@smartergpt/lexrunner 1.3.0 → 1.4.0

package/dist/cli.js

@@ -455,7 +455,7 @@ import "dotenv/config";
 // package.json
 var package_default = {
   name: "@smartergpt/lexrunner",
-  version: "1.3.0",
+  version: "1.4.0",
   type: "module",
   engines: {
     node: ">=24"
@@ -548,6 +548,7 @@ var package_default = {
     "validate:manifests": "tsx scripts/validate-manifests.ts",
     "validate:build-artifacts": "tsx scripts/validate-build-artifacts.ts",
     "validate:package": "tsx scripts/validate-package-boundary.ts",
+    "check:install-scripts": "node scripts/check-install-script-policy.mjs",
     "test:package": "node scripts/smoke-packed-package.mjs",
     "docs:check": "node scripts/check-doc-links.mjs",
     "docs:surface": "node scripts/render-doc-surfaces.mjs",
@@ -584,7 +585,7 @@ var package_default = {
     "@modelcontextprotocol/sdk": "^1.18.2",
     "@octokit/auth-token": "^6.0.0",
     "@octokit/rest": "^22.0.0",
-    "@smartergpt/lex": "^3.0.1",
+    "@smartergpt/lex": "^4.0.0",
     "@types/babel__traverse": "^7.28.0",
     ajv: "^8.20.0",
     "better-sqlite3-multiple-ciphers": "^12.6.2",
@@ -621,6 +622,11 @@ var package_default = {
     "*.{json,md,yaml,yml}": [
       "prettier --check"
     ]
+  },
+  allowScripts: {
+    "better-sqlite3-multiple-ciphers@12.11.1": true,
+    "esbuild@0.28.1": true,
+    "@smartergpt/lex": false
   }
 };
 
@@ -18504,7 +18510,7 @@ function evaluateDirectoryIdentityBoundarySupport(facts) {
       supported: false,
       platform: facts.platform,
       pathComparison: facts.pathComparison,
-      reasonCode: "windows_requires_native_wsl_broker"
+      reasonCode: "windows_native_boundary_unavailable"
     };
   }
   if (facts.platform === "darwin") {
@@ -18797,6 +18803,8 @@ function boundaryPathError(label, error) {
 }
 function boundarySupportMessage(reasonCode) {
   switch (reasonCode) {
+    case "windows_native_boundary_unavailable":
+      return "Physical worktree containment requires the native Windows workspace boundary";
     case "case_insensitive_runtime":
       return "Physical worktree containment currently requires a case-sensitive Linux Git runtime";
     case "procfs_unavailable":
@@ -18883,14 +18891,14 @@ var AgentWorkContainmentCapabilityService = class {
       });
     }
     if (!support.supported) {
-      const brokerRequired = support.reasonCode === "windows_requires_native_wsl_broker";
+      const brokerRequired = support.reasonCode === "windows_native_boundary_unavailable";
       return capabilityResult({
         bindingDigest,
         support,
         paths: syntacticPaths,
         state: brokerRequired ? "broker_required" : "unsupported",
         reasonCode: support.reasonCode,
-        nextActions: brokerRequired ? ["provision_native_wsl_projection", "rerun_containment_preflight"] : ["select_native_case_sensitive_linux_runtime", "rerun_containment_preflight"]
+        nextActions: brokerRequired ? ["install_native_windows_boundary", "rerun_containment_preflight"] : ["select_native_case_sensitive_linux_runtime", "rerun_containment_preflight"]
       });
     }
     const repositoryRoot = evaluatePath(this.pathProbe(runtime.repositoryRoot, "repositoryRoot"));
@@ -18914,7 +18922,8 @@ var AgentWorkContainmentCapabilityService = class {
         paths,
         state: "broker_required",
         reasonCode: wslReason,
-        nextActions: ["provision_native_wsl_projection", "rerun_containment_preflight"]
+        nextActions: ["provision_native_wsl_projection", "rerun_containment_preflight"],
+        projectionRequired: true
       });
     }
     const pathFailure = firstPathFailure(repositoryRoot, repositoryGitDirectory, worktreeRoot);
@@ -18959,7 +18968,7 @@ function capabilityResult(input) {
     state: input.state,
     reasonCode: input.reasonCode,
     physicalContainmentAvailable: false,
-    projectionRequired: input.state === "broker_required",
+    projectionRequired: input.projectionRequired ?? false,
     runtime: {
       platform: publicPlatform(input.support.platform),
       pathComparison: input.support.pathComparison
@@ -19101,14 +19110,39 @@ function isJsonSafe(value, seen = /* @__PURE__ */ new Set(), depth = 0) {
 }
 
 // src/runs/agent-work-projection-lifecycle.ts
-import { z as z17 } from "zod";
+import { z as z19 } from "zod";
 
 // src/schemas/agent-work-projection.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
+
+// src/schemas/bounded-strict-object.ts
+import { z as z14 } from "zod";
+function boundedStrictObject(shape) {
+  const allowedKeys = new Set(Object.keys(shape));
+  return z14.preprocess((input) => {
+    if (input === null || typeof input !== "object" || Array.isArray(input)) {
+      return input;
+    }
+    try {
+      const prototype = Object.getPrototypeOf(input);
+      if (prototype !== Object.prototype && prototype !== null) {
+        return null;
+      }
+      for (const key of Reflect.ownKeys(input)) {
+        if (typeof key !== "string" || !allowedKeys.has(key)) {
+          return null;
+        }
+      }
+    } catch {
+      return null;
+    }
+    return input;
+  }, z14.object(shape));
+}
 
 // src/schemas/task-contract.ts
 import { createHash as createHash6 } from "crypto";
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 var TASK_CONTRACT_VERSION = "1.0.0";
 function computeCanonicalHash(obj) {
   const canonical = JSON.stringify(obj, sortedReplacer);
@@ -19130,111 +19164,111 @@ function sortedReplacer(_key, value) {
   }
   return value;
 }
-var DeterminismLevel2 = z14.enum(["D1", "D2", "D3"]);
-var ConfidenceLevel = z14.enum(["high", "medium", "low"]);
-var SourceOfTruthKind = z14.enum(["symbol", "file", "registry"]);
-var AssumptionType = z14.enum(["scope", "codebase", "env", "intent", "dependency", "test"]);
-var RepoRelativePath = z14.string().refine((p) => !p.startsWith("/"), {
+var DeterminismLevel2 = z15.enum(["D1", "D2", "D3"]);
+var ConfidenceLevel = z15.enum(["high", "medium", "low"]);
+var SourceOfTruthKind = z15.enum(["symbol", "file", "registry"]);
+var AssumptionType = z15.enum(["scope", "codebase", "env", "intent", "dependency", "test"]);
+var RepoRelativePath = z15.string().refine((p) => !p.startsWith("/"), {
   message: "Path must be repo-relative (no leading slash)"
 }).refine((p) => !p.includes(":\\") && !p.includes(":/"), {
   message: "Path must not be absolute (no drive letters)"
 }).refine((p) => !p.startsWith(".."), {
   message: "Path must not escape repo root"
 });
-var GlobPattern = z14.string().min(1);
-var SHA256Hash = z14.string().regex(/^sha256:[a-f0-9]{64}$/, "Must be sha256:<64-hex-chars>");
-var SHA256HashOrPlaceholder = z14.string().refine((h) => h.startsWith("sha256:"), {
+var GlobPattern = z15.string().min(1);
+var SHA256Hash = z15.string().regex(/^sha256:[a-f0-9]{64}$/, "Must be sha256:<64-hex-chars>");
+var SHA256HashOrPlaceholder = z15.string().refine((h) => h.startsWith("sha256:"), {
   message: "Must start with sha256:"
 });
-var RepoProvenance = z14.object({
+var RepoProvenance = z15.object({
   /** Repository identifier (owner/name) */
-  id: z14.string().regex(/^[^/]+\/[^/]+$/, "Must be owner/repo format"),
+  id: z15.string().regex(/^[^/]+\/[^/]+$/, "Must be owner/repo format"),
   /** Absolute path to repo root (engine-local, for resolution) */
-  root: z14.string(),
+  root: z15.string(),
   /** Pinned commit SHA */
-  commit_sha: z14.string().min(7)
+  commit_sha: z15.string().min(7)
 });
-var ScopeBoundary = z14.object({
+var ScopeBoundary = z15.object({
   /** Globs for files agent can read */
-  read_globs: z14.array(GlobPattern),
+  read_globs: z15.array(GlobPattern),
   /** Globs for files agent can modify */
-  write_globs: z14.array(GlobPattern),
+  write_globs: z15.array(GlobPattern),
   /** Globs for files explicitly denied (always applied) */
-  deny_globs: z14.array(GlobPattern),
+  deny_globs: z15.array(GlobPattern),
   /** Whether cross-repo operations are permitted */
-  cross_repo_allowed: z14.boolean()
+  cross_repo_allowed: z15.boolean()
 });
-var FailureEvidence = z14.object({
+var FailureEvidence = z15.object({
   /** Short error description */
-  message: z14.string(),
+  message: z15.string(),
   /** Repo-relative path to failed file */
   file_rel: RepoRelativePath,
   /** Line number if available */
-  line: z14.number().int().positive().optional(),
+  line: z15.number().int().positive().optional(),
   /** Actual test runner output snippet */
-  runner_output_snip: z14.string(),
+  runner_output_snip: z15.string(),
   /** Code context around failure */
-  excerpt: z14.string().optional()
+  excerpt: z15.string().optional()
 });
-var HintEdit = z14.object({
-  find: z14.string(),
-  replace: z14.string()
+var HintEdit = z15.object({
+  find: z15.string(),
+  replace: z15.string()
 });
-var Target = z14.object({
+var Target = z15.object({
   /** Repo-relative file path */
   path_rel: RepoRelativePath,
   /** Anchored code context (±N lines) */
-  hunk: z14.string(),
+  hunk: z15.string(),
   /** SHA256 of hunk for drift detection */
   hunk_sha256: SHA256HashOrPlaceholder,
   /** Optional find/replace suggestion */
   hint_edit: HintEdit.optional()
 });
-var IntroducingChange = z14.object({
-  commit_sha: z14.string().min(7),
-  diff_hunk: z14.string()
+var IntroducingChange = z15.object({
+  commit_sha: z15.string().min(7),
+  diff_hunk: z15.string()
 });
-var SourceOfTruth = z14.object({
+var SourceOfTruth = z15.object({
   /** Kind of source */
   kind: SourceOfTruthKind,
   /** Repo-relative path */
   path_rel: RepoRelativePath,
   /** Repository ID (defaults to snapshot repo if omitted) */
-  repo_id: z14.string().optional(),
+  repo_id: z15.string().optional(),
   /** Commit SHA (defaults to snapshot commit if omitted) */
-  commit_sha: z14.string().optional(),
+  commit_sha: z15.string().optional(),
   /** Canonical excerpt */
-  excerpt: z14.string(),
+  excerpt: z15.string(),
   /** Lexmap module ID if applicable */
-  lexmap_module_id: z14.string().optional(),
+  lexmap_module_id: z15.string().optional(),
   /** Change that introduced this */
   introducing_change: IntroducingChange.optional()
 });
-var VerificationExpectations = z14.object({
+var VerificationExpectations = z15.object({
   /** Command to run */
-  cmd: z14.string(),
+  cmd: z15.string(),
   /** Expected results */
-  expect: z14.object({
+  expect: z15.object({
     /** Expected exit code (usually 0) */
-    exit_code: z14.number().int(),
+    exit_code: z15.number().int(),
     /** Strings that must appear in output */
-    must_include: z14.array(z14.string()).optional(),
+    must_include: z15.array(z15.string()).optional(),
     /** Strings that must not appear */
-    must_not_include: z14.array(z14.string()).optional()
+    must_not_include: z15.array(z15.string()).optional()
   })
 });
-var Budget = z14.object({
+var Budget = z15.object({
   /** Token budget hint in bytes */
-  max_bytes: z14.number().int().positive().optional(),
+  max_bytes: z15.number().int().positive().optional(),
   /** Fields that were truncated (empty if none) */
-  truncated_fields: z14.array(z14.string())
+  truncated_fields: z15.array(z15.string())
 });
-var TaskSnapshot_v1 = z14.object({
+var TaskSnapshot_v1 = z15.object({
   // Schema version
-  schema_version: z14.literal(TASK_CONTRACT_VERSION),
+  schema_version: z15.literal(TASK_CONTRACT_VERSION),
   // Identity
-  task_id: z14.string().min(1),
-  procedure: z14.string().min(1),
+  task_id: z15.string().min(1),
+  procedure: z15.string().min(1),
   determinism: DeterminismLevel2,
   snapshot_hash: SHA256HashOrPlaceholder,
   // Provenance (MUST)
@@ -19244,9 +19278,9 @@ var TaskSnapshot_v1 = z14.object({
   // Failure evidence (MUST)
   failure: FailureEvidence,
   // Invariants (SHOULD) - anti-brittleness constraints
-  invariants: z14.array(z14.string()).optional(),
+  invariants: z15.array(z15.string()).optional(),
   // Targets (MUST, array)
-  targets: z14.array(Target).min(1),
+  targets: z15.array(Target).min(1),
   // Source of truth (SHOULD)
   source_of_truth: SourceOfTruth.optional(),
   // Verification expectations (MUST)
@@ -19254,112 +19288,112 @@ var TaskSnapshot_v1 = z14.object({
   // Budget/truncation (MUST)
   budget: Budget,
   // Output contract
-  receipt_schema_id: z14.string()
+  receipt_schema_id: z15.string()
 });
-var StructuredAssumption = z14.object({
+var StructuredAssumption = z15.object({
   /** Type of assumption */
   type: AssumptionType,
   /** Assumption text */
-  text: z14.string(),
+  text: z15.string(),
   /** Whether it was validated */
-  validated: z14.boolean().optional(),
+  validated: z15.boolean().optional(),
   /** Evidence supporting validation */
-  evidence: z14.string().optional()
+  evidence: z15.string().optional()
 });
-var AgentClaims = z14.object({
+var AgentClaims = z15.object({
   /** Whether the task succeeded */
-  success: z14.boolean(),
+  success: z15.boolean(),
   /** Unified diff patch */
-  patch: z14.string().optional(),
+  patch: z15.string().optional(),
   /** Files touched (repo-relative) */
-  files_touched: z14.array(RepoRelativePath),
+  files_touched: z15.array(RepoRelativePath),
   /** Rationale for the fix */
-  rationale: z14.string(),
+  rationale: z15.string(),
   /** Confidence level */
   confidence: ConfidenceLevel,
   /** Which invariants were respected */
-  invariants_respected: z14.array(z14.string()).optional(),
+  invariants_respected: z15.array(z15.string()).optional(),
   /** Structured assumptions made */
-  assumptions_made: z14.array(StructuredAssumption)
+  assumptions_made: z15.array(StructuredAssumption)
 });
-var SearchActivity = z14.object({
+var SearchActivity = z15.object({
   /** Search query */
-  query: z14.string(),
+  query: z15.string(),
   /** Search method used */
-  method: z14.string().optional(),
+  method: z15.string().optional(),
   /** Roots searched (repo-relative) */
-  roots: z14.array(z14.string()),
+  roots: z15.array(z15.string()),
   /** Number of results found */
-  results_count: z14.number().int().nonnegative().optional(),
+  results_count: z15.number().int().nonnegative().optional(),
   /** Time taken in milliseconds */
-  time_ms: z14.number().nonnegative().optional()
+  time_ms: z15.number().nonnegative().optional()
 });
-var TokenUsage = z14.object({
-  input: z14.number().int().nonnegative(),
-  output: z14.number().int().nonnegative(),
-  total: z14.number().int().nonnegative()
+var TokenUsage = z15.object({
+  input: z15.number().int().nonnegative(),
+  output: z15.number().int().nonnegative(),
+  total: z15.number().int().nonnegative()
 });
-var CostTracking = z14.object({
+var CostTracking = z15.object({
   /** Token usage breakdown */
   token_usage: TokenUsage.optional(),
   /** Number of tool calls made */
-  tool_calls_count: z14.number().int().nonnegative().optional(),
+  tool_calls_count: z15.number().int().nonnegative().optional(),
   /** Elapsed time in milliseconds */
-  elapsed_ms: z14.number().nonnegative().optional()
+  elapsed_ms: z15.number().nonnegative().optional()
 });
-var AgentVerification = z14.object({
+var AgentVerification = z15.object({
   /** Whether verification command was run */
-  cmd_ran: z14.boolean(),
+  cmd_ran: z15.boolean(),
   /** Exit code if run */
-  exit_code: z14.number().int().optional(),
+  exit_code: z15.number().int().optional(),
   /** Output snippet */
-  output_snip: z14.string().optional()
+  output_snip: z15.string().optional()
 });
-var TaskReceipt_v1 = z14.object({
+var TaskReceipt_v1 = z15.object({
   // Schema version
-  schema_version: z14.literal(TASK_CONTRACT_VERSION),
+  schema_version: z15.literal(TASK_CONTRACT_VERSION),
   // Identity (echo from snapshot)
-  task_id: z14.string().min(1),
+  task_id: z15.string().min(1),
   snapshot_hash: SHA256HashOrPlaceholder,
   // Claims (what agent says it did)
   claims: AgentClaims,
   // Search activity (if agent searched)
-  search_activity: z14.array(SearchActivity),
+  search_activity: z15.array(SearchActivity),
   // Cost tracking
   cost: CostTracking,
   // Agent's verification attempt (still a claim)
   agent_verification: AgentVerification.optional(),
   // Blockers (if not successful)
-  blockers: z14.array(z14.string())
+  blockers: z15.array(z15.string())
 });
-var DetectedFailure = z14.object({
-  type: z14.string(),
-  message: z14.string(),
-  file: z14.string().optional(),
-  line: z14.number().int().positive().optional()
+var DetectedFailure = z15.object({
+  type: z15.string(),
+  message: z15.string(),
+  file: z15.string().optional(),
+  line: z15.number().int().positive().optional()
 });
-var EngineVerification_v1 = z14.object({
+var EngineVerification_v1 = z15.object({
   // Identity
-  task_id: z14.string().min(1),
-  timestamp: z14.string().datetime(),
+  task_id: z15.string().min(1),
+  timestamp: z15.string().datetime(),
   // Hash binding (audit trail)
   snapshot_hash: SHA256HashOrPlaceholder,
   receipt_hash: SHA256HashOrPlaceholder,
   // Verification result
-  verified: z14.boolean(),
+  verified: z15.boolean(),
   // What engine ran
-  cmd_ran: z14.string(),
-  exit_code: z14.number().int(),
-  stdout_snip: z14.string(),
-  stderr_snip: z14.string(),
+  cmd_ran: z15.string(),
+  exit_code: z15.number().int(),
+  stdout_snip: z15.string(),
+  stderr_snip: z15.string(),
   // Patch verification
   patch_hash: SHA256HashOrPlaceholder.optional(),
-  patch_applied: z14.boolean(),
+  patch_applied: z15.boolean(),
   // Comparison with agent claim
-  agent_claimed: z14.boolean(),
-  trust_gap: z14.boolean(),
+  agent_claimed: z15.boolean(),
+  trust_gap: z15.boolean(),
   // Failures detected
-  failures: z14.array(DetectedFailure)
+  failures: z15.array(DetectedFailure)
 });
 
 // src/schemas/agent-work-projection.ts
@@ -19370,15 +19404,15 @@ var MAX_PATH_LENGTH = 16384;
 var MAX_RUNTIME_LENGTH = 512;
 var MAX_TIMESTAMP_LENGTH = 64;
 var MAX_DECIMAL_IDENTITY_LENGTH = 32;
-var BoundedIdentifier = z15.string().min(1).max(MAX_IDENTIFIER_LENGTH).refine((value) => !value.includes("\0"), { message: "must not contain NUL bytes" });
-var BoundedRuntime = z15.string().min(1).max(MAX_RUNTIME_LENGTH).refine((value) => !value.includes("\0"), { message: "must not contain NUL bytes" });
-var Timestamp = z15.string().max(MAX_TIMESTAMP_LENGTH).datetime({ offset: true });
-var CanonicalGitObjectId = z15.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/, "Must be a lowercase full Git object ID");
-var WindowsAbsolutePath = z15.string().min(3).max(MAX_PATH_LENGTH).refine((value) => !value.includes("\0"), { message: "must not contain NUL bytes" }).refine(
+var BoundedIdentifier = z16.string().min(1).max(MAX_IDENTIFIER_LENGTH).refine((value) => !value.includes("\0"), { message: "must not contain NUL bytes" });
+var BoundedRuntime = z16.string().min(1).max(MAX_RUNTIME_LENGTH).refine((value) => !value.includes("\0"), { message: "must not contain NUL bytes" });
+var Timestamp = z16.string().max(MAX_TIMESTAMP_LENGTH).datetime({ offset: true });
+var CanonicalGitObjectId = z16.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/, "Must be a lowercase full Git object ID");
+var WindowsAbsolutePath = z16.string().min(3).max(MAX_PATH_LENGTH).refine((value) => !value.includes("\0"), { message: "must not contain NUL bytes" }).refine(
   (value) => /^[a-z]:[\\/]/iu.test(value) || /^\\\\[^\\/\0]+[\\/][^\\/\0]+(?:[\\/]|$)/u.test(value),
   { message: "must be an absolute Windows drive or UNC path" }
 );
-var LinuxAbsolutePath = z15.string().min(1).max(MAX_PATH_LENGTH).refine((value) => !value.includes("\0"), { message: "must not contain NUL bytes" }).refine((value) => value.startsWith("/") && !value.startsWith("//"), {
+var LinuxAbsolutePath = z16.string().min(1).max(MAX_PATH_LENGTH).refine((value) => !value.includes("\0"), { message: "must not contain NUL bytes" }).refine((value) => value.startsWith("/") && !value.startsWith("//"), {
   message: "must be an absolute native Linux path"
 }).refine((value) => !value.includes("\\"), {
   message: "must use native Linux path separators"
@@ -19389,35 +19423,13 @@ var LinuxAbsolutePath = z15.string().min(1).max(MAX_PATH_LENGTH).refine((value)
 }).refine((value) => value === "/" || !value.endsWith("/"), {
   message: "must not contain a trailing path separator"
 });
-var DecimalIdentity = z15.string().max(MAX_DECIMAL_IDENTITY_LENGTH).regex(/^(?:0|[1-9][0-9]*)$/, "must be a decimal integer");
-function boundedStrictObject(shape) {
-  const allowedKeys = new Set(Object.keys(shape));
-  return z15.preprocess((input) => {
-    if (input === null || typeof input !== "object" || Array.isArray(input)) {
-      return input;
-    }
-    try {
-      const prototype = Object.getPrototypeOf(input);
-      if (prototype !== Object.prototype && prototype !== null) {
-        return null;
-      }
-      for (const key of Reflect.ownKeys(input)) {
-        if (typeof key !== "string" || !allowedKeys.has(key)) {
-          return null;
-        }
-      }
-    } catch {
-      return null;
-    }
-    return input;
-  }, z15.object(shape));
-}
+var DecimalIdentity = z16.string().max(MAX_DECIMAL_IDENTITY_LENGTH).regex(/^(?:0|[1-9][0-9]*)$/, "must be a decimal integer");
 var NativeDirectoryIdentityClaim_v1 = boundedStrictObject({
   device: DecimalIdentity,
   inode: DecimalIdentity
 });
 var ProjectionRequestShape = {
-  schema_version: z15.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
+  schema_version: z16.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
   request_id: BoundedIdentifier,
   repository: boundedStrictObject({
     id: BoundedIdentifier,
@@ -19429,8 +19441,8 @@ var ProjectionRequestShape = {
     wsl_distribution: BoundedRuntime,
     wsl_git_runtime: BoundedRuntime,
     wsl_repository_path: LinuxAbsolutePath,
-    head_policy: z15.enum(["observe", "require_base"]),
-    dirty_policy: z15.enum(["require_clean", "committed_base_only"])
+    head_policy: z16.enum(["observe", "require_base"]),
+    dirty_policy: z16.enum(["require_clean", "committed_base_only"])
   }),
   native: boundedStrictObject({
     host_id: BoundedIdentifier,
@@ -19456,7 +19468,7 @@ var NativeWslProjectionRequest_v1 = boundedStrictObject({
   );
 });
 var NativeWslProjectionRequestJsonSchema = closeJsonSchemaObjects(
-  z15.toJSONSchema(NativeWslProjectionRequest_v1, {
+  z16.toJSONSchema(NativeWslProjectionRequest_v1, {
     target: "draft-7"
   })
 );
@@ -19468,14 +19480,14 @@ function createNativeWslProjectionRequest(input) {
   });
 }
 var SourceObservationShape = {
-  schema_version: z15.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
+  schema_version: z16.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
   repository_id: BoundedIdentifier,
   request_digest: SHA256Hash,
   observed_remote_hash: SHA256Hash,
   source_head_sha: CanonicalGitObjectId,
   requested_object_sha: CanonicalGitObjectId,
-  requested_object_type: z15.enum(["commit", "missing", "other"]),
-  cleanliness: z15.enum(["clean", "dirty", "unknown"]),
+  requested_object_type: z16.enum(["commit", "missing", "other"]),
+  cleanliness: z16.enum(["clean", "dirty", "unknown"]),
   observed_at: Timestamp
 };
 var SourceObservationBody = boundedStrictObject(SourceObservationShape);
@@ -19501,22 +19513,22 @@ function createNativeWslSourceObservation(input) {
 var DeclaredWindowsRoot = boundedStrictObject({
   runtime_id: BoundedRuntime,
   path: WindowsAbsolutePath,
-  verification: z15.literal("declared")
+  verification: z16.literal("declared")
 });
 var ObservedWslRoot = boundedStrictObject({
   runtime_id: BoundedRuntime,
   path: LinuxAbsolutePath,
-  verification: z15.literal("git_observed"),
+  verification: z16.literal("git_observed"),
   observation_digest: SHA256Hash
 });
 var VerifiedNativeRoot = boundedStrictObject({
   runtime_id: BoundedRuntime,
   path: LinuxAbsolutePath,
-  verification: z15.literal("directory_identity"),
+  verification: z16.literal("directory_identity"),
   directory_identity: NativeDirectoryIdentityClaim_v1
 });
 var ProjectionPathMappingShape = {
-  schema_version: z15.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
+  schema_version: z16.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
   projection_id: BoundedIdentifier,
   repository_id: BoundedIdentifier,
   base_sha: CanonicalGitObjectId,
@@ -19551,7 +19563,7 @@ function createNativeWslProjectionPathMapping(input) {
   });
 }
 var ProjectionManifestShape = {
-  schema_version: z15.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
+  schema_version: z16.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
   projection_id: BoundedIdentifier,
   repository_id: BoundedIdentifier,
   base_sha: CanonicalGitObjectId,
@@ -19681,7 +19693,7 @@ function requireValidProjectionManifest(manifest, context) {
   );
 }
 var ExecutionPathMappingShape = {
-  schema_version: z15.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
+  schema_version: z16.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
   projection_id: BoundedIdentifier,
   repository_id: BoundedIdentifier,
   base_sha: CanonicalGitObjectId,
@@ -19720,8 +19732,8 @@ function createNativeWslExecutionPathMapping(input) {
   });
 }
 var NativeExecutionPathMappingShape = {
-  schema_version: z15.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
-  mapping_kind: z15.literal("native_linux"),
+  schema_version: z16.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
+  mapping_kind: z16.literal("native_linux"),
   repository_id: BoundedIdentifier,
   base_sha: CanonicalGitObjectId,
   native_host_id: BoundedIdentifier,
@@ -19754,7 +19766,7 @@ function createNativeExecutionPathMapping(input) {
     mapping_digest: projectionHash("native-execution-path-mapping", body)
   });
 }
-var AgentExecutionPathMapping_v1 = z15.union([
+var AgentExecutionPathMapping_v1 = z16.union([
   NativeWslExecutionPathMapping_v1,
   NativeExecutionPathMapping_v1
 ]);
@@ -19789,8 +19801,8 @@ function validateAgentExecutionPathBinding(mappings, context) {
     mappingDigest: mapping.mapping_digest
   };
 }
-var NativeWslProjectionOutcome = z15.enum(["prepared", "reused", "rejected", "quarantined"]);
-var NativeWslProjectionReasonCode = z15.enum([
+var NativeWslProjectionOutcome = z16.enum(["prepared", "reused", "rejected", "quarantined"]);
+var NativeWslProjectionReasonCode = z16.enum([
   "projection_prepared",
   "projection_reused",
   "source_dirty",
@@ -19809,7 +19821,7 @@ var NativeWslProjectionReasonCode = z15.enum([
   "operation_failed"
 ]);
 var ProjectionReceiptShape = {
-  schema_version: z15.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
+  schema_version: z16.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
   request_id: BoundedIdentifier,
   request_digest: SHA256Hash,
   outcome: NativeWslProjectionOutcome,
@@ -19842,7 +19854,7 @@ function createNativeWslProjectionReceipt(input) {
   });
 }
 var ProjectionSelectionShape = {
-  schema_version: z15.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
+  schema_version: z16.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
   manifest_digest: SHA256Hash,
   receipt: NativeWslProjectionReceipt_v1,
   source_observation: NativeWslSourceObservation_v1
@@ -19947,7 +19959,7 @@ function requireValidProjectionSelection(selection, context) {
     );
   }
 }
-var NativeWslProjectionInventoryState = z15.enum([
+var NativeWslProjectionInventoryState = z16.enum([
   "absent",
   "ready",
   "staging",
@@ -19956,7 +19968,7 @@ var NativeWslProjectionInventoryState = z15.enum([
   "interrupted",
   "conflicting"
 ]);
-var NativeWslProjectionPlanAction = z15.enum([
+var NativeWslProjectionPlanAction = z16.enum([
   "prepare_staging",
   "reuse_ready",
   "wait_for_same_request",
@@ -19964,7 +19976,7 @@ var NativeWslProjectionPlanAction = z15.enum([
   "cleanup_quarantine_then_prepare",
   "refuse_conflict"
 ]);
-var NativeWslProjectionPlanReason = z15.enum([
+var NativeWslProjectionPlanReason = z16.enum([
   "projection_absent",
   "projection_exact_match",
   "projection_staging_same_request",
@@ -20183,68 +20195,46 @@ import { lstat, open as open2, readFile as readFile4, readdir, rename, rmdir, un
 import path34 from "path";
 
