@rosthq/cli 0.7.94 → 0.7.96

package/dist/index.js

@@ -41569,6 +41569,7 @@ var compassImportOutputSchema = external_exports.object({
   citations: external_exports.number().int().nonnegative()
 }).strict();
 var goalStatusSchema = external_exports.enum(["on", "off", "done", "dropped"]);
+var goalStatusSourceSchema = external_exports.enum(["human", "agent", "rollup", "signal"]);
 var goalListInputSchema = external_exports.object({
   cycle_id: uuidSchema9.optional(),
   seat_id: uuidSchema9.optional()
@@ -41584,7 +41585,7 @@ var goalSummarySchema = external_exports.object({
   parent_goal_id: uuidSchema9.nullable(),
   title: external_exports.string(),
   status: goalStatusSchema,
-  status_source: external_exports.enum(["human", "agent", "rollup"])
+  status_source: goalStatusSourceSchema
 }).strict();
 var goalListOutputSchema = external_exports.object({
   goals: external_exports.array(goalSummarySchema)
@@ -41604,7 +41605,7 @@ var goalMutationOutputSchema = external_exports.object({
   parent_goal_id: uuidSchema9.nullable(),
   title: external_exports.string(),
   status: goalStatusSchema,
-  status_source: external_exports.enum(["human", "agent", "rollup"])
+  status_source: goalStatusSourceSchema
 }).strict();
 var goalUpdateInputSchema = external_exports.object({
   goal_id: uuidSchema9,
@@ -41655,7 +41656,6 @@ var goalListAtRiskOutputSchema = external_exports.object({
   goals: external_exports.array(goalAtRiskSchema)
 }).strict();
 var goalSignalStateSchema = external_exports.enum(["ok", "risk", "crit", "pending"]);
-var goalStatusSourceSchema = external_exports.enum(["human", "agent", "rollup", "signal"]);
 var goalMeasurableRoleSchema = external_exports.enum(["drives_status", "informs"]);
 var goalDriverAnchorSchema = external_exports.object({
   // The closed period being anchored on (an ISO date / period label — free-form so a
@@ -43438,7 +43438,11 @@ var fleetDigestAgentSchema = fleetOverviewRowSchema.extend({
   spend_7d_usd: external_exports.string(),
   spend_30d_usd: external_exports.string(),
   cost_drift_percent: external_exports.number().int().nullable(),
-  health_status: external_exports.enum(["needs_review", "stale", "setup_gap", "awaiting_data", "awaiting_data_overdue", "healthy"]),
+  // DER-1905: "idle" added — cadence-aware grading now distinguishes an
+  // on-demand agent with nothing pending (idle, neutral) from a scheduled
+  // agent that missed its cron (stale, alarming). Purely additive to this
+  // enum; no other field on this schema changed.
+  health_status: external_exports.enum(["needs_review", "stale", "idle", "setup_gap", "awaiting_data", "awaiting_data_overdue", "healthy"]),
   health_reasons: external_exports.array(external_exports.string()),
   recent_failed_runs: external_exports.array(fleetDigestRunSchema),
   unresolved_errors: external_exports.array(fleetDigestErrorSchema),
@@ -43509,8 +43513,11 @@ var seatRunDetailSchema = seatRunSchema.extend({
   task_id: uuidSchema14.nullable(),
   work_order_id: uuidSchema14.nullable(),
   transcript_ref: external_exports.string(),
-  input_tokens: external_exports.number().int().nonnegative(),
-  output_tokens: external_exports.number().int().nonnegative(),
+  // DER-1913: null = usage UNKNOWN — a Codex / read-status / timeout / spawn-error
+  // runner turn reports no model-usage envelope, so the run records no token count.
+  // Never coerced to a fabricated 0; surfaces (CLI/MCP/UI) render it as unknown.
+  input_tokens: external_exports.number().int().nonnegative().nullable(),
+  output_tokens: external_exports.number().int().nonnegative().nullable(),
   outcome: external_exports.record(external_exports.string(), external_exports.unknown()),
   error_logs: external_exports.array(seatRunErrorLogSchema),
   skill_activations: external_exports.array(external_exports.object({
@@ -44829,8 +44836,44 @@ var secretGrantListOutputSchema = external_exports.object({
   grants: external_exports.array(secretGrantSummarySchema)
 }).strict();
 
-// ../../packages/protocol/src/software-factory.ts
+// ../../packages/protocol/src/gate.ts
 var uuid11 = external_exports.string().uuid();
+var gateDecisionSchema = external_exports.enum(["approve", "reject"]);
+var gateSubjectKindSchema = external_exports.enum(["prototype", "deliverable", "artifact"]);
+var gateDecideInputSchema = external_exports.object({
+  subject_kind: gateSubjectKindSchema,
+  subject_id: uuid11,
+  artifact_ref: external_exports.object({
+    // The deep link to the artifact (a prototype URL). Agent-supplied and rendered as a
+    // clickable link in the operator's Home band, so it is constrained to an http(s)
+    // URL or a relative in-app path — a `javascript:`/`data:` href would be a
+    // stored-XSS-via-link vector (conservative-by-default, invariant #10).
+    href: external_exports.string().min(1).max(2048).refine(
+      (value) => value.startsWith("/") || /^https?:\/\//i.test(value),
+      "href must be a relative path or an http(s) URL"
+    ),
+    label: external_exports.string().min(1).max(200)
+  }).strict(),
+  // The digest the gate is bound to. On approval the current artifact digest must
+  // still match (a changed artifact is a stale gate — re-draft required).
+  artifact_digest: external_exports.string().min(1).max(200),
+  decision: gateDecisionSchema,
+  ask: external_exports.string().min(1).max(400),
+  consequence: external_exports.string().min(1).max(600),
+  unblocked_targets: external_exports.array(external_exports.string().min(1).max(200)).max(20).default([]),
+  rationale: external_exports.string().max(4e3).optional()
+}).strict();
+var gateDecideOutputSchema = external_exports.object({
+  decision_id: uuid11.nullable(),
+  subject_id: uuid11,
+  artifact_digest: external_exports.string(),
+  decision: gateDecisionSchema,
+  decided_by: uuid11,
+  gate_status: external_exports.enum(["approved", "rejected"])
+});
+
+// ../../packages/protocol/src/software-factory.ts
+var uuid12 = external_exports.string().uuid();
 var SOFTWARE_PHASE_VALUES = [
   "intake",
   "discovery_scoping",
@@ -44941,7 +44984,7 @@ var softwareConfigValueKindSchema = external_exports.enum(["plain", "secret_ref"
 var softwareCredentialRequestStatusSchema = external_exports.enum(["pending", "fulfilled", "rejected", "canceled"]);
 var softwareSecretAccessOperationSchema = external_exports.enum(["use", "vercel_env_sync", "test_execution"]);
 var softwareProjectSummarySchema = external_exports.object({
-  id: uuid11,
+  id: uuid12,
   name: external_exports.string().min(1),
   slug: external_exports.string().min(1),
   base_branch: external_exports.string().min(1),
@@ -44995,7 +45038,7 @@ var softwarePhaseSchedulerStateSchema = external_exports.object({
   ]).nullable(),
   message: external_exports.string(),
   remediation_href: external_exports.string().nullable(),
-  work_order_id: uuid11.nullable()
+  work_order_id: uuid12.nullable()
 });
 var softwareDispatchHoldReasonSchema = external_exports.enum([
   "dependency",
@@ -45019,7 +45062,7 @@ var softwareDispatchPreviewRunnerRequirementSchema = external_exports.object({
 }).strict();
 var softwareDispatchPreviewItemSchema = external_exports.object({
