@rosthq/cli 0.7.23 → 0.7.25

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EA2N3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EA4N3D,CAAC"}

package/dist/generator/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/generator/render.ts"],"names":[],"mappings":"AAeA,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAGpD;AAiBD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAiB7D;AAgCD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAgD3D"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/generator/render.ts"],"names":[],"mappings":"AAeA,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAGpD;AA8DD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAuB7D;AAgCD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAgD3D"}

package/dist/index.js

@@ -37718,6 +37718,19 @@ var dryRunToolActionSchema = external_exports.object({
   // The underlying manifest guard decision that produced `status`.
   guard: dryRunGuardResultSchema
 }).strict();
+var dryRunLaneSchema = external_exports.enum(["cloud", "mcp_session", "runner"]);
+var dryRunToolExecutabilitySchema = external_exports.enum([
+  "executable",
+  "unimplemented_in_lane",
+  "held_for_steward"
+]);
+var dryRunGrantedToolSchema = external_exports.object({
+  // The granted tool (manifest id).
+  tool_name: external_exports.string().min(1),
+  // Its lane-aware executability, derived from the agent's lane + the runtime
+  // handler registry (never an id string pattern).
+  executability: dryRunToolExecutabilitySchema
+}).strict();
 var dryRunTranscriptSchema = external_exports.object({
   // Whether the rehearsal passed (the must-escalate clause was escalated and no
   // external side effect ran) or failed (it acted without escalating, or the run
@@ -37736,6 +37749,14 @@ var dryRunTranscriptSchema = external_exports.object({
   // handlers. Optional so the field is additive — a transcript without it (the
   // static demo replay, an older record) still validates.
   tool_preview: external_exports.array(dryRunToolActionSchema).optional(),
+  // DER-1294: the runtime lane this rehearsal reflects. Optional/additive —
+  // transcripts recorded before DER-1294 (and the static public-demo replay)
+  // omit it, so they still validate.
+  lane: dryRunLaneSchema.optional(),
+  // DER-1294: every GRANTED tool (manifest allow|escalate) with its lane-aware
+  // executability, so an operator sees which grants actually run vs. silently
+  // no-op in this lane. Optional/additive so older transcripts still validate.
+  granted_tools: external_exports.array(dryRunGrantedToolSchema).optional(),
   // The underlying run id (present once the run is recorded).
   run_id: external_exports.string().min(1).optional()
 }).strict();
@@ -42665,6 +42686,25 @@ var softwarePlanDecisionOutputSchema = external_exports.object({
   decision_id: uuid10,
   current_phase: softwarePhaseSchema
 });
+var forgeConformanceFindingInput = external_exports.object({
+  severity: softwareConformanceSeveritySchema,
+  category: softwareConformanceCategorySchema.default("other"),
+  summary: external_exports.string().trim().min(1).max(2e3),
+  detail: external_exports.string().trim().min(1).max(8e3).optional(),
+  changeset_id: uuid10.optional(),
+  plan_version_id: uuid10.optional()
+}).strict();
+var softwareConformanceRecordFindingsInputSchema = external_exports.object({
+  build_request_id: uuid10,
+  phase_run_id: uuid10.optional(),
+  findings: external_exports.array(forgeConformanceFindingInput).min(1).max(50)
+}).strict();
+var softwareConformanceRecordFindingsOutputSchema = external_exports.object({
+  build_request_id: uuid10,
+  recorded_count: external_exports.number().int(),
+  finding_ids: external_exports.array(uuid10),
+  open_finding_count: external_exports.number().int()
+}).strict();
 var softwareAuthorityProfileListInputSchema = external_exports.object({
   software_project_id: uuid10.nullable().optional()
 }).strict();
@@ -44056,7 +44096,7 @@ Treat AICOS as a coordinator over the operating system. It can become more usefu
     order: 20,
     title: "Responsibility Graph playbook",
     summary: "How to build a functions-first graph with seats, owners, Stewards, vacancies, and clean authority.",
-    version: "2026-07-04.2",
+    version: "2026-07-04.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "staffing"],
@@ -44114,6 +44154,10 @@ The graph is also where you land after onboarding \u2014 it is the mission contr
 
 The graph also carries a mission-control panel. It pulls the same operational state visible on the agent and setup-health surfaces: held actions that need steward decisions, failed runs, open Friction, pending Signal readings, stale agents, and setup recommendations. Each item can focus the affected seat on the canvas and links to the route where the operator can act.
 
