nexus-agents 14.0.3 → 14.0.4

package/dist/{chunk-KX33QPIJ.js → chunk-TK723ERO.js}

@@ -62,7 +62,7 @@ import {
   updateStage,
   withFileLock,
   writeJobCancelled
-} from "./chunk-KVLHGDAF.js";
+} from "./chunk-KSF67NHM.js";
 import {
   allOf,
   anyOf
@@ -85,7 +85,7 @@ import {
 } from "./chunk-RYDTFPVI.js";
 import {
   withPrerequisite
-} from "./chunk-PNAYEZVT.js";
+} from "./chunk-JDFDGY5A.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -118,7 +118,7 @@ import {
   toolSuccess,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-7TYSIQYE.js";
+} from "./chunk-63L435QC.js";
 import {
   generateSecurityPlan
 } from "./chunk-KMGKOF5P.js";
@@ -28403,10 +28403,10 @@ function calculateDifferenceCI(p1, p2, total1, total2, confidence) {
   const difference = p1 - p2;
   const measured = total1 > 0 && total2 > 0;
   const seDiff = Math.sqrt(p1 * (1 - p1) / (total1 || 1) + p2 * (1 - p2) / (total2 || 1));
-  const z134 = getZScore(confidence);
+  const z135 = getZScore(confidence);
   return {
-    lower: difference - z134 * seDiff,
-    upper: difference + z134 * seDiff,
+    lower: difference - z135 * seDiff,
+    upper: difference + z135 * seDiff,
     estimate: difference,
     confidence,
     n: total1 + total2,
@@ -28434,11 +28434,11 @@ function proportionConfidenceInterval(successes, total, options = {}) {
       measured: false
     };
   }
-  const z134 = getZScore(opts.confidence);
-  const z210 = z134 * z134;
+  const z135 = getZScore(opts.confidence);
+  const z210 = z135 * z135;
   const denominator = 1 + z210 / n;
   const center = (p + z210 / (2 * n)) / denominator;
-  const margin = z134 / denominator * Math.sqrt(p * (1 - p) / n + z210 / (4 * n * n));
+  const margin = z135 / denominator * Math.sqrt(p * (1 - p) / n + z210 / (4 * n * n));
   const lower = Math.max(0, center - margin);
   const upper = Math.min(1, center + margin);
   const standardError = Math.sqrt(p * (1 - p) / n);
@@ -28476,8 +28476,8 @@ function meanConfidenceInterval(values, options = {}) {
   const variance = values.reduce((sum, v) => sum + (v - mean) ** 2, 0) / (n - 1 || 1);
   const stdDev = Math.sqrt(variance);
   const standardError = stdDev / Math.sqrt(n);
-  const z134 = getZScore(opts.confidence);
-  const margin = z134 * standardError;
+  const z135 = getZScore(opts.confidence);
+  const margin = z135 * standardError;
   return {
     lower: mean - margin,
     upper: mean + margin,
@@ -50459,7 +50459,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-M3V3WSW4.js");
+    const { executeVoting } = await import("./consensus-vote-XRRZGJGJ.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -52935,7 +52935,7 @@ async function prepareCompletePlanVote(plan, research, config, signal) {
   return { proposal, roleAdapters: panel.seats };
 }
 async function executePlanVote(plan, research, config, strategy, signal) {
-  const { executeVoting } = await import("./consensus-vote-M3V3WSW4.js");
+  const { executeVoting } = await import("./consensus-vote-XRRZGJGJ.js");
   const { proposal, roleAdapters } = await prepareCompletePlanVote(plan, research, config, signal);
   const votingResult = await executeVoting(
     {
@@ -55694,10 +55694,27 @@ function createAuditStageRegistry() {
 }
 
 // src/mcp/tools/pr-review-tool.ts
-import { z as z113 } from "zod";
+import { z as z114 } from "zod";
 import { randomUUID as randomUUID15 } from "node:crypto";
 
 // src/mcp/tools/pr-review-record-producer.ts
+import { z as z113 } from "zod";
+var LocalDiffReductionSchema = z113.object({
+  prefixCodeUnits: z113.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  totalCodeUnits: z113.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  prefixUtf8Bytes: z113.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  totalUtf8Bytes: z113.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  marker: z113.string().min(1).max(64)
+}).strict();
+function localReductionStamp(args) {
+  if (args.localDiffReduction === void 0) return "";
+  const r = LocalDiffReductionSchema.parse(args.localDiffReduction);
+  const diff = args.input.prDiff;
+  if (args.diffSource !== "canonical-git" || args.sanitization !== void 0 || args.coverage !== void 0 || r.prefixCodeUnits >= r.totalCodeUnits || r.totalCodeUnits !== diff.length || r.totalUtf8Bytes !== Buffer.byteLength(diff) || r.prefixUtf8Bytes !== Buffer.byteLength(diff.slice(0, r.prefixCodeUnits))) {
+    throw new Error("Invalid local pre-builder diff reduction measurements");
+  }
+  return ` [local pre-builder diff prefix ${String(r.prefixCodeUnits)}/${String(r.totalCodeUnits)} JS code units; UTF-8 ${String(r.prefixUtf8Bytes)}/${String(r.totalUtf8Bytes)} bytes; marker +${String(r.marker.length)} JS code units/+${String(Buffer.byteLength(r.marker))} bytes; additional inspection UNMEASURED]`;
+}
 function bytes(n) {
   return n.toLocaleString("en-US");
 }
@@ -55772,7 +55789,7 @@ function writeFailedOutcome() {
 function buildAndPersist(prNumber, baseSha, args) {
   const { input, aggregate, counts, reviewCount, logger: logger62, coverage, diffSource, sanitization } = args;
   const reviewedDiffHash = sanitization?.rawDiffHash ?? computeReviewedDiffHash(input.prDiff);
-  const stamps = coverageStamps(coverage);
+  const stamps = localReductionStamp(args) + coverageStamps(coverage);
   const coverageFields = coverageFieldsOf(coverage);
   const disclosure = sanitizationDisclosureOf(sanitization, input.prDiff);
   warnIfDiffTruncated(resolveBindingMeasurement(input.prDiff, sanitization), prNumber, logger62);
@@ -55884,19 +55901,19 @@ var MAX_REPO_CONTEXT_LENGTH = 2e3;
 var MAX_TITLE_LENGTH = 500;
 var MAX_DESCRIPTION_LENGTH = 1e4;
 var PR_REVIEW_ASYNC_HINT = "A pr_review run fans out to 5 live LLM voters and can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
-var PrReviewInputSchema = z113.object({
-  prTitle: z113.string().min(1).max(MAX_TITLE_LENGTH).describe("PR title"),
-  prDescription: z113.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
-  prDiff: z113.string().min(1).max(MAX_DIFF_INPUT_LENGTH).refine(looksLikeUnifiedDiff, {
+var PrReviewInputSchema = z114.object({
+  prTitle: z114.string().min(1).max(MAX_TITLE_LENGTH).describe("PR title"),
+  prDescription: z114.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
+  prDiff: z114.string().min(1).max(MAX_DIFF_INPUT_LENGTH).refine(looksLikeUnifiedDiff, {
     message: "prDiff must be a unified diff (expected a `diff --git`, `---`/`+++`, or `@@ \u2026 @@` line). Prose descriptions of a change are rejected: a review of a summary is not a review of the code, and would be recorded as though it were (#4451)."
   }).describe(
     `Unified diff text (max ${String(MAX_DIFF_INPUT_LENGTH)} chars). REQUIRED SHAPE (#4451): must contain a \`diff --git\` header, an \`@@ \u2026 @@\` hunk header backed by +/- lines, or a \`---\`/\`+++\` header pair \u2014 a prose summary of the change is REJECTED, because reviewing a summary is not reviewing the code and would be recorded as though it were. (Stated here because Zod refinements do not survive JSON-schema generation, so this constraint is otherwise invisible to clients.) No need to truncate before calling: the panel reads the whole diff whenever it fits the voters' context windows (#6003); a diff larger than that is security-prioritized and PARTIALLY reviewed (lowest-priority whole files dropped; a partial panel read can block but never verified-approve). Separately, the audit record's hash binds only the first ${String(MAX_DIFF_LENGTH)} UTF-8 bytes; the response \`coverage\` and the record summary state both what the panel read and what the hash binds.`
   ),
-  repoContext: z113.string().max(MAX_REPO_CONTEXT_LENGTH).optional().describe(
+  repoContext: z114.string().max(MAX_REPO_CONTEXT_LENGTH).optional().describe(
     `Optional one-paragraph repo context (architecture, conventions; max ${String(MAX_REPO_CONTEXT_LENGTH)} chars; trim before calling)`
   ),
-  baseRef: z113.string().max(200).optional().describe("Base branch ref (e.g. main)"),
-  headRef: z113.string().max(200).optional().describe("Head branch ref"),
+  baseRef: z114.string().max(200).optional().describe("Base branch ref (e.g. main)"),
+  headRef: z114.string().max(200).optional().describe("Head branch ref"),
   /**
    * Option-C audit binding (#4031). When BOTH `prNumber` and `baseSha` are
    * supplied AND the review is live (not simulated), pr_review persists an
@@ -55912,14 +55929,14 @@ var PrReviewInputSchema = z113.object({
    * the PR opened and drifts as main advances), so pass the merge-base as
    * `baseSha` or the record will not match on an aged branch (#5692).
    */
-  prNumber: z113.number().int().positive().max(1e6).optional().describe("PR number \u2014 with baseSha, enables Option-C audit-record persistence (#4031)"),
-  baseSha: z113.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha").optional().describe(
+  prNumber: z114.number().int().positive().max(1e6).optional().describe("PR number \u2014 with baseSha, enables Option-C audit-record persistence (#4031)"),
+  baseSha: z114.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha").optional().describe(
     "40-hex base commit sha the reviewed diff was computed from \u2014 pass `git merge-base origin/<base> <head>`, the base the gate recomputes (Option-C binding, #4031, #5692)"
   ),
-  repoPath: z113.string().max(1024).optional().describe(
+  repoPath: z114.string().max(1024).optional().describe(
     "Repo root path for persisting the governance pr-review record (overrides cwd auto-detection). Must contain a .git ancestor \u2014 relative paths are resolved against cwd; ignored (falls back to cwd auto-detection) if it is not a real repo root. Env NEXUS_PR_REVIEW_RECORDS_PATH still takes precedence and is unrestricted."
   ),
-  simulate: z113.boolean().default(false).describe("Use simulated voters (testing only; never ship live with this true)"),
+  simulate: z114.boolean().default(false).describe("Use simulated voters (testing only; never ship live with this true)"),
   /**
    * Error policy (#4132). `standard` (default) excludes absent voters but
    * requires a majority of the requested panel to approve. `absolute_quorum` gates
@@ -55931,7 +55948,7 @@ var PrReviewInputSchema = z113.object({
    * verified approve. A genuine `request_changes` blocker still wins (Tiers 1-2
    * run first).
    */
-  errorPolicy: z113.enum(["standard", "absolute_quorum"]).default("standard").describe(
+  errorPolicy: z114.enum(["standard", "absolute_quorum"]).default("standard").describe(
     "Error policy (#4132). 'standard' (default): absent voters excluded; approval requires a majority of the requested panel. 'absolute_quorum': any errored voter \u2014 esp. the contrarian \u2014 degrades a would-be approve to a recoverable abstain (verified:false); never manufactures a verified approve from an induced error."
   ),
   // #6123: same field as consensus_vote — the panel judges the caller's project.
@@ -56287,27 +56304,27 @@ function absoluteQuorumApprove(reviews, valid) {
 }
 
