@xemahq/xema 0.16.0 → 0.17.0

package/dist/assets/appliance-lean/distribution.lock.json

@@ -1,90 +1,7 @@
 {
-  "schemaVersion": 1,
+  "schemaVersion": 2,
   "distributionId": "appliance-lean",
   "biomes": [
-    {
-      "id": "contribution-test",
-      "version": "0.0.1",
-      "tier": "kernel",
-      "target": "server",
-      "origin": "first-party",
-      "mandatory": true,
-      "installPolicy": "required",
-      "repo": "repos/xema-base",
-      "path": "repos/xema-base/biomes/kernel/contribution-test",
-      "services": [],
-      "runtimeComponents": [],
-      "serviceDependencies": [],
-      "displayName": "Contribution Protocol Test Biome",
-      "packageName": "@xemahq/biomes-kernel-contribution-test",
-      "requiresServerBiomes": [],
-      "optionalServerBiomes": [],
-      "audience": "org",
-      "storeListed": false,
-      "sourceManifestHash": "a5989a0adba0fae65f1cd3107b38896d1df9742ba35d0de670be7f10fa43aeb7",
-      "display": {
-        "icon": "flask-conical",
-        "category": "build",
-        "summary": "Synthetic kernel test biome exercising the XSI Contribution Protocol, capability resolution, and boundary enforcement."
-      }
-    },
-    {
-      "id": "output-surface-control",
-      "version": "1.0.0",
-      "tier": "kernel",
-      "target": "server",
-      "origin": "first-party",
-      "mandatory": true,
-      "installPolicy": "required",
-      "repo": "repos/xema-base",
-      "path": "repos/xema-base/biomes/kernel/output-surface-control",
-      "services": [],
-      "runtimeComponents": [],
-      "serviceDependencies": [],
-      "displayName": "Output Surface Control",
-      "packageName": "@xemahq/biomes-kernel-output-surface-control",
-      "requiresServerBiomes": [
-        "runtime"
-      ],
-      "optionalServerBiomes": [],
-      "audience": "org",
-      "storeListed": false,
-      "sourceManifestHash": "8c773b92dc42534da668a0857840810ad581066db735e27a8cdbdb750a0b10b9",
-      "display": {
-        "icon": "refresh-cw",
-        "category": "operate",
-        "summary": "Output-surface control tools: re-trigger the deterministic install-to-start pipeline over the workspace-proxy API."
-      }
-    },
-    {
-      "id": "output-surface-inspector",
-      "version": "1.0.0",
-      "tier": "kernel",
-      "target": "server",
-      "origin": "first-party",
-      "mandatory": true,
-      "installPolicy": "required",
-      "repo": "repos/xema-base",
-      "path": "repos/xema-base/biomes/kernel/output-surface-inspector",
-      "services": [],
-      "runtimeComponents": [],
-      "serviceDependencies": [],
-      "displayName": "Output Surface Inspector",
-      "packageName": "@xemahq/biomes-kernel-output-surface-inspector",
-      "requiresServerBiomes": [
-        "output-surface-control",
-        "runtime"
-      ],
-      "optionalServerBiomes": [],
-      "audience": "org",
-      "storeListed": false,
-      "sourceManifestHash": "b6b0bfb9861229725e487a3d16f1f7d842fb5afeed545e7e43d3b7cc8abdd289",
-      "display": {
-        "icon": "search",
-        "category": "operate",
-        "summary": "Output-surface inspection: browser tool, inspector sub-agent, and bridge for read-only diagnosis of live pages."
-      }
-    },
     {
       "id": "runtime",
       "version": "1.0.0",
@@ -96,7 +13,9 @@
       "repo": "repos/xema-base",
       "path": "repos/xema-base/biomes/kernel/runtime",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Xema Runtime Kernel",
       "packageName": "@xemahq/biomes-kernel-runtime",
@@ -109,64 +28,9 @@
         "icon": "box",
         "category": "runtime",
         "summary": "Kernel runtime baseline: base workspace manifests, custom OpenCode tools and plugins, and the canonical MCP catalog."
-      }
-    },
-    {
-      "id": "studio-author",
-      "version": "1.0.0",
-      "tier": "kernel",
-      "target": "server",
-      "origin": "first-party",
-      "mandatory": true,
-      "installPolicy": "required",
-      "repo": "repos/xema-base",
-      "path": "repos/xema-base/biomes/kernel/studio-author",
-      "services": [],
-      "runtimeComponents": [],
-      "serviceDependencies": [],
-      "displayName": "Studio Author",
-      "packageName": "@xemahq/biomes-kernel-studio-author",
-      "requiresServerBiomes": [
-        "runtime",
-        "subagents"
-      ],
-      "optionalServerBiomes": [],
-      "audience": "org",
-      "storeListed": false,
-      "sourceManifestHash": "9c0a9522ef36140ce704d5be39ae44cde175b1addec90ba56d36970ace803f1e",
-      "display": {
-        "icon": "wand",
-        "category": "build",
-        "summary": "Authoring co-pilot for Agent Studio: workflow/spec authors and a build-with-an-agent profile that emits typed proposals."
-      }
-    },
-    {
-      "id": "subagents",
-      "version": "1.0.0",
-      "tier": "kernel",
-      "target": "server",
-      "origin": "first-party",
-      "mandatory": true,
-      "installPolicy": "required",
-      "repo": "repos/xema-base",
-      "path": "repos/xema-base/biomes/kernel/subagents",
-      "services": [],
-      "runtimeComponents": [],
-      "serviceDependencies": [],
-      "displayName": "Xema Universal Subagents",
-      "packageName": "@xemahq/biomes-kernel-subagents",
-      "requiresServerBiomes": [
-        "runtime"
-      ],
-      "optionalServerBiomes": [],
-      "audience": "org",
-      "storeListed": false,
-      "sourceManifestHash": "c7d66ce06a303e40ae4901694c9617fab3645185752cce5f214cd29f9bed24c0",
-      "display": {
-        "icon": "users",
-        "category": "runtime",
-        "summary": "Canonical roster of platform subagents and gate-reviewers every install boots with, plus their MCP tool-profiles."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "activity-web",
@@ -179,7 +43,9 @@
       "repo": "submodules/xema-host-web",
       "path": "submodules/xema-host-web/biomes/system/activity-web",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Activity (Web)",
       "packageName": "@xemahq/biomes-system-activity-web",
@@ -189,12 +55,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "e6ca64b0c2e26a4a405a7ceea824050b31dd34dbe22ac4fcbc38134cecf26ba5",
+      "sourceManifestHash": "4243795eb988fd49f02f0ddf568d113f490e3dcf35cdcfc8aa1453e4956a685a",
       "display": {
         "icon": "activity",
         "category": "operate",
         "summary": "Track activity and audit events."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "audit",
@@ -209,7 +77,9 @@
       "services": [
         "audit-log-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "audit-log-api",
@@ -222,9 +92,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -236,12 +106,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "47d7d7203aed8644e0d4b768b5e6781fa0e1bc5ca5e1cffa5e77df9a27e8f155",
+      "sourceManifestHash": "64c24fbe6a8394eee5ecdb0163bc88c2dd52f1e8bdbc0588810e5502b61f7128",
       "display": {
         "icon": "scroll-text",
         "category": "governance",
         "summary": "Tamper-evident, append-only audit log of platform actions for compliance and forensics."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "authorization",
@@ -256,7 +128,9 @@
       "services": [
         "authorization-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "authorization-api",
@@ -269,12 +143,25 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
+        },
+        {
+          "consumerService": "authorization-api",
+          "requiredService": "resource-governance-api",
+          "owner": {
+            "kind": "biome",
+            "biomeId": "resource-governance",
+            "target": "server",
+            "repo": "repos/xema-base",
+            "path": "repos/xema-base/biomes/resource-governance",
+            "version": "0.1.0",
+            "sourceManifestHash": "9acb9151fdba684642aad6166d46f43896d0d122cfaa1f00c4137f5ff4033fad"
+          }
         }
       ],
       "displayName": "Authorization",
@@ -283,69 +170,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "757ad1901fbeaeb8e2ff20bf7f5aa381e03ae9a72c43ac9a88eabc1af92371a1",
+      "sourceManifestHash": "3687551f3883d53cba6c201ecb449d4aabb4005a9ccd1eb429732fb497c912d0",
       "display": {
         "icon": "shield",
         "category": "governance",
         "summary": "Policy decision point: resolves capability and scope grants for every actor/action pair (OpenFGA/OPA)."
-      }
-    },
-    {
-      "id": "biome-adapter-host",
-      "version": "0.1.0",
-      "tier": "system",
-      "target": "server",
-      "origin": "first-party",
-      "mandatory": false,
-      "installPolicy": "required",
-      "repo": "repos/xema-base",
-      "path": "repos/xema-base/biomes/biome-adapter-host",
-      "services": [],
-      "runtimeComponents": [
-        "biome-adapter-host"
-      ],
-      "serviceDependencies": [],
-      "displayName": "Biome Adapter Host",
-      "packageName": "@xemahq/biomes-biome-adapter-host",
-      "requiresServerBiomes": [],
-      "optionalServerBiomes": [],
-      "audience": "org",
-      "storeListed": true,
-      "sourceManifestHash": "0bc4a9a1653d2bcbd91cb6fdd252b955a652594d2fb7c0e2601655e36eb54c08",
-      "display": {
-        "icon": "puzzle",
-        "category": "connect",
-        "summary": "Adapter-SDK runtime: hosts integration adapter contributions shipped by other biomes."
