@themoltnet/agent-daemon 0.42.1 → 0.43.0

package/dist/cli.js

@@ -5,10 +5,10 @@ import { Type } from "typebox";
 import "multiformats/cid";
 import "multiformats/codecs/json";
 import "multiformats/hashes/sha2";
-import { Value } from "typebox/value";
+import "typebox/value";
 import { dirname, join, resolve } from "node:path";
 import { parseArgs, promisify } from "node:util";
-import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource } from "@themoltnet/agent-runtime";
+import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, resolveProfileWarmSessionTtlSec, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
 import { GuestEnvironmentBoundaryError, assertGuestEnvironmentBoundary, createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normalizeRetryTriageResult, redactRetryTriageSecrets } from "@themoltnet/pi-runtime";
 import { execFile, execFileSync } from "node:child_process";
 import { createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync, realpathSync, rmSync } from "node:fs";
@@ -41,64 +41,6 @@ import { mkdir, realpath, stat } from "node:fs/promises";
 import { pipeline } from "node:stream/promises";
 import { Writable } from "node:stream";
 import { createGzip } from "node:zlib";
-//#region ../../libs/tasks/src/context.ts
-/**
-* How an executor delivers a context entry to its underlying LLM.
-* V1 bindings only; Tier-2 (reference_file, mcp_resource, imported_file,
-* tool_response_seed, additional_context_hook) ship in a later slice.
-*/
-var CONTEXT_BINDINGS = [
-	"skill",
-	"context_inline",
-	"prompt_prefix",
-	"user_inline"
-];
-/** Maximum UTF-16 code units accepted in one ContextRef content field. */
-var CONTEXT_REF_MAX_CONTENT_LENGTH = 65536;
-var ContextBinding = Type.Unsafe(Type.Union(CONTEXT_BINDINGS.map((binding) => Type.Literal(binding)), { $id: "ContextBinding" }));
-/**
-* One context entry. Bytes are inlined: the proposer chose them, and the
-* task's `inputCid` already pins the entire input — including
-* `context[]` — so we don't need a separate per-entry hash, fetcher, or
-* flagged-content gate. Tasks reference rendered packs (or any other
-* external content) by copying their bytes into `content` at task
-* creation time.
-*
-* - `slug` — short identifier the daemon uses to disambiguate
-*            entries. For `skill` binding it becomes the directory
-*            name under the runtime's skill discovery path. Must be
-*            kebab-case-safe (alphanumeric + dashes/underscores).
-* - `binding` — how the bytes are delivered to the LLM (see above).
-* - `content` — UTF-8 text. Capped at 65,536 UTF-16 code units per
-*               entry; total per-task context bytes are bounded by the
-*               soft `maxItems` cap and per-binding daemon limits.
-*               Raised from 32 KiB in 2026-05 — protocol-heavy operator
-*               skills (e.g. `.claude/skills/legreffier/SKILL.md`) ship
-*               at ~35 KiB inline, and the original cap was sized for
-*               short example skills, not the kind of skill the eval
-*               substrate is dogfooded on (#943, #823).
-*/
-var ContextRef = Type.Object({
-	slug: Type.String({
-		minLength: 1,
-		maxLength: 64,
-		pattern: "^[a-zA-Z0-9_-]+$"
-	}),
-	binding: ContextBinding,
-	content: Type.String({
-		minLength: 1,
-		maxLength: CONTEXT_REF_MAX_CONTENT_LENGTH
-	})
-}, {
-	$id: "ContextRef",
-	additionalProperties: false
-});
-/** Reusable input fragment for any task type. Soft cap at 5 items. */
-var TaskContext = Type.Array(ContextRef, {
-	$id: "TaskContext",
-	maxItems: 5
-});
-//#endregion
 //#region ../../libs/tasks/src/rubric.ts
 /**
 * Rubric — structured acceptance criteria used by judgment tasks.
@@ -201,380 +143,868 @@ function validateRubricWeights(rubric) {
 	return null;
 }
 //#endregion
-//#region ../../libs/tasks/src/runtime-models.ts
+//#region ../../libs/tasks/src/success-criteria.ts
 /**
-* Runtime model catalog: a list of supported provider/model couples that
-* MoltNet daemons can target. Backed by the `runtime_models` table.
+* SuccessCriteria — proposer-stated acceptance criteria, evaluated in two
+* complementary places.
 *
-* Scope is intrinsic to the row:
-*   - `teamId == null`  => global entry (MoltNet-seeded, read-only to most callers)
-*   - `teamId != null`  => team-owned custom entry
+* Before this envelope existed, criteria were scattered: a vestigial
+* `criteriaCid` column nobody resolved, free-form prose on
+* `fulfill_brief.input`, and inline `rubric` / `criteria[]` fields on
+* judgment-task inputs. None of those were machine-verifiable
+* end-to-end.
 *
-* The REST API exposes a single shape regardless of scope; the team header
-* gates which rows are returned.
+* This module defines a single, content-addressable envelope a proposer
+* attaches to any task type. It has four orthogonal sections — pick
+* whichever apply per task type:
+*
+*   - `gates`        Promise-level structural/process checks
+*   - `assertions`   Declarative claims about output JSON
+*   - `rubric`       Weighted-criteria scoring instrument, reused
+*                    verbatim from `./rubric.ts`.
+*   - `sideEffects`  Required process side-effects (e.g. diary entry)
+*
+* ## Two roles, two task types
+*
+* **Producer self-assessment** (fulfillment tasks: `fulfill_brief`,
+* `curate_pack`, `render_pack`). The producer **LLM** evaluates the
+* criteria against its own output and emits a `VerificationRecord`
+* inside `output.verification`. The daemon is pure passthrough — it
+* does not run `evaluateAssertions`, does not inspect the verification
+* record. The REST API is dumb storage; it never re-runs assertions and
+* never runs LLMs. The cross-field rule
+* `requireVerificationWhenCriteriaPresent` enforces "verification
+* required iff successCriteria present" at task-output validation time
+* (server-side schema check). Self-assessment is a truthful self-rating,
+* NOT enforcement — `verification.passed=false` does not block /complete
+* and does not affect `acceptedAttemptN`. See
+* `docs/use/tasks-and-runtime.md` for the full producer/judge flow.
+*
+* **Binding evaluation** (judgment tasks: `assess_brief`, `judge_pack`).
+* A separate task whose IS the application of `successCriteria` to
+* someone else's output. Different agent (enforced at claim time), same
+* envelope. The judge's verdict is binding: this is the *gate* in the
+* MoltNet model. The rubric inside `successCriteria.rubric` IS the job
+* spec for the judge.
+*
+* The clean chain: producer task with `successCriteria` → producer
+* self-assesses honestly → proposer (or automation) creates a downstream
+* judgment task that references the same `successCriteria` (or a
+* stricter rubric) → judgment task delivers the binding verdict.
+*
+* Storage: SuccessCriteria lives inline at `task.input.successCriteria`,
+* pinned via the task's `inputCid`. No separate column or hash. When
+* #881 lands, the `rubric` field can graduate to `{ rubricCid }` lookup
+* without changing this envelope, and producer + judge tasks can pin
+* the SAME rubric across the chain for end-to-end auditability.
 */
-var RuntimeModelProvider = Type.String({
-	minLength: 1,
-	maxLength: 100,
-	pattern: "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$"
+var SchemaCheckSpec = Type.Object({ schemaCid: Type.String({ minLength: 1 }) }, { additionalProperties: false });
+var CidEqualsSpec = Type.Object({
+	path: Type.String({ minLength: 1 }),
+	expected: Type.String({ minLength: 1 })
+}, { additionalProperties: false });
+var SubmitToolCallGate = Type.Object({
+	id: Type.String({ minLength: 1 }),
+	kind: Type.Literal("submit-tool-call"),
+	description: Type.String({ minLength: 1 }),
+	required: Type.Boolean()
+}, { additionalProperties: false });
+var Gate = Type.Union([
+	SubmitToolCallGate,
+	Type.Object({
+		id: Type.String({ minLength: 1 }),
+		kind: Type.Literal("schema-check"),
+		spec: SchemaCheckSpec,
+		required: Type.Boolean()
+	}, { additionalProperties: false }),
+	Type.Object({
+		id: Type.String({ minLength: 1 }),
+		kind: Type.Literal("cid-equals"),
+		spec: CidEqualsSpec,
+		required: Type.Boolean()
+	}, { additionalProperties: false })
+], { $id: "Gate" });
+var AssertionOp = Type.Union([
+	Type.Literal("exists"),
+	Type.Literal("equals"),
+	Type.Literal("matches"),
+	Type.Literal("in-range"),
+	Type.Literal("min-length")
+], { $id: "AssertionOp" });
+var Assertion = Type.Object({
+	id: Type.String({ minLength: 1 }),
+	path: Type.String({ minLength: 1 }),
+	op: AssertionOp,
+	value: Type.Optional(Type.Unknown())
+}, {
+	$id: "Assertion",
+	additionalProperties: false
 });
-var RuntimeModelName = Type.String({
-	minLength: 1,
-	maxLength: 200,
-	pattern: "^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,199}$"
+var SideEffectsSpec = Type.Object({
+	diaryEntryRequired: Type.Optional(Type.Boolean()),
+	diaryEntryTags: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+	referencedEntries: Type.Optional(Type.Integer({ minimum: 0 }))
+}, {
+	$id: "SideEffectsSpec",
+	additionalProperties: false
 });
-var RuntimeModelCapabilities = Type.Record(Type.String({
-	minLength: 1,
-	maxLength: 64
-}), Type.Union([
-	Type.Boolean(),
-	Type.Number(),
-	Type.String({ maxLength: 256 })
-]));
-Type.Object({
-	id: Type.String({ format: "uuid" }),
-	teamId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
-	provider: RuntimeModelProvider,
-	model: RuntimeModelName,
-	displayName: Type.Union([Type.String({ maxLength: 200 }), Type.Null()]),
-	description: Type.Union([Type.String({ maxLength: 4096 }), Type.Null()]),
-	capabilities: RuntimeModelCapabilities,
-	isActive: Type.Boolean(),
-	createdByAgentId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
-	createdByHumanId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
-	createdAt: Type.String({ format: "date-time" }),
-	updatedAt: Type.String({ format: "date-time" })
+var SuccessCriteria = Type.Object({
+	version: Type.Literal(1),
+	gates: Type.Optional(Type.Array(Gate)),
+	assertions: Type.Optional(Type.Array(Assertion)),
+	rubric: Type.Optional(Rubric),
+	minComposite: Type.Optional(Type.Number({
+		minimum: 0,
+		maximum: 1
+	})),
+	sideEffects: Type.Optional(SideEffectsSpec)
 }, {
-	$id: "RuntimeModel",
+	$id: "SuccessCriteria",
+	additionalProperties: false
+});
+var VerificationResultStatus = Type.Union([
+	Type.Literal("pass"),
+	Type.Literal("fail"),
+	Type.Literal("skip")
+], { $id: "VerificationResultStatus" });
+var VerificationResultKind = Type.Union([
+	Type.Literal("gate"),
+	Type.Literal("assertion"),
+	Type.Literal("rubric"),
+	Type.Literal("sideEffect")
+], { $id: "VerificationResultKind" });
+var VerificationResult = Type.Object({
+	id: Type.String({ minLength: 1 }),
+	kind: VerificationResultKind,
+	status: VerificationResultStatus,
+	detail: Type.Optional(Type.String())
+}, {
+	$id: "VerificationResult",
+	additionalProperties: false
+});
+var VerificationRecord = Type.Object({
+	inputCid: Type.String({ minLength: 1 }),
+	results: Type.Array(VerificationResult),
+	passed: Type.Boolean({ description: "True iff every verification result has status \"pass\" or \"skip\"; false when any result has status \"fail\"." })
+}, {
+	$id: "VerificationRecord",
 	additionalProperties: false
 });
 //#endregion
-//#region ../../libs/tasks/src/runtime-profile-context-recipes.ts
-var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
-	version: 1,
-	fragments: {
-		"artifact-planner-v1": {
-			binding: "prompt_prefix",
-			content: "# Bounded artifact planner\n\n- The typed task facts, embedded bounded manifest, exact bound artifact references, registered tools, and runtime capability section are the complete contract. Do not search diaries, inspect a mounted repository, enumerate unrelated tasks or artifacts, modify a checkout, commit, branch, push, or contact GitHub.\n- Read only the exact artifact CIDs named by the task, and only when the embedded manifest does not provide enough evidence. Use the registered task-artifact tools for artifact access; never use shell or CLI wrappers to fetch artifacts, paginate, or discover them speculatively.\n- If the effective runtime exposes a local calculator or shell, use it only inside scratch for coverage accounting, budget arithmetic, and JSON validation. The runtime capability section and policy are authoritative; do not assume a static executable list.\n- Perform semantic classification and planning from supplied content and producer/consumer evidence. Do not substitute filename, directory, language, ecosystem, or repository-specific exclusion rules for evidence.\n- Write and upload exactly the requested versioned plan artifact, then reference its returned metadata through the registered submit-output tool. Do not emit a second prose or JSON representation.",
-			slug: "artifact-planner-v1"
-		},
-		"accountable-delivery-v1": {
-			binding: "prompt_prefix",
-			content: "# Accountable delivery\n\n- Pair every commit made during this task with a signed diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer.\n- Keep commit signing enabled; do not bypass the agent git configuration.\n- Push a branch and open or update a pull request only when the task asks for it. For GitHub mutations, use the credential-bound `GH_TOKEN` command form required by the runtime kernel.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
-			slug: "accountable-delivery-v1"
-		},
-		"judgment-diary-v1": {
-			binding: "prompt_prefix",
-			content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a signed diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict.\n- Add the `judgment` tag and the active task type tag (`assess_brief`, `judge_pack`, or `pr_review`). For `judge_pack`, also add `rubric:<rubricId>` from the task facts.\n- Do not use a shell `moltnet entry` command: task provenance is injected only by the custom tool.",
-			slug: "judgment-diary-v1"
-		},
-		"proactive-memory-v1": {
-			binding: "prompt_prefix",
-			content: "# Proactive memory use\n\n- Before non-trivial investigation, debugging, code changes, or review, check the task diary for relevant prior knowledge instead of waiting for a human to ask. Use `moltnet_diary_tags` for cheap reconnaissance, `moltnet_list_entries` when tags or task provenance are known, and `moltnet_search_entries` for semantic similarity. Do not search randomly: pass `taskFilter` for task-local or correlation-local queries, and pass `tags` / `entryTypes` for broader prior-knowledge queries using known tags such as `incident`, `decision`, or `scope:<area>`. Broaden only after constrained searches miss.\n- Before creating an `episodic` incident entry, search for similar incidents using the proposed title, root cause, error text, affected subsystem, and watch-for terms, filtered by `entryTypes: [\"episodic\", \"semantic\"]` and any known `scope:*` or task-provenance tags. If a close prior match exists, do not create an isolated duplicate: reference the prior entry in your response or diary content, update or link it when the new occurrence adds material evidence, or create a new recurrence entry only when the recurrence itself is important signal.\n- When you create a recurrence entry, include the prior matching entry id(s) in the content and explain what is new about this occurrence.",
-			slug: "proactive-memory-v1"
-		},
-		"run-eval-direct-v1": {
-			binding: "prompt_prefix",
-			content: "# Direct evaluation run\n\nThe supplied scenario, typed task facts, injected context, and registered submit-output tool are the complete task contract. Do not search diaries, create diary entries, modify a repository, commit, branch, push, or open a pull request unless a task fact explicitly requires it. Submit the agent-authored payload in the first turn; correction turns exist only to recover a rejected or missing submission.",
-			slug: "run-eval-direct-v1"
-		},
-		"task-diary-discipline-v1": {
-			binding: "prompt_prefix",
-			content: "# Task diary discipline\n\n- During a daemon task, create diary entries only through the `moltnet_create_entry` custom tool. It binds entries to the current task diary and injects task, type, attempt, and correlation provenance tags.\n- Do not shell out to `moltnet entry create`, `moltnet entry create-signed`, or any other `moltnet entry` subcommand from bash while a task is running. Those paths bypass the custom tool's task-tag injection, so task-filtered diary queries cannot find the entry.\n- You may add useful tags, but do not try to replace task provenance supplied by the runtime.",
-			slug: "task-diary-discipline-v1"
-		},
-		"verification-and-artifacts-v1": {
-			binding: "prompt_prefix",
-			content: "# Verification and artifacts\n\n- Run relevant verification before submitting. When task facts include `successCriteria`, assess them honestly in the generated verification contract; a fail or skip with evidence is better than a fabricated pass.\n- The registered submit-output tool owns the exact agent submission schema and validation recovery. Use that schema; do not invent a JSON shape in prose.\n- Upload only task-relevant artifacts, and inspect each before uploading. Never upload secrets, credentials, API keys, auth tokens or headers, .env files, or personal or customer data; redact sensitive values, and prefer minimal, sanitized excerpts over whole logs, bundles, or datasets. Include artifact metadata only where the typed submit contract permits it.\n- If the task depends on prior artifacts, list and download the exact referenced artifact before judging or continuing that work.",
-			slug: "verification-and-artifacts-v1"
-		}
-	},
-	recipes: {
-		"artifact-planner@v1": {
-			description: "Minimal artifact-only context for bounded semantic classification and planning.",
-			fragments: ["artifact-planner-v1"]
-		},
-		"run-eval-direct@v1": {
-			description: "Minimal direct context for a short, isolated evaluation run.",
-			fragments: ["run-eval-direct-v1"]
-		},
-		"standard-engineering@v1": {
-			description: "Full opt-in operating guidance for engineering tasks that need diary research, accountable delivery, and verification discipline.",
-			fragments: [
-				"proactive-memory-v1",
-				"task-diary-discipline-v1",
-				"accountable-delivery-v1",
-				"judgment-diary-v1",
-				"verification-and-artifacts-v1"
-			]
-		}
-	}
-};
-function deepFreeze(value) {
-	if (value && typeof value === "object") {
-		for (const key of Object.keys(value)) deepFreeze(value[key]);
-		Object.freeze(value);
-	}
-	return value;
-}
-deepFreeze(RUNTIME_PROFILE_CONTEXT_CATALOGUE);
-Object.freeze(Object.keys(RUNTIME_PROFILE_CONTEXT_CATALOGUE.recipes));
-//#endregion
-//#region ../../libs/models/src/credential-scopes.ts
-var CREDENTIAL_SCOPES = {
-	AgentProfile: "agent:profile",
-	ConnectorInvoke: "connector:invoke",
-	CryptoSign: "crypto:sign",
-	DiaryManage: "diary:manage",
-	DiaryRead: "diary:read",
-	DiaryWrite: "diary:write",
-	HumanProfile: "human:profile",
-	KeyManage: "key:manage",
-	PackRead: "pack:read",
-	PackWrite: "pack:write",
-	RuntimeManage: "runtime:manage",
-	RuntimeRead: "runtime:read",
-	TaskClaim: "task:claim",
-	TaskExecute: "task:execute",
-	TaskManage: "task:manage",
-	TaskRead: "task:read",
-	TeamManage: "team:manage",
-	TeamRead: "team:read"
-};
-var ALL_CREDENTIAL_SCOPES = Object.freeze(Object.values(CREDENTIAL_SCOPES));
-/**
-* Minimum grant for the agent daemon. Task credentials attenuate this further
-* to `task:execute` alone.
