@themoltnet/pi-runtime 0.11.0 → 0.12.0

package/dist/index.js

@@ -1,23 +1,239 @@
+import { createHash } from "node:crypto";
+import * as ed from "@noble/ed25519";
+import { createHash as createHash$1 } from "crypto";
+import { FREEFORM_TYPE, SUBMIT_OUTPUT_GATE_ID, buildTaskUserPrompt, createHostCapabilityRouter, defineHostCapability, getSubmitOutputContract, materializeTaskOutput, mergeRuntimeProfileContext, resolveTaskContext, taskTypeUsesSubagents, traceRuntimePhase, validateTaskOutput, validateTaskSubmission } from "@themoltnet/agent-runtime";
+import { Type } from "typebox";
 import { execFileSync } from "node:child_process";
 import { cpSync, createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync } from "node:fs";
 import { mkdir, realpath, stat } from "node:fs/promises";
 import path, { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
-import { Type } from "@earendil-works/pi-ai";
+import { Type as Type$1 } from "@earendil-works/pi-ai";
 import { AuthStorage, DEFAULT_MAX_BYTES, DefaultResourceLoader, ModelRegistry, SessionManager, createAgentSession, createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLsToolDefinition, createReadToolDefinition, createSyntheticSourceInfo, createWriteToolDefinition, defineTool, formatSize, parseFrontmatter, truncateHead, truncateLine } from "@earendil-works/pi-coding-agent";
+import { sha256 } from "@noble/hashes/sha2";
+import { base32 } from "multiformats/bases/base32";
+import { CID } from "multiformats/cid";
+import * as raw from "multiformats/codecs/raw";
+import { create } from "multiformats/hashes/digest";
 import { BrokeredHttpSecretBoundaryError, GONDOLIN_BASE_EXECUTABLES, GUEST_TASK_CONTEXT_MOUNT, GuestEnvironmentBoundaryError, activateAgentEnv, activateAgentEnv as activateAgentEnv$1, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, canonicalizeBrokeredHttpSecretDescriptor, ensureSnapshot, ensureSnapshot as ensureSnapshot$1, findMainWorktree, findMainWorktree as findMainWorktree$1, isResolvedPathInsideRoot, isResolvedPathInsideRoot as isResolvedPathInsideRoot$1, loadCredentials, prepareBrokeredHttpSecrets, resolveVfsShadowConfig, resumeVm as resumeVm$1 } from "@themoltnet/sandbox-gondolin";
 import { SpanStatusCode, context, metrics, trace } from "@opentelemetry/api";
-import { CID } from "multiformats/cid";
 import * as json from "multiformats/codecs/json";
-import { sha256 } from "multiformats/hashes/sha2";
-import { FREEFORM_TYPE, SUBMIT_OUTPUT_GATE_ID, buildTaskUserPrompt, getSubmitOutputContract, materializeTaskOutput, mergeRuntimeProfileContext, resolveTaskContext, taskTypeUsesSubagents, traceRuntimePhase, validateTaskOutput, validateTaskSubmission } from "@themoltnet/agent-runtime";
+import { sha256 as sha256$1 } from "multiformats/hashes/sha2";
 import { connect } from "@themoltnet/sdk/node";
 import { ShellCommandAnalyzer } from "@themoltnet/shell-command-analyzer";
 import { homedir } from "node:os";
 import { VmCheckpoint } from "@earendil-works/gondolin";
-import { Type as Type$1 } from "typebox";
-import { createHash } from "node:crypto";
 import { Value } from "typebox/value";
+//#region ../crypto-service/src/ssh.ts
+/**
+* SSH key format conversion for MoltNet Ed25519 keys
+*
+* Converts MoltNet agent keys (ed25519:<base64>) to OpenSSH format
+* for use with git commit signing and SSH authentication.
+*/
+if (!ed.etc.sha512Sync) ed.etc.sha512Sync = (...m) => {
+	const hash = createHash$1("sha512");
+	m.forEach((msg) => hash.update(msg));
+	return hash.digest();
+};
+var SSH_ED25519_KEY_TYPE = "ssh-ed25519";
+/**
+* Encode a 32-bit unsigned integer in big-endian format.
+*/
+function encodeUInt32(n) {
+	const buf = Buffer.alloc(4);
+	buf.writeUInt32BE(n, 0);
+	return buf;
+}
+/**
+* Encode a byte sequence as an SSH string (uint32 length prefix + data).
+*/
+function encodeSSHString(data) {
+	const buf = typeof data === "string" ? Buffer.from(data) : data;
+	return Buffer.concat([encodeUInt32(buf.length), buf]);
+}
+/**
+* Convert a MoltNet public key to SSH public key format.
+*
+* @param moltnetPublicKey - Key in `ed25519:<base64>` format
+* @returns SSH public key string: `ssh-ed25519 <base64>`
+* @throws Error if the key format is invalid or the key is not 32 bytes
+*/
+function toSSHPublicKey(moltnetPublicKey) {
+	const match = moltnetPublicKey.match(/^ed25519:(.+)$/);
+	if (!match) throw new Error("Invalid MoltNet public key format: expected \"ed25519:<base64>\"");
+	const pubkeyBytes = Buffer.from(match[1], "base64");
+	if (pubkeyBytes.length !== 32) throw new Error(`Invalid Ed25519 public key length: expected 32 bytes, got ${pubkeyBytes.length}`);
+	return `${SSH_ED25519_KEY_TYPE} ${Buffer.concat([encodeSSHString(SSH_ED25519_KEY_TYPE), encodeSSHString(pubkeyBytes)]).toString("base64")}`;
+}
+//#endregion
+//#region ../crypto-service/src/agent-signing.ts
+/** Git `user.signingKey` literal: git signs through ssh-agent, no key file. */
+function sshPublicKeyLiteral(publicKey) {
+	return `key::${toSSHPublicKey(publicKey)}`;
+}
+/** One `allowed_signers` line restricted to commit/tag signatures. */
+function allowedSignersLine(identity) {
+	return `${identity.gitEmail} namespaces="git" ${toSSHPublicKey(identity.publicKey)}`;
+}
+/**
+* A gitconfig that carries identity and verification settings only: no key
+* paths, no credential helper, nothing a guest could exfiltrate.
+*/
+function nonSecretGitconfig(identity, paths) {
+	return [
+		"[user]",
+		`\tname = ${identity.gitName}`,
+		`\temail = ${identity.gitEmail}`,
+		`\tsigningKey = ${sshPublicKeyLiteral(identity.publicKey)}`,
+		"[gpg]",
+		"	format = ssh",
+		"[gpg \"ssh\"]",
+		`\tallowedSignersFile = ${paths.allowedSignersFile}`,
+		"[url \"https://github.com/\"]",
+		"	insteadOf = git@github.com:",
+		"[safe]",
+		`\tdirectory = ${paths.mountPath}`,
+		""
+	].join("\n");
+}
+//#endregion
+//#region src/host-capabilities/agent-signing.ts
+var GUEST_SIGNER_SOCKET = "/run/moltnet/signer.sock";
+var GUEST_GITCONFIG_PATH = "/home/agent/.config/moltnet/gitconfig";
+var GUEST_ALLOWED_SIGNERS_PATH = "/home/agent/.config/moltnet/allowed_signers";
+var UUID_PATTERN = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
+function isSigner(value) {
+	return typeof value === "object" && value !== null && typeof value.signGitCommit === "function" && typeof value.signDiaryEntry === "function";
+}
+function requireSigner(ctx) {
+	const signer = ctx.injected.signer;
+	if (!isSigner(signer)) {
+		const error = /* @__PURE__ */ new Error("no signer injected into this session");
+		error.name = "SignerUnavailable";
+		throw error;
+	}
+	return signer;
+}
+function digestBase64(value) {
+	return `sha256:${createHash("sha256").update(Buffer.from(value, "base64")).digest("hex").slice(0, 16)}`;
+}
+/**
+* Stock signing capability: the guest keeps `git commit -S` and
+* `moltnet entry create-signed`; signatures are produced on the host through
+* the injected `AgentSigningCapability`. The guest receives only the signer
+* origin, an ssh-agent socket served by the CLI, and a non-secret gitconfig.
+*/
+var agentSigningCapability = defineHostCapability({
+	name: "agent-signing",
+	operations: {
+		"sign-git-commit": {
+			request: Type.Object({ sshsig: Type.String({
+				minLength: 1,
+				maxLength: 8192
+			}) }, { additionalProperties: false }),
+			response: Type.Object({ signature: Type.String() }),
+			maxBodyBytes: 12 * 1024,
+			async handle(input, ctx) {
+				const { signature } = await requireSigner(ctx).signGitCommit({ sshsig: new Uint8Array(Buffer.from(input.sshsig, "base64")) });
+				return { signature: Buffer.from(signature).toString("base64") };
+			},
+			evidence: (input) => ({ sshsigDigest: digestBase64(input.sshsig) })
+		},
+		"sign-diary-entry": {
+			request: Type.Object({ signingRequestId: Type.String({ pattern: UUID_PATTERN }) }, { additionalProperties: false }),
+			response: Type.Object({ signingRequestId: Type.String() }),
+			maxBodyBytes: 1024,
+			handle: (input, ctx) => requireSigner(ctx).signDiaryEntry(input),
+			evidence: (input) => ({ signingRequestId: input.signingRequestId })
+		}
+	},
+	guest: {
+		env: {
+			MOLTNET_SIGNER_URL: "${origin}",
+			SSH_AUTH_SOCK: GUEST_SIGNER_SOCKET,
+			GIT_CONFIG_GLOBAL: GUEST_GITCONFIG_PATH
+		},
+		files: [{
+			path: GUEST_GITCONFIG_PATH,
+			mode: 420,
+			content: (identity, { mountPath }) => nonSecretGitconfig(identity, {
+				allowedSignersFile: GUEST_ALLOWED_SIGNERS_PATH,
+				mountPath
+			})
+		}, {
+			path: GUEST_ALLOWED_SIGNERS_PATH,
+			mode: 420,
+			content: (identity) => `${allowedSignersLine(identity)}\n`
+		}],
+		services: [{
+			id: "signer-agent",
+			command: [
+				"moltnet",
+				"capability",
+				"serve",
+				"agent-signing",
+				"--adapter",
+				"ssh-agent",
+				"--socket",
+				GUEST_SIGNER_SOCKET
+			],
+			readiness: {
+				path: GUEST_SIGNER_SOCKET,
+				timeoutMs: 8e3
+			}
+		}]
+	}
+});
+//#endregion
+//#region ../crypto-service/src/content-cid.ts
+/**
+* Content CID — Canonical content hashing for diary entries
+*
+* Produces CIDv1 content identifiers (sha2-256, raw codec, base32lower)
+* for immutable diary entry signing.
+*
+* Canonical input follows RFC 8785 (JCS — JSON Canonicalization Scheme):
+* deterministic JSON with sorted keys, then hashed. JSON string escaping
+* naturally prevents field delimiter collision.
+*/
+/** SHA-256 multicodec code per multihash table */
+var SHA2_256_CODE = 18;
+/**
+* Build the canonical JSON input for content hashing.
+*
+* Uses JSON with sorted keys (RFC 8785 style) to avoid field delimiter
+* collision. Nulls are normalized: null title → empty string, null tags → [].
+* Tags are sorted for determinism.
+*/
+function buildCanonicalInput(entryType, title, content, tags) {
+	const canonical = {
+		c: content,
+		t: title ?? "",
+		tags: tags ? [...tags].sort() : [],
+		type: entryType,
+		v: "moltnet:diary:v1"
+	};
+	return JSON.stringify(canonical);
+}
+/**
+* Compute the raw SHA-256 hash of canonical diary entry content.
+*/
+function computeCanonicalHash(entryType, title, content, tags) {
+	const input = buildCanonicalInput(entryType, title, content, tags);
+	return sha256(new TextEncoder().encode(input));
+}
+/**
+* Compute a CIDv1 content identifier for a diary entry.
+*
+* Format: CIDv1 with sha2-256 hash, raw codec, base32lower multibase.
+* Example output: "bafkreig..."
+*/
+function computeContentCid(entryType, title, content, tags) {
+	const digest = create(SHA2_256_CODE, computeCanonicalHash(entryType, title, content, tags));
+	return CID.createV1(raw.code, digest).toString(base32);
+}
+//#endregion
 //#region src/moltnet/render-phase6.ts
 function slugToTitle(value) {
 	return value.split(/[:/_-]+/).filter(Boolean).map((part) => part[0]?.toUpperCase() + part.slice(1)).join(" ");
@@ -279,9 +495,9 @@ function createMoltNetTools(config) {
 		name: "moltnet_pack_get",
 		label: "Get MoltNet Pack",
 		description: "Get a context pack by ID. Optionally expand included entries.",
-		parameters: Type.Object({
-			packId: Type.String({ description: "Context pack ID" }),
-			expandEntries: Type.Optional(Type.Boolean({ description: "Include full expanded entries" }))
+		parameters: Type$1.Object({
+			packId: Type$1.String({ description: "Context pack ID" }),
+			expandEntries: Type$1.Optional(Type$1.Boolean({ description: "Include full expanded entries" }))
 		}),
 		async execute(_id, params) {
 			const { agent } = ensureConnected(config);
@@ -299,14 +515,14 @@ function createMoltNetTools(config) {
 		name: "moltnet_pack_create",
 		label: "Create MoltNet Pack",
 		description: "Persist a curated context pack. Entries are caller-ranked (lower rank = more prominent). Recipe/prompt/selection_rationale belong in params. Defaults to pinned=false — packs in the attribution pipeline are ephemeral unless the caller explicitly opts in.",
-		parameters: Type.Object({
-			entries: Type.Array(Type.Object({
-				entryId: Type.String({ description: "Diary entry UUID" }),
-				rank: Type.Number({ description: "Rank (1..N, lower = more prominent)" })
+		parameters: Type$1.Object({
+			entries: Type$1.Array(Type$1.Object({
+				entryId: Type$1.String({ description: "Diary entry UUID" }),
+				rank: Type$1.Number({ description: "Rank (1..N, lower = more prominent)" })
 			}), { description: "Selected entries with their ranks" }),
-			params: Type.Optional(Type.Record(Type.String(), Type.Unknown(), { description: "Free-form recipe parameters (recipe name, prompt, selection rationale, etc.)" })),
-			tokenBudget: Type.Optional(Type.Number({ description: "Soft token budget recorded on the pack (optional)" })),
-			pinned: Type.Optional(Type.Boolean({ description: "Pin the pack against retention policy (default false)" }))
+			params: Type$1.Optional(Type$1.Record(Type$1.String(), Type$1.Unknown(), { description: "Free-form recipe parameters (recipe name, prompt, selection rationale, etc.)" })),
+			tokenBudget: Type$1.Optional(Type$1.Number({ description: "Soft token budget recorded on the pack (optional)" })),
+			pinned: Type$1.Optional(Type$1.Boolean({ description: "Pin the pack against retention policy (default false)" }))
 		}),
 		async execute(_id, params) {
 			const { agent, diaryId } = ensureConnected(config);
@@ -330,10 +546,10 @@ function createMoltNetTools(config) {
 		name: "moltnet_pack_provenance",
 		label: "Get MoltNet Pack Provenance",
 		description: "Get the provenance graph for a context pack by ID or CID.",
-		parameters: Type.Object({
-			packId: Type.Optional(Type.String({ description: "Context pack ID" })),
-			packCid: Type.Optional(Type.String({ description: "Context pack CID" })),
-			depth: Type.Optional(Type.Number({ description: "Supersession ancestry depth to include (default 2)" }))
+		parameters: Type$1.Object({
+			packId: Type$1.Optional(Type$1.String({ description: "Context pack ID" })),
+			packCid: Type$1.Optional(Type$1.String({ description: "Context pack CID" })),
+			depth: Type$1.Optional(Type$1.Number({ description: "Supersession ancestry depth to include (default 2)" }))
 		}),
 		async execute(_id, params) {
 			const { agent } = ensureConnected(config);
@@ -361,12 +577,12 @@ function createMoltNetTools(config) {
 		name: "moltnet_pack_render",
 		label: "Render MoltNet Pack",
 		description: "Fetch a pack with entries, transform it into docs, then preview or persist the rendered pack.",
-		parameters: Type.Object({
-			packId: Type.String({ description: "Context pack ID" }),
-			renderMethod: Type.Optional(Type.String({ description: "Render method label. Defaults to pi:pack-to-docs-v1" })),
-			markdown: Type.Optional(Type.String({ description: "Optional caller-authored markdown override" })),
-			preview: Type.Optional(Type.Boolean({ description: "Preview without persisting (default false)" })),
-			pinned: Type.Optional(Type.Boolean({ description: "Persist the rendered pack as pinned (default false)" }))
+		parameters: Type$1.Object({
+			packId: Type$1.String({ description: "Context pack ID" }),
+			renderMethod: Type$1.Optional(Type$1.String({ description: "Render method label. Defaults to pi:pack-to-docs-v1" })),
+			markdown: Type$1.Optional(Type$1.String({ description: "Optional caller-authored markdown override" })),
+			preview: Type$1.Optional(Type$1.Boolean({ description: "Preview without persisting (default false)" })),
+			pinned: Type$1.Optional(Type$1.Boolean({ description: "Persist the rendered pack as pinned (default false)" }))
 		}),
 		async execute(_id, params) {
 			const { agent } = ensureConnected(config);
@@ -394,11 +610,11 @@ function createMoltNetTools(config) {
 		name: "moltnet_rendered_pack_list",
 		label: "List MoltNet Rendered Packs",
 		description: "List rendered packs for the current MoltNet diary, optionally filtered by source pack or render method.",
-		parameters: Type.Object({
-			sourcePackId: Type.Optional(Type.String({ description: "Filter by source pack ID" })),
-			renderMethod: Type.Optional(Type.String({ description: "Filter by render method" })),
-			limit: Type.Optional(Type.Number({ description: "Max results (default 10)" })),
-			offset: Type.Optional(Type.Number({ description: "Offset for pagination (default 0)" }))
+		parameters: Type$1.Object({
+			sourcePackId: Type$1.Optional(Type$1.String({ description: "Filter by source pack ID" })),
+			renderMethod: Type$1.Optional(Type$1.String({ description: "Filter by render method" })),
+			limit: Type$1.Optional(Type$1.Number({ description: "Max results (default 10)" })),
+			offset: Type$1.Optional(Type$1.Number({ description: "Offset for pagination (default 0)" }))
 		}),
 		async execute(_id, params) {
 			const { agent, diaryId } = ensureConnected(config);
@@ -421,7 +637,7 @@ function createMoltNetTools(config) {
 		name: "moltnet_rendered_pack_get",
 		label: "Get MoltNet Rendered Pack",
 		description: "Get a rendered pack by ID.",
-		parameters: Type.Object({ renderedPackId: Type.String({ description: "Rendered pack ID" }) }),
+		parameters: Type$1.Object({ renderedPackId: Type$1.String({ description: "Rendered pack ID" }) }),
 		async execute(_id, params) {
 			const { agent } = ensureConnected(config);
 			const rendered = await agent.packs.getRendered(params.renderedPackId);
@@ -438,14 +654,14 @@ function createMoltNetTools(config) {
 		name: "moltnet_diary_tags",
 		label: "List MoltNet Diary Tags",
 		description: "Inventory tags on the current diary with entry counts. Cheap reconnaissance before committing to a search or list — use it to discover scope prefixes and cluster sizes. Optional prefix/minCount/entryTypes filters narrow the result.",
-		parameters: Type.Object({
-			prefix: Type.Optional(Type.String({ description: "Filter to tags starting with this prefix (e.g. \"scope:\")" })),
-			minCount: Type.Optional(Type.Number({ description: "Exclude tags with fewer than this many entries" })),
-			entryTypes: Type.Optional(Type.Array(Type.Union([
-				Type.Literal("episodic"),
-				Type.Literal("semantic"),
-				Type.Literal("procedural"),
-				Type.Literal("reflection")
+		parameters: Type$1.Object({
