep = resolve22(protoFileName);
+        const dep = resolve23(protoFileName);
         if (!dep) {
           throw new Error(`Unable to resolve ${protoFileName}, imported by ${file.name}`);
         }
@@ -90008,7 +90790,7 @@ function createFileRegistry(...args) {
       return deps.concat(...deps.map(recurseDeps));
     };
     const input = args[0];
-    const resolve22 = args[1];
+    const resolve23 = args[1];
     const seen = /* @__PURE__ */ new Set();
     for (const file of [input, ...recurseDeps(input)].reverse()) {
       addFile(file, registry2);
@@ -92858,7 +93640,7 @@ var require_aspromise = __commonJS({
       var params = new Array(arguments.length - 1), offset = 0, index = 2, pending = true;
       while (index < arguments.length)
         params[offset++] = arguments[index++];
-      return new Promise(function executor(resolve22, reject) {
+      return new Promise(function executor(resolve23, reject) {
         params[offset] = function callback(err2) {
           if (pending) {
             pending = false;
@@ -92868,7 +93650,7 @@ var require_aspromise = __commonJS({
               var params2 = new Array(arguments.length - 1), offset2 = 0;
               while (offset2 < params2.length)
                 params2[offset2++] = arguments[offset2];
-              resolve22.apply(null, params2);
+              resolve23.apply(null, params2);
             }
           }
         };
@@ -95386,13 +96168,13 @@ var require_path = __commonJS({
   "../../node_modules/.pnpm/@protobufjs+path@1.1.2/node_modules/@protobufjs/path/index.js"(exports) {
     "use strict";
     var path2 = exports;
-    var isAbsolute15 = (
+    var isAbsolute16 = (
       /**
        * Tests if the specified path is absolute.
        * @param {string} path Path to test
        * @returns {boolean} `true` if path is absolute
        */
-      path2.isAbsolute = function isAbsolute16(path3) {
+      path2.isAbsolute = function isAbsolute17(path3) {
         return /^(?:\/|\w+:)/.test(path3);
       }
     );
@@ -95404,7 +96186,7 @@ var require_path = __commonJS({
        */
       path2.normalize = function normalize4(path3) {
         path3 = path3.replace(/\\/g, "/").replace(/\/{2,}/g, "/");
-        var parts = path3.split("/"), absolute = isAbsolute15(path3), prefix = "";
+        var parts = path3.split("/"), absolute = isAbsolute16(path3), prefix = "";
         if (absolute)
           prefix = parts.shift() + "/";
         for (var i2 = 0; i2 < parts.length; ) {
@@ -95423,10 +96205,10 @@ var require_path = __commonJS({
         return prefix + parts.join("/");
       }
     );
-    path2.resolve = function resolve22(originPath, includePath, alreadyNormalized) {
+    path2.resolve = function resolve23(originPath, includePath, alreadyNormalized) {
       if (!alreadyNormalized)
         includePath = normalize3(includePath);
-      if (isAbsolute15(includePath))
+      if (isAbsolute16(includePath))
         return includePath;
       if (!alreadyNormalized)
         originPath = normalize3(originPath);
@@ -95780,7 +96562,7 @@ var require_mapfield = __commonJS({
         keepComments ? this.comment : void 0
       ]);
     };
-    MapField.prototype.resolve = function resolve22() {
+    MapField.prototype.resolve = function resolve23() {
       if (this.resolved)
         return this;
       if (types.mapKey[this.keyType] === void 0)
@@ -95857,7 +96639,7 @@ var require_method = __commonJS({
         this.parsedOptions
       ]);
     };
-    Method.prototype.resolve = function resolve22() {
+    Method.prototype.resolve = function resolve23() {
       if (this.resolved)
         return this;
       this.resolvedRequestType = this.parent.lookupType(this.requestType);
@@ -97470,7 +98252,7 @@ var require_field = __commonJS({
         keepComments ? this.comment : void 0
       ]);
     };
-    Field.prototype.resolve = function resolve22() {
+    Field.prototype.resolve = function resolve23() {
       if (this.resolved)
         return this;
