@williambeto/ai-workflow 2.7.1 → 2.8.1

package/bin/ai-workflow.js

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 import {
-  BranchGate,
   COMPLETION_STATUS_TEXT,
   DelegationController,
   EvidenceLedger,
@@ -15,24 +14,360 @@ import {
   discoverPackageFiles,
   getFullAgentContent,
   getFullSkillFiles,
+  getPackageRoot,
   getPackageVersion,
   getWorkflowProfile,
   isRecoverableGateFailure,
   isTerminalFailure,
   readPackageFile,
   resolveWorkflowProfile
-} from "../chunk-W4RTQWVQ.js";
+} from "../chunk-4FI5ODAM.js";
+import {
+  EvidenceValidator,
+  require_ajv,
+  require_codegen
+} from "../chunk-FNT7DN3N.js";
 import {
   EvidenceCollector,
   QualityGuard,
-  ValidationPlanner
-} from "../chunk-BDZPUAEX.js";
-import "../chunk-XW747GIG.js";
-import "../chunk-5WRI5ZAA.js";
+  ValidationPlanner,
+  parseDeliveryOutcomeClaim
+} from "../chunk-LD7EHAU2.js";
+import {
+  DeliveryDecisionEngine
+} from "../chunk-H7GIKXFO.js";
+import {
+  createManagedBackup,
+  createManagedPathBackup
+} from "../chunk-AY33SA5W.js";
+import {
+  BranchGate
+} from "../chunk-AINIR25D.js";
+import {
+  __commonJS,
+  __toESM
+} from "../chunk-5WRI5ZAA.js";
+
+// node_modules/ajv-formats/dist/formats.js
+var require_formats = __commonJS({
+  "node_modules/ajv-formats/dist/formats.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.formatNames = exports.fastFormats = exports.fullFormats = void 0;
+    function fmtDef(validate, compare) {
+      return { validate, compare };
+    }
+    exports.fullFormats = {
+      // date: http://tools.ietf.org/html/rfc3339#section-5.6
+      date: fmtDef(date, compareDate),
+      // date-time: http://tools.ietf.org/html/rfc3339#section-5.6
+      time: fmtDef(getTime(true), compareTime),
+      "date-time": fmtDef(getDateTime(true), compareDateTime),
+      "iso-time": fmtDef(getTime(), compareIsoTime),
+      "iso-date-time": fmtDef(getDateTime(), compareIsoDateTime),
+      // duration: https://tools.ietf.org/html/rfc3339#appendix-A
+      duration: /^P(?!$)((\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+S)?)?|(\d+W)?)$/,
+      uri,
+      "uri-reference": /^(?:[a-z][a-z0-9+\-.]*:)?(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'"()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*)?(?:\?(?:[a-z0-9\-._~!$&'"()*+,;=:@/?]|%[0-9a-f]{2})*)?(?:#(?:[a-z0-9\-._~!$&'"()*+,;=:@/?]|%[0-9a-f]{2})*)?$/i,
+      // uri-template: https://tools.ietf.org/html/rfc6570
+      "uri-template": /^(?:(?:[^\x00-\x20"'<>%\\^`{|}]|%[0-9a-f]{2})|\{[+#./;?&=,!@|]?(?:[a-z0-9_]|%[0-9a-f]{2})+(?::[1-9][0-9]{0,3}|\*)?(?:,(?:[a-z0-9_]|%[0-9a-f]{2})+(?::[1-9][0-9]{0,3}|\*)?)*\})*$/i,
+      // For the source: https://gist.github.com/dperini/729294
+      // For test cases: https://mathiasbynens.be/demo/url-regex
+      url: /^(?:https?|ftp):\/\/(?:\S+(?::\S*)?@)?(?:(?!(?:10|127)(?:\.\d{1,3}){3})(?!(?:169\.254|192\.168)(?:\.\d{1,3}){2})(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u{00a1}-\u{ffff}]+-)*[a-z0-9\u{00a1}-\u{ffff}]+)(?:\.(?:[a-z0-9\u{00a1}-\u{ffff}]+-)*[a-z0-9\u{00a1}-\u{ffff}]+)*(?:\.(?:[a-z\u{00a1}-\u{ffff}]{2,})))(?::\d{2,5})?(?:\/[^\s]*)?$/iu,
+      email: /^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i,
+      hostname: /^(?=.{1,253}\.?$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[-0-9a-z]{0,61}[0-9a-z])?)*\.?$/i,
+      // optimized https://www.safaribooksonline.com/library/view/regular-expressions-cookbook/9780596802837/ch07s16.html
+      ipv4: /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/,
+      ipv6: /^((([0-9a-f]{1,4}:){7}([0-9a-f]{1,4}|:))|(([0-9a-f]{1,4}:){6}(:[0-9a-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9a-f]{1,4}:){5}(((:[0-9a-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9a-f]{1,4}:){4}(((:[0-9a-f]{1,4}){1,3})|((:[0-9a-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){3}(((:[0-9a-f]{1,4}){1,4})|((:[0-9a-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){2}(((:[0-9a-f]{1,4}){1,5})|((:[0-9a-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){1}(((:[0-9a-f]{1,4}){1,6})|((:[0-9a-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9a-f]{1,4}){1,7})|((:[0-9a-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))$/i,
+      regex,
+      // uuid: http://tools.ietf.org/html/rfc4122
+      uuid: /^(?:urn:uuid:)?[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i,
+      // JSON-pointer: https://tools.ietf.org/html/rfc6901
+      // uri fragment: https://tools.ietf.org/html/rfc3986#appendix-A
+      "json-pointer": /^(?:\/(?:[^~/]|~0|~1)*)*$/,
+      "json-pointer-uri-fragment": /^#(?:\/(?:[a-z0-9_\-.!$&'()*+,;:=@]|%[0-9a-f]{2}|~0|~1)*)*$/i,
+      // relative JSON-pointer: http://tools.ietf.org/html/draft-luff-relative-json-pointer-00
+      "relative-json-pointer": /^(?:0|[1-9][0-9]*)(?:#|(?:\/(?:[^~/]|~0|~1)*)*)$/,
+      // the following formats are used by the openapi specification: https://spec.openapis.org/oas/v3.0.0#data-types
+      // byte: https://github.com/miguelmota/is-base64
+      byte,
+      // signed 32 bit integer
+      int32: { type: "number", validate: validateInt32 },
+      // signed 64 bit integer
+      int64: { type: "number", validate: validateInt64 },
+      // C-type float
+      float: { type: "number", validate: validateNumber },
+      // C-type double
+      double: { type: "number", validate: validateNumber },
+      // hint to the UI to hide input strings
+      password: true,
+      // unchecked string payload
+      binary: true
+    };
+    exports.fastFormats = {
+      ...exports.fullFormats,
+      date: fmtDef(/^\d\d\d\d-[0-1]\d-[0-3]\d$/, compareDate),
+      time: fmtDef(/^(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:z|[+-]\d\d(?::?\d\d)?)$/i, compareTime),
+      "date-time": fmtDef(/^\d\d\d\d-[0-1]\d-[0-3]\dt(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:z|[+-]\d\d(?::?\d\d)?)$/i, compareDateTime),
+      "iso-time": fmtDef(/^(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:z|[+-]\d\d(?::?\d\d)?)?$/i, compareIsoTime),
+      "iso-date-time": fmtDef(/^\d\d\d\d-[0-1]\d-[0-3]\d[t\s](?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:z|[+-]\d\d(?::?\d\d)?)?$/i, compareIsoDateTime),
+      // uri: https://github.com/mafintosh/is-my-json-valid/blob/master/formats.js
+      uri: /^(?:[a-z][a-z0-9+\-.]*:)(?:\/?\/)?[^\s]*$/i,
+      "uri-reference": /^(?:(?:[a-z][a-z0-9+\-.]*:)?\/?\/)?(?:[^\\\s#][^\s#]*)?(?:#[^\\\s]*)?$/i,
+      // email (sources from jsen validator):
+      // http://stackoverflow.com/questions/201323/using-a-regular-expression-to-validate-an-email-address#answer-8829363
+      // http://www.w3.org/TR/html5/forms.html#valid-e-mail-address (search for 'wilful violation')
+      email: /^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i
+    };
+    exports.formatNames = Object.keys(exports.fullFormats);
+    function isLeapYear(year) {
+      return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+    }
+    var DATE = /^(\d\d\d\d)-(\d\d)-(\d\d)$/;
+    var DAYS = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+    function date(str) {
+      const matches = DATE.exec(str);
+      if (!matches)
+        return false;
+      const year = +matches[1];
+      const month = +matches[2];
+      const day = +matches[3];
+      return month >= 1 && month <= 12 && day >= 1 && day <= (month === 2 && isLeapYear(year) ? 29 : DAYS[month]);
+    }
+    function compareDate(d1, d2) {
+      if (!(d1 && d2))
+        return void 0;
+      if (d1 > d2)
+        return 1;
+      if (d1 < d2)
+        return -1;
+      return 0;
+    }
+    var TIME = /^(\d\d):(\d\d):(\d\d(?:\.\d+)?)(z|([+-])(\d\d)(?::?(\d\d))?)?$/i;
+    function getTime(strictTimeZone) {
+      return function time(str) {
+        const matches = TIME.exec(str);
+        if (!matches)
+          return false;
+        const hr = +matches[1];
+        const min = +matches[2];
+        const sec = +matches[3];
+        const tz = matches[4];
+        const tzSign = matches[5] === "-" ? -1 : 1;
+        const tzH = +(matches[6] || 0);
+        const tzM = +(matches[7] || 0);
+        if (tzH > 23 || tzM > 59 || strictTimeZone && !tz)
+          return false;
+        if (hr <= 23 && min <= 59 && sec < 60)
+          return true;
+        const utcMin = min - tzM * tzSign;
+        const utcHr = hr - tzH * tzSign - (utcMin < 0 ? 1 : 0);
+        return (utcHr === 23 || utcHr === -1) && (utcMin === 59 || utcMin === -1) && sec < 61;
+      };
+    }
+    function compareTime(s1, s2) {
+      if (!(s1 && s2))
+        return void 0;
+      const t1 = (/* @__PURE__ */ new Date("2020-01-01T" + s1)).valueOf();
+      const t2 = (/* @__PURE__ */ new Date("2020-01-01T" + s2)).valueOf();
+      if (!(t1 && t2))
+        return void 0;
+      return t1 - t2;
+    }
+    function compareIsoTime(t1, t2) {
+      if (!(t1 && t2))
+        return void 0;
+      const a1 = TIME.exec(t1);
+      const a2 = TIME.exec(t2);
+      if (!(a1 && a2))
+        return void 0;
+      t1 = a1[1] + a1[2] + a1[3];
+      t2 = a2[1] + a2[2] + a2[3];
+      if (t1 > t2)
+        return 1;
+      if (t1 < t2)
+        return -1;
+      return 0;
+    }
+    var DATE_TIME_SEPARATOR = /t|\s/i;
+    function getDateTime(strictTimeZone) {
+      const time = getTime(strictTimeZone);
+      return function date_time(str) {
+        const dateTime = str.split(DATE_TIME_SEPARATOR);
+        return dateTime.length === 2 && date(dateTime[0]) && time(dateTime[1]);
+      };
+    }
+    function compareDateTime(dt1, dt2) {
+      if (!(dt1 && dt2))
+        return void 0;
+      const d1 = new Date(dt1).valueOf();
+      const d2 = new Date(dt2).valueOf();
+      if (!(d1 && d2))
+        return void 0;
+      return d1 - d2;
+    }
+    function compareIsoDateTime(dt1, dt2) {
+      if (!(dt1 && dt2))
+        return void 0;
+      const [d1, t1] = dt1.split(DATE_TIME_SEPARATOR);
+      const [d2, t2] = dt2.split(DATE_TIME_SEPARATOR);
+      const res = compareDate(d1, d2);
+      if (res === void 0)
+        return void 0;
+      return res || compareTime(t1, t2);
+    }
+    var NOT_URI_FRAGMENT = /\/|:/;
+    var URI = /^(?:[a-z][a-z0-9+\-.]*:)(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)(?:\?(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?(?:#(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?$/i;
+    function uri(str) {
+      return NOT_URI_FRAGMENT.test(str) && URI.test(str);
+    }
+    var BYTE = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/gm;
+    function byte(str) {
+      BYTE.lastIndex = 0;
+      return BYTE.test(str);
+    }
+    var MIN_INT32 = -(2 ** 31);
+    var MAX_INT32 = 2 ** 31 - 1;
+    function validateInt32(value) {
+      return Number.isInteger(value) && value <= MAX_INT32 && value >= MIN_INT32;
+    }
+    function validateInt64(value) {
+      return Number.isInteger(value);
+    }
+    function validateNumber() {
+      return true;
+    }
+    var Z_ANCHOR = /[^\\]\\Z/;
+    function regex(str) {
+      if (Z_ANCHOR.test(str))
+        return false;
+      try {
+        new RegExp(str);
+        return true;
+      } catch (e) {
+        return false;
+      }
+    }
+  }
+});
+
+// node_modules/ajv-formats/dist/limit.js
+var require_limit = __commonJS({
+  "node_modules/ajv-formats/dist/limit.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.formatLimitDefinition = void 0;
+    var ajv_1 = require_ajv();
+    var codegen_1 = require_codegen();
+    var ops = codegen_1.operators;
+    var KWDs = {
+      formatMaximum: { okStr: "<=", ok: ops.LTE, fail: ops.GT },
+      formatMinimum: { okStr: ">=", ok: ops.GTE, fail: ops.LT },
+      formatExclusiveMaximum: { okStr: "<", ok: ops.LT, fail: ops.GTE },
+      formatExclusiveMinimum: { okStr: ">", ok: ops.GT, fail: ops.LTE }
+    };
+    var error = {
+      message: ({ keyword, schemaCode }) => (0, codegen_1.str)`should be ${KWDs[keyword].okStr} ${schemaCode}`,
+      params: ({ keyword, schemaCode }) => (0, codegen_1._)`{comparison: ${KWDs[keyword].okStr}, limit: ${schemaCode}}`
+    };
+    exports.formatLimitDefinition = {
+      keyword: Object.keys(KWDs),
+      type: "string",
+      schemaType: "string",
+      $data: true,
+      error,
+      code(cxt) {
+        const { gen, data, schemaCode, keyword, it } = cxt;
+        const { opts, self } = it;
+        if (!opts.validateFormats)
+          return;
+        const fCxt = new ajv_1.KeywordCxt(it, self.RULES.all.format.definition, "format");
+        if (fCxt.$data)
+          validate$DataFormat();
+        else
+          validateFormat();
+        function validate$DataFormat() {
+          const fmts = gen.scopeValue("formats", {
+            ref: self.formats,
+            code: opts.code.formats
+          });
+          const fmt = gen.const("fmt", (0, codegen_1._)`${fmts}[${fCxt.schemaCode}]`);
+          cxt.fail$data((0, codegen_1.or)((0, codegen_1._)`typeof ${fmt} != "object"`, (0, codegen_1._)`${fmt} instanceof RegExp`, (0, codegen_1._)`typeof ${fmt}.compare != "function"`, compareCode(fmt)));
+        }
+        function validateFormat() {
+          const format = fCxt.schema;
+          const fmtDef = self.formats[format];
+          if (!fmtDef || fmtDef === true)
+            return;
+          if (typeof fmtDef != "object" || fmtDef instanceof RegExp || typeof fmtDef.compare != "function") {
+            throw new Error(`"${keyword}": format "${format}" does not define "compare" function`);
+          }
+          const fmt = gen.scopeValue("formats", {
+            key: format,
+            ref: fmtDef,
+            code: opts.code.formats ? (0, codegen_1._)`${opts.code.formats}${(0, codegen_1.getProperty)(format)}` : void 0
+          });
+          cxt.fail$data(compareCode(fmt));
+        }
+        function compareCode(fmt) {
+          return (0, codegen_1._)`${fmt}.compare(${data}, ${schemaCode}) ${KWDs[keyword].fail} 0`;
+        }
+      },
+      dependencies: ["format"]
+    };
+    var formatLimitPlugin = (ajv) => {
+      ajv.addKeyword(exports.formatLimitDefinition);
+      return ajv;
+    };
+    exports.default = formatLimitPlugin;
+  }
+});
+
+// node_modules/ajv-formats/dist/index.js
+var require_dist = __commonJS({
+  "node_modules/ajv-formats/dist/index.js"(exports, module) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    var formats_1 = require_formats();
+    var limit_1 = require_limit();
+    var codegen_1 = require_codegen();
+    var fullName = new codegen_1.Name("fullFormats");
+    var fastName = new codegen_1.Name("fastFormats");
+    var formatsPlugin = (ajv, opts = { keywords: true }) => {
+      if (Array.isArray(opts)) {
+        addFormats2(ajv, opts, formats_1.fullFormats, fullName);
+        return ajv;
+      }
+      const [formats, exportName] = opts.mode === "fast" ? [formats_1.fastFormats, fastName] : [formats_1.fullFormats, fullName];
+      const list = opts.formats || formats_1.formatNames;
+      addFormats2(ajv, list, formats, exportName);
+      if (opts.keywords)
+        (0, limit_1.default)(ajv);
+      return ajv;
+    };
+    formatsPlugin.get = (name, mode = "full") => {
+      const formats = mode === "fast" ? formats_1.fastFormats : formats_1.fullFormats;
+      const f = formats[name];
+      if (!f)
+        throw new Error(`Unknown format "${name}"`);
+      return f;
+    };
+    function addFormats2(ajv, list, fs15, exportName) {
+      var _a;
+      var _b;
+      (_a = (_b = ajv.opts.code).formats) !== null && _a !== void 0 ? _a : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
+      for (const f of list)
+        ajv.addFormat(f, fs15[f]);
+    }
+    module.exports = exports = formatsPlugin;
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.default = formatsPlugin;
+  }
+});
 