   kind: external_exports.enum(["changeset", "task"]),
-  id: uuid11,
+  id: uuid12,
   ordinal: external_exports.number().int().positive(),
   title: external_exports.string(),
   changeset_ordinal: external_exports.number().int().positive().nullable(),
@@ -45046,7 +45089,7 @@ var softwareTouchSetCollisionSchema = external_exports.object({
   overlap: external_exports.array(external_exports.string()).min(1)
 }).strict();
 var softwareCrossRequestCollisionGroupSchema = external_exports.object({
-  software_project_id: uuid11,
+  software_project_id: uuid12,
   requests: external_exports.array(softwareTouchSetRefSchema),
   collisions: external_exports.array(softwareTouchSetCollisionSchema),
   unknown: external_exports.array(softwareTouchSetRefSchema)
@@ -45080,8 +45123,8 @@ var softwareDispatchPreviewSchema = external_exports.object({
   grooming_reason: external_exports.string().nullable()
 }).strict();
 var softwareBuildRequestSummarySchema = external_exports.object({
-  id: uuid11,
-  software_project_id: uuid11,
+  id: uuid12,
+  software_project_id: uuid12,
   title: external_exports.string(),
   source_channel: softwareSourceChannelSchema,
   source_ref: external_exports.string().nullable(),
@@ -45097,7 +45140,7 @@ var softwareBuildRequestSummarySchema = external_exports.object({
   scheduler_state: softwarePhaseSchedulerStateSchema.nullable()
 });
 var softwarePhaseRunSummarySchema = external_exports.object({
-  id: uuid11,
+  id: uuid12,
   phase: softwarePhaseSchema,
   status: softwarePhaseRunStatusSchema,
   attempt_no: external_exports.number().int(),
@@ -45107,17 +45150,17 @@ var softwarePhaseRunSummarySchema = external_exports.object({
   scheduler_state: softwarePhaseSchedulerStateSchema.nullable()
 });
 var softwareGateSummarySchema = external_exports.object({
-  id: uuid11,
+  id: uuid12,
   gate_type: softwareGateTypeSchema,
   status: external_exports.enum(["pending", "approved", "rejected", "held"]),
-  phase_run_id: uuid11.nullable(),
-  resolved_by_user_id: uuid11.nullable(),
+  phase_run_id: uuid12.nullable(),
+  resolved_by_user_id: uuid12.nullable(),
   rationale: external_exports.string().nullable(),
   created_at: external_exports.string()
 });
 var softwareChangesetSummarySchema = external_exports.object({
-  id: uuid11,
-  build_request_id: uuid11,
+  id: uuid12,
+  build_request_id: uuid12,
   ordinal: external_exports.number().int(),
   title: external_exports.string(),
   split_criterion: softwareChangesetSplitCriterionSchema,
@@ -45131,10 +45174,10 @@ var softwareChangesetSummarySchema = external_exports.object({
   created_at: external_exports.string()
 });
 var softwareTaskSummarySchema = external_exports.object({
-  id: uuid11,
-  build_request_id: uuid11,
-  changeset_id: uuid11,
-  plan_version_id: uuid11,
+  id: uuid12,
+  build_request_id: uuid12,
+  changeset_id: uuid12,
+  plan_version_id: uuid12,
   ordinal: external_exports.number().int(),
   task_key: external_exports.string(),
   title: external_exports.string(),
@@ -45173,8 +45216,8 @@ var softwarePlanArtifactSummarySchema = external_exports.object({
   changesets: external_exports.array(softwarePlanArtifactChangesetSummarySchema).default([])
 });
 var softwarePlanVersionSummarySchema = external_exports.object({
-  id: uuid11,
-  build_request_id: uuid11,
+  id: uuid12,
+  build_request_id: uuid12,
   version_no: external_exports.number().int(),
   status: softwarePlanVersionStatusSchema,
   summary: external_exports.string().nullable(),
@@ -45185,37 +45228,37 @@ var softwarePlanVersionSummarySchema = external_exports.object({
     answer: external_exports.string()
   })).default([]),
   planning_artifact: softwarePlanArtifactSummarySchema.nullable(),
-  created_by_seat_id: uuid11.nullable(),
+  created_by_seat_id: uuid12.nullable(),
   created_at: external_exports.string()
 });
 var softwarePlanConformanceFindingSummarySchema = external_exports.object({
-  id: uuid11,
-  build_request_id: uuid11,
-  changeset_id: uuid11.nullable(),
-  phase_run_id: uuid11.nullable(),
-  plan_version_id: uuid11.nullable(),
+  id: uuid12,
+  build_request_id: uuid12,
+  changeset_id: uuid12.nullable(),
+  phase_run_id: uuid12.nullable(),
+  plan_version_id: uuid12.nullable(),
   severity: softwareConformanceSeveritySchema,
   category: softwareConformanceCategorySchema,
   summary: external_exports.string(),
   detail: external_exports.string().nullable(),
   status: softwareConformanceStatusSchema,
-  accepted_by_decision_id: uuid11.nullable(),
+  accepted_by_decision_id: uuid12.nullable(),
   resolved_at: external_exports.string().nullable(),
   created_at: external_exports.string()
 });
 var softwareAuthorityProfileSummarySchema = external_exports.object({
-  id: uuid11,
-  software_project_id: uuid11.nullable(),
+  id: uuid12,
+  software_project_id: uuid12.nullable(),
   name: external_exports.string(),
   preset: softwareAuthorityPresetSchema,
   is_default: external_exports.boolean(),
   created_at: external_exports.string()
 });
 var softwareSecretGrantSummarySchema = external_exports.object({
-  id: uuid11,
-  software_project_id: uuid11,
+  id: uuid12,
+  software_project_id: uuid12,
   environment: softwareEnvironmentSchema,
-  seat_id: uuid11,
+  seat_id: uuid12,
   action: external_exports.string(),
   key_name: external_exports.string(),
   vault_ref: external_exports.string(),
@@ -45224,8 +45267,8 @@ var softwareSecretGrantSummarySchema = external_exports.object({
   revoked_at: external_exports.string().nullable()
 });
 var softwareConfigEntrySummarySchema = external_exports.object({
-  id: uuid11,
-  software_project_id: uuid11,
+  id: uuid12,
+  software_project_id: uuid12,
   environment: softwareEnvironmentSchema,
   key_name: external_exports.string(),
   value_kind: softwareConfigValueKindSchema,
@@ -45235,20 +45278,20 @@ var softwareConfigEntrySummarySchema = external_exports.object({
   updated_at: external_exports.string()
 });
 var softwareCredentialRequestSummarySchema = external_exports.object({
-  id: uuid11,
-  software_project_id: uuid11,
+  id: uuid12,
+  software_project_id: uuid12,
   environment: softwareEnvironmentSchema,
-  requested_by_seat_id: uuid11,
+  requested_by_seat_id: uuid12,
   action: external_exports.string(),
   key_name: external_exports.string(),
   reason: external_exports.string().nullable(),
   status: softwareCredentialRequestStatusSchema,
-  approval_task_id: uuid11.nullable(),
+  approval_task_id: uuid12.nullable(),
   created_at: external_exports.string()
 });
 var softwareCapacityObservationSummarySchema = external_exports.object({
-  id: uuid11,
-  runner_id: uuid11,
+  id: uuid12,
+  runner_id: uuid12,
   observed_at: external_exports.string(),
   os: external_exports.string().nullable(),
   cpu_count: external_exports.number().int().nullable(),
@@ -45264,7 +45307,7 @@ var softwareRequestCreateInputSchema = external_exports.object({
   // this schema) enforces that exactly one resolves, with an actionable error
   // when neither is given or neither matches — keeping this shape a plain
   // `z.object` so JSON-schema/CLI-flag projection stays simple (no `.refine`).
