npm - nexus-agents - Versions diffs - 2.140.2 → 2.141.0 - Mend

nexus-agents 2.140.2 → 2.141.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/dist/{chunk-66LTZALB.js → chunk-4VCLI2T3.js} +692 -436
package/dist/chunk-4VCLI2T3.js.map +1 -0
package/dist/{chunk-FLDT5YWH.js → chunk-7XOTLM3R.js} +3 -3
package/dist/{chunk-JO2EX53W.js → chunk-VLODTBPY.js} +2 -2
package/dist/cli.js +3 -3
package/dist/index.d.ts +53 -0
package/dist/index.js +2 -2
package/dist/{setup-command-SR7SNTMD.js → setup-command-SP3Q6YW6.js} +3 -3
package/package.json +1 -1
package/dist/chunk-66LTZALB.js.map +0 -1
/package/dist/{chunk-FLDT5YWH.js.map → chunk-7XOTLM3R.js.map} +0 -0
/package/dist/{chunk-JO2EX53W.js.map → chunk-VLODTBPY.js.map} +0 -0
/package/dist/{setup-command-SR7SNTMD.js.map → setup-command-SP3Q6YW6.js.map} +0 -0

package/dist/{chunk-66LTZALB.js → chunk-4VCLI2T3.js} RENAMED Viewed

@@ -18,7 +18,7 @@ import {
   DEFAULT_TASK_TTL_MS,
   DEFAULT_TOOL_RATE_LIMITS,
   clampTaskTtl
-} from "./chunk-FLDT5YWH.js";
+} from "./chunk-7XOTLM3R.js";
 import {
   executeExpert
 } from "./chunk-733ZGAXH.js";
@@ -265,6 +265,7 @@ import {
   isPersistenceEnabled
 } from "./chunk-NL7SZQPW.js";
 import {
+  findRepoRoot,
   nexusDataPath,
   nexusDataPathEnsure
 } from "./chunk-DHVMSIT5.js";
@@ -43928,7 +43929,7 @@ function createAuditStageRegistry() {
 }
 // src/mcp/tools/pr-review-tool.ts
-import { z as z90 } from "zod";
+import { z as z91 } from "zod";
 import { randomUUID as randomUUID13 } from "crypto";
 // src/mcp/tools/pr-review-findings.ts
@@ -44011,6 +44012,312 @@ var FINDINGS_FORMAT_INSTRUCTIONS = `If you have one or more findings (claims tha
 A finding only triggers request_changes if ALL FOUR gate checks are 'passed' AND named_assertion is substantive (>10 chars, naming a concrete failure). Findings missing any of those surface as informational only \u2014 they do not block the merge. This is the #2225 verification gate; the 2026-04-25 audit found a 100% false-positive rate when this gate was not enforced.`;
+// src/audit/reviewed-diff-hash.ts
+import * as crypto2 from "crypto";
+var MAX_REVIEWED_DIFF_BYTES = 5e4;
+var CANONICAL_GIT_DIFF_ARGS = Object.freeze([
+  "-c",
+  "core.autocrlf=false",
+  "-c",
+  "diff.algorithm=myers",
+  "-c",
+  "diff.mnemonicprefix=false",
+  "-c",
+  "diff.noprefix=false",
+  "diff",
+  "--no-color",
+  "--no-ext-diff",
+  "--no-renames",
+  "-U3"
+]);
+function computeReviewedDiffHash(diff) {
+  const bytes = Buffer.from(diff, "utf-8");
+  const truncated = bytes.byteLength > MAX_REVIEWED_DIFF_BYTES ? bytes.subarray(0, MAX_REVIEWED_DIFF_BYTES) : bytes;
+  return crypto2.createHash("sha256").update(truncated).digest("hex");
+}
+function reviewedDiffWasTruncated(diff) {
+  return Buffer.byteLength(diff, "utf-8") > MAX_REVIEWED_DIFF_BYTES;
+}
+// src/audit/pr-review-record-store.ts
+import { appendFileSync as appendFileSync4, existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname4, isAbsolute, join as join9, resolve as resolve12 } from "path";
+// src/audit/pr-review-record.ts
+import * as crypto3 from "crypto";
+import { z as z90 } from "zod";
+var PrReviewVerdictSchema = z90.enum(["approve", "request_changes", "abstain"]);
+var PrReviewVoteCountsSchema = z90.object({
+  approve: z90.number().int().nonnegative(),
+  request_changes: z90.number().int().nonnegative(),
+  abstain: z90.number().int().nonnegative(),
+  error: z90.number().int().nonnegative(),
+  total: z90.number().int().nonnegative()
+}).strict();
+var PrReviewRecordSchema = z90.object({
+  /**
+   * Schema version. '1.1' is the Option-C binding (#3831): the record binds to
+   * `{prNumber, baseSha, reviewedDiffHash}` instead of the rejected `headSha`.
+   * Clean break — the committed `governance/pr-review-records.jsonl` ledger is
+   * empty on every install (no producer ever wrote a '1.0' record), so there is
+   * no '1.0' data to migrate.
+   */
+  version: z90.literal("1.1"),
+  /**
+   * Monotonic sequence number (integer ≥ 0). Assigned as (max existing
+   * sequence)+1 at write time. Sorted, the set of sequences must cover
+   * 0..maxSeq with no gap (omission detection); DUPLICATE sequences are a
+   * benign concurrent-fork signal, not tampering.
+   */
+  sequence: z90.number().int().nonnegative(),
+  /** The PR number the review covers. */
+  prNumber: z90.number().int().positive(),
+  /**
+   * The 40-hex BASE commit SHA the reviewed diff was computed against (the
+   * `<base>..<head>` range base). Part of the Option-C binding so the gate knows
+   * which range to recompute {@link reviewedDiffHash} over.
+   */
+  baseSha: z90.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha"),
+  /**
+   * DIFF-BINDING (Option-C, #3831): sha256 of the canonical reviewed diff bytes
+   * (see `audit/reviewed-diff-hash.ts` — pinned `git diff` invocation + 50k
+   * byte-truncation). The gate recomputes this from the committed PR's diff and
+   * matches it, so a record only satisfies a PR whose reviewed diff is
+   * byte-identical to what the voters saw. Covered by the self-hash below, so it
+   * cannot be edited to claim a different reviewed diff.
+   */
+  reviewedDiffHash: z90.string().length(64),
+  /** ISO-8601 timestamp the review was recorded. */
+  recordedAt: z90.string().min(1),
+  /** The resolved aggregate verdict. */
+  verdict: PrReviewVerdictSchema,
+  /**
+   * Whether the aggregate carried a VERIFIED finding (the 4-point gate). A
+   * `request_changes` with `verified: true` is a strict blocker; covered by the
+   * hash so it cannot be flipped without detection.
+   */
+  verified: z90.boolean(),
+  /** Per-decision voter tally from the pr_review aggregate. */
+  voteCounts: PrReviewVoteCountsSchema,
+  /** Truncated human-readable review summary for the reviewer record. */
+  summary: z90.string(),
+  /** Optional correlation/decision id linking to the cost rollup / trace. */
+  correlationId: z90.string().min(1).optional(),
+  /**
+   * ADVISORY hash of the tip record at write time (absent for the first).
+   * Retained for audit texture but NOT covered by `hash` and NOT verified —
+   * the record-set model is position-independent (mirrors #3927).
+   */
+  previousHash: z90.string().length(64).optional(),
+  /** SHA-256 over every field above EXCEPT `previousHash` (and except `hash`). */
+  hash: z90.string().length(64)
+}).strict();
+function computePrReviewRecordHash(payload) {
+  const canonical = JSON.stringify({
+    version: payload.version,
+    sequence: payload.sequence,
+    prNumber: payload.prNumber,
+    baseSha: payload.baseSha,
+    reviewedDiffHash: payload.reviewedDiffHash,
+    recordedAt: payload.recordedAt,
+    verdict: payload.verdict,
+    verified: payload.verified,
+    // Rebuild voteCounts in schema order so the hash does not depend on how the
+    // nested object's keys were ordered (mirrors #3962).
