@sechroom/cli 2026.8.8-rc.56311f4a3 → 2026.9.1

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync19 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
 import { Command } from "commander";
 
 // src/auth.ts
@@ -642,6 +642,17 @@ function emitAction(summary, data, json) {
   process.stdout.write(`${ok("\u2713")} ${summary}
 `);
 }
+var JSON_NUMBER = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$/;
+function confidenceWireValue(value) {
+  if (value === null || value === void 0 || value === "") return null;
+  if (typeof value === "number") return Number.isFinite(value) ? value : String(value);
+  const raw = String(value).trim();
+  if (JSON_NUMBER.test(raw)) {
+    const numeric = Number(raw);
+    if (Number.isFinite(numeric)) return numeric;
+  }
+  return String(value);
+}
 var GOVERNANCE_QUEUED_PROBLEM_TYPE = "https://sechroom.dev/problems/governance-review-queued";
 function isGovernanceQueued(body) {
   return typeof body === "object" && body !== null && "type" in body && body.type === GOVERNANCE_QUEUED_PROBLEM_TYPE;
@@ -688,23 +699,57 @@ function formatFailureMessage(error) {
     if (error.cause instanceof Error && error.cause.message) {
       msg += `: ${error.cause.message}`;
     }
-  } else if (typeof error === "object" && error !== null && "title" in error) {
+  } else if (isRecord(error)) {
     const problem = error;
-    msg = String(problem.title);
-    if (problem.errors && typeof problem.errors === "object") {
-      const detail = Object.entries(problem.errors).flatMap(
-        ([field, msgs]) => (Array.isArray(msgs) ? msgs : [msgs]).map((m) => `  ${field}: ${String(m)}`)
-      );
-      if (detail.length > 0) msg += `
-${detail.join("\n")}`;
+    const title = typeof problem.title === "string" && problem.title.length > 0 ? problem.title : void 0;
+    const problemDetail2 = typeof problem.detail === "string" && problem.detail.length > 0 ? problem.detail : void 0;
+    const fieldErrors = formatProblemErrors(problem.errors);
+    const structuredErrors = fieldErrors.length === 0 ? formatStructuredViolations(problem.violations) : [];
+    const parts = [
+      ...title ? [title] : [],
+      ...problemDetail2 ? [problemDetail2] : [],
+      ...fieldErrors,
+      ...structuredErrors
+    ];
+    if (parts.length > 0) {
+      if (title && !problemDetail2 && fieldErrors.length === 0 && structuredErrors.length === 0) {
+        parts.push("No additional error detail was returned by the API.");
+      }
+      msg = parts.join("\n");
+    } else {
+      const serialized = JSON.stringify(error);
+      msg = serialized && serialized !== "{}" ? serialized : "The API returned an empty error response.";
     }
-  } else if (typeof error === "object" && error !== null) {
-    msg = JSON.stringify(error);
   } else {
     msg = String(error);
   }
   return msg;
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function formatProblemErrors(errors) {
+  if (!isRecord(errors)) return [];
+  return Object.entries(errors).flatMap(
+    ([field, messages]) => (Array.isArray(messages) ? messages : [messages]).map(
+      (message) => `  ${field}: ${formatErrorValue(message)}`
+    )
+  );
+}
+function formatStructuredViolations(violations) {
+  if (!Array.isArray(violations)) return [];
+  return violations.flatMap((violation) => {
+    if (!isRecord(violation)) return [formatErrorValue(violation)];
+    const field = typeof violation.field === "string" ? violation.field : "validation";
+    const message = typeof violation.message === "string" ? violation.message : formatErrorValue(violation);
+    return [`  ${field}: ${message}`];
+  });
+}
+function formatErrorValue(value) {
+  if (typeof value === "string") return value;
+  const serialized = JSON.stringify(value);
+  return serialized ?? String(value);
+}
 function fail(error) {
   const msg = formatFailureMessage(error);
   process.stderr.write(`error: ${msg}
@@ -956,8 +1001,8 @@ function recordMaterialisedSkills(dir, slug2, skills, meta = {}) {
 }
 
 // src/setup/materialise.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join5 } from "path";
 
 // src/setup/config-dirs.ts
 import { homedir as homedir2 } from "os";
@@ -1027,14 +1072,19 @@ async function fetchSetup(cfg, namespaceSlug) {
     "/operator-surface/setup",
     hasQuery ? { params: { query } } : {}
   );
-  if (error) throw new Error(`GET /operator-surface/setup failed: ${JSON.stringify(error)}`);
+  if (error)
+    throw new Error(
+      `GET /operator-surface/setup failed: ${JSON.stringify(error)}`
+    );
   return data;
 }
 async function listNamespaces(cfg) {
   const client = await makeClient(cfg);
   const { data } = await client.GET("/mcp-aggregator/namespaces", {});
   const rows = data ?? [];
-  return rows.filter((r) => typeof r.slug === "string").map((r) => ({ slug: r.slug, displayName: r.displayName ?? r.slug }));
+  return rows.filter(
+    (r) => typeof r.slug === "string"
+  ).map((r) => ({ slug: r.slug, displayName: r.displayName ?? r.slug }));
 }
 function findSurface(setup, surfaceKey) {
   return setup.surfaces.find((s) => s.surfaceKey === surfaceKey);
@@ -1050,10 +1100,15 @@ function sectionSnippet(section) {
   }
   return null;
 }
-function parseTagArtifactId(id) {
+function parseTagArtifactCandidates(id) {
   if (!id.startsWith("tag:")) return null;
-  const tags = id.slice("tag:".length).split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-  return tags.length > 0 ? tags : null;
+  const candidates = id.slice("tag:".length).split("|").map(
+    (set) => set.split(",").map((t) => t.trim()).filter((t) => t.length > 0)
+  ).filter((set) => set.length > 0);
+  return candidates.length > 0 ? candidates : null;
+}
+function parseTagArtifactId(id) {
+  return parseTagArtifactCandidates(id)?.[0] ?? null;
 }
 async function getPersonalWorkspaceId(cfg) {
   const client = await makeClient(cfg);
@@ -1062,40 +1117,102 @@ async function getPersonalWorkspaceId(cfg) {
 }
 async function fetchMemoryFields(cfg, id) {
   const client = await makeClient(cfg);
-  const { data } = await client.GET("/memories/{memoryId}", { params: { path: { memoryId: id } } });
+  const { data } = await client.GET("/memories/{memoryId}", {
+    params: { path: { memoryId: id } }
+  });
   const env = data;
   const m = env?.item ?? env;
   if (!m) return null;
   const version = typeof m.currentVersion === "string" ? Number(m.currentVersion) : m.currentVersion;
-  return { text: m.text, title: m.title, tags: m.tags, version: Number.isFinite(version) ? version : void 0 };
+  return {
+    text: m.text,
+    title: m.title,
+    tags: m.tags,
+    version: Number.isFinite(version) ? version : void 0
+  };
 }
-async function resolveInstruction(cfg, section, personalWorkspaceId) {
-  const client = await makeClient(cfg);
-  for (const artifact of section.artifacts) {
-    const tags = parseTagArtifactId(artifact.id);
-    if (!tags) continue;
+async function findTemplateByCandidates(client, candidates) {
+  for (let i = 0; i < candidates.length; i++) {
+    const tags = candidates[i];
     const { data } = await client.POST("/memories/search", {
-      body: { query: null, textQuery: null, semanticQuery: null, hybrid: false, limit: 1, includeArchived: false, includeSystem: false, tags }
+      body: {
+        query: null,
+        textQuery: null,
+        semanticQuery: null,
+        hybrid: false,
+        limit: 1,
+        includeArchived: false,
+        includeSystem: false,
+        tags
+      }
     });
     const hits = data?.items ?? [];
     if (hits.length === 0) continue;
-    const templateId = hits[0].id;
+    return { id: hits[0].id, tags, via: i === 0 ? "preferred" : "fallback" };
+  }
+  return null;
+}
+function attemptedTagSets(section) {
+  return section.artifacts.flatMap(
+    (artifact) => parseTagArtifactCandidates(artifact.id) ?? []
+  );
+}
+async function resolveInstruction(cfg, section, personalWorkspaceId) {
+  const client = await makeClient(cfg);
+  for (const artifact of section.artifacts) {
+    const candidates = parseTagArtifactCandidates(artifact.id);
+    if (!candidates) continue;
+    const found = await findTemplateByCandidates(client, candidates);
+    if (!found) continue;
+    const templateId = found.id;
     const template = await fetchMemoryFields(cfg, templateId);
-    if (typeof template?.text !== "string" || template.text.length === 0) continue;
-    const templateTags = template.tags ?? tags;
+    if (typeof template?.text !== "string" || template.text.length === 0)
+      continue;
+    const templateTags = template.tags ?? found.tags;
     if (personalWorkspaceId) {
       const { data: ovr } = await client.POST("/memories/search", {
-        body: { query: null, textQuery: null, semanticQuery: null, hybrid: false, limit: 1, includeArchived: false, includeSystem: false, tags: ["sechroom:role:override", `sechroom:template-ref:${templateId}`], owner: { type: "Workspace", id: personalWorkspaceId } }
+        body: {
+          query: null,
+          textQuery: null,
+          semanticQuery: null,
+          hybrid: false,
+          limit: 1,
+          includeArchived: false,
+          includeSystem: false,
+          tags: [
+            "sechroom:role:override",
+            `sechroom:template-ref:${templateId}`
+          ],
+          owner: { type: "Workspace", id: personalWorkspaceId }
+        }
       });
       const ovrHits = ovr?.items ?? [];
       if (ovrHits.length > 0) {
         const override = await fetchMemoryFields(cfg, ovrHits[0].id);
         if (typeof override?.text === "string" && override.text.length > 0) {
-          return { title: override.title ?? template.title ?? artifact.title, body: override.text, source: "override", templateId, templateTags, sourceRef: `${ovrHits[0].id}@v${override.version ?? 1}` };
+          return {
+            title: override.title ?? template.title ?? artifact.title,
+            body: override.text,
+            source: "override",
+            templateId,
+            templateTags,
+            resolvedVia: found.via,
+            resolvedTags: found.tags,
+            sourceRef: `${ovrHits[0].id}@v${override.version ?? 1}`
+          };
         }
       }
     }
-    return { title: template.title ?? artifact.title, body: template.text, source: "template", templateId, templateTags, sourceRef: `${templateId}@v${template.version ?? 1}` };
+    return {
+      title: template.title ?? artifact.title,
+      body: template.text,
+      source: "template",
+      templateId,
+      templateTags,
+      resolvedVia: found.via,
+      resolvedTags: found.tags,
+      sourceRef: `${templateId}@v${template.version ?? 1}`
+    };
   }
   return null;
 }
@@ -1107,8 +1224,10 @@ async function resolveWorkspaceConventions(cfg, section) {
     const mem = await fetchMemoryFields(cfg, artifact.id);
     if (typeof mem?.text === "string" && mem.text.trim().length > 0) {
       const ref = `${artifact.id}@v${mem.version ?? 1}`;
-      parts.push(`<!-- @sechroom/cli:section source=${ref} -->
-${mem.text.trim()}`);
+      parts.push(
+        `<!-- @sechroom/cli:section source=${ref} -->
+${mem.text.trim()}`
+      );
       refs.push(ref);
     }
   }
@@ -1120,7 +1239,10 @@ async function createOverride(cfg, template, personalWorkspaceId) {
   const overrideTags = template.templateTags.filter(
     (t) => t !== "sechroom:role:template" && !t.startsWith("sechroom:bundle:") && !t.startsWith("sechroom:template-ref:")
   );
-  overrideTags.push("sechroom:role:override", `sechroom:template-ref:${template.templateId}`);
+  overrideTags.push(
+    "sechroom:role:override",
+    `sechroom:template-ref:${template.templateId}`
+  );
   const { error } = await client.POST("/memories", {
     body: {
       text: template.body,
@@ -1134,7 +1256,8 @@ async function createOverride(cfg, template, personalWorkspaceId) {
       owner: { type: "Workspace", id: personalWorkspaceId }
     }
   });
-  if (error) throw new Error(`creating personal copy failed: ${JSON.stringify(error)}`);
+  if (error)
+    throw new Error(`creating personal copy failed: ${JSON.stringify(error)}`);
 }
 
 // src/setup/skill-resolution.ts
@@ -1248,6 +1371,89 @@ function resolveReferenceSet(rows, surface) {
   return resolveReferences(rows.systemRows, rows.personalRows, surface);
 }
 
