nexus-agents 6.3.4 → 6.3.5

package/dist/{chunk-DJN4XAQO.js → chunk-KXQYRZ3X.js}

@@ -21,7 +21,7 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-DPFRPNAC.js";
+} from "./chunk-PPCIJBHY.js";
 import {
   executeExpert
 } from "./chunk-Q3DEXAOB.js";
@@ -47,7 +47,7 @@ import {
   simulationDeniedResult,
   toJobSummary,
   writeJobCancelled
-} from "./chunk-YBG6Y2UN.js";
+} from "./chunk-SADUKKC7.js";
 import {
   allOf
 } from "./chunk-OQB3XC5O.js";
@@ -64,7 +64,7 @@ import {
 } from "./chunk-NQ2CC67G.js";
 import {
   withPrerequisite
-} from "./chunk-RIMEO4AY.js";
+} from "./chunk-6B7IGVVI.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -88,7 +88,7 @@ import {
   withAuditTrail,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-HJUL6YRG.js";
+} from "./chunk-QBBQA57Z.js";
 import {
   createAuditTrail,
   createGraphAuditBridge,
@@ -27003,10 +27003,10 @@ function calculateZStatistic(params) {
 function calculateDifferenceCI(p1, p2, total1, total2, confidence) {
   const difference = p1 - p2;
   const seDiff = Math.sqrt(p1 * (1 - p1) / (total1 || 1) + p2 * (1 - p2) / (total2 || 1));
-  const z126 = getZScore(confidence);
+  const z127 = getZScore(confidence);
   return {
-    lower: difference - z126 * seDiff,
-    upper: difference + z126 * seDiff,
+    lower: difference - z127 * seDiff,
+    upper: difference + z127 * seDiff,
     estimate: difference,
     confidence,
     n: total1 + total2,
@@ -27029,11 +27029,11 @@ function proportionConfidenceInterval(successes, total, options = {}) {
       standardError: 0
     };
   }
-  const z126 = getZScore(opts.confidence);
-  const z210 = z126 * z126;
+  const z127 = getZScore(opts.confidence);
+  const z210 = z127 * z127;
   const denominator = 1 + z210 / n;
   const center = (p + z210 / (2 * n)) / denominator;
-  const margin = z126 / denominator * Math.sqrt(p * (1 - p) / n + z210 / (4 * n * n));
+  const margin = z127 / denominator * Math.sqrt(p * (1 - p) / n + z210 / (4 * n * n));
   const lower = Math.max(0, center - margin);
   const upper = Math.min(1, center + margin);
   const standardError = Math.sqrt(p * (1 - p) / n);
@@ -27063,8 +27063,8 @@ function meanConfidenceInterval(values, options = {}) {
   const variance = values.reduce((sum, v) => sum + (v - mean) ** 2, 0) / (n - 1 || 1);
   const stdDev = Math.sqrt(variance);
   const standardError = stdDev / Math.sqrt(n);
-  const z126 = getZScore(opts.confidence);
-  const margin = z126 * standardError;
+  const z127 = getZScore(opts.confidence);
+  const margin = z127 * standardError;
   return {
     lower: mean - margin,
     upper: mean + margin,
@@ -46407,31 +46407,94 @@ Verdict: PASS/NEEDS_WORK/REJECT`;
 }
 
 // src/security/sarif-parser.ts
-function tryParseJson(json) {
+import { z as z99 } from "zod";
+var SarifLocationSchema = z99.object({
+  physicalLocation: z99.object({
+    artifactLocation: z99.object({ uri: z99.string().min(1).optional() }).optional(),
+    region: z99.object({
+      startLine: z99.number().int().min(1).optional(),
+      endLine: z99.number().int().min(1).optional(),
+      snippet: z99.object({ text: z99.string().optional() }).optional()
+    }).optional()
+  }).optional()
+});
+var SarifResultSchema = z99.object({
+  ruleId: z99.string().nullish(),
+  level: z99.string().nullish(),
+  message: z99.object({ text: z99.string().optional() }).nullish(),
+  locations: z99.array(SarifLocationSchema).nullish()
+});
+var SarifRuleSchema = z99.object({
+  id: z99.string(),
+  shortDescription: z99.object({ text: z99.string().optional() }).optional(),
+  defaultConfiguration: z99.object({ level: z99.string().optional() }).optional(),
+  properties: z99.object({
+    precision: z99.string().optional(),
+    tags: z99.array(z99.string()).optional(),
+    "security-severity": z99.string().optional()
+  }).optional(),
+  helpUri: z99.string().optional(),
+  help: z99.object({ markdown: z99.string().optional() }).optional()
+});
+var SarifRunSchema = z99.object({
+  tool: z99.object({
+    driver: z99.object({
+      name: z99.string().optional(),
+      rules: z99.array(z99.unknown()).optional()
+    }).optional()
+  }).optional(),
+  results: z99.array(z99.unknown()).nullish()
+});
+var SarifLogSchema = z99.object({
+  version: z99.string().optional(),
+  runs: z99.array(z99.unknown()).optional()
+});
+var UNMAPPED_LEVEL_SEVERITY = "high";
+var MAX_MESSAGE_LENGTH = 2e3;
+function parseEnvelope(json) {
+  let raw;
   try {
-    return JSON.parse(json);
+    raw = JSON.parse(json);
   } catch {
-    return null;
+    return { ok: false, error: "Invalid JSON" };
+  }
+  const parsed = SarifLogSchema.safeParse(raw);
+  if (!parsed.success) {
+    return { ok: false, error: `Malformed SARIF log: ${describeZodError(parsed.error)}` };
   }
+  return { ok: true, log: parsed.data };
+}
+function describeZodError(error) {
+  return error.issues.slice(0, 3).map((issue) => {
+    const path12 = issue.path.length > 0 ? issue.path.join(".") : "(root)";
+    return `${path12}: ${issue.message}`;
+  }).join("; ");
 }
 function parseSarif(sarifJson, maxFindings = 100) {
   const errors = [];
-  const log = tryParseJson(sarifJson);
-  if (log === null) {
-    return { scanner: "unknown", totalFindings: 0, findings: [], errors: ["Invalid JSON"] };
+  const envelope = parseEnvelope(sarifJson);
+  if (!envelope.ok) {
+    return { scanner: "unknown", totalFindings: 0, findings: [], errors: [envelope.error] };
   }
-  return parseLog(log, maxFindings, errors);
+  return parseLog(envelope.log, maxFindings, errors);
+}
+function describeDriver(run) {
+  const driver = run.tool?.driver;
+  return { scanner: driver?.name ?? "unknown", rules: driver?.rules ?? [] };
+}
+function emptyResult(error) {
+  return { scanner: "unknown", totalFindings: 0, findings: [], errors: [error] };
 }
 function parseLog(log, maxFindings, errors) {
   const runs = log.runs;
-  if (runs === void 0 || runs.length === 0) {
-    return { scanner: "unknown", totalFindings: 0, findings: [], errors: ["No runs in SARIF"] };
+  if (runs === void 0 || runs.length === 0) return emptyResult("No runs in SARIF");
+  const parsedRun = SarifRunSchema.safeParse(runs[0]);
+  if (!parsedRun.success) {
+    return emptyResult(`Malformed SARIF run: ${describeZodError(parsedRun.error)}`);
   }
-  const run = runs[0];
-  const scanner = run.tool?.driver?.name ?? "unknown";
-  const ruleMap = buildRuleMap(run.tool?.driver?.rules ?? []);
-  const results = run.results ?? [];
-  const findings = collectFindings(results, scanner, ruleMap, errors);
+  const { scanner, rules } = describeDriver(parsedRun.data);
+  const ruleMap = buildRuleMap(rules, errors);
+  const findings = collectFindings(parsedRun.data.results ?? [], scanner, ruleMap, errors);
   return {
     scanner,
     totalFindings: findings.length,
@@ -46441,17 +46504,27 @@ function parseLog(log, maxFindings, errors) {
 }
 function collectFindings(results, scanner, ruleMap, errors) {
   const findings = [];
-  for (const result of results) {
-    const finding = parseResult(result, scanner, ruleMap, errors);
+  for (const [index, raw] of results.entries()) {
+    const parsed = SarifResultSchema.safeParse(raw);
+    if (!parsed.success) {
+      errors.push(`Skipped result ${String(index)}: ${describeZodError(parsed.error)}`);
+      continue;
+    }
+    const finding = parseResult(parsed.data, scanner, ruleMap, errors);
     if (finding !== null) findings.push(finding);
   }
   findings.sort((a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity]);
   return findings;
 }
-function buildRuleMap(rules) {
+function buildRuleMap(rules, errors) {
   const map = /* @__PURE__ */ new Map();
-  for (const rule of rules) {
-    map.set(rule.id, rule);
+  for (const [index, raw] of rules.entries()) {
+    const parsed = SarifRuleSchema.safeParse(raw);
+    if (!parsed.success) {
+      errors.push(`Skipped rule ${String(index)}: ${describeZodError(parsed.error)}`);
+      continue;
+    }
+    map.set(parsed.data.id, parsed.data);
   }
   return map;
 }
@@ -46459,6 +46532,7 @@ function getFirstPhysicalLocation(result) {
   const locations = result.locations;
   if (locations === void 0 || locations === null || locations.length === 0) return null;
   const first = locations[0];
+  if (first === void 0) return null;
   return first.physicalLocation ?? null;
 }
 function buildLocation(file, startLine, phys) {
@@ -46477,6 +46551,15 @@ function extractLocation(result) {
   if (file === void 0 || file === "" || startLine === void 0) return null;
   return buildLocation(file, startLine, phys);
 }
+function severityWithDisclosure(result, rule, ruleId, errors) {
+  const { severity, unmappedLevel } = resolveSeverity(result.level ?? void 0, rule);
+  if (unmappedLevel !== void 0) {
+    errors.push(
+      `Finding ${ruleId}: SARIF level '${unmappedLevel}' is not defined by the spec; severity recorded as '${severity}' (fail-closed), not measured`
+    );
+  }
+  return severity;
+}
 function parseResult(result, scanner, ruleMap, errors) {
   const ruleId = result.ruleId ?? "unknown";
   const rule = ruleMap.get(ruleId);
@@ -46485,12 +46568,14 @@ function parseResult(result, scanner, ruleMap, errors) {
     errors.push(`Skipped finding ${ruleId}: missing location`);
     return null;
   }
-  const message = result.message?.text ?? rule?.shortDescription?.text ?? ruleId;
+  const rawMessage = result.message?.text ?? rule?.shortDescription?.text ?? ruleId;
+  const message = rawMessage.slice(0, MAX_MESSAGE_LENGTH);
+  const severity = severityWithDisclosure(result, rule, ruleId, errors);
   return {
     id: `${scanner}:${ruleId}:${loc.file}:${String(loc.startLine)}`,
     scanner,
     rule: ruleId,
-    severity: resolveSeverity(result.level ?? void 0, rule),
+    severity,
     message,
     file: loc.file,
     startLine: loc.startLine,
@@ -46509,11 +46594,16 @@ function scoreToSeverity(score) {
 }
 function resolveSeverity(level, rule) {
   const fromScore = resolveSeverityFromScore(rule);
-  if (fromScore !== null) return fromScore;
-  if (level !== void 0) return SARIF_LEVEL_MAP[level] ?? "medium";
+  if (fromScore !== null) return { severity: fromScore };
+  if (level !== void 0) return mapLevel(level);
   const ruleLevel = rule?.defaultConfiguration?.level;
-  if (ruleLevel !== void 0) return SARIF_LEVEL_MAP[ruleLevel] ?? "medium";
-  return "medium";
+  if (ruleLevel !== void 0) return mapLevel(ruleLevel);
+  return { severity: "medium" };
+}
+function mapLevel(level) {
+  const mapped = SARIF_LEVEL_MAP[level];
+  if (mapped !== void 0) return { severity: mapped };
+  return { severity: UNMAPPED_LEVEL_SEVERITY, unmappedLevel: level };
 }
 function resolveSeverityFromScore(rule) {
   if (rule === void 0) return null;
@@ -46612,18 +46702,18 @@ async function executeSecurityScan(input) {
 }
 
