@sechroom/cli 2026.7.16 → 2026.7.17-rc.a5e3a36a

package/dist/index.js

@@ -657,9 +657,14 @@ async function runApi(label, fn) {
   s.succeed();
   return res.data;
 }
-function fail(error) {
+function formatFailureMessage(error) {
   let msg;
-  if (typeof error === "object" && error !== null && "title" in error) {
+  if (error instanceof Error) {
+    msg = error.message || error.name;
+    if (error.cause instanceof Error && error.cause.message) {
+      msg += `: ${error.cause.message}`;
+    }
+  } else if (typeof error === "object" && error !== null && "title" in error) {
     const problem = error;
     msg = String(problem.title);
     if (problem.errors && typeof problem.errors === "object") {
@@ -674,6 +679,10 @@ ${detail.join("\n")}`;
   } else {
     msg = String(error);
   }
+  return msg;
+}
+function fail(error) {
+  const msg = formatFailureMessage(error);
   process.stderr.write(`error: ${msg}
 `);
   process.exit(1);
@@ -1140,7 +1149,10 @@ function resolveReferences(systemRows, personalRows, surface) {
 }
 
 // src/setup/skill-resolution-io.ts
-var AGENT_TARGET = { "claude-code": "claude-agent" };
+var AGENT_TARGET = {
+  "claude-code": "claude-agent",
+  "gpt-codex": "gpt-codex-agent"
+};
 function agentTargetFor(surface) {
   return AGENT_TARGET[surface] ?? `${surface}-agent`;
 }
@@ -1205,12 +1217,58 @@ function writeSkills(dir, skills, surface) {
   if (written.length) recordMaterialisedSkills(dir, DEFAULT_SKILLS_SLUG, written, { surface });
   return written;
 }
+function splitAgentFrontmatter(body) {
+  body = body.replaceAll("\r\n", "\n");
+  if (!body.startsWith("---\n")) return { instructions: body };
+  const end = body.indexOf("\n---\n", 4);
+  if (end < 0) return { instructions: body };
+  const frontmatter = body.slice(4, end);
+  const field = (key) => {
+    const line = frontmatter.split("\n").find((candidate) => candidate.startsWith(`${key}:`));
+    return line?.slice(key.length + 1).trim().replace(/^(["'])(.*)\1$/, "$2");
+  };
+  return { name: field("name"), description: field("description"), instructions: body.slice(end + 5).trimStart() };
+}
+function validateCodexSkills(skills) {
+  for (const skill of skills) {
+    const parsed = splitAgentFrontmatter(skill.body);
+    if (parsed.name !== skill.name || !parsed.description) {
+      throw new Error(
+        `Codex skill '${skill.name}' must begin with YAML frontmatter containing matching name and a description.`
+      );
+    }
+  }
+}
+var WORKER_NAMES = ["substrate-drafter", "substrate-miner", "substrate-verifier"];
+function validateCodexWorkerDependencies(skills, agents) {
+  const available = new Set(agents.map((agent) => agent.name));
+  const missing = WORKER_NAMES.filter(
+    (worker) => skills.some((skill) => skill.body.includes(worker)) && !available.has(worker)
+  );
+  if (missing.length) {
+    throw new Error(`Codex skills reference missing agent template(s): ${missing.join(", ")}.`);
+  }
+}
+function codexAgentToml(agent) {
+  const parsed = splitAgentFrontmatter(agent.body);
+  if (!parsed.description) {
+    throw new Error(`Codex agent '${agent.name}' requires a description in its leading YAML frontmatter.`);
+  }
+  return [
+    `name = ${JSON.stringify(parsed.name || agent.name)}`,
+    `description = ${JSON.stringify(parsed.description)}`,
+    `developer_instructions = ${JSON.stringify(parsed.instructions.trimEnd())}`,
+    ""
+  ].join("\n");
+}
 function writeAgents(dir, agents, surface) {
   if (agents.length) mkdirSync3(dir, { recursive: true });
   const written = [];
   for (const a of agents) {
-    const file = `${a.name}.md`;
-    writeFileSync3(join4(dir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+    const codex = surface === CLIENT_SURFACE.codex;
+    const file = `${a.name}.${codex ? "toml" : "md"}`;
+    const body = codex ? codexAgentToml(a) : a.body.endsWith("\n") ? a.body : a.body + "\n";
+    writeFileSync3(join4(dir, file), body);
     written.push(file);
   }
   if (written.length) recordMaterialisedSkills(dir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -1239,7 +1297,7 @@ var AGENT_SPEC = {
   dir: agentsDir,
   resolve: resolveAgentSet,
   write: writeAgents,
-  supportsCodex: false
+  supportsCodex: true
 };
 function scopeOf(opts) {
   return opts.local ? "project" : resolveScope(opts.scope);
@@ -1315,6 +1373,10 @@ async function runInstall(spec, cmd, opts) {
   const rows = await fetchTemplateRows(cfg, personalWorkspaceId);
   const results = targets.map((t) => {
     const items = spec.resolve(rows, t.surface);
+    if (t.client === "codex" && spec.kind === "skill") {
+      validateCodexSkills(items);
+      validateCodexWorkerDependencies(items, resolveAgentSet(rows, t.surface));
+    }
     const refs = spec.kind === "skill" ? resolveReferenceSet(rows, t.surface) : [];
     const written = dryRun ? items.map((i) => i.name) : spec.write(t.dir, items, t.surface);
     const refsWritten = dryRun ? refs.map((r) => r.name) : writeReferencesIntoSkillDirs(t.dir, items, refs);
@@ -1440,22 +1502,24 @@ function registerAgents(program2) {
     `
 Examples:
   $ sechroom agents install                 materialise your installed agents to ~/.claude/agents
+	$ sechroom agents install --client codex  materialise native TOML agents to ~/.codex/agents
   $ sechroom agents install --scope project  write them to ./.claude/agents instead
   $ sechroom agents install --claude-config-dir ~/.claude-work   target another instance
   $ sechroom agents list                     what's materialised on disk
   $ sechroom agents clean                    remove the materialised agent files
 
-Agents are resolved from the agent target (target:claude-agent), the dispatchable
-workers your loop skills call (e.g. find-prior-art \u2192 substrate-miner).`
+Agents are resolved from the client's agent target (target:claude-agent or
+target:gpt-codex-agent), the dispatchable workers your loop skills call
+(e.g. find-prior-art \u2192 substrate-miner).`
   );
-  agents.command("install").description("Materialise your installed subagents to disk (the already-installed bundle \u2014 no server install)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--dry-run", "print what would be written; write nothing").option("--json", "machine output").action((opts, cmd) => runInstall(AGENT_SPEC, cmd, opts));
-  agents.command("list").description("List the subagents materialised on disk (per resolved config dir)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").action((opts, cmd) => runList(AGENT_SPEC, cmd, opts));
-  agents.command("clean [slug]").description(`Remove subagent files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").action((slugArg, opts, cmd) => runClean(AGENT_SPEC, cmd, opts, slugArg));
+  agents.command("install").description("Materialise your installed subagents to disk (the already-installed bundle \u2014 no server install)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--dry-run", "print what would be written; write nothing").option("--client <client>", "claude, codex, or all").option("--json", "machine output").action((opts, cmd) => runInstall(AGENT_SPEC, cmd, opts));
+  agents.command("list").description("List the subagents materialised on disk (per resolved config dir)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").option("--client <client>", "claude, codex, or all").action((opts, cmd) => runList(AGENT_SPEC, cmd, opts));
+  agents.command("clean [slug]").description(`Remove subagent files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").option("--client <client>", "claude, codex, or all").action((slugArg, opts, cmd) => runClean(AGENT_SPEC, cmd, opts, slugArg));
 }
 
 // src/commands/channel.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname4, join as join7 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname6, join as join9 } from "path";
 import {
   HttpTransportType,
   HubConnectionBuilder
@@ -1463,52 +1527,218 @@ import {
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
+// src/commands/executor.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5, join as join8 } from "path";
+
+// src/sem.ts
+import { dirname as dirname2, join as join5 } from "path";
+import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync, readFileSync as readFileSync3, statSync, writeFileSync as writeFileSync4 } from "fs";
+var SEM_FILE = join5(".sechroom", "lane.json");
+var STATE_DIR_NAME2 = ".sechroom";
+function localSemPath(cwd = process.cwd()) {
+  return join5(cwd, SEM_FILE);
+}
+function resolveSemPathForRead(start = process.cwd()) {
+  let dir = start;
+  while (true) {
+    const candidate = join5(dir, SEM_FILE);
+    if (existsSync4(candidate)) return candidate;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function applyWorktreeLaneSuffix(lane, start = process.cwd()) {
+  try {
+    let dir = start;
+    let gitPath;
+    for (; ; ) {
+      const candidate = join5(dir, ".git");
+      if (existsSync4(candidate)) {
+        gitPath = candidate;
+        break;
+      }
+      const parent = dirname2(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+    if (!gitPath || statSync(gitPath).isDirectory()) return lane;
+    const gitFile = readFileSync3(gitPath, "utf8");
+    const common = gitFile.trim().match(/^gitdir:\s*(.+)\/worktrees\/[^/\s]+\s*$/);
+    if (!common) return lane;
+    const worktreesDir = join5(common[1], "worktrees");
+    const siblings = readdirSync(worktreesDir).filter((n) => {
+      try {
+        return statSync(join5(worktreesDir, n)).isDirectory();
+      } catch {
+        return false;
+      }
+    });
+    return laneWithWorktreeSuffix(lane, gitFile, siblings);
+  } catch {
+    return lane;
+  }
+}
+function laneWithWorktreeSuffix(lane, gitFile, siblings) {
+  const m = gitFile.trim().match(/\/worktrees\/([^/\s]+)\s*$/);
+  if (!m) return lane;
+  const idx = [...siblings].sort().indexOf(m[1]);
+  return idx < 0 ? lane : `${lane}-${idx + 2}`;
+}
+function serializeSem(values) {
+  return JSON.stringify(values, null, 2) + "\n";
+}
+function readSem(path) {
+  const p = path ?? resolveSemPathForRead();
+  if (!p || !existsSync4(p)) return void 0;
+  return { path: p, values: parseLaneJson(readFileSync3(p, "utf8")) };
+}
+function readLocalSemValues(cwd = process.cwd()) {
+  const next = join5(cwd, SEM_FILE);
+  if (existsSync4(next)) return readSem(next)?.values ?? {};
+  return {};
+}
+function parseLaneJson(text2) {
+  try {
+    const parsed = JSON.parse(text2);
+    const out = {};
+    for (const [k, v] of Object.entries(parsed)) {
+      if (typeof v === "string") out[k] = v;
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+var STATE_DIR_IGNORE = `${STATE_DIR_NAME2}/`;
+function writeSem(values, path = localSemPath()) {
+  mkdirSync4(dirname2(path), { recursive: true });
+  writeFileSync4(path, serializeSem(values));
+  ensureSemIgnored(path);
+  ensureContinuityScaffold(path);
+  return path;
+}
+function ensureStateDirIgnored(cwd = process.cwd()) {
+  ensureSemIgnored(localSemPath(cwd));
+}
+var CONTINUITY_FILE_NAME = "continuity.json";
+var CONTINUITY_SCAFFOLD = JSON.stringify(
+  {
+    _readme: "Agent-maintained continuity intent. Keep these current during the session; `sechroom checkpoint` and the PreCompact hook snapshot from here. The five required fields (objective, state, lastAction, nextAction, resumeInstruction) must all be non-empty for a snapshot to be created.",
+    objective: "",
+    state: "",
+    lastAction: "",
+    nextAction: "",
+    resumeInstruction: "",
+    constraints: [],
+    questions: [],
+    artifacts: [],
+    confidence: null
+  },
+  null,
+  2
+) + "\n";
+function ensureContinuityScaffold(semPath) {
+  try {
+    const target = join5(dirname2(semPath), CONTINUITY_FILE_NAME);
+    if (existsSync4(target)) return;
+    writeFileSync4(target, CONTINUITY_SCAFFOLD);
+  } catch {
+  }
+}
+function ignoresSem(content) {
+  return content.split("\n").some((line) => {
+    const t = line.trim();
+    return t === STATE_DIR_NAME2 || t === STATE_DIR_IGNORE || t === `/${STATE_DIR_NAME2}` || t === `/${STATE_DIR_IGNORE}` || t === `**/${STATE_DIR_NAME2}` || t === `**/${STATE_DIR_IGNORE}`;
+  });
+}
+function inGitRepo(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    if (existsSync4(join5(dir, ".git"))) return true;
+    const parent = dirname2(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+}
+function resolveGitignoreTarget(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    const gi = join5(dir, ".gitignore");
+    if (existsSync4(gi)) return { path: gi, exists: true };
+    const parent = dirname2(dir);
+    if (existsSync4(join5(dir, ".git")) || parent === dir) {
+      return { path: join5(startDir, ".gitignore"), exists: false };
+    }
+    dir = parent;
+  }
+}
+function ensureSemIgnored(semPath) {
+  try {
+    const checkoutDir = dirname2(dirname2(semPath));
+    if (!inGitRepo(checkoutDir)) return;
+    const target = resolveGitignoreTarget(checkoutDir);
+    if (target.exists) {
+      const content = readFileSync3(target.path, "utf8");
+      if (ignoresSem(content)) return;
+      const sep = content.length === 0 || content.endsWith("\n") ? "" : "\n";
+      appendFileSync(target.path, `${sep}${STATE_DIR_IGNORE}
+`);
+    } else {
+      writeFileSync4(target.path, `${STATE_DIR_IGNORE}
+`);
+    }
+  } catch {
+  }
+}
+
 // src/commands/hook-install.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
-import { delimiter, dirname as dirname3, join as join6 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { delimiter, dirname as dirname4, join as join7 } from "path";
 
 // src/setup/clients.ts
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname3, join as join6 } from "path";
 function claudeDesktopConfigPath(home) {
   switch (process.platform) {
     case "darwin":
-      return join5(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+      return join6(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
     case "win32":
-      return join5(process.env.APPDATA ?? join5(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+      return join6(process.env.APPDATA ?? join6(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
     default:
-      return join5(home, ".config", "Claude", "claude_desktop_config.json");
+      return join6(home, ".config", "Claude", "claude_desktop_config.json");
   }
 }
 function clientTargets(cwd, opts = {}) {
   const home = homedir3();
-  const claudeDir = opts.claudeDir ?? join5(home, ".claude");
-  const codexHome = opts.codexHome ?? join5(home, ".codex");
+  const claudeDir = opts.claudeDir ?? join6(home, ".claude");
+  const codexHome = opts.codexHome ?? join6(home, ".codex");
   return {
     "claude-code": {
       key: "claude-code",
       label: "Claude Code",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join5(cwd, ".mcp.json"), format: "json" },
-      instruction: { surfaceKey: "claude-code", path: join5(cwd, "CLAUDE.md") }
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join6(cwd, ".mcp.json"), format: "json" },
+      instruction: { surfaceKey: "claude-code", path: join6(cwd, "CLAUDE.md") }
     },
     "claude-desktop": {
       key: "claude-desktop",
       label: "Claude Desktop",
       mcp: { surfaceKey: "claude-desktop", sectionType: SectionType.McpConfig, path: claudeDesktopConfigPath(home), format: "json" },
-      instruction: { surfaceKey: "claude-desktop", path: join5(claudeDir, "CLAUDE.md") }
+      instruction: { surfaceKey: "claude-desktop", path: join6(claudeDir, "CLAUDE.md") }
     },
     codex: {
       key: "codex",
       label: "Codex CLI",
-      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join5(codexHome, "config.toml"), format: "toml" },
-      instruction: { surfaceKey: "chatgpt", path: join5(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join6(codexHome, "config.toml"), format: "toml" },
+      instruction: { surfaceKey: "chatgpt", path: join6(cwd, "AGENTS.md") }
     },
     cursor: {
       key: "cursor",
       label: "Cursor",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join5(cwd, ".cursor", "mcp.json"), format: "json" },
-      instruction: { surfaceKey: "chatgpt", path: join5(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join6(cwd, ".cursor", "mcp.json"), format: "json" },
+      instruction: { surfaceKey: "chatgpt", path: join6(cwd, "AGENTS.md") }
     },
     antigravity: {
       key: "antigravity",
@@ -1519,8 +1749,8 @@ function clientTargets(cwd, opts = {}) {
       // `type` — comes from the `antigravity` server surface, so we don't
       // hardcode it here. Instructions go in the project `AGENTS.md`
       // (cross-tool, shared with Codex/Cursor).