       if ((this.typeDefault = types.defaults[this.type]) === void 0) {
@@ -97743,7 +98525,7 @@ var require_object = __commonJS({
       this.parent = null;
       this.resolved = false;
     };
-    ReflectionObject.prototype.resolve = function resolve22() {
+    ReflectionObject.prototype.resolve = function resolve23() {
       if (this.resolved)
         return this;
       if (this.root instanceof Root)
@@ -101298,7 +102080,7 @@ function buildSet(input, notes) {
   for (const [name, file] of built) {
     const visible = visibility.of(name);
     for (const ref2 of file.pending)
-      resolve20(ref2, name, visible, everyFile, symbols);
+      resolve21(ref2, name, visible, everyFile, symbols);
     for (const [key, text5] of file.comments) comments.set(key, text5);
     for (const option of file.customOptions) customOptions.add(option);
   }
@@ -101472,7 +102254,7 @@ function remember(built, name, file) {
   built.set(name, file);
   return file.proto;
 }
-function resolve20(ref2, file, visible, everyFile, symbols) {
+function resolve21(ref2, file, visible, everyFile, symbols) {
   const found = symbols.lookup(ref2.ref, ref2.scope, visible);
   if (found === void 0) {
     const everywhere = symbols.lookup(ref2.ref, ref2.scope, everyFile);
@@ -103925,19 +104707,19 @@ function retryAfterMs(value, now) {
   return Number.isNaN(date) ? void 0 : Math.max(0, date - now);
 }
 function sleep(ms, signal) {
-  return new Promise((resolve22) => {
+  return new Promise((resolve23) => {
     if (signal.aborted) {
-      resolve22(false);
+      resolve23(false);
       return;
     }
     const onAbort = () => {
       clearTimeout(timer);
-      resolve22(false);
+      resolve23(false);
     };
     const timer = setTimeout(
       () => {
         signal.removeEventListener("abort", onAbort);
-        resolve22(true);
+        resolve23(true);
       },
       Math.min(ms, MAX_TIMER_MS)
     );
@@ -103991,13 +104773,13 @@ var init_retry = __esm({
         else signal.addEventListener("abort", this.onAbort, { once: true });
       }
       race(promise) {
-        return new Promise((resolve22) => {
+        return new Promise((resolve23) => {
           let settled2 = false;
           const settle3 = (result2) => {
             if (settled2) return;
             settled2 = true;
             this.waiter = void 0;
-            resolve22(result2);
+            resolve23(result2);
           };
           promise.then(
             (value) => settle3({ kind: "value", value }),
@@ -104389,8 +105171,8 @@ function sendFailure(error, sender) {
   };
 }
 function settle2(run3) {
-  return new Promise((resolve22) => {
-    resolve22(run3());
+  return new Promise((resolve23) => {
+    resolve23(run3());
   });
 }
 async function attemptOnce(spec, deadline) {
@@ -107790,7 +108572,7 @@ var require_call_credentials = __commonJS({
           if (isCurrentOauth2Client(googleCredentials)) {
             getHeaders = googleCredentials.getRequestHeaders(options.service_url);
           } else {
-            getHeaders = new Promise((resolve22, reject) => {
+            getHeaders = new Promise((resolve23, reject) => {
               googleCredentials.getRequestMetadata(options.service_url, (err2, headers) => {
                 if (err2) {
                   reject(err2);
@@ -107800,7 +108582,7 @@ var require_call_credentials = __commonJS({
                   reject(new Error("Headers not set by metadata plugin"));
                   return;
                 }
-                resolve22(headers);
+                resolve23(headers);
               });
             });
           }
@@ -107853,10 +108635,10 @@ var require_call_credentials = __commonJS({
         this.metadataGenerator = metadataGenerator;
       }
       generateMetadata(options) {
-        return new Promise((resolve22, reject) => {
+        return new Promise((resolve23, reject) => {
           this.metadataGenerator(options, (err2, metadata) => {
             if (metadata !== void 0) {
