devtorch-cli 3.0.1__py3-none-any.whl

devtorch_cli/main.py

@@ -0,0 +1,4090 @@
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+import types
+from pathlib import Path
+from typing import Any
+
+from devtorch_core import (
+    GCCRepository,
+    SensitivityEvent,
+    OmegaCapability,
+    L_MAX_DEFAULT,
+)
+from devtorch_core.serve import cmd_serve as _cmd_serve
+
+from devtorch_cli.session_cmds import (
+    cmd_session_start,
+    cmd_session_list,
+    cmd_session_show,
+    cmd_session_plan,
+    cmd_session_next,
+    cmd_session_mark,
+    cmd_session_close,
+    cmd_session_disagree,
+    cmd_session_resolve,
+    cmd_session_disagreements,
+    cmd_simulate,
+)
+from devtorch_cli.capability_role_cmds import (
+    cmd_capability_role_list,
+    cmd_capability_role_show,
+    cmd_capability_role_set,
+    cmd_capability_role_policy,
+    cmd_capability_role_apply_default_policy,
+)
+from devtorch_cli.pre_commit_cmds import (
+    cmd_pre_commit_install,
+    cmd_pre_commit_run,
+)
+from devtorch_cli.pr_reporter_cmd import cmd_pr_report
+from devtorch_cli.audit_cmds import build_audit_parser
+
+
+def cmd_init(args: argparse.Namespace) -> int:
+    project_root = Path(args.path).resolve()
+    template_name = getattr(args, "template", None)
+    if template_name:
+        from devtorch_core.templates.engine import apply_template
+        try:
+            apply_template(project_root, template_name)
+        except ValueError as exc:
+            print(f"error: {exc}", file=sys.stderr)
+            return 1
+        print(f"Initialized DevTorch GCC store at {project_root / '.GCC'} with template '{template_name}'")
+    else:
+        repo = GCCRepository.at(project_root)
+        repo.init()
+        print(f"Initialized DevTorch GCC store at {repo.gcc_dir}")
+    return 0
+
+
+# S27: reasoning template library
+
+
+def cmd_templates_list(args: argparse.Namespace) -> int:
+    """List built-in and custom reasoning templates."""
+    from devtorch_core.templates.library import (
+        list_builtin_templates,
+        discover_custom_templates,
+    )
+
+    project_root = Path(args.path).resolve()
+    builtins = list_builtin_templates()
+    custom = discover_custom_templates(project_root)
+
+    if not builtins and not custom:
+        print("No templates found.")
+        return 0
+
+    print("Built-in templates:")
+    for t in builtins:
+        tags = ", ".join(t.get("tags", []))
+        print(f"  {t['name']:<22} {t['description']}")
+        if tags:
+            print(f"    tags: {tags}")
+
+    if custom:
+        print("\nCustom templates:")
+        for t in custom:
+            tags = ", ".join(t.get("tags", []))
+            print(f"  {t['name']:<22} {t['description']}  [{t['origin']}]")
+            if tags:
+                print(f"    tags: {tags}")
+
+    return 0
+
+
+def cmd_templates_apply(args: argparse.Namespace) -> int:
+    """Render a reasoning template with variables."""
+    from devtorch_core.templates.library import apply_template
+
+    variables: dict[str, str] = {}
+    for var in getattr(args, "variables", []) or []:
+        if "=" not in var:
+            print(f"error: --var must be KEY=VALUE, got: {var}", file=sys.stderr)
+            return 1
+        key, value = var.split("=", 1)
+        variables[key.strip()] = value.strip()
+
+    project_root = Path(args.path).resolve()
+    output_path = Path(args.output) if args.output else None
+
+    try:
+        out = apply_template(
+            args.name,
+            variables,
+            output_path=output_path,
+            project_root=project_root,
+        )
+    except ValueError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+
+    print(f"Rendered template to {out}")
+    return 0
+
+
+def cmd_templates_init(args: argparse.Namespace) -> int:
+    """Create the custom template extension directory and README."""
+    project_root = Path(args.path).resolve()
+    templates_dir = project_root / ".devtorch" / "templates"
+    templates_dir.mkdir(parents=True, exist_ok=True)
+
+    readme = templates_dir / "README.md"
+    content = """# Custom Reasoning Templates
+
+Add Markdown templates to this directory to make them available via `devtorch templates`.
+
+Each template should start with a YAML front-matter block:
+
+```yaml
+---
+name: my_template
+description: Short description shown in `devtorch templates list`
+tags: [reasoning, custom]
+---
+```
+
+The body can contain `{{variable}}` placeholders. Render with:
+
+```bash
+devtorch templates apply my_template --var key=value --output path/to/file.md
+```
+
+Templates are also discovered from the project-level `templates/` directory.
+"""
+    readme.write_text(content, encoding="utf-8")
+    print(f"Created custom templates directory at {templates_dir}")
+    return 0
+
+
+def _parse_concepts(raw: str | None) -> list[str] | None:
+    """Parse comma-separated concepts, returning None if empty."""
+    if not raw:
+        return None
+    parts = [c.strip() for c in raw.split(",") if c.strip()]
+    return parts if parts else None
+
+
+def cmd_commit(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    concepts = _parse_concepts(getattr(args, "concepts", None))
+    try:
+        repo.commit(message=args.message or "", concepts=concepts)
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    if concepts:
+        print(f"Recorded commit in {repo.gcc_dir}  [concepts: {', '.join(concepts)}]")
+    else:
+        print(f"Recorded commit in {repo.gcc_dir}")
+    return 0
+
+
+def cmd_chain(args: argparse.Namespace) -> int:
+    from devtorch_core.reasoning_plus.learning.chain import build_chain, format_chains
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+    chains = build_chain(
+        repo.gcc_dir,
+        concept=getattr(args, "concept", None),
+        max_chains=getattr(args, "max_chains", 5),
+    )
+    print(format_chains(chains))
+    return 0
+
+
+def cmd_welcome(args: argparse.Namespace) -> int:
+    print("Welcome to DevTorch — governance for AI-assisted codebases.")
+    print()
+    print("Quick start:")
+    print("  1. devtorch init                 start tracking this project")
+    print("  2. devtorch status               see current state")
+    print("  3. devtorch today                daily dashboard")
+    print()
+    print("Common commands:")
+    print("  devtorch setup                   one-command IDE setup")
+    print("  devtorch doctor                  run health checks")
+    print("  devtorch log --tail 20           recent reasoning log")
+    print("  devtorch metrics --period 1d     recent activity metrics")
+    print("  devtorch ask <query>             search .GCC/ and project files")
+    print()
+    print("Need help? Run any command with --help, e.g. devtorch init --help")
+    return 0
+
+
+def cmd_ask(args: argparse.Namespace) -> int:
+    """Hybrid grep + semantic search over .GCC/ and project files."""
+    from devtorch_core.query import hybrid_search
+
+    project_root = Path(args.path).resolve()
+    if not (project_root / ".GCC").exists():
+        print(f"error: {project_root / '.GCC'} not found. Run `devtorch init` first.", file=sys.stderr)
+        return 1
+
+    force_semantic = getattr(args, "semantic", False)
+    no_semantic = getattr(args, "no_semantic", False)
+    if force_semantic and no_semantic:
+        print("error: --semantic and --no-semantic are mutually exclusive.", file=sys.stderr)
+        return 1
+
+    if force_semantic:
+        mode = "semantic"
+    elif no_semantic:
+        mode = "grep"
+    else:
+        mode = "hybrid"
+
+    results = hybrid_search(
+        query=args.query,
+        project_root=project_root,
+        top_n=args.top_n,
+        mode=mode,
+    )
+
+    if not results:
+        print("No results found.")
+        return 0
+
+    print(f"Results for: {args.query}\n")
+    for r in results:
+        rel_path = r.path
+        try:
+            rel_path = r.path.relative_to(project_root)
+        except ValueError:
+            pass
+        print(f"{rel_path}:{r.line} [{r.source}] score={r.score:.3f}")
+        print(f"  {r.snippet}")
+    return 0
+
+
+def cmd_doctor(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    issues = repo.doctor()
+    if getattr(args, "ci", False):
+        # In CI the .GCC/ directory is often gitignored and not present; the
+        # reusable check is meant to validate code quality, not runtime state.
+        issues = [i for i in issues if not (i.kind == "layout" and ".GCC" in i.message and "Missing" in i.message)]
+        return _doctor_ci_mode(repo, issues, args)
+    if not issues:
+        print("devtorch doctor: OK")
+        return 0
+    print("devtorch doctor: found issues:")
+    for issue in issues:
+        print(f"- [{issue.kind}] {issue.message}")
+    return 1
+
+
+def cmd_alert(args: argparse.Namespace) -> int:
+    """Send a test governance alert to configured channels."""
+    from devtorch_core.alerts import (
+        AlertEnvelope,
+        AlertSeverity,
+        dispatch_alert,
+        SlackChannel,
+        MicrosoftTeamsChannel,
+        JiraChannel,
+        LinearChannel,
+        PagerDutyChannel,
+        load_config,
+        AlertConfig,
+    )
+
+    severity_map = {
+        "info": AlertSeverity.INFO,
+        "warning": AlertSeverity.WARNING,
+        "critical": AlertSeverity.CRITICAL,
+    }
+    severity = severity_map[args.severity]
+    envelope = AlertEnvelope(
+        event_type=args.event_type,
+        severity=severity,
+        title=args.title,
+        body=args.body,
+        branch="main",
+        commit_id="test",
+        metadata={"source": "devtorch-cli"},
+    )
+
+    config = load_config()
+    if args.channel:
+        # Dispatch only to selected channel
+        channel = args.channel
+        if not config.is_channel_configured(channel):
+            print(f"error: channel '{channel}' is not configured. Set the required environment variables.", file=sys.stderr)
+            return 1
+        channels = []
+        if channel == "slack":
+            channels.append(SlackChannel(config.slack_webhook_url))
+        elif channel == "teams":
+            channels.append(MicrosoftTeamsChannel(config.teams_webhook_url))
+        elif channel == "jira":
+            channels.append(JiraChannel(config.jira_url, config.jira_project_key, config.jira_api_token, config.jira_email))
+        elif channel == "linear":
+            channels.append(LinearChannel(config.linear_api_token, config.linear_team_id))
+        elif channel == "pagerduty":
+            channels.append(PagerDutyChannel(config.pagerduty_routing_key))
+        results = [c.deliver(envelope) for c in channels]
+    else:
+        results = dispatch_alert(envelope, config=config)
+
+    if not results:
+        print("No alert channels configured. Set e.g. DEVTORCH_SLACK_WEBHOOK_URL and try again.")
+        return 1
+
+    exit_code = 0
+    for result in results:
+        status = "OK" if result.success else "FAIL"
+        detail = f" ({result.error})" if result.error else ""
+        print(f"{status}: {result.channel}{detail}")
+        if not result.success:
+            exit_code = 1
+    return exit_code
+
+
+def cmd_cloud_client_config(args: argparse.Namespace) -> int:
+    """Install MCP client config for an IDE and update AGENTS.md."""
+    from devtorch_core.cloud.client_config import install_client_config
+
+    try:
+        result = install_client_config(
+            ide=args.ide,
+            org=args.org,
+            repo=args.repo,
+            api_key=args.api_key,
+            domain=args.domain,
+            project_root=args.path,
+            use_env_key=getattr(args, "use_env_key", False),
+        )
+    except Exception as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+
+    print(f"Installed {result['installed_file']}")
+    print(f"DevTorch MCP URL: {result['url']}")
+    if "warning" in result:
+        print(f"WARNING: {result['warning']}", file=sys.stderr)
+    if "warning_use_env_key" in result:
+        print(f"WARNING: {result['warning_use_env_key']}", file=sys.stderr)
+    if "secret_warning" in result:
+        print(f"WARNING: {result['secret_warning']}", file=sys.stderr)
+    return 0
+
+
+def _doctor_ci_mode(repo: Any, issues: List[Any], args: argparse.Namespace) -> int:
+    """CI mode: enforce DHS and I3 thresholds in addition to doctor checks."""
+    from devtorch_core.metrics.dhs import compute_dhs, DHSComponents, dhs_to_label
+    from devtorch_core.metrics.shadow_ai import detect_shadow_ai
+
+    min_dhs = float(getattr(args, "min_dhs_score", 0.0))
+    critical_concepts = [c.strip() for c in getattr(args, "critical_concepts", "").split(",") if c.strip()]
+
+    exit_code = 0
+    messages: List[str] = []
+
+    if issues:
+        exit_code = 1
+        messages.append(f"Doctor found {len(issues)} issue(s)")
+        for issue in issues:
+            messages.append(f"  - [{issue.kind}] {issue.message}")
+
+    # DHS check
+    shadow = detect_shadow_ai(repo.root)
+    components = DHSComponents(
+        commit_health=1.0 if shadow.get("gcc_commits", 0) > 0 else 0.0,
+        sensitivity_health=1.0,
+        capability_health=0.0,
+        variance_health=1.0,
+    )
+    dhs_score = compute_dhs(components)
+    dhs_label = dhs_to_label(dhs_score)
+    if min_dhs > 0 and dhs_score < min_dhs:
+        exit_code = 1
+        messages.append(f"DHS {dhs_score:.2f} below threshold {min_dhs:.2f} ({dhs_label})")
+    else:
+        messages.append(f"DHS {dhs_score:.2f} ({dhs_label})")
+
+    # I3 critical-concepts check
+    if critical_concepts:
+        theta = repo.get_theta().get("coordination_vector", {})
+        missing = [c for c in critical_concepts if c not in theta]
+        if missing:
+            exit_code = 1
+            messages.append(f"Critical concepts missing from Θ: {', '.join(missing)}")
+        else:
+            messages.append(f"Critical concepts present in Θ: {', '.join(critical_concepts)}")
+
+    prefix = "PASS" if exit_code == 0 else "FAIL"
+    print(f"devtorch doctor --ci: {prefix}")
+    for msg in messages:
+        print(f"  {msg}")
+    return exit_code
+
+
+def cmd_branch(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        repo.create_branch(args.name, from_ref=args.from_ref)
+    except ValueError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print(f"Created branch `{args.name}`.")
+    return 0
+
+
+def cmd_history(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    history = repo.history(branch=args.branch)
+    if not history:
+        print("No commits.")
+        return 0
+    for commit in history:
+        cid = commit.get("id")
+        msg = commit.get("message", "")
+        br = commit.get("branch")
+        parent = commit.get("parent")
+        ts = commit.get("timestamp")
+        print(f"{cid} [{br}] parent={parent} {ts} :: {msg}")
+    return 0
+
+
+def cmd_merge(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        repo.merge_fast_forward(source=args.source, target=args.target)
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print(f"Merged `{args.source}` into `{args.target or repo._current_branch()}` (fast-forward).")
+    return 0
+
+
+def cmd_context(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        bundle = repo.context_bundle(
+            k_tokens=args.k,
+            policy={"sensitivity_policy": args.policy},
+            branch=args.branch,
+            explain=args.explain,
+        )
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+
+    print(f"Context bundle for branch `{bundle['branch']}` "
+          f"(approx {bundle['approx_tokens_used']}/{bundle['k_tokens']} tokens):")
+    for art in bundle["artifacts"]:
+        print(f"- {art['path']} :: {art['reason']} "
+              f"(~{art['approx_tokens']} tokens)")
+    if args.explain and "bundle_path" in bundle:
+        print(f"Bundle persisted as `.GCC/{bundle['bundle_path']}`")
+    return 0
+
+
+def cmd_sensitivity_add(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        event = SensitivityEvent(
+            source_node=args.source,
+            target_concept=args.concept,
+            counterfactuals=args.counterfactuals or "",
+            confidence=args.confidence,
+            disclosure_level=args.disclosure.upper(),
+            numerical_value=args.numerical,
+            uncertainty=args.uncertainty,
+            message=args.message or "",
+        )
+        event_id = repo.add_sensitivity(event)
+    except (ValueError, RuntimeError) as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print(f"Sensitivity recorded (id={event_id}).")
+    return 0
+
+
+def cmd_sensitivity_list(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        events = repo.list_sensitivities(
+            concept=args.concept,
+            disclosure_level=args.disclosure.upper() if args.disclosure else None,
+            source_node=args.source_node,
+        )
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    if not events:
+        print("No sensitivity events found.")
+        return 0
+    for ev in events:
+        num = f" num={ev['numerical_value']}" if ev.get("numerical_value") is not None else ""
+        print(
+            f"[{ev['disclosure_level']}] {ev['source_node']} → {ev['target_concept']} "
+            f"conf={ev['confidence']}{num}  id={ev['event_id']}"
+        )
+    return 0
+
+
+def cmd_sensitivity_filter(args: argparse.Namespace) -> int:
+    """Alias for `sensitivity list` with a mandatory --disclosure filter."""
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        events = repo.list_sensitivities(
+            concept=args.concept,
+            disclosure_level=args.disclosure.upper() if args.disclosure else None,
+            source_node=args.source_node,
+        )
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    theta = repo.get_theta()
+    cv = theta.get("coordination_vector", {})
+
+    print(f"Filtered sensitivities (disclosure={args.disclosure or 'any'}, "
+          f"concept={args.concept or 'any'}):")
+    for ev in events:
+        num = f" num={ev['numerical_value']}" if ev.get("numerical_value") is not None else ""
+        print(
+            f"  [{ev['disclosure_level']}] {ev['source_node']} → {ev['target_concept']} "
+            f"conf={ev['confidence']}{num}"
+        )
+    print(f"\nΘ coordination vector (all concepts):")
+    for concept, entry in cv.items():
+        print(
+            f"  {concept}: mean_conf={entry['mean_confidence']} "
+            f"level={entry['disclosure_level']} n={entry['event_count']}"
+        )
+    return 0
+
+
+def cmd_capability_set(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        cap = OmegaCapability(
+            agent_id=args.agent_id,
+            lipschitz_bound=args.lipschitz_bound,
+            calibration_dataset_hash=args.calibration_hash,
+            embedding_model=args.embedding_model,
+            calibration_date=args.calibration_date,
+            temperature_used=args.temperature,
+            lipschitz_p95=args.lipschitz_p95,
+            expiry_days=args.expiry_days,
+        )
+        repo.set_capability(cap)
+    except (ValueError, RuntimeError) as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print(f"Capability declaration set for agent '{cap.agent_id}'.")
+    return 0
+
+
+def cmd_capability_show(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        cap = repo.get_capability()
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    if cap is None:
+        print("No capability declaration set. Run `devtorch capability set` first.")
+        return 1
+    print(f"Ωᵢ capability for agent '{cap['agent_id']}':")
+    for key in (
+        "schema_version", "lipschitz_bound", "lipschitz_p95",
+        "embedding_model", "calibration_date", "temperature_used",
+        "expiry_days", "pst_status", "pst_score",
+        "pst_n_prompts", "pst_n_repetitions", "calibration_dataset_hash",
+        "created_at", "updated_at",
+    ):
+        val = cap.get(key)
+        if val is not None:
+            print(f"  {key}: {val}")
+    return 0
+
+
+def cmd_capability_validate(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        result = repo.validate_capability(l_max=args.l_max)
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    if result["textual_mode_allowed"]:
+        print(f"Capability valid. Textual Mode: ALLOWED (agent={result['agent_id']}).")
+        return 0
+    print(f"Capability DEGRADED. Textual Mode: BLOCKED (agent={result['agent_id']}).")
+    for reason in result["reasons"]:
+        print(f"  - {reason}")
+    return 1
+
+
+# Sprint 4: lock, unlock, invariant, concept, variance
+
+def cmd_lock(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        repo.lock(reason=args.reason or "", required_peer_count=args.peers)
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print("Consensus lock acquired.")
+    return 0
+
+
+def cmd_unlock(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        repo.unlock()
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print("Consensus lock released.")
+    return 0
+
+
+def cmd_invariant_check(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        concepts_raw = (args.concepts or "").strip()
+        concepts_used = [c.strip() for c in concepts_raw.split(",") if c.strip()] or None
+        failures = repo.invariant_check(
+            operation=args.operation or "merge",
+            branch_tips=None,
+            concepts_used=concepts_used,
+        )
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    if not failures:
+        print("All invariant checks passed.")
+        return 0
+    print("Invariant check(s) failed:")
+    for f in failures:
+        print(f"  [{f.invariant_id}] {f.message}")
+        print(f"    Fix: {f.actionable_fix}")
+    return 1
+
+
+def cmd_concept_add(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        repo.concept_add(args.name, args.definition)
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print(f"Concept '{args.name}' registered.")
+    return 0
+
+
+def cmd_concept_list(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        names = repo.concept_list()
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    if not names:
+        print("No concepts registered.")
+        return 0
+    for n in names:
+        print(n)
+    return 0
+
+
+def cmd_concept_danger(args: argparse.Namespace) -> int:
+    from devtorch_core.reasoning_plus.learning.store import LearningStore
+    from devtorch_core.reasoning_plus.learning.analytics import danger_zones
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+    store = LearningStore(repo.gcc_dir)
+    zones = danger_zones(store, threshold=args.threshold, min_samples=args.min_samples)
+    if not zones:
+        print(f"No danger zones found (threshold={args.threshold}, min_samples={args.min_samples}).")
