diff --git a/src/Sovrant.Runtime/Storage/PostgresSchema.sql b/db/postgres/PostgresSchema.sql
similarity index 85%
rename from src/Sovrant.Runtime/Storage/PostgresSchema.sql
rename to db/postgres/PostgresSchema.sql
index d1c0b0a0..9bd4157c 100644
--- a/src/Sovrant.Runtime/Storage/PostgresSchema.sql
+++ b/db/postgres/PostgresSchema.sql
@@ -1,5 +1,6 @@
--- Sovrant PostgreSQL schema (Supabase-compatible).
--- Mirrors V001–V042 SQLite migrations. Safe to run multiple times (idempotent).
+-- Sovrant standalone PostgreSQL schema.
+-- Mirrors V001–V043 SQLite migrations. Safe to run multiple times (idempotent).
+-- For Supabase deployments use supabase/migrations/ instead (includes GoTrue auth triggers).
 -- Timestamps are stored as TEXT (ISO 8601) for wire-compatibility with SQLite stores.
 -- BYTEA used for encrypted blobs (credentials table).
 -- V035/V037 (built-in knowledge seed data) are handled by the app at startup, not here.
@@ -11,7 +12,6 @@
 
 CREATE TABLE IF NOT EXISTS users (
     user_id       TEXT PRIMARY KEY,
-    username      TEXT NOT NULL,
     email         TEXT,
     role          TEXT NOT NULL DEFAULT 'user',
     team          TEXT,
@@ -19,8 +19,7 @@ CREATE TABLE IF NOT EXISTS users (
     password_hash TEXT,
     created_at    TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
     updated_at    TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
-    CONSTRAINT users_username_unique UNIQUE (username),
-    CONSTRAINT users_email_unique    UNIQUE (email)
+    CONSTRAINT users_email_unique UNIQUE (email)
 );
 
 CREATE TABLE IF NOT EXISTS workspaces (
@@ -759,9 +758,13 @@ CREATE INDEX IF NOT EXISTS ix_session_summaries_owner ON session_summaries(owner
 CREATE INDEX IF NOT EXISTS ix_learned_patterns_owner  ON learned_patterns(owner_user_id);
 CREATE INDEX IF NOT EXISTS ix_instincts_owner         ON instincts(owner_user_id);
 
+-- ── V043 Drop username column ─────────────────────────────────────────────────
+-- For instances initialized before V043. Fresh installs never had this column.
+-- V043's PK rewrite (usr_{hex} → email) applies to SQLite standalone only.
+
+ALTER TABLE public.users DROP COLUMN IF EXISTS username;
+
 -- ── Schema version tracking ───────────────────────────────────────────────────
--- Records the last successfully applied schema version so the admin UI
--- can show "Up to date" vs "Needs initialization".
 
 CREATE TABLE IF NOT EXISTS sovrant_schema_version (
     id          INTEGER PRIMARY KEY DEFAULT 1,
@@ -771,127 +774,5 @@ CREATE TABLE IF NOT EXISTS sovrant_schema_version (
 );
 
 INSERT INTO sovrant_schema_version (id, version)
-VALUES (1, 42)
+VALUES (1, 43)
 ON CONFLICT (id) DO UPDATE SET version = EXCLUDED.version, applied_at = EXCLUDED.applied_at;
-
--- ════════════════════════════════════════════════════════════════════════════════
--- SUPABASE AUTH EXTENSION
--- Run this section ONLY on Supabase-hosted deployments, AFTER the schema above.
--- Standalone PostgreSQL deployments skip this entire section.
---
--- Why: Supabase Auth stores identities in auth.users (UUID PK, managed by GoTrue).
--- The app uses public.users (TEXT PK) as the FK anchor for all domain tables.
--- These triggers keep public.users in sync automatically so every FK constraint
--- continues to work without any application code changes.
---
--- user_id = auth.users.id::TEXT — UUID string, compatible with TEXT PK on all
--- existing FK columns (workspaces, workspace_members, api_tokens, user_roles,
--- project_members, password_reset_tokens).
--- ════════════════════════════════════════════════════════════════════════════════
-
--- ── Mirror trigger: auth.users INSERT → public.users INSERT ──────────────────
-
-CREATE OR REPLACE FUNCTION public.handle_auth_user_created()
-RETURNS TRIGGER LANGUAGE plpgsql SECURITY DEFINER SET search_path = public AS $$
-DECLARE
-    _role TEXT;
-BEGIN
-    -- Read sovrant_role from app_metadata (service-role only, user cannot self-set).
-    -- Whitelist: only 'admin' is elevated; anything else (missing, null, unknown) → 'user'.
-    _role := CASE
-        WHEN NEW.raw_app_meta_data->>'sovrant_role' = 'admin' THEN 'admin'
-        ELSE 'user'
-    END;
-
-    INSERT INTO public.users (user_id, username, email, role, status, created_at, updated_at)
-    VALUES (
-        NEW.id::TEXT,
-        COALESCE(NEW.raw_user_meta_data->>'username', split_part(NEW.email, '@', 1)),
-        NEW.email,
-        _role,
-        'active',
-        to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
-        to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')
-    )
-    ON CONFLICT (user_id) DO NOTHING;
-    RETURN NEW;
-END;
-$$;
-
-CREATE OR REPLACE TRIGGER on_auth_user_created
-    AFTER INSERT ON auth.users
-    FOR EACH ROW EXECUTE FUNCTION public.handle_auth_user_created();
-
--- ── Mirror trigger: auth.users email/role UPDATE → public.users UPDATE ───────
--- Fires on email changes AND raw_app_meta_data changes so that setting
--- sovrant_role in app_metadata immediately syncs to public.users.role.
-
-CREATE OR REPLACE FUNCTION public.handle_auth_user_updated()
-RETURNS TRIGGER LANGUAGE plpgsql SECURITY DEFINER SET search_path = public AS $$
-DECLARE
-    _role TEXT;
-BEGIN
-    IF NEW.raw_app_meta_data IS DISTINCT FROM OLD.raw_app_meta_data THEN
-        _role := CASE
-            WHEN NEW.raw_app_meta_data->>'sovrant_role' = 'admin' THEN 'admin'
-            ELSE 'user'
-        END;
-        UPDATE public.users
-        SET    email      = NEW.email,
-               role       = _role,
-               updated_at = to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')
-        WHERE  user_id = NEW.id::TEXT;
-    ELSE
-        UPDATE public.users
-        SET    email      = NEW.email,
-               updated_at = to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')
-        WHERE  user_id = NEW.id::TEXT;
-    END IF;
-    RETURN NEW;
-END;
-$$;
-
-CREATE OR REPLACE TRIGGER on_auth_user_updated
-    AFTER UPDATE OF email, raw_app_meta_data ON auth.users
-    FOR EACH ROW EXECUTE FUNCTION public.handle_auth_user_updated();
-
--- ── Notes for Supabase deployments ───────────────────────────────────────────
--- • public.users.password_hash is always NULL for Supabase-authenticated users.
---   GoTrue owns password management; the column is inert and kept for schema
---   parity with SQLite / standalone Postgres deployments.
--- • password_reset_tokens is also inert — Supabase handles password resets.
---   The table is retained so the schema remains identical across all modes.
--- • svt_* api_tokens still work for CLI / headless API access in Supabase mode.
---   Only interactive UI sessions use JWTs; machine tokens use the token table.
--- • First admin: create the user in the Supabase dashboard (Auth → Users).
---   The mirror trigger fires automatically (role defaults to 'user'). Elevate to
---   admin by setting sovrant_role in app_metadata (service-role only):
---     UPDATE auth.users
---     SET    raw_app_meta_data = jsonb_set(
---                COALESCE(raw_app_meta_data, '{}'), '{sovrant_role}', '"admin"')
---     WHERE  email = 'you@example.com';
---   The on_auth_user_updated trigger fires and syncs role = 'admin' to
---   public.users automatically. Never UPDATE public.users.role directly.
-
--- ── Row-Level Security (recommended for Supabase deployments) ────────────────
--- Uncomment to enforce the owner_user_id privacy model at the database layer
--- rather than relying solely on application-layer query filters. Required if
--- any Supabase Edge Functions, dashboard queries, or service-role clients need
--- to respect per-user memory privacy without going through the Sovrant API.
-
--- ALTER TABLE workspace_memory  ENABLE ROW LEVEL SECURITY;
--- ALTER TABLE session_summaries ENABLE ROW LEVEL SECURITY;
--- ALTER TABLE learned_patterns  ENABLE ROW LEVEL SECURITY;
--- ALTER TABLE instincts         ENABLE ROW LEVEL SECURITY;
-
--- CREATE POLICY workspace_memory_owner ON workspace_memory
---     USING (is_private = 0 OR owner_user_id = auth.uid()::text);
-
--- CREATE POLICY session_summaries_owner ON session_summaries
---     USING (owner_user_id = '' OR owner_user_id = auth.uid()::text);
-
--- CREATE POLICY learned_patterns_owner ON learned_patterns
---     USING (owner_user_id = '' OR owner_user_id = auth.uid()::text);
-
--- CREATE POLICY instincts_owner ON instincts
---     USING (owner_user_id = '' OR owner_user_id = auth.uid()::text);
diff --git a/db/supabase/config.toml b/db/supabase/config.toml
new file mode 100644
index 00000000..98c5592c
--- /dev/null
+++ b/db/supabase/config.toml
@@ -0,0 +1,40 @@
+# Supabase CLI project configuration.
+# Run migrations from this directory: cd db/supabase && supabase db push
+# Or link to a remote project:        supabase link --project-ref <ref>
+
+[api]
+enabled = true
+port = 54321
+schemas = ["public", "storage", "graphql_public"]
+extra_search_path = ["public", "extensions"]
+max_rows = 1000
+
+[db]
+port = 54322
+shadow_port = 54320
+major_version = 15
+
+[studio]
+enabled = true
+port = 54323
+
+[inbucket]
+enabled = true
+port = 54324
+
+[storage]
+enabled = true
+
+[auth]
+enabled = true
+# Sovrant uses public.users as the domain anchor.
+# The GoTrue auth.users mirror triggers are in the initial migration.
+site_url = "http://localhost:5100"
+additional_redirect_urls = ["http://localhost:5100"]
+jwt_expiry = 3600
+enable_signup = true
+
+[auth.email]
+enable_signup = true
+double_confirm_changes = true
+enable_confirmations = false
diff --git a/db/supabase/migrations/20260625000000_initial_schema.sql b/db/supabase/migrations/20260625000000_initial_schema.sql
new file mode 100644
index 00000000..2cee1e1c
--- /dev/null
+++ b/db/supabase/migrations/20260625000000_initial_schema.sql
@@ -0,0 +1,876 @@
+-- Sovrant initial schema for Supabase deployments.
+-- Mirrors V001–V043 SQLite migrations. Safe to run multiple times (idempotent).
+-- For standalone PostgreSQL use db/postgres/PostgresSchema.sql instead.
+--
+-- Timestamps are stored as TEXT (ISO 8601) for wire-compatibility with SQLite stores.
+-- BYTEA used for encrypted blobs (credentials table).
+-- V035/V037 (built-in knowledge seed data) are handled by the app at startup, not here.
+--
+-- NOTE: user_id remains the GoTrue UUID (auth.users.id::TEXT) in Supabase mode.
+-- V043's PK rewrite (usr_{hex} → email) applies to SQLite standalone deployments only.
+
+-- ── V001 Foundation ───────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS users (
+    user_id       TEXT PRIMARY KEY,
+    email         TEXT,
+    role          TEXT NOT NULL DEFAULT 'user',
+    team          TEXT,
+    status        TEXT NOT NULL DEFAULT 'active',
+    password_hash TEXT,
+    created_at    TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    updated_at    TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    CONSTRAINT users_email_unique UNIQUE (email)
+);
+
+CREATE TABLE IF NOT EXISTS workspaces (
+    workspace_id TEXT PRIMARY KEY,
+    type         TEXT NOT NULL DEFAULT 'personal',
+    name         TEXT NOT NULL,
+    slug         TEXT NOT NULL,
+    owner_id     TEXT NOT NULL REFERENCES users(user_id),
+    created_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    updated_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    CONSTRAINT workspaces_slug_unique UNIQUE (slug)
+);
+
+CREATE TABLE IF NOT EXISTS workspace_members (
+    workspace_id TEXT NOT NULL REFERENCES workspaces(workspace_id),
+    user_id      TEXT NOT NULL REFERENCES users(user_id),
+    role         TEXT NOT NULL DEFAULT 'member',
+    joined_at    TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    PRIMARY KEY (workspace_id, user_id)
+);
+
+CREATE TABLE IF NOT EXISTS workspace_config (
+    workspace_id TEXT NOT NULL REFERENCES workspaces(workspace_id),
+    key          TEXT NOT NULL,
+    value        TEXT NOT NULL,
+    PRIMARY KEY (workspace_id, key)
+);
+
+CREATE TABLE IF NOT EXISTS workspace_invites (
+    invite_id    TEXT PRIMARY KEY,
+    workspace_id TEXT NOT NULL REFERENCES workspaces(workspace_id),
+    email        TEXT NOT NULL,
+    role         TEXT NOT NULL DEFAULT 'member',
+    token        TEXT NOT NULL,
+    expires_at   TEXT NOT NULL,
+    accepted_at  TEXT,
+    created_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    CONSTRAINT workspace_invites_token_unique UNIQUE (token)
+);
+
+CREATE TABLE IF NOT EXISTS projects (
+    project_id   TEXT PRIMARY KEY,
+    workspace_id TEXT REFERENCES workspaces(workspace_id),
+    name         TEXT NOT NULL,
+    slug         TEXT NOT NULL,
+    description  TEXT,
+    created_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    updated_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    archived_at  TEXT,
+    CONSTRAINT projects_ws_slug_unique UNIQUE (workspace_id, slug)
+);
+
+CREATE TABLE IF NOT EXISTS project_members (
+    project_id TEXT NOT NULL REFERENCES projects(project_id),
+    user_id    TEXT NOT NULL REFERENCES users(user_id),
+    role       TEXT NOT NULL DEFAULT 'contributor',
+    joined_at  TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    PRIMARY KEY (project_id, user_id)
+);
+
+CREATE TABLE IF NOT EXISTS project_config (
+    project_id TEXT NOT NULL REFERENCES projects(project_id),
+    key        TEXT NOT NULL,
+    value      TEXT NOT NULL,
+    PRIMARY KEY (project_id, key)
+);
+
+CREATE TABLE IF NOT EXISTS config (
+    scope      TEXT NOT NULL,
+    key        TEXT NOT NULL,
+    value      TEXT NOT NULL,
+    updated_at TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    PRIMARY KEY (scope, key)
+);
+
+CREATE TABLE IF NOT EXISTS api_tokens (
+    token_id     TEXT PRIMARY KEY,
+    user_id      TEXT NOT NULL REFERENCES users(user_id),
+    token_hash   TEXT NOT NULL,
+    token_prefix TEXT NOT NULL,
+    name         TEXT,
+    scopes       TEXT,
+    created_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    expires_at   TEXT,
+    revoked_at   TEXT,
+    last_used_at TEXT,
+    CONSTRAINT api_tokens_hash_unique UNIQUE (token_hash)
+);
+
+CREATE TABLE IF NOT EXISTS roles (
+    role_id     TEXT PRIMARY KEY,
+    name        TEXT NOT NULL,
+    description TEXT,
+    is_system   INTEGER NOT NULL DEFAULT 0,
+    created_at  TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    CONSTRAINT roles_name_unique UNIQUE (name)
+);
+
+CREATE TABLE IF NOT EXISTS permissions (
+    permission_id TEXT PRIMARY KEY,
+    name          TEXT NOT NULL,
+    description   TEXT,
+    CONSTRAINT permissions_name_unique UNIQUE (name)
+);
+
+CREATE TABLE IF NOT EXISTS role_permissions (
+    role_id       TEXT NOT NULL REFERENCES roles(role_id),
+    permission_id TEXT NOT NULL REFERENCES permissions(permission_id),
+    PRIMARY KEY (role_id, permission_id)
+);
+
+CREATE TABLE IF NOT EXISTS user_roles (
+    user_id      TEXT NOT NULL REFERENCES users(user_id),
+    role_id      TEXT NOT NULL REFERENCES roles(role_id),
+    workspace_id TEXT NOT NULL DEFAULT '',
+    granted_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    PRIMARY KEY (user_id, role_id, workspace_id)
+);
+
+CREATE TABLE IF NOT EXISTS audit_governance (
+    id           BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    timestamp    TEXT NOT NULL,
+    phase        TEXT NOT NULL,
+    tool         TEXT NOT NULL,
+    session_id   TEXT,
+    workspace_id TEXT,
+    project_id   TEXT,
+    action       TEXT NOT NULL,
+    rule         TEXT NOT NULL,
+    reason       TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS audit_bash (
+    id           BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    timestamp    TEXT NOT NULL,
+    command      TEXT NOT NULL,
+    session_id   TEXT,
+    workspace_id TEXT,
+    project_id   TEXT,
+    exit_code    INTEGER NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS ix_api_tokens_user          ON api_tokens(user_id);
+CREATE INDEX IF NOT EXISTS ix_api_tokens_hash          ON api_tokens(token_hash);
+CREATE INDEX IF NOT EXISTS ix_audit_governance_session ON audit_governance(session_id);
+CREATE INDEX IF NOT EXISTS ix_audit_bash_session       ON audit_bash(session_id);
+
+-- ── V002 Sessions ─────────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS sessions (
+    session_id   TEXT PRIMARY KEY,
+    user_id      TEXT NOT NULL DEFAULT '',
+    workspace_id TEXT,
+    project_id   TEXT,
+    model        TEXT,
+    status       TEXT NOT NULL DEFAULT 'active',
+    title        TEXT,
+    mcp_servers  TEXT,
+    started_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    ended_at     TEXT,
+    updated_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'))
+);
+
+CREATE TABLE IF NOT EXISTS session_entries (
+    entry_id      BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    session_id    TEXT NOT NULL REFERENCES sessions(session_id) ON DELETE CASCADE,
+    entry_uid     TEXT NOT NULL,
+    timestamp     TEXT NOT NULL,
+    role          TEXT NOT NULL,
+    content       TEXT NOT NULL,
+    model         TEXT,
+    provider      TEXT,
+    input_tokens  INTEGER NOT NULL DEFAULT 0,
+    output_tokens INTEGER NOT NULL DEFAULT 0,
+    tool_name     TEXT,
+    tool_use_id   TEXT,
+    is_error      INTEGER NOT NULL DEFAULT 0,
+    -- Full-text search via PostgreSQL tsvector (replaces SQLite FTS5)
+    search_vector tsvector GENERATED ALWAYS AS (to_tsvector('english', content)) STORED,
+    CONSTRAINT uq_session_entries_uid UNIQUE (session_id, entry_uid)
+);
+
+CREATE TABLE IF NOT EXISTS token_usage (
+    id            BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    session_id    TEXT NOT NULL,
+    user_id       TEXT NOT NULL DEFAULT '',
+    workspace_id  TEXT,
+    project_id    TEXT,
+    model         TEXT NOT NULL,
+    input_tokens  INTEGER NOT NULL DEFAULT 0,
+    output_tokens INTEGER NOT NULL DEFAULT 0,
+    cost_usd      DOUBLE PRECISION,
+    recorded_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'))
+);
+
+CREATE INDEX IF NOT EXISTS ix_sessions_user         ON sessions(user_id);
+CREATE INDEX IF NOT EXISTS ix_sessions_status       ON sessions(status);
+CREATE INDEX IF NOT EXISTS ix_sessions_workspace    ON sessions(workspace_id);
+CREATE INDEX IF NOT EXISTS ix_sessions_project      ON sessions(project_id);
+CREATE INDEX IF NOT EXISTS ix_session_entries_session ON session_entries(session_id);
+CREATE INDEX IF NOT EXISTS ix_session_entries_fts   ON session_entries USING GIN(search_vector);
+CREATE INDEX IF NOT EXISTS ix_token_usage_session   ON token_usage(session_id);
+CREATE INDEX IF NOT EXISTS ix_token_usage_user      ON token_usage(user_id);
+CREATE INDEX IF NOT EXISTS ix_token_usage_workspace ON token_usage(workspace_id);
+CREATE INDEX IF NOT EXISTS ix_token_usage_project   ON token_usage(project_id);
+
+-- ── V003 Memory ───────────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS session_summaries (
+    session_id           TEXT PRIMARY KEY,
+    project              TEXT NOT NULL,
+    workspace_id         TEXT,
+    started_at           TEXT NOT NULL,
+    ended_at             TEXT NOT NULL,
+    tasks                TEXT NOT NULL DEFAULT '[]',
+    tools_used           TEXT NOT NULL DEFAULT '[]',
+    files_modified       TEXT NOT NULL DEFAULT '[]',
+    outcome              TEXT NOT NULL DEFAULT 'Unknown',
+    total_input_tokens   INTEGER NOT NULL DEFAULT 0,
+    total_output_tokens  INTEGER NOT NULL DEFAULT 0,
+    turn_count           INTEGER NOT NULL DEFAULT 0,
+    error_count          INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS learned_patterns (
+    id             TEXT PRIMARY KEY,
+    pattern        TEXT NOT NULL,
+    project        TEXT NOT NULL,
+    source_session TEXT,
+    confidence     DOUBLE PRECISION NOT NULL DEFAULT 0.5,
+    created_at     TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    last_used      TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'))
+);
+
+CREATE TABLE IF NOT EXISTS instincts (
+    id         TEXT PRIMARY KEY,
+    trigger    TEXT NOT NULL,
+    action     TEXT NOT NULL,
+    confidence DOUBLE PRECISION NOT NULL DEFAULT 0.5,
+    evidence   TEXT NOT NULL DEFAULT '[]',
+    created_at TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    updated_at TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'))
+);
+
+CREATE INDEX IF NOT EXISTS ix_session_summaries_project   ON session_summaries(project);
+CREATE INDEX IF NOT EXISTS ix_session_summaries_workspace ON session_summaries(workspace_id);
+CREATE INDEX IF NOT EXISTS ix_learned_patterns_project    ON learned_patterns(project);
+
+-- ── V004 Credentials ──────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS credentials (
+    key_hash     TEXT PRIMARY KEY,
+    user_id      TEXT NOT NULL DEFAULT '',
+    workspace_id TEXT,
+    nonce        BYTEA NOT NULL,
+    tag          BYTEA NOT NULL,
+    ciphertext   BYTEA NOT NULL,
+    created_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    updated_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'))
+);
+
+-- ── V005 Swarm + Evals ────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS swarm_events (
+    id             BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    swarm_id       TEXT NOT NULL,
+    event_type     TEXT NOT NULL,
+    agent_id       TEXT,
+    workspace_id   TEXT,
+    project_id     TEXT,
+    payload        TEXT NOT NULL DEFAULT '{}',
+    timestamp      TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    kind           TEXT NOT NULL DEFAULT 'swarm',
+    run_id         TEXT,
+    user_id        TEXT,
+    parent_swarm_id TEXT
+);
+
+CREATE TABLE IF NOT EXISTS eval_runs (
+    run_id           TEXT PRIMARY KEY,
+    suite_name       TEXT NOT NULL,
+    workspace_id     TEXT,
+    started_at       TEXT NOT NULL,
+    duration_seconds DOUBLE PRECISION NOT NULL DEFAULT 0,
+    pass_rate        DOUBLE PRECISION NOT NULL DEFAULT 0,
+    pass_at_1_rate   DOUBLE PRECISION NOT NULL DEFAULT 0,
+    total_passed     INTEGER NOT NULL DEFAULT 0,
+    total_failed     INTEGER NOT NULL DEFAULT 0,
+    total_skipped    INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS eval_results (
+    id               BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    run_id           TEXT NOT NULL REFERENCES eval_runs(run_id) ON DELETE CASCADE,
+    eval_name        TEXT NOT NULL,
+    category         TEXT NOT NULL,
+    grader_type      TEXT NOT NULL,
+    passed           INTEGER NOT NULL DEFAULT 0,
+    pass_at_1        INTEGER NOT NULL DEFAULT 0,
+    pass_count       INTEGER NOT NULL DEFAULT 0,
+    attempt_count    INTEGER NOT NULL DEFAULT 0,
+    average_score    DOUBLE PRECISION,
+    duration_seconds DOUBLE PRECISION NOT NULL DEFAULT 0,
+    skipped          INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE INDEX IF NOT EXISTS ix_swarm_events_swarm     ON swarm_events(swarm_id);
+CREATE INDEX IF NOT EXISTS ix_swarm_events_workspace ON swarm_events(workspace_id);
+CREATE INDEX IF NOT EXISTS ix_swarm_events_project   ON swarm_events(project_id);
+CREATE INDEX IF NOT EXISTS ix_swarm_events_run_id    ON swarm_events(run_id);
+CREATE INDEX IF NOT EXISTS ix_swarm_events_kind      ON swarm_events(kind);
+CREATE INDEX IF NOT EXISTS ix_swarm_events_user      ON swarm_events(user_id);
+CREATE INDEX IF NOT EXISTS ix_swarm_events_parent    ON swarm_events(parent_swarm_id);
+CREATE INDEX IF NOT EXISTS ix_eval_runs_suite        ON eval_runs(suite_name);
+CREATE INDEX IF NOT EXISTS ix_eval_runs_workspace    ON eval_runs(workspace_id);
+CREATE INDEX IF NOT EXISTS ix_eval_results_run       ON eval_results(run_id);
+
+-- ── V006 Workspace Memory ─────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS workspace_memory (
+    memory_id    TEXT PRIMARY KEY,
+    workspace_id TEXT NOT NULL REFERENCES workspaces(workspace_id) ON DELETE CASCADE,
+    layer        TEXT NOT NULL,
+    content      TEXT NOT NULL,
+    confidence   DOUBLE PRECISION,
+    project_id   TEXT,
+    created_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    updated_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'))
+);
+
+CREATE INDEX IF NOT EXISTS ix_workspace_memory_workspace ON workspace_memory(workspace_id);
+CREATE INDEX IF NOT EXISTS ix_workspace_memory_layer     ON workspace_memory(workspace_id, layer);
+CREATE INDEX IF NOT EXISTS ix_workspace_memory_project   ON workspace_memory(workspace_id, project_id);
+
+-- ── V010 Runtime Traces ───────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS runtime_traces (
+    id             BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    runtime_run_id TEXT NOT NULL,
+    plan_id        TEXT NOT NULL,
+    plan_version   INTEGER NOT NULL,
+    step_index     INTEGER,
+    entry_type     TEXT NOT NULL,
+    payload        TEXT NOT NULL DEFAULT '{}',
+    timestamp      TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    session_id     TEXT,
+    workspace_id   TEXT,
+    project_id     TEXT
+);
+
+CREATE TABLE IF NOT EXISTS mission_scratchpad (
+    id           BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    mission_id   TEXT NOT NULL,
+    step_index   INTEGER NOT NULL,
+    agent_id     TEXT,
+    namespace    TEXT NOT NULL DEFAULT 'default',
+    key          TEXT NOT NULL,
+    value        TEXT NOT NULL,
+    created_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    workspace_id TEXT,
+    project_id   TEXT
+);
+
+CREATE INDEX IF NOT EXISTS ix_runtime_traces_run        ON runtime_traces(runtime_run_id, id);
+CREATE INDEX IF NOT EXISTS ix_runtime_traces_entry_type ON runtime_traces(entry_type);
+CREATE INDEX IF NOT EXISTS ix_runtime_traces_workspace  ON runtime_traces(workspace_id);
+CREATE INDEX IF NOT EXISTS ix_runtime_traces_project    ON runtime_traces(project_id);
+CREATE INDEX IF NOT EXISTS ix_mission_scratchpad_mission   ON mission_scratchpad(mission_id, step_index);
+CREATE INDEX IF NOT EXISTS ix_mission_scratchpad_workspace ON mission_scratchpad(workspace_id);
+
+-- ── V011 Missions ─────────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS missions (
+    id            TEXT PRIMARY KEY,
+    goal          TEXT NOT NULL,
+    status        TEXT NOT NULL DEFAULT 'planning',
+    plan_json     TEXT NOT NULL DEFAULT '{}',
+    created_at    TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    updated_at    TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    completed_at  TEXT,
+    session_id    TEXT,
+    workspace_id  TEXT,
+    project_id    TEXT,
+    owner_user_id TEXT
+);
+
+CREATE TABLE IF NOT EXISTS mission_events (
+    id           BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    mission_id   TEXT NOT NULL,
+    event_type   TEXT NOT NULL,
+    payload      TEXT NOT NULL DEFAULT '{}',
+    timestamp    TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    workspace_id TEXT,
+    project_id   TEXT
+);
+
+CREATE INDEX IF NOT EXISTS ix_missions_status    ON missions(status);
+CREATE INDEX IF NOT EXISTS ix_missions_workspace ON missions(workspace_id);
+CREATE INDEX IF NOT EXISTS ix_missions_project   ON missions(project_id);
+CREATE INDEX IF NOT EXISTS ix_missions_owner     ON missions(owner_user_id);
+CREATE INDEX IF NOT EXISTS ix_mission_events_mission   ON mission_events(mission_id, id);
+CREATE INDEX IF NOT EXISTS ix_mission_events_workspace ON mission_events(workspace_id);
+
+-- ── V012 Unified Orchestration ────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS teams (
+    team_id               TEXT PRIMARY KEY,
+    workspace_id          TEXT NOT NULL,
+    project_id            TEXT,
+    name                  TEXT NOT NULL,
+    description           TEXT,
+    origin                TEXT NOT NULL DEFAULT 'user',
+    created_by            TEXT NOT NULL,
+    created_at            TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    run_mode              TEXT NOT NULL DEFAULT 'sequential',
+    max_concurrent        INTEGER NOT NULL DEFAULT 1,
+    file_locks_enabled    INTEGER NOT NULL DEFAULT 0,
+    quality_gate_enabled  INTEGER NOT NULL DEFAULT 0,
+    quality_gate_threshold INTEGER NOT NULL DEFAULT 7,
+    decomposition_mode    TEXT NOT NULL DEFAULT 'off'
+);
+
+CREATE TABLE IF NOT EXISTS team_members (
+    member_id     TEXT PRIMARY KEY,
+    team_id       TEXT NOT NULL REFERENCES teams(team_id) ON DELETE CASCADE,
+    workspace_id  TEXT NOT NULL,
+    project_id    TEXT,
+    name          TEXT NOT NULL,
+    role          TEXT NOT NULL DEFAULT 'general',
+    template      TEXT,
+    system_prompt TEXT,
+    allowed_tools TEXT,
+    model_level   TEXT,
+    created_by    TEXT NOT NULL,
+    created_at    TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    last_used_at  TEXT,
+    status        TEXT NOT NULL DEFAULT 'active'
+);
+
+CREATE TABLE IF NOT EXISTS agent_runs (
+    run_id        TEXT PRIMARY KEY,
+    parent_run_id TEXT,
+    team_id       TEXT,
+    member_id     TEXT,
+    workspace_id  TEXT NOT NULL,
+    project_id    TEXT,
+    user_id       TEXT NOT NULL,
+    kind          TEXT NOT NULL,
+    status        TEXT NOT NULL DEFAULT 'queued',
+    started_at    TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    ended_at      TEXT,
+    input_tokens  INTEGER NOT NULL DEFAULT 0,
+    output_tokens INTEGER NOT NULL DEFAULT 0,
+    cost_usd      DOUBLE PRECISION,
+    prompt        TEXT
+);
+
+CREATE INDEX IF NOT EXISTS ix_teams_workspace      ON teams(workspace_id);
+CREATE INDEX IF NOT EXISTS ix_teams_project        ON teams(project_id);
+CREATE INDEX IF NOT EXISTS ix_teams_name           ON teams(workspace_id, name);
+CREATE INDEX IF NOT EXISTS ix_team_members_team      ON team_members(team_id);
+CREATE INDEX IF NOT EXISTS ix_team_members_workspace ON team_members(workspace_id);
+CREATE INDEX IF NOT EXISTS ix_agent_runs_parent    ON agent_runs(parent_run_id);
+CREATE INDEX IF NOT EXISTS ix_agent_runs_team      ON agent_runs(team_id);
+CREATE INDEX IF NOT EXISTS ix_agent_runs_workspace ON agent_runs(workspace_id);
+CREATE INDEX IF NOT EXISTS ix_agent_runs_user      ON agent_runs(user_id);
+CREATE INDEX IF NOT EXISTS ix_agent_runs_kind      ON agent_runs(kind);
+CREATE INDEX IF NOT EXISTS ix_agent_runs_status    ON agent_runs(status);
+
+-- ── V013 Coordination Mailbox ─────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS coordination_events (
+    id                BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    source_group_id   TEXT NOT NULL,
+    target_group_id   TEXT NOT NULL,
+    event_type        TEXT NOT NULL,
+    payload           TEXT NOT NULL DEFAULT '{}',
+    status            TEXT NOT NULL DEFAULT 'pending',
+    workspace_id      TEXT NOT NULL,
+    project_id        TEXT,
+    created_at        TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    delivered_at      TEXT,
+    acknowledged_at   TEXT
+);
+
+CREATE TABLE IF NOT EXISTS group_pm_assignments (
+    group_id      TEXT PRIMARY KEY,
+    group_type    TEXT NOT NULL,
+    pm_template   TEXT NOT NULL DEFAULT 'pm-coordinator',
+    workspace_id  TEXT NOT NULL,
+    project_id    TEXT,
+    created_at    TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'))
+);
+
+CREATE INDEX IF NOT EXISTS ix_coordination_events_target ON coordination_events(target_group_id, status);
+CREATE INDEX IF NOT EXISTS ix_coordination_events_source ON coordination_events(source_group_id);
+CREATE INDEX IF NOT EXISTS ix_coordination_events_ws     ON coordination_events(workspace_id);
+CREATE INDEX IF NOT EXISTS ix_group_pm_assignments_ws    ON group_pm_assignments(workspace_id);
+
+-- ── V017 Hooks ────────────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS hooks (
+    hook_id      TEXT PRIMARY KEY,
+    event        TEXT    NOT NULL,
+    command      TEXT    NOT NULL,
+    matcher_tool TEXT,
+    matcher_glob TEXT,
+    timeout_ms   INTEGER NOT NULL DEFAULT 30000,
+    enabled      INTEGER NOT NULL DEFAULT 1,
+    created_at   TEXT    NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    updated_at   TEXT    NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'))
+);
+
+CREATE INDEX IF NOT EXISTS hooks_event_enabled_idx ON hooks(event) WHERE enabled = 1;
+
+-- ── V018 Workspace Settings ───────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS workspace_settings (
+    workspace_id TEXT NOT NULL DEFAULT '',
+    key          TEXT NOT NULL,
+    value        TEXT NOT NULL,
+    updated_at   TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    PRIMARY KEY (workspace_id, key)
+);
+
+CREATE INDEX IF NOT EXISTS workspace_settings_key_idx ON workspace_settings(key);
+
+-- ── V019 MCP/LSP Servers ──────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS mcp_servers (
+    id                TEXT NOT NULL DEFAULT '',
+    name              TEXT PRIMARY KEY,
+    command           TEXT NOT NULL DEFAULT '',
+    args_json         TEXT NOT NULL DEFAULT '[]',
+    env_json          TEXT NOT NULL DEFAULT '{}',
+    oauth_config_json TEXT,
+    url               TEXT,
+    headers_json      TEXT NOT NULL DEFAULT '{}',
+    created_at        TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    updated_at        TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_mcp_servers_id ON mcp_servers(id) WHERE id <> '';
+
+CREATE TABLE IF NOT EXISTS lsp_servers (
+    language   TEXT PRIMARY KEY,
+    command    TEXT NOT NULL DEFAULT '',
+    args_json  TEXT NOT NULL DEFAULT '[]',
+    env_json   TEXT NOT NULL DEFAULT '{}',
+    created_at TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    updated_at TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'))
+);
+
+-- ── V020 User Preferences ─────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS user_preferences (
+    user_id    TEXT NOT NULL,
+    key        TEXT NOT NULL,
+    value      TEXT NOT NULL,
+    updated_at TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    PRIMARY KEY (user_id, key)
+);
+
+CREATE INDEX IF NOT EXISTS user_preferences_key_idx ON user_preferences(key);
+
+-- ── V021 Provider Profiles ────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS provider_profiles (
+    profile_id     TEXT PRIMARY KEY,
+    user_id        TEXT NOT NULL,
+    name           TEXT NOT NULL,
+    provider_kind  TEXT NOT NULL,
+    base_url       TEXT NOT NULL,
+    default_model  TEXT,
+    max_tokens     INTEGER,
+    credential_id  TEXT NOT NULL,
+    workspace_id   TEXT,
+    created_at     TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    updated_at     TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'))
+);
+
+CREATE INDEX IF NOT EXISTS provider_profiles_user_idx      ON provider_profiles(user_id);
+CREATE INDEX IF NOT EXISTS provider_profiles_workspace_idx ON provider_profiles(workspace_id)
+    WHERE workspace_id IS NOT NULL;
+
+-- ── V026 Auth Credentials ─────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS server_settings (
+    key        TEXT PRIMARY KEY,
+    value      TEXT NOT NULL,
+    updated_at TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'))
+);
+
+CREATE TABLE IF NOT EXISTS password_reset_tokens (
+    token_id   TEXT PRIMARY KEY,
+    user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+    token_hash TEXT NOT NULL,
+    created_at TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    expires_at TEXT NOT NULL,
+    used_at    TEXT,
+    CONSTRAINT prt_hash_unique UNIQUE (token_hash)
+);
+
+CREATE INDEX IF NOT EXISTS ix_prt_user ON password_reset_tokens(user_id);
+CREATE INDEX IF NOT EXISTS ix_prt_hash ON password_reset_tokens(token_hash);
+
+-- ── V030 Activity is Private ──────────────────────────────────────────────────
+
+ALTER TABLE missions   ADD COLUMN IF NOT EXISTS is_private INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE agent_runs ADD COLUMN IF NOT EXISTS is_private INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE sessions   ADD COLUMN IF NOT EXISTS is_private INTEGER NOT NULL DEFAULT 0;
+
+CREATE INDEX IF NOT EXISTS ix_missions_is_private   ON missions(is_private);
+CREATE INDEX IF NOT EXISTS ix_agent_runs_is_private ON agent_runs(is_private);
+CREATE INDEX IF NOT EXISTS ix_sessions_is_private   ON sessions(is_private);
+
+-- ── V031 Session Agent Name ───────────────────────────────────────────────────
+
+ALTER TABLE sessions ADD COLUMN IF NOT EXISTS agent_name TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_sessions_agent_name ON sessions(agent_name) WHERE agent_name IS NOT NULL;
+
+-- ── V032 MCP Trust Rules ──────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS mcp_trust_rules (
+    rule_id      TEXT NOT NULL PRIMARY KEY,
+    workspace_id TEXT NOT NULL,
+    server_name  TEXT NOT NULL,
+    tool_pattern TEXT NOT NULL,
+    action       TEXT NOT NULL,
+    reason       TEXT,
+    created_at   TEXT NOT NULL,
+    updated_at   TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_mcp_trust_rules_workspace ON mcp_trust_rules(workspace_id);
+CREATE INDEX IF NOT EXISTS idx_mcp_trust_rules_server    ON mcp_trust_rules(server_name);
+
+-- ── V033/V034/V036 Knowledge Pages ───────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS knowledge_pages (
+    knowledge_id      TEXT NOT NULL PRIMARY KEY,
+    kind              TEXT NOT NULL,
+    slug              TEXT NOT NULL,
+    name              TEXT NOT NULL,
+    description       TEXT NOT NULL DEFAULT '',
+    tier              TEXT NOT NULL DEFAULT 'User',
+    trigger           TEXT,
+    agents            TEXT,
+    tools             TEXT,
+    industry          TEXT,
+    default_format    TEXT,
+    category          TEXT,
+    role              TEXT,
+    recommended_level TEXT,
+    fields_json       TEXT,
+    filename_template TEXT,
+    body              TEXT NOT NULL DEFAULT '',
+    workspace_id      TEXT NOT NULL DEFAULT '',
+    created_at        TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    updated_at        TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    UNIQUE (kind, slug, workspace_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_knowledge_pages_kind      ON knowledge_pages(kind);
+CREATE INDEX IF NOT EXISTS idx_knowledge_pages_workspace ON knowledge_pages(workspace_id);
+
+ALTER TABLE knowledge_pages ADD COLUMN IF NOT EXISTS role              TEXT;
+ALTER TABLE knowledge_pages ADD COLUMN IF NOT EXISTS recommended_level TEXT;
+ALTER TABLE knowledge_pages ADD COLUMN IF NOT EXISTS fields_json       TEXT;
+ALTER TABLE knowledge_pages ADD COLUMN IF NOT EXISTS filename_template TEXT;
+
+-- ── V038 Knowledge Attributions ───────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS knowledge_attributions (
+    id          BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    session_id  TEXT    NOT NULL,
+    turn_index  INTEGER NOT NULL,
+    kind        TEXT    NOT NULL,
+    slug        TEXT    NOT NULL,
+    used_at     TEXT    NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_knowledge_attributions_session ON knowledge_attributions(session_id);
+
+-- ── V039 Keystore ─────────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS keystore (
+    scope      TEXT NOT NULL PRIMARY KEY,
+    key_hex    TEXT NOT NULL,
+    created_at TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'))
+);
+
+-- ── V040 MCP Server stable ID ────────────────────────────────────────────────
+
+ALTER TABLE mcp_servers ADD COLUMN IF NOT EXISTS id TEXT NOT NULL DEFAULT '';
+CREATE UNIQUE INDEX IF NOT EXISTS idx_mcp_servers_id ON mcp_servers(id) WHERE id <> '';
+UPDATE mcp_servers SET id = gen_random_uuid()::text WHERE id = '';
+
+-- ── V041 Workspace Memory Privacy ────────────────────────────────────────────
+
+ALTER TABLE workspace_memory ADD COLUMN IF NOT EXISTS owner_user_id TEXT NOT NULL DEFAULT '';
+ALTER TABLE workspace_memory ADD COLUMN IF NOT EXISTS is_private    INTEGER NOT NULL DEFAULT 0;
+
+CREATE INDEX IF NOT EXISTS ix_workspace_memory_owner ON workspace_memory(owner_user_id);
+
+-- ── V042 Memory Owner User ID ─────────────────────────────────────────────────
+
+ALTER TABLE session_summaries ADD COLUMN IF NOT EXISTS owner_user_id TEXT NOT NULL DEFAULT '';
+ALTER TABLE learned_patterns  ADD COLUMN IF NOT EXISTS owner_user_id TEXT NOT NULL DEFAULT '';
+ALTER TABLE instincts          ADD COLUMN IF NOT EXISTS owner_user_id TEXT NOT NULL DEFAULT '';
+
+CREATE INDEX IF NOT EXISTS ix_session_summaries_owner ON session_summaries(owner_user_id);
+CREATE INDEX IF NOT EXISTS ix_learned_patterns_owner  ON learned_patterns(owner_user_id);
+CREATE INDEX IF NOT EXISTS ix_instincts_owner         ON instincts(owner_user_id);
+
+-- ── V043 Drop username column ─────────────────────────────────────────────────
+-- Fresh installs never have this column. IF EXISTS makes this safe to run on both
+-- new and upgraded instances. user_id remains the GoTrue UUID in Supabase mode.
+
+ALTER TABLE public.users DROP COLUMN IF EXISTS username;
+
+-- ── Schema version tracking ───────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS sovrant_schema_version (
+    id          INTEGER PRIMARY KEY DEFAULT 1,
+    version     INTEGER NOT NULL,
+    applied_at  TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
+    CONSTRAINT single_row CHECK (id = 1)
+);
+
+INSERT INTO sovrant_schema_version (id, version)
+VALUES (1, 43)
+ON CONFLICT (id) DO UPDATE SET version = EXCLUDED.version, applied_at = EXCLUDED.applied_at;
+
+-- ════════════════════════════════════════════════════════════════════════════════
+-- SUPABASE AUTH EXTENSION
+-- Keeps public.users in sync with auth.users (GoTrue) automatically.
+-- Every time a user signs up or updates their email/role in Supabase Auth,
+-- these triggers mirror the change so all FK constraints remain intact.
+--
+-- user_id = auth.users.id::TEXT (UUID string, NOT the email address).
+-- The email-as-PK rewrite in V043 applies to SQLite standalone only.
+-- ════════════════════════════════════════════════════════════════════════════════
+
+-- ── Mirror trigger: auth.users INSERT → public.users INSERT ──────────────────
+
+CREATE OR REPLACE FUNCTION public.handle_auth_user_created()
+RETURNS TRIGGER LANGUAGE plpgsql SECURITY DEFINER SET search_path = public AS $$
+DECLARE
+    _role TEXT;
+BEGIN
+    -- Read sovrant_role from app_metadata (service-role only, user cannot self-set).
+    -- Whitelist: only 'admin' is elevated; anything else (missing, null, unknown) → 'user'.
+    _role := CASE
+        WHEN NEW.raw_app_meta_data->>'sovrant_role' = 'admin' THEN 'admin'
+        ELSE 'user'
+    END;
+
+    INSERT INTO public.users (user_id, email, role, status, created_at, updated_at)
+    VALUES (
+        NEW.id::TEXT,
+        NEW.email,
+        _role,
+        'active',
+        to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+        to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')
+    )
+    ON CONFLICT (user_id) DO NOTHING;
+    RETURN NEW;
+END;
+$$;
+
+CREATE OR REPLACE TRIGGER on_auth_user_created
+    AFTER INSERT ON auth.users
+    FOR EACH ROW EXECUTE FUNCTION public.handle_auth_user_created();
+
+-- ── Mirror trigger: auth.users email/role UPDATE → public.users UPDATE ───────
+-- Fires on email changes AND raw_app_meta_data changes so that setting
+-- sovrant_role in app_metadata immediately syncs to public.users.role.
+
+CREATE OR REPLACE FUNCTION public.handle_auth_user_updated()
+RETURNS TRIGGER LANGUAGE plpgsql SECURITY DEFINER SET search_path = public AS $$
+DECLARE
+    _role TEXT;
+BEGIN
+    IF NEW.raw_app_meta_data IS DISTINCT FROM OLD.raw_app_meta_data THEN
+        _role := CASE
+            WHEN NEW.raw_app_meta_data->>'sovrant_role' = 'admin' THEN 'admin'
+            ELSE 'user'
+        END;
+        UPDATE public.users
+        SET    email      = NEW.email,
+               role       = _role,
+               updated_at = to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')
+        WHERE  user_id = NEW.id::TEXT;
+    ELSE
+        UPDATE public.users
+        SET    email      = NEW.email,
+               updated_at = to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')
+        WHERE  user_id = NEW.id::TEXT;
+    END IF;
+    RETURN NEW;
+END;
+$$;
+
+CREATE OR REPLACE TRIGGER on_auth_user_updated
+    AFTER UPDATE OF email, raw_app_meta_data ON auth.users
+    FOR EACH ROW EXECUTE FUNCTION public.handle_auth_user_updated();
+
+-- ── Notes for Supabase deployments ───────────────────────────────────────────
+-- • public.users.password_hash is always NULL for Supabase-authenticated users.
+--   GoTrue owns password management; the column is inert but kept for schema
+--   parity with SQLite / standalone Postgres deployments.
+-- • password_reset_tokens is also inert — Supabase handles password resets.
+--   The table is retained so the schema remains identical across all modes.
+-- • svt_* api_tokens still work for CLI / headless API access in Supabase mode.
+--   Only interactive UI sessions use Supabase JWTs; machine tokens use the table.
+-- • First admin: create the user in the Supabase dashboard (Auth → Users).
+--   The mirror trigger fires automatically (role defaults to 'user'). Elevate to
+--   admin by setting sovrant_role in app_metadata (service-role only):
+--     UPDATE auth.users
+--     SET    raw_app_meta_data = jsonb_set(
+--                COALESCE(raw_app_meta_data, '{}'), '{sovrant_role}', '"admin"')
+--     WHERE  email = 'you@example.com';
+--   The on_auth_user_updated trigger fires and syncs role = 'admin' to
+--   public.users automatically. Never UPDATE public.users.role directly.
+
+-- ── Row-Level Security (recommended for Supabase deployments) ────────────────
+-- Uncomment to enforce the owner_user_id privacy model at the database layer.
+-- Required if any Supabase Edge Functions or dashboard queries need to respect
+-- per-user memory privacy without going through the Sovrant API.
+--
+-- NOTE: auth.uid() only works for Supabase JWT holders. svt_* machine tokens
+-- use the service role and bypass RLS entirely by design. Sovrant's own API
+-- enforces privacy at the application layer for machine-token callers.
+
+-- ALTER TABLE workspace_memory  ENABLE ROW LEVEL SECURITY;
+-- ALTER TABLE session_summaries ENABLE ROW LEVEL SECURITY;
+-- ALTER TABLE learned_patterns  ENABLE ROW LEVEL SECURITY;
+-- ALTER TABLE instincts         ENABLE ROW LEVEL SECURITY;
+
+-- CREATE POLICY workspace_memory_owner ON workspace_memory
+--     USING (is_private = 0 OR owner_user_id = auth.uid()::text);
+
+-- CREATE POLICY session_summaries_owner ON session_summaries
+--     USING (owner_user_id = '' OR owner_user_id = auth.uid()::text);
+
+-- CREATE POLICY learned_patterns_owner ON learned_patterns
+--     USING (owner_user_id = '' OR owner_user_id = auth.uid()::text);
+
+-- CREATE POLICY instincts_owner ON instincts
+--     USING (owner_user_id = '' OR owner_user_id = auth.uid()::text);
diff --git a/docs/document-templates.md b/docs/document-templates.md
new file mode 100644
index 00000000..6a8ac1fc
--- /dev/null
+++ b/docs/document-templates.md
@@ -0,0 +1,310 @@
+# Document Template Authoring Guide
+
+Document templates in Sovrant are stored as rows in the `knowledge_pages` table
+(`kind = 'document-templates'`). The body is a Scriban template that renders to
+Markdown (or structured JSON for Excel), and the field schema is stored as a
+JSON array in the `fields_json` column.
+
+This guide covers everything a domain expert needs to author, edit, test, and
+deploy a new document template without touching C#.
+
+---
+
+## Quick Start
+
+1. **Open the Knowledge UI** → Documents → find the template you want to edit.
+   Click **Edit** to modify the body or fields inline. Changes land in a
+   `Global`-tier overlay row that shadows the built-in automatically.
+
+2. **Or write a SQL migration** (see [Adding a new template via migration](#adding-a-new-template-via-migration)).
+
+3. **Validate** with the CLI:
+   ```
+   sovrant document lint --id legal/nda
+   ```
+
+---
+
+## Template Body — Scriban Syntax
+
+The body is a [Scriban](https://github.com/scriban/scriban) template. Scriban
+uses `{{ }}` for expressions and `{%  %}` for statements.
+
+### Variable interpolation
+
+```scriban
+**Client:** {{ client_name }}
+**Date:** {{ format_date effective_date }}
+```
+
+### Conditionals
+
+```scriban
+{{ if governing_law && governing_law != "" }}
+## Governing Law
+This agreement is governed by the laws of {{ governing_law }}.
+{{ end }}
+```
+
+### Loops over string arrays
+
+```scriban
+## Parties
+{{ for party in parties }}- {{ party }}
+{{ end }}
+```
+
+### Loops over object arrays
+
+```scriban
+## Action Items
+{{ for item in action_items }}- {{ item.task }}{{ if item.owner && item.owner != "" }} — **{{ item.owner }}**{{ end }}
+{{ end }}
+```
+
+### Markdown tables from object arrays
+
+```scriban
+| Date | Category | Amount |
+|------|----------|--------|
+{{ for row in line_items }}| {{ format_date row.date }} | {{ escape_pipes row.category }} | {{ format_money row.amount currency }} |
+{{ end }}
+```
+
+Always call `escape_pipes` on string values inside table cells to prevent
+Markdown table corruption from `|` characters in user data.
+
+---
+
+## Format Helpers
+
+These functions are available in every template body.
+
+| Helper | Signature | Example |
+|--------|-----------|---------|
+| `format_date` | `(value) → string` | `{{ format_date start_date }}` → `2024-03-15` |
+| `format_money` | `(amount, currency) → string` | `{{ format_money total "USD" }}` → `USD 1,500.00` |
+| `format_money_whole` | `(amount, currency) → string` | `{{ format_money_whole fee "USD" }}` → `USD 1,500` |
+| `format_number` | `(value) → string` | `{{ format_number count }}` → `1,234` |
+| `format_percent` | `(rate) → string` | `{{ format_percent tax_rate }}` → `8.5%` |
+| `escape_pipes` | `(value) → string` | `{{ escape_pipes description }}` — escapes `\|` in Markdown tables |
+| `slug` | `(value, fallback?) → string` | `{{ slug client_name "client" }}` → `acme-corp` |
+| `normalize_currency` | `(value) → string` | `{{ normalize_currency currency }}` → `USD` |
+
+`format_date` accepts ISO date strings (`2024-03-15`) and passes them through
+unchanged if they don't parse. `format_money` / `format_money_whole` accept
+numeric amounts (Decimal or Double from JSON).
+
+---
+
+## Field Schema (`fields_json`)
+
+Every template declares its inputs as a JSON array of field objects stored in
+the `fields_json` column. The agent uses this to collect missing data before
+calling the template.
+
+### Field object shape
+
+```json
+{
+  "name": "client_name",
+  "type": "string",
+  "required": true,
+  "description": "Full legal name of the client."
+}
+```
+
+### Field types
+
+| `type` value | JSON shape expected | Notes |
+|---|---|---|
+| `string` | `"value"` | Single-line text |
+| `text` | `"value"` | Multi-line / paragraph |
+| `integer` | `42` | Whole number |
+| `decimal` | `3.14` or `"3.14"` | Fractional number |
+| `currency` | `1500.00` or `"1500.00"` | Monetary amount (use `format_money` in body) |
+| `date` | `"2024-03-15"` | ISO date string |
+| `boolean` | `true` / `false` | |
+| `stringArray` | `["a", "b"]` | List of strings |
+| `objectArray` | `[{...}, {...}]` | List of objects; requires `itemFields` |
+
+### `objectArray` with nested fields
+
+```json
+{
+  "name": "line_items",
+  "type": "objectArray",
+  "required": true,
+  "description": "Expense line items.",
+  "itemFields": [
+    { "name": "date",        "type": "date",    "required": true  },
+    { "name": "description", "type": "string",  "required": true  },
+    { "name": "amount",      "type": "currency", "required": true  },
+    { "name": "receipt",     "type": "string",  "required": false }
+  ]
+}
+```
+
+---
+
+## `filename_template` and `default_format`
+
+### `default_format`
+
+One of: `Word`, `StructuredPdf`, `Excel`, `Markdown`, `Pdf`, `PowerPoint`.
+
+Most Markdown-body templates use `Word` (rendered to DOCX via MigraDoc).
+
+### `filename_template`
+
+A Scriban expression producing the output filename. The same format helpers
+and field variables are available.
+
+```
+nda-{{ slug client_name "client" }}-{{ slug counterparty_name "counterparty" }}-{{ format_date effective_date }}.docx
+```
+
+If omitted, Sovrant falls back to `<slug>.<ext>`.
+
+---
+
+## Adding a New Template via Migration
+
+Create `src/Sovrant.Runtime/Storage/Migrations/V0NN__<description>.sql`:
+
+```sql
+-- V0NN: Add <template name> template (Phase NN).
+
+INSERT OR IGNORE INTO knowledge_pages
+(knowledge_id, kind, slug, name, description, tier, body, workspace_id,
+ created_at, updated_at, industry, default_format, fields_json, filename_template)
+VALUES (
+  'doctempl_legal-my-template',   -- unique ID; prefix 'doctempl_' + industry slug
+  'document-templates',
+  'legal/my-template',            -- id used in the API and CLI
+  'My Template Name',
+  'One-sentence description shown in template listings.',
+  'BuiltIn',
+  '# {{ title }}
+
+**Party:** {{ party_name }}
+...rest of Scriban body...',
+  '',                             -- workspace_id '' = BuiltIn base row
+  unixepoch(),
+  unixepoch(),
+  'legal',                        -- industry
+  'Word',                         -- default_format
+  '[{"name":"title","type":"string","required":true},{"name":"party_name","type":"string","required":true}]',
+  'my-template-{{ slug party_name "party" }}.docx'
+);
+```
+
+Then update the test files:
+- `tests/Sovrant.Runtime.Tests/Storage/SqliteStorageProviderTests.cs` — bump schema version
+- `tests/Sovrant.Runtime.Tests/Storage/OldDbUpgradeTests.cs` — bump schema version + row count
+
+---
+
+## Editing a Built-In Template
+
+Built-in templates (`tier = 'BuiltIn'`, `workspace_id = ''`) are read-only.
+Edits land in a **Global overlay** row (`tier = 'User'`, `workspace_id = 'global'`)
+that shadows the built-in by slug. The built-in row is never touched.
+
+**Via the Knowledge UI:** Documents → select template → Edit. The UI handles
+copy-on-write automatically.
+
+**Via `IKnowledgeStore.UpsertAsync`** (programmatic):
+
+```csharp
+var page = new KnowledgePage(
+    KnowledgeId:   $"doctempl_global_legal-nda",
+    Kind:          "document-templates",
+    Slug:          "legal/nda",
+    Name:          "Non-Disclosure Agreement",
+    Tier:          "User",
+    WorkspaceId:   KnowledgeScope.Global,
+    Body:          "...updated Scriban body...",
+    // ... other fields
+);
+await store.UpsertAsync(page);
+```
+
+To **revert** to the built-in: delete the Global overlay row.
+
+---
+
+## Validating a Template
+
+```
+# Validate a specific template
+sovrant document lint --id legal/nda
+
+# Validate all DB-backed templates
+sovrant document lint
+
+# Machine-readable output for CI
+sovrant document lint --json
+```
+
+The lint command checks:
+- Scriban syntax — `Template.Parse(body)` reports parse errors
+- `fields_json` — must be a valid JSON array
+
+Exit code 0 = all pass. Exit code 1 = one or more failures.
+
+---
+
+## Template Anatomy Example
+
+Complete example — a simple consulting agreement:
+
+**`fields_json`:**
+```json
+[
+  { "name": "client_name",   "type": "string",  "required": true,  "description": "Client's full legal name." },
+  { "name": "consultant",    "type": "string",  "required": true,  "description": "Consultant's full legal name." },
+  { "name": "start_date",    "type": "date",    "required": true  },
+  { "name": "end_date",      "type": "date",    "required": false },
+  { "name": "rate",          "type": "currency","required": true,  "description": "Hourly or project rate." },
+  { "name": "currency",      "type": "string",  "required": false, "description": "ISO currency code (default USD)." },
+  { "name": "scope",         "type": "text",    "required": true,  "description": "Description of services." },
+  { "name": "governing_law", "type": "string",  "required": false }
+]
+```
+
+**Body (Scriban):**
+```scriban
+# Consulting Agreement
+
+**Client:** {{ client_name }}
+**Consultant:** {{ consultant }}
+**Start Date:** {{ format_date start_date }}{{ if end_date && end_date != "" }}
+**End Date:** {{ format_date end_date }}{{ end }}
+**Rate:** {{ format_money rate (normalize_currency currency) }}
+
+## Scope of Services
+
+{{ scope }}
+
+{{ if governing_law && governing_law != "" }}
+## Governing Law
+
+This agreement is governed by the laws of {{ governing_law }}.
+
+{{ end }}
+## Signatures
+
+**Client:** {{ client_name }}
+
+Signature: ____________________________  Date: ____________
+
+**Consultant:** {{ consultant }}
+
+Signature: ____________________________  Date: ____________
+```
+
+**`filename_template`:**
+```
+consulting-agreement-{{ slug client_name "client" }}-{{ format_date start_date }}.docx
+```
diff --git a/docs/images/web-flow-01-login-first-run.png b/docs/images/web-flow-01-login-first-run.png
new file mode 100644
index 00000000..7a4a7bfc
Binary files /dev/null and b/docs/images/web-flow-01-login-first-run.png differ
diff --git a/docs/images/web-flow-02-chat.png b/docs/images/web-flow-02-chat.png
new file mode 100644
index 00000000..a7b33d40
Binary files /dev/null and b/docs/images/web-flow-02-chat.png differ
diff --git a/docs/images/web-flow-03-dashboard.png b/docs/images/web-flow-03-dashboard.png
new file mode 100644
index 00000000..509ae397
Binary files /dev/null and b/docs/images/web-flow-03-dashboard.png differ
diff --git a/docs/images/web-flow-04-memory.png b/docs/images/web-flow-04-memory.png
new file mode 100644
index 00000000..0efdd4d1
Binary files /dev/null and b/docs/images/web-flow-04-memory.png differ
diff --git a/docs/images/web-flow-05-documents.png b/docs/images/web-flow-05-documents.png
new file mode 100644
index 00000000..1d1f5eab
Binary files /dev/null and b/docs/images/web-flow-05-documents.png differ
diff --git a/docs/images/web-flow-06-document-templates.png b/docs/images/web-flow-06-document-templates.png
new file mode 100644
index 00000000..c32122de
Binary files /dev/null and b/docs/images/web-flow-06-document-templates.png differ
diff --git a/docs/images/web-flow-07-artifacts.png b/docs/images/web-flow-07-artifacts.png
new file mode 100644
index 00000000..da9c50e7
Binary files /dev/null and b/docs/images/web-flow-07-artifacts.png differ
diff --git a/docs/images/web-flow-08-guidelines.png b/docs/images/web-flow-08-guidelines.png
new file mode 100644
index 00000000..afe2d2ff
Binary files /dev/null and b/docs/images/web-flow-08-guidelines.png differ
diff --git a/docs/images/web-flow-09-agents.png b/docs/images/web-flow-09-agents.png
new file mode 100644
index 00000000..9faa75d1
Binary files /dev/null and b/docs/images/web-flow-09-agents.png differ
diff --git a/docs/images/web-flow-10-skills.png b/docs/images/web-flow-10-skills.png
new file mode 100644
index 00000000..6151e77e
Binary files /dev/null and b/docs/images/web-flow-10-skills.png differ
diff --git a/docs/images/web-flow-11-tools.png b/docs/images/web-flow-11-tools.png
new file mode 100644
index 00000000..71e06c90
Binary files /dev/null and b/docs/images/web-flow-11-tools.png differ
diff --git a/docs/images/web-flow-12-tool-templates.png b/docs/images/web-flow-12-tool-templates.png
new file mode 100644
index 00000000..d7dab68a
Binary files /dev/null and b/docs/images/web-flow-12-tool-templates.png differ
diff --git a/docs/images/web-flow-13-orchestration.png b/docs/images/web-flow-13-orchestration.png
new file mode 100644
index 00000000..887561c1
Binary files /dev/null and b/docs/images/web-flow-13-orchestration.png differ
diff --git a/docs/images/web-flow-14-projects.png b/docs/images/web-flow-14-projects.png
new file mode 100644
index 00000000..e14836bd
Binary files /dev/null and b/docs/images/web-flow-14-projects.png differ
diff --git a/docs/images/web-flow-15-workspaces.png b/docs/images/web-flow-15-workspaces.png
new file mode 100644
index 00000000..fd1cd0bb
Binary files /dev/null and b/docs/images/web-flow-15-workspaces.png differ
diff --git a/docs/images/web-flow-16-code.png b/docs/images/web-flow-16-code.png
new file mode 100644
index 00000000..31ea3dbc
Binary files /dev/null and b/docs/images/web-flow-16-code.png differ
diff --git a/docs/images/web-flow-17-settings.png b/docs/images/web-flow-17-settings.png
new file mode 100644
index 00000000..1a48f58a
Binary files /dev/null and b/docs/images/web-flow-17-settings.png differ
diff --git a/docs/images/web-flow-18-provider-setup.png b/docs/images/web-flow-18-provider-setup.png
new file mode 100644
index 00000000..b05a8980
Binary files /dev/null and b/docs/images/web-flow-18-provider-setup.png differ
diff --git a/docs/images/web-flow-19-command-center.png b/docs/images/web-flow-19-command-center.png
new file mode 100644
index 00000000..d7db9c5a
Binary files /dev/null and b/docs/images/web-flow-19-command-center.png differ
diff --git a/docs/images/web-flow-20-admin.png b/docs/images/web-flow-20-admin.png
new file mode 100644
index 00000000..43555ff2
Binary files /dev/null and b/docs/images/web-flow-20-admin.png differ
diff --git a/docs/images/web-flow-21-admin-providers.png b/docs/images/web-flow-21-admin-providers.png
new file mode 100644
index 00000000..b912023f
Binary files /dev/null and b/docs/images/web-flow-21-admin-providers.png differ
diff --git a/docs/images/web-flow-22-admin-integrations.png b/docs/images/web-flow-22-admin-integrations.png
new file mode 100644
index 00000000..e66155db
Binary files /dev/null and b/docs/images/web-flow-22-admin-integrations.png differ
diff --git a/docs/images/web-flow-23-admin-system-integrations.png b/docs/images/web-flow-23-admin-system-integrations.png
new file mode 100644
index 00000000..0a7ab7bd
Binary files /dev/null and b/docs/images/web-flow-23-admin-system-integrations.png differ
diff --git a/docs/images/web-flow-24-admin-workspaces.png b/docs/images/web-flow-24-admin-workspaces.png
new file mode 100644
index 00000000..a402fd4d
Binary files /dev/null and b/docs/images/web-flow-24-admin-workspaces.png differ
diff --git a/docs/images/web-flow-25-governance.png b/docs/images/web-flow-25-governance.png
new file mode 100644
index 00000000..cac4b773
Binary files /dev/null and b/docs/images/web-flow-25-governance.png differ
diff --git a/docs/images/web-flow-26-diagnostics.png b/docs/images/web-flow-26-diagnostics.png
new file mode 100644
index 00000000..73e00d74
Binary files /dev/null and b/docs/images/web-flow-26-diagnostics.png differ
diff --git a/docs/images/web-flow-27-trust-boundary.png b/docs/images/web-flow-27-trust-boundary.png
new file mode 100644
index 00000000..6de4d8d6
Binary files /dev/null and b/docs/images/web-flow-27-trust-boundary.png differ
diff --git a/docs/persistence.md b/docs/persistence.md
index 6a48a267..ffadc12b 100644
--- a/docs/persistence.md
+++ b/docs/persistence.md
@@ -1,6 +1,6 @@
 # Sovrant — Persistence Layer
 
