codeharness 0.36.2 → 0.36.3

package/dist/index.js

@@ -40,7 +40,7 @@ import {
   validateDockerfile,
   warn,
   writeState
-} from "./chunk-374J3J3A.js";
+} from "./chunk-2FHBRGG7.js";
 
 // src/index.ts
 import { Command } from "commander";
@@ -149,7 +149,7 @@ function registerBridgeCommand(program) {
 
 // src/commands/run.ts
 import { existsSync as existsSync17 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 
 // src/modules/sprint/state.ts
 import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, renameSync, existsSync as existsSync5, unlinkSync } from "fs";
@@ -2507,9 +2507,9 @@ function resolveWorkflow(options) {
 }
 
 // src/lib/workflow-machine.ts
-import { setup, assign, fromPromise, createActor } from "xstate";
+import { setup, assign, fromPromise as fromPromise2, createActor } from "xstate";
 import { readFileSync as readFileSync13, existsSync as existsSync15, writeFileSync as writeFileSync8, mkdirSync as mkdirSync6, rmSync as rmSync2 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // src/lib/agent-dispatch.ts
 import { query } from "@anthropic-ai/claude-agent-sdk";
@@ -2550,257 +2550,6 @@ function checkCapabilityConflicts(workflow) {
   return warnings;
 }
 
-// src/lib/agents/model-resolver.ts
-function resolveModel(task, agent, driver) {
-  const taskModel = task.model?.trim() || void 0;
-  const agentModel = agent.model?.trim() || void 0;
-  if (taskModel) {
-    return taskModel;
-  }
-  if (agentModel) {
-    return agentModel;
-  }
-  if (!driver.defaultModel?.trim()) {
-    throw new Error(
-      "Driver has no default model: driver.defaultModel must be a non-empty string"
-    );
-  }
-  return driver.defaultModel;
-}
-
-// src/lib/agents/output-contract.ts
-import { writeFileSync as writeFileSync6, readFileSync as readFileSync10, renameSync as renameSync2, mkdirSync as mkdirSync2, existsSync as existsSync11 } from "fs";
-import { join as join8, resolve as resolve4 } from "path";
-function assertSafeComponent(value, label) {
-  if (!value || value.trim().length === 0) {
-    throw new Error(`${label} must be a non-empty string`);
-  }
-  if (value.includes("/") || value.includes("\\") || value.includes("..")) {
-    throw new Error(`${label} contains invalid path characters: ${value}`);
-  }
-}
-function contractFilePath(taskName, storyId, contractDir) {
-  assertSafeComponent(taskName, "taskName");
-  assertSafeComponent(storyId, "storyId");
-  const filePath = join8(contractDir, `${taskName}-${storyId}.json`);
-  const resolvedDir = resolve4(contractDir);
-  const resolvedFile = resolve4(filePath);
-  if (!resolvedFile.startsWith(resolvedDir)) {
-    throw new Error(`Path traversal detected: ${filePath} escapes ${contractDir}`);
-  }
-  return filePath;
-}
-function writeOutputContract(contract, contractDir) {
-  const finalPath = contractFilePath(contract.taskName, contract.storyId, contractDir);
-  const tmpPath2 = finalPath + ".tmp";
-  try {
-    mkdirSync2(contractDir, { recursive: true });
-    writeFileSync6(tmpPath2, JSON.stringify(contract, null, 2) + "\n", "utf-8");
-    renameSync2(tmpPath2, finalPath);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    throw new Error(`Failed to write output contract to ${finalPath}: ${message}`, { cause: err });
-  }
-}
-var OUTPUT_TRUNCATE_LIMIT = 2e3;
-function formatContractAsPromptContext(contract) {
-  const sections = [];
-  const costStr = contract.cost_usd != null ? `$${contract.cost_usd.toFixed(2)}` : "N/A";
-  const durationStr = `${(contract.duration_ms / 1e3).toFixed(1)}s`;
-  sections.push(
-    `### Context from Previous Task
-- **Task:** ${contract.taskName}
-- **Driver:** ${contract.driver}
-- **Model:** ${contract.model}
-- **Cost:** ${costStr}
-- **Duration:** ${durationStr}
-- **Timestamp:** ${contract.timestamp}`
-  );
-  if (contract.changedFiles.length > 0) {
-    const fileList = contract.changedFiles.map((f) => `- ${f}`).join("\n");
-    sections.push(`### Changed Files
-${fileList}`);
-  } else {
-    sections.push(`### Changed Files
-None`);
-  }
-  if (contract.testResults) {
-    const tr = contract.testResults;
-    const coverageStr = tr.coverage != null ? `${tr.coverage}%` : "N/A";
-    sections.push(
-      `### Test Results
-- **Passed:** ${tr.passed}
-- **Failed:** ${tr.failed}
-- **Coverage:** ${coverageStr}`
-    );
-  } else {
-    sections.push(`### Test Results
-No test results available`);
-  }
-  let outputText = contract.output;
-  if (outputText.length > OUTPUT_TRUNCATE_LIMIT) {
-    outputText = outputText.slice(0, OUTPUT_TRUNCATE_LIMIT) + " [truncated]";
-  }
-  if (outputText.length > 0) {
-    sections.push(`### Output Summary
-${outputText}`);
-  } else {
-    sections.push(`### Output Summary
-None`);
-  }
-  if (contract.acceptanceCriteria.length > 0) {
-    const acList = contract.acceptanceCriteria.map((ac) => `- **${ac.id}** (${ac.status}): ${ac.description}`).join("\n");
-    sections.push(`### Acceptance Criteria
-${acList}`);
-  } else {
-    sections.push(`### Acceptance Criteria
-None`);
-  }
-  return sections.join("\n\n");
-}
-function buildPromptWithContractContext(basePrompt, previousContract) {
-  if (!previousContract) {
-    return basePrompt;
-  }
-  const context = formatContractAsPromptContext(previousContract);
-  return `${basePrompt}
-
----
-
-## Previous Task Context
-
-${context}`;
-}
-
-// src/lib/source-isolation.ts
-import { mkdirSync as mkdirSync3, copyFileSync, existsSync as existsSync12, rmSync } from "fs";
-import { join as join9, basename } from "path";
-function sanitizeRunId(runId) {
-  let sanitized = runId.replace(/[^a-zA-Z0-9._-]/g, "_");
-  sanitized = sanitized.replace(/^\.+/, "");
-  if (sanitized.length === 0) {
-    throw new Error("Source isolation: runId is empty after sanitization");
-  }
-  return sanitized;
-}
-function deduplicateFilename(dir, name) {
-  if (!existsSync12(join9(dir, name))) {
-    return name;
-  }
-  const dotIdx = name.lastIndexOf(".");
-  const stem = dotIdx > 0 ? name.slice(0, dotIdx) : name;
-  const ext = dotIdx > 0 ? name.slice(dotIdx) : "";
-  let counter = 1;
-  let candidate;
-  do {
-    candidate = `${stem}-${counter}${ext}`;
-    counter++;
-  } while (existsSync12(join9(dir, candidate)));
-  return candidate;
-}
-async function createIsolatedWorkspace(options) {
-  const safeRunId = sanitizeRunId(options.runId);
-  const dir = `/tmp/codeharness-verify-${safeRunId}`;
-  const storyFilesDir = join9(dir, "story-files");
-  const verdictDir = join9(dir, "verdict");
-  if (existsSync12(dir)) {
-    rmSync(dir, { recursive: true, force: true });
-  }
-  mkdirSync3(storyFilesDir, { recursive: true });
-  mkdirSync3(verdictDir, { recursive: true });
-  for (const filePath of options.storyFiles) {
-    if (!existsSync12(filePath)) {
-      warn(`Source isolation: story file not found, skipping: ${filePath}`);
-      continue;
-    }
-    const name = deduplicateFilename(storyFilesDir, basename(filePath));
-    const dest = join9(storyFilesDir, name);
-    copyFileSync(filePath, dest);
-  }
-  const workspace = {
-    dir,
-    storyFilesDir,
-    verdictDir,
-    toDispatchOptions() {
-      return { cwd: dir };
-    },
-    async cleanup() {
-      if (existsSync12(dir)) {
-        rmSync(dir, { recursive: true, force: true });
-      }
-    }
-  };
-  return workspace;
-}
-
-// src/lib/trace-id.ts
-function sanitizeSegment(segment) {
-  return segment.replace(/[^a-zA-Z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
-}
-var MAX_SEGMENT_LENGTH = 128;
-function generateTraceId(runId, iteration, taskName) {
-  if (!Number.isInteger(iteration) || iteration < 0) {
-    throw new Error(
-      `generateTraceId: iteration must be a non-negative integer, got ${iteration}`
-    );
-  }
-  const safeRunId = sanitizeSegment(runId).slice(0, MAX_SEGMENT_LENGTH);
-  const safeTask = sanitizeSegment(taskName).slice(0, MAX_SEGMENT_LENGTH);
-  return `ch-${safeRunId}-${iteration}-${safeTask}`;
-}
-function formatTracePrompt(traceId) {
-  if (!traceId) {
-    throw new Error("formatTracePrompt: traceId must be a non-empty string");
-  }
-  return `[TRACE] trace_id=${traceId}
-Include this trace ID in all log output, metric labels, and trace spans for correlation.`;
-}
-function recordTraceId(traceId, state) {
-  if (!traceId) {
-    throw new Error("recordTraceId: traceId must be a non-empty string");
-  }
-  return {
-    ...state,
-    trace_ids: [...state.trace_ids ?? [], traceId]
-  };
-}
-
-// src/lib/session-manager.ts
-function resolveSessionId(boundary, key, state) {
-  if (boundary === "fresh") {
-    return void 0;
-  }
-  if (boundary !== "continue") {
-    return void 0;
-  }
-  return getLastSessionId(state, key.taskName, key.storyKey);
-}
-function recordSessionId(key, sessionId, state) {
-  if (!sessionId) {
-    throw new Error("recordSessionId: sessionId must be a non-empty string");
-  }
-  const checkpoint = {
-    task_name: key.taskName,
-    story_key: key.storyKey,
-    completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-    session_id: sessionId
-  };
-  return {
-    ...state,
-    tasks_completed: [...state.tasks_completed, checkpoint]
-  };
-}
-function getLastSessionId(state, taskName, storyKey) {
-  const tasks = state.tasks_completed;
-  for (let i = tasks.length - 1; i >= 0; i--) {
-    const cp = tasks[i];
-    if (cp.task_name === taskName && cp.story_key === storyKey && cp.session_id !== void 0) {
-      return cp.session_id;
-    }
-  }
-  return void 0;
-}
-
 // src/lib/verdict-parser.ts
 import Ajv2 from "ajv";
 
@@ -3005,71 +2754,12 @@ function evaluateProgress(scores) {
   };
 }
 
-// src/lib/telemetry-writer.ts
-import { appendFileSync, existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync11 } from "fs";
-import { join as join10 } from "path";
-var TELEMETRY_DIR = ".codeharness";
-var TELEMETRY_FILE = "telemetry.jsonl";
-function extractEpicId(storyKey) {
-  if (storyKey === "__run__") return "unknown";
-  const dash = storyKey.indexOf("-");
-  if (dash === -1) return storyKey;
-  return storyKey.slice(0, dash);
-}
-async function writeTelemetryEntry(ctx) {
-  const epicId = extractEpicId(ctx.storyKey);
-  const contract = ctx.outputContract;
-  const entry = {
-    version: 1,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    storyKey: ctx.storyKey,
-    epicId,
-    duration_ms: ctx.durationMs,
-    cost_usd: ctx.cost ?? null,
-    attempts: null,
-    acResults: contract?.acceptanceCriteria ? contract.acceptanceCriteria.map((ac) => ({
-      id: ac.id,
-      description: ac.description,
-      status: ac.status
-    })) : null,
-    filesChanged: contract?.changedFiles ? [...contract.changedFiles] : [],
-    testResults: contract?.testResults ? {
-      passed: contract.testResults.passed,
-      failed: contract.testResults.failed,
-      coverage: contract.testResults.coverage
-    } : null,
-    errors: []
-  };
-  const dir = join10(ctx.projectDir, TELEMETRY_DIR);
-  mkdirSync4(dir, { recursive: true });
-  appendFileSync(join10(dir, TELEMETRY_FILE), JSON.stringify(entry) + "\n");
-  return { success: true, output: `telemetry: entry written for ${ctx.storyKey}` };
-}
-
-// src/lib/null-task-registry.ts
-var registry2 = /* @__PURE__ */ new Map();
-function registerNullTask(name, handler) {
-  registry2.set(name, handler);
-}
-function getNullTask(name) {
-  return registry2.get(name);
-}
-function listNullTasks() {
-  return [...registry2.keys()];
-}
-registerNullTask("telemetry", writeTelemetryEntry);
-
 // src/lib/workflow-machine.ts
 import { parse as parse5 } from "yaml";
 