-*/
-var AGENT_CREDENTIAL_SCOPES = [
-	CREDENTIAL_SCOPES.AgentProfile,
-	CREDENTIAL_SCOPES.RuntimeRead,
-	CREDENTIAL_SCOPES.TaskRead,
-	CREDENTIAL_SCOPES.TaskClaim,
-	CREDENTIAL_SCOPES.TaskExecute
-];
-Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile));
-[
-	CREDENTIAL_SCOPES.AgentProfile,
-	CREDENTIAL_SCOPES.CryptoSign,
-	CREDENTIAL_SCOPES.DiaryManage,
-	CREDENTIAL_SCOPES.DiaryRead,
-	CREDENTIAL_SCOPES.DiaryWrite,
-	CREDENTIAL_SCOPES.HumanProfile,
-	CREDENTIAL_SCOPES.PackRead,
-	CREDENTIAL_SCOPES.PackWrite,
-	CREDENTIAL_SCOPES.TaskExecute,
-	CREDENTIAL_SCOPES.TaskManage,
-	CREDENTIAL_SCOPES.TaskRead,
-	CREDENTIAL_SCOPES.TeamManage,
-	CREDENTIAL_SCOPES.TeamRead
-].filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile);
-//#endregion
-//#region ../../libs/models/src/preview-sign.ts
-function schemaRef$1(schema, id) {
-	return Type.Unsafe(Type.Ref(id));
-}
-var PreviewSignBase64UrlSchema = Type.String({
-	$id: "PreviewSignBase64Url",
-	minLength: 1,
-	maxLength: 5462,
-	pattern: "^[A-Za-z0-9_-]+$"
-});
-var PreviewSignSha256Base64UrlSchema = Type.String({
-	$id: "PreviewSignSha256Base64Url",
-	minLength: 43,
-	maxLength: 43,
-	pattern: "^[A-Za-z0-9_-]+$"
-});
-var PreviewSignP256DerSignatureBase64UrlSchema = Type.String({
-	$id: "PreviewSignP256DerSignatureBase64Url",
-	minLength: 11,
-	maxLength: 96,
-	pattern: "^[A-Za-z0-9_-]+$"
-});
-var PreviewSignEs256PublicKeySchema = Type.Object({
-	kty: Type.Literal(2),
-	algorithm: Type.Literal(-7),
-	curve: Type.Literal(1),
-	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
-	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
+//#region ../../libs/tasks/src/task-artifacts.ts
+var TaskArtifact = Type.Object({
+	id: Type.String({ format: "uuid" }),
+	teamId: Type.String({ format: "uuid" }),
+	taskId: Type.String({ format: "uuid" }),
+	attemptN: Type.Union([Type.Integer({ minimum: 1 }), Type.Null()]),
+	kind: Type.String({
+		minLength: 1,
+		maxLength: 100
+	}),
+	title: Type.String({
+		minLength: 1,
+		maxLength: 255
+	}),
+	contentType: Type.String({
+		minLength: 1,
+		maxLength: 200
+	}),
+	contentEncoding: Type.Union([Type.String({
+		minLength: 1,
+		maxLength: 100
+	}), Type.Null()]),
+	sizeBytes: Type.Integer({ minimum: 0 }),
+	cid: Type.String({
+		minLength: 1,
+		maxLength: 100
+	}),
+	createdByAgentId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	expiresAt: Type.Union([Type.String({ format: "date-time" }), Type.Null()]),
+	createdAt: Type.String({ format: "date-time" })
+}, { $id: "TaskArtifact" });
+Type.Object({
+	artifacts: Type.Array(TaskArtifact),
+	nextCursor: Type.Union([Type.String({ minLength: 1 }), Type.Null()])
+}, { $id: "TaskArtifactList" });
+Type.Object({
+	limit: Type.Optional(Type.Integer({
+		minimum: 1,
+		maximum: 100
+	})),
+	cursor: Type.Optional(Type.String({ minLength: 1 }))
 }, {
-	$id: "PreviewSignEs256PublicKey",
+	$id: "ListTaskArtifactsQuery",
 	additionalProperties: false
 });
-var PreviewSignEcdhEsHkdf256PublicKeySchema = Type.Object({
-	kty: Type.Literal(2),
-	algorithm: Type.Literal(-25),
-	curve: Type.Literal(1),
-	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
-	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
-}, {
-	$id: "PreviewSignEcdhEsHkdf256PublicKey",
-	additionalProperties: false
+var HeaderSafeContentType = Type.String({
+	minLength: 1,
+	maxLength: 200,
+	pattern: "^[\\x21-\\x7e][\\x20-\\x7e]*$"
 });
-var PreviewSignEsp256PublicKeySchema = Type.Object({
-	kty: Type.Literal(2),
-	algorithm: Type.Literal(-9),
-	curve: Type.Literal(1),
-	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
-	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
+var HeaderSafeContentEncoding = Type.String({
+	minLength: 1,
+	maxLength: 100,
+	pattern: "^[\\x21-\\x7e][\\x20-\\x7e]*$"
+});
+Type.Object({
+	kind: Type.String({
+		minLength: 1,
+		maxLength: 100
+	}),
+	title: Type.String({
+		minLength: 1,
+		maxLength: 255
+	}),
+	contentType: Type.Optional(HeaderSafeContentType),
+	contentEncoding: Type.Optional(HeaderSafeContentEncoding)
 }, {
-	$id: "PreviewSignEsp256PublicKey",
+	$id: "UploadTaskArtifactQuery",
 	additionalProperties: false
 });
-var PreviewSignArkgSeedPublicKeySchema = Type.Object({
-	kty: Type.Literal(-65537),
-	algorithm: Type.Literal(-65700),
-	derivedAlgorithm: Type.Literal(-9),
-	blindingKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
-	kemKey: schemaRef$1(PreviewSignEcdhEsHkdf256PublicKeySchema, "PreviewSignEcdhEsHkdf256PublicKey")
-}, {
-	$id: "PreviewSignArkgSeedPublicKey",
+Type.String({
+	$id: "TaskArtifactContent",
+	description: "Task artifact content stream.",
+	format: "binary"
+});
+Type.Object({ taskId: Type.String({ format: "uuid" }) }, {
+	$id: "TaskArtifactTaskParams",
 	additionalProperties: false
 });
-var PreviewSignPublicMaterialSchema = Type.Object({
-	version: Type.Literal(1),
-	outerCredentialId: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
-	outerPublicKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
-	previewKeyHandle: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
-	seedPublicKey: schemaRef$1(PreviewSignArkgSeedPublicKeySchema, "PreviewSignArkgSeedPublicKey")
+Type.Object({
+	taskId: Type.String({ format: "uuid" }),
+	attemptN: Type.Integer({ minimum: 1 })
 }, {
-	$id: "PreviewSignPublicMaterial",
+	$id: "TaskArtifactAttemptParams",
 	additionalProperties: false
 });
-var PreviewSignChallengeSchema = Type.Object({
-	verificationMethod: Type.Literal("human-hardware-previewsign"),
-	version: Type.Literal(1),
-	envelope: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
-	digest: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
-	additionalArguments: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
-	outerCredentialId: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
-	outerPublicKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
-	previewKeyHandle: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url")
+Type.Object({
+	taskId: Type.String({ format: "uuid" }),
+	attemptN: Type.Integer({ minimum: 1 }),
+	cid: Type.String({
+		minLength: 1,
+		maxLength: 100
+	})
 }, {
-	$id: "PreviewSignChallenge",
+	$id: "TaskArtifactContentParams",
 	additionalProperties: false
 });
-var PreviewSignChallengeValueSchema = Type.Object({
-	verificationMethod: Type.Literal("human-hardware-previewsign"),
-	value: schemaRef$1(PreviewSignChallengeSchema, "PreviewSignChallenge")
+Type.Object({
+	contentType: Type.Optional(HeaderSafeContentType),
+	contentEncoding: Type.Optional(HeaderSafeContentEncoding)
 }, {
-	$id: "PreviewSignChallengeValue",
+	$id: "StageTaskArtifactQuery",
 	additionalProperties: false
 });
-var PreviewSignChallengeOperationSchema = Type.Union([Type.Literal("credential-registration"), Type.Literal("signing-request")], { $id: "PreviewSignChallengeOperation" });
-var PreviewSignReceiptSchema = Type.Object({
-	version: Type.Literal(1),
-	signature: schemaRef$1(PreviewSignP256DerSignatureBase64UrlSchema, "PreviewSignP256DerSignatureBase64Url")
+Type.Object({
+	cid: Type.String({
+		minLength: 1,
+		maxLength: 100
+	}),
+	sizeBytes: Type.Integer({ minimum: 0 }),
+	contentType: Type.String({
+		minLength: 1,
+		maxLength: 200
+	})
+}, { $id: "StagedTaskArtifact" });
+Type.Object({
+	taskId: Type.String({ format: "uuid" }),
+	cid: Type.String({
+		minLength: 1,
+		maxLength: 100
+	})
 }, {
-	$id: "PreviewSignReceipt",
+	$id: "TaskArtifactTaskContentParams",
 	additionalProperties: false
 });
-var PreviewSignReceiptValueSchema = Type.Object({
-	verificationMethod: Type.Literal("human-hardware-previewsign"),
-	value: schemaRef$1(PreviewSignReceiptSchema, "PreviewSignReceipt")
+//#endregion
+//#region ../../libs/tasks/src/task-types/assess-brief.ts
+/**
+* `assess_brief` — independently evaluate a fulfilled brief.
+*
+* output_kind: judgment
+* criteria: required (`successCriteria.rubric` — same envelope as
+*   `judge_pack`)
+* references: required (must reference the target `fulfill_brief` task)
+*
+* The assessor is a different agent from the producer (enforced by the
+* server / runtime at claim time — not in the wire schema).
+*
+* The rubric in `successCriteria` IS the job spec — the assessor applies
+* it to the target task's output and emits per-criterion scores. Other
+* sections (`assertions`, `gates`, `sideEffects`) MAY be present and are
+* evaluated against the *assessor's output*.
+*/
+var ASSESS_BRIEF_TYPE = "assess_brief";
+var AssessBriefInput = Type.Object({
+	targetTaskId: Type.String({ format: "uuid" }),
+	successCriteria: SuccessCriteria
 }, {
-	$id: "PreviewSignReceiptValue",
+	$id: "AssessBriefInput",
+	additionalProperties: false
+});
+/** One score line. */
+var AssessBriefScore = Type.Object({
+	criterionId: Type.String({ minLength: 1 }),
+	score: Type.Number({
+		minimum: 0,
+		maximum: 1
+	}),
+	rationale: Type.Optional(Type.String()),
+	evidence: Type.Optional(Type.Object({
+		commitsVerified: Type.Number(),
+		commitsTotal: Type.Number(),
+		signatureFailures: Type.Array(Type.String())
+	}, { additionalProperties: false }))
+}, {
+	$id: "AssessBriefScore",
+	additionalProperties: false
+});
+var AssessBriefOutput = Type.Object({
+	scores: Type.Array(AssessBriefScore, { minItems: 1 }),
+	composite: Type.Number({
+		minimum: 0,
+		maximum: 1
+	}),
+	verdict: Type.String({ minLength: 1 }),
+	judgeModel: Type.Optional(Type.String())
+}, {
+	$id: "AssessBriefOutput",
 	additionalProperties: false
 });
-var previewSignSchemaContext = {
-	PreviewSignBase64Url: PreviewSignBase64UrlSchema,
-	PreviewSignSha256Base64Url: PreviewSignSha256Base64UrlSchema,
-	PreviewSignP256DerSignatureBase64Url: PreviewSignP256DerSignatureBase64UrlSchema,
-	PreviewSignEs256PublicKey: PreviewSignEs256PublicKeySchema,
-	PreviewSignEcdhEsHkdf256PublicKey: PreviewSignEcdhEsHkdf256PublicKeySchema,
-	PreviewSignEsp256PublicKey: PreviewSignEsp256PublicKeySchema,
-	PreviewSignArkgSeedPublicKey: PreviewSignArkgSeedPublicKeySchema,
-	PreviewSignPublicMaterial: PreviewSignPublicMaterialSchema,
-	PreviewSignChallenge: PreviewSignChallengeSchema,
-	PreviewSignChallengeValue: PreviewSignChallengeValueSchema,
-	PreviewSignChallengeOperation: PreviewSignChallengeOperationSchema,
-	PreviewSignReceipt: PreviewSignReceiptSchema,
-	PreviewSignReceiptValue: PreviewSignReceiptValueSchema
-};
-//#endregion
-//#region ../../libs/models/src/verification-method.ts
 /**
-* Persisted and wire-level signing verification method identifiers.
+* Async preflight (#1096):
+*   - `targetTaskId` resolves to a real task the caller can see.
+*   - The target is a `fulfill_brief` (you cannot grade an arbitrary
+*     task type as if it were a brief fulfillment).
+*   - Unless readiness checks are explicitly deferred, the target is
+*     `completed` with an accepted attempt — grading an in-flight or
+*     failed task would either race or grade nothing.
 *
-* This vocabulary is append-only. Never rename, remove, or change an existing
-* value: PostgreSQL rows, workflow inputs, and API clients persist these exact
-* strings. Future signing methods must add a new property and value.
+* Agent-distinctness ("assessor ≠ producer") is a runtime / auth-
+* layer concern and intentionally NOT checked here. It belongs in
+* an auth-aware claim-time check.
