cc-codeconductor 1.0.0 → 1.1.0

package/dist/index.js

@@ -83,7 +83,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "cc-codeconductor",
-    version: "1.0.0",
+    version: "1.1.0",
     description: "A multi-agent orchestration framework for AI-assisted software engineering workflows.",
     keywords: [
       "ai",
@@ -132,7 +132,10 @@ var init_package = __esm(() => {
       "build:lib": "bun build src/index.ts --target=node --outfile=dist/library.js --packages=external",
       "build:types": "tsc -p tsconfig.lib.json --emitDeclarationOnly",
       test: "bun test",
+      "test:fast": "bun run scripts/test-fast.ts",
       typecheck: "tsc --noEmit",
+      lint: "bun run scripts/lint.ts",
+      "check:coverage": "bun run scripts/check-coverage.ts",
       "check:prompt-changelog": "bun run scripts/check-prompt-changelog.ts",
       "release:patch": "bash release.sh patch",
       "release:minor": "bash release.sh minor",
@@ -11274,6 +11277,10 @@ __export(exports_schemas, {
   validateMemoryIndex: () => validateMemoryIndex,
   validateKnowledgeEntity: () => validateKnowledgeEntity,
   validateImplementerOutput: () => validateImplementerOutput,
+  validateHarnessSuite: () => validateHarnessSuite,
+  validateHarnessOverlay: () => validateHarnessOverlay,
+  validateHarnessExperiment: () => validateHarnessExperiment,
+  validateHarnessCatalog: () => validateHarnessCatalog,
   validateGoalGraph: () => validateGoalGraph,
   validateExecutionContext: () => validateExecutionContext,
   validateEvidence: () => validateEvidence,
@@ -11337,6 +11344,15 @@ __export(exports_schemas, {
   ImplementerTestsSchema: () => ImplementerTestsSchema,
   ImplementerOutputSchema: () => ImplementerOutputSchema,
   ImpactReportSchema: () => ImpactReportSchema,
+  HarnessToggleKindSchema: () => HarnessToggleKindSchema,
+  HarnessSuiteTaskSchema: () => HarnessSuiteTaskSchema,
+  HarnessSuiteSchema: () => HarnessSuiteSchema,
+  HarnessOverlaySchema: () => HarnessOverlaySchema,
+  HarnessExperimentSchema: () => HarnessExperimentSchema,
+  HarnessComponentLayerSchema: () => HarnessComponentLayerSchema,
+  HarnessComponentIdSchema: () => HarnessComponentIdSchema,
+  HarnessCatalogSchema: () => HarnessCatalogSchema,
+  HarnessCatalogEntrySchema: () => HarnessCatalogEntrySchema,
   GraphRelationSchema: () => GraphRelationSchema,
   GoalTaskSchema: () => GoalTaskSchema,
   GoalGraphSchema: () => GoalGraphSchema,
@@ -11427,6 +11443,18 @@ function validateScorecardRecord(data) {
 function validateTaskOutcome(data) {
   return TaskOutcomeSchema.parse(data);
 }
+function validateHarnessCatalog(data) {
+  return HarnessCatalogSchema.parse(data);
+}
+function validateHarnessOverlay(data) {
+  return HarnessOverlaySchema.parse(data);
+}
+function validateHarnessExperiment(data) {
+  return HarnessExperimentSchema.parse(data);
+}
+function validateHarnessSuite(data) {
+  return HarnessSuiteSchema.parse(data);
+}
 function validateCommandEnvelope(data) {
   return CommandEnvelopeSchema.parse(data);
 }
@@ -11466,7 +11494,7 @@ function validateCanonicalTaskCard(data) {
 function validateProductEvent(data) {
   return ProductEventSchema.parse(data);
 }
-var CouncilAgentSpecSchema, CouncilSpecSchema, ProjectProfileSchema, CompileCheckConfigSchema, LoopConfigSchema, CodeConductorConfigSchema, RunnerTargetSchema, InstallStrategySchema, ManifestEntrySchema, InstallManifestSchema, ToolProviderNamesSchema, PermissionProviderNamesSchema, ModelConfigSchema, ContractTargetSchema, ContractFormatSchema, AgentContractSchema, CouncilFindingSchema, CouncilVerdictInputSchema, ConsensusConfigSchema, CouncilVerdictSchema, ClaudeAgentFileSchema, OpenCodeAgentFileSchema, SentryStackFrameSchema, SentryWebhookSchema, MemoryPointerSchema, MemoryIndexSchema, GoalTaskSchema, GoalGraphSchema, ConfidenceLevelSchema, ProductNodeTypeSchema, GraphRelationSchema, KnowledgeEntitySchema, DecisionSchema, EvidenceSchema, CanonicalTaskCardStatusSchema, CanonicalTaskCardSchema, ProductGraphNodeSchema, ProductGraphEdgeSchema, ProductGraphSchema, ProductMetaSchema, ProductEventTypeSchema, ProductEventSchema, OperationalStateSchema, StrategicMemorySchema, ImpactReportSchema, BusinessReviewOutputSchema, VerificationReportSchema, BacklogStatusSchema, BacklogTypeSchema, BacklogPrioritySchema, BacklogGlobalSchema, BacklogItemSchema, BacklogDocumentSchema, OpenspecTaskCardPhaseSchema, OpenspecTaskCardStatusSchema, OpenspecTaskCardSchema, OpenspecStateSchema, WorkflowCommandSchema, CcepOutputFormatSchema, CommandEnvelopeSchema, WorkflowPhaseSchema, WorkflowRiskRuleSchema, WorkflowProfileSchema, ExecutionContextSchema, PlannerOutputSchema, AgentArtifactSchema, AgentOutputSchema, ImplementerTestsSchema, ImplementerOutputSchema, ReviewAxisSchema, ReviewFindingSchema, ReviewerOutputSchema, TechnicalPlanOutputSchema, ScorecardVerdictSchema, ScorecardCriterionIdSchema, ScorecardCriterionSchema, ScorecardRecordSchema, TaskOutcomeSourceSchema, TaskOutcomeStatusSchema, TaskOutcomeSchema, EvaluationIndexSchema, ExecutionProfileNameSchema, ExecutionProfileSchema;
+var CouncilAgentSpecSchema, CouncilSpecSchema, ProjectProfileSchema, CompileCheckConfigSchema, LoopConfigSchema, CodeConductorConfigSchema, RunnerTargetSchema, InstallStrategySchema, ManifestEntrySchema, InstallManifestSchema, ToolProviderNamesSchema, PermissionProviderNamesSchema, ModelConfigSchema, ContractTargetSchema, ContractFormatSchema, AgentContractSchema, CouncilFindingSchema, CouncilVerdictInputSchema, ConsensusConfigSchema, CouncilVerdictSchema, ClaudeAgentFileSchema, OpenCodeAgentFileSchema, SentryStackFrameSchema, SentryWebhookSchema, MemoryPointerSchema, MemoryIndexSchema, GoalTaskSchema, GoalGraphSchema, ConfidenceLevelSchema, ProductNodeTypeSchema, GraphRelationSchema, KnowledgeEntitySchema, DecisionSchema, EvidenceSchema, CanonicalTaskCardStatusSchema, CanonicalTaskCardSchema, ProductGraphNodeSchema, ProductGraphEdgeSchema, ProductGraphSchema, ProductMetaSchema, ProductEventTypeSchema, ProductEventSchema, OperationalStateSchema, StrategicMemorySchema, ImpactReportSchema, BusinessReviewOutputSchema, VerificationReportSchema, BacklogStatusSchema, BacklogTypeSchema, BacklogPrioritySchema, BacklogGlobalSchema, BacklogItemSchema, BacklogDocumentSchema, OpenspecTaskCardPhaseSchema, OpenspecTaskCardStatusSchema, OpenspecTaskCardSchema, OpenspecStateSchema, WorkflowCommandSchema, CcepOutputFormatSchema, CommandEnvelopeSchema, WorkflowPhaseSchema, WorkflowRiskRuleSchema, WorkflowProfileSchema, ExecutionContextSchema, PlannerOutputSchema, AgentArtifactSchema, AgentOutputSchema, ImplementerTestsSchema, ImplementerOutputSchema, ReviewAxisSchema, ReviewFindingSchema, ReviewerOutputSchema, TechnicalPlanOutputSchema, ScorecardVerdictSchema, ScorecardCriterionIdSchema, ScorecardCriterionSchema, ScorecardRecordSchema, TaskOutcomeSourceSchema, TaskOutcomeStatusSchema, TaskOutcomeSchema, HarnessComponentIdSchema, HarnessComponentLayerSchema, HarnessToggleKindSchema, HarnessCatalogEntrySchema, HarnessCatalogSchema, HarnessOverlaySchema, HarnessExperimentSchema, HarnessSuiteTaskSchema, HarnessSuiteSchema, EvaluationIndexSchema, ExecutionProfileNameSchema, ExecutionProfileSchema;
 var init_schemas = __esm(() => {
   init_zod();
   CouncilAgentSpecSchema = exports_external.object({
@@ -11488,7 +11516,7 @@ var init_schemas = __esm(() => {
     version: exports_external.string(),
     description: exports_external.string(),
     outputContract: exports_external.string(),
-    agents: exports_external.array(CouncilAgentSpecSchema)
+    agents: exports_external.array(CouncilAgentSpecSchema).min(1).refine((agents) => new Set(agents.map((a) => a.id.trim().toLowerCase())).size === agents.length, { message: "council agent ids must be unique" })
   });
   ProjectProfileSchema = exports_external.object({
     rootDir: exports_external.string(),
@@ -11610,7 +11638,7 @@ var init_schemas = __esm(() => {
     status: exports_external.enum(["APPROVED", "REJECTED", "ABSTAIN"]),
     securityVeto: exports_external.boolean(),
     complianceVeto: exports_external.boolean().optional(),
-    confidence: exports_external.number().min(0).max(1).optional(),
+    confidence: exports_external.number().min(0).max(1),
     findings: exports_external.array(CouncilFindingSchema),
     summary: exports_external.string()
   });
@@ -11618,10 +11646,15 @@ var init_schemas = __esm(() => {
     algorithm: exports_external.enum(["majority", "unanimous"]),
     allowSecurityVeto: exports_external.boolean(),
     allowComplianceVeto: exports_external.boolean().optional(),
-    expectedAgentIds: exports_external.array(exports_external.string().min(1).refine((id) => id.trim().length > 0)).min(1).refine((ids) => new Set(ids.map((id) => id.trim().toLowerCase())).size === ids.length).optional()
+    expectedAgentIds: exports_external.array(exports_external.string().min(1).refine((id) => id.trim().length > 0)).min(1).refine((ids) => new Set(ids.map((id) => id.trim().toLowerCase())).size === ids.length).optional(),
+    quorum: exports_external.number().int().positive().optional(),
+    criticalFindingsPolicy: exports_external.enum(["escalate", "reject", "ignore"]).optional()
   }).refine((config) => config.algorithm !== "unanimous" || config.expectedAgentIds !== undefined, {
     message: "unanimous consensus requires a non-empty expectedAgentIds roster",
     path: ["expectedAgentIds"]
+  }).refine((config) => !config.allowSecurityVeto || config.expectedAgentIds === undefined || config.expectedAgentIds.some((id) => id.toLowerCase().includes("security")), {
+    message: "allowSecurityVeto requires at least one security agent in expectedAgentIds",
+    path: ["expectedAgentIds"]
   });
   CouncilVerdictSchema = exports_external.object({
     status: exports_external.enum(["APPROVED", "REJECTED", "ESCALATED"]),
@@ -11773,8 +11806,17 @@ var init_schemas = __esm(() => {
     agentType: exports_external.string(),
     evidenceRequired: exports_external.array(exports_external.string()).default([]),
     status: CanonicalTaskCardStatusSchema,
-    type: exports_external.enum(["feature", "fix", "refactor", "review", "docs", "test"]).optional(),
-    linkedCapabilities: exports_external.array(exports_external.string()).default([])
+    type: exports_external.enum(["feature", "fix", "refactor", "review", "docs", "test"]),
+    linkedCapabilities: exports_external.array(exports_external.string()).default([]),
+    boundaries: exports_external.array(exports_external.string()).default([]),
+    requiresHumanReview: exports_external.boolean().optional(),
+    requiresTests: exports_external.boolean().optional(),
+    contextScope: exports_external.enum(["isolated", "continuation", "full"]).optional(),
+    actualBehavior: exports_external.string().optional(),
+    expectedBehavior: exports_external.string().optional(),
+    reproductionSteps: exports_external.array(exports_external.string()).optional(),
+    domain: exports_external.string().optional(),
+    authorization: exports_external.string().optional()
   });
   ProductGraphNodeSchema = exports_external.object({
     id: exports_external.string(),
@@ -11932,7 +11974,8 @@ var init_schemas = __esm(() => {
     modelHint: exports_external.string().optional(),
     dependsOn: exports_external.array(exports_external.string()).default([]),
     acceptanceCriteria: exports_external.array(exports_external.string()),
-    status: OpenspecTaskCardStatusSchema
+    status: OpenspecTaskCardStatusSchema,
+    itemHash: exports_external.string().optional()
   });
   OpenspecStateSchema = exports_external.object({
     version: exports_external.literal(1),
@@ -11954,6 +11997,7 @@ var init_schemas = __esm(() => {
     "db-migration",
     "pagespeed",
     "openspec",
+    "backlog",
     "scorecard",
     "council",
     "iterative",
@@ -11961,7 +12005,8 @@ var init_schemas = __esm(() => {
     "triage",
     "prototype",
     "handoff",
-    "clarify"
+    "clarify",
+    "security"
   ]);
   CcepOutputFormatSchema = exports_external.enum(["taskcard", "plan", "verdict"]);
   CommandEnvelopeSchema = exports_external.object({
@@ -12195,7 +12240,86 @@ var init_schemas = __esm(() => {
     tokensIn: exports_external.number().optional(),
     tokensOut: exports_external.number().optional(),
     costUsd: exports_external.number().optional(),
-    durationMs: exports_external.number().optional()
+    durationMs: exports_external.number().optional(),
+    experimentId: exports_external.string().optional(),
+    variantId: exports_external.string().optional(),
+    suiteTaskId: exports_external.string().optional(),
+    harnessFingerprint: exports_external.string().optional(),
+    disabledComponents: exports_external.array(exports_external.string()).optional()
+  });
+  HarnessComponentIdSchema = exports_external.enum([
+    "wayfinding",
+    "intake",
+    "design",
+    "test_first",
+    "review",
+    "docs",
+    "confirmation_gates",
+    "compile_loop",
+    "council",
+    "product_graph"
+  ]);
+  HarnessComponentLayerSchema = exports_external.enum([
+    "phase",
+    "gate",
+    "loop",
+    "knowledge",
+    "council"
+  ]);
+  HarnessToggleKindSchema = exports_external.enum([
+    "ccep_phase",
+    "ccep_gates",
+    "config_loop",
+    "config_council",
+    "product_graph"
+  ]);
+  HarnessCatalogEntrySchema = exports_external.object({
+    id: HarnessComponentIdSchema,
+    layer: HarnessComponentLayerSchema,
+    label: exports_external.string(),
+    defaultOn: exports_external.boolean().default(true),
+    toggle: exports_external.object({
+      kind: HarnessToggleKindSchema,
+      phaseId: exports_external.string().optional()
+    })
+  });
+  HarnessCatalogSchema = exports_external.object({
+    version: exports_external.literal(1),
+    components: exports_external.array(HarnessCatalogEntrySchema).min(1)
+  });
+  HarnessOverlaySchema = exports_external.object({
+    experimentId: exports_external.string().optional(),
+    variantId: exports_external.string(),
+    disabledComponents: exports_external.array(HarnessComponentIdSchema),
+    disableProductGraph: exports_external.boolean().optional().default(false),
+    contractVersion: exports_external.string().optional(),
+    ccepProfile: exports_external.string().optional().default("feature")
+  });
+  HarnessExperimentSchema = exports_external.object({
+    id: exports_external.string(),
+    suiteId: exports_external.string(),
+    createdAt: exports_external.string(),
+    contractVersion: exports_external.string(),
+    components: exports_external.array(HarnessComponentIdSchema),
+    variants: exports_external.array(exports_external.string()).min(1),
+    suiteTaskIds: exports_external.array(exports_external.string()),
+    suitePath: exports_external.string().optional()
+  });
+  HarnessSuiteTaskSchema = exports_external.object({
+    id: exports_external.string(),
+    title: exports_external.string(),
+    type: exports_external.enum(["feature", "fix", "refactor"]),
+    risk: exports_external.enum(["low", "medium", "high"]).default("low"),
+    prompt: exports_external.string(),
+    scope: exports_external.string(),
+    acceptanceCriteria: exports_external.array(exports_external.string()).min(1),
+    testCommand: exports_external.string().optional()
+  });
+  HarnessSuiteSchema = exports_external.object({
+    id: exports_external.string(),
+    version: exports_external.number().int().positive(),
+    fixtureDir: exports_external.string().optional(),
+    tasks: exports_external.array(HarnessSuiteTaskSchema).min(1)
   });
   EvaluationIndexSchema = exports_external.object({
     version: exports_external.literal(1),
@@ -12377,6 +12501,24 @@ var init_profiles = __esm(() => {
       routing: { default: ["validate-backlog", "discover", "design", "test", "implement", "review"] },
       confirmationGate: baseGate
     },
+    backlog: {
+      id: "backlog",
+      version: 1,
+      command: "backlog",
+      taskCard: {
+        type: "feature",
+        requiredFields: ["title", "type", "risk", "scope", "context", "acceptanceCriteria"]
+      },
+      phases: [
+        { id: "wayfinding", agent: "repo-explorer", outputSchema: "agent-output" },
+        { id: "intake", agent: "task-coach", outputSchema: "planner-output", stopGate: "confirmation" },
+        { id: "write-backlog", agent: "docs" },
+        { id: "validate-backlog", agent: "orchestrator", type: "cli-gate" },
+        { id: "plan-changes", agent: "orchestrator", type: "cli-gate" }
+      ],
+      routing: { default: ["wayfinding", "intake", "write-backlog", "validate-backlog", "plan-changes"] },
+      confirmationGate: baseGate
+    },
     scorecard: {
       id: "scorecard",
       version: 1,
@@ -12507,13 +12649,42 @@ var init_profiles = __esm(() => {
       ],
       routing: { default: ["re-explain"] },
       confirmationGate: { stopOnHighRisk: false, stopOnQuestions: true }
+    },
+    security: {
+      id: "security",
+      version: 1,
+      command: "security",
+      taskCard: {
+        type: "fix",
+        requiredFields: ["domain", "authorization", "risk", "scope"]
+      },
+      phases: [
+        { id: "wayfinding", agent: "repo-explorer", outputSchema: "agent-output" },
+        { id: "intake", agent: "task-coach", outputSchema: "planner-output", stopGate: "confirmation" },
+        { id: "design", agent: "architect", stopGate: "approval" },
+        { id: "test", agent: "tester" },
+        { id: "implement", agent: "implementer", dependsOn: ["test"] },
+        { id: "review", agent: "reviewer" }
+      ],
+      routing: {
+        default: ["wayfinding", "intake", "test", "implement"],
+        riskRules: [
+          { when: { risk: "low" }, then: ["wayfinding", "intake", "test", "implement"] },
+          {
+            when: { risk: ["medium", "high"] },
+            then: ["wayfinding", "intake", "design", "test", "implement", "review"]
+          }
+        ]
+      },
+      confirmationGate: baseGate
     }
   };
 });
 
 // src/core/ccep/profile-yaml.ts
 import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { dirname as dirname2, join } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 function workflowYamlPath(command, projectRoot) {
   if (projectRoot) {
     const projectPath = join(projectRoot, ".codeconductor", "workflows", `${command}.yml`);
@@ -12551,7 +12722,7 @@ var init_profile_yaml = __esm(() => {
   init_dist();
   init_schemas();
   init_profiles();
-  BUNDLED_WORKFLOWS_DIR = join(import.meta.dir, "workflows");
+  BUNDLED_WORKFLOWS_DIR = join(dirname2(fileURLToPath2(import.meta.url)), "workflows");
 });
 
 // src/core/ccep/workflow-init.ts
@@ -13130,17 +13301,65 @@ function resolveAssets(target) {
 }
 var CURRENT_PRESET_VERSION = "v1.0.0";
 
+// src/core/openspec/openspec-gitignore.ts
+import { readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir } from "node:os";
+import { resolve as resolve4 } from "node:path";
+function gitignoreHasEntry(content, entry) {
+  return content.split(/\r?\n/).some((line) => line.trim() === entry);
+}
+async function ensureOpenspecGitignore(projectRoot) {
+  if (projectRoot === homedir())
+    return null;
+  const gitignorePath = resolve4(projectRoot, ".gitignore");
+  let existing = "";
+  try {
+    existing = await readFile2(gitignorePath, "utf-8");
+  } catch {
+    existing = "";
+  }
+  const missing = OPENSPEC_GITIGNORE_ENTRIES.filter((entry) => !gitignoreHasEntry(existing, entry));
+  if (missing.length === 0)
+    return null;
+  const chunks = [];
+  if (existing.length > 0 && !existing.endsWith(`
+`)) {
+    chunks.push(`
+`);
+  }
+  if (!existing.includes(OPENSPEC_GITIGNORE_HEADER)) {
+    if (existing.length > 0)
+      chunks.push(`
+`);
+    chunks.push(OPENSPEC_GITIGNORE_HEADER, `
+`);
+  }
+  chunks.push(missing.join(`
+`), `
+`);
+  await writeFile2(gitignorePath, existing + chunks.join(""), "utf-8");
+  return ".gitignore";
+}
+var OPENSPEC_GITIGNORE_HEADER = "# CodeConductor OpenSpec (local operational artifacts)", OPENSPEC_GITIGNORE_ENTRIES;
+var init_openspec_gitignore = __esm(() => {
+  OPENSPEC_GITIGNORE_ENTRIES = [
+    "BACKLOG.md",
+    "openspec/",
+    ".codeconductor/openspec-state.json"
+  ];
+});
+
 // src/commands/init.command.ts
 var exports_init_command = {};
 __export(exports_init_command, {
   initCommand: () => initCommand
 });
-import { access as access4, mkdir as mkdir3, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import { homedir } from "node:os";
-import { basename, resolve as resolve4 } from "node:path";
+import { access as access4, mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { basename, resolve as resolve5 } from "node:path";
 async function initCommand(options) {
   const { projectRoot, dryRun, force, global: isGlobal, output, locale } = options;
-  const baseDir = isGlobal ? homedir() : projectRoot;
+  const baseDir = isGlobal ? homedir2() : projectRoot;
   try {
     let profile = null;
     if (!isGlobal) {
@@ -13217,6 +13436,7 @@ async function initCommand(options) {
     }
     const copiedPresets = await copyPresets(baseDir, presetsToCopy, force);
     const openspecCreated = await initOpenspecArtifacts(baseDir, force);
+    const gitignoreCreated = await ensureOpenspecGitignore(baseDir);
     const evalCreated = await initEvaluationArtifacts(baseDir, force);
     const workflowsCreated = await initWorkflowArtifacts(baseDir, force);
     return {
@@ -13228,6 +13448,7 @@ async function initCommand(options) {
           ".codeconductor/config.yml",
           ...copiedPresets,
           ...openspecCreated,
+          ...gitignoreCreated ? [gitignoreCreated] : [],
           ...evalCreated,
           ...workflowsCreated
         ],
@@ -13256,7 +13477,7 @@ async function initCommand(options) {
 }
 async function resolvePresetsToCopy() {
   const sources = [];
-  const bundledCouncil = resolve4(SRC_PRESETS_DIR, "council", "council.yml");
+  const bundledCouncil = resolve5(SRC_PRESETS_DIR, "council", "council.yml");
   if (await fileExists3(bundledCouncil)) {
     sources.push({ name: "council.yml", sourcePath: bundledCouncil });
   }
@@ -13267,17 +13488,17 @@ async function resolvePresetsToCopy() {
   return sources;
 }
 async function copyPresets(baseDir, presets, force) {
-  const presetsDir = resolve4(baseDir, ".codeconductor", "presets");
+  const presetsDir = resolve5(baseDir, ".codeconductor", "presets");
   await mkdir3(presetsDir, { recursive: true });
   const copied = [];
   for (const preset of presets) {
-    const destPath = resolve4(presetsDir, preset.name);
+    const destPath = resolve5(presetsDir, preset.name);
     if (!force && await fileExists3(destPath)) {
       continue;
     }
     try {
-      const content = await readFile2(preset.sourcePath, "utf-8");
-      await writeFile2(destPath, content, "utf-8");
+      const content = await readFile3(preset.sourcePath, "utf-8");
+      await writeFile3(destPath, content, "utf-8");
       copied.push(`.codeconductor/presets/${preset.name}`);
     } catch (err2) {
       const code = err2.code;
@@ -13298,21 +13519,21 @@ async function fileExists3(path) {
   }
 }
 async function initOpenspecArtifacts(baseDir, force) {
-  if (baseDir === homedir())
+  if (baseDir === homedir2())
     return [];
   const created = [];
-  const backlogDest = resolve4(baseDir, "BACKLOG.md");
-  const backlogTemplate = resolve4(ROOT_PRESETS_DIR, "templates", "BACKLOG.md");
+  const backlogDest = resolve5(baseDir, "BACKLOG.md");
+  const backlogTemplate = resolve5(ROOT_PRESETS_DIR, "templates", "BACKLOG.md");
   if (force || !await fileExists3(backlogDest)) {
     if (await fileExists3(backlogTemplate)) {
-      const content = await readFile2(backlogTemplate, "utf-8");
-      await writeFile2(backlogDest, content, "utf-8");
+      const content = await readFile3(backlogTemplate, "utf-8");
+      await writeFile3(backlogDest, content, "utf-8");
       created.push("BACKLOG.md");
     }
   }
-  const stateDir = resolve4(baseDir, ".codeconductor");
+  const stateDir = resolve5(baseDir, ".codeconductor");
   await mkdir3(stateDir, { recursive: true });
-  const stateDest = resolve4(stateDir, "openspec-state.json");
+  const stateDest = resolve5(stateDir, "openspec-state.json");
   if (force || !await fileExists3(stateDest)) {
     const initialState = JSON.stringify({
       version: 1,
@@ -13320,34 +13541,34 @@ async function initOpenspecArtifacts(baseDir, force) {
       changePaths: {},
       itemSnapshots: {}
     }, null, 2);
-    await writeFile2(stateDest, initialState, "utf-8");
+    await writeFile3(stateDest, initialState, "utf-8");
     created.push(".codeconductor/openspec-state.json");
   }
   return created;
 }
 async function initEvaluationArtifacts(baseDir, force) {
-  if (baseDir === homedir())
+  if (baseDir === homedir2())
     return [];
   const created = [];
-  const evalDir = resolve4(baseDir, ".codeconductor", "evaluation");
+  const evalDir = resolve5(baseDir, ".codeconductor", "evaluation");
   await mkdir3(evalDir, { recursive: true });
-  await mkdir3(resolve4(evalDir, "scorecards"), { recursive: true });
-  const indexPath = resolve4(evalDir, "index.json");
+  await mkdir3(resolve5(evalDir, "scorecards"), { recursive: true });
+  const indexPath = resolve5(evalDir, "index.json");
   if (force || !await fileExists3(indexPath)) {
-    await writeFile2(indexPath, JSON.stringify({ version: 1 }, null, 2), "utf-8");
+    await writeFile3(indexPath, JSON.stringify({ version: 1 }, null, 2), "utf-8");
     created.push(".codeconductor/evaluation/index.json");
   }
-  const outcomesPath = resolve4(evalDir, "outcomes.jsonl");
+  const outcomesPath = resolve5(evalDir, "outcomes.jsonl");
   if (force || !await fileExists3(outcomesPath)) {
-    await writeFile2(outcomesPath, "", "utf-8");
+    await writeFile3(outcomesPath, "", "utf-8");
     created.push(".codeconductor/evaluation/outcomes.jsonl");
   }
-  const profileDest = resolve4(evalDir, "execution-profile.yml");
-  const profileTemplate = resolve4(ROOT_PRESETS_DIR, "templates", "execution-profile.yml");
+  const profileDest = resolve5(evalDir, "execution-profile.yml");
+  const profileTemplate = resolve5(ROOT_PRESETS_DIR, "templates", "execution-profile.yml");
   if (force || !await fileExists3(profileDest)) {
     if (await fileExists3(profileTemplate)) {
-      const content = await readFile2(profileTemplate, "utf-8");
-      await writeFile2(profileDest, content, "utf-8");
+      const content = await readFile3(profileTemplate, "utf-8");
+      await writeFile3(profileDest, content, "utf-8");
       created.push(".codeconductor/evaluation/execution-profile.yml");
     }
   }
@@ -13358,6 +13579,7 @@ var init_init_command = __esm(() => {
   init_workflow_init();
   init_project_detector();
   init_package_paths();
+  init_openspec_gitignore();
 });
 
