token-harness 0.1.14 → 0.1.16

package/token-harness.mjs

@@ -5051,7 +5051,7 @@ function updateState(row2) {
   }
 }
 function healthState(input) {
-  if (input.detection.state === "broken" || input.detection.versionVerdict === "unknown-newer" || input.verification === "degraded" || input.quality.state === "regressed" || input.conflicts.length > 0 || input.detection.warnings.some((warning2) => warning2.severity === "error")) {
+  if (input.detection.state === "broken" || input.verification === "degraded" || input.quality.state === "regressed" || input.conflicts.length > 0 || input.detection.warnings.some((warning2) => warning2.severity === "error")) {
     return "attention";
   }
   if (input.detection.state === "configured" && input.verification === "verified")
@@ -9387,7 +9387,7 @@ var TOOL_VERSION;
 var init_version2 = __esm({
   "apps/cli/dist/src/version.js"() {
     "use strict";
-    TOOL_VERSION = "0.1.14";
+    TOOL_VERSION = "0.1.16";
   }
 });
 
@@ -16088,6 +16088,25 @@ function parseHarnessCapabilities(value3) {
     narrowing: flags
   };
 }
+function parseCapabilityDigests(value3) {
+  if (value3 === void 0)
+    return {};
+  if (typeof value3 !== "object" || value3 === null || Array.isArray(value3))
+    return null;
+  const result6 = {};
+  for (const [harness, raw] of Object.entries(value3)) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+      return null;
+    const entries = {};
+    for (const [path, digest] of Object.entries(raw)) {
+      if (typeof digest !== "string" || !/^[a-f0-9]{64}$/i.test(digest))
+        return null;
+      entries[path.replaceAll("\\", "/")] = `sha256:${digest.toLowerCase()}`;
+    }
+    result6[harness] = entries;
+  }
+  return result6;
+}
 function parseCapabilities(stdout) {
   let parsed;
   try {
@@ -16100,7 +16119,8 @@ function parseCapabilities(stdout) {
   const record5 = parsed;
   const version3 = record5["version"];
   const harnesses = record5["harnesses"];
-  if (typeof version3 !== "string" || typeof harnesses !== "object" || harnesses === null) {
+  const digests = parseCapabilityDigests(record5["digests"]);
+  if (typeof version3 !== "string" || typeof harnesses !== "object" || harnesses === null || digests === null) {
     return null;
   }
   const entries = {};
@@ -16110,7 +16130,7 @@ function parseCapabilities(stdout) {
       return null;
     entries[harness] = entry;
   }
-  return { version: version3, harnesses: entries };
+  return { version: version3, harnesses: entries, digests };
 }
 async function probeCapabilities(context) {
   const outcome2 = await context.runner.run({
@@ -16185,13 +16205,27 @@ function driftWarning(message, remediation) {
 function formatSurface(surface) {
   return `${surface.toolFamily}/${surface.interceptionPoint}`;
 }
+function requiresRuntimeSkillDigests(capabilities) {
+  const observed = parseSemanticVersion(capabilities.version);
+  const minimum = parseSemanticVersion(RUNTIME_SKILL_DIGESTS_MINIMUM);
+  if (observed === null || minimum === null)
+    return true;
+  return compareVersions(observed, minimum) >= 0;
+}
+function publishedSkillArtifactDigests(capabilities, harness) {
+  const install = SKILLS_INSTALL[harness];
+  if (install === void 0)
+    return [];
+  const prefix = `${install.directory}/skills/`;
+  return Object.entries(capabilities.digests?.[harness] ?? {}).filter(([path]) => path.startsWith(prefix));
+}
 function assignableOn(capabilities) {
   if (capabilities === null)
     return [];
   const reviews = MANIFEST6.delegatedInstallReviews ?? {};
   return Object.keys(reviews).filter((harness) => {
     const observed = capabilities.harnesses[harness];
-    return observed !== void 0 && observed.narrowing.length > 0 && writeSetStillReviewed(capabilities, harnessId(harness));
+    return observed !== void 0 && observed.narrowing.length > 0 && writeSetStillReviewed(capabilities, harnessId(harness)) && (!requiresRuntimeSkillDigests(capabilities) || publishedSkillArtifactDigests(capabilities, harness).length > 0);
   }).map((harness) => harnessId(harness));
 }
 function writeSetStillReviewed(capabilities, harness) {
@@ -16239,6 +16273,15 @@ function compareCapabilities(manifest, capabilities) {
       warnings.push(driftWarning(`\`harnesstrim capabilities\` (${capabilities.version}) declares ${entry} for ${harness}, which sits outside the containment boundary recorded at ${review.upstreamVersion} (${boundary.join(", ")})`, "Re-review the write set: rollback restores the boundary, and a path it does not cover would survive a rollback"));
     }
   }
+  if (requiresRuntimeSkillDigests(capabilities)) {
+    for (const harness of Object.keys(manifest.delegatedInstallReviews ?? {})) {
+      if (capabilities.harnesses[harness] === void 0)
+        continue;
+      if (publishedSkillArtifactDigests(capabilities, harness).length > 0)
+        continue;
+      warnings.push(driftWarning(`HarnessTrim ${capabilities.version} does not publish the ${harness} skill artifact digests required by the managed install contract`, `Use a HarnessTrim build that publishes per-harness artifact digests, or update Token Harness if the upstream capability contract changed`));
+    }
+  }
   return warnings;
 }
 function harnessesWiredToHarnessTrim(configs) {
@@ -16332,7 +16375,7 @@ function metricsLocations(context) {
 async function detect6(context) {
   const probe = await probeExecutable(context);
   const observed = probe.installed ? await probeCapabilities(context) : null;
-  const configured = harnessesWiredToHarnessTrim(context.harnessConfigs);
+  const configured = await configuredHarnessesForHarnessTrim(context, observed?.capabilities ?? null);
   const warnings = [];
   const evidenceItems = [...probe.evidence, ...observed?.evidence ?? []];
   if (observed !== null && observed.capabilities !== null) {
@@ -16496,11 +16539,12 @@ async function verify6(context) {
     evidence: probe.evidence,
     remediation: probe.installed ? null : "Install HarnessTrim, or add it to PATH"
   });
-  const configured = harnessesWiredToHarnessTrim(context.harnessConfigs);
+  const currentCapabilities = probe.installed ? await probeCapabilities(context) : null;
+  const configured = await configuredHarnessesForHarnessTrim(context, currentCapabilities?.capabilities ?? null);
   checks.push({
-    id: "hook-registered",
+    id: "integration-configured",
     status: configured.length > 0 ? "pass" : "not-exercised",
-    summary: configured.length > 0 ? `wired to ${configured.join(", ")}` : "no harness configuration names harnesstrim",
+    summary: configured.length > 0 ? `configured for ${configured.join(", ")}` : "no HarnessTrim hook, plugin, or matching skills-only installation was found",
     achievedTier: configured.length > 0 ? "config-only" : null,
     evidence: [],
     remediation: null
@@ -16716,16 +16760,46 @@ async function collectMetrics(context, store) {
     diagnostics
   };
 }
-function skillArtifacts(context, harness) {
+function skillArtifacts(context, harness, capabilities = null) {
   const install = SKILLS_INSTALL[harness];
   if (install === void 0)
     return [];
+  const dynamic = capabilities === null ? [] : publishedSkillArtifactDigests(capabilities, harness).map(([path, digest]) => ({
+    path: context.fs.join(context.projectRoot, ...path.split("/")),
+    digest
+  }));
+  if (dynamic.length > 0)
+    return dynamic;
+  if (capabilities !== null && requiresRuntimeSkillDigests(capabilities))
+    return [];
   const skills = context.fs.join(context.projectRoot, install.directory, "skills");
   return Object.entries(SKILL_ARTIFACT_DIGESTS).map(([path, digest]) => ({
     path: context.fs.join(skills, ...path.split("/")),
     digest
   }));
 }
+async function harnessTrimSkillsConfigured(context, harness, capabilities) {
+  const artifacts = skillArtifacts(context, harness, capabilities);
+  if (artifacts.length === 0)
+    return false;
+  for (const artifact of artifacts) {
+    const stat3 = await context.fs.stat(artifact.path);
+    if (stat3 === null || stat3.kind !== "file")
+      return false;
+    const actual = digestText(new TextDecoder().decode(await context.fs.readFile(artifact.path)));
+    if (actual !== artifact.digest)
+      return false;
+  }
+  return true;
+}
+async function configuredHarnessesForHarnessTrim(context, capabilities) {
+  const configured = new Set(harnessesWiredToHarnessTrim(context.harnessConfigs));
+  for (const harness of [CLAUDE2, CODEX2]) {
+    if (await harnessTrimSkillsConfigured(context, harness, capabilities))
+      configured.add(harness);
+  }
+  return [...configured];
+}
 async function plan(context, request) {
   const reviews = MANIFEST6.delegatedInstallReviews ?? {};
   const targets = request.harnesses.map((harness) => harness.id).filter((harness) => reviews[harness] !== void 0 && SKILLS_INSTALL[harness] !== void 0);
@@ -16737,8 +16811,11 @@ async function plan(context, request) {
       targetHarnesses: []
     };
   }
+  const installed2 = await probeExecutable(context);
+  const observed = installed2.installed ? await probeCapabilities(context) : null;
+  const currentCapabilities = observed?.capabilities ?? null;
   if (request.desiredState === "absent") {
-    const actions2 = targets.flatMap((harness) => skillArtifacts(context, harness).map((artifact) => ({
+    const actions2 = targets.flatMap((harness) => skillArtifacts(context, harness, currentCapabilities).map((artifact) => ({
       kind: "remove-owned-change",
       id: `harnesstrim-${harness}-skill-remove-${digestText(artifact.path).slice(7, 15)}`,
       riskClass: "reversible",
@@ -16747,7 +16824,7 @@ async function plan(context, request) {
       affectedPaths: [artifact.path],
       affectedProcesses: [],
       preconditions: [
-        `the HarnessTrim skill still matches the reviewed ${SKILLS_UPSTREAM} artifact`
+        `the HarnessTrim skill still matches the installed HarnessTrim artifact contract`
       ],
       postconditions: ["the owned HarnessTrim skill is absent"],
       rollbackData: "file-snapshot",