+## An agent seat's profile
+
+A staffed agent's seat page opens on a profile built to answer one question in ten seconds: what is this agent, what does it know, what can it touch, and who is accountable. The hero shows live/paused/draft status, a one-line description, and when it last ran; a right-hand fact sheet stays visible on every tab with the Charter version, Skills, Connections (with a "connect" prompt when a Skill needs a provider that is not yet linked), an Access summary, and tool/held/model counts. Four tabs organize the rest: **Overview** (recent runs as one-line summaries, 30-day cost by model, and a version-history feed that tracks the agent itself as an actor alongside human Charter decisions), **Charter** (the accepted Charter rendered as a document \u2014 purpose, responsibilities, owned measurables, decision authority \u2014 with its version chip, signer, and an Amend action that opens the same draft-and-confirm amendment flow as the Charter Builder), **Access** (plain-language cards for what the agent does while you are watching versus running unattended, then every granted tool grouped under its Connection with a one-line description and Read/Draft/Held status), and **Activity** (the full Trust Card below). AICOS's seat keeps its own operations panel instead of this profile, because it is the company's foundation seat rather than a generic staffed agent.
+
 ## Review an agent seat's delivered work
 
 Agent seat pages show the operator-facing output trail, not just low-level run telemetry. The completed work area combines explicit \`agent_deliverables\`, successful \`work.log\` evidence, and recent successful run summaries into one readable list. Each item shows what was delivered, when it happened, what kind of work it was, and safe evidence links labelled as internal, Linear, GitHub, or external. Secret-shaped values are redacted before display, and run or task context is shown only when it belongs to the same seat.
@@ -44427,7 +44471,7 @@ For CLI and MCP setup, read agent-skill-setup-guide before adding or assigning S
     order: 42,
     title: "Design a custom agent",
     summary: "How to build a custom agent from operational questions through the Charter Builder, tools, dry run, and go-live without writing prompts.",
-    version: "2026-06-21.1",
+    version: "2026-07-04.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "charter_design"],
@@ -44494,7 +44538,7 @@ The same path is command-backed:
 
 ## Dry run and go-live
 
-The dry run is a real sandbox rehearsal, not a stamp. It executes a mock-provider run derived from the Charter \u2014 the agent works against sandbox data only and is expected to escalate where the Charter's must-escalate clause requires it. The same rehearsal works on all three lanes: cloud, external MCP, and local Runner. External MCP dry runs require an active seat-scoped MCP token; Runner dry runs require a paired Runner. Missing substrate returns a typed precondition error, not a generic failure. The recorded run keeps the agent's actual lane, so the evidence you review matches the lane you selected. The result is earned: a run that escalates the must-escalate boundary passes; a run that acts on that boundary instead of escalating fails. A failed dry run keeps the draft and shows the reason so you can edit and rerun. The rehearsal returns a transcript \u2014 the steps the agent took and the escalation it raised \u2014 shown step by step in the builder and printed by the CLI, so you can see the governance model working before anything goes live. When the dry run passes, a human promotes the agent live. The dry run rehearses the specific model tier you chose, so once it passes the model is locked \u2014 changing the model requires re-running the dry run on the new model before go-live.
+The dry run is a real sandbox rehearsal, not a stamp. It executes a mock-provider run derived from the Charter \u2014 the agent works against sandbox data only and is expected to escalate where the Charter's must-escalate clause requires it. The same rehearsal works on all three lanes: cloud, external MCP, and local Runner. External MCP dry runs require an active seat-scoped MCP token; Runner dry runs require a paired Runner. Missing substrate returns a typed precondition error, not a generic failure. The recorded run keeps the agent's actual lane, so the evidence you review matches the lane you selected. The result is earned: a run that escalates the must-escalate boundary passes; a run that acts on that boundary instead of escalating fails. A failed dry run keeps the draft and shows the reason so you can edit and rerun. The rehearsal returns a transcript \u2014 the steps the agent took and the escalation it raised \u2014 shown step by step in the builder and printed by the CLI, so you can see the governance model working before anything goes live. The transcript is also lane-honest: each granted tool is marked executable, held for the steward, or granted but unimplemented in this lane, with a plain-count verdict such as "2 of 6 granted tools don't execute in the cloud lane yet" \u2014 so a grant that would silently no-op in the cloud runtime is visible before go-live instead of passing green. Runner and MCP-session agents run those tools through their own local skills, so their grants are not flagged as unimplemented. When the dry run passes, a human promotes the agent live. The dry run rehearses the specific model tier you chose, so once it passes the model is locked \u2014 changing the model requires re-running the dry run on the new model before go-live.
 