-      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join5(home, ".gemini", "config", "mcp_config.json"), format: "json" },
-      instruction: { surfaceKey: "antigravity", path: join5(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join6(home, ".gemini", "config", "mcp_config.json"), format: "json" },
+      instruction: { surfaceKey: "antigravity", path: join6(cwd, "AGENTS.md") }
     }
   };
 }
@@ -1529,11 +1759,11 @@ var DEFAULT_CLIENT_KEY = "claude-code";
 function detectInstalledClients(cwd) {
   const home = homedir3();
   const detected = [];
-  if (resolveClaudeTargets({}).some((t) => existsSync4(t.dir))) detected.push("claude-code");
-  if (existsSync4(dirname2(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
-  if (resolveCodexHomes({}).some((d) => existsSync4(d))) detected.push("codex");
-  if (existsSync4(join5(home, ".cursor")) || existsSync4(join5(cwd, ".cursor"))) detected.push("cursor");
-  if (existsSync4(join5(home, ".gemini"))) detected.push("antigravity");
+  if (resolveClaudeTargets({}).some((t) => existsSync5(t.dir))) detected.push("claude-code");
+  if (existsSync5(dirname3(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
+  if (resolveCodexHomes({}).some((d) => existsSync5(d))) detected.push("codex");
+  if (existsSync5(join6(home, ".cursor")) || existsSync5(join6(cwd, ".cursor"))) detected.push("cursor");
+  if (existsSync5(join6(home, ".gemini"))) detected.push("antigravity");
   return detected;
 }
 
@@ -1576,29 +1806,29 @@ function mergeHooks(config2, commands) {
   return added;
 }
 function readJsonConfig2(path) {
-  if (!existsSync5(path)) return {};
-  const raw = readFileSync3(path, "utf8");
+  if (!existsSync6(path)) return {};
+  const raw = readFileSync4(path, "utf8");
   if (!raw.trim()) return {};
   return JSON.parse(raw);
 }
 function installHooksJson(path, commands, dryRun) {
-  const existed = existsSync5(path) && readFileSync3(path, "utf8").trim().length > 0;
+  const existed = existsSync6(path) && readFileSync4(path, "utf8").trim().length > 0;
   const config2 = readJsonConfig2(path);
   const added = mergeHooks(config2, commands);
   if (added === 0 && existed) return { path, status: "current" };
   if (!dryRun) {
-    mkdirSync4(dirname3(path), { recursive: true });
-    writeFileSync4(path, JSON.stringify(config2, null, 2) + "\n");
+    mkdirSync5(dirname4(path), { recursive: true });
+    writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
   }
   return { path, status: existed ? "merged" : "created" };
 }
 function installClaudeCommands(claudeDir, commands, dryRun) {
-  return installHooksJson(join6(claudeDir, "settings.json"), commands, dryRun);
+  return installHooksJson(join7(claudeDir, "settings.json"), commands, dryRun);
 }
 function installCodexCommands(codexHome, commands, dryRun) {
   return [
-    installHooksJson(join6(codexHome, "hooks.json"), commands, dryRun),
-    installCodexFeatureFlag(join6(codexHome, "config.toml"), dryRun)
+    installHooksJson(join7(codexHome, "hooks.json"), commands, dryRun),
+    installCodexFeatureFlag(join7(codexHome, "config.toml"), dryRun)
   ];
 }
 function ensureCodexFeaturesHooks(content) {
@@ -1622,13 +1852,13 @@ function ensureCodexFeaturesHooks(content) {
   return { next: lines.join("\n"), changed: true };
 }
 function installCodexFeatureFlag(path, dryRun) {
-  const existed = existsSync5(path);
-  const content = existed ? readFileSync3(path, "utf8") : "";
+  const existed = existsSync6(path);
+  const content = existed ? readFileSync4(path, "utf8") : "";
   const { next, changed } = ensureCodexFeaturesHooks(content);
   if (!changed) return { path, status: "current" };
   if (!dryRun) {
-    mkdirSync4(dirname3(path), { recursive: true });
-    writeFileSync4(path, next);
+    mkdirSync5(dirname4(path), { recursive: true });
+    writeFileSync5(path, next);
   }
   return { path, status: existed ? "merged" : "created" };
 }
@@ -1653,11 +1883,11 @@ function installHookSurfaces(surfaces, opts) {
   const out = [];
   for (const surface of surfaces) {
     if (surface === "claude") {
-      const path = join6(opts.claudeDir, "settings.json");
+      const path = join7(opts.claudeDir, "settings.json");
       out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
     } else {
-      const hooksJson = installHooksJson(join6(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
-      const featureFlag = installCodexFeatureFlag(join6(opts.codexHome, "config.toml"), opts.dryRun);
+      const hooksJson = installHooksJson(join7(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
+      const featureFlag = installCodexFeatureFlag(join7(opts.codexHome, "config.toml"), opts.dryRun);
       out.push({ surface, results: [hooksJson, featureFlag] });
     }
   }
@@ -1677,7 +1907,7 @@ function isSechroomOnPath() {
   for (const dir of pathEnv.split(delimiter)) {
     if (!dir) continue;
     for (const name of names) {
-      if (existsSync5(join6(dir, name))) return true;
+      if (existsSync6(join7(dir, name))) return true;
     }
   }
   return false;
@@ -1690,80 +1920,538 @@ function warnIfSechroomNotOnPath(write = (s) => void process.stderr.write(s)) {
   return true;
 }
 
-// src/commands/channel.ts
-function registerChannel(program2) {
-  const channel = program2.command("channel").description(
-    "Receive matched substrate events over the held SignalR push leg (D-WLP-9)"
+// src/commands/executor.ts
+function executorSubscriptionInput(name) {
+  return {
+    name,
+    enabled: true,
+    filter: { tags: ["kind:task"], workspaceScope: [] }
+  };
+}
+function executorRegistrationInput(state, deliverySubscriptionId) {
+  return {
+    relayId: state.relayId,
+    instanceKey: state.instanceKey,
+    laneId: state.laneId ?? state.instanceKey,
+    runtimeKind: parseRuntimeKind(state.runtime),
+    activationMode: "Attached",
+    deliverySubscriptionId,
+    connectorId: state.connectorId,
+    claimedCapabilityKeys: state.capabilityKeys,
+    toolSetRef: null,
+    ttlSeconds: state.ttlSeconds
+  };
+}
+var EXECUTOR_STATE = "executor.json";
+var EXECUTOR_PULSE_COMMAND = "sechroom executor hook-pulse";
+var EXECUTOR_STOP_COMMAND = "sechroom executor hook-stop";
+var CLAUDE_EXECUTOR_HOOKS = {
+  SessionStart: EXECUTOR_PULSE_COMMAND,
+  UserPromptSubmit: EXECUTOR_PULSE_COMMAND,
+  PreToolUse: EXECUTOR_PULSE_COMMAND,
+  Stop: EXECUTOR_PULSE_COMMAND,
+  SessionEnd: EXECUTOR_STOP_COMMAND
+};
+var CODEX_EXECUTOR_HOOKS = {
+  SessionStart: EXECUTOR_PULSE_COMMAND,
+  UserPromptSubmit: EXECUTOR_PULSE_COMMAND,
+  PreToolUse: EXECUTOR_PULSE_COMMAND,
+  Stop: EXECUTOR_PULSE_COMMAND
+};
+function registerExecutor(program2) {
+  const executor = program2.command("executor").description(
+    "Register and operate a local Claude Code/Codex executor advertisement"
   );
-  const withFilterOpts = (c) => c.option(
-    "--name <name>",
-    "Subscription name (idempotent per name)",
-    "wlp-dispatch"
+  executor.command("install").description(
+    "Configure this checkout's harness to advertise itself as a WLP executor"
+  ).option("--connector <id>", "Approved local-session ConnectorDefinition id").option(
+    "--instance-key <key>",
+    "Stable executor identity (defaults to .sechroom/lane.json code-lane)"
   ).option(
-    "--tag <tag...>",
-    "Tag(s) the event must carry to match (repeatable). Default targets WLP task dispatches.",
-    ["kind:task"]
-  ).option("--workspace <wsp...>", "Restrict to these workspace id(s)").option(
-    "--executor-instance <id>",
-    "Join the exact executor-instance SignalR group"
-  );
-  withFilterOpts(
-    channel.command("connect").description(
-      "Register a SignalR subscription and stream matched events to stdout"
-    )
-  ).action(async (opts, cmd) => {
-    const json = Boolean(cmd.optsWithGlobals().json);
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const filter = readFilter(opts);
-    const sub = await ensureSubscription(cfg, opts.name, filter);
-    const seen = /* @__PURE__ */ new Set();
-    const deliver = makeDeliver(
-      filter,
-      seen,
-      (payload) => process.stdout.write(
-        (typeof payload === "string" ? payload : JSON.stringify(payload)) + "\n"
-      )
-    );
-    const conn = await openConnection(cfg, deliver, opts.executorInstance);
-    await reconcile(cfg, filter, deliver);
-    if (json) {
-      emit(
-        {
-          connected: true,
-          tenant: cfg.tenant,
-          subscriptionId: sub.id ?? opts.name,
-          filter
-        },
-        true
+    "--lane-id <lane>",
+    "Canonical affinity lane (defaults to .sechroom/lane.json code-lane)"
+  ).option("--runtime <kind>", "claude-code | codex").option("--surface <surface>", "claude | codex").option(
+    "--capability <key...>",
+    "Capability operation keys claimed by this instance"
+  ).option(
+    "--relay <id>",
+    "Relay identity shared by sibling instances",
+    "sechroom-cli-local"
+  ).option(
+    "--subscription-name <name>",
+    "SignalR delivery binding name",
+    "executor-dispatch"
+  ).option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 600).option(
+    "--refresh-after <seconds>",
+    "Minimum age before a hook refreshes",
+    parseInteger,
+    40
+  ).option(
+    "-y, --yes",
+    "Non-interactive: accept detected surface and lane defaults",
+    false
+  ).option("--dry-run", "Show hook files without writing", false).action(async (opts, cmd) => {
+    const globals = cmd.optsWithGlobals();
+    const lane = readSem()?.values["code-lane"];
+    const detected = detectHookSurfaces(process.cwd());
+    let surface = opts.surface;
+    let instanceKey = opts.instanceKey;
+    let runtime = opts.runtime;
+    let laneId = opts.laneId;
+    let connector = opts.connector;
+    let capabilities = opts.capability;
+    const surfaceDefault = detected.length === 1 ? detected[0] : lane?.includes("codex") ? "codex" : "claude";
+    if (!opts.yes && canPrompt()) {
+      surface = await promptText(
+        "Harness surface (claude or codex)?",
+        surface ?? surfaceDefault
       );
-    } else {
-      process.stderr.write(
-        style.green("channel connected") + style.dim(
-          ` \u2014 tenant ${cfg.tenant}, sub ${sub.id ?? opts.name}, tags [${filter.tags.join(", ")}]
-`
-        ) + style.dim("streaming matched events to stdout; Ctrl-C to stop.\n")
+      instanceKey = await promptText(
+        "Executor instance key?",
+        instanceKey ?? lane ?? ""
+      );
+      laneId = await promptText(
+        "Executor affinity lane?",
+        laneId ?? lane ?? ""
+      );
+      runtime = await promptText(
+        "Runtime (claude-code or codex)?",
+        runtime ?? (surface === "codex" ? "codex" : "claude-code")
+      );
+      connector = await promptText(
+        "Approved local-session connector id?",
+        connector ?? ""
       );
+      const capabilityText = await promptText(
+        "Capability keys (comma-separated; blank for none)?",
+        capabilities?.join(",") ?? ""
+      );
+      capabilities = capabilityText.split(",").map((x) => x.trim()).filter(Boolean);
     }
-    await holdOpen(conn);
-  });
-  withFilterOpts(
-    channel.command("mcp").description(
-      "Run as a Claude Code channel (local-stdio MCP server) \u2014 push matched events into the session"
-    )
-  ).action(async (opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const filter = readFilter(opts);
-    const mcp = new Server(
-      { name: "sechroom", version: "0.1.0" },
-      {
-        capabilities: { experimental: { "claude/channel": {} } },
-        instructions: 'Matched Sechroom substrate events arrive as <channel source="sechroom"> tags. A WLP dispatch (kind:task \u2192 status:in-progress) means a task is runnable now: load the memory id from the event, do the work, then write a closeout memory tagged wlp-decomposition:{id} + wlp-task:{taskId} + verdict:{pass|soft-fail|plan-invalid|blocked}.'