@@ -16768,7 +16845,6 @@ async function plan(context, request) {
       targetHarnesses: actions2.length === 0 ? [] : targets.map((harness) => harnessId(harness))
     };
   }
-  const installed2 = await probeExecutable(context);
   if (!installed2.installed) {
     return {
       providerId: HARNESSTRIM2,
@@ -16777,7 +16853,6 @@ async function plan(context, request) {
       targetHarnesses: []
     };
   }
-  const observed = await probeCapabilities(context);
   const actions = [];
   const plannedHarnesses = [];
   for (const harness of targets) {
@@ -16785,10 +16860,12 @@ async function plan(context, request) {
     const install = SKILLS_INSTALL[harness];
     if (review === void 0 || install === void 0)
       continue;
-    const reviewed = observed.capabilities === null ? installed2.version === review.upstreamVersion : writeSetStillReviewed(observed.capabilities, harnessId(harness));
+    const reviewed = currentCapabilities === null ? installed2.version === review.upstreamVersion : writeSetStillReviewed(currentCapabilities, harnessId(harness));
     if (!reviewed)
       continue;
-    const expectedArtifacts = skillArtifacts(context, harness);
+    const expectedArtifacts = skillArtifacts(context, harness, currentCapabilities);
+    if (expectedArtifacts.length === 0)
+      continue;
     actions.push({
       kind: "delegated-provider-install",
       id: `harnesstrim-${harness}-skills-${digestText(context.projectRoot).slice(7, 15)}`,
@@ -16798,11 +16875,11 @@ async function plan(context, request) {
       affectedPaths: expectedArtifacts.map((artifact) => artifact.path),
       affectedProcesses: ["harnesstrim"],
       preconditions: [
-        "harnesstrim is installed, on PATH, and declares the reviewed write set",
-        `the reviewed installer writes only the declared ${harness} skill artifacts`
+        "harnesstrim is installed, on PATH, and declares a compatible write set",
+        `the installed HarnessTrim build publishes the exact ${harness} skill artifact contract`
       ],
       postconditions: [
-        `HarnessTrim ${harness} skills match the reviewed ${review.upstreamVersion} artifacts`,
+        `HarnessTrim ${harness} skills match the installed ${installed2.version ?? review.upstreamVersion} artifact contract`,
         "no HarnessTrim hook or reduce-pipe instruction was added"
       ],
       rollbackData: "directory-snapshot",
@@ -16829,7 +16906,7 @@ async function plan(context, request) {
     targetHarnesses: plannedHarnesses
   };
 }
-var HARNESSTRIM2, CLAUDE2, HERMES2, CODEX2, PI2, SKILLS_UPSTREAM, SKILL_ARTIFACT_DIGESTS, SKILL_ARTIFACTS, OPENCODE2, MODE_CARRYING_HARNESSES, HOOK_COMMAND_PATTERN, PLUGIN_MODULE_PATTERN2, PI_EXTENSION_PATTERN, MANIFEST6, SKILLS_INSTALL, TESTED_UPSTREAM, TESTED_VERSIONS, SURFACE_ANCHORS, VERSION_PATTERN6, harnesstrimAdapter;
+var HARNESSTRIM2, CLAUDE2, HERMES2, CODEX2, PI2, SKILLS_UPSTREAM, RUNTIME_SKILL_DIGESTS_MINIMUM, SKILL_ARTIFACT_DIGESTS, SKILL_ARTIFACTS, OPENCODE2, MODE_CARRYING_HARNESSES, HOOK_COMMAND_PATTERN, PLUGIN_MODULE_PATTERN2, PI_EXTENSION_PATTERN, MANIFEST6, SKILLS_INSTALL, TESTED_UPSTREAM, TESTED_VERSIONS, SURFACE_ANCHORS, VERSION_PATTERN6, harnesstrimAdapter;
 var init_harnesstrim = __esm({
   "packages/adapters/dist/src/providers/harnesstrim.js"() {
     "use strict";
@@ -16840,6 +16917,7 @@ var init_harnesstrim = __esm({
     CODEX2 = harnessId("codex");
     PI2 = harnessId("pi");
     SKILLS_UPSTREAM = "0.0.7";
+    RUNTIME_SKILL_DIGESTS_MINIMUM = "0.3.0";
     SKILL_ARTIFACT_DIGESTS = {
       "compact-handoff/SKILL.md": "sha256:0efbf35581c559359e755b204778b64a289dab4d20dadc1cba3d5b5c995b5f01",
       "debug-log-slim/SKILL.md": "sha256:17f5ccc34d29d7aba083444e0e4d87fd3d49916ebcb4e6544caf8c89f13f0045",
@@ -18088,13 +18166,62 @@ var init_gitnexus_candidate = __esm({
 function claudeTarget(context) {
   return context.fs.join(context.paths.home, ".claude.json");
 }
-function prerequisiteDiagnostic(harness, version3, supportsMcp) {
+async function observeGitNexusManagedRuntime(context) {
+  const versionOutcome = await context.runner.run({
+    executable: "gitnexus",
+    args: ["--version"],
+    cwd: context.projectRoot,
+    timeoutMs: 2e4
+  });
+  if (versionOutcome.failure !== null) {
+    return {
+      ready: false,
+      absent: versionOutcome.failure.reason === "executable-not-found",
+      version: null,
+      executable: versionOutcome.executablePath,
+      supportsMcp: false,
+      detail: `gitnexus --version failed: ${versionOutcome.failure.reason}`
+    };
+  }
+  const version3 = parseGitNexusVersion(`${versionOutcome.stdout}
+${versionOutcome.stderr}`);
+  const actual = version3 === null ? null : parseSemanticVersion(version3);
+  const floor = parseSemanticVersion(GITNEXUS_REVIEWED_MCP_VERSION);
+  const newEnough = actual !== null && floor !== null && compareVersions(actual, floor) >= 0;
+  if (versionOutcome.exitCode !== 0 || !newEnough) {
+    return {
+      ready: false,
+      absent: false,
+      version: version3,
+      executable: versionOutcome.executablePath,
+      supportsMcp: false,
+      detail: version3 === null ? "GitNexus did not report a semantic version" : `GitNexus ${version3} predates the managed MCP floor ${GITNEXUS_REVIEWED_MCP_VERSION}`
+    };
+  }
+  const help = await context.runner.run({
+    executable: "gitnexus",
+    args: ["--help"],
+    cwd: context.projectRoot,
+    timeoutMs: 2e4
+  });
+  const capabilities = help.failure === null && help.exitCode === 0 ? parseGitNexusCliCapabilities(`${help.stdout}
+${help.stderr}`, "") : { query: false, context: false, statusJson: false, mcp: false };
+  return {
+    ready: capabilities.mcp,
+    absent: false,
+    version: version3,
+    executable: versionOutcome.executablePath,
+    supportsMcp: capabilities.mcp,
+    detail: capabilities.mcp ? `GitNexus ${version3} exposes the MCP command required by the managed Claude integration` : `GitNexus ${version3} does not advertise the MCP command required by the managed Claude integration`
+  };
+}
+function prerequisiteDiagnostic(harness, detail2) {
   return diagnostic({
     severity: "warning",
     code: "gitnexus-managed-mcp-prerequisite",
     subject: harness,
-    message: version3 === null ? "GitNexus is not available on the reviewed managed MCP surface" : supportsMcp ? `GitNexus ${version3} is not the reviewed managed MCP version ${GITNEXUS_REVIEWED_MCP_VERSION}` : `GitNexus ${version3} does not advertise the reviewed MCP command`,
-    remediation: `Keep the current installation user-owned; this build manages MCP registration only for GitNexus ${GITNEXUS_REVIEWED_MCP_VERSION}`
+    message: detail2,
+    remediation: `Install or update GitNexus to ${GITNEXUS_REVIEWED_MCP_VERSION} or newer with the MCP command, then refresh Token Harness`
   });
 }
 async function planGitNexusManagedMcpActivation(context, harness) {
@@ -18114,13 +18241,13 @@ async function planGitNexusManagedMcpActivation(context, harness) {
       ]
     };
   }
-  const observation = await observeGitNexusCandidate(context);
-  if (observation.state !== "benchmark-ready" || observation.version !== GITNEXUS_REVIEWED_MCP_VERSION || !observation.supportsMcp) {
+  const observation = await observeGitNexusManagedRuntime(context);
+  if (!observation.ready) {
     return {
       harness,
       target: null,
       actions: [],
-      diagnostics: [prerequisiteDiagnostic(harness, observation.version, observation.supportsMcp)]
+      diagnostics: [prerequisiteDiagnostic(harness, observation.detail)]
     };
   }
   const target = claudeTarget(context);
@@ -18287,12 +18414,12 @@ async function verifyGitNexusManagedMcpActivation(context, harness) {
       detail: "Managed GitNexus MCP verification is currently reviewed only for Claude Code"
     };
   }
-  const observation = await observeGitNexusCandidate(context);
-  if (observation.state !== "benchmark-ready" || observation.version !== GITNEXUS_REVIEWED_MCP_VERSION || !observation.supportsMcp) {
+  const observation = await observeGitNexusManagedRuntime(context);
+  if (!observation.ready) {
     return {
       state: "candidate-unavailable",
       target: null,
-      detail: observation.reasons.join("; ")
+      detail: observation.detail
     };
   }
   const target = claudeTarget(context);
@@ -18327,7 +18454,7 @@ async function verifyGitNexusManagedMcpActivation(context, harness) {
   return {
     state: "verified",
     target,
-    detail: `GitNexus ${GITNEXUS_REVIEWED_MCP_VERSION} is registered through the reviewed Claude MCP entry; verification did not start the MCP server`
+    detail: `GitNexus ${observation.version ?? ""} is registered through the Token Harness-owned Claude MCP entry; verification did not start the MCP server`
   };
 }
 var GITNEXUS_REVIEWED_MCP_VERSION, GITNEXUS_CLAUDE_MCP_POINTER, GITNEXUS_MCP_SERVER, DECODER;
@@ -18479,6 +18606,28 @@ var init_headroom_candidate = __esm({
 function parseMcptoonVersion(text3) {
   return VERSION_PATTERN10.exec(text3)?.[1] ?? null;
 }
+function numericCore2(version3) {
+  const core = version3.split(/[-+]/, 1)[0];
+  if (core === void 0)
+    return null;
+  const parts = core.split(".").map((part) => Number.parseInt(part, 10));
+  if (parts.length !== 3 || parts.some((part) => !Number.isInteger(part) || part < 0))
+    return null;
+  return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
+}
+function mcptoonVersionAtLeast(version3, minimum) {
+  const actual = numericCore2(version3);
+  const floor = numericCore2(minimum);
+  if (actual === null || floor === null)
+    return false;
+  for (let index = 0; index < 3; index += 1) {
+    const left = actual[index] ?? 0;
+    const right = floor[index] ?? 0;
+    if (left !== right)
+      return left > right;
+  }
+  return !(version3.includes("-") && !minimum.includes("-"));
+}
 function parseMcptoonManifestCapabilities(text3) {
   const lower = text3.toLowerCase();
   return {
@@ -18586,6 +18735,50 @@ var init_mcptoon_candidate = __esm({
 });
 