 */
-var VERIFICATION_METHOD = {
-	AgentEd25519: "agent-ed25519",
-	HumanHardwarePreviewSign: "human-hardware-previewsign"
-};
-VERIFICATION_METHOD.AgentEd25519, VERIFICATION_METHOD.HumanHardwarePreviewSign;
+async function validateAssessBriefInputAsync(input, ctx) {
+	const { targetTaskId } = input;
+	const errors = [];
+	const target = await ctx.resolveTask(targetTaskId);
+	if (!target) {
+		errors.push({
+			field: "targetTaskId",
+			message: `targetTaskId ${targetTaskId} does not resolve to a task you can read`
+		});
+		return errors;
+	}
+	if (target.taskType !== "fulfill_brief") errors.push({
+		field: "targetTaskId",
+		message: `targetTaskId ${targetTaskId} is a ${target.taskType}, not a fulfill_brief`
+	});
+	if (!ctx.deferReadinessChecks && (target.status !== "completed" || target.acceptedAttemptN === null)) errors.push({
+		field: "targetTaskId",
+		message: `targetTaskId ${targetTaskId} is not completed with an accepted attempt (status=${target.status}, acceptedAttemptN=${target.acceptedAttemptN})`
+	});
+	return errors;
+}
 //#endregion
-//#region ../../libs/models/src/schemas.ts
-var UuidSchema = Type.String({
-	format: "uuid",
-	description: "UUID v4 identifier"
-});
-var TimestampSchema = Type.String({
-	format: "date-time",
-	description: "ISO 8601 timestamp"
-});
-var verificationMethodLiterals = [Type.Literal(VERIFICATION_METHOD.AgentEd25519), Type.Literal(VERIFICATION_METHOD.HumanHardwarePreviewSign)];
-Type.Union(verificationMethodLiterals, { description: "Stable signing verification method identifier" });
-var visibilityLiterals = [
-	Type.Literal("private"),
-	Type.Literal("moltnet"),
-	Type.Literal("public")
-];
-Type.Union(visibilityLiterals, { description: "Entry visibility level" });
-var ENTRY_TYPE_VALUES = [
-	"episodic",
-	"semantic",
-	"procedural",
-	"reflection"
-];
-var entryTypeLiterals = [
+//#region ../../libs/tasks/src/task-types/curate-pack.ts
+/**
+* `curate_pack` — select and rank diary entries into a context pack.
+*
+* output_kind: artifact
+* criteria: not required (rubric-less curation recipe)
+* references: optional (e.g. a prior rendered pack being re-curated)
+*
+* This is step 1 of the three-session attribution loop (#875). The agent
+* runs a structured exploration over a diary — tag inventory, hybrid
+* search, type/tag narrowing — and emits a ranked entry list via
+* `moltnet_pack_create`. The prompt is deterministic given the input
+* (no operator interaction), so two runs with the same input should
+* converge on similar packs.
+*
+* Related: `render_pack`, `judge_pack`.
+*/
+var CURATE_PACK_TYPE = "curate_pack";
+var EntryTypeFilter = Type.Union([
 	Type.Literal("episodic"),
 	Type.Literal("semantic"),
 	Type.Literal("procedural"),
 	Type.Literal("reflection")
-];
-var EntryTypeSchema = Type.Union(entryTypeLiterals, { description: "Entry memory type" });
-/** Regex fragment matching a single entry type value. */
-var ENTRY_TYPE_PATTERN = `(${ENTRY_TYPE_VALUES.join("|")})`;
-`${ENTRY_TYPE_PATTERN}${ENTRY_TYPE_PATTERN}`, ENTRY_TYPE_VALUES.length - 1;
-var PublicKeySchema = Type.String({
-	pattern: "^ed25519:[A-Za-z0-9+/=]+$",
-	description: "Ed25519 public key with prefix"
-});
-var FingerprintSchema = Type.String({
-	pattern: "^[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}$",
-	description: "Key fingerprint (A1B2-C3D4-E5F6-G7H8)"
-});
-Type.Object({
-	title: Type.Optional(Type.String({ maxLength: 255 })),
-	content: Type.String({
-		minLength: 1,
-		maxLength: 1e5
-	}),
-	tags: Type.Optional(Type.Array(Type.String({ maxLength: 128 }), { maxItems: 20 }))
+]);
+var CuratePackInput = Type.Object({
+	diaryId: Type.String({ format: "uuid" }),
+	taskPrompt: Type.String({ minLength: 1 }),
+	entryTypes: Type.Optional(Type.Array(EntryTypeFilter, { minItems: 1 })),
+	tagFilters: Type.Optional(Type.Object({
+		include: Type.Optional(Type.Array(Type.String())),
+		exclude: Type.Optional(Type.Array(Type.String())),
+		prefix: Type.Optional(Type.String())
+	}, { additionalProperties: false })),
+	tokenBudget: Type.Optional(Type.Number({ minimum: 500 })),
+	recipe: Type.Optional(Type.Union([Type.Literal("topic-focused-v1"), Type.Literal("scope-inventory-v1")])),
+	successCriteria: Type.Optional(SuccessCriteria)
+}, {
+	$id: "CuratePackInput",
+	additionalProperties: false
 });
-Type.Object({
-	title: Type.Optional(Type.String({ maxLength: 255 })),
-	content: Type.Optional(Type.String({
-		minLength: 1,
-		maxLength: 1e5
-	})),
-	tags: Type.Optional(Type.Array(Type.String({ maxLength: 128 }), { maxItems: 20 }))
+/**
+* Index of the curated pack plus the reasoning trace. The pack itself
+* lives in the database (created via `moltnet_pack_create`); this output
+* is the receipt.
+*/
+var CuratePackOutput = Type.Object({
+	packId: Type.String({ format: "uuid" }),
+	packCid: Type.String({ minLength: 1 }),
+	entries: Type.Array(Type.Object({
+		entryId: Type.String({ format: "uuid" }),
+		rank: Type.Number({ minimum: 1 }),
+		rationale: Type.String({ minLength: 1 })
+	}, { additionalProperties: false }), { minItems: 1 }),
+	recipeParams: Type.Record(Type.String(), Type.Unknown()),
+	checkpoints: Type.Optional(Type.Array(Type.Object({
+		phase: Type.String({ minLength: 1 }),
+		candidateIds: Type.Array(Type.String({ format: "uuid" })),
+		droppedIds: Type.Optional(Type.Array(Type.String({ format: "uuid" }))),
+		notes: Type.String({ minLength: 1 })
+	}, { additionalProperties: false }))),
+	summary: Type.String({ minLength: 1 }),
+	verification: Type.Optional(VerificationRecord)
+}, {
+	$id: "CuratePackOutput",
+	additionalProperties: false
 });
-Type.Object({
-	query: Type.Optional(Type.String({
-		minLength: 1,
-		maxLength: 500
-	})),
-	tags: Type.Optional(Type.Array(Type.String({ maxLength: 128 }), {
-		minItems: 1,
-		maxItems: 20,
-		description: "Filter: entry must have ALL specified tags"
-	})),
-	limit: Type.Optional(Type.Number({
+//#endregion
+//#region ../../libs/runtime-profiles/src/context.ts
+/**
+* How an executor delivers a context entry to its underlying LLM.
+* V1 bindings only; Tier-2 (reference_file, mcp_resource, imported_file,
+* tool_response_seed, additional_context_hook) ship in a later slice.
+*/
+var CONTEXT_BINDINGS = [
+	"skill",
+	"context_inline",
+	"prompt_prefix",
+	"user_inline"
+];
+/** Maximum UTF-16 code units accepted in one ContextRef content field. */
+var CONTEXT_REF_MAX_CONTENT_LENGTH = 65536;
+var ContextBinding = Type.Unsafe(Type.Union(CONTEXT_BINDINGS.map((binding) => Type.Literal(binding)), { $id: "ContextBinding" }));
+/**
+* One context entry. Bytes are inlined: the proposer chose them, and the
+* task's `inputCid` already pins the entire input — including
+* `context[]` — so we don't need a separate per-entry hash, fetcher, or
+* flagged-content gate. Tasks reference rendered packs (or any other
+* external content) by copying their bytes into `content` at task
+* creation time.
+*
+* - `slug` — short identifier the daemon uses to disambiguate
+*            entries. For `skill` binding it becomes the directory
+*            name under the runtime's skill discovery path. Must be
+*            kebab-case-safe (alphanumeric + dashes/underscores).
+* - `binding` — how the bytes are delivered to the LLM (see above).
+* - `content` — UTF-8 text. Capped at 65,536 UTF-16 code units per
+*               entry; total per-task context bytes are bounded by the
+*               soft `maxItems` cap and per-binding daemon limits.
+*               Raised from 32 KiB in 2026-05 — protocol-heavy operator
+*               skills (e.g. `.claude/skills/legreffier/SKILL.md`) ship
+*               at ~35 KiB inline, and the original cap was sized for
+*               short example skills, not the kind of skill the eval
+*               substrate is dogfooded on (#943, #823).
+*/
+var ContextRef = Type.Object({
+	slug: Type.String({
+		minLength: 1,
+		maxLength: 64,
+		pattern: "^[a-zA-Z0-9_-]+$"
+	}),
+	binding: ContextBinding,
+	content: Type.String({
+		minLength: 1,
+		maxLength: CONTEXT_REF_MAX_CONTENT_LENGTH
+	})
+}, {
+	$id: "ContextRef",
+	additionalProperties: false
+});
+/** Reusable input fragment for any task type. Soft cap at 5 items. */
+var TaskContext = Type.Array(ContextRef, {
+	$id: "TaskContext",
+	maxItems: 5
+});
+//#endregion
+//#region ../../libs/runtime-profiles/src/runtime-models.ts
+/**
+* Runtime model catalog: a list of supported provider/model couples that
+* MoltNet daemons can target. Backed by the `runtime_models` table.
+*
+* Scope is intrinsic to the row:
+*   - `teamId == null`  => global entry (MoltNet-seeded, read-only to most callers)
+*   - `teamId != null`  => team-owned custom entry
+*
+* The REST API exposes a single shape regardless of scope; the team header
+* gates which rows are returned.
+*/
+var RuntimeModelProvider = Type.String({
+	minLength: 1,
+	maxLength: 100,
+	pattern: "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$"
+});
+var RuntimeModelName = Type.String({
+	minLength: 1,
+	maxLength: 200,
+	pattern: "^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,199}$"
+});
+var RuntimeModelCapabilities = Type.Record(Type.String({
+	minLength: 1,
+	maxLength: 64
+}), Type.Union([
+	Type.Boolean(),
+	Type.Number(),
+	Type.String({ maxLength: 256 })
+]));
+Type.Object({
+	id: Type.String({ format: "uuid" }),
+	teamId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	provider: RuntimeModelProvider,
+	model: RuntimeModelName,
+	displayName: Type.Union([Type.String({ maxLength: 200 }), Type.Null()]),
+	description: Type.Union([Type.String({ maxLength: 4096 }), Type.Null()]),
+	capabilities: RuntimeModelCapabilities,
+	isActive: Type.Boolean(),
+	createdByAgentId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	createdByHumanId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	createdAt: Type.String({ format: "date-time" }),
+	updatedAt: Type.String({ format: "date-time" })
+}, {
+	$id: "RuntimeModel",
+	additionalProperties: false
+});
+//#endregion
+//#region ../../libs/runtime-profiles/src/runtime-profile-context-recipes.ts
+var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
+	version: 1,
+	fragments: {
+		"artifact-planner-v1": {
+			binding: "prompt_prefix",
+			content: "# Bounded artifact planner\n\n- The typed task facts, embedded bounded manifest, exact bound artifact references, registered tools, and runtime capability section are the complete contract. Do not search diaries, inspect a mounted repository, enumerate unrelated tasks or artifacts, modify a checkout, commit, branch, push, or contact GitHub.\n- Read only the exact artifact CIDs named by the task, and only when the embedded manifest does not provide enough evidence. Use the registered task-artifact tools for artifact access; never use shell or CLI wrappers to fetch artifacts, paginate, or discover them speculatively.\n- If the effective runtime exposes a local calculator or shell, use it only inside scratch for coverage accounting, budget arithmetic, and JSON validation. The runtime capability section and policy are authoritative; do not assume a static executable list.\n- Perform semantic classification and planning from supplied content and producer/consumer evidence. Do not substitute filename, directory, language, ecosystem, or repository-specific exclusion rules for evidence.\n- Write and upload exactly the requested versioned plan artifact, then reference its returned metadata through the registered submit-output tool. Do not emit a second prose or JSON representation.",
+			slug: "artifact-planner-v1"
+		},
+		"accountable-delivery-v1": {
+			binding: "prompt_prefix",
+			content: "# Accountable delivery\n\n- Pair every commit made during this task with a task-provenance diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer. The tool does not currently promise a content signature; never describe an entry as signed unless the active runtime exposes and verifies a signing capability.\n- Do not disable commit signing when the active runtime provides it. A host-authenticated guest has no injected signing key, so do not recover one from host configuration or claim an unsigned commit is signed.\n- Push a branch and open or update a pull request only when the task asks for it. Use a host-brokered GitHub placeholder only when the runtime kernel declares one; if no GitHub credential is active, the authenticated operation is unavailable.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
+			slug: "accountable-delivery-v1"
+		},
+		"judgment-diary-v1": {
+			binding: "prompt_prefix",
+			content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict. Do not claim a content signature unless the active runtime exposes and verifies a signing capability.\n- Add the `judgment` tag and the active task type tag (`assess_brief`, `judge_pack`, or `pr_review`). For `judge_pack`, also add `rubric:<rubricId>` from the task facts.\n- Do not use a shell `moltnet entry` command: task provenance is injected only by the custom tool.",
+			slug: "judgment-diary-v1"
+		},
+		"proactive-memory-v1": {
+			binding: "prompt_prefix",
+			content: "# Proactive memory use\n\n- Before non-trivial investigation, debugging, code changes, or review, check the task diary for relevant prior knowledge instead of waiting for a human to ask. Use `moltnet_diary_tags` for cheap reconnaissance, `moltnet_list_entries` when tags or task provenance are known, and `moltnet_search_entries` for semantic similarity. Do not search randomly: pass `taskFilter` for task-local or correlation-local queries, and pass `tags` / `entryTypes` for broader prior-knowledge queries using known tags such as `incident`, `decision`, or `scope:<area>`. Broaden only after constrained searches miss.\n- Before creating an `episodic` incident entry, search for similar incidents using the proposed title, root cause, error text, affected subsystem, and watch-for terms, filtered by `entryTypes: [\"episodic\", \"semantic\"]` and any known `scope:*` or task-provenance tags. If a close prior match exists, do not create an isolated duplicate: reference the prior entry in your response or diary content, update or link it when the new occurrence adds material evidence, or create a new recurrence entry only when the recurrence itself is important signal.\n- When you create a recurrence entry, include the prior matching entry id(s) in the content and explain what is new about this occurrence.",
+			slug: "proactive-memory-v1"
+		},
+		"run-eval-direct-v1": {
+			binding: "prompt_prefix",
+			content: "# Direct evaluation run\n\nThe supplied scenario, typed task facts, injected context, and registered submit-output tool are the complete task contract. Do not search diaries, create diary entries, modify a repository, commit, branch, push, or open a pull request unless a task fact explicitly requires it. Submit the agent-authored payload in the first turn; correction turns exist only to recover a rejected or missing submission.",
+			slug: "run-eval-direct-v1"
+		},
+		"task-diary-discipline-v1": {
+			binding: "prompt_prefix",
+			content: "# Task diary discipline\n\n- During a daemon task, create diary entries only through the `moltnet_create_entry` custom tool. It binds entries to the current task diary and injects task, type, attempt, and correlation provenance tags.\n- Do not shell out to `moltnet entry create`, `moltnet entry create-signed`, or any other `moltnet entry` subcommand from bash while a task is running. Those paths bypass the custom tool's task-tag injection, so task-filtered diary queries cannot find the entry.\n- You may add useful tags, but do not try to replace task provenance supplied by the runtime.",
+			slug: "task-diary-discipline-v1"
+		},
+		"verification-and-artifacts-v1": {
+			binding: "prompt_prefix",
+			content: "# Verification and artifacts\n\n- Run relevant verification before submitting. When task facts include `successCriteria`, assess them honestly in the generated verification contract; a fail or skip with evidence is better than a fabricated pass.\n- The registered submit-output tool owns the exact agent submission schema and validation recovery. Use that schema; do not invent a JSON shape in prose.\n- Upload only task-relevant artifacts, and inspect each before uploading. Never upload secrets, credentials, API keys, auth tokens or headers, .env files, or personal or customer data; redact sensitive values, and prefer minimal, sanitized excerpts over whole logs, bundles, or datasets. Include artifact metadata only where the typed submit contract permits it.\n- If the task depends on prior artifacts, list and download the exact referenced artifact before judging or continuing that work.",
+			slug: "verification-and-artifacts-v1"
+		}
+	},
+	recipes: {
+		"artifact-planner@v1": {
+			description: "Minimal artifact-only context for bounded semantic classification and planning.",
+			fragments: ["artifact-planner-v1"]
+		},
+		"run-eval-direct@v1": {
+			description: "Minimal direct context for a short, isolated evaluation run.",
+			fragments: ["run-eval-direct-v1"]
+		},
+		"standard-engineering@v1": {
+			description: "Full opt-in operating guidance for engineering tasks that need diary research, accountable delivery, and verification discipline.",
+			fragments: [
+				"proactive-memory-v1",
+				"task-diary-discipline-v1",
+				"accountable-delivery-v1",
+				"judgment-diary-v1",
+				"verification-and-artifacts-v1"
+			]
+		}
+	}
+};
+function deepFreeze(value) {
+	if (value && typeof value === "object") {
+		for (const key of Object.keys(value)) deepFreeze(value[key]);
+		Object.freeze(value);
+	}
+	return value;
+}
+deepFreeze(RUNTIME_PROFILE_CONTEXT_CATALOGUE);
+Object.freeze(Object.keys(RUNTIME_PROFILE_CONTEXT_CATALOGUE.recipes));
+//#endregion
+//#region ../../libs/models/src/credential-scopes.ts
+var CREDENTIAL_SCOPES = {
+	AgentProfile: "agent:profile",
+	ConnectorInvoke: "connector:invoke",
+	CryptoSign: "crypto:sign",
+	DiaryManage: "diary:manage",
+	DiaryRead: "diary:read",
+	DiaryWrite: "diary:write",
+	HumanProfile: "human:profile",
+	KeyManage: "key:manage",
+	PackRead: "pack:read",
+	PackWrite: "pack:write",
+	RuntimeManage: "runtime:manage",
+	RuntimeRead: "runtime:read",
+	TaskClaim: "task:claim",
+	TaskExecute: "task:execute",
+	TaskManage: "task:manage",
+	TaskRead: "task:read",
+	TeamManage: "team:manage",
+	TeamRead: "team:read"
+};
+var ALL_CREDENTIAL_SCOPES = Object.freeze(Object.values(CREDENTIAL_SCOPES));
+/**
+* Minimum grant for the agent daemon. Task credentials attenuate this further
+* to `task:execute` alone.