-  software_project_id: uuid11.optional(),
+  software_project_id: uuid12.optional(),
   project: external_exports.string().trim().min(1).max(200).optional(),
   // Untrusted display text (ADR-0018 §5) — bounded, never treated as an instruction.
   title: external_exports.string().trim().min(1).max(500),
@@ -45276,11 +45319,11 @@ var softwareRequestCreateInputSchema = external_exports.object({
   automation_mode: softwareAutomationModeSchema.optional()
 }).strict();
 var softwareRequestCreateOutputSchema = external_exports.object({
-  build_request_id: uuid11,
-  software_project_id: uuid11,
+  build_request_id: uuid12,
+  software_project_id: uuid12,
   status: softwareRequestStatusSchema,
   current_phase: softwarePhaseSchema,
-  phase_run_id: uuid11,
+  phase_run_id: uuid12,
   scheduler_state: softwarePhaseSchedulerStateSchema
 });
 var softwareRequestListInputSchema = external_exports.object({
@@ -45290,7 +45333,7 @@ var softwareRequestListOutputSchema = external_exports.object({
   requests: external_exports.array(softwareBuildRequestSummarySchema)
 });
 var softwareRequestShowInputSchema = external_exports.object({
-  build_request_id: uuid11
+  build_request_id: uuid12
 }).strict();
 var softwareRequestShowOutputSchema = external_exports.object({
   request: softwareBuildRequestSummarySchema,
@@ -45304,51 +45347,51 @@ var softwareRequestShowOutputSchema = external_exports.object({
 });
 var softwareRequestLifecycleReason = external_exports.string().trim().min(1).max(2e3);
 var softwareRequestPauseInputSchema = external_exports.object({
-  build_request_id: uuid11,
+  build_request_id: uuid12,
   reason: softwareRequestLifecycleReason.optional()
 }).strict();
 var softwareRequestCancelInputSchema = external_exports.object({
-  build_request_id: uuid11,
+  build_request_id: uuid12,
   reason: softwareRequestLifecycleReason.optional()
 }).strict();
 var softwareRequestResumeInputSchema = external_exports.object({
-  build_request_id: uuid11,
+  build_request_id: uuid12,
   reason: softwareRequestLifecycleReason.optional(),
   termination_bound: softwareTerminationBoundSchema.optional()
 }).strict();
 var softwareRequestLifecycleOutputSchema = external_exports.object({
-  build_request_id: uuid11,
+  build_request_id: uuid12,
   status: softwareRequestStatusSchema,
   current_phase: softwarePhaseSchema,
-  phase_run_id: uuid11.nullable(),
-  work_order_id: uuid11.nullable(),
-  resume_from_task_id: uuid11.nullable()
+  phase_run_id: uuid12.nullable(),
+  work_order_id: uuid12.nullable(),
+  resume_from_task_id: uuid12.nullable()
 });
 var softwarePhaseAdvanceInputSchema = external_exports.object({
-  build_request_id: uuid11,
+  build_request_id: uuid12,
   to_phase: softwarePhaseSchema,
-  owning_seat_id: uuid11.optional(),
+  owning_seat_id: uuid12.optional(),
   note: external_exports.string().max(2e3).optional()
 }).strict();
 var softwarePhaseAdvanceOutputSchema = external_exports.object({
-  build_request_id: uuid11,
+  build_request_id: uuid12,
   from_phase: softwarePhaseSchema,
   to_phase: softwarePhaseSchema,
-  phase_run_id: uuid11
+  phase_run_id: uuid12
 });
 var softwareGateDecideInputSchema = external_exports.object({
-  gate_id: uuid11,
+  gate_id: uuid12,
   decision: softwareGateDecisionSchema,
   rationale: external_exports.string().max(4e3).optional()
 }).strict();
 var softwareGateDecideOutputSchema = external_exports.object({
-  gate_id: uuid11,
+  gate_id: uuid12,
   status: external_exports.enum(["approved", "rejected"]),
-  resolved_by_user_id: uuid11,
-  decision_id: uuid11.nullable()
+  resolved_by_user_id: uuid12,
+  decision_id: uuid12.nullable()
 });
 var softwareDispatchSerializeInputSchema = external_exports.object({
-  build_request_id: uuid11,
+  build_request_id: uuid12,
   // The task that must run FIRST (the dependency target).
   before_task_key: external_exports.string().trim().min(1).max(200),
   // The task that gains the depends_on edge and runs AFTER `before_task_key`.
@@ -45359,45 +45402,45 @@ var softwareDispatchSerializeInputSchema = external_exports.object({
   path: ["after_task_key"]
 });
 var softwareDispatchSerializeOutputSchema = external_exports.object({
-  build_request_id: uuid11,
+  build_request_id: uuid12,
   before_task_key: external_exports.string(),
   after_task_key: external_exports.string(),
   // false when the edge already existed (idempotent no-op) — still a valid, audited call.
   edge_added: external_exports.boolean(),
-  decision_id: uuid11.nullable(),
-  event_id: uuid11.nullable()
+  decision_id: uuid12.nullable(),
+  event_id: uuid12.nullable()
 }).strict();
 var forgeClarificationAnswer = external_exports.object({
   question: external_exports.string().trim().min(1).max(2e3),
   answer: external_exports.string().trim().min(1).max(4e3)
 }).strict();
 var softwareRequestAnswerClarificationInputSchema = external_exports.object({
-  build_request_id: uuid11,
+  build_request_id: uuid12,
   answers: external_exports.array(forgeClarificationAnswer).min(1).max(50),
   // The planner marks the plan ready once its questions are resolved; the human/COS can
   // signal that here. Default false keeps the plan in needs_clarification.
   mark_ready_for_plan_review: external_exports.boolean().default(false)
 }).strict();
 var softwareRequestAnswerClarificationOutputSchema = external_exports.object({
-  build_request_id: uuid11,
-  plan_version_id: uuid11,
+  build_request_id: uuid12,
+  plan_version_id: uuid12,
   status: softwarePlanVersionStatusSchema,
   answered_count: external_exports.number().int()
 });
 var softwarePlanApproveInputSchema = external_exports.object({
-  build_request_id: uuid11,
+  build_request_id: uuid12,
   rationale: external_exports.string().trim().min(1).max(4e3).optional()
 }).strict();
 var softwarePlanRejectInputSchema = external_exports.object({
-  build_request_id: uuid11,
+  build_request_id: uuid12,
   // A rejection must say why (it routes the request back to discovery/scoping).
   rationale: external_exports.string().trim().min(1).max(4e3)
 }).strict();
 var softwarePlanDecisionOutputSchema = external_exports.object({
-  build_request_id: uuid11,
-  plan_version_id: uuid11,
+  build_request_id: uuid12,
+  plan_version_id: uuid12,
   status: external_exports.enum(["approved", "rejected"]),
-  decision_id: uuid11,
+  decision_id: uuid12,
   current_phase: softwarePhaseSchema
 });
 var forgeConformanceFindingInput = external_exports.object({
@@ -45405,41 +45448,41 @@ var forgeConformanceFindingInput = external_exports.object({
   category: softwareConformanceCategorySchema.default("other"),
   summary: external_exports.string().trim().min(1).max(2e3),
   detail: external_exports.string().trim().min(1).max(8e3).optional(),
-  changeset_id: uuid11.optional(),
-  plan_version_id: uuid11.optional()
+  changeset_id: uuid12.optional(),
+  plan_version_id: uuid12.optional()
 }).strict();
 var softwareConformanceRecordFindingsInputSchema = external_exports.object({
-  build_request_id: uuid11,
-  phase_run_id: uuid11.optional(),
+  build_request_id: uuid12,
+  phase_run_id: uuid12.optional(),
   findings: external_exports.array(forgeConformanceFindingInput).min(1).max(50)
 }).strict();
 var softwareConformanceRecordFindingsOutputSchema = external_exports.object({
-  build_request_id: uuid11,
+  build_request_id: uuid12,
   recorded_count: external_exports.number().int(),
-  finding_ids: external_exports.array(uuid11),
+  finding_ids: external_exports.array(uuid12),
   open_finding_count: external_exports.number().int()
 }).strict();
 var softwareConformanceResolveFindingInputSchema = external_exports.object({
-  build_request_id: uuid11,
-  finding_ids: external_exports.array(uuid11).min(1).max(50),
+  build_request_id: uuid12,
+  finding_ids: external_exports.array(uuid12).min(1).max(50),
   // The re-review run that verified the fix — provenance only (rides into the append-only audit
   // event; the finding row's resolution state is the durable transition).