 // src/commands/detect.command.ts
@@ -13670,12 +13892,12 @@ var init_opencode_lsp_generator = __esm(() => {
 });
 
 // src/core/config/config-loader.ts
-import { readFile as readFile3 } from "node:fs/promises";
-import { resolve as resolve5 } from "node:path";
+import { readFile as readFile4 } from "node:fs/promises";
+import { resolve as resolve6 } from "node:path";
 async function loadConfig(projectRoot) {
   try {
-    const configPath = resolve5(projectRoot, CONFIG_FILE2);
-    const content = await readFile3(configPath, "utf-8");
+    const configPath = resolve6(projectRoot, CONFIG_FILE2);
+    const content = await readFile4(configPath, "utf-8");
     const data = $parse(content);
     if (!data) {
       return err(new ValidationError("Empty config file"));
@@ -13694,8 +13916,8 @@ async function loadConfig(projectRoot) {
 }
 async function configExists(projectRoot) {
   try {
-    const configPath = resolve5(projectRoot, CONFIG_FILE2);
-    await readFile3(configPath, "utf-8");
+    const configPath = resolve6(projectRoot, CONFIG_FILE2);
+    await readFile4(configPath, "utf-8");
     return true;
   } catch {
     return false;
@@ -13711,7 +13933,7 @@ var init_config_loader = __esm(() => {
 // src/core/filesystem/path-containment.ts
 import { constants as constants2 } from "node:fs";
 import { lstat, mkdir as mkdir4, open, realpath } from "node:fs/promises";
-import { basename as basename2, dirname as dirname2, isAbsolute, join as join3, relative, resolve as resolve6, sep as sep2 } from "node:path";
+import { basename as basename2, dirname as dirname3, isAbsolute, join as join3, relative, resolve as resolve7, sep as sep2 } from "node:path";
 function isInside(root, target) {
   const rel = relative(root, target);
   return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep2}`) && !isAbsolute(rel);
@@ -13730,8 +13952,8 @@ async function resolveWithinRoot(projectRoot, relPath) {
   if (isAbsolute(relPath)) {
     return;
   }
-  const rootAbs = resolve6(projectRoot);
-  const candidate = resolve6(rootAbs, relPath);
+  const rootAbs = resolve7(projectRoot);
+  const candidate = resolve7(rootAbs, relPath);
   if (!isInside(rootAbs, candidate)) {
     return;
   }
@@ -13747,7 +13969,7 @@ async function readFileWithinRoot(projectRoot, relPath) {
   if (candidateReal === undefined) {
     return;
   }
-  const rootReal = await realpath(resolve6(projectRoot));
+  const rootReal = await realpath(resolve7(projectRoot));
   let handle;
   try {
     handle = await open(candidateReal, constants2.O_RDONLY | O_NOFOLLOW);
@@ -13782,7 +14004,7 @@ async function canonicalizeExistingPrefix(target) {
       if (error.code !== "ENOENT") {
         throw error;
       }
-      const parent = dirname2(current);
+      const parent = dirname3(current);
       if (parent === current) {
         throw error;
       }
@@ -13795,8 +14017,8 @@ async function resolveOutputWithinRoot(projectRoot, relPath) {
   if (relPath === "" || isAbsolute(relPath)) {
     return;
   }
-  const rootAbs = resolve6(projectRoot);
-  const candidate = resolve6(rootAbs, relPath);
+  const rootAbs = resolve7(projectRoot);
+  const candidate = resolve7(rootAbs, relPath);
   if (!isInside(rootAbs, candidate)) {
     return;
   }
@@ -13879,12 +14101,12 @@ async function writeContainedFile(projectRoot, relPath, content, options) {
   if (resolved === undefined) {
     throw new OutputPathError(`Output path is not an allowed destination: ${relPath}`);
   }
-  await mkdir4(dirname2(resolved), { recursive: true });
+  await mkdir4(dirname3(resolved), { recursive: true });
   const outputPath = await resolveOutputWithinRoot(projectRoot, relPath);
   if (outputPath === undefined) {
     throw new OutputPathError(`Output path is not an allowed destination: ${relPath}`);
   }
-  const rootReal = await realpath(resolve6(projectRoot));
+  const rootReal = await realpath(resolve7(projectRoot));
   let handle;
   try {
     handle = await openOutputHandle(outputPath, force);
@@ -14035,7 +14257,7 @@ var init_file_writer = __esm(() => {
 
 // src/core/lsp/binary-integrity.ts
 import { createHash } from "node:crypto";
-import { isAbsolute as isAbsolute2, resolve as resolve7, sep as sep3 } from "node:path";
+import { isAbsolute as isAbsolute2, resolve as resolve8, sep as sep3 } from "node:path";
 function assertPinnedBinaryUrl(url) {
   let parsed;
   try {
@@ -14071,8 +14293,8 @@ function resolveSafeArchiveEntry(destRoot, entry) {
   if (normalized === "" || isAbsolute2(normalized) || normalized.startsWith("/") || /^[A-Za-z]:\//.test(normalized) || normalized.split("/").includes("..")) {
     throw new Error(`Unsafe archive entry rejected: ${entry}`);
   }
-  const root = resolve7(destRoot);
-  const target = resolve7(root, normalized);
+  const root = resolve8(destRoot);
+  const target = resolve8(root, normalized);
   const rel = target.slice(root.length);
   if (target !== root && (rel === "" || !rel.startsWith(sep3))) {
     throw new Error(`Unsafe archive entry rejected: ${entry}`);
@@ -14322,7 +14544,7 @@ function parseContentLength(raw, url) {
   return declared;
 }
 function performRequest(target, remainingMs, originalUrl, totalTimeout, followRedirects) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const isHttps = target.url.protocol === "https:";
     const port = target.url.port !== "" ? Number(target.url.port) : isHttps ? 443 : 80;
     let timer;
@@ -14341,7 +14563,7 @@ function performRequest(target, remainingMs, originalUrl, totalTimeout, followRe
         return;
       settled = true;
       clearTimeout(timer);
-      resolve8(response);
+      resolve9(response);
     };
     timer = setTimeout(() => {
       fail(new SafeFetchError(`Request timed out after ${totalTimeout}ms: ${originalUrl}`));
@@ -14445,7 +14667,7 @@ async function safeFetchWithInternals(urlString, options = {}, internals = {}) {
   }
 }
 async function delay(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 var MAX_BODY_BYTES, MAX_REDIRECTS = 5, USER_AGENT = "CodeConductor-SEO/0.3.0", ACCEPT = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", SafeFetchError, BLOCKED_IPV4_CIDRS, BLOCKED_IPV4;
 var init_safe_fetch_internal = __esm(() => {
@@ -14664,8 +14886,8 @@ var init_binary_downloader = __esm(() => {
 
 // src/core/lsp/lsp-installer.ts
 import { execFile } from "node:child_process";
-import { access as access6, mkdir as mkdir5, mkdtemp, rename, rm, writeFile as writeFile3 } from "node:fs/promises";
-import { homedir as homedir2, tmpdir } from "node:os";
+import { access as access6, mkdir as mkdir5, mkdtemp, rename, rm, writeFile as writeFile4 } from "node:fs/promises";
+import { homedir as homedir3, tmpdir } from "node:os";
 import { join as join4 } from "node:path";
 import { promisify } from "node:util";
 async function assertTarArchiveSafe(archivePath, destRoot) {
@@ -14687,7 +14909,7 @@ async function extractHardenedTar(archivePath, destRoot) {
 class LspInstaller {
   lspBinDir;
   constructor() {
-    this.lspBinDir = join4(homedir2(), ".codeconductor", "lsp", "bin");
+    this.lspBinDir = join4(homedir3(), ".codeconductor", "lsp", "bin");
   }
   async checkInstalled(def) {
     try {
@@ -14757,11 +14979,9 @@ class LspInstaller {
     const results = [];
     for (const lsp of lsps) {
       if (options.dryRun) {
-        const status = await this.checkInstalled(lsp);
         results.push({
           lspId: lsp.id,
-          status: status.installed ? "already-installed" : "installed",
-          version: status.version
+          status: "installed"
         });
       } else {
         const result = await this.installLsp(lsp);
@@ -14833,7 +15053,7 @@ class LspInstaller {
     try {
       const archiveName = binary.url.endsWith(".zip") ? "server.zip" : "server.tar.gz";
       const archivePath = join4(workDir, archiveName);
-      await writeFile3(archivePath, bytes);
+      await writeFile4(archivePath, bytes);
       if (archiveName.endsWith(".zip")) {
         throw new Error(`Zip binary installs are not supported yet for ${def.serverName}; use a .tar.gz artifact`);
       }
@@ -14976,11 +15196,11 @@ var exports_install_lsp_command = {};
 __export(exports_install_lsp_command, {
   installLspCommand: () => installLspCommand
 });
-import { homedir as homedir3 } from "node:os";
-import { resolve as resolve8 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { resolve as resolve9 } from "node:path";
 async function installLspCommand(options) {
   const { target, lang, dryRun, force, global: isGlobal, output, projectRoot } = options;
-  const baseDir = isGlobal ? homedir3() : projectRoot;
+  const baseDir = isGlobal ? homedir4() : projectRoot;
   try {
     const runnerTarget = parseRunnerTarget(target);
     const targets = getIndividualTargets(runnerTarget);
@@ -15028,7 +15248,7 @@ async function installLspCommand(options) {
       const generatedFiles = generator.generate(installReport.results);
       const resolvedFiles = generatedFiles.map((f) => ({
         ...f,
-        path: resolve8(baseDir, f.path)
+        path: resolve9(baseDir, f.path)
       }));
       const results = await writeGeneratedFiles(resolvedFiles, {
         ...writeOptions,
@@ -15919,18 +16139,18 @@ function countOccurrences(content, needle) {
 var MANAGED_BEGIN_MARKER = "<!-- CODECONDUCTOR:BEGIN managed -->", MANAGED_END_MARKER = "<!-- CODECONDUCTOR:END managed -->";
 
 // src/core/presets/complementary-detector.ts
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { join as join5 } from "node:path";
-import { homedir as homedir4 } from "node:os";
+import { homedir as homedir5 } from "node:os";
 function detectComplementaryTools() {
   if (cachedStatus) {
     return cachedStatus;
   }
   const isCmdAvailable = (cmd) => {
     try {
-      const command = process.platform === "win32" ? `where ${cmd}` : `which ${cmd}`;
-      execSync(command, { stdio: "ignore", timeout: 1000 });
+      const binary = process.platform === "win32" ? "where" : "which";
+      execFileSync(binary, [cmd], { stdio: "ignore", timeout: 1000 });
       return true;
     } catch {
       return false;
@@ -15938,7 +16158,7 @@ function detectComplementaryTools() {
   };
   const hasCaveman = () => {
     try {
-      const globalSettingsPath = join5(homedir4(), ".claude", "settings.json");
+      const globalSettingsPath = join5(homedir5(), ".claude", "settings.json");
       if (existsSync2(globalSettingsPath)) {
         const content = readFileSync2(globalSettingsPath, "utf8");
         const settings = JSON.parse(content);
@@ -15973,9 +16193,9 @@ var cachedStatus = null;
 var init_complementary_detector = () => {};
 
 // src/core/presets/file-copier.ts
-import { lstat as lstat2, readdir as readdir2, readFile as readFile4, stat } from "node:fs/promises";
-import { homedir as homedir5 } from "node:os";
-import { join as join6, relative as relative3, resolve as resolve9 } from "node:path";
+import { lstat as lstat2, readdir as readdir2, readFile as readFile5, stat } from "node:fs/promises";
+import { homedir as homedir6 } from "node:os";
+import { join as join6, relative as relative3, resolve as resolve10 } from "node:path";
 function isMaintainerReservedDest(baseDir, destPath) {
   const rel = relative3(baseDir, destPath).replace(/\\/g, "/");
   if (MAINTAINER_RESERVED_EXACT.has(rel))
@@ -16004,17 +16224,17 @@ async function fileExists4(path) {
   }
 }
 async function resolveEntryFiles(entry, presetsDir, baseDir) {
-  const srcAbsolute = resolve9(presetsDir, entry.src);
+  const srcAbsolute = resolve10(presetsDir, entry.src);
   try {
     const s = await stat(srcAbsolute);
     if (s.isDirectory()) {
       const files = await listFilesRecursive(srcAbsolute);
       return files.map((f) => ({
         src: join6(srcAbsolute, f),
-        dest: resolve9(baseDir, entry.dest, f)
+        dest: resolve10(baseDir, entry.dest, f)
       }));
     }
-    return [{ src: srcAbsolute, dest: resolve9(baseDir, entry.dest) }];
+    return [{ src: srcAbsolute, dest: resolve10(baseDir, entry.dest) }];
   } catch {
     return [];
   }
@@ -16282,7 +16502,7 @@ async function applySingleFile(srcPath, destPath, strategy, force, dryRun, isTem
   }
   let content;
   try {
-    content = await readFile4(srcPath, "utf-8");
+    content = await readFile5(srcPath, "utf-8");
   } catch (e) {
     return { src: srcPath, dest: destPath, action: "error", error: `Cannot read source: ${e}` };
   }
@@ -16293,7 +16513,7 @@ async function applySingleFile(srcPath, destPath, strategy, force, dryRun, isTem
   if (strategy === "append") {
     let existing = "";
     try {
-      existing = await readFile4(destPath, "utf-8");
+      existing = await readFile5(destPath, "utf-8");
     } catch {}
     if (existing) {
       finalContent = existing + `
@@ -16306,7 +16526,7 @@ async function applySingleFile(srcPath, destPath, strategy, force, dryRun, isTem
   } else if (strategy === "merge-json") {
     let existing = {};
     try {
-      existing = JSON.parse(await readFile4(destPath, "utf-8"));
+      existing = JSON.parse(await readFile5(destPath, "utf-8"));
     } catch {}
     try {
       const incoming = JSON.parse(incomingContent);
@@ -16318,7 +16538,7 @@ async function applySingleFile(srcPath, destPath, strategy, force, dryRun, isTem
   } else if (strategy === "merge-managed") {
     let existing = null;
     try {
-      existing = await readFile4(destPath, "utf-8");
+      existing = await readFile5(destPath, "utf-8");
     } catch {}
     const markerless = existing !== null && !existing.includes(MANAGED_BEGIN_MARKER) && !existing.includes(MANAGED_END_MARKER);
     if (markerless && !force) {
@@ -16359,7 +16579,7 @@ async function copyFromManifest(manifest, presetsDir, baseDir, isGlobal, dryRun,
     let resolvedBaseDir = baseDir;
     let resolvedEntry = entry;
     if (manifest.target === "agy" && isGlobal) {
-      resolvedBaseDir = join6(homedir5(), ".gemini", "config");
+      resolvedBaseDir = join6(homedir6(), ".gemini", "config");
       resolvedEntry = {
         ...entry,
         dest: entry.dest.replace(/^\.agents\/?/, "")
@@ -16391,17 +16611,17 @@ var init_file_copier = __esm(() => {
 });
 
 // src/core/presets/manifest-loader.ts
-import { readFile as readFile5 } from "node:fs/promises";
+import { readFile as readFile6 } from "node:fs/promises";
 import { join as join7 } from "node:path";
 async function loadManifest(target) {
   const manifestPath = join7(MANIFESTS_DIR, `${target}.yml`);
-  const content = await readFile5(manifestPath, "utf-8");
+  const content = await readFile6(manifestPath, "utf-8");
   const data = $parse(content);
   return InstallManifestSchema.parse(data);
 }
 async function loadModelConfig(target) {
   const modelPath = join7(MODELS_DIR, `${target}.yml`);
-  const content = await readFile5(modelPath, "utf-8");
+  const content = await readFile6(modelPath, "utf-8");
   const data = $parse(content);
   return ModelConfigSchema.parse(data);
 }
@@ -16421,16 +16641,16 @@ __export(exports_preset_loader, {
   loadPreset: () => loadPreset,
   loadCouncilPreset: () => loadCouncilPreset
 });
-import { readFile as readFile6 } from "node:fs/promises";
-import { resolve as resolve10 } from "node:path";
+import { readFile as readFile7 } from "node:fs/promises";
+import { resolve as resolve11 } from "node:path";
 async function loadPreset(name, projectRoot = process.cwd()) {
   const candidates = [
-    resolve10(projectRoot, ".codeconductor", "presets", `${name}.yml`),
-    resolve10(SRC_PRESETS_DIR, name, `${name}.yml`)
+    resolve11(projectRoot, ".codeconductor", "presets", `${name}.yml`),
+    resolve11(SRC_PRESETS_DIR, name, `${name}.yml`)
   ];
   for (const presetPath of candidates) {
     try {
-      const content = await readFile6(presetPath, "utf-8");
+      const content = await readFile7(presetPath, "utf-8");
       const data = $parse(content);
       if (!data)
         continue;
@@ -16464,11 +16684,11 @@ __export(exports_install_command, {
   installPresetCommand: () => installPresetCommand,
   installCommand: () => installCommand
 });
-import { homedir as homedir6 } from "node:os";
-import { resolve as resolve11 } from "node:path";
+import { homedir as homedir7 } from "node:os";
+import { resolve as resolve12 } from "node:path";
 async function installCommand(options) {
   const { target, dryRun, force, global: isGlobal, output, projectRoot } = options;
-  const baseDir = isGlobal ? homedir6() : projectRoot;
+  const baseDir = isGlobal ? homedir7() : projectRoot;
   try {
     const runnerTarget = parseRunnerTarget(target);
     const targets = getIndividualTargets(runnerTarget);
@@ -16509,10 +16729,10 @@ async function installCommand(options) {
       }
       const generatedFiles = await installer.generate();
       const isAgyGlobal = (t === "agy" || t === "gemini") && isGlobal;
-      const targetBase = isAgyGlobal ? resolve11(homedir6(), ".gemini", "config") : baseDir;
+      const targetBase = isAgyGlobal ? resolve12(homedir7(), ".gemini", "config") : baseDir;
       const resolvedFiles = generatedFiles.map((f) => ({
         ...f,
-        path: resolve11(targetBase, isAgyGlobal ? f.path.replace(/^\.agents\/?/, "") : f.path)
+        path: resolve12(targetBase, isAgyGlobal ? f.path.replace(/^\.agents\/?/, "") : f.path)
       }));
       const results = await writeGeneratedFiles(resolvedFiles, {
         ...writeOptions,
@@ -16574,7 +16794,7 @@ async function installCommand(options) {
 }
 async function installPresetCommand(options) {
   const { target, dryRun, force, global: isGlobal, projectRoot } = options;
-  const baseDir = isGlobal ? homedir6() : projectRoot;
+  const baseDir = isGlobal ? homedir7() : projectRoot;
   try {
     const runnerTarget = parseRunnerTarget(target);
     const targets = getIndividualTargets(runnerTarget);
@@ -16637,9 +16857,9 @@ var init_install_command = __esm(() => {
 });
 
 // src/core/security/target-compatibility.ts
-import { readFile as readFile7 } from "node:fs/promises";
+import { readFile as readFile8 } from "node:fs/promises";
 async function loadTargetSecurityCompatibility() {
-  const policy = $parse(await readFile7(POLICY_PATH, "utf-8"));
+  const policy = $parse(await readFile8(POLICY_PATH, "utf-8"));
   const targets = [
     "opencode",
     "claude",
@@ -16673,14 +16893,14 @@ var init_target_compatibility = __esm(() => {
 });
 