       },
-      "launch": "per-installation"
-    },
-    {
-      "id": "biome-fetcher",
-      "version": "0.1.0",
-      "tier": "system",
-      "target": "server",
-      "origin": "first-party",
-      "mandatory": false,
-      "installPolicy": "required",
-      "repo": "repos/xema-base",
-      "path": "repos/xema-base/biomes/biome-fetcher",
-      "services": [
-        "biome-fetcher-api"
-      ],
-      "runtimeComponents": [],
-      "serviceDependencies": [],
-      "displayName": "Biome Fetcher",
-      "packageName": "@xemahq/biomes-biome-fetcher",
-      "requiresServerBiomes": [],
-      "optionalServerBiomes": [],
-      "audience": "org",
-      "storeListed": true,
-      "sourceManifestHash": "7cf92483d2880ce99165350cc6f0497ce34b3fbe78bbea6aa7580d770b2ef0f9",
-      "display": {
-        "icon": "download",
-        "category": "build",
-        "summary": "Downloads and verifies biome bundles from registries, staging them for the biome-host installer."
-      }
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "biome-host",
@@ -360,7 +192,9 @@
       "services": [
         "biome-host-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "biome-host-api",
@@ -373,9 +207,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -387,12 +221,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "6e522468aff28ebd3f8989d63f061cf8ead477a37844f804ae8b0f434f0258ff",
+      "sourceManifestHash": "0a67a684074bf91556c7529959bc40eefca409822cf6252ebb98faad91e6bbfa",
       "display": {
         "icon": "package",
         "category": "build",
         "summary": "Biome installer and lifecycle manager: validates manifests, applies Helm sub-charts, tracks install state."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "capabilities-web",
@@ -405,7 +241,9 @@
       "repo": "submodules/xema-host-web",
       "path": "submodules/xema-host-web/biomes/system/capabilities-web",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Capabilities (Web)",
       "packageName": "@xemahq/biomes-system-capabilities-web",
@@ -415,12 +253,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "9d074819f387ccd2d545e33dfc1d6a9f4b7db31612faabf17186e5d1a473a7d3",
+      "sourceManifestHash": "c06afc998c1cfae62cbe2ac659d39078eb1356dd9e40a9f442d2d061903e14ef",
       "display": {
         "icon": "puzzle",
         "category": "platform",
         "summary": "Browse and govern platform capabilities."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "capability-registry",
@@ -435,7 +275,9 @@
       "services": [
         "capability-registry-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "capability-registry-api",
@@ -448,9 +290,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -467,7 +309,9 @@
         "icon": "list",
         "category": "platform",
         "summary": "Capability descriptor registry: authoritative source for every published capability ref and schema."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "concepts-web",
@@ -480,7 +324,9 @@
       "repo": "submodules/xema-host-web",
       "path": "submodules/xema-host-web/biomes/system/concepts-web",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Concepts (Web)",
       "packageName": "@xemahq/biomes-system-concepts-web",
@@ -490,13 +336,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": false,
-      "sourceManifestHash": "b002ad3b5621c4d3850836c238b1af77cd52f5dfaba0025d061e10803c69fe2e",
+      "sourceManifestHash": "a842e01e7b38bf2cdecc46da59699c5dbf5bad9948dac5143367cf9e2c1b4a28",
       "display": {
         "icon": "lightbulb",
         "category": "knowledge",
         "summary": "Manage shared concepts and definitions."
       },
-      "systemSurface": true
+      "systemSurface": true,
+      "launch": "static"
     },
     {
       "id": "container-registry-web",
@@ -509,7 +356,9 @@
       "repo": "submodules/xema-host-web",
       "path": "submodules/xema-host-web/biomes/system/container-registry-web",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Container Registry (Web)",
       "packageName": "@xemahq/biomes-system-container-registry-web",
@@ -519,12 +368,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "8512c2a97eeecf1195a52f8c487efa6779a51443d3e2942a0138fc867c2d1bca",
+      "sourceManifestHash": "33ea1e235dc558a71e49869e01f5acf2301df0d83c924a42a549aa0f0f94c43d",
       "display": {
         "icon": "package",
         "category": "platform",
         "summary": "Manage container images."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "decision",
@@ -539,21 +390,10 @@
       "services": [
         "decision-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
-        {
-          "consumerService": "decision-api",
-          "requiredService": "authorization-api",
-          "owner": {
-            "kind": "biome",
-            "biomeId": "authorization",
-            "target": "server",
-            "repo": "repos/xema-base",
-            "path": "repos/xema-base/biomes/authorization",
-            "version": "0.1.0",
-            "sourceManifestHash": "757ad1901fbeaeb8e2ff20bf7f5aa381e03ae9a72c43ac9a88eabc1af92371a1"
-          }
-        },
         {
           "consumerService": "decision-api",
           "requiredService": "identity-api",
@@ -565,9 +405,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -579,12 +419,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "3e93781a626e400f7970ffb97e8ef0b49271caebb6b4ae278d9efbaad56fa127",
+      "sourceManifestHash": "16c93d2a45228bfebe7c421a666252cc67ce52e01ac1c2cdcf3790bc2e3fdeb6",
       "display": {
         "icon": "gavel",
         "category": "operate",
         "summary": "The platform's one human-decision primitive: a durable ask with N answerable options, a derived lifecycle and a PDP-resolved audience."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "environments-web",
@@ -597,7 +439,9 @@
       "repo": "submodules/xema-host-web",
       "path": "submodules/xema-host-web/biomes/system/environments-web",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Environments (Web)",
       "packageName": "@xemahq/biomes-system-environments-web",
@@ -607,12 +451,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "e1227ed5d257fb15ba083c948ed1e9c7aa84aeda88631e940e2dcbfa371d8075",
+      "sourceManifestHash": "cf854b4160465ba5c4e785ab9791d0c85a13f17586a1a3800c95e70839a83080",
       "display": {
         "icon": "server",
         "category": "platform",
         "summary": "Manage execution environments."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "gateway-routes-web",
@@ -625,7 +471,9 @@
       "repo": "submodules/xema-host-web",
       "path": "submodules/xema-host-web/biomes/system/gateway-routes-web",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Gateway Routes (Web)",
       "packageName": "@xemahq/biomes-system-gateway-routes-web",
@@ -635,12 +483,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "4f4375a83e7bbfe5a5f85ed1ff55948a0408ee9b4d2d35206435c3e80e5bfb4b",
+      "sourceManifestHash": "d7e7e7c89354101e68be8111b8afacb0f5141acfcaf523ef6141e1d2bcfe9cbe",
       "display": {
         "icon": "route",
         "category": "platform",
         "summary": "Configure public gateway routes."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "grants-web",
@@ -653,7 +503,9 @@
       "repo": "submodules/xema-host-web",
       "path": "submodules/xema-host-web/biomes/system/grants-web",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Grants (Web)",
       "packageName": "@xemahq/biomes-system-grants-web",
@@ -663,12 +515,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "15ddb0475d72c48baad54ce9cdac380950681939c9f6b8db244f558596a4bc9d",
+      "sourceManifestHash": "72d6de134598d129b53ea34c2522fd931dc47fb19ad8115b741eff178b9f8569",
       "display": {
         "icon": "key",
         "category": "governance",
         "summary": "Review and manage access grants."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "mailops-web",
@@ -681,11 +535,14 @@
       "repo": "submodules/xema-host-web",
       "path": "submodules/xema-host-web/biomes/system/mailops-web",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "MailOps (Web)",
       "packageName": "@xemahq/biomes-system-mailops-web",
       "requiresServerBiomes": [
+        "agent-runtime",
         "mailops",
         "project-registry",
         "workflow-runtime"
@@ -693,12 +550,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "e54d0d516229df0a1bc9cb0d865246ad4cbd247d4fb0567bd818b83954fe9a71",
+      "sourceManifestHash": "e71b0fa62af5261eaf1bbc92258f45b17975bd5b98ec204c86e13eb6994020d2",
       "display": {
         "icon": "mail",
         "category": "connect",
         "summary": "Run email-driven workflows."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "object-registry",
@@ -713,7 +572,9 @@
       "services": [
         "object-registry-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "object-registry-api",
@@ -726,9 +587,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -745,7 +606,9 @@
         "icon": "link",
         "category": "platform",
         "summary": "XVFS object resolver: addresses every platform object (artifact, biome, capability) via a stable URI scheme."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "objects-web",
@@ -758,7 +621,9 @@
       "repo": "submodules/xema-host-web",
       "path": "submodules/xema-host-web/biomes/system/objects-web",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Objects (Web)",
       "packageName": "@xemahq/biomes-system-objects-web",
@@ -768,13 +633,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": false,
-      "sourceManifestHash": "4fc671dc1f39fde79ade866b1b0a885bd65b3a0051cacc4b6a94620bffa11eaf",
+      "sourceManifestHash": "23d313f5d5bae4b1864c3ebd2409f6e495b939fad074db83bd4fe30d481caba1",
       "display": {
         "icon": "box",
         "category": "data",
         "summary": "Browse Xema objects and registries."
