loki-mode 11.17.34 → 11.17.35

package/packages/control-plane/dist/server.js

@@ -10877,6 +10877,21 @@ async function run(argv, opts = {}) {
       clearTimeout(killTimer);
   }
 }
+async function commandExists(name) {
+  const safe = shEscape(name);
+  const r = await run(["sh", "-c", `command -v ${safe}`], { timeoutMs: 5000 });
+  if (r.exitCode === 0) {
+    const path = r.stdout.trim();
+    return path || null;
+  }
+  return null;
+}
+function shEscape(name) {
+  if (!/^[A-Za-z0-9._/-]+$/.test(name)) {
+    throw new Error(`refused to shell-escape suspect token: ${name}`);
+  }
+  return name;
+}
 var MAX_STDOUT_BYTES;
 var init_shell = __esm(() => {
   MAX_STDOUT_BYTES = 16 * 1024 * 1024;
@@ -10886,6 +10901,23 @@ var init_shell = __esm(() => {
 import { accessSync, constants as constants3, existsSync as existsSync26, mkdtempSync as mkdtempSync4, readFileSync as readFileSync33, realpathSync as realpathSync17, rmSync as rmSync11, statSync as statSync16 } from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
 import { tmpdir as tmpdir5 } from "os";
+async function findPython3() {
+  if (_pythonCache !== undefined)
+    return _pythonCache;
+  const homebrew = "/opt/homebrew/bin/python3.12";
+  if (existsSync26(homebrew)) {
+    _pythonCache = homebrew;
+    return homebrew;
+  }
+  const py312 = await commandExists("python3.12");
+  if (py312) {
+    _pythonCache = py312;
+    return py312;
+  }
+  const py3 = await commandExists("python3");
+  _pythonCache = py3;
+  return py3;
+}
 function resolvePython3() {
   for (const dir of (process.env.PATH ?? "").split(":")) {
     if (!dir || !dir.startsWith("/"))
@@ -10922,7 +10954,7 @@ function pySignatures(src) {
     return [];
   }
 }
-var PY_TIMEOUT_MS = 5000, PY_SCRIPT = `
+var _pythonCache, PY_TIMEOUT_MS = 5000, PY_SCRIPT = `
 import ast, sys, json, re
 def u(n): return ast.unparse(n)
 def chain(n):
@@ -12232,176 +12264,162 @@ var init_wall_owned = __esm(() => {
   ANSI2 = /\u001b\[[0-9;?]*[ -/]*[@-~]/g;
 });
 
-// ../../loki-ts/src/project_graph.ts
-import { createHash as createHash13 } from "crypto";
-import {
-  existsSync as existsSync28,
-  readdirSync as readdirSync16,
-  readFileSync as readFileSync37,
-  statSync as statSync17,
-  writeFileSync as writeFileSync21,
-  mkdirSync as mkdirSync18
-} from "fs";
-import { basename as basename19, dirname as dirname16, join as join48, resolve as resolve14 } from "path";
-function readManifest(path) {
-  if (!existsSync28(path)) {
-    return null;
-  }
-  let raw2;
-  try {
-    raw2 = readFileSync37(path, "utf8");
-  } catch {
-    return null;
-  }
-  let parsed;
+// ../../loki-ts/src/util/app_probe.ts
+import { spawnSync as spawnSync4 } from "child_process";
+import { existsSync as existsSync28, mkdirSync as mkdirSync18, readFileSync as readFileSync37, renameSync as renameSync11, writeFileSync as writeFileSync21 } from "fs";
+import { join as join48 } from "path";
+function readJson4(p) {
   try {
-    parsed = JSON.parse(raw2);
+    const v = JSON.parse(readFileSync37(p, "utf8"));
+    return v && typeof v === "object" ? v : null;
   } catch {
     return null;
   }
-  if (typeof parsed !== "object" || parsed === null) {
-    return null;
-  }
-  const obj = parsed;
-  if (obj["schema_version"] !== SUPPORTED_SCHEMA_VERSION) {
-    console.warn(`[loki:project_graph] unsupported schema_version in ${path}: ` + `${String(obj["schema_version"])} (expected ${SUPPORTED_SCHEMA_VERSION})`);
-    return null;
-  }
-  const appId = obj["app_id"];
-  if (typeof appId !== "string" || !APP_ID_REGEX.test(appId)) {
-    console.warn(`[loki:project_graph] invalid app_id in ${path}: ${String(appId)}`);
-    return null;
-  }
-  const members = Array.isArray(obj["members"]) ? obj["members"].filter((m) => typeof m === "string") : [];
-  const sharedMemoryDir = typeof obj["shared_memory_dir"] === "string" ? obj["shared_memory_dir"] : undefined;
-  return {
-    schema_version: SUPPORTED_SCHEMA_VERSION,
-    app_id: appId,
-    members,
-    shared_memory_dir: sharedMemoryDir
-  };
 }
-function resolveMembers(rootDir, declared, selfBasename) {
-  const out2 = [];
-  const seen = new Set;
-  let children;
+function stopApp(repoDir, opts = {}) {
+  const runner = opts.runnerPath ?? join48(REPO_ROOT, "autonomy", "app-runner.sh");
+  if (!existsSync28(runner) || !existsSync28(join48(repoDir, ".loki", "app-runner", "app.pid")))
+    return;
+  spawnSync4("bash", ["-c", STOP, "app-probe", repoDir, runner], { cwd: repoDir, env: plainTestEnv(), timeout: opts.timeoutMs ?? 60000, killSignal: "SIGKILL", stdio: "ignore" });
+}
+async function appProbe(repoDir, lokiDir2, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 60000, runner = opts.runnerPath ?? join48(REPO_ROOT, "autonomy", "app-runner.sh");
+  const dir = join48(repoDir, ".loki", "app-runner"), checks = [];
+  const t0 = Date.now();
+  const mk2 = (name, result, reason) => ({ name, cmd: "autonomy/app-runner.sh", result, duration_s: (Date.now() - t0) / 1000, reason });
+  const sh = (script) => {
+    const r = spawnSync4("bash", ["-c", script, "app-probe", repoDir, runner], { cwd: repoDir, env: { ...plainTestEnv(), ...opts.env ?? {} }, encoding: "utf8", timeout: timeoutMs, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
+    return { out: r.stdout ?? "", status: r.error ? null : r.status };
+  };
+  let pid = null, url = null;
+  if (!existsSync28(runner))
+    return { checks: [mk2("app boot", "not_run", "app-runner.sh not found"), mk2("http probe", "not_run", "app not booted")], pid, url };
   try {
-    children = readdirSync16(rootDir);
+    const b = sh(BOOT);
+    const m = b.out.match(/__APP_PROBE__ (-?\d+) (-?\d+) (-?\d+)/);
+    if (!m) {
+      checks.push(mk2("app boot", "not_run", b.status === null ? "bash unavailable or boot timed out" : "app-runner did not report"), mk2("http probe", "not_run", "app not booted"));
+      return { checks, pid, url };
+    }
+    const ir = Number(m[1]), sr = Number(m[2]), hr = Number(m[3]);
+    const pidTxt = existsSync28(join48(dir, "app.pid")) ? readFileSync37(join48(dir, "app.pid"), "utf8").trim() : "";
+    pid = /^\d+$/.test(pidTxt) && sr >= 0 ? Number(pidTxt) : null;
+    const st = readJson4(join48(dir, "state.json"));
+    url = typeof st?.["url"] === "string" ? st["url"] : null;
+    if (sr < 0) {
+      checks.push(mk2("app boot", "not_run", ir === 0 ? "app-runner detected no app" : "no runnable app detected or runtime missing"), mk2("http probe", "not_run", "app not booted"));
+      return { checks, pid, url };
+    }
+    if (sr !== 0) {
+      checks.push(mk2("app boot", "fail", "app start command failed or exited"), mk2("http probe", "not_run", "app not booted"));
+      return { checks, pid, url };
+    }
+    checks.push(mk2("app boot", "pass", "app process started"));
+    const health = readJson4(join48(dir, "health.json"));
+    checks.push(hr === 0 && health?.["ok"] === true ? mk2("http probe", "pass", "health.json ok") : mk2("http probe", "fail", "app-runner health check failed"));
+    if (opts.specText !== undefined && checks[1]?.result === "pass" && url)
+      checks.push(await functionalVerify(opts, url, dir, lokiDir2, timeoutMs));
+    return { checks, pid, url };
+  } finally {
+    if (!opts.skipStop)
+      stopApp(repoDir, { runnerPath: runner, timeoutMs });
+  }
+}
+async function functionalVerify(opts, url, dir, lokiDir2, timeoutMs) {
+  const t0 = Date.now();
+  const res = (result, reason) => ({ name: "functional verify", cmd: "autonomy/lib/functional-verify.py", result, duration_s: (Date.now() - t0) / 1000, reason });
+  const py = await findPython3(), script = opts.verifyPath ?? join48(REPO_ROOT, "autonomy", "lib", "functional-verify.py");
+  if (!py || !existsSync28(script))
+    return res("not_run", "python3 or functional-verify.py unavailable");
+  const specFile = join48(dir, "spec.txt");
+  writeFileSync21(specFile, opts.specText ?? "");
+  const r = spawnSync4(py, ["-I", script, specFile, url], { env: plainTestEnv(), encoding: "utf8", timeout: timeoutMs, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
+  let out2 = null;
+  try {
+    const v = JSON.parse(r.stdout ?? "");
+    out2 = v && typeof v === "object" ? v : null;
   } catch {
-    children = [];
-  }
-  const matchPattern = (pattern, name) => {
-    if (!pattern.includes("*") && !pattern.includes("?")) {
-      return pattern === name;
-    }
-    const re = new RegExp("^" + pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".") + "$");
-    return re.test(name);
-  };
-  for (const name of declared) {
-    for (const child of children) {
-      if (!matchPattern(name, child))
-        continue;
-      const full = join48(rootDir, child);
-      if (seen.has(full))
-        continue;
-      let st;
-      try {
-        st = statSync17(full);
-      } catch {
-        continue;
-      }
-      if (!st.isDirectory())
-        continue;
-      seen.add(full);
-      out2.push(full);
-    }
-  }
-  if (declared.length === 0) {
-    for (const child of children) {
-      const full = join48(rootDir, child);
-      if (seen.has(full))
-        continue;
-      let st;
-      try {
-        st = statSync17(full);
-      } catch {
-        continue;
-      }
-      if (!st.isDirectory())
-        continue;
-      if (!existsSync28(join48(full, ".loki", "app.json")))
-        continue;
-      seen.add(full);
-      out2.push(full);
-    }
-  }
-  return out2;
-}
-function cacheKey(manifestPaths) {
-  const parts = [];
-  for (const p of manifestPaths.sort()) {
-    let mtime = 0;
-    try {
-      mtime = statSync17(p).mtimeMs;
-    } catch {}
-    parts.push(`${p}:${mtime}`);
-  }
-  return createHash13("sha256").update(parts.join("|")).digest("hex");
-}
-function writeCache(targetDir, key, result) {
+    out2 = null;
+  }
+  if (!out2 || r.status !== 0)
+    return res("not_run", "functional harness produced no result");
+  const q = join48(lokiDir2, "quality");
+  mkdirSync18(q, { recursive: true });
+  const tmp = join48(q, `functional-results.json.tmp.${process.pid}`);
+  writeFileSync21(tmp, JSON.stringify(out2, null, 2));
+  renameSync11(tmp, join48(q, "functional-results.json"));
+  const s = String(out2["functional_status"] ?? "inconclusive");
+  return res(s === "verified" ? "pass" : s === "failed" ? "fail" : "not_run", `functional_status ${s}`);
+}
+var PRELUDE = `set +e
+log_info() { :; }; log_warn() { :; }; log_error() { :; }; log_step() { :; }; register_pid() { :; }
+export APP_RUNNER_ENABLED=true
+export TARGET_DIR="$1"
+source "$2" >/dev/null 2>&1 || exit 90
+`, BOOT, STOP;
+var init_app_probe = __esm(() => {
+  init_check_result();
+  init_python();
+  init_paths();
+  BOOT = `${PRELUDE}
+app_runner_init >/dev/null 2>&1; ir=$?
+sr=-1; hr=-1
+if [ "$ir" -eq 0 ] && [ -s "$TARGET_DIR/.loki/app-runner/detection.json" ]; then
+  app_runner_start >/dev/null 2>&1; sr=$?
+  [ "$sr" -eq 0 ] && { app_runner_health_check >/dev/null 2>&1; hr=$?; }
+fi
+printf '__APP_PROBE__ %s %s %s\\n' "$ir" "$sr" "$hr"
+`;
+  STOP = `${PRELUDE}
+_app_runner_dir
+app_runner_stop >/dev/null 2>&1
+`;
+});
+
+// ../../loki-ts/src/util/secure_scan.ts
+import { existsSync as existsSync29 } from "fs";
+import { join as join49 } from "path";
+function fail(error) {
+  return { ok: false, findings: [], error };
+}
+async function runSecureScan(targetDir, opts = {}) {
+  const script = opts.scriptPath ?? join49(REPO_ROOT, "autonomy", "lib", "secure-scan.py");
+  if (!existsSync29(script))
+    return fail(`secure-scan script not found: ${script}`);
+  const py = await findPython3();
+  if (!py)
+    return fail("python3 not found");
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_SECURE_SCAN_TIMEOUT_MS;
+  const started = Date.now();
+  const res = await run([py, script, targetDir, "--json", ...opts.secretsEverywhere ? ["--secrets-everywhere"] : []], { timeoutMs });
+  const elapsed = Date.now() - started;
+  let parsed;
   try {
-    const cacheDir = join48(targetDir, ".loki", "state");
-    mkdirSync18(cacheDir, { recursive: true });
-    const cachePath = join48(cacheDir, "project-graph.json");
-    writeFileSync21(cachePath, JSON.stringify({ key, result }, null, 2), "utf8");
-  } catch {}
-}
-function discoverProjectGraph(targetDir) {
-  const absTarget = resolve14(targetDir);
-  const targetManifest = join48(absTarget, ".loki", "app.json");
-  const parentDir = dirname16(absTarget);
-  const parentManifest = join48(parentDir, ".loki", "app.json");
-  const examined = [];
-  let chosenManifest = null;
-  let chosenRoot = "";
-  if (existsSync28(parentManifest) && parentDir !== absTarget) {
-    examined.push(parentManifest);
-    chosenManifest = readManifest(parentManifest);
-    chosenRoot = parentDir;
-  }
-  if (!chosenManifest && existsSync28(targetManifest)) {
-    examined.push(targetManifest);
-    chosenManifest = readManifest(targetManifest);
-    chosenRoot = absTarget;
-  }
-  if (!chosenManifest)
-    return null;
-  const declared = chosenManifest.members ?? [];
-  const members = resolveMembers(chosenRoot, declared, basename19(absTarget));
-  const filtered = [];
-  for (const m of members) {
-    const sibManifestPath = join48(m, ".loki", "app.json");
-    if (existsSync28(sibManifestPath)) {
-      examined.push(sibManifestPath);
-      const sibManifest = readManifest(sibManifestPath);
-      if (sibManifest && sibManifest.app_id !== chosenManifest.app_id) {
-        continue;
-      }
-    }
-    filtered.push(m);
-  }
-  const result = {
-    appId: chosenManifest.app_id,
-    root: chosenRoot,
-    members: filtered,
-    sharedMemoryDir: chosenManifest.shared_memory_dir
-  };
-  writeCache(absTarget, cacheKey(examined), result);
-  return result;
-}
-var APP_ID_REGEX, SUPPORTED_SCHEMA_VERSION = 1;
-var init_project_graph = __esm(() => {
-  APP_ID_REGEX = /^[a-z0-9-]{3,40}$/;
+    parsed = JSON.parse(res.stdout);
+  } catch {
+    parsed = undefined;
+  }
+  const obj = parsed && typeof parsed === "object" ? parsed : undefined;
+  if ((res.exitCode === 0 || res.exitCode === 1) && obj && Array.isArray(obj.findings)) {
+    const findings = obj.findings;
+    if (res.exitCode === 1 === findings.length > 0)
+      return { ok: true, findings };
+    return fail(`secure-scan exit ${res.exitCode} disagrees with ${findings.length} findings`);
+  }
+  if (res.exitCode !== 0 && res.exitCode !== 1 && res.exitCode !== 2 && elapsed >= timeoutMs) {
+    return fail(`secure-scan timed out after ${timeoutMs}ms`);
+  }
+  if (obj && typeof obj.error === "string")
+    return fail(`secure-scan: ${obj.error}`);
+  const tail = (res.stderr || res.stdout).trim().split(`
+`).slice(-3).join(" | ");
+  return fail(`secure-scan failed (exit ${res.exitCode}): ${tail}`);
+}
+var DEFAULT_SECURE_SCAN_TIMEOUT_MS = 120000;
+var init_secure_scan = __esm(() => {
+  init_paths();
+  init_python();
+  init_shell();
 });
 