 // src/mcp/tools/survey-oss-landscape.ts
-import { z as z114 } from "zod";
-var SurveyOssLandscapeInputSchema = z114.object({
-  query: z114.string().min(1).max(200).describe('Free-text search query, e.g. "cargo nextest replacement" or "OSS SBOM tools"'),
-  maxResults: z114.number().int().min(1).max(50).optional().default(10).describe("Maximum candidates to return (1-50; default 10)"),
-  minStars: z114.number().int().min(0).max(1e6).optional().default(0).describe("Minimum star count to include (default 0; useful for filtering noise)"),
-  language: z114.string().max(50).optional().describe('GitHub language filter, e.g. "rust" or "typescript"')
-});
-var GitHubRepoSchema = z114.object({
-  full_name: z114.string().optional(),
-  html_url: z114.string().optional(),
-  description: z114.string().nullable().optional(),
-  stargazers_count: z114.number().optional(),
-  pushed_at: z114.string().nullable().optional(),
-  language: z114.string().nullable().optional(),
-  license: z114.object({
-    spdx_id: z114.string().nullable().optional()
+import { z as z115 } from "zod";
+var SurveyOssLandscapeInputSchema = z115.object({
+  query: z115.string().min(1).max(200).describe('Free-text search query, e.g. "cargo nextest replacement" or "OSS SBOM tools"'),
+  maxResults: z115.number().int().min(1).max(50).optional().default(10).describe("Maximum candidates to return (1-50; default 10)"),
+  minStars: z115.number().int().min(0).max(1e6).optional().default(0).describe("Minimum star count to include (default 0; useful for filtering noise)"),
+  language: z115.string().max(50).optional().describe('GitHub language filter, e.g. "rust" or "typescript"')
+});
+var GitHubRepoSchema = z115.object({
+  full_name: z115.string().optional(),
+  html_url: z115.string().optional(),
+  description: z115.string().nullable().optional(),
+  stargazers_count: z115.number().optional(),
+  pushed_at: z115.string().nullable().optional(),
+  language: z115.string().nullable().optional(),
+  license: z115.object({
+    spdx_id: z115.string().nullable().optional()
   }).nullable().optional()
 });
-var GitHubSearchResponseSchema = z114.object({
-  total_count: z114.number().optional(),
-  items: z114.array(GitHubRepoSchema).optional()
+var GitHubSearchResponseSchema = z115.object({
+  total_count: z115.number().optional(),
+  items: z115.array(GitHubRepoSchema).optional()
 });
 var GITHUB_SEARCH_BASE = "https://api.github.com/search/repositories";
 function buildGithubQuery(input) {
@@ -56429,16 +56446,16 @@ function createSurveyHandler(deps) {
     });
     return withToolError("Survey failed", logger62, async () => {
       const result = await executeSurvey(validation.data, logger62);
-      return structuredToolSuccess(z114.object(SURVEY_OUTPUT_SCHEMA), result);
+      return structuredToolSuccess(z115.object(SURVEY_OUTPUT_SCHEMA), result);
     });
   };
 }
 var SURVEY_OUTPUT_SCHEMA = {
-  query: z114.string(),
-  totalFound: z114.number(),
-  candidates: z114.array(z114.unknown()),
-  sourcesQueried: z114.array(z114.string()),
-  sourcesFailed: z114.array(z114.string())
+  query: z115.string(),
+  totalFound: z115.number(),
+  candidates: z115.array(z115.unknown()),
+  sourcesQueried: z115.array(z115.string()),
+  sourcesFailed: z115.array(z115.string())
 };
 var SURVEY_DESCRIPTION = 'Transient OSS project search. Returns a ranked list of GitHub repositories with license, last-commit, star-count, and one-line description. Does NOT persist to the research registry \u2014 use `research_add_source` for that. Best for one-off engineering decisions like "what tools exist in this space?".';
 function registerSurveyOssLandscapeTool(server, deps) {
@@ -56469,7 +56486,7 @@ function registerSurveyOssLandscapeTool(server, deps) {
 }
 
 // src/mcp/tools/vendor-publishing-audit.ts
-import { z as z115 } from "zod";
+import { z as z116 } from "zod";
 
 // src/mcp/tools/vendor-publishing-seed.ts
 var VENDOR_PUBLISHING_SEED = {
@@ -56542,8 +56559,8 @@ function listKnownVendors() {
 }
 
 // src/mcp/tools/vendor-publishing-audit.ts
-var VendorPublishingAuditInputSchema = z115.object({
-  vendor: z115.string().min(1).max(50).toLowerCase().describe('Vendor identifier, lowercase. e.g. "ubuntu", "debian", "fedora"')
+var VendorPublishingAuditInputSchema = z116.object({
+  vendor: z116.string().min(1).max(50).toLowerCase().describe('Vendor identifier, lowercase. e.g. "ubuntu", "debian", "fedora"')
 });
 function lookupVendor(vendor) {
   if (isKnownVendor(vendor)) {
@@ -56571,26 +56588,26 @@ function createVendorPublishingAuditHandler(deps) {
     return withToolError("Vendor publishing audit failed", logger62, () => {
       const result = lookupVendor(validation.data.vendor);
       return Promise.resolve(
-        structuredToolSuccess(z115.object(VENDOR_PUBLISHING_OUTPUT_SCHEMA), result)
+        structuredToolSuccess(z116.object(VENDOR_PUBLISHING_OUTPUT_SCHEMA), result)
       );
     });
   };
 }
 var VENDOR_PUBLISHING_OUTPUT_SCHEMA = {
-  vendor: z115.string(),
-  known: z115.boolean(),
+  vendor: z116.string(),
+  known: z116.boolean(),
   // Fields below populate when known=true; permissive optional for known=false.
-  sha256SumsUrlPattern: z115.string().optional(),
-  sha256SumsSignatureUrlPattern: z115.string().optional(),
-  signaturePattern: z115.string().optional(),
-  gpgKeys: z115.array(z115.unknown()).optional(),
-  releaseCadence: z115.string().optional(),
-  keyRotationNotes: z115.string().optional(),
-  vendorDocUrl: z115.string().optional(),
-  citedAt: z115.string().optional(),
+  sha256SumsUrlPattern: z116.string().optional(),
+  sha256SumsSignatureUrlPattern: z116.string().optional(),
+  signaturePattern: z116.string().optional(),
+  gpgKeys: z116.array(z116.unknown()).optional(),
+  releaseCadence: z116.string().optional(),
+  keyRotationNotes: z116.string().optional(),
+  vendorDocUrl: z116.string().optional(),
+  citedAt: z116.string().optional(),
   // Fields below populate when known=false.
-  message: z115.string().optional(),
-  knownVendors: z115.array(z115.string()).optional()
+  message: z116.string().optional(),
+  knownVendors: z116.array(z116.string()).optional()
 };
 var VENDOR_PUBLISHING_DESCRIPTION = "Look up a vendor's published-artifact signing infrastructure: GPG key fingerprints, SHA256SUMS URL pattern, signature shape (clearsigned / detached / detached-on-iso), release cadence, key rotation notes, and the vendor doc citation. Static lookup against a curated seed dataset; the vendor doc URL is the authoritative source. Returns `{known: false, knownVendors: [...]}` for vendors without a seed entry. v1 covers ubuntu, debian, fedora.";
 function registerVendorPublishingAuditTool(server, deps) {
@@ -56620,17 +56637,17 @@ function registerVendorPublishingAuditTool(server, deps) {
 }
 
