nexus-agents 2.131.0 → 2.132.0

package/dist/cli.js

@@ -13,19 +13,17 @@ import {
   generateSummary,
   parseFindings,
   sumFindings
-} from "./chunk-ZM3S6PTN.js";
-import "./chunk-TGDWL7FG.js";
+} from "./chunk-FKTLAPXJ.js";
+import "./chunk-RLYXX3FQ.js";
 import {
   buildOpenAICompatAdapters,
-  loadUsageEvents,
-  readOpenAICompatEnv,
-  rollupByModel
-} from "./chunk-5GQMP7QN.js";
+  readOpenAICompatEnv
+} from "./chunk-27DRQWON.js";
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-KY2QMH3C.js";
-import "./chunk-FFJEERPZ.js";
+} from "./chunk-RR7Q2HFH.js";
+import "./chunk-QLRH6KOT.js";
 import {
   AuthHandler,
   DEFAULT_EXPERTS,
@@ -144,18 +142,18 @@ import {
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-RPT5WZAT.js";
-import "./chunk-3N7TSFKQ.js";
+} from "./chunk-2JZ55G3X.js";
+import "./chunk-GET2MTLW.js";
 import "./chunk-3ACDP4E6.js";
 import {
   CATEGORY_DISPLAY_NAMES,
   DEFAULT_PR_REVIEW_CONFIG
 } from "./chunk-WAYGXUSM.js";
-import "./chunk-CMRQR57K.js";
-import "./chunk-AVRE45DO.js";
+import "./chunk-PM63X3QG.js";
+import "./chunk-CI5KGCX5.js";
 import {
   shutdownExpertBridge
-} from "./chunk-YXFQ3L56.js";
+} from "./chunk-RAWF4JOT.js";
 import {
   ConsensusVoteInputSchema,
   DEFAULT_VOTE_TIMEOUT_MS,
@@ -164,24 +162,27 @@ import {
   VoteThresholdSchema,
   executeVoting,
   registerConsensusVoteTool
-} from "./chunk-ZQ5K3PG4.js";
+} from "./chunk-I2SW34K6.js";
+import {
+  loadUsageEvents,
+  rollupByModel
+} from "./chunk-TGGR6ST5.js";
 import {
   synthesizeResearch
-} from "./chunk-7IMI64LW.js";
+} from "./chunk-EFDXX5MC.js";
 import {
   classifyTrust,
   createFullGitHubProvider,
   evaluatePolicy,
   parsePRUrl
-} from "./chunk-EYD6O5TQ.js";
-import "./chunk-ULIAUMQD.js";
+} from "./chunk-J435FU54.js";
+import "./chunk-4DLHM6LI.js";
 import {
   ReputationCache,
   sanitizeInput
-} from "./chunk-3UXCVSLJ.js";
+} from "./chunk-QMCHVYZB.js";
 import {
   ImprovementReviewInputSchema,
-  JsonlStore,
   calculateFitnessScore,
   classifySignalPriority,
   consensusFor,
@@ -193,10 +194,10 @@ import {
   registerImprovementReviewTool,
   runImprovementReview,
   scanForSecrets
-} from "./chunk-5CADWTFO.js";
+} from "./chunk-MHIJSCPR.js";
 import {
   createDefaultPolicyFirewall
-} from "./chunk-ACARS7NG.js";
+} from "./chunk-4CLBJ2NA.js";
 import "./chunk-HFOQKCD2.js";
 import {
   PaperStatusSchema,
@@ -220,20 +221,20 @@ import {
   loadSourcesRegistry,
   rankDiscoveredItems,
   saveSourcesRegistry
-} from "./chunk-YEK3ZHO6.js";
+} from "./chunk-S4U3Z6ZS.js";
 import {
   resolveToken
-} from "./chunk-YHBVFTRG.js";
+} from "./chunk-ZQEQVCIU.js";
 import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry
-} from "./chunk-VTTPYENR.js";
+} from "./chunk-2CLFX73Y.js";
 import {
   MemoryError,
   shutdownToolMemory
-} from "./chunk-PM4MZHQK.js";
-import "./chunk-FDY6YOFG.js";
+} from "./chunk-GYDO2WOR.js";
+import "./chunk-NZGNOXXW.js";
 import {
   CustomExpertDefinitionSchema,
   DATA_SUBDIRECTORIES,
@@ -252,7 +253,7 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-3XLDANPJ.js";
+} from "./chunk-FRHC77VK.js";
 import "./chunk-NUBSJGQZ.js";
 import {
   capitalize,
@@ -263,20 +264,20 @@ import "./chunk-ZM4O442V.js";
 import "./chunk-PQHVC4BD.js";
 import {
   createUnifiedRegistry
-} from "./chunk-TA5HYM3H.js";
+} from "./chunk-XIFOAZ5B.js";
 import {
   createAllAdapters,
   getAvailableClis,
   isRecord,
   probeAllClis
-} from "./chunk-IZO437XR.js";
+} from "./chunk-VZCQRLXT.js";
 import {
   DEFAULTS
-} from "./chunk-4A6MSCNJ.js";
-import "./chunk-A4MPCXZ7.js";
-import "./chunk-ADIJIYFA.js";
-import "./chunk-2Z4V5THE.js";
-import "./chunk-E4LAXVQE.js";
+} from "./chunk-WHZD2W6Q.js";
+import "./chunk-ECDJM6UB.js";
+import "./chunk-ZTRBMKXK.js";
+import "./chunk-7BONPRR2.js";
+import "./chunk-E4IYX7LD.js";
 import {
   API_TIMEOUTS,
   AgentCapability,
@@ -288,6 +289,7 @@ import {
   ErrorCode,
   INPUT_MODALITIES,
   INTERNAL_TIMEOUTS,
+  JsonlStore,
   LinUCBBandit,
   MCP_TIMEOUTS,
   NexusError,
@@ -349,7 +351,7 @@ import {
   validateTimeout,
   writeEmptyLine,
   writeLine
-} from "./chunk-VY5WEC2D.js";
+} from "./chunk-QJIHSQZX.js";
 import {
   applyPortableMode,
   detectSandbox,
@@ -358,8 +360,8 @@ import {
   getPerRepoSubdirs,
   nexusDataPath,
   sessionsDbPath
-} from "./chunk-ZGLIHPGJ.js";
-import "./chunk-PR4QN5HX.js";
+} from "./chunk-RUSP5PJR.js";
+import "./chunk-ZPWHCABL.js";
 
