@sechroom/cli 2026.7.11 → 2026.7.12-rc.de836e14

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { Command } from "commander";
 
 // src/auth.ts
@@ -439,6 +439,9 @@ var quiet = false;
 function setQuiet(q) {
   quiet = q;
 }
+function isQuiet() {
+  return quiet;
+}
 function colorOn() {
   return !quiet && !process.env.NO_COLOR && process.env.FORCE_COLOR !== "0" && Boolean(process.stdout.isTTY);
 }
@@ -615,6 +618,22 @@ function emitAction(summary, data, json) {
   process.stdout.write(`${ok("\u2713")} ${summary}
 `);
 }
+var GOVERNANCE_QUEUED_PROBLEM_TYPE = "https://sechroom.dev/problems/governance-review-queued";
+function isGovernanceQueued(body) {
+  return typeof body === "object" && body !== null && "type" in body && body.type === GOVERNANCE_QUEUED_PROBLEM_TYPE;
+}
+function formatQueuedForApproval(body, json) {
+  if (json) return JSON.stringify(body) + "\n";
+  const b = body ?? {};
+  const detail = typeof b.detail === "string" ? b.detail : void 0;
+  const requestId = typeof b.requestId === "string" ? b.requestId : void 0;
+  const message = detail ?? "This change requires operator approval before it takes effect.";
+  let out = `${warn("\u29D7")} Pending approval \u2014 ${message}
+`;
+  if (requestId) out += `  ${style.dim(`request: ${requestId}`)}
+`;
+  return out;
+}
 async function runApi(label, fn) {
   const s = spinner(label);
   let res;
@@ -624,6 +643,12 @@ async function runApi(label, fn) {
     s.fail();
     fail(err2);
   }
+  const queuedBody = res.data ?? res.error;
+  if (res.response?.status === 202 && isGovernanceQueued(queuedBody)) {
+    s.stop();
+    process.stdout.write(formatQueuedForApproval(queuedBody, isQuiet()));
+    process.exit(0);
+  }
   const httpFailed = res.response !== void 0 && !res.response.ok;
   if (res.error !== void 0 && res.error !== null || httpFailed) {
     s.fail();
@@ -632,9 +657,14 @@ async function runApi(label, fn) {
   s.succeed();
   return res.data;
 }
-function fail(error) {
+function formatFailureMessage(error) {
   let msg;
-  if (typeof error === "object" && error !== null && "title" in error) {
+  if (error instanceof Error) {
+    msg = error.message || error.name;
+    if (error.cause instanceof Error && error.cause.message) {
+      msg += `: ${error.cause.message}`;
+    }
+  } else if (typeof error === "object" && error !== null && "title" in error) {
     const problem = error;
     msg = String(problem.title);
     if (problem.errors && typeof problem.errors === "object") {
@@ -649,6 +679,10 @@ ${detail.join("\n")}`;
   } else {
     msg = String(error);
   }
+  return msg;
+}
+function fail(error) {
+  const msg = formatFailureMessage(error);
   process.stderr.write(`error: ${msg}
 `);
   process.exit(1);
@@ -1076,14 +1110,23 @@ function bodyOf(row) {
   const m = row?.item ?? row;
   return m?.text ?? m?.Text ?? "";
 }
+function idOf(row) {
+  const m = row?.item ?? row;
+  return String(m?.id ?? m?.memoryId ?? "unknown");
+}
 function entriesFromRows(rows, surface, source, roleTag, namePrefix) {
   const out = /* @__PURE__ */ new Map();
   for (const row of rows ?? []) {
     const tags = tagsOf(row);
     if (!tags.includes(roleTag)) continue;
-    if (tagValue(tags, "target:") !== surface) continue;
+    if (!tags.includes(`target:${surface}`)) continue;
     const name = tagValue(tags, namePrefix);
     if (!name) continue;
+    if (out.has(name)) {
+      throw new Error(
+        `Ambiguous ${source} ${roleTag} '${name}' for target:${surface}: ${idOf(row)} duplicates another eligible component. Resolve the duplicate before installing.`
+      );
+    }
     out.set(name, { name, body: bodyOf(row), source });
   }
   return out;
@@ -1106,25 +1149,41 @@ function resolveReferences(systemRows, personalRows, surface) {
 }
 
 // src/setup/skill-resolution-io.ts
-var AGENT_TARGET = { "claude-code": "claude-agent" };
+var AGENT_TARGET = {
+  "claude-code": "claude-agent",
+  "gpt-codex": "gpt-codex-agent"
+};
 function agentTargetFor(surface) {
   return AGENT_TARGET[surface] ?? `${surface}-agent`;
 }
 async function fetchFeedRows(cfg, workspaceId) {
-  try {
-    const client = await makeClient(cfg);
-    const feed = await client.GET("/workspaces/{workspaceId}/memories/feed", {
+  const client = await makeClient(cfg);
+  const rows = [];
+  let cursor;
+  do {
+    const { data, error, response } = await client.GET("/workspaces/{workspaceId}/memories/feed", {
       params: {
         path: { workspaceId },
         // cascadeWorkspaces: skills land in an "Operator Skills" SUB-workspace;
         // includeText: the feed omits bodies by default, we need them for SKILL.md.
-        query: { limit: 200, cascadeWorkspaces: true, includeText: true }
+        query: {
+          limit: 200,
+          cascadeWorkspaces: true,
+          includeText: true,
+          ...cursor ? { cursor } : {}
+        }
       }
-    }).then((r) => r.data).catch(() => void 0);
-    return feed?.results ?? feed?.Results ?? [];
-  } catch {
-    return [];
-  }
+    });
+    if (error || !response.ok || !data) {
+      throw new Error(
+        `Could not read operator-skill catalogue from ${workspaceId}: HTTP ${response.status}.`
+      );
+    }
+    const feed = data;
+    rows.push(...feed.results ?? feed.Results ?? []);
+    cursor = feed.nextCursor ?? feed.NextCursor ?? void 0;
+  } while (cursor);
+  return rows;
 }
 async function fetchTemplateRows(cfg, personalWorkspaceId) {
   const [systemRows, personalRows] = await Promise.all([
@@ -1144,7 +1203,10 @@ function resolveReferenceSet(rows, surface) {
 }
 
 // src/setup/materialise.ts
-var CLIENT_SURFACE = "claude-code";
+var CLIENT_SURFACE = {
+  claude: "claude-code",
+  codex: "gpt-codex"
+};
 function writeSkills(dir, skills, surface) {
   const written = [];
   for (const s of skills) {
@@ -1155,12 +1217,58 @@ function writeSkills(dir, skills, surface) {
   if (written.length) recordMaterialisedSkills(dir, DEFAULT_SKILLS_SLUG, written, { surface });
   return written;
 }
+function splitAgentFrontmatter(body) {
+  body = body.replaceAll("\r\n", "\n");
+  if (!body.startsWith("---\n")) return { instructions: body };
+  const end = body.indexOf("\n---\n", 4);
+  if (end < 0) return { instructions: body };
+  const frontmatter = body.slice(4, end);
+  const field = (key) => {
+    const line = frontmatter.split("\n").find((candidate) => candidate.startsWith(`${key}:`));
+    return line?.slice(key.length + 1).trim().replace(/^(["'])(.*)\1$/, "$2");
+  };
+  return { name: field("name"), description: field("description"), instructions: body.slice(end + 5).trimStart() };
+}
+function validateCodexSkills(skills) {
+  for (const skill of skills) {
+    const parsed = splitAgentFrontmatter(skill.body);
+    if (parsed.name !== skill.name || !parsed.description) {
+      throw new Error(
+        `Codex skill '${skill.name}' must begin with YAML frontmatter containing matching name and a description.`
+      );
+    }
+  }
+}
+var WORKER_NAMES = ["substrate-drafter", "substrate-miner", "substrate-verifier"];
+function validateCodexWorkerDependencies(skills, agents) {
+  const available = new Set(agents.map((agent) => agent.name));
+  const missing = WORKER_NAMES.filter(
+    (worker) => skills.some((skill) => skill.body.includes(worker)) && !available.has(worker)
+  );
+  if (missing.length) {
+    throw new Error(`Codex skills reference missing agent template(s): ${missing.join(", ")}.`);
+  }
+}
+function codexAgentToml(agent) {
+  const parsed = splitAgentFrontmatter(agent.body);
+  if (!parsed.description) {
+    throw new Error(`Codex agent '${agent.name}' requires a description in its leading YAML frontmatter.`);
+  }
+  return [
+    `name = ${JSON.stringify(parsed.name || agent.name)}`,
+    `description = ${JSON.stringify(parsed.description)}`,
+    `developer_instructions = ${JSON.stringify(parsed.instructions.trimEnd())}`,
+    ""
+  ].join("\n");
+}
 function writeAgents(dir, agents, surface) {
   if (agents.length) mkdirSync3(dir, { recursive: true });
   const written = [];
   for (const a of agents) {
-    const file = `${a.name}.md`;
-    writeFileSync3(join4(dir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+    const codex = surface === CLIENT_SURFACE.codex;
+    const file = `${a.name}.${codex ? "toml" : "md"}`;
+    const body = codex ? codexAgentToml(a) : a.body.endsWith("\n") ? a.body : a.body + "\n";
+    writeFileSync3(join4(dir, file), body);
     written.push(file);
   }
   if (written.length) recordMaterialisedSkills(dir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -1177,11 +1285,71 @@ function writeReferencesIntoSkillDirs(dir, skills, refs) {
   }
   return refs.map((r) => r.name);
 }
-var SKILL_SPEC = { kind: "skill", dir: skillsDir, resolve: resolveSkillSet, write: writeSkills };
-var AGENT_SPEC = { kind: "agent", dir: agentsDir, resolve: resolveAgentSet, write: writeAgents };
+var SKILL_SPEC = {
+  kind: "skill",
+  dir: skillsDir,
+  resolve: resolveSkillSet,
+  write: writeSkills,
+  supportsCodex: true
+};
+var AGENT_SPEC = {
+  kind: "agent",
+  dir: agentsDir,
+  resolve: resolveAgentSet,
+  write: writeAgents,
+  supportsCodex: true
+};
 function scopeOf(opts) {
   return opts.local ? "project" : resolveScope(opts.scope);
 }
+function parseClient(value) {
+  if (value == null) return void 0;
+  if (value === "claude" || value === "codex" || value === "all") return value;
+  throw new Error(`--client must be 'claude', 'codex', or 'all' (got '${value}')`);
+}
+function clientSelection(spec, g, raw) {
+  if (!spec.supportsCodex) return "claude";
+  const explicit = parseClient(raw);
+  if (explicit) return explicit;
+  const claudeConfigured = Boolean(g.claudeConfigDir || process.env.CLAUDE_CONFIG_DIR);
+  const codexConfigured = Boolean(g.codexHome || process.env.CODEX_HOME);
+  if (claudeConfigured || codexConfigured) {
+    if (claudeConfigured && codexConfigured) return "all";
+    return codexConfigured ? "codex" : "claude";
+  }
+  const claudeDetected = resolveClaudeTargets({})[0]?.dir;
+  const codexDetected = resolveCodexHomes({})[0];
+  const hasClaude = Boolean(claudeDetected && existsSync3(claudeDetected));
+  const hasCodex = Boolean(codexDetected && existsSync3(codexDetected));
+  if (hasClaude && hasCodex) return "all";
+  if (hasCodex) return "codex";
+  return "claude";
+}
+function targetsFor(spec, g, scope, selection) {
+  const clients = selection === "all" ? ["claude", "codex"] : [selection];
+  if (scope === "project" && clients.includes("codex")) {
+    throw new Error("Codex skills have no supported project scope; use --scope global or --client claude.");
+  }
+  const targets = [];
+  for (const client of clients) {
+    if (client === "claude") {
+      targets.push(...resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() }).map((target) => ({
+        client,
+        surface: CLIENT_SURFACE[client],
+        dir: spec.dir(target.dir),
+        label: target.label
+      })));
+      continue;
+    }
+    targets.push(...resolveCodexHomes({ override: g.codexHome, scope }).map((home) => ({
+      client,
+      surface: CLIENT_SURFACE[client],
+      dir: spec.dir(home),
+      label: home
+    })));
+  }
+  return targets;
+}
 async function runInstall(spec, cmd, opts) {
   const g = cmd.optsWithGlobals();
   let scope;
@@ -1193,31 +1361,52 @@ async function runInstall(spec, cmd, opts) {
   const cfg = resolveConfig(g);
   const dryRun = Boolean(opts.dryRun);
   const json = Boolean(g.json || opts.json);
-  const targets = resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() });
+  let selection;
+  let targets;
+  try {
+    selection = clientSelection(spec, g, opts.client);
+    targets = targetsFor(spec, g, scope, selection);
+  } catch (err2) {
+    return fail(err2.message);
+  }
   const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
   const rows = await fetchTemplateRows(cfg, personalWorkspaceId);
-  const items = spec.resolve(rows, CLIENT_SURFACE);
-  const refs = spec.kind === "skill" ? resolveReferenceSet(rows, CLIENT_SURFACE) : [];
   const results = targets.map((t) => {
-    const dir = spec.dir(t.dir);
-    const written = dryRun ? items.map((i) => i.name) : spec.write(dir, items, CLIENT_SURFACE);
-    const refsWritten = dryRun ? refs.map((r) => r.name) : writeReferencesIntoSkillDirs(dir, items, refs);
-    return { dir, label: t.label, written, refsWritten };
+    const items = spec.resolve(rows, t.surface);
+    if (t.client === "codex" && spec.kind === "skill") {
+      validateCodexSkills(items);
+      validateCodexWorkerDependencies(items, resolveAgentSet(rows, t.surface));
+    }
+    const refs = spec.kind === "skill" ? resolveReferenceSet(rows, t.surface) : [];
+    const written = dryRun ? items.map((i) => i.name) : spec.write(t.dir, items, t.surface);
+    const refsWritten = dryRun ? refs.map((r) => r.name) : writeReferencesIntoSkillDirs(t.dir, items, refs);
+    return {
+      client: t.client,
+      surface: t.surface,
+      dir: t.dir,
+      label: t.label,
+      available: items.length,
+      references: refs.length,
+      items: items.map(({ name, source }) => ({ name, source })),
+      referenceItems: refs.map(({ name, source }) => ({ name, source })),
+      written,
+      refsWritten
+    };
   });
-  if (json) return emit({ kind: spec.kind, dryRun, available: items.length, references: refs.length, targets: results }, true);
-  if (items.length === 0) {
+  if (json) return emit({ kind: spec.kind, client: selection, dryRun, targets: results }, true);
+  if (results.every((r) => r.available === 0)) {
     console.log(style.dim(`No ${spec.kind}s available to install \u2014 is the bundle installed for your account?`));
     return;
   }
   for (const r of results) {
     console.log(
-      `${dryRun ? "" : style.green("\u2713 ")}${dryRun ? "would write" : "wrote"} ${r.written.length} ${spec.kind}(s) ${style.dim("\u2192")} ${r.dir}`
+      `${dryRun ? "" : style.green("\u2713 ")}${dryRun ? "would write" : "wrote"} ${r.written.length} ${spec.kind}(s) for ${r.client} ${style.dim("\u2192")} ${r.dir}`
     );
     if (r.refsWritten.length)
       console.log(
         `${dryRun ? "" : style.green("\u2713 ")}${dryRun ? "would write" : "wrote"} ${r.refsWritten.length} reference(s) into each skill ${style.dim("\u2192")} ${r.dir}/<skill>/references`
       );
-    if (dryRun) for (const i of items) console.log(`    ${i.name} ${style.dim(`[${i.source}]`)}`);
+    if (dryRun) for (const i of r.items) console.log(`    ${i.name} ${style.dim(`[${i.source}]`)}`);
   }
 }
 function runList(spec, cmd, opts) {
@@ -1229,16 +1418,22 @@ function runList(spec, cmd, opts) {
     return fail(err2.message);
   }
   const json = Boolean(g.json || opts.json);
-  const targets = resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() });
+  let selection;
+  let targets;
+  try {
+    selection = clientSelection(spec, g, opts.client);
+    targets = targetsFor(spec, g, scope, selection);
+  } catch (err2) {
+    return fail(err2.message);
+  }
   const out = targets.map((t) => {
-    const dir = spec.dir(t.dir);
-    const lock = readSkillsLock(dir);
+    const lock = readSkillsLock(t.dir);
     const entries = Object.entries(lock).flatMap(
-      ([slug, e]) => (e.skills ?? []).map((name) => ({ slug, name, present: existsSync3(join4(dir, name)) }))
+      ([slug, e]) => (e.skills ?? []).map((name) => ({ slug, name, present: existsSync3(join4(t.dir, name)) }))
     );
-    return { dir, label: t.label, entries };
+    return { client: t.client, surface: t.surface, dir: t.dir, label: t.label, entries };
   });
-  if (json) return emit({ kind: spec.kind, targets: out }, true);
+  if (json) return emit({ kind: spec.kind, client: selection, targets: out }, true);
   let any = false;
   for (const t of out) {
     if (t.entries.length === 0) continue;
@@ -1261,33 +1456,39 @@ function runClean(spec, cmd, opts, slugArg) {
     return fail(err2.message);
   }
   const json = Boolean(g.json || opts.json);
-  const targets = resolveClaudeTargets({ override: g.claudeConfigDir, scope, cwd: process.cwd() });
+  let selection;
+  let targets;
+  try {
+    selection = clientSelection(spec, g, opts.client);
+    targets = targetsFor(spec, g, scope, selection);
+  } catch (err2) {
+    return fail(err2.message);
+  }
   const cleaned = [];
   const missing = [];
   for (const t of targets) {
-    const dir = spec.dir(t.dir);
-    const lock = readSkillsLock(dir);
+    const lock = readSkillsLock(t.dir);
     const entry = lock[slug];
     if (!entry) {
-      missing.push(join4(dir, SKILLS_LOCK));
+      missing.push(join4(t.dir, SKILLS_LOCK));
       continue;
     }
     const removed = [];
     for (const name of entry.skills) {
-      const p = join4(dir, name);
+      const p = join4(t.dir, name);
       if (existsSync3(p)) {
         rmSync2(p, { recursive: true, force: true });
         removed.push(name);
       }
     }
     delete lock[slug];
-    writeSkillsLock(dir, lock);
-    cleaned.push({ dir, removed });
+    writeSkillsLock(t.dir, lock);
+    cleaned.push({ client: t.client, surface: t.surface, dir: t.dir, removed });
   }
   if (cleaned.length === 0) {
     return fail(`No materialised ${spec.kind}s recorded for '${slug}' in ${missing.join(", ")}.`);
   }
-  if (json) return emit({ kind: spec.kind, slug, cleaned, missing }, true);
+  if (json) return emit({ kind: spec.kind, client: selection, slug, cleaned, missing }, true);
   for (const c of cleaned) {
     console.log(style.green(`Removed ${c.removed.length} ${spec.kind}(s) for ${slug} from ${c.dir}`));
   }
@@ -1301,22 +1502,24 @@ function registerAgents(program2) {
     `
 Examples:
   $ sechroom agents install                 materialise your installed agents to ~/.claude/agents
+	$ sechroom agents install --client codex  materialise native TOML agents to ~/.codex/agents
   $ sechroom agents install --scope project  write them to ./.claude/agents instead
   $ sechroom agents install --claude-config-dir ~/.claude-work   target another instance
   $ sechroom agents list                     what's materialised on disk
   $ sechroom agents clean                    remove the materialised agent files
 