-**Phases 32–42.5, 51, 52, 55, 57, 78, 85, 87, 88, 90, 93, 98, 108–116, 123, 124** | **Last updated:** 2026-06-18 | **Current schema:** V042
+**Phases 32–42.5, 51, 52, 55, 57, 78, 85, 87, 88, 90, 93, 98, 108–116, 123–126** | **Last updated:** 2026-06-25 | **Current schema:** V043
 
 This document describes how Sovrant stores durable operational data. All persistent state (sessions, memory, audit, credentials, token usage, workspaces, projects, users, knowledge, hooks, MCP/LSP config) is managed by a relational database. Three deployment modes are supported:
 
@@ -107,8 +107,9 @@ Migrations are embedded SQL resources named `V{NNN}__{description}.sql` inside t
 | V040 | `V040__mcp_server_id.sql` | Adds stable `id` column to `mcp_servers` (UUID surrogate that survives renames; `name` remains the routing key) |
 | V041 | `V041__workspace_memory_privacy.sql` | Adds `owner_user_id` + `is_private` to `workspace_memory` for per-user note privacy |
 | V042 | `V042__memory_owner_user_id.sql` | Adds `owner_user_id` to `session_summaries`, `learned_patterns`, `instincts` so auto-generated memories are scoped to their session owner |
+| V043 | `V043__email_as_user_id.sql` | Rewrites `usr_{hex}` primary keys to email addresses; drops `username` column via table recreation |
 
-V008, V009, V022, V035, V037 ship no new tables — they are data backfills or seed inserts. V014–V016, V023–V025, V027–V031, V034, V036, V040–V042 add only columns to existing tables.
+V008, V009, V022, V035, V037 ship no new tables — they are data backfills or seed inserts. V014–V016, V023–V025, V027–V031, V034, V036, V040–V043 add only columns to existing tables.
 
 Migrations are idempotent — running `InitializeAsync` multiple times is safe. The runner skips already-applied versions and records the SHA-256 checksum of each script in `schema_version.checksum`. Checksum drift is enforced: if a previously-applied `V00X__*.sql` file has been edited in place, `InitializeAsync` throws `MigrationDriftException` on the next boot. Legacy rows with `checksum = NULL` are tolerated so pre-42.5 installs upgrade cleanly.
 
@@ -191,13 +192,13 @@ A failing probe flips `db.status` to `"error"` and overall `status` to `"degrade
 
 ## Database Inventory (authoritative)
 
-The current schema spans **42 migrations (V001–V042)**. The tables below reflect the schema as of V042.
+The current schema spans **43 migrations (V001–V043)**. The tables below reflect the schema as of V043.
 
 ### Tables by purpose
 
 | Category | Tables | First migration | Notes |
 |---|---|---|---|
-| **Identity & access** | `users`, `api_tokens`, `roles`, `permissions`, `role_permissions`, `user_roles` | V001 | `password_hash` added V026. `api_tokens` is live (Phase 38). RBAC tables populated (Phase 40). |
+| **Identity & access** | `users`, `api_tokens`, `roles`, `permissions`, `role_permissions`, `user_roles` | V001 | `password_hash` added V026. `username` column dropped V043 (email is now the PK). `api_tokens` is live (Phase 38). RBAC tables populated (Phase 40). |
 | **Auth extras** | `server_settings`, `password_reset_tokens` | V026 | `server_settings`: key/value store for auth bootstrap. `password_reset_tokens`: local-auth only; inert in Supabase mode. |
 | **Workspaces** | `workspaces`, `workspace_members`, `workspace_config`, `workspace_invites`, `workspace_memory` | V001 + V006 | `workspace_memory` gained `owner_user_id` + `is_private` (V041) for per-user note privacy. |
 | **Projects** | `projects`, `project_members`, `project_config` | V001 | V007 adds indexes only. |
@@ -449,14 +450,14 @@ Sovrant supports three storage deployment modes. The SQLite schema described abo
 | Token resolution | `SqliteTokenService` | `PostgresTokenService` *(planned)* | JWT JWKS validation + `svt_*` fallback |
 | `password_reset_tokens` | used | used | inert (Supabase handles resets) |
 | FK tables | reference `public.users` | same | same — mirror trigger ensures row exists first |
-| Schema bootstrap | V-series migration runner | `PostgresSchema.sql` (base section, manual) | `PostgresSchema.sql` (full file inc. Supabase Auth Extension section) |
-| Row-level security | n/a | optional | Commented-out policies in `PostgresSchema.sql` Supabase Auth Extension section |
+| Schema bootstrap | V-series migration runner | `db/postgres/PostgresSchema.sql` (manual `psql`) | `db/supabase/migrations/` via Supabase CLI |
+| Row-level security | n/a | optional | Commented-out policies in `db/supabase/migrations/20260625000000_initial_schema.sql` |
 
 ### How Supabase Auth fits
 
 Supabase Auth stores identities in `auth.users` (UUID PK, managed by GoTrue). The canonical user identity throughout the app is a `user_id TEXT` column. In Supabase mode this TEXT value is `auth.users.id::TEXT` (a UUID string) — fully compatible with existing FK columns and `owner_user_id` memory columns without any type changes.
 
-Two mirror triggers (in the **SUPABASE AUTH EXTENSION** section at the bottom of `PostgresSchema.sql`) propagate changes from `auth.users` to `public.users`:
+Two mirror triggers (in `db/supabase/migrations/20260625000000_initial_schema.sql`) propagate changes from `auth.users` to `public.users`:
 
 ```sql
 -- on_auth_user_created: fires on new sign-up
@@ -469,8 +470,8 @@ BEGIN
         WHEN NEW.raw_app_meta_data->>'sovrant_role' = 'admin' THEN 'admin'
         ELSE 'user'
     END;
-    INSERT INTO public.users (user_id, username, email, role, ...)
-    VALUES (NEW.id::TEXT, ..., _role, ...)
+    INSERT INTO public.users (user_id, email, role, ...)
+    VALUES (NEW.id::TEXT, NEW.email, _role, ...)
     ON CONFLICT (user_id) DO NOTHING;
 END; $$;
 
@@ -494,13 +495,29 @@ This means every FK reference to `users(user_id)` continues to work without sche
 
 ### File layout
 
-`src/Sovrant.Runtime/Storage/PostgresSchema.sql` — **single file for all Postgres deployments**. Divided into two sections:
+All database files live under `db/` in the repo root:
 
-1. **Base schema** (always run) — full `public.users` with `password_hash`, all FK/memory/knowledge tables, V041/V042 `ADD COLUMN IF NOT EXISTS` guards, V040 `mcp_servers.id` backfill.
+```
+db/
+  postgres/
+    PostgresSchema.sql                            ← standalone Postgres (also embedded in Runtime DLL)
+  supabase/
+    config.toml                                   ← Supabase CLI project config
+    migrations/
+      20260625000000_initial_schema.sql           ← full schema + GoTrue mirror triggers + RLS stubs
+```
+
+**Standalone Postgres** (`db/postgres/PostgresSchema.sql`) — base schema only; no Supabase-specific sections. Run once with `psql` to bootstrap; re-run on upgrades (idempotent). Also embedded in `Sovrant.Runtime.dll` so the runtime can auto-initialize a fresh Postgres database without external files present.
 
-2. **SUPABASE AUTH EXTENSION** (Supabase only, clearly marked at the bottom) — the two mirror triggers (`on_auth_user_created`, `on_auth_user_updated`), commented-out RLS policies, and deployment notes. **Standalone Postgres deployments skip this section.**
+**Supabase** (`db/supabase/migrations/`) — full schema plus the GoTrue mirror triggers (`on_auth_user_created`, `on_auth_user_updated`) and commented-out RLS policies. Managed by the Supabase CLI — run `supabase db push` from `db/supabase/`. Admins can layer their own customizations by adding new numbered migration files after the initial one:
+
+```
+db/supabase/migrations/
+  20260625000000_initial_schema.sql   ← Sovrant base (don't edit)
+  20260625000001_my_org_additions.sql ← admin customizations layered on top
+```
 
-There is no separate `SupabaseAuth.sql` file — the Supabase-specific SQL lives inline in `PostgresSchema.sql` behind the section header. When running in the Supabase SQL editor, run the entire file; Supabase-only objects only apply inside a Supabase project where `auth.users` exists.
+The Supabase CLI applies migrations in timestamp order so admin additions never conflict with future Sovrant upgrades as long as they stay additive.
 
 ### What changes in auth middleware
 
@@ -522,9 +539,9 @@ Because the role is embedded in the JWT by Supabase (from `raw_app_meta_data`),
 
 | Item | Status |
 |---|---|
-| `PostgresSchema.sql` base schema (V001–V042 parity + V040 backfill) | **Done** |
-| Supabase mirror triggers (`on_auth_user_created`, `on_auth_user_updated`) with Option A role from `app_metadata` | **Done** (SUPABASE AUTH EXTENSION section in `PostgresSchema.sql`) |
-| RLS policies for memory privacy at DB layer | Skeleton commented out in `PostgresSchema.sql` — **Planned** to enable |
+| `db/postgres/PostgresSchema.sql` base schema (V001–V043 parity + V040 backfill) | **Done** |
+| `db/supabase/migrations/` Supabase CLI migration with GoTrue mirror triggers + RLS stubs | **Done** |
+| RLS policies for memory privacy at DB layer | Skeleton commented out in Supabase migration — **Planned** to enable |
 | `PostgresTokenService` (mirrors `SqliteTokenService` for standalone Postgres) | **Planned** |
 | Postgres V-series migration runner (equivalent to SQLite `MigrationRunner`) | **Planned** |
 | JWT validation in `BearerTokenMiddleware` | **Planned** |
@@ -571,10 +588,10 @@ export SOVRANT_POSTGRES_URL="postgres://sovrant_app:yourpassword@localhost:5432/
 
 **3. Bootstrap the schema (one-time, run from the repo):**
 ```bash
-psql $SOVRANT_POSTGRES_URL -f src/Sovrant.Runtime/Storage/PostgresSchema.sql
+psql $SOVRANT_POSTGRES_URL -f db/postgres/PostgresSchema.sql
 ```
 
-> **Stop before the SUPABASE AUTH EXTENSION section.** Standalone Postgres skips everything after the `══ SUPABASE AUTH EXTENSION ══` divider at the bottom of the file. You can verify this by checking that `auth.users` does not exist in your database — the section's `CREATE TRIGGER ... ON auth.users` will error if run on a plain Postgres instance.
+The standalone schema has no Supabase-specific sections — it is safe to run in full against any plain Postgres instance.
 
 **4. Start Sovrant.** It detects Postgres via `SOVRANT_POSTGRES_URL`. On first boot, `SeedDefaultUser` and `SeedPersonalWorkspace` run automatically (same as SQLite).
 
@@ -588,11 +605,22 @@ psql $SOVRANT_POSTGRES_URL -f src/Sovrant.Runtime/Storage/PostgresSchema.sql
 
 Prerequisites: Supabase project (cloud at [supabase.com](https://supabase.com) or self-hosted via `supabase start`).
 
-**1. Run `PostgresSchema.sql` in the Supabase SQL editor.**
+**1. Apply the Sovrant migration via the Supabase CLI (recommended):**
+```bash
+cd db/supabase
+supabase link --project-ref <your-project-ref>
+supabase db push
+```
+
+Or paste the contents of `db/supabase/migrations/20260625000000_initial_schema.sql` directly into the Supabase SQL Editor. `auth.users` exists in every Supabase project so there are no errors.
 
-Open your project → SQL Editor → New query → paste the full contents of `src/Sovrant.Runtime/Storage/PostgresSchema.sql` → Run. This includes the SUPABASE AUTH EXTENSION section at the bottom which creates the mirror triggers. `auth.users` exists in every Supabase project so there are no errors.
+**Customizing the schema** — add your own migrations after the initial one:
+```
+db/supabase/migrations/20260625000001_my_org_additions.sql
+```
+The CLI applies them in timestamp order. Keep customizations additive so future Sovrant upgrades layer cleanly on top.
 
-**2. (Optional) Enable Row Level Security** — uncomment and run the RLS block at the very end of the file. This enforces `owner_user_id` privacy at the database layer (not just application layer), which is the recommended posture for multi-user Supabase deployments. The commented policies are:
+**2. (Optional) Enable Row Level Security** — uncomment the RLS block at the end of `20260625000000_initial_schema.sql`. This enforces `owner_user_id` privacy at the database layer (not just application layer), which is the recommended posture for multi-user Supabase deployments. The commented policies are:
 - `workspace_memory`: `USING (is_private = 0 OR owner_user_id = auth.uid()::text)`
 - `session_summaries`, `learned_patterns`, `instincts`: `USING (owner_user_id = '' OR owner_user_id = auth.uid()::text)`
 
@@ -662,7 +690,7 @@ export SUPABASE_SERVICE_ROLE_KEY="your-service-key"   # secret — server-side o
 | Credential at rest | AES-256-GCM encryption; master key in `keystore` table (DB) since V039 |
 | Concurrent access | WAL mode + `busy_timeout=5000` allows CLI and server to share the same DB file |
 | Server auth | All HTTP endpoints require `Authorization: Bearer`; SQLite DB never directly exposed |
-| Memory privacy | `owner_user_id` scoping enforced at app layer (query filter); no DB-level RLS on SQLite. Supabase deployments can enable RLS policies (commented out in `PostgresSchema.sql`) to enforce privacy at the DB layer. |
+| Memory privacy | `owner_user_id` scoping enforced at app layer (query filter); no DB-level RLS on SQLite. Supabase deployments can enable RLS policies (commented out in `db/supabase/migrations/20260625000000_initial_schema.sql`) to enforce privacy at the DB layer. |
 | Role elevation (Supabase) | `raw_app_meta_data.sovrant_role` is writable only by service-role callers (GoTrue enforces); users cannot self-elevate. Role is embedded in the signed JWT — tamper-proof in transit. |
 
 ---
@@ -708,13 +736,13 @@ export SUPABASE_SERVICE_ROLE_KEY="your-service-key"   # secret — server-side o
 | 5 | **No backup-before-migrate.** Migration applied with no snapshot. | **✓ Resolved (Phase 42.5).** `SOVRANT_DB_BACKUP_ON_UPGRADE=true` checkpoints + copies before migrations. |
 | 6 | **Migration checksum drift not enforced.** | **✓ Resolved (Phase 42.5).** `MigrationDriftException` thrown on any mismatch. |
 | 8 | **Empty `user_id` defaults.** Sessions written with `user_id = ''`. | **✓ Resolved (Phase 38 + V009 backfill).** |
-| 13 | **`PostgresSchema.sql` has no migration runner.** One-shot manual script; Supabase instances bootstrapped before V041/V042 silently lack the privacy columns. Existing Postgres instances not re-run against the updated script will have no `owner_user_id` on memory tables → INSERT failures at runtime. | **Planned** — Postgres V-series migration runner needed; or publish discrete upgrade scripts per release (e.g. `V041_upgrade.sql`). |
-| 14 | **Memory privacy enforced at app layer only.** `owner_user_id` filter is in application query logic, not DB RLS. Direct Supabase dashboard, service-role queries, or edge functions bypass it entirely. | **Partially done** — RLS policy skeletons are in the `PostgresSchema.sql` Supabase Auth Extension section (commented out). Uncomment and run to enforce. Full enforcement requires all Supabase Edge Functions to also use `auth.uid()`. |
-| 15 | **Six tables with `REFERENCES users(user_id)` block Supabase Auth adoption.** `workspaces`, `workspace_members`, `project_members`, `api_tokens`, `user_roles`, `password_reset_tokens`. Without the mirror trigger these FK inserts fail because `public.users` has no row. | **✓ Resolved (2026-06-18).** `on_auth_user_created` mirror trigger in `PostgresSchema.sql` SUPABASE AUTH EXTENSION section ensures `public.users` row is created before any FK-dependent inserts. |
+| 13 | **`db/postgres/PostgresSchema.sql` has no migration runner.** One-shot manual script; Supabase instances bootstrapped before V041/V042 silently lack the privacy columns. Existing Postgres instances not re-run against the updated script will have no `owner_user_id` on memory tables → INSERT failures at runtime. | **Planned** — Postgres V-series migration runner needed; or publish discrete upgrade scripts per release (e.g. `V041_upgrade.sql`). |
+| 14 | **Memory privacy enforced at app layer only.** `owner_user_id` filter is in application query logic, not DB RLS. Direct Supabase dashboard, service-role queries, or edge functions bypass it entirely. | **Partially done** — RLS policy skeletons are in `db/supabase/migrations/20260625000000_initial_schema.sql` (commented out). Uncomment and run to enforce. Full enforcement requires all Supabase Edge Functions to also use `auth.uid()`. |
+| 15 | **Six tables with `REFERENCES users(user_id)` block Supabase Auth adoption.** `workspaces`, `workspace_members`, `project_members`, `api_tokens`, `user_roles`, `password_reset_tokens`. Without the mirror trigger these FK inserts fail because `public.users` has no row. | **✓ Resolved (2026-06-18).** `on_auth_user_created` mirror trigger in the Supabase migration ensures `public.users` row is created before any FK-dependent inserts. |
 | 16 | **`/remember` command writes patterns/instincts with `owner_user_id = ''`** making them visible to all users. | **✓ Resolved (2026-06-18).** `ownerUserId` now threaded through `SlashCommandDispatcher.TryDispatchAsync` → `RememberCommand`. |
 | 17 | **`GET /workspaces/{id}/memory` returned private entries to any member.** `viewerUserId` was not passed to `ListMemoryAsync`. | **✓ Resolved (2026-06-18).** Route now passes `viewerUserId: ctx.GetUserId()`. |
 | 18 | **SQL query fragments built via string interpolation** in `SqliteMemoryStore` and `SqliteWorkspaceStore` for optional owner filters. Currently safe (hardcoded literal strings) but establishes a risky pattern. | Deferred — replace with static tautology queries: `AND ($uid IS NULL OR owner_user_id = '' OR owner_user_id = $uid)`. |
-| 19 | **`PostgresSchema.sql` V040 backfill gap.** V040 backfills `mcp_servers.id` with `randomblob(16)` in SQLite. No equivalent UPDATE in `PostgresSchema.sql` for upgrade installs — existing Postgres rows keep `id=''`. | **✓ Resolved (2026-06-18).** `UPDATE mcp_servers SET id = gen_random_uuid()::text WHERE id = '';` added to the V040 section of `PostgresSchema.sql`. |
+| 19 | **`db/postgres/PostgresSchema.sql` V040 backfill gap.** V040 backfills `mcp_servers.id` with `randomblob(16)` in SQLite. No equivalent UPDATE in the Postgres schema for upgrade installs — existing Postgres rows kept `id=''`. | **✓ Resolved (2026-06-18).** `UPDATE mcp_servers SET id = gen_random_uuid()::text WHERE id = '';` added to the V040 section of both Postgres schema files. |
 | 9 | **No shared bootstrap helper.** Test fixtures re-implement parts of the boot flow. | Deferred. |
 | 10 | **Connection-per-call with no pool.** | Deferred — benchmark before adding pooling. |
 | 11 | **No `sovrant init` first-boot UX.** | Partially addressed — `sovrant db status` covers it. |
@@ -732,7 +760,7 @@ The persistence layer is exercised by the full solution test suite (**2,222 test
 | `SqliteMemoryStoreTests` | Summaries, patterns, instincts, reinforcement, correction, pruning, owner scoping |
 | `SqliteAuditStoreTests` | Governance events, bash commands, batch writes |
 | `SqliteTokenUsageStoreTests` | Record/aggregate, empty session, cost tracking |
-| `MigrationRunnerTests` | All V001–V042 migrations apply in order; idempotency; expected tables present; backfill behavior |
+| `MigrationRunnerTests` | All V001–V043 migrations apply in order; idempotency; expected tables present; backfill behavior |
 | `SqliteWorkspaceStoreTests` | Workspace CRUD, personal-workspace idempotency, members, invites, config, memory with privacy filtering |
 | `SqliteProjectStoreTests` | Project CRUD, archive/unarchive, open-by-default access, member roles, 3-tier config inheritance |
 | `SqliteUserStoreTests` | Server-generated IDs, validation, duplicate detection, soft-delete, FK preservation, usage aggregation |
@@ -748,7 +776,7 @@ After a fresh install and first run, `~/.sovrant/` contains:
 ```
 ~/.sovrant/
 ├── data/
-│   └── sovrant.db          ← SQLite database — all persistent state (V042 schema)
+│   └── sovrant.db          ← SQLite database — all persistent state (V043 schema)
 │                             sessions, memory, audit, credentials, keystore,
 │                             workspaces, projects, users, knowledge, hooks,
 │                             MCP/LSP config, teams, missions, swarm, evals
@@ -763,7 +791,7 @@ After a fresh install and first run, `~/.sovrant/` contains:
 Note: `credentials/.keystore` no longer exists on fresh installs (V039 moved the master key into `sovrant.db`'s `keystore` table). Existing installs had the file migrated and deleted on first V039 boot.
 
 A fresh boot with no existing DB produces:
-- `data/sovrant.db` at schema version 42 (V001–V042 applied in order)
+- `data/sovrant.db` at schema version 43 (V001–V043 applied in order)
 - A `users` row for `SOVRANT_USER_ID` (or OS username) via `SeedDefaultUser`
 - A `workspaces` row `ws-personal-{userId}` via `SeedPersonalWorkspace`
 - A `workspace_members` row linking the seeded user as `owner`
diff --git a/docs/roadmap.md b/docs/roadmap.md
index ecf523ca..334476fc 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,7 +1,7 @@
 # Sovrant — Roadmap
 
 **Branch:** `development`
-**Last updated:** 2026-06-25 (Phase 126 planned — chat conversation UX: collapsed work strips. Phase 125 planned — web search via integrations. Phase 124 planned — file system access controls. Phase 96 ✅ — MCP runtime variables: inline env var editor Web + Desktop, keystore in DB (V039). Phase 116 ✅ — Intelligent Knowledge Harness complete: A–H shipped; knowledge_attributions table, IKnowledgeRouter, per-turn PII sanitization, MCP tool relevance filtering, provenance Sources UI. Phase 113 ✅ — CachedKnowledgeStore + Phase 31 CacheInvalidator repair. Phase 112 ✅ — all built-in markdown (skills, agents, 42 doc templates) in DB; dual-write removed. Phase 108 ✅ — knowledge_pages universal store. Phase 103 ✅ — MCP trust gates + trust rules editor UI. Phase 101 ✅ — OAuth 2.1 + PKCE for MCP.)
+**Last updated:** 2026-07-01 (Phase 130 planned — OpenRouter account registration & in-app key issuance via OAuth PKCE against OpenRouter's own `/auth` flow, reusing Phase 101's PKCE + loopback-listener plumbing; "Get an OpenRouter key" button on Providers settings (Web + Desktop) removes the manual copy/paste key step entirely. Phase 128 shipped ✅ — five-part plan complete: artifact security hardening (content-security headers, RemoteArtifactStore field-name fix, API zip endpoint, Artifacts.razor abstraction fix); code manifest in ArtifactManifest; scaffold enrichment (.sln + Directory.Build.props + .editorconfig + CI for all 21 templates, every .NET scaffold immediately buildable with dotnet build {sln}); LLM instruction enrichment (IProjectTemplate.BuildCommand/RunCommand, CodeCreate next_steps response, tool description update); new CodeValidateTool (structural checks via IArtifactStore.ListAsync — no compiler in PATH required, V045/V046 migrations). Phase 129 planned — Missions → Workflows rename + UX (surface labels only, dedicated Workflows page, positioning callout, `/v1/workflows` alias). v1.5 focus: Phase 114 ✅ skill enrichment + Phase 74 markdown document templates + Phase 128 ✅ + Phase 126 + Phase 129. Phase 123 ✅ — Memory System: workspace memory with public/private scoping, "+Remember" button in Chat (Web + Desktop), V041/V042 migrations, per-user injection in multi-user deployments. V040 MCP stable IDs (Phase 105 workspace-level gating). V043 email-as-user-id (replaces `usr_{hex}` PKs). PostgresSchema split to `db/postgres/PostgresSchema.sql` + `db/supabase/migrations/` (Phase 40C documentation update). Phase 127 planned — Supabase RLS. Phase 126 planned — chat conversation UX: collapsed work strips. Phase 125 planned — web search via integrations. Phase 124 planned — file system access controls. Phase 96 ✅ — MCP runtime variables: inline env var editor Web + Desktop, keystore in DB (V039). Phase 116 ✅ — Intelligent Knowledge Harness complete: A–H shipped; knowledge_attributions table, IKnowledgeRouter, per-turn PII sanitization, MCP tool relevance filtering, provenance Sources UI. Phase 113 ✅ — CachedKnowledgeStore + Phase 31 CacheInvalidator repair. Phase 112 ✅ — all built-in markdown (skills, agents, 42 doc templates) in DB; dual-write removed. Phase 108 ✅ — knowledge_pages universal store. Phase 103 ✅ — MCP trust gates + trust rules editor UI. Phase 101 ✅ — OAuth 2.1 + PKCE for MCP.)
 
 This document tracks planned features, architectural decisions, and the reasoning behind them.
 