 // src/mcp/tools/compare-data-feeds.ts
-import { z as z116 } from "zod";
+import { z as z117 } from "zod";
 import * as path6 from "node:path";
 import * as fs7 from "node:fs";
 import * as yaml4 from "yaml";
-var CompareDataFeedsInputSchema = z116.object({
-  feedAPath: z116.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
-  feedBPath: z116.string().min(1).max(1e3).describe("Filesystem path to feed B"),
-  keyPath: z116.string().min(1).max(200).describe(
+var CompareDataFeedsInputSchema = z117.object({
+  feedAPath: z117.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
+  feedBPath: z117.string().min(1).max(1e3).describe("Filesystem path to feed B"),
+  keyPath: z117.string().min(1).max(200).describe(
     'Dotted path to the entry key, e.g. "id" or "name". Each entry must have this field.'
   ),
-  compareFields: z116.array(z116.string().min(1).max(200)).max(20).optional().describe(
+  compareFields: z117.array(z117.string().min(1).max(200)).max(20).optional().describe(
     'Optional dotted field paths to compare across matched entries (e.g. ["license", "sha256"])'
   )
 });
@@ -56808,29 +56825,29 @@ function createCompareDataFeedsHandler(deps) {
     });
     return withToolError("Compare data feeds failed", logger62, () => {
       const result = executeCompare(validation.data);
-      return Promise.resolve(structuredToolSuccess(z116.object(COMPARE_OUTPUT_SCHEMA), result));
+      return Promise.resolve(structuredToolSuccess(z117.object(COMPARE_OUTPUT_SCHEMA), result));
     });
   };
 }
 var COMPARE_OUTPUT_SCHEMA = {
-  feedAPath: z116.string(),
-  feedBPath: z116.string(),
-  keyPath: z116.string(),
-  counts: z116.object({
-    entriesInA: z116.number(),
-    entriesInB: z116.number(),
-    onlyInA: z116.number(),
-    onlyInB: z116.number(),
-    inBoth: z116.number(),
-    fieldDifferences: z116.number()
+  feedAPath: z117.string(),
+  feedBPath: z117.string(),
+  keyPath: z117.string(),
+  counts: z117.object({
+    entriesInA: z117.number(),
+    entriesInB: z117.number(),
+    onlyInA: z117.number(),
+    onlyInB: z117.number(),
+    inBoth: z117.number(),
+    fieldDifferences: z117.number()
   }),
-  coverage: z116.object({
-    onlyInA: z116.array(z116.string()),
-    onlyInB: z116.array(z116.string()),
-    inBoth: z116.array(z116.string())
+  coverage: z117.object({
+    onlyInA: z117.array(z117.string()),
+    onlyInB: z117.array(z117.string()),
+    inBoth: z117.array(z117.string())
   }),
-  fieldDifferences: z116.array(z116.unknown()),
-  summary: z116.string()
+  fieldDifferences: z117.array(z117.unknown()),
+  summary: z117.string()
 };
 var COMPARE_DESCRIPTION = "Diff two upstream data feeds (YAML or JSON files) along coverage and per-field axes. Returns which entries exist in A, B, both, plus optional field-level diffs across matched entries. v1 takes file paths only (no URL fetch \u2014 that needs an SSRF design pass). Both feeds must be a top-level array OR a top-level object with exactly one array field.";
 function registerCompareDataFeedsTool(server, deps) {
@@ -56861,9 +56878,9 @@ function registerCompareDataFeedsTool(server, deps) {
 }
 
 // src/mcp/tools/query-task-state-tool.ts
-import { z as z117 } from "zod";
-var QueryTaskStateInputSchema = z117.object({
-  taskId: z117.string().min(1).max(128).describe("Task ID whose structured state log should be read")
+import { z as z118 } from "zod";
+var QueryTaskStateInputSchema = z118.object({
+  taskId: z118.string().min(1).max(128).describe("Task ID whose structured state log should be read")
 });
 function queryTaskStateHandler(args, ctx) {
   const parsed = QueryTaskStateInputSchema.safeParse(args);
@@ -56898,7 +56915,7 @@ function queryTaskStateHandler(args, ctx) {
 function registerQueryTaskStateTool(server, deps) {
   const logger62 = deps.logger ?? createLogger({ tool: "query_task_state" });
   const toolSchema = {
-    taskId: z117.string().min(1).max(128).describe("Task ID whose structured state log should be read")
+    taskId: z118.string().min(1).max(128).describe("Task ID whose structured state log should be read")
   };
   const description = "Read the structured state log for a task ID and return the current snapshot. Includes Magentic-One Task Ledger (facts/guesses/openQuestions) and Progress Ledger (per-step reflections with suggestedAction) when orchestrators have written them. Structured state is only written when NEXUS_TASK_STATE_ENABLED=1 was set during the orchestrate invocation.";
   const secureHandler = createSecureHandler(queryTaskStateHandler, {
@@ -56920,28 +56937,28 @@ function registerQueryTaskStateTool(server, deps) {
 }
 
 // src/mcp/tools/ci-health-check-tool.ts
-import { z as z120 } from "zod";
+import { z as z121 } from "zod";
 
 // src/mcp/tools/ci-health-log.ts
 import { appendFileSync as appendFileSync5, existsSync as existsSync17, readFileSync as readFileSync14, statSync as statSync5, writeFileSync as writeFileSync3 } from "node:fs";
-import { z as z119 } from "zod";
+import { z as z120 } from "zod";
 
 // src/mcp/tools/ci-health-types.ts
-import { z as z118 } from "zod";
-var CiHealthStatusSchema = z118.enum(["healthy", "degraded", "outage", "unknown"]);
+import { z as z119 } from "zod";
+var CiHealthStatusSchema = z119.enum(["healthy", "degraded", "outage", "unknown"]);
 
 // src/mcp/tools/ci-health-log.ts
 var logger56 = createLogger({ component: "ci-health-log" });
-var CiHealthEventSchema = z119.object({
-  v: z119.literal(1),
-  ts: z119.iso.datetime(),
+var CiHealthEventSchema = z120.object({
+  v: z120.literal(1),
+  ts: z120.iso.datetime(),
   status: CiHealthStatusSchema,
-  repo: z119.string().optional(),
-  signals: z119.array(
-    z119.object({
-      source: z119.enum(["github-status", "repo-activity-window"]),
+  repo: z120.string().optional(),
+  signals: z120.array(
+    z120.object({
+      source: z120.enum(["github-status", "repo-activity-window"]),
       status: CiHealthStatusSchema,
-      evidence: z119.string()
+      evidence: z120.string()
     })
   )
 });
@@ -57021,17 +57038,17 @@ function eventFromCheck(params) {
 }
 