-Agents are resolved from the agent target (target:claude-agent), the dispatchable
-workers your loop skills call (e.g. find-prior-art \u2192 substrate-miner).`
+Agents are resolved from the client's agent target (target:claude-agent or
+target:gpt-codex-agent), the dispatchable workers your loop skills call
+(e.g. find-prior-art \u2192 substrate-miner).`
   );
-  agents.command("install").description("Materialise your installed subagents to disk (the already-installed bundle \u2014 no server install)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--dry-run", "print what would be written; write nothing").option("--json", "machine output").action((opts, cmd) => runInstall(AGENT_SPEC, cmd, opts));
-  agents.command("list").description("List the subagents materialised on disk (per resolved config dir)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").action((opts, cmd) => runList(AGENT_SPEC, cmd, opts));
-  agents.command("clean [slug]").description(`Remove subagent files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").action((slugArg, opts, cmd) => runClean(AGENT_SPEC, cmd, opts, slugArg));
+  agents.command("install").description("Materialise your installed subagents to disk (the already-installed bundle \u2014 no server install)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--dry-run", "print what would be written; write nothing").option("--client <client>", "claude, codex, or all").option("--json", "machine output").action((opts, cmd) => runInstall(AGENT_SPEC, cmd, opts));
+  agents.command("list").description("List the subagents materialised on disk (per resolved config dir)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").option("--client <client>", "claude, codex, or all").action((opts, cmd) => runList(AGENT_SPEC, cmd, opts));
+  agents.command("clean [slug]").description(`Remove subagent files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").option("--client <client>", "claude, codex, or all").action((slugArg, opts, cmd) => runClean(AGENT_SPEC, cmd, opts, slugArg));
 }
 
 // src/commands/channel.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname4, join as join7 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname6, join as join9 } from "path";
 import {
   HttpTransportType,
   HubConnectionBuilder
@@ -1324,52 +1527,218 @@ import {
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
+// src/commands/executor.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5, join as join8 } from "path";
+
+// src/sem.ts
+import { dirname as dirname2, join as join5 } from "path";
+import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync, readFileSync as readFileSync3, statSync, writeFileSync as writeFileSync4 } from "fs";
+var SEM_FILE = join5(".sechroom", "lane.json");
+var STATE_DIR_NAME2 = ".sechroom";
+function localSemPath(cwd = process.cwd()) {
+  return join5(cwd, SEM_FILE);
+}
+function resolveSemPathForRead(start = process.cwd()) {
+  let dir = start;
+  while (true) {
+    const candidate = join5(dir, SEM_FILE);
+    if (existsSync4(candidate)) return candidate;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function applyWorktreeLaneSuffix(lane, start = process.cwd()) {
+  try {
+    let dir = start;
+    let gitPath;
+    for (; ; ) {
+      const candidate = join5(dir, ".git");
+      if (existsSync4(candidate)) {
+        gitPath = candidate;
+        break;
+      }
+      const parent = dirname2(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+    if (!gitPath || statSync(gitPath).isDirectory()) return lane;
+    const gitFile = readFileSync3(gitPath, "utf8");
+    const common = gitFile.trim().match(/^gitdir:\s*(.+)\/worktrees\/[^/\s]+\s*$/);
+    if (!common) return lane;
+    const worktreesDir = join5(common[1], "worktrees");
+    const siblings = readdirSync(worktreesDir).filter((n) => {
+      try {
+        return statSync(join5(worktreesDir, n)).isDirectory();
+      } catch {
+        return false;
+      }
+    });
+    return laneWithWorktreeSuffix(lane, gitFile, siblings);
+  } catch {
+    return lane;
+  }
+}
+function laneWithWorktreeSuffix(lane, gitFile, siblings) {
+  const m = gitFile.trim().match(/\/worktrees\/([^/\s]+)\s*$/);
+  if (!m) return lane;
+  const idx = [...siblings].sort().indexOf(m[1]);
+  return idx < 0 ? lane : `${lane}-${idx + 2}`;
+}
+function serializeSem(values) {
+  return JSON.stringify(values, null, 2) + "\n";
+}
+function readSem(path) {
+  const p = path ?? resolveSemPathForRead();
+  if (!p || !existsSync4(p)) return void 0;
+  return { path: p, values: parseLaneJson(readFileSync3(p, "utf8")) };
+}
+function readLocalSemValues(cwd = process.cwd()) {
+  const next = join5(cwd, SEM_FILE);
+  if (existsSync4(next)) return readSem(next)?.values ?? {};
+  return {};
+}
+function parseLaneJson(text2) {
+  try {
+    const parsed = JSON.parse(text2);
+    const out = {};
+    for (const [k, v] of Object.entries(parsed)) {
+      if (typeof v === "string") out[k] = v;
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+var STATE_DIR_IGNORE = `${STATE_DIR_NAME2}/`;
+function writeSem(values, path = localSemPath()) {
+  mkdirSync4(dirname2(path), { recursive: true });
+  writeFileSync4(path, serializeSem(values));
+  ensureSemIgnored(path);
+  ensureContinuityScaffold(path);
+  return path;
+}
+function ensureStateDirIgnored(cwd = process.cwd()) {
+  ensureSemIgnored(localSemPath(cwd));
+}
+var CONTINUITY_FILE_NAME = "continuity.json";
+var CONTINUITY_SCAFFOLD = JSON.stringify(
+  {
+    _readme: "Agent-maintained continuity intent. Keep these current during the session; `sechroom checkpoint` and the PreCompact hook snapshot from here. The five required fields (objective, state, lastAction, nextAction, resumeInstruction) must all be non-empty for a snapshot to be created.",
+    objective: "",
+    state: "",
+    lastAction: "",
+    nextAction: "",
+    resumeInstruction: "",
+    constraints: [],
+    questions: [],
+    artifacts: [],
+    confidence: null
+  },
+  null,
+  2
+) + "\n";
+function ensureContinuityScaffold(semPath) {
+  try {
+    const target = join5(dirname2(semPath), CONTINUITY_FILE_NAME);
+    if (existsSync4(target)) return;
+    writeFileSync4(target, CONTINUITY_SCAFFOLD);
+  } catch {
+  }
+}
+function ignoresSem(content) {
+  return content.split("\n").some((line) => {
+    const t = line.trim();
+    return t === STATE_DIR_NAME2 || t === STATE_DIR_IGNORE || t === `/${STATE_DIR_NAME2}` || t === `/${STATE_DIR_IGNORE}` || t === `**/${STATE_DIR_NAME2}` || t === `**/${STATE_DIR_IGNORE}`;
+  });
+}
+function inGitRepo(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    if (existsSync4(join5(dir, ".git"))) return true;
+    const parent = dirname2(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+}
+function resolveGitignoreTarget(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    const gi = join5(dir, ".gitignore");
+    if (existsSync4(gi)) return { path: gi, exists: true };
+    const parent = dirname2(dir);
+    if (existsSync4(join5(dir, ".git")) || parent === dir) {
+      return { path: join5(startDir, ".gitignore"), exists: false };
+    }
+    dir = parent;
+  }
+}
+function ensureSemIgnored(semPath) {
+  try {
+    const checkoutDir = dirname2(dirname2(semPath));
+    if (!inGitRepo(checkoutDir)) return;
+    const target = resolveGitignoreTarget(checkoutDir);
+    if (target.exists) {
+      const content = readFileSync3(target.path, "utf8");
+      if (ignoresSem(content)) return;
+      const sep = content.length === 0 || content.endsWith("\n") ? "" : "\n";
+      appendFileSync(target.path, `${sep}${STATE_DIR_IGNORE}
+`);
+    } else {
+      writeFileSync4(target.path, `${STATE_DIR_IGNORE}
+`);
+    }
+  } catch {
+  }
+}
+
 // src/commands/hook-install.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
-import { delimiter, dirname as dirname3, join as join6 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { delimiter, dirname as dirname4, join as join7 } from "path";
 