 // src/cli/cli-log-bootstrap.ts
 import { argv, env } from "process";
@@ -1843,6 +1845,7 @@ var BaseEvaluator = class {
     this.thresholds = { ...DEFAULT_THRESHOLDS, ...config?.thresholds };
     this.timeoutMs = config?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   }
+  role;
   log;
   thresholds;
   timeoutMs;
@@ -3181,7 +3184,7 @@ ${file.patch}
         violations: policyResult.violations
       });
     }
-    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-2WBM5GL7.js");
+    const { formatReviewComment: formatReviewComment2 } = await import("./pr-reviewer-helpers-PLKDVWYF.js");
     const body = formatReviewComment2(result);
     const postResult = await provider.createReview(pr.prNumber, body, result.decision);
     if (!postResult.ok) {
@@ -13969,6 +13972,108 @@ function scriptedIO() {
   };
 }
 
+// src/governance/claims-registry.ts
+import { existsSync as existsSync12, readFileSync as readFileSync6 } from "fs";
+import { parse as parseYaml2 } from "yaml";
+import { z as z8 } from "zod";
+var VerificationMethodSchema = z8.enum([
+  "file-exists",
+  "file-contains",
+  "source-contains-all",
+  "enum-member-count",
+  "manifest-tool-count",
+  "roadmap-status"
+]);
+var ClaimStatusSchema = z8.enum([
+  "verified",
+  // backed by live evidence the runner checks every CI run
+  "partial",
+  // backed, but with a documented caveat (e.g. small-n eval)
+  "aspirational",
+  // roadmap; allowed only when the subject doc marks it roadmap
+  "stale"
+  // known-broken backing; tracked, must not regress to silent
+]);
+var EvidenceTypeSchema = z8.enum(["test", "gate", "eval-artifact", "adr", "source"]);
+var VerificationSchema = z8.object({
+  method: VerificationMethodSchema,
+  /** Repo-root-relative path to the live backing evidence. */
+  path: z8.string().min(1),
+  /**
+   * Expected value. Numeric for `enum-member-count` / `manifest-tool-count`,
+   * string for `file-contains` / `roadmap-status`. Unused by `file-exists`.
+   */
+  expected: z8.union([z8.number().int().nonnegative(), z8.string().min(1)]).optional(),
+  /** Target symbol name (e.g. the exported `z.enum` const) for count methods. */
+  symbol: z8.string().min(1).optional(),
+  /**
+   * Literal the claim's `subject` doc must contain (#3877). When present, the
+   * runner verifies the doc making the claim — not just the source of truth —
+   * so README/ARCHITECTURE drift fails the gate. Omit only for claims whose
+   * `subject` IS the verification `path` (e.g. `roadmap-status`).
+   */
+  subjectContains: z8.string().min(1).optional()
+}).strict().superRefine((v, ctx) => {
+  const needsNumber = v.method === "enum-member-count" || v.method === "manifest-tool-count";
+  const needsString = v.method === "file-contains" || v.method === "source-contains-all" || v.method === "roadmap-status";
+  if (needsNumber && typeof v.expected !== "number") {
+    ctx.addIssue({
+      code: "custom",
+      message: `method '${v.method}' requires a numeric 'expected'`,
+      path: ["expected"]
+    });
+  }
+  if (needsString && typeof v.expected !== "string") {
+    ctx.addIssue({
+      code: "custom",
+      message: `method '${v.method}' requires a string 'expected'`,
+      path: ["expected"]
+    });
+  }
+  if (v.method === "enum-member-count" && v.symbol === void 0) {
+    ctx.addIssue({
+      code: "custom",
+      message: `method 'enum-member-count' requires a 'symbol'`,
+      path: ["symbol"]
+    });
+  }
+});
+var ClaimEntrySchema = z8.object({
+  /** Stable, kebab-case identifier; never reused. */
+  id: z8.string().regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "id must be kebab-case"),
+  /** Human-readable claim text (<=25 words). */
+  claim: z8.string().min(1).refine((s) => s.trim().split(/\s+/).length <= 25, "claim must be <=25 words"),
+  /** Repo-root-relative doc that makes the claim (e.g. README.md). */
+  subject: z8.string().min(1),
+  status: ClaimStatusSchema,
+  evidenceType: EvidenceTypeSchema,
+  verification: VerificationSchema,
+  /** ISO date (YYYY-MM-DD) the claim was last manually verified. */
+  lastVerified: z8.string().regex(/^\d{4}-\d{2}-\d{2}$/, "lastVerified must be YYYY-MM-DD"),
+  /** Optional caveat surfaced in reports (required-ish for `partial`). */
+  caveat: z8.string().optional()
+}).strict();
+var ClaimsRegistrySchema = z8.object({
+  version: z8.number().int().positive(),
+  claims: z8.array(ClaimEntrySchema).min(1).superRefine((claims, ctx) => {
+    const seen = /* @__PURE__ */ new Set();
+    for (const [i, c] of claims.entries()) {
+      if (seen.has(c.id)) {
+        ctx.addIssue({
+          code: "custom",
+          message: `duplicate claim id '${c.id}'`,
+          path: [i, "id"]
+        });
+      }
+      seen.add(c.id);
+    }
+  })
+}).strict();
+
+// src/governance/claims-verify.ts
+import { existsSync as existsSync13, readFileSync as readFileSync7 } from "fs";
+import { isAbsolute as isAbsolute2, join as join12 } from "path";
+
 // src/cli/fitness-audit.ts
 var COLORS = colors;
 function formatScore(score, max) {
@@ -14429,11 +14534,11 @@ async function releaseNotesCommand(args) {
 }
 
