loki-mode 11.7.1 → 11.8.1

package/packages/control-plane/dist/server.js

@@ -7325,6 +7325,72 @@ var init_paths = __esm(() => {
   REPO_ROOT = findRepoRoot();
 });
 
+// ../../loki-ts/src/util/receipt_signer.ts
+import { createHash as createHash6, randomBytes as randomBytes2, createPrivateKey, createPublicKey as createPublicKey2, generateKeyPairSync, sign } from "crypto";
+import { chmodSync as chmodSync4, linkSync, mkdirSync as mkdirSync5, readFileSync as readFileSync18, statSync as statSync11, unlinkSync as unlinkSync3, writeFileSync as writeFileSync8 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname7, join as join26 } from "path";
+function canonicalJson(x) {
+  const walk = (v) => {
+    if (Array.isArray(v))
+      return `[${v.map(walk).join(",")}]`;
+    if (v !== null && typeof v === "object") {
+      const o = v;
+      return `{${Object.keys(o).filter((k) => o[k] !== undefined).sort().map((k) => `${JSON.stringify(k)}:${walk(o[k])}`).join(",")}}`;
+    }
+    return JSON.stringify(v ?? null);
+  };
+  return walk(x).replace(/[\u0080-\uFFFF]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function loadSigningKey(generate = true) {
+  try {
+    const inline = process.env["LOKI_RECEIPT_SIGNING_KEY"]?.trim();
+    let pem = inline ?? "";
+    if (!inline) {
+      const given = process.env["LOKI_RECEIPT_SIGNING_KEY_FILE"]?.trim();
+      const file = given || join26(process.env["HOME"] || homedir8(), ".loki", "keys", RECEIPT_SIGNER_BASENAME);
+      try {
+        pem = readFileSync18(file);
+        if (!given) {
+          for (const [f, m] of [[file, 384], [dirname7(file), 448]])
+            if (statSync11(f).mode & 63)
+              chmodSync4(f, m);
+        }
+      } catch (e) {
+        if (e.code !== "ENOENT" || !generate)
+          return null;
+        mkdirSync5(dirname7(dirname7(file)), { recursive: true, mode: 448 });
+        mkdirSync5(dirname7(file), { recursive: true, mode: 448 });
+        const tmp = `${file}.${randomBytes2(6).toString("hex")}.tmp`;
+        writeFileSync8(tmp, generateKeyPairSync("ed25519").privateKey.export({ type: "pkcs8", format: "pem" }), { flag: "wx", mode: 384 });
+        try {
+          linkSync(tmp, file);
+        } catch (l) {
+          if (l.code !== "EEXIST")
+            throw l;
+        } finally {
+          unlinkSync3(tmp);
+        }
+        pem = readFileSync18(file);
+      }
+    }
+    const k = createPrivateKey(pem);
+    return k.asymmetricKeyType === "ed25519" ? k : null;
+  } catch {
+    return null;
+  }
+}
+function signReceipt(runId, hash) {
+  const key = loadSigningKey();
+  if (!key)
+    return { jwt: null, kid: null };
+  const kid = kidOf2(createPublicKey2(key));
+  const input = `${b64u(canonicalJson({ alg: "EdDSA", typ: "JWT", kid }))}.${b64u(canonicalJson({ job_id: runId, run_id: runId, receipt_sha256: hash, iat: Math.floor(Date.now() / 1000) }))}`;
+  return { jwt: `${input}.${b64u(sign(null, Buffer.from(input), key))}`, kid };
+}
+var RECEIPT_SIGNER_BASENAME = "receipt-ed25519.pem", b64u = (b) => Buffer.from(b).toString("base64url"), kidOf2 = (pub) => b64u(createHash6("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${pub.export({ format: "jwk" }).x}"}`).digest());
+var init_receipt_signer = () => {};
+
 // ../../loki-ts/src/engine10/registry.ts
 var init_registry = () => {};
 
@@ -7377,7 +7443,7 @@ var init_types = __esm(() => {
 });
 
 // ../../loki-ts/src/util/spec_file.ts
-import { isAbsolute, join as join26, relative } from "path";
+import { isAbsolute, join as join27, relative } from "path";
 function specReceiptBlock(env) {
   const { LOKI_E10_SPEC_PATH: p, LOKI_E10_SPEC_SHA256: sha2 } = env;
   if (!p || !sha2)
@@ -7388,7 +7454,7 @@ function specReceiptBlock(env) {
 var SPEC_DIR;
 var init_spec_file = __esm(() => {
   init_types();
-  SPEC_DIR = join26(".loki", "specs");
+  SPEC_DIR = join27(".loki", "specs");
 });
 
 // ../../loki-ts/src/engine10/pr_body.ts
@@ -7400,14 +7466,14 @@ function aiTrailers(i, env = process.env) {
 var markingOn = (env) => env["LOKI_AI_MARKING"] === "1", clean = (v) => v.replace(/[\u0000-\u001f\u007f\u2028\u2029]+/g, " ").replace(/\s+/g, " ").trim().slice(0, 100) || "unknown";
 
 // ../../loki-ts/src/util/credential_env.ts
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, statSync as statSync11, lstatSync as lstatSync4 } from "fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, statSync as statSync12, lstatSync as lstatSync4 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join27 } from "path";
-import { randomBytes as randomBytes2 } from "crypto";
+import { join as join28 } from "path";
+import { randomBytes as randomBytes3 } from "crypto";
 function withheldSentinel(fresh = false) {
   if (fresh)
     sentinel = null;
-  return sentinel ??= `${SENTINEL_PREFIX}${process.pid}${randomBytes2(8).toString("hex")}INVALID`;
+  return sentinel ??= `${SENTINEL_PREFIX}${process.pid}${randomBytes3(8).toString("hex")}INVALID`;
 }
 function removeConfigDir() {
   if (configDir)
@@ -7421,7 +7487,7 @@ function emptyGhConfigDir(env = process.env) {
   const runTmp = env["LOKI_RUN_TMP"] ?? "";
   const root = runTmp !== "" && isDir(runTmp) ? runTmp : tmpdir3();
   try {
-    configDir = mkdtempSync2(join27(root, "loki-gh-config-"));
+    configDir = mkdtempSync2(join28(root, "loki-gh-config-"));
   } catch {
     return null;
   }
@@ -7462,7 +7528,7 @@ function hardenCredentialEnv(env, fresh = false) {
 }
 var GITHUB_TOKEN_VARS, SENTINEL_PREFIX = "ghp_LOKIWITHHELDsentinel", sentinel = null, configDir = null, exitHooked = false, sigtermHooked = false, isDir = (p) => {
   try {
-    return !lstatSync4(p).isSymbolicLink() && statSync11(p).isDirectory();
+    return !lstatSync4(p).isSymbolicLink() && statSync12(p).isDirectory();
   } catch {
     return false;
   }
@@ -7588,9 +7654,9 @@ var init_run_cap = __esm(() => {
 });
 
 // ../../loki-ts/src/util/mutation_proof.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync3, readFileSync as readFileSync18, rmSync as rmSync5, symlinkSync, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync3, readFileSync as readFileSync19, rmSync as rmSync5, symlinkSync, writeFileSync as writeFileSync9 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { basename as basename8, dirname as dirname7, isAbsolute as isAbsolute2, join as join28, relative as relative2 } from "path";
+import { basename as basename8, dirname as dirname8, isAbsolute as isAbsolute2, join as join29, relative as relative2 } from "path";
 function mutationProof(i) {
   const rels = i.wallFiles.map((f) => isAbsolute2(f.path) ? relative2(i.repoDir, f.path) : f.path);
   if (rels.length === 0)
@@ -7608,25 +7674,25 @@ function mutationProof(i) {
   const deadline = Date.now() + budgetS * 1000, remaining = () => deadline - Date.now();
   let parent = null, wt = null, added = false;
   try {
-    parent = mkdtempSync3(join28(tmpdir4(), "loki-mutproof-"));
-    wt = join28(parent, "wt");
+    parent = mkdtempSync3(join29(tmpdir4(), "loki-mutproof-"));
+    wt = join29(parent, "wt");
     const add2 = git(i.repoDir, ["worktree", "add", "--detach", wt, i.baseSha], Math.max(1000, Math.min(30000, remaining())));
     added = existsSync15(wt) || add2.status === 0;
     if (add2.status !== 0)
       return np("could not create the base worktree");
     for (const rel of rels) {
-      const sealed = join28(i.runDir, "wall", basename8(rel)), src = existsSync15(sealed) ? sealed : join28(i.repoDir, rel);
+      const sealed = join29(i.runDir, "wall", basename8(rel)), src = existsSync15(sealed) ? sealed : join29(i.repoDir, rel);
       if (!existsSync15(src))
         return np(`Wall file missing: ${rel}`);
-      mkdirSync5(dirname7(join28(wt, rel)), { recursive: true });
-      writeFileSync8(join28(wt, rel), readFileSync18(src));
+      mkdirSync6(dirname8(join29(wt, rel)), { recursive: true });
+      writeFileSync9(join29(wt, rel), readFileSync19(src));
     }
     for (const rel of rels) {
       const parts = rel.split("/").slice(0, -1);
       for (let n2 = 0;n2 <= parts.length; n2++) {
         const anc = parts.slice(0, n2).join("/");
         for (const d of DEP_DIRS) {
-          const src = join28(i.repoDir, anc, d), dst = join28(wt, anc, d);
+          const src = join29(i.repoDir, anc, d), dst = join29(wt, anc, d);
           if (existsSync15(src) && !existsSync15(dst)) {
             try {
               symlinkSync(src, dst);
@@ -7823,7 +7889,7 @@ var init_shell = __esm(() => {
 });
 
 // ../../loki-ts/src/util/python.ts
-import { accessSync, constants as constants2, existsSync as existsSync16, statSync as statSync12 } from "fs";
+import { accessSync, constants as constants2, existsSync as existsSync16, statSync as statSync13 } from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
 import { tmpdir as tmpdir5 } from "os";
 function resolvePython3() {
@@ -7833,7 +7899,7 @@ function resolvePython3() {
     const cand = `${dir}/python3`;
     try {
       accessSync(cand, constants2.X_OK);
-      if (statSync12(cand).isFile())
+      if (statSync13(cand).isFile())
         return cand;
     } catch {}
   }
@@ -7960,7 +8026,7 @@ var init_python = __esm(() => {
   init_shell();
 });
 