 // src/cli/commands/init.ts
-import fs7 from "fs/promises";
-import path9 from "path";
+import fs6 from "fs/promises";
+import path8 from "path";
 
 // src/core/install-plan.ts
 import path from "path";
@@ -390,79 +725,38 @@ async function readJsonc(filePath) {
   return JSON.parse(stripTrailingCommas(stripJsonComments(content)));
 }
 
-// src/core/backup.ts
-import fs2 from "fs/promises";
-import path3 from "path";
-function escapeRelativePath(relativePath) {
-  return relativePath.replace(/[\\/]/g, "__");
-}
-async function createManagedBackup(filePath, { cwd, backupRoot, maxPerFile = 20 }) {
-  const relativePath = path3.relative(cwd, filePath);
-  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const backupName = `${escapeRelativePath(relativePath)}.${stamp}.bak`;
-  const absoluteBackupRoot = path3.join(cwd, backupRoot);
-  const backupPath = path3.join(absoluteBackupRoot, backupName);
-  await fs2.mkdir(absoluteBackupRoot, { recursive: true });
-  await fs2.copyFile(filePath, backupPath);
-  const prefix = `${escapeRelativePath(relativePath)}.`;
-  const entries = await fs2.readdir(absoluteBackupRoot);
-  const matching = entries.filter((entry) => entry.startsWith(prefix) && entry.endsWith(".bak")).sort();
-  if (matching.length > maxPerFile) {
-    const excess = matching.slice(0, matching.length - maxPerFile);
-    await Promise.all(excess.map((entry) => fs2.unlink(path3.join(absoluteBackupRoot, entry))));
-  }
-  return backupPath;
-}
-async function createManagedPathBackup(targetPath, { cwd, backupRoot, maxPerFile = 20 }) {
-  const relativePath = path3.relative(cwd, targetPath);
-  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const backupName = `${escapeRelativePath(relativePath)}.${stamp}.bak`;
-  const absoluteBackupRoot = path3.join(cwd, backupRoot);
-  const backupPath = path3.join(absoluteBackupRoot, backupName);
-  await fs2.mkdir(absoluteBackupRoot, { recursive: true });
-  await fs2.rename(targetPath, backupPath);
-  const prefix = `${escapeRelativePath(relativePath)}.`;
-  const entries = await fs2.readdir(absoluteBackupRoot);
-  const matching = entries.filter((entry) => entry.startsWith(prefix) && entry.endsWith(".bak")).sort();
-  if (matching.length > maxPerFile) {
-    const excess = matching.slice(0, matching.length - maxPerFile);
-    await Promise.all(excess.map((entry) => fs2.rm(path3.join(absoluteBackupRoot, entry), { recursive: true, force: true })));
-  }
-  return backupPath;
-}
-
 // src/core/opencode-merge.ts
-import path4 from "path";
+import path3 from "path";
 var LEGACY_MARKER = "_aiWorkflowManaged";
 var AGENTS = {
-  Atlas: { description: "Router and workflow coordinator for AI Workflow Kit" },
-  Nexus: { description: "Discovery, requirement, scope, and specification owner" },
-  Orion: { description: "Planning, PR sequencing, release, and deployment strategy owner" },
-  Astra: { description: "Implementation owner for incremental, scoped changes" },
-  Sage: { description: "Audit, validation, evidence, and quality gate owner" },
-  Phoenix: { description: "Remediation and regression recovery owner" }
+  Atlas: { description: "Router and workflow coordinator for AI Workflow Kit", mode: "primary" },
+  Nexus: { description: "Discovery, requirement, scope, and specification owner", mode: "all" },
+  Orion: { description: "Planning, PR sequencing, release, and deployment strategy owner", mode: "all" },
+  Astra: { description: "Implementation owner for incremental, scoped workspace changes", mode: "all" },
+  Sage: { description: "Audit, validation, evidence, and quality gate owner", mode: "all" },
+  Phoenix: { description: "Bounded remediation and regression recovery owner", mode: "all" }
 };
 var SUBAGENTS = {
-  "Architecture-Specialist": { description: "Select the simplest architecture that safely satisfies current requirements", skill: "architecture" },
-  "Backend-Engineer": { description: "Support safe PHP/Node/Python backend changes for APIs and persistence", skill: "backend-development" },
-  "Deployment-Specialist": { description: "Plan, review, or validate deployment, release, and production-readiness", skill: "deployment" },
-  "Design-Specialist": { description: "Apply practical design principles to keep solutions simple and maintainable", skill: "design-principles" },
-  "Docs-Engineer": { description: "Write or improve project documentation, READMEs, guides, and prompts", skill: "documentation" },
-  "Frontend-Engineer": { description: "Implement or review frontend changes involving UI, state, routing, and accessibility", skill: "frontend-development" },
-  "Frontend-Design-System-Specialist": { description: "Enforce CSS/HTML tokens, semantic elements, typography, and premium atmosphere constraints for frontend quality", skill: "frontend-design-system" },
-  "Full-Stack-Engineer": { description: "Coordinate frontend and backend changes as one coherent, testable increment", skill: "full-stack-development" },
-  "Token-Economist": { description: "Reduce context size while preserving information required for safe execution", skill: "optimize-tokens" },
-  "PR-Manager": { description: "Plan, implement, review, or validate small pull requests while preserving scope", skill: "pr-workflow" },
-  "Discovery-Analyst": { description: "Clarify ambiguous requests into actionable problem statements and success outcomes", skill: "product-discovery" },
-  "Product-Planner": { description: "Turn clarified needs into scoped requirements with acceptance-ready outcomes", skill: "product-planning" },
-  "Memory-Guardian": { description: "Manage discoverable project memory for durable decisions and recurring corrections", skill: "project-memory" },
-  "Prompt-Engineer": { description: "Expert in creating and refining prompts for AI agents and workflows", skill: "prompt-engineer" },
-  "QA-Engineer": { description: "Design, review, or improve tests, acceptance criteria, and validation evidence", skill: "qa-workflow" },
-  "Refactoring-Specialist": { description: "Improve code/document structure safely while preserving behavior", skill: "refactoring" },
-  "Release-Specialist": { description: "Prepare release readiness decisions with explicit gates and evidence", skill: "release-workflow" },
-  "SDD-Specialist": { description: "Convert approved requirements into explicit, testable specification artifacts", skill: "spec-driven-development" },
-  "Technical-Leader": { description: "Make technical decisions, review architecture, and identify trade-offs", skill: "technical-leadership" },
-  "UI-UX-Engineer": { description: "Improve usability and interface clarity without introducing unnecessary complexity", skill: "ui-ux-design" }
+  "Architecture-Specialist": { description: "Capability only: advise on the simplest safe architecture for current requirements", skill: "architecture" },
+  "Backend-Engineer": { description: "Capability only: advise on PHP, Node, or Python APIs and persistence", skill: "backend-development" },
+  "Deployment-Specialist": { description: "Capability only: analyze deployment, release, and production readiness", skill: "deployment" },
+  "Design-Specialist": { description: "Capability only: advise on simple and maintainable design principles", skill: "design-principles" },
+  "Docs-Engineer": { description: "Capability only: advise on documentation, READMEs, guides, and prompts", skill: "documentation" },
+  "Frontend-Engineer": { description: "Capability only: advise on UI, state, routing, and accessibility", skill: "frontend-development" },
+  "Frontend-Design-System-Specialist": { description: "Capability only: review CSS and HTML tokens, semantics, typography, and visual quality", skill: "frontend-design-system" },
+  "Full-Stack-Engineer": { description: "Capability only: analyze frontend and backend integration as one testable increment", skill: "full-stack-development" },
+  "Token-Economist": { description: "Capability only: analyze context size while preserving safe execution information", skill: "optimize-tokens" },
+  "PR-Manager": { description: "Capability only: plan or review small pull requests while preserving scope", skill: "pr-workflow" },
+  "Discovery-Analyst": { description: "Capability only: clarify ambiguous requests into actionable outcomes", skill: "product-discovery" },
+  "Product-Planner": { description: "Capability only: shape clarified needs into scoped requirements", skill: "product-planning" },
+  "Memory-Guardian": { description: "Capability only: advise on durable project decisions and recurring corrections", skill: "project-memory" },
+  "Prompt-Engineer": { description: "Capability only: advise on prompts for agents and workflows", skill: "prompt-engineer" },
+  "QA-Engineer": { description: "Capability only: design or review tests, acceptance criteria, and validation evidence", skill: "qa-workflow" },
+  "Refactoring-Specialist": { description: "Capability only: review structure and behavior-preserving simplifications", skill: "refactoring" },
+  "Release-Specialist": { description: "Capability only: analyze release readiness with explicit gates and evidence", skill: "release-workflow" },
+  "SDD-Specialist": { description: "Capability only: shape approved requirements into testable specifications", skill: "spec-driven-development" },
+  "Technical-Leader": { description: "Capability only: analyze technical decisions, architecture, and trade-offs", skill: "technical-leadership" },
+  "UI-UX-Engineer": { description: "Capability only: review usability and interface clarity", skill: "ui-ux-design" }
 };
 var COMMANDS = {
   atlas: { description: "Decide safest next step and delegate to the appropriate workflow or agent", agent: "Atlas" },
@@ -482,18 +776,36 @@ var COMMANDS = {
 };
 function buildManagedConfig() {
   const agent = {};
+  const coreTaskPermissions = Object.fromEntries([
+    ["*", "deny"],
+    ...Object.keys(AGENTS).filter((name) => name !== "Atlas").map((name) => [name, "allow"])
+  ]);
+  const capabilityTaskPermissions = Object.fromEntries([
+    ["*", "deny"],
+    ...Object.keys(SUBAGENTS).map((name) => [name, "allow"])
+  ]);
   for (const [name, def] of Object.entries(AGENTS)) {
     agent[name] = {
-      mode: "primary",
+      mode: def.mode,
       description: def.description,
-      prompt: `{file:./.ai-workflow/opencode/agents/${name.toLowerCase()}.md}`
+      prompt: `{file:./.ai-workflow/opencode/agents/${name.toLowerCase()}.md}`,
+      permission: {
+        ...name === "Atlas" ? { edit: "deny", bash: "ask" } : {},
+        ...name === "Astra" ? { edit: "allow" } : {},
+        task: name === "Atlas" ? coreTaskPermissions : capabilityTaskPermissions
+      }
     };
   }
   for (const [name, def] of Object.entries(SUBAGENTS)) {
     agent[name] = {
       mode: "subagent",
       description: def.description,
-      prompt: `{file:./.ai-workflow/opencode/skills/${def.skill}/SKILL.md}`
+      prompt: `{file:./.ai-workflow/opencode/skills/${def.skill}/SKILL.md}`,
+      permission: {
+        edit: "deny",
+        bash: "ask",
+        task: { "*": "deny" }
+      }
     };
   }
   const command = {};
@@ -515,7 +827,7 @@ function buildManagedConfig() {
   };
 }
 async function mergeOpencodeConfig(cwd, { force = false, backupRoot = ".ai-workflow-backups" } = {}) {
-  const targetPath = path4.join(cwd, "opencode.jsonc");
+  const targetPath = path3.join(cwd, "opencode.jsonc");
   const managed = buildManagedConfig();
   if (!await exists(targetPath)) {
     await writeFileSafe(targetPath, `${JSON.stringify(managed, null, 2)}
@@ -567,10 +879,10 @@ async function mergeOpencodeConfig(cwd, { force = false, backupRoot = ".ai-workf
 }
 
 // src/core/symlink-layout.ts
-import fs3 from "fs/promises";
-import path5 from "path";
+import fs2 from "fs/promises";
+import path4 from "path";
 function normalize(p) {
-  return p.split(path5.sep).join("/");
+  return p.split(path4.sep).join("/");
 }
 var LINKABLE_ROOTS = /* @__PURE__ */ new Set([
   "opencode",
@@ -598,38 +910,38 @@ function buildSymlinkEntries({ templateFiles, installRoot = ".ai-workflow" }) {
 }
 async function isSymlinkTo(absoluteLinkPath, absoluteTargetPath) {
   try {
-    const stat = await fs3.lstat(absoluteLinkPath);
+    const stat = await fs2.lstat(absoluteLinkPath);
     if (!stat.isSymbolicLink()) return false;
-    const currentTarget = await fs3.readlink(absoluteLinkPath);
-    const resolved = path5.resolve(path5.dirname(absoluteLinkPath), currentTarget);
+    const currentTarget = await fs2.readlink(absoluteLinkPath);
+    const resolved = path4.resolve(path4.dirname(absoluteLinkPath), currentTarget);
     return resolved === absoluteTargetPath;
   } catch {
     return false;
   }
 }
 async function setupInternalSymlinks(cwd, installRoot = ".ai-workflow") {
-  const skillsLink = path5.join(cwd, installRoot, "opencode/skills");
-  const skillsTarget = path5.join(cwd, installRoot, ".agents/skills");
+  const skillsLink = path4.join(cwd, installRoot, "opencode/skills");
+  const skillsTarget = path4.join(cwd, installRoot, ".agents/skills");
   if (!await exists2(skillsTarget)) return;
   try {
-    const stat = await fs3.lstat(skillsLink).catch(() => null);
+    const stat = await fs2.lstat(skillsLink).catch(() => null);
     if (stat) {
       if (stat.isSymbolicLink()) {
-        const current = await fs3.readlink(skillsLink);
+        const current = await fs2.readlink(skillsLink);
         if (current === "../.agents/skills") return;
-        await fs3.unlink(skillsLink);
+        await fs2.unlink(skillsLink);
       } else {
         return;
       }
     }
     const type = process.platform === "win32" ? "junction" : "dir";
-    await fs3.symlink("../.agents/skills", skillsLink, type);
+    await fs2.symlink("../.agents/skills", skillsLink, type);
   } catch {
   }
 }
 async function exists2(p) {
   try {
-    await fs3.access(p);
+    await fs2.access(p);
     return true;
   } catch {
     return false;
@@ -637,8 +949,8 @@ async function exists2(p) {
 }
 