 // src/cli/release-validate-command.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 
 // src/cli/release-validate-helpers.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync8 } from "fs";
 async function validateSecurity(options) {
   const startTime = Date.now();
   const findings = [];
@@ -14452,7 +14557,7 @@ async function validateSecurity(options) {
       remediation: "Run npm audit fix or review and update vulnerable dependencies."
     });
   }
-  if (existsSync12(".env")) {
+  if (existsSync14(".env")) {
     findings.push({
       severity: "error",
       category: "security",
@@ -14548,7 +14653,7 @@ async function validateArchitecture2(options) {
 async function validateDocumentation(options) {
   const startTime = Date.now();
   const findings = [];
-  if (!existsSync12("CHANGELOG.md")) {
+  if (!existsSync14("CHANGELOG.md")) {
     findings.push({
       severity: "error",
       category: "docs",
@@ -14556,7 +14661,7 @@ async function validateDocumentation(options) {
       description: "No CHANGELOG.md found in repository root.",
       remediation: "Create CHANGELOG.md following Keep a Changelog format."
     });
-  } else if (!readFileSync6("CHANGELOG.md", "utf-8").includes(options.version)) {
+  } else if (!readFileSync8("CHANGELOG.md", "utf-8").includes(options.version)) {
     findings.push({
       severity: "warning",
       category: "docs",
@@ -14566,7 +14671,7 @@ async function validateDocumentation(options) {
     });
   }
   const pkgCl = "packages/nexus-agents/CHANGELOG.md";
-  if (existsSync12(pkgCl) && !readFileSync6(pkgCl, "utf-8").includes(options.version)) {
+  if (existsSync14(pkgCl) && !readFileSync8(pkgCl, "utf-8").includes(options.version)) {
     findings.push({
       severity: "warning",
       category: "docs",
@@ -14575,7 +14680,7 @@ async function validateDocumentation(options) {
       remediation: "Run pnpm changeset:version to generate changelog from pending changesets."
     });
   }
-  if (!existsSync12("README.md")) {
+  if (!existsSync14("README.md")) {
     findings.push({
       severity: "error",
       category: "docs",
@@ -14584,8 +14689,8 @@ async function validateDocumentation(options) {
       remediation: "Create README.md with project overview and usage instructions."
     });
   }
-  if (existsSync12("CLAUDE.md")) {
-    const claudeMd = readFileSync6("CLAUDE.md", "utf-8");
+  if (existsSync14("CLAUDE.md")) {
+    const claudeMd = readFileSync8("CLAUDE.md", "utf-8");
     const match = claudeMd.match(/Governance Version: (\d{4}-\d{2}-\d{2})/);
     if (match?.[1]) {
       const governanceDate = new Date(match[1]);
@@ -14693,7 +14798,7 @@ var DEFAULT_OPTIONS2 = {
 };
 function readVersionFromPackage() {
   try {
-    const raw = JSON.parse(readFileSync7("package.json", "utf-8"));
+    const raw = JSON.parse(readFileSync9("package.json", "utf-8"));
     if (typeof raw === "object" && raw !== null && "version" in raw) {
       const pkg = raw;
       return typeof pkg.version === "string" ? pkg.version : "unknown";
@@ -14807,7 +14912,7 @@ async function releaseValidateCommand(args) {
 }
 
 // src/cli/release-announce-command.ts
-import { readFileSync as readFileSync8, existsSync as existsSync13 } from "fs";
+import { readFileSync as readFileSync10, existsSync as existsSync15 } from "fs";
 
 // src/cli/release-announce-types.ts
 var BLUESKY_LIMITS = {
@@ -14832,7 +14937,7 @@ function getBlueskyConfig() {
 }
 async function loadAtproto() {
   try {
-    const mod = await import("./dist-QZLOLGIK.js");
+    const mod = await import("./dist-A5STUO26.js");
     return { AtpAgent: mod.AtpAgent, RichText: mod.RichText };
   } catch {
     return void 0;
@@ -14874,8 +14979,8 @@ var DEFAULT_OPTIONS3 = {
   verbose: false
 };
 function extractHighlightsFromChangelog(version) {
-  if (!existsSync13("CHANGELOG.md")) return [];
-  const changelog = readFileSync8("CHANGELOG.md", "utf-8");
+  if (!existsSync15("CHANGELOG.md")) return [];
+  const changelog = readFileSync10("CHANGELOG.md", "utf-8");
   const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const versionRegex = new RegExp(`## \\[${escaped}\\][^#]*`, "s");
   const match = changelog.match(versionRegex);
@@ -15144,7 +15249,7 @@ async function releaseAnnounceCommand(args) {
     version = args.options.version;
   } else {
     try {
-      const pkg = JSON.parse(readFileSync8("package.json", "utf-8"));
+      const pkg = JSON.parse(readFileSync10("package.json", "utf-8"));
       if (!pkg.version) {
         console.error(`${colors.red}Error: Could not determine version${colors.reset}`);
         return 1;
@@ -16076,7 +16181,7 @@ function formatEvalDetails(baseline, reflective, improvement, datasetSize) {
 }
 