+*/
+var AGENT_CREDENTIAL_SCOPES = [
+	CREDENTIAL_SCOPES.AgentProfile,
+	CREDENTIAL_SCOPES.RuntimeRead,
+	CREDENTIAL_SCOPES.TaskRead,
+	CREDENTIAL_SCOPES.TaskClaim,
+	CREDENTIAL_SCOPES.TaskExecute
+];
+Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile));
+[
+	CREDENTIAL_SCOPES.AgentProfile,
+	CREDENTIAL_SCOPES.CryptoSign,
+	CREDENTIAL_SCOPES.DiaryManage,
+	CREDENTIAL_SCOPES.DiaryRead,
+	CREDENTIAL_SCOPES.DiaryWrite,
+	CREDENTIAL_SCOPES.HumanProfile,
+	CREDENTIAL_SCOPES.PackRead,
+	CREDENTIAL_SCOPES.PackWrite,
+	CREDENTIAL_SCOPES.TaskExecute,
+	CREDENTIAL_SCOPES.TaskManage,
+	CREDENTIAL_SCOPES.TaskRead,
+	CREDENTIAL_SCOPES.TeamManage,
+	CREDENTIAL_SCOPES.TeamRead
+].filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile);
+//#endregion
+//#region ../../libs/models/src/preview-sign.ts
+function schemaRef$1(schema, id) {
+	return Type.Unsafe(Type.Ref(id));
+}
+var PreviewSignBase64UrlSchema = Type.String({
+	$id: "PreviewSignBase64Url",
+	minLength: 1,
+	maxLength: 5462,
+	pattern: "^[A-Za-z0-9_-]+$"
+});
+var PreviewSignSha256Base64UrlSchema = Type.String({
+	$id: "PreviewSignSha256Base64Url",
+	minLength: 43,
+	maxLength: 43,
+	pattern: "^[A-Za-z0-9_-]+$"
+});
+var PreviewSignP256DerSignatureBase64UrlSchema = Type.String({
+	$id: "PreviewSignP256DerSignatureBase64Url",
+	minLength: 11,
+	maxLength: 96,
+	pattern: "^[A-Za-z0-9_-]+$"
+});
+var PreviewSignEs256PublicKeySchema = Type.Object({
+	kty: Type.Literal(2),
+	algorithm: Type.Literal(-7),
+	curve: Type.Literal(1),
+	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
+}, {
+	$id: "PreviewSignEs256PublicKey",
+	additionalProperties: false
+});
+var PreviewSignEcdhEsHkdf256PublicKeySchema = Type.Object({
+	kty: Type.Literal(2),
+	algorithm: Type.Literal(-25),
+	curve: Type.Literal(1),
+	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
+}, {
+	$id: "PreviewSignEcdhEsHkdf256PublicKey",
+	additionalProperties: false
+});
+var PreviewSignEsp256PublicKeySchema = Type.Object({
+	kty: Type.Literal(2),
+	algorithm: Type.Literal(-9),
+	curve: Type.Literal(1),
+	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
+}, {
+	$id: "PreviewSignEsp256PublicKey",
+	additionalProperties: false
+});
+var PreviewSignArkgSeedPublicKeySchema = Type.Object({
+	kty: Type.Literal(-65537),
+	algorithm: Type.Literal(-65700),
+	derivedAlgorithm: Type.Literal(-9),
+	blindingKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
+	kemKey: schemaRef$1(PreviewSignEcdhEsHkdf256PublicKeySchema, "PreviewSignEcdhEsHkdf256PublicKey")
+}, {
+	$id: "PreviewSignArkgSeedPublicKey",
+	additionalProperties: false
+});
+var PreviewSignPublicMaterialSchema = Type.Object({
+	version: Type.Literal(1),
+	outerCredentialId: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	outerPublicKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
+	previewKeyHandle: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	seedPublicKey: schemaRef$1(PreviewSignArkgSeedPublicKeySchema, "PreviewSignArkgSeedPublicKey")
+}, {
+	$id: "PreviewSignPublicMaterial",
+	additionalProperties: false
+});
+var PreviewSignChallengeSchema = Type.Object({
+	verificationMethod: Type.Literal("human-hardware-previewsign"),
+	version: Type.Literal(1),
+	envelope: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	digest: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	additionalArguments: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	outerCredentialId: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	outerPublicKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
+	previewKeyHandle: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url")
+}, {
+	$id: "PreviewSignChallenge",
+	additionalProperties: false
+});
+var PreviewSignChallengeValueSchema = Type.Object({
+	verificationMethod: Type.Literal("human-hardware-previewsign"),
+	value: schemaRef$1(PreviewSignChallengeSchema, "PreviewSignChallenge")
+}, {
+	$id: "PreviewSignChallengeValue",
+	additionalProperties: false
+});
+var PreviewSignChallengeOperationSchema = Type.Union([Type.Literal("credential-registration"), Type.Literal("signing-request")], { $id: "PreviewSignChallengeOperation" });
+var PreviewSignReceiptSchema = Type.Object({
+	version: Type.Literal(1),
+	signature: schemaRef$1(PreviewSignP256DerSignatureBase64UrlSchema, "PreviewSignP256DerSignatureBase64Url")
+}, {
+	$id: "PreviewSignReceipt",
+	additionalProperties: false
+});
+var PreviewSignReceiptValueSchema = Type.Object({
+	verificationMethod: Type.Literal("human-hardware-previewsign"),
+	value: schemaRef$1(PreviewSignReceiptSchema, "PreviewSignReceipt")
+}, {
+	$id: "PreviewSignReceiptValue",
+	additionalProperties: false
+});
+var previewSignSchemaContext = {
+	PreviewSignBase64Url: PreviewSignBase64UrlSchema,
+	PreviewSignSha256Base64Url: PreviewSignSha256Base64UrlSchema,
+	PreviewSignP256DerSignatureBase64Url: PreviewSignP256DerSignatureBase64UrlSchema,
+	PreviewSignEs256PublicKey: PreviewSignEs256PublicKeySchema,
+	PreviewSignEcdhEsHkdf256PublicKey: PreviewSignEcdhEsHkdf256PublicKeySchema,
+	PreviewSignEsp256PublicKey: PreviewSignEsp256PublicKeySchema,
+	PreviewSignArkgSeedPublicKey: PreviewSignArkgSeedPublicKeySchema,
+	PreviewSignPublicMaterial: PreviewSignPublicMaterialSchema,
+	PreviewSignChallenge: PreviewSignChallengeSchema,
+	PreviewSignChallengeValue: PreviewSignChallengeValueSchema,
+	PreviewSignChallengeOperation: PreviewSignChallengeOperationSchema,
+	PreviewSignReceipt: PreviewSignReceiptSchema,
+	PreviewSignReceiptValue: PreviewSignReceiptValueSchema
+};
+//#endregion
+//#region ../../libs/models/src/verification-method.ts
+/**
+* Persisted and wire-level signing verification method identifiers.
+*
+* This vocabulary is append-only. Never rename, remove, or change an existing
+* value: PostgreSQL rows, workflow inputs, and API clients persist these exact
+* strings. Future signing methods must add a new property and value.
+*/
+var VERIFICATION_METHOD = {
+	AgentEd25519: "agent-ed25519",
+	HumanHardwarePreviewSign: "human-hardware-previewsign"
+};
+VERIFICATION_METHOD.AgentEd25519, VERIFICATION_METHOD.HumanHardwarePreviewSign;
+//#endregion
+//#region ../../libs/models/src/schemas.ts
+var UuidSchema = Type.String({
+	format: "uuid",
+	description: "UUID v4 identifier"
+});
+var TimestampSchema = Type.String({
+	format: "date-time",
+	description: "ISO 8601 timestamp"
+});
+var verificationMethodLiterals = [Type.Literal(VERIFICATION_METHOD.AgentEd25519), Type.Literal(VERIFICATION_METHOD.HumanHardwarePreviewSign)];
+Type.Union(verificationMethodLiterals, { description: "Stable signing verification method identifier" });
+var visibilityLiterals = [
+	Type.Literal("private"),
+	Type.Literal("moltnet"),
+	Type.Literal("public")
+];
+Type.Union(visibilityLiterals, { description: "Entry visibility level" });
+var ENTRY_TYPE_VALUES = [
+	"episodic",
+	"semantic",
+	"procedural",
+	"reflection"
+];
+var entryTypeLiterals = [
+	Type.Literal("episodic"),
+	Type.Literal("semantic"),
+	Type.Literal("procedural"),
+	Type.Literal("reflection")
+];
+var EntryTypeSchema = Type.Union(entryTypeLiterals, { description: "Entry memory type" });
+/** Regex fragment matching a single entry type value. */
+var ENTRY_TYPE_PATTERN = `(${ENTRY_TYPE_VALUES.join("|")})`;
+`${ENTRY_TYPE_PATTERN}${ENTRY_TYPE_PATTERN}`, ENTRY_TYPE_VALUES.length - 1;
+var PublicKeySchema = Type.String({
+	pattern: "^ed25519:[A-Za-z0-9+/=]+$",
+	description: "Ed25519 public key with prefix"
+});
+var FingerprintSchema = Type.String({
+	pattern: "^[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}$",
+	description: "Key fingerprint (A1B2-C3D4-E5F6-G7H8)"
+});
+Type.Object({
+	title: Type.Optional(Type.String({ maxLength: 255 })),
+	content: Type.String({
+		minLength: 1,
+		maxLength: 1e5
+	}),
+	tags: Type.Optional(Type.Array(Type.String({ maxLength: 128 }), { maxItems: 20 }))
+});
+Type.Object({
+	title: Type.Optional(Type.String({ maxLength: 255 })),
+	content: Type.Optional(Type.String({
+		minLength: 1,
+		maxLength: 1e5
+	})),
+	tags: Type.Optional(Type.Array(Type.String({ maxLength: 128 }), { maxItems: 20 }))
+});
+Type.Object({
+	query: Type.Optional(Type.String({
+		minLength: 1,
+		maxLength: 500
+	})),
+	tags: Type.Optional(Type.Array(Type.String({ maxLength: 128 }), {
+		minItems: 1,
+		maxItems: 20,
+		description: "Filter: entry must have ALL specified tags"
+	})),
+	limit: Type.Optional(Type.Number({
 		minimum: 1,
 		maximum: 100,
 		default: 20
@@ -1173,921 +1603,491 @@ var SignerProblemSchema = Type.Object({
 	$id: "SignerProblem",
 	additionalProperties: false
 });
-var SignerCeremonyParamsSchema = Type.Object({ ceremonyId: Type.Unsafe(schemaRef(SignerBase64UrlSchema)) }, {
-	$id: "SignerCeremonyParams",
-	additionalProperties: false
-});
-var SignerSessionSchema = Type.Object({
-	version: Type.Literal(1),
-	token: Type.Unsafe(schemaRef(SignerBase64UrlSchema)),
-	expiresAt: Type.String()
-}, {
-	$id: "SignerSession",
-	additionalProperties: false
-});
-var SignerEnrollmentCeremonyRequestSchema = Type.Object({
-	version: Type.Literal(1),
-	operation: Type.Literal("credential-enrollment"),
-	label: Type.String({
-		minLength: 1,
-		maxLength: 255
-	}),
-	teamId: Type.Unsafe(schemaRef(SignerUuidSchema))
-}, {
-	$id: "SignerEnrollmentCeremonyRequest",
-	additionalProperties: false
-});
-var SignerChallengeCeremonyRequestSchema = Type.Object({
-	version: Type.Literal(1),
-	operation: Type.Unsafe(schemaRef(SignerChallengeOperationSchema)),
-	resourceId: Type.Unsafe(schemaRef(SignerUuidSchema)),
-	challenge: Type.Unsafe(schemaRef(SignerPreviewSignChallengeValueSchema))
-}, {
-	$id: "SignerChallengeCeremonyRequest",
-	additionalProperties: false
-});
-var SignerCeremonyRequestSchema = Type.Union([Type.Unsafe(schemaRef(SignerEnrollmentCeremonyRequestSchema)), Type.Unsafe(schemaRef(SignerChallengeCeremonyRequestSchema))], { $id: "SignerCeremonyRequest" });
-var SignerCeremonySchema = Type.Object({
-	version: Type.Literal(1),
-	id: Type.Unsafe(schemaRef(SignerBase64UrlSchema)),
-	operation: Type.Unsafe(schemaRef(SignerOperationSchema)),
-	approvalUrl: Type.String(),
-	expiresAt: Type.String()
-}, {
-	$id: "SignerCeremony",
-	additionalProperties: false
-});
-var SignerPendingResultSchema = Type.Object({
-	version: Type.Literal(1),
-	status: Type.Literal("pending"),
-	operation: Type.Unsafe(schemaRef(SignerOperationSchema))
-}, {
-	$id: "SignerPendingResult",
-	additionalProperties: false
-});
-var SignerEnrollmentResultSchema = Type.Object({
-	version: Type.Literal(1),
-	status: Type.Literal("completed"),
-	operation: Type.Literal("credential-enrollment"),
-	publicMaterial: Type.Unsafe(schemaRef(SignerPreviewSignPublicMaterialSchema))
-}, {
-	$id: "SignerEnrollmentResult",
-	additionalProperties: false
-});
-var SignerReceiptSchema = PreviewSignReceiptValueSchema;
-var SignerSignatureResultSchema = Type.Object({
-	version: Type.Literal(1),
-	status: Type.Literal("completed"),
-	operation: Type.Unsafe(schemaRef(SignerChallengeOperationSchema)),
-	receipt: Type.Unsafe(schemaRef(SignerReceiptSchema))
-}, {
-	$id: "SignerSignatureResult",
-	additionalProperties: false
-});
-var SignerFailedResultSchema = Type.Object({
-	version: Type.Literal(1),
-	status: Type.Literal("failed"),
-	operation: Type.Unsafe(schemaRef(SignerOperationSchema)),
-	code: Type.String(),
-	message: Type.String()
-}, {
-	$id: "SignerFailedResult",
-	additionalProperties: false
-});
-var SignerCeremonyResultSchema = Type.Union([
-	Type.Unsafe(schemaRef(SignerPendingResultSchema)),
-	Type.Unsafe(schemaRef(SignerEnrollmentResultSchema)),
-	Type.Unsafe(schemaRef(SignerSignatureResultSchema)),
-	Type.Unsafe(schemaRef(SignerFailedResultSchema))
-], { $id: "SignerCeremonyResult" });
-({ ...previewSignSchemaContext }), schemaId(SignerUuidSchema), schemaId(SignerOperationSchema), schemaId(SignerProblemSchema), schemaId(SignerCeremonyParamsSchema), schemaId(SignerSessionSchema), schemaId(SignerEnrollmentCeremonyRequestSchema), schemaId(SignerChallengeCeremonyRequestSchema), schemaId(SignerCeremonyRequestSchema), schemaId(SignerCeremonySchema), schemaId(SignerPendingResultSchema), schemaId(SignerEnrollmentResultSchema), schemaId(SignerSignatureResultSchema), schemaId(SignerFailedResultSchema), schemaId(SignerCeremonyResultSchema);
-//#endregion
-//#region ../../libs/models/src/tool-enforcement.ts
-var TOOL_ENFORCEMENT_VALUES = [
-	"off",
-	"watch",
-	"enforce"
-];
-var toolEnforcementLiterals = [
-	Type.Literal(TOOL_ENFORCEMENT_VALUES[0]),
-	Type.Literal(TOOL_ENFORCEMENT_VALUES[1]),
-	Type.Literal(TOOL_ENFORCEMENT_VALUES[2])
-];
-var ToolEnforcementSchema = Type.Union(toolEnforcementLiterals, { description: "Runtime tool-policy enforcement mode: off (inert), watch (audit only), enforce (block disallowed tools, fail-closed)." });
-//#endregion
-//#region ../../libs/tasks/src/runtime-profiles.ts
-var RuntimeProfileName = Type.String({
-	minLength: 1,
-	maxLength: 100,
-	pattern: "^[a-zA-Z0-9][a-zA-Z0-9_-]{0,99}$"
-});
-var RuntimeProfileEnvName = Type.String({
-	minLength: 1,
-	maxLength: 128,
-	pattern: "^[A-Z_][A-Z0-9_]*$"
-});
-var RuntimeProfileToolName = Type.String({
-	minLength: 1,
-	maxLength: 128,
-	pattern: "^[a-zA-Z0-9._/-]+$"
-});
-var RUNTIME_PROFILE_RUNTIME_KIND_PATTERN = "^[a-z][a-z0-9._-]{0,99}$";
-new RegExp(RUNTIME_PROFILE_RUNTIME_KIND_PATTERN);
-var RuntimeProfileRuntimeKind = Type.String({
-	minLength: 1,
-	maxLength: 100,
-	pattern: RUNTIME_PROFILE_RUNTIME_KIND_PATTERN
-});
-var RuntimeProfileWorkspaceMode = Type.Union([
-	Type.Literal("none"),
-	Type.Literal("shared_mount"),
-	Type.Literal("dedicated_worktree")
-]);
-/**
-* Tool-policy enforcement mode for the profile's runtime `tool_call` gate:
-* `off` (inert), `watch` (audit only), `enforce` (block disallowed tools,
-* fail-closed). Read by the daemon via `GET /runtime-profiles/:id/allowed-tools`.