 // src/adapters/platforms/claude.ts
-import fs4 from "fs/promises";
-import path6 from "path";
+import fs3 from "fs/promises";
+import path5 from "path";
 var ClaudeAdapter = class {
   cwd;
   constructor({ cwd }) {
@@ -648,8 +960,8 @@ var ClaudeAdapter = class {
    * Transforms an OpenCode agent or skill into a Claude rule with completion contract.
    */
   async transformToRule(filePath, type = "agent") {
-    const content = await fs4.readFile(filePath, "utf8");
-    const fileName = path6.basename(filePath, ".md") === "SKILL" ? path6.basename(path6.dirname(filePath)) : path6.basename(filePath, ".md");
+    const content = await fs3.readFile(filePath, "utf8");
+    const fileName = path5.basename(filePath, ".md") === "SKILL" ? path5.basename(path5.dirname(filePath)) : path5.basename(filePath, ".md");
     const ruleName = `${type}-${fileName.toLowerCase()}`;
     const hardenedContent = `---
 name: ${ruleName}
@@ -679,34 +991,34 @@ Every task completion MUST provide the following payload:
    * Deploys agents, skills, and root CLAUDE.md.
    */
   async deploy(installRoot = ".ai-workflow") {
-    const rulesDir = path6.join(this.cwd, ".claude/rules");
-    await fs4.mkdir(rulesDir, { recursive: true });
-    const sourceAgentsDir = path6.join(this.cwd, installRoot, "opencode/agents");
-    const sourceSkillsDir = path6.join(this.cwd, installRoot, "opencode/skills");
-    const sourceCommandsDir = path6.join(this.cwd, installRoot, "opencode/commands");
-    const agentFiles = await fs4.readdir(sourceAgentsDir).catch(() => []);
+    const rulesDir = path5.join(this.cwd, ".claude/rules");
+    await fs3.mkdir(rulesDir, { recursive: true });
+    const sourceAgentsDir = path5.join(this.cwd, installRoot, "opencode/agents");
+    const sourceSkillsDir = path5.join(this.cwd, installRoot, "opencode/skills");
+    const sourceCommandsDir = path5.join(this.cwd, installRoot, "opencode/commands");
+    const agentFiles = await fs3.readdir(sourceAgentsDir).catch(() => []);
     for (const file of agentFiles) {
       if (!file.endsWith(".md")) continue;
-      const transformed = await this.transformToRule(path6.join(sourceAgentsDir, file), "agent");
-      await fs4.writeFile(path6.join(rulesDir, `${transformed.name}.md`), transformed.content);
+      const transformed = await this.transformToRule(path5.join(sourceAgentsDir, file), "agent");
+      await fs3.writeFile(path5.join(rulesDir, `${transformed.name}.md`), transformed.content);
     }
-    const skillFolders = await fs4.readdir(sourceSkillsDir).catch(() => []);
+    const skillFolders = await fs3.readdir(sourceSkillsDir).catch(() => []);
     for (const folder of skillFolders) {
-      const skillSource = path6.join(sourceSkillsDir, folder, "SKILL.md");
+      const skillSource = path5.join(sourceSkillsDir, folder, "SKILL.md");
       if (await this.exists(skillSource)) {
         const transformed = await this.transformToRule(skillSource, "skill");
-        await fs4.writeFile(path6.join(rulesDir, `${transformed.name}.md`), transformed.content);
+        await fs3.writeFile(path5.join(rulesDir, `${transformed.name}.md`), transformed.content);
       }
     }
     await this.deployRootClaudeMd(sourceCommandsDir);
   }
   async deployRootClaudeMd(sourceCommandsDir) {
-    const targetPath = path6.join(this.cwd, "CLAUDE.md");
-    const commandFiles = await fs4.readdir(sourceCommandsDir).catch(() => []);
+    const targetPath = path5.join(this.cwd, "CLAUDE.md");
+    const commandFiles = await fs3.readdir(sourceCommandsDir).catch(() => []);
     let commandsDoc = "";
     for (const file of commandFiles) {
       if (!file.endsWith(".md")) continue;
-      const name = path6.basename(file, ".md");
+      const name = path5.basename(file, ".md");
       commandsDoc += `- \`ai-workflow run --spec-path=...\` (Target: ${name})
 `;
     }
@@ -730,11 +1042,11 @@ Adhere to the specific rules and personas defined in \`.claude/rules/\`.
 ##  Completion Contract
 Every task completion MUST follow the payload format defined in the individual rule files.
 `;
-    await fs4.writeFile(targetPath, instructions);
+    await fs3.writeFile(targetPath, instructions);
   }
   async exists(p) {
     try {
-      await fs4.access(p);
+      await fs3.access(p);
       return true;
     } catch {
       return false;
@@ -743,8 +1055,8 @@ Every task completion MUST follow the payload format defined in the individual r
 };
 
 // src/adapters/platforms/codex.ts
-import fs5 from "fs/promises";
-import path7 from "path";
+import fs4 from "fs/promises";
+import path6 from "path";
 var CodexAdapter = class {
   cwd;
   constructor({ cwd }) {
@@ -754,8 +1066,8 @@ var CodexAdapter = class {
    * Transforms an OpenCode agent into a Codex prompt with completion contract.
    */
   async transformAgent(filePath) {
-    const content = await fs5.readFile(filePath, "utf8");
-    const fileName = path7.basename(filePath, ".md");
+    const content = await fs4.readFile(filePath, "utf8");
+    const fileName = path6.basename(filePath, ".md");
     const hardenedContent = `${content}
 
 ##  System Directives for Codex
@@ -787,55 +1099,55 @@ Every task completion MUST provide the following payload:
    * - Commands -> .codex/prompts/
    */
   async deploy(installRoot = ".ai-workflow", force) {
-    const sourceAgentsDir = path7.join(this.cwd, installRoot, "opencode/agents");
-    const sourceSkillsDir = path7.join(this.cwd, installRoot, "opencode/skills");
-    const sourceCommandsDir = path7.join(this.cwd, installRoot, "opencode/commands");
-    const codexAgentsDir = path7.join(this.cwd, ".github/agents");
-    await fs5.mkdir(codexAgentsDir, { recursive: true });
-    const agentFiles = await fs5.readdir(sourceAgentsDir).catch(() => []);
+    const sourceAgentsDir = path6.join(this.cwd, installRoot, "opencode/agents");
+    const sourceSkillsDir = path6.join(this.cwd, installRoot, "opencode/skills");
+    const sourceCommandsDir = path6.join(this.cwd, installRoot, "opencode/commands");
+    const codexAgentsDir = path6.join(this.cwd, ".github/agents");
+    await fs4.mkdir(codexAgentsDir, { recursive: true });
+    const agentFiles = await fs4.readdir(sourceAgentsDir).catch(() => []);
     for (const file of agentFiles) {
       if (!file.endsWith(".md")) continue;
-      const transformed = await this.transformAgent(path7.join(sourceAgentsDir, file));
-      await fs5.writeFile(path7.join(codexAgentsDir, `${transformed.name}.md`), transformed.content);
+      const transformed = await this.transformAgent(path6.join(sourceAgentsDir, file));
+      await fs4.writeFile(path6.join(codexAgentsDir, `${transformed.name}.md`), transformed.content);
     }
-    const codexSkillsDir = path7.join(this.cwd, ".codex/skills");
-    await fs5.mkdir(codexSkillsDir, { recursive: true });
-    const skillFolders = await fs5.readdir(sourceSkillsDir).catch(() => []);
+    const codexSkillsDir = path6.join(this.cwd, ".codex/skills");
+    await fs4.mkdir(codexSkillsDir, { recursive: true });
+    const skillFolders = await fs4.readdir(sourceSkillsDir).catch(() => []);
     for (const folder of skillFolders) {
-      const skillSource = path7.join(sourceSkillsDir, folder, "SKILL.md");
+      const skillSource = path6.join(sourceSkillsDir, folder, "SKILL.md");
       if (await this.exists(skillSource)) {
-        const targetDir = path7.join(codexSkillsDir, folder);
-        await fs5.mkdir(targetDir, { recursive: true });
-        const content = await fs5.readFile(skillSource, "utf8");
-        await fs5.writeFile(path7.join(targetDir, "SKILL.md"), content);
+        const targetDir = path6.join(codexSkillsDir, folder);
+        await fs4.mkdir(targetDir, { recursive: true });
+        const content = await fs4.readFile(skillSource, "utf8");
+        await fs4.writeFile(path6.join(targetDir, "SKILL.md"), content);
       }
     }
-    const codexPromptsDir = path7.join(this.cwd, ".codex/prompts");
-    await fs5.mkdir(codexPromptsDir, { recursive: true });
-    const commandFiles = await fs5.readdir(sourceCommandsDir).catch(() => []);
+    const codexPromptsDir = path6.join(this.cwd, ".codex/prompts");
+    await fs4.mkdir(codexPromptsDir, { recursive: true });
+    const commandFiles = await fs4.readdir(sourceCommandsDir).catch(() => []);
     for (const file of commandFiles) {
       if (!file.endsWith(".md") && !file.endsWith(".toml")) continue;
-      const targetFileName = file.endsWith(".toml") ? `${path7.basename(file, ".toml")}.md` : file;
-      const content = await fs5.readFile(path7.join(sourceCommandsDir, file), "utf8");
-      await fs5.writeFile(path7.join(codexPromptsDir, targetFileName), content);
-    }
-    const codexPoliciesDir = path7.join(this.cwd, ".codex", "docs", "policies");
-    await fs5.mkdir(codexPoliciesDir, { recursive: true });
-    const sourcePoliciesDir = path7.join(this.cwd, installRoot, "opencode", "docs", "policies");
-    const policyFiles = await fs5.readdir(sourcePoliciesDir).catch(() => []);
+      const targetFileName = file.endsWith(".toml") ? `${path6.basename(file, ".toml")}.md` : file;
+      const content = await fs4.readFile(path6.join(sourceCommandsDir, file), "utf8");
+      await fs4.writeFile(path6.join(codexPromptsDir, targetFileName), content);
+    }
+    const codexPoliciesDir = path6.join(this.cwd, ".codex", "docs", "policies");
+    await fs4.mkdir(codexPoliciesDir, { recursive: true });
+    const sourcePoliciesDir = path6.join(this.cwd, installRoot, "opencode", "docs", "policies");
+    const policyFiles = await fs4.readdir(sourcePoliciesDir).catch(() => []);
     for (const file of policyFiles) {
       if (!file.endsWith(".md")) continue;
-      const policyContent = await fs5.readFile(path7.join(sourcePoliciesDir, file), "utf8");
-      await fs5.writeFile(path7.join(codexPoliciesDir, file), policyContent);
+      const policyContent = await fs4.readFile(path6.join(sourcePoliciesDir, file), "utf8");
+      await fs4.writeFile(path6.join(codexPoliciesDir, file), policyContent);
     }
     await this.deployRootCopilotInstructions();
     await this.deployRootCodexMd(force);
     await this.deployRootAgentsMd(force);
   }
   async deployRootCopilotInstructions() {
-    const githubDir = path7.join(this.cwd, ".github");
-    await fs5.mkdir(githubDir, { recursive: true });
-    const targetPath = path7.join(githubDir, "copilot-instructions.md");
+    const githubDir = path6.join(this.cwd, ".github");
+    await fs4.mkdir(githubDir, { recursive: true });
+    const targetPath = path6.join(githubDir, "copilot-instructions.md");
     const instructions = `# AI Workflow Kit Governance
 
 This repository uses the **AI Workflow Kit** (OpenCode-first) workflow.
@@ -857,15 +1169,15 @@ All architectural changes must align with the specifications issued by the **Spe
 ##  Completion Contract
 Every task completion MUST follow the payload format defined in the individual agent files.
 `;
-    await fs5.writeFile(targetPath, instructions);
+    await fs4.writeFile(targetPath, instructions);
   }
   async deployRootCodexMd(force) {
-    const targetPath = path7.join(this.cwd, "CODEX.md");
+    const targetPath = path6.join(this.cwd, "CODEX.md");
     if (!force && await this.exists(targetPath)) return;
-    const templatePath = path7.join(this.cwd, ".ai-workflow", "templates", "CODEX.md.template");
+    const templatePath = path6.join(this.cwd, ".ai-workflow", "templates", "CODEX.md.template");
     if (await this.exists(templatePath)) {
-      const content = await fs5.readFile(templatePath, "utf8");
-      await fs5.writeFile(targetPath, content);
+      const content = await fs4.readFile(templatePath, "utf8");
+      await fs4.writeFile(targetPath, content);
       return;
     }
     const instructions = `# AI Workflow Kit Governance
@@ -889,23 +1201,23 @@ All architectural changes must align with the specifications issued by the **Spe
 ##  Completion Contract
 Every task completion MUST follow the payload format defined in the individual agent files.
 `;
-    await fs5.writeFile(targetPath, instructions);
+    await fs4.writeFile(targetPath, instructions);
   }
   async deployRootAgentsMd(force) {
-    const targetPath = path7.join(this.cwd, "AGENTS.md");
+    const targetPath = path6.join(this.cwd, "AGENTS.md");
     if (!force && await this.exists(targetPath)) return;
-    const templatePath = path7.join(this.cwd, ".ai-workflow", "AGENTS.md");
+    const templatePath = path6.join(this.cwd, ".ai-workflow", "AGENTS.md");
     if (await this.exists(templatePath)) {
-      let content = await fs5.readFile(templatePath, "utf8");
+      let content = await fs4.readFile(templatePath, "utf8");
       content = content.replace(/\.agents\/skills/g, ".codex/skills");
       content = content.replace(/opencode\/commands/g, ".codex/prompts");
       content = content.replace(/opencode\/docs\/policies/g, ".codex/docs/policies");
-      await fs5.writeFile(targetPath, content);
+      await fs4.writeFile(targetPath, content);
     }
   }
   async exists(p) {
     try {
-      await fs5.access(p);
+      await fs4.access(p);
       return true;
     } catch {
       return false;
@@ -914,8 +1226,8 @@ Every task completion MUST follow the payload format defined in the individual a
 };
 