 // src/runs/agent-work-projection-planner.ts
-import { z as z16 } from "zod";
-var ProjectionId = z16.string().min(1).max(4096);
-var Timestamp2 = z16.string().max(64).datetime({ offset: true });
-function boundedStrictObject2(shape) {
-  const allowedKeys = new Set(Object.keys(shape));
-  return z16.preprocess((input) => {
-    if (input === null || typeof input !== "object" || Array.isArray(input)) {
-      return input;
-    }
-    try {
-      const prototype = Object.getPrototypeOf(input);
-      if (prototype !== Object.prototype && prototype !== null) {
-        return null;
-      }
-      for (const key of Reflect.ownKeys(input)) {
-        if (typeof key !== "string" || !allowedKeys.has(key)) {
-          return null;
-        }
-      }
-    } catch {
-      return null;
-    }
-    return input;
-  }, z16.object(shape));
-}
-var NativeWslProjectionInventoryObservation_v1 = z16.union([
-  boundedStrictObject2({ state: z16.literal("absent") }),
-  boundedStrictObject2({
-    state: z16.literal("ready"),
+import { z as z17 } from "zod";
+var ProjectionId = z17.string().min(1).max(4096);
+var Timestamp2 = z17.string().max(64).datetime({ offset: true });
+var NativeWslProjectionInventoryObservation_v1 = z17.union([
+  boundedStrictObject({ state: z17.literal("absent") }),
+  boundedStrictObject({
+    state: z17.literal("ready"),
     manifest: NativeWslProjectionManifest_v1
   }),
-  boundedStrictObject2({
-    state: z16.literal("staging"),
+  boundedStrictObject({
+    state: z17.literal("staging"),
     projection_id: ProjectionId,
     request_digest: SHA256Hash,
     started_at: Timestamp2
   }),
-  boundedStrictObject2({
-    state: z16.literal("quarantined"),
+  boundedStrictObject({
+    state: z17.literal("quarantined"),
     projection_id: ProjectionId.optional(),
     request_digest: SHA256Hash.optional(),
     quarantined_at: Timestamp2
   }),
-  boundedStrictObject2({
-    state: z16.literal("invalid"),
+  boundedStrictObject({
+    state: z17.literal("invalid"),
     projection_id: ProjectionId.optional(),
     request_digest: SHA256Hash.optional()
   }),
-  boundedStrictObject2({
-    state: z16.literal("interrupted"),
+  boundedStrictObject({
+    state: z17.literal("interrupted"),
     projection_id: ProjectionId,
     request_digest: SHA256Hash,
     started_at: Timestamp2
   }),
-  boundedStrictObject2({
-    state: z16.literal("conflicting"),
+  boundedStrictObject({
+    state: z17.literal("conflicting"),
     projection_id: ProjectionId,
     request_digest: SHA256Hash.optional(),
     observed_at: Timestamp2
   })
 ]);
-var NativeWslProjectionNextAction = z16.enum([
+var NativeWslProjectionNextAction = z17.enum([
   "prepare_projection_staging",
   "reuse_projection",
   "retry_after_active_request",
@@ -20252,17 +20242,17 @@ var NativeWslProjectionNextAction = z16.enum([
   "cleanup_quarantined_projection",
   "stop_and_report_conflict"
 ]);
-var NativeWslProjectionPlan_v1 = boundedStrictObject2({
-  schema_version: z16.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
+var NativeWslProjectionPlan_v1 = boundedStrictObject({
+  schema_version: z17.literal(NATIVE_WSL_PROJECTION_CONTRACT_VERSION),
   projection_id: ProjectionId,
   request_digest: SHA256Hash,
   inventory_state: NativeWslProjectionInventoryState,
   action: NativeWslProjectionPlanAction,
   reason: NativeWslProjectionPlanReason,
-  selection_allowed: z16.boolean(),
-  mutation_required: z16.boolean(),
+  selection_allowed: z17.boolean(),
+  mutation_required: z17.boolean(),
   selected_manifest_digest: SHA256Hash.optional(),
-  next_actions: z16.array(NativeWslProjectionNextAction).min(1).max(2)
+  next_actions: z17.array(NativeWslProjectionNextAction).min(1).max(2)
 }).superRefine((plan, context) => {
   const reusesReady = plan.action === "reuse_ready";
   const mutates = plan.action === "prepare_staging" || plan.action === "quarantine_then_prepare" || plan.action === "cleanup_quarantine_then_prepare";
@@ -20568,8 +20558,6 @@ function boundOutput(value, maxBytes) {
 }
 
 // src/workspaces/node-git-worktree-broker.ts
-import { constants as constants2 } from "fs";
-import { open } from "fs/promises";
 import path33 from "path";
 
 // src/workspaces/git-worktree-porcelain.ts
@@ -20703,6 +20691,999 @@ function setOnce(record, key, value) {
   record[key] = value;
 }
 