+        return 0
+    print(f"Danger zones (success rate < {args.threshold:.0%}):")
+    for z in zones:
+        print(
+            f"  {z['concept']}: success {z['success_rate']:.0%}, "
+            f"{z['total_learnings']} learning(s), "
+            f"avg confidence {z['avg_confidence']:.2f}"
+        )
+    return 0
+
+
+def _try_remote_or_local(
+    args: argparse.Namespace,
+    tool_name: str,
+    tool_args: dict,
+    local_fn: Any,
+) -> int | None:
+    """Try remote MCP first, fall back to local on failure.
+
+    Returns an int return code if remote succeeded, or None if the caller
+    should proceed with the local fallback.
+    """
+    from devtorch_core.cloud.mcp_client import detect_mcp_config, McpClient
+
+    root = Path(args.path).resolve()
+    config = detect_mcp_config(root)
+
+    if config:
+        url, api_key = config
+        try:
+            client = McpClient(url, api_key, timeout=10.0)
+            result = client.call_tool(tool_name, tool_args)
+            print(result)
+            return 0
+        except Exception as e:
+            print(f"Remote MCP unavailable ({e}), falling back to local .GCC/...")
+
+    return None
+
+
+def cmd_concept_list_all(args: argparse.Namespace) -> int:
+    rc = _try_remote_or_local(args, "devtorch_concepts_list", {"learned_only": False}, None)
+    if rc is not None:
+        return rc
+
+    from devtorch_core.concept_catalog import ConceptCatalog
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+    catalog = ConceptCatalog(repo.gcc_dir)
+    all_concepts = catalog.enumerate_all()
+    if not all_concepts:
+        print("No concepts found.")
+        return 0
+    print(f"All concepts ({len(all_concepts)} from multiple sources):\n")
+    for cname, sources in all_concepts.items():
+        print(f"  {cname:<20} {', '.join(sources)}")
+    return 0
+
+
+def cmd_concept_learned(args: argparse.Namespace) -> int:
+    rc = _try_remote_or_local(args, "devtorch_concepts_list", {"learned_only": True}, None)
+    if rc is not None:
+        return rc
+
+    from devtorch_core.concept_catalog import ConceptCatalog
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+    catalog = ConceptCatalog(repo.gcc_dir)
+    learned = catalog.enumerate_learned()
+    if not learned:
+        print("No concepts with learning data found.")
+        return 0
+    print("Concepts learned from interactions:\n")
+    print(f"  {'Concept':<16} {'Learnings':>9} {'Active':>7} {'Success':>8} {'Confidence':>10}")
+    print(f"  {'─'*16} {'─'*9} {'─'*7} {'─'*8} {'─'*10}")
+    for cname, stats in sorted(learned.items()):
+        danger = "  DANGER" if stats["success_rate"] < 0.4 else ""
+        print(
+            f"  {cname:<16} {stats['learning_count']:>9} {stats['active']:>7} "
+            f"{stats['success_rate']:>7.0%} {stats['avg_confidence']:>10.2f}{danger}"
+        )
+    print(f"\n{len(learned)} concepts with learning data.")
+    return 0
+
+
+def cmd_concept_related(args: argparse.Namespace) -> int:
+    rc = _try_remote_or_local(args, "devtorch_concepts_related", {"topic": args.topic}, None)
+    if rc is not None:
+        return rc
+
+    from devtorch_core.concept_catalog import ConceptCatalog
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+    catalog = ConceptCatalog(repo.gcc_dir)
+    result = catalog.concepts_for_topic(args.topic, hide_empty=True)
+    concepts = result.get("concepts", [])
+    taxonomy_only = result.get("taxonomy_only", [])
+    if not concepts and not taxonomy_only:
+        print(f"Topic '{args.topic}' not found or has no concepts.")
+        return 0
+    print(f"Concepts related to topic '{args.topic}':\n")
+    for c in concepts:
+        parts = [f"  {c['name']:<16}"]
+        parts.append(f"sources: {', '.join(c['sources'])}")
+        if "learning_count" in c:
+            parts.append(f"{c['learning_count']} learnings, {c['success_rate']:.0%} success")
+        print(" — ".join(parts))
+    if taxonomy_only:
+        print(f"\n  Also in taxonomy (no data): {', '.join(taxonomy_only)}")
+    print(f"\n{len(concepts)} concept(s) with data. Use 'devtorch reasoning history --topic {args.topic}' for full history.")
+    return 0
+
+
+def cmd_topics_list(args: argparse.Namespace) -> int:
+    show_all = getattr(args, "all", False)
+    rc = _try_remote_or_local(args, "devtorch_topics_list", {"all": show_all}, None)
+    if rc is not None:
+        return rc
+
+    from devtorch_core.topics import TopicStore
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+    store = TopicStore(repo.gcc_dir)
+    topics = store.list_topics(with_data_only=not show_all)
+    if not topics:
+        print("No topics found." if show_all else "No topics with captured reasoning. Use --all to see full taxonomy.")
+        return 0
+    header = "Topics" + (" (full taxonomy):\n" if show_all else " with captured reasoning:\n")
+    print(header)
+    for t in topics:
+        tag = f"  [{t['source']}]" if t["source"] != "default" else ""
+        print(f"  {t['name']:<20} ({len(t['concepts'])} concepts: {', '.join(t['concepts'])}){tag}")
+    total = len(topics)
+    defaults = sum(1 for t in topics if t["source"] == "default")
+    customs = sum(1 for t in topics if t["source"] == "custom")
+    derived = sum(1 for t in topics if t["source"] == "derived")
+    print(f"\n{total} topics ({defaults} default, {customs} custom, {derived} auto-derived)")
+    return 0
+
+
+def cmd_topics_show(args: argparse.Namespace) -> int:
+    from devtorch_core.topics import TopicStore
+    from devtorch_core.concept_catalog import ConceptCatalog
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+    store = TopicStore(repo.gcc_dir)
+    catalog = ConceptCatalog(repo.gcc_dir)
+    concepts = store.get_concepts(args.name)
+    if not concepts:
+        print(f"Topic '{args.name}' not found.")
+        return 1
+    topics = store.list_topics(with_data_only=False)
+    topic_meta = next((t for t in topics if t["name"] == args.name), None)
+    source_tag = f"  [{topic_meta['source']}]" if topic_meta and topic_meta["source"] != "default" else ""
+    print(f"Topic: {args.name}{source_tag}\n")
+
+    all_concepts = catalog.enumerate_all()
+    learned = catalog.enumerate_learned()
+    with_data = []
+    without_data = []
+    for c in concepts:
+        sources = all_concepts.get(c.lower(), [])
+        if sources:
+            entry = f"  {c:<16} [sources: {', '.join(sources)}]"
+            if c.lower() in learned:
+                stats = learned[c.lower()]
+                entry += f" — {stats['learning_count']} learnings, {stats['success_rate']:.0%} success"
+            with_data.append(entry)
+        else:
+            without_data.append(c)
+
+    if with_data:
+        print("Concepts with data:")
+        for line in with_data:
+            print(line)
+    if without_data:
+        print(f"\nAlso in taxonomy (no data yet):\n  {', '.join(without_data)}")
+    if not with_data and not without_data:
+        print("No concepts found for this topic.")
+    return 0
+
+
+def cmd_topics_add(args: argparse.Namespace) -> int:
+    from devtorch_core.topics import TopicStore
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+    concepts = _parse_concepts(args.concepts) or []
+    store = TopicStore(repo.gcc_dir)
+    store.add_topic(args.name, concepts)
+    print(f"Topic '{args.name}' registered with {len(concepts)} concept(s).")
+    return 0
+
+
+def cmd_topics_remove(args: argparse.Namespace) -> int:
+    from devtorch_core.topics import TopicStore
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+    store = TopicStore(repo.gcc_dir)
+    removed = store.remove_topic(args.name)
+    if removed:
+        print(f"Topic '{args.name}' removed.")
+    else:
+        print(f"Topic '{args.name}' not found.")
+        return 1
+    return 0
+
+
+def cmd_topics_derive(args: argparse.Namespace) -> int:
+    from devtorch_core.topics import TopicStore
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+    store = TopicStore(repo.gcc_dir)
+    derived = store.derive_topics(force=getattr(args, "force", False))
+    if not derived:
+        print("No topics could be derived from concept co-occurrence (need >= 3 co-occurring concepts).")
+        return 0
+    print(f"Derived {len(derived)} topic(s) from concept co-occurrence:")
+    for label, concepts in derived.items():
+        print(f"  {label:<20} ({len(concepts)} concepts: {', '.join(concepts)})")
+    print("\nRe-derivation skipped on next call unless commits or learnings change.")
+    return 0
+
+
+def cmd_reasoning_history(args: argparse.Namespace) -> int:
+    topic = getattr(args, "topic", None)
+    concept = getattr(args, "concept", None)
+    max_entries = getattr(args, "max_entries", 50)
+    agent_id = getattr(args, "agent_id", None)
+
+    if not topic and not concept:
+        print("Provide either --topic or --concept.", file=sys.stderr)
+        return 1
+
+    tool_args = {"max_entries": max_entries}
+    if topic:
+        tool_args["topic"] = topic
+    if concept:
+        tool_args["concept"] = concept
+    if agent_id:
+        tool_args["agent_id"] = agent_id
+
+    rc = _try_remote_or_local(args, "devtorch_reasoning_history", tool_args, None)
+    if rc is not None:
+        return rc
+
+    from devtorch_core.reasoning import ReasoningStore
+    from devtorch_core.topics import TopicStore
+
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+    store = ReasoningStore(repo)
+
+    if concept:
+        entries = store.query(concept=concept, agent_id=agent_id, k_tokens=args.tokens)
+        if not entries:
+            print(f"No reasoning entries found for concept '{concept}'.")
+            return 0
+        print(f"Reasoning for '{concept}' ({len(entries)} entries):\n")
+        for e in entries[:max_entries]:
+            print(f"  [{e.timestamp[:19]}] agent={e.agent_id} conf={e.confidence:.2f} [{e.disclosure_level}]")
+            print(f"  Reasoning: {e.reasoning_text}")
+            if e.decision_text:
+                print(f"  Decision:  {e.decision_text}")
+            print()
+        return 0
+
+    if topic:
+        topic_store = TopicStore(repo.gcc_dir)
+        concepts = topic_store.get_concepts(topic)
+        if not concepts:
+            print(f"Topic '{topic}' not found.")
+            return 1
+        print(f"Reasoning history for topic '{topic}' ({len(concepts)} concepts):\n")
+        total = 0
+        for c in concepts:
+            entries = store.query(concept=c, agent_id=agent_id, k_tokens=args.tokens)
+            if entries:
+                shown = entries[:max(0, max_entries - total)]
+                if not shown:
+                    break
+                print(f"═══ {c} ({len(entries)} entries, showing {len(shown)}) ═══")
+                for e in shown:
+                    print(f"  [{e.timestamp[:19]}] agent={e.agent_id} conf={e.confidence:.2f} [{e.disclosure_level}]")
+                    print(f"  Reasoning: {e.reasoning_text}")
+                    if e.decision_text:
+                        print(f"  Decision:  {e.decision_text}")
+                    print()
+                total += len(shown)
+                if total >= max_entries:
+                    break
+        print(f"Total: {total} reasoning entries (capped at --max-entries {max_entries}) across {len(concepts)} concepts.")
+        return 0
+
+    return 0
+
+
+def cmd_learning_stats(args: argparse.Namespace) -> int:
+    from devtorch_core.reasoning_plus.learning.store import LearningStore
+    from devtorch_core.reasoning_plus.learning.analytics import concept_stats
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+    store = LearningStore(repo.gcc_dir)
+    stats = concept_stats(store)
+    if not stats:
+        print("No learnings found.")
+        return 0
+
+    if args.by_concept:
+        for cname, data in stats.items():
+            print(f"\n  [{cname}]")
+            print(f"    Total: {data['total']}")
+            print(f"    Active: {data['active']}  Stale: {data['stale']}  Deprecated: {data['deprecated']}")
+            print(f"    Avg confidence: {data['avg_confidence']:.2f}")
+            print(f"    Success rate: {data['success_rate']:.0%}")
+            if data["by_type"]:
+                types = ", ".join(f"{t}: {c}" for t, c in data["by_type"].most_common())
+                print(f"    By type: {types}")
+    else:
+        total_all = sum(d["total"] for d in stats.values())
+        active_all = sum(d["active"] for d in stats.values())
+        avg_conf_all = sum(d["avg_confidence"] * d["total"] for d in stats.values()) / total_all if total_all else 0
+        concepts_with_data = [c for c in stats if c != "__untyped__"]
+        print(f"Total learnings: {total_all}")
+        print(f"Active: {active_all}")
+        print(f"Average confidence: {avg_conf_all:.2f}")
+        print(f"Concepts tracked: {len(concepts_with_data)}")
+        print(f"Danger zones: {sum(1 for d in stats.values() if d['success_rate'] < 0.4)}")
+    return 0
+
+
+def cmd_variance_calibrate(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    # Parse agent variances: key=value[,key=value...]
+    agent_variances = {}
+    if getattr(args, "variances", None):
+        for part in args.variances.split(","):
+            part = part.strip()
+            if "=" in part:
+                k, v = part.split("=", 1)
+                agent_variances[k.strip()] = float(v.strip())
+    try:
+        report = repo.variance_calibrate(agent_variances)
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print(f"Variance calibration: n={report.n}, σ²_obs={report.sigma_sq_obs:.4f}, f_max={report.f_max}")
+    return 0
+
+
+def cmd_variance_monitor(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    agent_variances = None
+    if getattr(args, "variances", None):
+        agent_variances = {}
+        for part in args.variances.split(","):
+            part = part.strip()
+            if "=" in part:
+                k, v = part.split("=", 1)
+                agent_variances[k.strip()] = float(v.strip())
+    try:
+        result = repo.variance_monitor_run(agent_variances)
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print(f"Variance monitor: f_max_live={result['f_max_live']}, previous_f_max={result.get('previous_f_max')}, "
+          f"σ²_obs={result.get('sigma_sq_obs', 0):.4f}, alert_emitted={result.get('alert_emitted')}, "
+          f"deterministic_mode_forced={result.get('deterministic_mode_forced')}")
+    return 0
+
+
+# Sprint 5: REP, SIS-TC, prompt, deltaf, RDP, disclosure
+
+def cmd_rep_append(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        payload = json.loads(args.payload) if args.payload else {}
+        seq = repo.rep_append(args.agent_id, args.round_id, payload, trust=args.trust or 0.5)
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print(f"REP envelope appended (sequence_id={seq}).")
+    return 0
+
+
+def cmd_rep_checksum(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    cs = repo.rep_replay_checksum()
+    if not cs:
+        print("No REP ledger or repo not initialized.")
+        return 0
+    print(cs)
+    return 0
+
+
+def cmd_sis_tc_run(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        report = repo.sis_tc_run(corpus_path=Path(args.corpus) if getattr(args, "corpus", None) else None)
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print(f"SIS-TC report: n={report.n_total}, FPR={report.fpr:.4f}, FNR={report.fnr:.4f}")
+    return 0
+
+
+def cmd_prompt_set(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    content = args.content if hasattr(args, "content") and args.content else ""
+    if not content and hasattr(args, "file") and args.file:
+        content = Path(args.file).read_text(encoding="utf-8")
+    try:
+        repo.prompt_set(content, version=getattr(args, "version", "v2.1") or "v2.1")
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print("RACP_SYSTEM_PROMPT_v2.1 stored.")
+    return 0
+
+
+def cmd_prompt_show(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    content = repo.prompt_get()
+    if content is None:
+        print("No system prompt set.")
+        return 0
+    print(content)
+    return 0
+
+
+def cmd_deltaf_run(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        report = repo.deltaf_run(expiry_days=getattr(args, "expiry_days", None) or 90)
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print(f"Δf report: delta_f={report.delta_f}, expiry={report.expiry_date}")
+    return 0
+
+
+def cmd_rdp_spend(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        allowed, event = repo.rdp_spend(args.round_id, args.epsilon)
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    if not allowed:
+        print(f"Privacy budget exhausted: {event}")
+        return 1
+    print("Epsilon spend recorded.")
+    return 0
+
+
+def cmd_rdp_status(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    ro = repo.rdp_read_only()
+    print("read_only=True" if ro else "read_only=False")
+    return 0
+
+
+def cmd_disclosure_redact(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    text = args.text if getattr(args, "text", None) else sys.stdin.read()
+    try:
+        out = repo.disclosure_redact(text, padding_length=getattr(args, "padding", None))
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print(out, end="")
+    return 0
+
+
+# Sprint 19: reasoning subcommand
+
+def cmd_reasoning_show(args: argparse.Namespace) -> int:
+    rc = _try_remote_or_local(
+        args, "devtorch_reasoning_query",
+        {"concept": args.concept, "agent_id": args.agent_id, "k": args.tokens},
+        None,
+    )
+    if rc is not None:
+        return rc
+
+    from devtorch_core.mcp.server import _tool_devtorch_reasoning_query
+    gcc = GCCRepository.at(Path(args.path).resolve())
+    result = _tool_devtorch_reasoning_query(gcc, {
+        "concept": args.concept,
+        "agent_id": args.agent_id,
+        "k": args.tokens,
+    })
+    print(result)
+    return 0
+
+
+# Sprint 9: status command
+
+def cmd_status(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+
+    print("─── DevTorch status ───")
+
+    # 1. Current branch
+    branch = repo._current_branch()
+
+    # 2. Last commit
+    history = repo.history(branch=None)
+    if history:
+        last = history[0]
+        commit_id = (last.get("id") or "")[:7]
+        commit_msg = last.get("message", "")
+        commit_str = f'{commit_id} "{commit_msg}"'
+    else:
+        commit_str = "(no commits)"
+
+    print(f'Branch: {branch}  |  Last commit: {commit_str}')
+
+    # 3. Top 5 Θ hot zones by mean_confidence
+    theta = repo.get_theta()
+    cv = theta.get("coordination_vector", {})
+    sorted_cv = sorted(cv.items(), key=lambda kv: kv[1].get("mean_confidence", 0), reverse=True)
+    hot_zones = "  ".join(
+        f"{concept} ({entry['mean_confidence']:.2f})"
+        for concept, entry in sorted_cv[:5]
+    )
+    print(f"Θ hot zones: {hot_zones or '(none)'}")
+
+    # 4. Node state
+    node_state_path = repo.gcc_dir / "NODE_STATE"
+    if node_state_path.exists():
+        node_state = node_state_path.read_text(encoding="utf-8").strip()
+    else:
+        node_state = "UNKNOWN"
+    print(f"Node state: {node_state}")
+
+    # 5. Invariant summary
+    try:
+        failures = repo.invariant_check(operation="status")
+        if not failures:
+            print("Invariants: \u2713 clear")
+        else:
+            print(f"Invariants: {len(failures)} failure(s):")
+            for f in failures:
+                print(f"  [{f.invariant_id}] {f.message}")
+    except Exception as e:
+        print(f"Invariants: ERROR ({e})")
+
+    # 6. Consensus lock status
+    locked = repo.is_locked()
+    print(f"Lock: {'LOCKED' if locked else 'UNLOCKED'}")
+
+    print("\nTip: run `devtorch metrics --period 1d` for recent activity.")
+    return 0
+
+
+# Sprint 9: today command
+
+def cmd_today(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.")
+        print("Run `devtorch init` to start, or `devtorch welcome` for a quick guide.")
+        return 0
+
+    print("═══ DevTorch daily dashboard ═══\n")
+    rc = 0
+
+    status_args = types.SimpleNamespace(path=args.path)
+    try:
+        rc = max(rc, cmd_status(status_args))
+    except Exception as e:
+        print(f"Status: unavailable ({e})")
+        rc = 1
+    print()
+
+    doctor_args = types.SimpleNamespace(path=args.path, ci=False, skip_checks=[])
+    try:
+        rc = max(rc, cmd_doctor(doctor_args))
+    except Exception as e:
+        print(f"Doctor: unavailable ({e})")
+        rc = 1
+    print()
+
+    log_args = types.SimpleNamespace(
+        path=args.path, tail=getattr(args, "tail", 20), branch=None
+    )
+    try:
+        rc = max(rc, cmd_log(log_args))
+    except Exception as e:
+        print(f"Log: unavailable ({e})")
+        rc = 1
+    print()
+
+    metrics_args = types.SimpleNamespace(
+        path=args.path,
+        period="1d",
+        as_json=False,
+        tokens=False,
+        speedup=False,
+        all_projects=False,
+        delivery_time=False,
+    )
+    try:
+        rc = max(rc, cmd_metrics(metrics_args))
+    except Exception as e:
+        print(f"Metrics: unavailable ({e})")
+        rc = 1
+
+    try:
+        from devtorch_core.reasoning_plus.learning.store import LearningStore
+        from devtorch_core.reasoning_plus.learning.analytics import concept_health_section
+        health = concept_health_section(LearningStore(repo.gcc_dir), threshold=0.4)
+        if health:
+            print()
+            print(health)
+    except Exception as e:
+        print(f"Concept health: unavailable ({e})")
+        rc = 1
+
+    try:
+        from devtorch_core.reasoning_plus.learning.chain import build_chain, format_chain
+        recent = build_chain(repo.gcc_dir, concept=None, max_chains=2)
+        if recent:
+            print()
+            print("─── Recent reasoning chains ───")
+            for i, chain in enumerate(recent, 1):
+                print()
+                print(format_chain(chain, indent="  "))
+    except Exception as e:
+        print(f"Reasoning chains: unavailable ({e})")
+        rc = 1
+
+    try:
+        from devtorch_core.cloud.sync_conflicts import ConflictLog
+        summary = ConflictLog(repo.gcc_dir).summary()
+        if summary:
+            print()
+            print(summary)
+    except Exception as e:
+        print(f"Sync conflicts: unavailable ({e})")
+        rc = 1
+
+    print("\n═══ End of dashboard ═══")
+    return rc
+
+
+# Sprint 9: log command
+
+def cmd_log(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    log_path = repo.gcc_dir / "log.md"
+
+    if not log_path.exists():
+        print("No log found. Run `devtorch init` first.")
