@whittlelabs/sifter 0.34.0 → 0.36.0

package/bin.js

@@ -9961,6 +9961,8 @@ var require_progress = __commonJS({
       seq = 0;
       pending = [];
       textBuf = "";
+      /** The last two characters of reasoning emitted since the last tool; null when none. */
+      reasoningTail = null;
       timer = null;
       closed = false;
       flushMs;
@@ -9970,20 +9972,39 @@ var require_progress = __commonJS({
         this.flushMs = options.flushMs ?? 400;
         this.maxChars = options.maxChars ?? 1200;
       }
+      /** A fragment of reasoning, continuing whatever came before it. */
       reasoning(text) {
         if (this.closed || !text)
           return;
         this.textBuf += text;
+        this.reasoningTail = ((this.reasoningTail ?? "") + text).slice(-2);
         if (this.textBuf.length >= this.maxChars) {
           this.flush();
         } else {
           this.arm();
         }
       }
+      /**
+       * A whole block of reasoning (a thinking summary, a message between tool
+       * calls), trimmed and set off from the reasoning before it by one blank
+       * line. A consumer flows consecutive reasoning frames into one passage, so
+       * two blocks reported as fragments run together mid-sentence, and a
+       * block's own trailing blank lines (thinking summaries end in them) would
+       * show as empty lines before the next act.
+       */
+      reasoningBlock(text) {
+        const block = text.trim();
+        if (this.closed || !block)
+          return;
+        const tail = this.reasoningTail;
+        const gap = tail === null || tail.endsWith("\n\n") ? "" : tail.endsWith("\n") ? "\n" : "\n\n";
+        this.reasoning(gap + block);
+      }
       tool(name, target) {
         if (this.closed || !name)
           return;
         this.drainText();
+        this.reasoningTail = null;
         this.push({ kind: "tool", tool: target ? { name, target } : { name } });
         this.flush();
       }
@@ -10611,6 +10632,87 @@ var require_workspace_telemetry = __commonJS({
   }
 });
 
+// ../../packages/shuttle/dist/executors/cli-version.js
+var require_cli_version = __commonJS({
+  "../../packages/shuttle/dist/executors/cli-version.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.cliVersion = cliVersion;
+    var child_process_1 = require("child_process");
+    var VERSION_TIMEOUT_MS = 5e3;
+    function cliVersion(bin, env) {
+      return new Promise((resolve) => {
+        try {
+          (0, child_process_1.execFile)(bin, ["--version"], { timeout: VERSION_TIMEOUT_MS, ...env ? { env } : {} }, (err, stdout) => {
+            resolve(err ? null : String(stdout).match(/\d+\.\d+\.\d+/)?.[0] ?? null);
+          });
+        } catch {
+          resolve(null);
+        }
+      });
+    }
+  }
+});
+
+// ../../packages/shuttle/dist/version-check.js
+var require_version_check = __commonJS({
+  "../../packages/shuttle/dist/version-check.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.UpgradeRequiredError = exports2.LATEST_VERSION_HEADER = exports2.MIN_VERSION_HEADER = void 0;
+    exports2.compareSemver = compareSemver;
+    exports2.checkResponseMinVersion = checkResponseMinVersion;
+    exports2.readResponseLatestVersion = readResponseLatestVersion;
+    exports2.MIN_VERSION_HEADER = "x-sifter-min-version";
+    exports2.LATEST_VERSION_HEADER = "x-sifter-latest-version";
+    var UpgradeRequiredError2 = class extends Error {
+      currentVersion;
+      minVersion;
+      packageName;
+      constructor(opts) {
+        super(`The backend requires ${opts.packageName} ${opts.minVersion} or newer. You're running ${opts.currentVersion}. Upgrade: npm install -g ${opts.packageName}@latest`);
+        this.name = "UpgradeRequiredError";
+        this.currentVersion = opts.currentVersion;
+        this.minVersion = opts.minVersion;
+        this.packageName = opts.packageName;
+      }
+    };
+    exports2.UpgradeRequiredError = UpgradeRequiredError2;
+    function compareSemver(a, b) {
+      const parse = (v) => {
+        const core = v.replace(/^v/, "").split(/[-+]/, 1)[0];
+        const parts = core.split(".").map((p) => Number.parseInt(p, 10));
+        return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
+      };
+      const [aMaj, aMin, aPat] = parse(a);
+      const [bMaj, bMin, bPat] = parse(b);
+      if (aMaj !== bMaj)
+        return aMaj < bMaj ? -1 : 1;
+      if (aMin !== bMin)
+        return aMin < bMin ? -1 : 1;
+      if (aPat !== bPat)
+        return aPat < bPat ? -1 : 1;
+      return 0;
+    }
+    function checkResponseMinVersion(opts) {
+      const minVersion = opts.response.headers.get(exports2.MIN_VERSION_HEADER);
+      if (!minVersion)
+        return;
+      if (compareSemver(opts.currentVersion, minVersion) >= 0)
+        return;
+      throw new UpgradeRequiredError2({
+        currentVersion: opts.currentVersion,
+        minVersion,
+        packageName: opts.packageName
+      });
+    }
+    function readResponseLatestVersion(response) {
+      const latest = response.headers.get(exports2.LATEST_VERSION_HEADER);
+      return latest && latest.trim().length > 0 ? latest.trim() : null;
+    }
+  }
+});
+
 // ../../packages/shuttle/dist/executors/claude-code.js
 var require_claude_code = __commonJS({
   "../../packages/shuttle/dist/executors/claude-code.js"(exports2) {
@@ -10634,9 +10736,12 @@ var require_claude_code = __commonJS({
     var json_answer_1 = require_json_answer();
     var models_1 = require_models();
     var workspace_telemetry_1 = require_workspace_telemetry();
+    var cli_version_1 = require_cli_version();
     var apply_1 = require_apply();
+    var version_check_1 = require_version_check();
     var DEFAULT_TIMEOUT = 6e5;
     var REVIEW_TOOLS = ["Read", "Grep", "Glob"];
+    var THINKING_DISPLAY_FLOOR = "2.1.94";
     function reviewRunArgs(settingSources) {
       return [
         "--setting-sources",
@@ -10891,13 +10996,17 @@ var require_claude_code = __commonJS({
           args.push("--model", model);
         if (effort)
           args.push("--effort", effort);
+        const version = await (0, cli_version_1.cliVersion)("claude", childEnv);
+        if (version !== null && (0, version_check_1.compareSemver)(version, THINKING_DISPLAY_FLOOR) >= 0) {
+          args.push("--thinking-display", "summarized");
+        }
         if (this.config.maxTurns !== void 0)
           args.push("--max-turns", String(this.config.maxTurns));
         if (allowedTools && allowedTools.length > 0) {
           args.push("--allowedTools", allowedTools.join(","));
         }
         const tap = reporter ? new progress_1.StreamJsonTap({
-          onReasoning: (t) => reporter.reasoning(t),
+          onReasoning: (t) => reporter.reasoningBlock(t),
           onTool: (name, target) => reporter.tool(name, target),
           onResult: () => reporter.flush()
         }) : null;
@@ -11072,6 +11181,7 @@ var require_claude_code = __commonJS({
       let finalText = null;
       const readPaths = [];
       let usage = null;
+      const toolCalls = {};
       let resultMeta = null;
       let structuredOutput = null;
       let sessionId = null;
@@ -11099,6 +11209,8 @@ var require_claude_code = __commonJS({
             const b = block;
             if (b?.type !== "tool_use")
               continue;
+            if (typeof b.name === "string")
+              toolCalls[b.name] = (toolCalls[b.name] ?? 0) + 1;
             const fp = b.input?.file_path;
             if (b.name === "Read" && typeof fp === "string") {
               readPaths.push(fp);
@@ -11125,13 +11237,19 @@ var require_claude_code = __commonJS({
           }
           const u = event.usage;
           const cost = event.total_cost_usd;
+          const turns = event.num_turns;
           usage = {
             ...typeof u?.input_tokens === "number" ? { inputTokens: u.input_tokens } : {},
             ...typeof u?.output_tokens === "number" ? { outputTokens: u.output_tokens } : {},
-            ...typeof cost === "number" ? { costUsd: cost } : {}
+            ...typeof u?.cache_read_input_tokens === "number" ? { cacheReadInputTokens: u.cache_read_input_tokens } : {},
+            ...typeof u?.cache_creation_input_tokens === "number" ? { cacheCreationInputTokens: u.cache_creation_input_tokens } : {},
+            ...typeof cost === "number" ? { costUsd: cost } : {},
+            ...typeof turns === "number" ? { turns } : {}
           };
         }
       }
+      if (usage && Object.keys(toolCalls).length > 0)
+        usage.toolCalls = toolCalls;
       return { finalText, readPaths, usage, resultMeta, structuredOutput, sessionId, model, toolInputs };
     }
   }
@@ -11386,6 +11504,11 @@ var require_codex = __commonJS({
         'approval_policy="never"',
         "-c",
         'web_search="disabled"',
+        // Reasoning summaries are the live view's narration. With the user config
+        // ignored, codex 0.162.1 emits no reasoning items at all; `detailed`
+        // brings them back without touching the answer.