 // src/cli/auth-command.ts
-import { existsSync as existsSync15, statSync, chmodSync } from "fs";
+import { existsSync as existsSync17, statSync, chmodSync } from "fs";
 function isValidAuthSubcommand(value) {
   return value === "init" || value === "show" || value === "rotate" || value === "help" || value === "status";
 }
@@ -16096,7 +16201,7 @@ function fixPermissions(filePath) {
 }
 function runAuthInit(options) {
   const tokenFile = options.tokenFile ?? getDefaultTokenPath();
-  const tokenExists = existsSync15(tokenFile);
+  const tokenExists = existsSync17(tokenFile);
   if (tokenExists && options.force !== true) {
     return {
       success: false,
@@ -16120,7 +16225,7 @@ function runAuthInit(options) {
 }
 function runAuthShow(options) {
   const tokenFile = options.tokenFile ?? getDefaultTokenPath();
-  const tokenExists = existsSync15(tokenFile);
+  const tokenExists = existsSync17(tokenFile);
   const token = readStoredToken(tokenFile);
   if (!tokenExists || token === void 0) {
     return {
@@ -16141,7 +16246,7 @@ function runAuthShow(options) {
 }
 function runAuthRotate(options) {
   const tokenFile = options.tokenFile ?? getDefaultTokenPath();
-  const tokenExists = existsSync15(tokenFile);
+  const tokenExists = existsSync17(tokenFile);
   if (!tokenExists) {
     return {
       success: false,
@@ -16177,14 +16282,14 @@ function runAuthCommand(options) {
         success: true,
         operation: "help",
         tokenFile: getDefaultTokenPath(),
-        tokenExists: existsSync15(getDefaultTokenPath())
+        tokenExists: existsSync17(getDefaultTokenPath())
       };
     default:
       return {
         success: false,
         operation: "help",
         tokenFile: getDefaultTokenPath(),
-        tokenExists: existsSync15(getDefaultTokenPath()),
+        tokenExists: existsSync17(getDefaultTokenPath()),
         error: `Unknown subcommand: ${subcommand}`
       };
   }
@@ -16773,22 +16878,22 @@ function isValidCommand(value) {
 }
 
 // src/cli-commands-handlers.ts
-import { existsSync as existsSync20 } from "fs";
+import { existsSync as existsSync22 } from "fs";
 
 // src/cli/init-portable.ts
 import {
-  existsSync as existsSync19,
+  existsSync as existsSync21,
   mkdirSync as mkdirSync5,
   readdirSync,
   statSync as statSync2,
   appendFileSync as appendFileSync2,
-  readFileSync as readFileSync11
+  readFileSync as readFileSync13
 } from "fs";
-import { resolve as resolve10, join as join15, isAbsolute as isAbsolute2 } from "path";
+import { resolve as resolve10, join as join16, isAbsolute as isAbsolute3 } from "path";
 
 // src/cli/mcp-config-emitter.ts
-import { existsSync as existsSync16, readFileSync as readFileSync9, writeFileSync as writeFileSync5, appendFileSync } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync11, writeFileSync as writeFileSync5, appendFileSync } from "fs";
+import { join as join13 } from "path";
 var MCP_CONFIG_FILENAME = ".mcp.json";
 var NEXUS_SERVER_KEY = "nexus-agents";
 function buildNexusServerEntry(dataDir, commandPath) {
@@ -16811,10 +16916,10 @@ function entriesEqual(a, b) {
   return true;
 }
 function loadExistingConfig(path21) {
-  if (!existsSync16(path21)) return { ok: true, value: void 0 };
+  if (!existsSync18(path21)) return { ok: true, value: void 0 };
   let raw;
   try {
-    raw = readFileSync9(path21, "utf-8");
+    raw = readFileSync11(path21, "utf-8");
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
   }
@@ -16848,12 +16953,12 @@ function decideEmission(existing, desired, force) {
   return { kind: "write", nextConfig: { ...existing, mcpServers: nextServers } };
 }
 function autoGitignoreMcpConfig(workspaceDir, dryRun) {
-  const gitDir = join12(workspaceDir, ".git");
-  if (!existsSync16(gitDir)) return false;
-  const gitignorePath = join12(workspaceDir, ".gitignore");
+  const gitDir = join13(workspaceDir, ".git");
+  if (!existsSync18(gitDir)) return false;
+  const gitignorePath = join13(workspaceDir, ".gitignore");
   let existing = "";
-  if (existsSync16(gitignorePath)) {
-    existing = readFileSync9(gitignorePath, "utf-8");
+  if (existsSync18(gitignorePath)) {
+    existing = readFileSync11(gitignorePath, "utf-8");
     const already = existing.split("\n").some((l) => l.trim() === MCP_CONFIG_FILENAME || l.trim() === `/${MCP_CONFIG_FILENAME}`);
     if (already) return false;
   }
@@ -16865,7 +16970,7 @@ function autoGitignoreMcpConfig(workspaceDir, dryRun) {
   return true;
 }
 function emitMcpConfig(options) {
-  const mcpConfigPath = join12(options.workspaceDir, MCP_CONFIG_FILENAME);
+  const mcpConfigPath = join13(options.workspaceDir, MCP_CONFIG_FILENAME);
   const dryRun = options.dryRun === true;
   const force = options.force === true;
   const desired = buildNexusServerEntry(options.dataDir, options.commandPath);
@@ -16903,13 +17008,13 @@ function makeFailure(mcpConfigPath, error) {
 
 // src/cli/portable-installer.ts
 import { execFile as execFile2 } from "child_process";
-import { existsSync as existsSync18, mkdirSync as mkdirSync4, rmSync, writeFileSync as writeFileSync7 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync4, rmSync, writeFileSync as writeFileSync7 } from "fs";
+import { join as join15 } from "path";
 import { promisify as promisify2 } from "util";
 