-*/
-var RuntimeProfileToolEnforcement = ToolEnforcementSchema;
-var RuntimeProfileAllowedWorkspaceModes = Type.Array(RuntimeProfileWorkspaceMode, {
-	minItems: 1,
-	maxItems: 3,
-	uniqueItems: true
-});
-var RuntimeProfileThinkingLevelOptions = [
-	Type.Literal("off"),
-	Type.Literal("minimal"),
-	Type.Literal("low"),
-	Type.Literal("medium"),
-	Type.Literal("high"),
-	Type.Literal("xhigh")
-];
-Type.Union([...RuntimeProfileThinkingLevelOptions]);
-var RuntimeProfileNullableThinkingLevel = Type.Union([...RuntimeProfileThinkingLevelOptions, Type.Null()]);
-var RuntimeProfileNullableTemperature = Type.Union([Type.Null(), Type.Number({
-	minimum: 0,
-	maximum: 2
-})]);
-var RuntimeProfileNullableTopP = Type.Union([Type.Null(), Type.Number({
-	minimum: 0,
-	maximum: 1
-})]);
-var RuntimeProfileNullableTopK = Type.Union([Type.Integer({
-	minimum: 1,
-	maximum: 1e4
-}), Type.Null()]);
-var RuntimeProfileNullableMaxOutputTokens = Type.Union([Type.Integer({
-	minimum: 1,
-	maximum: 1e6
-}), Type.Null()]);
-var RuntimeProfileAllowedHost = Type.String({
-	minLength: 1,
-	maxLength: 255,
-	pattern: "^(?:\\*\\.)?(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)(?:\\.(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?))*$"
-});
-var RuntimeProfileSandbox = Type.Object({
-	network: Type.Optional(Type.Object({
-		allowedHosts: Type.Optional(Type.Array(RuntimeProfileAllowedHost, { maxItems: 50 })),
-		allowedInternalHosts: Type.Optional(Type.Array(RuntimeProfileAllowedHost, { maxItems: 50 }))
-	}, { additionalProperties: false })),
-	vfs: Type.Optional(Type.Object({
-		shadow: Type.Optional(Type.Array(Type.String({
-			minLength: 1,
-			maxLength: 255
-		}), { maxItems: 100 })),
-		shadowMode: Type.Optional(Type.Union([Type.Literal("deny"), Type.Literal("tmpfs")]))
-	}, { additionalProperties: false })),
-	env: Type.Optional(Type.Record(RuntimeProfileEnvName, Type.String({ maxLength: 4096 }))),
-	hostExec: Type.Optional(Type.Object({ autoApprove: Type.Optional(Type.Literal(false)) }, { additionalProperties: false })),
-	resources: Type.Optional(Type.Object({
-		memory: Type.Optional(Type.String({
-			minLength: 2,
-			maxLength: 16,
-			pattern: "^[0-9]+[KMG]?$"
-		})),
-		cpus: Type.Optional(Type.Integer({
-			minimum: 1,
-			maximum: 32
-		}))
-	}, { additionalProperties: false }))
-}, {
-	$id: "RuntimeProfileSandbox",
-	additionalProperties: false
-});
-var RuntimeProfileContext = Type.Object({
-	slug: Type.String({
-		minLength: 1,
-		maxLength: 64,
-		pattern: "^[a-zA-Z0-9_-]+$"
-	}),
-	binding: Type.Union([
-		Type.Literal("skill"),
-		Type.Literal("context_inline"),
-		Type.Literal("prompt_prefix"),
-		Type.Literal("user_inline")
-	]),
-	content: Type.String({
-		minLength: 1,
-		maxLength: 65536
-	})
-}, {
-	$id: "RuntimeProfileContext",
-	additionalProperties: false
-});
-var RuntimeProfileRef = Type.Object({ profileId: Type.String({ format: "uuid" }) }, {
-	$id: "RuntimeProfileRef",
+var SignerCeremonyParamsSchema = Type.Object({ ceremonyId: Type.Unsafe(schemaRef(SignerBase64UrlSchema)) }, {
+	$id: "SignerCeremonyParams",
 	additionalProperties: false
 });
-var RuntimeProfileLeaseTtlSec = Type.Integer({
-	minimum: 1,
-	maximum: 86400
-});
-var RuntimeProfileHeartbeatIntervalMs = Type.Integer({
-	minimum: 0,
-	maximum: 36e5
-});
-var RuntimeProfileMaxBatchSize = Type.Integer({
-	minimum: 1,
-	maximum: 1e3
-});
-var RuntimeProfileMaxTurns = Type.Integer({
-	minimum: 0,
-	maximum: 1e4
-});
-var RuntimeProfileMaxBashTimeouts = Type.Integer({
-	minimum: 0,
-	maximum: 1e3
-});
-Type.Object({
-	id: Type.String({ format: "uuid" }),
-	teamId: Type.String({ format: "uuid" }),
-	name: RuntimeProfileName,
-	description: Type.Union([Type.String({ maxLength: 4096 }), Type.Null()]),
-	provider: Type.String({
-		minLength: 1,
-		maxLength: 100
-	}),
-	model: Type.String({
-		minLength: 1,
-		maxLength: 200
-	}),
-	thinkingLevel: RuntimeProfileNullableThinkingLevel,
-	temperature: RuntimeProfileNullableTemperature,
-	topP: RuntimeProfileNullableTopP,
-	topK: RuntimeProfileNullableTopK,
-	maxOutputTokens: RuntimeProfileNullableMaxOutputTokens,
-	runtimeKind: RuntimeProfileRuntimeKind,
-	sandbox: RuntimeProfileSandbox,
-	sessionStorageMode: Type.Literal("local"),
-	workspaceStorageMode: Type.Literal("local"),
-	defaultWorkspaceMode: Type.Union([RuntimeProfileWorkspaceMode, Type.Null()]),
-	allowedWorkspaceModes: RuntimeProfileAllowedWorkspaceModes,
-	sessionTtlSec: Type.Integer({
-		minimum: 1,
-		maximum: 86400
-	}),
-	workspaceTtlSec: Type.Integer({
-		minimum: 1,
-		maximum: 86400
-	}),
-	leaseTtlSec: RuntimeProfileLeaseTtlSec,
-	heartbeatIntervalMs: RuntimeProfileHeartbeatIntervalMs,
-	maxBatchSize: RuntimeProfileMaxBatchSize,
-	maxTurns: RuntimeProfileMaxTurns,
-	maxBashTimeouts: RuntimeProfileMaxBashTimeouts,
-	toolEnforcement: RuntimeProfileToolEnforcement,
-	requiredEnv: Type.Array(RuntimeProfileEnvName, { maxItems: 100 }),
-	requiredTools: Type.Array(RuntimeProfileToolName, { maxItems: 100 }),
-	requiredExecutables: Type.Array(RuntimeProfileToolName, { maxItems: 100 }),
-	context: Type.Array(RuntimeProfileContext, { maxItems: 5 }),
-	revision: Type.Integer({ minimum: 1 }),
-	definitionCid: Type.String({
-		minLength: 1,
-		maxLength: 100
-	}),
-	createdByAgentId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
-	createdByHumanId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
-	createdAt: Type.String({ format: "date-time" }),
-	updatedAt: Type.String({ format: "date-time" })
+var SignerSessionSchema = Type.Object({
+	version: Type.Literal(1),
+	token: Type.Unsafe(schemaRef(SignerBase64UrlSchema)),
+	expiresAt: Type.String()
 }, {
-	$id: "RuntimeProfile",
+	$id: "SignerSession",
 	additionalProperties: false
 });
-//#endregion
-//#region ../../libs/tasks/src/runtime-sessions.ts
-var RuntimeSessionKind = Type.Union([
-	Type.Literal("root"),
-	Type.Literal("extend"),
-	Type.Literal("fork")
-]);
-var RuntimeSessionCheckpointKind = Type.Union([Type.Literal("attempt_final")]);
-Type.Object({
-	id: Type.String({ format: "uuid" }),
-	teamId: Type.String({ format: "uuid" }),
-	taskId: Type.String({ format: "uuid" }),
-	attemptN: Type.Integer({ minimum: 1 }),
-	sourceSlotId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
-	sourceRuntimeProfileId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
-	sessionKind: RuntimeSessionKind,
-	parentSessionId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
-	contentType: Type.String({
-		minLength: 1,
-		maxLength: 200
-	}),
-	contentEncoding: Type.Union([Type.String({
-		minLength: 1,
-		maxLength: 100
-	}), Type.Null()]),
-	sizeBytes: Type.Integer({ minimum: 0 }),
-	sha256: Type.String({
-		minLength: 64,
-		maxLength: 64
-	}),
-	storageClass: Type.String({
+var SignerEnrollmentCeremonyRequestSchema = Type.Object({
+	version: Type.Literal(1),
+	operation: Type.Literal("credential-enrollment"),
+	label: Type.String({
 		minLength: 1,
-		maxLength: 100
+		maxLength: 255
 	}),
-	checkpointKind: RuntimeSessionCheckpointKind,
-	uploadedAt: Type.String({ format: "date-time" })
-}, { $id: "RuntimeSession" });
-Type.Object({
-	sourceSlotId: Type.Optional(Type.String({ format: "uuid" })),
-	sourceRuntimeProfileId: Type.Optional(Type.String({ format: "uuid" })),
-	sessionKind: RuntimeSessionKind,
-	parentSessionId: Type.Optional(Type.String({ format: "uuid" }))
+	teamId: Type.Unsafe(schemaRef(SignerUuidSchema))
 }, {
-	$id: "UploadRuntimeSessionQuery",
+	$id: "SignerEnrollmentCeremonyRequest",
 	additionalProperties: false
 });
-Type.String({
-	$id: "RuntimeSessionContent",
-	description: "Runtime session content stream.",
-	format: "binary"
+var SignerChallengeCeremonyRequestSchema = Type.Object({
+	version: Type.Literal(1),
+	operation: Type.Unsafe(schemaRef(SignerChallengeOperationSchema)),
+	resourceId: Type.Unsafe(schemaRef(SignerUuidSchema)),
+	challenge: Type.Unsafe(schemaRef(SignerPreviewSignChallengeValueSchema))
+}, {
+	$id: "SignerChallengeCeremonyRequest",
+	additionalProperties: false
 });
-Type.Object({
-	taskId: Type.String({ format: "uuid" }),
-	attemptN: Type.Integer({ minimum: 1 })
+var SignerCeremonyRequestSchema = Type.Union([Type.Unsafe(schemaRef(SignerEnrollmentCeremonyRequestSchema)), Type.Unsafe(schemaRef(SignerChallengeCeremonyRequestSchema))], { $id: "SignerCeremonyRequest" });
+var SignerCeremonySchema = Type.Object({
+	version: Type.Literal(1),
+	id: Type.Unsafe(schemaRef(SignerBase64UrlSchema)),
+	operation: Type.Unsafe(schemaRef(SignerOperationSchema)),
+	approvalUrl: Type.String(),
+	expiresAt: Type.String()
 }, {
-	$id: "RuntimeSessionAttemptParams",
+	$id: "SignerCeremony",
 	additionalProperties: false
 });
-//#endregion
-//#region ../../libs/tasks/src/runtime-slots.ts
-var RuntimeWorkspaceKind = Type.Union([
-	Type.Literal("origin"),
-	Type.Literal("fork"),
-	Type.Literal("scratch")
-]);
-var RuntimeSlotState = Type.Union([Type.Literal("active"), Type.Literal("idle")]);
-var RuntimeWorkspace = Type.Object({
-	id: Type.String({ format: "uuid" }),
-	teamId: Type.String({ format: "uuid" }),
-	workspaceId: Type.String({ minLength: 1 }),
-	worktreePath: Type.String({ minLength: 1 }),
-	worktreeBranch: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
-	kind: RuntimeWorkspaceKind,
-	createdAtMs: Type.Integer({ minimum: 0 }),
-	lastUsedAtMs: Type.Integer({ minimum: 0 })
-}, { $id: "RuntimeWorkspace" });
-var RuntimeSlot = Type.Object({
-	id: Type.String({ format: "uuid" }),
-	teamId: Type.String({ format: "uuid" }),
-	agentName: Type.String({
-		minLength: 1,
-		maxLength: 100
-	}),
-	runtimeProfileId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
-	provider: Type.String({
-		minLength: 1,
-		maxLength: 100
-	}),
-	model: Type.String({
-		minLength: 1,
-		maxLength: 200
-	}),
-	slotKey: Type.String({ minLength: 1 }),
-	taskType: Type.String({
-		minLength: 1,
-		maxLength: 100
-	}),
-	state: RuntimeSlotState,
-	lastTaskId: Type.String({ format: "uuid" }),
-	lastAttemptN: Type.Integer({ minimum: 1 }),
-	sessionDir: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
-	sessionPath: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
-	workspaceRowId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
-	createdAtMs: Type.Integer({ minimum: 0 }),
-	lastUsedAtMs: Type.Integer({ minimum: 0 }),
-	expiresAtMs: Type.Integer({ minimum: 0 })
-}, { $id: "RuntimeSlot" });
-var ResolvedRuntimeSlot = Type.Object({
-	slot: RuntimeSlot,
-	workspace: Type.Union([RuntimeWorkspace, Type.Null()])
-}, { $id: "ResolvedRuntimeSlot" });
-Type.Object({ items: Type.Array(ResolvedRuntimeSlot) }, { $id: "RuntimeSlotListResponse" });
-Type.Object({
-	agentName: Type.String({
-		minLength: 1,
-		maxLength: 100
-	}),
-	runtimeProfileId: Type.String({ format: "uuid" }),
-	provider: Type.String({
-		minLength: 1,
-		maxLength: 100
-	}),
-	model: Type.String({
-		minLength: 1,
-		maxLength: 200
-	}),
-	slotKey: Type.String({ minLength: 1 }),
-	taskType: Type.String({
-		minLength: 1,
-		maxLength: 100
-	}),
-	sessionDir: Type.Optional(Type.String({ minLength: 1 })),
-	sessionPath: Type.Optional(Type.String({ minLength: 1 })),
-	workspaceId: Type.Optional(Type.String({ minLength: 1 })),
-	worktreePath: Type.Optional(Type.String({ minLength: 1 })),
-	worktreeBranch: Type.Optional(Type.String({ minLength: 1 })),
-	workspaceKind: Type.Optional(RuntimeWorkspaceKind),
-	lastTaskId: Type.String({ format: "uuid" }),
-	lastAttemptN: Type.Integer({ minimum: 1 })
+var SignerPendingResultSchema = Type.Object({
+	version: Type.Literal(1),
+	status: Type.Literal("pending"),
+	operation: Type.Unsafe(schemaRef(SignerOperationSchema))
 }, {
-	$id: "BeginRuntimeSlotBody",
+	$id: "SignerPendingResult",
 	additionalProperties: false
 });
-Type.Object({
-	agentName: Type.String({
-		minLength: 1,
-		maxLength: 100
-	}),
-	runtimeProfileId: Type.String({ format: "uuid" }),
-	provider: Type.String({
-		minLength: 1,
-		maxLength: 100
-	}),
-	model: Type.String({
-		minLength: 1,
-		maxLength: 200
-	}),
-	slotKey: Type.String({ minLength: 1 }),
-	taskId: Type.String({ format: "uuid" }),
-	attemptN: Type.Integer({ minimum: 1 }),
-	sessionPath: Type.Optional(Type.String({ minLength: 1 }))
+var SignerEnrollmentResultSchema = Type.Object({
+	version: Type.Literal(1),
+	status: Type.Literal("completed"),
+	operation: Type.Literal("credential-enrollment"),
+	publicMaterial: Type.Unsafe(schemaRef(SignerPreviewSignPublicMaterialSchema))
 }, {
-	$id: "FinishRuntimeSlotBody",
+	$id: "SignerEnrollmentResult",
 	additionalProperties: false
 });
-Type.Object({
-	taskId: Type.String({ format: "uuid" }),
-	attemptN: Type.Integer({ minimum: 1 })
+var SignerReceiptSchema = PreviewSignReceiptValueSchema;
+var SignerSignatureResultSchema = Type.Object({
+	version: Type.Literal(1),
+	status: Type.Literal("completed"),
+	operation: Type.Unsafe(schemaRef(SignerChallengeOperationSchema)),