+        "-c",
+        'model_reasoning_summary="detailed"',
         ...DISABLED_FEATURES.flatMap((f) => ["--disable", f])
       ];
     }
@@ -11640,12 +11763,17 @@ var require_codex = __commonJS({
         if (event.type === "item.started" && kind === "command_execution" && typeof item?.command === "string") {
           reporter.tool("shell", item.command);
         } else if (event.type === "item.completed" && kind === "reasoning" && typeof item?.text === "string") {
-          reporter.reasoning(item.text);
+          reporter.reasoningBlock(plainHeadings(item.text));
+        } else if (event.type === "item.completed" && kind === "agent_message" && typeof item?.text === "string" && (0, json_answer_1.extractJsonObject)(item.text) === void 0) {
+          reporter.reasoningBlock(item.text);
         } else if (event.type === "turn.completed") {
           reporter.flush();
         }
       });
     }
+    function plainHeadings(text) {
+      return text.replace(/^\*\*([^*\n]+)\*\*[ \t]*$/gm, "$1");
+    }
     function itemKind(item) {
       const kind = typeof item.type === "string" ? item.type : typeof item.item_type === "string" ? item.item_type : null;
       return kind === "assistant_message" ? "agent_message" : kind;
@@ -12173,7 +12301,7 @@ ${JSON.stringify(spec.outputSchema)}
           const target = [args.path, args.pattern].find((v) => typeof v === "string");
           reporter.tool(data.toolName, target);
         } else if (event.type === "assistant.reasoning" && typeof data.content === "string") {
-          reporter.reasoning(data.content);
+          reporter.reasoningBlock(data.content);
         } else if (event.type === "assistant.turn_end") {
           reporter.flush();
         }
@@ -13721,65 +13849,6 @@ var require_custom_script = __commonJS({
   }
 });
 
-// ../../packages/shuttle/dist/version-check.js
-var require_version_check = __commonJS({
-  "../../packages/shuttle/dist/version-check.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.UpgradeRequiredError = exports2.LATEST_VERSION_HEADER = exports2.MIN_VERSION_HEADER = void 0;
-    exports2.compareSemver = compareSemver;
-    exports2.checkResponseMinVersion = checkResponseMinVersion;
-    exports2.readResponseLatestVersion = readResponseLatestVersion;
-    exports2.MIN_VERSION_HEADER = "x-sifter-min-version";
-    exports2.LATEST_VERSION_HEADER = "x-sifter-latest-version";
-    var UpgradeRequiredError2 = class extends Error {
-      currentVersion;
-      minVersion;
-      packageName;
-      constructor(opts) {
-        super(`The backend requires ${opts.packageName} ${opts.minVersion} or newer. You're running ${opts.currentVersion}. Upgrade: npm install -g ${opts.packageName}@latest`);
-        this.name = "UpgradeRequiredError";
-        this.currentVersion = opts.currentVersion;
-        this.minVersion = opts.minVersion;
-        this.packageName = opts.packageName;
-      }
-    };
-    exports2.UpgradeRequiredError = UpgradeRequiredError2;
-    function compareSemver(a, b) {
-      const parse = (v) => {
-        const core = v.replace(/^v/, "").split(/[-+]/, 1)[0];
-        const parts = core.split(".").map((p) => Number.parseInt(p, 10));
-        return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
-      };
-      const [aMaj, aMin, aPat] = parse(a);
-      const [bMaj, bMin, bPat] = parse(b);
-      if (aMaj !== bMaj)
-        return aMaj < bMaj ? -1 : 1;
-      if (aMin !== bMin)
-        return aMin < bMin ? -1 : 1;
-      if (aPat !== bPat)
-        return aPat < bPat ? -1 : 1;
-      return 0;
-    }
-    function checkResponseMinVersion(opts) {
-      const minVersion = opts.response.headers.get(exports2.MIN_VERSION_HEADER);
-      if (!minVersion)
-        return;
-      if (compareSemver(opts.currentVersion, minVersion) >= 0)
-        return;
-      throw new UpgradeRequiredError2({
-        currentVersion: opts.currentVersion,
-        minVersion,
-        packageName: opts.packageName
-      });
-    }
-    function readResponseLatestVersion(response) {
-      const latest = response.headers.get(exports2.LATEST_VERSION_HEADER);
-      return latest && latest.trim().length > 0 ? latest.trim() : null;
-    }
-  }
-});
-
 // ../../packages/shuttle/dist/branding/environment.js
 var require_environment = __commonJS({
   "../../packages/shuttle/dist/branding/environment.js"(exports2) {
@@ -26124,75 +26193,326 @@ var require_chain = __commonJS({
   }
 });
 
-// ../../packages/shuttle/dist/workspace/git.js
-var require_git = __commonJS({
-  "../../packages/shuttle/dist/workspace/git.js"(exports2) {
+// ../../packages/shuttle/dist/executors/output-gates.js
+var require_output_gates = __commonJS({
+  "../../packages/shuttle/dist/executors/output-gates.js"(exports2) {
     "use strict";
-    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { "default": mod };
-    };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.gitMaterializer = void 0;
-    exports2.buildGitAuthEnv = buildGitAuthEnv;
-    var child_process_1 = require("child_process");
-    var fs_1 = require("fs");
-    var path_1 = __importDefault(require("path"));
-    var DEFAULT_GIT_TIMEOUT_MS = 12e4;
-    var DEFAULT_GIT_PROTOCOLS = "https:ssh:git";
-    var DEFAULT_MAX_CONTEXT_REPOS = 5;
-    exports2.gitMaterializer = {
-      namespace: "git",
-      materialize: materializeGit
-    };
-    async function materializeGit(request, runRoot, options) {
-      const resolvedPrimary = readGitWorkspace(request);
-      const primaryDir = path_1.default.join(runRoot, "primary");
-      await fs_1.promises.mkdir(primaryDir, { recursive: true });
-      if ("warning" in resolvedPrimary) {
-        return { materialized: false, warning: resolvedPrimary.warning, context: [] };
-      }
-      const primary = resolvedPrimary.git;
-      const timeoutMs = options.commandTimeoutMs ?? DEFAULT_GIT_TIMEOUT_MS;
-      const allowedProtocols = options.allowedProtocols ?? DEFAULT_GIT_PROTOCOLS;
-      const signal = options.signal;
-      const maxContext = options.maxContextRepos ?? DEFAULT_MAX_CONTEXT_REPOS;
-      const contextPlan = planContextRepos(primary.context, maxContext);
-      const ref = primary.fetchCredential;
-      let gitToken = null;
-      if (ref && typeof ref.name === "string" && typeof ref.principal === "string" && options.credentials) {
-        try {
-          gitToken = await options.credentials.reveal(ref);
-        } catch {
-          gitToken = null;
-        }
-      }
-      const authEnv = gitToken !== null ? buildGitAuthEnv([primary.remote, ...contextPlan.materialize.map((c) => c.git.remote)], gitToken) : void 0;
-      const git = (args, cwd) => runGit(args, cwd, { timeoutMs, signal, allowedProtocols, extraEnv: authEnv });
-      const primaryResult = await materializeCommit(primary, primaryDir, git);
-      if (!primaryResult.ok) {
-        await fs_1.promises.rm(primaryDir, { recursive: true, force: true }).catch(() => {
-        });
-        await fs_1.promises.mkdir(primaryDir).catch(() => {
-        });
-        return { materialized: false, warning: primaryResult.warning, context: [] };
+    exports2.isSanctionedPaint = isSanctionedPaint;
+    exports2.unsanctionedPaints = unsanctionedPaints;
+    exports2.resolvePath = resolvePath;
+    exports2.evaluateOutputGates = evaluateOutputGates;
+    exports2.renderRepairPrompt = renderRepairPrompt;
+    var INPUT_REF = "input:";
+    var COLOR_BEARING = ["fill", "stroke", "color", "stop-color", "flood-color", "lighting-color"];
+    var INERT = /* @__PURE__ */ new Set(["none", "inherit", "initial", "unset", "transparent", "currentcolor"]);
+    function isSanctionedPaint(raw) {
+      const value = raw.trim().toLowerCase();
+      if (value === "")
+        return true;
+      if (INERT.has(value))
+        return true;
+      if (/^url\(\s*['"]?#[^)'"]+['"]?\s*\)$/.test(value))
+        return true;
+      const varMatch = /^var\(\s*(--[a-z0-9-]+)\s*(?:,([\s\S]*))?\)$/.exec(value);
+      if (!varMatch)
+        return false;
+      const [, name, fallback] = varMatch;
+      if (!name.startsWith("--color-"))
+        return false;
+      return fallback === void 0 || isSanctionedPaint(fallback);
+    }
+    function unsanctionedPaints(source) {
+      const found = [];
+      const attrs = COLOR_BEARING.join("|");
+      const attribute = new RegExp(`\\b(?:${attrs})\\s*=\\s*(['"])([\\s\\S]*?)\\1`, "gi");
+      const declaration = new RegExp(`\\b(?:${attrs})\\s*:\\s*([^;"'}\\n]+)`, "gi");
+      for (const [, , value] of source.matchAll(attribute)) {
+        if (!isSanctionedPaint(value))
+          found.push(value.trim());
       }
-      const context = [];
-      for (const planned of contextPlan.skip) {
-        context.push({ ...planned, materialized: false });
+      for (const [, value] of source.matchAll(declaration)) {
+        if (!isSanctionedPaint(value))
+          found.push(value.trim());
       }
-      if (contextPlan.materialize.length > 0) {
-        const contextRoot = path_1.default.join(runRoot, "context");
-        await fs_1.promises.mkdir(contextRoot, { recursive: true });
-        for (const entry of contextPlan.materialize) {
-          const dir = path_1.default.join(contextRoot, entry.name);
-          await fs_1.promises.mkdir(dir);
-          const result = await materializeCommit(entry.git, dir, git);
-          context.push({
-            name: entry.name,
-            requestedName: entry.requestedName,
-            materialized: result.ok,
-            ...result.ok ? {} : { warning: result.warning }
-          });
+      return found;
+    }
+    function resolvePath(root, path) {
+      let ctx = root;
+      for (const seg of path.split(".")) {
+        const project = seg.endsWith("[*]");
+        const key = project ? seg.slice(0, -3) : seg;
+        if (Array.isArray(ctx)) {
+          ctx = ctx.map((el) => key ? el?.[key] : el);
+        } else {
+          ctx = key ? ctx?.[key] : ctx;
+        }
+        if (project && !Array.isArray(ctx)) {
+          ctx = ctx == null ? [] : [ctx];
+        }
+      }
+      return ctx;
+    }
+    function resolveRef(ref, output, inputs) {
+      if (ref.startsWith(INPUT_REF)) {
+        const label = ref.slice(INPUT_REF.length);
+        const row = inputs.find((i) => i.label === label) ?? inputs.find((i) => i.label === "artifacts" && i.payload.label === label);
+        if (!row)
+          return void 0;
+        return Object.prototype.hasOwnProperty.call(row.payload, "value") ? row.payload.value : row.payload;
+      }
+      return resolvePath(output, ref);
+    }
+    function asStrings(value) {
+      if (Array.isArray(value))
+        return value.map((v) => String(v));
+      if (value == null)
+        return [];
+      return [String(value)];
+    }
+    var PRIMITIVES = {
+      /**
+       * `coverage` — the values at `got` must exactly cover the set at `want`:
+       * every wanted value present, nothing invented, none repeated. Params:
+       * `{ got: <output path>, want: <ref>, subject?: <noun> }`.
