nexus-agents 12.6.0 → 12.7.0

package/dist/{chunk-WMEV4263.js → chunk-32F2JIQ7.js}

@@ -62,7 +62,7 @@ import {
   updateStage,
   withFileLock,
   writeJobCancelled
-} from "./chunk-L2YUWHLO.js";
+} from "./chunk-E36PFEF6.js";
 import {
   allOf,
   anyOf
@@ -70,7 +70,7 @@ import {
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-OZ4MJ37G.js";
+} from "./chunk-E6UCTQDW.js";
 import {
   IssueTriage,
   createAuditTrail,
@@ -79,13 +79,13 @@ import {
   createGraphAuditBridge,
   emitPipelinePolicyEvent,
   readActionRefusal
-} from "./chunk-MTW6GDCJ.js";
+} from "./chunk-LN72XW24.js";
 import {
   sanitizeInput
 } from "./chunk-RYDTFPVI.js";
 import {
   withPrerequisite
-} from "./chunk-7DTZMHL7.js";
+} from "./chunk-644XVF2Z.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -117,7 +117,7 @@ import {
   toolSuccess,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-R7Y7BBG5.js";
+} from "./chunk-DEJZBJ3X.js";
 import {
   generateSecurityPlan
 } from "./chunk-KMGKOF5P.js";
@@ -163,7 +163,7 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-PPGUFPJQ.js";
+} from "./chunk-DHDG5AZH.js";
 import {
   REGISTRY_PATH,
   computeSourceQualityScore,
@@ -171,11 +171,11 @@ import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   resolveRegistryRoot
-} from "./chunk-UJKT5T3J.js";
+} from "./chunk-DKYP4FGN.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-LLYA4RZQ.js";
+} from "./chunk-UPBZUIUK.js";
 import {
   DEFAULT_RELEVANCE_CONFIG,
   MemoryImportance,
@@ -183,7 +183,7 @@ import {
   calculateTextJaccardSimilarity,
   getToolMemory,
   memoryTrustTierTag
-} from "./chunk-CQX276YP.js";
+} from "./chunk-TRPJOMT6.js";
 import {
   EXTERNAL_CONTENT_TRUST_TIER,
   resolveContentTrustProvenance,
@@ -192,7 +192,7 @@ import {
 } from "./chunk-RGB5OTRZ.js";
 import {
   createSessionMemory
-} from "./chunk-J72TWH3S.js";
+} from "./chunk-QT3EBFLT.js";
 import {
   TrustTierSchema
 } from "./chunk-BFO2NZPO.js";
@@ -207,7 +207,7 @@ import {
 } from "./chunk-MZWHXERV.js";
 import {
   executeExpert
-} from "./chunk-2MF4NNPO.js";
+} from "./chunk-EYT2XPU5.js";
 import {
   CliDetectionCache,
   EventTopics,
@@ -218,7 +218,7 @@ import {
   getAvailableClis,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-IIU4MHGC.js";
+} from "./chunk-SYMR2UOV.js";
 import {
   DEFAULTS
 } from "./chunk-L47UF7ET.js";
@@ -235,7 +235,7 @@ import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-I3J4CPNU.js";
+} from "./chunk-FZKKE56L.js";
 import {
   BaseAdapter,
   createStream,
@@ -243,11 +243,11 @@ import {
   parseGatewayExtraHeaders,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-PE42IZWH.js";
+} from "./chunk-TKRXEBFT.js";
 import {
   BWRAP_READ_ONLY_ARGS,
   createBwrapPreflight
-} from "./chunk-WDOWAWVR.js";
+} from "./chunk-W7S2425L.js";
 import {
   getMemoryRegistry
 } from "./chunk-ROYGBFVE.js";
@@ -255,14 +255,14 @@ import {
   SIGKILL_GRACE_MS,
   terminateProcessTree,
   trackProcessTree
-} from "./chunk-GIQWYFPY.js";
+} from "./chunk-EQYDFNEI.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-OOJD457B.js";
+} from "./chunk-XUBLXLIX.js";
 import {
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-KSJ43GHQ.js";
+} from "./chunk-TQMMWFNV.js";
 import {
   sanitizeErrorDetails,
   sanitizeOutput
@@ -282,6 +282,7 @@ import {
   DecisionGateSchema,
   ErrorCode,
   LinUCBBandit,
+  MAX_TRACE_ATTRIBUTION_BYTES,
   MODELSDEV_CATALOGUE_CAVEATS,
   ModelCapability,
   ModelError,
@@ -299,7 +300,11 @@ import {
   SharedTaskAnalyzer,
   StrategyNameSchema,
   TOOL_MANIFEST,
+  TRACE_ATTRIBUTION_FILE,
   TimeoutError,
+  TraceAttributionSnapshotSchema,
+  TraceOriginSchema,
+  TraceRunOriginSchema,
   UNRESOLVED_MODEL_ID,
   ValidationError,
   WeatherReportInputSchema,
@@ -317,6 +322,7 @@ import {
   classifyStallTick,
   computeTokenCost,
   createSharedTaskAnalyzer,
+  decodeTraceBytes,
   deriveResearchMaturity,
   detectCapabilityGaps,
   detectTrend,
@@ -359,8 +365,10 @@ import {
   queryModelAccessMode,
   raceAbort,
   rankStrategiesByManifest,
+  readTraceSnapshot,
   recordRoutingGaps,
   recordToolRefusal,
+  relationCounts,
   researchContextFromText,
   resolveInsideRoot,
   runInHeartbeatSession,
@@ -370,11 +378,13 @@ import {
   throwIfAborted,
   toError,
   toExpertTaskAnalysisResult,
+  traceDigest,
+  traceRelation,
   truncateText,
   truncateWithInfo,
   withStep,
   withTimeout
-} from "./chunk-3BSLRRPJ.js";
+} from "./chunk-PQKMJL5R.js";
 import {
   SUPPORTED_EXTENSIONS
 } from "./chunk-XBEKMUTO.js";
@@ -389,13 +399,13 @@ import {
   lookupInTreeCapability,
   modelSupportsAll,
   resolveOwnerCli
-} from "./chunk-NMIAGVWS.js";
+} from "./chunk-DBIF43Y5.js";
 import {
   deriveEntry,
   getDefaultRegistry,
   resolveModelIdentity,
   resolveModelIdentitySync
-} from "./chunk-ZWWPRNNJ.js";
+} from "./chunk-FRLQV7PA.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -2494,7 +2504,7 @@ var RateLimiter2 = class {
    * Sleeps for the specified duration.
    */
   sleep(ms) {
-    return new Promise((resolve17) => setTimeout(resolve17, ms));
+    return new Promise((resolve18) => setTimeout(resolve18, ms));
   }
   /**
    * Returns the current number of available tokens.
@@ -2717,14 +2727,14 @@ function notifyRetry(onRetry, info) {
 function sleepUnlessAborted(ms, signal) {
   if (signal === void 0) return sleep(ms).then(() => true);
   if (signal.aborted) return Promise.resolve(false);
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     const onAbort = () => {
       clearTimeout(timer);
-      resolve17(false);
+      resolve18(false);
     };
     const timer = setTimeout(() => {
       signal.removeEventListener("abort", onAbort);
-      resolve17(true);
+      resolve18(true);
     }, ms);
     signal.addEventListener("abort", onAbort, { once: true });
   });
@@ -5723,13 +5733,13 @@ function makeCancelError(taskId) {
 }
 function executeWithTimeout(params) {
   const { task, maxDurationMs, executeTask, transformError, signal } = params;
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     let settled = false;
     const settle = (result) => {
       if (settled) return;
       settled = true;
       clearTimeout(timeoutId);
-      resolve17(result);
+      resolve18(result);
     };
     const timeoutId = setTimeout(() => {
       settle(
@@ -11482,13 +11492,13 @@ var WaveScheduler = class {
   }
   async withTimeout(promise, timeoutMs, taskId) {
     if (timeoutMs <= 0) return promise;
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       const timer = setTimeout(() => {
         reject(new Error(`Task ${taskId} timed out after ${String(timeoutMs)}ms`));
       }, timeoutMs);
       promise.then((result) => {
         clearTimeout(timer);
-        resolve17(result);
+        resolve18(result);
       }).catch((error) => {
         clearTimeout(timer);
         reject(error instanceof Error ? error : new Error(String(error)));
@@ -19134,8 +19144,8 @@ var Semaphore = class {
       this.available -= 1;
       return Promise.resolve();
     }
-    return new Promise((resolve17) => {
-      this.waiters.push(resolve17);
+    return new Promise((resolve18) => {
+      this.waiters.push(resolve18);
     });
   }
   release() {
@@ -22554,9 +22564,9 @@ var ExpertPool = class {
     if (this.active < this.capacity) {
       return this.issuePermit();
     }
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       const timer = setTimeout(() => {
-        const idx = this.queue.findIndex((e) => e.resolve === resolve17);
+        const idx = this.queue.findIndex((e) => e.resolve === resolve18);
         if (idx !== -1) {
           this.queue.splice(idx, 1);
         }
@@ -22566,7 +22576,7 @@ var ExpertPool = class {
           )
         );
       }, this.acquireTimeoutMs);
-      this.queue.push({ resolve: resolve17, reject, timer });
+      this.queue.push({ resolve: resolve18, reject, timer });
     });
   }
   /** Release a permit back to the pool. */
@@ -23161,8 +23171,8 @@ var TaskQueue = class {
     if (this.cancelled) {
       return Promise.reject(new Error("Queue has been cancelled"));
     }
-    return new Promise((resolve17, reject) => {
-      this.queue.push({ task, resolve: resolve17, reject });
+    return new Promise((resolve18, reject) => {
+      this.queue.push({ task, resolve: resolve18, reject });
       this.processNext();
     });
   }
@@ -23438,16 +23448,16 @@ async function executeStepWithTimeout(step, context, stepExecutor, signal) {
   return executeWithTimeout2(step, stepContext, stepExecutor, stepTimeout, startTime);
 }
 function executeWithTimeout2(step, context, executor, timeout, startTime) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     const timeoutId = setTimeout(() => {
-      resolve17(createTimeoutResult(step.id, getTimeProvider().now() - startTime, timeout));
+      resolve18(createTimeoutResult(step.id, getTimeProvider().now() - startTime, timeout));
     }, timeout);
     executor(step, context).then((result) => {
       clearTimeout(timeoutId);
-      resolve17(result);
+      resolve18(result);
     }).catch((error) => {
       clearTimeout(timeoutId);
-      resolve17(createErrorResult(step.id, getTimeProvider().now() - startTime, error));
+      resolve18(createErrorResult(step.id, getTimeProvider().now() - startTime, error));
     });
   });
 }
@@ -26288,8 +26298,8 @@ function resolveCwdProjectRoot(logger62) {
 function beginWorkspaceRootResolution(logger62) {
   if (resolution?.timer !== void 0) clearTimeout(resolution.timer);
   let resolveReady;
-  workspaceRootReady = new Promise((resolve17) => {
-    resolveReady = resolve17;
+  workspaceRootReady = new Promise((resolve18) => {
+    resolveReady = resolve18;
   });
   const root = resolveNexusProjectRoot(logger62) ?? resolveClaudeProjectRoot(logger62) ?? resolveCwdProjectRoot(logger62);
   if (root === null) {
@@ -29096,6 +29106,7 @@ function emitSwarmUnhealthySignals(metrics, bus, logger62 = defaultLogger) {
       emittedSlots.add(slot);
       bus.emit({
         type: "signal.swarm_unhealthy",
+        origin: { kind: "global", producer: "swarm-health" },
         timestamp: Date.parse(metrics.calculatedAt),
         agentId: slot,
         reason: `bottleneck: ${String(bottleneck.queuedMessages)} queued, ${String(bottleneck.blockedAgents)} blocked (severity ${bottleneck.severity})`
@@ -29160,6 +29171,7 @@ function startFailoverSignals(options) {
       lastEmitByCli.set(unhealthy.cli, now);
       pipelineBus.emit({
         type: "signal.swarm_unhealthy",
+        origin: { kind: "global", producer: "failover" },
         timestamp: now,
         agentId: unhealthy.cli,
         reason: unhealthy.reason
@@ -30629,8 +30641,8 @@ function budgetHaltFailure(context) {
 import { randomUUID as randomUUID8 } from "node:crypto";
 function resolveExecutionEngineOrError(deps, workflowName) {
   try {
-    const resolve17 = deps.resolveExecutionEngine ?? (() => deps.workflowEngine);
-    return { ok: true, value: resolve17() };
+    const resolve18 = deps.resolveExecutionEngine ?? (() => deps.workflowEngine);
+    return { ok: true, value: resolve18() };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     deps.logger?.error(
@@ -31314,7 +31326,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-P4WAQWKW.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-TJY4PZDE.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -31835,13 +31847,13 @@ function dedupe(ids) {
   return [...new Set(ids)];
 }
 async function withTimeout3(promise, ms) {
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve18, reject) => {
     const timer = setTimeout(() => {
       reject(new Error(`Node timed out after ${String(ms)}ms`));
     }, ms);
     promise.then((result) => {
       clearTimeout(timer);
-      resolve17(result);
+      resolve18(result);
     }).catch((error) => {
       clearTimeout(timer);
       reject(error instanceof Error ? error : new Error(String(error)));
@@ -32945,22 +32957,37 @@ function emitPipelineStageEvent(prefix, stage, status, details) {
 import { createHash as createHash4 } from "node:crypto";
 