 // src/cli/bin-shim.ts
-import { existsSync as existsSync17, readFileSync as readFileSync10, writeFileSync as writeFileSync6, chmodSync as chmodSync2, mkdirSync as mkdirSync3 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync12, writeFileSync as writeFileSync6, chmodSync as chmodSync2, mkdirSync as mkdirSync3 } from "fs";
+import { join as join14 } from "path";
 var SHIM_BASENAME = "nexus-agents";
 var SHIM_MODE = 493;
 function buildShimContents(cliEntryPath) {
@@ -16923,18 +17028,18 @@ function buildShimContents(cliEntryPath) {
   return lines.join("\n");
 }
 function writeBinShim(options) {
-  const shimPath = join13(options.binDir, SHIM_BASENAME);
+  const shimPath = join14(options.binDir, SHIM_BASENAME);
   const desired = buildShimContents(options.cliEntryPath);
   const dryRun = options.dryRun === true;
   try {
-    if (existsSync17(shimPath)) {
-      const current = readFileSync10(shimPath, "utf-8");
+    if (existsSync19(shimPath)) {
+      const current = readFileSync12(shimPath, "utf-8");
       if (current === desired) {
         return { success: true, shimPath, written: false, alreadyMatched: true, error: null };
       }
     }
     if (!dryRun) {
-      if (!existsSync17(options.binDir)) mkdirSync3(options.binDir, { recursive: true });
+      if (!existsSync19(options.binDir)) mkdirSync3(options.binDir, { recursive: true });
       writeFileSync6(shimPath, desired, "utf-8");
       chmodSync2(shimPath, SHIM_MODE);
     }
@@ -16969,10 +17074,10 @@ function writeInstallManifest(cliDir, version) {
     description: "Local install root for portable nexus-agents (generated; do not commit)",
     dependencies: { "nexus-agents": version }
   };
-  writeFileSync7(join14(cliDir, "package.json"), JSON.stringify(manifest, null, 2) + "\n", "utf-8");
+  writeFileSync7(join15(cliDir, "package.json"), JSON.stringify(manifest, null, 2) + "\n", "utf-8");
 }
 function isAlreadyInstalled(cliDir) {
-  return existsSync18(join14(cliDir, "node_modules", "nexus-agents", "package.json"));
+  return existsSync20(join15(cliDir, "node_modules", "nexus-agents", "package.json"));
 }
 async function spawnNpmInstall(cliDir) {
   await execFileAsync2("npm", ["install", "--no-audit", "--no-fund", "--silent"], {
@@ -16988,7 +17093,7 @@ function cleanupOnFailure(cliDir) {
 }
 async function runNpmStep(ctx) {
   try {
-    if (!existsSync18(ctx.cliDir)) mkdirSync4(ctx.cliDir, { recursive: true });
+    if (!existsSync20(ctx.cliDir)) mkdirSync4(ctx.cliDir, { recursive: true });
     writeInstallManifest(ctx.cliDir, ctx.version);
     await spawnNpmInstall(ctx.cliDir);
     return void 0;
@@ -16999,8 +17104,8 @@ async function runNpmStep(ctx) {
   }
 }
 async function installPortable(options) {
-  const cliDir = join14(options.dataDir, CLI_SUBDIR);
-  const binDir = join14(options.dataDir, BIN_SUBDIR);
+  const cliDir = join15(options.dataDir, CLI_SUBDIR);
+  const binDir = join15(options.dataDir, BIN_SUBDIR);
   const versionResolution = resolveInstallVersion(options.version);
   if (!versionResolution.ok) {
     return {
@@ -17021,7 +17126,7 @@ async function installPortable(options) {
   }
   const npmFailure = await runNpmStep(ctx);
   if (npmFailure !== void 0) return npmFailure;
-  const shim = writeBinShim({ binDir, cliEntryPath: join14(cliDir, CLI_ENTRY_RELATIVE) });
+  const shim = writeBinShim({ binDir, cliEntryPath: join15(cliDir, CLI_ENTRY_RELATIVE) });
   if (!shim.success) {
     cleanupOnFailure(cliDir);
     return {
@@ -17035,14 +17140,14 @@ async function installPortable(options) {
   return { success: true, ...ctx, shim, skipped: false, error: null };
 }
 function uninstallPortable(options) {
-  const cliDir = join14(options.dataDir, CLI_SUBDIR);
-  const binDir = join14(options.dataDir, BIN_SUBDIR);
+  const cliDir = join15(options.dataDir, CLI_SUBDIR);
+  const binDir = join15(options.dataDir, BIN_SUBDIR);
   const removed = [];
   const notPresent = [];
   const dryRun = options.dryRun === true;
   try {
     for (const dir of [cliDir, binDir]) {
-      if (!existsSync18(dir)) {
+      if (!existsSync20(dir)) {
         notPresent.push(dir);
         continue;
       }
@@ -17056,8 +17161,8 @@ function uninstallPortable(options) {
   }
 }
 function findBinShim(dataDir) {
-  const shimPath = join14(dataDir, BIN_SUBDIR, "nexus-agents");
-  return existsSync18(shimPath) ? shimPath : void 0;
+  const shimPath = join15(dataDir, BIN_SUBDIR, "nexus-agents");
+  return existsSync20(shimPath) ? shimPath : void 0;
 }
 