 // src/core/presets/update-checker.ts
-import { stat as stat2, readFile as readFile8 } from "node:fs/promises";
-import { resolve as resolve12, join as join8 } from "node:path";
-import { homedir as homedir7 } from "node:os";
+import { stat as stat2, readFile as readFile9 } from "node:fs/promises";
+import { resolve as resolve13, join as join8 } from "node:path";
+import { homedir as homedir8 } from "node:os";
 function getTargetInstallationPath(target, basePath, isGlobal) {
   if (target === "agy") {
-    return isGlobal ? resolve12(basePath, ".gemini", "config") : resolve12(basePath, ".agents");
+    return isGlobal ? resolve13(basePath, ".gemini", "config") : resolve13(basePath, ".agents");
   }
-  return resolve12(basePath, `.${target}`);
+  return resolve13(basePath, `.${target}`);
 }
 async function isTargetInstalled(target, basePath, isGlobal) {
   const path = getTargetInstallationPath(target, basePath, isGlobal);
@@ -16693,12 +16913,12 @@ async function isTargetInstalled(target, basePath, isGlobal) {
 }
 async function validateAgentFileSizes(basePath, isGlobal) {
   const filesToCheck = [];
-  filesToCheck.push(resolve12(basePath, ".claude", "CLAUDE.md"));
-  filesToCheck.push(resolve12(basePath, ".codex", "AGENTS.md"));
+  filesToCheck.push(resolve13(basePath, ".claude", "CLAUDE.md"));
+  filesToCheck.push(resolve13(basePath, ".codex", "AGENTS.md"));
   if (isGlobal) {
-    filesToCheck.push(resolve12(basePath, ".gemini", "config", "AGENTS.md"));
+    filesToCheck.push(resolve13(basePath, ".gemini", "config", "AGENTS.md"));
   } else {
-    filesToCheck.push(resolve12(basePath, ".agents", "AGENTS.md"));
+    filesToCheck.push(resolve13(basePath, ".agents", "AGENTS.md"));
   }
   const largeFiles = [];
   for (const filePath of filesToCheck) {
@@ -16740,7 +16960,7 @@ async function validateAgentMarkers(basePath, isGlobal) {
       let resolvedEntry = entry;
       let targetBaseDir = basePath;
       if (target === "agy" && isGlobal) {
-        targetBaseDir = join8(homedir7(), ".gemini", "config");
+        targetBaseDir = join8(homedir8(), ".gemini", "config");
         resolvedEntry = {
           ...entry,
           dest: entry.dest.replace(/^\.agents\/?/, "")
@@ -16749,7 +16969,7 @@ async function validateAgentMarkers(basePath, isGlobal) {
       const files = await resolveEntryFiles(resolvedEntry, PRESETS_DIR, targetBaseDir);
       for (const { dest } of files) {
         try {
-          const content = await readFile8(dest, "utf-8");
+          const content = await readFile9(dest, "utf-8");
           const beginCount = content.split(MANAGED_BEGIN_MARKER).length - 1;
           const endCount = content.split(MANAGED_END_MARKER).length - 1;
           if (beginCount === 0 && endCount === 0) {
@@ -16773,8 +16993,8 @@ async function validateAgentMarkers(basePath, isGlobal) {
 }
 async function fileContentDiffers(pathA, pathB) {
   try {
-    const contentA = await readFile8(pathA, "utf-8");
-    const contentB = await readFile8(pathB, "utf-8");
+    const contentA = await readFile9(pathA, "utf-8");
+    const contentB = await readFile9(pathB, "utf-8");
     return contentA.trim() !== contentB.trim();
   } catch {
     try {
@@ -16787,12 +17007,12 @@ async function fileContentDiffers(pathA, pathB) {
 }
 async function loadSkillsLock(basePath) {
   const paths = [
-    resolve12(basePath, ".codeconductor", "skills-lock.json"),
-    resolve12(basePath, ".agents", "skills-lock.json")
+    resolve13(basePath, ".codeconductor", "skills-lock.json"),
+    resolve13(basePath, ".agents", "skills-lock.json")
   ];
   for (const p of paths) {
     try {
-      const content = await readFile8(p, "utf-8");
+      const content = await readFile9(p, "utf-8");
       return JSON.parse(content);
     } catch {}
   }
@@ -16808,9 +17028,9 @@ async function getLatestSkillVersion(skillId) {
     "cursor"
   ];
   for (const target of targets) {
-    const skillPath = resolve12(ROOT_PRESETS_DIR, target, "skills", skillId, "SKILL.md");
+    const skillPath = resolve13(ROOT_PRESETS_DIR, target, "skills", skillId, "SKILL.md");
     try {
-      const content = await readFile8(skillPath, "utf-8");
+      const content = await readFile9(skillPath, "utf-8");
       const fmMatch = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
       if (fmMatch) {
         const parsed = $parse(fmMatch[1]);
@@ -16823,10 +17043,10 @@ async function getLatestSkillVersion(skillId) {
   return null;
 }
 async function checkUpdates(basePath, isGlobal) {
-  const localCouncil = resolve12(basePath, ".codeconductor", "presets", "council.yml");
-  const bundledCouncil = resolve12(SRC_PRESETS_DIR, "council", "council.yml");
+  const localCouncil = resolve13(basePath, ".codeconductor", "presets", "council.yml");
+  const bundledCouncil = resolve13(SRC_PRESETS_DIR, "council", "council.yml");
   const councilHasUpdate = await fileContentDiffers(localCouncil, bundledCouncil);
-  const localPolicy = resolve12(basePath, ".codeconductor", "presets", "policy.yml");
+  const localPolicy = resolve13(basePath, ".codeconductor", "presets", "policy.yml");
   const policyHasUpdate = await fileContentDiffers(localPolicy, POLICY_PATH);
   const targetsToCheck = [
     "opencode",
@@ -16865,7 +17085,7 @@ async function checkUpdates(basePath, isGlobal) {
       let resolvedEntry = entry;
       let targetBaseDir = basePath;
       if (target === "agy" && isGlobal) {
-        targetBaseDir = join8(homedir7(), ".gemini", "config");
+        targetBaseDir = join8(homedir8(), ".gemini", "config");
         resolvedEntry = {
           ...entry,
           dest: entry.dest.replace(/^\.agents\/?/, "")
@@ -16876,14 +17096,14 @@ async function checkUpdates(basePath, isGlobal) {
       for (const { src, dest } of files) {
         let expectedContent;
         try {
-          const srcContent = await readFile8(src, "utf-8");
+          const srcContent = await readFile9(src, "utf-8");
           expectedContent = isTemplate && modelConfig ? renderTemplate(srcContent, modelConfig, src, locale) : srcContent;
         } catch {
           continue;
         }
         let destContent;
         try {
-          destContent = await readFile8(dest, "utf-8");
+          destContent = await readFile9(dest, "utf-8");
         } catch {
           changedFiles.push(dest);
           continue;
@@ -16955,13 +17175,13 @@ async function checkUpdates(basePath, isGlobal) {
               let targetPath = f.path;
               let targetBase = basePath;
               if ((target === "agy" || target === "gemini") && isGlobal) {
-                targetBase = join8(homedir7(), ".gemini", "config");
+                targetBase = join8(homedir8(), ".gemini", "config");
                 targetPath = targetPath.replace(/^\.agents\/?/, "");
               }
-              const dest = resolve12(targetBase, targetPath);
+              const dest = resolve13(targetBase, targetPath);
               let destContent;
               try {
-                destContent = await readFile8(dest, "utf-8");
+                destContent = await readFile9(dest, "utf-8");
                 if (destContent.trim() !== f.content.trim()) {
                   changedFiles.push(dest);
                 }
@@ -17032,7 +17252,7 @@ __export(exports_doctor_command, {
   doctorCommand: () => doctorCommand
 });
 import { join as join9 } from "node:path";
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir9 } from "node:os";
 async function doctorCommand(options) {
   const { projectRoot, output } = options;
   const checks = [];
@@ -17108,7 +17328,7 @@ async function doctorCommand(options) {
       });
     }
     const localUpdates = await checkUpdates(projectRoot, false);
-    const globalUpdates = await checkUpdates(homedir8(), true);
+    const globalUpdates = await checkUpdates(homedir9(), true);
     const updateDetails = [];
     if (localUpdates.hasUpdates) {
       if (localUpdates.council)
@@ -17152,7 +17372,7 @@ async function doctorCommand(options) {
       });
     }
     const largeFilesLocal = await validateAgentFileSizes(projectRoot, false);
-    const largeFilesGlobal = await validateAgentFileSizes(homedir8(), true);
+    const largeFilesGlobal = await validateAgentFileSizes(homedir9(), true);
     const allLargeFiles = [...largeFilesLocal, ...largeFilesGlobal];
     if (allLargeFiles.length > 0) {
       checks.push({
@@ -17168,7 +17388,7 @@ async function doctorCommand(options) {
       });
     }
     const missingMarkersLocal = await validateAgentMarkers(projectRoot, false);
-    const missingMarkersGlobal = await validateAgentMarkers(homedir8(), true);
+    const missingMarkersGlobal = await validateAgentMarkers(homedir9(), true);
     const allMissingMarkers = [...missingMarkersLocal, ...missingMarkersGlobal];
     if (allMissingMarkers.length > 0) {
       checks.push({
@@ -17196,8 +17416,8 @@ async function doctorCommand(options) {
     const graphPath = join9(projectRoot, ".codeconductor", "product-graph.json");
     if (existsSync3(graphPath)) {
       try {
-        const { readFile: readFile9 } = await import("node:fs/promises");
-        const raw = await readFile9(graphPath, "utf-8");
+        const { readFile: readFile10 } = await import("node:fs/promises");
+        const raw = await readFile10(graphPath, "utf-8");
         const graph = ProductGraphSchema2.parse(JSON.parse(raw));
         checks.push({
           name: "product-graph",
@@ -17284,12 +17504,12 @@ var exports_update_command = {};
 __export(exports_update_command, {
   updateCommand: () => updateCommand
 });
-import { homedir as homedir9 } from "node:os";
-import { resolve as resolve13, dirname as dirname3 } from "node:path";
-import { mkdir as mkdir6, readFile as readFile9, writeFile as writeFile4, stat as stat3 } from "node:fs/promises";
+import { homedir as homedir10 } from "node:os";
+import { resolve as resolve14, dirname as dirname4 } from "node:path";
+import { mkdir as mkdir6, readFile as readFile10, writeFile as writeFile5, stat as stat3 } from "node:fs/promises";
 async function updateCommand(options) {
   const { dryRun, force, global: isGlobal, output, projectRoot } = options;
-  const basePath = isGlobal ? homedir9() : projectRoot;
+  const basePath = isGlobal ? homedir10() : projectRoot;
   try {
     const configResult = await loadConfig(basePath);
     if (!configResult.success) {
@@ -17351,23 +17571,23 @@ async function updateCommand(options) {
     }
     const updated = [];
     if (updateResults.council) {
-      const localCouncil = resolve13(basePath, ".codeconductor", "presets", "council.yml");
-      const bundledCouncil = resolve13(SRC_PRESETS_DIR, "council", "council.yml");
+      const localCouncil = resolve14(basePath, ".codeconductor", "presets", "council.yml");
+      const bundledCouncil = resolve14(SRC_PRESETS_DIR, "council", "council.yml");
       try {
-        const content = await readFile9(bundledCouncil, "utf-8");
-        await mkdir6(dirname3(localCouncil), { recursive: true });
-        await writeFile4(localCouncil, content, "utf-8");
+        const content = await readFile10(bundledCouncil, "utf-8");
+        await mkdir6(dirname4(localCouncil), { recursive: true });
+        await writeFile5(localCouncil, content, "utf-8");
         updated.push(localCouncil);
       } catch (e) {
         throw new Error(`Failed to update council.yml: ${e}`);
       }
     }
     if (updateResults.policy) {
-      const localPolicy = resolve13(basePath, ".codeconductor", "presets", "policy.yml");
+      const localPolicy = resolve14(basePath, ".codeconductor", "presets", "policy.yml");
       try {
-        const content = await readFile9(POLICY_PATH, "utf-8");
-        await mkdir6(dirname3(localPolicy), { recursive: true });
-        await writeFile4(localPolicy, content, "utf-8");
+        const content = await readFile10(POLICY_PATH, "utf-8");
+        await mkdir6(dirname4(localPolicy), { recursive: true });
+        await writeFile5(localPolicy, content, "utf-8");
         updated.push(localPolicy);
       } catch (e) {
         throw new Error(`Failed to update policy.yml: ${e}`);
@@ -17416,10 +17636,10 @@ async function updateCommand(options) {
             if (installer) {
               const generatedFiles = await installer.generate();
               const isAgyGlobal = (targetName === "agy" || targetName === "gemini") && isGlobal;
-              const targetBase = isAgyGlobal ? resolve13(homedir9(), ".gemini", "config") : basePath;
+              const targetBase = isAgyGlobal ? resolve14(homedir10(), ".gemini", "config") : basePath;
               const resolvedFiles = generatedFiles.map((f) => ({
                 ...f,
-                path: resolve13(targetBase, isAgyGlobal ? f.path.replace(/^\.agents\/?/, "") : f.path)
+                path: resolve14(targetBase, isAgyGlobal ? f.path.replace(/^\.agents\/?/, "") : f.path)
               }));
               const filesToWrite = resolvedFiles.filter((f) => t.files.includes(f.path));
               if (filesToWrite.length > 0) {
@@ -17446,19 +17666,19 @@ async function updateCommand(options) {
       for (const s of updateResults.skills) {
         newSkillsLock[s.id] = s.latestVersion;
       }
-      let lockDest = resolve13(basePath, ".codeconductor", "skills-lock.json");
+      let lockDest = resolve14(basePath, ".codeconductor", "skills-lock.json");
       try {
-        const statAgents = await stat3(resolve13(basePath, ".agents"));
+        const statAgents = await stat3(resolve14(basePath, ".agents"));
         if (statAgents.isDirectory()) {
-          const statCodeConductor = await stat3(resolve13(basePath, ".codeconductor")).catch(() => null);
+          const statCodeConductor = await stat3(resolve14(basePath, ".codeconductor")).catch(() => null);
           if (!statCodeConductor) {
-            lockDest = resolve13(basePath, ".agents", "skills-lock.json");
+            lockDest = resolve14(basePath, ".agents", "skills-lock.json");
           }
         }
       } catch {}
       try {
-        await mkdir6(dirname3(lockDest), { recursive: true });
-        await writeFile4(lockDest, JSON.stringify(newSkillsLock, null, 2), "utf-8");
+        await mkdir6(dirname4(lockDest), { recursive: true });
+        await writeFile5(lockDest, JSON.stringify(newSkillsLock, null, 2), "utf-8");
         updated.push(lockDest);
       } catch (e) {
         throw new Error(`Failed to write skills-lock.json: ${e}`);
@@ -17504,8 +17724,38 @@ function recommendAskFlow(problem) {
     const flow = catalog.get(command);
     return { command: flow.command, slash: flow.slash, reason };
   };
-  if (includesAny(text, ["openspec", "backlog", "tracer bullet", "bc-"])) {
-    return pick("openspec", "The request names OpenSpec, BACKLOG, or a BC-xxx item, so /cc:openspec is the delivery loop.");
+  if (includesAny(text, ["bc-", "tracer bullet", "openspec plan", "openspec next"]) || text.includes("deliver") && includesAny(text, ["backlog", "openspec", "bc-"])) {
+    return pick("openspec", "The request names OpenSpec delivery, a tracer bullet, or a BC-xxx item, so /cc:openspec is the delivery loop.");
+  }
+  if (includesAny(text, [
+    "create backlog",
+    "write backlog",
+    "add to backlog",
+    "append to backlog",
+    "new backlog",
+    "author backlog",
+    "add a backlog",
+    "add backlog"
+  ]) || text.includes("backlog") && includesAny(text, ["create", "write", "append", "objetivo", "objective", "objectives"])) {
+    return pick("backlog", "The request is to create or append BACKLOG.md, so /cc:backlog is the authoring loop.");
+  }
+  if (includesAny(text, ["openspec", "backlog"])) {
+    return pick("openspec", "The request names OpenSpec or BACKLOG without authoring verbs, so /cc:openspec is the delivery loop.");
+  }
+  if (includesAny(text, [
+    "/cc-security",
+    "/cc:security",
+    "authorized security",
+    "vulnerability assessment",
+    "vuln assessment",
+    "threat hunting",
+    "incident response",
+    "penetration test",
+    "pentest",
+    "purple team",
+    "security hardening"
+  ])) {
+    return pick("security", "The request is authorized defensive security work, so /cc:security is the fit.");
   }
   if (includesAny(text, [
     "tdd",
@@ -17576,10 +17826,20 @@ var init_recommend_flow = __esm(() => {
       slash: "/cc:tdd-cycle",
       blurb: "one red-green-refactor cycle starting from a failing test"
     },
+    {
+      command: "backlog",
+      slash: "/cc:backlog",
+      blurb: "create or append BACKLOG.md items and OpenSpec change folders"
+    },
     {
       command: "openspec",
       slash: "/cc:openspec",
       blurb: "deliver a BACKLOG.md / OpenSpec tracer bullet"
+    },
+    {
+      command: "security",
+      slash: "/cc:security",
+      blurb: "authorized defensive security work with an authorization gate"
     }
   ];
 });
@@ -17766,7 +18026,7 @@ var exports_debt_harvest_command = {};
 __export(exports_debt_harvest_command, {
   debtHarvestCommand: () => debtHarvestCommand
 });
-import { readdir as readdir4, readFile as readFile10, writeFile as writeFile5, mkdir as mkdir7 } from "node:fs/promises";
+import { readdir as readdir4, readFile as readFile11, writeFile as writeFile6, mkdir as mkdir7 } from "node:fs/promises";
 import { join as join11, relative as relative4, extname } from "node:path";
 async function walkDir(dir, extensions) {
   const results = [];
@@ -17844,7 +18104,7 @@ async function debtHarvestCommand(options) {
     const files = await walkDir(targetDir, SOURCE_EXTENSIONS);
     const allEntries = [];
     for (const file of files) {
-      const content = await readFile10(file, "utf-8");
+      const content = await readFile11(file, "utf-8");
       const entries = extractDefers(content, relative4(projectRoot, file));
       allEntries.push(...entries);
     }
@@ -17852,7 +18112,7 @@ async function debtHarvestCommand(options) {
     await mkdir7(ledgerDir, { recursive: true });
     const ledgerPath = join11(ledgerDir, "debt-ledger.md");
     const ledgerContent = renderLedger(allEntries);
-    await writeFile5(ledgerPath, ledgerContent, "utf-8");
+    await writeFile6(ledgerPath, ledgerContent, "utf-8");
     if (output === "json") {
       return {
         code: 0,
@@ -18322,11 +18582,11 @@ __export(exports_graph_store, {
   findPath: () => findPath,
   countByType: () => countByType
 });
-import { mkdir as mkdir8, readFile as readFile11, writeFile as writeFile6 } from "node:fs/promises";
-import { dirname as dirname4 } from "node:path";
+import { mkdir as mkdir8, readFile as readFile12, writeFile as writeFile7 } from "node:fs/promises";
+import { dirname as dirname5 } from "node:path";
 async function loadGraph(projectRoot) {
   try {
-    const raw = await readFile11(productGraphPath(projectRoot), "utf-8");
+    const raw = await readFile12(productGraphPath(projectRoot), "utf-8");
     return ok(ProductGraphSchema.parse(JSON.parse(raw)));
   } catch (e) {
     if (e.code === "ENOENT") {
@@ -18339,8 +18599,8 @@ async function saveGraph(projectRoot, graph) {
   try {
     const validated = ProductGraphSchema.parse(graph);
     const path = productGraphPath(projectRoot);
-    await mkdir8(dirname4(path), { recursive: true });
-    await writeFile6(path, JSON.stringify(validated, null, 2), "utf-8");
+    await mkdir8(dirname5(path), { recursive: true });
+    await writeFile7(path, JSON.stringify(validated, null, 2), "utf-8");
     return ok(undefined);
   } catch (e) {
     return err(e instanceof Error ? e : new Error(String(e)));
@@ -18507,8 +18767,8 @@ __export(exports_goal_state, {
   markTaskBlocked: () => markTaskBlocked,
   loadGoal: () => loadGoal
 });
-import { mkdir as mkdir9, readFile as readFile12, writeFile as writeFile7 } from "node:fs/promises";
-import { resolve as resolve14 } from "node:path";
+import { mkdir as mkdir9, readFile as readFile13, writeFile as writeFile8 } from "node:fs/promises";
+import { resolve as resolve15 } from "node:path";
 function validateGoalGraph2(graph) {
   const ids = new Set(graph.tasks.map((t) => t.id));
   if (ids.size !== graph.tasks.length) {
@@ -18551,16 +18811,16 @@ async function writeGoal(projectRoot, graph) {
   const validation = validateGoalGraph2(graph);
   if (!validation.success)
     return validation;
-  const dir = resolve14(projectRoot, ".codeconductor");
+  const dir = resolve15(projectRoot, ".codeconductor");
   await mkdir9(dir, { recursive: true });
   const yaml = $stringify(graph);
-  await writeFile7(resolve14(dir, "current-goal.yml"), yaml, "utf-8");
+  await writeFile8(resolve15(dir, "current-goal.yml"), yaml, "utf-8");
   return ok(undefined);
 }
 async function loadGoal(projectRoot) {
   try {
-    const filePath = resolve14(projectRoot, GOAL_FILE);
-    const content = await readFile12(filePath, "utf-8");
+    const filePath = resolve15(projectRoot, GOAL_FILE);
+    const content = await readFile13(filePath, "utf-8");
     const data = $parse(content);
     const validated = GoalGraphSchema.parse(data);
     return validateGoalGraph2(validated);
@@ -18722,8 +18982,8 @@ var init_goal_command = __esm(() => {
 });
 
 // src/core/openspec/backlog-parser.ts
-import { readFile as readFile13 } from "node:fs/promises";
-import { resolve as resolve15 } from "node:path";
+import { readFile as readFile14 } from "node:fs/promises";
+import { resolve as resolve16 } from "node:path";
 function parseBool(value) {
   const v = value.trim().toLowerCase();
   return v === "yes" || v === "true";
@@ -18897,8 +19157,8 @@ function parseBacklogMarkdown(content) {
 }
 async function loadBacklog(projectRoot) {
   try {
-    const filePath = resolve15(projectRoot, BACKLOG_FILE);
-    const content = await readFile13(filePath, "utf-8");
+    const filePath = resolve16(projectRoot, BACKLOG_FILE);
+    const content = await readFile14(filePath, "utf-8");
     return parseBacklogMarkdown(content);
   } catch (e) {
     return err(e instanceof Error ? e : new Error(String(e)));
@@ -18947,11 +19207,11 @@ function slugify(text) {
 }
 
 // src/core/knowledge/source-parsers.ts
-import { readFile as readFile14 } from "node:fs/promises";
+import { readFile as readFile15 } from "node:fs/promises";
 import { join as join13 } from "node:path";
 async function parseAdrFile(filePath) {
   try {
-    const content = await readFile14(filePath, "utf-8");
+    const content = await readFile15(filePath, "utf-8");
     const basename3 = filePath.split("/").pop() ?? "";
     const idMatch = basename3.match(/adr-(\d+)/i);
     const id = idMatch ? `adr-${idMatch[1]}` : slugify(basename3);
@@ -19000,7 +19260,7 @@ function adrToEntities(adr, source) {
 }
 async function parseReadmeEntities(projectRoot, productName) {
   try {
-    const content = await readFile14(join13(projectRoot, "README.md"), "utf-8");
+    const content = await readFile15(join13(projectRoot, "README.md"), "utf-8");
     const firstPara = content.split(`
 
 `).find((p) => p.trim() && !p.startsWith("#") && !p.startsWith(">")) ?? "";
@@ -19021,7 +19281,7 @@ async function parseReadmeEntities(projectRoot, productName) {
 }
 async function parseGraphifyEntities(projectRoot) {
   try {
-    const raw = await readFile14(join13(projectRoot, "graphify-out", "graph.json"), "utf-8");
+    const raw = await readFile15(join13(projectRoot, "graphify-out", "graph.json"), "utf-8");
     const graph = JSON.parse(raw);
     const entities = [];
     for (const node2 of graph.nodes ?? []) {
@@ -19077,8 +19337,8 @@ async function scanSrcComponents(projectRoot) {
 var init_source_parsers = () => {};
 
 // src/core/memory/episodic-store.ts
-import { appendFile, mkdir as mkdir10, readFile as readFile15 } from "node:fs/promises";
-import { resolve as resolve16 } from "node:path";
+import { appendFile, mkdir as mkdir10, readFile as readFile16 } from "node:fs/promises";
+import { resolve as resolve17 } from "node:path";
 async function appendEvent(projectRoot, event) {
   try {
     const full = ProductEventSchema.parse({
@@ -19086,7 +19346,7 @@ async function appendEvent(projectRoot, event) {
       id: event.id ?? `evt-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
     });
     const path = eventsPath(projectRoot);
-    await mkdir10(resolve16(projectRoot, ".codeconductor"), { recursive: true });
+    await mkdir10(resolve17(projectRoot, ".codeconductor"), { recursive: true });
     await appendFile(path, JSON.stringify(full) + `
 `, "utf-8");
     return ok(full);
@@ -19096,7 +19356,7 @@ async function appendEvent(projectRoot, event) {
 }
 async function listEvents(projectRoot, since, type) {
   try {
-    const content = await readFile15(eventsPath(projectRoot), "utf-8");
+    const content = await readFile16(eventsPath(projectRoot), "utf-8");
     const events = [];
     for (const line of content.split(`
 `)) {
@@ -19124,9 +19384,9 @@ var init_episodic_store = __esm(() => {
 
 // src/core/knowledge/ingest-pipeline.ts
 import { createHash as createHash2 } from "node:crypto";
-import { readFile as readFile16 } from "node:fs/promises";
+import { readFile as readFile17 } from "node:fs/promises";
 import { join as join14 } from "node:path";
-import { mkdir as mkdir11, writeFile as writeFile8 } from "node:fs/promises";
+import { mkdir as mkdir11, writeFile as writeFile9 } from "node:fs/promises";
 async function mapLimit(items, limit, fn) {
   if (items.length === 0)
     return [];
@@ -19146,7 +19406,7 @@ async function mapLimit(items, limit, fn) {
 }
 async function hashFile(path) {
   try {
-    const content = await readFile16(path, "utf-8");
+    const content = await readFile17(path, "utf-8");
     return createHash2("sha256").update(content).digest("hex").slice(0, 16);
   } catch {
     return null;
@@ -19173,7 +19433,7 @@ async function collectDeferRisks(projectRoot) {
   await walk(join14(projectRoot, "src"));
   const perFile = await mapLimit(files, WALK_READ_CONCURRENCY, async (full) => {
     const entities = [];
-    const content = await readFile16(full, "utf-8");
+    const content = await readFile17(full, "utf-8");
     const rel = full.replace(projectRoot + "/", "");
     const deferRe = new RegExp(DEFER_REGEX_SOURCE, "gm");
     let match;
@@ -19341,7 +19601,7 @@ async function runIngest(projectRoot, productName) {
     sourceHashes
   };
   await mkdir11(join14(projectRoot, ".codeconductor"), { recursive: true });
-  await writeFile8(productMetaPath(projectRoot), JSON.stringify(ProductMetaSchema.parse(meta), null, 2), "utf-8");
+  await writeFile9(productMetaPath(projectRoot), JSON.stringify(ProductMetaSchema.parse(meta), null, 2), "utf-8");
   await appendEvent(projectRoot, {
     type: "ingest.completed",
     timestamp: new Date().toISOString(),
@@ -19422,11 +19682,11 @@ var init_ingest_command = __esm(() => {
 });
 
 // src/core/memory/operational-state.ts
-import { mkdir as mkdir12, readFile as readFile17, writeFile as writeFile9 } from "node:fs/promises";
-import { resolve as resolve17 } from "node:path";
+import { mkdir as mkdir12, readFile as readFile18, writeFile as writeFile10 } from "node:fs/promises";
+import { resolve as resolve18 } from "node:path";
 async function loadOperationalState(projectRoot) {
   try {
-    const raw = await readFile17(operationalStatePath(projectRoot), "utf-8");
+    const raw = await readFile18(operationalStatePath(projectRoot), "utf-8");
     return ok(OperationalStateSchema.parse(JSON.parse(raw)));
   } catch (e) {
     if (e.code === "ENOENT") {
@@ -19448,8 +19708,8 @@ async function saveOperationalState(projectRoot, state) {
       updatedAt: new Date().toISOString()
     });
     const path = operationalStatePath(projectRoot);
-    await mkdir12(resolve17(projectRoot, ".codeconductor"), { recursive: true });
-    await writeFile9(path, JSON.stringify(validated, null, 2), "utf-8");
+    await mkdir12(resolve18(projectRoot, ".codeconductor"), { recursive: true });
+    await writeFile10(path, JSON.stringify(validated, null, 2), "utf-8");
     return ok(undefined);
   } catch (e) {
     return err(e instanceof Error ? e : new Error(String(e)));
@@ -19483,11 +19743,11 @@ var init_operational_state = __esm(() => {
 });
 
 // src/core/memory/strategic-memory.ts
-import { mkdir as mkdir13, readFile as readFile18, writeFile as writeFile10 } from "node:fs/promises";
-import { resolve as resolve18 } from "node:path";
+import { mkdir as mkdir13, readFile as readFile19, writeFile as writeFile11 } from "node:fs/promises";
+import { resolve as resolve19 } from "node:path";
 async function loadStrategicMemory(projectRoot) {
   try {
-    const raw = await readFile18(strategicPath(projectRoot), "utf-8");
+    const raw = await readFile19(strategicPath(projectRoot), "utf-8");
     return ok(StrategicMemorySchema.parse(JSON.parse(raw)));
   } catch (e) {
     if (e.code === "ENOENT") {
@@ -19508,8 +19768,8 @@ async function saveStrategicMemory(projectRoot, memory) {
       updatedAt: new Date().toISOString()
     });
     const path = strategicPath(projectRoot);
-    await mkdir13(resolve18(projectRoot, ".codeconductor"), { recursive: true });
-    await writeFile10(path, JSON.stringify(validated, null, 2), "utf-8");
+    await mkdir13(resolve19(projectRoot, ".codeconductor"), { recursive: true });
+    await writeFile11(path, JSON.stringify(validated, null, 2), "utf-8");
     return ok(undefined);
   } catch (e) {
     return err(e instanceof Error ? e : new Error(String(e)));
@@ -19521,8 +19781,8 @@ var init_strategic_memory = __esm(() => {
 });
 
 // src/core/memory/memory-index.ts
-import { mkdir as mkdir14, readFile as readFile19, writeFile as writeFile11 } from "node:fs/promises";
-import { resolve as resolve19 } from "node:path";
+import { mkdir as mkdir14, readFile as readFile20, writeFile as writeFile12 } from "node:fs/promises";
+import { resolve as resolve20 } from "node:path";
 function parseMarkdown(content) {
   const startIdx = content.indexOf(SENTINEL_START);
   const endIdx = content.indexOf(SENTINEL_END);
@@ -19541,8 +19801,8 @@ function parseMarkdown(content) {
 }
 async function loadMemoryIndex(projectRoot) {
   try {
-    const filePath = resolve19(projectRoot, MEMORY_FILE);
-    const content = await readFile19(filePath, "utf-8");
+    const filePath = resolve20(projectRoot, MEMORY_FILE);
+    const content = await readFile20(filePath, "utf-8");
     const parsed = parseMarkdown(content);
     if (!parsed) {
       return err(new Error("Failed to parse memory index from memory.md"));
@@ -19559,28 +19819,28 @@ var init_memory_index = __esm(() => {
 });
 