       },
-      "systemSurface": true
+      "systemSurface": true,
+      "launch": "static"
     },
     {
       "id": "opencode-runtime",
@@ -787,9 +653,11 @@
       "repo": "repos/xema-base",
       "path": "repos/xema-base/biomes/opencode-runtime",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [
         "opencode-worker"
       ],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Opencode Runtime",
       "packageName": "@xemahq/biomes-opencode-runtime",
@@ -802,7 +670,9 @@
         "icon": "bot",
         "category": "runtime",
         "summary": "OpenCode runtime executor: runs LLM agent sessions inside a per-allocation workspace."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "org-database-pool",
@@ -817,7 +687,9 @@
       "services": [
         "org-database-pool-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "org-database-pool-api",
@@ -830,7 +702,7 @@
               "repositoryUrl": "https://github.com/xema-dev/event-hub-api.git",
               "repo": "submodules/event-hub-api",
               "path": "submodules/event-hub-api/package.json",
-              "sourceCommit": "8ff3acef9ca979948b2b1eb95c3964f97caf16b1",
+              "sourceCommit": "e19c759bc761720f64ef54e80f9b08f8d2cb0b37",
               "version": "2.0.0",
               "sourceManifestHash": "2e57d7356ed288b00e35f3ee4aa542cdbb1eb25d94a8fecbc2bda76cedd5f995",
               "imageKey": "event-hub-api"
@@ -848,9 +720,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -862,12 +734,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "4a9077cbda9fb20adf207682173a3df88398ff7288428b9a356213000c68997c",
+      "sourceManifestHash": "74c28fb5b621e0485f7159e7c40805ff44257168f917f8c600f9a2c84b9263bd",
       "display": {
         "icon": "database",
         "category": "platform",
         "summary": "Per-org database pool: issues per-tenant Postgres credentials and tracks per-org migration state."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "policies-web",
@@ -880,7 +754,9 @@
       "repo": "submodules/xema-host-web",
       "path": "submodules/xema-host-web/biomes/system/policies-web",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Policies (Web)",
       "packageName": "@xemahq/biomes-system-policies-web",
@@ -890,12 +766,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "7b4f380be501bcf5042b08d1d97e12e813b617ac468c87fd1bf9449bcb93cff8",
+      "sourceManifestHash": "720f536934ca9e5a3f138fcdaf05b52416fb6e74548ce74f0c8917a8a5580e5e",
       "display": {
         "icon": "shield",
         "category": "governance",
         "summary": "Author and review policies."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "public-gateway",
@@ -910,7 +788,9 @@
       "services": [
         "public-gateway-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Public Gateway",
       "packageName": "@xemahq/biomes-public-gateway",
@@ -918,12 +798,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "c12bdd52233605e5effa26a7b283281760988420b8929652606c78ed9bb460ad",
+      "sourceManifestHash": "745b5c6d3b8cefe6710a4b93ae8430a7249471501d13d0ab188c5fac0f0243f3",
       "display": {
         "icon": "globe",
         "category": "connect",
         "summary": "Public-facing HTTP gateway: streams preview pages, dispatches webhook ingress, terminates public routes."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "redis-pool",
@@ -938,7 +820,9 @@
       "services": [
         "redis-pool-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "redis-pool-api",
@@ -951,7 +835,7 @@
               "repositoryUrl": "https://github.com/xema-dev/event-hub-api.git",
               "repo": "submodules/event-hub-api",
               "path": "submodules/event-hub-api/package.json",
-              "sourceCommit": "8ff3acef9ca979948b2b1eb95c3964f97caf16b1",
+              "sourceCommit": "e19c759bc761720f64ef54e80f9b08f8d2cb0b37",
               "version": "2.0.0",
               "sourceManifestHash": "2e57d7356ed288b00e35f3ee4aa542cdbb1eb25d94a8fecbc2bda76cedd5f995",
               "imageKey": "event-hub-api"
@@ -969,9 +853,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -983,12 +867,65 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "c46fffcdf97637a5dcde14c2fa81a7bb728f257ace02098e9fbbef9a9ee43aa0",
+      "sourceManifestHash": "b3602544220af514c79bf40cb535b2aebda4ca54a8c562ee4201ead37f4effaa",
       "display": {
         "icon": "database",
         "category": "platform",
         "summary": "Brokers the shared Redis/Valkey keyspace: per-(biome, org) namespaces with a server-enforced key prefix and short-lived Redis ACL credentials."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
+    },
+    {
+      "id": "resource-governance",
+      "version": "0.1.0",
+      "tier": "system",
+      "target": "server",
+      "origin": "first-party",
+      "mandatory": false,
+      "installPolicy": "required",
+      "repo": "repos/xema-base",
+      "path": "repos/xema-base/biomes/resource-governance",
+      "services": [
+        "resource-governance-api"
+      ],
+      "serviceDatabases": {},
+      "runtimeComponents": [],
+      "hostModules": [],
+      "serviceDependencies": [
+        {
+          "consumerService": "resource-governance-api",
+          "requiredService": "identity-api",
+          "owner": {
+            "kind": "platform",
+            "source": {
+              "name": "identity-api",
+              "tier": "infra",
+              "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
+              "repo": "submodules/identity-api",
+              "path": "submodules/identity-api/package.json",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
+              "version": "0.0.2",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
+              "imageKey": "identity-api"
+            }
+          }
+        }
+      ],
+      "displayName": "Resource Governance",
+      "packageName": "@xemahq/biomes-resource-governance",
+      "requiresServerBiomes": [],
+      "optionalServerBiomes": [],
+      "audience": "org",
+      "storeListed": true,
+      "sourceManifestHash": "9acb9151fdba684642aad6166d46f43896d0d122cfaa1f00c4137f5ff4033fad",
+      "display": {
+        "icon": "gauge",
+        "category": "governance",
+        "summary": "Authoritative resource inventory, consumption, source freshness, and cost-attribution inputs."
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "runners-web",
@@ -1001,7 +938,9 @@
       "repo": "submodules/xema-host-web",
       "path": "submodules/xema-host-web/biomes/system/runners-web",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Runners (Web)",
       "packageName": "@xemahq/biomes-system-runners-web",
@@ -1014,12 +953,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "c56bb0d5eb00552d1aeceb4a7c4965fc3e32cb9f994639f5c97d64fa2f574bcb",
+      "sourceManifestHash": "469a04d8a7ff2e8dc55ab05fc4f6b874c46981a987d30393a469541f61b7cda3",
       "display": {
         "icon": "cpu",
         "category": "platform",
         "summary": "Monitor and manage execution runners."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "search-web",
@@ -1032,7 +973,9 @@
       "repo": "submodules/xema-host-web",
       "path": "submodules/xema-host-web/biomes/system/search-web",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Search (Web)",
       "packageName": "@xemahq/biomes-system-search-web",
@@ -1042,12 +985,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "13e726cddbf11f1e47c62f44b28e9834f630c3c119ec976424e0f9afe54050a0",
+      "sourceManifestHash": "82c0a04f2ad3e6ba84a85e8d14e6dc4ed65c0581ca7ec168e066ebcf0da07944",
       "display": {
         "icon": "search",
         "category": "platform",
         "summary": "Search across the platform."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "service-registry-web",
@@ -1060,7 +1005,9 @@
       "repo": "submodules/xema-host-web",
       "path": "submodules/xema-host-web/biomes/system/service-registry-web",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Service Registry (Web)",
       "packageName": "@xemahq/biomes-system-service-registry-web",
@@ -1070,12 +1017,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "989267e6eef302890d6e35e84c151438f584354b500a19649f7ea6133869a767",
+      "sourceManifestHash": "4e6de6c3d7fb2edd030b9d346833c7ce6e99aff3d2e46e40ef61670abc302839",
       "display": {
         "icon": "network",
         "category": "platform",
         "summary": "Inspect the service registry."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "space-registry",
@@ -1090,7 +1039,9 @@
       "services": [
         "space-registry-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "space-registry-api",
@@ -1103,9 +1054,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1117,12 +1068,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "2dfcb549315fefa787a0008f6d924847e41126842542786c7172391cc1cada9f",
+      "sourceManifestHash": "d67c0d563cad7bffb0d069459052060f4e52635658c45d66e7d3bb9a7d5e1e7d",
       "display": {
         "icon": "folder-tree",
         "category": "governance",
-        "summary": "Authoritative Space ownership, hierarchy, and most-specific-wins data-classification resolution."
-      }
+        "summary": "Authoritative Space ownership declarations and join-based data-classification resolution."
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "spaces-web",
@@ -1135,7 +1088,9 @@
       "repo": "submodules/xema-host-web",
       "path": "submodules/xema-host-web/biomes/system/spaces-web",
       "services": [],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Spaces (Web)",
       "packageName": "@xemahq/biomes-system-spaces-web",
@@ -1147,13 +1102,83 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": false,
-      "sourceManifestHash": "d9297d1f16ab7faef0d8678522598286420f31ea7bff8fbc9033f499f93722a1",
+      "sourceManifestHash": "ca0317b58364d048e70ac47801fa4f74d57f4ddd3647f99e8e1186dbc2581629",
       "display": {
         "icon": "layers",
         "category": "platform",
         "summary": "Organize work into spaces."
       },
-      "systemSurface": true
+      "systemSurface": true,
+      "launch": "static"
+    },
+    {
+      "id": "template-registry",
+      "version": "0.1.0",
+      "tier": "system",
+      "target": "server",
+      "origin": "first-party",
+      "mandatory": false,
+      "installPolicy": "required",
+      "repo": "repos/xema-base",
+      "path": "repos/xema-base/biomes/template-registry",
+      "services": [
+        "template-registry-api"
+      ],
+      "serviceDatabases": {},
+      "runtimeComponents": [],
+      "hostModules": [],
+      "serviceDependencies": [
+        {
+          "consumerService": "template-registry-api",
+          "requiredService": "event-hub-api",
+          "owner": {
+            "kind": "platform",
+            "source": {
+              "name": "event-hub-api",
+              "tier": "infra",
+              "repositoryUrl": "https://github.com/xema-dev/event-hub-api.git",
+              "repo": "submodules/event-hub-api",
+              "path": "submodules/event-hub-api/package.json",
+              "sourceCommit": "e19c759bc761720f64ef54e80f9b08f8d2cb0b37",
+              "version": "2.0.0",
+              "sourceManifestHash": "2e57d7356ed288b00e35f3ee4aa542cdbb1eb25d94a8fecbc2bda76cedd5f995",
+              "imageKey": "event-hub-api"
+            }
+          }
+        },
+        {
+          "consumerService": "template-registry-api",
+          "requiredService": "identity-api",
+          "owner": {
+            "kind": "platform",
+            "source": {
+              "name": "identity-api",
+              "tier": "infra",
+              "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
+              "repo": "submodules/identity-api",
+              "path": "submodules/identity-api/package.json",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
+              "version": "0.0.2",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
+              "imageKey": "identity-api"
+            }
+          }
+        }
+      ],
+      "displayName": "Template Registry",
+      "packageName": "@xemahq/biomes-template-registry",
+      "requiresServerBiomes": [],
+      "optionalServerBiomes": [],
+      "audience": "org",
+      "storeListed": true,
+      "sourceManifestHash": "f4d6d0c7f96302701f415442d0db06037d71be0965ee5fe4732fbd19dd04cd3b",
+      "display": {
+        "icon": "layout-template",
+        "category": "platform",
+        "summary": "Authoritative Template and DesignSystem content, drafts, revisions, evaluations, and previews."