-// src/lib/evaluator.ts
-function formatCoverageContextMessage(coverage, target) {
-  return `Coverage already verified by engine: ${coverage}% (target: ${target}%). No re-run needed.`;
-}
-
 // src/lib/workflow-state.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "fs";
+import { join as join8 } from "path";
 import { parse as parse4, stringify } from "yaml";
 var STATE_DIR = ".codeharness";
 var STATE_FILE = "workflow-state.yaml";
@@ -3091,20 +2781,20 @@ function getDefaultWorkflowState() {
 }
 function writeWorkflowState(state, dir) {
   const baseDir = dir ?? process.cwd();
-  const stateDir = join11(baseDir, STATE_DIR);
-  mkdirSync5(stateDir, { recursive: true });
+  const stateDir = join8(baseDir, STATE_DIR);
+  mkdirSync2(stateDir, { recursive: true });
   const yamlContent = stringify(state, { nullStr: "null" });
-  writeFileSync7(join11(stateDir, STATE_FILE), yamlContent, "utf-8");
+  writeFileSync6(join8(stateDir, STATE_FILE), yamlContent, "utf-8");
 }
 function readWorkflowState(dir) {
   const baseDir = dir ?? process.cwd();
-  const filePath = join11(baseDir, STATE_DIR, STATE_FILE);
-  if (!existsSync14(filePath)) {
+  const filePath = join8(baseDir, STATE_DIR, STATE_FILE);
+  if (!existsSync11(filePath)) {
     return getDefaultWorkflowState();
   }
   let raw;
   try {
-    raw = readFileSync12(filePath, "utf-8");
+    raw = readFileSync10(filePath, "utf-8");
   } catch {
     warn("workflow-state.yaml could not be read \u2014 returning default state");
     return getDefaultWorkflowState();
@@ -3167,10 +2857,331 @@ function isValidWorkflowState(value) {
   return true;
 }
 