-      }
-    );
-    await mcp.connect(new StdioServerTransport());
-    await ensureSubscription(cfg, opts.name, filter);
-    const seen = /* @__PURE__ */ new Set();
-    const deliver = makeDeliver(filter, seen, (payload) => {
+    surface ??= surfaceDefault;
+    instanceKey ??= lane;
+    laneId ??= lane;
+    runtime ??= surface === "codex" ? "codex" : "claude-code";
+    if (!connector)
+      fail(
+        "executor install requires --connector (or an interactive connector id)"
+      );
+    if (!instanceKey)
+      fail(
+        "no instance key resolved; pass --instance-key or pin .sechroom/lane.json code-lane"
+      );
+    if (!opts.yes && !canPrompt())
+      fail("non-interactive executor install requires --yes");
+    parseRuntimeKind(runtime);
+    if (!["claude", "codex"].includes(surface))
+      fail("surface must be claude or codex");
+    if (opts.refreshAfter >= opts.ttl)
+      fail("refresh-after must be shorter than the TTL");
+    const sem = readSem();
+    const checkout = sem ? dirname5(dirname5(sem.path)) : process.cwd();
+    const statePath = join8(checkout, ".sechroom", EXECUTOR_STATE);
+    const state = {
+      schemaVersion: 1,
+      instanceKey,
+      laneId,
+      runtime: runtime.toLowerCase() === "codex" ? "codex" : "claude-code",
+      connectorId: connector,
+      capabilityKeys: capabilities ?? [],
+      relayId: opts.relay,
+      subscriptionName: opts.subscriptionName,
+      ttlSeconds: opts.ttl,
+      refreshAfterSeconds: opts.refreshAfter
+    };
+    if (!opts.dryRun) {
+      mkdirSync6(dirname5(statePath), { recursive: true });
+      writeFileSync6(statePath, JSON.stringify(state, null, 2) + "\n");
+      ensureStateDirIgnored(checkout);
+    }
+    const configuredClaudeDirs = globals.claudeConfigDir || process.env.CLAUDE_CONFIG_DIR ? resolveClaudeTargets({ override: globals.claudeConfigDir }).map(
+      (target) => target.dir
+    ) : [join8(checkout, ".claude")];
+    const configuredCodexHomes = globals.codexHome || process.env.CODEX_HOME ? resolveCodexHomes({ override: globals.codexHome }) : [join8(checkout, ".codex")];
+    const hookTargets = surface === "claude" ? configuredClaudeDirs : configuredCodexHomes;
+    for (const target of hookTargets) {
+      const results = surface === "claude" ? [
+        installClaudeCommands(
+          target,
+          CLAUDE_EXECUTOR_HOOKS,
+          opts.dryRun
+        )
+      ] : installCodexCommands(target, CODEX_EXECUTOR_HOOKS, opts.dryRun);
+      for (const result of results)
+        process.stderr.write(describe(result, opts.dryRun) + "\n");
+    }
+    warnIfSechroomNotOnPath();
+    process.stderr.write(
+      style.green("executor harness configured") + style.dim(` \u2014 ${instanceKey}
+`)
+    );
+  });
+  executor.command("hook-pulse").description("Hook adapter: register or refresh this checkout's executor").action(async (_opts, cmd) => {
+    await drainStdin();
+    const located = readExecutorState();
+    if (!located) return;
+    const { state, path } = located;
+    const age = state.lastRefreshAt ? Date.now() - Date.parse(state.lastRefreshAt) : Number.POSITIVE_INFINITY;
+    if (state.instanceId && age < state.refreshAfterSeconds * 1e3) return;
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    try {
+      await ensureExecutorInstance(cfg, { state, path });
+    } catch {
+    }
+  });
+  executor.command("hook-stop").description("Hook adapter: deregister this checkout's executor").action(async (_opts, cmd) => {
+    await drainStdin();
+    const located = readExecutorState();
+    if (!located?.state.instanceId) return;
+    try {
+      await api(
+        resolveConfig(cmd.optsWithGlobals()),
+        `/me/executor-instances/${encodeURIComponent(located.state.instanceId)}`,
+        { method: "DELETE", body: JSON.stringify({}) }
+      );
+      delete located.state.instanceId;
+      delete located.state.lastRefreshAt;
+      writeFileSync6(
+        located.path,
+        JSON.stringify(located.state, null, 2) + "\n"
+      );
+    } catch {
+    }
+  });
+  executor.command("submit-connector").description(
+    "Submit a local-session connector definition for governed approval"
+  ).requiredOption("--slug <slug>", "Unique connector definition slug").requiredOption("--display-name <name>", "Human-readable connector name").requiredOption("--transport <kind>", "push | pull").option("--profile <profile...>", "Advertised runtime profiles", [
+    "base",
+    "dotnet-10"
+  ]).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(cfg, "/connectors/definitions", {
+      method: "POST",
+      body: JSON.stringify({
+        slug: opts.slug,
+        displayName: opts.displayName,
+        runtimeProfiles: opts.profile,
+        connectorKind: "ExecutionRuntime",
+        providerKind: "local-session",
+        dispatchTransport: parseTransport(opts.transport)
+      })
+    });
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+    if (!cmd.optsWithGlobals().json) {
+      process.stderr.write(
+        style.dim(
+          "approve this connector definition before registering executors\n"
+        )
+      );
+    }
+  });
+  executor.command("register").description(
+    "Create/reuse a SignalR binding and register this local executor instance"
+  ).requiredOption(
+    "--instance-key <key>",
+    "Stable key for this concrete session/lane"
+  ).requiredOption(
+    "--connector <id>",
+    "Approved local-session ConnectorDefinition id"
+  ).option("--runtime <kind>", "claude-code | codex", "claude-code").option(
+    "--lane-id <lane>",
+    "Canonical affinity lane (defaults to instance key)"
+  ).option(
+    "--relay <id>",
+    "Relay identity shared by sibling instances",
+    "sechroom-cli-local"
+  ).option(
+    "--subscription-name <name>",
+    "SignalR delivery binding name",
+    "executor-dispatch"
+  ).option(
+    "--capability <key...>",
+    "Capability operation keys claimed by this instance"
+  ).option("--tool-set-ref <ref>", "Optional governed tool-set reference").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const subscription = await api(
+      cfg,
+      "/me/delivery-subscriptions/signalr",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          name: opts.subscriptionName,
+          enabled: true,
+          // Exact executor fanout ignores this generic filter; the fixed tag only
+          // satisfies the legacy SignalR subscription shape.
+          filter: { tags: ["kind:task"], workspaceScope: [] }
+        })
+      }
+    );
+    const data = await api(
+      cfg,
+      "/me/executor-instances",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          relayId: opts.relay,
+          instanceKey: opts.instanceKey,
+          laneId: opts.laneId ?? opts.instanceKey,
+          runtimeKind: parseRuntimeKind(opts.runtime),
+          activationMode: "Attached",
+          deliverySubscriptionId: subscription.id,
+          connectorId: opts.connector,
+          claimedCapabilityKeys: opts.capability ?? [],
+          toolSetRef: opts.toolSetRef ?? null,
+          ttlSeconds: opts.ttl
+        })
+      }
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+    if (!cmd.optsWithGlobals().json)
+      process.stderr.write(
+        style.dim(`refresh with: sechroom executor heartbeat ${data.id}
+`)
+      );
+  });
+  executor.command("refresh <id>").description("Refresh one advertisement lease once").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (id, opts, cmd) => {
+    const data = await refreshExecutorInstance(
+      resolveConfig(cmd.optsWithGlobals()),
+      id,
+      opts.ttl
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+  });
+  executor.command("heartbeat <id>").description("Keep an advertisement alive until interrupted").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).option("--interval <seconds>", "Refresh interval", parseInteger, 40).action(async (id, opts, cmd) => {
+    if (opts.interval >= opts.ttl)
+      fail("heartbeat interval must be shorter than the TTL");
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    await refreshExecutorInstance(cfg, id, opts.ttl);
+    process.stderr.write(
+      style.green("executor heartbeat active") + style.dim(` \u2014 ${id}
+`)
+    );
+    await holdHeartbeat(async () => {
+      await refreshExecutorInstance(cfg, id, opts.ttl);
+    }, opts.interval * 1e3);
+  });
+  executor.command("offers <id>").description("List live dispatch offers addressed to this exact instance").action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(id)}/dispatch-offers`
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+  });
+  executor.command("deregister <id>").description("Stop advertising this executor instance").action(async (id, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(id)}`,
+      {
+        method: "DELETE",
+        body: JSON.stringify({})
+      }
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+  });
+}
+function parseRuntimeKind(value) {
+  switch (value.trim().toLowerCase()) {
+    case "claude":
+    case "claude-code":
+      return "ClaudeCode";
+    case "codex":
+      return "Codex";
+    default:
+      return fail("runtime must be claude-code or codex");
+  }
+}
+function parseTransport(value) {
+  switch (value.trim().toLowerCase()) {
+    case "push":
+      return "Push";
+    case "pull":
+      return "Pull";
+    default:
+      return fail("transport must be push or pull");
+  }
+}
+async function refreshExecutorInstance(cfg, id, ttlSeconds) {
+  return api(
+    cfg,
+    `/me/executor-instances/${encodeURIComponent(id)}/refresh`,
+    {
+      method: "POST",
+      body: JSON.stringify({ ttlSeconds })
+    }
+  );
+}
+async function registerInstance(cfg, state) {
+  const subscription = await api(
+    cfg,
+    "/me/delivery-subscriptions/signalr",
+    {
+      method: "POST",
+      body: JSON.stringify(executorSubscriptionInput(state.subscriptionName))
+    }
+  );
+  return api(cfg, "/me/executor-instances", {
+    method: "POST",
+    body: JSON.stringify(executorRegistrationInput(state, subscription.id))
+  });
+}
+async function ensureExecutorInstance(cfg, located) {
+  const { state, path } = located;
+  state.laneId ??= state.instanceKey;
+  const data = await registerInstance(cfg, state);
+  state.instanceId = data.id;
+  state.lastRefreshAt = (/* @__PURE__ */ new Date()).toISOString();
+  writeFileSync6(path, JSON.stringify(state, null, 2) + "\n");
+  return data;
+}
+function readExecutorState(start = process.cwd()) {
+  const semPath = resolveSemPathForRead(start);
+  const sem = semPath ? readSem(semPath) : void 0;
+  const path = join8(
+    sem ? dirname5(sem.path) : join8(start, ".sechroom"),
+    EXECUTOR_STATE
+  );
+  if (!existsSync7(path)) return void 0;
+  return {
+    state: JSON.parse(readFileSync5(path, "utf8")),
+    path
+  };
+}
+async function drainStdin() {
+  if (process.stdin.isTTY) return;
+  for await (const _chunk of process.stdin) {
+  }
+}
+async function api(cfg, path, init) {
+  const token = await requireToken(cfg);
+  const response = await fetch(`${cfg.baseUrl}${path}`, {
+    ...init,
+    headers: {
+      authorization: `Bearer ${token}`,
+      tenant: cfg.tenant,
+      "content-type": "application/json",
+      "x-sechroom-surface": "cli"
+    }
+  });
+  if (!response.ok)
+    fail(
+      `${init?.method ?? "GET"} ${path} failed (${response.status}): ${await response.text()}`
+    );
+  return response.json();
+}
+function parseInteger(value) {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isFinite(parsed)) fail(`expected an integer, got '${value}'`);
+  return parsed;
+}
+function holdHeartbeat(tick, intervalMs) {
+  return new Promise((resolve3, reject) => {
+    const timer = setInterval(() => void tick().catch(reject), intervalMs);
+    const stop = () => {
+      clearInterval(timer);
+      resolve3();
+    };
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+  });
+}
+
+// src/commands/channel.ts
+function registerChannel(program2) {
+  const channel = program2.command("channel").description(
+    "Receive matched substrate events over the held SignalR push leg (D-WLP-9)"
+  );
+  const withFilterOpts = (c) => c.option(
+    "--name <name>",
+    "Deprecated: ignored; the installed executor selects its delivery subscription"
+  ).option(
+    "--tag <tag...>",
+    "Deprecated: executor eligibility comes from the installed capability advertisement"
+  ).option(
+    "--workspace <wsp...>",
+    "Deprecated: workspace authority is resolved by the server"
+  ).option(
+    "--executor-instance <id>",
+    "Deprecated: the instance is read from .sechroom/executor.json"
+  );
+  withFilterOpts(
+    channel.command("connect").description(
+      "Register a SignalR subscription and stream matched events to stdout"
+    )
+  ).action(async (opts, cmd) => {
+    const json = Boolean(cmd.optsWithGlobals().json);
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    warnLegacyChannelOptions(opts);
+    const located = requireExecutorState();
+    const instance = await ensureExecutorInstance(cfg, located);
+    const deliver = (payload) => process.stdout.write(
+      (typeof payload === "string" ? payload : JSON.stringify(payload)) + "\n"
+    );
+    const drain = createClaimDrain(cfg, instance.id, deliver);
+    const conn = await openConnection(
+      cfg,
+      () => {
+        void drain().catch(
+          (e) => process.stderr.write(err(`channel claim failed: ${String(e)}
+`))
+        );
+      },
+      instance.id
+    );
+    await drain();
+    const stopReconciliation = startOfferReconciliation(drain);
+    const stopHeartbeat = startExecutorHeartbeat(
+      () => refreshExecutorInstance(cfg, instance.id, located.state.ttlSeconds),
+      located.state.refreshAfterSeconds * 1e3
+    );
+    if (json) {
+      emit(
+        {
+          connected: true,
+          tenant: cfg.tenant,
+          executorInstanceId: instance.id,
+          instanceKey: located.state.instanceKey,
+          laneId: located.state.laneId
+        },
+        true
+      );
+    } else {
+      process.stderr.write(
+        style.green("channel connected") + style.dim(
+          ` \u2014 tenant ${cfg.tenant}, executor ${located.state.instanceKey}
+`
+        ) + style.dim("streaming matched events to stdout; Ctrl-C to stop.\n")
+      );
+    }
+    try {
+      await holdOpen(conn);
+    } finally {
+      stopReconciliation();
+      stopHeartbeat();
+    }
+  });
+  withFilterOpts(
+    channel.command("mcp").description(
+      "Run as a Claude Code channel (local-stdio MCP server) \u2014 push matched events into the session"
+    )
+  ).action(async (opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    warnLegacyChannelOptions(opts);
+    const located = requireExecutorState();
+    const instance = await ensureExecutorInstance(cfg, located);
+    const mcp = new Server(
+      { name: "sechroom", version: "0.1.0" },
+      {
+        capabilities: { experimental: { "claude/channel": {} } },
+        instructions: 'Matched Sechroom substrate events arrive as <channel source="sechroom"> tags. A WLP dispatch delivered here has already been atomically claimed for this executor. Load the memory id from the event and retain the lease and claim token for holder-bound completion.'