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "workload-runtime",
@@ -1168,7 +1193,9 @@
       "services": [
         "workload-runtime-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "workload-runtime-api",
@@ -1181,9 +1208,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1195,12 +1222,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "021012bff91a63be2f7981c8ba54fa4b1c1898349f2f3770484d475025913d86",
+      "sourceManifestHash": "1be099aa1afae9a83584c6fe38c0ce0dceb815e794392d1fa16dfb0e3d7786df",
       "display": {
         "icon": "server-cog",
         "category": "runtime",
         "summary": "Workload runtime control plane: dispatches and reconciles every per-allocation Kubernetes workload."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "workspace-storage-pool",
@@ -1215,7 +1244,9 @@
       "services": [
         "workspace-storage-pool-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "workspace-storage-pool-api",
@@ -1228,9 +1259,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1247,7 +1278,9 @@
         "icon": "hard-drive",
         "category": "platform",
         "summary": "Per-org workspace volume manager: allocates, snapshots, and reclaims persistent workspace storage."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "xema-capability-router",
@@ -1262,7 +1295,9 @@
       "services": [
         "xema-capability-router"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "xema-capability-router",
@@ -1275,9 +1310,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1289,12 +1324,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "39a08d58a36cc8c469740f1ce28eed1d72b1ec55fb3a2c40645020c533bcc1f9",
+      "sourceManifestHash": "4ccc5c67859a6576a8e994d6a156bb5a3035c5ae1dedc3708d0f2da101cd564f",
       "display": {
         "icon": "split",
         "category": "platform",
         "summary": "Capability dispatch router: resolves a capability invocation to the owning biome's API and endpoint."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "xema-platform-worker",
@@ -1309,7 +1346,9 @@
       "services": [
         "xema-platform-worker"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Xema Platform Worker",
       "packageName": "@xemahq/biomes-xema-platform-worker",
@@ -1322,54 +1361,9 @@
         "icon": "cpu",
         "category": "runtime",
         "summary": "Platform Temporal worker: executes kernel and system-biome workflows on the platform task queue."
-      }
-    },
-    {
-      "id": "xema-shell",
-      "version": "0.1.0",
-      "tier": "system",
-      "target": "server",
-      "origin": "first-party",
-      "mandatory": false,
-      "installPolicy": "required",
-      "repo": "repos/xema-base",
-      "path": "repos/xema-base/biomes/xema-shell",
-      "services": [
-        "xema-shell-api"
-      ],
-      "runtimeComponents": [],
-      "serviceDependencies": [
-        {
-          "consumerService": "xema-shell-api",
-          "requiredService": "identity-api",
-          "owner": {
-            "kind": "platform",
-            "source": {
-              "name": "identity-api",
-              "tier": "infra",
-              "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
-              "repo": "submodules/identity-api",
-              "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
-              "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
-              "imageKey": "identity-api"
-            }
-          }
-        }
-      ],
-      "displayName": "Xema Shell",
-      "packageName": "@xemahq/biomes-xema-shell",
-      "requiresServerBiomes": [],
-      "optionalServerBiomes": [],
-      "audience": "org",
-      "storeListed": true,
-      "sourceManifestHash": "c63106362062ebf93b05f266e5340a4ffe28322678cd9a63afe87aec3723e943",
-      "display": {
-        "icon": "terminal",
-        "category": "runtime",
-        "summary": "Xema shell parser and runner: executes platform shell scripts inside session workspaces."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "activity-feed",
@@ -1384,7 +1378,9 @@
       "services": [
         "activity-feed-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "activity-feed-api",
@@ -1397,9 +1393,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1411,12 +1407,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "1c8246ca4b24b76d8c5b75afbd5dfccc3ee1bb10cb8d7a42b6c51bd687a81af8",
+      "sourceManifestHash": "cf0b4e2af8d740bab0253fb5e13440b284fb23f2638be48a94dfa06d1ab81a4f",
       "display": {
         "icon": "activity",
         "category": "operate",
         "summary": "Activity feed projector: materializes CloudEvent streams into per-actor and per-subject timelines."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "agent-runtime",
@@ -1434,8 +1432,23 @@
         "llm-registry-api",
         "skill-registry-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
+        {
+          "consumerService": "agent-session-api",
+          "requiredService": "authorization-api",
+          "owner": {
+            "kind": "biome",
+            "biomeId": "authorization",
+            "target": "server",
+            "repo": "repos/xema-base",
+            "path": "repos/xema-base/biomes/authorization",
+            "version": "0.1.0",
+            "sourceManifestHash": "3687551f3883d53cba6c201ecb449d4aabb4005a9ccd1eb429732fb497c912d0"
+          }
+        },
         {
           "consumerService": "agent-session-api",
           "requiredService": "biome-host-api",
@@ -1446,7 +1459,33 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/biome-host",
             "version": "0.1.0",
-            "sourceManifestHash": "6e522468aff28ebd3f8989d63f061cf8ead477a37844f804ae8b0f434f0258ff"
+            "sourceManifestHash": "0a67a684074bf91556c7529959bc40eefca409822cf6252ebb98faad91e6bbfa"
+          }
+        },
+        {
+          "consumerService": "agent-session-api",
+          "requiredService": "capability-registry-api",
+          "owner": {
+            "kind": "biome",
+            "biomeId": "capability-registry",
+            "target": "server",
+            "repo": "repos/xema-base",
+            "path": "repos/xema-base/biomes/capability-registry",
+            "version": "0.1.0",
+            "sourceManifestHash": "22d7b0a4cfd4ce0caba32995b71897b6152a01fb55ca1e3120e6ab02a7ff16ee"
+          }
+        },
+        {
+          "consumerService": "agent-session-api",
+          "requiredService": "decision-api",
+          "owner": {
+            "kind": "biome",
+            "biomeId": "decision",
+            "target": "server",
+            "repo": "repos/xema-base",
+            "path": "repos/xema-base/biomes/decision",
+            "version": "0.1.0",
+            "sourceManifestHash": "16c93d2a45228bfebe7c421a666252cc67ce52e01ac1c2cdcf3790bc2e3fdeb6"
           }
         },
         {
@@ -1460,9 +1499,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1490,7 +1529,33 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/org-database-pool",
             "version": "0.1.0",
-            "sourceManifestHash": "4a9077cbda9fb20adf207682173a3df88398ff7288428b9a356213000c68997c"
+            "sourceManifestHash": "74c28fb5b621e0485f7159e7c40805ff44257168f917f8c600f9a2c84b9263bd"
+          }
+        },
+        {
+          "consumerService": "agent-session-api",
+          "requiredService": "public-gateway-api",
+          "owner": {
+            "kind": "biome",
+            "biomeId": "public-gateway",
+            "target": "server",
+            "repo": "repos/xema-base",
+            "path": "repos/xema-base/biomes/public-gateway",
+            "version": "0.1.0",
+            "sourceManifestHash": "745b5c6d3b8cefe6710a4b93ae8430a7249471501d13d0ab188c5fac0f0243f3"
+          }
+        },
+        {
+          "consumerService": "agent-session-api",
+          "requiredService": "resource-governance-api",
+          "owner": {
+            "kind": "biome",
+            "biomeId": "resource-governance",
+            "target": "server",
+            "repo": "repos/xema-base",
+            "path": "repos/xema-base/biomes/resource-governance",
+            "version": "0.1.0",
+            "sourceManifestHash": "9acb9151fdba684642aad6166d46f43896d0d122cfaa1f00c4137f5ff4033fad"
           }
         },
         {
@@ -1503,7 +1568,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/workload-runtime",
             "version": "0.1.0",
-            "sourceManifestHash": "021012bff91a63be2f7981c8ba54fa4b1c1898349f2f3770484d475025913d86"
+            "sourceManifestHash": "1be099aa1afae9a83584c6fe38c0ce0dceb815e794392d1fa16dfb0e3d7786df"
           }
         },
         {
@@ -1516,7 +1581,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/xema-capability-router",
             "version": "0.1.0",
-            "sourceManifestHash": "39a08d58a36cc8c469740f1ce28eed1d72b1ec55fb3a2c40645020c533bcc1f9"
+            "sourceManifestHash": "4ccc5c67859a6576a8e994d6a156bb5a3035c5ae1dedc3708d0f2da101cd564f"
           }
         },
         {
@@ -1529,7 +1594,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/biome-host",
             "version": "0.1.0",
-            "sourceManifestHash": "6e522468aff28ebd3f8989d63f061cf8ead477a37844f804ae8b0f434f0258ff"
+            "sourceManifestHash": "0a67a684074bf91556c7529959bc40eefca409822cf6252ebb98faad91e6bbfa"
           }
         },
         {
@@ -1543,9 +1608,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1560,7 +1625,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/biome-host",
             "version": "0.1.0",
-            "sourceManifestHash": "6e522468aff28ebd3f8989d63f061cf8ead477a37844f804ae8b0f434f0258ff"
+            "sourceManifestHash": "0a67a684074bf91556c7529959bc40eefca409822cf6252ebb98faad91e6bbfa"
           }
         },