-  phase_run_id: uuid11.optional()
+  phase_run_id: uuid12.optional()
 }).strict();
 var softwareConformanceResolveFindingOutputSchema = external_exports.object({
-  build_request_id: uuid11,
+  build_request_id: uuid12,
   resolved_count: external_exports.number().int(),
-  resolved_finding_ids: external_exports.array(uuid11),
+  resolved_finding_ids: external_exports.array(uuid12),
   open_finding_count: external_exports.number().int()
 }).strict();
 var softwareAuthorityProfileListInputSchema = external_exports.object({
-  software_project_id: uuid11.nullable().optional()
+  software_project_id: uuid12.nullable().optional()
 }).strict();
 var softwareAuthorityProfileListOutputSchema = external_exports.object({
   profiles: external_exports.array(softwareAuthorityProfileSummarySchema)
 });
 var softwareAuthorityProfileCreateInputSchema = external_exports.object({
-  software_project_id: uuid11.nullable().optional(),
+  software_project_id: uuid12.nullable().optional(),
   name: external_exports.string().trim().min(1).max(120),
   preset: softwareAuthorityPresetSchema.default("read_only"),
   // A closed capability map (booleans by capability key). Never derived from
@@ -45448,77 +45491,77 @@ var softwareAuthorityProfileCreateInputSchema = external_exports.object({
   is_default: external_exports.boolean().optional()
 }).strict();
 var softwareAuthorityProfileCreateOutputSchema = external_exports.object({
-  profile_id: uuid11,
+  profile_id: uuid12,
   name: external_exports.string(),
   preset: softwareAuthorityPresetSchema
 });
 var softwareAuthorityGrantInputSchema = external_exports.object({
-  software_project_id: uuid11,
-  seat_id: uuid11,
-  authority_profile_id: uuid11
+  software_project_id: uuid12,
+  seat_id: uuid12,
+  authority_profile_id: uuid12
 }).strict();
 var softwareAuthorityGrantOutputSchema = external_exports.object({
-  grant_id: uuid11,
-  software_project_id: uuid11,
-  seat_id: uuid11,
-  authority_profile_id: uuid11,
+  grant_id: uuid12,
+  software_project_id: uuid12,
+  seat_id: uuid12,
+  authority_profile_id: uuid12,
   status: softwareGrantStatusSchema
 });
 var softwareAuthorityRevokeInputSchema = external_exports.object({
-  grant_id: uuid11
+  grant_id: uuid12
 }).strict();
 var softwareAuthorityRevokeOutputSchema = external_exports.object({
-  grant_id: uuid11,
+  grant_id: uuid12,
   status: softwareGrantStatusSchema
 });
 var softwareSecretRequestInputSchema = external_exports.object({
-  software_project_id: uuid11,
+  software_project_id: uuid12,
   environment: softwareEnvironmentSchema,
-  seat_id: uuid11,
+  seat_id: uuid12,
   action: softwareSecretActionSchema,
   key_name: softwareSecretKeyNameSchema,
   reason: external_exports.string().max(2e3).optional()
 }).strict();
 var softwareSecretRequestOutputSchema = external_exports.object({
   requested: external_exports.literal(true),
-  credential_request_id: uuid11,
-  approval_task_id: uuid11,
-  software_project_id: uuid11,
+  credential_request_id: uuid12,
+  approval_task_id: uuid12,
+  software_project_id: uuid12,
   environment: softwareEnvironmentSchema,
-  seat_id: uuid11,
+  seat_id: uuid12,
   key_name: external_exports.string()
 });
 var softwareSecretGrantInputSchema = external_exports.object({
-  software_project_id: uuid11,
+  software_project_id: uuid12,
   environment: softwareEnvironmentSchema,
-  seat_id: uuid11,
+  seat_id: uuid12,
   action: softwareSecretActionSchema,
   key_name: softwareSecretKeyNameSchema,
   // POINTER only. The vault ref shape refinement rejects any raw-secret value.
   vault_ref: softwareVaultRefSchema
 }).strict();
 var softwareSecretGrantOutputSchema = external_exports.object({
-  grant_id: uuid11,
+  grant_id: uuid12,
   key_name: external_exports.string(),
   environment: softwareEnvironmentSchema,
   status: softwareGrantStatusSchema
 });
 var softwareSecretRevokeInputSchema = external_exports.object({
-  grant_id: uuid11
+  grant_id: uuid12
 }).strict();
 var softwareSecretRevokeOutputSchema = external_exports.object({
-  grant_id: uuid11,
+  grant_id: uuid12,
   status: softwareGrantStatusSchema
 });
 var softwareConfigListInputSchema = external_exports.object({
-  software_project_id: uuid11.nullable().optional(),
+  software_project_id: uuid12.nullable().optional(),
   environment: softwareEnvironmentSchema.nullable().optional()
 }).strict();
 var softwareConfigListOutputSchema = external_exports.object({
   entries: external_exports.array(softwareConfigEntrySummarySchema)
 });
 var softwareConfigSetInputSchema = external_exports.object({
-  software_project_id: uuid11,
+  software_project_id: uuid12,
   environment: softwareEnvironmentSchema,
   key_name: softwareSecretKeyNameSchema,
   value_kind: softwareConfigValueKindSchema,
@@ -45538,24 +45581,24 @@ var softwareConfigSetInputSchema = external_exports.object({
   }
 });
 var softwareConfigSetOutputSchema = external_exports.object({
-  config_entry_id: uuid11,
-  software_project_id: uuid11,
+  config_entry_id: uuid12,
+  software_project_id: uuid12,
   environment: softwareEnvironmentSchema,
   key_name: external_exports.string(),
   value_kind: softwareConfigValueKindSchema,
   has_secret_ref: external_exports.boolean()
 });
 var softwareSecretRequestListInputSchema = external_exports.object({
-  software_project_id: uuid11.nullable().optional(),
+  software_project_id: uuid12.nullable().optional(),
   status: softwareCredentialRequestStatusSchema.nullable().optional()
 }).strict();
 var softwareSecretRequestListOutputSchema = external_exports.object({
   requests: external_exports.array(softwareCredentialRequestSummarySchema)
 });
 var softwareSecretUseInputSchema = external_exports.object({
-  software_project_id: uuid11,
+  software_project_id: uuid12,
   environment: softwareEnvironmentSchema,
-  seat_id: uuid11,
+  seat_id: uuid12,
   action: softwareSecretActionSchema,
   key_name: softwareSecretKeyNameSchema,
   operation: softwareSecretAccessOperationSchema.default("use")
@@ -45566,12 +45609,12 @@ var softwareSecretUseOutputSchema = external_exports.object({
   key_name: external_exports.string(),
   environment: softwareEnvironmentSchema,
   operation: softwareSecretAccessOperationSchema,
-  access_log_id: uuid11,
-  missing_request_id: uuid11.nullable(),
+  access_log_id: uuid12,
+  missing_request_id: uuid12.nullable(),
   redacted_summary: external_exports.record(external_exports.string(), external_exports.unknown())
 });
 var softwareCapacityListInputSchema = external_exports.object({
-  runner_id: uuid11.nullable().optional(),
+  runner_id: uuid12.nullable().optional(),
   limit: external_exports.number().int().positive().max(200).optional()
 }).strict();
 var softwareCapacityListOutputSchema = external_exports.object({
@@ -45626,9 +45669,9 @@ var forgeTrustedControlSchema = external_exports.object({
   automation_mode: softwareAutomationModeSchema,
   inferred_risk: softwareRiskLevelSchema,
   risk_ceiling: softwareRiskLevelSchema.nullable().default(null),
-  authority_profile_ids: external_exports.array(uuid11).max(50).default([]),
+  authority_profile_ids: external_exports.array(uuid12).max(50).default([]),
   active_secret_grant_count: external_exports.number().int().nonnegative().max(1e3).default(0),
-  pending_gate_ids: external_exports.array(uuid11).max(50).default([])
+  pending_gate_ids: external_exports.array(uuid12).max(50).default([])
 }).strict();
 var forgeSeatSkillSchema = external_exports.object({
   slug: external_exports.string().trim().min(1).max(200),
@@ -45637,9 +45680,9 @@ var forgeSeatSkillSchema = external_exports.object({
 }).strict();
 var forgeRuntimeContextPacketSchema = external_exports.object({
   schema_version: external_exports.literal(1),
-  phase_run_id: uuid11,
-  build_request_id: uuid11,
-  software_project_id: uuid11,
+  phase_run_id: uuid12,
+  build_request_id: uuid12,
+  software_project_id: uuid12,
   phase: softwarePhaseSchema,
   request_status: softwareRequestStatusSchema,
   project: external_exports.object({
@@ -45648,7 +45691,7 @@ var forgeRuntimeContextPacketSchema = external_exports.object({
   }).strict(),
   scheduler: external_exports.object({
     lease_model: external_exports.literal("work_order_claim_heartbeat"),
-    runner_id: uuid11,
+    runner_id: uuid12,
     max_runner_sessions: external_exports.number().int().positive().max(8),
     model_account_state: external_exports.string().min(1).max(80),
     account_alias: external_exports.string().min(1).max(200).nullable()
@@ -45732,7 +45775,7 @@ var runnerTurnReportSchema = external_exports.object({
 var softwareDeveloperTeamInstallInputSchema = external_exports.object({
   // The human-accountable steward seat for the installed team. Agent seats created
   // by the template chain through this seat so no agent occupancy can be orphaned.