+       */
+      coverage(params, output, inputs) {
+        const subject = typeof params.subject === "string" ? params.subject : "item";
+        const got = asStrings(resolveRef(String(params.got), output, inputs));
+        const want = asStrings(resolveRef(String(params.want), output, inputs));
+        const gotSet = new Set(got);
+        const wantSet = new Set(want);
+        const missing = want.filter((v) => !gotSet.has(v));
+        const unknown = [...new Set(got.filter((v) => !wantSet.has(v)))];
+        const seen = /* @__PURE__ */ new Set();
+        const duplicated = [];
+        for (const v of got) {
+          if (seen.has(v))
+            duplicated.push(v);
+          else
+            seen.add(v);
+        }
+        if (missing.length === 0 && unknown.length === 0 && duplicated.length === 0)
+          return [];
+        const parts = [];
+        if (missing.length)
+          parts.push(`missing ${subject}(s): [${missing.join(", ")}]`);
+        if (unknown.length)
+          parts.push(`not a known ${subject}: [${unknown.join(", ")}]`);
+        if (duplicated.length)
+          parts.push(`assessed more than once: [${[...new Set(duplicated)].join(", ")}]`);
+        return [
+          `every ${subject} must be covered exactly once \u2014 ${parts.join("; ")}. Return one entry per ${subject}, using its exact id.`
+        ];
+      },
+      /**
+       * `non_empty_when` — the array at `path` must be non-empty, optionally only
+       * when `when.path` equals `when.equals`. Params:
+       * `{ path: <output path>, when?: { path: <output path>, equals: <value> } }`.
+       */
+      non_empty_when(params, output) {
+        const when = params.when;
+        if (when && typeof when.path === "string") {
+          if (resolvePath(output, when.path) !== when.equals)
+            return [];
+        }
+        const path = String(params.path);
+        const value = resolvePath(output, path);
+        if (Array.isArray(value) && value.length > 0)
+          return [];
+        const cond = when && typeof when.path === "string" ? ` when ${when.path} is ${JSON.stringify(when.equals)}` : "";
+        return [
+          `'${path}' must be a non-empty array${cond}; it was ${Array.isArray(value) ? "empty" : "absent"}.`
+        ];
+      },
+      /**
+       * `bounded_palette` — every colour in the sources at `path` must be named
+       * by role rather than written as a value. Params:
+       * `{ path: <output path>, roles?: <role names for the repair turn> }`.
+       *
+       * A drawing the model authors is markup the house did not write, and a
+       * literal in it is a colour outside the consuming palette: unproved
+       * against the colours beside it, unchecked for contrast on the ground it
+       * lands on, and fixed to one theme. The consumer strips such a paint at
+       * render, so an artifact that carries one silently loses it. Catching it
+       * HERE is what makes that a repair the model can make while it still has
+       * the drawing in hand, instead of a defect nobody sees until the picture
+       * comes out plain.
+       */
+      bounded_palette(params, output) {
+        const path = String(params.path);
+        const value = resolvePath(output, path);
+        const sources = (Array.isArray(value) ? value : [value]).filter((v) => typeof v === "string" && v.length > 0);
+        const offenders = [...new Set(sources.flatMap(unsanctionedPaints))];
+        if (offenders.length === 0)
+          return [];
+        const roles = Array.isArray(params.roles) ? params.roles.map(String) : [];
+        const vocabulary = roles.length > 0 ? ` Use one of: ${roles.join(", ")}.` : "";
+        return [
+          `'${path}' states ${offenders.length} colour value${offenders.length === 1 ? "" : "s"} directly (${offenders.slice(0, 8).join(", ")}${offenders.length > 8 ? ", \u2026" : ""}). Every colour must be named by role \u2014 var(--color-\u2026), currentColor, or none \u2014 never as a hex, rgb(), hsl() or colour name, because a value cannot adapt to the reader's theme and was never checked against the colours beside it.${vocabulary} Redraw with roles and return the whole output again.`
+        ];
+      }
+    };
+    function evaluateOutputGates(gates, output, inputs) {
+      const findings = [];
+      for (const gate of gates) {
+        const primitive = PRIMITIVES[gate.primitive];
+        if (!primitive) {
+          findings.push({ gate: gate.name, message: `unknown gate primitive '${gate.primitive}'` });
+          continue;
+        }
+        for (const message of primitive(gate.params, output, inputs)) {
+          findings.push({ gate: gate.name, message });
+        }
+      }
+      return { ok: findings.length === 0, findings };
+    }
+    function renderRepairPrompt(findings) {
+      return [
+        "Your previous answer did not satisfy these output checks. Return the corrected, complete answer that resolves every item below. Produce the same output shape with the problems fixed, and nothing else \u2014 no commentary, no explanation of the changes.",
+        "",
+        ...findings.map((f) => `- [${f.gate}] ${f.message}`)
+      ].join("\n");
+    }
+  }
+});
+
+// ../../packages/shuttle/dist/logging/logger.js
+var require_logger = __commonJS({
+  "../../packages/shuttle/dist/logging/logger.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.createLogger = createLogger;
+    exports2.setGlobalLogger = setGlobalLogger;
+    exports2.getLogger = getLogger;
+    var LEVEL_ORDER = {
+      debug: 0,
+      info: 1,
+      warn: 2,
+      error: 3
+    };
+    function formatContext(context) {
+      return Object.entries(context).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(" ");
+    }
+    function formatPretty(level, message, context) {
+      const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+      const tag = level.toUpperCase().padEnd(5);
+      const base = `[${timestamp}] ${tag} ${message}`;
+      if (context && Object.keys(context).length > 0) {
+        return `${base} ${formatContext(context)}`;
+      }
+      return base;
+    }
+    function formatJson(level, message, context) {
+      const entry = {
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        level,
+        message,
+        ...context
+      };
+      return JSON.stringify(entry);
+    }
+    function createLogger(options) {
+      const threshold = LEVEL_ORDER[options.level];
+      const format = options.format === "json" ? formatJson : formatPretty;
+      function emit(level, message, context) {
+        if (LEVEL_ORDER[level] < threshold)
+          return;
+        const line = format(level, message, context);
+        if (level === "error") {
+          console.error(line);
+        } else if (level === "warn") {
+          console.warn(line);
+        } else {
+          console.log(line);
+        }
+      }
+      return {
+        debug: (message, context) => emit("debug", message, context),
+        info: (message, context) => emit("info", message, context),
+        warn: (message, context) => emit("warn", message, context),
+        error: (message, context) => emit("error", message, context)
+      };
+    }
+    var globalLogger = createLogger({ level: "info", format: "pretty" });
+    function setGlobalLogger(logger) {
+      globalLogger = logger;
+    }
+    function getLogger() {
+      return globalLogger;
+    }
+  }
+});
+
+// ../../packages/shuttle/dist/workspace/git.js
+var require_git = __commonJS({
+  "../../packages/shuttle/dist/workspace/git.js"(exports2) {
+    "use strict";
+    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.gitMaterializer = void 0;
+    exports2.buildGitAuthEnv = buildGitAuthEnv;
+    var child_process_1 = require("child_process");
+    var fs_1 = require("fs");
+    var path_1 = __importDefault(require("path"));
+    var DEFAULT_GIT_TIMEOUT_MS = 12e4;
+    var DEFAULT_GIT_PROTOCOLS = "https:ssh:git";
+    var DEFAULT_MAX_CONTEXT_REPOS = 5;
+    exports2.gitMaterializer = {
+      namespace: "git",
+      materialize: materializeGit
+    };
+    async function materializeGit(request, runRoot, options) {
+      const resolvedPrimary = readGitWorkspace(request);