 // src/pipeline/trace-writer.ts
+import { randomUUID as randomUUID9 } from "node:crypto";
 import { mkdir, writeFile, rename, unlink } from "node:fs/promises";
-import { join as join5 } from "node:path";
+import { join as join5, resolve as resolve6 } from "node:path";
 var logger23 = createLogger({ component: "TraceWriter" });
 var MAX_BUFFER_SIZE = 5e4;
 var TraceWriter = class {
   constructor(bus, options) {
     this.options = options;
-    this.runDir = join5(options.runsDir, options.runId);
+    const origin = options.origin === void 0 ? void 0 : TraceRunOriginSchema.parse(options.origin);
+    if (origin !== void 0 && origin.runId !== options.runId)
+      throw new Error("Trace capture run mismatch");
+    this.options = { ...options, ...origin === void 0 ? {} : { origin } };
+    this.runDir = resolve6(options.runsDir, options.runId);
     this.maxBuffer = options.maxBufferSize ?? MAX_BUFFER_SIZE;
+    if (!Number.isSafeInteger(this.maxBuffer) || this.maxBuffer < 1)
+      throw new Error("Invalid trace buffer size");
     this.unsubscribe = bus.subscribe({}, (event) => {
-      if (!this.stopped) {
-        if (this.buffer.length >= this.maxBuffer) {
-          this.buffer.shift();
-        }
-        this.buffer.push(this.eventToTrace(event));
+      if (this.stopped) return;
+      this.countsOverflow ||= this.observed === Number.MAX_SAFE_INTEGER;
+      if (this.countsOverflow) return;
+      this.observed++;
+      const entry = this.eventToTrace(event);
+      if (entry === null) {
+        this.foreignDropped++;
+        return;
       }
+      if (this.buffer.length >= this.maxBuffer) {
+        this.buffer.shift();
+        this.evicted++;
+      }
+      this.buffer.push(entry);
     });
   }
   options;
@@ -32969,40 +32996,69 @@ var TraceWriter = class {
   runDir;
   maxBuffer;
   stopped = false;
-  /** Flush buffered events to disk. Throws on write failure. */
-  async flush() {
-    if (this.buffer.length === 0) return;
-    await mkdir(this.runDir, { recursive: true });
-    const lines = this.buffer.map((e) => JSON.stringify(e)).join("\n");
-    const tracePath = join5(this.runDir, "trace.jsonl");
-    const traceTmp = `${tracePath}.tmp.${String(process.pid)}`;
-    try {
-      await writeFile(traceTmp, lines + "\n", "utf-8");
-      await rename(traceTmp, tracePath);
-    } catch (err2) {
-      await unlink(traceTmp).catch((unlinkErr) => {
-        const msg = unlinkErr instanceof Error ? unlinkErr.message : String(unlinkErr);
-        logger23.warn("Failed to clean up trace temp file", { path: traceTmp, error: msg });
-      });
-      throw err2;
-    }
-    const indexContent = this.buildIndex();
-    const indexPath = join5(this.runDir, "index.md");
-    const indexTmp = `${indexPath}.tmp.${String(process.pid)}`;
-    try {
-      await writeFile(indexTmp, indexContent, "utf-8");
-      await rename(indexTmp, indexPath);
-    } catch (err2) {
-      await unlink(indexTmp).catch((unlinkErr) => {
-        const msg = unlinkErr instanceof Error ? unlinkErr.message : String(unlinkErr);
-        logger23.warn("Failed to clean up index temp file", { path: indexTmp, error: msg });
+  observed = 0;
+  foreignDropped = 0;
+  evicted = 0;
+  countsOverflow = false;
+  pendingFlush;
+  flushAgain = false;
+  /**
+   * Serializes/coalesces bounded pending work. Each snapshot freezes rows and counters
+   * before its first await. Files rename individually; readers verify their digest binding.
+   */
+  flush() {
+    if (this.pendingFlush !== void 0) {
+      this.flushAgain = true;
+      return this.pendingFlush;
+    }
+    this.pendingFlush = this.flushSnapshots().finally(() => {
+      this.pendingFlush = void 0;
+    });
+    return this.pendingFlush;
+  }
+  async flushSnapshots() {
+    do {
+      this.flushAgain = false;
+      if (this.countsOverflow) throw new Error("Trace observation counter overflow");
+      const entries = [...this.buffer];
+      const content = entries.length === 0 ? "" : entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
+      const snapshot = TraceAttributionSnapshotSchema.parse({
+        attributionVersion: 1,
+        runId: this.options.runId,
+        ...this.options.origin === void 0 ? {} : { captureOrigin: this.options.origin },
+        traceSha256: traceDigest(content),
+        traceBytes: Buffer.byteLength(content),
+        writerObserved: {
+          observed: this.observed,
+          foreignDropped: this.foreignDropped,
+          evicted: this.evicted
+        },
+        retained: relationCounts(entries)
       });
-      throw err2;
-    }
-    logger23.info("Trace flushed", {
-      runId: this.options.runId,
-      events: this.buffer.length
-    });
+      const metadata = JSON.stringify(snapshot) + "\n";
+      if (Buffer.byteLength(metadata) > MAX_TRACE_ATTRIBUTION_BYTES)
+        throw new Error("Trace metadata exceeds read cap");
+      const runDir = this.containedRunDirectory();
+      const index = this.buildIndex(entries);
+      await mkdir(runDir, { recursive: true });
+      await writeAtomic(join5(runDir, "trace.jsonl"), content);
+      await writeAtomic(join5(runDir, TRACE_ATTRIBUTION_FILE), metadata);
+      await writeAtomic(join5(runDir, "index.md"), index);
+      logger23.info("Trace flushed", { runId: this.options.runId, events: entries.length });
+    } while (this.needsAnotherFlush());
+  }
+  /** Refuse unsafe output during optional diagnostic flush, not task admission. */
+  containedRunDirectory() {
+    const root = resolve6(this.options.runsDir);
+    const directory = resolveInsideRoot(this.runDir, root);
+    const canonicalRoot = resolveInsideRoot(root, root);
+    if (canonicalRoot === null || directory === null || directory === canonicalRoot)
+      throw new Error("Trace output must be a contained descendant of runsDir");
+    return directory;
+  }
+  /** Read through a call: another request can set this flag across awaits. */
+  needsAnotherFlush() {
+    return this.flushAgain;
   }
   /** Stop subscribing to events. */
   stop() {
@@ -33011,14 +33067,30 @@ var TraceWriter = class {
   }
   /** Convert a PipelineEvent to an ExecutionTraceEntry. */
   eventToTrace(event) {
+    const parsed = TraceOriginSchema.safeParse(event.origin);
+    const origin = parsed.success ? parsed.data : void 0;
+    const captureRelation = traceRelation(
+      event.type,
+      origin,
+      this.options.origin,
+      this.options.runId
+    );
+    if (captureRelation === "foreign") return null;
     const base = {
+      attributionVersion: 1,
+      captureRelation,
+      ...origin === void 0 ? {} : { origin },
+      ...this.options.origin === void 0 ? {} : { captureOrigin: { ...this.options.origin } },
+      ...event.origin !== void 0 && !parsed.success ? { attributionIssue: "invalid_origin" } : {},
       timestamp: event.timestamp,
       runId: this.options.runId,
       eventType: event.type
     };
     return {
       ...base,
-      ...this.extractAttribution(event)
+      ...this.extractAttribution(event),
+      ...extractIdentity(event),
+      ...extractSignal(event)
     };
   }
   /** Extract attribution fields from typed events. */
@@ -33043,18 +33115,18 @@ var TraceWriter = class {
     }
   }
   /** Build a markdown index summary for this run. */
-  buildIndex() {
+  buildIndex(entries) {
     const lines = [
       `# Run: ${this.options.runId}`,
       "",
       `**Generated:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
-      `**Events:** ${String(this.buffer.length)}`,
+      `**Events:** ${String(entries.length)}`,
       "",
       "## Event Summary",
       ""
     ];
     const counts = /* @__PURE__ */ new Map();
-    for (const entry of this.buffer) {
+    for (const entry of entries) {
       const prev = counts.get(entry.eventType) ?? 0;
       counts.set(entry.eventType, prev + 1);
     }
@@ -33117,6 +33189,74 @@ function extractWaveAttribution(event) {
   }
   return { ...base, durationMs: event.durationMs, workerCount: event.successes + event.errors };
 }
+async function writeAtomic(path9, content) {
+  const temporary = `${path9}.tmp.${randomUUID9()}`;
+  try {
+    await writeFile(temporary, content, { encoding: "utf8", flag: "wx" });
+    await rename(temporary, path9);
+  } catch (cause) {
+    await unlink(temporary).catch((cleanup) => {
+      const error = cleanup instanceof Error ? cleanup.message : String(cleanup);
+      logger23.warn("Failed to clean up trace temporary file", { path: temporary, error });
+    });
+    throw cause;
+  }
+}
+function taskIdentity(event) {
+  switch (event.type) {
+    case "task.created":
+    case "task.status_changed":
+    case "task.completed":
+    case "task.failed":
+    case "pipeline.started":
+      return event.taskId;
+    default:
+      return void 0;
+  }
+}
+function extractIdentity(event) {
+  const result = {};
+  const identities = {
+    intentId: event.intentId,
+    attemptId: event.attemptId,
+    // CompositeRouter uses routing.taskId for a task-content prefix, not an ID.
+    taskId: taskIdentity(event),
+    ...event.type === "tool.invoked" || event.type === "tool.completed" ? { invocationId: event.invocationId } : {}
+  };
+  for (const key2 of ["taskId", "attemptId", "intentId", "invocationId"]) {
+    const value = Reflect.get(identities, key2);
+    if (typeof value !== "string") continue;
+    if (value.length === 0 || value.length > 256) {
+      result.provenanceTruncated = true;
+      continue;
+    }
+    result[key2] = value;
+  }
+  return result;
+}
+function extractSignal(event) {
+  const result = {};
+  const bounded = (value, limit = 256) => {
+    if (value.length > limit) result.provenanceTruncated = true;
+    return value.slice(0, limit);
+  };
+  if (event.type === "signal.vote_rejected") {
+    result.proposalId = bounded(event.proposalId);
+    result.approvalPercentage = event.approvalPercentage;
+    if (event.rejectionRules !== void 0) {
+      if (event.rejectionRules.length > 20) result.provenanceTruncated = true;
+      result.rejectionRules = event.rejectionRules.slice(0, 20).map((rule) => bounded(rule));
+    }
+  } else if (event.type === "signal.fitness_declined") {
+    result.score = event.score;
+    result.floor = event.floor;
+    if (event.dimension !== void 0) result.dimension = bounded(event.dimension);
+  } else if (event.type === "signal.swarm_unhealthy") {
+    result.agentId = bounded(event.agentId);
+    result.reason = bounded(event.reason, 1024);
+  }
+  return result;
+}
 