+    voteCounts: {
+      approve: payload.voteCounts.approve,
+      request_changes: payload.voteCounts.request_changes,
+      abstain: payload.voteCounts.abstain,
+      error: payload.voteCounts.error,
+      total: payload.voteCounts.total
+    },
+    summary: payload.summary,
+    correlationId: payload.correlationId ?? null
+  });
+  return crypto3.createHash("sha256").update(canonical).digest("hex");
+}
+// src/audit/pr-review-record-store.ts
+var PR_REVIEW_RECORDS_REL_PATH = "governance/pr-review-records.jsonl";
+var PR_REVIEW_RECORDS_PATH_ENV = "NEXUS_PR_REVIEW_RECORDS_PATH";
+var MAX_SUMMARY_RECORD_CHARS = 500;
+function buildPrReviewRecord(input) {
+  const summaryTruncated = input.summary.length > MAX_SUMMARY_RECORD_CHARS ? input.summary.slice(0, MAX_SUMMARY_RECORD_CHARS) + "..." : input.summary;
+  const payload = {
+    version: "1.1",
+    sequence: input.sequence ?? 0,
+    prNumber: input.prNumber,
+    baseSha: input.baseSha,
+    reviewedDiffHash: input.reviewedDiffHash,
+    recordedAt: input.recordedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    verdict: input.verdict,
+    verified: input.verified,
+    voteCounts: {
+      approve: input.voteCounts.approve,
+      request_changes: input.voteCounts.request_changes,
+      abstain: input.voteCounts.abstain,
+      error: input.voteCounts.error,
+      total: input.voteCounts.total
+    },
+    summary: summaryTruncated,
+    ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {},
+    ...input.previousHash !== void 0 ? { previousHash: input.previousHash } : {}
+  };
+  return { ...payload, hash: computePrReviewRecordHash(payload) };
+}
+function resolvePrReviewRecordsPath() {
+  const envPath = process.env[PR_REVIEW_RECORDS_PATH_ENV];
+  if (envPath !== void 0 && envPath.trim() !== "") {
+    return isAbsolute(envPath) ? envPath : resolve12(envPath);
+  }
+  const root = findRepoRoot(process.cwd());
+  if (root === null) return void 0;
+  return join9(root, PR_REVIEW_RECORDS_REL_PATH);
+}
+function readPrReviewRecords(filePath) {
+  const records = [];
+  const invalidLines = [];
+  if (!existsSync9(filePath)) return { records, invalidLines };
+  const lines = readFileSync7(filePath, "utf-8").split("\n").filter((l) => l.trim() !== "");
+  for (const [i, line] of lines.entries()) {
+    try {
+      const parsed = PrReviewRecordSchema.safeParse(JSON.parse(line));
+      if (parsed.success) records.push(parsed.data);
+      else invalidLines.push(i + 1);
+    } catch {
+      invalidLines.push(i + 1);
+    }
+  }
+  return { records, invalidLines };
+}
+function readPrReviewLedgerTip(filePath, logger57) {
+  if (!existsSync9(filePath)) return { maxSequence: -1, lastHash: void 0 };
+  try {
+    const { records } = readPrReviewRecords(filePath);
+    if (records.length === 0) return { maxSequence: -1, lastHash: void 0 };
+    let maxSequence = -1;
+    for (const record of records) {
+      if (record.sequence > maxSequence) maxSequence = record.sequence;
+    }
+    const last = records[records.length - 1];
+    return { maxSequence, lastHash: last?.hash };
+  } catch (error) {
+    logger57.warn("Failed to read pr-review-record ledger tip", { error: getErrorMessage(error) });
+    return { maxSequence: -1, lastHash: void 0 };
+  }
+}
+function persistPrReviewRecord(opts) {
+  const logger57 = opts.logger ?? createLogger({ component: "pr-review-record-store" });
+  const filePath = opts.filePath ?? resolvePrReviewRecordsPath();
+  if (filePath === void 0) {
+    logger57.warn("Cannot persist pr-review record: no records path resolved", {
+      prNumber: opts.prNumber
+    });
+    return void 0;
+  }
+  try {
+    mkdirSync6(dirname4(filePath), { recursive: true });
+    const { maxSequence, lastHash } = readPrReviewLedgerTip(filePath, logger57);
+    const record = buildPrReviewRecord({
+      ...opts,
+      sequence: maxSequence + 1,
+      previousHash: lastHash
+    });
+    appendFileSync4(filePath, JSON.stringify(record) + "\n", "utf-8");
+    logger57.info("Persisted authentic pr-review record", {
+      prNumber: record.prNumber,
+      verdict: record.verdict,
+      sequence: record.sequence,
+      path: filePath
+    });
+    return record;
+  } catch (error) {
+    logger57.warn("Failed to persist authentic pr-review record", {
+      error: getErrorMessage(error),
+      prNumber: opts.prNumber,
+      path: filePath
+    });
+    return void 0;
+  }
+}
+// src/mcp/tools/pr-review-record-producer.ts
+function buildAndPersist(prNumber, baseSha, args) {
+  const { input, aggregate, counts, reviewCount, logger: logger57 } = args;
+  if (reviewedDiffWasTruncated(input.prDiff)) {
+    logger57.warn(
+      "Reviewed diff exceeds the hash byte cap; content past it is unbound in reviewedDiffHash",
+      { prNumber }
+    );
+  }
+  const record = persistPrReviewRecord({
+    prNumber,
+    baseSha,
+    reviewedDiffHash: computeReviewedDiffHash(input.prDiff),
+    verdict: aggregate.decision,
+    verified: aggregate.verified,
+    voteCounts: {
+      approve: counts.approveCount,
+      request_changes: counts.requestChangesCount,
+      abstain: counts.abstainCount,
+      error: counts.errorCount,
+      total: reviewCount
+    },
+    summary: `${aggregate.decision} (${String(counts.approveCount)} approve / ${String(counts.requestChangesCount)} request_changes / ${String(counts.abstainCount)} abstain) \u2014 ${input.prTitle}`,
+    logger: logger57
+  });
+  if (record === void 0) {
+    return {
+      persisted: false,
+      reason: "write-failed",
+      detail: "Audit record could not be written: the records path was unresolved or the append failed (see server logs for the underlying cause)."
+    };
+  }
+  return {
+    persisted: true,
+    prNumber: record.prNumber,
+    baseSha: record.baseSha,
+    reviewedDiffHash: record.reviewedDiffHash,
+    sequence: record.sequence
+  };
+}
+function persistReviewRecord(args) {
+  const { input } = args;
+  if (input.prNumber === void 0 || input.baseSha === void 0) {
+    return {
+      persisted: false,
+      reason: "binding-inputs-absent",
+      detail: "No audit record written: supply both prNumber and baseSha to persist an Option-C governor-review record bound to {prNumber, baseSha, reviewedDiffHash}."
+    };
+  }
+  if (input.simulate) {
+    return {
+      persisted: false,
+      reason: "simulated",
+      detail: "No audit record written: the review used simulated voters, and a committed governance record must not be seeded from non-live output (mirrors #2319)."
+    };
+  }
+  const { counts } = args;
+  if (counts.approveCount + counts.requestChangesCount + counts.abstainCount === 0) {
+    return {
+      persisted: false,
+      reason: "no-live-votes",
+      detail: "No audit record written: every voter errored, so the aggregate verdict reflects no live review. A committed governor-review record must not be seeded from a failed panel (the pr_review analogue of no_quorum, #4053)."
+    };
+  }
+  try {
+    return buildAndPersist(input.prNumber, input.baseSha, args);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    args.logger.warn("Audit-record persistence threw (non-fatal)", { detail });
+    return {
+      persisted: false,
+      reason: "write-failed",
+      detail: `Audit record persistence raised: ${detail}`
+    };
+  }
+}
 // src/mcp/tools/pr-review-tool.ts
 var PR_REVIEW_ROLES = [
   "architect",
@@ -44022,14 +44329,29 @@ var PR_REVIEW_ROLES = [
 var MAX_DIFF_LENGTH = 5e4;
 var MAX_DESCRIPTION_LENGTH = 1e4;
 var PR_REVIEW_ASYNC_HINT = "A pr_review run fans out to 5 live LLM voters and can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
-var PrReviewInputSchema = z90.object({
-  prTitle: z90.string().min(1).max(500).describe("PR title"),
-  prDescription: z90.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
-  prDiff: z90.string().min(1).max(MAX_DIFF_LENGTH).describe(`Unified diff text (max ${String(MAX_DIFF_LENGTH)} chars; truncate before calling)`),
-  repoContext: z90.string().max(2e3).optional().describe("Optional one-paragraph repo context (architecture, conventions)"),
-  baseRef: z90.string().max(200).optional().describe("Base branch ref (e.g. main)"),
-  headRef: z90.string().max(200).optional().describe("Head branch ref"),
-  simulate: z90.boolean().default(false).describe("Use simulated voters (testing only; never ship live with this true)"),
+var PrReviewInputSchema = z91.object({
+  prTitle: z91.string().min(1).max(500).describe("PR title"),
+  prDescription: z91.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
+  prDiff: z91.string().min(1).max(MAX_DIFF_LENGTH).describe(`Unified diff text (max ${String(MAX_DIFF_LENGTH)} chars; truncate before calling)`),
+  repoContext: z91.string().max(2e3).optional().describe("Optional one-paragraph repo context (architecture, conventions)"),
+  baseRef: z91.string().max(200).optional().describe("Base branch ref (e.g. main)"),
+  headRef: z91.string().max(200).optional().describe("Head branch ref"),
+  /**
+   * Option-C audit binding (#4031). When BOTH `prNumber` and `baseSha` are
+   * supplied AND the review is live (not simulated), pr_review persists an
+   * authentic, self-hashed pr-review record binding {prNumber, baseSha,
+   * reviewedDiffHash(prDiff), verdict} to the governance ledger — the record the
+   * warn-first governor-review gate (#3831) queries. Omit either to skip
+   * persistence (a structured `recordOutcome` note explains why). IMPORTANT: for
+   * the gate to FIND the record, `prDiff`'s first 50_000 bytes must match the
+   * canonical `git diff <baseSha>..<headSha>` the gate recomputes (the hash
+   * truncates at that byte cap) — pass the canonical diff, not a reordered one.
+   */
+  prNumber: z91.number().int().positive().optional().describe("PR number \u2014 with baseSha, enables Option-C audit-record persistence (#4031)"),
+  baseSha: z91.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha").optional().describe(
+    "40-hex base commit sha the reviewed diff was computed from (Option-C binding, #4031)"
+  ),
+  simulate: z91.boolean().default(false).describe("Use simulated voters (testing only; never ship live with this true)"),
   /**
    * Dispatch mode (#3731). `sync` (default) runs the 5-voter panel inline and
    * returns the result — but a live fan-out can exceed the MCP request timeout.
@@ -44037,7 +44359,7 @@ var PrReviewInputSchema = z90.object({
    * runs the panel in the background; poll `get_job_result({ jobId })` for the
    * result.
    */
-  dispatch: z90.enum(["sync", "async"]).default("sync").describe(
+  dispatch: z91.enum(["sync", "async"]).default("sync").describe(
     "Dispatch mode (#3731). 'sync' (default): run inline. 'async': return a jobId immediately + run the panel in background (poll get_job_result)."