         {
@@ -1574,9 +1639,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1592,13 +1657,26 @@
               "repositoryUrl": "https://github.com/xema-dev/llm-gateway-api.git",
               "repo": "submodules/llm-gateway-api",
               "path": "submodules/llm-gateway-api/package.json",
-              "sourceCommit": "79e4da92d86f8a7dc7605a8eca6837006495ccf5",
+              "sourceCommit": "3c94877b103c9360eb708814833355d55b79e8cd",
               "version": "1.0.0",
               "sourceManifestHash": "a862e41a632f3aecf1d6037b842a70ca5be91c996a89a68bd8200068355f43b8",
               "imageKey": "llm-gateway-api"
             }
           }
         },
+        {
+          "consumerService": "llm-registry-api",
+          "requiredService": "resource-governance-api",
+          "owner": {
+            "kind": "biome",
+            "biomeId": "resource-governance",
+            "target": "server",
+            "repo": "repos/xema-base",
+            "path": "repos/xema-base/biomes/resource-governance",
+            "version": "0.1.0",
+            "sourceManifestHash": "9acb9151fdba684642aad6166d46f43896d0d122cfaa1f00c4137f5ff4033fad"
+          }
+        },
         {
           "consumerService": "llm-registry-api",
           "requiredService": "xema-capability-router",
@@ -1609,7 +1687,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/xema-capability-router",
             "version": "0.1.0",
-            "sourceManifestHash": "39a08d58a36cc8c469740f1ce28eed1d72b1ec55fb3a2c40645020c533bcc1f9"
+            "sourceManifestHash": "4ccc5c67859a6576a8e994d6a156bb5a3035c5ae1dedc3708d0f2da101cd564f"
           }
         },
         {
@@ -1623,9 +1701,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1637,12 +1715,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "a13807cf05146aca50ee7964e66af7844f0bcfd34e35352227944ec81997461f",
+      "sourceManifestHash": "c9ea40d2bea57d8d1e53a4a3a6c006933ec67b28582de4e53aad65b84c3af267",
       "display": {
         "icon": "bot",
         "category": "runtime",
         "summary": "Foundational agent-runtime primitives: agent sessions, skill catalog, LLM registry, and typed artifact storage."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "app-platform",
@@ -1657,7 +1737,9 @@
       "services": [
         "app-platform-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "app-platform-api",
@@ -1669,7 +1751,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/authorization",
             "version": "0.1.0",
-            "sourceManifestHash": "757ad1901fbeaeb8e2ff20bf7f5aa381e03ae9a72c43ac9a88eabc1af92371a1"
+            "sourceManifestHash": "3687551f3883d53cba6c201ecb449d4aabb4005a9ccd1eb429732fb497c912d0"
           }
         },
         {
@@ -1682,7 +1764,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/biome-host",
             "version": "0.1.0",
-            "sourceManifestHash": "6e522468aff28ebd3f8989d63f061cf8ead477a37844f804ae8b0f434f0258ff"
+            "sourceManifestHash": "0a67a684074bf91556c7529959bc40eefca409822cf6252ebb98faad91e6bbfa"
           }
         },
         {
@@ -1696,9 +1778,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1723,12 +1805,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "ad83e92526cc2c94606512fccbac5f330135a3f59f969727059333a589aece6e",
+      "sourceManifestHash": "eb152de2e18e5b883c79659a7a4a382a3eae49802b2f67451407649e78c7795a",
       "display": {
         "icon": "app-window",
         "category": "connect",
         "summary": "App/portal runtime for external end-users: Apps, external auth (magic-link/OIDC), public ingress, delegated sessions."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "backlog",
@@ -1743,7 +1827,9 @@
       "services": [
         "backlog-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "backlog-api",
@@ -1756,9 +1842,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1775,7 +1861,73 @@
         "icon": "list",
         "category": "operate",
         "summary": "Work-item and backlog primitive — stores and syncs tracker issues and tasks that Xema workflows read and update."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
+    },
+    {
+      "id": "biome-adapter-host",
+      "version": "0.1.0",
+      "tier": "base",
+      "target": "server",
+      "origin": "first-party",
+      "mandatory": false,
+      "installPolicy": "default-selected",
+      "repo": "repos/xema-base",
+      "path": "repos/xema-base/biomes/biome-adapter-host",
+      "services": [],
+      "serviceDatabases": {},
+      "runtimeComponents": [
+        "biome-adapter-host"
+      ],
+      "hostModules": [],
+      "serviceDependencies": [],
+      "displayName": "Biome Adapter Host",
+      "packageName": "@xemahq/biomes-biome-adapter-host",
+      "requiresServerBiomes": [],
+      "optionalServerBiomes": [],
+      "audience": "org",
+      "storeListed": true,
+      "sourceManifestHash": "cddd250d2e4136c2b438272b98aff8a591556ffed296d57ea4ed7dbb97ae0b9b",
+      "display": {
+        "icon": "puzzle",
+        "category": "connect",
+        "summary": "Adapter-SDK runtime: hosts integration adapter contributions shipped by other biomes."
+      },
+      "systemSurface": false,
+      "launch": "per-installation"
+    },
+    {
+      "id": "biome-fetcher",
+      "version": "0.1.0",
+      "tier": "base",
+      "target": "server",
+      "origin": "first-party",
+      "mandatory": false,
+      "installPolicy": "default-selected",
+      "repo": "repos/xema-base",
+      "path": "repos/xema-base/biomes/biome-fetcher",
+      "services": [
+        "biome-fetcher-api"
+      ],
+      "serviceDatabases": {},
+      "runtimeComponents": [],
+      "hostModules": [],
+      "serviceDependencies": [],
+      "displayName": "Biome Fetcher",
+      "packageName": "@xemahq/biomes-biome-fetcher",
+      "requiresServerBiomes": [],
+      "optionalServerBiomes": [],
+      "audience": "org",
+      "storeListed": true,
+      "sourceManifestHash": "aaa2b6daf48f8e1635fc818782a199dd48ae40ed91d4fff2ff7fc1e0bbb33655",
+      "display": {
+        "icon": "download",
+        "category": "build",
+        "summary": "Downloads and verifies biome bundles from registries, staging them for the biome-host installer."
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "canopy",
@@ -1790,7 +1942,9 @@
       "services": [
         "canopy-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "canopy-api",
@@ -1816,9 +1970,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1833,7 +1987,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/xema-capability-router",
             "version": "0.1.0",
-            "sourceManifestHash": "39a08d58a36cc8c469740f1ce28eed1d72b1ec55fb3a2c40645020c533bcc1f9"
+            "sourceManifestHash": "4ccc5c67859a6576a8e994d6a156bb5a3035c5ae1dedc3708d0f2da101cd564f"
           }
         }
       ],
@@ -1843,12 +1997,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "a88ef0b188ed5b303d8d8cf790a17b024ceb172a7a1616c339d8c88853ae9ce4",
+      "sourceManifestHash": "b4b85ad9d79bbfcd62e9b58a28853f998a3d2e69115321001e080d117bc02721",
       "display": {
         "icon": "sparkles",
         "category": "runtime",
         "summary": "The universal Xema agent: one org-scoped conversation that can reach every capability of every installed biome."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "connector-platform",
@@ -1864,8 +2020,23 @@
         "connector-gateway-api",
         "credential-broker-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
+        {
+          "consumerService": "connector-gateway-api",
+          "requiredService": "authorization-api",
+          "owner": {
+            "kind": "biome",
+            "biomeId": "authorization",
+            "target": "server",
+            "repo": "repos/xema-base",
+            "path": "repos/xema-base/biomes/authorization",
+            "version": "0.1.0",
+            "sourceManifestHash": "3687551f3883d53cba6c201ecb449d4aabb4005a9ccd1eb429732fb497c912d0"
+          }
+        },
         {
           "consumerService": "connector-gateway-api",
           "requiredService": "capability-registry-api",
@@ -1879,6 +2050,19 @@
             "sourceManifestHash": "22d7b0a4cfd4ce0caba32995b71897b6152a01fb55ca1e3120e6ab02a7ff16ee"
           }
         },
+        {
+          "consumerService": "connector-gateway-api",
+          "requiredService": "decision-api",
+          "owner": {
+            "kind": "biome",
+            "biomeId": "decision",
+            "target": "server",
+            "repo": "repos/xema-base",
+            "path": "repos/xema-base/biomes/decision",
+            "version": "0.1.0",
+            "sourceManifestHash": "16c93d2a45228bfebe7c421a666252cc67ce52e01ac1c2cdcf3790bc2e3fdeb6"
+          }
+        },
         {
           "consumerService": "connector-gateway-api",
           "requiredService": "identity-api",
@@ -1890,9 +2074,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1908,9 +2092,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1926,7 +2110,7 @@
               "repositoryUrl": "https://github.com/xema-dev/secrets-api.git",
               "repo": "submodules/secrets-api",
               "path": "submodules/secrets-api/package.json",
-              "sourceCommit": "5cb3114aa9fee7eeed42aeeea0ddd2d5a1ed8722",
+              "sourceCommit": "f6030e5e7dfd7a979079450ab2d40007a0412b5b",
               "version": "1.0.0",
               "sourceManifestHash": "51d6db6fac73a58b167eb7615c371fc75dfdb13a294c22ddb98c18d99df620a7",
               "imageKey": "secrets-api"
@@ -1940,12 +2124,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "36862dd4bf78175095aab7fc39fcead6b0993cd48604b3a054e18132374fc9d0",
+      "sourceManifestHash": "cd53a7f937c3a3e2ce4336c608e6dc5887fb1b30cdb3521b5a8079627376571e",