-// ../../loki-ts/src/features/wall_manifest.ts
+// ../../loki-ts/src/util/ts_signatures.ts
 function templateEnd(s, i) {
   for (let j = i + 1;j < s.length; ) {
     const c = s[j];
@@ -8686,6 +8752,14 @@ function tsSignatures(src, jsx) {
   }
   return out2;
 }
+var REGEX_PREV = "(,=:[!&|?{;+-*%~^", isComment = (s, i) => s[i] === "/" && (s[i + 1] === "/" || s[i + 1] === "*"), MODS = "(?:(?:public|private|protected|static|readonly|abstract|async|get|set|declare|override)\\s+)*", MEMBER_GRAMMAR, NOT_MEMBER, RESERVED_AFTER_DECORATOR;
+var init_ts_signatures = __esm(() => {
+  MEMBER_GRAMMAR = new RegExp(`^(?:@[\\w$.]+(?:\\([^)]*\\))?\\s*)*${MODS}\\*?\\s*(?:[A-Za-z_$][\\w$]*|#[A-Za-z_$][\\w$]*|\\[[^\\]]*\\])\\s*[?!]?\\s*(?:[(<:=]|$)`);
+  NOT_MEMBER = /^(return|const|let|var|if|else|for|while|do|switch|case|default|throw|try|catch|finally|new|await|yield|break|continue|import|export|function|delete|typeof|void)\b/;
+  RESERVED_AFTER_DECORATOR = /^(?:if|else|for|while|do|switch|case|try|catch|finally|return|throw|with|var|let|const|function|new|delete|typeof|void|yield|await|break|continue|import|debugger|instanceof|this|super|null|true|false)(?![\w$])/;
+});
+
+// ../../loki-ts/src/features/wall_manifest.ts
 function packageRunner(content) {
   try {
     const pkg = JSON.parse(content);
@@ -8876,21 +8950,19 @@ var MANIFEST_MAX_LINES = 400, MAX_EXAMPLES = 2, EXAMPLE_LINES = 40, MAX_LAYOUT =
   const raw2 = stemOf(m).toLowerCase(), parent = m.split("/").slice(-2, -1)[0];
   return [normStem(raw2), ...["index", "__init__", "mod", "main"].includes(raw2) && parent ? [normStem(parent)] : []];
 }, norm3 = (s) => s.replace(/\r\n?/g, `
-`), stemOf = (p) => (p.split("/").pop() ?? p).replace(/\.[^.]*$/, ""), byPath = (a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : a.content < b.content ? -1 : a.content > b.content ? 1 : 0, REGEX_PREV = "(,=:[!&|?{;+-*%~^", isComment = (s, i) => s[i] === "/" && (s[i + 1] === "/" || s[i + 1] === "*"), MODS = "(?:(?:public|private|protected|static|readonly|abstract|async|get|set|declare|override)\\s+)*", MEMBER_GRAMMAR, NOT_MEMBER, RESERVED_AFTER_DECORATOR;
+`), stemOf = (p) => (p.split("/").pop() ?? p).replace(/\.[^.]*$/, ""), byPath = (a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : a.content < b.content ? -1 : a.content > b.content ? 1 : 0;
 var init_wall_manifest = __esm(() => {
   init_python();
+  init_ts_signatures();
   TEST_PATH = /(^|\/)(tests?|__tests__|spec)\/|\.(test|spec)\.[jt]sx?$|(^|\/)test_[^/]*\.py$|_test\.(py|go)$/;
   TEST_FILE = /\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)test_[^/]*\.py$|_test\.py$/;
   EXAMPLE_EXT = /\.(py|[cm]?[jt]sx?)$/;
   GENERIC_STEMS = ["index", "init", "mod", "main"];
-  MEMBER_GRAMMAR = new RegExp(`^(?:@[\\w$.]+(?:\\([^)]*\\))?\\s*)*${MODS}\\*?\\s*(?:[A-Za-z_$][\\w$]*|#[A-Za-z_$][\\w$]*|\\[[^\\]]*\\])\\s*[?!]?\\s*(?:[(<:=]|$)`);
-  NOT_MEMBER = /^(return|const|let|var|if|else|for|while|do|switch|case|default|throw|try|catch|finally|new|await|yield|break|continue|import|export|function|delete|typeof|void)\b/;
-  RESERVED_AFTER_DECORATOR = /^(?:if|else|for|while|do|switch|case|try|catch|finally|return|throw|with|var|let|const|function|new|delete|typeof|void|yield|await|break|continue|import|debugger|instanceof|this|super|null|true|false)(?![\w$])/;
 });
 
 // ../../loki-ts/src/features/wall_manifest_wire.ts
-import { createHash as createHash6 } from "crypto";
-import { basename as basename9, dirname as dirname8 } from "path";
+import { createHash as createHash7 } from "crypto";
+import { basename as basename9, dirname as dirname9 } from "path";
 function blobEntries(ls) {
   const out2 = [];
   for (const raw2 of ls.toString("latin1").split("\x00")) {
@@ -8920,7 +8992,7 @@ function wallManifestFor(repoDir, tree, task, env = process.env) {
       return null;
     const low = task.toLowerCase().replace(/\\/g, "/");
     const token = (n2) => new RegExp(`(?<![A-Za-z0-9_])${n2.toLowerCase().replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9_])`).test(low);
-    const dirModule = (e) => /^(index|__init__|mod|main)\.[^.]+$/.test(basename9(e.path)) && e.path.includes("/") && token(dirname8(e.path));
+    const dirModule = (e) => /^(index|__init__|mod|main)\.[^.]+$/.test(basename9(e.path)) && e.path.includes("/") && token(dirname9(e.path));
     const matched = all.filter((e) => SOURCE.test(e.path) && (token(basename9(e.path)) || token(e.path) || token(basename9(e.path).replace(/\.[^.]*$/, "")) || dirModule(e)));
     const spans = (p) => [...low.matchAll(new RegExp(`(?<![A-Za-z0-9_])${p.toLowerCase().replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9_])`, "g"))].map((m) => [m.index, m.index + m[0].length]);
     const occ = new Map(matched.map((e) => [e, spans(e.path)]));
@@ -8949,7 +9021,7 @@ function wallManifestFor(repoDir, tree, task, env = process.env) {
     if (at !== cat.length)
       return null;
     const text2 = buildWallManifest([...files, ...listed.map((e) => ({ path: e.path, content: "" }))], named.map((e) => e.path), matched.map((e) => e.path));
-    return { text: text2, sha256: createHash6("sha256").update(text2).digest("hex") };
+    return { text: text2, sha256: createHash7("sha256").update(text2).digest("hex") };
   } catch {
     return null;
   }
@@ -8981,12 +9053,12 @@ Example: test('name', () => { assert.strictEqual(fn(1), 2); });  Run: node --tes
 });
 
 // ../../loki-ts/src/engine10/cache.ts
-import { createHash as createHash7 } from "crypto";
-import { existsSync as existsSync17, mkdirSync as mkdirSync6, readFileSync as readFileSync19, writeFileSync as writeFileSync9 } from "fs";
+import { createHash as createHash8 } from "crypto";
+import { existsSync as existsSync17, mkdirSync as mkdirSync7, readFileSync as readFileSync20, writeFileSync as writeFileSync10 } from "fs";
 import { resolve as resolve8 } from "path";
 function repoKey(originUrl, repoDir) {
   const basis = originUrl && originUrl.trim() !== "" ? originUrl : resolve8(repoDir);
-  return createHash7("sha256").update(basis).digest("hex");
+  return createHash8("sha256").update(basis).digest("hex");
 }
 function defaultCacheRoot() {
   return resolve8(homeLokiDir(), "cache", "v10");
@@ -8998,7 +9070,7 @@ function readJson3(path, isValid = (_v) => true) {
   if (!existsSync17(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync19(path, "utf8"));
+    const parsed = JSON.parse(readFileSync20(path, "utf8"));
     return isValid(parsed) ? parsed : null;
   } catch {
     return null;
@@ -9048,12 +9120,12 @@ function speedLikelyFiles(task, map, env = process.env) {
 var init_lean_select = () => {};
 
 // ../../loki-ts/src/util/claude_model.ts
-import { readFileSync as readFileSync20 } from "fs";
+import { readFileSync as readFileSync21 } from "fs";
 import { resolve as resolve9 } from "path";
 function resolveClaudeModel(want) {
   try {
     const path = process.env["LOKI_MODEL_CATALOG"] || resolve9(REPO_ROOT, "providers/model_catalog.json");
-    return JSON.parse(readFileSync20(path, "utf8")).providers?.claude?.cli_aliases?.[want] ?? want;
+    return JSON.parse(readFileSync21(path, "utf8")).providers?.claude?.cli_aliases?.[want] ?? want;
   } catch {
     return want;
   }
@@ -9113,8 +9185,8 @@ function routerMode(env = process.env) {
 var routerEnabled = (env = process.env) => routerMode(env) === "on";
 