 // src/pipeline/pipeline-callback-tracker.ts
 var PipelineCallbackTracker = class {
@@ -34256,17 +34396,17 @@ async function runBoundedProbe(req, config, probeOptions, effectiveTimeoutMs) {
   };
   config.signal?.addEventListener("abort", onAbort, { once: true });
   let timer;
-  const timeoutRace = new Promise((resolve17) => {
+  const timeoutRace = new Promise((resolve18) => {
     timer = setTimeout(() => {
       controller.abort();
       const message = `Worker probe for "${req.id}" timed out after ${String(effectiveTimeoutMs)}ms`;
-      resolve17({ ok: false, errorClass: "ProbeTimeoutError", message });
+      resolve18({ ok: false, errorClass: "ProbeTimeoutError", message });
     }, effectiveTimeoutMs);
   });
-  const abortRace = new Promise((resolve17) => {
+  const abortRace = new Promise((resolve18) => {
     const onSig = () => {
       const message = `Worker probe for "${req.id}" aborted during execution`;
-      resolve17({ ok: false, errorClass: "ProbeAbortedError", message });
+      resolve18({ ok: false, errorClass: "ProbeAbortedError", message });
     };
     config.signal?.addEventListener("abort", onSig, { once: true });
   });
@@ -34627,7 +34767,7 @@ function emitStageEvent(bus, executionId, result) {
 