 // src/mcp/tools/ci-health-check-tool.ts
-var CiHealthCheckInputSchema = z120.object({
+var CiHealthCheckInputSchema = z121.object({
   /**
    * Repo to check for the recent-runs activity signal (in `owner/repo` form).
    * Optional — when omitted, only the status-page signal is consulted.
    */
-  repo: z120.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
+  repo: z121.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
   /**
    * How far back to look for recent-runs activity (minutes). Default 30 —
    * matches the typical wedge-detection window from the #3070 / #3076 outages.
    */
-  activityWindowMinutes: z120.number().int().min(5).max(180).default(30).describe("Recent-runs lookback window in minutes (5-180; default 30).")
+  activityWindowMinutes: z121.number().int().min(5).max(180).default(30).describe("Recent-runs lookback window in minutes (5-180; default 30).")
 });
 var STATUS_PAGE_URL = "https://www.githubstatus.com/api/v2/components.json";
 function mapStatusPageStatus(raw) {
@@ -57190,8 +57207,8 @@ var DESCRIPTION = "Check CI infrastructure health before triggering / polling ru
 function registerCiHealthCheckTool(server, deps) {
   const logger62 = deps.logger ?? createLogger({ tool: "ci_health_check" });
   const toolSchema = {
-    repo: z120.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
-    activityWindowMinutes: z120.number().int().min(5).max(180).optional().describe("Recent-runs lookback window in minutes (5-180; default 30).")
+    repo: z121.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
+    activityWindowMinutes: z121.number().int().min(5).max(180).optional().describe("Recent-runs lookback window in minutes (5-180; default 30).")
   };
   const secureHandler = createSecureHandler((args) => ciHealthCheckHandler(args, logger62), {
     toolName: "ci_health_check",
@@ -57218,18 +57235,18 @@ function registerCiHealthCheckTool(server, deps) {
 
 // src/mcp/tools/quality-gate-tool.ts
 import { statSync as statSync6 } from "node:fs";
-import { z as z121 } from "zod";
-var QualityCheckSchema = z121.enum(["typecheck", "lint", "tests", "build", "security"]);
+import { z as z122 } from "zod";
+var QualityCheckSchema = z122.enum(["typecheck", "lint", "tests", "build", "security"]);
 var DEFAULT_CHECKS = ["typecheck", "lint", "tests"];
-var RunQualityGateInputSchema = z121.object({
+var RunQualityGateInputSchema = z122.object({
   /** Project directory to run checks against. Must resolve inside the repo/cwd root. */
-  projectDir: z121.string().max(500).optional().describe(
+  projectDir: z122.string().max(500).optional().describe(
     "Project directory to run checks against (default: cwd). Must stay inside the repo root."
   ),
   /** Which allowlisted checks to run. */
-  checks: z121.array(QualityCheckSchema).nonempty().default([...DEFAULT_CHECKS]).describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
+  checks: z122.array(QualityCheckSchema).nonempty().default([...DEFAULT_CHECKS]).describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
   /** 1-based iteration counter, forwarded to the engine for feedback context. */
-  iteration: z121.number().int().min(1).max(100).default(1).describe("1-based iteration number (default 1).")
+  iteration: z122.number().int().min(1).max(100).default(1).describe("1-based iteration number (default 1).")
 });
 function validateProjectDir(raw) {
   const candidate = raw ?? process.cwd();
@@ -57304,11 +57321,11 @@ var DESCRIPTION2 = "Run the QA quality gate (#1684 engine) against a project dir
 function registerRunQualityGateTool(server, deps) {
   const logger62 = deps.logger ?? createLogger({ tool: "run_quality_gate" });
   const toolSchema = {
-    projectDir: z121.string().max(500).optional().describe(
+    projectDir: z122.string().max(500).optional().describe(
       "Project directory to run checks against (default: cwd). Must stay inside the repo root."
     ),
-    checks: z121.array(QualityCheckSchema).nonempty().optional().describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
-    iteration: z121.number().int().min(1).max(100).optional().describe("1-based iteration number (default 1).")
+    checks: z122.array(QualityCheckSchema).nonempty().optional().describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
+    iteration: z122.number().int().min(1).max(100).optional().describe("1-based iteration number (default 1).")
   };
   const secureHandler = createSecureHandler(
     (args) => runQualityGateHandler(args, logger62),
@@ -57338,7 +57355,7 @@ function registerRunQualityGateTool(server, deps) {
 // src/mcp/tools/verify-audit-chain-tool.ts
 import * as fs8 from "node:fs/promises";
 import * as path7 from "node:path";
-import { z as z122 } from "zod";
+import { z as z123 } from "zod";
 
 // src/cli-server-auth.ts
 function resolveAuthEnabled(config) {
@@ -57512,11 +57529,11 @@ function logSecurityConfig(logger62, config) {
 }
 
 // src/mcp/tools/verify-audit-chain-tool.ts
-var VerifyAuditChainInputSchema = z122.object({
-  logDir: z122.string().min(1).max(512).describe(
+var VerifyAuditChainInputSchema = z123.object({
+  logDir: z123.string().min(1).max(512).describe(
     "Filesystem path to the FileAuditStorage log directory. Must lie inside the nexus data dir, a repo-local `.nexus-agents/`, or the configured `security.audit.logDir`. Tool reads all `audit-*.jsonl` files in lexicographic order and verifies the combined chain."
   ),
-  filePrefix: z122.string().min(1).max(64).optional().default(DEFAULT_AUDIT_FILE_PREFIX).describe(
+  filePrefix: z123.string().min(1).max(64).optional().default(DEFAULT_AUDIT_FILE_PREFIX).describe(
     'Filename prefix for audit log files (defaults to "audit"). Files matching `${filePrefix}-*.jsonl` will be verified.'
   )
 });
@@ -57645,10 +57662,10 @@ async function handler2(args, ctx, security) {
 function registerVerifyAuditChainTool(server, deps) {
   const logger62 = deps.logger ?? createLogger({ tool: "verify_audit_chain" });
   const toolSchema = {
-    logDir: z122.string().min(1).max(512).describe(
+    logDir: z123.string().min(1).max(512).describe(
       "Filesystem path to the FileAuditStorage log directory. Must lie inside the nexus data dir, a repo-local `.nexus-agents/`, or the configured `security.audit.logDir`. Tool reads all `audit-*.jsonl` files and verifies the combined hash chain."
     ),
-    filePrefix: z122.string().min(1).max(64).optional().describe(
+    filePrefix: z123.string().min(1).max(64).optional().describe(
       'Filename prefix for audit log files (defaults to "audit"). Files matching `${filePrefix}-*.jsonl` will be verified.'
     )
   };
@@ -57672,7 +57689,7 @@ function registerVerifyAuditChainTool(server, deps) {
 }
 
 // src/mcp/tools/suggest-research-tasks-tool.ts
-import { z as z123 } from "zod";
+import { z as z124 } from "zod";
 var SUGGEST_RESEARCH_TASKS_NOTE = "Suggestions derived from external research (untrusted); review before acting \u2014 nothing was executed or filed.";
 var RESEARCH_BUDGET_MS = 2e4;
 var RESEARCH_TIMED_OUT = /* @__PURE__ */ Symbol("research-budget-exceeded");
@@ -57689,11 +57706,11 @@ async function withResearchBudget(p, ms) {
     if (timer !== void 0) clearTimeout(timer);
   }
 }
-var SuggestResearchTasksInputSchema = z123.object({
-  topic: z123.string().optional().describe("Topic filter passed to research_discover. Optional."),
-  qualityThreshold: z123.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
-  maxTriggers: z123.number().int().min(1).max(50).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
-  existingTaskIds: z123.array(z123.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
+var SuggestResearchTasksInputSchema = z124.object({
+  topic: z124.string().optional().describe("Topic filter passed to research_discover. Optional."),
+  qualityThreshold: z124.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
+  maxTriggers: z124.number().int().min(1).max(50).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
+  existingTaskIds: z124.array(z124.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
 });
 function toTriggerConfig(input) {
   return {
@@ -57750,10 +57767,10 @@ var DESCRIPTION3 = "SUGGEST-ONLY: surface candidate pipeline tasks for human/orc
 function registerSuggestResearchTasksTool(server, deps) {
   const logger62 = deps.logger ?? createLogger({ tool: "suggest_research_tasks" });
   const toolSchema = {
-    topic: z123.string().optional().describe("Topic filter passed to research_discover. Optional."),
-    qualityThreshold: z123.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
-    maxTriggers: z123.number().int().min(1).max(50).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
-    existingTaskIds: z123.array(z123.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
+    topic: z124.string().optional().describe("Topic filter passed to research_discover. Optional."),
+    qualityThreshold: z124.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
+    maxTriggers: z124.number().int().min(1).max(50).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
+    existingTaskIds: z124.array(z124.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
   };
   const secureHandler = createSecureHandler(
     (args) => suggestResearchTasksHandler(args, logger62),
@@ -57781,7 +57798,7 @@ function registerSuggestResearchTasksTool(server, deps) {
 }
 
 // src/mcp/tools/run-tool.ts
-import { z as z127 } from "zod";
+import { z as z128 } from "zod";
 import { randomUUID as randomUUID20 } from "node:crypto";
 
 // src/orchestration/consensus-enforcement-mode.ts
@@ -58403,7 +58420,7 @@ function createMetaOrchestrator(options) {
 