+      }
+    );
+    await mcp.connect(new StdioServerTransport());
+    const deliver = (payload) => {
       const { content, meta } = summarizeEvent(payload);
       void mcp.notification({
         method: "notifications/claude/channel",
@@ -1772,37 +2460,53 @@ function registerChannel(program2) {
         (e) => process.stderr.write(err(`channel push failed: ${String(e)}
 `))
       );
-    });
-    const conn = await openConnection(cfg, deliver, opts.executorInstance);
-    await reconcile(cfg, filter, deliver);
+    };
+    const drain = createClaimDrain(cfg, instance.id, deliver);
+    const conn = await openConnection(
+      cfg,
+      () => {
+        void drain().catch(
+          (e) => process.stderr.write(err(`channel claim failed: ${String(e)}
+`))
+        );
+      },
+      instance.id
+    );
+    await drain();
+    const stopReconciliation = startOfferReconciliation(drain);
+    const stopHeartbeat = startExecutorHeartbeat(
+      () => refreshExecutorInstance(cfg, instance.id, located.state.ttlSeconds),
+      located.state.refreshAfterSeconds * 1e3
+    );
     process.stderr.write(
       style.dim(
-        `sechroom channel (mcp) \u2014 tenant ${cfg.tenant}, tags [${filter.tags.join(", ")}]
+        `sechroom channel (mcp) \u2014 tenant ${cfg.tenant}, executor ${located.state.instanceKey}
 `
       )
     );
-    await holdOpen(conn);
+    try {
+      await holdOpen(conn);
+    } finally {
+      stopReconciliation();
+      stopHeartbeat();
+    }
   });
   channel.command("install").description(
     "Wire `sechroom channel mcp` into the project .mcp.json as a Claude Code channel MCP server (idempotent)"
   ).option(
     "--workspace <wsp...>",
-    "Restrict dispatches to these workspace id(s)"
+    "Deprecated: accepted only to migrate an existing managed entry"
   ).option(
     "--tag <tag...>",
-    "Tag(s) a dispatch must carry to match (repeatable). Default targets WLP task dispatches.",
-    ["kind:task"]
+    "Deprecated: accepted only to migrate an existing managed entry"
   ).option(
     "--name <name>",
     "MCP server + subscription name (idempotent per name)",
     "sechroom-channel"
   ).option("--dry-run", "Print what would change; write nothing").action((opts) => {
-    const path = join7(process.cwd(), ".mcp.json");
+    const path = join9(process.cwd(), ".mcp.json");
     const dryRun = Boolean(opts.dryRun);
-    const args = ["channel", "mcp", "--name", opts.name];
-    for (const w of opts.workspace ?? [])
-      args.push("--workspace", w);
-    for (const t of opts.tag ?? []) args.push("--tag", t);
+    const args = ["channel", "mcp"];
     const entry = { command: "sechroom", args };
     const config2 = readMcpConfig(path);
     config2.mcpServers ??= {};
@@ -1810,8 +2514,8 @@ function registerChannel(program2) {
     const status = JSON.stringify(existing) === JSON.stringify(entry) ? "current" : existing ? "updated" : "created";
     if (status !== "current" && !dryRun) {
       config2.mcpServers[opts.name] = entry;
-      mkdirSync5(dirname4(path), { recursive: true });
-      writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
+      mkdirSync7(dirname6(path), { recursive: true });
+      writeFileSync7(path, JSON.stringify(config2, null, 2) + "\n");
     }
     const verb = status === "current" ? "already configured" : dryRun ? `would ${status === "created" ? "create" : "update"}` : status;
     process.stdout.write(`${style.green("channel")} ${path} (${verb})
@@ -1831,23 +2535,124 @@ Load it (Channels research preview) by launching your agent with:
       );
     }
     warnIfSechroomNotOnPath();
+    if ((opts.workspace?.length ?? 0) > 0 || (opts.tag?.length ?? 0) > 0)
+      process.stderr.write(
+        style.dim(
+          "channel: --workspace/--tag are retired; the managed entry now uses the installed executor advertisement.\n"
+        )
+      );
   });
   channel.addHelpText(
     "after",
     `
 Examples:
-  $ sechroom channel connect                         stream WLP task dispatches to stdout
-  $ sechroom channel connect --tag kind:task --tag status:in-progress
-  $ sechroom channel connect --workspace wsp_X --json | jq .
+  $ sechroom executor install                        configure capability + lane advertisement
+  $ sechroom channel connect                         claim WLP dispatches and stream them to stdout
 
   # Wire it as a Claude Code channel MCP server (research preview, v2.1.80+):
-  $ sechroom channel install --workspace wsp_X --tag kind:task --tag status:in-progress
+  $ sechroom channel install                          migrate/install the exact-instance channel
   #   then:  claude --dangerously-load-development-channels server:sechroom-channel`
   );
 }
+function requireExecutorState() {
+  const located = readExecutorState();
+  if (!located)
+    return fail(
+      "channel requires an installed executor advertisement; run `sechroom executor install` first."
+    );
+  return located;
+}
+function warnLegacyChannelOptions(opts) {
+  if (!opts.name && (opts.workspace?.length ?? 0) === 0 && (opts.tag?.length ?? 0) === 0 && !opts.executorInstance)
+    return;
+  process.stderr.write(
+    style.dim(
+      "channel: --name, --workspace, --tag, and --executor-instance are retired; delivery, eligibility, and identity come from the installed executor advertisement.\n"
+    )
+  );
+}
+function createClaimDrain(cfg, executorInstanceId, deliver, dependencies = {}) {
+  let active2;
+  const state = {};
+  return () => {
+    active2 ??= drainClaims(cfg, executorInstanceId, deliver, {
+      ...dependencies,
+      state
+    }).finally(() => {
+      active2 = void 0;
+    });
+    return active2;
+  };
+}
+function startOfferReconciliation(drain, intervalMilliseconds = 5e3, dependencies = {}) {
+  const schedule = dependencies.setInterval ?? setInterval;
+  const cancel = dependencies.clearInterval ?? clearInterval;
+  const onError = dependencies.onError ?? ((error) => process.stderr.write(err(`channel claim failed: ${String(error)}
+`)));
+  const timer = schedule(() => {
+    void drain().catch(onError);
+  }, intervalMilliseconds);
+  return () => cancel(timer);
+}
+function startExecutorHeartbeat(refresh, intervalMilliseconds, dependencies = {}) {
+  const schedule = dependencies.setInterval ?? setInterval;
+  const cancel = dependencies.clearInterval ?? clearInterval;
+  const onError = dependencies.onError ?? ((error) => process.stderr.write(err(`channel heartbeat failed: ${String(error)}
+`)));
+  const timer = schedule(() => {
+    void refresh().catch(onError);
+  }, intervalMilliseconds);
+  return () => cancel(timer);
+}
+async function drainClaims(cfg, executorInstanceId, deliver, dependencies = {}) {
+  const request = dependencies.request ?? api;
+  const sleep = dependencies.sleep ?? ((milliseconds) => new Promise((resolve3) => setTimeout(resolve3, milliseconds)));
+  const idempotencyKey = dependencies.idempotencyKey ?? ((offer) => `channel:${offer.generationId}`);
+  const state = dependencies.state ?? {};
+  for (; ; ) {
+    if (state.pendingIdempotencyKey) {
+      const replay = await request(
+        cfg,
+        `/me/executor-instances/${encodeURIComponent(executorInstanceId)}/dispatch-offers/claim-next`,
+        {
+          method: "POST",
+          body: JSON.stringify({ idempotencyKey: state.pendingIdempotencyKey })
+        }
+      );
+      state.pendingIdempotencyKey = void 0;
+      if (replay.outcome === "Claimed" || replay.outcome === "AlreadyHeld") {
+        deliver(replay);
+        continue;
+      }
+      return;
+    }
+    const offers = await request(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(executorInstanceId)}/dispatch-offers`
+    );
+    const offer = offers[0];
+    if (!offer) return;
+    if (offer.suggestedClaimDelayMs > 0)
+      await sleep(offer.suggestedClaimDelayMs);
+    state.pendingIdempotencyKey = idempotencyKey(offer);
+    const claim = await request(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(executorInstanceId)}/dispatch-offers/claim-next`,
+      {
+        method: "POST",
+        body: JSON.stringify({ idempotencyKey: state.pendingIdempotencyKey })
+      }
+    );
+    state.pendingIdempotencyKey = void 0;
+    if (claim.outcome === "NoOffer") return;
+    if (claim.outcome === "Claimed" || claim.outcome === "AlreadyHeld")
+      deliver(claim);
+    else return;
+  }
+}
 function readMcpConfig(path) {
-  if (!existsSync6(path)) return {};
-  const raw = readFileSync4(path, "utf8");
+  if (!existsSync8(path)) return {};
+  const raw = readFileSync6(path, "utf8");
   if (!raw.trim()) return {};
   try {
     return JSON.parse(raw);
@@ -1855,34 +2660,7 @@ function readMcpConfig(path) {
     return fail(
       `Could not parse ${path} as JSON \u2014 fix or remove it before installing the channel.`
     );
-  }
-}
-function readFilter(opts) {
-  const tags = opts.tag ?? [];
-  const workspaceScope = opts.workspace ?? [];
-  if (tags.length === 0 && workspaceScope.length === 0)
-    fail(
-      "A channel subscription needs at least one --tag or --workspace (an empty filter receives nothing)."
-    );
-  return { tags, workspaceScope };
-}
-async function ensureSubscription(cfg, name, filter) {
-  const token = await requireToken(cfg);
-  const resp = await fetch(`${cfg.baseUrl}/me/delivery-subscriptions/signalr`, {
-    method: "POST",
-    headers: {
-      authorization: `Bearer ${token}`,
-      tenant: cfg.tenant,
-      "content-type": "application/json",
-      "x-sechroom-surface": "cli"
-    },
-    body: JSON.stringify({ name, enabled: true, filter })
-  });
-  if (!resp.ok)
-    fail(
-      `Could not register the SignalR subscription (HTTP ${resp.status}): ${await resp.text()}`
-    );
-  return await resp.json();
+  }
 }
 async function openConnection(cfg, onEvent, executorInstanceId) {
   const query = executorInstanceId ? `?executorInstanceId=${encodeURIComponent(executorInstanceId)}` : "";
@@ -1920,7 +2698,8 @@ function parseEvent(payload) {
     }
   }
   const obj = data ?? {};
-  const inner = obj.data ?? obj;
+  const envelope = obj.data ?? obj;
+  const inner = envelope.offer ?? envelope;
   const rawTags = inner.tags ?? inner.Tags;
   return {
     eventType: str(inner.eventType ?? inner.EventType ?? obj.type) || "substrate.event",
@@ -1929,113 +2708,6 @@ function parseEvent(payload) {
     tags: Array.isArray(rawTags) ? rawTags.filter((t) => typeof t === "string") : void 0
   };
 }
-function shouldDeliver(payload, filter) {
-  const { workspaceId, tags } = parseEvent(payload);
-  if (filter.workspaceScope.length > 0 && (!workspaceId || !filter.workspaceScope.includes(workspaceId)))
-    return false;
-  if (filter.tags.length > 0) {
-    if (!tags) return false;
-    return facetedTagMatch(tags, filter.tags);
-  }
-  return true;
-}
-function makeDeliver(filter, seen, forward) {
-  return (payload) => {
-    if (!shouldDeliver(payload, filter)) return;
-    const { memoryId } = parseEvent(payload);
-    if (memoryId) {
-      if (seen.has(memoryId)) return;
-      seen.add(memoryId);
-    }
-    forward(payload);
-  };
-}
-async function reconcile(cfg, filter, deliver) {
-  if (filter.workspaceScope.length === 0) {
-    process.stderr.write(
-      style.dim(
-        "channel: no --workspace to reconcile against; live feed only (a dropped dispatch won't be recovered).\n"
-      )
-    );
-    return;
-  }
-  if (filter.tags.length === 0) return;
-  let token;
-  try {
-    token = await requireToken(cfg);
-  } catch {
-    return;
-  }
-  const qs = `filterTags=${encodeURIComponent(filter.tags.join(","))}&limit=100`;
-  let recovered = 0;
-  for (const ws of filter.workspaceScope) {
-    try {
-      const resp = await fetch(
-        `${cfg.baseUrl}/workspaces/${encodeURIComponent(ws)}/memories/feed?${qs}`,
-        {
-          headers: {
-            authorization: `Bearer ${token}`,
-            tenant: cfg.tenant,
-            "x-sechroom-surface": "cli"
-          }
-        }
-      );
-      if (!resp.ok) {
-        process.stderr.write(
-          err(
-            `channel: reconcile query for ${ws} failed (HTTP ${resp.status})
-`
-          )
-        );
-        continue;
-      }
-      const data = await resp.json();
-      for (const m of data.results ?? []) {
-        if (!m.id) continue;
-        deliver({
-          eventType: "reconcile",
-          memoryId: m.id,
-          workspaceId: ws,
-          tags: m.tags ?? []
-        });
-        recovered++;
-      }
-    } catch (e) {
-      process.stderr.write(
-        err(`channel: reconcile error for ${ws}: ${String(e)}
-`)
-      );
-    }
-  }
-  if (recovered > 0)
-    process.stderr.write(
-      style.dim(
-        `channel: reconciled ${recovered} already-queued event(s) on connect.