 // ../../loki-ts/src/runner/retry_class.ts
@@ -12509,10 +12527,10 @@ var init_route_block = __esm(() => {
 
 // ../../loki-ts/src/features/visual_evidence.ts
 import { spawn as spawn7 } from "child_process";
-import { createHash as createHash14, randomBytes as randomBytes5 } from "crypto";
-import { existsSync as existsSync29, lstatSync as lstatSync10, mkdirSync as mkdirSync19, readdirSync as readdirSync17, readFileSync as readFileSync38, writeFileSync as writeFileSync22 } from "fs";
+import { createHash as createHash13, randomBytes as randomBytes5 } from "crypto";
+import { existsSync as existsSync30, lstatSync as lstatSync10, mkdirSync as mkdirSync19, readdirSync as readdirSync16, readFileSync as readFileSync38, writeFileSync as writeFileSync22 } from "fs";
 import { createServer } from "net";
-import { dirname as dirname17, isAbsolute as isAbsolute7, join as join49, normalize as normalize3, relative as relative6, sep as sep11 } from "path";
+import { dirname as dirname16, isAbsolute as isAbsolute7, join as join50, normalize as normalize3, relative as relative6, sep as sep11 } from "path";
 function routeFor(file) {
   let r = file.replace(/^(?:.*?\/)?(?:app|pages|src|public)\//, "").replace(/^(?:routes|pages)\//, "");
   r = r.replace(/\.(?:html|jsx|tsx|vue|svelte)$/, "").replace(/\/?(?:page|index|\+page)$/, "");
@@ -12522,7 +12540,7 @@ function hashScreens(runDir, rels) {
   const out2 = [];
   for (const rel of rels) {
     try {
-      out2.push({ path: rel, sha256: sha256File(join49(runDir, rel)) });
+      out2.push({ path: rel, sha256: sha256File(join50(runDir, rel)) });
     } catch {}
   }
   return out2;
@@ -12535,14 +12553,14 @@ function checkScreens(runDir, screens) {
       return "evidence_screens entry is malformed";
     if (isAbsolute7(s.path) || normalize3(s.path).startsWith(".."))
       return `evidence screenshot path escapes the evidence dir: ${s.path}`;
-    const file = join49(runDir, s.path);
+    const file = join50(runDir, s.path);
     let cur = runDir;
     for (const seg of normalize3(s.path).split(sep11)) {
-      cur = join49(cur, seg);
+      cur = join50(cur, seg);
       if (isSymlink(cur))
         return `evidence screenshot path is a symlink: ${s.path}`;
     }
-    if (!existsSync29(file))
+    if (!existsSync30(file))
       return `evidence screenshot is missing: ${s.path}`;
     if (!isRegularFile(file))
       return `evidence screenshot is not a regular file: ${s.path}`;
@@ -12585,8 +12603,8 @@ async function waitUp(url, ms, signal) {
 }
 function openapiPaths(repoDir) {
   for (const f of ["openapi.json", "openapi.yaml", "openapi.yml", "swagger.json"]) {
-    const p = join49(repoDir, f);
-    if (!existsSync29(p))
+    const p = join50(repoDir, f);
+    if (!existsSync30(p))
       continue;
     try {
       const txt = readFileSync38(p, "utf8");
@@ -12603,24 +12621,24 @@ async function recordE2eMedia(repoDir, runDir, relDir, base, routes, ms, signal)
   if (!pw || !pkg)
     return { rels: [], skipped: "playwright e2e video and trace skipped: @playwright/test is not installed in the repo" };
   try {
-    const dir = join49(runDir, relDir, "e2e");
+    const dir = join50(runDir, relDir, "e2e");
     mkdirSync19(dir, { recursive: true });
-    writeFileSync22(join49(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
-    writeFileSync22(join49(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
+    writeFileSync22(join50(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
+    writeFileSync22(join50(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
 `);
-    if (!await shoot(pw, ["test", "--config", join49(dir, "playwright.config.cjs")], repoDir, ms, signal))
+    if (!await shoot(pw, ["test", "--config", join50(dir, "playwright.config.cjs")], repoDir, ms, signal))
       return { rels: [], skipped: "playwright e2e video and trace skipped: the run failed or timed out" };
     const rels = [];
     const walk = (d) => {
-      for (const e of readdirSync17(d, { withFileTypes: true })) {
-        const full = join49(d, e.name);
+      for (const e of readdirSync16(d, { withFileTypes: true })) {
+        const full = join50(d, e.name);
         if (e.isDirectory())
           walk(full);
         else if (e.isFile() && /\.(webm|zip)$/.test(e.name))
-          rels.push(join49(relDir, "e2e", relative6(dir, full)));
+          rels.push(join50(relDir, "e2e", relative6(dir, full)));
       }
     };
-    walk(join49(dir, "out"));
+    walk(join50(dir, "out"));
     return rels.length > 0 ? { rels, skipped: null } : { rels, skipped: "playwright e2e video and trace skipped: no video or trace was produced" };
   } catch (e) {
     return { rels: [], skipped: `playwright e2e video and trace skipped: ${String(e?.message ?? e).slice(0, 120)}` };
@@ -12699,15 +12717,15 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     if (!visualEvidenceEnabled(opts.env))
       return skip("LOKI_VISUAL_EVIDENCE is 0");
     const api = loadProjectApi(repoDir), boot = isMultiRoot(api) ? api.uiBoot() : null;
-    const appDir = boot ? join49(repoDir, boot.boot.cwd) : repoDir;
-    const pkgPath = join49(appDir, "package.json");
+    const appDir = boot ? join50(repoDir, boot.boot.cwd) : repoDir;
+    const pkgPath = join50(appDir, "package.json");
     let script = null;
     if (!boot) {
-      if (!existsSync29(pkgPath)) {
-        const subs = ["backend", "frontend"].filter((d) => existsSync29(join49(repoDir, d, "package.json")));
+      if (!existsSync30(pkgPath)) {
+        const subs = ["backend", "frontend"].filter((d) => existsSync30(join50(repoDir, d, "package.json")));
         const has = (d) => {
           try {
-            return pickScript(JSON.parse(readFileSync38(join49(repoDir, d, "package.json"), "utf8"))) !== null;
+            return pickScript(JSON.parse(readFileSync38(join50(repoDir, d, "package.json"), "utf8"))) !== null;
           } catch {
             return false;
           }
@@ -12741,20 +12759,20 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (!await waitUp(base, left(), signal))
       return skip(aborted() ? "aborted" : `${script} server did not answer within ${Math.round(budget / 1000)}s`);
-    const evRoot = join49(runDir, "evidence");
+    const evRoot = join50(runDir, "evidence");
     if (isSymlink(evRoot))
       return skip("evidence dir is a symlink");
     mkdirSync19(evRoot, { recursive: true });
     if (pages.length > 0) {
-      const rel0 = join49("evidence", randomBytes5(6).toString("hex"));
-      mkdirSync19(join49(runDir, rel0));
+      const rel0 = join50("evidence", randomBytes5(6).toString("hex"));
+      mkdirSync19(join50(runDir, rel0));
       const rels = [];
       for (const route of [...new Set(pages.map(routeFor))].slice(0, opts.maxRoutes ?? MAX_ROUTES)) {
         if (aborted() || left() <= 0)
           break;
-        const rel = join49(rel0, `${screenName(route)}.png`);
-        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join49(runDir, rel)], appDir, left(), signal);
-        if (ok && !aborted() && !isSymlink(join49(runDir, rel)) && existsSync29(join49(runDir, rel)))
+        const rel = join50(rel0, `${screenName(route)}.png`);
+        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join50(runDir, rel)], appDir, left(), signal);
+        if (ok && !aborted() && !isSymlink(join50(runDir, rel)) && existsSync30(join50(runDir, rel)))
           rels.push(rel);
       }
       if (aborted())
@@ -12779,9 +12797,9 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (aborted())
       return skip("aborted");
-    const hdir = join49(evRoot, randomBytes5(6).toString("hex"));
+    const hdir = join50(evRoot, randomBytes5(6).toString("hex"));
     mkdirSync19(hdir);
-    writeFileSync22(join49(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
+    writeFileSync22(join50(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
 `);
     return { screens: [], http: true, skipped: null };
   } catch (e) {
@@ -12808,14 +12826,14 @@ async function sealEvidence(repoDir, runDir, o, notProven, signal, emit) {
 function receiptScreensProblem(receiptPath, receipt) {
   if (visualGateEnabled() && typeof receipt["evidence_failed"] === "string")
     return `visual evidence failed (LOKI_VISUAL_GATE=1): ${receipt["evidence_failed"]}`;
-  return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname17(receiptPath), receipt["evidence_screens"]);
+  return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname16(receiptPath), receipt["evidence_screens"]);
 }
-var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash14("sha256").update(readFileSync38(p)).digest("hex"), playwrightBin = (repoDir) => {
-  const bin = join49(repoDir, "node_modules", ".bin", "playwright");
-  return existsSync29(bin) ? bin : null;
+var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash13("sha256").update(readFileSync38(p)).digest("hex"), playwrightBin = (repoDir) => {
+  const bin = join50(repoDir, "node_modules", ".bin", "playwright");
+  return existsSync30(bin) ? bin : null;
 }, playwrightTestPkg = (repoDir) => {
-  const d = join49(repoDir, "node_modules", "@playwright", "test");
-  return existsSync29(join49(d, "package.json")) ? d : null;
+  const d = join50(repoDir, "node_modules", "@playwright", "test");
+  return existsSync30(join50(d, "package.json")) ? d : null;
 }, e2eSpecSource = (pkgDir, base, routes) => `const { test } = require(${JSON.stringify(pkgDir)});
 test("loki e2e walkthrough", async ({ page }) => {
   for (const r of ${JSON.stringify(routes)}) { await page.goto(${JSON.stringify(base)} + r); await page.waitForLoadState("load"); }
@@ -12858,7 +12876,7 @@ var init_outbox = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/pr.ts
-import { join as join50 } from "path";
+import { join as join51 } from "path";
 var DEFAULT_PUSH_SH;
 var init_pr = __esm(() => {
   init_types();
@@ -12875,16 +12893,16 @@ var init_pr = __esm(() => {
   init_run_outputs();
   init_yaml_key();
   init_outbox();
-  DEFAULT_PUSH_SH = join50(REPO_ROOT, "autonomy/lib/engine10-push.sh");
+  DEFAULT_PUSH_SH = join51(REPO_ROOT, "autonomy/lib/engine10-push.sh");
 });
 