+// src/workspaces/workspace-boundary-resolver.ts
+import { randomUUID as randomUUID4 } from "crypto";
+import { arch, platform as platform2 } from "os";
+
+// src/workspaces/linux-workspace-boundary.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { constants as constants2 } from "fs";
+import { open } from "fs/promises";
+
+// src/workspaces/workspace-boundary.ts
+import { z as z18 } from "zod";
+var WORKSPACE_BOUNDARY_CONTRACT_VERSION = "1.0.0";
+var MAX_IDENTIFIER_LENGTH2 = 4096;
+var MAX_PATH_LENGTH2 = 32768;
+var MAX_MESSAGE_LENGTH = 4096;
+var BoundedIdentifier2 = z18.string().min(1).max(MAX_IDENTIFIER_LENGTH2).refine((value) => !value.includes("\0"), { message: "must not contain NUL bytes" });
+var BoundedPath = z18.string().min(1).max(MAX_PATH_LENGTH2).refine((value) => !value.includes("\0"), { message: "must not contain NUL bytes" });
+var Timestamp3 = z18.string().max(64).datetime({ offset: true });
+var DecimalIdentity2 = z18.string().max(32).regex(/^(?:0|[1-9][0-9]*)$/u, "must be a decimal integer");
+var HexIdentity = z18.string().min(1).max(64).regex(/^[a-f0-9]+$/u, "must be lowercase hexadecimal");
+var WorkspaceBoundaryBackendKind = z18.enum([
+  "linux-native",
+  "windows-native",
+  "native-wsl-projection"
+]);
+var WorkspaceBoundarySelectionRequest_v1 = z18.union([
+  boundedStrictObject({ mode: z18.literal("native") }),
+  boundedStrictObject({
+    mode: z18.literal("explicit_projection"),
+    profile_id: BoundedIdentifier2
+  })
+]);
+var BoundaryClaims = boundedStrictObject({
+  held_directory_identity: z18.boolean(),
+  no_follow_open: z18.boolean(),
+  final_path_from_handle: z18.boolean(),
+  held_ancestor_chain: z18.boolean(),
+  replacement_resistant_process_binding: z18.boolean(),
+  rename_delete_exclusion: z18.boolean(),
+  durable_directory_mutation: z18.boolean()
+});
+var InProcessBackend = boundedStrictObject({
+  transport: z18.literal("in_process"),
+  implementation: BoundedIdentifier2,
+  implementation_version: BoundedIdentifier2
+});
+var NativeHelperBackend = boundedStrictObject({
+  transport: z18.literal("native_helper"),
+  implementation: BoundedIdentifier2,
+  implementation_version: BoundedIdentifier2,
+  protocol_version: BoundedIdentifier2,
+  artifact_digest: SHA256Hash.optional(),
+  signature: z18.union([
+    boundedStrictObject({
+      status: z18.literal("verified"),
+      signer_identity: BoundedIdentifier2
+    }),
+    boundedStrictObject({
+      status: z18.literal("development_unverified")
+    }),
+    boundedStrictObject({
+      status: z18.literal("not_available")
+    })
+  ])
+});
+var CapabilityDecisionShape = {
+  schema_version: z18.literal(WORKSPACE_BOUNDARY_CONTRACT_VERSION),
+  decision_id: BoundedIdentifier2,
+  selection: WorkspaceBoundarySelectionRequest_v1,
+  backend_kind: WorkspaceBoundaryBackendKind,
+  state: z18.enum(["ready", "unavailable", "unsupported"]),
+  reason_code: z18.enum([
+    "native_backend_ready",
+    "explicit_projection_ready",
+    "unsupported_host",
+    "unsupported_filesystem",
+    "backend_unavailable",
+    "helper_missing",
+    "helper_integrity_failure",
+    "helper_protocol_mismatch",
+    "helper_signature_unverified",
+    "projection_not_requested",
+    "projection_unavailable"
+  ]),
+  host: boundedStrictObject({
+    platform: z18.enum(["linux", "windows", "other"]),
+    architecture: BoundedIdentifier2,
+    path_comparison: z18.enum(["case-sensitive", "case-insensitive"])
+  }),
+  backend: z18.union([InProcessBackend, NativeHelperBackend]),
+  claims: BoundaryClaims,
+  observed_at: Timestamp3
+};
+var CapabilityDecisionBody = boundedStrictObject(CapabilityDecisionShape).superRefine(
+  requireValidCapabilityDecision
+);
+var WorkspaceBoundaryCapabilityDecision_v1 = boundedStrictObject({
+  ...CapabilityDecisionShape,
+  decision_digest: SHA256Hash
+}).superRefine(requireValidCapabilityDecision).superRefine((decision, context) => {
+  const { decision_digest: _digest, ...body } = decision;
+  requireDigest2(
+    decision.decision_digest,
+    boundaryHash("capability-decision", body),
+    "decision_digest",
+    context
+  );
+});
+function createWorkspaceBoundaryCapabilityDecision(input) {
+  const body = CapabilityDecisionBody.parse(input);
+  return WorkspaceBoundaryCapabilityDecision_v1.parse({
+    ...body,
+    decision_digest: boundaryHash("capability-decision", body)
+  });
+}
+var DirectoryIdentityCommon = {
+  schema_version: z18.literal(WORKSPACE_BOUNDARY_CONTRACT_VERSION),
+  backend_kind: WorkspaceBoundaryBackendKind,
+  canonical_path: BoundedPath,
+  path_comparison: z18.enum(["case-sensitive", "case-insensitive"])
+};
+var LinuxDirectoryIdentityShape = {
+  ...DirectoryIdentityCommon,
+  identity_kind: z18.literal("linux-device-inode"),
+  device: DecimalIdentity2,
+  inode: DecimalIdentity2
+};
+var WindowsDirectoryIdentityShape = {
+  ...DirectoryIdentityCommon,
+  identity_kind: z18.literal("windows-volume-file-id"),
+  volume_serial_number: HexIdentity,
+  file_id: HexIdentity
+};
+var LinuxDirectoryIdentityBody = boundedStrictObject(LinuxDirectoryIdentityShape).superRefine(
+  (identity, context) => {
+    if (identity.backend_kind === "windows-native") {
+      addIssue(context, ["backend_kind"], "Windows native identities require a Windows file ID");
+    }
+    if (identity.path_comparison !== "case-sensitive") {
+      addIssue(context, ["path_comparison"], "Linux directory identities are case-sensitive");
+    }
+    if (!identity.canonical_path.startsWith("/") || identity.canonical_path.startsWith("//")) {
+      addIssue(context, ["canonical_path"], "Linux identities require an absolute native path");
+    }
+  }
+);
+var WindowsDirectoryIdentityBody = boundedStrictObject(WindowsDirectoryIdentityShape).superRefine(
+  (identity, context) => {
+    if (identity.backend_kind !== "windows-native") {
+      addIssue(context, ["backend_kind"], "Windows file IDs require the Windows native backend");
+    }
+    if (identity.path_comparison !== "case-insensitive") {
+      addIssue(context, ["path_comparison"], "Windows directory identities are case-insensitive");
+    }
+    if (!isWindowsAbsolutePath(identity.canonical_path)) {
+      addIssue(context, ["canonical_path"], "Windows identities require an absolute native path");
+    }
+  }
+);
+var WorkspaceBoundaryDirectoryIdentity_v1 = z18.union([
+  boundedStrictObject({
+    ...LinuxDirectoryIdentityShape,
+    identity_digest: SHA256Hash
+  }).superRefine((identity, context) => {
+    const { identity_digest: _digest, ...body } = identity;
+    const parsed = LinuxDirectoryIdentityBody.safeParse(body);
+    copyIssues(parsed, context);
+    requireDigest2(
+      identity.identity_digest,
+      boundaryHash("directory-identity", body),
+      "identity_digest",
+      context
+    );
+  }),
+  boundedStrictObject({
+    ...WindowsDirectoryIdentityShape,
+    identity_digest: SHA256Hash
+  }).superRefine((identity, context) => {
+    const { identity_digest: _digest, ...body } = identity;
+    const parsed = WindowsDirectoryIdentityBody.safeParse(body);
+    copyIssues(parsed, context);
+    requireDigest2(
+      identity.identity_digest,
+      boundaryHash("directory-identity", body),
+      "identity_digest",
+      context
+    );
+  })
+]);
+function createWorkspaceBoundaryDirectoryIdentity(input) {
+  const body = input.identity_kind === "linux-device-inode" ? LinuxDirectoryIdentityBody.parse(input) : WindowsDirectoryIdentityBody.parse(input);
+  return WorkspaceBoundaryDirectoryIdentity_v1.parse({
+    ...body,
+    identity_digest: boundaryHash("directory-identity", body)
+  });
+}
+var WorkspaceBoundaryError_v1 = boundedStrictObject({
+  schema_version: z18.literal(WORKSPACE_BOUNDARY_CONTRACT_VERSION),
+  code: z18.enum([
+    "unsupported_host",
+    "unsupported_filesystem",
+    "backend_unavailable",
+    "helper_integrity_failure",
+    "helper_protocol_mismatch",
+    "invalid_path",
+    "reparse_point_rejected",
+    "identity_changed",
+    "lease_stale",
+    "containment_violation",
+    "sharing_violation",
+    "operation_failed",
+    "durability_indeterminate"
+  ]),
+  message: z18.string().min(1).max(MAX_MESSAGE_LENGTH),
+  retryable: z18.boolean(),
+  effect_state: z18.enum(["no_effect", "effect_recorded", "effect_unknown"]),
+  operation_id: BoundedIdentifier2.optional()
+});
+var LeaseReceiptShape = {
+  schema_version: z18.literal(WORKSPACE_BOUNDARY_CONTRACT_VERSION),
+  lease_id: BoundedIdentifier2,
+  orchestration_lease_id: BoundedIdentifier2,
+  orchestration_lease_revision: z18.number().int().nonnegative(),
+  owner_id: BoundedIdentifier2,
+  backend_kind: WorkspaceBoundaryBackendKind,
+  capability_decision_digest: SHA256Hash,
+  root_identity_digests: z18.array(SHA256Hash).min(1).max(16),
+  phase: z18.enum(["acquired", "released", "expired", "reconciled"]),
+  observed_at: Timestamp3
+};
+var LeaseReceiptBody = boundedStrictObject(LeaseReceiptShape);
+var WorkspaceBoundaryLeaseReceipt_v1 = boundedStrictObject({
+  ...LeaseReceiptShape,
+  receipt_digest: SHA256Hash
+}).superRefine((receipt, context) => {
+  const { receipt_digest: _digest, ...body } = receipt;
+  requireDigest2(
+    receipt.receipt_digest,
+    boundaryHash("lease-receipt", body),
+    "receipt_digest",
+    context
+  );
+});
+function createWorkspaceBoundaryLeaseReceipt(input) {
+  const parsed = LeaseReceiptBody.parse(input);
+  const body = LeaseReceiptBody.parse({
+    ...parsed,
+    root_identity_digests: canonicalDigestSet(parsed.root_identity_digests)
+  });
+  return WorkspaceBoundaryLeaseReceipt_v1.parse({
+    ...body,
+    receipt_digest: boundaryHash("lease-receipt", body)
+  });
+}
+var WorkspaceBoundaryOperationKind = z18.enum([
+  "capture-root",
+  "open-child",
+  "create-child",
+  "assert-current",
+  "read-owned-file",
+  "write-owned-file",
+  "rename-owned",
+  "remove-owned",
+  "sync-directory",
+  "spawn-process"
+]);
+var OperationReceiptShape = {
+  schema_version: z18.literal(WORKSPACE_BOUNDARY_CONTRACT_VERSION),
+  operation_id: BoundedIdentifier2,
+  lease_id: BoundedIdentifier2,
+  backend_kind: WorkspaceBoundaryBackendKind,
+  operation: WorkspaceBoundaryOperationKind,
+  mutation: z18.boolean(),
+  outcome: z18.enum(["completed", "rejected", "indeterminate"]),
+  durability: z18.enum(["not_applicable", "not_requested", "committed", "indeterminate"]),
+  identity_digests: z18.array(SHA256Hash).min(1).max(32),
+  started_at: Timestamp3,
+  completed_at: Timestamp3,
+  error: WorkspaceBoundaryError_v1.optional()
+};
+var OperationReceiptBody = boundedStrictObject(OperationReceiptShape).superRefine(
+  requireValidOperationReceipt
+);
+var WorkspaceBoundaryOperationReceipt_v1 = boundedStrictObject({
+  ...OperationReceiptShape,
+  receipt_digest: SHA256Hash
+}).superRefine(requireValidOperationReceipt).superRefine((receipt, context) => {
+  const { receipt_digest: _digest, ...body } = receipt;
+  requireDigest2(
+    receipt.receipt_digest,
+    boundaryHash("operation-receipt", body),
+    "receipt_digest",
+    context
+  );
+});
+function createWorkspaceBoundaryOperationReceipt(input) {
+  const parsed = OperationReceiptBody.parse(input);
+  const body = OperationReceiptBody.parse({
+    ...parsed,
+    identity_digests: canonicalDigestSet(parsed.identity_digests)
+  });
+  return WorkspaceBoundaryOperationReceipt_v1.parse({
+    ...body,
+    receipt_digest: boundaryHash("operation-receipt", body)
+  });
+}
+function canonicalDigestSet(digests) {
+  return [...new Set(digests)].sort();
+}
+var workspaceBoundaryLeaseBrand = /* @__PURE__ */ Symbol("WorkspaceBoundaryLease");
+function requireValidCapabilityDecision(decision, context) {
+  const readyReason = decision.reason_code === "native_backend_ready" || decision.reason_code === "explicit_projection_ready";
+  if (decision.state === "ready" !== readyReason) {
+    addIssue(context, ["reason_code"], "ready state and reason code must agree");
+  }
+  if (decision.state === "ready" && decision.selection.mode === "native" && decision.reason_code !== "native_backend_ready") {
+    addIssue(context, ["reason_code"], "native selection requires the native ready reason");
+  }
+  if (decision.state === "ready" && decision.selection.mode === "explicit_projection" && decision.reason_code !== "explicit_projection_ready") {
+    addIssue(context, ["reason_code"], "projection selection requires the projection ready reason");
+  }
+  if (decision.selection.mode === "explicit_projection") {
+    if (decision.backend_kind !== "native-wsl-projection") {
+      addIssue(context, ["backend_kind"], "explicit projection must select the projection backend");
+    }
+  } else if (decision.backend_kind === "native-wsl-projection") {
+    addIssue(context, ["backend_kind"], "projection selection must be explicit");
+  }
+  if (decision.state === "ready" && decision.backend_kind === "linux-native") {
+    if (decision.host.platform !== "linux") {
+      addIssue(context, ["host", "platform"], "Linux native requires a Linux host probe");
+    }
+    if (decision.host.path_comparison !== "case-sensitive") {
+      addIssue(context, ["host", "path_comparison"], "Linux native requires case-sensitive paths");
+    }
+    if (decision.backend.transport !== "in_process") {
+      addIssue(context, ["backend", "transport"], "Linux native uses the in-process boundary");
+    }
+  }
+  if (decision.state === "ready" && decision.backend_kind === "windows-native") {
+    if (decision.host.platform !== "windows") {
+      addIssue(context, ["host", "platform"], "Windows native requires a Windows host probe");
+    }
+    if (decision.host.path_comparison !== "case-insensitive") {
+      addIssue(
+        context,
+        ["host", "path_comparison"],
+        "Windows native requires case-insensitive paths"
+      );
+    }
+    if (decision.backend.transport !== "native_helper") {
+      addIssue(context, ["backend", "transport"], "Windows native requires the native helper");
+    }
+  }
+  if (decision.state === "ready") {
+    const requiredClaims = [
+      "held_directory_identity",
+      "no_follow_open",
+      "final_path_from_handle",
+      "held_ancestor_chain",
+      "replacement_resistant_process_binding"
+    ];
+    for (const claim of requiredClaims) {
+      if (!decision.claims[claim]) {
+        addIssue(context, ["claims", claim], "ready backends must enforce this claim");
+      }
+    }
+  }
+  if (decision.state === "ready" && decision.backend.transport === "native_helper" && (decision.backend.signature.status !== "verified" || !decision.backend.artifact_digest)) {
+    addIssue(
+      context,
+      ["backend", "signature"],
+      "a ready native helper must have a verified signature and artifact digest"
+    );
+  }
+}
+function requireValidOperationReceipt(receipt, context) {
+  if (receipt.outcome === "completed" === Boolean(receipt.error)) {
+    addIssue(context, ["error"], "completed operations omit errors; other outcomes require one");
+  }
+  if (receipt.error?.operation_id !== void 0 && receipt.error.operation_id !== receipt.operation_id) {
+    addIssue(
+      context,
+      ["error", "operation_id"],
+      "error operation_id must match receipt operation_id"
+    );
+  }
+  if (!receipt.mutation && receipt.durability !== "not_applicable") {
+    addIssue(context, ["durability"], "read-only operations use not_applicable durability");
+  }
+  if (receipt.outcome === "indeterminate" && receipt.durability !== "indeterminate") {
+    addIssue(context, ["durability"], "indeterminate operations require indeterminate durability");
+  }
+  if (receipt.outcome === "completed" && receipt.durability === "indeterminate") {
+    addIssue(context, ["durability"], "completed operations cannot have indeterminate durability");
+  }
+  if (receipt.outcome === "rejected" && receipt.error?.effect_state !== "no_effect") {
+    addIssue(context, ["error", "effect_state"], "rejected operations must report no effect");
+  }
+  if (Date.parse(receipt.completed_at) < Date.parse(receipt.started_at)) {
+    addIssue(context, ["completed_at"], "completed_at must not precede started_at");
+  }
+  if (receipt.mutation !== isMutationOperation(receipt.operation)) {
+    addIssue(context, ["mutation"], "mutation must match the operation kind");
+  }
+}
+function isMutationOperation(operation) {
+  return operation === "create-child" || operation === "write-owned-file" || operation === "rename-owned" || operation === "remove-owned" || operation === "sync-directory";
+}
+function isWindowsAbsolutePath(value) {
+  return /^[a-z]:[\\/]/iu.test(value) || /^\\\\[^\\/\0]+[\\/][^\\/\0]+(?:[\\/]|$)/u.test(value) || /^\\\\\?\\/u.test(value);
+}
+function boundaryHash(domain, body) {
+  return computeCanonicalHash(["lexrunner-workspace-boundary-v1", domain, body]);
+}
+function requireDigest2(actual, expected, field, context) {
+  if (actual !== expected) addIssue(context, [field], `${field} does not match canonical content`);
+}
+function copyIssues(result, context) {
+  if (result.success) return;
+  for (const issue of result.error.issues) {
+    context.addIssue({ code: "custom", path: issue.path, message: issue.message });
+  }
+}
+function addIssue(context, path50, message) {
+  context.addIssue({ code: "custom", path: path50, message });
+}
+
+// src/workspaces/linux-workspace-boundary.ts
+var DEFAULT_FILE_MODE = 384;
+var LinuxWorkspaceBoundary = class {
+  constructor(options) {
+    this.capability = WorkspaceBoundaryCapabilityDecision_v1.parse(options.capability);
+    if (this.capability.state !== "ready" || this.capability.backend_kind !== "linux-native" || this.capability.backend.transport !== "in_process") {
+      throw new Error("LinuxWorkspaceBoundary requires a verified ready Linux capability decision");
+    }
+    this.runner = options.runner ?? new ExecaCommandRunner();
+    this.clock = options.clock ?? (() => /* @__PURE__ */ new Date());
+    this.createId = options.createId ?? randomUUID3;
+  }
+  acquire(request) {
+    const opened = [];
+    try {
+      if (request.roots.length === 0 || request.roots.length > 16) {
+        throw new DirectoryBoundaryError("invalid_path", "A boundary lease requires 1-16 roots");
+      }
+      const roles = /* @__PURE__ */ new Set();
+      const roots = /* @__PURE__ */ new Map();
+      const directories = /* @__PURE__ */ new Map();
+      const leaseId = this.createId();
+      for (const root of request.roots) {
+        if (!root.role || roles.has(root.role)) {
+          throw new DirectoryBoundaryError(
+            "invalid_path",
+            "Boundary root roles must be non-empty and unique"
+          );
+        }
+        roles.add(root.role);
+        const captured = captureDirectoryIdentity(root.absolutePath, root.role);
+        const directory = reopenDirectoryIdentity(captured, root.role);
+        opened.push(directory);
+        const capability = linuxCapability(leaseId, directory);
+        roots.set(root.role, capability);
+        directories.set(capability, directory);
+      }
+      const acquired = createWorkspaceBoundaryLeaseReceipt({
+        schema_version: WORKSPACE_BOUNDARY_CONTRACT_VERSION,
+        lease_id: leaseId,
+        orchestration_lease_id: request.orchestrationLeaseId,
+        orchestration_lease_revision: request.orchestrationLeaseRevision,
+        owner_id: request.ownerId,
+        backend_kind: "linux-native",
+        capability_decision_digest: this.capability.decision_digest,
+        root_identity_digests: [...roots.values()].map((root) => root.identity.identity_digest),
+        phase: "acquired",
+        observed_at: this.clock().toISOString()
+      });
+      return Promise.resolve({
+        ok: true,
+        lease: new LinuxWorkspaceBoundaryLease({
+          acquired,
+          roots,
+          directories,
+          runner: this.runner,
+          clock: this.clock
+        })
+      });
+    } catch (error) {
+      for (const directory of opened.reverse()) directory.close();
+      return Promise.resolve({
+        ok: false,
+        error: boundaryError(error, request.operationId, "no_effect")
+      });
+    }
+  }
+};
+var _a;
+_a = workspaceBoundaryLeaseBrand;
+var LinuxWorkspaceBoundaryLease = class {
+  constructor(options) {
+    this[_a] = true;
+    this.directories = /* @__PURE__ */ new Map();
+    this.closed = false;
+    this.acquired = options.acquired;
+    this.roots = options.roots;
+    this.runner = options.runner;
+    this.clock = options.clock;
+    for (const [capability, directory] of options.directories) {
+      this.directories.set(capability, directory);
+    }
+  }
+  root(role) {
+    this.assertOpen();
+    const root = this.roots.get(role);
+    if (!root) throw new Error(`Boundary lease does not contain root role ${role}`);
+    return root;
+  }
+  async openChild(parent, component, operationId) {
+    return this.directoryOperation(
+      "open-child",
+      parent,
+      operationId,
+      () => this.register(openChildDirectory(this.requireCapability(parent), component, "boundary child"))
+    );
+  }
+  async tryOpenChild(parent, component, operationId) {
+    return this.directoryOperation("open-child", parent, operationId, () => {
+      const directory = tryOpenChildDirectory(
+        this.requireCapability(parent),
+        component,
+        "boundary child"
+      );
+      return directory ? this.register(directory) : null;
+    });
+  }
+  async createChild(parent, component, operationId) {
+    return this.directoryOperation(
+      "create-child",
+      parent,
+      operationId,
+      () => this.register(
+        createChildDirectory(this.requireCapability(parent), component, "boundary child")
+      ),
+      true
+    );
+  }
+  async assertCurrent(directories, operationId) {
+    const startedAt = this.clock();
+    try {
+      this.assertOpen();
+      if (directories.length === 0) throw new Error("assertCurrent requires a directory");
+      const capabilities = directories.map((directory) => this.requireCapability(directory));
+      for (const directory of capabilities) {
+        assertAnchoredDirectoryLocation(directory, "boundary directory");
+      }
+      const identities = capabilities.map((directory) => linuxIdentity(directory));
+      return this.success("assert-current", operationId, identities, directories, startedAt);
+    } catch (error) {
+      return this.failure("assert-current", operationId, directories, error, startedAt, false);
+    }
+  }
+  async readFile(request) {
+    const startedAt = this.clock();
+    try {
+      this.assertOpen();
+      if (!Number.isSafeInteger(request.maxBytes) || request.maxBytes <= 0) {
+        throw new Error("maxBytes must be a positive safe integer");
+      }
+      const directory = this.requireCapability(request.directory);
+      assertAnchoredDirectoryLocation(directory, "owned file parent");
+      const handle = await open(
+        procChildPath(directory, request.component),
+        constants2.O_RDONLY | constants2.O_NOFOLLOW
+      );
+      try {
+        const stats = await handle.stat();
+        if (!stats.isFile()) throw new Error("Owned file is not a regular file");
+        const buffer = Buffer.alloc(request.maxBytes + 1);
+        let offset = 0;
+        while (offset < buffer.byteLength) {
+          const { bytesRead } = await handle.read(
+            buffer,
+            offset,
+            buffer.byteLength - offset,
+            offset
+          );
+          if (bytesRead === 0) break;
+          offset += bytesRead;
+        }
+        if (offset > request.maxBytes) {
+          throw new Error(`Owned file exceeds ${request.maxBytes} bytes`);
+        }
+        return this.success(
+          "read-owned-file",
+          request.operationId,
+          buffer.subarray(0, offset),
+          [request.directory],
+          startedAt
+        );
+      } finally {
+        await handle.close();
+      }
+    } catch (error) {
+      return this.failure(
+        "read-owned-file",
+        request.operationId,
+        [request.directory],
+        error,
+        startedAt,
+        false
+      );
+    }
+  }
+  async writeFile(request) {
+    const startedAt = this.clock();
+    try {
+      this.assertOpen();
+      const directory = this.requireCapability(request.directory);
+      assertAnchoredDirectoryLocation(directory, "owned file parent");
+      const flags = constants2.O_WRONLY | constants2.O_CREAT | constants2.O_NOFOLLOW | (request.exclusive ? constants2.O_EXCL : constants2.O_TRUNC);
+      const handle = await open(
+        procChildPath(directory, request.component),
+        flags,
+        request.mode ?? DEFAULT_FILE_MODE
+      );
+      try {
+        await handle.writeFile(request.content);
+      } finally {
+        await handle.close();
+      }
+      return this.success(
+        "write-owned-file",
+        request.operationId,
+        void 0,
+        [request.directory],
+        startedAt,
+        "not_requested"
+      );
+    } catch (error) {
+      return this.failure(
+        "write-owned-file",
+        request.operationId,
+        [request.directory],
+        error,
+        startedAt,
+        true
+      );
+    }
+  }
+  async runProcess(request) {
+    const startedAt = this.clock();
+    const temporaryDirectories = [];
+    try {
+      this.assertOpen();
+      const cwd = this.requireCapability(request.cwd);
+      const rendered = request.args.map(
+        (argument) => this.renderArgument(argument, request.cwd, temporaryDirectories)
+      );
+      const asserted = [
+        ...this.roots.values(),
+        request.cwd,
+        ...request.args.filter(
+          (argument) => argument.kind === "directory"
+        ).map((argument) => argument.directory)
+      ];
+      const command = {
+        executable: request.executable,
+        args: rendered,
+        cwd: cwd.procPath,
+        timeoutMs: request.timeoutMs,
+        ...request.env ? { env: request.env } : {},
+        ...request.extendEnv !== void 0 ? { extendEnv: request.extendEnv } : {},
+        ...request.signal ? { signal: request.signal } : {},
+        ...request.maxOutputBytes ? { maxOutputBytes: request.maxOutputBytes } : {},
+        preflight: () => {
+          for (const capability of asserted) {
+            assertAnchoredDirectoryLocation(
+              this.requireCapability(capability),
+              "process directory"
+            );
+          }
+          for (const directory of temporaryDirectories) {
+            assertAnchoredDirectoryLocation(directory, "process directory component");
+          }
+        }
+      };
+      const result = await this.runner.run(command);
+      return this.success("spawn-process", request.operationId, result, asserted, startedAt);
+    } catch (error) {
+      return this.failure(
+        "spawn-process",
+        request.operationId,
+        [request.cwd],
+        error,
+        startedAt,
+        false
+      );
+    } finally {
+      for (const directory of temporaryDirectories.reverse()) directory.close();
+    }
+  }
+  async close(reason) {
+    if (this.terminalReceipt) return this.terminalReceipt;
+    this.closed = true;
+    for (const directory of [...this.directories.values()].reverse()) directory.close();
+    this.directories.clear();
+    this.terminalReceipt = createWorkspaceBoundaryLeaseReceipt({
+      schema_version: WORKSPACE_BOUNDARY_CONTRACT_VERSION,
+      lease_id: this.acquired.lease_id,
+      orchestration_lease_id: this.acquired.orchestration_lease_id,
+      orchestration_lease_revision: this.acquired.orchestration_lease_revision,
+      owner_id: this.acquired.owner_id,
+      backend_kind: "linux-native",
+      capability_decision_digest: this.acquired.capability_decision_digest,
+      root_identity_digests: this.acquired.root_identity_digests,
+      phase: reason === "expired" ? "expired" : reason === "reconcile" ? "reconciled" : "released",
+      observed_at: this.clock().toISOString()
+    });
+    return this.terminalReceipt;
+  }
+  async directoryOperation(operation, parent, operationId, effect, mutation4 = false) {
+    const startedAt = this.clock();
+    try {
+      this.assertOpen();
+      const value = effect();
+      const identities = value && typeof value === "object" && "identity" in value ? [parent, value] : [parent];
+      return this.success(
+        operation,
+        operationId,
+        value,
+        identities,
+        startedAt,
+        mutation4 ? "not_requested" : "not_applicable"
+      );
+    } catch (error) {
+      return this.failure(operation, operationId, [parent], error, startedAt, mutation4);
+    }
+  }
+  renderArgument(argument, cwd, temporaryDirectories) {
+    if (argument.kind === "literal") return argument.value;
+    if (argument.relativeToCwd) {
+      if (argument.directory !== cwd || (argument.components?.length ?? 0) > 0) {
+        throw new DirectoryBoundaryError(
+          "invalid_path",
+          "A cwd-relative process argument must reference the exact cwd capability without components"
+        );
+      }
+      this.requireCapability(argument.directory);
+      return `${argument.prefix ?? ""}.${argument.suffix ?? ""}`;
+    }
+    let directory = this.requireCapability(argument.directory);
+    for (const component of argument.components ?? []) {
+      directory = openChildDirectory(directory, component, "process directory component");
+      temporaryDirectories.push(directory);
+    }
+    return `${argument.prefix ?? ""}${directory.procPath}${argument.suffix ?? ""}`;
+  }
+  register(directory) {
+    const capability = linuxCapability(this.acquired.lease_id, directory);
+    this.directories.set(capability, directory);
+    return capability;
+  }
+  requireCapability(capability) {
+    this.assertOpen();
+    const candidate = capability;
+    const directory = this.directories.get(candidate);
+    if (candidate.leaseId !== this.acquired.lease_id || !directory) {
+      throw new DirectoryBoundaryError(
+        "identity_changed",
+        "Directory capability is stale, foreign, or forged"
+      );
+    }
+    return directory;
+  }
+  assertOpen() {
+    if (this.closed) {
+      throw new DirectoryBoundaryError("identity_changed", "Workspace boundary lease is closed");
+    }
+  }
+  success(operation, operationId, value, directories, startedAt, durability = "not_applicable") {
+    return {
+      ok: true,
+      value,
+      receipt: this.receipt(operation, operationId, directories, startedAt, {
+        outcome: "completed",
+        durability
+      })
+    };
+  }
+  failure(operation, operationId, directories, error, startedAt, mutation4) {
+    const effectState = mutation4 && !knownNoEffect(error) ? "effect_unknown" : "no_effect";
+    const boundary = boundaryError(error, operationId, effectState);
+    return {
+      ok: false,
+      error: boundary,
+      receipt: this.receipt(operation, operationId, directories, startedAt, {
+        outcome: effectState === "effect_unknown" ? "indeterminate" : "rejected",
+        durability: effectState === "effect_unknown" ? "indeterminate" : "not_applicable",
+        error: boundary
+      })
+    };
+  }
+  receipt(operation, operationId, directories, startedAt, result) {
+    const identities = directories.map((directory) => directory.identity?.identity_digest).filter((digest) => Boolean(digest));
+    const completedAt = new Date(Math.max(startedAt.getTime(), this.clock().getTime()));
+    return createWorkspaceBoundaryOperationReceipt({
+      schema_version: WORKSPACE_BOUNDARY_CONTRACT_VERSION,
+      operation_id: operationId,
+      lease_id: this.acquired.lease_id,
+      backend_kind: "linux-native",
+      operation,
+      mutation: operation === "create-child" || operation === "write-owned-file" || operation === "rename-owned" || operation === "remove-owned" || operation === "sync-directory",
+      outcome: result.outcome,
+      durability: result.durability,
+      identity_digests: [
+        ...new Set(identities.length > 0 ? identities : this.acquired.root_identity_digests)
+      ],
+      started_at: startedAt.toISOString(),
+      completed_at: completedAt.toISOString(),
+      ...result.outcome === "completed" ? {} : { error: result.error }
+    });
+  }
+};
+function linuxCapability(leaseId, directory) {
+  return {
+    leaseId,
+    identity: linuxIdentity(directory)
+  };
+}
+function linuxIdentity(directory) {
+  const identity = identityOf(directory);
+  return createWorkspaceBoundaryDirectoryIdentity({
+    schema_version: WORKSPACE_BOUNDARY_CONTRACT_VERSION,
+    backend_kind: "linux-native",
+    canonical_path: identity.path,
+    path_comparison: "case-sensitive",
+    identity_kind: "linux-device-inode",
+    device: identity.device.toString(10),
+    inode: identity.inode.toString(10)
+  });
+}
+function boundaryError(error, operationId, effectState) {
+  const nodeCode = isNodeError2(error) ? error.code : void 0;
+  const code = error instanceof DirectoryBoundaryError ? error.code === "identity_changed" ? "identity_changed" : error.code === "unsupported_platform" ? "unsupported_filesystem" : "invalid_path" : nodeCode === "ENOENT" ? "invalid_path" : nodeCode === "EACCES" || nodeCode === "EPERM" ? "sharing_violation" : "operation_failed";
+  return {
+    schema_version: WORKSPACE_BOUNDARY_CONTRACT_VERSION,
+    code,
+    message: boundedMessage(error),
+    retryable: false,
+    effect_state: effectState,
+    operation_id: operationId
+  };
+}
+function knownNoEffect(error) {
+  if (error instanceof DirectoryBoundaryError) {
+    const cause = error.originalCause;
+    return isNodeError2(cause) && cause.code === "EEXIST";
+  }
+  return isNodeError2(error) && error.code === "EEXIST";
+}
+function boundedMessage(error) {
+  const message = isNodeError2(error) && error.code === "ENOENT" ? "Boundary path does not exist" : isNodeError2(error) && (error.code === "EACCES" || error.code === "EPERM") ? "Boundary operation was denied by the host" : (error instanceof Error ? error.message : String(error)).replace(
+    /\/proc\/\d+\/fd\/\d+/gu,
+    "<held-directory>"
+  );
+  return message.length <= 4096 ? message : message.slice(0, 4096);
+}
+function isNodeError2(error) {
+  return error instanceof Error && "code" in error;
+}
+