 // src/adapters/platforms/antigravity.ts
-import fs6 from "fs/promises";
-import path8 from "path";
+import fs5 from "fs/promises";
+import path7 from "path";
 import { pathToFileURL } from "url";
 var PERSONA_MAPPING = {
   "atlas": "Atlas",
@@ -938,8 +1250,8 @@ var AntigravityAdapter = class {
    * Transforms an OpenCode agent or specialized skill file to an Antigravity Skill.
    */
   async transform(filePath) {
-    const content = await fs6.readFile(filePath, "utf8");
-    const fileName = path8.basename(filePath, ".md") === "SKILL" ? path8.basename(path8.dirname(filePath)) : path8.basename(filePath, ".md");
+    const content = await fs5.readFile(filePath, "utf8");
+    const fileName = path7.basename(filePath, ".md") === "SKILL" ? path7.basename(path7.dirname(filePath)) : path7.basename(filePath, ".md");
     const persona = PERSONA_MAPPING[fileName.toLowerCase()] || "Astra";
     if (content.trim().startsWith("---")) {
       return { content, name: fileName };
@@ -975,17 +1287,17 @@ Every task completion MUST provide the following payload:
    * Also orchestrates the .antigravity/ native integration.
    */
   async deploy(transformedItems, installRoot = ".ai-workflow") {
-    const agentsDir = path8.join(this.cwd, installRoot, "opencode/agents");
-    const skillsDir = path8.join(this.cwd, installRoot, "opencode/skills");
-    await fs6.mkdir(agentsDir, { recursive: true });
-    await fs6.mkdir(skillsDir, { recursive: true });
+    const agentsDir = path7.join(this.cwd, installRoot, "opencode/agents");
+    const skillsDir = path7.join(this.cwd, installRoot, "opencode/skills");
+    await fs5.mkdir(agentsDir, { recursive: true });
+    await fs5.mkdir(skillsDir, { recursive: true });
     for (const item of transformedItems) {
       const isAgent = PERSONA_MAPPING[item.name.toLowerCase()];
-      const targetDir = isAgent ? agentsDir : path8.join(skillsDir, item.name);
+      const targetDir = isAgent ? agentsDir : path7.join(skillsDir, item.name);
       const fileName = isAgent ? `${item.name}.md` : "SKILL.md";
       const absoluteTargetDir = isAgent ? agentsDir : targetDir;
-      await fs6.mkdir(absoluteTargetDir, { recursive: true });
-      await fs6.writeFile(path8.join(absoluteTargetDir, fileName), item.content);
+      await fs5.mkdir(absoluteTargetDir, { recursive: true });
+      await fs5.writeFile(path7.join(absoluteTargetDir, fileName), item.content);
     }
     await this.deployNativeExtensions(installRoot);
     await this.deployInstructions();
@@ -995,13 +1307,13 @@ Every task completion MUST provide the following payload:
    * Using hard copies instead of symlinks ensures native discovery across all platforms.
    */
   async deployNativeExtensions(installRoot = ".ai-workflow") {
-    const antigravityDir = path8.join(this.cwd, ".agents");
-    const antigravityAgents = path8.join(antigravityDir, "agents");
-    const antigravitySkills = path8.join(antigravityDir, "skills");
-    const antigravityCommands = path8.join(antigravityDir, "commands");
-    await fs6.mkdir(antigravityAgents, { recursive: true });
-    await fs6.mkdir(antigravitySkills, { recursive: true });
-    await fs6.mkdir(antigravityCommands, { recursive: true });
+    const antigravityDir = path7.join(this.cwd, ".agents");
+    const antigravityAgents = path7.join(antigravityDir, "agents");
+    const antigravitySkills = path7.join(antigravityDir, "skills");
+    const antigravityCommands = path7.join(antigravityDir, "commands");
+    await fs5.mkdir(antigravityAgents, { recursive: true });
+    await fs5.mkdir(antigravitySkills, { recursive: true });
+    await fs5.mkdir(antigravityCommands, { recursive: true });
     const getUrls = (targetPath) => {
       const linuxUrl = pathToFileURL(targetPath).href;
       const urls = [linuxUrl];
@@ -1043,8 +1355,8 @@ Every task completion MUST provide the following payload:
         "user_rules"
       ]
     };
-    const sourceAgentsDir = path8.join(this.cwd, installRoot, "opencode/agents");
-    const agentFiles = await fs6.readdir(sourceAgentsDir).catch(() => []);
+    const sourceAgentsDir = path7.join(this.cwd, installRoot, "opencode/agents");
+    const agentFiles = await fs5.readdir(sourceAgentsDir).catch(() => []);
     const AGENTS_INFO = {
       "atlas": { name: "Atlas", description: "Router and workflow coordinator for AI Workflow Kit" },
       "nexus": { name: "Nexus", description: "Discovery, requirement, scope, and specification owner" },
@@ -1055,14 +1367,14 @@ Every task completion MUST provide the following payload:
     };
     for (const file of agentFiles) {
       if (!file.endsWith(".md")) continue;
-      const lowercaseName = path8.basename(file, ".md").toLowerCase();
+      const lowercaseName = path7.basename(file, ".md").toLowerCase();
       const info = AGENTS_INFO[lowercaseName];
       if (!info) continue;
-      const agentFolder = path8.join(antigravityAgents, lowercaseName);
-      await fs6.mkdir(agentFolder, { recursive: true });
-      const content = await fs6.readFile(path8.join(sourceAgentsDir, file), "utf8");
-      const mdTarget = path8.join(agentFolder, `${lowercaseName}.md`);
-      await fs6.writeFile(mdTarget, content);
+      const agentFolder = path7.join(antigravityAgents, lowercaseName);
+      await fs5.mkdir(agentFolder, { recursive: true });
+      const content = await fs5.readFile(path7.join(sourceAgentsDir, file), "utf8");
+      const mdTarget = path7.join(agentFolder, `${lowercaseName}.md`);
+      await fs5.writeFile(mdTarget, content);
       const agentJson = {
         name: lowercaseName,
         description: info.description,
@@ -1083,7 +1395,7 @@ ${getUrls(mdTarget)}`
           }
         }
       };
-      await fs6.writeFile(path8.join(agentFolder, "agent.json"), JSON.stringify(agentJson, null, 2));
+      await fs5.writeFile(path7.join(agentFolder, "agent.json"), JSON.stringify(agentJson, null, 2));
     }
     const SUBAGENTS_INFO = {
       "Architecture-Specialist": { description: "Select the simplest architecture that safely satisfies current requirements", skill: "architecture" },
@@ -1108,9 +1420,9 @@ ${getUrls(mdTarget)}`
     };
     for (const [name, subInfo] of Object.entries(SUBAGENTS_INFO)) {
       const lowercaseSubagentName = name.toLowerCase();
-      const subagentFolder = path8.join(antigravityAgents, lowercaseSubagentName);
-      await fs6.mkdir(subagentFolder, { recursive: true });
-      const skillPath = path8.join(antigravitySkills, subInfo.skill, "SKILL.md");
+      const subagentFolder = path7.join(antigravityAgents, lowercaseSubagentName);
+      await fs5.mkdir(subagentFolder, { recursive: true });
+      const skillPath = path7.join(antigravitySkills, subInfo.skill, "SKILL.md");
       const subagentJson = {
         name: lowercaseSubagentName,
         description: subInfo.description,
@@ -1131,50 +1443,50 @@ ${getUrls(skillPath)}`
           }
         }
       };
-      await fs6.writeFile(path8.join(subagentFolder, "agent.json"), JSON.stringify(subagentJson, null, 2));
+      await fs5.writeFile(path7.join(subagentFolder, "agent.json"), JSON.stringify(subagentJson, null, 2));
     }
-    const sourceSkillsDir = path8.join(this.cwd, installRoot, "opencode/skills");
-    const skillFolders = await fs6.readdir(sourceSkillsDir).catch(() => []);
+    const sourceSkillsDir = path7.join(this.cwd, installRoot, "opencode/skills");
+    const skillFolders = await fs5.readdir(sourceSkillsDir).catch(() => []);
     for (const folder of skillFolders) {
-      const skillSource = path8.join(sourceSkillsDir, folder, "SKILL.md");
+      const skillSource = path7.join(sourceSkillsDir, folder, "SKILL.md");
       if (await this.exists(skillSource)) {
-        await fs6.mkdir(path8.join(antigravitySkills, folder), { recursive: true });
-        const content = await fs6.readFile(skillSource, "utf8");
-        await fs6.writeFile(path8.join(antigravitySkills, folder, "SKILL.md"), content);
+        await fs5.mkdir(path7.join(antigravitySkills, folder), { recursive: true });
+        const content = await fs5.readFile(skillSource, "utf8");
+        await fs5.writeFile(path7.join(antigravitySkills, folder, "SKILL.md"), content);
       }
     }
-    const sourceCommandsDir = path8.join(this.cwd, installRoot, "opencode/commands");
+    const sourceCommandsDir = path7.join(this.cwd, installRoot, "opencode/commands");
     if (await this.exists(sourceCommandsDir)) {
-      const commandFiles = await fs6.readdir(sourceCommandsDir).catch(() => []);
+      const commandFiles = await fs5.readdir(sourceCommandsDir).catch(() => []);
       for (const file of commandFiles) {
         if (!file.endsWith(".md") && !file.endsWith(".toml")) continue;
-        const content = await fs6.readFile(path8.join(sourceCommandsDir, file), "utf8");
-        await fs6.writeFile(path8.join(antigravityCommands, file), content);
+        const content = await fs5.readFile(path7.join(sourceCommandsDir, file), "utf8");
+        await fs5.writeFile(path7.join(antigravityCommands, file), content);
       }
     }
-    const sourcePoliciesDir = path8.join(this.cwd, installRoot, "opencode", "docs", "policies");
-    const antigravityPolicies = path8.join(antigravityDir, "docs", "policies");
+    const sourcePoliciesDir = path7.join(this.cwd, installRoot, "opencode", "docs", "policies");
+    const antigravityPolicies = path7.join(antigravityDir, "docs", "policies");
     if (await this.exists(sourcePoliciesDir)) {
-      await fs6.mkdir(antigravityPolicies, { recursive: true });
-      const policyFiles = await fs6.readdir(sourcePoliciesDir).catch(() => []);
+      await fs5.mkdir(antigravityPolicies, { recursive: true });
+      const policyFiles = await fs5.readdir(sourcePoliciesDir).catch(() => []);
       for (const file of policyFiles) {
         if (!file.endsWith(".md")) continue;
-        const content = await fs6.readFile(path8.join(sourcePoliciesDir, file), "utf8");
-        await fs6.writeFile(path8.join(antigravityPolicies, file), content);
+        const content = await fs5.readFile(path7.join(sourcePoliciesDir, file), "utf8");
+        await fs5.writeFile(path7.join(antigravityPolicies, file), content);
       }
     }
-    const settingsPath = path8.join(antigravityDir, "settings.json");
+    const settingsPath = path7.join(antigravityDir, "settings.json");
     if (!await this.exists(settingsPath)) {
       const settings = {
         model: { name: "auto" },
         ui: { theme: "Ayu" }
       };
-      await fs6.writeFile(settingsPath, JSON.stringify(settings, null, 2));
+      await fs5.writeFile(settingsPath, JSON.stringify(settings, null, 2));
     }
   }
   async exists(p) {
     try {
-      await fs6.access(p);
+      await fs5.access(p);
       return true;
     } catch {
       return false;
@@ -1184,10 +1496,10 @@ ${getUrls(skillPath)}`
    * Deploys the main ANTIGRAVITY.md and .antigravityignore instructions to the project root.
    */
   async deployInstructions() {
-    const targetPath = path8.join(this.cwd, "ANTIGRAVITY.md");
-    const ignorePath = path8.join(this.cwd, ".antigravityignore");
+    const targetPath = path7.join(this.cwd, "ANTIGRAVITY.md");
+    const ignorePath = path7.join(this.cwd, ".antigravityignore");
     try {
-      await fs6.access(targetPath);
+      await fs5.access(targetPath);
     } catch {
       const instructions = `# AI Workflow Kit - Engineering Governance
 
@@ -1216,10 +1528,10 @@ All architectural changes must align with the specifications issued by the **Spe
 - **Native Discovery**: This project uses workspace-specific extensions in \`.agents/\`.
 - **Workflow Entry**: Use \`/atlas\` to begin any task.
 `;
-      await fs6.writeFile(targetPath, instructions);
+      await fs5.writeFile(targetPath, instructions);
     }
     try {
-      await fs6.access(ignorePath);
+      await fs5.access(ignorePath);
     } catch {
       const ignoreContent = `.ai-workflow/
 .ai-workflow-backups/
@@ -1232,7 +1544,7 @@ EVIDENCE.json
 .agents/tmp/
 .agents/history/
 `;
-      await fs6.writeFile(ignorePath, ignoreContent);
+      await fs5.writeFile(ignorePath, ignoreContent);
     }
   }
 };
@@ -1266,7 +1578,7 @@ function buildGitignoreBlock(entries) {
   ].join("\n");
 }
 async function upsertGitignoreBlock(cwd, entries) {
-  const gitignorePath = path9.join(cwd, ".gitignore");
+  const gitignorePath = path8.join(cwd, ".gitignore");
   const block = buildGitignoreBlock(entries);
   const beginMarker = "# BEGIN AI WORKFLOW KIT";
   const endMarker = "# END AI WORKFLOW KIT";
@@ -1276,7 +1588,7 @@ async function upsertGitignoreBlock(cwd, entries) {
 `);
     return "created";
   }
-  const current = await fs7.readFile(gitignorePath, "utf8");
+  const current = await fs6.readFile(gitignorePath, "utf8");
   const beginIndex = current.indexOf(beginMarker);
   const endIndex = current.indexOf(endMarker);
   if (beginIndex >= 0 && endIndex > beginIndex) {
@@ -1297,7 +1609,7 @@ async function upsertGitignoreBlock(cwd, entries) {
   return "updated";
 }
 async function injectScripts(cwd) {
-  const pkgPath = path9.join(cwd, "package.json");
+  const pkgPath = path8.join(cwd, "package.json");
   if (!await exists(pkgPath)) return false;
   try {
     const pkg = await readJson(pkgPath);
@@ -1315,7 +1627,7 @@ async function injectScripts(cwd) {
 async function verifySelfExecutionGuard(cwd, devMode) {
   if (!devMode) {
     try {
-      const pkgPath = path9.join(cwd, "package.json");
+      const pkgPath = path8.join(cwd, "package.json");
       if (await exists(pkgPath)) {
         const pkg = await readJson(pkgPath);
         if (pkg.name === "@williambeto/ai-workflow") {
@@ -1363,8 +1675,8 @@ async function writeSymlinks(cwd, linkEntries, force, backupRoot = ".ai-workflow
   const linkBackups = [];
   const linkCreated = [];
   for (const { linkPath, targetPath } of linkEntries) {
-    const absoluteLinkPath = path9.join(cwd, linkPath);
-    const absoluteTargetPath = path9.join(cwd, targetPath);
+    const absoluteLinkPath = path8.join(cwd, linkPath);
+    const absoluteTargetPath = path8.join(cwd, targetPath);
     if (!await exists(absoluteTargetPath)) {
       throw new Error(`missing link target: ${targetPath}`);
     }
@@ -1383,14 +1695,14 @@ async function writeSymlinks(cwd, linkEntries, force, backupRoot = ".ai-workflow
         maxPerFile: 20
       });
       linkBackups.push(backupPath);
-      await fs7.rm(absoluteLinkPath, { recursive: true, force: true });
+      await fs6.rm(absoluteLinkPath, { recursive: true, force: true });
     }
-    const stat = await fs7.lstat(absoluteTargetPath);
+    const stat = await fs6.lstat(absoluteTargetPath);
     const type = process.platform === "win32" ? stat.isDirectory() ? "junction" : "file" : stat.isDirectory() ? "dir" : "file";
-    const linkTarget = process.platform === "win32" ? absoluteTargetPath : path9.relative(path9.dirname(absoluteLinkPath), absoluteTargetPath);
+    const linkTarget = process.platform === "win32" ? absoluteTargetPath : path8.relative(path8.dirname(absoluteLinkPath), absoluteTargetPath);
     try {
-      await fs7.mkdir(path9.dirname(absoluteLinkPath), { recursive: true });
-      await fs7.symlink(linkTarget, absoluteLinkPath, type);
+      await fs6.mkdir(path8.dirname(absoluteLinkPath), { recursive: true });
+      await fs6.symlink(linkTarget, absoluteLinkPath, type);
     } catch (error) {
       throw new Error(
         `failed to create symlink '${linkPath}' -> '${targetPath}' (${error.message}). For Windows, enable Developer Mode or run terminal as Administrator. For Linux/macOS, verify write permissions in project root.`
@@ -1403,9 +1715,9 @@ async function writeSymlinks(cwd, linkEntries, force, backupRoot = ".ai-workflow
 async function executePlatformMigrations(cwd, installRoot, platforms, claude, codex, antigravity, force) {
   if (platforms.length === 0) return;
   console.log("ai-workflow: migrating to native platforms...");
-  const agentsDir = path9.join(cwd, installRoot, "opencode/agents");
-  const skillsDir = path9.join(cwd, installRoot, "opencode/skills");
-  const agentFiles = (await fs7.readdir(agentsDir).catch(() => [])).filter((f) => f.endsWith(".md")).map((f) => path9.join(agentsDir, f));
+  const agentsDir = path8.join(cwd, installRoot, "opencode/agents");
+  const skillsDir = path8.join(cwd, installRoot, "opencode/skills");
+  const agentFiles = (await fs6.readdir(agentsDir).catch(() => [])).filter((f) => f.endsWith(".md")).map((f) => path8.join(agentsDir, f));
   if (claude) {
     const adapter = new ClaudeAdapter({ cwd });
     await adapter.deploy(installRoot);
@@ -1418,10 +1730,10 @@ async function executePlatformMigrations(cwd, installRoot, platforms, claude, co
   }
   if (antigravity) {
     const adapter = new AntigravityAdapter({ cwd });
-    const skillFolders = await fs7.readdir(skillsDir).catch(() => []);
+    const skillFolders = await fs6.readdir(skillsDir).catch(() => []);
     const skillFiles = [];
     for (const folder of skillFolders) {
-      const skillPath = path9.join(skillsDir, folder, "SKILL.md");
+      const skillPath = path8.join(skillsDir, folder, "SKILL.md");
       if (await exists(skillPath)) {
         skillFiles.push(skillPath);
       }
@@ -1553,15 +1865,15 @@ async function runInit({
 }
 