@@ -25,6 +25,16 @@ What we are actively working on and shipping next, in priority order.
 | **v1.2 — done** | Phase 98 | User Dashboard — cross-workspace activity view; own public (Shared) + own private + teammates' public; V030 `is_private`; Web + Desktop rail nav; pagination, timestamps, 30s poll, guide panels, page-preserve on refresh ✅ |
 | **v1.2 — done** | Phase 99 | Private sessions and agent runs — per-record privacy toggle on sessions, agent runs, and missions; masked in Command Center, excluded from User Dashboard; server-side enforcement via V030 `is_private` ✅ |
 | **v1.2 — done** | Phase 96 | MCP runtime variables — inline env var editor on Web + Desktop; KEY=VALUE textarea in stdio add form; JSON paste auto-populates env vars; master key moved into DB (V039 `keystore` table); AES-256-GCM encrypted at rest ✅ |
+| **v1.3 — done** | Phase 105 | MCP server permissions — workspace-level gating via V040 stable MCP IDs; `GetEnabledEntriesAsync` workspace filter; admin toggle UI on Web + Desktop; memory-gate guards at selection point ✅ (project-level deferred) |
+| **v1.3 — done** | Phase 123 | Memory System — workspace memory with public/private scoping; "+Remember" button in Chat (Web + Desktop); Workspace tab on Memory page; V041/V042 migrations; per-user injection in multi-user deployments ✅ |
+| **v1.3 — done** | Phase 91 *(partial)* | Knowledge Authoring — admin edit/revert on Skills and Document Templates pages; Monaco editor for prompt + JSON editing; Knowledge sub-nav sorted alphabetically (Web + Desktop); Avalonia 11 → 12 desktop migration ✅ (AvaloniaEdit Desktop fixes deferred) |
+| **v1.4 — done** | V043 | Email-as-user-id — V043 migration replaces all `usr_{hex}` PKs with email across every FK and soft-reference column; `username` column dropped; `IUserService` API updated; personal workspace IDs updated in tandem ✅ |
+| **v1.4 — done** | Bug fixes | Ollama provider label/routing fixed (FriendlyProviderName checks provider name before URL); FK error 19 on project creation fixed (PersonalWorkspaceId reads `App.SovrantUserId` at call time) ✅ |
+| **v1.5 — done** | Phase 114 | Enrich built-in skill definitions — 2-3 sentence descriptions, agent list wiring, `verification-loop` tools fix; V044 migration; immediate quality lift for every LLM via the IKnowledgeRouter harness ✅ |
+| **v1.5 — done** | Phase 74 | DB-backed document templates — 42 of 44 built-in templates in `knowledge_pages` via V037; Scriban rendering; admin Edit/Revert on Documents page (Web + Desktop); copy-on-write overlay; `sovrant document lint` CLI; authoring guide ✅ |
+| **v1.5 — done** | Phase 128 | Code generation quality gates — artifact security hardening (content-security headers, API zip endpoint, RemoteArtifactStore fix, Artifacts.razor abstraction); `.sln` + `Directory.Build.props` + CI for all 21 templates (every project immediately runnable); `CodeValidateTool` (structural checks via `IArtifactStore.ListAsync`, no compiler in PATH); `CodeCreate` `next_steps` + `build_command` + LLM instruction update; `ArtifactManifest` code metadata; V045/V046 migrations ✅ |
+| **v1.5 — pending UAT** | Phase 126 | Chat conversation UX — collapsed work strips replace per-tool boxes; two-level expand (strip → tool list → full detail); live "doing X" in-progress indicator; agent answer prominent, tool work subordinate; Web + Desktop parity — implemented, awaiting live UAT pass ✅(code) |
+| **v1.5 — next** | Phase 129 | Missions → Workflows — surface-label rename (presentation-layer only); dedicated Workflows page with goal-first launch, active/recent cards, detail view; positioning callout (AI workflows vs n8n/Zapier automation); `/v1/workflows` API alias; **plus dual-path execution** — route through Claude Agent SDK dynamic workflow orchestration when a qualifying Claude tier is active, else fall back to Sovrant's own mission engine (base version) — model/tier gate TBD |
 
 > Items below v1.0 are planned but not yet scheduled. See [Still pending](#still-pending) for the full gap list.
 
@@ -35,11 +45,11 @@ What we are actively working on and shipping next, in priority order.
 The engine is fully functional across five delivery modes with enterprise multi-tenant infrastructure:
 
 - **58 tools** across 18 categories (core file, extended, todo, tasks, plan mode, worktree, skills, MCP, agent, team, missions, artifacts, documents, quality, swarm, coordination, LSP, code scaffolding)
-- **2,222 tests** across 10 projects, 0 failures
+- **2,208 tests** across 10 projects, 0 failures
 - **141 server endpoints** + 1 SignalR hub (chat, sessions, config, status, models, usage, cost, command-center, webhooks, workspaces, projects, users, teams, runs, missions, engine, artifacts, evals, swarm, tools, skills, agents, MCP auth, knowledge, trust-rules, attributions)
 - **5 delivery modes:** CLI REPL, HTTP server (:5200), desktop app (Avalonia), web app (Blazor :5100), MCP server (stdio)
 - Agentic loop with up to 20 tool rounds per turn
-- SQLite persistence layer with 39 versioned migrations (V001–V039) — V038 `mcp_servers`→credential store migration (Phase 95), V039 `keystore` table — master AES key in DB (Phase 96), V030 `is_private` (Phase 98), V031 `agent_name` (Phase 106), V032–V033 `knowledge_pages` + `knowledge_attributions` (Phase 108/116F), V034–V037 `role`/`recommended_level` + `fields_json`/`filename_template` + skill/agent/doc-template seeds (Phase 112A–D) on top of the Phase 32/42.5/51/52/57/78 foundation
+- SQLite persistence layer with 46 versioned migrations (V001–V046) — V045 seed built-in tool guides for CodeCreate/CodeCreateMulti (Phase 128D), V046 seed CodeValidateTool guide (Phase 128E), V044 enrich built-in skill descriptions + agent/tool list fixes (Phase 114), V040 `mcp_servers.id` stable surrogate for workspace-scoped gating (Phase 105), V041 `workspace_memory` owner/privacy columns (Phase 123), V042 `session_summaries`/`learned_patterns`/`instincts` owner scoping (Phase 123), V043 email-as-user-id rewrite (replaces `usr_{hex}` PKs), V038 `knowledge_attributions` table (Phase 116F), V039 `keystore` table — master AES key in DB (Phase 96), V030 `is_private` (Phase 98), V031 `agent_name` (Phase 106), V032–V033 `knowledge_pages` + `knowledge_attributions` schema (Phase 108/116F), V034–V037 `role`/`recommended_level` + `fields_json`/`filename_template` + skill/agent/doc-template seeds (Phase 112A–D) on top of the Phase 32/42.5/51/52/57/78 foundation
 - Single `.env` file configuration — `sovrant.config` removed; all bootstrap knobs are env vars; routing and swarm config fully DB-backed
 - **Integrations Gallery** on Web and Desktop — catalog-first MCP onramp with Automation (Composio, n8n, Zapier, Make), Platform (GitHub, Slack, Notion, Linear, Stripe, PostgreSQL, Supabase, Filesystem), and Search (Brave, Exa, Tavily) tiers; credentials stored in encrypted keystore (Phase 95 ✅)
 - **Model switcher with provider discovery** — configured providers selectable inline; unconfigured known providers shown with click-to-configure deep-link to Settings → Providers on both Web and Desktop
@@ -150,7 +160,7 @@ The engine is fully functional across five delivery modes with enterprise multi-
 
 ### Still pending
 
-> **Last audited:** 2026-05-26. Shipped since prior audit: Phase 79 Agents page ✅, Phase 94 Orchestration Studio ✅, Phase 95 Integrations Gallery ✅ (encrypted credentials, catalog with 14 integrations across 3 tiers, Web + Desktop parity). Phase 50 OpenClaw federation ✅ (SwarmFederationMode, bus client, manager-led routing, V029, 3 new API endpoints). Phase 73 code scaffolding ✅ (21 templates, CodeCreateMultiTool, ScaffoldManifestValidator, 235 tests). Session-level MCP opt-in lifted to context bar (Desktop WorkspacePanelView + Web TopContextBar). Phase 98 User Dashboard ✅ (Shared stat = own public items, pagination + timestamps + 30s poll + page-preserve on both surfaces, guide panels). Phase 99 privacy toggles ✅ (per-record is_private on sessions/agent_runs/missions, Command Center masking, User Dashboard exclusion). Phase 85.5 local/remote mode selection ✅ (Sovrant.Api.Client, sovrant connect/disconnect, two-phase Desktop boot, setup wizard mode picker). Phase 91 Knowledge Authoring deferred.
+> **Last audited:** 2026-06-29. Shipped since prior audit: Phase 96 MCP runtime variables ✅ (inline env var editor Web + Desktop, V039 keystore). Phase 105 MCP server permissions ✅ (partial — workspace-level gating via V040 stable MCP IDs, admin toggle UI on Web + Desktop; project-level restrictions remain deferred). Phase 123 Memory System ✅ (workspace memory with public/private scoping, "+Remember" button in Chat on Web + Desktop, dedicated Workspace tab on Memory page, V041/V042 migrations, per-user injection in multi-user deployments). V043 email-as-user-id migration ✅ (replaces opaque `usr_{hex}` PKs across all FK columns). Phase 40C Supabase backend ✅ (PostgreSQL stores, admin UI, SQLite→Postgres migrator, boot-time DI switch; schema split to `db/postgres/PostgresSchema.sql` + `db/supabase/migrations/`). Phase 91 Knowledge Authoring partial ✅ (Guidelines + Documents pages complete with single Edit + silent copy-on-write; Skills page Duplicate button removal + AvaloniaEdit Desktop fixes remain).
 >
 > Quality / polish / audit phases (62, 68, 69, 70, 71, 72, 75) and partial-completion phases (56) are tracked in their own sections below; this table is gap-only.
 
@@ -172,7 +182,7 @@ The engine is fully functional across five delivery modes with enterprise multi-
 | Video generation — fal.ai, Kling AI, and pluggable provider support for text-to-video, image-to-video | Phase 65 | Medium |
 | Autonomous agent modes (swarm autonomy & alternate claws) | Phase 67 | Medium |
 | Code creation: project scaffolding & app generation | Phase 73 | ✅ Done |
-| Markdown-backed document templates | Phase 74 | Medium |
+| DB-backed document templates | Phase 74 | ✅ Done |
 | In-app document viewing | Phase 76 | Medium |
 | Project isolation with full feature parity | Phase 77 | Medium |
 | Composio MCP integration — first-class platform awareness for Composio's MCP catalog (250+ apps), in-app browse/enable, managed OAuth via Composio connections, per-user/workspace credential scoping, still routed through Sovrant's `MCPTool` proxy and permission model | Phase 80 | Medium |
@@ -182,7 +192,7 @@ The engine is fully functional across five delivery modes with enterprise multi-
 | Local / remote mode selection — CLI + Desktop can run embedded (local DB) or connect to a shared `Sovrant.Server`; setup wizard mode picker; `sovrant connect <url>` | Phase 85.5 | ✅ Done |
 | Background session continuation across navigation & session switches | Phase 86 | ✅ Done |
 | Artifacts-by-default for code & documents (with workspace identity unification) | Phase 87 | ✅ Done |
-| Knowledge Authoring Revisit — Web + Desktop UX rework: single Edit action on any item, silent copy-on-write for built-ins, no "Duplicate to user" intermediate; fix AvaloniaEdit defects on Desktop | Phase 91 | Deferred |
+| Knowledge Authoring Revisit — Guidelines and Documents pages complete (single Edit, silent copy-on-write, no "Duplicate" intermediate); Skills page Duplicate button removal + AvaloniaEdit Desktop fixes remain | Phase 91 | Partial ✅ — Skills + Desktop deferred |
 | Active Sessions: up to 5 concurrent live tasks with return-anytime results; Settings UI on Web + Desktop, DB-backed; future admin console fallback | Phase 92 | ✅ Done |
 | Agents page — in-app create/edit, Launch chat, Run one-shot, prompt titles in ledger | Phase 79 | ✅ Done |
 | Orchestration Studio — compose and run teams from the UI; Run button with task prompt | Phase 94 | ✅ Done |
@@ -202,7 +212,7 @@ The engine is fully functional across five delivery modes with enterprise multi-
 | Migrate built-in markdown knowledge into the DB — move all on-disk built-in markdown (32 skills, 25 agents) plus the 44 code-defined document templates out of the filesystem/C# and into the `knowledge_pages` table so users manage every template (base + their own) in the DB without code changes; copy-on-write overlay model (immutable base rows, user edits become `global`/project overlays that win, revert = delete overlay); built-ins seeded via SQL migration; registries flipped to read DB; document rendering becomes data-driven via a sandboxed templating engine; `.md` files and disk scans deleted once verified; SQLite-only (knowledge store is local even on Postgres backend) | Phase 112 | Done ✅ |
 | Caching: DB read cache + Phase 31 invalidation fix — `CachedKnowledgeStore` decorator wraps `IKnowledgeStore` with TTL-based in-process caching for rarely-changing content (skills, agents, document templates, tool/doc guides) and fires a `KnowledgePageChanged` event on every write; repairs Phase 31's `CacheInvalidator` whose file-watcher triggers were deleted by Phase 112, restoring HTTP-cache invalidation for `skills:list`, `templates:list`, and `knowledge:*` keys; opt-out via `SOVRANT_KNOWLEDGE_CACHE_TTL=0` | Phase 113 | ✅ Done |
 | Intelligent Knowledge Harness — on-demand per-turn knowledge loading via `IKnowledgeRouter` (keyword/trigger/intent scoring, no LLM call); dynamic per-turn addendum preserves stable system-prompt cache; full-round-trip PII sanitization for knowledge bodies and tool results; `knowledge_attributions` table; MCP tool relevance filtering per turn; provenance Sources section in Web + Desktop chat | Phase 116 | ✅ Done |
-| Enrich built-in skill definitions — review and improve all 32 built-in skill descriptions (2-3 sentences), workflow bodies (≥5 concrete steps), agents/tools lists, and trigger phrases; ship as a `V038__enrich_builtin_skills.sql` additive migration that UPDATEs only the BuiltIn base rows; user overlays are unaffected | Phase 114 | Planned |
+| Enrich built-in skill definitions — 2-3 sentence descriptions, agent list wiring, `verification-loop` tools fix; V044 additive migration updates all 32 BuiltIn base rows; user overlays unaffected | Phase 114 | ✅ Done |
 | API endpoint integration — connect REST and GraphQL APIs as first-class platform integrations alongside MCP servers; harness auto-discovers endpoints via OpenAPI/Swagger spec import or GraphQL introspection, or admin can manually describe specific endpoints; discovered endpoints exposed as typed tools through the same `MCPTool` proxy layer (trust rules, session picker, `FilteredToolRegistry`); admin configures per workspace; credentials stored in encrypted keystore; Web + Desktop parity | Phase 117 | Planned |
 | Bootstrap configuration — declarative YAML file (`sovrant.bootstrap.yaml`) that pre-configures a Sovrant installation before or at first run; covers providers, MCP servers, knowledge/skills, agent templates, workspace setup, admin users, permission defaults, and branding; Sovrant installs and starts normally then applies the bootstrap idempotently; enables sales-assisted and partner-delivered custom installs without code changes | Phase 118 | Planned |
 | Orchestration improvements — enhanced mission run-mode for teams and swarms; missions get a named run-mode (autonomous, supervised, step-through) set at launch rather than inherited from global permission; Claws sourced from configured platform integrations can be added as team members if the integration is connected, giving orchestrations access to external agents alongside local ones | Phase 119 | Planned |
@@ -211,8 +221,12 @@ The engine is fully functional across five delivery modes with enterprise multi-
 | Image generation and inline display — allow models that support image output (e.g. `dall-e-3`, `gpt-image-1`, `flux`, `stable-diffusion` via OpenRouter, or any provider that returns `image_url` / base64 in the response) to generate images mid-conversation; generated images are stored as chat artifacts (`Artifact` with `Kind = "image"`) and rendered inline in the chat transcript for both Web and Desktop; the message bubble shows the image directly below the assistant text that prompted it, with a "Save" button to download the full-resolution file; clicking the image opens a lightbox (Web) or a full-size viewer window (Desktop); admin configures which providers and models are image-capable; no new conversation format needed — the existing artifact pipeline handles the binary payload | Phase 122 | Medium |
 | Memory system — workspace memory as a first-class user feature with public/private scoping: users can add memory notes directly from the chat "＋ Remember" button (web and desktop) or from a dedicated Workspace tab on the Memory page; notes are injected into every future chat session; private notes are only injected for their owner, public notes are injected for all workspace members; V041 migration adds `owner_user_id` and `is_private` to `workspace_memory`; `ConversationRuntime` auto-resolves the session owner's personal workspace so injection is per-user in multi-user deployments rather than relying on a global env var | Phase 123 | Done |
 | File system access controls — admin-configurable directory allowlist and blocklist so Sovrant agents can only operate within declared paths; enforced at the tool level before Read/Write/Edit/Glob/Grep/Bash execute; denied accesses logged as `directory_access_denied` governance audit events; Governance page gains a "File System Access" section (Web + Desktop); V044 migration stores rules in `server_settings`; path traversal and symlink escapes are normalised before evaluation | Phase 124 | Planned |
-| Chat conversation UX — collapsed work strips replace per-tool boxes; two-level expand (strip → tool list → full detail); live "doing X" in-progress indicator while agent works; clean visual hierarchy where the agent's answer is prominent and tool work is subordinate; consistent Web + Desktop parity | Phase 126 | Planned |
+| Chat conversation UX — collapsed work strips replace per-tool boxes; two-level expand (strip → tool list → full detail); live "doing X" in-progress indicator while agent works; clean visual hierarchy where the agent's answer is prominent and tool work is subordinate; consistent Web + Desktop parity | Phase 126 | Implemented — pending UAT |
 | Web search via integrations — move web search out of the hard-coded `WebSearchBackend` enum and into the Integration Gallery; add `IntegrationKind.HttpApi` for direct REST adapters (no MCP process); define `IWebSearchProvider` interface; ship DuckDuckGo (built-in free default), Brave, FireCrawl, Exa, Tavily as `HttpApi` catalog entries; add Crawl4AI as a scraper/fetcher integration; admin picks active search provider from Integrations page; remove `WebSearchBackend` enum; existing MCP search entries remain as alternatives; unit test coverage for WebFetchTool, search providers, and dispatch | Phase 125 | Planned |
+| Supabase Row Level Security — enable RLS on all privacy-sensitive tables in the Supabase migration and write policies for the `owner_user_id` model; service-role key retains full unrestricted access (Supabase bypasses RLS for service role by design); anon/authenticated JWT callers are scoped to their own data at the database layer; complements the existing application-layer query filters | Phase 127 | Planned |
+| Code generation quality gates — artifact security hardening; `.sln` + `Directory.Build.props` + CI for all 21 templates (every scaffold immediately runnable); `CodeValidateTool` (structural checks, no compiler in PATH); `CodeCreate` `next_steps` + `build_command` + LLM instruction update; `ArtifactManifest` code metadata | Phase 128 | ✅ Done |
+| Missions → Workflows rename and UX review — surface-label rename (presentation-layer only); dedicated Workflows page (goal-first launch, active/recent cards, detail view with journal + artifacts); positioning callout distinguishing AI-driven workflows from trigger-automation (n8n/Zapier/Make); `/v1/workflows` alias for `/v1/missions`; Phase 119 run-modes surfaced in the launch form; plus dual-path execution — Claude Agent SDK dynamic workflow orchestration when a qualifying Claude tier is active, otherwise Sovrant's own mission engine as the base version (model/tier gate TBD) | Phase 129 | Planned (v1.5) |
+| OpenRouter account registration & key issuance in-app — "Get an OpenRouter key" button on the Providers setup flow (Web + Desktop) drives OpenRouter's OAuth PKCE flow (`openrouter.ai/auth`) so a user can register a new OpenRouter account or sign into an existing one and receive a working API key without ever leaving Sovrant or hand-copying a key; reuses the PKCE code-challenge/verifier plumbing and loopback callback listener built for Phase 101's MCP OAuth; issued key is written straight into the encrypted keystore and activated as a provider profile like a manually-entered key | Phase 130 | Planned |
 
 ### v1.0 release polish ✅
 
@@ -7019,120 +7033,71 @@ Boundary for dependency manifest validation.
 
 ---
 
-## Phase 74 — Markdown-Backed Document Templates
+## Phase 74 — DB-Backed Document Templates
 
 ### Why
 
-The document template library (Phase 66 and 66.4, currently 44 templates across
-7 industries) is entirely hardcoded as C# classes. Each template is a sealed
-class implementing `IDocumentTemplate` whose `Render(JsonElement)` builds a
-markdown body with a `StringBuilder`. Adding or tweaking a template requires a
-developer, a rebuild, and a deploy. That mirror-images the pattern we already
-use for **agent templates**, which are markdown files with YAML frontmatter
-loaded at runtime via `FileSystemTemplateLoader` (`src/Sovrant.Agents/Templates/FileSystemTemplateLoader.cs`).
-
-The goal of this phase is to bring document templates to parity: let domain
-experts (legal, clinical, finance, education) author and revise templates as
-`.md` files — with field schema in YAML frontmatter, body in markdown with an
-expression syntax — without touching C#. A small hybrid escape hatch preserves
-the ability to express non-trivial logic (computed totals, conditional
-sections, dynamic tables) for templates that genuinely need it.
-
-This also unlocks **user-authored templates**, matching the planned knowledge
-pages subsystem (`project_knowledge_pages.md`): users can drop a template into
-their workspace and have it appear in the registry automatically.
-
-### Scope
-
-1. **Template file format**
-   - YAML frontmatter declares `id`, `name`, `industry`, `description`,
-     `format` (Word / StructuredPdf / Excel), and a `fields:` list matching
-     the existing `TemplateField` schema (String, Text, Integer, Decimal,
-     Currency, Date, Boolean, StringArray, ObjectArray with nested
-     `itemFields`).
-   - Body is markdown with an expression syntax for field interpolation,
-     conditionals, and loops. Evaluate candidates: Scriban (fastest, .NET-
-     native, safe), Liquid via DotLiquid (familiar to non-devs), Handlebars.
-     **Lean: Scriban** — it's already .NET-native, has strong sandboxing,
-     supports custom functions for our format helpers, and doesn't require
-     a separate interpreter.
-2. **Runtime loader**
-   - New `MarkdownDocumentTemplate : IDocumentTemplate` that accepts a parsed
-     file. Registered alongside existing C# templates.
-   - `FileSystemDocumentTemplateLoader` scans one or more directories (built-
-     in resources, workspace overrides, user overrides) in override order.
-   - Expose format helpers (`FormatMoney`, `FormatDate`, `FormatPercent`,
-     `EscapePipes`, `Slug`) as Scriban functions so markdown templates use
-     the same rendering conventions as the hardcoded ones.
-3. **Validation and error surfacing**
-   - Field validation still runs through `TemplateData.Validate`; frontmatter
-     deserialization produces the same `TemplateField` list.
-   - Template-file errors (bad YAML, unknown field, unresolved expression)
-     should produce actionable error messages at load time, not at render
-     time. Load-time errors fail the registry cold; render-time errors
-     return a `TemplateValidationException`-shaped result.
-4. **Hybrid escape hatch**
-   - Some templates have logic a pure template engine shouldn't express:
-     computed totals (superbill line-item sums, CMA $/sqft averages, closing
-     disclosure cash-to-close), custom table column counts (optional columns
-     only appearing when any row has data), HIPAA-specific sequencing of
-     required clauses, contingency `[Waived]` markers, etc.
-   - Support a **code-behind** model: a markdown template can reference a
-     class (via frontmatter `codeBehind: Sovrant.Runtime.Documents.Templates.Healthcare.SuperbillCodeBehind`)
-     that exposes computed properties to the template context. Simple
-     templates need no code-behind.
-5. **Migration**
-   - Convert the ~20 templates that are purely "fields + markdown body"
-     (NDA, terms-of-service, lease agreement, syllabus, etc.) to `.md` files.
-     Delete the corresponding C# classes.
-   - Keep the ~14 templates with real logic (superbill, CMA, closing
-     disclosure, HIPAA authorization, progress note, business plan,
-     performance review with competencies table, etc.) as markdown + code-
-     behind. Their C# render method shrinks to a handful of computed
-     properties.
-   - All 51 existing template tests must continue to pass, unchanged —
-     they exercise the `IDocumentTemplate` contract, not the implementation.
-6. **User overrides**
-   - Workspace directory `<workspace>/.sovrant/templates/` is scanned by the
-     loader. Templates there shadow built-in templates with the same `id`.
-   - A future Phase 74.x can expose a UI for editing templates in-app; this
-     phase only needs the filesystem contract.
-7. **Author ergonomics**
-   - Document the file format under `docs/document-templates.md` with one
-     worked example per field type, including nested ObjectArray.
-   - Ship a `sovrant templates lint <file>` CLI command that validates a
-     template file without rendering it — useful for authors before they
-     commit.
+The original Phase 74 plan called for `.md` files on disk. That approach was
+superseded during Phase 112C/D: all content — skills, agent definitions, and
+now document templates — is stored in the `knowledge_pages` table so it
+benefits from the same copy-on-write overlay model, Knowledge UI editing, and
+`IKnowledgeRouter` routing.
+
+The goal of this phase is to complete the migration: ship the `sovrant document
+lint` CLI command (Scriban syntax validation + fields_json sanity check) and the
+`docs/document-templates.md` authoring guide so domain experts can author,
+review, and iterate on templates without rebuilding the binary.
+
+### What Is Already In Place
+
+**Phase 112D (already done before this phase):**
+
+- **V036** — `knowledge_pages` gains `fields_json`, `filename_template`,
+  `default_format`, and `industry` columns for document templates.
+- **V037** — Seeds 42 built-in Scriban templates as `kind = 'document-templates'`
+  `BuiltIn` rows. The two Excel-format templates (`finance/expense-report`,
+  `finance/loan-amortization`) remain as C# because they emit structured JSON
+  bodies (preamble/headers/rows) rather than Markdown.
+- **`DbDocumentTemplate`** — `IDocumentTemplate` backed by a `KnowledgePage`.
+  Uses `ScribanRenderer.Render(_page.Body, data)` and
+  `TemplateFieldSerializer.Deserialize(page.FieldsJson)`.
+- **`ScribanRenderer`** — Scriban rendering with format helpers:
+  `format_date`, `format_money`, `format_money_whole`, `format_number`,
+  `format_percent`, `escape_pipes`, `slug`, `normalize_currency`.
+- **`TemplateRegistry`** — loads C# templates first, then DB-backed
+  `DbDocumentTemplate` rows override by slug. DB wins.
+- **Copy-on-write user overlay** — Global/Project tier rows shadow BuiltIn
+  base rows by slug. Revert = delete the overlay row. UI editing uses the
+  existing Knowledge page inline editor (Phase 91).
+- **All 51 existing template tests pass** — they test the `IDocumentTemplate`
+  contract, which is unchanged.
+
+### Delivered
 
 ### Non-Goals
 
-- **Not** building a visual template editor. That's a follow-on phase.
-- **Not** replacing the `IDocumentTemplate` interface; this phase adds a new
-  implementation backed by markdown files, not a new contract.
-- **Not** migrating the code generation / agent / runtime template systems —
-  they already are, or intentionally aren't, file-based.
+- **Not** building a visual template editor — that's a Phase 91 follow-on.
+- **Not** filesystem-based template loading — all templates are DB-only.
+- **Not** changing the `IDocumentTemplate` interface or `TemplateRegistry`.
 
 ### Acceptance Criteria
 
-- [ ] Template file format spec documented with field-type reference and
-      worked examples
-- [ ] `MarkdownDocumentTemplate` implementation + `FileSystemDocumentTemplateLoader`
-      merged and registered in DI alongside C# templates
-- [ ] Scriban (or chosen engine) integrated with format-helper bindings
-      (`format_money`, `format_date`, `format_percent`, `escape_pipes`, `slug`)
-- [ ] Frontmatter schema covers every `TemplateFieldType`, including nested
-      `ObjectArray` with `itemFields`
-- [ ] At least 15 simple templates ported from C# to `.md`, corresponding
-      C# classes deleted
-- [ ] Code-behind mechanism in place for hybrid templates; at least 3 complex
-      templates (e.g. superbill, CMA, closing disclosure) migrated with
-      code-behind
-- [ ] Workspace override directory loads and shadows built-ins by `id`
-- [ ] `sovrant templates lint` CLI command validates a file without rendering
-- [ ] All existing document-template tests still pass; new tests cover the
-      markdown loader, Scriban rendering, and override precedence
-- [ ] Template authoring guide published under `docs/document-templates.md`
-      so non-developers can author a template end-to-end
+- [x] 42 built-in templates seeded as BuiltIn `knowledge_pages` rows (V037)
+- [x] `DbDocumentTemplate` — `IDocumentTemplate` backed by `KnowledgePage`
+- [x] Scriban renderer with `format_date`, `format_money`, `format_percent`,
+      `escape_pipes`, `slug`, `normalize_currency`, `format_number`,
+      `format_money_whole` helpers
+- [x] `TemplateRegistry` merges C# + DB templates; DB overrides win
+- [x] Copy-on-write user overlay — Global/Project tier rows shadow BuiltIn
+- [x] All 51 existing document-template tests pass
+- [x] Admin Edit/Revert buttons on Documents page (Web + Desktop) — inline
+      editor saves a User-tier overlay; `Registry.Reload()` reflects changes
+      immediately; 2 Excel C# templates intentionally excluded (computed logic)
+- [x] `sovrant document lint [--id <id>] [--json]` CLI command validates
+      Scriban syntax and fields_json for DB-backed templates; exit code 1 on
+      any failure
+- [x] `docs/document-templates.md` authoring guide covers field types,
+      Scriban expression syntax, format helpers, and the add/edit workflow
 
 ## Phase 75 — Documents Surface Re-evaluation
 
@@ -11413,7 +11378,7 @@ Once all backends are integrations, the `WebSearchBackend` enum and `WebSearchOp
 
 ## Phase 126 — Chat Conversation UX: Collapsed Work Strips & Clear Hierarchy
 
-**Status:** Planned
+**Status:** Implemented (v1.5) — items 1–7 shipped on Web (`WorkStrip.razor`, `ChatMessage.razor`, `sovrant.css`) and Desktop (`MessageViewModel.cs`, `ChatView.axaml`); solution builds clean, no dangling references to removed pre-strip members. One contrast fix applied before merge: `.work-strip-row-error .work-strip-row-name` was coloring tool-name text red (a colored-text violation of the item 7 rule, ~3.7:1 on the light theme, short of the 4.5:1 bar) — removed in favor of the existing status-dot fill + header ⚠ icon, matching what Desktop already did. **Pending UAT verification** — live browser/Desktop interaction through an actual agentic turn has not been exercised yet (owner verifying in UAT).
 
 ### Why
 
@@ -11499,6 +11464,25 @@ Desktop (`ChatView.axaml` / `ToolUseViewModel`):
 
 Both surfaces share the same visual language (strip line format, icon set, status badge colours) so the experience is identical whether the user is on Web or Desktop.
 
+**7. Color & contrast — reuse existing tokens, verify on both themes**
+
+The strip must not invent a fourth color system. Sovrant already has a themed token set for exactly this kind of chrome, and Web/Desktop have kept it token-for-token identical so far — the strip should extend it, not bypass it:
+
+| Purpose | Web token (`sovrant.css`) | Desktop resource (`SovrantDarkColors.axaml` / `SovrantLightColors.axaml`) | Dark value | Light value |
+|---|---|---|---|---|
+| Strip / tool-row background | `--tool-use-bg` | `ToolUseBackground` | `#1E1E2E` | `#F0F0FA` |
+| Strip / tool-row border | `--tool-use-border` | `ToolUseBorder` | `#3A3A4A` | `#D0D0E0` |
+| In-progress / active accent | `--brand-primary` | `BrandPrimary` | `#6D52C6` | `#6D52C6` (only token intentionally identical across both themes) |
+| Completed / pass indicator | `--status-pass` | `StatusPass` | `#4CAF50` | `#4CAF50` |
+| Partial-failure / warn indicator | `--status-warn` | `StatusWarn` | `#FF9800` | `#FF9800` |
+| Error / fail indicator | `--status-fail` | `StatusFail` | `#F44336` | `#F44336` |
+
+Two things to get right before this ships, not after:
+
+- **The status trio isn't actually re-themed today.** `sovrant.css` only sets `--status-pass/warn/fail` in the `:root[data-theme="dark"]` block; the `:root[data-theme="light"]` block never overrides them, so light mode silently inherits the same dark-tuned hex values (same story in the two Desktop `.axaml` dictionaries — they happen to repeat identical hex rather than share one source). That's been fine for small dots/badges, but the work strip's ⚠ error state and the animated in-progress text put color closer to text-label duty, where dark-surface-tuned colors can under-perform on light backgrounds.
+- **Contrast check, not eyeball check, before merge.** `#4CAF50` green as a filled dot/icon (3:1 WCAG graphical-object threshold) is fine on both `#1E1E2E` (dark tool-use bg) and `#F0F0FA` (light tool-use bg). The same `#4CAF50` used as *text* on a light card (`--surface-card: #FFFFFF`) lands around ~2.4:1 — well under the 4.5:1 text threshold. Rule for this phase: pass/warn/fail render as icon + fill only, never as colored text; if a future design wants colored status *text*, that needs its own light-theme-specific values (e.g. `--status-pass-light`) rather than reusing the dark-tuned hex.
+- **No new tokens for the base strip.** Background/border/active-accent reuse existing tokens as-is. If the contrast check above does force new light-specific status values, add them to both `sovrant.css` and `SovrantLightColors.axaml` in the same PR — don't let Web and Desktop drift on hex values the way the two Desktop `.axaml` files currently duplicate rather than share.
+
 ### What stays out of scope
 