 // ../../loki-ts/src/engine10/cost.ts
-import { readdirSync as readdirSync9, readFileSync as readFileSync21 } from "fs";
-import { join as join29 } from "path";
+import { readdirSync as readdirSync9, readFileSync as readFileSync22 } from "fs";
+import { join as join30 } from "path";
 function routerTelemetryOn(env = process.env) {
   return routerEnabled(env);
 }
@@ -9122,7 +9194,7 @@ function num3(v) {
   return typeof v === "number" && Number.isFinite(v) ? v : 0;
 }
 function resultCostPath(lokiRoot, iteration) {
-  return join29(lokiRoot, "metrics", `result-cost-${iteration}.json`);
+  return join30(lokiRoot, "metrics", `result-cost-${iteration}.json`);
 }
 function sumResultCosts(lokiRoot, iterations, context = []) {
   const out2 = {
@@ -9153,7 +9225,7 @@ function sumResultCosts(lokiRoot, iterations, context = []) {
   const parsed = new Map;
   for (const iter of iterations) {
     try {
-      parsed.set(iter, JSON.parse(readFileSync21(resultCostPath(lokiRoot, iter), "utf8")));
+      parsed.set(iter, JSON.parse(readFileSync22(resultCostPath(lokiRoot, iter), "utf8")));
     } catch {}
   }
   const own = new Set(iterations);
@@ -9162,7 +9234,7 @@ function sumResultCosts(lokiRoot, iterations, context = []) {
     if (own.has(iter))
       continue;
     try {
-      lookup.push({ iter, rec: JSON.parse(readFileSync21(resultCostPath(lokiRoot, iter), "utf8")) });
+      lookup.push({ iter, rec: JSON.parse(readFileSync22(resultCostPath(lokiRoot, iter), "utf8")) });
     } catch {}
   }
   const verdicts = hooks.costRecords?.resumeVerdicts(lookup) ?? { ambiguous: [], separate: [] };
@@ -9267,19 +9339,19 @@ import {
   fstatSync as fstatSync5,
   fsyncSync as fsyncSync2,
   lstatSync as lstatSync6,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   openSync as openSync6,
   readSync as readSync5,
   renameSync as renameSync4,
   rmSync as rmSync6,
-  statSync as statSync13,
-  unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync11,
+  statSync as statSync14,
+  unlinkSync as unlinkSync4,
+  writeFileSync as writeFileSync12,
   writeSync as writeSync3
 } from "fs";
-import { dirname as dirname9 } from "path";
+import { dirname as dirname10 } from "path";
 function durableWriteThenRename(target, body) {
-  mkdirSync8(dirname9(target), { recursive: true });
+  mkdirSync9(dirname10(target), { recursive: true });
   const tmp = tmpPathFor(target);
   const fd = openSync6(tmp, "w");
   try {
@@ -9294,7 +9366,7 @@ function durableWriteThenRename(target, body) {
 function fsyncParentDir(target) {
   let dfd = null;
   try {
-    dfd = openSync6(dirname9(target), "r");
+    dfd = openSync6(dirname10(target), "r");
     fsyncSync2(dfd);
   } catch {} finally {
     if (dfd !== null) {
@@ -9317,14 +9389,14 @@ var init_atomic = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/budget.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync9, readdirSync as readdirSync10, readFileSync as readFileSync22, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname10, join as join30, resolve as resolve10 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync10, readdirSync as readdirSync10, readFileSync as readFileSync23, writeFileSync as writeFileSync13 } from "fs";
+import { dirname as dirname11, join as join31, resolve as resolve10 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function loadDefaultMaxCostUsd() {
-  const here = dirname10(fileURLToPath2(import.meta.url));
+  const here = dirname11(fileURLToPath2(import.meta.url));
   for (const rel of [["..", "..", "data"], ["..", "data"]]) {
     try {
-      const j = JSON.parse(readFileSync22(resolve10(here, ...rel, "model-pricing.json"), "utf8"));
+      const j = JSON.parse(readFileSync23(resolve10(here, ...rel, "model-pricing.json"), "utf8"));
       if (typeof j.default_max_cost_usd === "number" && Number.isFinite(j.default_max_cost_usd) && j.default_max_cost_usd > 0)
         return j.default_max_cost_usd;
     } catch {}
@@ -9333,11 +9405,11 @@ function loadDefaultMaxCostUsd() {
 }
 function _loadPricing() {
   try {
-    const moduleDir = dirname10(fileURLToPath2(import.meta.url));
+    const moduleDir = dirname11(fileURLToPath2(import.meta.url));
     const jsonPath = resolve10(moduleDir, "..", "..", "data", "model-pricing.json");
     if (!existsSync18(jsonPath))
       return _FALLBACK_PRICING;
-    const raw2 = JSON.parse(readFileSync22(jsonPath, "utf8"));
+    const raw2 = JSON.parse(readFileSync23(jsonPath, "utf8"));
     const pricing2 = raw2["pricing"];
     if (!pricing2 || typeof pricing2 !== "object")
       return _FALLBACK_PRICING;
@@ -9467,7 +9539,7 @@ var init_model_rank = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/sizing.ts
-import { existsSync as existsSync19, readFileSync as readFileSync23 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync24 } from "fs";
 import { basename as basename10 } from "path";
 function namedFiles(task, map) {
   return (map?.files ?? []).filter((f) => task.toLowerCase().includes(basename10(f).toLowerCase()));
@@ -9489,7 +9561,7 @@ function loadRepoMap(repomapRef) {
   if (!repomapRef || !existsSync19(repomapRef))
     return null;
   try {
-    return JSON.parse(readFileSync23(repomapRef, "utf8"));
+    return JSON.parse(readFileSync24(repomapRef, "utf8"));
   } catch {
     return null;
   }
@@ -9520,8 +9592,8 @@ var init_sizing = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/schema.ts
-import { existsSync as existsSync20, lstatSync as lstatSync7, realpathSync as realpathSync15, statSync as statSync14 } from "fs";
-import { isAbsolute as isAbsolute3, join as join32, normalize, sep as sep9 } from "path";
+import { existsSync as existsSync20, lstatSync as lstatSync7, realpathSync as realpathSync15, statSync as statSync15 } from "fs";
+import { isAbsolute as isAbsolute3, join as join33, normalize, sep as sep9 } from "path";
 function safeRel(p) {
   const n2 = normalize(p.trim()).split(sep9).join("/").replace(/\/$/, "");
   if (n2 === "" || isAbsolute3(n2) || n2 === ".." || n2.startsWith("../"))
@@ -9530,7 +9602,7 @@ function safeRel(p) {
 }
 function insideRepo(repoDir, rel) {
   try {
-    const real2 = realpathSync15(join32(repoDir, rel));
+    const real2 = realpathSync15(join33(repoDir, rel));
     const base = realpathSync15(repoDir);
     return real2 === base || real2.startsWith(base + sep9);
   } catch {
@@ -9543,8 +9615,8 @@ function checkCitation(repoDir, raw2) {
   const rel = safeRel(raw2.replace(/:\d+(?:-\d+)?$/, ""));
   if (rel === null)
     return `citation "${raw2}" is not a repo-relative path`;
-  const abs = join32(repoDir, rel);
-  if (!existsSync20(abs) || !statSync14(abs).isFile() || !insideRepo(repoDir, rel))
+  const abs = join33(repoDir, rel);
+  if (!existsSync20(abs) || !statSync15(abs).isFile() || !insideRepo(repoDir, rel))
     return `citation "${raw2}" names a file that does not exist`;
   return null;
 }
@@ -9555,7 +9627,7 @@ function checkFingerprint(repoDir, raw2) {
   if (rel === null)
     return `fingerprint "${raw2}" is not a repo-relative path`;
   try {
-    if (!lstatSync7(join32(repoDir, rel)).isFile() || !insideRepo(repoDir, rel))
+    if (!lstatSync7(join33(repoDir, rel)).isFile() || !insideRepo(repoDir, rel))
       return `fingerprint "${raw2}" is not a regular file inside the repo`;
   } catch {
     return `fingerprint "${raw2}" names a file that does not exist`;
@@ -9583,8 +9655,8 @@ function checkDir(repoDir, v, where, errs) {
     errs.push(`${where}: must be a repo-relative directory ("." for the repo root)`);
     return ".";
   }
-  const abs = join32(repoDir, rel);
-  if (!existsSync20(abs) || !statSync14(abs).isDirectory() || !insideRepo(repoDir, rel))
+  const abs = join33(repoDir, rel);
+  if (!existsSync20(abs) || !statSync15(abs).isDirectory() || !insideRepo(repoDir, rel))
     errs.push(`${where}: directory "${rel}" does not exist`);
   return rel;
 }
@@ -9686,9 +9758,9 @@ var init_schema = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/gather.ts
-import { createHash as createHash8 } from "crypto";
-import { closeSync as closeSync7, lstatSync as lstatSync8, openSync as openSync7, readFileSync as readFileSync24, readSync as readSync6 } from "fs";
-import { dirname as dirname11, join as join33 } from "path";
+import { createHash as createHash9 } from "crypto";
+import { closeSync as closeSync7, lstatSync as lstatSync8, openSync as openSync7, readFileSync as readFileSync25, readSync as readSync6 } from "fs";
+import { dirname as dirname12, join as join34 } from "path";
 function listShallow(repoDir) {
   try {
     const out2 = safeGit(repoDir, ["ls-files", "-z"], { maxBuffer: 256 * 1024 * 1024 });
@@ -9698,10 +9770,10 @@ function listShallow(repoDir) {
   }
 }
 function shallowDirs(repoDir) {
-  return [...new Set(listShallow(repoDir).map((p) => dirname11(p)))].sort();
+  return [...new Set(listShallow(repoDir).map((p) => dirname12(p)))].sort();
 }
 function computeKey(repoDir, fingerprintFiles, dirs, committedHash = null) {
-  const h = createHash8("sha256");
+  const h = createHash9("sha256");
   h.update(`${MODEL_REV}
 `);
   if (committedHash !== null)
@@ -9714,9 +9786,9 @@ function computeKey(repoDir, fingerprintFiles, dirs, committedHash = null) {
       if (checkFingerprint(repoDir, f) !== null)
         h.update("invalid");
       else {
-        const abs = join33(repoDir, f);
+        const abs = join34(repoDir, f);
         const size = lstatSync8(abs).size;
-        h.update(size <= GATHER_CAPS.maxHashBytes ? readFileSync24(abs) : `too-large:${size}`);
+        h.update(size <= GATHER_CAPS.maxHashBytes ? readFileSync25(abs) : `too-large:${size}`);
       }
     } catch {
       h.update("missing");
@@ -9741,7 +9813,7 @@ function committedModelHash(raw2) {
   if (typeof raw2 !== "object" || raw2 === null || Array.isArray(raw2))
     return null;
   const { key: _key, expiresAt: _exp, ...rest } = raw2;
-  return createHash8("sha256").update(JSON.stringify(rest)).digest("hex");
+  return createHash9("sha256").update(JSON.stringify(rest)).digest("hex");
 }
 var GATHER_CAPS, depthOf = (p) => p.split("/").length, MODEL_REV = "model-rev:2";
 var init_gather = __esm(() => {
@@ -9759,14 +9831,14 @@ var init_gather = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/discover.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync25, rmSync as rmSync7, writeFileSync as writeFileSync13 } from "fs";
-import { join as join34 } from "path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync11, readFileSync as readFileSync26, rmSync as rmSync7, writeFileSync as writeFileSync14 } from "fs";
+import { join as join35 } from "path";
 function projectModelEnabled(env = process.env) {
   return env["LOKI_E10_PROJECT_MODEL"] !== "0";
 }
 function loadCached(repoDir, now2 = Date.now()) {
   try {
-    return parseCached(repoDir, JSON.parse(readFileSync25(join34(repoDir, PROJECT_FILE), "utf8")), now2);
+    return parseCached(repoDir, JSON.parse(readFileSync26(join35(repoDir, PROJECT_FILE), "utf8")), now2);
   } catch {
     return null;
   }
@@ -9781,7 +9853,7 @@ function loadCommitted(repoDir) {
   };
   let raw2;
   try {
-    raw2 = JSON.parse(readFileSync25(join34(repoDir, PROJECT_FILE), "utf8"));
+    raw2 = JSON.parse(readFileSync26(join35(repoDir, PROJECT_FILE), "utf8"));
   } catch (e) {
     return ignore(`unreadable JSON (${e instanceof Error ? e.message : String(e)})`);
   }
@@ -9854,7 +9926,7 @@ var clean2 = (p) => typeof p === "string" ? posix.normalize(p.replace(/\\/g, "/"
 var init_api = () => {};
 