       "display": {
         "icon": "plug",
         "category": "connect",
         "summary": "Generic connector ingress edge and credential broker; per-provider connector biomes consume its services."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "container-registry",
@@ -1960,7 +2146,9 @@
       "services": [
         "container-registry-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "container-registry-api",
@@ -1973,9 +2161,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -1990,7 +2178,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/workload-runtime",
             "version": "0.1.0",
-            "sourceManifestHash": "021012bff91a63be2f7981c8ba54fa4b1c1898349f2f3770484d475025913d86"
+            "sourceManifestHash": "1be099aa1afae9a83584c6fe38c0ce0dceb815e794392d1fa16dfb0e3d7786df"
           }
         }
       ],
@@ -2000,12 +2188,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "a81a72b151ae1ac8f4d423188db7d1185d55ef161a06ae067b4ad73f1da996a2",
+      "sourceManifestHash": "d0069f417878418767e547da75d78dd9b18624b93ac49ddd7785aaa611bfd583",
       "display": {
         "icon": "container",
         "category": "build",
         "summary": "OCI image registry adapter and workspace-image baker: proxies push/pull and bakes custom worker images."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "knowledge-base",
@@ -2020,7 +2210,9 @@
       "services": [
         "knowledge-base-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "knowledge-base-api",
@@ -2032,7 +2224,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/authorization",
             "version": "0.1.0",
-            "sourceManifestHash": "757ad1901fbeaeb8e2ff20bf7f5aa381e03ae9a72c43ac9a88eabc1af92371a1"
+            "sourceManifestHash": "3687551f3883d53cba6c201ecb449d4aabb4005a9ccd1eb429732fb497c912d0"
           }
         },
         {
@@ -2059,12 +2251,25 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
+        },
+        {
+          "consumerService": "knowledge-base-api",
+          "requiredService": "public-gateway-api",
+          "owner": {
+            "kind": "biome",
+            "biomeId": "public-gateway",
+            "target": "server",
+            "repo": "repos/xema-base",
+            "path": "repos/xema-base/biomes/public-gateway",
+            "version": "0.1.0",
+            "sourceManifestHash": "745b5c6d3b8cefe6710a4b93ae8430a7249471501d13d0ab188c5fac0f0243f3"
+          }
         }
       ],
       "displayName": "Knowledge Base",
@@ -2073,12 +2278,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "05352e300ab561ccd98189bb63012174d79b25f3f0a8c31aaecf04a123f903f0",
+      "sourceManifestHash": "69e14d6a7030a9ba6d3328b1368adb60ff1d08bbf9916817fa991b28927708d2",
       "display": {
         "icon": "book-open",
         "category": "knowledge",
         "summary": "Knowledge base primitive: document storage plus semantic search consumed across tiers."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "mcp-router",
@@ -2093,7 +2300,9 @@
       "services": [
         "mcp-gateway-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "mcp-gateway-api",
@@ -2105,7 +2314,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/biome-host",
             "version": "0.1.0",
-            "sourceManifestHash": "6e522468aff28ebd3f8989d63f061cf8ead477a37844f804ae8b0f434f0258ff"
+            "sourceManifestHash": "0a67a684074bf91556c7529959bc40eefca409822cf6252ebb98faad91e6bbfa"
           }
         },
         {
@@ -2119,9 +2328,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -2136,7 +2345,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/org-database-pool",
             "version": "0.1.0",
-            "sourceManifestHash": "4a9077cbda9fb20adf207682173a3df88398ff7288428b9a356213000c68997c"
+            "sourceManifestHash": "74c28fb5b621e0485f7159e7c40805ff44257168f917f8c600f9a2c84b9263bd"
           }
         }
       ],
@@ -2146,12 +2355,79 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "65ccf9ef1e56529751c54547d4be240ae8d0464c2b746bf1439f3b97fa43272f",
+      "sourceManifestHash": "bd398a5e3682471cf37d2b68b0bd6e8f3bca3211340976b8635d0ae32e015ed6",
       "display": {
         "icon": "network",
         "category": "connect",
         "summary": "External MCP bridge: routes agent MCP tool calls to registered or biome-shipped MCP servers."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
+    },
+    {
+      "id": "output-surface-control",
+      "version": "1.0.0",
+      "tier": "base",
+      "target": "server",
+      "origin": "first-party",
+      "mandatory": false,
+      "installPolicy": "default-selected",
+      "repo": "repos/xema-base",
+      "path": "repos/xema-base/biomes/kernel/output-surface-control",
+      "services": [],
+      "serviceDatabases": {},
+      "runtimeComponents": [],
+      "hostModules": [],
+      "serviceDependencies": [],
+      "displayName": "Output Surface Control",
+      "packageName": "@xemahq/biomes-kernel-output-surface-control",
+      "requiresServerBiomes": [
+        "runtime"
+      ],
+      "optionalServerBiomes": [],
+      "audience": "org",
+      "storeListed": false,
+      "sourceManifestHash": "c963d8f49323c402e322582e9e396c8a538b205c9ff8f363aca1400e6c65853d",
+      "display": {
+        "icon": "refresh-cw",
+        "category": "operate",
+        "summary": "Output-surface control tools: re-trigger the deterministic install-to-start pipeline over the workspace-proxy API."
+      },
+      "systemSurface": false,
+      "launch": "static"
+    },
+    {
+      "id": "output-surface-inspector",
+      "version": "1.0.0",
+      "tier": "base",
+      "target": "server",
+      "origin": "first-party",
+      "mandatory": false,
+      "installPolicy": "default-selected",
+      "repo": "repos/xema-base",
+      "path": "repos/xema-base/biomes/kernel/output-surface-inspector",
+      "services": [],
+      "serviceDatabases": {},
+      "runtimeComponents": [],
+      "hostModules": [],
+      "serviceDependencies": [],
+      "displayName": "Output Surface Inspector",
+      "packageName": "@xemahq/biomes-kernel-output-surface-inspector",
+      "requiresServerBiomes": [
+        "output-surface-control",
+        "runtime"
+      ],
+      "optionalServerBiomes": [],
+      "audience": "org",
+      "storeListed": false,
+      "sourceManifestHash": "e6998235405dfbfa682fa77b7074e4383e50387fad959db2f3822b05c55af932",
+      "display": {
+        "icon": "search",
+        "category": "operate",
+        "summary": "Output-surface inspection: browser tool, inspector sub-agent, and bridge for read-only diagnosis of live pages."
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "policy-distributor",
@@ -2166,7 +2442,9 @@
       "services": [
         "policy-distributor-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "policy-distributor-api",
@@ -2179,9 +2457,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -2198,7 +2476,9 @@
         "icon": "file-lock",
         "category": "governance",
         "summary": "Central OPA bundle distributor: serves signed, versioned policy bundles over the OPA Bundle Service protocol."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "project-registry",
@@ -2213,7 +2493,9 @@
       "services": [
         "project-registry-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "project-registry-api",
@@ -2226,9 +2508,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -2245,7 +2527,74 @@
         "icon": "folders",
         "category": "platform",
         "summary": "Project and membership management: owns project identity, membership, and role assignment."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
+    },
+    {
+      "id": "studio-author",
+      "version": "1.0.0",
+      "tier": "base",
+      "target": "server",
+      "origin": "first-party",
+      "mandatory": false,
+      "installPolicy": "default-selected",
+      "repo": "repos/xema-base",
+      "path": "repos/xema-base/biomes/kernel/studio-author",
+      "services": [],
+      "serviceDatabases": {},
+      "runtimeComponents": [],
+      "hostModules": [],
+      "serviceDependencies": [],
+      "displayName": "Studio Author",
+      "packageName": "@xemahq/biomes-kernel-studio-author",
+      "requiresServerBiomes": [
+        "runtime",
+        "subagents"
+      ],
+      "optionalServerBiomes": [],
+      "audience": "org",
+      "storeListed": false,
+      "sourceManifestHash": "862461feecc25209b9de3b689ee74f0a20434a506bd8b2de1ffe7702a417aad6",
+      "display": {
+        "icon": "wand",
+        "category": "build",
+        "summary": "Authoring co-pilot for Agent Studio: workflow/spec authors and a build-with-an-agent profile that emits typed proposals."
+      },
+      "systemSurface": false,
+      "launch": "static"
+    },
+    {
+      "id": "subagents",
+      "version": "1.0.0",
+      "tier": "base",
+      "target": "server",
+      "origin": "first-party",
+      "mandatory": false,
+      "installPolicy": "default-selected",
+      "repo": "repos/xema-base",
+      "path": "repos/xema-base/biomes/kernel/subagents",
+      "services": [],
+      "serviceDatabases": {},
+      "runtimeComponents": [],
+      "hostModules": [],
+      "serviceDependencies": [],
+      "displayName": "Xema Universal Subagents",
+      "packageName": "@xemahq/biomes-kernel-subagents",
+      "requiresServerBiomes": [
+        "runtime"
+      ],
+      "optionalServerBiomes": [],
+      "audience": "org",
+      "storeListed": false,
+      "sourceManifestHash": "033135a9948495a19b38e1602269a8f76559da0eed9a88952d09d8303434a8cf",
+      "display": {
+        "icon": "users",
+        "category": "runtime",
+        "summary": "Canonical base roster of platform subagents and gate-reviewers, plus their MCP tool-profiles."