 // src/orchestration/meta-shadow-selector.ts
 import { appendFileSync as appendFileSync6, existsSync as existsSync18, readFileSync as readFileSync15 } from "node:fs";
-import { z as z124 } from "zod";
+import { z as z125 } from "zod";
 var SHADOW_STRATEGY_ARMS = [
   "single-shot",
   "dev-pipeline",
@@ -58492,19 +58509,19 @@ function createHydratableSelector() {
 var META_OUTCOME_SCHEMA_VERSION = 1;
 var HYDRATE_LOOKBACK_DAYS = 30;
 var HYDRATE_LOOKBACK_MS = HYDRATE_LOOKBACK_DAYS * 24 * 60 * 60 * 1e3;
-var PersistedContextSchema = z124.object({
-  taskComplexity: z124.number(),
-  contextLengthNormalized: z124.number(),
-  isCodeTask: z124.number(),
-  isReasoningTask: z124.number(),
-  budgetUtilization: z124.number(),
-  timePressure: z124.number()
-});
-var PersistedMetaOutcomeSchema = z124.object({
-  schema: z124.literal(META_OUTCOME_SCHEMA_VERSION),
-  timestamp: z124.string(),
-  strategy: z124.enum(SHADOW_STRATEGY_ARMS),
-  success: z124.boolean(),
+var PersistedContextSchema = z125.object({
+  taskComplexity: z125.number(),
+  contextLengthNormalized: z125.number(),
+  isCodeTask: z125.number(),
+  isReasoningTask: z125.number(),
+  budgetUtilization: z125.number(),
+  timePressure: z125.number()
+});
+var PersistedMetaOutcomeSchema = z125.object({
+  schema: z125.literal(META_OUTCOME_SCHEMA_VERSION),
+  timestamp: z125.string(),
+  strategy: z125.enum(SHADOW_STRATEGY_ARMS),
+  success: z125.boolean(),
   context: PersistedContextSchema
 });
 var persistLogger = createLogger({ component: "MetaShadowSelector" });
@@ -58897,7 +58914,7 @@ function evaluateMetaStrategyReadiness(result, config = DEFAULT_META_STRATEGY_RE
 }
 
 // src/mcp/tools/dev-pipeline-tool.ts
-import { z as z125 } from "zod";
+import { z as z126 } from "zod";
 import * as fs10 from "node:fs";
 import { randomUUID as randomUUID18 } from "node:crypto";
 
@@ -59163,42 +59180,42 @@ var DEV_PIPELINE_DRY_RUN_NOTE = "This was a dry run (plan+vote), which always ru
 function dispatchNoteFor(dryRun) {
   return dryRun ? DEV_PIPELINE_DRY_RUN_NOTE : DEV_PIPELINE_ASYNC_HINT;
 }
-var DevPipelineInputSchema = z125.object({
+var DevPipelineInputSchema = z126.object({
   /** Direct task instructions. */
-  task: z125.string().max(1e4).optional().describe("Direct task instructions (what to build)"),
+  task: z126.string().max(1e4).optional().describe("Direct task instructions (what to build)"),
   /** Declared provenance of the task text (#6795); omitted means '3'. */
   sourceTrustTier: TaskSourceTrustTierSchema,
   /** Path to a plan file (.md, .yaml, .txt) to use as input. */
-  planFile: z125.string().max(500).optional().describe("Path to a plan/spec file to use as input"),
+  planFile: z126.string().max(500).optional().describe("Path to a plan/spec file to use as input"),
   /** Whether to run in dry-run mode (plan+vote only, no implementation). */
-  dryRun: z125.boolean().default(false).describe("If true, stop after plan+vote (no implementation)"),
+  dryRun: z126.boolean().default(false).describe("If true, stop after plan+vote (no implementation)"),
   /** Maximum vote iterations before proceeding (default: 3). */
-  maxVoteIterations: z125.number().int().min(1).max(5).default(3).describe("Max plan\u2192vote iterations"),
+  maxVoteIterations: z126.number().int().min(1).max(5).default(3).describe("Max plan\u2192vote iterations"),
   /** Maximum QA iterations per task (default: 3). */
-  maxQaIterations: z125.number().int().min(1).max(5).default(3).describe("Max QA review iterations per task"),
+  maxQaIterations: z126.number().int().min(1).max(5).default(3).describe("Max QA review iterations per task"),
   /** Working directory for the pipeline (default: cwd). Used for security scan and context. */
-  workingDir: z125.string().max(500).optional().describe("Working directory (default: cwd)"),
+  workingDir: z126.string().max(500).optional().describe("Working directory (default: cwd)"),
   /** GitHub issue number to track progress on. Updates posted as comments. */
-  issueNumber: z125.number().int().positive().optional().describe("GitHub issue to post progress to"),
+  issueNumber: z126.number().int().positive().optional().describe("GitHub issue to post progress to"),
   /** GitHub repo (owner/name) for issue tracking. */
-  repo: z125.string().max(200).optional().describe("GitHub repo for issue tracking (e.g., owner/repo)"),
+  repo: z126.string().max(200).optional().describe("GitHub repo for issue tracking (e.g., owner/repo)"),
   /** Task tracking backend: github, gitlab, or json (default: json). */
-  trackerBackend: z125.enum(["github", "gitlab", "json"]).default("json").describe("Task tracking backend for issue creation"),
+  trackerBackend: z126.enum(["github", "gitlab", "json"]).default("json").describe("Task tracking backend for issue creation"),
   /** Labels to apply to created issues. */
-  labels: z125.array(z125.string()).optional().describe("Labels for created issues"),
+  labels: z126.array(z126.string()).optional().describe("Labels for created issues"),
   /** Session ID for checkpoint/resume. Enables crash recovery. */
-  sessionId: z125.string().max(128).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Session ID for checkpoint/resume (crash recovery)"),
+  sessionId: z126.string().max(128).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Session ID for checkpoint/resume (crash recovery)"),
   /**
    * TESTS ONLY — when true, voters return random decisions. Must not be used as
    * a fallback when adapters are unavailable; configure an adapter instead. (#2319)
    */
-  simulateVotes: z125.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)"),
+  simulateVotes: z126.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)"),
   /** Voting strategy for consensus stages. */
   votingStrategy: VotingStrategySchema.optional().describe(
     "Voting strategy for plan approval (default: higher_order)"
   ),
   /** Start with the canonical quick panel; approvals may trigger a full-panel re-vote. */
-  quickMode: z125.boolean().default(false).describe(
+  quickMode: z126.boolean().default(false).describe(
     "Start with 3 voters (architect, security, scope_steward) instead of 7. An approved quick vote may escalate to the full 7-role panel when the Bayesian posterior is borderline or a separate contrarian check rejects with high confidence, matching CLI --quick"
   ),
   /**
@@ -59206,7 +59223,7 @@ var DevPipelineInputSchema = z125.object({
    * budget for the whole run (#6736). Replaces every stage's default, the
    * vote's included; clamped to the `pipeline` class guard.
    */
-  timeoutMs: z125.number().int().min(3e4).max(6e5).optional().describe(
+  timeoutMs: z126.number().int().min(3e4).max(6e5).optional().describe(
     "Max time for EACH stage call in ms (30000-600000), not for the whole run; applies to every stage, the vote included, and to each plan/vote and implement/QA iteration. A stage past it fails with a timeout and its model calls are aborted. Default: the vote stage gets the multi-LLM panel guard (900000 unless overridden), other stages the pipeline guard (1800000 unless overridden)"
   ),
   /**
@@ -59214,7 +59231,7 @@ var DevPipelineInputSchema = z125.object({
    * dispatch. A caller who learned `mode: 'async'` elsewhere gets an error
    * naming `dispatch` rather than the bare enum message (#4968).
    */
-  mode: z125.enum(["autonomous", "harness"], { error: modeEnumErrorNamingDispatch }).default("autonomous").describe(
+  mode: z126.enum(["autonomous", "harness"], { error: modeEnumErrorNamingDispatch }).default("autonomous").describe(
     "'autonomous': full pipeline. 'harness': stops after decompose, returns tasks for caller to implement. (Not the async switch \u2014 that is `dispatch`.)"
   ),
   /**
@@ -59228,11 +59245,11 @@ var DevPipelineInputSchema = z125.object({
    */
   dispatch: dispatchFieldDefaultSync("Ignored for dryRun."),
   /** Local pre-ship quality gate (typecheck/lint/tests) mode (#3356). */
-  qualityGate: z125.enum(["off", "advisory", "blocking"]).default("off").describe(
+  qualityGate: z126.enum(["off", "advisory", "blocking"]).default("off").describe(
     "Pre-ship local quality gate. 'off' (default): skip. 'advisory': run + record feedback, never fail. 'blocking': a red gate fails the pipeline."
   ),
   /** Opt-in per-run token budget — a safety cap for unattended runs (#3395). */
-  maxBudgetTokens: z125.number().int().positive().optional().describe(
+  maxBudgetTokens: z126.number().int().positive().optional().describe(
     "Per-run token ceiling (#3395). When set, expert calls stop (returning failures) once cumulative usage crosses it \u2014 a hard-stop safety cap for unattended/multi-day runs. Omit to disable (default)."
   )
 });
@@ -59321,7 +59338,7 @@ async function executeDevPipelineBody(taskText, stages, pipelineOptions, simulat
     });
     return { ...error, content: [{ type: "text", text: describeFailureText(result) }] };
   }
-  return structuredToolSuccess(z125.record(z125.string(), z125.unknown()), output2);
+  return structuredToolSuccess(z126.record(z126.string(), z126.unknown()), output2);
 }
 function describeIncompleteRun(result) {
   if (result.planStatus !== void 0) {
@@ -59487,33 +59504,33 @@ function registerDevPipelineTool(server, deps) {
 }
 