 // src/cli/init-portable.ts
@@ -17067,16 +17172,16 @@ function resolveTargetPath(rawPath) {
   if (rawPath === void 0 || rawPath === "") {
     return resolve10(process.cwd(), DEFAULT_PORTABLE_DIRNAME);
   }
-  return isAbsolute2(rawPath) ? rawPath : resolve10(process.cwd(), rawPath);
+  return isAbsolute3(rawPath) ? rawPath : resolve10(process.cwd(), rawPath);
 }
 function isNonEmpty(dir) {
-  if (!existsSync19(dir)) return false;
+  if (!existsSync21(dir)) return false;
   const stat2 = statSync2(dir);
   if (!stat2.isDirectory()) return true;
   return readdirSync(dir).length > 0;
 }
 function ensureDir(path21, dryRun, created, alreadyExisted, mode) {
-  if (existsSync19(path21)) {
+  if (existsSync21(path21)) {
     alreadyExisted.push(path21);
     return;
   }
@@ -17086,13 +17191,13 @@ function ensureDir(path21, dryRun, created, alreadyExisted, mode) {
   created.push(path21);
 }
 function maybeUpdateGitignore(workspaceDir, portableDirName, dryRun) {
-  const gitDir = join15(workspaceDir, ".git");
-  if (!existsSync19(gitDir)) return false;
-  const gitignorePath = join15(workspaceDir, ".gitignore");
+  const gitDir = join16(workspaceDir, ".git");
+  if (!existsSync21(gitDir)) return false;
+  const gitignorePath = join16(workspaceDir, ".gitignore");
   const entry = `${portableDirName}/`;
   let existing = "";
-  if (existsSync19(gitignorePath)) {
-    existing = readFileSync11(gitignorePath, "utf-8");
+  if (existsSync21(gitignorePath)) {
+    existing = readFileSync13(gitignorePath, "utf-8");
     if (existing.split("\n").some((l) => l.trim() === entry || l.trim() === portableDirName)) {
       return false;
     }
@@ -17105,18 +17210,18 @@ function maybeUpdateGitignore(workspaceDir, portableDirName, dryRun) {
   return true;
 }
 function inspectTarget(target) {
-  const exists = existsSync19(target);
+  const exists = existsSync21(target);
   if (!exists) return { exists: false, nonEmpty: false, isExistingNexusDir: false };
   const nonEmpty = isNonEmpty(target);
   const stat2 = statSync2(target);
-  const isExistingNexusDir = stat2.isDirectory() && existsSync19(join15(target, "audit"));
+  const isExistingNexusDir = stat2.isDirectory() && existsSync21(join16(target, "audit"));
   return { exists, nonEmpty, isExistingNexusDir };
 }
 function createDataLayout(target, dryRun, created, alreadyExisted) {
   ensureDir(target, dryRun, created, alreadyExisted);
   for (const subdir of DATA_SUBDIRECTORIES) {
     const mode = RESTRICTED_SUBDIRS.has(subdir) ? 448 : void 0;
-    ensureDir(join15(target, subdir), dryRun, created, alreadyExisted, mode);
+    ensureDir(join16(target, subdir), dryRun, created, alreadyExisted, mode);
   }
 }
 function makeResult(opts) {
@@ -17647,7 +17752,7 @@ function startImprovementReviewScheduler(options) {
   let running = false;
   const runOnce = async () => {
     try {
-      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-AMVJW3SI.js");
+      const { runImprovementReview: runImprovementReview2, ImprovementReviewInputSchema: ImprovementReviewInputSchema2 } = await import("./improvement-review-TDC4QH5P.js");
       const input = ImprovementReviewInputSchema2.parse({ fileIssues });
       const result = await runImprovementReview2(input, { logger: logger19 });
       logger19.info("Scheduled improvement_review complete", {
@@ -18081,8 +18186,8 @@ async function initUpstreamServers(gatewayConfig, server, logger19) {
     servers: upstreamServers.length,
     tools: tools.length
   });
-  const { z: z10 } = await import("zod");
-  const passthroughSchema = z10.looseObject({});
+  const { z: z11 } = await import("zod");
+  const passthroughSchema = z11.looseObject({});
   for (const tool of tools) {
     const toolName = tool.name;
     const desc = tool.description ?? `Upstream tool: ${toolName}`;
@@ -19584,7 +19689,7 @@ function adaptConfigToLibrary(config) {
 }
 function createBeliefPromoter() {
   return async (event) => {
-    const { getToolMemory } = await import("./tool-memory-MIZVB4ZT.js");
+    const { getToolMemory } = await import("./tool-memory-Z2B7CAH7.js");
     const tm = getToolMemory();
     await tm.recordBelief(
       `skill:${event.name}`,
@@ -20335,8 +20440,8 @@ function printFirstRunHint() {
   const isTTY = process.stderr.isTTY;
   if (!isTTY) return;
   const dataDir = getNexusDataDir();
-  const hasConfig = existsSync20("./.nexus-agents/nexus-agents.yaml") || existsSync20("./.nexus-agents/nexus-agents.yml") || existsSync20("./nexus-agents.yaml") || existsSync20("./nexus-agents.yml");
-  if (existsSync20(dataDir) || hasConfig) return;
+  const hasConfig = existsSync22("./.nexus-agents/nexus-agents.yaml") || existsSync22("./.nexus-agents/nexus-agents.yml") || existsSync22("./nexus-agents.yaml") || existsSync22("./nexus-agents.yml");
+  if (existsSync22(dataDir) || hasConfig) return;
   process.stderr.write(
     "\n\x1B[36mnexus-agents\x1B[0m: First time? Run \x1B[1mnexus-agents setup\x1B[0m to configure.\n\n"
   );
@@ -20451,7 +20556,7 @@ async function handleResearchCommand(args) {
   }
 }
 async function handleRegistryCommand(args) {
-  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-AXNA2H35.js");
+  const { registryCommand, isValidRegistrySubcommand, formatRegistryUsage } = await import("./registry-command-HPKNLYUL.js");
   const subcommand = args.subcommand;
   if (!isValidRegistrySubcommand(subcommand)) {
     process.stdout.write(`${formatRegistryUsage()}
@@ -20499,7 +20604,7 @@ async function handleVerifyCommand(args) {
 async function handleDoctorCommand(args) {
   const exitCode = await doctorCommand({ fix: args.options.fix });
   if (args.options.deep) {
-    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-WID6FQ2F.js");
+    const { runDeepDiagnostics: runDeepDiagnostics2, formatDeepDiagnostics: formatDeepDiagnostics2 } = await import("./doctor-deep-HJ3NQ365.js");
     const diag = runDeepDiagnostics2();
     process.stdout.write(formatDeepDiagnostics2(diag) + "\n");
   }
@@ -20543,7 +20648,7 @@ async function handleInitCommand(args) {
   process.exit(result.success ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runInitOpencodeFlow(args) {
-  const { runInitOpencode } = await import("./init-opencode-3UPZL2UQ.js");
+  const { runInitOpencode } = await import("./init-opencode-L3NT524E.js");
   const opencodePath = args.options.opencode;
   if (opencodePath === void 0 || opencodePath === "") {
     process.stderr.write("Error: --opencode requires a path argument.\n");
@@ -20570,7 +20675,7 @@ async function runInitOpencodeFlow(args) {
   process.exit(EXIT_CODES.SUCCESS);
 }
 async function renderOpencodeValidate(opencodePath) {
-  const { runOpencodeValidate } = await import("./init-opencode-3UPZL2UQ.js");
+  const { runOpencodeValidate } = await import("./init-opencode-L3NT524E.js");
   const result = await runOpencodeValidate(opencodePath);
   if (!result.ok) {
     process.stderr.write(`init --opencode --validate: ${result.reason ?? "failed"}
@@ -20610,7 +20715,7 @@ async function handleSetupCommandAsync(args) {
   process.exit(exitCode === 0 ? EXIT_CODES.SUCCESS : EXIT_CODES.SERVER_START_FAILED);
 }
 async function runCustomApiSetup(args) {
-  const { configureCustomApi } = await import("./setup-custom-api-AZMHKIHE.js");
+  const { configureCustomApi } = await import("./setup-custom-api-W7EDVKWR.js");
   const baseUrl = args.options.customApi;
   if (baseUrl === void 0) return EXIT_CODES.SERVER_START_FAILED;
   const input = {
@@ -22174,7 +22279,7 @@ function handleStatusCommand2(args) {
 