+// src/setup/skill-orphans.ts
+import { readdirSync, readFileSync as readFileSync3, rmSync as rmSync2, statSync } from "fs";
+import { join as join4 } from "path";
+var INSTALL_MARKER = "<!-- sechroom-install:";
+var MAX_MARKER_SCAN_BYTES = 2 * 1024 * 1024;
+function bundleFromBody(body) {
+  const start = body.indexOf(INSTALL_MARKER);
+  if (start < 0) return null;
+  const from = start + INSTALL_MARKER.length;
+  const end = body.indexOf("-->", from);
+  if (end < 0) return null;
+  try {
+    const payload = JSON.parse(body.slice(from, end).replaceAll("\\", "").trim());
+    return typeof payload.Bundle === "string" && payload.Bundle ? payload.Bundle : null;
+  } catch {
+    return null;
+  }
+}
+function readBody(path) {
+  try {
+    if (statSync(path).size > MAX_MARKER_SCAN_BYTES) return null;
+    return readFileSync3(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+var SKILL_LAYOUT = {
+  scan: (dir) => readEntries(dir).filter((e) => e.isDirectory()).map((e) => ({ name: e.name, bodyPath: join4(dir, e.name, "SKILL.md") }))
+};
+var AGENT_LAYOUT = {
+  scan: (dir) => readEntries(dir).filter((e) => e.isFile() && (e.name.endsWith(".md") || e.name.endsWith(".toml"))).map((e) => ({ name: e.name, bodyPath: join4(dir, e.name) }))
+};
+function readEntries(dir) {
+  try {
+    return readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+function scanMarked(dir, layout) {
+  const marked = [];
+  for (const item of layout.scan(dir)) {
+    const body = readBody(item.bodyPath);
+    if (body === null || !body.includes(INSTALL_MARKER)) continue;
+    marked.push({ name: item.name, bundle: bundleFromBody(body) });
+  }
+  return marked;
+}
+function markedItems(dir, layout) {
+  return scanMarked(dir, layout).map((item) => item.name);
+}
+function lockedNames(lock, exceptSlug) {
+  const names = /* @__PURE__ */ new Set();
+  for (const [slug2, entry] of Object.entries(lock)) {
+    if (slug2 === exceptSlug) continue;
+    for (const name of entry.skills ?? []) names.add(name);
+  }
+  return names;
+}
+function orphansAfterInstall(dir, layout, slug2, keep, ownBundles2 = /* @__PURE__ */ new Set()) {
+  if (keep.length === 0) return [];
+  const lock = readSkillsLock(dir);
+  const protectedNames = /* @__PURE__ */ new Set([...keep, ...lockedNames(lock, slug2)]);
+  const mine = scanMarked(dir, layout).filter((item) => ownBundles2.size === 0 || item.bundle === null || ownBundles2.has(item.bundle)).map((item) => item.name);
+  const managed = /* @__PURE__ */ new Set([...lock[slug2]?.skills ?? [], ...mine]);
+  return [...managed].filter((name) => !protectedNames.has(name)).sort();
+}
+function orphansAfterClean(dir, layout) {
+  const protectedNames = lockedNames(readSkillsLock(dir));
+  return markedItems(dir, layout).filter((name) => !protectedNames.has(name)).sort();
+}
+function pruneItems(dir, names) {
+  const removed = [];
+  for (const name of names) {
+    try {
+      rmSync2(join4(dir, name), { recursive: true, force: true });
+      removed.push(name);
+    } catch {
+    }
+  }
+  return removed;
+}
+
 // src/setup/materialise.ts
 var CLIENT_SURFACE = {
   claude: "claude-code",
@@ -1256,8 +1462,8 @@ var CLIENT_SURFACE = {
 function writeSkills(dir, skills, surface) {
   const written = [];
   for (const s of skills) {
-    mkdirSync3(join4(dir, s.name), { recursive: true });
-    writeFileSync3(join4(dir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+    mkdirSync3(join5(dir, s.name), { recursive: true });
+    writeFileSync3(join5(dir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
     written.push(s.name);
   }
   if (written.length) recordMaterialisedSkills(dir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -1307,14 +1513,17 @@ function codexAgentToml(agent) {
     ""
   ].join("\n");
 }
+function agentFileName(name, surface) {
+  return `${name}.${surface === CLIENT_SURFACE.codex ? "toml" : "md"}`;
+}
 function writeAgents(dir, agents, surface) {
   if (agents.length) mkdirSync3(dir, { recursive: true });
   const written = [];
   for (const a of agents) {
     const codex = surface === CLIENT_SURFACE.codex;
-    const file = `${a.name}.${codex ? "toml" : "md"}`;
+    const file = agentFileName(a.name, surface);
     const body = codex ? codexAgentToml(a) : a.body.endsWith("\n") ? a.body : a.body + "\n";
-    writeFileSync3(join4(dir, file), body);
+    writeFileSync3(join5(dir, file), body);
     written.push(file);
   }
   if (written.length) recordMaterialisedSkills(dir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -1323,10 +1532,10 @@ function writeAgents(dir, agents, surface) {
 function writeReferencesIntoSkillDirs(dir, skills, refs) {
   if (!refs.length || !skills.length) return [];
   for (const s of skills) {
-    const refDir = join4(dir, s.name, "references");
+    const refDir = join5(dir, s.name, "references");
     mkdirSync3(refDir, { recursive: true });
     for (const r of refs) {
-      writeFileSync3(join4(refDir, `${r.name}.md`), r.body.endsWith("\n") ? r.body : r.body + "\n");
+      writeFileSync3(join5(refDir, `${r.name}.md`), r.body.endsWith("\n") ? r.body : r.body + "\n");
     }
   }
   return refs.map((r) => r.name);
@@ -1336,6 +1545,8 @@ var SKILL_SPEC = {
   dir: skillsDir,
   resolve: resolveSkillSet,
   write: writeSkills,
+  lockNames: (items) => items.map((i) => i.name),
+  layout: SKILL_LAYOUT,
   supportsCodex: true
 };
 var AGENT_SPEC = {
@@ -1343,8 +1554,18 @@ var AGENT_SPEC = {
   dir: agentsDir,
   resolve: resolveAgentSet,
   write: writeAgents,
+  lockNames: (items, surface) => items.map((i) => agentFileName(i.name, surface)),
+  layout: AGENT_LAYOUT,
   supportsCodex: true
 };
+function ownBundles(items) {
+  const bundles = /* @__PURE__ */ new Set();
+  for (const item of items) {
+    const bundle = bundleFromBody(item.body);
+    if (bundle) bundles.add(bundle);
+  }
+  return bundles;
+}
 function scopeOf(opts) {
   return opts.local ? "project" : resolveScope(opts.scope);
 }
@@ -1424,8 +1645,16 @@ async function runInstall(spec, cmd, opts) {
       validateCodexWorkerDependencies(items, resolveAgentSet(rows, t.surface));
     }
     const refs = spec.kind === "skill" ? resolveReferenceSet(rows, t.surface) : [];
-    const written = dryRun ? items.map((i) => i.name) : spec.write(t.dir, items, t.surface);
+    const orphans = orphansAfterInstall(
+      t.dir,
+      spec.layout,
+      DEFAULT_SKILLS_SLUG,
+      spec.lockNames(items, t.surface),
+      ownBundles(items)
+    );
+    const written = dryRun ? spec.lockNames(items, t.surface) : spec.write(t.dir, items, t.surface);
     const refsWritten = dryRun ? refs.map((r) => r.name) : writeReferencesIntoSkillDirs(t.dir, items, refs);
+    const pruned = dryRun ? orphans : pruneItems(t.dir, orphans);
     return {
       client: t.client,
       surface: t.surface,
@@ -1436,7 +1665,8 @@ async function runInstall(spec, cmd, opts) {
       items: items.map(({ name, source }) => ({ name, source })),
       referenceItems: refs.map(({ name, source }) => ({ name, source })),
       written,
-      refsWritten
+      refsWritten,
+      pruned
     };
   });
   if (json) return emit({ kind: spec.kind, client: selection, dryRun, targets: results }, true);
@@ -1452,6 +1682,12 @@ async function runInstall(spec, cmd, opts) {
       console.log(
         `${dryRun ? "" : style.green("\u2713 ")}${dryRun ? "would write" : "wrote"} ${r.refsWritten.length} reference(s) into each skill ${style.dim("\u2192")} ${r.dir}/<skill>/references`
       );
+    if (r.pruned.length) {
+      console.log(
+        style.yellow("! ") + `${dryRun ? "would prune" : "pruned"} ${r.pruned.length} superseded ${spec.kind}(s) no longer in the bundle ${style.dim("\u2192")} ${r.dir}`
+      );
+      for (const name of r.pruned) console.log(`    ${style.yellow("-")} ${name}`);
+    }
     if (dryRun) for (const i of r.items) console.log(`    ${i.name} ${style.dim(`[${i.source}]`)}`);
   }
 }
@@ -1475,7 +1711,7 @@ function runList(spec, cmd, opts) {
   const out = targets.map((t) => {
     const lock = readSkillsLock(t.dir);
     const entries = Object.entries(lock).flatMap(
-      ([slug2, e]) => (e.skills ?? []).map((name) => ({ slug: slug2, name, present: existsSync3(join4(t.dir, name)) }))
+      ([slug2, e]) => (e.skills ?? []).map((name) => ({ slug: slug2, name, present: existsSync3(join5(t.dir, name)) }))
     );
     return { client: t.client, surface: t.surface, dir: t.dir, label: t.label, entries };
   });
@@ -1510,33 +1746,47 @@ function runClean(spec, cmd, opts, slugArg) {
   } catch (err2) {
     return fail(err2.message);
   }
+  const pruneOrphans = Boolean(opts.pruneOrphans);
   const cleaned = [];
   const missing = [];
   for (const t of targets) {
     const lock = readSkillsLock(t.dir);
     const entry = lock[slug2];
-    if (!entry) {
-      missing.push(join4(t.dir, SKILLS_LOCK));
+    if (!entry && !pruneOrphans) {
+      missing.push(join5(t.dir, SKILLS_LOCK));
       continue;
     }
     const removed = [];
-    for (const name of entry.skills) {
-      const p = join4(t.dir, name);
+    for (const name of entry?.skills ?? []) {
+      const p = join5(t.dir, name);
       if (existsSync3(p)) {
-        rmSync2(p, { recursive: true, force: true });
+        rmSync3(p, { recursive: true, force: true });
         removed.push(name);
       }
     }
-    delete lock[slug2];
-    writeSkillsLock(t.dir, lock);
-    cleaned.push({ client: t.client, surface: t.surface, dir: t.dir, removed });
+    if (entry) {
+      delete lock[slug2];
+      writeSkillsLock(t.dir, lock);
+    }
+    const pruned = pruneOrphans ? pruneItems(t.dir, orphansAfterClean(t.dir, spec.layout)) : [];
+    if (!entry && pruned.length === 0) {
+      missing.push(join5(t.dir, SKILLS_LOCK));
+      continue;
+    }
+    cleaned.push({ client: t.client, surface: t.surface, dir: t.dir, removed, pruned });
   }
   if (cleaned.length === 0) {
     return fail(`No materialised ${spec.kind}s recorded for '${slug2}' in ${missing.join(", ")}.`);
   }
-  if (json) return emit({ kind: spec.kind, client: selection, slug: slug2, cleaned, missing }, true);
+  if (json) return emit({ kind: spec.kind, client: selection, slug: slug2, pruneOrphans, cleaned, missing }, true);
   for (const c of cleaned) {
     console.log(style.green(`Removed ${c.removed.length} ${spec.kind}(s) for ${slug2} from ${c.dir}`));
+    if (c.pruned.length) {
+      console.log(
+        style.yellow("! ") + `pruned ${c.pruned.length} orphaned ${spec.kind}(s) with no lock entry from ${c.dir}`
+      );
+      for (const name of c.pruned) console.log(`    ${style.yellow("-")} ${name}`);
+    }
   }
 }
 
@@ -1560,12 +1810,12 @@ target:gpt-codex-agent), the dispatchable workers your loop skills call
   );
   agents.command("install").description("Materialise your installed subagents to disk (the already-installed bundle \u2014 no server install)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--dry-run", "print what would be written; write nothing").option("--client <client>", "claude, codex, or all").option("--json", "machine output").action((opts, cmd) => runInstall(AGENT_SPEC, cmd, opts));
   agents.command("list").description("List the subagents materialised on disk (per resolved config dir)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").option("--client <client>", "claude, codex, or all").action((opts, cmd) => runList(AGENT_SPEC, cmd, opts));
-  agents.command("clean [slug]").description(`Remove subagent files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--json", "machine output").option("--client <client>", "claude, codex, or all").action((slugArg, opts, cmd) => runClean(AGENT_SPEC, cmd, opts, slugArg));
+  agents.command("clean [slug]").description(`Remove subagent files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--prune-orphans", "also remove sechroom-installed agent files that no lock entry claims (renamed/removed upstream)").option("--json", "machine output").option("--client <client>", "claude, codex, or all").action((slugArg, opts, cmd) => runClean(AGENT_SPEC, cmd, opts, slugArg));
 }
 
 // src/commands/channel.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname9, join as join12 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname9, join as join13 } from "path";
 import {
   HttpTransportType,
   HubConnectionBuilder
@@ -1749,6 +1999,44 @@ async function runDriverLoop(ports, options) {
         }
         throw error;
       }
+      if (task.reviewExecution) {
+        const binding = ports.verifyTaskBinding ? await ports.verifyTaskBinding(task) : {
+          ok: false,
+          reason: "review-execution task has no driver-side target verifier; refusing before turn"
+        };
+        if (!binding.ok) {
+          const evidence = binding.evidence ? `
+
+Observed binding:
+${binding.evidence}` : "";
+          const text2 = `Review target preflight refused before turn. ${binding.reason ?? "repository/head mismatch"}${evidence}`;
+          ports.log(
+            `REVIEW TARGET REFUSED ${claim.memoryId}: ${binding.reason ?? "mismatch"}`
+          );
+          try {
+            const done = await ports.completeLease(
+              claim,
+              "blocked",
+              text2,
+              `${task.title} \u2014 review target preflight refused`
+            );
+            summary.completed++;
+            ports.log(
+              `completed ${claim.memoryId} verdict:blocked \u2192 ${done.completionMemoryId ?? done.outcome}`
+            );
+          } catch (e) {
+            if (e instanceof AuthExpiredError) throw e;
+            summary.abandoned++;
+            ports.log(
+              `COMPLETE REJECTED for ${claim.memoryId} (${String(e)}) \u2014 refused review target will re-offer; investigate the lease gap.`
+            );
+          }
+          if (options.once) break;
+          continue;
+        }
+        if (binding.evidence)
+          task = { ...task, reviewTargetEvidence: binding.evidence };
+      }
       const stopHeartbeat = ports.startLeaseHeartbeat(claim);
       let result;
       try {
@@ -1833,15 +2121,19 @@ Delivery: FAILED unexpectedly (${String(e)}) \u2014 changes remain in the execut
   return summary;
 }
 function closeoutText(task, result) {
+  const targetEvidence = task.reviewTargetEvidence ? `
+
+Review target preflight evidence:
+${task.reviewTargetEvidence}` : "";
   if (!result.packet)
     return `Driven codex run ended without a sechroom_closeout packet (soft-fail). Last agent message:
 
-${result.lastAgentMessage || "(none)"}`;
+${result.lastAgentMessage || "(none)"}${targetEvidence}`;
   const evidence = result.packet.evidence?.length ? `
 
 Evidence:
 ${result.packet.evidence.map((e) => `- ${e}`).join("\n")}` : "";
-  return `${result.packet.summary}${evidence}
+  return `${result.packet.summary}${evidence}${targetEvidence}
 
 (terminal_status: ${result.packet.terminal_status}; driven by sechroom executor run.)`;
 }
@@ -1883,7 +2175,8 @@ async function materializeClaimedTask(request, memoryId) {
   }
   return {
     title: card.title ?? memoryId,
-    text: assemblePrompt(card, components)
+    text: assemblePrompt(card, components),
+    reviewExecution: card.reviewExecution ?? void 0
   };
 }
 function validatePackage(value, expectedSlug, expectedVersion) {
@@ -1917,6 +2210,11 @@ ${card.task.boundaries}`,
     `## Closeout
 ${card.task.closeout}`
   ];
+  if (card.reviewExecution)
+    sections.push(
+      `## Review target
+${renderReviewExecution(card.reviewExecution)}`
+    );
   if (components.length > 0)
     sections.push(
       `## Task context
@@ -1924,6 +2222,17 @@ ${components.map(renderComponent).join("\n\n")}`
     );
   return sections.join("\n\n");
 }
+function renderReviewExecution(target) {
+  return [
+    `kind: ${target.kind}`,
+    `round: ${target.round}`,
+    `repository: ${target.repository}`,
+    `base commit: ${target.baseCommit}`,
+    `head commit: ${target.headCommit}`,
+    target.preferredInstanceKey ? `preferred instance: ${target.preferredInstanceKey}` : void 0,
+    target.preferredLaneId ? `preferred lane: ${target.preferredLaneId}` : void 0
+  ].filter((line) => line !== void 0).join("\n");
+}
 function renderComponent(component) {
   return [
     `<!-- sechroom-task-context component=${JSON.stringify(component.slug)} id=${JSON.stringify(component.sourceId)} sourceVersion=${component.sourceVersion} -->`,
@@ -1934,21 +2243,22 @@ function renderComponent(component) {
 