+      const primaryDir = path_1.default.join(runRoot, "primary");
+      await fs_1.promises.mkdir(primaryDir, { recursive: true });
+      if ("warning" in resolvedPrimary) {
+        return { materialized: false, warning: resolvedPrimary.warning, context: [] };
+      }
+      const primary = resolvedPrimary.git;
+      const timeoutMs = options.commandTimeoutMs ?? DEFAULT_GIT_TIMEOUT_MS;
+      const allowedProtocols = options.allowedProtocols ?? DEFAULT_GIT_PROTOCOLS;
+      const signal = options.signal;
+      const maxContext = options.maxContextRepos ?? DEFAULT_MAX_CONTEXT_REPOS;
+      const contextPlan = planContextRepos(primary.context, maxContext);
+      const ref = primary.fetchCredential;
+      let gitToken = null;
+      if (ref && typeof ref.name === "string" && typeof ref.principal === "string" && options.credentials) {
+        try {
+          gitToken = await options.credentials.reveal(ref);
+        } catch {
+          gitToken = null;
+        }
+      }
+      const authEnv = gitToken !== null ? buildGitAuthEnv([primary.remote, ...contextPlan.materialize.map((c) => c.git.remote)], gitToken) : void 0;
+      const git = (args, cwd) => runGit(args, cwd, { timeoutMs, signal, allowedProtocols, extraEnv: authEnv });
+      const primaryResult = await materializeCommit(primary, primaryDir, git);
+      if (!primaryResult.ok) {
+        await fs_1.promises.rm(primaryDir, { recursive: true, force: true }).catch(() => {
+        });
+        await fs_1.promises.mkdir(primaryDir).catch(() => {
+        });
+        return { materialized: false, warning: primaryResult.warning, context: [] };
+      }
+      const context = [];
+      for (const planned of contextPlan.skip) {
+        context.push({ ...planned, materialized: false });
+      }
+      if (contextPlan.materialize.length > 0) {
+        const contextRoot = path_1.default.join(runRoot, "context");
+        await fs_1.promises.mkdir(contextRoot, { recursive: true });
+        for (const entry of contextPlan.materialize) {
+          const dir = path_1.default.join(contextRoot, entry.name);
+          await fs_1.promises.mkdir(dir);
+          const result = await materializeCommit(entry.git, dir, git);
+          context.push({
+            name: entry.name,
+            requestedName: entry.requestedName,
+            materialized: result.ok,
+            ...result.ok ? {} : { warning: result.warning }
+          });
         }
       }
       context.sort((a, b) => contextOrder(contextPlan, a.requestedName) - contextOrder(contextPlan, b.requestedName));
@@ -26522,448 +26842,321 @@ var require_overlay = __commonJS({
             throw new Error("overlay file exceeds size cap");
           chunks.push(buf);
         }
-        return Buffer.concat(chunks);
-      } finally {
-        clearTimeout(timer);
-        opts.signal?.removeEventListener("abort", onParentAbort);
-      }
-    }
-  }
-});
-
-// ../../packages/shuttle/dist/workspace/materialize.js
-var require_materialize = __commonJS({
-  "../../packages/shuttle/dist/workspace/materialize.js"(exports2) {
-    "use strict";
-    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { "default": mod };
-    };
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.registerMaterializer = registerMaterializer;
-    exports2.registerModifier = registerModifier;
-    exports2.materializeWorkspace = materializeWorkspace;
-    var fs_1 = require("fs");
-    var os_1 = __importDefault(require("os"));
-    var path_1 = __importDefault(require("path"));
-    var git_1 = require_git();
-    var overlay_1 = require_overlay();
-    var materializers = /* @__PURE__ */ new Map();
-    var modifiers = /* @__PURE__ */ new Map();
-    function registerMaterializer(provider) {
-      materializers.set(provider.namespace, provider);
-    }
-    function registerModifier(provider) {
-      modifiers.set(provider.namespace, provider);
-    }
-    registerMaterializer(git_1.gitMaterializer);
-    registerModifier(overlay_1.overlayModifier);
-    async function materializeWorkspace(bag, options = {}) {
-      const tmpBase = options.tmpDir ?? os_1.default.tmpdir();
-      const runRoot = await fs_1.promises.mkdtemp(path_1.default.join(tmpBase, "shuttle-ws-"));
-      const cleanup = async () => {
-        await fs_1.promises.rm(runRoot, { recursive: true, force: true }).catch(() => {
-        });
-      };
-      let materialized = false;
-      let primaryDir;
-      let warning;
-      let context = [];
-      let ranBase = false;
-      for (const [namespace, provider] of materializers) {
-        if (bag[namespace] !== void 0) {
-          const outcome = await provider.materialize(bag[namespace], runRoot, options);
-          materialized = outcome.materialized;
-          primaryDir = outcome.primaryDir;
-          warning = outcome.warning;
-          context = outcome.context;
-          ranBase = true;
-          break;
-        }
-      }
-      if (!ranBase) {
-        const offered = Object.keys(bag).join(", ") || "(none)";
-        await fs_1.promises.mkdir(path_1.default.join(runRoot, "primary"), { recursive: true }).catch(() => {
-        });
-        warning = `workspace carries no materializer this runner understands (offered: ${offered}; supported: ${[...materializers.keys()].join(", ")})`;
-      }
-      let overlay;
-      for (const [namespace, provider] of modifiers) {
-        if (bag[namespace] !== void 0) {
-          overlay = await provider.apply(bag[namespace], runRoot, options);
-        }
-      }
-      return { cwd: runRoot, materialized, primaryDir, warning, context, overlay, cleanup };
-    }
-  }
-});
-
-// ../../packages/shuttle/dist/workspace/index.js
-var require_workspace = __commonJS({
-  "../../packages/shuttle/dist/workspace/index.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.applyOverlay = exports2.overlayModifier = exports2.buildGitAuthEnv = exports2.gitMaterializer = exports2.registerModifier = exports2.registerMaterializer = exports2.materializeWorkspace = void 0;
-    var materialize_1 = require_materialize();
-    Object.defineProperty(exports2, "materializeWorkspace", { enumerable: true, get: function() {
-      return materialize_1.materializeWorkspace;
-    } });
-    Object.defineProperty(exports2, "registerMaterializer", { enumerable: true, get: function() {
-      return materialize_1.registerMaterializer;
-    } });
-    Object.defineProperty(exports2, "registerModifier", { enumerable: true, get: function() {
-      return materialize_1.registerModifier;
-    } });
-    var git_1 = require_git();
-    Object.defineProperty(exports2, "gitMaterializer", { enumerable: true, get: function() {
-      return git_1.gitMaterializer;
-    } });
-    Object.defineProperty(exports2, "buildGitAuthEnv", { enumerable: true, get: function() {
-      return git_1.buildGitAuthEnv;
-    } });
-    var overlay_1 = require_overlay();
-    Object.defineProperty(exports2, "overlayModifier", { enumerable: true, get: function() {
-      return overlay_1.overlayModifier;
-    } });
-    Object.defineProperty(exports2, "applyOverlay", { enumerable: true, get: function() {
-      return overlay_1.applyOverlay;
-    } });
-  }
-});
-
-// ../../packages/shuttle/dist/credentials/registry.js
-var require_registry2 = __commonJS({
-  "../../packages/shuttle/dist/credentials/registry.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.registerCredentialResolver = registerCredentialResolver;
-    exports2.getCredentialResolver = getCredentialResolver;
-    var resolvers = /* @__PURE__ */ new Map();
-    function registerCredentialResolver(name, resolver) {
-      resolvers.set(name, resolver);
-    }
-    function getCredentialResolver(name) {
-      return resolvers.get(name);
-    }
-    registerCredentialResolver("managed-model-key", async (keep, principal) => {
-      const reveal = await keep.revealManagedSifterKey(principal);
-      return reveal.apiKey;
-    });
-    registerCredentialResolver("github-user-token", async (keep, principal) => {
-      try {
-        const reveal = await keep.getUserGithubToken(principal);
-        return reveal.access_token;
-      } catch {
-        return null;
-      }
-    });
-  }
-});
-
-// ../../packages/shuttle/dist/credentials/broker.js
-var require_broker = __commonJS({