 // src/cli/commands/doctor.ts
-import fs8 from "fs/promises";
-import path10 from "path";
+import fs7 from "fs/promises";
+import path9 from "path";
 var REQUIRED_FILES = [
   ".ai-workflow",
   "opencode/README.md"
 ];
 async function isSymlink(filePath) {
   try {
-    const stat = await fs8.lstat(filePath);
+    const stat = await fs7.lstat(filePath);
     return stat.isSymbolicLink();
   } catch {
     return false;
@@ -1587,7 +1899,7 @@ async function checkOpenCodeRuntime(cwd, state) {
 }
 async function checkRequiredFiles(cwd, state) {
   for (const relativePath of REQUIRED_FILES) {
-    const ok = await exists(path10.join(cwd, relativePath));
+    const ok = await exists(path9.join(cwd, relativePath));
     if (ok) {
       console.log(`PASS ${relativePath}`);
     } else {
@@ -1597,8 +1909,8 @@ async function checkRequiredFiles(cwd, state) {
   }
 }
 async function checkAiWorkflowConfig(cwd, state) {
-  const configPathV2 = path10.join(cwd, ".ai-workflow/config.json");
-  const configPathLegacy = path10.join(cwd, ".ai-workflow.json");
+  const configPathV2 = path9.join(cwd, ".ai-workflow/config.json");
+  const configPathLegacy = path9.join(cwd, ".ai-workflow.json");
   let configPath = null;
   if (await exists(configPathV2)) {
     configPath = configPathV2;
@@ -1608,7 +1920,7 @@ async function checkAiWorkflowConfig(cwd, state) {
   if (!configPath) return;
   try {
     const config = await readJson(configPath);
-    const basename = path10.basename(configPath);
+    const basename = path9.basename(configPath);
     if (config.installMode === "project-local" || config.mode === "standalone") {
       console.log("PASS install mode is project-local/standalone");
     } else {
@@ -1635,7 +1947,7 @@ async function checkAiWorkflowConfig(cwd, state) {
     }
     if (Array.isArray(config.managedFiles)) {
       for (const relativePath of config.managedFiles) {
-        const fileExists = await exists(path10.join(cwd, relativePath));
+        const fileExists = await exists(path9.join(cwd, relativePath));
         if (!fileExists) {
           state.hasWarning = true;
           console.log(`WARN managed file missing: ${relativePath}`);
@@ -1644,7 +1956,7 @@ async function checkAiWorkflowConfig(cwd, state) {
     }
     if (Array.isArray(config.managedLinks)) {
       for (const relativePath of config.managedLinks) {
-        const absolutePath = path10.join(cwd, relativePath);
+        const absolutePath = path9.join(cwd, relativePath);
         if (!await exists(absolutePath)) {
           state.hasWarning = true;
           console.log(`WARN managed link missing: ${relativePath}`);
@@ -1658,11 +1970,11 @@ async function checkAiWorkflowConfig(cwd, state) {
     }
   } catch {
     state.hasFailure = true;
-    console.log(`FAIL ${path10.basename(configPath)} is not valid JSON`);
+    console.log(`FAIL ${path9.basename(configPath)} is not valid JSON`);
   }
 }
 async function checkOpencodeJson(cwd, state) {
-  const opencodePath = path10.join(cwd, "opencode.jsonc");
+  const opencodePath = path9.join(cwd, "opencode.jsonc");
   if (!await exists(opencodePath)) {
     state.hasFailure = true;
     console.log("FAIL opencode.jsonc missing");
@@ -1708,7 +2020,7 @@ async function checkOpencodeJson(cwd, state) {
   }
 }
 async function checkPackageJson(cwd, state) {
-  const packageJsonPath = path10.join(cwd, "package.json");
+  const packageJsonPath = path9.join(cwd, "package.json");
   if (await exists(packageJsonPath)) {
     try {
       const packageJson = await readJson(packageJsonPath);
@@ -1731,7 +2043,7 @@ async function checkCodexRuntime(cwd, state) {
     { name: ".codex policies detected", path: ".codex/docs/policies" }
   ];
   for (const check of checks) {
-    const ok = await exists(path10.join(cwd, check.path));
+    const ok = await exists(path9.join(cwd, check.path));
     if (ok) {
       console.log(`PASS ${check.name}`);
     } else {
@@ -1739,7 +2051,7 @@ async function checkCodexRuntime(cwd, state) {
       console.log(`FAIL ${check.name}`);
     }
   }
-  const codexMdOk = await exists(path10.join(cwd, "CODEX.md"));
+  const codexMdOk = await exists(path9.join(cwd, "CODEX.md"));
   if (codexMdOk) {
     console.log(`PASS root CODEX.md exists`);
   }
@@ -1788,7 +2100,7 @@ function buildDeliverySummary({ evidence }) {
   return {
     Status: evidence?.status || "BLOCKED",
     Branch: evidence?.branch || "unknown",
-    Changes: (evidence?.changedFiles || []).join(", ") || "No changed files recorded",
+    Changes: (evidence?.deliveryChangedFiles || evidence?.changedFiles || []).join(", ") || "No changed files recorded",
     Validation: commands,
     "Known limitations": (evidence?.limitations || []).join("; ") || "None recorded"
   };
@@ -1822,12 +2134,41 @@ async function runCollectEvidence({
   userRequest = null,
   explicitApprovals = [],
   visualDist = null,
-  port = null
+  port = null,
+  workflowEvidence = null,
+  claimedOutcome = null,
+  deliveryChangedFiles = null,
+  deliveryAddedFiles = null,
+  deliveryDeletedFiles = null
 }) {
+  if (process.env.AI_WORKFLOW_FINALIZATION_OWNER === "execute") {
+    console.log("[FINALIZATION DEFERRED] Parent ai-workflow execute process owns canonical finalization.");
+    return { status: "DEFERRED_TO_ORCHESTRATOR", internalStatus: "DEFERRED", commands: [] };
+  }
   const policies = resolvePoliciesFromLegacyMode(mode, evidencePolicy);
-  const qualityGuard = new QualityGuard({ cwd, taskSlug, evidencePolicy: policies.evidencePolicy, riskLevel: policies.riskLevel });
+  const workspaceGuard = new QualityGuard({ cwd, taskSlug, evidencePolicy: policies.evidencePolicy, riskLevel: policies.riskLevel });
+  const observedDeliveryFiles = deliveryChangedFiles ?? workspaceGuard.getChangedFiles();
+  const qualityGuard = new QualityGuard({
+    cwd,
+    taskSlug,
+    evidencePolicy: policies.evidencePolicy,
+    riskLevel: policies.riskLevel,
+    scopedChangedFiles: observedDeliveryFiles
+  });
   const planner = new ValidationPlanner({ cwd, qualityGuard });
-  const tasks = await planner.plan(profile);
+  const tasks = await planner.plan(profile, {
+    requireObservedValidation: claimedOutcome === "ALREADY_SATISFIED" && observedDeliveryFiles.length === 0
+  });
+  const docs = observedDeliveryFiles.filter((file) => /(^|\/)(docs?|readme|changelog)|\.md$/i.test(file));
+  if (tasks.length === 0 && docs.length > 0 && docs.length === observedDeliveryFiles.length) {
+    tasks.push({
+      name: "docs-integrity",
+      command: ["aiwk", "internal", "docs-integrity"],
+      kind: "lint",
+      internal: "document-integrity",
+      files: docs
+    });
+  }
   const persist = !dryRun && policies.evidencePolicy === "required";
   const collector = new EvidenceCollector({
     cwd,
@@ -1839,7 +2180,13 @@ async function runCollectEvidence({
     userRequest,
     explicitApprovals,
     visualDist,
-    port: port || 8080
+    port: port || 8080,
+    workflowEvidence,
+    claimedOutcome,
+    deliveryChangedFiles: observedDeliveryFiles,
+    deliveryAddedFiles,
+    deliveryDeletedFiles,
+    riskLevel: policies.riskLevel
   });
   const evidence = await collector.collect(tasks, { writeArtifact: persist });
   const summary = buildDeliverySummary({ evidence });
@@ -1854,11 +2201,11 @@ async function runCollectEvidence({
 
 // src/core/healing/cli-remediation-executor.ts
 import { spawnSync, execSync as execSync2 } from "child_process";
-import fs9 from "fs/promises";
-import path11 from "path";
+import fs8 from "fs/promises";
+import path10 from "path";
 async function readScripts(cwd) {
   try {
-    const pkg = JSON.parse(await fs9.readFile(path11.join(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(await fs8.readFile(path10.join(cwd, "package.json"), "utf8"));
     return pkg.scripts || {};
   } catch {
     return {};
@@ -1948,8 +2295,170 @@ function createCliRemediationExecutor(cwd) {
 }
 