 // src/commands/executor.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync8, mkdirSync as mkdirSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname8, join as join11 } from "path";
+import { randomUUID } from "crypto";
+import { existsSync as existsSync8, mkdirSync as mkdirSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname8, join as join12 } from "path";
 
 // src/sem.ts
-import { dirname as dirname2, join as join5 } from "path";
-import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync, readFileSync as readFileSync3, statSync, writeFileSync as writeFileSync4 } from "fs";
-var SEM_FILE = join5(".sechroom", "lane.json");
+import { dirname as dirname2, join as join6 } from "path";
+import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
+var SEM_FILE = join6(".sechroom", "lane.json");
 var STATE_DIR_NAME2 = ".sechroom";
 function localSemPath(cwd = process.cwd()) {
-  return join5(cwd, SEM_FILE);
+  return join6(cwd, SEM_FILE);
 }
 function resolveSemPathForRead(start = process.cwd()) {
   let dir = start;
   while (true) {
-    const candidate = join5(dir, SEM_FILE);
+    const candidate = join6(dir, SEM_FILE);
     if (existsSync4(candidate)) return candidate;
     const parent = dirname2(dir);
     if (parent === dir) return void 0;
@@ -1960,7 +2270,7 @@ function applyWorktreeLaneSuffix(lane, start = process.cwd()) {
     let dir = start;
     let gitPath;
     for (; ; ) {
-      const candidate = join5(dir, ".git");
+      const candidate = join6(dir, ".git");
       if (existsSync4(candidate)) {
         gitPath = candidate;
         break;
@@ -1969,14 +2279,14 @@ function applyWorktreeLaneSuffix(lane, start = process.cwd()) {
       if (parent === dir) break;
       dir = parent;
     }
-    if (!gitPath || statSync(gitPath).isDirectory()) return lane;
-    const gitFile = readFileSync3(gitPath, "utf8");
+    if (!gitPath || statSync2(gitPath).isDirectory()) return lane;
+    const gitFile = readFileSync4(gitPath, "utf8");
     const common = gitFile.trim().match(/^gitdir:\s*(.+)\/worktrees\/[^/\s]+\s*$/);
     if (!common) return lane;
-    const worktreesDir = join5(common[1], "worktrees");
-    const siblings = readdirSync(worktreesDir).filter((n) => {
+    const worktreesDir = join6(common[1], "worktrees");
+    const siblings = readdirSync2(worktreesDir).filter((n) => {
       try {
-        return statSync(join5(worktreesDir, n)).isDirectory();
+        return statSync2(join6(worktreesDir, n)).isDirectory();
       } catch {
         return false;
       }
@@ -1998,10 +2308,10 @@ function serializeSem(values) {
 function readSem(path) {
   const p = path ?? resolveSemPathForRead();
   if (!p || !existsSync4(p)) return void 0;
-  return { path: p, values: parseLaneJson(readFileSync3(p, "utf8")) };
+  return { path: p, values: parseLaneJson(readFileSync4(p, "utf8")) };
 }
 function readLocalSemValues(cwd = process.cwd()) {
-  const next = join5(cwd, SEM_FILE);
+  const next = join6(cwd, SEM_FILE);
   if (existsSync4(next)) return readSem(next)?.values ?? {};
   return {};
 }
@@ -2047,7 +2357,7 @@ var CONTINUITY_SCAFFOLD = JSON.stringify(
 ) + "\n";
 function ensureContinuityScaffold(semPath) {
   try {
-    const target = join5(dirname2(semPath), CONTINUITY_FILE_NAME);
+    const target = join6(dirname2(semPath), CONTINUITY_FILE_NAME);
     if (existsSync4(target)) return;
     writeFileSync4(target, CONTINUITY_SCAFFOLD);
   } catch {
@@ -2062,7 +2372,7 @@ function ignoresSem(content) {
 function inGitRepo(startDir) {
   let dir = startDir;
   for (; ; ) {
-    if (existsSync4(join5(dir, ".git"))) return true;
+    if (existsSync4(join6(dir, ".git"))) return true;
     const parent = dirname2(dir);
     if (parent === dir) return false;
     dir = parent;
@@ -2071,11 +2381,11 @@ function inGitRepo(startDir) {
 function resolveGitignoreTarget(startDir) {
   let dir = startDir;
   for (; ; ) {
-    const gi = join5(dir, ".gitignore");
+    const gi = join6(dir, ".gitignore");
     if (existsSync4(gi)) return { path: gi, exists: true };
     const parent = dirname2(dir);
-    if (existsSync4(join5(dir, ".git")) || parent === dir) {
-      return { path: join5(startDir, ".gitignore"), exists: false };
+    if (existsSync4(join6(dir, ".git")) || parent === dir) {
+      return { path: join6(startDir, ".gitignore"), exists: false };
     }
     dir = parent;
   }
@@ -2086,7 +2396,7 @@ function ensureSemIgnored(semPath) {
     if (!inGitRepo(checkoutDir)) return;
     const target = resolveGitignoreTarget(checkoutDir);
     if (target.exists) {
-      const content = readFileSync3(target.path, "utf8");
+      const content = readFileSync4(target.path, "utf8");
       if (ignoresSem(content)) return;
       const sep2 = content.length === 0 || content.endsWith("\n") ? "" : "\n";
       appendFileSync(target.path, `${sep2}${STATE_DIR_IGNORE}
@@ -2100,7 +2410,7 @@ function ensureSemIgnored(semPath) {
 }
 
 // src/commands/executor-run.ts
-import { join as join10, resolve as resolve3 } from "path";
+import { join as join11, resolve as resolve3 } from "path";
 
 // src/executor-run/usage.ts
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync5 } from "fs";
@@ -2719,7 +3029,9 @@ var CodexAppServer = class {
       modelId,
       executorInstanceId: this.options.executorInstanceId,
       leaseId: telemetry?.leaseId ?? null,
-      turnId: turnId || null
+      turnId: turnId || null,
+      originatingReviewId: telemetry?.originatingReviewId ?? null,
+      reviewRound: telemetry?.reviewRound ?? null
     });
     this.onNotification = (msg) => {
       if (msg.method === "thread/tokenUsage/updated") {
@@ -3243,8 +3555,8 @@ import {
   closeSync,
   mkdirSync as mkdirSync6,
   openSync,
-  readFileSync as readFileSync4,
-  rmSync as rmSync3,
+  readFileSync as readFileSync5,
+  rmSync as rmSync4,
   writeFileSync as writeFileSync5
 } from "fs";
 import { readFile } from "fs/promises";
@@ -3253,7 +3565,7 @@ import {
   createServer as createServer2
 } from "net";
 import { tmpdir } from "os";
-import { dirname as dirname4, join as join6, resolve } from "path";
+import { dirname as dirname4, join as join7, resolve } from "path";
 var DEFAULT_RESTART_POLICY = {
   enabled: true,
   maxRetries: 10,
@@ -4110,7 +4422,7 @@ function isProcessAlive(pid) {
 function readPidFile(path) {
   let raw;
   try {
-    raw = readFileSync4(path, "utf8");
+    raw = readFileSync5(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
@@ -4124,7 +4436,7 @@ function claimPidFile(path, options = {}) {
   });
   let raw;
   try {
-    raw = readFileSync4(path, "utf8");
+    raw = readFileSync5(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return;
     throw error;
@@ -4138,7 +4450,7 @@ function claimPidFile(path, options = {}) {
   log(
     `stale pid-file ${path} (${valid ? `pid ${pid}` : "unparseable"} not running) \u2014 reclaiming`
   );
-  rmSync3(path, { force: true });
+  rmSync4(path, { force: true });
 }
 function writePidFile(path, pid) {
   mkdirSync6(dirname4(path), { recursive: true });
@@ -4148,7 +4460,7 @@ function writePidFile(path, pid) {
 function removePidFileIfOwned(path, pid, log) {
   if (readPidFile(path) !== pid) return;
   try {
-    rmSync3(path, { force: true });
+    rmSync4(path, { force: true });
   } catch (error) {
     log?.(`pid-file ${path} cleanup failed: ${String(error)}`);
   }
@@ -4198,12 +4510,12 @@ function launchDetachedSupervisor(options) {
 }
 function controlSocketPath(pidFile) {
   const hash = createHash2("sha256").update(resolve(pidFile)).digest("hex").slice(0, 16);
-  return join6(tmpdir(), `sechroom-fleet-${hash}.sock`);
+  return join7(tmpdir(), `sechroom-fleet-${hash}.sock`);
 }
 function startControlServer(socketPath, handlers, options = {}) {
   const log = options.log ?? (() => {
   });
-  rmSync3(socketPath, { force: true });
+  rmSync4(socketPath, { force: true });
   const dispatch = (req) => {
     switch (req.command) {
       case "status":
@@ -4265,7 +4577,7 @@ function startControlServer(socketPath, handlers, options = {}) {
         socketPath,
         close: () => new Promise((res) => {
           server.close(() => {
-            rmSync3(socketPath, { force: true });
+            rmSync4(socketPath, { force: true });
             res();
           });
         })
@@ -4344,29 +4656,88 @@ function sendControlCommand(socketPath, request, options = {}) {
   });
 }
 
+// src/executor-run/review-target.ts
+async function verifyReviewTarget(git, task) {
+  const target = task.reviewExecution;
+  if (!target) return { ok: true };
+  const [remote, head] = await Promise.all([
+    git("git", ["remote", "get-url", "origin"]),
+    git("git", ["rev-parse", "HEAD"])
+  ]);
+  const observedRepository = remote.ok ? canonicalRepository(remote.stdout) : void 0;
+  const observedHead = head.ok ? head.stdout.trim().toLowerCase() || void 0 : void 0;
+  const failures = [];
+  if (observedRepository !== target.repository)
+    failures.push(
+      `repository required ${target.repository}, observed ${observedRepository ?? "(unavailable)"}`
+    );
+  if (observedHead !== target.headCommit)
+    failures.push(
+      `head required ${target.headCommit}, observed ${observedHead ?? "(unavailable)"}`
+    );
+  const evidence = [
+    `required repository: ${target.repository}`,
+    `observed repository: ${observedRepository ?? "(unavailable)"}`,
+    `required base: ${target.baseCommit}`,
+    `required head: ${target.headCommit}`,
+    `observed head: ${observedHead ?? "(unavailable)"}`
+  ].join("\n");
+  return {
+    ok: failures.length === 0,
+    reason: failures.length > 0 ? `review target mismatch before turn: ${failures.join("; ")}` : void 0,
+    evidence
+  };
+}
+function canonicalRepository(remote) {
+  let value = remote.trim().split(/\r?\n/, 1)[0] ?? "";
+  if (!value) return void 0;
+  if (value.startsWith("git@")) {
+    const separator = value.indexOf(":");
+    if (separator < 0) return void 0;
+    value = value.slice(separator + 1);
+  } else {
+    try {
+      const parsed = new URL(value);
+      if (parsed.protocol === "file:") return void 0;
+      value = parsed.pathname;
+    } catch {
+      return void 0;
+    }
+  }
+  value = value.replace(/^\/+/, "").replace(/\/+$/, "").replace(/\.git$/i, "");
+  const parts = value.split("/").filter(Boolean);
+  if (parts.length < 2) return void 0;
+  const owner = parts.at(-2);
+  const repository = parts.at(-1);
+  if (!owner || !repository) return void 0;
+  const part = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+  if (!part.test(owner) || !part.test(repository)) return void 0;
+  return `${owner}/${repository}`.toLowerCase();
+}
+
 // src/commands/telemetry.ts
 import {
   existsSync as existsSync7,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync6,
-  rmSync as rmSync4,
+  readFileSync as readFileSync7,
+  rmSync as rmSync5,
   writeFileSync as writeFileSync7
 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname7, join as join9, parse, resolve as resolve2, sep } from "path";
+import { dirname as dirname7, join as join10, parse, resolve as resolve2, sep } from "path";
 
 // src/commands/hook-install.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
-import { delimiter, dirname as dirname6, join as join8 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
+import { delimiter, dirname as dirname6, join as join9 } from "path";
 
 // src/setup/clients.ts
 import { existsSync as existsSync5 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname5, join as join7 } from "path";
+import { dirname as dirname5, join as join8 } from "path";
 function claudeDesktopConfigPath(home) {
   switch (process.platform) {
     case "darwin":
-      return join7(
+      return join8(
         home,
         "Library",
         "Application Support",
@@ -4374,19 +4745,20 @@ function claudeDesktopConfigPath(home) {
         "claude_desktop_config.json"
       );
     case "win32":
-      return join7(
-        process.env.APPDATA ?? join7(home, "AppData", "Roaming"),
+      return join8(
+        process.env.APPDATA ?? join8(home, "AppData", "Roaming"),
         "Claude",
         "claude_desktop_config.json"
       );
     default:
-      return join7(home, ".config", "Claude", "claude_desktop_config.json");
+      return join8(home, ".config", "Claude", "claude_desktop_config.json");
   }
 }
 function clientTargets(cwd, opts = {}) {
   const home = homedir3();
-  const claudeDir = opts.claudeDir ?? join7(home, ".claude");
-  const codexHome = opts.codexHome === void 0 ? join7(home, ".codex") : opts.codexHome;
+  const claudeDir = opts.claudeDir ?? join8(home, ".claude");
+  const codexHome = opts.codexHome === void 0 ? join8(home, ".codex") : opts.codexHome;
+  const codexConfigPath = opts.codexScope === "project" ? join8(cwd, ".codex", "config.toml") : codexHome ? join8(codexHome, "config.toml") : null;
   return {
     "claude-code": {
       key: "claude-code",
@@ -4394,10 +4766,10 @@ function clientTargets(cwd, opts = {}) {
       mcp: {
         surfaceKey: "claude-code",
         sectionType: SectionType.McpConfig,
-        path: join7(cwd, ".mcp.json"),
+        path: join8(cwd, ".mcp.json"),
         format: "json"
       },
-      instruction: { surfaceKey: "claude-code", path: join7(cwd, "CLAUDE.md") }
+      instruction: { surfaceKey: "claude-code", path: join8(cwd, "CLAUDE.md") }
     },
     "claude-desktop": {
       key: "claude-desktop",
@@ -4410,19 +4782,19 @@ function clientTargets(cwd, opts = {}) {
       },
       instruction: {
         surfaceKey: "claude-desktop",
-        path: join7(claudeDir, "CLAUDE.md")
+        path: join8(claudeDir, "CLAUDE.md")
       }
     },
     codex: {
       key: "codex",
       label: "Codex CLI",
-      mcp: codexHome ? {
+      mcp: codexConfigPath ? {
         surfaceKey: "chatgpt",
         sectionType: SectionType.McpConfigToml,
-        path: join7(codexHome, "config.toml"),
+        path: codexConfigPath,
         format: "toml"
       } : null,
-      instruction: { surfaceKey: "chatgpt", path: join7(cwd, "AGENTS.md") }
+      instruction: { surfaceKey: "chatgpt", path: join8(cwd, "AGENTS.md") }
     },
     cursor: {
       key: "cursor",
@@ -4430,10 +4802,10 @@ function clientTargets(cwd, opts = {}) {
       mcp: {
         surfaceKey: "claude-code",
         sectionType: SectionType.McpConfig,
-        path: join7(cwd, ".cursor", "mcp.json"),
+        path: join8(cwd, ".cursor", "mcp.json"),
         format: "json"
       },
-      instruction: { surfaceKey: "chatgpt", path: join7(cwd, "AGENTS.md") }
+      instruction: { surfaceKey: "chatgpt", path: join8(cwd, "AGENTS.md") }
     },
     antigravity: {
       key: "antigravity",
@@ -4447,10 +4819,10 @@ function clientTargets(cwd, opts = {}) {
       mcp: {
         surfaceKey: "antigravity",
         sectionType: SectionType.McpConfig,
-        path: join7(home, ".gemini", "config", "mcp_config.json"),
+        path: join8(home, ".gemini", "config", "mcp_config.json"),
         format: "json"
       },
-      instruction: { surfaceKey: "antigravity", path: join7(cwd, "AGENTS.md") }
+      instruction: { surfaceKey: "antigravity", path: join8(cwd, "AGENTS.md") }
     }
   };
 }
@@ -4470,9 +4842,9 @@ function detectInstalledClients(cwd) {
   if (existsSync5(dirname5(claudeDesktopConfigPath(home))))
     detected.push("claude-desktop");
   if (resolveCodexHomes({}).some((d) => existsSync5(d))) detected.push("codex");
-  if (existsSync5(join7(home, ".cursor")) || existsSync5(join7(cwd, ".cursor")))
+  if (existsSync5(join8(home, ".cursor")) || existsSync5(join8(cwd, ".cursor")))
     detected.push("cursor");
-  if (existsSync5(join7(home, ".gemini"))) detected.push("antigravity");
+  if (existsSync5(join8(home, ".gemini"))) detected.push("antigravity");
   return detected;
 }
 