-`
-      )
-    );
-}
-function facetedTagMatch(eventTags, filterTags) {
-  const have = new Set(eventTags);
-  const groups = /* @__PURE__ */ new Map();
-  for (const f of filterTags) {
-    const ns = f.endsWith(":*") ? f.slice(0, -2) : namespaceOf(f);
-    const group = groups.get(ns) ?? [];
-    group.push(f);
-    groups.set(ns, group);
-  }
-  for (const [ns, group] of groups) {
-    const ok2 = group.some(
-      (f) => f.endsWith(":*") ? eventTags.some((t) => namespaceOf(t) === ns) : have.has(f)
-    );
-    if (!ok2) return false;
-  }
-  return true;
-}
-function namespaceOf(tag) {
-  const i = tag.indexOf(":");
-  return i >= 0 ? tag.slice(0, i) : tag;
-}
 function summarizeEvent(payload) {
   const { eventType, memoryId, workspaceId } = parseEvent(payload);
   const content = memoryId ? `${eventType}: ${memoryId}${workspaceId ? ` (workspace ${workspaceId})` : ""}` : typeof payload === "string" ? payload : JSON.stringify(payload);
@@ -2043,266 +2715,106 @@ function summarizeEvent(payload) {
   if (eventType) meta.event_type = eventType;
   if (memoryId) meta.memory_id = memoryId;
   if (workspaceId) meta.workspace_id = workspaceId;
-  return { content, meta };
-}
-function str(v) {
-  return typeof v === "string" ? v : v == null ? "" : String(v);
-}
-
-// src/commands/chat.ts
-function registerChat(program2) {
-  const chat = program2.command("chat").description("Send and read Slack / Discord channel messages").option("--surface <surface>", "slack | discord", "slack");
-  chat.addHelpText(
-    "after",
-    `
-Examples:
-  $ sechroom chat send C0123456789 "deploy is green" --surface slack
-  $ sechroom chat send 987654321098765432 "deploy is green" --surface discord --guild 123456789012345678
-  $ sechroom chat send C0123456789 "lgtm" --surface slack --as user --parent 1718049600.123456
-  $ sechroom chat messages --surface slack
-  $ sechroom chat replies 1718049600.123456 --surface slack
-  $ sechroom chat stop-tracking 1718049600.123456 --surface slack`
-  );
-  chat.command("send <channelId> <text>").description("Send a message to a channel (POST /chat/channel-messages/{surface})").option("--guild <guildId>", "Discord guild snowflake \u2014 required for --surface discord").option("--memory <memoryId>", "Attach a sechroom memory id").option("--no-track", "Don't capture replies to this message").option("--parent <parentMessage>", "Thread under a parent (Slack thread_ts / Discord message id)").option("--source <source>", "Source / lane stamp (renders an attribution footer)", "cli").option("--as <as>", "Slack only: 'bot' (default) or 'user' (your linked Slack identity)", "bot").action(async (channelId, text2, opts, cmd) => {
-    const { surface, ...globals } = cmd.optsWithGlobals();
-    const json = Boolean(cmd.optsWithGlobals().json);
-    const cfg = resolveConfig(globals);
-    const data = await runApi("Sending message", async () => {
-      const client = await makeClient(cfg);
-      return client.POST("/chat/channel-messages/{surface}", {
-        params: { path: { surface: String(surface) } },
-        body: {
-          channelId,
-          text: text2,
-          guildId: opts.guild ?? null,
-          attachedMemoryId: opts.memory ?? null,
-          trackReplies: opts.track,
-          parentMessage: opts.parent ?? null,
-          source: opts.source,
-          as: opts.as
-        }
-      });
-    });
-    if (!data.ok) {
-      if (json) {
-        emit(data, true);
-      } else {
-        process.stderr.write(
-          `${err("\u2717")} send failed: ${data.upstreamError ?? "error"}${data.errorDescription ? ` \u2014 ${data.errorDescription}` : ""}
-`
-        );
-      }
-      process.exit(1);
-    }
-    const idPart = data.persistedId ? ` ${style.dim(`(${data.persistedId})`)}` : "";
-    emitAction(`sent to ${surface} ${style.bold(channelId)}${idPart}`, data, json);
-  });
-  chat.command("messages").description("List recent channel messages (GET /chat/channel-messages/{surface})").action(async (_opts, cmd) => {
-    const { surface, ...globals } = cmd.optsWithGlobals();
-    const cfg = resolveConfig(globals);
-    const data = await runApi("Fetching messages", async () => {
-      const client = await makeClient(cfg);
-      return client.GET("/chat/channel-messages/{surface}", {
-        params: { path: { surface: String(surface) } }
-      });
-    });
-    emit(data, cmd.optsWithGlobals().json);
-  });
-  chat.command("replies <messageId>").description("List thread replies for a message (GET /chat/channel-messages/by-id/{id}/replies)").action(async (messageId, _opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Fetching replies", async () => {
-      const client = await makeClient(cfg);
-      return client.GET("/chat/channel-messages/by-id/{id}/replies", {
-        params: { path: { id: messageId } }
-      });
-    });
-    emit(data, cmd.optsWithGlobals().json);
-  });
-  chat.command("stop-tracking <messageId>").description("Stop watching a message for replies (POST .../by-id/{id}/stop-tracking-replies)").action(async (messageId, _opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Stopping reply tracking", async () => {
-      const client = await makeClient(cfg);
-      return client.POST("/chat/channel-messages/by-id/{id}/stop-tracking-replies", {
-        params: { path: { id: messageId } },
-        body: {}
-      });
-    });
-    emitAction(`stopped tracking replies on ${style.bold(messageId)}`, data, cmd.optsWithGlobals().json);
-  });
-}
-
-// src/commands/checkpoint.ts
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname7, join as join10 } from "path";
-
-// src/commands/hook.ts
-import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync6, statSync as statSync2, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname6, join as join9 } from "path";
-
-// src/sem.ts
-import { dirname as dirname5, join as join8 } from "path";
-import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync6 } from "fs";
-var SEM_FILE = join8(".sechroom", "lane.json");
-var STATE_DIR_NAME2 = ".sechroom";
-function localSemPath(cwd = process.cwd()) {
-  return join8(cwd, SEM_FILE);
-}
-function resolveSemPathForRead(start = process.cwd()) {
-  let dir = start;
-  while (true) {
-    const candidate = join8(dir, SEM_FILE);
-    if (existsSync7(candidate)) return candidate;
-    const parent = dirname5(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
-  }
-}
-function applyWorktreeLaneSuffix(lane, start = process.cwd()) {
-  try {
-    let dir = start;
-    let gitPath;
-    for (; ; ) {
-      const candidate = join8(dir, ".git");
-      if (existsSync7(candidate)) {
-        gitPath = candidate;
-        break;
-      }
-      const parent = dirname5(dir);
-      if (parent === dir) break;
-      dir = parent;
-    }
-    if (!gitPath || statSync(gitPath).isDirectory()) return lane;
-    const gitFile = readFileSync5(gitPath, "utf8");
-    const common = gitFile.trim().match(/^gitdir:\s*(.+)\/worktrees\/[^/\s]+\s*$/);
-    if (!common) return lane;
-    const worktreesDir = join8(common[1], "worktrees");
-    const siblings = readdirSync(worktreesDir).filter((n) => {
-      try {
-        return statSync(join8(worktreesDir, n)).isDirectory();
-      } catch {
-        return false;
-      }
-    });
-    return laneWithWorktreeSuffix(lane, gitFile, siblings);
-  } catch {
-    return lane;
-  }
-}
-function laneWithWorktreeSuffix(lane, gitFile, siblings) {
-  const m = gitFile.trim().match(/\/worktrees\/([^/\s]+)\s*$/);
-  if (!m) return lane;
-  const idx = [...siblings].sort().indexOf(m[1]);
-  return idx < 0 ? lane : `${lane}-${idx + 2}`;
-}
-function serializeSem(values) {
-  return JSON.stringify(values, null, 2) + "\n";
-}
-function readSem(path) {
-  const p = path ?? resolveSemPathForRead();
-  if (!p || !existsSync7(p)) return void 0;
-  return { path: p, values: parseLaneJson(readFileSync5(p, "utf8")) };
-}
-function readLocalSemValues(cwd = process.cwd()) {
-  const next = join8(cwd, SEM_FILE);
-  if (existsSync7(next)) return readSem(next)?.values ?? {};
-  return {};
-}
-function parseLaneJson(text2) {
-  try {
-    const parsed = JSON.parse(text2);
-    const out = {};
-    for (const [k, v] of Object.entries(parsed)) {
-      if (typeof v === "string") out[k] = v;
-    }
-    return out;
-  } catch {
-    return {};
-  }
-}
-var STATE_DIR_IGNORE = `${STATE_DIR_NAME2}/`;
-function writeSem(values, path = localSemPath()) {
-  mkdirSync6(dirname5(path), { recursive: true });
-  writeFileSync6(path, serializeSem(values));
-  ensureSemIgnored(path);
-  ensureContinuityScaffold(path);
-  return path;
-}
-function ensureStateDirIgnored(cwd = process.cwd()) {
-  ensureSemIgnored(localSemPath(cwd));
-}
-var CONTINUITY_FILE_NAME = "continuity.json";
-var CONTINUITY_SCAFFOLD = JSON.stringify(
-  {
-    _readme: "Agent-maintained continuity intent. Keep these current during the session; `sechroom checkpoint` and the PreCompact hook snapshot from here. The five required fields (objective, state, lastAction, nextAction, resumeInstruction) must all be non-empty for a snapshot to be created.",
-    objective: "",
-    state: "",
-    lastAction: "",
-    nextAction: "",
-    resumeInstruction: "",
-    constraints: [],
-    questions: [],
-    artifacts: [],
-    confidence: null
-  },
-  null,
-  2
-) + "\n";
-function ensureContinuityScaffold(semPath) {
-  try {
-    const target = join8(dirname5(semPath), CONTINUITY_FILE_NAME);
-    if (existsSync7(target)) return;
-    writeFileSync6(target, CONTINUITY_SCAFFOLD);
-  } catch {
-  }
-}
-function ignoresSem(content) {
-  return content.split("\n").some((line) => {
-    const t = line.trim();
-    return t === STATE_DIR_NAME2 || t === STATE_DIR_IGNORE || t === `/${STATE_DIR_NAME2}` || t === `/${STATE_DIR_IGNORE}` || t === `**/${STATE_DIR_NAME2}` || t === `**/${STATE_DIR_IGNORE}`;
-  });
-}
-function inGitRepo(startDir) {
-  let dir = startDir;
-  for (; ; ) {
-    if (existsSync7(join8(dir, ".git"))) return true;
-    const parent = dirname5(dir);
-    if (parent === dir) return false;
-    dir = parent;
-  }
-}
-function resolveGitignoreTarget(startDir) {
-  let dir = startDir;
-  for (; ; ) {
-    const gi = join8(dir, ".gitignore");
-    if (existsSync7(gi)) return { path: gi, exists: true };
-    const parent = dirname5(dir);
-    if (existsSync7(join8(dir, ".git")) || parent === dir) {
-      return { path: join8(startDir, ".gitignore"), exists: false };
-    }
-    dir = parent;
-  }
+  const claim = payload ?? {};
+  if (claim.outcome) meta.claim_outcome = claim.outcome;
+  if (claim.lease?.id) meta.lease_id = claim.lease.id;
+  if (claim.claimToken) meta.claim_token = claim.claimToken;
+  return { content, meta };
 }
-function ensureSemIgnored(semPath) {
-  try {
-    const checkoutDir = dirname5(dirname5(semPath));
-    if (!inGitRepo(checkoutDir)) return;
-    const target = resolveGitignoreTarget(checkoutDir);
-    if (target.exists) {
-      const content = readFileSync5(target.path, "utf8");
-      if (ignoresSem(content)) return;
-      const sep = content.length === 0 || content.endsWith("\n") ? "" : "\n";
-      appendFileSync(target.path, `${sep}${STATE_DIR_IGNORE}
-`);
-    } else {
-      writeFileSync6(target.path, `${STATE_DIR_IGNORE}
-`);
+function str(v) {
+  return typeof v === "string" ? v : v == null ? "" : String(v);
+}
+
+// src/commands/chat.ts
+function registerChat(program2) {
+  const chat = program2.command("chat").description("Send and read Slack / Discord channel messages").option("--surface <surface>", "slack | discord", "slack");
+  chat.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom chat send C0123456789 "deploy is green" --surface slack
+  $ sechroom chat send 987654321098765432 "deploy is green" --surface discord --guild 123456789012345678
+  $ sechroom chat send C0123456789 "lgtm" --surface slack --as user --parent 1718049600.123456
+  $ sechroom chat messages --surface slack
+  $ sechroom chat replies 1718049600.123456 --surface slack
+  $ sechroom chat stop-tracking 1718049600.123456 --surface slack`
+  );
+  chat.command("send <channelId> <text>").description("Send a message to a channel (POST /chat/channel-messages/{surface})").option("--guild <guildId>", "Discord guild snowflake \u2014 required for --surface discord").option("--memory <memoryId>", "Attach a sechroom memory id").option("--no-track", "Don't capture replies to this message").option("--parent <parentMessage>", "Thread under a parent (Slack thread_ts / Discord message id)").option("--source <source>", "Source / lane stamp (renders an attribution footer)", "cli").option("--as <as>", "Slack only: 'bot' (default) or 'user' (your linked Slack identity)", "bot").action(async (channelId, text2, opts, cmd) => {
+    const { surface, ...globals } = cmd.optsWithGlobals();
+    const json = Boolean(cmd.optsWithGlobals().json);
+    const cfg = resolveConfig(globals);
+    const data = await runApi("Sending message", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/chat/channel-messages/{surface}", {
+        params: { path: { surface: String(surface) } },
+        body: {
+          channelId,
+          text: text2,
+          guildId: opts.guild ?? null,
+          attachedMemoryId: opts.memory ?? null,
+          trackReplies: opts.track,
+          parentMessage: opts.parent ?? null,
+          source: opts.source,
+          as: opts.as
+        }
+      });
+    });
+    if (!data.ok) {
+      if (json) {
+        emit(data, true);
+      } else {
+        process.stderr.write(
+          `${err("\u2717")} send failed: ${data.upstreamError ?? "error"}${data.errorDescription ? ` \u2014 ${data.errorDescription}` : ""}
+`
+        );
+      }
+      process.exit(1);
     }
-  } catch {
-  }
+    const idPart = data.persistedId ? ` ${style.dim(`(${data.persistedId})`)}` : "";
+    emitAction(`sent to ${surface} ${style.bold(channelId)}${idPart}`, data, json);
+  });
+  chat.command("messages").description("List recent channel messages (GET /chat/channel-messages/{surface})").action(async (_opts, cmd) => {
+    const { surface, ...globals } = cmd.optsWithGlobals();
+    const cfg = resolveConfig(globals);
+    const data = await runApi("Fetching messages", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/chat/channel-messages/{surface}", {