 // src/cli/scenario-command.ts
 import { readdir as readdir4 } from "fs/promises";
-import { join as join17, resolve as resolve12 } from "path";
+import { join as join18, resolve as resolve12 } from "path";
 
 // src/testing/e2e/scenario-runner.ts
 import { readFile as readFile7 } from "fs/promises";
@@ -22544,7 +22649,7 @@ async function handleRun(args) {
     process.exit(EXIT_CODES.SERVER_START_FAILED);
   }
   const runner = createScenarioRunner();
-  const fixturePath = join17(FIXTURES_DIR, `${name}${SCENARIO_SUFFIX}`);
+  const fixturePath = join18(FIXTURES_DIR, `${name}${SCENARIO_SUFFIX}`);
   try {
     const fixture = await runner.loadFixture(fixturePath);
     const result = await runner.run(fixture);
@@ -22958,7 +23063,10 @@ var ACTION_BY_CATEGORY = {
   "tech-debt": "refactor",
   security: "investigate",
   // conservative — security is p0/unanimous-gated regardless
-  consensus: "investigate"
+  consensus: "investigate",
+  // #3852: a deprecation/consolidation candidate is a human decision, never an
+  // autonomous code change — investigate only (Epic D ratification path).
+  "tool-fitness": "investigate"
 };
 function clip(s, max) {
   return s.length > max ? s.slice(0, max) : s;
@@ -23078,10 +23186,10 @@ function stripRefsPrefix(ref) {
 import { execFile as execFile4 } from "child_process";
 import { promisify as promisify4 } from "util";
 import { writeFile as writeFile6, mkdir as mkdir5 } from "fs/promises";
-import { join as join18, dirname as dirname11 } from "path";
+import { join as join19, dirname as dirname11 } from "path";
 
 // src/mcp/tools/improvement-remediation-capability.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var PHASE_CAPABILITIES = {
   research: /* @__PURE__ */ new Set(["untrusted-input", "secrets"]),
   implement: /* @__PURE__ */ new Set(["repo-write", "secrets"])
@@ -23122,7 +23230,7 @@ var CapabilityLedger = class {
     }
   }
 };
-var RemediationActionKindSchema = z8.enum([
+var RemediationActionKindSchema = z9.enum([
   "investigate",
   "adjust-routing",
   "add-test",
@@ -23130,19 +23238,19 @@ var RemediationActionKindSchema = z8.enum([
   "update-docs",
   "fix-bug"
 ]);
-var RemediationStepSchema = z8.object({
+var RemediationStepSchema = z9.object({
   kind: RemediationActionKindSchema,
-  description: z8.string().min(1).max(500),
+  description: z9.string().min(1).max(500),
   /** Optional path hint; bounded inert string, validated for traversal at use. */
-  targetPath: z8.string().min(1).max(300).optional()
+  targetPath: z9.string().min(1).max(300).optional()
 }).strict();
-var RemediationPlanSchema = z8.object({
+var RemediationPlanSchema = z9.object({
   /** Source signal key (mirrors ImprovementSignal.signalKey). */
-  signalKey: z8.string().min(1).max(200),
-  /** Signal category (mirrors SignalCategory). */
-  category: z8.enum(["routing", "tech-debt", "bug", "security", "consensus"]),
-  summary: z8.string().min(1).max(1e3),
-  steps: z8.array(RemediationStepSchema).min(1).max(20)
+  signalKey: z9.string().min(1).max(200),
+  /** Signal category (mirrors SignalCategory; 'tool-fitness' added #3852). */
+  category: z9.enum(["routing", "tech-debt", "bug", "security", "consensus", "tool-fitness"]),
+  summary: z9.string().min(1).max(1e3),
+  steps: z9.array(RemediationStepSchema).min(1).max(20)
 }).strict();
 function parseRemediationPlan(raw) {
   const result = RemediationPlanSchema.safeParse(raw);
@@ -23229,12 +23337,12 @@ function makeGitWorktreeOps(repoRoot) {
   };
   return {
     async addWorktree(branch, baseBranch) {
-      const path21 = join18(repoRoot, ".nexus-worktrees", branch.replace(/\//g, "_"));
+      const path21 = join19(repoRoot, ".nexus-worktrees", branch.replace(/\//g, "_"));
       await git(["worktree", "add", "-b", branch, path21, baseBranch], repoRoot);
       return path21;
     },
     async writeFileIn(worktreePath, relPath, content) {
-      const abs = join18(worktreePath, relPath);
+      const abs = join19(worktreePath, relPath);
       await mkdir5(dirname11(abs), { recursive: true });
       await writeFile6(abs, content, "utf8");
     },
@@ -23272,25 +23380,25 @@ function makeGhPrCreator() {
 }
 