 // ../../loki-ts/src/project_model/resolve.ts
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 function loadProjectApi(repoDir, env = process.env) {
   if (!projectModelEnabled(env))
     return null;
@@ -9876,7 +9948,7 @@ function siteFor(api, repoDir, file) {
   const rel = api.relativeToRoot(file);
   if (!pkg || pkg.root === "." || rel === null)
     return null;
-  return { pkg, root: pkg.root, cwd: join35(repoDir, pkg.root), file: rel };
+  return { pkg, root: pkg.root, cwd: join36(repoDir, pkg.root), file: rel };
 }
 function groupByPackage(api, repoDir, files) {
   const out2 = new Map;
@@ -9909,9 +9981,9 @@ var init_scope = __esm(() => {
 
 // ../../loki-ts/src/e10ext/assert_delta.ts
 import { execFileSync as execFileSync5 } from "child_process";
-import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync26, rmSync as rmSync8 } from "fs";
+import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync27, rmSync as rmSync8 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
-import { join as join36 } from "path";
+import { join as join37 } from "path";
 import { basename as basename11 } from "path";
 function classifyAssertDelta(inp) {
   const f = basename11(inp.path);
@@ -9921,7 +9993,7 @@ function classifyAssertDelta(inp) {
     return WEAKENED;
   let cwd = "";
   try {
-    cwd = mkdtempSync4(join36(tmpdir6(), "loki-ad-"));
+    cwd = mkdtempSync4(join37(tmpdir6(), "loki-ad-"));
     const raw2 = execFileSync5("python3", ["-I", "-c", PY], {
       input: JSON.stringify({ path: inp.path, base: inp.base, head: inp.head, task: inp.task }),
       cwd,
@@ -9952,7 +10024,7 @@ function assertDeltaNotes(repoDir, baseSha, headRef, path, task, baseCounts, hea
     return null;
   try {
     const show = (ref) => safeGit(repoDir, ["show", `${ref}:${path}`]);
-    const head = headRef ? show(headRef) : readFileSync26(join36(repoDir, path), "utf8");
+    const head = headRef ? show(headRef) : readFileSync27(join37(repoDir, path), "utf8");
     const r = classifyTestEdit(path, show(baseSha), head, task, baseCounts, headCounts);
     return r[0]?.kind === "literal-only" ? r.map((e) => `assertion value changed (not shown to be required by the task): ${e.file}:${e.line} ${e.old} -> ${e.new}`) : null;
   } catch {
@@ -10176,7 +10248,7 @@ var init_runner_errors = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/testmap.ts
-import { basename as basename12, extname, join as join37, relative as relative3, sep as sep10 } from "path";
+import { basename as basename12, extname, join as join38, relative as relative3, sep as sep10 } from "path";
 function isTestFile(rel) {
   const name = basename12(rel);
   return JS_TEST_RE.test(name) || PY_TEST_RE.test(name) || GO_TEST_RE.test(name);
@@ -10206,8 +10278,8 @@ var init_testmap = __esm(() => {
 });
 
 // ../../loki-ts/src/util/check_result.ts
-import { mkdirSync as mkdirSync11, readFileSync as readFileSync27, renameSync as renameSync5, writeFileSync as writeFileSync14 } from "fs";
-import { basename as basename13, join as join38 } from "path";
+import { mkdirSync as mkdirSync12, readFileSync as readFileSync28, renameSync as renameSync5, writeFileSync as writeFileSync15 } from "fs";
+import { basename as basename13, join as join39 } from "path";
 function plainTestEnv(base = process.env) {
   const e = {};
   for (const [k, v] of Object.entries(tokenFreeEnv(base)))
@@ -10499,7 +10571,7 @@ function diffFiles(repoDir, baseSha) {
       return f;
     let n2 = 0;
     try {
-      n2 = readFileSync27(join38(repoDir, path), "utf8").split(`
+      n2 = readFileSync28(join39(repoDir, path), "utf8").split(`
 `).length;
     } catch {}
     return { path, added: n2, deleted: 0, status: "added" };
@@ -10507,9 +10579,9 @@ function diffFiles(repoDir, baseSha) {
 }
 function recordRisk(repoDir, a) {
   try {
-    const dir = join38(repoDir, ".loki", "state"), p = join38(dir, "risk-tier.json");
-    mkdirSync11(dir, { recursive: true });
-    writeFileSync14(`${p}.tmp`, JSON.stringify(a, null, 2) + `
+    const dir = join39(repoDir, ".loki", "state"), p = join39(dir, "risk-tier.json");
+    mkdirSync12(dir, { recursive: true });
+    writeFileSync15(`${p}.tmp`, JSON.stringify(a, null, 2) + `
 `);
     renameSync5(`${p}.tmp`, p);
     return p;
@@ -10552,10 +10624,10 @@ var init_check_result = __esm(() => {
 import { spawnSync as spawnSync3 } from "child_process";
 import { mkdtempSync as mkdtempSync5, realpathSync as realpathSync16, rmSync as rmSync9 } from "fs";
 import { tmpdir as tmpdir7 } from "os";
-import { basename as basename14, extname as extname2, join as join39 } from "path";
+import { basename as basename14, extname as extname2, join as join40 } from "path";
 function changedFilesNamed(out2, repoDir, changed) {
   return changed.filter((f) => {
-    if (out2.includes(f) || out2.includes(join39(repoDir, f)))
+    if (out2.includes(f) || out2.includes(join40(repoDir, f)))
       return true;
     const segs = f.split("/");
     if (suffixes(segs, 2).some((x) => x !== f && bounded(out2, x, "(?![\\w-])")))
@@ -10666,7 +10738,7 @@ async function loadErrorIsHarnessOwned(i) {
     return false;
   if (i.args.some((a) => changed.includes(a.replace(/^\.\//, ""))))
     return false;
-  const dir = mkdtempSync5(join39(tmpdir7(), "e10-loadown-"));
+  const dir = mkdtempSync5(join40(tmpdir7(), "e10-loadown-"));
   const git3 = (args) => {
     safeGit(i.repoDir, args, { stdio: "ignore" });
   };
@@ -10698,7 +10770,7 @@ var init_load_owner = __esm(() => {
 });
 
 // ../../loki-ts/src/util/wall_owned.ts
-import { isAbsolute as isAbsolute4, join as join40, relative as relative4 } from "path";
+import { isAbsolute as isAbsolute4, join as join41, relative as relative4 } from "path";
 function failingLocations(raw2, cwd, repoDir) {
   const out2 = raw2.replace(ANSI2, "").replace(/\r\n?/g, `
 `), files = new Set;
@@ -10730,7 +10802,7 @@ function failingLocations(raw2, cwd, repoDir) {
   }
   if (errors2 === 0 || located !== errors2)
     return null;
-  return [...files].map((f) => relative4(repoDir, isAbsolute4(f) ? f : join40(cwd, f)));
+  return [...files].map((f) => relative4(repoDir, isAbsolute4(f) ? f : join41(cwd, f)));
 }
 function wallOwnedFailure(raw2, cwd, repoDir, wall) {
   const locs = failingLocations(raw2, cwd, repoDir);
@@ -10759,11 +10831,11 @@ var init_state = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/repo_profile.ts
-import { existsSync as existsSync22, readFileSync as readFileSync28, mkdirSync as mkdirSync12, readdirSync as readdirSync11, renameSync as renameSync6, rmSync as rmSync10, writeFileSync as writeFileSync15 } from "fs";
-import { basename as basename15, join as join41, resolve as resolve11, isAbsolute as isAbsolute5 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync29, mkdirSync as mkdirSync13, readdirSync as readdirSync11, renameSync as renameSync6, rmSync as rmSync10, writeFileSync as writeFileSync16 } from "fs";
+import { basename as basename15, join as join42, resolve as resolve11, isAbsolute as isAbsolute5 } from "path";
 function loadProfile(repoDir) {
   try {
-    const p = JSON.parse(readFileSync28(commandProfilePath(repoDir), "utf8"));
+    const p = JSON.parse(readFileSync29(commandProfilePath(repoDir), "utf8"));
     return p?.version === 1 && Array.isArray(p.commands) && p.baseline ? p : null;
   } catch {
     return null;
@@ -10794,7 +10866,7 @@ function attributeFullSuite(repoDir, baseSha, full, blocked, changed) {
   const block = new Set(blocked);
   return attribute(repoDir, baseSha, bad.map((c) => ({ name: c.name, ...c.ids ? { ids: c.ids } : {}, eligible: (c.ids ?? []).every((i) => !block.has(i) && !changed.some((f) => i.includes(f))) })));
 }
-var commandProfilePath = (repoDir) => join41(repoDir, ".loki", "state", "repo-profile.json");
+var commandProfilePath = (repoDir) => join42(repoDir, ".loki", "state", "repo-profile.json");
 var init_repo_profile = __esm(() => {
   init_failures();
   init_check_result();
@@ -10804,23 +10876,23 @@ var init_repo_profile = __esm(() => {
 });
 