 - Replay / history view of tool calls across sessions (separate memory/history phase)
@@ -11516,3 +11500,468 @@ Both surfaces share the same visual language (strip line format, icon set, statu
 - The answer text is readable without scrolling past tool blocks on a typical 1080p screen
 - Web and Desktop render the strip with the same visual language
 - No regression in tool confirmation flow (Allow once / Allow for turn / Deny buttons still work within the strip)
+- Pass/warn/fail indicators are icon+fill only (no colored text labels) on both themes; if colored text ships anyway, it passes a 4.5:1 contrast check against the light theme's `--surface-card` / `--tool-use-bg` backgrounds, not just the dark theme
+
+---
+
+## Phase 127 — Supabase Row Level Security
+
+**Status:** Planned
+
+### Why
+
+Sovrant enforces the `owner_user_id` privacy model at the application layer — query filters in `SqliteWorkspaceStore`, `SqliteMemoryStore`, and similar stores ensure users only see their own private data. In a Supabase deployment this is sufficient for all traffic that goes through the Sovrant API, but it leaves a gap:
+
+- **Supabase dashboard queries** (developers, DBAs) run directly against the database and bypass the application layer entirely
+- **Edge Functions** calling `supabase.from(...)` use the user's JWT and get no automatic scoping unless RLS is enabled
+- **Service-role callers** (the Sovrant server itself, admin scripts) need unrestricted access and must not be blocked
+
+RLS closes the first two gaps without touching the third — Supabase's service role bypasses RLS by design. This means the Sovrant API server, admin tooling, and migration scripts all continue to work with zero changes; only JWT-authenticated direct-DB callers gain a scoping boundary.
+
+The commented-out policy skeletons already exist in `db/supabase/migrations/20260625000000_initial_schema.sql`. This phase activates them properly with a second migration file admins can apply when they are ready.
+
+### What ships
+
+**A new Supabase migration** (`db/supabase/migrations/20260625000001_enable_rls.sql`) that:
+
+1. Enables RLS on the four privacy-sensitive tables:
+   - `workspace_memory`
+   - `session_summaries`
+   - `learned_patterns`
+   - `instincts`
+
+2. Creates read policies scoped to the calling JWT's `auth.uid()`:
+
+| Table | Policy | Rule |
+|---|---|---|
+| `workspace_memory` | `workspace_memory_read` | `is_private = 0 OR owner_user_id = auth.uid()::text` |
+| `session_summaries` | `session_summaries_read` | `owner_user_id = '' OR owner_user_id = auth.uid()::text` |
+| `learned_patterns` | `learned_patterns_read` | `owner_user_id = '' OR owner_user_id = auth.uid()::text` |
+| `instincts` | `instincts_read` | `owner_user_id = '' OR owner_user_id = auth.uid()::text` |
+
+3. Creates permissive write policies that allow authenticated callers to insert/update/delete their own rows and rows with `owner_user_id = ''` (shared/legacy).
+
+**Service-role key is unaffected** — Supabase's service role always bypasses RLS. The Sovrant API server uses the service role key for all database operations, so no application code changes are needed.
+
+**Docs** — `docs/persistence.md` updated to note that the RLS migration is available as an optional `supabase db push` step; the commented-out stubs in the initial migration file are removed now that a proper migration exists.
+
+### What stays out of scope
+
+- RLS on session or audit tables — those are queried by the application with scoped filters already; RLS on high-write tables adds overhead without meaningful security gain for service-role deployments
+- Per-workspace RLS policies — the current `owner_user_id` model is user-scoped; workspace-level isolation is a separate governance layer
+- Standalone PostgreSQL RLS — standalone deployments use application-layer auth exclusively; service-role bypass does not apply in the same way
+
+### Acceptance criteria
+
+- After applying the migration, a direct Supabase client authenticated as user A cannot read user B's private `workspace_memory` rows via the dashboard or an Edge Function
+- User A can read all `workspace_memory` rows where `is_private = 0` regardless of `owner_user_id`
+- The Sovrant API server (service-role key) continues to read and write all rows without restriction
+
+---
+
+## Phase 128 — Code Generation Quality Gates
+
+**Status:** ✅ Done (2026-07-01)
+
+### Why
+
+Phase 73 shipped the scaffolding *mechanism* — 21 templates, `CodeCreateTool`, `CodeCreateMultiTool`, 235 tests. Generated code runs and passes its first test. That met the "works" bar. The higher bar is **immediately runnable, production-shaped projects**: a .NET user should be able to unzip the artifact and run `dotnet build MyApi.sln` on the first try; a Node user should run `npm install && npm start`; a Go user `go build ./...`. Nothing should be missing.
+
+Three root causes hold this back today:
+
+1. **Scaffolds omit project-level files.** The .NET templates produce `.csproj` files but no `.sln` — `dotnet build` won't work from the project root. No template ships a CI pipeline. No template uses `Directory.Build.props` to share properties across projects. These are mechanical, not model-quality issues.
+
+2. **No structural quality gate.** `CodeCreateTool` writes files and stops. If the LLM writes malformed XML in a `.csproj`, or references a namespace that doesn't exist, or omits `package.json` entirely — those errors are invisible until the user runs the build. A `CodeValidate` tool closes this loop via in-process structural checks (parse JSON/XML/YAML, verify required files exist) without needing any compiler in PATH.
+
+3. **The LLM is not instructed on what to do next.** After `CodeCreate` returns, the agent has conventions (via `LanguageGuidelines`) but no `next_steps` — no "add your route handlers here," no "call CodeValidate when done." The tool description reads like documentation, not instruction.
+
+4. **Artifact delivery has security and correctness gaps.** The artifact store serves LLM-generated HTML/SVG/JS without `Content-Disposition: attachment`, opening an XSS vector. The `RemoteArtifactStore.ListAsync` reads wrong JSON field names from the server. The API server has no bulk zip endpoint. The Blazor Artifacts page bypasses `IArtifactStore` and casts to `LocalArtifactStore` directly.
+
+This phase addresses all four. It is designed to work with **any code-capable LLM** — the quality gates are structural checks and explicit instruction, not model judgment.
+
+### Scope
+
+#### Part A — Artifact store security and correctness fixes
+
+**A1. Content-security headers on file downloads** (`Sovrant.Web/Program.cs` + `Sovrant.Server/Routes/ArtifactRoutes.cs`):
+- For `text/html`, `image/svg+xml`, `application/javascript`: force `Content-Disposition: attachment; filename="..."` and add `X-Content-Type-Options: nosniff`
+- For all artifact downloads: add `X-Content-Type-Options: nosniff` and `Cache-Control: private, no-store`
+- LLM-generated files must be treated as untrusted third-party content even within the user's own workspace
+
+**A2. Fix `RemoteArtifactStore.ListAsync`** (`Sovrant.Api.Client/RemoteArtifactStore.cs:43–55`):
+- JSON field `path` → `relative_path`; `size` → `size_bytes` — these must match what `ArtifactRoutes.cs` actually serializes
+
+**A3. Add `GET /v1/artifacts/{runId}.zip`** to `Sovrant.Server/Routes/ArtifactRoutes.cs`:
+- Mirrors the web-app zip endpoint; streams a `ZipArchive` via `IArtifactStore.ListAsync` + `ReadAsync` (no `LocalArtifactStore` cast — stays interface-clean for future cloud backends)
+- Respects the workspace auth guard
+- Makes bulk code scaffold download available to all clients: SDK, CLI in server mode, mobile
+
+**A4. Fix `Artifacts.razor` abstraction leak**:
+- Replace the `LocalArtifactStore` cast + `Directory.EnumerateFiles` call with `IArtifactStore.ListAsync`
+- Load `_manifest.json` via `ReadAsync` to surface code-specific metadata (see B2)
+
+#### Part B — Code-specific artifact manifest
+
+**B1. `ArtifactManifest` — add optional code metadata fields** (additive, no migration needed):
+```csharp
+[JsonPropertyName("kind")]           public string? Kind { get; set; }          // "code-scaffold"
+[JsonPropertyName("language")]       public string? Language { get; set; }      // "dotnet"
+[JsonPropertyName("template_id")]    public string? TemplateId { get; set; }    // "dotnet/webapi"
+[JsonPropertyName("build_command")]  public string? BuildCommand { get; set; }  // "dotnet build MyApi.sln"
+[JsonPropertyName("run_command")]    public string? RunCommand { get; set; }    // "dotnet run --project MyApi"
+[JsonPropertyName("test_command")]   public string? TestCommand { get; set; }   // "dotnet test MyApi.sln"
+[JsonPropertyName("entry_point")]    public string? EntryPoint { get; set; }    // "MyApi/MyApi.sln"
+```
+
+**B2. `CodeCreateTool` writes a code manifest** after scaffolding — stamps `Kind = "code-scaffold"`, `Language`, `TemplateId`, `BuildCommand`, `RunCommand`, `TestCommand` into `_manifest.json`. The Artifacts page can then render a language badge and copy-able run commands in the folder detail view.
+
+#### Part C — Scaffold enrichment ("every project is immediately runnable")
+
+Update all 21 scaffold templates in `src/Sovrant.Tools/Projects/Scaffolds/`. Pure C# changes to the scaffold classes — no DB migration, no knowledge_pages rows involved (scaffolds live in code, not the DB).
+
+**All 5 .NET scaffolds** (`dotnet/webapi`, `dotnet/console`, `dotnet/library`, `dotnet/blazor`, `dotnet/worker`):
+
+| Addition | Detail |
+|---|---|
+| `{pascal}.sln` | Generated with `Guid.NewGuid()` per project (matches `dotnet new sln` behavior); references main project + tests project with C# project type GUID `{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}`; `Debug\|Release × Any CPU` config matrix |
+| `Directory.Build.props` | Shared `<Nullable>enable</Nullable>`, `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>`, `<AnalysisMode>All</AnalysisMode>` — removed from individual `.csproj` files to avoid duplication |
+| `.editorconfig` | Standard C# indentation, charset, trailing whitespace rules |
+| `.github/workflows/ci.yml` | `dotnet restore → dotnet build --no-restore → dotnet test --no-build` on push/PR |
+
+**All 16 non-.NET scaffolds** — add `.github/workflows/ci.yml` per language:
+
+| Templates | CI steps |
+|---|---|
+| `node/*` (4 templates) | `npm ci → npm run lint → npm test`; also add `.nvmrc` |
+| `python/*` (2 templates) | `pip install -e ".[dev]" → ruff check → pytest`; `pyproject.toml` with `[project.optional-dependencies] dev = [pytest, ruff]` |
+| `go/api` | `go build ./... → go vet ./... → go test ./...`; add `Makefile` (build/test/lint targets) |
+| `rust/cli` | `cargo build → cargo clippy → cargo test`; add `rust-toolchain.toml` |
+| `java/maven` | `mvn verify` |
+| `kotlin/console` | `./gradlew check` |
+| `ruby/script` | `bundle install → rspec` |
+| `swift/cli` | `swift build → swift test` |
+| `cpp/cmake` | `cmake → make → ctest`; add `CMakePresets.json` |
+| `lua/script` | `Makefile` (test via busted); `.luacheckrc` |
+| `zig/cli` | `zig build → zig test` |
+
+#### Part D — LLM instruction enrichment
+
+**D1. `IProjectTemplate` — add two optional members** (default `string.Empty`):
+```csharp
+string BuildCommand { get; }  // e.g. "dotnet build {pascal}.sln"
+string RunCommand { get; }    // e.g. "dotnet run --project {pascal}"
+```
+Each scaffold overrides as appropriate. These feed both the artifact manifest (B2) and `next_steps` (D2).
+
+**D2. `CodeCreate` and `CodeCreateMulti` response — add fields**:
+```json
+{
+  "next_steps": [
+    "Add your route handlers — e.g. app.MapPost('/items', async (ItemDto dto) => { ... })",
+    "Register services in Program.cs using builder.Services.Add*()",
+    "Place model classes in a Models/ folder, one file per type",
+    "Call CodeValidate when done to verify structural correctness"
+  ],
+  "build_command": "dotnet build MyApi.sln",
+  "test_command":  "dotnet test MyApi.sln",
+  "run_command":   "dotnet run --project MyApi"
+}
+```
+`next_steps` is generated by each template's `NextSteps(ScaffoldContext)` method. This gives the LLM concrete, project-specific guidance rather than generic style rules.
+
+**D3. Tool `Description` update** for `CodeCreate` and `CodeCreateMulti`:
+> *"After scaffolding, add business logic with the Artifact tool following the returned `conventions` and `next_steps`. Then call `CodeValidate` to verify structural correctness. If issues are found, fix them and call `CodeValidate` once more before presenting the project to the user."*
+
+#### Part E — `CodeValidateTool` (new tool)
+
+**File:** `src/Sovrant.Tools/Projects/CodeValidateTool.cs`  
+**Tool name:** `CodeValidate`  
+**Input:** `run_id`, `workspace_id`, `project_id` (same scope as `CodeCreate`); optional `language` (auto-detected from file extensions if omitted)
+
+**Flow:** `IArtifactStore.ListAsync(scope)` → enumerate files → `ReadAsync(handle, path)` for each → run per-language structural checks → return report. No compiler invocation; no language runtime required in PATH.
+
+**Check matrix:**
+
+| Check | Languages | What |
+|---|---|---|
+| `.sln` present at depth ≤ 2 | dotnet | File exists with `.sln` extension |
+| Each `.csproj` parses as valid XML | dotnet | `XDocument.Parse` |
+| `<TargetFramework>` present in each `.csproj` | dotnet | XPath check |
+| `package.json` present + valid JSON + has `name`/`version` | node | `JsonDocument.Parse` |
+| `go.mod` present with `module` directive | go | File exists; first line check |
+| `Cargo.toml` present with `[package]` section | rust | File exists; line scan |
+| `pyproject.toml` or `requirements.txt` present | python | Either file exists |
+| All `.json` files parse | all | `JsonDocument.Parse` |
+| All `.xml`/`.csproj`/`pom.xml` files parse | all | `XDocument.Parse` |
+| All `.yml`/`.yaml` files parse | all | Basic structure heuristic (no external YAML dep) |
+| `.github/workflows/ci.yml` present | all | File path exists in listing |
+
+**Output on success:**
+```json
+{
+  "valid": true,
+  "language": "dotnet",
+  "file_count": 12,
+  "issue_count": 0,
+  "issues": []
+}
+```
+**Output on failure:**
+```json
+{
+  "valid": false,
+  "language": "dotnet",
+  "file_count": 8,
+  "issue_count": 2,
+  "issues": [
+    {
+      "file": "MyApi.sln",
+      "severity": "error",
+      "message": "Solution file missing — dotnet build will not work from the project root",
+      "fix_hint": "Create MyApi.sln referencing MyApi/MyApi.csproj and MyApi.Tests/MyApi.Tests.csproj"
+    },
+    {
+      "file": "MyApi/MyApi.csproj",
+      "severity": "error",
+      "message": "XML parse error: unexpected token at line 5",
+      "fix_hint": "Check for unclosed tags or invalid characters"
+    }
+  ],
+  "self_correction_prompt": "The scaffold has 2 structural errors (listed above). Fix them using the Artifact tool before presenting the project to the user. Then call CodeValidate once more to confirm."
+}
+```
+
+The `self_correction_prompt` field is the re-entry point for the LLM's agentic loop. The tool itself runs once and returns; the loop is driven by the LLM following the instruction in `self_correction_prompt`. The tool description caps this at one retry: "call CodeValidate once more after fixing."
+
+### Implementation order
+
+| Step | What | Files |
+|---|---|---|
+| A1 | Content-security headers (both servers) | `Sovrant.Web/Program.cs`, `ArtifactRoutes.cs` |
+| A2 | Fix `RemoteArtifactStore.ListAsync` field names | `RemoteArtifactStore.cs` |
+| A3 | Add `GET /v1/artifacts/{runId}.zip` to API server | `ArtifactRoutes.cs` |
+| B1 | `ArtifactManifest` code metadata fields | `ArtifactManifest.cs` |
+| C | Scaffold enrichment — `.sln` + CI for all 21 templates | All scaffold `.cs` files |
+| D1 | `IProjectTemplate.BuildCommand` / `RunCommand` | `IProjectTemplate.cs` + all scaffold classes |
+| D2 | `CodeCreate` / `CodeCreateMulti` response `next_steps` | `CodeCreateTool.cs`, `CodeCreateMultiTool.cs` |
+| B2 | `CodeCreateTool` writes code manifest | `CodeCreateTool.cs` |
+| D3 | Tool `Description` updates | Same files |
+| E | `CodeValidateTool` | New file `Projects/CodeValidateTool.cs` |
+| A4 | `Artifacts.razor` abstraction fix + manifest display | `Artifacts.razor` |
+| — | Tests: enriched scaffolds + `CodeValidateTool` | New test files |
+
+### What this is not
+
+- Not a compiler-in-the-loop gate — structural validation only; no language runtime required in PATH
+- Not a style enforcer — `LanguageGuidelines` remain advisory; guideline conformance is not a gate
+- Not a replacement for the user's own CI — the generated CI config is a starting point
+- Not a continuous linting service — validation fires at generation time, not on every file write
+
+### Acceptance Criteria
+
+- [ ] All 5 .NET scaffolds produce a `.sln` file; `dotnet build {pascal}.sln` succeeds on the generated output with no additional steps
+- [ ] All 21 templates produce `.github/workflows/ci.yml` with correct install/build/test steps for the language
+- [ ] `IProjectTemplate.BuildCommand` / `RunCommand` implemented on all scaffold classes; values appear in `CodeCreate` response and `_manifest.json`
+- [ ] `CodeCreate` response includes `next_steps`, `build_command`, `test_command`, `run_command`; tool description instructs the LLM to call `CodeValidate` after writing code
+- [ ] `CodeValidateTool` registered, all check matrix rows implemented; returns `valid: true` for a freshly scaffolded project of every language; returns `valid: false` with actionable `issues` + `self_correction_prompt` when `.sln` or `package.json` is missing
+- [ ] `GET /v1/artifacts/{runId}.zip` added to API server; returns a correct zip of all run artifacts; respects workspace auth
+- [ ] HTML/SVG/JS artifact downloads from both web and API server send `Content-Disposition: attachment` + `X-Content-Type-Options: nosniff`
+- [ ] `RemoteArtifactStore.ListAsync` field names fixed; remote-mode artifact listing returns correct entries
+- [ ] `Artifacts.razor` no longer casts to `LocalArtifactStore`; uses `IArtifactStore.ListAsync`; displays language badge + build/run commands when `_manifest.json` has code metadata
+- [ ] All existing Phase 73 scaffold tests pass unchanged
+- [ ] New unit tests cover: `.sln` present in each .NET scaffold; `ci.yml` present in each template; `CodeValidateTool` pass/fail cases for dotnet, node, python, go
+
+### Deferred
+
+- Compiler/linter-in-the-loop (invoking `dotnet build`, `tsc`, `ruff` as subprocesses) — requires language runtime availability detection, temp directory management, stdout/stderr capture, and process isolation; too much platform complexity for v1.5; structural validation + self-correction via `CodeValidateTool` achieves the main quality lift without it
+- Continuous background linting of the user's working tree — separate concern
+- Cloud artifact backend (S3/Azure/R2) — `IArtifactStore` is ready; backend registration is the remaining work; deferred to post-v1.5 per the workspace provider roadmap
+
+---
+
+## Phase 129 — Missions → Workflows: Rename, Positioning, and UX Review
+
+**Status:** Planned (v1.5)
+
+### Why
+
+The term "missions" is accurate for the engine internals — a bounded goal delegated to an AI team with a planner, executor, and journal — but it is opaque to users. Almost everyone arriving at Sovrant calls this concept a "workflow." Renaming closes the vocabulary gap without changing what the engine does.
+
+More importantly, the rename is the right moment to resolve a positioning question the codebase sidesteps today: **what kind of workflows does Sovrant own, and what does it deliberately leave to external tools?**
+
+The answer is clear from what's already shipped:
+- **Sovrant owns**: AI-orchestrated, goal-driven workflows where the "steps" are LLM agents making decisions — not predetermined trigger→action chains. The planner decomposes the goal; the executor routes it; the agents adapt. This is the lane n8n and Zapier cannot fill.
+- **n8n, Zapier, Make, Composio own**: trigger-based automation, scheduled jobs, branching deterministic pipelines, and hundreds of SaaS connectors. These are already available in Sovrant via the Integrations Gallery as MCP connections — Sovrant acts as the AI layer on top of them, not a replacement for them.
+
+Without this distinction surfaced in the UI, users either expect Sovrant to be a Zapier clone (and are disappointed) or miss entirely that they can run complex AI-driven goals with a single prompt.
+
+The UX also needs work independent of naming. Today "missions" is discoverable only through the Orchestration Studio → Run button and the Command Center grid. There is no dedicated Workflows page where a user can launch, monitor, and review their AI-driven workflows without knowing what an "orchestration" or "mission" is first.
+
+### What ships
+
+#### 1 — Surface label rename (Web + Desktop)
+
+Replace every user-visible "Mission" / "Missions" label with "Workflow" / "Workflows" across both surfaces. The underlying DB table (`missions`), API path (`/v1/missions`), and C# types (`IMissionStore`, `LlmMissionPlanner`, etc.) are **not renamed** — this is a presentation-layer change only.
+
+| Where | Old label | New label |
+|---|---|---|
+| Nav / rail | Missions | Workflows |
+| Orchestration Studio | Run Mission | Run Workflow |
+| Command Center | Missions column | Workflows column |
+| User Dashboard | missions stat | workflows stat |
+| Page titles | Missions | Workflows |
+| Privacy toggle | Make mission private | Make workflow private |
+| Completion messages | "Mission complete" | "Workflow complete" |
+
+**API compatibility:** Add `/v1/workflows` as an alias that proxies to `/v1/missions` on all CRUD and status endpoints. The `/v1/missions` path is retained and marked `@deprecated` in comments (not removed — no external consumers confirmed yet, but a grace period is the right call).
+
+#### 2 — Dedicated Workflows page
+
+Replace or supplement the current Orchestration Studio with a standalone `/workflows` page (Web) and `WorkflowsView` (Desktop) that is the primary entry point for AI-driven workflows. The Orchestration Studio can remain for team composition; the Workflows page is for goal-level users who don't care about the agent structure underneath.
+
+**Page layout:**
+- **Header**: "Workflows" + "New Workflow" button (prominent)
+- **Active workflows**: card row — name, goal snippet, team name, run-mode badge (Autonomous / Supervised / Step-through), live status indicator (dot + "Running step 3 of ~5"), elapsed time
+- **Recent workflows**: collapsible list of completed/failed — name, team, finish time, outcome badge (✅ Complete / ❌ Failed), link to detail
+- **Empty state**: "No workflows yet. A workflow gives an AI team a goal and lets it figure out the steps." + "New Workflow" CTA
+
+**What it is not**: a node editor, a visual flow diagram, a cron scheduler.
+
+#### 3 — New Workflow launch form
+
+A simple form replacing (or complementing) the current Orchestration Studio run path:
+
+```
+Goal:         [textarea — describe what you want accomplished]
+Team:         [dropdown of configured teams, or "Let Sovrant pick"]
+Run mode:     [Autonomous | Supervised | Step-through]
+Name:         [optional, auto-generated from goal if blank]
+[Run Workflow]
+```
+
+The "Let Sovrant pick" team option uses `AgentOrchestrator` in decomposition mode — the engine selects agents based on the goal. This is the one-click path for users who don't want to configure a team first.
+
+#### 4 — Workflow detail view
+
+Each workflow gets a detail page/view showing:
+- **Goal** — the original prompt
+- **Team** — agents involved, with roles
+- **Journal** — chronological list of events (agent step started, tool called, step complete, replanning triggered) — collapsible by default, expandable for debugging
+- **Artifacts** — files produced, with open/download links
+- **Output summary** — the final LLM-produced summary of what was accomplished
+- **Status timeline** — duration per step if available
+
+This replaces the current "click-through from Command Center" flow, which lands on a sparse detail page.
+
+#### 5 — Positioning callout in the UI
+
+A short inline note on the Workflows page (dismissible, not a modal) that surfaces the positioning:
+
+> **Workflows vs automation tools.** Sovrant workflows are AI-driven — you describe a goal and the AI team plans and executes the steps. For trigger-based automation, scheduled jobs, and SaaS connectors, connect n8n, Zapier, or Make from the [Integrations](link) page and use them as tools inside a workflow.
+
+This single sentence prevents the most common expectation mismatch.
+
+#### 6 — Dual-path execution: Claude Agent SDK dynamic workflows when available
+
+Unlike items 1–5, this is an engine-level addition, not a presentation change. When the workflow's active model is a qualifying Claude tier (exact gate TBD at design time — candidates are the Opus/Sonnet 5 family resolved via `ModelTierResolver`, not simply "any Anthropic key configured"), workflow execution can route through the Claude Agent SDK's dynamic subagent/workflow orchestration instead of Sovrant's own planner/executor. When no qualifying Claude model is configured — no key, or a non-qualifying provider/model — workflows fall back to Sovrant's existing provider-agnostic mission engine (`LlmMissionPlanner` / `ParallelMissionExecutor`), which remains the base version and continues to work with any OpenAI-compatible provider.
+
+Open design questions to resolve before implementation, not before this roadmap entry:
+- Exact model/tier gate — which specific Claude models qualify, and where that check lives (`ModelTierResolver` vs a new capability flag)
+- Whether the two backends emit a compatible event journal, or the Workflows UI needs to tolerate two event vocabularies under one `/v1/workflows` contract
+- Whether a settings override lets a user force one path or the other rather than always auto-selecting by provider capability
+- Whether this ships inside Phase 129 or splits into its own phase, since it changes the "no DB/engine changes" framing that otherwise applies to items 1–5
+
+### What we explicitly do not build
+
+| Not building | Why | Alternative |
+|---|---|---|
+| Visual node/flow editor | That is n8n's lane | Connect n8n via MCP Integrations |
+| Cron / scheduled triggers | That is n8n/Zapier's lane | n8n workflows can call Sovrant's API |
+| Webhook-triggered workflows | Same | n8n trigger → Sovrant REST call |
+| 500-connector library | Already covered | Composio / n8n in the Integrations Gallery |
+| Deterministic branching pipelines | LLM planner handles branching better | No alternative needed |
+
+The constraint is intentional and permanent. Sovrant's value is the AI layer. Adding a visual editor or a scheduler would compete with tools that have years of head start and would dilute what makes Sovrant different.
+
+### Relationship to other phases
+
+- **Phase 51** ✅ built the engine (`IMissionStore`, `LlmMissionPlanner`, `ParallelMissionExecutor`) — remains the base-version execution path (item 6) and is otherwise not touched by items 1–5
+- **Phase 119** (planned) adds per-mission run-modes and integration-sourced Claws — Phase 129 uses those run-modes in the new launch form; Phase 119 should ship first or in parallel
+- **Phase 94** ✅ (Orchestration Studio) remains as the team-composition surface; Phase 129 adds a goal-first surface on top
+- **Claude Agent SDK dependency (item 6, new)** — requires an Anthropic/Claude provider integration capable of driving the Agent SDK's dynamic subagent orchestration; needs its own design pass on the model/tier gate before implementation
+
+### Acceptance criteria
+
+- [ ] Every user-visible "Mission" / "Missions" label replaced with "Workflow" / "Workflows" on Web and Desktop; no DB or runtime type names changed
+- [ ] `/v1/workflows` alias proxies to `/v1/missions`; all CRUD and status operations work identically through both paths
+- [ ] Dedicated Workflows page reachable from nav; shows active + recent workflows; "New Workflow" button launches the new goal form
+- [ ] New Workflow form: goal textarea, team picker with "Let Sovrant pick" option, run-mode selector, optional name field
+- [ ] "Let Sovrant pick" path invokes `AgentOrchestrator` in decomposition mode and runs the workflow without requiring a pre-built team
+- [ ] Workflow detail view shows goal, journal (collapsible), artifacts, and output summary
+- [ ] Positioning callout visible on Workflows page; dismissible per user; links to Integrations
+- [ ] All existing mission/orchestration tests pass unchanged (no engine code modified)
+- [ ] Web + Desktop parity on all new UI surfaces
+
+---
+
+## Phase 130 — OpenRouter Account Registration & In-App Key Issuance
+
+**Status:** Planned
+
+### Why
+
+Today, adding OpenRouter as a provider means: open a browser, create or log into an OpenRouter account, navigate to Keys, generate one, copy it, switch back to Sovrant, and paste it into the provider form. That's a five-step context switch for what should be the single fastest path to a working model — OpenRouter is the default onramp for free-tier models (`SOVRANT_FREE_MODELS_ONLY`, `:free` model routing) and is already Sovrant's most-referenced provider outside the default OpenAI.
+
+OpenRouter publishes exactly the flow that removes this friction: [OAuth PKCE](https://openrouter.ai/docs/use-cases/oauth-pkce). Unlike a normal OAuth login, the token exchange returns a real, permanent OpenRouter API key — not a session token — meaning the end result is identical to what a user would have pasted in by hand, just without the hand.
+
+### What ships
+
+#### 1 — PKCE flow against OpenRouter's own auth endpoint
+
+Reuse the PKCE primitives already built for Phase 101 (MCP OAuth 2.1 + PKCE): code-verifier generation, S256 code-challenge derivation, and the loopback callback listener (`McpOAuthCallbackListener` pattern) — but point them at OpenRouter's dedicated flow rather than a generic MCP server's `/authorize` endpoint:
+
+1. Sovrant generates `code_verifier` + `code_challenge` (S256) and opens `https://openrouter.ai/auth?callback_url={redirect}&code_challenge={challenge}&code_challenge_method=S256` in the user's browser.
+2. The user registers a new OpenRouter account or logs into an existing one, then approves the connection — entirely on OpenRouter's own site, so Sovrant never sees a password.
+3. OpenRouter redirects back to Sovrant's callback with a `code`.
+4. Sovrant exchanges `code` + `code_verifier` via `POST https://openrouter.ai/api/v1/auth/keys` and receives a live OpenRouter API key.
+5. The key is written directly to the encrypted keystore (same AES-256-GCM store used for manually entered keys) and a `provider_profiles` row is created/activated for OpenRouter — indistinguishable afterward from a hand-entered key.
+
+A new `OpenRouterAuthService` in `Sovrant.Runtime` owns this exchange; it is a sibling to `McpOAuthService`, not a fork of it — the PKCE helper (verifier/challenge generation) is extracted into a shared internal utility both services call, rather than duplicated.
+
+#### 2 — Callback handling per surface
+
+- **Desktop:** ephemeral loopback HTTP listener on `127.0.0.1:{port}/openrouter-callback`, matching the pattern `McpOAuthCallbackListener` already uses for MCP server auth — no new listener architecture.
+- **Web:** ASP.NET Core route (`/auth/openrouter/callback`) using an absolute redirect URI, matching Phase 101's web OIDC-style callback handling.
+
+#### 3 — UI entry point (Web + Desktop, Providers settings)
+
+- Existing "Add Provider" flow gains a second path alongside "Enter API key manually": a **"Get an OpenRouter key"** button, shown only for the OpenRouter provider entry.
+- Clicking it opens the system browser to the OpenRouter auth page and shows a waiting state ("Waiting for OpenRouter authorization…") with a cancel option.
+- On success, the provider profile is created and activated automatically — same end state as the manual-entry path, so downstream code (model picker, `SmartRouter`, cost tracking) needs no changes.
+- On denial/timeout/error, a plain-language error is shown and the manual-entry form remains available as a fallback.
+
+#### 4 — Multi-user / workspace scoping
+
+Same scoping rules as any other provider profile (Phase 95/Phase 8): the issued key is stored per-user or per-workspace depending on where the flow was launched from (personal Settings vs. a workspace's admin Providers page), reusing the existing `provider_profiles` ownership model — no new scoping concept.
+
+### Non-goals
+
+- Managing OpenRouter account settings (billing, usage limits) from within Sovrant — out of scope; Sovrant only obtains a key.
+- Building a generic "OAuth key issuance" framework for other providers — this phase is scoped to OpenRouter's specific PKCE-for-a-key flow. If another provider ships an equivalent flow later, it gets its own phase informed by this one.
+- Revoking or rotating the key from Sovrant — the key is managed like any other stored credential (delete + re-run the flow to rotate), consistent with how manually entered keys are already handled.
+
+### Relationship to other phases
+
+- **Phase 101** ✅ (OAuth 2.1 + PKCE for MCP) supplies the PKCE primitives and loopback-listener pattern this phase reuses — Phase 130 does not reimplement PKCE from scratch.
+- **Phase 95** ✅ (Integrations Gallery) established the encrypted-keystore-backed credential pattern this phase writes into.
+- **Phase 8** ✅ (multi-tenant per-request credentials) and the workspace-scoped provider profile model (README §Multi-User & Workspaces) define where the issued key is scoped.
+
+### Acceptance criteria
+
+- [ ] "Get an OpenRouter key" button visible on the OpenRouter provider entry in Settings (Web + Desktop)
+- [ ] Full PKCE round-trip verified against OpenRouter's real `/auth` and `/api/v1/auth/keys` endpoints (registration path and existing-account login path both tested manually)
+- [ ] Issued key lands in the encrypted keystore and appears as an active provider profile with no additional user action
+- [ ] Desktop loopback listener and Web callback route both tear down cleanly on success, cancel, and timeout
+- [ ] Manual key-entry path remains fully functional and is offered as a fallback on any error
+- [ ] Web + Desktop parity
+- [ ] No changes required in `SmartRouter`, model discovery, or cost tracking — the issued key behaves identically to a manually entered one
diff --git a/docs/user-flow.md b/docs/user-flow.md
new file mode 100644
index 00000000..5566e90a
--- /dev/null
+++ b/docs/user-flow.md
@@ -0,0 +1,241 @@
+# Web App User Flow
+
+A screen-by-screen walkthrough of the Sovrant Web app (Blazor Server, `http://localhost:5100`), captured from a live run of version 1.4.0 (with the upstream `development` branch merged in, including the Phase 126 chat-UX work) in embedded mode with a fresh database. Every screenshot lives in [`docs/images/`](images/) with the `web-flow-` prefix.
+
+Each image is a side-by-side theme comparison at identical resolution: **dark mode on the left, light mode on the right**, each half captured at 1440×900 (2880×900 combined). The theme is toggled live via the same mechanism as the Settings → Appearance → Dark Mode switch.
+
+The flow follows the order a new user encounters the product: first-run setup → chat home → the rail-nav sections (Dashboard, Knowledge, Agents, Projects) → settings and provider setup → the admin surfaces.
+
+---
+
+## 1. First-run: create the administrator account
+
+**Route:** `/login`
+
+On a fresh install no accounts exist, so the login page switches to first-time setup. The first account created becomes the administrator with full control over registration, approvals, and server settings. On subsequent visits this page shows the normal sign-in form (plus self-registration, if the admin has enabled it).
+
+![Login — first-run setup](images/web-flow-01-login-first-run.png)
+
+## 2. Chat (home)
+
+**Route:** `/`
+
+After registering, the user lands on Chat — the home screen. The empty state asks "What are you working on?" and offers starter prompts (create a custom agent, build a team, set up a mission, connect an MCP server). The left sidebar holds **+ New Chat** and conversation search; the top context bar exposes the model picker ("No model" until a provider is configured), workspace selector, project selector, and integrations menu. The composer includes a per-record **Private** toggle and a **+ Remember** control.
+
+![Chat home](images/web-flow-02-chat.png)
+
+## 3. User Dashboard
+
+**Route:** `/dashboard` (rail nav: chart icon)
+
+Cross-workspace activity for the signed-in user: missions, team runs, agent runs, sessions, shared items, and Claws, with quick actions to start a chat or run an agent.
+
+![User Dashboard](images/web-flow-03-dashboard.png)
+
+## Knowledge section
+
+### 4. Memory
+
+**Route:** `/memory`
+
+Per-user memory entries the agents can recall across sessions, with privacy scoping.
+
+![Memory](images/web-flow-04-memory.png)
+
+### 5. Documents
+
+**Route:** `/documents`
+
+Document library for the current workspace — files agents can read, produce, and update.
+
+![Documents](images/web-flow-05-documents.png)
+
+### 6. Document Templates
+
+**Route:** `/documents/templates`
+
+Reusable document templates users can instantiate.
+
+![Document Templates](images/web-flow-06-document-templates.png)
+
+### 7. Artifacts
+
+**Route:** `/artifacts`
+
+Artifacts produced by agent runs (reports, files, outputs), browsable per workspace.
+
+![Artifacts](images/web-flow-07-artifacts.png)
+
+### 8. Guidelines
+
+**Route:** `/guidelines`
+
+Behavioral guidelines that steer agents (the CLAUDE.md-style instruction layer).
+
+![Guidelines](images/web-flow-08-guidelines.png)
+
+## Agents section
+
+### 9. Agents
+
+**Route:** `/agents`
+
+The 25 built-in agent templates (architect, coder, code-reviewer, data-analyst, …) in a master–detail layout showing each template's role, effort level, and tool grants, plus a **+ New** button for custom agents and a recent-runs strip.
+
+![Agents](images/web-flow-09-agents.png)
+
+### 10. Skills
+
+**Route:** `/skills`
+
+The 32 built-in skills agents can invoke, with search and detail view.
+
+![Skills](images/web-flow-10-skills.png)
+
+### 11. Tools
+
+**Route:** `/tools`
+
+The 58 tools available to agents (file I/O, shell, web search, delegation, …), including enablement and permission info.
+
+![Tools](images/web-flow-11-tools.png)
+
+### 12. Tool Templates
+
+**Route:** `/tools/templates`
+
+User-defined tool templates.
+
+![Tool Templates](images/web-flow-12-tool-templates.png)
+
+### 13. Orchestration
+
+**Route:** `/orchestration`
+
+Teams, swarms, and missions — the multi-agent orchestration surfaces with per-team run profiles.
+
+![Orchestration](images/web-flow-13-orchestration.png)
+
+## Projects section
+
+### 14. Projects
+
+**Route:** `/projects`
+
+Projects within the current workspace; conversations and runs can be filed under a project via the top context bar.
+
+![Projects](images/web-flow-14-projects.png)
+
+### 15. Workspaces
+
+**Route:** `/workspaces`
+
+The user's workspaces (a personal workspace is seeded on first login) and membership management.
+
+![Workspaces](images/web-flow-15-workspaces.png)
+
+### 16. Code
+
+**Route:** `/code`
+
+Code-focused view for repository-oriented sessions.
+
+![Code](images/web-flow-16-code.png)
+
+## Settings & provider setup
+
+### 17. Settings
+
+**Route:** `/settings`
+
+Per-user preferences: appearance, defaults, and account controls (including sign-out).
+
+![Settings](images/web-flow-17-settings.png)
+
+### 18. Provider Setup
+
+**Route:** `/setup`
+
+Connect an LLM provider (API key + model) so chats and agent runs have a model to route to. Reachable from the "Set up →" link in the model picker; models can be switched anytime from the sidebar.
+
+![Provider Setup](images/web-flow-18-provider-setup.png)
+
+## Admin section (admin role only)
+
+### 19. Command Center
+
+**Route:** `/command`
+
+The live cockpit: missions, team runs, agent runs, sessions, and Claws currently in flight, auto-refreshing while runs are active.
+
+![Command Center](images/web-flow-19-command-center.png)
+
+### 20. Admin — Users
+
+**Route:** `/admin`
+
+User management with tabs for Users, Registration (open/closed, approval required), and Password Reset. The first-run admin account appears as active with the admin role.
+
+![Admin Users](images/web-flow-20-admin.png)
+
+### 21. Admin — Providers
+
+**Route:** `/admin/providers`
+
+Server-wide LLM provider configuration.
+
+![Admin Providers](images/web-flow-21-admin-providers.png)
+
+### 22. Admin — Integrations
+
+**Route:** `/admin/integrations`
+
+Webhook/chat integrations (Slack, Teams, Discord, custom).
+
+![Admin Integrations](images/web-flow-22-admin-integrations.png)
+
+### 23. Admin — System Integrations
+
+**Route:** `/admin/system-integrations`
+
+System-level integrations such as MCP servers and Claw runtimes.
+
+![Admin System Integrations](images/web-flow-23-admin-system-integrations.png)
+
+### 24. Admin — Workspaces
+
+**Route:** `/admin/workspaces`
+
+Administration across all workspaces on the server.
+
+![Admin Workspaces](images/web-flow-24-admin-workspaces.png)
+
+### 25. Governance
+
+**Route:** `/governance`
+
+Governance controls: policies and limits that bound what agents may do.
+
+![Governance](images/web-flow-25-governance.png)
+
+### 26. Diagnostics
+
+**Route:** `/diagnostics`
+
+Runtime diagnostics: health, logs, and environment information.
+
+![Diagnostics](images/web-flow-26-diagnostics.png)
+
+### 27. Trust Boundary
+
+**Route:** `/trust-boundary`
+
+The trust-boundary view — what data and capabilities are exposed where, in line with the security architecture (see [security-architecture.md](security-architecture.md)).
+
+![Trust Boundary](images/web-flow-27-trust-boundary.png)
+
+---
+
+## How these were captured
+
+Screenshots were taken with Playwright/Chromium at 1440×900 against a debug build (`dotnet run --project src/Sovrant.Web`) with a fresh SQLite database: the script registers the first-run admin account through the real login form, then visits each route as that user. On every screen it captures dark mode, switches the theme to light (the same `data-theme` mechanism the Settings toggle uses), captures again, and composites the two frames side-by-side with ImageMagick (`convert dark.png light.png +append`). Re-running the capture on an existing database signs in instead of registering.
diff --git a/src/Sovrant.Agents/Shared/WorkspaceContext.cs b/src/Sovrant.Agents/Shared/WorkspaceContext.cs
index 8d771fa8..27bb9ad6 100644
--- a/src/Sovrant.Agents/Shared/WorkspaceContext.cs
+++ b/src/Sovrant.Agents/Shared/WorkspaceContext.cs
@@ -83,12 +83,12 @@ public async Task<string> GetOrCreateArtifactsDirectoryAsync(string prompt, Canc
             return ArtifactHandle.ResolvedRoot;
         }
 
-        // Legacy fallback — always resolve to ~/.sovrant/artifacts, never CWD-relative.
+        // Legacy fallback — always resolve to ~/.sovrant/workspaces, never CWD-relative.
         var slug = Slugify(prompt);
         var fallbackRoot = Environment.GetEnvironmentVariable("SOVRANT_ARTIFACTS_ROOT")
             ?? Path.Combine(
                 Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
-                ".sovrant", "artifacts");
+                ".sovrant", "workspaces");
         var dir = Path.Combine(fallbackRoot, slug);
         Directory.CreateDirectory(dir);
         return dir;
@@ -111,11 +111,11 @@ public async Task<string> GetArtifactsDirectoryAsync(CancellationToken ct = defa
             return ArtifactHandle.ResolvedRoot;
         }
 
-        // Legacy fallback — always resolve to ~/.sovrant/artifacts, never CWD-relative.
+        // Legacy fallback — always resolve to ~/.sovrant/workspaces, never CWD-relative.
         var dir = Environment.GetEnvironmentVariable("SOVRANT_ARTIFACTS_ROOT")
             ?? Path.Combine(
                 Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
-                ".sovrant", "artifacts");
+                ".sovrant", "workspaces");
         Directory.CreateDirectory(dir);
         return dir;
     }
diff --git a/src/Sovrant.Api.Client/RemoteArtifactStore.cs b/src/Sovrant.Api.Client/RemoteArtifactStore.cs
index e9daa01d..03e1cbba 100644
--- a/src/Sovrant.Api.Client/RemoteArtifactStore.cs
+++ b/src/Sovrant.Api.Client/RemoteArtifactStore.cs
@@ -49,20 +49,31 @@ public async IAsyncEnumerable<ArtifactEntry> ListAsync(ArtifactScope scope, [Enu
         {
             foreach (var item in arr.EnumerateArray())
             {
-                var path = item.TryGetProperty("path", out var p) ? p.GetString() ?? string.Empty : string.Empty;
-                var size = item.TryGetProperty("size", out var s) ? s.GetInt64() : 0;
+                var path = item.TryGetProperty("relative_path", out var p) ? p.GetString() ?? string.Empty : string.Empty;
+                var size = item.TryGetProperty("size_bytes", out var s) ? s.GetInt64() : 0;
                 var contentType = item.TryGetProperty("content_type", out var c) ? c.GetString() : null;
+                var runId = item.TryGetProperty("run_id", out var r) ? r.GetString() : null;
+                var lastModified = item.TryGetProperty("last_modified", out var lm) && lm.TryGetDateTimeOffset(out var dt)
+                    ? dt : DateTimeOffset.UtcNow;
 
                 yield return new ArtifactEntry
                 {
                     RelativePath = path,
                     SizeBytes = size,
                     ContentType = contentType,
+                    RunId = runId,
+                    LastModified = lastModified,
                 };
             }
         }
     }
 
+    public Task SetCodeMetadataAsync(ArtifactHandle handle, CodeManifest metadata, CancellationToken ct = default)
+    {
+        // Manifest is managed server-side during agent execution; no client update needed.
+        return Task.CompletedTask;
+    }
+
     public async Task DeleteAsync(ArtifactScope scope, CancellationToken ct = default)
     {
         if (scope.RunId is not null)
diff --git a/src/Sovrant.Cli/DocumentCommand.cs b/src/Sovrant.Cli/DocumentCommand.cs
index fb9bfc82..001269db 100644
--- a/src/Sovrant.Cli/DocumentCommand.cs
+++ b/src/Sovrant.Cli/DocumentCommand.cs
@@ -2,9 +2,11 @@
 using System.Globalization;
 using System.Text.Json;
 using Microsoft.Extensions.DependencyInjection;
+using Scriban;
 using Sovrant.Runtime.Artifacts;
 using Sovrant.Runtime.Documents;
 using Sovrant.Runtime.Documents.Templates;
+using Sovrant.Runtime.Knowledge;
 using Sovrant.Runtime.Workspaces;
 using Spectre.Console;
 using SovrantDocumentFormat = Sovrant.Runtime.Documents.DocumentFormat;
@@ -28,6 +30,7 @@ public static Command Build(Func<ParseResult, ServiceProvider> buildServices)
         root.Add(BuildFields(buildServices));
         root.Add(BuildRender(buildServices));
         root.Add(BuildSuggest(buildServices));
+        root.Add(BuildLint(buildServices));
         return root;
     }
 
@@ -406,6 +409,115 @@ private static Command BuildRender(Func<ParseResult, ServiceProvider> buildServi
         return cmd;
     }
 
+    private static Command BuildLint(Func<ParseResult, ServiceProvider> buildServices)
+    {
+        var idOpt = new Option<string?>("--id")
+        { Description = "Lint a single template by id (e.g. 'legal/nda'). Omit to lint all DB-backed templates." };
+        var jsonOpt = new Option<bool>("--json")
+        { Description = "Emit machine-readable JSON instead of a table." };
+
+        var cmd = new Command("lint", "Validate Scriban syntax and field schema for DB-backed document templates.");
+        cmd.Add(idOpt);
+        cmd.Add(jsonOpt);
+
+        cmd.SetAction(async (ParseResult pr, CancellationToken ct) =>
+        {
+            await using var sp = buildServices(pr);
+            var store = sp.GetRequiredService<IKnowledgeStore>();
+            var idFilter = pr.GetValue(idOpt);
+            var asJson = pr.GetValue(jsonOpt);
+
+            var pages = await store.GetAllEffectiveAsync("document-templates", ct: ct).ConfigureAwait(false);
+
+            if (!string.IsNullOrWhiteSpace(idFilter))
+                pages = pages.Where(p => p.Slug.Equals(idFilter, StringComparison.OrdinalIgnoreCase)).ToList();
+
+            if (pages.Count == 0)
+            {
+                if (asJson)
+                    Console.WriteLine(JsonSerializer.Serialize(new { status = "no_templates", message = "No DB-backed templates found." }, s_jsonOpts));
+                else
+                    AnsiConsole.MarkupLine("[yellow]No DB-backed templates found.[/]");
+                return;
+            }
+
+            var results = new List<LintResult>();
+            foreach (var page in pages)
+            {
+                var errors = new List<string>();
+
+                // Scriban syntax check
+                try
+                {
+                    var tpl = Template.Parse(page.Body ?? string.Empty);
+                    if (tpl.HasErrors)
+                        errors.AddRange(tpl.Messages.Select(m => $"Scriban: {m.Message}"));
+                }
+                catch (InvalidOperationException ex)
+                {
+                    errors.Add($"Scriban parse exception: {ex.Message}");
+                }
+
+                // fields_json well-formed JSON check
+                if (!string.IsNullOrWhiteSpace(page.FieldsJson))
+                {
+                    try
+                    {
+                        using var doc = JsonDocument.Parse(page.FieldsJson);
+                        if (doc.RootElement.ValueKind != JsonValueKind.Array)
+                            errors.Add("fields_json: expected a JSON array");
+                    }
+                    catch (JsonException ex)
+                    {
+                        errors.Add($"fields_json: {ex.Message}");
+                    }
+                }
+
+                results.Add(new LintResult(page.Slug, page.Name, errors));
+            }
+
+            var passCount = results.Count(r => r.Errors.Count == 0);
+            var failCount = results.Count - passCount;
+
+            if (asJson)
+            {
+                Console.WriteLine(JsonSerializer.Serialize(new
+                {
+                    total = results.Count,
+                    passed = passCount,
+                    failed = failCount,
+                    templates = results.Select(r => new
+                    {
+                        id = r.Id,
+                        name = r.Name,
+                        status = r.Errors.Count == 0 ? "pass" : "fail",
+                        errors = r.Errors,
+                    }),
+                }, s_jsonOpts));
+            }
+            else
+            {
+                var table = new Table()
+                    .Title($"[bold]Document template lint — {passCount}/{results.Count} passed[/]")
+                    .AddColumns("Id", "Name", "Status", "Errors");
+                foreach (var r in results)
+                {
+                    var status = r.Errors.Count == 0 ? "[green]pass[/]" : "[red]fail[/]";
+                    var errText = r.Errors.Count == 0 ? string.Empty : Markup.Escape(string.Join("; ", r.Errors));
+                    table.AddRow(Markup.Escape(r.Id), Markup.Escape(r.Name), status, errText);
+                }
+                AnsiConsole.Write(table);
+            }
+
+            if (failCount > 0)
+                Environment.ExitCode = 1;
+        });
+
+        return cmd;
+    }
+
+    private sealed record LintResult(string Id, string Name, List<string> Errors);
+
     private static void Fail(string message, bool asJson)
     {
         if (asJson)
diff --git a/src/Sovrant.Desktop/ViewModels/DiagnosticsViewModel.cs b/src/Sovrant.Desktop/ViewModels/DiagnosticsViewModel.cs
index a3a0ace7..97b6a490 100644
--- a/src/Sovrant.Desktop/ViewModels/DiagnosticsViewModel.cs
+++ b/src/Sovrant.Desktop/ViewModels/DiagnosticsViewModel.cs
@@ -108,7 +108,7 @@ _ when string.IsNullOrEmpty(url) => "OpenAI",
         // Paths
         var home = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
         DbPath = _bootstrap.DbPath ?? Path.Combine(home, ".sovrant", "data", "sovrant.db");
-        ArtifactsPath = Path.Combine(home, ".sovrant", "artifacts");
+        ArtifactsPath = _bootstrap.ArtifactsRoot ?? Path.Combine(home, ".sovrant", "workspaces");
     }
 
     [RelayCommand]
diff --git a/src/Sovrant.Desktop/ViewModels/MessageViewModel.cs b/src/Sovrant.Desktop/ViewModels/MessageViewModel.cs
index ece28252..0795d23e 100644
--- a/src/Sovrant.Desktop/ViewModels/MessageViewModel.cs
+++ b/src/Sovrant.Desktop/ViewModels/MessageViewModel.cs
@@ -155,6 +155,75 @@ private static string FormatModelName(string model)
 
     public ObservableCollection<ToolUseViewModel> ToolUses { get; } = [];
 
+    // ── Phase 126 — collapsed work strip ────────────────────────────────
+
+    /// <summary>Whether the work strip's tool-list level is expanded.</summary>
+    [ObservableProperty]
+    private bool _isWorkStripExpanded;
+
+    /// <summary>ToolUseId of the tool currently showing full detail (only one at a time).</summary>
+    [ObservableProperty]
+    private string? _activeDetailToolId;
+
+    public int NonPendingToolCount => ToolUses.Count(t => !t.IsPendingConfirmation);
+    public int ErrorToolCount => ToolUses.Count(t => t.IsError);
+    public bool HasWorkStripErrors => ErrorToolCount > 0;
+    public bool HasWorkStrip => NonPendingToolCount > 0;
+    public string WorkStripCaret => IsWorkStripExpanded ? "▾" : "▸";
+    public string WorkStripActionLabel => NonPendingToolCount == 1 ? "1 action" : $"{NonPendingToolCount} actions";
+    public string WorkStripErrorLabel => ErrorToolCount == 1 ? "1 error" : $"{ErrorToolCount} errors";
+
+    /// <summary>True when this turn has any tool call at all (pending or otherwise) — used to
+    /// decide whether the answer/work-strip separator (Phase 126 #4) should render.</summary>
+    public bool HasAnyToolUses => ToolUses.Count > 0;
+
+    /// <summary>Phase 126 #4 — answer-first: shows a thin divider between the completed answer
+    /// and the (now-subordinate) work strip / pending tools below it.</summary>
+    public bool ShowWorkSeparator => IsComplete && HasAnyToolUses;
+
+    public MessageViewModel()
+    {
+        ToolUses.CollectionChanged += (_, e) =>
+        {
+            if (e.NewItems is not null)
+                foreach (ToolUseViewModel t in e.NewItems)
+                    t.PropertyChanged += (_, args) =>
+                    {
+                        if (args.PropertyName is nameof(ToolUseViewModel.IsError)
+                            or nameof(ToolUseViewModel.IsPendingConfirmation)
+                            or nameof(ToolUseViewModel.Status))
+                            RaiseWorkStripChanged();
+                    };
+            RaiseWorkStripChanged();
+        };
+    }
+
+    private void RaiseWorkStripChanged()
+    {
+        OnPropertyChanged(nameof(NonPendingToolCount));
+        OnPropertyChanged(nameof(HasAnyToolUses));
+        OnPropertyChanged(nameof(ShowWorkSeparator));
+        OnPropertyChanged(nameof(ErrorToolCount));
+        OnPropertyChanged(nameof(HasWorkStripErrors));
+        OnPropertyChanged(nameof(HasWorkStrip));
+        OnPropertyChanged(nameof(WorkStripActionLabel));
+        OnPropertyChanged(nameof(WorkStripErrorLabel));
+    }
+
+    partial void OnIsWorkStripExpandedChanged(bool value) => OnPropertyChanged(nameof(WorkStripCaret));
+
+    [RelayCommand]
+    private void ToggleWorkStrip() => IsWorkStripExpanded = !IsWorkStripExpanded;
+
+    [RelayCommand]
+    private void ToggleToolDetail(ToolUseViewModel tool)
+    {
+        var activate = ActiveDetailToolId != tool.ToolUseId;
+        ActiveDetailToolId = activate ? tool.ToolUseId : null;
+        foreach (var t in ToolUses)
+            t.IsActiveDetail = activate && t.ToolUseId == tool.ToolUseId;
+    }
+
     /// <summary>Artifacts auto-saved from large text blocks (not tied to a specific tool use row).</summary>
     public ObservableCollection<DocumentArtifactViewModel> StandaloneArtifacts { get; } = [];
     public bool HasStandaloneArtifacts => StandaloneArtifacts.Count > 0;
@@ -180,6 +249,7 @@ public void AddStandaloneArtifact(DocumentArtifactViewModel vm)
     partial void OnRoleChanged(string value) => IsUser = value == "user";
     partial void OnModelNameChanged(string? value) => OnPropertyChanged(nameof(SenderLabel));
     partial void OnProviderNameChanged(string? value) => OnPropertyChanged(nameof(SenderLabel));
+    partial void OnIsCompleteChanged(bool value) => OnPropertyChanged(nameof(ShowWorkSeparator));
 
     public void StartThinking(string? prompt = null)
     {
@@ -538,29 +608,14 @@ public partial class ToolUseViewModel : ViewModelBase
     [ObservableProperty]
     private bool _isPendingConfirmation;
 
+    /// <summary>Phase 126 — true when this row's full detail is shown in the work strip (only one at a time).</summary>
     [ObservableProperty]
-    private bool _isExpanded;
+    private bool _isActiveDetail;
 
     public ConfirmationRequest? PendingRequest { get; set; }
 
     public bool HasResult => !string.IsNullOrEmpty(Result);
 
-    public bool IsResultLong
-    {
-        get
-        {
-            if (string.IsNullOrEmpty(Result)) return false;
-            if (Result.Length > 400) return true;
-            int nl = 0;
-            foreach (var ch in Result) { if (ch == '\n') { nl++; if (nl > 6) return true; } }
-            return false;
-        }
-    }
-
-    public int ResultMaxLines => IsExpanded ? 10000 : 6;
-
-    public string ExpandToggleText => IsExpanded ? "▾ Show less" : "▸ Show more";
-
     public bool IsStatusDone => !IsError && (Status == "Done" || Status == "Approved");
     public bool IsStatusError => IsError || Status == "Denied";
     public bool IsStatusRunning => !IsStatusDone && !IsStatusError;
@@ -578,7 +633,6 @@ partial void OnResultChanged(string value)
     {
         RebuildDocumentArtifacts();
         OnPropertyChanged(nameof(HasResult));
-        OnPropertyChanged(nameof(IsResultLong));
     }
 
     partial void OnToolNameChanged(string value) => RebuildDocumentArtifacts();
@@ -597,15 +651,6 @@ partial void OnIsErrorChanged(bool value)
         OnPropertyChanged(nameof(IsStatusRunning));
     }
 
-    partial void OnIsExpandedChanged(bool value)
-    {
-        OnPropertyChanged(nameof(ResultMaxLines));
-        OnPropertyChanged(nameof(ExpandToggleText));
-    }
-
-    [RelayCommand]
-    private void ToggleExpanded() => IsExpanded = !IsExpanded;
-
     private void RebuildDocumentArtifacts()
     {
         DocumentArtifacts.Clear();
diff --git a/src/Sovrant.Desktop/ViewModels/SettingsViewModel.cs b/src/Sovrant.Desktop/ViewModels/SettingsViewModel.cs
index de93ad83..8b70bec1 100644
--- a/src/Sovrant.Desktop/ViewModels/SettingsViewModel.cs
+++ b/src/Sovrant.Desktop/ViewModels/SettingsViewModel.cs
@@ -76,6 +76,8 @@ public partial class SettingsViewModel : ViewModelBase
     private bool _isDarkMode = Application.Current?.RequestedThemeVariant == ThemeVariant.Dark;
 
     [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(ApiKeyLabel))]
+    [NotifyPropertyChangedFor(nameof(ApiKeyWatermark))]
     private string _selectedProvider = "OpenAI";
 