 // src/security/osv-lookup.ts
-import { z as z99 } from "zod";
+import { z as z100 } from "zod";
 var logger44 = createLogger({ component: "osv-lookup" });
 var OSV_API_URL = "https://api.osv.dev/v1/query";
 var DEFAULT_TIMEOUT_MS4 = NETWORK_FETCH_TIMEOUT_MS;
-var OsvVulnerabilitySchema = z99.object({
-  id: z99.string(),
-  summary: z99.string().optional(),
-  severity: z99.enum(["CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN"]).optional(),
-  aliases: z99.array(z99.string()).default([]),
-  affectedVersions: z99.string().optional(),
-  fixedVersion: z99.string().optional(),
-  url: z99.string().optional()
+var OsvVulnerabilitySchema = z100.object({
+  id: z100.string(),
+  summary: z100.string().optional(),
+  severity: z100.enum(["CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN"]).optional(),
+  aliases: z100.array(z100.string()).default([]),
+  affectedVersions: z100.string().optional(),
+  fixedVersion: z100.string().optional(),
+  url: z100.string().optional()
 });
 var DEFAULT_OSV_CONFIG = {
   timeoutMs: DEFAULT_TIMEOUT_MS4
@@ -47369,7 +47459,7 @@ ${contextBlock}`;
       const strategy = config.votingStrategy ?? "higher_order";
       await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
       try {
-        const { executeVoting } = await import("./consensus-vote-5XRP2OY4.js");
+        const { executeVoting } = await import("./consensus-vote-XICKVHZF.js");
         const votingResult = await executeVoting(
           {
             proposal: buildVoteProposal(plan, research),
@@ -47909,7 +47999,7 @@ function createAuditStageRegistry() {
 }
 
 // src/mcp/tools/pr-review-tool.ts
-import { z as z101 } from "zod";
+import { z as z102 } from "zod";
 import { randomUUID as randomUUID13 } from "crypto";
 
 // src/mcp/tools/pr-review-findings.ts
@@ -48025,17 +48115,17 @@ import { dirname as dirname4, isAbsolute, join as join11, resolve as resolve15 }
 
 // src/audit/pr-review-record.ts
 import * as crypto3 from "crypto";
-import { z as z100 } from "zod";
-var PrReviewVerdictSchema = z100.enum(["approve", "request_changes", "abstain"]);
-var PrReviewVoteCountsSchema = z100.object({
-  approve: z100.number().int().nonnegative(),
-  request_changes: z100.number().int().nonnegative(),
-  abstain: z100.number().int().nonnegative(),
-  error: z100.number().int().nonnegative(),
-  total: z100.number().int().nonnegative()
+import { z as z101 } from "zod";
+var PrReviewVerdictSchema = z101.enum(["approve", "request_changes", "abstain"]);
+var PrReviewVoteCountsSchema = z101.object({
+  approve: z101.number().int().nonnegative(),
+  request_changes: z101.number().int().nonnegative(),
+  abstain: z101.number().int().nonnegative(),
+  error: z101.number().int().nonnegative(),
+  total: z101.number().int().nonnegative()
 }).strict();
-var PrReviewDiffSourceSchema = z100.enum(["canonical-git", "caller-supplied"]);
-var PrReviewDiffProvenanceSchema = z100.object({
+var PrReviewDiffSourceSchema = z101.enum(["canonical-git", "caller-supplied"]);
+var PrReviewDiffProvenanceSchema = z101.object({
   /** How the reviewed diff was obtained. */
   source: PrReviewDiffSourceSchema,
   /**
@@ -48047,9 +48137,9 @@ var PrReviewDiffProvenanceSchema = z100.object({
    * per-file attribution is unavailable. `false` means "a diff, but the packer
    * saw it as one undifferentiated blob".
    */
-  fileBoundaries: z100.boolean()
+  fileBoundaries: z101.boolean()
 }).strict();
-var PrReviewRecordSchema = z100.object({
+var PrReviewRecordSchema = z101.object({
   /**
    * Schema version. '1.1' was the Option-C binding (#3831): the record binds to
    * `{prNumber, baseSha, reviewedDiffHash}` instead of the rejected `headSha`.
@@ -48061,22 +48151,22 @@ var PrReviewRecordSchema = z100.object({
    * records at the time of this bump), so there is no data to migrate and no
    * reason to keep a tolerant version union.
    */
-  version: z100.literal("1.2"),
+  version: z101.literal("1.2"),
   /**
    * Monotonic sequence number (integer ≥ 0). Assigned as (max existing
    * sequence)+1 at write time. Sorted, the set of sequences must cover
    * 0..maxSeq with no gap (omission detection); DUPLICATE sequences are a
    * benign concurrent-fork signal, not tampering.
    */
-  sequence: z100.number().int().nonnegative(),
+  sequence: z101.number().int().nonnegative(),
   /** The PR number the review covers. */
-  prNumber: z100.number().int().positive(),
+  prNumber: z101.number().int().positive(),
   /**
    * The 40-hex BASE commit SHA the reviewed diff was computed against (the
    * `<base>..<head>` range base). Part of the Option-C binding so the gate knows
    * which range to recompute {@link reviewedDiffHash} over.
    */
-  baseSha: z100.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha"),
+  baseSha: z101.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha"),
   /**
    * DIFF-BINDING (Option-C, #3831): sha256 of the canonical reviewed diff bytes
    * (see `audit/reviewed-diff-hash.ts` — pinned `git diff` invocation + 50k
@@ -48085,9 +48175,9 @@ var PrReviewRecordSchema = z100.object({
    * byte-identical to what the voters saw. Covered by the self-hash below, so it
    * cannot be edited to claim a different reviewed diff.
    */
-  reviewedDiffHash: z100.string().length(64),
+  reviewedDiffHash: z101.string().length(64),
   /** ISO-8601 timestamp the review was recorded. */
-  recordedAt: z100.string().min(1),
+  recordedAt: z101.string().min(1),
   /** The resolved aggregate verdict. */
   verdict: PrReviewVerdictSchema,
   /**
@@ -48095,13 +48185,13 @@ var PrReviewRecordSchema = z100.object({
    * `request_changes` with `verified: true` is a strict blocker; covered by the
    * hash so it cannot be flipped without detection.
    */
-  verified: z100.boolean(),
+  verified: z101.boolean(),
   /** Per-decision voter tally from the pr_review aggregate. */
   voteCounts: PrReviewVoteCountsSchema,
   /** Truncated human-readable review summary for the reviewer record. */
-  summary: z100.string(),
+  summary: z101.string(),
   /** Optional correlation/decision id linking to the cost rollup / trace. */
-  correlationId: z100.string().min(1).optional(),
+  correlationId: z101.string().min(1).optional(),
   /**
    * What this record was DERIVED FROM (#4459). OPTIONAL by necessity: the
    * schema is `.strict()`, so a required field would reject every record
@@ -48114,9 +48204,9 @@ var PrReviewRecordSchema = z100.object({
    * Retained for audit texture but NOT covered by `hash` and NOT verified —
    * the record-set model is position-independent (mirrors #3927).
    */
-  previousHash: z100.string().length(64).optional(),
+  previousHash: z101.string().length(64).optional(),
   /** SHA-256 over every field above EXCEPT `previousHash` (and except `hash`). */
-  hash: z100.string().length(64)
+  hash: z101.string().length(64)
 }).strict();
 function computePrReviewRecordHash(payload) {
   const canonical = JSON.stringify({
@@ -48571,19 +48661,19 @@ var MAX_DIFF_INPUT_LENGTH = 2e6;
 var MAX_REPO_CONTEXT_LENGTH = 2e3;
 var MAX_DESCRIPTION_LENGTH = 1e4;
 var PR_REVIEW_ASYNC_HINT = "A pr_review run fans out to 5 live LLM voters and can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
-var PrReviewInputSchema = z101.object({
-  prTitle: z101.string().min(1).max(500).describe("PR title"),
-  prDescription: z101.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
-  prDiff: z101.string().min(1).max(MAX_DIFF_INPUT_LENGTH).refine(looksLikeUnifiedDiff, {
+var PrReviewInputSchema = z102.object({
+  prTitle: z102.string().min(1).max(500).describe("PR title"),
+  prDescription: z102.string().max(MAX_DESCRIPTION_LENGTH).optional().describe("PR body / description"),
+  prDiff: z102.string().min(1).max(MAX_DIFF_INPUT_LENGTH).refine(looksLikeUnifiedDiff, {
     message: "prDiff must be a unified diff (expected a `diff --git`, `---`/`+++`, or `@@ \u2026 @@` line). Prose descriptions of a change are rejected: a review of a summary is not a review of the code, and would be recorded as though it were (#4451)."
   }).describe(
     `Unified diff text (max ${String(MAX_DIFF_INPUT_LENGTH)} chars). REQUIRED SHAPE (#4451): must contain a \`diff --git\` header, an \`@@ \u2026 @@\` hunk header backed by +/- lines, or a \`---\`/\`+++\` header pair \u2014 a prose summary of the change is REJECTED, because reviewing a summary is not reviewing the code and would be recorded as though it were. (Stated here because Zod refinements do not survive JSON-schema generation, so this constraint is otherwise invisible to clients.) No need to truncate before calling: diffs over ${String(MAX_DIFF_LENGTH)} chars are security-prioritized and PARTIALLY reviewed (lowest-priority whole files dropped; coverage reported on the response, and a partial review can block but never verified-approve).`
   ),
-  repoContext: z101.string().max(MAX_REPO_CONTEXT_LENGTH).optional().describe(
+  repoContext: z102.string().max(MAX_REPO_CONTEXT_LENGTH).optional().describe(
     `Optional one-paragraph repo context (architecture, conventions; max ${String(MAX_REPO_CONTEXT_LENGTH)} chars; trim before calling)`
   ),
-  baseRef: z101.string().max(200).optional().describe("Base branch ref (e.g. main)"),
-  headRef: z101.string().max(200).optional().describe("Head branch ref"),
+  baseRef: z102.string().max(200).optional().describe("Base branch ref (e.g. main)"),
+  headRef: z102.string().max(200).optional().describe("Head branch ref"),
   /**
    * Option-C audit binding (#4031). When BOTH `prNumber` and `baseSha` are
    * supplied AND the review is live (not simulated), pr_review persists an
@@ -48595,14 +48685,14 @@ var PrReviewInputSchema = z101.object({
    * canonical `git diff <baseSha>..<headSha>` the gate recomputes (the hash
    * truncates at that byte cap) — pass the canonical diff, not a reordered one.
    */
-  prNumber: z101.number().int().positive().optional().describe("PR number \u2014 with baseSha, enables Option-C audit-record persistence (#4031)"),
-  baseSha: z101.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha").optional().describe(
+  prNumber: z102.number().int().positive().optional().describe("PR number \u2014 with baseSha, enables Option-C audit-record persistence (#4031)"),
+  baseSha: z102.string().regex(/^[0-9a-f]{40}$/, "baseSha must be a 40-char lowercase hex commit sha").optional().describe(
     "40-hex base commit sha the reviewed diff was computed from (Option-C binding, #4031)"
   ),
-  repoPath: z101.string().max(1024).optional().describe(
+  repoPath: z102.string().max(1024).optional().describe(
     "Repo root path for persisting the governance pr-review record (overrides cwd auto-detection). Must contain a .git ancestor \u2014 relative paths are resolved against cwd; ignored (falls back to cwd auto-detection) if it is not a real repo root. Env NEXUS_PR_REVIEW_RECORDS_PATH still takes precedence and is unrestricted."
   ),
-  simulate: z101.boolean().default(false).describe("Use simulated voters (testing only; never ship live with this true)"),
+  simulate: z102.boolean().default(false).describe("Use simulated voters (testing only; never ship live with this true)"),
   /**
    * Error policy (#4132). `standard` (default) keeps the pre-#4132 aggregation:
    * an errored voter is simply excluded from the panel. `absolute_quorum` gates
@@ -48614,7 +48704,7 @@ var PrReviewInputSchema = z101.object({
    * verified approve. A genuine `request_changes` blocker still wins (Tiers 1-2
    * run first).
    */
-  errorPolicy: z101.enum(["standard", "absolute_quorum"]).default("standard").describe(
+  errorPolicy: z102.enum(["standard", "absolute_quorum"]).default("standard").describe(
     "Error policy (#4132). 'standard' (default): errored voters excluded. 'absolute_quorum': any errored voter \u2014 esp. the contrarian \u2014 degrades a would-be approve to a recoverable abstain (verified:false); never manufactures a verified approve from an induced error."
   ),
   /**
@@ -48624,7 +48714,7 @@ var PrReviewInputSchema = z101.object({
    * runs the panel in the background; poll `get_job_result({ jobId })` for the
    * result.
    */
-  dispatch: z101.enum(["sync", "async"]).default("sync").describe(
+  dispatch: z102.enum(["sync", "async"]).default("sync").describe(
     "Dispatch mode (#3731). 'sync' (default): run inline. 'async': return a jobId immediately + run the panel in background (poll get_job_result)."
   )
 });
@@ -48859,27 +48949,27 @@ function registerPrReviewTool(server, deps) {
 }
 