-  "../../packages/shuttle/dist/credentials/broker.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.createCredentialBroker = createCredentialBroker;
-    var keep_1 = require_dist2();
-    var env_ref_1 = require_env_ref();
-    var registry_1 = require_registry2();
-    function createCredentialBroker(config, deps = {}) {
-      if (typeof config !== "object" || config === null || config.apiKeyFrom !== "job-metadata") {
-        return null;
-      }
-      const cfg = config;
-      const keepApiUrl = (0, env_ref_1.resolveConfigStringOrEnv)(cfg, "keepApiUrl", "KEEP_API_URL");
-      const clientId = (0, env_ref_1.resolveConfigStringOrEnv)(cfg, "keepClientId", "KEEP_CLIENT_ID");
-      const clientSecret = (0, env_ref_1.resolveConfigStringOrEnv)(cfg, "keepClientSecret", "KEEP_CLIENT_SECRET");
-      const stmFactory = deps.buildServiceTokenManager ?? ((c) => new keep_1.ServiceTokenManager(c));
-      const stm = stmFactory({ keepApiUrl, clientId, clientSecret });
-      const keepFactory = deps.buildKeepClient ?? ((c) => new keep_1.KeepClient(c));
-      return {
-        async reveal({ name, principal }) {
-          const resolver = (0, registry_1.getCredentialResolver)(name);
-          if (!resolver)
-            return null;
-          const serviceToken = await stm.getToken();
-          if (!serviceToken) {
-            throw new Error("credential broker: Keep service-token exchange failed. Check KEEP_CLIENT_ID / KEEP_CLIENT_SECRET.");
-          }
-          const keep = keepFactory({ baseUrl: keepApiUrl, serviceToken });
-          return resolver(keep, principal);
-        }
-      };
+        return Buffer.concat(chunks);
+      } finally {
+        clearTimeout(timer);
+        opts.signal?.removeEventListener("abort", onParentAbort);
+      }
     }
   }
 });
 
-// ../../packages/shuttle/dist/credentials/index.js
-var require_credentials = __commonJS({
-  "../../packages/shuttle/dist/credentials/index.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.getCredentialResolver = exports2.registerCredentialResolver = exports2.createCredentialBroker = void 0;
-    var broker_1 = require_broker();
-    Object.defineProperty(exports2, "createCredentialBroker", { enumerable: true, get: function() {
-      return broker_1.createCredentialBroker;
-    } });
-    var registry_1 = require_registry2();
-    Object.defineProperty(exports2, "registerCredentialResolver", { enumerable: true, get: function() {
-      return registry_1.registerCredentialResolver;
-    } });
-    Object.defineProperty(exports2, "getCredentialResolver", { enumerable: true, get: function() {
-      return registry_1.getCredentialResolver;
-    } });
-  }
-});
-
-// ../../packages/shuttle/dist/executors/output-gates.js
-var require_output_gates = __commonJS({
-  "../../packages/shuttle/dist/executors/output-gates.js"(exports2) {
+// ../../packages/shuttle/dist/workspace/materialize.js
+var require_materialize = __commonJS({
+  "../../packages/shuttle/dist/workspace/materialize.js"(exports2) {
     "use strict";
+    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.isSanctionedPaint = isSanctionedPaint;
-    exports2.unsanctionedPaints = unsanctionedPaints;
-    exports2.resolvePath = resolvePath;
-    exports2.evaluateOutputGates = evaluateOutputGates;
-    exports2.renderRepairPrompt = renderRepairPrompt;
-    var INPUT_REF = "input:";
-    var COLOR_BEARING = ["fill", "stroke", "color", "stop-color", "flood-color", "lighting-color"];
-    var INERT = /* @__PURE__ */ new Set(["none", "inherit", "initial", "unset", "transparent", "currentcolor"]);
-    function isSanctionedPaint(raw) {
-      const value = raw.trim().toLowerCase();
-      if (value === "")
-        return true;
-      if (INERT.has(value))
-        return true;
-      if (/^url\(\s*['"]?#[^)'"]+['"]?\s*\)$/.test(value))
-        return true;
-      const varMatch = /^var\(\s*(--[a-z0-9-]+)\s*(?:,([\s\S]*))?\)$/.exec(value);
-      if (!varMatch)
-        return false;
-      const [, name, fallback] = varMatch;
-      if (!name.startsWith("--color-"))
-        return false;
-      return fallback === void 0 || isSanctionedPaint(fallback);
+    exports2.registerMaterializer = registerMaterializer;
+    exports2.registerModifier = registerModifier;
+    exports2.materializeWorkspace = materializeWorkspace;
+    var fs_1 = require("fs");
+    var os_1 = __importDefault(require("os"));
+    var path_1 = __importDefault(require("path"));
+    var git_1 = require_git();
+    var overlay_1 = require_overlay();
+    var materializers = /* @__PURE__ */ new Map();
+    var modifiers = /* @__PURE__ */ new Map();
+    function registerMaterializer(provider) {
+      materializers.set(provider.namespace, provider);
     }
-    function unsanctionedPaints(source) {
-      const found = [];
-      const attrs = COLOR_BEARING.join("|");
-      const attribute = new RegExp(`\\b(?:${attrs})\\s*=\\s*(['"])([\\s\\S]*?)\\1`, "gi");
-      const declaration = new RegExp(`\\b(?:${attrs})\\s*:\\s*([^;"'}\\n]+)`, "gi");
-      for (const [, , value] of source.matchAll(attribute)) {
-        if (!isSanctionedPaint(value))
-          found.push(value.trim());
-      }
-      for (const [, value] of source.matchAll(declaration)) {
-        if (!isSanctionedPaint(value))
-          found.push(value.trim());
-      }
-      return found;
+    function registerModifier(provider) {
+      modifiers.set(provider.namespace, provider);
     }
-    function resolvePath(root, path) {
-      let ctx = root;
-      for (const seg of path.split(".")) {
-        const project = seg.endsWith("[*]");
-        const key = project ? seg.slice(0, -3) : seg;
-        if (Array.isArray(ctx)) {
-          ctx = ctx.map((el) => key ? el?.[key] : el);
-        } else {
-          ctx = key ? ctx?.[key] : ctx;
-        }
-        if (project && !Array.isArray(ctx)) {
-          ctx = ctx == null ? [] : [ctx];
+    registerMaterializer(git_1.gitMaterializer);
+    registerModifier(overlay_1.overlayModifier);
+    async function materializeWorkspace(bag, options = {}) {
+      const tmpBase = options.tmpDir ?? os_1.default.tmpdir();
+      const runRoot = await fs_1.promises.mkdtemp(path_1.default.join(tmpBase, "shuttle-ws-"));
+      const cleanup = async () => {
+        await fs_1.promises.rm(runRoot, { recursive: true, force: true }).catch(() => {
+        });
+      };
+      let materialized = false;
+      let primaryDir;
+      let warning;
+      let context = [];
+      let ranBase = false;
+      for (const [namespace, provider] of materializers) {
+        if (bag[namespace] !== void 0) {
+          const outcome = await provider.materialize(bag[namespace], runRoot, options);
+          materialized = outcome.materialized;
+          primaryDir = outcome.primaryDir;
+          warning = outcome.warning;
+          context = outcome.context;
+          ranBase = true;
+          break;
         }
       }
-      return ctx;
-    }
-    function resolveRef(ref, output, inputs) {
-      if (ref.startsWith(INPUT_REF)) {
-        const label = ref.slice(INPUT_REF.length);
-        const row = inputs.find((i) => i.label === label) ?? inputs.find((i) => i.label === "artifacts" && i.payload.label === label);
-        if (!row)
-          return void 0;
-        return Object.prototype.hasOwnProperty.call(row.payload, "value") ? row.payload.value : row.payload;
+      if (!ranBase) {
+        const offered = Object.keys(bag).join(", ") || "(none)";
+        await fs_1.promises.mkdir(path_1.default.join(runRoot, "primary"), { recursive: true }).catch(() => {
+        });
+        warning = `workspace carries no materializer this runner understands (offered: ${offered}; supported: ${[...materializers.keys()].join(", ")})`;
       }
-      return resolvePath(output, ref);
-    }
-    function asStrings(value) {
-      if (Array.isArray(value))
-        return value.map((v) => String(v));
-      if (value == null)
-        return [];
-      return [String(value)];
-    }
-    var PRIMITIVES = {
-      /**
-       * `coverage` — the values at `got` must exactly cover the set at `want`:
-       * every wanted value present, nothing invented, none repeated. Params:
-       * `{ got: <output path>, want: <ref>, subject?: <noun> }`.