+        return 0
+
+    if getattr(args, "branch", None):
+        print("(branch filter not yet supported — log.md is global)")
+
+    content = log_path.read_text(encoding="utf-8")
+    lines = content.splitlines()
+
+    tail = getattr(args, "tail", None)
+    if tail is not None:
+        lines = lines[-tail:]
+
+    print("\n".join(lines))
+    return 0
+
+
+# S7: proxy subcommand (server in devtorch_core/proxy/)
+
+def cmd_proxy_start(args: argparse.Namespace) -> int:
+    port = getattr(args, "port", 8765)
+    host = getattr(args, "host", "127.0.0.1")
+    try:
+        from devtorch_core.proxy.server import run_proxy
+        run_proxy(port=port, host=host)
+    except ImportError:
+        print("Install proxy deps: pip install devtorch[proxy]")
+        return 1
+    return 0
+
+
+def cmd_proxy_stop(args: argparse.Namespace) -> int:
+    print("The proxy runs in the foreground. To stop it:")
+    print("  - Press Ctrl+C in the terminal where it is running, or")
+    print("  - Find the PID with `lsof -i :8765` and run `kill <PID>`.")
+    return 0
+
+
+def cmd_proxy_install(args: argparse.Namespace) -> int:
+    try:
+        from devtorch_core.proxy.server import install_service
+        install_service()
+    except ImportError:
+        print("Install proxy deps: pip install devtorch[proxy]")
+        return 1
+    return 0
+
+
+def cmd_proxy_status(args: argparse.Namespace) -> int:
+    import socket
+    port = 8765
+    try:
+        with socket.create_connection(("127.0.0.1", port), timeout=1):
+            print(f"Proxy running on :{port}")
+    except (ConnectionRefusedError, OSError):
+        print("Proxy not running")
+    return 0
+
+
+# S26: daemon subcommand
+
+
+def cmd_daemon_start(args: argparse.Namespace) -> int:
+    from devtorch_core.daemon import start_daemon
+
+    project_root = Path(args.path).resolve()
+    ok, message = start_daemon(
+        project_root,
+        run_server=getattr(args, "run_server", False),
+        host=getattr(args, "host", "127.0.0.1"),
+        port=int(getattr(args, "port", 8765)),
+    )
+    print(message)
+    return 0 if ok else 1
+
+
+def cmd_daemon_stop(args: argparse.Namespace) -> int:
+    from devtorch_core.daemon import stop_daemon
+
+    project_root = Path(args.path).resolve()
+    ok, message = stop_daemon(project_root)
+    print(message)
+    return 0 if ok else 1
+
+
+def cmd_daemon_status(args: argparse.Namespace) -> int:
+    from devtorch_core.daemon import daemon_status
+
+    project_root = Path(args.path).resolve()
+    status = daemon_status(project_root)
+    if status.get("error"):
+        print(f"error: {status['error']}", file=sys.stderr)
+        return 1
+    if status["running"]:
+        print(f"DevTorch daemon running (PID {status['pid']})")
+    else:
+        print("DevTorch daemon stopped")
+    print(f"Log: {status['log_path']}")
+    return 0
+
+
+def cmd_daemon_logs(args: argparse.Namespace) -> int:
+    from devtorch_core.daemon import daemon_logs
+
+    project_root = Path(args.path).resolve()
+    lines = daemon_logs(project_root, lines=getattr(args, "lines", 50))
+    if not lines:
+        print("(no daemon log entries)")
+        return 0
+    for line in lines:
+        print(line)
+    return 0
+
+
+# Sprint 9: event log signing
+
+def cmd_signing_enable(args: argparse.Namespace) -> int:
+    from devtorch_core.signing import enable_signing
+    gcc_dir = Path(args.path).resolve() / ".GCC"
+    if not gcc_dir.exists():
+        print(f"error: {gcc_dir} not found. Run `devtorch init` first.", file=sys.stderr)
+        return 1
+    enable_signing(gcc_dir)
+    print(f"Event log signing enabled for {gcc_dir}.")
+    print("  Key: .GCC/signing.key")
+    print("  Config: .GCC/signing.json")
+    print("  New events will carry HMAC-SHA256 signatures.")
+    return 0
+
+
+def cmd_signing_disable(args: argparse.Namespace) -> int:
+    from devtorch_core.signing import disable_signing
+    gcc_dir = Path(args.path).resolve() / ".GCC"
+    if not gcc_dir.exists():
+        print(f"error: {gcc_dir} not found. Run `devtorch init` first.", file=sys.stderr)
+        return 1
+    disable_signing(gcc_dir)
+    print(f"Event log signing disabled for {gcc_dir}. Existing signatures remain intact.")
+    return 0
+
+
+def cmd_signing_verify(args: argparse.Namespace) -> int:
+    from devtorch_core.signing import verify_log
+    gcc_dir = Path(args.path).resolve() / ".GCC"
+    if not gcc_dir.exists():
+        print(f"error: {gcc_dir} not found. Run `devtorch init` first.", file=sys.stderr)
+        return 1
+    failures = verify_log(gcc_dir)
+    if not failures:
+        print("Event log signature verification: OK")
+        return 0
+    print(f"Event log signature verification: {len(failures)} failure(s)")
+    for f in failures:
+        print(f"  line {f['line_no']}: {f['reason']}")
+    return 1
+
+
+# Sprint 19: project registry
+
+def cmd_projects_add(args: argparse.Namespace) -> int:
+    from devtorch_core.projects import ProjectRegistry
+    try:
+        registry = ProjectRegistry()
+        entry = registry.add(Path(args.path), name=args.name, developer_id=args.developer_id)
+    except ValueError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print(f"Added project `{entry.name}` at {entry.path}")
+    print(f"  developer_id: {entry.developer_id}")
+
+    if getattr(args, "configure_mcp", False):
+        from devtorch_core.hooks.installer import install_all_hooks, install_cursor_mcp
+        hooks_result = install_all_hooks(str(entry.path))
+        if hooks_result.claude_hooks_written:
+            print("  MCP: .claude/hooks.json written")
+        cursor_ok, cursor_msg = install_cursor_mcp(str(entry.path))
+        if cursor_ok:
+            print("  MCP: .cursor/mcp.json written")
+        else:
+            print(f"  MCP: .cursor/mcp.json skipped ({cursor_msg})")
+    return 0
+
+
+def cmd_projects_list(args: argparse.Namespace) -> int:
+    from devtorch_core.projects import ProjectRegistry
+    registry = ProjectRegistry()
+    entries = registry.list()
+    if not entries:
+        print("No projects registered. Run `devtorch projects add <path>`.")
+        return 0
+    print(f"{'Name':<20} {'Path':<40} {'Developer':<25} {'Last Synced'}")
+    print("-" * 100)
+    for e in entries:
+        print(f"{e.name:<20} {e.path:<40} {e.developer_id:<25} {e.last_synced[:19]}")
+    return 0
+
+
+def cmd_projects_remove(args: argparse.Namespace) -> int:
+    from devtorch_core.projects import ProjectRegistry
+    registry = ProjectRegistry()
+    removed = registry.remove(Path(args.path))
+    if removed:
+        print(f"Removed project at {args.path}")
+        return 0
+    print(f"No project registered at {args.path}", file=sys.stderr)
+    return 1
+
+
+def cmd_projects_sync(args: argparse.Namespace) -> int:
+    from devtorch_core.projects import ProjectRegistry
+    registry = ProjectRegistry()
+    entries = registry.sync()
+    print(f"Synced {len(entries)} project(s).")
+    return 0
+
+
+# Sprint 6: debug views
+
+def cmd_debug_timeline(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    filter_types = None
+    if getattr(args, "filter", None):
+        filter_types = [t.strip() for t in args.filter.split(",") if t.strip()]
+    events = repo.debug_timeline(filter_types=filter_types)
+    for e in events:
+        ts = e.get("timestamp", "")
+        et = e.get("event_type", "")
+        payload = e.get("payload", {})
+        print(f"{ts}  {et}  {payload}")
+    return 0
+
+
+def cmd_debug_branch_compare(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    b1 = args.branch1
+    b2 = args.branch2
+    try:
+        data = repo.debug_branch_compare(b1, b2)
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    print(f"Branch: {b1}")
+    for c in data["branch1"]:
+        print(f"  {c.get('id')}  {c.get('timestamp')}  {c.get('message')}")
+    print(f"\nBranch: {b2}")
+    for c in data["branch2"]:
+        print(f"  {c.get('id')}  {c.get('timestamp')}  {c.get('message')}")
+    print("\nΘ (coordination vector):")
+    for k, v in (data.get("theta") or {}).items():
+        print(f"  {k}: {v}")
+    return 0
+
+
+def cmd_debug_invariant_trace(args: argparse.Namespace) -> int:
+    repo = GCCRepository.at(Path(args.path).resolve())
+    try:
+        traces = repo.debug_invariant_trace()
+    except RuntimeError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    if not traces:
+        print("No invariant failures (trace clear).")
+        return 0
+    print("Invariant trace (failures):")
+    for t in traces:
+        print(f"  [{t['invariant_id']}] {t['message']}")
+        print(f"    Fix: {t['actionable_fix']}")
+    return 1
+
+
+_CLAUDE_MD_BLOCK = """
+## DevTorch — Reasoning Capture
+
+This project uses DevTorch for AI governance. Follow these rules on every task:
+
+1. **Before writing code**: call `devtorch_commit` (MCP tool) with your reasoning.
+   Include what you decided and why, not just what you did.
+
+2. **When touching sensitive areas** (auth, payments, database schema, secrets,
+   PII, external APIs): call `devtorch_sensitivity_add` with the concept name,
+   your confidence (0–1), and disclosure level (PUBLIC / PROTECTED / PRIVATE).
+
+3. **At the start of a new task**: call `devtorch_context` to retrieve prior
+   decisions before making new ones.
+"""
+
+def cmd_setup(args: argparse.Namespace) -> int:
+    """
+    One-command setup: init + hooks + MCP server config + optional CLAUDE.md.
+    Idempotent — safe to run on an already-configured project.
+    """
+    import shutil
+
+    project_root = Path(args.path).resolve()
+    ok_mark = "✓"
+    skip_mark = "–"
+    fail_mark = "✗"
+
+    print("DevTorch setup\n")
+
+    # ------------------------------------------------------------------ #
+    # Detect IDE(s) and project type
+    # ------------------------------------------------------------------ #
+    from devtorch_core.hooks.installer import (
+        _detect_ides,
+        _detect_project_type,
+    )
+
+    detected_ides = _detect_ides(str(project_root))
+    project_type = _detect_project_type(str(project_root))
+    print(f"Detected project type: {project_type}")
+    print(f"Detected IDE(s): {', '.join(detected_ides) if detected_ides else 'none'}")
+    print()
+
+    # ------------------------------------------------------------------ #
+    # Step 1: devtorch init
+    # ------------------------------------------------------------------ #
+    repo = GCCRepository.at(project_root)
+    if repo.is_initialized():
+        print(f"  {skip_mark}  .GCC/  already initialized — skipping")
+    else:
+        try:
+            repo.init()
+            print(f"  {ok_mark}  .GCC/  initialized at {repo.gcc_dir}")
+        except Exception as exc:
+            print(f"  {fail_mark}  .GCC/  init failed: {exc}", file=sys.stderr)
+            return 1
+
+    # ------------------------------------------------------------------ #
+    # Step 2: Claude Code hooks (hooks key in .claude/settings.json)
+    # ------------------------------------------------------------------ #
+    from devtorch_core.hooks.installer import install_all_hooks, get_hooks_status
+
+    hooks_status = get_hooks_status(str(project_root))
+    if hooks_status["claude_hooks"]:
+        print(f"  {skip_mark}  .claude/settings.json  hooks already installed — skipping")
+    else:
+        result = install_all_hooks(str(project_root))
+        if result.claude_hooks_written:
+            print(f"  {ok_mark}  .claude/settings.json  hooks installed")
+        else:
+            err = result.errors[0] if result.errors else "unknown error"
+            print(f"  {fail_mark}  .claude/settings.json  hooks failed: {err}")
+
+    if hooks_status["git_hook"]:
+        print(f"  {skip_mark}  .git/hooks/commit-msg  already installed — skipping")
+    elif not hooks_status["claude_hooks"]:
+        # result was assigned in the else-branch above
+        if result.git_hook_written:
+            print(f"  {ok_mark}  .git/hooks/commit-msg  written")
+        else:
+            print(f"  {skip_mark}  .git/hooks/commit-msg  no .git repo found (skipped)")
+    else:
+        print(f"  {skip_mark}  .git/hooks/commit-msg  no .git repo found (skipped)")
+
+    # ------------------------------------------------------------------ #
+    # Step 3: Claude Code MCP server (<project-root>/.mcp.json)
+    # ------------------------------------------------------------------ #
+    # Claude Code only reads project-scope MCP servers from .mcp.json at the
+    # project root; a mcpServers key in .claude/settings.json is ignored.
+    from devtorch_core.hooks.installer import install_claude_mcp
+
+    mcp_path = project_root / ".mcp.json"
+    try:
+        pre_existing = json.loads(mcp_path.read_text(encoding="utf-8")).get("mcpServers", {}) \
+            if mcp_path.exists() else {}
+    except Exception:
+        pre_existing = {}
+
+    ok, path_or_err = install_claude_mcp(str(project_root))
+    if not ok:
+        print(f"  {fail_mark}  .mcp.json  failed: {path_or_err}", file=sys.stderr)
+    elif "devtorch" in pre_existing:
+        print(f"  {skip_mark}  .mcp.json  MCP entry already present — skipping")
+    else:
+        print(f"  {ok_mark}  .mcp.json  MCP server entry added")
+
+    # ------------------------------------------------------------------ #
+    # Step 4: CLAUDE.md DevTorch instructions
+    # ------------------------------------------------------------------ #
+    if not getattr(args, "skip_claude_md", False):
+        claude_md_path = project_root / "CLAUDE.md"
+        marker = "## DevTorch"
+        if claude_md_path.exists() and marker in claude_md_path.read_text(encoding="utf-8"):
+            print(f"  {skip_mark}  CLAUDE.md  DevTorch section already present — skipping")
+        else:
+            try:
+                with claude_md_path.open("a", encoding="utf-8") as f:
+                    f.write(_CLAUDE_MD_BLOCK)
+                action = "appended to" if claude_md_path.stat().st_size > len(_CLAUDE_MD_BLOCK) else "created"
+                print(f"  {ok_mark}  CLAUDE.md  DevTorch instructions {action}")
+            except Exception as exc:
+                print(f"  {fail_mark}  CLAUDE.md  failed: {exc}", file=sys.stderr)
+
+    # ------------------------------------------------------------------ #
+    # Step 5: AGENTS.md DevTorch instructions (Google Antigravity)
+    # ------------------------------------------------------------------ #
+    if not getattr(args, "skip_agents_md", False):
+        from devtorch_core.hooks.installer import install_agents_md
+        agents_md_path = project_root / "AGENTS.md"
+        marker = "## DevTorch"
+        if agents_md_path.exists() and marker in agents_md_path.read_text(encoding="utf-8"):
+            print(f"  {skip_mark}  AGENTS.md  DevTorch section already present — skipping")
+        else:
+            ok, path_or_err = install_agents_md(str(project_root))
+            if ok:
+                action = "appended to" if agents_md_path.exists() and agents_md_path.stat().st_size > len(
+                    "\n## DevTorch"
+                ) else "created"
+                print(f"  {ok_mark}  AGENTS.md  DevTorch instructions {action}")
+            else:
+                print(f"  {fail_mark}  AGENTS.md  failed: {path_or_err}", file=sys.stderr)
+
+    # ------------------------------------------------------------------ #
+    # Step 6/7: IDE-specific MCP config
+    # ------------------------------------------------------------------ #
+    target = getattr(args, "target", None)
+    if target is None or target == "auto":
+        targets = detected_ides if detected_ides else ["claude-code"]
+    else:
+        targets = [target]
+
+    from devtorch_core.hooks.installer import (
+        install_cursor_mcp,
+        install_antigravity_mcp,
+    )
+
+    for target in targets:
+        if target == "cursor":
+            cursor_mcp = project_root / ".cursor" / "mcp.json"
+            already = (
+                cursor_mcp.exists()
+                and "devtorch" in json.loads(cursor_mcp.read_text()).get("mcpServers", {})
+            )
+            if already:
+                print(f"  {skip_mark}  .cursor/mcp.json  MCP entry already present — skipping")
+            else:
+                ok, path_or_err = install_cursor_mcp(str(project_root))
+                if ok:
+                    print(f"  {ok_mark}  .cursor/mcp.json  MCP server entry added")
+                else:
+                    print(f"  {fail_mark}  .cursor/mcp.json  failed: {path_or_err}", file=sys.stderr)
+            print()
+            print("  Next: install the VS Code extension in Cursor:")
+            print("    Extensions: Install from VSIX... →")
+            print("    extensions/vscode/devtorch-0.1.0.vsix")
+
+        elif target == "antigravity":
+            ag_mcp = project_root / "mcp_config.json"
+            already = (
+                ag_mcp.exists()
+                and "devtorch" in json.loads(ag_mcp.read_text()).get("mcpServers", {})
+            )
+            if already:
+                print(f"  {skip_mark}  mcp_config.json  MCP entry already present — skipping")
+            else:
+                ok, path_or_err = install_antigravity_mcp(str(project_root))
+                if ok:
+                    print(f"  {ok_mark}  mcp_config.json  MCP server entry added")
+                else:
+                    print(f"  {fail_mark}  mcp_config.json  failed: {path_or_err}", file=sys.stderr)
+
+    # ------------------------------------------------------------------ #
+    # Step 5.5: OpenCode hooks (PreUserPrompt for context bundle)
+    # ------------------------------------------------------------------ #
+    if "opencode" in detected_ides:
+        from devtorch_core.hooks.installer import install_opencode_hooks
+
+        ok, path_or_err = install_opencode_hooks(str(project_root))
+        if ok:
+            print(f"  {ok_mark}  opencode.json  hooks installed")
+        else:
+            print(f"  {fail_mark}  opencode.json  hooks failed: {path_or_err}", file=sys.stderr)
+
+    # ------------------------------------------------------------------ #
+    # Done
+    # ------------------------------------------------------------------ #
+    print()
+    print("Setup complete. Start Claude Code and run: devtorch status")
+    if not shutil.which("devtorch"):
+        print()
+        print("  NOTE: 'devtorch' not found in PATH.")