+	receipt: Type.Unsafe(schemaRef(SignerReceiptSchema))
 }, {
-	$id: "FindLatestRuntimeSlotForAttemptQuery",
+	$id: "SignerSignatureResult",
 	additionalProperties: false
 });
-Type.Object({
-	agentName: Type.Optional(Type.String({
-		minLength: 1,
-		maxLength: 100
-	})),
-	runtimeProfileId: Type.Optional(Type.String({ format: "uuid" })),
-	state: Type.Optional(RuntimeSlotState),
-	limit: Type.Optional(Type.Integer({
-		minimum: 1,
-		maximum: 200
-	}))
+var SignerFailedResultSchema = Type.Object({
+	version: Type.Literal(1),
+	status: Type.Literal("failed"),
+	operation: Type.Unsafe(schemaRef(SignerOperationSchema)),
+	code: Type.String(),
+	message: Type.String()
 }, {
-	$id: "ListRuntimeSlotsQuery",
+	$id: "SignerFailedResult",
 	additionalProperties: false
 });
+var SignerCeremonyResultSchema = Type.Union([
+	Type.Unsafe(schemaRef(SignerPendingResultSchema)),
+	Type.Unsafe(schemaRef(SignerEnrollmentResultSchema)),
+	Type.Unsafe(schemaRef(SignerSignatureResultSchema)),
+	Type.Unsafe(schemaRef(SignerFailedResultSchema))
+], { $id: "SignerCeremonyResult" });
+({ ...previewSignSchemaContext }), schemaId(SignerUuidSchema), schemaId(SignerOperationSchema), schemaId(SignerProblemSchema), schemaId(SignerCeremonyParamsSchema), schemaId(SignerSessionSchema), schemaId(SignerEnrollmentCeremonyRequestSchema), schemaId(SignerChallengeCeremonyRequestSchema), schemaId(SignerCeremonyRequestSchema), schemaId(SignerCeremonySchema), schemaId(SignerPendingResultSchema), schemaId(SignerEnrollmentResultSchema), schemaId(SignerSignatureResultSchema), schemaId(SignerFailedResultSchema), schemaId(SignerCeremonyResultSchema);
 //#endregion
-//#region ../../libs/tasks/src/success-criteria.ts
+//#region ../../libs/models/src/tool-enforcement.ts
+var TOOL_ENFORCEMENT_VALUES = [
+	"off",
+	"watch",
+	"enforce"
+];
+var toolEnforcementLiterals = [
+	Type.Literal(TOOL_ENFORCEMENT_VALUES[0]),
+	Type.Literal(TOOL_ENFORCEMENT_VALUES[1]),
+	Type.Literal(TOOL_ENFORCEMENT_VALUES[2])
+];
+var ToolEnforcementSchema = Type.Union(toolEnforcementLiterals, { description: "Runtime tool-policy enforcement mode: off (inert), watch (audit only), enforce (block disallowed tools, fail-closed)." });
+//#endregion
+//#region ../../libs/runtime-profiles/src/runtime-profiles.ts
+var RuntimeProfileName = Type.String({
+	minLength: 1,
+	maxLength: 100,
+	pattern: "^[a-zA-Z0-9][a-zA-Z0-9_-]{0,99}$"
+});
+var RuntimeProfileEnvName = Type.String({
+	minLength: 1,
+	maxLength: 128,
+	pattern: "^[A-Z_][A-Z0-9_]*$"
+});
+var RuntimeProfileToolName = Type.String({
+	minLength: 1,
+	maxLength: 128,
+	pattern: "^[a-zA-Z0-9._/-]+$"
+});
+var RUNTIME_PROFILE_RUNTIME_KIND_PATTERN = "^[a-z][a-z0-9._-]{0,99}$";
+new RegExp(RUNTIME_PROFILE_RUNTIME_KIND_PATTERN);
+var RuntimeProfileRuntimeKind = Type.String({
+	minLength: 1,
+	maxLength: 100,
+	pattern: RUNTIME_PROFILE_RUNTIME_KIND_PATTERN
+});
+var RuntimeProfileWorkspaceMode = Type.Union([
+	Type.Literal("none"),
+	Type.Literal("shared_mount"),
+	Type.Literal("dedicated_worktree")
+]);
 /**
-* SuccessCriteria — proposer-stated acceptance criteria, evaluated in two
-* complementary places.
-*
-* Before this envelope existed, criteria were scattered: a vestigial
-* `criteriaCid` column nobody resolved, free-form prose on
-* `fulfill_brief.input`, and inline `rubric` / `criteria[]` fields on
-* judgment-task inputs. None of those were machine-verifiable
-* end-to-end.
-*
-* This module defines a single, content-addressable envelope a proposer
-* attaches to any task type. It has four orthogonal sections — pick
-* whichever apply per task type:
-*
-*   - `gates`        Promise-level structural/process checks
-*   - `assertions`   Declarative claims about output JSON
-*   - `rubric`       Weighted-criteria scoring instrument, reused
-*                    verbatim from `./rubric.ts`.
-*   - `sideEffects`  Required process side-effects (e.g. diary entry)
-*
-* ## Two roles, two task types
-*
-* **Producer self-assessment** (fulfillment tasks: `fulfill_brief`,
-* `curate_pack`, `render_pack`). The producer **LLM** evaluates the
-* criteria against its own output and emits a `VerificationRecord`
-* inside `output.verification`. The daemon is pure passthrough — it
-* does not run `evaluateAssertions`, does not inspect the verification
-* record. The REST API is dumb storage; it never re-runs assertions and
-* never runs LLMs. The cross-field rule
-* `requireVerificationWhenCriteriaPresent` enforces "verification
-* required iff successCriteria present" at task-output validation time
-* (server-side schema check). Self-assessment is a truthful self-rating,
-* NOT enforcement — `verification.passed=false` does not block /complete
-* and does not affect `acceptedAttemptN`. See
-* `docs/use/tasks-and-runtime.md` for the full producer/judge flow.
-*
-* **Binding evaluation** (judgment tasks: `assess_brief`, `judge_pack`).
-* A separate task whose IS the application of `successCriteria` to
-* someone else's output. Different agent (enforced at claim time), same
-* envelope. The judge's verdict is binding: this is the *gate* in the
-* MoltNet model. The rubric inside `successCriteria.rubric` IS the job
-* spec for the judge.
-*
-* The clean chain: producer task with `successCriteria` → producer
-* self-assesses honestly → proposer (or automation) creates a downstream
-* judgment task that references the same `successCriteria` (or a
-* stricter rubric) → judgment task delivers the binding verdict.
-*
-* Storage: SuccessCriteria lives inline at `task.input.successCriteria`,
-* pinned via the task's `inputCid`. No separate column or hash. When
-* #881 lands, the `rubric` field can graduate to `{ rubricCid }` lookup
-* without changing this envelope, and producer + judge tasks can pin
-* the SAME rubric across the chain for end-to-end auditability.
+* Tool-policy enforcement mode for the profile's runtime `tool_call` gate:
+* `off` (inert), `watch` (audit only), `enforce` (block disallowed tools,
+* fail-closed). Read by the daemon via `GET /runtime-profiles/:id/allowed-tools`.
 */
-var SchemaCheckSpec = Type.Object({ schemaCid: Type.String({ minLength: 1 }) }, { additionalProperties: false });
-var CidEqualsSpec = Type.Object({
-	path: Type.String({ minLength: 1 }),
-	expected: Type.String({ minLength: 1 })
-}, { additionalProperties: false });
-var SubmitToolCallGate = Type.Object({
-	id: Type.String({ minLength: 1 }),
-	kind: Type.Literal("submit-tool-call"),
-	description: Type.String({ minLength: 1 }),
-	required: Type.Boolean()
-}, { additionalProperties: false });
-var Gate = Type.Union([
-	SubmitToolCallGate,
-	Type.Object({
-		id: Type.String({ minLength: 1 }),
-		kind: Type.Literal("schema-check"),
-		spec: SchemaCheckSpec,
-		required: Type.Boolean()
-	}, { additionalProperties: false }),
-	Type.Object({
-		id: Type.String({ minLength: 1 }),
-		kind: Type.Literal("cid-equals"),
-		spec: CidEqualsSpec,
-		required: Type.Boolean()
-	}, { additionalProperties: false })
-], { $id: "Gate" });
-var AssertionOp = Type.Union([
-	Type.Literal("exists"),
-	Type.Literal("equals"),
-	Type.Literal("matches"),
-	Type.Literal("in-range"),
-	Type.Literal("min-length")
-], { $id: "AssertionOp" });
-var Assertion = Type.Object({
-	id: Type.String({ minLength: 1 }),
-	path: Type.String({ minLength: 1 }),
-	op: AssertionOp,
-	value: Type.Optional(Type.Unknown())
-}, {
-	$id: "Assertion",
-	additionalProperties: false
+var RuntimeProfileToolEnforcement = ToolEnforcementSchema;
+var RuntimeProfileAllowedWorkspaceModes = Type.Array(RuntimeProfileWorkspaceMode, {
+	minItems: 1,
+	maxItems: 3,
+	uniqueItems: true
 });
-var SideEffectsSpec = Type.Object({
-	diaryEntryRequired: Type.Optional(Type.Boolean()),
-	diaryEntryTags: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
-	referencedEntries: Type.Optional(Type.Integer({ minimum: 0 }))
-}, {
-	$id: "SideEffectsSpec",
-	additionalProperties: false
+var RuntimeProfileThinkingLevelOptions = [
+	Type.Literal("off"),
+	Type.Literal("minimal"),
+	Type.Literal("low"),
+	Type.Literal("medium"),
+	Type.Literal("high"),
+	Type.Literal("xhigh")
+];
+Type.Union([...RuntimeProfileThinkingLevelOptions]);
+var RuntimeProfileNullableThinkingLevel = Type.Union([...RuntimeProfileThinkingLevelOptions, Type.Null()]);
+var RuntimeProfileNullableTemperature = Type.Union([Type.Null(), Type.Number({
+	minimum: 0,
+	maximum: 2
+})]);
+var RuntimeProfileNullableTopP = Type.Union([Type.Null(), Type.Number({
+	minimum: 0,
+	maximum: 1
+})]);
+var RuntimeProfileNullableTopK = Type.Union([Type.Integer({
+	minimum: 1,
+	maximum: 1e4
+}), Type.Null()]);
+var RuntimeProfileNullableMaxOutputTokens = Type.Union([Type.Integer({
+	minimum: 1,
+	maximum: 1e6
+}), Type.Null()]);
+var RuntimeProfileAllowedHost = Type.String({
+	minLength: 1,
+	maxLength: 255,
+	pattern: "^(?:\\*\\.)?(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)(?:\\.(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?))*$"
 });
-var SuccessCriteria = Type.Object({
-	version: Type.Literal(1),
-	gates: Type.Optional(Type.Array(Gate)),
-	assertions: Type.Optional(Type.Array(Assertion)),
-	rubric: Type.Optional(Rubric),
-	minComposite: Type.Optional(Type.Number({
-		minimum: 0,
-		maximum: 1
-	})),
-	sideEffects: Type.Optional(SideEffectsSpec)
+var RuntimeProfileSandbox = Type.Object({
+	network: Type.Optional(Type.Object({
+		allowedHosts: Type.Optional(Type.Array(RuntimeProfileAllowedHost, { maxItems: 50 })),
+		allowedInternalHosts: Type.Optional(Type.Array(RuntimeProfileAllowedHost, { maxItems: 50 }))
+	}, { additionalProperties: false })),
+	vfs: Type.Optional(Type.Object({
+		shadow: Type.Optional(Type.Array(Type.String({
+			minLength: 1,
+			maxLength: 255
+		}), { maxItems: 100 })),
+		shadowMode: Type.Optional(Type.Union([Type.Literal("deny"), Type.Literal("tmpfs")]))
+	}, { additionalProperties: false })),
+	env: Type.Optional(Type.Record(RuntimeProfileEnvName, Type.String({ maxLength: 4096 }))),
+	hostExec: Type.Optional(Type.Object({ autoApprove: Type.Optional(Type.Literal(false)) }, { additionalProperties: false })),
+	resources: Type.Optional(Type.Object({
+		memory: Type.Optional(Type.String({
+			minLength: 2,
+			maxLength: 16,
+			pattern: "^[0-9]+[KMG]?$"
+		})),
+		cpus: Type.Optional(Type.Integer({
+			minimum: 1,
+			maximum: 32
+		}))
+	}, { additionalProperties: false }))
 }, {
-	$id: "SuccessCriteria",
+	$id: "RuntimeProfileSandbox",
 	additionalProperties: false
 });
-var VerificationResultStatus = Type.Union([
-	Type.Literal("pass"),
-	Type.Literal("fail"),
-	Type.Literal("skip")
-], { $id: "VerificationResultStatus" });
-var VerificationResultKind = Type.Union([
-	Type.Literal("gate"),
-	Type.Literal("assertion"),
-	Type.Literal("rubric"),
-	Type.Literal("sideEffect")
-], { $id: "VerificationResultKind" });
-var VerificationResult = Type.Object({
-	id: Type.String({ minLength: 1 }),
-	kind: VerificationResultKind,
-	status: VerificationResultStatus,
-	detail: Type.Optional(Type.String())
+var RuntimeProfileContext = Type.Object({
+	slug: Type.String({
+		minLength: 1,
+		maxLength: 64,
+		pattern: "^[a-zA-Z0-9_-]+$"
+	}),
+	binding: Type.Union([
+		Type.Literal("skill"),
+		Type.Literal("context_inline"),
+		Type.Literal("prompt_prefix"),
+		Type.Literal("user_inline")
+	]),
+	content: Type.String({
+		minLength: 1,
+		maxLength: 65536
+	})
 }, {
-	$id: "VerificationResult",
+	$id: "RuntimeProfileContext",
 	additionalProperties: false
 });
-var VerificationRecord = Type.Object({
-	inputCid: Type.String({ minLength: 1 }),
-	results: Type.Array(VerificationResult),
-	passed: Type.Boolean({ description: "True iff every verification result has status \"pass\" or \"skip\"; false when any result has status \"fail\"." })
-}, {
-	$id: "VerificationRecord",
+var RuntimeProfileRef = Type.Object({ profileId: Type.String({ format: "uuid" }) }, {
+	$id: "RuntimeProfileRef",
 	additionalProperties: false
 });
-//#endregion
-//#region ../../libs/tasks/src/task-artifacts.ts
-var TaskArtifact = Type.Object({
+var RuntimeProfileLeaseTtlSec = Type.Integer({
+	minimum: 1,
+	maximum: 86400
+});
+var RuntimeProfileHeartbeatIntervalMs = Type.Integer({
+	minimum: 0,
+	maximum: 36e5
+});
+var RuntimeProfileMaxBatchSize = Type.Integer({
+	minimum: 1,
+	maximum: 1e3
+});
+var RuntimeProfileMaxTurns = Type.Integer({
+	minimum: 0,
+	maximum: 1e4
+});
+var RuntimeProfileMaxBashTimeouts = Type.Integer({
+	minimum: 0,
+	maximum: 1e3
+});
+Type.Object({
 	id: Type.String({ format: "uuid" }),
 	teamId: Type.String({ format: "uuid" }),
-	taskId: Type.String({ format: "uuid" }),
-	attemptN: Type.Union([Type.Integer({ minimum: 1 }), Type.Null()]),
-	kind: Type.String({
+	name: RuntimeProfileName,
+	description: Type.Union([Type.String({ maxLength: 4096 }), Type.Null()]),
+	provider: Type.String({
 		minLength: 1,
 		maxLength: 100
 	}),
-	title: Type.String({
-		minLength: 1,
-		maxLength: 255