 // ../../loki-ts/src/project_graph.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 import {
   existsSync as existsSync23,
   readdirSync as readdirSync12,
-  readFileSync as readFileSync29,
-  statSync as statSync15,
-  writeFileSync as writeFileSync16,
-  mkdirSync as mkdirSync13
+  readFileSync as readFileSync30,
+  statSync as statSync16,
+  writeFileSync as writeFileSync17,
+  mkdirSync as mkdirSync14
 } from "fs";
-import { basename as basename16, dirname as dirname12, join as join42, resolve as resolve12 } from "path";
+import { basename as basename16, dirname as dirname13, join as join43, resolve as resolve12 } from "path";
 function readManifest(path) {
   if (!existsSync23(path)) {
     return null;
   }
   let raw2;
   try {
-    raw2 = readFileSync29(path, "utf8");
+    raw2 = readFileSync30(path, "utf8");
   } catch {
     return null;
   }
@@ -10872,12 +10944,12 @@ function resolveMembers(rootDir, declared, selfBasename) {
     for (const child of children) {
       if (!matchPattern(name, child))
         continue;
-      const full = join42(rootDir, child);
+      const full = join43(rootDir, child);
       if (seen.has(full))
         continue;
       let st;
       try {
-        st = statSync15(full);
+        st = statSync16(full);
       } catch {
         continue;
       }
@@ -10889,18 +10961,18 @@ function resolveMembers(rootDir, declared, selfBasename) {
   }
   if (declared.length === 0) {
     for (const child of children) {
-      const full = join42(rootDir, child);
+      const full = join43(rootDir, child);
       if (seen.has(full))
         continue;
       let st;
       try {
-        st = statSync15(full);
+        st = statSync16(full);
       } catch {
         continue;
       }
       if (!st.isDirectory())
         continue;
-      if (!existsSync23(join42(full, ".loki", "app.json")))
+      if (!existsSync23(join43(full, ".loki", "app.json")))
         continue;
       seen.add(full);
       out2.push(full);
@@ -10913,25 +10985,25 @@ function cacheKey(manifestPaths) {
   for (const p of manifestPaths.sort()) {
     let mtime = 0;
     try {
-      mtime = statSync15(p).mtimeMs;
+      mtime = statSync16(p).mtimeMs;
     } catch {}
     parts.push(`${p}:${mtime}`);
   }
-  return createHash9("sha256").update(parts.join("|")).digest("hex");
+  return createHash10("sha256").update(parts.join("|")).digest("hex");
 }
 function writeCache(targetDir, key, result) {
   try {
-    const cacheDir = join42(targetDir, ".loki", "state");
-    mkdirSync13(cacheDir, { recursive: true });
-    const cachePath = join42(cacheDir, "project-graph.json");
-    writeFileSync16(cachePath, JSON.stringify({ key, result }, null, 2), "utf8");
+    const cacheDir = join43(targetDir, ".loki", "state");
+    mkdirSync14(cacheDir, { recursive: true });
+    const cachePath = join43(cacheDir, "project-graph.json");
+    writeFileSync17(cachePath, JSON.stringify({ key, result }, null, 2), "utf8");
   } catch {}
 }
 function discoverProjectGraph(targetDir) {
   const absTarget = resolve12(targetDir);
-  const targetManifest = join42(absTarget, ".loki", "app.json");
-  const parentDir = dirname12(absTarget);
-  const parentManifest = join42(parentDir, ".loki", "app.json");
+  const targetManifest = join43(absTarget, ".loki", "app.json");
+  const parentDir = dirname13(absTarget);
+  const parentManifest = join43(parentDir, ".loki", "app.json");
   const examined = [];
   let chosenManifest = null;
   let chosenRoot = "";
@@ -10951,7 +11023,7 @@ function discoverProjectGraph(targetDir) {
   const members = resolveMembers(chosenRoot, declared, basename16(absTarget));
   const filtered = [];
   for (const m of members) {
-    const sibManifestPath = join42(m, ".loki", "app.json");
+    const sibManifestPath = join43(m, ".loki", "app.json");
     if (existsSync23(sibManifestPath)) {
       examined.push(sibManifestPath);
       const sibManifest = readManifest(sibManifestPath);
@@ -11024,15 +11096,15 @@ var init_steer = __esm(() => {
 });
 
 // ../../loki-ts/src/util/pr_lessons.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync14, readFileSync as readFileSync30 } from "fs";
-import { dirname as dirname13, join as join43 } from "path";
-import { createHash as createHash10 } from "crypto";
+import { existsSync as existsSync24, mkdirSync as mkdirSync15, readFileSync as readFileSync31 } from "fs";
+import { dirname as dirname14, join as join44 } from "path";
+import { createHash as createHash11 } from "crypto";
 function loadLessons(repoDir) {
   const p = lessonsPath(repoDir);
   if (!existsSync24(p))
     return [];
   try {
-    const j = JSON.parse(readFileSync30(p, "utf-8"));
+    const j = JSON.parse(readFileSync31(p, "utf-8"));
     return Array.isArray(j.lessons) ? j.lessons : [];
   } catch {
     return [];
@@ -11040,11 +11112,11 @@ function loadLessons(repoDir) {
 }
 function save(repoDir, lessons) {
   const p = lessonsPath(repoDir);
-  mkdirSync14(dirname13(p), { recursive: true });
+  mkdirSync15(dirname14(p), { recursive: true });
   atomicWriteJson(p, { version: 2, lessons });
 }
 function appendReceiptFact(repoDir, f, now2 = () => new Date) {
-  const id = `rcp-${createHash10("sha256").update(f.runId).digest("hex").slice(0, 12)}`;
+  const id = `rcp-${createHash11("sha256").update(f.runId).digest("hex").slice(0, 12)}`;
   const lessons = loadLessons(repoDir);
   if (lessons.some((l) => l.id === id))
     return false;
@@ -11074,7 +11146,7 @@ function recordRunVerdict(repoDir, runId, verdict) {
   if (dirty)
     save(repoDir, lessons);
 }
-var lessonsPath = (repoDir) => join43(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), KINDS;
+var lessonsPath = (repoDir) => join44(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), KINDS;
 var init_pr_lessons = __esm(() => {
   init_atomic();
   KINDS = new Set(["pr", "receipt", "ticket", "rejected"]);
@@ -11090,19 +11162,19 @@ var init_model_downgrades = __esm(() => {
 var init_mcp_config = () => {};
 
 // ../../loki-ts/src/providers/claude_flags.ts
-import { existsSync as existsSync25, readFileSync as readFileSync31 } from "fs";
-import { resolve as resolvePath, dirname as dirname14 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync32 } from "fs";
+import { resolve as resolvePath, dirname as dirname15 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function designArchetypesText() {
   try {
-    const moduleDir = dirname14(fileURLToPath3(import.meta.url));
+    const moduleDir = dirname15(fileURLToPath3(import.meta.url));
     for (const rel of [
       ["..", "..", "..", "references", "design-archetypes.md"],
       ["..", "..", "references", "design-archetypes.md"]
     ]) {
       const p = resolvePath(moduleDir, ...rel);
       if (existsSync25(p))
-        return readFileSync31(p, "utf8");
+        return readFileSync32(p, "utf8");
     }
   } catch {}
   return "";
@@ -11180,14 +11252,14 @@ var init_providers = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/route_record.ts
-import { existsSync as existsSync26, lstatSync as lstatSync9, mkdirSync as mkdirSync15, readFileSync as readFileSync32, writeFileSync as writeFileSync17 } from "fs";
-import { join as join44 } from "path";
+import { existsSync as existsSync26, lstatSync as lstatSync9, mkdirSync as mkdirSync16, readFileSync as readFileSync33, writeFileSync as writeFileSync18 } from "fs";
+import { join as join45 } from "path";
 function loadRouteRecord(runDir) {
   try {
-    const p = join44(runDir, ROUTE_RECORD_FILE);
+    const p = join45(runDir, ROUTE_RECORD_FILE);
     if (!existsSync26(p) || !lstatSync9(p).isFile())
       return;
-    const v = JSON.parse(readFileSync32(p, "utf8"));
+    const v = JSON.parse(readFileSync33(p, "utf8"));
     return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
   } catch {
     return;
@@ -11197,7 +11269,7 @@ var ROUTE_RECORD_FILE = "route.json";
 var init_route_record = () => {};
 
 // ../../loki-ts/src/runner/router/history_store.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync16, readFileSync as readFileSync33, renameSync as renameSync7, rmSync as rmSync11, writeFileSync as writeFileSync18 } from "fs";
+import { existsSync as existsSync27, mkdirSync as mkdirSync17, readFileSync as readFileSync34, renameSync as renameSync7, rmSync as rmSync11, writeFileSync as writeFileSync19 } from "fs";
 import { resolve as resolve13 } from "path";
 function validRun(v) {
   if (typeof v !== "object" || v === null)
@@ -11213,7 +11285,7 @@ function readRunHistory(key, cacheRoot) {
   if (!existsSync27(path))
     return [];
   try {
-    const parsed = JSON.parse(readFileSync33(path, "utf8"));
+    const parsed = JSON.parse(readFileSync34(path, "utf8"));
     const runs2 = parsed?.runs;
     return Array.isArray(runs2) ? runs2.filter(validRun) : [];
   } catch {
@@ -11223,11 +11295,11 @@ function readRunHistory(key, cacheRoot) {
 function appendRunOutcome(key, outcome, cacheRoot) {
   try {
     const runs2 = [...readRunHistory(key, cacheRoot), outcome].slice(-HISTORY_CAP);
-    mkdirSync16(repoCacheDir(key, cacheRoot), { recursive: true });
+    mkdirSync17(repoCacheDir(key, cacheRoot), { recursive: true });
     const target = historyPath(key, cacheRoot);
     const tmp = `${target}.${process.pid}.tmp`;
     try {
-      writeFileSync18(tmp, JSON.stringify({ runs: runs2 }));
+      writeFileSync19(tmp, JSON.stringify({ runs: runs2 }));
       renameSync7(tmp, target);
     } catch (e) {
       rmSync11(tmp, { force: true, recursive: false });
@@ -11247,7 +11319,7 @@ var init_history_store = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/history.ts
-import { dirname as dirname15, join as join45, resolve as resolve14 } from "path";
+import { dirname as dirname16, join as join46, resolve as resolve14 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function shapeKey(model) {
   if (!model || model.status !== "ok")
@@ -11276,7 +11348,7 @@ var init_history = __esm(() => {
   init_discover2();
   init_gather();
   init_history_store();
-  SHAPE_DEFAULTS_FILE = resolve14(dirname15(fileURLToPath4(import.meta.url)), "..", "..", "..", "data", "router-shape-defaults.json");
+  SHAPE_DEFAULTS_FILE = resolve14(dirname16(fileURLToPath4(import.meta.url)), "..", "..", "..", "data", "router-shape-defaults.json");
 });
 