+			prefix: Type$1.Optional(Type$1.String({ description: "Filter to tags starting with this prefix (e.g. \"scope:\")" })),
+			minCount: Type$1.Optional(Type$1.Number({ description: "Exclude tags with fewer than this many entries" })),
+			entryTypes: Type$1.Optional(Type$1.Array(Type$1.Union([
+				Type$1.Literal("episodic"),
+				Type$1.Literal("semantic"),
+				Type$1.Literal("procedural"),
+				Type$1.Literal("reflection")
 			]), { description: "Scope the tag count to these entry types" }))
 		}),
 		async execute(_id, params) {
@@ -468,30 +684,30 @@ function createMoltNetTools(config) {
 		name: "moltnet_list_entries",
 		label: "List MoltNet Diary Entries",
 		description: "List entries from the MoltNet diary. When `entryIds` is provided, batch-fetches those specific entries (max 50) and returns full fields including entryType, contentSignature, and contentHash for signature checks. Otherwise returns recent entries with a content preview, filtered by any combination of tags (AND), excludeTags (NONE), entryType, and the taskFilter shorthand which expands into the right `task:*` tags.",
-		parameters: Type.Object({
-			limit: Type.Optional(Type.Number({ description: "Max entries to return (default 10)" })),
-			tags: Type.Optional(Type.Array(Type.String({
+		parameters: Type$1.Object({
+			limit: Type$1.Optional(Type$1.Number({ description: "Max entries to return (default 10)" })),
+			tags: Type$1.Optional(Type$1.Array(Type$1.String({
 				minLength: 1,
 				maxLength: DIARY_TAG_MAX_LENGTH$1
 			}), {
 				description: "Tags filter — entry must have ALL listed tags (AND). Max 20.",
 				maxItems: 20
 			})),
-			excludeTags: Type.Optional(Type.Array(Type.String({
+			excludeTags: Type$1.Optional(Type$1.Array(Type$1.String({
 				minLength: 1,
 				maxLength: DIARY_TAG_MAX_LENGTH$1
 			}), {
 				description: "Tags to exclude — entry must have NONE of these. Max 20.",
 				maxItems: 20
 			})),
-			entryType: Type.Optional(Type.String({ description: "Filter by entry type (procedural, semantic, episodic, reflection)." })),
-			taskFilter: Type.Optional(Type.Object({
-				taskId: Type.Optional(Type.String()),
-				taskType: Type.Optional(Type.String()),
-				correlationId: Type.Optional(Type.String()),
-				attemptN: Type.Optional(Type.Number())
+			entryType: Type$1.Optional(Type$1.String({ description: "Filter by entry type (procedural, semantic, episodic, reflection)." })),
+			taskFilter: Type$1.Optional(Type$1.Object({
+				taskId: Type$1.Optional(Type$1.String()),
+				taskType: Type$1.Optional(Type$1.String()),
+				correlationId: Type$1.Optional(Type$1.String()),
+				attemptN: Type$1.Optional(Type$1.Number())
 			}, { description: "Shorthand: any combination compiles to the matching task:* tags (task:id:<id>, task:type:<type>, task:correlation:<id>, task:attempt:<n>) and is merged into the tags filter." })),
-			entryIds: Type.Optional(Type.Array(Type.String(), {
+			entryIds: Type$1.Optional(Type$1.Array(Type$1.String(), {
 				description: "Batch-fetch specific entries by UUID (max 50). Overrides every other filter.",
 				maxItems: 50
 			}))
@@ -543,7 +759,7 @@ function createMoltNetTools(config) {
 		name: "moltnet_get_entry",
 		label: "Get MoltNet Diary Entry",
 		description: "Get the full content of a specific diary entry by ID.",
-		parameters: Type.Object({ entryId: Type.String({ description: "The entry ID to fetch" }) }),
+		parameters: Type$1.Object({ entryId: Type$1.String({ description: "The entry ID to fetch" }) }),
 		async execute(_id, params) {
 			const { agent } = ensureConnected(config);
 			const entry = await agent.entries.get(params.entryId);
@@ -567,32 +783,32 @@ function createMoltNetTools(config) {
 		name: "moltnet_search_entries",
 		label: "Search MoltNet Diary Entries",
 		description: "Hybrid (semantic + lexical) search over diary entries. Use proactively before non-trivial investigation, code changes, review, or episodic incident capture so prior decisions and recurring failures surface before you act. Do not search randomly: pass taskFilter for task/correlation-local searches and tags or entryTypes for broader prior-knowledge searches. Optional tags / excludeTags / entryTypes filters AND with the query; the taskFilter shorthand expands into task:* provenance tags so `taskFilter: { taskType: \"fulfill_brief\" }` returns only entries from fulfill_brief attempts. Filters apply server-side before ranking.",
-		parameters: Type.Object({
-			query: Type.String({ description: "Natural language search query" }),
-			limit: Type.Optional(Type.Number({ description: "Max results (default 5)" })),
-			tags: Type.Optional(Type.Array(Type.String({
+		parameters: Type$1.Object({
+			query: Type$1.String({ description: "Natural language search query" }),
+			limit: Type$1.Optional(Type$1.Number({ description: "Max results (default 5)" })),
+			tags: Type$1.Optional(Type$1.Array(Type$1.String({
 				minLength: 1,
 				maxLength: DIARY_TAG_MAX_LENGTH$1
 			}), {
 				description: "Entry must have ALL listed tags (AND). Max 20.",
 				maxItems: 20
 			})),
-			excludeTags: Type.Optional(Type.Array(Type.String({
+			excludeTags: Type$1.Optional(Type$1.Array(Type$1.String({
 				minLength: 1,
 				maxLength: DIARY_TAG_MAX_LENGTH$1
 			}), {
 				description: "Entry must have NONE of these tags. Max 20.",
 				maxItems: 20
 			})),
-			entryTypes: Type.Optional(Type.Array(Type.String(), {
+			entryTypes: Type$1.Optional(Type$1.Array(Type$1.String(), {
 				description: "Restrict to these entry types (procedural, semantic, episodic, reflection). Max 4.",
 				maxItems: 4
 			})),
-			taskFilter: Type.Optional(Type.Object({
-				taskId: Type.Optional(Type.String()),
-				taskType: Type.Optional(Type.String()),
-				correlationId: Type.Optional(Type.String()),
-				attemptN: Type.Optional(Type.Number())
+			taskFilter: Type$1.Optional(Type$1.Object({
+				taskId: Type$1.Optional(Type$1.String()),
+				taskType: Type$1.Optional(Type$1.String()),
+				correlationId: Type$1.Optional(Type$1.String()),
+				attemptN: Type$1.Optional(Type$1.Number())
 			}, { description: "Shorthand: any combination compiles to the matching task:* tags and is merged into the tags filter." }))
 		}),
 		async execute(_id, params) {
@@ -626,21 +842,24 @@ function createMoltNetTools(config) {
 		name: "moltnet_create_entry",
 		label: "Create MoltNet Diary Entry",
 		description: "Create a new diary entry to record decisions, findings, incidents, or reflections. Before creating an episodic incident entry, first call moltnet_search_entries with the title/root-cause/error/watch-for terms plus taskFilter, tags, or entryTypes filters, then reference close matches instead of creating an isolated duplicate. During an active task, the entry is forced into the task diary and tagged with the task:* provenance namespace (task:id:<id>, task:type:<type>, task:attempt:<n>, plus task:correlation:<id> when set); an explicit diaryId mismatching the task diary is rejected. Use this tool — NOT `moltnet entry create` / `moltnet entry create-signed` via bash. The CLI path bypasses task-tag auto-injection and leaves entries invisible to taskFilter queries.",
-		parameters: Type.Object({
-			title: Type.String({ description: "Entry title (concise, descriptive)" }),
-			content: Type.String({ description: "Entry content (markdown)" }),
-			tags: Type.Optional(Type.Array(Type.String(), { description: "Tags for categorization" })),
-			importance: Type.Optional(Type.Number({ description: "Importance 1-10 (default 5)" })),
-			entryType: Type.Optional(Type.Union([
-				Type.Literal("episodic"),
-				Type.Literal("semantic"),
-				Type.Literal("procedural"),
-				Type.Literal("reflection")
+		parameters: Type$1.Object({
+			title: Type$1.String({ description: "Entry title (concise, descriptive)" }),
+			content: Type$1.String({ description: "Entry content (markdown)" }),
+			tags: Type$1.Optional(Type$1.Array(Type$1.String(), { description: "Tags for categorization" })),
+			importance: Type$1.Optional(Type$1.Number({ description: "Importance 1-10 (default 5)" })),
+			entryType: Type$1.Optional(Type$1.Union([
+				Type$1.Literal("episodic"),
+				Type$1.Literal("semantic"),
+				Type$1.Literal("procedural"),
+				Type$1.Literal("reflection")
 			], { description: "Entry type. Use episodic for incidents, workarounds, bugs, or recurrence evidence; defaults to semantic." })),
-			diaryId: Type.Optional(Type.String({ description: "Explicit diary id. During an active task, must match the task diary or the call is rejected. Outside a task, overrides the env-derived diary." }))
+			diaryId: Type$1.Optional(Type$1.String({ description: "Explicit diary id. During an active task, must match the task diary or the call is rejected. Outside a task, overrides the env-derived diary." })),
+			signed: Type$1.Optional(Type$1.Boolean({ description: "Create a content-signed (immutable) entry. The signature is produced on the trusted host through the agent-signing capability; fails when the runtime does not expose it." }))
 		}),
 		async execute(_id, params) {
 			const { agent, diaryId: envDiaryId } = ensureConnected(config);
+			const signer = params.signed ? config.getSigner?.() ?? null : null;
+			if (params.signed && !signer) throw new Error("entries_create: signed entries require the agent-signing capability; create an unsigned entry or run under a runtime that declares it.");
 			const taskCtx = config.getTaskContext?.() ?? null;
 			let targetDiaryId;
 			let autoTags = [];
@@ -658,12 +877,23 @@ function createMoltNetTools(config) {
 			const mergedTags = autoTags.length ? [...autoTags, ...userTags.filter((t) => !autoTags.includes(t))] : userTags;
 			let entry;
 			try {
+				let signingRequestId;
+				if (signer) {
+					const contentCid = computeContentCid(params.entryType ?? "semantic", params.title, params.content, mergedTags);
+					const request = await agent.crypto.signingRequests.create({
+						message: contentCid,
+						verificationMethod: "agent-ed25519"
+					});
+					await signer.signDiaryEntry({ signingRequestId: request.id });
+					signingRequestId = request.id;
+				}
 				entry = await agent.entries.create(targetDiaryId, {
 					title: params.title,
 					content: params.content,
 					tags: mergedTags,
 					importance: params.importance ?? 5,
-					...params.entryType ? { entryType: params.entryType } : {}
+					...params.entryType ? { entryType: params.entryType } : {},
+					...signingRequestId ? { signingRequestId } : {}
 				});
 			} catch (error) {
 				const message = error instanceof Error ? error.message : String(error);
@@ -687,7 +917,8 @@ function createMoltNetTools(config) {
 						diaryId: targetDiaryId,
 						entryType: entry.entryType,
 						importance: entry.importance,
-						tags: mergedTags
+						tags: mergedTags,
+						signed: signer !== null
 					}, null, 2)
 				}],
 				details: {}
@@ -698,7 +929,7 @@ function createMoltNetTools(config) {
 		name: "moltnet_get_task",
 		label: "Get MoltNet Task",
 		description: "Fetch a task by ID — the row, including taskType, status, acceptedAttemptN, references, input, timeouts. Use this when you need to inspect another task (e.g. an assess_brief judging a fulfill_brief: fetch the target task here, then list its attempts via moltnet_list_task_attempts to read the producer's output and decide what to investigate).",
-		parameters: Type.Object({ taskId: Type.String({ description: "Task ID (UUID)." }) }),
+		parameters: Type$1.Object({ taskId: Type$1.String({ description: "Task ID (UUID)." }) }),
 		async execute(_id, params) {
 			const { agent } = ensureConnected(config);
 			const task = await agent.tasks.get(params.taskId);
@@ -715,7 +946,7 @@ function createMoltNetTools(config) {
 		name: "moltnet_list_task_attempts",
 		label: "List MoltNet Task Attempts",
 		description: "List every attempt made on a task, in attempt-number order. Each attempt carries the claimed agent, status, output, outputCid, and timing. The accepted attempt (whose attemptN matches the parent task's acceptedAttemptN) is the canonical one — its `output` is what consumers should reason against. Earlier failed or timed_out attempts are kept for audit but should not drive downstream decisions.",
-		parameters: Type.Object({ taskId: Type.String({ description: "Task ID (UUID)." }) }),
+		parameters: Type$1.Object({ taskId: Type$1.String({ description: "Task ID (UUID)." }) }),
 		async execute(_id, params) {
 			const { agent } = ensureConnected(config);
 			const attempts = await agent.tasks.listAttempts(params.taskId);
@@ -732,17 +963,17 @@ function createMoltNetTools(config) {
 		name: "moltnet_list_task_messages",
 		label: "List MoltNet Task Attempt Messages",
 		description: "List messages for a specific task attempt. Use this when you need the turn-by-turn execution record behind an accepted attempt — tool calls, text deltas, and error/info events that do not appear in the attempt output alone.",
-		parameters: Type.Object({
-			taskId: Type.String({ description: "Task ID (UUID)." }),
-			attemptN: Type.Integer({
+		parameters: Type$1.Object({
+			taskId: Type$1.String({ description: "Task ID (UUID)." }),
+			attemptN: Type$1.Integer({
 				minimum: 1,
 				description: "Attempt number to inspect."
 			}),
-			afterSeq: Type.Optional(Type.Integer({
+			afterSeq: Type$1.Optional(Type$1.Integer({
 				minimum: 0,
 				description: "Optional cursor: only return messages with seq > afterSeq."
 			})),
-			limit: Type.Optional(Type.Integer({
+			limit: Type$1.Optional(Type$1.Integer({
 				minimum: 1,
 				maximum: 500,
 				description: "Optional maximum messages to return. Defaults to the API value."
@@ -767,12 +998,12 @@ function createMoltNetTools(config) {
 		name: "moltnet_upload_task_artifact",
 		label: "Upload MoltNet Task Artifact",
 		description: "Upload a file from the current task workspace as an immutable task artifact. Only available during an active task attempt; the tool attaches the artifact to the active taskId/attemptN and returns metadata including cid, sizeBytes, kind, and title. Use this for large logs, reports, build outputs, screenshots, generated files, or other bytes that should be referenced by CID instead of pasted into structured task output.",
-		parameters: Type.Object({
-			filePath: Type.String({ description: "Path to a file under the current task workspace. Relative paths are resolved from the workspace root." }),
-			kind: Type.String({ description: "Artifact category, e.g. log, report, patch, screenshot, bundle, dataset, trace." }),
-			title: Type.String({ description: "Human-readable artifact title, usually the file name." }),
-			contentType: Type.Optional(Type.String({ description: "MIME type. Defaults to application/octet-stream when omitted." })),
-			contentEncoding: Type.Optional(Type.String({ description: "Optional content encoding if the file is already encoded, e.g. gzip." }))
+		parameters: Type$1.Object({
+			filePath: Type$1.String({ description: "Path to a file under the current task workspace. Relative paths are resolved from the workspace root." }),
+			kind: Type$1.String({ description: "Artifact category, e.g. log, report, patch, screenshot, bundle, dataset, trace." }),
+			title: Type$1.String({ description: "Human-readable artifact title, usually the file name." }),
+			contentType: Type$1.Optional(Type$1.String({ description: "MIME type. Defaults to application/octet-stream when omitted." })),
+			contentEncoding: Type$1.Optional(Type$1.String({ description: "Optional content encoding if the file is already encoded, e.g. gzip." }))
 		}),
 		async execute(_id, params) {
 			const { agent, teamId } = ensureConnected(config);
@@ -807,14 +1038,14 @@ function createMoltNetTools(config) {
 		name: "moltnet_list_task_artifacts",
 		label: "List MoltNet Task Artifacts",
 		description: "List immutable artifacts attached to a task, including each artifact CID, attempt number, kind, title, content type, size, uploader, and creation time. Use this when judging or continuing work that references task artifacts.",
-		parameters: Type.Object({
-			taskId: Type.Optional(Type.String({ description: "Task ID. Defaults to the active task when running inside a task attempt." })),
-			limit: Type.Optional(Type.Integer({
+		parameters: Type$1.Object({
+			taskId: Type$1.Optional(Type$1.String({ description: "Task ID. Defaults to the active task when running inside a task attempt." })),
+			limit: Type$1.Optional(Type$1.Integer({
 				minimum: 1,
 				maximum: 100,
 				description: "Maximum artifacts to return. Defaults to the server page size."
 			})),
-			cursor: Type.Optional(Type.String({ description: "Pagination cursor returned by a previous moltnet_list_task_artifacts call." }))
+			cursor: Type$1.Optional(Type$1.String({ description: "Pagination cursor returned by a previous moltnet_list_task_artifacts call." }))
 		}),
 		async execute(_id, params) {
 			const { agent, teamId } = ensureConnected(config);
@@ -838,17 +1069,17 @@ function createMoltNetTools(config) {
 		name: "moltnet_download_task_artifact",
 		label: "Download MoltNet Task Artifact",
 		description: "Download immutable task artifact bytes by taskId and CID into a new file in the current task workspace. Use moltnet_list_task_artifacts first to choose the correct CID. Omit attemptN for a bound input artifact; pass it only to require an artifact from one exact task attempt.",
-		parameters: Type.Object({
-			taskId: Type.Optional(Type.String({ description: "Task ID. Defaults to the active task when running inside a task attempt." })),
-			attemptN: Type.Optional(Type.Integer({
+		parameters: Type$1.Object({
+			taskId: Type$1.Optional(Type$1.String({ description: "Task ID. Defaults to the active task when running inside a task attempt." })),
+			attemptN: Type$1.Optional(Type$1.Integer({
 				minimum: 1,
 				description: "Attempt number that produced the artifact. Omit for bound input artifacts, which have no producing attempt."
 			})),
-			cid: Type.String({
+			cid: Type$1.String({
 				minLength: 1,
 				description: "Artifact CID returned by moltnet_list_task_artifacts."