-// src/lib/workflow-machine.ts
-var HALT_ERROR_CODES = /* @__PURE__ */ new Set(["RATE_LIMIT", "NETWORK", "SDK_INIT"]);
-var DEFAULT_MAX_ITERATIONS = 5;
-var HEALTH_CHECK_TIMEOUT_MS = 5e3;
+// src/lib/workflow-actors.ts
+import { fromPromise } from "xstate";
+import { join as join12 } from "path";
+
+// src/lib/agents/model-resolver.ts
+function resolveModel(task, agent, driver) {
+  const taskModel = task.model?.trim() || void 0;
+  const agentModel = agent.model?.trim() || void 0;
+  if (taskModel) {
+    return taskModel;
+  }
+  if (agentModel) {
+    return agentModel;
+  }
+  if (!driver.defaultModel?.trim()) {
+    throw new Error(
+      "Driver has no default model: driver.defaultModel must be a non-empty string"
+    );
+  }
+  return driver.defaultModel;
+}
+
+// src/lib/agents/output-contract.ts
+import { writeFileSync as writeFileSync7, readFileSync as readFileSync11, renameSync as renameSync2, mkdirSync as mkdirSync3, existsSync as existsSync12 } from "fs";
+import { join as join9, resolve as resolve4 } from "path";
+function assertSafeComponent(value, label) {
+  if (!value || value.trim().length === 0) {
+    throw new Error(`${label} must be a non-empty string`);
+  }
+  if (value.includes("/") || value.includes("\\") || value.includes("..")) {
+    throw new Error(`${label} contains invalid path characters: ${value}`);
+  }
+}
+function contractFilePath(taskName, storyId, contractDir) {
+  assertSafeComponent(taskName, "taskName");
+  assertSafeComponent(storyId, "storyId");
+  const filePath = join9(contractDir, `${taskName}-${storyId}.json`);
+  const resolvedDir = resolve4(contractDir);
+  const resolvedFile = resolve4(filePath);
+  if (!resolvedFile.startsWith(resolvedDir)) {
+    throw new Error(`Path traversal detected: ${filePath} escapes ${contractDir}`);
+  }
+  return filePath;
+}
+function writeOutputContract(contract, contractDir) {
+  const finalPath = contractFilePath(contract.taskName, contract.storyId, contractDir);
+  const tmpPath2 = finalPath + ".tmp";
+  try {
+    mkdirSync3(contractDir, { recursive: true });
+    writeFileSync7(tmpPath2, JSON.stringify(contract, null, 2) + "\n", "utf-8");
+    renameSync2(tmpPath2, finalPath);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`Failed to write output contract to ${finalPath}: ${message}`, { cause: err });
+  }
+}
+var OUTPUT_TRUNCATE_LIMIT = 2e3;
+function formatContractAsPromptContext(contract) {
+  const sections = [];
+  const costStr = contract.cost_usd != null ? `$${contract.cost_usd.toFixed(2)}` : "N/A";
+  const durationStr = `${(contract.duration_ms / 1e3).toFixed(1)}s`;
+  sections.push(
+    `### Context from Previous Task
+- **Task:** ${contract.taskName}
+- **Driver:** ${contract.driver}
+- **Model:** ${contract.model}
+- **Cost:** ${costStr}
+- **Duration:** ${durationStr}
+- **Timestamp:** ${contract.timestamp}`
+  );
+  if (contract.changedFiles.length > 0) {
+    const fileList = contract.changedFiles.map((f) => `- ${f}`).join("\n");
+    sections.push(`### Changed Files
+${fileList}`);
+  } else {
+    sections.push(`### Changed Files
+None`);
+  }
+  if (contract.testResults) {
+    const tr = contract.testResults;
+    const coverageStr = tr.coverage != null ? `${tr.coverage}%` : "N/A";
+    sections.push(
+      `### Test Results
+- **Passed:** ${tr.passed}
+- **Failed:** ${tr.failed}
+- **Coverage:** ${coverageStr}`
+    );
+  } else {
+    sections.push(`### Test Results
+No test results available`);
+  }
+  let outputText = contract.output;
+  if (outputText.length > OUTPUT_TRUNCATE_LIMIT) {
+    outputText = outputText.slice(0, OUTPUT_TRUNCATE_LIMIT) + " [truncated]";
+  }
+  if (outputText.length > 0) {
+    sections.push(`### Output Summary
+${outputText}`);
+  } else {
+    sections.push(`### Output Summary
+None`);
+  }
+  if (contract.acceptanceCriteria.length > 0) {
+    const acList = contract.acceptanceCriteria.map((ac) => `- **${ac.id}** (${ac.status}): ${ac.description}`).join("\n");
+    sections.push(`### Acceptance Criteria
+${acList}`);
+  } else {
+    sections.push(`### Acceptance Criteria
+None`);
+  }
+  return sections.join("\n\n");
+}
+function buildPromptWithContractContext(basePrompt, previousContract) {
+  if (!previousContract) {
+    return basePrompt;
+  }
+  const context = formatContractAsPromptContext(previousContract);
+  return `${basePrompt}
+
+---
+
+## Previous Task Context
+
+${context}`;
+}
+
+// src/lib/source-isolation.ts
+import { mkdirSync as mkdirSync4, copyFileSync, existsSync as existsSync13, rmSync } from "fs";
+import { join as join10, basename } from "path";
+function sanitizeRunId(runId) {
+  let sanitized = runId.replace(/[^a-zA-Z0-9._-]/g, "_");
+  sanitized = sanitized.replace(/^\.+/, "");
+  if (sanitized.length === 0) {
+    throw new Error("Source isolation: runId is empty after sanitization");
+  }
+  return sanitized;
+}
+function deduplicateFilename(dir, name) {
+  if (!existsSync13(join10(dir, name))) {
+    return name;
+  }
+  const dotIdx = name.lastIndexOf(".");
+  const stem = dotIdx > 0 ? name.slice(0, dotIdx) : name;
+  const ext = dotIdx > 0 ? name.slice(dotIdx) : "";
+  let counter = 1;
+  let candidate;
+  do {
+    candidate = `${stem}-${counter}${ext}`;
+    counter++;
+  } while (existsSync13(join10(dir, candidate)));
+  return candidate;
+}
+async function createIsolatedWorkspace(options) {
+  const safeRunId = sanitizeRunId(options.runId);
+  const dir = `/tmp/codeharness-verify-${safeRunId}`;
+  const storyFilesDir = join10(dir, "story-files");
+  const verdictDir = join10(dir, "verdict");
+  if (existsSync13(dir)) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+  mkdirSync4(storyFilesDir, { recursive: true });
+  mkdirSync4(verdictDir, { recursive: true });
+  for (const filePath of options.storyFiles) {
+    if (!existsSync13(filePath)) {
+      warn(`Source isolation: story file not found, skipping: ${filePath}`);
+      continue;
+    }
+    const name = deduplicateFilename(storyFilesDir, basename(filePath));
+    const dest = join10(storyFilesDir, name);
+    copyFileSync(filePath, dest);
+  }
+  const workspace = {
+    dir,
+    storyFilesDir,
+    verdictDir,
+    toDispatchOptions() {
+      return { cwd: dir };
+    },
+    async cleanup() {
+      if (existsSync13(dir)) {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    }
+  };
+  return workspace;
+}
+
+// src/lib/trace-id.ts
+function sanitizeSegment(segment) {
+  return segment.replace(/[^a-zA-Z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+}
+var MAX_SEGMENT_LENGTH = 128;
+function generateTraceId(runId, iteration, taskName) {
+  if (!Number.isInteger(iteration) || iteration < 0) {
+    throw new Error(
+      `generateTraceId: iteration must be a non-negative integer, got ${iteration}`
+    );
+  }
+  const safeRunId = sanitizeSegment(runId).slice(0, MAX_SEGMENT_LENGTH);
+  const safeTask = sanitizeSegment(taskName).slice(0, MAX_SEGMENT_LENGTH);
+  return `ch-${safeRunId}-${iteration}-${safeTask}`;
+}
+function formatTracePrompt(traceId) {
+  if (!traceId) {
+    throw new Error("formatTracePrompt: traceId must be a non-empty string");
+  }
+  return `[TRACE] trace_id=${traceId}
+Include this trace ID in all log output, metric labels, and trace spans for correlation.`;
+}
+function recordTraceId(traceId, state) {
+  if (!traceId) {
+    throw new Error("recordTraceId: traceId must be a non-empty string");
+  }
+  return {
+    ...state,
+    trace_ids: [...state.trace_ids ?? [], traceId]
+  };
+}
+
+// src/lib/session-manager.ts
+function resolveSessionId(boundary, key, state) {
+  if (boundary === "fresh") {
+    return void 0;
+  }
+  if (boundary !== "continue") {
+    return void 0;
+  }
+  return getLastSessionId(state, key.taskName, key.storyKey);
+}
+function recordSessionId(key, sessionId, state) {
+  if (!sessionId) {
+    throw new Error("recordSessionId: sessionId must be a non-empty string");
+  }
+  const checkpoint = {
+    task_name: key.taskName,
+    story_key: key.storyKey,
+    completed_at: (/* @__PURE__ */ new Date()).toISOString(),
+    session_id: sessionId
+  };
+  return {
+    ...state,
+    tasks_completed: [...state.tasks_completed, checkpoint]
+  };
+}
+function getLastSessionId(state, taskName, storyKey) {
+  const tasks = state.tasks_completed;
+  for (let i = tasks.length - 1; i >= 0; i--) {
+    const cp = tasks[i];
+    if (cp.task_name === taskName && cp.story_key === storyKey && cp.session_id !== void 0) {
+      return cp.session_id;
+    }
+  }
+  return void 0;
+}
+
+// src/lib/telemetry-writer.ts
+import { appendFileSync, existsSync as existsSync14, mkdirSync as mkdirSync5, readFileSync as readFileSync12 } from "fs";
+import { join as join11 } from "path";
+var TELEMETRY_DIR = ".codeharness";
+var TELEMETRY_FILE = "telemetry.jsonl";
+function extractEpicId(storyKey) {
+  if (storyKey === "__run__") return "unknown";
+  const dash = storyKey.indexOf("-");
+  if (dash === -1) return storyKey;
+  return storyKey.slice(0, dash);
+}
+async function writeTelemetryEntry(ctx) {
+  const epicId = extractEpicId(ctx.storyKey);
+  const contract = ctx.outputContract;
+  const entry = {
+    version: 1,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    storyKey: ctx.storyKey,
+    epicId,
+    duration_ms: ctx.durationMs,
+    cost_usd: ctx.cost ?? null,
+    attempts: null,
+    acResults: contract?.acceptanceCriteria ? contract.acceptanceCriteria.map((ac) => ({
+      id: ac.id,
+      description: ac.description,
+      status: ac.status
+    })) : null,
+    filesChanged: contract?.changedFiles ? [...contract.changedFiles] : [],
+    testResults: contract?.testResults ? {
+      passed: contract.testResults.passed,
+      failed: contract.testResults.failed,
+      coverage: contract.testResults.coverage
+    } : null,
+    errors: []
+  };
+  const dir = join11(ctx.projectDir, TELEMETRY_DIR);
+  mkdirSync5(dir, { recursive: true });
+  appendFileSync(join11(dir, TELEMETRY_FILE), JSON.stringify(entry) + "\n");
+  return { success: true, output: `telemetry: entry written for ${ctx.storyKey}` };
+}
+
+// src/lib/null-task-registry.ts
+var registry2 = /* @__PURE__ */ new Map();
+function registerNullTask(name, handler) {
+  registry2.set(name, handler);
+}
+function getNullTask(name) {
+  return registry2.get(name);
+}
+function listNullTasks() {
+  return [...registry2.keys()];
+}
+registerNullTask("telemetry", writeTelemetryEntry);
+
+// src/lib/evaluator.ts
+function formatCoverageContextMessage(coverage, target) {
+  return `Coverage already verified by engine: ${coverage}% (target: ${target}%). No re-run needed.`;
+}
+
+// src/lib/workflow-actors.ts
+var TASK_PROMPTS = {
+  "create-story": (key) => `Create the story spec for ${key}. Read the epic definitions and architecture docs. Write a complete story file with acceptance criteria, tasks, and dev notes. CRITICAL: Every AC must be testable by a blind QA agent using ONLY a user guide + browser/API/CLI access. No AC should reference source code, internal data structures, or implementation details like O(1) complexity. Each AC must describe observable behavior that can be verified through UI interaction (agent-browser), API calls (curl), CLI commands (docker exec), or log inspection (docker logs). Wrap output in <story-spec>...</story-spec> tags.`,
+  "implement": (key) => `Implement story ${key}`,
+  "check": (key) => `Run automated checks for story ${key}. Run ONLY these commands: 1) \`npx vitest run\` (unit tests), 2) \`npm run lint\` (linter). Do NOT run \`npm test\` (BATS integration tests) \u2014 those require the installed CLI binary and Docker, which are not available in the sandbox. If vitest and lint both pass, include <verdict>pass</verdict>. If either fails, include <verdict>fail</verdict> with the actual error output. Only report failures from YOUR test run, not from previous sessions.`,
+  "review": (key) => `Review the implementation of story ${key}. Check for correctness, security issues, architecture violations, and AC coverage. Include <verdict>pass</verdict> or <verdict>fail</verdict> in your response. If fail, include <issues>...</issues>.`,
+  "document": (key) => `Write user documentation for story ${key}. Describe what was built and how to use it from a user's perspective. No source code. Wrap documentation in <user-docs>...</user-docs> tags.`,
+  "deploy": () => `Provision the Docker environment for this project. Check for docker-compose.yml, start containers, verify health. Wrap report in <deploy-report>...</deploy-report> tags with status, containers, URLs, credentials, health.`,
+  "verify": () => `Verify the epic's stories using the user docs and deploy info in ./story-files/. For each AC, derive verification steps, run commands, observe output. Include <verdict>pass</verdict> or <verdict>fail</verdict>. Include <evidence ac="N" status="pass|fail|unknown">...</evidence> per AC. Include <quality-scores>...</quality-scores>.`,
+  "retro": () => `Run a retrospective for this epic. Analyze what worked, what failed, patterns, and action items for next epic.`
+};
 var FILE_WRITE_TOOL_NAMES = /* @__PURE__ */ new Set([
   "Write",
   "Edit",
@@ -3181,16 +3192,6 @@ var FILE_WRITE_TOOL_NAMES = /* @__PURE__ */ new Set([
   "WriteFile",
   "EditFile"
 ]);
-var TASK_PROMPTS = {
-  "create-story": (key) => `Create the story spec for ${key}. Read the epic definitions and architecture docs. Write a complete story file with acceptance criteria, tasks, and dev notes. CRITICAL: Every AC must be testable by a blind QA agent using ONLY a user guide + browser/API/CLI access. No AC should reference source code, internal data structures, or implementation details like O(1) complexity. Each AC must describe observable behavior that can be verified through UI interaction (agent-browser), API calls (curl), CLI commands (docker exec), or log inspection (docker logs). Wrap output in <story-spec>...</story-spec> tags.`,
-  "implement": (key) => `Implement story ${key}`,
-  "check": (key) => `Run automated checks for story ${key}. Execute the project's test suite, linter, and coverage tool. Include <verdict>pass</verdict> or <verdict>fail</verdict> in your response.`,
-  "review": (key) => `Review the implementation of story ${key}. Check for correctness, security issues, architecture violations, and AC coverage. Include <verdict>pass</verdict> or <verdict>fail</verdict> in your response. If fail, include <issues>...</issues>.`,
-  "document": (key) => `Write user documentation for story ${key}. Describe what was built and how to use it from a user's perspective. No source code. Wrap documentation in <user-docs>...</user-docs> tags.`,
-  "deploy": () => `Provision the Docker environment for this project. Check for docker-compose.yml, start containers, verify health. Wrap report in <deploy-report>...</deploy-report> tags with status, containers, URLs, credentials, health.`,
-  "verify": () => `Verify the epic's stories using the user docs and deploy info in ./story-files/. For each AC, derive verification steps, run commands, observe output. Include <verdict>pass</verdict> or <verdict>fail</verdict>. Include <evidence ac="N" status="pass|fail|unknown">...</evidence> per AC. Include <quality-scores>...</quality-scores>.`,
-  "retro": () => `Run a retrospective for this epic. Analyze what worked, what failed, patterns, and action items for next epic.`
-};
 function buildCoverageDeduplicationContext(contract, projectDir) {
   if (!contract?.testResults) return null;
   const { coverage } = contract.testResults;
@@ -3204,127 +3205,71 @@ function buildCoverageDeduplicationContext(contract, projectDir) {
     return null;
   }
 }
-function propagateVerifyFlags(taskName, contract, projectDir) {
-  if (taskName !== "implement") return;
-  if (!contract?.testResults) return;
-  const { failed, coverage } = contract.testResults;
-  try {
-    const { state, body } = readStateWithBody(projectDir);
-    if (failed === 0) state.session_flags.tests_passed = true;
-    if (coverage !== null && coverage !== void 0 && coverage >= state.coverage.target) {
-      state.session_flags.coverage_met = true;
-    }
-    writeState(state, projectDir, body);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    warn(`workflow-machine: flag propagation failed for ${taskName}: ${msg}`);
-  }
-}
-function isTaskCompleted(state, taskName, storyKey) {
-  return state.tasks_completed.some(
-    (cp) => cp.task_name === taskName && cp.story_key === storyKey && !cp.error
-  );
-}
-function isLoopTaskCompleted(state, taskName, storyKey, iteration) {
-  const count = state.tasks_completed.filter(
-    (cp) => cp.task_name === taskName && cp.story_key === storyKey && !cp.error
-  ).length;
-  return count >= iteration;
-}
-function loadWorkItems(sprintStatusPath, issuesPath2) {
-  const items = [];
-  if (existsSync15(sprintStatusPath)) {
-    let raw;
-    try {
-      raw = readFileSync13(sprintStatusPath, "utf-8");
-    } catch {
-      warn(`workflow-machine: could not read sprint-status.yaml at ${sprintStatusPath}`);
-      return items;
-    }
-    let parsed;
-    try {
-      parsed = parse5(raw);
-    } catch {
-      warn(`workflow-machine: invalid YAML in sprint-status.yaml at ${sprintStatusPath}`);
-      return items;
-    }
-    if (parsed && typeof parsed === "object") {
-      const data = parsed;
-      const devStatus = data.development_status;
-      if (devStatus && typeof devStatus === "object") {
-        for (const [key, status] of Object.entries(devStatus)) {
-          if (key.startsWith("epic-")) continue;
-          if (key.endsWith("-retrospective")) continue;
-          if (status === "backlog" || status === "ready-for-dev" || status === "in-progress") {
-            items.push({ key, source: "sprint" });
-          }
-        }
-      }
-    }
+async function nullTaskCore(input) {
+  const { task: _task, taskName, storyKey, config, workflowState, previousContract, accumulatedCostUsd } = input;
+  const projectDir = config.projectDir ?? process.cwd();
+  const handler = getNullTask(taskName);
+  if (!handler) {
+    const registered = listNullTasks();
+    throw { taskName, storyKey, code: "NULL_TASK_NOT_FOUND", message: `No null task handler registered for "${taskName}". Registered: ${registered.join(", ") || "(none)"}` };
   }
-  if (issuesPath2 && existsSync15(issuesPath2)) {
-    let raw;
-    try {
-      raw = readFileSync13(issuesPath2, "utf-8");
-    } catch {
-      warn(`workflow-machine: could not read issues.yaml at ${issuesPath2}`);
-      return items;
-    }
-    let parsed;
-    try {