 // src/setup/clients.ts
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname3, join as join6 } from "path";
 function claudeDesktopConfigPath(home) {
   switch (process.platform) {
     case "darwin":
-      return join5(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+      return join6(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
     case "win32":
-      return join5(process.env.APPDATA ?? join5(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+      return join6(process.env.APPDATA ?? join6(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
     default:
-      return join5(home, ".config", "Claude", "claude_desktop_config.json");
+      return join6(home, ".config", "Claude", "claude_desktop_config.json");
   }
 }
 function clientTargets(cwd, opts = {}) {
   const home = homedir3();
-  const claudeDir = opts.claudeDir ?? join5(home, ".claude");
-  const codexHome = opts.codexHome ?? join5(home, ".codex");
+  const claudeDir = opts.claudeDir ?? join6(home, ".claude");
+  const codexHome = opts.codexHome ?? join6(home, ".codex");
   return {
     "claude-code": {
       key: "claude-code",
       label: "Claude Code",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join5(cwd, ".mcp.json"), format: "json" },
-      instruction: { surfaceKey: "claude-code", path: join5(cwd, "CLAUDE.md") }
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join6(cwd, ".mcp.json"), format: "json" },
+      instruction: { surfaceKey: "claude-code", path: join6(cwd, "CLAUDE.md") }
     },
     "claude-desktop": {
       key: "claude-desktop",
       label: "Claude Desktop",
       mcp: { surfaceKey: "claude-desktop", sectionType: SectionType.McpConfig, path: claudeDesktopConfigPath(home), format: "json" },
-      instruction: { surfaceKey: "claude-desktop", path: join5(claudeDir, "CLAUDE.md") }
+      instruction: { surfaceKey: "claude-desktop", path: join6(claudeDir, "CLAUDE.md") }
     },
     codex: {
       key: "codex",
       label: "Codex CLI",
-      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join5(codexHome, "config.toml"), format: "toml" },
-      instruction: { surfaceKey: "chatgpt", path: join5(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join6(codexHome, "config.toml"), format: "toml" },
+      instruction: { surfaceKey: "chatgpt", path: join6(cwd, "AGENTS.md") }
     },
     cursor: {
       key: "cursor",
       label: "Cursor",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join5(cwd, ".cursor", "mcp.json"), format: "json" },
-      instruction: { surfaceKey: "chatgpt", path: join5(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join6(cwd, ".cursor", "mcp.json"), format: "json" },
+      instruction: { surfaceKey: "chatgpt", path: join6(cwd, "AGENTS.md") }
     },
     antigravity: {
       key: "antigravity",
@@ -1380,8 +1749,8 @@ function clientTargets(cwd, opts = {}) {
       // `type` — comes from the `antigravity` server surface, so we don't
       // hardcode it here. Instructions go in the project `AGENTS.md`
       // (cross-tool, shared with Codex/Cursor).
-      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join5(home, ".gemini", "config", "mcp_config.json"), format: "json" },
-      instruction: { surfaceKey: "antigravity", path: join5(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join6(home, ".gemini", "config", "mcp_config.json"), format: "json" },
+      instruction: { surfaceKey: "antigravity", path: join6(cwd, "AGENTS.md") }
     }
   };
 }
@@ -1390,11 +1759,11 @@ var DEFAULT_CLIENT_KEY = "claude-code";
 function detectInstalledClients(cwd) {
   const home = homedir3();
   const detected = [];
-  if (resolveClaudeTargets({}).some((t) => existsSync4(t.dir))) detected.push("claude-code");
-  if (existsSync4(dirname2(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
-  if (resolveCodexHomes({}).some((d) => existsSync4(d))) detected.push("codex");
-  if (existsSync4(join5(home, ".cursor")) || existsSync4(join5(cwd, ".cursor"))) detected.push("cursor");
-  if (existsSync4(join5(home, ".gemini"))) detected.push("antigravity");
+  if (resolveClaudeTargets({}).some((t) => existsSync5(t.dir))) detected.push("claude-code");
+  if (existsSync5(dirname3(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
+  if (resolveCodexHomes({}).some((d) => existsSync5(d))) detected.push("codex");
+  if (existsSync5(join6(home, ".cursor")) || existsSync5(join6(cwd, ".cursor"))) detected.push("cursor");
+  if (existsSync5(join6(home, ".gemini"))) detected.push("antigravity");
   return detected;
 }
 
@@ -1403,15 +1772,24 @@ var CLAUDE_HOOK_COMMANDS = {
   SessionStart: "sechroom hook session-start",
   PreCompact: "sechroom hook pre-compact",
   SessionEnd: "sechroom hook session-end",
-  // WLP telemetry tap (D-WLP-10) — per-turn executor self-report. No-op (exit 0) unless this
-  // checkout is bound to a decomposition+task via `sechroom telemetry bind`, so it's safe to wire
-  // for every Claude install. Claude-only (it parses a Claude Code transcript).
-  Stop: "sechroom telemetry hook"
+  // WLP telemetry tap (D-WLP-10 + FR-352 Tier 1) — per-turn executor self-report. The one
+  // `telemetry hook` verb dispatches on hook_event_name: Stop/SubagentStop → parsed (token/context) +
+  // terminal (turn end), Notification/PermissionDenied → approval. No-op (exit 0) unless this checkout
+  // is bound via `sechroom telemetry bind`, so it's safe to wire for every Claude install; an event a
+  // given Claude Code version doesn't know is inert (never fires). Claude-only.
+  Stop: "sechroom telemetry hook",
+  SubagentStop: "sechroom telemetry hook",
+  Notification: "sechroom telemetry hook",
+  PermissionDenied: "sechroom telemetry hook"
 };
 var CODEX_HOOK_COMMANDS = {
   SessionStart: "sechroom hook session-start",
+  PreCompact: "sechroom hook pre-compact",
   Stop: "sechroom hook session-end --debounce-minutes 10"
 };
+function hookCommandsForSurface(surface) {
+  return surface === "claude" ? CLAUDE_HOOK_COMMANDS : CODEX_HOOK_COMMANDS;
+}
 function hasHookCommand(config2, event, command) {
   const groups = config2.hooks?.[event] ?? [];
   return groups.some((g) => (g.hooks ?? []).some((h) => h.type === "command" && h.command === command));
@@ -1428,24 +1806,30 @@ function mergeHooks(config2, commands) {
   return added;
 }
 function readJsonConfig2(path) {
-  if (!existsSync5(path)) return {};
-  const raw = readFileSync3(path, "utf8");
+  if (!existsSync6(path)) return {};
+  const raw = readFileSync4(path, "utf8");
   if (!raw.trim()) return {};
   return JSON.parse(raw);
 }
 function installHooksJson(path, commands, dryRun) {
-  const existed = existsSync5(path) && readFileSync3(path, "utf8").trim().length > 0;
+  const existed = existsSync6(path) && readFileSync4(path, "utf8").trim().length > 0;
   const config2 = readJsonConfig2(path);
   const added = mergeHooks(config2, commands);
   if (added === 0 && existed) return { path, status: "current" };
   if (!dryRun) {
-    mkdirSync4(dirname3(path), { recursive: true });
-    writeFileSync4(path, JSON.stringify(config2, null, 2) + "\n");
+    mkdirSync5(dirname4(path), { recursive: true });
+    writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
   }
   return { path, status: existed ? "merged" : "created" };
 }
 function installClaudeCommands(claudeDir, commands, dryRun) {
-  return installHooksJson(join6(claudeDir, "settings.json"), commands, dryRun);
+  return installHooksJson(join7(claudeDir, "settings.json"), commands, dryRun);
+}
+function installCodexCommands(codexHome, commands, dryRun) {
+  return [
+    installHooksJson(join7(codexHome, "hooks.json"), commands, dryRun),
+    installCodexFeatureFlag(join7(codexHome, "config.toml"), dryRun)
+  ];
 }
 function ensureCodexFeaturesHooks(content) {
   const lines = content.split("\n");
@@ -1468,13 +1852,13 @@ function ensureCodexFeaturesHooks(content) {
   return { next: lines.join("\n"), changed: true };
 }
 function installCodexFeatureFlag(path, dryRun) {
-  const existed = existsSync5(path);
-  const content = existed ? readFileSync3(path, "utf8") : "";
+  const existed = existsSync6(path);
+  const content = existed ? readFileSync4(path, "utf8") : "";
   const { next, changed } = ensureCodexFeaturesHooks(content);
   if (!changed) return { path, status: "current" };
   if (!dryRun) {
-    mkdirSync4(dirname3(path), { recursive: true });
-    writeFileSync4(path, next);
+    mkdirSync5(dirname4(path), { recursive: true });
+    writeFileSync5(path, next);
   }
   return { path, status: existed ? "merged" : "created" };
 }
@@ -1499,11 +1883,11 @@ function installHookSurfaces(surfaces, opts) {
   const out = [];
   for (const surface of surfaces) {
     if (surface === "claude") {
-      const path = join6(opts.claudeDir, "settings.json");
+      const path = join7(opts.claudeDir, "settings.json");
       out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
     } else {
-      const hooksJson = installHooksJson(join6(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
-      const featureFlag = installCodexFeatureFlag(join6(opts.codexHome, "config.toml"), opts.dryRun);
+      const hooksJson = installHooksJson(join7(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
+      const featureFlag = installCodexFeatureFlag(join7(opts.codexHome, "config.toml"), opts.dryRun);
       out.push({ surface, results: [hooksJson, featureFlag] });
     }
   }
@@ -1523,7 +1907,7 @@ function isSechroomOnPath() {
   for (const dir of pathEnv.split(delimiter)) {
     if (!dir) continue;
     for (const name of names) {
-      if (existsSync5(join6(dir, name))) return true;
+      if (existsSync6(join7(dir, name))) return true;
     }
   }
   return false;
@@ -1536,6 +1920,446 @@ function warnIfSechroomNotOnPath(write = (s) => void process.stderr.write(s)) {
   return true;
 }
 