 			}),
-			outputPath: Type.String({ description: "New file path under the current task workspace. The tool refuses to overwrite existing files." })
+			outputPath: Type$1.String({ description: "New file path under the current task workspace. The tool refuses to overwrite existing files." })
 		}),
 		async execute(_id, params) {
 			const { agent, teamId } = ensureConnected(config);
@@ -890,7 +1121,7 @@ function createMoltNetTools(config) {
 		name: "moltnet_review_session_errors",
 		label: "Review Session Tool Errors",
 		description: "Review tool failures buffered during this session (isError=true results). Use this to decide whether any failures are worth persisting as a diary entry via moltnet_create_entry. Most failures are transient (denied prompts, empty greps, mid-iteration typecheck errors) and should NOT be written to the diary — only persist incidents that represent a real finding (root cause identified, non-obvious workaround, recurring pattern). Pass clear=true to drop the buffer after reviewing.",
-		parameters: Type.Object({ clear: Type.Optional(Type.Boolean({ description: "If true, empty the buffer after returning it. Use once you have decided whether to persist." })) }),
+		parameters: Type$1.Object({ clear: Type$1.Optional(Type$1.Boolean({ description: "If true, empty the buffer after returning it. Use once you have decided whether to persist." })) }),
 		async execute(_id, params) {
 			const errors = config.getSessionErrors();
 			const payload = {
@@ -942,11 +1173,11 @@ function createMoltNetTools(config) {
 		defineTool({
 			name: "moltnet_host_exec",
 			label: "Run command on host (escape hatch — requires user approval)",
-			description: "Runs a command on the HOST machine, outside the sandbox VM. The user will be prompted to approve each invocation via a UI dialog, and in headless task runs there is no one to approve — so do NOT call this tool speculatively. Routine git and gh work — pushing branches, opening pull requests, etc. — runs INSIDE the VM via the normal `bash` tool; use that, not this escape hatch. Credentials are not generally injected into the guest. A runtime may expose an opaque HTTP placeholder that the host proxy can use only for declared destinations; otherwise authenticated operations are unavailable. Reserve this tool for the rare case that genuinely cannot run in the guest (e.g. reaching a host-only resource the VM has no path to).\n\nAllowed executables: git, gh, moltnet. Runs with a minimal env (PATH, HOME, GIT_CONFIG_GLOBAL, …); pass only non-secret additional vars via the `env` parameter. Every invocation is logged as an auditable host execution.",
-			parameters: Type.Object({
-				executable: Type.String({ description: "Executable to run (git | gh | moltnet)" }),
-				args: Type.Array(Type.String(), { description: "Arguments to pass to the executable" }),
-				env: Type.Optional(Type.Record(Type.String(), Type.String(), { description: "Additional non-secret environment variables for this invocation. Merged on top of the minimal base env." }))
+			description: "Runs a command on the HOST machine, outside the sandbox VM. The user will be prompted to approve each invocation via a UI dialog, and in headless task runs there is no one to approve — so do NOT call this tool speculatively. Routine git and gh work — pushing branches, opening pull requests, etc. — runs INSIDE the VM via the normal `bash` tool; use that, not this escape hatch. Credentials are not generally injected into the guest. A runtime may expose an opaque HTTP placeholder that the host proxy can use only for declared destinations, and commit signing is brokered through the `agent-signing` host capability when declared; otherwise authenticated operations are unavailable. Reserve this tool for the rare case that genuinely cannot run in the guest (e.g. reaching a host-only resource the VM has no path to).\n\nAllowed executables: git, gh, moltnet. Runs with a minimal env (PATH, HOME, GIT_CONFIG_GLOBAL, …); pass only non-secret additional vars via the `env` parameter. Every invocation is logged as an auditable host execution.",
+			parameters: Type$1.Object({
+				executable: Type$1.String({ description: "Executable to run (git | gh | moltnet)" }),
+				args: Type$1.Array(Type$1.String(), { description: "Arguments to pass to the executable" }),
+				env: Type$1.Optional(Type$1.Record(Type$1.String(), Type$1.String(), { description: "Additional non-secret environment variables for this invocation. Merged on top of the minimal base env." }))
 			}),
 			async execute(_id, params, _signal, _onUpdate, ctx) {
 				if (!HOST_EXEC_ALLOWED.has(params.executable)) throw new Error(`host_exec: '${params.executable}' is not in the allowed list (${[...HOST_EXEC_ALLOWED].join(", ")}). Extend HOST_EXEC_ALLOWED only after explicit security review.`);
@@ -1299,7 +1530,7 @@ async function resolvePersistentSessionManager(args) {
 */
 async function computeJsonCid(value) {
 	const bytes = json.encode(value);
-	const hash = await sha256.digest(bytes);
+	const hash = await sha256$1.digest(bytes);
 	return CID.create(1, json.code, hash).toString();
 }
 //#endregion
@@ -1323,7 +1554,7 @@ var CONTEXT_BINDINGS = [
 ];
 /** Maximum UTF-16 code units accepted in one ContextRef content field. */
 var CONTEXT_REF_MAX_CONTENT_LENGTH = 65536;
-var ContextBinding = Type$1.Unsafe(Type$1.Union(CONTEXT_BINDINGS.map((binding) => Type$1.Literal(binding)), { $id: "ContextBinding" }));
+var ContextBinding = Type.Unsafe(Type.Union(CONTEXT_BINDINGS.map((binding) => Type.Literal(binding)), { $id: "ContextBinding" }));
 /**
 * One context entry. Bytes are inlined: the proposer chose them, and the
 * task's `inputCid` already pins the entire input — including
@@ -1346,14 +1577,14 @@ var ContextBinding = Type$1.Unsafe(Type$1.Union(CONTEXT_BINDINGS.map((binding) =
 *               short example skills, not the kind of skill the eval
 *               substrate is dogfooded on (#943, #823).
 */
-var ContextRef = Type$1.Object({
-	slug: Type$1.String({
+var ContextRef = Type.Object({
+	slug: Type.String({
 		minLength: 1,
 		maxLength: 64,
 		pattern: "^[a-zA-Z0-9_-]+$"
 	}),
 	binding: ContextBinding,
-	content: Type$1.String({
+	content: Type.String({
 		minLength: 1,
 		maxLength: CONTEXT_REF_MAX_CONTENT_LENGTH
 	})
@@ -1362,7 +1593,7 @@ var ContextRef = Type$1.Object({
 	additionalProperties: false
 });
 /** Reusable input fragment for any task type. Soft cap at 5 items. */
-var TaskContext = Type$1.Array(ContextRef, {
+var TaskContext = Type.Array(ContextRef, {
 	$id: "TaskContext",
 	maxItems: 5
 });
@@ -1379,37 +1610,37 @@ var TaskContext = Type$1.Array(ContextRef, {
 * The REST API exposes a single shape regardless of scope; the team header
 * gates which rows are returned.
 */
-var RuntimeModelProvider = Type$1.String({
+var RuntimeModelProvider = Type.String({
 	minLength: 1,
 	maxLength: 100,
 	pattern: "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$"
 });
-var RuntimeModelName = Type$1.String({
+var RuntimeModelName = Type.String({
 	minLength: 1,
 	maxLength: 200,
 	pattern: "^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,199}$"
 });
-var RuntimeModelCapabilities = Type$1.Record(Type$1.String({
+var RuntimeModelCapabilities = Type.Record(Type.String({
 	minLength: 1,
 	maxLength: 64
-}), Type$1.Union([
-	Type$1.Boolean(),
-	Type$1.Number(),
-	Type$1.String({ maxLength: 256 })
+}), Type.Union([
+	Type.Boolean(),
+	Type.Number(),
+	Type.String({ maxLength: 256 })
 ]));
-Type$1.Object({
-	id: Type$1.String({ format: "uuid" }),
-	teamId: Type$1.Union([Type$1.String({ format: "uuid" }), Type$1.Null()]),
+Type.Object({
+	id: Type.String({ format: "uuid" }),
+	teamId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
 	provider: RuntimeModelProvider,
 	model: RuntimeModelName,
-	displayName: Type$1.Union([Type$1.String({ maxLength: 200 }), Type$1.Null()]),
-	description: Type$1.Union([Type$1.String({ maxLength: 4096 }), Type$1.Null()]),
+	displayName: Type.Union([Type.String({ maxLength: 200 }), Type.Null()]),
+	description: Type.Union([Type.String({ maxLength: 4096 }), Type.Null()]),
 	capabilities: RuntimeModelCapabilities,
-	isActive: Type$1.Boolean(),
-	createdByAgentId: Type$1.Union([Type$1.String({ format: "uuid" }), Type$1.Null()]),
-	createdByHumanId: Type$1.Union([Type$1.String({ format: "uuid" }), Type$1.Null()]),
-	createdAt: Type$1.String({ format: "date-time" }),
-	updatedAt: Type$1.String({ format: "date-time" })
+	isActive: Type.Boolean(),
+	createdByAgentId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	createdByHumanId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	createdAt: Type.String({ format: "date-time" }),
+	updatedAt: Type.String({ format: "date-time" })
 }, {
 	$id: "RuntimeModel",
 	additionalProperties: false
@@ -1426,12 +1657,12 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 		},
 		"accountable-delivery-v1": {
 			binding: "prompt_prefix",
-			content: "# Accountable delivery\n\n- Pair every commit made during this task with a task-provenance diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer. The tool does not currently promise a content signature; never describe an entry as signed unless the active runtime exposes and verifies a signing capability.\n- Do not disable commit signing when the active runtime provides it. A host-authenticated guest has no injected signing key, so do not recover one from host configuration or claim an unsigned commit is signed.\n- Push a branch and open or update a pull request only when the task asks for it. Use a host-brokered GitHub placeholder only when the runtime kernel declares one; if no GitHub credential is active, the authenticated operation is unavailable.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
+			content: "# Accountable delivery\n\n- Pair every commit made during this task with a task-provenance diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer. The tool does not currently promise a content signature unless you pass `signed: true` while the runtime kernel declares the `agent-signing` host capability; never describe an entry as signed otherwise.\n- When the runtime kernel declares `agent-signing`, sign commits normally with `git commit -S`: the signature is brokered to the trusted host through `SSH_AUTH_SOCK` and no private key exists in the guest. Without that capability commits are unsigned; do not disable signing the runtime provides, and never try to obtain a key from host configuration.\n- Push a branch and open or update a pull request only when the task asks for it. Use a host-brokered GitHub placeholder only when the runtime kernel declares one; if no GitHub credential is active, the authenticated operation is unavailable.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
 			slug: "accountable-delivery-v1"
 		},
 		"judgment-diary-v1": {
 			binding: "prompt_prefix",
-			content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict. Do not claim a content signature unless the active runtime exposes and verifies a signing capability.\n- Add the `judgment` tag and the active task type tag (`assess_brief`, `judge_pack`, or `pr_review`). For `judge_pack`, also add `rubric:<rubricId>` from the task facts.\n- Do not use a shell `moltnet entry` command: task provenance is injected only by the custom tool.",
+			content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict. Do not claim a content signature unless you created the entry with `signed: true` under a runtime that declares the `agent-signing` host capability.\n- Add the `judgment` tag and the active task type tag (`assess_brief`, `judge_pack`, or `pr_review`). For `judge_pack`, also add `rubric:<rubricId>` from the task facts.\n- Do not use a shell `moltnet entry` command: task provenance is injected only by the custom tool.",
 			slug: "judgment-diary-v1"
 		},
 		"proactive-memory-v1": {
@@ -1446,7 +1677,7 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 		},
 		"task-diary-discipline-v1": {
 			binding: "prompt_prefix",
-			content: "# Task diary discipline\n\n- During a daemon task, create diary entries only through the `moltnet_create_entry` custom tool. It binds entries to the current task diary and injects task, type, attempt, and correlation provenance tags.\n- Do not shell out to `moltnet entry create`, `moltnet entry create-signed`, or any other `moltnet entry` subcommand from bash while a task is running. Those paths bypass the custom tool's task-tag injection, so task-filtered diary queries cannot find the entry.\n- You may add useful tags, but do not try to replace task provenance supplied by the runtime.",
+			content: "# Task diary discipline\n\n- During a daemon task, create diary entries only through the `moltnet_create_entry` custom tool. It binds entries to the current task diary and injects task, type, attempt, and correlation provenance tags.\n- Do not shell out to `moltnet entry create`, `moltnet entry create-signed`, or any other `moltnet entry` subcommand from bash while a task is running. For a content-signed entry pass `signed: true` to the custom tool instead; it signs on the trusted host. Those shell paths bypass the custom tool's task-tag injection, so task-filtered diary queries cannot find the entry.\n- You may add useful tags, but do not try to replace task provenance supplied by the runtime.",
 			slug: "task-diary-discipline-v1"
 		},
 		"verification-and-artifacts-v1": {
@@ -1528,68 +1759,68 @@ Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPE
 //#endregion
 //#region ../models/src/preview-sign.ts
 function schemaRef$1(schema, id) {
-	return Type$1.Unsafe(Type$1.Ref(id));
+	return Type.Unsafe(Type.Ref(id));
 }
-var PreviewSignBase64UrlSchema = Type$1.String({
+var PreviewSignBase64UrlSchema = Type.String({
 	$id: "PreviewSignBase64Url",
 	minLength: 1,
 	maxLength: 5462,
 	pattern: "^[A-Za-z0-9_-]+$"
 });
-var PreviewSignSha256Base64UrlSchema = Type$1.String({
+var PreviewSignSha256Base64UrlSchema = Type.String({
 	$id: "PreviewSignSha256Base64Url",
 	minLength: 43,
 	maxLength: 43,
 	pattern: "^[A-Za-z0-9_-]+$"
 });
-var PreviewSignP256DerSignatureBase64UrlSchema = Type$1.String({
+var PreviewSignP256DerSignatureBase64UrlSchema = Type.String({
 	$id: "PreviewSignP256DerSignatureBase64Url",
 	minLength: 11,
 	maxLength: 96,
 	pattern: "^[A-Za-z0-9_-]+$"
 });
-var PreviewSignEs256PublicKeySchema = Type$1.Object({
-	kty: Type$1.Literal(2),
-	algorithm: Type$1.Literal(-7),
-	curve: Type$1.Literal(1),
+var PreviewSignEs256PublicKeySchema = Type.Object({
+	kty: Type.Literal(2),
+	algorithm: Type.Literal(-7),
+	curve: Type.Literal(1),
 	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
 	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
 }, {
 	$id: "PreviewSignEs256PublicKey",
 	additionalProperties: false
 });
-var PreviewSignEcdhEsHkdf256PublicKeySchema = Type$1.Object({
-	kty: Type$1.Literal(2),
-	algorithm: Type$1.Literal(-25),
-	curve: Type$1.Literal(1),
+var PreviewSignEcdhEsHkdf256PublicKeySchema = Type.Object({
+	kty: Type.Literal(2),
+	algorithm: Type.Literal(-25),
+	curve: Type.Literal(1),
 	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
 	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
 }, {
 	$id: "PreviewSignEcdhEsHkdf256PublicKey",
 	additionalProperties: false
 });
-var PreviewSignEsp256PublicKeySchema = Type$1.Object({
-	kty: Type$1.Literal(2),
-	algorithm: Type$1.Literal(-9),
-	curve: Type$1.Literal(1),
+var PreviewSignEsp256PublicKeySchema = Type.Object({
+	kty: Type.Literal(2),
+	algorithm: Type.Literal(-9),
+	curve: Type.Literal(1),
 	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
 	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
 }, {
 	$id: "PreviewSignEsp256PublicKey",
 	additionalProperties: false
 });
-var PreviewSignArkgSeedPublicKeySchema = Type$1.Object({
-	kty: Type$1.Literal(-65537),
-	algorithm: Type$1.Literal(-65700),
-	derivedAlgorithm: Type$1.Literal(-9),
+var PreviewSignArkgSeedPublicKeySchema = Type.Object({
+	kty: Type.Literal(-65537),
+	algorithm: Type.Literal(-65700),
+	derivedAlgorithm: Type.Literal(-9),
 	blindingKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
 	kemKey: schemaRef$1(PreviewSignEcdhEsHkdf256PublicKeySchema, "PreviewSignEcdhEsHkdf256PublicKey")
 }, {
 	$id: "PreviewSignArkgSeedPublicKey",
 	additionalProperties: false
 });
-var PreviewSignPublicMaterialSchema = Type$1.Object({
-	version: Type$1.Literal(1),
+var PreviewSignPublicMaterialSchema = Type.Object({
+	version: Type.Literal(1),
 	outerCredentialId: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
 	outerPublicKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
 	previewKeyHandle: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
@@ -1598,9 +1829,9 @@ var PreviewSignPublicMaterialSchema = Type$1.Object({
 	$id: "PreviewSignPublicMaterial",
 	additionalProperties: false
 });
-var PreviewSignChallengeSchema = Type$1.Object({
-	verificationMethod: Type$1.Literal("human-hardware-previewsign"),
-	version: Type$1.Literal(1),
+var PreviewSignChallengeSchema = Type.Object({
+	verificationMethod: Type.Literal("human-hardware-previewsign"),
+	version: Type.Literal(1),
 	envelope: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
 	digest: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
 	additionalArguments: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
@@ -1611,23 +1842,23 @@ var PreviewSignChallengeSchema = Type$1.Object({
 	$id: "PreviewSignChallenge",
 	additionalProperties: false
 });
-var PreviewSignChallengeValueSchema = Type$1.Object({
-	verificationMethod: Type$1.Literal("human-hardware-previewsign"),
+var PreviewSignChallengeValueSchema = Type.Object({
+	verificationMethod: Type.Literal("human-hardware-previewsign"),
 	value: schemaRef$1(PreviewSignChallengeSchema, "PreviewSignChallenge")
 }, {
 	$id: "PreviewSignChallengeValue",
 	additionalProperties: false
 });
-var PreviewSignChallengeOperationSchema = Type$1.Union([Type$1.Literal("credential-registration"), Type$1.Literal("signing-request")], { $id: "PreviewSignChallengeOperation" });
-var PreviewSignReceiptSchema = Type$1.Object({
-	version: Type$1.Literal(1),
+var PreviewSignChallengeOperationSchema = Type.Union([Type.Literal("credential-registration"), Type.Literal("signing-request")], { $id: "PreviewSignChallengeOperation" });
+var PreviewSignReceiptSchema = Type.Object({
+	version: Type.Literal(1),
 	signature: schemaRef$1(PreviewSignP256DerSignatureBase64UrlSchema, "PreviewSignP256DerSignatureBase64Url")
 }, {
 	$id: "PreviewSignReceipt",
 	additionalProperties: false
 });
-var PreviewSignReceiptValueSchema = Type$1.Object({
-	verificationMethod: Type$1.Literal("human-hardware-previewsign"),