+// src/workspaces/workspace-boundary-resolver.ts
+var EMPTY_CLAIMS = Object.freeze({
+  held_directory_identity: false,
+  no_follow_open: false,
+  final_path_from_handle: false,
+  held_ancestor_chain: false,
+  replacement_resistant_process_binding: false,
+  rename_delete_exclusion: false,
+  durable_directory_mutation: false
+});
+var LINUX_CLAIMS = Object.freeze({
+  held_directory_identity: true,
+  no_follow_open: true,
+  final_path_from_handle: true,
+  held_ancestor_chain: true,
+  replacement_resistant_process_binding: true,
+  rename_delete_exclusion: false,
+  durable_directory_mutation: false
+});
+function resolveWorkspaceBoundary(request, options = {}) {
+  const selection = WorkspaceBoundarySelectionRequest_v1.parse(request);
+  const runtimePlatform = platform2();
+  const observedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const decisionId = randomUUID4();
+  if (selection.mode === "explicit_projection") {
+    return {
+      ok: false,
+      decision: createWorkspaceBoundaryCapabilityDecision({
+        schema_version: WORKSPACE_BOUNDARY_CONTRACT_VERSION,
+        decision_id: decisionId,
+        selection,
+        backend_kind: "native-wsl-projection",
+        state: "unavailable",
+        reason_code: "projection_unavailable",
+        host: host(runtimePlatform),
+        backend: {
+          transport: "in_process",
+          implementation: "native-wsl-projection",
+          implementation_version: WORKSPACE_BOUNDARY_CONTRACT_VERSION
+        },
+        claims: EMPTY_CLAIMS,
+        observed_at: observedAt
+      })
+    };
+  }
+  if (runtimePlatform === "linux") {
+    const support = probeDirectoryIdentityBoundarySupport("case-sensitive");
+    const capability = createWorkspaceBoundaryCapabilityDecision({
+      schema_version: WORKSPACE_BOUNDARY_CONTRACT_VERSION,
+      decision_id: decisionId,
+      selection,
+      backend_kind: "linux-native",
+      state: support.supported ? "ready" : "unavailable",
+      reason_code: support.supported ? "native_backend_ready" : "backend_unavailable",
+      host: host(runtimePlatform),
+      backend: {
+        transport: "in_process",
+        implementation: "linux-directory-identity",
+        implementation_version: WORKSPACE_BOUNDARY_CONTRACT_VERSION
+      },
+      claims: support.supported ? LINUX_CLAIMS : EMPTY_CLAIMS,
+      observed_at: observedAt
+    });
+    return support.supported ? {
+      ok: true,
+      boundary: new LinuxWorkspaceBoundary({
+        capability,
+        ...options.runner ? { runner: options.runner } : {}
+      })
+    } : { ok: false, decision: capability };
+  }
+  if (runtimePlatform === "win32") {
+    return {
+      ok: false,
+      decision: createWorkspaceBoundaryCapabilityDecision({
+        schema_version: WORKSPACE_BOUNDARY_CONTRACT_VERSION,
+        decision_id: decisionId,
+        selection,
+        backend_kind: "windows-native",
+        state: "unavailable",
+        reason_code: "helper_missing",
+        host: host(runtimePlatform),
+        backend: {
+          transport: "native_helper",
+          implementation: "windows-workspace-boundary",
+          implementation_version: WORKSPACE_BOUNDARY_CONTRACT_VERSION,
+          protocol_version: WORKSPACE_BOUNDARY_CONTRACT_VERSION,
+          signature: { status: "not_available" }
+        },
+        claims: EMPTY_CLAIMS,
+        observed_at: observedAt
+      })
+    };
+  }
+  return {
+    ok: false,
+    decision: createWorkspaceBoundaryCapabilityDecision({
+      schema_version: WORKSPACE_BOUNDARY_CONTRACT_VERSION,
+      decision_id: decisionId,
+      selection,
+      backend_kind: "linux-native",
+      state: "unsupported",
+      reason_code: "unsupported_host",
+      host: host(runtimePlatform),
+      backend: {
+        transport: "in_process",
+        implementation: "linux-directory-identity",
+        implementation_version: WORKSPACE_BOUNDARY_CONTRACT_VERSION
+      },
+      claims: EMPTY_CLAIMS,
+      observed_at: observedAt
+    })
+  };
+}
+function host(runtimePlatform) {
+  return {
+    platform: runtimePlatform === "linux" ? "linux" : runtimePlatform === "win32" ? "windows" : "other",
+    architecture: arch(),
+    path_comparison: runtimePlatform === "win32" ? "case-insensitive" : "case-sensitive"
+  };
+}
+
 // src/workspaces/node-git-worktree-broker.ts
 var FULL_GIT_OBJECT_ID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
 var DEFAULT_TIMEOUT_MS = 3e4;
@@ -20736,7 +21717,23 @@ var NodeGitWorktreeBroker = class {
     if (nativePathsOverlap2(options.repositoryRoot, options.worktreeRoot, options.pathComparison)) {
       throw new Error("repositoryRoot and worktreeRoot must not overlap");
     }
-    assertDirectoryIdentityBoundarySupported(options.pathComparison);
+    const resolution = resolveWorkspaceBoundary(
+      { mode: "native" },
+      options.runner ? { runner: options.runner } : {}
+    );
+    if (!resolution.ok) {
+      throw new DirectoryBoundaryError(
+        "unsupported_platform",
+        `Native workspace boundary is unavailable (${resolution.decision.reason_code})`
+      );
+    }
+    if (resolution.boundary.capability.host.path_comparison !== options.pathComparison) {
+      throw new DirectoryBoundaryError(
+        "unsupported_platform",
+        "Physical worktree containment currently requires a case-sensitive Linux Git runtime"
+      );
+    }
+    this.boundary = resolution.boundary;
     this.repositoryIdentity = captureDirectoryIdentity(options.repositoryRoot, "repositoryRoot");
     this.worktreeRootIdentity = captureDirectoryIdentity(options.worktreeRoot, "worktreeRoot");
     const repository = reopenDirectoryIdentity(this.repositoryIdentity, "repositoryRoot");
@@ -20757,9 +21754,9 @@ var NodeGitWorktreeBroker = class {
     this.gitRuntime = options.gitRuntime;
     this.pathComparison = options.pathComparison;
     this.gitExecutable = options.gitExecutable ?? "git";
-    this.runner = options.runner ?? new ExecaCommandRunner();
     this.defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
     this.maxDirtyPaths = options.maxDirtyPaths ?? DEFAULT_MAX_DIRTY_PATHS;
+    this.testOnlyAllowUnboundBoundaryAuthority = options.testOnlyAllowUnboundBoundaryAuthority ?? false;
   }
   async create(target, options = {}) {
     const runtimeFailure = this.runtimeFailure(target, "create");
@@ -20771,7 +21768,7 @@ var NodeGitWorktreeBroker = class {
         "baseSha must be a lowercase full SHA-1 or SHA-256 object ID"
       );
     }
-    const boundary = this.openOperationBoundary(target, "create");
+    const boundary = await this.openOperationBoundary(target, "create", options);
     if ("ok" in boundary) return boundary;
     try {
       const branchValidation = await this.gitMain(
@@ -20856,12 +21853,13 @@ var NodeGitWorktreeBroker = class {
         );
       }
       try {
-        const targetDirectory2 = createChildDirectory(
+        const targetDirectory2 = await boundary.lease.createChild(
           boundary.targetParent,
           boundary.targetName,
-          "worktree target"
+          nextBoundaryOperationId(boundary, "create-target")
         );
-        boundary.target = targetDirectory2;
+        if (!targetDirectory2.ok) return this.containmentFailure("create", targetDirectory2.error);
+        boundary.target = targetDirectory2.value;
       } catch (error) {
         return this.containmentFailure("create", error);
       }
@@ -20876,7 +21874,14 @@ var NodeGitWorktreeBroker = class {
       const created = await this.gitMain(
         boundary,
         "create",
-        ["worktree", "add", "-b", target.branch, targetDirectory.procPath, target.baseSha],
+        [
+          { kind: "literal", value: "worktree" },
+          { kind: "literal", value: "add" },
+          { kind: "literal", value: "-b" },
+          { kind: "literal", value: target.branch },
+          { kind: "directory", directory: targetDirectory },
+          { kind: "literal", value: target.baseSha }
+        ],
         options
       );
       if (!created.ok) {
@@ -20898,18 +21903,18 @@ var NodeGitWorktreeBroker = class {
       }
       return { ok: true, outcome: "created", observation: after.observation };
     } finally {
-      closeOperationBoundary(boundary);
+      await closeOperationBoundary(boundary);
     }
   }
   async observe(target, options = {}) {
     const runtimeFailure = this.runtimeFailure(target, "observe");
     if (runtimeFailure) return runtimeFailure;
-    const boundary = this.openOperationBoundary(target, "observe");
+    const boundary = await this.openOperationBoundary(target, "observe", options);
     if ("ok" in boundary) return boundary;
     try {
       return await this.observeAnchored(target, boundary, options);
     } finally {
-      closeOperationBoundary(boundary);
+      await closeOperationBoundary(boundary);
     }
   }
   async observeAnchored(target, boundary, options) {
@@ -20984,11 +21989,10 @@ var NodeGitWorktreeBroker = class {
             status
           );
         }
-        const marker = await this.readAttemptMarker(target, worktreeGit);
+        const marker = await this.readAttemptMarker(target, worktreeGit, boundary);
         markerVerified = marker.matches;
         markerReason = marker.reason ?? markerReason;
       } finally {
-        worktreeGit.close();
       }
     }
     const identityVerified = exists && !record.bare && !record.detached && !record.locked && !record.prunable && observedBranch === target.branch && markerVerified;
@@ -21016,7 +22020,7 @@ var NodeGitWorktreeBroker = class {
   async remove(target, options = {}) {
     const runtimeFailure = this.runtimeFailure(target, "remove");
     if (runtimeFailure) return runtimeFailure;
-    const boundary = this.openOperationBoundary(target, "remove");
+    const boundary = await this.openOperationBoundary(target, "remove", options);
     if ("ok" in boundary) return boundary;
     try {
       const observed = await this.observeAnchored(target, boundary, options);
@@ -21033,21 +22037,22 @@ var NodeGitWorktreeBroker = class {
       const removed = await this.gitMain(
         boundary,
         "remove",
-        ["worktree", "remove", targetDirectory.procPath],
+        [
+          { kind: "literal", value: "worktree" },
+          { kind: "literal", value: "remove" },
+          { kind: "directory", directory: targetDirectory }
+        ],
         options
       );
       if (!removed.ok) return removed;
-      targetDirectory.close();
       boundary.target = null;
-      try {
-        boundary.target = tryOpenChildDirectory(
-          boundary.targetParent,
-          boundary.targetName,
-          "worktree target"
-        );
-      } catch (error) {
-        return this.containmentFailure("remove", error);
-      }
+      const reopened = await boundary.lease.tryOpenChild(
+        boundary.targetParent,
+        boundary.targetName,
+        nextBoundaryOperationId(boundary, "reopen-removed-target")
+      );
+      if (!reopened.ok) return this.containmentFailure("remove", reopened.error);
+      boundary.target = reopened.value;
       const after = await this.observeAnchored(target, boundary, options);
       if (!after.ok) return { ...after, operation: "remove" };
       if (after.observation.registered || after.observation.exists) {
@@ -21061,7 +22066,7 @@ var NodeGitWorktreeBroker = class {
       }
       return { ok: true, outcome: "removed", observation: after.observation };
     } finally {
-      closeOperationBoundary(boundary);
+      await closeOperationBoundary(boundary);
     }
   }
   runtimeFailure(target, operation) {
@@ -21095,74 +22100,129 @@ var NodeGitWorktreeBroker = class {
     }
     return null;
   }
-  openOperationBoundary(target, operation) {
-    let repository = null;
-    let repositoryGit = null;
-    let targetParent = null;
-    let targetDirectory = null;
+  async openOperationBoundary(target, operation, options) {
+    const authority2 = this.boundaryAuthority(target, operation, options);
+    if (!authority2) {
+      return this.failure(
+        operation,
+        "containment_violation",
+        "Workspace boundary authority lineage is required"
+      );
+    }
+    const acquired = await this.boundary.acquire({
+      operationId: authority2.operationId,
+      orchestrationLeaseId: authority2.orchestrationLeaseId,
+      orchestrationLeaseRevision: authority2.orchestrationLeaseRevision,
+      ownerId: authority2.ownerId,
+      roots: [
+        { role: "repository", absolutePath: this.repositoryRoot },
+        { role: "allocation", absolutePath: this.worktreeRoot }
+      ]
+    });
+    if (!acquired.ok) return this.containmentFailure(operation, acquired.error);
+    const lease = acquired.lease;
+    const boundary = {
+      lease,
+      repository: lease.root("repository"),
+      repositoryGit: lease.root("repository"),
+      targetParent: lease.root("allocation"),
+      targetName: "",
+      target: null,
+      operationId: authority2.operationId,
+      operationSequence: 0
+    };
     try {
-      repository = reopenDirectoryIdentity(this.repositoryIdentity, "repositoryRoot");
-      repositoryGit = openChildDirectory(repository, ".git", "repository Git directory");
-      if (!sameDirectoryIdentity(repositoryGit, this.repositoryGitIdentity)) {
+      if (!sameBoundaryIdentity(boundary.repository, this.repositoryIdentity)) {
+        throw new DirectoryBoundaryError(
+          "identity_changed",
+          "The repository root was replaced after broker initialization"
+        );
+      }
+      const repositoryGit = await lease.openChild(
+        boundary.repository,
+        ".git",
+        nextBoundaryOperationId(boundary, "open-repository-git")
+      );
+      if (!repositoryGit.ok) throw new Error(repositoryGit.error.message);
+      boundary.repositoryGit = repositoryGit.value;
+      if (!sameBoundaryIdentity(boundary.repositoryGit, this.repositoryGitIdentity)) {
         throw new DirectoryBoundaryError(
           "identity_changed",
           "The repository Git directory was replaced after broker initialization"
         );
       }
-      const allocationRoot = reopenDirectoryIdentity(this.worktreeRootIdentity, "worktreeRoot");
+      if (!sameBoundaryIdentity(boundary.targetParent, this.worktreeRootIdentity)) {
+        throw new DirectoryBoundaryError(
+          "identity_changed",
+          "The worktree root was replaced after broker initialization"
+        );
+      }
       const relative = path33.relative(this.worktreeRoot, path33.resolve(target.worktreePath));
       const components = relative.split(path33.sep);
       const targetName = components.pop();
       if (!targetName) {
-        allocationRoot.close();
         throw new DirectoryBoundaryError("invalid_path", "The worktree target has no basename");
       }
-      targetParent = allocationRoot;
+      boundary.targetName = targetName;
       for (const component of components) {
-        const child = openChildDirectory(targetParent, component, "worktree target ancestor");
-        targetParent.close();
-        targetParent = child;
+        const child = await lease.openChild(
+          boundary.targetParent,
+          component,
+          nextBoundaryOperationId(boundary, "open-target-ancestor")
+        );
+        if (!child.ok) throw new Error(child.error.message);
+        boundary.targetParent = child.value;
       }
-      targetDirectory = tryOpenChildDirectory(targetParent, targetName, "worktree target");
-      return {
-        repository,
-        repositoryGit,
-        targetParent,
+      const targetDirectory = await lease.tryOpenChild(
+        boundary.targetParent,
         targetName,
-        target: targetDirectory
-      };
+        nextBoundaryOperationId(boundary, "open-target")
+      );
+      if (!targetDirectory.ok) throw new Error(targetDirectory.error.message);
+      boundary.target = targetDirectory.value;
+      return boundary;
     } catch (error) {
-      targetDirectory?.close();
-      targetParent?.close();
-      repositoryGit?.close();
-      repository?.close();
+      await lease.close("cancelled");
       return this.containmentFailure(operation, error);
     }
   }
+  boundaryAuthority(target, operation, options) {
+    if (options.boundaryAuthority) return options.boundaryAuthority;
+    if (!this.testOnlyAllowUnboundBoundaryAuthority) return null;
+    return {
+      operationId: `test-${target.attemptId}-${operation}`,
+      orchestrationLeaseId: `test-${target.attemptId}`,
+      orchestrationLeaseRevision: 0,
+      ownerId: `test-${target.hostId}`
+    };
+  }
   containmentFailure(operation, error) {
     const message = error instanceof DirectoryBoundaryError ? error.message : `Directory identity containment failed: ${errorMessage(error)}`;
     return this.failure(operation, "containment_violation", message);
   }
   gitMain(boundary, operation, args, options, allowedNonzeroExitCodes = []) {
-    const anchoredArgs = [
-      `--git-dir=${boundary.repositoryGit.procPath}`,
-      `--work-tree=${boundary.repository.procPath}`,
-      ...args
+    const boundaryArgs = [
+      {
+        kind: "directory",
+        directory: boundary.repositoryGit,
+        prefix: "--git-dir=",
+        relativeToCwd: true
+      },
+      { kind: "directory", directory: boundary.repository, prefix: "--work-tree=" },
+      ...args.map(boundaryArgument)
     ];
     const evidenceArgs = [
       `--git-dir=${this.repositoryGitIdentity.path}`,
       `--work-tree=${this.repositoryRoot}`,
-      ...args.map(
-        (arg) => boundary.target && arg === boundary.target.procPath ? boundary.target.path : arg
-      )
+      ...args.map(evidenceArgument)
     ];
     return this.git(
+      boundary,
       operation,
-      anchoredArgs,
-      boundary.repository.procPath,
+      boundaryArgs,
+      boundary.repositoryGit,
       options,
       allowedNonzeroExitCodes,
-      () => this.assertOperationBoundary(boundary),
       { args: evidenceArgs, cwd: this.repositoryRoot }
     );
   }
@@ -21176,38 +22236,24 @@ var NodeGitWorktreeBroker = class {
         )
       );
     }
-    const anchoredArgs = [
-      `--git-dir=${worktreeGit.procPath}`,
-      `--work-tree=${boundary.target.procPath}`,
-      ...args
+    const boundaryArgs = [
+      { kind: "directory", directory: worktreeGit, prefix: "--git-dir=" },
+      { kind: "directory", directory: boundary.target, prefix: "--work-tree=" },
+      ...args.map(boundaryArgument)
     ];
     const evidenceArgs = [
       `--git-dir=${path33.join(
         this.repositoryGitIdentity.path,
         "worktrees",
-        path33.basename(boundary.target.path)
+        path33.basename(boundary.target.identity.canonical_path)
       )}`,
-      `--work-tree=${boundary.target.path}`,
+      `--work-tree=${boundary.target.identity.canonical_path}`,
       ...args
     ];
-    return this.git(
-      operation,
-      anchoredArgs,
-      boundary.target.procPath,
-      options,
-      [],
-      () => this.assertOperationBoundary(boundary, worktreeGit),
-      { args: evidenceArgs, cwd: boundary.target.path }
-    );
-  }
-  assertOperationBoundary(boundary, worktreeGit) {
-    assertAnchoredDirectoryLocation(boundary.repository, "repositoryRoot");
-    assertAnchoredDirectoryLocation(boundary.repositoryGit, "repository Git directory");
-    assertAnchoredDirectoryLocation(boundary.targetParent, "worktree target parent");
-    if (boundary.target) assertAnchoredDirectoryLocation(boundary.target, "worktree target");
-    if (worktreeGit) {
-      assertAnchoredDirectoryLocation(worktreeGit, "worktree Git directory");
-    }
+    return this.git(boundary, operation, boundaryArgs, boundary.target, options, [], {
+      args: evidenceArgs,
+      cwd: boundary.target.identity.canonical_path
+    });
   }
   async writeAttemptMarker(target, boundary) {
     const gitDirectory = await this.openWorktreeGitDirectory(boundary, "create");
@@ -21224,18 +22270,16 @@ var NodeGitWorktreeBroker = class {
       baseSha: target.baseSha
     };
     try {
-      this.assertOperationBoundary(boundary, gitDirectory);
-      const handle = await open(
-        path33.join(gitDirectory.procPath, ATTEMPT_MARKER_FILE),
-        constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_NOFOLLOW,
-        384
-      );
-      try {
-        await handle.writeFile(`${JSON.stringify(marker)}
-`, "utf8");
-      } finally {
-        await handle.close();
-      }
+      const written = await boundary.lease.writeFile({
+        operationId: nextBoundaryOperationId(boundary, "write-attempt-marker"),
+        directory: gitDirectory,
+        component: ATTEMPT_MARKER_FILE,
+        content: Buffer.from(`${JSON.stringify(marker)}
+`, "utf8"),
+        mode: 384,
+        exclusive: true
+      });
+      if (!written.ok) throw new Error(written.error.message);
       return null;
     } catch (error) {
       return this.failure(
@@ -21243,27 +22287,32 @@ var NodeGitWorktreeBroker = class {
         "containment_violation",
         `Worktree was created but its Attempt marker could not be written: ${errorMessage(error)}`
       );
-    } finally {
-      gitDirectory.close();
     }
   }
-  async readAttemptMarker(target, gitDirectory) {
+  async readAttemptMarker(target, gitDirectory, boundary) {
     let marker;
     try {
-      const parsed = JSON.parse(
-        await readBoundedText(
-          path33.join(gitDirectory.procPath, ATTEMPT_MARKER_FILE),
-          MAX_ATTEMPT_MARKER_BYTES
-        )
-      );
+      const read = await boundary.lease.readFile({
+        operationId: nextBoundaryOperationId(boundary, "read-attempt-marker"),
+        directory: gitDirectory,
+        component: ATTEMPT_MARKER_FILE,
+        maxBytes: MAX_ATTEMPT_MARKER_BYTES
+      });
+      if (!read.ok) {
+        if (read.error.code === "invalid_path") {
+          return { matches: false, reason: "worktree Attempt marker is missing" };
+        }
+        return {
+          matches: false,
+          reason: `worktree Attempt marker is unreadable: ${read.error.message}`
+        };
+      }
+      const parsed = JSON.parse(Buffer.from(read.value).toString("utf8"));
       if (!isAttemptMarker(parsed)) {
         return { matches: false, reason: "worktree Attempt marker is malformed" };
       }
       marker = parsed;
     } catch (error) {
-      if (isNodeError2(error) && error.code === "ENOENT") {
-        return { matches: false, reason: "worktree Attempt marker is missing" };
-      }
       return {
         matches: false,
         reason: `worktree Attempt marker is unreadable: ${errorMessage(error)}`
@@ -21283,17 +22332,16 @@ var NodeGitWorktreeBroker = class {
         "The worktree target directory identity is unavailable"
       );
     }
-    try {
-      this.assertOperationBoundary(boundary);
-    } catch (error) {
-      return this.containmentFailure(operation, error);
-    }
     let gitFile;
     try {
-      gitFile = await readBoundedText(
-        path33.join(boundary.target.procPath, ".git"),
-        MAX_GITDIR_FILE_BYTES
-      );
+      const read = await boundary.lease.readFile({
+        operationId: nextBoundaryOperationId(boundary, "read-worktree-git-file"),
+        directory: boundary.target,
+        component: ".git",
+        maxBytes: MAX_GITDIR_FILE_BYTES
+      });
+      if (!read.ok) throw new Error(read.error.message);
+      gitFile = Buffer.from(read.value).toString("utf8");
     } catch (error) {
       return this.containmentFailure(operation, error);
     }
@@ -21325,18 +22373,17 @@ var NodeGitWorktreeBroker = class {
     let current = null;
     try {
       for (const component of relative.split(path33.sep)) {
-        const child = openChildDirectory(
+        const child = await boundary.lease.openChild(
           current ?? boundary.repositoryGit,
           component,
-          "worktree Git directory"
+          nextBoundaryOperationId(boundary, "open-worktree-git-directory")
         );
-        current?.close();
-        current = child;
+        if (!child.ok) throw new Error(child.error.message);
+        current = child.value;
       }
       if (!current) throw new DirectoryBoundaryError("invalid_path", "Missing worktree Git path");
       return current;
     } catch (error) {
-      current?.close();
       return this.containmentFailure(operation, error);
     }
   }
@@ -21382,32 +22429,36 @@ var NodeGitWorktreeBroker = class {
     const relative = path33.relative(comparedRoot, comparedCandidate);
     return relative.length > 0 && relative !== ".." && !relative.startsWith(`..${path33.sep}`);
   }
-  async git(operation, args, cwd, options, allowedNonzeroExitCodes = [], preflight, evidence) {
-    const request = {
+  async git(boundary, operation, args, cwd, options, allowedNonzeroExitCodes = [], evidence) {
+    const result = await boundary.lease.runProcess({
+      operationId: nextBoundaryOperationId(boundary, "run-git"),
       executable: this.gitExecutable,
       args,
       cwd,
       timeoutMs: options.timeoutMs ?? this.defaultTimeoutMs,
-      ...preflight ? { preflight } : {},
+      ...options.signal ? { signal: options.signal } : {}
+    });
+    if (!result.ok) return this.containmentFailure(operation, result.error);
+    const commandResult = result.value;
+    const commandEvidence = {
+      executable: this.gitExecutable,
+      args: evidence?.args ?? args.map(evidenceArgument),
+      cwd: evidence?.cwd ?? cwd.identity.canonical_path,
+      timeoutMs: options.timeoutMs ?? this.defaultTimeoutMs,
       ...options.signal ? { signal: options.signal } : {}
     };
-    const result = await this.runner.run(request);
-    if (result.ok || result.kind === "nonzero_exit" && result.exitCode !== null && allowedNonzeroExitCodes.includes(result.exitCode)) {
+    if (commandResult.ok || commandResult.kind === "nonzero_exit" && commandResult.exitCode !== null && allowedNonzeroExitCodes.includes(commandResult.exitCode)) {
       return {
         ok: true,
-        exitCode: result.exitCode ?? 0,
-        stdout: result.stdout,
-        stderr: result.stderr,
-        executable: request.executable,
-        args: [...evidence?.args ?? request.args],
-        cwd: evidence?.cwd ?? request.cwd
+        exitCode: commandResult.exitCode ?? 0,
+        stdout: commandResult.stdout,
+        stderr: commandResult.stderr,
+        executable: commandEvidence.executable,
+        args: [...commandEvidence.args],
+        cwd: commandEvidence.cwd
       };
     }
-    return this.commandFailure(
-      operation,
-      evidence ? { ...request, args: evidence.args, cwd: evidence.cwd } : request,
-      result
-    );
+    return this.commandFailure(operation, commandEvidence, commandResult);
   }
   commandFailure(operation, request, result) {
     if (result.kind === "preflight_error") {
@@ -21447,11 +22498,29 @@ var NodeGitWorktreeBroker = class {
     };
   }
 };
-function closeOperationBoundary(boundary) {
-  boundary.target?.close();
-  boundary.targetParent.close();
-  boundary.repositoryGit.close();
-  boundary.repository.close();
+async function closeOperationBoundary(boundary) {
+  await boundary.lease.close("completed");
+}
+function nextBoundaryOperationId(boundary, label) {
+  boundary.operationSequence += 1;
+  const suffix = `:${boundary.operationSequence}:${label}`;
+  return `${boundary.operationId.slice(0, 4096 - suffix.length)}${suffix}`;
+}
+function boundaryArgument(argument) {
+  return typeof argument === "string" ? { kind: "literal", value: argument } : argument;
+}
+function evidenceArgument(argument) {
+  if (typeof argument === "string") return argument;
+  if (argument.kind === "literal") return argument.value;
+  const rendered = path33.join(
+    argument.directory.identity.canonical_path,
+    ...argument.components ?? []
+  );
+  return `${argument.prefix ?? ""}${rendered}${argument.suffix ?? ""}`;
+}
+function sameBoundaryIdentity(capability, identity) {
+  const observed = capability.identity;
+  return observed.identity_kind === "linux-device-inode" && observed.device === identity.device.toString(10) && observed.inode === identity.inode.toString(10);
 }
 function nativePathsOverlap2(left, right, comparison) {
   const normalize2 = (value) => {
@@ -21471,35 +22540,18 @@ function branchName(ref) {
   const prefix = "refs/heads/";
   return ref.startsWith(prefix) ? ref.slice(prefix.length) : ref;
 }
-function isNodeError2(error) {
-  return error instanceof Error && "code" in error;
-}
 function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
+  if (error instanceof Error) return error.message;
+  if (typeof error === "object" && error !== null && "message" in error && typeof error.message === "string") {
+    return error.message;
+  }
+  return String(error);
 }
 function isAttemptMarker(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
   const marker = value;
   return marker.schemaVersion === 1 && typeof marker.repositoryId === "string" && typeof marker.attemptId === "string" && typeof marker.hostId === "string" && typeof marker.gitRuntime === "string" && typeof marker.projectRoot === "string" && typeof marker.worktreePath === "string" && typeof marker.branch === "string" && typeof marker.baseSha === "string";
 }
-async function readBoundedText(filePath, maxBytes) {
-  const handle = await open(filePath, constants2.O_RDONLY | constants2.O_NOFOLLOW);
-  try {
-    const stats = await handle.stat();
-    if (!stats.isFile()) throw new Error(`${filePath} is not a regular file`);
-    const buffer = Buffer.alloc(maxBytes + 1);
-    let offset = 0;
-    while (offset < buffer.byteLength) {
-      const { bytesRead } = await handle.read(buffer, offset, buffer.byteLength - offset, offset);
-      if (bytesRead === 0) break;
-      offset += bytesRead;
-    }
-    if (offset > maxBytes) throw new Error(`Attempt marker exceeds ${maxBytes} bytes`);
-    return buffer.subarray(0, offset).toString("utf8");
-  } finally {
-    await handle.close();
-  }
-}
 function tail(value, maxBytes) {
   const bytes = Buffer.from(value, "utf8");
   if (bytes.byteLength <= maxBytes) return value;
@@ -23391,7 +24443,7 @@ async function writeExclusiveText(directory, file, content) {
 async function readOwnerMarker(directory) {
   try {
     const parsed = JSON.parse(
-      await readBoundedText2(path34.join(directory.procPath, OWNER_FILE))
+      await readBoundedText(path34.join(directory.procPath, OWNER_FILE))
     );
     return isOwnerMarker(parsed) ? parsed : null;
   } catch {
@@ -23401,7 +24453,7 @@ async function readOwnerMarker(directory) {
 async function readQuarantineOwnerMarker(directory) {
   try {
     const parsed = JSON.parse(
-      await readBoundedText2(path34.join(directory.procPath, QUARANTINE_OWNER_FILE))
+      await readBoundedText(path34.join(directory.procPath, QUARANTINE_OWNER_FILE))
     );
     return isQuarantineOwnerMarker(parsed) ? parsed : null;
   } catch {
@@ -23581,7 +24633,7 @@ async function readProjectionManifest(repository) {
   try {
     gitDirectory = openChildDirectory(repository, ".git", "native projection Git directory");
     const parsed = JSON.parse(
-      await readBoundedText2(path34.join(gitDirectory.procPath, MANIFEST_FILE))
+      await readBoundedText(path34.join(gitDirectory.procPath, MANIFEST_FILE))
     );
     const result = NativeWslProjectionManifest_v1.safeParse(parsed);
     return result.success ? result.data : null;
@@ -23591,7 +24643,7 @@ async function readProjectionManifest(repository) {
     gitDirectory?.close();
   }
 }
-async function readBoundedText2(file) {
+async function readBoundedText(file) {
   const stats = await lstat(file);
   if (!stats.isFile() || stats.size > MAX_STATE_FILE_BYTES) {
     throw new Error("projection state file is invalid");
@@ -23727,35 +24779,35 @@ function isNodeError3(error) {
 // src/runs/agent-work-projection-lifecycle.ts
 var MAX_INPUT_BYTES2 = 256 * 1024;
 var MAX_ISSUES2 = 20;
-var text = z17.string().min(1).max(4096);
-var mutationAuthority = z17.object({
-  authorized: z17.literal(true),
+var text = z19.string().min(1).max(4096);
+var mutationAuthority = z19.object({
+  authorized: z19.literal(true),
   reason: text.optional()
 }).strict();
-var NativeWslProjectionPrepareRequestSchema = z17.object({
+var NativeWslProjectionPrepareRequestSchema = z19.object({
   request: NativeWslProjectionRequest_v1,
   mutation: mutationAuthority
 }).strict();
-var NativeWslProjectionStatusRequestSchema = z17.object({ request: NativeWslProjectionRequest_v1 }).strict();
-var NativeWslProjectionCleanupRequestSchema = z17.object({
+var NativeWslProjectionStatusRequestSchema = z19.object({ request: NativeWslProjectionRequest_v1 }).strict();
+var NativeWslProjectionCleanupRequestSchema = z19.object({
   request: NativeWslProjectionRequest_v1,
   mutation: mutationAuthority,
-  includeQuarantine: z17.boolean().optional()
+  includeQuarantine: z19.boolean().optional()
 }).strict();
-var NativeWslProjectionQuarantineRequestSchema = z17.object({ request: NativeWslProjectionRequest_v1 }).strict();
-var NativeWslProjectionPrepareRequestJsonSchema = z17.toJSONSchema(
+var NativeWslProjectionQuarantineRequestSchema = z19.object({ request: NativeWslProjectionRequest_v1 }).strict();
+var NativeWslProjectionPrepareRequestJsonSchema = z19.toJSONSchema(
   NativeWslProjectionPrepareRequestSchema,
   { target: "draft-7" }
 );
-var NativeWslProjectionStatusRequestJsonSchema = z17.toJSONSchema(
+var NativeWslProjectionStatusRequestJsonSchema = z19.toJSONSchema(
   NativeWslProjectionStatusRequestSchema,
   { target: "draft-7" }
 );
-var NativeWslProjectionCleanupRequestJsonSchema = z17.toJSONSchema(
+var NativeWslProjectionCleanupRequestJsonSchema = z19.toJSONSchema(
   NativeWslProjectionCleanupRequestSchema,
   { target: "draft-7" }
 );
-var NativeWslProjectionQuarantineRequestJsonSchema = z17.toJSONSchema(
+var NativeWslProjectionQuarantineRequestJsonSchema = z19.toJSONSchema(
   NativeWslProjectionQuarantineRequestSchema,
   { target: "draft-7" }
 );
@@ -23951,17 +25003,17 @@ function isJsonSafe2(value, seen = /* @__PURE__ */ new Set(), depth = 0) {
 // src/runs/agent-work-adapters.ts
 import path38 from "path";
 import { stat as stat3 } from "fs/promises";
-import { z as z24 } from "zod";
+import { z as z26 } from "zod";
 