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "web-access",
@@ -2260,7 +2609,9 @@
       "services": [
         "web-access-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "web-access-api",
@@ -2273,9 +2624,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -2292,7 +2643,9 @@
         "icon": "globe",
         "category": "runtime",
         "summary": "Governed public-web access — the ONE audited door for fetching and searching the public internet."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "workflow-runtime",
@@ -2309,7 +2662,9 @@
         "workflow-engine-api",
         "workflow-runtime-worker"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "deliverable-specs-api",
@@ -2321,7 +2676,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/biome-host",
             "version": "0.1.0",
-            "sourceManifestHash": "6e522468aff28ebd3f8989d63f061cf8ead477a37844f804ae8b0f434f0258ff"
+            "sourceManifestHash": "0a67a684074bf91556c7529959bc40eefca409822cf6252ebb98faad91e6bbfa"
           }
         },
         {
@@ -2335,13 +2690,26 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
         },
+        {
+          "consumerService": "deliverable-specs-api",
+          "requiredService": "resource-governance-api",
+          "owner": {
+            "kind": "biome",
+            "biomeId": "resource-governance",
+            "target": "server",
+            "repo": "repos/xema-base",
+            "path": "repos/xema-base/biomes/resource-governance",
+            "version": "0.1.0",
+            "sourceManifestHash": "9acb9151fdba684642aad6166d46f43896d0d122cfaa1f00c4137f5ff4033fad"
+          }
+        },
         {
           "consumerService": "workflow-engine-api",
           "requiredService": "biome-host-api",
@@ -2352,7 +2720,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/biome-host",
             "version": "0.1.0",
-            "sourceManifestHash": "6e522468aff28ebd3f8989d63f061cf8ead477a37844f804ae8b0f434f0258ff"
+            "sourceManifestHash": "0a67a684074bf91556c7529959bc40eefca409822cf6252ebb98faad91e6bbfa"
           }
         },
         {
@@ -2366,12 +2734,25 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
+        },
+        {
+          "consumerService": "workflow-engine-api",
+          "requiredService": "resource-governance-api",
+          "owner": {
+            "kind": "biome",
+            "biomeId": "resource-governance",
+            "target": "server",
+            "repo": "repos/xema-base",
+            "path": "repos/xema-base/biomes/resource-governance",
+            "version": "0.1.0",
+            "sourceManifestHash": "9acb9151fdba684642aad6166d46f43896d0d122cfaa1f00c4137f5ff4033fad"
+          }
         }
       ],
       "displayName": "Workflow Runtime",
@@ -2380,12 +2761,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "21f6e8eb656f1a5e73e1980401e56c34eee55964bace21db87d065e2f690cb06",
+      "sourceManifestHash": "c376791358eba667ae78e45162250d0443c8cf40e1a7003244143b2d5d9743b0",
       "display": {
         "icon": "workflow",
         "category": "runtime",
         "summary": "Workflow primitive: DSL compilation, Temporal-driven workflow execution, and the typed deliverable-spec store."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "workspace-orchestrator",
@@ -2400,7 +2783,9 @@
       "services": [
         "workspace-orchestrator-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "workspace-orchestrator-api",
@@ -2412,7 +2797,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/biome-host",
             "version": "0.1.0",
-            "sourceManifestHash": "6e522468aff28ebd3f8989d63f061cf8ead477a37844f804ae8b0f434f0258ff"
+            "sourceManifestHash": "0a67a684074bf91556c7529959bc40eefca409822cf6252ebb98faad91e6bbfa"
           }
         },
         {
@@ -2426,9 +2811,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -2444,13 +2829,26 @@
               "repositoryUrl": "https://github.com/xema-dev/llm-gateway-api.git",
               "repo": "submodules/llm-gateway-api",
               "path": "submodules/llm-gateway-api/package.json",
-              "sourceCommit": "79e4da92d86f8a7dc7605a8eca6837006495ccf5",
+              "sourceCommit": "3c94877b103c9360eb708814833355d55b79e8cd",
               "version": "1.0.0",
               "sourceManifestHash": "a862e41a632f3aecf1d6037b842a70ca5be91c996a89a68bd8200068355f43b8",
               "imageKey": "llm-gateway-api"
             }
           }
         },
+        {
+          "consumerService": "workspace-orchestrator-api",
+          "requiredService": "resource-governance-api",
+          "owner": {
+            "kind": "biome",
+            "biomeId": "resource-governance",
+            "target": "server",
+            "repo": "repos/xema-base",
+            "path": "repos/xema-base/biomes/resource-governance",
+            "version": "0.1.0",
+            "sourceManifestHash": "9acb9151fdba684642aad6166d46f43896d0d122cfaa1f00c4137f5ff4033fad"
+          }
+        },
         {
           "consumerService": "workspace-orchestrator-api",
           "requiredService": "workload-runtime-api",
@@ -2461,7 +2859,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/workload-runtime",
             "version": "0.1.0",
-            "sourceManifestHash": "021012bff91a63be2f7981c8ba54fa4b1c1898349f2f3770484d475025913d86"
+            "sourceManifestHash": "1be099aa1afae9a83584c6fe38c0ce0dceb815e794392d1fa16dfb0e3d7786df"
           }
         },
         {
@@ -2487,7 +2885,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/xema-capability-router",
             "version": "0.1.0",
-            "sourceManifestHash": "39a08d58a36cc8c469740f1ce28eed1d72b1ec55fb3a2c40645020c533bcc1f9"
+            "sourceManifestHash": "4ccc5c67859a6576a8e994d6a156bb5a3035c5ae1dedc3708d0f2da101cd564f"
           }
         }
       ],
@@ -2497,12 +2895,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "5c311b32be20adb044ad1687cb97d8c38f2e3885664d54063ea866261f85fe58",
+      "sourceManifestHash": "f2aee41b0bd7f68b970a4357154d914fe8f810be4ae2b66bb7876ff2b4600a7a",
       "display": {
         "icon": "layout-grid",
         "category": "runtime",
         "summary": "Per-session workspace lifecycle: creates, hibernates, and reaps workspace allocations."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "workspace-proxy",
@@ -2517,7 +2917,9 @@
       "services": [
         "workspace-materialization-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "workspace-materialization-api",
@@ -2530,9 +2932,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -2549,7 +2951,9 @@
         "icon": "route",
         "category": "runtime",
         "summary": "Per-allocation HTTP proxy: routes session and control-plane traffic into the workspace runtime worker."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "xema-biome-runner",
@@ -2564,7 +2968,9 @@
       "services": [
         "xema-biome-runner"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [],
       "displayName": "Xema Biome Runner",
       "packageName": "@xemahq/biomes-xema-biome-runner",
@@ -2577,7 +2983,60 @@
         "icon": "play",
         "category": "runtime",
         "summary": "Generic biome executor: in-process host for biome-shipped Temporal workflows, activities, and capabilities."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
+    },
+    {
+      "id": "xema-shell",
+      "version": "0.1.0",
+      "tier": "base",
+      "target": "server",
+      "origin": "first-party",
+      "mandatory": false,
+      "installPolicy": "default-selected",
+      "repo": "repos/xema-base",
+      "path": "repos/xema-base/biomes/xema-shell",
+      "services": [
+        "xema-shell-api"
+      ],
+      "serviceDatabases": {},
+      "runtimeComponents": [],
+      "hostModules": [],
+      "serviceDependencies": [
+        {
+          "consumerService": "xema-shell-api",
+          "requiredService": "identity-api",
+          "owner": {
+            "kind": "platform",
+            "source": {
+              "name": "identity-api",
+              "tier": "infra",
+              "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
+              "repo": "submodules/identity-api",
+              "path": "submodules/identity-api/package.json",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
+              "version": "0.0.2",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
+              "imageKey": "identity-api"
+            }
+          }
+        }
+      ],
+      "displayName": "Xema Shell",
+      "packageName": "@xemahq/biomes-xema-shell",
+      "requiresServerBiomes": [],
+      "optionalServerBiomes": [],
+      "audience": "org",
+      "storeListed": true,
+      "sourceManifestHash": "80d843d3537c281c6241094f6f4c358afffd40d73d92b9672e9e58d5d123e85f",
+      "display": {
+        "icon": "terminal",
+        "category": "runtime",
+        "summary": "Xema OS shell: the `xema …` command surface, XVFS path resolution, and the concept object slice."