@@ -4516,12 +4888,12 @@ function mergeHooks(config2, commands) {
 }
 function readJsonConfig2(path) {
   if (!existsSync6(path)) return {};
-  const raw = readFileSync5(path, "utf8");
+  const raw = readFileSync6(path, "utf8");
   if (!raw.trim()) return {};
   return JSON.parse(raw);
 }
 function installHooksJson(path, commands, dryRun) {
-  const existed = existsSync6(path) && readFileSync5(path, "utf8").trim().length > 0;
+  const existed = existsSync6(path) && readFileSync6(path, "utf8").trim().length > 0;
   const config2 = readJsonConfig2(path);
   const added = mergeHooks(config2, commands);
   if (added === 0 && existed) return { path, status: "current" };
@@ -4532,12 +4904,12 @@ function installHooksJson(path, commands, dryRun) {
   return { path, status: existed ? "merged" : "created" };
 }
 function installClaudeCommands(claudeDir, commands, dryRun) {
-  return installHooksJson(join8(claudeDir, "settings.json"), commands, dryRun);
+  return installHooksJson(join9(claudeDir, "settings.json"), commands, dryRun);
 }
 function installCodexCommands(codexHome, commands, dryRun) {
   return [
-    installHooksJson(join8(codexHome, "hooks.json"), commands, dryRun),
-    installCodexFeatureFlag(join8(codexHome, "config.toml"), dryRun)
+    installHooksJson(join9(codexHome, "hooks.json"), commands, dryRun),
+    installCodexFeatureFlag(join9(codexHome, "config.toml"), dryRun)
   ];
 }
 function ensureCodexFeaturesHooks(content) {
@@ -4562,7 +4934,7 @@ function ensureCodexFeaturesHooks(content) {
 }
 function installCodexFeatureFlag(path, dryRun) {
   const existed = existsSync6(path);
-  const content = existed ? readFileSync5(path, "utf8") : "";
+  const content = existed ? readFileSync6(path, "utf8") : "";
   const { next, changed } = ensureCodexFeaturesHooks(content);
   if (!changed) return { path, status: "current" };
   if (!dryRun) {
@@ -4592,11 +4964,11 @@ function installHookSurfaces(surfaces, opts) {
   const out = [];
   for (const surface of surfaces) {
     if (surface === "claude") {
-      const path = join8(opts.claudeDir, "settings.json");
+      const path = join9(opts.claudeDir, "settings.json");
       out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
     } else {
-      const hooksJson = installHooksJson(join8(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
-      const featureFlag = installCodexFeatureFlag(join8(opts.codexHome, "config.toml"), opts.dryRun);
+      const hooksJson = installHooksJson(join9(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
+      const featureFlag = installCodexFeatureFlag(join9(opts.codexHome, "config.toml"), opts.dryRun);
       out.push({ surface, results: [hooksJson, featureFlag] });
     }
   }
@@ -4616,7 +4988,7 @@ function isSechroomOnPath() {
   for (const dir of pathEnv.split(delimiter)) {
     if (!dir) continue;
     for (const name of names) {
-      if (existsSync6(join8(dir, name))) return true;
+      if (existsSync6(join9(dir, name))) return true;
     }
   }
   return false;
@@ -4661,6 +5033,13 @@ function registerTelemetry(program2) {
   ).option("--text <s>", "Raw/parsed payload text").option("--approval <state>", "Approval gate state (approval events)").option(
     "--verdict <v>",
     "Typed verdict (terminal events): pass | soft-fail | plan-invalid | blocked"
+  ).option(
+    "--originating-review-id <id>",
+    "Existing review entity id that caused this rework; never creates a review"
+  ).option(
+    "--review-round <n>",
+    "Review round for the originating review",
+    parseIntOpt
   ).action(async (opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
     const cfg = resolveConfig(cmd.optsWithGlobals());
@@ -4673,7 +5052,9 @@ function registerTelemetry(program2) {
       contextWindow: opts.contextWindow ?? null,
       text: opts.text ?? null,
       approvalState: opts.approval ?? null,
-      verdict: opts.verdict ?? null
+      verdict: opts.verdict ?? null,
+      originatingReviewId: opts.originatingReviewId,
+      reviewRound: opts.reviewRound
     };
     let body;
     try {
@@ -4714,14 +5095,23 @@ function registerTelemetry(program2) {
   ).requiredOption(
     "--decomposition <id>",
     "Decomposition id this session executes"
-  ).requiredOption("--task <id>", "Task id this session executes").action((opts, cmd) => {
+  ).requiredOption("--task <id>", "Task id this session executes").option(
+    "--originating-review-id <id>",
+    "Existing review entity id driving this rework; never creates a review"
+  ).option(
+    "--review-round <n>",
+    "Review round for the originating review",
+    parseIntOpt
+  ).action((opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
-    const dir = join9(process.cwd(), ".sechroom");
+    const dir = join10(process.cwd(), ".sechroom");
     mkdirSync8(dir, { recursive: true });
-    const path = join9(dir, BINDING_FILE);
+    const path = join10(dir, BINDING_FILE);
     const binding = {
       decompositionId: opts.decomposition,
-      taskId: opts.task
+      taskId: opts.task,
+      originatingReviewId: opts.originatingReviewId,
+      reviewRound: opts.reviewRound
     };
     writeFileSync7(path, JSON.stringify(binding, null, 2) + "\n");
     ensureStateDirIgnored(process.cwd());
@@ -4738,9 +5128,9 @@ function registerTelemetry(program2) {
   });
   telemetry.command("unbind").description("Clear this checkout's telemetry binding").action((_opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
-    const path = join9(process.cwd(), ".sechroom", BINDING_FILE);
+    const path = join10(process.cwd(), ".sechroom", BINDING_FILE);
     const existed = existsSync7(path);
-    if (existed) rmSync4(path);
+    if (existed) rmSync5(path);
     if (json) emit({ unbound: existed, path }, true);
     else
       process.stdout.write(
@@ -4766,7 +5156,9 @@ function registerTelemetry(program2) {
         input,
         usage,
         binding.taskId,
-        configRoot
+        configRoot,
+        binding.originatingReviewId ?? null,
+        binding.reviewRound ?? null
       );
       if (events.length === 0) return process.exit(0);
       const taskId = await taskIdForHook(cfg, binding);
@@ -4860,11 +5252,11 @@ async function postTelemetry(cfg, decompositionId, events) {
 function findBinding(start) {
   let dir = start;
   for (; ; ) {
-    const path = join9(dir, ".sechroom", BINDING_FILE);
+    const path = join10(dir, ".sechroom", BINDING_FILE);
     if (existsSync7(path)) {
       try {
         const b = JSON.parse(
-          readFileSync6(path, "utf8")
+          readFileSync7(path, "utf8")
         );
         if (b.decompositionId && b.taskId)
           return {
@@ -4872,6 +5264,8 @@ function findBinding(start) {
             taskId: b.taskId,
             activeTaskCheckedAt: b.activeTaskCheckedAt,
             lifecycleWarning: b.lifecycleWarning,
+            originatingReviewId: b.originatingReviewId,
+            reviewRound: b.reviewRound,
             path
           };
         if (b.decompositionId && b.invalidatedTaskId && b.invalidatedReason === "terminal-task")
@@ -4879,6 +5273,8 @@ function findBinding(start) {
             decompositionId: b.decompositionId,
             invalidatedTaskId: b.invalidatedTaskId,
             invalidatedReason: b.invalidatedReason,
+            originatingReviewId: b.originatingReviewId,
+            reviewRound: b.reviewRound,
             path
           };
       } catch {
@@ -4941,7 +5337,7 @@ async function getTaskLifecycleVerdict(cfg, binding) {
 function markLifecycleWarningIfCurrent(binding) {
   try {
     const current = JSON.parse(
-      readFileSync6(binding.path, "utf8")
+      readFileSync7(binding.path, "utf8")
     );
     if (current.decompositionId !== binding.decompositionId || current.taskId !== binding.taskId)
       return;
@@ -4949,7 +5345,9 @@ function markLifecycleWarningIfCurrent(binding) {
       decompositionId: binding.decompositionId,
       taskId: binding.taskId,
       activeTaskCheckedAt: current.activeTaskCheckedAt,
-      lifecycleWarning: "insufficient-permission"
+      lifecycleWarning: "insufficient-permission",
+      originatingReviewId: current.originatingReviewId,
+      reviewRound: current.reviewRound
     };
     writeFileSync7(binding.path, JSON.stringify(warned, null, 2) + "\n");
   } catch {
@@ -4958,14 +5356,16 @@ function markLifecycleWarningIfCurrent(binding) {
 function cacheActiveBindingIfCurrent(binding) {
   try {
     const current = JSON.parse(
-      readFileSync6(binding.path, "utf8")
+      readFileSync7(binding.path, "utf8")
     );
     if (current.decompositionId !== binding.decompositionId || current.taskId !== binding.taskId)
       return;
     const cached = {
       decompositionId: binding.decompositionId,
       taskId: binding.taskId,
-      activeTaskCheckedAt: (/* @__PURE__ */ new Date()).toISOString()
+      activeTaskCheckedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      originatingReviewId: current.originatingReviewId,
+      reviewRound: current.reviewRound
     };
     writeFileSync7(binding.path, JSON.stringify(cached, null, 2) + "\n");
   } catch {
@@ -4974,7 +5374,7 @@ function cacheActiveBindingIfCurrent(binding) {
 function invalidateBindingIfCurrent(binding) {
   try {
     const current = JSON.parse(
-      readFileSync6(binding.path, "utf8")
+      readFileSync7(binding.path, "utf8")
     );
     if (current.decompositionId !== binding.decompositionId || current.taskId !== binding.taskId)
       return;
@@ -4984,7 +5384,9 @@ function invalidateBindingIfCurrent(binding) {
         {
           decompositionId: binding.decompositionId,
           invalidatedTaskId: binding.taskId,
-          invalidatedReason: "terminal-task"
+          invalidatedReason: "terminal-task",
+          originatingReviewId: current.originatingReviewId,
+          reviewRound: current.reviewRound
         },
         null,
         2
@@ -4999,7 +5401,7 @@ function parseTranscript(path) {
   let tokensOut = 0;
   let contextUsed = 0;
   let model = "";
-  for (const line of readFileSync6(path, "utf8").split("\n")) {
+  for (const line of readFileSync7(path, "utf8").split("\n")) {
     if (!line.trim()) continue;
     let obj;
     try {
@@ -5016,14 +5418,20 @@ function parseTranscript(path) {
     if (obj.message?.model) model = obj.message.model;
   }
   if (tokensIn === 0 && tokensOut === 0) return null;
-  return { tokensIn, tokensOut, contextUsed, contextWindow: windowFor(model, contextUsed), modelId: model || null };
+  return {
+    tokensIn,
+    tokensOut,
+    contextUsed,
+    contextWindow: windowFor(model, contextUsed),
+    modelId: model || null
+  };
 }
 function windowFor(model, contextUsed = 0) {
   const m = model.toLowerCase();
   if (m.includes("[1m]") || m.includes("-1m")) return 1e6;
   return contextUsed > 2e5 ? 1e6 : 2e5;
 }
-function buildHookEvents(input, usage, taskId, configRoot = null) {
+function buildHookEvents(input, usage, taskId, configRoot = null, originatingReviewId = null, reviewRound = null) {
   const events = [];
   const base = (kind, over) => ({
     taskId,
@@ -5037,6 +5445,8 @@ function buildHookEvents(input, usage, taskId, configRoot = null) {
     verdict: null,
     modelId: null,
     configRoot,
+    originatingReviewId,
+    reviewRound,
     ...over
   });
   if (usage) {
@@ -5065,7 +5475,9 @@ function buildHookEvents(input, usage, taskId, configRoot = null) {
       break;
     case "Stop":
     case "SubagentStop":
-      events.push(base("Terminal", { text: input.last_assistant_message ?? null }));
+      events.push(
+        base("Terminal", { text: input.last_assistant_message ?? null })
+      );
       break;
   }
   return events;
@@ -5086,7 +5498,7 @@ function resolveClaudeConfigRoot(configuredRoot, transcriptPath) {
 function normalizeClaudeConfigRoot(candidate) {
   const trimmed = candidate?.trim();
   if (!trimmed) return null;
-  const expanded = trimmed === "~" ? homedir4() : trimmed.startsWith(`~${sep}`) ? join9(homedir4(), trimmed.slice(2)) : trimmed;
+  const expanded = trimmed === "~" ? homedir4() : trimmed.startsWith(`~${sep}`) ? join10(homedir4(), trimmed.slice(2)) : trimmed;
   let normalized = resolve2(expanded);
   const rootLength = parse(normalized).root.length;
   while (normalized.length > rootLength && normalized.endsWith(sep))
@@ -5160,10 +5572,10 @@ function registerExecutorRunCommand(executor) {
       fail("--detach and --foreground are mutually exclusive");
     const detach = !foreground;
     const pidFile = resolve3(
-      opts.pidFile ? String(opts.pidFile) : join10(process.cwd(), ".sechroom", "fleet.pid")
+      opts.pidFile ? String(opts.pidFile) : join11(process.cwd(), ".sechroom", "fleet.pid")
     );
     const logFile = resolve3(
-      opts.logFile ? String(opts.logFile) : join10(process.cwd(), ".sechroom", "fleet.log")
+      opts.logFile ? String(opts.logFile) : join11(process.cwd(), ".sechroom", "fleet.log")
     );
     if (detach && !isDetachedChild) {
       await readFleetConfig(String(opts.config));
@@ -5449,7 +5861,7 @@ function registerExecutorRunCommand(executor) {
     if (excludeTags.length)
       log(`excluding offers tagged: ${excludeTags.join(", ")}`);
     const rootDir = resolve3(String(opts.root));
-    const usageLogPath = join10(
+    const usageLogPath = join11(
       rootDir,
       ".sechroom",
       `executor-usage-${located.state.instanceKey.replace(/[^\w.-]/g, "-")}.jsonl`
@@ -5579,6 +5991,7 @@ function registerExecutorRunCommand(executor) {
       },
       claimNext: async () => await fleetInbox.waitForClaim() ?? await claimNext(request, instance.id, log, excludeTags, skipLog),
       loadTask: (memoryId) => materializeClaimedTask(request, memoryId),
+      verifyTaskBinding: (task) => verifyReviewTarget(gitRunner, task),
       startLeaseHeartbeat: (claim) => startLeaseHeartbeat(
         () => request(
           `/me/executor-task-leases/${encodeURIComponent(claim.leaseId)}/heartbeat`,
@@ -5707,7 +6120,7 @@ function registerExecutorRunCommand(executor) {
 }
 function resolveFleetPidFile(flag) {
   return resolve3(
-    flag ? String(flag) : join10(process.cwd(), ".sechroom", "fleet.pid")
+    flag ? String(flag) : join11(process.cwd(), ".sechroom", "fleet.pid")
   );
 }
 function requireLiveSupervisor(pidFile) {
@@ -5843,6 +6256,13 @@ var CODEX_EXECUTOR_HOOKS = {
   PreToolUse: EXECUTOR_PULSE_COMMAND,
   Stop: EXECUTOR_PULSE_COMMAND
 };
+function claimNextHint(claim) {
+  if (claim.outcome === "NoOffer")
+    return "no offer is currently standing for this instance";
+  if (claim.lease?.id && claim.claimToken)
+    return `claimed lease ${claim.lease.id} \u2014 keep it alive with the claimToken above, then close it out with work_executor_complete`;
+  return void 0;
+}
 function registerExecutor(program2) {
   const executor = program2.command("executor").description(
     "Register and operate a local Claude Code/Codex executor advertisement"
@@ -5955,8 +6375,8 @@ function registerExecutor(program2) {
       fail("refresh-after must be shorter than the TTL");
     const sem = readSem();
     const checkout = sem ? dirname8(dirname8(sem.path)) : process.cwd();
-    const statePath = join11(checkout, ".sechroom", EXECUTOR_STATE);
-    const previous = existsSync8(statePath) ? JSON.parse(readFileSync7(statePath, "utf8")) : void 0;
+    const statePath = join12(checkout, ".sechroom", EXECUTOR_STATE);
+    const previous = existsSync8(statePath) ? JSON.parse(readFileSync8(statePath, "utf8")) : void 0;
     const canUpdateExisting = previous?.instanceId && previous.instanceKey === instanceKey && previous.laneId === laneId && previous.runtime === (runtime.toLowerCase() === "codex" ? "codex" : "claude-code") && previous.relayId === opts.relay && previous.connectorId === connector;
     const state = {
       schemaVersion: 1,
@@ -5985,8 +6405,8 @@ function registerExecutor(program2) {
     }
     const configuredClaudeDirs = globals.claudeConfigDir || process.env.CLAUDE_CONFIG_DIR ? resolveClaudeTargets({ override: globals.claudeConfigDir }).map(
       (target) => target.dir
-    ) : [join11(checkout, ".claude")];
-    const configuredCodexHomes = globals.codexHome || process.env.CODEX_HOME ? resolveCodexHomes({ override: globals.codexHome }) : [join11(checkout, ".codex")];
+    ) : [join12(checkout, ".claude")];
+    const configuredCodexHomes = globals.codexHome || process.env.CODEX_HOME ? resolveCodexHomes({ override: globals.codexHome }) : [join12(checkout, ".codex")];
     const hookTargets = surface === "claude" ? configuredClaudeDirs : configuredCodexHomes;
     for (const target of hookTargets) {
       const results = surface === "claude" ? [
@@ -6201,6 +6621,29 @@ function registerExecutor(program2) {
     );
     emit(data, Boolean(cmd.optsWithGlobals().json));
   });
+  executor.command("claim <id>").description(
+    "Claim the next dispatch offer standing for this exact instance (one-shot attended self-claim)"
+  ).option(
+    "--idempotency-key <key>",
+    "Replay the same claim on retry instead of taking another offer (default: a fresh key per call)"
+  ).action(async (id, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(
+      cfg,
+      `/me/executor-instances/${encodeURIComponent(id)}/dispatch-offers/claim-next`,
+      {
+        method: "POST",
+        body: JSON.stringify({
+          idempotencyKey: opts.idempotencyKey ?? `cli:${randomUUID().replace(/-/g, "")}`
+        })
+      }
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+    if (cmd.optsWithGlobals().json) return;
+    const hint = claimNextHint(data);
+    if (hint) process.stderr.write(style.dim(`${hint}
+`));
+  });
   executor.command("proxy-claim <generationId>").description(
     "Node-held proxy claim: hold a task lease on a child's behalf so an attended/harness session is board-visible (node = holder-of-record, child = worker)"
   ).requiredOption(
@@ -6521,13 +6964,13 @@ function refreshRuntimeVersion(state, binaryOverride) {
 function readExecutorState(start = process.cwd()) {
   const semPath = resolveSemPathForRead(start);
   const sem = semPath ? readSem(semPath) : void 0;
-  const path = join11(
-    sem ? dirname8(sem.path) : join11(start, ".sechroom"),
+  const path = join12(
+    sem ? dirname8(sem.path) : join12(start, ".sechroom"),
     EXECUTOR_STATE
   );
   if (!existsSync8(path)) return void 0;
   return {
-    state: JSON.parse(readFileSync7(path, "utf8")),
+    state: JSON.parse(readFileSync8(path, "utf8")),
     path
   };
 }
@@ -6697,7 +7140,7 @@ function registerChannel(program2) {
   channel.command("install").description(
     "Wire `sechroom channel mcp` into the project .mcp.json as a Claude Code channel MCP server (idempotent)"
   ).option("--dry-run", "Print what would change; write nothing").action((opts) => {
-    const path = join12(process.cwd(), ".mcp.json");
+    const path = join13(process.cwd(), ".mcp.json");
     const dryRun = Boolean(opts.dryRun);
     const name = "sechroom-channel";
     const args = ["channel", "mcp"];
@@ -6794,36 +7237,69 @@ function startExecutorHeartbeat(refresh, intervalMilliseconds, dependencies = {}
   }, intervalMilliseconds);
   return () => cancel(timer);
 }
+var leaseHeartbeatApi = (cfg, path, init, deps = {}) => createAuthedRequest(cfg, deps)(path, init);
+function classifyLeaseHeartbeatFailure(error) {
+  if (!(error instanceof HttpError)) return "retry";
+  if (error.status === 408 || error.status === 429) return "retry";
+  if (error.status < 400 || error.status >= 500) return "retry";
+  if (error.status === 409 && /\bLease is Released\b/.test(error.body))
+    return "released";
+  return "terminal";
+}
+function leaseHeartbeatStoppedLine(leaseId, error) {
+  if (!(error instanceof HttpError))
+    return `lease heartbeat stopped for ${leaseId}: ${String(error)}`;
+  return `lease heartbeat stopped for ${leaseId} (${error.status}): ${problemDetail(error.body)}`;
+}
+function problemDetail(body) {
+  try {
+    const parsed = JSON.parse(body);
+    const detail = parsed.detail ?? parsed.title;
+    if (typeof detail === "string" && detail.length > 0) return detail;
+  } catch {
+  }
+  return body;
+}
 function startChannelTaskLeaseHeartbeat(cfg, claim, intervalMilliseconds = 3e4, dependencies = {}) {
   const leaseId = claim.lease?.id;
   const claimToken = claim.claimToken;
   if (!leaseId || !claimToken) return void 0;
-  const request = dependencies.request ?? api;
+  const request = dependencies.request ?? leaseHeartbeatApi;
   const onError = dependencies.onError ?? ((value) => process.stderr.write(
     err(`channel lease heartbeat failed: ${String(value)}
 `)
   ));
-  return startLeaseHeartbeat(
-    () => request(
-      cfg,
-      `/me/executor-task-leases/${encodeURIComponent(leaseId)}/heartbeat`,
-      {
-        method: "POST",
-        body: JSON.stringify({
-          claimToken,
-          tokenVersion: claim.tokenVersion ?? 1
-        })
-      }
-    ),
-    onError,
-    intervalMilliseconds,
-    {
-      setInterval: dependencies.setInterval,
-      clearInterval: dependencies.clearInterval
+  let stop;
+  const beat = async () => {
+    try {
+      return await request(
+        cfg,
+        `/me/executor-task-leases/${encodeURIComponent(leaseId)}/heartbeat`,
+        {
+          method: "POST",
+          body: JSON.stringify({
+            claimToken,
+            tokenVersion: claim.tokenVersion ?? 1
+          })
+        }
+      );
+    } catch (error) {
+      const disposition = classifyLeaseHeartbeatFailure(error);
+      if (disposition === "retry") throw error;
+      stop?.();
+      dependencies.onLeaseTerminal?.(leaseId, error);
+      if (disposition === "terminal")
+        onError(leaseHeartbeatStoppedLine(leaseId, error));
+      return void 0;
     }
-  );
+  };
+  stop = startLeaseHeartbeat(beat, onError, intervalMilliseconds, {
+    setInterval: dependencies.setInterval,
+    clearInterval: dependencies.clearInterval
+  });
+  return stop;
 }
-function createChannelLeaseHeartbeatManager(cfg, taskLeaseTtlSeconds) {
+function createChannelLeaseHeartbeatManager(cfg, taskLeaseTtlSeconds, dependencies = {}) {
   const stops = /* @__PURE__ */ new Map();
   const intervalMilliseconds = Math.max(
     1e3,
@@ -6836,10 +7312,20 @@ function createChannelLeaseHeartbeatManager(cfg, taskLeaseTtlSeconds) {
       const stop = startChannelTaskLeaseHeartbeat(
         cfg,
         claim,
-        intervalMilliseconds
+        intervalMilliseconds,
+        {
+          ...dependencies,
+          // The beat has already cancelled its own timer; drop the dead entry so a
+          // later re-claim of the same lease id can start a fresh beat, and so the
+          // map does not accumulate stopped leases for the life of the channel.
+          onLeaseTerminal: (id) => {
+            stops.delete(id);
+          }
+        }
       );
       if (stop) stops.set(leaseId, stop);
     },
+    activeLeaseIds: () => [...stops.keys()],
     stop: () => {
       for (const stop of stops.values()) stop();
       stops.clear();
@@ -6901,7 +7387,7 @@ async function drainClaims(cfg, executorInstanceId, deliver, dependencies = {})
 }
 function readMcpConfig(path) {
   if (!existsSync9(path)) return {};
-  const raw = readFileSync8(path, "utf8");
+  const raw = readFileSync9(path, "utf8");
   if (!raw.trim()) return {};
   try {
     return JSON.parse(raw);
@@ -7075,12 +7561,12 @@ Examples:
 