 // src/schemas/agent-work.ts
-import { z as z18 } from "zod";
+import { z as z20 } from "zod";
 var AGENT_WORK_CONTRACT_VERSION = "1.0.0";
 var AGENT_TASK_RECEIPT_V2_VERSION = "2.0.0";
 var AGENT_TASK_RECEIPT_PATCH_PROFILE = "git-diff-binary-v1";
 var AGENT_ENGINE_VERIFICATION_V2_VERSION = "2.0.0";
-var Id = z18.string().min(1);
-var Timestamp3 = z18.string().datetime();
-var Revision = z18.number().int().nonnegative();
+var Id = z20.string().min(1);
+var Timestamp4 = z20.string().datetime();
+var Revision = z20.number().int().nonnegative();
 function timestampMillis(value) {
   return Date.parse(value);
 }
@@ -23974,15 +25026,15 @@ function requireTimestampOrder(earlier, later, laterPath, ctx) {
     });
   }
 }
-var GitObjectId = z18.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i, "Must be a full SHA-1 or SHA-256 Git object ID");
-var CanonicalGitObjectId2 = z18.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/, "Must be a lowercase full Git object ID");
-var ReceiptTimestampV2 = z18.string().datetime({ offset: true });
-var PortableRepository = z18.object({
+var GitObjectId = z20.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i, "Must be a full SHA-1 or SHA-256 Git object ID");
+var CanonicalGitObjectId2 = z20.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/, "Must be a lowercase full Git object ID");
+var ReceiptTimestampV2 = z20.string().datetime({ offset: true });
+var PortableRepository = z20.object({
   id: Id,
-  remote_url: z18.string().url().optional(),
-  default_branch: z18.string().min(1).optional()
+  remote_url: z20.string().url().optional(),
+  default_branch: z20.string().min(1).optional()
 }).strict();
-var PortableGlob = z18.string().min(1).refine((value) => !isMachineLocalAbsolutePath(value), {
+var PortableGlob = z20.string().min(1).refine((value) => !isMachineLocalAbsolutePath(value), {
   message: "Glob must be repository-relative"
 }).refine((value) => !value.split(/[\\/]/u).includes(".."), {
   message: "Glob must not escape the repository root"
@@ -23998,24 +25050,24 @@ var CanonicalAgentRepoPathV2 = AgentRepoRelativePath.refine((value) => !value.in
 }).refine((value) => value.split("/").every((segment) => segment.length > 0 && segment !== "."), {
   message: "Path must not contain empty or dot segments"
 });
-var PortableScope = z18.object({
-  read_globs: z18.array(PortableGlob),
-  write_globs: z18.array(PortableGlob),
-  deny_globs: z18.array(PortableGlob),
-  cross_repo_allowed: z18.boolean()
+var PortableScope = z20.object({
+  read_globs: z20.array(PortableGlob),
+  write_globs: z20.array(PortableGlob),
+  deny_globs: z20.array(PortableGlob),
+  cross_repo_allowed: z20.boolean()
 }).strict();
-var AuthorityEnvelope = z18.object({
-  edit: z18.boolean(),
-  git_write: z18.boolean(),
-  github_write: z18.boolean(),
-  external_runtime: z18.boolean(),
-  secrets: z18.boolean(),
-  signing: z18.boolean(),
-  release: z18.boolean()
+var AuthorityEnvelope = z20.object({
+  edit: z20.boolean(),
+  git_write: z20.boolean(),
+  github_write: z20.boolean(),
+  external_runtime: z20.boolean(),
+  secrets: z20.boolean(),
+  signing: z20.boolean(),
+  release: z20.boolean()
 }).strict();
-var AcceptanceCriterion = z18.object({
+var AcceptanceCriterion = z20.object({
   id: Id,
-  text: z18.string().min(1)
+  text: z20.string().min(1)
 }).strict();
 function isMachineLocalAbsolutePath(value) {
   return /(?:^|\s)\/(?!\/)[^\s]*/.test(value) || /(?:^|\s)~\/[^\s]*/.test(value) || /(?:^|\s)\\\\[^\s]*/.test(value) || /(?:^|\s)[a-z]:[\\/][^\s]*/i.test(value) || /(?:^|\s)file:/i.test(value);
@@ -24070,27 +25122,27 @@ function requireUniqueStrings(values, field, ctx) {
 function compareCanonicalStrings(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
-var WorkItem_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var WorkItem_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   work_item_id: Id,
   revision: Revision,
-  source: z18.object({
-    kind: z18.enum(["jira", "github", "manual"]),
+  source: z20.object({
+    kind: z20.enum(["jira", "github", "manual"]),
     external_id: Id,
-    revision: z18.string().min(1),
-    url: z18.string().url().optional(),
-    captured_at: Timestamp3
+    revision: z20.string().min(1),
+    url: z20.string().url().optional(),
+    captured_at: Timestamp4
   }).strict(),
   repository: PortableRepository,
-  title: z18.string().min(1),
-  objective: z18.string().min(1),
-  description: z18.string(),
-  acceptance_criteria: z18.array(AcceptanceCriterion),
-  constraints: z18.array(z18.string()),
-  labels: z18.array(z18.string()),
-  dependencies: z18.array(Id)
+  title: z20.string().min(1),
+  objective: z20.string().min(1),
+  description: z20.string(),
+  acceptance_criteria: z20.array(AcceptanceCriterion),
+  constraints: z20.array(z20.string()),
+  labels: z20.array(z20.string()),
+  dependencies: z20.array(Id)
 }).strict();
-var RunStatus = z18.enum([
+var RunStatus = z20.enum([
   "created",
   "planning",
   "ready",
@@ -24104,25 +25156,25 @@ var RunStatus = z18.enum([
   "failed",
   "cancelled"
 ]);
-var RunResumeStatus = z18.enum(["planning", "ready", "executing", "verifying", "delivering"]);
+var RunResumeStatus = z20.enum(["planning", "ready", "executing", "verifying", "delivering"]);
 var INTERRUPTED_RUN_STATUSES = /* @__PURE__ */ new Set(["awaiting_human", "paused", "blocked"]);
 var TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
-var Run_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var Run_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   run_id: Id,
   revision: Revision,
   work_item_id: Id,
   work_item_revision: Revision,
-  control_mode: z18.enum(["assisted", "headless"]),
+  control_mode: z20.enum(["assisted", "headless"]),
   authority_ceiling: AuthorityEnvelope,
   status: RunStatus,
   active_controller_lease_id: Id.optional(),
-  attempt_ids: z18.array(Id),
+  attempt_ids: z20.array(Id),
   current_attempt_id: Id.optional(),
   resume_status: RunResumeStatus.optional(),
-  created_at: Timestamp3,
-  updated_at: Timestamp3,
-  completed_at: Timestamp3.optional()
+  created_at: Timestamp4,
+  updated_at: Timestamp4,
+  completed_at: Timestamp4.optional()
 }).strict().superRefine((run, ctx) => {
   requireTimestampOrder(run.created_at, run.updated_at, "updated_at", ctx);
   if (run.completed_at !== void 0) {
@@ -24158,7 +25210,7 @@ var Run_v1 = z18.object({
     });
   }
 });
-var AttemptStatus = z18.enum([
+var AttemptStatus = z20.enum([
   "prepared",
   "leased",
   "launching",
@@ -24223,8 +25275,8 @@ function attemptStatusRequiresVerification(status) {
 function isTerminalAttemptStatus(status) {
   return TERMINAL_ATTEMPT_STATUSES.has(status);
 }
-var Attempt_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var Attempt_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   attempt_id: Id,
   revision: Revision,
   run_id: Id,
@@ -24238,9 +25290,9 @@ var Attempt_v1 = z18.object({
   receipt_id: Id.optional(),
   verification_id: Id.optional(),
   status: AttemptStatus,
-  created_at: Timestamp3,
-  updated_at: Timestamp3,
-  completed_at: Timestamp3.optional()
+  created_at: Timestamp4,
+  updated_at: Timestamp4,
+  completed_at: Timestamp4.optional()
 }).strict().superRefine((attempt, ctx) => {
   requireTimestampOrder(attempt.created_at, attempt.updated_at, "updated_at", ctx);
   if (attempt.completed_at !== void 0) {
@@ -24283,7 +25335,7 @@ var Attempt_v1 = z18.object({
     });
   }
 });
-var AttemptRetryDeltaDimension_v1 = z18.enum([
+var AttemptRetryDeltaDimension_v1 = z20.enum([
   "evidence",
   "premise",
   "strategy",
@@ -24292,15 +25344,15 @@ var AttemptRetryDeltaDimension_v1 = z18.enum([
   "authority",
   "worker_runtime"
 ]);
-var AttemptRetryDeltaChange_v1 = z18.object({
+var AttemptRetryDeltaChange_v1 = z20.object({
   dimension: AttemptRetryDeltaDimension_v1,
   before_hash: SHA256Hash,
   after_hash: SHA256Hash
 }).strict().refine((change) => change.before_hash !== change.after_hash, {
   message: "A retry change must identify a different durable premise"
 });
-var AttemptRetryEvidenceReference_v1 = z18.object({
-  kind: z18.enum([
+var AttemptRetryEvidenceReference_v1 = z20.object({
+  kind: z20.enum([
     "receipt",
     "verification",
     "fan_in_decision",
@@ -24311,20 +25363,20 @@ var AttemptRetryEvidenceReference_v1 = z18.object({
   id: Id.max(256),
   hash: SHA256Hash
 }).strict();
-var AttemptRetryDelta_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var AttemptRetryDelta_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   previous_attempt_id: Id.max(256),
   next_attempt_id: Id.max(256),
   work_item_id: Id.max(256),
   work_item_revision: Revision,
-  changes: z18.array(AttemptRetryDeltaChange_v1).max(16),
-  inherited_evidence: z18.array(AttemptRetryEvidenceReference_v1).max(64),
-  policy_exception: z18.object({
+  changes: z20.array(AttemptRetryDeltaChange_v1).max(16),
+  inherited_evidence: z20.array(AttemptRetryEvidenceReference_v1).max(64),
+  policy_exception: z20.object({
     policy_id: Id.max(256),
-    reason: z18.string().min(1).max(1024)
+    reason: z20.string().min(1).max(1024)
   }).strict().optional(),
-  summary: z18.string().min(1).max(1024),
-  created_at: Timestamp3
+  summary: z20.string().min(1).max(1024),
+  created_at: Timestamp4
 }).strict().superRefine((delta, context) => {
   if (delta.changes.length === 0 && !delta.policy_exception) {
     context.addIssue({
@@ -24350,14 +25402,14 @@ var AttemptRetryDelta_v1 = z18.object({
     });
   }
 });
-var FanoutRationale_v1 = z18.enum([
+var FanoutRationale_v1 = z20.enum([
   "separable_work",
   "hypothesis_diversity",
   "independent_review",
   "risk_reduction",
   "best_of_n"
 ]);
-var FanoutSelectionCriterion_v1 = z18.enum([
+var FanoutSelectionCriterion_v1 = z20.enum([
   "verification_outcome",
   "trust_gap_count",
   "verified_result_identity"
@@ -24367,30 +25419,30 @@ var STRICT_FANOUT_SELECTION_CRITERIA = [
   "trust_gap_count",
   "verified_result_identity"
 ];
-var FanoutPremise_v1 = z18.object({
+var FanoutPremise_v1 = z20.object({
   premise_id: Id.max(256),
   attempt_id: Id.max(256),
   strategy_hash: SHA256Hash,
-  summary: z18.string().min(1).max(1024)
+  summary: z20.string().min(1).max(1024)
 }).strict();
-var AgentWorkFanoutPlan_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var AgentWorkFanoutPlan_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   fanout_id: Id.max(256),
   run_id: Id.max(256),
   work_item_id: Id.max(256),
   work_item_revision: Revision,
   rationale: FanoutRationale_v1,
-  selection_criteria: z18.array(FanoutSelectionCriterion_v1).length(3),
-  budget: z18.object({
-    max_attempts: z18.number().int().min(2).max(16),
-    max_concurrency: z18.number().int().min(1).max(16),
-    max_elapsed_ms: z18.number().int().positive().max(7 * 24 * 60 * 60 * 1e3),
-    max_context_bytes_per_attempt: z18.number().int().positive().max(1024 * 1024),
-    max_judging_cost_units: z18.number().int().nonnegative().max(1e6)
+  selection_criteria: z20.array(FanoutSelectionCriterion_v1).length(3),
+  budget: z20.object({
+    max_attempts: z20.number().int().min(2).max(16),
+    max_concurrency: z20.number().int().min(1).max(16),
+    max_elapsed_ms: z20.number().int().positive().max(7 * 24 * 60 * 60 * 1e3),
+    max_context_bytes_per_attempt: z20.number().int().positive().max(1024 * 1024),
+    max_judging_cost_units: z20.number().int().nonnegative().max(1e6)
   }).strict(),
-  premises: z18.array(FanoutPremise_v1).min(2).max(16),
-  direct_worker_communication: z18.enum(["forbidden", "brokered"]),
-  created_at: Timestamp3
+  premises: z20.array(FanoutPremise_v1).min(2).max(16),
+  direct_worker_communication: z20.enum(["forbidden", "brokered"]),
+  created_at: Timestamp4
 }).strict().superRefine((plan, context) => {
   if (plan.premises.length > plan.budget.max_attempts) {
     context.addIssue({
@@ -24439,22 +25491,22 @@ var AgentWorkFanoutPlan_v1 = z18.object({
     (left, right) => compareCanonicalStrings(left.attempt_id, right.attempt_id)
   )
 }));
-var FanoutAttemptBinding_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var FanoutAttemptBinding_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   fanout_id: Id.max(256),
   fanout_plan_hash: SHA256Hash,
   premise_id: Id.max(256),
   premise_hash: SHA256Hash,
   attempt_id: Id.max(256)
 }).strict();
-var FanInCandidateConclusion_v1 = z18.enum([
+var FanInCandidateConclusion_v1 = z20.enum([
   "selected",
   "equivalent",
   "unselected",
   "rejected",
   "missing_evidence"
 ]);
-var FanInCandidateEvidence_v1 = z18.object({
+var FanInCandidateEvidence_v1 = z20.object({
   attempt_id: Id.max(256),
   premise_id: Id.max(256),
   attempt_status: AttemptStatus,
@@ -24462,12 +25514,12 @@ var FanInCandidateEvidence_v1 = z18.object({
   receipt_hash: SHA256Hash.optional(),
   verification_id: Id.max(256).optional(),
   verification_hash: SHA256Hash.optional(),
-  verification_outcome: z18.enum(["pass", "fail", "inconclusive", "infrastructure_error", "cancelled"]).optional(),
-  verified_result_identity: z18.union([CanonicalGitObjectId2, SHA256Hash]).optional(),
-  trust_gap_count: z18.number().int().nonnegative().max(64),
+  verification_outcome: z20.enum(["pass", "fail", "inconclusive", "infrastructure_error", "cancelled"]).optional(),
+  verified_result_identity: z20.union([CanonicalGitObjectId2, SHA256Hash]).optional(),
+  trust_gap_count: z20.number().int().nonnegative().max(64),
   conclusion: FanInCandidateConclusion_v1,
-  reason_codes: z18.array(Id.max(256)).max(16),
-  artifact_refs: z18.array(Id.max(256)).max(64)
+  reason_codes: z20.array(Id.max(256)).max(16),
+  artifact_refs: z20.array(Id.max(256)).max(64)
 }).strict().superRefine((candidate, context) => {
   if (candidate.receipt_id === void 0 !== (candidate.receipt_hash === void 0)) {
     context.addIssue({
@@ -24492,25 +25544,25 @@ var FanInCandidateEvidence_v1 = z18.object({
   requireUniqueStrings(candidate.reason_codes, "reason_codes", context);
   requireUniqueStrings(candidate.artifact_refs, "artifact_refs", context);
 });
-var AgentWorkFanInDecision_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var AgentWorkFanInDecision_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   decision_id: Id.max(256),
   fanout_id: Id.max(256),
   fanout_plan_hash: SHA256Hash,
   run_id: Id.max(256),
   work_item_id: Id.max(256),
   work_item_revision: Revision,
-  policy_id: z18.literal("lexrunner.engine-fanin.strict"),
-  policy_version: z18.literal("1.0.0"),
-  selection_criteria: z18.array(FanoutSelectionCriterion_v1).length(3),
-  decision: z18.enum(["selected", "escalated", "no_viable_candidate"]),
+  policy_id: z20.literal("lexrunner.engine-fanin.strict"),
+  policy_version: z20.literal("1.0.0"),
+  selection_criteria: z20.array(FanoutSelectionCriterion_v1).length(3),
+  decision: z20.enum(["selected", "escalated", "no_viable_candidate"]),
   selected_attempt_id: Id.max(256).optional(),
-  candidates: z18.array(FanInCandidateEvidence_v1).min(2).max(16),
-  conflicts: z18.array(Id.max(256)).max(32),
-  uncertainty: z18.array(z18.string().min(1).max(1024)).max(32),
+  candidates: z20.array(FanInCandidateEvidence_v1).min(2).max(16),
+  conflicts: z20.array(Id.max(256)).max(32),
+  uncertainty: z20.array(z20.string().min(1).max(1024)).max(32),
   evidence_set_hash: SHA256Hash,
-  summary: z18.string().min(1).max(2048),
-  created_at: Timestamp3
+  summary: z20.string().min(1).max(2048),
+  created_at: Timestamp4
 }).strict().superRefine((decision, context) => {
   if (decision.decision === "selected" !== (decision.selected_attempt_id !== void 0)) {
     context.addIssue({
@@ -24564,11 +25616,11 @@ function computeFanInEvidenceSetHash(candidates) {
     )
   );
 }
-var AgentTaskPacketBase = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var AgentTaskPacketBase = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   packet_id: Id,
   run_id: Id,
-  work_item: z18.object({
+  work_item: z20.object({
     work_item_id: Id,
     revision: Revision
   }).strict(),
@@ -24576,17 +25628,17 @@ var AgentTaskPacketBase = z18.object({
   repository: PortableRepository.extend({
     base_sha: GitObjectId
   }).strict(),
-  objective: z18.string().min(1),
-  acceptance_criteria: z18.array(AcceptanceCriterion),
-  instructions: z18.array(z18.string()),
+  objective: z20.string().min(1),
+  acceptance_criteria: z20.array(AcceptanceCriterion),
+  instructions: z20.array(z20.string()),
   scope: PortableScope,
   authority: AuthorityEnvelope,
-  preparation: z18.object({
-    policy: z18.object({
-      network: z18.enum(["forbidden", "registry_only"]),
-      registries: z18.array(z18.string().url()).max(8),
-      cache: z18.enum(["disabled", "read_only", "read_write"]),
-      lifecycle_scripts: z18.enum(["forbidden", "allowed"])
+  preparation: z20.object({
+    policy: z20.object({
+      network: z20.enum(["forbidden", "registry_only"]),
+      registries: z20.array(z20.string().url()).max(8),
+      cache: z20.enum(["disabled", "read_only", "read_write"]),
+      lifecycle_scripts: z20.enum(["forbidden", "allowed"])
     }).strict().superRefine((policy, context) => {
       if (policy.network === "forbidden" && policy.registries.length > 0) {
         context.addIssue({
@@ -24604,14 +25656,14 @@ var AgentTaskPacketBase = z18.object({
       }
       requireUniqueStrings(policy.registries, "registries", context);
     }),
-    steps: z18.array(
-      z18.object({
+    steps: z20.array(
+      z20.object({
         id: Id,
-        kind: z18.enum(["provision", "build"]),
-        argv: z18.array(z18.string()).min(1).max(128),
+        kind: z20.enum(["provision", "build"]),
+        argv: z20.array(z20.string()).min(1).max(128),
         cwd_rel: AgentRepoRelativePath.optional(),
-        depends_on: z18.array(Id).max(64),
-        expected_exit_codes: z18.array(z18.number().int()).min(1).max(32)
+        depends_on: z20.array(Id).max(64),
+        expected_exit_codes: z20.array(z20.number().int()).min(1).max(32)
       }).strict().superRefine((step, context) => {
         requireUniqueStrings(step.depends_on, "depends_on", context);
         if (new Set(step.expected_exit_codes).size !== step.expected_exit_codes.length) {
@@ -24624,23 +25676,23 @@ var AgentTaskPacketBase = z18.object({
       })
     ).min(1).max(64)
   }).strict().optional(),
-  verification: z18.array(
-    z18.object({
+  verification: z20.array(
+    z20.object({
       id: Id,
-      argv: z18.array(z18.string()).min(1),
+      argv: z20.array(z20.string()).min(1),
       cwd_rel: AgentRepoRelativePath.optional(),
-      depends_on: z18.array(Id).max(64).optional(),
-      expected_exit_codes: z18.array(z18.number().int()).min(1)
+      depends_on: z20.array(Id).max(64).optional(),
+      expected_exit_codes: z20.array(z20.number().int()).min(1)
     }).strict().superRefine((step, context) => {
       requireUniqueStrings(step.depends_on ?? [], "depends_on", context);
     })
   ),
-  budget: z18.object({
-    max_tokens: z18.number().int().positive().optional(),
-    max_tool_calls: z18.number().int().positive().optional(),
-    max_elapsed_ms: z18.number().int().positive().optional()
+  budget: z20.object({
+    max_tokens: z20.number().int().positive().optional(),
+    max_tool_calls: z20.number().int().positive().optional(),
+    max_elapsed_ms: z20.number().int().positive().optional()
   }).strict(),
-  created_at: Timestamp3,
+  created_at: Timestamp4,
   packet_hash: SHA256Hash
 }).strict();
 var AgentTaskPacketHashInput_v1 = AgentTaskPacketBase.omit({ packet_hash: true });
@@ -24736,8 +25788,8 @@ function validatePacketExecutionGraph(packet, context) {
     });
   }
 }
-var AgentWorkPreparationReceipt_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var AgentWorkPreparationReceipt_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   receipt_id: Id,
   run_id: Id,
   attempt_id: Id,
@@ -24745,12 +25797,12 @@ var AgentWorkPreparationReceipt_v1 = z18.object({
   packet_hash: SHA256Hash,
   preparation_plan_hash: SHA256Hash,
   policy_hash: SHA256Hash,
-  outcome: z18.enum(["passed", "failed"]),
-  steps: z18.array(
-    z18.object({
+  outcome: z20.enum(["passed", "failed"]),
+  steps: z20.array(
+    z20.object({
       id: Id,
-      outcome: z18.enum(["passed", "failed", "blocked"]),
-      exit_code: z18.number().int().optional(),
+      outcome: z20.enum(["passed", "failed", "blocked"]),
+      exit_code: z20.number().int().optional(),
       stdout_hash: SHA256Hash.optional(),
       stderr_hash: SHA256Hash.optional(),
       policy_hash: SHA256Hash.optional()
@@ -24766,8 +25818,8 @@ var AgentWorkPreparationReceipt_v1 = z18.object({
       }
     })
   ).max(64),
-  started_at: Timestamp3,
-  completed_at: Timestamp3,
+  started_at: Timestamp4,
+  completed_at: Timestamp4,
   receipt_hash: SHA256Hash
 }).strict().superRefine((receipt, context) => {
   requireTimestampOrder(receipt.started_at, receipt.completed_at, "completed_at", context);
@@ -24789,12 +25841,12 @@ var AgentWorkPreparationReceipt_v1 = z18.object({
     });
   }
 });
-var AbsolutePath = z18.string().min(1).refine(isMachineLocalAbsolutePath, {
+var AbsolutePath = z20.string().min(1).refine(isMachineLocalAbsolutePath, {
   message: "Must be an absolute machine-local path"
 });
-var ExecutionEnvironmentOS = z18.enum(["linux", "windows", "darwin", "other"]);
-var ExecutionEnvelope_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var ExecutionEnvironmentOS = z20.enum(["linux", "windows", "darwin", "other"]);
+var ExecutionEnvelope_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   envelope_id: Id,
   run_id: Id,
   attempt_id: Id,
@@ -24804,15 +25856,15 @@ var ExecutionEnvelope_v1 = z18.object({
   workspace_lease_revision: Revision,
   expected_head_sha: GitObjectId,
   /** Emitted by Stage 3 launch bundles; optional for pre-Stage-3 v1 envelopes. */
-  branch: z18.string().min(1).optional(),
-  runtime: z18.object({
+  branch: z20.string().min(1).optional(),
+  runtime: z20.object({
     host_id: Id,
     os: ExecutionEnvironmentOS,
-    architecture: z18.string().min(1),
-    worker_runtime: z18.string().min(1),
-    git_runtime: z18.string().min(1)
+    architecture: z20.string().min(1),
+    worker_runtime: z20.string().min(1),
+    git_runtime: z20.string().min(1)
   }).strict(),
-  paths: z18.object({
+  paths: z20.object({
     project_root: AbsolutePath,
     execution_root: AbsolutePath,
     /** Required on new envelopes; optional only so legacy v1 records can be read fail-closed. */
@@ -24823,27 +25875,27 @@ var ExecutionEnvelope_v1 = z18.object({
    * New launch bindings require exactly one mapping. Empty legacy arrays remain
    * structurally readable, but lifecycle evidence validation rejects them.
    */
-  path_mappings: z18.array(AgentExecutionPathMapping_v1).max(1),
-  exposed_environment_keys: z18.array(z18.string().min(1)),
-  created_at: Timestamp3
+  path_mappings: z20.array(AgentExecutionPathMapping_v1).max(1),
+  exposed_environment_keys: z20.array(z20.string().min(1)),
+  created_at: Timestamp4
 }).strict();
-var ControllerLease_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var ControllerLease_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   lease_id: Id,
   run_id: Id,
   controller_id: Id,
-  control_mode: z18.enum(["assisted", "headless"]),
+  control_mode: z20.enum(["assisted", "headless"]),
   /** Monotonic token used to reject operations from superseded controllers. */
-  fence: z18.number().int().positive(),
+  fence: z20.number().int().positive(),
   revision: Revision,
   run_revision: Revision,
-  status: z18.enum(["active", "released", "expired", "revoked"]),
-  acquired_at: Timestamp3,
-  heartbeat_at: Timestamp3,
-  expires_at: Timestamp3,
-  released_at: Timestamp3.optional()
+  status: z20.enum(["active", "released", "expired", "revoked"]),
+  acquired_at: Timestamp4,
+  heartbeat_at: Timestamp4,
+  expires_at: Timestamp4,
+  released_at: Timestamp4.optional()
 }).strict();
-var WorkspaceLeaseStatus = z18.enum([
+var WorkspaceLeaseStatus = z20.enum([
   "reserved",
   "acquired",
   "active",
@@ -24855,14 +25907,14 @@ var WorkspaceLeaseStatus = z18.enum([
   "expired",
   "abandoned"
 ]);
-var WorkspaceCleanupDisposition = z18.enum([
+var WorkspaceCleanupDisposition = z20.enum([
   "integrated",
   "preserved",
   "abandoned",
   "discarded"
 ]);
-var WorkspaceLease_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var WorkspaceLease_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   lease_id: Id,
   revision: Revision,
   run_id: Id,
@@ -24871,19 +25923,19 @@ var WorkspaceLease_v1 = z18.object({
   work_item_revision: Revision,
   attempt_id: Id,
   controller_lease_id: Id,
-  controller_fence: z18.number().int().positive(),
+  controller_fence: z20.number().int().positive(),
   packet_id: Id,
   packet_hash: SHA256Hash,
   repository: PortableRepository,
   base_sha: GitObjectId,
-  branch: z18.string().min(1),
+  branch: z20.string().min(1),
   scope: PortableScope,
   authority: AuthorityEnvelope,
   status: WorkspaceLeaseStatus,
-  acquired_at: Timestamp3,
-  heartbeat_at: Timestamp3,
-  expires_at: Timestamp3,
-  released_at: Timestamp3.optional(),
+  acquired_at: Timestamp4,
+  heartbeat_at: Timestamp4,
+  expires_at: Timestamp4,
+  released_at: Timestamp4.optional(),
   cleanup_disposition: WorkspaceCleanupDisposition.optional()
 }).strict().superRefine((lease, ctx) => {
   requireTimestampOrder(lease.acquired_at, lease.heartbeat_at, "heartbeat_at", ctx);
@@ -24941,9 +25993,9 @@ var WorkspaceLease_v1 = z18.object({
     });
   }
 });
-var WorkspaceAllocationStatus = z18.enum(["allocated", "active", "released", "quarantined"]);
-var WorkspaceAllocation_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var WorkspaceAllocationStatus = z20.enum(["allocated", "active", "released", "quarantined"]);
+var WorkspaceAllocation_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   allocation_id: Id,
   revision: Revision,
   run_id: Id,
@@ -24951,30 +26003,30 @@ var WorkspaceAllocation_v1 = z18.object({
   workspace_lease_id: Id,
   repository: PortableRepository,
   base_sha: GitObjectId,
-  branch: z18.string().min(1),
+  branch: z20.string().min(1),
   host_id: Id,
-  git_runtime: z18.string().min(1),
-  paths: z18.object({
+  git_runtime: z20.string().min(1),
+  paths: z20.object({
     project_root: AbsolutePath,
     worktree_root: AbsolutePath,
     repository_git_common_dir: AbsolutePath,
     worktree_git_dir: AbsolutePath
   }).strict(),
   status: WorkspaceAllocationStatus,
-  observation: z18.object({
-    registration: z18.enum([
+  observation: z20.object({
+    registration: z20.enum([
       "registered",
       "missing",
       "unregistered",
       "wrong_repository",
       "wrong_branch"
     ]),
-    cleanliness: z18.enum(["clean", "dirty", "unknown"]),
-    observed_branch: z18.string().min(1).optional(),
+    cleanliness: z20.enum(["clean", "dirty", "unknown"]),
+    observed_branch: z20.string().min(1).optional(),
     observed_head_sha: GitObjectId.optional(),
-    observed_at: Timestamp3
+    observed_at: Timestamp4
   }).strict().optional(),
-  quarantine_reason: z18.enum([
+  quarantine_reason: z20.enum([
     "dirty",
     "missing",
     "unregistered",
@@ -24984,11 +26036,11 @@ var WorkspaceAllocation_v1 = z18.object({
     "expired",
     "other"
   ]).optional(),
-  quarantine_evidence: z18.array(z18.string().min(1)).min(1).optional(),
-  allocated_at: Timestamp3,
-  updated_at: Timestamp3,
-  released_at: Timestamp3.optional(),
-  quarantined_at: Timestamp3.optional()
+  quarantine_evidence: z20.array(z20.string().min(1)).min(1).optional(),
+  allocated_at: Timestamp4,
+  updated_at: Timestamp4,
+  released_at: Timestamp4.optional(),
+  quarantined_at: Timestamp4.optional()
 }).strict().superRefine((allocation, ctx) => {
   requireTimestampOrder(allocation.allocated_at, allocation.updated_at, "updated_at", ctx);
   if (allocation.observation !== void 0) {
@@ -25071,8 +26123,8 @@ var WorkspaceAllocation_v1 = z18.object({
     requireTimestampOrder(allocation.quarantined_at, allocation.updated_at, "updated_at", ctx);
   }
 });
-var WorkerSessionBackend = z18.enum(["host-subagent", "codex-cli", "external"]);
-var WorkerSessionStatus = z18.enum([
+var WorkerSessionBackend = z20.enum(["host-subagent", "codex-cli", "external"]);
+var WorkerSessionStatus = z20.enum([
   "starting",
   "running",
   "awaiting_human",
@@ -25081,8 +26133,8 @@ var WorkerSessionStatus = z18.enum([
   "cancelled",
   "lost"
 ]);
-var WorkerSession_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var WorkerSession_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   session_id: Id,
   run_id: Id,
   attempt_id: Id,
@@ -25091,26 +26143,26 @@ var WorkerSession_v1 = z18.object({
   workspace_lease_id: Id,
   workspace_lease_revision: Revision,
   execution_envelope_id: Id,
-  worker: z18.object({
+  worker: z20.object({
     backend: WorkerSessionBackend,
     worker_id: Id,
-    model: z18.string().min(1).optional()
+    model: z20.string().min(1).optional()
   }).strict(),
   status: WorkerSessionStatus,
-  started_at: Timestamp3,
-  heartbeat_at: Timestamp3,
-  ended_at: Timestamp3.optional()
+  started_at: Timestamp4,
+  heartbeat_at: Timestamp4,
+  ended_at: Timestamp4.optional()
 }).strict();
-var ClaimedCheckOutcome = z18.enum(["pass", "fail", "not_run"]);
-var ClaimedCheck = z18.object({
+var ClaimedCheckOutcome = z20.enum(["pass", "fail", "not_run"]);
+var ClaimedCheck = z20.object({
   id: Id,
   outcome: ClaimedCheckOutcome,
-  exit_code: z18.number().int().optional(),
-  output_snippet: z18.string().optional()
+  exit_code: z20.number().int().optional(),
+  output_snippet: z20.string().optional()
 }).strict();
-var AgentTaskReceiptOutcome = z18.enum(["completed", "blocked", "failed", "cancelled"]);
-var AgentTaskReceipt_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var AgentTaskReceiptOutcome = z20.enum(["completed", "blocked", "failed", "cancelled"]);
+var AgentTaskReceipt_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   receipt_id: Id,
   run_id: Id,
   work_item_id: Id,
@@ -25123,21 +26175,21 @@ var AgentTaskReceipt_v1 = z18.object({
   base_sha: GitObjectId,
   final_head_sha: GitObjectId.optional(),
   outcome: AgentTaskReceiptOutcome,
-  summary: z18.string().min(1),
-  files_touched: z18.array(RepoRelativePath),
-  commits: z18.array(GitObjectId),
-  acceptance_criteria_addressed: z18.array(Id),
-  claimed_checks: z18.array(ClaimedCheck),
-  assumptions: z18.array(z18.string()),
-  blockers: z18.array(z18.string()),
-  human_action_request_ids: z18.array(Id),
-  cost: z18.object({
-    input_tokens: z18.number().int().nonnegative().optional(),
-    output_tokens: z18.number().int().nonnegative().optional(),
-    tool_calls: z18.number().int().nonnegative().optional(),
-    elapsed_ms: z18.number().int().nonnegative().optional()
+  summary: z20.string().min(1),
+  files_touched: z20.array(RepoRelativePath),
+  commits: z20.array(GitObjectId),
+  acceptance_criteria_addressed: z20.array(Id),
+  claimed_checks: z20.array(ClaimedCheck),
+  assumptions: z20.array(z20.string()),
+  blockers: z20.array(z20.string()),
+  human_action_request_ids: z20.array(Id),
+  cost: z20.object({
+    input_tokens: z20.number().int().nonnegative().optional(),
+    output_tokens: z20.number().int().nonnegative().optional(),
+    tool_calls: z20.number().int().nonnegative().optional(),
+    elapsed_ms: z20.number().int().nonnegative().optional()
   }).strict(),
-  submitted_at: Timestamp3
+  submitted_at: Timestamp4
 }).strict().superRefine((receipt, ctx) => {
   if (receipt.outcome === "completed" && receipt.final_head_sha === void 0) {
     ctx.addIssue({
@@ -25154,8 +26206,8 @@ var AgentTaskReceipt_v1 = z18.object({
     });
   }
 });
-var AgentTaskReceipt_v2 = z18.object({
-  schema_version: z18.literal(AGENT_TASK_RECEIPT_V2_VERSION),
+var AgentTaskReceipt_v2 = z20.object({
+  schema_version: z20.literal(AGENT_TASK_RECEIPT_V2_VERSION),
   receipt_id: Id,
   run_id: Id,
   work_item_id: Id,
@@ -25179,19 +26231,19 @@ var AgentTaskReceipt_v2 = z18.object({
   patch_hash: SHA256Hash.optional(),
   outcome: AgentTaskReceiptOutcome,
   exit_reason: Id,
-  summary: z18.string().min(1),
-  files_touched: z18.array(CanonicalAgentRepoPathV2),
-  commits: z18.array(CanonicalGitObjectId2),
-  acceptance_criteria_addressed: z18.array(Id),
-  claimed_checks: z18.array(ClaimedCheck),
-  assumptions: z18.array(z18.string()),
-  blockers: z18.array(z18.string()),
-  human_action_request_ids: z18.array(Id),
-  cost: z18.object({
-    input_tokens: z18.number().int().nonnegative().optional(),
-    output_tokens: z18.number().int().nonnegative().optional(),
-    tool_calls: z18.number().int().nonnegative().optional(),
-    elapsed_ms: z18.number().int().nonnegative().optional()
+  summary: z20.string().min(1),
+  files_touched: z20.array(CanonicalAgentRepoPathV2),
+  commits: z20.array(CanonicalGitObjectId2),
+  acceptance_criteria_addressed: z20.array(Id),
+  claimed_checks: z20.array(ClaimedCheck),
+  assumptions: z20.array(z20.string()),
+  blockers: z20.array(z20.string()),
+  human_action_request_ids: z20.array(Id),
+  cost: z20.object({
+    input_tokens: z20.number().int().nonnegative().optional(),
+    output_tokens: z20.number().int().nonnegative().optional(),
+    tool_calls: z20.number().int().nonnegative().optional(),
+    elapsed_ms: z20.number().int().nonnegative().optional()
   }).strict(),
   worker_started_at: ReceiptTimestampV2,
   worker_completed_at: ReceiptTimestampV2,
@@ -25250,15 +26302,15 @@ function validateAgentTaskReceiptV2PacketReferences(packet, receipt) {
   ];
   return { valid: errors.length === 0, errors };
 }
-var VerificationOutcome = z18.enum([
+var VerificationOutcome = z20.enum([
   "pass",
   "fail",
   "inconclusive",
   "infrastructure_error",
   "cancelled"
 ]);
-var AgentEngineVerification_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var AgentEngineVerification_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   verification_id: Id,
   run_id: Id,
   work_item_id: Id,
@@ -25273,55 +26325,55 @@ var AgentEngineVerification_v1 = z18.object({
   base_sha: GitObjectId,
   verified_head_sha: GitObjectId.optional(),
   outcome: VerificationOutcome,
-  summary: z18.string().min(1),
-  checks: z18.array(
-    z18.object({
+  summary: z20.string().min(1),
+  checks: z20.array(
+    z20.object({
       id: Id,
       outcome: VerificationOutcome,
-      exit_code: z18.number().int().optional(),
-      stdout_snippet: z18.string().optional(),
-      stderr_snippet: z18.string().optional(),
-      artifact_refs: z18.array(z18.string())
+      exit_code: z20.number().int().optional(),
+      stdout_snippet: z20.string().optional(),
+      stderr_snippet: z20.string().optional(),
+      artifact_refs: z20.array(z20.string())
     }).strict()
   ),
-  failures: z18.array(z18.string()),
-  trust_gap: z18.boolean(),
+  failures: z20.array(z20.string()),
+  trust_gap: z20.boolean(),
   verifier_id: Id,
-  started_at: Timestamp3,
-  completed_at: Timestamp3
+  started_at: Timestamp4,
+  completed_at: Timestamp4
 }).strict();
-var EngineVerificationCheckSource_v2 = z18.enum(["packet", "engine_extra"]);
-var EngineVerificationDeterminism_v2 = z18.enum([
+var EngineVerificationCheckSource_v2 = z20.enum(["packet", "engine_extra"]);
+var EngineVerificationDeterminism_v2 = z20.enum([
   "deterministic",
   "externally_nondeterministic",
   "unknown"
 ]);
-var EngineVerificationTrustGapReason_v2 = z18.enum([
+var EngineVerificationTrustGapReason_v2 = z20.enum([
   "worker_outcome_disagrees",
   "head_identity_disagrees",
   "patch_identity_disagrees",
   "claimed_check_disagrees",
   "authority_deviation"
 ]);
-var AgentEngineVerificationCheck_v2 = z18.object({
+var AgentEngineVerificationCheck_v2 = z20.object({
   id: Id,
   source: EngineVerificationCheckSource_v2,
   outcome: VerificationOutcome,
   command_hash: SHA256Hash,
   cwd_rel: CanonicalAgentRepoPathV2.optional(),
   environment_fingerprint: SHA256Hash,
-  exit_code: z18.number().int().optional(),
+  exit_code: z20.number().int().optional(),
   stdout_hash: SHA256Hash.optional(),
   stderr_hash: SHA256Hash.optional(),
-  stdout_snippet: z18.string().max(4096).optional(),
-  stderr_snippet: z18.string().max(4096).optional(),
-  duration_ms: z18.number().int().nonnegative(),
-  retry_count: z18.number().int().nonnegative(),
-  artifact_refs: z18.array(z18.string().min(1).max(1024)).max(512),
+  stdout_snippet: z20.string().max(4096).optional(),
+  stderr_snippet: z20.string().max(4096).optional(),
+  duration_ms: z20.number().int().nonnegative(),
+  retry_count: z20.number().int().nonnegative(),
+  artifact_refs: z20.array(z20.string().min(1).max(1024)).max(512),
   determinism: EngineVerificationDeterminism_v2
 }).strict();
-var AgentEngineVerification_v2 = z18.object({
-  schema_version: z18.literal(AGENT_ENGINE_VERIFICATION_V2_VERSION),
+var AgentEngineVerification_v2 = z20.object({
+  schema_version: z20.literal(AGENT_ENGINE_VERIFICATION_V2_VERSION),
   verification_id: Id,
   run_id: Id,
   work_item_id: Id,
@@ -25340,10 +26392,10 @@ var AgentEngineVerification_v2 = z18.object({
   verified_patch_hash: SHA256Hash.optional(),
   workspace_observation_hash: SHA256Hash,
   outcome: VerificationOutcome,
-  summary: z18.string().min(1).max(4096),
-  checks: z18.array(AgentEngineVerificationCheck_v2).max(1024),
-  failures: z18.array(z18.string().min(1).max(2048)).max(1024),
-  trust_gap_reasons: z18.array(EngineVerificationTrustGapReason_v2).max(16),
+  summary: z20.string().min(1).max(4096),
+  checks: z20.array(AgentEngineVerificationCheck_v2).max(1024),
+  failures: z20.array(z20.string().min(1).max(2048)).max(1024),
+  trust_gap_reasons: z20.array(EngineVerificationTrustGapReason_v2).max(16),
   verifier_id: Id,
   verifier_version: Id,
   started_at: ReceiptTimestampV2,
@@ -25489,19 +26541,19 @@ function mismatchErrors(values) {
     ([field, expectedValue, actualValue]) => `${field} mismatch: expected=${String(expectedValue)}, actual=${String(actualValue)}`
   );
 }
-var HumanActionPreconditions = z18.object({
+var HumanActionPreconditions = z20.object({
   run_revision: Revision,
   workspace_lease_revision: Revision,
   expected_head_sha: GitObjectId
 }).strict();
-var HumanActionRequest_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var HumanActionRequest_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   request_id: Id,
   run_id: Id,
   attempt_id: Id,
   workspace_lease_id: Id,
   worker_session_id: Id,
-  action: z18.enum([
+  action: z20.enum([
     "approve_scope",
     "sign_commit",
     "authenticate",
@@ -25509,15 +26561,15 @@ var HumanActionRequest_v1 = z18.object({
     "approve_merge",
     "other"
   ]),
-  summary: z18.string().min(1),
-  instructions: z18.array(z18.string()).min(1),
-  suggested_commands: z18.array(z18.string()),
+  summary: z20.string().min(1),
+  instructions: z20.array(z20.string()).min(1),
+  suggested_commands: z20.array(z20.string()),
   preconditions: HumanActionPreconditions,
-  requested_at: Timestamp3,
-  expires_at: Timestamp3.optional()
+  requested_at: Timestamp4,
+  expires_at: Timestamp4.optional()
 }).strict();
-var HumanActionReceipt_v1 = z18.object({
-  schema_version: z18.literal(AGENT_WORK_CONTRACT_VERSION),
+var HumanActionReceipt_v1 = z20.object({
+  schema_version: z20.literal(AGENT_WORK_CONTRACT_VERSION),
   receipt_id: Id,
   request_id: Id,
   run_id: Id,
@@ -25525,11 +26577,11 @@ var HumanActionReceipt_v1 = z18.object({
   workspace_lease_id: Id,
   worker_session_id: Id,
   observed_preconditions: HumanActionPreconditions,
-  outcome: z18.enum(["completed", "declined", "expired", "failed"]),
+  outcome: z20.enum(["completed", "declined", "expired", "failed"]),
   actor_id: Id,
-  summary: z18.string().min(1),
+  summary: z20.string().min(1),
   resulting_head_sha: GitObjectId.optional(),
-  completed_at: Timestamp3
+  completed_at: Timestamp4
 }).strict();
 function validateHumanActionReceiptBinding(request, receipt) {
   const expected = [
@@ -25606,125 +26658,125 @@ function parseHumanActionReceipt(data) {
 }
 