 // src/mcp/tools/survey-oss-landscape.ts
-import { z as z102 } from "zod";
-var SurveyOssLandscapeInputSchema = z102.object({
-  query: z102.string().min(1).max(200).describe('Free-text search query, e.g. "cargo nextest replacement" or "OSS SBOM tools"'),
-  maxResults: z102.number().int().min(1).max(50).optional().default(10).describe("Maximum candidates to return (1-50; default 10)"),
-  minStars: z102.number().int().min(0).optional().default(0).describe("Minimum star count to include (default 0; useful for filtering noise)"),
-  language: z102.string().max(50).optional().describe('GitHub language filter, e.g. "rust" or "typescript"')
-});
-var GitHubRepoSchema = z102.object({
-  full_name: z102.string().optional(),
-  html_url: z102.string().optional(),
-  description: z102.string().nullable().optional(),
-  stargazers_count: z102.number().optional(),
-  pushed_at: z102.string().nullable().optional(),
-  language: z102.string().nullable().optional(),
-  license: z102.object({
-    spdx_id: z102.string().nullable().optional()
+import { z as z103 } from "zod";
+var SurveyOssLandscapeInputSchema = z103.object({
+  query: z103.string().min(1).max(200).describe('Free-text search query, e.g. "cargo nextest replacement" or "OSS SBOM tools"'),
+  maxResults: z103.number().int().min(1).max(50).optional().default(10).describe("Maximum candidates to return (1-50; default 10)"),
+  minStars: z103.number().int().min(0).optional().default(0).describe("Minimum star count to include (default 0; useful for filtering noise)"),
+  language: z103.string().max(50).optional().describe('GitHub language filter, e.g. "rust" or "typescript"')
+});
+var GitHubRepoSchema = z103.object({
+  full_name: z103.string().optional(),
+  html_url: z103.string().optional(),
+  description: z103.string().nullable().optional(),
+  stargazers_count: z103.number().optional(),
+  pushed_at: z103.string().nullable().optional(),
+  language: z103.string().nullable().optional(),
+  license: z103.object({
+    spdx_id: z103.string().nullable().optional()
   }).nullable().optional()
 });
-var GitHubSearchResponseSchema = z102.object({
-  total_count: z102.number().optional(),
-  items: z102.array(GitHubRepoSchema).optional()
+var GitHubSearchResponseSchema = z103.object({
+  total_count: z103.number().optional(),
+  items: z103.array(GitHubRepoSchema).optional()
 });
 var GITHUB_SEARCH_BASE = "https://api.github.com/search/repositories";
 function buildGithubQuery(input) {
@@ -49006,11 +49096,11 @@ function createSurveyHandler(deps) {
   };
 }
 var SURVEY_OUTPUT_SCHEMA = {
-  query: z102.string(),
-  totalFound: z102.number(),
-  candidates: z102.array(z102.unknown()),
-  sourcesQueried: z102.array(z102.string()),
-  sourcesFailed: z102.array(z102.string())
+  query: z103.string(),
+  totalFound: z103.number(),
+  candidates: z103.array(z103.unknown()),
+  sourcesQueried: z103.array(z103.string()),
+  sourcesFailed: z103.array(z103.string())
 };
 var SURVEY_DESCRIPTION = 'Transient OSS project search. Returns a ranked list of GitHub repositories with license, last-commit, star-count, and one-line description. Does NOT persist to the research registry \u2014 use `research_add_source` for that. Best for one-off engineering decisions like "what tools exist in this space?".';
 function registerSurveyOssLandscapeTool(server, deps) {
@@ -49039,7 +49129,7 @@ function registerSurveyOssLandscapeTool(server, deps) {
 }
 
 // src/mcp/tools/vendor-publishing-audit.ts
-import { z as z103 } from "zod";
+import { z as z104 } from "zod";
 
 // src/mcp/tools/vendor-publishing-seed.ts
 var VENDOR_PUBLISHING_SEED = {
@@ -49112,8 +49202,8 @@ function listKnownVendors() {
 }
 
 // src/mcp/tools/vendor-publishing-audit.ts
-var VendorPublishingAuditInputSchema = z103.object({
-  vendor: z103.string().min(1).max(50).toLowerCase().describe('Vendor identifier, lowercase. e.g. "ubuntu", "debian", "fedora"')
+var VendorPublishingAuditInputSchema = z104.object({
+  vendor: z104.string().min(1).max(50).toLowerCase().describe('Vendor identifier, lowercase. e.g. "ubuntu", "debian", "fedora"')
 });
 function lookupVendor(vendor) {
   if (isKnownVendor(vendor)) {
@@ -49145,20 +49235,20 @@ function createVendorPublishingAuditHandler(deps) {
   };
 }
 var VENDOR_PUBLISHING_OUTPUT_SCHEMA = {
-  vendor: z103.string(),
-  known: z103.boolean(),
+  vendor: z104.string(),
+  known: z104.boolean(),
   // Fields below populate when known=true; permissive optional for known=false.
-  sha256SumsUrlPattern: z103.string().optional(),
-  sha256SumsSignatureUrlPattern: z103.string().optional(),
-  signaturePattern: z103.string().optional(),
-  gpgKeys: z103.array(z103.unknown()).optional(),
-  releaseCadence: z103.string().optional(),
-  keyRotationNotes: z103.string().optional(),
-  vendorDocUrl: z103.string().optional(),
-  citedAt: z103.string().optional(),
+  sha256SumsUrlPattern: z104.string().optional(),
+  sha256SumsSignatureUrlPattern: z104.string().optional(),
+  signaturePattern: z104.string().optional(),
+  gpgKeys: z104.array(z104.unknown()).optional(),
+  releaseCadence: z104.string().optional(),
+  keyRotationNotes: z104.string().optional(),
+  vendorDocUrl: z104.string().optional(),
+  citedAt: z104.string().optional(),
   // Fields below populate when known=false.
-  message: z103.string().optional(),
-  knownVendors: z103.array(z103.string()).optional()
+  message: z104.string().optional(),
+  knownVendors: z104.array(z104.string()).optional()
 };
 var VENDOR_PUBLISHING_DESCRIPTION = "Look up a vendor's published-artifact signing infrastructure: GPG key fingerprints, SHA256SUMS URL pattern, signature shape (clearsigned / detached / detached-on-iso), release cadence, key rotation notes, and the vendor doc citation. Static lookup against a curated seed dataset; the vendor doc URL is the authoritative source. Returns `{known: false, knownVendors: [...]}` for vendors without a seed entry. v1 covers ubuntu, debian, fedora.";
 function registerVendorPublishingAuditTool(server, deps) {
@@ -49187,17 +49277,17 @@ function registerVendorPublishingAuditTool(server, deps) {
 }
 