 // src/commands/checkpoint.ts
 import { mkdirSync as mkdirSync15, writeFileSync as writeFileSync14 } from "fs";
-import { dirname as dirname14, join as join16 } from "path";
+import { dirname as dirname14, join as join17 } from "path";
 
 // src/commands/hook.ts
 import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync12, mkdirSync as mkdirSync14, readFileSync as readFileSync11, statSync as statSync3, writeFileSync as writeFileSync13 } from "fs";
-import { dirname as dirname13, join as join15 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync14, readFileSync as readFileSync12, statSync as statSync4, writeFileSync as writeFileSync13 } from "fs";
+import { dirname as dirname13, join as join16 } from "path";
 
 // src/commands/lane-commit-hook.ts
 import { execFileSync as execFileSync2 } from "child_process";
@@ -7088,7 +7574,7 @@ import {
   chmodSync,
   existsSync as existsSync10,
   mkdirSync as mkdirSync11,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync10,
   renameSync,
   unlinkSync,
   writeFileSync as writeFileSync10
@@ -7109,7 +7595,7 @@ function resolveCheckoutLane(start) {
   return pin ? applyWorktreeLaneSuffix(pin, start) : void 0;
 }
 function appendLaneTrailer(messagePath, lane) {
-  const original = readFileSync9(messagePath, "utf8").replace(/\r\n/g, "\n");
+  const original = readFileSync10(messagePath, "utf8").replace(/\r\n/g, "\n");
   const lines = original.split("\n");
   const scissorsIndex = lines.findIndex(
     (line) => /^#\s*-+\s*>8\s*-+\s*$/.test(line)
@@ -7181,7 +7667,7 @@ function resolveHookPath(root, hookName) {
 function removeLegacyPrepareCommitMsgLeg(root) {
   const path = resolveHookPath(root, LEGACY_HOOK_NAME);
   if (!existsSync10(path)) return;
-  const current = readFileSync9(path, "utf8");
+  const current = readFileSync10(path, "utf8");
   const pattern = managedBlockPattern();
   if (!pattern.test(current)) return;
   const next = current.replace(pattern, "").replace(/\n{3,}/g, "\n\n").trimEnd();
@@ -7201,7 +7687,7 @@ function installLaneCommitHook(start) {
     }).trim();
     removeLegacyPrepareCommitMsgLeg(root);
     const path = resolveHookPath(root, HOOK_NAME);
-    const current = existsSync10(path) ? readFileSync9(path, "utf8") : "";
+    const current = existsSync10(path) ? readFileSync10(path, "utf8") : "";
     let next;
     if (current && !isShellHook(current)) {
       const incumbentPath = nextIncumbentPath(path);
@@ -7224,25 +7710,25 @@ function installLaneCommitHook(start) {
 }
 