 // src/core/evaluation/outcome-store.ts
-import { appendFile as appendFile2, mkdir as mkdir15, readFile as readFile20, writeFile as writeFile12 } from "node:fs/promises";
-import { resolve as resolve20 } from "node:path";
+import { appendFile as appendFile2, mkdir as mkdir15, readFile as readFile21, writeFile as writeFile13 } from "node:fs/promises";
+import { resolve as resolve21 } from "node:path";
 async function ensureEvaluationDir(projectRoot) {
-  const dir = resolve20(projectRoot, EVAL_DIR);
+  const dir = resolve21(projectRoot, EVAL_DIR);
   await mkdir15(dir, { recursive: true });
-  await mkdir15(resolve20(dir, SCORECARDS_DIR), { recursive: true });
+  await mkdir15(resolve21(dir, SCORECARDS_DIR), { recursive: true });
   return dir;
 }
 async function appendOutcome(projectRoot, outcome) {
   try {
     const dir = await ensureEvaluationDir(projectRoot);
     const validated = TaskOutcomeSchema.parse(outcome);
-    await appendFile2(resolve20(dir, OUTCOMES_FILE), JSON.stringify(validated) + `
+    await appendFile2(resolve21(dir, OUTCOMES_FILE), JSON.stringify(validated) + `
 `, "utf-8");
-    const indexPath = resolve20(dir, INDEX_FILE);
+    const indexPath = resolve21(dir, INDEX_FILE);
     let index = { version: 1, lastOutcomeId: validated.id };
     try {
-      const raw = await readFile20(indexPath, "utf-8");
+      const raw = await readFile21(indexPath, "utf-8");
       index = EvaluationIndexSchema.parse(JSON.parse(raw));
       index.lastOutcomeId = validated.id;
     } catch {}
-    await writeFile12(indexPath, JSON.stringify(index, null, 2), "utf-8");
+    await writeFile13(indexPath, JSON.stringify(index, null, 2), "utf-8");
     return ok(undefined);
   } catch (e) {
     return err(e instanceof Error ? e : new Error(String(e)));
@@ -19588,8 +19848,8 @@ async function appendOutcome(projectRoot, outcome) {
 }
 async function listOutcomes(projectRoot, filter = {}) {
   try {
-    const path = resolve20(projectRoot, EVAL_DIR, OUTCOMES_FILE);
-    const content = await readFile20(path, "utf-8");
+    const path = resolve21(projectRoot, EVAL_DIR, OUTCOMES_FILE);
+    const content = await readFile21(path, "utf-8");
     const lines = content.split(`
 `).filter((l) => l.trim().length > 0);
     const outcomes = [];
@@ -19607,6 +19867,12 @@ async function listOutcomes(projectRoot, filter = {}) {
         continue;
       if (filter.since && parsed.timestamp < filter.since)
         continue;
+      if (filter.experimentId && parsed.experimentId !== filter.experimentId)
+        continue;
+      if (filter.variantId && parsed.variantId !== filter.variantId)
+        continue;
+      if (filter.suiteTaskId && parsed.suiteTaskId !== filter.suiteTaskId)
+        continue;
       outcomes.push(parsed);
     }
     return ok(outcomes);
@@ -19621,8 +19887,8 @@ async function saveScorecard(projectRoot, record) {
   try {
     const dir = await ensureEvaluationDir(projectRoot);
     const validated = ScorecardRecordSchema.parse(record);
-    const filePath = resolve20(dir, SCORECARDS_DIR, `${validated.id}.json`);
-    await writeFile12(filePath, JSON.stringify(validated, null, 2), "utf-8");
+    const filePath = resolve21(dir, SCORECARDS_DIR, `${validated.id}.json`);
+    await writeFile13(filePath, JSON.stringify(validated, null, 2), "utf-8");
     return ok(filePath);
   } catch (e) {
     return err(e instanceof Error ? e : new Error(String(e)));
@@ -19630,8 +19896,8 @@ async function saveScorecard(projectRoot, record) {
 }
 async function loadScorecard(projectRoot, id) {
   try {
-    const filePath = resolve20(projectRoot, EVAL_DIR, SCORECARDS_DIR, `${id}.json`);
-    const content = await readFile20(filePath, "utf-8");
+    const filePath = resolve21(projectRoot, EVAL_DIR, SCORECARDS_DIR, `${id}.json`);
+    const content = await readFile21(filePath, "utf-8");
     return ok(ScorecardRecordSchema.parse(JSON.parse(content)));
   } catch (e) {
     return err(e instanceof Error ? e : new Error(String(e)));
@@ -19643,10 +19909,12 @@ function aggregateOutcomes(outcomes) {
   const avgWeightedScore = withScore.length > 0 ? withScore.reduce((s, o) => s + (o.weightedScore ?? 0), 0) / withScore.length : 0;
   const byAgent = {};
   const byModel = {};
+  const byVariant = {};
   const agentScoreCounts = {};
   const modelScoreCounts = {};
   const modelCostCounts = {};
   const modelTokenCounts = {};
+  const variantScoreCounts = {};
   for (const o of outcomes) {
     if (!byAgent[o.agent])
       byAgent[o.agent] = { count: 0, avgScore: 0 };
@@ -19671,6 +19939,15 @@ function aggregateOutcomes(outcomes) {
       byModel[o.model].avgTokens = (byModel[o.model].avgTokens ?? 0) + tokens;
       modelTokenCounts[o.model] = (modelTokenCounts[o.model] ?? 0) + 1;
     }
+    if (o.variantId) {
+      if (!byVariant[o.variantId])
+        byVariant[o.variantId] = { count: 0, avgScore: 0 };
+      byVariant[o.variantId].count++;
+      if (o.weightedScore !== undefined) {
+        byVariant[o.variantId].avgScore += o.weightedScore;
+        variantScoreCounts[o.variantId] = (variantScoreCounts[o.variantId] ?? 0) + 1;
+      }
+    }
   }
   for (const agent of Object.keys(byAgent)) {
     const entry = byAgent[agent];
@@ -19686,12 +19963,18 @@ function aggregateOutcomes(outcomes) {
     if (entry.avgTokens !== undefined)
       entry.avgTokens /= modelTokenCounts[model];
   }
+  for (const variant of Object.keys(byVariant)) {
+    const entry = byVariant[variant];
+    const scoreCount = variantScoreCounts[variant] ?? 0;
+    entry.avgScore = scoreCount > 0 ? entry.avgScore / scoreCount : 0;
+  }
   return {
     total: outcomes.length,
     passRate: outcomes.length > 0 ? passed.length / outcomes.length : 0,
     avgWeightedScore: Math.round(avgWeightedScore * 1000) / 1000,
     byAgent,
-    byModel
+    byModel,
+    byVariant
   };
 }
 function generateEvalId(prefix) {
@@ -19705,11 +19988,11 @@ var init_outcome_store = __esm(() => {
 });
 
 // src/core/feedback/feedback-ingestor.ts
-import { readFile as readFile21 } from "node:fs/promises";
+import { readFile as readFile22 } from "node:fs/promises";
 import { join as join15 } from "node:path";
 async function parseChangelogLearnings(projectRoot) {
   try {
-    const content = await readFile21(join15(projectRoot, "CHANGELOG.md"), "utf-8");
+    const content = await readFile22(join15(projectRoot, "CHANGELOG.md"), "utf-8");
     const unreleased = content.match(/## \[Unreleased\]([\s\S]*?)(?=## \[|\n## )/i);
     if (!unreleased)
       return [];
@@ -19743,6 +20026,15 @@ async function generateInsights(projectRoot) {
         });
       }
     }
+    const tagged = outcomes.data.filter((o) => o.experimentId && o.variantId);
+    if (tagged.length > 0) {
+      const experiments = new Set(tagged.map((o) => o.experimentId));
+      insights.push({
+        type: "harness_ablation",
+        message: `${experiments.size} harness experiment(s), ${tagged.length} tagged outcomes`,
+        confidence: "medium"
+      });
+    }
   }
   const learnings = await parseChangelogLearnings(projectRoot);
   for (const learning of learnings.slice(0, 5)) {
@@ -19820,7 +20112,7 @@ var exports_product_command = {};
 __export(exports_product_command, {
   productCommand: () => productCommand
 });
-import { writeFile as writeFile13 } from "node:fs/promises";
+import { writeFile as writeFile14 } from "node:fs/promises";
 async function productCommand(options) {
   const { subcommand, projectRoot, output, query, from, to, since, format } = options;
   try {
@@ -20023,7 +20315,7 @@ async function handleExport(projectRoot, format, output) {
     ...queryNodes(graph.data, "risk").map((n) => `- ${n.name}`)
   ].join(`
 `);
-  await writeFile13(productReportPath(projectRoot), md, "utf-8");
+  await writeFile14(productReportPath(projectRoot), md, "utf-8");
   return {
     code: 0,
     data: {
@@ -20226,8 +20518,8 @@ async function runCompileCheck(options) {
   })();
   collectOutput.catch(() => {});
   let timeoutId;
-  const timeout = new Promise((resolve21) => {
-    timeoutId = setTimeout(() => resolve21("timeout"), timeoutMs);
+  const timeout = new Promise((resolve22) => {
+    timeoutId = setTimeout(() => resolve22("timeout"), timeoutMs);
   });
   try {
     const outcome = await Promise.race([collectOutput, timeout]);
@@ -20297,9 +20589,9 @@ var init_compile_checker = __esm(() => {
 
 // src/core/verification/verification-runner.ts
 import { existsSync as existsSync3 } from "node:fs";
-import { readFile as readFile22 } from "node:fs/promises";
-import { dirname as dirname5, join as join16, resolve as resolve21 } from "node:path";
-import { mkdir as mkdir16, readdir as readdir5, writeFile as writeFile14 } from "node:fs/promises";
+import { readFile as readFile23 } from "node:fs/promises";
+import { dirname as dirname6, join as join16, resolve as resolve22 } from "node:path";
+import { mkdir as mkdir16, readdir as readdir5, writeFile as writeFile15 } from "node:fs/promises";
 function isPassingEvidence(ev) {
   switch (ev.type) {
     case "verification":
@@ -20317,8 +20609,8 @@ function isPassingEvidence(ev) {
   }
 }
 function evidenceFilePath(evDir, id) {
-  const path = resolve21(evDir, `${id.replace(/[^A-Za-z0-9_-]/g, "_")}.json`);
-  if (dirname5(path) !== resolve21(evDir)) {
+  const path = resolve22(evDir, `${id.replace(/[^A-Za-z0-9_-]/g, "_")}.json`);
+  if (dirname6(path) !== resolve22(evDir)) {
     return err(new Error(`Refusing to write evidence for "${id}" outside ${evDir}`));
   }
   return ok(path);
@@ -20330,7 +20622,7 @@ async function persistEvidence(projectRoot, evidence) {
     return evidencePath;
   try {
     await mkdir16(evDir, { recursive: true });
-    await writeFile14(evidencePath.data, JSON.stringify(evidence, null, 2), "utf-8");
+    await writeFile15(evidencePath.data, JSON.stringify(evidence, null, 2), "utf-8");
   } catch (e) {
     return err(e instanceof Error ? e : new Error(String(e)));
   }
@@ -20352,7 +20644,7 @@ async function collectTaskEvidence(projectRoot, taskId) {
     if (!file.endsWith(".json"))
       continue;
     try {
-      const raw = await readFile22(join16(evDir, file), "utf-8");
+      const raw = await readFile23(join16(evDir, file), "utf-8");
       const ev = EvidenceSchema.parse(JSON.parse(raw));
       if (ev.relatedTask === taskId)
         records.push(ev);
@@ -20556,7 +20848,8 @@ function goalTaskToCanonicalCard(task, objective) {
     evidenceRequired: task.evidenceRequired ?? ["acceptance_criteria_met"],
     status: task.status === "in-progress" ? "in-progress" : task.status === "done" ? "done" : task.status === "blocked" ? "blocked" : "ready",
     type: task.type,
-    linkedCapabilities: []
+    linkedCapabilities: [],
+    boundaries: []
   };
 }
 function buildTaskEnvelope(card, projectRoot, projectName) {
@@ -20987,6 +21280,8 @@ async function runLoop(generateFn, compileCheckFn, config = {}, taskTitle = "com
   let state = createInitialState({ maxIterations, maxTokenBudget });
   let totalErrors = 0;
   let feedbackText;
+  let compileCheck;
+  let compileCheckSkipReason;
   logTransition(state.phase, "INIT", state.iteration);
   const startResult = loopStateMachine(state, { type: "START" });
   state = startResult.state;
@@ -21022,6 +21317,12 @@ async function runLoop(generateFn, compileCheckFn, config = {}, taskTitle = "com
         logTransition(state.phase, "COMPILE_CHECK", state.iteration);
         const compileResult = await compileCheckFn();
         totalErrors += compileResult.errors.length;
+        if (compileResult.skipped) {
+          compileCheck = "skipped";
+          compileCheckSkipReason = compileResult.skipReason;
+        } else {
+          compileCheck = "ran";
+        }
         const checkResult = loopStateMachine(state, {
           type: "COMPILE_CHECK_COMPLETED",
           errors: compileResult.errors
@@ -21045,7 +21346,9 @@ async function runLoop(generateFn, compileCheckFn, config = {}, taskTitle = "com
           iterations: state.iteration,
           totalErrors,
           finalPhase: "DONE",
-          errorHistory: state.errorHistory
+          errorHistory: state.errorHistory,
+          compileCheck,
+          compileCheckSkipReason
         };
       }
       case "ESCALATED": {
@@ -21057,7 +21360,9 @@ async function runLoop(generateFn, compileCheckFn, config = {}, taskTitle = "com
           totalErrors,
           finalPhase: "ESCALATED",
           escalationReport: report,
-          errorHistory: state.errorHistory
+          errorHistory: state.errorHistory,
+          compileCheck,
+          compileCheckSkipReason
         };
       }
       case "FAILED": {
@@ -21067,7 +21372,9 @@ async function runLoop(generateFn, compileCheckFn, config = {}, taskTitle = "com
           iterations: state.iteration,
           totalErrors,
           finalPhase: "FAILED",
-          errorHistory: state.errorHistory
+          errorHistory: state.errorHistory,
+          compileCheck,
+          compileCheckSkipReason
         };
       }
       default: {
@@ -21077,7 +21384,9 @@ async function runLoop(generateFn, compileCheckFn, config = {}, taskTitle = "com
           iterations: state.iteration,
           totalErrors,
           finalPhase: state.phase,
-          errorHistory: state.errorHistory
+          errorHistory: state.errorHistory,
+          compileCheck,
+          compileCheckSkipReason
         };
       }
     }
@@ -21134,6 +21443,15 @@ function buildEscalationReport(taskTitle, state, originalTask) {
     recommendedAction
   };
 }
+function skippedCompileResult(reason) {
+  return {
+    ...CLEAN_COMPILE,
+    skipped: true,
+    skipReason: reason,
+    stderr: `compileCheck: skipped
+${reason}`
+  };
+}
 function shouldRunAgentLoop(type, agentType, phase) {
   if (phase === "implement" || phase === "test")
     return true;
@@ -21146,11 +21464,13 @@ async function runLoopForProject(projectRoot, options) {
   const loopCfg = configResult.success ? configResult.data.loop : undefined;
   const compileCheck = configResult.success ? configResult.data.safety.compileCheck : undefined;
   const compileCheckFn = async () => {
-    if (!compileCheck?.enabled || !compileCheck.command)
-      return CLEAN_COMPILE;
+    if (!compileCheck?.enabled || !compileCheck.command) {
+      return skippedCompileResult(!compileCheck?.enabled ? "Compile check is not enabled in config." : "Compile check is enabled but no command is configured.");
+    }
     const allowed = options.allowCompileCheck === true || isAllowlistedCompileCommand(compileCheck.command);
-    if (!allowed)
-      return CLEAN_COMPILE;
+    if (!allowed) {
+      return skippedCompileResult("Compile check not executed: the command is not on the compile allowlist. " + "Re-run with --allow-compile-check to trust it.");
+    }
     const result = await runCompileCheck({
       command: compileCheck.command,
       cwd: projectRoot,
@@ -21737,10 +22057,15 @@ var init_prompt_compiler = __esm(() => {
   "needsConfirmation": true
 }`,
     "council-verdict": `{
-  "status": "APPROVED" | "BLOCKED",
-  "confidence": 0.0,
+  "status": "APPROVED" | "REJECTED" | "ESCALATED",
+  "totalAgents": 0,
+  "approvedCount": 0,
+  "rejectedCount": 0,
+  "abstainedCount": 0,
+  "vetoApplied": false,
   "findings": [],
-  "next_actions": []
+  "summary": "",
+  "individualVerdicts": []
 }`,
     "technical-plan": '{ "approach": "", "filesAffected": [], "risks": [] }',
     "fix-intake-output": '{ "actualBehavior": "", "expectedBehavior": "", "reproductionSteps": [] }',
@@ -21784,7 +22109,14 @@ function resolveOutputSchemaName(schemaName, role) {
 }
 function validateAgentOutputBySchema(schemaName, data, role) {
   const resolved = resolveOutputSchemaName(schemaName, role);
-  const schema = SCHEMA_REGISTRY[resolved] ?? AgentOutputSchema;
+  const schema = SCHEMA_REGISTRY[resolved];
+  if (!schema) {
+    return {
+      valid: false,
+      schema: resolved,
+      errors: [`Unknown output schema: ${resolved}`]
+    };
+  }
   const parsed = schema.safeParse(data);
   if (parsed.success) {
     return { valid: true, schema: resolved, data: parsed.data };
@@ -21843,8 +22175,14 @@ var init_output_validator = __esm(() => {
     "review-report": ReviewerOutputSchema,
     "technical-plan": TechnicalPlanOutputSchema,
     "fix-intake-output": AgentOutputSchema,
-    "council-verdict": AgentOutputSchema,
-    "agent-output": AgentOutputSchema
+    "council-verdict": CouncilVerdictSchema,
+    "agent-output": AgentOutputSchema,
+    taskcard: CanonicalTaskCardSchema,
+    "test-plan": AgentOutputSchema,
+    "complexity-audit": AgentOutputSchema,
+    "api-contract": AgentOutputSchema,
+    "pagespeed-report": AgentOutputSchema,
+    "scorecard-record": ScorecardRecordSchema
   };
 });
 
@@ -21917,6 +22255,7 @@ var init_command_parser = __esm(() => {
     "db-migration": { outputFormat: "plan", needConfirmation: true, riskThreshold: "high" },
     pagespeed: { outputFormat: "verdict", needConfirmation: false, riskThreshold: "low" },
     openspec: { outputFormat: "taskcard", needConfirmation: true, riskThreshold: "medium" },
+    backlog: { outputFormat: "taskcard", needConfirmation: true, riskThreshold: "medium" },
     scorecard: { outputFormat: "verdict", needConfirmation: false, riskThreshold: "low" },
     council: { outputFormat: "taskcard", needConfirmation: true, riskThreshold: "medium" },
     iterative: { outputFormat: "taskcard", needConfirmation: true, riskThreshold: "medium" },
@@ -21924,96 +22263,8 @@ var init_command_parser = __esm(() => {
     triage: { outputFormat: "taskcard", needConfirmation: true, riskThreshold: "medium" },
     prototype: { outputFormat: "taskcard", needConfirmation: true, riskThreshold: "medium" },
     handoff: { outputFormat: "plan", needConfirmation: false, riskThreshold: "low" },
-    clarify: { outputFormat: "plan", needConfirmation: false, riskThreshold: "low" }
-  };
-});
-
-// src/core/ccep/context-resolver.ts
-import { existsSync as existsSync5 } from "node:fs";
-import { readFile as readFile23 } from "node:fs/promises";
-import { join as join18 } from "node:path";
-async function loadProductKnowledge(projectRoot) {
-  const graphPath = productGraphPath(projectRoot);
-  if (!existsSync5(graphPath)) {
-    return {};
-  }
-  try {
-    const raw = await readFile23(graphPath, "utf-8");
-    const graph = ProductGraphSchema.parse(JSON.parse(raw));
-    return {
-      productName: graph.productName,
-      domains: queryNodes(graph, "domain").map((n) => n.name),
-      decisions: queryNodes(graph, "decision").slice(0, 10).map((n) => ({ id: n.id, name: n.name, data: n.data })),
-      risks: queryNodes(graph, "risk").slice(0, 10).map((n) => ({ id: n.id, name: n.name })),
-      requirements: queryNodes(graph, "requirement").slice(0, 10).map((n) => ({ id: n.id, name: n.name, status: n.data.status })),
-      nodeCount: graph.nodes.length
-    };
-  } catch {
-    return {};
-  }
-}
-async function resolveAstSource(projectRoot) {
-  const graphPath = productGraphPath(projectRoot);
-  if (existsSync5(graphPath)) {
-    return { source: "product-graph", confidence: "high" };
-  }
-  const graphifyPath = join18(projectRoot, "graphify-out", "graph.json");
-  if (existsSync5(graphifyPath)) {
-    return { source: "graphify", confidence: "medium" };
-  }
-  try {
-    const profile = await detectProject(projectRoot);
-    if (profile.signals.length > 0) {
-      return { source: "detect", confidence: profile.confidence };
-    }
-  } catch {}
-  return { source: "manual", confidence: "low" };
-}
-async function resolveContext(envelope, profile, projectRoot) {
-  const ast = await resolveAstSource(projectRoot);
-  const knowledge = await loadProductKnowledge(projectRoot);
-  const firstPhase = profile.phases[0];
-  let stack = envelope.repoContext.stack;
-  if (stack.length === 0 || stack.length === 1 && stack[0] === "unknown") {
-    try {
-      const detected = await detectProject(projectRoot);
-      stack = [...new Set([...detected.languages, ...detected.frameworks])];
-    } catch {
-      stack = envelope.repoContext.stack;
-    }
-  }
-  const context = {
-    envelope,
-    profile,
-    intent: {
-      type: envelope.command,
-      goal: envelope.userRequest,
-      domain: envelope.repoContext.domain
-    },
-    project: {
-      name: envelope.projectId,
-      rootDir: projectRoot,
-      stack
-    },
-    knowledge,
-    ast,
-    policies: DEFAULT_POLICIES,
-    outputSchema: firstPhase?.outputSchema ?? profile.intakeSchema ?? "agent-output"
-  };
-  return validateExecutionContext(context);
-}
-var DEFAULT_POLICIES;
-var init_context_resolver = __esm(() => {
-  init_project_detector();
-  init_schemas();
-  init_command_parser();
-  init_paths();
-  init_graph_store();
-  DEFAULT_POLICIES = {
-    architecture: "modular",
-    testing: "required",
-    documentation: "required",
-    breakingChanges: "approval"
+    clarify: { outputFormat: "plan", needConfirmation: false, riskThreshold: "low" },
+    security: { outputFormat: "taskcard", needConfirmation: true, riskThreshold: "high" }
   };
 });
 
@@ -22039,25 +22290,821 @@ var init_workflow_profile_loader = __esm(() => {
   init_profiles();
 });
 