+        print("  Activate your venv first: source .venv/bin/activate")
+    return 0
+
+
+def cmd_calibrate(args: argparse.Namespace) -> int:
+    from devtorch_core.metrics.calibrate import CalibrationStore, run_calibrate_wizard
+
+    gcc_dir = Path(args.path).resolve() / ".GCC"
+
+    if getattr(args, "set_value", None):
+        # Parse KEY=VALUE
+        raw = args.set_value.strip()
+        if "=" not in raw:
+            print(f"error: --set expects KEY=VALUE, got: {raw!r}", file=sys.stderr)
+            return 1
+        key, _, value_str = raw.partition("=")
+        key = key.strip()
+        value_str = value_str.strip()
+        # Try numeric coercion
+        try:
+            value: object = float(value_str)
+        except ValueError:
+            value = value_str
+        try:
+            store = CalibrationStore(gcc_dir)
+            store.set_value(key, value)
+            print(f"Calibration set: {key} = {value}")
+        except Exception as exc:
+            print(f"error: {exc}", file=sys.stderr)
+            return 1
+        return 0
+
+    # Interactive wizard
+    try:
+        result = run_calibrate_wizard(gcc_dir)
+        print("Calibration saved:")
+        for k, v in sorted(result.items()):
+            print(f"  {k}: {v}")
+    except Exception as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+    return 0
+
+
+def cmd_metrics(args: argparse.Namespace) -> int:
+    import glob as _glob
+
+    from devtorch_core.metrics.calibrate import CalibrationStore
+    from devtorch_core.metrics.delivery_time import compute_delivery_time_summary
+    from devtorch_core.metrics.shadow_ai import detect_shadow_ai
+    from devtorch_core.metrics.dhs import compute_dhs, DHSComponents, dhs_to_label
+
+    repo_root = Path(args.path).resolve()
+    gcc_dir = repo_root / ".GCC"
+
+    # Parse period
+    period_str = getattr(args, "period", "30d")
+    try:
+        period_days = int(period_str.rstrip("d"))
+    except (ValueError, AttributeError):
+        period_days = 30
+
+    # Load calibration
+    try:
+        store = CalibrationStore(gcc_dir)
+        calibration = store.load()
+    except Exception:
+        calibration = {}
+
+    # Sprint 20: token/speedup breakdowns
+    from devtorch_core.metrics.aggregate import (
+        aggregate_tokens,
+        aggregate_speedup,
+        aggregate_by_developer,
+    )
+
+    if getattr(args, "tokens", False):
+        if getattr(args, "all_projects", False):
+            from devtorch_core.metrics.aggregate import aggregate_all_projects
+            all_projects = aggregate_all_projects()
+            if getattr(args, "as_json", False):
+                print(json.dumps(all_projects, indent=2))
+                return 0
+            print("DevTorch Token Metrics — All Projects\n")
+            print(f"  {'Project':<20} {'Sessions':>10} {'Used':>12} {'Saved':>12}")
+            print("  " + "-" * 60)
+            for p in all_projects["projects"]:
+                print(f"  {p['name']:<20} {p['sessions_count']:>10} {p['tokens_used']:>12,} {p['tokens_saved']:>12,}")
+            agg = all_projects["aggregate"]
+            print("  " + "-" * 60)
+            print(f"  {'AGGREGATE':<20} {agg['sessions_count']:>10} {agg['tokens_used']:>12,} {agg['tokens_saved']:>12,}")
+            return 0
+
+        agg = aggregate_tokens(gcc_dir)
+        by_dev = aggregate_by_developer(gcc_dir)
+        token_cost = calibration.get("token_cost_usd_per_million")
+        if token_cost:
+            cost_saved_usd = (agg['total_tokens_saved'] / 1_000_000) * float(token_cost)
+        else:
+            cost_saved_usd = None
+        if getattr(args, "as_json", False):
+            output = {
+                "project": agg,
+                "per_developer": by_dev,
+                "cost_saved_usd": cost_saved_usd,
+                "cost_calibrated": bool(token_cost),
+            }
+            print(json.dumps(output, indent=2))
+            return 0
+        print("DevTorch Token Metrics\n")
+        print(f"  Sessions:           {agg['sessions_count']}")
+        print(f"  Tokens used:        {agg['total_tokens_used']:,}  [MEASURED]")
+        print(f"  Tokens saved:       {agg['total_tokens_saved']:,}  [CALIBRATED]")
+        print(f"  Bundle tokens:      {agg['total_bundle_tokens']:,}  [MEASURED]")
+        print(f"  Full history tokens: {agg['total_full_history_tokens']:,}  [MEASURED]")
+        if cost_saved_usd is not None:
+            print(f"  Cost saved (USD):   ${cost_saved_usd:,.2f}  [CALIBRATED]")
+        else:
+            print("  Cost saved (USD):   Set token_cost_usd_per_million to unlock  [UNAVAILABLE]")
+        if by_dev:
+            print("\n  Per developer:")
+            for dev_id, dev in sorted(by_dev.items()):
+                print(f"    {dev_id}: used={dev['tokens_used']:,} saved={dev['tokens_saved']:,} sessions={dev['sessions_count']}")
+        return 0
+
+    if getattr(args, "speedup", False):
+        if getattr(args, "all_projects", False):
+            from devtorch_core.metrics.aggregate import aggregate_all_projects
+            all_projects = aggregate_all_projects()
+            if getattr(args, "as_json", False):
+                print(json.dumps(all_projects, indent=2))
+                return 0
+            print("DevTorch Speedup Metrics — All Projects\n")
+            print(f"  {'Project':<20} {'Sessions':>10} {'Speedup':>10}")
+            print("  " + "-" * 45)
+            for p in all_projects["projects"]:
+                print(f"  {p['name']:<20} {p['sessions_count']:>10} {p['latency_speedup_factor']:>9.2f}x")
+            agg = all_projects["aggregate"]
+            print("  " + "-" * 45)
+            print(f"  {'AGGREGATE':<20} {agg['sessions_count']:>10} {agg['latency_speedup_factor']:>9.2f}x")
+            return 0
+
+        agg = aggregate_speedup(gcc_dir)
+        by_dev = aggregate_by_developer(gcc_dir)
+        if getattr(args, "as_json", False):
+            print(json.dumps({"project": agg, "per_developer": by_dev}, indent=2))
+            return 0
+        print("DevTorch Speedup Metrics\n")
+        print(f"  Sessions:                 {agg['sessions_count']}")
+        print(f"  Latency speedup factor:   {agg['latency_speedup_factor']:.2f}x  [MEASURED]")
+        print(f"  Full history tokens:      {agg['total_full_history_tokens']:,}")
+        print(f"  Bundle tokens:            {agg['total_bundle_tokens']:,}")
+        if by_dev:
+            print("\n  Per developer:")
+            for dev_id, dev in sorted(by_dev.items()):
+                print(f"    {dev_id}: speedup={dev['latency_speedup_factor']:.2f}x sessions={dev['sessions_count']}")
+        return 0
+
+    # Read session metrics
+    session_dir = gcc_dir / "metrics" / "session"
+    session_files: list[dict] = []
+    if session_dir.exists():
+        for p in session_dir.glob("*.json"):
+            try:
+                data = json.loads(p.read_text(encoding="utf-8"))
+                if isinstance(data, dict):
+                    session_files.append(data)
+            except Exception:
+                pass
+
+    # Read sprint metrics
+    sprint_dir = gcc_dir / "metrics" / "sprint"
+    sprint_files: list[dict] = []
+    if sprint_dir.exists():
+        for p in sprint_dir.glob("*.json"):
+            try:
+                data = json.loads(p.read_text(encoding="utf-8"))
+                if isinstance(data, dict):
+                    sprint_files.append(data)
+            except Exception:
+                pass
+
+    # Shadow AI detection
+    try:
+        shadow = detect_shadow_ai(repo_root)
+    except Exception:
+        shadow = {"git_commits": 0, "gcc_commits": 0, "unregistered": 0, "shadow_ratio": 0.0, "flagged": False}
+
+    # DHS computation (best-effort from available data)
+    try:
+        components = DHSComponents(
+            commit_health=1.0 if (shadow.get("gcc_commits", 0) > 0) else 0.0,
+            sensitivity_health=1.0,
+            capability_health=0.0,
+            variance_health=1.0,
+        )
+        dhs_score = compute_dhs(components)
+        dhs_label = dhs_to_label(dhs_score)
+    except Exception:
+        dhs_score = 0.0
+        dhs_label = "UNAVAILABLE"
+
+    # Sprint 25: complex-problem delivery-time baseline
+    metrics_dir = gcc_dir / "metrics"
+    show_delivery_time = (
+        getattr(args, "delivery_time", False)
+        or "complex_problem_delivery_time_baseline_min" in calibration
+    )
+    delivery_summary = None
+    if show_delivery_time:
+        delivery_summary = compute_delivery_time_summary(metrics_dir, calibration)
+
+    # Aggregate session data
+    total_tokens_used = sum(s.get("tokens_used", 0) for s in session_files)
+    total_tokens_saved = sum(s.get("tokens_saved", 0) for s in session_files)
+    avg_coverage = (
+        sum(s.get("coverage", 0.0) for s in session_files) / len(session_files)
+        if session_files else 0.0
+    )
+    # Aggregate confidence distribution
+    conf_dist: dict[str, int] = {}
+    for s in session_files:
+        for tier, cnt in (s.get("confidence_distribution") or {}).items():
+            conf_dist[tier] = conf_dist.get(tier, 0) + int(cnt)
+
+    # Aggregate sprint data
+    avg_mcs = (
+        sum(sp.get("mcs_score", 0.0) for sp in sprint_files) / len(sprint_files)
+        if sprint_files else 0.0
+    )
+    total_i3_violations = sum(sp.get("i3_violations", 0) for sp in sprint_files)
+    total_collisions_prevented = sum(sp.get("collisions_prevented", 0) for sp in sprint_files)
+
+    # Auditability: fraction of git commits that are GCC-registered
+    git_commits = shadow.get("git_commits", 0)
+    gcc_commits = shadow.get("gcc_commits", 0)
+    auditability = gcc_commits / git_commits if git_commits > 0 else 1.0
+
+    disclosure = (
+        "\nNOTE: MCS/DHS weights are DevTorch design choices pending empirical calibration."
+    )
+
+    if getattr(args, "as_json", False):
+        output = {
+            "period_days": period_days,
+            "calibration": calibration,
+            "developer": {
+                "tokens_used": {"value": total_tokens_used, "tier": "MEASURED"},
+                "tokens_saved": {"value": total_tokens_saved, "tier": "CALIBRATED"},
+                "coverage_pct": {"value": round(avg_coverage * 100, 1), "tier": "MEASURED"},
+                "confidence_distribution": {"value": conf_dist, "tier": "MEASURED"},
+            },
+            "tech_lead": {
+                "mcs_trend": {"value": round(avg_mcs, 4), "tier": "CALIBRATED"},
+                "i3_violations": {"value": total_i3_violations, "tier": "MEASURED"},
+                "collisions_prevented": {"value": total_collisions_prevented, "tier": "CALIBRATED"},
+            },
+            "ciso": {
+                "dhs_score": {"value": round(dhs_score, 4), "label": dhs_label, "tier": "CALIBRATED"},
+                "shadow_ai_ratio": {"value": round(shadow.get("shadow_ratio", 0.0), 4), "flagged": shadow.get("flagged", False), "tier": "MEASURED"},
+                "auditability_pct": {"value": round(auditability * 100, 1), "tier": "MEASURED"},
+            },
+            "shadow_ai": shadow,
+            "disclosure": disclosure.strip(),
+        }
+        if delivery_summary:
+            output["tech_lead"]["complex_problem_delivery_time"] = {
+                "current_min": delivery_summary["complex_problem_delivery_time_current_min"],
+                "baseline_min": delivery_summary["complex_problem_delivery_time_baseline_min"],
+                "delta_vs_baseline_min": delivery_summary["delta_vs_baseline_min"],
+                "tier": delivery_summary["tier"],
+            }
+        print(json.dumps(output, indent=2))
+        return 0
+
+    # Formatted output
+    print(f"DevTorch Metrics Summary  (period: {period_days}d)\n")
+    print("=== Developer ===")
+    print(f"  Tokens used:   {total_tokens_used:,}  [MEASURED]")
+    print(f"  Tokens saved:  {total_tokens_saved:,}  [CALIBRATED]")
+    print(f"  Coverage:      {avg_coverage * 100:.1f}%  [MEASURED]")
+    if conf_dist:
+        conf_str = "  ".join(f"{t}:{c}" for t, c in sorted(conf_dist.items()))
+        print(f"  Confidence:    {conf_str}  [MEASURED]")
+    else:
+        print("  Confidence:    (no session data)  [UNAVAILABLE]")
+
+    print("\n=== Tech Lead ===")
+    print(f"  MCS trend:             {avg_mcs:.4f}  [CALIBRATED]")
+    print(f"  I3 violations:         {total_i3_violations}  [MEASURED]")
+    print(f"  Collisions prevented:  {total_collisions_prevented}  [CALIBRATED]")
+    if delivery_summary:
+        current = delivery_summary["complex_problem_delivery_time_current_min"]
+        baseline = delivery_summary["complex_problem_delivery_time_baseline_min"]
+        delta = delivery_summary["delta_vs_baseline_min"]
+        print(
+            f"  Complex problem delivery time: {current:.1f} min "
+            f"(baseline {baseline:.1f}, delta {delta:+.1f})  {delivery_summary['tier']}"
+        )
+
+    print("\n=== CISO ===")
+    print(f"  DHS score:        {dhs_score:.4f} ({dhs_label})  [CALIBRATED]")
+    shadow_ratio = shadow.get("shadow_ratio", 0.0)
+    flagged_str = " *** FLAGGED ***" if shadow.get("flagged") else ""
+    print(f"  Shadow AI ratio:  {shadow_ratio:.4f}{flagged_str}  [MEASURED]")
+    print(f"  Auditability:     {auditability * 100:.1f}%  [MEASURED]")
+
+    print(disclosure)
+    return 0
+
+
+def build_parser() -> argparse.ArgumentParser:
+    epilog = (
+        "Common commands:\n"
+        "  devtorch init                 start tracking this project\n"
+        "  devtorch status               show the current repository state\n"
+        "  devtorch doctor               run health checks\n"
+        "  devtorch today                daily status dashboard\n"
+        "  devtorch log --tail 20        recent commit history\n"
+        "  devtorch metrics --period 1d  recent activity metrics\n"
+        "  devtorch topics list          list topics with captured reasoning\n"
+        "  devtorch concept list-all     list all concepts from all sources\n"
+        "  devtorch concept learned      list concepts from learning interactions\n"
+        "  devtorch reasoning history --topic <topic>  reasoning history by topic\n"
+        "  devtorch sync all [--interval N]  bidirectional sync with MCP server\n"
+        "\n"
+        "Run 'devtorch <command> --help' for more information on a command."
+    )
+    parser = argparse.ArgumentParser(
+        prog="devtorch",
+        description="DevTorch — governance for AI-assisted codebases.",
+        epilog=epilog,
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    parser.add_argument(
+        "-C",
+        "--path",
+        default=".",
+        help="Path to the repository root (default: current directory).",
+    )
+
+    subparsers = parser.add_subparsers(dest="command", required=False)
+
+    # One-command setup: init + hooks + MCP + CLAUDE.md
+    p_setup = subparsers.add_parser(
+        "setup",
+        help="One-command setup: init + MCP server config + IDE-specific wiring.",
+    )
+    p_setup.add_argument(
+        "--target",
+        choices=["claude-code", "cursor", "antigravity", "auto"],
+        default=None,
+        help="IDE to configure (default: auto-detect).",
+    )
+    p_setup.add_argument(
+        "--skip-claude-md",
+        dest="skip_claude_md",
+        action="store_true",
+        help="Skip writing the DevTorch section to CLAUDE.md.",
+    )
+    p_setup.add_argument(
+        "--skip-agents-md",
+        dest="skip_agents_md",
+        action="store_true",
+        help="Skip writing the DevTorch section to AGENTS.md (Google Antigravity).",
+    )
+    p_setup.set_defaults(func=cmd_setup)
+
+    p_init = subparsers.add_parser("init", help="Initialize the .GCC layout.")
+    p_init.add_argument(
+        "--template",
+        choices=["python", "typescript", "react", "go", "infra"],
+        default=None,
+        help="Apply a project template with default concepts and governance policy.",
+    )
+    p_init.set_defaults(func=cmd_init)
+
+    p_serve = subparsers.add_parser(
+        "serve",
+        help="Start the unified local dev server (proxy + dashboard + broadcast + MCP).",
+    )
+    p_serve.add_argument(
+        "--host", default="127.0.0.1", help="Host interface to bind (default: 127.0.0.1)."
+    )
+    p_serve.add_argument(
+        "--port", type=int, default=8765, help="Port to bind (default: 8765)."
+    )
+    p_serve.add_argument(
+        "--gcc-path", default=None, help="Path to project root containing .GCC (default: auto-detect)."
+    )
+    p_serve.set_defaults(func=_cmd_serve)
+
+    p_welcome = subparsers.add_parser(
+        "welcome", help="Show a quick getting-started guide."
+    )
+    p_welcome.set_defaults(func=cmd_welcome)
+
+    p_ask = subparsers.add_parser(
+        "ask", help="Hybrid grep + semantic search over .GCC/ and project files (S27)."
+    )
+    p_ask.add_argument("query", help="Search query.")
+    p_ask.add_argument(
+        "--top-n", type=int, default=5, dest="top_n",
+        help="Maximum number of results to show (default: 5)."
+    )
+    p_ask.add_argument(
+        "--semantic", action="store_true", dest="semantic",
+        help="Force semantic search (falls back to keyword search if sentence-transformers is unavailable)."
+    )
+    p_ask.add_argument(
+        "--no-semantic", action="store_true", dest="no_semantic",
+        help="Force grep-only search."
+    )
+    p_ask.set_defaults(func=cmd_ask)
+
+    p_today = subparsers.add_parser(
+        "today", help="Daily status dashboard (status + doctor + log + metrics)."
+    )
+    p_today.add_argument(
+        "--tail", type=int, default=20, help="Recent log lines to show (default: 20)."
+    )
+    p_today.set_defaults(func=cmd_today)
+
+    p_commit = subparsers.add_parser("commit", help="Record a reasoning commit (Sprint 0 happy path).")
+    p_commit.add_argument("-m", "--message", help="Commit message.", default="")
+    p_commit.add_argument(
+        "--concepts",
+        help="Comma-separated concept tags (e.g. auth,security). Phase 5: developer-agent handoff.",
+        default="",
+    )
+    p_commit.set_defaults(func=cmd_commit)
+
+    # Phase 5: reasoning chain
+    p_chain = subparsers.add_parser(
+        "chain", help="Show the full reasoning chain: human commit -> agent session -> calls -> learnings -> outcomes (Phase 5)."
+    )
+    p_chain.add_argument(
+        "--concept",
+        default=None,
+        help="Filter chains by concept name (matches commit concepts and message).",
+    )
+    p_chain.add_argument(
+        "--max", type=int, default=5, dest="max_chains",
+        help="Maximum number of chains to show (default: 5).",
+    )
+    p_chain.set_defaults(func=cmd_chain)
+
+    p_doctor = subparsers.add_parser("doctor", help="Validate .GCC layout and event log integrity.")
+    p_doctor.add_argument(
+        "--ci",
+        action="store_true",
+        help="CI mode: enforce --min-dhs-score and --critical-concepts thresholds.",
+    )
+    p_doctor.add_argument(
+        "--min-dhs-score",
+        type=float,
+        default=0.0,
+        help="Minimum Deployment Health Score (0-1) for CI mode to pass.",
+    )
+    p_doctor.add_argument(
+        "--critical-concepts",
+        type=str,
+        default="",
+        help="Comma-separated list of concepts that must exist in Θ for CI mode to pass.",
+    )
+    p_doctor.set_defaults(func=cmd_doctor)
+
+    p_branch = subparsers.add_parser("branch", help="Create a new branch.")
+    p_branch.add_argument("name", help="New branch name.")
+    p_branch.add_argument("--from-ref", help="Commit ID to start from (default: current tip).", default=None)
+    p_branch.set_defaults(func=cmd_branch)
+
+    p_history = subparsers.add_parser("history", help="Show commit history.")
+    p_history.add_argument("--branch", help="Branch name (default: current branch).", default=None)
+    p_history.set_defaults(func=cmd_history)
+
+    p_merge = subparsers.add_parser("merge", help="Fast-forward merge source into target branch.")
+    p_merge.add_argument("source", help="Source branch name.")
+    p_merge.add_argument(
+        "--target",
+        help="Target branch name (default: current branch).",
+        default=None,
+    )
+    p_merge.set_defaults(func=cmd_merge)
+
+    p_context = subparsers.add_parser("context", help="Build a MECW-aware context bundle.")
+    p_context.add_argument(
+        "-k",
+        type=int,
+        required=True,
+        help="Approximate token budget for the bundle.",
+    )
+    p_context.add_argument(
+        "--branch",
+        help="Branch name to build context from (default: current branch).",
+        default=None,
+    )
+    p_context.add_argument(
+        "--policy",
+        help="Optional sensitivity policy name (e.g. 'default', 'no-private'); "
+             "recorded in the bundle for future enforcement.",
+        default="default",
+    )
+    p_context.add_argument(
+        "--explain",
+        action="store_true",
+        help="Include bundle file path in the output for debugging.",
+    )
+    p_context.set_defaults(func=cmd_context)
+
+    # Sprint 3: sensitivity subcommands
+    p_sens = subparsers.add_parser("sensitivity", help="Manage sensitivity events.")
+    sens_sub = p_sens.add_subparsers(dest="sens_command", required=True)
+
+    p_sens_add = sens_sub.add_parser("add", help="Record a sensitivity event.")
+    p_sens_add.add_argument("--source", required=True, help="Source node identifier.")
+    p_sens_add.add_argument("--concept", required=True, help="Target concept name.")
+    p_sens_add.add_argument("--confidence", type=float, required=True, help="Confidence [0, 1].")
+    p_sens_add.add_argument(
+        "--disclosure",
+        default="PUBLIC",
+        choices=["PUBLIC", "PROTECTED", "PRIVATE"],
+        help="Disclosure level (default: PUBLIC).",
+    )
+    p_sens_add.add_argument("--counterfactuals", default="", help="Counterfactual description.")
+    p_sens_add.add_argument("--numerical", type=float, default=None, help="Optional numerical sensitivity value.")
+    p_sens_add.add_argument("--uncertainty", type=float, default=None, help="Optional ±uncertainty for numerical value.")
+    p_sens_add.add_argument("-m", "--message", default="", help="Human-readable annotation.")
+    p_sens_add.set_defaults(func=cmd_sensitivity_add)
+
+    p_sens_list = sens_sub.add_parser("list", help="List sensitivity events.")
+    p_sens_list.add_argument("--concept", default=None, help="Filter by concept name.")
+    p_sens_list.add_argument("--disclosure", default=None, choices=["PUBLIC", "PROTECTED", "PRIVATE"],
+                             help="Filter by disclosure level.")
+    p_sens_list.add_argument("--source-node", default=None, dest="source_node",
+                              help="Filter by source node identifier.")