-       */
-      coverage(params, output, inputs) {
-        const subject = typeof params.subject === "string" ? params.subject : "item";
-        const got = asStrings(resolveRef(String(params.got), output, inputs));
-        const want = asStrings(resolveRef(String(params.want), output, inputs));
-        const gotSet = new Set(got);
-        const wantSet = new Set(want);
-        const missing = want.filter((v) => !gotSet.has(v));
-        const unknown = [...new Set(got.filter((v) => !wantSet.has(v)))];
-        const seen = /* @__PURE__ */ new Set();
-        const duplicated = [];
-        for (const v of got) {
-          if (seen.has(v))
-            duplicated.push(v);
-          else
-            seen.add(v);
-        }
-        if (missing.length === 0 && unknown.length === 0 && duplicated.length === 0)
-          return [];
-        const parts = [];
-        if (missing.length)
-          parts.push(`missing ${subject}(s): [${missing.join(", ")}]`);
-        if (unknown.length)
-          parts.push(`not a known ${subject}: [${unknown.join(", ")}]`);
-        if (duplicated.length)
-          parts.push(`assessed more than once: [${[...new Set(duplicated)].join(", ")}]`);
-        return [
-          `every ${subject} must be covered exactly once \u2014 ${parts.join("; ")}. Return one entry per ${subject}, using its exact id.`
-        ];
-      },
-      /**
-       * `non_empty_when` — the array at `path` must be non-empty, optionally only
-       * when `when.path` equals `when.equals`. Params:
-       * `{ path: <output path>, when?: { path: <output path>, equals: <value> } }`.
-       */
-      non_empty_when(params, output) {
-        const when = params.when;
-        if (when && typeof when.path === "string") {
-          if (resolvePath(output, when.path) !== when.equals)
-            return [];
+      let overlay;
+      for (const [namespace, provider] of modifiers) {
+        if (bag[namespace] !== void 0) {
+          overlay = await provider.apply(bag[namespace], runRoot, options);
         }
-        const path = String(params.path);
-        const value = resolvePath(output, path);
-        if (Array.isArray(value) && value.length > 0)
-          return [];
-        const cond = when && typeof when.path === "string" ? ` when ${when.path} is ${JSON.stringify(when.equals)}` : "";
-        return [
-          `'${path}' must be a non-empty array${cond}; it was ${Array.isArray(value) ? "empty" : "absent"}.`
-        ];
-      },
-      /**
-       * `bounded_palette` — every colour in the sources at `path` must be named
-       * by role rather than written as a value. Params:
-       * `{ path: <output path>, roles?: <role names for the repair turn> }`.
-       *
-       * A drawing the model authors is markup the house did not write, and a
-       * literal in it is a colour outside the consuming palette: unproved
-       * against the colours beside it, unchecked for contrast on the ground it
-       * lands on, and fixed to one theme. The consumer strips such a paint at
-       * render, so an artifact that carries one silently loses it. Catching it
-       * HERE is what makes that a repair the model can make while it still has
-       * the drawing in hand, instead of a defect nobody sees until the picture
-       * comes out plain.
-       */
-      bounded_palette(params, output) {
-        const path = String(params.path);
-        const value = resolvePath(output, path);
-        const sources = (Array.isArray(value) ? value : [value]).filter((v) => typeof v === "string" && v.length > 0);
-        const offenders = [...new Set(sources.flatMap(unsanctionedPaints))];
-        if (offenders.length === 0)
-          return [];
-        const roles = Array.isArray(params.roles) ? params.roles.map(String) : [];
-        const vocabulary = roles.length > 0 ? ` Use one of: ${roles.join(", ")}.` : "";
-        return [
-          `'${path}' states ${offenders.length} colour value${offenders.length === 1 ? "" : "s"} directly (${offenders.slice(0, 8).join(", ")}${offenders.length > 8 ? ", \u2026" : ""}). Every colour must be named by role \u2014 var(--color-\u2026), currentColor, or none \u2014 never as a hex, rgb(), hsl() or colour name, because a value cannot adapt to the reader's theme and was never checked against the colours beside it.${vocabulary} Redraw with roles and return the whole output again.`
-        ];
       }
-    };
-    function evaluateOutputGates(gates, output, inputs) {
-      const findings = [];
-      for (const gate of gates) {
-        const primitive = PRIMITIVES[gate.primitive];
-        if (!primitive) {
-          findings.push({ gate: gate.name, message: `unknown gate primitive '${gate.primitive}'` });
-          continue;
+      return { cwd: runRoot, materialized, primaryDir, warning, context, overlay, cleanup };
+    }
+  }
+});
+
+// ../../packages/shuttle/dist/workspace/index.js
+var require_workspace = __commonJS({
+  "../../packages/shuttle/dist/workspace/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.applyOverlay = exports2.overlayModifier = exports2.buildGitAuthEnv = exports2.gitMaterializer = exports2.registerModifier = exports2.registerMaterializer = exports2.materializeWorkspace = void 0;
+    var materialize_1 = require_materialize();
+    Object.defineProperty(exports2, "materializeWorkspace", { enumerable: true, get: function() {
+      return materialize_1.materializeWorkspace;
+    } });
+    Object.defineProperty(exports2, "registerMaterializer", { enumerable: true, get: function() {
+      return materialize_1.registerMaterializer;
+    } });
+    Object.defineProperty(exports2, "registerModifier", { enumerable: true, get: function() {
+      return materialize_1.registerModifier;
+    } });
+    var git_1 = require_git();
+    Object.defineProperty(exports2, "gitMaterializer", { enumerable: true, get: function() {
+      return git_1.gitMaterializer;
+    } });
+    Object.defineProperty(exports2, "buildGitAuthEnv", { enumerable: true, get: function() {
+      return git_1.buildGitAuthEnv;
+    } });
+    var overlay_1 = require_overlay();
+    Object.defineProperty(exports2, "overlayModifier", { enumerable: true, get: function() {
+      return overlay_1.overlayModifier;
+    } });
+    Object.defineProperty(exports2, "applyOverlay", { enumerable: true, get: function() {
+      return overlay_1.applyOverlay;
+    } });
+  }
+});
+
+// ../../packages/shuttle/dist/core/run-dispatch.js
+var require_run_dispatch = __commonJS({
+  "../../packages/shuttle/dist/core/run-dispatch.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.GATE_REPAIR_BUDGET = void 0;
+    exports2.runDispatch = runDispatch;
+    exports2.runOutputGates = runOutputGates;
+    exports2.mergeRepairedResponse = mergeRepairedResponse;
+    var loom_1 = require_dist();
+    var output_gates_1 = require_output_gates();
+    var logger_1 = require_logger();
+    var workspace_1 = require_workspace();
+    exports2.GATE_REPAIR_BUDGET = 2;
+    async function runDispatch(dispatch, executor, options) {
+      const { credentials, signal } = options;
+      const environment = executor.prepareEnvironment ? await executor.prepareEnvironment(dispatch) : void 0;
+      let workspace = null;
+      if (environment?.workspaceRequest) {
+        try {
+          workspace = await (0, workspace_1.materializeWorkspace)(environment.workspaceRequest, {
+            ...environment.materializeOptions ?? {},
+            credentials,
+            signal
+          });
+        } catch (err) {
+          (0, logger_1.getLogger)().warn("workspace materialization failed; running prompt-only", {
+            jobId: dispatch.job.id,
+            error: err instanceof Error ? err.message : String(err)
+          });
+          workspace = null;
         }
-        for (const message of primitive(gate.params, output, inputs)) {
-          findings.push({ gate: gate.name, message });
+      }
+      const ctx = {
+        ...options.reportProgress ? { reportProgress: options.reportProgress } : {},
+        workspace,
+        credentials
+      };
+      let response;
+      try {
+        response = await executor.execute(dispatch, signal, ctx);
+      } catch (error) {
+        return { kind: "executor-failed", error };
+      } finally {
+        if (workspace)
+          await workspace.cleanup();
+      }
+      const gated = await runOutputGates(dispatch, response, executor, signal, ctx);
+      if (!gated.ok)
+        return { kind: "gate-failed", reason: gated.reason };
+      return { kind: "completed", response: gated.response };
+    }
+    async function runOutputGates(dispatch, response, executor, signal, ctx) {
+      let spec;
+      try {
+        spec = (0, loom_1.readPromptExecutionSpec)(dispatch.inputs);
+      } catch {
+        return { ok: true, response };
+      }
+      const gates = spec.gates;
+      if (!gates || gates.length === 0)
+        return { ok: true, response };
+      let current = response;
+      let result = (0, output_gates_1.evaluateOutputGates)(gates, current.parsed ?? {}, dispatch.inputs);
+      let attempts = 0;
+      while (!result.ok && attempts < exports2.GATE_REPAIR_BUDGET && current.continuation !== void 0 && typeof executor.continue === "function") {
+        try {