 // src/runs/types.ts
-import { z as z20 } from "zod";
+import { z as z22 } from "zod";
 
 // src/schemas/runCentric.ts
-import { z as z19 } from "zod";
-var PersonaSnapshotSchema = z19.object({
+import { z as z21 } from "zod";
+var PersonaSnapshotSchema = z21.object({
   /** Persona mode identifier, e.g. "senior-dev", "reviewer", "security-auditor" */
-  mode: z19.string(),
+  mode: z21.string(),
   /** Actions that are forbidden under this persona */
-  forbidden: z19.array(z19.string()),
+  forbidden: z21.array(z21.string()),
   /** Gates that must pass before completion */
-  completionGates: z19.array(z19.string()),
+  completionGates: z21.array(z21.string()),
   /** Decision-making style preferences */
-  decisionStyle: z19.object({
+  decisionStyle: z21.object({
     /** Prefer small, incremental diffs over large changes */
-    preferSmallDiffs: z19.boolean().optional(),
+    preferSmallDiffs: z21.boolean().optional(),
     /** Require explicit rationale when skipping steps */
-    requireRationaleForSkips: z19.boolean().optional(),
+    requireRationaleForSkips: z21.boolean().optional(),
     /** Escalate security findings to higher attention */
-    escalateSecurityFindings: z19.boolean().optional()
+    escalateSecurityFindings: z21.boolean().optional()
   }).optional(),
   /** Output formatting preferences */
-  outputFormat: z19.object({
+  outputFormat: z21.object({
     /** Severity levels for findings, e.g. ["critical", "high", "medium", "low"] */
-    severityLevels: z19.array(z19.string()).optional(),
+    severityLevels: z21.array(z21.string()).optional(),
     /** Whether findings must include a severity level */
-    requireSeverityOnFindings: z19.boolean().optional()
+    requireSeverityOnFindings: z21.boolean().optional()
   }).optional()
 });
-var NextOptionSchema = z19.object({
+var NextOptionSchema = z21.object({
   /** Action identifier, e.g. "merge_next", "abort_run", "resolve_conflict" */
-  action: z19.string(),
+  action: z21.string(),
   /** Verb-first description, at most one sentence */
-  description: z19.string(),
+  description: z21.string(),
   // Decision point fields
   /** Whether this action requires an LLM decision */
-  requiresLLMDecision: z19.boolean().optional(),
+  requiresLLMDecision: z21.boolean().optional(),
   /** Prompt to present to the LLM for decision-making */
-  prompt: z19.string().optional(),
+  prompt: z21.string().optional(),
   /** JSON Schema describing the expected response format */
-  responseSchema: z19.record(z19.string(), z19.unknown()).optional(),
+  responseSchema: z21.record(z21.string(), z21.unknown()).optional(),
   // Guidance
   /** The objective to achieve with this action */
-  objective: z19.string().optional(),
+  objective: z21.string().optional(),
   /** Constraints that must be respected */
-  constraints: z19.array(z19.string()).optional(),
+  constraints: z21.array(z21.string()).optional(),
   /** Output style preference */
-  style: z19.enum(["brief", "detailed"]).optional(),
+  style: z21.enum(["brief", "detailed"]).optional(),
   /** Risk level assessment for this action */
-  riskLevel: z19.enum(["low", "medium", "high"]).optional()
+  riskLevel: z21.enum(["low", "medium", "high"]).optional()
 });
-var StatusResponseSchema = z19.object({
+var StatusResponseSchema = z21.object({
   /** Unique run identifier */
-  runId: z19.string(),
+  runId: z21.string(),
   // Core run identity
   /** Current state, e.g. "planning", "gated", "executing", "completed", "failed" */
-  state: z19.string(),
+  state: z21.string(),
   /** Persona mode, e.g. "senior-dev" */
-  mode: z19.string(),
+  mode: z21.string(),
   /** Procedure identifier, e.g. "merge-weave-main" */
-  procedure: z19.string(),
+  procedure: z21.string(),
   // Human-readable recap
   /** Single sentence orientation summary */
-  summary: z19.string(),
+  summary: z21.string(),
   // Progress tracking
   /** Progress information with completed, current, and remaining steps */
-  progress: z19.object({
+  progress: z21.object({
     /** List of completed step identifiers */
-    completed: z19.array(z19.string()),
+    completed: z21.array(z21.string()),
     /** Current step identifier, or null if between steps */
-    current: z19.string().nullable(),
+    current: z21.string().nullable(),
     /** List of remaining step identifiers */
-    remaining: z19.array(z19.string())
+    remaining: z21.array(z21.string())
   }).optional(),
   // Canonical action set
   /** Available next actions - the ONLY source of allowed actions */
-  nextOptions: z19.array(NextOptionSchema),
+  nextOptions: z21.array(NextOptionSchema),
   // Additional context
   /** Additional context as key-value pairs */
-  context: z19.record(z19.string(), z19.unknown()).optional(),
+  context: z21.record(z21.string(), z21.unknown()).optional(),
   /** Risk flags for the current state */
-  riskFlags: z19.array(z19.string()).optional(),
+  riskFlags: z21.array(z21.string()).optional(),
   /** Blocking issues that prevent progress */
-  blockers: z19.array(z19.string()).optional(),
+  blockers: z21.array(z21.string()).optional(),
   // Persona snapshot
   /** Snapshot of the active persona configuration */
   persona: PersonaSnapshotSchema.optional()
 });
 
 // src/runs/types.ts
-var RunStateSchema = z20.object({
+var RunStateSchema = z22.object({
   /** Unique run identifier (ULID) */
-  runId: z20.string(),
+  runId: z22.string(),
   /** Persona mode, e.g. "senior-dev", "eager-pm" */
-  mode: z20.string(),
+  mode: z22.string(),
   /** Procedure being executed, e.g. "merge-weave-main", "pr-review" */
-  procedure: z20.string(),
+  procedure: z22.string(),
   /** Repository identifier (owner/repo or path) */
-  repo: z20.string(),
+  repo: z22.string(),
   /** Optional task description */
-  task: z20.string().optional(),
+  task: z22.string().optional(),
   // Lifecycle
   /** Current state in procedure state machine */
-  state: z20.string(),
+  state: z22.string(),
   /** ISO 8601 timestamp when run was created */
-  createdAt: z20.string(),
+  createdAt: z22.string(),
   /** ISO 8601 timestamp when run was last updated */
-  updatedAt: z20.string(),
+  updatedAt: z22.string(),
   /** ISO 8601 timestamp when run completed (if applicable) */
-  completedAt: z20.string().optional(),
+  completedAt: z22.string().optional(),
   // Progress
   /** List of completed step identifiers */
-  completedSteps: z20.array(z20.string()),
+  completedSteps: z22.array(z22.string()),
   /** Current step identifier, or null if between steps */
-  currentStep: z20.string().nullable(),
+  currentStep: z22.string().nullable(),
   // Context
   /** Runtime parameters for the run */
-  params: z20.record(z20.string(), z20.unknown()),
+  params: z22.record(z22.string(), z22.unknown()),
   /** Additional metadata for the run */
-  metadata: z20.record(z20.string(), z20.unknown()),
+  metadata: z22.record(z22.string(), z22.unknown()),
   // Persona snapshot (frozen at run start)
   /** Snapshot of the active persona configuration */
   persona: PersonaSnapshotSchema.optional()
@@ -25732,20 +26784,20 @@ var RunStateSchema = z20.object({
 function parseRunState(data) {
   return RunStateSchema.parse(data);
 }
-var StartRunInputSchema = z20.object({
+var StartRunInputSchema = z22.object({
   /** Persona mode, e.g. "senior-dev", "eager-pm" */
-  mode: z20.string(),
+  mode: z22.string(),
   /** Procedure identifier, e.g. "merge-weave-main", "pr-review" */
-  procedure: z20.string(),
+  procedure: z22.string(),
   /** Repository in "owner/repo" format */
-  repo: z20.string(),
+  repo: z22.string(),
   /** Human-readable task description */
-  task: z20.string().optional(),
+  task: z22.string().optional(),
   /** Procedure-specific parameters */
-  params: z20.record(z20.string(), z20.unknown()).optional()
+  params: z22.record(z22.string(), z22.unknown()).optional()
 });
-var GetStatusInputSchema = z20.object({
-  runId: z20.string()
+var GetStatusInputSchema = z22.object({
+  runId: z22.string()
 });
 var RunNotFoundError = class extends Error {
   constructor(runId) {
@@ -26121,6 +27173,14 @@ function boundedControllerLease(lease) {
 import path35 from "path";
 import { realpath, stat } from "fs/promises";
 
+// src/workspaces/git-worktree-broker.ts
+function withBrokerBoundaryAuthority(options, authority2) {
+  return {
+    ...options,
+    boundaryAuthority: { ...authority2 }
+  };
+}
+
 // src/runs/agent-work-path-mapping.ts
 function createAttemptExecutionPathMapping(input) {
   const identities = captureBoundIdentities(input);
@@ -26342,7 +27402,12 @@ async function assertCurrentWorkspace(runtime, lifecycle, input) {
       attemptId: lifecycle.attempt.attemptId,
       baseSha: lifecycle.attempt.baseSha
     },
-    input.attempt.broker
+    withBrokerBoundaryAuthority(input.attempt.broker, {
+      operationId: input.attempt.mutations.authorizeLaunch.mutationId,
+      orchestrationLeaseId: lifecycle.workspace.leaseId,
+      orchestrationLeaseRevision: lifecycle.workspace.revision,
+      ownerId: lifecycle.controllerLease.controllerId
+    })
   );
   if (!observation.ok) {
     throw new Error(`Launch workspace observation failed: ${observation.reason}`);
@@ -26388,7 +27453,7 @@ function assertAuthorizedBinding(lifecycle, input, runtime, packet) {
 
 // src/runs/agent-work-runtime.ts
 import path37 from "path";
-import { z as z23 } from "zod";
+import { z as z25 } from "zod";
 
 // src/store/sqlite/workspace-lifecycle-store.ts
 import { readFileSync as readFileSync27 } from "fs";
@@ -26506,8 +27571,8 @@ function credentialFailureReason(lease, credential2) {
 }
 