 // src/mcp/tools/pipeline-tool.ts
-import { z as z126 } from "zod";
+import { z as z127 } from "zod";
 import * as fs11 from "node:fs";
 import { randomUUID as randomUUID19 } from "node:crypto";
 var PIPELINE_ASYNC_HINT = "A full run_pipeline run can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
-var PipelineInputSchema = z126.object({
+var PipelineInputSchema = z127.object({
   /** The task to execute. */
-  task: z126.string().min(5).max(1e4).describe("Task description \u2014 pipeline template auto-selected based on content"),
+  task: z127.string().min(5).max(1e4).describe("Task description \u2014 pipeline template auto-selected based on content"),
   /** Path to a spec file (.md, .yaml) to use as task input. */
-  specFile: z126.string().max(500).optional().describe("Path to a spec file \u2014 content prepended to task for greenfield projects"),
+  specFile: z127.string().max(500).optional().describe("Path to a spec file \u2014 content prepended to task for greenfield projects"),
   /** Override template — see `listTemplateIds()` for the canonical list (#2728). Auto-detected if omitted. */
-  template: z126.string().max(50).optional().describe(`Pipeline template override. Available: ${listTemplateIds().join(", ")}`),
+  template: z127.string().max(50).optional().describe(`Pipeline template override. Available: ${listTemplateIds().join(", ")}`),
   /** Voting strategy for consensus stages. */
   votingStrategy: VotingStrategySchema.optional().describe(
     "Voting strategy for plan approval. simple_majority (default), supermajority (67%), unanimous, higher_order (Bayesian), opinion_wise"
   ),
   /** Use 3 agents instead of 7 for faster voting. */
-  quickMode: z126.boolean().default(false).describe("Use 3 agents instead of 7 for faster consensus voting"),
+  quickMode: z127.boolean().default(false).describe("Use 3 agents instead of 7 for faster consensus voting"),
   /**
    * Deadline for EACH stage in milliseconds (min 30s, max 600s), not a budget
    * for the whole run (#6730). Replaces every stage's default, the vote's
    * included; clamped to the `pipeline` class guard.
    */
-  timeoutMs: z126.number().int().min(3e4).max(6e5).optional().describe(
+  timeoutMs: z127.number().int().min(3e4).max(6e5).optional().describe(
     "Max time for EACH stage in ms (30000-600000), not for the whole run; applies to every stage, the vote included. Default: the vote stage gets the multi-LLM panel guard (900000 unless overridden), other stages 120000"
   ),
   /** Stop after planning/voting (no implementation). */
-  dryRun: z126.boolean().default(false).describe("Stop after vote stage (no implementation)"),
+  dryRun: z127.boolean().default(false).describe("Stop after vote stage (no implementation)"),
   /**
    * Dispatch mode (#3730). `sync` (default) runs the pipeline inline and
    * returns the result — but a real multi-stage adaptive run can exceed the
@@ -59524,7 +59541,7 @@ var PipelineInputSchema = z126.object({
    */
   ...asyncDispatchInputDefaultSync("Ignored for dryRun."),
   /** TESTS ONLY — random output, must not be used for real decisions. (#2319) */
-  simulateVotes: z126.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
+  simulateVotes: z127.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
 });
 function buildOutput3(result, simulated) {
   return {
@@ -59550,14 +59567,14 @@ function buildOutput3(result, simulated) {
     rateLimitHint: result.error?.toLowerCase().includes("rate limit") === true ? "Consider using quickMode or increasing delay between pipeline runs" : void 0
   };
 }
-var VoteEvidenceSchema = z126.object({
-  approvalPercentage: z126.number(),
-  voteRecordId: z126.string().optional()
+var VoteEvidenceSchema = z127.object({
+  approvalPercentage: z127.number(),
+  voteRecordId: z127.string().optional()
 });
-var VoteResultSchema = z126.discriminatedUnion("kind", [
-  VoteEvidenceSchema.extend({ kind: z126.literal("approved") }),
-  VoteEvidenceSchema.extend({ kind: z126.literal("rejected"), feedback: z126.string() }),
-  VoteEvidenceSchema.extend({ kind: z126.literal("no_quorum"), reason: z126.string() })
+var VoteResultSchema = z127.discriminatedUnion("kind", [
+  VoteEvidenceSchema.extend({ kind: z127.literal("approved") }),
+  VoteEvidenceSchema.extend({ kind: z127.literal("rejected"), feedback: z127.string() }),
+  VoteEvidenceSchema.extend({ kind: z127.literal("no_quorum"), reason: z127.string() })
 ]);
 function isVoteResult(value) {
   return VoteResultSchema.safeParse(value).success;
@@ -59659,7 +59676,7 @@ async function executePipelineBody(task, stages, run) {
       detail: output2
     });
   }
-  return structuredToolSuccess(z126.record(z126.string(), z126.unknown()), output2);
+  return structuredToolSuccess(z127.record(z127.string(), z127.unknown()), output2);
 }
 function createPipelineAgentStages(input, config) {
   return createAgentStages({
@@ -59809,9 +59826,9 @@ function cancellableExecutor(strategy, executor, signal) {
 }
 
 // src/mcp/tools/run-tool.ts
-var RunInputSchema = z127.object({
-  goal: z127.string().min(1).describe("Natural-language goal. nexus-agents selects how to execute it."),
-  forceStrategy: z127.enum([
+var RunInputSchema = z128.object({
+  goal: z128.string().min(1).describe("Natural-language goal. nexus-agents selects how to execute it."),
+  forceStrategy: z128.enum([
     "single-shot",
     "dev-pipeline",
     "pipeline",
@@ -59823,10 +59840,10 @@ var RunInputSchema = z127.object({
   ]).optional().describe(
     "Power-user override: force a specific strategy instead of letting the router choose."
   ),
-  requiresConsensus: z127.boolean().optional().describe("Hint: the task needs a multi-perspective consensus decision."),
-  dependencyStructure: z127.enum(["linear", "dag", "independent", "unknown"]).optional().describe("Hint: the dependency structure of the work."),
-  isNovel: z127.boolean().optional().describe("Hint: this kind of task has not been seen before."),
-  execute: z127.boolean().optional().describe(
+  requiresConsensus: z128.boolean().optional().describe("Hint: the task needs a multi-perspective consensus decision."),
+  dependencyStructure: z128.enum(["linear", "dag", "independent", "unknown"]).optional().describe("Hint: the dependency structure of the work."),
+  isNovel: z128.boolean().optional().describe("Hint: this kind of task has not been seen before."),
+  execute: z128.boolean().optional().describe(
     "When true, actually run the selected strategy (if an executor is wired) and return its result; otherwise return the routing decision only (default false, read-only)."
   ),
   /**
@@ -59841,7 +59858,7 @@ var RunInputSchema = z127.object({
    * other, the call is REFUSED rather than executed: silently ignoring a
    * do-not-act flag is the one outcome a governance substrate cannot allow.
    */
-  dryRun: z127.boolean().optional().describe(
+  dryRun: z128.boolean().optional().describe(
     "Plan and vote only, no implementation (#4806). Requires the dev-pipeline strategy \u2014 refused (never silently executed) when the router selects another."
   ),
   /**
@@ -60077,12 +60094,12 @@ function registerRunTool(server, deps) {
 }
 