-      parsed = parse5(raw);
-    } catch {
-      warn(`workflow-machine: invalid YAML in issues.yaml at ${issuesPath2}`);
-      return items;
-    }
-    if (parsed && typeof parsed === "object") {
-      const data = parsed;
-      const issuesList = data.issues;
-      if (Array.isArray(issuesList)) {
-        for (const issue of issuesList) {
-          if (issue && typeof issue === "object") {
-            const status = issue.status;
-            if (status === "backlog" || status === "ready-for-dev" || status === "in-progress") {
-              items.push({ key: issue.id, title: issue.title, source: "issues" });
-            }
-          }
-        }
-      }
-    }
+  const startMs = Date.now();
+  const workflowStartMs = workflowState.started ? new Date(workflowState.started).getTime() : startMs;
+  const ctx = {
+    storyKey,
+    taskName,
+    cost: accumulatedCostUsd,
+    durationMs: startMs - workflowStartMs,
+    outputContract: previousContract,
+    projectDir
+  };
+  let result;
+  try {
+    result = await handler(ctx);
+  } catch (err) {
+    throw { taskName, storyKey, code: "NULL_TASK_HANDLER_ERROR", message: `Null task handler "${taskName}" threw: ${err instanceof Error ? err.message : String(err)}` };
   }
-  return items;
-}
-function buildRetryPrompt(storyKey, findings) {
-  const failedFindings = findings.filter((f) => f.status === "fail" || f.status === "unknown");
-  if (failedFindings.length === 0) return `Implement story ${storyKey}`;
-  const formatted = failedFindings.map((f) => {
-    let entry = `AC #${f.ac} (${f.status.toUpperCase()}): ${f.description}`;
-    if (f.evidence?.reasoning) entry += `
-  Evidence: ${f.evidence.reasoning}`;
-    return entry;
-  }).join("\n\n");
-  return `Retry story ${storyKey}. Previous evaluator findings:
-
-${formatted}
-
-Focus on fixing the failed criteria above.`;
-}
-function buildAllUnknownVerdict(workItems, reasoning) {
-  const findings = workItems.map((_, index) => ({
-    ac: index + 1,
-    description: `AC #${index + 1}`,
-    status: "unknown",
-    evidence: { commands_run: [], output_observed: "", reasoning }
-  }));
-  return { verdict: "fail", score: { passed: 0, failed: 0, unknown: findings.length, total: findings.length }, findings };
+  if (!result.success) {
+    throw { taskName, storyKey, code: "NULL_TASK_FAILED", message: `Null task handler "${taskName}" returned success=false${result.output ? `: ${result.output}` : ""}` };
+  }
+  const checkpoint = { task_name: taskName, story_key: storyKey, completed_at: (/* @__PURE__ */ new Date()).toISOString() };
+  const updatedState = { ...workflowState, tasks_completed: [...workflowState.tasks_completed, checkpoint] };
+  const durationMs = Date.now() - startMs;
+  const contract = {
+    version: 1,
+    taskName,
+    storyId: storyKey,
+    driver: "engine",
+    model: "null",
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    cost_usd: 0,
+    duration_ms: durationMs,
+    changedFiles: [],
+    testResults: null,
+    output: result.output ?? "",
+    acceptanceCriteria: []
+  };
+  writeWorkflowState(updatedState, projectDir);
+  return { output: result.output ?? "", cost: 0, changedFiles: [], sessionId: "", contract, updatedState };
 }
-function getFailedItems(verdict, allItems) {
-  if (!verdict) return allItems;
-  if (verdict.verdict === "pass") return [];
-  return allItems;
+function propagateVerifyFlags(taskName, contract, projectDir) {
+  if (taskName !== "implement") return;
+  if (!contract?.testResults) return;
+  const { failed, coverage } = contract.testResults;
+  try {
+    const { state, body } = readStateWithBody(projectDir);
+    if (failed === 0) state.session_flags.tests_passed = true;
+    if (coverage !== null && coverage !== void 0 && coverage >= state.coverage.target) {
+      state.session_flags.coverage_met = true;
+    }
+    writeState(state, projectDir, body);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    warn(`workflow-actors: flag propagation failed for ${taskName}: ${msg}`);
+  }
 }
 async function dispatchTaskCore(input) {
-  const { task, taskName, storyKey, definition, config, workflowState, previousContract, onStreamEvent, storyFiles, customPrompt, accumulatedCostUsd } = input;
+  const { task, taskName, storyKey, definition, config, workflowState, previousContract, onStreamEvent, storyFiles, customPrompt } = input;
   const projectDir = config.projectDir ?? process.cwd();
   const traceId = generateTraceId(config.runId, workflowState.iteration, taskName);
   const tracePrompt = formatTracePrompt(traceId);
@@ -3345,7 +3290,6 @@ async function dispatchTaskCore(input) {
   } else {
     cwd = projectDir;
   }
-  const isEpicSentinel = storyKey.startsWith("__epic_") || storyKey === "__run__";
   let basePrompt;
   if (customPrompt) {
     basePrompt = customPrompt;
@@ -3367,7 +3311,6 @@ ${coverageDedup}`;
     ...sessionId ? { sessionId } : {},
     ...tracePrompt ? { appendSystemPrompt: tracePrompt } : {},
     ...task.plugins ?? definition.plugins ? { plugins: task.plugins ?? definition.plugins } : {}
-    // Note: max_budget_usd is not mapped to timeout — they have different semantics
   };
   const emit = config.onEvent;
   if (emit) emit({ type: "dispatch-start", taskName, storyKey, driverName, model });
@@ -3430,11 +3373,7 @@ ${coverageDedup}`;
   if (resultSessionId) {
     updatedState = recordSessionId(sessionKey, resultSessionId, updatedState);
   } else {
-    const checkpoint = {
-      task_name: taskName,
-      story_key: storyKey,
-      completed_at: (/* @__PURE__ */ new Date()).toISOString()
-    };
+    const checkpoint = { task_name: taskName, story_key: storyKey, completed_at: (/* @__PURE__ */ new Date()).toISOString() };
     updatedState = { ...updatedState, tasks_completed: [...updatedState.tasks_completed, checkpoint] };
   }
   updatedState = recordTraceId(traceId, updatedState);
@@ -3458,70 +3397,129 @@ ${coverageDedup}`;
     writeOutputContract(contract, join12(projectDir, ".codeharness", "contracts"));
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    warn(`workflow-machine: failed to write output contract for ${taskName}/${storyKey}: ${msg}`);
+    warn(`workflow-actors: failed to write output contract for ${taskName}/${storyKey}: ${msg}`);
     contract = null;
   }
   writeWorkflowState(updatedState, projectDir);
   propagateVerifyFlags(taskName, contract, projectDir);
   return { output, cost, changedFiles, sessionId: resultSessionId, contract, updatedState };
 }
-async function nullTaskCore(input) {
-  const { task, taskName, storyKey, config, workflowState, previousContract, accumulatedCostUsd } = input;
-  const projectDir = config.projectDir ?? process.cwd();
-  const handler = getNullTask(taskName);
-  if (!handler) {
-    const registered = listNullTasks();
-    throw { taskName, storyKey, code: "NULL_TASK_NOT_FOUND", message: `No null task handler registered for "${taskName}". Registered: ${registered.join(", ") || "(none)"}` };
-  }
-  const startMs = Date.now();
-  const workflowStartMs = workflowState.started ? new Date(workflowState.started).getTime() : startMs;
-  const ctx = {
-    storyKey,
-    taskName,
-    cost: accumulatedCostUsd,
-    durationMs: startMs - workflowStartMs,
-    outputContract: previousContract,
-    projectDir
-  };
-  let result;
-  try {
-    result = await handler(ctx);
-  } catch (err) {
-    throw { taskName, storyKey, code: "NULL_TASK_HANDLER_ERROR", message: `Null task handler "${taskName}" threw: ${err instanceof Error ? err.message : String(err)}` };
+var dispatchActor = fromPromise(async ({ input }) => dispatchTaskCore(input));
+var nullTaskDispatchActor = fromPromise(async ({ input }) => {
+  return nullTaskCore(input);
+});
+
+// src/lib/workflow-machine.ts
+var HALT_ERROR_CODES = /* @__PURE__ */ new Set(["RATE_LIMIT", "NETWORK", "SDK_INIT"]);
+var DEFAULT_MAX_ITERATIONS = 5;
+var HEALTH_CHECK_TIMEOUT_MS = 5e3;
+function isTaskCompleted(state, taskName, storyKey) {
+  return state.tasks_completed.some(
+    (cp) => cp.task_name === taskName && cp.story_key === storyKey && !cp.error
+  );
+}
+function isLoopTaskCompleted(state, taskName, storyKey, iteration) {
+  const count = state.tasks_completed.filter(
+    (cp) => cp.task_name === taskName && cp.story_key === storyKey && !cp.error
+  ).length;
+  return count >= iteration;
+}
+function loadWorkItems(sprintStatusPath, issuesPath2) {
+  const items = [];
+  if (existsSync15(sprintStatusPath)) {
+    let raw;
+    try {
+      raw = readFileSync13(sprintStatusPath, "utf-8");
+    } catch {
+      warn(`workflow-machine: could not read sprint-status.yaml at ${sprintStatusPath}`);
+      return items;
+    }
+    let parsed;
+    try {
+      parsed = parse5(raw);
+    } catch {
+      warn(`workflow-machine: invalid YAML in sprint-status.yaml at ${sprintStatusPath}`);
+      return items;
+    }
+    if (parsed && typeof parsed === "object") {
+      const data = parsed;
+      const devStatus = data.development_status;
+      if (devStatus && typeof devStatus === "object") {
+        for (const [key, status] of Object.entries(devStatus)) {
+          if (key.startsWith("epic-")) continue;
+          if (key.endsWith("-retrospective")) continue;
+          if (status === "backlog" || status === "ready-for-dev" || status === "in-progress") {
+            items.push({ key, source: "sprint" });
+          }
+        }
+      }
+    }
   }
-  if (!result.success) {
-    throw { taskName, storyKey, code: "NULL_TASK_FAILED", message: `Null task handler "${taskName}" returned success=false${result.output ? `: ${result.output}` : ""}` };
+  if (issuesPath2 && existsSync15(issuesPath2)) {
+    let raw;
+    try {
+      raw = readFileSync13(issuesPath2, "utf-8");
+    } catch {
+      warn(`workflow-machine: could not read issues.yaml at ${issuesPath2}`);
+      return items;
+    }
+    let parsed;
+    try {
+      parsed = parse5(raw);
+    } catch {
+      warn(`workflow-machine: invalid YAML in issues.yaml at ${issuesPath2}`);
+      return items;
+    }
+    if (parsed && typeof parsed === "object") {
+      const data = parsed;
+      const issuesList = data.issues;
+      if (Array.isArray(issuesList)) {
+        for (const issue of issuesList) {
+          if (issue && typeof issue === "object") {
+            const status = issue.status;
+            if (status === "backlog" || status === "ready-for-dev" || status === "in-progress") {
+              items.push({ key: issue.id, title: issue.title, source: "issues" });
+            }
+          }
+        }
+      }
+    }
   }
-  const checkpoint = { task_name: taskName, story_key: storyKey, completed_at: (/* @__PURE__ */ new Date()).toISOString() };
-  const updatedState = { ...workflowState, tasks_completed: [...workflowState.tasks_completed, checkpoint] };
-  const durationMs = Date.now() - startMs;
-  const contract = {
-    version: 1,
-    taskName,
-    storyId: storyKey,
-    driver: "engine",
-    model: "null",
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    cost_usd: 0,
-    duration_ms: durationMs,
-    changedFiles: [],
-    testResults: null,
-    output: result.output ?? "",
-    acceptanceCriteria: []
-  };
-  writeWorkflowState(updatedState, projectDir);
-  return { output: result.output ?? "", cost: 0, changedFiles: [], sessionId: "", contract, updatedState };
+  return items;
+}
+function buildRetryPrompt(storyKey, findings) {
+  const failedFindings = findings.filter((f) => f.status === "fail" || f.status === "unknown");
+  if (failedFindings.length === 0) return `Implement story ${storyKey}`;
+  const formatted = failedFindings.map((f) => {
+    let entry = `AC #${f.ac} (${f.status.toUpperCase()}): ${f.description}`;
+    if (f.evidence?.reasoning) entry += `
+  Evidence: ${f.evidence.reasoning}`;
+    return entry;
+  }).join("\n\n");
+  return `Retry story ${storyKey}. Previous evaluator findings:
+
+${formatted}
+
+Focus on fixing the failed criteria above.`;
+}
+function buildAllUnknownVerdict(workItems, reasoning) {
+  const findings = workItems.map((_, index) => ({
+    ac: index + 1,
+    description: `AC #${index + 1}`,
+    status: "unknown",
+    evidence: { commands_run: [], output_observed: "", reasoning }
+  }));
+  return { verdict: "fail", score: { passed: 0, failed: 0, unknown: findings.length, total: findings.length }, findings };
+}
+function getFailedItems(verdict, allItems) {
+  if (!verdict) return allItems;
+  if (verdict.verdict === "pass") return [];
+  return allItems;
 }
 function isLoopBlock(step) {
   return typeof step === "object" && step !== null && "loop" in step;
 }
-var dispatchActor = fromPromise(async ({ input }) => {
-  return dispatchTaskCore(input);
-});
-var nullTaskDispatchActor = fromPromise(async ({ input }) => {
-  return nullTaskCore(input);
-});
-var loopIterationActor = fromPromise(async ({ input }) => {
+var loopIterationActor = fromPromise2(async ({ input }) => {
   const { loopBlock, config, workItems, storyFlowTasks, onStreamEvent, maxIterations } = input;
   let { currentState, errors, tasksCompleted, lastContract, lastVerdict, accumulatedCostUsd } = input;
   const projectDir = config.projectDir ?? process.cwd();
@@ -3762,7 +3760,7 @@ async function checkDriverHealth(workflow, timeoutMs) {
   }
 }
 function collectGuideFiles(epicItems, epicSentinel, projectDir) {
-  const guidesDir = join12(projectDir, ".codeharness", "verify-guides");
+  const guidesDir = join13(projectDir, ".codeharness", "verify-guides");
   const guideFiles = [];
   try {
     mkdirSync6(guidesDir, { recursive: true });
@@ -3771,12 +3769,12 @@ function collectGuideFiles(epicItems, epicSentinel, projectDir) {
   }
   for (const item of epicItems) {
     try {
-      const contractPath = join12(projectDir, ".codeharness", "contracts", `document-${item.key}.json`);
+      const contractPath = join13(projectDir, ".codeharness", "contracts", `document-${item.key}.json`);
       if (existsSync15(contractPath)) {
         const contractData = JSON.parse(readFileSync13(contractPath, "utf-8"));
         const docs = contractData.output ? extractTag(contractData.output, "user-docs") ?? contractData.output : null;
         if (docs) {
-          const guidePath = join12(guidesDir, `${item.key}-guide.md`);
+          const guidePath = join13(guidesDir, `${item.key}-guide.md`);
           writeFileSync8(guidePath, docs, "utf-8");
           guideFiles.push(guidePath);
         }
@@ -3785,12 +3783,12 @@ function collectGuideFiles(epicItems, epicSentinel, projectDir) {
     }
   }
   try {
-    const deployContractPath = join12(projectDir, ".codeharness", "contracts", `deploy-${epicSentinel}.json`);
+    const deployContractPath = join13(projectDir, ".codeharness", "contracts", `deploy-${epicSentinel}.json`);
     if (existsSync15(deployContractPath)) {
       const deployData = JSON.parse(readFileSync13(deployContractPath, "utf-8"));
       const report = deployData.output ? extractTag(deployData.output, "deploy-report") ?? deployData.output : null;
       if (report) {
-        const deployPath = join12(guidesDir, "deploy-info.md");
+        const deployPath = join13(guidesDir, "deploy-info.md");
         writeFileSync8(deployPath, report, "utf-8");
         guideFiles.push(deployPath);
       }
@@ -3800,13 +3798,13 @@ function collectGuideFiles(epicItems, epicSentinel, projectDir) {
   return guideFiles;
 }
 function cleanupGuideFiles(projectDir) {
-  const guidesDir = join12(projectDir, ".codeharness", "verify-guides");
+  const guidesDir = join13(projectDir, ".codeharness", "verify-guides");
   try {
     rmSync2(guidesDir, { recursive: true, force: true });
   } catch {
   }
 }
-var storyFlowActor = fromPromise(async ({ input }) => {
+var storyFlowActor = fromPromise2(async ({ input }) => {
   const { item, config, storyFlowTasks } = input;
   let { workflowState: state, lastContract, accumulatedCostUsd } = input;
   const projectDir = config.projectDir ?? process.cwd();
@@ -3880,7 +3878,7 @@ var storyFlowActor = fromPromise(async ({ input }) => {
   }
   return { workflowState: state, errors, tasksCompleted, lastContract, accumulatedCostUsd, halted };
 });
-var epicStepActor = fromPromise(async ({ input }) => {
+var epicStepActor = fromPromise2(async ({ input }) => {
   const { epicId, epicItems, config, storyFlowTasks } = input;
   let { workflowState: state, errors, tasksCompleted, storiesProcessed, lastContract, accumulatedCostUsd, halted, currentStepIndex } = input;
   const projectDir = config.projectDir ?? process.cwd();
@@ -4014,7 +4012,7 @@ var epicMachine = setup({
     done: { type: "final" }
   }
 });
-var runEpicActor = fromPromise(async ({ input }) => {
+var runEpicActor = fromPromise2(async ({ input }) => {
   const { config, storyFlowTasks, epicEntries, currentEpicIndex } = input;
   let { workflowState: state, errors, tasksCompleted, storiesProcessed, lastContract, accumulatedCostUsd, halted } = input;
   if (currentEpicIndex >= epicEntries.length || halted || config.abortSignal?.aborted) {
@@ -4194,12 +4192,12 @@ function handleDispatchError(err, taskName, storyKey) {
 // src/lib/worktree-manager.ts
 import { execSync as execSync2 } from "child_process";
 import { existsSync as existsSync16, readFileSync as readFileSync14, statSync } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 
 // src/lib/cross-worktree-validator.ts
 import { exec } from "child_process";
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync7 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 import { promisify } from "util";
 var execAsync = promisify(exec);
 var MAX_BUFFER = 10 * 1024 * 1024;
@@ -4233,9 +4231,9 @@ function writeMergeTelemetry(opts, result) {
       testResults: result.testResults,
       errors: result.valid ? [] : ["Test suite failed after merge"]
     };
-    const dir = join13(opts.cwd, TELEMETRY_DIR2);
+    const dir = join14(opts.cwd, TELEMETRY_DIR2);
     mkdirSync7(dir, { recursive: true });
-    appendFileSync2(join13(dir, TELEMETRY_FILE2), JSON.stringify(entry) + "\n");
+    appendFileSync2(join14(dir, TELEMETRY_FILE2), JSON.stringify(entry) + "\n");
   } catch {
   }
 }
@@ -4716,7 +4714,7 @@ var WorktreeManager = class {
    * Check if a worktree is orphaned (no active codeharness process).
    */
   isOrphaned(wt) {
-    const laneStatePath = join14(wt.path, ".codeharness", "lane-state.json");
+    const laneStatePath = join15(wt.path, ".codeharness", "lane-state.json");
     if (!existsSync16(laneStatePath)) {
       return true;
     }
@@ -6069,7 +6067,7 @@ function startRenderer(options) {
 