 // src/commands/session-context.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import { mkdirSync as mkdirSync13, renameSync as renameSync3, rmSync as rmSync6, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname12, join as join14 } from "path";
+import { randomUUID as randomUUID3 } from "crypto";
+import { mkdirSync as mkdirSync13, renameSync as renameSync3, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname12, join as join15 } from "path";
 
 // src/setup/skill-composition-materialise.ts
-import { createHash as createHash3, randomUUID } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
 import {
   existsSync as existsSync11,
   mkdirSync as mkdirSync12,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync10,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync11,
   renameSync as renameSync2,
   rmdirSync,
-  rmSync as rmSync5,
-  statSync as statSync2,
+  rmSync as rmSync6,
+  statSync as statSync3,
   writeFileSync as writeFileSync11
 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute2, join as join13, relative, resolve as resolve5 } from "path";
-var COMPILED_SKILL_LOCK = join13(
+import { dirname as dirname11, isAbsolute as isAbsolute2, join as join14, relative, resolve as resolve5 } from "path";
+var COMPILED_SKILL_LOCK = join14(
   ".sechroom",
   "compiled-skill-materialisation.json"
 );
@@ -7307,7 +7793,7 @@ function materialiseCompiledSkillCompositions(cwd, payload, options = {}) {
       desired.delete(key);
     }
   }
-  const lockPath = join13(cwd, COMPILED_SKILL_LOCK);
+  const lockPath = join14(cwd, COMPILED_SKILL_LOCK);
   const previous = readLock(lockPath, destinations);
   const next = {
     version: 2,
@@ -7318,7 +7804,7 @@ function materialiseCompiledSkillCompositions(cwd, payload, options = {}) {
     const path = skillPath(value.skillsRoot, value.skill.name);
     const directory = dirname11(path);
     const prior = previous.entries[key];
-    const existing = existsSync11(path) ? readFileSync10(path, "utf8") : void 0;
+    const existing = existsSync11(path) ? readFileSync11(path, "utf8") : void 0;
     const existingHash = existing === void 0 ? void 0 : sha256(existing);
     const owned = prior !== void 0 && prior.skillsRoot === value.skillsRoot && existing !== void 0 && (existingHash === prior.contentHash || existingHash === prior.previousContentHash);
     const recoverableMissing = prior !== void 0 && existing === void 0;
@@ -7366,7 +7852,7 @@ function materialiseCompiledSkillCompositions(cwd, payload, options = {}) {
       };
       writeLock(lockPath, next);
       mkdirSync12(directory, { recursive: true });
-      if (existingHash !== void 0 && (!existsSync11(path) || sha256(readFileSync10(path, "utf8")) !== existingHash)) {
+      if (existingHash !== void 0 && (!existsSync11(path) || sha256(readFileSync11(path, "utf8")) !== existingHash)) {
         delete next.entries[key];
         writeLock(lockPath, next);
         items.push({
@@ -7449,7 +7935,7 @@ function entryKey(target, name, skillsRoot) {
   return `${target}:${sha256(skillsRoot)}:${name}`;
 }
 function skillPath(skillsRoot, name) {
-  return join13(skillsRoot, name, "SKILL.md");
+  return join14(skillsRoot, name, "SKILL.md");
 }
 function withFinalNewline(body) {
   return body.endsWith("\n") ? body : body + "\n";
@@ -7464,7 +7950,7 @@ function readLock(path, destinations) {
     )
   );
   try {
-    const parsed = JSON.parse(readFileSync10(path, "utf8"));
+    const parsed = JSON.parse(readFileSync11(path, "utf8"));
     if (parsed.version === 2 && parsed.entries && typeof parsed.entries === "object") {
       const entries = {};
       for (const [key, candidate] of Object.entries(parsed.entries)) {
@@ -7495,22 +7981,22 @@ function writeAtomic(path, body) {
   renameSync2(temporary, path);
 }
 function removeOwnedFile(path, acceptableHashes) {
-  const quarantine = `${path}.sechroom-retire-${process.pid}-${randomUUID()}`;
+  const quarantine = `${path}.sechroom-retire-${process.pid}-${randomUUID2()}`;
   try {
     renameSync2(path, quarantine);
   } catch (error) {
     if (error.code === "ENOENT") return "missing";
     throw error;
   }
-  const quarantinedHash = sha256(readFileSync10(quarantine, "utf8"));
+  const quarantinedHash = sha256(readFileSync11(quarantine, "utf8"));
   if (acceptableHashes.includes(quarantinedHash)) {
-    rmSync5(quarantine);
+    rmSync6(quarantine);
     return "removed";
   }
   if (!existsSync11(path)) {
     renameSync2(quarantine, path);
   } else {
-    renameSync2(quarantine, `${path}.sechroom-preserved-${randomUUID()}`);
+    renameSync2(quarantine, `${path}.sechroom-preserved-${randomUUID2()}`);
   }
   return "collision";
 }
@@ -7519,7 +8005,7 @@ function syncGitExcludes(cwd, lock) {
   if (!path) return;
   let current = "";
   try {
-    current = readFileSync10(path, "utf8");
+    current = readFileSync11(path, "utf8");
   } catch {
   }
   const withoutOwnedBlock = removeOwnedExcludeBlock(current);
@@ -7534,14 +8020,14 @@ function syncGitExcludes(cwd, lock) {
   writeAtomic(path, updated);
 }
 function gitExcludePath(cwd) {
-  const dotGit = join13(cwd, ".git");
+  const dotGit = join14(cwd, ".git");
   try {
-    if (statSync2(dotGit).isDirectory()) return join13(dotGit, "info", "exclude");
-    const pointer = readFileSync10(dotGit, "utf8").trim();
+    if (statSync3(dotGit).isDirectory()) return join14(dotGit, "info", "exclude");
+    const pointer = readFileSync11(dotGit, "utf8").trim();
     if (!pointer.startsWith("gitdir:")) return void 0;
     const raw = pointer.slice("gitdir:".length).trim();
     const gitDir = isAbsolute2(raw) ? raw : resolve5(cwd, raw);
-    return join13(gitDir, "info", "exclude");
+    return join14(gitDir, "info", "exclude");
   } catch {
     return void 0;
   }
@@ -7558,13 +8044,13 @@ function removeOwnedExcludeBlock(body) {
 }
 function removeDirectoryIfEmpty(path) {
   try {
-    if (readdirSync2(path).length === 0) rmdirSync(path);
+    if (readdirSync3(path).length === 0) rmdirSync(path);
   } catch {
   }
 }
 
 // src/commands/session-context.ts
-var DYNAMIC_AGENT_CONTEXT_FILE = join14(".sechroom", "CLAUDE.md");
+var DYNAMIC_AGENT_CONTEXT_FILE = join15(".sechroom", "CLAUDE.md");
 function checkoutRoot(start) {
   const semPath = resolveSemPathForRead(start);
   return semPath ? dirname12(dirname12(semPath)) : start;
@@ -7601,7 +8087,7 @@ function renderSessionContext(result, lane) {
 }
 function writeSessionContext(start, lane, result, options = {}) {
   const root = checkoutRoot(start);
-  const path = join14(root, DYNAMIC_AGENT_CONTEXT_FILE);
+  const path = join15(root, DYNAMIC_AGENT_CONTEXT_FILE);
   const skills = materialiseCompiledSkillCompositions(
     root,
     result.status === "hold" ? {
@@ -7617,13 +8103,13 @@ function writeSessionContext(start, lane, result, options = {}) {
   );
   const context = renderSessionContext(result, lane);
   mkdirSync13(dirname12(path), { recursive: true });
-  const temporaryPath = `${path}.${process.pid}.${randomUUID2()}.tmp`;
+  const temporaryPath = `${path}.${process.pid}.${randomUUID3()}.tmp`;
   try {
     writeFileSync12(temporaryPath, context.endsWith("\n") ? context : `${context}
 `, "utf8");
     renameSync3(temporaryPath, path);
   } catch (error) {
-    rmSync6(temporaryPath, { force: true });
+    rmSync7(temporaryPath, { force: true });
     throw error;
   }
   return { status: result.status, path, context, skills };
@@ -7674,11 +8160,12 @@ function resolveLane(flagLane, cwd) {
   if (!base) return void 0;
   return applyWorktreeLaneSuffix(base, start);
 }
-var INTENT_FILE = join15(".sechroom", "continuity.json");
+var INTENT_FILE = join16(".sechroom", "continuity.json");
+var LOCAL_DRY_RUN_VALIDATION_WARNING = "LOCAL-ONLY \u2014 NOT SERVER-VALIDATED";
 function resolveIntentPath(start) {
   let dir = start;
   for (; ; ) {
-    const candidate = join15(dir, INTENT_FILE);
+    const candidate = join16(dir, INTENT_FILE);
     if (existsSync12(candidate)) return candidate;
     const parent = dirname13(dir);
     if (parent === dir) return void 0;
@@ -7689,7 +8176,7 @@ function readIntent(start) {
   const path = resolveIntentPath(start);
   if (!path) return void 0;
   try {
-    return JSON.parse(readFileSync11(path, "utf8"));
+    return JSON.parse(readFileSync12(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -7699,6 +8186,16 @@ function hasRequiredIntent(i) {
     i.objective?.trim() && i.state?.trim() && i.lastAction?.trim() && i.nextAction?.trim() && i.resumeInstruction?.trim()
   );
 }
+function localDryRunMissingFields(i) {
+  const required = [
+    ["objective", "--objective"],
+    ["state", "--state"],
+    ["lastAction", "--last-action"],
+    ["nextAction", "--next-action"],
+    ["resumeInstruction", "--resume-instruction"]
+  ];
+  return required.filter(([key]) => !String(i[key] ?? "").trim()).map(([, flag]) => flag);
+}
 async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScope, opts) {
   const lane = resolveLane(laneFlag, cwd);
   if (!lane) return false;
@@ -7720,7 +8217,9 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
       openQuestions: intent.questions ?? null,
       surfaceMarkers: intent.surfaceMarkers ?? null,
       relevantArtifactIds: intent.artifacts ?? null,
-      confidence: intent.confidence ?? null,
+      // Preserve invalid JSON-string confidence tokens for the server's semantic
+      // validator; never coerce them through Number/NaN/null.
+      confidence: confidenceWireValue(intent.confidence),
       // Frequent triggers (compaction, session-end) land within the FR-051 4h
       // window; Acknowledge lets the checkpoint persist on the lane.
       concurrentSessionPolicy: "Acknowledge"
@@ -7731,14 +8230,14 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
 }
 function ledgerPath(start) {
   const intent = resolveIntentPath(start);
-  const dir = intent ? dirname13(intent) : join15(start, ".sechroom");
-  return join15(dir, ".checkpoint-state.json");
+  const dir = intent ? dirname13(intent) : join16(start, ".sechroom");
+  return join16(dir, ".checkpoint-state.json");
 }
 function readLedger(start) {
   try {
     const p = ledgerPath(start);
     if (!existsSync12(p)) return {};
-    return JSON.parse(readFileSync11(p, "utf8"));
+    return JSON.parse(readFileSync12(p, "utf8"));
   } catch {
     return {};
   }
@@ -7769,7 +8268,7 @@ function unchangedSinceLastPush(start, intent) {
   const path = resolveIntentPath(start);
   if (path && ledger.lastMtimeMs != null) {
     try {
-      if (statSync3(path).mtimeMs <= ledger.lastMtimeMs) return true;
+      if (statSync4(path).mtimeMs <= ledger.lastMtimeMs) return true;
     } catch {
     }
   }
@@ -7781,7 +8280,7 @@ function recordPush(start, intent) {
     const path = resolveIntentPath(start);
     let mtimeMs;
     try {
-      if (path) mtimeMs = statSync3(path).mtimeMs;
+      if (path) mtimeMs = statSync4(path).mtimeMs;
     } catch {
       mtimeMs = void 0;
     }
@@ -8015,12 +8514,18 @@ Fail-soft: failures exit 0 and never block; session-context refresh failures ren
 function registerCheckpoint(program2) {
   program2.command("checkpoint").description(
     "Checkpoint working state: create a continuity snapshot (server-validated) AND sync ./.sechroom/continuity.json in one step"
-  ).option("--lane <laneId>", "Lane id (else SECHROOM_LANE, else ./.sechroom/lane.json code-lane)").option("--scope <scope>", "Snapshot scope (else the file's scope, else 'session')").option("--objective <text>", "Current objective").option("--state <text>", "Current state").option("--last-action <text>", "Last meaningful action").option("--next-action <text>", "Next intended action").option("--resume-instruction <text>", "Resume instruction").option("--constraint <text...>", "Active constraints (repeatable)").option("--question <text...>", "Open questions (repeatable)").option("--surface-marker <text...>", "Surface markers (repeatable)").option("--artifact <id...>", "Relevant artifact ids (repeatable)").option("--confidence <n>", "Confidence 0..1").option("--dry-run", "validate + print the snapshot payload without creating it or writing the file", false).addHelpText(
+  ).option("--lane <laneId>", "Lane id (else SECHROOM_LANE, else ./.sechroom/lane.json code-lane)").option("--scope <scope>", "Snapshot scope (else the file's scope, else 'session')").option("--objective <text>", "Current objective").option("--state <text>", "Current state").option("--last-action <text>", "Last meaningful action").option("--next-action <text>", "Next intended action").option("--resume-instruction <text>", "Resume instruction").option("--constraint <text...>", "Active constraints (repeatable)").option("--question <text...>", "Open questions (repeatable)").option("--surface-marker <text...>", "Surface markers (repeatable)").option("--artifact <id...>", "Relevant artifact ids (repeatable)").option("--confidence <n>", "Confidence 0..1").option(
+    "--dry-run",
+    "run the local required-field check and print the payload (LOCAL-ONLY; NOT SERVER-VALIDATED)",
+    false
+  ).addHelpText(
     "after",
     `
 File-first: reads ./.sechroom/continuity.json (kept current as you work) as the base; any flag
 overrides that field. The snapshot is created FIRST (server-validated), then the local file is
 written/normalized with the returned snapshotId. Lane: --lane > SECHROOM_LANE > ./.sechroom/lane.json code-lane.
+--dry-run performs only the local required-field check and prints a payload. Its output is
+explicitly LOCAL-ONLY; NOT SERVER-VALIDATED, so it does not establish write-path parity.
 