+var PreviewSignReceiptValueSchema = Type.Object({
+	verificationMethod: Type.Literal("human-hardware-previewsign"),
 	value: schemaRef$1(PreviewSignReceiptSchema, "PreviewSignReceipt")
 }, {
 	$id: "PreviewSignReceiptValue",
@@ -1664,22 +1895,22 @@ var VERIFICATION_METHOD = {
 VERIFICATION_METHOD.AgentEd25519, VERIFICATION_METHOD.HumanHardwarePreviewSign;
 //#endregion
 //#region ../models/src/schemas.ts
-var UuidSchema = Type$1.String({
+var UuidSchema = Type.String({
 	format: "uuid",
 	description: "UUID v4 identifier"
 });
-var TimestampSchema = Type$1.String({
+var TimestampSchema = Type.String({
 	format: "date-time",
 	description: "ISO 8601 timestamp"
 });
-var verificationMethodLiterals = [Type$1.Literal(VERIFICATION_METHOD.AgentEd25519), Type$1.Literal(VERIFICATION_METHOD.HumanHardwarePreviewSign)];
-Type$1.Union(verificationMethodLiterals, { description: "Stable signing verification method identifier" });
+var verificationMethodLiterals = [Type.Literal(VERIFICATION_METHOD.AgentEd25519), Type.Literal(VERIFICATION_METHOD.HumanHardwarePreviewSign)];
+Type.Union(verificationMethodLiterals, { description: "Stable signing verification method identifier" });
 var visibilityLiterals = [
-	Type$1.Literal("private"),
-	Type$1.Literal("moltnet"),
-	Type$1.Literal("public")
+	Type.Literal("private"),
+	Type.Literal("moltnet"),
+	Type.Literal("public")
 ];
-Type$1.Union(visibilityLiterals, { description: "Entry visibility level" });
+Type.Union(visibilityLiterals, { description: "Entry visibility level" });
 var ENTRY_TYPE_VALUES = [
 	"episodic",
 	"semantic",
@@ -1687,362 +1918,384 @@ var ENTRY_TYPE_VALUES = [
 	"reflection"
 ];
 var entryTypeLiterals = [
-	Type$1.Literal("episodic"),
-	Type$1.Literal("semantic"),
-	Type$1.Literal("procedural"),
-	Type$1.Literal("reflection")
+	Type.Literal("episodic"),
+	Type.Literal("semantic"),
+	Type.Literal("procedural"),
+	Type.Literal("reflection")
 ];
-var EntryTypeSchema = Type$1.Union(entryTypeLiterals, { description: "Entry memory type" });
+var EntryTypeSchema = Type.Union(entryTypeLiterals, { description: "Entry memory type" });
 /** Regex fragment matching a single entry type value. */
 var ENTRY_TYPE_PATTERN = `(${ENTRY_TYPE_VALUES.join("|")})`;
 `${ENTRY_TYPE_PATTERN}${ENTRY_TYPE_PATTERN}`, ENTRY_TYPE_VALUES.length - 1;
-var PublicKeySchema = Type$1.String({
+var PublicKeySchema = Type.String({
 	pattern: "^ed25519:[A-Za-z0-9+/=]+$",
 	description: "Ed25519 public key with prefix"
 });
-var FingerprintSchema = Type$1.String({
+var FingerprintSchema = Type.String({
 	pattern: "^[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}$",
 	description: "Key fingerprint (A1B2-C3D4-E5F6-G7H8)"
 });
-Type$1.Object({
-	title: Type$1.Optional(Type$1.String({ maxLength: 255 })),
-	content: Type$1.String({
+Type.Object({
+	title: Type.Optional(Type.String({ maxLength: 255 })),
+	content: Type.String({
 		minLength: 1,
 		maxLength: 1e5
 	}),
-	tags: Type$1.Optional(Type$1.Array(Type$1.String({ maxLength: 128 }), { maxItems: 20 }))
+	tags: Type.Optional(Type.Array(Type.String({ maxLength: 128 }), { maxItems: 20 }))
 });
-Type$1.Object({
-	title: Type$1.Optional(Type$1.String({ maxLength: 255 })),
-	content: Type$1.Optional(Type$1.String({
+Type.Object({
+	title: Type.Optional(Type.String({ maxLength: 255 })),
+	content: Type.Optional(Type.String({
 		minLength: 1,
 		maxLength: 1e5
 	})),
-	tags: Type$1.Optional(Type$1.Array(Type$1.String({ maxLength: 128 }), { maxItems: 20 }))
+	tags: Type.Optional(Type.Array(Type.String({ maxLength: 128 }), { maxItems: 20 }))
 });
-Type$1.Object({
-	query: Type$1.Optional(Type$1.String({
+Type.Object({
+	query: Type.Optional(Type.String({
 		minLength: 1,
 		maxLength: 500
 	})),
-	tags: Type$1.Optional(Type$1.Array(Type$1.String({ maxLength: 128 }), {
+	tags: Type.Optional(Type.Array(Type.String({ maxLength: 128 }), {
 		minItems: 1,
 		maxItems: 20,
 		description: "Filter: entry must have ALL specified tags"
 	})),
-	limit: Type$1.Optional(Type$1.Number({
+	limit: Type.Optional(Type.Number({
 		minimum: 1,
 		maximum: 100,
 		default: 20
 	})),
-	offset: Type$1.Optional(Type$1.Number({
+	offset: Type.Optional(Type.Number({
 		minimum: 0,
 		default: 0
 	}))
 });
-Type$1.Object({
+Type.Object({
 	identityId: UuidSchema,
 	publicKey: PublicKeySchema,
 	fingerprint: FingerprintSchema,
 	createdAt: TimestampSchema
 });
-Type$1.Object({
+Type.Object({
 	publicKey: PublicKeySchema,
 	fingerprint: FingerprintSchema
 });
-Type$1.Object({ message: Type$1.String({
+Type.Object({ message: Type.String({
 	minLength: 1,
 	maxLength: 1e4
 }) });
-Type$1.Object({
-	message: Type$1.String(),
-	signature: Type$1.String({ description: "Base64 encoded Ed25519 signature" }),
+Type.Object({
+	message: Type.String(),
+	signature: Type.String({ description: "Base64 encoded Ed25519 signature" }),
 	publicKey: PublicKeySchema
 });
-Type$1.Object({
-	message: Type$1.String({
+Type.Object({
+	message: Type.String({
 		minLength: 1,
 		maxLength: 1e4
 	}),
-	signature: Type$1.String({ description: "Base64 encoded signature" }),
+	signature: Type.String({ description: "Base64 encoded signature" }),
 	publicKey: PublicKeySchema
 });
-Type$1.Object({
-	valid: Type$1.Boolean(),
-	signer: Type$1.Optional(Type$1.Object({ fingerprint: FingerprintSchema }))
+Type.Object({
+	valid: Type.Boolean(),
+	signer: Type.Optional(Type.Object({ fingerprint: FingerprintSchema }))
 });
-var BaseAuthContextSchema = Type$1.Object({
+var BaseAuthContextSchema = Type.Object({
 	identityId: UuidSchema,
-	scopes: Type$1.Array(Type$1.String()),
-	subjectType: Type$1.Union([Type$1.Literal("agent"), Type$1.Literal("human")]),
-	currentTeamId: Type$1.Union([UuidSchema, Type$1.Null()])
+	scopes: Type.Array(Type.String()),
+	subjectType: Type.Union([Type.Literal("agent"), Type.Literal("human")]),
+	currentTeamId: Type.Union([UuidSchema, Type.Null()])
 });
-var AgentAuthContextSchema = Type$1.Intersect([BaseAuthContextSchema, Type$1.Object({
-	subjectType: Type$1.Literal("agent"),
+var AgentAuthContextSchema = Type.Intersect([BaseAuthContextSchema, Type.Object({
+	subjectType: Type.Literal("agent"),
 	publicKey: PublicKeySchema,
 	fingerprint: FingerprintSchema,
-	clientId: Type$1.String()
+	clientId: Type.String()
 })]);
-var HumanAuthContextSchema = Type$1.Intersect([BaseAuthContextSchema, Type$1.Object({
-	subjectType: Type$1.Literal("human"),
-	clientId: Type$1.Union([Type$1.String(), Type$1.Null()])
+var HumanAuthContextSchema = Type.Intersect([BaseAuthContextSchema, Type.Object({
+	subjectType: Type.Literal("human"),
+	clientId: Type.Union([Type.String(), Type.Null()])
 })]);
-Type$1.Union([AgentAuthContextSchema, HumanAuthContextSchema]);
-Type$1.Object({
-	success: Type$1.Boolean(),
-	message: Type$1.Optional(Type$1.String())
+Type.Union([AgentAuthContextSchema, HumanAuthContextSchema]);
+Type.Object({
+	success: Type.Boolean(),
+	message: Type.Optional(Type.String())
 });
-Type$1.Object({ diaryId: UuidSchema });
-Type$1.Object({
+Type.Object({ diaryId: UuidSchema });
+Type.Object({
 	diaryId: UuidSchema,
 	entryId: UuidSchema
 });
-Type$1.Object({ entryId: UuidSchema });
-Type$1.Object({ id: UuidSchema });
-Type$1.Object({
+Type.Object({ entryId: UuidSchema });
+Type.Object({ id: UuidSchema });
+Type.Object({
 	publicKey: PublicKeySchema,
 	fingerprint: FingerprintSchema,
-	proof: Type$1.String({
+	proof: Type.String({
 		minLength: 1,
 		maxLength: 256
 	}),
-	credentialType: Type$1.Literal("oauth2"),
-	agentName: Type$1.String({
+	credentialType: Type.Literal("oauth2"),
+	agentName: Type.String({
 		minLength: 1,
 		maxLength: 34
 	}),
-	org: Type$1.Optional(Type$1.String({
+	org: Type.Optional(Type.String({
 		minLength: 1,
 		maxLength: 39,
 		pattern: "^[a-zA-Z0-9-]+$",
 		description: "GitHub organization name. When provided, the GitHub App will be created under this org instead of the personal account."
 	}))
 });
-Type$1.Object({
-	workflowId: Type$1.String(),
-	manifestFormUrl: Type$1.String()
+Type.Object({
+	workflowId: Type.String(),
+	manifestFormUrl: Type.String()
 });
-Type$1.Object({
-	status: Type$1.Union([
-		Type$1.Literal("awaiting_github"),
-		Type$1.Literal("github_code_ready"),
-		Type$1.Literal("awaiting_installation"),
-		Type$1.Literal("completed"),
-		Type$1.Literal("failed")
+Type.Object({
+	status: Type.Union([
+		Type.Literal("awaiting_github"),
+		Type.Literal("github_code_ready"),
+		Type.Literal("awaiting_installation"),
+		Type.Literal("completed"),
+		Type.Literal("failed")
 	]),
-	githubCode: Type$1.Optional(Type$1.String({ description: "GitHub manifest code sealed to the onboarding agent public key." })),
-	identityId: Type$1.Optional(Type$1.String()),
-	clientId: Type$1.Optional(Type$1.String()),
-	clientSecret: Type$1.Optional(Type$1.String({ description: "OAuth2 client secret sealed to the onboarding agent public key." })),
-	installationId: Type$1.Optional(Type$1.String())
+	githubCode: Type.Optional(Type.String({ description: "GitHub manifest code sealed to the onboarding agent public key." })),
+	identityId: Type.Optional(Type.String()),
+	clientId: Type.Optional(Type.String()),
+	clientSecret: Type.Optional(Type.String({ description: "OAuth2 client secret sealed to the onboarding agent public key." })),
+	installationId: Type.Optional(Type.String())
 });
-Type$1.Object({
-	wf: Type$1.String({
+Type.Object({
+	wf: Type.String({
 		minLength: 1,
 		description: "Workflow ID baked into setup_url"
 	}),
-	installation_id: Type$1.String({ minLength: 1 }),
-	setup_action: Type$1.Optional(Type$1.String())
+	installation_id: Type.String({ minLength: 1 }),
+	setup_action: Type.Optional(Type.String())
 });
-Type$1.Object({ id: UuidSchema });
-Type$1.Object({
+Type.Object({ id: UuidSchema });
+Type.Object({
 	id: UuidSchema,
 	subjectId: UuidSchema
 });
-Type$1.Object({
+Type.Object({
 	id: UuidSchema,
 	inviteId: UuidSchema
 });
-Type$1.Object({ name: Type$1.String({
+Type.Object({ name: Type.String({
 	minLength: 1,
 	maxLength: 255
 }) });
-Type$1.Object({
-	role: Type$1.Optional(Type$1.Union([Type$1.Literal("manager"), Type$1.Literal("member")])),
-	maxUses: Type$1.Optional(Type$1.Integer({
+Type.Object({
+	role: Type.Optional(Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	])),
+	maxUses: Type.Optional(Type.Integer({
 		minimum: 1,
 		default: 1
 	})),
-	expiresInHours: Type$1.Optional(Type$1.Integer({
+	expiresInHours: Type.Optional(Type.Integer({
 		minimum: 1,
 		maximum: 720,
 		default: 168
 	}))
 });
-Type$1.Object({ code: Type$1.String({ minLength: 1 }) });
-Type$1.Object({ role: Type$1.Union([Type$1.Literal("manager"), Type$1.Literal("member")]) });
-var TeamRoleSchema = Type$1.Union([
-	Type$1.Literal("owner"),
-	Type$1.Literal("manager"),
-	Type$1.Literal("member")
+Type.Object({ code: Type.String({ minLength: 1 }) });
+Type.Object({ role: Type.Union([
+	Type.Literal("manager"),
+	Type.Literal("executor"),
+	Type.Literal("member")
+]) });
+var TeamRoleSchema = Type.Union([
+	Type.Literal("owner"),
+	Type.Literal("manager"),
+	Type.Literal("executor"),
+	Type.Literal("member")
 ]);
-Type$1.Object({
+Type.Object({
 	id: UuidSchema,
-	name: Type$1.String()
+	name: Type.String()
 });
-var DateTimeUnsafe = Type$1.Unsafe(Type$1.String({ format: "date-time" }));
-Type$1.Object({
+var DateTimeUnsafe = Type.Unsafe(Type.String({ format: "date-time" }));
+Type.Object({
 	id: UuidSchema,
-	code: Type$1.String(),
-	role: Type$1.Union([Type$1.Literal("manager"), Type$1.Literal("member")]),
-	maxUses: Type$1.Integer(),
-	useCount: Type$1.Integer(),
+	code: Type.String(),
+	role: Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	]),
+	maxUses: Type.Integer(),
+	useCount: Type.Integer(),
 	expiresAt: DateTimeUnsafe,
 	createdAt: DateTimeUnsafe
 });
-var TeamMemberSchema = Type$1.Object({
+var TeamMemberSchema = Type.Object({
 	subjectId: UuidSchema,
-	subjectType: Type$1.Union([Type$1.Literal("agent"), Type$1.Literal("human")]),
+	subjectType: Type.Union([Type.Literal("agent"), Type.Literal("human")]),
 	role: TeamRoleSchema,
-	displayName: Type$1.String(),
-	fingerprint: Type$1.Optional(Type$1.String()),
-	email: Type$1.Optional(Type$1.String())
+	displayName: Type.String(),
+	fingerprint: Type.Optional(Type.String()),
+	email: Type.Optional(Type.String())
 });
-Type$1.Object({
+Type.Object({
 	id: UuidSchema,
-	name: Type$1.String(),
-	personal: Type$1.Boolean(),
-	status: Type$1.String(),
+	name: Type.String(),
+	personal: Type.Boolean(),
+	status: Type.String(),
 	role: TeamRoleSchema
 });
-Type$1.Object({
+Type.Object({
 	id: UuidSchema,
-	name: Type$1.String(),
-	status: Type$1.String(),
-	personal: Type$1.Boolean(),
+	name: Type.String(),
+	status: Type.String(),
+	personal: Type.Boolean(),
 	createdAt: DateTimeUnsafe,
 	updatedAt: DateTimeUnsafe,
-	members: Type$1.Array(TeamMemberSchema)
+	members: Type.Array(TeamMemberSchema)
 });
-Type$1.Object({
+Type.Object({
 	teamId: UuidSchema,
-	role: Type$1.Union([Type$1.Literal("manager"), Type$1.Literal("member")])
+	role: Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	])
 });
-Type$1.Object({
-	updated: Type$1.Boolean(),
-	role: Type$1.Union([Type$1.Literal("manager"), Type$1.Literal("member")])
+Type.Object({
+	updated: Type.Boolean(),
+	role: Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	])
 });
-Type$1.Object({ deleted: Type$1.Boolean() });
-Type$1.Object({ removed: Type$1.Boolean() });
-var FoundingMemberSchema = Type$1.Object({
+Type.Object({ deleted: Type.Boolean() });
+Type.Object({ removed: Type.Boolean() });
+var FoundingMemberSchema = Type.Object({
 	subjectId: UuidSchema,
-	subjectNs: Type$1.Union([Type$1.Literal("Agent"), Type$1.Literal("Human")]),
-	role: Type$1.Union([
-		Type$1.Literal("owner"),
-		Type$1.Literal("manager"),
-		Type$1.Literal("member")
+	subjectNs: Type.Union([Type.Literal("Agent"), Type.Literal("Human")]),
+	role: Type.Union([
+		Type.Literal("owner"),
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
 	])
 });
-Type$1.Object({
-	name: Type$1.String({
+Type.Object({
+	name: Type.String({
 		minLength: 1,
 		maxLength: 255
 	}),
-	foundingMembers: Type$1.Optional(Type$1.Array(FoundingMemberSchema, { minItems: 1 }))
+	foundingMembers: Type.Optional(Type.Array(FoundingMemberSchema, { minItems: 1 }))
 });
-Type$1.Object({
+Type.Object({
 	id: UuidSchema,
-	name: Type$1.String(),
-	status: Type$1.String(),
-	workflowId: Type$1.Optional(Type$1.String())
+	name: Type.String(),
+	status: Type.String(),
+	workflowId: Type.Optional(Type.String())
 });
-Type$1.Object({});
-Type$1.Object({
-	accepted: Type$1.Boolean(),
-	teamStatus: Type$1.String()
+Type.Object({});
+Type.Object({
+	accepted: Type.Boolean(),
+	teamStatus: Type.String()
 });
-Type$1.Object({ destinationTeamId: UuidSchema });
-Type$1.Object({ transferId: UuidSchema });
-var TransferResponseSchema = Type$1.Object({
+Type.Object({ destinationTeamId: UuidSchema });
+Type.Object({ transferId: UuidSchema });
+var TransferResponseSchema = Type.Object({
 	id: UuidSchema,
 	diaryId: UuidSchema,
 	sourceTeamId: UuidSchema,
 	destinationTeamId: UuidSchema,
-	status: Type$1.String(),
+	status: Type.String(),
 	initiatedBy: UuidSchema,
-	expiresAt: Type$1.Unsafe(Type$1.String({ format: "date-time" })),
-	createdAt: Type$1.Unsafe(Type$1.String({ format: "date-time" }))
+	expiresAt: Type.Unsafe(Type.String({ format: "date-time" })),
+	createdAt: Type.Unsafe(Type.String({ format: "date-time" }))
 });
-Type$1.Object({ items: Type$1.Array(TransferResponseSchema) });
-Type$1.Object({ groupId: UuidSchema });
-Type$1.Object({
+Type.Object({ items: Type.Array(TransferResponseSchema) });
+Type.Object({ groupId: UuidSchema });
+Type.Object({
 	groupId: UuidSchema,
 	subjectId: UuidSchema
 });
-Type$1.Object({ name: Type$1.String({
+Type.Object({ name: Type.String({
 	minLength: 1,
 	maxLength: 255
 }) });
-Type$1.Object({
+Type.Object({
 	subjectId: UuidSchema,
-	subjectNs: Type$1.Optional(Type$1.Union([Type$1.Literal("Agent"), Type$1.Literal("Human")]))
+	subjectNs: Type.Optional(Type.Union([Type.Literal("Agent"), Type.Literal("Human")]))
 });
-Type$1.Object({
+Type.Object({
 	id: UuidSchema,
-	name: Type$1.String(),
+	name: Type.String(),
 	teamId: UuidSchema
 });
-var GroupMemberResponseSchema = Type$1.Object({
+var GroupMemberResponseSchema = Type.Object({
 	subjectId: UuidSchema,
-	subjectNs: Type$1.String()
+	subjectNs: Type.String()
 });
-Type$1.Object({
+Type.Object({
 	id: UuidSchema,
-	name: Type$1.String(),
+	name: Type.String(),
 	teamId: UuidSchema,
 	createdAt: DateTimeUnsafe,
-	members: Type$1.Array(GroupMemberResponseSchema)
+	members: Type.Array(GroupMemberResponseSchema)
 });
-var DiaryGrantRoleSchema = Type$1.Union([Type$1.Literal("writer"), Type$1.Literal("manager")]);
-var GrantSubjectNsSchema = Type$1.Union([
-	Type$1.Literal("Agent"),
-	Type$1.Literal("Human"),
-	Type$1.Literal("Group")
+var DiaryGrantRoleSchema = Type.Union([Type.Literal("writer"), Type.Literal("manager")]);
+var GrantSubjectNsSchema = Type.Union([
+	Type.Literal("Agent"),
+	Type.Literal("Human"),
+	Type.Literal("Group")
 ]);
-Type$1.Object({
+Type.Object({
 	subjectId: UuidSchema,
 	subjectNs: GrantSubjectNsSchema,
 	role: DiaryGrantRoleSchema
 });
-Type$1.Object({
+Type.Object({
 	subjectId: UuidSchema,
 	subjectNs: GrantSubjectNsSchema,
 	role: DiaryGrantRoleSchema
 });
-var DiaryGrantResponseSchema = Type$1.Object({
+var DiaryGrantResponseSchema = Type.Object({
 	subjectId: UuidSchema,
 	subjectNs: GrantSubjectNsSchema,
 	role: DiaryGrantRoleSchema
 });
-Type$1.Object({ grants: Type$1.Array(DiaryGrantResponseSchema) });
-Type$1.Object({ revoked: Type$1.Boolean() });
-var TaskGrantRoleSchema = Type$1.Union([Type$1.Literal("writer"), Type$1.Literal("manager")]);
-Type$1.Object({
+Type.Object({ grants: Type.Array(DiaryGrantResponseSchema) });
+Type.Object({ revoked: Type.Boolean() });
+var TaskGrantRoleSchema = Type.Union([Type.Literal("writer"), Type.Literal("manager")]);
+Type.Object({
 	subjectId: UuidSchema,
 	subjectNs: GrantSubjectNsSchema,
 	role: TaskGrantRoleSchema
 });
-Type$1.Object({
+Type.Object({
 	subjectId: UuidSchema,
 	subjectNs: GrantSubjectNsSchema,
 	role: TaskGrantRoleSchema
 });
-var TaskGrantResponseSchema = Type$1.Object({
+var TaskGrantResponseSchema = Type.Object({
 	subjectId: UuidSchema,
 	subjectNs: GrantSubjectNsSchema,
 	role: TaskGrantRoleSchema
 });
-Type$1.Object({ grants: Type$1.Array(TaskGrantResponseSchema) });
-Type$1.Object({ "x-moltnet-team-id": Type$1.String({
+Type.Object({ grants: Type.Array(TaskGrantResponseSchema) });
+Type.Object({ "x-moltnet-team-id": Type.String({
 	format: "uuid",
 	description: "Team ID (UUID) that will own the resource. Required."