 // src/store/workspace-lifecycle-domains.ts
-import { z as z21 } from "zod";
-var WorkspaceLifecycleLeaseStatus = z21.enum([
+import { z as z23 } from "zod";
+var WorkspaceLifecycleLeaseStatus = z23.enum([
   "reserved",
   "active",
   "released",
@@ -26524,8 +27589,8 @@ var ReleaseWorkspaceDisposition = WorkspaceCleanupDisposition.extract([
   "integrated",
   "discarded"
 ]);
-var WorkspaceReconciliationAction = z21.enum(["resume", "release", "preserve", "abandon"]);
-var WorkspaceLifecycleEventType = z21.enum([
+var WorkspaceReconciliationAction = z23.enum(["resume", "release", "preserve", "abandon"]);
+var WorkspaceLifecycleEventType = z23.enum([
   "attempt_created",
   "attempt_transitioned",
   "workspace_acquired",
@@ -26534,23 +27599,23 @@ var WorkspaceLifecycleEventType = z21.enum([
   "workspace_reconciled",
   "workspace_quarantined"
 ]);
-var WorkerSessionEventType = z21.enum([
+var WorkerSessionEventType = z23.enum([
   "worker_session_attached",
   "worker_session_heartbeat",
   "worker_session_ended"
 ]);
-var AttemptReceiptDisposition = z21.enum(["verification_pending", "retained_late"]);
-var AttemptReceiptEventType = z21.enum([
+var AttemptReceiptDisposition = z23.enum(["verification_pending", "retained_late"]);
+var AttemptReceiptEventType = z23.enum([
   "attempt_receipt_submitted",
   "attempt_receipt_retained_late",
   "attempt_receipt_replayed"
 ]);
-var AttemptVerificationEventType = z21.enum([
+var AttemptVerificationEventType = z23.enum([
   "attempt_verification_started",
   "attempt_verification_recorded",
   "attempt_verification_replayed"
 ]);
-var WorkerAuthorityDimension = z21.enum([
+var WorkerAuthorityDimension = z23.enum([
   "edit",
   "git_write",
   "github_write",
@@ -26559,15 +27624,15 @@ var WorkerAuthorityDimension = z21.enum([
   "signing",
   "release"
 ]);
-var WorkerAuthorityDecision = z21.enum(["allowed", "denied", "deviation"]);
-var WorkerAuthorityEnforcement = z21.enum(["enforced", "brokered", "unenforced"]);
-var WorkerAuthorityReason = z21.enum([
+var WorkerAuthorityDecision = z23.enum(["allowed", "denied", "deviation"]);
+var WorkerAuthorityEnforcement = z23.enum(["enforced", "brokered", "unenforced"]);
+var WorkerAuthorityReason = z23.enum([
   "packet_granted",
   "packet_denied",
   "backend_unenforceable",
   "observed_after_execution"
 ]);
-var WorkspaceMutationFailureReason = z21.enum([
+var WorkspaceMutationFailureReason = z23.enum([
   "not_found",
   "no_active_lease",
   "lease_mismatch",
@@ -26593,38 +27658,38 @@ var WorkspaceMutationFailureReason = z21.enum([
   "retry_delta_invalid",
   "fanout_invalid"
 ]);
-var WorkerSessionMutationFailureReason = z21.enum([
+var WorkerSessionMutationFailureReason = z23.enum([
   ...WorkspaceMutationFailureReason.options,
   "stale_session_revision",
   "worker_session_not_active",
   "worker_session_conflict"
 ]);
-var AttemptReceiptFailureReason = z21.enum([
+var AttemptReceiptFailureReason = z23.enum([
   ...WorkspaceMutationFailureReason.options,
   "stale_session_revision",
   "worker_session_not_active",
   "receipt_conflict"
 ]);
-var AttemptVerificationFailureReason = z21.enum([
+var AttemptVerificationFailureReason = z23.enum([
   ...WorkspaceMutationFailureReason.options,
   "stale_session_revision",
   "verification_conflict"
 ]);
-var WorkspaceObservationCleanliness = z21.enum(["clean", "dirty"]);
-var WorkspaceObservation = z21.object({
-  exists: z21.boolean(),
-  registered: z21.boolean(),
-  repositoryId: z21.string().nullable(),
-  hostId: z21.string(),
-  gitRuntime: z21.string(),
-  projectRoot: z21.string().nullable(),
-  branch: z21.string().nullable(),
-  worktreePath: z21.string(),
-  attemptId: z21.string().nullable(),
-  headSha: z21.string().nullable(),
+var WorkspaceObservationCleanliness = z23.enum(["clean", "dirty"]);
+var WorkspaceObservation = z23.object({
+  exists: z23.boolean(),
+  registered: z23.boolean(),
+  repositoryId: z23.string().nullable(),
+  hostId: z23.string(),
+  gitRuntime: z23.string(),
+  projectRoot: z23.string().nullable(),
+  branch: z23.string().nullable(),
+  worktreePath: z23.string(),
+  attemptId: z23.string().nullable(),
+  headSha: z23.string().nullable(),
   cleanliness: WorkspaceObservationCleanliness,
-  dirtyPaths: z21.array(z21.string()).optional(),
-  reason: z21.string().optional()
+  dirtyPaths: z23.array(z23.string()).optional(),
+  reason: z23.string().optional()
 }).strict();
 var ATTEMPT_TRANSITIONS = {
   prepared: ["cancelled"],
@@ -30682,7 +31747,15 @@ var WorkspaceCoordinator = class {
       return reconciliation("reserve", current);
     }
     const target = targetFrom(current.lease);
-    const created = await this.create(target, input.broker);
+    const created = await this.create(
+      target,
+      boundaryBrokerOptions(
+        input.broker,
+        current.lease,
+        input.mutations.reserve.mutationId,
+        input.controller.controllerId
+      )
+    );
     if (!created.ok) {
       return this.quarantineAfterFailure(
         input,
@@ -30742,7 +31815,15 @@ var WorkspaceCoordinator = class {
     const records = await this.readExpected(input, false, true);
     if (!records.ok) return records.failure;
     const target = targetFrom(records.lease);
-    const observed = await this.observe(target, input.broker);
+    const observed = await this.observe(
+      target,
+      boundaryBrokerOptions(
+        input.broker,
+        records.lease,
+        input.mutations.heartbeat.mutationId,
+        input.controller.controllerId
+      )
+    );
     if (!observed.ok) {
       if (records.replayCandidate) {
         return {
@@ -30800,7 +31881,15 @@ var WorkspaceCoordinator = class {
     const records = await this.readExpected(input, true, true);
     if (!records.ok) return records.failure;
     const target = targetFrom(records.lease);
-    const observed = await this.observe(target, input.broker);
+    const observed = await this.observe(
+      target,
+      boundaryBrokerOptions(
+        input.broker,
+        records.lease,
+        input.mutation.mutationId,
+        input.controller.controllerId
+      )
+    );
     const observation = observed.ok ? observed.observation : observed.observation ?? syntheticObservation(target, observed);
     const safeResume = observed.ok && ownedObservation(records.lease, observation) && observation.cleanliness === "clean";
     if (!safeResume && records.replayCandidate) {
@@ -30921,7 +32010,15 @@ var WorkspaceCoordinator = class {
         return reconciliation("release_prepare", current);
       }
     }
-    const observed = await this.observe(target, input.broker);
+    const observed = await this.observe(
+      target,
+      boundaryBrokerOptions(
+        input.broker,
+        current.lease,
+        input.mutations.prepare.mutationId,
+        input.controller.controllerId
+      )
+    );
     if (!observed.ok) {
       return this.quarantineAfterFailure(
         input,
@@ -30967,7 +32064,15 @@ var WorkspaceCoordinator = class {
     const preparedAttempt = preparedRevisions ? current.attempt : prepared.attempt;
     const preparedLease = preparedRevisions ? current.lease : prepared.workspaceLease;
     const releaseEvidence = preparedRevisions ? current.lease.lastObservation ?? observed.observation : observed.observation;
-    const removed = await this.remove(target, input.broker);
+    const removed = await this.remove(
+      target,
+      boundaryBrokerOptions(
+        input.broker,
+        preparedLease,
+        input.mutations.finalize.mutationId,
+        input.controller.controllerId
+      )
+    );
     if (!removed.ok || removed.outcome === "preserved") {
       const failure2 = removed.ok ? void 0 : removed;
       const observation = removed.ok ? removed.observation : removed.observation ?? syntheticObservation(target, removed);
@@ -31152,6 +32257,14 @@ function targetFrom(lease) {
     baseSha: lease.baseSha
   };
 }
+function boundaryBrokerOptions(options, lease, operationId, ownerId) {
+  return withBrokerBoundaryAuthority(options, {
+    operationId,
+    orchestrationLeaseId: lease.leaseId,
+    orchestrationLeaseRevision: lease.revision,
+    ownerId
+  });
+}
 function boundPair(attempt, lease) {
   return attempt.attemptId === lease.attemptId && attempt.workspaceLeaseId === lease.leaseId;
 }
@@ -31350,16 +32463,24 @@ var AgentWorkWorkerSessionService = class {
       envelope.paths.project_root,
       "execution_root"
     );
-    const observation = await this.runtime.observeWorkspace({
-      repositoryId: lease.repositoryId,
-      hostId: lease.hostId,
-      gitRuntime: lease.gitRuntime,
-      projectRoot: lease.projectRoot,
-      branch: lease.branch,
-      worktreePath: lease.worktreePath,
-      attemptId: attempt.attemptId,
-      baseSha: attempt.baseSha
-    });
+    const observation = await this.runtime.observeWorkspace(
+      {
+        repositoryId: lease.repositoryId,
+        hostId: lease.hostId,
+        gitRuntime: lease.gitRuntime,
+        projectRoot: lease.projectRoot,
+        branch: lease.branch,
+        worktreePath: lease.worktreePath,
+        attemptId: attempt.attemptId,
+        baseSha: attempt.baseSha
+      },
+      withBrokerBoundaryAuthority(void 0, {
+        operationId: input.mutationId,
+        orchestrationLeaseId: lease.leaseId,
+        orchestrationLeaseRevision: lease.revision,
+        ownerId: input.controller.controllerId
+      })
+    );
     if (!observation.ok || !observation.observation.exists || !observation.observation.registered || observation.observation.attemptId !== attempt.attemptId || observation.observation.headSha !== attempt.baseSha || observation.observation.cleanliness !== "clean") {
       return failure("evidence_mismatch", attempt.revision, lease.revision);
     }
@@ -31498,9 +32619,9 @@ function failure(reason, attemptRevision, workspaceRevision) {
 }
 
 // src/runs/agent-work-worker-runtime.ts
-import { z as z22 } from "zod";
+import { z as z24 } from "zod";
 var WORKER_ADAPTER_CONTRACT_VERSION = "1.0.0";
-var WorkerAdapterAuthorityDimension = z22.enum([
+var WorkerAdapterAuthorityDimension = z24.enum([
   "filesystem_read",
   "filesystem_write",
   "git_write",
@@ -31512,14 +32633,14 @@ var WorkerAdapterAuthorityDimension = z22.enum([
   "release",
   "nested_delegation"
 ]);
-var WorkerAdapterEnforcement = z22.enum([
+var WorkerAdapterEnforcement = z24.enum([
   "enforced",
   "brokered",
   "unenforced",
   "unsupported"
 ]);
-var boundedText = z22.string().min(1).max(256);
-var authorityMatrix = z22.object(
+var boundedText = z24.string().min(1).max(256);
+var authorityMatrix = z24.object(
   Object.fromEntries(
     WorkerAdapterAuthorityDimension.options.map((dimension) => [
       dimension,
@@ -31527,40 +32648,40 @@ var authorityMatrix = z22.object(
     ])
   )
 );
-var WorkerAdapterManifest_v1 = z22.object({
-  schema_version: z22.literal(WORKER_ADAPTER_CONTRACT_VERSION),
-  adapter: z22.object({
+var WorkerAdapterManifest_v1 = z24.object({
+  schema_version: z24.literal(WORKER_ADAPTER_CONTRACT_VERSION),
+  adapter: z24.object({
     id: boundedText,
     version: boundedText,
-    kind: z22.enum(["assisted", "subprocess", "remote"]),
+    kind: z24.enum(["assisted", "subprocess", "remote"]),
     session_backend: WorkerSessionBackend
   }).strict(),
-  lifecycle: z22.object({
-    prepare: z22.boolean(),
-    launch: z22.boolean(),
-    assisted_attach: z22.boolean(),
-    heartbeat: z22.boolean(),
-    cancellation: z22.boolean(),
-    teardown: z22.boolean(),
-    artifact_collection: z22.boolean(),
-    receipt_collection: z22.boolean()
+  lifecycle: z24.object({
+    prepare: z24.boolean(),
+    launch: z24.boolean(),
+    assisted_attach: z24.boolean(),
+    heartbeat: z24.boolean(),
+    cancellation: z24.boolean(),
+    teardown: z24.boolean(),
+    artifact_collection: z24.boolean(),
+    receipt_collection: z24.boolean()
   }).strict(),
   authority: authorityMatrix.strict(),
-  signals: z22.object({
-    structured: z22.boolean(),
-    max_bytes: z22.number().int().positive().max(1024 * 1024)
+  signals: z24.object({
+    structured: z24.boolean(),
+    max_bytes: z24.number().int().positive().max(1024 * 1024)
   }).strict(),
-  reproducibility: z22.object({
+  reproducibility: z24.object({
     backend_identity: boundedText,
     backend_version: boundedText
   }).strict()
 }).strict();
-var WorkerAdapterSelection_v1 = z22.object({
-  schema_version: z22.literal(WORKER_ADAPTER_CONTRACT_VERSION),
+var WorkerAdapterSelection_v1 = z24.object({
+  schema_version: z24.literal(WORKER_ADAPTER_CONTRACT_VERSION),
   adapter_id: boundedText,
   adapter_version: boundedText,
-  mode: z22.enum(["launch", "assisted_attach"]),
-  accepted_trust_gaps: z22.array(WorkerAdapterAuthorityDimension).max(16)
+  mode: z24.enum(["launch", "assisted_attach"]),
+  accepted_trust_gaps: z24.array(WorkerAdapterAuthorityDimension).max(16)
 }).strict().superRefine((value, context) => {
   if (new Set(value.accepted_trust_gaps).size !== value.accepted_trust_gaps.length) {
     context.addIssue({
@@ -31571,52 +32692,52 @@ var WorkerAdapterSelection_v1 = z22.object({
   }
 });
 var workerSignalBase = {
-  summary: z22.string().min(1).max(4096),
-  at: z22.string().datetime({ offset: true })
+  summary: z24.string().min(1).max(4096),
+  at: z24.string().datetime({ offset: true })
 };
-var WorkerRuntimeSignalSchema = z22.discriminatedUnion("type", [
-  z22.object({
-    type: z22.enum(["heartbeat", "progress", "completed", "failed"]),
+var WorkerRuntimeSignalSchema = z24.discriminatedUnion("type", [
+  z24.object({
+    type: z24.enum(["heartbeat", "progress", "completed", "failed"]),
     ...workerSignalBase
   }).strict(),
-  z22.object({
-    type: z22.literal("blocked"),
+  z24.object({
+    type: z24.literal("blocked"),
     ...workerSignalBase,
-    blocker: z22.object({
+    blocker: z24.object({
       code: boundedText,
-      retryable: z22.boolean()
+      retryable: z24.boolean()
     }).strict()
   }).strict(),
-  z22.object({
-    type: z22.literal("dependency_discovered"),
+  z24.object({
+    type: z24.literal("dependency_discovered"),
     ...workerSignalBase,
-    dependency: z22.object({
+    dependency: z24.object({
       work_item_id: boundedText,
-      relationship: z22.enum(["blocks", "blocked_by", "related"]),
-      evidence_hash: z22.string().regex(/^sha256:[0-9a-f]{64}$/u)
+      relationship: z24.enum(["blocks", "blocked_by", "related"]),
+      evidence_hash: z24.string().regex(/^sha256:[0-9a-f]{64}$/u)
     }).strict()
   }).strict(),
-  z22.object({
-    type: z22.literal("evidence_discovered"),
+  z24.object({
+    type: z24.literal("evidence_discovered"),
     ...workerSignalBase,
-    evidence: z22.object({
-      kind: z22.enum(["artifact", "observation", "decision", "eliminated_hypothesis"]),
+    evidence: z24.object({
+      kind: z24.enum(["artifact", "observation", "decision", "eliminated_hypothesis"]),
       id: boundedText,
-      hash: z22.string().regex(/^sha256:[0-9a-f]{64}$/u)
+      hash: z24.string().regex(/^sha256:[0-9a-f]{64}$/u)
     }).strict()
   }).strict(),
-  z22.object({
-    type: z22.literal("human_action_requested"),
+  z24.object({
+    type: z24.literal("human_action_requested"),
     ...workerSignalBase,
-    request: z22.object({
+    request: z24.object({
       request_id: boundedText,
       action_class: boundedText
     }).strict()
   }).strict()
 ]);
-var WorkerRuntimeArtifactSchema = z22.object({
+var WorkerRuntimeArtifactSchema = z24.object({
   id: boundedText,
-  hash: z22.string().regex(/^sha256:[0-9a-f]{64}$/u)
+  hash: z24.string().regex(/^sha256:[0-9a-f]{64}$/u)
 }).strict();
 var WorkerAdapterRegistry = class {
   constructor(manifests = [HOST_ASSISTED_ADAPTER_MANIFEST]) {
@@ -31749,21 +32870,21 @@ function deepFreeze(value) {
 }
 
 // src/runs/agent-work-runtime.ts
-var required = z23.string().min(1).max(16384).refine((value) => !value.includes("\0"));
+var required = z25.string().min(1).max(16384).refine((value) => !value.includes("\0"));
 var absolutePath = required.refine((value) => path37.isAbsolute(value), {
   message: "must be a runtime-native absolute path"
 });
-var AgentWorkRuntimeConfigSchema = z23.object({
+var AgentWorkRuntimeConfigSchema = z25.object({
   databasePath: absolutePath,
-  repositoryId: z23.string().min(1).max(4096),
+  repositoryId: z25.string().min(1).max(4096),
   repositoryRoot: absolutePath,
   worktreeRoot: absolutePath,
-  hostId: z23.string().min(1).max(4096),
-  gitRuntime: z23.string().min(1).max(4096),
-  pathComparison: z23.enum(["case-sensitive", "case-insensitive"]),
+  hostId: z25.string().min(1).max(4096),
+  gitRuntime: z25.string().min(1).max(4096),
+  pathComparison: z25.enum(["case-sensitive", "case-insensitive"]),
   gitExecutable: required.optional(),
-  timeoutMs: z23.number().int().positive().max(24 * 60 * 60 * 1e3).optional(),
-  maxDirtyPaths: z23.number().int().positive().max(1e4).optional()
+  timeoutMs: z25.number().int().positive().max(24 * 60 * 60 * 1e3).optional(),
+  maxDirtyPaths: z25.number().int().positive().max(1e4).optional()
 }).strict();
 function createAgentWorkRuntime(input) {
   const config = AgentWorkRuntimeConfigSchema.parse(input);
@@ -31808,30 +32929,30 @@ var MAX_INPUT_BYTES3 = 256 * 1024;
 var MAX_TEXT = 4096;
 var MAX_PATH = 16384;
 var MAX_ISSUES3 = 20;
-var text2 = z24.string().min(1).max(MAX_TEXT);
-var nativePath = z24.string().min(1).max(MAX_PATH).refine((value) => !value.includes("\0"), {
+var text2 = z26.string().min(1).max(MAX_TEXT);
+var nativePath = z26.string().min(1).max(MAX_PATH).refine((value) => !value.includes("\0"), {
   message: "must not contain NUL bytes"
 });
 var absoluteNativePath = nativePath.refine((value) => path38.isAbsolute(value), {
   message: "must be a runtime-native absolute path"
 });
-var instant2 = z24.string().datetime({ offset: true });
-var revision = z24.number().int().nonnegative();
-var positiveTtl = z24.number().int().positive().max(24 * 60 * 60 * 1e3);
-var mutation = z24.object({ mutationId: text2, now: instant2 }).strict();
-var AttemptStartInputSchema = z24.object({
+var instant2 = z26.string().datetime({ offset: true });
+var revision = z26.number().int().nonnegative();
+var positiveTtl = z26.number().int().positive().max(24 * 60 * 60 * 1e3);
+var mutation = z26.object({ mutationId: text2, now: instant2 }).strict();
+var AttemptStartInputSchema = z26.object({
   runId: text2,
   initialRunState: RunStateSchema,
-  controller: z24.object({ controllerId: text2, leaseId: text2, now: instant2, ttlMs: positiveTtl }).strict(),
-  attempt: z24.object({
+  controller: z26.object({ controllerId: text2, leaseId: text2, now: instant2, ttlMs: positiveTtl }).strict(),
+  attempt: z26.object({
     attemptId: text2,
     workItemId: text2,
     workItemRevision: revision,
     packetId: text2,
-    packetHash: z24.string().regex(/^sha256:[0-9a-f]{64}$/),
-    baseSha: z24.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/)
+    packetHash: z26.string().regex(/^sha256:[0-9a-f]{64}$/),
+    baseSha: z26.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/)
   }).strict(),
-  workspace: z24.object({
+  workspace: z26.object({
     workspaceLeaseId: text2,
     repositoryId: text2,
     hostId: text2,
@@ -31841,7 +32962,7 @@ var AttemptStartInputSchema = z24.object({
     worktreePath: nativePath,
     ttlMs: positiveTtl
   }).strict(),
-  mutations: z24.object({
+  mutations: z26.object({
     createAttempt: mutation,
     reserveWorkspace: mutation,
     activateWorkspace: mutation,
@@ -31849,16 +32970,16 @@ var AttemptStartInputSchema = z24.object({
     quarantineWorkspace: mutation,
     authorizeLaunch: mutation
   }).strict(),
-  broker: z24.object({ timeoutMs: positiveTtl }).strict().optional()
+  broker: z26.object({ timeoutMs: positiveTtl }).strict().optional()
 }).strict();
-var AttemptStatusInputSchema = z24.object({
+var AttemptStatusInputSchema = z26.object({
   databasePath: nativePath.refine((value) => path38.isAbsolute(value), {
     message: "must be a runtime-native absolute path"
   }),
   runId: text2,
   attemptId: text2
 }).strict();
-var AttemptStartRequestSchema = z24.object({ runtime: AgentWorkRuntimeConfigSchema, attempt: AttemptStartInputSchema }).strict();
+var AttemptStartRequestSchema = z26.object({ runtime: AgentWorkRuntimeConfigSchema, attempt: AttemptStartInputSchema }).strict();
 var AttemptPrepareLifecycleInputSchema = AttemptStartInputSchema.omit({
   runId: true,
   attempt: true,
@@ -31873,26 +32994,26 @@ var AttemptLaunchPacketPolicySchema = AgentTaskPacketHashInput_v1.pick({
   verification: true,
   budget: true
 }).extend({ packetId: text2, createdAt: instant2 }).strict();
-var AttemptLaunchEnvelopePolicySchema = z24.object({
+var AttemptLaunchEnvelopePolicySchema = z26.object({
   envelopeId: text2,
   os: ExecutionEnvironmentOS,
   architecture: text2,
   workerRuntime: text2,
   projectRoot: absoluteNativePath,
   executionRoot: absoluteNativePath,
-  exposedEnvironmentKeys: z24.array(text2).max(256),
+  exposedEnvironmentKeys: z26.array(text2).max(256),
   createdAt: instant2,
-  projection: z24.object({
+  projection: z26.object({
     selectionDigest: SHA256Hash
   }).strict().optional()
 }).strict();
-var AttemptPrepareRequestSchema = z24.object({
+var AttemptPrepareRequestSchema = z26.object({
   runtime: AgentWorkRuntimeConfigSchema,
   workItem: WorkItem_v1,
-  identity: z24.object({
+  identity: z26.object({
     runId: text2,
     attemptId: text2,
-    baseSha: z24.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/)
+    baseSha: z26.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/)
   }).strict(),
   packet: AttemptLaunchPacketPolicySchema,
   envelope: AttemptLaunchEnvelopePolicySchema,
@@ -31984,7 +33105,7 @@ var AttemptPrepareRequestSchema = z24.object({
       created_at: value.packet.createdAt
     });
   } catch (error) {
-    if (error instanceof z24.ZodError) {
+    if (error instanceof z26.ZodError) {
       for (const issue of error.issues.slice(0, MAX_ISSUES3)) {
         context.addIssue({
           code: "custom",
@@ -31997,13 +33118,13 @@ var AttemptPrepareRequestSchema = z24.object({
     }
   }
 });
-var AttemptStartRequestJsonSchema = z24.toJSONSchema(AttemptStartRequestSchema, {
+var AttemptStartRequestJsonSchema = z26.toJSONSchema(AttemptStartRequestSchema, {
   target: "draft-7"
 });
-var AttemptPrepareRequestJsonSchema = z24.toJSONSchema(AttemptPrepareRequestSchema, {
+var AttemptPrepareRequestJsonSchema = z26.toJSONSchema(AttemptPrepareRequestSchema, {
   target: "draft-7"
 });
-var AttemptStatusInputJsonSchema = z24.toJSONSchema(AttemptStatusInputSchema, {
+var AttemptStatusInputJsonSchema = z26.toJSONSchema(AttemptStatusInputSchema, {
   target: "draft-7"
 });
 function createAttemptLifecycleHandlers() {
@@ -32235,22 +33356,22 @@ function safeError(error) {
 // src/runs/agent-work-worker-adapters.ts
 import path39 from "path";
 import { stat as stat4 } from "fs/promises";
-import { z as z25 } from "zod";
+import { z as z27 } from "zod";
 var MAX_INPUT_BYTES4 = 256 * 1024;
 var MAX_ISSUES4 = 20;
-var text3 = z25.string().min(1).max(4096);
-var shortText = z25.string().min(1).max(1024);
-var nativePath2 = z25.string().min(1).max(16384).refine((value) => !value.includes("\0") && path39.isAbsolute(value), {
+var text3 = z27.string().min(1).max(4096);
+var shortText = z27.string().min(1).max(1024);
+var nativePath2 = z27.string().min(1).max(16384).refine((value) => !value.includes("\0") && path39.isAbsolute(value), {
   message: "must be a runtime-native absolute path"
 });
-var instant3 = z25.string().datetime({ offset: true });
-var revision2 = z25.number().int().nonnegative();
-var mutation2 = z25.object({ mutationId: text3, now: instant3 }).strict();
-var controller = z25.object({
+var instant3 = z27.string().datetime({ offset: true });
+var revision2 = z27.number().int().nonnegative();
+var mutation2 = z27.object({ mutationId: text3, now: instant3 }).strict();
+var controller = z27.object({
   runId: text3,
   controllerId: text3,
   leaseId: text3,
-  fencingToken: z25.number().int().positive()
+  fencingToken: z27.number().int().positive()
 }).strict();
 var common = {
   runId: text3,
@@ -32263,32 +33384,32 @@ var common = {
   workerSessionId: text3,
   mutation: mutation2
 };
-var BoundedExecutionEnvelopeSchema = z25.object({
-  schema_version: z25.literal("1.0.0"),
+var BoundedExecutionEnvelopeSchema = z27.object({
+  schema_version: z27.literal("1.0.0"),
   envelope_id: text3,
   run_id: text3,
   attempt_id: text3,
   packet_id: text3,
-  packet_hash: z25.string().regex(/^sha256:[0-9a-f]{64}$/),
+  packet_hash: z27.string().regex(/^sha256:[0-9a-f]{64}$/),
   workspace_lease_id: text3,
   workspace_lease_revision: revision2,
-  expected_head_sha: z25.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i),
+  expected_head_sha: z27.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i),
   branch: text3,
-  runtime: z25.object({
+  runtime: z27.object({
     host_id: text3,
     os: ExecutionEnvironmentOS,
     architecture: text3,
     worker_runtime: text3,
     git_runtime: text3
   }).strict(),
-  paths: z25.object({
+  paths: z27.object({
     project_root: nativePath2,
     execution_root: nativePath2,
     allocation_root: nativePath2.optional(),
     worktree_root: nativePath2
   }).strict(),
-  path_mappings: z25.array(AgentExecutionPathMapping_v1).max(1),
-  exposed_environment_keys: z25.array(text3).max(256),
+  path_mappings: z27.array(AgentExecutionPathMapping_v1).max(1),
+  exposed_environment_keys: z27.array(text3).max(256),
   created_at: instant3
 }).strict().superRefine((value, context) => {
   const parsed = ExecutionEnvelope_v1.safeParse(value);
@@ -32298,12 +33419,12 @@ var BoundedExecutionEnvelopeSchema = z25.object({
     }
   }
 });
-var AttemptWorkerAttachRequestSchema = z25.object({
+var AttemptWorkerAttachRequestSchema = z27.object({
   runtime: AgentWorkRuntimeConfigSchema,
-  attach: z25.object({
+  attach: z27.object({
     ...common,
     envelope: BoundedExecutionEnvelopeSchema,
-    worker: z25.object({
+    worker: z27.object({
       backend: WorkerSessionBackend,
       workerId: text3,
       model: text3.optional(),
@@ -32334,40 +33455,40 @@ var AttemptWorkerAttachRequestSchema = z25.object({
     });
   }
 });
-var WorkerHeartbeatInputSchema = z25.object({
+var WorkerHeartbeatInputSchema = z27.object({
   ...common,
   expectedWorkerSessionRevision: revision2,
   status: HeartbeatWorkerSessionStatus.optional()
 }).strict();
-var AttemptWorkerHeartbeatRequestSchema = z25.object({ databasePath: nativePath2, heartbeat: WorkerHeartbeatInputSchema }).strict().superRefine((value, context) => {
+var AttemptWorkerHeartbeatRequestSchema = z27.object({ databasePath: nativePath2, heartbeat: WorkerHeartbeatInputSchema }).strict().superRefine((value, context) => {
   requireControllerRun(value.heartbeat, "heartbeat", context);
 });
-var WorkerEndInputSchema = z25.object({
+var WorkerEndInputSchema = z27.object({
   ...common,
   expectedWorkerSessionRevision: revision2,
   status: EndWorkerSessionStatus,
-  exit: z25.object({
-    code: z25.number().int().optional(),
-    signal: z25.string().min(1).max(128).optional(),
+  exit: z27.object({
+    code: z27.number().int().optional(),
+    signal: z27.string().min(1).max(128).optional(),
     summary: shortText.optional()
   }).strict()
 }).strict();
-var AttemptWorkerEndRequestSchema = z25.object({ databasePath: nativePath2, end: WorkerEndInputSchema }).strict().superRefine((value, context) => {
+var AttemptWorkerEndRequestSchema = z27.object({ databasePath: nativePath2, end: WorkerEndInputSchema }).strict().superRefine((value, context) => {
   requireControllerRun(value.end, "end", context);
 });
-var AttemptWorkerStatusRequestSchema = z25.object({ databasePath: nativePath2, runId: text3, attemptId: text3 }).strict();
-var AttemptWorkerAttachRequestJsonSchema = z25.toJSONSchema(
+var AttemptWorkerStatusRequestSchema = z27.object({ databasePath: nativePath2, runId: text3, attemptId: text3 }).strict();
+var AttemptWorkerAttachRequestJsonSchema = z27.toJSONSchema(
   AttemptWorkerAttachRequestSchema,
   { target: "draft-7" }
 );
-var AttemptWorkerHeartbeatRequestJsonSchema = z25.toJSONSchema(
+var AttemptWorkerHeartbeatRequestJsonSchema = z27.toJSONSchema(
   AttemptWorkerHeartbeatRequestSchema,
   { target: "draft-7" }
 );
-var AttemptWorkerEndRequestJsonSchema = z25.toJSONSchema(AttemptWorkerEndRequestSchema, {
+var AttemptWorkerEndRequestJsonSchema = z27.toJSONSchema(AttemptWorkerEndRequestSchema, {
   target: "draft-7"
 });
-var AttemptWorkerStatusRequestJsonSchema = z25.toJSONSchema(
+var AttemptWorkerStatusRequestJsonSchema = z27.toJSONSchema(
   AttemptWorkerStatusRequestSchema,
   { target: "draft-7" }
 );
@@ -32592,7 +33713,7 @@ function operationFailed3(error) {
 // src/runs/agent-work-attempt-receipt-adapters.ts
 import path40 from "path";
 import { stat as stat5 } from "fs/promises";
-import { z as z26 } from "zod";
+import { z as z28 } from "zod";
 