 // src/cli/commands/run.ts
-import path12 from "path";
+import path14 from "path";
+import fs12 from "fs/promises";
+
+// src/core/sdd/approval-receipt.ts
+var import_ajv = __toESM(require_ajv(), 1);
+var import_ajv_formats = __toESM(require_dist(), 1);
 import fs10 from "fs/promises";
+import path12 from "path";
+
+// src/core/sdd/workflow-artifacts.ts
+import { createHash } from "crypto";
+import fs9 from "fs/promises";
+import path11 from "path";
+function sha256(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+async function hashFile(filePath) {
+  return sha256(await fs9.readFile(filePath));
+}
+async function writeFileAtomic(filePath, content) {
+  await fs9.mkdir(path11.dirname(filePath), { recursive: true });
+  const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    await fs9.writeFile(temporaryPath, content, { encoding: "utf8", flag: "wx" });
+    await fs9.rename(temporaryPath, filePath);
+  } catch (error) {
+    await fs9.rm(temporaryPath, { force: true }).catch(() => {
+    });
+    throw error;
+  }
+}
+function stripMarkdownFence(content) {
+  const trimmed = content.trim();
+  const match = trimmed.match(/^```(?:markdown|md|json)?\s*\n([\s\S]*?)\n```$/i);
+  return (match ? match[1] : trimmed).trim() + "\n";
+}
+
+// src/core/sdd/approval-receipt.ts
+var ApprovalReceiptValidator = class {
+  cwd;
+  constructor({ cwd = process.cwd() } = {}) {
+    this.cwd = path12.resolve(cwd);
+  }
+  async validate(receiptPath, specPath, expectedWorkflowId) {
+    const absoluteReceiptPath = path12.resolve(this.cwd, receiptPath);
+    if (absoluteReceiptPath !== this.cwd && !absoluteReceiptPath.startsWith(`${this.cwd}${path12.sep}`)) {
+      return { valid: false, reason: "Approval receipt must be inside the repository." };
+    }
+    try {
+      const stat = await fs10.lstat(absoluteReceiptPath);
+      if (!stat.isFile() || stat.isSymbolicLink()) {
+        return { valid: false, reason: "Approval receipt must be a regular, non-symlink file." };
+      }
+    } catch {
+      return { valid: false, reason: `Approval receipt not found: ${receiptPath}` };
+    }
+    let receipt;
+    try {
+      receipt = JSON.parse(await fs10.readFile(absoluteReceiptPath, "utf8"));
+      const root = getPackageRoot();
+      const schema = JSON.parse(await fs10.readFile(path12.join(root, "dist-assets/schemas/approval-receipt.schema.json"), "utf8"));
+      const ajv = new import_ajv.default({ allErrors: true });
+      (0, import_ajv_formats.default)(ajv);
+      const validateSchema = ajv.compile(schema);
+      if (!validateSchema(receipt)) {
+        const errors = (validateSchema.errors || []).map((error) => `${error.instancePath} ${error.message}`).join(", ");
+        return { valid: false, reason: `Approval receipt schema violation: ${errors}` };
+      }
+    } catch (error) {
+      return { valid: false, reason: `Approval receipt validation failed: ${error.message}` };
+    }
+    if (expectedWorkflowId && receipt.workflowId !== expectedWorkflowId) {
+      return { valid: false, reason: `Approval receipt workflowId '${receipt.workflowId}' does not match '${expectedWorkflowId}'.` };
+    }
+    const approvedSpecHash = await hashFile(specPath);
+    if (receipt.approvedSpecHash !== approvedSpecHash) {
+      return { valid: false, reason: "Approval receipt hash does not match the approved specification bytes." };
+    }
+    return { valid: true, receipt, approvedSpecHash };
+  }
+};
+
+// src/core/sdd/technical-plan-validator.ts
+var import_ajv2 = __toESM(require_ajv(), 1);
+import fs11 from "fs/promises";
+import path13 from "path";
+function isContained(root, candidate) {
+  return candidate === root || candidate.startsWith(`${root}${path13.sep}`);
+}
+var TechnicalPlanValidator = class {
+  cwd;
+  constructor({ cwd = process.cwd() } = {}) {
+    this.cwd = path13.resolve(cwd);
+  }
+  async validateScopedPath(candidate, forbiddenPaths) {
+    if (path13.isAbsolute(candidate)) return `Absolute path is not allowed: '${candidate}'.`;
+    const normalized = candidate.replaceAll("\\", "/");
+    if (!normalized || normalized.split("/").some((part) => part === "" || part === "." || part === "..")) {
+      return `Path must be normalized without empty, '.' or '..' segments: '${candidate}'.`;
+    }
+    if (normalized === ".git" || normalized.startsWith(".git/") || normalized === ".ai-workflow" || normalized.startsWith(".ai-workflow/")) {
+      return `Workflow control path is out of implementation scope: '${candidate}'.`;
+    }
+    const conflictsWithProtectedPath = [...forbiddenPaths].some(
+      (protectedPath) => normalized === protectedPath || normalized.startsWith(`${protectedPath}/`) || protectedPath.startsWith(`${normalized}/`)
+    );
+    if (normalized === "EVIDENCE.json" || conflictsWithProtectedPath) {
+      return `Protected workflow artifact is out of implementation scope: '${candidate}'.`;
+    }
+    const absolute = path13.resolve(this.cwd, normalized);
+    if (!isContained(this.cwd, absolute)) return `Path escapes repository: '${candidate}'.`;
+    let cursor = this.cwd;
+    for (const part of normalized.split("/")) {
+      cursor = path13.join(cursor, part);
+      try {
+        const stat = await fs11.lstat(cursor);
+        if (cursor === absolute && stat.isDirectory()) {
+          return `filesInScope must name explicit files, not a directory: '${candidate}'.`;
+        }
+        if (stat.isSymbolicLink()) {
+          const resolved = await fs11.realpath(cursor);
+          if (!isContained(this.cwd, resolved)) return `Symlink escapes repository: '${candidate}'.`;
+          cursor = resolved;
+        }
+      } catch (error) {
+        if (error.code !== "ENOENT") return `Cannot inspect scoped path '${candidate}': ${error.message}`;
+        break;
+      }
+    }
+    return null;
+  }
+  async validateOutput(output, protectedPaths = []) {
+    let plan;
+    try {
+      plan = JSON.parse(stripMarkdownFence(output));
+    } catch (error) {
+      return { valid: false, reason: `Technical plan is not valid JSON: ${error.message}` };
+    }
+    try {
+      const schema = JSON.parse(await fs11.readFile(path13.join(getPackageRoot(), "dist-assets/schemas/technical-plan.schema.json"), "utf8"));
+      const validateSchema = new import_ajv2.default({ allErrors: true }).compile(schema);
+      if (!validateSchema(plan)) {
+        const errors = (validateSchema.errors || []).map((error) => `${error.instancePath} ${error.message}`).join(", ");
+        return { valid: false, reason: `Technical plan schema violation: ${errors}` };
+      }
+    } catch (error) {
+      return { valid: false, reason: `Technical plan schema validation failed: ${error.message}` };
+    }
+    if (plan.filesInScope.length === 0) {
+      return { valid: false, reason: "Technical plan filesInScope must not be empty." };
+    }
+    const forbidden = new Set(protectedPaths.map((entry) => path13.relative(this.cwd, path13.resolve(this.cwd, entry)).replaceAll("\\", "/")));
+    for (const entry of plan.filesInScope) {
+      const reason = await this.validateScopedPath(entry.path, forbidden);
+      if (reason) return { valid: false, reason };
+    }
+    const content = `${JSON.stringify(plan, null, 2)}
+`;
+    return { valid: true, plan, content };
+  }
+};
+
+// src/cli/commands/run.ts
+import { execFileSync } from "child_process";
 function normalizeTaskSlugFromSpec(specPath) {
   const normalized = String(specPath).replaceAll("\\", "/");
   const marker = "/docs/workflows/";
@@ -1958,7 +2467,7 @@ function normalizeTaskSlugFromSpec(specPath) {
     const slug = normalized.slice(index).split("/")[0];
     if (slug) return slug;
   }
-  return path12.basename(specPath, path12.extname(specPath));
+  return path14.basename(specPath, path14.extname(specPath));
 }
 function combineValidation(evidence, quality) {
   const statuses = [evidence.internalStatus, quality.overallStatus];
@@ -1970,27 +2479,197 @@ function combineValidation(evidence, quality) {
   else if (statuses.includes("PASS_WITH_NOTES")) overallStatus = "PASS_WITH_NOTES";
   return { overallStatus, evidence, quality };
 }
-async function runMasterOrchestrator({ cwd, specPath, override, remediationExecutor = null }) {
+function repositoryRelative(cwd, candidate) {
+  return path14.relative(cwd, path14.resolve(cwd, candidate)).replaceAll("\\", "/");
+}
+async function findCompatibleLedger(cwd, specRelativePath) {
+  const historyDir = path14.join(cwd, ".ai-workflow/history");
+  const matches = [];
+  for (const file of await fs12.readdir(historyDir).catch(() => [])) {
+    if (!file.endsWith("-ledger.json")) continue;
+    try {
+      const events = JSON.parse(await fs12.readFile(path14.join(historyDir, file), "utf8"));
+      if (events.some((event) => event.eventType === "specification_complete" && event.data?.artifactPath === specRelativePath)) {
+        matches.push(path14.join(historyDir, file));
+      }
+    } catch {
+    }
+  }
+  return matches;
+}
+async function runDeepImplementation(cwd, absoluteSpecPath, specPath, approvalPath, specContent) {
+  if (!approvalPath) throw new Error("[SDD BLOCKED] DEEP resume requires --approval-path.");
+  const approvalValidator = new ApprovalReceiptValidator({ cwd });
+  const approval = await approvalValidator.validate(approvalPath, absoluteSpecPath);
+  if (!approval.valid || !approval.receipt || !approval.approvedSpecHash) {
+    throw new Error(`[SDD BLOCKED] ${approval.reason || "Approval receipt is invalid."}`);
+  }
+  const workflowId = approval.receipt.workflowId;
+  const ledgerPath = `.ai-workflow/history/${workflowId}-ledger.json`;
+  const absoluteLedgerPath = path14.join(cwd, ledgerPath);
+  const relativeSpecPath = repositoryRelative(cwd, specPath);
+  const compatibleLedgers = await findCompatibleLedger(cwd, relativeSpecPath);
+  if (compatibleLedgers.length > 1) {
+    throw new Error("[SDD BLOCKED] Multiple ledgers claim the same approved specification.");
+  }
+  if (compatibleLedgers.length === 1 && path14.resolve(compatibleLedgers[0]) !== path14.resolve(absoluteLedgerPath)) {
+    throw new Error("[SDD BLOCKED] Approval workflowId conflicts with the ledger that created the specification.");
+  }
+  const ledger = new EvidenceLedger({ cwd, workflowId });
+  const loaded = await ledger.load(ledgerPath);
+  if (!loaded) {
+    ledger.logEvent({
+      actor: "Atlas",
+      actorType: "control-plane",
+      observed: true,
+      eventType: "workflow_attached",
+      provenance: "sdd-control-plane",
+      data: { specSource: "external", specPath: relativeSpecPath, status: "COMPLETED" }
+    });
+  }
+  const events = ledger.getEvents();
+  const approvalEvents = events.filter((event) => event.eventType === "spec_approval_verified");
+  if (approvalEvents.length > 1) throw new Error("[SDD BLOCKED] Duplicate specification approval events in ledger.");
+  if (approvalEvents.length === 1 && (approvalEvents[0].data?.approvedHash !== approval.approvedSpecHash || approvalEvents[0].data?.approvalPath !== repositoryRelative(cwd, approvalPath))) throw new Error("[SDD BLOCKED] Existing specification approval conflicts with the supplied receipt.");
+  const nexusTerminals = events.filter((event) => event.eventType === "specification_complete");
+  if (nexusTerminals.length > 1) throw new Error("[SDD BLOCKED] Duplicate Nexus terminal events in ledger.");
+  if (nexusTerminals.length === 1 && nexusTerminals[0].data?.artifactPath !== relativeSpecPath) {
+    throw new Error("[SDD BLOCKED] Ledger specification path does not match --spec-path.");
+  }
+  const draftHash = nexusTerminals[0]?.data?.artifactHash || null;
+  const controller = new DelegationController({ cwd, ledger, adapter: new OpenCodeAdapter({ cwd }) });
+  const absolutePlanPath = path14.join(cwd, "docs/workflows", workflowId, "technical-plan.json");
+  const relativePlanPath = repositoryRelative(cwd, absolutePlanPath);
+  if (await fs12.access(absolutePlanPath).then(() => true).catch(() => false)) {
+    throw new Error(`[SDD BLOCKED] Refusing to overwrite existing technical plan: ${relativePlanPath}`);
+  }
+  const planValidator = new TechnicalPlanValidator({ cwd });
+  const protectedPaths = [absoluteSpecPath, approvalPath, ledgerPath, absolutePlanPath, "EVIDENCE.json"];
+  const planning = await controller.executePhase({
+    phase: "planning",
+    actor: "Orion",
+    prompt: [
+      "Return only a JSON technical plan conforming to dist-assets/schemas/technical-plan.schema.json.",
+      "Use explicit repository-relative file paths in filesInScope. Do not edit files or implement.",
+      "Approved specification:",
+      specContent
+    ].join("\n\n"),
+    readOnly: true,
+    requireExplicitActor: true,
+    onOutput: async (output) => {
+      const validation = await planValidator.validateOutput(output, protectedPaths);
+      if (!validation.valid || !validation.content) throw new Error(validation.reason || "Technical plan is invalid.");
+      await writeFileAtomic(absolutePlanPath, validation.content);
+      return { artifactPath: relativePlanPath, artifactHash: sha256(validation.content) };
+    }
+  });
+  await ledger.save(ledgerPath);
+  if (!planning.success || !planning.artifact?.artifactHash) {
+    throw new Error(`[WORKFLOW BLOCKED] Orion planning phase failed: ${planning.error || "unknown failure"}`);
+  }
+  if (approvalEvents.length === 0) {
+    ledger.logEvent({
+      actor: "Atlas",
+      actorType: "control-plane",
+      observed: true,
+      eventType: "spec_approval_verified",
+      provenance: "approval-receipt",
+      data: {
+        approvalPath: repositoryRelative(cwd, approvalPath),
+        approvedHash: approval.approvedSpecHash,
+        draftHash,
+        authorizationSource: approval.receipt.authorizationSource,
+        status: "COMPLETED"
+      }
+    });
+    await ledger.save(ledgerPath);
+  }
+  const planContent = await fs12.readFile(absolutePlanPath, "utf8");
+  const parsedPlan = JSON.parse(planContent);
+  const approvedHash = approval.approvedSpecHash;
+  const planHash = String(planning.artifact.artifactHash);
+  const baseSha = (() => {
+    try {
+      return execFileSync("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8", stdio: "pipe" }).trim();
+    } catch {
+      return "unknown";
+    }
+  })();
+  const finalizer = new Finalizer({ cwd, fastTrack: false });
+  const beforeImplementation = await finalizer.snapshotManager.capture();
+  const allowedFiles = new Set(parsedPlan.filesInScope.map((entry) => String(entry.path).replaceAll("\\", "/")));
+  const implementation = await controller.executePhase({
+    phase: "implementation",
+    actor: "Astra",
+    prompt: [
+      "Implement the approved specification using the validated technical plan.",
+      `You may modify only these files: ${[...allowedFiles].join(", ")}`,
+      "Do not modify the specification, approval receipt, technical plan, ledger, or evidence artifacts.",
+      "Approved specification:",
+      specContent,
+      "Validated technical plan:",
+      planContent
+    ].join("\n\n"),
+    readOnly: false,
+    requireExplicitActor: true,
+    onOutput: async () => {
+      if (await hashFile(absoluteSpecPath) !== approvedHash) throw new Error("Approved specification changed during Astra implementation.");
+      if (await hashFile(absolutePlanPath) !== planHash) throw new Error("Technical plan changed during Astra implementation.");
+      const integrity = await finalizer.verifyIntegrity(beforeImplementation);
+      const workspaceStateMarkers = /* @__PURE__ */ new Set(["stagedDiff", "unstagedDiff", "untrackedFiles"]);
+      const changed = [...integrity.changes.added, ...integrity.changes.modified, ...integrity.changes.deleted].filter((entry) => !workspaceStateMarkers.has(entry) && !/^(branch|head|indexTree):/.test(entry)).map((entry) => String(entry).replaceAll("\\", "/"));
+      const outsideScope = changed.filter((entry) => !allowedFiles.has(entry));
+      if (outsideScope.length > 0) throw new Error(`Astra modified files outside the technical plan: ${outsideScope.join(", ")}`);
+      return { artifactPath: relativePlanPath, artifactHash: planHash };
+    }
+  });
+  await ledger.save(ledgerPath);
+  if (!implementation.success) {
+    throw new Error(`[WORKFLOW BLOCKED] Astra implementation phase failed: ${implementation.error || "unknown failure"}`);
+  }
+  const phaseEvents = ledger.getEvents().filter(
+    (event) => ["specification_complete", "planning_complete", "implementation_complete"].includes(event.eventType) && event.data?.success !== false
+  );
+  return {
+    workflowId,
+    baseSha,
+    artifactHashes: { draft: draftHash, approved: approvedHash, technicalPlan: planHash },
+    phaseOrder: phaseEvents.map((event) => event.data?.phase || event.eventType.replace("_complete", "")),
+    confirmedActors: phaseEvents.filter((event) => event.data?.runtimeAgentApplied).map((event) => ({
+      phase: event.data.phase || event.eventType.replace("_complete", ""),
+      requested: event.data.runtimeAgentRequested,
+      applied: event.data.runtimeAgentApplied
+    })),
+    ledger,
+    ledgerPath,
+    controller
+  };
+}
+async function runMasterOrchestrator({ cwd, specPath, approvalPath, override, remediationExecutor = null }) {
+  if (process.env.AI_WORKFLOW_FINALIZATION_OWNER === "execute") {
+    throw new Error("[NESTED EXECUTION BLOCKED] The parent execute process owns orchestration and finalization.");
+  }
   console.log("\n[AI WORKFLOW] Starting evidence-backed orchestration...\n");
-  const branchGate = new BranchGate({ memoryDir: path12.join(cwd, ".ai-workflow"), cwd });
+  const branchGate = new BranchGate({ memoryDir: path14.join(cwd, ".ai-workflow"), cwd });
   const taskSlug = specPath ? normalizeTaskSlugFromSpec(specPath) : "implementation";
   const gateResult = branchGate.check(override, { taskSlug });
   if (gateResult.blocked) throw new Error(`[GATE BLOCKED] ${gateResult.reason}`);
   console.log(`[PASS] Branch Gate: ${gateResult.recovered ? `${gateResult.branchBefore} -> ${gateResult.branch}` : `${gateResult.branch} is authorized`}.`);
   if (!specPath) throw new Error("[SDD BLOCKED] Missing --spec-path. An approved specification is required.");
   const validator = new SpecValidator();
-  const absoluteSpecPath = path12.isAbsolute(specPath) ? specPath : path12.join(cwd, specPath);
+  const absoluteSpecPath = path14.isAbsolute(specPath) ? specPath : path14.join(cwd, specPath);
   const validation = await validator.validate(absoluteSpecPath);
   if (!validation.valid) throw new Error(`[SDD BLOCKED] Specification is not ready: ${validation.reason}`);
   const specTier = validation.tier || "standard";
   const riskLevel = specTier === "deep" ? "high" : specTier === "tiny" ? "low" : "medium";
   const evidencePolicy = specTier === "deep" ? "required" : "optional";
   const remediationLimit = specTier === "deep" ? 3 : specTier === "tiny" ? 1 : 2;
-  const specContent = await fs10.readFile(absoluteSpecPath, "utf8");
+  const specContent = await fs12.readFile(absoluteSpecPath, "utf8");
   const workflowProfile = resolveWorkflowProfile({ request: specContent });
   const profileDefinition = getWorkflowProfile(workflowProfile);
   console.log(`[PASS] Specification: ${specTier.toUpperCase()} spec is APPROVED.`);
   console.log(`[PROFILE] ${workflowProfile} -> ${profileDefinition.owner}; skills: ${profileDefinition.skills.join(", ") || "none"}.`);
+  const deepContext = specTier === "deep" ? await runDeepImplementation(cwd, absoluteSpecPath, specPath, approvalPath, specContent) : null;
   const validateWorkflow = async () => {
     const evidence = await runCollectEvidence({
       cwd,
@@ -1998,18 +2677,36 @@ async function runMasterOrchestrator({ cwd, specPath, override, remediationExecu
       taskSlug,
       evidencePolicy,
       profile: workflowProfile,
-      branchRecovery: gateResult.recovered ? `${gateResult.branchBefore} -> ${gateResult.branch}` : "NOT_REQUIRED"
+      branchRecovery: gateResult.recovered ? `${gateResult.branchBefore} -> ${gateResult.branch}` : "NOT_REQUIRED",
+      workflowEvidence: deepContext ? {
+        workflowId: deepContext.workflowId,
+        baseSha: deepContext.baseSha,
+        artifactHashes: deepContext.artifactHashes,
+        phaseOrder: deepContext.phaseOrder,
+        confirmedActors: deepContext.confirmedActors
+      } : null
     });
     const quality = await new QualityGuard({ cwd, taskSlug, evidencePolicy, riskLevel }).verify();
-    return combineValidation(evidence, quality);
+    const combined = combineValidation(evidence, quality);
+    if (deepContext) {
+      const workflowEvidence = await new EvidenceValidator({ cwd, requireWorkflowEvidence: true }).validate();
+      if (!workflowEvidence.valid) {
+        combined.overallStatus = "FAIL_QUALITY_GATE";
+        combined.reason = workflowEvidence.reason;
+      }
+    }
+    return combined;
   };
-  let result = await validateWorkflow();
+  const observedValidate = async () => deepContext ? await deepContext.controller.validate(taskSlug, workflowProfile, validateWorkflow, evidencePolicy) : await validateWorkflow();
+  let result = await observedValidate();
+  if (deepContext) await deepContext.ledger.save(deepContext.ledgerPath);
   if (isRecoverableGateFailure(result.overallStatus)) {
     console.log(`
 [REMEDIATION REQUIRED] ${result.overallStatus}. Starting bounded remediation (limit: ${remediationLimit}).`);
     const executor = typeof remediationExecutor === "function" ? remediationExecutor : createCliRemediationExecutor(cwd);
     const healer = new HealerEngine({ cwd, remediationLimit, taskSlug });
-    result = await healer.run({ initialResult: result, validate: validateWorkflow, remediate: executor });
+    result = await healer.run({ initialResult: result, validate: observedValidate, remediate: executor });
+    if (deepContext) await deepContext.ledger.save(deepContext.ledgerPath);
   }
   if (isTerminalFailure(result.overallStatus)) {
     throw new Error(`[WORKFLOW BLOCKED] ${result.overallStatus}: ${result.reason || "Validation could not be resolved safely."}`);
@@ -2020,7 +2717,7 @@ async function runMasterOrchestrator({ cwd, specPath, override, remediationExecu
   console.log("\n--- Final Handoff ---");
   const handoffEngine = new HandoffEngine({ cwd });
   const handoffPath = await handoffEngine.generate({
-    taskId: path12.basename(specPath, ".md"),
+    taskId: path14.basename(specPath, ".md"),
     status: result.overallStatus,
     specPaths: [specPath],
     evidence: result.evidence,
@@ -2029,14 +2726,14 @@ async function runMasterOrchestrator({ cwd, specPath, override, remediationExecu
   console.log(`
 [AI WORKFLOW COMPLETE] ${result.overallStatus}`);
   if (result.remediation?.attempts) console.log(`Remediation attempts: ${result.remediation.attempts}`);
-  console.log(`Handoff Packet: ${path12.relative(cwd, handoffPath)}
+  console.log(`Handoff Packet: ${path14.relative(cwd, handoffPath)}
 `);
-  return { ...result, workflowProfile };
+  return { ...result, workflowProfile, workflowId: deepContext?.workflowId || null };
 }
 