 // src/commands/run.ts
 function resolvePluginDir() {
-  return join15(process.cwd(), ".claude");
+  return join16(process.cwd(), ".claude");
 }
 function extractEpicId2(storyKey) {
   const match = storyKey.match(/^(\d+)-/);
@@ -6161,8 +6159,8 @@ function registerRunCommand(program) {
         process.exitCode = 1;
         return;
       }
-      const projectWorkflowPath = join15(projectDir, ".codeharness", "workflows", "default.yaml");
-      const templateWorkflowPath = join15(projectDir, "templates", "workflows", "default.yaml");
+      const projectWorkflowPath = join16(projectDir, ".codeharness", "workflows", "default.yaml");
+      const templateWorkflowPath = join16(projectDir, "templates", "workflows", "default.yaml");
       const workflowPath = existsSync17(projectWorkflowPath) ? projectWorkflowPath : templateWorkflowPath;
       try {
         parsedWorkflow = parseWorkflow(workflowPath);
@@ -6420,8 +6418,8 @@ function registerRunCommand(program) {
     const config = {
       workflow: parsedWorkflow,
       agents,
-      sprintStatusPath: join15(projectDir, "_bmad-output", "implementation-artifacts", "sprint-status.yaml"),
-      issuesPath: join15(projectDir, ".codeharness", "issues.yaml"),
+      sprintStatusPath: join16(projectDir, "_bmad-output", "implementation-artifacts", "sprint-status.yaml"),
+      issuesPath: join16(projectDir, ".codeharness", "issues.yaml"),
       runId: `run-${Date.now()}`,
       projectDir,
       abortSignal: abortController.signal,
@@ -6533,7 +6531,7 @@ function registerRunCommand(program) {
 