     [ObservableProperty]
@@ -195,7 +197,11 @@ await Dispatcher.UIThread.InvokeAsync(() =>
                 {
                     WorkspaceItems.Clear();
                     foreach (var ws in workspaces)
-                        WorkspaceItems.Add(new WorkspaceSelectItem { WorkspaceId = ws.WorkspaceId, Name = ws.Name });
+                    {
+                        // Personal workspace is pre-selected; all others are opt-in.
+                        var isPersonal = ws.Type == Runtime.Workspaces.WorkspaceType.Personal;
+                        WorkspaceItems.Add(new WorkspaceSelectItem { WorkspaceId = ws.WorkspaceId, Name = ws.Name, IsSelected = isPersonal });
+                    }
                 });
             }
             catch { /* workspaces unavailable — omit the picker */ }
@@ -298,9 +304,18 @@ private async Task LoadModelsForProviderAsync(string provider)
         {
             List<string> models;
 
+            // The form ApiKey is cleared on provider switch before this fires.
+            // Fall back to the saved credential for any existing profile that
+            // matches the selected provider so the model list still loads.
+            var effectiveKey = !string.IsNullOrWhiteSpace(ApiKey)
+                ? ApiKey
+                : SavedProfiles.FirstOrDefault(p =>
+                    p.Provider.Equals(provider, StringComparison.OrdinalIgnoreCase))?.ApiKey
+                  ?? string.Empty;
+
             if (provider == "OpenRouter")
             {
-                models = await FetchAuthenticatedModelIdsAsync("https://openrouter.ai/api/v1", ApiKey);
+                models = await FetchAuthenticatedModelIdsAsync("https://openrouter.ai/api/v1", effectiveKey);
             }
             else if (provider == "Ollama")
             {
@@ -314,8 +329,8 @@ private async Task LoadModelsForProviderAsync(string provider)
             {
                 // Try fetching from the provider's /models endpoint (OpenAI, DeepSeek, Groq, etc.)
                 var baseUrl = ProviderBaseUrls.GetValueOrDefault(provider, string.Empty);
-                models = !string.IsNullOrEmpty(baseUrl) && !string.IsNullOrWhiteSpace(ApiKey)
-                    ? await FetchAuthenticatedModelIdsAsync(baseUrl, ApiKey)
+                models = !string.IsNullOrEmpty(baseUrl) && !string.IsNullOrWhiteSpace(effectiveKey)
+                    ? await FetchAuthenticatedModelIdsAsync(baseUrl, effectiveKey)
                     : [];
 
                 // Fall back to static list if API fetch returned nothing.
@@ -353,7 +368,9 @@ private async Task<List<string>> FetchAuthenticatedModelIdsAsync(string baseUrl,
 
             var modelsUrl = baseUrl.TrimEnd('/') + "/models";
             using var request = new HttpRequestMessage(HttpMethod.Get, new Uri(modelsUrl));
-            request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", new string(apiKey.Where(c => c < 128).ToArray()).Trim());
+            var safeKey = new string(apiKey.Where(c => c < 128).ToArray()).Trim();
+            if (!string.IsNullOrEmpty(safeKey))
+                request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", safeKey);
 
             var response = await http.SendAsync(request, cts.Token);
             response.EnsureSuccessStatusCode();
@@ -427,10 +444,19 @@ partial void OnPermissionModeChanged(PermissionMode value)
 
     // ─── Provider Profiles ─────────────────────────────
 
+    private static bool IsLocalProvider(string provider) =>
+        provider is "Ollama" or "LM Studio";
+
+    public string ApiKeyLabel =>
+        IsLocalProvider(SelectedProvider) ? "API Key (optional)" : "API Key";
+
+    public string ApiKeyWatermark =>
+        IsLocalProvider(SelectedProvider) ? "Not required for local providers" : "sk-...";
+
     [RelayCommand]
     private async Task AddProviderAsync()
     {
-        if (string.IsNullOrWhiteSpace(ApiKey))
+        if (string.IsNullOrWhiteSpace(ApiKey) && !IsLocalProvider(SelectedProvider))
         {
             StatusMessage = "Please enter an API key.";
             return;
diff --git a/src/Sovrant.Desktop/Views/ChatView.axaml b/src/Sovrant.Desktop/Views/ChatView.axaml
index 0db1017e..5e4bcfcf 100644
--- a/src/Sovrant.Desktop/Views/ChatView.axaml
+++ b/src/Sovrant.Desktop/Views/ChatView.axaml
@@ -386,10 +386,6 @@
                                                            Foreground="{DynamicResource TextMuted}"
                                                            VerticalAlignment="Center" Margin="8,0,0,0"
                                                            IsVisible="{Binding ElapsedText, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
-                                                <TextBlock Text="{Binding ActionSummary}" FontSize="11"
-                                                           Foreground="{DynamicResource TextMuted}"
-                                                           VerticalAlignment="Center" Margin="4,0,0,0"
-                                                           IsVisible="{Binding ActionSummary, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
                                                 <Button Content="Copy"
                                                         FontSize="10"
                                                         Padding="8,2"
@@ -444,41 +440,6 @@
                                                            VerticalAlignment="Center" />
                                             </StackPanel>
 
-                                            <!-- Execution status bar — visible during tool calls -->
-                                            <Border Margin="42,4,0,0"
-                                                    Padding="10,6"
-                                                    CornerRadius="6"
-                                                    Background="{DynamicResource ToolUseBackground}"
-                                                    BorderBrush="{DynamicResource BrandPrimary}"
-                                                    BorderThickness="1"
-                                                    IsVisible="{Binding IsExecutingTools}">
-                                                <StackPanel Orientation="Horizontal" Spacing="8">
-                                                    <Border Width="8" Height="8" CornerRadius="4"
-                                                            Background="{DynamicResource BrandPrimary}">
-                                                        <Border.Styles>
-                                                            <Style Selector="Border">
-                                                                <Style.Animations>
-                                                                    <Animation Duration="0:0:0.8" IterationCount="INFINITE">
-                                                                        <KeyFrame Cue="0%">
-                                                                            <Setter Property="Opacity" Value="1.0" />
-                                                                        </KeyFrame>
-                                                                        <KeyFrame Cue="50%">
-                                                                            <Setter Property="Opacity" Value="0.2" />
-                                                                        </KeyFrame>
-                                                                        <KeyFrame Cue="100%">
-                                                                            <Setter Property="Opacity" Value="1.0" />
-                                                                        </KeyFrame>
-                                                                    </Animation>
-                                                                </Style.Animations>
-                                                            </Style>
-                                                        </Border.Styles>
-                                                    </Border>
-                                                    <TextBlock Text="{Binding ExecutionStatusText}"
-                                                               FontSize="12" FontWeight="SemiBold"
-                                                               Foreground="{DynamicResource TextPrimary}" />
-                                                </StackPanel>
-                                            </Border>
-
                                             <!-- Step progress bar — visible during plan execution -->
                                             <Border Margin="42,4,0,0"
                                                     Padding="10,6"
@@ -505,6 +466,14 @@
                                                                         Margin="42,0,0,0"
                                                                         IsVisible="{Binding IsComplete}" />
 
+                                            <!-- Phase 126 #4 — answer-first: thin divider between the completed
+                                                 answer and the (now-subordinate) work strip / pending tools below. -->
+                                            <Border Height="1"
+                                                    Margin="42,10,0,10"
+                                                    Background="{DynamicResource SurfaceBorder}"
+                                                    Opacity="0.6"
+                                                    IsVisible="{Binding ShowWorkSeparator}" />
+
                                             <!-- Auto-saved artifacts (from large text blocks) -->
                                             <ItemsControl ItemsSource="{Binding StandaloneArtifacts}"
                                                           IsVisible="{Binding HasStandaloneArtifacts}"
@@ -646,7 +615,7 @@
                                                 </DockPanel>
                                             </Border>
 
-                                            <!-- Tool uses -->
+                                            <!-- Pending tool confirmations — always visible, never collapsed into the strip -->
                                             <ItemsControl ItemsSource="{Binding ToolUses}"
                                                           Margin="42,2,0,0"
                                                           IsVisible="{Binding ToolUses.Count}">
@@ -656,145 +625,35 @@
                                                                 Padding="10,8"
                                                                 CornerRadius="8"
                                                                 Background="{DynamicResource ToolUseBackground}"
-                                                                BorderBrush="{Binding IsError, Converter={x:Static vm:BoolToBrushConverter.ErrorOrToolBorder}}"
-                                                                BorderThickness="1">
+                                                                BorderBrush="{DynamicResource SurfaceBorder}"
+                                                                BorderThickness="1"
+                                                                IsVisible="{Binding IsPendingConfirmation}">
                                                             <StackPanel Spacing="4">
-                                                                <DockPanel LastChildFill="False">
-                                                                    <!-- Status chip docks right -->
-                                                                    <Border DockPanel.Dock="Right"
-                                                                            Padding="6,1" CornerRadius="10"
-                                                                            Background="{DynamicResource SurfaceCard}"
-                                                                            BorderThickness="0"
-                                                                            VerticalAlignment="Center"
-                                                                            IsVisible="{Binding IsStatusDone}">
-                                                                        <TextBlock Text="{Binding Status}"
-                                                                                   FontSize="10" FontWeight="SemiBold"
-                                                                                   Foreground="{DynamicResource StatusPass}" />
-                                                                    </Border>
-                                                                    <Border DockPanel.Dock="Right"
-                                                                            Padding="6,1" CornerRadius="10"
-                                                                            Background="{DynamicResource SurfaceCard}"
-                                                                            BorderThickness="0"
-                                                                            VerticalAlignment="Center"
-                                                                            IsVisible="{Binding IsStatusError}">
-                                                                        <TextBlock Text="{Binding Status}"
-                                                                                   FontSize="10" FontWeight="SemiBold"
-                                                                                   Foreground="{DynamicResource StatusFail}" />
-                                                                    </Border>
-                                                                    <Border DockPanel.Dock="Right"
-                                                                            Padding="6,1" CornerRadius="10"
+                                                                <StackPanel Orientation="Horizontal" Spacing="6">
+                                                                    <ctrl:SovrantIcon IconName="tools" Width="12" Height="12" VerticalAlignment="Center" />
+                                                                    <TextBlock Text="{Binding ToolName}"
+                                                                               FontWeight="SemiBold"
+                                                                               FontSize="12"
+                                                                               Foreground="{DynamicResource TextPrimary}" />
+                                                                    <Border Padding="6,1" CornerRadius="10"
                                                                             Background="{DynamicResource SurfaceCard}"
-                                                                            BorderThickness="0"
-                                                                            VerticalAlignment="Center"
-                                                                            IsVisible="{Binding IsStatusRunning}">
+                                                                            BorderThickness="0">
                                                                         <TextBlock Text="{Binding Status}"
                                                                                    FontSize="10" FontWeight="SemiBold"
                                                                                    Foreground="{DynamicResource StatusWarn}" />
                                                                     </Border>
-                                                                    <StackPanel Orientation="Horizontal" Spacing="6" VerticalAlignment="Center">
-                                                                        <ctrl:SovrantIcon IconName="tools" Width="12" Height="12" />
-                                                                        <TextBlock Text="{Binding ToolName}"
-                                                                                   FontWeight="SemiBold"
-                                                                                   FontSize="12"
-                                                                                   Foreground="{DynamicResource TextPrimary}" />
-                                                                    </StackPanel>
-                                                                </DockPanel>
+                                                                </StackPanel>
                                                                 <SelectableTextBlock Text="{Binding Result}"
                                                                                      TextWrapping="Wrap"
                                                                                      FontSize="11"
                                                                                      FontFamily="Consolas,Menlo,monospace"
                                                                                      Foreground="{DynamicResource TextSecondary}"
                                                                                      IsVisible="{Binding HasResult}"
-                                                                                     MaxLines="{Binding ResultMaxLines}" />
-
-                                                                <!-- Expand/collapse toggle for long results -->
-                                                                <Button Command="{Binding ToggleExpandedCommand}"
-                                                                        Content="{Binding ExpandToggleText}"
-                                                                        IsVisible="{Binding IsResultLong}"
-                                                                        HorizontalAlignment="Left"
-                                                                        Padding="0,2"
-                                                                        Background="Transparent"
-                                                                        BorderThickness="0"
-                                                                        Foreground="{DynamicResource TextSecondary}"
-                                                                        FontSize="11" />
-
-                                                                <!-- Phase 66: Document artifact cards (one per generated doc) -->
-                                                                <ItemsControl ItemsSource="{Binding DocumentArtifacts}"
-                                                                              IsVisible="{Binding HasDocumentArtifacts}"
-                                                                              Margin="0,6,0,0">
-                                                                    <ItemsControl.ItemTemplate>
-                                                                        <DataTemplate DataType="vm:DocumentArtifactViewModel">
-                                                                            <Border Margin="0,3"
-                                                                                    Padding="10,8"
-                                                                                    CornerRadius="6"
-                                                                                    Background="{DynamicResource SurfaceCard}"
-                                                                                    BorderBrush="{DynamicResource SurfaceBorder}"
-                                                                                    BorderThickness="1">
-                                                                                <DockPanel>
-                                                                                    <ctrl:SovrantIcon DockPanel.Dock="Left"
-                                                                                                      IconName="{Binding Icon}"
-                                                                                                      Width="20" Height="20"
-                                                                                                      VerticalAlignment="Center"
-                                                                                                      Margin="0,0,10,0" />
-                                                                                    <StackPanel DockPanel.Dock="Right"
-                                                                                                Orientation="Horizontal"
-                                                                                                Spacing="6"
-                                                                                                VerticalAlignment="Center">
-                                                                                        <Button Content="Open"
-                                                                                                Command="{Binding OpenCommand}"
-                                                                                                Padding="8,3"
-                                                                                                CornerRadius="4"
-                                                                                                FontSize="11"
-                                                                                                Background="{DynamicResource BrandPrimary}"
-                                                                                                Foreground="White" />
-                                                                                        <Button Content="Reveal"
-                                                                                                Command="{Binding RevealInFolderCommand}"
-                                                                                                Padding="8,3"
-                                                                                                CornerRadius="4"
-                                                                                                FontSize="11"
-                                                                                                Background="Transparent"
-                                                                                                BorderBrush="{DynamicResource SurfaceBorder}"
-                                                                                                BorderThickness="1"
-                                                                                                Foreground="{DynamicResource TextSecondary}"
-                                                                                                IsVisible="{Binding LocalPath, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
-                                                                                    </StackPanel>
-                                                                                    <StackPanel Spacing="2">
-                                                                                        <TextBlock Text="{Binding DisplayName}"
-                                                                                                   FontSize="12"
-                                                                                                   FontWeight="SemiBold"
-                                                                                                   Foreground="{DynamicResource TextPrimary}"
-                                                                                                   TextTrimming="CharacterEllipsis" />
-                                                                                        <StackPanel Orientation="Horizontal" Spacing="6">
-                                                                                            <TextBlock Text="{Binding Format}"
-                                                                                                       FontSize="10"
-                                                                                                       Foreground="{DynamicResource TextMuted}" />
-                                                                                            <TextBlock Text="·"
-                                                                                                       FontSize="10"
-                                                                                                       Foreground="{DynamicResource TextMuted}"
-                                                                                                       IsVisible="{Binding SizeText, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
-                                                                                            <TextBlock Text="{Binding SizeText}"
-                                                                                                       FontSize="10"
-                                                                                                       Foreground="{DynamicResource TextMuted}" />
-                                                                                            <TextBlock Text="·"
-                                                                                                       FontSize="10"
-                                                                                                       Foreground="{DynamicResource TextMuted}"
-                                                                                                       IsVisible="{Binding TemplateId, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
-                                                                                            <TextBlock Text="{Binding TemplateId}"
-                                                                                                       FontSize="10"
-                                                                                                       Foreground="{DynamicResource TextMuted}" />
-                                                                                        </StackPanel>
-                                                                                    </StackPanel>
-                                                                                </DockPanel>
-                                                                            </Border>
-                                                                        </DataTemplate>
-                                                                    </ItemsControl.ItemTemplate>
-                                                                </ItemsControl>
-
-                                                                <!-- Inline approve/deny buttons -->
+                                                                                     MaxLines="6" />
                                                                 <StackPanel Orientation="Horizontal" Spacing="8"
-                                                                            Margin="0,6,0,0"
-                                                                            IsVisible="{Binding IsPendingConfirmation}">
-                                                                    <Button Command="{Binding ApproveCommand}"
+                                                                            Margin="0,6,0,0">
+                                                                    <Button
+                                                                            Command="{Binding ApproveCommand}"
                                                                             Padding="10,4"
                                                                             CornerRadius="6"
                                                                             Background="{DynamicResource StatusPass}"
@@ -839,6 +698,209 @@
                                                     </DataTemplate>
                                                 </ItemsControl.ItemTemplate>
                                             </ItemsControl>
+
+                                            <!-- Work strip (Phase 126) — collapsed summary of completed/running tool calls -->
+                                            <StackPanel Margin="42,2,0,0" IsVisible="{Binding HasWorkStrip}">
+                                                <!-- Mid-turn animated indicator -->
+                                                <Border Padding="10,6"
+                                                        CornerRadius="6"
+                                                        Background="{DynamicResource ToolUseBackground}"
+                                                        BorderBrush="{DynamicResource BrandPrimary}"
+                                                        BorderThickness="1"
+                                                        IsVisible="{Binding IsExecutingTools}">
+                                                    <StackPanel Orientation="Horizontal" Spacing="8">
+                                                        <Border Width="8" Height="8" CornerRadius="4"
+                                                                Background="{DynamicResource BrandPrimary}">
+                                                            <Border.Styles>
+                                                                <Style Selector="Border">
+                                                                    <Style.Animations>
+                                                                        <Animation Duration="0:0:0.8" IterationCount="INFINITE">
+                                                                            <KeyFrame Cue="0%">
+                                                                                <Setter Property="Opacity" Value="1.0" />
+                                                                            </KeyFrame>
+                                                                            <KeyFrame Cue="50%">
+                                                                                <Setter Property="Opacity" Value="0.2" />
+                                                                            </KeyFrame>
+                                                                            <KeyFrame Cue="100%">
+                                                                                <Setter Property="Opacity" Value="1.0" />
+                                                                            </KeyFrame>
+                                                                        </Animation>
+                                                                    </Style.Animations>
+                                                                </Style>
+                                                            </Border.Styles>
+                                                        </Border>
+                                                        <TextBlock Text="{Binding ExecutionStatusText}"
+                                                                   FontSize="12" FontWeight="SemiBold"
+                                                                   Foreground="{DynamicResource TextPrimary}" />
+                                                    </StackPanel>
+                                                </Border>
+
+                                                <!-- Collapsed / collapsible header — shown once the turn's tool calls settle -->
+                                                <Button Command="{Binding ToggleWorkStripCommand}"
+                                                        Padding="10,6"
+                                                        CornerRadius="6"
+                                                        Background="{DynamicResource ToolUseBackground}"
+                                                        BorderBrush="{Binding HasWorkStripErrors, Converter={x:Static vm:BoolToBrushConverter.ErrorOrToolBorder}}"
+                                                        BorderThickness="1"
+                                                        HorizontalAlignment="Stretch"
+                                                        HorizontalContentAlignment="Left"
+                                                        IsVisible="{Binding !IsExecutingTools}">
+                                                    <StackPanel Orientation="Horizontal" Spacing="6">
+                                                        <TextBlock Text="{Binding WorkStripCaret}" FontSize="10"
+                                                                   Foreground="{DynamicResource TextMuted}" VerticalAlignment="Center" />
+                                                        <TextBlock Text="{Binding WorkStripActionLabel}" FontSize="12" FontWeight="SemiBold"
+                                                                   Foreground="{DynamicResource TextPrimary}" VerticalAlignment="Center" />
+                                                        <TextBlock Text="·" FontSize="12" Foreground="{DynamicResource TextMuted}"
+                                                                   IsVisible="{Binding ActionSummary, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
+                                                        <TextBlock Text="{Binding ActionSummary}" FontSize="12"
+                                                                   Foreground="{DynamicResource TextSecondary}" VerticalAlignment="Center"
+                                                                   IsVisible="{Binding ActionSummary, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
+                                                        <TextBlock Text="·" FontSize="12" Foreground="{DynamicResource TextMuted}"
+                                                                   IsVisible="{Binding HasWorkStripErrors}" />
+                                                        <TextBlock Text="{Binding WorkStripErrorLabel}" FontSize="12"
+                                                                   Foreground="{DynamicResource TextSecondary}" VerticalAlignment="Center"
+                                                                   IsVisible="{Binding HasWorkStripErrors}" />
+                                                        <TextBlock Text="·" FontSize="12" Foreground="{DynamicResource TextMuted}"
+                                                                   IsVisible="{Binding ElapsedText, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
+                                                        <TextBlock Text="{Binding ElapsedText}" FontSize="12"
+                                                                   Foreground="{DynamicResource TextMuted}" VerticalAlignment="Center" />
+                                                        <TextBlock Text="⚠" FontSize="12" Foreground="{DynamicResource StatusFail}"
+                                                                   VerticalAlignment="Center"
+                                                                   IsVisible="{Binding HasWorkStripErrors}" />
+                                                    </StackPanel>
+                                                </Button>
+
+                                                <!-- Tool-list level — one row per tool call -->
+                                                <ItemsControl ItemsSource="{Binding ToolUses}"
+                                                              IsVisible="{Binding IsWorkStripExpanded}"
+                                                              Margin="0,4,0,0">
+                                                    <ItemsControl.ItemTemplate>
+                                                        <DataTemplate DataType="vm:ToolUseViewModel">
+                                                            <StackPanel IsVisible="{Binding !IsPendingConfirmation}">
+                                                                <Button Command="{Binding $parent[ItemsControl].((vm:MessageViewModel)DataContext).ToggleToolDetailCommand}"
+                                                                        CommandParameter="{Binding}"
+                                                                        Padding="10,6"
+                                                                        Margin="0,1"
+                                                                        Background="{DynamicResource ToolUseBackground}"
+                                                                        BorderThickness="0"
+                                                                        HorizontalAlignment="Stretch"
+                                                                        HorizontalContentAlignment="Left">
+                                                                    <DockPanel LastChildFill="True">
+                                                                        <StackPanel DockPanel.Dock="Left" Orientation="Horizontal" Spacing="8" VerticalAlignment="Center">
+                                                                            <Border Width="7" Height="7" CornerRadius="4"
+                                                                                    Background="{DynamicResource StatusPass}"
+                                                                                    IsVisible="{Binding IsStatusDone}" />
+                                                                            <Border Width="7" Height="7" CornerRadius="4"
+                                                                                    Background="{DynamicResource StatusFail}"
+                                                                                    IsVisible="{Binding IsStatusError}" />
+                                                                            <Border Width="7" Height="7" CornerRadius="4"
+                                                                                    Background="{DynamicResource StatusWarn}"
+                                                                                    IsVisible="{Binding IsStatusRunning}" />
+                                                                            <ctrl:SovrantIcon IconName="tools" Width="11" Height="11" VerticalAlignment="Center" />
+                                                                            <TextBlock Text="{Binding ToolName}"
+                                                                                       FontWeight="SemiBold" FontSize="12"
+                                                                                       Foreground="{DynamicResource TextPrimary}" />
+                                                                        </StackPanel>
+                                                                        <TextBlock Text="{Binding Result}"
+                                                                                   FontSize="11"
+                                                                                   FontFamily="Consolas,Menlo,monospace"
+                                                                                   Foreground="{DynamicResource TextMuted}"
+                                                                                   TextTrimming="CharacterEllipsis"
+                                                                                   MaxLines="1"
+                                                                                   Margin="10,0,0,0" />
+                                                                    </DockPanel>
+                                                                </Button>
+
+                                                                <!-- Full detail — only one row expanded at a time -->
+                                                                <Border IsVisible="{Binding IsActiveDetail}"
+                                                                        Padding="10,8,10,10"
+                                                                        Background="{DynamicResource ToolUseBackground}">
+                                                                    <StackPanel Spacing="4">
+                                                                        <SelectableTextBlock Text="{Binding Result}"
+                                                                                             TextWrapping="Wrap"
+                                                                                             FontSize="11"
+                                                                                             FontFamily="Consolas,Menlo,monospace"
+                                                                                             Foreground="{DynamicResource TextSecondary}"
+                                                                                             IsVisible="{Binding HasResult}" />
+
+                                                                        <!-- Phase 66: Document artifact cards (one per generated doc) -->
+                                                                        <ItemsControl ItemsSource="{Binding DocumentArtifacts}"
+                                                                                      IsVisible="{Binding HasDocumentArtifacts}"
+                                                                                      Margin="0,6,0,0">
+                                                                            <ItemsControl.ItemTemplate>
+                                                                                <DataTemplate DataType="vm:DocumentArtifactViewModel">
+                                                                                    <Border Margin="0,3"
+                                                                                            Padding="10,8"
+                                                                                            CornerRadius="6"
+                                                                                            Background="{DynamicResource SurfaceCard}"
+                                                                                            BorderBrush="{DynamicResource SurfaceBorder}"
+                                                                                            BorderThickness="1">
+                                                                                        <DockPanel>
+                                                                                            <TextBlock DockPanel.Dock="Left"
+                                                                                                       Text="{Binding Icon}"
+                                                                                                       FontSize="20"
+                                                                                                       VerticalAlignment="Center"
+                                                                                                       Margin="0,0,10,0" />
+                                                                                            <StackPanel DockPanel.Dock="Right"
+                                                                                                        Orientation="Horizontal"
+                                                                                                        Spacing="6"
+                                                                                                        VerticalAlignment="Center">
+                                                                                                <Button Content="Open"
+                                                                                                        Command="{Binding OpenCommand}"
+                                                                                                        Padding="8,3"
+                                                                                                        CornerRadius="4"
+                                                                                                        FontSize="11"
+                                                                                                        Background="{DynamicResource BrandPrimary}"
+                                                                                                        Foreground="White" />
+                                                                                                <Button Content="Reveal"
+                                                                                                        Command="{Binding RevealInFolderCommand}"
+                                                                                                        Padding="8,3"
+                                                                                                        CornerRadius="4"
+                                                                                                        FontSize="11"
+                                                                                                        Background="Transparent"
+                                                                                                        BorderBrush="{DynamicResource SurfaceBorder}"
+                                                                                                        BorderThickness="1"
+                                                                                                        Foreground="{DynamicResource TextSecondary}"
+                                                                                                        IsVisible="{Binding LocalPath, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
+                                                                                            </StackPanel>
+                                                                                            <StackPanel Spacing="2">
+                                                                                                <TextBlock Text="{Binding DisplayName}"
+                                                                                                           FontSize="12"
+                                                                                                           FontWeight="SemiBold"
+                                                                                                           Foreground="{DynamicResource TextPrimary}"
+                                                                                                           TextTrimming="CharacterEllipsis" />
+                                                                                                <StackPanel Orientation="Horizontal" Spacing="6">
+                                                                                                    <TextBlock Text="{Binding Format}"
+                                                                                                               FontSize="10"
+                                                                                                               Foreground="{DynamicResource TextMuted}" />
+                                                                                                    <TextBlock Text="·"
+                                                                                                               FontSize="10"
+                                                                                                               Foreground="{DynamicResource TextMuted}"
+                                                                                                               IsVisible="{Binding SizeText, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
+                                                                                                    <TextBlock Text="{Binding SizeText}"
+                                                                                                               FontSize="10"
+                                                                                                               Foreground="{DynamicResource TextMuted}" />
+                                                                                                    <TextBlock Text="·"
+                                                                                                               FontSize="10"
+                                                                                                               Foreground="{DynamicResource TextMuted}"
+                                                                                                               IsVisible="{Binding TemplateId, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
+                                                                                                    <TextBlock Text="{Binding TemplateId}"
+                                                                                                               FontSize="10"
+                                                                                                               Foreground="{DynamicResource TextMuted}" />
+                                                                                                </StackPanel>
+                                                                                            </StackPanel>
+                                                                                        </DockPanel>
+                                                                                    </Border>
+                                                                                </DataTemplate>
+                                                                            </ItemsControl.ItemTemplate>
+                                                                        </ItemsControl>
+                                                                    </StackPanel>
+                                                                </Border>
+                                                            </StackPanel>
+                                                        </DataTemplate>
+                                                    </ItemsControl.ItemTemplate>
+                                                </ItemsControl>
+                                            </StackPanel>
                                         </StackPanel>
                                     </Border>
                                 </StackPanel>
diff --git a/src/Sovrant.Desktop/Views/SettingsView.axaml b/src/Sovrant.Desktop/Views/SettingsView.axaml
index 10a51427..100a8d68 100644
--- a/src/Sovrant.Desktop/Views/SettingsView.axaml
+++ b/src/Sovrant.Desktop/Views/SettingsView.axaml
@@ -107,11 +107,11 @@
 
                 <!-- API Key -->
                 <StackPanel Spacing="6">
-                    <TextBlock Text="API Key" FontSize="13" FontWeight="SemiBold"
+                    <TextBlock Text="{Binding ApiKeyLabel}" FontSize="13" FontWeight="SemiBold"
                                Foreground="{DynamicResource TextSecondary}" />
                     <TextBox Text="{Binding ApiKey}"
                              PasswordChar="*"
-                             Watermark="sk-..."
+                             Watermark="{Binding ApiKeyWatermark}"
                              CornerRadius="8"
                              Padding="12,8" />
                 </StackPanel>
diff --git a/src/Sovrant.Runtime/Artifacts/ArtifactLayoutMigrator.cs b/src/Sovrant.Runtime/Artifacts/ArtifactLayoutMigrator.cs
index ba14037b..14ab2141 100644
--- a/src/Sovrant.Runtime/Artifacts/ArtifactLayoutMigrator.cs
+++ b/src/Sovrant.Runtime/Artifacts/ArtifactLayoutMigrator.cs
@@ -7,9 +7,9 @@ namespace Sovrant.Runtime.Artifacts;
 /// (<c>~/.sovrant/artifacts/{ws}/{proj}/{run}/</c>) into the new
 /// workspace-first layout (<c>~/.sovrant/workspaces/{ws}/...</c>).
 ///
-/// Routing rule applied during migration:
-/// - <c>default-project</c>  → <c>{ws}/artifacts/{run}/</c>    (workspace-level)
-/// - any other project       → <c>{ws}/projects/{proj}/artifacts/{run}/</c>
+/// Projects-only routing: every project segment — including the old
+/// <c>default-project</c> sentinel — lands under <c>{ws}/projects/{proj}/artifacts/{run}/</c>.
+/// There is no workspace-level (project-less) destination.
 ///
 /// Idempotent — if the old root does not exist or has already been migrated,
 /// returns 0 immediately. Leaves a <c>README.migrated</c> breadcrumb in the
@@ -79,28 +79,14 @@ public int MigrateIfNeeded()
 
     private string BuildNewPath(string wsSegment, string projSegment, string runSegment)
     {
+        // Projects-only: every project segment, including the legacy "default-project"
+        // sentinel, nests under projects/{proj}/artifacts — no workspace-level bypass.
         var wsDir = Path.Combine(_newRoot, wsSegment);
-        string artifactsDir;
-
-        // Workspace-level: old default-project (exact segment match or prefix match)
-        if (IsDefaultProjectSegment(projSegment))
-        {
-            artifactsDir = Path.Combine(wsDir, "artifacts");
-        }
-        else
-        {
-            artifactsDir = Path.Combine(wsDir, "projects", projSegment, "artifacts");
-        }
+        var artifactsDir = Path.Combine(wsDir, "projects", projSegment, "artifacts");
 
         return Path.Combine(artifactsDir, runSegment);
     }
 
-    // The old segment was either the bare sentinel "default-project" or
-    // "default-project__{safe-name}" (the {id}__{name} format). Match both.
-    private static bool IsDefaultProjectSegment(string segment) =>
-        string.Equals(segment, ArtifactScope.DefaultProjectId, StringComparison.OrdinalIgnoreCase) ||
-        segment.StartsWith(ArtifactScope.DefaultProjectId + "__", StringComparison.OrdinalIgnoreCase);
-
     private void MoveRunDirectory(string source, string target)
     {
         try
@@ -141,9 +127,7 @@ private void TryMoveLooseFile(string file, string wsSegment, string projSegment)
         try
         {
             var fileName = Path.GetFileName(file);
-            var targetDir = IsDefaultProjectSegment(projSegment)
-                ? Path.Combine(_newRoot, wsSegment, "artifacts")
-                : Path.Combine(_newRoot, wsSegment, "projects", projSegment, "artifacts");
+            var targetDir = Path.Combine(_newRoot, wsSegment, "projects", projSegment, "artifacts");
             Directory.CreateDirectory(targetDir);
             var dest = Path.Combine(targetDir, fileName);
             if (!File.Exists(dest)) File.Move(file, dest);
diff --git a/src/Sovrant.Runtime/Artifacts/ArtifactManifest.cs b/src/Sovrant.Runtime/Artifacts/ArtifactManifest.cs
index 7313327a..fd02479c 100644
--- a/src/Sovrant.Runtime/Artifacts/ArtifactManifest.cs
+++ b/src/Sovrant.Runtime/Artifacts/ArtifactManifest.cs
@@ -28,9 +28,56 @@ public sealed class ArtifactManifest
     [JsonPropertyName("files")]
     public Collection<string> Files { get; } = [];
 
+    /// <summary>
+    /// Present when the run was produced by a code scaffold tool (CodeCreate /
+    /// CodeCreateMulti). Null for all other artifact types.
+    /// </summary>
+    [JsonPropertyName("code")]
+    public CodeManifest? Code { get; set; }
+
     [JsonPropertyName("migrated_from")]
     public string? MigratedFrom { get; set; }
 
     [JsonPropertyName("original_slug")]
     public string? OriginalSlug { get; set; }
 }
+
+/// <summary>
+/// Code-specific metadata written into <see cref="ArtifactManifest.Code"/> by
+/// <c>CodeCreateTool</c> and <c>CodeCreateMultiTool</c> after scaffolding.
+/// Provides the minimal information needed to build, run, and test the project
+/// without reading individual files.
+/// </summary>
+public sealed class CodeManifest
+{
+    /// <summary>Template identifier used to scaffold, e.g. <c>dotnet/webapi</c>.</summary>
+    [JsonPropertyName("template_id")]
+    public string? TemplateId { get; set; }
+
+    /// <summary>Primary language, e.g. <c>dotnet</c>, <c>node</c>, <c>python</c>.</summary>
+    [JsonPropertyName("language")]
+    public string? Language { get; set; }
+
+    /// <summary>Project kind within the language, e.g. <c>webapi</c>, <c>cli</c>, <c>library</c>.</summary>
+    [JsonPropertyName("kind")]
+    public string? Kind { get; set; }
+
+    /// <summary>Shell command to build the project from its root directory.</summary>
+    [JsonPropertyName("build_command")]
+    public string? BuildCommand { get; set; }
+
+    /// <summary>Shell command to run the project after building.</summary>
+    [JsonPropertyName("run_command")]
+    public string? RunCommand { get; set; }
+
+    /// <summary>Shell command to run the project's test suite.</summary>
+    [JsonPropertyName("test_command")]
+    public string? TestCommand { get; set; }
+
+    /// <summary>
+    /// Relative path to the primary entry point file or project descriptor,
+    /// e.g. <c>MyApp/MyApp.csproj</c> or <c>package.json</c>.
+    /// </summary>
+    [JsonPropertyName("entry_point")]
+    public string? EntryPoint { get; set; }
+}
diff --git a/src/Sovrant.Runtime/Artifacts/ArtifactScope.cs b/src/Sovrant.Runtime/Artifacts/ArtifactScope.cs
index 86a125d7..0ec32334 100644
--- a/src/Sovrant.Runtime/Artifacts/ArtifactScope.cs
+++ b/src/Sovrant.Runtime/Artifacts/ArtifactScope.cs
@@ -3,28 +3,26 @@
 namespace Sovrant.Runtime.Artifacts;
 
 /// <summary>
-/// Identifies the workspace-scoped location where artifacts for a given run
-/// are stored. The workspace is the top-level tenant object — all users in
-/// the same workspace share the same artifact tree. The initiating user is
-/// tracked in the <see cref="ArtifactManifest"/> metadata, not in the path.
+/// Identifies the workspace- and project-scoped location where artifacts for a given
+/// run are stored. The workspace is the top-level tenant object — all users in the
+/// same workspace share the same artifact tree. The initiating user is tracked in the
+/// <see cref="ArtifactManifest"/> metadata, not in the path.
 /// </summary>
 /// <remarks>
-/// Layout (workspace-level):  <c>{root}/{workspace}/artifacts/{run}/</c>
-/// Layout (project-level):    <c>{root}/{workspace}/projects/{project}/artifacts/{run}/</c>
-/// The routing rule: if <see cref="ProjectId"/> equals <see cref="DefaultProjectId"/>
-/// the artifact is stored at workspace level; any real project routes under projects/.
+/// Projects-only layout: <c>{root}/{workspace}/projects/{project}/artifacts/{run}/</c>.
+/// Every artifact belongs to a workspace AND a project — there is no workspace-level
+/// (project-less) storage mode. A session with no explicit project uses
+/// <see cref="DefaultProjectId"/>, which is a real project folder like any other.
 /// </remarks>
 public sealed record ArtifactScope
 {
     /// <summary>
-    /// Sentinel used when no project is explicitly selected (startup, workspace-only context).
-    /// Artifacts with this project ID are stored at workspace level, not under a project folder.
+    /// Project ID used when the caller has no explicit project selected. This is a
+    /// real project folder in the artifact tree, not a workspace-level bypass —
+    /// artifacts always nest under <c>projects/{ProjectId}/artifacts/</c>.
     /// </summary>
     public const string DefaultProjectId = "default-project";
 
-    /// <summary>Returns true when this scope targets workspace-level storage (no real project selected).</summary>
-    public bool IsWorkspaceLevel => string.IsNullOrEmpty(ProjectId) || ProjectId == DefaultProjectId;
-
     /// <summary>
     /// The workspace. Defaults to the active user's personal workspace
     /// (<c>ws-personal-{userId}</c>) — never the bare <c>"personal"</c>
diff --git a/src/Sovrant.Runtime/Artifacts/IArtifactStore.cs b/src/Sovrant.Runtime/Artifacts/IArtifactStore.cs
index 2907be4a..052aaeeb 100644
--- a/src/Sovrant.Runtime/Artifacts/IArtifactStore.cs
+++ b/src/Sovrant.Runtime/Artifacts/IArtifactStore.cs
@@ -41,4 +41,11 @@ public interface IArtifactStore
     /// Returns <see langword="null"/> if the artifact does not exist.
     /// </summary>
     Task<Uri?> GetAccessUrlAsync(ArtifactHandle handle, string relativePath, TimeSpan ttl, CancellationToken ct = default);
+
+    /// <summary>
+    /// Merges code-specific metadata into the run's <c>_manifest.json</c>.
+    /// Called by scaffold tools after all files have been written.
+    /// No-op in remote mode (the server writes the manifest during execution).
+    /// </summary>
+    Task SetCodeMetadataAsync(ArtifactHandle handle, CodeManifest metadata, CancellationToken ct = default);
 }
diff --git a/src/Sovrant.Runtime/Artifacts/LocalArtifactStore.cs b/src/Sovrant.Runtime/Artifacts/LocalArtifactStore.cs
index 97aff438..ef5a4894 100644
--- a/src/Sovrant.Runtime/Artifacts/LocalArtifactStore.cs
+++ b/src/Sovrant.Runtime/Artifacts/LocalArtifactStore.cs
@@ -11,12 +11,12 @@ namespace Sovrant.Runtime.Artifacts;
 /// (default <c>~/.sovrant/workspaces</c>).
 /// </summary>
 /// <remarks>
-/// Workspace-level layout: <c>{root}/{workspace}/artifacts/{run}/</c>
-/// Project-level layout:   <c>{root}/{workspace}/projects/{project}/artifacts/{run}/</c>
-/// The routing is determined by <see cref="ArtifactScope.IsWorkspaceLevel"/>:
-/// when no real project is selected the artifact lands at workspace level;
-/// an explicit project routes it under the project's artifacts folder.
-/// Each run directory contains a <c>_manifest.json</c> with metadata.
+/// Projects-only layout: <c>{root}/{workspace}/projects/{project}/artifacts/{run}/</c>.
+/// Every artifact belongs to a workspace AND a project — there is no workspace-level
+/// (project-less) storage. Sessions with no explicit project fall back to
+/// <see cref="ArtifactScope.DefaultProjectId"/>, which is a real project folder like
+/// any other, not a routing bypass. Each run directory contains a <c>_manifest.json</c>
+/// with metadata.
 /// </remarks>
 public sealed partial class LocalArtifactStore : IArtifactStore
 {
@@ -63,16 +63,21 @@ public Task<ArtifactHandle> CreateRunScopeAsync(ArtifactScope scope, Cancellatio
         var runDir = BuildScopePath(scope);
         Directory.CreateDirectory(runDir);
 
-        // Write initial manifest
-        var manifest = new ArtifactManifest
+        // Write manifest only on first creation — subsequent calls (e.g. from download/zip
+        // endpoints that need a handle) must not overwrite an existing manifest.
+        var manifestPath = Path.Combine(runDir, "_manifest.json");
+        if (!File.Exists(manifestPath))
         {
-            RunId = scope.RunId,
-            UserId = scope.UserId,
-            WorkspaceId = scope.WorkspaceId,
-            ProjectId = scope.ProjectId,
-            CreatedAt = DateTimeOffset.UtcNow,
-        };
-        WriteManifest(runDir, manifest);
+            var manifest = new ArtifactManifest
+            {
+                RunId = scope.RunId,
+                UserId = scope.UserId,
+                WorkspaceId = scope.WorkspaceId,
+                ProjectId = scope.ProjectId,
+                CreatedAt = DateTimeOffset.UtcNow,
+            };
+            WriteManifest(runDir, manifest);
+        }
 
         LogScopeCreated(scope.WorkspaceId, scope.ProjectId, scope.RunId);
 
@@ -182,6 +187,39 @@ public Task DeleteAsync(ArtifactScope scope, CancellationToken ct = default)
         return Task.CompletedTask;
     }
 
+    /// <inheritdoc/>
+    public async Task SetCodeMetadataAsync(ArtifactHandle handle, CodeManifest metadata, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(handle);
+        ArgumentNullException.ThrowIfNull(metadata);
+
+        var manifestPath = Path.Combine(handle.ResolvedRoot, "_manifest.json");
+        try
+        {
+            ArtifactManifest manifest;
+            if (File.Exists(manifestPath))
+            {
+                var json = await File.ReadAllTextAsync(manifestPath, ct).ConfigureAwait(false);
+                manifest = JsonSerializer.Deserialize<ArtifactManifest>(json) ?? new ArtifactManifest();
+            }
+            else
+            {
+                manifest = new ArtifactManifest { RunId = handle.Scope.RunId };
+            }
+
+            manifest.Code = metadata;
+            WriteManifest(handle.ResolvedRoot, manifest);
+        }
+        catch (IOException ex)
+        {
+            LogManifestUpdateFailed(manifestPath, ex);
+        }
+        catch (JsonException ex)
+        {
+            LogManifestUpdateFailed(manifestPath, ex);
+        }
+    }
+
     /// <inheritdoc/>
     public Task<Uri?> GetAccessUrlAsync(
         ArtifactHandle handle,
@@ -202,16 +240,9 @@ public Task DeleteAsync(ArtifactScope scope, CancellationToken ct = default)
             var prefix = _accessPathPrefix.TrimEnd('/');
             var segs = new List<string> { prefix, Uri.EscapeDataString(scope.WorkspaceId) };
 
-            if (scope.IsWorkspaceLevel)
-            {
-                segs.Add("artifacts");
-            }
-            else
-            {
-                segs.Add("projects");
-                segs.Add(Uri.EscapeDataString(scope.ProjectId));
-                segs.Add("artifacts");
-            }
+            segs.Add("projects");
+            segs.Add(Uri.EscapeDataString(scope.ProjectId));
+            segs.Add("artifacts");
 
             if (!string.IsNullOrEmpty(scope.RunId))
                 segs.Add(Uri.EscapeDataString(scope.RunId));
@@ -230,26 +261,17 @@ public Task DeleteAsync(ArtifactScope scope, CancellationToken ct = default)
     // ── Path helpers ────────────────────────────────────────────────────
 
     /// <summary>
-    /// Builds the filesystem path for a scope.
-    /// Workspace-level (no real project): <c>{root}/{ws}/artifacts/{run}</c>
-    /// Project-level (explicit project):  <c>{root}/{ws}/projects/{proj}/artifacts/{run}</c>
+    /// Builds the filesystem path for a scope. Projects-only layout:
+    /// <c>{root}/{ws}/projects/{proj}/artifacts/{run}</c>. Every artifact belongs to a
+    /// workspace AND a project — there is no workspace-level (project-less) storage.
+    /// Sessions with no explicit project use <see cref="ArtifactScope.DefaultProjectId"/>,
+    /// which is just a real project folder like any other, not a special bypass.
     /// </summary>
     private string BuildScopePath(ArtifactScope scope)
     {
         var wsDir = Path.Combine(_root, MakeDirSegment(scope.WorkspaceId, scope.WorkspaceName));
-
-        string artifactsDir;
-        if (scope.IsWorkspaceLevel)
-        {
-            // No real project selected — store at workspace level.
-            artifactsDir = Path.Combine(wsDir, "artifacts");
-        }
-        else
-        {
-            // Explicit project — nest under projects/{proj}/artifacts.
-            var projDir = Path.Combine(wsDir, "projects", MakeDirSegment(scope.ProjectId, scope.ProjectName));
-            artifactsDir = Path.Combine(projDir, "artifacts");
-        }
+        var projDir = Path.Combine(wsDir, "projects", MakeDirSegment(scope.ProjectId, scope.ProjectName));
+        var artifactsDir = Path.Combine(projDir, "artifacts");
 
         return scope.RunId is not null ? Path.Combine(artifactsDir, scope.RunId) : artifactsDir;
     }
diff --git a/src/Sovrant.Runtime/Config/BootstrapConfig.cs b/src/Sovrant.Runtime/Config/BootstrapConfig.cs
index 395a626e..d7f930ac 100644
--- a/src/Sovrant.Runtime/Config/BootstrapConfig.cs
+++ b/src/Sovrant.Runtime/Config/BootstrapConfig.cs
@@ -23,7 +23,7 @@ public sealed record BootstrapConfig
     /// </summary>
     public string? LogFile { get; init; }
 