 }) });
-Type$1.Object({ "x-moltnet-team-id": Type$1.Optional(Type$1.String({
+Type.Object({ "x-moltnet-team-id": Type.Optional(Type.String({
 	format: "uuid",
 	description: "Team ID (UUID) for scoping the request. Optional."
 })) });
-Type$1.Object({
-	kind: Type$1.Literal("agent"),
+Type.Object({
+	kind: Type.Literal("agent"),
 	identityId: UuidSchema,
 	fingerprint: FingerprintSchema,
 	publicKey: PublicKeySchema
@@ -2050,25 +2303,25 @@ Type$1.Object({
 	$id: "AgentPrincipal",
 	additionalProperties: false
 });
-Type$1.Object({
-	kind: Type$1.Literal("human"),
+Type.Object({
+	kind: Type.Literal("human"),
 	humanId: UuidSchema,
-	identityId: Type$1.Union([UuidSchema, Type$1.Null()])
+	identityId: Type.Union([UuidSchema, Type.Null()])
 }, {
 	$id: "HumanPrincipal",
 	additionalProperties: false
 });
-var principalUnionVariants = [Type$1.Object({
-	kind: Type$1.Literal("agent"),
+var principalUnionVariants = [Type.Object({
+	kind: Type.Literal("agent"),
 	identityId: UuidSchema,
 	fingerprint: FingerprintSchema,
 	publicKey: PublicKeySchema
-}, { additionalProperties: false }), Type$1.Object({
-	kind: Type$1.Literal("human"),
+}, { additionalProperties: false }), Type.Object({
+	kind: Type.Literal("human"),
 	humanId: UuidSchema,
-	identityId: Type$1.Union([UuidSchema, Type$1.Null()])
+	identityId: Type.Union([UuidSchema, Type.Null()])
 }, { additionalProperties: false })];
-Type$1.Union(principalUnionVariants, {
+Type.Union(principalUnionVariants, {
 	$id: "PrincipalIdentity",
 	discriminator: { propertyName: "kind" }
 });
@@ -2085,50 +2338,50 @@ Type$1.Union(principalUnionVariants, {
 * Structurally identical to `PrincipalIdentitySchema` (they share the
 * variants array); change one, change both.
 */
-var PrincipalIdentitySchemaInline = Type$1.Union(principalUnionVariants, { discriminator: { propertyName: "kind" } });
+var PrincipalIdentitySchemaInline = Type.Union(principalUnionVariants, { discriminator: { propertyName: "kind" } });
 //#endregion
 //#region ../models/src/problem-details.ts
-var ProblemCodeSchema = Type$1.Union([
-	Type$1.Literal("UNAUTHORIZED"),
-	Type$1.Literal("FORBIDDEN"),
-	Type$1.Literal("NOT_FOUND"),
-	Type$1.Literal("CONFLICT"),
-	Type$1.Literal("UNSUPPORTED_MEDIA_TYPE"),
-	Type$1.Literal("VALIDATION_FAILED"),
-	Type$1.Literal("INVALID_CHALLENGE"),
-	Type$1.Literal("INVALID_SIGNATURE"),
-	Type$1.Literal("RATE_LIMIT_EXCEEDED"),
-	Type$1.Literal("SERIALIZATION_EXHAUSTED"),
-	Type$1.Literal("SIGNING_REQUEST_EXPIRED"),
-	Type$1.Literal("SIGNING_REQUEST_ALREADY_COMPLETED"),
-	Type$1.Literal("SIGNING_REQUEST_LIMIT_REACHED"),
-	Type$1.Literal("REGISTRATION_FAILED"),
-	Type$1.Literal("UPSTREAM_ERROR"),
-	Type$1.Literal("SERVICE_UNAVAILABLE"),
-	Type$1.Literal("INTERNAL_SERVER_ERROR"),
-	Type$1.Literal("TEAM_PERSONAL_IMMUTABLE"),
-	Type$1.Literal("TEAM_NOT_ACTIVE"),
-	Type$1.Literal("INVITE_EXPIRED"),
-	Type$1.Literal("INVITE_EXHAUSTED"),
-	Type$1.Literal("TEAM_LAST_OWNER"),
-	Type$1.Literal("TEAM_ALREADY_ACTIVE"),
-	Type$1.Literal("TEAM_NOT_FOUNDING"),
-	Type$1.Literal("FOUNDING_ALREADY_ACCEPTED"),
-	Type$1.Literal("DIARY_TRANSFER_PENDING"),
-	Type$1.Literal("DIARY_TRANSFER_NOT_FOUND"),
-	Type$1.Literal("DIARY_TRANSFER_ALREADY_RESOLVED")
+var ProblemCodeSchema = Type.Union([
+	Type.Literal("UNAUTHORIZED"),
+	Type.Literal("FORBIDDEN"),
+	Type.Literal("NOT_FOUND"),
+	Type.Literal("CONFLICT"),
+	Type.Literal("UNSUPPORTED_MEDIA_TYPE"),
+	Type.Literal("VALIDATION_FAILED"),
+	Type.Literal("INVALID_CHALLENGE"),
+	Type.Literal("INVALID_SIGNATURE"),
+	Type.Literal("RATE_LIMIT_EXCEEDED"),
+	Type.Literal("SERIALIZATION_EXHAUSTED"),
+	Type.Literal("SIGNING_REQUEST_EXPIRED"),
+	Type.Literal("SIGNING_REQUEST_ALREADY_COMPLETED"),
+	Type.Literal("SIGNING_REQUEST_LIMIT_REACHED"),
+	Type.Literal("REGISTRATION_FAILED"),
+	Type.Literal("UPSTREAM_ERROR"),
+	Type.Literal("SERVICE_UNAVAILABLE"),
+	Type.Literal("INTERNAL_SERVER_ERROR"),
+	Type.Literal("TEAM_PERSONAL_IMMUTABLE"),
+	Type.Literal("TEAM_NOT_ACTIVE"),
+	Type.Literal("INVITE_EXPIRED"),
+	Type.Literal("INVITE_EXHAUSTED"),
+	Type.Literal("TEAM_LAST_OWNER"),
+	Type.Literal("TEAM_ALREADY_ACTIVE"),
+	Type.Literal("TEAM_NOT_FOUNDING"),
+	Type.Literal("FOUNDING_ALREADY_ACCEPTED"),
+	Type.Literal("DIARY_TRANSFER_PENDING"),
+	Type.Literal("DIARY_TRANSFER_NOT_FOUND"),
+	Type.Literal("DIARY_TRANSFER_ALREADY_RESOLVED")
 ]);
-var ProblemDetailsSchema = Type$1.Object({
-	type: Type$1.String({ format: "uri" }),
-	title: Type$1.String(),
-	status: Type$1.Integer({
+var ProblemDetailsSchema = Type.Object({
+	type: Type.String({ format: "uri" }),
+	title: Type.String(),
+	status: Type.Integer({
 		minimum: 100,
 		maximum: 599
 	}),
 	code: ProblemCodeSchema,
-	detail: Type$1.Optional(Type$1.String()),
-	instance: Type$1.Optional(Type$1.String()),
-	retryAfter: Type$1.Optional(Type$1.Integer({
+	detail: Type.Optional(Type.String()),
+	instance: Type.Optional(Type.String()),
+	retryAfter: Type.Optional(Type.Integer({
 		minimum: 0,
 		description: "Non-negative delay in seconds before retrying, matching the Retry-After response header when present."
 	}))
@@ -2136,63 +2389,63 @@ var ProblemDetailsSchema = Type$1.Object({
 	$id: "ProblemDetails",
 	additionalProperties: true
 });
-Type$1.Object({
-	field: Type$1.String(),
-	message: Type$1.String(),
-	code: Type$1.Optional(Type$1.String())
+Type.Object({
+	field: Type.String(),
+	message: Type.String(),
+	code: Type.Optional(Type.String())
 }, {
 	$id: "ValidationError",
 	additionalProperties: false
 });
-Type$1.Object({
-	resource: Type$1.String(),
-	id: Type$1.Optional(Type$1.String({ format: "uuid" })),
-	keys: Type$1.Optional(Type$1.Record(Type$1.String(), Type$1.String()))
+Type.Object({
+	resource: Type.String(),
+	id: Type.Optional(Type.String({ format: "uuid" })),
+	keys: Type.Optional(Type.Record(Type.String(), Type.String()))
 }, {
 	$id: "ConflictTarget",
 	additionalProperties: false
 });
-Type$1.Object({
-	constraint: Type$1.Optional(Type$1.String()),
-	target: Type$1.Optional(Type$1.Ref("ConflictTarget"))
+Type.Object({
+	constraint: Type.Optional(Type.String()),
+	target: Type.Optional(Type.Ref("ConflictTarget"))
 }, {
 	$id: "ConflictError",
 	additionalProperties: false
 });
-var ConflictProblemDetailsSchema = Type$1.Intersect([ProblemDetailsSchema, Type$1.Object({ conflict: Type$1.Ref("ConflictError") })], { $id: "ConflictProblemDetails" });
-Type$1.Object({
-	type: Type$1.String(),
-	severity: Type$1.Number(),
-	match: Type$1.String()
+var ConflictProblemDetailsSchema = Type.Intersect([ProblemDetailsSchema, Type.Object({ conflict: Type.Ref("ConflictError") })], { $id: "ConflictProblemDetails" });
+Type.Object({
+	type: Type.String(),
+	severity: Type.Number(),
+	match: Type.String()
 }, {
 	$id: "InjectionThreat",
 	additionalProperties: false
 });
-Type$1.Intersect([ConflictProblemDetailsSchema, Type$1.Object({ flagged: Type$1.Optional(Type$1.Array(Type$1.Object({
-	id: Type$1.String({ format: "uuid" }),
-	threats: Type$1.Array(Type$1.Ref("InjectionThreat"))
+Type.Intersect([ConflictProblemDetailsSchema, Type.Object({ flagged: Type.Optional(Type.Array(Type.Object({
+	id: Type.String({ format: "uuid" }),
+	threats: Type.Array(Type.Ref("InjectionThreat"))
 }, { additionalProperties: false }))) })], { $id: "InjectionConflictProblemDetails" });
-Type$1.Intersect([ProblemDetailsSchema, Type$1.Object({ errors: Type$1.Array(Type$1.Ref("ValidationError")) })], { $id: "ValidationProblemDetails" });
-Type$1.Union([
-	Type$1.Literal("pack"),
-	Type$1.Literal("entry"),
-	Type$1.Literal("rendered_pack")
+Type.Intersect([ProblemDetailsSchema, Type.Object({ errors: Type.Array(Type.Ref("ValidationError")) })], { $id: "ValidationProblemDetails" });
+Type.Union([
+	Type.Literal("pack"),
+	Type.Literal("entry"),
+	Type.Literal("rendered_pack")
 ]);
-var ProvenanceGraphEdgeKindSchema = Type$1.Union([
-	Type$1.Literal("includes"),
-	Type$1.Literal("supersedes"),
-	Type$1.Literal("rendered_from")
+var ProvenanceGraphEdgeKindSchema = Type.Union([
+	Type.Literal("includes"),
+	Type.Literal("supersedes"),
+	Type.Literal("rendered_from")
 ]);
-var ProvenanceGraphPackMetaSchema = Type$1.Object({
+var ProvenanceGraphPackMetaSchema = Type.Object({
 	packId: UuidSchema,
 	diaryId: UuidSchema,
-	packCid: Type$1.String(),
-	packType: Type$1.String(),
-	packCodec: Type$1.String(),
-	pinned: Type$1.Boolean(),
+	packCid: Type.String(),
+	packType: Type.String(),
+	packCodec: Type.String(),
+	pinned: Type.Boolean(),
 	createdAt: TimestampSchema,
-	expiresAt: Type$1.Union([TimestampSchema, Type$1.Null()]),
-	supersedesPackId: Type$1.Union([UuidSchema, Type$1.Null()])
+	expiresAt: Type.Union([TimestampSchema, Type.Null()]),
+	supersedesPackId: Type.Union([UuidSchema, Type.Null()])
 });
 /**
 * Discriminated creator embedded inside provenance-node response
@@ -2202,80 +2455,80 @@ var ProvenanceGraphPackMetaSchema = Type$1.Object({
 * (`reference "PrincipalIdentity" resolves to more than one schema`).