 // ../../loki-ts/src/util/pr_lessons.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync7, readFileSync as readFileSync39, rmSync as rmSync15, writeFileSync as writeFileSync23 } from "fs";
-import { dirname as dirname18, join as join51 } from "path";
-import { createHash as createHash15 } from "crypto";
+import { existsSync as existsSync31, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync7, readFileSync as readFileSync39, rmSync as rmSync15, writeFileSync as writeFileSync23 } from "fs";
+import { dirname as dirname17, join as join52 } from "path";
+import { createHash as createHash14 } from "crypto";
 function loadLessons(repoDir) {
   const p = lessonsPath(repoDir);
-  if (!existsSync30(p))
+  if (!existsSync31(p))
     return [];
   try {
     const j = JSON.parse(readFileSync39(p, "utf-8"));
@@ -12895,11 +12913,11 @@ function loadLessons(repoDir) {
 }
 function save(repoDir, lessons) {
   const p = lessonsPath(repoDir);
-  mkdirSync20(dirname18(p), { recursive: true });
+  mkdirSync20(dirname17(p), { recursive: true });
   atomicWriteJson(p, { version: 2, lessons });
 }
 function appendReceiptFact(repoDir, f, now2 = () => new Date) {
-  const id = `rcp-${createHash15("sha256").update(f.runId).digest("hex").slice(0, 12)}`;
+  const id = `rcp-${createHash14("sha256").update(f.runId).digest("hex").slice(0, 12)}`;
   const lessons = loadLessons(repoDir);
   if (lessons.some((l) => l.id === id))
     return false;
@@ -12929,7 +12947,7 @@ function recordRunVerdict(repoDir, runId, verdict) {
   if (dirty)
     save(repoDir, lessons);
 }
-var lessonsPath = (repoDir) => join51(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), KINDS;
+var lessonsPath = (repoDir) => join52(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), KINDS;
 var init_pr_lessons = __esm(() => {
   init_atomic();
   init_safe_git();
@@ -12961,8 +12979,8 @@ var init_attempts = __esm(() => {
 var init_mcp_config = () => {};
 
 // ../../loki-ts/src/providers/claude_flags.ts
-import { existsSync as existsSync31, readFileSync as readFileSync40 } from "fs";
-import { resolve as resolvePath, dirname as dirname19 } from "path";
+import { existsSync as existsSync32, readFileSync as readFileSync40 } from "fs";
+import { resolve as resolvePath, dirname as dirname18 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function claudeFlagSupported(flag, helpText) {
   const txt = helpText ?? _claudeHelpCache;
@@ -13009,13 +13027,13 @@ function leanReviewerFlags(opts = {}) {
 }
 function designArchetypesText() {
   try {
-    const moduleDir = dirname19(fileURLToPath4(import.meta.url));
+    const moduleDir = dirname18(fileURLToPath4(import.meta.url));
     for (const rel of [
       ["..", "..", "..", "references", "design-archetypes.md"],
       ["..", "..", "references", "design-archetypes.md"]
     ]) {
       const p = resolvePath(moduleDir, ...rel);
-      if (existsSync31(p))
+      if (existsSync32(p))
         return readFileSync40(p, "utf8");
     }
   } catch {}
@@ -13100,12 +13118,12 @@ var init_providers = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/route_record.ts
-import { existsSync as existsSync32, lstatSync as lstatSync11, mkdirSync as mkdirSync21, readFileSync as readFileSync41, writeFileSync as writeFileSync24 } from "fs";
-import { join as join52 } from "path";
+import { existsSync as existsSync33, lstatSync as lstatSync11, mkdirSync as mkdirSync21, readFileSync as readFileSync41, writeFileSync as writeFileSync24 } from "fs";
+import { join as join53 } from "path";
 function loadRouteRecord(runDir) {
   try {
-    const p = join52(runDir, ROUTE_RECORD_FILE);
-    if (!existsSync32(p) || !lstatSync11(p).isFile())
+    const p = join53(runDir, ROUTE_RECORD_FILE);
+    if (!existsSync33(p) || !lstatSync11(p).isFile())
       return;
     const v = JSON.parse(readFileSync41(p, "utf8"));
     return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
@@ -13236,7 +13254,7 @@ var init_worker = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/package_suite.ts
-import { join as join53 } from "path";
+import { join as join54 } from "path";
 async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
   const api = loadProjectApi(repoDir);
   if (!isMultiRoot(api))
@@ -13247,7 +13265,7 @@ async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
   for (const pkg of withTests) {
     const tc = pkg.commands.test, name = `full suite: ${pkg.name}`, cmd = `(cd ${tc.cwd} && ${tc.cmd})`;
     const started = Date.now();
-    const r = await run(["bash", "-c", tc.cmd], { cwd: join53(repoDir, tc.cwd), timeoutMs: opts.timeoutMs, ...opts.path ? { env: { PATH: opts.path } } : {} });
+    const r = await run(["bash", "-c", tc.cmd], { cwd: join54(repoDir, tc.cwd), timeoutMs: opts.timeoutMs, ...opts.path ? { env: { PATH: opts.path } } : {} });
     const duration_s = (Date.now() - started) / 1000;
     if (signal.aborted) {
       checks.push({ name, cmd, result: "not_run", duration_s });
@@ -13256,7 +13274,7 @@ async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
     }
     const out2 = `${r.stdout}
 ${r.stderr}`;
-    const lr = r.exitCode === 0 || !opts.baseSha ? undefined : await harnessLoadReason({ repoDir, baseSha: opts.baseSha, out: out2, cmd: "bash", args: ["-c", tc.cmd], signal, cwd: join53(repoDir, tc.cwd), ...opts.path ? { env: { PATH: opts.path } } : {} });
+    const lr = r.exitCode === 0 || !opts.baseSha ? undefined : await harnessLoadReason({ repoDir, baseSha: opts.baseSha, out: out2, cmd: "bash", args: ["-c", tc.cmd], signal, cwd: join54(repoDir, tc.cwd), ...opts.path ? { env: { PATH: opts.path } } : {} });
     if (lr) {
       checks.push({ name, cmd, result: "not_run", duration_s });
       notProven.add(`${lr} (${name}; harness-owned)`);
@@ -13290,14 +13308,14 @@ __export(exports_deep, {
   DEFAULT_SECRET_SCAN_SH: () => DEFAULT_SECRET_SCAN_SH,
   DEFAULT_PUSH_SH: () => DEFAULT_PUSH_SH2
 });
-import { existsSync as existsSync33, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync8, rmSync as rmSync16, writeFileSync as writeFileSync25 } from "fs";
+import { copyFileSync as copyFileSync3, existsSync as existsSync34, lstatSync as lstatSync12, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync8, rmSync as rmSync16, writeFileSync as writeFileSync25 } from "fs";
 import { tmpdir as tmpdir9 } from "os";
-import { join as join54 } from "path";
+import { dirname as dirname19, join as join55 } from "path";
 function sessionCouncil(sessions) {
   return { async run(input, signal) {
-    const cwd = mkdtempSync8(join54(tmpdir9(), "loki-deep-council-"));
+    const cwd = mkdtempSync8(join55(tmpdir9(), "loki-deep-council-"));
     try {
-      writeFileSync25(join54(cwd, "diff.patch"), input.diff, "utf8");
+      writeFileSync25(join55(cwd, "diff.patch"), input.diff, "utf8");
       const r = await sessions.run({
         stage: "deep",
         tier: "development",
@@ -13364,16 +13382,20 @@ ${r.stderr}`, lr = r.exitCode === 0 ? undefined : await harnessLoadReason({ repo
       notProven.add(`not run: ${name} (${cls.reason ?? NO_TESTS_REASON})`);
   }
 }
-function runAppBoot(ctx, opts, checks, notProven) {
-  const discover = opts.discoverGraph ?? discoverProjectGraph;
-  let graph = null;
+async function runAppBoot(ctx, opts, checks, notProven) {
+  let r;
   try {
-    graph = discover(ctx.repoDir);
-  } catch {
-    graph = null;
+    r = await (opts.appProbe ?? appProbe)(ctx.repoDir, join55(ctx.repoDir, ".loki"));
+  } catch (err) {
+    r = { checks: [{ name: "app boot", cmd: "autonomy/app-runner.sh", result: "not_run", duration_s: 0, reason: `app probe threw: ${err.message}` }], pid: null, url: null };
+  }
+  if (!r.checks.some((c) => c.name === "app boot"))
+    notProven.add("not run: app boot (app probe reported no result)");
+  for (const c of r.checks) {
+    checks.push(c);
+    if (c.result === "not_run")
+      notProven.add(`not run: ${c.name} (${c.reason ?? "no reason given"})`);
   }
-  checks.push({ name: "app boot", cmd: "project_graph.ts discoverProjectGraph", result: "not_run", duration_s: 0 });
-  notProven.add(graph ? `app boot not run (app graph discovered, ${graph.members.length} member(s))` : "app boot not run (no app graph discovered)");
 }
 async function runCouncilCheck(ctx, changed, baseSha, signal, opts, checks, notProven) {
   const codeFiles = changed.filter((f) => !f.endsWith(".md"));
@@ -13404,30 +13426,48 @@ async function runCouncilCheck(ctx, changed, baseSha, signal, opts, checks, notP
     notProven.add(`council (refused: ${err.message})`);
   }
 }
+async function secureScanChanged(repoDir, changed, opts) {
+  const dir = mkdtempSync8(join55(tmpdir9(), "loki-deep-secure-"));
+  try {
+    for (const f of changed)
+      if (existsSync34(join55(repoDir, f)) && lstatSync12(join55(repoDir, f)).isFile()) {
+        mkdirSync22(dirname19(join55(dir, f)), { recursive: true });
+        copyFileSync3(join55(repoDir, f), join55(dir, f));
+      }
+    return await runSecureScan(dir, { ...opts.secureScanPath ? { scriptPath: opts.secureScanPath } : {}, timeoutMs: 60000 });
+  } finally {
+    rmSync16(dir, { recursive: true, force: true });
+  }
+}
 async function runSecretScan(ctx, changed, opts, checks, notProven) {
-  const scriptPath = opts.secretScanShPath ?? DEFAULT_SECRET_SCAN_SH;
-  const name = "security scan";
-  if (!existsSync33(scriptPath)) {
-    checks.push({ name, cmd: "secret-scan.sh", result: "not_run", duration_s: 0 });
+  const scriptPath = opts.secretScanShPath ?? DEFAULT_SECRET_SCAN_SH, name = "security scan", cmd = "secret-scan.sh + secure-scan.py";
+  if (!existsSync34(scriptPath)) {
+    checks.push({ name, cmd, result: "not_run", duration_s: 0 });
     notProven.add(`not run: ${name} (secret-scan.sh not found)`);
     return;
   }
   if (changed.length === 0) {
-    checks.push({ name, cmd: "secret-scan.sh", result: "pass", duration_s: 0 });
+    checks.push({ name, cmd, result: "pass", duration_s: 0 });
     return;
   }
   const inline = 'script="$1"; shift; . "$script" || exit 3; hit=0; for f in "$@"; do if _commit_scan_secret_file "$f" || _commit_path_looks_secret "$f"; then printf "%s\\n" "$f"; hit=1; fi; done; exit "$hit"';
   const started = Date.now();
-  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join54(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
-  const durationS = (Date.now() - started) / 1000;
-  if (r.exitCode === 3) {
-    checks.push({ name, cmd: "secret-scan.sh", result: "not_run", duration_s: durationS });
-    notProven.add(`not run: ${name} (secret-scan.sh failed to load)`);
-    return;
-  }
-  const hits = r.stdout.split(`
-`).map((l) => l.trim()).filter(Boolean);
-  checks.push({ name, cmd: "secret-scan.sh", result: hits.length > 0 ? "fail" : "pass", duration_s: durationS, ...hits.length > 0 ? { reason: `secret match: ${hits.join(", ")}` } : {} });
+  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join55(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
+  const sec = await secureScanChanged(ctx.repoDir, changed, opts), gaps = [], reasons = [];
+  const hits = r.exitCode === 3 ? [] : r.stdout.split(`
+`).map((l) => l.trim()).filter(Boolean), high = sec.findings.filter((f) => String(f.severity).toUpperCase() === "HIGH");
+  if (r.exitCode === 3)
+    gaps.push("secret-scan.sh failed to load");
+  if (!sec.ok)
+    gaps.push(sec.error ?? "secure-scan failed");
+  if (hits.length > 0)
+    reasons.push(`secret match: ${hits.join(", ")}`);
+  if (high.length > 0)
+    reasons.push(`secure-scan: ${high.map((f) => `${f.rule}: ${f.file}:${f.line}`).join(", ")}`);
+  const result = reasons.length > 0 ? "fail" : gaps.length > 0 ? "not_run" : "pass";
+  checks.push({ name, cmd, result, duration_s: (Date.now() - started) / 1000, ...result === "pass" ? {} : { reason: (result === "fail" ? reasons : gaps).join("; ") } });
+  if (result === "not_run")
+    notProven.add(`not run: ${name} (${gaps.join("; ")})`);
 }
 function commentArgv(prNumber, bodyFile) {
   return ["comment", prNumber, bodyFile];
@@ -13453,7 +13493,7 @@ async function postResults(ctx, opts, checks, notProven, statusState) {
   const prNumber = prUrl ? PR_NUMBER_RE.exec(prUrl)?.[1] : undefined;
   if (prNumber) {
     mkdirSync22(ctx.runDir, { recursive: true });
-    const bodyFile = join54(ctx.runDir, "deep-comment.md");
+    const bodyFile = join55(ctx.runDir, "deep-comment.md");
     writeFileSync25(bodyFile, buildCommentBody(checks, notProven, statusState), "utf8");
     const commentResult = await run(["bash", scriptPath, ...commentArgv(prNumber, bodyFile)], { cwd: ctx.repoDir, env, timeoutMs: 30000 });
     if (commentResult.exitCode !== 0)
@@ -13489,7 +13529,7 @@ async function runDeep(ctx, signal, opts = {}) {
   const checks = [];
   const notProven = new Set;
   await runFullSuite(ctx, signal, opts, checks, notProven);
-  runAppBoot(ctx, opts, checks, notProven);
+  await runAppBoot(ctx, opts, checks, notProven);
   await runCouncilCheck(ctx, changed, ctx.baseSha, signal, opts, checks, notProven);
   await runSecretScan(ctx, changed, opts, checks, notProven);
   const statusState = checks.some((c) => c.result === "fail") ? "failure" : "success";
@@ -13507,7 +13547,7 @@ async function runDeep(ctx, signal, opts = {}) {
   const sig = signReceipt(`${ctx.runId}-deep`, addendumSha256);
   const addendum = { ...addendumBody, addendum_sha256: addendumSha256, verification: { jwt: sig.jwt, kid: sig.kid } };
   mkdirSync22(ctx.runDir, { recursive: true });
-  writeFileSync25(join54(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
+  writeFileSync25(join55(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
 `);
   const pushNotProven = await postResults(ctx, opts, checks, notProvenList, statusState);
   const allNotProven = [...notProvenList, ...pushNotProven];
@@ -13516,7 +13556,8 @@ async function runDeep(ctx, signal, opts = {}) {
 }
 var DEFAULT_PUSH_SH2, DEFAULT_SECRET_SCAN_SH, MAX_COUNCIL_DIFF_BYTES = 400000, COUNCIL_LIMIT_S = 600, FULL_SUITE_TIMEOUT_MS = 300000, PR_NUMBER_RE, SHA_RE, FULL_SUITE_CMD, deepStage, stage;
 var init_deep = __esm(() => {
-  init_project_graph();
+  init_app_probe();
+  init_secure_scan();
   init_shell();
   init_load_owner();
   init_worker();
@@ -13551,9 +13592,9 @@ var init_deep = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/verify.ts
-import { existsSync as existsSync34, mkdtempSync as mkdtempSync9, realpathSync as realpathSync19, rmSync as rmSync17 } from "fs";
+import { existsSync as existsSync35, mkdtempSync as mkdtempSync9, realpathSync as realpathSync19, rmSync as rmSync17 } from "fs";
 import { tmpdir as tmpdir10 } from "os";
-import { dirname as dirname20, isAbsolute as isAbsolute8, join as join55, relative as relative7 } from "path";
+import { dirname as dirname20, isAbsolute as isAbsolute8, join as join56, relative as relative7 } from "path";
 function resolveTool(repoDir, bin, fallback, lastResort = fallback) {
   const inRepo = (p) => {
     try {
@@ -13564,7 +13605,7 @@ function resolveTool(repoDir, bin, fallback, lastResort = fallback) {
     }
   };
   const venvEnv = process.env["VIRTUAL_ENV"];
-  const project = [join55(repoDir, ".venv", "bin", bin), join55(repoDir, "venv", "bin", bin), ...venvEnv && inRepo(venvEnv) ? [join55(venvEnv, "bin", bin)] : []].find(existsSync34);
+  const project = [join56(repoDir, ".venv", "bin", bin), join56(repoDir, "venv", "bin", bin), ...venvEnv && inRepo(venvEnv) ? [join56(venvEnv, "bin", bin)] : []].find(existsSync35);
   return project ? [project, "project"] : [Bun.which(fallback) ? fallback : lastResort, "system"];
 }
 function runnerCmd(t, repoDir) {
@@ -13679,7 +13720,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
   const sus = pairs.filter(({ c }) => rel.has(c.name) && c.result === "pass");
   if (!(un.some(({ c }) => c.result === "fail" && c.ids?.length) || sus.length) || signal.aborted)
     return out2;
-  const dir = mkdtempSync9(join55(tmpdir10(), "e10-base-"));
+  const dir = mkdtempSync9(join56(tmpdir10(), "e10-base-"));
   const git3 = (args) => {
     safeGit(ctx.repoDir, args, { stdio: "ignore", repoDrivers: true });
   };
@@ -13717,7 +13758,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
   return out2;
 }
 function isLokiModeRepo(repoDir) {
-  return existsSync34(join55(repoDir, "scripts", "select-tests.sh"));
+  return existsSync35(join56(repoDir, "scripts", "select-tests.sh"));
 }
 async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   const { api, ...runOpts } = opts;
@@ -13739,9 +13780,9 @@ async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   }
   for (const g of groupByPackage(api, ctx.repoDir, changed.filter((f) => /\.(ts|tsx|js|jsx)$/.test(f)))) {
     const sfx = g.root === "." ? "" : `:${g.root}`, co = g.root === "." ? opts : { ...opts, cwd: g.cwd };
-    if (existsSync34(join55(g.cwd, "tsconfig.json")))
+    if (existsSync35(join56(g.cwd, "tsconfig.json")))
       await runCheck(ctx, `lint:tsc${sfx}`, "npx", ["tsc", "--noEmit", "-p", "."], signal, checks, { ...co, kind: "static" });
-    if (ESLINT_CONFIGS.some((f) => existsSync34(join55(g.cwd, f)))) {
+    if (ESLINT_CONFIGS.some((f) => existsSync35(join56(g.cwd, f)))) {
       const c = await runCheck(ctx, `lint:eslint${sfx}`, "npx", ["eslint", ...g.rel], signal, checks, { ...co, kind: "static" });
       if (await excuseLint(ctx, signal, c, "eslint", "npx", ["eslint"], g.cwd, g.rel, co))
         pre.push(c.name);
@@ -13756,7 +13797,7 @@ var CHECK_TIMEOUT_MS = 60000, excerpts, isHold = (c) => isHoldoutCheck(c.name),
   return r.missing || r.cut ? null : r;
 }, base: (f) => {
   try {
-    return safeGit(ctx.repoDir, ["show", `${ctx.baseSha}:${relative7(ctx.repoDir, join55(cwd, f))}`], { stdio: ["ignore", "pipe", "ignore"] });
+    return safeGit(ctx.repoDir, ["show", `${ctx.baseSha}:${relative7(ctx.repoDir, join56(cwd, f))}`], { stdio: ["ignore", "pipe", "ignore"] });
   } catch {
     return null;
   }
@@ -13921,8 +13962,8 @@ ${x}` : c.cmd };
 });
 