 // src/pipeline/authoritative-decision-persistence.ts
 import { chmodSync, closeSync, mkdirSync as mkdirSync3, openSync, statSync as statSync3 } from "node:fs";
-import { join as join6, resolve as resolve6 } from "node:path";
+import { join as join6, resolve as resolve7 } from "node:path";
 import { z as z67 } from "zod";
 
 // src/pipeline/authoritative-decision-types.ts
@@ -34821,13 +34961,13 @@ function databasePath(config) {
     throw new Error("InvalidStorageDirectoryError: storageDir must be nonempty");
   }
   return join6(
-    config.storageDir === void 0 ? nexusDataPath("pipeline") : resolve6(config.storageDir),
+    config.storageDir === void 0 ? nexusDataPath("pipeline") : resolve7(config.storageDir),
     "decisions.db"
   );
 }
 function openDecisionDatabase(config) {
   const filePath = databasePath(config);
-  const storageDir = resolve6(filePath, "..");
+  const storageDir = resolve7(filePath, "..");
   mkdirSync3(storageDir, { recursive: true, mode: 448 });
   closeSync(openSync(filePath, "a", 384));
   chmodSync(filePath, 384);
@@ -35259,7 +35399,7 @@ function createDefaultPolicyEngine() {
 }
 
 // src/pipeline/task-contract-builders.ts
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 var sharedAnalyzer;
 function analyzeTask(task) {
   sharedAnalyzer ??= createSharedTaskAnalyzer();
@@ -35270,7 +35410,7 @@ function buildBaseTaskContract(input) {
   const report = detectCapabilityGaps(analysis.requiredCapabilities);
   const now = Date.now();
   return {
-    id: `${input.idPrefix}-${randomUUID9().slice(0, 8)}`,
+    id: `${input.idPrefix}-${randomUUID10().slice(0, 8)}`,
     description: input.task,
     status: "approved",
     analysis: input.analysis ?? {
@@ -35461,7 +35601,7 @@ async function executeOrchestratePipeline(task) {
 }
 
 // src/orchestration/orchestrator-factory.ts
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 
 // src/orchestration/orchestrator-adapters.ts
 function generateId2(prefix) {
@@ -35676,7 +35816,7 @@ var WorkflowOrchestratorAdapter = class {
   executions = /* @__PURE__ */ new Map();
   history = [];
   constructor(engine, logger62) {
-    this.id = `workflow-${randomUUID10().slice(0, 8)}`;
+    this.id = `workflow-${randomUUID11().slice(0, 8)}`;
     this.engine = engine;
     this.logger = logger62 ?? createLogger({ component: "WorkflowOrchestratorAdapter" });
   }
@@ -35689,7 +35829,7 @@ var WorkflowOrchestratorAdapter = class {
         )
       );
     }
-    const executionId = randomUUID10();
+    const executionId = randomUUID11();
     const startTime = getTimeProvider().now();
     this.setRunning(executionId);
     try {
@@ -36335,11 +36475,11 @@ function createMockOrchestrator() {
 async function raceAgainstDeadline(promise, deadlineMs, onTimeout) {
   const startedAt = Date.now();
   let timer;
-  const timeoutP = new Promise((resolve17, reject) => {
+  const timeoutP = new Promise((resolve18, reject) => {
     timer = setTimeout(
       () => {
         try {
-          resolve17(onTimeout(Date.now() - startedAt));
+          resolve18(onTimeout(Date.now() - startedAt));
         } catch (err2) {
           reject(err2 instanceof Error ? err2 : new Error(String(err2)));
         }
@@ -37526,11 +37666,11 @@ function createWorkerTask(entry, taskIndex, waveNumber, opts) {
     const staggerSlot = taskIndex % opts.maxConcurrency;
     const staggerMs = staggerSlot * opts.staggerDelayMs;
     if (staggerMs > 0) {
-      await new Promise((resolve17) => setTimeout(resolve17, staggerMs));
+      await new Promise((resolve18) => setTimeout(resolve18, staggerMs));
     }
     const spacingDelay = opts.failureTracker.getSpacingDelay(entry.role);
     if (spacingDelay > 0) {
-      await new Promise((resolve17) => setTimeout(resolve17, spacingDelay));
+      await new Promise((resolve18) => setTimeout(resolve18, spacingDelay));
     }
     const timeoutMs = opts.options.workerTimeoutMs ?? getExpertTaskTimeout(entry.subTask);
     const result = await executeSafe({
@@ -37583,7 +37723,7 @@ async function maybeDelayForRateLimit(results, waveIdx, totalWaves) {
   );
   if (hasRateLimit) {
     logger31.warn("Rate-limit detected \u2014 delaying next wave", { delayMs: RATE_LIMIT_WAVE_DELAY_MS });
-    await new Promise((resolve17) => setTimeout(resolve17, RATE_LIMIT_WAVE_DELAY_MS));
+    await new Promise((resolve18) => setTimeout(resolve18, RATE_LIMIT_WAVE_DELAY_MS));
   }
 }
 function emitWaveStarted(ctx, workerCount, roles) {
@@ -37690,7 +37830,7 @@ async function maybeRetryAfterTriage(opts) {
   }
   const useAltCli = triage.action === "retry_different_cli" && altExecuteWorker !== void 0;
   if (triage.action === "retry_different_cli") {
-    await new Promise((resolve17) => setTimeout(resolve17, RATE_LIMIT_SPACING_MS));
+    await new Promise((resolve18) => setTimeout(resolve18, RATE_LIMIT_SPACING_MS));
   }
   if (isCancelled2(opts.signal)) return { ...failedResult2, triageAction: triage.action };
   const retryTimeout = triage.action === "extend_timeout" ? Math.min(timeoutMs * TIMEOUT_EXTENSION_FACTOR, MAX_WORKER_TIMEOUT_MS) : timeoutMs;
@@ -44392,7 +44532,7 @@ function recordTriageOutcome(success, durationMs, errorMsg) {
 