+          const repaired = await executor.continue(current.continuation, (0, output_gates_1.renderRepairPrompt)(result.findings), signal, ctx);
+          current = mergeRepairedResponse(current, repaired);
+        } catch {
+          break;
         }
+        result = (0, output_gates_1.evaluateOutputGates)(gates, current.parsed ?? {}, dispatch.inputs);
+        attempts += 1;
       }
-      return { ok: findings.length === 0, findings };
+      if (result.ok)
+        return { ok: true, response: current };
+      const detail = result.findings.map((f) => `[${f.gate}] ${f.message}`).join(" | ");
+      return {
+        ok: false,
+        reason: `output gate(s) failed${attempts > 0 ? ` after ${attempts} repair attempt(s)` : ""}: ${detail}`
+      };
     }
-    function renderRepairPrompt(findings) {
-      return [
-        "Your previous answer did not satisfy these output checks. Return the corrected, complete answer that resolves every item below. Produce the same output shape with the problems fixed, and nothing else \u2014 no commentary, no explanation of the changes.",
-        "",
-        ...findings.map((f) => `- [${f.gate}] ${f.message}`)
-      ].join("\n");
+    function mergeRepairedResponse(original, repaired) {
+      const replaced = new Set(repaired.outputs.map((o) => o.label));
+      const outputs = [...original.outputs.filter((o) => !replaced.has(o.label)), ...repaired.outputs];
+      const usage = sumUsage(original.usage, repaired.usage);
+      return {
+        ...original,
+        ...repaired,
+        outputs,
+        ...usage ? { usage } : {}
+      };
+    }
+    var ADDITIVE_USAGE = [
+      "inputTokens",
+      "outputTokens",
+      "cacheReadInputTokens",
+      "cacheCreationInputTokens",
+      "costUsd",
+      "turns"
+    ];
+    function sumUsage(a, b) {
+      if (!a)
+        return b;
+      if (!b)
+        return a;
+      const sum = { ...a, ...b };
+      for (const key of ADDITIVE_USAGE) {
+        if (a[key] === void 0 && b[key] === void 0)
+          continue;
+        sum[key] = (a[key] ?? 0) + (b[key] ?? 0);
+      }
+      if (a.toolCalls || b.toolCalls) {
+        const calls = { ...a.toolCalls ?? {} };
+        for (const [name, n] of Object.entries(b.toolCalls ?? {}))
+          calls[name] = (calls[name] ?? 0) + n;
+        sum.toolCalls = calls;
+      }
+      return sum;
     }
   }
 });
 
-// ../../packages/shuttle/dist/logging/logger.js
-var require_logger = __commonJS({
-  "../../packages/shuttle/dist/logging/logger.js"(exports2) {
+// ../../packages/shuttle/dist/credentials/registry.js
+var require_registry2 = __commonJS({
+  "../../packages/shuttle/dist/credentials/registry.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.createLogger = createLogger;
-    exports2.setGlobalLogger = setGlobalLogger;
-    exports2.getLogger = getLogger;
-    var LEVEL_ORDER = {
-      debug: 0,
-      info: 1,
-      warn: 2,
-      error: 3
-    };
-    function formatContext(context) {
-      return Object.entries(context).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(" ");
-    }
-    function formatPretty(level, message, context) {
-      const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-      const tag = level.toUpperCase().padEnd(5);
-      const base = `[${timestamp}] ${tag} ${message}`;
-      if (context && Object.keys(context).length > 0) {
-        return `${base} ${formatContext(context)}`;
-      }
-      return base;
+    exports2.registerCredentialResolver = registerCredentialResolver;
+    exports2.getCredentialResolver = getCredentialResolver;
+    var resolvers = /* @__PURE__ */ new Map();
+    function registerCredentialResolver(name, resolver) {
+      resolvers.set(name, resolver);
     }
-    function formatJson(level, message, context) {
-      const entry = {
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        level,
-        message,
-        ...context
-      };
-      return JSON.stringify(entry);
+    function getCredentialResolver(name) {
+      return resolvers.get(name);
     }
-    function createLogger(options) {
-      const threshold = LEVEL_ORDER[options.level];
-      const format = options.format === "json" ? formatJson : formatPretty;
-      function emit(level, message, context) {
-        if (LEVEL_ORDER[level] < threshold)
-          return;
-        const line = format(level, message, context);
-        if (level === "error") {
-          console.error(line);
-        } else if (level === "warn") {
-          console.warn(line);
-        } else {
-          console.log(line);
-        }
+    registerCredentialResolver("managed-model-key", async (keep, principal) => {
+      const reveal = await keep.revealManagedSifterKey(principal);
+      return reveal.apiKey;
+    });
+    registerCredentialResolver("github-user-token", async (keep, principal) => {
+      try {
+        const reveal = await keep.getUserGithubToken(principal);
+        return reveal.access_token;
+      } catch {
+        return null;
+      }
+    });
+  }
+});
+
+// ../../packages/shuttle/dist/credentials/broker.js
+var require_broker = __commonJS({
+  "../../packages/shuttle/dist/credentials/broker.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.createCredentialBroker = createCredentialBroker;
+    var keep_1 = require_dist2();
+    var env_ref_1 = require_env_ref();
+    var registry_1 = require_registry2();
+    function createCredentialBroker(config, deps = {}) {
+      if (typeof config !== "object" || config === null || config.apiKeyFrom !== "job-metadata") {
+        return null;
       }
+      const cfg = config;
+      const keepApiUrl = (0, env_ref_1.resolveConfigStringOrEnv)(cfg, "keepApiUrl", "KEEP_API_URL");
+      const clientId = (0, env_ref_1.resolveConfigStringOrEnv)(cfg, "keepClientId", "KEEP_CLIENT_ID");
+      const clientSecret = (0, env_ref_1.resolveConfigStringOrEnv)(cfg, "keepClientSecret", "KEEP_CLIENT_SECRET");
+      const stmFactory = deps.buildServiceTokenManager ?? ((c) => new keep_1.ServiceTokenManager(c));
+      const stm = stmFactory({ keepApiUrl, clientId, clientSecret });
+      const keepFactory = deps.buildKeepClient ?? ((c) => new keep_1.KeepClient(c));
       return {
-        debug: (message, context) => emit("debug", message, context),
-        info: (message, context) => emit("info", message, context),
-        warn: (message, context) => emit("warn", message, context),
-        error: (message, context) => emit("error", message, context)
+        async reveal({ name, principal }) {
+          const resolver = (0, registry_1.getCredentialResolver)(name);
+          if (!resolver)
+            return null;
+          const serviceToken = await stm.getToken();
+          if (!serviceToken) {
+            throw new Error("credential broker: Keep service-token exchange failed. Check KEEP_CLIENT_ID / KEEP_CLIENT_SECRET.");
+          }
+          const keep = keepFactory({ baseUrl: keepApiUrl, serviceToken });
+          return resolver(keep, principal);
+        }
       };
     }
-    var globalLogger = createLogger({ level: "info", format: "pretty" });
-    function setGlobalLogger(logger) {
-      globalLogger = logger;
-    }
-    function getLogger() {
-      return globalLogger;
-    }
+  }
+});
+
+// ../../packages/shuttle/dist/credentials/index.js
+var require_credentials = __commonJS({
+  "../../packages/shuttle/dist/credentials/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.getCredentialResolver = exports2.registerCredentialResolver = exports2.createCredentialBroker = void 0;
+    var broker_1 = require_broker();
+    Object.defineProperty(exports2, "createCredentialBroker", { enumerable: true, get: function() {
+      return broker_1.createCredentialBroker;
+    } });
+    var registry_1 = require_registry2();
+    Object.defineProperty(exports2, "registerCredentialResolver", { enumerable: true, get: function() {
+      return registry_1.registerCredentialResolver;
+    } });
+    Object.defineProperty(exports2, "getCredentialResolver", { enumerable: true, get: function() {
+      return registry_1.getCredentialResolver;
+    } });
   }
 });
 
@@ -27527,9 +27720,8 @@ var require_shuttle = __commonJS({
     var loom_1 = require_dist();
     var chain_1 = require_chain();
     var types_1 = require_types2();
-    var workspace_1 = require_workspace();
+    var run_dispatch_1 = require_run_dispatch();
     var credentials_1 = require_credentials();
-    var output_gates_1 = require_output_gates();
     var keep_1 = require_dist2();
     var apply_1 = require_apply();
     var environment_1 = require_environment();
@@ -27549,7 +27741,6 @@ var require_shuttle = __commonJS({
     var audit_log_1 = require_audit_log();
     var spend_tracker_1 = require_spend_tracker();
     var store_1 = require_store();
-    var GATE_REPAIR_BUDGET = 2;
     var ENVIRONMENT_HOLD = "executor-environment";
     function requiredExecutor(dispatch, strategy) {
       if (strategy !== loom_1.PROMPT_EXECUTION_STRATEGY)
@@ -27616,36 +27807,6 @@ var require_shuttle = __commonJS({
     function formatInstant(epochMs) {
       return new Date(epochMs).toISOString().replace(/\.\d{3}Z$/, "Z");
     }
-    async function runOutputGates(dispatch, response, executor, signal, ctx) {
-      let spec;
-      try {
-        spec = (0, loom_1.readPromptExecutionSpec)(dispatch.inputs);
-      } catch {
-        return { ok: true, response };