 // ../../loki-ts/src/project_model/conventions.ts
-import { existsSync as existsSync35, readdirSync as readdirSync18, readFileSync as readFileSync42 } from "fs";
-import { dirname as dirname21, join as join56 } from "path";
+import { existsSync as existsSync36, readdirSync as readdirSync17, readFileSync as readFileSync42 } from "fs";
+import { dirname as dirname21, join as join57 } from "path";
 function parseJsonc(text2) {
   let out2 = "", i = 0;
   while (i < text2.length) {
@@ -13948,7 +13989,7 @@ function parseJsonc(text2) {
   return JSON.parse(out2.replace(/,(\s*[}\]])/g, "$1"));
 }
 function moduleOf(file, depth = 0) {
-  const j = readJson4(file);
+  const j = readJson5(file);
   if (!j || depth > 4)
     return null;
   const m = j.compilerOptions?.module;
@@ -13957,25 +13998,25 @@ function moduleOf(file, depth = 0) {
   const ext = typeof j.extends === "string" ? j.extends : null;
   if (!ext || !ext.startsWith("."))
     return null;
-  const next = join56(dirname21(file), ext.endsWith(".json") ? ext : `${ext}.json`);
-  return existsSync35(next) ? moduleOf(next, depth + 1) : null;
+  const next = join57(dirname21(file), ext.endsWith(".json") ? ext : `${ext}.json`);
+  return existsSync36(next) ? moduleOf(next, depth + 1) : null;
 }
 function readPackageConventions(pkgDir, runner = null) {
   let names = [];
   try {
-    names = readdirSync18(pkgDir).filter((f) => f.endsWith(".json")).sort((x, y) => x.length - y.length || x.localeCompare(y));
+    names = readdirSync17(pkgDir).filter((f) => f.endsWith(".json")).sort((x, y) => x.length - y.length || x.localeCompare(y));
   } catch {
     return null;
   }
   let packageType = null, tsModule = null;
   for (const n2 of names) {
-    const j = readJson4(join56(pkgDir, n2));
+    const j = readJson5(join57(pkgDir, n2));
     if (!j)
       continue;
     if (packageType === null && typeof j.type === "string" && typeof j.name === "string")
       packageType = j.type;
     if (tsModule === null && j.compilerOptions !== undefined)
-      tsModule = moduleOf(join56(pkgDir, n2));
+      tsModule = moduleOf(join57(pkgDir, n2));
   }
   if (packageType === null && tsModule === null)
     return null;
@@ -13995,7 +14036,7 @@ function conventionViolation(c, fileName, content) {
   const code = content.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1").replace(/(["'`])(?:\\.|(?!\1)[^\\\n])*\1/g, '""');
   return /\bimport\.meta\b/.test(code) ? "import.meta is not allowed in a CommonJS package (TS1470)" : null;
 }
-var readJson4 = (p) => {
+var readJson5 = (p) => {
   try {
     const v = parseJsonc(readFileSync42(p, "utf8"));
     return v && typeof v === "object" && !Array.isArray(v) ? v : null;
@@ -14006,16 +14047,16 @@ var readJson4 = (p) => {
 var init_conventions = () => {};
 