+    p_sens_list.set_defaults(func=cmd_sensitivity_list)
+
+    p_sens_filter = sens_sub.add_parser("filter", help="Filter sensitivities and show Θ vector.")
+    p_sens_filter.add_argument("--concept", default=None, help="Filter by concept name.")
+    p_sens_filter.add_argument("--disclosure", default=None, choices=["PUBLIC", "PROTECTED", "PRIVATE"],
+                               help="Filter by disclosure level.")
+    p_sens_filter.add_argument("--source-node", default=None, dest="source_node",
+                               help="Filter by source node identifier.")
+    p_sens_filter.set_defaults(func=cmd_sensitivity_filter)
+
+    # Sprint 3: capability subcommands
+    p_cap = subparsers.add_parser("capability", help="Manage Ωᵢ capability declarations.")
+    cap_sub = p_cap.add_subparsers(dest="cap_command", required=True)
+
+    p_cap_set = cap_sub.add_parser("set", help="Set the Ωᵢ capability declaration.")
+    p_cap_set.add_argument("--agent-id", required=True, dest="agent_id", help="Agent identifier.")
+    p_cap_set.add_argument("--lipschitz-bound", type=float, required=True, dest="lipschitz_bound",
+                           help="Empirical Lipschitz bound L̂.")
+    p_cap_set.add_argument("--calibration-hash", required=True, dest="calibration_hash",
+                           help="SHA-256 hex digest of calibration dataset.")
+    p_cap_set.add_argument("--embedding-model", required=True, dest="embedding_model",
+                           help="Embedding model name/version.")
+    p_cap_set.add_argument("--calibration-date", required=True, dest="calibration_date",
+                           help="ISO date of calibration run (YYYY-MM-DD).")
+    p_cap_set.add_argument("--temperature", type=float, required=True, dest="temperature",
+                           help="Sampling temperature used during calibration [0, 2].")
+    p_cap_set.add_argument("--lipschitz-p95", type=float, default=None, dest="lipschitz_p95",
+                           help="Optional 95th-percentile Lipschitz estimate.")
+    p_cap_set.add_argument("--expiry-days", type=int, default=90, dest="expiry_days",
+                           help="Days until calibration expires (default: 90).")
+    p_cap_set.set_defaults(func=cmd_capability_set)
+
+    p_cap_show = cap_sub.add_parser("show", help="Display the current Ωᵢ declaration.")
+    p_cap_show.set_defaults(func=cmd_capability_show)
+
+    p_cap_val = cap_sub.add_parser("validate", help="Validate Ωᵢ against A1 gate conditions.")
+    p_cap_val.add_argument("--l-max", type=float, default=L_MAX_DEFAULT, dest="l_max",
+                           help=f"Lipschitz bound threshold L_max (default: {L_MAX_DEFAULT}).")
+    p_cap_val.set_defaults(func=cmd_capability_validate)
+
+    # S28: capability role subcommands
+    p_cap_role = cap_sub.add_parser("role", help="Manage agent roles and role policy (S28).")
+    role_sub = p_cap_role.add_subparsers(dest="role_command", required=True)
+
+    p_role_list = role_sub.add_parser("list", help="List defined agent roles.")
+    p_role_list.set_defaults(func=cmd_capability_role_list)
+
+    p_role_show = role_sub.add_parser("show", help="Show a role definition.")
+    p_role_show.add_argument("role_id", help="Role identifier.")
+    p_role_show.set_defaults(func=cmd_capability_role_show)
+
+    p_role_set = role_sub.add_parser("set", help="Create or update a role.")
+    p_role_set.add_argument("role_id", help="Role identifier.")
+    p_role_set.add_argument("--name", default=None, help="Human-readable role name.")
+    p_role_set.add_argument("--allowed", default="", help="Comma-separated allowed concepts.")
+    p_role_set.add_argument("--disallowed", default="", help="Comma-separated disallowed concepts.")
+    p_role_set.add_argument("--required", default="", help="Comma-required capability fields.")
+    p_role_set.add_argument("--max-temperature", type=float, default=None, dest="max_temperature",
+                            help="Maximum allowed temperature for this role.")
+    p_role_set.set_defaults(func=cmd_capability_role_set)
+
+    p_role_policy = role_sub.add_parser("policy", help="Show the current role policy.")
+    p_role_policy.set_defaults(func=cmd_capability_role_policy)
+
+    p_role_default = role_sub.add_parser("apply-default-policy", help="Apply the built-in default role policy.")
+    p_role_default.set_defaults(func=cmd_capability_role_apply_default_policy)
+
+    # Sprint 4: lock, unlock, invariant, concept, variance
+    p_lock = subparsers.add_parser("lock", help="Acquire consensus lock.")
+    p_lock.add_argument("--reason", default="", help="Reason for locking.")
+    p_lock.add_argument("--peers", type=int, default=None, dest="peers", help="Required peer count (optional).")
+    p_lock.set_defaults(func=cmd_lock)
+
+    p_unlock = subparsers.add_parser("unlock", help="Release consensus lock (I1 checked).")
+    p_unlock.set_defaults(func=cmd_unlock)
+
+    p_inv = subparsers.add_parser("invariant", help="Run invariant checks.")
+    inv_sub = p_inv.add_subparsers(dest="inv_command", required=True)
+    p_inv_check = inv_sub.add_parser("check", help="Run I1/I3 invariant engine.")
+    p_inv_check.add_argument("--operation", default="merge", help="Operation context (default: merge).")
+    p_inv_check.add_argument("--concepts", default="", help="Comma-separated concept names for I3.")
+    p_inv_check.set_defaults(func=cmd_invariant_check)
+
+    # S29: alias `invariants` for the invariant command (plural form used in pre-commit hooks).
+    p_inv_plural = subparsers.add_parser("invariants", help="Alias for `devtorch invariant`.")
+    inv_plural_sub = p_inv_plural.add_subparsers(dest="inv_command", required=True)
+    p_inv_plural_check = inv_plural_sub.add_parser("check", help="Run I1/I3 invariant engine.")
+    p_inv_plural_check.add_argument("--operation", default="merge", help="Operation context (default: merge).")
+    p_inv_plural_check.add_argument("--concepts", default="", help="Comma-separated concept names for I3.")
+    p_inv_plural_check.set_defaults(func=cmd_invariant_check)
+
+    p_concept = subparsers.add_parser("concept", help="Manage concept definitions (I3 semantic grounding).")
+    concept_sub = p_concept.add_subparsers(dest="concept_command", required=True)
+    p_concept_add = concept_sub.add_parser("add", help="Add a concept definition.")
+    p_concept_add.add_argument("name", help="Concept name.")
+    p_concept_add.add_argument("definition", help="Concept definition text.")
+    p_concept_add.set_defaults(func=cmd_concept_add)
+    p_concept_list = concept_sub.add_parser("list", help="List registered concepts.")
+    p_concept_list.set_defaults(func=cmd_concept_list)
+    p_concept_danger = concept_sub.add_parser(
+        "danger", help="Detect concepts with abnormally low learning success rates (Phase 3)."
+    )
+    p_concept_danger.add_argument(
+        "--threshold", type=float, default=0.4,
+        help="Success rate threshold below which a concept is flagged (default: 0.4).",
+    )
+    p_concept_danger.add_argument(
+        "--min-samples", type=int, default=3,
+        help="Minimum learnings required to consider a concept (default: 3).",
+    )
+    p_concept_danger.set_defaults(func=cmd_concept_danger)
+
+    # Phase 5B: concept list-all, learned, related subcommands
+    p_concept_list_all = concept_sub.add_parser(
+        "list-all", help="List all concepts from every source (theta, sensitivity, learnings, commits, calls)."
+    )
+    p_concept_list_all.set_defaults(func=cmd_concept_list_all)
+
+    p_concept_learned = concept_sub.add_parser(
+        "learned", help="List concepts learned from interactions with learning stats."
+    )
+    p_concept_learned.set_defaults(func=cmd_concept_learned)
+
+    p_concept_related = concept_sub.add_parser(
+        "related", help="List concepts related to a given topic."
+    )
+    p_concept_related.add_argument("--topic", required=True, help="Topic name.")
+    p_concept_related.set_defaults(func=cmd_concept_related)
+
+    p_var = subparsers.add_parser("variance", help="Variance calibration and rolling monitor (f_max, A2/I2).")
+    var_sub = p_var.add_subparsers(dest="var_command", required=True)
+    p_var_cal = var_sub.add_parser("calibrate", help="Run calibration and persist report.")
+    p_var_cal.add_argument("--variances", default="", help="Comma-separated agent_id=sigma_sq (e.g. a1=0.1,a2=0.2).")
+    p_var_cal.set_defaults(func=cmd_variance_calibrate)
+    p_var_mon = var_sub.add_parser("monitor", help="Run rolling monitor; emit VARIANCE_ALERT if f_max drops or is 0.")
+    p_var_mon.add_argument("--variances", default="", help="Optional: comma-separated agent_id=sigma_sq for live re-check.")
+    p_var_mon.set_defaults(func=cmd_variance_monitor)
+
+    # Sprint 5: rep, sis-tc, prompt, deltaf, rdp, disclosure
+    p_rep = subparsers.add_parser("rep", help="REP envelope and local ledger (S5).")
+    rep_sub = p_rep.add_subparsers(dest="rep_command", required=True)
+    p_rep_append = rep_sub.add_parser("append", help="Append REP envelope to ledger.")
+    p_rep_append.add_argument("--agent-id", required=True, dest="agent_id", help="Agent ID.")
+    p_rep_append.add_argument("--round", type=int, required=True, dest="round_id", help="Round ID.")
+    p_rep_append.add_argument("--payload", default="{}", help="JSON payload.")
+    p_rep_append.add_argument("--trust", type=float, default=0.5, help="Trust score [0,1].")
+    p_rep_append.set_defaults(func=cmd_rep_append)
+    p_rep_checksum = rep_sub.add_parser("checksum", help="Replay checksum of ledger.")
+    p_rep_checksum.set_defaults(func=cmd_rep_checksum)
+
+    p_sis = subparsers.add_parser("sis-tc", help="SIS-TC evaluation (A3).")
+    sis_sub = p_sis.add_subparsers(dest="sis_command", required=True)
+    p_sis_run = sis_sub.add_parser("run", help="Run SIS-TC eval; persist report.")
+    p_sis_run.add_argument("--corpus", default=None, help="Path to corpus JSONL (default: .GCC/sis/sis_tc_corpus.jsonl).")
+    p_sis_run.set_defaults(func=cmd_sis_tc_run)
+
+    p_prompt = subparsers.add_parser("prompt", help="RACP system prompt artifact (A3).")
+    prompt_sub = p_prompt.add_subparsers(dest="prompt_command", required=True)
+    p_prompt_set = prompt_sub.add_parser("set", help="Store RACP_SYSTEM_PROMPT_v2.1.")
+    p_prompt_set.add_argument("--file", default=None, help="Read content from file.")
+    p_prompt_set.add_argument("content", nargs="?", default="", help="Prompt content (or use --file).")
+    p_prompt_set.add_argument("--version", default="v2.1")
+    p_prompt_set.set_defaults(func=cmd_prompt_set)
+    p_prompt_show = prompt_sub.add_parser("show", help="Show stored prompt.")
+    p_prompt_show.set_defaults(func=cmd_prompt_show)
+
+    p_deltaf = subparsers.add_parser("deltaf", help="Δf estimation (A4).")
+    deltaf_sub = p_deltaf.add_subparsers(dest="deltaf_command", required=True)
+    p_deltaf_run = deltaf_sub.add_parser("run", help="Run Δf estimation; persist report.")
+    p_deltaf_run.add_argument("--expiry-days", type=int, default=90, dest="expiry_days")
+    p_deltaf_run.set_defaults(func=cmd_deltaf_run)
+
+    p_rdp = subparsers.add_parser("rdp", help="RDP accountant (A4).")
+    rdp_sub = p_rdp.add_subparsers(dest="rdp_command", required=True)
+    p_rdp_spend = rdp_sub.add_parser("spend", help="Spend epsilon for round.")
+    p_rdp_spend.add_argument("round_id", type=int, help="Round ID.")
+    p_rdp_spend.add_argument("epsilon", type=float, help="Epsilon cost.")
+    p_rdp_spend.set_defaults(func=cmd_rdp_spend)
+    p_rdp_status = rdp_sub.add_parser("status", help="Show read_only status.")
+    p_rdp_status.set_defaults(func=cmd_rdp_status)
+
+    p_disc = subparsers.add_parser("disclosure", help="[PRIVATE] suppression and padding (A4).")
+    disc_sub = p_disc.add_subparsers(dest="disclosure_command", required=True)
+    p_disc_redact = disc_sub.add_parser("redact", help="Redact [PRIVATE] with padding.")
+    p_disc_redact.add_argument("text", nargs="?", default="", help="Input text (or stdin).")
+    p_disc_redact.add_argument("--padding", type=int, default=32, help="Padding length.")
+    p_disc_redact.set_defaults(func=cmd_disclosure_redact)
+
+    # Sprint 6: debug
+    p_debug = subparsers.add_parser("debug", help="Debug views (timeline, branch comparison, invariant trace).")
+    debug_sub = p_debug.add_subparsers(dest="debug_command", required=True)
+    p_debug_timeline = debug_sub.add_parser("timeline", help="Event timeline, optionally filtered.")
+    p_debug_timeline.add_argument(
+        "--filter",
+        default=None,
+        help="Comma-separated event types (e.g. CAPABILITY_DEGRADED,VARIANCE_ALERT,QUARANTINE,PRIVACY_BUDGET_EXHAUSTED).",
+    )
+    p_debug_timeline.set_defaults(func=cmd_debug_timeline)
+    p_debug_branch = debug_sub.add_parser("branch-compare", help="Compare two branches (history + Θ).")
+    p_debug_branch.add_argument("branch1", help="First branch name.")
+    p_debug_branch.add_argument("branch2", help="Second branch name.")
+    p_debug_branch.set_defaults(func=cmd_debug_branch_compare)
+    p_debug_inv = debug_sub.add_parser("invariant-trace", help="Show invariant failures and actionable fixes.")
+    p_debug_inv.set_defaults(func=cmd_debug_invariant_trace)
+
+    # Sprint 9: status command
+    p_status = subparsers.add_parser("status", help="Show repository status (branch, commits, Θ hot zones, invariants, lock).")
+    p_status.set_defaults(func=cmd_status)
+
+    # Sprint 9: log command
+    p_log = subparsers.add_parser("log", help="Print .GCC/log.md to stdout.")
+    p_log.add_argument("--tail", type=int, default=None, metavar="N",
+                       help="Print last N lines only (default: print all).")
+    p_log.add_argument("--branch", default=None, metavar="B",
+                       help="Branch filter (note: log.md is global; filter is noted but not applied).")
+    p_log.set_defaults(func=cmd_log)
+
+    # Sprint 9: signing subcommand
+    p_signing = subparsers.add_parser("signing", help="Optional HMAC-SHA256 signing of events.log.jsonl.")
+    signing_sub = p_signing.add_subparsers(dest="signing_command", required=True)
+
+    p_signing_enable = signing_sub.add_parser("enable", help="Enable event log signing (creates .GCC/signing.key if needed).")
+    p_signing_enable.set_defaults(func=cmd_signing_enable)
+
+    p_signing_disable = signing_sub.add_parser("disable", help="Disable event log signing (keeps existing key).")
+    p_signing_disable.set_defaults(func=cmd_signing_disable)
+
+    p_signing_verify = signing_sub.add_parser("verify", help="Verify signatures in events.log.jsonl.")
+    p_signing_verify.set_defaults(func=cmd_signing_verify)
+
+    # Sprint 30: audit subcommand
+    build_audit_parser(subparsers)
+
+    # Sprint 19: projects subcommand
+    p_projects = subparsers.add_parser("projects", help="Manage the machine-level DevTorch project registry.")
+    projects_sub = p_projects.add_subparsers(dest="projects_command", required=True)
+
+    p_projects_add = projects_sub.add_parser("add", help="Add a project to the registry.")
+    p_projects_add.add_argument("path", help="Path to the project root.")
+    p_projects_add.add_argument("--name", default=None, help="Optional project name.")
+    p_projects_add.add_argument("--developer-id", default=None, help="Optional developer ID override.")
+    p_projects_add.add_argument(
+        "--configure-mcp",
+        action="store_true",
+        dest="configure_mcp",
+        help="Also write per-project MCP configs (.claude/hooks.json, .cursor/mcp.json).",
+    )
+    p_projects_add.set_defaults(func=cmd_projects_add)
+
+    p_projects_list = projects_sub.add_parser("list", help="List registered projects.")
+    p_projects_list.set_defaults(func=cmd_projects_list)
+
+    p_projects_remove = projects_sub.add_parser("remove", help="Remove a project from the registry.")
+    p_projects_remove.add_argument("path", help="Path to the project root.")
+    p_projects_remove.set_defaults(func=cmd_projects_remove)
+
+    p_projects_sync = projects_sub.add_parser("sync", help="Refresh last_synced for all registered projects.")
+    p_projects_sync.set_defaults(func=cmd_projects_sync)
+
+    # S7: proxy subcommand (server in devtorch_core/proxy/)
+    p_proxy = subparsers.add_parser("proxy", help="LLM proxy management (S7).")
+    proxy_sub = p_proxy.add_subparsers(dest="proxy_command", required=True)
+
+    p_proxy_start = proxy_sub.add_parser("start", help="Start the LLM proxy server in the foreground.")
+    p_proxy_start.add_argument("--port", type=int, default=8765, help="Port to listen on (default: 8765).")
+    p_proxy_start.add_argument("--host", default="127.0.0.1", help="Host to bind to (default: 127.0.0.1).")
+    p_proxy_start.set_defaults(func=cmd_proxy_start)
+
+    p_proxy_stop = proxy_sub.add_parser("stop", help="Print instructions to stop the proxy.")
+    p_proxy_stop.set_defaults(func=cmd_proxy_stop)
+
+    p_proxy_install = proxy_sub.add_parser("install", help="Install proxy as a system service.")
+    p_proxy_install.set_defaults(func=cmd_proxy_install)
+
+    p_proxy_status = proxy_sub.add_parser("status", help="Check if the proxy is running on :8765.")
+    p_proxy_status.set_defaults(func=cmd_proxy_status)
+
+    # S26: daemon subcommand
+    p_daemon = subparsers.add_parser(
+        "daemon", help="Background file watcher and server (S26)."
+    )
+    daemon_sub = p_daemon.add_subparsers(dest="daemon_command", required=True)
+
+    p_daemon_start = daemon_sub.add_parser("start", help="Start the background daemon.")
+    p_daemon_start.add_argument(
+        "--run-server", action="store_true", dest="run_server",
+        help="Also start the unified DevTorch server in the daemon process.",
+    )
+    p_daemon_start.add_argument(
+        "--host", default="127.0.0.1", help="Host to bind the unified server to (default: 127.0.0.1)."
+    )
+    p_daemon_start.add_argument(
+        "--port", type=int, default=8765, help="Port to bind the unified server to (default: 8765)."
+    )
+    p_daemon_start.set_defaults(func=cmd_daemon_start)
+
+    p_daemon_stop = daemon_sub.add_parser("stop", help="Stop the background daemon.")
+    p_daemon_stop.set_defaults(func=cmd_daemon_stop)
+
+    p_daemon_status = daemon_sub.add_parser("status", help="Show daemon status.")
+    p_daemon_status.set_defaults(func=cmd_daemon_status)
+
+    p_daemon_logs = daemon_sub.add_parser("logs", help="Print the daemon log.")
+    p_daemon_logs.add_argument(
+        "--lines", type=int, default=50, help="Number of lines to show (default: 50)."
+    )
+    p_daemon_logs.set_defaults(func=cmd_daemon_logs)
+
+    # S28: session subcommand
+    p_session = subparsers.add_parser(
+        "session", help="Multi-agent session orchestration (S28)."
+    )
+    session_sub = p_session.add_subparsers(dest="session_command", required=True)
+
+    p_session_start = session_sub.add_parser("start", help="Start a new multi-agent session.")
+    p_session_start.add_argument("--name", required=True, help="Session name.")
+    p_session_start.add_argument("--problem", required=True, help="Problem statement to solve.")
+    p_session_start.add_argument(
+        "--agent", action="append", dest="agents", default=[],
+        help="Agent assignment AGENT_ID=ROLE (repeatable).",
+    )
+    p_session_start.set_defaults(func=cmd_session_start)
+
+    p_session_list = session_sub.add_parser("list", help="List sessions.")
+    p_session_list.set_defaults(func=cmd_session_list)
+
+    p_session_show = session_sub.add_parser("show", help="Show session details.")
+    p_session_show.add_argument("session_id", help="Session ID.")
+    p_session_show.set_defaults(func=cmd_session_show)
+
+    p_session_plan = session_sub.add_parser("plan", help="Decompose the session into subtasks.")
+    p_session_plan.add_argument("session_id", help="Session ID.")
+    p_session_plan.add_argument("--problem", default=None, help="Override the problem statement.")
+    p_session_plan.set_defaults(func=cmd_session_plan)
+
+    p_session_next = session_sub.add_parser("next", help="Show the next ready subtask.")
+    p_session_next.add_argument("session_id", help="Session ID.")