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "mailops",
@@ -2592,7 +3051,9 @@
       "services": [
         "mailops-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "mailops-api",
@@ -2604,7 +3065,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/agent-runtime",
             "version": "0.1.0",
-            "sourceManifestHash": "a13807cf05146aca50ee7964e66af7844f0bcfd34e35352227944ec81997461f"
+            "sourceManifestHash": "c9ea40d2bea57d8d1e53a4a3a6c006933ec67b28582de4e53aad65b84c3af267"
           }
         },
         {
@@ -2617,7 +3078,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/authorization",
             "version": "0.1.0",
-            "sourceManifestHash": "757ad1901fbeaeb8e2ff20bf7f5aa381e03ae9a72c43ac9a88eabc1af92371a1"
+            "sourceManifestHash": "3687551f3883d53cba6c201ecb449d4aabb4005a9ccd1eb429732fb497c912d0"
           }
         },
         {
@@ -2643,7 +3104,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/connector-platform",
             "version": "0.1.0",
-            "sourceManifestHash": "36862dd4bf78175095aab7fc39fcead6b0993cd48604b3a054e18132374fc9d0"
+            "sourceManifestHash": "cd53a7f937c3a3e2ce4336c608e6dc5887fb1b30cdb3521b5a8079627376571e"
           }
         },
         {
@@ -2656,7 +3117,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/connector-platform",
             "version": "0.1.0",
-            "sourceManifestHash": "36862dd4bf78175095aab7fc39fcead6b0993cd48604b3a054e18132374fc9d0"
+            "sourceManifestHash": "cd53a7f937c3a3e2ce4336c608e6dc5887fb1b30cdb3521b5a8079627376571e"
           }
         },
         {
@@ -2670,9 +3131,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -2687,7 +3148,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/workflow-runtime",
             "version": "0.1.0",
-            "sourceManifestHash": "21f6e8eb656f1a5e73e1980401e56c34eee55964bace21db87d065e2f690cb06"
+            "sourceManifestHash": "c376791358eba667ae78e45162250d0443c8cf40e1a7003244143b2d5d9743b0"
           }
         },
         {
@@ -2700,7 +3161,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/xema-capability-router",
             "version": "0.1.0",
-            "sourceManifestHash": "39a08d58a36cc8c469740f1ce28eed1d72b1ec55fb3a2c40645020c533bcc1f9"
+            "sourceManifestHash": "4ccc5c67859a6576a8e994d6a156bb5a3035c5ae1dedc3708d0f2da101cd564f"
           }
         }
       ],
@@ -2710,12 +3171,14 @@
       "optionalServerBiomes": [],
       "audience": "org",
       "storeListed": true,
-      "sourceManifestHash": "6fe5b908a01770ca23f86a1ffa478f6c51351b59edadc9167fe74979b36b8db5",
+      "sourceManifestHash": "59dd126a854e2e6bded840f7250ac1cc023266a9749bc33d42ad8f548f614640",
       "display": {
         "icon": "mail",
         "category": "connect",
         "summary": "Email as a workflow entrypoint — intake, understanding, routing, capability call-out and reply."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     },
     {
       "id": "search",
@@ -2730,7 +3193,9 @@
       "services": [
         "search-api"
       ],
+      "serviceDatabases": {},
       "runtimeComponents": [],
+      "hostModules": [],
       "serviceDependencies": [
         {
           "consumerService": "search-api",
@@ -2756,9 +3221,9 @@
               "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
               "repo": "submodules/identity-api",
               "path": "submodules/identity-api/package.json",
-              "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+              "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
               "version": "0.0.2",
-              "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+              "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
               "imageKey": "identity-api"
             }
           }
@@ -2774,7 +3239,7 @@
               "repositoryUrl": "https://github.com/xema-dev/llm-gateway-api.git",
               "repo": "submodules/llm-gateway-api",
               "path": "submodules/llm-gateway-api/package.json",
-              "sourceCommit": "79e4da92d86f8a7dc7605a8eca6837006495ccf5",
+              "sourceCommit": "3c94877b103c9360eb708814833355d55b79e8cd",
               "version": "1.0.0",
               "sourceManifestHash": "a862e41a632f3aecf1d6037b842a70ca5be91c996a89a68bd8200068355f43b8",
               "imageKey": "llm-gateway-api"
@@ -2791,7 +3256,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/agent-runtime",
             "version": "0.1.0",
-            "sourceManifestHash": "a13807cf05146aca50ee7964e66af7844f0bcfd34e35352227944ec81997461f"
+            "sourceManifestHash": "c9ea40d2bea57d8d1e53a4a3a6c006933ec67b28582de4e53aad65b84c3af267"
           }
         },
         {
@@ -2817,7 +3282,7 @@
             "repo": "repos/xema-base",
             "path": "repos/xema-base/biomes/xema-capability-router",
             "version": "0.1.0",
-            "sourceManifestHash": "39a08d58a36cc8c469740f1ce28eed1d72b1ec55fb3a2c40645020c533bcc1f9"
+            "sourceManifestHash": "4ccc5c67859a6576a8e994d6a156bb5a3035c5ae1dedc3708d0f2da101cd564f"
           }
         }
       ],
@@ -2832,7 +3297,9 @@
         "icon": "search",
         "category": "knowledge",
         "summary": "Full-text and vector search facade over OpenSearch for cross-entity discovery."
-      }
+      },
+      "systemSurface": false,
+      "launch": "static"
     }
   ],
   "platformServices": [
@@ -2845,7 +3312,7 @@
         "repositoryUrl": "https://github.com/xema-dev/event-hub-api.git",
         "repo": "submodules/event-hub-api",
         "path": "submodules/event-hub-api/package.json",
-        "sourceCommit": "8ff3acef9ca979948b2b1eb95c3964f97caf16b1",
+        "sourceCommit": "e19c759bc761720f64ef54e80f9b08f8d2cb0b37",
         "version": "2.0.0",
         "sourceManifestHash": "2e57d7356ed288b00e35f3ee4aa542cdbb1eb25d94a8fecbc2bda76cedd5f995",
         "imageKey": "event-hub-api"
@@ -2860,9 +3327,9 @@
         "repositoryUrl": "https://github.com/xema-dev/identity-api.git",
         "repo": "submodules/identity-api",
         "path": "submodules/identity-api/package.json",
-        "sourceCommit": "aeed57a5f01d50d0f4e9dff7c61967240a33ea4d",
+        "sourceCommit": "5bca87e39c536159b91c58d4e8a30d8df2f12ca4",
         "version": "0.0.2",
-        "sourceManifestHash": "240f19853364d56b71c89c5a7d15da4ce24d8423bdc22677a87603e0bac378ca",
+        "sourceManifestHash": "f0acc5e81bb3b00f98e1fde709e9dc24903bdf2ce5bdc6eeec0d5b9338bf5c1b",
         "imageKey": "identity-api"
       }
     },
@@ -2875,7 +3342,7 @@
         "repositoryUrl": "https://github.com/xema-dev/llm-gateway-api.git",
         "repo": "submodules/llm-gateway-api",
         "path": "submodules/llm-gateway-api/package.json",
-        "sourceCommit": "79e4da92d86f8a7dc7605a8eca6837006495ccf5",
+        "sourceCommit": "3c94877b103c9360eb708814833355d55b79e8cd",
         "version": "1.0.0",
         "sourceManifestHash": "a862e41a632f3aecf1d6037b842a70ca5be91c996a89a68bd8200068355f43b8",
         "imageKey": "llm-gateway-api"
@@ -2890,7 +3357,7 @@
         "repositoryUrl": "https://github.com/xema-dev/secrets-api.git",
         "repo": "submodules/secrets-api",
         "path": "submodules/secrets-api/package.json",
-        "sourceCommit": "5cb3114aa9fee7eeed42aeeea0ddd2d5a1ed8722",
+        "sourceCommit": "f6030e5e7dfd7a979079450ab2d40007a0412b5b",
         "version": "1.0.0",
         "sourceManifestHash": "51d6db6fac73a58b167eb7615c371fc75dfdb13a294c22ddb98c18d99df620a7",
         "imageKey": "secrets-api"
@@ -2898,19 +3365,63 @@
     },
     {
       "name": "xema-kernel-server",
-      "tier": "kernel"
+      "tier": "kernel",
+      "source": {
+        "name": "xema-kernel-server",
+        "tier": "kernel",
+        "repositoryUrl": "https://github.com/xema-dev/xema-base.git",
+        "repo": "repos/xema-base",
+        "path": "repos/xema-base/kernel/xema-kernel-server/package.json",
+        "sourceCommit": "4613b4ae8a4e11cf7948f743a7a4bef22377cb0e",
+        "version": "0.1.0",
+        "sourceManifestHash": "d84b71fafcbee7cdfe7f3b329a02578228bb008f4352788786869eaada86fce4",
+        "imageKey": "xema-kernel-server"
+      }
     },
     {
       "name": "docs-api",
-      "tier": "platform"
+      "tier": "platform",
+      "source": {
+        "name": "docs-api",
+        "tier": "platform",
+        "repositoryUrl": "https://github.com/xema-dev/xema-docs.git",
+        "repo": "repos/xema-docs",
+        "path": "repos/xema-docs/package.json",
+        "sourceCommit": "c4e1da5a49f385a4f6dc491cf6c918bbd11f848a",
+        "version": "0.0.1",
+        "sourceManifestHash": "10770a77153a2549a3e1af1142e3c52f1125f9b7a178937f1c05f76ce88e7cbc",
+        "imageKey": "docs-api"
+      }
     },
     {
       "name": "opencode-image-prepuller",
-      "tier": "platform"
+      "tier": "platform",
+      "source": {
+        "name": "opencode-image-prepuller",
+        "tier": "platform",
+        "repositoryUrl": "https://github.com/xema-dev/xema-base.git",
+        "repo": "repos/xema-base",
+        "path": "repos/xema-base/biomes/opencode-runtime/xema-biome.json",
+        "sourceCommit": "4613b4ae8a4e11cf7948f743a7a4bef22377cb0e",
+        "version": "0.1.0",
+        "sourceManifestHash": "4b38bba65e002f24e26ef4572ffa0e123da6cb0cdf0cd2fa5b2582e969abeb94",
+        "imageKey": "opencode-worker"
+      }
     },
     {
       "name": "xema-host-web",
-      "tier": "edge"
+      "tier": "edge",
+      "source": {
+        "name": "xema-host-web",
+        "tier": "edge",
+        "repositoryUrl": "https://github.com/xema-dev/xema-host-web.git",
+        "repo": "submodules/xema-host-web",
+        "path": "submodules/xema-host-web/package.json",
+        "sourceCommit": "e9bcee50b6ac5dde6aeaf0f642f2e988dabb8d3d",
+        "version": "2.2.0",
+        "sourceManifestHash": "30300d6cf87a55727209e9a9580500aaf9094659a4043481c74b33deb3163005",
+        "imageKey": "xema-host-web"
+      }
     }
   ],
   "capabilityDomainOwners": [
@@ -2990,6 +3501,10 @@
       "domain": "studio",
       "biomeId": "studio-author"
     },
+    {
+      "domain": "template",
+      "biomeId": "template-registry"
+    },
     {
       "domain": "web",
       "biomeId": "web-access"
@@ -3011,5 +3526,5 @@
       "biomeId": "xema-shell"
     }
   ],
-  "inputHash": "4c31b374a83013f1f375ce030f45605b0a3ba6c4a27a48efaae64167ea85b621"
+  "inputHash": "1cc50e8f629fd15fc4c32a09472dab6d4a0642229a74e06c9762009a4d1d3e6c"
 }