 // src/mcp/tools/list-available-models-tool.ts
-import { z as z128 } from "zod";
+import { z as z129 } from "zod";
 var DESCRIPTION5 = "Probe every model-discovery transport (OpenRouter API, the configured gateway, and the opencode/claude/codex/gemini CLIs) and report a per-transport health summary: probe ok/failed, model count, and a sample of usable ids. Models with open route breakers are excluded; each CLI reports whether its default-route breaker is open. Use it to validate the CLIs and APIs are wired and reachable. Read-only; does not change routing.";
 var PROBE_TIMEOUT_MS = 12e3;
-var ListAvailableModelsInputSchema = z128.object({
-  includeModelIds: z128.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
-  includeOpenRouter: z128.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
+var ListAvailableModelsInputSchema = z129.object({
+  includeModelIds: z129.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
+  includeOpenRouter: z129.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
 });
 async function probeSource(source, includeModelIds) {
   let timer;
@@ -60191,8 +60208,8 @@ async function listAvailableModelsHandler(args, deps, logger62) {
 function registerListAvailableModelsTool(server, deps) {
   const logger62 = deps.logger ?? createLogger({ tool: "list_available_models" });
   const toolSchema = {
-    includeModelIds: z128.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
-    includeOpenRouter: z128.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
+    includeModelIds: z129.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
+    includeOpenRouter: z129.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
   };
   const secureHandler = createSecureHandler(
     (args) => listAvailableModelsHandler(args, deps, logger62),
@@ -60216,9 +60233,9 @@ function registerListAvailableModelsTool(server, deps) {
 }
 
 // src/mcp/tools/pr-review-eval-types.ts
-import { z as z129 } from "zod";
+import { z as z130 } from "zod";
 var MAX_EVAL_FINDINGS = 100;
-var VoterEvalFindingSchema = z129.object({
+var VoterEvalFindingSchema = z130.object({
   summary: RawFindingSchema.shape.summary,
   location: RawFindingSchema.shape.location,
   severity: RawFindingSchema.shape.severity.unwrap(),
@@ -60226,14 +60243,14 @@ var VoterEvalFindingSchema = z129.object({
   gate: RawFindingSchema.shape.gate.extend({
     named_assertion: RawFindingSchema.shape.claim.min(0)
   }).optional(),
-  verified: z129.boolean().optional(),
-  classification: z129.enum(["TP", "FP", "FN", "excluded"]),
-  source: z129.enum(["voter", "ground_truth"]),
+  verified: z130.boolean().optional(),
+  classification: z130.enum(["TP", "FP", "FN", "excluded"]),
+  source: z130.enum(["voter", "ground_truth"]),
   /** Original index in the voter's raw findings; repeated TP evidence shares it. */
-  findingIndex: z129.number().int().nonnegative().optional(),
-  knownBugIndex: z129.number().int().nonnegative().optional(),
+  findingIndex: z130.number().int().nonnegative().optional(),
+  knownBugIndex: z130.number().int().nonnegative().optional(),
   /** String fields shortened by the producer, never silently truncated. */
-  truncatedFields: z129.array(z129.enum(["summary", "location", "rationale", "gate.named_assertion"])).max(4).optional()
+  truncatedFields: z130.array(z130.enum(["summary", "location", "rationale", "gate.named_assertion"])).max(4).optional()
 });
 var PR_REVIEW_EVAL_ROLES = [
   "architect",
@@ -60242,47 +60259,47 @@ var PR_REVIEW_EVAL_ROLES = [
   "catfish",
   "scope_steward"
 ];
-var PrReviewEvalRoleSchema = z129.enum(PR_REVIEW_EVAL_ROLES);
-var PrReviewCaseClassSchema = z129.enum(["buggy", "clean", "borderline"]);
-var VoterEvalVerdictSchema = z129.object({
+var PrReviewEvalRoleSchema = z130.enum(PR_REVIEW_EVAL_ROLES);
+var PrReviewCaseClassSchema = z130.enum(["buggy", "clean", "borderline"]);
+var VoterEvalVerdictSchema = z130.object({
   /** Stable record id (e.g. `${runId}:${caseNumber}:${role}`). */
-  id: z129.string().min(1).max(160),
+  id: z130.string().min(1).max(160),
   /** The pr_review run / batch this verdict belongs to. */
-  runId: z129.string().min(1).max(64),
+  runId: z130.string().min(1).max(64),
   /** Dataset case identifier (the dataset's `number` field). */
-  caseNumber: z129.string().min(1).max(80),
+  caseNumber: z130.string().min(1).max(80),
   /** Rubric class of the case (ground-truth label). */
   caseClass: PrReviewCaseClassSchema,
   /** The voter role being scored. */
   role: PrReviewEvalRoleSchema,
   /** Verified findings that matched a known bug. */
-  truePositives: z129.number().int().nonnegative(),
+  truePositives: z130.number().int().nonnegative(),
   /** Verified findings on clean code that matched no known bug. */
-  falsePositives: z129.number().int().nonnegative(),
+  falsePositives: z130.number().int().nonnegative(),
   /** Known bugs this voter failed to flag. */
-  falseNegatives: z129.number().int().nonnegative(),
+  falseNegatives: z130.number().int().nonnegative(),
   /** Optional for legacy records/count-only callers; [] means measured, no evidence. */
-  findings: z129.array(VoterEvalFindingSchema).max(MAX_EVAL_FINDINGS).optional(),
+  findings: z130.array(VoterEvalFindingSchema).max(MAX_EVAL_FINDINGS).optional(),
   /** Number of evidence entries omitted at the cap; full tallies are unchanged. */
-  findingsTruncated: z129.number().int().nonnegative().optional(),
+  findingsTruncated: z130.number().int().nonnegative().optional(),
   /** Rubric version the ground truth was adjudicated under. */
-  rubricVersion: z129.string().min(1).max(32),
+  rubricVersion: z130.string().min(1).max(32),
   /** ISO-8601 timestamp the verdict was recorded. */
-  timestamp: z129.string().min(1).max(40)
+  timestamp: z130.string().min(1).max(40)
 });
-var VoterEvalVerdictQuerySchema = z129.object({
+var VoterEvalVerdictQuerySchema = z130.object({
   role: PrReviewEvalRoleSchema.optional(),
-  runId: z129.string().min(1).max(64).optional(),
+  runId: z130.string().min(1).max(64).optional(),
   caseClass: PrReviewCaseClassSchema.optional(),
-  rubricVersion: z129.string().min(1).max(32).optional(),
+  rubricVersion: z130.string().min(1).max(32).optional(),
   /** ISO-8601 lower bound (inclusive) on `timestamp`. */
-  since: z129.string().optional(),
+  since: z130.string().optional(),
   /** Most-recent-N cap. */
-  limit: z129.number().int().positive().optional()
+  limit: z130.number().int().positive().optional()
 });
 
 // src/mcp/tools/supply-chain-tradeoff-panel.ts
-import { z as z130 } from "zod";
+import { z as z131 } from "zod";
 import { randomUUID as randomUUID21 } from "node:crypto";
 var DEFAULT_AXES = [
   "build_time_determinism",
@@ -60304,16 +60321,16 @@ var FULL_PANEL = [
   "scope_steward"
 ];
 var QUICK_PANEL = ["architect", "security", "scope_steward"];
-var SupplyChainTradeoffPanelInputSchema = z130.object({
-  proposal: z130.string().min(1).max(MAX_PROPOSAL_LENGTH2).describe('The proposal under tradeoff review (e.g. "Should aegis-boot adopt cargo-nextest?")'),
-  axes: z130.array(z130.string().min(1).max(MAX_AXIS_NAME_LENGTH)).min(1).max(MAX_AXES).optional().describe(
+var SupplyChainTradeoffPanelInputSchema = z131.object({
+  proposal: z131.string().min(1).max(MAX_PROPOSAL_LENGTH2).describe('The proposal under tradeoff review (e.g. "Should aegis-boot adopt cargo-nextest?")'),
+  axes: z131.array(z131.string().min(1).max(MAX_AXIS_NAME_LENGTH)).min(1).max(MAX_AXES).optional().describe(
     `Tradeoff axes to evaluate. Default: ${DEFAULT_AXES.join(", ")}. Custom axes accepted; max ${String(MAX_AXES)}.`
   ),
-  context: z130.string().max(MAX_CONTEXT_LENGTH).optional().describe(
+  context: z131.string().max(MAX_CONTEXT_LENGTH).optional().describe(
     "Optional context: relevant repo state, dependency tree, vendor publishing patterns, etc."
   ),
-  quickMode: z130.boolean().optional().default(false).describe("Use 3 voters (architect, security, scope_steward) instead of 7"),
-  simulate: z130.boolean().optional().default(false).describe("Use simulated voters (testing only)"),
+  quickMode: z131.boolean().optional().default(false).describe("Use 3 voters (architect, security, scope_steward) instead of 7"),
+  simulate: z131.boolean().optional().default(false).describe("Use simulated voters (testing only)"),
   // #6123: same field as consensus_vote — the panel judges the caller's project.
   project: VoterProjectInputSchema,
   /**
@@ -60811,40 +60828,40 @@ var RiskLevel = /* @__PURE__ */ ((RiskLevel2) => {
 })(RiskLevel || {});
 