+    p_session_next.set_defaults(func=cmd_session_next)
+
+    p_session_mark = session_sub.add_parser("mark", help="Update subtask status.")
+    p_session_mark.add_argument("session_id", help="Session ID.")
+    p_session_mark.add_argument("--subtask", required=True, dest="subtask_id", help="Subtask ID.")
+    p_session_mark.add_argument(
+        "--status", required=True,
+        choices=["pending", "in_progress", "completed", "blocked", "failed"],
+        help="New subtask status.",
+    )
+    p_session_mark.set_defaults(func=cmd_session_mark)
+
+    p_session_close = session_sub.add_parser("close", help="Close a session.")
+    p_session_close.add_argument("session_id", help="Session ID.")
+    p_session_close.set_defaults(func=cmd_session_close)
+
+    p_session_disagree = session_sub.add_parser("disagree", help="Record a disagreement between agents.")
+    p_session_disagree.add_argument("session_id", help="Session ID.")
+    p_session_disagree.add_argument("--concept", required=True, help="Concept under disagreement.")
+    p_session_disagree.add_argument(
+        "--position", action="append", dest="positions", default=[],
+        help="Agent position AGENT=POSITION:CONFIDENCE (repeatable).",
+    )
+    p_session_disagree.set_defaults(func=cmd_session_disagree)
+
+    p_session_resolve = session_sub.add_parser("resolve", help="Resolve a disagreement.")
+    p_session_resolve.add_argument("disagreement_id", help="Disagreement ID.")
+    p_session_resolve.add_argument("--decision", default=None, help="Human decision to record.")
+    p_session_resolve.set_defaults(func=cmd_session_resolve)
+
+    p_session_disagreements = session_sub.add_parser("disagreements", help="List disagreements.")
+    p_session_disagreements.add_argument("--session", dest="session_id", default=None, help="Filter by session ID.")
+    p_session_disagreements.set_defaults(func=cmd_session_disagreements)
+
+    # S28: simulate subcommand
+    p_simulate = subparsers.add_parser(
+        "simulate", help="Run a what-if simulation against a session (S28)."
+    )
+    p_simulate.add_argument("--session", required=True, dest="session_id", help="Session ID.")
+    p_simulate.add_argument(
+        "--assume", action="append", dest="assumptions", default=[],
+        help="Alternate assumption KEY=VALUE (repeatable).",
+    )
+    p_simulate.add_argument("--json", action="store_true", help="Also print the raw result as JSON.")
+    p_simulate.set_defaults(func=cmd_simulate)
+
+    # S29: pre-commit subcommand
+    p_pre_commit = subparsers.add_parser(
+        "pre-commit", help="Install and run pre-commit hooks (S29)."
+    )
+    pre_commit_sub = p_pre_commit.add_subparsers(dest="pre_commit_command", required=True)
+
+    p_pre_commit_install = pre_commit_sub.add_parser("install", help="Install the DevTorch pre-commit hook.")
+    p_pre_commit_install.set_defaults(func=cmd_pre_commit_install)
+
+    p_pre_commit_run = pre_commit_sub.add_parser("run", help="Run DevTorch pre-commit checks manually.")
+    p_pre_commit_run.set_defaults(func=cmd_pre_commit_run)
+
+    # S29: pr-report subcommand
+    p_pr_report = subparsers.add_parser(
+        "pr-report", help="Post a reasoning-delta comment on a GitHub PR and check merge gate (S29)."
+    )
+    p_pr_report.add_argument("--base", required=True, help="Base branch name.")
+    p_pr_report.add_argument("--head", required=True, help="Head branch name.")
+    p_pr_report.add_argument("--repo-owner", required=True, help="GitHub repository owner.")
+    p_pr_report.add_argument("--repo-name", required=True, help="GitHub repository name.")
+    p_pr_report.add_argument("--pr-number", required=True, type=int, help="Pull request number.")
+    p_pr_report.add_argument("--token", required=True, help="GitHub API token.")
+    p_pr_report.add_argument("--critical-concepts", default="", help="Comma-separated critical concept names.")
+    p_pr_report.add_argument("--min-mcs", type=float, default=0.0, help="Minimum MCS score for merge gate (default: 0).")
+    p_pr_report.set_defaults(func=cmd_pr_report)
+
+    # S17a: calibrate subcommand
+    p_calibrate = subparsers.add_parser("calibrate", help="Calibrate DevTorch metrics baselines.")
+    p_calibrate.add_argument(
+        "--set",
+        dest="set_value",
+        metavar="KEY=VALUE",
+        help="Set a single calibration value.",
+    )
+    p_calibrate.set_defaults(func=cmd_calibrate)
+
+    # S17a: metrics subcommand
+    p_metrics = subparsers.add_parser("metrics", help="Show DevTorch metrics summary.")
+    p_metrics.add_argument(
+        "--period",
+        default="30d",
+        help="Time period (e.g. 30d, 7d). Default: 30d.",
+    )
+    p_metrics.add_argument(
+        "--json",
+        action="store_true",
+        dest="as_json",
+        help="Output raw JSON.",
+    )
+    p_metrics.add_argument(
+        "--tokens",
+        action="store_true",
+        help="Show token usage/savings breakdown (S20).",
+    )
+    p_metrics.add_argument(
+        "--speedup",
+        action="store_true",
+        help="Show latency speedup breakdown (S20).",
+    )
+    p_metrics.add_argument(
+        "--all-projects",
+        action="store_true",
+        dest="all_projects",
+        help="Aggregate metrics across all projects in the registry (S19).",
+    )
+    p_metrics.add_argument(
+        "--delivery-time",
+        action="store_true",
+        dest="delivery_time",
+        help="Show complex-problem delivery-time baseline and current estimate (S25).",
+    )
+    p_metrics.set_defaults(func=cmd_metrics)
+
+    # Sprint 19: reasoning subcommand
+    reasoning_parser = subparsers.add_parser("reasoning", help="Query agent reasoning")
+    reasoning_sub = reasoning_parser.add_subparsers(dest="reasoning_cmd")
+    rshow = reasoning_sub.add_parser("show", help="Show agent reasoning for a concept")
+    rshow.add_argument("--concept", required=True)
+    rshow.add_argument("--agent", dest="agent_id", default=None)
+    rshow.add_argument("--tokens", type=int, default=4000)
+    rshow.set_defaults(func=cmd_reasoning_show)
+
+    # Phase 5B: reasoning history subcommand
+    rhistory = reasoning_sub.add_parser("history", help="Show reasoning history for a topic or concept.")
+    rhistory.add_argument("--topic", default=None, help="Topic name (expands to multiple concepts).")
+    rhistory.add_argument("--concept", default=None, help="Single concept name (alternative to topic).")
+    rhistory.add_argument("--max-entries", type=int, default=50, dest="max_entries", help="Max total entries (default: 50).")
+    rhistory.add_argument("--agent", dest="agent_id", default=None, help="Filter by agent ID.")
+    rhistory.add_argument("--tokens", type=int, default=4000, help="Per-concept token budget (default: 4000).")
+    rhistory.set_defaults(func=cmd_reasoning_history)
+
+    # Phase 5B: topics subcommand
+    topics_parser = subparsers.add_parser("topics", help="Manage and query topic taxonomy.")
+    topics_sub = topics_parser.add_subparsers(dest="topics_command", required=True)
+
+    p_topics_list = topics_sub.add_parser("list", help="List topics with captured reasoning.")
+    p_topics_list.add_argument("--all", action="store_true", help="Show full taxonomy including topics with no data.")
+    p_topics_list.set_defaults(func=cmd_topics_list)
+
+    p_topics_show = topics_sub.add_parser("show", help="Show details for a specific topic.")
+    p_topics_show.add_argument("name", help="Topic name.")
+    p_topics_show.set_defaults(func=cmd_topics_show)
+
+    p_topics_add = topics_sub.add_parser("add", help="Add a custom topic.")
+    p_topics_add.add_argument("name", help="Topic name.")
+    p_topics_add.add_argument("--concepts", required=True, help="Comma-separated concept names.")
+    p_topics_add.set_defaults(func=cmd_topics_add)
+
+    p_topics_remove = topics_sub.add_parser("remove", help="Remove a custom topic.")
+    p_topics_remove.add_argument("name", help="Topic name.")
+    p_topics_remove.set_defaults(func=cmd_topics_remove)
+
+    p_topics_derive = topics_sub.add_parser("derive", help="Auto-derive topics from concept co-occurrence.")
+    p_topics_derive.add_argument("--force", action="store_true", help="Force re-derivation even if cached.")
+    p_topics_derive.set_defaults(func=cmd_topics_derive)
+
+    # S27: templates subcommand (reasoning template library)
+    p_templates = subparsers.add_parser(
+        "templates",
+        help="Reasoning template library and custom template extension (S27).",
+    )
+    templates_sub = p_templates.add_subparsers(dest="templates_command", required=True)
+
+    p_templates_list = templates_sub.add_parser("list", help="List built-in and custom templates.")
+    p_templates_list.set_defaults(func=cmd_templates_list)
+
+    p_templates_apply = templates_sub.add_parser("apply", help="Render a template with variables.")
+    p_templates_apply.add_argument("name", help="Template name.")
+    p_templates_apply.add_argument(
+        "--var",
+        dest="variables",
+        action="append",
+        default=[],
+        help="Template variable KEY=VALUE (repeatable).",
+    )
+    p_templates_apply.add_argument(
+        "--output",
+        default=None,
+        help="Output path for the rendered template (default: .GCC/templates/rendered/<name>.md).",
+    )
+    p_templates_apply.set_defaults(func=cmd_templates_apply)
+
+    p_templates_init = templates_sub.add_parser("init", help="Create the custom template extension directory.")
+    p_templates_init.set_defaults(func=cmd_templates_init)
+
+    # S24: reasoning-plus subcommand
+    rp_parser = subparsers.add_parser("reasoning-plus", help="Manage Reasoning Plus settings")
+    rp_sub = rp_parser.add_subparsers(dest="reasoning_plus_cmd")
+    rp_enable = rp_sub.add_parser("enable", help="Enable Reasoning Plus for this project")
+    rp_enable.add_argument("--path", default=".", help="Path to project root (default: .)")
+    rp_enable.set_defaults(func=cmd_reasoning_plus_enable)
+    rp_disable = rp_sub.add_parser("disable", help="Disable Reasoning Plus for this project")
+    rp_disable.add_argument("--path", default=".", help="Path to project root (default: .)")
+    rp_disable.set_defaults(func=cmd_reasoning_plus_disable)
+    rp_status = rp_sub.add_parser("status", help="Show current Reasoning Plus settings and source")
+    rp_status.add_argument("--path", default=".", help="Path to project root (default: .)")
+    rp_status.set_defaults(func=cmd_reasoning_plus_status)
+    rp_config = rp_sub.add_parser("config", help="Update Reasoning Plus settings")
+    rp_config.add_argument("--path", default=".", help="Path to project root (default: .)")
+    rp_config.add_argument("--smart-top-n", type=int, default=None)
+    rp_config.add_argument("--smart-max-lines", type=int, default=None)
+    rp_config.add_argument("--context-k", type=int, default=None)
+    rp_config.add_argument("--require-thinking", type=lambda x: x.lower() in ("1", "true", "yes", "on"), default=None)
+    rp_config.add_argument("--max-keywords", type=int, default=None)
+    rp_config.add_argument("--cache-ttl", type=int, default=None)
+    rp_config.add_argument("--learning-enabled", type=lambda x: x.lower() in ("1", "true", "yes", "on"), default=None)
+    rp_config.add_argument("--learning-top-n", type=int, default=None)
+    rp_config.add_argument("--learning-max-lines", type=int, default=None)
+    rp_config.add_argument("--learning-embedding-backend", type=str, default=None)
+    rp_config.add_argument("--learning-embedding-model", type=str, default=None)
+    rp_config.add_argument("--learning-extraction-strategy", type=str, default=None)
+    rp_config.add_argument("--learning-relevance-cache-ttl", type=int, default=None)
+    rp_config.set_defaults(func=cmd_reasoning_plus_config)
+    rp_reset = rp_sub.add_parser("reset", help="Reset project Reasoning Plus settings to default")
+    rp_reset.add_argument("--path", default=".", help="Path to project root (default: .)")
+    rp_reset.set_defaults(func=cmd_reasoning_plus_reset)
+
+    rp_suggest = rp_sub.add_parser(
+        "cross-project-suggest",
+        help="Suggest relevant learnings from sibling governed projects.",
+    )
+    rp_suggest.add_argument("--path", default=".", help="Path to project root (default: .)")
+    rp_suggest.add_argument("query", help="Query to match against project name/tags and learnings.")
+    rp_suggest.add_argument("--top-n", type=int, default=3, help="Maximum number of learnings to return (default: 3).")
+    rp_suggest.set_defaults(func=cmd_reasoning_plus_cross_project_suggest)
+
+    # Phase 3: learning analytics CLI
+    learning_parser = subparsers.add_parser("learning", help="Per-concept learning statistics and analytics (Phase 3).")
+    learning_sub = learning_parser.add_subparsers(dest="learning_command", required=True)
+    p_learning_stats = learning_sub.add_parser("stats", help="Show learning statistics.")
+    p_learning_stats.add_argument("--by-concept", action="store_true", help="Group statistics by concept.")
+    p_learning_stats.set_defaults(func=cmd_learning_stats)
+
+    sync_parser = subparsers.add_parser("sync", help="Sync REP ledger or team Θ with peers.")
+    sync_parser.add_argument("--interval", type=int, default=0,
+                             help="If >0, repeat sync every N seconds (runs until interrupted).")
+    sync_parser.add_argument("--gcc-dir", default=".GCC",
+                             help="Path to .GCC directory (default: .GCC in cwd).")
+    sync_sub = sync_parser.add_subparsers(dest="sync_command", required=False)
+
+    # Existing REP sync (default when no subcommand is given)
+    rep_sync_parser = sync_sub.add_parser("rep", help="Sync REP ledger with registered peers.")
+    rep_sync_parser.set_defaults(func=cmd_sync)
+
+    # Team Θ synchronization (S31)
+    theta_sync_parser = sync_sub.add_parser("theta", help="Synchronize team Θ (coordination vector) via cloud storage.")
+    theta_sync_sub = theta_sync_parser.add_subparsers(dest="theta_sync_command", required=True)
+    theta_push = theta_sync_sub.add_parser("push", help="Push local .GCC/theta.json to the org team Θ store.")
+    theta_push.add_argument("--org", required=True, help="DevTorch org ID")
+    theta_push.add_argument("--gcc-dir", default=".GCC", help="Path to .GCC directory (default: .GCC in cwd)")
+    theta_push.add_argument(
+        "--from-learnings", action="store_true",
+        help="Sync learning success rates into Θ before pushing (Phase 4).",
+    )
+    theta_push.set_defaults(func=cmd_sync_theta_push)
+    theta_pull = theta_sync_sub.add_parser("pull", help="Pull the org team Θ store and merge it into local .GCC/theta.json.")
+    theta_pull.add_argument("--org", required=True, help="DevTorch org ID")
+    theta_pull.add_argument("--gcc-dir", default=".GCC", help="Path to .GCC directory (default: .GCC in cwd)")
+    theta_pull.set_defaults(func=cmd_sync_theta_pull)
+
+    # Phase 4: cross-project learning sync
+    learning_sync_parser = sync_sub.add_parser("learning", help="Synchronize learnings across team projects via cloud storage.")
+    learning_sync_sub = learning_sync_parser.add_subparsers(dest="learning_sync_command", required=True)
+    lp_push = learning_sync_sub.add_parser("push", help="Push local learnings to the org team learning store.")
+    lp_push.add_argument("--org", required=True, help="DevTorch org ID")
+    lp_push.add_argument("--gcc-dir", default=".GCC", help="Path to .GCC directory (default: .GCC in cwd)")
+    lp_push.set_defaults(func=cmd_sync_learning_push)
+    lp_pull = learning_sync_sub.add_parser("pull", help="Pull and merge team learnings into the local store.")
+    lp_pull.add_argument("--org", required=True, help="DevTorch org ID")
+    lp_pull.add_argument("--gcc-dir", default=".GCC", help="Path to .GCC directory (default: .GCC in cwd)")
+    lp_pull.set_defaults(func=cmd_sync_learning_pull)
+
+    # Bidirectional sync (PR #32)
+    sync_all_parser = sync_sub.add_parser("all", help="Bidirectional sync with MCP server (git-inspired, incremental + conflict resolution).")
+    sync_all_parser.add_argument("--interval", type=int, default=0, help="Repeat every N minutes (default: 0 = one-shot).")
+    sync_all_parser.add_argument("--dry-run", action="store_true", help="Show what would sync without making changes.")
+    sync_all_parser.add_argument("--verbose", action="store_true", help="Show per-item details.")
+    sync_all_parser.add_argument("--chunk-size", type=int, default=500, help="Max items per batch (default: 500).")
+    sync_all_parser.add_argument("--force-full", action="store_true", help="Treat sync state as empty, trigger full re-sync.")
+    sync_all_parser.set_defaults(func=cmd_sync_all)
+
+    sync_conflicts_parser = sync_sub.add_parser("conflicts", help="List and resolve sync conflicts.")
+    sync_conflicts_parser.add_argument("--all", action="store_true", dest="show_all", help="Include resolved conflicts.")
+    sync_conflicts_parser.add_argument("--severity", default=None, choices=["high", "medium", "low"], help="Filter by severity.")
+    sync_conflicts_parser.set_defaults(func=cmd_sync_conflicts)
+
+    sync_conflicts_resolve_parser = sync_sub.add_parser("conflicts-resolve", help="Resolve a specific sync conflict.")
+    sync_conflicts_resolve_parser.add_argument("conflict_id", help="Conflict ID to resolve.")
+    sync_conflicts_resolve_parser.add_argument("--use-remote", action="store_true", help="Use the remote value instead of local.")
+    sync_conflicts_resolve_parser.add_argument("--dismiss", action="store_true", help="Dismiss without changing anything.")
+    sync_conflicts_resolve_parser.add_argument("--dry-run", action="store_true", help="Show what would happen without applying.")
+    sync_conflicts_resolve_parser.set_defaults(func=cmd_sync_conflicts_resolve)
+
+    sync_parser.set_defaults(func=cmd_sync, sync_command=None)
+
+    watch_parser = subparsers.add_parser("watch", help="Tail coordination events from .GCC/ in real time.")
+    watch_parser.add_argument("--gcc-dir", default=".GCC",
+                              help="Path to .GCC directory (default: .GCC in cwd).")
+    watch_parser.set_defaults(func=cmd_watch)
+
+    # S11: mcp-server subcommand
+    mcp_parser = subparsers.add_parser("mcp-server", help="Start the DevTorch MCP server")
+    mcp_parser.add_argument(
+        "--transport", choices=["stdio", "sse"], default="stdio",
+        help="Transport: stdio (default, local) or sse (cloud HTTPS)",
+    )
+    mcp_parser.add_argument("--host", default="0.0.0.0", help="SSE bind host (default: 0.0.0.0)")
+    mcp_parser.add_argument("--port", type=int, default=8080, help="SSE bind port (default: 8080)")
+
+    # Cloud key management
+    cloud_parser = subparsers.add_parser("cloud", help="Cloud MCP server management")
+    cloud_sub = cloud_parser.add_subparsers(dest="cloud_command", required=True)
+    key_parser = cloud_sub.add_parser("key", help="API key management")
+    key_sub = key_parser.add_subparsers(dest="key_command", required=True)
+    key_create = key_sub.add_parser("create", help="Create a new API key")
+    key_create.add_argument("--org", required=True, help="Org ID")
+    key_create.add_argument("--repo", help="Repo ID (optional, adds to allowed_repos)")
+    key_create.add_argument(
+        "--github", metavar="OWNER/REPO",
+        help="Also set DEVTORCH_API_KEY as a GitHub Repository Secret",
+    )
+
+    key_list = key_sub.add_parser("list", help="List API keys for an org")
+    key_list.add_argument("--org", required=True, help="Org ID")
+
+    key_revoke = key_sub.add_parser("revoke", help="Revoke an API key by hash prefix")
+    key_revoke.add_argument("--org", required=True, help="Org ID")
+    key_revoke.add_argument("key_prefix", help="Hex prefix of the key hash to revoke (min 8 chars)")
+    key_revoke.add_argument("--yes", "-y", action="store_true",
+                            help="Skip confirmation prompt (required for non-interactive use)")
+
+    key_rotate = key_sub.add_parser("rotate", help="Rotate an API key by prefix (revoke old, create new)")
+    key_rotate.add_argument("--org", required=True, help="Org ID")
+    key_rotate.add_argument("key_prefix", help="Hex prefix of the key hash to rotate (min 8 chars)")
+    key_rotate.add_argument("--yes", "-y", action="store_true",
+                            help="Skip confirmation prompt (required for non-interactive use)")
+
+    repo_parser = cloud_sub.add_parser("repo", help="GitHub repository connection management")
+    repo_sub = repo_parser.add_subparsers(dest="repo_command", required=True)
+
+    repo_connect = repo_sub.add_parser("connect", help="Connect a GitHub repository")
+    repo_connect.add_argument("--org", required=True, help="Org ID")
+    repo_connect.add_argument("--repo", required=True, help="DevTorch repo ID (e.g. 'myproject')")
+    repo_connect.add_argument("--github", required=True, metavar="OWNER/REPO",
+                              help="GitHub repository (e.g. 'acme/backend')")
+    repo_connect_auth = repo_connect.add_mutually_exclusive_group(required=True)
+    repo_connect_auth.add_argument("--pat", metavar="TOKEN",
+                                   help="GitHub Personal Access Token")
+    repo_connect_auth.add_argument("--github-app", action="store_true",
+                                   help="Use GitHub App (server handles via webhook)")
+
+    repo_list = repo_sub.add_parser("list", help="List connected GitHub repositories")
+    repo_list.add_argument("--org", required=True, help="Org ID")
+
+    repo_disconnect = repo_sub.add_parser("disconnect", help="Remove a connected GitHub repository")
+    repo_disconnect.add_argument("--org", required=True, help="Org ID")
+    repo_disconnect.add_argument("--repo", required=True, help="DevTorch repo ID")
+
+    # Cloud client configuration installer
+    setup_parser = cloud_sub.add_parser("setup", help="Deploy the self-hosted Cloudflare Worker MCP server (one-command setup).")