-              resolve22(metadata);
+              resolve23(metadata);
             } else {
               reject(err2);
             }
@@ -108215,14 +108997,14 @@ var require_channel_credentials = __commonJS({
       }
       connect(socket) {
         const tlsConnectOptions = Object.assign({ socket }, this.connectionOptions);
-        return new Promise((resolve22, reject) => {
+        return new Promise((resolve23, reject) => {
           const tlsSocket = (0, tls_1.connect)(tlsConnectOptions, () => {
             var _a2;
             if (((_a2 = this.connectionOptions.rejectUnauthorized) !== null && _a2 !== void 0 ? _a2 : true) && !tlsSocket.authorized) {
               reject(tlsSocket.authorizationError);
               return;
             }
-            resolve22({
+            resolve23({
               socket: tlsSocket,
               secure: true
             });
@@ -108341,8 +109123,8 @@ var require_channel_credentials = __commonJS({
         if (this.hasReceivedUpdates()) {
           return Promise.resolve(this.getLatestSecureContext());
         } else {
-          return new Promise((resolve22) => {
-            this.secureContextWatchers.push(resolve22);
+          return new Promise((resolve23) => {
+            this.secureContextWatchers.push(resolve23);
           });
         }
       }
@@ -108375,7 +109157,7 @@ var require_channel_credentials = __commonJS({
         this.callCredentials = callCredentials;
       }
       connect(socket) {
-        return new Promise((resolve22, reject) => {
+        return new Promise((resolve23, reject) => {
           const secureContext = this.parent.getLatestSecureContext();
           if (!secureContext) {
             reject(new Error("Failed to load credentials"));
@@ -108400,7 +109182,7 @@ var require_channel_credentials = __commonJS({
               reject(tlsSocket.authorizationError);
               return;
             }
-            resolve22({
+            resolve23({
               socket: tlsSocket,
               secure: true
             });
@@ -115279,18 +116061,18 @@ var require_compression_filter = __commonJS({
         this.maxRecvMessageLength = maxRecvMessageLength;
       }
       compressMessage(message) {
-        return new Promise((resolve22, reject) => {
+        return new Promise((resolve23, reject) => {
           zlib.deflate(message, (err2, output) => {
             if (err2) {
               reject(err2);
             } else {
-              resolve22(output);
+              resolve23(output);
             }
           });
         });
       }
       decompressMessage(message) {
-        return new Promise((resolve22, reject) => {
+        return new Promise((resolve23, reject) => {
           let totalLength = 0;
           const messageParts = [];
           const decompresser = zlib.createInflate();
@@ -115312,7 +116094,7 @@ var require_compression_filter = __commonJS({
             }
           });
           decompresser.on("end", () => {
-            resolve22(Buffer.concat(messageParts));
+            resolve23(Buffer.concat(messageParts));
           });
           decompresser.write(message);
           decompresser.end();
@@ -115325,18 +116107,18 @@ var require_compression_filter = __commonJS({
         this.maxRecvMessageLength = maxRecvMessageLength;
       }
       compressMessage(message) {
-        return new Promise((resolve22, reject) => {
+        return new Promise((resolve23, reject) => {
           zlib.gzip(message, (err2, output) => {
             if (err2) {
               reject(err2);
             } else {
-              resolve22(output);
+              resolve23(output);
             }
           });
         });
       }
       decompressMessage(message) {
-        return new Promise((resolve22, reject) => {
+        return new Promise((resolve23, reject) => {
           let totalLength = 0;
           const messageParts = [];
           const decompresser = zlib.createGunzip();
@@ -115358,7 +116140,7 @@ var require_compression_filter = __commonJS({