 // ../../loki-ts/src/engine10/stages/wall.ts
-import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync36, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync10, readFileSync as readFileSync43, readdirSync as readdirSync19, realpathSync as realpathSync20, rmSync as rmSync18, writeFileSync as writeFileSync26 } from "fs";
+import { spawnSync as spawnSync5 } from "child_process";
+import { existsSync as existsSync37, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync10, readFileSync as readFileSync43, readdirSync as readdirSync18, realpathSync as realpathSync20, rmSync as rmSync18, writeFileSync as writeFileSync26 } from "fs";
 import { tmpdir as tmpdir11 } from "os";
-import { dirname as dirname22, isAbsolute as isAbsolute9, join as join57, relative as relative8 } from "path";
+import { dirname as dirname22, isAbsolute as isAbsolute9, join as join58, relative as relative8 } from "path";
 function pytestCollectionIsRed(output, repoDir) {
   if (/ModuleNotFoundError/.test(output))
     return false;
   const real2 = (p) => {
     try {
-      return realpathSync20(isAbsolute9(p) ? p : join57(repoDir, p));
+      return realpathSync20(isAbsolute9(p) ? p : join58(repoDir, p));
     } catch {
       return null;
     }
@@ -14052,7 +14093,7 @@ function pytestCollectionIsRed(output, repoDir) {
 }
 function moduleUnderRepo(repoDir, name) {
   const rel = name.replace(/\./g, "/");
-  return existsSync36(join57(repoDir, `${rel}.py`)) || existsSync36(join57(repoDir, rel, "__init__.py"));
+  return existsSync37(join58(repoDir, `${rel}.py`)) || existsSync37(join58(repoDir, rel, "__init__.py"));
 }
 function pytestExit1IsRed(output) {
   if (/^!+ _pytest\.outcomes\.Exit\b/m.test(output))
@@ -14107,26 +14148,26 @@ class RealBaseTestRunner {
   }
   run(repoDir, files) {
     this.lastNotRunFiles = [];
-    let pass = 0, fail = 0, not_run = 0;
+    let pass = 0, fail2 = 0, not_run = 0;
     const not_run_files = [];
     const api = this.api === undefined ? loadProjectApi(repoDir) : this.api;
     for (const f of files) {
       const { cmd, args, interpreter, cwd } = commandFor(f, repoDir, api);
-      const r = spawnSync4(cmd, f.runner === "pytest" ? [...args, "-rfE"] : args, { cwd, encoding: "utf8", timeout: Math.max(1000, this.timeoutMs), env: plainTestEnv() });
+      const r = spawnSync5(cmd, f.runner === "pytest" ? [...args, "-rfE"] : args, { cwd, encoding: "utf8", timeout: Math.max(1000, this.timeoutMs), env: plainTestEnv() });
       const status = r.error ? null : r.status;
       const result = classify(f, status, stripAnsi(`${r.stdout ?? ""}
 ${r.stderr ?? ""}`), repoDir, interpreter);
       if (result === "pass")
         pass++;
       else if (result === "fail")
-        fail++;
+        fail2++;
       else {
         not_run++;
         not_run_files.push({ file: f.path, reason: notRunReason(status, interpreter) });
       }
     }
     this.lastNotRunFiles = not_run_files;
-    return { pass, fail, not_run };
+    return { pass, fail: fail2, not_run };
   }
 }
 function buildWallBrief(task, repomapText = "", runners = [], hasManifest = false, conventions = "", acceptance = []) {
@@ -14151,8 +14192,8 @@ ${acceptance.map((a) => `Acceptance: ${a}`).join(`
 function loadTaskText(ctx, fromPrior) {
   if (fromPrior)
     return fromPrior;
-  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join57(ctx.runDir, "issue.json");
-  if (existsSync36(issueJsonPath)) {
+  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join58(ctx.runDir, "issue.json");
+  if (existsSync37(issueJsonPath)) {
     try {
       const issue = JSON.parse(readFileSync43(issueJsonPath, "utf8"));
       const text2 = [issue.title, issue.body].filter((s) => typeof s === "string" && s.length > 0).join(`
@@ -14166,7 +14207,7 @@ function loadTaskText(ctx, fromPrior) {
 }
 function wallTargetDir(repoDir, existingTests) {
   const first = existingTests[0];
-  return first ? join57(repoDir, dirname22(first.path)) : join57(repoDir, "tests");
+  return first ? join58(repoDir, dirname22(first.path)) : join58(repoDir, "tests");
 }
 function guessRunner(fileName, runners) {
   if (fileName.endsWith(".py"))
@@ -14199,11 +14240,11 @@ async function wallAuthor(ctx, signal, retry) {
   const tree = prior.intake?.tree;
   const repomapText = repoMapText(ctx.repoDir, tree, repomapRef, WALL_MAP_MAX_LINES);
   const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative8(ctx.repoDir, targetDir)}/x`);
-  const conv2 = readPackageConventions(join57(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
-  const cwd = mkdtempSync10(join57(tmpdir11(), "loki-e15-wall-"));
+  const conv2 = readPackageConventions(join58(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
+  const cwd = mkdtempSync10(join58(tmpdir11(), "loki-e15-wall-"));
   const wm = wallManifestFor(ctx.repoDir, tree, task);
   for (const [n2, c] of [["task.md", task], ["repomap.txt", repomapText], ...wm ? [["wall_manifest.txt", wm.text]] : []])
-    writeFileSync26(join57(cwd, n2), c, "utf8");
+    writeFileSync26(join58(cwd, n2), c, "utf8");
   const model = retry?.model ?? wallFirstModel(sz.size), iterationId = `${ctx.runId}-wall${retry?.suffix ?? ""}`;
   const session = await ctx.sessions.run({
     stage: "wall",
@@ -14219,15 +14260,15 @@ async function wallAuthor(ctx, signal, retry) {
     rmSync18(cwd, { recursive: true, force: true });
     return done({ status: "failed", data: { iteration_ids: [iterationId], model }, reason: "wall session aborted, killed, or timed out", killed: true });
   }
-  const all = readdirSync19(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !conventionViolation(conv2, n2, readFileSync43(join57(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
-  const sealedDir = join57(ctx.runDir, "wall");
+  const all = readdirSync18(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !conventionViolation(conv2, n2, readFileSync43(join58(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
+  const sealedDir = join58(ctx.runDir, "wall");
   if (generated.length > 0)
     mkdirSync23(sealedDir, { recursive: true });
   const contents = new Map;
   const discarded = [];
   for (const name of generated) {
-    const content = readFileSync43(join57(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
-    writeFileSync26(join57(sealedDir, name), content, "utf8");
+    const content = readFileSync43(join58(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
+    writeFileSync26(join58(sealedDir, name), content, "utf8");
     if (bad)
       discarded.push({ file: name, reason: `${bad}; wall test did not compile under the package config` });
     else
@@ -14247,7 +14288,7 @@ function installWall(ctx, a, baseDir, opts = {}) {
     const content = contents.get(name);
     if (content === undefined)
       continue;
-    const dest = join57(targetDir, name), runner = guessRunner(name, runners);
+    const dest = join58(targetDir, name), runner = guessRunner(name, runners);
     writeFileSync26(dest, content, "utf8");
     sealedFiles.push({ path: dest, sha256: sha2562(content) });
     readOnlyFiles.push({ path: dest, content });
@@ -14258,7 +14299,7 @@ function installWall(ctx, a, baseDir, opts = {}) {
   ctx.emit("wall.sealed", "wall", { files: sealedFiles, ...a.manifestSha256 ? { manifest_sha256: a.manifestSha256 } : {} });
   const baseRunner = opts.baseRunner ?? new RealBaseTestRunner, baseRun = { pass: 0, fail: 0, not_run: discarded.length }, notRunFiles = [];
   for (const t of wallTests) {
-    const r = baseRunner.run(baseDir, [t]), abs = join57(ctx.repoDir, t.path);
+    const r = baseRunner.run(baseDir, [t]), abs = join58(ctx.repoDir, t.path);
     baseRun.pass += r.pass;
     baseRun.fail += r.fail;
     baseRun.not_run += r.not_run ?? 0;
@@ -14298,7 +14339,7 @@ async function runWall(ctx, signal, opts = {}) {
   if (a.kind === "authored") {
     for (const f of first.data.files ?? [])
       rmSync18(f.path, { force: true });
-    rmSync18(join57(ctx.runDir, "wall"), { recursive: true, force: true });
+    rmSync18(join58(ctx.runDir, "wall"), { recursive: true, force: true });
     ctx.wallSealed = false;
   }
   removeHoldout(ctx.runId, ctx.repoDir);
@@ -14333,18 +14374,18 @@ var init_wall = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/discard.ts
-import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync12, mkdirSync as mkdirSync24, openSync as openSync9, readFileSync as readFileSync44, realpathSync as realpathSync21, rmdirSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync27 } from "fs";
-import { dirname as dirname23, join as join58, relative as relative9, sep as sep12 } from "path";
+import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync13, mkdirSync as mkdirSync24, openSync as openSync9, readFileSync as readFileSync44, realpathSync as realpathSync21, rmdirSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync27 } from "fs";
+import { dirname as dirname23, join as join59, relative as relative9, sep as sep12 } from "path";
 function safeRestore(repoDir, f, want, mode) {
-  const root = realpathSync21(repoDir), fp = join58(root, f), rel = relative9(root, dirname23(fp));
+  const root = realpathSync21(repoDir), fp = join59(root, f), rel = relative9(root, dirname23(fp));
   if (rel.startsWith(".."))
     throw new Error("outside repo");
   let cur = root;
   for (const part of rel === "" ? [] : rel.split(sep12)) {
-    cur = join58(cur, part);
+    cur = join59(cur, part);
     let st2;
     try {
-      st2 = lstatSync12(cur);
+      st2 = lstatSync13(cur);
     } catch {
       mkdirSync24(cur);
       continue;
@@ -14354,7 +14395,7 @@ function safeRestore(repoDir, f, want, mode) {
   }
   let st;
   try {
-    st = lstatSync12(fp);
+    st = lstatSync13(fp);
   } catch {
     st = null;
   }
@@ -14396,10 +14437,10 @@ async function discardIfSatisfied(git3, base, o, staged, keep, repoDir) {
     return { status: "failed", data: {}, reason: "already-satisfied discard failed" };
   const notProven = [];
   for (const [f, v] of Object.entries(o.intake?.preexisting_untracked_blobs ?? {})) {
-    const fp = join58(repoDir, f);
+    const fp = join59(repoDir, f);
     try {
       if (v.startsWith("!")) {
-        const st = lstatSync12(fp);
+        const st = lstatSync13(fp);
         if (`!${st.size}:${st.mtimeMs}:${st.ctimeMs}` !== v)
           throw new Error("changed, not snapshotted");
         continue;
@@ -14415,7 +14456,7 @@ async function discardIfSatisfied(git3, base, o, staged, keep, repoDir) {
       try {
         let m = 420;
         try {
-          const l = lstatSync12(join58(repoDir, f));
+          const l = lstatSync13(join59(repoDir, f));
           if (l.isFile())
             m = l.mode & 511;
         } catch {}
@@ -14459,7 +14500,7 @@ var init_commit_filter = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/scope.ts
-import { basename as basename21, dirname as dirname25 } from "path";
+import { basename as basename20, dirname as dirname25 } from "path";
 function contractText(o) {
   const c = o.intake?.contract_snapshot?.contract;
   return Array.isArray(c?.criteria) ? c.criteria.map((x) => typeof x?.text === "string" ? x.text : "").join(`
@@ -14474,26 +14515,26 @@ function outsideScope(o, staged) {
 ${typeof o.intake?.task === "string" ? o.intake.task : ""}
 ${contractText(o)}`, pre = o.intake?.preexisting_dirty ?? {};
   const toks = surfaceTokens(text2), plannedDirs = new Set(rel.map((r) => dirname25(r)).filter((d) => d !== "."));
-  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename21(f)) && !plannedDirs.has(dirname25(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
+  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename20(f)) && !plannedDirs.has(dirname25(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
 }
 function flagOutsideScope(o, staged) {
   const unit = unitFlags(staged, process.env, o.intake?.preexisting_dirty ?? {});
   const un = outsideScope(o, staged), seen = new Set((unit ?? []).map(outsideNote));
   return [...(unit ?? []).map(outsideNote), ...un ? un.map(outsideNote).filter((n2) => !seen.has(n2)) : staged.length > 0 ? [SCOPE_UNDETERMINED] : []];
 }
-var SCOPE_UNDETERMINED = "scope not determined; all edits committed", outsideNote = (f) => `outside stated scope: ${f}`, esc2 = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), mentions = (text2, name) => new RegExp(`(?<![\\w./-])${esc2(name)}(?![\\w-]|\\.\\w)`).test(text2), STOP, stem = (w) => w.length > 3 && w.endsWith("s") ? w.slice(0, -1) : w, surfaceTokens = (text2) => new Set((text2.toLowerCase().match(/[a-z][a-z0-9_-]{2,}/g) ?? []).filter((w) => !STOP.has(w)).map(stem)), dirSegs = (f) => f.split("/").slice(0, -1).map((d) => stem(d.toLowerCase()));
+var SCOPE_UNDETERMINED = "scope not determined; all edits committed", outsideNote = (f) => `outside stated scope: ${f}`, esc2 = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), mentions = (text2, name) => new RegExp(`(?<![\\w./-])${esc2(name)}(?![\\w-]|\\.\\w)`).test(text2), STOP2, stem = (w) => w.length > 3 && w.endsWith("s") ? w.slice(0, -1) : w, surfaceTokens = (text2) => new Set((text2.toLowerCase().match(/[a-z][a-z0-9_-]{2,}/g) ?? []).filter((w) => !STOP2.has(w)).map(stem)), dirSegs = (f) => f.split("/").slice(0, -1).map((d) => stem(d.toLowerCase()));
 var init_scope2 = __esm(() => {
   init_testmap();
   init_unit_mode();
-  STOP = new Set(["the", "and", "for", "with", "that", "this", "all", "any", "src", "from", "into", "each", "across", "apply", "add", "use", "make"]);
+  STOP2 = new Set(["the", "and", "for", "with", "that", "this", "all", "any", "src", "from", "into", "each", "across", "apply", "add", "use", "make"]);
 });
 