 // src/mcp/tools/run-graph-workflow.ts
 import { z as z85 } from "zod";
-import { randomUUID as randomUUID11 } from "node:crypto";
+import { randomUUID as randomUUID12 } from "node:crypto";
 
 // src/mcp/tools/run-graph-workflow-events.ts
 function isHookEvent(event) {
@@ -44599,7 +44739,7 @@ function createGraphWorkflowHandler(logger62, notifier, auditLogger) {
       return runAsJob({
         toolName: "run_graph_workflow",
         input,
-        freshJobId: () => `gw-${randomUUID11()}`,
+        freshJobId: () => `gw-${randomUUID12()}`,
         // #5393: arity 4 — signal + #6162 progress. `runAsJob` derives
         // `signalAccepted` from `run.length`. The signal reaches `executeGraph`,
         // which gates every super-step on it; `progress` fires per graph event.
@@ -45192,7 +45332,7 @@ function suggestImprovement(criterion) {
 
 // src/mcp/tools/execute-spec-tool.ts
 import { z as z86 } from "zod";
-import { randomUUID as randomUUID12 } from "node:crypto";
+import { randomUUID as randomUUID13 } from "node:crypto";
 var ExecuteSpecInputSchema = z86.object({
   spec: z86.string().min(1).max(5e4).describe("Markdown specification to execute"),
   dryRun: z86.boolean().optional().default(false).describe("Parse and decompose only"),
@@ -45285,7 +45425,7 @@ function createExecuteSpecHandler(logger62) {
       return runAsJob({
         toolName: "execute_spec",
         input,
-        freshJobId: () => `es-${randomUUID12()}`,
+        freshJobId: () => `es-${randomUUID13()}`,
         // #5393 / #6305: arity 3 — `executeSpec` checks the signal at every step
         // boundary. #6162: heartbeats by jobId on every graph event.
         run: (jobId, _input, signal) => createFullResponse(input, logger62, {
@@ -47058,7 +47198,12 @@ function parseJsonlLines(content) {
   let skippedLines = 0;
   for (const line of content.trim().split("\n").filter(Boolean)) {
     try {
-      events.push(JSON.parse(line));
+      const parsed = JSON.parse(line);
+      if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        skippedLines++;
+        continue;
+      }
+      events.push(parsed);
     } catch {
       skippedLines++;
     }
@@ -47082,11 +47227,13 @@ function overSizeResponse(runId, sizeBytes) {
     errorMessage: `Trace for runId '${runId}' is ${String(sizeBytes)} bytes, over the ${String(MAX_TRACE_FILE_BYTES)}-byte read cap; no events were read`
   };
 }
-function readTraceResponse(input, read) {
+function readTraceResponse(input, read, reading) {
   const limit = input.limit ?? 100;
-  const parsed = input.eventType !== void 0 ? read.events.filter((e) => e["eventType"] === input.eventType) : read.events;
+  const events = reading.status === "measured" ? reading.entries.map((entry) => ({ ...entry })) : read.events.map(withoutCertifiedAttribution);
+  const parsed = input.eventType !== void 0 ? events.filter((e) => e["eventType"] === input.eventType) : events;
   return {
     runId: input.runId,
+    attribution: attributionReport(reading, input.eventType, limit),
     events: parsed.slice(0, limit),
     totalEvents: parsed.length,
     truncated: parsed.length > limit,
@@ -47098,6 +47245,34 @@ function readTraceResponse(input, read) {
     } : {}
   };
 }
+function withoutCertifiedAttribution(entry) {
+  const {
+    attributionVersion: _version,
+    captureRelation: _relation,
+    captureOrigin: _capture,
+    origin: _origin,
+    ...legacy
+  } = entry;
+  return legacy;
+}
+function attributionReport(reading, eventType, limit) {
+  if (reading.status === "unmeasured")
+    return {
+      ...reading,
+      writerObserved: null,
+      retained: null,
+      filtered: null,
+      returned: null
+    };
+  const filtered = eventType === void 0 ? reading.entries : reading.entries.filter((e) => e.eventType === eventType);
+  return {
+    status: "measured",
+    writerObserved: reading.snapshot.writerObserved,
+    retained: reading.snapshot.retained,
+    filtered: relationCounts(filtered),
+    returned: relationCounts(filtered.slice(0, limit))
+  };
+}
 async function queryTraceFromDisk(input, runsDir) {
   if (runsDir !== void 0) return readTraceFromDirectory(input, runsDir);
   const primary = await readTraceFromDirectory(input, getDefaultRunsDir());
@@ -47117,8 +47292,27 @@ async function readTraceFromDirectory(input, dir) {
     if (fileStat.size > MAX_TRACE_FILE_BYTES) {
       return overSizeResponse(input.runId, fileStat.size);
     }
-    const content = await readFile4(tracePath, "utf-8");
-    return readTraceResponse(input, parseJsonlLines(content));
+    const content = await readFile4(tracePath);
+    const decoded = decodeTraceBytes(content);
+    if (decoded === null) {
+      return {
+        ...readTraceResponse(
+          input,
+          { events: [], skippedLines: 0 },
+          {
+            status: "unmeasured",
+            reason: "invalid_encoding"
+          }
+        ),
+        errorCategory: "parse_error",
+        errorMessage: "Trace is not valid UTF-8; no events were read"
+      };
+    }
+    return readTraceResponse(
+      input,
+      parseJsonlLines(decoded),
+      readTraceSnapshot(tracePath, dir, content, input.runId)
+    );
   } catch (err2) {
     const category = classifyTraceError(err2);
     const message = userFacingTraceError(err2, input.runId);
@@ -47161,7 +47355,7 @@ function registerQueryTraceTool(server, deps) {
     eventType: z101.string().max(100).regex(/^[a-zA-Z0-9._-]+$/).optional().describe("Filter by event type (e.g., model.called)"),
     limit: z101.number().min(1).max(500).optional().describe("Max events to return (default: 100)")
   };
-  const description = "Query execution traces by run ID. Returns agent and model attribution for pipeline runs including decision paths, error taxonomy, and timing data.";
+  const description = "Query execution traces by run ID. Returns agent and model attribution for pipeline runs including decision paths, error taxonomy, timing and snapshot-bound attribution counts. run_related is logical session participation only: reused/concurrent invocations are indistinguishable; no attempt, worker or settlement proof.";
   const secureHandler = createSecureHandler(queryTraceHandler, {
     toolName: "query_trace",
     rateLimiter: deps.rateLimiter,
@@ -48116,12 +48310,12 @@ var FileAuditStorage = class _FileAuditStorage {
     const data = this.writeBuffer.join("");
     this.writeBuffer = [];
     const stream = this.writeStream;
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       stream.write(data, (err2) => {
         if (err2 !== void 0 && err2 !== null) {
           reject(new AuditError("Failed to flush audit log", { cause: err2 }));
         } else {
-          resolve17();
+          resolve18();
         }
       });
     });
@@ -48182,15 +48376,15 @@ var FileAuditStorage = class _FileAuditStorage {
   }
   async close() {
     await this.flush();
-    return new Promise((resolve17) => {
+    return new Promise((resolve18) => {
       if (this.writeStream === null) {
-        resolve17();
+        resolve18();
         return;
       }
       this.writeStream.end(() => {
         this.writeStream = null;
         this.logger.info("Audit storage closed");
-        resolve17();
+        resolve18();
       });
     });
   }
@@ -49140,7 +49334,7 @@ function computePrReviewRecordHash(payload) {
 