 // packages/adapters/dist/src/providers/mcptoon-managed.js
+async function observeMcptoonManagedRuntime(context) {
+  const versionOutcome = await context.runner.run({
+    executable: "mcptoon",
+    args: ["--version"],
+    cwd: context.projectRoot,
+    timeoutMs: 2e4
+  });
+  if (versionOutcome.failure !== null) {
+    return {
+      ready: false,
+      absent: versionOutcome.failure.reason === "executable-not-found",
+      version: null,
+      executable: versionOutcome.executablePath,
+      detail: `mcptoon --version failed: ${versionOutcome.failure.reason}`
+    };
+  }
+  const version3 = parseMcptoonVersion(`${versionOutcome.stdout}
+${versionOutcome.stderr}`);
+  if (versionOutcome.exitCode !== 0 || version3 === null || !mcptoonVersionAtLeast(version3, MCPTOON_MANAGED_MINIMUM_VERSION)) {
+    return {
+      ready: false,
+      absent: false,
+      version: version3,
+      executable: versionOutcome.executablePath,
+      detail: version3 === null ? "mcptoon did not report a semantic version" : `mcptoon ${version3} predates the managed runtime floor ${MCPTOON_MANAGED_MINIMUM_VERSION}`
+    };
+  }
+  const help = await context.runner.run({
+    executable: "mcptoon",
+    args: ["--help"],
+    cwd: context.projectRoot,
+    timeoutMs: 2e4
+  });
+  const capabilities = help.failure === null && help.exitCode === 0 ? parseMcptoonManifestCapabilities(`${help.stdout}
+${help.stderr}`) : { compact: false, json: false };
+  const ready = capabilities.compact && capabilities.json;
+  return {
+    ready,
+    absent: false,
+    version: version3,
+    executable: versionOutcome.executablePath,
+    detail: ready ? `mcptoon ${version3} exposes the compact/JSON CLI surfaces used by the managed integration` : `mcptoon ${version3} no longer advertises the compact/JSON CLI surfaces required by the managed integration`
+  };
+}
 function mcptoonInstallAction() {
   return {
     kind: "package-manager-install",
@@ -18811,11 +19004,11 @@ async function planMcptoonManagedActivation(context, harness) {
       ]
     };
   }
-  const observation = await observeMcptoonCandidate(context);
+  const observation = await observeMcptoonManagedRuntime(context);
   const activation = harness === "claude" ? await planClaudeActivation(context, harness) : await planCodexActivation(context, harness);
-  if (observation.state === "benchmark-ready")
+  if (observation.ready)
     return activation;
-  if (observation.state === "absent") {
+  if (observation.absent) {
     const activationSatisfied = activation.diagnostics.some((entry) => entry.code === "mcptoon-guidance-already-present");
     if (activation.actions.length === 0 && !activationSatisfied) {
       return activation;
@@ -18867,19 +19060,19 @@ async function planMcptoonManagedActivation(context, harness) {
         severity: "warning",
         code: "mcptoon-managed-prerequisite",
         subject: harness,
-        message: `mcptoon ${observation.version ?? ""} is runnable but not on the reviewed managed-activation surface`.trim(),
-        remediation: `Keep the existing installation user-owned, or move to the exact reviewed mcptoon ${MCPTOON_REVIEWED_INSTALL_VERSION} build`
+        message: observation.detail,
+        remediation: `Update mcptoon to ${MCPTOON_MANAGED_MINIMUM_VERSION} or newer with the required compact/JSON CLI surfaces, then refresh Token Harness`
       })
     ]
   };
 }
 async function verifyMcptoonManagedActivation(context, harness) {
-  const observation = await observeMcptoonCandidate(context);
-  if (observation.state !== "benchmark-ready") {
+  const observation = await observeMcptoonManagedRuntime(context);
+  if (!observation.ready) {
     return {
       state: "candidate-unavailable",
       target: null,
-      detail: observation.reasons.join("; ")
+      detail: observation.detail
     };
   }
   let target;
@@ -18906,22 +19099,23 @@ async function verifyMcptoonManagedActivation(context, harness) {
     return {
       state: "not-configured",
       target,
-      detail: "The reviewed mcptoon agent instructions are not present"
+      detail: "The Token Harness mcptoon agent instructions are not present"
     };
   }
   return {
     state: "verified",
     target,
-    detail: "Reviewed agent instructions are present and mcptoon exposes the reviewed passive CLI capabilities"
+    detail: `Agent instructions are present and mcptoon ${observation.version ?? ""} exposes the required passive CLI capabilities`
   };
 }
-var MCPTOON_REVIEWED_INSTALL_VERSION, MCPTOON_MARKER_BEGIN, MCPTOON_MARKER_END, MCPTOON_AGENT_INSTRUCTIONS, MCPTOON_CLAUDE_SKILL, DECODER2;
+var MCPTOON_REVIEWED_INSTALL_VERSION, MCPTOON_MANAGED_MINIMUM_VERSION, MCPTOON_MARKER_BEGIN, MCPTOON_MARKER_END, MCPTOON_AGENT_INSTRUCTIONS, MCPTOON_CLAUDE_SKILL, DECODER2;
 var init_mcptoon_managed = __esm({
   "packages/adapters/dist/src/providers/mcptoon-managed.js"() {
     "use strict";
     init_src();
     init_mcptoon_candidate();
     MCPTOON_REVIEWED_INSTALL_VERSION = "0.7.10";
+    MCPTOON_MANAGED_MINIMUM_VERSION = MCPTOON_REVIEWED_INSTALL_VERSION;
     MCPTOON_MARKER_BEGIN = "TOKEN-HARNESS:MCPTOON:BEGIN";
     MCPTOON_MARKER_END = "TOKEN-HARNESS:MCPTOON:END";
     MCPTOON_AGENT_INSTRUCTIONS = `Use mcptoon as the CLI gateway for MCP tools when a task needs one.
@@ -18961,7 +19155,7 @@ function warning(code, subject, message) {
     code,
     subject,
     message,
-    remediation: "Use the exact reviewed version before asking Token Harness to change this tool."
+    remediation: "Update the provider or restore the CLI capability this managed integration requires, then refresh Token Harness."
   });
 }
 function unavailableMetrics(provider) {
@@ -18976,53 +19170,49 @@ function unavailableMetrics(provider) {
   };
 }
 async function mcptoonDetection(context) {
-  const observation = await observeMcptoonCandidate(context);
+  const observation = await observeMcptoonManagedRuntime(context);
   const configuredHarnesses = [];
-  if (observation.version === MCPTOON_REVIEWED_BENCHMARK_VERSION) {
+  if (observation.ready) {
     for (const harness of [CLAUDE5, CODEX3]) {
       const verification = await verifyMcptoonManagedActivation(context, harness);
       if (verification.state === "verified")
         configuredHarnesses.push(harness);
     }
   }
-  const warnings = observation.state === "unsupported-version" ? [
-    warning("mcptoon-provider-version-unreviewed", "mcptoon", observation.reasons[0] ?? "The installed mcptoon version is outside the reviewed row.")
-  ] : [];
+  const warnings = !observation.absent && !observation.ready ? [warning("mcptoon-provider-capability-unavailable", "mcptoon", observation.detail)] : [];
   return {
     providerId: MCPTOON,
-    state: observation.state === "absent" ? "absent" : configuredHarnesses.length > 0 ? "configured" : "installed",
+    state: observation.absent ? "absent" : configuredHarnesses.length > 0 ? "configured" : "installed",
     version: observation.version,
     executable: observation.executable,
-    installationChannel: observation.state === "absent" ? "pipx" : null,
+    installationChannel: observation.absent ? "pipx" : null,
     versionVerdict: versionVerdict(observation.version, MCPTOON_REVIEWED_BENCHMARK_VERSION),
     configuredHarnesses,
     unmanagedHarnessesConfigured: [],
     supportsUnmanagedHarnesses: false,
     managedByTokenHarness: false,
-    assignableHarnesses: observation.version === MCPTOON_REVIEWED_BENCHMARK_VERSION ? [CLAUDE5, CODEX3] : [],
+    assignableHarnesses: observation.ready ? [CLAUDE5, CODEX3] : [],
     evidence: [],
     warnings
   };
 }
 async function gitnexusDetection(context) {
-  const observation = await observeGitNexusCandidate(context);
-  const verification = observation.version === GITNEXUS_REVIEWED_BENCHMARK_VERSION ? await verifyGitNexusManagedMcpActivation(context, CLAUDE5) : null;
+  const observation = await observeGitNexusManagedRuntime(context);
+  const verification = observation.ready ? await verifyGitNexusManagedMcpActivation(context, CLAUDE5) : null;
   const configuredHarnesses = verification?.state === "verified" ? [CLAUDE5] : [];
-  const warnings = observation.state === "unsupported-version" ? [
-    warning("gitnexus-provider-version-unreviewed", "gitnexus", observation.reasons[0] ?? "The installed GitNexus version is outside the reviewed row.")
-  ] : [];
+  const warnings = !observation.absent && !observation.ready ? [warning("gitnexus-provider-capability-unavailable", "gitnexus", observation.detail)] : [];
   return {
     providerId: GITNEXUS,
-    state: observation.state === "absent" ? "absent" : configuredHarnesses.length > 0 ? "configured" : "installed",
+    state: observation.absent ? "absent" : configuredHarnesses.length > 0 ? "configured" : "installed",
     version: observation.version,
     executable: observation.executable,
-    installationChannel: observation.state === "absent" ? "npm" : null,
+    installationChannel: observation.absent ? "npm" : null,
     versionVerdict: versionVerdict(observation.version, GITNEXUS_REVIEWED_BENCHMARK_VERSION),
     configuredHarnesses,
     unmanagedHarnessesConfigured: [],
     supportsUnmanagedHarnesses: false,
     managedByTokenHarness: false,
-    assignableHarnesses: observation.version === GITNEXUS_REVIEWED_BENCHMARK_VERSION && observation.supportsMcp ? [CLAUDE5] : [],
+    assignableHarnesses: observation.ready ? [CLAUDE5] : [],
     evidence: [],
     warnings
   };
@@ -19322,12 +19512,15 @@ function directoryAction2(harness, path) {
     path
   };
 }
-async function reviewedMcpCliAvailable(context) {
+async function headroomManagedMcpRuntime(context) {
   const observation = await observeHeadroomCandidate(context);
-  if (observation.version !== HEADROOM_REVIEWED_MCP_VERSION) {
+  const compatible = observation.version !== null && headroomVersionAtLeast(observation.version, HEADROOM_REVIEWED_MCP_VERSION);
+  if (!compatible) {
     return {
       ok: false,
-      detail: observation.version === null ? `Headroom ${HEADROOM_REVIEWED_MCP_VERSION} is not installed` : `Headroom ${observation.version} is installed; managed MCP activation is reviewed only for ${HEADROOM_REVIEWED_MCP_VERSION}`
+      version: observation.version,
+      executable: observation.executable,
+      detail: observation.version === null ? `Headroom ${HEADROOM_REVIEWED_MCP_VERSION} or newer is not installed` : `Headroom ${observation.version} predates the managed MCP floor ${HEADROOM_REVIEWED_MCP_VERSION}`
     };
   }
   const help = await context.runner.run({
@@ -19339,12 +19532,16 @@ async function reviewedMcpCliAvailable(context) {
   if (help.failure !== null || help.exitCode !== 0) {
     return {
       ok: false,
-      detail: `Headroom ${HEADROOM_REVIEWED_MCP_VERSION} is installed but its reviewed MCP server command is unavailable`
+      version: observation.version,
+      executable: observation.executable,
+      detail: `Headroom ${observation.version} is installed but its MCP server command is unavailable`
     };
   }
   return {
     ok: true,
-    detail: `Headroom ${HEADROOM_REVIEWED_MCP_VERSION} exposes the reviewed local MCP server`
+    version: observation.version,
+    executable: observation.executable,
+    detail: `Headroom ${observation.version} exposes the local MCP server required by the managed integration`
   };
 }
 function prerequisite(harness, detail2) {
@@ -19358,7 +19555,7 @@ function prerequisite(harness, detail2) {
         code: "headroom-managed-mcp-prerequisite",
         subject: harness,
         message: detail2,
-        remediation: `Install the exact reviewed Headroom ${HEADROOM_REVIEWED_MCP_VERSION} MCP package with your existing Python/uv tooling, then refresh Token Harness. Token Harness will not install Python, uv, or system prerequisites implicitly.`
+        remediation: `Install Headroom ${HEADROOM_REVIEWED_MCP_VERSION} or newer with its MCP extra using your existing Python/uv tooling, then refresh Token Harness. Token Harness will not install Python, uv, or system prerequisites implicitly.`
       })
     ]
   };
@@ -19612,9 +19809,9 @@ async function planCodex(context, harness) {
     affectedPaths: [target],
     affectedProcesses: [],
     preconditions: ["No Headroom MCP table or Token Harness Headroom marker block exists"],
-    postconditions: ["Codex config contains exactly one reviewed Headroom MCP server block"],
+    postconditions: ["Codex config contains exactly one Token Harness Headroom MCP server block"],
     rollbackData: "file-snapshot",
-    explanation: "Register the installed reviewed Headroom CLI as a Codex MCP server",
+    explanation: "Register the installed Headroom CLI as a Codex MCP server",
     path: target,
     markerBegin: HEADROOM_CODEX_MARKER_BEGIN,
     markerEnd: HEADROOM_CODEX_MARKER_END,
@@ -19643,7 +19840,7 @@ async function planHeadroomManagedMcpActivation(context, harness) {
       ]
     };
   }
-  const cli = await reviewedMcpCliAvailable(context);
+  const cli = await headroomManagedMcpRuntime(context);
   if (!cli.ok)
     return prerequisite(harness, cli.detail);
   return harness === "claude" ? planClaude(context, harness) : planCodex(context, harness);
@@ -19670,7 +19867,7 @@ function headroomOwnedArtifact(context, harness) {
   return null;
 }
 async function verifyHeadroomManagedMcpActivation(context, harness) {
-  const cli = await reviewedMcpCliAvailable(context);
+  const cli = await headroomManagedMcpRuntime(context);
   if (!cli.ok)
     return { state: "candidate-unavailable", target: null, detail: cli.detail };
   if (harness === "claude") {
@@ -19693,13 +19890,13 @@ async function verifyHeadroomManagedMcpActivation(context, harness) {
       return {
         state: "degraded",
         target,
-        detail: "Headroom MCP entry differs from the reviewed command"
+        detail: "Headroom MCP entry differs from the Token Harness managed command"
       };
     }
     return {
       state: "verified",
       target,
-      detail: `${cli.detail}; Claude registration matches the reviewed entry`
+      detail: `${cli.detail}; Claude registration matches the managed entry`
     };
   }
   if (harness === "codex") {
@@ -19719,12 +19916,12 @@ async function verifyHeadroomManagedMcpActivation(context, harness) {
       return {
         state: "not-configured",
         target,
-        detail: "Reviewed Headroom Codex MCP block is absent"
+        detail: "Token Harness Headroom Codex MCP block is absent"
       };
     return {
       state: "verified",
       target,
-      detail: `${cli.detail}; Codex registration matches the reviewed owned block`
+      detail: `${cli.detail}; Codex registration matches the managed owned block`
     };
   }
   return {
@@ -19760,14 +19957,15 @@ function manualInstallWarning() {
     severity: "warning",
     code: "headroom-uv-install-prerequisite",
     subject: "headroom",
-    message: `Headroom ${HEADROOM_REVIEWED_MCP_VERSION} is not installed. Token Harness can manage its MCP configuration after the reviewed CLI is present.`,
-    remediation: `With your existing uv and a compatible system Python >=3.10, run: uv tool install --no-managed-python --no-python-downloads "headroom-ai[mcp]==${HEADROOM_REVIEWED_MCP_VERSION}". Token Harness does not install uv, Python, or admin prerequisites.`
+    message: `Headroom ${HEADROOM_REVIEWED_MCP_VERSION} or newer is not installed. Token Harness can manage its MCP configuration after a compatible CLI is present.`,
+    remediation: `With your existing uv and a compatible system Python >=3.10, install headroom-ai[mcp] ${HEADROOM_REVIEWED_MCP_VERSION} or newer. Token Harness does not install uv, Python, or admin prerequisites.`
   });
 }
 async function detect8(context) {
   const observation = await observeHeadroomCandidate(context);
+  const runtime = await headroomManagedMcpRuntime(context);
   const configuredHarnesses = [];
-  if (observation.version === HEADROOM_REVIEWED_MCP_VERSION) {
+  if (runtime.ok) {
     for (const harness of [CLAUDE7, CODEX4]) {
       const verification = await verifyHeadroomManagedMcpActivation(context, harness);
       if (verification.state === "verified")
@@ -19777,13 +19975,13 @@ async function detect8(context) {
   const warnings = [];
   if (observation.state === "absent")
     warnings.push(manualInstallWarning());
-  if (observation.state === "unsupported-version") {
+  else if (!runtime.ok) {
     warnings.push(diagnostic({
       severity: "warning",
-      code: "headroom-provider-version-unreviewed",
+      code: "headroom-provider-capability-unavailable",
       subject: "headroom",
-      message: observation.reasons[0] ?? `The installed Headroom version is outside the reviewed ${HEADROOM_REVIEWED_MCP_VERSION} row.`,
-      remediation: `Keep that installation user-owned or use the exact reviewed ${HEADROOM_REVIEWED_MCP_VERSION} build.`
+      message: runtime.detail,
+      remediation: `Update Headroom to ${HEADROOM_REVIEWED_MCP_VERSION} or newer with the MCP extra, then refresh Token Harness.`
     }));
   }
   return {
@@ -19800,7 +19998,7 @@ async function detect8(context) {
     unmanagedHarnessesConfigured: [],
     supportsUnmanagedHarnesses: false,
     managedByTokenHarness: false,
-    assignableHarnesses: observation.version === HEADROOM_REVIEWED_MCP_VERSION ? [CLAUDE7, CODEX4] : [],
+    assignableHarnesses: runtime.ok ? [CLAUDE7, CODEX4] : [],
     evidence: [],
     warnings
   };
@@ -19873,7 +20071,7 @@ async function verify8(context) {
       summary: result6.detail,
       achievedTier: result6.state === "verified" ? "config-only" : result6.state === "candidate-unavailable" ? null : "presence",
       evidence: [],
-      remediation: result6.state === "candidate-unavailable" ? `Install reviewed Headroom ${HEADROOM_REVIEWED_MCP_VERSION} with its MCP extra first.` : null
+      remediation: result6.state === "candidate-unavailable" ? `Install Headroom ${HEADROOM_REVIEWED_MCP_VERSION} or newer with its MCP extra first.` : null
     });
   }
   return {
@@ -20046,26 +20244,25 @@ var init_mcptoon_provider = __esm({
 