-// src/commands/ccep.command.ts
-var exports_ccep_command = {};
-__export(exports_ccep_command, {
-  ccepCommand: () => ccepCommand
-});
-function parseWorkflowCommand(command) {
-  if (!command) {
-    return { ok: false, error: "Missing required --command flag" };
+// src/core/evaluation/harness-catalog.ts
+import { createHash as createHash3 } from "node:crypto";
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
+import { copyFile as copyFile2, mkdir as mkdir17, readFile as readFile24, readdir as readdir6, rm as rm2, writeFile as writeFile16 } from "node:fs/promises";
+import { dirname as dirname7, join as join18, resolve as resolve23 } from "node:path";
+function catalogIds(catalog = DEFAULT_HARNESS_CATALOG) {
+  return catalog.components.map((c) => c.id);
+}
+function isHarnessComponentId(value) {
+  return catalogIds().includes(value);
+}
+function parseComponentsFlag(raw, catalog = DEFAULT_HARNESS_CATALOG) {
+  if (!raw || raw.trim() === "" || raw.trim() === "all") {
+    return ok(catalogIds(catalog));
   }
-  const result = WorkflowCommandSchema.safeParse(command);
-  if (!result.success) {
-    return { ok: false, error: `Unknown workflow command: ${command}` };
+  const ids = [];
+  for (const part of raw.split(",").map((s) => s.trim()).filter(Boolean)) {
+    if (!isHarnessComponentId(part)) {
+      return err(new Error(`Unknown harness component: ${part}`));
+    }
+    ids.push(part);
   }
-  return { ok: true, command: result.data };
+  return ok(ids);
 }
-function containedContextError(contextPath) {
-  return `Could not read --context file: ${contextPath}. ` + "It must be a regular file at a relative path inside the project root.";
+function variantIdFor(component) {
+  return component ? `minus:${component}` : "baseline";
 }
-async function readContainedContext(projectRoot, contextPath) {
+function parseVariantId(variantId) {
+  if (!variantId || variantId === "baseline")
+    return [];
+  if (variantId.startsWith("minus:")) {
+    const id = variantId.slice("minus:".length);
+    return isHarnessComponentId(id) ? [id] : [];
+  }
+  return [];
+}
+function variantDirName(variantId) {
+  return variantId.replaceAll(":", "-");
+}
+function componentStates(disabled, catalog = DEFAULT_HARNESS_CATALOG) {
+  const off = new Set(disabled);
+  const states = {};
+  for (const entry of catalog.components) {
+    states[entry.id] = entry.defaultOn && !off.has(entry.id);
+  }
+  return states;
+}
+function harnessFingerprint(disabled, contractVersion, ccepProfile = "feature", catalog = DEFAULT_HARNESS_CATALOG) {
+  const states = componentStates(disabled, catalog);
+  const payload = {
+    components: Object.fromEntries(Object.entries(states).sort(([a], [b]) => a.localeCompare(b))),
+    contractVersion,
+    ccepProfile
+  };
+  return createHash3("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
+}
+async function loadHarnessCatalog(projectRoot) {
+  const overridePath = resolve23(projectRoot, EVAL_DIR2, CATALOG_FILE);
+  try {
+    const raw = await readFile24(overridePath, "utf-8");
+    return HarnessCatalogSchema.parse($parse(raw));
+  } catch {
+    return DEFAULT_HARNESS_CATALOG;
+  }
+}
+function activeOverlayPath(projectRoot) {
+  return resolve23(projectRoot, EVAL_DIR2, ACTIVE_OVERLAY_FILE);
+}
+async function readActiveOverlay(projectRoot) {
+  try {
+    const raw = await readFile24(activeOverlayPath(projectRoot), "utf-8");
+    return HarnessOverlaySchema.parse($parse(raw));
+  } catch {
+    return null;
+  }
+}
+function isProductGraphDisabled(projectRoot) {
+  try {
+    const path = activeOverlayPath(projectRoot);
+    if (!existsSync5(path))
+      return false;
+    const overlay = HarnessOverlaySchema.parse($parse(readFileSync4(path, "utf-8")));
+    return overlay.disableProductGraph === true || overlay.disabledComponents.includes("product_graph");
+  } catch {
+    return false;
+  }
+}
+function cloneProfile(profile) {
+  return structuredClone(profile);
+}
+function dropPhase(profile, phaseId) {
+  profile.routing.default = profile.routing.default.filter((id) => id !== phaseId);
+  if (profile.routing.riskRules) {
+    for (const rule of profile.routing.riskRules) {
+      rule.then = rule.then.filter((id) => id !== phaseId);
+    }
+  }
+}
+function disableGates(profile) {
+  profile.confirmationGate.stopOnHighRisk = false;
+  profile.confirmationGate.stopOnQuestions = false;
+  for (const phase of profile.phases) {
+    delete phase.stopGate;
+  }
+}
+function disableCouncilPhases(profile) {
+  for (const phaseId of ["deliberation", "council-review"]) {
+    dropPhase(profile, phaseId);
+  }
+}
+function applyCatalogToProfile(profile, disabled) {
+  const next = cloneProfile(profile);
+  for (const id of disabled) {
+    const phaseId = PHASE_BY_COMPONENT[id];
+    if (phaseId)
+      dropPhase(next, phaseId);
+    if (id === "confirmation_gates")
+      disableGates(next);
+    if (id === "council")
+      disableCouncilPhases(next);
+  }
+  return next;
+}
+async function restoreOverlayBackup(projectRoot) {
+  const backupRoot = resolve23(projectRoot, EVAL_DIR2, OVERLAY_BACKUP_DIR);
+  if (!existsSync5(backupRoot))
+    return;
+  const configBackup = join18(backupRoot, "config.yml");
+  const configDest = resolve23(projectRoot, ".codeconductor", "config.yml");
+  if (existsSync5(configBackup)) {
+    await mkdir17(dirname7(configDest), { recursive: true });
+    await copyFile2(configBackup, configDest);
+  }
+  const workflowsBackup = join18(backupRoot, "workflows");
+  const workflowsDest = resolve23(projectRoot, ".codeconductor", "workflows");
+  if (existsSync5(workflowsBackup)) {
+    await mkdir17(workflowsDest, { recursive: true });
+    const files = await readdir6(workflowsBackup);
+    for (const file of files) {
+      await copyFile2(join18(workflowsBackup, file), join18(workflowsDest, file));
+    }
+  }
+  const overlayBackup = join18(backupRoot, ACTIVE_OVERLAY_FILE);
+  const overlayDest = activeOverlayPath(projectRoot);
+  if (existsSync5(overlayBackup)) {
+    await copyFile2(overlayBackup, overlayDest);
+  } else if (existsSync5(overlayDest)) {
+    await rm2(overlayDest, { force: true });
+  }
+}
+async function snapshotForBackup(projectRoot) {
+  const backupRoot = resolve23(projectRoot, EVAL_DIR2, OVERLAY_BACKUP_DIR);
+  if (existsSync5(backupRoot))
+    return;
+  await mkdir17(backupRoot, { recursive: true });
+  const configPath = resolve23(projectRoot, ".codeconductor", "config.yml");
+  if (existsSync5(configPath)) {
+    await copyFile2(configPath, join18(backupRoot, "config.yml"));
+  }
+  const workflowsDir = resolve23(projectRoot, ".codeconductor", "workflows");
+  if (existsSync5(workflowsDir)) {
+    const dest = join18(backupRoot, "workflows");
+    await mkdir17(dest, { recursive: true });
+    const files = await readdir6(workflowsDir);
+    for (const file of files) {
+      if (file.endsWith(".yml")) {
+        await copyFile2(join18(workflowsDir, file), join18(dest, file));
+      }
+    }
+  }
+  const overlay = activeOverlayPath(projectRoot);
+  if (existsSync5(overlay)) {
+    await copyFile2(overlay, join18(backupRoot, ACTIVE_OVERLAY_FILE));
+  }
+}
+async function applyHarnessOverlay(projectRoot, disabled, options = {}) {
+  try {
+    if (options.backup) {
+      await restoreOverlayBackup(projectRoot);
+      await snapshotForBackup(projectRoot);
+    }
+    const workflowsDir = resolve23(projectRoot, ".codeconductor", "workflows");
+    await mkdir17(workflowsDir, { recursive: true });
+    await mkdir17(resolve23(projectRoot, EVAL_DIR2), { recursive: true });
+    for (const command of WORKFLOW_OVERLAY_COMMANDS) {
+      const base = loadWorkflowProfile(command);
+      const next = applyCatalogToProfile(base, disabled);
+      await writeFile16(join18(workflowsDir, `${command}.yml`), $stringify(next), "utf-8");
+    }
+    const needsConfig = disabled.includes("compile_loop") || disabled.includes("council");
+    if (needsConfig) {
+      const loaded = await loadConfig(projectRoot);
+      const current = loaded.success ? loaded.data : structuredClone(DEFAULT_CONFIG);
+      if (disabled.includes("compile_loop")) {
+        current.loop = { ...current.loop, enabled: false };
+      }
+      if (disabled.includes("council")) {
+        current.presets = {
+          ...current.presets,
+          council: { ...current.presets.council, enabled: false }
+        };
+      }
+      const write = await writeConfig(projectRoot, current, true);
+      if (!write.success) {
+        return err(write.error);
+      }
+    }
+    const overlay = HarnessOverlaySchema.parse({
+      experimentId: options.experimentId,
+      variantId: options.variantId ?? (disabled[0] ? variantIdFor(disabled[0]) : "baseline"),
+      disabledComponents: [...disabled],
+      disableProductGraph: disabled.includes("product_graph"),
+      contractVersion: options.contractVersion,
+      ccepProfile: options.ccepProfile ?? "feature"
+    });
+    await writeFile16(activeOverlayPath(projectRoot), $stringify(overlay), "utf-8");
+    return ok(overlay);
+  } catch (e) {
+    return err(e instanceof Error ? e : new Error(String(e)));
+  }
+}
+async function currentFingerprint(projectRoot, contractVersion) {
+  const catalog = await loadHarnessCatalog(projectRoot);
+  const overlay = await readActiveOverlay(projectRoot);
+  const disabled = overlay?.disabledComponents ?? [];
+  return {
+    fingerprint: harnessFingerprint(disabled, overlay?.contractVersion ?? contractVersion, overlay?.ccepProfile ?? "feature", catalog),
+    overlay,
+    states: componentStates(disabled, catalog)
+  };
+}
+var EVAL_DIR2 = ".codeconductor/evaluation", ACTIVE_OVERLAY_FILE = "active-overlay.yml", CATALOG_FILE = "harness-catalog.yml", OVERLAY_BACKUP_DIR = "overlay-backup", WORKFLOW_OVERLAY_COMMANDS, PHASE_BY_COMPONENT, DEFAULT_HARNESS_CATALOG;
+var init_harness_catalog = __esm(() => {
+  init_dist();
+  init_schemas();
+  init_codeconductor_config();
+  init_config_loader();
+  init_config_writer();
+  init_workflow_profile_loader();
+  WORKFLOW_OVERLAY_COMMANDS = ["feature", "fix", "refactor", "council"];
+  PHASE_BY_COMPONENT = {
+    wayfinding: "wayfinding",
+    intake: "intake",
+    design: "design",
+    test_first: "test",
+    review: "review",
+    docs: "docs"
+  };
+  DEFAULT_HARNESS_CATALOG = {
+    version: 1,
+    components: [
+      {
+        id: "wayfinding",
+        layer: "phase",
+        label: "Wayfinding (repo-explorer)",
+        defaultOn: true,
+        toggle: { kind: "ccep_phase", phaseId: "wayfinding" }
+      },
+      {
+        id: "intake",
+        layer: "phase",
+        label: "Intake (task-coach)",
+        defaultOn: true,
+        toggle: { kind: "ccep_phase", phaseId: "intake" }
+      },
+      {
+        id: "design",
+        layer: "phase",
+        label: "Design (architect)",
+        defaultOn: true,
+        toggle: { kind: "ccep_phase", phaseId: "design" }
+      },
+      {
+        id: "test_first",
+        layer: "phase",
+        label: "Test-first (tester before implement)",
+        defaultOn: true,
+        toggle: { kind: "ccep_phase", phaseId: "test" }
+      },
+      {
+        id: "review",
+        layer: "phase",
+        label: "Review (reviewer)",
+        defaultOn: true,
+        toggle: { kind: "ccep_phase", phaseId: "review" }
+      },
+      {
+        id: "docs",
+        layer: "phase",
+        label: "Docs",
+        defaultOn: true,
+        toggle: { kind: "ccep_phase", phaseId: "docs" }
+      },
+      {
+        id: "confirmation_gates",
+        layer: "gate",
+        label: "Confirmation / stop gates",
+        defaultOn: true,
+        toggle: { kind: "ccep_gates" }
+      },
+      {
+        id: "compile_loop",
+        layer: "loop",
+        label: "Compile-fix loop",
+        defaultOn: true,
+        toggle: { kind: "config_loop" }
+      },
+      {
+        id: "council",
+        layer: "council",
+        label: "Council deliberation and review",
+        defaultOn: true,
+        toggle: { kind: "config_council" }
+      },
+      {
+        id: "product_graph",
+        layer: "knowledge",
+        label: "Product-graph knowledge layer",
+        defaultOn: true,
+        toggle: { kind: "product_graph" }
+      }
+    ]
+  };
+});
+
+// src/core/ccep/context-resolver.ts
+import { existsSync as existsSync6 } from "node:fs";
+import { readFile as readFile25 } from "node:fs/promises";
+import { join as join19 } from "node:path";
+async function loadProductKnowledge(projectRoot) {
+  if (isProductGraphDisabled(projectRoot)) {
+    return {};
+  }
+  const graphPath = productGraphPath(projectRoot);
+  if (!existsSync6(graphPath)) {
+    return {};
+  }
+  try {
+    const raw = await readFile25(graphPath, "utf-8");
+    const graph = ProductGraphSchema.parse(JSON.parse(raw));
+    return {
+      productName: graph.productName,
+      domains: queryNodes(graph, "domain").map((n) => n.name),
+      decisions: queryNodes(graph, "decision").slice(0, 10).map((n) => ({ id: n.id, name: n.name, data: n.data })),
+      risks: queryNodes(graph, "risk").slice(0, 10).map((n) => ({ id: n.id, name: n.name })),
+      requirements: queryNodes(graph, "requirement").slice(0, 10).map((n) => ({ id: n.id, name: n.name, status: n.data.status })),
+      nodeCount: graph.nodes.length
+    };
+  } catch {
+    return {};
+  }
+}
+async function resolveAstSource(projectRoot) {
+  if (isProductGraphDisabled(projectRoot)) {
+    const graphifyPath2 = join19(projectRoot, "graphify-out", "graph.json");
+    if (existsSync6(graphifyPath2)) {
+      return { source: "graphify", confidence: "medium" };
+    }
+    return { source: "manual", confidence: "low" };
+  }
+  const graphPath = productGraphPath(projectRoot);
+  if (existsSync6(graphPath)) {
+    return { source: "product-graph", confidence: "high" };
+  }
+  const graphifyPath = join19(projectRoot, "graphify-out", "graph.json");
+  if (existsSync6(graphifyPath)) {
+    return { source: "graphify", confidence: "medium" };
+  }
+  try {
+    const profile = await detectProject(projectRoot);
+    if (profile.signals.length > 0) {
+      return { source: "detect", confidence: profile.confidence };
+    }
+  } catch {}
+  return { source: "manual", confidence: "low" };
+}
+async function resolveContext(envelope, profile, projectRoot) {
+  const ast = await resolveAstSource(projectRoot);
+  const knowledge = await loadProductKnowledge(projectRoot);
+  const firstPhase = profile.phases[0];
+  let stack = envelope.repoContext.stack;
+  if (stack.length === 0 || stack.length === 1 && stack[0] === "unknown") {
+    try {
+      const detected = await detectProject(projectRoot);
+      stack = [...new Set([...detected.languages, ...detected.frameworks])];
+    } catch {
+      stack = envelope.repoContext.stack;
+    }
+  }
+  const context = {
+    envelope,
+    profile,
+    intent: {
+      type: envelope.command,
+      goal: envelope.userRequest,
+      domain: envelope.repoContext.domain
+    },
+    project: {
+      name: envelope.projectId,
+      rootDir: projectRoot,
+      stack
+    },
+    knowledge,
+    ast,
+    policies: DEFAULT_POLICIES,
+    outputSchema: firstPhase?.outputSchema ?? profile.intakeSchema ?? "agent-output"
+  };
+  return validateExecutionContext(context);
+}
+var DEFAULT_POLICIES;
+var init_context_resolver = __esm(() => {
+  init_project_detector();
+  init_schemas();
+  init_command_parser();
+  init_paths();
+  init_graph_store();
+  init_harness_catalog();
+  DEFAULT_POLICIES = {
+    architecture: "modular",
+    testing: "required",
+    documentation: "required",
+    breakingChanges: "approval"
+  };
+});
+
+// src/domain/council/council-consensus.ts
+function canonicalAgentId(agentId) {
+  return agentId.trim().toLowerCase();
+}
+function isSecurityCategory(category) {
+  return SECURITY_CATEGORIES.has(category.trim().toLowerCase());
+}
+function resolveQuorum(config, ballotCount) {
+  if (typeof config.quorum === "number") {
+    const required = Math.max(1, config.quorum);
+    return { required, met: ballotCount >= required };
+  }
+  if (config.expectedAgentIds && config.expectedAgentIds.length > 0) {
+    const required = Math.ceil(config.expectedAgentIds.length / 2);
+    return { required, met: ballotCount >= required };
+  }
+  if (config.algorithm === "majority") {
+    return { required: 3, met: ballotCount >= 3 };
+  }
+  return { required: 1, met: ballotCount >= 1 };
+}
+function validateBallotBox(verdicts, expectedAgentIds) {
+  if (expectedAgentIds !== undefined) {
+    if (expectedAgentIds.length === 0 || expectedAgentIds.some((id) => typeof id !== "string" || canonicalAgentId(id) === "")) {
+      return "invalid expected agent roster";
+    }
+    const canonicalExpected = expectedAgentIds.map(canonicalAgentId);
+    if (new Set(canonicalExpected).size !== canonicalExpected.length) {
+      return "duplicate agent IDs in expected roster";
+    }
+  }
+  const invalidCount = verdicts.filter((v) => typeof v.agentId !== "string" || v.agentId.trim() === "" || !VALID_STATUSES.has(v.status)).length;
+  if (invalidCount > 0) {
+    return `${invalidCount} invalid verdict(s) received`;
+  }
+  const missingConfidence = verdicts.filter((v) => typeof v.confidence !== "number").length;
+  if (missingConfidence > 0) {
+    return `${missingConfidence} verdict(s) missing confidence`;
+  }
+  const seen = new Set;
+  const duplicates = new Set;
+  for (const v of verdicts) {
+    const canonicalId = canonicalAgentId(v.agentId);
+    if (seen.has(canonicalId)) {
+      duplicates.add(v.agentId);
+    }
+    seen.add(canonicalId);
+  }
+  if (duplicates.size > 0) {
+    return `duplicate verdicts from ${[...duplicates].join(", ")}`;
+  }
+  return;
+}
+function unanimousFailure(verdicts, expectedAgentIds) {
+  const box = validateBallotBox(verdicts, expectedAgentIds);
+  if (box)
+    return box;
+  if (expectedAgentIds === undefined) {
+    return "missing expected agent roster";
+  }
+  const seen = new Set(verdicts.map((v) => canonicalAgentId(v.agentId)));
+  const missing = expectedAgentIds.filter((id) => !seen.has(canonicalAgentId(id)));
+  if (missing.length > 0) {
+    return `missing verdicts from ${missing.join(", ")}`;
+  }
+  const expected = new Set(expectedAgentIds.map(canonicalAgentId));
+  const unexpected = verdicts.filter((v) => !expected.has(canonicalAgentId(v.agentId))).map((v) => v.agentId);
+  if (unexpected.length > 0) {
+    return `unexpected verdicts from ${unexpected.join(", ")}`;
+  }
+  const nonApproving = verdicts.filter((v) => v.status !== "APPROVED").length;
+  if (nonApproving > 0) {
+    return `${nonApproving} agent(s) did not approve`;
+  }
+  return;
+}
+function escalated(verdicts, summary, counts) {
+  return {
+    status: "ESCALATED",
+    totalAgents: verdicts.length,
+    approvedCount: counts?.approvedCount ?? 0,
+    rejectedCount: counts?.rejectedCount ?? 0,
+    abstainedCount: counts?.abstainedCount ?? 0,
+    vetoApplied: false,
+    complianceVetoApplied: false,
+    averageConfidence: counts?.averageConfidence,
+    findings: counts?.findings ? [...counts.findings] : [],
+    summary,
+    individualVerdicts: verdicts
+  };
+}
+function councilConsensus(verdicts, config = DEFAULT_CONFIG2) {
+  const totalAgents = verdicts.length;
+  if (totalAgents === 0) {
+    return escalated(verdicts, "No verdicts submitted — escalated for human review.");
+  }
+  const ballotFailure = validateBallotBox(verdicts, config.expectedAgentIds);
+  if (ballotFailure) {
+    return escalated(verdicts, `Ballot box invalid: ${ballotFailure} — escalated for human review.`);
+  }
+  let approvedCount = 0;
+  let rejectedCount = 0;
+  let abstainedCount = 0;
+  let vetoApplied = false;
+  let complianceVetoApplied = false;
+  let vetoByAgentId;
+  let totalConfidence = 0;
+  let hasLowConfidence = false;
+  const allFindings = [];
+  const allowCompliance = typeof config.allowComplianceVeto === "boolean" ? config.allowComplianceVeto : true;
+  const policy = config.criticalFindingsPolicy ?? "escalate";
+  for (const v of verdicts) {
+    switch (v.status) {
+      case "APPROVED":
+        approvedCount++;
+        break;
+      case "REJECTED":
+        rejectedCount++;
+        break;
+      case "ABSTAIN":
+        abstainedCount++;
+        break;
+    }
+    if (typeof v.confidence !== "number") {
+      return escalated(verdicts, "Ballot box invalid: verdict(s) missing confidence — escalated for human review.");
+    }
+    const confidence = v.confidence;
+    totalConfidence += confidence;
+    if (confidence < 0.6) {
+      hasLowConfidence = true;
+    }
+    if (config.allowSecurityVeto && v.securityVeto && v.status === "REJECTED") {
+      vetoApplied = true;
+      vetoByAgentId = v.agentId;
+    }
+    if (allowCompliance && v.complianceVeto && v.status === "REJECTED") {
+      complianceVetoApplied = true;
+      vetoByAgentId = v.agentId;
+    }
+    for (const finding of v.findings) {
+      allFindings.push(finding);
+      if (config.allowSecurityVeto && finding.severity === "critical" && isSecurityCategory(finding.category)) {
+        vetoApplied = true;
+        vetoByAgentId = v.agentId;
+      }
+    }
+  }
+  const averageConfidence = totalConfidence / totalAgents;
+  const counts = {
+    approvedCount,
+    rejectedCount,
+    abstainedCount,
+    averageConfidence,
+    findings: allFindings
+  };
+  if (vetoApplied || complianceVetoApplied) {
+    const vetoAgent = verdicts.find((v) => v.agentId === vetoByAgentId);
+    const vetoType = vetoApplied ? "Security" : "Compliance";
+    return {
+      status: "REJECTED",
+      totalAgents,
+      approvedCount,
+      rejectedCount,
+      abstainedCount,
+      vetoApplied,
+      complianceVetoApplied,
+      vetoByAgentId,
+      averageConfidence,
+      findings: allFindings,
+      summary: `${vetoType} veto applied by ${vetoAgent?.agentRole ?? vetoByAgentId} — rejected regardless of majority.`,
+      individualVerdicts: verdicts
+    };
+  }
+  const critical = allFindings.filter((f) => f.severity === "critical");
+  if (critical.length > 0 && policy === "reject") {
+    return {
+      status: "REJECTED",
+      totalAgents,
+      approvedCount,
+      rejectedCount,
+      abstainedCount,
+      vetoApplied: false,
+      complianceVetoApplied: false,
+      averageConfidence,
+      findings: allFindings,
+      summary: `${critical.length} critical finding(s) — rejected by criticalFindingsPolicy.`,
+      individualVerdicts: verdicts
+    };
+  }
+  if (critical.length > 0 && policy === "escalate") {
+    return escalated(verdicts, `${critical.length} critical finding(s) — escalated by criticalFindingsPolicy.`, counts);
+  }
+  const quorum = resolveQuorum(config, totalAgents);
+  if (!quorum.met) {
+    return escalated(verdicts, `Quorum not reached (${totalAgents}/${quorum.required}) — escalated for human review.`, counts);
+  }
+  if (hasLowConfidence || averageConfidence < 0.7) {
+    const reason = hasLowConfidence ? "one or more agents reported confidence below 0.6" : `average confidence (${averageConfidence.toFixed(2)}) is below 0.7`;
+    return escalated(verdicts, `Confidence threshold breach: ${reason} — escalated for human review.`, {
+      approvedCount,
+      rejectedCount,
+      abstainedCount,
+      averageConfidence,
+      findings: allFindings
+    });
+  }
+  if (config.algorithm === "majority") {
+    if (approvedCount > rejectedCount) {
+      return {
+        status: "APPROVED",
+        totalAgents,
+        approvedCount,
+        rejectedCount,
+        abstainedCount,
+        vetoApplied: false,
+        complianceVetoApplied: false,
+        averageConfidence,
+        findings: allFindings,
+        summary: `Approved by majority (${approvedCount}/${totalAgents}).`,
+        individualVerdicts: verdicts
+      };
+    }
+  }
+  if (config.algorithm === "unanimous") {
+    const failure = unanimousFailure(verdicts, config.expectedAgentIds);
+    if (!failure) {
+      return {
+        status: "APPROVED",
+        totalAgents,
+        approvedCount,
+        rejectedCount,
+        abstainedCount,
+        vetoApplied: false,
+        complianceVetoApplied: false,
+        averageConfidence,
+        findings: allFindings,
+        summary: `Approved unanimously (${approvedCount}/${totalAgents}).`,
+        individualVerdicts: verdicts
+      };
+    }
+    return escalated(verdicts, `Unanimity not reached: ${failure} — escalated for human review.`, {
+      approvedCount,
+      rejectedCount,
+      abstainedCount,
+      averageConfidence,
+      findings: allFindings
+    });
+  }
+  return escalated(verdicts, `No clear consensus (${approvedCount} approved, ${rejectedCount} rejected, ${abstainedCount} abstained) — escalated for human review.`, {
+    approvedCount,
+    rejectedCount,
+    abstainedCount,
+    averageConfidence,
+    findings: allFindings
+  });
+}
+var DEFAULT_CONFIG2, VALID_STATUSES, SECURITY_CATEGORIES;
+var init_council_consensus = __esm(() => {
+  DEFAULT_CONFIG2 = {
+    algorithm: "majority",
+    allowSecurityVeto: true,
+    allowComplianceVeto: true,
+    criticalFindingsPolicy: "escalate"
+  };
+  VALID_STATUSES = new Set(["APPROVED", "REJECTED", "ABSTAIN"]);
+  SECURITY_CATEGORIES = new Set([
+    "security",
+    "auth",
+    "injection",
+    "credentials",
+    "supply-chain"
+  ]);
+});
+
+// src/core/shared/vague-criterion.ts
+function isVagueCriterion(text) {
+  const t = text.trim();
+  if (t.length < 8)
+    return true;
+  return VAGUE_PATTERNS.some((p) => p.test(t));
+}
+var VAGUE_PATTERNS;
+var init_vague_criterion = __esm(() => {
+  VAGUE_PATTERNS = [
+    /^mejorar\s/i,
+    /^fix\s+bugs?$/i,
+    /^refactor$/i,
+    /^hacer\s+refactor/i,
+    /^arreglar\s+bugs?/i,
+    /^improve\s+ux$/i,
+    /^better\s+ux$/i,
+    /^cleanup$/i,
+    /^misc$/i
+  ];
+});
+
+// src/core/ccep/task-card-validator.ts
+function isNonEmpty(value) {
+  if (value === undefined || value === null)
+    return false;
+  if (typeof value === "string")
+    return value.trim().length > 0;
+  if (Array.isArray(value)) {
+    return value.length > 0 && value.every((entry) => isNonEmpty(entry));
+  }
+  return true;
+}
+function fieldValue(card, field) {
+  if (field === "scope") {
+    return card.targetFiles;
+  }
+  return card[field];
+}
+function validateTaskCardForProfile(profile, card) {
+  const issues = [];
+  const parsed = CanonicalTaskCardSchema.safeParse(card);
+  if (!parsed.success) {
+    issues.push({
+      code: "SCHEMA",
+      message: parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")
+    });
+    return issues;
+  }
+  const data = parsed.data;
+  const required = profile.taskCard?.requiredFields ?? [];
+  for (const field of required) {
+    if (!isNonEmpty(fieldValue(data, field))) {
+      issues.push({
+        code: "MISSING_FIELD",
+        message: `Required field "${field}" is missing or empty`,
+        itemId: data.id
+      });
+    }
+  }
+  if (data.status === "draft") {
+    issues.push({
+      code: "NOT_ROUTABLE",
+      message: 'TaskCard status "draft" is not routable',
+      itemId: data.id
+    });
+  }
+  if (data.risk === "high" && data.requiresHumanReview !== true) {
+    issues.push({
+      code: "HIGH_RISK_REVIEW",
+      message: "risk: high requires requiresHumanReview: true",
+      itemId: data.id
+    });
+  }
+  if (data.type !== "docs" && data.type !== "review" && data.requiresTests !== true) {
+    issues.push({
+      code: "TESTS_REQUIRED",
+      message: `type "${data.type}" requires requiresTests: true`,
+      itemId: data.id
+    });
+  }
+  for (const criterion of data.acceptanceCriteria) {
+    if (isVagueCriterion(criterion)) {
+      issues.push({
+        code: "VAGUE_ACCEPTANCE",
+        message: `Vague acceptance criterion: "${criterion}"`,
+        itemId: data.id
+      });
+    }
+  }
+  return issues;
+}
+var init_task_card_validator = __esm(() => {
+  init_schemas();
+  init_vague_criterion();
+});
+
+// src/commands/ccep.command.ts
+var exports_ccep_command = {};
+__export(exports_ccep_command, {
+  ccepCommand: () => ccepCommand
+});
+function parseWorkflowCommand(command) {
+  if (!command) {
+    return { ok: false, error: "Missing required --command flag" };
+  }
+  const result = WorkflowCommandSchema.safeParse(command);
+  if (!result.success) {
+    return { ok: false, error: `Unknown workflow command: ${command}` };
+  }
+  return { ok: true, command: result.data };
+}
+function containedContextError(contextPath) {
+  return `Could not read --context file: ${contextPath}. ` + "It must be a regular file at a relative path inside the project root.";
+}
+async function readContainedContext(projectRoot, contextPath) {
   try {
     return await readFileWithinRoot(projectRoot, contextPath);
   } catch {
@@ -22095,6 +23142,37 @@ async function readInputPayload(projectRoot, input, rest) {
     return { ok: false, error: `Invalid JSON input: ${String(err3)}` };
   }
 }
+function consensusExitCode(status) {
+  if (status === "APPROVED")
+    return 0;
+  if (status === "REJECTED")
+    return 1;
+  return 2;
+}
+function parseConsensusPayload(data) {
+  if (Array.isArray(data)) {
+    return { ok: true, verdicts: data };
+  }
+  if (typeof data !== "object" || data === null) {
+    return { ok: false, error: "Consensus input must be a verdicts array or { verdicts, config? }" };
+  }
+  const record = data;
+  if (!Array.isArray(record.verdicts)) {
+    return { ok: false, error: "Consensus input must be a verdicts array or { verdicts, config? }" };
+  }
+  let config;
+  if (record.config !== undefined) {
+    const parsed = ConsensusConfigSchema.safeParse(record.config);
+    if (!parsed.success) {
+      return {
+        ok: false,
+        error: parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")
+      };
+    }
+    config = parsed.data;
+  }
+  return { ok: true, verdicts: record.verdicts, config };
+}
 async function ccepCommand(options) {
   const {
     subcommand,
@@ -22106,6 +23184,7 @@ async function ccepCommand(options) {
     input,
     contextPath,
     promptVersion = "v1.0.0",
+    config,
     rest
   } = options;
   switch (subcommand) {
@@ -22260,6 +23339,22 @@ async function ccepCommand(options) {
           data: { success: false, command: "ccep validate", errors: [payload.error] }
         };
       }
+      if (profile.taskCard && CanonicalTaskCardSchema.safeParse(payload.data).success) {
+        const issues = validateTaskCardForProfile(profile, payload.data);
+        return {
+          code: issues.length === 0 ? 0 : 1,
+          data: {
+            success: issues.length === 0,
+            command: "ccep validate",
+            phase: phaseId,
+            role: agentRole,
+            schema: "taskcard",
+            valid: issues.length === 0,
+            issues,
+            errors: issues.map((issue) => issue.message)
+          }
+        };
+      }
       const result = validateOutputForRole(agentRole, resolvedPhase.outputSchema, payload.data);
       return {
         code: result.valid ? 0 : 1,
@@ -22275,6 +23370,95 @@ async function ccepCommand(options) {
         }
       };
     }
+    case "taskcard": {
+      const parsed = parseWorkflowCommand(command);
+      if (!parsed.ok) {
+        return {
+          code: 1,
+          data: { success: false, command: "ccep taskcard", errors: [parsed.error] }
+        };
+      }
+      const profile = loadWorkflowProfile(parsed.command, projectRoot);
+      if (!profile.taskCard) {
+        return {
+          code: 1,
+          data: {
+            success: false,
+            command: "ccep taskcard",
+            errors: [`Workflow "${parsed.command}" does not declare a taskCard contract`]
+          }
+        };
+      }
+      const payload = await readInputPayload(projectRoot, input, rest);
+      if (!payload.ok) {
+        return {
+          code: 1,
+          data: { success: false, command: "ccep taskcard", errors: [payload.error] }
+        };
+      }
+      const issues = validateTaskCardForProfile(profile, payload.data);
+      return {
+        code: issues.length === 0 ? 0 : 1,
+        data: {
+          success: issues.length === 0,
+          command: "ccep taskcard",
+          workflow: parsed.command,
+          issues,
+          errors: issues.map((issue) => issue.message)
+        }
+      };
+    }
+    case "consensus": {
+      const payload = await readInputPayload(projectRoot, input, rest);
+      if (!payload.ok) {
+        return {
+          code: 1,
+          data: { success: false, command: "ccep consensus", errors: [payload.error] }
+        };
+      }
+      const parsedBallots = parseConsensusPayload(payload.data);
+      if (!parsedBallots.ok) {
+        return {
+          code: 1,
+          data: { success: false, command: "ccep consensus", errors: [parsedBallots.error] }
+        };
+      }
+      let mergedConfig = parsedBallots.config;
+      if (config) {
+        const configPayload = await readInputPayload(projectRoot, config);
+        if (!configPayload.ok) {
+          return {
+            code: 1,
+            data: {
+              success: false,
+              command: "ccep consensus",
+              errors: [`Invalid --config: ${configPayload.error}`]
+            }
+          };
+        }
+        const parsedConfig = ConsensusConfigSchema.safeParse(configPayload.data);
+        if (!parsedConfig.success) {
+          return {
+            code: 1,
+            data: {
+              success: false,
+              command: "ccep consensus",
+              errors: parsedConfig.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`)
+            }
+          };
+        }
+        mergedConfig = { ...mergedConfig, ...parsedConfig.data };
+      }
+      const verdict = councilConsensus(parsedBallots.verdicts, mergedConfig);
+      return {
+        code: consensusExitCode(verdict.status),
+        data: {
+          success: verdict.status === "APPROVED",
+          command: "ccep consensus",
+          verdict
+        }
+      };
+    }
     case "evaluate": {
       const parsed = parseWorkflowCommand(command);
       if (!parsed.ok) {
@@ -22350,7 +23534,7 @@ async function ccepCommand(options) {
           success: false,
           command: "ccep",
           errors: [
-            `Unknown subcommand: ${subcommand}. Use: parse, profile, resolve, compile, validate, evaluate`
+            `Unknown subcommand: ${subcommand}. Use: parse, profile, resolve, compile, validate, evaluate, consensus, taskcard`
           ]
         }
       };
@@ -22363,6 +23547,8 @@ var init_ccep_command = __esm(() => {
   init_command_parser();
   init_context_resolver();
   init_workflow_profile_loader();
+  init_council_consensus();
+  init_task_card_validator();
   init_schemas();
 });
 