 // src/audit/pr-review-record-store.ts
 import { appendFileSync as appendFileSync3, existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync7 } from "node:fs";
-import { dirname as dirname3, isAbsolute as isAbsolute4, join as join12, resolve as resolve8 } from "node:path";
+import { dirname as dirname3, isAbsolute as isAbsolute4, join as join12, resolve as resolve9 } from "node:path";
 var PR_REVIEW_RECORDS_REL_PATH = "governance/pr-review-records.jsonl";
 var PR_REVIEW_RECORDS_PATH_ENV = "NEXUS_PR_REVIEW_RECORDS_PATH";
 var MAX_SUMMARY_RECORD_CHARS = 500;
@@ -49178,7 +49372,7 @@ function buildPrReviewRecord(input) {
 function resolvePrReviewRecordsPath(repoPathOverride) {
   const envPath = process.env[PR_REVIEW_RECORDS_PATH_ENV];
   if (envPath !== void 0 && envPath.trim() !== "") {
-    return isAbsolute4(envPath) ? envPath : resolve8(envPath);
+    return isAbsolute4(envPath) ? envPath : resolve9(envPath);
   }
   if (repoPathOverride !== void 0 && repoPathOverride.trim() !== "") {
     const overrideRoot = findRepoRoot(repoPathOverride);
@@ -49829,7 +50023,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-OKLIMR7X.js");
+    const { createIssueTriage } = await import("./issue-triage-WJQZC3WH.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num2 = issueMatch[2] ?? "";
@@ -49857,7 +50051,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-OW4PM4ZT.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-VRMBEB25.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -50226,7 +50420,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-MNPLBGXT.js");
+    const { executeVoting } = await import("./consensus-vote-AFHPZ643.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -50550,8 +50744,8 @@ function hermeticGitEnv(base = process.env) {
 }
 
 // src/cli/vote-scratch-checkout.ts
-import { randomUUID as randomUUID13 } from "node:crypto";
-import { basename as basename3, join as join14, resolve as resolve9 } from "node:path";
+import { randomUUID as randomUUID14 } from "node:crypto";
+import { basename as basename3, join as join14, resolve as resolve10 } from "node:path";
 var GIT_TIMEOUT_MS = 3e4;
 var SHA_PREFIX_LENGTH = 12;
 var ScratchCheckoutError = class extends NexusError {
@@ -50659,9 +50853,9 @@ function createScratchCheckout(options) {
       toError(error)
     );
   }
-  const path9 = resolve9(
+  const path9 = resolve10(
     options.tmpRoot ?? getNexusTmpDir(),
-    `vote-${sha.slice(0, SHA_PREFIX_LENGTH)}-${randomUUID13()}`
+    `vote-${sha.slice(0, SHA_PREFIX_LENGTH)}-${randomUUID14()}`
   );
   const paths = scratchPaths(options, path9);
   let gitMetadataUnchanged;
@@ -50735,7 +50929,7 @@ function execFileTree(command, args, options) {
     return Promise.reject(new AbortError(`${command} aborted before it started`));
   }
   const graceMs = options.graceMs ?? SIGKILL_GRACE_MS;
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve18, reject) => {
     const run = {
       settled: false,
       child: void 0
@@ -50763,7 +50957,7 @@ function execFileTree(command, args, options) {
     signal?.addEventListener("abort", onAbort, { once: true });
     run.child = spawnTracked(command, args, options, (error, stdout, stderr) => {
       finish(() => {
-        if (error === null) resolve17({ stdout, stderr });
+        if (error === null) resolve18({ stdout, stderr });
         else reject(Object.assign(error, { stdout, stderr }));
       });
     });
@@ -50954,7 +51148,7 @@ async function createScratchSandbox(scratch, source) {
 // src/pipeline/pipeline-scratch-root.ts
 import { existsSync as existsSync12, realpathSync as realpathSync5 } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute6, relative as relative4, resolve as resolve10, sep as sep4 } from "node:path";
+import { isAbsolute as isAbsolute6, relative as relative4, resolve as resolve11, sep as sep4 } from "node:path";
 function contains(parent, child) {
   const path9 = relative4(parent, child);
   return path9 === "" || path9 !== ".." && !path9.startsWith(`..${sep4}`) && !isAbsolute6(path9);
@@ -50963,7 +51157,7 @@ function overlaps(a, b) {
   return contains(a, b) || contains(b, a);
 }
 function pipelineScratchRoot(protectedPaths) {
-  const canonical = (path9) => existsSync12(path9) ? realpathSync5(path9) : resolve10(path9);
+  const canonical = (path9) => existsSync12(path9) ? realpathSync5(path9) : resolve11(path9);
   const occupied = protectedPaths.map(canonical);
   const preferred = canonical(getNexusTmpDir());
   if (!occupied.some((path9) => overlaps(preferred, path9))) return preferred;
@@ -52070,7 +52264,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-WPVNRUJX.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-AGLSO5V6.js");
     const { getLearningDir } = await import("./learning-persistence-NW5AE222.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -52132,7 +52326,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-A6HRDTWW.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-PFBPOTQO.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -52702,7 +52896,7 @@ async function prepareCompletePlanVote(plan, research, config, signal) {
   return { proposal, roleAdapters: panel.seats };
 }
 async function executePlanVote(plan, research, config, strategy, signal) {
-  const { executeVoting } = await import("./consensus-vote-MNPLBGXT.js");
+  const { executeVoting } = await import("./consensus-vote-AFHPZ643.js");
   const { proposal, roleAdapters } = await prepareCompletePlanVote(plan, research, config, signal);
   const votingResult = await executeVoting(
     {
@@ -53258,7 +53452,7 @@ function resolveConfidence(rule) {
 // src/mcp/tools/security-scan.ts
 import { access, constants as constants2 } from "node:fs/promises";
 import { readFile as readFile5, realpath as realpath2, writeFile as writeFile2 } from "node:fs/promises";
-import { delimiter as delimiter2, isAbsolute as isAbsolute8, join as join17, parse as parse5, resolve as resolve11 } from "node:path";
+import { delimiter as delimiter2, isAbsolute as isAbsolute8, join as join17, parse as parse5, resolve as resolve12 } from "node:path";
 var logger50 = createLogger({ component: "security-scan" });
 var SCAN_TIMEOUT_MS = 3e5;
 async function probeSemgrepVersion(signal, env, wrapper, binary = "semgrep", cwd) {
@@ -53285,7 +53479,7 @@ async function probeSemgrepVersion(signal, env, wrapper, binary = "semgrep", cwd
 function probeExecutableCandidates(binary, env, cwd) {
   const root = cwd ?? process.cwd();
   const searchPath = (env ?? process.env)["PATH"];
-  return isAbsolute8(binary) || /[/\\]/.test(binary) ? [resolve11(root, binary)] : process.platform === "win32" ? void 0 : searchPath?.split(delimiter2).map((directory) => resolve11(root, directory, binary));
+  return isAbsolute8(binary) || /[/\\]/.test(binary) ? [resolve12(root, binary)] : process.platform === "win32" ? void 0 : searchPath?.split(delimiter2).map((directory) => resolve12(root, directory, binary));
 }
 async function isSemgrepExecutableMissing(binary, env, cwd) {
   const candidates = probeExecutableCandidates(binary, env, cwd);
@@ -53304,7 +53498,7 @@ async function runSemgrep(targetDir, rulesets, signal, env, options) {
   const prepared = options.preparedScan;
   const flags = prepared?.flags ?? (options.completeResults === true ? COMPLETE_SCAN_FLAGS : []);
   const configs = prepared?.rulesets ?? rulesets.map(
-    (ruleset) => /^(?:[pr]\/|https?:\/\/|auto$)/.test(ruleset) ? ruleset : resolve11(ruleset)
+    (ruleset) => /^(?:[pr]\/|https?:\/\/|auto$)/.test(ruleset) ? ruleset : resolve12(ruleset)
   );
   const args = [
     "--sarif",
@@ -53380,7 +53574,7 @@ async function resolveSemgrep(env) {
 }
 async function readRuleset(ruleset, signal) {
   const url = /^[pr]\//.test(ruleset) ? `https://semgrep.dev/c/${ruleset}` : ruleset;
-  if (!/^https?:\/\//.test(url)) return await readFile5(resolve11(ruleset), "utf8");
+  if (!/^https?:\/\//.test(url)) return await readFile5(resolve12(ruleset), "utf8");
   const timeout = AbortSignal.timeout(3e4);
   const response = await fetch(url, {
     headers: { Accept: "application/json" },
@@ -53430,7 +53624,7 @@ async function prepareSecurityScan(rulesets, options) {
       options.env,
       options.wrapper,
       binary,
-      parse5(resolve11(options.directory)).root
+      parse5(resolve12(options.directory)).root
     );
     if (typeof version !== "string") throw new Error(version.error);
     const configs = [];
@@ -53556,7 +53750,7 @@ function isScannerNoise(line) {
 }
 