-  steward_seat_id: uuid11,
+  steward_seat_id: uuid12,
   // Optional project scope for authority grants. Authority profile presets are
   // installed tenant-wide either way; grants are project-scoped only when supplied.
   // DER-1241: `.nullable()` too — this command is human-confirmed, so its input is
@@ -45740,7 +45783,7 @@ var softwareDeveloperTeamInstallInputSchema = external_exports.object({
   // replay; an empty project round-trips as JSON `null`, which a bare `.optional()`
   // rejects (→ "Command input failed schema validation"). Matches the sibling
   // software-factory schemas that already use `.nullable().optional()`.
-  software_project_id: uuid11.nullable().optional(),
+  software_project_id: uuid12.nullable().optional(),
   assign_skills: external_exports.boolean().default(true),
   // DER-1264: the install auto-staffs live agents at a pr_only, observe-first
   // posture. If the tenant's company autonomy ceiling (`agent_policy`) is MORE
@@ -45760,34 +45803,34 @@ var softwareDeveloperTeamInstallInputSchema = external_exports.object({
 }).strict();
 var softwareDeveloperTeamSeatSummarySchema = external_exports.object({
   role: softwareDeveloperTeamRoleSchema,
-  seat_id: uuid11,
+  seat_id: uuid12,
   name: external_exports.string(),
-  charter_version_id: uuid11,
+  charter_version_id: uuid12,
   created: external_exports.boolean()
 });
 var softwareDeveloperTeamSkillSummarySchema = external_exports.object({
   slug: external_exports.string(),
-  skill_id: uuid11,
-  skill_version_id: uuid11,
-  assigned_seat_ids: external_exports.array(uuid11)
+  skill_id: uuid12,
+  skill_version_id: uuid12,
+  assigned_seat_ids: external_exports.array(uuid12)
 });
 var softwareDeveloperTeamAuthorityProfileSummarySchema = external_exports.object({
   preset: softwareAuthorityPresetSchema,
-  profile_id: uuid11,
+  profile_id: uuid12,
   name: external_exports.string()
 });
 var softwareDeveloperTeamAuthorityGrantSummarySchema = external_exports.object({
   role: softwareDeveloperTeamRoleSchema,
-  software_project_id: uuid11,
-  seat_id: uuid11,
-  authority_profile_id: uuid11,
-  grant_id: uuid11,
+  software_project_id: uuid12,
+  seat_id: uuid12,
+  authority_profile_id: uuid12,
+  grant_id: uuid12,
   created: external_exports.boolean()
 });
 var softwareDeveloperTeamOccupancySummarySchema = external_exports.object({
   role: softwareDeveloperTeamRoleSchema,
-  seat_id: uuid11,
-  agent_id: uuid11,
+  seat_id: uuid12,
+  agent_id: uuid12,
   template_slug: external_exports.string(),
   status: external_exports.literal("live"),
   // false when a live agent already occupied the seat (idempotent re-install).
@@ -45807,7 +45850,7 @@ var softwareDeveloperTeamTokenBudgetSummarySchema = external_exports.object({
   set_by_install: external_exports.boolean()
 });
 var softwareDeveloperTeamGithubPolicySummarySchema = external_exports.object({
-  software_project_id: uuid11,
+  software_project_id: uuid12,
   automation_mode_ceiling: softwareAutomationModeSchema,
   // false when a pre-existing policy was preserved (not created by this install).
   created: external_exports.boolean()
@@ -45835,8 +45878,8 @@ var softwareDeveloperTeamUninstallInputSchema = external_exports.object({
 }).strict();
 var softwareDeveloperTeamDecommissionedAgentSchema = external_exports.object({
   role: softwareDeveloperTeamRoleSchema.nullable(),
-  seat_id: uuid11,
-  agent_id: uuid11
+  seat_id: uuid12,
+  agent_id: uuid12
 });
 var softwareDeveloperTeamUninstallOutputSchema = external_exports.object({
   torn_down: external_exports.boolean(),
@@ -45986,8 +46029,8 @@ var forgeMemoryDraftArtifact = external_exports.object({
   follow_up_items: forgeArtifactList
 }).strict();
 var softwareGithubAutomationPolicyInputSchema = external_exports.object({
-  software_project_id: uuid11,
-  authority_profile_id: uuid11.nullable().optional(),
+  software_project_id: uuid12,
+  authority_profile_id: uuid12.nullable().optional(),
   automation_mode_ceiling: softwareAutomationModeSchema.default("plan_only"),
   allowed_actions: external_exports.array(softwareGithubActionSchema).max(20),
   // DER-1233: the element schema is a single FLATTENED enum (the union of the
@@ -46023,12 +46066,12 @@ var softwareGithubInstallationConnectInputSchema = external_exports.object({
   repositories: external_exports.array(softwareGithubConnectedRepositoryInputSchema).min(1).max(200)
 }).strict();
 var softwareGithubInstallationConnectOutputSchema = external_exports.object({
-  github_installation_id: uuid11,
+  github_installation_id: uuid12,
   repositories_connected: external_exports.number().int().nonnegative()
 });
 var softwareGithubRepositoryBindMappingSchema = external_exports.object({
   repository_id: external_exports.number().int().positive(),
-  software_project_id: uuid11
+  software_project_id: uuid12
 }).strict();
 var softwareGithubInstallationBindInputSchema = external_exports.object({
   app_slug: external_exports.string().trim().min(1).max(120).default("rost-forge"),
@@ -46036,7 +46079,7 @@ var softwareGithubInstallationBindInputSchema = external_exports.object({
   bindings: external_exports.array(softwareGithubRepositoryBindMappingSchema).min(1).max(100)
 }).strict();
 var softwareGithubInstallationBindOutputSchema = external_exports.object({
-  github_installation_id: uuid11,
+  github_installation_id: uuid12,
   repositories_bound: external_exports.number().int().nonnegative()
 });
 var softwareGithubRepositoryUnbindInputSchema = external_exports.object({
@@ -46057,12 +46100,12 @@ var softwareGithubInstallationRepositoryViewSchema = external_exports.object({
   private: external_exports.boolean(),
   default_branch: external_exports.string(),
   status: external_exports.enum(["connected", "active"]),
-  software_project_id: uuid11.nullable(),
+  software_project_id: uuid12.nullable(),
   software_project_name: external_exports.string().nullable(),
   software_project_slug: external_exports.string().nullable()
 });
 var softwareGithubInstallationViewSchema = external_exports.object({
-  id: uuid11,
+  id: uuid12,
   installation_id: external_exports.number().int().positive(),
   account_login: external_exports.string(),
   account_id: external_exports.number().int().positive(),
@@ -46074,17 +46117,17 @@ var softwareGithubInstallationListOutputSchema = external_exports.object({
   installations: external_exports.array(softwareGithubInstallationViewSchema)
 });
 var softwareGithubAutomationPolicyUpsertOutputSchema = external_exports.object({
-  policy_id: uuid11,
-  software_project_id: uuid11,
+  policy_id: uuid12,
+  software_project_id: uuid12,
   automation_mode_ceiling: softwareAutomationModeSchema,
   max_risk: softwareRiskLevelSchema.nullable()
 });
 var softwareGithubInstallationTokenCreateInputSchema = external_exports.object({
-  software_project_id: uuid11,
+  software_project_id: uuid12,
   repository_id: external_exports.number().int().positive(),
   requested_actions: external_exports.array(softwareGithubActionSchema).min(1).max(20),
   requested_automation_mode: softwareAutomationModeSchema.default("plan_only"),
-  seat_id: uuid11.optional()
+  seat_id: uuid12.optional()
 }).strict();
 var softwareGithubInstallationTokenCreateOutputSchema = external_exports.object({
   installation_id: external_exports.number().int().positive(),
@@ -46121,13 +46164,13 @@ var softwareVercelConnectionConnectInputSchema = external_exports.object({
   scopes: external_exports.array(external_exports.string().trim().min(1).max(120)).max(40).default([])
 }).strict();
 var softwareVercelConnectionConnectOutputSchema = external_exports.object({
-  vercel_connection_id: uuid11,
+  vercel_connection_id: uuid12,
   account_id: external_exports.string(),
   team_id: external_exports.string().nullable()
 });
 var softwareVercelProjectLinkInputSchema = external_exports.object({
-  software_project_id: uuid11,
-  vercel_connection_id: uuid11,
+  software_project_id: uuid12,
+  vercel_connection_id: uuid12,
   vercel_project_id: external_exports.string().trim().min(1).max(200),
   vercel_project_name: external_exports.string().trim().min(1).max(255),
   framework: external_exports.string().trim().min(1).max(120).nullable().optional(),
@@ -46136,12 +46179,12 @@ var softwareVercelProjectLinkInputSchema = external_exports.object({
   git_repository: external_exports.record(external_exports.string().min(1), external_exports.unknown()).default({})
 }).strict();
 var softwareVercelProjectLinkOutputSchema = external_exports.object({