 Examples:
   $ sechroom checkpoint                          snapshot from ./.sechroom/continuity.json, then sync it
@@ -8043,7 +8548,9 @@ Examples:
       questions: opts.question ?? base.questions,
       surfaceMarkers: opts.surfaceMarker ?? base.surfaceMarkers,
       artifacts: opts.artifact ?? base.artifacts,
-      confidence: opts.confidence != null ? Number(opts.confidence) : base.confidence
+      // Keep the raw token until the server's shared validator sees it. In particular,
+      // Number("high") -> NaN -> JSON null would silently discard the operator's input.
+      confidence: opts.confidence != null ? opts.confidence : base.confidence
     };
     const lane = resolveLane(opts.lane, cwd);
     if (!lane) {
@@ -8051,19 +8558,6 @@ Examples:
         "no lane resolved \u2014 pass --lane, set SECHROOM_LANE, or pin one in ./.sechroom/lane.json (code-lane). See `sechroom lane`."
       );
     }
-    const required = [
-      ["objective", "--objective"],
-      ["state", "--state"],
-      ["lastAction", "--last-action"],
-      ["nextAction", "--next-action"],
-      ["resumeInstruction", "--resume-instruction"]
-    ];
-    const missing = required.filter(([k]) => !String(merged[k] ?? "").trim()).map(([, flag]) => flag);
-    if (missing.length > 0) {
-      fail(
-        `missing required field(s): ${missing.join(", ")} \u2014 supply via flag or in ./.sechroom/continuity.json`
-      );
-    }
     const scope = merged.scope ?? "session";
     const body = {
       laneId: lane,
@@ -8077,20 +8571,40 @@ Examples:
       openQuestions: merged.questions ?? null,
       surfaceMarkers: merged.surfaceMarkers ?? null,
       relevantArtifactIds: merged.artifacts ?? null,
-      confidence: merged.confidence ?? null,
+      confidence: confidenceWireValue(merged.confidence),
       // Explicit checkpoints are often within the FR-051 4h window; Acknowledge
       // lets one land on the lane (matches `hook pre-compact`).
       concurrentSessionPolicy: "Acknowledge"
     };
     if (opts.dryRun) {
-      emit({ dryRun: true, lane, scope, wouldCreate: body }, json);
+      const missing = localDryRunMissingFields(merged);
+      if (missing.length > 0) {
+        fail(
+          `LOCAL-ONLY CHECK \u2014 NOT SERVER-VALIDATED: missing required field(s): ${missing.join(", ")} \u2014 supply via flag or in ./.sechroom/continuity.json`
+        );
+      }
+      emit(
+        {
+          dryRun: true,
+          validation: {
+            mode: "local-only",
+            serverValidated: false,
+            checks: ["required-fields"],
+            warning: LOCAL_DRY_RUN_VALIDATION_WARNING
+          },
+          lane,
+          scope,
+          wouldCreate: body
+        },
+        json
+      );
       return;
     }
     const data = await runApi("Creating snapshot", async () => {
       const client = await makeClient(cfg);
       return client.POST("/continuity/snapshots", { body });
     });
-    const path = resolveIntentPath(cwd) ?? join16(cwd, INTENT_FILE);
+    const path = resolveIntentPath(cwd) ?? join17(cwd, INTENT_FILE);
     const fileBody = { ...merged, scope, lastSnapshotId: data.snapshotId };
     mkdirSync15(dirname14(path), { recursive: true });
     writeFileSync14(path, JSON.stringify(fileBody, null, 2) + "\n");
@@ -8107,7 +8621,7 @@ Examples:
 }
 
 // src/commands/close.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 var VERDICTS = ["pass", "soft-fail", "plan-invalid", "blocked"];
 function registerClose(program2) {
   program2.command("close").description(
@@ -8148,7 +8662,7 @@ Examples:
       );
     let bodyText;
     try {
-      bodyText = opts.file ? readFileSync12(opts.file, "utf8") : readFileSync12(0, "utf8");
+      bodyText = opts.file ? readFileSync13(opts.file, "utf8") : readFileSync13(0, "utf8");
     } catch {
       fail(
         opts.file ? `could not read --file ${opts.file}` : "no closeout body \u2014 pass --file <path> or pipe it on stdin"
@@ -8320,7 +8834,7 @@ Displaced snapshot recovery surfaces:
           openQuestions: opts.question ?? null,
           surfaceMarkers: opts.surfaceMarker ?? null,
           relevantArtifactIds: opts.artifact ?? null,
-          confidence: opts.confidence != null ? Number(opts.confidence) : null
+          confidence: confidenceWireValue(opts.confidence)
         }
       });
     });
@@ -8619,7 +9133,7 @@ Examples:
     );
   });
   workPlan.command("append <decompositionId>").description(
-    "Append hand-authored task(s) to a running work plan; they land proposed until ratified (POST /decompositions/{id}/append-tasks)"
+    "Append hand-authored task(s) to a running work plan; they land proposed until ratified. Verification tasks may carry reviewExecution { kind: local-code-review, round, repository, baseCommit, headCommit, preferredInstanceKey?, preferredLaneId? } (POST /decompositions/{id}/append-tasks)"
   ).requiredOption(
     "--file <path>",
     "JSON file containing { tasks, gates? } (the AppendTasksInput shape); use - for stdin"
@@ -9018,14 +9532,34 @@ Examples:
   });
 }
 
+// src/commands/github.ts
+function registerGitHub(program2) {
+  const installation = program2.command("github").description("Manage the tenant's GitHub App installation").command("installation").description("Inspect or administer the tenant's GitHub App installation");
+  installation.command("revoke <installationId>").description("Revoke a GitHub App installation (POST /github/app/installations/{installationId}/revoke)").option("--reason <reason>", "Optional reason recorded in the installation audit trail").action(async (installationId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Revoking GitHub App installation", async () => {
+      const client = await makeClient(cfg);
+      return client.POST("/github/app/installations/{installationId}/revoke", {
+        params: { path: { installationId } },
+        body: { reason: opts.reason ?? null }
+      });
+    });
+    emitAction(
+      `revoked GitHub App installation ${style.bold(installationId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
+}
+
 // src/commands/herdr.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { basename as basename3 } from "path";
 
 // src/herdr/client.ts
 import { createConnection as createConnection2 } from "net";
 import { homedir as homedir5 } from "os";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 var DEFAULT_HERDR_SOCKET_RELATIVE = ".config/herdr/herdr.sock";
 var HerdrUnreachableError = class extends Error {
   constructor(socketPath, reason) {
@@ -9050,7 +9584,7 @@ function resolveSocketPath(flag, env = process.env, home = homedir5()) {
   if (fromFlag) return fromFlag;
   const fromEnv = env.HERDR_SOCKET?.trim();
   if (fromEnv) return fromEnv;
-  return join17(home, DEFAULT_HERDR_SOCKET_RELATIVE);
+  return join18(home, DEFAULT_HERDR_SOCKET_RELATIVE);
 }
 function expandTarget(target) {
   const trimmed = target.trim();
@@ -9390,7 +9924,7 @@ function parseSource(value, fallback = DEFAULT_READ_SOURCE) {
   }
   return match;
 }
-function resolveSendText(textArgs, useStdin, readStdin5 = () => readFileSync13(0, "utf8")) {
+function resolveSendText(textArgs, useStdin, readStdin5 = () => readFileSync14(0, "utf8")) {
   if (useStdin) {
     if (textArgs.length > 0) {
       throw new Error(
@@ -10130,11 +10664,11 @@ Examples:
 }
 
 // src/commands/memory.ts
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 
 // src/commands/memory-import.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync14, realpathSync, statSync as statSync4 } from "fs";
-import { basename as basename4, join as join18, resolve as resolve6 } from "path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync15, realpathSync, statSync as statSync5 } from "fs";
+import { basename as basename4, join as join19, resolve as resolve6 } from "path";
 var MARKDOWN_RE = /\.(md|markdown)$/i;
 function isMarkdownPath(path) {
   return MARKDOWN_RE.test(path);
@@ -10161,18 +10695,18 @@ function collectImportFiles(inputs, opts = {}) {
     files.push(path);
   };
   const walk = (dir) => {
-    const entries = readdirSync3(dir, { withFileTypes: true }).sort(
+    const entries = readdirSync4(dir, { withFileTypes: true }).sort(
       (a, b) => a.name.localeCompare(b.name)
     );
     for (const entry of entries) {
       if (entry.name.startsWith(".")) continue;
-      const child = join18(dir, entry.name);
+      const child = join19(dir, entry.name);
       let isDirectory = entry.isDirectory();
       let isFile = entry.isFile();
       if (entry.isSymbolicLink()) {
         let target;
         try {
-          target = statSync4(child);
+          target = statSync5(child);
         } catch {
           skipped.push({ path: child, reason: "broken symlink" });
           continue;
@@ -10210,7 +10744,7 @@ function collectImportFiles(inputs, opts = {}) {
   for (const input of inputs) {
     let isDirectory;
     try {
-      isDirectory = statSync4(input).isDirectory();
+      isDirectory = statSync5(input).isDirectory();
     } catch {
       missing.push(input);
       continue;
@@ -10226,7 +10760,7 @@ function buildImportPlan(collected) {
   for (const path of collected.files) {
     let text2;
     try {
-      text2 = readFileSync14(path, "utf8");
+      text2 = readFileSync15(path, "utf8");
     } catch (error) {
       throw new Error(
         `couldn't read ${path}: ${error instanceof Error ? error.message : String(error)}`
@@ -10327,7 +10861,7 @@ function resolveCreateBody(textOpt, fileOpt) {
   }
   if (textOpt != null) return { text: textOpt, defaultTitle: null };
   const fromStdin = fileOpt === "-";
-  const text2 = fromStdin ? readFileSync15(0, "utf8") : readFileSync15(String(fileOpt), "utf8");
+  const text2 = fromStdin ? readFileSync16(0, "utf8") : readFileSync16(String(fileOpt), "utf8");
   if (text2.trim().length === 0) {
     fail(fromStdin ? "Stdin was empty." : `File is empty: ${fileOpt}`);
   }
@@ -10979,16 +11513,16 @@ Note: CLI memory get omits relationships by default; MCP get_memory includes the
 }
 
 // src/setup/apply.ts
-import { createHash as createHash5, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID4 } from "crypto";
 import {
   chmodSync as chmodSync2,
   copyFileSync,
   existsSync as existsSync13,
   mkdirSync as mkdirSync16,
-  readFileSync as readFileSync16,
+  readFileSync as readFileSync17,
   renameSync as renameSync4,
-  rmSync as rmSync7,
-  statSync as statSync5,
+  rmSync as rmSync8,
+  statSync as statSync6,
   writeFileSync as writeFileSync15
 } from "fs";
 import { dirname as dirname15 } from "path";
@@ -11055,7 +11589,7 @@ function ensureDir2(path) {
 }
 function readOr(path, fallback) {
   try {
-    return readFileSync16(path, "utf8");
+    return readFileSync17(path, "utf8");
   } catch {
     return fallback;
   }
@@ -11066,7 +11600,7 @@ function mergeMcpJson(path, snippet, dryRun) {
   let current = {};
   if (existed) {
     try {
-      current = JSON.parse(readFileSync16(path, "utf8"));
+      current = JSON.parse(readFileSync17(path, "utf8"));
     } catch {
       return {
         kind: "mcp",
@@ -11436,24 +11970,24 @@ var defaultTomlFileOperations = {
 function writeTomlAtomic(path, content, fileOperations = {}) {
   ensureDir2(path);
   const operations = { ...defaultTomlFileOperations, ...fileOperations };
-  const temporary = `${path}.sechroom-${process.pid}-${randomUUID3()}.tmp`;
+  const temporary = `${path}.sechroom-${process.pid}-${randomUUID4()}.tmp`;
   const backup = `${path}.bak`;
-  const backupTemporary = `${backup}.sechroom-${process.pid}-${randomUUID3()}.tmp`;
-  const mode = existsSync13(path) ? statSync5(path).mode & 4095 : 384;
+  const backupTemporary = `${backup}.sechroom-${process.pid}-${randomUUID4()}.tmp`;
+  const mode = existsSync13(path) ? statSync6(path).mode & 4095 : 384;
   try {
     writeFileSync15(temporary, content, { mode });
     chmodSync2(temporary, mode);
-    validateToml(readFileSync16(temporary, "utf8"));
+    validateToml(readFileSync17(temporary, "utf8"));
     if (existsSync13(path) && !existsSync13(backup)) {
       operations.copyFileSync(path, backupTemporary);
       chmodSync2(backupTemporary, mode);
-      validateToml(readFileSync16(backupTemporary, "utf8"));
+      validateToml(readFileSync17(backupTemporary, "utf8"));
       operations.renameSync(backupTemporary, backup);
     }
     operations.renameSync(temporary, path);
   } finally {
-    rmSync7(temporary, { force: true });
-    rmSync7(backupTemporary, { force: true });
+    rmSync8(temporary, { force: true });
+    rmSync8(backupTemporary, { force: true });
   }
 }
 function mergeCodexToml(path, snippet, dryRun, fileOperations = {}) {
@@ -11629,7 +12163,15 @@ async function applyClient(cfg, setup, target, opts) {
           kind: "instruction",
           path: target.instruction.path,
           status: "skipped",
-          note: "no role template found in this tenant \u2014 install the SEM Starter bundle, then re-run `sechroom setup agent-files`"
+          // Name the block even when nothing resolved. Without it the skip reports a
+          // path and no identity, so a consumer cannot tell WHICH managed block went
+          // missing — absent rather than loud, which is the failure this guards.
+          block: "role-template",
+          // GUARD — an unresolved template must NAME what it looked for. A bare
+          // "not found" reads identically whether the bundle is absent or the memo
+          // was retagged out of every candidate family, and the second case is a
+          // silent loss of a template the installation previously had.
+          note: "no role template resolved \u2014 tried " + attemptedTagSets(section).map((set) => `[${set.join(", ")}]`).join(" then ") + " \u2014 install the SEM Starter bundle, or check the template's target tag, then re-run `sechroom setup agent-files`"
         });
       } else {
         const action = applyBlock(
@@ -11734,7 +12276,7 @@ auto-resumes where you left off and checkpoints working state before compacting.
 