+        params: { path: { surface: String(surface) } }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  chat.command("replies <messageId>").description("List thread replies for a message (GET /chat/channel-messages/by-id/{id}/replies)").action(async (messageId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Fetching replies", async () => {
+      const client = await makeClient(cfg);
+      return client.GET("/chat/channel-messages/by-id/{id}/replies", {
+        params: { path: { id: messageId } }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
+  });
+  chat.command("stop-tracking <messageId>").description("Stop watching a message for replies (POST .../by-id/{id}/stop-tracking-replies)").action(async (messageId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Stopping reply tracking", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/chat/channel-messages/by-id/{id}/stop-tracking-replies", {
+        params: { path: { id: messageId } },
+        body: {}
+      });
+    });
+    emitAction(`stopped tracking replies on ${style.bold(messageId)}`, data, cmd.optsWithGlobals().json);
+  });
 }
 
+// src/commands/checkpoint.ts
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname8, join as join11 } from "path";
+
 // src/commands/hook.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync7, statSync as statSync2, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname7, join as join10 } from "path";
 async function readStdin() {
   if (process.stdin.isTTY) return "";
   const chunks = [];
@@ -2326,13 +2838,13 @@ function resolveLane(flagLane, cwd) {
   if (!base) return void 0;
   return applyWorktreeLaneSuffix(base, start);
 }
-var INTENT_FILE = join9(".sechroom", "continuity.json");
+var INTENT_FILE = join10(".sechroom", "continuity.json");
 function resolveIntentPath(start) {
   let dir = start;
   for (; ; ) {
-    const candidate = join9(dir, INTENT_FILE);
-    if (existsSync8(candidate)) return candidate;
-    const parent = dirname6(dir);
+    const candidate = join10(dir, INTENT_FILE);
+    if (existsSync9(candidate)) return candidate;
+    const parent = dirname7(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -2341,7 +2853,7 @@ function readIntent(start) {
   const path = resolveIntentPath(start);
   if (!path) return void 0;
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -2383,14 +2895,14 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
 }
 function ledgerPath(start) {
   const intent = resolveIntentPath(start);
-  const dir = intent ? dirname6(intent) : join9(start, ".sechroom");
-  return join9(dir, ".checkpoint-state.json");
+  const dir = intent ? dirname7(intent) : join10(start, ".sechroom");
+  return join10(dir, ".checkpoint-state.json");
 }
 function readLedger(start) {
   try {
     const p = ledgerPath(start);
-    if (!existsSync8(p)) return {};
-    return JSON.parse(readFileSync6(p, "utf8"));
+    if (!existsSync9(p)) return {};
+    return JSON.parse(readFileSync7(p, "utf8"));
   } catch {
     return {};
   }
@@ -2437,13 +2949,13 @@ function recordPush(start, intent) {
     } catch {
       mtimeMs = void 0;
     }
-    mkdirSync7(dirname6(p), { recursive: true });
+    mkdirSync8(dirname7(p), { recursive: true });
     const ledger = {
       lastEpochMs: Date.now(),
       lastMtimeMs: mtimeMs,
       lastHash: intentHash(intent)
     };
-    writeFileSync7(p, JSON.stringify(ledger) + "\n");
+    writeFileSync8(p, JSON.stringify(ledger) + "\n");
   } catch {
   }
 }
@@ -2696,10 +3208,10 @@ Examples:
       const client = await makeClient(cfg);
       return client.POST("/continuity/snapshots", { body });
     });
-    const path = resolveIntentPath(cwd) ?? join10(cwd, INTENT_FILE);
+    const path = resolveIntentPath(cwd) ?? join11(cwd, INTENT_FILE);
     const fileBody = { ...merged, scope, lastSnapshotId: data.snapshotId };
-    mkdirSync8(dirname7(path), { recursive: true });
-    writeFileSync8(path, JSON.stringify(fileBody, null, 2) + "\n");
+    mkdirSync9(dirname8(path), { recursive: true });
+    writeFileSync9(path, JSON.stringify(fileBody, null, 2) + "\n");
     recordPush(cwd, merged);
     if (json) {
       emit({ snapshotId: data.snapshotId, lane, scope, file: path }, true);
@@ -2713,7 +3225,7 @@ Examples:
 }
 
 // src/commands/close.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 var VERDICTS = ["pass", "soft-fail", "plan-invalid", "blocked"];
 function registerClose(program2) {
   program2.command("close").description(
@@ -2754,7 +3266,7 @@ Examples:
       );
     let bodyText;
     try {
-      bodyText = opts.file ? readFileSync7(opts.file, "utf8") : readFileSync7(0, "utf8");
+      bodyText = opts.file ? readFileSync8(opts.file, "utf8") : readFileSync8(0, "utf8");
     } catch {
       fail(
         opts.file ? `could not read --file ${opts.file}` : "no closeout body \u2014 pass --file <path> or pipe it on stdin"
@@ -2928,552 +3440,221 @@ Examples:
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Fetching snapshot", async () => {
       const client = await makeClient(cfg);
-      return client.GET("/continuity/snapshots/{id}", { params: { path: { id } } });
-    });
-    emit(data, cmd.optsWithGlobals().json);
-  });
-  continuity.command("snapshots").description("List the caller's own snapshots (GET /me/continuity/snapshots)").option("--scope <scope>", "Filter by scope").option("--lane <laneId>", "Filter by lane id").action(async (opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Listing snapshots", async () => {
-      const client = await makeClient(cfg);
-      return client.GET("/me/continuity/snapshots", {
-        params: {
-          query: {
-            ...opts.scope ? { scope: opts.scope } : {},
-            ...opts.lane ? { laneId: opts.lane } : {}
-          }
-        }
-      });
-    });
-    emit(data, cmd.optsWithGlobals().json);
-  });
-  continuity.command("resume-me").description("Resume the caller's own lane (POST /continuity/resume/me)").option("--workspace <workspaceId>", "Scope to a workspace").option("--max-artifacts <n>", "Cap artifacts in the bundle").option("--changed-since <iso>", "Only include changes since this ISO timestamp").option("--looking-at-myself", "Include the caller's own changes", false).action(async (opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Resuming", async () => {
-      const client = await makeClient(cfg);
-      return client.POST("/continuity/resume/me", {
-        body: {
-          workspaceId: opts.workspace ?? null,
-          maxArtifacts: opts.maxArtifacts != null ? Number(opts.maxArtifacts) : null,
-          includeLookingAtMyself: opts.lookingAtMyself ? true : null,
-          changedSince: opts.changedSince ?? null
-        }
-      });
-    });
-    emit(data, cmd.optsWithGlobals().json);
-  });
-  continuity.command("resume-lane <laneId>").description("Resume a specific lane (POST /continuity/resume/lane)").option("--workspace <workspaceId>", "Scope to a workspace").option("--max-artifacts <n>", "Cap artifacts in the bundle").option("--changed-since <iso>", "Only include changes since this ISO timestamp").option("--looking-at-myself", "Include the caller's own changes", false).action(async (laneId, opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Resuming lane", async () => {
-      const client = await makeClient(cfg);
-      return client.POST("/continuity/resume/lane", {
-        body: {
-          laneId,
-          workspaceId: opts.workspace ?? null,
-          maxArtifacts: opts.maxArtifacts != null ? Number(opts.maxArtifacts) : null,
-          includeLookingAtMyself: opts.lookingAtMyself ? true : null,
-          changedSince: opts.changedSince ?? null
-        }
-      });
-    });
-    emit(data, cmd.optsWithGlobals().json);
-  });
-  continuity.command("changed-since").description("What changed since a timestamp (POST /continuity/changed-since)").requiredOption("--since <iso>", "ISO-8601 timestamp to compare against").option("--looking-at-myself", "Include the caller's own changes", false).action(async (opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Computing changes", async () => {
-      const client = await makeClient(cfg);
-      return client.POST("/continuity/changed-since", {
-        body: {
-          since: opts.since,
-          includeLookingAtMyself: opts.lookingAtMyself ? true : null
-        }
-      });
-    });
-    emit(data, cmd.optsWithGlobals().json);
-  });
-  continuity.command("load-set").description("Derive the active load set (POST /continuity/load-set/derive)").option("--workspace <workspaceId>", "Scope to a workspace").option("--max-artifacts <n>", "Cap artifacts in the load set").option("--looking-at-myself", "Include the caller's own changes", false).action(async (opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Deriving load set", async () => {
-      const client = await makeClient(cfg);
-      return client.POST("/continuity/load-set/derive", {
-        body: {
-          workspaceId: opts.workspace ?? null,
-          maxArtifacts: opts.maxArtifacts != null ? Number(opts.maxArtifacts) : null,
-          includeLookingAtMyself: opts.lookingAtMyself ? true : null
-        }
-      });
-    });
-    emit(data, cmd.optsWithGlobals().json);
-  });
-  continuity.command("grant <snapshotId>").description("Grant another operator read access (POST /continuity/snapshots/{snapshotId}/grants)").requiredOption("--grantee <userId>", "Sechroom user id being granted read access").option("--source <source>", "Permission-set source kind", "TenantRole").option("--source-id <sourceId>", "Permission-set source id (e.g. a tenant role)", "viewer").option("--valid-from <iso>", "Optional ISO-8601 grant start").option("--valid-to <iso>", "Optional ISO-8601 grant expiry").action(async (snapshotId, opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Minting grant", async () => {
-      const client = await makeClient(cfg);
-      return client.POST("/continuity/snapshots/{snapshotId}/grants", {
-        params: { path: { snapshotId } },
-        body: {
-          userId: opts.grantee,
-          kind: "Allow",
-          source: opts.source,
-          sourceId: opts.sourceId,
-          ...opts.validFrom ? { validFrom: opts.validFrom } : {},
-          ...opts.validTo ? { validTo: opts.validTo } : {}
-        }
-      });
-    });
-    emitAction(
-      `granted ${style.bold(data.userId)} read on ${style.bold(snapshotId)} ${style.dim(`(grant ${data.grantId})`)}`,
-      data,
-      cmd.optsWithGlobals().json
-    );
-  });
-  continuity.command("revoke-grant <snapshotId> <grantId>").description("Revoke a grant (DELETE /continuity/snapshots/{snapshotId}/grants/{grantId})").action(async (snapshotId, grantId, _opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Revoking grant", async () => {
-      const client = await makeClient(cfg);
-      return client.DELETE("/continuity/snapshots/{snapshotId}/grants/{grantId}", {
-        params: { path: { snapshotId, grantId } },
-        body: {}
-      });
-    });
-    emitAction(
-      `revoked grant ${style.bold(grantId)} on ${style.bold(snapshotId)}`,
-      data,
-      cmd.optsWithGlobals().json
-    );
-  });
-}
-
-// src/commands/decomposition.ts
-function registerDecomposition(program2) {
-  const decomposition = program2.command("decomposition").description(
-    "Drive a WLP decomposition: decompose a brief, then execute / accept / reject"
-  );
-  decomposition.addHelpText(
-    "after",
-    `
-Examples:
-  $ sechroom decomposition decompose mem_XXXX
-  $ sechroom decomposition execute sug_XXXX
-  $ sechroom decomposition publish-run sug_XXXX
-  $ sechroom decomposition accept sug_XXXX
-  $ sechroom decomposition reject sug_XXXX --reason "wrong shape"`
-  );
-  decomposition.command("decompose <briefId>").description(
-    "Decompose a work brief into a candidate Task graph (POST /work-briefs/{id}/decompose)"
-  ).action(async (briefId, _opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Queueing decomposition", async () => {
-      const client = await makeClient(cfg);
-      return client.POST("/work-briefs/{id}/decompose", {
-        params: { path: { id: briefId } },
-        body: { id: briefId }
-      });
-    });
-    emitAction(
-      `queued decomposition of ${style.bold(briefId)} \u2192 ${style.bold(data.suggestionId)}`,
-      data,
-      cmd.optsWithGlobals().json
-    );
-  });
-  decomposition.command("execute <decompositionId>").description(
-    "Execute a decomposition's Task graph (POST /decompositions/{id}/execute)"
-  ).action(async (decompositionId, _opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Executing decomposition", async () => {
-      const client = await makeClient(cfg);
-      return client.POST("/decompositions/{id}/execute", {
-        params: { path: { id: decompositionId } },
-        body: {}
-      });
+      return client.GET("/continuity/snapshots/{id}", { params: { path: { id } } });
     });
-    emitAction(
-      `executed ${style.bold(decompositionId)} \u2192 run ${style.bold(data.runRecordId)} (${data.outcome})`,
-      data,
-      cmd.optsWithGlobals().json
-    );
+    emit(data, cmd.optsWithGlobals().json);
   });
-  decomposition.command("publish-run <decompositionId>").description(
-    "Publish an accepted decomposition's context pack on demand (POST /decompositions/{id}/publish-run)"
-  ).action(async (decompositionId, _opts, cmd) => {
+  continuity.command("snapshots").description("List the caller's own snapshots (GET /me/continuity/snapshots)").option("--scope <scope>", "Filter by scope").option("--lane <laneId>", "Filter by lane id").action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Publishing context pack", async () => {
+    const data = await runApi("Listing snapshots", async () => {
       const client = await makeClient(cfg);
-      return client.POST("/decompositions/{id}/publish-run", {
-        params: { path: { id: decompositionId } },
-        body: {}
+      return client.GET("/me/continuity/snapshots", {
+        params: {
+          query: {
+            ...opts.scope ? { scope: opts.scope } : {},
+            ...opts.lane ? { laneId: opts.lane } : {}
+          }
+        }
       });
     });
-    emitAction(