@@ -22398,12 +23584,6 @@ function detectCycle(items) {
   }
   return null;
 }
-function isVagueCriterion(text) {
-  const t = text.trim();
-  if (t.length < 8)
-    return true;
-  return VAGUE_PATTERNS.some((p) => p.test(t));
-}
 function validateBacklog(doc) {
   const errors3 = [];
   const recommendations = [];
@@ -22505,30 +23685,42 @@ function buildRecommendations(errors3, extra = []) {
   }
   return recs;
 }
-var VAGUE_PATTERNS;
 var init_backlog_validator = __esm(() => {
   init_schemas();
-  VAGUE_PATTERNS = [
-    /^mejorar\s/i,
-    /^fix\s+bugs?$/i,
-    /^refactor$/i,
-    /^hacer\s+refactor/i,
-    /^arreglar\s+bugs?/i,
-    /^improve\s+ux$/i,
-    /^better\s+ux$/i,
-    /^cleanup$/i,
-    /^misc$/i
-  ];
+  init_vague_criterion();
 });
 
 // src/core/openspec/openspec-state.ts
-import { createHash as createHash3 } from "node:crypto";
-import { mkdir as mkdir17, readFile as readFile24, writeFile as writeFile15 } from "node:fs/promises";
-import { resolve as resolve22 } from "node:path";
+import { createHash as createHash4 } from "node:crypto";
+import { mkdir as mkdir18, readFile as readFile26, rename as rename2, writeFile as writeFile17 } from "node:fs/promises";
+import { resolve as resolve24 } from "node:path";
+function canTransition(from, to) {
+  return ALLOWED_TRANSITIONS[from]?.includes(to) ?? false;
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function applyBacklogTransition(content, itemId, from, to, progress) {
+  if (from === to) {
+    if (progress === undefined)
+      return ok(content);
+    return ok(updateBacklogItemInMarkdown(content, itemId, { progress }));
+  }
+  if (!canTransition(from, to)) {
+    const allowed = ALLOWED_TRANSITIONS[from] ?? [];
+    return err(new Error(`Illegal backlog transition for ${itemId}: ${from} → ${to}. ` + `Allowed: ${allowed.length > 0 ? allowed.join(", ") : "none"}.`));
+  }
+  return ok(updateBacklogItemInMarkdown(content, itemId, { status: to, progress }));
+}
+async function writeFileAtomic(path, content) {
+  const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+  await writeFile17(tmp, content, "utf-8");
+  await rename2(tmp, path);
+}
 async function loadOpenspecState(projectRoot) {
   try {
-    const filePath = resolve22(projectRoot, STATE_FILE);
-    const content = await readFile24(filePath, "utf-8");
+    const filePath = resolve24(projectRoot, STATE_FILE);
+    const content = await readFile26(filePath, "utf-8");
     const data = JSON.parse(content);
     return ok(OpenspecStateSchema.parse(data));
   } catch (e) {
@@ -22545,15 +23737,19 @@ async function loadOpenspecState(projectRoot) {
 }
 async function writeOpenspecState(projectRoot, state) {
   try {
-    const dir = resolve22(projectRoot, ".codeconductor");
-    await mkdir17(dir, { recursive: true });
+    const dir = resolve24(projectRoot, ".codeconductor");
+    await mkdir18(dir, { recursive: true });
     const validated = OpenspecStateSchema.parse(state);
-    await writeFile15(resolve22(dir, "openspec-state.json"), JSON.stringify(validated, null, 2), "utf-8");
+    await writeFileAtomic(resolve24(dir, "openspec-state.json"), JSON.stringify(validated, null, 2));
     return ok(undefined);
   } catch (e) {
     return err(e instanceof Error ? e : new Error(String(e)));
   }
 }
+function setTaskCardStatus(state, cardId, status) {
+  const taskCards = state.taskCards.map((c) => c.id === cardId ? { ...c, status } : c);
+  return { ...state, taskCards };
+}
 function getNextTaskCard(state) {
   const done = new Set(state.taskCards.filter((c) => c.status === "done").map((c) => c.id));
   for (const card of state.taskCards) {
@@ -22566,13 +23762,25 @@ function getNextTaskCard(state) {
   return null;
 }
 function hashContent(content) {
-  return createHash3("sha256").update(content).digest("hex").slice(0, 16);
+  return createHash4("sha256").update(content).digest("hex").slice(0, 16);
+}
+function serializeItemSnapshot(item) {
+  return JSON.stringify({
+    status: item.status,
+    progress: item.progress,
+    title: item.title,
+    description: item.description,
+    scope: item.scope,
+    type: item.type,
+    priority: item.priority,
+    acceptanceCriteria: item.acceptanceCriteria
+  });
 }
 function updateBacklogItemInMarkdown(content, itemId, updates) {
   const lines = content.split(`
 `);
   let inTargetItem = false;
-  const idPattern = new RegExp(`^###\\s+.*${itemId}\\b`, "i");
+  const idPattern = new RegExp(`^###\\s+.*${escapeRegExp(itemId)}\\b`, "i");
   for (let i = 0;i < lines.length; i++) {
     const line = lines[i];
     if (line.match(/^###\s+/)) {
@@ -22591,34 +23799,69 @@ function updateBacklogItemInMarkdown(content, itemId, updates) {
   return lines.join(`
 `);
 }
-var STATE_FILE = ".codeconductor/openspec-state.json";
+function archiveItemInMarkdown(content, itemId) {
+  const lines = content.split(`
+`);
+  const itemStart = lines.findIndex((l) => l.match(new RegExp(`^###\\s+.*${escapeRegExp(itemId)}\\b`, "i")));
+  if (itemStart < 0)
+    return content;
+  let itemEnd = lines.length;
+  for (let i = itemStart + 1;i < lines.length; i++) {
+    if (lines[i].match(/^###\s+/) || lines[i].match(/^##\s+Archive/i)) {
+      itemEnd = i;
+      break;
+    }
+  }
+  const block = lines.slice(itemStart, itemEnd);
+  const statusLine = block.findIndex((l) => l.match(/^-\s+Status:/i));
+  if (statusLine >= 0)
+    block[statusLine] = "- Status: DONE";
+  const progressLine = block.findIndex((l) => l.match(/^-\s+Progress:/i));
+  if (progressLine >= 0)
+    block[progressLine] = "- Progress: 100%";
+  const withoutItem = [...lines.slice(0, itemStart), ...lines.slice(itemEnd)];
+  const archiveIdx = withoutItem.findIndex((l) => /^##\s+Archive/i.test(l));
+  if (archiveIdx < 0) {
+    withoutItem.push("", "## Archive", ...block);
+  } else {
+    withoutItem.splice(archiveIdx + 1, 0, ...block);
+  }
+  return withoutItem.join(`
+`);
+}
+var STATE_FILE = ".codeconductor/openspec-state.json", ALLOWED_TRANSITIONS;
 var init_openspec_state = __esm(() => {
   init_schemas();
+  ALLOWED_TRANSITIONS = {
+    TODO: ["READY"],
+    READY: ["PLANNED", "BLOCKED"],
+    PLANNED: ["IN_PROGRESS", "BLOCKED"],
+    IN_PROGRESS: ["REVIEW", "BLOCKED"],
+    BLOCKED: ["READY"],
+    REVIEW: ["DONE", "IN_PROGRESS"],
+    DONE: []
+  };
 });
 
 // src/core/openspec/backlog-scanner.ts
-import { execSync as execSync2 } from "node:child_process";
-import { readFile as readFile25 } from "node:fs/promises";
-import { resolve as resolve23 } from "node:path";
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { readFile as readFile27 } from "node:fs/promises";
+import { resolve as resolve25 } from "node:path";
 function itemSnapshot(items) {
   const snap = {};
   for (const item of items) {
-    snap[item.id] = JSON.stringify({
-      status: item.status,
-      progress: item.progress,
-      title: item.title
-    });
+    snap[item.id] = serializeItemSnapshot(item);
   }
   return snap;
 }
 async function scanBacklog(projectRoot, previousSnapshot = {}) {
   try {
-    const filePath = resolve23(projectRoot, BACKLOG_FILENAME);
-    const content = await readFile25(filePath, "utf-8");
+    const filePath = resolve25(projectRoot, BACKLOG_FILENAME);
+    const content = await readFile27(filePath, "utf-8");
     const hash = hashContent(content);
     let fileChanged = true;
     try {
-      const diff = execSync2(`git diff --name-only -- ${BACKLOG_FILENAME}`, {
+      const diff = execFileSync2("git", ["diff", "--name-only", "--", BACKLOG_FILENAME], {
         cwd: projectRoot,
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "ignore"]
@@ -22752,8 +23995,17 @@ function phaseAcceptance(phase, item) {
 function getPhaseOrder(doc) {
   return doc.global.tddRequired ? [...TDD_PHASE_ORDER] : [...DEFAULT_PHASE_ORDER];
 }
-function planTaskCardsForItem(item, doc, existingCards = []) {
+function hashItemSnapshot(item) {
+  return hashContent(serializeItemSnapshot(item));
+}
+function planTaskCardsForItem(item, doc, existingCards = [], previousSnapshot) {
   const phases = getPhaseOrder(doc);
+  const currentHash = hashItemSnapshot(item);
+  const snapshotDrifted = Boolean(previousSnapshot && hashContent(previousSnapshot) !== currentHash);
+  const existingForItem = existingCards.filter((c) => c.backlogId === item.id);
+  const previousOrder = existingForItem.map((c) => c.phase);
+  const orderChanged = previousOrder.length > 0 && previousOrder.join(",") !== phases.join(",");
+  const invalidatedCards = [];
   const cards = [];
   let prevId;
   for (const phase of phases) {
@@ -22761,6 +24013,11 @@ function planTaskCardsForItem(item, doc, existingCards = []) {
     const existing = existingCards.find((c) => c.id === id);
     const route = routePhaseToAgent(phase);
     const dependsOn = prevId ? [prevId] : [];
+    const drifted = snapshotDrifted || Boolean(existing?.itemHash && existing.itemHash !== currentHash);
+    const reset = drifted || orderChanged;
+    if (existing && reset) {
+      invalidatedCards.push(existing.id);
+    }
     cards.push({
       id,
       backlogId: item.id,
@@ -22771,11 +24028,22 @@ function planTaskCardsForItem(item, doc, existingCards = []) {
       modelHint: route.modelKey,
       dependsOn,
       acceptanceCriteria: phaseAcceptance(phase, item),
-      status: existing?.status ?? "pending"
+      status: reset ? "pending" : existing?.status ?? "pending",
+      itemHash: currentHash
     });
     prevId = id;
   }
-  return cards;
+  const leftover = existingForItem.filter((c) => !phases.includes(c.phase));
+  for (const card of leftover) {
+    invalidatedCards.push(card.id);
+  }
+  const uniqueInvalidated = [...new Set(invalidatedCards)];
+  const tddImpact = orderChanged ? {
+    previousOrder,
+    nextOrder: phases,
+    resetCardIds: uniqueInvalidated
+  } : undefined;
+  return { cards, invalidatedCards: uniqueInvalidated, tddImpact };
 }
 function comparePriority(a, b) {
   const order = { P0: 0, P1: 1, P2: 2, P3: 3 };
@@ -22808,6 +24076,7 @@ function buildChangeSlug(item) {
 var DEFAULT_PHASE_ORDER, TDD_PHASE_ORDER;
 var init_backlog_planner = __esm(() => {
   init_agent_router();
+  init_openspec_state();
   DEFAULT_PHASE_ORDER = [
     "discover",
     "design",
@@ -22825,8 +24094,8 @@ var init_backlog_planner = __esm(() => {
 });
 
 // src/core/openspec/openspec-generator.ts
-import { mkdir as mkdir18, writeFile as writeFile16 } from "node:fs/promises";
-import { resolve as resolve24 } from "node:path";
+import { mkdir as mkdir19, rename as rename3, writeFile as writeFile18 } from "node:fs/promises";
+import { basename as basename3, resolve as resolve26 } from "node:path";
 function proposalContent(item) {
   return `# Proposal: ${item.title}
 
@@ -22869,6 +24138,10 @@ ${item.acceptanceCriteria.map((c) => `- ${c}`).join(`
 `)}
 `;
 }
+async function writeTasksMarkdown(projectRoot, changePath, cards) {
+  await mkdir19(resolve26(projectRoot, changePath), { recursive: true });
+  await writeFile18(resolve26(projectRoot, changePath, "tasks.md"), tasksContent(cards), "utf-8");
+}
 function tasksContent(cards) {
   const implCards = cards.filter((c) => c.phase === "implement" || c.phase === "test");
   const lines = ["# Implementation Tasks", ""];
@@ -22884,11 +24157,11 @@ function tasksContent(cards) {
 }
 async function generateOpenspecChange(projectRoot, item, taskCards) {
   const slug = buildChangeSlug(item);
-  const changeDir = resolve24(projectRoot, "openspec", "changes", slug);
-  await mkdir18(resolve24(changeDir, "specs"), { recursive: true });
-  await writeFile16(resolve24(changeDir, "proposal.md"), proposalContent(item), "utf-8");
-  await writeFile16(resolve24(changeDir, "design.md"), designPlaceholder(item), "utf-8");
-  await writeFile16(resolve24(changeDir, "tasks.md"), tasksContent(taskCards), "utf-8");
+  const changeDir = resolve26(projectRoot, "openspec", "changes", slug);
+  await mkdir19(resolve26(changeDir, "specs"), { recursive: true });
+  await writeFile18(resolve26(changeDir, "proposal.md"), proposalContent(item), "utf-8");
+  await writeFile18(resolve26(changeDir, "design.md"), designPlaceholder(item), "utf-8");
+  await writeFile18(resolve26(changeDir, "tasks.md"), tasksContent(taskCards), "utf-8");
   const specStub = `# Delta Spec: ${item.title}
 
 ## ADDED Requirements
@@ -22896,20 +24169,29 @@ async function generateOpenspecChange(projectRoot, item, taskCards) {
 ${item.acceptanceCriteria.map((c) => `- ${c}`).join(`
 `)}
 `;
-  await writeFile16(resolve24(changeDir, "specs", "delta.md"), specStub, "utf-8");
+  await writeFile18(resolve26(changeDir, "specs", "delta.md"), specStub, "utf-8");
   return `openspec/changes/${slug}`;
 }
+async function archiveChangeFolder(projectRoot, changePath) {
+  const src = resolve26(projectRoot, changePath);
+  const slug = basename3(changePath);
+  const destDir = resolve26(projectRoot, "openspec", "changes", "archive");
+  await mkdir19(destDir, { recursive: true });
+  const dest = resolve26(destDir, slug);
+  await rename3(src, dest);
+  return `openspec/changes/archive/${slug}`;
+}
 async function ensureOpenspecConfig(projectRoot) {
-  const configPath = resolve24(projectRoot, "openspec", "config.yaml");
+  const configPath = resolve26(projectRoot, "openspec", "config.yaml");
   try {
     const { access: access7 } = await import("node:fs/promises");
     await access7(configPath);
   } catch {
-    await mkdir18(resolve24(projectRoot, "openspec"), { recursive: true });
+    await mkdir19(resolve26(projectRoot, "openspec"), { recursive: true });
     const stub = `# OpenSpec project config (CodeConductor native compatible)
 schema: spec-driven
 `;
-    await writeFile16(configPath, stub, "utf-8");
+    await writeFile18(configPath, stub, "utf-8");
   }
 }
 var init_openspec_generator = __esm(() => {
@@ -22921,10 +24203,10 @@ var exports_openspec_command = {};
 __export(exports_openspec_command, {
   openspecCommand: () => openspecCommand
 });
-import { readFile as readFile26, writeFile as writeFile17 } from "node:fs/promises";
-import { resolve as resolve25 } from "node:path";
+import { readFile as readFile28 } from "node:fs/promises";
+import { resolve as resolve27 } from "node:path";
 async function openspecCommand(options) {
-  const { subcommand, itemId, projectRoot, output } = options;
+  const { subcommand, itemId, projectRoot, output, reason } = options;
   switch (subcommand) {
     case "validate":
       return handleValidate(projectRoot);
@@ -22936,6 +24218,14 @@ async function openspecCommand(options) {
       return handleStatus2(projectRoot);
     case "next":
       return handleNext2(projectRoot);
+    case "start":
+      return handleStart(projectRoot, itemId);
+    case "done":
+      return handleDone(projectRoot, itemId);
+    case "block":
+      return handleBlock(projectRoot, itemId, reason);
+    case "archive":
+      return handleArchive(projectRoot, itemId);
     default:
       return {
         code: 1,
@@ -22943,12 +24233,46 @@ async function openspecCommand(options) {
           success: false,
           command: "openspec",
           errors: [
-            `Unknown subcommand: ${subcommand}. Use: validate, scan, plan, status, next`
+            `Unknown subcommand: ${subcommand}. Use: ${KNOWN_SUBCOMMANDS}`
           ]
         }
       };
   }
 }
+function fail(command, errors3, extra = {}) {
+  return {
+    code: 1,
+    data: { success: false, command, errors: errors3, ...extra }
+  };
+}
+async function persistBacklog(projectRoot, content) {
+  await writeFileAtomic(resolve27(projectRoot, BACKLOG_FILENAME), content);
+}
+async function persistState(projectRoot, state) {
+  const written = await writeOpenspecState(projectRoot, state);
+  if (!written.success) {
+    return { ok: false, error: written.error.message };
+  }
+  return { ok: true };
+}
+async function readBacklogMarkdown(projectRoot) {
+  return readFile28(resolve27(projectRoot, BACKLOG_FILENAME), "utf-8");
+}
+async function transitionItem(projectRoot, item, to, progress) {
+  const content = await readBacklogMarkdown(projectRoot);
+  const next = applyBacklogTransition(content, item.id, item.status, to, progress);
+  if (!next.success) {
+    return { ok: false, error: next.error.message };
+  }
+  await persistBacklog(projectRoot, next.data);
+  return { ok: true };
+}
+function findCard(state, cardId) {
+  return state.taskCards.find((c) => c.id === cardId);
+}
+function itemCards(state, backlogId) {
+  return state.taskCards.filter((c) => c.backlogId === backlogId);
+}
 async function handleValidate(projectRoot) {
   const loadResult = await loadBacklog(projectRoot);
   if (!loadResult.success) {
@@ -23001,7 +24325,10 @@ async function handleScan(projectRoot) {
       lastScanAt: new Date().toISOString(),
       itemSnapshots: snapshots
     };
-    await writeOpenspecState(projectRoot, state);
+    const written = await persistState(projectRoot, state);
+    if (!written.ok) {
+      return fail("openspec scan", [written.error]);
+    }
   }
   return {
     code: 0,
@@ -23041,7 +24368,13 @@ async function handlePlan(projectRoot, itemId) {
     changePaths: {},
     itemSnapshots: {}
   };
-  const taskCards = planTaskCardsForItem(item, doc, existingState.taskCards);
+  if (item.status !== "PLANNED" && !canTransition(item.status, "PLANNED")) {
+    return fail("openspec plan", [
+      `Illegal backlog transition for ${item.id}: ${item.status} → PLANNED.`
+    ]);
+  }
+  const planned = planTaskCardsForItem(item, doc, existingState.taskCards, existingState.itemSnapshots?.[item.id]);
+  const taskCards = planned.cards;
   await ensureOpenspecConfig(projectRoot);
   const changePath = await generateOpenspecChange(projectRoot, item, taskCards);
   const newState = {
@@ -23052,16 +24385,22 @@ async function handlePlan(projectRoot, itemId) {
     changePaths: {
       ...existingState.changePaths,
       [item.id]: changePath
+    },
+    itemSnapshots: {
+      ...existingState.itemSnapshots,
+      [item.id]: serializeItemSnapshot(item)
     }
   };
-  await writeOpenspecState(projectRoot, newState);
-  const backlogPath = resolve25(projectRoot, BACKLOG_FILENAME);
-  let content = await readFile26(backlogPath, "utf-8");
-  content = updateBacklogItemInMarkdown(content, item.id, {
-    status: "PLANNED",
-    progress: item.progress
-  });
-  await writeFile17(backlogPath, content, "utf-8");
+  const written = await persistState(projectRoot, newState);
+  if (!written.ok) {
+    return fail("openspec plan", [written.error]);
+  }
+  const content = await readBacklogMarkdown(projectRoot);
+  const transition = applyBacklogTransition(content, item.id, item.status, "PLANNED", item.progress);
+  if (!transition.success) {
+    return fail("openspec plan", [transition.error.message]);
+  }
+  await persistBacklog(projectRoot, transition.data);
   return {
     code: 0,
     data: {
@@ -23070,7 +24409,9 @@ async function handlePlan(projectRoot, itemId) {
       itemId: item.id,
       title: item.title,
       changePath,
-      taskCards
+      taskCards,
+      invalidatedCards: planned.invalidatedCards,
+      tddImpact: planned.tddImpact
     }
   };
 }
@@ -23119,23 +24460,244 @@ async function handleNext2(projectRoot) {
       }
     };
   }
-  let loop = undefined;
-  if (shouldRunAgentLoop(undefined, next.agent, next.phase)) {
-    loop = await runLoopForProject(projectRoot, {
-      taskTitle: next.title,
-      originalTask: next.prompt
-    });
+  let loop = undefined;
+  if (shouldRunAgentLoop(undefined, next.agent, next.phase)) {
+    loop = await runLoopForProject(projectRoot, {
+      taskTitle: next.title,
+      originalTask: next.prompt
+    });
+  }
+  return {
+    code: loop && !loop.success ? 1 : 0,
+    data: {
+      success: !(loop && !loop.success),
+      command: "openspec next",
+      taskCard: next,
+      ...loop ? { loop } : {}
+    }
+  };
+}
+async function loadStateOrFail(projectRoot, command) {
+  const stateResult = await loadOpenspecState(projectRoot);
+  if (!stateResult.success) {
+    return { ok: false, response: fail(command, [stateResult.error.message]) };
+  }
+  return { ok: true, state: stateResult.data };
+}
+async function loadItemOrFail(projectRoot, itemId, command) {
+  const loadResult = await loadBacklog(projectRoot);
+  if (!loadResult.success) {
+    return { ok: false, response: fail(command, [loadResult.error.message]) };
+  }
+  const item = loadResult.data.items.find((i) => i.id === itemId) ?? loadResult.data.archive.find((i) => i.id === itemId);
+  if (!item) {
+    return { ok: false, response: fail(command, [`Backlog item ${itemId} not found`]) };
+  }
+  return {
+    ok: true,
+    item,
+    reviewRequired: loadResult.data.global.reviewRequired
+  };
+}
+async function handleStart(projectRoot, cardId) {
+  const command = "openspec start";
+  if (!cardId) {
+    return fail(command, ["Missing card id. Usage: openspec start <cardId>"]);
+  }
+  const loaded = await loadStateOrFail(projectRoot, command);
+  if (!loaded.ok)
+    return loaded.response;
+  const card = findCard(loaded.state, cardId);
+  if (!card) {
+    return fail(command, [`Task card ${cardId} not found`]);
+  }
+  if (card.status !== "pending" && card.status !== "doing") {
+    return fail(command, [`Card ${cardId} cannot start from status ${card.status}`]);
+  }
+  const itemLoaded = await loadItemOrFail(projectRoot, card.backlogId, command);
+  if (!itemLoaded.ok)
+    return itemLoaded.response;
+  let state = loaded.state;
+  if (card.status === "pending") {
+    state = setTaskCardStatus(state, cardId, "doing");
+    const written = await persistState(projectRoot, state);
+    if (!written.ok)
+      return fail(command, [written.error]);
+  }
+  const transition = await transitionItem(projectRoot, itemLoaded.item, "IN_PROGRESS", itemLoaded.item.progress);
+  if (!transition.ok)
+    return fail(command, [transition.error]);
+  return {
+    code: 0,
+    data: {
+      success: true,
+      command,
+      cardId,
+      cardStatus: "doing",
+      itemId: itemLoaded.item.id,
+      itemStatus: "IN_PROGRESS"
+    }
+  };
+}
+async function handleDone(projectRoot, cardId) {
+  const command = "openspec done";
+  if (!cardId) {
+    return fail(command, ["Missing card id. Usage: openspec done <cardId>"]);
+  }
+  const loaded = await loadStateOrFail(projectRoot, command);
+  if (!loaded.ok)
+    return loaded.response;
+  const card = findCard(loaded.state, cardId);
+  if (!card) {
+    return fail(command, [`Task card ${cardId} not found`]);
+  }
+  if (card.status === "done") {
+    return {
+      code: 0,
+      data: { success: true, command, cardId, cardStatus: "done", alreadyDone: true }
+    };
+  }
+  if (card.status !== "doing") {
+    return fail(command, [`Card ${cardId} must be doing before done (got ${card.status})`]);
+  }
+  const itemLoaded = await loadItemOrFail(projectRoot, card.backlogId, command);
+  if (!itemLoaded.ok)
+    return itemLoaded.response;
+  const state = setTaskCardStatus(loaded.state, cardId, "done");
+  const cards = itemCards(state, card.backlogId);
+  const doneCount = cards.filter((c) => c.status === "done").length;
+  const progress = cards.length === 0 ? 0 : Math.round(doneCount / cards.length * 100);
+  const allDone = cards.length > 0 && doneCount === cards.length;
+  const written = await persistState(projectRoot, state);
+  if (!written.ok)
+    return fail(command, [written.error]);
+  const changePath = state.changePaths[card.backlogId];
+  if (changePath) {
+    await writeTasksMarkdown(projectRoot, changePath, cards);
+  }
+  const nextStatus = allDone ? "REVIEW" : "IN_PROGRESS";
+  const transition = await transitionItem(projectRoot, itemLoaded.item, nextStatus, progress);
+  if (!transition.ok)
+    return fail(command, [transition.error]);
+  return {
+    code: 0,
+    data: {
+      success: true,
+      command,
+      cardId,
+      cardStatus: "done",
+      itemId: itemLoaded.item.id,
+      progress,
+      itemStatus: nextStatus,
+      allCardsDone: allDone
+    }
+  };
+}
+async function handleBlock(projectRoot, cardId, reason) {
+  const command = "openspec block";
+  if (!cardId) {
+    return fail(command, ["Missing card id. Usage: openspec block <cardId> --reason <text>"]);
+  }
+  if (!reason || !reason.trim()) {
+    return fail(command, ["--reason is required"]);
+  }
+  const loaded = await loadStateOrFail(projectRoot, command);
+  if (!loaded.ok)
+    return loaded.response;
+  const card = findCard(loaded.state, cardId);
+  if (!card) {
+    return fail(command, [`Task card ${cardId} not found`]);
+  }
+  const itemLoaded = await loadItemOrFail(projectRoot, card.backlogId, command);
+  if (!itemLoaded.ok)
+    return itemLoaded.response;
+  const state = setTaskCardStatus(loaded.state, cardId, "blocked");
+  const written = await persistState(projectRoot, state);
+  if (!written.ok)
+    return fail(command, [written.error]);
+  const transition = await transitionItem(projectRoot, itemLoaded.item, "BLOCKED");
+  if (!transition.ok)
+    return fail(command, [transition.error]);
+  return {
+    code: 0,
+    data: {
+      success: true,
+      command,
+      cardId,
+      cardStatus: "blocked",
+      itemId: itemLoaded.item.id,
+      itemStatus: "BLOCKED",
+      reason: reason.trim()
+    }
+  };
+}
+async function handleArchive(projectRoot, itemId) {
+  const command = "openspec archive";
+  if (!itemId) {
+    return fail(command, ["Missing item id. Usage: openspec archive <itemId>"]);
+  }
+  const loaded = await loadStateOrFail(projectRoot, command);
+  if (!loaded.ok)
+    return loaded.response;
+  const itemLoaded = await loadItemOrFail(projectRoot, itemId, command);
+  if (!itemLoaded.ok)
+    return itemLoaded.response;
+  const cards = itemCards(loaded.state, itemId);
+  if (cards.length === 0) {
+    return fail(command, [`No task cards found for ${itemId}. Run openspec plan first.`]);
+  }
+  const unfinished = cards.filter((c) => c.status !== "done");
+  if (unfinished.length > 0) {
+    return fail(command, [
+      `Cannot archive ${itemId}: ${unfinished.length} card(s) are not done (${unfinished.map((c) => c.id).join(", ")})`
+    ]);
+  }
+  if (itemLoaded.reviewRequired) {
+    const reviewCard = cards.find((c) => c.phase === "review");
+    if (!reviewCard || reviewCard.status !== "done") {
+      return fail(command, [
+        `Cannot archive ${itemId}: global.reviewRequired needs the review phase card done`
+      ]);
+    }
+  }
+  if (itemLoaded.item.status !== "DONE") {
+    const toDone = await transitionItem(projectRoot, itemLoaded.item, "DONE", 100);
+    if (!toDone.ok)
+      return fail(command, [toDone.error]);
+  }
+  const content = await readBacklogMarkdown(projectRoot);
+  const archived = archiveItemInMarkdown(content, itemId);
+  await persistBacklog(projectRoot, archived);
+  let archivedPath;
+  const changePath = loaded.state.changePaths[itemId];
+  if (changePath && !changePath.includes("/archive/")) {
+    try {
+      archivedPath = await archiveChangeFolder(projectRoot, changePath);
+    } catch (e) {
+      return fail(command, [
+        `Backlog archived but change folder move failed: ${e instanceof Error ? e.message : String(e)}`
+      ]);
+    }
   }
+  const nextState = {
+    ...loaded.state,
+    activeItemId: loaded.state.activeItemId === itemId ? undefined : loaded.state.activeItemId,
+    changePaths: archivedPath ? { ...loaded.state.changePaths, [itemId]: archivedPath } : loaded.state.changePaths
+  };
+  const written = await persistState(projectRoot, nextState);
+  if (!written.ok)
+    return fail(command, [written.error]);
   return {
-    code: loop && !loop.success ? 1 : 0,
+    code: 0,
     data: {
-      success: !(loop && !loop.success),
-      command: "openspec next",
-      taskCard: next,
-      ...loop ? { loop } : {}
+      success: true,
+      command,
+      itemId,
+      archivedPath: archivedPath ?? changePath
     }
   };
 }
+var KNOWN_SUBCOMMANDS = "validate, scan, plan, status, next, start, done, block, archive";
 var init_openspec_command = __esm(() => {
   init_backlog_parser();
   init_backlog_validator();
@@ -23543,13 +25105,13 @@ function ccGainToScorecardImpact(result) {
 }
 