 // ../../loki-ts/src/council/role_agents.ts
-import { existsSync as existsSync37, readdirSync as readdirSync20, readFileSync as readFileSync45 } from "fs";
+import { existsSync as existsSync38, readdirSync as readdirSync19, readFileSync as readFileSync45 } from "fs";
 import { homedir as homedir9 } from "os";
-import { join as join59 } from "path";
+import { join as join60 } from "path";
 function agentDirs(repoDir, env = process.env) {
-  return [env["LOKI_AGENTS_PROJECT_DIR"] || join59(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join59(env["XDG_CONFIG_HOME"] || join59(homedir9(), ".config"), "loki", "agents")];
+  return [env["LOKI_AGENTS_PROJECT_DIR"] || join60(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join60(env["XDG_CONFIG_HOME"] || join60(homedir9(), ".config"), "loki", "agents")];
 }
 function parseAgent(file, stem2) {
   const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync45(file, "utf8"));
@@ -14510,18 +14551,18 @@ function parseAgent(file, stem2) {
 }
 function loadRoleAgent(repoDir, role, env = process.env) {
   for (const d of agentDirs(repoDir, env)) {
-    if (!existsSync37(d))
+    if (!existsSync38(d))
       continue;
     let names;
     try {
-      names = readdirSync20(d).filter((n2) => n2.endsWith(".md") && !n2.startsWith(".")).sort();
+      names = readdirSync19(d).filter((n2) => n2.endsWith(".md") && !n2.startsWith(".")).sort();
     } catch {
       continue;
     }
     const ordered = [...names.filter((n2) => n2 === `${role}.md`), ...names.filter((n2) => n2 !== `${role}.md`)];
     for (const n2 of ordered) {
       try {
-        const a = parseAgent(join59(d, n2), n2.slice(0, -3));
+        const a = parseAgent(join60(d, n2), n2.slice(0, -3));
         if (a && a.role === role)
           return a;
       } catch {}
@@ -14539,7 +14580,7 @@ var init_role_agents = __esm(() => {
 
 // ../../loki-ts/src/util/child_ledger.ts
 import { appendFileSync as appendFileSync4, mkdirSync as mkdirSync25 } from "fs";
-import { join as join60 } from "path";
+import { join as join61 } from "path";
 function unmeasuredRecord(phase, model, source) {
   return { phase, model, input_tokens: 0, output_tokens: 0, cache_creation_tokens: 0, cache_read_tokens: 0, source, cost_status: "unmeasured" };
 }
@@ -14564,9 +14605,9 @@ function recordFromClaudeResult(phase, payload, source = "claude-json") {
 }
 function appendChildLedger(lokiDir2, rec2) {
   try {
-    const dir = join60(lokiDir2, "metrics");
+    const dir = join61(lokiDir2, "metrics");
     mkdirSync25(dir, { recursive: true });
-    appendFileSync4(join60(dir, "child-sessions.jsonl"), `${JSON.stringify(rec2)}
+    appendFileSync4(join61(dir, "child-sessions.jsonl"), `${JSON.stringify(rec2)}
 `);
     return true;
   } catch {
@@ -14596,12 +14637,12 @@ var init_child_ledger = __esm(() => {
 });
 
 // ../../loki-ts/src/util/run_summary.ts
-import { existsSync as existsSync38, mkdirSync as mkdirSync26, readFileSync as readFileSync46, renameSync as renameSync11, statSync as statSync18, writeFileSync as writeFileSync28 } from "fs";
-import { join as join61 } from "path";
+import { existsSync as existsSync39, mkdirSync as mkdirSync26, readFileSync as readFileSync46, renameSync as renameSync12, statSync as statSync17, writeFileSync as writeFileSync28 } from "fs";
+import { join as join62 } from "path";
 function readRiskRecord(repoDir, sinceMs = 0) {
   try {
-    const p = join61(repoDir, ".loki", "state", "risk-tier.json");
-    if (statSync18(p).mtimeMs < sinceMs)
+    const p = join62(repoDir, ".loki", "state", "risk-tier.json");
+    if (statSync17(p).mtimeMs < sinceMs)
       return null;
     const r = JSON.parse(readFileSync46(p, "utf8"));
     return r && typeof r === "object" ? r : null;
@@ -14617,8 +14658,8 @@ var init_run_summary = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/xreview.ts
-import { existsSync as existsSync39, readFileSync as readFileSync47 } from "fs";
-import { join as join62 } from "path";
+import { existsSync as existsSync40, readFileSync as readFileSync47 } from "fs";
+import { join as join63 } from "path";
 function minVerdict(verdict, review) {
   const ceiling = review?.level === "block" ? "PARTIAL" : verdict;
   return RANK3[ceiling] < RANK3[verdict] ? ceiling : verdict;
@@ -14631,8 +14672,8 @@ function explicitReview(repoDir, env) {
   if (flag && isOff(ev))
     return "off";
   for (const f of ["loki.yaml", "loki.yml"]) {
-    const p = join62(repoDir, f);
-    if (!existsSync39(p))
+    const p = join63(repoDir, f);
+    if (!existsSync40(p))
       continue;
     try {
       const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync47(p, "utf8"));
@@ -14717,7 +14758,7 @@ Review ONLY the diff below. Do not modify files.` : "You are an independent code
   try {
     if (p === "claude")
       await ensureClaudeHelpCache();
-    const r = await withChildLedger(run, join62(ctx.repoDir, ".loki"), "xreview")(reviewArgv(p, prompt, process.env, p === "claude" ? agent?.model : undefined), { cwd: ctx.repoDir, timeoutMs: TIMEOUT_MS });
+    const r = await withChildLedger(run, join63(ctx.repoDir, ".loki"), "xreview")(reviewArgv(p, prompt, process.env, p === "claude" ? agent?.model : undefined), { cwd: ctx.repoDir, timeoutMs: TIMEOUT_MS });
     if (r.exitCode !== 0)
       return { provider: p, level: "not_run", notes: [`cross-review not run: ${p} exited ${r.exitCode}`] };
     return parseReview(p, r.stdout);
@@ -14811,14 +14852,14 @@ See also: loki cost --detail (what a run ALREADY spent)
 });
 
 // ../../loki-ts/src/features/contract.ts
-import { existsSync as existsSync40, lstatSync as lstatSync13, mkdirSync as mkdirSync27, readFileSync as readFileSync48, rmSync as rmSync19, writeFileSync as writeFileSync29 } from "fs";
-import { dirname as dirname26, join as join63 } from "path";
-import { createHash as createHash16 } from "crypto";
+import { existsSync as existsSync41, lstatSync as lstatSync14, mkdirSync as mkdirSync27, readFileSync as readFileSync48, rmSync as rmSync19, writeFileSync as writeFileSync29 } from "fs";
+import { dirname as dirname26, join as join64 } from "path";
+import { createHash as createHash15 } from "crypto";
 function contractEnabled(env = process.env) {
   return env["LOKI_CONTRACT"] !== "0";
 }
 function words(s) {
-  return [...new Set(s.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 3 && !STOP2.has(w)))];
+  return [...new Set(s.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 3 && !STOP3.has(w)))];
 }
 function overlaps(criterionWords, target) {
   const tw = new Set(words(target));
@@ -14844,13 +14885,13 @@ function untracedLines(trace) {
   return trace.criteria.filter((c) => c.status === "no_match").map((c) => `contract ${sanitizeCriterion(c.id)} untraced (no keyword match in changed files): ${sanitizeCriterion(c.text)}`);
 }
 function contractPath(repoDir) {
-  return join63(repoDir, ".loki", "contract.json");
+  return join64(repoDir, ".loki", "contract.json");
 }
 function readContract(repoDir) {
   const p = contractPath(repoDir);
   let st;
   try {
-    st = lstatSync13(p);
+    st = lstatSync14(p);
   } catch {
     return { contract: null, notes: [], sha256: null };
   }
@@ -14864,7 +14905,7 @@ function readContract(repoDir) {
   } catch {
     return { contract: null, notes: ["contract unreadable: read failed"], sha256: null };
   }
-  const sha2563 = createHash16("sha256").update(raw2).digest("hex");
+  const sha2563 = createHash15("sha256").update(raw2).digest("hex");
   let j;
   try {
     j = JSON.parse(raw2.toString("utf8"));
@@ -14895,7 +14936,7 @@ function sealContract(repoDir, body, rawDiff, checks, env = process.env, snap) {
     const live2 = readContract(repoDir);
     let exists2 = true;
     try {
-      lstatSync13(contractPath(repoDir));
+      lstatSync14(contractPath(repoDir));
     } catch {
       exists2 = false;
     }
@@ -14921,36 +14962,36 @@ function sealContract(repoDir, body, rawDiff, checks, env = process.env, snap) {
     return [`contract trace failed: ${sanitizeCriterion(e instanceof Error ? e.message : String(e))}`];
   }
 }
-var MAX_CRITERIA = 50, MAX_TEXT = 500, STOP2, MAX_CONTRACT_BYTES, REQ_MAP_REL, REQ_STOP;
+var MAX_CRITERIA = 50, MAX_TEXT = 500, STOP3, MAX_CONTRACT_BYTES, REQ_MAP_REL, REQ_STOP;
 var init_contract = __esm(() => {
   init_atomic();
   init_spec_file();
   init_paths();
   init_safe_git();
-  STOP2 = new Set(["the", "and", "for", "with", "that", "this", "must", "should", "shall", "when", "then", "are", "was", "all", "any", "can", "not", "has", "have", "from", "into", "each", "user", "users"]);
+  STOP3 = new Set(["the", "and", "for", "with", "that", "this", "must", "should", "shall", "when", "then", "are", "was", "all", "any", "can", "not", "has", "have", "from", "into", "each", "user", "users"]);
   MAX_CONTRACT_BYTES = 1024 * 1024;
-  REQ_MAP_REL = join63(".loki", "state", "requirements-map.json");
+  REQ_MAP_REL = join64(".loki", "state", "requirements-map.json");
   REQ_STOP = new Set(["with", "that", "this", "from", "have", "will", "should", "must", "when", "then", "into", "each", "every", "user", "users", "page", "able", "allow", "support", "ensure", "using", "their", "there", "which", "shall"]);
 });
 