   )
 });
@@ -44171,13 +44493,21 @@ async function executePrReviewBody(input, logger57, gatewayAdapters) {
       error: getErrorMessage(costError)
     });
   }
+  const recordOutcome3 = persistReviewRecord({
+    input,
+    aggregate,
+    counts,
+    reviewCount: reviews.length,
+    logger: logger57
+  });
   const response = {
     summary: aggregate.decision,
     verified: aggregate.verified,
     ...counts,
     reviews,
     totalDurationMs: Date.now() - start,
-    ...costSummary !== void 0 ? { costSummary } : {}
+    ...costSummary !== void 0 ? { costSummary } : {},
+    recordOutcome: recordOutcome3
   };
   return toolSuccess(JSON.stringify(response, null, 2));
 }
@@ -44233,27 +44563,27 @@ function registerPrReviewTool(server, deps) {
 }
 // src/mcp/tools/survey-oss-landscape.ts
-import { z as z91 } from "zod";
-var SurveyOssLandscapeInputSchema = z91.object({
-  query: z91.string().min(1).max(200).describe('Free-text search query, e.g. "cargo nextest replacement" or "OSS SBOM tools"'),
-  maxResults: z91.number().int().min(1).max(50).optional().default(10).describe("Maximum candidates to return (1-50; default 10)"),
-  minStars: z91.number().int().min(0).optional().default(0).describe("Minimum star count to include (default 0; useful for filtering noise)"),
-  language: z91.string().max(50).optional().describe('GitHub language filter, e.g. "rust" or "typescript"')
+import { z as z92 } from "zod";
+var SurveyOssLandscapeInputSchema = z92.object({
+  query: z92.string().min(1).max(200).describe('Free-text search query, e.g. "cargo nextest replacement" or "OSS SBOM tools"'),
+  maxResults: z92.number().int().min(1).max(50).optional().default(10).describe("Maximum candidates to return (1-50; default 10)"),
+  minStars: z92.number().int().min(0).optional().default(0).describe("Minimum star count to include (default 0; useful for filtering noise)"),
+  language: z92.string().max(50).optional().describe('GitHub language filter, e.g. "rust" or "typescript"')
 });
-var GitHubRepoSchema = z91.object({
-  full_name: z91.string().optional(),
-  html_url: z91.string().optional(),
-  description: z91.string().nullable().optional(),
-  stargazers_count: z91.number().optional(),
-  pushed_at: z91.string().nullable().optional(),
-  language: z91.string().nullable().optional(),
-  license: z91.object({
-    spdx_id: z91.string().nullable().optional()
+var GitHubRepoSchema = z92.object({
+  full_name: z92.string().optional(),
+  html_url: z92.string().optional(),
+  description: z92.string().nullable().optional(),
+  stargazers_count: z92.number().optional(),
+  pushed_at: z92.string().nullable().optional(),
+  language: z92.string().nullable().optional(),
+  license: z92.object({
+    spdx_id: z92.string().nullable().optional()
   }).nullable().optional()
 });
-var GitHubSearchResponseSchema = z91.object({
-  total_count: z91.number().optional(),
-  items: z91.array(GitHubRepoSchema).optional()
+var GitHubSearchResponseSchema = z92.object({
+  total_count: z92.number().optional(),
+  items: z92.array(GitHubRepoSchema).optional()
 });
 var GITHUB_SEARCH_BASE = "https://api.github.com/search/repositories";
 function buildGithubQuery(input) {
@@ -44380,11 +44710,11 @@ function createSurveyHandler(deps) {
   };
 }
 var SURVEY_OUTPUT_SCHEMA = {
-  query: z91.string(),
-  totalFound: z91.number(),
-  candidates: z91.array(z91.unknown()),
-  sourcesQueried: z91.array(z91.string()),
-  sourcesFailed: z91.array(z91.string())
+  query: z92.string(),
+  totalFound: z92.number(),
+  candidates: z92.array(z92.unknown()),
+  sourcesQueried: z92.array(z92.string()),
+  sourcesFailed: z92.array(z92.string())
 };
 var SURVEY_DESCRIPTION = 'Transient OSS project search. Returns a ranked list of GitHub repositories with license, last-commit, star-count, and one-line description. Does NOT persist to the research registry \u2014 use `research_add_source` for that. Best for one-off engineering decisions like "what tools exist in this space?".';
 function registerSurveyOssLandscapeTool(server, deps) {
@@ -44413,7 +44743,7 @@ function registerSurveyOssLandscapeTool(server, deps) {
 }
 // src/mcp/tools/vendor-publishing-audit.ts
-import { z as z92 } from "zod";
+import { z as z93 } from "zod";
 // src/mcp/tools/vendor-publishing-seed.ts
 var VENDOR_PUBLISHING_SEED = {
@@ -44486,8 +44816,8 @@ function listKnownVendors() {
 }
 // src/mcp/tools/vendor-publishing-audit.ts
-var VendorPublishingAuditInputSchema = z92.object({
-  vendor: z92.string().min(1).max(50).toLowerCase().describe('Vendor identifier, lowercase. e.g. "ubuntu", "debian", "fedora"')
+var VendorPublishingAuditInputSchema = z93.object({
+  vendor: z93.string().min(1).max(50).toLowerCase().describe('Vendor identifier, lowercase. e.g. "ubuntu", "debian", "fedora"')
 });
 function lookupVendor(vendor) {
   if (isKnownVendor(vendor)) {
@@ -44519,20 +44849,20 @@ function createVendorPublishingAuditHandler(deps) {
   };
 }
 var VENDOR_PUBLISHING_OUTPUT_SCHEMA = {
-  vendor: z92.string(),
-  known: z92.boolean(),
+  vendor: z93.string(),
+  known: z93.boolean(),
   // Fields below populate when known=true; permissive optional for known=false.
-  sha256SumsUrlPattern: z92.string().optional(),
-  sha256SumsSignatureUrlPattern: z92.string().optional(),
-  signaturePattern: z92.string().optional(),
-  gpgKeys: z92.array(z92.unknown()).optional(),
-  releaseCadence: z92.string().optional(),
-  keyRotationNotes: z92.string().optional(),
-  vendorDocUrl: z92.string().optional(),
-  citedAt: z92.string().optional(),
+  sha256SumsUrlPattern: z93.string().optional(),
+  sha256SumsSignatureUrlPattern: z93.string().optional(),
+  signaturePattern: z93.string().optional(),
+  gpgKeys: z93.array(z93.unknown()).optional(),
+  releaseCadence: z93.string().optional(),
+  keyRotationNotes: z93.string().optional(),
+  vendorDocUrl: z93.string().optional(),
+  citedAt: z93.string().optional(),
   // Fields below populate when known=false.
-  message: z92.string().optional(),
-  knownVendors: z92.array(z92.string()).optional()
+  message: z93.string().optional(),
+  knownVendors: z93.array(z93.string()).optional()
 };
 var VENDOR_PUBLISHING_DESCRIPTION = "Look up a vendor's published-artifact signing infrastructure: GPG key fingerprints, SHA256SUMS URL pattern, signature shape (clearsigned / detached / detached-on-iso), release cadence, key rotation notes, and the vendor doc citation. Static lookup against a curated seed dataset; the vendor doc URL is the authoritative source. Returns `{known: false, knownVendors: [...]}` for vendors without a seed entry. v1 covers ubuntu, debian, fedora.";
 function registerVendorPublishingAuditTool(server, deps) {
@@ -44561,17 +44891,17 @@ function registerVendorPublishingAuditTool(server, deps) {
 }
 // src/mcp/tools/compare-data-feeds.ts
-import { z as z93 } from "zod";
+import { z as z94 } from "zod";
 import * as path7 from "path";
 import * as fs8 from "fs";
 import * as yaml2 from "yaml";
-var CompareDataFeedsInputSchema = z93.object({
-  feedAPath: z93.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
-  feedBPath: z93.string().min(1).max(1e3).describe("Filesystem path to feed B"),
-  keyPath: z93.string().min(1).max(200).describe(
+var CompareDataFeedsInputSchema = z94.object({
+  feedAPath: z94.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
+  feedBPath: z94.string().min(1).max(1e3).describe("Filesystem path to feed B"),
+  keyPath: z94.string().min(1).max(200).describe(
     'Dotted path to the entry key, e.g. "id" or "name". Each entry must have this field.'
   ),
-  compareFields: z93.array(z93.string().min(1).max(200)).max(20).optional().describe(
+  compareFields: z94.array(z94.string().min(1).max(200)).max(20).optional().describe(
     'Optional dotted field paths to compare across matched entries (e.g. ["license", "sha256"])'
   )
 });
@@ -44755,24 +45085,24 @@ function createCompareDataFeedsHandler(deps) {
   };
 }
 var COMPARE_OUTPUT_SCHEMA = {
-  feedAPath: z93.string(),
-  feedBPath: z93.string(),
-  keyPath: z93.string(),
-  counts: z93.object({
-    entriesInA: z93.number(),
-    entriesInB: z93.number(),
-    onlyInA: z93.number(),
-    onlyInB: z93.number(),
-    inBoth: z93.number(),
-    fieldDifferences: z93.number()
+  feedAPath: z94.string(),
+  feedBPath: z94.string(),
+  keyPath: z94.string(),
+  counts: z94.object({
+    entriesInA: z94.number(),
+    entriesInB: z94.number(),
+    onlyInA: z94.number(),
+    onlyInB: z94.number(),
+    inBoth: z94.number(),
+    fieldDifferences: z94.number()
   }),
-  coverage: z93.object({
-    onlyInA: z93.array(z93.string()),
-    onlyInB: z93.array(z93.string()),
-    inBoth: z93.array(z93.string())
+  coverage: z94.object({
+    onlyInA: z94.array(z94.string()),
+    onlyInB: z94.array(z94.string()),
+    inBoth: z94.array(z94.string())
   }),
-  fieldDifferences: z93.array(z93.unknown()),
-  summary: z93.string()
+  fieldDifferences: z94.array(z94.unknown()),
+  summary: z94.string()
 };
 var COMPARE_DESCRIPTION = "Diff two upstream data feeds (YAML or JSON files) along coverage and per-field axes. Returns which entries exist in A, B, both, plus optional field-level diffs across matched entries. v1 takes file paths only (no URL fetch \u2014 that needs an SSRF design pass). Both feeds must be a top-level array OR a top-level object with exactly one array field.";
 function registerCompareDataFeedsTool(server, deps) {
@@ -44801,9 +45131,9 @@ function registerCompareDataFeedsTool(server, deps) {
 }
 // src/mcp/tools/query-task-state-tool.ts
-import { z as z94 } from "zod";
-var QueryTaskStateInputSchema = z94.object({
-  taskId: z94.string().min(1).max(128).describe("Task ID whose structured state log should be read")
+import { z as z95 } from "zod";
+var QueryTaskStateInputSchema = z95.object({
+  taskId: z95.string().min(1).max(128).describe("Task ID whose structured state log should be read")
 });
 function queryTaskStateHandler(args, ctx) {
   const parsed = QueryTaskStateInputSchema.safeParse(args);
@@ -44838,7 +45168,7 @@ function queryTaskStateHandler(args, ctx) {
 function registerQueryTaskStateTool(server, deps) {
   const logger57 = deps.logger ?? createLogger({ tool: "query_task_state" });
   const toolSchema = {
-    taskId: z94.string().min(1).max(128).describe("Task ID whose structured state log should be read")
+    taskId: z95.string().min(1).max(128).describe("Task ID whose structured state log should be read")
   };
   const description = "Read the structured state log for a task ID and return the current snapshot. Includes Magentic-One Task Ledger (facts/guesses/openQuestions) and Progress Ledger (per-step reflections with suggestedAction) when orchestrators have written them. Structured state is only written when NEXUS_TASK_STATE_ENABLED=1 was set during the orchestrate invocation.";
   const secureHandler = createSecureHandler(queryTaskStateHandler, {
@@ -44860,28 +45190,28 @@ function registerQueryTaskStateTool(server, deps) {
 }
 // src/mcp/tools/ci-health-check-tool.ts
-import { z as z97 } from "zod";
+import { z as z98 } from "zod";
 // src/mcp/tools/ci-health-log.ts
-import { appendFileSync as appendFileSync4, existsSync as existsSync10, readFileSync as readFileSync8, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
-import { z as z96 } from "zod";
+import { appendFileSync as appendFileSync5, existsSync as existsSync11, readFileSync as readFileSync9, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
+import { z as z97 } from "zod";
 // src/mcp/tools/ci-health-types.ts
-import { z as z95 } from "zod";
-var CiHealthStatusSchema = z95.enum(["healthy", "degraded", "outage", "unknown"]);
+import { z as z96 } from "zod";
+var CiHealthStatusSchema = z96.enum(["healthy", "degraded", "outage", "unknown"]);
 // src/mcp/tools/ci-health-log.ts
 var logger45 = createLogger({ component: "ci-health-log" });
-var CiHealthEventSchema = z96.object({
-  v: z96.literal(1),
-  ts: z96.iso.datetime(),
+var CiHealthEventSchema = z97.object({
+  v: z97.literal(1),
+  ts: z97.iso.datetime(),
   status: CiHealthStatusSchema,
-  repo: z96.string().optional(),
-  signals: z96.array(
-    z96.object({
-      source: z96.enum(["github-status", "repo-activity-window"]),
+  repo: z97.string().optional(),
+  signals: z97.array(
+    z97.object({
+      source: z97.enum(["github-status", "repo-activity-window"]),
       status: CiHealthStatusSchema,
-      evidence: z96.string()
+      evidence: z97.string()
     })
   )
 });
@@ -44905,7 +45235,7 @@ function capLogSize(path12) {
   }
   if (size <= max) return;
   try {
-    const lines = readFileSync8(path12, "utf-8").split("\n").filter((l) => l !== "");
+    const lines = readFileSync9(path12, "utf-8").split("\n").filter((l) => l !== "");
     const kept = [];
     let bytes = 0;
     for (let i = lines.length - 1; i >= 0; i--) {
@@ -44939,7 +45269,7 @@ function appendCiHealthEvent(event) {
   };
   try {
     const path12 = logFilePath();
-    appendFileSync4(path12, `${JSON.stringify(record)}
+    appendFileSync5(path12, `${JSON.stringify(record)}
 `);
     capLogSize(path12);
   } catch (err2) {
@@ -44961,17 +45291,17 @@ function eventFromCheck(params) {
 }
 // src/mcp/tools/ci-health-check-tool.ts
-var CiHealthCheckInputSchema = z97.object({
+var CiHealthCheckInputSchema = z98.object({
   /**
    * Repo to check for the recent-runs activity signal (in `owner/repo` form).