-  vercel_project_link_id: uuid11,
-  software_project_id: uuid11,
+  vercel_project_link_id: uuid12,
+  software_project_id: uuid12,
   vercel_project_id: external_exports.string()
 });
 var softwareVercelConnectionViewSchema = external_exports.object({
-  id: uuid11,
+  id: uuid12,
   account_id: external_exports.string(),
   account_name: external_exports.string().nullable(),
   team_id: external_exports.string().nullable(),
@@ -46152,11 +46195,11 @@ var softwareVercelConnectionViewSchema = external_exports.object({
   connected_at: external_exports.string()
 });
 var softwareVercelProjectLinkViewSchema = external_exports.object({
-  id: uuid11,
-  software_project_id: uuid11,
+  id: uuid12,
+  software_project_id: uuid12,
   software_project_name: external_exports.string(),
   software_project_slug: external_exports.string(),
-  vercel_connection_id: uuid11,
+  vercel_connection_id: uuid12,
   vercel_project_id: external_exports.string(),
   vercel_project_name: external_exports.string(),
   framework: external_exports.string().nullable(),
@@ -46170,16 +46213,16 @@ var softwareVercelProjectListOutputSchema = external_exports.object({
   project_links: external_exports.array(softwareVercelProjectLinkViewSchema)
 });
 var softwareVercelDeployPreviewInputSchema = external_exports.object({
-  software_project_id: uuid11,
+  software_project_id: uuid12,
   commit_sha: external_exports.string().trim().regex(/^[A-Fa-f0-9]{7,64}$/),
   git_ref: external_exports.string().trim().min(1).max(255),
-  build_request_id: uuid11.optional(),
-  phase_run_id: uuid11.optional(),
-  seat_id: uuid11.optional(),
+  build_request_id: uuid12.optional(),
+  phase_run_id: uuid12.optional(),
+  seat_id: uuid12.optional(),
   required_secret_keys: external_exports.array(external_exports.string().trim().min(1).max(200)).max(25).default([])
 }).strict();
 var softwareVercelDeployPreviewOutputSchema = external_exports.object({
-  vercel_deployment_record_id: uuid11,
+  vercel_deployment_record_id: uuid12,
   deployment_id: external_exports.string(),
   deployment_url: external_exports.string().nullable(),
   commit_sha: external_exports.string(),
@@ -46187,18 +46230,18 @@ var softwareVercelDeployPreviewOutputSchema = external_exports.object({
 });
 
 // ../../packages/protocol/src/software-factory-events.ts
-var uuid12 = external_exports.string().uuid();
+var uuid13 = external_exports.string().uuid();
 var softwareFactoryPhaseRunCompletedEventSchema = external_exports.object({
-  tenantId: uuid12,
-  phaseRunId: uuid12,
-  buildRequestId: uuid12.nullish(),
+  tenantId: uuid13,
+  phaseRunId: uuid13,
+  buildRequestId: uuid13.nullish(),
   status: external_exports.enum(["passed", "failed"]),
   idempotencyKey: external_exports.string().min(1).optional()
 }).strict();
 var softwareFactoryBudgetExhaustedEventSchema = external_exports.object({
-  tenantId: uuid12,
-  phaseRunId: uuid12,
-  buildRequestId: uuid12,
+  tenantId: uuid13,
+  phaseRunId: uuid13,
+  buildRequestId: uuid13,
   reason: external_exports.string().min(1),
   idempotencyKey: external_exports.string().min(1).optional()
 }).strict();
@@ -48388,7 +48431,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-16.8",
+    version: "2026-07-16.9",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -49232,6 +49275,7 @@ Seat-scoped MCP tokens expose the operating protocol below. The server still che
 | \`rost_list_brokered_secret_grants\` | \`secret_grant.list\` | List the seat's own brokered secret grants. Returns egress allowlist metadata only (host, path prefix, methods, scope, status), never the vault ref or any secret. | Seat | Call with {} (an agent is server-pinned to its own seat). |
 | \`rost_record_forge_conformance_findings\` | \`software_factory.conformance.record_findings\` | A Forge review seat (plan conformance, security, or QA) records structured findings as reviewer evidence. Set \`changeset_id\` on a finding that targets a specific changeset. Open findings route the request back to implementation; accepting a gap remains a separate human gate. Requires the seat's signed manifest grant. | Seat | Call with \`{"build_request_id":"<request-id>","findings":[{"severity":"major","category":"scope_gap","summary":"Missing migration verification","changeset_id":"<changeset-id>"}]}\`. |
 | \`rost_resolve_forge_conformance_finding\` | \`software_factory.conformance.resolve_finding\` | A Forge review seat marks a prior open finding resolved after re-reviewing the changeset and verifying it is fixed (reviewer verification, not human gap-acceptance). A resolved finding stops routing the request back to implementation, so the recycle loop converges. Requires the seat's signed manifest grant. | Seat | Call with \`{"build_request_id":"<request-id>","finding_ids":["<finding-id>"]}\`. |
+| \`rost_decide_a_conversational_gate\` | \`gate.decide\` | A seat agent DRAFTS a conversational gate approval bound to an artifact digest; the call stages a pending confirmation and a human owner/admin CONFIRMS it via /approvals (invariant #7 \u2014 an agent drafts, never self-decides). A stale artifact digest (the artifact changed since the gate was drafted) re-blocks and refuses. | Seat (draft; owner/admin decides) | Call with \`{"subject_kind":"artifact","subject_id":"<id>","artifact_ref":{"href":"<url>","label":"<label>"},"artifact_digest":"sha256:<digest>","decision":"approve","ask":"Ship it?","consequence":"Unblocks implementation."}\`; the seat-agent caller receives a confirmation handoff and the owner/admin decides. |
 
 ### MCP operation resources
 
@@ -52520,6 +52564,7 @@ var COMMAND_MANIFEST = [
   { "id": "friction.resolve", "namespace": "friction", "action": "resolve", "title": "Resolve Friction issue", "description": 'Resolve an issue with a root cause. In the default "ids" resolution_mode this also creates a remediation follow-up task; "already_fixed" records only the root cause (no follow-up task). Always records a human decision (decided_by) in the same transaction.', "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "issue_id", "flag": "issue-id", "type": "string", "required": true }, { "name": "resolution_mode", "flag": "resolution-mode", "type": "enum", "required": false, "enumValues": ["ids", "already_fixed"] }, { "name": "root_cause", "flag": "root-cause", "type": "string", "required": true }, { "name": "owner_seat_id", "flag": "owner-seat-id", "type": "string", "required": false }, { "name": "task_title", "flag": "task-title", "type": "string", "required": false }, { "name": "task_description", "flag": "task-description", "type": "string", "required": false }, { "name": "done_by", "flag": "done-by", "type": "string", "required": false }, { "name": "resolving_seat_id", "flag": "resolving-seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Resolve an issue with a root cause and remediation task; resolution is a human decision." },
   { "id": "friction.stale_candidates", "namespace": "friction", "action": "stale_candidates", "title": "Find stale friction", "description": "List open or diagnosing Friction issues whose linked remediation task has already shipped, making them high-confidence candidates for bulk resolution, with per-row evidence. Read-only \u2014 it never resolves anything.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "stale_after_days", "flag": "stale-after-days", "type": "integer", "required": false }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List open or diagnosing issues whose remediation task already shipped \u2014 high-confidence candidates for a bulk close-the-loop pass. Read-only." },
   { "id": "friction.update_status", "namespace": "friction", "action": "update_status", "title": "Update Friction issue status", "description": "Move a non-terminal issue between open and diagnosing. Terminal issues (resolved/dropped) cannot be reopened here.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "issue_id", "flag": "issue-id", "type": "string", "required": true }, { "name": "status", "flag": "status", "type": "enum", "required": true, "enumValues": ["open", "diagnosing"] }], "hasComplexInput": false, "help": "Move a non-terminal issue between open and diagnosing while it is being worked." },