 // src/mcp/tools/compare-data-feeds.ts
-import { z as z104 } from "zod";
+import { z as z105 } from "zod";
 import * as path7 from "path";
 import * as fs8 from "fs";
 import * as yaml4 from "yaml";
-var CompareDataFeedsInputSchema = z104.object({
-  feedAPath: z104.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
-  feedBPath: z104.string().min(1).max(1e3).describe("Filesystem path to feed B"),
-  keyPath: z104.string().min(1).max(200).describe(
+var CompareDataFeedsInputSchema = z105.object({
+  feedAPath: z105.string().min(1).max(1e3).describe("Filesystem path to feed A (YAML or JSON, auto-detected by extension)"),
+  feedBPath: z105.string().min(1).max(1e3).describe("Filesystem path to feed B"),
+  keyPath: z105.string().min(1).max(200).describe(
     'Dotted path to the entry key, e.g. "id" or "name". Each entry must have this field.'
   ),
-  compareFields: z104.array(z104.string().min(1).max(200)).max(20).optional().describe(
+  compareFields: z105.array(z105.string().min(1).max(200)).max(20).optional().describe(
     'Optional dotted field paths to compare across matched entries (e.g. ["license", "sha256"])'
   )
 });
@@ -49381,24 +49471,24 @@ function createCompareDataFeedsHandler(deps) {
   };
 }
 var COMPARE_OUTPUT_SCHEMA = {
-  feedAPath: z104.string(),
-  feedBPath: z104.string(),
-  keyPath: z104.string(),
-  counts: z104.object({
-    entriesInA: z104.number(),
-    entriesInB: z104.number(),
-    onlyInA: z104.number(),
-    onlyInB: z104.number(),
-    inBoth: z104.number(),
-    fieldDifferences: z104.number()
+  feedAPath: z105.string(),
+  feedBPath: z105.string(),
+  keyPath: z105.string(),
+  counts: z105.object({
+    entriesInA: z105.number(),
+    entriesInB: z105.number(),
+    onlyInA: z105.number(),
+    onlyInB: z105.number(),
+    inBoth: z105.number(),
+    fieldDifferences: z105.number()
   }),
-  coverage: z104.object({
-    onlyInA: z104.array(z104.string()),
-    onlyInB: z104.array(z104.string()),
-    inBoth: z104.array(z104.string())
+  coverage: z105.object({
+    onlyInA: z105.array(z105.string()),
+    onlyInB: z105.array(z105.string()),
+    inBoth: z105.array(z105.string())
   }),
-  fieldDifferences: z104.array(z104.unknown()),
-  summary: z104.string()
+  fieldDifferences: z105.array(z105.unknown()),
+  summary: z105.string()
 };
 var COMPARE_DESCRIPTION = "Diff two upstream data feeds (YAML or JSON files) along coverage and per-field axes. Returns which entries exist in A, B, both, plus optional field-level diffs across matched entries. v1 takes file paths only (no URL fetch \u2014 that needs an SSRF design pass). Both feeds must be a top-level array OR a top-level object with exactly one array field.";
 function registerCompareDataFeedsTool(server, deps) {
@@ -49427,9 +49517,9 @@ function registerCompareDataFeedsTool(server, deps) {
 }
 
 // src/mcp/tools/query-task-state-tool.ts
-import { z as z105 } from "zod";
-var QueryTaskStateInputSchema = z105.object({
-  taskId: z105.string().min(1).max(128).describe("Task ID whose structured state log should be read")
+import { z as z106 } from "zod";
+var QueryTaskStateInputSchema = z106.object({
+  taskId: z106.string().min(1).max(128).describe("Task ID whose structured state log should be read")
 });
 function queryTaskStateHandler(args, ctx) {
   const parsed = QueryTaskStateInputSchema.safeParse(args);
@@ -49464,7 +49554,7 @@ function queryTaskStateHandler(args, ctx) {
 function registerQueryTaskStateTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "query_task_state" });
   const toolSchema = {
-    taskId: z105.string().min(1).max(128).describe("Task ID whose structured state log should be read")
+    taskId: z106.string().min(1).max(128).describe("Task ID whose structured state log should be read")
   };
   const description = "Read the structured state log for a task ID and return the current snapshot. Includes Magentic-One Task Ledger (facts/guesses/openQuestions) and Progress Ledger (per-step reflections with suggestedAction) when orchestrators have written them. Structured state is only written when NEXUS_TASK_STATE_ENABLED=1 was set during the orchestrate invocation.";
   const secureHandler = createSecureHandler(queryTaskStateHandler, {
@@ -49486,28 +49576,28 @@ function registerQueryTaskStateTool(server, deps) {
 }
 
 // src/mcp/tools/ci-health-check-tool.ts
-import { z as z108 } from "zod";
+import { z as z109 } from "zod";
 
 // src/mcp/tools/ci-health-log.ts
 import { appendFileSync as appendFileSync5, existsSync as existsSync13, readFileSync as readFileSync11, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
-import { z as z107 } from "zod";
+import { z as z108 } from "zod";
 
 // src/mcp/tools/ci-health-types.ts
-import { z as z106 } from "zod";
-var CiHealthStatusSchema = z106.enum(["healthy", "degraded", "outage", "unknown"]);
+import { z as z107 } from "zod";
+var CiHealthStatusSchema = z107.enum(["healthy", "degraded", "outage", "unknown"]);
 
 // src/mcp/tools/ci-health-log.ts
 var logger47 = createLogger({ component: "ci-health-log" });
-var CiHealthEventSchema = z107.object({
-  v: z107.literal(1),
-  ts: z107.iso.datetime(),
+var CiHealthEventSchema = z108.object({
+  v: z108.literal(1),
+  ts: z108.iso.datetime(),
   status: CiHealthStatusSchema,
-  repo: z107.string().optional(),
-  signals: z107.array(
-    z107.object({
-      source: z107.enum(["github-status", "repo-activity-window"]),
+  repo: z108.string().optional(),
+  signals: z108.array(
+    z108.object({
+      source: z108.enum(["github-status", "repo-activity-window"]),
       status: CiHealthStatusSchema,
-      evidence: z107.string()
+      evidence: z108.string()
     })
   )
 });
@@ -49587,17 +49677,17 @@ function eventFromCheck(params) {
 }
 
 // src/mcp/tools/ci-health-check-tool.ts
-var CiHealthCheckInputSchema = z108.object({
+var CiHealthCheckInputSchema = z109.object({
   /**
    * Repo to check for the recent-runs activity signal (in `owner/repo` form).
    * Optional — when omitted, only the status-page signal is consulted.
    */
-  repo: z108.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
+  repo: z109.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
   /**
    * How far back to look for recent-runs activity (minutes). Default 30 —
    * matches the typical wedge-detection window from the #3070 / #3076 outages.
    */
-  activityWindowMinutes: z108.number().int().min(5).max(180).default(30).describe("Recent-runs lookback window in minutes (5-180; default 30).")
+  activityWindowMinutes: z109.number().int().min(5).max(180).default(30).describe("Recent-runs lookback window in minutes (5-180; default 30).")
 });
 var STATUS_PAGE_URL = "https://www.githubstatus.com/api/v2/components.json";
 function mapStatusPageStatus(raw) {
@@ -49730,8 +49820,8 @@ var DESCRIPTION = "Check CI infrastructure health before triggering / polling ru
 function registerCiHealthCheckTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "ci_health_check" });
   const toolSchema = {
-    repo: z108.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
-    activityWindowMinutes: z108.number().int().min(5).max(180).optional().describe("Recent-runs lookback window in minutes (5-180; default 30).")
+    repo: z109.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, "Must be owner/repo form").optional().describe("GitHub repo (owner/repo) to check for recent CI activity. Optional."),
+    activityWindowMinutes: z109.number().int().min(5).max(180).optional().describe("Recent-runs lookback window in minutes (5-180; default 30).")
   };
   const secureHandler = createSecureHandler((args) => ciHealthCheckHandler(args, logger58), {
     toolName: "ci_health_check",
@@ -49757,18 +49847,18 @@ function registerCiHealthCheckTool(server, deps) {
 
 // src/mcp/tools/quality-gate-tool.ts
 import { statSync as statSync3 } from "fs";
-import { z as z109 } from "zod";
-var QualityCheckSchema = z109.enum(["typecheck", "lint", "tests", "build", "security"]);
+import { z as z110 } from "zod";
+var QualityCheckSchema = z110.enum(["typecheck", "lint", "tests", "build", "security"]);
 var DEFAULT_CHECKS = ["typecheck", "lint", "tests"];
-var RunQualityGateInputSchema = z109.object({
+var RunQualityGateInputSchema = z110.object({
   /** Project directory to run checks against. Must resolve inside the repo/cwd root. */
-  projectDir: z109.string().optional().describe(
+  projectDir: z110.string().optional().describe(
     "Project directory to run checks against (default: cwd). Must stay inside the repo root."
   ),
   /** Which allowlisted checks to run. */
-  checks: z109.array(QualityCheckSchema).nonempty().default([...DEFAULT_CHECKS]).describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
+  checks: z110.array(QualityCheckSchema).nonempty().default([...DEFAULT_CHECKS]).describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
   /** 1-based iteration counter, forwarded to the engine for feedback context. */
-  iteration: z109.number().int().min(1).default(1).describe("1-based iteration number (default 1).")
+  iteration: z110.number().int().min(1).default(1).describe("1-based iteration number (default 1).")
 });
 function validateProjectDir(raw) {
   const candidate = raw ?? process.cwd();
@@ -49843,11 +49933,11 @@ var DESCRIPTION2 = "Run the QA quality gate (#1684 engine) against a project dir
 function registerRunQualityGateTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "run_quality_gate" });
   const toolSchema = {
-    projectDir: z109.string().optional().describe(
+    projectDir: z110.string().optional().describe(
       "Project directory to run checks against (default: cwd). Must stay inside the repo root."
     ),
-    checks: z109.array(QualityCheckSchema).nonempty().optional().describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
-    iteration: z109.number().int().min(1).optional().describe("1-based iteration number (default 1).")
+    checks: z110.array(QualityCheckSchema).nonempty().optional().describe("Allowlisted checks to run (default: ['typecheck','lint','tests'])."),
+    iteration: z110.number().int().min(1).optional().describe("1-based iteration number (default 1).")
   };
   const secureHandler = createSecureHandler(
     (args) => runQualityGateHandler(args, logger58),
@@ -49877,9 +49967,9 @@ function registerRunQualityGateTool(server, deps) {
 // src/mcp/tools/verify-audit-chain-tool.ts
 import * as fs9 from "fs/promises";
 import * as path8 from "path";
-import { z as z110 } from "zod";
-var VerifyAuditChainInputSchema = z110.object({
-  logDir: z110.string().min(1).max(512).describe(
+import { z as z111 } from "zod";
+var VerifyAuditChainInputSchema = z111.object({
+  logDir: z111.string().min(1).max(512).describe(
     "Filesystem path to the FileAuditStorage log directory. Tool reads all `audit-*.jsonl` files in lexicographic order and verifies the combined chain."
   )
 });
@@ -49969,7 +50059,7 @@ async function handler2(args, ctx) {
 function registerVerifyAuditChainTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "verify_audit_chain" });
   const toolSchema = {
-    logDir: z110.string().min(1).max(512).describe(
+    logDir: z111.string().min(1).max(512).describe(
       "Filesystem path to the FileAuditStorage log directory. Tool reads all `audit-*.jsonl` files and verifies the combined hash chain."
     )
   };
@@ -49993,7 +50083,7 @@ function registerVerifyAuditChainTool(server, deps) {
 }
 