             }
           });
           decompresser.on("end", () => {
-            resolve22(Buffer.concat(messageParts));
+            resolve23(Buffer.concat(messageParts));
           });
           decompresser.write(message);
           decompresser.end();
@@ -116713,7 +117495,7 @@ var require_http_proxy = __commonJS({
       options.headers = headers;
       const proxyAddressString = (0, subchannel_address_1.subchannelAddressToString)(address);
       trace("Using proxy " + proxyAddressString + " to connect to " + options.path);
-      return new Promise((resolve22, reject) => {
+      return new Promise((resolve23, reject) => {
         const request3 = http2.request(options);
         request3.once("connect", (res, socket, head2) => {
           request3.removeAllListeners();
@@ -116724,7 +117506,7 @@ var require_http_proxy = __commonJS({
               socket.unshift(head2);
             }
             trace("Successfully established a plaintext connection to " + options.path + " through proxy " + proxyAddressString);
-            resolve22(socket);
+            resolve23(socket);
           } else {
             (0, logging_1.log)(constants_1.LogVerbosity.ERROR, "Failed to connect to " + options.path + " through proxy " + proxyAddressString + " with status " + res.statusCode);
             reject();
@@ -117705,7 +118487,7 @@ var require_transport = __commonJS({
         if (secureConnectResult.socket.closed) {
           return Promise.reject("Connection closed before starting HTTP/2 handshake");
         }
-        return new Promise((resolve22, reject) => {
+        return new Promise((resolve23, reject) => {
           var _a2, _b2, _c, _d, _e, _f, _g, _h;
           let remoteName = null;
           let realTarget2 = this.channelTarget;
@@ -117776,7 +118558,7 @@ var require_transport = __commonJS({
             session.removeAllListeners();
             secureConnectResult.socket.removeListener("close", closeHandler);
             secureConnectResult.socket.removeListener("error", errorHandler);
-            resolve22(new Http2Transport(session, address, options, remoteName));
+            resolve23(new Http2Transport(session, address, options, remoteName));
             this.session = null;
           });
           session.once("close", closeHandler);
@@ -117790,7 +118572,7 @@ var require_transport = __commonJS({
           if (proxiedSocket) {
             return proxiedSocket;
           } else {
-            return new Promise((resolve22, reject) => {
+            return new Promise((resolve23, reject) => {
               const closeCallback = () => {
                 reject(new Error("Socket closed"));
               };
@@ -117800,7 +118582,7 @@ var require_transport = __commonJS({
               const socket = net.connect(address, () => {
                 socket.removeListener("close", closeCallback);
                 socket.removeListener("error", errorCallback);
-                resolve22(socket);
+                resolve23(socket);
               });
               socket.once("close", closeCallback);
               socket.once("error", errorCallback);
@@ -121204,7 +121986,7 @@ var require_server_interceptors = __commonJS({
           } else {
             decompresser = zlib.createGunzip();
           }
-          return new Promise((resolve22, reject) => {
+          return new Promise((resolve23, reject) => {
             let totalLength = 0;
             const messageParts = [];
             decompresser.on("error", (error) => {
@@ -121225,7 +122007,7 @@ var require_server_interceptors = __commonJS({
               }
             });
             decompresser.on("end", () => {
-              resolve22(Buffer.concat(messageParts));
+              resolve23(Buffer.concat(messageParts));
             });
             decompresser.write(messageContents);
             decompresser.end();
@@ -121818,10 +122600,10 @@ var require_server = __commonJS({
         bindOneAddress(address, boundPortObject) {