 */
 var ProvenanceGraphCreatorSchema = PrincipalIdentitySchemaInline;
-var ProvenanceGraphEntryMetaSchema = Type$1.Object({
+var ProvenanceGraphEntryMetaSchema = Type.Object({
 	entryId: UuidSchema,
 	diaryId: UuidSchema,
 	entryType: EntryTypeSchema,
-	contentHash: Type$1.Union([Type$1.String(), Type$1.Null()]),
+	contentHash: Type.Union([Type.String(), Type.Null()]),
 	createdAt: TimestampSchema,
 	updatedAt: TimestampSchema,
-	signed: Type$1.Boolean(),
-	title: Type$1.Union([Type$1.String(), Type$1.Null()]),
-	tags: Type$1.Array(Type$1.String()),
-	creator: Type$1.Optional(ProvenanceGraphCreatorSchema)
+	signed: Type.Boolean(),
+	title: Type.Union([Type.String(), Type.Null()]),
+	tags: Type.Array(Type.String()),
+	creator: Type.Optional(ProvenanceGraphCreatorSchema)
 });
-var ProvenanceGraphPackNodeSchema = Type$1.Object({
-	id: Type$1.String(),
-	kind: Type$1.Literal("pack"),
-	label: Type$1.String(),
-	cid: Type$1.Union([Type$1.String(), Type$1.Null()]),
-	meta: Type$1.Intersect([ProvenanceGraphPackMetaSchema, Type$1.Object({ creator: Type$1.Optional(ProvenanceGraphCreatorSchema) })])
+var ProvenanceGraphPackNodeSchema = Type.Object({
+	id: Type.String(),
+	kind: Type.Literal("pack"),
+	label: Type.String(),
+	cid: Type.Union([Type.String(), Type.Null()]),
+	meta: Type.Intersect([ProvenanceGraphPackMetaSchema, Type.Object({ creator: Type.Optional(ProvenanceGraphCreatorSchema) })])
 });
-var ProvenanceGraphEntryNodeSchema = Type$1.Object({
-	id: Type$1.String(),
-	kind: Type$1.Literal("entry"),
-	label: Type$1.String(),
-	cid: Type$1.Union([Type$1.String(), Type$1.Null()]),
+var ProvenanceGraphEntryNodeSchema = Type.Object({
+	id: Type.String(),
+	kind: Type.Literal("entry"),
+	label: Type.String(),
+	cid: Type.Union([Type.String(), Type.Null()]),
 	meta: ProvenanceGraphEntryMetaSchema
 });
-var ProvenanceGraphRenderedPackMetaSchema = Type$1.Object({
+var ProvenanceGraphRenderedPackMetaSchema = Type.Object({
 	renderedPackId: UuidSchema,
 	sourcePackId: UuidSchema,
 	diaryId: UuidSchema,
-	packCid: Type$1.String(),
-	renderMethod: Type$1.String(),
-	totalTokens: Type$1.Number(),
-	pinned: Type$1.Boolean(),
+	packCid: Type.String(),
+	renderMethod: Type.String(),
+	totalTokens: Type.Number(),
+	pinned: Type.Boolean(),
 	createdAt: TimestampSchema,
-	expiresAt: Type$1.Union([TimestampSchema, Type$1.Null()]),
-	creator: Type$1.Optional(ProvenanceGraphCreatorSchema)
+	expiresAt: Type.Union([TimestampSchema, Type.Null()]),
+	creator: Type.Optional(ProvenanceGraphCreatorSchema)
 });
-var ProvenanceGraphRenderedPackNodeSchema = Type$1.Object({
-	id: Type$1.String(),
-	kind: Type$1.Literal("rendered_pack"),
-	label: Type$1.String(),
-	cid: Type$1.Union([Type$1.String(), Type$1.Null()]),
+var ProvenanceGraphRenderedPackNodeSchema = Type.Object({
+	id: Type.String(),
+	kind: Type.Literal("rendered_pack"),
+	label: Type.String(),
+	cid: Type.Union([Type.String(), Type.Null()]),
 	meta: ProvenanceGraphRenderedPackMetaSchema
 });
-var ProvenanceGraphNodeSchema = Type$1.Union([
+var ProvenanceGraphNodeSchema = Type.Union([
 	ProvenanceGraphPackNodeSchema,
 	ProvenanceGraphEntryNodeSchema,
 	ProvenanceGraphRenderedPackNodeSchema
 ]);
-var ProvenanceGraphEdgeSchema = Type$1.Object({
-	id: Type$1.String(),
-	from: Type$1.String(),
-	to: Type$1.String(),
+var ProvenanceGraphEdgeSchema = Type.Object({
+	id: Type.String(),
+	from: Type.String(),
+	to: Type.String(),
 	kind: ProvenanceGraphEdgeKindSchema,
-	label: Type$1.Optional(Type$1.String()),
-	meta: Type$1.Optional(Type$1.Record(Type$1.String(), Type$1.Union([
-		Type$1.String(),
-		Type$1.Number(),
-		Type$1.Boolean(),
-		Type$1.Null()
+	label: Type.Optional(Type.String()),
+	meta: Type.Optional(Type.Record(Type.String(), Type.Union([
+		Type.String(),
+		Type.Number(),
+		Type.Boolean(),
+		Type.Null()
 	])))
 });
-var ProvenanceGraphMetadataSchema = Type$1.Object({
-	format: Type$1.Literal("moltnet.provenance-graph/v1"),
+var ProvenanceGraphMetadataSchema = Type.Object({
+	format: Type.Literal("moltnet.provenance-graph/v1"),
 	generatedAt: TimestampSchema,
-	rootNodeId: Type$1.String(),
+	rootNodeId: Type.String(),
 	rootPackId: UuidSchema,
-	depth: Type$1.Number({ minimum: 0 })
+	depth: Type.Number({ minimum: 0 })
 });
-Type$1.Object({
+Type.Object({
 	metadata: ProvenanceGraphMetadataSchema,
-	nodes: Type$1.Array(ProvenanceGraphNodeSchema),
-	edges: Type$1.Array(ProvenanceGraphEdgeSchema)
+	nodes: Type.Array(ProvenanceGraphNodeSchema),
+	edges: Type.Array(ProvenanceGraphEdgeSchema)
 }, { $id: "ProvenanceGraph" });
 //#endregion
 //#region ../models/src/signer-constraint.ts
@@ -2284,25 +2537,25 @@ var SIGNER_CONSTRAINT_TYPE = {
 	TeamRole: "team-role",
 	Group: "group"
 };
-Type$1.Union([
-	Type$1.Object({
-		type: Type$1.Literal(SIGNER_CONSTRAINT_TYPE.Human),
-		id: Type$1.String({ format: "uuid" })
+Type.Union([
+	Type.Object({
+		type: Type.Literal(SIGNER_CONSTRAINT_TYPE.Human),
+		id: Type.String({ format: "uuid" })
 	}),
-	Type$1.Object({
-		type: Type$1.Literal(SIGNER_CONSTRAINT_TYPE.TeamRole),
+	Type.Object({
+		type: Type.Literal(SIGNER_CONSTRAINT_TYPE.TeamRole),
 		id: TeamRoleSchema
 	}),
-	Type$1.Object({
-		type: Type$1.Literal(SIGNER_CONSTRAINT_TYPE.Group),
-		id: Type$1.String({ format: "uuid" })
+	Type.Object({
+		type: Type.Literal(SIGNER_CONSTRAINT_TYPE.Group),
+		id: Type.String({ format: "uuid" })
 	})
 ]);
 //#endregion
 //#region ../models/src/signer-protocol.ts
 function schemaRef(schema) {
 	const id = schemaId(schema);
-	return Type$1.Ref(id);
+	return Type.Ref(id);
 }
 function schemaId(schema) {
 	const id = schema.$id;
@@ -2310,111 +2563,111 @@ function schemaId(schema) {
 	return id;
 }
 var SignerBase64UrlSchema = PreviewSignBase64UrlSchema;
-var SignerUuidSchema = Type$1.String({
+var SignerUuidSchema = Type.String({
 	$id: "SignerUuid",
 	pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
 });
-var SignerOperationSchema = Type$1.Union([
-	Type$1.Literal("credential-enrollment"),
-	Type$1.Literal("credential-registration"),
-	Type$1.Literal("signing-request")
+var SignerOperationSchema = Type.Union([
+	Type.Literal("credential-enrollment"),
+	Type.Literal("credential-registration"),
+	Type.Literal("signing-request")
 ], { $id: "SignerOperation" });
 var SignerChallengeOperationSchema = PreviewSignChallengeOperationSchema;
 var SignerPreviewSignPublicMaterialSchema = PreviewSignPublicMaterialSchema;
 var SignerPreviewSignChallengeValueSchema = PreviewSignChallengeValueSchema;
-var SignerProblemSchema = Type$1.Object({
-	code: Type$1.String({ minLength: 1 }),
-	message: Type$1.String({ minLength: 1 })
+var SignerProblemSchema = Type.Object({
+	code: Type.String({ minLength: 1 }),
+	message: Type.String({ minLength: 1 })
 }, {
 	$id: "SignerProblem",
 	additionalProperties: false
 });
-var SignerCeremonyParamsSchema = Type$1.Object({ ceremonyId: Type$1.Unsafe(schemaRef(SignerBase64UrlSchema)) }, {
+var SignerCeremonyParamsSchema = Type.Object({ ceremonyId: Type.Unsafe(schemaRef(SignerBase64UrlSchema)) }, {
 	$id: "SignerCeremonyParams",
 	additionalProperties: false
 });
-var SignerSessionSchema = Type$1.Object({
-	version: Type$1.Literal(1),
-	token: Type$1.Unsafe(schemaRef(SignerBase64UrlSchema)),
-	expiresAt: Type$1.String()
+var SignerSessionSchema = Type.Object({
+	version: Type.Literal(1),
+	token: Type.Unsafe(schemaRef(SignerBase64UrlSchema)),
+	expiresAt: Type.String()
 }, {
 	$id: "SignerSession",
 	additionalProperties: false
 });
-var SignerEnrollmentCeremonyRequestSchema = Type$1.Object({
-	version: Type$1.Literal(1),
-	operation: Type$1.Literal("credential-enrollment"),
-	label: Type$1.String({
+var SignerEnrollmentCeremonyRequestSchema = Type.Object({
+	version: Type.Literal(1),
+	operation: Type.Literal("credential-enrollment"),
+	label: Type.String({
 		minLength: 1,
 		maxLength: 255
 	}),
-	teamId: Type$1.Unsafe(schemaRef(SignerUuidSchema))
+	teamId: Type.Unsafe(schemaRef(SignerUuidSchema))
 }, {
 	$id: "SignerEnrollmentCeremonyRequest",
 	additionalProperties: false
 });
-var SignerChallengeCeremonyRequestSchema = Type$1.Object({
-	version: Type$1.Literal(1),
-	operation: Type$1.Unsafe(schemaRef(SignerChallengeOperationSchema)),
-	resourceId: Type$1.Unsafe(schemaRef(SignerUuidSchema)),
-	challenge: Type$1.Unsafe(schemaRef(SignerPreviewSignChallengeValueSchema))
+var SignerChallengeCeremonyRequestSchema = Type.Object({
+	version: Type.Literal(1),
+	operation: Type.Unsafe(schemaRef(SignerChallengeOperationSchema)),
+	resourceId: Type.Unsafe(schemaRef(SignerUuidSchema)),
+	challenge: Type.Unsafe(schemaRef(SignerPreviewSignChallengeValueSchema))
 }, {
 	$id: "SignerChallengeCeremonyRequest",
 	additionalProperties: false
 });
-var SignerCeremonyRequestSchema = Type$1.Union([Type$1.Unsafe(schemaRef(SignerEnrollmentCeremonyRequestSchema)), Type$1.Unsafe(schemaRef(SignerChallengeCeremonyRequestSchema))], { $id: "SignerCeremonyRequest" });
-var SignerCeremonySchema = Type$1.Object({
-	version: Type$1.Literal(1),
-	id: Type$1.Unsafe(schemaRef(SignerBase64UrlSchema)),
-	operation: Type$1.Unsafe(schemaRef(SignerOperationSchema)),
-	approvalUrl: Type$1.String(),
-	expiresAt: Type$1.String()
+var SignerCeremonyRequestSchema = Type.Union([Type.Unsafe(schemaRef(SignerEnrollmentCeremonyRequestSchema)), Type.Unsafe(schemaRef(SignerChallengeCeremonyRequestSchema))], { $id: "SignerCeremonyRequest" });
+var SignerCeremonySchema = Type.Object({
+	version: Type.Literal(1),
+	id: Type.Unsafe(schemaRef(SignerBase64UrlSchema)),
+	operation: Type.Unsafe(schemaRef(SignerOperationSchema)),
+	approvalUrl: Type.String(),
+	expiresAt: Type.String()
 }, {
 	$id: "SignerCeremony",
 	additionalProperties: false
 });
-var SignerPendingResultSchema = Type$1.Object({
-	version: Type$1.Literal(1),
-	status: Type$1.Literal("pending"),
-	operation: Type$1.Unsafe(schemaRef(SignerOperationSchema))
+var SignerPendingResultSchema = Type.Object({
+	version: Type.Literal(1),
+	status: Type.Literal("pending"),
+	operation: Type.Unsafe(schemaRef(SignerOperationSchema))
 }, {
 	$id: "SignerPendingResult",
 	additionalProperties: false
 });
-var SignerEnrollmentResultSchema = Type$1.Object({
-	version: Type$1.Literal(1),
-	status: Type$1.Literal("completed"),
-	operation: Type$1.Literal("credential-enrollment"),
-	publicMaterial: Type$1.Unsafe(schemaRef(SignerPreviewSignPublicMaterialSchema))
+var SignerEnrollmentResultSchema = Type.Object({
+	version: Type.Literal(1),
+	status: Type.Literal("completed"),
+	operation: Type.Literal("credential-enrollment"),
+	publicMaterial: Type.Unsafe(schemaRef(SignerPreviewSignPublicMaterialSchema))
 }, {
 	$id: "SignerEnrollmentResult",
 	additionalProperties: false
 });
 var SignerReceiptSchema = PreviewSignReceiptValueSchema;
-var SignerSignatureResultSchema = Type$1.Object({
-	version: Type$1.Literal(1),
-	status: Type$1.Literal("completed"),
-	operation: Type$1.Unsafe(schemaRef(SignerChallengeOperationSchema)),
-	receipt: Type$1.Unsafe(schemaRef(SignerReceiptSchema))
+var SignerSignatureResultSchema = Type.Object({
+	version: Type.Literal(1),
+	status: Type.Literal("completed"),
+	operation: Type.Unsafe(schemaRef(SignerChallengeOperationSchema)),
+	receipt: Type.Unsafe(schemaRef(SignerReceiptSchema))
 }, {
 	$id: "SignerSignatureResult",
 	additionalProperties: false
 });
-var SignerFailedResultSchema = Type$1.Object({
-	version: Type$1.Literal(1),
-	status: Type$1.Literal("failed"),
-	operation: Type$1.Unsafe(schemaRef(SignerOperationSchema)),
-	code: Type$1.String(),
-	message: Type$1.String()
+var SignerFailedResultSchema = Type.Object({
+	version: Type.Literal(1),
+	status: Type.Literal("failed"),
+	operation: Type.Unsafe(schemaRef(SignerOperationSchema)),
+	code: Type.String(),
+	message: Type.String()
 }, {
 	$id: "SignerFailedResult",
 	additionalProperties: false
 });
-var SignerCeremonyResultSchema = Type$1.Union([
-	Type$1.Unsafe(schemaRef(SignerPendingResultSchema)),
-	Type$1.Unsafe(schemaRef(SignerEnrollmentResultSchema)),
-	Type$1.Unsafe(schemaRef(SignerSignatureResultSchema)),
-	Type$1.Unsafe(schemaRef(SignerFailedResultSchema))
+var SignerCeremonyResultSchema = Type.Union([
+	Type.Unsafe(schemaRef(SignerPendingResultSchema)),
+	Type.Unsafe(schemaRef(SignerEnrollmentResultSchema)),
+	Type.Unsafe(schemaRef(SignerSignatureResultSchema)),
+	Type.Unsafe(schemaRef(SignerFailedResultSchema))
 ], { $id: "SignerCeremonyResult" });
 ({ ...previewSignSchemaContext }), schemaId(SignerUuidSchema), schemaId(SignerOperationSchema), schemaId(SignerProblemSchema), schemaId(SignerCeremonyParamsSchema), schemaId(SignerSessionSchema), schemaId(SignerEnrollmentCeremonyRequestSchema), schemaId(SignerChallengeCeremonyRequestSchema), schemaId(SignerCeremonyRequestSchema), schemaId(SignerCeremonySchema), schemaId(SignerPendingResultSchema), schemaId(SignerEnrollmentResultSchema), schemaId(SignerSignatureResultSchema), schemaId(SignerFailedResultSchema), schemaId(SignerCeremonyResultSchema);
 //#endregion
@@ -2425,39 +2678,39 @@ var TOOL_ENFORCEMENT_VALUES = [
 	"enforce"
 ];
 var toolEnforcementLiterals = [
-	Type$1.Literal(TOOL_ENFORCEMENT_VALUES[0]),
-	Type$1.Literal(TOOL_ENFORCEMENT_VALUES[1]),
-	Type$1.Literal(TOOL_ENFORCEMENT_VALUES[2])
+	Type.Literal(TOOL_ENFORCEMENT_VALUES[0]),
+	Type.Literal(TOOL_ENFORCEMENT_VALUES[1]),
+	Type.Literal(TOOL_ENFORCEMENT_VALUES[2])
 ];
-var ToolEnforcementSchema = Type$1.Union(toolEnforcementLiterals, { description: "Runtime tool-policy enforcement mode: off (inert), watch (audit only), enforce (block disallowed tools, fail-closed)." });
+var ToolEnforcementSchema = Type.Union(toolEnforcementLiterals, { description: "Runtime tool-policy enforcement mode: off (inert), watch (audit only), enforce (block disallowed tools, fail-closed)." });
 //#endregion
 //#region ../runtime-profiles/src/runtime-profiles.ts
-var RuntimeProfileName = Type$1.String({
+var RuntimeProfileName = Type.String({
 	minLength: 1,
 	maxLength: 100,
 	pattern: "^[a-zA-Z0-9][a-zA-Z0-9_-]{0,99}$"
 });
-var RuntimeProfileEnvName = Type$1.String({
+var RuntimeProfileEnvName = Type.String({
 	minLength: 1,
 	maxLength: 128,
 	pattern: "^[A-Z_][A-Z0-9_]*$"
 });
-var RuntimeProfileToolName = Type$1.String({
+var RuntimeProfileToolName = Type.String({
 	minLength: 1,
 	maxLength: 128,
 	pattern: "^[a-zA-Z0-9._/-]+$"
 });
 var RUNTIME_PROFILE_RUNTIME_KIND_PATTERN = "^[a-z][a-z0-9._-]{0,99}$";
 var RUNTIME_PROFILE_RUNTIME_KIND_REGEXP = new RegExp(RUNTIME_PROFILE_RUNTIME_KIND_PATTERN);
-var RuntimeProfileRuntimeKind = Type$1.String({
+var RuntimeProfileRuntimeKind = Type.String({
 	minLength: 1,
 	maxLength: 100,
 	pattern: RUNTIME_PROFILE_RUNTIME_KIND_PATTERN
 });
-var RuntimeProfileWorkspaceMode = Type$1.Union([
-	Type$1.Literal("none"),
-	Type$1.Literal("shared_mount"),
-	Type$1.Literal("dedicated_worktree")
+var RuntimeProfileWorkspaceMode = Type.Union([
+	Type.Literal("none"),
+	Type.Literal("shared_mount"),
+	Type.Literal("dedicated_worktree")
 ]);
 /**
 * Tool-policy enforcement mode for the profile's runtime `tool_call` gate:
@@ -2465,63 +2718,63 @@ var RuntimeProfileWorkspaceMode = Type$1.Union([
 * fail-closed). Read by the daemon via `GET /runtime-profiles/:id/allowed-tools`.