 // src/mcp/tools/remediation-review.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 function soakRefOf(record) {
   return `${record.signalKey}::${record.timestamp}`;
 }
-var ReviewRecordSchema = z9.object({
+var ReviewRecordSchema = z10.object({
   /** Reference to the reviewed soak selection (`signalKey::timestamp`). */
-  soakRef: z9.string(),
+  soakRef: z10.string(),
   /** ISO-8601 time the review was recorded. */
-  reviewedAt: z9.string(),
+  reviewedAt: z10.string(),
   /** Always true — a persisted record is, by construction, a review. */
-  reviewed: z9.literal(true),
+  reviewed: z10.literal(true),
   /** Whether the evaluator assessed the selection SOUND. */
-  sound: z9.boolean(),
+  sound: z10.boolean(),
   /** Named evaluator who performed the review (required — the gate's named-evaluator criterion). */
-  evaluator: z9.string().min(1),
+  evaluator: z10.string().min(1),
   /** Named owner accepting enforcement, recorded at sign-off time (optional per record). */
-  owner: z9.string().min(1).optional(),
+  owner: z10.string().min(1).optional(),
   /** Free-text note (secret-scrubbed). */
-  note: z9.string().optional()
+  note: z10.string().optional()
 });
 var REVIEW_MAX_RECORDS = 1e4;
 function getRemediationReviewFile() {
@@ -23998,18 +24106,18 @@ async function handleRemediationReviewCommand(args) {
 }
 
 // src/cli/migrate-command.ts
-import { cpSync, existsSync as existsSync22, mkdirSync as mkdirSync6, readdirSync as readdirSync3 } from "fs";
+import { cpSync, existsSync as existsSync24, mkdirSync as mkdirSync6, readdirSync as readdirSync3 } from "fs";
 import { homedir } from "os";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 var logger18 = createLogger({ component: "migrate-command" });
-var HOMEDIR_DEFAULT_BASE = join19(homedir(), ".nexus-agents");
+var HOMEDIR_DEFAULT_BASE = join20(homedir(), ".nexus-agents");
 function countItems(dir) {
-  if (!existsSync22(dir)) return 0;
+  if (!existsSync24(dir)) return 0;
   try {
     const entries = readdirSync3(dir, { withFileTypes: true });
     let n = 0;
     for (const e of entries) {
-      const p = join19(dir, e.name);
+      const p = join20(dir, e.name);
       if (e.isDirectory()) {
         n += countItems(p);
       } else {
@@ -24051,7 +24159,7 @@ function checkEarlyExits(fromBase, toBase, dryRun) {
       summary: "No git repo detected from cwd. Run from inside a repo or pass --to <path> to choose an explicit destination."
     };
   }
-  if (!existsSync22(fromBase)) {
+  if (!existsSync24(fromBase)) {
     return {
       fromBase,
       toBase,
@@ -24064,8 +24172,8 @@ function checkEarlyExits(fromBase, toBase, dryRun) {
   return null;
 }
 function planAndExecuteEntry(name, fromBase, toBase, perRepoSet, dryRun) {
-  const source = join19(fromBase, name);
-  const target = join19(toBase, name);
+  const source = join20(fromBase, name);
+  const target = join20(toBase, name);
   if (!perRepoSet.has(name)) {
     return { subdir: name, status: "skipped-not-per-repo", source, target: "", itemsCopied: 0 };
   }
@@ -24073,7 +24181,7 @@ function planAndExecuteEntry(name, fromBase, toBase, perRepoSet, dryRun) {
   if (items === 0) {
     return { subdir: name, status: "skipped-empty", source, target, itemsCopied: 0 };
   }
-  if (existsSync22(target) && readdirSync3(target).length > 0) {
+  if (existsSync24(target) && readdirSync3(target).length > 0) {
     return { subdir: name, status: "skipped-exists", source, target, itemsCopied: 0 };
   }
   if (!dryRun) {
@@ -24085,7 +24193,7 @@ function planAndExecuteEntry(name, fromBase, toBase, perRepoSet, dryRun) {
 function resolveDefaultTarget(cwd) {
   const repoRoot = findRepoRoot(cwd);
   if (repoRoot === null) return null;
-  return join19(repoRoot, ".nexus-agents");
+  return join20(repoRoot, ".nexus-agents");
 }
 function formatMigrationResult(result) {
   if (!result.success) {