+// src/commands/executor.ts
+function executorSubscriptionInput(name) {
+  return {
+    name,
+    enabled: true,
+    filter: { tags: ["kind:task"], workspaceScope: [] }
+  };
+}
+function executorRegistrationInput(state, deliverySubscriptionId) {
+  return {
+    relayId: state.relayId,
+    instanceKey: state.instanceKey,
+    laneId: state.laneId ?? state.instanceKey,
+    runtimeKind: parseRuntimeKind(state.runtime),
+    activationMode: "Attached",
+    deliverySubscriptionId,
+    connectorId: state.connectorId,
+    claimedCapabilityKeys: state.capabilityKeys,
+    toolSetRef: null,
+    ttlSeconds: state.ttlSeconds
+  };
+}
+var EXECUTOR_STATE = "executor.json";
+var EXECUTOR_PULSE_COMMAND = "sechroom executor hook-pulse";
+var EXECUTOR_STOP_COMMAND = "sechroom executor hook-stop";
+var CLAUDE_EXECUTOR_HOOKS = {
+  SessionStart: EXECUTOR_PULSE_COMMAND,
+  UserPromptSubmit: EXECUTOR_PULSE_COMMAND,
+  PreToolUse: EXECUTOR_PULSE_COMMAND,
+  Stop: EXECUTOR_PULSE_COMMAND,
+  SessionEnd: EXECUTOR_STOP_COMMAND
+};
+var CODEX_EXECUTOR_HOOKS = {
+  SessionStart: EXECUTOR_PULSE_COMMAND,
+  UserPromptSubmit: EXECUTOR_PULSE_COMMAND,
+  PreToolUse: EXECUTOR_PULSE_COMMAND,
+  Stop: EXECUTOR_PULSE_COMMAND
+};
+function registerExecutor(program2) {
+  const executor = program2.command("executor").description(
+    "Register and operate a local Claude Code/Codex executor advertisement"
+  );
+  executor.command("install").description(
+    "Configure this checkout's harness to advertise itself as a WLP executor"
+  ).option("--connector <id>", "Approved local-session ConnectorDefinition id").option(
+    "--instance-key <key>",
+    "Stable executor identity (defaults to .sechroom/lane.json code-lane)"
+  ).option(
+    "--lane-id <lane>",
+    "Canonical affinity lane (defaults to .sechroom/lane.json code-lane)"
+  ).option("--runtime <kind>", "claude-code | codex").option("--surface <surface>", "claude | codex").option(
+    "--capability <key...>",
+    "Capability operation keys claimed by this instance"
+  ).option(
+    "--relay <id>",
+    "Relay identity shared by sibling instances",
+    "sechroom-cli-local"
+  ).option(
+    "--subscription-name <name>",
+    "SignalR delivery binding name",
+    "executor-dispatch"
+  ).option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 600).option(
+    "--refresh-after <seconds>",
+    "Minimum age before a hook refreshes",
+    parseInteger,
+    40
+  ).option(
+    "-y, --yes",
+    "Non-interactive: accept detected surface and lane defaults",
+    false
+  ).option("--dry-run", "Show hook files without writing", false).action(async (opts, cmd) => {
+    const globals = cmd.optsWithGlobals();
+    const lane = readSem()?.values["code-lane"];
+    const detected = detectHookSurfaces(process.cwd());
+    let surface = opts.surface;
+    let instanceKey = opts.instanceKey;
+    let runtime = opts.runtime;
+    let laneId = opts.laneId;
+    let connector = opts.connector;
+    let capabilities = opts.capability;
+    const surfaceDefault = detected.length === 1 ? detected[0] : lane?.includes("codex") ? "codex" : "claude";
+    if (!opts.yes && canPrompt()) {
+      surface = await promptText(
+        "Harness surface (claude or codex)?",
+        surface ?? surfaceDefault
+      );
+      instanceKey = await promptText(
+        "Executor instance key?",
+        instanceKey ?? lane ?? ""
+      );
+      laneId = await promptText(
+        "Executor affinity lane?",
+        laneId ?? lane ?? ""
+      );
+      runtime = await promptText(
+        "Runtime (claude-code or codex)?",
+        runtime ?? (surface === "codex" ? "codex" : "claude-code")
+      );
+      connector = await promptText(
+        "Approved local-session connector id?",
+        connector ?? ""
+      );
+      const capabilityText = await promptText(
+        "Capability keys (comma-separated; blank for none)?",
+        capabilities?.join(",") ?? ""
+      );
+      capabilities = capabilityText.split(",").map((x) => x.trim()).filter(Boolean);
+    }
+    surface ??= surfaceDefault;
+    instanceKey ??= lane;
+    laneId ??= lane;
+    runtime ??= surface === "codex" ? "codex" : "claude-code";
+    if (!connector)
+      fail(
+        "executor install requires --connector (or an interactive connector id)"
+      );
+    if (!instanceKey)
+      fail(
+        "no instance key resolved; pass --instance-key or pin .sechroom/lane.json code-lane"
+      );
+    if (!opts.yes && !canPrompt())
+      fail("non-interactive executor install requires --yes");
+    parseRuntimeKind(runtime);
+    if (!["claude", "codex"].includes(surface))
+      fail("surface must be claude or codex");
+    if (opts.refreshAfter >= opts.ttl)
+      fail("refresh-after must be shorter than the TTL");
+    const sem = readSem();
+    const checkout = sem ? dirname5(dirname5(sem.path)) : process.cwd();
+    const statePath = join8(checkout, ".sechroom", EXECUTOR_STATE);
+    const state = {
+      schemaVersion: 1,
+      instanceKey,
+      laneId,
+      runtime: runtime.toLowerCase() === "codex" ? "codex" : "claude-code",
+      connectorId: connector,
+      capabilityKeys: capabilities ?? [],
+      relayId: opts.relay,
+      subscriptionName: opts.subscriptionName,
+      ttlSeconds: opts.ttl,
+      refreshAfterSeconds: opts.refreshAfter
+    };
+    if (!opts.dryRun) {
+      mkdirSync6(dirname5(statePath), { recursive: true });
+      writeFileSync6(statePath, JSON.stringify(state, null, 2) + "\n");
+      ensureStateDirIgnored(checkout);
+    }
+    const configuredClaudeDirs = globals.claudeConfigDir || process.env.CLAUDE_CONFIG_DIR ? resolveClaudeTargets({ override: globals.claudeConfigDir }).map(
+      (target) => target.dir
+    ) : [join8(checkout, ".claude")];
+    const configuredCodexHomes = globals.codexHome || process.env.CODEX_HOME ? resolveCodexHomes({ override: globals.codexHome }) : [join8(checkout, ".codex")];
+    const hookTargets = surface === "claude" ? configuredClaudeDirs : configuredCodexHomes;
+    for (const target of hookTargets) {
+      const results = surface === "claude" ? [
+        installClaudeCommands(
+          target,
+          CLAUDE_EXECUTOR_HOOKS,
+          opts.dryRun
+        )
+      ] : installCodexCommands(target, CODEX_EXECUTOR_HOOKS, opts.dryRun);
+      for (const result of results)
+        process.stderr.write(describe(result, opts.dryRun) + "\n");
+    }
+    warnIfSechroomNotOnPath();
+    process.stderr.write(
+      style.green("executor harness configured") + style.dim(` \u2014 ${instanceKey}
+`)
+    );
+  });
+  executor.command("hook-pulse").description("Hook adapter: register or refresh this checkout's executor").action(async (_opts, cmd) => {
+    await drainStdin();
+    const located = readExecutorState();
+    if (!located) return;
+    const { state, path } = located;
+    const age = state.lastRefreshAt ? Date.now() - Date.parse(state.lastRefreshAt) : Number.POSITIVE_INFINITY;
+    if (state.instanceId && age < state.refreshAfterSeconds * 1e3) return;
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    try {
+      await ensureExecutorInstance(cfg, { state, path });
+    } catch {
+    }
+  });
+  executor.command("hook-stop").description("Hook adapter: deregister this checkout's executor").action(async (_opts, cmd) => {
+    await drainStdin();
+    const located = readExecutorState();
+    if (!located?.state.instanceId) return;
+    try {
+      await api(
+        resolveConfig(cmd.optsWithGlobals()),
+        `/me/executor-instances/${encodeURIComponent(located.state.instanceId)}`,
+        { method: "DELETE", body: JSON.stringify({}) }
+      );
+      delete located.state.instanceId;
+      delete located.state.lastRefreshAt;
+      writeFileSync6(
+        located.path,
+        JSON.stringify(located.state, null, 2) + "\n"
+      );
+    } catch {
+    }
+  });
+  executor.command("submit-connector").description(
+    "Submit a local-session connector definition for governed approval"
+  ).requiredOption("--slug <slug>", "Unique connector definition slug").requiredOption("--display-name <name>", "Human-readable connector name").requiredOption("--transport <kind>", "push | pull").option("--profile <profile...>", "Advertised runtime profiles", [
+    "base",
+    "dotnet-10"
+  ]).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(cfg, "/connectors/definitions", {
+      method: "POST",
+      body: JSON.stringify({
+        slug: opts.slug,
+        displayName: opts.displayName,
+        runtimeProfiles: opts.profile,
+        connectorKind: "ExecutionRuntime",
+        providerKind: "local-session",
+        dispatchTransport: parseTransport(opts.transport)
+      })
+    });
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+    if (!cmd.optsWithGlobals().json) {
+      process.stderr.write(
+        style.dim(
+          "approve this connector definition before registering executors\n"
+        )
+      );
+    }
+  });
+  executor.command("register").description(
+    "Create/reuse a SignalR binding and register this local executor instance"
+  ).requiredOption(
+    "--instance-key <key>",
+    "Stable key for this concrete session/lane"
+  ).requiredOption(
+    "--connector <id>",
+    "Approved local-session ConnectorDefinition id"
+  ).option("--runtime <kind>", "claude-code | codex", "claude-code").option(
+    "--lane-id <lane>",
+    "Canonical affinity lane (defaults to instance key)"
+  ).option(
+    "--relay <id>",
+    "Relay identity shared by sibling instances",
+    "sechroom-cli-local"
+  ).option(
+    "--subscription-name <name>",
+    "SignalR delivery binding name",
+    "executor-dispatch"
+  ).option(
+    "--capability <key...>",
+    "Capability operation keys claimed by this instance"
+  ).option("--tool-set-ref <ref>", "Optional governed tool-set reference").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const subscription = await api(
+      cfg,
+      "/me/delivery-subscriptions/signalr",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          name: opts.subscriptionName,
+          enabled: true,
+          // Exact executor fanout ignores this generic filter; the fixed tag only
+          // satisfies the legacy SignalR subscription shape.
+          filter: { tags: ["kind:task"], workspaceScope: [] }
+        })
+      }
+    );
+    const data = await api(
+      cfg,
+      "/me/executor-instances",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          relayId: opts.relay,
+          instanceKey: opts.instanceKey,
+          laneId: opts.laneId ?? opts.instanceKey,
+          runtimeKind: parseRuntimeKind(opts.runtime),
+          activationMode: "Attached",
+          deliverySubscriptionId: subscription.id,
+          connectorId: opts.connector,
+          claimedCapabilityKeys: opts.capability ?? [],
+          toolSetRef: opts.toolSetRef ?? null,
+          ttlSeconds: opts.ttl
+        })
+      }
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+    if (!cmd.optsWithGlobals().json)
+      process.stderr.write(
+        style.dim(`refresh with: sechroom executor heartbeat ${data.id}
+`)
+      );
+  });
+  executor.command("refresh <id>").description("Refresh one advertisement lease once").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (id, opts, cmd) => {
+    const data = await refreshExecutorInstance(
+      resolveConfig(cmd.optsWithGlobals()),
+      id,
+      opts.ttl
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+  });
+  executor.command("heartbeat <id>").description("Keep an advertisement alive until interrupted").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).option("--interval <seconds>", "Refresh interval", parseInteger, 40).action(async (id, opts, cmd) => {
+    if (opts.interval >= opts.ttl)
+      fail("heartbeat interval must be shorter than the TTL");
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    await refreshExecutorInstance(cfg, id, opts.ttl);
+    process.stderr.write(
+      style.green("executor heartbeat active") + style.dim(` \u2014 ${id}
+`)
+    );
+    await holdHeartbeat(async () => {
+      await refreshExecutorInstance(cfg, id, opts.ttl);
+    }, opts.interval * 1e3);
+  });
+  executor.command("offers <id>").description("List live dispatch offers addressed to this exact instance").action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(id)}/dispatch-offers`
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+  });
+  executor.command("deregister <id>").description("Stop advertising this executor instance").action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(id)}`,
+      {
+        method: "DELETE",
+        body: JSON.stringify({})
+      }
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+  });
+}
+function parseRuntimeKind(value) {
+  switch (value.trim().toLowerCase()) {
+    case "claude":
+    case "claude-code":
+      return "ClaudeCode";
+    case "codex":
+      return "Codex";
+    default:
+      return fail("runtime must be claude-code or codex");
+  }
+}
+function parseTransport(value) {
+  switch (value.trim().toLowerCase()) {
+    case "push":
+      return "Push";
+    case "pull":
+      return "Pull";
+    default:
+      return fail("transport must be push or pull");
+  }
+}
+async function refreshExecutorInstance(cfg, id, ttlSeconds) {
+  return api(
+    cfg,
+    `/me/executor-instances/${encodeURIComponent(id)}/refresh`,
+    {
+      method: "POST",
+      body: JSON.stringify({ ttlSeconds })
+    }
+  );
+}
+async function registerInstance(cfg, state) {
+  const subscription = await api(
+    cfg,
+    "/me/delivery-subscriptions/signalr",
+    {
+      method: "POST",
+      body: JSON.stringify(executorSubscriptionInput(state.subscriptionName))
+    }
+  );
+  return api(cfg, "/me/executor-instances", {
+    method: "POST",
+    body: JSON.stringify(executorRegistrationInput(state, subscription.id))
+  });
+}
+async function ensureExecutorInstance(cfg, located) {
+  const { state, path } = located;
+  state.laneId ??= state.instanceKey;
+  const data = await registerInstance(cfg, state);
+  state.instanceId = data.id;
+  state.lastRefreshAt = (/* @__PURE__ */ new Date()).toISOString();
+  writeFileSync6(path, JSON.stringify(state, null, 2) + "\n");
+  return data;
+}
+function readExecutorState(start = process.cwd()) {
+  const semPath = resolveSemPathForRead(start);
+  const sem = semPath ? readSem(semPath) : void 0;
+  const path = join8(
+    sem ? dirname5(sem.path) : join8(start, ".sechroom"),
+    EXECUTOR_STATE
+  );
+  if (!existsSync7(path)) return void 0;
+  return {
+    state: JSON.parse(readFileSync5(path, "utf8")),
+    path
+  };
+}
+async function drainStdin() {
+  if (process.stdin.isTTY) return;
+  for await (const _chunk of process.stdin) {
+  }
+}
+async function api(cfg, path, init) {
+  const token = await requireToken(cfg);
+  const response = await fetch(`${cfg.baseUrl}${path}`, {
+    ...init,
+    headers: {
+      authorization: `Bearer ${token}`,
+      tenant: cfg.tenant,
+      "content-type": "application/json",
+      "x-sechroom-surface": "cli"
+    }
+  });
+  if (!response.ok)
+    fail(
+      `${init?.method ?? "GET"} ${path} failed (${response.status}): ${await response.text()}`
+    );
+  return response.json();
+}
+function parseInteger(value) {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isFinite(parsed)) fail(`expected an integer, got '${value}'`);
+  return parsed;
+}
+function holdHeartbeat(tick, intervalMs) {
+  return new Promise((resolve3, reject) => {
+    const timer = setInterval(() => void tick().catch(reject), intervalMs);
+    const stop = () => {
+      clearInterval(timer);
+      resolve3();
+    };
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+  });
+}
+
 // src/commands/channel.ts
 function registerChannel(program2) {
   const channel = program2.command("channel").description(
@@ -1543,13 +2367,17 @@ function registerChannel(program2) {
   );
   const withFilterOpts = (c) => c.option(
     "--name <name>",
-    "Subscription name (idempotent per name)",
-    "wlp-dispatch"
+    "Deprecated: ignored; the installed executor selects its delivery subscription"
   ).option(
     "--tag <tag...>",
-    "Tag(s) the event must carry to match (repeatable). Default targets WLP task dispatches.",
-    ["kind:task"]
-  ).option("--workspace <wsp...>", "Restrict to these workspace id(s)");
+    "Deprecated: executor eligibility comes from the installed capability advertisement"
+  ).option(
+    "--workspace <wsp...>",
+    "Deprecated: workspace authority is resolved by the server"
+  ).option(
+    "--executor-instance <id>",
+    "Deprecated: the instance is read from .sechroom/executor.json"
+  );
   withFilterOpts(
     channel.command("connect").description(
       "Register a SignalR subscription and stream matched events to stdout"
@@ -1557,37 +2385,54 @@ function registerChannel(program2) {
   ).action(async (opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const filter = readFilter(opts);
-    const sub = await ensureSubscription(cfg, opts.name, filter);
-    const seen = /* @__PURE__ */ new Set();
-    const deliver = makeDeliver(
-      filter,
-      seen,
-      (payload) => process.stdout.write(
-        (typeof payload === "string" ? payload : JSON.stringify(payload)) + "\n"
-      )
+    warnLegacyChannelOptions(opts);
+    const located = requireExecutorState();
+    const instance = await ensureExecutorInstance(cfg, located);
+    const deliver = (payload) => process.stdout.write(
+      (typeof payload === "string" ? payload : JSON.stringify(payload)) + "\n"
+    );