 // src/mcp/tools/suggest-research-tasks-tool.ts
-import { z as z111 } from "zod";
+import { z as z112 } from "zod";
 var SUGGEST_RESEARCH_TASKS_NOTE = "Suggestions derived from external research (untrusted); review before acting \u2014 nothing was executed or filed.";
 var RESEARCH_BUDGET_MS = 2e4;
 var RESEARCH_TIMED_OUT = /* @__PURE__ */ Symbol("research-budget-exceeded");
@@ -50010,11 +50100,11 @@ async function withResearchBudget(p, ms) {
     if (timer !== void 0) clearTimeout(timer);
   }
 }
-var SuggestResearchTasksInputSchema = z111.object({
-  topic: z111.string().optional().describe("Topic filter passed to research_discover. Optional."),
-  qualityThreshold: z111.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
-  maxTriggers: z111.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
-  existingTaskIds: z111.array(z111.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
+var SuggestResearchTasksInputSchema = z112.object({
+  topic: z112.string().optional().describe("Topic filter passed to research_discover. Optional."),
+  qualityThreshold: z112.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
+  maxTriggers: z112.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
+  existingTaskIds: z112.array(z112.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
 });
 function toTriggerConfig(input) {
   return {
@@ -50071,10 +50161,10 @@ var DESCRIPTION3 = "SUGGEST-ONLY: surface candidate pipeline tasks for human/orc
 function registerSuggestResearchTasksTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "suggest_research_tasks" });
   const toolSchema = {
-    topic: z111.string().optional().describe("Topic filter passed to research_discover. Optional."),
-    qualityThreshold: z111.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
-    maxTriggers: z111.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
-    existingTaskIds: z111.array(z111.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
+    topic: z112.string().optional().describe("Topic filter passed to research_discover. Optional."),
+    qualityThreshold: z112.number().min(0).max(10).optional().describe("Minimum quality score (0-10) a discovery must meet to be suggested. Optional."),
+    maxTriggers: z112.number().int().min(1).optional().describe("Max number of candidate tasks to return (>=1). Optional."),
+    existingTaskIds: z112.array(z112.string()).optional().describe("Known task IDs to skip (dedup). Optional.")
   };
   const secureHandler = createSecureHandler(
     (args) => suggestResearchTasksHandler(args, logger58),
@@ -50102,7 +50192,7 @@ function registerSuggestResearchTasksTool(server, deps) {
 }
 
 // src/mcp/tools/run-tool.ts
-import { z as z115 } from "zod";
+import { z as z116 } from "zod";
 import { randomUUID as randomUUID17 } from "crypto";
 
 // src/orchestration/meta-dispatcher.ts
@@ -50497,7 +50587,7 @@ function createMetaOrchestrator(options) {
 
 // src/orchestration/meta-shadow-selector.ts
 import { appendFileSync as appendFileSync6, existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
-import { z as z112 } from "zod";
+import { z as z113 } from "zod";
 var SHADOW_STRATEGY_ARMS = [
   "single-shot",
   "dev-pipeline",
@@ -50584,19 +50674,19 @@ function createHydratableSelector() {
 var META_OUTCOME_SCHEMA_VERSION = 1;
 var HYDRATE_LOOKBACK_DAYS = 30;
 var HYDRATE_LOOKBACK_MS = HYDRATE_LOOKBACK_DAYS * 24 * 60 * 60 * 1e3;
-var PersistedContextSchema = z112.object({
-  taskComplexity: z112.number(),
-  contextLengthNormalized: z112.number(),
-  isCodeTask: z112.number(),
-  isReasoningTask: z112.number(),
-  budgetUtilization: z112.number(),
-  timePressure: z112.number()
-});
-var PersistedMetaOutcomeSchema = z112.object({
-  schema: z112.literal(META_OUTCOME_SCHEMA_VERSION),
-  timestamp: z112.string(),
-  strategy: z112.enum(SHADOW_STRATEGY_ARMS),
-  success: z112.boolean(),
+var PersistedContextSchema = z113.object({
+  taskComplexity: z113.number(),
+  contextLengthNormalized: z113.number(),
+  isCodeTask: z113.number(),
+  isReasoningTask: z113.number(),
+  budgetUtilization: z113.number(),
+  timePressure: z113.number()
+});
+var PersistedMetaOutcomeSchema = z113.object({
+  schema: z113.literal(META_OUTCOME_SCHEMA_VERSION),
+  timestamp: z113.string(),
+  strategy: z113.enum(SHADOW_STRATEGY_ARMS),
+  success: z113.boolean(),
   context: PersistedContextSchema
 });
 var persistLogger = createLogger({ component: "MetaShadowSelector" });
@@ -50989,7 +51079,7 @@ function evaluateMetaStrategyReadiness(result, config = DEFAULT_META_STRATEGY_RE
 }
 
 // src/mcp/tools/dev-pipeline-tool.ts
-import { z as z113 } from "zod";
+import { z as z114 } from "zod";
 import * as fs11 from "fs";
 import * as path10 from "path";
 import { randomUUID as randomUUID15 } from "crypto";
@@ -51142,36 +51232,36 @@ var DEV_PIPELINE_DRY_RUN_NOTE = "This was a dry run (plan+vote), which always ru
 function dispatchNoteFor(dryRun) {
   return dryRun ? DEV_PIPELINE_DRY_RUN_NOTE : DEV_PIPELINE_ASYNC_HINT;
 }
-var DevPipelineInputSchema = z113.object({
+var DevPipelineInputSchema = z114.object({
   /** Direct task instructions. */
-  task: z113.string().max(1e4).optional().describe("Direct task instructions (what to build)"),
+  task: z114.string().max(1e4).optional().describe("Direct task instructions (what to build)"),
   /** Path to a plan file (.md, .yaml, .txt) to use as input. */
-  planFile: z113.string().max(500).optional().describe("Path to a plan/spec file to use as input"),
+  planFile: z114.string().max(500).optional().describe("Path to a plan/spec file to use as input"),
   /** Whether to run in dry-run mode (plan+vote only, no implementation). */
-  dryRun: z113.boolean().default(false).describe("If true, stop after plan+vote (no implementation)"),
+  dryRun: z114.boolean().default(false).describe("If true, stop after plan+vote (no implementation)"),
   /** Maximum vote iterations before proceeding (default: 3). */
-  maxVoteIterations: z113.number().int().min(1).max(5).default(3).describe("Max plan\u2192vote iterations"),
+  maxVoteIterations: z114.number().int().min(1).max(5).default(3).describe("Max plan\u2192vote iterations"),
   /** Maximum QA iterations per task (default: 3). */
-  maxQaIterations: z113.number().int().min(1).max(5).default(3).describe("Max QA review iterations per task"),
+  maxQaIterations: z114.number().int().min(1).max(5).default(3).describe("Max QA review iterations per task"),
   /** Working directory for the pipeline (default: cwd). Used for security scan and context. */
-  workingDir: z113.string().max(500).optional().describe("Working directory (default: cwd)"),
+  workingDir: z114.string().max(500).optional().describe("Working directory (default: cwd)"),
   /** GitHub issue number to track progress on. Updates posted as comments. */
-  issueNumber: z113.number().int().positive().optional().describe("GitHub issue to post progress to"),
+  issueNumber: z114.number().int().positive().optional().describe("GitHub issue to post progress to"),
   /** GitHub repo (owner/name) for issue tracking. */
-  repo: z113.string().max(200).optional().describe("GitHub repo for issue tracking (e.g., owner/repo)"),
+  repo: z114.string().max(200).optional().describe("GitHub repo for issue tracking (e.g., owner/repo)"),
   /** Task tracking backend: github, gitlab, or json (default: json). */
-  trackerBackend: z113.enum(["github", "gitlab", "json"]).default("json").describe("Task tracking backend for issue creation"),
+  trackerBackend: z114.enum(["github", "gitlab", "json"]).default("json").describe("Task tracking backend for issue creation"),
   /** Labels to apply to created issues. */
-  labels: z113.array(z113.string()).optional().describe("Labels for created issues"),
+  labels: z114.array(z114.string()).optional().describe("Labels for created issues"),
   /** Session ID for checkpoint/resume. Enables crash recovery. */
-  sessionId: z113.string().max(128).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Session ID for checkpoint/resume (crash recovery)"),
+  sessionId: z114.string().max(128).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Session ID for checkpoint/resume (crash recovery)"),
   /**
    * TESTS ONLY — when true, voters return random decisions. Must not be used as
    * a fallback when adapters are unavailable; configure an adapter instead. (#2319)
    */
-  simulateVotes: z113.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)"),
+  simulateVotes: z114.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)"),
   /** Voting strategy for consensus stages. */
-  votingStrategy: z113.enum([
+  votingStrategy: z114.enum([
     "simple_majority",
     "supermajority",
     "unanimous",
@@ -51180,11 +51270,11 @@ var DevPipelineInputSchema = z113.object({
     "opinion_wise"
   ]).optional().describe("Voting strategy for plan approval (default: higher_order)"),
   /** Use 3 agents instead of 6 for faster voting. */
-  quickMode: z113.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
+  quickMode: z114.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
   /** Maximum execution time per stage in milliseconds (min 30s, max 600s). */
-  timeoutMs: z113.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
+  timeoutMs: z114.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
   /** Pipeline execution mode. */
-  mode: z113.enum(["autonomous", "harness"]).default("autonomous").describe(
+  mode: z114.enum(["autonomous", "harness"]).default("autonomous").describe(
     "'autonomous': full pipeline. 'harness': stops after decompose, returns tasks for caller to implement."
   ),
   /**
@@ -51195,15 +51285,15 @@ var DevPipelineInputSchema = z113.object({
    * `get_job_result({ jobId })` for the result. Ignored when `dryRun` is
    * true (plan+vote completes fast, so dry runs always stay sync).
    */
-  dispatch: z113.enum(["sync", "async"]).default("sync").describe(
+  dispatch: z114.enum(["sync", "async"]).default("sync").describe(
     "Dispatch mode (#3726). 'sync' (default): run inline. 'async': return a jobId immediately + run in background (poll get_job_result). Ignored for dryRun."
   ),
   /** Local pre-ship quality gate (typecheck/lint/tests) mode (#3356). */
-  qualityGate: z113.enum(["off", "advisory", "blocking"]).default("off").describe(
+  qualityGate: z114.enum(["off", "advisory", "blocking"]).default("off").describe(
     "Pre-ship local quality gate. 'off' (default): skip. 'advisory': run + record feedback, never fail. 'blocking': a red gate fails the pipeline."
   ),
   /** Opt-in per-run token budget — a safety cap for unattended runs (#3395). */
-  maxBudgetTokens: z113.number().int().positive().optional().describe(
+  maxBudgetTokens: z114.number().int().positive().optional().describe(
     "Per-run token ceiling (#3395). When set, expert calls stop (returning failures) once cumulative usage crosses it \u2014 a hard-stop safety cap for unattended/multi-day runs. Omit to disable (default)."
   )
 });
@@ -51402,20 +51492,20 @@ function registerDevPipelineTool(server, deps) {
 }
 