    * Optional — when omitted, only the status-page signal is consulted.
    */
-  repo: z97.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
+  repo: z98.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
   /**
    * How far back to look for recent-runs activity (minutes). Default 30 —
    * matches the typical wedge-detection window from the #3070 / #3076 outages.
    */
-  activityWindowMinutes: z97.number().int().min(5).max(180).default(30).describe("Recent-runs lookback window in minutes (5-180; default 30).")
+  activityWindowMinutes: z98.number().int().min(5).max(180).default(30).describe("Recent-runs lookback window in minutes (5-180; default 30).")
 });
 var STATUS_PAGE_URL = "https://www.githubstatus.com/api/v2/components.json";
 function mapStatusPageStatus(raw) {
@@ -45104,8 +45434,8 @@ var DESCRIPTION = "Check CI infrastructure health before triggering / polling ru
 function registerCiHealthCheckTool(server, deps) {
   const logger57 = deps.logger ?? createLogger({ tool: "ci_health_check" });
   const toolSchema = {
-    repo: z97.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
-    activityWindowMinutes: z97.number().int().min(5).max(180).optional().describe("Recent-runs lookback window in minutes (5-180; default 30).")
+    repo: z98.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
+    activityWindowMinutes: z98.number().int().min(5).max(180).optional().describe("Recent-runs lookback window in minutes (5-180; default 30).")
   };
   const secureHandler = createSecureHandler((args) => ciHealthCheckHandler(args, logger57), {
     toolName: "ci_health_check",
@@ -45131,18 +45461,18 @@ function registerCiHealthCheckTool(server, deps) {
 // src/mcp/tools/quality-gate-tool.ts
 import { statSync as statSync3 } from "fs";
-import { z as z98 } from "zod";
-var QualityCheckSchema = z98.enum(["typecheck", "lint", "tests", "build", "security"]);
+import { z as z99 } from "zod";
+var QualityCheckSchema = z99.enum(["typecheck", "lint", "tests", "build", "security"]);
 var DEFAULT_CHECKS = ["typecheck", "lint", "tests"];
-var RunQualityGateInputSchema = z98.object({
+var RunQualityGateInputSchema = z99.object({
   /** Project directory to run checks against. Must resolve inside the repo/cwd root. */
-  projectDir: z98.string().optional().describe(
+  projectDir: z99.string().optional().describe(
     "Project directory to run checks against (default: cwd). Must stay inside the repo root."
   ),
   /** Which allowlisted checks to run. */
-  checks: z98.array(QualityCheckSchema).nonempty().default([...DEFAULT_CHECKS]).describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
+  checks: z99.array(QualityCheckSchema).nonempty().default([...DEFAULT_CHECKS]).describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
   /** 1-based iteration counter, forwarded to the engine for feedback context. */
-  iteration: z98.number().int().min(1).default(1).describe("1-based iteration number (default 1).")
+  iteration: z99.number().int().min(1).default(1).describe("1-based iteration number (default 1).")
 });
 function validateProjectDir(raw) {
   const candidate = raw ?? process.cwd();
@@ -45217,11 +45547,11 @@ var DESCRIPTION2 = "Run the QA quality gate (#1684 engine) against a project dir
 function registerRunQualityGateTool(server, deps) {
   const logger57 = deps.logger ?? createLogger({ tool: "run_quality_gate" });
   const toolSchema = {
-    projectDir: z98.string().optional().describe(
+    projectDir: z99.string().optional().describe(
       "Project directory to run checks against (default: cwd). Must stay inside the repo root."
     ),
-    checks: z98.array(QualityCheckSchema).nonempty().optional().describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
-    iteration: z98.number().int().min(1).optional().describe("1-based iteration number (default 1).")
+    checks: z99.array(QualityCheckSchema).nonempty().optional().describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
+    iteration: z99.number().int().min(1).optional().describe("1-based iteration number (default 1).")
   };
   const secureHandler = createSecureHandler(
     (args) => runQualityGateHandler(args, logger57),
@@ -45251,9 +45581,9 @@ function registerRunQualityGateTool(server, deps) {
 // src/mcp/tools/verify-audit-chain-tool.ts
 import * as fs9 from "fs/promises";
 import * as path8 from "path";
-import { z as z99 } from "zod";
-var VerifyAuditChainInputSchema = z99.object({
-  logDir: z99.string().min(1).max(512).describe(
+import { z as z100 } from "zod";
+var VerifyAuditChainInputSchema = z100.object({
+  logDir: z100.string().min(1).max(512).describe(
     "Filesystem path to the FileAuditStorage log directory. Tool reads all `audit-*.jsonl` files in lexicographic order and verifies the combined chain."
   )
 });
@@ -45330,7 +45660,7 @@ async function handler2(args, ctx) {
 function registerVerifyAuditChainTool(server, deps) {
   const logger57 = deps.logger ?? createLogger({ tool: "verify_audit_chain" });
   const toolSchema = {
-    logDir: z99.string().min(1).max(512).describe(
+    logDir: z100.string().min(1).max(512).describe(
       "Filesystem path to the FileAuditStorage log directory. Tool reads all `audit-*.jsonl` files and verifies the combined hash chain."
     )
   };
@@ -45354,7 +45684,7 @@ function registerVerifyAuditChainTool(server, deps) {
 }
 // src/mcp/tools/suggest-research-tasks-tool.ts
-import { z as z100 } from "zod";
+import { z as z101 } from "zod";
 var SUGGEST_RESEARCH_TASKS_NOTE = "Suggestions derived from external research (untrusted); review before acting \u2014 nothing was executed or filed.";
 var RESEARCH_BUDGET_MS = 2e4;
 var RESEARCH_TIMED_OUT = /* @__PURE__ */ Symbol("research-budget-exceeded");
@@ -45371,11 +45701,11 @@ async function withResearchBudget(p, ms) {
     if (timer !== void 0) clearTimeout(timer);
   }
 }
-var SuggestResearchTasksInputSchema = z100.object({
-  topic: z100.string().optional().describe("Topic filter passed to research_discover. Optional."),
-  qualityThreshold: z100.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
-  maxTriggers: z100.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
-  existingTaskIds: z100.array(z100.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
+var SuggestResearchTasksInputSchema = z101.object({
+  topic: z101.string().optional().describe("Topic filter passed to research_discover. Optional."),
+  qualityThreshold: z101.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
+  maxTriggers: z101.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
+  existingTaskIds: z101.array(z101.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
 });
 function toTriggerConfig(input) {
   return {
@@ -45432,10 +45762,10 @@ var DESCRIPTION3 = "SUGGEST-ONLY: surface candidate pipeline tasks for human/orc
 function registerSuggestResearchTasksTool(server, deps) {
   const logger57 = deps.logger ?? createLogger({ tool: "suggest_research_tasks" });
   const toolSchema = {
-    topic: z100.string().optional().describe("Topic filter passed to research_discover. Optional."),
-    qualityThreshold: z100.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
-    maxTriggers: z100.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
-    existingTaskIds: z100.array(z100.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
+    topic: z101.string().optional().describe("Topic filter passed to research_discover. Optional."),
+    qualityThreshold: z101.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
+    maxTriggers: z101.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
+    existingTaskIds: z101.array(z101.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
   };
   const secureHandler = createSecureHandler(
     (args) => suggestResearchTasksHandler(args, logger57),
@@ -45463,7 +45793,7 @@ function registerSuggestResearchTasksTool(server, deps) {
 }
 // src/mcp/tools/run-tool.ts
-import { z as z104 } from "zod";
+import { z as z105 } from "zod";
 import { randomUUID as randomUUID17 } from "crypto";
 // src/orchestration/meta-orchestrator.ts
@@ -45708,8 +46038,8 @@ function createMetaOrchestrator(options) {
 }
 // src/orchestration/meta-shadow-selector.ts
-import { appendFileSync as appendFileSync5, existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
-import { z as z101 } from "zod";
+import { appendFileSync as appendFileSync6, existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
+import { z as z102 } from "zod";
 var SHADOW_STRATEGY_ARMS = [
   "single-shot",
   "dev-pipeline",
@@ -45790,19 +46120,19 @@ function createHydratableSelector() {
 var META_OUTCOME_SCHEMA_VERSION = 1;
 var HYDRATE_LOOKBACK_DAYS = 30;
 var HYDRATE_LOOKBACK_MS = HYDRATE_LOOKBACK_DAYS * 24 * 60 * 60 * 1e3;
-var PersistedContextSchema = z101.object({
-  taskComplexity: z101.number(),
-  contextLengthNormalized: z101.number(),
-  isCodeTask: z101.number(),
-  isReasoningTask: z101.number(),
-  budgetUtilization: z101.number(),
-  timePressure: z101.number()
+var PersistedContextSchema = z102.object({
+  taskComplexity: z102.number(),
+  contextLengthNormalized: z102.number(),
+  isCodeTask: z102.number(),
+  isReasoningTask: z102.number(),
+  budgetUtilization: z102.number(),
+  timePressure: z102.number()
 });
-var PersistedMetaOutcomeSchema = z101.object({
-  schema: z101.literal(META_OUTCOME_SCHEMA_VERSION),
-  timestamp: z101.string(),
-  strategy: z101.enum(SHADOW_STRATEGY_ARMS),
-  success: z101.boolean(),
+var PersistedMetaOutcomeSchema = z102.object({
+  schema: z102.literal(META_OUTCOME_SCHEMA_VERSION),
+  timestamp: z102.string(),
+  strategy: z102.enum(SHADOW_STRATEGY_ARMS),
+  success: z102.boolean(),
   context: PersistedContextSchema
 });
 var persistLogger = createLogger({ component: "MetaShadowSelector" });
@@ -45816,7 +46146,7 @@ function persistMetaOutcome(strategy, decision, success) {
   };
   try {
     ensureLearningDir();
-    appendFileSync5(getMetaOutcomesFile(), JSON.stringify(record) + "\n", "utf-8");
+    appendFileSync6(getMetaOutcomesFile(), JSON.stringify(record) + "\n", "utf-8");
   } catch (err2) {
     persistLogger.warn("Failed to persist meta-outcome (ignored)", {