 // src/runs/agent-work-attempt-receipt-service.ts
 var MAX_OUTPUT_BYTES2 = 4096;
@@ -32701,28 +33822,28 @@ function bounded7(value) {
 // src/runs/agent-work-attempt-receipt-adapters.ts
 var MAX_INPUT_BYTES5 = 256 * 1024;
 var MAX_ISSUES5 = 20;
-var text4 = z26.string().min(1).max(4096);
-var shortText2 = z26.string().min(1).max(1024);
-var instant4 = z26.string().datetime({ offset: true });
-var revision3 = z26.number().int().nonnegative();
-var gitObjectId = z26.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/);
-var sha2564 = z26.string().regex(/^sha256:[a-f0-9]{64}$/);
-var nativePath3 = z26.string().min(1).max(16384).refine((value) => !value.includes("\0") && path40.isAbsolute(value), {
+var text4 = z28.string().min(1).max(4096);
+var shortText2 = z28.string().min(1).max(1024);
+var instant4 = z28.string().datetime({ offset: true });
+var revision3 = z28.number().int().nonnegative();
+var gitObjectId = z28.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/);
+var sha2564 = z28.string().regex(/^sha256:[a-f0-9]{64}$/);
+var nativePath3 = z28.string().min(1).max(16384).refine((value) => !value.includes("\0") && path40.isAbsolute(value), {
   message: "must be a runtime-native absolute path"
 });
-var receiptPath = z26.string().min(1).max(4096).refine(
+var receiptPath = z28.string().min(1).max(4096).refine(
   (value) => !value.includes("\0") && !value.includes("\\") && value.split("/").every((part) => part.length > 0 && part !== "." && part !== "..") && !value.startsWith("/"),
   { message: "must be a canonical slash-separated repository path" }
 );
-var controller2 = z26.object({
+var controller2 = z28.object({
   runId: text4,
   controllerId: text4,
   leaseId: text4,
-  fencingToken: z26.number().int().positive()
+  fencingToken: z28.number().int().positive()
 }).strict();
-var mutation3 = z26.object({ mutationId: text4, now: instant4 }).strict();
-var BoundedAgentTaskReceiptV2Schema = z26.object({
-  schema_version: z26.literal("2.0.0"),
+var mutation3 = z28.object({ mutationId: text4, now: instant4 }).strict();
+var BoundedAgentTaskReceiptV2Schema = z28.object({
+  schema_version: z28.literal("2.0.0"),
   receipt_id: text4,
   run_id: text4,
   work_item_id: text4,
@@ -32739,26 +33860,26 @@ var BoundedAgentTaskReceiptV2Schema = z26.object({
   patch_hash: sha2564.optional(),
   outcome: AgentTaskReceiptOutcome,
   exit_reason: text4,
-  summary: z26.string().min(1).max(4096),
-  files_touched: z26.array(receiptPath).max(2048),
-  commits: z26.array(gitObjectId).max(1024),
-  acceptance_criteria_addressed: z26.array(text4).max(1024),
-  claimed_checks: z26.array(
-    z26.object({
+  summary: z28.string().min(1).max(4096),
+  files_touched: z28.array(receiptPath).max(2048),
+  commits: z28.array(gitObjectId).max(1024),
+  acceptance_criteria_addressed: z28.array(text4).max(1024),
+  claimed_checks: z28.array(
+    z28.object({
       id: text4,
       outcome: ClaimedCheckOutcome,
-      exit_code: z26.number().int().optional(),
+      exit_code: z28.number().int().optional(),
       output_snippet: shortText2.optional()
     }).strict()
   ).max(512),
-  assumptions: z26.array(shortText2).max(512),
-  blockers: z26.array(shortText2).max(512),
-  human_action_request_ids: z26.array(text4).max(512),
-  cost: z26.object({
-    input_tokens: z26.number().int().nonnegative().optional(),
-    output_tokens: z26.number().int().nonnegative().optional(),
-    tool_calls: z26.number().int().nonnegative().optional(),
-    elapsed_ms: z26.number().int().nonnegative().optional()
+  assumptions: z28.array(shortText2).max(512),
+  blockers: z28.array(shortText2).max(512),
+  human_action_request_ids: z28.array(text4).max(512),
+  cost: z28.object({
+    input_tokens: z28.number().int().nonnegative().optional(),
+    output_tokens: z28.number().int().nonnegative().optional(),
+    tool_calls: z28.number().int().nonnegative().optional(),
+    elapsed_ms: z28.number().int().nonnegative().optional()
   }).strict(),
   worker_started_at: instant4,
   worker_completed_at: instant4,
@@ -32771,9 +33892,9 @@ var BoundedAgentTaskReceiptV2Schema = z26.object({
     }
   }
 });
-var AttemptReceiptSubmitRequestSchema = z26.object({
+var AttemptReceiptSubmitRequestSchema = z28.object({
   databasePath: nativePath3,
-  submission: z26.object({
+  submission: z28.object({
     runId: text4,
     expectedRunRevision: revision3,
     controller: controller2,
@@ -32803,12 +33924,12 @@ var AttemptReceiptSubmitRequestSchema = z26.object({
     });
   }
 });
-var AttemptReceiptStatusRequestSchema = z26.object({ databasePath: nativePath3, runId: text4, attemptId: text4 }).strict();
-var AttemptReceiptSubmitRequestJsonSchema = z26.toJSONSchema(
+var AttemptReceiptStatusRequestSchema = z28.object({ databasePath: nativePath3, runId: text4, attemptId: text4 }).strict();
+var AttemptReceiptSubmitRequestJsonSchema = z28.toJSONSchema(
   AttemptReceiptSubmitRequestSchema,
   { target: "draft-7" }
 );
-var AttemptReceiptStatusRequestJsonSchema = z26.toJSONSchema(
+var AttemptReceiptStatusRequestJsonSchema = z28.toJSONSchema(
   AttemptReceiptStatusRequestSchema,
   { target: "draft-7" }
 );
@@ -32934,7 +34055,7 @@ function isJsonSafe5(value, depth = 0) {
 // src/runs/agent-work-attempt-verification-adapters.ts
 import { stat as stat6 } from "fs/promises";
 import path42 from "path";
-import { z as z27 } from "zod";
+import { z as z29 } from "zod";
 
 // src/runs/agent-work-attempt-verification-service.ts
 var DEFAULT_CHECK_TIMEOUT_MS = 6e4;
@@ -33701,17 +34822,17 @@ function hashBytes(bytes) {
 // src/runs/agent-work-attempt-verification-adapters.ts
 var MAX_INPUT_BYTES6 = 256 * 1024;
 var MAX_ISSUES6 = 20;
-var text6 = z27.string().min(1).max(4096);
-var revision4 = z27.number().int().nonnegative();
-var sha2565 = z27.string().regex(/^sha256:[a-f0-9]{64}$/);
-var nativePath4 = z27.string().min(1).max(16384).refine((value) => !value.includes("\0") && path42.isAbsolute(value), {
+var text6 = z29.string().min(1).max(4096);
+var revision4 = z29.number().int().nonnegative();
+var sha2565 = z29.string().regex(/^sha256:[a-f0-9]{64}$/);
+var nativePath4 = z29.string().min(1).max(16384).refine((value) => !value.includes("\0") && path42.isAbsolute(value), {
   message: "must be a runtime-native absolute path"
 });
-var controller3 = z27.object({
+var controller3 = z29.object({
   runId: text6,
   controllerId: text6,
   leaseId: text6,
-  fencingToken: z27.number().int().positive()
+  fencingToken: z29.number().int().positive()
 }).strict();
 var verificationBinding = {
   runId: text6,
@@ -33727,9 +34848,9 @@ var verificationBinding = {
   receiptId: text6,
   receiptHash: sha2565
 };
-var AttemptVerificationRunRequestSchema = z27.object({
+var AttemptVerificationRunRequestSchema = z29.object({
   databasePath: nativePath4,
-  verification: z27.object({
+  verification: z29.object({
     ...verificationBinding,
     beginMutationId: text6,
     completeMutationId: text6
@@ -33750,15 +34871,15 @@ var AttemptVerificationRunRequestSchema = z27.object({
     });
   }
 });
-var AttemptVerificationStatusRequestSchema = z27.object({
+var AttemptVerificationStatusRequestSchema = z29.object({
   databasePath: nativePath4,
   runId: text6,
   attemptId: text6,
-  diagnostics: z27.boolean().optional()
+  diagnostics: z29.boolean().optional()
 }).strict();
-var AttemptAcceptanceApplyRequestSchema = z27.object({
+var AttemptAcceptanceApplyRequestSchema = z29.object({
   databasePath: nativePath4,
-  acceptance: z27.object({
+  acceptance: z29.object({
     ...verificationBinding,
     verificationHash: sha2565,
     mutationId: text6
@@ -33772,20 +34893,20 @@ var AttemptAcceptanceApplyRequestSchema = z27.object({
     });
   }
 });
-var AttemptAcceptanceStatusRequestSchema = z27.object({ databasePath: nativePath4, runId: text6, attemptId: text6 }).strict();
-var AttemptVerificationRunRequestJsonSchema = z27.toJSONSchema(
+var AttemptAcceptanceStatusRequestSchema = z29.object({ databasePath: nativePath4, runId: text6, attemptId: text6 }).strict();
+var AttemptVerificationRunRequestJsonSchema = z29.toJSONSchema(
   AttemptVerificationRunRequestSchema,
   { target: "draft-7" }
 );
-var AttemptVerificationStatusRequestJsonSchema = z27.toJSONSchema(
+var AttemptVerificationStatusRequestJsonSchema = z29.toJSONSchema(
   AttemptVerificationStatusRequestSchema,
   { target: "draft-7" }
 );
-var AttemptAcceptanceApplyRequestJsonSchema = z27.toJSONSchema(
+var AttemptAcceptanceApplyRequestJsonSchema = z29.toJSONSchema(
   AttemptAcceptanceApplyRequestSchema,
   { target: "draft-7" }
 );
-var AttemptAcceptanceStatusRequestJsonSchema = z27.toJSONSchema(
+var AttemptAcceptanceStatusRequestJsonSchema = z29.toJSONSchema(
   AttemptAcceptanceStatusRequestSchema,
   { target: "draft-7" }
 );
@@ -34652,7 +35773,7 @@ import * as fs48 from "fs";
 import * as path49 from "path";
 
 // src/runs/enforcement.ts
-import { z as z28 } from "zod";
+import { z as z30 } from "zod";
 var ViolationType = {
   /** Direct git command executed during active run */
   DIRECT_GIT_COMMAND: "DIRECT_GIT_COMMAND",
@@ -34669,21 +35790,21 @@ var ViolationType = {
   /** Used forbidden action under current persona */
   FORBIDDEN_ACTION: "FORBIDDEN_ACTION"
 };
-var ViolationEntrySchema = z28.object({
+var ViolationEntrySchema = z30.object({
   /** ISO 8601 timestamp of the violation */
-  timestamp: z28.string(),
+  timestamp: z30.string(),
   /** Run identifier where violation occurred */
-  runId: z28.string(),
+  runId: z30.string(),
   /** Type of violation */
-  violation: z28.string(),
+  violation: z30.string(),
   /** Command or action that caused the violation */
-  command: z28.string().optional(),
+  command: z30.string().optional(),
   /** Additional context about the violation */
-  context: z28.string().optional(),
+  context: z30.string().optional(),
   /** Severity level */
-  severity: z28.enum(["warning", "error", "critical"]),
+  severity: z30.enum(["warning", "error", "critical"]),
   /** Whether the violation was blocked (hard enforcement) */
-  blocked: z28.boolean().optional()
+  blocked: z30.boolean().optional()
 });
 function getViolations(runId, baseDir = process.cwd()) {
   const failures = readRunLog(runId, "failures", baseDir);
@@ -34906,26 +36027,26 @@ import { ulid as ulid3 } from "ulid";
 // src/runs/artifacts.ts
 import * as fs46 from "fs";
 import * as path45 from "path";
-import { z as z29 } from "zod";
+import { z as z31 } from "zod";
 var DEFAULT_INLINE_THRESHOLD = 10 * 1024;
-var ListArtifactsInputSchema = z29.object({
-  runId: z29.string().describe("The unique run identifier"),
-  type: z29.enum(["plan", "decision", "failure", "gate", "report", "log"]).optional().describe('Filter by type: "plan", "decision", "failure", "gate", "report", "log"'),
-  path: z29.string().optional().describe("Filter by path pattern (supports * and ** wildcards)"),
-  latestOnly: z29.boolean().optional().describe("Only return the most recent artifact of each type"),
-  inline: z29.boolean().optional().describe("Include content for small artifacts (< 10KB)")
+var ListArtifactsInputSchema = z31.object({
+  runId: z31.string().describe("The unique run identifier"),
+  type: z31.enum(["plan", "decision", "failure", "gate", "report", "log"]).optional().describe('Filter by type: "plan", "decision", "failure", "gate", "report", "log"'),
+  path: z31.string().optional().describe("Filter by path pattern (supports * and ** wildcards)"),
+  latestOnly: z31.boolean().optional().describe("Only return the most recent artifact of each type"),
+  inline: z31.boolean().optional().describe("Include content for small artifacts (< 10KB)")
 });
-var ArtifactDescriptorSchema = z29.object({
-  path: z29.string().describe("Relative path within run directory"),
-  type: z29.enum(["plan", "decision", "failure", "gate", "report", "log"]).describe("Artifact type"),
-  size: z29.number().describe("File size in bytes"),
-  createdAt: z29.string().describe("ISO 8601 creation timestamp"),
-  modifiedAt: z29.string().describe("ISO 8601 modification timestamp"),
-  content: z29.string().optional().describe("File content (included if inline=true and size < threshold)")
+var ArtifactDescriptorSchema = z31.object({
+  path: z31.string().describe("Relative path within run directory"),
+  type: z31.enum(["plan", "decision", "failure", "gate", "report", "log"]).describe("Artifact type"),
+  size: z31.number().describe("File size in bytes"),
+  createdAt: z31.string().describe("ISO 8601 creation timestamp"),
+  modifiedAt: z31.string().describe("ISO 8601 modification timestamp"),
+  content: z31.string().optional().describe("File content (included if inline=true and size < threshold)")
 });
-var ListArtifactsOutputSchema = z29.object({
-  artifacts: z29.array(ArtifactDescriptorSchema),
-  totalCount: z29.number().describe("Total number of artifacts found")
+var ListArtifactsOutputSchema = z31.object({
+  artifacts: z31.array(ArtifactDescriptorSchema),
+  totalCount: z31.number().describe("Total number of artifacts found")
 });
 function getArtifactType(filePath) {
   const normalizedPath = filePath.replace(/\\/g, "/");
@@ -35047,54 +36168,54 @@ function listArtifacts(input, baseDir = process.cwd(), inlineThreshold = DEFAULT
 }
 
 // src/store/run-store.ts
-import { z as z30 } from "zod";
-var RunStateSchema2 = z30.enum(["pending", "running", "completed", "failed", "aborted"]);
-var StepStatusSchema = z30.enum(["pass", "fail", "skipped", "blocked"]);
-var RunRecordSchema = z30.object({
+import { z as z32 } from "zod";
+var RunStateSchema2 = z32.enum(["pending", "running", "completed", "failed", "aborted"]);
+var StepStatusSchema = z32.enum(["pass", "fail", "skipped", "blocked"]);
+var RunRecordSchema = z32.object({
   /** Caller-provided run identifier. Pre-generated by orchestration. */
-  runId: z30.string().min(1),
+  runId: z32.string().min(1),
   /** SHA256 hash of the frozen plan.json. */
-  planHash: z30.string().min(1),
+  planHash: z32.string().min(1),
   /** Current state of the run. */
   state: RunStateSchema2,
   /** When the run started. UTC ISO 8601. */
-  startedAt: z30.string().datetime({ message: "startedAt must be UTC ISO 8601 format" }),
+  startedAt: z32.string().datetime({ message: "startedAt must be UTC ISO 8601 format" }),
   /** When the run completed (if terminal state). UTC ISO 8601. */
-  completedAt: z30.string().datetime({ message: "completedAt must be UTC ISO 8601 format" }).optional(),
+  completedAt: z32.string().datetime({ message: "completedAt must be UTC ISO 8601 format" }).optional(),
   /** Arbitrary metadata for extensibility. */
-  metadata: z30.record(z30.string(), z30.unknown()).optional()
+  metadata: z32.record(z32.string(), z32.unknown()).optional()
 });
-var StepOutcomeSchema = z30.object({
+var StepOutcomeSchema = z32.object({
   /** Unique step identifier. Caller-generated. */
-  stepId: z30.string().min(1),
+  stepId: z32.string().min(1),
   /** Parent run identifier. */
-  runId: z30.string().min(1),
+  runId: z32.string().min(1),
   /** Node (PR/item) identifier from plan. */
-  nodeId: z30.string().min(1),
+  nodeId: z32.string().min(1),
   /** Gate name (e.g., "lint", "typecheck", "test"). */
-  gateName: z30.string().min(1),
+  gateName: z32.string().min(1),
   /** Outcome status. */
   status: StepStatusSchema,
   /** Execution duration in milliseconds. */
-  durationMs: z30.number().int().nonnegative(),
+  durationMs: z32.number().int().nonnegative(),
   /** Optional log output or path. */
-  logs: z30.string().optional(),
+  logs: z32.string().optional(),
   /** Optional artifact paths. */
-  artifacts: z30.array(z30.string()).optional(),
+  artifacts: z32.array(z32.string()).optional(),
   /** When this step was recorded. UTC ISO 8601. */
-  timestamp: z30.string().datetime({ message: "timestamp must be UTC ISO 8601 format" })
+  timestamp: z32.string().datetime({ message: "timestamp must be UTC ISO 8601 format" })
 });
-var ReceiptSchema = z30.object({
+var ReceiptSchema = z32.object({
   /** Unique receipt identifier. Caller-generated. */
-  receiptId: z30.string().min(1),
+  receiptId: z32.string().min(1),
   /** Parent run identifier. */
-  runId: z30.string().min(1),
+  runId: z32.string().min(1),
   /** Reason for the scope/risk escalation. */
-  reason: z30.string().min(1),
+  reason: z32.string().min(1),
   /** Human who approved (if applicable). */
-  approver: z30.string().optional(),
+  approver: z32.string().optional(),
   /** When this receipt was created. UTC ISO 8601. */
-  timestamp: z30.string().datetime({ message: "timestamp must be UTC ISO 8601 format" })
+  timestamp: z32.string().datetime({ message: "timestamp must be UTC ISO 8601 format" })
 });
 function safeParseStepOutcome(data) {
   return StepOutcomeSchema.safeParse(data);
@@ -35760,16 +36881,16 @@ import { existsSync as existsSync24, readFileSync as readFileSync29, renameSync
 import { join as join30 } from "path";
 
 // src/runs/agent-work-supervisor.ts
-import { z as z31 } from "zod";
-var instant5 = z31.string().datetime({ offset: true });
-var HeadlessSupervisorConfig = z31.object({
-  controllerTtlMs: z31.number().int().positive().max(24 * 60 * 60 * 1e3),
-  workspaceTtlMs: z31.number().int().positive().max(24 * 60 * 60 * 1e3),
-  heartbeatTimeoutMs: z31.number().int().positive().max(24 * 60 * 60 * 1e3),
-  maxAttemptsPerWorkItem: z31.number().int().positive().max(100),
-  maxConcurrency: z31.number().int().positive().max(16),
-  retryBaseDelayMs: z31.number().int().nonnegative().max(24 * 60 * 60 * 1e3),
-  retryMaxDelayMs: z31.number().int().nonnegative().max(7 * 24 * 60 * 60 * 1e3)
+import { z as z33 } from "zod";
+var instant5 = z33.string().datetime({ offset: true });
+var HeadlessSupervisorConfig = z33.object({
+  controllerTtlMs: z33.number().int().positive().max(24 * 60 * 60 * 1e3),
+  workspaceTtlMs: z33.number().int().positive().max(24 * 60 * 60 * 1e3),
+  heartbeatTimeoutMs: z33.number().int().positive().max(24 * 60 * 60 * 1e3),
+  maxAttemptsPerWorkItem: z33.number().int().positive().max(100),
+  maxConcurrency: z33.number().int().positive().max(16),
+  retryBaseDelayMs: z33.number().int().nonnegative().max(24 * 60 * 60 * 1e3),
+  retryMaxDelayMs: z33.number().int().nonnegative().max(7 * 24 * 60 * 60 * 1e3)
 }).strict().refine((value) => value.retryMaxDelayMs >= value.retryBaseDelayMs, {
   message: "retryMaxDelayMs must be at least retryBaseDelayMs"
 });
@@ -36115,28 +37236,28 @@ import { execa as execa4 } from "execa";
 var MAX_COMMAND_OUTPUT_BYTES3 = 64 * 1024;
 
 // src/runs/decisions.ts
-import { z as z32 } from "zod";
-var SubmitDecisionInputSchema = z32.object({
+import { z as z34 } from "zod";
+var SubmitDecisionInputSchema = z34.object({
   /** Unique run identifier */
-  runId: z32.string(),
+  runId: z34.string(),
   /** Action to submit (must match a nextOptions[x].action) */
-  action: z32.string(),
+  action: z34.string(),
   /** Response data (validated against nextOptions[x].responseSchema) */
-  response: z32.unknown(),
+  response: z34.unknown(),
   /** Optional rationale for audit trail */
-  rationale: z32.string().optional()
+  rationale: z34.string().optional()
 });
-var SubmitDecisionOutputSchema = z32.object({
+var SubmitDecisionOutputSchema = z34.object({
   /** Whether the decision was accepted */
-  accepted: z32.boolean(),
+  accepted: z34.boolean(),
   /** Updated status after accepting the decision */
   updatedStatus: StatusResponseSchema,
   /** Error information if rejected */
-  error: z32.object({
+  error: z34.object({
     /** Error code from DecisionErrorCodes */
-    code: z32.string(),
+    code: z34.string(),
     /** Human-readable error message */
-    message: z32.string()
+    message: z34.string()
   }).optional()
 });