 // ../../loki-ts/src/runner/router/plan_route.ts
@@ -11407,7 +11479,7 @@ var init_worker = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/package_suite.ts
-import { join as join46 } from "path";
+import { join as join47 } from "path";
 async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
   const api = loadProjectApi(repoDir);
   if (!isMultiRoot(api))
@@ -11418,7 +11490,7 @@ async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
   for (const pkg of withTests) {
     const tc = pkg.commands.test, name = `full suite: ${pkg.name}`, cmd = `(cd ${tc.cwd} && ${tc.cmd})`;
     const started = Date.now();
-    const r = await run(["bash", "-c", tc.cmd], { cwd: join46(repoDir, tc.cwd), timeoutMs: opts.timeoutMs, ...opts.path ? { env: { PATH: opts.path } } : {} });
+    const r = await run(["bash", "-c", tc.cmd], { cwd: join47(repoDir, tc.cwd), timeoutMs: opts.timeoutMs, ...opts.path ? { env: { PATH: opts.path } } : {} });
     const duration_s = (Date.now() - started) / 1000;
     if (signal.aborted) {
       checks.push({ name, cmd, result: "not_run", duration_s });
@@ -11427,7 +11499,7 @@ async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
     }
     const out2 = `${r.stdout}
 ${r.stderr}`;
-    const lr = r.exitCode === 0 || !opts.baseSha ? undefined : await harnessLoadReason({ repoDir, baseSha: opts.baseSha, out: out2, cmd: "bash", args: ["-c", tc.cmd], signal, cwd: join46(repoDir, tc.cwd), ...opts.path ? { env: { PATH: opts.path } } : {} });
+    const lr = r.exitCode === 0 || !opts.baseSha ? undefined : await harnessLoadReason({ repoDir, baseSha: opts.baseSha, out: out2, cmd: "bash", args: ["-c", tc.cmd], signal, cwd: join47(repoDir, tc.cwd), ...opts.path ? { env: { PATH: opts.path } } : {} });
     if (lr) {
       checks.push({ name, cmd, result: "not_run", duration_s });
       notProven.add(`${lr} (${name}; harness-owned)`);
@@ -11460,8 +11532,8 @@ __export(exports_deep, {
   DEFAULT_SECRET_SCAN_SH: () => DEFAULT_SECRET_SCAN_SH,
   DEFAULT_PUSH_SH: () => DEFAULT_PUSH_SH
 });
-import { existsSync as existsSync28, mkdirSync as mkdirSync17, writeFileSync as writeFileSync19 } from "fs";
-import { join as join47 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync18, writeFileSync as writeFileSync20 } from "fs";
+import { join as join48 } from "path";
 async function runFullSuite(ctx, signal, opts, checks, notProven) {
   if (await runPackageSuites(ctx.repoDir, signal, { path: opts.path, timeoutMs: opts.fullSuiteTimeoutMs ?? FULL_SUITE_TIMEOUT_MS, baseSha: ctx.baseSha }, checks, notProven))
     return;
@@ -11558,7 +11630,7 @@ async function runSecretScan(ctx, changed, opts, checks, notProven) {
   }
   const inline = 'script="$1"; shift; . "$script" || exit 3; hit=0; for f in "$@"; do if _commit_scan_secret_file "$f" || _commit_path_looks_secret "$f"; then printf "%s\\n" "$f"; hit=1; fi; done; exit "$hit"';
   const started = Date.now();
-  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join47(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
+  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join48(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
   const durationS = (Date.now() - started) / 1000;
   if (r.exitCode === 3) {
     checks.push({ name, cmd: "secret-scan.sh", result: "not_run", duration_s: durationS });
@@ -11598,9 +11670,9 @@ async function postResults(ctx, opts, checks, notProven, statusState) {
   const prUrl = ctx.outputs().pr?.pr_url;
   const prNumber = prUrl ? PR_NUMBER_RE.exec(prUrl)?.[1] : undefined;
   if (prNumber) {
-    mkdirSync17(ctx.runDir, { recursive: true });
-    const bodyFile = join47(ctx.runDir, "deep-comment.md");
-    writeFileSync19(bodyFile, buildCommentBody(checks, notProven, statusState), "utf8");
+    mkdirSync18(ctx.runDir, { recursive: true });
+    const bodyFile = join48(ctx.runDir, "deep-comment.md");
+    writeFileSync20(bodyFile, buildCommentBody(checks, notProven, statusState), "utf8");
     const commentResult = await run(["bash", scriptPath, ...commentArgv(prNumber, bodyFile)], { cwd: ctx.repoDir, env, timeoutMs: 30000 });
     if (commentResult.exitCode !== 0)
       out2.push(`deep comment not posted (engine10-push.sh exit ${commentResult.exitCode})`);
@@ -11652,8 +11724,8 @@ async function runDeep(ctx, signal, opts = {}) {
   const addendumSha256 = sha2562(canonicalJson(addendumBody));
   const sig = signReceipt(`${ctx.runId}-deep`, addendumSha256);
   const addendum = { ...addendumBody, addendum_sha256: addendumSha256, verification: { jwt: sig.jwt, kid: sig.kid } };
-  mkdirSync17(ctx.runDir, { recursive: true });
-  writeFileSync19(join47(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
+  mkdirSync18(ctx.runDir, { recursive: true });
+  writeFileSync20(join48(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
 `);
   const pushNotProven = await postResults(ctx, opts, checks, notProvenList, statusState);
   const allNotProven = [...notProvenList, ...pushNotProven];
@@ -11698,7 +11770,7 @@ var init_deep = __esm(() => {
 // ../../loki-ts/src/engine10/stages/verify.ts
 import { existsSync as existsSync29, mkdtempSync as mkdtempSync6, realpathSync as realpathSync17, rmSync as rmSync12 } from "fs";
 import { tmpdir as tmpdir8 } from "os";
-import { dirname as dirname16, isAbsolute as isAbsolute6, join as join48, relative as relative5 } from "path";
+import { dirname as dirname17, isAbsolute as isAbsolute6, join as join49, relative as relative5 } from "path";
 function resolveTool(repoDir, bin, fallback, lastResort = fallback) {
   const inRepo = (p) => {
     try {
@@ -11709,7 +11781,7 @@ function resolveTool(repoDir, bin, fallback, lastResort = fallback) {
     }
   };
   const venvEnv = process.env["VIRTUAL_ENV"];
-  const project = [join48(repoDir, ".venv", "bin", bin), join48(repoDir, "venv", "bin", bin), ...venvEnv && inRepo(venvEnv) ? [join48(venvEnv, "bin", bin)] : []].find(existsSync29);
+  const project = [join49(repoDir, ".venv", "bin", bin), join49(repoDir, "venv", "bin", bin), ...venvEnv && inRepo(venvEnv) ? [join49(venvEnv, "bin", bin)] : []].find(existsSync29);
   return project ? [project, "project"] : [Bun.which(fallback) ? fallback : lastResort, "system"];
 }
 function runnerCmd(t, repoDir) {
@@ -11729,7 +11801,7 @@ function runnerCmd(t, repoDir) {
     case "npm":
       return ["npm", ["test", "--silent"]];
     case "go":
-      return ["go", ["test", "-json", `./${dirname16(t.path)}`]];
+      return ["go", ["test", "-json", `./${dirname17(t.path)}`]];
     case "cargo":
       return ["cargo", ["test"]];
   }
@@ -11827,7 +11899,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
   const sus = pairs.filter(({ c }) => rel.has(c.name) && c.result === "pass");
   if (!(un.some(({ c }) => c.result === "fail" && c.ids?.length) || sus.length) || signal.aborted)
     return out2;
-  const dir = mkdtempSync6(join48(tmpdir8(), "e10-base-"));
+  const dir = mkdtempSync6(join49(tmpdir8(), "e10-base-"));
   const git3 = (args) => {
     safeGit(ctx.repoDir, args, { stdio: "ignore", repoDrivers: true });
   };
@@ -11862,7 +11934,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
   return out2;
 }
 function isLokiModeRepo(repoDir) {
-  return existsSync29(join48(repoDir, "scripts", "select-tests.sh"));
+  return existsSync29(join49(repoDir, "scripts", "select-tests.sh"));
 }
 async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   const { api, ...runOpts } = opts;
@@ -11879,9 +11951,9 @@ async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   }
   for (const g of groupByPackage(api, ctx.repoDir, changed.filter((f) => /\.(ts|tsx|js|jsx)$/.test(f)))) {
     const sfx = g.root === "." ? "" : `:${g.root}`, co = g.root === "." ? opts : { ...opts, cwd: g.cwd };
-    if (existsSync29(join48(g.cwd, "tsconfig.json")))
+    if (existsSync29(join49(g.cwd, "tsconfig.json")))
       await runCheck(ctx, `lint:tsc${sfx}`, "npx", ["tsc", "--noEmit", "-p", "."], signal, checks, { ...co, kind: "static" });
-    if (ESLINT_CONFIGS.some((f) => existsSync29(join48(g.cwd, f))))
+    if (ESLINT_CONFIGS.some((f) => existsSync29(join49(g.cwd, f))))
       await runCheck(ctx, `lint:eslint${sfx}`, "npx", ["eslint", ...g.rel], signal, checks, { ...co, kind: "static" });
   }
 }
@@ -12013,8 +12085,8 @@ var init_verify = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/conventions.ts
-import { existsSync as existsSync30, readdirSync as readdirSync13, readFileSync as readFileSync34 } from "fs";
-import { dirname as dirname17, join as join49 } from "path";
+import { existsSync as existsSync30, readdirSync as readdirSync13, readFileSync as readFileSync35 } from "fs";
+import { dirname as dirname18, join as join50 } from "path";
 function parseJsonc(text2) {
   let out2 = "", i = 0;
   while (i < text2.length) {
@@ -12049,7 +12121,7 @@ function moduleOf(file, depth = 0) {
   const ext = typeof j.extends === "string" ? j.extends : null;
   if (!ext || !ext.startsWith("."))
     return null;
-  const next = join49(dirname17(file), ext.endsWith(".json") ? ext : `${ext}.json`);
+  const next = join50(dirname18(file), ext.endsWith(".json") ? ext : `${ext}.json`);
   return existsSync30(next) ? moduleOf(next, depth + 1) : null;
 }
 function readPackageConventions(pkgDir, runner = null) {
@@ -12061,13 +12133,13 @@ function readPackageConventions(pkgDir, runner = null) {
   }
   let packageType = null, tsModule = null;
   for (const n2 of names) {
-    const j = readJson4(join49(pkgDir, n2));
+    const j = readJson4(join50(pkgDir, n2));
     if (!j)
       continue;
     if (packageType === null && typeof j.type === "string" && typeof j.name === "string")
       packageType = j.type;
     if (tsModule === null && j.compilerOptions !== undefined)
-      tsModule = moduleOf(join49(pkgDir, n2));
+      tsModule = moduleOf(join50(pkgDir, n2));
   }
   if (packageType === null && tsModule === null)
     return null;
@@ -12089,7 +12161,7 @@ function conventionViolation(c, fileName, content) {
 }
 var readJson4 = (p) => {
   try {
-    const v = parseJsonc(readFileSync34(p, "utf8"));
+    const v = parseJsonc(readFileSync35(p, "utf8"));
     return v && typeof v === "object" && !Array.isArray(v) ? v : null;
   } catch {
     return null;
@@ -12099,15 +12171,15 @@ var init_conventions = () => {};
 