       error: getErrorMessage(err2)
@@ -45827,11 +46157,11 @@ function hydrateShadowSelector(selector) {
   const hydratable = selector;
   if (typeof hydratable.recordFromContext !== "function") return 0;
   const file = getMetaOutcomesFile();
-  if (!existsSync11(file)) return 0;
+  if (!existsSync12(file)) return 0;
   let replayed = 0;
   try {
     const cutoff = Date.now() - HYDRATE_LOOKBACK_MS;
-    const lines = readFileSync9(file, "utf-8").split("\n").filter((l) => l.trim().length > 0);
+    const lines = readFileSync10(file, "utf-8").split("\n").filter((l) => l.trim().length > 0);
     for (const line of lines) {
       let parsed;
       try {
@@ -45973,7 +46303,7 @@ function createMetaDispatcher(options) {
 }
 // src/mcp/tools/dev-pipeline-tool.ts
-import { z as z102 } from "zod";
+import { z as z103 } from "zod";
 import * as fs11 from "fs";
 import * as path10 from "path";
 import { randomUUID as randomUUID15 } from "crypto";
@@ -46122,36 +46452,36 @@ function createTaskTracker(config) {
 // src/mcp/tools/dev-pipeline-tool.ts
 var DEV_PIPELINE_ASYNC_HINT = "A full run_dev_pipeline run can exceed the 900s synchronous MCP timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
-var DevPipelineInputSchema = z102.object({
+var DevPipelineInputSchema = z103.object({
   /** Direct task instructions. */
-  task: z102.string().max(1e4).optional().describe("Direct task instructions (what to build)"),
+  task: z103.string().max(1e4).optional().describe("Direct task instructions (what to build)"),
   /** Path to a plan file (.md, .yaml, .txt) to use as input. */
-  planFile: z102.string().max(500).optional().describe("Path to a plan/spec file to use as input"),
+  planFile: z103.string().max(500).optional().describe("Path to a plan/spec file to use as input"),
   /** Whether to run in dry-run mode (plan+vote only, no implementation). */
-  dryRun: z102.boolean().default(false).describe("If true, stop after plan+vote (no implementation)"),
+  dryRun: z103.boolean().default(false).describe("If true, stop after plan+vote (no implementation)"),
   /** Maximum vote iterations before proceeding (default: 3). */
-  maxVoteIterations: z102.number().int().min(1).max(5).default(3).describe("Max plan\u2192vote iterations"),
+  maxVoteIterations: z103.number().int().min(1).max(5).default(3).describe("Max plan\u2192vote iterations"),
   /** Maximum QA iterations per task (default: 3). */
-  maxQaIterations: z102.number().int().min(1).max(5).default(3).describe("Max QA review iterations per task"),
+  maxQaIterations: z103.number().int().min(1).max(5).default(3).describe("Max QA review iterations per task"),
   /** Working directory for the pipeline (default: cwd). Used for security scan and context. */
-  workingDir: z102.string().max(500).optional().describe("Working directory (default: cwd)"),
+  workingDir: z103.string().max(500).optional().describe("Working directory (default: cwd)"),
   /** GitHub issue number to track progress on. Updates posted as comments. */
-  issueNumber: z102.number().int().positive().optional().describe("GitHub issue to post progress to"),
+  issueNumber: z103.number().int().positive().optional().describe("GitHub issue to post progress to"),
   /** GitHub repo (owner/name) for issue tracking. */
-  repo: z102.string().max(200).optional().describe("GitHub repo for issue tracking (e.g., owner/repo)"),
+  repo: z103.string().max(200).optional().describe("GitHub repo for issue tracking (e.g., owner/repo)"),
   /** Task tracking backend: github, gitlab, or json (default: json). */
-  trackerBackend: z102.enum(["github", "gitlab", "json"]).default("json").describe("Task tracking backend for issue creation"),
+  trackerBackend: z103.enum(["github", "gitlab", "json"]).default("json").describe("Task tracking backend for issue creation"),
   /** Labels to apply to created issues. */
-  labels: z102.array(z102.string()).optional().describe("Labels for created issues"),
+  labels: z103.array(z103.string()).optional().describe("Labels for created issues"),
   /** Session ID for checkpoint/resume. Enables crash recovery. */
-  sessionId: z102.string().max(128).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Session ID for checkpoint/resume (crash recovery)"),
+  sessionId: z103.string().max(128).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Session ID for checkpoint/resume (crash recovery)"),
   /**
    * TESTS ONLY — when true, voters return random decisions. Must not be used as
    * a fallback when adapters are unavailable; configure an adapter instead. (#2319)
    */
-  simulateVotes: z102.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)"),
+  simulateVotes: z103.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)"),
   /** Voting strategy for consensus stages. */
-  votingStrategy: z102.enum([
+  votingStrategy: z103.enum([
     "simple_majority",
     "supermajority",
     "unanimous",
@@ -46160,11 +46490,11 @@ var DevPipelineInputSchema = z102.object({
     "opinion_wise"
   ]).optional().describe("Voting strategy for plan approval (default: higher_order)"),
   /** Use 3 agents instead of 6 for faster voting. */
-  quickMode: z102.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
+  quickMode: z103.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
   /** Maximum execution time per stage in milliseconds (min 30s, max 600s). */
-  timeoutMs: z102.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
+  timeoutMs: z103.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
   /** Pipeline execution mode. */
-  mode: z102.enum(["autonomous", "harness"]).default("autonomous").describe(
+  mode: z103.enum(["autonomous", "harness"]).default("autonomous").describe(
     "'autonomous': full pipeline. 'harness': stops after decompose, returns tasks for caller to implement."
   ),
   /**
@@ -46175,15 +46505,15 @@ var DevPipelineInputSchema = z102.object({
    * `get_job_result({ jobId })` for the result. Ignored when `dryRun` is
    * true (plan+vote completes fast, so dry runs always stay sync).
    */
-  dispatch: z102.enum(["sync", "async"]).default("sync").describe(
+  dispatch: z103.enum(["sync", "async"]).default("sync").describe(
     "Dispatch mode (#3726). 'sync' (default): run inline. 'async': return a jobId immediately + run in background (poll get_job_result). Ignored for dryRun."
   ),
   /** Local pre-ship quality gate (typecheck/lint/tests) mode (#3356). */
-  qualityGate: z102.enum(["off", "advisory", "blocking"]).default("off").describe(
+  qualityGate: z103.enum(["off", "advisory", "blocking"]).default("off").describe(
     "Pre-ship local quality gate. 'off' (default): skip. 'advisory': run + record feedback, never fail. 'blocking': a red gate fails the pipeline."
   ),
   /** Opt-in per-run token budget — a safety cap for unattended runs (#3395). */
-  maxBudgetTokens: z102.number().int().positive().optional().describe(
+  maxBudgetTokens: z103.number().int().positive().optional().describe(
     "Per-run token ceiling (#3395). When set, expert calls stop (returning failures) once cumulative usage crosses it \u2014 a hard-stop safety cap for unattended/multi-day runs. Omit to disable (default)."
   )
 });
@@ -46348,20 +46678,20 @@ function registerDevPipelineTool(server, deps) {
 }
 // src/mcp/tools/pipeline-tool.ts
-import { z as z103 } from "zod";
+import { z as z104 } from "zod";
 import * as fs12 from "fs";
 import * as path11 from "path";
 import { randomUUID as randomUUID16 } from "crypto";
 var PIPELINE_ASYNC_HINT = "A full run_pipeline run can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
-var PipelineInputSchema = z103.object({
+var PipelineInputSchema = z104.object({
   /** The task to execute. */
-  task: z103.string().min(5).max(1e4).describe("Task description \u2014 pipeline template auto-selected based on content"),
+  task: z104.string().min(5).max(1e4).describe("Task description \u2014 pipeline template auto-selected based on content"),
   /** Path to a spec file (.md, .yaml) to use as task input. */
-  specFile: z103.string().max(500).optional().describe("Path to a spec file \u2014 content prepended to task for greenfield projects"),
+  specFile: z104.string().max(500).optional().describe("Path to a spec file \u2014 content prepended to task for greenfield projects"),
   /** Override template — see `listTemplateIds()` for the canonical list (#2728). Auto-detected if omitted. */
-  template: z103.string().max(50).optional().describe(`Pipeline template override. Available: ${listTemplateIds().join(", ")}`),
+  template: z104.string().max(50).optional().describe(`Pipeline template override. Available: ${listTemplateIds().join(", ")}`),
   /** Voting strategy for consensus stages. */
-  votingStrategy: z103.enum([
+  votingStrategy: z104.enum([
     "simple_majority",
     "supermajority",
     "unanimous",
@@ -46372,11 +46702,11 @@ var PipelineInputSchema = z103.object({
     "Voting strategy for plan approval. simple_majority (default), supermajority (67%), unanimous, higher_order (Bayesian), proof_of_learning, opinion_wise"
   ),
   /** Use 3 agents instead of 6 for faster voting. */
-  quickMode: z103.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
+  quickMode: z104.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
   /** Maximum execution time per stage in milliseconds (min 30s, max 600s). */
-  timeoutMs: z103.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
+  timeoutMs: z104.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
   /** Stop after planning/voting (no implementation). */
-  dryRun: z103.boolean().default(false).describe("Stop after vote stage (no implementation)"),
+  dryRun: z104.boolean().default(false).describe("Stop after vote stage (no implementation)"),
   /**
    * Dispatch mode (#3730). `sync` (default) runs the pipeline inline and
    * returns the result — but a real multi-stage adaptive run can exceed the
@@ -46385,11 +46715,11 @@ var PipelineInputSchema = z103.object({
    * `get_job_result({ jobId })` for the result. Ignored when `dryRun` is true
    * (plan+vote completes fast, so dry runs always stay sync).