 // packages/adapters/dist/src/providers/version-compatibility.js
 function reviewedProviderPackageMaximum(provider) {
-  return REVIEWED_PACKAGE_UPDATE_RANGES.get(provider)?.maximum ?? null;
+  return PACKAGE_UPDATE_BASELINES.get(provider)?.maximum ?? null;
 }
 function admitProviderPackageUpdate(provider, targetVersion) {
-  const range = REVIEWED_PACKAGE_UPDATE_RANGES.get(provider);
+  const range = PACKAGE_UPDATE_BASELINES.get(provider);
   if (range === void 0) {
     return { state: "blocked", reason: `no package-update policy exists for ${provider}` };
   }
   const target = parseSemanticVersion(targetVersion);
   const minimum = parseSemanticVersion(range.minimum);
-  const maximum = parseSemanticVersion(range.maximum);
-  if (target === null || minimum === null || maximum === null) {
+  if (target === null || minimum === null) {
     return {
       state: "blocked",
-      reason: `${targetVersion} is not a parseable reviewed provider release`
+      reason: `${targetVersion} is not a parseable provider release`
     };
   }
-  if (compareVersions(target, minimum) < 0 || compareVersions(target, maximum) > 0) {
+  if (compareVersions(target, minimum) < 0) {
     return {
       state: "blocked",
-      reason: `${targetVersion} is outside the reviewed package-update range ${range.minimum}..${range.maximum}`
+      reason: `${targetVersion} predates the supported provider update floor ${range.minimum}`
     };
   }
   return { state: "admitted" };
@@ -20078,10 +20275,15 @@ function harnessTrimContractMatchesInstalledVersion(detection) {
   const capabilityDrift = detection.warnings.some((warning2) => warning2.code === "provider-capabilities-drift");
   return declaredByInstalledBuild && !capabilityDrift;
 }
+function runtimeManagedSurfaceStillAvailable(detection) {
+  if (detection.state === "broken" || detection.assignableHarnesses.length === 0)
+    return false;
+  return !detection.warnings.some((warning2) => /capabilit/i.test(warning2.code) && /(unavailable|drift|mismatch|unsupported)/i.test(warning2.code));
+}
 function applyProviderVersionCompatibility(detection) {
   if (detection.versionVerdict !== "unknown-newer" || detection.version === null)
     return detection;
-  const compatible = detection.providerId === RTK3 && SOURCE_REVIEWED_RTK_RELEASES.has(detection.version) || detection.providerId === HARNESSTRIM3 && harnessTrimContractMatchesInstalledVersion(detection);
+  const compatible = detection.providerId === HARNESSTRIM3 ? harnessTrimContractMatchesInstalledVersion(detection) : [RTK3, MCPTOON2, GITNEXUS2, HEADROOM3].includes(detection.providerId) && runtimeManagedSurfaceStillAvailable(detection);
   if (!compatible)
     return detection;
   return {
@@ -20096,17 +20298,40 @@ function withProviderVersionCompatibility(adapter) {
     detect: async (context) => applyProviderVersionCompatibility(await adapter.detect(context))
   };
 }
-var RTK3, HARNESSTRIM3, SOURCE_REVIEWED_RTK_RELEASES, REVIEWED_PACKAGE_UPDATE_RANGES;
+var RTK3, HARNESSTRIM3, MCPTOON2, GITNEXUS2, HEADROOM3, PACKAGE_UPDATE_BASELINES;
 var init_version_compatibility = __esm({
   "packages/adapters/dist/src/providers/version-compatibility.js"() {
     "use strict";
     init_src();
+    init_gitnexus_candidate();
+    init_headroom_candidate();
+    init_mcptoon_candidate();
     RTK3 = providerId("rtk");
     HARNESSTRIM3 = providerId("harnesstrim");
-    SOURCE_REVIEWED_RTK_RELEASES = /* @__PURE__ */ new Set(["0.49.0"]);
-    REVIEWED_PACKAGE_UPDATE_RANGES = /* @__PURE__ */ new Map([
+    MCPTOON2 = providerId("mcptoon");
+    GITNEXUS2 = providerId("gitnexus");
+    HEADROOM3 = providerId("headroom");
+    PACKAGE_UPDATE_BASELINES = /* @__PURE__ */ new Map([
       [RTK3, { minimum: "0.44.0", maximum: "0.49.0" }],
-      [HARNESSTRIM3, { minimum: "0.0.5", maximum: "0.3.0" }]
+      [HARNESSTRIM3, { minimum: "0.0.5", maximum: "0.3.0" }],
+      [
+        MCPTOON2,
+        { minimum: MCPTOON_REVIEWED_BENCHMARK_VERSION, maximum: MCPTOON_REVIEWED_BENCHMARK_VERSION }
+      ],
+      [
+        GITNEXUS2,
+        {
+          minimum: GITNEXUS_REVIEWED_BENCHMARK_VERSION,
+          maximum: GITNEXUS_REVIEWED_BENCHMARK_VERSION
+        }
+      ],
+      [
+        HEADROOM3,
+        {
+          minimum: HEADROOM_REVIEWED_BENCHMARK_VERSION,
+          maximum: HEADROOM_REVIEWED_BENCHMARK_VERSION
+        }
+      ]
     ]);
   }
 });
@@ -20303,9 +20528,9 @@ var init_providers = __esm({
     PROVIDER_ADAPTERS = [
       rtkAdapter2,
       cliHarnessTrimAdapter,
-      mcptoonManagedProviderAdapter,
-      gitnexusManagedProviderAdapter,
-      headroomManagedProviderAdapter
+      withProviderVersionCompatibility(mcptoonManagedProviderAdapter),
+      withProviderVersionCompatibility(gitnexusManagedProviderAdapter),
+      withProviderVersionCompatibility(headroomManagedProviderAdapter)
     ];
   }
 });
@@ -24056,6 +24281,17 @@ async function computePlan(context) {
           wsl: context.platform.isWsl
         });
         if (admission.state !== "admitted") {
+          const dynamicallyAssignable = assignable.get(adapter.manifest.id)?.has(harness) === true;
+          if (dynamicallyAssignable) {
+            diagnostics.push(diagnostic({
+              severity: "info",
+              code: "managed-mutation-forward-compatible",
+              subject: adapter.manifest.id,
+              message: `${adapter.manifest.displayName} declares that it can configure ${harness} on the installed build. Token Harness will use the normal transactional apply path and verify the resulting state even though this exact version tuple is newer than the recorded compatibility evidence.`,
+              remediation: null
+            }));
+            continue;
+          }
           admitted = false;
           blocked.push({
             provider: adapter.manifest.id,
@@ -24224,7 +24460,7 @@ async function computePlan(context) {
       severity: refusalIsTheOutcome ? "error" : "warning",
       code: "managed-mutation-blocked",
       message: `plan refuses managed mutation of ${entry.harness} by ${entry.provider}${entry.providerVersion !== null ? ` at ${entry.providerVersion}` : ""}: ${entry.missing}`,
-      remediation: "Add a compatibility row whose fixture proves this combination, or configure this integration by hand"
+      remediation: "Restore the provider runtime capability required for this managed integration, or configure it by hand"
     }));
   }
   for (const conflict of conflicts) {
@@ -26864,7 +27100,7 @@ async function runDoctor(context) {
       ]
     };
   });
-  const problemCount = harnesses.filter(isBroken).length + providers.filter(isBroken).length + [...harnesses, ...providers].filter((detection) => detection.versionVerdict === "unknown-newer").length;
+  const problemCount = harnesses.filter(isBroken).length + providers.filter(isBroken).length;
   const rows = context.compatibilityRows ?? COMPATIBILITY_ROWS;
   const providersWithCoverage = providersWithPathDiagnostics.map((detection) => {
     if (detection.state !== "configured" || detection.configuredHarnesses.length === 0) {
@@ -26880,14 +27116,14 @@ async function runDoctor(context) {
         os: context.platform.os,
         wsl: context.platform.isWsl
       });
-      if (admission.state === "admitted")
+      if (admission.state === "admitted" || detection.assignableHarnesses.includes(harness))
         return [];
       return [
         diagnostic({
           severity: "warning",
-          code: "no-compatibility-row",
-          message: `no compatibility row covers ${detection.providerId} on ${harness}${detection.version !== null ? ` at ${detection.version}` : ""} \u2014 ${admission.missing}`,
-          remediation: "Add a compatibility row whose fixture proves this combination, or configure this integration by hand"
+          code: "provider-surface-not-assignable",
+          message: `${detection.providerId} is configured on ${harness}, but the currently installed provider build does not advertise that harness as an automatic setup target`,
+          remediation: "Run the provider verification checks; keep the existing configuration if it is healthy, or update the provider if its automatic setup contract has changed"
         })
       ];
     });
@@ -28104,6 +28340,7 @@ async function runPackageChannelUpdate(context, options = {}) {
     projectIdFor: adapters.projectIdFor
   };
   const actions = [];
+  const updateTargets = /* @__PURE__ */ new Map();
   const blockedUpdates = [];
   const destinations = /* @__PURE__ */ new Set();
   for (const adapter of providerAdapters) {
@@ -28180,7 +28417,7 @@ async function runPackageChannelUpdate(context, options = {}) {
     }
     row2.verdict = "upgradable";
     report.providers.push(row2);
-    actions.push(upgradeAction({
+    const action = upgradeAction({
       providerId: adapter.manifest.id,
       channel: channel.id,
       packageName,
@@ -28188,15 +28425,21 @@ async function runPackageChannelUpdate(context, options = {}) {
       requiresNetwork: channel.requiresNetwork,
       requiresElevation: channel.requiresElevation,
       installed: detection.version ?? "an unknown version"
-    }));
+    });
+    actions.push(action);
+    updateTargets.set(action.id, {
+      providerId: adapter.manifest.id,
+      target: query.version,
+      adapter
+    });
   }
   report.network = [...destinations].sort();
   for (const blocked of blockedUpdates) {
     diagnostics.push(diagnostic({
       severity: "info",
       code: "provider-update-target-unreviewed",
-      message: `${blocked.providerId} ${blocked.target} is available but is outside the reviewed provider package-update policy; keeping ${blocked.installed ?? "the installed version"}`,
-      remediation: "Review the provider package contract before enabling unattended update to this release"
+      message: `${blocked.providerId} ${blocked.target} is available but does not meet the provider update prerequisites; keeping ${blocked.installed ?? "the installed version"}`,
+      remediation: "Check the provider update floor or version format, then retry the update"
     }));
     diagnostics.push(diagnostic({
       severity: "info",
@@ -28269,7 +28512,64 @@ async function runPackageChannelUpdate(context, options = {}) {
       backupRoot: fs.join(context.stateRoot, "backups")
     }),
     runner: adapters.runner,
-    now: context.now
+    now: context.now,
+    verifyPostconditions: async (applied) => {
+      const postconditions = [];
+      for (const outcome2 of applied) {
+        if (outcome2.status !== "applied" && outcome2.status !== "already-satisfied")
+          continue;
+        const target = updateTargets.get(outcome2.actionId);
+        if (target === void 0)
+          continue;
+        const detection = await target.adapter.detect(providerContext4);
+        const observed = detection.version === null ? null : parseSemanticVersion(detection.version);
+        const expected = parseSemanticVersion(target.target);
+        const exactTarget = observed !== null && expected !== null && compareVersions(observed, expected) === 0;
+        if (!exactTarget) {
+          postconditions.push(diagnostic({
+            severity: "error",
+            code: "provider-update-version-not-observed",
+            subject: target.adapter.manifest.id,
+            message: `${target.providerId} update did not become active: requested ${target.target}, but the executable currently resolved on PATH reports ${detection.version ?? "no readable version"}`,
+            path: detection.executable,
+            remediation: "Review duplicate PATH installations. Token Harness will not report this update as successful while the old executable is still the one being resolved."
+          }));
+          continue;
+        }
+        const capabilityProblem = detection.warnings.find((warning2) => /capabilit/i.test(warning2.code) && /(unavailable|drift|mismatch|unsupported)/i.test(warning2.code));
+        if (target.adapter.manifest.id === "harnesstrim" && (detection.versionVerdict !== "in-range" || capabilityProblem !== void 0)) {
+          postconditions.push(diagnostic({
+            severity: "error",
+            code: "harnesstrim-update-contract-mismatch",
+            subject: target.adapter.manifest.id,
+            message: `HarnessTrim ${target.target} was installed, but its machine-readable capability/artifact contract did not pass Token Harness validation` + (capabilityProblem === void 0 ? "" : `: ${capabilityProblem.message}`),
+            path: detection.executable,
+            remediation: "Keep the previous working HarnessTrim release until the changed contract is understood."
+          }));
+          continue;
+        }
+        if (["mcptoon", "gitnexus", "headroom"].includes(target.adapter.manifest.id) && (detection.assignableHarnesses.length === 0 || capabilityProblem !== void 0)) {
+          postconditions.push(diagnostic({
+            severity: "error",
+            code: "provider-update-capability-unavailable",
+            subject: target.adapter.manifest.id,
+            message: `${target.providerId} ${target.target} became active on PATH, but the installed build no longer exposes the runtime capability surface required by Token Harness` + (capabilityProblem === void 0 ? "" : `: ${capabilityProblem.message}`),
+            path: detection.executable,
+            remediation: "Keep the previous working provider release until the changed CLI capability surface is understood."
+          }));
+          continue;
+        }
+        postconditions.push(diagnostic({
+          severity: "info",
+          code: "provider-update-version-verified",
+          subject: target.adapter.manifest.id,
+          message: `${target.providerId} ${target.target} is now the executable resolved on PATH and passed post-update detection`,
+          path: detection.executable,
+          remediation: null
+        }));
+      }
+      return postconditions;
+    }
   });
   diagnostics.push(...transaction.diagnostics);
   report.execution = {
@@ -31970,13 +32270,75 @@ var init_stack_combination_reviews = __esm({
 });
 