 // ../../loki-ts/src/engine10/stages/wall.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync31, mkdirSync as mkdirSync18, mkdtempSync as mkdtempSync7, readFileSync as readFileSync35, readdirSync as readdirSync14, realpathSync as realpathSync18, rmSync as rmSync13, writeFileSync as writeFileSync20 } from "fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync19, mkdtempSync as mkdtempSync7, readFileSync as readFileSync36, readdirSync as readdirSync14, realpathSync as realpathSync18, rmSync as rmSync13, writeFileSync as writeFileSync21 } from "fs";
 import { tmpdir as tmpdir9 } from "os";
-import { dirname as dirname18, isAbsolute as isAbsolute7, join as join50, relative as relative6 } from "path";
+import { dirname as dirname19, isAbsolute as isAbsolute7, join as join51, relative as relative6 } from "path";
 function pytestCollectionIsRed(output, repoDir) {
   if (/ModuleNotFoundError/.test(output))
     return false;
   const real2 = (p) => {
     try {
-      return realpathSync18(isAbsolute7(p) ? p : join50(repoDir, p));
+      return realpathSync18(isAbsolute7(p) ? p : join51(repoDir, p));
     } catch {
       return null;
     }
@@ -12144,7 +12216,7 @@ function pytestCollectionIsRed(output, repoDir) {
 }
 function moduleUnderRepo(repoDir, name) {
   const rel = name.replace(/\./g, "/");
-  return existsSync31(join50(repoDir, `${rel}.py`)) || existsSync31(join50(repoDir, rel, "__init__.py"));
+  return existsSync31(join51(repoDir, `${rel}.py`)) || existsSync31(join51(repoDir, rel, "__init__.py"));
 }
 function pytestExit1IsRed(output) {
   if (/^!+ _pytest\.outcomes\.Exit\b/m.test(output))
@@ -12242,10 +12314,10 @@ ${acceptance.map((a) => `Acceptance: ${a}`).join(`
 function loadTaskText(ctx, fromPrior) {
   if (fromPrior)
     return fromPrior;
-  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join50(ctx.runDir, "issue.json");
+  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join51(ctx.runDir, "issue.json");
   if (existsSync31(issueJsonPath)) {
     try {
-      const issue = JSON.parse(readFileSync35(issueJsonPath, "utf8"));
+      const issue = JSON.parse(readFileSync36(issueJsonPath, "utf8"));
       const text2 = [issue.title, issue.body].filter((s) => typeof s === "string" && s.length > 0).join(`
 
 `);
@@ -12257,7 +12329,7 @@ function loadTaskText(ctx, fromPrior) {
 }
 function wallTargetDir(repoDir, existingTests) {
   const first = existingTests[0];
-  return first ? join50(repoDir, dirname18(first.path)) : join50(repoDir, "tests");
+  return first ? join51(repoDir, dirname19(first.path)) : join51(repoDir, "tests");
 }
 function guessRunner(fileName, runners) {
   if (fileName.endsWith(".py"))
@@ -12288,11 +12360,11 @@ async function wallAuthor(ctx, signal) {
   const tree = prior.intake?.tree;
   const repomapText = repoMapText(ctx.repoDir, tree, repomapRef, WALL_MAP_MAX_LINES);
   const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative6(ctx.repoDir, targetDir)}/x`);
-  const conv2 = readPackageConventions(join50(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
-  const cwd = mkdtempSync7(join50(tmpdir9(), "loki-e15-wall-"));
+  const conv2 = readPackageConventions(join51(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
+  const cwd = mkdtempSync7(join51(tmpdir9(), "loki-e15-wall-"));
   const wm = wallManifestFor(ctx.repoDir, tree, task);
   for (const [n2, c] of [["task.md", task], ["repomap.txt", repomapText], ...wm ? [["wall_manifest.txt", wm.text]] : []])
-    writeFileSync20(join50(cwd, n2), c, "utf8");
+    writeFileSync21(join51(cwd, n2), c, "utf8");
   const session = await ctx.sessions.run({
     stage: "wall",
     brief: buildWallBrief(task, repomapText, runners, !!wm, conventionsBrief(conv2), unitSpec()?.acceptance ?? []),
@@ -12308,14 +12380,14 @@ async function wallAuthor(ctx, signal) {
     return done({ status: "failed", data: {}, reason: "wall session aborted, killed, or timed out", killed: true });
   }
   const generated = readdirSync14(cwd).filter((f) => f.startsWith(WALL_PREFIX));
-  const sealedDir = join50(ctx.runDir, "wall");
+  const sealedDir = join51(ctx.runDir, "wall");
   if (generated.length > 0)
-    mkdirSync18(sealedDir, { recursive: true });
+    mkdirSync19(sealedDir, { recursive: true });
   const contents = new Map;
   const discarded = [];
   for (const name of generated) {
-    const content = readFileSync35(join50(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
-    writeFileSync20(join50(sealedDir, name), content, "utf8");
+    const content = readFileSync36(join51(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
+    writeFileSync21(join51(sealedDir, name), content, "utf8");
     if (bad)
       discarded.push({ file: name, reason: `${bad}; wall test did not compile under the package config` });
     else
@@ -12327,7 +12399,7 @@ async function wallAuthor(ctx, signal) {
 function installWall(ctx, a, baseDir, opts = {}) {
   const { generated, contents, discarded, targetDir, runners } = a;
   if (generated.length > 0)
-    mkdirSync18(targetDir, { recursive: true });
+    mkdirSync19(targetDir, { recursive: true });
   const sealedFiles = [];
   const readOnlyFiles = [];
   const wallTests = [];
@@ -12335,8 +12407,8 @@ function installWall(ctx, a, baseDir, opts = {}) {
     const content = contents.get(name);
     if (content === undefined)
       continue;
-    const dest = join50(targetDir, name), runner = guessRunner(name, runners);
-    writeFileSync20(dest, content, "utf8");
+    const dest = join51(targetDir, name), runner = guessRunner(name, runners);
+    writeFileSync21(dest, content, "utf8");
     sealedFiles.push({ path: dest, sha256: sha2562(content) });
     readOnlyFiles.push({ path: dest, content });
     if (runner)
@@ -12345,7 +12417,7 @@ function installWall(ctx, a, baseDir, opts = {}) {
   ctx.emit("wall.sealed", "wall", { files: sealedFiles, ...a.manifestSha256 ? { manifest_sha256: a.manifestSha256 } : {} });
   const baseRunner = opts.baseRunner ?? new RealBaseTestRunner, baseRun = { pass: 0, fail: 0, not_run: discarded.length }, notRunFiles = [];
   for (const t of wallTests) {
-    const r = baseRunner.run(baseDir, [t]), abs = join50(ctx.repoDir, t.path);
+    const r = baseRunner.run(baseDir, [t]), abs = join51(ctx.repoDir, t.path);
     baseRun.pass += r.pass;
     baseRun.fail += r.fail;
     baseRun.not_run += r.not_run ?? 0;
@@ -12397,20 +12469,20 @@ var init_wall = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/discard.ts
-import { chmodSync as chmodSync4, closeSync as closeSync8, lstatSync as lstatSync10, mkdirSync as mkdirSync19, openSync as openSync8, readFileSync as readFileSync36, realpathSync as realpathSync19, rmdirSync, unlinkSync as unlinkSync4, writeFileSync as writeFileSync21 } from "fs";
-import { dirname as dirname19, join as join51, relative as relative7, sep as sep11 } from "path";
+import { chmodSync as chmodSync5, closeSync as closeSync8, lstatSync as lstatSync10, mkdirSync as mkdirSync20, openSync as openSync8, readFileSync as readFileSync37, realpathSync as realpathSync19, rmdirSync, unlinkSync as unlinkSync5, writeFileSync as writeFileSync22 } from "fs";
+import { dirname as dirname20, join as join52, relative as relative7, sep as sep11 } from "path";
 function safeRestore(repoDir, f, want, mode) {
-  const root = realpathSync19(repoDir), fp = join51(root, f), rel = relative7(root, dirname19(fp));
+  const root = realpathSync19(repoDir), fp = join52(root, f), rel = relative7(root, dirname20(fp));
   if (rel.startsWith(".."))
     throw new Error("outside repo");
   let cur = root;
   for (const part of rel === "" ? [] : rel.split(sep11)) {
-    cur = join51(cur, part);
+    cur = join52(cur, part);
     let st2;
     try {
       st2 = lstatSync10(cur);
     } catch {
-      mkdirSync19(cur);
+      mkdirSync20(cur);
       continue;
     }
     if (!st2.isDirectory())
@@ -12422,23 +12494,23 @@ function safeRestore(repoDir, f, want, mode) {
   } catch {
     st = null;
   }
-  if (st?.isFile() && readFileSync36(fp).equals(want)) {
-    chmodSync4(fp, mode);
+  if (st?.isFile() && readFileSync37(fp).equals(want)) {
+    chmodSync5(fp, mode);
     return;
   }
   if (st) {
     if (st.isDirectory())
       rmdirSync(fp);
     else
-      unlinkSync4(fp);
+      unlinkSync5(fp);
   }
   const fd = openSync8(fp, "wx", mode);
   try {
-    writeFileSync21(fd, want);
+    writeFileSync22(fd, want);
   } finally {
     closeSync8(fd);
   }
-  chmodSync4(fp, mode);
+  chmodSync5(fp, mode);
 }
 function alreadySatisfied(o) {
   const b = o.wall?.base_run ?? {};
@@ -12460,7 +12532,7 @@ async function discardIfSatisfied(git3, base, o, staged, keep, repoDir) {
     return { status: "failed", data: {}, reason: "already-satisfied discard failed" };
   const notProven = [];
   for (const [f, v] of Object.entries(o.intake?.preexisting_untracked_blobs ?? {})) {
-    const fp = join51(repoDir, f);
+    const fp = join52(repoDir, f);
     try {
       if (v.startsWith("!")) {
         const st = lstatSync10(fp);
@@ -12479,7 +12551,7 @@ async function discardIfSatisfied(git3, base, o, staged, keep, repoDir) {
       try {
         let m = 420;
         try {
-          const l = lstatSync10(join51(repoDir, f));
+          const l = lstatSync10(join52(repoDir, f));
           if (l.isFile())
             m = l.mode & 511;
         } catch {}
@@ -12512,9 +12584,9 @@ var init_preexisting_dirty = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/commit_filter.ts
-import { dirname as dirname20 } from "path";
+import { dirname as dirname21 } from "path";
 function dropSet(repoDir, staged, preexistingDirty, env = process.env) {
-  return staged.concat(untouchedSinceIntake(repoDir, preexistingDirty, env).map((f) => ({ st: "L", f }))).filter(({ st, f }) => f.startsWith(".loki/") || st === "L" || /(^|\/)loki_wall_[^/]*$/.test(f) || st === "A" && !staged.some(({ f: m }) => /(^|\/)(package\.json|pyproject\.toml|requirements\.txt|Cargo\.toml|go\.mod)$/.test(m) && dirname20(m) === dirname20(f)) && /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|poetry\.lock|Cargo\.lock|go\.sum)$/.test(f));
+  return staged.concat(untouchedSinceIntake(repoDir, preexistingDirty, env).map((f) => ({ st: "L", f }))).filter(({ st, f }) => f.startsWith(".loki/") || st === "L" || /(^|\/)loki_wall_[^/]*$/.test(f) || st === "A" && !staged.some(({ f: m }) => /(^|\/)(package\.json|pyproject\.toml|requirements\.txt|Cargo\.toml|go\.mod)$/.test(m) && dirname21(m) === dirname21(f)) && /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|poetry\.lock|Cargo\.lock|go\.sum)$/.test(f));
 }
 var parseStaged = (out2) => out2.split("\x00").reduce((a, t, i, all) => i % 2 === 0 && t ? [...a, { st: t, f: all[i + 1] }] : a, []);
 var init_commit_filter = __esm(() => {
@@ -12523,7 +12595,7 @@ var init_commit_filter = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/scope.ts
-import { basename as basename18, dirname as dirname21 } from "path";
+import { basename as basename18, dirname as dirname22 } from "path";
 function contractText(o) {
   const c = o.intake?.contract_snapshot?.contract;
   return Array.isArray(c?.criteria) ? c.criteria.map((x) => typeof x?.text === "string" ? x.text : "").join(`
@@ -12537,8 +12609,8 @@ function outsideScope(o, staged) {
   const text2 = `${plan}
 ${typeof o.intake?.task === "string" ? o.intake.task : ""}
 ${contractText(o)}`, pre = o.intake?.preexisting_dirty ?? {};
-  const toks = surfaceTokens(text2), plannedDirs = new Set(rel.map((r) => dirname21(r)).filter((d) => d !== "."));
-  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename18(f)) && !plannedDirs.has(dirname21(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
+  const toks = surfaceTokens(text2), plannedDirs = new Set(rel.map((r) => dirname22(r)).filter((d) => d !== "."));
+  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename18(f)) && !plannedDirs.has(dirname22(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
 }
 function flagOutsideScope(o, staged) {
   const unit = unitFlags(staged, process.env, o.intake?.preexisting_dirty ?? {});
@@ -12552,72 +12624,6 @@ var init_scope2 = __esm(() => {
   STOP = new Set(["the", "and", "for", "with", "that", "this", "all", "any", "src", "from", "into", "each", "across", "apply", "add", "use", "make"]);
 });
 