           this.trace("Attempting to bind " + (0, subchannel_address_1.subchannelAddressToString)(address));
           const http2Server = this.createHttp2Server(boundPortObject.credentials);
-          return new Promise((resolve22, reject) => {
+          return new Promise((resolve23, reject) => {
             const onError = (err2) => {
               this.trace("Failed to bind " + (0, subchannel_address_1.subchannelAddressToString)(address) + " with error " + err2.message);
-              resolve22({
+              resolve23({
                 port: "port" in address ? address.port : 1,
                 error: err2.message
               });
@@ -121849,7 +122631,7 @@ var require_server = __commonJS({
               });
               boundPortObject.listeningServers.add(http2Server);
               this.trace("Successfully bound " + (0, subchannel_address_1.subchannelAddressToString)(boundSubchannelAddress));
-              resolve22({
+              resolve23({
                 port: "port" in boundSubchannelAddress ? boundSubchannelAddress.port : 1
               });
               http2Server.removeListener("error", onError);
@@ -121902,7 +122684,7 @@ var require_server = __commonJS({
           }
         }
         resolvePort(port) {
-          return new Promise((resolve22, reject) => {
+          return new Promise((resolve23, reject) => {
             let seenResolution = false;
             const resolverListener = (endpointList, attributes, serviceConfig, resolutionNote) => {
               if (seenResolution) {
@@ -121918,7 +122700,7 @@ var require_server = __commonJS({
                 reject(new Error(`No addresses resolved for port ${port}`));
                 return true;
               }
-              resolve22(addressList);
+              resolve23(addressList);
               return true;
             };
             const resolver = (0, resolver_1.createResolver)(port, resolverListener, this.options);
@@ -125925,13 +126707,13 @@ var init_env = __esm({
       // Row-Level Security enforcement gate. Fail-CLOSED in production:
       // when unset, this defaults ON in any production runtime (NODE_ENV or
       // VERCEL_ENV = "production") and OFF everywhere else (dev/test/preview seeding
-      // window). withTenantDb always sets the scope GUCs; when this resolves false
-      // it additionally sets app.rls_bypass='on' so the bypass-aware policies do not
-      // yet filter (isolation still enforced by the manual eq(orgId) predicates kept
-      // in every query). An operator can still force it OFF in production with an
+      // window). It no longer changes what the policies filter: no policy reads
+      // app.rls_bypass, and withTenantDb sets the scope GUCs either way
+      // (ADR-5879). When true, assertRlsConnectionSafe refuses to start on a
+      // connection role that is a superuser, has BYPASSRLS, or inherits
+      // oxagen_system. An operator can still force it OFF in production with an
       // explicit "false", but the startup guard (assertRlsEnforcedInProduction)
-      // refuses to boot in that state — a production process may not run unscoped.
-      // Reversible via env (no migration needed).
+      // refuses to boot in that state.
       TENANT_RLS_ENFORCEMENT_ENABLED: external_exports.union([external_exports.literal("true"), external_exports.literal("false")]).optional().transform((v) => v === void 0 ? isProductionRuntime() : v === "true"),
       // ── Billing / usage-meter tuning (see @oxagen/billing pricing.ts) ──
       // Target *blended* gross margin across all products, in (0,1). When set,
@@ -126495,7 +127277,7 @@ function withServers(entry2, outcome) {
   };
 }
 function nextTurn() {
-  return new Promise((resolve22) => setImmediate(resolve22));
+  return new Promise((resolve23) => setImmediate(resolve23));
 }
 async function runChecksWithServers(input, options = {}) {
   const done = [];
@@ -127862,7 +128644,7 @@ import {
   readlinkSync as readlinkSync4,