 // src/setup/skills-offer.ts
 import { mkdirSync as mkdirSync17, writeFileSync as writeFileSync16 } from "fs";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -11850,8 +12392,8 @@ Found ${summary} available to you for ${surface}.
   if (skills.length > 0) {
     const written = [];
     for (const s of skills) {
-      mkdirSync17(join19(sDir, s.name), { recursive: true });
-      writeFileSync16(join19(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      mkdirSync17(join20(sDir, s.name), { recursive: true });
+      writeFileSync16(join20(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
       written.push(s.name);
     }
     recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -11863,7 +12405,7 @@ Found ${summary} available to you for ${surface}.
     const written = [];
     for (const a of agents) {
       const file = `${a.name}.md`;
-      writeFileSync16(join19(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      writeFileSync16(join20(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
       written.push(file);
     }
     recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -11976,8 +12518,17 @@ function buildCheckReport(result) {
     stub: 0
   };
   const blocks = [];
+  const unresolved = [];
   for (const { client, actions } of result) {
     for (const action of actions) {
+      if (action.kind === "instruction" && action.status === "skipped" && !action.eval) {
+        unresolved.push({
+          client,
+          path: action.path,
+          block: action.block ?? "unknown",
+          note: action.note
+        });
+      }
       if (!action.eval) continue;
       counts[action.eval]++;
       blocks.push({
@@ -11991,7 +12542,8 @@ function buildCheckReport(result) {
   return {
     eval: counts,
     wouldChange: counts.stale + counts.drift + counts.absent,
-    blocks
+    blocks,
+    unresolved
   };
 }
 function reportCheckAndExit(result, json, refreshCommand, jsonContext = {}) {
@@ -12006,7 +12558,7 @@ function reportCheckAndExit(result, json, refreshCommand, jsonContext = {}) {
       },
       true
     );
-  } else if (report.wouldChange === 0) {
+  } else if (report.wouldChange === 0 && report.unresolved.length === 0) {
     if (report.eval.stub) {
       const files = report.eval.stub === 1 ? "file" : "files";
       process.stdout.write(
@@ -12018,11 +12570,27 @@ function reportCheckAndExit(result, json, refreshCommand, jsonContext = {}) {
     }
   } else {
     const bits = [];
-    if (report.eval.stale) bits.push(`${report.eval.stale} out of date`);
-    if (report.eval.drift) bits.push(`${report.eval.drift} with local edits`);
-    if (report.eval.absent) bits.push(`${report.eval.absent} not yet written`);
+    if (report.wouldChange > 0) {
+      const changes = [];
+      if (report.eval.stale) changes.push(`${report.eval.stale} out of date`);
+      if (report.eval.drift)
+        changes.push(`${report.eval.drift} with local edits`);
+      if (report.eval.absent)
+        changes.push(`${report.eval.absent} not yet written`);
+      bits.push(
+        `${report.wouldChange} instruction block(s) would change: ${changes.join(", ")}`
+      );
+    }
+    if (report.unresolved.length > 0) {
+      const details = report.unresolved.map(
+        ({ client, path, block, note }) => `${client} ${block} at ${path}${note ? ` \u2014 ${note}` : ""}`
+      ).join("; ");
+      bits.push(
+        `${report.unresolved.length} instruction template(s) skipped or unresolved: ${details}`
+      );
+    }
     process.stderr.write(
-      `\u26A0 ${report.wouldChange} instruction block(s) would change: ${bits.join(", ")}. Run ${style.cyan(refreshCommand)}.
+      `\u26A0 ${bits.join("; ")}. Run ${style.cyan(refreshCommand)}.
 `
     );
   }
@@ -12099,7 +12667,7 @@ function registerInit(program2) {
     false
   ).option(
     "--check",
-    "report whether agent files would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing",
+    "report whether agent files would change and exit (0 = current/stub or unresolved warning, 1 = stale/drift/absent); writes nothing",
     false
   ).addHelpText(
     "after",
@@ -12140,7 +12708,8 @@ Examples:
     const codexHomes = resolveCodexHomes({ override: g.codexHome, scope });
     const targets = clientTargets(process.cwd(), {
       claudeDir: claudeTargets[0]?.dir,
-      codexHome: codexHomes[0] ?? null
+      codexHome: codexHomes[0] ?? null,
+      codexScope: scope
     });
     const keys = resolveClientKeys(opts.client);
     const json = g.json;
@@ -12242,7 +12811,7 @@ function registerSetup(program2, deps = {}) {
     false
   ).option(
     "--check",
-    "report whether anything would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing",
+    "report whether anything would change and exit (0 = current/stub or unresolved warning, 1 = stale/drift/absent); writes nothing",
     false
   ).addHelpText(
     "after",
@@ -12432,15 +13001,30 @@ Examples:
     "--client <list>",
     `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all'`,
     DEFAULT_CLIENT_KEY
+  ).option(
+    "--scope <scope>",
+    "Codex MCP config scope: 'project' (<cwd>/.codex) or 'global' (CODEX_HOME / ~/.codex) \u2014 default project",
+    "project"
   ).option("--dry-run", "print what would be written without writing", false).action(async (slug2, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const setup = await withSpinner(
       "Fetching setup descriptors",
       () => fetchSetup(cfg, slug2)
     );
-    const targets = clientTargets(process.cwd());
+    let scope;
+    try {
+      scope = resolveScope(opts.scope);
+    } catch (error) {
+      return fail(error.message);
+    }
+    const globals = cmd.optsWithGlobals();
+    const codexHome = scope === "global" ? resolveCodexHomes({ override: globals.codexHome, scope })[0] ?? null : null;
+    const targets = clientTargets(process.cwd(), {
+      codexHome,
+      codexScope: scope
+    });
     const keys = resolveClientKeys(opts.client);
-    const json = cmd.optsWithGlobals().json;
+    const json = globals.json;
     const result = [];
     for (const key of keys) {
       const target = targets[key];
@@ -12467,12 +13051,12 @@ Wired to namespace '${slug2}'. Restart your AI client (or reload MCP) to pick it
 
 // src/commands/onboard.ts
 import { existsSync as existsSync15 } from "fs";
-import { basename as basename5, join as join21 } from "path";
+import { basename as basename5, join as join22 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync17, readdirSync as readdirSync4, statSync as statSync6 } from "fs";
-import { isAbsolute as isAbsolute3, join as join20, resolve as resolve7 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync18, readdirSync as readdirSync5, statSync as statSync7 } from "fs";
+import { isAbsolute as isAbsolute3, join as join21, resolve as resolve7 } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -12485,20 +13069,20 @@ function resolveChildDir(path, root) {
 function discoverChildren(root) {
   let names;
   try {
-    names = readdirSync4(root);
+    names = readdirSync5(root);
   } catch {
     return [];
   }
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join20(root, name);
+    const dir = join21(root, name);
     try {
-      if (!statSync6(dir).isDirectory()) continue;
+      if (!statSync7(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync14(join20(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync14(join21(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
@@ -12506,7 +13090,7 @@ function readManifest(path) {
   if (!existsSync14(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync17(path, "utf8"));
+    parsed = JSON.parse(readFileSync18(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -12974,7 +13558,7 @@ async function planRecurseChild(entry, root, client, opts) {
       reason: "directory does not exist"
     };
   }
-  if (existsSync15(join21(dir, ".sechroom.json"))) {
+  if (existsSync15(join22(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -13081,7 +13665,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join21(root, ".sechroom", "repos.json");
+  const manifestPath = join22(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -13185,7 +13769,7 @@ function registerOnboard(program2) {
     false
   ).option(
     "--check",
-    "report whether anything would change and exit (0 = current/stub, 1 = stale/drift/absent); writes nothing",
+    "report whether anything would change and exit (0 = current/stub or unresolved warning, 1 = stale/drift/absent); writes nothing",
     false
   ).option(
     "-y, --yes",
@@ -13330,20 +13914,15 @@ Try: ${style.cyan('sechroom memory search "..."')}  or  ${style.cyan("sechroom -
       yes,
       process.cwd()
     );
-    const keys = scope === "project" ? requestedKeys.filter((key) => key !== "codex") : requestedKeys;
-    if (scope === "project" && requestedKeys.includes("codex") && !json) {
-      process.stderr.write(
-        `${style.dim("Codex has no project scope \u2014 skipped (use --scope global for Codex).")}
-`
-      );
-    }
+    const keys = requestedKeys;
     const setup = await withSpinner(
       "Fetching setup descriptors",
       () => fetchSetup(cfg)
     );
     const targets = clientTargets(process.cwd(), {
       claudeDir: claudeTargets[0]?.dir,
-      codexHome: codexHomes[0] ?? null
+      codexHome: codexHomes[0] ?? null,
+      codexScope: scope
     });
     const personalWorkspaceId = await getPersonalWorkspaceId(cfg);
     if (!dryRun && !check) {
@@ -13873,31 +14452,31 @@ Examples:
 
 // src/commands/reset.ts
 import { homedir as homedir6 } from "os";
-import { join as join22 } from "path";
-import { existsSync as existsSync16, readFileSync as readFileSync18, rmSync as rmSync8 } from "fs";
+import { join as join23 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync19, rmSync as rmSync9 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
-var localSkillsDir = () => join22(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join22(homedir6(), ".claude", "skills");
-var localAgentsDir = () => join22(process.cwd(), ".claude", "agents");
-var globalAgentsDir = () => join22(homedir6(), ".claude", "agents");
+var localSkillsDir = () => join23(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join23(homedir6(), ".claude", "skills");
+var localAgentsDir = () => join23(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join23(homedir6(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join22(dir, SKILLS_LOCK2);
+  const lockPath = join23(dir, SKILLS_LOCK2);
   if (!existsSync16(lockPath)) return removed;
   try {
-    const lock = JSON.parse(readFileSync18(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync19(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join22(dir, name);
+        const p = join23(dir, name);
         if (existsSync16(p)) {
-          rmSync8(p, { recursive: true, force: true });
+          rmSync9(p, { recursive: true, force: true });
           removed.push(p);
         }
       }
     }
   } catch {
   }
-  rmSync8(lockPath, { force: true });
+  rmSync9(lockPath, { force: true });
   removed.push(lockPath);
   return removed;
 }
@@ -13934,19 +14513,19 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join22(process.cwd(), ".sechroom");
+    const stateDir = join23(process.cwd(), ".sechroom");
     if (existsSync16(stateDir)) {
-      rmSync8(stateDir, { recursive: true, force: true });
+      rmSync9(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join22(process.cwd(), ".sechroom.json");
+    const legacyCfg = join23(process.cwd(), ".sechroom.json");
     if (existsSync16(legacyCfg)) {
-      rmSync8(legacyCfg, { force: true });
+      rmSync9(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join22(process.cwd(), ".sem");
+    const legacySem = join23(process.cwd(), ".sem");
     if (existsSync16(legacySem)) {
-      rmSync8(legacySem, { force: true });
+      rmSync9(legacySem, { force: true });
       removed.push(legacySem);
     }
     removed.push(...removeMaterialisedSkills(localSkillsDir()));
@@ -13971,8 +14550,8 @@ function registerReset(program2) {
 }
 
 // src/commands/skills.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync18, statSync as statSync7, writeFileSync as writeFileSync17 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync18, statSync as statSync8, writeFileSync as writeFileSync17 } from "fs";
+import { join as join24 } from "path";
 function filenameFromDisposition(header) {
   if (!header) return void 0;
   const m = /filename\*?=(?:UTF-8'')?"?([^";]+)"?/i.exec(header);
@@ -13980,11 +14559,11 @@ function filenameFromDisposition(header) {
 }
 function resolveOutputPath(output, serverFilename) {
   const filename = serverFilename || "skills.zip";
-  if (!output) return join23(process.cwd(), filename);
-  const looksLikeDir = output.endsWith("/") || existsSync17(output) && statSync7(output).isDirectory();
+  if (!output) return join24(process.cwd(), filename);
+  const looksLikeDir = output.endsWith("/") || existsSync17(output) && statSync8(output).isDirectory();
   if (looksLikeDir) {
     mkdirSync18(output, { recursive: true });
-    return join23(output, filename);
+    return join24(output, filename);
   }
   return output;
 }
@@ -14030,6 +14609,7 @@ Examples:
   $ sechroom skills install --scope project  write them to ./.claude/skills instead
   $ sechroom skills list                     what's materialised on disk
   $ sechroom skills clean                    remove the materialised skill files
+  $ sechroom skills clean --prune-orphans    also sweep skills orphaned by an earlier rename
   $ sechroom skills preview --workspace wsp_abc        render a draft bundle from source (no install)
   $ sechroom skills package my-bundle                  download the installed bundle's skills as a zip
   $ sechroom skills package --from-source --workspace wsp_abc -o ./dist   zip a draft from source
@@ -14043,7 +14623,7 @@ clients select all; an unconfigured machine preserves the legacy Claude default.
   );
   skills.command("install").description("Materialise your installed skills to disk (the already-installed bundle \u2014 no server install)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--client <client>", "claude, codex, or all (default: configured/detected clients)").option("--dry-run", "print what would be written; write nothing").option("--json", "machine output").action((opts, cmd) => runInstall(SKILL_SPEC, cmd, opts));
   skills.command("list").description("List the skills materialised on disk (per resolved config dir)").option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--client <client>", "claude, codex, or all (default: configured/detected clients)").option("--json", "machine output").action((opts, cmd) => runList(SKILL_SPEC, cmd, opts));
-  skills.command("clean [slug]").description(`Remove skill files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--client <client>", "claude, codex, or all (default: configured/detected clients)").option("--json", "machine output").action((slugArg, opts, cmd) => runClean(SKILL_SPEC, cmd, opts, slugArg));
+  skills.command("clean [slug]").description(`Remove skill files materialised to disk (default ${DEFAULT_SKILLS_SLUG})`).option("--scope <scope>", "global (config dir / CLAUDE_CONFIG_DIR) or project (<cwd>/.claude) \u2014 default global").option("--local", "alias for --scope project").option("--client <client>", "claude, codex, or all (default: configured/detected clients)").option("--prune-orphans", "also remove sechroom-installed skill dirs that no lock entry claims (renamed/removed upstream)").option("--json", "machine output").action((slugArg, opts, cmd) => runClean(SKILL_SPEC, cmd, opts, slugArg));
   skills.command("preview").description("Render a workspace's draft bundle from source (no publish/install) and report the components").requiredOption("--workspace <id>", "workspace holding the draft bundle sources (wsp_\u2026)").option("--slug <slug>", "override the derived bundle slug").option("--title <title>", "override the derived bundle title").option("--version <version>", "override the derived bundle version").option("--default-install-parent <path>", "override the derived default install parent").option("--json", "machine output (the full RenderBundlePreviewResponse)").action(async (opts, cmd) => {
     const json = Boolean(opts.json) || Boolean(cmd.optsWithGlobals().json);
     const client = await makeClient(resolveConfig(cmd.optsWithGlobals()));
@@ -14190,8 +14770,8 @@ clients select all; an unconfigured machine preserves the legacy Claude default.
 
 // src/commands/sweep.ts
 import { existsSync as existsSync18 } from "fs";
-import { dirname as dirname16, join as join24, resolve as resolve8 } from "path";
-var DEFAULT_MANIFEST = join24(".sechroom", "repos.json");
+import { dirname as dirname16, join as join25, resolve as resolve8 } from "path";
+var DEFAULT_MANIFEST = join25(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
   if (!existsSync18(dir)) {
@@ -14695,7 +15275,7 @@ async function readStdin4() {
 function resolveVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync19(new URL("../package.json", import.meta.url), "utf8")
+      readFileSync20(new URL("../package.json", import.meta.url), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {
@@ -14859,6 +15439,7 @@ registerWorkPlan(program);
 registerExecutor(program);
 registerClose(program);
 registerFiling(program);
+registerGitHub(program);
 registerContinuity(program);
 registerCheckpoint(program);
 registerHook(program);