 // src/core/evaluation/scorecard-signals.ts
-import { execSync as execSync3 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 function collectScorecardSignals(projectRoot, scopeFiles) {
   const findings = [];
   const overrides = {};
   let diff = "";
   try {
-    diff = execSync3("git diff HEAD", {
+    diff = execFileSync3("git", ["diff", "HEAD"], {
       cwd: projectRoot,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -23608,11 +25170,11 @@ var init_scorecard_signals = __esm(() => {
 });
 
 // src/core/evaluation/execution-profile.ts
-import { readFile as readFile27 } from "node:fs/promises";
-import { resolve as resolve26 } from "node:path";
+import { readFile as readFile29 } from "node:fs/promises";
+import { resolve as resolve28 } from "node:path";
 async function loadExecutionProfile(projectRoot, defaultTarget = "opencode") {
   try {
-    const content = await readFile27(resolve26(projectRoot, PROFILE_FILE), "utf-8");
+    const content = await readFile29(resolve28(projectRoot, PROFILE_FILE), "utf-8");
     const data = $parse(content);
     return ExecutionProfileSchema.parse(data);
   } catch {
@@ -23692,14 +25254,14 @@ var init_execution_profile = __esm(() => {
 });
 
 // src/core/evaluation/prompt-diff.ts
-import { readFile as readFile28, readdir as readdir6 } from "node:fs/promises";
-import { join as join19, resolve as resolve27 } from "node:path";
+import { readFile as readFile30, readdir as readdir7 } from "node:fs/promises";
+import { join as join20, resolve as resolve29 } from "node:path";
 function normalizeVersion(v) {
   return v.startsWith("v") ? v : `v${v}`;
 }
 async function listPromptFiles(dir) {
   try {
-    const entries = await readdir6(dir, { withFileTypes: true });
+    const entries = await readdir7(dir, { withFileTypes: true });
     return entries.filter((e) => e.isFile() && e.name.endsWith(".md")).map((e) => e.name);
   } catch {
     return [];
@@ -23742,30 +25304,30 @@ async function diffPromptVersions(fromVersion, toVersion, options = {}) {
   const fromV = normalizeVersion(fromVersion);
   const toV = normalizeVersion(toVersion);
   const searchRoots = [
-    resolve27(options.projectRoot ?? PACKAGE_ROOT, ".agents", "prompts"),
-    join19(ROOT_PRESETS_DIR, target, "prompts"),
-    join19(ROOT_PRESETS_DIR, "opencode", "prompts")
+    resolve29(options.projectRoot ?? PACKAGE_ROOT, ".agents", "prompts"),
+    join20(ROOT_PRESETS_DIR, target, "prompts"),
+    join20(ROOT_PRESETS_DIR, "opencode", "prompts")
   ];
   let fromDir = "";
   let toDir = "";
   for (const root of searchRoots) {
-    const f = join19(root, fromV);
-    const t = join19(root, toV);
+    const f = join20(root, fromV);
+    const t = join20(root, toV);
     try {
-      await readFile28(join19(f, "orchestrator.md"), "utf-8");
+      await readFile30(join20(f, "orchestrator.md"), "utf-8");
       fromDir = f;
       toDir = t;
       break;
     } catch {}
   }
   if (!fromDir) {
-    fromDir = join19(ROOT_PRESETS_DIR, "opencode", "prompts", fromV);
-    toDir = join19(ROOT_PRESETS_DIR, "opencode", "prompts", toV);
+    fromDir = join20(ROOT_PRESETS_DIR, "opencode", "prompts", fromV);
+    toDir = join20(ROOT_PRESETS_DIR, "opencode", "prompts", toV);
   } else {
     try {
-      await readFile28(join19(toDir, "orchestrator.md"), "utf-8");
+      await readFile30(join20(toDir, "orchestrator.md"), "utf-8");
     } catch {
-      toDir = join19(ROOT_PRESETS_DIR, "opencode", "prompts", toV);
+      toDir = join20(ROOT_PRESETS_DIR, "opencode", "prompts", toV);
     }
   }
   const fromFiles = await listPromptFiles(fromDir);
@@ -23783,12 +25345,12 @@ async function diffPromptVersions(fromVersion, toVersion, options = {}) {
     let oldText = "";
     let newText = "";
     try {
-      oldText = await readFile28(join19(fromDir, name), "utf-8");
+      oldText = await readFile30(join20(fromDir, name), "utf-8");
     } catch {
       oldText = "";
     }
     try {
-      newText = await readFile28(join19(toDir, name), "utf-8");
+      newText = await readFile30(join20(toDir, name), "utf-8");
     } catch {
       newText = "";
     }
@@ -23827,13 +25389,13 @@ var init_prompt_diff = __esm(() => {
 });
 
 // src/core/evaluation/regression-checklist.ts
-import { execFileSync } from "node:child_process";
-import { mkdir as mkdir19, readFile as readFile29, writeFile as writeFile18 } from "node:fs/promises";
-import { dirname as dirname6, resolve as resolve28 } from "node:path";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { mkdir as mkdir20, readFile as readFile31, writeFile as writeFile19 } from "node:fs/promises";
+import { dirname as dirname8, resolve as resolve30 } from "node:path";
 async function loadRegressionChecklist() {
   try {
-    const path = resolve28(ROOT_PRESETS_DIR, "templates", "regression-checklist.yml");
-    const content = await readFile29(path, "utf-8");
+    const path = resolve30(ROOT_PRESETS_DIR, "templates", "regression-checklist.yml");
+    const content = await readFile31(path, "utf-8");
     const data = $parse(content);
     return data.checks ?? [];
   } catch {
@@ -23847,7 +25409,7 @@ function runCheckCommand(cmd, cwd) {
   if (!file)
     return { passed: false, message: "Empty command" };
   try {
-    execFileSync(file, args, {
+    execFileSync4(file, args, {
       cwd,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"],
@@ -23888,9 +25450,9 @@ async function runRegressionChecklist(projectRoot, options = {}) {
       checks,
       timestamp: new Date().toISOString()
     };
-    const outPath = resolve28(projectRoot, ".codeconductor/evaluation/regression-last.json");
-    await mkdir19(dirname6(outPath), { recursive: true });
-    await writeFile18(outPath, JSON.stringify(report, null, 2), "utf-8");
+    const outPath = resolve30(projectRoot, ".codeconductor/evaluation/regression-last.json");
+    await mkdir20(dirname8(outPath), { recursive: true });
+    await writeFile19(outPath, JSON.stringify(report, null, 2), "utf-8");
     return ok(report);
   } catch (e) {
     return err(e instanceof Error ? e : new Error(String(e)));
@@ -23932,8 +25494,8 @@ var init_model_comparison = __esm(() => {
 });
 
 // src/core/evaluation/cost-quality-matrix.ts
-import { writeFile as writeFile19 } from "node:fs/promises";
-import { resolve as resolve29 } from "node:path";
+import { writeFile as writeFile20 } from "node:fs/promises";
+import { resolve as resolve31 } from "node:path";
 async function buildCostQualityMatrix(projectRoot, outcomes) {
   const agg = aggregateOutcomes(outcomes);
   const rows = Object.entries(agg.byModel).map(([model, entry]) => {
@@ -23953,7 +25515,7 @@ async function buildCostQualityMatrix(projectRoot, outcomes) {
     rows
   };
   const dir = await ensureEvaluationDir(projectRoot);
-  await writeFile19(resolve29(dir, "matrix.yml"), $stringify(matrix), "utf-8");
+  await writeFile20(resolve31(dir, "matrix.yml"), $stringify(matrix), "utf-8");
   return matrix;
 }
 function formatMatrixMarkdown(matrix) {
@@ -23976,13 +25538,385 @@ var init_cost_quality_matrix = __esm(() => {
   init_outcome_store();
 });
 
+// src/core/evaluation/harness-experiment.ts
+import { existsSync as existsSync7 } from "node:fs";
+import { cp, mkdir as mkdir21, readFile as readFile32, readdir as readdir8, writeFile as writeFile21 } from "node:fs/promises";
+import { dirname as dirname9, join as join21, resolve as resolve32 } from "node:path";
+function experimentDir(projectRoot, experimentId) {
+  return resolve32(projectRoot, EVAL_DIR2, EXPERIMENTS_DIR, experimentId);
+}
+function experimentYamlPath(projectRoot, experimentId) {
+  return join21(experimentDir(projectRoot, experimentId), "experiment.yml");
+}
+async function loadHarnessSuite(projectRoot, suiteId, suitePath) {
+  const candidates = suitePath ? [suitePath] : [
+    resolve32(projectRoot, "eval", "suites", suiteId, "suite.yml"),
+    resolve32(projectRoot, EVAL_DIR2, "suites", suiteId, "suite.yml")
+  ];
+  for (const path of candidates) {
+    if (!existsSync7(path))
+      continue;
+    try {
+      const suite = HarnessSuiteSchema.parse($parse(await readFile32(path, "utf-8")));
+      return ok({ ...suite, path });
+    } catch (e) {
+      return err(e instanceof Error ? e : new Error(String(e)));
+    }
+  }
+  return err(new Error(`Harness suite not found: ${suiteId}`));
+}
+async function loadExperiment(projectRoot, experimentId) {
+  try {
+    const raw = await readFile32(experimentYamlPath(projectRoot, experimentId), "utf-8");
+    return ok(HarnessExperimentSchema.parse($parse(raw)));
+  } catch (e) {
+    if (e.code === "ENOENT") {
+      return err(new Error(`Experiment not found: ${experimentId}`));
+    }
+    return err(e instanceof Error ? e : new Error(String(e)));
+  }
+}
+async function listExperiments(projectRoot) {
+  const root = resolve32(projectRoot, EVAL_DIR2, EXPERIMENTS_DIR);
+  if (!existsSync7(root))
+    return [];
+  const ids = await readdir8(root);
+  const experiments = [];
+  for (const id of ids) {
+    const loaded = await loadExperiment(projectRoot, id);
+    if (loaded.success)
+      experiments.push(loaded.data);
+  }
+  return experiments;
+}
+function formatTaskCard(task, experimentId, variantId) {
+  return [
+    "## Task Card",
+    "",
+    `**Title:** ${task.title}`,
+    `**Type:** ${task.type}`,
+    `**Risk:** ${task.risk}`,
+    `**Scope:** ${task.scope}`,
+    `**suiteTaskId:** ${task.id}`,
+    `**experimentId:** ${experimentId}`,
+    `**variantId:** ${variantId}`,
+    "",
+    "### Context",
+    "",
+    task.prompt,
+    "",
+    "### Acceptance Criteria",
+    "",
+    ...task.acceptanceCriteria.map((c) => `- [ ] ${c}`),
+    "",
+    "### Constraints",
+    "",
+    "- Stay inside the declared scope.",
+    "- Record the outcome with experiment and variant tags.",
+    "",
+    "### Scoring",
+    "",
+    "When done:",
+    "",
+    "```",
+    `bun run dev scorecard create --task ${task.id} --from-diff`,
+    `bun run dev scorecard record --task ${task.id} --verdict PASS|REVISE|REJECT --score <n> --experiment ${experimentId} --variant ${variantId} --suite-task ${task.id}`,
+    "```",
+    task.testCommand ? `
+Fixture test command: \`${task.testCommand}\`
+` : ""
+  ].join(`
+`);
+}
+function formatExperimentMarkdown(experiment) {
+  return [
+    `# Harness experiment ${experiment.id}`,
+    "",
+    `- Suite: ${experiment.suiteId}`,
+    `- Contract: ${experiment.contractVersion}`,
+    `- Created: ${experiment.createdAt}`,
+    `- Variants: ${experiment.variants.join(", ")}`,
+    `- Tasks: ${experiment.suiteTaskIds.join(", ")}`,
+    "",
+    "This runner does not invoke a model. Execute each run directory with the host",
+    "agent, then `scorecard record` with `--experiment` and `--variant`.",
+    "",
+    "Compare with:",
+    "",
+    "```",
+    `bun run dev scorecard ablation --experiment ${experiment.id}`,
+    "```",
+    ""
+  ].join(`
+`);
+}
+function generateExperimentId(suiteId, now = new Date) {
+  const date = now.toISOString().slice(0, 10).replaceAll("-", "");
+  const rand = Math.random().toString(36).slice(2, 6);
+  return `abl-${date}-${suiteId}-${rand}`;
+}
+async function copyFixture(suitePath, fixtureDir, dest) {
+  const source = fixtureDir ? resolve32(dirname9(suitePath), fixtureDir) : join21(dirname9(suitePath), "fixture");
+  await mkdir21(dest, { recursive: true });
+  if (existsSync7(source)) {
+    await cp(source, dest, { recursive: true });
+  }
+}
+async function startHarnessExperiment(projectRoot, options) {
+  const suite = await loadHarnessSuite(projectRoot, options.suiteId, options.suitePath);
+  if (!suite.success)
+    return suite;
+  const experimentId = options.experimentId ?? generateExperimentId(suite.data.id);
+  const variants = ["baseline", ...options.components.map((id) => variantIdFor(id))];
+  const experiment = {
+    id: experimentId,
+    suiteId: suite.data.id,
+    createdAt: new Date().toISOString(),
+    contractVersion: options.contractVersion,
+    components: options.components,
+    variants,
+    suiteTaskIds: suite.data.tasks.map((t) => t.id),
+    suitePath: suite.data.path
+  };
+  const root = experimentDir(projectRoot, experimentId);
+  await mkdir21(root, { recursive: true });
+  await writeFile21(experimentYamlPath(projectRoot, experimentId), $stringify(experiment), "utf-8");
+  await writeFile21(join21(root, "EXPERIMENT.md"), formatExperimentMarkdown(experiment), "utf-8");
+  for (const task of suite.data.tasks) {
+    for (const variantId of variants) {
+      const runRoot = join21(root, "runs", task.id, variantDirName(variantId));
+      await copyFixture(suite.data.path, suite.data.fixtureDir, runRoot);
+      await writeConfig(runRoot, structuredClone(DEFAULT_CONFIG), true);
+      const disabled = variantId === "baseline" ? [] : options.components.filter((id) => variantIdFor(id) === variantId);
+      const overlay = await applyHarnessOverlay(runRoot, disabled, {
+        experimentId,
+        variantId,
+        contractVersion: options.contractVersion,
+        backup: false
+      });
+      if (!overlay.success)
+        return overlay;
+      await writeFile21(join21(runRoot, "TASK.md"), formatTaskCard(task, experimentId, variantId), "utf-8");
+    }
+  }
+  return ok(experiment);
+}
+async function applyExperimentVariant(projectRoot, experimentId, variantId, contractVersion) {
+  const loaded = await loadExperiment(projectRoot, experimentId);
+  if (!loaded.success)
+    return loaded;
+  if (!loaded.data.variants.includes(variantId)) {
+    return err(new Error(`Unknown variant ${variantId} for ${experimentId}`));
+  }
+  const disabled = variantId === "baseline" ? [] : loaded.data.components.filter((id) => variantIdFor(id) === variantId);
+  const overlay = await applyHarnessOverlay(projectRoot, disabled, {
+    experimentId,
+    variantId,
+    contractVersion,
+    backup: true
+  });
+  if (!overlay.success)
+    return overlay;
+  return ok(loaded.data);
+}
+var EXPERIMENTS_DIR = "experiments";
+var init_harness_experiment = __esm(() => {
+  init_dist();
+  init_schemas();
+  init_codeconductor_config();
+  init_config_writer();
+  init_harness_catalog();
+});
+
+// src/core/evaluation/ablation-report.ts
+import { mkdir as mkdir22, writeFile as writeFile22 } from "node:fs/promises";
+import { resolve as resolve33 } from "node:path";
+function isPass(o) {
+  return o.verdict === "PASS" || o.status === "pass";
+}
+function mean(values) {
+  if (values.length === 0)
+    return;
+  return values.reduce((s, v) => s + v, 0) / values.length;
+}
+function metricsFrom(outcomes, criteria) {
+  const scores = outcomes.map((o) => o.weightedScore).filter((n) => n !== undefined);
+  const costs = outcomes.map((o) => o.costUsd).filter((n) => n !== undefined);
+  const durations = outcomes.map((o) => o.durationMs).filter((n) => n !== undefined);
+  return {
+    count: outcomes.length,
+    avgScore: mean(scores) ?? 0,
+    passRate: outcomes.length > 0 ? outcomes.filter(isPass).length / outcomes.length : 0,
+    avgCost: mean(costs),
+    avgDurationMs: mean(durations),
+    criteria
+  };
+}
+function classifyAblation(deltaScore, deltaPassRate) {
+  const scoreNeutral = Math.abs(deltaScore) < SCORE_THRESHOLD;
+  const passNeutral = Math.abs(deltaPassRate) < PASS_RATE_THRESHOLD;
+  if (scoreNeutral && passNeutral)
+    return "no_change";
+  if (deltaScore <= -SCORE_THRESHOLD)
+    return "degrades";
+  if (deltaScore >= SCORE_THRESHOLD)
+    return "improves";
+  if (deltaPassRate <= -PASS_RATE_THRESHOLD)
+    return "degrades";
+  if (deltaPassRate >= PASS_RATE_THRESHOLD)
+    return "improves";
+  return "no_change";
+}
+async function averageCriteria(projectRoot, outcomes) {
+  const buckets = {};
+  for (const o of outcomes) {
+    if (!o.scorecardId)
+      continue;
+    const loaded = await loadScorecard(projectRoot, o.scorecardId);
+    if (!loaded.success)
+      continue;
+    for (const c of loaded.data.criteria) {
+      if (!buckets[c.id])
+        buckets[c.id] = [];
+      buckets[c.id].push(c.score);
+    }
+  }
+  const ids = Object.keys(buckets);
+  if (ids.length === 0)
+    return;
+  const avg = {};
+  for (const id of ids) {
+    avg[id] = mean(buckets[id]) ?? 0;
+  }
+  return avg;
+}
+async function buildAblationReport(projectRoot, outcomes, experimentId) {
+  const scoped = experimentId ? outcomes.filter((o) => o.experimentId === experimentId) : outcomes.filter((o) => o.variantId);
+  const byComponent = new Map;
+  const keyOf = (o) => o.suiteTaskId ?? o.taskId;
+  const treatmentIds = (o) => {
+    const fromField = o.disabledComponents?.filter((id) => catalogIds().includes(id));
+    if (fromField && fromField.length > 0)
+      return fromField;
+    return parseVariantId(o.variantId ?? "");
+  };
+  const baselines = scoped.filter((o) => o.variantId === "baseline");
+  const treatments = scoped.filter((o) => o.variantId && o.variantId !== "baseline");
+  const baselineKeys = new Set(baselines.map(keyOf));
+  for (const o of treatments) {
+    const ids = treatmentIds(o);
+    const hasPair = baselineKeys.has(keyOf(o)) || baselines.length > 0;
+    if (!hasPair)
+      continue;
+    for (const id of ids) {
+      if (!byComponent.has(id))
+        byComponent.set(id, { baseline: [], treatment: [] });
+      byComponent.get(id).treatment.push(o);
+    }
+  }
+  for (const [id, pair] of byComponent) {
+    const treatmentKeys = new Set(pair.treatment.map(keyOf));
+    const pairedBaselines = baselines.filter((o) => treatmentKeys.has(keyOf(o)));
+    pair.baseline = pairedBaselines.length > 0 ? pairedBaselines : baselines;
+  }
+  const rows = [];
+  for (const id of catalogIds()) {
+    const pair = byComponent.get(id);
+    if (!pair || pair.treatment.length === 0 || pair.baseline.length === 0)
+      continue;
+    const baselineCriteria = await averageCriteria(projectRoot, pair.baseline);
+    const treatmentCriteria = await averageCriteria(projectRoot, pair.treatment);
+    const baseline = metricsFrom(pair.baseline, baselineCriteria);
+    const treatment = metricsFrom(pair.treatment, treatmentCriteria);
+    const deltaScore = treatment.avgScore - baseline.avgScore;
+    const deltaPassRate = treatment.passRate - baseline.passRate;
+    const deltaCriteria = {};
+    const criterionIds = new Set([
+      ...Object.keys(baseline.criteria ?? {}),
+      ...Object.keys(treatment.criteria ?? {})
+    ]);
+    for (const cid of criterionIds) {
+      deltaCriteria[cid] = (treatment.criteria?.[cid] ?? 0) - (baseline.criteria?.[cid] ?? 0);
+    }
+    rows.push({
+      component: id,
+      variantId: `minus:${id}`,
+      baseline,
+      treatment,
+      deltaScore: Math.round(deltaScore * 1000) / 1000,
+      deltaPassRate: Math.round(deltaPassRate * 1000) / 1000,
+      deltaCost: baseline.avgCost !== undefined && treatment.avgCost !== undefined ? Math.round((treatment.avgCost - baseline.avgCost) * 1e4) / 1e4 : undefined,
+      deltaDurationMs: baseline.avgDurationMs !== undefined && treatment.avgDurationMs !== undefined ? Math.round(treatment.avgDurationMs - baseline.avgDurationMs) : undefined,
+      deltaCriteria,
+      verdict: classifyAblation(deltaScore, deltaPassRate)
+    });
+  }
+  return {
+    generatedAt: new Date().toISOString(),
+    experimentId,
+    outcomeCount: scoped.length,
+    pairedCount: rows.reduce((s, r) => s + Math.min(r.baseline.count, r.treatment.count), 0),
+    rows
+  };
+}
+function formatAblationMarkdown(report) {
+  const lines = [
+    "# Harness Ablation Report",
+    "",
+    `Generated: ${report.generatedAt}`,
+    report.experimentId ? `Experiment: ${report.experimentId}` : "Experiment: (all tagged outcomes)",
+    `Outcomes: ${report.outcomeCount}`,
+    "",
+    "| Component | Verdict | Δ score | Δ pass | Δ cost | Δ duration | Baseline n | Treatment n |",
+    "|-----------|---------|---------|--------|--------|------------|------------|-------------|"
+  ];
+  for (const row of report.rows) {
+    lines.push(`| ${row.component} | ${row.verdict} | ${row.deltaScore.toFixed(2)} | ${(row.deltaPassRate * 100).toFixed(0)}pp | ${row.deltaCost?.toFixed(4) ?? "—"} | ${row.deltaDurationMs ?? "—"} | ${row.baseline.count} | ${row.treatment.count} |`);
+  }
+  if (report.rows.length === 0) {
+    lines.push("| — | — | — | — | — | — | — | — |");
+    lines.push("", "No paired baseline/treatment outcomes yet.");
+  } else {
+    lines.push("", "## Criterion deltas", "");
+    for (const row of report.rows) {
+      const keys = Object.keys(row.deltaCriteria);
+      if (keys.length === 0)
+        continue;
+      lines.push(`### minus:${row.component}`);
+      for (const key of keys) {
+        const delta = row.deltaCriteria[key] ?? 0;
+        lines.push(`- ${key}: ${delta >= 0 ? "+" : ""}${delta.toFixed(2)}`);
+      }
+      lines.push("");
+    }
+    lines.push("## How to read", "");
+    lines.push(`- \`improves\`: removing the component raised score by ≥ ${SCORE_THRESHOLD} or pass rate by ≥ ${PASS_RATE_THRESHOLD * 100}pp.`);
+    lines.push(`- \`degrades\`: removing the component lowered score by ≥ ${SCORE_THRESHOLD} or pass rate by ≥ ${PASS_RATE_THRESHOLD * 100}pp.`);
+    lines.push(`- \`no_change\`: both deltas stay inside those thresholds.`);
+  }
+  return lines.join(`
+`);
+}
+async function persistAblationReport(projectRoot, markdown) {
+  const dir = resolve33(projectRoot, EVAL_DIR2);
+  await mkdir22(dir, { recursive: true });
+  const path = resolve33(dir, "ablation-last.md");
+  await writeFile22(path, markdown, "utf-8");
+  return path;
+}
+var SCORE_THRESHOLD = 0.1, PASS_RATE_THRESHOLD = 0.05;
+var init_ablation_report = __esm(() => {
+  init_harness_catalog();
+  init_outcome_store();
+});
+
 // src/commands/scorecard.command.ts
 var exports_scorecard_command = {};
 __export(exports_scorecard_command, {
   scorecardCommand: () => scorecardCommand
 });
-import { readFile as readFile30 } from "node:fs/promises";
-import { resolve as resolve30 } from "node:path";
+import { readFile as readFile33 } from "node:fs/promises";
+import { resolve as resolve34 } from "node:path";
 function contractVersion() {
   return package_default.version;
 }
@@ -24009,6 +25943,14 @@ async function scorecardCommand(options) {
       return handleMatrix(projectRoot);
     case "compare-models":
       return handleCompareModels(projectRoot, options);
+    case "catalog":
+      return handleCatalog(projectRoot);
+    case "fingerprint":
+      return handleFingerprint(projectRoot);
+    case "experiment":
+      return handleExperiment(projectRoot, options);
+    case "ablation":
+      return handleAblation(projectRoot, options);
     default:
       return {
         code: 1,
@@ -24016,7 +25958,7 @@ async function scorecardCommand(options) {
           success: false,
           command: "scorecard",
           errors: [
-            `Unknown subcommand: ${subcommand}. Use: create, show, record, list, aggregate, models, prompt-diff, regression, matrix, compare-models`
+            `Unknown subcommand: ${subcommand}. Use: create, show, record, list, aggregate, models, prompt-diff, regression, matrix, compare-models, catalog, fingerprint, experiment, ablation`
           ]
         }
       };
@@ -24085,6 +26027,12 @@ async function handleShow(projectRoot, id) {
 }
 async function handleRecord(projectRoot, options) {
   const taskId = options.taskId ?? "unknown-task";
+  const overlay = await readActiveOverlay(projectRoot);
+  const experimentId = options.experimentId ?? overlay?.experimentId;
+  const variantId = options.variantId ?? overlay?.variantId;
+  const suiteTaskId = options.suiteTaskId;
+  const disabled = overlay?.disabledComponents ?? (variantId ? parseVariantId(variantId) : undefined);
+  const fingerprint = experimentId || variantId ? harnessFingerprint(disabled ?? [], overlay?.contractVersion ?? contractVersion(), overlay?.ccepProfile ?? "feature") : undefined;
   const outcome = {
     id: generateEvalId("out"),
     taskId,
@@ -24099,6 +26047,11 @@ async function handleRecord(projectRoot, options) {
     costUsd: options.costUsd,
     tokensIn: options.tokens,
     durationMs: options.durationMs,
+    experimentId,
+    variantId,
+    suiteTaskId,
+    harnessFingerprint: fingerprint,
+    disabledComponents: disabled && disabled.length > 0 ? [...disabled] : disabled ? [] : undefined,
     status: options.verdict === "PASS" ? "pass" : options.verdict === "REJECT" ? "reject" : undefined
   };
   const result = await appendOutcome(projectRoot, outcome);
@@ -24113,7 +26066,10 @@ async function handleList(projectRoot, options) {
     model: options.model,
     taskId: options.taskId,
     since: options.since,
-    source: options.source
+    source: options.source,
+    experimentId: options.experimentId,
+    variantId: options.variantId,
+    suiteTaskId: options.suiteTaskId
   };
   const result = await listOutcomes(projectRoot, filter);
   if (!result.success) {
@@ -24125,7 +26081,13 @@ async function handleList(projectRoot, options) {
   };
 }
 async function handleAggregate(projectRoot, options) {
-  const filter = { since: options.since, agent: options.agent, model: options.model };
+  const filter = {
+    since: options.since,
+    agent: options.agent,
+    model: options.model,
+    experimentId: options.experimentId,
+    variantId: options.variantId
+  };
   const list = await listOutcomes(projectRoot, filter);
   if (!list.success) {
     return { code: 1, data: { success: false, errors: [list.error.message] } };
@@ -24206,13 +26168,13 @@ async function handleCompareModels(projectRoot, options) {
     outcomes = outcomes.filter((o) => options.modelsFilter.includes(o.model));
   }
   const markdown = generateModelComparisonMarkdown(outcomes, options.modelsFilter);
-  const templatePath = resolve30(projectRoot, ".codeconductor/evaluation/model-comparison-last.md");
+  const templatePath = resolve34(projectRoot, ".codeconductor/evaluation/model-comparison-last.md");
   try {
-    await readFile30(templatePath);
+    await readFile33(templatePath);
   } catch {}
-  const { writeFile: writeFile20, mkdir: mkdir20 } = await import("node:fs/promises");
-  await mkdir20(resolve30(projectRoot, ".codeconductor/evaluation"), { recursive: true });
-  await writeFile20(templatePath, markdown, "utf-8");
+  const { writeFile: writeFile23, mkdir: mkdir23 } = await import("node:fs/promises");
+  await mkdir23(resolve34(projectRoot, ".codeconductor/evaluation"), { recursive: true });
+  await writeFile23(templatePath, markdown, "utf-8");
   return {
     code: 0,
     data: {
@@ -24224,6 +26186,119 @@ async function handleCompareModels(projectRoot, options) {
     }
   };
 }
+async function handleCatalog(projectRoot) {
+  const catalog = await loadHarnessCatalog(projectRoot);
+  return {
+    code: 0,
+    data: { success: true, command: "scorecard catalog", catalog }
+  };
+}
+async function handleFingerprint(projectRoot) {
+  const snap = await currentFingerprint(projectRoot, contractVersion());
+  return {
+    code: 0,
+    data: {
+      success: true,
+      command: "scorecard fingerprint",
+      fingerprint: snap.fingerprint,
+      overlay: snap.overlay,
+      components: snap.states
+    }
+  };
+}
+async function handleExperiment(projectRoot, options) {
+  const action = options.experimentAction ?? "list";
+  if (action === "list") {
+    const experiments = await listExperiments(projectRoot);
+    return {
+      code: 0,
+      data: { success: true, command: "scorecard experiment list", experiments, count: experiments.length }
+    };
+  }
+  if (action === "show") {
+    if (!options.experimentId && !options.id) {
+      return { code: 1, data: { success: false, errors: ["Usage: scorecard experiment show <id>"] } };
+    }
+    const loaded = await loadExperiment(projectRoot, options.experimentId ?? options.id);
+    if (!loaded.success) {
+      return { code: 1, data: { success: false, errors: [loaded.error.message] } };
+    }
+    return { code: 0, data: { success: true, command: "scorecard experiment show", experiment: loaded.data } };
+  }
+  if (action === "start") {
+    const parsed = parseComponentsFlag(options.components);
+    if (!parsed.success) {
+      return { code: 1, data: { success: false, errors: [parsed.error.message] } };
+    }
+    const started = await startHarnessExperiment(projectRoot, {
+      suiteId: options.suiteId ?? "harness-v1",
+      suitePath: options.suitePath,
+      components: parsed.data,
+      contractVersion: contractVersion(),
+      experimentId: options.experimentId ?? options.id
+    });
+    if (!started.success) {
+      return { code: 1, data: { success: false, errors: [started.error.message] } };
+    }
+    return {
+      code: 0,
+      data: { success: true, command: "scorecard experiment start", experiment: started.data }
+    };
+  }
+  if (action === "apply") {
+    const experimentId = options.experimentId ?? options.id;
+    const variantId = options.variantId;
+    if (!experimentId || !variantId) {
+      return {
+        code: 1,
+        data: { success: false, errors: ["Usage: scorecard experiment apply --id <exp> --variant baseline|minus:<id>"] }
+      };
+    }
+    const applied = await applyExperimentVariant(projectRoot, experimentId, variantId, contractVersion());
+    if (!applied.success) {
+      return { code: 1, data: { success: false, errors: [applied.error.message] } };
+    }
+    return {
+      code: 0,
+      data: {
+        success: true,
+        command: "scorecard experiment apply",
+        experiment: applied.data,
+        variantId
+      }
+    };
+  }
+  return {
+    code: 1,
+    data: {
+      success: false,
+      errors: ["Usage: scorecard experiment start|apply|list|show"]
+    }
+  };
+}
+async function handleAblation(projectRoot, options) {
+  const filter = {
+    since: options.since,
+    experimentId: options.experimentId ?? options.id
+  };
+  const list = await listOutcomes(projectRoot, filter);
+  if (!list.success) {
+    return { code: 1, data: { success: false, errors: [list.error.message] } };
+  }
+  const report = await buildAblationReport(projectRoot, list.data, filter.experimentId);
+  const markdown = formatAblationMarkdown(report);
+  const path = await persistAblationReport(projectRoot, markdown);
+  return {
+    code: 0,
+    data: {
+      success: true,
+      command: "scorecard ablation",
+      report,
+      markdown,
+      path
+    }
+  };
+}
 var init_scorecard_command = __esm(() => {
   init_package();
   init_config_loader();
@@ -24235,6 +26310,9 @@ var init_scorecard_command = __esm(() => {
   init_regression_checklist();
   init_model_comparison();
   init_cost_quality_matrix();
+  init_harness_catalog();
+  init_harness_experiment();
+  init_ablation_report();
   init_backlog_parser();
 });
 