 // src/commands/verify.ts
 import { existsSync as existsSync28, readFileSync as readFileSync25 } from "fs";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 
 // src/modules/verify/index.ts
 import { readFileSync as readFileSync24 } from "fs";
@@ -6770,11 +6768,11 @@ function validateProofQuality(proofPath) {
 // src/modules/verify/orchestrator.ts
 import { execFileSync } from "child_process";
 import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "fs";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 
 // src/lib/doc-health/types.ts
 import { readdirSync as readdirSync3, statSync as statSync2 } from "fs";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".js", ".py"]);
 function getExtension(filename) {
   const dot = filename.lastIndexOf(".");
@@ -6795,7 +6793,7 @@ function getNewestSourceMtime(dir) {
     const dirName = current.split("/").pop() ?? "";
     if (dirName === "node_modules" || dirName === ".git") return;
     for (const entry of entries) {
-      const fullPath = join16(current, entry);
+      const fullPath = join17(current, entry);
       let stat;
       try {
         stat = statSync2(fullPath);
@@ -6827,7 +6825,7 @@ import {
   readdirSync as readdirSync5,
   statSync as statSync4
 } from "fs";
-import { join as join18, relative as relative2 } from "path";
+import { join as join19, relative as relative2 } from "path";
 
 // src/lib/doc-health/staleness.ts
 import { execSync as execSync3 } from "child_process";
@@ -6837,7 +6835,7 @@ import {
   readdirSync as readdirSync4,
   statSync as statSync3
 } from "fs";
-import { join as join17, relative } from "path";
+import { join as join18, relative } from "path";
 var SOURCE_EXTENSIONS2 = /* @__PURE__ */ new Set([".ts", ".js", ".py"]);
 var DO_NOT_EDIT_HEADER = "<!-- DO NOT EDIT MANUALLY";
 function getSourceFilesInModule(modulePath) {
@@ -6852,7 +6850,7 @@ function getSourceFilesInModule(modulePath) {
     const dirName = current.split("/").pop() ?? "";
     if (dirName === "node_modules" || dirName === ".git" || dirName === "__tests__" || dirName === "dist" || dirName === "coverage" || dirName.startsWith(".") && current !== modulePath) return;
     for (const entry of entries) {
-      const fullPath = join17(current, entry);
+      const fullPath = join18(current, entry);
       let stat;
       try {
         stat = statSync3(fullPath);
@@ -6898,10 +6896,10 @@ function checkAgentsMdCompleteness(agentsPath, modulePath) {
 }
 function checkAgentsMdForModule(modulePath, dir) {
   const root = dir ?? process.cwd();
-  const fullModulePath = join17(root, modulePath);
-  let agentsPath = join17(fullModulePath, "AGENTS.md");
+  const fullModulePath = join18(root, modulePath);
+  let agentsPath = join18(fullModulePath, "AGENTS.md");
   if (!existsSync19(agentsPath)) {
-    agentsPath = join17(root, "AGENTS.md");
+    agentsPath = join18(root, "AGENTS.md");
   }
   if (!existsSync19(agentsPath)) {
     return {
@@ -6966,14 +6964,14 @@ function checkStoryDocFreshness(storyId, dir) {
   for (const mod of modulesToCheck) {
     const result = checkAgentsMdForModule(mod, root);
     documents.push(result);
-    const moduleAgentsPath = join17(root, mod, "AGENTS.md");
-    const actualAgentsPath = existsSync19(moduleAgentsPath) ? moduleAgentsPath : join17(root, "AGENTS.md");
+    const moduleAgentsPath = join18(root, mod, "AGENTS.md");
+    const actualAgentsPath = existsSync19(moduleAgentsPath) ? moduleAgentsPath : join18(root, "AGENTS.md");
     if (existsSync19(actualAgentsPath)) {
       checkAgentsMdLineCountInternal(actualAgentsPath, result.path, documents);
     }
   }
   if (modulesToCheck.length === 0) {
-    const rootAgentsPath = join17(root, "AGENTS.md");
+    const rootAgentsPath = join18(root, "AGENTS.md");
     if (existsSync19(rootAgentsPath)) {
       documents.push({
         path: "AGENTS.md",
@@ -7048,7 +7046,7 @@ function findModules(dir, threshold) {
     let sourceCount = 0;
     const subdirs = [];
     for (const entry of entries) {
-      const fullPath = join18(current, entry);
+      const fullPath = join19(current, entry);
       let stat;
       try {
         stat = statSync4(fullPath);
@@ -7082,7 +7080,7 @@ function scanDocHealth(dir) {
   const root = dir ?? process.cwd();
   const documents = [];
   const modules = findModules(root);
-  const rootAgentsPath = join18(root, "AGENTS.md");
+  const rootAgentsPath = join19(root, "AGENTS.md");
   if (existsSync20(rootAgentsPath)) {
     if (modules.length > 0) {
       const docMtime = statSync4(rootAgentsPath).mtime;
@@ -7090,8 +7088,8 @@ function scanDocHealth(dir) {
       let staleModule = "";
       let newestCode = null;
       for (const mod of modules) {
-        const fullModPath = join18(root, mod);
-        const modAgentsPath = join18(fullModPath, "AGENTS.md");
+        const fullModPath = join19(root, mod);
+        const modAgentsPath = join19(fullModPath, "AGENTS.md");
         if (existsSync20(modAgentsPath)) continue;
         const { missing } = checkAgentsMdCompleteness(rootAgentsPath, fullModPath);
         if (missing.length > 0 && staleModule === "") {
@@ -7140,7 +7138,7 @@ function scanDocHealth(dir) {
     });
   }
   for (const mod of modules) {
-    const modAgentsPath = join18(root, mod, "AGENTS.md");
+    const modAgentsPath = join19(root, mod, "AGENTS.md");
     if (existsSync20(modAgentsPath)) {
       const result = checkAgentsMdForModule(mod, root);
       if (result.path !== "AGENTS.md") {
@@ -7149,7 +7147,7 @@ function scanDocHealth(dir) {
       }
     }
   }
-  const indexPath = join18(root, "docs", "index.md");
+  const indexPath = join19(root, "docs", "index.md");
   if (existsSync20(indexPath)) {
     const content = readFileSync17(indexPath, "utf-8");
     const hasAbsolutePaths = /https?:\/\/|file:\/\//i.test(content);
@@ -7161,11 +7159,11 @@ function scanDocHealth(dir) {
       reason: hasAbsolutePaths ? "Contains absolute URLs (may violate NFR25)" : "Uses relative paths"
     });
   }
-  const activeDir = join18(root, "docs", "exec-plans", "active");
+  const activeDir = join19(root, "docs", "exec-plans", "active");
   if (existsSync20(activeDir)) {
     const files = readdirSync5(activeDir).filter((f) => f.endsWith(".md"));
     for (const file of files) {
-      const filePath = join18(activeDir, file);
+      const filePath = join19(activeDir, file);
       documents.push({
         path: `docs/exec-plans/active/${file}`,
         grade: "fresh",
@@ -7176,11 +7174,11 @@ function scanDocHealth(dir) {
     }
   }
   for (const subdir of ["quality", "generated"]) {
-    const dirPath = join18(root, "docs", subdir);
+    const dirPath = join19(root, "docs", subdir);
     if (!existsSync20(dirPath)) continue;
     const files = readdirSync5(dirPath).filter((f) => !f.startsWith("."));
     for (const file of files) {
-      const filePath = join18(dirPath, file);
+      const filePath = join19(dirPath, file);
       let stat;
       try {
         stat = statSync4(filePath);
@@ -7236,7 +7234,7 @@ import {
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync9
 } from "fs";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 function printDocHealthOutput(report) {
   for (const doc of report.documents) {
     switch (doc.grade) {
@@ -7257,7 +7255,7 @@ function printDocHealthOutput(report) {
 }
 function completeExecPlan(storyId, dir) {
   const root = dir ?? process.cwd();
-  const activePath = join19(root, "docs", "exec-plans", "active", `${storyId}.md`);
+  const activePath = join20(root, "docs", "exec-plans", "active", `${storyId}.md`);
   if (!existsSync21(activePath)) {
     return null;
   }
@@ -7269,9 +7267,9 @@ function completeExecPlan(storyId, dir) {
     `$1
 Completed: ${timestamp}`
   );
-  const completedDir = join19(root, "docs", "exec-plans", "completed");
+  const completedDir = join20(root, "docs", "exec-plans", "completed");
   mkdirSync8(completedDir, { recursive: true });
-  const completedPath = join19(completedDir, `${storyId}.md`);
+  const completedPath = join20(completedDir, `${storyId}.md`);
   writeFileSync9(completedPath, content, "utf-8");
   try {
     unlinkSync2(activePath);
@@ -7313,9 +7311,9 @@ function checkPreconditions(dir, storyId) {
 }
 function createProofDocument(storyId, _storyTitle, _acs, dir) {
   const root = dir ?? process.cwd();
-  const verificationDir = join20(root, "verification");
+  const verificationDir = join21(root, "verification");
   mkdirSync9(verificationDir, { recursive: true });
-  const proofPath = join20(verificationDir, `${storyId}-proof.md`);
+  const proofPath = join21(verificationDir, `${storyId}-proof.md`);
   writeFileSync10(proofPath, `# ${storyId} \u2014 Proof
 
 Pending: blind evaluator (Epic 6)
@@ -7487,7 +7485,7 @@ function parseObservabilityGaps(proofContent) {
 
 // src/modules/observability/analyzer.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 var DEFAULT_RULES_DIR = "patches/observability/";
 var ADDITIONAL_RULES_DIRS = ["patches/error-handling/"];
 var DEFAULT_TIMEOUT = 6e4;
@@ -7522,8 +7520,8 @@ function analyze(projectDir, config) {
   }
   const rulesDir = config?.rulesDir ?? DEFAULT_RULES_DIR;
   const timeout = config?.timeout ?? DEFAULT_TIMEOUT;
-  const fullRulesDir = join21(projectDir, rulesDir);
-  const additionalDirs = (config?.additionalRulesDirs ?? ADDITIONAL_RULES_DIRS).map((d) => join21(projectDir, d));
+  const fullRulesDir = join22(projectDir, rulesDir);
+  const additionalDirs = (config?.additionalRulesDirs ?? ADDITIONAL_RULES_DIRS).map((d) => join22(projectDir, d));
   const rawResult = runSemgrep(projectDir, fullRulesDir, timeout, additionalDirs);
   if (!rawResult.success) {
     return fail2(rawResult.error);
@@ -7612,7 +7610,7 @@ function normalizeSeverity(severity) {
 
 // src/modules/observability/coverage.ts
 import { readFileSync as readFileSync20, writeFileSync as writeFileSync11, renameSync as renameSync3, existsSync as existsSync24 } from "fs";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 var STATE_FILE2 = "sprint-state.json";
 var DEFAULT_STATIC_TARGET = 80;
 function defaultCoverageState() {
@@ -7628,7 +7626,7 @@ function defaultCoverageState() {
   };
 }
 function readStateFile(projectDir) {
-  const fp = join22(projectDir, STATE_FILE2);
+  const fp = join23(projectDir, STATE_FILE2);
   if (!existsSync24(fp)) {
     return ok2({});
   }
@@ -7701,7 +7699,7 @@ function parseGapArray(raw) {
 
 // src/modules/observability/runtime-coverage.ts
 import { readFileSync as readFileSync21, writeFileSync as writeFileSync12, renameSync as renameSync4, existsSync as existsSync25 } from "fs";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 
 // src/modules/observability/coverage-gate.ts
 var DEFAULT_STATIC_TARGET2 = 80;
@@ -7744,7 +7742,7 @@ function checkObservabilityCoverageGate(projectDir, overrides) {
 // src/modules/observability/runtime-validator.ts
 import { execSync as execSync4 } from "child_process";
 import { readdirSync as readdirSync6, statSync as statSync5 } from "fs";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 var DEFAULT_CONFIG = {
   testCommand: "npm test",
   otlpEndpoint: "http://localhost:4318",
@@ -7871,11 +7869,11 @@ function mapEventsToModules(events, projectDir, modules) {
   });
 }
 function discoverModules(projectDir) {
-  const srcDir = join24(projectDir, "src");
+  const srcDir = join25(projectDir, "src");
   try {
     return readdirSync6(srcDir).filter((name) => {
       try {
-        return statSync5(join24(srcDir, name)).isDirectory();
+        return statSync5(join25(srcDir, name)).isDirectory();
       } catch {
         return false;
       }
@@ -8543,7 +8541,7 @@ function getACById(id) {
 // src/modules/verify/validation-runner.ts
 import { execSync as execSync5 } from "child_process";
 import { writeFileSync as writeFileSync13, mkdirSync as mkdirSync10 } from "fs";
-import { join as join25, dirname as dirname3 } from "path";
+import { join as join26, dirname as dirname3 } from "path";
 var MAX_VALIDATION_ATTEMPTS = 10;
 var AC_COMMAND_TIMEOUT_MS = 3e4;
 var VAL_KEY_PREFIX = "val-";
@@ -8652,7 +8650,7 @@ function executeValidationAC(ac) {
 function createFixStory(ac, error) {
   try {
     const storyKey = `val-fix-${ac.id}`;
-    const storyPath = join25(
+    const storyPath = join26(
       process.cwd(),
       "_bmad-output",
       "implementation-artifacts",
@@ -9023,11 +9021,11 @@ function runValidationCycle() {
 // src/modules/verify/env.ts
 import { execFileSync as execFileSync5 } from "child_process";
 import { existsSync as existsSync27, mkdirSync as mkdirSync11, readdirSync as readdirSync7, readFileSync as readFileSync23, writeFileSync as writeFileSync14, cpSync, rmSync as rmSync3, statSync as statSync6 } from "fs";
-import { join as join27, basename as basename2 } from "path";
+import { join as join28, basename as basename2 } from "path";
 import { createHash } from "crypto";
 