 ## When to stop for confirmation
 
@@ -44837,7 +44881,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-04.15",
+    version: "2026-07-04.16",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -45564,6 +45608,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_answer_forge_plan_clarifications\` | \`software_factory.request.answer_clarification\` | Write structured human answers to a draft plan's clarifying questions and optionally mark it ready for plan review; answers append to the versioned planning artifact and never widen authority or automation mode. | Tenant | Call with \`{"build_request_id":"<request-id>","answers":[{"question":"Which database?","answer":"Postgres"}],"mark_ready_for_plan_review":true}\`. |
 | \`rost_approve_a_forge_plan\` | \`software_factory.plan.approve\` | A human approves the current plan at the plan_review gate; records a human decision and advances the request to implementation. Owner-only and human-gated. | Tenant-admin | Call with \`{"build_request_id":"<request-id>"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_reject_a_forge_plan\` | \`software_factory.plan.reject\` | A human rejects the current plan (with a required rationale) and routes the request back to discovery/scoping for re-planning. Owner-only and human-gated. | Tenant-admin | Call with \`{"build_request_id":"<request-id>","rationale":"Scope too broad"}\`; non-interactive callers receive a confirmation handoff. |
+| \`rost_record_forge_conformance_findings\` | \`software_factory.conformance.record_findings\` | Record structured plan-conformance findings as reviewer evidence. Open findings route the request back to implementation; accepting a gap remains a separate human gate. | Tenant | Call with \`{"build_request_id":"<request-id>","findings":[{"severity":"major","category":"scope_gap","summary":"Missing migration verification"}]}\`. |
 | \`rost_list_forge_authority_profiles\` | \`software_factory.authority_profile.list\` | List the tenant's Forge authority profiles (seat capability presets, read-only by default). Read-only; requires the Forge add-on. | Tenant | Call with \`{}\`. |
 | \`rost_create_a_forge_authority_profile\` | \`software_factory.authority_profile.create\` | Define a Forge authority profile (a named seat capability preset). Owner-only; defaults to the read_only preset. | Tenant-admin | Call with \`{"name":"Builder","preset":"contributor"}\`. |
 | \`rost_grant_forge_seat_authority\` | \`software_factory.authority.grant\` | Grant a seat a Forge authority profile on a project (seat \u2192 project \u2192 profile). Owner-only and human-gated; emits a durable authority-change event. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","seat_id":"<seat-id>","authority_profile_id":"<profile-id>"}\`; non-interactive callers receive a confirmation handoff. |
@@ -46065,7 +46110,7 @@ Retrieve the narrowest relevant guide before making a setup recommendation. Pref
     order: 60,
     title: "Cascade guide",
     summary: "How to connect company goals to seat-level work without turning {{brand}} into a project-management tool.",
-    version: "2026-07-04.1",
+    version: "2026-07-04.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -46133,7 +46178,7 @@ Cascade warnings are advisory, not blockers. They point to setup that should be
 - Agent goal missing human accountability parent: an agent-owned goal has no human or hybrid goal in its ancestry.
 - Orphaned goal branch: the owner seat or parent chain no longer reaches an active Compass objective.
 
-On \`/cascade\`, the screen renders the full goal depth, not just one or two levels. Off-track descendant branches stay open so the operator can see why a parent rolled up to risk.
+\`/cascade\` leads with one computed line \u2014 how many goals are off pace this cycle, or an all-clear when none are. Off-pace and off-track goals stay fully visible with their owner seat and pace context; goals confirmed on pace collapse into a per-branch count you can expand. Creating or editing a goal opens the same drawer from a single **New goal** action or a goal's own edit control \u2014 there is no separate persistent form.
 