 // src/mcp/safety/stpa-schemas.ts
-import { z as z131 } from "zod";
-var HazardCategorySchema = z131.enum(HazardCategory);
-var HazardSeveritySchema = z131.enum(HazardSeverity);
-var ConstraintPrioritySchema = z131.enum(ConstraintPriority);
-var RiskLevelSchema = z131.enum(RiskLevel);
-var TriggerPatternSchema = z131.object({
-  parameter: z131.string().min(1),
-  matchType: z131.enum(["contains", "regex", "equals", "startsWith", "endsWith"]),
-  pattern: z131.string(),
-  reason: z131.string()
-});
-var HazardSchema = z131.object({
-  id: z131.string().min(1),
-  description: z131.string(),
+import { z as z132 } from "zod";
+var HazardCategorySchema = z132.enum(HazardCategory);
+var HazardSeveritySchema = z132.enum(HazardSeverity);
+var ConstraintPrioritySchema = z132.enum(ConstraintPriority);
+var RiskLevelSchema = z132.enum(RiskLevel);
+var TriggerPatternSchema = z132.object({
+  parameter: z132.string().min(1),
+  matchType: z132.enum(["contains", "regex", "equals", "startsWith", "endsWith"]),
+  pattern: z132.string(),
+  reason: z132.string()
+});
+var HazardSchema = z132.object({
+  id: z132.string().min(1),
+  description: z132.string(),
   category: HazardCategorySchema,
   severity: HazardSeveritySchema,
-  likelihood: z131.enum(["almost_certain", "likely", "possible", "unlikely", "rare"]),
-  triggerConditions: z131.array(z131.string()),
-  consequences: z131.array(z131.string())
-});
-var UnsafeControlActionSchema = z131.object({
-  id: z131.string().min(1),
-  toolName: z131.string().min(1),
-  type: z131.enum(["not_provided", "provided_causes_hazard", "wrong_timing", "wrong_duration"]),
-  description: z131.string(),
-  unsafeContext: z131.string(),
-  relatedHazards: z131.array(z131.string()),
-  triggerPatterns: z131.array(TriggerPatternSchema).optional()
-});
-var SafetyConstraintSchema = z131.object({
-  id: z131.string().min(1),
-  description: z131.string(),
-  mitigates: z131.array(z131.string()),
-  enforcement: z131.enum([
+  likelihood: z132.enum(["almost_certain", "likely", "possible", "unlikely", "rare"]),
+  triggerConditions: z132.array(z132.string()),
+  consequences: z132.array(z132.string())
+});
+var UnsafeControlActionSchema = z132.object({
+  id: z132.string().min(1),
+  toolName: z132.string().min(1),
+  type: z132.enum(["not_provided", "provided_causes_hazard", "wrong_timing", "wrong_duration"]),
+  description: z132.string(),
+  unsafeContext: z132.string(),
+  relatedHazards: z132.array(z132.string()),
+  triggerPatterns: z132.array(TriggerPatternSchema).optional()
+});
+var SafetyConstraintSchema = z132.object({
+  id: z132.string().min(1),
+  description: z132.string(),
+  mitigates: z132.array(z132.string()),
+  enforcement: z132.enum([
     "prevent",
     "require_confirmation",
     "alert",
@@ -60852,52 +60869,52 @@ var SafetyConstraintSchema = z131.object({
     "rate_limit",
     "require_privilege"
   ]),
-  validationFunction: z131.string().optional(),
+  validationFunction: z132.string().optional(),
   priority: ConstraintPrioritySchema
 });
-var PropertySchemaSchema = z131.object({
-  type: z131.string(),
-  description: z131.string().optional(),
-  enum: z131.array(z131.unknown()).optional(),
-  pattern: z131.string().optional(),
-  minimum: z131.number().optional(),
-  maximum: z131.number().optional()
-});
-var ToolInputSchemaSchema = z131.object({
-  type: z131.string(),
-  properties: z131.record(z131.string(), PropertySchemaSchema).optional(),
-  required: z131.array(z131.string()).optional(),
-  additionalProperties: z131.boolean().optional()
-});
-var ToolDefinitionSchema = z131.object({
-  name: z131.string().min(1),
-  description: z131.string(),
+var PropertySchemaSchema = z132.object({
+  type: z132.string(),
+  description: z132.string().optional(),
+  enum: z132.array(z132.unknown()).optional(),
+  pattern: z132.string().optional(),
+  minimum: z132.number().optional(),
+  maximum: z132.number().optional()
+});
+var ToolInputSchemaSchema = z132.object({
+  type: z132.string(),
+  properties: z132.record(z132.string(), PropertySchemaSchema).optional(),
+  required: z132.array(z132.string()).optional(),
+  additionalProperties: z132.boolean().optional()
+});
+var ToolDefinitionSchema = z132.object({
+  name: z132.string().min(1),
+  description: z132.string(),
   inputSchema: ToolInputSchemaSchema
 });
-var AnalysisConfigurationSchema = z131.object({
-  includeLowSeverity: z131.boolean().default(true),
-  generateAllConstraints: z131.boolean().default(true),
-  checkInteractions: z131.boolean().default(true),
-  maxHazardsPerTool: z131.number().int().min(1).max(100).default(50),
-  categories: z131.array(HazardCategorySchema).default([])
+var AnalysisConfigurationSchema = z132.object({
+  includeLowSeverity: z132.boolean().default(true),
+  generateAllConstraints: z132.boolean().default(true),
+  checkInteractions: z132.boolean().default(true),
+  maxHazardsPerTool: z132.number().int().min(1).max(100).default(50),
+  categories: z132.array(HazardCategorySchema).default([])
 });
-var ConstraintViolationSchema = z131.object({
-  constraintId: z131.string().min(1),
-  constraintDescription: z131.string(),
+var ConstraintViolationSchema = z132.object({
+  constraintId: z132.string().min(1),
+  constraintDescription: z132.string(),
   severity: HazardSeveritySchema,
-  details: z131.string(),
-  remediation: z131.string()
-});
-var ValidationWarningSchema = z131.object({
-  code: z131.string().min(1),
-  message: z131.string(),
-  affected: z131.string()
-});
-var ValidationResultSchema = z131.object({
-  valid: z131.boolean(),
-  toolName: z131.string().min(1),
-  violations: z131.array(ConstraintViolationSchema),
-  passed: z131.array(z131.string()),
+  details: z132.string(),
+  remediation: z132.string()
+});
+var ValidationWarningSchema = z132.object({
+  code: z132.string().min(1),
+  message: z132.string(),
+  affected: z132.string()
+});
+var ValidationResultSchema = z132.object({
+  valid: z132.boolean(),
+  toolName: z132.string().min(1),
+  violations: z132.array(ConstraintViolationSchema),
+  passed: z132.array(z132.string()),
   // Optional rather than required, deliberately. `ValidationResult` declares
   // both fields required because every result this package produces has them;
   // the schema is the lenient inbound edge for a result that arrived from
@@ -60908,10 +60925,10 @@ var ValidationResultSchema = z131.object({
   // "nothing was evaluated". The strict/lenient split is safe because nothing
   // bridges the two with `z.infer`: a parsed result will not typecheck as a
   // `ValidationResult` without handling the absent fields.
-  evaluated: z131.array(z131.string()).optional(),
-  notApplicable: z131.array(z131.string()).optional(),
-  warnings: z131.array(ValidationWarningSchema),
-  validatedAt: z131.date()
+  evaluated: z132.array(z132.string()).optional(),
+  notApplicable: z132.array(z132.string()).optional(),
+  warnings: z132.array(ValidationWarningSchema),
+  validatedAt: z132.date()
 });
 
 // src/mcp/safety/stpa-types.ts
@@ -62011,18 +62028,18 @@ var GeminiResponseParser = class {
 };
 
 // src/cli-adapters/router-types.ts
-import { z as z132 } from "zod";
-var RouterConfigSchema = z132.object({
-  preferCostEfficient: z132.boolean().default(false)
+import { z as z133 } from "zod";
+var RouterConfigSchema = z133.object({
+  preferCostEfficient: z133.boolean().default(false)
 });
 
 // src/cli-adapters/task-classifier.ts
-import { z as z133 } from "zod";
-var ClassificationPatternsSchema = z133.object({
-  code: z133.array(z133.string()).readonly(),
-  research: z133.array(z133.string()).readonly(),
-  documentation: z133.array(z133.string()).readonly(),
-  analysis: z133.array(z133.string()).readonly()
+import { z as z134 } from "zod";
+var ClassificationPatternsSchema = z134.object({
+  code: z134.array(z134.string()).readonly(),
+  research: z134.array(z134.string()).readonly(),
+  documentation: z134.array(z134.string()).readonly(),
+  analysis: z134.array(z134.string()).readonly()
 });
 
 // src/security/sandbox/sandbox-types.ts
@@ -63424,4 +63441,4 @@ export {
   initializeSandbox,
   getSandboxMode
 };
-//# sourceMappingURL=chunk-KX33QPIJ.js.map
+//# sourceMappingURL=chunk-TK723ERO.js.map