 // src/modules/verify/dockerfile-generator.ts
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 function generateVerifyDockerfile(projectDir) {
   const detections = detectStacks(projectDir);
   const sections = [];
@@ -9047,7 +9045,7 @@ function generateVerifyDockerfile(projectDir) {
   for (const detection of detections) {
     const provider = getStackProvider(detection.stack);
     if (!provider) continue;
-    const resolvedDir = detection.dir === "." ? projectDir : join26(projectDir, detection.dir);
+    const resolvedDir = detection.dir === "." ? projectDir : join27(projectDir, detection.dir);
     const section = provider.getVerifyDockerfileSection(resolvedDir);
     if (section) {
       sections.push(section);
@@ -9076,7 +9074,7 @@ function isValidStoryKey(storyKey) {
   return /^[a-zA-Z0-9_-]+$/.test(storyKey);
 }
 function computeDistHash(projectDir) {
-  const distDir = join27(projectDir, "dist");
+  const distDir = join28(projectDir, "dist");
   if (!existsSync27(distDir)) return null;
   const hash = createHash("sha256");
   const files = collectFiles(distDir).sort();
@@ -9089,7 +9087,7 @@ function computeDistHash(projectDir) {
 function collectFiles(dir) {
   const results = [];
   for (const entry of readdirSync7(dir, { withFileTypes: true })) {
-    const fullPath = join27(dir, entry.name);
+    const fullPath = join28(dir, entry.name);
     if (entry.isDirectory()) {
       results.push(...collectFiles(fullPath));
     } else {
@@ -9125,7 +9123,7 @@ function detectProjectType(projectDir) {
   const rootDetection = allStacks.find((s) => s.dir === ".");
   const stack = rootDetection ? rootDetection.stack : null;
   if (stack && STACK_TO_PROJECT_TYPE[stack]) return STACK_TO_PROJECT_TYPE[stack];
-  if (existsSync27(join27(projectDir, ".claude-plugin", "plugin.json"))) return "plugin";
+  if (existsSync27(join28(projectDir, ".claude-plugin", "plugin.json"))) return "plugin";
   return "generic";
 }
 function buildVerifyImage(options = {}) {
@@ -9169,18 +9167,18 @@ function buildNodeImage(projectDir) {
   const lastLine = packOutput.split("\n").pop()?.trim();
   if (!lastLine) throw new Error("npm pack produced no output \u2014 cannot determine tarball filename.");
   const tarballName = basename2(lastLine);
-  const tarballPath = join27("/tmp", tarballName);
-  const buildContext = join27("/tmp", `codeharness-verify-build-${Date.now()}`);
+  const tarballPath = join28("/tmp", tarballName);
+  const buildContext = join28("/tmp", `codeharness-verify-build-${Date.now()}`);
   mkdirSync11(buildContext, { recursive: true });
   try {
-    cpSync(tarballPath, join27(buildContext, tarballName));
+    cpSync(tarballPath, join28(buildContext, tarballName));
     const dockerfile = generateVerifyDockerfile(projectDir) + `
 # Install project from tarball
 ARG TARBALL=package.tgz
 COPY \${TARBALL} /tmp/\${TARBALL}
 RUN npm install -g /tmp/\${TARBALL} && rm /tmp/\${TARBALL}
 `;
-    writeFileSync14(join27(buildContext, "Dockerfile"), dockerfile);
+    writeFileSync14(join28(buildContext, "Dockerfile"), dockerfile);
     execFileSync5("docker", ["build", "-t", IMAGE_TAG, "--build-arg", `TARBALL=${tarballName}`, "."], {
       cwd: buildContext,
       stdio: "pipe",
@@ -9192,22 +9190,22 @@ RUN npm install -g /tmp/\${TARBALL} && rm /tmp/\${TARBALL}
   }
 }
 function buildPythonImage(projectDir) {
-  const distDir = join27(projectDir, "dist");
+  const distDir = join28(projectDir, "dist");
   const distFiles = readdirSync7(distDir).filter((f) => f.endsWith(".tar.gz") || f.endsWith(".whl"));
   if (distFiles.length === 0) {
     throw new Error("No distribution files found in dist/. Run your build command first (e.g., python -m build).");
   }
   const distFile = distFiles.filter((f) => f.endsWith(".tar.gz"))[0] ?? distFiles[0];
-  const buildContext = join27("/tmp", `codeharness-verify-build-${Date.now()}`);
+  const buildContext = join28("/tmp", `codeharness-verify-build-${Date.now()}`);
   mkdirSync11(buildContext, { recursive: true });
   try {
-    cpSync(join27(distDir, distFile), join27(buildContext, distFile));
+    cpSync(join28(distDir, distFile), join28(buildContext, distFile));
     const dockerfile = generateVerifyDockerfile(projectDir) + `
 # Install project from distribution
 COPY ${distFile} /tmp/${distFile}
 RUN pip install --break-system-packages /tmp/${distFile} && rm /tmp/${distFile}
 `;
-    writeFileSync14(join27(buildContext, "Dockerfile"), dockerfile);
+    writeFileSync14(join28(buildContext, "Dockerfile"), dockerfile);
     execFileSync5("docker", ["build", "-t", IMAGE_TAG, "."], {
       cwd: buildContext,
       stdio: "pipe",
@@ -9222,19 +9220,19 @@ function prepareVerifyWorkspace(storyKey, projectDir) {
   if (!isValidStoryKey(storyKey)) {
     throw new Error(`Invalid story key: ${storyKey}. Keys must contain only alphanumeric characters, hyphens, and underscores.`);
   }
-  const storyFile = join27(root, STORY_DIR, `${storyKey}.md`);
+  const storyFile = join28(root, STORY_DIR, `${storyKey}.md`);
   if (!existsSync27(storyFile)) throw new Error(`Story file not found: ${storyFile}`);
   const workspace = `${TEMP_PREFIX}${storyKey}`;
   if (existsSync27(workspace)) rmSync3(workspace, { recursive: true, force: true });
   mkdirSync11(workspace, { recursive: true });
-  cpSync(storyFile, join27(workspace, "story.md"));
-  const readmePath = join27(root, "README.md");
-  if (existsSync27(readmePath)) cpSync(readmePath, join27(workspace, "README.md"));
-  const docsDir = join27(root, "docs");
+  cpSync(storyFile, join28(workspace, "story.md"));
+  const readmePath = join28(root, "README.md");
+  if (existsSync27(readmePath)) cpSync(readmePath, join28(workspace, "README.md"));
+  const docsDir = join28(root, "docs");
   if (existsSync27(docsDir) && statSync6(docsDir).isDirectory()) {
-    cpSync(docsDir, join27(workspace, "docs"), { recursive: true });
+    cpSync(docsDir, join28(workspace, "docs"), { recursive: true });
   }
-  mkdirSync11(join27(workspace, "verification"), { recursive: true });
+  mkdirSync11(join28(workspace, "verification"), { recursive: true });
   return workspace;
 }
 function checkVerifyEnv() {
@@ -9287,18 +9285,18 @@ function cleanupVerifyEnv(storyKey) {
   }
 }
 function buildPluginImage(projectDir) {
-  const buildContext = join27("/tmp", `codeharness-verify-build-${Date.now()}`);
+  const buildContext = join28("/tmp", `codeharness-verify-build-${Date.now()}`);
   mkdirSync11(buildContext, { recursive: true });
   try {
-    const pluginDir = join27(projectDir, ".claude-plugin");
-    cpSync(pluginDir, join27(buildContext, ".claude-plugin"), { recursive: true });
+    const pluginDir = join28(projectDir, ".claude-plugin");
+    cpSync(pluginDir, join28(buildContext, ".claude-plugin"), { recursive: true });
     for (const dir of ["commands", "hooks", "knowledge", "skills"]) {
-      const src = join27(projectDir, dir);
+      const src = join28(projectDir, dir);
       if (existsSync27(src) && statSync6(src).isDirectory()) {
-        cpSync(src, join27(buildContext, dir), { recursive: true });
+        cpSync(src, join28(buildContext, dir), { recursive: true });
       }
     }
-    writeFileSync14(join27(buildContext, "Dockerfile"), generateVerifyDockerfile(projectDir));
+    writeFileSync14(join28(buildContext, "Dockerfile"), generateVerifyDockerfile(projectDir));
     execFileSync5("docker", ["build", "-t", IMAGE_TAG, "."], {
       cwd: buildContext,
       stdio: "pipe",
@@ -9309,10 +9307,10 @@ function buildPluginImage(projectDir) {
   }
 }
 function buildSimpleImage(projectDir, timeout = 12e4) {
-  const buildContext = join27("/tmp", `codeharness-verify-build-${Date.now()}`);
+  const buildContext = join28("/tmp", `codeharness-verify-build-${Date.now()}`);
   mkdirSync11(buildContext, { recursive: true });
   try {
-    writeFileSync14(join27(buildContext, "Dockerfile"), generateVerifyDockerfile(projectDir));
+    writeFileSync14(join28(buildContext, "Dockerfile"), generateVerifyDockerfile(projectDir));
     execFileSync5("docker", ["build", "-t", IMAGE_TAG, "."], {
       cwd: buildContext,
       stdio: "pipe",
@@ -9394,7 +9392,7 @@ function verifyRetro(opts, isJson, root) {
     return;
   }
   const retroFile = `epic-${epicNum}-retrospective.md`;
-  const retroPath = join28(root, STORY_DIR2, retroFile);
+  const retroPath = join29(root, STORY_DIR2, retroFile);
   if (!existsSync28(retroPath)) {
     if (isJson) {
       jsonOutput({ status: "fail", epic: epicNum, retroFile, message: `${retroFile} not found` });
@@ -9412,7 +9410,7 @@ function verifyRetro(opts, isJson, root) {
     warn(`Failed to update sprint status: ${message}`);
   }
   if (isJson) {
-    jsonOutput({ status: "ok", epic: epicNum, retroFile: join28(STORY_DIR2, retroFile) });
+    jsonOutput({ status: "ok", epic: epicNum, retroFile: join29(STORY_DIR2, retroFile) });
   } else {
     ok(`Epic ${epicNum} retrospective: marked done`);
   }
@@ -9423,7 +9421,7 @@ function verifyStory(storyId, isJson, root) {
     process.exitCode = 1;
     return;
   }
-  const readmePath = join28(root, "README.md");
+  const readmePath = join29(root, "README.md");
   if (!existsSync28(readmePath)) {
     if (isJson) {
       jsonOutput({ status: "fail", message: "No README.md found \u2014 verification requires user documentation" });
@@ -9433,7 +9431,7 @@ function verifyStory(storyId, isJson, root) {
     process.exitCode = 1;
     return;
   }
-  const storyFilePath = join28(root, STORY_DIR2, `${storyId}.md`);
+  const storyFilePath = join29(root, STORY_DIR2, `${storyId}.md`);
   if (!existsSync28(storyFilePath)) {
     fail(`Story file not found: ${storyFilePath}`, { json: isJson });
     process.exitCode = 1;
@@ -9474,7 +9472,7 @@ function verifyStory(storyId, isJson, root) {
     return;
   }
   const storyTitle = extractStoryTitle(storyFilePath);
-  const expectedProofPath = join28(root, "verification", `${storyId}-proof.md`);
+  const expectedProofPath = join29(root, "verification", `${storyId}-proof.md`);
   const proofPath = existsSync28(expectedProofPath) ? expectedProofPath : createProofDocument(storyId, storyTitle, acs, root);
   const proofQuality = validateProofQuality(proofPath);
   if (!proofQuality.passed) {
@@ -9646,11 +9644,11 @@ function resolveEndpoints(state) {
 
 // src/lib/onboard-checks.ts
 import { existsSync as existsSync32 } from "fs";
-import { join as join31 } from "path";
+import { join as join32 } from "path";
 
 // src/lib/coverage/parser.ts
 import { existsSync as existsSync29, readFileSync as readFileSync26 } from "fs";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 function parseTestCounts(output) {
   const vitestMatch = /Tests\s+(\d+)\s+passed(?:\s*\|\s*(\d+)\s+failed)?/i.exec(output);
   if (vitestMatch) {
@@ -9714,7 +9712,7 @@ function parseVitestCoverage(dir) {
   }
 }
 function parsePythonCoverage(dir) {
-  const reportPath = join29(dir, "coverage.json");
+  const reportPath = join30(dir, "coverage.json");
   if (!existsSync29(reportPath)) {
     warn("Coverage report not found at coverage.json");
     return 0;
@@ -9728,7 +9726,7 @@ function parsePythonCoverage(dir) {
   }
 }
 function parseTarpaulinCoverage(dir) {
-  const reportPath = join29(dir, "coverage", "tarpaulin-report.json");
+  const reportPath = join30(dir, "coverage", "tarpaulin-report.json");
   if (!existsSync29(reportPath)) {
     warn("Tarpaulin report not found at coverage/tarpaulin-report.json");
     return 0;
@@ -9743,8 +9741,8 @@ function parseTarpaulinCoverage(dir) {
 }
 function findCoverageSummary(dir) {
   const candidates = [
-    join29(dir, "coverage", "coverage-summary.json"),
-    join29(dir, "src", "coverage", "coverage-summary.json")
+    join30(dir, "coverage", "coverage-summary.json"),
+    join30(dir, "src", "coverage", "coverage-summary.json")
   ];
   for (const p of candidates) {
     if (existsSync29(p)) return p;
@@ -9755,7 +9753,7 @@ function findCoverageSummary(dir) {
 // src/lib/coverage/runner.ts
 import { execSync as execSync7 } from "child_process";
 import { existsSync as existsSync30, readFileSync as readFileSync27 } from "fs";
-import { join as join30 } from "path";
+import { join as join31 } from "path";
 function detectCoverageTool(dir) {
   const baseDir = dir ?? process.cwd();
   const stateHint = getStateToolHint(baseDir);
@@ -9788,7 +9786,7 @@ function detectRustCoverageTool(dir) {
     warn("cargo-tarpaulin not installed \u2014 coverage detection unavailable");
     return { tool: "unknown", runCommand: "", reportFormat: "" };
   }
-  const cargoPath = join30(dir, "Cargo.toml");
+  const cargoPath = join31(dir, "Cargo.toml");
   let isWorkspace = false;
   try {
     const cargoContent = readFileSync27(cargoPath, "utf-8");
@@ -9811,8 +9809,8 @@ function getStateToolHint(dir) {
   }
 }
 function detectNodeCoverageTool(dir, stateHint) {
-  const hasVitestConfig = existsSync30(join30(dir, "vitest.config.ts")) || existsSync30(join30(dir, "vitest.config.js"));
-  const pkgPath = join30(dir, "package.json");
+  const hasVitestConfig = existsSync30(join31(dir, "vitest.config.ts")) || existsSync30(join31(dir, "vitest.config.js"));
+  const pkgPath = join31(dir, "package.json");
   let hasVitestCoverageV8 = false;
   let hasVitestCoverageIstanbul = false;
   let hasC8 = false;
@@ -9873,7 +9871,7 @@ function getNodeTestCommand(scripts, runner) {
   return "npm test";
 }
 function detectPythonCoverageTool(dir) {
-  const reqPath = join30(dir, "requirements.txt");
+  const reqPath = join31(dir, "requirements.txt");
   if (existsSync30(reqPath)) {
     try {
       const content = readFileSync27(reqPath, "utf-8");
@@ -9887,7 +9885,7 @@ function detectPythonCoverageTool(dir) {
     } catch {
     }
   }
-  const pyprojectPath = join30(dir, "pyproject.toml");
+  const pyprojectPath = join31(dir, "pyproject.toml");
   if (existsSync30(pyprojectPath)) {
     try {
       const content = readFileSync27(pyprojectPath, "utf-8");
@@ -10720,7 +10718,7 @@ function registerStatusCommand(program) {
 