 ## Goal progress and at-risk goals
 
@@ -46280,7 +46325,7 @@ Agents may record readings when the Charter allows it. Agent-reported readings s
     order: 62,
     title: "Friction guide",
     summary: "How to capture issues with evidence, rank them, and resolve them without losing ownership.",
-    version: "2026-07-01.2",
+    version: "2026-07-04.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -46332,6 +46377,8 @@ Agents should file Friction when a measurable breaks, a tool fails, a repeated e
 
 In the app, operational evidence is summarized for humans instead of shown as the primary interface. Incident fields, proposed tool calls, schedules, payload labels, and source links render as readable fields with raw details tucked behind supporting context when useful. Secret-shaped values stay redacted.
 
+The Friction page opens with one computed line \u2014 how many issues are open, the oldest one's age, and how many are escalated \u2014 followed by the open issues themselves as incident-ticket rows (filer, one-line cause, an escalation chip naming the steward when severity is critical). Resolved issues collapse into a single count that expands into a quiet history list. Filing a new issue and the three-step resolution (root cause, owner task, done-by) both live behind one "File friction" action, which opens a drawer; resolving launches that same drawer already seeded from the row you clicked "Resolve" on.
+
 ## Operate Friction, tasks, and escalations from CLI or MCP
 
 Friction, tasks, and escalations are the issue-to-action loop. A seat files, a task carries the work, and an escalation routes a decision a seat cannot make alone.
@@ -48765,6 +48812,7 @@ var COMMAND_MANIFEST = [
   { "id": "software_factory.capacity.list", "namespace": "software_factory", "action": "capacity.list", "title": "List Forge runner capacity", "description": "List the tenant's Forge runner capacity observations (OS, CPU, memory, active sessions, usage-limit telemetry). Advisory scheduling input only, never an authority input. Read-only, entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "runner_id", "flag": "runner-id", "type": "string", "required": false }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List Forge runner capacity observations (advisory scheduling input only, never an authority input). Read-only; requires the Forge add-on." },
   { "id": "software_factory.config.list", "namespace": "software_factory", "action": "config.list", "title": "List Forge config", "description": "List active Forge config metadata for project environments. Plain config values may be returned; secret refs are represented only as has_secret_ref.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "environment", "flag": "environment", "type": "enum", "required": false, "enumValues": ["development", "preview", "production"] }], "hasComplexInput": false, "help": "List active Forge config entries. Plain config may be shown; secret refs are represented only as metadata." },
   { "id": "software_factory.config.set", "namespace": "software_factory", "action": "config.set", "title": "Set Forge config", "description": "Create or rotate a Forge project config entry. Secret config stores only a vault ref pointer; raw values are never accepted for secret_ref entries.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "environment", "flag": "environment", "type": "enum", "required": true, "enumValues": ["development", "preview", "production"] }, { "name": "key_name", "flag": "key-name", "type": "string", "required": true }, { "name": "value_kind", "flag": "value-kind", "type": "enum", "required": true, "enumValues": ["plain", "secret_ref"] }, { "name": "plain_value", "flag": "plain-value", "type": "string", "required": false }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": false }], "hasComplexInput": false, "help": "Set or rotate a Forge project config key. Secret entries store only vault refs and are human-gated." },
+  { "id": "software_factory.conformance.record_findings", "namespace": "software_factory", "action": "conformance.record_findings", "title": "Record Forge conformance findings", "description": "The plan-conformance reviewer records one or more findings against a build request; open findings route the request back to implementation. Recording is evidence, not a decision \u2014 accepting a gap is a separate human gate. Requires the Forge add-on.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "phase_run_id", "flag": "phase-run-id", "type": "string", "required": false }], "hasComplexInput": true, "help": "Record structured Forge plan-conformance findings as reviewer evidence. Open findings route the request back to implementation; accepting a gap remains a separate human gate." },