-      `published ${style.bold(decompositionId)} \u2192 run ${style.bold(data.runRecordId)} (${data.outcome})`,
-      data,
-      cmd.optsWithGlobals().json
-    );
+    emit(data, cmd.optsWithGlobals().json);
   });
-  decomposition.command("accept <decompositionId>").description(
-    "Accept a Pending decomposition \u2014 promote + ratify its Tasks (POST /decompositions/{id}/accept)"
-  ).action(async (decompositionId, _opts, cmd) => {
+  continuity.command("resume-me").description("Resume the caller's own lane (POST /continuity/resume/me)").option("--workspace <workspaceId>", "Scope to a workspace").option("--max-artifacts <n>", "Cap artifacts in the bundle").option("--changed-since <iso>", "Only include changes since this ISO timestamp").option("--looking-at-myself", "Include the caller's own changes", false).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Accepting decomposition", async () => {
+    const data = await runApi("Resuming", async () => {
       const client = await makeClient(cfg);
-      return client.POST("/decompositions/{id}/accept", {
-        params: { path: { id: decompositionId } },
-        body: {}
+      return client.POST("/continuity/resume/me", {
+        body: {
+          workspaceId: opts.workspace ?? null,
+          maxArtifacts: opts.maxArtifacts != null ? Number(opts.maxArtifacts) : null,
+          includeLookingAtMyself: opts.lookingAtMyself ? true : null,
+          changedSince: opts.changedSince ?? null
+        }
       });
     });
-    emitAction(
-      `accepted decomposition ${style.bold(decompositionId)}`,
-      data,
-      cmd.optsWithGlobals().json
-    );
+    emit(data, cmd.optsWithGlobals().json);
   });
-  decomposition.command("reject <decompositionId>").description(
-    "Reject a Pending decomposition \u2014 archive its Tasks, bounce the brief (POST /decompositions/{id}/reject)"
-  ).option("--reason <reason>", "Optional free-text rejection reason").action(async (decompositionId, opts, cmd) => {
+  continuity.command("resume-lane <laneId>").description("Resume a specific lane (POST /continuity/resume/lane)").option("--workspace <workspaceId>", "Scope to a workspace").option("--max-artifacts <n>", "Cap artifacts in the bundle").option("--changed-since <iso>", "Only include changes since this ISO timestamp").option("--looking-at-myself", "Include the caller's own changes", false).action(async (laneId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await runApi("Rejecting decomposition", async () => {
+    const data = await runApi("Resuming lane", async () => {
       const client = await makeClient(cfg);
-      return client.POST("/decompositions/{id}/reject", {
-        params: { path: { id: decompositionId } },
-        body: { reasonText: opts.reason ?? null }
+      return client.POST("/continuity/resume/lane", {
+        body: {
+          laneId,
+          workspaceId: opts.workspace ?? null,
+          maxArtifacts: opts.maxArtifacts != null ? Number(opts.maxArtifacts) : null,
+          includeLookingAtMyself: opts.lookingAtMyself ? true : null,
+          changedSince: opts.changedSince ?? null
+        }
       });
     });
-    emitAction(
-      `rejected decomposition ${style.bold(decompositionId)}`,
-      data,
-      cmd.optsWithGlobals().json
-    );
-  });
-}
-
-// src/commands/executor.ts
-import { dirname as dirname8, join as join11 } from "path";
-import { existsSync as existsSync9, mkdirSync as mkdirSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "fs";
-var EXECUTOR_STATE = "executor.json";
-var EXECUTOR_PULSE_COMMAND = "sechroom executor hook-pulse";
-var EXECUTOR_STOP_COMMAND = "sechroom executor hook-stop";
-var CLAUDE_EXECUTOR_HOOKS = {
-  SessionStart: EXECUTOR_PULSE_COMMAND,
-  UserPromptSubmit: EXECUTOR_PULSE_COMMAND,
-  PreToolUse: EXECUTOR_PULSE_COMMAND,
-  Stop: EXECUTOR_PULSE_COMMAND,
-  SessionEnd: EXECUTOR_STOP_COMMAND
-};
-var CODEX_EXECUTOR_HOOKS = {
-  SessionStart: EXECUTOR_PULSE_COMMAND,
-  UserPromptSubmit: EXECUTOR_PULSE_COMMAND,
-  PreToolUse: EXECUTOR_PULSE_COMMAND,
-  Stop: EXECUTOR_PULSE_COMMAND
-};
-function registerExecutor(program2) {
-  const executor = program2.command("executor").description(
-    "Register and operate a local Claude Code/Codex executor advertisement"
-  );
-  executor.command("install").description("Configure this checkout's harness to advertise itself as a WLP executor").option("--connector <id>", "Approved local-session ConnectorDefinition id").option("--instance-key <key>", "Stable executor identity (defaults to .sechroom/lane.json code-lane)").option("--runtime <kind>", "claude-code | codex").option("--surface <surface>", "claude | codex").option("--capability <key...>", "Capability operation keys claimed by this instance").option("--relay <id>", "Relay identity shared by sibling instances", "sechroom-cli-local").option("--subscription-name <name>", "SignalR delivery binding name", "executor-dispatch").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 600).option("--refresh-after <seconds>", "Minimum age before a hook refreshes", parseInteger, 40).option("-y, --yes", "Non-interactive: accept detected surface and lane defaults", false).option("--dry-run", "Show hook files without writing", false).action(async (opts, cmd) => {
-    const lane = readSem()?.values["code-lane"];
-    const detected = detectHookSurfaces(process.cwd());
-    let surface = opts.surface;
-    let instanceKey = opts.instanceKey;
-    let runtime = opts.runtime;
-    let connector = opts.connector;
-    let capabilities = opts.capability;
-    const surfaceDefault = detected.length === 1 ? detected[0] : lane?.includes("codex") ? "codex" : "claude";
-    if (!opts.yes && canPrompt()) {
-      surface = await promptText("Harness surface (claude or codex)?", surface ?? surfaceDefault);
-      instanceKey = await promptText("Executor instance key?", instanceKey ?? lane ?? "");
-      runtime = await promptText("Runtime (claude-code or codex)?", runtime ?? (surface === "codex" ? "codex" : "claude-code"));
-      connector = await promptText("Approved local-session connector id?", connector ?? "");
-      const capabilityText = await promptText("Capability keys (comma-separated; blank for none)?", capabilities?.join(",") ?? "");
-      capabilities = capabilityText.split(",").map((x) => x.trim()).filter(Boolean);
-    }
-    surface ??= surfaceDefault;
-    instanceKey ??= lane;
-    runtime ??= surface === "codex" ? "codex" : "claude-code";
-    if (!connector) fail("executor install requires --connector (or an interactive connector id)");
-    if (!instanceKey) fail("no instance key resolved; pass --instance-key or pin .sechroom/lane.json code-lane");
-    if (!opts.yes && !canPrompt()) fail("non-interactive executor install requires --yes");
-    parseRuntimeKind(runtime);
-    if (!["claude", "codex"].includes(surface)) fail("surface must be claude or codex");
-    if (opts.refreshAfter >= opts.ttl) fail("refresh-after must be shorter than the TTL");
-    const sem = readSem();
-    const checkout = sem ? dirname8(dirname8(sem.path)) : process.cwd();
-    const statePath = join11(checkout, ".sechroom", EXECUTOR_STATE);
-    const state = {
-      schemaVersion: 1,
-      instanceKey,
-      runtime: runtime.toLowerCase() === "codex" ? "codex" : "claude-code",
-      connectorId: connector,
-      capabilityKeys: capabilities ?? [],
-      relayId: opts.relay,
-      subscriptionName: opts.subscriptionName,
-      ttlSeconds: opts.ttl,
-      refreshAfterSeconds: opts.refreshAfter
-    };
-    if (!opts.dryRun) {
-      mkdirSync9(dirname8(statePath), { recursive: true });
-      writeFileSync9(statePath, JSON.stringify(state, null, 2) + "\n");
-      ensureStateDirIgnored(checkout);
-    }
-    const surfaces = [surface];
-    for (const s of surfaces) {
-      const results = s === "claude" ? [installClaudeCommands(join11(checkout, ".claude"), CLAUDE_EXECUTOR_HOOKS, opts.dryRun)] : installCodexCommands(join11(checkout, ".codex"), CODEX_EXECUTOR_HOOKS, opts.dryRun);
-      for (const result of results) process.stderr.write(describe(result, opts.dryRun) + "\n");
-    }
-    warnIfSechroomNotOnPath();
-    process.stderr.write(style.green("executor harness configured") + style.dim(` \u2014 ${instanceKey}
-`));
+    emit(data, cmd.optsWithGlobals().json);
   });
-  executor.command("hook-pulse").description("Hook adapter: register or refresh this checkout's executor").action(async (_opts, cmd) => {
-    await drainStdin();
-    const located = readExecutorState();
-    if (!located) return;
-    const { state, path } = located;
-    const age = state.lastRefreshAt ? Date.now() - Date.parse(state.lastRefreshAt) : Number.POSITIVE_INFINITY;
-    if (state.instanceId && age < state.refreshAfterSeconds * 1e3) return;
+  continuity.command("changed-since").description("What changed since a timestamp (POST /continuity/changed-since)").requiredOption("--since <iso>", "ISO-8601 timestamp to compare against").option("--looking-at-myself", "Include the caller's own changes", false).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    try {
-      let data;
-      if (state.instanceId) {
-        try {
-          data = await refresh(cfg, state.instanceId, state.ttlSeconds);
-        } catch {
-          data = await registerInstance(cfg, state);
+    const data = await runApi("Computing changes", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/continuity/changed-since", {
+        body: {
+          since: opts.since,
+          includeLookingAtMyself: opts.lookingAtMyself ? true : null
         }
-      } else {
-        data = await registerInstance(cfg, state);
-      }
-      state.instanceId = data.id;
-      state.lastRefreshAt = (/* @__PURE__ */ new Date()).toISOString();
-      writeFileSync9(path, JSON.stringify(state, null, 2) + "\n");
-    } catch {
-    }
-  });
-  executor.command("hook-stop").description("Hook adapter: deregister this checkout's executor").action(async (_opts, cmd) => {
-    await drainStdin();
-    const located = readExecutorState();
-    if (!located?.state.instanceId) return;
-    try {
-      await api(resolveConfig(cmd.optsWithGlobals()), `/me/executor-instances/${encodeURIComponent(located.state.instanceId)}`, { method: "DELETE", body: JSON.stringify({}) });
-      delete located.state.instanceId;
-      delete located.state.lastRefreshAt;
-      writeFileSync9(located.path, JSON.stringify(located.state, null, 2) + "\n");
-    } catch {
-    }
-  });
-  executor.command("submit-connector").description(
-    "Submit a local-session connector definition for governed approval"
-  ).requiredOption("--slug <slug>", "Unique connector definition slug").requiredOption("--display-name <name>", "Human-readable connector name").requiredOption("--transport <kind>", "push | pull").option("--profile <profile...>", "Advertised runtime profiles", [
-    "base",
-    "dotnet-10"
-  ]).action(async (opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await api(cfg, "/connectors/definitions", {
-      method: "POST",
-      body: JSON.stringify({
-        slug: opts.slug,
-        displayName: opts.displayName,
-        runtimeProfiles: opts.profile,
-        connectorKind: "ExecutionRuntime",
-        providerKind: "local-session",
-        dispatchTransport: parseTransport(opts.transport)
-      })
+      });
     });
-    emit(data, Boolean(cmd.optsWithGlobals().json));
-    if (!cmd.optsWithGlobals().json) {
-      process.stderr.write(
-        style.dim(
-          "approve this connector definition before registering executors\n"
-        )
-      );
-    }
-  });
-  executor.command("register").description(
-    "Create/reuse a SignalR binding and register this local executor instance"
-  ).requiredOption(
-    "--instance-key <key>",
-    "Stable key for this concrete session/lane"
-  ).requiredOption(
-    "--connector <id>",
-    "Approved local-session ConnectorDefinition id"
-  ).option("--runtime <kind>", "claude-code | codex", "claude-code").option(
-    "--relay <id>",
-    "Relay identity shared by sibling instances",
-    "sechroom-cli-local"
-  ).option(
-    "--subscription-name <name>",
-    "SignalR delivery binding name",
-    "executor-dispatch"
-  ).option(
-    "--capability <key...>",
-    "Capability operation keys claimed by this instance"
-  ).option("--tool-set-ref <ref>", "Optional governed tool-set reference").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (opts, cmd) => {
-    const cfg = resolveConfig(cmd.optsWithGlobals());
-    if (!cfg.workspaceId)
-      fail("executor register requires a configured workspaceId");
-    const subscription = await api(
-      cfg,
-      "/me/delivery-subscriptions/signalr",
-      {
-        method: "POST",
-        body: JSON.stringify({
-          name: opts.subscriptionName,
-          enabled: true,
-          filter: { tags: ["kind:task"], workspaceScope: [cfg.workspaceId] }
-        })
-      }
-    );
-    const data = await api(
-      cfg,
-      "/me/executor-instances",
-      {
-        method: "POST",
-        body: JSON.stringify({
-          relayId: opts.relay,
-          instanceKey: opts.instanceKey,
-          runtimeKind: parseRuntimeKind(opts.runtime),
-          activationMode: "Attached",
-          deliverySubscriptionId: subscription.id,
-          connectorId: opts.connector,
-          claimedCapabilityKeys: opts.capability ?? [],
-          toolSetRef: opts.toolSetRef ?? null,
-          ttlSeconds: opts.ttl
-        })
-      }
-    );
-    emit(data, Boolean(cmd.optsWithGlobals().json));
-    if (!cmd.optsWithGlobals().json)
-      process.stderr.write(
-        style.dim(`refresh with: sechroom executor heartbeat ${data.id}
-`)
-      );
-  });
-  executor.command("refresh <id>").description("Refresh one advertisement lease once").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (id, opts, cmd) => {
-    const data = await refresh(
-      resolveConfig(cmd.optsWithGlobals()),
-      id,
-      opts.ttl
-    );
-    emit(data, Boolean(cmd.optsWithGlobals().json));
+    emit(data, cmd.optsWithGlobals().json);
   });
-  executor.command("heartbeat <id>").description("Keep an advertisement alive until interrupted").option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).option("--interval <seconds>", "Refresh interval", parseInteger, 40).action(async (id, opts, cmd) => {