+    const drain = createClaimDrain(cfg, instance.id, deliver);
+    const conn = await openConnection(
+      cfg,
+      () => {
+        void drain().catch(
+          (e) => process.stderr.write(err(`channel claim failed: ${String(e)}
+`))
+        );
+      },
+      instance.id
+    );
+    await drain();
+    const stopReconciliation = startOfferReconciliation(drain);
+    const stopHeartbeat = startExecutorHeartbeat(
+      () => refreshExecutorInstance(cfg, instance.id, located.state.ttlSeconds),
+      located.state.refreshAfterSeconds * 1e3
     );
-    const conn = await openConnection(cfg, deliver);
-    await reconcile(cfg, filter, deliver);
     if (json) {
       emit(
         {
           connected: true,
           tenant: cfg.tenant,
-          subscriptionId: sub.id ?? opts.name,
-          filter
+          executorInstanceId: instance.id,
+          instanceKey: located.state.instanceKey,
+          laneId: located.state.laneId
         },
         true
       );
     } else {
       process.stderr.write(
         style.green("channel connected") + style.dim(
-          ` \u2014 tenant ${cfg.tenant}, sub ${sub.id ?? opts.name}, tags [${filter.tags.join(", ")}]
+          ` \u2014 tenant ${cfg.tenant}, executor ${located.state.instanceKey}
 `
         ) + style.dim("streaming matched events to stdout; Ctrl-C to stop.\n")
       );
     }
-    await holdOpen(conn);
+    try {
+      await holdOpen(conn);
+    } finally {
+      stopReconciliation();
+      stopHeartbeat();
+    }
   });
   withFilterOpts(
     channel.command("mcp").description(
@@ -1595,18 +2440,18 @@ function registerChannel(program2) {
     )
   ).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const filter = readFilter(opts);
+    warnLegacyChannelOptions(opts);
+    const located = requireExecutorState();
+    const instance = await ensureExecutorInstance(cfg, located);
     const mcp = new Server(
       { name: "sechroom", version: "0.1.0" },
       {
         capabilities: { experimental: { "claude/channel": {} } },
-        instructions: 'Matched Sechroom substrate events arrive as <channel source="sechroom"> tags. A WLP dispatch (kind:task \u2192 status:in-progress) means a task is runnable now: load the memory id from the event, do the work, then write a closeout memory tagged wlp-decomposition:{id} + wlp-task:{taskId} + verdict:{pass|soft-fail|plan-invalid|blocked}.'
+        instructions: 'Matched Sechroom substrate events arrive as <channel source="sechroom"> tags. A WLP dispatch delivered here has already been atomically claimed for this executor. Load the memory id from the event and retain the lease and claim token for holder-bound completion.'
       }
     );
     await mcp.connect(new StdioServerTransport());
-    await ensureSubscription(cfg, opts.name, filter);
-    const seen = /* @__PURE__ */ new Set();
-    const deliver = makeDeliver(filter, seen, (payload) => {
+    const deliver = (payload) => {
       const { content, meta } = summarizeEvent(payload);
       void mcp.notification({
         method: "notifications/claude/channel",
@@ -1615,37 +2460,53 @@ function registerChannel(program2) {
         (e) => process.stderr.write(err(`channel push failed: ${String(e)}
 `))
       );
-    });
-    const conn = await openConnection(cfg, deliver);
-    await reconcile(cfg, filter, deliver);
+    };
+    const drain = createClaimDrain(cfg, instance.id, deliver);
+    const conn = await openConnection(
+      cfg,
+      () => {
+        void drain().catch(
+          (e) => process.stderr.write(err(`channel claim failed: ${String(e)}
+`))
+        );
+      },
+      instance.id
+    );
+    await drain();
+    const stopReconciliation = startOfferReconciliation(drain);
+    const stopHeartbeat = startExecutorHeartbeat(
+      () => refreshExecutorInstance(cfg, instance.id, located.state.ttlSeconds),
+      located.state.refreshAfterSeconds * 1e3
+    );
     process.stderr.write(
       style.dim(
-        `sechroom channel (mcp) \u2014 tenant ${cfg.tenant}, tags [${filter.tags.join(", ")}]
+        `sechroom channel (mcp) \u2014 tenant ${cfg.tenant}, executor ${located.state.instanceKey}
 `
       )
     );
-    await holdOpen(conn);
+    try {
+      await holdOpen(conn);
+    } finally {
+      stopReconciliation();
+      stopHeartbeat();
+    }
   });
   channel.command("install").description(
     "Wire `sechroom channel mcp` into the project .mcp.json as a Claude Code channel MCP server (idempotent)"
   ).option(
     "--workspace <wsp...>",
-    "Restrict dispatches to these workspace id(s)"
+    "Deprecated: accepted only to migrate an existing managed entry"
   ).option(
     "--tag <tag...>",
-    "Tag(s) a dispatch must carry to match (repeatable). Default targets WLP task dispatches.",
-    ["kind:task"]
+    "Deprecated: accepted only to migrate an existing managed entry"
   ).option(
     "--name <name>",
     "MCP server + subscription name (idempotent per name)",
     "sechroom-channel"
   ).option("--dry-run", "Print what would change; write nothing").action((opts) => {
-    const path = join7(process.cwd(), ".mcp.json");
+    const path = join9(process.cwd(), ".mcp.json");
     const dryRun = Boolean(opts.dryRun);
-    const args = ["channel", "mcp", "--name", opts.name];
-    for (const w of opts.workspace ?? [])
-      args.push("--workspace", w);
-    for (const t of opts.tag ?? []) args.push("--tag", t);
+    const args = ["channel", "mcp"];
     const entry = { command: "sechroom", args };
     const config2 = readMcpConfig(path);
     config2.mcpServers ??= {};
@@ -1653,8 +2514,8 @@ function registerChannel(program2) {
     const status = JSON.stringify(existing) === JSON.stringify(entry) ? "current" : existing ? "updated" : "created";
     if (status !== "current" && !dryRun) {
       config2.mcpServers[opts.name] = entry;
-      mkdirSync5(dirname4(path), { recursive: true });
-      writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
+      mkdirSync7(dirname6(path), { recursive: true });
+      writeFileSync7(path, JSON.stringify(config2, null, 2) + "\n");
     }
     const verb = status === "current" ? "already configured" : dryRun ? `would ${status === "created" ? "create" : "update"}` : status;
     process.stdout.write(`${style.green("channel")} ${path} (${verb})
@@ -1673,24 +2534,125 @@ Load it (Channels research preview) by launching your agent with:
         )
       );
     }
-    warnIfSechroomNotOnPath();
-  });
-  channel.addHelpText(
-    "after",
-    `
-Examples:
-  $ sechroom channel connect                         stream WLP task dispatches to stdout
-  $ sechroom channel connect --tag kind:task --tag status:in-progress
-  $ sechroom channel connect --workspace wsp_X --json | jq .
-
-  # Wire it as a Claude Code channel MCP server (research preview, v2.1.80+):
-  $ sechroom channel install --workspace wsp_X --tag kind:task --tag status:in-progress
-  #   then:  claude --dangerously-load-development-channels server:sechroom-channel`
-  );
+    warnIfSechroomNotOnPath();
+    if ((opts.workspace?.length ?? 0) > 0 || (opts.tag?.length ?? 0) > 0)
+      process.stderr.write(
+        style.dim(
+          "channel: --workspace/--tag are retired; the managed entry now uses the installed executor advertisement.\n"
+        )
+      );
+  });
+  channel.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom executor install                        configure capability + lane advertisement
+  $ sechroom channel connect                         claim WLP dispatches and stream them to stdout
+
+  # Wire it as a Claude Code channel MCP server (research preview, v2.1.80+):
+  $ sechroom channel install                          migrate/install the exact-instance channel
+  #   then:  claude --dangerously-load-development-channels server:sechroom-channel`
+  );
+}
+function requireExecutorState() {
+  const located = readExecutorState();
+  if (!located)
+    return fail(
+      "channel requires an installed executor advertisement; run `sechroom executor install` first."
+    );
+  return located;
+}
+function warnLegacyChannelOptions(opts) {
+  if (!opts.name && (opts.workspace?.length ?? 0) === 0 && (opts.tag?.length ?? 0) === 0 && !opts.executorInstance)
+    return;
+  process.stderr.write(
+    style.dim(
+      "channel: --name, --workspace, --tag, and --executor-instance are retired; delivery, eligibility, and identity come from the installed executor advertisement.\n"
+    )
+  );
+}
+function createClaimDrain(cfg, executorInstanceId, deliver, dependencies = {}) {
+  let active2;
+  const state = {};
+  return () => {
+    active2 ??= drainClaims(cfg, executorInstanceId, deliver, {
+      ...dependencies,
+      state
+    }).finally(() => {
+      active2 = void 0;
+    });
+    return active2;
+  };
+}
+function startOfferReconciliation(drain, intervalMilliseconds = 5e3, dependencies = {}) {
+  const schedule = dependencies.setInterval ?? setInterval;
+  const cancel = dependencies.clearInterval ?? clearInterval;
+  const onError = dependencies.onError ?? ((error) => process.stderr.write(err(`channel claim failed: ${String(error)}
+`)));
+  const timer = schedule(() => {
+    void drain().catch(onError);
+  }, intervalMilliseconds);
+  return () => cancel(timer);
+}
+function startExecutorHeartbeat(refresh, intervalMilliseconds, dependencies = {}) {
+  const schedule = dependencies.setInterval ?? setInterval;
+  const cancel = dependencies.clearInterval ?? clearInterval;
+  const onError = dependencies.onError ?? ((error) => process.stderr.write(err(`channel heartbeat failed: ${String(error)}
+`)));
+  const timer = schedule(() => {
+    void refresh().catch(onError);
+  }, intervalMilliseconds);
+  return () => cancel(timer);
+}
+async function drainClaims(cfg, executorInstanceId, deliver, dependencies = {}) {
+  const request = dependencies.request ?? api;
+  const sleep = dependencies.sleep ?? ((milliseconds) => new Promise((resolve3) => setTimeout(resolve3, milliseconds)));
+  const idempotencyKey = dependencies.idempotencyKey ?? ((offer) => `channel:${offer.generationId}`);
+  const state = dependencies.state ?? {};
+  for (; ; ) {
+    if (state.pendingIdempotencyKey) {
+      const replay = await request(
+        cfg,
+        `/me/executor-instances/${encodeURIComponent(executorInstanceId)}/dispatch-offers/claim-next`,
+        {
+          method: "POST",
+          body: JSON.stringify({ idempotencyKey: state.pendingIdempotencyKey })
+        }
+      );
+      state.pendingIdempotencyKey = void 0;
+      if (replay.outcome === "Claimed" || replay.outcome === "AlreadyHeld") {
+        deliver(replay);
+        continue;
+      }
+      return;
+    }
+    const offers = await request(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(executorInstanceId)}/dispatch-offers`
+    );
+    const offer = offers[0];
+    if (!offer) return;
+    if (offer.suggestedClaimDelayMs > 0)
+      await sleep(offer.suggestedClaimDelayMs);
+    state.pendingIdempotencyKey = idempotencyKey(offer);
+    const claim = await request(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(executorInstanceId)}/dispatch-offers/claim-next`,
+      {
+        method: "POST",
+        body: JSON.stringify({ idempotencyKey: state.pendingIdempotencyKey })
+      }
+    );
+    state.pendingIdempotencyKey = void 0;
+    if (claim.outcome === "NoOffer") return;
+    if (claim.outcome === "Claimed" || claim.outcome === "AlreadyHeld")
+      deliver(claim);
+    else return;
+  }
 }
 function readMcpConfig(path) {
-  if (!existsSync6(path)) return {};
-  const raw = readFileSync4(path, "utf8");
+  if (!existsSync8(path)) return {};
+  const raw = readFileSync6(path, "utf8");
   if (!raw.trim()) return {};
   try {
     return JSON.parse(raw);
@@ -1700,35 +2662,9 @@ function readMcpConfig(path) {
     );
   }
 }
-function readFilter(opts) {
-  const tags = opts.tag ?? [];
-  const workspaceScope = opts.workspace ?? [];
-  if (tags.length === 0 && workspaceScope.length === 0)
-    fail(
-      "A channel subscription needs at least one --tag or --workspace (an empty filter receives nothing)."
-    );
-  return { tags, workspaceScope };
-}
-async function ensureSubscription(cfg, name, filter) {
-  const token = await requireToken(cfg);
-  const resp = await fetch(`${cfg.baseUrl}/me/delivery-subscriptions/signalr`, {
-    method: "POST",
-    headers: {
-      authorization: `Bearer ${token}`,
-      tenant: cfg.tenant,
-      "content-type": "application/json",
-      "x-sechroom-surface": "cli"
-    },
-    body: JSON.stringify({ name, enabled: true, filter })
-  });
-  if (!resp.ok)
-    fail(
-      `Could not register the SignalR subscription (HTTP ${resp.status}): ${await resp.text()}`
-    );
-  return await resp.json();
-}
-async function openConnection(cfg, onEvent) {
-  const conn = new HubConnectionBuilder().withUrl(`${cfg.baseUrl}/notifications/${cfg.tenant}`, {
+async function openConnection(cfg, onEvent, executorInstanceId) {
+  const query = executorInstanceId ? `?executorInstanceId=${encodeURIComponent(executorInstanceId)}` : "";
+  const conn = new HubConnectionBuilder().withUrl(`${cfg.baseUrl}/notifications/${cfg.tenant}${query}`, {
     transport: HttpTransportType.LongPolling,
     accessTokenFactory: () => requireToken(cfg)
   }).withAutomaticReconnect().build();
@@ -1762,7 +2698,8 @@ function parseEvent(payload) {
     }
   }
   const obj = data ?? {};
-  const inner = obj.data ?? obj;
+  const envelope = obj.data ?? obj;
+  const inner = envelope.offer ?? envelope;
   const rawTags = inner.tags ?? inner.Tags;
   return {
     eventType: str(inner.eventType ?? inner.EventType ?? obj.type) || "substrate.event",
@@ -1771,113 +2708,6 @@ function parseEvent(payload) {
     tags: Array.isArray(rawTags) ? rawTags.filter((t) => typeof t === "string") : void 0
   };
 }
-function shouldDeliver(payload, filter) {
-  const { workspaceId, tags } = parseEvent(payload);
-  if (filter.workspaceScope.length > 0 && (!workspaceId || !filter.workspaceScope.includes(workspaceId)))
-    return false;
-  if (filter.tags.length > 0) {
-    if (!tags) return false;
-    return facetedTagMatch(tags, filter.tags);
-  }
-  return true;
-}
-function makeDeliver(filter, seen, forward) {
-  return (payload) => {
-    if (!shouldDeliver(payload, filter)) return;
-    const { memoryId } = parseEvent(payload);
-    if (memoryId) {
-      if (seen.has(memoryId)) return;
-      seen.add(memoryId);
-    }
-    forward(payload);
-  };
-}
-async function reconcile(cfg, filter, deliver) {
-  if (filter.workspaceScope.length === 0) {
-    process.stderr.write(
-      style.dim(
-        "channel: no --workspace to reconcile against; live feed only (a dropped dispatch won't be recovered).\n"
-      )
-    );
-    return;
-  }
-  if (filter.tags.length === 0) return;
-  let token;
-  try {
-    token = await requireToken(cfg);
-  } catch {
-    return;
-  }
-  const qs = `filterTags=${encodeURIComponent(filter.tags.join(","))}&limit=100`;
-  let recovered = 0;
-  for (const ws of filter.workspaceScope) {
-    try {
-      const resp = await fetch(
-        `${cfg.baseUrl}/workspaces/${encodeURIComponent(ws)}/memories/feed?${qs}`,
-        {
-          headers: {
-            authorization: `Bearer ${token}`,
-            tenant: cfg.tenant,
-            "x-sechroom-surface": "cli"
-          }
-        }
-      );
-      if (!resp.ok) {
-        process.stderr.write(
-          err(
-            `channel: reconcile query for ${ws} failed (HTTP ${resp.status})
-`
-          )
-        );
-        continue;
-      }
-      const data = await resp.json();
-      for (const m of data.results ?? []) {
-        if (!m.id) continue;
-        deliver({
-          eventType: "reconcile",
-          memoryId: m.id,
-          workspaceId: ws,
-          tags: m.tags ?? []
-        });
-        recovered++;
-      }
-    } catch (e) {
-      process.stderr.write(
-        err(`channel: reconcile error for ${ws}: ${String(e)}
-`)
-      );
-    }
-  }
-  if (recovered > 0)
-    process.stderr.write(
-      style.dim(
-        `channel: reconciled ${recovered} already-queued event(s) on connect.
-`
-      )
-    );
-}
-function facetedTagMatch(eventTags, filterTags) {
-  const have = new Set(eventTags);
-  const groups = /* @__PURE__ */ new Map();
-  for (const f of filterTags) {
-    const ns = f.endsWith(":*") ? f.slice(0, -2) : namespaceOf(f);
-    const group = groups.get(ns) ?? [];
-    group.push(f);
-    groups.set(ns, group);
-  }
-  for (const [ns, group] of groups) {
-    const ok2 = group.some(
-      (f) => f.endsWith(":*") ? eventTags.some((t) => namespaceOf(t) === ns) : have.has(f)
-    );
-    if (!ok2) return false;
-  }
-  return true;
-}
-function namespaceOf(tag) {
-  const i = tag.indexOf(":");
-  return i >= 0 ? tag.slice(0, i) : tag;
-}
 function summarizeEvent(payload) {
   const { eventType, memoryId, workspaceId } = parseEvent(payload);
   const content = memoryId ? `${eventType}: ${memoryId}${workspaceId ? ` (workspace ${workspaceId})` : ""}` : typeof payload === "string" ? payload : JSON.stringify(payload);
@@ -1885,6 +2715,10 @@ function summarizeEvent(payload) {
   if (eventType) meta.event_type = eventType;
   if (memoryId) meta.memory_id = memoryId;
   if (workspaceId) meta.workspace_id = workspaceId;
+  const claim = payload ?? {};
+  if (claim.outcome) meta.claim_outcome = claim.outcome;
+  if (claim.lease?.id) meta.lease_id = claim.lease.id;
+  if (claim.claimToken) meta.claim_token = claim.claimToken;
   return { content, meta };
 }
 function str(v) {
@@ -1974,177 +2808,13 @@ Examples:
 }
 