+    setup_parser.add_argument("--env-file", help="Environment file to source")
+    setup_parser.add_argument("--org", help="DevTorch org ID")
+    setup_parser.add_argument("--repo", help="DevTorch repo ID")
+    setup_parser.add_argument("--ide", choices=["opencode", "claude", "cursor", "vscode", "stdio"],
+                              help="IDE to configure locally")
+    setup_parser.add_argument("--openai-key", help="OpenAI API key for DRPL embedding backend")
+    setup_parser.add_argument("--non-interactive", action="store_true",
+                              help="Run without prompts (requires --org and --repo)")
+    setup_parser.add_argument("--skip-key", action="store_true", help="Skip creating API key")
+    setup_parser.add_argument("--skip-client-config", action="store_true", help="Skip IDE config")
+    setup_parser.add_argument("--dry-run", action="store_true", help="Print command instead of running")
+    setup_parser.set_defaults(func=cmd_cloud_setup)
+
+    client_config_parser = cloud_sub.add_parser(
+        "client-config", help="Install MCP client config for an IDE (opencode, claude, cursor, vscode, stdio)."
+    )
+    client_config_parser.add_argument("ide", choices=["opencode", "claude", "cursor", "vscode", "stdio"], help="IDE target")
+    client_config_parser.add_argument("--org", required=True, help="DevTorch org ID")
+    client_config_parser.add_argument("--repo", required=True, help="DevTorch repo ID")
+    client_config_parser.add_argument("--api-key", required=True, help="API key from 'devtorch cloud key create'")
+    client_config_parser.add_argument(
+        "--domain", default=None, help="Cloudflare Worker domain (default: DEVTORCH_MCP_DOMAIN env var)"
+    )
+    client_config_parser.add_argument(
+        "--path", default=".", help="Project root to install config into (default: current directory)"
+    )
+    client_config_parser.add_argument(
+        "--use-env-key", action="store_true",
+        help="claude/stdio targets: write ${DEVTORCH_API_KEY} into .mcp.json instead of "
+             "the literal key (Claude Code expands env vars; export DEVTORCH_API_KEY yourself)",
+    )
+    client_config_parser.set_defaults(func=cmd_cloud_client_config)
+
+    # Cloud reasoning sync (Task 6)
+    sync_parser = cloud_sub.add_parser(
+        "sync", help="Push local .GCC commits to the cloud MCP store (one-way)."
+    )
+    sync_parser.add_argument(
+        "--from-now", action="store_true", dest="from_now",
+        help="Mark all existing local commits as synced without pushing them; "
+             "only commits made after this point will sync (go-forward adoption).",
+    )
+    sync_parser.add_argument("--path", default=".", help="Project root (default: current directory)")
+
+    # S11: hooks subcommand
+    p_hooks = subparsers.add_parser("hooks", help="Manage DevTorch hooks for Claude Code and git (S11).")
+    hooks_sub = p_hooks.add_subparsers(dest="hooks_command", required=True)
+
+    p_hooks_install = hooks_sub.add_parser("install", help="Install .claude/hooks.json and git commit-msg hook.")
+    p_hooks_install.set_defaults(hooks_command="install")
+
+    p_hooks_status = hooks_sub.add_parser("status", help="Show which DevTorch hooks are installed.")
+    p_hooks_status.set_defaults(hooks_command="status")
+
+    p_hooks_git_commit = hooks_sub.add_parser("git-commit", help="Git commit-msg hook entry point.")
+    p_hooks_git_commit.add_argument("commit_msg_file", help="Path to the git commit message file.")
+    p_hooks_git_commit.set_defaults(hooks_command="git-commit")
+
+    p_hooks_git_capture = hooks_sub.add_parser(
+        "git-capture",
+        help="Git capture hook entry point for post-commit, post-merge, post-checkout, post-rewrite.",
+    )
+    p_hooks_git_capture.add_argument(
+        "event",
+        choices=["post-commit", "post-merge", "post-checkout", "post-rewrite", "conflict"],
+        help="Git hook event to capture.",
+    )
+    p_hooks_git_capture.add_argument(
+        "args",
+        nargs="*",
+        help="Extra positional arguments passed by the git hook (e.g. squash flag, prev/new HEAD).",
+    )
+    p_hooks_git_capture.set_defaults(hooks_command="git-capture")
+
+    p_hooks_run = hooks_sub.add_parser("run", help="Run a Claude Code hook (reads JSON from stdin).")
+    p_hooks_run.add_argument("hook_name", choices=["pre-tool-use", "post-tool-use", "session-end"])
+    p_hooks_run.set_defaults(hooks_command="run")
+
+    # S16: alert subcommand
+    p_alert = subparsers.add_parser("alert", help="Send a test governance alert to configured channels (Slack, Teams, Jira, Linear, PagerDuty).")
+    p_alert.add_argument("--title", default="DevTorch test alert", help="Alert title.")
+    p_alert.add_argument("--body", default="This is a test alert from the DevTorch CLI.", help="Alert body.")
+    p_alert.add_argument("--severity", choices=["info", "warning", "critical"], default="warning", help="Alert severity.")
+    p_alert.add_argument("--event-type", default="TEST_ALERT", help="Event type label.")
+    p_alert.add_argument("--channel", choices=["slack", "teams", "jira", "linear", "pagerduty"], help="Send only to this channel (requires env vars for that channel).")
+    p_alert.set_defaults(func=cmd_alert)
+
+    return parser
+
+
+def _set_github_secret(owner_repo: str, secret_name: str, secret_value: str) -> None:
+    import os
+    import urllib.request
+    import json as _json
+
+    token = os.environ.get("GITHUB_TOKEN", "")
+    if not token:
+        print("Warning: GITHUB_TOKEN not set; skipping GitHub secret creation.")
+        return
+    owner, repo = owner_repo.split("/", 1)
+
+    url = f"https://api.github.com/repos/{owner}/{repo}/actions/secrets/public-key"
+    req = urllib.request.Request(
+        url,
+        headers={
+            "Authorization": f"token {token}",
+            "Accept": "application/vnd.github+json",
+        },
+    )
+    with urllib.request.urlopen(req, timeout=10) as resp:
+        pub_key_data = _json.loads(resp.read())
+
+    try:
+        import nacl.public
+        from base64 import b64decode, b64encode
+        pub_key = nacl.public.PublicKey(b64decode(pub_key_data["key"]))
+        sealed = nacl.public.SealedBox(pub_key).encrypt(secret_value.encode())
+        encrypted = b64encode(sealed).decode()
+    except ImportError:
+        print("Warning: PyNaCl not installed; cannot encrypt GitHub secret. Install with: pip install PyNaCl")
+        return
+
+    payload = _json.dumps({
+        "encrypted_value": encrypted,
+        "key_id": pub_key_data["key_id"],
+    }).encode()
+    put_url = f"https://api.github.com/repos/{owner}/{repo}/actions/secrets/{secret_name}"
+    put_req = urllib.request.Request(
+        put_url, data=payload, method="PUT",
+        headers={
+            "Authorization": f"token {token}",
+            "Accept": "application/vnd.github+json",
+            "Content-Type": "application/json",
+        },
+    )
+    with urllib.request.urlopen(put_req, timeout=10):
+        pass
+    print(f"GitHub secret {secret_name} set on {owner_repo}.")
+
+
+def cmd_sync(args: argparse.Namespace) -> int:
+    import time
+    from pathlib import Path
+    from devtorch_core.rep import REPLedger
+    from devtorch_core.rep_network.node import NodeRegistry
+    from devtorch_core.rep_network.sync import sync_all_peers
+
+    if getattr(args, "sync_command", None) == "theta":
+        theta_cmd = getattr(args, "theta_sync_command", None)
+        if theta_cmd == "push":
+            return cmd_sync_theta_push(args)
+        if theta_cmd == "pull":
+            return cmd_sync_theta_pull(args)
+        print("error: unknown theta sync command", file=sys.stderr)
+        return 1
+
+    gcc_dir = Path(args.gcc_dir)
+    ledger = REPLedger(gcc_dir / "rep")
+    registry = NodeRegistry(gcc_dir / "rep")
+
+    def _do_sync():
+        results = sync_all_peers(ledger, registry)
+        if not results:
+            print("No peers configured.")
+            return
+        for r in results:
+            status = "✓" if r.success else "✗"
+            print(f"  {status} {r.peer_node_id} ({r.peer_url}): "
+                  f"pushed={r.pushed_count} pulled={r.pulled_count}"
+                  + (f" errors={r.errors}" if r.errors else ""))
+
+    if args.interval > 0:
+        print(f"Syncing every {args.interval}s — Ctrl-C to stop.")
+        try:
+            while True:
+                _do_sync()
+                time.sleep(args.interval)
+        except KeyboardInterrupt:
+            print("\nSync stopped.")
+    else:
+        _do_sync()
+    return 0
+
+
+def cmd_sync_theta_push(args: argparse.Namespace) -> int:
+    from pathlib import Path
+    from devtorch_core.cloud.team_sync import push_theta
+
+    gcc_dir = Path(args.gcc_dir).resolve()
+
+    if getattr(args, "from_learnings", False):
+        from devtorch_core.reasoning_plus.learning.theta_learning_bridge import (
+            sync_learnings_to_theta,
+        )
+        bridge_result = sync_learnings_to_theta(gcc_dir, min_samples=3)
+        if bridge_result["concepts_synced"]:
+            print(f"Synced {bridge_result['concepts_synced']} concept(s) from learnings into Θ.")
+        else:
+            print("No concepts with sufficient learnings to sync into Θ.")
+
+    result = push_theta(args.org, gcc_dir)
+    print(f"Pushed {result['concepts_pushed']} concept(s) to team Θ for {result['org_id']}.")
+    return 0
+
+
+def cmd_sync_learning_push(args: argparse.Namespace) -> int:
+    from pathlib import Path
+    from devtorch_core.cloud.team_sync import push_learnings
+
+    result = push_learnings(args.org, Path(args.gcc_dir).resolve())
+    print(
+        f"Pushed {result['learnings_pushed']} learning(s) to team store for "
+        f"{result['org_id']} (total remote: {result['learnings_total_remote']})."
+    )
+    return 0
+
+
+def cmd_sync_learning_pull(args: argparse.Namespace) -> int:
+    from pathlib import Path
+    from devtorch_core.cloud.team_sync import pull_learnings
+
+    result = pull_learnings(args.org, Path(args.gcc_dir).resolve())
+    print(
+        f"Pulled {result['learnings_added']} new learning(s) from team store for "
+        f"{result['org_id']} (total local: {result['learnings_total_local']})."
+    )
+    return 0
+
+
+def cmd_sync_theta_pull(args: argparse.Namespace) -> int:
+    from pathlib import Path
+    from devtorch_core.cloud.team_sync import pull_theta
+
+    result = pull_theta(args.org, Path(args.gcc_dir).resolve())
+    print(f"Pulled team Θ for {result['org_id']}: "
+          f"{result['concepts_after']} concept(s) total "
+          f"(+{result['concepts_added']} from remote).")
+    return 0
+
+
+def cmd_sync_all(args: argparse.Namespace) -> int:
+    """Bidirectional sync with MCP server (sync_pull → merge → sync_push)."""
+    import time as _time
+    from devtorch_core.cloud.mcp_client import detect_mcp_config, McpClient
+    from devtorch_core.cloud.sync_state import SyncState
+    from devtorch_core.cloud.sync_bundle import build_local_delta, build_server_state, compress, decompress, merge_pull
+    from devtorch_core.cloud.sync_conflicts import ConflictLog
+    from devtorch_core.gcc import GCCRepository
+
+    root = Path(args.path).resolve()
+    config = detect_mcp_config(root)
+    if not config:
+        print("No MCP server configured. Set DEVTORCH_MCP_URL and DEVTORCH_API_KEY or configure .mcp.json.", file=sys.stderr)
+        return 1
+
+    url, api_key = config
+    repo = GCCRepository.at(root)
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+
+    with McpClient(url, api_key, timeout=60.0) as client:
+        gcc_dir = repo.gcc_dir
+        sync_state = SyncState(gcc_dir)
+        conflict_log = ConflictLog(gcc_dir)
+
+        interval = getattr(args, "interval", 0)
+        dry_run = getattr(args, "dry_run", False)
+        verbose = getattr(args, "verbose", False)
+        chunk_size = getattr(args, "chunk_size", 500)
+        force_full = getattr(args, "force_full", False)
+
+        consecutive_failures = 0
+
+        def _do_sync() -> bool:
+            nonlocal consecutive_failures
+            state = sync_state.load()
+            if force_full:
+                state = sync_state.reset(state)
+
+            # Phase 1: PULL
+            if verbose:
+                print("  Pull (server → local)...")
+            remote_view = sync_state.get_remote_state_view(state)
+            try:
+                pull_result_raw = client.call_tool("devtorch_sync_pull", {"sync_state": remote_view, "chunk_size": chunk_size})
+                pull_result = json.loads(pull_result_raw)
+            except Exception as e:
+                print(f"  Pull failed: {e}. Skipping push. Will retry.", file=sys.stderr)
+                return False
+
+            server_state = pull_result.get("server_state", {})
+            if pull_result.get("bundle"):
+                pull_delta = decompress(pull_result["bundle"])
+            else:
+                pull_delta = {}
+
+            # Phase 2: MERGE PULL
+            if pull_delta.get("delta"):
+                if dry_run:
+                    print(f"  Pull (dry-run): would merge {sum(len(v) if isinstance(v, list) else 1 for v in pull_delta['delta'].values())} items")
+                else:
+                    merge_result = merge_pull(gcc_dir, pull_delta["delta"], conflict_log)
+                    state = sync_state.update_after_pull(state, {
+                        "server_state": server_state,
+                        "delta": pull_delta["delta"],
+                    })
+                    sync_state.save(state)
+                    if verbose:
+                        for k, v in merge_result["counts"].items():
+                            if v:
+                                print(f"    {k}: +{v} new")
+                        for c in merge_result["conflicts"]:
+                            print(f"    \u26a0 CONFLICT: {c.get('type','')} — {c.get('item_id','')}")
+
+            # Phase 3: PUSH
+            if verbose:
+                print("  Push (local → server)...")
+            local_delta = build_local_delta(gcc_dir, server_state)
+            if any(isinstance(v, (list, dict)) and v for v in local_delta.values() if isinstance(v, (list, dict))):
+                if dry_run:
+                    sizes = {k: len(v) if isinstance(v, list) else 1 for k, v in local_delta.items() if isinstance(v, (list, dict)) and v}
+                    print(f"  Push (dry-run): would send {sizes}")
+                else:
+                    compressed_bundle = compress(local_delta)
+                    try:
+                        push_result_raw = client.call_tool("devtorch_sync_push", {"bundle": compressed_bundle})
+                        push_result = json.loads(push_result_raw)
+                    except Exception as e:
+                        print(f"  Push failed: {e}. Local is updated but server may not have latest.", file=sys.stderr)
+                        return False
+
+                    # Update sync state with push results
+                    state = sync_state.update_after_push(state, {"delta": local_delta}, push_result.get("server_state", {}))
+                    sync_state.save(state)
+                    if verbose:
+                        for k, v in push_result.get("counts", {}).items():
+                            if v:
+                                print(f"    {k}: +{v}")
+                        for c in push_result.get("conflicts", []):
+                            print(f"    \u26a0 CONFLICT: {c.get('type','')} — {c.get('item_id','')}")
+            else:
+                if verbose:
+                    print("    Nothing to push.")
+
+            # Show unresolved conflicts
+            unresolved = conflict_log.count_unresolved()
+            if unresolved:
+                print(f"  \u26a0 {unresolved} unresolved conflict(s) — run 'devtorch sync conflicts' for details")
+
+            consecutive_failures = 0
+            return True
+
+        if interval > 0:
+            interval_seconds = interval * 60
+            consecutive_failures = 0
+            print(f"Syncing every {interval} minute(s) — Ctrl-C to stop.")
+            try:
+                while True:
+                    print()
+                    success = _do_sync()
+                    if success:
+                        consecutive_failures = 0
+                        sleep_time = interval_seconds
+                        print(f"  Next sync in {interval} minute(s).")
+                    else:
+                        consecutive_failures += 1
+                        sleep_time = min(interval_seconds * (2 ** min(consecutive_failures - 1, 4)), 3600)
+                        print(f"  Sync failed ({consecutive_failures} consecutive). Retrying in {sleep_time // 60} minute(s)...")
+                    _time.sleep(sleep_time)
+            except KeyboardInterrupt:
+                print("\nSync stopped.")
+        else:
+            _do_sync()
+
+    return 0
+
+
+def cmd_sync_conflicts(args: argparse.Namespace) -> int:
+    """List sync conflicts."""
+    from devtorch_core.gcc import GCCRepository
+    from devtorch_core.cloud.sync_conflicts import ConflictLog
+
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+
+    conflict_log = ConflictLog(repo.gcc_dir)
+    show_all = getattr(args, "show_all", False)
+    severity_filter = getattr(args, "severity", None)
+
+    entries = conflict_log.list_all() if show_all else conflict_log.list_unresolved()
+
+    if severity_filter:
+        entries = [e for e in entries if e.get("severity") == severity_filter]
+
+    if not entries:
+        print("No conflicts found.")
+        return 0
+
+    print(f"Sync conflicts ({len(entries)}):\n")
+    for e in entries:
+        status = "\u2713 resolved" if e.get("resolved") else "\u26a0 unresolved"
+        print(f"  [{e.get('severity', '?')}] {e.get('type', '?')} — {e.get('item_id', '?')} ({status})")
+        if e.get("local_value"):
+            lv = e["local_value"]
+            print(f"    Local:  {lv.get('message', lv.get('content', json.dumps(lv)))[:80]}")
+        if e.get("remote_value"):
+            rv = e["remote_value"]
+            print(f"    Remote: {rv.get('message', rv.get('content', json.dumps(rv)))[:80]}")
+        print(f"    Resolution: {e.get('resolution', 'pending')}")
+        if not e.get("resolved"):
+            print(f"    Use: devtorch sync conflicts-resolve {e['conflict_id']} [--use-remote] [--dismiss]")
+        print()
+    return 0
+
+
+def cmd_sync_conflicts_resolve(args: argparse.Namespace) -> int:
+    """Resolve a sync conflict."""
+    from devtorch_core.gcc import GCCRepository
+    from devtorch_core.cloud.sync_conflicts import ConflictLog
+
+    repo = GCCRepository.at(Path(args.path).resolve())
+    if not repo.is_initialized():
+        print("This directory is not tracking DevTorch yet.", file=sys.stderr)
+        return 1
+
+    conflict_log = ConflictLog(repo.gcc_dir)
+    conflict_id = args.conflict_id
+    use_remote = getattr(args, "use_remote", False)
+    dismiss = getattr(args, "dismiss", False)
+    dry_run = getattr(args, "dry_run", False)
+
+    # First check the conflict exists
+    all_entries = conflict_log.list_all()
+    found = None
+    for e in all_entries:
+        if e.get("conflict_id") == conflict_id:
+            found = e
+            break
+
+    if not found:
+        print(f"Conflict '{conflict_id}' not found.", file=sys.stderr)
+        return 1
+
+    if dry_run:
+        rv = found.get("remote_value", {})
+        lv = found.get("local_value", {})
+        print(f"Conflict '{conflict_id}':")
+        print(f"  Type: {found.get('type', '?')}")
+        print(f"  Current resolution: {found.get('resolution', 'pending')}")
+        if use_remote:
+            print(f"  Would apply REMOTE: {rv.get('message', rv.get('content', json.dumps(rv)))[:80]}")
+        elif dismiss:
+            print(f"  Would dismiss (keep local).")
+        else:
+            print(f"  Would keep LOCAL (default). Add --use-remote to override.")
+        return 0
+
+    result = conflict_log.resolve(conflict_id, use_remote=use_remote, dismiss=dismiss)
+    if result is None:
+        print(f"Conflict '{conflict_id}' not found.", file=sys.stderr)
+        return 1
+
+    print(f"Conflict '{conflict_id}' resolved: {result.get('resolution', 'completed')}.")