 // src/pipeline/dependency-gate.ts
-import { join as join18, resolve as resolve12 } from "node:path";
+import { join as join18, resolve as resolve13 } from "node:path";
 import { existsSync as existsSync14, lstatSync as lstatSync2, readFileSync as readFileSync11 } from "node:fs";
 import { z as z112 } from "zod";
 
@@ -53735,12 +53929,12 @@ function lookupFailure(label) {
   };
 }
 function dependencyManifestScope(targetDir, captureRoot, changed) {
-  const workingDirManifest = resolve12(targetDir, "package.json");
+  const workingDirManifest = resolve13(targetDir, "package.json");
   const scope = /* @__PURE__ */ new Map([
     [workingDirManifest, { path: workingDirManifest, label: workingDirManifest, required: false }]
   ]);
   for (const manifest of changed) {
-    const path9 = resolve12(captureRoot, manifest);
+    const path9 = resolve13(captureRoot, manifest);
     scope.set(path9, { path: path9, label: manifest, required: true });
   }
   return [...scope.values()];
@@ -54513,7 +54707,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-DROJA42L.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-EM6ZPAZ2.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -54531,7 +54725,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-WPVNRUJX.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-AGLSO5V6.js");
     const { getLearningDir } = await import("./learning-persistence-NW5AE222.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -55290,7 +55484,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-3PT4X3BX.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-Q5EU3I3D.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -55409,7 +55603,7 @@ function createScanStageWrapper() {
       try {
         const repo = await selectAuditRepository(ctx.task);
         if (!repo.ok) return failOutput(PIPELINE_STATE_KEYS.FINDINGS, repo.error, getTimeProvider().now() - start);
-        const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-O6V5DZXV.js");
+        const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-5VPJP4HN.js");
         const plan = await generateSecurityPlan2({ repo: repo.value, maxScanners: 10 });
         const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
         return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -55462,7 +55656,7 @@ function createAuditStageRegistry() {
 
 // src/mcp/tools/pr-review-tool.ts
 import { z as z113 } from "zod";
-import { randomUUID as randomUUID14 } from "node:crypto";
+import { randomUUID as randomUUID15 } from "node:crypto";
 
 // src/mcp/tools/pr-review-record-producer.ts
 function bytes(n) {
@@ -55769,7 +55963,7 @@ function resolveAggregate(reviews, input, absent, coverage, logger62) {
 function rollUpDecisionCost(voteResults, logger62, jobId) {
   try {
     return recordDecisionCost({
-      decisionId: `pr-${randomUUID14().slice(0, 8)}`,
+      decisionId: `pr-${randomUUID15().slice(0, 8)}`,
       gate: "pr_review",
       ...jobId !== void 0 ? { jobId } : {},
       votes: voteResults
@@ -55857,7 +56051,7 @@ function makePrReviewHandler(gatewayAdapters) {
         return runAsJob({
           toolName: "pr_review",
           input,
-          freshJobId: () => `pr-${randomUUID14()}`,
+          freshJobId: () => `pr-${randomUUID15()}`,
           // #6750: on a cancel the body throws VoteCancelledError; the seats it
           // had collected are attached to the `cancelled` record, with no verdict.
           // #5393: arity 4 — signal + #6162 progress (heartbeat per settled
@@ -57445,9 +57639,9 @@ var RESEARCH_BUDGET_MS = 2e4;
 var RESEARCH_TIMED_OUT = /* @__PURE__ */ Symbol("research-budget-exceeded");
 async function withResearchBudget(p, ms) {
   let timer;
-  const budget = new Promise((resolve17) => {
+  const budget = new Promise((resolve18) => {
     timer = setTimeout(() => {
-      resolve17(RESEARCH_TIMED_OUT);
+      resolve18(RESEARCH_TIMED_OUT);
     }, ms);
   });
   try {
@@ -57549,7 +57743,7 @@ function registerSuggestResearchTasksTool(server, deps) {
 
 // src/mcp/tools/run-tool.ts
 import { z as z127 } from "zod";
-import { randomUUID as randomUUID19 } from "node:crypto";
+import { randomUUID as randomUUID20 } from "node:crypto";
 
 // src/orchestration/consensus-enforcement-mode.ts
 function resolveConsensusEnforcementMode(raw) {
@@ -57559,7 +57753,7 @@ function resolveConsensusEnforcementMode(raw) {
 }
 
 // src/mcp/tools/run-tool-consensus.ts
-import { randomUUID as randomUUID15 } from "node:crypto";
+import { randomUUID as randomUUID16 } from "node:crypto";
 function getConsensusEnforcement(result) {
   if (typeof result !== "object" || result === null) return void 0;
   return result.enforcement;
@@ -57635,7 +57829,7 @@ async function runConsensusWithEnforcement(goal, options) {
   const retryable = /* @__PURE__ */ new Set(["no_quorum", "not_outage_invariant"]);
   if (options.mode === "enforce" && retryable.has(result.enforcement.reason)) {
     recordVoteDecisionCost({
-      decisionId: `consensus-${randomUUID15()}`,
+      decisionId: `consensus-${randomUUID16()}`,
       gate: "consensus_vote",
       votes: result.votes,
       proposal: goal,
@@ -57994,7 +58188,7 @@ function assertExecutePolicy(strategy, input, logger62, requestContext) {
 }
 