 // src/commands/checkpoint.ts
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname7, join as join10 } from "path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname8, join as join11 } from "path";
 
 // src/commands/hook.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync6, statSync as statSync2, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname6, join as join9 } from "path";
-
-// src/sem.ts
-import { dirname as dirname5, join as join8 } from "path";
-import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync6 } from "fs";
-var SEM_FILE = join8(".sechroom", "lane.json");
-var STATE_DIR_NAME2 = ".sechroom";
-function localSemPath(cwd = process.cwd()) {
-  return join8(cwd, SEM_FILE);
-}
-function resolveSemPathForRead(start = process.cwd()) {
-  let dir = start;
-  while (true) {
-    const candidate = join8(dir, SEM_FILE);
-    if (existsSync7(candidate)) return candidate;
-    const parent = dirname5(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
-  }
-}
-function applyWorktreeLaneSuffix(lane, start = process.cwd()) {
-  try {
-    let dir = start;
-    let gitPath;
-    for (; ; ) {
-      const candidate = join8(dir, ".git");
-      if (existsSync7(candidate)) {
-        gitPath = candidate;
-        break;
-      }
-      const parent = dirname5(dir);
-      if (parent === dir) break;
-      dir = parent;
-    }
-    if (!gitPath || statSync(gitPath).isDirectory()) return lane;
-    const gitFile = readFileSync5(gitPath, "utf8");
-    const common = gitFile.trim().match(/^gitdir:\s*(.+)\/worktrees\/[^/\s]+\s*$/);
-    if (!common) return lane;
-    const worktreesDir = join8(common[1], "worktrees");
-    const siblings = readdirSync(worktreesDir).filter((n) => {
-      try {
-        return statSync(join8(worktreesDir, n)).isDirectory();
-      } catch {
-        return false;
-      }
-    });
-    return laneWithWorktreeSuffix(lane, gitFile, siblings);
-  } catch {
-    return lane;
-  }
-}
-function laneWithWorktreeSuffix(lane, gitFile, siblings) {
-  const m = gitFile.trim().match(/\/worktrees\/([^/\s]+)\s*$/);
-  if (!m) return lane;
-  const idx = [...siblings].sort().indexOf(m[1]);
-  return idx < 0 ? lane : `${lane}-${idx + 2}`;
-}
-function serializeSem(values) {
-  return JSON.stringify(values, null, 2) + "\n";
-}
-function readSem(path) {
-  const p = path ?? resolveSemPathForRead();
-  if (!p || !existsSync7(p)) return void 0;
-  return { path: p, values: parseLaneJson(readFileSync5(p, "utf8")) };
-}
-function readLocalSemValues(cwd = process.cwd()) {
-  const next = join8(cwd, SEM_FILE);
-  if (existsSync7(next)) return readSem(next)?.values ?? {};
-  return {};
-}
-function parseLaneJson(text2) {
-  try {
-    const parsed = JSON.parse(text2);
-    const out = {};
-    for (const [k, v] of Object.entries(parsed)) {
-      if (typeof v === "string") out[k] = v;
-    }
-    return out;
-  } catch {
-    return {};
-  }
-}
-var STATE_DIR_IGNORE = `${STATE_DIR_NAME2}/`;
-function writeSem(values, path = localSemPath()) {
-  mkdirSync6(dirname5(path), { recursive: true });
-  writeFileSync6(path, serializeSem(values));
-  ensureSemIgnored(path);
-  ensureContinuityScaffold(path);
-  return path;
-}
-function ensureStateDirIgnored(cwd = process.cwd()) {
-  ensureSemIgnored(localSemPath(cwd));
-}
-var CONTINUITY_FILE_NAME = "continuity.json";
-var CONTINUITY_SCAFFOLD = JSON.stringify(
-  {
-    _readme: "Agent-maintained continuity intent. Keep these current during the session; `sechroom checkpoint` and the PreCompact hook snapshot from here. The five required fields (objective, state, lastAction, nextAction, resumeInstruction) must all be non-empty for a snapshot to be created.",
-    objective: "",
-    state: "",
-    lastAction: "",
-    nextAction: "",
-    resumeInstruction: "",
-    constraints: [],
-    questions: [],
-    artifacts: [],
-    confidence: null
-  },
-  null,
-  2
-) + "\n";
-function ensureContinuityScaffold(semPath) {
-  try {
-    const target = join8(dirname5(semPath), CONTINUITY_FILE_NAME);
-    if (existsSync7(target)) return;
-    writeFileSync6(target, CONTINUITY_SCAFFOLD);
-  } catch {
-  }
-}
-function ignoresSem(content) {
-  return content.split("\n").some((line) => {
-    const t = line.trim();
-    return t === STATE_DIR_NAME2 || t === STATE_DIR_IGNORE || t === `/${STATE_DIR_NAME2}` || t === `/${STATE_DIR_IGNORE}` || t === `**/${STATE_DIR_NAME2}` || t === `**/${STATE_DIR_IGNORE}`;
-  });
-}
-function inGitRepo(startDir) {
-  let dir = startDir;
-  for (; ; ) {
-    if (existsSync7(join8(dir, ".git"))) return true;
-    const parent = dirname5(dir);
-    if (parent === dir) return false;
-    dir = parent;
-  }
-}
-function resolveGitignoreTarget(startDir) {
-  let dir = startDir;
-  for (; ; ) {
-    const gi = join8(dir, ".gitignore");
-    if (existsSync7(gi)) return { path: gi, exists: true };
-    const parent = dirname5(dir);
-    if (existsSync7(join8(dir, ".git")) || parent === dir) {
-      return { path: join8(startDir, ".gitignore"), exists: false };
-    }
-    dir = parent;
-  }
-}
-function ensureSemIgnored(semPath) {
-  try {
-    const checkoutDir = dirname5(dirname5(semPath));
-    if (!inGitRepo(checkoutDir)) return;
-    const target = resolveGitignoreTarget(checkoutDir);
-    if (target.exists) {
-      const content = readFileSync5(target.path, "utf8");
-      if (ignoresSem(content)) return;
-      const sep = content.length === 0 || content.endsWith("\n") ? "" : "\n";
-      appendFileSync(target.path, `${sep}${STATE_DIR_IGNORE}
-`);
-    } else {
-      writeFileSync6(target.path, `${STATE_DIR_IGNORE}
-`);
-    }
-  } catch {
-  }
-}
-
-// src/commands/hook.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync7, statSync as statSync2, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname7, join as join10 } from "path";
 async function readStdin() {
   if (process.stdin.isTTY) return "";
   const chunks = [];
@@ -2168,13 +2838,13 @@ function resolveLane(flagLane, cwd) {
   if (!base) return void 0;
   return applyWorktreeLaneSuffix(base, start);
 }
-var INTENT_FILE = join9(".sechroom", "continuity.json");
+var INTENT_FILE = join10(".sechroom", "continuity.json");
 function resolveIntentPath(start) {
   let dir = start;
   for (; ; ) {
-    const candidate = join9(dir, INTENT_FILE);
-    if (existsSync8(candidate)) return candidate;
-    const parent = dirname6(dir);
+    const candidate = join10(dir, INTENT_FILE);
+    if (existsSync9(candidate)) return candidate;
+    const parent = dirname7(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -2183,7 +2853,7 @@ function readIntent(start) {
   const path = resolveIntentPath(start);
   if (!path) return void 0;
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -2225,14 +2895,14 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
 }
 function ledgerPath(start) {
   const intent = resolveIntentPath(start);
-  const dir = intent ? dirname6(intent) : join9(start, ".sechroom");
-  return join9(dir, ".checkpoint-state.json");
+  const dir = intent ? dirname7(intent) : join10(start, ".sechroom");
+  return join10(dir, ".checkpoint-state.json");
 }
 function readLedger(start) {
   try {
     const p = ledgerPath(start);
-    if (!existsSync8(p)) return {};
-    return JSON.parse(readFileSync6(p, "utf8"));
+    if (!existsSync9(p)) return {};
+    return JSON.parse(readFileSync7(p, "utf8"));
   } catch {
     return {};
   }
@@ -2279,13 +2949,13 @@ function recordPush(start, intent) {
     } catch {
       mtimeMs = void 0;
     }
-    mkdirSync7(dirname6(p), { recursive: true });
+    mkdirSync8(dirname7(p), { recursive: true });
     const ledger = {
       lastEpochMs: Date.now(),
       lastMtimeMs: mtimeMs,
       lastHash: intentHash(intent)
     };
-    writeFileSync7(p, JSON.stringify(ledger) + "\n");
+    writeFileSync8(p, JSON.stringify(ledger) + "\n");
   } catch {
   }
 }
@@ -2431,6 +3101,12 @@ Fail-soft: no lane / no auth / no-or-partial intent file / API error -> exit 0,
         const surfaceResults = installHookSurfaces(["codex"], { dryRun, claudeDir: "", codexHome })[0].results;
         process.stdout.write(`${HOOK_SURFACE_LABEL.codex}:
 `);
+        if (dryRun) {
+          for (const [event, command] of Object.entries(hookCommandsForSurface("codex"))) {
+            process.stdout.write(`  ${event}: ${command}
+`);
+          }
+        }
         for (const r of surfaceResults) {
           results.push(r);
           process.stdout.write(describe(r, dryRun) + "\n");
@@ -2532,10 +3208,10 @@ Examples:
       const client = await makeClient(cfg);
       return client.POST("/continuity/snapshots", { body });
     });
-    const path = resolveIntentPath(cwd) ?? join10(cwd, INTENT_FILE);
+    const path = resolveIntentPath(cwd) ?? join11(cwd, INTENT_FILE);
     const fileBody = { ...merged, scope, lastSnapshotId: data.snapshotId };
-    mkdirSync8(dirname7(path), { recursive: true });
-    writeFileSync8(path, JSON.stringify(fileBody, null, 2) + "\n");
+    mkdirSync9(dirname8(path), { recursive: true });
+    writeFileSync9(path, JSON.stringify(fileBody, null, 2) + "\n");
     recordPush(cwd, merged);
     if (json) {
       emit({ snapshotId: data.snapshotId, lane, scope, file: path }, true);
@@ -2549,7 +3225,7 @@ Examples:
 }
 