 */
 var RuntimeProfileToolEnforcement = ToolEnforcementSchema;
-var RuntimeProfileAllowedWorkspaceModes = Type$1.Array(RuntimeProfileWorkspaceMode, {
+var RuntimeProfileAllowedWorkspaceModes = Type.Array(RuntimeProfileWorkspaceMode, {
 	minItems: 1,
 	maxItems: 3,
 	uniqueItems: true
 });
 var RuntimeProfileThinkingLevelOptions = [
-	Type$1.Literal("off"),
-	Type$1.Literal("minimal"),
-	Type$1.Literal("low"),
-	Type$1.Literal("medium"),
-	Type$1.Literal("high"),
-	Type$1.Literal("xhigh")
+	Type.Literal("off"),
+	Type.Literal("minimal"),
+	Type.Literal("low"),
+	Type.Literal("medium"),
+	Type.Literal("high"),
+	Type.Literal("xhigh")
 ];
-Type$1.Union([...RuntimeProfileThinkingLevelOptions]);
-var RuntimeProfileNullableThinkingLevel = Type$1.Union([...RuntimeProfileThinkingLevelOptions, Type$1.Null()]);
-var RuntimeProfileNullableTemperature = Type$1.Union([Type$1.Null(), Type$1.Number({
+Type.Union([...RuntimeProfileThinkingLevelOptions]);
+var RuntimeProfileNullableThinkingLevel = Type.Union([...RuntimeProfileThinkingLevelOptions, Type.Null()]);
+var RuntimeProfileNullableTemperature = Type.Union([Type.Null(), Type.Number({
 	minimum: 0,
 	maximum: 2
 })]);
-var RuntimeProfileNullableTopP = Type$1.Union([Type$1.Null(), Type$1.Number({
+var RuntimeProfileNullableTopP = Type.Union([Type.Null(), Type.Number({
 	minimum: 0,
 	maximum: 1
 })]);
-var RuntimeProfileNullableTopK = Type$1.Union([Type$1.Integer({
+var RuntimeProfileNullableTopK = Type.Union([Type.Integer({
 	minimum: 1,
 	maximum: 1e4
-}), Type$1.Null()]);
-var RuntimeProfileNullableMaxOutputTokens = Type$1.Union([Type$1.Integer({
+}), Type.Null()]);
+var RuntimeProfileNullableMaxOutputTokens = Type.Union([Type.Integer({
 	minimum: 1,
 	maximum: 1e6
-}), Type$1.Null()]);
-var RuntimeProfileAllowedHost = Type$1.String({
+}), Type.Null()]);
+var RuntimeProfileAllowedHost = Type.String({
 	minLength: 1,
 	maxLength: 255,
 	pattern: "^(?:\\*\\.)?(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)(?:\\.(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?))*$"
 });
-var RuntimeProfileSandbox = Type$1.Object({
-	network: Type$1.Optional(Type$1.Object({
-		allowedHosts: Type$1.Optional(Type$1.Array(RuntimeProfileAllowedHost, { maxItems: 50 })),
-		allowedInternalHosts: Type$1.Optional(Type$1.Array(RuntimeProfileAllowedHost, { maxItems: 50 }))
+var RuntimeProfileSandbox = Type.Object({
+	network: Type.Optional(Type.Object({
+		allowedHosts: Type.Optional(Type.Array(RuntimeProfileAllowedHost, { maxItems: 50 })),
+		allowedInternalHosts: Type.Optional(Type.Array(RuntimeProfileAllowedHost, { maxItems: 50 }))
 	}, { additionalProperties: false })),
-	vfs: Type$1.Optional(Type$1.Object({
-		shadow: Type$1.Optional(Type$1.Array(Type$1.String({
+	vfs: Type.Optional(Type.Object({
+		shadow: Type.Optional(Type.Array(Type.String({
 			minLength: 1,
 			maxLength: 255
 		}), { maxItems: 100 })),
-		shadowMode: Type$1.Optional(Type$1.Union([Type$1.Literal("deny"), Type$1.Literal("tmpfs")]))
+		shadowMode: Type.Optional(Type.Union([Type.Literal("deny"), Type.Literal("tmpfs")]))
 	}, { additionalProperties: false })),
-	env: Type$1.Optional(Type$1.Record(RuntimeProfileEnvName, Type$1.String({ maxLength: 4096 }))),
-	hostExec: Type$1.Optional(Type$1.Object({ autoApprove: Type$1.Optional(Type$1.Literal(false)) }, { additionalProperties: false })),
-	resources: Type$1.Optional(Type$1.Object({
-		memory: Type$1.Optional(Type$1.String({
+	env: Type.Optional(Type.Record(RuntimeProfileEnvName, Type.String({ maxLength: 4096 }))),
+	hostExec: Type.Optional(Type.Object({ autoApprove: Type.Optional(Type.Literal(false)) }, { additionalProperties: false })),
+	resources: Type.Optional(Type.Object({
+		memory: Type.Optional(Type.String({
 			minLength: 2,
 			maxLength: 16,
 			pattern: "^[0-9]+[KMG]?$"
 		})),
-		cpus: Type$1.Optional(Type$1.Integer({
+		cpus: Type.Optional(Type.Integer({
 			minimum: 1,
 			maximum: 32
 		}))
@@ -2530,19 +2783,19 @@ var RuntimeProfileSandbox = Type$1.Object({
 	$id: "RuntimeProfileSandbox",
 	additionalProperties: false
 });
-var RuntimeProfileContext = Type$1.Object({
-	slug: Type$1.String({
+var RuntimeProfileContext = Type.Object({
+	slug: Type.String({
 		minLength: 1,
 		maxLength: 64,
 		pattern: "^[a-zA-Z0-9_-]+$"
 	}),
-	binding: Type$1.Union([
-		Type$1.Literal("skill"),
-		Type$1.Literal("context_inline"),
-		Type$1.Literal("prompt_prefix"),
-		Type$1.Literal("user_inline")
+	binding: Type.Union([
+		Type.Literal("skill"),
+		Type.Literal("context_inline"),
+		Type.Literal("prompt_prefix"),
+		Type.Literal("user_inline")
 	]),
-	content: Type$1.String({
+	content: Type.String({
 		minLength: 1,
 		maxLength: 65536
 	})
@@ -2550,40 +2803,40 @@ var RuntimeProfileContext = Type$1.Object({
 	$id: "RuntimeProfileContext",
 	additionalProperties: false
 });
-Type$1.Object({ profileId: Type$1.String({ format: "uuid" }) }, {
+Type.Object({ profileId: Type.String({ format: "uuid" }) }, {
 	$id: "RuntimeProfileRef",
 	additionalProperties: false
 });
-var RuntimeProfileLeaseTtlSec = Type$1.Integer({
+var RuntimeProfileLeaseTtlSec = Type.Integer({
 	minimum: 1,
 	maximum: 86400
 });
-var RuntimeProfileHeartbeatIntervalMs = Type$1.Integer({
+var RuntimeProfileHeartbeatIntervalMs = Type.Integer({
 	minimum: 0,
 	maximum: 36e5
 });
-var RuntimeProfileMaxBatchSize = Type$1.Integer({
+var RuntimeProfileMaxBatchSize = Type.Integer({
 	minimum: 1,
 	maximum: 1e3
 });
-var RuntimeProfileMaxTurns = Type$1.Integer({
+var RuntimeProfileMaxTurns = Type.Integer({
 	minimum: 0,
 	maximum: 1e4
 });
-var RuntimeProfileMaxBashTimeouts = Type$1.Integer({
+var RuntimeProfileMaxBashTimeouts = Type.Integer({
 	minimum: 0,
 	maximum: 1e3
 });
-Type$1.Object({
-	id: Type$1.String({ format: "uuid" }),
-	teamId: Type$1.String({ format: "uuid" }),
+Type.Object({
+	id: Type.String({ format: "uuid" }),
+	teamId: Type.String({ format: "uuid" }),
 	name: RuntimeProfileName,
-	description: Type$1.Union([Type$1.String({ maxLength: 4096 }), Type$1.Null()]),
-	provider: Type$1.String({
+	description: Type.Union([Type.String({ maxLength: 4096 }), Type.Null()]),
+	provider: Type.String({
 		minLength: 1,
 		maxLength: 100
 	}),
-	model: Type$1.String({
+	model: Type.String({
 		minLength: 1,
 		maxLength: 200
 	}),
@@ -2594,15 +2847,15 @@ Type$1.Object({
 	maxOutputTokens: RuntimeProfileNullableMaxOutputTokens,
 	runtimeKind: RuntimeProfileRuntimeKind,
 	sandbox: RuntimeProfileSandbox,
-	sessionStorageMode: Type$1.Literal("local"),
-	workspaceStorageMode: Type$1.Literal("local"),
-	defaultWorkspaceMode: Type$1.Union([RuntimeProfileWorkspaceMode, Type$1.Null()]),
+	sessionStorageMode: Type.Literal("local"),
+	workspaceStorageMode: Type.Literal("local"),
+	defaultWorkspaceMode: Type.Union([RuntimeProfileWorkspaceMode, Type.Null()]),
 	allowedWorkspaceModes: RuntimeProfileAllowedWorkspaceModes,
-	sessionTtlSec: Type$1.Integer({
+	sessionTtlSec: Type.Integer({
 		minimum: 1,
 		maximum: 86400
 	}),
-	workspaceTtlSec: Type$1.Integer({
+	workspaceTtlSec: Type.Integer({
 		minimum: 1,
 		maximum: 86400
 	}),
@@ -2612,203 +2865,203 @@ Type$1.Object({
 	maxTurns: RuntimeProfileMaxTurns,
 	maxBashTimeouts: RuntimeProfileMaxBashTimeouts,
 	toolEnforcement: RuntimeProfileToolEnforcement,
-	requiredEnv: Type$1.Array(RuntimeProfileEnvName, { maxItems: 100 }),
-	requiredTools: Type$1.Array(RuntimeProfileToolName, { maxItems: 100 }),
-	requiredExecutables: Type$1.Array(RuntimeProfileToolName, { maxItems: 100 }),
-	context: Type$1.Array(RuntimeProfileContext, { maxItems: 5 }),
-	revision: Type$1.Integer({ minimum: 1 }),
-	definitionCid: Type$1.String({
+	requiredEnv: Type.Array(RuntimeProfileEnvName, { maxItems: 100 }),
+	requiredTools: Type.Array(RuntimeProfileToolName, { maxItems: 100 }),
+	requiredExecutables: Type.Array(RuntimeProfileToolName, { maxItems: 100 }),
+	context: Type.Array(RuntimeProfileContext, { maxItems: 5 }),
+	revision: Type.Integer({ minimum: 1 }),
+	definitionCid: Type.String({
 		minLength: 1,
 		maxLength: 100
 	}),
-	createdByAgentId: Type$1.Union([Type$1.String({ format: "uuid" }), Type$1.Null()]),
-	createdByHumanId: Type$1.Union([Type$1.String({ format: "uuid" }), Type$1.Null()]),
-	createdAt: Type$1.String({ format: "date-time" }),
-	updatedAt: Type$1.String({ format: "date-time" })
+	createdByAgentId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	createdByHumanId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	createdAt: Type.String({ format: "date-time" }),
+	updatedAt: Type.String({ format: "date-time" })
 }, {
 	$id: "RuntimeProfile",
 	additionalProperties: false
 });
 //#endregion
 //#region ../runtime-profiles/src/runtime-sessions.ts
-var RuntimeSessionKind = Type$1.Union([
-	Type$1.Literal("root"),
-	Type$1.Literal("extend"),
-	Type$1.Literal("fork")
+var RuntimeSessionKind = Type.Union([
+	Type.Literal("root"),
+	Type.Literal("extend"),
+	Type.Literal("fork")
 ]);
-var RuntimeSessionCheckpointKind = Type$1.Union([Type$1.Literal("attempt_final")]);
-Type$1.Object({
-	id: Type$1.String({ format: "uuid" }),
-	teamId: Type$1.String({ format: "uuid" }),
-	taskId: Type$1.String({ format: "uuid" }),
-	attemptN: Type$1.Integer({ minimum: 1 }),
-	sourceSlotId: Type$1.Union([Type$1.String({ format: "uuid" }), Type$1.Null()]),
-	sourceRuntimeProfileId: Type$1.Union([Type$1.String({ format: "uuid" }), Type$1.Null()]),
+var RuntimeSessionCheckpointKind = Type.Union([Type.Literal("attempt_final")]);
+Type.Object({
+	id: Type.String({ format: "uuid" }),
+	teamId: Type.String({ format: "uuid" }),
+	taskId: Type.String({ format: "uuid" }),
+	attemptN: Type.Integer({ minimum: 1 }),
+	sourceSlotId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	sourceRuntimeProfileId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
 	sessionKind: RuntimeSessionKind,
-	parentSessionId: Type$1.Union([Type$1.String({ format: "uuid" }), Type$1.Null()]),
-	contentType: Type$1.String({
+	parentSessionId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	contentType: Type.String({
 		minLength: 1,
 		maxLength: 200
 	}),
-	contentEncoding: Type$1.Union([Type$1.String({
+	contentEncoding: Type.Union([Type.String({
 		minLength: 1,
 		maxLength: 100
-	}), Type$1.Null()]),
-	sizeBytes: Type$1.Integer({ minimum: 0 }),
-	sha256: Type$1.String({
+	}), Type.Null()]),
+	sizeBytes: Type.Integer({ minimum: 0 }),
+	sha256: Type.String({
 		minLength: 64,
 		maxLength: 64
 	}),
-	storageClass: Type$1.String({
+	storageClass: Type.String({
 		minLength: 1,
 		maxLength: 100
 	}),
 	checkpointKind: RuntimeSessionCheckpointKind,
-	uploadedAt: Type$1.String({ format: "date-time" })
+	uploadedAt: Type.String({ format: "date-time" })
 }, { $id: "RuntimeSession" });
-Type$1.Object({
-	sourceSlotId: Type$1.Optional(Type$1.String({ format: "uuid" })),
-	sourceRuntimeProfileId: Type$1.Optional(Type$1.String({ format: "uuid" })),
+Type.Object({
+	sourceSlotId: Type.Optional(Type.String({ format: "uuid" })),
+	sourceRuntimeProfileId: Type.Optional(Type.String({ format: "uuid" })),
 	sessionKind: RuntimeSessionKind,
-	parentSessionId: Type$1.Optional(Type$1.String({ format: "uuid" }))
+	parentSessionId: Type.Optional(Type.String({ format: "uuid" }))
 }, {
 	$id: "UploadRuntimeSessionQuery",
 	additionalProperties: false
 });
-Type$1.String({
+Type.String({
 	$id: "RuntimeSessionContent",
 	description: "Runtime session content stream.",
 	format: "binary"
 });
-Type$1.Object({
-	taskId: Type$1.String({ format: "uuid" }),
-	attemptN: Type$1.Integer({ minimum: 1 })
+Type.Object({
+	taskId: Type.String({ format: "uuid" }),
+	attemptN: Type.Integer({ minimum: 1 })
 }, {
 	$id: "RuntimeSessionAttemptParams",
 	additionalProperties: false
 });
 //#endregion
 //#region ../runtime-profiles/src/runtime-slots.ts
-var RuntimeWorkspaceKind = Type$1.Union([
-	Type$1.Literal("origin"),
-	Type$1.Literal("fork"),
-	Type$1.Literal("scratch")
+var RuntimeWorkspaceKind = Type.Union([
+	Type.Literal("origin"),
+	Type.Literal("fork"),
+	Type.Literal("scratch")
 ]);
-var RuntimeSlotState = Type$1.Union([Type$1.Literal("active"), Type$1.Literal("idle")]);
-var RuntimeWorkspace = Type$1.Object({
-	id: Type$1.String({ format: "uuid" }),
-	teamId: Type$1.String({ format: "uuid" }),
-	workspaceId: Type$1.String({ minLength: 1 }),
-	worktreePath: Type$1.String({ minLength: 1 }),
-	worktreeBranch: Type$1.Union([Type$1.String({ minLength: 1 }), Type$1.Null()]),
+var RuntimeSlotState = Type.Union([Type.Literal("active"), Type.Literal("idle")]);
+var RuntimeWorkspace = Type.Object({
+	id: Type.String({ format: "uuid" }),
+	teamId: Type.String({ format: "uuid" }),
+	workspaceId: Type.String({ minLength: 1 }),
+	worktreePath: Type.String({ minLength: 1 }),
+	worktreeBranch: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
 	kind: RuntimeWorkspaceKind,
-	createdAtMs: Type$1.Integer({ minimum: 0 }),
-	lastUsedAtMs: Type$1.Integer({ minimum: 0 })
+	createdAtMs: Type.Integer({ minimum: 0 }),
+	lastUsedAtMs: Type.Integer({ minimum: 0 })
 }, { $id: "RuntimeWorkspace" });
-var RuntimeSlot = Type$1.Object({
-	id: Type$1.String({ format: "uuid" }),
-	teamId: Type$1.String({ format: "uuid" }),
-	agentName: Type$1.String({
+var RuntimeSlot = Type.Object({
+	id: Type.String({ format: "uuid" }),
+	teamId: Type.String({ format: "uuid" }),
+	agentName: Type.String({
 		minLength: 1,
 		maxLength: 100
 	}),
-	runtimeProfileId: Type$1.Union([Type$1.String({ format: "uuid" }), Type$1.Null()]),
-	provider: Type$1.String({
+	runtimeProfileId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	provider: Type.String({
 		minLength: 1,
 		maxLength: 100
 	}),
-	model: Type$1.String({
+	model: Type.String({
 		minLength: 1,
 		maxLength: 200
 	}),
-	slotKey: Type$1.String({ minLength: 1 }),
-	taskType: Type$1.String({
+	slotKey: Type.String({ minLength: 1 }),
+	taskType: Type.String({
 		minLength: 1,
 		maxLength: 100
 	}),
 	state: RuntimeSlotState,
-	lastTaskId: Type$1.String({ format: "uuid" }),
-	lastAttemptN: Type$1.Integer({ minimum: 1 }),
-	sessionDir: Type$1.Union([Type$1.String({ minLength: 1 }), Type$1.Null()]),
-	sessionPath: Type$1.Union([Type$1.String({ minLength: 1 }), Type$1.Null()]),
-	workspaceRowId: Type$1.Union([Type$1.String({ format: "uuid" }), Type$1.Null()]),
-	createdAtMs: Type$1.Integer({ minimum: 0 }),
-	lastUsedAtMs: Type$1.Integer({ minimum: 0 }),
-	expiresAtMs: Type$1.Integer({ minimum: 0 })
+	lastTaskId: Type.String({ format: "uuid" }),
+	lastAttemptN: Type.Integer({ minimum: 1 }),
+	sessionDir: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+	sessionPath: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+	workspaceRowId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	createdAtMs: Type.Integer({ minimum: 0 }),
+	lastUsedAtMs: Type.Integer({ minimum: 0 }),
+	expiresAtMs: Type.Integer({ minimum: 0 })
 }, { $id: "RuntimeSlot" });
-var ResolvedRuntimeSlot = Type$1.Object({
+var ResolvedRuntimeSlot = Type.Object({
 	slot: RuntimeSlot,
-	workspace: Type$1.Union([RuntimeWorkspace, Type$1.Null()])
+	workspace: Type.Union([RuntimeWorkspace, Type.Null()])
 }, { $id: "ResolvedRuntimeSlot" });
-Type$1.Object({ items: Type$1.Array(ResolvedRuntimeSlot) }, { $id: "RuntimeSlotListResponse" });
-Type$1.Object({
-	agentName: Type$1.String({
+Type.Object({ items: Type.Array(ResolvedRuntimeSlot) }, { $id: "RuntimeSlotListResponse" });
+Type.Object({
+	agentName: Type.String({
 		minLength: 1,
 		maxLength: 100
 	}),
-	runtimeProfileId: Type$1.String({ format: "uuid" }),
-	provider: Type$1.String({
+	runtimeProfileId: Type.String({ format: "uuid" }),
+	provider: Type.String({
 		minLength: 1,
 		maxLength: 100
 	}),
-	model: Type$1.String({
+	model: Type.String({
 		minLength: 1,
 		maxLength: 200
 	}),
-	slotKey: Type$1.String({ minLength: 1 }),
-	taskType: Type$1.String({
+	slotKey: Type.String({ minLength: 1 }),
+	taskType: Type.String({
 		minLength: 1,
 		maxLength: 100
 	}),
-	sessionDir: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	sessionPath: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	workspaceId: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	worktreePath: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	worktreeBranch: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	workspaceKind: Type$1.Optional(RuntimeWorkspaceKind),
-	lastTaskId: Type$1.String({ format: "uuid" }),
-	lastAttemptN: Type$1.Integer({ minimum: 1 })
+	sessionDir: Type.Optional(Type.String({ minLength: 1 })),
+	sessionPath: Type.Optional(Type.String({ minLength: 1 })),
+	workspaceId: Type.Optional(Type.String({ minLength: 1 })),
+	worktreePath: Type.Optional(Type.String({ minLength: 1 })),
+	worktreeBranch: Type.Optional(Type.String({ minLength: 1 })),
+	workspaceKind: Type.Optional(RuntimeWorkspaceKind),
+	lastTaskId: Type.String({ format: "uuid" }),
+	lastAttemptN: Type.Integer({ minimum: 1 })
 }, {
 	$id: "BeginRuntimeSlotBody",
 	additionalProperties: false
 });
-Type$1.Object({
-	agentName: Type$1.String({
+Type.Object({
+	agentName: Type.String({
 		minLength: 1,
 		maxLength: 100
 	}),
-	runtimeProfileId: Type$1.String({ format: "uuid" }),
-	provider: Type$1.String({
+	runtimeProfileId: Type.String({ format: "uuid" }),
+	provider: Type.String({
 		minLength: 1,
 		maxLength: 100
 	}),
-	model: Type$1.String({
+	model: Type.String({
 		minLength: 1,
 		maxLength: 200
 	}),
-	slotKey: Type$1.String({ minLength: 1 }),
-	taskId: Type$1.String({ format: "uuid" }),
-	attemptN: Type$1.Integer({ minimum: 1 }),
-	sessionPath: Type$1.Optional(Type$1.String({ minLength: 1 }))
+	slotKey: Type.String({ minLength: 1 }),
+	taskId: Type.String({ format: "uuid" }),
+	attemptN: Type.Integer({ minimum: 1 }),
+	sessionPath: Type.Optional(Type.String({ minLength: 1 }))
 }, {
 	$id: "FinishRuntimeSlotBody",
 	additionalProperties: false
 });
-Type$1.Object({
-	taskId: Type$1.String({ format: "uuid" }),
-	attemptN: Type$1.Integer({ minimum: 1 })
+Type.Object({
+	taskId: Type.String({ format: "uuid" }),
+	attemptN: Type.Integer({ minimum: 1 })
 }, {
 	$id: "FindLatestRuntimeSlotForAttemptQuery",
 	additionalProperties: false
 });
-Type$1.Object({
-	agentName: Type$1.Optional(Type$1.String({
+Type.Object({
+	agentName: Type.Optional(Type.String({
 		minLength: 1,
 		maxLength: 100
 	})),
-	runtimeProfileId: Type$1.Optional(Type$1.String({ format: "uuid" })),
-	state: Type$1.Optional(RuntimeSlotState),
-	limit: Type$1.Optional(Type$1.Integer({
+	runtimeProfileId: Type.Optional(Type.String({ format: "uuid" })),
+	state: Type.Optional(RuntimeSlotState),
+	limit: Type.Optional(Type.Integer({
 		minimum: 1,
 		maximum: 200
 	}))
@@ -2946,6 +3199,11 @@ function definePiRuntime(options) {
 		secretIds.add(id);
 		secretEnvNames.add(guestEnv);
 	}
+	const capabilityNames = /* @__PURE__ */ new Set();
+	for (const capability of options.hostCapabilities ?? []) {
+		if (capabilityNames.has(capability.name)) throw new Error(`Duplicate host capability name "${capability.name}"`);
+		capabilityNames.add(capability.name);
+	}
 	return Object.freeze({
 		schemaVersion: PI_RUNTIME_DEFINITION_VERSION,
 		id: options.id,
@@ -2953,12 +3211,14 @@ function definePiRuntime(options) {
 		runtimeKind: options.runtimeKind ?? "gondolin_pi",
 		vm: options.vm,
 		brokeredHttpSecrets: Object.freeze([...options.brokeredHttpSecrets ?? []]),
+		hostCapabilities: Object.freeze([...options.hostCapabilities ?? []]),
 		tools: Object.freeze([...options.tools ?? []]),
 		extensions: Object.freeze([...options.extensions ?? []])
 	});
 }
 async function buildPiExecutorManifest(input) {
 	const brokeredHttpSecrets = input.runtime.brokeredHttpSecrets ?? [];
+	const hostCapabilities = input.runtime.hostCapabilities ?? [];
 	const descriptors = [...(input.builtInTools ?? []).map((descriptor) => ({
 		descriptor,
 		scope: "parent_and_subagents"
@@ -3006,6 +3266,12 @@ async function buildPiExecutorManifest(input) {
 			ports: [...descriptor.ports ?? [descriptor.protocol === "http" ? 80 : 443]],
 			required: descriptor.required !== false
 		})).sort((left, right) => left.id.localeCompare(right.id)) },
+		...hostCapabilities.length > 0 && { hostCapabilities: hostCapabilities.map((capability) => ({
+			name: capability.name,
+			origin: capability.origin,
+			operations: Object.keys(capability.operations).sort(),
+			descriptorCid: capability.descriptorCid
+		})).sort((left, right) => left.name.localeCompare(right.name)) },
 		tools,
 		extensions: input.runtime.extensions.map((extension) => ({
 			id: extension.id,
@@ -4400,6 +4666,8 @@ function buildSandboxCapabilityInstructions(sandbox, policy) {
 		`  placeholders in: ${brokeredSecretEnvNames.map((name) => `\`${name}\``).join(", ")}. The host proxy may substitute them only for their`,
 		"  declared destination hosts. Do not print, persist, or move them."