   statSync as statSync13
 } from "node:fs";
-import { dirname as dirname31, isAbsolute as isAbsolute14, join as join55, relative as relative8, resolve as resolve21, sep as sep10 } from "node:path";
+import { dirname as dirname31, isAbsolute as isAbsolute15, join as join56, relative as relative9, resolve as resolve22, sep as sep11 } from "node:path";
 function git5(cwd, args, input) {
   try {
     return execFileSync2("git", args, {
@@ -127894,7 +128676,7 @@ function commitOf2(root, ref2) {
   return sha2.length > 0 ? sha2 : null;
 }
 function readWorkingFile(root, path2) {
-  const abs = join55(root, ...path2.split("/"));
+  const abs = join56(root, ...path2.split("/"));
   try {
     const stat7 = lstatSync11(abs);
     if (stat7.isSymbolicLink()) return readlinkSync4(abs, "utf8");
@@ -127986,9 +128768,9 @@ function isDir(path2) {
   }
 }
 function findSteeringRoot(start) {
-  let dir = resolve21(start);
+  let dir = resolve22(start);
   for (; ; ) {
-    if (isFile(join55(dir, WORKSPACE_TOML_PATH)) || isFile(join55(dir, AGENTS_MD_PATH)) && isDir(join55(dir, STEERING_DIR))) {
+    if (isFile(join56(dir, WORKSPACE_TOML_PATH)) || isFile(join56(dir, AGENTS_MD_PATH)) && isDir(join56(dir, STEERING_DIR))) {
       return dir;
     }
     const parent = dirname31(dir);
@@ -128002,11 +128784,11 @@ function within3(path2, scope) {
 function scopesFor(root, cwd, paths, trees) {
   const scopes = [];
   for (const path2 of paths) {
-    const rel = relative8(root, resolve21(cwd, path2));
-    if (rel === ".." || rel.startsWith(`..${sep10}`) || isAbsolute14(rel)) {
+    const rel = relative9(root, resolve22(cwd, path2));
+    if (rel === ".." || rel.startsWith(`..${sep11}`) || isAbsolute15(rel)) {
       return { error: `${path2} is outside the steering repo at ${root}.` };
     }
-    const scope = rel.split(sep10).join("/");
+    const scope = rel.split(sep11).join("/");
     const known = trees.some(
       (tree) => tree !== null && [...tree.keys()].some((file) => within3(file, scope))
     );
@@ -128068,7 +128850,7 @@ function cacheFile(cacheDir, root) {
     key: token === void 0 ? null : createHash20("sha256").update(token).digest("hex").slice(0, 16)
   };
   const key = createHash20("sha256").update(JSON.stringify([root, identity])).digest("hex").slice(0, 32);
-  return join55(cacheDir, `${key}.json`);
+  return join56(cacheDir, `${key}.json`);
 }
 function readCache(file, now) {
   let entry2;
@@ -128182,7 +128964,7 @@ function defaultDeps2() {
   return {
     fetchPublished: fetchSteeringIndex,
     cedar: cedarHooks,
-    cacheDir: join55(getConfigDir(), "cache", "steering-check"),
+    cacheDir: join56(getConfigDir(), "cache", "steering-check"),
     now: () => Date.now()
   };
 }
@@ -129880,7 +130662,13 @@ var init_revision = __esm({
       /** Each repo's exact revision, by `owner/name`. */
       repoRevisions: external_exports.record(external_exports.string().min(1), revisionIdSchema).refine((r) => Object.keys(r).length > 0, "lists no repo revision"),
       /** The ID of the cross-repo link file built from those revisions. */
-      crossRepoFile: digestSchema2
+      crossRepoFile: digestSchema2,
+      /**
+       * The ID of the nodes a linker recheck put back in the review queue, when
+       * there are any. The specs file reads them, so a change makes a new
+       * revision (ADR-371). Left out when there are none.
+       */
+      recheckMismatches: digestSchema2.optional()
     }).strict();
   }
 });
@@ -130259,10 +131047,17 @@ var init_calls = __esm({
           status: requirementStatusSchema,
           reason: external_exports.string().min(1).optional(),
           code: external_exports.array(graphItemSchema),
+          // Each test that proves the requirement, with the result CI
+          // reported for the commit of its repo's revision. `none` means no
+          // report at that commit. `provenance` says whether a citation
+          // (`declared`) or a linker agent (`agent`) gave the VERIFIES edge.