-// ../../loki-ts/src/util/receipt_signer.ts
-import { createHash as createHash11, randomBytes as randomBytes3, createPrivateKey, createPublicKey as createPublicKey2, generateKeyPairSync, sign } from "crypto";
-import { chmodSync as chmodSync5, linkSync, mkdirSync as mkdirSync20, readFileSync as readFileSync37, statSync as statSync16, unlinkSync as unlinkSync5, writeFileSync as writeFileSync22 } from "fs";
-import { homedir as homedir8 } from "os";
-import { dirname as dirname22, join as join52 } from "path";
-function canonicalJson(x) {
-  const walk = (v) => {
-    if (Array.isArray(v))
-      return `[${v.map(walk).join(",")}]`;
-    if (v !== null && typeof v === "object") {
-      const o = v;
-      return `{${Object.keys(o).filter((k) => o[k] !== undefined).sort().map((k) => `${JSON.stringify(k)}:${walk(o[k])}`).join(",")}}`;
-    }
-    return JSON.stringify(v ?? null);
-  };
-  return walk(x).replace(/[\u0080-\uFFFF]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
-}
-function loadSigningKey(generate = true) {
-  try {
-    const inline = process.env["LOKI_RECEIPT_SIGNING_KEY"]?.trim();
-    let pem = inline ?? "";
-    if (!inline) {
-      const given = process.env["LOKI_RECEIPT_SIGNING_KEY_FILE"]?.trim();
-      const file = given || join52(process.env["HOME"] || homedir8(), ".loki", "keys", RECEIPT_SIGNER_BASENAME);
-      try {
-        pem = readFileSync37(file);
-        if (!given) {
-          for (const [f, m] of [[file, 384], [dirname22(file), 448]])
-            if (statSync16(f).mode & 63)
-              chmodSync5(f, m);
-        }
-      } catch (e) {
-        if (e.code !== "ENOENT" || !generate)
-          return null;
-        mkdirSync20(dirname22(dirname22(file)), { recursive: true, mode: 448 });
-        mkdirSync20(dirname22(file), { recursive: true, mode: 448 });
-        const tmp = `${file}.${randomBytes3(6).toString("hex")}.tmp`;
-        writeFileSync22(tmp, generateKeyPairSync("ed25519").privateKey.export({ type: "pkcs8", format: "pem" }), { flag: "wx", mode: 384 });
-        try {
-          linkSync(tmp, file);
-        } catch (l) {
-          if (l.code !== "EEXIST")
-            throw l;
-        } finally {
-          unlinkSync5(tmp);
-        }
-        pem = readFileSync37(file);
-      }
-    }
-    const k = createPrivateKey(pem);
-    return k.asymmetricKeyType === "ed25519" ? k : null;
-  } catch {
-    return null;
-  }
-}
-function signReceipt(runId, hash) {
-  const key = loadSigningKey();
-  if (!key)
-    return { jwt: null, kid: null };
-  const kid = kidOf2(createPublicKey2(key));
-  const input = `${b64u(canonicalJson({ alg: "EdDSA", typ: "JWT", kid }))}.${b64u(canonicalJson({ job_id: runId, run_id: runId, receipt_sha256: hash, iat: Math.floor(Date.now() / 1000) }))}`;
-  return { jwt: `${input}.${b64u(sign(null, Buffer.from(input), key))}`, kid };
-}
-var RECEIPT_SIGNER_BASENAME = "receipt-ed25519.pem", b64u = (b) => Buffer.from(b).toString("base64url"), kidOf2 = (pub) => b64u(createHash11("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${pub.export({ format: "jwk" }).x}"}`).digest());
-var init_receipt_signer = () => {};
-
 // ../../loki-ts/src/features/visual_evidence.ts
 import { spawn as spawn7 } from "child_process";
 import { createHash as createHash12, randomBytes as randomBytes4 } from "crypto";
@@ -13343,7 +13349,7 @@ var init_contract = __esm(() => {
 
 // ../../loki-ts/src/features/speed/seal_group.ts
 import { createHash as createHash14 } from "crypto";
-import { existsSync as existsSync36, readdirSync as readdirSync17, readFileSync as readFileSync42, statSync as statSync17 } from "fs";
+import { existsSync as existsSync36, mkdirSync as mkdirSync23, readdirSync as readdirSync17, readFileSync as readFileSync42, renameSync as renameSync8, statSync as statSync17, writeFileSync as writeFileSync25 } from "fs";
 import { basename as basename19, dirname as dirname25, join as join57 } from "path";
 function sealGroup(runDir, rh) {
   const manifestPath = join57(runDir, "group", "manifest.json");
@@ -13800,7 +13806,7 @@ var init_supply_guard = __esm(() => {
 
 // ../../loki-ts/src/engine10/stages/seal.ts
 import { createHash as createHash15 } from "crypto";
-import { existsSync as existsSync38, readdirSync as readdirSync18, mkdirSync as mkdirSync23, readFileSync as readFileSync44, writeFileSync as writeFileSync25 } from "fs";
+import { existsSync as existsSync38, readdirSync as readdirSync18, mkdirSync as mkdirSync24, readFileSync as readFileSync44, writeFileSync as writeFileSync26 } from "fs";
 import { basename as basename21, isAbsolute as isAbsolute9, join as join59, relative as relative9 } from "path";
 function sanitizeReason(s) {
   const collapsed = s.replace(/[\x00-\x1f\x7f]+/g, " ").trim();
@@ -14114,11 +14120,11 @@ var init_seal = __esm(() => {
         hash = receiptSha256(body);
       }
       const receipt = { ...body, receipt_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } };
-      mkdirSync23(ctx.runDir, { recursive: true });
+      mkdirSync24(ctx.runDir, { recursive: true });
       const path = join59(ctx.runDir, "receipt.json");
-      writeFileSync25(path, JSON.stringify(receipt, null, 2) + `
+      writeFileSync26(path, JSON.stringify(receipt, null, 2) + `
 `);
-      writeFileSync25(join59(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
+      writeFileSync26(join59(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
       recordRun(process.env, ctx.repoDir, ctx.model, verdict, cost.usd, cost.unmetered === true, totalS);
       const signed = sig.jwt !== null;
       const data = { receipt_path: path, receipt_sha256: hash, signed, kid: sig.kid, verdict, not_proven: receipt.not_proven, ...mp ? { mutation_line: mp.line } : {}, ...routeBlock ? { route_line: routePrLine(routeBlock) } : {} };
@@ -14229,7 +14235,7 @@ var init_keys_cmd = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/verify_cmd.ts
-import { existsSync as existsSync39, readFileSync as readFileSync46, renameSync as renameSync8, statSync as statSync20, writeFileSync as writeFileSync26 } from "fs";
+import { existsSync as existsSync39, readFileSync as readFileSync46, renameSync as renameSync9, statSync as statSync20, writeFileSync as writeFileSync27 } from "fs";
 import { basename as basename22, dirname as dirname27, join as join60 } from "path";
 import { createHash as createHash16, createPublicKey as createPublicKey4, verify as verify3 } from "crypto";
 function pubFor(kid, given) {
@@ -14321,9 +14327,8 @@ async function verifyReceipt(receiptPath, deps = {}) {
     return verifyCompositeFile(receiptPath, receipt, deps);
   const recorded = receipt["receipt_sha256"];
   const computed = computeReceiptHash(receipt);
-  if (typeof recorded !== "string" || recorded !== computed) {
+  if (typeof recorded !== "string" || recorded !== computed)
     return { verdict: "TAMPERED", reasons: [`receipt_sha256 mismatch: recorded ${JSON.stringify(recorded)}, computed ${computed}`] };
-  }
   const logProblem = checkEventLog(receiptPath, receipt);
   if (logProblem)
     return { verdict: "TAMPERED", reasons: [logProblem] };
@@ -14383,6 +14388,7 @@ async function verifyCompositeFile(receiptPath, receipt, deps) {
 var computeReceiptHash = (receipt) => receiptSha256(receipt);
 var init_verify_cmd = __esm(() => {
   init_paths();
+  init_receipt_signer();
   init_run_status();
   init_events();
   init_seal();