-    /// <summary>Root directory for artifact storage. Default: <c>~/.sovrant/artifacts</c>.</summary>
+    /// <summary>Root directory for artifact storage. Default: <c>~/.sovrant/workspaces</c>.</summary>
     public string? ArtifactsRoot { get; init; }
 
     /// <summary>
diff --git a/src/Sovrant.Runtime/Projects/Templates/IProjectTemplate.cs b/src/Sovrant.Runtime/Projects/Templates/IProjectTemplate.cs
index 29f0e134..70e3a7f1 100644
--- a/src/Sovrant.Runtime/Projects/Templates/IProjectTemplate.cs
+++ b/src/Sovrant.Runtime/Projects/Templates/IProjectTemplate.cs
@@ -39,6 +39,30 @@ public interface IProjectTemplate
     /// </summary>
     IReadOnlyList<ScaffoldParameter> Parameters { get; }
 
+    /// <summary>
+    /// Optional override for the shell command that builds the project.
+    /// When null, <c>ScaffoldCommands.For()</c> provides the language default.
+    /// </summary>
+    string? BuildCommand => null;
+
+    /// <summary>
+    /// Optional override for the shell command that runs the project.
+    /// When null, <c>ScaffoldCommands.For()</c> provides the language default.
+    /// </summary>
+    string? RunCommand => null;
+
+    /// <summary>
+    /// Optional override for the shell command that runs tests.
+    /// When null, <c>ScaffoldCommands.For()</c> provides the language default.
+    /// </summary>
+    string? TestCommand => null;
+
+    /// <summary>
+    /// Optional override for the primary entry-point path relative to the project root.
+    /// When null, <c>ScaffoldCommands.EntryPoint()</c> provides the language default.
+    /// </summary>
+    string? EntryPoint => null;
+
     /// <summary>
     /// Produces the complete file tree for the project.
     /// All paths in the returned <see cref="ProjectFile"/> list are relative
diff --git a/src/Sovrant.Runtime/Sovrant.Runtime.csproj b/src/Sovrant.Runtime/Sovrant.Runtime.csproj
index b56fa2e8..c40b83bd 100644
--- a/src/Sovrant.Runtime/Sovrant.Runtime.csproj
+++ b/src/Sovrant.Runtime/Sovrant.Runtime.csproj
@@ -26,7 +26,7 @@
 
   <ItemGroup>
     <EmbeddedResource Include="Storage\Migrations\*.sql" />
-    <EmbeddedResource Include="Storage\PostgresSchema.sql" />
+    <EmbeddedResource Include="..\..\db\postgres\PostgresSchema.sql" LogicalName="PostgresSchema.sql" />
     <EmbeddedResource Include="Metrics\OpenRouterModelAliases.json" />
   </ItemGroup>
 
diff --git a/src/Sovrant.Runtime/Storage/Migrations/V044__enrich_builtin_skills.sql b/src/Sovrant.Runtime/Storage/Migrations/V044__enrich_builtin_skills.sql
new file mode 100644
index 00000000..d21daa20
--- /dev/null
+++ b/src/Sovrant.Runtime/Storage/Migrations/V044__enrich_builtin_skills.sql
@@ -0,0 +1,145 @@
+-- V044: Enrich built-in skill descriptions and agent/tool lists (Phase 114).
+-- Updates `description` to 2-3 sentence form (what, when, output) for all 32 BuiltIn skills.
+-- Wires `agents` lists where natural delegations exist and fixes incorrect tool references.
+-- Only touches BuiltIn base rows (workspace_id=''); user overlay rows are never clobbered.
+
+-- ─── SKILLS ────────────────────────────────────────────────────────────────
+
+UPDATE knowledge_pages
+SET description = 'Creates a structured Architecture Decision Record (ADR) to document an architectural choice, its context, and trade-offs. Use when your team needs a permanent record of a major design decision — framework selection, data model, API boundary. Produces a markdown ADR with options considered, decision rationale, and consequences.'
+WHERE slug = 'architecture-decision' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Writes high-quality long-form content — blog posts, essays, newsletters — with voice matching and anti-slop discipline. Use when you need polished published content, not a quick draft. Produces a title, subtitle, structured body with headers, and an optional call to action.'
+WHERE slug = 'article-writing' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Designs and executes configurable autonomous loops across six patterns: simple poll, pipeline, watch-and-react, retry-with-backoff, fan-out/fan-in, and DAG. Use when a task needs to repeat, monitor a condition, or process a queue of items with dependency ordering. Always produces a loop with a defined termination condition, per-iteration logging, and rate-limit awareness.'
+WHERE slug = 'autonomous-loop' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET    description = 'Triages refund requests, analyses subscription churn patterns, and produces prioritised retention recommendations from billing data. Use when investigating cancellation spikes, processing a batch of refund tickets, or preparing a quarterly retention report. Produces a triage summary (auto-approve / review / escalate counts), a churn dashboard, and a ranked action-item list.',
+       agents      = '["data-analyst"]'
+WHERE slug = 'billing-ops' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Analyses 5–20 writing samples to extract a reusable brand voice profile covering tone, sentence structure, vocabulary, and signature rhetorical patterns. Use before generating any content that must match an established person or company voice. Produces a structured voice profile and a sample paragraph demonstrating the extracted style.'
+WHERE slug = 'brand-voice' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Generates a comprehensive onboarding guide for a new contributor: architecture overview, tech stack, setup instructions, key patterns, and common gotchas. Use at the start of a new project or when onboarding someone who needs to get productive quickly. Produces a structured markdown guide with a Quick Start section, architecture map, and recommended reading order.'
+WHERE slug = 'codebase-onboard' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Performs a systematic code review with findings ranked by severity (CRITICAL / HIGH / MEDIUM / LOW) covering logic errors, security vulnerabilities, performance issues, and style violations. Use on any diff or pull request before merge, or when auditing an unfamiliar codebase. Produces a structured findings list with file:line references, explanations, and suggested fixes.'
+WHERE slug = 'code-review' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Audits a professional network, scores contacts by strategic value and relationship strength, identifies gaps, and drafts warm re-engagement messages for dormant high-value contacts. Use when preparing for a fundraise, hiring push, or strategic partnership campaign. Produces a network health report, ranked contact list, recommended additions, and personalised outreach drafts.'
+WHERE slug = 'connections-optimizer' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET    description = 'Repurposes a single piece of anchor content (article, talk, or thread) into platform-optimised versions for X/Twitter, LinkedIn, newsletter, and blog. Use after publishing long-form content to maximise reach without duplicating the same text across channels. Produces a self-contained adapted version for each target channel with platform-native formatting and a varied hook.',
+       agents      = '["content-writer"]'
+WHERE slug = 'content-engine' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET    description = 'Adapts a single piece of content for multiple platforms by applying platform-specific constraints: character limits, formatting conventions, hashtag norms, and tone. Use when you have a finished piece and need ready-to-post versions for X, LinkedIn, Threads, Mastodon, or a blog. Produces a self-contained adapted version for each requested platform.',
+       agents      = '["content-writer"]'
+WHERE slug = 'crosspost' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Builds and executes a structured data collection pipeline: discover sources, fetch pages via WebFetch, clean and normalise, enrich with cross-references, and store as structured output. Use when you need to extract and consolidate data from websites, documents, or APIs into a queryable format. Produces a data summary with record counts, completeness metrics, sample records, and an output file.'
+WHERE slug = 'data-scraper' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Conducts thorough multi-source research (15–30 sources), cross-references claims, scores confidence per finding, and produces a structured report with inline citations. Use for strategic decisions, due diligence, or technical investigations where a single source is insufficient. Produces an executive summary, detailed findings with citations, per-finding confidence levels, and identified gaps.'
+WHERE slug = 'deep-research' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Locates and extracts specific API, library, or framework documentation — parameters, return types, examples, and version-specific gotchas — from official sources. Use when you need a precise, directly actionable reference without manually reading through an entire doc site. Produces a source URL, API signature, parameter table, usage example, and any known gotchas.'
+WHERE slug = 'doc-lookup' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET    description = 'Keeps documentation in sync with recent code changes: locates affected docs, audits accuracy, rewrites outdated sections, verifies links, and adds missing coverage for new APIs. Use after any non-trivial code change or before a release to prevent documentation drift. Produces updated documentation files and a summary of what changed and what was added.',
+       agents      = '["doc-updater"]'
+WHERE slug = 'doc-update' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Creates investor-ready materials: a 12-slide pitch deck following the Problem→Solution→Market→Traction→Team→Ask structure, a one-page executive summary, and optionally basic financial projections. Use when preparing for a fundraise, demo day, or investor introduction. Produces markdown-formatted deck slides with speaker notes, a one-pager, and a financially consistent model if requested.'
+WHERE slug = 'investor-materials' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET    description = 'Researches and qualifies potential leads with a three-axis score (ICP fit, timing signals, warm-path access), ranks the top prospects, surfaces mutual connections, and drafts personalised first-touch messages. Use when building a targeted outreach list or preparing for a sales push into a new segment. Produces a scored lead table and personalised outreach drafts for the top five.',
+       agents      = '["sales-intelligence","researcher"]'
+WHERE slug = 'lead-intelligence' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Produces structured competitive and market analysis: competitor mapping, feature/price matrix, SWOT summaries, TAM/SAM/SOM estimates with methodology, and trend analysis with source attribution. Use when evaluating a market entry, positioning a product, or preparing for a strategic planning session. Produces a sourced report with a competitor matrix, market-size estimates, and strategic recommendations.'
+WHERE slug = 'market-research' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Crafts and executes optimised generation prompts for image, video, or audio AI services, iterates on outputs against the brief, and delivers the final file with reproducible prompt metadata. Use when you need AI-generated visuals or audio as part of a project or campaign. Produces a final media file and the generation prompt saved alongside it for reproducibility.'
+WHERE slug = 'media-gen' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Decomposes a complex goal into a phased implementation plan with components, dependencies, risk assessment, and acceptance criteria per phase — before writing any code. Use before starting any non-trivial implementation to reach alignment and surface unknowns early. Produces a phased plan document presented for user review and approval before execution begins.'
+WHERE slug = 'plan' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Performs structured product analysis: feature audit, user need mapping, competitive comparison, gap analysis, and prioritisation using an impact/effort matrix. Use when evaluating a roadmap, planning a feature investment, or preparing a competitive positioning brief. Produces a feature matrix, user-need map, ranked gap list, and build/buy/partner recommendations.'
+WHERE slug = 'product-lens' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET    description = 'Coordinates project work by triaging open issues, verifying consistency with current code state, updating priorities, and producing a clear status report. Use at the start of a sprint, during triage, or when a project feels out of sync with its issue tracker. Produces an active-work summary, triage results, stale-item list, and blocker callouts.',
+       agents      = '["project-manager"]'
+WHERE slug = 'project-flow' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET    description = 'Analyses a prompt through a 6-phase evaluation (intent, gaps, structure, constraints, rewrite, comparison) and produces an improved version with a bullet-by-bullet changelog. Use whenever a prompt is producing inconsistent, off-target, or verbose model outputs. Produces the original prompt with annotated issues, an optimised rewrite, and an explanation of every change made.',
+       agents      = '["prompt-optimizer"]'
+WHERE slug = 'prompt-optimize' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET    description = 'Identifies and safely removes dead code, consolidates duplicates, simplifies complex conditionals, and improves naming — without changing any observable behaviour. Use when a codebase has grown messy or before adding a new feature to a tangled area. Produces incremental edits with a full test run after each change and a summary checklist of what was cleaned.',
+       agents      = '["refactor-cleaner"]'
+WHERE slug = 'refactor' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET    description = 'Forces thorough research before any implementation: locates existing solutions, compares 2–3 approaches with trade-offs, checks for known bugs and deprecations, and presents a ranked recommendation for user approval. Use at the start of any non-trivial task to avoid reinventing the wheel or repeating known mistakes. Produces a research summary with a recommended approach — no code until the user confirms.',
+       agents      = '["researcher"]'
+WHERE slug = 'search-first' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Performs a systematic OWASP Top 10 security audit covering injection, auth failures, sensitive data exposure, access control, and vulnerable dependencies, plus a secret scan for hardcoded credentials. Use on any codebase before release, after a significant feature addition, or as part of a compliance audit. Produces a severity-ranked findings table with OWASP category, file:line references, and specific remediation steps.'
+WHERE slug = 'security-review' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Captures a successful workflow pattern as a reusable skill definition: identifies the repeatable steps, required tools and agents, an intuitive slash-command trigger, and saves it to the Skills registry. Use after completing a workflow you expect to repeat, or to formalise a team standard. Produces a saved skill definition ready to invoke from the Skills page or via its trigger command.'
+WHERE slug = 'skill-create' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Creates a structured presentation deck as markdown or HTML slides: confirms brief, builds an outline, writes each slide with one key idea and speaker notes, and ensures a clean narrative arc from problem to call to action. Use when you need a presentation for a meeting, conference, or internal review. Produces a complete deck with title, context, core-content, summary, and CTA slides.'
+WHERE slug = 'slides' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Drives strict Test-Driven Development through the Red-Green-Refactor cycle: write a failing test, confirm it fails, write minimal passing code, confirm it passes, refactor, confirm coverage. Use for any new feature or bug fix where correctness and test coverage are non-negotiable. Produces implementation code with a matching test suite, a confirmed green build, and coverage meeting the configured threshold.'
+WHERE slug = 'tdd-workflow' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Assembles a team of specialised agents, writes self-contained briefs for each, dispatches them in parallel, and synthesises their outputs into a coherent result. Use when a task has clearly parallelisable sub-tasks — research + implementation + review — that different specialist agents can handle independently. Produces individual agent deliverables merged into a unified outcome with a monitoring summary.'
+WHERE slug = 'team-builder' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Builds an interactive UI prototype as a single self-contained HTML file with inline CSS and JS, realistic sample data, responsive layout, and hover/transition states — no build step required. Use to quickly demonstrate a layout, interaction pattern, or user flow before committing to a full implementation. Produces a browser-ready file the user can open immediately.'
+WHERE slug = 'ui-demo' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET    description = 'Runs the structured 6-phase quality gate pipeline in sequence: build, type-check, lint, test with coverage, security scan, and diff review for debug code or secrets. Use before merging any change or after a significant implementation session to confirm the codebase is clean. Produces a pass/fail result per phase with actionable failure details and the precise command that failed.',
+       -- Remove the non-existent `Verify` tool; keep the real tools only
+       tools       = '["Bash","Read","Grep","Glob"]'
+WHERE slug = 'verification-loop' AND tier = 'BuiltIn' AND kind = 'skills';
+
+UPDATE knowledge_pages
+SET description = 'Creates animated technical explainers as self-contained HTML files using CSS animations or inline SVG: script with timing markers, storyboard with progressive reveal, and a fully playable animation requiring no build step. Use to communicate a complex concept visually — architecture diagrams, algorithm walkthroughs, data flows. Produces a single browser-ready HTML file with embedded script, animation, and labels.'
+WHERE slug = 'video-explainer' AND tier = 'BuiltIn' AND kind = 'skills';
diff --git a/src/Sovrant.Runtime/Storage/Migrations/V045__seed_builtin_tool_guides.sql b/src/Sovrant.Runtime/Storage/Migrations/V045__seed_builtin_tool_guides.sql
new file mode 100644
index 00000000..885169c5
--- /dev/null
+++ b/src/Sovrant.Runtime/Storage/Migrations/V045__seed_builtin_tool_guides.sql
@@ -0,0 +1,97 @@
+-- V045: Seed built-in tool guides (kind='tools') for Phase 128 code-generation tools.
+-- These BuiltIn rows (workspace_id='') appear in the system prompt under "Tool Guides"
+-- and in the Knowledge UI under the Tools page. User edits land in overlay rows and
+-- are never clobbered here. Add new guides via a later Vxxx migration.
+
+INSERT INTO knowledge_pages
+    (knowledge_id, kind, slug, name, description, tier, body, workspace_id,
+     trigger, agents, tools, industry, default_format, category, role, recommended_level)
+VALUES
+
+  ('tool_CodeCreate', 'tools', 'CodeCreate', 'CodeCreate',
+   'Scaffold a new code project from a built-in template and get ready-to-run commands.',
+   'BuiltIn',
+   '# CodeCreate
+
+Scaffold a complete, runnable code project from a built-in template in one call.
+
+## When to use
+- User asks to "create a project", "start a new app", "scaffold a service", or names a language/framework
+- Before writing any files manually — always scaffold first, then customise
+
+## Inputs
+| Field | Required | Description |
+|---|---|---|
+| `template_id` | one of these | Exact template ID (e.g. `dotnet/webapi`, `node/express-api`, `python/fastapi`, `go/api`, `rust/cli`) |
+| `language` | or these | Language name used to auto-select the best template |
+| `kind` | optional | Narrows selection within a language (e.g. `cli`, `webapi`, `library`) |
+| `project_name` | yes | Used as directory name and wired into generated source |
+| `run_id` | yes | Scopes all files to this artifact run |
+
+## Response fields
+- **`build_command`** — the command to compile/build the project; execute it first
+- **`run_command`** — the command to start the app
+- **`test_command`** — the command to run the test suite
+- **`next_steps`** — ordered list of commands to share with the user
+- **`files`** — every generated file with its `path` and `access_url`
+- **`conventions`** — language style guide (present this to the user or apply it when writing more code)
+
+## Usage pattern
+1. Call `CodeListTemplates` if unsure which `template_id` to use
+2. Call `CodeCreate` with `project_name` and `run_id`
+3. Present `next_steps` to the user verbatim
+4. Apply `conventions` when writing any additional code in the same session
+
+## Rules
+- Always include `run_id` — without it the call fails
+- Use `template_id` over `language` when you know the exact template
+- If `error_count > 0`, check `errors[]` and report which files failed
+- Never scaffold into an existing `run_id` unless intentionally appending',
+   '', NULL, '["coder","executor"]', '["CodeCreate","CodeListTemplates","ArtifactTool","Bash"]',
+   NULL, NULL, 'code-generation', NULL, NULL),
+
+  ('tool_CodeCreateMulti', 'tools', 'CodeCreateMulti', 'CodeCreateMulti',
+   'Scaffold multiple interdependent project components (monorepo) in a single call.',
+   'BuiltIn',
+   '# CodeCreateMulti
+
+Scaffold an entire monorepo — multiple interdependent components — in a single call.
+Use this instead of multiple `CodeCreate` calls when the components form one deliverable.
+
+## When to use
+- User wants a full-stack app (API + frontend), a service + shared library, or any multi-component project
+- Do NOT use for a single component — use `CodeCreate` instead
+
+## Inputs
+| Field | Required | Description |
+|---|---|---|
+| `root_name` | yes | Top-level directory (e.g. `my-platform`). All components go under `<root_name>/<project_name>/` |
+| `components` | yes | Array of component specs (see below) |
+| `run_id` | yes | Scopes all files to this artifact run |
+
+### Component spec
+```json
+{
+  "project_name": "api",
+  "template_id": "node/express-api"
+}
+```
+Alternatively use `language` + optional `kind` instead of `template_id`.
+
+## Response fields
+- **`next_steps`** — combined ordered list of build/run/test commands across all components
+- **`components[]`** — per-component results, each with `build_command`, `run_command`, `test_command`, `files`
+- **`total_file_count`** — aggregate file count
+
+## Usage pattern
+1. Call `CodeListTemplates` to confirm template IDs for each component
+2. Call `CodeCreateMulti` with all components in one call
+3. Present `next_steps` to the user, organised per component
+4. Mention each component''s `README.md` for full setup
+
+## Rules
+- `root_name` becomes the outer directory — choose something meaningful (e.g. project slug)
+- Components are written sequentially; a scaffold failure on one component does not abort others
+- Check `error_count` at both the top level and per-component before declaring success',
+   '', NULL, '["coder","executor"]', '["CodeCreateMulti","CodeListTemplates","ArtifactTool","Bash"]',
+   NULL, NULL, 'code-generation', NULL, NULL);
diff --git a/src/Sovrant.Runtime/Storage/Migrations/V046__seed_code_validate_tool_guide.sql b/src/Sovrant.Runtime/Storage/Migrations/V046__seed_code_validate_tool_guide.sql
new file mode 100644
index 00000000..fbac7793
--- /dev/null
+++ b/src/Sovrant.Runtime/Storage/Migrations/V046__seed_code_validate_tool_guide.sql
@@ -0,0 +1,67 @@
+-- V046: Seed built-in tool guide for CodeValidate (Phase 128E).
+-- Adds a kind='tools' BuiltIn row so agents see usage guidance in the system prompt.
+
+INSERT INTO knowledge_pages
+    (knowledge_id, kind, slug, name, description, tier, body, workspace_id,
+     trigger, agents, tools, industry, default_format, category, role, recommended_level)
+VALUES
+  ('tool_CodeValidate', 'tools', 'CodeValidate', 'CodeValidate',
+   'Validate structural completeness of a scaffolded code artifact run — no compiler required.',
+   'BuiltIn',
+   '# CodeValidate
+
+Structurally validates a scaffolded code run after `CodeCreate` or `CodeCreateMulti`.
+Checks that language-specific marker files and universal scaffold files are present.
+No compiler or runtime is required — all checks are performed via the artifact store.
+
+## When to use
+- Immediately after `CodeCreate` to confirm the scaffold completed correctly
+- When debugging a scaffold that fails to build (check structural issues first)
+- In an automated post-scaffold quality gate before handing off to the user
+
+## Inputs
+| Field | Required | Description |
+|---|---|---|
+| `run_id` | yes | The run ID returned by `CodeCreate` or `CodeCreateMulti` |
+| `workspace_id` | no | Workspace ID (defaults to ''personal'') |
+| `project_id` | no | Project ID (defaults to ''default-project'') |
+
+## Response fields
+- **`pass`** — `true` if all gates passed; `false` if any gate failed
+- **`language`** / **`kind`** / **`template_id`** — from the stored manifest
+- **`build_command`** / **`run_command`** / **`test_command`** — ready to share
+- **`gates`** — per-gate results: `name`, `check`, `severity` (critical/warning), `passed`
+- **`gates_failed`** — number of failed gates
+- **`remediation`** — ordered list of fixes for failed gates
+
+## Gate severities
+- **critical** — language marker file missing; the project will not build without it
+- **warning** — universal file missing (.gitignore, README.md, CI workflow)
+
+## Usage pattern
+```
+1. Call CodeCreate → get run_id
+2. Call CodeValidate(run_id) → check pass == true
+3. If pass == false: surface remediation[] to the user or fix and re-run
+4. If pass == true: present build_command / next_steps to the user
+```
+
+## Language gates
+| Language | Critical check |
+|---|---|
+| dotnet | `.sln` or `.slnx` file + `Directory.Build.props` |
+| node | `package.json` |
+| python | `pyproject.toml` or `setup.py` |
+| go | `go.mod` |
+| rust | `Cargo.toml` |
+| java | `pom.xml` |
+| kotlin | `build.gradle.kts` |
+| ruby | `Gemfile` |
+| swift | `Package.swift` |
+| lua | `*.rockspec` |
+| zig | `build.zig` |
+| cpp | `CMakeLists.txt` |
+
+Universal gates (all languages): `README.md`, `.gitignore`, `.github/workflows/ci.yml`',
+   '', NULL, '["coder","executor"]', '["CodeValidate","CodeCreate","CodeListTemplates","ArtifactTool"]',
+   NULL, NULL, 'code-generation', NULL, NULL);
diff --git a/src/Sovrant.Server/Routes/ArtifactRoutes.cs b/src/Sovrant.Server/Routes/ArtifactRoutes.cs
index ab839c14..3dfce11b 100644
--- a/src/Sovrant.Server/Routes/ArtifactRoutes.cs
+++ b/src/Sovrant.Server/Routes/ArtifactRoutes.cs
@@ -1,3 +1,4 @@
+using System.IO.Compression;
 using System.Text.Json;
 using System.Text.Json.Serialization;
 using Sovrant.Runtime.Artifacts;
@@ -87,6 +88,7 @@ public static void Map(WebApplication app)
             {
                 var stream = await store.ReadAsync(handle, path, ct);
                 var contentType = MimeTypeFromExtension(path);
+                ApplyArtifactSecurityHeaders(ctx);
                 return Results.Stream(stream, contentType, Path.GetFileName(path));
             }
             catch (FileNotFoundException)
@@ -99,6 +101,62 @@ public static void Map(WebApplication app)
             }
         });
 
+        // ── Zip download — entire run as a single archive ───────────────
+
+        app.MapGet("/v1/artifacts/{runId}.zip", async (
+            string runId,
+            HttpContext ctx,
+            IArtifactStore store,
+            IWorkspaceService wsSvc,
+            IProjectService projSvc,
+            CancellationToken ct) =>
+        {
+            var scope = await ScopeFromQueryAsync(ctx, wsSvc, projSvc, ct, runId);
+            var deny = await WorkspaceAuthGuards.RequireWorkspaceAccessAsync(ctx, scope.WorkspaceId, wsSvc, ct).ConfigureAwait(false);
+            if (deny is not null) return deny;
+
+            ArtifactHandle handle;
+            try
+            {
+                handle = await store.CreateRunScopeAsync(scope, ct);
+            }
+            catch (ArgumentException ex)
+            {
+                return Results.BadRequest(new { error = ex.Message });
+            }
+
+            var ms = new MemoryStream();
+            var hasFiles = false;
+            using (var archive = new ZipArchive(ms, ZipArchiveMode.Create, leaveOpen: true))
+            {
+                await foreach (var entry in store.ListAsync(scope, ct))
+                {
+                    try
+                    {
+                        await using var fileStream = await store.ReadAsync(handle, entry.RelativePath, ct);
+                        var zipEntry = archive.CreateEntry(entry.RelativePath, CompressionLevel.Fastest);
+#pragma warning disable CA1849 // ZipArchiveEntry has no OpenAsync; archive is over MemoryStream
+                        await using var entryStream = zipEntry.Open();
+#pragma warning restore CA1849
+                        await fileStream.CopyToAsync(entryStream, ct).ConfigureAwait(false);
+                        hasFiles = true;
+                    }
+                    catch (Exception ex) when (ex is not OperationCanceledException)
+                    {
+                        // Skip unreadable entries — partial zip beats a 500
+                    }
+                }
+            }
+
+            if (!hasFiles)
+                return Results.NotFound(new { error = $"No artifacts found for run: {runId}" });
+
+            ms.Position = 0;
+            var safeId = SanitizeForFilename(runId);
+            ApplyArtifactSecurityHeaders(ctx);
+            return Results.File(ms, contentType: "application/zip", fileDownloadName: $"{safeId}.zip");
+        });
+
         // ── Delete a run's artifacts ────────────────────────────────────
 
         app.MapDelete("/v1/artifacts/{runId}", async (
@@ -202,4 +260,29 @@ private static string MimeTypeFromExtension(string path)
             _ => "application/octet-stream",
         };
     }
+
+    /// <summary>
+    /// Applies security headers that must be present on every artifact response.
+    /// HTML/SVG/JS files are served with <c>Content-Disposition: attachment</c> by
+    /// <c>Results.Stream</c> (via its fileDownloadName parameter), so this method
+    /// only needs to add the non-disposition headers.
+    /// </summary>
+    private static void ApplyArtifactSecurityHeaders(HttpContext ctx)
+    {
+        ctx.Response.Headers["X-Content-Type-Options"] = "nosniff";
+        ctx.Response.Headers["Cache-Control"] = "private, no-store";
+    }
+
+    private static string SanitizeForFilename(string name)
+    {
+        var invalid = Path.GetInvalidFileNameChars();
+        Span<char> buffer = stackalloc char[Math.Min(name.Length, 64)];
+        var len = 0;
+        foreach (var c in name)
+        {
+            if (len >= buffer.Length) break;
+            buffer[len++] = Array.IndexOf(invalid, c) >= 0 ? '_' : c;
+        }
+        return len == 0 ? "artifacts" : new string(buffer[..len]);
+    }
 }
diff --git a/src/Sovrant.Tools/Core/WriteFileTool.cs b/src/Sovrant.Tools/Core/WriteFileTool.cs
index abe45a95..04bd08b3 100644
--- a/src/Sovrant.Tools/Core/WriteFileTool.cs
+++ b/src/Sovrant.Tools/Core/WriteFileTool.cs
@@ -15,11 +15,12 @@ public sealed class WriteFileTool : ITool
     };
 
     // The Sovrant artifact store root — writes here must go through the Artifact tool.
+    // Must match LocalArtifactStore's default (Sovrant.Runtime/Artifacts/LocalArtifactStore.cs).
     private static readonly string s_artifactsRoot = Path.GetFullPath(
         Environment.GetEnvironmentVariable("SOVRANT_ARTIFACTS_ROOT")
         ?? Path.Combine(
             Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
-            ".sovrant", "artifacts"));
+            ".sovrant", "workspaces"));
 
     public ToolDefinition Definition => s_definition;
 
diff --git a/src/Sovrant.Tools/Projects/CodeCreateMultiTool.cs b/src/Sovrant.Tools/Projects/CodeCreateMultiTool.cs
index 327369f1..cfb19817 100644
--- a/src/Sovrant.Tools/Projects/CodeCreateMultiTool.cs
+++ b/src/Sovrant.Tools/Projects/CodeCreateMultiTool.cs
@@ -4,6 +4,7 @@
 using Sovrant.Runtime.Artifacts;
 using Sovrant.Runtime.Projects.Templates;
 using Sovrant.Runtime.Workspaces;
+using Sovrant.Tools.Projects.Scaffolds;
 
 namespace Sovrant.Tools.Projects;
 
@@ -19,7 +20,8 @@ public sealed class CodeCreateMultiTool : ITool
         Description =
             "Scaffold multiple interdependent project components (e.g. a monorepo with an API + shared library + frontend) " +
             "in a single call. Each entry in 'components' maps to a template, producing files under " +
-            "'<root_name>/<project_name>/...' in the artifact store. " +
+            "'<root_name>/<project_name>/...' in the artifact store. Each component in the response includes " +
+            "'build_command', 'run_command', and 'test_command'. A 'next_steps' list is also returned. " +
             "Use 'CodeListTemplates' to discover available template IDs.",
     };
 
@@ -137,6 +139,7 @@ public async Task<string> ExecuteAsync(JsonElement input, CancellationToken ct =
                 }
 
                 allErrors.AddRange(componentErrors);
+                var (compBuild, compRun, compTest) = ScaffoldCommands.For(template.Language, template.Kind, projectName);
                 componentResults.Add(new
                 {
                     component = projectName,
@@ -144,6 +147,9 @@ public async Task<string> ExecuteAsync(JsonElement input, CancellationToken ct =
                     template_name = template.Name,
                     file_count = written.Count,
                     error_count = componentErrors.Count,
+                    build_command = template.BuildCommand ?? compBuild,
+                    run_command = template.RunCommand ?? compRun,
+                    test_command = template.TestCommand ?? compTest,
                     files = written,
                 });
             }
@@ -153,6 +159,25 @@ public async Task<string> ExecuteAsync(JsonElement input, CancellationToken ct =
             return $"Error: {ex.Message}";
         }
 
+        // Write a top-level code manifest. For monorepos the commands are
+        // too variable to derive reliably, so we record the template list and
+        // mark the kind as "monorepo" for discoverability.
+        try
+        {
+            var manifestHandle = await _store.CreateRunScopeAsync(scope, ct).ConfigureAwait(false);
+            var languages = resolved.Select(r => r.template.Language).Distinct().ToList();
+            var templateIds = resolved.Select(r => r.template.Id).ToList();
+            await _store.SetCodeMetadataAsync(manifestHandle, new CodeManifest
+            {
+                TemplateId = templateIds.Count == 1 ? templateIds[0] : string.Join(", ", templateIds),
+                Language = languages.Count == 1 ? languages[0] : string.Join(", ", languages),
+                Kind = "monorepo",
+            }, ct).ConfigureAwait(false);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException) { /* best effort */ _ = ex; }
+
+        var nextSteps = BuildNextSteps(rootName, resolved);
+
         return JsonSerializer.Serialize(new
         {
             status = allErrors.Count == 0 ? "created" : "partial",
@@ -163,11 +188,31 @@ public async Task<string> ExecuteAsync(JsonElement input, CancellationToken ct =
             run_id = scope.RunId,
             workspace_id = scope.WorkspaceId,
             project_id = scope.ProjectId,
+            next_steps = nextSteps,
             components = componentResults,
             errors = allErrors,
         });
     }
 
+    private static string[] BuildNextSteps(
+        string rootName,
+        IReadOnlyList<(string projectName, IProjectTemplate template, ScaffoldContext context)> components)
+    {
+        var steps = new List<string>();
+        foreach (var (projectName, template, _) in components)
+        {
+            var (build, run, test) = ScaffoldCommands.For(template.Language, template.Kind, projectName);
+            var buildCmd = template.BuildCommand ?? build;
+            var runCmd = template.RunCommand ?? run;
+            var testCmd = template.TestCommand ?? test;
+            if (buildCmd is not null) steps.Add($"Build {projectName}: {buildCmd}");
+            if (runCmd is not null) steps.Add($"Run {projectName}: {runCmd}");
+            if (testCmd is not null) steps.Add($"Test {projectName}: {testCmd}");
+        }
+        steps.Add($"See {rootName}/*/README.md files for full setup instructions per component");
+        return [.. steps];
+    }
+
     private IProjectTemplate? ResolveTemplate(JsonElement spec, out string? error)
     {
         var templateId = spec.GetStringProp("template_id");
diff --git a/src/Sovrant.Tools/Projects/CodeCreateTool.cs b/src/Sovrant.Tools/Projects/CodeCreateTool.cs
index c37b4df3..2e3187c6 100644
--- a/src/Sovrant.Tools/Projects/CodeCreateTool.cs
+++ b/src/Sovrant.Tools/Projects/CodeCreateTool.cs
@@ -5,6 +5,7 @@
 using Sovrant.Runtime.Knowledge;
 using Sovrant.Runtime.Projects.Templates;
 using Sovrant.Runtime.Workspaces;
+using Sovrant.Tools.Projects.Scaffolds;
 
 namespace Sovrant.Tools.Projects;
 
@@ -21,8 +22,9 @@ public sealed class CodeCreateTool : ITool
             "Scaffold a new code project from a built-in template. " +
             "Provide either 'template_id' (e.g. 'node/express-api', 'dotnet/webapi', 'python/fastapi') " +
             "or a 'language' + optional 'kind' hint to auto-select the best template. " +
-            "Requires 'project_name' and 'run_id'. All generated files are written to the artifact store " +
-            "and listed in the response. Use 'CodeListTemplates' to discover available templates.",
+            "Requires 'project_name' and 'run_id'. All generated files are written to the artifact store. " +
+            "The response includes 'build_command', 'run_command', 'test_command', and a 'next_steps' list " +
+            "ready to share with the user. Use 'CodeListTemplates' to discover available templates.",
     };
 
     private readonly ProjectTemplateRegistry _registry;
@@ -125,6 +127,17 @@ public async Task<string> ExecuteAsync(JsonElement input, CancellationToken ct =
             return $"Error: {ex.Message}";
         }
 
+        var codeManifest = BuildCodeManifest(template, projectName);
+
+        // Write code metadata into the run manifest so the Artifacts page and
+        // downstream tools can surface build/run/test commands without re-reading files.
+        try
+        {
+            var handle2 = await _store.CreateRunScopeAsync(scope, ct).ConfigureAwait(false);
+            await _store.SetCodeMetadataAsync(handle2, codeManifest, ct).ConfigureAwait(false);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException) { /* best effort */ _ = ex; }
+
         // Resolve active language guideline (user override > built-in) and surface
         // it to the agent so it can apply conventions when writing additional code.
         string? conventions = null;
@@ -135,6 +148,8 @@ public async Task<string> ExecuteAsync(JsonElement input, CancellationToken ct =
         }
         conventions ??= LanguageGuidelines.Get(template.Language)?.Body;
 
+        var nextSteps = BuildNextSteps(codeManifest, projectName);
+
         return JsonSerializer.Serialize(new
         {
             status = errors.Count == 0 ? "created" : "partial",
@@ -146,6 +161,10 @@ public async Task<string> ExecuteAsync(JsonElement input, CancellationToken ct =
             run_id = scope.RunId,
             workspace_id = scope.WorkspaceId,
             project_id = scope.ProjectId,
+            build_command = codeManifest.BuildCommand,
+            run_command = codeManifest.RunCommand,
+            test_command = codeManifest.TestCommand,
+            next_steps = nextSteps,
             files = written,
             errors,
             conventions,
@@ -188,6 +207,34 @@ public async Task<string> ExecuteAsync(JsonElement input, CancellationToken ct =
         return null;
     }
 
+    private static CodeManifest BuildCodeManifest(IProjectTemplate template, string projectName)
+    {
+        var (defaultBuild, defaultRun, defaultTest) = ScaffoldCommands.For(template.Language, template.Kind, projectName);
+        return new CodeManifest
+        {
+            TemplateId = template.Id,
+            Language = template.Language,
+            Kind = template.Kind,
+            BuildCommand = template.BuildCommand ?? defaultBuild,
+            RunCommand = template.RunCommand ?? defaultRun,
+            TestCommand = template.TestCommand ?? defaultTest,
+            EntryPoint = template.EntryPoint ?? ScaffoldCommands.EntryPoint(template.Language, projectName),
+        };
+    }
+
+    private static string[] BuildNextSteps(CodeManifest manifest, string projectName)
+    {
+        var steps = new List<string>();
+        if (manifest.BuildCommand is not null)
+            steps.Add($"Build: {manifest.BuildCommand}");
+        if (manifest.RunCommand is not null)
+            steps.Add($"Run: {manifest.RunCommand}");
+        if (manifest.TestCommand is not null)
+            steps.Add($"Test: {manifest.TestCommand}");
+        steps.Add($"See {projectName}/README.md for full setup instructions");
+        return [.. steps];
+    }
+
     private static string InferContentType(string path)
     {
         var ext = Path.GetExtension(path).ToUpperInvariant();
diff --git a/src/Sovrant.Tools/Projects/CodeValidateTool.cs b/src/Sovrant.Tools/Projects/CodeValidateTool.cs
new file mode 100644
index 00000000..957392b0
--- /dev/null
+++ b/src/Sovrant.Tools/Projects/CodeValidateTool.cs
@@ -0,0 +1,234 @@
+using System.Text.Json;
+using Sovrant.Api.Types;
+using Sovrant.Runtime.Artifacts;
+using Sovrant.Runtime.Workspaces;
+
+namespace Sovrant.Tools.Projects;
+
+/// <summary>
+/// Phase 128E — Validates the structural quality of a previously scaffolded code artifact run.
+/// Reads the run manifest (language, kind, build commands) then checks that language-specific
+/// marker files and universal scaffold files are present. Purely structural — no compiler required.
+/// </summary>
+public sealed class CodeValidateTool : ITool
+{
+    private static readonly ToolDefinition s_definition = new("CodeValidate", CreateSchema())
+    {
+        Description =
+            "Validate the structural quality of a previously scaffolded code artifact run. " +
+            "Reads the run manifest (language, kind, build commands) and verifies that " +
+            "language-specific marker files (.sln for .NET, package.json for Node, go.mod for Go, etc.) " +
+            "and universal files (.gitignore, README.md, .github/workflows/ci.yml) are present. " +
+            "Returns pass/fail per gate with severity (critical/warning) and remediation steps. " +
+            "Does not require a compiler in PATH — purely structural checks via the artifact store. " +
+            "Run this immediately after CodeCreate to confirm the scaffold is complete.",
+    };
+
+    private readonly IArtifactStore _store;
+
+    public CodeValidateTool(IArtifactStore store)
+    {
+        _store = store ?? throw new ArgumentNullException(nameof(store));
+    }
+
+    public ToolDefinition Definition => s_definition;
+
+    // ── Gate definitions ─────────────────────────────────────────────────
+
+    private sealed record GateDef(
+        string Name,
+        string Check,
+        string Severity,
+        Func<IReadOnlySet<string>, bool> Test);
+
+    private static readonly GateDef[] s_universalGates =
+    [
+        new("readme",      "README.md present",                "warning", HasFile("README.md")),
+        new("gitignore",   ".gitignore present",               "warning", HasFile(".gitignore")),
+        new("ci-workflow", ".github/workflows/ci.yml present", "warning", HasPathSegment(".github/workflows/ci")),
+    ];
+
+    private static readonly Dictionary<string, GateDef[]> s_languageGates =
+        new(StringComparer.OrdinalIgnoreCase)
+        {
+            ["dotnet"] =
+            [
+                new("dotnet-sln",         ".sln or .slnx file present (required for dotnet build)",  "critical", AnyOf(HasExtension(".sln"), HasExtension(".slnx"))),
+                new("dotnet-build-props", "Directory.Build.props present (solution-wide settings)",  "warning",  HasFile("Directory.Build.props")),
+            ],
+            ["node"] =
+            [
+                new("node-package-json",  "package.json present (required for npm install)",         "critical", HasFile("package.json")),
+            ],
+            ["python"] =
+            [
+                new("python-project",     "pyproject.toml or setup.py present",                      "critical", AnyOf(HasFile("pyproject.toml"), HasFile("setup.py"))),
+            ],
+            ["go"] =
+            [
+                new("go-mod",             "go.mod present (required for go build)",                  "critical", HasFile("go.mod")),
+            ],
+            ["rust"] =
+            [
+                new("rust-cargo",         "Cargo.toml present (required for cargo build)",           "critical", HasFile("Cargo.toml")),
+            ],
+            ["java"] =
+            [
+                new("java-pom",           "pom.xml present (required for mvn package)",              "critical", HasFile("pom.xml")),
+            ],
+            ["kotlin"] =
+            [
+                new("kotlin-gradle",      "build.gradle.kts present (required for gradle build)",    "critical", HasFile("build.gradle.kts")),
+            ],
+            ["ruby"] =
+            [
+                new("ruby-gemfile",       "Gemfile present (required for bundle install)",           "critical", HasFile("Gemfile")),
+            ],
+            ["swift"] =
+            [
+                new("swift-package",      "Package.swift present (required for swift build)",        "critical", HasFile("Package.swift")),
+            ],
+            ["lua"] =
+            [
+                new("lua-rockspec",       "*.rockspec file present",                                  "critical", HasExtension(".rockspec")),
+            ],
+            ["zig"] =
+            [
+                new("zig-build",          "build.zig present (required for zig build)",              "critical", HasFile("build.zig")),
+            ],
+            ["cpp"] =
+            [
+                new("cpp-cmake",          "CMakeLists.txt present (required for cmake -B build)",    "critical", HasFile("CMakeLists.txt")),
+            ],
+        };
+
+    // ── Gate predicate helpers ────────────────────────────────────────────
+
+    private static Func<IReadOnlySet<string>, bool> HasFile(string fileName) =>
+        files => files.Any(p =>
+        {
+            var slash = p.LastIndexOf('/');
+            return p.AsSpan(slash + 1).Equals(fileName.AsSpan(), StringComparison.OrdinalIgnoreCase);
+        });
+
+    private static Func<IReadOnlySet<string>, bool> HasExtension(string ext) =>
+        files => files.Any(p => p.EndsWith(ext, StringComparison.OrdinalIgnoreCase));
+
+    private static Func<IReadOnlySet<string>, bool> HasPathSegment(string segment) =>
+        files => files.Any(p => p.Contains(segment, StringComparison.OrdinalIgnoreCase));
+
+    private static Func<IReadOnlySet<string>, bool> AnyOf(
+        Func<IReadOnlySet<string>, bool> a,
+        Func<IReadOnlySet<string>, bool> b) =>
+        files => a(files) || b(files);
+
+    // ── Execution ─────────────────────────────────────────────────────────
+
+    public async Task<string> ExecuteAsync(JsonElement input, CancellationToken ct = default)
+    {
+        var runId = input.GetStringProp("run_id");
+        if (string.IsNullOrWhiteSpace(runId))
+            return "Error: 'run_id' is required.";
+
+        var scope = new ArtifactScope
+        {
+            WorkspaceId = input.GetStringProp("workspace_id", WorkspaceIdentity.DefaultPersonal()),
+            ProjectId   = input.GetStringProp("project_id",   ArtifactScope.DefaultProjectId),
+            RunId       = runId,
+        };
+
+        ArtifactHandle handle;
+        try
+        {
+            handle = await _store.CreateRunScopeAsync(scope, ct).ConfigureAwait(false);
+        }
+        catch (ArgumentException ex)
+        {
+            return $"Error: {ex.Message}";
+        }
+
+        // Read manifest to discover language, kind, and commands.
+        CodeManifest? code = null;
+        try
+        {
+            using var manifestStream = await _store.ReadAsync(handle, "_manifest.json", ct).ConfigureAwait(false);
+            var manifest = await JsonSerializer.DeserializeAsync<ArtifactManifest>(
+                manifestStream, cancellationToken: ct).ConfigureAwait(false);
+            code = manifest?.Code;
+        }
+        catch (FileNotFoundException) { /* no manifest — universal gates only */ }
+        catch (JsonException)         { /* corrupt manifest — universal gates only */ }
+
+        // Collect all file paths for the run.
+        var filePaths = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        await foreach (var entry in _store.ListAsync(scope, ct).ConfigureAwait(false))
+            filePaths.Add(entry.RelativePath);
+
+        if (filePaths.Count == 0 && code is null)
+            return $"Error: run '{runId}' has no files. " +
+                   "Verify the run_id, workspace_id, and project_id are correct.";
+
+        // Select and order gates: language-specific first (critical), then universal.
+        var language = code?.Language ?? "unknown";
+        var activeGates = new List<GateDef>();
+        if (s_languageGates.TryGetValue(language, out var langGates))
+            activeGates.AddRange(langGates);
+        activeGates.AddRange(s_universalGates);
+
+        // Evaluate all gates.
+        var results = activeGates.Select(g => new
+        {
+            name     = g.Name,
+            check    = g.Check,
+            severity = g.Severity,
+            passed   = g.Test(filePaths),
+        }).ToList();
+
+        var failed = results.Where(r => !r.passed).ToList();
+        var pass   = failed.Count == 0;
+
+        var remediation = failed
+            .Select(r => r.severity == "critical"
+                ? $"[CRITICAL] {r.check} — add this file before attempting to build"
+                : $"[WARNING]  {r.check} — add this file to match the scaffold standard")
+            .ToArray();
+
+        return JsonSerializer.Serialize(new
+        {
+            pass,
+            language,
+            kind         = code?.Kind,
+            template_id  = code?.TemplateId,
+            build_command  = code?.BuildCommand,
+            run_command    = code?.RunCommand,
+            test_command   = code?.TestCommand,
+            file_count   = filePaths.Count,
+            gates_total  = results.Count,
+            gates_passed = results.Count(r => r.passed),
+            gates_failed = failed.Count,
+            gates        = results,
+            remediation,
+        });
+    }
+
+    private static JsonElement CreateSchema() => JsonDocument.Parse("""
+        {
+            "type": "object",
+            "properties": {
+                "run_id": {
+                    "type": "string",
+                    "description": "The run ID of the scaffolded artifact to validate. Required."
+                },
+                "workspace_id": {
+                    "type": "string",
+                    "description": "Workspace ID (defaults to 'personal')."
+                },
+                "project_id": {
+                    "type": "string",
+                    "description": "Project ID (defaults to 'default-project')."
+                }
+            },
+            "required": ["run_id"]
+        }
+        """).RootElement;
+}
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetBlazorScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetBlazorScaffold.cs
index 8565feb0..6d28e769 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetBlazorScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetBlazorScaffold.cs
@@ -17,6 +17,8 @@ public IReadOnlyList<ProjectFile> Scaffold(ScaffoldContext context)
         ArgumentNullException.ThrowIfNull(context);
         var pascal = ScaffoldHelpers.ToPascalCase(context.ProjectName);
         var kebab = ScaffoldHelpers.ToKebabCase(context.ProjectName);
+        var mainGuid = Guid.NewGuid().ToString("B").ToUpperInvariant();
+        var testGuid = Guid.NewGuid().ToString("B").ToUpperInvariant();
 
         return
         [
@@ -194,6 +196,90 @@ public async Task HomePage_ContainsHello()
                 }
                 """),
 