@@ -25538,7 +27616,7 @@ var exports_seo_audit_command = {};
 __export(exports_seo_audit_command, {
   seoAuditCommand: () => seoAuditCommand
 });
-import { join as join20 } from "node:path";
+import { join as join22 } from "node:path";
 async function seoAuditCommand(options) {
   const { url, sitemap, format, failOn, delay: delay2, output, followRedirects, force } = options;
   if (!url && !sitemap) {
@@ -25551,7 +27629,7 @@ async function seoAuditCommand(options) {
       }
     };
   }
-  const defaultMarkdownPath = output === undefined && format === "markdown" ? join20("seo-reports", `audit-report-${new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19)}.md`) : undefined;
+  const defaultMarkdownPath = output === undefined && format === "markdown" ? join22("seo-reports", `audit-report-${new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19)}.md`) : undefined;
   const outputPathToWrite = output ?? defaultMarkdownPath;
   if (outputPathToWrite !== undefined) {
     const preflightError = await preflightContainedOutput(options.projectRoot, outputPathToWrite, { force });
@@ -25814,7 +27892,7 @@ var init_seo_llms_command = __esm(() => {
   init_llms_generator();
 });
 
-// src/cli/main.ts
+// src/cli/execute.ts
 init_errors();
 
 // src/cli/router.ts
@@ -25940,9 +28018,10 @@ Published commands (package ${package_default.version}):
   ask                     Recommend a /cc: slash command from a natural-language problem
   cc-help                 Show preset inventory (skills, subagents, commands)
   debt-harvest / harvest  Scan source files for deferred debt items
-  ccep                    Compile and evaluate CCEP workflow contracts
-  openspec                OpenSpec loop: backlog + delivery (validate/scan/plan/status/next)
+  ccep                    CCEP contracts: parse/profile/validate/evaluate/consensus/taskcard
+  openspec                OpenSpec loop: validate/scan/plan/status/next/start/done/block/archive
   scorecard               Record and aggregate evaluation outcomes
+                          (catalog / fingerprint / experiment / ablation)
 
 v1.0.0 (in this repo, not in published ${package_default.version}):
   goal / cc-goal          Plan goal into task graph with dependencies
@@ -25978,7 +28057,7 @@ Orchestration loops:
   src/core/ccep/). Prefer /cc-iterative, /cc-triage, and /cc-handoff;
   other CCEP commands are supporting profiles.
   OpenSpec is a delivery loop (CLI openspec + /cc-openspec) on top of
-  BACKLOG.md — not only a scanner.
+  BACKLOG.md — not only a scanner. Author BACKLOG.md with /cc-backlog.
   runWorkflowPipeline() in src/core/pipeline/workflow-loop.ts is an
   experimental library-only 8-phase loop — not a shipped CLI runtime.
 
@@ -26020,14 +28099,23 @@ Examples:
   npx cc-codeconductor ccep profile council --output json
   npx cc-codeconductor ccep resolve --command feature "Add CRUD"
   npx cc-codeconductor ccep evaluate --command feature --input @planner.json
+  npx cc-codeconductor ccep consensus --input @verdicts.json
+  npx cc-codeconductor ccep taskcard --command feature --input @card.json
   npx cc-codeconductor openspec validate
   npx cc-codeconductor openspec scan
   npx cc-codeconductor openspec plan BC-001
   npx cc-codeconductor openspec status
   npx cc-codeconductor openspec next
+  npx cc-codeconductor openspec start BC-001-discover
+  npx cc-codeconductor openspec done BC-001-discover
+  npx cc-codeconductor openspec block BC-001-implement --reason "waiting on design"
+  npx cc-codeconductor openspec archive BC-001
   npx cc-codeconductor scorecard create --task BC-001 --from-diff
   npx cc-codeconductor scorecard models
   npx cc-codeconductor scorecard aggregate
+  npx cc-codeconductor scorecard catalog
+  npx cc-codeconductor scorecard experiment start --suite harness-v1 --components review
+  npx cc-codeconductor scorecard ablation --experiment <id>
   npx cc-codeconductor help
   npx cc-codeconductor ask "login fails with 500"
   npx cc-codeconductor cc-help --target opencode
@@ -26288,7 +28376,7 @@ async function routeCommand(args, projectRoot) {
       });
     }
     case "ccep": {
-      const validSubs = ["parse", "profile", "resolve", "compile", "validate", "evaluate"];
+      const validSubs = ["parse", "profile", "resolve", "compile", "validate", "evaluate", "consensus", "taskcard"];
       if (subcommand && !validSubs.includes(subcommand)) {
         return unknownSubcommand("ccep", subcommand, validSubs);
       }
@@ -26296,7 +28384,7 @@ async function routeCommand(args, projectRoot) {
       const workflowCommand = options.command || undefined;
       const requestParts = args.rest ?? [];
       const userRequest = ccepSub === "profile" && !workflowCommand ? requestParts[0] : ["compile", "resolve", "parse", "evaluate"].includes(ccepSub) ? requestParts.join(" ").trim() : requestParts.join(" ").trim();
-      const validateRest = (ccepSub === "validate" || ccepSub === "evaluate") && !options.input ? requestParts : undefined;
+      const validateRest = (ccepSub === "validate" || ccepSub === "evaluate" || ccepSub === "consensus" || ccepSub === "taskcard") && !options.input ? requestParts : undefined;
       const { ccepCommand: ccepCommand2 } = await Promise.resolve().then(() => (init_ccep_command(), exports_ccep_command));
       return ccepCommand2({
         subcommand: ccepSub,
@@ -26309,12 +28397,23 @@ async function routeCommand(args, projectRoot) {
         input: options.input,
         contextPath: options.context || options.contextPath,
         promptVersion: options["prompt-version"] || options.promptVersion,
+        config: options.config,
         rest: validateRest
       });
     }
     case "openspec":
     case "cc-openspec": {
-      const validSubs = ["validate", "scan", "plan", "status", "next"];
+      const validSubs = [
+        "validate",
+        "scan",
+        "plan",
+        "status",
+        "next",
+        "start",
+        "done",
+        "block",
+        "archive"
+      ];
       let openspecSub = "validate";
       let itemId = options.item || undefined;
       if (subcommand && validSubs.includes(subcommand)) {
@@ -26330,6 +28429,7 @@ async function routeCommand(args, projectRoot) {
       return openspecCommand2({
         subcommand: openspecSub,
         itemId,
+        reason: typeof options.reason === "string" ? options.reason : undefined,
         projectRoot,
         output: flags.output
       });
@@ -26346,7 +28446,11 @@ async function routeCommand(args, projectRoot) {
         "prompt-diff",
         "regression",
         "matrix",
-        "compare-models"
+        "compare-models",
+        "catalog",
+        "fingerprint",
+        "experiment",
+        "ablation"
       ];
       if (subcommand && !validSubs.includes(subcommand)) {
         return unknownSubcommand(command, subcommand, validSubs);
@@ -26361,7 +28465,7 @@ async function routeCommand(args, projectRoot) {
         subcommand: scorecardSub,
         projectRoot,
         output: flags.output,
-        id: scorecardSub === "show" ? args.rest?.[0] ?? options.id : options.id,
+        id: scorecardSub === "show" || scorecardSub === "ablation" ? args.rest?.[0] ?? options.id : options.id,
         taskId: options.task ?? options.item,
         agent: options.agent,
         model: options.model,
@@ -26376,7 +28480,14 @@ async function routeCommand(args, projectRoot) {
         weightedScore: options.score ? parseFloat(String(options.score)) : undefined,
         source: options.source,
         since: options.since,
-        modelsFilter
+        modelsFilter,
+        experimentId: options.experiment ?? (scorecardSub === "experiment" && args.rest?.[1] ? args.rest[1] : undefined) ?? (scorecardSub === "ablation" ? args.rest?.[0] : undefined),
+        variantId: options.variant,
+        suiteTaskId: options["suite-task"] ?? options.suiteTask,
+        suiteId: options.suite,
+        suitePath: options["suite-path"] ?? options.suitePath,
+        components: options.components,
+        experimentAction: scorecardSub === "experiment" ? args.rest?.[0] : undefined
       });
     }
     case "seo": {
@@ -26430,107 +28541,120 @@ async function routeCommand(args, projectRoot) {
   }
 }
 
-// src/cli/main.ts
-async function runCli(args) {
-  const parsed = parseArgs(args.slice(2));
+// src/cli/execute.ts
+async function executeCli(args, projectRoot) {
+  const parsed = parseArgs(args);
   if (parsed.flags.version) {
     console.log(getVersion());
-    process.exit(0);
+    return 0;
   }
   if (parsed.flags.help || !parsed.command || parsed.command === "help") {
     console.log(getHelp());
-    process.exit(0);
+    return 0;
   }
-  const projectRoot = process.cwd();
   try {
     const result = await routeCommand(parsed, projectRoot);
-    if (parsed.flags.output === "json") {
-      console.log(JSON.stringify(result.data, null, 2));
-    } else {
-      if (result.data) {
-        const data = result.data;
-        if ("help" in data) {
-          console.log(data.help);
-        } else if ("message" in data && typeof data.message === "string") {
-          console.log(data.message);
-        } else {
-          if ("errors" in data && Array.isArray(data.errors) && data.errors.length > 0) {
-            data.errors.forEach((e) => console.error(e));
-          }
-          if ("checks" in data) {
-            const checks = data.checks;
-            checks.forEach((c) => {
-              const icon = c.status === "pass" ? "✓" : c.status === "warn" ? "⚠" : "✗";
-              console.log(`${icon} ${c.name}: ${c.message}`);
-            });
-          } else if ("fileResults" in data) {
-            const fileResults = data.fileResults;
-            const actionIcon = {
-              written: "✓",
-              appended: "→",
-              merged: "~",
-              skipped: "∅",
-              error: "✗"
-            };
-            fileResults.forEach((r) => {
-              if (r.action === "skipped")
-                return;
-              const icon = actionIcon[r.action] ?? "?";
-              const prefix = r.dryRun ? "[dry-run] " : "";
-              const suffix = r.error ? `: ${r.error}` : "";
-              console.log(`${icon} ${prefix}${r.dest}${suffix}`);
-            });
-            const acted = fileResults.filter((r) => r.action !== "skipped");
-            const errCount = acted.filter((r) => r.action === "error").length;
-            const count = acted.length - errCount;
-            const note = data.dryRun ? " (dry-run)" : "";
-            console.log(`
+    emitCliResult(parsed, result);
+    return result.code;
+  } catch (error) {
+    emitCliError(parsed, error);
+    return getExitCode(error);
+  }
+}
+function emitCliResult(parsed, result) {
+  if (parsed.flags.output === "json") {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  if (!result.data) {
+    return;
+  }
+  const data = result.data;
+  if ("help" in data) {
+    console.log(data.help);
+    return;
+  }
+  if ("message" in data && typeof data.message === "string") {
+    console.log(data.message);
+    return;
+  }
+  if ("errors" in data && Array.isArray(data.errors) && data.errors.length > 0) {
+    data.errors.forEach((e) => console.error(e));
+  }
+  if ("checks" in data) {
+    const checks = data.checks;
+    checks.forEach((c) => {
+      const icon = c.status === "pass" ? "✓" : c.status === "warn" ? "⚠" : "✗";
+      console.log(`${icon} ${c.name}: ${c.message}`);
+    });
+  } else if ("fileResults" in data) {
+    const fileResults = data.fileResults;
+    const actionIcon = {
+      written: "✓",
+      appended: "→",
+      merged: "~",
+      skipped: "∅",
+      error: "✗"
+    };
+    fileResults.forEach((r) => {
+      if (r.action === "skipped")
+        return;
+      const icon = actionIcon[r.action] ?? "?";
+      const prefix = r.dryRun ? "[dry-run] " : "";
+      const suffix = r.error ? `: ${r.error}` : "";
+      console.log(`${icon} ${prefix}${r.dest}${suffix}`);
+    });
+    const acted = fileResults.filter((r) => r.action !== "skipped");
+    const errCount = acted.filter((r) => r.action === "error").length;
+    const count = acted.length - errCount;
+    const note = data.dryRun ? " (dry-run)" : "";
+    console.log(`
 ${count} files processed${errCount > 0 ? `, ${errCount} errors` : ""}${note}`);
-          } else if ("written" in data) {
-            const written = data.written;
-            if (written.length > 0) {
-              if ("targets" in data && Array.isArray(data.targets) && data.targets.length > 0) {
-                console.log(`Installed to: ${data.targets.join(", ")} (${written.length} files)`);
-              } else {
-                console.log(`Written ${written.length} files`);
-              }
-            }
-          } else if ("wouldCreate" in data) {
-            const items = data.wouldCreate;
-            console.log(`Would create ${items.length} files:`);
-            items.forEach((f) => console.log(`  + ${f}`));
-          } else if ("created" in data) {
-            console.log(`Created ${data.created.length} files`);
-          } else if ("detected" in data) {
-            console.log("Detected:");
-            const detected = data.detected;
-            Object.entries(detected).forEach(([key, value]) => {
-              if (Array.isArray(value) && value.length > 0) {
-                console.log(`  - ${key}: ${value.join(", ")}`);
-              } else if (typeof value === "string" && value.length > 0) {
-                console.log(`  - ${key}: ${value}`);
-              }
-            });
-          } else if ("output" in data && typeof data.output === "string") {
-            console.log(data.output);
-          }
-        }
+  } else if ("written" in data) {
+    const written = data.written;
+    if (written.length > 0) {
+      if ("targets" in data && Array.isArray(data.targets) && data.targets.length > 0) {
+        console.log(`Installed to: ${data.targets.join(", ")} (${written.length} files)`);
+      } else {
+        console.log(`Written ${written.length} files`);
+      }
+    }
+  } else if ("wouldCreate" in data) {
+    const items = data.wouldCreate;
+    console.log(`Would create ${items.length} files:`);
+    items.forEach((f) => console.log(`  + ${f}`));
+  } else if ("created" in data) {
+    console.log(`Created ${data.created.length} files`);
+  } else if ("detected" in data) {
+    console.log("Detected:");
+    const detected = data.detected;
+    Object.entries(detected).forEach(([key, value]) => {
+      if (Array.isArray(value) && value.length > 0) {
+        console.log(`  - ${key}: ${value.join(", ")}`);
+      } else if (typeof value === "string" && value.length > 0) {
+        console.log(`  - ${key}: ${value}`);
       }
-    }
-    process.exit(result.code);
-  } catch (error) {
-    const exitCode = getExitCode(error);
-    if (parsed.flags.output === "json") {
-      console.log(JSON.stringify({
-        success: false,
-        errors: [String(error)]
-      }, null, 2));
-    } else {
-      console.error(String(error));
-    }
-    process.exit(exitCode);
+    });
+  } else if ("output" in data && typeof data.output === "string") {
+    console.log(data.output);
   }
 }
+function emitCliError(parsed, error) {
+  if (parsed.flags.output === "json") {
+    console.log(JSON.stringify({
+      success: false,
+      errors: [String(error)]
+    }, null, 2));
+    return;
+  }
+  console.error(String(error));
+}
+
+// src/cli/main.ts
+async function runCli(args) {
+  const code = await executeCli(args.slice(2), process.cwd());
+  process.exit(code);
+}
 runCli(process.argv);
 export {
   runCli