-      }
-      const gates = spec.gates;
-      if (!gates || gates.length === 0)
-        return { ok: true, response };
-      let current = response;
-      let result = (0, output_gates_1.evaluateOutputGates)(gates, current.parsed ?? {}, dispatch.inputs);
-      let attempts = 0;
-      while (!result.ok && attempts < GATE_REPAIR_BUDGET && current.continuation !== void 0 && typeof executor.continue === "function") {
-        try {
-          current = await executor.continue(current.continuation, (0, output_gates_1.renderRepairPrompt)(result.findings), signal, ctx);
-        } catch {
-          break;
-        }
-        result = (0, output_gates_1.evaluateOutputGates)(gates, current.parsed ?? {}, dispatch.inputs);
-        attempts += 1;
-      }
-      if (result.ok)
-        return { ok: true, response: current };
-      const detail = result.findings.map((f) => `[${f.gate}] ${f.message}`).join(" | ");
-      return {
-        ok: false,
-        reason: `output gate(s) failed${attempts > 0 ? ` after ${attempts} repair attempt(s)` : ""}: ${detail}`
-      };
-    }
     var Shuttle = class {
       brand;
       config;
@@ -27837,35 +27998,16 @@ var require_shuttle = __commonJS({
           const runOn = async (executor) => {
             await observerChain.notify({ kind: "executor.dispatch.started", jobId, attendanceId, executor: executor.capability.id, strategy }, onObserverError);
             const dispatchStartedAt = Date.now();
-            const environment = executor.prepareEnvironment ? await executor.prepareEnvironment(dispatch) : void 0;
-            let preparedWorkspace = null;
-            if (environment?.workspaceRequest) {
-              try {
-                preparedWorkspace = await (0, workspace_1.materializeWorkspace)(environment.workspaceRequest, {
-                  ...environment.materializeOptions ?? {},
-                  credentials: this.broker,
-                  signal
-                });
-              } catch (err) {
-                (0, logger_1.getLogger)().warn("workspace materialization failed; running prompt-only", {
-                  jobId,
-                  error: err instanceof Error ? err.message : String(err)
-                });
-                preparedWorkspace = null;
-              }
-            }
-            const executionCtx = {
+            const outcome = await (0, run_dispatch_1.runDispatch)(dispatch, executor, {
+              credentials: this.broker,
+              signal,
               reportProgress: (channel, frames) => {
                 void jobsClient.postProgress(jobId, { channel, frames }).then(() => activity.record()).catch(() => {
                 });
-              },
-              workspace: preparedWorkspace,
-              credentials: this.broker
-            };
-            let response;
-            try {
-              response = await executor.execute(dispatch, signal, executionCtx);
-            } catch (err) {
+              }
+            });
+            if (outcome.kind === "executor-failed") {
+              const err = outcome.error;
               const reason = `executor failed: ${err instanceof Error ? err.message : String(err)}`;
               if (this.broker === null && (0, types_1.isExecutorEnvironmentError)(err)) {
                 this.markUnwell(executor, err, subscribeLogger);
@@ -27875,14 +28017,11 @@ var require_shuttle = __commonJS({
                 return { kind: "result", result: { status: "failed", reason, failureCode: types_1.MODEL_UNAVAILABLE } };
               }
               return { kind: "result", result: { status: "failed", reason } };
-            } finally {
-              if (preparedWorkspace)
-                await preparedWorkspace.cleanup();
             }
-            const gated = await runOutputGates(dispatch, response, executor, signal, executionCtx);
-            if (!gated.ok)
-              return { kind: "result", result: { status: "failed", reason: gated.reason } };
-            response = gated.response;
+            if (outcome.kind === "gate-failed") {
+              return { kind: "result", result: { status: "failed", reason: outcome.reason } };
+            }
+            const response = outcome.response;
             await observerChain.notify({
               kind: "executor.dispatch.completed",
               jobId,
@@ -28823,8 +28962,8 @@ var require_dist5 = __commonJS({
   "../../packages/shuttle/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.verificationJson = exports2.resolveEnvironment = exports2.renderVerificationLine = exports2.renderEnvironmentReport = exports2.isWorthReporting = exports2.hostOf = exports2.executorDefaultsFor = exports2.environmentReportJson = exports2.environmentPolledBy = exports2.applyEnvironment = exports2.renderTemplate = exports2.expandHome = exports2.resolvePaths = exports2.SpendStore = exports2.AuditLogStore = exports2.createSpendTrackerObserver = exports2.createAuditLogObserver = exports2.createLoggerObserver = exports2.SpendCapExceeded = exports2.ObserverChain = exports2.createCustomScriptExecutor = exports2.createWebhookExecutor = exports2.createHttpApiExecutor = exports2.createCopilotExecutor = exports2.createCodexExecutor = exports2.createClaudeCodeExecutor = exports2.MODEL_UNAVAILABLE = exports2.ExecutorModelUnavailableError = exports2.ExecutorEnvironmentError = exports2.ExecutorRegistry = exports2.AgentCredentialRevokedError = exports2.runPreflight = exports2.renderLines = exports2.renderJson = exports2.printReport = exports2.hasFailure = exports2.createProbes = exports2.checksFor = exports2.PREFLIGHT_FLOORS = exports2.PREFLIGHT_EXIT_CODE = exports2.CHECKS = exports2.readResponseLatestVersion = exports2.checkResponseMinVersion = exports2.compareSemver = exports2.UpgradeRequiredError = exports2.LATEST_VERSION_HEADER = exports2.MIN_VERSION_HEADER = exports2.loadConfig = exports2.Shuttle = exports2.createCli = void 0;
-    exports2.revokePairing = exports2.listPairings = exports2.PairingConfigStore = exports2.pair = exports2.scaffoldedConfigPath = exports2.planScaffold = exports2.DEFAULT_REFUSAL_MESSAGE = exports2.DEFAULT_MONTHLY_PERIOD = exports2.DEFAULT_DAILY_PERIOD = exports2.SUBSTRATE_BRAND = void 0;
+    exports2.renderEnvironmentReport = exports2.isWorthReporting = exports2.hostOf = exports2.executorDefaultsFor = exports2.environmentReportJson = exports2.environmentPolledBy = exports2.applyEnvironment = exports2.renderTemplate = exports2.expandHome = exports2.resolvePaths = exports2.SpendStore = exports2.AuditLogStore = exports2.createSpendTrackerObserver = exports2.createAuditLogObserver = exports2.createLoggerObserver = exports2.SpendCapExceeded = exports2.ObserverChain = exports2.createCustomScriptExecutor = exports2.createWebhookExecutor = exports2.createHttpApiExecutor = exports2.createCopilotExecutor = exports2.createCodexExecutor = exports2.createClaudeCodeExecutor = exports2.MODEL_UNAVAILABLE = exports2.ExecutorModelUnavailableError = exports2.ExecutorEnvironmentError = exports2.ExecutorRegistry = exports2.AgentCredentialRevokedError = exports2.runPreflight = exports2.renderLines = exports2.renderJson = exports2.printReport = exports2.hasFailure = exports2.createProbes = exports2.checksFor = exports2.PREFLIGHT_FLOORS = exports2.PREFLIGHT_EXIT_CODE = exports2.CHECKS = exports2.readResponseLatestVersion = exports2.checkResponseMinVersion = exports2.compareSemver = exports2.UpgradeRequiredError = exports2.LATEST_VERSION_HEADER = exports2.MIN_VERSION_HEADER = exports2.loadConfig = exports2.GATE_REPAIR_BUDGET = exports2.mergeRepairedResponse = exports2.runDispatch = exports2.Shuttle = exports2.createCli = void 0;
+    exports2.revokePairing = exports2.listPairings = exports2.PairingConfigStore = exports2.pair = exports2.scaffoldedConfigPath = exports2.planScaffold = exports2.DEFAULT_REFUSAL_MESSAGE = exports2.DEFAULT_MONTHLY_PERIOD = exports2.DEFAULT_DAILY_PERIOD = exports2.SUBSTRATE_BRAND = exports2.verificationJson = exports2.resolveEnvironment = exports2.renderVerificationLine = void 0;
     var cli_1 = require_cli();
     Object.defineProperty(exports2, "createCli", { enumerable: true, get: function() {
       return cli_1.createCli;
@@ -28833,6 +28972,16 @@ var require_dist5 = __commonJS({
     Object.defineProperty(exports2, "Shuttle", { enumerable: true, get: function() {
       return shuttle_1.Shuttle;
     } });
+    var run_dispatch_1 = require_run_dispatch();
+    Object.defineProperty(exports2, "runDispatch", { enumerable: true, get: function() {
+      return run_dispatch_1.runDispatch;
+    } });
+    Object.defineProperty(exports2, "mergeRepairedResponse", { enumerable: true, get: function() {
+      return run_dispatch_1.mergeRepairedResponse;
+    } });
+    Object.defineProperty(exports2, "GATE_REPAIR_BUDGET", { enumerable: true, get: function() {
+      return run_dispatch_1.GATE_REPAIR_BUDGET;
+    } });
     var loader_1 = require_loader();
     Object.defineProperty(exports2, "loadConfig", { enumerable: true, get: function() {
       return loader_1.loadConfig;
@@ -29043,7 +29192,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist3());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.34.0" : pkg.version;
+var buildVersion = true ? "0.36.0" : pkg.version;
 var AGENT_EXECUTORS = ["claude-code", "codex", "copilot"];
 var sifterBrand = {
   product: {