+            new($"{pascal}.sln", $$"""
+                Microsoft Visual Studio Solution File, Format Version 12.00
+                # Visual Studio Version 17
+                VisualStudioVersion = 17.0.31903.59
+                MinimumVisualStudioVersion = 10.0.40219.1
+                Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "{{pascal}}", "{{pascal}}/{{pascal}}.csproj", "{{mainGuid}}"
+                EndProject
+                Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "{{pascal}}.Tests", "{{pascal}}.Tests/{{pascal}}.Tests.csproj", "{{testGuid}}"
+                EndProject
+                Global
+                	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+                		Debug|Any CPU = Debug|Any CPU
+                		Release|Any CPU = Release|Any CPU
+                	EndGlobalSection
+                	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+                		{{mainGuid}}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+                		{{mainGuid}}.Debug|Any CPU.Build.0 = Debug|Any CPU
+                		{{mainGuid}}.Release|Any CPU.ActiveCfg = Release|Any CPU
+                		{{mainGuid}}.Release|Any CPU.Build.0 = Release|Any CPU
+                		{{testGuid}}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+                		{{testGuid}}.Debug|Any CPU.Build.0 = Debug|Any CPU
+                		{{testGuid}}.Release|Any CPU.ActiveCfg = Release|Any CPU
+                		{{testGuid}}.Release|Any CPU.Build.0 = Release|Any CPU
+                	EndGlobalSection
+                	GlobalSection(SolutionProperties) = preSolution
+                		HideSolutionNode = FALSE
+                	EndGlobalSection
+                EndGlobal
+                """),
+
+            new("Directory.Build.props", """
+                <Project>
+                  <PropertyGroup>
+                    <Nullable>enable</Nullable>
+                    <ImplicitUsings>enable</ImplicitUsings>
+                    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+                    <AnalysisMode>All</AnalysisMode>
+                    <LangVersion>latest</LangVersion>
+                  </PropertyGroup>
+                </Project>
+                """),
+
+            new(".editorconfig", """
+                root = true
+
+                [*]
+                indent_style = space
+                end_of_line = lf
+                charset = utf-8
+                trim_trailing_whitespace = true
+                insert_final_newline = true
+
+                [*.{cs,csproj,props,targets,razor}]
+                indent_size = 4
+
+                [*.{json,yaml,yml}]
+                indent_size = 2
+
+                [*.md]
+                trim_trailing_whitespace = false
+                """),
+
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions/setup-dotnet@v4
+                        with:
+                          dotnet-version: '10.x'
+                      - run: dotnet restore
+                      - run: dotnet build --no-restore
+                      - run: dotnet test --no-build
+                """),
+
             new(".gitignore", """
                 bin/
                 obj/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetConsoleScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetConsoleScaffold.cs
index 93f81d3b..a1249fa1 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetConsoleScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetConsoleScaffold.cs
@@ -16,6 +16,8 @@ public IReadOnlyList<ProjectFile> Scaffold(ScaffoldContext context)
     {
         ArgumentNullException.ThrowIfNull(context);
         var pascal = ScaffoldHelpers.ToPascalCase(context.ProjectName);
+        var mainGuid = Guid.NewGuid().ToString("B").ToUpperInvariant();
+        var testGuid = Guid.NewGuid().ToString("B").ToUpperInvariant();
 
         return
         [
@@ -87,6 +89,90 @@ public void Greet_IncludesName(string name)
                 }
                 """),
 
+            new($"{pascal}.sln", $$"""
+                Microsoft Visual Studio Solution File, Format Version 12.00
+                # Visual Studio Version 17
+                VisualStudioVersion = 17.0.31903.59
+                MinimumVisualStudioVersion = 10.0.40219.1
+                Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "{{pascal}}", "{{pascal}}/{{pascal}}.csproj", "{{mainGuid}}"
+                EndProject
+                Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "{{pascal}}.Tests", "{{pascal}}.Tests/{{pascal}}.Tests.csproj", "{{testGuid}}"
+                EndProject
+                Global
+                	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+                		Debug|Any CPU = Debug|Any CPU
+                		Release|Any CPU = Release|Any CPU
+                	EndGlobalSection
+                	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+                		{{mainGuid}}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+                		{{mainGuid}}.Debug|Any CPU.Build.0 = Debug|Any CPU
+                		{{mainGuid}}.Release|Any CPU.ActiveCfg = Release|Any CPU
+                		{{mainGuid}}.Release|Any CPU.Build.0 = Release|Any CPU
+                		{{testGuid}}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+                		{{testGuid}}.Debug|Any CPU.Build.0 = Debug|Any CPU
+                		{{testGuid}}.Release|Any CPU.ActiveCfg = Release|Any CPU
+                		{{testGuid}}.Release|Any CPU.Build.0 = Release|Any CPU
+                	EndGlobalSection
+                	GlobalSection(SolutionProperties) = preSolution
+                		HideSolutionNode = FALSE
+                	EndGlobalSection
+                EndGlobal
+                """),
+
+            new("Directory.Build.props", """
+                <Project>
+                  <PropertyGroup>
+                    <Nullable>enable</Nullable>
+                    <ImplicitUsings>enable</ImplicitUsings>
+                    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+                    <AnalysisMode>All</AnalysisMode>
+                    <LangVersion>latest</LangVersion>
+                  </PropertyGroup>
+                </Project>
+                """),
+
+            new(".editorconfig", """
+                root = true
+
+                [*]
+                indent_style = space
+                end_of_line = lf
+                charset = utf-8
+                trim_trailing_whitespace = true
+                insert_final_newline = true
+
+                [*.{cs,csproj,props,targets}]
+                indent_size = 4
+
+                [*.{json,yaml,yml}]
+                indent_size = 2
+
+                [*.md]
+                trim_trailing_whitespace = false
+                """),
+
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions/setup-dotnet@v4
+                        with:
+                          dotnet-version: '10.x'
+                      - run: dotnet restore
+                      - run: dotnet build --no-restore
+                      - run: dotnet test --no-build
+                """),
+
             new(".gitignore", """
                 bin/
                 obj/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetLibraryScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetLibraryScaffold.cs
index e6ac04c4..b45bb43e 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetLibraryScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetLibraryScaffold.cs
@@ -22,6 +22,8 @@ public IReadOnlyList<ProjectFile> Scaffold(ScaffoldContext context)
         var pascal = ScaffoldHelpers.ToPascalCase(context.ProjectName);
         var author = context.Get("Author", "Your Name");
         var description = context.Get("Description", $"A .NET library: {pascal}");
+        var mainGuid = Guid.NewGuid().ToString("B").ToUpperInvariant();
+        var testGuid = Guid.NewGuid().ToString("B").ToUpperInvariant();
 
         return
         [
@@ -102,6 +104,90 @@ public void Greet_NullName_Throws()
                 }
                 """),
 
+            new($"{pascal}.sln", $$"""
+                Microsoft Visual Studio Solution File, Format Version 12.00
+                # Visual Studio Version 17
+                VisualStudioVersion = 17.0.31903.59
+                MinimumVisualStudioVersion = 10.0.40219.1
+                Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "{{pascal}}", "{{pascal}}/{{pascal}}.csproj", "{{mainGuid}}"
+                EndProject
+                Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "{{pascal}}.Tests", "{{pascal}}.Tests/{{pascal}}.Tests.csproj", "{{testGuid}}"
+                EndProject
+                Global
+                	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+                		Debug|Any CPU = Debug|Any CPU
+                		Release|Any CPU = Release|Any CPU
+                	EndGlobalSection
+                	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+                		{{mainGuid}}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+                		{{mainGuid}}.Debug|Any CPU.Build.0 = Debug|Any CPU
+                		{{mainGuid}}.Release|Any CPU.ActiveCfg = Release|Any CPU
+                		{{mainGuid}}.Release|Any CPU.Build.0 = Release|Any CPU
+                		{{testGuid}}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+                		{{testGuid}}.Debug|Any CPU.Build.0 = Debug|Any CPU
+                		{{testGuid}}.Release|Any CPU.ActiveCfg = Release|Any CPU
+                		{{testGuid}}.Release|Any CPU.Build.0 = Release|Any CPU
+                	EndGlobalSection
+                	GlobalSection(SolutionProperties) = preSolution
+                		HideSolutionNode = FALSE
+                	EndGlobalSection
+                EndGlobal
+                """),
+
+            new("Directory.Build.props", """
+                <Project>
+                  <PropertyGroup>
+                    <Nullable>enable</Nullable>
+                    <ImplicitUsings>enable</ImplicitUsings>
+                    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+                    <AnalysisMode>All</AnalysisMode>
+                    <LangVersion>latest</LangVersion>
+                  </PropertyGroup>
+                </Project>
+                """),
+
+            new(".editorconfig", """
+                root = true
+
+                [*]
+                indent_style = space
+                end_of_line = lf
+                charset = utf-8
+                trim_trailing_whitespace = true
+                insert_final_newline = true
+
+                [*.{cs,csproj,props,targets}]
+                indent_size = 4
+
+                [*.{json,yaml,yml}]
+                indent_size = 2
+
+                [*.md]
+                trim_trailing_whitespace = false
+                """),
+
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions/setup-dotnet@v4
+                        with:
+                          dotnet-version: '10.x'
+                      - run: dotnet restore
+                      - run: dotnet build --no-restore
+                      - run: dotnet test --no-build
+                """),
+
             new(".gitignore", """
                 bin/
                 obj/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetWebApiScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetWebApiScaffold.cs
index 480745b8..7cceb6d1 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetWebApiScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetWebApiScaffold.cs
@@ -16,6 +16,8 @@ public IReadOnlyList<ProjectFile> Scaffold(ScaffoldContext context)
     {
         ArgumentNullException.ThrowIfNull(context);
         var pascal = ScaffoldHelpers.ToPascalCase(context.ProjectName);
+        var mainGuid = Guid.NewGuid().ToString("B").ToUpperInvariant();
+        var testGuid = Guid.NewGuid().ToString("B").ToUpperInvariant();
 
         return
         [
@@ -125,6 +127,90 @@ private sealed record HealthResponse(string Status);
                 }
                 """),
 
+            new($"{pascal}.sln", $$"""
+                Microsoft Visual Studio Solution File, Format Version 12.00
+                # Visual Studio Version 17
+                VisualStudioVersion = 17.0.31903.59
+                MinimumVisualStudioVersion = 10.0.40219.1
+                Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "{{pascal}}", "{{pascal}}/{{pascal}}.csproj", "{{mainGuid}}"
+                EndProject
+                Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "{{pascal}}.Tests", "{{pascal}}.Tests/{{pascal}}.Tests.csproj", "{{testGuid}}"
+                EndProject
+                Global
+                	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+                		Debug|Any CPU = Debug|Any CPU
+                		Release|Any CPU = Release|Any CPU
+                	EndGlobalSection
+                	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+                		{{mainGuid}}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+                		{{mainGuid}}.Debug|Any CPU.Build.0 = Debug|Any CPU
+                		{{mainGuid}}.Release|Any CPU.ActiveCfg = Release|Any CPU
+                		{{mainGuid}}.Release|Any CPU.Build.0 = Release|Any CPU
+                		{{testGuid}}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+                		{{testGuid}}.Debug|Any CPU.Build.0 = Debug|Any CPU
+                		{{testGuid}}.Release|Any CPU.ActiveCfg = Release|Any CPU
+                		{{testGuid}}.Release|Any CPU.Build.0 = Release|Any CPU
+                	EndGlobalSection
+                	GlobalSection(SolutionProperties) = preSolution
+                		HideSolutionNode = FALSE
+                	EndGlobalSection
+                EndGlobal
+                """),
+
+            new("Directory.Build.props", """
+                <Project>
+                  <PropertyGroup>
+                    <Nullable>enable</Nullable>
+                    <ImplicitUsings>enable</ImplicitUsings>
+                    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+                    <AnalysisMode>All</AnalysisMode>
+                    <LangVersion>latest</LangVersion>
+                  </PropertyGroup>
+                </Project>
+                """),
+
+            new(".editorconfig", """
+                root = true
+
+                [*]
+                indent_style = space
+                end_of_line = lf
+                charset = utf-8
+                trim_trailing_whitespace = true
+                insert_final_newline = true
+
+                [*.{cs,csproj,props,targets}]
+                indent_size = 4
+
+                [*.{json,yaml,yml}]
+                indent_size = 2
+
+                [*.md]
+                trim_trailing_whitespace = false
+                """),
+
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions/setup-dotnet@v4
+                        with:
+                          dotnet-version: '10.x'
+                      - run: dotnet restore
+                      - run: dotnet build --no-restore
+                      - run: dotnet test --no-build
+                """),
+
             new(".gitignore", """
                 bin/
                 obj/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetWorkerScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetWorkerScaffold.cs
index 3168ba3d..aba62eb7 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetWorkerScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/DotNet/DotNetWorkerScaffold.cs
@@ -16,6 +16,7 @@ public IReadOnlyList<ProjectFile> Scaffold(ScaffoldContext context)
     {
         ArgumentNullException.ThrowIfNull(context);
         var pascal = ScaffoldHelpers.ToPascalCase(context.ProjectName);
+        var mainGuid = Guid.NewGuid().ToString("B").ToUpperInvariant();
 
         return
         [
@@ -74,6 +75,84 @@ protected override async Task ExecuteAsync(CancellationToken stoppingToken)
                 }
                 """),
 
+            new($"{pascal}.sln", $$"""
+                Microsoft Visual Studio Solution File, Format Version 12.00
+                # Visual Studio Version 17
+                VisualStudioVersion = 17.0.31903.59
+                MinimumVisualStudioVersion = 10.0.40219.1
+                Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "{{pascal}}", "{{pascal}}.csproj", "{{mainGuid}}"
+                EndProject
+                Global
+                	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+                		Debug|Any CPU = Debug|Any CPU
+                		Release|Any CPU = Release|Any CPU
+                	EndGlobalSection
+                	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+                		{{mainGuid}}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+                		{{mainGuid}}.Debug|Any CPU.Build.0 = Debug|Any CPU
+                		{{mainGuid}}.Release|Any CPU.ActiveCfg = Release|Any CPU
+                		{{mainGuid}}.Release|Any CPU.Build.0 = Release|Any CPU
+                	EndGlobalSection
+                	GlobalSection(SolutionProperties) = preSolution
+                		HideSolutionNode = FALSE
+                	EndGlobalSection
+                EndGlobal
+                """),
+
+            new("Directory.Build.props", """
+                <Project>
+                  <PropertyGroup>
+                    <Nullable>enable</Nullable>
+                    <ImplicitUsings>enable</ImplicitUsings>
+                    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+                    <AnalysisMode>All</AnalysisMode>
+                    <LangVersion>latest</LangVersion>
+                  </PropertyGroup>
+                </Project>
+                """),
+
+            new(".editorconfig", """
+                root = true
+
+                [*]
+                indent_style = space
+                end_of_line = lf
+                charset = utf-8
+                trim_trailing_whitespace = true
+                insert_final_newline = true
+
+                [*.{cs,csproj,props,targets}]
+                indent_size = 4
+
+                [*.{json,yaml,yml}]
+                indent_size = 2
+
+                [*.md]
+                trim_trailing_whitespace = false
+                """),
+
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions/setup-dotnet@v4
+                        with:
+                          dotnet-version: '10.x'
+                      - run: dotnet restore
+                      - run: dotnet build --no-restore
+                      - run: dotnet publish -c Release -o publish/
+                """),
+
             new(".gitignore", """
                 bin/
                 obj/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Go/GoApiScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Go/GoApiScaffold.cs
index 13eae94d..31e20cb0 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Go/GoApiScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Go/GoApiScaffold.cs
@@ -99,6 +99,28 @@ var body map[string]string
                 }
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions/setup-go@v5
+                        with:
+                          go-version: '1.23'
+                      - run: go build ./...
+                      - run: go test ./...
+                      - run: go vet ./...
+                """),
+
             new(".gitignore", """
                 /bin/
                 *.exe
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Java/JavaMavenAppScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Java/JavaMavenAppScaffold.cs
index 4239d57f..7d8dfa73 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Java/JavaMavenAppScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Java/JavaMavenAppScaffold.cs
@@ -95,6 +95,27 @@ void greetIncludesName() {
                 }
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions/setup-java@v4
+                        with:
+                          java-version: '21'
+                          distribution: 'temurin'
+                      - run: mvn -B package
+                """),
+
             new(".gitignore", """
                 target/
                 .classpath
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Minimal/CppCmakeScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Minimal/CppCmakeScaffold.cs
index 1e6f8db5..839d9df9 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Minimal/CppCmakeScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Minimal/CppCmakeScaffold.cs
@@ -105,6 +105,25 @@ int main(int argc, char* argv[]) {
                 }
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - run: cmake -B build -DCMAKE_BUILD_TYPE=Debug
+                      - run: cmake --build build
+                      - run: ctest --test-dir build --output-on-failure
+                """),
+
             new(".gitignore", """
                 build/
                 cmake-build-*/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Minimal/KotlinConsoleScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Minimal/KotlinConsoleScaffold.cs
index f67b21bf..52152671 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Minimal/KotlinConsoleScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Minimal/KotlinConsoleScaffold.cs
@@ -72,6 +72,27 @@ fun greetIncludesName() = assertTrue(greet("World").contains("World"))
                 }
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions/setup-java@v4
+                        with:
+                          java-version: '21'
+                          distribution: 'temurin'
+                      - run: ./gradlew build
+                """),
+
             new(".gitignore", """
                 .gradle/
                 build/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Minimal/LuaScriptScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Minimal/LuaScriptScaffold.cs
index 33b7b8ec..634663c7 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Minimal/LuaScriptScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Minimal/LuaScriptScaffold.cs
@@ -80,6 +80,25 @@ function M.greet(name)
                 end)
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - run: sudo apt-get install -y lua5.4 luarocks
+                      - run: sudo luarocks install busted
+                      - run: busted spec/
+                """),
+
             new(".gitignore", """
                 *.rock
                 luarocks/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Minimal/RubyScriptScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Minimal/RubyScriptScaffold.cs
index cbe5a34c..67e3caa3 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Minimal/RubyScriptScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Minimal/RubyScriptScaffold.cs
@@ -66,6 +66,26 @@ def test_greet_includes_name
                 end
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: ruby/setup-ruby@v1
+                        with:
+                          bundler-cache: true
+                      - run: bundle exec ruby -Itest test/test_*.rb
+                """),
+
             new(".gitignore", """
                 .bundle/
                 vendor/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Minimal/SwiftCliScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Minimal/SwiftCliScaffold.cs
index e3da59b6..601729bd 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Minimal/SwiftCliScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Minimal/SwiftCliScaffold.cs
@@ -61,6 +61,24 @@ func testGreetIncludesName() {
                 }
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: macos-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - run: swift build
+                      - run: swift test
+                """),
+
             new(".gitignore", """
                 .build/
                 .swiftpm/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Minimal/ZigCliScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Minimal/ZigCliScaffold.cs
index bf381625..aeb1b38f 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Minimal/ZigCliScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Minimal/ZigCliScaffold.cs
@@ -104,6 +104,27 @@ pub fn main() !void {
                 }
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: mlugg/setup-zig@v1
+                        with:
+                          version: '0.14.0'
+                      - run: zig build
+                      - run: zig build test
+                """),
+
             new(".gitignore", """
                 zig-out/
                 zig-cache/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeCliScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeCliScaffold.cs
index 429aeb1e..6c3a9814 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeCliScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeCliScaffold.cs
@@ -84,6 +84,29 @@ export function greet(name: string): string {
                 });
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions/setup-node@v4
+                        with:
+                          node-version: '22'
+                          cache: 'npm'
+                      - run: npm install
+                      - run: npm test
+                      - run: npm run build
+                """),
+
             new(".gitignore", """
                 node_modules/
                 dist/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeExpressApiScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeExpressApiScaffold.cs
index dd5f5197..6df5f4d1 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeExpressApiScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeExpressApiScaffold.cs
@@ -104,6 +104,29 @@ export function createApp() {
                 });
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions/setup-node@v4
+                        with:
+                          node-version: '22'
+                          cache: 'npm'
+                      - run: npm install
+                      - run: npm test
+                      - run: npm run build
+                """),
+
             new(".gitignore", """
                 node_modules/
                 dist/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeLibraryScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeLibraryScaffold.cs
index fb068f01..92ffb23f 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeLibraryScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeLibraryScaffold.cs
@@ -98,6 +98,29 @@ export function greet(name: string): string {
                 });
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions/setup-node@v4
+                        with:
+                          node-version: '22'
+                          cache: 'npm'
+                      - run: npm install
+                      - run: npm test
+                      - run: npm run build
+                """),
+
             new(".gitignore", """
                 node_modules/
                 dist/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeMonorepoScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeMonorepoScaffold.cs
index cdc5e57c..e69dfba7 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeMonorepoScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeMonorepoScaffold.cs
@@ -163,6 +163,32 @@ export function greet(name: string): string {
                 console.log(greet(name));
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: pnpm/action-setup@v4
+                        with:
+                          version: 9
+                      - uses: actions/setup-node@v4
+                        with:
+                          node-version: '22'
+                          cache: 'pnpm'
+                      - run: pnpm install
+                      - run: pnpm build
+                      - run: pnpm test
+                """),
+
             new(".gitignore", """
                 node_modules/
                 dist/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeNextJsScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeNextJsScaffold.cs
index 5fd99344..a2bedbca 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeNextJsScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Node/NodeNextJsScaffold.cs
@@ -165,6 +165,29 @@ public IReadOnlyList<ProjectFile> Scaffold(ScaffoldContext context)
                 });
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions/setup-node@v4
+                        with:
+                          node-version: '22'
+                          cache: 'npm'
+                      - run: npm install
+                      - run: npm test
+                      - run: npm run build
+                """),
+
             new(".gitignore", """
                 node_modules/
                 .next/
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Python/PythonFastApiScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Python/PythonFastApiScaffold.cs
index 39a37b91..3b2e39c3 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Python/PythonFastApiScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Python/PythonFastApiScaffold.cs
@@ -81,6 +81,28 @@ async with AsyncClient(
                     assert response.json() == {"status": "ok"}
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions/setup-python@v5
+                        with:
+                          python-version: '3.12'
+                      - run: pip install -e ".[dev]"
+                      - run: pytest
+                      - run: ruff check .
+                """),
+
             new(".gitignore", """
                 __pycache__/
                 *.pyc
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Python/PythonScriptScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Python/PythonScriptScaffold.cs
index 35f75d58..c4e15fea 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Python/PythonScriptScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Python/PythonScriptScaffold.cs
@@ -74,6 +74,28 @@ def test_greet_defaults_work():
                     assert "World" in result
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions/setup-python@v5
+                        with:
+                          python-version: '3.12'
+                      - run: pip install -e ".[dev]"
+                      - run: pytest
+                      - run: ruff check .
+                """),
+
             new(".gitignore", """
                 __pycache__/
                 *.pyc
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/Rust/RustCliScaffold.cs b/src/Sovrant.Tools/Projects/Scaffolds/Rust/RustCliScaffold.cs
index fede35cd..6fe04b08 100644
--- a/src/Sovrant.Tools/Projects/Scaffolds/Rust/RustCliScaffold.cs
+++ b/src/Sovrant.Tools/Projects/Scaffolds/Rust/RustCliScaffold.cs
@@ -107,6 +107,26 @@ fn greets_given_name() {
                 }
                 """),
 
+            new(".github/workflows/ci.yml", """
+                name: CI
+
+                on:
+                  push:
+                    branches: [main, master]
+                  pull_request:
+                    branches: [main, master]
+
+                jobs:
+                  build-and-test:
+                    runs-on: ubuntu-latest
+                    steps:
+                      - uses: actions/checkout@v4
+                      - uses: actions-rust-lang/setup-rust-toolchain@v1
+                      - run: cargo build
+                      - run: cargo test
+                      - run: cargo clippy -- -D warnings
+                """),
+
             new(".gitignore", """
                 /target/
                 .env
diff --git a/src/Sovrant.Tools/Projects/Scaffolds/ScaffoldCommands.cs b/src/Sovrant.Tools/Projects/Scaffolds/ScaffoldCommands.cs
new file mode 100644
index 00000000..085f0bb5
--- /dev/null
+++ b/src/Sovrant.Tools/Projects/Scaffolds/ScaffoldCommands.cs
@@ -0,0 +1,85 @@
+#pragma warning disable CA1308 // ToLowerInvariant on ASCII language IDs is intentional and locale-safe
+namespace Sovrant.Tools.Projects.Scaffolds;
+
+/// <summary>
+/// Derives the canonical build/run/test shell commands and entry point for a
+/// scaffolded project based on its language and kind.
+/// These are temporary defaults — Phase 128 Part D will promote them to
+/// <c>IProjectTemplate</c> members so each template can override them precisely.
+/// </summary>
+internal static class ScaffoldCommands
+{
+    /// <summary>
+    /// Returns <c>(buildCommand, runCommand, testCommand)</c> for the given language and kind.
+    /// <paramref name="projectName"/> is used where the command must reference a specific file.
+    /// Null means "not applicable for this language/kind".
+    /// </summary>
+    public static (string? build, string? run, string? test) For(string language, string kind, string projectName) =>
+        language.ToLowerInvariant() switch
+        {
+            "dotnet" => DotNet(kind, projectName),
+            "node"   => Node(kind),
+            "python" => Python(kind),
+            "go"     => ("go build ./...", "go run .", "go test ./..."),
+            "rust"   => ("cargo build", "cargo run", "cargo test"),
+            "java"   => ("mvn package -q", $"java -jar target/{projectName}-1.0-SNAPSHOT.jar", "mvn test -q"),
+            "kotlin" => ("./gradlew build", "./gradlew run", "./gradlew test"),
+            "ruby"   => ("bundle install", "bundle exec ruby main.rb", "bundle exec rspec"),
+            "swift"  => ("swift build", $".build/debug/{projectName}", "swift test"),
+            "lua"    => (null, "lua main.lua", null),
+            "zig"    => ("zig build", $"zig-out/bin/{projectName}", "zig build test"),
+            "cpp"    => ("cmake -B build && cmake --build build", $"./build/{projectName}", "ctest --test-dir build"),
+            _        => (null, null, null),
+        };
+
+    /// <summary>
+    /// Returns the primary entry point path relative to the artifact run root
+    /// (i.e. including the project name directory prefix).
+    /// </summary>
+    public static string? EntryPoint(string language, string projectName) =>
+        language.ToLowerInvariant() switch
+        {
+            "dotnet" => $"{projectName}/{projectName}.csproj",
+            "node"   => $"{projectName}/package.json",
+            "python" => $"{projectName}/main.py",
+            "go"     => $"{projectName}/main.go",
+            "rust"   => $"{projectName}/Cargo.toml",
+            "java"   => $"{projectName}/pom.xml",
+            "kotlin" => $"{projectName}/build.gradle.kts",
+            "ruby"   => $"{projectName}/Gemfile",
+            "swift"  => $"{projectName}/Package.swift",
+            "lua"    => $"{projectName}/main.lua",
+            "zig"    => $"{projectName}/build.zig",
+            "cpp"    => $"{projectName}/CMakeLists.txt",
+            _        => null,
+        };
+
+    // ── Per-language helpers ────────────────────────────────────────────
+
+    private static (string? build, string? run, string? test) DotNet(string kind, string projectName) =>
+        kind switch
+        {
+            "library" => ("dotnet build", null, "dotnet test"),
+            "blazor"  => ("dotnet build", $"dotnet run --project {projectName}/{projectName}.csproj", null),
+            "worker"  => ("dotnet build", $"dotnet run --project {projectName}/{projectName}.csproj", null),
+            // webapi, console, and everything else
+            _         => ("dotnet build", $"dotnet run --project {projectName}/{projectName}.csproj", "dotnet test"),
+        };
+
+    private static (string? build, string? run, string? test) Node(string kind) =>
+        kind switch
+        {
+            "nextjs"    => ("npm install && npm run build", "npm run dev", "npm test"),
+            "monorepo"  => ("npm install", "npm run dev --workspaces", "npm test --workspaces"),
+            "library"   => ("npm install && npm run build", null, "npm test"),
+            // cli, express-api, and everything else
+            _           => ("npm install", "npm start", "npm test"),
+        };
+
+    private static (string? build, string? run, string? test) Python(string kind) =>
+        kind switch
+        {
+            "fastapi" => ("pip install -r requirements.txt", "uvicorn main:app --reload", "pytest"),
+            _         => ("pip install -r requirements.txt", "python main.py", "pytest"),
+        };
+}
diff --git a/src/Sovrant.Tools/ServiceCollectionExtensions.cs b/src/Sovrant.Tools/ServiceCollectionExtensions.cs
index 62adb68c..89eda167 100644
--- a/src/Sovrant.Tools/ServiceCollectionExtensions.cs
+++ b/src/Sovrant.Tools/ServiceCollectionExtensions.cs
@@ -203,6 +203,7 @@ public static IServiceCollection AddSovrantTools(this IServiceCollection service
             sp.GetService<Sovrant.Runtime.Knowledge.IKnowledgeStore>()));
         services.AddSingleton<ITool, CodeCreateMultiTool>();
         services.AddSingleton<ITool, CodeListTemplatesTool>();
+        services.AddSingleton<ITool, CodeValidateTool>();
 
         // Quality / verification tools
         services.AddSingleton<ITool, VerifyTool>();
diff --git a/src/Sovrant.Web/Components/Layout/TopContextBar.razor b/src/Sovrant.Web/Components/Layout/TopContextBar.razor
index 97ab41d1..4d8f46b1 100644
--- a/src/Sovrant.Web/Components/Layout/TopContextBar.razor
+++ b/src/Sovrant.Web/Components/Layout/TopContextBar.razor
@@ -501,7 +501,13 @@
         }
         _treeGroups = groups.Values.ToList();
         var configuredSet = new HashSet<string>(groups.Keys, StringComparer.OrdinalIgnoreCase);
-        _unconfiguredProviders = _knownProviders.Where(p => !configuredSet.Contains(p.Name)).ToList();
+
+        // Provider setup lives at /admin/providers (system-admin only). Non-admins have no
+        // path to act on an unconfigured provider, so the "Set up →" prompt is admin-only;
+        // non-admins only ever see providers a workspace admin has already enabled for them.
+        _unconfiguredProviders = Session.IsAdmin
+            ? _knownProviders.Where(p => !configuredSet.Contains(p.Name)).ToList()
+            : [];
     }
 
     private async Task ToggleTreeDropdown()
@@ -608,7 +614,8 @@
             var modelsUrl = baseUrl.TrimEnd('/') + "/models";
             using var request = new HttpRequestMessage(HttpMethod.Get, new Uri(modelsUrl));
             var safeKey = new string(apiKey.Where(c => c < 128).ToArray()).Trim();
-            request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", safeKey);
+            if (!string.IsNullOrEmpty(safeKey))
+                request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", safeKey);
             var response = await http.SendAsync(request, cts.Token);
             response.EnsureSuccessStatusCode();
             using var stream = await response.Content.ReadAsStreamAsync(cts.Token);
@@ -773,7 +780,7 @@
     private void NavigateToProviderSetup(string providerName)
     {
         _treeOpen = false;
-        NavManager.NavigateTo("/settings?tab=providers&provider=" + Uri.EscapeDataString(providerName));
+        NavManager.NavigateTo("/admin/providers?provider=" + Uri.EscapeDataString(providerName));
     }
 
     private static string ShortenModelName(string model)
diff --git a/src/Sovrant.Web/Components/Pages/AdminProviders.razor b/src/Sovrant.Web/Components/Pages/AdminProviders.razor
index 6e9eb864..53e53fb7 100644
--- a/src/Sovrant.Web/Components/Pages/AdminProviders.razor
+++ b/src/Sovrant.Web/Components/Pages/AdminProviders.razor
@@ -60,8 +60,8 @@
         </div>
 
         <div class="form-field">
-            <label>API Key</label>
-            <input type="password" @bind="_apiKey" placeholder="sk-..." autocomplete="off" data-lpignore="true" data-1p-ignore />
+            <label>API Key @(IsLocalProvider(_selectedProvider) ? "(optional)" : "")</label>
+            <input type="password" @bind="_apiKey" placeholder="@(IsLocalProvider(_selectedProvider) ? "Not required for local providers" : "sk-...")" autocomplete="off" data-lpignore="true" data-1p-ignore />
         </div>
 
         <div class="form-field">
@@ -149,11 +149,25 @@
         }
 
         _apiKey = string.Empty;
+
+        // Deep-link from the top provider switcher's "Set up →" unconfigured-provider entry.
+        var query = Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(new Uri(Nav.Uri).Query);
+        if (query.TryGetValue("provider", out var providerParam)
+            && Providers.Contains(providerParam.ToString(), StringComparer.Ordinal))
+        {
+            _selectedProvider = providerParam.ToString();
+        }
+
         if (ProviderBaseUrls.TryGetValue(_selectedProvider, out var defaultUrl))
             _baseUrl = defaultUrl;
 
         await LoadProfilesAsync();
         _allWorkspaces = (await WorkspaceService.ListAllAsync()).ToList();
+
+        // Pre-select the personal workspace; all others are opt-in.
+        var personal = _allWorkspaces.FirstOrDefault(w => w.Type == Sovrant.Runtime.Workspaces.WorkspaceType.Personal);
+        if (personal is not null)
+            _selectedWorkspaceIds.Add(personal.WorkspaceId);
     }
 
     private void OnProviderChanged()
@@ -169,9 +183,16 @@
             _baseUrl = profile.BaseUrl;
     }
 
+    private static bool IsLocalProvider(string provider) =>
+        provider is "Ollama" or "LM Studio";
+
     private async Task AddProvider()
     {
-        if (string.IsNullOrWhiteSpace(_apiKey)) { _statusMessage = "Please enter an API key."; return; }
+        if (string.IsNullOrWhiteSpace(_apiKey) && !IsLocalProvider(_selectedProvider))
+        {
+            _statusMessage = "Please enter an API key.";
+            return;
+        }
 
         var displayName = string.IsNullOrWhiteSpace(_newProfileName)
             ? _selectedProvider : _newProfileName.Trim();
diff --git a/src/Sovrant.Web/Components/Pages/Artifacts.razor b/src/Sovrant.Web/Components/Pages/Artifacts.razor
index 1edbd257..06d0da5c 100644
--- a/src/Sovrant.Web/Components/Pages/Artifacts.razor
+++ b/src/Sovrant.Web/Components/Pages/Artifacts.razor
@@ -1,5 +1,6 @@
 @page "/artifacts"
 @using Sovrant.Runtime.Artifacts
+@using Sovrant.Runtime.Workspaces
 @using Sovrant.Web.Services
 @using Markdig
 @using BlazorMonaco.Editor
@@ -120,6 +121,8 @@
 
 @code {
     [Inject] private IArtifactStore ArtifactStore { get; set; } = default!;
+    [Inject] private IWorkspaceService WorkspaceService { get; set; } = default!;
+    [Inject] private Sovrant.Web.Services.WebSessionService Session { get; set; } = default!;
 
     private List<ArtifactItem> _all = [];
     private List<ArtifactItem> _filtered = [];
@@ -137,6 +140,7 @@
         ".md", ".txt", ".json", ".xml", ".html", ".htm", ".css", ".js", ".ts", ".tsx", ".jsx",
         ".cs", ".py", ".go", ".rs", ".java", ".rb", ".php", ".yaml", ".yml", ".toml", ".csv",
         ".log", ".sh", ".ps1", ".sql", ".csproj", ".axaml", ".razor", ".ini", ".cfg", ".conf", ".env",
+        ".sln", ".gitignore", ".editorconfig", ".nvmrc", ".env.example",
     };
 
     private static readonly HashSet<string> CodeExtensions = new(StringComparer.OrdinalIgnoreCase)
@@ -148,74 +152,80 @@
 
     protected override async Task OnInitializedAsync() => await LoadAsync();
 
-    private Task LoadAsync()
+    private async Task LoadAsync()
     {
         _loadError = string.Empty;
         _selected = null;
         _selectedEditorKey = string.Empty;
         try
         {
-            var root = (ArtifactStore as LocalArtifactStore)?.Root;
-            if (root is null || !Directory.Exists(root))
-            {
-                _all = [];
-                ApplyFilter();
-                return Task.CompletedTask;
-            }
-
+            // Scoped to the viewer's own workspaces — personal workspaces are single-member
+            // by construction, so this naturally keeps personal artifacts private. Team
+            // workspace membership (any role) grants visibility into that workspace's
+            // artifacts; global admins see everything. Matches server-side enforcement
+            // in WorkspaceAuthGuards.RequireWorkspaceAccessAsync for the /v1/artifacts API.
+            var workspaces = Session.IsAdmin
+                ? await WorkspaceService.ListAllAsync()
+                : await WorkspaceService.ListForUserAsync(Session.UserId ?? string.Empty);
             var items = new List<ArtifactItem>();
-            foreach (var file in Directory.EnumerateFiles(root, "*", SearchOption.AllDirectories))
+
+            foreach (var ws in workspaces)
             {
-                var fileName = System.IO.Path.GetFileName(file);
-                if (string.Equals(fileName, "_manifest.json", StringComparison.OrdinalIgnoreCase))
-                    continue;
+                // Projects-only: lists the default project's artifacts. Enumerating every
+                // real project's artifacts is deferred until multi-user web and
+                // project-level artifact display are built.
+                var scope = new ArtifactScope
+                {
+                    WorkspaceId = ws.WorkspaceId,
+                    WorkspaceName = ws.Name,
+                };
 
-                var relativePath = System.IO.Path.GetRelativePath(root, file).Replace('\\', '/');
-                var segments = relativePath.Split('/');
-                if (segments.Length < 4) continue;
+                await foreach (var entry in ArtifactStore.ListAsync(scope))
+                {
+                    var runId = entry.RunId ?? string.Empty;
+                    if (string.IsNullOrEmpty(runId)) continue;
 
-                var info = new FileInfo(file);
-                var ext = System.IO.Path.GetExtension(file);
+                    // RelativePath when listing without RunId = "{run}/{artifactPath}"
+                    var artifactPath = entry.RelativePath.Length > runId.Length + 1
+                        ? entry.RelativePath[(runId.Length + 1)..]
+                        : entry.RelativePath;
 
-                var workspaceId = SegmentId(segments[0]);
-                var projectId = SegmentId(segments[1]);
-                var runId = segments[2];
-                var artifactPath = string.Join('/', segments[3..]);
+                    var fileName = System.IO.Path.GetFileName(artifactPath);
+                    var ext = System.IO.Path.GetExtension(artifactPath);
+                    var isCode = CodeExtensions.Contains(ext);
 
-                var accessUrl = string.Empty;
-                var zipUrl = string.Empty;
-                if (!string.IsNullOrEmpty(workspaceId) && !string.IsNullOrEmpty(projectId) && !string.IsNullOrEmpty(runId))
-                {
+                    // URL layout: /artifacts/{ws}/{proj}/{run}/{file} — FindRunDir in
+                    // Program.cs resolves this against the real on-disk layout
+                    // {root}/{ws}/projects/{proj}/artifacts/{run}.
                     var escapedTail = string.Join('/', artifactPath.Split('/').Select(Uri.EscapeDataString));
-                    accessUrl = $"/artifacts/{Uri.EscapeDataString(workspaceId)}/{Uri.EscapeDataString(projectId)}/{Uri.EscapeDataString(runId)}/{escapedTail}";
-                    zipUrl = $"/artifacts/{Uri.EscapeDataString(workspaceId)}/{Uri.EscapeDataString(projectId)}/{Uri.EscapeDataString(runId)}.zip";
-                }
+                    var accessUrl = $"/artifacts/{Uri.EscapeDataString(ws.WorkspaceId)}/{Uri.EscapeDataString(scope.ProjectId)}/{Uri.EscapeDataString(runId)}/{escapedTail}";
+                    var zipUrl = $"/artifacts/{Uri.EscapeDataString(ws.WorkspaceId)}/{Uri.EscapeDataString(scope.ProjectId)}/{Uri.EscapeDataString(runId)}.zip";
 
-                var isCode = CodeExtensions.Contains(ext);
-
-                items.Add(new ArtifactItem
-                {
-                    FullDiskPath = file,
-                    FileName = fileName,
-                    Extension = ext,
-                    ArtifactRelPath = artifactPath,
-                    SizeBytes = info.Length,
-                    SizeDisplay = FormatSize(info.Length),
-                    ContentType = GuessMime(ext),
-                    LastModified = new DateTimeOffset(info.LastWriteTimeUtc, TimeSpan.Zero),
-                    IsMarkdown = ext.Equals(".md", StringComparison.OrdinalIgnoreCase),
-                    IsPdf = ext.Equals(".pdf", StringComparison.OrdinalIgnoreCase),
-                    IsCode = isCode,
-                    MonacoLanguage = isCode ? GetMonacoLanguage(ext) : "plaintext",
-                    AccessUrl = accessUrl,
-                    ZipUrl = zipUrl,
-                    RunId = runId,
-                });
+                    items.Add(new ArtifactItem
+                    {
+                        WorkspaceId = ws.WorkspaceId,
+                        WorkspaceName = ws.Name,
+                        RunId = runId,
+                        FileName = fileName,
+                        Extension = ext,
+                        ArtifactRelPath = artifactPath,
+                        SizeBytes = entry.SizeBytes,
+                        SizeDisplay = FormatSize(entry.SizeBytes),
+                        ContentType = GuessMime(ext),
+                        LastModified = entry.LastModified,
+                        IsMarkdown = ext.Equals(".md", StringComparison.OrdinalIgnoreCase),
+                        IsPdf = ext.Equals(".pdf", StringComparison.OrdinalIgnoreCase),
+                        IsCode = isCode,
+                        MonacoLanguage = isCode ? GetMonacoLanguage(ext) : "plaintext",
+                        AccessUrl = accessUrl,
+                        ZipUrl = zipUrl,
+                    });
+                }
             }
 
             // Group multi-file runs into folder items; single-file runs stay flat.
             var grouped = new List<ArtifactItem>();
-            foreach (var runGroup in items.GroupBy(a => a.RunId))
+            foreach (var runGroup in items.GroupBy(a => $"{a.WorkspaceId}/{a.RunId}"))
             {
                 var files = runGroup.ToList();
                 if (files.Count > 1)
@@ -223,11 +233,13 @@
                     var first = files.OrderBy(f => f.LastModified).First();
                     var folderName = first.ArtifactRelPath.Contains('/')
                         ? first.ArtifactRelPath.Split('/')[0]
-                        : runGroup.Key;
+                        : files[0].RunId;
                     var totalBytes = files.Sum(f => f.SizeBytes);
                     grouped.Add(new ArtifactItem
                     {
-                        RunId = runGroup.Key,
+                        WorkspaceId = files[0].WorkspaceId,
+                        WorkspaceName = files[0].WorkspaceName,
+                        RunId = files[0].RunId,
                         IsFolder = true,
                         FolderName = folderName,
                         FolderFiles = files,
@@ -252,7 +264,6 @@
             _all = [];
             ApplyFilter();
         }
-        return Task.CompletedTask;
     }
 
     private async Task SelectItem(ArtifactItem item)
@@ -265,19 +276,25 @@
         {
             try
             {
-                if (File.Exists(item.FullDiskPath))
+                var scope = new ArtifactScope
                 {
-                    var content = await File.ReadAllTextAsync(item.FullDiskPath);
-                    if (content.Length > 20000) content = content[..20000] + "\n\n... (truncated at 20,000 chars)";
-                    item.Preview = content;
-                }
+                    WorkspaceId = item.WorkspaceId,
+                    WorkspaceName = item.WorkspaceName,
+                    RunId = item.RunId,
+                };
+                var handle = await ArtifactStore.CreateRunScopeAsync(scope);
+                await using var stream = await ArtifactStore.ReadAsync(handle, item.ArtifactRelPath);
+                using var reader = new System.IO.StreamReader(stream, System.Text.Encoding.UTF8);
+                var content = await reader.ReadToEndAsync();
+                if (content.Length > 20_000) content = content[..20_000] + "\n\n... (truncated at 20,000 chars)";
+                item.Preview = content;
             }
             catch { item.Preview = "(Could not load preview)"; }
         }
 