 // src/mcp/tools/pipeline-tool.ts
-import { z as z114 } from "zod";
+import { z as z115 } from "zod";
 import * as fs12 from "fs";
 import * as path11 from "path";
 import { randomUUID as randomUUID16 } from "crypto";
 var PIPELINE_ASYNC_HINT = "A full run_pipeline run can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
-var PipelineInputSchema = z114.object({
+var PipelineInputSchema = z115.object({
   /** The task to execute. */
-  task: z114.string().min(5).max(1e4).describe("Task description \u2014 pipeline template auto-selected based on content"),
+  task: z115.string().min(5).max(1e4).describe("Task description \u2014 pipeline template auto-selected based on content"),
   /** Path to a spec file (.md, .yaml) to use as task input. */
-  specFile: z114.string().max(500).optional().describe("Path to a spec file \u2014 content prepended to task for greenfield projects"),
+  specFile: z115.string().max(500).optional().describe("Path to a spec file \u2014 content prepended to task for greenfield projects"),
   /** Override template — see `listTemplateIds()` for the canonical list (#2728). Auto-detected if omitted. */
-  template: z114.string().max(50).optional().describe(`Pipeline template override. Available: ${listTemplateIds().join(", ")}`),
+  template: z115.string().max(50).optional().describe(`Pipeline template override. Available: ${listTemplateIds().join(", ")}`),
   /** Voting strategy for consensus stages. */
-  votingStrategy: z114.enum([
+  votingStrategy: z115.enum([
     "simple_majority",
     "supermajority",
     "unanimous",
@@ -51426,11 +51516,11 @@ var PipelineInputSchema = z114.object({
     "Voting strategy for plan approval. simple_majority (default), supermajority (67%), unanimous, higher_order (Bayesian), proof_of_learning, opinion_wise"
   ),
   /** Use 3 agents instead of 6 for faster voting. */
-  quickMode: z114.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
+  quickMode: z115.boolean().default(false).describe("Use 3 agents instead of 6 for faster consensus voting"),
   /** Maximum execution time per stage in milliseconds (min 30s, max 600s). */
-  timeoutMs: z114.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
+  timeoutMs: z115.number().int().min(3e4).max(6e5).optional().describe("Max time per stage in ms (30000-600000). Default: varies by stage complexity"),
   /** Stop after planning/voting (no implementation). */
-  dryRun: z114.boolean().default(false).describe("Stop after vote stage (no implementation)"),
+  dryRun: z115.boolean().default(false).describe("Stop after vote stage (no implementation)"),
   /**
    * Dispatch mode (#3730). `sync` (default) runs the pipeline inline and
    * returns the result — but a real multi-stage adaptive run can exceed the
@@ -51439,11 +51529,11 @@ var PipelineInputSchema = z114.object({
    * `get_job_result({ jobId })` for the result. Ignored when `dryRun` is true
    * (plan+vote completes fast, so dry runs always stay sync).
    */
-  dispatch: z114.enum(["sync", "async"]).default("sync").describe(
+  dispatch: z115.enum(["sync", "async"]).default("sync").describe(
     "Dispatch mode (#3730). 'sync' (default): run inline. 'async': return a jobId immediately + run in background (poll get_job_result). Ignored for dryRun."
   ),
   /** TESTS ONLY — random output, must not be used for real decisions. (#2319) */
-  simulateVotes: z114.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
+  simulateVotes: z115.boolean().default(false).describe("TESTS ONLY \u2014 random output, must not be used for real decisions (#2319)")
 });
 function buildOutput3(result, simulated) {
   return {
@@ -51608,9 +51698,9 @@ function registerPipelineTool(server, deps) {
 }
 
 // src/mcp/tools/run-tool.ts
-var RunInputSchema = z115.object({
-  goal: z115.string().min(1).describe("Natural-language goal. nexus-agents selects how to execute it."),
-  forceStrategy: z115.enum([
+var RunInputSchema = z116.object({
+  goal: z116.string().min(1).describe("Natural-language goal. nexus-agents selects how to execute it."),
+  forceStrategy: z116.enum([
     "single-shot",
     "dev-pipeline",
     "pipeline",
@@ -51622,10 +51712,10 @@ var RunInputSchema = z115.object({
   ]).optional().describe(
     "Power-user override: force a specific strategy instead of letting the router choose."
   ),
-  requiresConsensus: z115.boolean().optional().describe("Hint: the task needs a multi-perspective consensus decision."),
-  dependencyStructure: z115.enum(["linear", "dag", "independent", "unknown"]).optional().describe("Hint: the dependency structure of the work."),
-  isNovel: z115.boolean().optional().describe("Hint: this kind of task has not been seen before."),
-  execute: z115.boolean().optional().describe(
+  requiresConsensus: z116.boolean().optional().describe("Hint: the task needs a multi-perspective consensus decision."),
+  dependencyStructure: z116.enum(["linear", "dag", "independent", "unknown"]).optional().describe("Hint: the dependency structure of the work."),
+  isNovel: z116.boolean().optional().describe("Hint: this kind of task has not been seen before."),
+  execute: z116.boolean().optional().describe(
     "When true, actually run the selected strategy (if an executor is wired) and return its result; otherwise return the routing decision only (default false, read-only)."
   ),
   /**
@@ -51640,7 +51730,7 @@ var RunInputSchema = z115.object({
    * other, the call is REFUSED rather than executed: silently ignoring a
    * do-not-act flag is the one outcome a governance substrate cannot allow.
    */
-  dryRun: z115.boolean().optional().describe(
+  dryRun: z116.boolean().optional().describe(
     "Plan and vote only, no implementation (#4806). Requires the dev-pipeline strategy \u2014 refused (never silently executed) when the router selects another."
   ),
   /**
@@ -51651,7 +51741,7 @@ var RunInputSchema = z115.object({
    * envelope immediately and runs in the background; poll
    * `get_job_result({ jobId })`. Ignored for read-only routing (execute:false).
    */
-  dispatch: z115.enum(["sync", "async"]).optional().describe(
+  dispatch: z116.enum(["sync", "async"]).optional().describe(
     "Dispatch mode (#3732). 'sync' (default): run inline. 'async' (only with execute:true): return a jobId immediately + run in background (poll get_job_result)."
   )
 });
@@ -51889,12 +51979,12 @@ function registerRunTool(server, deps) {
 }
 
 // src/mcp/tools/list-available-models-tool.ts
-import { z as z116 } from "zod";
+import { z as z117 } from "zod";
 var DESCRIPTION5 = "Probe every model-discovery transport (OpenRouter API + opencode/claude/codex/gemini CLIs) and report a per-transport health summary: probe ok/failed, model count, and a sample of ids. Use it to validate the CLIs and APIs are wired and reachable. Read-only; does not change routing.";
 var PROBE_TIMEOUT_MS = 12e3;
-var ListAvailableModelsInputSchema = z116.object({
-  includeModelIds: z116.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
-  includeOpenRouter: z116.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
+var ListAvailableModelsInputSchema = z117.object({
+  includeModelIds: z117.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
+  includeOpenRouter: z117.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
 });
 async function probeSource(source, includeModelIds) {
   let timer;
@@ -51961,8 +52051,8 @@ async function listAvailableModelsHandler(args, deps, logger58) {
 function registerListAvailableModelsTool(server, deps) {
   const logger58 = deps.logger ?? createLogger({ tool: "list_available_models" });
   const toolSchema = {
-    includeModelIds: z116.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
-    includeOpenRouter: z116.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
+    includeModelIds: z117.boolean().optional().describe("Include the full model-id list per transport (default false \u2192 sample of 5 only)."),
+    includeOpenRouter: z117.boolean().optional().describe("Probe the OpenRouter live catalog (default true).")
   };
   const secureHandler = createSecureHandler(
     (args) => listAvailableModelsHandler(args, deps, logger58),
@@ -51986,7 +52076,7 @@ function registerListAvailableModelsTool(server, deps) {
 }
 
 // src/mcp/tools/pr-review-eval-types.ts
-import { z as z117 } from "zod";
+import { z as z118 } from "zod";
 var PR_REVIEW_EVAL_ROLES = [
   "architect",
   "security",
@@ -51994,43 +52084,43 @@ var PR_REVIEW_EVAL_ROLES = [
   "catfish",
   "scope_steward"
 ];
-var PrReviewEvalRoleSchema = z117.enum(PR_REVIEW_EVAL_ROLES);
-var PrReviewCaseClassSchema = z117.enum(["buggy", "clean", "borderline"]);
-var VoterEvalVerdictSchema = z117.object({
+var PrReviewEvalRoleSchema = z118.enum(PR_REVIEW_EVAL_ROLES);
+var PrReviewCaseClassSchema = z118.enum(["buggy", "clean", "borderline"]);
+var VoterEvalVerdictSchema = z118.object({
   /** Stable record id (e.g. `${runId}:${caseNumber}:${role}`). */
-  id: z117.string().min(1).max(160),
+  id: z118.string().min(1).max(160),
   /** The pr_review run / batch this verdict belongs to. */
-  runId: z117.string().min(1).max(64),
+  runId: z118.string().min(1).max(64),
   /** Dataset case identifier (the dataset's `number` field). */
-  caseNumber: z117.string().min(1).max(80),
+  caseNumber: z118.string().min(1).max(80),
   /** Rubric class of the case (ground-truth label). */
   caseClass: PrReviewCaseClassSchema,
   /** The voter role being scored. */
   role: PrReviewEvalRoleSchema,
   /** Verified findings that matched a known bug. */
-  truePositives: z117.number().int().nonnegative(),
+  truePositives: z118.number().int().nonnegative(),
   /** Verified findings on clean code that matched no known bug. */
-  falsePositives: z117.number().int().nonnegative(),
+  falsePositives: z118.number().int().nonnegative(),
   /** Known bugs this voter failed to flag. */
-  falseNegatives: z117.number().int().nonnegative(),
+  falseNegatives: z118.number().int().nonnegative(),
   /** Rubric version the ground truth was adjudicated under. */
-  rubricVersion: z117.string().min(1).max(32),
+  rubricVersion: z118.string().min(1).max(32),
   /** ISO-8601 timestamp the verdict was recorded. */
-  timestamp: z117.string().min(1).max(40)
+  timestamp: z118.string().min(1).max(40)
 });
-var VoterEvalVerdictQuerySchema = z117.object({
+var VoterEvalVerdictQuerySchema = z118.object({
   role: PrReviewEvalRoleSchema.optional(),
-  runId: z117.string().min(1).max(64).optional(),
+  runId: z118.string().min(1).max(64).optional(),
   caseClass: PrReviewCaseClassSchema.optional(),
-  rubricVersion: z117.string().min(1).max(32).optional(),
+  rubricVersion: z118.string().min(1).max(32).optional(),
   /** ISO-8601 lower bound (inclusive) on `timestamp`. */
-  since: z117.string().optional(),
+  since: z118.string().optional(),
   /** Most-recent-N cap. */
-  limit: z117.number().int().positive().optional()
+  limit: z118.number().int().positive().optional()
 });
 