 // ../../loki-ts/src/features/speed/seal_group.ts
-import { createHash as createHash17 } from "crypto";
-import { existsSync as existsSync41, mkdirSync as mkdirSync28, readdirSync as readdirSync21, readFileSync as readFileSync49, renameSync as renameSync12, statSync as statSync19, writeFileSync as writeFileSync30 } from "fs";
-import { dirname as dirname27, join as join64 } from "path";
+import { createHash as createHash16 } from "crypto";
+import { existsSync as existsSync42, mkdirSync as mkdirSync28, readdirSync as readdirSync20, readFileSync as readFileSync49, renameSync as renameSync13, statSync as statSync18, writeFileSync as writeFileSync30 } from "fs";
+import { dirname as dirname27, join as join65 } from "path";
 function sealGroup(runDir, rh) {
-  const manifestPath = join64(runDir, "group", "manifest.json");
-  if (!existsSync41(manifestPath))
+  const manifestPath = join65(runDir, "group", "manifest.json");
+  if (!existsSync42(manifestPath))
     return { section: undefined, notProven: [], problems: 0, allUnitsPass: true };
   const notProven = [];
   let problems = 0;
-  const fail = (m2) => {
+  const fail2 = (m2) => {
     problems++;
     notProven.push(`group: ${m2}`);
   };
-  const m = readJson5(manifestPath);
+  const m = readJson6(manifestPath);
   const list = isObj10(m) && Array.isArray(m["units"]) ? m["units"] : [];
   if (!isObj10(m) || !ID_RE.test(String(m["group_id"] ?? "")) || list.length === 0) {
-    fail("manifest missing, unreadable or empty");
+    fail2("manifest missing, unreadable or empty");
     return { section: undefined, notProven, problems, allUnitsPass: false };
   }
   const units = [];
@@ -14960,19 +15001,19 @@ function sealGroup(runDir, rh) {
     const u = isObj10(raw2) ? raw2 : {};
     const id = String(u["unit_id"] ?? "");
     if (!ID_RE.test(id) || seen.has(id) || seenLower.has(id.toLowerCase()))
-      return fail(`unit ${index2} has an invalid, duplicate or case-colliding id`);
+      return fail2(`unit ${index2} has an invalid, duplicate or case-colliding id`);
     seen.add(id);
     seenLower.add(id.toLowerCase());
-    const dir = join64(unitsDir(runDir), id), rp = join64(dir, "receipt.json"), ep = join64(dir, "events.jsonl");
+    const dir = join65(unitsDir(runDir), id), rp = join65(dir, "receipt.json"), ep = join65(dir, "events.jsonl");
     let bytes;
     try {
       bytes = readFileSync49(rp);
     } catch {
-      return fail(`unit ${id} sub-receipt missing`);
+      return fail2(`unit ${id} sub-receipt missing`);
     }
-    const sub = readJson5(rp);
+    const sub = readJson6(rp);
     if (!isObj10(sub) || typeof sub["receipt_sha256"] !== "string" || rh(sub) !== sub["receipt_sha256"])
-      return fail(`unit ${id} sub-receipt unreadable or its hash does not recompute`);
+      return fail2(`unit ${id} sub-receipt unreadable or its hash does not recompute`);
     const verdict = String(sub["verdict"] ?? "");
     if (!PASSING.has(verdict)) {
       allUnitsPass = false;
@@ -14983,7 +15024,7 @@ function sealGroup(runDir, rh) {
       unit_id: id,
       sub_receipt_sha256: sha3(bytes),
       receipt_sha256: sub["receipt_sha256"],
-      events_file_sha256: existsSync41(ep) ? sha3(readFileSync49(ep)) : null,
+      events_file_sha256: existsSync42(ep) ? sha3(readFileSync49(ep)) : null,
       verdict,
       goal: text2(u["goal"], 200),
       files: (Array.isArray(u["files"]) ? u["files"] : []).map((f) => text2(f, 200)).filter(Boolean).slice(0, 50),
@@ -14994,7 +15035,7 @@ function sealGroup(runDir, rh) {
   });
   const extra = (dirNames(unitsDir(runDir)) ?? []).filter((n3) => !seen.has(n3));
   for (const n3 of extra)
-    fail(`unit directory ${text2(n3, 64)} is not in the manifest`);
+    fail2(`unit directory ${text2(n3, 64)} is not in the manifest`);
   return { section: problems === 0 ? { group_id: String(m["group_id"]), units } : undefined, notProven, problems, allUnitsPass: allUnitsPass && problems === 0 };
 }
 function capGroupVerdict(v, g) {
@@ -15008,7 +15049,7 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
   const bad = (reason) => ({ verdict: "TAMPERED", reason: `group: ${reason}` });
   const g = receipt["group"];
   if (g === undefined)
-    return existsSync41(join64(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
+    return existsSync42(join65(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
   if (!isObj10(g) || !ID_RE.test(String(g["group_id"] ?? "")) || !Array.isArray(g["units"]) || g["units"].length === 0)
     return bad("group section malformed");
   const entries = g["units"];
@@ -15020,12 +15061,12 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("unit directories do not match the receipt (missing or extra unit)");
   let unchecked = null;
   for (let i = 0;i < entries.length; i++) {
-    const e = entries[i], id = ids[i], dir = join64(unitsDir(runDir), id), rp = join64(dir, "receipt.json"), ep = join64(dir, "events.jsonl");
+    const e = entries[i], id = ids[i], dir = join65(unitsDir(runDir), id), rp = join65(dir, "receipt.json"), ep = join65(dir, "events.jsonl");
     if (e["index"] !== i)
       return bad(`unit ${id} is out of order (index ${String(e["index"])} at position ${i})`);
     let bytes;
     try {
-      if (!statSync19(dir).isDirectory())
+      if (!statSync18(dir).isDirectory())
         return bad(`unit ${id} is not a directory`);
       bytes = readFileSync49(rp);
     } catch {
@@ -15033,10 +15074,10 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
     }
     if (sha3(bytes) !== e["sub_receipt_sha256"])
       return bad(`unit ${id} sub-receipt does not match its recorded hash`);
-    const evSha = existsSync41(ep) ? sha3(readFileSync49(ep)) : null;
+    const evSha = existsSync42(ep) ? sha3(readFileSync49(ep)) : null;
     if (evSha !== (e["events_file_sha256"] ?? null))
       return bad(`unit ${id} events.jsonl does not match its recorded hash`);
-    const sub = readJson5(rp);
+    const sub = readJson6(rp);
     if (!isObj10(sub) || sub["receipt_sha256"] !== e["receipt_sha256"] || rh(sub) !== e["receipt_sha256"])
       return bad(`unit ${id} sub-receipt hash does not recompute`);
     if (String(sub["verdict"] ?? "") !== e["verdict"])
@@ -15056,7 +15097,7 @@ function compositeVerdict(childVerdicts) {
   const failed2 = childVerdicts.filter((v) => v === "FAILED" || !["VERIFIED", "ALREADY_SATISFIED", "PARTIAL", "SPEC_CONFLICT"].includes(v)).length;
   return capGroupVerdict(base, { section: undefined, notProven: [], problems: failed2, allUnitsPass: childVerdicts.every((v) => PASSING.has(v)) });
 }
-var ID_RE, PASSING, sha3 = (b) => createHash17("sha256").update(b).digest("hex"), isObj10 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), text2 = (v, cap) => typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0, unitsDir = (runDir) => join64(runDir, "group", "units"), readJson5 = (p) => {
+var ID_RE, PASSING, sha3 = (b) => createHash16("sha256").update(b).digest("hex"), isObj10 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), text2 = (v, cap) => typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0, unitsDir = (runDir) => join65(runDir, "group", "units"), readJson6 = (p) => {
   try {
     return JSON.parse(readFileSync49(p, "utf8"));
   } catch {
@@ -15064,7 +15105,7 @@ var ID_RE, PASSING, sha3 = (b) => createHash17("sha256").update(b).digest("hex")
   }
 }, dirNames = (d) => {
   try {
-    return readdirSync21(d).filter((n3) => !n3.startsWith(".")).sort();
+    return readdirSync20(d).filter((n3) => !n3.startsWith(".")).sort();
   } catch {
     return null;
   }
@@ -15076,8 +15117,8 @@ var init_seal_group = __esm(() => {
 });
 
 // ../../loki-ts/src/supply/supply_guard.ts
-import { existsSync as existsSync42, readFileSync as readFileSync50, statSync as statSync20 } from "fs";
-import { basename as basename22, join as join65 } from "path";
+import { existsSync as existsSync43, readFileSync as readFileSync50, statSync as statSync19 } from "fs";
+import { basename as basename21, join as join66 } from "path";
 function supplyEnabled(env) {
   return env["LOKI_SUPPLY_GUARD"] !== "0";
 }
@@ -15089,14 +15130,14 @@ function supplyVerdict(verdict, r) {
   return r.blocked && verdict === "VERIFIED" ? "FAILED" : verdict;
 }
 function isManifestPath(path) {
-  return MANIFESTS.test(basename22(path));
+  return MANIFESTS.test(basename21(path));
 }
 function readDeclared(repoDir) {
-  const p = join65(repoDir, ".loki", DECLARED_FILE);
-  if (!existsSync42(p))
+  const p = join66(repoDir, ".loki", DECLARED_FILE);
+  if (!existsSync43(p))
     return { deps: [], problem: null };
   try {
-    if (statSync20(p).size > MAX_FILE_BYTES)
+    if (statSync19(p).size > MAX_FILE_BYTES)
       return { deps: [], problem: "declaration file too large" };
     const j = JSON.parse(readFileSync50(p, "utf8"));
     if (!Array.isArray(j))
@@ -15118,8 +15159,8 @@ function readDeclared(repoDir) {
   }
 }
 function readAllowlist(repoDir) {
-  const p = join65(repoDir, ".loki", "supply-allowlist");
-  if (!existsSync42(p))
+  const p = join66(repoDir, ".loki", "supply-allowlist");
+  if (!existsSync43(p))
     return new Set;
   try {
     return new Set(readFileSync50(p, "utf8").split(`
@@ -15163,7 +15204,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "npm") {
     if (privateUrlList([env["npm_config_registry"] ?? "", env["NPM_CONFIG_REGISTRY"] ?? ""]))
       return true;
-    return files(join65(repoDir, ".npmrc"), home ? join65(home, ".npmrc") : "").some((t) => t.split(`
+    return files(join66(repoDir, ".npmrc"), home ? join66(home, ".npmrc") : "").some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:(@[^:\s]+):)?registry\s*=\s*(\S+)/.exec(l);
       return !!m && privateUrl(m[2]) && (m[1] === undefined || name.startsWith(`${m[1]}/`));
@@ -15172,7 +15213,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "pypi") {
     if (privateUrlList([env["PIP_INDEX_URL"] ?? "", env["PIP_EXTRA_INDEX_URL"] ?? ""]))
       return true;
-    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join65(home, ".config", "pip", "pip.conf") : "", home ? join65(home, ".pip", "pip.conf") : "", join65(repoDir, "pip.conf")];
+    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join66(home, ".config", "pip", "pip.conf") : "", home ? join66(home, ".pip", "pip.conf") : "", join66(repoDir, "pip.conf")];
     return files(...cfg).some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:extra-)?index-url\s*[=:]\s*(.+)$/.exec(l);
@@ -15182,7 +15223,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "cargo") {
     if (Object.keys(env).some((k) => /^CARGO_REGISTRIES_.+_INDEX$/.test(k) || /^CARGO_SOURCE_/.test(k)))
       return true;
-    return files(join65(repoDir, ".cargo", "config.toml"), join65(repoDir, ".cargo", "config"), home ? join65(home, ".cargo", "config.toml") : "", home ? join65(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
+    return files(join66(repoDir, ".cargo", "config.toml"), join66(repoDir, ".cargo", "config"), home ? join66(home, ".cargo", "config.toml") : "", home ? join66(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
   }
   if (eco === "go") {
     const gp = goEnv["GOPROXY"] ?? env["GOPROXY"] ?? "";
@@ -15305,7 +15346,7 @@ var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50,
   }
 }, PUBLIC_HOSTS, hostOf = (u) => u.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^www\./, "").split(/[/?#\s]/)[0].replace(/^[^@]*@/, "").replace(/:\d+$/, ""), privateUrl = (u) => /[a-z0-9]/i.test(u) && !PUBLIC_HOSTS.has(hostOf(u)), readSmall = (p) => {
   try {
-    return statSync20(p).size <= MAX_FILE_BYTES ? readFileSync50(p, "utf8") : "";
+    return statSync19(p).size <= MAX_FILE_BYTES ? readFileSync50(p, "utf8") : "";
   } catch {
     return "";
   }
@@ -15320,9 +15361,9 @@ var init_supply_guard = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/seal.ts
-import { createHash as createHash18 } from "crypto";
-import { existsSync as existsSync43, readdirSync as readdirSync22, mkdirSync as mkdirSync29, readFileSync as readFileSync51, writeFileSync as writeFileSync31 } from "fs";
-import { basename as basename23, isAbsolute as isAbsolute10, join as join66, relative as relative10 } from "path";
+import { createHash as createHash17 } from "crypto";
+import { existsSync as existsSync44, readdirSync as readdirSync21, mkdirSync as mkdirSync29, readFileSync as readFileSync51, writeFileSync as writeFileSync31 } from "fs";
+import { basename as basename22, isAbsolute as isAbsolute10, join as join67, relative as relative10 } from "path";
 function sanitizeReason(s) {
   const collapsed = s.replace(/[\x00-\x1f\x7f]+/g, " ").trim();
   const capped = collapsed.length > 500 ? `${collapsed.slice(0, 500)}...` : collapsed;
@@ -15397,8 +15438,8 @@ function renderReceiptMd(r) {
   ].join(`
 `);
 }
-var DEEP_NOT_PROVEN, SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", AGENT_ONLY_REASON = "only agent-authored tests executed (no agent-independent proof)", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash18("sha256").update(s).digest("hex"), str3 = (v) => typeof v === "string" && v !== "" ? v : null, strs2 = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : [], receiptRel = (ctx) => {
-  const r = relative10(ctx.repoDir, join66(ctx.runDir, "receipt.json"));
+var DEEP_NOT_PROVEN, SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", AGENT_ONLY_REASON = "only agent-authored tests executed (no agent-independent proof)", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash17("sha256").update(s).digest("hex"), str3 = (v) => typeof v === "string" && v !== "" ? v : null, strs2 = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : [], receiptRel = (ctx) => {
+  const r = relative10(ctx.repoDir, join67(ctx.runDir, "receipt.json"));
   return r.startsWith("..") || isAbsolute10(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
 }, commitStage, wallGreenOnBaseOf = (o) => {
   const b = o.wall?.base_run ?? {};
@@ -15510,8 +15551,8 @@ var init_seal = __esm(() => {
         notProven.add(`Wall test not executed: ${wallNotRun} file(s), no reason recorded`);
       if (wallNotRun > 0) {
         try {
-          const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename23(String(f.path))));
-          for (const n3 of readdirSync22(join66(ctx.runDir, "wall")).sort())
+          const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename22(String(f.path))));
+          for (const n3 of readdirSync21(join67(ctx.runDir, "wall")).sort())
             if (!kept.has(n3))
               notProven.add(`wall test discarded: ${n3} (not_run)`);
         } catch {}
@@ -15574,19 +15615,19 @@ var init_seal = __esm(() => {
       for (const [s, d] of Object.entries(o))
         if (typeof d?.duration_s === "number")
           stages[s] = d.duration_s;
-      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join66(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
+      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join67(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
       const iterIds = [...new Set([...Object.values(o).flatMap((d) => [...strs2(d?.iteration_ids), ...strs2([d?.iteration_id])]), ...ctx.sessionIds?.() ?? []])];
       if (iterIds.length === 0)
         notProven.add("cost not measured (no iteration ids recorded)");
       const cost = ctx.cost.read(ctx.repoDir, iterIds);
       if (cost.unmetered)
         notProven.add("cost unmetered (CLI invoker; recorded as 0)");
-      const eventsPath = join66(ctx.runDir, "events.jsonl");
+      const eventsPath = join67(ctx.runDir, "events.jsonl");
       const wallFiles = Array.isArray(o.wall?.files) ? o.wall.files : [];
       const wallPassed = typeof o.verify?.wall_passed === "boolean" ? o.verify.wall_passed : null;
       if (wallFiles.length > 0 && wallPassed === null)
         notProven.add("wall result not recorded by verify");
-      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join66(ctx.repoDir, ".loki"), liveArchivedCosts(join66(ctx.repoDir, ".loki"), iterIds, UNMETERED)).router : undefined), ctx.model);
+      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join67(ctx.repoDir, ".loki"), liveArchivedCosts(join67(ctx.repoDir, ".loki"), iterIds, UNMETERED)).router : undefined), ctx.model);
       if (routeBlock)
         for (const l of routeNotProven(routeBlock))
           notProven.add(l);
@@ -15628,7 +15669,7 @@ var init_seal = __esm(() => {
         provider: ctx.provider,
         model: ctx.model,
         resumed: o.intake?.resumed === true,
-        events_sha256: sha2562(existsSync43(eventsPath) ? readFileSync51(eventsPath) : ""),
+        events_sha256: sha2562(existsSync44(eventsPath) ? readFileSync51(eventsPath) : ""),
         ...await sealEvidence(ctx.repoDir, ctx.runDir, o, notProven, signal, ctx.emit),
         log_seal: true,
         ...receiptBlock(process.env, cost.usd, cost.unmetered === true, totalS),
@@ -15650,10 +15691,10 @@ var init_seal = __esm(() => {
       }
       const receipt = { ...body, receipt_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } };
       mkdirSync29(ctx.runDir, { recursive: true });
-      const path = join66(ctx.runDir, "receipt.json");
+      const path = join67(ctx.runDir, "receipt.json");
       writeFileSync31(path, JSON.stringify(receipt, null, 2) + `
 `);
-      writeFileSync31(join66(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
+      writeFileSync31(join67(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
       recordRun(process.env, ctx.repoDir, ranModel(o.implement, ctx.model, o.fix), verdict, cost.usd, cost.unmetered === true, totalS);
       try {
         hooks.sealed?.(ctx.runDir, JSON.parse(JSON.stringify(receipt), (_k, v) => v && typeof v === "object" ? Object.freeze(v) : v));
@@ -15765,14 +15806,14 @@ var DSSE_PAYLOAD_TYPE = "application/vnd.in-toto+json", STATEMENT_TYPE = "https:
 var init_receipt_dsse = () => {};
 