-	}),
-	contentType: Type.String({
+	model: Type.String({
 		minLength: 1,
 		maxLength: 200
 	}),
-	contentEncoding: Type.Union([Type.String({
-		minLength: 1,
-		maxLength: 100
-	}), Type.Null()]),
-	sizeBytes: Type.Integer({ minimum: 0 }),
-	cid: Type.String({
+	thinkingLevel: RuntimeProfileNullableThinkingLevel,
+	temperature: RuntimeProfileNullableTemperature,
+	topP: RuntimeProfileNullableTopP,
+	topK: RuntimeProfileNullableTopK,
+	maxOutputTokens: RuntimeProfileNullableMaxOutputTokens,
+	runtimeKind: RuntimeProfileRuntimeKind,
+	sandbox: RuntimeProfileSandbox,
+	sessionStorageMode: Type.Literal("local"),
+	workspaceStorageMode: Type.Literal("local"),
+	defaultWorkspaceMode: Type.Union([RuntimeProfileWorkspaceMode, Type.Null()]),
+	allowedWorkspaceModes: RuntimeProfileAllowedWorkspaceModes,
+	sessionTtlSec: Type.Integer({
+		minimum: 1,
+		maximum: 86400
+	}),
+	workspaceTtlSec: Type.Integer({
+		minimum: 1,
+		maximum: 86400
+	}),
+	leaseTtlSec: RuntimeProfileLeaseTtlSec,
+	heartbeatIntervalMs: RuntimeProfileHeartbeatIntervalMs,
+	maxBatchSize: RuntimeProfileMaxBatchSize,
+	maxTurns: RuntimeProfileMaxTurns,
+	maxBashTimeouts: RuntimeProfileMaxBashTimeouts,
+	toolEnforcement: RuntimeProfileToolEnforcement,
+	requiredEnv: Type.Array(RuntimeProfileEnvName, { maxItems: 100 }),
+	requiredTools: Type.Array(RuntimeProfileToolName, { maxItems: 100 }),
+	requiredExecutables: Type.Array(RuntimeProfileToolName, { maxItems: 100 }),
+	context: Type.Array(RuntimeProfileContext, { maxItems: 5 }),
+	revision: Type.Integer({ minimum: 1 }),
+	definitionCid: Type.String({
 		minLength: 1,
 		maxLength: 100
 	}),
 	createdByAgentId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
-	expiresAt: Type.Union([Type.String({ format: "date-time" }), Type.Null()]),
-	createdAt: Type.String({ format: "date-time" })
-}, { $id: "TaskArtifact" });
-Type.Object({
-	artifacts: Type.Array(TaskArtifact),
-	nextCursor: Type.Union([Type.String({ minLength: 1 }), Type.Null()])
-}, { $id: "TaskArtifactList" });
-Type.Object({
-	limit: Type.Optional(Type.Integer({
-		minimum: 1,
-		maximum: 100
-	})),
-	cursor: Type.Optional(Type.String({ minLength: 1 }))
+	createdByHumanId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	createdAt: Type.String({ format: "date-time" }),
+	updatedAt: Type.String({ format: "date-time" })
 }, {
-	$id: "ListTaskArtifactsQuery",
+	$id: "RuntimeProfile",
 	additionalProperties: false
 });
-var HeaderSafeContentType = Type.String({
-	minLength: 1,
-	maxLength: 200,
-	pattern: "^[\\x21-\\x7e][\\x20-\\x7e]*$"
-});
-var HeaderSafeContentEncoding = Type.String({
-	minLength: 1,
-	maxLength: 100,
-	pattern: "^[\\x21-\\x7e][\\x20-\\x7e]*$"
-});
+//#endregion
+//#region ../../libs/runtime-profiles/src/runtime-sessions.ts
+var RuntimeSessionKind = Type.Union([
+	Type.Literal("root"),
+	Type.Literal("extend"),
+	Type.Literal("fork")
+]);
+var RuntimeSessionCheckpointKind = Type.Union([Type.Literal("attempt_final")]);
 Type.Object({
-	kind: Type.String({
+	id: Type.String({ format: "uuid" }),
+	teamId: Type.String({ format: "uuid" }),
+	taskId: Type.String({ format: "uuid" }),
+	attemptN: Type.Integer({ minimum: 1 }),
+	sourceSlotId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	sourceRuntimeProfileId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	sessionKind: RuntimeSessionKind,
+	parentSessionId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	contentType: Type.String({
+		minLength: 1,
+		maxLength: 200
+	}),
+	contentEncoding: Type.Union([Type.String({
 		minLength: 1,
 		maxLength: 100
+	}), Type.Null()]),
+	sizeBytes: Type.Integer({ minimum: 0 }),
+	sha256: Type.String({
+		minLength: 64,
+		maxLength: 64
 	}),
-	title: Type.String({
+	storageClass: Type.String({
 		minLength: 1,
-		maxLength: 255
+		maxLength: 100
 	}),
-	contentType: Type.Optional(HeaderSafeContentType),
-	contentEncoding: Type.Optional(HeaderSafeContentEncoding)
+	checkpointKind: RuntimeSessionCheckpointKind,
+	uploadedAt: Type.String({ format: "date-time" })
+}, { $id: "RuntimeSession" });
+Type.Object({
+	sourceSlotId: Type.Optional(Type.String({ format: "uuid" })),
+	sourceRuntimeProfileId: Type.Optional(Type.String({ format: "uuid" })),
+	sessionKind: RuntimeSessionKind,
+	parentSessionId: Type.Optional(Type.String({ format: "uuid" }))
 }, {
-	$id: "UploadTaskArtifactQuery",
+	$id: "UploadRuntimeSessionQuery",
 	additionalProperties: false
 });
 Type.String({
-	$id: "TaskArtifactContent",
-	description: "Task artifact content stream.",
+	$id: "RuntimeSessionContent",
+	description: "Runtime session content stream.",
 	format: "binary"
 });
-Type.Object({ taskId: Type.String({ format: "uuid" }) }, {
-	$id: "TaskArtifactTaskParams",
-	additionalProperties: false
-});
 Type.Object({
 	taskId: Type.String({ format: "uuid" }),
 	attemptN: Type.Integer({ minimum: 1 })
 }, {
-	$id: "TaskArtifactAttemptParams",
+	$id: "RuntimeSessionAttemptParams",
 	additionalProperties: false
 });
+//#endregion
+//#region ../../libs/runtime-profiles/src/runtime-slots.ts
+var RuntimeWorkspaceKind = Type.Union([
+	Type.Literal("origin"),
+	Type.Literal("fork"),
+	Type.Literal("scratch")
+]);
+var RuntimeSlotState = Type.Union([Type.Literal("active"), Type.Literal("idle")]);
+var RuntimeWorkspace = Type.Object({
+	id: Type.String({ format: "uuid" }),
+	teamId: Type.String({ format: "uuid" }),
+	workspaceId: Type.String({ minLength: 1 }),
+	worktreePath: Type.String({ minLength: 1 }),
+	worktreeBranch: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+	kind: RuntimeWorkspaceKind,
+	createdAtMs: Type.Integer({ minimum: 0 }),
+	lastUsedAtMs: Type.Integer({ minimum: 0 })
+}, { $id: "RuntimeWorkspace" });
+var RuntimeSlot = Type.Object({
+	id: Type.String({ format: "uuid" }),
+	teamId: Type.String({ format: "uuid" }),
+	agentName: Type.String({
+		minLength: 1,
+		maxLength: 100
+	}),
+	runtimeProfileId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	provider: Type.String({
+		minLength: 1,
+		maxLength: 100
+	}),
+	model: Type.String({
+		minLength: 1,
+		maxLength: 200
+	}),
+	slotKey: Type.String({ minLength: 1 }),
+	taskType: Type.String({
+		minLength: 1,
+		maxLength: 100
+	}),
+	state: RuntimeSlotState,
+	lastTaskId: Type.String({ format: "uuid" }),
+	lastAttemptN: Type.Integer({ minimum: 1 }),
+	sessionDir: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+	sessionPath: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+	workspaceRowId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	createdAtMs: Type.Integer({ minimum: 0 }),
+	lastUsedAtMs: Type.Integer({ minimum: 0 }),
+	expiresAtMs: Type.Integer({ minimum: 0 })
+}, { $id: "RuntimeSlot" });
+var ResolvedRuntimeSlot = Type.Object({
+	slot: RuntimeSlot,
+	workspace: Type.Union([RuntimeWorkspace, Type.Null()])
+}, { $id: "ResolvedRuntimeSlot" });
+Type.Object({ items: Type.Array(ResolvedRuntimeSlot) }, { $id: "RuntimeSlotListResponse" });
 Type.Object({
-	taskId: Type.String({ format: "uuid" }),
-	attemptN: Type.Integer({ minimum: 1 }),
-	cid: Type.String({
+	agentName: Type.String({
 		minLength: 1,
 		maxLength: 100
-	})
-}, {
-	$id: "TaskArtifactContentParams",
-	additionalProperties: false
-});
-Type.Object({
-	contentType: Type.Optional(HeaderSafeContentType),
-	contentEncoding: Type.Optional(HeaderSafeContentEncoding)
-}, {
-	$id: "StageTaskArtifactQuery",
-	additionalProperties: false
-});
-Type.Object({
-	cid: Type.String({
+	}),
+	runtimeProfileId: Type.String({ format: "uuid" }),
+	provider: Type.String({
 		minLength: 1,
 		maxLength: 100
 	}),
-	sizeBytes: Type.Integer({ minimum: 0 }),
-	contentType: Type.String({
+	model: Type.String({
 		minLength: 1,
 		maxLength: 200
-	})
-}, { $id: "StagedTaskArtifact" });
-Type.Object({
-	taskId: Type.String({ format: "uuid" }),
-	cid: Type.String({
+	}),
+	slotKey: Type.String({ minLength: 1 }),
+	taskType: Type.String({
 		minLength: 1,
 		maxLength: 100
-	})
-}, {
-	$id: "TaskArtifactTaskContentParams",
-	additionalProperties: false
-});
-//#endregion
-//#region ../../libs/tasks/src/task-types/assess-brief.ts
-/**
-* `assess_brief` — independently evaluate a fulfilled brief.
-*
-* output_kind: judgment
-* criteria: required (`successCriteria.rubric` — same envelope as
-*   `judge_pack`)
-* references: required (must reference the target `fulfill_brief` task)
-*
-* The assessor is a different agent from the producer (enforced by the
-* server / runtime at claim time — not in the wire schema).
-*
-* The rubric in `successCriteria` IS the job spec — the assessor applies
-* it to the target task's output and emits per-criterion scores. Other
-* sections (`assertions`, `gates`, `sideEffects`) MAY be present and are
-* evaluated against the *assessor's output*.
-*/
-var ASSESS_BRIEF_TYPE = "assess_brief";
-var AssessBriefInput = Type.Object({
-	targetTaskId: Type.String({ format: "uuid" }),
-	successCriteria: SuccessCriteria
-}, {
-	$id: "AssessBriefInput",
-	additionalProperties: false
-});
-/** One score line. */
-var AssessBriefScore = Type.Object({
-	criterionId: Type.String({ minLength: 1 }),
-	score: Type.Number({
-		minimum: 0,
-		maximum: 1
 	}),
-	rationale: Type.Optional(Type.String()),
-	evidence: Type.Optional(Type.Object({
-		commitsVerified: Type.Number(),
-		commitsTotal: Type.Number(),
-		signatureFailures: Type.Array(Type.String())
-	}, { additionalProperties: false }))
+	sessionDir: Type.Optional(Type.String({ minLength: 1 })),
+	sessionPath: Type.Optional(Type.String({ minLength: 1 })),
+	workspaceId: Type.Optional(Type.String({ minLength: 1 })),
+	worktreePath: Type.Optional(Type.String({ minLength: 1 })),
+	worktreeBranch: Type.Optional(Type.String({ minLength: 1 })),
+	workspaceKind: Type.Optional(RuntimeWorkspaceKind),
+	lastTaskId: Type.String({ format: "uuid" }),
+	lastAttemptN: Type.Integer({ minimum: 1 })
 }, {
-	$id: "AssessBriefScore",
+	$id: "BeginRuntimeSlotBody",
 	additionalProperties: false
 });
-var AssessBriefOutput = Type.Object({
-	scores: Type.Array(AssessBriefScore, { minItems: 1 }),
-	composite: Type.Number({
-		minimum: 0,
-		maximum: 1
+Type.Object({
+	agentName: Type.String({
+		minLength: 1,
+		maxLength: 100
 	}),
-	verdict: Type.String({ minLength: 1 }),
-	judgeModel: Type.Optional(Type.String())
+	runtimeProfileId: Type.String({ format: "uuid" }),
+	provider: Type.String({
+		minLength: 1,
+		maxLength: 100
+	}),
+	model: Type.String({
+		minLength: 1,
+		maxLength: 200
+	}),
+	slotKey: Type.String({ minLength: 1 }),
+	taskId: Type.String({ format: "uuid" }),
+	attemptN: Type.Integer({ minimum: 1 }),
+	sessionPath: Type.Optional(Type.String({ minLength: 1 }))
 }, {
-	$id: "AssessBriefOutput",
+	$id: "FinishRuntimeSlotBody",
 	additionalProperties: false
 });
-/**
-* Async preflight (#1096):
-*   - `targetTaskId` resolves to a real task the caller can see.
-*   - The target is a `fulfill_brief` (you cannot grade an arbitrary
-*     task type as if it were a brief fulfillment).
-*   - Unless readiness checks are explicitly deferred, the target is
-*     `completed` with an accepted attempt — grading an in-flight or
-*     failed task would either race or grade nothing.
-*
-* Agent-distinctness ("assessor ≠ producer") is a runtime / auth-
-* layer concern and intentionally NOT checked here. It belongs in
-* an auth-aware claim-time check.
-*/
-async function validateAssessBriefInputAsync(input, ctx) {
-	const { targetTaskId } = input;
-	const errors = [];
-	const target = await ctx.resolveTask(targetTaskId);
-	if (!target) {
-		errors.push({
-			field: "targetTaskId",
-			message: `targetTaskId ${targetTaskId} does not resolve to a task you can read`
-		});
-		return errors;
-	}
-	if (target.taskType !== "fulfill_brief") errors.push({
-		field: "targetTaskId",
-		message: `targetTaskId ${targetTaskId} is a ${target.taskType}, not a fulfill_brief`
-	});
-	if (!ctx.deferReadinessChecks && (target.status !== "completed" || target.acceptedAttemptN === null)) errors.push({
-		field: "targetTaskId",
-		message: `targetTaskId ${targetTaskId} is not completed with an accepted attempt (status=${target.status}, acceptedAttemptN=${target.acceptedAttemptN})`
-	});
-	return errors;
-}
-//#endregion
-//#region ../../libs/tasks/src/task-types/curate-pack.ts
-/**
-* `curate_pack` — select and rank diary entries into a context pack.
-*
-* output_kind: artifact
-* criteria: not required (rubric-less curation recipe)
-* references: optional (e.g. a prior rendered pack being re-curated)
-*
-* This is step 1 of the three-session attribution loop (#875). The agent
-* runs a structured exploration over a diary — tag inventory, hybrid
-* search, type/tag narrowing — and emits a ranked entry list via
-* `moltnet_pack_create`. The prompt is deterministic given the input
-* (no operator interaction), so two runs with the same input should
-* converge on similar packs.
-*
-* Related: `render_pack`, `judge_pack`.