+    return 0
+
+
+def cmd_cloud_setup(args: argparse.Namespace) -> int:
+    from devtorch_core.cloud.setup import run_cloud_setup
+
+    try:
+        result = run_cloud_setup(
+            env_file=args.env_file,
+            org=args.org,
+            repo=args.repo,
+            ide=args.ide,
+            openai_key=args.openai_key,
+            non_interactive=args.non_interactive,
+            skip_key=args.skip_key,
+            skip_client_config=args.skip_client_config,
+            dry_run=args.dry_run,
+        )
+    except (FileNotFoundError, ValueError) as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+
+    if args.dry_run:
+        print(" ".join(result["args"]))
+        return 0
+    return int(result.get("returncode", "0"))
+
+
+def cmd_watch(args: argparse.Namespace) -> int:
+    """Tail the DevTorch event stream (SSE broadcaster)."""
+    import sys
+    from pathlib import Path
+    from devtorch_core.broadcast.broadcaster import EventBroadcaster
+    from devtorch_core.broadcast.watcher import GCCWatcher
+
+    gcc_dir = Path(args.gcc_dir)
+    if not gcc_dir.exists():
+        print(f"Error: {gcc_dir} does not exist. Run devtorch init first.", file=sys.stderr)
+        return 1
+
+    broadcaster = EventBroadcaster()
+    q = broadcaster.subscribe()
+    watcher = GCCWatcher(gcc_dir, broadcaster, poll_interval=0.2)
+    watcher.start()
+    print(f"Watching {gcc_dir}/events.log.jsonl for coordination events... (Ctrl-C to stop)")
+    import json as _json
+    import time as _time
+    try:
+        while True:
+            _time.sleep(0.1)
+            while not q.empty():
+                event = q.get_nowait()
+                print(_json.dumps(event, indent=None))
+    except KeyboardInterrupt:
+        print("\nStopped.")
+    finally:
+        watcher.stop()
+    return 0
+
+
+# ---------------------------------------------------------------------------
+# S24: Reasoning Plus commands
+# ---------------------------------------------------------------------------
+
+
+def _reasoning_plus_store(args: argparse.Namespace) -> Any:
+    from devtorch_core.reasoning_plus.config import SettingsStore
+
+    project_root = Path(args.path).resolve()
+    gcc_repo = None
+    try:
+        gcc_repo = GCCRepository.at(project_root)
+    except Exception:
+        pass
+    gcc_dir = gcc_repo.gcc_dir if gcc_repo and gcc_repo.is_initialized() else None
+    return SettingsStore(gcc_dir)
+
+
+def cmd_reasoning_plus_enable(args: argparse.Namespace) -> int:
+    store = _reasoning_plus_store(args)
+    if store._project_dir is None:
+        print("error: no initialized .GCC/ repo found. Run devtorch init first.", file=sys.stderr)
+        return 1
+    config, _ = store.load()
+    config = config.with_values(enabled=True)
+    store.save_project(config)
+    print("Reasoning Plus enabled for this project.")
+    return 0
+
+
+def cmd_reasoning_plus_disable(args: argparse.Namespace) -> int:
+    store = _reasoning_plus_store(args)
+    if store._project_dir is None:
+        print("error: no initialized .GCC/ repo found. Run devtorch init first.", file=sys.stderr)
+        return 1
+    config, _ = store.load()
+    config = config.with_values(enabled=False)
+    store.save_project(config)
+    print("Reasoning Plus disabled for this project.")
+    return 0
+
+
+def cmd_reasoning_plus_status(args: argparse.Namespace) -> int:
+    store = _reasoning_plus_store(args)
+    config, source = store.load()
+    print(f"Reasoning Plus status")
+    print(f"  source: {source}")
+    print(f"  enabled: {config.enabled}")
+    print(f"  smart_top_n: {config.smart_top_n}")
+    print(f"  smart_max_lines: {config.smart_max_lines}")
+    print(f"  context_k: {config.context_k}")
+    print(f"  require_thinking: {config.require_thinking}")
+    print(f"  max_keywords: {config.max_keywords}")
+    print(f"  cache_ttl_secs: {config.cache_ttl_secs}")
+    print(f"  learning_enabled: {config.learning_enabled}")
+    print(f"  learning_top_n: {config.learning_top_n}")
+    print(f"  learning_max_lines: {config.learning_max_lines}")
+    print(f"  learning_embedding_backend: {config.learning_embedding_backend}")
+    print(f"  learning_embedding_model: {config.learning_embedding_model}")
+    print(f"  learning_extraction_strategy: {config.learning_extraction_strategy}")
+    print(f"  learning_relevance_cache_ttl: {config.learning_relevance_cache_ttl}")
+    return 0
+
+
+def cmd_reasoning_plus_config(args: argparse.Namespace) -> int:
+    store = _reasoning_plus_store(args)
+    if store._project_dir is None:
+        print("error: no initialized .GCC/ repo found. Run devtorch init first.", file=sys.stderr)
+        return 1
+    config, _ = store.load()
+    overrides: dict[str, Any] = {}
+    if args.smart_top_n is not None:
+        overrides["smart_top_n"] = args.smart_top_n
+    if args.smart_max_lines is not None:
+        overrides["smart_max_lines"] = args.smart_max_lines
+    if args.context_k is not None:
+        overrides["context_k"] = args.context_k
+    if args.require_thinking is not None:
+        overrides["require_thinking"] = args.require_thinking
+    if args.max_keywords is not None:
+        overrides["max_keywords"] = args.max_keywords
+    if args.cache_ttl is not None:
+        overrides["cache_ttl_secs"] = args.cache_ttl
+    if args.learning_enabled is not None:
+        overrides["learning_enabled"] = args.learning_enabled
+    if args.learning_top_n is not None:
+        overrides["learning_top_n"] = args.learning_top_n
+    if args.learning_max_lines is not None:
+        overrides["learning_max_lines"] = args.learning_max_lines
+    if args.learning_embedding_backend is not None:
+        overrides["learning_embedding_backend"] = args.learning_embedding_backend
+    if args.learning_embedding_model is not None:
+        overrides["learning_embedding_model"] = args.learning_embedding_model
+    if args.learning_extraction_strategy is not None:
+        overrides["learning_extraction_strategy"] = args.learning_extraction_strategy
+    if args.learning_relevance_cache_ttl is not None:
+        overrides["learning_relevance_cache_ttl"] = args.learning_relevance_cache_ttl
+    config = config.with_values(**overrides)
+    store.save_project(config)
+    print("Reasoning Plus configuration updated.")
+    return 0
+
+
+def cmd_reasoning_plus_reset(args: argparse.Namespace) -> int:
+    store = _reasoning_plus_store(args)
+    if store._project_dir is None:
+        print("error: no initialized .GCC/ repo found. Run devtorch init first.", file=sys.stderr)
+        return 1
+    store.reset_project()
+    print("Reasoning Plus project settings reset; will fall back to global/default.")
+    return 0
+
+
+def cmd_reasoning_plus_cross_project_suggest(args: argparse.Namespace) -> int:
+    """Suggest relevant learnings from sibling governed projects."""
+    from devtorch_core.reasoning_plus.learning import ReasoningPlusLearning
+    from devtorch_core.reasoning_plus import ReasoningPlusConfig
+
+    project_root = Path(args.path).resolve()
+    gcc_dir = project_root / ".GCC"
+    if not gcc_dir.exists():
+        print("error: no initialized .GCC/ repo found. Run devtorch init first.", file=sys.stderr)
+        return 1
+    config = ReasoningPlusConfig(learning_enabled=True)
+    drpl = ReasoningPlusLearning(gcc_dir=gcc_dir, repo_path=project_root, config=config)
+    learnings = drpl.cross_project_suggest(args.query, top_n=args.top_n)
+    if not learnings:
+        print("No relevant cross-project learnings found.")
+        return 0
+    print(f"Found {len(learnings)} relevant cross-project learning(s):")
+    for i, learning in enumerate(learnings, 1):
+        short = learning.short_form(max_chars=200)
+        print(f"  {i}. [{learning.type}] {short}")
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+
+    # Friendly default: show dashboard in an initialized repo, otherwise welcome guide.
+    if args.command is None:
+        repo = GCCRepository.at(Path(args.path).resolve())
+        if repo.is_initialized():
+            return cmd_today(args)
+        return cmd_welcome(args)
+
+    # S11: mcp-server
+    if args.command == "mcp-server":
+        if args.transport == "sse":
+            import os
+            from devtorch_core.mcp.server import _run_with_sse
+            from devtorch_core.storage import create_backend_from_env
+
+            org_id = os.environ.get("DEVTORCH_ORG_ID", "").strip()
+            if not org_id:
+                print("error: DEVTORCH_ORG_ID is required for SSE transport.", file=sys.stderr)
+                return 1
+
+            try:
+                auth_backend = create_backend_from_env(prefix=org_id)
+            except (KeyError, ValueError) as exc:
+                print(f"error: storage configuration: {exc}", file=sys.stderr)
+                return 1
+
+            def repo_factory(req_org: str, repo_id: str):
+                from devtorch_core.gcc import GCCRepository
+                from pathlib import Path
+                backend = create_backend_from_env(prefix=f"{req_org}/{repo_id}/.GCC")
+                return GCCRepository(root=Path(f"/tmp/{req_org}/{repo_id}"), backend=backend)
+
+            _run_with_sse(
+                repo_factory=repo_factory,
+                auth_backend=auth_backend,
+                host=args.host,
+                port=args.port,
+            )
+        else:
+            from devtorch_core.mcp.server import main as mcp_main
+            mcp_main()
+        return 0
+
+    if args.command == "cloud":
+        import os
+        import json
+        import secrets
+        import hashlib
+        import datetime
+        from devtorch_core.storage import create_backend_from_env
+
+        # setup, client-config, and sync do not need the admin backend; they are local.
+        if args.cloud_command == "setup":
+            return args.func(args)
+        if args.cloud_command == "client-config":
+            return args.func(args)
+        if args.cloud_command == "sync":
+            from devtorch_core.cloud.sync import sync_commits
+
+            root = Path(args.path).resolve()
+            from_now = getattr(args, "from_now", False)
+
+            if from_now:
+                # Pure cursor bookkeeping — no network I/O, no credentials.
+                try:
+                    result = sync_commits(root / ".GCC", "", "", from_now=True)
+                except ValueError as exc:
+                    print(f"error: {exc}", file=sys.stderr)
+                    return 1
+                print(
+                    f"Cursor set to {result['cursor']}; nothing pushed — "
+                    "commits from here on will sync."
+                )
+                return 0
+
+            url = os.environ.get("DEVTORCH_MCP_URL", "")
+            api_key = os.environ.get("DEVTORCH_API_KEY", "")
+            if not url or not api_key:
+                try:
+                    mcp = json.loads((root / ".mcp.json").read_text(encoding="utf-8"))
+                    env_cfg = mcp["mcpServers"]["devtorch"]["env"]
+                    url = url or env_cfg.get("DEVTORCH_MCP_URL", "")
+                    api_key = api_key or env_cfg.get("DEVTORCH_API_KEY", "")
+                except (OSError, KeyError, TypeError, json.JSONDecodeError):
+                    pass
+            if not url or not api_key:
+                print("error: need DEVTORCH_MCP_URL and DEVTORCH_API_KEY (env or .mcp.json)", file=sys.stderr)
+                return 1
+            messages_url = url.rstrip("/").removesuffix("/sse") + "/messages?sessionId=cli-sync"
+            try:
+                result = sync_commits(root / ".GCC", messages_url, api_key)
+            except Exception as exc:
+                print(f"error: cloud sync failed — {exc}", file=sys.stderr)
+                return 1
+            print(f"Pushed {result['pushed']} commit(s); cursor at {result['cursor']}.")
+            return 0
+
+        try:
+            _admin_backend = create_backend_from_env(prefix=args.org)
+        except (KeyError, ValueError) as exc:
+            print(f"error: storage configuration: {exc}", file=sys.stderr)
+            return 1
+
+        _KEYS_PATH = ".devtorch/api_keys.json"
+
+        if args.cloud_command == "key":
+            if args.key_command == "create":
+                raw_key = secrets.token_urlsafe(32)
+                key_hash = hashlib.sha256(raw_key.encode()).hexdigest()
+                try:
+                    existing = json.loads(_admin_backend.read_bytes(_KEYS_PATH))
+                except FileNotFoundError:
+                    existing = {}
+                existing[key_hash] = {
+                    "org_id": args.org,
+                    "allowed_repos": [args.repo] if args.repo else None,
+                    "created_at": datetime.datetime.now(datetime.timezone.utc).isoformat(),
+                }
+                _admin_backend.write_bytes(_KEYS_PATH, json.dumps(existing, indent=2).encode())
+                print(f"API key created. Store this — it will not be shown again:\n\n  {raw_key}\n")
+                if args.github:
+                    _set_github_secret(args.github, "DEVTORCH_API_KEY", raw_key)
+                return 0
+
+            elif args.key_command == "list":
+                try:
+                    data = json.loads(_admin_backend.read_bytes(_KEYS_PATH))
+                except FileNotFoundError:
+                    print("No API keys found.")
+                    return 0
+                except json.JSONDecodeError as exc:
+                    print(f"error: keys file is corrupted: {exc}", file=sys.stderr)
+                    return 1
+                if not data:
+                    print("No API keys found.")
+                    return 0
+                print(f"{'KEY HASH (first 16)':20}  {'ORG':16}  {'REPOS':20}  {'STATUS':10}  CREATED")
+                print("-" * 92)
+                for key_hash, entry in sorted(data.items(), key=lambda x: x[1].get("created_at", "")):
+                    repos = ",".join(entry.get("allowed_repos") or []) or "(all)"
+                    created = entry.get("created_at", "unknown")[:19]
+                    status = "revoked" if entry.get("revoked_at") else "active"
+                    print(f"{key_hash[:16]:20}  {entry.get('org_id',''):16}  {repos:20}  {status:10}  {created}")
+                return 0
+
+            elif args.key_command == "revoke":
+                try:
+                    data = json.loads(_admin_backend.read_bytes(_KEYS_PATH))
+                except FileNotFoundError:
+                    print("No API keys found.")
+                    return 1
+                except json.JSONDecodeError as exc:
+                    print(f"error: keys file is corrupted: {exc}", file=sys.stderr)
+                    return 1
+                if len(args.key_prefix) < 8:
+                    print("error: key_prefix must be at least 8 characters to avoid accidental matches.", file=sys.stderr)
+                    return 1
+                prefix_to_revoke = args.key_prefix.lower()
+                matches = [h for h in data if h.startswith(prefix_to_revoke)]
+                if not matches:
+                    print(f"No key found with prefix: {prefix_to_revoke}")
+                    return 1
+                if len(matches) > 1:
+                    print(f"Ambiguous prefix matches {len(matches)} keys. Use more characters.")
+                    return 1
+                if not args.yes:
+                    confirm = input(f"Revoke key {matches[0][:16]}...? This cannot be undone. [y/N] ").strip().lower()
+                    if confirm != "y":
+                        print("Aborted.")
+                        return 0
+                old_entry = data[matches[0]]
+                old_entry["revoked_at"] = datetime.datetime.now(datetime.timezone.utc).isoformat()
+                data[matches[0]] = old_entry
+                _admin_backend.write_bytes(_KEYS_PATH, json.dumps(data, indent=2).encode())
+                print(f"Revoked key {matches[0][:32]}...")
+                return 0
+
+            elif args.key_command == "rotate":
+                try:
+                    data = json.loads(_admin_backend.read_bytes(_KEYS_PATH))
+                except FileNotFoundError:
+                    print("No API keys found.")
+                    return 1
+                except json.JSONDecodeError as exc:
+                    print(f"error: keys file is corrupted: {exc}", file=sys.stderr)
+                    return 1
+                if len(args.key_prefix) < 8:
+                    print("error: key_prefix must be at least 8 characters to avoid accidental matches.", file=sys.stderr)
+                    return 1
+                prefix_to_rotate = args.key_prefix.lower()
+                matches = [h for h in data if h.startswith(prefix_to_rotate)]
+                if not matches:
+                    print(f"No key found with prefix: {prefix_to_rotate}")
+                    return 1
+                if len(matches) > 1:
+                    print(f"Ambiguous prefix matches {len(matches)} keys. Use more characters.")
+                    return 1
+                if not args.yes:
+                    confirm = input(f"Rotate key {matches[0][:16]}...? This will revoke the old key and create a new one. [y/N] ").strip().lower()
+                    if confirm != "y":
+                        print("Aborted.")
+                        return 0
+                old_hash = matches[0]
+                old_entry = data[old_hash]
+                old_entry["revoked_at"] = datetime.datetime.now(datetime.timezone.utc).isoformat()
+                old_entry["rotated_from"] = old_hash
+                data[old_hash] = old_entry
+
+                raw_key = secrets.token_urlsafe(32)
+                new_hash = hashlib.sha256(raw_key.encode()).hexdigest()
+                data[new_hash] = {
+                    "org_id": args.org,
+                    "allowed_repos": old_entry.get("allowed_repos"),
+                    "created_at": datetime.datetime.now(datetime.timezone.utc).isoformat(),
+                    "rotated_from": old_hash,
+                }
+                _admin_backend.write_bytes(_KEYS_PATH, json.dumps(data, indent=2).encode())
+                print(f"Rotated key {old_hash[:32]}... → {new_hash[:32]}...")
+                print(f"New API key (store safely — it will not be shown again):\n\n  {raw_key}\n")
+                return 0
+
+        if args.cloud_command == "repo":
+            import os
+            encryption_key_hex = os.environ.get("DEVTORCH_PAT_ENCRYPTION_KEY", "")
+            if not encryption_key_hex:
+                print("error: DEVTORCH_PAT_ENCRYPTION_KEY is required for repo operations.", file=sys.stderr)
+                return 1
+            try:
+                encryption_key = bytes.fromhex(encryption_key_hex)
+            except ValueError:
+                print("error: DEVTORCH_PAT_ENCRYPTION_KEY must be a hex string.", file=sys.stderr)
+                return 1
+
+            from devtorch_core.github.pat import GitHubPATStore
+            pat_store = GitHubPATStore(backend=_admin_backend, encryption_key=encryption_key)
+
+            if args.repo_command == "connect":
+                if args.pat:
+                    pat_store.store_pat(repo_id=args.repo, pat=args.pat, github_repo=args.github)
+                    print(f"Connected: {args.org}/{args.repo} → github.com/{args.github} (PAT)")
+                elif args.github_app:
+                    print("GitHub App connection is managed automatically via webhook.")
+                    print("Install the DevTorch GitHub App on your repo — the server handles registration.")
+                return 0
+
+            elif args.repo_command == "list":
+                repos = pat_store.list_repos()
+                if not repos:
+                    print("No repositories connected.")
+                else:
+                    for r in repos:
+                        entry = pat_store.get_pat(r)
+                        github_repo = entry["github_repo"] if entry else "(PAT decryption failed)"
+                        print(f"  {r} → github.com/{github_repo}")
+                return 0
+
+            elif args.repo_command == "disconnect":
+                pat_store.delete_pat(repo_id=args.repo)
+                print(f"Disconnected: {args.repo}")
+                return 0
+
+        print(f"error: unknown cloud command: {args.cloud_command}", file=sys.stderr)
+        return 1
+
+    # S11: hooks
+    if args.command == "hooks":
+        from devtorch_core.hooks.installer import install_all_hooks, get_hooks_status
+
+        # Try to resolve the project root from a GCC repo, fall back to cwd
+        try:
+            gcc_repo = GCCRepository.at(Path(args.path).resolve())
+            project_root = str(gcc_repo.root) if gcc_repo.is_initialized() else args.path
+        except Exception:
+            project_root = args.path
+
+        if args.hooks_command == "install":
+            result = install_all_hooks(project_root)
+            print(f"Claude hooks: {'✓' if result.claude_hooks_written else '✗'} {result.claude_hooks_path}")
+            print(f"Git hook:     {'✓' if result.git_hook_written else '✗'} {result.git_hook_path}")
+            if getattr(result, "git_capture_hooks_written", False):
+                print(f"Git capture hooks: ✓ ({len(result.git_capture_hooks)} installed)")
+            else:
+                print(f"Git capture hooks: ✗")
+            if result.errors:
+                for e in result.errors:
+                    print(f"  Error: {e}")
+        elif args.hooks_command == "status":
+            status = get_hooks_status(project_root)
+            for k, v in status.items():
+                print(f"{k}: {v}")
+        elif args.hooks_command == "git-commit":
+            from devtorch_core.hooks.git_commit import handle_commit_msg
+            handle_commit_msg(args.commit_msg_file)
+        elif args.hooks_command == "git-capture":
+            from devtorch_core.hooks.git_capture import handle_git_capture
+            handle_git_capture(args.event, args.args)
+        elif args.hooks_command == "run":
+            from devtorch_core.hooks.runner import run as run_hook
+            run_hook(args.hook_name)
+        return 0
+
+    if args.command == "reasoning":
+        if getattr(args, "reasoning_cmd", None) is None:
+            # Print help when no subcommand given
+            build_parser().parse_args(["reasoning", "--help"])
+            return 0
+        return args.func(args)
+
+    if args.command == "reasoning-plus":
+        if getattr(args, "reasoning_plus_cmd", None) is None:
+            build_parser().parse_args(["reasoning-plus", "--help"])
+            return 0
+        return args.func(args)
+
+    return args.func(args)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
+