 // ../../loki-ts/src/util/composite_seal.ts
-import { existsSync as existsSync44, readFileSync as readFileSync53 } from "fs";
-import { basename as basename24, dirname as dirname29, join as join67 } from "path";
+import { existsSync as existsSync45, readFileSync as readFileSync53 } from "fs";
+import { basename as basename23, dirname as dirname29, join as join68 } from "path";
 function logProblem(runDir, integ) {
   if (typeof integ["log_sha256"] !== "string")
     return null;
   let b;
   try {
-    b = readFileSync53(join67(runDir, "integration.log"));
+    b = readFileSync53(join68(runDir, "integration.log"));
   } catch {
     return "integration.log is missing but integration.json records its hash";
   }
@@ -15795,13 +15836,13 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("body malformed");
   let ibytes;
   try {
-    ibytes = readFileSync53(join67(runDir, "integration.json"));
+    ibytes = readFileSync53(join68(runDir, "integration.json"));
   } catch {
     return bad("integration.json missing");
   }
   if (sha3(ibytes) !== receipt["integration_sha256"])
     return bad("integration.json does not match its recorded hash");
-  const integ = readJson5(join67(runDir, "integration.json"));
+  const integ = readJson6(join68(runDir, "integration.json"));
   if (!isObj10(integ) || !isObj10(integ["outcomes"]))
     return bad("integration.json has no outcomes");
   const iprob = integrationProblem(integ);
@@ -15831,7 +15872,7 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
       return bad(`child ${text2(repo, 80) || "?"} has an invalid receipt path`);
     if (outcomes[repo] !== "ok")
       return bad(`child ${text2(repo, 80)} did not finish ok in integration.json`);
-    const rp = join67(runDir, rel);
+    const rp = join68(runDir, rel);
     let bytes;
     try {
       bytes = readFileSync53(rp);
@@ -15840,7 +15881,7 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
     }
     if (sha3(bytes) !== c["receipt_file_sha256"])
       return bad(`child ${repo} receipt does not match its recorded hash (swapped or edited)`);
-    const sub = readJson5(rp);
+    const sub = readJson6(rp);
     if (!isObj10(sub) || sub["receipt_sha256"] !== c["receipt_sha256"] || rh(sub) !== c["receipt_sha256"])
       return bad(`child ${repo} receipt hash does not recompute`);
     if (String(sub["verdict"] ?? "") !== c["verdict"])
@@ -15883,9 +15924,9 @@ var init_keys_cmd = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/verify_cmd.ts
-import { existsSync as existsSync45, readFileSync as readFileSync54, renameSync as renameSync13, statSync as statSync22, writeFileSync as writeFileSync32 } from "fs";
-import { basename as basename25, dirname as dirname30, join as join68 } from "path";
-import { createHash as createHash19, createPublicKey as createPublicKey4, verify as verify4 } from "crypto";
+import { existsSync as existsSync46, readFileSync as readFileSync54, renameSync as renameSync14, statSync as statSync21, writeFileSync as writeFileSync32 } from "fs";
+import { basename as basename24, dirname as dirname30, join as join69 } from "path";
+import { createHash as createHash18, createPublicKey as createPublicKey4, verify as verify4 } from "crypto";
 function pubFor(kid, given) {
   if (given)
     return kidOf2(given) === kid ? given : undefined;
@@ -15931,13 +15972,13 @@ function checkEventLog(receiptPath, receipt) {
   }
   if (typeof bound !== "string")
     return null;
-  if (bound === createHash19("sha256").digest("hex")) {
+  if (bound === createHash18("sha256").digest("hex")) {
     const st = receipt["time"]?.stages;
     const claims = st !== null && typeof st === "object" && Object.keys(st).length > 0;
     return claims ? "the receipt records stages but binds the empty-log hash, so no events.jsonl can back it (missing, empty or non-empty); the receipt is forged or was sealed without a log. Re-run the task to produce a fresh receipt" : null;
   }
-  const path = join68(dirname30(receiptPath), "events.jsonl");
-  if (!existsSync45(path))
+  const path = join69(dirname30(receiptPath), "events.jsonl");
+  if (!existsSync46(path))
     return "events.jsonl is missing";
   const raw2 = readFileSync54(path, "utf8"), events2 = readEvents(path), lines2 = raw2.split(`
 `).filter((l) => l.trim() !== "");
@@ -15945,7 +15986,7 @@ function checkEventLog(receiptPath, receipt) {
     return "events.jsonl has a forged, edited or missing line";
   if (events2.some((e) => e.type === "tamper.detected"))
     return "the supervisor detected events.jsonl being modified during the run";
-  const h = createHash19("sha256");
+  const h = createHash18("sha256");
   for (const l of lines2) {
     if (h.copy().digest("hex") === bound)
       return null;
@@ -15955,7 +15996,7 @@ function checkEventLog(receiptPath, receipt) {
   return h.digest("hex") === bound ? null : "events.jsonl does not match the hash recorded at seal";
 }
 function checkLogSeal(receiptPath, hash, kid, given) {
-  const path = join68(dirname30(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
+  const path = join69(dirname30(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
   if (!events2.some((e) => e.type === "receipt.sealed" && e.data["receipt_sha256"] === hash))
     return { verdict: "TAMPERED", reason: "events.jsonl has no receipt.sealed event for this receipt" };
   if (done < 0)
@@ -15964,7 +16005,7 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   if (!d)
     return { verdict: "TAMPERED", reason: "events.jsonl has no signed log.sealed line after run.completed" };
   const lines2 = readFileSync54(path, "utf8").split(`
-`).filter((l) => l.trim() !== ""), sha4 = createHash19("sha256").update(lines2.slice(0, done + 1).join(`
+`).filter((l) => l.trim() !== ""), sha4 = createHash18("sha256").update(lines2.slice(0, done + 1).join(`
 `) + `
 `).digest("hex");
   const pub = d["kid"] === kid ? pubFor(kid, given) : undefined;
@@ -15973,7 +16014,7 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   return null;
 }
 async function verifyReceipt(receiptPath, deps = {}) {
-  if (!existsSync45(receiptPath))
+  if (!existsSync46(receiptPath))
     return { verdict: "UNCHECKED", reasons: [`receipt not found: ${receiptPath}`] };
   let receipt;
   try {
@@ -16066,8 +16107,8 @@ var init_verify_cmd = __esm(() => {
 });
 
 // src/server/app.ts
-import { existsSync as existsSync47, readFileSync as readFileSync57, statSync as statSync23 } from "fs";
-import { join as join71, resolve as resolve15, sep as sep14 } from "path";
+import { existsSync as existsSync48, readFileSync as readFileSync57, statSync as statSync22 } from "fs";
+import { join as join72, resolve as resolve14, sep as sep14 } from "path";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = Symbol();
@@ -26351,7 +26392,7 @@ function mount20(ctx) {
 // src/server/routes/verify.ts
 import { readFileSync as readFileSync55, realpathSync as realpathSync22 } from "fs";
 import { createPublicKey as createPublicKey5 } from "crypto";
-import { join as join69, sep as sep13 } from "path";
+import { join as join70, sep as sep13 } from "path";
 init_verify_cmd();
 init_seal();
 init_receipt_dsse();
@@ -26378,11 +26419,11 @@ function mount21(ctx) {
       return done(404, "receipt not available", "not_found");
     let runDir, file;
     try {
-      const root = realpathSync22(join69(repo.p, ".loki", "runs"));
-      runDir = realpathSync22(join69(root, run2));
-      if (runDir !== join69(root, run2))
+      const root = realpathSync22(join70(repo.p, ".loki", "runs"));
+      runDir = realpathSync22(join70(root, run2));
+      if (runDir !== join70(root, run2))
         return done(404, "receipt not found", "not_found");
-      file = realpathSync22(join69(runDir, "receipt.json"));
+      file = realpathSync22(join70(runDir, "receipt.json"));
     } catch {
       return done(404, "receipt not found", "not_found");
     }
@@ -26463,8 +26504,8 @@ function ttlCache(ttlMs = PROBE_CACHE_MS, now2 = Date.now) {
 }
 
 // src/server/legacy/shim.ts
-import { existsSync as existsSync46, readFileSync as readFileSync56 } from "fs";
-import { join as join70 } from "path";
+import { existsSync as existsSync47, readFileSync as readFileSync56 } from "fs";
+import { join as join71 } from "path";
 
 // src/server/legacy/routes.ts
 var LEGACY_ROUTES = [
@@ -26842,9 +26883,9 @@ var logged = new Set;
 var toHono = (p) => p.replace(/\{([A-Za-z_]+):path\}/g, ":$1{.+}").replace(/\{([A-Za-z_]+)\}/g, ":$1");
 var NOT_SUPPORTED = "not yet supported by the Control Plane";
 var repoVersion = () => {
-  for (const f of [join70(import.meta.dir, "../../../../../VERSION")]) {
+  for (const f of [join71(import.meta.dir, "../../../../../VERSION")]) {
     try {
-      if (existsSync46(f))
+      if (existsSync47(f))
         return readFileSync56(f, "utf8").trim();
     } catch {}
   }
@@ -27027,7 +27068,7 @@ function legacyShim(opts) {
 
 // src/server/app.ts
 var MAX_BODY2 = 1e6;
-var defaultUiDir = () => [join71(import.meta.dir, "../../ui/dist"), join71(import.meta.dir, "../ui/dist")].find((d) => existsSync47(join71(d, "index.html")));
+var defaultUiDir = () => [join72(import.meta.dir, "../../ui/dist"), join72(import.meta.dir, "../ui/dist")].find((d) => existsSync48(join72(d, "index.html")));
 function createApp(opts) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
@@ -27056,7 +27097,7 @@ function createApp(opts) {
     await next();
   });
   const readInstalled = () => {
-    for (const f of [process.env.LOKI_VERSION_FILE, join71(import.meta.dir, "../../../../VERSION")]) {
+    for (const f of [process.env.LOKI_VERSION_FILE, join72(import.meta.dir, "../../../../VERSION")]) {
       try {
         if (f)
           return readFileSync57(f, "utf8").trim() || "unknown";
@@ -27168,13 +27209,13 @@ function createApp(opts) {
     }
     if (!uiDir || p.startsWith("/v1/"))
       return c.json({ error: "not found" }, 404);
-    const root = resolve15(uiDir);
-    const f = resolve15(root, `.${p}`);
-    if (f.startsWith(root + sep14) && existsSync47(f) && statSync23(f).isFile())
+    const root = resolve14(uiDir);
+    const f = resolve14(root, `.${p}`);
+    if (f.startsWith(root + sep14) && existsSync48(f) && statSync22(f).isFile())
       return new Response(Bun.file(f));
     if (/\.[a-z0-9]+$/i.test(p))
       return c.json({ error: "not found" }, 404);
-    return new Response(Bun.file(join71(root, "index.html")));
+    return new Response(Bun.file(join72(root, "index.html")));
   });
   return { app, db, close: () => {
     clearInterval(reconciler);