-*/
-var CURATE_PACK_TYPE = "curate_pack";
-var EntryTypeFilter = Type.Union([
-	Type.Literal("episodic"),
-	Type.Literal("semantic"),
-	Type.Literal("procedural"),
-	Type.Literal("reflection")
-]);
-var CuratePackInput = Type.Object({
-	diaryId: Type.String({ format: "uuid" }),
-	taskPrompt: Type.String({ minLength: 1 }),
-	entryTypes: Type.Optional(Type.Array(EntryTypeFilter, { minItems: 1 })),
-	tagFilters: Type.Optional(Type.Object({
-		include: Type.Optional(Type.Array(Type.String())),
-		exclude: Type.Optional(Type.Array(Type.String())),
-		prefix: Type.Optional(Type.String())
-	}, { additionalProperties: false })),
-	tokenBudget: Type.Optional(Type.Number({ minimum: 500 })),
-	recipe: Type.Optional(Type.Union([Type.Literal("topic-focused-v1"), Type.Literal("scope-inventory-v1")])),
-	successCriteria: Type.Optional(SuccessCriteria)
+Type.Object({
+	taskId: Type.String({ format: "uuid" }),
+	attemptN: Type.Integer({ minimum: 1 })
 }, {
-	$id: "CuratePackInput",
+	$id: "FindLatestRuntimeSlotForAttemptQuery",
 	additionalProperties: false
 });
-/**
-* Index of the curated pack plus the reasoning trace. The pack itself
-* lives in the database (created via `moltnet_pack_create`); this output
-* is the receipt.
-*/
-var CuratePackOutput = Type.Object({
-	packId: Type.String({ format: "uuid" }),
-	packCid: Type.String({ minLength: 1 }),
-	entries: Type.Array(Type.Object({
-		entryId: Type.String({ format: "uuid" }),
-		rank: Type.Number({ minimum: 1 }),
-		rationale: Type.String({ minLength: 1 })
-	}, { additionalProperties: false }), { minItems: 1 }),
-	recipeParams: Type.Record(Type.String(), Type.Unknown()),
-	checkpoints: Type.Optional(Type.Array(Type.Object({
-		phase: Type.String({ minLength: 1 }),
-		candidateIds: Type.Array(Type.String({ format: "uuid" })),
-		droppedIds: Type.Optional(Type.Array(Type.String({ format: "uuid" }))),
-		notes: Type.String({ minLength: 1 })
-	}, { additionalProperties: false }))),
-	summary: Type.String({ minLength: 1 }),
-	verification: Type.Optional(VerificationRecord)
+Type.Object({
+	agentName: Type.Optional(Type.String({
+		minLength: 1,
+		maxLength: 100
+	})),
+	runtimeProfileId: Type.Optional(Type.String({ format: "uuid" })),
+	state: Type.Optional(RuntimeSlotState),
+	limit: Type.Optional(Type.Integer({
+		minimum: 1,
+		maximum: 200
+	}))
 }, {
-	$id: "CuratePackOutput",
+	$id: "ListRuntimeSlotsQuery",
 	additionalProperties: false
 });
 //#endregion
@@ -3362,9 +3362,9 @@ var COMMON_OPTIONAL_FLAGS = `\
   --guest-credential-mode <mode>
                               Guest trust boundary: host-authenticated or
                               guest-config. Defaults to host-authenticated for
-                              agent-key and guest-config for OAuth2. Explicit
-                              guest-config exposes the complete local agent
-                              credential tree to the VM.
+                              both agent-key and OAuth2 authentication.
+                              Explicit guest-config exposes the complete local
+                              agent credential tree to the VM.
   --lease-ttl-sec <n>         Sliding liveness window. Silence longer than
                               this ends the attempt with lease_expired.
                               Default: 300.
@@ -3540,16 +3540,18 @@ function isHelpFlag(args) {
 //#region src/lib/agent-context.ts
 /**
 * Guest credentials are an explicit trust decision, never an incidental
-* consequence of files found on disk. Agent-key mode defaults to the
-* configless host-authenticated boundary; OAuth2 keeps its config-backed
-* behavior. OAuth2 cannot use the host-authenticated mode because its Agent is
-* itself resolved from the local credential tree.
+* consequence of files found on disk. The guest boundary is independent of
+* how the daemon itself authenticates: both agent-key and OAuth2 default to
+* the host-authenticated boundary, where structured MoltNet operations reuse
+* the trusted host-side Agent and the guest receives no credential material.
+* OAuth2 still resolves that Agent from the local config and secret provider
+* on the host — reading `moltnet.json` on the host does not imply projecting
+* it into the guest. `guest-config` remains an explicit compatibility opt-in
+* for tasks that need credential-bearing guest-shell operations.
 */
-function resolveDaemonGuestCredentialMode(authMode, requested) {
+function resolveDaemonGuestCredentialMode(requested) {
 	if (requested !== void 0 && requested !== "guest-config" && requested !== "host-authenticated") throw new Error(`Invalid --guest-credential-mode "${requested}": expected guest-config or host-authenticated.`);
-	const mode = requested ?? (authMode === "agent-key" ? "host-authenticated" : "guest-config");
-	if (authMode === "oauth2" && mode === "host-authenticated") throw new Error("--guest-credential-mode host-authenticated requires agent-key authentication. OAuth2 requires the local agent configuration.");
-	return mode;
+	return requested ?? "host-authenticated";
 }
 /**
 * Report which auth mode `connect()` will use, without ever reading the secret
@@ -3570,18 +3572,18 @@ function detectAuthMode(env) {
 *
 * Rules (see design entry edb848a1):
 * - The subject must be an `agent`; a human credential can never run the daemon.
-* - A team-bound agent key (`credentialBinding.boundTeamId` set) must match the
+* - A team-bound agent key (`credentialBinding.bindingScope === 'team'`) must match the
 *   `--team` the daemon was started with. A key is an immutable team ceiling, so
 *   a mismatch would only surface as an obscure mid-poll 403 otherwise.
-* - An unbound key or an OAuth2 identity (no `boundTeamId`) is accepted; normal
-*   team-scoped authorization governs those requests.
+* - An identity-scoped key or an OAuth2 identity is accepted; normal team-scoped
+*   authorization governs those requests.
 */
 function assessStartupBinding(whoami, teamId) {
 	if (whoami.subjectType !== "agent") return {
 		ok: false,
 		reason: `the daemon must authenticate as an agent, but whoami reported subjectType "${whoami.subjectType}". Provide agent credentials (an agent key or the agent's client id/secret).`
 	};
-	const boundTeamId = whoami.credentialBinding?.boundTeamId;
+	const boundTeamId = whoami.credentialBinding?.bindingScope === "team" ? whoami.credentialBinding.boundTeamId : void 0;
 	if (teamId && boundTeamId && boundTeamId !== teamId) return {
 		ok: false,
 		reason: `the agent key is bound to team ${boundTeamId}, but the daemon was started with --team ${teamId}. Restart with --team ${boundTeamId}, or issue a key for team ${teamId}.`
@@ -3623,8 +3625,8 @@ async function validateStartupBinding(options) {
 async function resolveAgentContext(agentName, options = {}) {
 	if (!/^[a-zA-Z0-9_-]+$/.test(agentName)) throw new Error(`Invalid agent name "${agentName}": must match /^[a-zA-Z0-9_-]+$/`);
 	const roots = resolveCredentialRoots(options.agentRootDir);
+	const guestCredentialMode = resolveDaemonGuestCredentialMode(options.guestCredentialMode);
 	if (options.authMode === "agent-key") {
-		const guestCredentialMode = resolveDaemonGuestCredentialMode("agent-key", options.guestCredentialMode);
 		const { rootDir, agentDir } = guestCredentialMode === "guest-config" ? resolveCompleteGuestCredentials(roots, agentName) : {
 			rootDir: roots[0] ?? process.cwd(),
 			agentDir: join(roots[0] ?? process.cwd(), ".moltnet", agentName)
@@ -3636,17 +3638,17 @@ async function resolveAgentContext(agentName, options = {}) {
 			guestCredentialMode
 		};
 	}
-	resolveDaemonGuestCredentialMode("oauth2", options.guestCredentialMode);
-	for (const rootDir of roots) {
-		const agentDir = join(rootDir, ".moltnet", agentName);
-		if (existsSync(join(agentDir, "moltnet.json"))) return {
-			agentDir,
-			agentRootDir: rootDir,
-			agent: await connect({
-				configDir: agentDir,
-				secretProviders: createNodeSecretProviderRegistry()
-			}),
-			guestCredentialMode: "guest-config"
+	const located = guestCredentialMode === "guest-config" ? resolveCompleteGuestCredentials(roots, agentName) : locateAgentConfig(roots, agentName);
+	if (located) {
+		const agent = await connect({
+			configDir: located.agentDir,
+			secretProviders: createNodeSecretProviderRegistry()
+		});
+		return {
+			agentDir: located.agentDir,
+			agentRootDir: located.rootDir,
+			agent,
+			guestCredentialMode
 		};
 	}
 	const tried = roots.map((root) => join(root, ".moltnet", agentName));
@@ -3658,6 +3660,15 @@ function isTransientWhoamiError(error) {
 	const statusCode = error.statusCode;
 	return typeof statusCode === "number" && (statusCode === 408 || statusCode === 429 || statusCode >= 500);
 }
+function locateAgentConfig(roots, agentName) {
+	for (const rootDir of roots) {
+		const agentDir = join(rootDir, ".moltnet", agentName);
+		if (existsSync(join(agentDir, "moltnet.json"))) return {
+			rootDir,
+			agentDir
+		};
+	}
+}
 function resolveCompleteGuestCredentials(roots, agentName) {
 	const partial = [];
 	for (const rootDir of roots) {
@@ -5034,102 +5045,6 @@ function runWithDaemonRuntimeContext(context, callback) {
 	return storage.run(context, callback);
 }
 //#endregion
-//#region src/lib/runtime-profile.ts
-var RuntimeProfilePrerequisiteError = class extends Error {
-	constructor(profileName, missingEnv, missingTools, missingExecutables) {
-		const parts = [
-			missingEnv.length > 0 ? `missing env: ${missingEnv.join(", ")}` : null,
-			missingTools.length > 0 ? `missing tools: ${missingTools.join(", ")}` : null,
-			missingExecutables.length > 0 ? `missing guest executables: ${missingExecutables.join(", ")}` : null
-		].filter(Boolean);
-		super(`Runtime profile "${profileName}" prerequisites are not satisfied: ${parts.join("; ")}`);
-		this.profileName = profileName;
-		this.missingEnv = missingEnv;
-		this.missingTools = missingTools;
-		this.missingExecutables = missingExecutables;
-		this.name = "RuntimeProfilePrerequisiteError";
-	}
-};
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-async function resolveRuntimeProfile(options) {
-	const profile = UUID_RE.test(options.profile) ? await options.agent.runtimeProfiles.get(options.profile) : await resolveProfileByName(options);
-	if (options.teamId && profile.teamId !== options.teamId) throw new Error(`Runtime profile "${options.profile}" belongs to team ${profile.teamId}, not ${options.teamId}.`);
-	if (!Value.Check(RuntimeProfileSandbox, profile.sandbox)) throw new Error(`Runtime profile "${profile.name}" contains unsupported sandbox fields.`);
-	return {
-		id: profile.id,
-		name: profile.name,
-		teamId: profile.teamId,
-		runtimeKind: profile.runtimeKind,
-		definitionCid: profile.definitionCid,
-		provider: profile.provider,
-		model: profile.model,
-		thinkingLevel: profile.thinkingLevel ?? null,
-		temperature: profile.temperature ?? null,
-		topP: profile.topP ?? null,
-		topK: profile.topK ?? null,
-		maxOutputTokens: profile.maxOutputTokens ?? null,
-		leaseTtlSec: profile.leaseTtlSec,
-		heartbeatIntervalMs: profile.heartbeatIntervalMs,
-		maxBatchSize: profile.maxBatchSize,
-		maxTurns: profile.maxTurns,
-		maxBashTimeouts: profile.maxBashTimeouts,
-		sessionTtlSec: profile.sessionTtlSec,
-		workspaceTtlSec: profile.workspaceTtlSec,
-		defaultWorkspaceMode: profile.defaultWorkspaceMode ?? null,
-		allowedWorkspaceModes: profile.allowedWorkspaceModes,
-		requiredEnv: profile.requiredEnv,
-		requiredTools: profile.requiredTools,
-		requiredExecutables: profile.requiredExecutables,
-		toolEnforcement: profile.toolEnforcement,
-		context: profile.context ?? [],
-		sandboxConfig: profile.sandbox,
-		mountPath: resolve(options.cwd),
-		source: `runtime-profile:${profile.id}`
-	};
-}
-async function resolveRuntimeProfiles(options) {
-	const seen = /* @__PURE__ */ new Set();
-	const out = [];
-	for (const profile of options.profiles) {
-		const resolved = await resolveRuntimeProfile({
-			agent: options.agent,
-			profile,
-			teamId: options.teamId,
-			cwd: options.cwd
-		});
-		if (seen.has(resolved.id)) continue;
-		seen.add(resolved.id);
-		out.push(resolved);
-	}
-	return out;
-}
-function validateRuntimeProfilePrerequisites(profile, env, inventory) {
-	const missingEnv = profile.requiredEnv.filter((name) => !env[name]);
-	const available = new Set(inventory?.tools ?? []);
-	const executableInventory = new Set(inventory?.executables ?? []);
-	const missingTools = profile.requiredTools.filter((tool) => !available.has(tool));
-	const missingExecutables = profile.requiredExecutables.filter((executable) => !executableInventory.has(executable));
-	if (missingEnv.length > 0 || missingTools.length > 0 || missingExecutables.length > 0) throw new RuntimeProfilePrerequisiteError(profile.name, missingEnv, missingTools, missingExecutables);
-}
-function resolveProfileWarmSessionTtlSec(profile) {
-	return Math.min(profile.sessionTtlSec, profile.workspaceTtlSec);
-}
-async function resolveProfileByName(options) {
-	if (!options.teamId) throw new Error(`Runtime profile name "${options.profile}" requires --team. Use a profile UUID when running without a team-scoped list.`);
-	const matches = (await options.agent.runtimeProfiles.list({ teamId: options.teamId })).items.filter((item) => item.name === options.profile);
-	if (matches.length === 0) throw new Error(`Runtime profile "${options.profile}" was not found in team ${options.teamId}.`);
-	if (matches.length > 1) throw new Error(`Runtime profile name "${options.profile}" is ambiguous in team ${options.teamId}. Use the profile UUID instead.`);
-	const profile = matches[0];
-	return {
-		...profile,
-		thinkingLevel: profile.thinkingLevel ?? null,
-		temperature: profile.temperature ?? null,
-		topP: profile.topP ?? null,
-		topK: profile.topK ?? null,
-		maxOutputTokens: profile.maxOutputTokens ?? null
-	};
-}
-//#endregion
 //#region src/lib/runtime-profile-retry-triage.ts
 function createRuntimeProfileRetryTriage(options) {
 	return createPiRetryTriage({
@@ -5926,7 +5841,9 @@ async function runPolling(opts) {
 	rootLogger.info({
 		authMode: cfg.authMode,
 		subjectType: startupWhoami.subjectType,
-		boundTeamId: startupWhoami.credentialBinding?.boundTeamId ?? null,
+		bindingScope: startupWhoami.credentialBinding?.bindingScope ?? null,
+		credentialKeyId: startupWhoami.credentialBinding?.keyId ?? null,
+		boundTeamId: startupWhoami.credentialBinding?.bindingScope === "team" ? startupWhoami.credentialBinding.boundTeamId : null,
 		guestCredentialMode: ctx.guestCredentialMode,
 		taskTypes: taskTypes.length > 0 ? taskTypes : ["*"],
 		correlationId: values["correlation-id"] ?? null,
@@ -6210,7 +6127,8 @@ async function runPolling(opts) {
 					onVmDiagnostic: (diagnostic) => {
 						const fields = {
 							event: diagnostic.event,
-							credentialMode: diagnostic.credentialMode
+							credentialMode: diagnostic.credentialMode,
+							...diagnostic.brokeredSecretCount !== void 0 && { brokeredSecretCount: diagnostic.brokeredSecretCount }
 						};
 						if (diagnostic.level === "warning") taskLogger.warn(fields, diagnostic.message);
 						else taskLogger.info(fields, diagnostic.message);
@@ -6576,7 +6494,8 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			onVmDiagnostic: (diagnostic) => {
 				const fields = {
 					event: diagnostic.event,
-					credentialMode: diagnostic.credentialMode
+					credentialMode: diagnostic.credentialMode,
+					...diagnostic.brokeredSecretCount !== void 0 && { brokeredSecretCount: diagnostic.brokeredSecretCount }
 				};
 				if (diagnostic.level === "warning") rootLogger.warn(fields, diagnostic.message);
 				else rootLogger.info(fields, diagnostic.message);