 	] : [], "- Runtime service endpoints required for task execution may be available", "  in addition to the operator-configured hosts above.");
+	const hostCapabilities = [...sandbox.hostCapabilities ?? []].sort((left, right) => left.name.localeCompare(right.name));
+	if (hostCapabilities.length > 0) lines.push("- Host capabilities served by the trusted daemon (attested in the", "  executor manifest; every call is policy-checked and evidenced):", ...hostCapabilities.map((capability) => `  - \`${capability.name}\` at ${capability.origin} (${[...capability.operations].sort().join(", ")}).`));
 	return lines.join("\n");
 }
 function shellExecutableIsAvailable(policy, sandbox, executable) {
@@ -4432,7 +4700,25 @@ function buildCredentialInstructions(policy, sandbox) {
 			"  requests; it is not a reusable or inspectable token."
 		] : ["- No brokered GitHub credential is active. Authenticated `gh`", "  operations are unavailable; do not mint or recover a host token."]);
 	}
-	if (gitAvailable) lines.push("- Local Git commands run inside the guest. No signing key or Git", "  credential helper is injected; signing and authenticated push", "  require an explicitly provided capability.");
+	if (gitAvailable) {
+		const signing = (sandbox?.hostCapabilities ?? []).find((capability) => capability.name === "agent-signing");
+		const signingGranted = !!signing && (!policy || policy.enforcement === "off" || policy.allowedTools.some((name) => name === "capability:agent-signing" || name.startsWith("capability:agent-signing:")));
+		const hostAuthenticated = sandbox?.guestCredentialMode === "host-authenticated";
+		if (signingGranted) {
+			lines.push("- Commit signing is brokered: `git commit -S` works normally through", "  `SSH_AUTH_SOCK`; the signing key stays on the host. Do not look for,", "  export, or recreate a private key in the guest.");
+			lines.push(...hostAuthenticated ? [
+				"- For a signed diary entry use the `moltnet_create_entry` tool with",
+				"  `signed: true` (it signs on the trusted host). Do not use the",
+				"  guest `moltnet entry create-signed` CLI: it has no guest identity",
+				"  credentials and its REST calls will fail."
+			] : [
+				"- For a signed diary entry use `moltnet_create_entry` with",
+				"  `signed: true`, or the guest `moltnet entry create-signed` CLI",
+				"  (brokered through `MOLTNET_SIGNER_URL`)."
+			]);
+		} else if (signing) lines.push("- An `agent-signing` capability is declared but the active policy does", "  not grant it. `git commit -S` and signed diary entries will be denied;", "  create unsigned commits/entries unless the capability is granted.");
+		else lines.push("- Local Git commands run inside the guest. No signing key or Git", "  credential helper is injected; signing and authenticated push", "  require an explicitly provided capability.");
+	}
 	return lines.join("\n");
 }
 /**
@@ -4505,12 +4791,12 @@ function recoverableSubagentSubmitParameters(schema) {
 *   - `output_schema` — name of a registered SubagentOutputContract.
 *                      Resolved at call time; unknown names error.
 */
-var SubagentToolParameters = Type$1.Object({
-	task: Type$1.String({
+var SubagentToolParameters = Type.Object({
+	task: Type.String({
 		minLength: 1,
 		description: "Natural-language instructions for the subagent. The subagent starts with a fresh conversation and a narrowed system prompt; this is the only context it has from you."
 	}),
-	output_schema: Type$1.String({
+	output_schema: Type.String({
 		minLength: 1,
 		description: "Name of a registered subagent output contract. The subagent must submit a structured payload via `submit_subagent_output` matching this contract."
 	})
@@ -5470,6 +5756,31 @@ var HOST_AUTHENTICATED_HOST_EXEC_REFUSED_ENV = new Set([
 	"MOLTNET_CREDENTIALS_PATH",
 	"SSH_AUTH_SOCK"
 ]);
+/** `capability:<name>[:<operation>]` entries in the tool allow-set. */
+function isHostCapabilityGrant(name) {
+	return name.startsWith("capability:");
+}
+/**
+* A signer whose every operation goes through the capability router, so a
+* tool cannot obtain a host signature the session policy would deny.
+*/
+function createPolicyCheckedSigner(router, identity) {
+	async function call(operation, input) {
+		const result = await router.invoke("agent-signing", operation, input);
+		if (!result.ok) throw new Error(`agent-signing/${operation} ${result.code}: ${result.message}`);
+		return result.output;
+	}
+	return {
+		identity,
+		async signDiaryEntry(input) {
+			return call("sign-diary-entry", input);
+		},
+		async signGitCommit(input) {
+			const { signature } = await call("sign-git-commit", { sshsig: Buffer.from(input.sshsig).toString("base64") });
+			return { signature: new Uint8Array(Buffer.from(signature, "base64")) };
+		}
+	};
+}
 function resolveHostExecBaseEnv(guestCredentialMode, agentEnv) {
 	const names = new Set([...HOST_EXEC_DEFAULT_BASE_ENV, ...Object.keys(agentEnv)]);
 	if (guestCredentialMode === "host-authenticated") {
@@ -5712,6 +6023,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 			resumeCommands: [...resolvedVmTemplate.resumeCommands]
 		} : opts.sandboxConfig, executionPlan);
 		let brokeredSecrets;
+		let capabilityRouter;
 		try {
 			const runtimeDefinition = opts.runtimeDefinition;
 			brokeredSecrets = runtimeDefinition ? await traceRuntimePhase("moltnet.execution.credentials.resolve", { "moltnet.credentials.requirement_count": runtimeDefinition.brokeredHttpSecrets?.length ?? 0 }, () => resolveAttemptBrokeredHttpSecrets({
@@ -5730,8 +6042,39 @@ async function executePiTask(claimedTask, reporter, opts) {
 			await emitError("credential_resolution", message);
 			return makeFailedOutput("credential_resolution_failed", message, finalUsage, err instanceof PiBrokeredHttpSecretResolutionError ? err.retryable : false);
 		}
+		if ((opts.runtimeDefinition?.hostCapabilities?.length ?? 0) > 0 && (!opts.agentIdentity || !opts.moltnetAgent)) {
+			const message = "runtime declares host capabilities but no agent identity and authenticated host Agent were injected";
+			await emitError("host_capabilities", message);
+			return makeFailedOutput("host_capability_context_missing", message, finalUsage, false);
+		}
 		try {
 			brokeredSecretEnvNames = (brokeredSecrets ?? []).filter(({ value }) => value !== void 0 && value !== "").map(({ guestEnv }) => guestEnv).sort();
+			const hostCapabilities = opts.runtimeDefinition?.hostCapabilities ?? [];
+			if (hostCapabilities.length > 0) capabilityRouter = createHostCapabilityRouter({
+				capabilities: hostCapabilities,
+				context: {
+					taskId: task.id,
+					attemptN: claimedTask.attemptN,
+					teamId: task.teamId ?? "",
+					agent: opts.moltnetAgent,
+					identity: opts.agentIdentity
+				},
+				injected: { ...opts.hostCapabilitySigner && { signer: opts.hostCapabilitySigner } },
+				paths: { mountPath },
+				logger: opts.hostCapabilityLogger ?? opts.toolPolicyLogger ?? {
+					info: (obj, msg) => console.error(JSON.stringify({
+						level: "info",
+						msg,
+						...obj
+					})),
+					warn: (obj, msg) => console.error(JSON.stringify({
+						level: "warn",
+						msg,
+						...obj
+					}))
+				},
+				signal: reporter.cancelSignal
+			});
 			managed = await traceRuntimePhase("moltnet.execution.vm.resume", { "moltnet.workspace.mode": preparedWorkspace.mode }, () => (opts.resumeVm ?? resumeVm)({
 				checkpointPath,
 				agentName: opts.agentName,
@@ -5743,6 +6086,10 @@ async function executePiTask(claimedTask, reporter, opts) {
 				sandboxConfig: effectiveSandboxConfig,
 				forwardEnv: opts.forwardEnv,
 				brokeredSecrets,
+				...capabilityRouter && {
+					hostOrigins: capabilityRouter.origins,
+					guestProjection: capabilityRouter.guestProjection
+				},
 				onDiagnostic: opts.onVmDiagnostic,
 				signal: reporter.cancelSignal
 			}));
@@ -5896,6 +6243,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 			const moltnetAgent = await getMoltNetAgent();
 			const moltnetTools = createMoltNetTools({
 				getAgent: () => moltnetAgent,
+				getSigner: () => capabilityRouter && opts.agentIdentity ? createPolicyCheckedSigner(capabilityRouter, opts.agentIdentity) : null,
 				getDiaryId: () => diaryId,
 				getTeamId: () => taskTeamId,
 				getSessionErrors: () => [],
@@ -5971,6 +6319,13 @@ async function executePiTask(claimedTask, reporter, opts) {
 					}));
 				}
 			}
+			capabilityRouter?.setPolicy(resolvedToolPolicy ? {
+				enforcement: resolvedToolPolicy.enforcement,
+				allowedTools: resolvedToolPolicy.allowedTools
+			} : {
+				enforcement: "off",
+				allowedTools: /* @__PURE__ */ new Set()
+			});
 			const runtimeToolContext = {
 				agent: moltnetAgent,
 				claimedTask,
@@ -6016,7 +6371,10 @@ async function executePiTask(claimedTask, reporter, opts) {
 				policy: resolvedToolPolicy
 			});
 			const capabilityProjection = projectRuntimeCapabilities({
-				policy: resolvedToolPolicy,
+				policy: resolvedToolPolicy && {
+					...resolvedToolPolicy,
+					allowedTools: new Set([...resolvedToolPolicy.allowedTools].filter((name) => !isHostCapabilityGrant(name)))
+				},
 				visibleToolNames: visibleParentToolNames,
 				unavailableShellCommands: unavailableRuntimeShellCommands
 			});
@@ -6051,7 +6409,9 @@ async function executePiTask(claimedTask, reporter, opts) {
 					verifiedExecutables: verifiedGuestExecutables,
 					allowedHosts: [...effectiveSandboxConfig?.network?.allowedHosts ?? [], ...opts.extraAllowedHosts ?? []],
 					allowedInternalHosts: effectiveSandboxConfig?.network?.allowedInternalHosts ?? [],
-					brokeredSecretEnvNames
+					brokeredSecretEnvNames,
+					guestCredentialMode: opts.guestCredentialMode ?? "guest-config",
+					...capabilityRouter && { hostCapabilities: capabilityRouter.manifest }
 				},
 				toolPolicy: capabilityProjection.instructorPolicy
 			});
@@ -6667,7 +7027,10 @@ async function cleanupAttempt(deps) {
 			log(`executePiTask: reporter.close() failed for task ${deps.taskId} attempt ${deps.attemptN}: ${detail}`);
 		}
 	}
-	if (deps.managed) await deps.managed.vm.close();
+	if (deps.managed) {
+		await deps.managed.services?.stop().catch(() => void 0);
+		await deps.managed.vm.close();
+	}
 	if (deps.workspace) try {
 		deps.workspace.cleanup();
 	} catch (err) {
@@ -7024,4 +7387,4 @@ function describeToolErrorMessage(result) {
 	}
 }
 //#endregion
-export { BrokeredHttpSecretBoundaryError, DEFAULT_BROKERED_HTTP_SECRET_RESOLUTION_TIMEOUT_MS, GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, GuestEnvironmentBoundaryError, HOST_EXEC_DEFAULT_BASE_ENV, MOLTNET_TOOL_NAMES, PI_EXECUTOR_MANIFEST_VERSION, PI_GUEST_AUTH_PATH, PI_RUNTIME_DEFINITION_VERSION, PiBrokeredHttpSecretResolutionError, activateAgentEnv, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, buildAgentSession, buildPiExecutorManifest, buildRuntimeKernel, buildWorkspaceMountInstructions, createGondolinBashOps, createGondolinEditOps, createGondolinFindOps, createGondolinLsOps, createGondolinReadOps, createGondolinToolDefinitions, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiRetryTriage, createPiTaskExecutor, createSubagentTool, createToolPolicyExtension, decideForEvent, decideToolCall, defineGondolinTemplate, definePiBrokeredHttpSecret, definePiExtension, definePiRuntime, definePiTool, enabledPiToolNames, ensureSnapshot, executeGondolinGrep, executePiTask, filterModelVisibleTools, findMainWorktree, injectRuntimeContext as injectTaskContext, isKernelTool, isResolvedPathInsideRoot, isToolVisible, loadCredentials, materializePiBrokeredHttpSecrets, materializePiExtensions, materializePiTools, normalizeRetryTriageResult, piProviderAuth, prepareBrokeredHttpSecrets, redactRetryTriageSecrets, resolveHostExecBaseEnv, resolveSessionToolPolicy, resolveTaskWorktreePath, resumeVm, toGuestPath };
+export { BrokeredHttpSecretBoundaryError, DEFAULT_BROKERED_HTTP_SECRET_RESOLUTION_TIMEOUT_MS, GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, GUEST_ALLOWED_SIGNERS_PATH, GUEST_GITCONFIG_PATH, GUEST_SIGNER_SOCKET, GuestEnvironmentBoundaryError, HOST_EXEC_DEFAULT_BASE_ENV, MOLTNET_TOOL_NAMES, PI_EXECUTOR_MANIFEST_VERSION, PI_GUEST_AUTH_PATH, PI_RUNTIME_DEFINITION_VERSION, PiBrokeredHttpSecretResolutionError, activateAgentEnv, agentSigningCapability, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, buildAgentSession, buildPiExecutorManifest, buildRuntimeKernel, buildWorkspaceMountInstructions, createGondolinBashOps, createGondolinEditOps, createGondolinFindOps, createGondolinLsOps, createGondolinReadOps, createGondolinToolDefinitions, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiRetryTriage, createPiTaskExecutor, createSubagentTool, createToolPolicyExtension, decideForEvent, decideToolCall, defineGondolinTemplate, definePiBrokeredHttpSecret, definePiExtension, definePiRuntime, definePiTool, enabledPiToolNames, ensureSnapshot, executeGondolinGrep, executePiTask, filterModelVisibleTools, findMainWorktree, injectRuntimeContext as injectTaskContext, isKernelTool, isResolvedPathInsideRoot, isToolVisible, loadCredentials, materializePiBrokeredHttpSecrets, materializePiExtensions, materializePiTools, normalizeRetryTriageResult, piProviderAuth, prepareBrokeredHttpSecrets, redactRetryTriageSecrets, resolveHostExecBaseEnv, resolveSessionToolPolicy, resolveTaskWorktreePath, resumeVm, toGuestPath };