 // src/modules/audit/dimensions.ts
 import { existsSync as existsSync33, readdirSync as readdirSync8 } from "fs";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 function gap(dimension, description, suggestedFix) {
   return { dimension, description, suggestedFix };
 }
@@ -10832,15 +10830,15 @@ function checkDocumentation(projectDir) {
 function checkVerification(projectDir) {
   try {
     const gaps = [];
-    const sprintPath = join32(projectDir, "_bmad-output", "implementation-artifacts", "sprint-status.yaml");
+    const sprintPath = join33(projectDir, "_bmad-output", "implementation-artifacts", "sprint-status.yaml");
     if (!existsSync33(sprintPath)) return dimOk("verification", "warn", "no sprint data", [gap("verification", "No sprint-status.yaml found", "Run sprint planning to create sprint status")]);
-    const vDir = join32(projectDir, "verification");
+    const vDir = join33(projectDir, "verification");
     let proofCount = 0, totalChecked = 0;
     if (existsSync33(vDir)) {
       for (const file of readdirSafe(vDir)) {
         if (!file.endsWith("-proof.md")) continue;
         totalChecked++;
-        const r = parseProof(join32(vDir, file));
+        const r = parseProof(join33(vDir, file));
         if (isOk(r) && r.data.passed) {
           proofCount++;
         } else {
@@ -10918,7 +10916,7 @@ function formatAuditJson(result) {
 
 // src/modules/audit/fix-generator.ts
 import { existsSync as existsSync34, writeFileSync as writeFileSync15, mkdirSync as mkdirSync12 } from "fs";
-import { join as join33, dirname as dirname5 } from "path";
+import { join as join34, dirname as dirname5 } from "path";
 function buildStoryKey(gap2, index) {
   const safeDimension = gap2.dimension.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "");
   return `audit-fix-${safeDimension}-${index}`;
@@ -10950,7 +10948,7 @@ function generateFixStories(auditResult) {
     const stories = [];
     let created = 0;
     let skipped = 0;
-    const artifactsDir = join33(
+    const artifactsDir = join34(
       process.cwd(),
       "_bmad-output",
       "implementation-artifacts"
@@ -10959,7 +10957,7 @@ function generateFixStories(auditResult) {
       for (let i = 0; i < dimension.gaps.length; i++) {
         const gap2 = dimension.gaps[i];
         const key = buildStoryKey(gap2, i + 1);
-        const filePath = join33(artifactsDir, `${key}.md`);
+        const filePath = join34(artifactsDir, `${key}.md`);
         if (existsSync34(filePath)) {
           stories.push({
             key,
@@ -11150,7 +11148,7 @@ function registerOnboardCommand(program) {
 
 // src/commands/teardown.ts
 import { existsSync as existsSync35, unlinkSync as unlinkSync3, readFileSync as readFileSync29, writeFileSync as writeFileSync16, rmSync as rmSync4 } from "fs";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 function buildDefaultResult() {
   return {
     status: "ok",
@@ -11196,7 +11194,7 @@ function registerTeardownCommand(program) {
     } else if (otlpMode === "remote-routed") {
       if (!options.keepDocker) {
         try {
-          const { stopCollectorOnly: stopCollectorOnly2 } = await import("./docker-SV6TB753.js");
+          const { stopCollectorOnly: stopCollectorOnly2 } = await import("./docker-Z6B3GBST.js");
           stopCollectorOnly2();
           result.docker.stopped = true;
           if (!isJson) {
@@ -11228,7 +11226,7 @@ function registerTeardownCommand(program) {
         info("Shared stack: kept running (other projects may use it)");
       }
     } else if (isLegacyStack) {
-      const { isStackRunning: isStackRunning2, stopStack } = await import("./docker-SV6TB753.js");
+      const { isStackRunning: isStackRunning2, stopStack } = await import("./docker-Z6B3GBST.js");
       let stackRunning = false;
       try {
         stackRunning = isStackRunning2(composeFile);
@@ -11253,7 +11251,7 @@ function registerTeardownCommand(program) {
           info("Docker stack: not running, skipping");
         }
       }
-      const composeFilePath = join34(projectDir, composeFile);
+      const composeFilePath = join35(projectDir, composeFile);
       if (existsSync35(composeFilePath)) {
         unlinkSync3(composeFilePath);
         result.removed.push(composeFile);
@@ -11261,7 +11259,7 @@ function registerTeardownCommand(program) {
           ok(`Removed: ${composeFile}`);
         }
       }
-      const otelConfigPath = join34(projectDir, "otel-collector-config.yaml");
+      const otelConfigPath = join35(projectDir, "otel-collector-config.yaml");
       if (existsSync35(otelConfigPath)) {
         unlinkSync3(otelConfigPath);
         result.removed.push("otel-collector-config.yaml");
@@ -11281,7 +11279,7 @@ function registerTeardownCommand(program) {
     }
     const stacks = state.stacks ?? (state.stack ? [state.stack] : []);
     if (state.otlp?.enabled && stacks.includes("nodejs")) {
-      const pkgPath = join34(projectDir, "package.json");
+      const pkgPath = join35(projectDir, "package.json");
       if (existsSync35(pkgPath)) {
         try {
           const raw = readFileSync29(pkgPath, "utf-8");
@@ -11324,7 +11322,7 @@ function registerTeardownCommand(program) {
         }
       }
     }
-    const harnessDir = join34(projectDir, ".harness");
+    const harnessDir = join35(projectDir, ".harness");
     if (existsSync35(harnessDir)) {
       rmSync4(harnessDir, { recursive: true, force: true });
       result.removed.push(".harness/");
@@ -12015,7 +12013,7 @@ function registerQueryCommand(program) {
 
 // src/commands/retro-import.ts
 import { existsSync as existsSync37, readFileSync as readFileSync31 } from "fs";
-import { join as join36 } from "path";
+import { join as join37 } from "path";
 
 // src/lib/retro-parser.ts
 var KNOWN_TOOLS = ["showboat", "ralph", "beads", "bmad"];
@@ -12133,7 +12131,7 @@ function isDuplicate(newItem, existingTitles, threshold = 0.8) {
 
 // src/lib/issue-tracker.ts
 import { existsSync as existsSync36, readFileSync as readFileSync30, writeFileSync as writeFileSync17, mkdirSync as mkdirSync13 } from "fs";
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 import { parse as parse6, stringify as stringify3 } from "yaml";
 var VALID_PRIORITIES = /* @__PURE__ */ new Set([
   "low",
@@ -12141,9 +12139,9 @@ var VALID_PRIORITIES = /* @__PURE__ */ new Set([
   "high",
   "critical"
 ]);
-var ISSUES_REL_PATH = join35(".codeharness", "issues.yaml");
+var ISSUES_REL_PATH = join36(".codeharness", "issues.yaml");
 function issuesPath(dir) {
-  return join35(dir, ISSUES_REL_PATH);
+  return join36(dir, ISSUES_REL_PATH);
 }
 function readIssues(dir = process.cwd()) {
   const filePath = issuesPath(dir);
@@ -12159,7 +12157,7 @@ function readIssues(dir = process.cwd()) {
 }
 function writeIssues(data, dir = process.cwd()) {
   const filePath = issuesPath(dir);
-  const dirPath = join35(dir, ".codeharness");
+  const dirPath = join36(dir, ".codeharness");
   if (!existsSync36(dirPath)) {
     mkdirSync13(dirPath, { recursive: true });
   }
@@ -12320,7 +12318,7 @@ function registerRetroImportCommand(program) {
       return;
     }
     const retroFile = `epic-${epicNum}-retrospective.md`;
-    const retroPath = join36(root, STORY_DIR3, retroFile);
+    const retroPath = join37(root, STORY_DIR3, retroFile);
     if (!existsSync37(retroPath)) {
       fail(`Retro file not found: ${retroFile}`, { json: isJson });
       process.exitCode = 1;
@@ -12821,7 +12819,7 @@ function registerValidateStateCommand(program) {
 
 // src/commands/validate-schema.ts
 import { readdirSync as readdirSync9, existsSync as existsSync38 } from "fs";
-import { join as join37, resolve as resolve6 } from "path";
+import { join as join38, resolve as resolve6 } from "path";
 function renderSchemaResult(result, isJson) {
   if (isJson) {
     jsonOutput(result);
@@ -12841,7 +12839,7 @@ function renderSchemaResult(result, isJson) {
   process.exitCode = result.status === "pass" ? 0 : 1;
 }
 function runSchemaValidation(projectDir) {
-  const workflowsDir = join37(projectDir, ".codeharness", "workflows");
+  const workflowsDir = join38(projectDir, ".codeharness", "workflows");
   if (!existsSync38(workflowsDir)) {
     return {
       status: "fail",
@@ -13150,7 +13148,7 @@ function registerAuditCommand(program) {
 
 // src/commands/stats.ts
 import { existsSync as existsSync39, readdirSync as readdirSync10, readFileSync as readFileSync32, writeFileSync as writeFileSync18 } from "fs";
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 var RATES = {
   input: 15,
   output: 75,
@@ -13235,10 +13233,10 @@ function parseLogFile(filePath, report) {
   }
 }
 function generateReport3(projectDir, logsDir) {
-  const ralphLogs = join38(projectDir, "ralph", "logs");
-  const sessionLogs = join38(projectDir, "session-logs");
+  const ralphLogs = join39(projectDir, "ralph", "logs");
+  const sessionLogs = join39(projectDir, "session-logs");
   const resolvedLogsDir = logsDir ?? (existsSync39(ralphLogs) ? ralphLogs : sessionLogs);
-  const logFiles = readdirSync10(resolvedLogsDir).filter((f) => f.endsWith(".log")).sort().map((f) => join38(resolvedLogsDir, f));
+  const logFiles = readdirSync10(resolvedLogsDir).filter((f) => f.endsWith(".log")).sort().map((f) => join39(resolvedLogsDir, f));
   const report = {
     byPhase: /* @__PURE__ */ new Map(),
     byStory: /* @__PURE__ */ new Map(),
@@ -13339,10 +13337,10 @@ function registerStatsCommand(program) {
     const projectDir = process.cwd();
     let logsDir;
     if (options.logsDir) {
-      logsDir = join38(projectDir, options.logsDir);
+      logsDir = join39(projectDir, options.logsDir);
     } else {
-      const ralphLogs = join38(projectDir, "ralph", "logs");
-      const sessionLogs = join38(projectDir, "session-logs");
+      const ralphLogs = join39(projectDir, "ralph", "logs");
+      const sessionLogs = join39(projectDir, "session-logs");
       logsDir = existsSync39(ralphLogs) ? ralphLogs : sessionLogs;
     }
     if (!existsSync39(logsDir)) {
@@ -13358,7 +13356,7 @@ function registerStatsCommand(program) {
     const formatted = formatReport2(report);
     console.log(formatted);
     if (options.save) {
-      const outPath = join38(projectDir, "_bmad-output", "implementation-artifacts", "cost-report.md");
+      const outPath = join39(projectDir, "_bmad-output", "implementation-artifacts", "cost-report.md");
       writeFileSync18(outPath, formatted, "utf-8");
       ok(`Report saved to ${outPath}`);
     }
@@ -14215,7 +14213,7 @@ function registerDriversCommand(program) {
 }
 
 // src/index.ts
-var VERSION = true ? "0.36.2" : "0.0.0-dev";
+var VERSION = true ? "0.36.3" : "0.0.0-dev";
 function createProgram() {
   const program = new Command();
   program.name("codeharness").description("Makes autonomous coding agents produce software that actually works").version(VERSION).option("--json", "Output in machine-readable JSON format");