+  { "id": "gate.decide", "namespace": "gate", "action": "decide", "title": "Decide a conversational gate", "description": "A human approves or rejects a conversational gate bound to an artifact digest (a prototype URL, deliverable, or artifact). The agent drafts the decision and the human confirms it; the resolver is always a human (invariant #7). On approval the artifact must be unchanged since the gate was drafted \u2014 a stale digest re-blocks. Requires confirmation.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "subject_kind", "flag": "subject-kind", "type": "enum", "required": true, "enumValues": ["prototype", "deliverable", "artifact"] }, { "name": "subject_id", "flag": "subject-id", "type": "string", "required": true }, { "name": "artifact_digest", "flag": "artifact-digest", "type": "string", "required": true }, { "name": "decision", "flag": "decision", "type": "enum", "required": true, "enumValues": ["approve", "reject"] }, { "name": "ask", "flag": "ask", "type": "string", "required": true }, { "name": "consequence", "flag": "consequence", "type": "string", "required": true }, { "name": "unblocked_targets", "flag": "unblocked-targets", "type": "array", "required": false, "itemType": "string" }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": true, "help": "A human approves or rejects a conversational gate bound to an artifact digest; the agent drafts, the human confirms (invariant #7)." },
   { "id": "goal.bind_measurable", "namespace": "goal", "action": "bind_measurable", "title": "Bind a Signal to a Cascade goal", "description": "Bind a measurable to a goal. Role defaults to 'informs' \u2014 a conservative informative indicator allowed at any goal level (many per goal) that never changes goal status. Role 'drives_status' makes it the goal's status driver: allowed only on a childless seat goal or milestone, at most one per goal, requires a second_anchor (a prior closed period + expected value confirming the Signal matched the books), and auto-status starts OFF until a steward opts in with goal.set_auto_status. Binding a driver over an existing informs binding of the same Signal promotes it. Binding is human-gated.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }, { "name": "measurable_id", "flag": "measurable-id", "type": "string", "required": true }, { "name": "role", "flag": "role", "type": "enum", "required": false, "enumValues": ["drives_status", "informs"] }], "hasComplexInput": true, "help": "Bind a Signal to a goal. Defaults to role informs (a conservative indicator at any level that never changes status); pass role drives_status with a second_anchor (a prior closed period + expected value confirming the Signal matched the books) to make it a childless leaf goal's status driver \u2014 this promotes an existing informs binding (auto-status starts OFF until a steward opts in)." },
   { "id": "goal.create", "namespace": "goal", "action": "create", "title": "Create Cascade goal", "description": "Create a cycle goal under an existing objective. The parent chain must terminate at a Compass objective in the same cycle (enforced server-side).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "cycle_id", "flag": "cycle-id", "type": "string", "required": true }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "parent_goal_id", "flag": "parent-goal-id", "type": "string", "required": true }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "definition_of_done", "flag": "definition-of-done", "type": "string", "required": true }, { "name": "status", "flag": "status", "type": "enum", "required": false, "enumValues": ["on", "off"] }], "hasComplexInput": false, "help": "Create cycle goals under an existing objective; the parent chain must terminate at a Compass objective." },
   { "id": "goal.drop", "namespace": "goal", "action": "drop", "title": "Drop Cascade goal", "description": "Drop (retire) a goal by setting status to dropped. Dropping retires the commitment, so it is human-gated. The row is retained for audit (never deleted).", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Drop a goal to retire a commitment; the goal is retained for audit and dropping is human-gated." },
@@ -56345,7 +56390,8 @@ function parseSemver2(value) {
 // src/runner-serve.ts
 import { execFile as execFileCallback5, spawn } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { chmod as chmod2, mkdir as mkdir5, readFile as readFile5, rename, rm as rm5, statfs, writeFile as writeFile5 } from "node:fs/promises";
+import { constants as fsConstants2 } from "node:fs";
+import { access as access3, chmod as chmod2, mkdir as mkdir5, readFile as readFile5, rename, rm as rm5, statfs, writeFile as writeFile5 } from "node:fs/promises";
 import { cpus, homedir as homedir4, hostname as hostname3, platform, totalmem, tmpdir as tmpdir2 } from "node:os";
 import path7 from "node:path";
 import { setTimeout as sleep3 } from "node:timers/promises";
@@ -57661,11 +57707,43 @@ function resolveSandboxPosture(env, homeDir) {
 function resolveSandboxNetworkFlag(env) {
   return parseSandboxNetwork(env.RUNNER_SANDBOX_NETWORK).allowNetwork ? "allow" : "deny";
 }
+var CAPABILITY_PROBE_TIMEOUT_MS = 1e4;
+function classifyProbeError(err) {
+  if (!err || typeof err !== "object") {
+    return "absent";
+  }
+  const candidate = err;
+  const message = typeof candidate.message === "string" ? candidate.message.toLowerCase() : "";
+  if (candidate.code === "ENOENT" || message.includes("not found")) {
+    return "absent";
+  }
+  if (candidate.killed === true || candidate.code === "ETIMEDOUT" || candidate.signal === "SIGTERM") {
+    return "present_slow";
+  }
+  return "absent";
+}
+async function isResolvableOnPath(command) {
+  const dirs = (process.env.PATH ?? "").split(path7.delimiter).filter((dir) => dir.length > 0);
+  const suffixes = process.platform === "win32" ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";").filter((ext) => ext.length > 0) : [""];
+  for (const dir of dirs) {
+    for (const suffix of suffixes) {
+      try {
+        await access3(path7.join(dir, `${command}${suffix}`), fsConstants2.X_OK);
+        return true;
+      } catch {
+      }
+    }
+  }
+  return false;
+}
 async function probe(command) {
   try {
-    const { stdout, stderr } = await execFile5(command, ["--version"], { timeout: 1500 });
+    const { stdout, stderr } = await execFile5(command, ["--version"], { timeout: CAPABILITY_PROBE_TIMEOUT_MS });
     return { installed: true, version: (stdout || stderr).trim() || null, auth_state: "ready" };
-  } catch {
+  } catch (err) {
+    if (classifyProbeError(err) === "present_slow" && await isResolvableOnPath(command)) {
+      return { installed: true, version: null, auth_state: "unknown" };
+    }
     return { installed: false, version: null, auth_state: "unknown" };
   }
 }
@@ -57701,7 +57779,7 @@ async function probeClaude() {
 }
 async function probeClaudeStreamJsonInterface() {
   try {
-    const { stdout, stderr } = await execFile5("claude", ["--help"], { timeout: 1500, maxBuffer: 1024 * 1024 });
+    const { stdout, stderr } = await execFile5("claude", ["--help"], { timeout: CAPABILITY_PROBE_TIMEOUT_MS, maxBuffer: 1024 * 1024 });
     return supportsClaudeStreamJsonInterface(`${stdout ?? ""}
 ${stderr ?? ""}`);
   } catch {
@@ -57713,7 +57791,7 @@ function supportsClaudeStreamJsonInterface(helpText2) {
 }
 async function probeGit() {
   try {
-    const { stdout, stderr } = await execFile5("git", ["--version"], { timeout: 1500 });
+    const { stdout, stderr } = await execFile5("git", ["--version"], { timeout: CAPABILITY_PROBE_TIMEOUT_MS });
     const raw = (stdout || stderr).trim();
     return { installed: true, version: /(\d+\.\d+(?:\.\d+)?)/.exec(raw)?.[1] ?? (raw || null) };
   } catch {
@@ -57722,7 +57800,7 @@ async function probeGit() {
 }
 async function probeGh() {
   try {
-    const { stdout, stderr } = await execFile5("gh", ["--version"], { timeout: 1500 });
+    const { stdout, stderr } = await execFile5("gh", ["--version"], { timeout: CAPABILITY_PROBE_TIMEOUT_MS });
     const raw = (stdout || stderr).trim().split("\n")[0]?.trim() ?? "";
     const authenticated = await probeGhAuth();
     return { installed: true, version: /(\d+\.\d+\.\d+)/.exec(raw)?.[1] ?? (raw || null), authenticated };
@@ -57848,6 +57926,11 @@ async function executeClaimedUnit(fetchImpl, appUrl2, state, config2, io, runtim
     summary: capResultSummary(result.summary),
     log_ref: input.logRef(id),
     model: (turnRuntime ?? runtime) === "codex" ? "codex-cli" : "claude-cli",
+    // DER-1915: token usage lifted from the claude JSON envelope (extractClaudeUsage), sent for
+    // BOTH kinds when present — never defaulted to 0 (see RunnerTurnResult.inputTokens/outputTokens).