 // src/mcp/tools/supply-chain-tradeoff-panel.ts
-import { z as z118 } from "zod";
+import { z as z119 } from "zod";
 import { randomUUID as randomUUID18 } from "crypto";
 var DEFAULT_AXES = [
   "build_time_determinism",
@@ -52052,16 +52142,16 @@ var FULL_PANEL = [
   "scope_steward"
 ];
 var QUICK_PANEL = ["architect", "security", "scope_steward"];
-var SupplyChainTradeoffPanelInputSchema = z118.object({
-  proposal: z118.string().min(1).max(MAX_PROPOSAL_LENGTH).describe('The proposal under tradeoff review (e.g. "Should aegis-boot adopt cargo-nextest?")'),
-  axes: z118.array(z118.string().min(1).max(MAX_AXIS_NAME_LENGTH)).min(1).max(MAX_AXES).optional().describe(
+var SupplyChainTradeoffPanelInputSchema = z119.object({
+  proposal: z119.string().min(1).max(MAX_PROPOSAL_LENGTH).describe('The proposal under tradeoff review (e.g. "Should aegis-boot adopt cargo-nextest?")'),
+  axes: z119.array(z119.string().min(1).max(MAX_AXIS_NAME_LENGTH)).min(1).max(MAX_AXES).optional().describe(
     `Tradeoff axes to evaluate. Default: ${DEFAULT_AXES.join(", ")}. Custom axes accepted; max ${String(MAX_AXES)}.`
   ),
-  context: z118.string().max(MAX_CONTEXT_LENGTH).optional().describe(
+  context: z119.string().max(MAX_CONTEXT_LENGTH).optional().describe(
     "Optional context: relevant repo state, dependency tree, vendor publishing patterns, etc."
   ),
-  quickMode: z118.boolean().optional().default(false).describe("Use 3 voters (architect, security, scope_steward) instead of 7"),
-  simulate: z118.boolean().optional().default(false).describe("Use simulated voters (testing only)"),
+  quickMode: z119.boolean().optional().default(false).describe("Use 3 voters (architect, security, scope_steward) instead of 7"),
+  simulate: z119.boolean().optional().default(false).describe("Use simulated voters (testing only)"),
   /**
    * Dispatch mode (#3731). `sync` (default) runs the panel inline and returns
    * the result — but a live fan-out (up to 7 voters) can exceed the MCP request
@@ -52069,7 +52159,7 @@ var SupplyChainTradeoffPanelInputSchema = z118.object({
    * immediately and runs the panel in the background; poll
    * `get_job_result({ jobId })` for the result.
    */
-  dispatch: z118.enum(["sync", "async"]).default("sync").describe(
+  dispatch: z119.enum(["sync", "async"]).default("sync").describe(
     "Dispatch mode (#3731). 'sync' (default): run inline. 'async': return a jobId immediately + run the panel in background (poll get_job_result)."
   )
 });
@@ -52547,40 +52637,40 @@ var RiskLevel = /* @__PURE__ */ ((RiskLevel2) => {
 })(RiskLevel || {});
 
 // src/mcp/safety/stpa-schemas.ts
-import { z as z119 } from "zod";
-var HazardCategorySchema = z119.enum(HazardCategory);
-var HazardSeveritySchema = z119.enum(HazardSeverity);
-var ConstraintPrioritySchema = z119.enum(ConstraintPriority);
-var RiskLevelSchema = z119.enum(RiskLevel);
-var TriggerPatternSchema = z119.object({
-  parameter: z119.string().min(1),
-  matchType: z119.enum(["contains", "regex", "equals", "startsWith", "endsWith"]),
-  pattern: z119.string(),
-  reason: z119.string()
-});
-var HazardSchema = z119.object({
-  id: z119.string().min(1),
-  description: z119.string(),
+import { z as z120 } from "zod";
+var HazardCategorySchema = z120.enum(HazardCategory);
+var HazardSeveritySchema = z120.enum(HazardSeverity);
+var ConstraintPrioritySchema = z120.enum(ConstraintPriority);
+var RiskLevelSchema = z120.enum(RiskLevel);
+var TriggerPatternSchema = z120.object({
+  parameter: z120.string().min(1),
+  matchType: z120.enum(["contains", "regex", "equals", "startsWith", "endsWith"]),
+  pattern: z120.string(),
+  reason: z120.string()
+});
+var HazardSchema = z120.object({
+  id: z120.string().min(1),
+  description: z120.string(),
   category: HazardCategorySchema,
   severity: HazardSeveritySchema,
-  likelihood: z119.enum(["almost_certain", "likely", "possible", "unlikely", "rare"]),
-  triggerConditions: z119.array(z119.string()),
-  consequences: z119.array(z119.string())
-});
-var UnsafeControlActionSchema = z119.object({
-  id: z119.string().min(1),
-  toolName: z119.string().min(1),
-  type: z119.enum(["not_provided", "provided_causes_hazard", "wrong_timing", "wrong_duration"]),
-  description: z119.string(),
-  unsafeContext: z119.string(),
-  relatedHazards: z119.array(z119.string()),
-  triggerPatterns: z119.array(TriggerPatternSchema).optional()
-});
-var SafetyConstraintSchema = z119.object({
-  id: z119.string().min(1),
-  description: z119.string(),
-  mitigates: z119.array(z119.string()),
-  enforcement: z119.enum([
+  likelihood: z120.enum(["almost_certain", "likely", "possible", "unlikely", "rare"]),
+  triggerConditions: z120.array(z120.string()),
+  consequences: z120.array(z120.string())
+});
+var UnsafeControlActionSchema = z120.object({
+  id: z120.string().min(1),
+  toolName: z120.string().min(1),
+  type: z120.enum(["not_provided", "provided_causes_hazard", "wrong_timing", "wrong_duration"]),
+  description: z120.string(),
+  unsafeContext: z120.string(),
+  relatedHazards: z120.array(z120.string()),
+  triggerPatterns: z120.array(TriggerPatternSchema).optional()
+});
+var SafetyConstraintSchema = z120.object({
+  id: z120.string().min(1),
+  description: z120.string(),
+  mitigates: z120.array(z120.string()),
+  enforcement: z120.enum([
     "prevent",
     "require_confirmation",
     "alert",
@@ -52588,52 +52678,52 @@ var SafetyConstraintSchema = z119.object({
     "rate_limit",
     "require_privilege"
   ]),
-  validationFunction: z119.string().optional(),
+  validationFunction: z120.string().optional(),
   priority: ConstraintPrioritySchema
 });
-var PropertySchemaSchema = z119.object({
-  type: z119.string(),
-  description: z119.string().optional(),
-  enum: z119.array(z119.unknown()).optional(),
-  pattern: z119.string().optional(),
-  minimum: z119.number().optional(),
-  maximum: z119.number().optional()
-});
-var ToolInputSchemaSchema = z119.object({
-  type: z119.string(),
-  properties: z119.record(z119.string(), PropertySchemaSchema).optional(),
-  required: z119.array(z119.string()).optional(),
-  additionalProperties: z119.boolean().optional()
-});
-var ToolDefinitionSchema = z119.object({
-  name: z119.string().min(1),
-  description: z119.string(),
+var PropertySchemaSchema = z120.object({
+  type: z120.string(),
+  description: z120.string().optional(),
+  enum: z120.array(z120.unknown()).optional(),
+  pattern: z120.string().optional(),
+  minimum: z120.number().optional(),
+  maximum: z120.number().optional()
+});
+var ToolInputSchemaSchema = z120.object({
+  type: z120.string(),
+  properties: z120.record(z120.string(), PropertySchemaSchema).optional(),
+  required: z120.array(z120.string()).optional(),
+  additionalProperties: z120.boolean().optional()
+});
+var ToolDefinitionSchema = z120.object({
+  name: z120.string().min(1),
+  description: z120.string(),
   inputSchema: ToolInputSchemaSchema
 });
-var AnalysisConfigurationSchema = z119.object({
-  includeLowSeverity: z119.boolean().default(true),
-  generateAllConstraints: z119.boolean().default(true),
-  checkInteractions: z119.boolean().default(true),
-  maxHazardsPerTool: z119.number().int().min(1).max(100).default(50),
-  categories: z119.array(HazardCategorySchema).default([])
+var AnalysisConfigurationSchema = z120.object({
+  includeLowSeverity: z120.boolean().default(true),
+  generateAllConstraints: z120.boolean().default(true),
+  checkInteractions: z120.boolean().default(true),
+  maxHazardsPerTool: z120.number().int().min(1).max(100).default(50),
+  categories: z120.array(HazardCategorySchema).default([])
 });
-var ConstraintViolationSchema = z119.object({
-  constraintId: z119.string().min(1),
-  constraintDescription: z119.string(),
+var ConstraintViolationSchema = z120.object({
+  constraintId: z120.string().min(1),
+  constraintDescription: z120.string(),
   severity: HazardSeveritySchema,
-  details: z119.string(),
-  remediation: z119.string()
-});
-var ValidationWarningSchema = z119.object({
-  code: z119.string().min(1),
-  message: z119.string(),
-  affected: z119.string()
-});
-var ValidationResultSchema = z119.object({
-  valid: z119.boolean(),
-  toolName: z119.string().min(1),
-  violations: z119.array(ConstraintViolationSchema),
-  passed: z119.array(z119.string()),
+  details: z120.string(),
+  remediation: z120.string()
+});
+var ValidationWarningSchema = z120.object({
+  code: z120.string().min(1),
+  message: z120.string(),
+  affected: z120.string()
+});
+var ValidationResultSchema = z120.object({
+  valid: z120.boolean(),
+  toolName: z120.string().min(1),
+  violations: z120.array(ConstraintViolationSchema),
+  passed: z120.array(z120.string()),
   // Optional rather than required, deliberately. `ValidationResult` declares
   // both fields required because every result this package produces has them;
   // the schema is the lenient inbound edge for a result that arrived from
@@ -52644,10 +52734,10 @@ var ValidationResultSchema = z119.object({
   // "nothing was evaluated". The strict/lenient split is safe because nothing
   // bridges the two with `z.infer`: a parsed result will not typecheck as a
   // `ValidationResult` without handling the absent fields.
-  evaluated: z119.array(z119.string()).optional(),
-  notApplicable: z119.array(z119.string()).optional(),
-  warnings: z119.array(ValidationWarningSchema),
-  validatedAt: z119.date()
+  evaluated: z120.array(z120.string()).optional(),
+  notApplicable: z120.array(z120.string()).optional(),
+  warnings: z120.array(ValidationWarningSchema),
+  validatedAt: z120.date()
 });
 
 // src/mcp/safety/stpa-types.ts
@@ -53732,42 +53822,42 @@ var GeminiResponseParser = class {
 };
 