 // src/core/healing/runtime-remediation-executor.ts
-import fs11 from "fs/promises";
-import path13 from "path";
+import fs13 from "fs/promises";
+import path15 from "path";
 import { execSync as execSync3 } from "child_process";
 function createRuntimeRemediationExecutor(cwd, ledger = null) {
   const adapter = new OpenCodeAdapter({ cwd });
@@ -2076,14 +2773,14 @@ function createRuntimeRemediationExecutor(cwd, ledger = null) {
     }
     let requestContent = {};
     try {
-      requestContent = JSON.parse(await fs11.readFile(requestPath, "utf8"));
+      requestContent = JSON.parse(await fs13.readFile(requestPath, "utf8"));
     } catch {
     }
     const filesBefore = getChangedFiles2();
     const fileContentsBefore = {};
     for (const file of filesBefore) {
       try {
-        fileContentsBefore[file] = await fs11.readFile(path13.join(cwd, file), "utf8");
+        fileContentsBefore[file] = await fs13.readFile(path15.join(cwd, file), "utf8");
       } catch {
         fileContentsBefore[file] = null;
       }
@@ -2121,7 +2818,7 @@ Please inspect the code, identify the root cause of these failures (e.g. failing
         changedFiles.push(file);
       } else {
         try {
-          const contentAfter = await fs11.readFile(path13.join(cwd, file), "utf8");
+          const contentAfter = await fs13.readFile(path15.join(cwd, file), "utf8");
           if (contentAfter !== fileContentsBefore[file]) {
             changedFiles.push(file);
           }
@@ -2158,9 +2855,22 @@ Please inspect the code, identify the root cause of these failures (e.g. failing
 }
 
 // src/cli/commands/execute.ts
-import fs12 from "fs/promises";
-import path14 from "path";
+import fs14 from "fs/promises";
+import path16 from "path";
 import { execSync as execSync4 } from "child_process";
+var INTEGRITY_METADATA_CHANGES = /* @__PURE__ */ new Set(["stagedDiff", "unstagedDiff", "untrackedFiles"]);
+function extractDeliveryChangedFiles(integrity) {
+  const files = /* @__PURE__ */ new Set();
+  for (const file of integrity.changes.added) files.add(file);
+  for (const file of integrity.changes.deleted) files.add(file);
+  for (const change of integrity.changes.modified) {
+    if (change.startsWith("branch:") || change.startsWith("head:")) continue;
+    if (INTEGRITY_METADATA_CHANGES.has(change)) continue;
+    if (change.startsWith("indexTree:")) continue;
+    files.add(change);
+  }
+  return [...files].sort();
+}
 async function captureReadOnlyState(cwd, fastTrack = false) {
   const finalizer = new Finalizer({ cwd, fastTrack });
   const snapshot = await finalizer.snapshotManager.capture();
@@ -2248,6 +2958,13 @@ async function classifyAndPlanExecution(naturalRequest, cwd, taskSlug, delegatio
   const plan = planner.plan(classification, taskSlug);
   console.log(`[PLANNED] Owner: ${plan.owner}, Remediation limit: ${plan.remediationLimit}`);
   stateMachine.transitionTo("PLANNED");
+  if (classification.requestUnderstanding.deliveryMode === "workspace") {
+    const deliveryDecision = await new DeliveryDecisionEngine({ cwd }).determineDecision({ userRequest: naturalRequest });
+    if (deliveryDecision.decision.startsWith("BLOCK_")) {
+      stateMachine.transitionTo("BLOCKED");
+      throw new Error(`[CONTEXT BLOCKED] NEEDS_CLARIFICATION: ${deliveryDecision.reason || deliveryDecision.decision}`);
+    }
+  }
   return { plan, classification };
 }
 function runBranchGate(plan, taskSlug, cwd, stateMachine, branchGate) {
@@ -2265,12 +2982,12 @@ function runBranchGate(plan, taskSlug, cwd, stateMachine, branchGate) {
 }
 async function createSpecIfRequired(plan, classification, taskSlug, cwd) {
   if (plan.specPath) {
-    const fullSpecPath = path14.join(cwd, plan.specPath);
-    const specExists = await fs12.access(fullSpecPath).then(() => true).catch(() => false);
+    const fullSpecPath = path16.join(cwd, plan.specPath);
+    const specExists = await fs14.access(fullSpecPath).then(() => true).catch(() => false);
     if (!specExists) {
-      await fs12.mkdir(path14.dirname(fullSpecPath), { recursive: true });
-      const specTemplatePath = path14.join(cwd, ".ai-workflow/templates/specs/standard.md");
-      const templateContent = await fs12.readFile(specTemplatePath, "utf8").catch(() => {
+      await fs14.mkdir(path16.dirname(fullSpecPath), { recursive: true });
+      const specTemplatePath = path16.join(cwd, ".ai-workflow/templates/specs/standard.md");
+      const templateContent = await fs14.readFile(specTemplatePath, "utf8").catch(() => {
         return `# [STANDARD] Specification: ${classification.request}
 