           tests: external_exports.array(
             testRefSchema.extend({
+              repo: external_exports.string().min(1).optional(),
+              provenance: provenanceKindSchema.optional(),
               lastResult: external_exports.enum(TEST_RESULTS),
-              commit: external_exports.string().min(7).optional()
+              commit: external_exports.string().min(7).optional(),
+              lastPassedCommit: external_exports.string().min(7).optional()
             }).strict()
           )
         }).strict()
@@ -132052,23 +132847,23 @@ var init_src9 = __esm({
 
 // src/commands/codegraph-upload/files.ts
 import { readdir as readdir5, stat as stat5 } from "node:fs/promises";
-import { join as join56, relative as relative9, sep as sep11 } from "node:path";
+import { join as join57, relative as relative10, sep as sep12 } from "node:path";
 function hasGlobChars(pattern) {
   return /[*?[\]{}]/.test(pattern);
 }
 function normalize2(path2) {
   const trimmed = path2.replace(/^\.\//, "");
-  return sep11 === "/" ? trimmed : trimmed.split(sep11).join("/");
+  return sep12 === "/" ? trimmed : trimmed.split(sep12).join("/");
 }
 async function walk(root, dir, out) {
   const entries2 = await readdir5(dir, { withFileTypes: true });
   for (const entry2 of entries2) {
     if (entry2.isSymbolicLink()) continue;
-    const full = join56(dir, entry2.name);
+    const full = join57(dir, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIP_DIRS.has(entry2.name)) await walk(root, full, out);
     } else if (entry2.isFile()) {
-      out.push(normalize2(relative9(root, full)));
+      out.push(normalize2(relative10(root, full)));
     }
   }
 }
@@ -132076,7 +132871,7 @@ async function expandPattern(root, pattern) {
   const wanted = normalize2(pattern.trim());
   if (!hasGlobChars(wanted)) {
     try {
-      const info = await stat5(join56(root, wanted));
+      const info = await stat5(join57(root, wanted));
       return info.isFile() ? [wanted] : [];
     } catch {
       return [];
@@ -132227,7 +133022,7 @@ var init_token = __esm({
 });
 
 // src/commands/codegraph-upload/run.ts
-import { join as join57 } from "node:path";
+import { join as join58 } from "node:path";
 function addDropped(into, more) {
   into.sensitiveValues += more.sensitiveValues;
   into.secretData += more.secretData;
@@ -132245,7 +133040,7 @@ async function uploadOne(deps, config, token, group, path2, totals2) {
   const label2 = `${group.kind}/${group.source} ${path2}`;
   let bytes;
   try {
-    bytes = await deps.readFile(join57(deps.cwd, path2));
+    bytes = await deps.readFile(join58(deps.cwd, path2));
   } catch (error) {
     totals2.failed += 1;
     deps.log(`error: ${label2}: cannot read the file: ${error.message}`);
@@ -132523,7 +133318,7 @@ Following ${file} (Ctrl-C to stop)\u2026
       draining = false;
     }
   };
-  await new Promise((resolve22) => {
+  await new Promise((resolve23) => {
     let watcher = null;
     try {
       watcher = watch(file, { persistent: true }, () => void drain());
@@ -132532,12 +133327,12 @@ Following ${file} (Ctrl-C to stop)\u2026
         `Cannot follow ${file}: ${err2 instanceof Error ? err2.message : String(err2)}
 `
       );
-      resolve22();
+      resolve23();
       return;
     }
     const stop = () => {
       watcher?.close();
-      resolve22();
+      resolve23();
     };
     process.on("SIGINT", stop);
     process.on("SIGTERM", stop);
@@ -132874,7 +133669,7 @@ async function browserLogin({
   server.keepAliveTimeout = 1e3;
   server.headersTimeout = 5e3;
   server.requestTimeout = 15e3;
-  const port = await new Promise((resolve22, reject) => {
+  const port = await new Promise((resolve23, reject) => {
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       const addr = server.address();
@@ -132884,7 +133679,7 @@ async function browserLogin({
         );
         return;
       }
-      resolve22(addr.port);
+      resolve23(addr.port);
     });
   });
   const redirectUri = `http://127.0.0.1:${port}/callback`;
@@ -132904,7 +133699,7 @@ async function browserLogin({
   ${authorizeUrl}`);
   openBrowser(authorizeUrl);
   return new Promise(
-    (resolve22, reject) => {
+    (resolve23, reject) => {
       let settled2 = false;
       const exchangeAbort = new AbortController();
       const shutdown = () => {
@@ -133037,7 +133832,7 @@ async function browserLogin({
             }
             const data = asTokenExchangeResponse(await exchangeRes.json());
             await sendRedirect(cliLoginCompleteUrl(appUrl));
-            closeAndSettle(() => resolve22(data));
+            closeAndSettle(() => resolve23(data));
           } catch (err2) {
             const msg = err2 instanceof Error ? err2.message : String(err2);
             try {