   { "id": "software_factory.developer_team.install", "namespace": "software_factory", "action": "developer_team.install", "title": "Install Forge Developer Team", "description": "Install AND activate the governed Forge Developer Team: 7 seats (1 human lead + 6 agents), first-party skills, authority presets, and a conservative token budget. Approving this ACTIVATES the 6 agents as live occupancies at a pr_only, observe-first posture: they open pull requests but never merge or deploy without a human. Entitlement-gated and human-confirmed.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": true }, { "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "assign_skills", "flag": "assign-skills", "type": "boolean", "required": false }, { "name": "acknowledge_autonomy_ceiling", "flag": "acknowledge-autonomy-ceiling", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Install the governed Forge Developer Team template with seats, draft Charters, skills, project authority grants, and audit records. Tenant-admin and human-gated; creates no live agent occupancy." },
   { "id": "software_factory.gate.decide", "namespace": "software_factory", "action": "gate.decide", "title": "Decide a Forge gate", "description": "A human approves or rejects a Forge gate. The resolver is recorded (never an agent \u2014 invariant #7); sensitive gates (security sign-off, merge/deploy, authority change, production deploy) also write a linked human decision. Requires confirmation.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "gate_id", "flag": "gate-id", "type": "string", "required": true }, { "name": "decision", "flag": "decision", "type": "enum", "required": true, "enumValues": ["approve", "reject"] }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human approves or rejects a Forge gate; an agent caller routes to /approvals and can never self-approve. Sensitive gates record a human decision." },
   { "id": "software_factory.github.installation_token.create", "namespace": "software_factory", "action": "github.installation_token.create", "title": "Create a Forge GitHub installation token", "description": "Mint a short-lived GitHub App installation token for one bound repository after server-side policy evaluation. The token is returned once and never persisted.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "repository_id", "flag": "repository-id", "type": "integer", "required": true }, { "name": "requested_actions", "flag": "requested-actions", "type": "array", "required": true, "itemType": "string" }, { "name": "requested_automation_mode", "flag": "requested-automation-mode", "type": "enum", "required": false, "enumValues": ["plan_only", "pr_only", "merge_after_checks", "deploy_preview", "deploy_production"] }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Mint a short-lived GitHub App installation token for one bound repository after policy evaluation; token material is returned once and never stored." },
@@ -49088,6 +49136,36 @@ function dryRunToolActionLabel(status) {
       return status;
   }
 }
+var DRY_RUN_LANE_LABELS = {
+  cloud: "cloud lane",
+  runner: "runner lane",
+  mcp_session: "MCP-session lane"
+};
+function dryRunLaneLabel(lane) {
+  return DRY_RUN_LANE_LABELS[lane] ?? `${lane} lane`;
+}
+function dryRunLaneVerdict(lane, grantedCount, unimplementedCount) {
+  const laneLabel = dryRunLaneLabel(lane);
+  if (unimplementedCount === 0) {
+    return grantedCount === 1 ? `The single granted tool is implemented in the ${laneLabel}.` : `All ${grantedCount} granted tools are implemented in the ${laneLabel}.`;
+  }
+  const verb = unimplementedCount === 1 ? "doesn't" : "don't";
+  return `${unimplementedCount} of ${grantedCount} granted tools ${verb} execute in the ${laneLabel} yet.`;
+}
+function dryRunLaneExecutabilityLines(transcript) {
+  const lane = transcript.lane;
+  const grantedTools = asArray(transcript.granted_tools);
+  if (typeof lane !== "string" || grantedTools.length === 0) {
+    return [];
+  }
+  const laneLabel = dryRunLaneLabel(lane);
+  const unimplemented = grantedTools.map((tool) => asRecord(tool)).filter((tool) => tool.executability === "unimplemented_in_lane");
+  const warningLines = unimplemented.map(
+    (tool) => `  warning: ${field(tool, "tool_name")} is granted but unimplemented in the ${laneLabel}`
+  );
+  const verdict = dryRunLaneVerdict(lane, grantedTools.length, unimplemented.length);
+  return ["lane executability:", ...warningLines, `  verdict: ${verdict}`];
+}
 function formatDryRunTranscript(value) {
   const transcript = asRecord(value);
   const steps = asArray(transcript.steps);
@@ -49104,7 +49182,13 @@ function formatDryRunTranscript(value) {
     const record2 = asRecord(action);
     return `  ${dryRunToolActionLabel(field(record2, "status"))}: ${field(record2, "intended_action")} [${field(record2, "tool_name")}]`;
   });
-  return ["rehearsal:", ...lines, ...toolPreview.length > 0 ? ["tool preview:", ...toolPreview] : []].join("\n");
+  const laneLines = dryRunLaneExecutabilityLines(transcript);
+  return [
+    "rehearsal:",
+    ...lines,
+    ...toolPreview.length > 0 ? ["tool preview:", ...toolPreview] : [],
+    ...laneLines
+  ].join("\n");
 }
 function isScalar(value) {
   return value === null || ["string", "number", "boolean"].includes(typeof value);