 ## Metadata
@@ -2298,11 +3015,87 @@ async function createSpecIfRequired(plan, classification, taskSlug, cwd) {
 
 - [ ] Behavior tests pass`;
       });
-      await fs12.writeFile(fullSpecPath, templateContent);
+      await fs14.writeFile(fullSpecPath, templateContent);
       console.log(`[EXECUTE] Created DRAFT specification template at: ${plan.specPath}`);
     }
   }
 }
+async function runDeepSpecificationCheckpoint(plan, classification, taskSlug, cwd, delegationController, stateMachine) {
+  if (!plan.specPath) throw new Error("[SDD BLOCKED] Required specification path was not planned.");
+  const absoluteSpecPath = path16.resolve(cwd, plan.specPath);
+  const relativeSpecPath = path16.relative(cwd, absoluteSpecPath).replaceAll("\\", "/");
+  if (relativeSpecPath.startsWith("../") || path16.isAbsolute(relativeSpecPath)) {
+    throw new Error("[SDD BLOCKED] Planned specification path escapes the repository.");
+  }
+  if (await fs14.access(absoluteSpecPath).then(() => true).catch(() => false)) {
+    throw new Error(`[SDD BLOCKED] Refusing to overwrite existing specification: ${relativeSpecPath}`);
+  }
+  const approvalPath = `.ai-workflow/approvals/${taskSlug}.json`;
+  const validator = new SpecValidator();
+  stateMachine.transitionTo("DELEGATED");
+  const prompt = [
+    "Produce only the complete Markdown for a [DEEP] specification.",
+    "The Metadata Status must be exactly DRAFT. Include concrete acceptance criteria as unchecked checkboxes.",
+    "Do not approve the specification, create a receipt, edit files, or implement code.",
+    `Workflow ID: ${taskSlug}`,
+    `Request: ${classification.request}`
+  ].join("\n");
+  const phaseResult = await delegationController.executePhase({
+    phase: "specification",
+    actor: "Nexus",
+    prompt,
+    readOnly: true,
+    requireExplicitActor: true,
+    onOutput: async (output) => {
+      const content = stripMarkdownFence(output);
+      const validation = validator.validateDraftContent(content);
+      if (!validation.valid) throw new Error(`Nexus DRAFT rejected: ${validation.reason}`);
+      await writeFileAtomic(absoluteSpecPath, content);
+      return { artifactPath: relativeSpecPath, artifactHash: sha256(content), draftHash: sha256(content) };
+    }
+  });
+  if (!phaseResult.success) {
+    stateMachine.transitionTo("BLOCKED");
+    throw new Error(`[SDD BLOCKED] Nexus specification phase failed: ${phaseResult.error || "unknown failure"}`);
+  }
+  const draftHash = String(phaseResult.artifact?.artifactHash || "");
+  delegationController.ledger?.logEvent({
+    actor: "Atlas",
+    actorType: "control-plane",
+    observed: true,
+    eventType: "approval_checkpoint",
+    provenance: "sdd-control-plane",
+    data: {
+      specSource: "nexus",
+      specPath: relativeSpecPath,
+      approvalPath,
+      draftHash,
+      approvedHash: null,
+      planHash: null,
+      status: "BLOCKED",
+      reason: "SDD APPROVAL REQUIRED"
+    }
+  });
+  stateMachine.transitionTo("BLOCKED");
+  const resumeCommand = `aw run --spec-path=${relativeSpecPath} --approval-path=${approvalPath}`;
+  console.log(`
+[BLOCKED] SDD APPROVAL REQUIRED`);
+  console.log(`Specification: ${relativeSpecPath}`);
+  console.log(`Resume: ${resumeCommand}
+`);
+  return {
+    overallStatus: "BLOCKED",
+    reason: "SDD APPROVAL REQUIRED",
+    checkpoint: "approval",
+    exitCode: 2,
+    workflowId: taskSlug,
+    specPath: relativeSpecPath,
+    approvalPath,
+    draftHash,
+    resumeCommand,
+    stateHistory: stateMachine.getHistory()
+  };
+}
 async function runImplementation(plan, classification, delegationController, stateMachine, fastTrack = false) {
   stateMachine.transitionTo("DELEGATED");
   stateMachine.transitionTo("IMPLEMENTING");
@@ -2310,7 +3103,21 @@ async function runImplementation(plan, classification, delegationController, sta
   if (plan.specPath) {
     promptMsg = `Please review and fill in the specification file at: ${plan.specPath}. Make sure to change the Status field to 'APPROVED' in the Metadata section, and then implement the behavior described.`;
   }
-  const runResult = await delegationController.implement(promptMsg, plan.owner, { readOnly: !plan.branchNeeded, fastTrack });
+  if (plan.branchNeeded) {
+    promptMsg = [
+      promptMsg,
+      "",
+      "AIWK delivery contract:",
+      "- Work in the active repository; printed code is not a substitute for workspace delivery.",
+      "- Keep the diff scoped and run proportional validation.",
+      "- The parent already satisfied the branch gate. Do not repeat branch/status checks unless a new safety concern makes them necessary.",
+      "- Documentation, screenshots, Sage review, Phoenix remediation, and persisted evidence are conditional; do not create them unless the request, risk policy, or an observed finding requires them.",
+      "- Do not run collect-evidence, create a handoff, or finalize this workflow; the parent execute process is the sole finalization owner.",
+      "- End with exactly one machine-readable line: AIWK_DELIVERY_OUTCOME: CHANGED or AIWK_DELIVERY_OUTCOME: ALREADY_SATISFIED.",
+      "- Use ALREADY_SATISFIED only when inspection and relevant validation prove that no repository change is needed."
+    ].join("\n");
+  }
+  const runResult = await delegationController.implement(promptMsg, plan.owner, { readOnly: !plan.branchNeeded, fastTrack, orchestratedChild: true });
   if (!runResult.success) {
     console.error(`[EXECUTE] OpenCode adapter execution reported failure: ${runResult.error || "Unknown error"}`);
     stateMachine.transitionTo("BLOCKED");
@@ -2331,9 +3138,13 @@ async function runReadOnlyConfinementCheck(readOnlyStateBefore, cwd, stateMachin
 ${violations.join("\n")}`);
   }
 }
-async function runValidation(plan, taskSlug, cwd, gateResult, naturalRequest, delegationController, stateMachine) {
+async function runValidation(plan, taskSlug, cwd, gateResult, naturalRequest, claimedOutcome, deliveryBaseline, deliveryFinalizer, delegationController, stateMachine) {
   stateMachine.transitionTo("VALIDATING");
   const validateWorkflow = async () => {
+    const deliveryIntegrity = await deliveryFinalizer.verifyIntegrity(deliveryBaseline);
+    const deliveryChangedFiles = extractDeliveryChangedFiles(deliveryIntegrity);
+    const deliveryAddedFiles = deliveryIntegrity.changes.added.filter((file) => deliveryChangedFiles.includes(file));
+    const deliveryDeletedFiles = deliveryIntegrity.changes.deleted.filter((file) => deliveryChangedFiles.includes(file));
     const evidence = await runCollectEvidence({
       cwd,
       exitOnError: false,
@@ -2342,7 +3153,11 @@ async function runValidation(plan, taskSlug, cwd, gateResult, naturalRequest, de
       profile: plan.profile,
       branchRecovery: gateResult.recovered ? `${gateResult.branchBefore} -> ${gateResult.branch}` : "NOT_REQUIRED",
       userRequest: naturalRequest,
-      explicitApprovals: process.env.AI_WORKFLOW_APPROVALS ? process.env.AI_WORKFLOW_APPROVALS.split(",").map((a) => a.trim()) : []
+      explicitApprovals: process.env.AI_WORKFLOW_APPROVALS ? process.env.AI_WORKFLOW_APPROVALS.split(",").map((a) => a.trim()) : [],
+      claimedOutcome,
+      deliveryChangedFiles,
+      deliveryAddedFiles,
+      deliveryDeletedFiles
     });
     const quality = await new QualityGuard({
       cwd,
@@ -2415,7 +3230,7 @@ async function generateFinalHandoff(plan, taskSlug, cwd, finalState, evidence) {
   });
   console.log(`
 [AI WORKFLOW COMPLETE] ${finalState}`);
-  console.log(`Handoff Packet: ${path14.relative(cwd, handoffPath)}
+  console.log(`Handoff Packet: ${path16.relative(cwd, handoffPath)}
 `);
   return handoffPath;
 }
@@ -2425,12 +3240,12 @@ async function runFastTrackValidation(cwd, result, checkBranchSafety) {
   checkBranchSafety();
   const changedFiles = result.evidence?.changedFiles || [];
   console.log(`[FAST-TRACK] Changed files detected:`, changedFiles);
-  const evidencePath = path14.join(cwd, "EVIDENCE.json");
-  const hasEvidence = await fs12.access(evidencePath).then(() => true).catch(() => false);
+  const evidencePath = path16.join(cwd, "EVIDENCE.json");
+  const hasEvidence = await fs14.access(evidencePath).then(() => true).catch(() => false);
   if (hasEvidence) {
-    const { EvidenceValidator } = await import("../evidence-validator-76ZQQYDU.js");
+    const { EvidenceValidator: EvidenceValidator2 } = await import("../evidence-validator-HS3NTWAB.js");
     const isTest = process.env.NODE_ENV === "test" || process.env.VITEST === "true";
-    const evidenceValidator = new EvidenceValidator({ cwd, skipFileCheck: isTest, skipGitCheck: isTest });
+    const evidenceValidator = new EvidenceValidator2({ cwd, skipFileCheck: isTest, skipGitCheck: isTest });
     const valResult = await evidenceValidator.validate();
     if (!valResult.valid) {
       console.error(`
@@ -2445,7 +3260,7 @@ async function runFidelityValidation(naturalRequest, result, finalizer) {
     userRequest: naturalRequest,
     projectContext: result.evidence?.deliveryDecision?.projectContext || null,
     deliveryDecision: result.evidence?.deliveryDecision || null,
-    changedFiles: result.evidence?.changedFiles || [],
+    changedFiles: result.evidence?.deliveryChangedFiles || result.evidence?.changedFiles || [],
     evidence: result.evidence || null,
     explicitApprovals: process.env.AI_WORKFLOW_APPROVALS ? process.env.AI_WORKFLOW_APPROVALS.split(",").map((a) => a.trim()) : []
   });
@@ -2462,7 +3277,7 @@ function computeFinalState(finalStatus) {
   if (finalStatus === "PASS_WITH_NOTES") return "COMPLETED_WITH_NOTES";
   return "BLOCKED";
 }
-async function executeReadOnlyWorkflow(cwd, stateMachine, readOnlyStateBefore, fastTrack) {
+async function executeReadOnlyWorkflow(cwd, stateMachine, readOnlyStateBefore, fastTrack, deliveryOutcome) {
   await runReadOnlyConfinementCheck(readOnlyStateBefore, cwd, stateMachine, fastTrack);
   stateMachine.transitionTo("IMPLEMENTED");
   stateMachine.transitionTo("VALIDATING");
@@ -2476,7 +3291,11 @@ async function executeReadOnlyWorkflow(cwd, stateMachine, readOnlyStateBefore, f
     overallStatus: "PASS",
     evidence: {
       internalStatus: "PASS",
-      commandsRun: []
+      commandsRun: [],
+      deliveryMode: "answer-only",
+      deliveryOutcome,
+      testAction: "none",
+      testReason: "Read-only work does not change executable behavior."
     },
     quality: {
       overallStatus: "PASS"
@@ -2485,6 +3304,9 @@ async function executeReadOnlyWorkflow(cwd, stateMachine, readOnlyStateBefore, f
   };
 }
 async function runExecute({ cwd, naturalRequest, taskSlug: taskSlugOverride }) {
+  if (process.env.AI_WORKFLOW_FINALIZATION_OWNER === "execute") {
+    throw new Error("[NESTED EXECUTION BLOCKED] The parent execute process owns orchestration and finalization.");
+  }
   if (!naturalRequest || !naturalRequest.trim()) {
     throw new Error("Missing request. Please provide a natural request string via positional arguments or --request flag.");
   }
@@ -2495,13 +3317,15 @@ async function runExecute({ cwd, naturalRequest, taskSlug: taskSlugOverride }) {
   const ledger = new EvidenceLedger({ cwd, workflowId: taskSlug });
   const delegationController = new DelegationController({ cwd, ledger, adapter: new OpenCodeAdapter({ cwd }) });
   let plan = null;
+  let branchAuthorized = false;
   try {
     const stateMachine = new WorkflowStateMachine();
     const { plan: planObj, classification } = await classifyAndPlanExecution(naturalRequest, cwd, taskSlug, delegationController, stateMachine);
     plan = planObj;
     const fastTrack = plan.riskLevel === "low" && (!plan.branchNeeded || plan.evidencePolicy === "optional");
-    const branchGate = new BranchGate({ memoryDir: path14.join(cwd, ".ai-workflow"), cwd });
+    const branchGate = new BranchGate({ memoryDir: path16.join(cwd, ".ai-workflow"), cwd });
     const gateResult = runBranchGate(plan, taskSlug, cwd, stateMachine, branchGate);
+    branchAuthorized = true;
     const checkBranchSafety = () => {
       if (!planObj.branchNeeded) return;
       const currentBranch = branchGate.getCurrentBranch();
@@ -2510,20 +3334,43 @@ async function runExecute({ cwd, naturalRequest, taskSlug: taskSlugOverride }) {
         throw new Error(`[WORKFLOW BLOCKED] Security violation: current branch is protected '${currentBranch}'!`);
       }
     };
+    if (classification.specPolicy === "required") {
+      return await runDeepSpecificationCheckpoint(plan, classification, taskSlug, cwd, delegationController, stateMachine);
+    }
     await createSpecIfRequired(plan, classification, taskSlug, cwd);
     let readOnlyStateBefore = null;
+    let deliveryBaseline = null;
+    const deliveryFinalizer = new Finalizer({ cwd, fastTrack: false });
     if (!plan.branchNeeded) {
       readOnlyStateBefore = await captureReadOnlyState(cwd, fastTrack);
+    } else {
+      deliveryBaseline = await deliveryFinalizer.snapshotManager.capture();
     }
-    await runImplementation(plan, classification, delegationController, stateMachine, fastTrack);
+    const implementationResult = await runImplementation(plan, classification, delegationController, stateMachine, fastTrack);
+    const claimedOutcome = parseDeliveryOutcomeClaim(implementationResult.output || "");
     if (!plan.branchNeeded && readOnlyStateBefore) {
-      return await executeReadOnlyWorkflow(cwd, stateMachine, readOnlyStateBefore, fastTrack);
+      const readOnlyOutcome = classification.requestUnderstanding.mutationIntent === "readonly" ? "READ_ONLY_RESULT" : "PREVIEW_ONLY";
+      return await executeReadOnlyWorkflow(cwd, stateMachine, readOnlyStateBefore, fastTrack, readOnlyOutcome);
+    }
+    if (!deliveryBaseline) {
+      throw new Error("[WORKFLOW BLOCKED] Missing delivery baseline for a write workflow.");
     }
     stateMachine.transitionTo("IMPLEMENTED");
     checkBranchSafety();
     const finalizer = new Finalizer({ cwd, fastTrack });
     const snapshotRef = { current: await finalizer.snapshotManager.capture() };
-    const { result: valResult, validateWorkflow } = await runValidation(plan, taskSlug, cwd, gateResult, naturalRequest, delegationController, stateMachine);
+    const { result: valResult, validateWorkflow } = await runValidation(
+      plan,
+      taskSlug,
+      cwd,
+      gateResult,
+      naturalRequest,
+      claimedOutcome,
+      deliveryBaseline,
+      deliveryFinalizer,
+      delegationController,
+      stateMachine
+    );
     let result = valResult;
     result = await runBoundedRemediation(
       plan,
@@ -2573,10 +3420,26 @@ async function runExecute({ cwd, naturalRequest, taskSlug: taskSlugOverride }) {
     }
     const finalState = computeFinalState(finalStatus);
     stateMachine.transitionTo(finalState);
+    ledger.logEvent({
+      actor: "Atlas",
+      actorType: "control-plane",
+      observed: true,
+      eventType: "finalization_started",
+      provenance: "execute",
+      data: { owner: "execute", status: finalState }
+    });
     await generateFinalHandoff(plan, taskSlug, cwd, finalState, result.evidence);
+    ledger.logEvent({
+      actor: "Atlas",
+      actorType: "control-plane",
+      observed: true,
+      eventType: "finalization_completed",
+      provenance: "execute",
+      data: { owner: "execute", status: finalState }
+    });
     return { ...result, overallStatus: finalStatus, stateHistory: stateMachine.getHistory() };
   } finally {
-    if (plan && !plan.branchNeeded) {
+    if (!branchAuthorized || plan && !plan.branchNeeded) {
       console.log(`
 [READ-ONLY LEDGER] (In-Memory/Stdout)
 ${JSON.stringify(ledger.getEvents(), null, 2)}
@@ -2585,6 +3448,7 @@ ${JSON.stringify(ledger.getEvents(), null, 2)}
       try {
         await ledger.save(`.ai-workflow/history/${taskSlug}-ledger.json`);
       } catch (err) {
+        if (plan?.riskLevel === "high") throw err;
       }
     }
   }
@@ -2621,7 +3485,7 @@ async function runClean({ cwd, yes = false, dryRun = false, purgeAgents = false
     "opencode"
   ];
   const hasAgents = existsSync(join(cwd, ".agents"));
-  const existingTargets = targets.map((name) => join(cwd, name)).filter((path15) => existsSync(path15) || isSymlink2(path15));
+  const existingTargets = targets.map((name) => join(cwd, name)).filter((path17) => existsSync(path17) || isSymlink2(path17));
   if (existingTargets.length === 0 && (!hasAgents || !purgeAgents)) {
     console.log("No AI Workflow configuration or files found in the current project.");
     return;
@@ -2630,7 +3494,7 @@ async function runClean({ cwd, yes = false, dryRun = false, purgeAgents = false
   console.log("===============================");
   if (dryRun) {
     console.log("[DRY RUN] The following items would be deleted:");
-    existingTargets.forEach((path15) => console.log(`  - ${path15}`));
+    existingTargets.forEach((path17) => console.log(`  - ${path17}`));
     if (hasAgents && purgeAgents) {
       console.log(`  - ${join(cwd, ".agents")} (customizations folder)`);
     } else if (hasAgents) {
@@ -2684,12 +3548,14 @@ function printHelp() {
 
 Usage:
   ai-workflow execute "<request>" [--task=<slug>] [--request="<request>"]
-  ai-workflow run --spec-path=<path>
+  ai-workflow run --spec-path=<path> [--approval-path=<path>]
   ai-workflow init [--yes] [--force] [--dry-run] [--no-install] [--no-overwrite] [--claude] [--codex] [--antigravity] [--profile=<profile>]
   ai-workflow validate [--a11y] [--visual-dist=<path>] [--port=<port>]
   ai-workflow collect-evidence [--task=<slug>] [--evidence-policy=<optional|required>] [--mode=<quick|standard|full>] [--dry-run] [--visual-dist=<path>] [--port=<port>]
   ai-workflow doctor
   ai-workflow clean [--yes] [--dry-run] [--purge-agents]
+  ai-workflow lint skills
+  ai-workflow skill create <name> [--description="<desc>"] [--dry-run] [--force]
 
 Commands:
   execute           Orchestrate execution of a natural request through the state machine
@@ -2698,10 +3564,13 @@ Commands:
   collect-evidence  Run observed project validation; persists EVIDENCE.json under required evidence policy
   doctor            Verify local ai-workflow installation
   clean             De-initialize and remove AI Workflow files and symlinks from the project
+  lint              Run specialized linters (e.g. lint skills)
+  skill             Manage AI workflow skills (e.g. create)
 `);
 }
 function parseFlags(args) {
   const specPathArg = args.find((arg) => arg.startsWith("--spec-path="));
+  const approvalPathArg = args.find((arg) => arg.startsWith("--approval-path="));
   const profileEqArg = args.find((arg) => arg.startsWith("--profile="));
   const taskArg = args.find((arg) => arg.startsWith("--task="));
   const modeArg = args.find((arg) => arg.startsWith("--mode="));
@@ -2722,6 +3591,7 @@ function parseFlags(args) {
     antigravity: args.includes("--antigravity"),
     "dev-mode": args.includes("--dev-mode"),
     specPath: specPathArg ? specPathArg.replace("--spec-path=", "") : void 0,
+    approvalPath: approvalPathArg ? approvalPathArg.replace("--approval-path=", "") : void 0,
     profile: profileVal || void 0,
     taskSlug: taskArg ? taskArg.replace("--task=", "") : void 0,
     mode: modeArg ? modeArg.replace("--mode=", "") : void 0,
@@ -2743,7 +3613,7 @@ var commandMap = {
       taskSlug: flags.taskSlug
     });
     if (result && (result.overallStatus === "FAIL_QUALITY_GATE" || result.overallStatus === "BLOCKED" || result.overallStatus === "FAIL")) {
-      process.exit(1);
+      process.exitCode = result.exitCode === 2 ? 2 : 1;
     }
   },
   run: async (_, flags) => {
@@ -2773,7 +3643,7 @@ var commandMap = {
     });
   },
   validate: async (_, flags) => {
-    const { runValidate } = await import("../validate-A46WUBVZ.js");
+    const { runValidate } = await import("../validate-F3ZH63LI.js");
     await runValidate({
       cwd: process.cwd(),
       taskSlug: flags.taskSlug,
@@ -2790,6 +3660,38 @@ var commandMap = {
       cwd: process.cwd(),
       ...flags
     });
+  },
+  lint: async (args) => {
+    if (args[0] === "skills") {
+      const { runLinter } = await import("../skill-frontmatter-linter-FMJADOK4.js");
+      const { errors, filesScanned } = runLinter(process.cwd());
+      console.log(`Scanned ${filesScanned} skill files.`);
+      if (errors.length > 0) {
+        console.error(`\\nFound ${errors.length} frontmatter issues:`);
+        for (const err of errors) {
+          console.error(`- ${err.filePath}: ${err.message}`);
+        }
+        process.exit(1);
+      } else {
+        console.log("All skills passed frontmatter linting.");
+      }
+    } else {
+      console.error("Unknown lint target. Supported: skills");
+      process.exit(1);
+    }
+  },
+  skill: async (args) => {
+    if (args[0] === "create") {
+      const { parseSkillCreateArgs, runSkillCreate } = await import("../skill-4MEGJ3DO.js");
+      const createOptions = parseSkillCreateArgs(args.slice(1));
+      await runSkillCreate({
+        cwd: process.cwd(),
+        ...createOptions
+      });
+    } else {
+      console.error("Unknown skill command. Supported: create");
+      process.exit(1);
+    }
   }
 };
 async function runCli(args) {