 // src/orchestration/meta-orchestrator.ts
-import { randomUUID as randomUUID16 } from "node:crypto";
+import { randomUUID as randomUUID17 } from "node:crypto";
 
 // src/orchestration/meta-orchestrator-routing.ts
 function reasoningFor(selection, routing) {
@@ -58146,7 +58340,7 @@ function createMetaOrchestrator(options) {
       const classification = classifyTask(input.goal);
       const forced = input.forceStrategy !== void 0;
       const base = input.forceStrategy !== void 0 ? buildForcedDecision(input.forceStrategy, routing, classification) : buildSelectedDecision(routing, classification);
-      const decision = { ...base, decisionId: randomUUID16() };
+      const decision = { ...base, decisionId: randomUUID17() };
       if (input.requiredAuthority !== void 0) {
         guardAuthority(decision.strategy, input.requiredAuthority);
       }
@@ -58666,7 +58860,7 @@ function evaluateMetaStrategyReadiness(result, config = DEFAULT_META_STRATEGY_RE
 // src/mcp/tools/dev-pipeline-tool.ts
 import { z as z125 } from "zod";
 import * as fs10 from "node:fs";
-import { randomUUID as randomUUID17 } from "node:crypto";
+import { randomUUID as randomUUID18 } from "node:crypto";
 
 // src/mcp/tools/dev-pipeline-output.ts
 function buildStructuredOutput(result, simulated) {
@@ -58737,7 +58931,7 @@ function planVoteVerdictFields(result) {
 }
 
 // src/mcp/tools/dev-pipeline-tool.ts
-import { resolve as resolve15 } from "node:path";
+import { resolve as resolve16 } from "node:path";
 
 // src/mcp/tools/dev-pipeline-options.ts
 function buildPipelineOptions(input, trustTier, auditLogger) {
@@ -58782,7 +58976,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-6YIROBGX.js");
+    const { createScmProvider } = await import("./factory-B5KLEQKU.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -59028,7 +59222,7 @@ function containWorkingDir(workingDir) {
   const roots = [process.cwd()];
   const workspaceRoot = getActiveWorkspaceRoot();
   if (workspaceRoot !== void 0) roots.push(workspaceRoot);
-  const absolute = resolve15(workingDir);
+  const absolute = resolve16(workingDir);
   for (const root of roots) {
     const contained = resolveInsideRoot(absolute, root);
     if (contained !== null) return contained;
@@ -59198,7 +59392,7 @@ function dispatchAsyncDevPipeline(input, run, logger62) {
     return runAsJob({
       toolName: "run_dev_pipeline",
       input,
-      freshJobId: () => `dp-${randomUUID17()}`,
+      freshJobId: () => `dp-${randomUUID18()}`,
       // #5393 / #6305: arity 3 — `runDevPipeline` checks the signal before every stage.
       run: (_jobId, _input, signal) => run(signal),
       logger: logger62
@@ -59256,7 +59450,7 @@ function registerDevPipelineTool(server, deps) {
 // src/mcp/tools/pipeline-tool.ts
 import { z as z126 } from "zod";
 import * as fs11 from "node:fs";
-import { randomUUID as randomUUID18 } from "node:crypto";
+import { randomUUID as randomUUID19 } from "node:crypto";
 var PIPELINE_ASYNC_HINT = "A full run_pipeline run can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
 var PipelineInputSchema = z126.object({
   /** The task to execute. */
@@ -59466,7 +59660,7 @@ async function runPipelineHandler(args, logger62, callerTrustTier, sanitization)
       return runAsJob({
         toolName: "run_pipeline",
         input,
-        freshJobId: () => `rp-${randomUUID18()}`,
+        freshJobId: () => `rp-${randomUUID19()}`,
         // #5393 / #6305: arity 3 — the graph executor checks the signal before every
         // super-step, so a cancel stops the run at the next stage boundary.
         run: (_jobId, _input, signal) => executePipelineBody(task, stages, { ...body, signal }),
@@ -59786,7 +59980,7 @@ async function runHandler(args, logger62, trustTier, gatewayAdapters, requestCon
       return runAsJob({
         toolName: "run",
         input,
-        freshJobId: () => `rn-${randomUUID19()}`,
+        freshJobId: () => `rn-${randomUUID20()}`,
         // #5393 / #6305: arity 3 — every wired strategy executor hands the
         // signal to its engine. #6162: heartbeats by jobId.
         run: (jobId, _input, signal) => executeRunBodyOrThrow(input, logger62, {
@@ -59901,7 +60095,7 @@ function withCatalogueCaveat(report) {
 var GATEWAY_TRANSPORT = "gateway";
 var GATEWAY_API_ARM = "api:custom-openai";
 async function gatewaySource(apiArm) {
-  const { discoverModels, readOpenAICompatEnv } = await import("./openai-compat-adapter-V76U3PUN.js");
+  const { discoverModels, readOpenAICompatEnv } = await import("./openai-compat-adapter-3H3JSNGP.js");
   const config = readOpenAICompatEnv();
   if (config !== null) {
     return {
@@ -59920,7 +60114,7 @@ async function gatewaySource(apiArm) {
 }
 async function defaultSources(includeOpenRouter, adaptersFactory) {
   const adapters = new Map(
-    adaptersFactory !== void 0 ? adaptersFactory() : (await import("./factory-JJIJMMSM.js")).createAllAdapters()
+    adaptersFactory !== void 0 ? adaptersFactory() : (await import("./factory-KFLVCHVV.js")).createAllAdapters()
   );
   const apiArm = adapters.get(GATEWAY_API_ARM);
   adapters.delete(GATEWAY_API_ARM);
@@ -60051,7 +60245,7 @@ var VoterEvalVerdictQuerySchema = z129.object({
 
 // src/mcp/tools/supply-chain-tradeoff-panel.ts
 import { z as z130 } from "zod";
-import { randomUUID as randomUUID20 } from "node:crypto";
+import { randomUUID as randomUUID21 } from "node:crypto";
 var DEFAULT_AXES = [
   "build_time_determinism",
   "supply_chain_risk",
@@ -60322,7 +60516,7 @@ async function tradeoffPanelHandler(args, ctx) {
       return runAsJob({
         toolName: "supply_chain_tradeoff_panel",
         input,
-        freshJobId: () => `sc-${randomUUID20()}`,
+        freshJobId: () => `sc-${randomUUID21()}`,
         // #5393: arity 4 — signal + #6162 progress. `runAsJob` derives
         // `signalAccepted` from `run.length`. The signal reaches `collectRealVotes`,
         // so a cancel stops the un-launched seats; `progress` heartbeats per seat.
@@ -62219,7 +62413,7 @@ function getPolicy(id) {
 // src/security/sandbox/sandbox-executor.ts
 import { execFile as execFile2 } from "node:child_process";
 import { promisify } from "node:util";
-import { resolve as resolve16 } from "node:path";
+import { resolve as resolve17 } from "node:path";
 var execFileAsync = promisify(execFile2);
 var logger59 = createLogger({ component: "sandbox-executor" });
 function parseExecError(error) {
@@ -62311,7 +62505,7 @@ var PolicySandboxExecutor = class {
    * following symlinks, else `null`. No rules means no allowed directory.
    */
   resolveAllowedCwd(cwd, policy) {
-    const absolute = resolve16(cwd);
+    const absolute = resolve17(cwd);
     for (const rule of policy.pathRules) {
       if (rule.access === "none") continue;
       const contained = resolveInsideRoot(absolute, rule.path);
@@ -63192,4 +63386,4 @@ export {
   initializeSandbox,
   getSandboxMode
 };
-//# sourceMappingURL=chunk-WMEV4263.js.map
+//# sourceMappingURL=chunk-32F2JIQ7.js.map