 // apps/cli/dist/src/guided.js
+function guideSetupTarget(report, harness, provider) {
+  const harnessDetection = report.harnesses.find((item) => item.harnessId === harness);
+  const detection = report.providers.find((item) => item.providerId === provider);
+  const label = name(provider);
+  if (harnessDetection === void 0 || harnessDetection.state === "absent") {
+    return {
+      providerId: provider,
+      provider: label,
+      state: "not-applicable",
+      reason: `${name(harness)} is not currently detected.`
+    };
+  }
+  if (detection === void 0) {
+    return {
+      providerId: provider,
+      provider: label,
+      state: "not-applicable",
+      reason: `${label} is not a managed provider in this build.`
+    };
+  }
+  if (detection.configuredHarnesses.includes(harnessDetection.harnessId)) {
+    return {
+      providerId: provider,
+      provider: label,
+      state: "connected",
+      reason: `${label} is configured for ${name(harness)}.`
+    };
+  }
+  if (detection.state === "absent" || detection.state === "available") {
+    return {
+      providerId: provider,
+      provider: label,
+      state: "unavailable",
+      reason: `${label} is not installed in a state Token Harness can configure automatically.`
+    };
+  }
+  if (detection.state === "broken") {
+    return {
+      providerId: provider,
+      provider: label,
+      state: "unavailable",
+      reason: `${label} is detected but its current integration needs attention before setup can continue.`
+    };
+  }
+  if (!detection.assignableHarnesses.includes(harnessDetection.harnessId)) {
+    return {
+      providerId: provider,
+      provider: label,
+      state: "not-applicable",
+      reason: `The installed ${label} build does not expose an automatic ${name(harness)} setup surface.`
+    };
+  }
+  return {
+    providerId: provider,
+    provider: label,
+    state: "actionable",
+    reason: `${label} can be configured automatically for ${name(harness)}. Token Harness will apply it transactionally and re-check the resulting state.`
+  };
+}
+function guideSetupTargets(report, harness) {
+  return GUIDE_MANAGED_PROVIDERS.map((provider) => guideSetupTarget(report, harness, provider));
+}
 function explainGuideIssue(diagnostics, fallback) {
   const known = diagnostics.find((entry) => ISSUE_COPY[entry.code] !== void 0);
   if (known !== void 0)
     return ISSUE_COPY[known.code];
   const blocked = diagnostics.find((entry) => /compatibility|unsupported|unreviewed|no-row/.test(entry.code));
   if (blocked !== void 0)
-    return "Automatic changes are not verified for this version combination. Your current settings are preserved.";
+    return "The required automatic capability or safety precondition is not available in the current runtime. Your current settings are preserved.";
   if (diagnostics.some((entry) => /drift|mismatch|precondition|conflict/.test(entry.code)))
     return "Something changed since the preview. No unsafe change was made. Review the current setup again.";
   return fallback;
@@ -31994,7 +32356,8 @@ function stackFingerprint(report) {
     version: item.version,
     versionVerdict: item.versionVerdict,
     managedByTokenHarness: item.managedByTokenHarness,
-    configuredHarnesses: [...item.configuredHarnesses].sort()
+    configuredHarnesses: [...item.configuredHarnesses].sort(),
+    assignableHarnesses: [...item.assignableHarnesses].sort()
   })).sort((left, right) => left.id.localeCompare(right.id));
   return JSON.stringify({ harnesses, providers });
 }
@@ -32212,7 +32575,7 @@ function describeChange(action, harness) {
     files: action.affectedPaths.length
   };
 }
-var GuideError, NAMES, name, TASKS, PERIODS, STACK_COMPONENTS, ISSUE_COPY, EFFORT_LABELS, SAFETY_RULES, TASK_RULES, READ_STAGES, GuideService;
+var GuideError, NAMES, name, GUIDE_MANAGED_PROVIDERS, RECOMMENDED_SETUP_PROVIDERS, TASKS, PERIODS, STACK_COMPONENTS, ISSUE_COPY, EFFORT_LABELS, SAFETY_RULES, TASK_RULES, READ_STAGES, GuideService;
 var init_guided = __esm({
   "apps/cli/dist/src/guided.js"() {
     "use strict";
@@ -32240,6 +32603,14 @@ var init_guided = __esm({
       headroom: "Headroom"
     };
     name = (id) => NAMES[id] ?? id;
+    GUIDE_MANAGED_PROVIDERS = [
+      "rtk",
+      "harnesstrim",
+      "mcptoon",
+      "gitnexus",
+      "headroom"
+    ];
+    RECOMMENDED_SETUP_PROVIDERS = ["rtk", "harnesstrim"];
     TASKS = /* @__PURE__ */ new Set(["mechanical", "standard", "hard", "critical"]);
     PERIODS = /* @__PURE__ */ new Set(["all", "7d", "30d"]);
     STACK_COMPONENTS = [
@@ -32277,13 +32648,13 @@ var init_guided = __esm({
       "cclimits-claude-token-expired": "The Claude login has expired. Sign in again in Claude, then refresh.",
       "cclimits-claude-cache-stale": "Only old Claude allowance data was found. It is not presented as current allowance.",
       "cclimits-claude-source-unsupported": "This cclimits response lacks supported Claude discovery information. Check its installed version.",
-      "claude-native-policy-blocked": "Claude settings could not be changed safely. A project override, environment setting or unreviewed version may be in effect. Your settings were kept.",
-      "native-policy-harness-unsupported": "This agent does not expose a reviewed setting for this action.",
+      "claude-native-policy-blocked": "Claude settings could not be changed safely. A project override, environment setting or changed writable surface may be in effect. Your settings were kept.",
+      "native-policy-harness-unsupported": "This agent does not expose a writable setting surface for this action.",
       "codex-native-policy-unavailable": "Codex did not expose a writable, versioned user setting. No change is proposed.",
       "codex-native-policy-shadowed": "A project or profile overrides this Codex setting. That setting belongs to you and will not be replaced.",
       "no-providers-registered": "No optimization provider was selected for this operation.",
       "already-in-desired-state": "The supported integration is already configured. Nothing needs to be changed.",
-      "managed-mutation-unsupported": "Automatic setup is not yet verified for this installed version combination. Existing integrations are left untouched.",
+      "managed-mutation-unsupported": "Automatic setup is unavailable because the installed provider does not expose the required managed surface. Existing integrations are left untouched.",
       "plan-ownership-drift": "The integration changed after the preview. Review a fresh plan; nothing was forced.",
       "plan-version-drift": "An installed version changed after the preview. Review a fresh plan.",
       "plan-project-mismatch": "This preview belongs to a different project. Open a new preview here.",
@@ -32419,7 +32790,7 @@ var init_guided = __esm({
         if (this.busy && this.cached !== null)
           return this.cached.value;
         if (this.busy)
-          throw new GuideError(409, "A reviewed change is in progress.");
+          throw new GuideError(409, "Another managed change is in progress.");
         if (this.cached?.period === period && this.now() - this.cached.at < 15e3)
           return this.cached.value;
         if (this.reading !== null) {
@@ -32542,6 +32913,8 @@ var init_guided = __esm({
           const providers = (doctor.data?.providers ?? []).filter((provider) => provider.state === "configured" && provider.configuredHarnesses.includes(agent.harnessId)).map((p) => p.providerId);
           const usage = budget.data?.harnesses.find((item) => item.harnessId === agent.harnessId);
           const observed = context.data?.harnesses.find((item) => item.harnessId === agent.harnessId);
+          const setup = doctor.data === null ? [] : guideSetupTargets(doctor.data, agent.harnessId);
+          const hasActionableSetup = setup.some((target) => target.state === "actionable");
           return {
             pending: [
               ...!complete2.rules ? ["reasoning"] : [],
@@ -32551,8 +32924,9 @@ var init_guided = __esm({
             name: name(agent.harnessId),
             version: agent.version,
             configured: providers.length > 0,
-            state: agent.state === "broken" ? "Needs attention" : providers.length > 0 ? "Integration configured" : "Ready to set up",
+            state: agent.state === "broken" ? "Needs attention" : providers.length > 0 ? "Integration configured" : hasActionableSetup ? "Ready to set up" : "No automatic setup surface available",
             providers: providers.map(name),
+            setup,
             effort: observed?.nativeEffort?.current ?? observed?.reasoningEffort ?? null,
             reasoning: reasoningView(agent.harnessId, observed),
             ...guidance?.[agent.harnessId] ? { guidance: guidance[agent.harnessId] } : {},
@@ -32754,11 +33128,17 @@ var init_guided = __esm({
           for (const agent of selected) {
             this.record(`Preparing supported changes for ${name(agent.harnessId)}. No settings changed.`, "working");
             const setupProviders = [];
-            if (data["action"] === "setup" && data["harness"] !== void 0) {
-              if (data["provider"] === void 0) {
-                setupProviders.push("rtk", "harnesstrim");
-              } else {
-                setupProviders.push(String(data["provider"]));
+            if (data["action"] === "setup") {
+              const requested = data["provider"] === void 0 ? RECOMMENDED_SETUP_PROVIDERS : [String(data["provider"])];
+              for (const setupProvider of requested) {
+                const target = inventory.data === null ? null : guideSetupTarget(inventory.data, agent.harnessId, setupProvider);
+                if (target?.state === "actionable") {
+                  setupProviders.push(setupProvider);
+                } else if (target?.state === "connected") {
+                  notices.push(`${name(agent.harnessId)} \xB7 ${name(setupProvider)}: already connected. No setup change is needed.`);
+                } else if (target !== null) {
+                  notices.push(`${name(agent.harnessId)} \xB7 ${name(setupProvider)}: ${target.reason}`);
+                }
               }
             } else {
               setupProviders.push(null);
@@ -32775,7 +33155,7 @@ var init_guided = __esm({
               const report = result6.data;
               if (report === null || result6.exitCode !== 0 || report.conflicts.length > 0 || report.actions.length === 0 || !report.persisted || report.planId === null) {
                 const subject = setupProvider !== null ? `${name(agent.harnessId)} \xB7 ${name(setupProvider)}` : name(agent.harnessId);
-                notices.push(`${subject}: ${explainGuideIssue(result6.diagnostics, data["action"] === "effort" ? "No supported preference change is needed or available. Your current preference is kept." : data["action"] === "skill" ? "In-session guidance is already present, or an existing user-owned skill location was left untouched." : "No safe setup change is available. The integration may already be configured, or a required provider is not installed.")}`);