 // src/cli-adapters/router-types.ts
-import { z as z120 } from "zod";
-var RouterConfigSchema = z120.object({
-  preferCostEfficient: z120.boolean().default(false),
-  maxDecisionTimeMs: z120.number().min(1).max(1e3).default(100)
+import { z as z121 } from "zod";
+var RouterConfigSchema = z121.object({
+  preferCostEfficient: z121.boolean().default(false),
+  maxDecisionTimeMs: z121.number().min(1).max(1e3).default(100)
 });
 
 // src/cli-adapters/agreement-cascade-types.ts
-import { z as z121 } from "zod";
-var AgreementCascadeConfigSchema = z121.object({
-  agreementThreshold: z121.number().min(0.5).max(1).default(0.7),
-  maxStages: z121.number().int().min(1).max(5).default(3),
-  modelTimeoutMs: z121.number().int().min(1e3).max(3e5).default(6e4)
+import { z as z122 } from "zod";
+var AgreementCascadeConfigSchema = z122.object({
+  agreementThreshold: z122.number().min(0.5).max(1).default(0.7),
+  maxStages: z122.number().int().min(1).max(5).default(3),
+  modelTimeoutMs: z122.number().int().min(1e3).max(3e5).default(6e4)
 });
 
 // src/cli-adapters/agreement-cascade-router.ts
 var logger50 = createLogger({ component: "agreement-cascade-router" });
 
 // src/cli-adapters/task-classifier.ts
-import { z as z122 } from "zod";
-var ClassificationPatternsSchema = z122.object({
-  code: z122.array(z122.string()).readonly(),
-  research: z122.array(z122.string()).readonly(),
-  documentation: z122.array(z122.string()).readonly(),
-  analysis: z122.array(z122.string()).readonly()
+import { z as z123 } from "zod";
+var ClassificationPatternsSchema = z123.object({
+  code: z123.array(z123.string()).readonly(),
+  research: z123.array(z123.string()).readonly(),
+  documentation: z123.array(z123.string()).readonly(),
+  analysis: z123.array(z123.string()).readonly()
 });
 
 // src/cli-adapters/response-cache-types.ts
-import { z as z123 } from "zod";
-var ResponseCacheConfigSchema = z123.object({
-  defaultTTL: z123.number().min(1e3).max(36e5).default(3e5),
+import { z as z124 } from "zod";
+var ResponseCacheConfigSchema = z124.object({
+  defaultTTL: z124.number().min(1e3).max(36e5).default(3e5),
   // 5 minutes
-  maxEntries: z123.number().min(10).max(1e5).default(1e3),
-  maxMemoryMB: z123.number().min(1).max(1e3).default(50),
-  cleanupInterval: z123.number().min(1e3).max(6e5).default(6e4),
+  maxEntries: z124.number().min(10).max(1e5).default(1e3),
+  maxMemoryMB: z124.number().min(1).max(1e3).default(50),
+  cleanupInterval: z124.number().min(1e3).max(6e5).default(6e4),
   // 1 minute
-  enableLogging: z123.boolean().default(false)
+  enableLogging: z124.boolean().default(false)
 });
 
 // src/cli-adapters/response-cache-utils.ts
@@ -53775,12 +53865,12 @@ import { createHash as createHash6 } from "crypto";
 var logger51 = createLogger({ component: "ResponseCacheUtils" });
 
 // src/cli-adapters/unified-routing-types.ts
-import { z as z124 } from "zod";
-var UnifiedRoutingDecisionSchema = z124.object({
-  selectedCli: z124.string(),
-  confidence: z124.number().min(0).max(1),
-  reason: z124.string(),
-  strategy: z124.enum([
+import { z as z125 } from "zod";
+var UnifiedRoutingDecisionSchema = z125.object({
+  selectedCli: z125.string(),
+  confidence: z125.number().min(0).max(1),
+  reason: z125.string(),
+  strategy: z125.enum([
     "composite",
     "quality",
     "budget",
@@ -53792,57 +53882,57 @@ var UnifiedRoutingDecisionSchema = z124.object({
     "linucb",
     "direct"
   ]),
-  decisionTimeMs: z124.number().nonnegative(),
-  alternatives: z124.array(z124.string()).readonly(),
-  stagesExecuted: z124.array(z124.string()).readonly(),
-  withinBudget: z124.boolean().optional(),
-  estimatedComplexity: z124.enum(["simple", "moderate", "complex", "expert"]).optional(),
-  estimatedTokens: z124.number().int().positive().optional(),
-  topsisScore: z124.number().optional(),
-  ucbScore: z124.number().optional(),
-  resolvedAtStage: z124.number().int().nonnegative().optional(),
-  consensusReached: z124.boolean().optional(),
-  agreementScore: z124.number().min(0).max(1).optional(),
-  metadata: z124.record(z124.string(), z124.unknown()).optional()
+  decisionTimeMs: z125.number().nonnegative(),
+  alternatives: z125.array(z125.string()).readonly(),
+  stagesExecuted: z125.array(z125.string()).readonly(),
+  withinBudget: z125.boolean().optional(),
+  estimatedComplexity: z125.enum(["simple", "moderate", "complex", "expert"]).optional(),
+  estimatedTokens: z125.number().int().positive().optional(),
+  topsisScore: z125.number().optional(),
+  ucbScore: z125.number().optional(),
+  resolvedAtStage: z125.number().int().nonnegative().optional(),
+  consensusReached: z125.boolean().optional(),
+  agreementScore: z125.number().min(0).max(1).optional(),
+  metadata: z125.record(z125.string(), z125.unknown()).optional()
 });
 
 // src/learning/outcome-feedback-types.ts
-import { z as z125 } from "zod";
-var QualitySignalsSchema = z125.object({
-  testsPass: z125.boolean().optional(),
-  lintErrors: z125.number().int().min(0).optional(),
-  userApproved: z125.boolean().optional(),
-  retryCount: z125.number().int().min(0).default(0),
-  completionRatio: z125.number().min(0).max(1).default(1),
-  validStructure: z125.boolean().optional(),
-  coherenceScore: z125.number().min(0).max(1).optional()
-});
-var RoutingDecisionSchema = z125.object({
-  id: z125.uuid(),
-  timestamp: z125.iso.datetime(),
-  query: z125.string(),
-  routerType: z125.enum(["linucb", "preference", "quality", "cascade", "topsis"]),
-  selectedModel: z125.string(),
-  selectedTier: z125.enum(["strong", "weak"]).optional(),
-  armIndex: z125.number().int().min(0).optional(),
-  banditContext: z125.record(z125.string(), z125.unknown()).optional(),
-  queryFeatures: z125.record(z125.string(), z125.unknown()).optional(),
-  ucbScore: z125.number().optional(),
-  confidence: z125.number().min(0).max(1).optional(),
-  traceId: z125.string(),
-  domain: z125.string().optional()
-});
-var TaskOutcomeSchema = z125.object({
-  routingDecisionId: z125.uuid(),
-  timestamp: z125.iso.datetime(),
-  outcomeClass: z125.enum(["success", "partial", "failure", "timeout", "error"]),
-  success: z125.boolean(),
-  qualityScore: z125.number().min(0).max(1),
-  durationMs: z125.number().min(0),
-  tokenUsage: z125.number().int().min(0),
-  errorMessage: z125.string().optional(),
+import { z as z126 } from "zod";
+var QualitySignalsSchema = z126.object({
+  testsPass: z126.boolean().optional(),
+  lintErrors: z126.number().int().min(0).optional(),
+  userApproved: z126.boolean().optional(),
+  retryCount: z126.number().int().min(0).default(0),
+  completionRatio: z126.number().min(0).max(1).default(1),
+  validStructure: z126.boolean().optional(),
+  coherenceScore: z126.number().min(0).max(1).optional()
+});
+var RoutingDecisionSchema = z126.object({
+  id: z126.uuid(),
+  timestamp: z126.iso.datetime(),
+  query: z126.string(),
+  routerType: z126.enum(["linucb", "preference", "quality", "cascade", "topsis"]),
+  selectedModel: z126.string(),
+  selectedTier: z126.enum(["strong", "weak"]).optional(),
+  armIndex: z126.number().int().min(0).optional(),
+  banditContext: z126.record(z126.string(), z126.unknown()).optional(),
+  queryFeatures: z126.record(z126.string(), z126.unknown()).optional(),
+  ucbScore: z126.number().optional(),
+  confidence: z126.number().min(0).max(1).optional(),
+  traceId: z126.string(),
+  domain: z126.string().optional()
+});
+var TaskOutcomeSchema = z126.object({
+  routingDecisionId: z126.uuid(),
+  timestamp: z126.iso.datetime(),
+  outcomeClass: z126.enum(["success", "partial", "failure", "timeout", "error"]),
+  success: z126.boolean(),
+  qualityScore: z126.number().min(0).max(1),
+  durationMs: z126.number().min(0),
+  tokenUsage: z126.number().int().min(0),
+  errorMessage: z126.string().optional(),
   qualitySignals: QualitySignalsSchema,
-  traceId: z125.string()
+  traceId: z126.string()
 });
 var DEFAULT_FEEDBACK_COLLECTOR_CONFIG = {
   maxPendingDecisions: 1e3,
@@ -53857,17 +53947,17 @@ var DEFAULT_FEEDBACK_COLLECTOR_CONFIG = {
   targetTokenUsage: 2e3,
   maxHistorySize: 1e4
 };
-var FeedbackCollectorConfigSchema = z125.object({
-  maxPendingDecisions: z125.number().int().positive().default(1e3),
-  pendingTimeoutMs: z125.number().positive().default(3e5),
-  enableAutoReward: z125.boolean().default(true),
-  qualityWeight: z125.number().min(0).max(1).default(0.5),
-  speedWeight: z125.number().min(0).max(1).default(0.2),
-  efficiencyWeight: z125.number().min(0).max(1).default(0.2),
-  retryPenalty: z125.number().min(0).max(1).default(0.1),
-  targetDurationMs: z125.number().positive().default(5e3),
-  targetTokenUsage: z125.number().positive().default(2e3),
-  maxHistorySize: z125.number().int().positive().default(1e4)
+var FeedbackCollectorConfigSchema = z126.object({
+  maxPendingDecisions: z126.number().int().positive().default(1e3),
+  pendingTimeoutMs: z126.number().positive().default(3e5),
+  enableAutoReward: z126.boolean().default(true),
+  qualityWeight: z126.number().min(0).max(1).default(0.5),
+  speedWeight: z126.number().min(0).max(1).default(0.2),
+  efficiencyWeight: z126.number().min(0).max(1).default(0.2),
+  retryPenalty: z126.number().min(0).max(1).default(0.1),
+  targetDurationMs: z126.number().positive().default(5e3),
+  targetTokenUsage: z126.number().positive().default(2e3),
+  maxHistorySize: z126.number().int().positive().default(1e4)
 });
 
 // src/learning/outcome-feedback-helpers.ts
@@ -56000,4 +56090,4 @@ export {
   shutdownFeedbackSubscriber,
   createEventBusBridge
 };
-//# sourceMappingURL=chunk-DJN4XAQO.js.map
+//# sourceMappingURL=chunk-KXQYRZ3X.js.map