    */
-  dispatch: z103.enum(["sync", "async"]).default("sync").describe(
+  dispatch: z104.enum(["sync", "async"]).default("sync").describe(
     "Dispatch mode (#3730). 'sync' (default): run inline. 'async': return a jobId immediately + run in background (poll get_job_result). Ignored for dryRun."
   ),
   /** TESTS ONLY — random output, must not be used for real decisions. (#2319) */
-  simulateVotes: z103.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
+  simulateVotes: z104.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
 });
 function buildOutput2(result) {
   return {
@@ -46535,9 +46865,9 @@ function registerPipelineTool(server, deps) {
 }
 // src/mcp/tools/run-tool.ts
-var RunInputSchema = z104.object({
-  goal: z104.string().min(1).describe("Natural-language goal. nexus-agents selects how to execute it."),
-  forceStrategy: z104.enum([
+var RunInputSchema = z105.object({
+  goal: z105.string().min(1).describe("Natural-language goal. nexus-agents selects how to execute it."),
+  forceStrategy: z105.enum([
     "single-shot",
     "dev-pipeline",
     "pipeline",
@@ -46549,10 +46879,10 @@ var RunInputSchema = z104.object({
   ]).optional().describe(
     "Power-user override: force a specific strategy instead of letting the router choose."
   ),
-  requiresConsensus: z104.boolean().optional().describe("Hint: the task needs a multi-perspective consensus decision."),
-  dependencyStructure: z104.enum(["linear", "dag", "independent", "unknown"]).optional().describe("Hint: the dependency structure of the work."),
-  isNovel: z104.boolean().optional().describe("Hint: this kind of task has not been seen before."),
-  execute: z104.boolean().optional().describe(
+  requiresConsensus: z105.boolean().optional().describe("Hint: the task needs a multi-perspective consensus decision."),
+  dependencyStructure: z105.enum(["linear", "dag", "independent", "unknown"]).optional().describe("Hint: the dependency structure of the work."),
+  isNovel: z105.boolean().optional().describe("Hint: this kind of task has not been seen before."),
+  execute: z105.boolean().optional().describe(
     "When true, actually run the selected strategy (if an executor is wired) and return its result; otherwise return the routing decision only (default false, read-only)."
   ),
   /**
@@ -46563,7 +46893,7 @@ var RunInputSchema = z104.object({
    * envelope immediately and runs in the background; poll
    * `get_job_result({ jobId })`. Ignored for read-only routing (execute:false).
    */
-  dispatch: z104.enum(["sync", "async"]).optional().describe(
+  dispatch: z105.enum(["sync", "async"]).optional().describe(
     "Dispatch mode (#3732). 'sync' (default): run inline. 'async' (only with execute:true): return a jobId immediately + run in background (poll get_job_result)."
   )
 });
@@ -46733,12 +47063,12 @@ function registerRunTool(server, deps) {
 }
 // src/mcp/tools/list-available-models-tool.ts
-import { z as z105 } from "zod";
+import { z as z106 } from "zod";
 var DESCRIPTION5 = "Probe every model-discovery transport (OpenRouter API + opencode/claude/codex/gemini CLIs) and report a per-transport health summary: probe ok/failed, model count, and a sample of ids. Use it to validate the CLIs and APIs are wired and reachable. Read-only; does not change routing.";
 var PROBE_TIMEOUT_MS = 12e3;
-var ListAvailableModelsInputSchema = z105.object({
-  includeModelIds: z105.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
-  includeOpenRouter: z105.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
+var ListAvailableModelsInputSchema = z106.object({
+  includeModelIds: z106.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
+  includeOpenRouter: z106.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
 });
 async function probeSource(source, includeModelIds) {
   let timer;
@@ -46802,8 +47132,8 @@ async function listAvailableModelsHandler(args, deps, logger57) {
 function registerListAvailableModelsTool(server, deps) {
   const logger57 = deps.logger ?? createLogger({ tool: "list_available_models" });
   const toolSchema = {
-    includeModelIds: z105.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
-    includeOpenRouter: z105.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
+    includeModelIds: z106.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
+    includeOpenRouter: z106.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
   };
   const secureHandler = createSecureHandler(
     (args) => listAvailableModelsHandler(args, deps, logger57),
@@ -46827,7 +47157,7 @@ function registerListAvailableModelsTool(server, deps) {
 }
 // src/mcp/tools/pr-review-eval-types.ts
-import { z as z106 } from "zod";
+import { z as z107 } from "zod";
 var PR_REVIEW_EVAL_ROLES = [
   "architect",
   "security",
@@ -46835,43 +47165,43 @@ var PR_REVIEW_EVAL_ROLES = [
   "catfish",
   "scope_steward"
 ];
-var PrReviewEvalRoleSchema = z106.enum(PR_REVIEW_EVAL_ROLES);
-var PrReviewCaseClassSchema = z106.enum(["buggy", "clean", "borderline"]);
-var VoterEvalVerdictSchema = z106.object({
+var PrReviewEvalRoleSchema = z107.enum(PR_REVIEW_EVAL_ROLES);
+var PrReviewCaseClassSchema = z107.enum(["buggy", "clean", "borderline"]);
+var VoterEvalVerdictSchema = z107.object({
   /** Stable record id (e.g. `${runId}:${caseNumber}:${role}`). */
-  id: z106.string().min(1).max(160),
+  id: z107.string().min(1).max(160),
   /** The pr_review run / batch this verdict belongs to. */
-  runId: z106.string().min(1).max(64),
+  runId: z107.string().min(1).max(64),
   /** Dataset case identifier (the dataset's `number` field). */
-  caseNumber: z106.string().min(1).max(80),
+  caseNumber: z107.string().min(1).max(80),
   /** Rubric class of the case (ground-truth label). */
   caseClass: PrReviewCaseClassSchema,
   /** The voter role being scored. */
   role: PrReviewEvalRoleSchema,
   /** Verified findings that matched a known bug. */
-  truePositives: z106.number().int().nonnegative(),
+  truePositives: z107.number().int().nonnegative(),
   /** Verified findings on clean code that matched no known bug. */
-  falsePositives: z106.number().int().nonnegative(),
+  falsePositives: z107.number().int().nonnegative(),
   /** Known bugs this voter failed to flag. */
-  falseNegatives: z106.number().int().nonnegative(),
+  falseNegatives: z107.number().int().nonnegative(),
   /** Rubric version the ground truth was adjudicated under. */
-  rubricVersion: z106.string().min(1).max(32),
+  rubricVersion: z107.string().min(1).max(32),
   /** ISO-8601 timestamp the verdict was recorded. */
-  timestamp: z106.string().min(1).max(40)
+  timestamp: z107.string().min(1).max(40)
 });
-var VoterEvalVerdictQuerySchema = z106.object({
+var VoterEvalVerdictQuerySchema = z107.object({
   role: PrReviewEvalRoleSchema.optional(),
-  runId: z106.string().min(1).max(64).optional(),
+  runId: z107.string().min(1).max(64).optional(),
   caseClass: PrReviewCaseClassSchema.optional(),
-  rubricVersion: z106.string().min(1).max(32).optional(),
+  rubricVersion: z107.string().min(1).max(32).optional(),
   /** ISO-8601 lower bound (inclusive) on `timestamp`. */
-  since: z106.string().optional(),
+  since: z107.string().optional(),
   /** Most-recent-N cap. */
-  limit: z106.number().int().positive().optional()
+  limit: z107.number().int().positive().optional()
 });
 // src/mcp/tools/supply-chain-tradeoff-panel.ts
-import { z as z107 } from "zod";
+import { z as z108 } from "zod";
 import { randomUUID as randomUUID18 } from "crypto";
 var DEFAULT_AXES = [
   "build_time_determinism",
@@ -46893,16 +47223,16 @@ var FULL_PANEL = [
   "scope_steward"
 ];
 var QUICK_PANEL = ["architect", "security", "scope_steward"];
-var SupplyChainTradeoffPanelInputSchema = z107.object({
-  proposal: z107.string().min(1).max(MAX_PROPOSAL_LENGTH).describe('The proposal under tradeoff review (e.g. "Should aegis-boot adopt cargo-nextest?")'),
-  axes: z107.array(z107.string().min(1).max(MAX_AXIS_NAME_LENGTH)).min(1).max(MAX_AXES).optional().describe(
+var SupplyChainTradeoffPanelInputSchema = z108.object({
+  proposal: z108.string().min(1).max(MAX_PROPOSAL_LENGTH).describe('The proposal under tradeoff review (e.g. "Should aegis-boot adopt cargo-nextest?")'),
+  axes: z108.array(z108.string().min(1).max(MAX_AXIS_NAME_LENGTH)).min(1).max(MAX_AXES).optional().describe(
     `Tradeoff axes to evaluate. Default: ${DEFAULT_AXES.join(", ")}. Custom axes accepted; max ${String(MAX_AXES)}.`
   ),
-  context: z107.string().max(MAX_CONTEXT_LENGTH).optional().describe(
+  context: z108.string().max(MAX_CONTEXT_LENGTH).optional().describe(
     "Optional context: relevant repo state, dependency tree, vendor publishing patterns, etc."
   ),
-  quickMode: z107.boolean().optional().default(false).describe("Use 3 voters (architect, security, scope_steward) instead of 7"),
-  simulate: z107.boolean().optional().default(false).describe("Use simulated voters (testing only)"),
+  quickMode: z108.boolean().optional().default(false).describe("Use 3 voters (architect, security, scope_steward) instead of 7"),
+  simulate: z108.boolean().optional().default(false).describe("Use simulated voters (testing only)"),
   /**
    * Dispatch mode (#3731). `sync` (default) runs the panel inline and returns
    * the result — but a live fan-out (up to 7 voters) can exceed the MCP request
@@ -46910,7 +47240,7 @@ var SupplyChainTradeoffPanelInputSchema = z107.object({
    * immediately and runs the panel in the background; poll
    * `get_job_result({ jobId })` for the result.
    */
-  dispatch: z107.enum(["sync", "async"]).default("sync").describe(
+  dispatch: z108.enum(["sync", "async"]).default("sync").describe(
     "Dispatch mode (#3731). 'sync' (default): run inline. 'async': return a jobId immediately + run the panel in background (poll get_job_result)."