+    // Both result routes (work-orders and turn-executions) accept these snake_case fields.
+    ...result.inputTokens != null ? { input_tokens: result.inputTokens } : {},
+    ...result.outputTokens != null ? { output_tokens: result.outputTokens } : {},
     // Artifact-bearing result fields (T1.5) — only sent when the harness produced them, so
     // the result route's `.strict()` schema still accepts a plain read-status report.
     ...result.prUrl ? { pr_url: result.prUrl } : {},
@@ -57981,9 +58064,14 @@ function resolveTurnPlan(input) {
     ],
     codexSandbox: execution.local_tools === "workspace_write" ? "workspace-write" : "read-only",
     // Forge build/review turns emit a structured JSON envelope (reusing the AICOS
-    // --output-format json pattern) so their summary is a real contract, not a stdout
-    // slice; read_status AND seat_work (DER-1333) turns keep free-form text status.
-    outputFormat: execution.profile === "forge_build" || execution.profile === "forge_review" ? "json" : "text",
+    // --output-format json pattern) so their summary is a real contract, not a stdout slice.
+    // DER-1915: seat_work ALSO uses the JSON envelope now, purely so its usage block
+    // (extractClaudeUsage) is reportable — the DER-1333 intent (a free-form status summary,
+    // not a structured contract) is unchanged, because `extractRunnerSummary` unwraps the
+    // envelope down to the model's own `result` text either way; json just adds parseable
+    // metadata (usage, session_id) alongside it. Only read_status (a read-only status stub,
+    // not a real MCP turn) still uses plain text.
+    outputFormat: execution.profile === "forge_build" || execution.profile === "forge_review" || execution.profile === "seat_work" ? "json" : "text",
     // Only a Forge workspace grants a repo cwd; a needs_repo contract with no prepared
     // workspace (broker/clone failed upstream) falls back to tmpdir rather than a bad cwd.
     repoDir: execution.needs_repo ? input.repoDir : null,
@@ -58664,11 +58752,21 @@ function runModelProcess(input) {
     let err = "";
     const timer = setTimeout(() => {
       killProcessTree(child);
+      const seconds = Math.round(input.timeoutMs / 1e3);
       const partial2 = scrubTranscriptSessionIds(redactForLog((out || err || "").trim()));
+      let transcriptBody = partial2;
+      if (transcriptBody.length === 0) {
+        const redactedErr = scrubTranscriptSessionIds(redactForLog(err.trim()));
+        transcriptBody = `turn timed out after ${seconds}s; no model output was captured before the process was killed.`;
+        if (redactedErr.length > 0) {
+          transcriptBody += `
+${redactedErr}`;
+        }
+      }
       finish({
         ok: false,
-        summary: `turn timed out after ${Math.round(input.timeoutMs / 1e3)}s`,
-        ...partial2.length > 0 ? { transcript: partial2.slice(0, MAX_TRANSCRIPT_CHARS) } : {}
+        summary: `turn timed out after ${seconds}s`,
+        transcript: transcriptBody.slice(0, MAX_TRANSCRIPT_CHARS)
       });
     }, input.timeoutMs);
     child.stdout.on("data", (data) => {
@@ -58683,18 +58781,30 @@ function runModelProcess(input) {
       const redacted = redactForLog(rawOutput);
       const evidence = input.collectEvidence && code === 0 ? extractRunnerEvidence(rawOutput) : [];
       const planArtifact = input.collectEvidence && code === 0 ? extractForgePlanArtifact(rawOutput) : void 0;
+      const transcriptSource = !input.collectEvidence && redacted.trim().startsWith("{") ? extractRunnerSummary(redacted) : redacted;
       finish({
         ok: code === 0,
         summary: extractRunnerSummary(redacted).slice(0, 12e3),
-        transcript: scrubTranscriptSessionIds(redacted).slice(0, MAX_TRANSCRIPT_CHARS),
+        transcript: scrubTranscriptSessionIds(transcriptSource).slice(0, MAX_TRANSCRIPT_CHARS),
         ...evidence.length > 0 ? { evidence } : {},
         ...input.expectSessionEnvelope ? extractClaudeSessionId(rawOutput) : {},
-        ...planArtifact ? { planArtifact } : {}
+        ...planArtifact ? { planArtifact } : {},
+        // DER-1915: attempt the token-usage extraction for BOTH work_order and turn_execution
+        // kinds (unlike the session id, which is scoped to expectSessionEnvelope/resume) — a
+        // Forge build/review work order runs claude with the same JSON envelope and its usage
+        // is just as reportable. Safe to attempt unconditionally: non-JSON/no-usage output
+        // yields {}, never a fabricated zero.
+        ...extractClaudeUsage(rawOutput)
       });
     });
     child.on("error", (error51) => {
       clearTimeout(timer);
-      finish({ ok: false, summary: `spawn error: ${redactForLog(error51.message)}` });
+      const message = redactForLog(error51.message);
+      finish({
+        ok: false,
+        summary: `spawn error: ${message}`,
+        transcript: `spawn error: ${message}`.slice(0, MAX_TRANSCRIPT_CHARS)
+      });
     });
   });
 }
@@ -58814,6 +58924,30 @@ function extractClaudeSessionId(output) {
     return {};
   }
 }
+function extractClaudeUsage(output) {
+  const trimmed = output.trim();
+  if (!trimmed.startsWith("{")) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(trimmed);
+    const usage2 = parsed.usage;
+    if (!usage2 || typeof usage2 !== "object" || Array.isArray(usage2)) {
+      return {};
+    }
+    const record2 = usage2;
+    const result = {};
+    if (typeof record2.input_tokens === "number" && Number.isFinite(record2.input_tokens) && record2.input_tokens >= 0) {
+      result.inputTokens = Math.floor(record2.input_tokens);
+    }
+    if (typeof record2.output_tokens === "number" && Number.isFinite(record2.output_tokens) && record2.output_tokens >= 0) {
+      result.outputTokens = Math.floor(record2.output_tokens);
+    }
+    return result;
+  } catch {
+    return {};
+  }
+}
 function runtimeSessionKey(state, workOrder) {
   const seatId = extractSeatId(workOrder);
   const userId = extractTurnUserId(workOrder);