+                notices.push(`${subject}: ${explainGuideIssue(result6.diagnostics, data["action"] === "effort" ? "No supported preference change is needed or available. Your current preference is kept." : data["action"] === "skill" ? "In-session guidance is already present, or an existing user-owned skill location was left untouched." : "No safe setup change is available for the current provider, agent version and platform.")}`);
                 continue;
               }
               plans.push(report.planId);
@@ -32820,17 +33200,17 @@ var init_guided = __esm({
       }
       async apply(input) {
         if (input === null || typeof input !== "object" || Array.isArray(input))
-          throw new GuideError(400, "A reviewed preview is required.");
+          throw new GuideError(400, "A current preview is required.");
         const data = input;
         if (Object.keys(data).length !== 1 || typeof data["ticket"] !== "string")
-          throw new GuideError(400, "A reviewed preview is required.");
+          throw new GuideError(400, "A current preview is required.");
         return this.exclusive(async () => {
           const approval = this.approval;
           if (approval === null || approval.id !== data["ticket"] || this.now() >= approval.expires)
             throw new GuideError(409, "This preview expired or was already used. Review a fresh preview.");
           this.approval = null;
           if (approval.operation === "update") {
-            this.record("Installing only the reviewed provider updates you approved.", "working");
+            this.record("Installing only the provider updates you approved.", "working");
             let result6;
             try {
               result6 = await this.call(["update", "--yes"]);
@@ -32846,7 +33226,7 @@ var init_guided = __esm({
               };
             }
             if (result6.exitCode !== 0 || result6.data === null) {
-              const message = explainGuideIssue(result6.diagnostics, "The reviewed optimizer update was not applied. The installed version, update channel or compatibility evidence changed after the preview, so nothing was forced.");
+              const message = explainGuideIssue(result6.diagnostics, "The optimizer update was not applied. The installed version, update channel or runtime capability state changed after the preview, so nothing was forced.");
               this.invalidateObservedState();
               this.record(message, "attention");
               return {
@@ -32860,14 +33240,14 @@ var init_guided = __esm({
             this.lastApplied = null;
             this.invalidateObservedState();
             const messages2 = applied.length > 0 ? [
-              "The reviewed optimizer update completed successfully.",
+              "The optimizer update completed successfully and the active runtime was verified.",
               "Token Harness re-ran the update transaction safety checks before changing software.",
               "Choose Refresh to read the installed versions again. Reopen a coding agent if the updated optimizer requires it."
             ] : [
               "No optimizer needed an update by the time the approved action ran.",
               "Nothing was forced. Choose Refresh to read the current versions."
             ];
-            this.record(applied.length > 0 ? "Reviewed optimizer update installed." : "Optimizer update no longer needed.", "success");
+            this.record(applied.length > 0 ? "Optimizer update installed and verified." : "Optimizer update no longer needed.", "success");
             return {
               ok: true,
               title: applied.length > 0 ? "Optimizer updated" : "Already up to date",
@@ -32973,7 +33353,7 @@ var init_guided = __esm({
             this.record(`${name(provider)} managed integration removed.`, "success");
             return { ok: true, title: "Integration removed", messages: messages2, appliedPlans: 1 };
           }
-          this.record(approval.operation === "rollback" ? "Restoring the reviewed configuration backup." : "Backing up and applying exactly the changes you approved.", "working");
+          this.record(approval.operation === "rollback" ? "Restoring the approved configuration backup." : "Backing up and applying exactly the changes you approved.", "working");
           const messages = [];
           let appliedPlans = 0;
           const steps = approval.operation === "rollback" && approval.transactionId !== null ? [
@@ -33017,7 +33397,7 @@ var init_guided = __esm({
             this.lastApplied = approval.operation === "rollback" ? null : step.plan === null ? null : { kind: "plan", plan: step.plan, network: approval.network };
           }
           this.invalidateObservedState();
-          messages.push(approval.operation === "rollback" ? "The reviewed backup was restored. Reopen the affected coding agent." : "The approved configuration was saved and checked. Reopen the affected coding agent to load it.");
+          messages.push(approval.operation === "rollback" ? "The approved backup was restored. Reopen the affected coding agent." : "The approved configuration was saved and checked. Reopen the affected coding agent to load it.");
           messages.push("Keep using the agent normally. The dashboard reads available measurements automatically; it does not need to stay open for the configured integration to operate.");
           this.record(`${approval.description} applied and verified against its configuration checks.`, "success");
           return {
@@ -33074,13 +33454,13 @@ var init_guided = __esm({
           const blocked = updateResult.data.providers.filter((row2) => row2.verdict === "blocked-unreviewed");
           const messages = [];
           if (available.length > 0) {
-            messages.push(...available.map((row2) => `${name(row2.providerId)}: ${row2.installed ?? "installed version"} \u2192 ${row2.available ?? "new version"} is reviewed and ready to install.`));
+            messages.push(...available.map((row2) => `${name(row2.providerId)}: ${row2.installed ?? "installed version"} \u2192 ${row2.available ?? "new version"} is available and ready to install; Token Harness will verify the active runtime after installation.`));
           }
           if (blocked.length > 0) {
-            messages.push(...blocked.map((row2) => `${name(row2.providerId)}: ${row2.available ?? "a newer version"} exists, but Token Harness is keeping ${row2.installed ?? "the installed version"} because that newer combination is not reviewed yet.`));
+            messages.push(...blocked.map((row2) => `${name(row2.providerId)}: ${row2.available ?? "a newer version"} exists, but Token Harness is keeping ${row2.installed ?? "the installed version"} because the target does not meet the provider update prerequisites.`));
           }
           if (available.length === 0 && blocked.length === 0)
-            messages.push("Your managed optimizers are up to date on their reviewed channels.");
+            messages.push("Your managed optimizers are up to date on their configured channels.");
           let ticket = null;
           if (available.length > 0) {
             ticket = this.random();
@@ -33102,7 +33482,7 @@ var init_guided = __esm({
           const stack = this.stackSnapshot();
           if (this.cached !== null)
             this.cached.value = { ...this.cached.value, stack };
-          this.record(available.length > 0 ? "Reviewed optimizer update available. Waiting for your approval." : "Provider update check completed. No reviewed update is pending.", "success");
+          this.record(available.length > 0 ? "Optimizer update available. Waiting for your approval." : "Provider update check completed. No update is pending.", "success");
           return {
             ok: true,
             title: available.length > 0 ? "Updates available" : "Optimizers up to date",
@@ -34874,7 +35254,7 @@ var init_guided_capabilities_client = __esm({
     const activeRun = runId;
     working = true;
     $('modal-actions').replaceChildren(closeButton('Applying…', true));
-    $('modal-content').append(progress('Applying the reviewed change', 'Only the approved transaction is being applied. Keep this window open until it finishes.'));
+    $('modal-content').append(progress('Applying the approved change', 'Only the approved transaction is being applied. Keep this window open until it finishes.'));
     try {
       const result = await request('/api/apply', { ticket });
       if (activeRun !== runId) return;
@@ -34972,7 +35352,7 @@ var init_guided_capabilities_client = __esm({
       return preview(
         { action: 'skill', harness: action.harness },
         'Review in-session guidance for ' + (action.harness === 'claude' ? 'Claude Code' : 'Codex'),
-        'Enable reviewed guidance',
+        'Enable managed guidance',
         'Guidance enabled',
       );
     if (action.kind === 'refresh') return $('refresh')?.click();
@@ -35061,7 +35441,7 @@ var init_guided_capabilities_client = __esm({
         actionButton('Review removal', () => preview(
           { action: 'remove', provider: component.providerId },
           'Review removal for ' + name,
-          'Remove reviewed integration',
+          'Remove managed integration',
           'Integration removed',
         ), 'secondary'),
       );
@@ -35162,24 +35542,24 @@ var init_guided_product_client = __esm({
     },
     harnesstrim: {
       name: 'HarnessTrim',
-      role: 'Adds reviewed instructions that help coding agents keep tool output and context lean.',
+      role: 'Adds version-aware instructions that help coding agents keep tool output and context lean.',
       managed: true,
     },
     mcptoon: {
       name: 'mcptoon',
-      role: 'Provides the reviewed compact MCP discovery integration on exact admitted versions.',
+      role: 'Provides compact MCP discovery integration and verifies the resulting setup.',
       managed: true,
       optional: true,
     },
     gitnexus: {
       name: 'GitNexus',
-      role: 'Registers an already-installed reviewed GitNexus CLI as a narrow Claude MCP integration.',
+      role: 'Registers an already-installed GitNexus CLI as a narrow Claude MCP integration and verifies the result.',
       managed: true,
       optional: true,
     },
     headroom: {
       name: 'Headroom',
-      role: 'Provides local MCP compression and retrieval through the reviewed Headroom server.',
+      role: 'Provides local MCP compression and retrieval through the installed Headroom server.',
       managed: true,
       optional: true,
     },
@@ -35237,7 +35617,7 @@ var init_guided_product_client = __esm({
       element.disabled = value;
     });
     $('live-status').textContent = value
-      ? (applying ? 'Applying only the reviewed change…' : 'Reading current state…')
+      ? (applying ? 'Applying only the approved change…' : 'Reading current state…')
       : 'Nothing changes without your approval';
   }
 