   )
 });
@@ -47377,40 +47707,40 @@ var RiskLevel = /* @__PURE__ */ ((RiskLevel2) => {
 })(RiskLevel || {});
 // src/mcp/safety/stpa-schemas.ts
-import { z as z108 } from "zod";
-var HazardCategorySchema = z108.enum(HazardCategory);
-var HazardSeveritySchema = z108.enum(HazardSeverity);
-var ConstraintPrioritySchema = z108.enum(ConstraintPriority);
-var RiskLevelSchema = z108.enum(RiskLevel);
-var TriggerPatternSchema = z108.object({
-  parameter: z108.string().min(1),
-  matchType: z108.enum(["contains", "regex", "equals", "startsWith", "endsWith"]),
-  pattern: z108.string(),
-  reason: z108.string()
+import { z as z109 } from "zod";
+var HazardCategorySchema = z109.enum(HazardCategory);
+var HazardSeveritySchema = z109.enum(HazardSeverity);
+var ConstraintPrioritySchema = z109.enum(ConstraintPriority);
+var RiskLevelSchema = z109.enum(RiskLevel);
+var TriggerPatternSchema = z109.object({
+  parameter: z109.string().min(1),
+  matchType: z109.enum(["contains", "regex", "equals", "startsWith", "endsWith"]),
+  pattern: z109.string(),
+  reason: z109.string()
 });
-var HazardSchema = z108.object({
-  id: z108.string().min(1),
-  description: z108.string(),
+var HazardSchema = z109.object({
+  id: z109.string().min(1),
+  description: z109.string(),
   category: HazardCategorySchema,
   severity: HazardSeveritySchema,
-  likelihood: z108.enum(["almost_certain", "likely", "possible", "unlikely", "rare"]),
-  triggerConditions: z108.array(z108.string()),
-  consequences: z108.array(z108.string())
+  likelihood: z109.enum(["almost_certain", "likely", "possible", "unlikely", "rare"]),
+  triggerConditions: z109.array(z109.string()),
+  consequences: z109.array(z109.string())
 });
-var UnsafeControlActionSchema = z108.object({
-  id: z108.string().min(1),
-  toolName: z108.string().min(1),
-  type: z108.enum(["not_provided", "provided_causes_hazard", "wrong_timing", "wrong_duration"]),
-  description: z108.string(),
-  unsafeContext: z108.string(),
-  relatedHazards: z108.array(z108.string()),
-  triggerPatterns: z108.array(TriggerPatternSchema).optional()
+var UnsafeControlActionSchema = z109.object({
+  id: z109.string().min(1),
+  toolName: z109.string().min(1),
+  type: z109.enum(["not_provided", "provided_causes_hazard", "wrong_timing", "wrong_duration"]),
+  description: z109.string(),
+  unsafeContext: z109.string(),
+  relatedHazards: z109.array(z109.string()),
+  triggerPatterns: z109.array(TriggerPatternSchema).optional()
 });
-var SafetyConstraintSchema = z108.object({
-  id: z108.string().min(1),
-  description: z108.string(),
-  mitigates: z108.array(z108.string()),
-  enforcement: z108.enum([
+var SafetyConstraintSchema = z109.object({
+  id: z109.string().min(1),
+  description: z109.string(),
+  mitigates: z109.array(z109.string()),
+  enforcement: z109.enum([
     "prevent",
     "require_confirmation",
     "alert",
@@ -47418,54 +47748,54 @@ var SafetyConstraintSchema = z108.object({
     "rate_limit",
     "require_privilege"
   ]),
-  validationFunction: z108.string().optional(),
+  validationFunction: z109.string().optional(),
   priority: ConstraintPrioritySchema
 });
-var PropertySchemaSchema = z108.object({
-  type: z108.string(),
-  description: z108.string().optional(),
-  enum: z108.array(z108.unknown()).optional(),
-  pattern: z108.string().optional(),
-  minimum: z108.number().optional(),
-  maximum: z108.number().optional()
+var PropertySchemaSchema = z109.object({
+  type: z109.string(),
+  description: z109.string().optional(),
+  enum: z109.array(z109.unknown()).optional(),
+  pattern: z109.string().optional(),
+  minimum: z109.number().optional(),
+  maximum: z109.number().optional()
 });
-var ToolInputSchemaSchema = z108.object({
-  type: z108.string(),
-  properties: z108.record(z108.string(), PropertySchemaSchema).optional(),
-  required: z108.array(z108.string()).optional(),
-  additionalProperties: z108.boolean().optional()
+var ToolInputSchemaSchema = z109.object({
+  type: z109.string(),
+  properties: z109.record(z109.string(), PropertySchemaSchema).optional(),
+  required: z109.array(z109.string()).optional(),
+  additionalProperties: z109.boolean().optional()
 });
-var ToolDefinitionSchema = z108.object({
-  name: z108.string().min(1),
-  description: z108.string(),
+var ToolDefinitionSchema = z109.object({
+  name: z109.string().min(1),
+  description: z109.string(),
   inputSchema: ToolInputSchemaSchema
 });
-var AnalysisConfigurationSchema = z108.object({
-  includeLowSeverity: z108.boolean().default(true),
-  generateAllConstraints: z108.boolean().default(true),
-  checkInteractions: z108.boolean().default(true),
-  maxHazardsPerTool: z108.number().int().min(1).max(100).default(50),
-  categories: z108.array(HazardCategorySchema).default([])
+var AnalysisConfigurationSchema = z109.object({
+  includeLowSeverity: z109.boolean().default(true),
+  generateAllConstraints: z109.boolean().default(true),
+  checkInteractions: z109.boolean().default(true),
+  maxHazardsPerTool: z109.number().int().min(1).max(100).default(50),
+  categories: z109.array(HazardCategorySchema).default([])
 });
-var ConstraintViolationSchema = z108.object({
-  constraintId: z108.string().min(1),
-  constraintDescription: z108.string(),
+var ConstraintViolationSchema = z109.object({
+  constraintId: z109.string().min(1),
+  constraintDescription: z109.string(),
   severity: HazardSeveritySchema,
-  details: z108.string(),
-  remediation: z108.string()
+  details: z109.string(),
+  remediation: z109.string()
 });
-var ValidationWarningSchema = z108.object({
-  code: z108.string().min(1),
-  message: z108.string(),
-  affected: z108.string()
+var ValidationWarningSchema = z109.object({
+  code: z109.string().min(1),
+  message: z109.string(),
+  affected: z109.string()
 });
-var ValidationResultSchema = z108.object({
-  valid: z108.boolean(),
-  toolName: z108.string().min(1),
-  violations: z108.array(ConstraintViolationSchema),
-  passed: z108.array(z108.string()),
-  warnings: z108.array(ValidationWarningSchema),
-  validatedAt: z108.date()
+var ValidationResultSchema = z109.object({
+  valid: z109.boolean(),
+  toolName: z109.string().min(1),
+  violations: z109.array(ConstraintViolationSchema),
+  passed: z109.array(z109.string()),
+  warnings: z109.array(ValidationWarningSchema),
+  validatedAt: z109.date()
 });
 // src/mcp/safety/stpa-types.ts
@@ -48550,56 +48880,56 @@ var GeminiResponseParser = class {
 };
 // src/cli-adapters/router-types.ts
-import { z as z109 } from "zod";
-var RouterConfigSchema = z109.object({
-  minCapacityThreshold: z109.number().min(0).max(1).default(0.1),
-  preferCostEfficient: z109.boolean().default(false),
-  maxDecisionTimeMs: z109.number().min(1).max(1e3).default(100)
+import { z as z110 } from "zod";
+var RouterConfigSchema = z110.object({
+  minCapacityThreshold: z110.number().min(0).max(1).default(0.1),
+  preferCostEfficient: z110.boolean().default(false),
+  maxDecisionTimeMs: z110.number().min(1).max(1e3).default(100)
 });
 // src/cli-adapters/agreement-cascade-types.ts
-import { z as z110 } from "zod";
-var AgreementCascadeConfigSchema = z110.object({
-  agreementThreshold: z110.number().min(0.5).max(1).default(0.7),
-  maxStages: z110.number().int().min(1).max(5).default(3),
-  modelTimeoutMs: z110.number().int().min(1e3).max(3e5).default(6e4)
+import { z as z111 } from "zod";
+var AgreementCascadeConfigSchema = z111.object({
+  agreementThreshold: z111.number().min(0.5).max(1).default(0.7),
+  maxStages: z111.number().int().min(1).max(5).default(3),
+  modelTimeoutMs: z111.number().int().min(1e3).max(3e5).default(6e4)
 });
 // src/cli-adapters/agreement-cascade-router.ts
 var logger48 = createLogger({ component: "agreement-cascade-router" });
 // src/cli-adapters/task-classifier.ts
-import { z as z111 } from "zod";
-var ClassificationPatternsSchema = z111.object({
-  code: z111.array(z111.string()).readonly(),
-  research: z111.array(z111.string()).readonly(),
-  documentation: z111.array(z111.string()).readonly(),
-  analysis: z111.array(z111.string()).readonly()
+import { z as z112 } from "zod";
+var ClassificationPatternsSchema = z112.object({
+  code: z112.array(z112.string()).readonly(),
+  research: z112.array(z112.string()).readonly(),
+  documentation: z112.array(z112.string()).readonly(),
+  analysis: z112.array(z112.string()).readonly()
 });
 // src/cli-adapters/response-cache-types.ts
-import { z as z112 } from "zod";
-var ResponseCacheConfigSchema = z112.object({
-  defaultTTL: z112.number().min(1e3).max(36e5).default(3e5),
+import { z as z113 } from "zod";
+var ResponseCacheConfigSchema = z113.object({
+  defaultTTL: z113.number().min(1e3).max(36e5).default(3e5),
   // 5 minutes
-  maxEntries: z112.number().min(10).max(1e5).default(1e3),
-  maxMemoryMB: z112.number().min(1).max(1e3).default(50),
-  cleanupInterval: z112.number().min(1e3).max(6e5).default(6e4),
+  maxEntries: z113.number().min(10).max(1e5).default(1e3),
+  maxMemoryMB: z113.number().min(1).max(1e3).default(50),
+  cleanupInterval: z113.number().min(1e3).max(6e5).default(6e4),
   // 1 minute
-  enableLogging: z112.boolean().default(false)
+  enableLogging: z113.boolean().default(false)
 });
 // src/cli-adapters/response-cache-utils.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 var logger49 = createLogger({ component: "ResponseCacheUtils" });
 // src/cli-adapters/unified-routing-types.ts
-import { z as z113 } from "zod";
-var UnifiedRoutingDecisionSchema = z113.object({
-  selectedCli: z113.string(),
-  confidence: z113.number().min(0).max(1),
-  reason: z113.string(),
-  strategy: z113.enum([
+import { z as z114 } from "zod";
+var UnifiedRoutingDecisionSchema = z114.object({
+  selectedCli: z114.string(),
+  confidence: z114.number().min(0).max(1),
+  reason: z114.string(),
+  strategy: z114.enum([
     "composite",
     "quality",
     "budget",
@@ -48611,57 +48941,57 @@ var UnifiedRoutingDecisionSchema = z113.object({