 // src/commands/close.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 var VERDICTS = ["pass", "soft-fail", "plan-invalid", "blocked"];
 function registerClose(program2) {
   program2.command("close").description(
@@ -2566,6 +3242,9 @@ function registerClose(program2) {
   ).option(
     "--no-status-flip",
     "Skip the status flip on a BARE task. (Managed runs never flip here \u2014 the run engine reflects the verdict onto the task on resume.)"
+  ).option(
+    "--to-version <n>",
+    "Pin the Reference edge at this task version \u2014 the DISPATCHED version the executor worked against (D-continuity-2). Default: the task's current version (status flips are metadata edits that don't bump the version, so current == dispatched in the normal case; pass this when the task's content changed between dispatch and close)."
   ).option("--source <source>", "Source / lane stamp", "cli").addHelpText(
     "after",
     `
@@ -2587,7 +3266,7 @@ Examples:
       );
     let bodyText;
     try {
-      bodyText = opts.file ? readFileSync7(opts.file, "utf8") : readFileSync7(0, "utf8");
+      bodyText = opts.file ? readFileSync8(opts.file, "utf8") : readFileSync8(0, "utf8");
     } catch {
       fail(
         opts.file ? `could not read --file ${opts.file}` : "no closeout body \u2014 pass --file <path> or pipe it on stdin"
@@ -2599,6 +3278,7 @@ Examples:
       );
     const client = await makeClient(cfg);
     let matchTags;
+    let dispatchedVersion;
     if (opts.decomposition) {
       const run = await runApi(
         "Reading run contract",
@@ -2616,6 +3296,8 @@ Examples:
           `run ${opts.decomposition} is awaiting task ${run.awaitingTaskId}, not ${opts.task} \u2014 refusing to mis-key the resume.`
         );
       matchTags = await_.matchTags;
+      if (typeof await_.dispatchedTaskVersion === "number")
+        dispatchedVersion = await_.dispatchedTaskVersion;
     } else {
       matchTags = [`wlp-task:${opts.task}`];
     }
@@ -2642,11 +3324,34 @@ Examples:
         }
       })
     );
+    let toVersion;
+    if (opts.toVersion !== void 0) {
+      toVersion = Number(opts.toVersion);
+      if (!Number.isInteger(toVersion) || toVersion < 1)
+        fail(
+          `--to-version must be an integer >= 1 \u2014 got '${opts.toVersion}'`
+        );
+    } else if (dispatchedVersion !== void 0) {
+      toVersion = dispatchedVersion;
+    } else {
+      const task = await runApi(
+        "Reading task version",
+        async () => client.GET("/memories/{memoryId}", {
+          params: { path: { memoryId: opts.task } }
+        })
+      );
+      const v = task?.item?.currentVersion ?? task?.currentVersion;
+      if (typeof v !== "number" || v < 1)
+        fail(
+          `could not read task ${opts.task} version to pin the Reference edge \u2014 pass --to-version <n>`
+        );
+      toVersion = v;
+    }
     const edge = await runApi(
       "Wiring Reference edge",
       async () => client.POST("/memories/{memoryId}/relationships", {
         params: { path: { memoryId: closeout.id } },
-        body: { toMemoryId: opts.task, type: "Reference" }
+        body: { toMemoryId: opts.task, type: "Reference", toVersion }
       })
     );
     let taskStatus;
@@ -2862,6 +3567,7 @@ function registerDecomposition(program2) {
 Examples:
   $ sechroom decomposition decompose mem_XXXX
   $ sechroom decomposition execute sug_XXXX
+  $ sechroom decomposition publish-run sug_XXXX
   $ sechroom decomposition accept sug_XXXX
   $ sechroom decomposition reject sug_XXXX --reason "wrong shape"`
   );
@@ -2899,6 +3605,23 @@ Examples:
       cmd.optsWithGlobals().json
     );
   });
+  decomposition.command("publish-run <decompositionId>").description(
+    "Publish an accepted decomposition's context pack on demand (POST /decompositions/{id}/publish-run)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Publishing context pack", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/publish-run", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `published ${style.bold(decompositionId)} \u2192 run ${style.bold(data.runRecordId)} (${data.outcome})`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
   decomposition.command("accept <decompositionId>").description(
     "Accept a Pending decomposition \u2014 promote + ratify its Tasks (POST /decompositions/{id}/accept)"
   ).action(async (decompositionId, _opts, cmd) => {
@@ -3446,8 +4169,8 @@ Examples:
 
 // src/setup/apply.ts
 import { createHash as createHash3 } from "crypto";
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync9, existsSync as existsSync9 } from "fs";
-import { dirname as dirname8 } from "path";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync10, existsSync as existsSync10 } from "fs";
+import { dirname as dirname9 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
 function normalizeBody(s) {
@@ -3500,22 +4223,22 @@ function parseManagedBlock(content, block) {
   return null;
 }
 function ensureDir2(path) {
-  mkdirSync9(dirname8(path), { recursive: true });
+  mkdirSync10(dirname9(path), { recursive: true });
 }
 function readOr(path, fallback) {
   try {
-    return readFileSync8(path, "utf8");
+    return readFileSync9(path, "utf8");
   } catch {
     return fallback;
   }
 }
 function mergeMcpJson(path, snippet, dryRun) {
   const incoming = JSON.parse(snippet);
-  const existed = existsSync9(path);
+  const existed = existsSync10(path);
   let current = {};
   if (existed) {
     try {
-      current = JSON.parse(readFileSync8(path, "utf8"));
+      current = JSON.parse(readFileSync9(path, "utf8"));
     } catch {
       return { kind: "mcp", path, status: "skipped", note: "existing file isn't valid JSON \u2014 left untouched" };
     }
@@ -3523,26 +4246,26 @@ function mergeMcpJson(path, snippet, dryRun) {
   current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync9(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
+  writeFileSync10(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function mergeCodexToml(path, snippet, dryRun) {
-  const existed = existsSync9(path);
+  const existed = existsSync10(path);
   let body = readOr(path, "");
   body = body.replace(/(^|\n)\[mcp_servers\.sechroom\][^[]*/, "\n").replace(/\n{3,}/g, "\n\n");
   const trimmed = body.trim();
   const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync9(path, next, { mode: 384 });
+  writeFileSync10(path, next, { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function writeInstructionBlock(path, write, dryRun) {
-  const existed = existsSync9(path);
+  const existed = existsSync10(path);
   const next = computeBlockFile(readOr(path, ""), write);
   if (dryRun) return { kind: "instruction", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync9(path, next);
+  writeFileSync10(path, next);
   return { kind: "instruction", path, status: existed ? "merged" : "created" };
 }
 function computeBlockFile(current, write) {
@@ -3583,7 +4306,7 @@ function applyBlock(path, write, mode, dryRun) {
     const next = computeBlockFile(current, write);
     if (!dryRun) {
       ensureDir2(proposedPath);
-      writeFileSync9(proposedPath, next);
+      writeFileSync10(proposedPath, next);
     }
     return {
       kind: "instruction",
@@ -3713,8 +4436,8 @@ auto-resumes where you left off and checkpoints working state before compacting.
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
+import { join as join12 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -3830,8 +4553,8 @@ Found ${summary} available to you for ${surface}.
   if (skills.length > 0) {
     const written = [];
     for (const s of skills) {
-      mkdirSync10(join11(sDir, s.name), { recursive: true });
-      writeFileSync10(join11(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      mkdirSync11(join12(sDir, s.name), { recursive: true });
+      writeFileSync11(join12(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
       written.push(s.name);
     }
     recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -3839,11 +4562,11 @@ Found ${summary} available to you for ${surface}.
 `);
   }
   if (agents.length > 0) {
-    mkdirSync10(aDir, { recursive: true });
+    mkdirSync11(aDir, { recursive: true });
     const written = [];
     for (const a of agents) {
       const file = `${a.name}.md`;
-      writeFileSync10(join11(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      writeFileSync11(join12(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
       written.push(file);
     }
     recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -4226,13 +4949,13 @@ Wired to namespace '${slug}'. Restart your AI client (or reload MCP) to pick it
 }
 
 // src/commands/onboard.ts
-import { existsSync as existsSync11 } from "fs";
-import { basename as basename2, join as join13 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { basename as basename2, join as join14 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync9, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
-import { isAbsolute, join as join12, resolve } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync10, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { isAbsolute, join as join13, resolve } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -4252,21 +4975,21 @@ function discoverChildren(root) {
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join12(root, name);
+    const dir = join13(root, name);
     try {
       if (!statSync3(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync10(join12(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync11(join13(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
 function readManifest(path) {
-  if (!existsSync10(path)) return null;
+  if (!existsSync11(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync9(path, "utf8"));
+    parsed = JSON.parse(readFileSync10(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -4632,10 +5355,10 @@ async function chooseScope(scopeFlag, yes) {
 }
 async function planRecurseChild(entry, root, client, opts) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync11(dir)) {
+  if (!existsSync12(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync11(join13(dir, ".sechroom.json"))) {
+  if (existsSync12(join14(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -4708,7 +5431,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join13(root, ".sechroom", "repos.json");
+  const manifestPath = join14(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -5241,23 +5964,23 @@ Examples:
 
 // src/commands/reset.ts
 import { homedir as homedir4 } from "os";
-import { join as join14 } from "path";
-import { existsSync as existsSync12, readFileSync as readFileSync10, rmSync as rmSync3 } from "fs";
+import { join as join15 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync11, rmSync as rmSync3 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
-var localSkillsDir = () => join14(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join14(homedir4(), ".claude", "skills");
-var localAgentsDir = () => join14(process.cwd(), ".claude", "agents");
-var globalAgentsDir = () => join14(homedir4(), ".claude", "agents");
+var localSkillsDir = () => join15(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join15(homedir4(), ".claude", "skills");
+var localAgentsDir = () => join15(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join15(homedir4(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join14(dir, SKILLS_LOCK2);
-  if (!existsSync12(lockPath)) return removed;
+  const lockPath = join15(dir, SKILLS_LOCK2);
+  if (!existsSync13(lockPath)) return removed;
   try {
-    const lock = JSON.parse(readFileSync10(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync11(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join14(dir, name);
-        if (existsSync12(p)) {
+        const p = join15(dir, name);
+        if (existsSync13(p)) {
           rmSync3(p, { recursive: true, force: true });
           removed.push(p);
         }
@@ -5302,18 +6025,18 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join14(process.cwd(), ".sechroom");
-    if (existsSync12(stateDir)) {
+    const stateDir = join15(process.cwd(), ".sechroom");
+    if (existsSync13(stateDir)) {
       rmSync3(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join14(process.cwd(), ".sechroom.json");
-    if (existsSync12(legacyCfg)) {
+    const legacyCfg = join15(process.cwd(), ".sechroom.json");
+    if (existsSync13(legacyCfg)) {
       rmSync3(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join14(process.cwd(), ".sem");
-    if (existsSync12(legacySem)) {
+    const legacySem = join15(process.cwd(), ".sem");
+    if (existsSync13(legacySem)) {
       rmSync3(legacySem, { force: true });
       removed.push(legacySem);
     }
@@ -5339,8 +6062,8 @@ function registerReset(program2) {
 }
 