-    if (opts.interval >= opts.ttl)
-      fail("heartbeat interval must be shorter than the TTL");
+  continuity.command("load-set").description("Derive the active load set (POST /continuity/load-set/derive)").option("--workspace <workspaceId>", "Scope to a workspace").option("--max-artifacts <n>", "Cap artifacts in the load set").option("--looking-at-myself", "Include the caller's own changes", false).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    await refresh(cfg, id, opts.ttl);
-    process.stderr.write(
-      style.green("executor heartbeat active") + style.dim(` \u2014 ${id}
-`)
-    );
-    await holdHeartbeat(async () => {
-      await refresh(cfg, id, opts.ttl);
-    }, opts.interval * 1e3);
+    const data = await runApi("Deriving load set", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/continuity/load-set/derive", {
+        body: {
+          workspaceId: opts.workspace ?? null,
+          maxArtifacts: opts.maxArtifacts != null ? Number(opts.maxArtifacts) : null,
+          includeLookingAtMyself: opts.lookingAtMyself ? true : null
+        }
+      });
+    });
+    emit(data, cmd.optsWithGlobals().json);
   });
-  executor.command("offers <id>").description("List live dispatch offers addressed to this exact instance").action(async (id, _opts, cmd) => {
+  continuity.command("grant <snapshotId>").description("Grant another operator read access (POST /continuity/snapshots/{snapshotId}/grants)").requiredOption("--grantee <userId>", "Sechroom user id being granted read access").option("--source <source>", "Permission-set source kind", "TenantRole").option("--source-id <sourceId>", "Permission-set source id (e.g. a tenant role)", "viewer").option("--valid-from <iso>", "Optional ISO-8601 grant start").option("--valid-to <iso>", "Optional ISO-8601 grant expiry").action(async (snapshotId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await api(
-      cfg,
-      `/me/executor-instances/${encodeURIComponent(id)}/dispatch-offers`
+    const data = await runApi("Minting grant", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/continuity/snapshots/{snapshotId}/grants", {
+        params: { path: { snapshotId } },
+        body: {
+          userId: opts.grantee,
+          kind: "Allow",
+          source: opts.source,
+          sourceId: opts.sourceId,
+          ...opts.validFrom ? { validFrom: opts.validFrom } : {},
+          ...opts.validTo ? { validTo: opts.validTo } : {}
+        }
+      });
+    });
+    emitAction(
+      `granted ${style.bold(data.userId)} read on ${style.bold(snapshotId)} ${style.dim(`(grant ${data.grantId})`)}`,
+      data,
+      cmd.optsWithGlobals().json
     );
-    emit(data, Boolean(cmd.optsWithGlobals().json));
   });
-  executor.command("deregister <id>").description("Stop advertising this executor instance").action(async (id, _opts, cmd) => {
+  continuity.command("revoke-grant <snapshotId> <grantId>").description("Revoke a grant (DELETE /continuity/snapshots/{snapshotId}/grants/{grantId})").action(async (snapshotId, grantId, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const data = await api(
-      cfg,
-      `/me/executor-instances/${encodeURIComponent(id)}`,
-      {
-        method: "DELETE",
-        body: JSON.stringify({})
-      }
+    const data = await runApi("Revoking grant", async () => {
+      const client = await makeClient(cfg);
+      return client.DELETE("/continuity/snapshots/{snapshotId}/grants/{grantId}", {
+        params: { path: { snapshotId, grantId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `revoked grant ${style.bold(grantId)} on ${style.bold(snapshotId)}`,
+      data,
+      cmd.optsWithGlobals().json
     );
-    emit(data, Boolean(cmd.optsWithGlobals().json));
   });
 }
-function parseRuntimeKind(value) {
-  switch (value.trim().toLowerCase()) {
-    case "claude":
-    case "claude-code":
-      return "ClaudeCode";
-    case "codex":
-      return "Codex";
-    default:
-      return fail("runtime must be claude-code or codex");
-  }
-}
-function parseTransport(value) {
-  switch (value.trim().toLowerCase()) {
-    case "push":
-      return "Push";
-    case "pull":
-      return "Pull";
-    default:
-      return fail("transport must be push or pull");
-  }
-}
-async function refresh(cfg, id, ttlSeconds) {
-  return api(
-    cfg,
-    `/me/executor-instances/${encodeURIComponent(id)}/refresh`,
-    {
-      method: "POST",
-      body: JSON.stringify({ ttlSeconds })
-    }
+
+// src/commands/decomposition.ts
+function registerDecomposition(program2) {
+  const decomposition = program2.command("decomposition").description(
+    "Drive a WLP decomposition: decompose a brief, then execute / accept / reject"
   );
-}
-async function registerInstance(cfg, state) {
-  if (!cfg.workspaceId) fail("executor registration requires a configured workspaceId");
-  const subscription = await api(cfg, "/me/delivery-subscriptions/signalr", {
-    method: "POST",
-    body: JSON.stringify({ name: state.subscriptionName, enabled: true, filter: { tags: ["kind:task"], workspaceScope: [cfg.workspaceId] } })
+  decomposition.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom decomposition decompose mem_XXXX
+  $ sechroom decomposition execute sug_XXXX
+  $ sechroom decomposition publish-run sug_XXXX
+  $ sechroom decomposition accept sug_XXXX
+  $ sechroom decomposition reject sug_XXXX --reason "wrong shape"`
+  );
+  decomposition.command("decompose <briefId>").description(
+    "Decompose a work brief into a candidate Task graph (POST /work-briefs/{id}/decompose)"
+  ).action(async (briefId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Queueing decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/work-briefs/{id}/decompose", {
+        params: { path: { id: briefId } },
+        body: { id: briefId }
+      });
+    });
+    emitAction(
+      `queued decomposition of ${style.bold(briefId)} \u2192 ${style.bold(data.suggestionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  return api(cfg, "/me/executor-instances", {
-    method: "POST",
-    body: JSON.stringify({ relayId: state.relayId, instanceKey: state.instanceKey, runtimeKind: parseRuntimeKind(state.runtime), activationMode: "Attached", deliverySubscriptionId: subscription.id, connectorId: state.connectorId, claimedCapabilityKeys: state.capabilityKeys, toolSetRef: null, ttlSeconds: state.ttlSeconds })
+  decomposition.command("execute <decompositionId>").description(
+    "Execute a decomposition's Task graph (POST /decompositions/{id}/execute)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Executing decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/execute", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `executed ${style.bold(decompositionId)} \u2192 run ${style.bold(data.runRecordId)} (${data.outcome})`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-}
-function readExecutorState(start = process.cwd()) {
-  const semPath = resolveSemPathForRead(start);
-  const sem = semPath ? readSem(semPath) : void 0;
-  const path = join11(sem ? dirname8(sem.path) : join11(start, ".sechroom"), EXECUTOR_STATE);
-  if (!existsSync9(path)) return void 0;
-  return { state: JSON.parse(readFileSync8(path, "utf8")), path };
-}
-async function drainStdin() {
-  if (process.stdin.isTTY) return;
-  for await (const _chunk of process.stdin) {
-  }
-}
-async function api(cfg, path, init) {
-  const token = await requireToken(cfg);
-  const response = await fetch(`${cfg.baseUrl}${path}`, {
-    ...init,
-    headers: {
-      authorization: `Bearer ${token}`,
-      tenant: cfg.tenant,
-      "content-type": "application/json",
-      "x-sechroom-surface": "cli"
-    }
+  decomposition.command("publish-run <decompositionId>").description(
+    "Publish an accepted decomposition's context pack on demand (POST /decompositions/{id}/publish-run)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Publishing context pack", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/publish-run", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `published ${style.bold(decompositionId)} \u2192 run ${style.bold(data.runRecordId)} (${data.outcome})`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  if (!response.ok)
-    fail(
-      `${init?.method ?? "GET"} ${path} failed (${response.status}): ${await response.text()}`
+  decomposition.command("accept <decompositionId>").description(
+    "Accept a Pending decomposition \u2014 promote + ratify its Tasks (POST /decompositions/{id}/accept)"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Accepting decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/accept", {
+        params: { path: { id: decompositionId } },
+        body: {}
+      });
+    });
+    emitAction(
+      `accepted decomposition ${style.bold(decompositionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+  decomposition.command("reject <decompositionId>").description(
+    "Reject a Pending decomposition \u2014 archive its Tasks, bounce the brief (POST /decompositions/{id}/reject)"
+  ).option("--reason <reason>", "Optional free-text rejection reason").action(async (decompositionId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Rejecting decomposition", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/decompositions/{id}/reject", {
+        params: { path: { id: decompositionId } },
+        body: { reasonText: opts.reason ?? null }
+      });
+    });
+    emitAction(
+      `rejected decomposition ${style.bold(decompositionId)}`,
+      data,
+      cmd.optsWithGlobals().json
     );
-  return response.json();
-}
-function parseInteger(value) {
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isFinite(parsed)) fail(`expected an integer, got '${value}'`);
-  return parsed;
-}
-function holdHeartbeat(tick, intervalMs) {
-  return new Promise((resolve3, reject) => {
-    const timer = setInterval(() => void tick().catch(reject), intervalMs);
-    const stop = () => {
-      clearInterval(timer);
-      resolve3();
-    };
-    process.once("SIGINT", stop);
-    process.once("SIGTERM", stop);
   });
 }
 
@@ -5741,23 +5922,23 @@ Examples:
     });
     emit(data, cmd.optsWithGlobals().json);
   });
-  suggestion.command("accept <id>").description("Accept a suggestion (POST /relationship-suggestions/{id}/accept)").action(async (id, _opts, cmd) => {
+  suggestion.command("accept <id>").description("Accept a suggestion (POST /relationship-suggestions/{instanceId}/accept)").action(async (id, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Accepting suggestion", async () => {
       const client = await makeClient(cfg);
-      return client.POST("/relationship-suggestions/{id}/accept", {
-        params: { path: { id } },
+      return client.POST("/relationship-suggestions/{instanceId}/accept", {
+        params: { path: { instanceId: id } },
         body: {}
       });
     });
     emitAction(`accepted suggestion ${style.bold(id)}`, data, cmd.optsWithGlobals().json);
   });
-  suggestion.command("reject <id>").description("Reject a suggestion (POST /relationship-suggestions/{id}/reject)").option("--reason <reason>", "Why it's being rejected").option("--reason-code <code>", "Structured reason code").action(async (id, opts, cmd) => {
+  suggestion.command("reject <id>").description("Reject a suggestion (POST /relationship-suggestions/{instanceId}/reject)").option("--reason <reason>", "Why it's being rejected").option("--reason-code <code>", "Structured reason code").action(async (id, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Rejecting suggestion", async () => {
       const client = await makeClient(cfg);
-      return client.POST("/relationship-suggestions/{id}/reject", {
-        params: { path: { id } },
+      return client.POST("/relationship-suggestions/{instanceId}/reject", {
+        params: { path: { instanceId: id } },
         body: {
           reason: opts.reason ?? null,
           ...opts.reasonCode ? { reasonCode: opts.reasonCode } : {}
@@ -6732,6 +6913,54 @@ Examples:
   });
 }
 
+// src/commands/work-brief.ts
+function registerWorkBrief(program2) {
+  const workBrief = program2.command("work-brief").description("Control an active work brief run");
+  workBrief.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom work-brief pause mem_XXXX --reason-code operator-hold --source claude-code-chris
+  $ sechroom work-brief resume mem_XXXX --reason-code operator-resume --source claude-code-chris --reason "Ready to continue"`
+  );
+  registerLifecycleAction(workBrief, "pause");
+  registerLifecycleAction(workBrief, "resume");
+}
+function registerLifecycleAction(workBrief, action) {
+  const presentParticiple = action === "pause" ? "Pausing" : "Resuming";
+  const pastTense = action === "pause" ? "paused" : "resumed";
+  workBrief.command(`${action} <briefId>`).description(`${capitalize(action)} an active work brief run`).requiredOption(
+    "--reason-code <code>",
+    "Stable machine-readable reason code"
+  ).requiredOption(
+    "--source <source>",
+    "Calling surface or lane recorded in the audit"
+  ).option("--reason <text>", "Optional human-readable reason").action(async (briefId, opts, cmd) => {
+    const globals = cmd.optsWithGlobals();
+    const cfg = resolveConfig(globals);
+    const data = await runApi(`${presentParticiple} work brief`, async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/work-briefs/{id}/lifecycle", {
+        params: { path: { id: briefId } },
+        body: {
+          action,
+          reasonCode: opts.reasonCode,
+          source: opts.source,
+          reasonText: opts.reason ?? null
+        }
+      });
+    });
+    emitAction(
+      `${pastTense} work brief ${style.bold(briefId)} \u2192 ${data.outcome}`,
+      data,
+      globals.json
+    );
+  });
+}
+function capitalize(value) {
+  return value.charAt(0).toUpperCase() + value.slice(1);
+}
+
 // src/index.ts
 function resolveVersion() {
   try {
@@ -6894,6 +7123,7 @@ registerLookup(program);
 registerRelationships(program);
 registerWorkspace(program);
 registerProject(program);
+registerWorkBrief(program);
 registerDecomposition(program);
 registerExecutor(program);
 registerClose(program);