     "linucb",
     "direct"
   ]),
-  decisionTimeMs: z113.number().nonnegative(),
-  alternatives: z113.array(z113.string()).readonly(),
-  stagesExecuted: z113.array(z113.string()).readonly(),
-  withinBudget: z113.boolean().optional(),
-  estimatedComplexity: z113.enum(["simple", "moderate", "complex", "expert"]).optional(),
-  estimatedTokens: z113.number().int().positive().optional(),
-  topsisScore: z113.number().optional(),
-  ucbScore: z113.number().optional(),
-  resolvedAtStage: z113.number().int().nonnegative().optional(),
-  consensusReached: z113.boolean().optional(),
-  agreementScore: z113.number().min(0).max(1).optional(),
-  metadata: z113.record(z113.string(), z113.unknown()).optional()
+  decisionTimeMs: z114.number().nonnegative(),
+  alternatives: z114.array(z114.string()).readonly(),
+  stagesExecuted: z114.array(z114.string()).readonly(),
+  withinBudget: z114.boolean().optional(),
+  estimatedComplexity: z114.enum(["simple", "moderate", "complex", "expert"]).optional(),
+  estimatedTokens: z114.number().int().positive().optional(),
+  topsisScore: z114.number().optional(),
+  ucbScore: z114.number().optional(),
+  resolvedAtStage: z114.number().int().nonnegative().optional(),
+  consensusReached: z114.boolean().optional(),
+  agreementScore: z114.number().min(0).max(1).optional(),
+  metadata: z114.record(z114.string(), z114.unknown()).optional()
 });
 // src/learning/outcome-feedback-types.ts
-import { z as z114 } from "zod";
-var QualitySignalsSchema = z114.object({
-  testsPass: z114.boolean().optional(),
-  lintErrors: z114.number().int().min(0).optional(),
-  userApproved: z114.boolean().optional(),
-  retryCount: z114.number().int().min(0).default(0),
-  completionRatio: z114.number().min(0).max(1).default(1),
-  validStructure: z114.boolean().optional(),
-  coherenceScore: z114.number().min(0).max(1).optional()
+import { z as z115 } from "zod";
+var QualitySignalsSchema = z115.object({
+  testsPass: z115.boolean().optional(),
+  lintErrors: z115.number().int().min(0).optional(),
+  userApproved: z115.boolean().optional(),
+  retryCount: z115.number().int().min(0).default(0),
+  completionRatio: z115.number().min(0).max(1).default(1),
+  validStructure: z115.boolean().optional(),
+  coherenceScore: z115.number().min(0).max(1).optional()
 });
-var RoutingDecisionSchema = z114.object({
-  id: z114.uuid(),
-  timestamp: z114.iso.datetime(),
-  query: z114.string(),
-  routerType: z114.enum(["linucb", "preference", "quality", "cascade", "topsis"]),
-  selectedModel: z114.string(),
-  selectedTier: z114.enum(["strong", "weak"]).optional(),
-  armIndex: z114.number().int().min(0).optional(),
-  banditContext: z114.record(z114.string(), z114.unknown()).optional(),
-  queryFeatures: z114.record(z114.string(), z114.unknown()).optional(),
-  ucbScore: z114.number().optional(),
-  confidence: z114.number().min(0).max(1).optional(),
-  traceId: z114.string(),
-  domain: z114.string().optional()
+var RoutingDecisionSchema = z115.object({
+  id: z115.uuid(),
+  timestamp: z115.iso.datetime(),
+  query: z115.string(),
+  routerType: z115.enum(["linucb", "preference", "quality", "cascade", "topsis"]),
+  selectedModel: z115.string(),
+  selectedTier: z115.enum(["strong", "weak"]).optional(),
+  armIndex: z115.number().int().min(0).optional(),
+  banditContext: z115.record(z115.string(), z115.unknown()).optional(),
+  queryFeatures: z115.record(z115.string(), z115.unknown()).optional(),
+  ucbScore: z115.number().optional(),
+  confidence: z115.number().min(0).max(1).optional(),
+  traceId: z115.string(),
+  domain: z115.string().optional()
 });
-var TaskOutcomeSchema = z114.object({
-  routingDecisionId: z114.uuid(),
-  timestamp: z114.iso.datetime(),
-  outcomeClass: z114.enum(["success", "partial", "failure", "timeout", "error"]),
-  success: z114.boolean(),
-  qualityScore: z114.number().min(0).max(1),
-  durationMs: z114.number().min(0),
-  tokenUsage: z114.number().int().min(0),
-  errorMessage: z114.string().optional(),
+var TaskOutcomeSchema = z115.object({
+  routingDecisionId: z115.uuid(),
+  timestamp: z115.iso.datetime(),
+  outcomeClass: z115.enum(["success", "partial", "failure", "timeout", "error"]),
+  success: z115.boolean(),
+  qualityScore: z115.number().min(0).max(1),
+  durationMs: z115.number().min(0),
+  tokenUsage: z115.number().int().min(0),
+  errorMessage: z115.string().optional(),
   qualitySignals: QualitySignalsSchema,
-  traceId: z114.string()
+  traceId: z115.string()
 });
 var DEFAULT_FEEDBACK_COLLECTOR_CONFIG = {
   maxPendingDecisions: 1e3,
@@ -48676,17 +49006,17 @@ var DEFAULT_FEEDBACK_COLLECTOR_CONFIG = {
   targetTokenUsage: 2e3,
   maxHistorySize: 1e4
 };
-var FeedbackCollectorConfigSchema = z114.object({
-  maxPendingDecisions: z114.number().int().positive().default(1e3),
-  pendingTimeoutMs: z114.number().positive().default(3e5),
-  enableAutoReward: z114.boolean().default(true),
-  qualityWeight: z114.number().min(0).max(1).default(0.5),
-  speedWeight: z114.number().min(0).max(1).default(0.2),
-  efficiencyWeight: z114.number().min(0).max(1).default(0.2),
-  retryPenalty: z114.number().min(0).max(1).default(0.1),
-  targetDurationMs: z114.number().positive().default(5e3),
-  targetTokenUsage: z114.number().positive().default(2e3),
-  maxHistorySize: z114.number().int().positive().default(1e4)
+var FeedbackCollectorConfigSchema = z115.object({
+  maxPendingDecisions: z115.number().int().positive().default(1e3),
+  pendingTimeoutMs: z115.number().positive().default(3e5),
+  enableAutoReward: z115.boolean().default(true),
+  qualityWeight: z115.number().min(0).max(1).default(0.5),
+  speedWeight: z115.number().min(0).max(1).default(0.2),
+  efficiencyWeight: z115.number().min(0).max(1).default(0.2),
+  retryPenalty: z115.number().min(0).max(1).default(0.1),
+  targetDurationMs: z115.number().positive().default(5e3),
+  targetTokenUsage: z115.number().positive().default(2e3),
+  maxHistorySize: z115.number().int().positive().default(1e4)
 });
 // src/learning/outcome-feedback-helpers.ts
@@ -49336,80 +49666,6 @@ function computeOutcomeReward(collector, outcome) {
   return collector.computeReward(outcome);
 }
-// src/audit/pr-review-record.ts
-import * as crypto2 from "crypto";
-import { z as z115 } from "zod";
-var PrReviewVerdictSchema = z115.enum(["approve", "request_changes", "abstain"]);
-var PrReviewVoteCountsSchema = z115.object({
-  approve: z115.number().int().nonnegative(),
-  request_changes: z115.number().int().nonnegative(),
-  abstain: z115.number().int().nonnegative(),
-  error: z115.number().int().nonnegative(),
-  total: z115.number().int().nonnegative()
-}).strict();
-var PrReviewRecordSchema = z115.object({
-  /**
-   * Schema version. '1.1' is the Option-C binding (#3831): the record binds to
-   * `{prNumber, baseSha, reviewedDiffHash}` instead of the rejected `headSha`.
-   * Clean break — the committed `governance/pr-review-records.jsonl` ledger is
-   * empty on every install (no producer ever wrote a '1.0' record), so there is
-   * no '1.0' data to migrate.
-   */
-  version: z115.literal("1.1"),
-  /**
-   * Monotonic sequence number (integer ≥ 0). Assigned as (max existing
-   * sequence)+1 at write time. Sorted, the set of sequences must cover
-   * 0..maxSeq with no gap (omission detection); DUPLICATE sequences are a
-   * benign concurrent-fork signal, not tampering.
-   */
-  sequence: z115.number().int().nonnegative(),
-  /** The PR number the review covers. */
-  prNumber: z115.number().int().positive(),
-  /**
-   * The 40-hex BASE commit SHA the reviewed diff was computed against (the
-   * `<base>..<head>` range base). Part of the Option-C binding so the gate knows
-   * which range to recompute {@link reviewedDiffHash} over.
-   */
-  baseSha: z115.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha"),
-  /**
-   * DIFF-BINDING (Option-C, #3831): sha256 of the canonical reviewed diff bytes
-   * (see `audit/reviewed-diff-hash.ts` — pinned `git diff` invocation + 50k
-   * byte-truncation). The gate recomputes this from the committed PR's diff and
-   * matches it, so a record only satisfies a PR whose reviewed diff is
-   * byte-identical to what the voters saw. Covered by the self-hash below, so it
-   * cannot be edited to claim a different reviewed diff.
-   */
-  reviewedDiffHash: z115.string().length(64),
-  /** ISO-8601 timestamp the review was recorded. */
-  recordedAt: z115.string().min(1),
-  /** The resolved aggregate verdict. */
-  verdict: PrReviewVerdictSchema,
-  /**
-   * Whether the aggregate carried a VERIFIED finding (the 4-point gate). A
-   * `request_changes` with `verified: true` is a strict blocker; covered by the
-   * hash so it cannot be flipped without detection.
-   */
-  verified: z115.boolean(),
-  /** Per-decision voter tally from the pr_review aggregate. */
-  voteCounts: PrReviewVoteCountsSchema,
-  /** Truncated human-readable review summary for the reviewer record. */
-  summary: z115.string(),
-  /** Optional correlation/decision id linking to the cost rollup / trace. */
-  correlationId: z115.string().min(1).optional(),
-  /**
-   * ADVISORY hash of the tip record at write time (absent for the first).
-   * Retained for audit texture but NOT covered by `hash` and NOT verified —
-   * the record-set model is position-independent (mirrors #3927).
-   */
-  previousHash: z115.string().length(64).optional(),
-  /** SHA-256 over every field above EXCEPT `previousHash` (and except `hash`). */
-  hash: z115.string().length(64)
-}).strict();
-// src/audit/pr-review-record-store.ts
-import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
-import { isAbsolute, join as join10, resolve as resolve17 } from "path";
 // src/security/sandbox/sandbox-types.ts
 var DEFAULT_RESOURCE_LIMITS = {
   maxMemoryBytes: 512 * 1024 * 1024,
@@ -50907,4 +51163,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-66LTZALB.js.map
+//# sourceMappingURL=chunk-4VCLI2T3.js.map