 // src/commands/skills.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync11, statSync as statSync4, writeFileSync as writeFileSync11 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync12, statSync as statSync4, writeFileSync as writeFileSync12 } from "fs";
+import { join as join16 } from "path";
 function filenameFromDisposition(header) {
   if (!header) return void 0;
   const m = /filename\*?=(?:UTF-8'')?"?([^";]+)"?/i.exec(header);
@@ -5348,11 +6071,11 @@ function filenameFromDisposition(header) {
 }
 function resolveOutputPath(output, serverFilename) {
   const filename = serverFilename || "skills.zip";
-  if (!output) return join15(process.cwd(), filename);
-  const looksLikeDir = output.endsWith("/") || existsSync13(output) && statSync4(output).isDirectory();
+  if (!output) return join16(process.cwd(), filename);
+  const looksLikeDir = output.endsWith("/") || existsSync14(output) && statSync4(output).isDirectory();
   if (looksLikeDir) {
-    mkdirSync11(output, { recursive: true });
-    return join15(output, filename);
+    mkdirSync12(output, { recursive: true });
+    return join16(output, filename);
   }
   return output;
 }
@@ -5383,7 +6106,7 @@ async function downloadZip(label, call, output) {
   const buf = Buffer.from(res.data);
   const filename = filenameFromDisposition(res.response.headers.get("content-disposition")) ?? "skills.zip";
   const path = resolveOutputPath(output, filename);
-  writeFileSync11(path, buf);
+  writeFileSync12(path, buf);
   return { path, bytes: buf.length, filename };
 }
 function registerSkills(program2) {
@@ -5392,7 +6115,9 @@ function registerSkills(program2) {
     "after",
     `
 Examples:
-  $ sechroom skills install                 materialise your installed skills to ~/.claude/skills
+  $ sechroom skills install --client claude  materialise target:claude-code skills to ~/.claude/skills
+  $ sechroom skills install --client codex   materialise target:gpt-codex skills to ~/.codex/skills
+  $ sechroom skills install --client all     keep both global clients in sync
   $ sechroom skills install --scope project  write them to ./.claude/skills instead
   $ sechroom skills list                     what's materialised on disk
   $ sechroom skills clean                    remove the materialised skill files
@@ -5401,11 +6126,15 @@ Examples:
   $ sechroom skills package --from-source --workspace wsp_abc -o ./dist   zip a draft from source
   $ sechroom skills set-lane --code-lane claude-code-chris --design-lane claude-design-chris
 
+When --client is omitted, configured client flags/environment variables win;
+otherwise existing default client homes are detected. Both configured/detected
+clients select all; an unconfigured machine preserves the legacy Claude default.
+
 `
   );
-  skills.command("install").description("Materialise your installed skills to disk (the already-installed bundle \u2014 no server install)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--dry-run", "print what would be written; write nothing").option("--json", "machine output").action((opts, cmd) => runInstall(SKILL_SPEC, cmd, opts));
-  skills.command("list").description("List the skills materialised on disk (per resolved config dir)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").action((opts, cmd) => runList(SKILL_SPEC, cmd, opts));
-  skills.command("clean [slug]").description(`Remove skill files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").action((slugArg, opts, cmd) => runClean(SKILL_SPEC, cmd, opts, slugArg));
+  skills.command("install").description("Materialise your installed skills to disk (the already-installed bundle \u2014 no server install)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--client <client>", "claude, codex, or all (default: configured/detected clients)").option("--dry-run", "print what would be written; write nothing").option("--json", "machine output").action((opts, cmd) => runInstall(SKILL_SPEC, cmd, opts));
+  skills.command("list").description("List the skills materialised on disk (per resolved config dir)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--client <client>", "claude, codex, or all (default: configured/detected clients)").option("--json", "machine output").action((opts, cmd) => runList(SKILL_SPEC, cmd, opts));
+  skills.command("clean [slug]").description(`Remove skill files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--client <client>", "claude, codex, or all (default: configured/detected clients)").option("--json", "machine output").action((slugArg, opts, cmd) => runClean(SKILL_SPEC, cmd, opts, slugArg));
   skills.command("preview").description("Render a workspace's draft bundle from source (no publish/install) and report the components").requiredOption("--workspace <id>", "workspace holding the draft bundle sources (wsp_\u2026)").option("--slug <slug>", "override the derived bundle slug").option("--title <title>", "override the derived bundle title").option("--version <version>", "override the derived bundle version").option("--default-install-parent <path>", "override the derived default install parent").option("--json", "machine output (the full RenderBundlePreviewResponse)").action(async (opts, cmd) => {
     const json = Boolean(opts.json) || Boolean(cmd.optsWithGlobals().json);
     const client = await makeClient(resolveConfig(cmd.optsWithGlobals()));
@@ -5551,12 +6280,12 @@ Examples:
 }
 
 // src/commands/sweep.ts
-import { existsSync as existsSync14 } from "fs";
-import { dirname as dirname9, join as join16, resolve as resolve2 } from "path";
-var DEFAULT_MANIFEST = join16(".sechroom", "repos.json");
+import { existsSync as existsSync15 } from "fs";
+import { dirname as dirname10, join as join17, resolve as resolve2 } from "path";
+var DEFAULT_MANIFEST = join17(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
-  if (!existsSync14(dir)) {
+  if (!existsSync15(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
   if (committedBindingPath(dir)) {
@@ -5632,7 +6361,7 @@ Examples:
 `);
       return;
     }
-    const root = dirname9(dirname9(manifestPath));
+    const root = dirname10(dirname10(manifestPath));
     const plans = repos.map((entry) => planEntry(entry, root));
     if (!json) {
       process.stderr.write(
@@ -5651,13 +6380,13 @@ Examples:
 
 // src/commands/telemetry.ts
 import {
-  existsSync as existsSync15,
-  mkdirSync as mkdirSync12,
-  readFileSync as readFileSync11,
+  existsSync as existsSync16,
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync12,
   rmSync as rmSync4,
-  writeFileSync as writeFileSync12
+  writeFileSync as writeFileSync13
 } from "fs";
-import { dirname as dirname10, join as join17 } from "path";
+import { dirname as dirname11, join as join18 } from "path";
 function registerTelemetry(program2) {
   const telemetry = program2.command("telemetry").description(
     "Emit WLP run telemetry (an executor leg's progress events) into a decomposition run"
@@ -5727,14 +6456,14 @@ function registerTelemetry(program2) {
     "Decomposition id this session executes"
   ).requiredOption("--task <id>", "Task id this session executes").action((opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
-    const dir = join17(process.cwd(), ".sechroom");
-    mkdirSync12(dir, { recursive: true });
-    const path = join17(dir, BINDING_FILE);
+    const dir = join18(process.cwd(), ".sechroom");
+    mkdirSync13(dir, { recursive: true });
+    const path = join18(dir, BINDING_FILE);
     const binding = {
       decompositionId: opts.decomposition,
       taskId: opts.task
     };
-    writeFileSync12(path, JSON.stringify(binding, null, 2) + "\n");
+    writeFileSync13(path, JSON.stringify(binding, null, 2) + "\n");
     ensureStateDirIgnored(process.cwd());
     if (json) {
       emit({ bound: true, ...binding, path }, true);
@@ -5749,8 +6478,8 @@ function registerTelemetry(program2) {
   });
   telemetry.command("unbind").description("Clear this checkout's telemetry binding").action((_opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
-    const path = join17(process.cwd(), ".sechroom", BINDING_FILE);
-    const existed = existsSync15(path);
+    const path = join18(process.cwd(), ".sechroom", BINDING_FILE);
+    const existed = existsSync16(path);
     if (existed) rmSync4(path);
     if (json) emit({ unbound: existed, path }, true);
     else
@@ -5759,7 +6488,7 @@ function registerTelemetry(program2) {
       );
   });
   telemetry.command("hook").description(
-    "Per-turn telemetry self-report for a Claude Code Stop hook (reads stdin; no-op unless bound). Fail-soft."
+    "Per-turn telemetry self-report for Claude Code hooks \u2014 Stop/SubagentStop \u2192 parsed + terminal, Notification/PermissionDenied \u2192 approval (reads stdin; no-op unless bound). Fail-soft."
   ).action(async (_opts, cmd) => {
     try {
       const raw = await readStdin2();
@@ -5768,21 +6497,10 @@ function registerTelemetry(program2) {
       const binding = findBinding(cwd);
       if (!binding) return process.exit(0);
       const usage = input.transcript_path ? parseTranscript(input.transcript_path) : null;
-      if (!usage) return process.exit(0);
+      const events = buildHookEvents(input, usage, binding.taskId);
+      if (events.length === 0) return process.exit(0);
       const cfg = resolveConfig(cmd.optsWithGlobals());
-      await postTelemetry(cfg, binding.decompositionId, [
-        {
-          taskId: binding.taskId,
-          kind: "Parsed",
-          tokensIn: usage.tokensIn,
-          tokensOut: usage.tokensOut,
-          contextUsed: usage.contextUsed,
-          contextWindow: usage.contextWindow,
-          text: null,
-          approvalState: null,
-          verdict: null
-        }
-      ]);
+      await postTelemetry(cfg, binding.decompositionId, events);
       return process.exit(0);
     } catch {
       return process.exit(0);
@@ -5810,7 +6528,12 @@ function registerTelemetry(program2) {
       scope,
       cwd
     });
-    const commands = { Stop: "sechroom telemetry hook" };
+    const commands = {
+      Stop: "sechroom telemetry hook",
+      SubagentStop: "sechroom telemetry hook",
+      Notification: "sechroom telemetry hook",
+      PermissionDenied: "sechroom telemetry hook"
+    };
     try {
       const multi = targets.length > 1;
       const results = targets.map((t) => {
@@ -5864,11 +6587,11 @@ async function postTelemetry(cfg, decompositionId, events) {
 function findBinding(start) {
   let dir = start;
   for (; ; ) {
-    const path = join17(dir, ".sechroom", BINDING_FILE);
-    if (existsSync15(path)) {
+    const path = join18(dir, ".sechroom", BINDING_FILE);
+    if (existsSync16(path)) {
       try {
         const b = JSON.parse(
-          readFileSync11(path, "utf8")
+          readFileSync12(path, "utf8")
         );
         if (b.decompositionId && b.taskId)
           return { decompositionId: b.decompositionId, taskId: b.taskId };
@@ -5876,18 +6599,18 @@ function findBinding(start) {
       }
       return null;
     }
-    const parent = dirname10(dir);
+    const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function parseTranscript(path) {
-  if (!existsSync15(path)) return null;
+  if (!existsSync16(path)) return null;
   let tokensIn = 0;
   let tokensOut = 0;
   let contextUsed = 0;
   let model = "";
-  for (const line of readFileSync11(path, "utf8").split("\n")) {
+  for (const line of readFileSync12(path, "utf8").split("\n")) {
     if (!line.trim()) continue;
     let obj;
     try {
@@ -5911,6 +6634,55 @@ function windowFor(model, contextUsed = 0) {
   if (m.includes("[1m]") || m.includes("-1m")) return 1e6;
   return contextUsed > 2e5 ? 1e6 : 2e5;
 }
+function buildHookEvents(input, usage, taskId) {
+  const events = [];
+  const base = (kind, over) => ({
+    taskId,
+    kind,
+    tokensIn: null,
+    tokensOut: null,
+    contextUsed: null,
+    contextWindow: null,
+    text: null,
+    approvalState: null,
+    verdict: null,
+    ...over
+  });
+  if (usage) {
+    events.push(
+      base("Parsed", {
+        tokensIn: usage.tokensIn,
+        tokensOut: usage.tokensOut,
+        contextUsed: usage.contextUsed,
+        contextWindow: usage.contextWindow
+      })
+    );
+  }
+  switch (input.hook_event_name) {
+    case "PermissionDenied":
+      events.push(
+        base("Approval", {
+          approvalState: "denied",
+          text: input.tool_name ?? input.message ?? null
+        })
+      );
+      break;
+    case "Notification":
+      if (isPermissionNotification(input))
+        events.push(base("Approval", { text: input.message ?? null }));
+      break;
+    case "Stop":
+    case "SubagentStop":
+      events.push(base("Terminal", { text: input.last_assistant_message ?? null }));
+      break;
+  }
+  return events;
+}
+function isPermissionNotification(input) {
+  const t = (input.notification_type ?? input.type ?? "").toLowerCase();
+  if (t) return t.includes("permission");
+  return (input.message ?? "").toLowerCase().includes("permission");
+}
 async function readStdin2() {
   if (process.stdin.isTTY) return "";
   const chunks = [];
@@ -6145,7 +6917,7 @@ Examples:
 function resolveVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync12(new URL("../package.json", import.meta.url), "utf8")
+      readFileSync13(new URL("../package.json", import.meta.url), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {
@@ -6304,6 +7076,7 @@ registerRelationships(program);
 registerWorkspace(program);
 registerProject(program);
 registerDecomposition(program);
+registerExecutor(program);
 registerClose(program);
 registerFiling(program);
 registerContinuity(program);