@@ -35358,22 +35738,61 @@ var init_guided_product_client = __esm({
     return (current?.stack?.components || []).filter(component => component.configured);
   }
 
-  function componentConfiguredFor(id, agentId) {
-    const component = managedComponent(id);
-    return Boolean(component?.configuredHarnesses?.includes(agentId));
+  function setupTarget(agentId, providerId) {
+    const agent = activeAgents().find(item => item.id === agentId);
+    return agent?.setup?.find(item => item.providerId === providerId) || null;
   }
 
-  function baselineReadyFor(agentId) {
-    return componentConfiguredFor('rtk', agentId) && componentConfiguredFor('harnesstrim', agentId);
+  function baselineStatusFor(agentId) {
+    const targets = ['rtk', 'harnesstrim']
+      .map(providerId => setupTarget(agentId, providerId))
+      .filter(Boolean);
+    const actionable = targets.filter(target => target.state === 'actionable');
+    const unavailable = targets.filter(target => target.state === 'unavailable');
+    const connected = targets.filter(target => target.state === 'connected');
+    if (actionable.length)
+      return {
+        state: 'incomplete',
+        label: 'Setup incomplete',
+        cls: 'warn',
+        actionable,
+        unavailable,
+        connected,
+      };
+    if (unavailable.length && connected.length === 0)
+      return {
+        state: 'unavailable',
+        label: 'No automatic setup',
+        cls: '',
+        actionable,
+        unavailable,
+        connected,
+      };
+    if (unavailable.length)
+      return {
+        state: 'limited',
+        label: 'Setup complete',
+        cls: 'good',
+        actionable,
+        unavailable,
+        connected,
+      };
+    return {
+      state: 'ready',
+      label: 'Ready',
+      cls: 'good',
+      actionable,
+      unavailable,
+      connected,
+    };
   }
 
   function baselineIncompleteAgents() {
-    return activeAgents().filter(agent => !baselineReadyFor(agent.id));
+    return activeAgents().filter(agent => baselineStatusFor(agent.id).state === 'incomplete');
   }
 
-  function providerSupportsAgent(providerId, agentId) {
-    if (providerId === 'gitnexus') return agentId === 'claude';
-    return agentId === 'claude' || agentId === 'codex';
+  function baselineUnavailableAgents() {
+    return activeAgents().filter(agent => baselineStatusFor(agent.id).state === 'unavailable');
   }
 
   function candidateObservation(id) {
@@ -35445,7 +35864,7 @@ var init_guided_product_client = __esm({
         label: 'Needs attention',
         cls: 'warn',
         title: 'One configured optimizer needs attention',
-        detail: 'Use Re-check health below to see whether the configured integration still matches its reviewed state.',
+        detail: 'Use Re-check health below to see whether the configured integration still matches the provider and agent state currently installed.',
         action: 'verify',
       };
     if (incomplete.length)
@@ -35454,10 +35873,19 @@ var init_guided_product_client = __esm({
         cls: 'warn',
         title: incomplete.length === 1
           ? 'Finish setup for ' + incomplete[0].name
-          : 'Finish the recommended setup for your coding agents',
-        detail: 'The recommended baseline is RTK + HarnessTrim. Finish setup on each incomplete coding-agent card below; you will see the exact safe plan before anything changes.',
+          : 'Finish the available recommended setup for your coding agents',
+        detail: 'Every Finish setup action below has a concrete change available from the installed provider. Newer version combinations are attempted transactionally and checked again after apply.',
         action: 'configure',
       };
+    const unavailable = baselineUnavailableAgents();
+    if (unavailable.length)
+      return {
+        label: 'No automatic setup',
+        cls: '',
+        title: 'No automatic setup surface is currently exposed',
+        detail: 'The installed provider does not currently expose the setup surface Token Harness needs. This is a capability limitation, not a missing review row.',
+        action: 'none',
+      };
     if (!(current?.savings?.rows || []).length)
       return {
         label: 'Ready',
@@ -35511,7 +35939,7 @@ var init_guided_product_client = __esm({
     );
   }
 
-  function componentState(component) {
+  function componentState(id, component) {
     if (!component || component.detectedState === 'absent') return { label: 'Not installed', cls: '' };
     if (component.health === 'attention') return { label: 'Needs attention', cls: 'warn' };
     if (component.configured)
@@ -35519,14 +35947,19 @@ var init_guided_product_client = __esm({
         label: component.verification === 'verified' ? 'Connected · verified' : 'Connected',
         cls: 'good',
       };
-    if (component.installed) return { label: 'Installed · not connected', cls: '' };
+    const targets = activeAgents().map(agent => setupTarget(agent.id, id)).filter(Boolean);
+    if (component.installed && targets.some(target => target.state === 'actionable'))
+      return { label: 'Installed · setup available', cls: 'warn' };
+    if (component.installed && targets.some(target => target.state === 'unavailable'))
+      return { label: 'Installed · no automatic setup', cls: '' };
+    if (component.installed) return { label: 'Installed', cls: '' };
     return { label: 'Not installed', cls: '' };
   }
 
   function renderManagedTool(id) {
     const info = TOOL_INFO[id];
     const component = managedComponent(id);
-    const state = componentState(component);
+    const state = componentState(id, component);
     const card = node('article', undefined, 'tool-card');
     const head = node('div', undefined, 'tool-head');
     const title = node('div');
@@ -35539,9 +35972,20 @@ var init_guided_product_client = __esm({
 
     const facts = node('div', undefined, 'tool-facts');
     if (component?.version) facts.append(node('span', 'Installed version'), node('strong', 'v' + component.version));
+    const providerTargets = activeAgents()
+      .map(agent => ({ agent, target: setupTarget(agent.id, id) }))
+      .filter(item => item.target);
+    const actionableFor = providerTargets
+      .filter(item => item.target.state === 'actionable')
+      .map(item => item.agent.name);
+    const unavailableFor = providerTargets.filter(item => item.target.state === 'unavailable');
     const configuredFor = component?.configuredHarnesses?.length
       ? component.configuredHarnesses.map(agentName).join(', ')
-      : 'Not connected to a coding agent';
+      : actionableFor.length
+        ? 'Setup available for ' + actionableFor.join(', ')
+        : unavailableFor.length
+          ? 'No compatible automatic setup surface detected'
+          : 'Not applicable to the detected coding agents';
     facts.append(node('span', 'Connection'), node('strong', configuredFor));
     if (component?.update === 'available')
       facts.append(
@@ -35549,9 +35993,22 @@ var init_guided_product_client = __esm({
         node('strong', 'v' + (component.updateAvailableVersion || 'new version') + ' available'),
       );
     else if (component?.update === 'blocked')
-      facts.append(node('span', 'Update'), node('strong', 'Newer version not reviewed yet'));
+      facts.append(node('span', 'Update'), node('strong', 'Newer package requires a provider-specific update path'));
     card.append(facts);
 
+    if (
+      component?.installed &&
+      !(component?.configuredHarnesses?.length) &&
+      actionableFor.length === 0 &&
+      unavailableFor.length > 0
+    )
+      card.append(
+        messageBox(
+          'Why there is no Connect button',
+          unavailableFor[0].target.reason,
+        ),
+      );
+
     if (component?.warnings?.length) {
       const attention = component.health === 'attention';
       const prerequisite = !component.installed && component.nextAction?.kind === 'install-configure';
@@ -35567,25 +36024,15 @@ var init_guided_product_client = __esm({
 
     const actions = node('div', undefined, 'inline-actions');
     for (const agent of activeAgents()) {
-      if (!providerSupportsAgent(id, agent.id)) continue;
-      if (component?.configuredHarnesses?.includes(agent.id)) continue;
-      if (info.optional) {
-        actions.append(
-          actionButton(
-            'Set up for ' + agent.name,
-            () => reviewSetup(agent.id, id),
-            'secondary',
-          ),
-        );
-      } else {
-        actions.append(
-          actionButton(
-            component?.installed ? 'Connect to ' + agent.name : 'Set up for ' + agent.name,
-            () => reviewSetup(agent.id, id),
-            'secondary',
-          ),
-        );
-      }
+      const target = setupTarget(agent.id, id);
+      if (target?.state !== 'actionable') continue;
+      actions.append(
+        actionButton(
+          component?.installed ? 'Connect to ' + agent.name : 'Set up for ' + agent.name,
+          () => reviewSetup(agent.id, id),
+          'secondary',
+        ),
+      );
     }
     if (component?.update === 'available')
       actions.append(actionButton('Install update', () => readOnlyOperation('updates'), 'secondary'));
@@ -35612,7 +36059,7 @@ var init_guided_product_client = __esm({
       return;
     }
     for (const agent of activeAgents()) {
-      const ready = baselineReadyFor(agent.id);
+      const baseline = baselineStatusFor(agent.id);
       const card = node('article', undefined, 'tool-card compact');
       const head = node('div', undefined, 'tool-head');
       const title = node('div');
@@ -35620,16 +36067,18 @@ var init_guided_product_client = __esm({
         node('h3', agent.name),
         node('span', agent.version ? 'v' + agent.version : 'Version unavailable', 'caption'),
       );
-      head.append(title, pill(ready ? 'Ready' : 'Setup incomplete', ready ? 'good' : 'warn'));
-      card.append(
-        head,
-        node(
-          'p',
-          ready
-            ? 'RTK + HarnessTrim are configured for this coding agent.'
-            : 'The agent is detected. Finish the recommended RTK + HarnessTrim setup to complete onboarding.',
-        ),
-      );
+      head.append(title, pill(baseline.label, baseline.cls));
+      const detail =
+        baseline.state === 'incomplete'
+          ? 'An automatic setup is available for ' +
+            baseline.actionable.map(target => target.provider).join(' + ') +
+            '. Finish setup to review and apply it.'
+          : baseline.state === 'unavailable'
+            ? 'The installed baseline providers do not currently expose an automatic setup surface for this agent. Token Harness will not offer a no-op button.'
+            : baseline.state === 'limited'
+              ? 'All automatic baseline actions exposed by the installed providers are complete.'
+              : 'All automatic baseline connections exposed for this coding agent are configured.';
+      card.append(head, node('p', detail));
       if (agent.providers?.length)
         card.append(
           node(
@@ -35638,10 +36087,16 @@ var init_guided_product_client = __esm({
             'caption',
           ),
         );
-      if (!ready) {
+      if (baseline.state === 'incomplete') {
         const actions = node('div', undefined, 'inline-actions');
         actions.append(actionButton('Finish setup', () => reviewSetup(agent.id)));
         card.append(actions);
+      } else if (baseline.unavailable.length) {
+        const details = node('details', undefined, 'agent-details');
+        details.append(node('summary', 'Why some automatic connections are unavailable'));
+        for (const target of baseline.unavailable)
+          details.append(node('p', target.provider + ': ' + target.reason, 'caption'));
+        card.append(details);
       }
       root.append(card);
     }
@@ -35663,7 +36118,7 @@ var init_guided_product_client = __esm({
         'Safe preview first',
         provider
           ? 'Token Harness will inspect only ' + provider.name + ' for ' + agent.name + '. If setup is supported, the exact change appears before you confirm it.'
-          : 'Token Harness will prepare the recommended RTK + HarnessTrim setup for ' + agent.name + '. The exact files and changes appear before you confirm them.',
+          : 'Token Harness will prepare the RTK/HarnessTrim changes exposed by the installed providers for ' + agent.name + '. Newer combinations use the same transactional path and are checked again after apply. The exact files and changes appear before you confirm them.',
       ),
       messageBox('Nothing changes yet', 'This first step only prepares the safe plan. You decide whether to apply it after seeing the concrete changes.'),
       progress('Checking ' + agent.name, 'Reading installed optimizer versions and current integration state.'),
@@ -35689,13 +36144,18 @@ var init_guided_product_client = __esm({
       .then(data => {
         if (run !== modalRun || !$('modal').open) return;
         pendingTicket = data.ticket;
+        if (!data.ticket) {
+          refreshOverviewAfterMutation('Refreshing setup availability after the review…').catch(
+            () => undefined,
+          );
+        }
         $('modal-content').replaceChildren();
         $('modal-content').append(
           messageBox(
             provider ? 'This optimizer only' : 'Recommended setup',
             provider
               ? 'This approval changes only ' + provider.name + ' for ' + agent.name + '. Other optimizers are left unchanged.'
-              : 'This approval covers only RTK + HarnessTrim for ' + agent.name + '. Optional optimizers stay separate.',
+              : 'This review includes only the currently actionable RTK/HarnessTrim changes for ' + agent.name + '. Providers that do not expose the required setup surface, and already-complete providers, are left out. Optional optimizers stay separate.',
           ),
         );
         if (!data.changes.length) {
@@ -35703,7 +36163,7 @@ var init_guided_product_client = __esm({
             messageBox(
               'No setup change available',
               (data.notices || []).join(' ') ||
-                'This setup is already complete, or a prerequisite/version prevents Token Harness from changing it safely.',
+                'No automatic change is available from the provider’s current capability surface. The dashboard is refreshing so an obsolete setup action is not left visible.',
             ),
           );
         } else {
@@ -35714,7 +36174,7 @@ var init_guided_product_client = __esm({
           }
           for (const notice of data.notices || []) $('modal-content').append(node('p', notice, 'notice-row'));
         }
-        $('modal-content').append(messageBox('Safety', 'Apply uses the existing transactional engine with backups, compatibility checks, ownership checks and rollback. Unsupported versions are not forced.', 'safe'));
+        $('modal-content').append(messageBox('Safety', 'Apply uses the transactional engine with backups, ownership checks and rollback. A newer version tuple is allowed when the installed provider exposes the required capability, then the resulting state is checked again after apply.', 'safe'));
         $('modal-actions').replaceChildren(modalClose(data.ticket ? 'Cancel' : 'Done'));
         if (data.ticket)
           $('modal-actions').append(
@@ -35748,7 +36208,7 @@ var init_guided_product_client = __esm({
     const run = modalRun;
     setBusy(true, true);
     $('modal-actions').replaceChildren(modalClose('Applying…', true));
-    $('modal-content').append(progress('Applying the reviewed change', 'Keep this window open until the transaction finishes.'));
+    $('modal-content').append(progress('Applying the approved change', 'Keep this window open until the transaction finishes.'));
     try {
       await ensureSession();
       const result = await request('/api/apply', { ticket });
@@ -36061,7 +36521,7 @@ var init_guided_product_client = __esm({
         isVerify ? 'Troubleshooting check' : 'Update preview',
         isVerify
           ? 'Re-checks the configured optimizer integrations without repairing or changing them. Normal setup already performs its own safety checks.'
-          : 'Checks reviewed update channels first. If an installable update exists, you can approve it from this window.',
+          : 'Checks provider update channels first. If an installable update exists, you can approve it from this window; the active executable is re-checked after installation before success is reported.',
       ),
       progress(
         isVerify ? 'Checking configured optimizers' : 'Checking update channels',
@@ -36172,7 +36632,7 @@ var init_guided_product_client = __esm({
         'p',
         available.length
           ? available.map(component => (TOOL_INFO[component.providerId]?.name || component.providerId) + ' has an update ready.').join(' ')
-          : 'Check installed optimizer versions. If a reviewed update is available, you can install it from the same dialog.',
+          : 'Check installed optimizer versions. If an update is available, you can install it from the same dialog; Token Harness verifies the active runtime after installation.',
         'caption',
       ),
     );
@@ -37094,7 +37554,7 @@ ${GUIDE_CANDIDATE_READINESS_JS}`;
 </div>
 
 <section class="setup-step" id="coding-agents">
-<div class="section-title"><div><h2>Coding agents</h2><p>These are the harnesses Token Harness can configure today. A detected agent is not considered fully set up until the recommended RTK + HarnessTrim baseline is connected to it.</p></div></div>
+<div class="section-title"><div><h2>Coding agents</h2><p>Token Harness shows setup actions only when it has a reviewed automatic change for that exact agent, provider version and platform. Unsupported combinations are shown as unavailable instead of as unfinished work.</p></div></div>
 <div id="setup-agents" class="tool-grid"><article class="tool-card"><h3>Checking agents\u2026</h3></article></div>
 <details class="disclosure advanced-disclosure">
 <summary>Agent details and optional reasoning settings</summary>