         // Reveal Monaco only after content is ready so ConstructionOptions sees the value
         if (item.IsCode && !string.IsNullOrEmpty(item.Preview))
-            _selectedEditorKey = item.FullDiskPath;
+            _selectedEditorKey = $"{item.WorkspaceId}/{item.RunId}/{item.ArtifactRelPath}";
 
         StateHasChanged();
     }
@@ -317,12 +334,6 @@
 
     private static string GuessMime(string ext) => ArtifactMime.For(ext);
 
-    private static string SegmentId(string segment)
-    {
-        var idx = segment.IndexOf("__", StringComparison.Ordinal);
-        return idx >= 0 ? segment[..idx] : segment;
-    }
-
     private static string GetMonacoLanguage(string ext) => ext.ToLowerInvariant() switch
     {
         ".ts" or ".tsx" => "typescript",
@@ -356,7 +367,9 @@
 
     private sealed class ArtifactItem
     {
-        public string FullDiskPath { get; init; } = string.Empty;
+        public string WorkspaceId { get; init; } = string.Empty;
+        public string WorkspaceName { get; init; } = string.Empty;
+        public string RunId { get; init; } = string.Empty;
         public string FileName { get; init; } = string.Empty;
         public string Extension { get; init; } = string.Empty;
         public string ArtifactRelPath { get; init; } = string.Empty;
@@ -370,7 +383,6 @@
         public string MonacoLanguage { get; init; } = "plaintext";
         public string AccessUrl { get; init; } = string.Empty;
         public string ZipUrl { get; init; } = string.Empty;
-        public string RunId { get; init; } = string.Empty;
         public string? Preview { get; set; }
         // Folder grouping
         public bool IsFolder { get; set; }
diff --git a/src/Sovrant.Web/Components/Pages/Diagnostics.razor b/src/Sovrant.Web/Components/Pages/Diagnostics.razor
index bd863384..253e9874 100644
--- a/src/Sovrant.Web/Components/Pages/Diagnostics.razor
+++ b/src/Sovrant.Web/Components/Pages/Diagnostics.razor
@@ -186,7 +186,7 @@
 
         var home = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
         _dbPath = Bootstrap.DbPath ?? Path.Combine(home, ".sovrant", "data", "sovrant.db");
-        _artifactsPath = Path.Combine(home, ".sovrant", "artifacts");
+        _artifactsPath = Bootstrap.ArtifactsRoot ?? Path.Combine(home, ".sovrant", "workspaces");
         _logDir = Path.Combine(home, ".sovrant", "logs");
     }
 
diff --git a/src/Sovrant.Web/Components/Shared/ChatMessage.razor b/src/Sovrant.Web/Components/Shared/ChatMessage.razor
index fb50f0f9..fc72d104 100644
--- a/src/Sovrant.Web/Components/Shared/ChatMessage.razor
+++ b/src/Sovrant.Web/Components/Shared/ChatMessage.razor
@@ -20,10 +20,6 @@
                 {
                     <span class="elapsed-text">@Message.ElapsedText</span>
                 }
-                @if (Message.IsComplete && !string.IsNullOrEmpty(Message.ActionSummary))
-                {
-                    <span class="action-summary">@Message.ActionSummary</span>
-                }
                 @if (Message.IsComplete)
                 {
                     <button class="btn-copy-message" @onclick="CopyMessageAsync">@_copyLabel</button>
@@ -44,52 +40,60 @@
                 </div>
             }
 
-            @if (Message.IsExecutingTools)
+            @{
+                var pendingTools = Message.ToolUses.Where(t => t.IsPendingConfirmation).ToList();
+                var stripTools = Message.ToolUses.Where(t => !t.IsPendingConfirmation).ToList();
+                var hasWork = pendingTools.Count > 0 || stripTools.Count > 0 || Message.IsExecutingTools;
+            }
+
+            @* Answer-first (Phase 126 #4): once the turn is complete, the answer renders
+               above the work strip so it's readable without scrolling past tool blocks. *@
+            @if (Message.IsComplete && !string.IsNullOrEmpty(Message.Text))
             {
-                <div class="execution-status msg-indent">
-                    <span class="thinking-dot"></span>
-                    <span class="execution-status-text">@Message.ExecutionStatusText</span>
+                <div class="msg-indent">
+                    <div class="message-markdown">@((MarkupString)RenderMarkdown(Message.Text))</div>
                 </div>
+                @if (hasWork)
+                {
+                    <div class="work-separator"></div>
+                }
             }
 
-            @if (Message.ToolUses.Count > 0)
+            @if (pendingTools.Count > 0)
             {
                 <div class="msg-indent">
-                    @foreach (var tool in Message.ToolUses)
+                    @foreach (var tool in pendingTools)
                     {
-                        <div class="tool-use-block @(tool.IsError ? "tool-error" : "")">
+                        <div class="tool-use-block">
                             <div class="tool-header">
                                 <span class="tool-icon"><SovrantIcon Name="tools" /></span>
                                 <span class="tool-name">@ChatMessageModel.FriendlyToolLabel(tool.ToolName)</span>
-                                <span class="tool-status @(tool.Status == "Done" ? "status-done" : tool.IsError ? "status-error" : "status-running")">@tool.Status</span>
+                                <span class="tool-status status-running">@tool.Status</span>
                             </div>
-                            @if (tool.IsPendingConfirmation)
-                            {
-                                <div class="tool-confirmation">
-                                    <div class="tool-input-preview">@tool.Result</div>
-                                    <div class="tool-actions">
-                                        <button class="btn-approve" @onclick="() => OnApprove.InvokeAsync(tool)"><SovrantIcon Name="check" /> Allow once</button>
-                                        <button class="btn-approve-turn" @onclick="() => OnApproveForTurn.InvokeAsync(tool)" title="Auto-approve this tool for the rest of this turn"><SovrantIcon Name="check-circle" /> Allow for turn</button>
-                                        <button class="btn-deny" @onclick="() => OnDeny.InvokeAsync(tool)"><SovrantIcon Name="x" /> Deny</button>
-                                    </div>
+                            <div class="tool-confirmation">
+                                <div class="tool-input-preview">@tool.Result</div>
+                                <div class="tool-actions">
+                                    <button class="btn-approve" @onclick="() => OnApprove.InvokeAsync(tool)"><SovrantIcon Name="check" /> Allow once</button>
+                                    <button class="btn-approve-turn" @onclick="() => OnApproveForTurn.InvokeAsync(tool)" title="Auto-approve this tool for the rest of this turn"><SovrantIcon Name="check-circle" /> Allow for turn</button>
+                                    <button class="btn-deny" @onclick="() => OnDeny.InvokeAsync(tool)"><SovrantIcon Name="x" /> Deny</button>
                                 </div>
-                            }
-                            else if (!string.IsNullOrEmpty(tool.Result))
-                            {
-                                @if (DocumentArtifactCard.ProducesArtifacts(tool.ToolName))
-                                {
-                                    <DocumentArtifactCard ToolName="@tool.ToolName" ResultJson="@tool.Result" />
-                                }
-                                <details class="tool-result">
-                                    <summary>Result</summary>
-                                    <pre>@tool.Result</pre>
-                                </details>
-                            }
+                            </div>
                         </div>
                     }
                 </div>
             }
 
+            @if (stripTools.Count > 0 || Message.IsExecutingTools)
+            {
+                <div class="msg-indent">
+                    <WorkStrip ToolUses="stripTools"
+                               IsExecuting="Message.IsExecutingTools"
+                               ExecutionStatusText="@Message.ExecutionStatusText"
+                               ActionSummary="@Message.ActionSummary"
+                               ElapsedText="@Message.ElapsedText" />
+                </div>
+            }
+
             @if (Message.StandaloneArtifacts.Count > 0)
             {
                 <div class="msg-indent doc-artifact-list">
@@ -116,17 +120,10 @@
                 </div>
             }
 
-            @if (!string.IsNullOrEmpty(Message.Text))
+            @if (!Message.IsComplete && !string.IsNullOrEmpty(Message.Text))
             {
                 <div class="msg-indent">
-                    @if (Message.IsComplete)
-                    {
-                        <div class="message-markdown">@((MarkupString)RenderMarkdown(Message.Text))</div>
-                    }
-                    else
-                    {
-                        <div class="message-text streaming">@Message.Text</div>
-                    }
+                    <div class="message-text streaming">@Message.Text</div>
                 </div>
             }
 
diff --git a/src/Sovrant.Web/Components/Shared/WorkStrip.razor b/src/Sovrant.Web/Components/Shared/WorkStrip.razor
new file mode 100644
index 00000000..93a127e7
--- /dev/null
+++ b/src/Sovrant.Web/Components/Shared/WorkStrip.razor
@@ -0,0 +1,92 @@
+<div class="work-strip">
+    @if (IsExecuting)
+    {
+        <div class="work-strip-active">
+            <span class="thinking-dot"></span>
+            <span class="work-strip-status-text">@ExecutionStatusText</span>
+        </div>
+    }
+    else if (ToolUses.Count > 0)
+    {
+        <button type="button" class="work-strip-header @(ErrorCount > 0 ? "work-strip-header-error" : "")" @onclick="ToggleExpanded">
+            <span class="work-strip-caret">@(_expanded ? "▾" : "▸")</span>
+            <span class="work-strip-count">@ToolUses.Count action@(ToolUses.Count == 1 ? "" : "s")</span>
+            @if (!string.IsNullOrEmpty(ActionSummary))
+            {
+                <span class="work-strip-dot">&middot;</span>
+                <span class="work-strip-groups">@ActionSummary</span>
+            }
+            @if (ErrorCount > 0)
+            {
+                <span class="work-strip-dot">&middot;</span>
+                <span class="work-strip-errcount">@ErrorCount error@(ErrorCount == 1 ? "" : "s")</span>
+            }
+            @if (!string.IsNullOrEmpty(ElapsedText))
+            {
+                <span class="work-strip-dot">&middot;</span>
+                <span class="work-strip-elapsed">@ElapsedText</span>
+            }
+            @if (ErrorCount > 0)
+            {
+                <span class="work-strip-warn-icon">&#9888;</span>
+            }
+        </button>
+
+        @if (_expanded)
+        {
+            <div class="work-strip-list">
+                @foreach (var tool in ToolUses)
+                {
+                    <div class="work-strip-row @(tool.IsError ? "work-strip-row-error" : "") @(_activeToolId == tool.ToolUseId ? "work-strip-row-active" : "")"
+                         @onclick="() => ToggleDetail(tool.ToolUseId)">
+                        <span class="work-strip-status-dot @StatusDotClass(tool)"></span>
+                        <span class="tool-icon"><SovrantIcon Name="tools" /></span>
+                        <span class="work-strip-row-name">@ChatMessageModel.FriendlyToolLabel(tool.ToolName)</span>
+                        <span class="work-strip-row-preview">@Preview(tool.Result)</span>
+                    </div>
+                    @if (_activeToolId == tool.ToolUseId)
+                    {
+                        <div class="work-strip-detail">
+                            @if (DocumentArtifactCard.ProducesArtifacts(tool.ToolName) && !string.IsNullOrEmpty(tool.Result))
+                            {
+                                <DocumentArtifactCard ToolName="@tool.ToolName" ResultJson="@tool.Result" />
+                            }
+                            @if (!string.IsNullOrEmpty(tool.Result))
+                            {
+                                <pre>@tool.Result</pre>
+                            }
+                        </div>
+                    }
+                }
+            </div>
+        }
+    }
+</div>
+
+@code {
+    [Parameter, EditorRequired] public List<ToolUseModel> ToolUses { get; set; } = [];
+    [Parameter] public bool IsExecuting { get; set; }
+    [Parameter] public string? ExecutionStatusText { get; set; }
+    [Parameter] public string? ActionSummary { get; set; }
+    [Parameter] public string? ElapsedText { get; set; }
+
+    private bool _expanded;
+    private string? _activeToolId;
+
+    private int ErrorCount => ToolUses.Count(t => t.IsError);
+
+    private void ToggleExpanded() => _expanded = !_expanded;
+
+    private void ToggleDetail(string toolUseId) =>
+        _activeToolId = _activeToolId == toolUseId ? null : toolUseId;
+
+    private static string StatusDotClass(ToolUseModel tool) =>
+        tool.IsError ? "status-dot-fail" : tool.Status == "Done" ? "status-dot-pass" : "status-dot-warn";
+
+    private static string Preview(string result)
+    {
+        if (string.IsNullOrWhiteSpace(result)) return string.Empty;
+        var line = result.Split('\n', 2)[0].Trim();
+        return line.Length > 90 ? line[..90] + "…" : line;
+    }
+}
diff --git a/src/Sovrant.Web/Program.cs b/src/Sovrant.Web/Program.cs
index 96f7152e..6128b367 100644
--- a/src/Sovrant.Web/Program.cs
+++ b/src/Sovrant.Web/Program.cs
@@ -346,8 +346,11 @@ private static void MapArtifactsEndpoint(WebApplication app)
     {
         // Single-file endpoint.
         app.MapGet("/artifacts/{workspaceId}/{projectId}/{runId}/{*relPath}",
-            (string workspaceId, string projectId, string runId, string relPath,
-             Sovrant.Runtime.Artifacts.IArtifactStore store) =>
+            async (string workspaceId, string projectId, string runId, string relPath,
+             HttpContext ctx,
+             Sovrant.Runtime.Artifacts.IArtifactStore store,
+             Sovrant.Runtime.Workspaces.IWorkspaceService wsSvc,
+             WebSessionService session) =>
         {
             if (store is not Sovrant.Runtime.Artifacts.LocalArtifactStore local)
                 return Results.NotFound();
@@ -361,6 +364,15 @@ private static void MapArtifactsEndpoint(WebApplication app)
                 return Results.BadRequest();
             }
 
+            // Personal workspaces are single-member by construction; team workspace
+            // membership (any role) grants visibility into that workspace's artifacts.
+            // Matches WorkspaceAuthGuards.RequireWorkspaceAccessAsync for /v1/artifacts.
+            if (!session.IsAdmin &&
+                !await wsSvc.IsMemberAsync(Uri.UnescapeDataString(workspaceId), session.UserId ?? string.Empty))
+            {
+                return Results.Json(new { error = "Forbidden." }, statusCode: StatusCodes.Status403Forbidden);
+            }
+
             var ws = Uri.UnescapeDataString(workspaceId);
             var proj = Uri.UnescapeDataString(projectId);
             var run = Uri.UnescapeDataString(runId);
@@ -376,7 +388,17 @@ private static void MapArtifactsEndpoint(WebApplication app)
             if (!File.Exists(fullPath))
                 return Results.NotFound();
 
-            var contentType = Sovrant.Web.Services.ArtifactMime.For(Path.GetExtension(fullPath));
+            var ext = Path.GetExtension(fullPath);
+            var contentType = Sovrant.Web.Services.ArtifactMime.For(ext);
+
+            // Security: non-rendereable LLM-generated content must not execute in-browser.
+            ctx.Response.Headers["X-Content-Type-Options"] = "nosniff";
+            ctx.Response.Headers["Cache-Control"] = "private, no-store";
+
+            // Force download for types the browser would otherwise render or execute.
+            if (IsUnsafeInlineType(ext))
+                return Results.File(fullPath, contentType, fileDownloadName: Path.GetFileName(fullPath));
+
             return Results.File(fullPath, contentType, enableRangeProcessing: true);
         });
 
@@ -384,7 +406,10 @@ private static void MapArtifactsEndpoint(WebApplication app)
         // an entire run as one download from the Artifacts page.
         app.MapGet("/artifacts/{workspaceId}/{projectId}/{runId}.zip",
             async (string workspaceId, string projectId, string runId,
-             Sovrant.Runtime.Artifacts.IArtifactStore store) =>
+             HttpContext ctx,
+             Sovrant.Runtime.Artifacts.IArtifactStore store,
+             Sovrant.Runtime.Workspaces.IWorkspaceService wsSvc,
+             WebSessionService session) =>
         {
             if (store is not Sovrant.Runtime.Artifacts.LocalArtifactStore local)
                 return Results.NotFound();
@@ -396,6 +421,12 @@ private static void MapArtifactsEndpoint(WebApplication app)
                 return Results.BadRequest();
             }
 
+            if (!session.IsAdmin &&
+                !await wsSvc.IsMemberAsync(Uri.UnescapeDataString(workspaceId), session.UserId ?? string.Empty))
+            {
+                return Results.Json(new { error = "Forbidden." }, statusCode: StatusCodes.Status403Forbidden);
+            }
+
             var ws = Uri.UnescapeDataString(workspaceId);
             var proj = Uri.UnescapeDataString(projectId);
             var run = Uri.UnescapeDataString(runId);
@@ -421,6 +452,8 @@ private static void MapArtifactsEndpoint(WebApplication app)
                 }
             }
             ms.Position = 0;
+            ctx.Response.Headers["X-Content-Type-Options"] = "nosniff";
+            ctx.Response.Headers["Cache-Control"] = "private, no-store";
             return Results.File(ms, contentType: "application/zip", fileDownloadName: $"{safeRun}.zip");
         });
     }
@@ -428,16 +461,19 @@ private static void MapArtifactsEndpoint(WebApplication app)
     /// <summary>
     /// Resolves the run directory, handling the optional <c>{id}__{name}</c> suffix
     /// that <see cref="LocalArtifactStore"/> appends when a workspace or project has
-    /// a display name (e.g. <c>ws-personal-abc__myworkspace/artifacts/run-xyz</c>).
+    /// a display name. Matches the projects-only layout
+    /// <c>{root}/{ws}/projects/{proj}/artifacts/{run}</c> — every artifact belongs to
+    /// a workspace AND a project, there is no workspace-level shortcut.
     /// Returns <see langword="null"/> if the directory cannot be found.
     /// </summary>
     private static string? FindRunDir(string root, string ws, string proj, string run)
     {
         var wsDir = FindSegmentDir(root, ws);
         if (wsDir is null) return null;
-        var projDir = FindSegmentDir(wsDir, proj);
+        var projectsDir = Path.Combine(wsDir, "projects");
+        var projDir = FindSegmentDir(projectsDir, proj);
         if (projDir is null) return null;
-        var runDir = Path.Combine(projDir, run);
+        var runDir = Path.Combine(projDir, "artifacts", run);
         return Directory.Exists(runDir) ? runDir : null;
     }
 
@@ -449,6 +485,19 @@ private static void MapArtifactsEndpoint(WebApplication app)
         return Directory.EnumerateDirectories(parent, $"{id}__*").FirstOrDefault();
     }
 
+    /// <summary>
+    /// Returns true for file types the browser would render or execute if served inline.
+    /// These must be forced to <c>Content-Disposition: attachment</c> to prevent XSS
+    /// from LLM-generated content served within the user's origin.
+    /// </summary>
+    private static bool IsUnsafeInlineType(string ext) =>
+        ext.Equals(".html", StringComparison.OrdinalIgnoreCase) ||
+        ext.Equals(".htm", StringComparison.OrdinalIgnoreCase) ||
+        ext.Equals(".svg", StringComparison.OrdinalIgnoreCase) ||
+        ext.Equals(".js", StringComparison.OrdinalIgnoreCase) ||
+        ext.Equals(".mjs", StringComparison.OrdinalIgnoreCase) ||
+        ext.Equals(".cjs", StringComparison.OrdinalIgnoreCase);
+
     private static string SanitizeForFilename(string name)
     {
         var invalid = Path.GetInvalidFileNameChars();
diff --git a/src/Sovrant.Web/wwwroot/css/sovrant.css b/src/Sovrant.Web/wwwroot/css/sovrant.css
index c04b02b2..317d871b 100644
--- a/src/Sovrant.Web/wwwroot/css/sovrant.css
+++ b/src/Sovrant.Web/wwwroot/css/sovrant.css
@@ -34,6 +34,12 @@
     --tool-use-border: #D0D0E0;
     --input-bg: #FFFFFF;
     --input-border: #D0D0D0;
+    /* Explicitly themed (not silently inherited from the dark block) — see
+       Phase 126 note: fine as icon/dot fills on both surfaces, but never use
+       these as colored text on a light card (contrast drops well under 4.5:1). */
+    --status-pass: #4CAF50;
+    --status-warn: #FF9800;
+    --status-fail: #F44336;
 }
 
 /* ===== Reset ===== */
@@ -1260,6 +1266,14 @@ input, textarea, select { font-family: inherit; font-size: inherit; }
 /* Indent content below avatar row */
 .msg-indent { margin-left: 42px; }
 
+/* Phase 126 — thin divider between the answer and the (now-subordinate) work strip */
+.work-separator {
+    height: 1px;
+    margin: 10px 42px 10px 0;
+    background: var(--surface-border);
+    opacity: 0.6;
+}
+
 .message-text { white-space: pre-wrap; word-break: break-word; }
 .message-text.streaming { font-family: inherit; }
 
@@ -1385,24 +1399,6 @@ input, textarea, select { font-family: inherit; font-size: inherit; }
     margin-left: 4px;
 }
 
-/* ===== Execution status bar ===== */
-.execution-status {
-    display: flex;
-    align-items: center;
-    gap: 8px;
-    padding: 6px 10px;
-    margin: 4px 0;
-    border-radius: 6px;
-    background: var(--tool-use-bg);
-    border: 1px solid var(--brand-primary);
-    font-size: 12px;
-}
-
-.execution-status-text {
-    font-weight: 600;
-    color: var(--text-primary);
-}
-
 .intent-narration {
     font-size: 12px;
     font-style: italic;
@@ -1410,12 +1406,6 @@ input, textarea, select { font-family: inherit; font-size: inherit; }
     margin-bottom: 4px;
 }
 
-.action-summary {
-    font-size: 11px;
-    color: var(--text-muted);
-    margin-left: 8px;
-}
-
 .btn-copy-message {
     font-size: 10px;
     padding: 2px 8px;
@@ -1568,6 +1558,115 @@ input, textarea, select { font-family: inherit; font-size: inherit; }
     word-break: break-all;
 }
 
+/* ===== Work strip (Phase 126 — collapsed tool-use summary) ===== */
+.work-strip {
+    margin: 6px 0;
+}
+
+.work-strip-active {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    padding: 6px 10px;
+    border-radius: 6px;
+    background: var(--tool-use-bg);
+    border: 1px solid var(--brand-primary);
+    font-size: 12px;
+}
+
+.work-strip-status-text {
+    font-weight: 600;
+    color: var(--text-primary);
+}
+
+.work-strip-header {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    width: 100%;
+    padding: 6px 10px;
+    border-radius: 6px;
+    background: var(--tool-use-bg);
+    border: 1px solid var(--tool-use-border);
+    font-size: 12px;
+    color: var(--text-secondary);
+    text-align: left;
+}
+
+.work-strip-header:hover { border-color: var(--text-secondary); }
+.work-strip-header-error { border-color: var(--status-fail); }
+
+.work-strip-caret { font-size: 10px; color: var(--text-muted); }
+.work-strip-count { font-weight: 600; color: var(--text-primary); }
+.work-strip-dot { color: var(--text-muted); }
+.work-strip-groups { color: var(--text-secondary); }
+.work-strip-errcount { color: var(--text-secondary); }
+.work-strip-elapsed { color: var(--text-muted); margin-left: auto; }
+.work-strip-warn-icon { color: var(--status-fail); font-size: 12px; }
+
+.work-strip-list {
+    display: flex;
+    flex-direction: column;
+    margin-top: 4px;
+    border-radius: 6px;
+    border: 1px solid var(--tool-use-border);
+    overflow: hidden;
+}
+
+.work-strip-row {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    padding: 6px 10px;
+    background: var(--tool-use-bg);
+    border-top: 1px solid var(--tool-use-border);
+    font-size: 12px;
+    cursor: pointer;
+}
+.work-strip-row:first-child { border-top: none; }
+.work-strip-row:hover { background: var(--surface-hover); }
+.work-strip-row-active { background: var(--surface-hover); }
+/* Error state is signalled by the status dot fill (.status-dot-fail) and the
+   header ⚠ icon — never by coloring this row's text (Phase 126 contrast rule:
+   icon + fill only; --status-fail as text fails 4.5:1 on the light theme). */
+
+.work-strip-status-dot {
+    width: 7px;
+    height: 7px;
+    border-radius: 50%;
+    flex-shrink: 0;
+}
+.status-dot-pass { background: var(--status-pass); }
+.status-dot-warn { background: var(--status-warn); }
+.status-dot-fail { background: var(--status-fail); }
+
+.work-strip-row-name { font-weight: 600; color: var(--text-primary); white-space: nowrap; }
+.work-strip-row-preview {
+    color: var(--text-muted);
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    font-family: 'Consolas', monospace;
+    font-size: 11px;
+}
+
+.work-strip-detail {
+    padding: 8px 10px 10px 25px;
+    background: var(--tool-use-bg);
+    border-top: 1px solid var(--tool-use-border);
+}
+.work-strip-detail pre {
+    margin: 0;
+    padding: 8px;
+    background: var(--surface-card);
+    border-radius: 4px;
+    font-size: 11px;
+    max-height: 300px;
+    overflow: auto;
+    white-space: pre-wrap;
+    word-break: break-all;
+}
+
 /* ===== Document artifact card (Phase 66) ===== */
 .doc-artifact-list {
     display: flex;
diff --git a/tests/Sovrant.Runtime.Tests/Artifacts/LegacyArtifactImporterTests.cs b/tests/Sovrant.Runtime.Tests/Artifacts/LegacyArtifactImporterTests.cs
index 622116a2..f2ed63e9 100644
--- a/tests/Sovrant.Runtime.Tests/Artifacts/LegacyArtifactImporterTests.cs
+++ b/tests/Sovrant.Runtime.Tests/Artifacts/LegacyArtifactImporterTests.cs
@@ -54,10 +54,12 @@ public async Task ImportIfNeeded_MigratesLegacySlugDirs()
         Assert.Equal(1, count);
 
         // Verify files landed under workspace-scoped layout.
-        // Default project is workspace-level: {root}/{ws}/artifacts/{run}
+        // Projects-only: default project is a real project folder — {root}/{ws}/projects/default-project/artifacts/{run}
         var expectedDir = Path.Combine(
             _artifactsRoot,
             Sovrant.Runtime.Workspaces.WorkspaceIdentity.DefaultPersonal(),
+            "projects",
+            "default-project",
             "artifacts",
             "legacy-my-test-guide");
         Assert.True(Directory.Exists(expectedDir));
diff --git a/tests/Sovrant.Runtime.Tests/Artifacts/LocalArtifactStoreTests.cs b/tests/Sovrant.Runtime.Tests/Artifacts/LocalArtifactStoreTests.cs
index 7991723f..5d9c9362 100644
--- a/tests/Sovrant.Runtime.Tests/Artifacts/LocalArtifactStoreTests.cs
+++ b/tests/Sovrant.Runtime.Tests/Artifacts/LocalArtifactStoreTests.cs
@@ -282,8 +282,10 @@ public async Task FallbackScope_UsesDefaults_AndSucceeds()
 
         var handle = await _store.CreateRunScopeAsync(scope);
         Assert.Contains("ws-personal-", handle.Location, StringComparison.Ordinal);
-        // Default project resolves to workspace-level layout: {root}/{ws}/artifacts/{run}
+        // Projects-only layout: default project is a real project folder, not a bypass —
+        // {root}/{ws}/projects/default-project/artifacts/{run}
         Assert.Equal("default-project", handle.Scope.ProjectId);
+        Assert.Contains(Path.DirectorySeparatorChar + "projects" + Path.DirectorySeparatorChar, handle.Location, StringComparison.Ordinal);
         Assert.Contains(Path.DirectorySeparatorChar + "artifacts" + Path.DirectorySeparatorChar, handle.Location, StringComparison.Ordinal);
         // No user segment in the path
         Assert.DoesNotContain("default-user", handle.Location, StringComparison.Ordinal);
diff --git a/tests/Sovrant.Runtime.Tests/Storage/MigrationRunnerTests.cs b/tests/Sovrant.Runtime.Tests/Storage/MigrationRunnerTests.cs
index da1deb25..a2735739 100644
--- a/tests/Sovrant.Runtime.Tests/Storage/MigrationRunnerTests.cs
+++ b/tests/Sovrant.Runtime.Tests/Storage/MigrationRunnerTests.cs
@@ -25,7 +25,7 @@ public async ValueTask DisposeAsync()
     public async Task AllMigrations_RunSuccessfully()
     {
         await _provider.InitializeAsync();
-        Assert.Equal(43, _provider.SchemaVersion);
+        Assert.Equal(46, _provider.SchemaVersion);
     }
 
     [Fact]
@@ -33,7 +33,7 @@ public async Task Migrations_AreIdempotent()
     {
         await _provider.InitializeAsync();
         await _provider.InitializeAsync();
-        Assert.Equal(43, _provider.SchemaVersion);
+        Assert.Equal(46, _provider.SchemaVersion);
     }
 
     [Fact]
@@ -58,7 +58,7 @@ public async Task SchemaContains_ExpectedTables()
 
         // Verify tables exist by checking the DB file was created and schema version is correct.
         Assert.True(File.Exists(_dbPath));
-        Assert.Equal(43, _provider.SchemaVersion);
+        Assert.Equal(46, _provider.SchemaVersion);
     }
 
     [Fact]
@@ -246,7 +246,7 @@ public async Task ChecksumDrift_IsDetected_OnNextBoot()
     {
         // First boot: apply migrations normally.
         await _provider.InitializeAsync();
-        Assert.Equal(43, _provider.SchemaVersion);
+        Assert.Equal(46, _provider.SchemaVersion);
 
         var factory = (ISqliteConnectionFactory)_provider;
 
@@ -288,7 +288,7 @@ public async Task ChecksumDrift_NullStoredChecksum_IsTolerated()
         using var probe = factory.CreateConnection();
         var runner = new MigrationRunner(NullLogger<MigrationRunner>.Instance);
         var version = runner.RunPendingMigrations(probe);
-        Assert.Equal(43, version);
+        Assert.Equal(46, version);
     }
 
     private static string FindMigrationFile(string name)
diff --git a/tests/Sovrant.Runtime.Tests/Storage/OldDbUpgradeTests.cs b/tests/Sovrant.Runtime.Tests/Storage/OldDbUpgradeTests.cs
index ff3d8e2b..bfe99c10 100644
--- a/tests/Sovrant.Runtime.Tests/Storage/OldDbUpgradeTests.cs
+++ b/tests/Sovrant.Runtime.Tests/Storage/OldDbUpgradeTests.cs
@@ -52,7 +52,7 @@ public async Task UpgradeFromV005_PreservesSessionsAuditAndUsage()
         var provider = new SqliteStorageProvider(
             NullLogger<SqliteStorageProvider>.Instance, _dbPath);
         await provider.InitializeAsync();
-        Assert.Equal(43, provider.SchemaVersion);
+        Assert.Equal(46, provider.SchemaVersion);
 
         // ── Verify V005-era data survived ────────────────────────────────
         using var conn = ((ISqliteConnectionFactory)provider).CreateConnection();
@@ -136,7 +136,7 @@ public async Task UpgradeFromV005_WithBackupFlag_WritesBackupFile()
             var provider = new SqliteStorageProvider(
                 NullLogger<SqliteStorageProvider>.Instance, _dbPath);
             await provider.InitializeAsync();
-            Assert.Equal(43, provider.SchemaVersion);
+            Assert.Equal(46, provider.SchemaVersion);
             await provider.DisposeAsync();
         }
         finally
@@ -178,7 +178,7 @@ public async Task FreshInstall_WithBackupFlag_DoesNotWriteBackup()
             var provider = new SqliteStorageProvider(
                 NullLogger<SqliteStorageProvider>.Instance, _dbPath);
             await provider.InitializeAsync();
-            Assert.Equal(43, provider.SchemaVersion);
+            Assert.Equal(46, provider.SchemaVersion);
             await provider.DisposeAsync();
         }
         finally
@@ -207,9 +207,9 @@ public async Task UpgradeFromV005_SchemaVersionRowsStamped()
         while (r.Read())
             rows.Add((r.GetInt32(0), r.IsDBNull(1) ? null : r.GetString(1)));
 
-        // V001..V005 applied manually (no checksum), V006..V043 applied
+        // V001..V005 applied manually (no checksum), V006..V046 applied
         // by the real runner (with checksum).
-        Assert.Equal(43, rows.Count);
+        Assert.Equal(46, rows.Count);
         Assert.All(rows.Where(x => x.v <= 5), x => Assert.Null(x.c));
         Assert.All(rows.Where(x => x.v >= 6), x => Assert.False(string.IsNullOrEmpty(x.c)));
 
diff --git a/tests/Sovrant.Runtime.Tests/Storage/SqliteStorageProviderTests.cs b/tests/Sovrant.Runtime.Tests/Storage/SqliteStorageProviderTests.cs
index d3f88bd3..d16c9cff 100644
--- a/tests/Sovrant.Runtime.Tests/Storage/SqliteStorageProviderTests.cs
+++ b/tests/Sovrant.Runtime.Tests/Storage/SqliteStorageProviderTests.cs
@@ -35,8 +35,8 @@ public async Task InitializeAsync_SetsSchemaVersion()
     {
         await _provider.InitializeAsync();
 
-        // Schema head bumped to 43 by V043 (email as user_id).
-        Assert.Equal(43, _provider.SchemaVersion);
+        // Schema head bumped to 46 by V046 (seed CodeValidateTool guide).
+        Assert.Equal(46, _provider.SchemaVersion);
     }
 
     [Fact]
diff --git a/tests/Sovrant.Tools.Tests/Projects/CodeValidateToolTests.cs b/tests/Sovrant.Tools.Tests/Projects/CodeValidateToolTests.cs
new file mode 100644
index 00000000..8ab478fc
--- /dev/null
+++ b/tests/Sovrant.Tools.Tests/Projects/CodeValidateToolTests.cs
@@ -0,0 +1,334 @@
+using System.Text;
+using System.Text.Json;
+using Microsoft.Extensions.Logging.Abstractions;
+using Sovrant.Runtime.Artifacts;
+using Sovrant.Runtime.Projects.Templates;
+using Sovrant.Tools.Projects;
+using Sovrant.Tools.Projects.Scaffolds.DotNet;
+using Sovrant.Tools.Projects.Scaffolds.Go;
+using Sovrant.Tools.Projects.Scaffolds.Java;
+using Sovrant.Tools.Projects.Scaffolds.Minimal;
+using Sovrant.Tools.Projects.Scaffolds.Node;
+using Sovrant.Tools.Projects.Scaffolds.Python;
+using Sovrant.Tools.Projects.Scaffolds.Rust;
+
+namespace Sovrant.Tools.Tests.Projects;
+
+/// <summary>
+/// Phase 128E — Unit and integration tests for <see cref="CodeValidateTool"/>.
+/// Uses a real <see cref="LocalArtifactStore"/> in a temp directory.
+/// No compiler or toolchain required — purely structural file checks.
+/// </summary>
+public sealed class CodeValidateToolTests : IDisposable
+{
+    private readonly string _tempDir;
+    private readonly LocalArtifactStore _store;
+    private readonly CodeValidateTool _tool;
+
+    public CodeValidateToolTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), $"sovrant_validate_{Guid.NewGuid():N}");
+        _store = new LocalArtifactStore(NullLogger<LocalArtifactStore>.Instance, _tempDir);
+        _tool  = new CodeValidateTool(_store);
+    }
+
+    public void Dispose()
+    {
+        if (Directory.Exists(_tempDir))
+            Directory.Delete(_tempDir, recursive: true);
+    }
+
+    // ── Helpers ──────────────────────────────────────────────────────────
+
+    private async Task WriteFileAsync(ArtifactHandle handle, string path, string content = "x")
+    {
+        using var ms = new MemoryStream(Encoding.UTF8.GetBytes(content));
+        await _store.WriteAsync(handle, path, ms);
+    }
+
+    private static JsonElement BuildInput(string runId, string workspaceId = "test-ws") =>
+        JsonDocument.Parse($$"""{"run_id":"{{runId}}","workspace_id":"{{workspaceId}}"}""").RootElement;
+
+    private static ArtifactScope Scope(string runId) =>
+        new() { WorkspaceId = "test-ws", RunId = runId };
+
+    // ── Error cases ───────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task MissingRunId_ReturnsError()
+    {
+        var json = await _tool.ExecuteAsync(
+            JsonDocument.Parse("""{"workspace_id":"test-ws"}""").RootElement,
+            CancellationToken.None);
+
+        Assert.StartsWith("Error:", json, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task EmptyRun_ReturnsError()
+    {
+        // CreateRunScopeAsync creates the dir + blank manifest, but no files.
+        var json = await _tool.ExecuteAsync(BuildInput("empty-run-001"), CancellationToken.None);
+        Assert.StartsWith("Error:", json, StringComparison.Ordinal);
+    }
+
+    // ── No code manifest — universal gates only ───────────────────────────
+
+    [Fact]
+    public async Task NoCodeManifest_AllUniversalFilesPresent_Passes()
+    {
+        var handle = await _store.CreateRunScopeAsync(Scope("run-nometa-pass"));
+        await WriteFileAsync(handle, "proj/README.md");
+        await WriteFileAsync(handle, "proj/.gitignore");
+        await WriteFileAsync(handle, "proj/.github/workflows/ci.yml");
+
+        var result = JsonDocument.Parse(
+            await _tool.ExecuteAsync(BuildInput("run-nometa-pass"), CancellationToken.None))
+            .RootElement;
+
+        Assert.True(result.GetProperty("pass").GetBoolean());
+        Assert.Equal("unknown", result.GetProperty("language").GetString());
+        Assert.Equal(3, result.GetProperty("gates_total").GetInt32()); // 3 universal gates only
+        Assert.Equal(0, result.GetProperty("gates_failed").GetInt32());
+    }
+
+    [Fact]
+    public async Task NoCodeManifest_MissingUniversalFiles_Fails()
+    {
+        var handle = await _store.CreateRunScopeAsync(Scope("run-nometa-fail"));
+        await WriteFileAsync(handle, "proj/src/main.rs"); // has a file, so no empty-run error
+
+        var result = JsonDocument.Parse(
+            await _tool.ExecuteAsync(BuildInput("run-nometa-fail"), CancellationToken.None))
+            .RootElement;
+
+        Assert.False(result.GetProperty("pass").GetBoolean());
+        Assert.True(result.GetProperty("gates_failed").GetInt32() > 0);
+        Assert.NotEmpty(result.GetProperty("remediation").EnumerateArray());
+    }
+
+    // ── .NET gates ────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task DotNet_FullScaffold_PassesAllGates()
+    {
+        var handle = await _store.CreateRunScopeAsync(Scope("run-dotnet-pass"));
+        await _store.SetCodeMetadataAsync(handle, new CodeManifest { Language = "dotnet", Kind = "webapi" });
+
+        await WriteFileAsync(handle, "MyApp/MyApp.sln");
+        await WriteFileAsync(handle, "MyApp/Directory.Build.props");
+        await WriteFileAsync(handle, "MyApp/README.md");
+        await WriteFileAsync(handle, "MyApp/.gitignore");
+        await WriteFileAsync(handle, "MyApp/.github/workflows/ci.yml");
+
+        var result = JsonDocument.Parse(
+            await _tool.ExecuteAsync(BuildInput("run-dotnet-pass"), CancellationToken.None))
+            .RootElement;
+
+        Assert.True(result.GetProperty("pass").GetBoolean(), GetFailureMessage(result));
+        Assert.Equal("dotnet", result.GetProperty("language").GetString());
+        Assert.Equal(0, result.GetProperty("gates_failed").GetInt32());
+    }
+
+    [Fact]
+    public async Task DotNet_MissingSln_FailsCriticalGate()
+    {
+        var handle = await _store.CreateRunScopeAsync(Scope("run-dotnet-nosln"));
+        await _store.SetCodeMetadataAsync(handle, new CodeManifest { Language = "dotnet" });
+
+        await WriteFileAsync(handle, "MyApp/Directory.Build.props");
+        await WriteFileAsync(handle, "MyApp/README.md");
+        await WriteFileAsync(handle, "MyApp/.gitignore");
+        await WriteFileAsync(handle, "MyApp/.github/workflows/ci.yml");
+
+        var result = JsonDocument.Parse(
+            await _tool.ExecuteAsync(BuildInput("run-dotnet-nosln"), CancellationToken.None))
+            .RootElement;
+
+        Assert.False(result.GetProperty("pass").GetBoolean());
+        var failedNames = result.GetProperty("gates").EnumerateArray()
+            .Where(g => !g.GetProperty("passed").GetBoolean())
+            .Select(g => g.GetProperty("name").GetString())
+            .ToList();
+        Assert.Contains("dotnet-sln", failedNames);
+    }
+
+    [Fact]
+    public async Task DotNet_SlnxFileAlsoPassesSlnGate()
+    {
+        var handle = await _store.CreateRunScopeAsync(Scope("run-dotnet-slnx"));
+        await _store.SetCodeMetadataAsync(handle, new CodeManifest { Language = "dotnet" });
+
+        await WriteFileAsync(handle, "MyApp/MyApp.slnx"); // .slnx instead of .sln
+        await WriteFileAsync(handle, "MyApp/README.md");
+        await WriteFileAsync(handle, "MyApp/.gitignore");
+        await WriteFileAsync(handle, "MyApp/.github/workflows/ci.yml");
+
+        var result = JsonDocument.Parse(
+            await _tool.ExecuteAsync(BuildInput("run-dotnet-slnx"), CancellationToken.None))
+            .RootElement;
+
+        var slnGate = result.GetProperty("gates").EnumerateArray()
+            .First(g => g.GetProperty("name").GetString() == "dotnet-sln");
+        Assert.True(slnGate.GetProperty("passed").GetBoolean());
+    }
+
+    // ── Node gate ─────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task Node_WithPackageJson_PassesCriticalGate()
+    {
+        var handle = await _store.CreateRunScopeAsync(Scope("run-node-pass"));
+        await _store.SetCodeMetadataAsync(handle, new CodeManifest { Language = "node", Kind = "express-api" });
+
+        await WriteFileAsync(handle, "api/package.json");
+        await WriteFileAsync(handle, "api/README.md");
+        await WriteFileAsync(handle, "api/.gitignore");
+        await WriteFileAsync(handle, "api/.github/workflows/ci.yml");
+
+        var result = JsonDocument.Parse(
+            await _tool.ExecuteAsync(BuildInput("run-node-pass"), CancellationToken.None))
+            .RootElement;
+
+        Assert.True(result.GetProperty("pass").GetBoolean(), GetFailureMessage(result));
+    }
+
+    [Fact]
+    public async Task Node_MissingPackageJson_FailsCriticalGate()
+    {
+        var handle = await _store.CreateRunScopeAsync(Scope("run-node-nopkg"));
+        await _store.SetCodeMetadataAsync(handle, new CodeManifest { Language = "node" });
+        await WriteFileAsync(handle, "api/src/index.ts");
+
+        var result = JsonDocument.Parse(
+            await _tool.ExecuteAsync(BuildInput("run-node-nopkg"), CancellationToken.None))
+            .RootElement;
+
+        Assert.False(result.GetProperty("pass").GetBoolean());
+        var failedNames = result.GetProperty("gates").EnumerateArray()
+            .Where(g => !g.GetProperty("passed").GetBoolean())
+            .Select(g => g.GetProperty("name").GetString())
+            .ToList();
+        Assert.Contains("node-package-json", failedNames);
+    }
+
+    // ── Remediation ───────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task FailedCriticalGate_HasCriticalRemediationPrefix()
+    {
+        var handle = await _store.CreateRunScopeAsync(Scope("run-remediation"));
+        await _store.SetCodeMetadataAsync(handle, new CodeManifest { Language = "node" });
+        await WriteFileAsync(handle, "api/src/index.ts"); // no package.json
+
+        var result = JsonDocument.Parse(
+            await _tool.ExecuteAsync(BuildInput("run-remediation"), CancellationToken.None))
+            .RootElement;
+
+        var remediation = result.GetProperty("remediation").EnumerateArray()
+            .Select(r => r.GetString())
+            .ToList();
+
+        Assert.True(remediation.Any(r => r!.StartsWith("[CRITICAL]", StringComparison.Ordinal)),
+            "Expected at least one CRITICAL remediation step");
+    }
+
+    // ── Response shape ────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task Response_IncludesCommandsFromManifest()
+    {
+        var handle = await _store.CreateRunScopeAsync(Scope("run-commands"));
+        await _store.SetCodeMetadataAsync(handle, new CodeManifest
+        {
+            Language = "go",
+            Kind = "api",
+            BuildCommand = "go build ./...",
+            RunCommand = "go run main.go",
+            TestCommand = "go test ./...",
+        });
+        await WriteFileAsync(handle, "myapi/go.mod");
+        await WriteFileAsync(handle, "myapi/README.md");
+        await WriteFileAsync(handle, "myapi/.gitignore");
+        await WriteFileAsync(handle, "myapi/.github/workflows/ci.yml");
+
+        var result = JsonDocument.Parse(
+            await _tool.ExecuteAsync(BuildInput("run-commands"), CancellationToken.None))
+            .RootElement;
+
+        Assert.Equal("go build ./...", result.GetProperty("build_command").GetString());
+        Assert.Equal("go run main.go", result.GetProperty("run_command").GetString());
+        Assert.Equal("go test ./...", result.GetProperty("test_command").GetString());
+    }
+
+    // ── All 21 scaffold templates should pass ────────────────────────────
+
+    public static IEnumerable<object[]> AllTemplateData =>
+    [
+        [new NodeExpressApiScaffold()],
+        [new NodeCliScaffold()],
+        [new NodeLibraryScaffold()],
+        [new NodeNextJsScaffold()],
+        [new NodeMonorepoScaffold()],
+        [new DotNetWebApiScaffold()],
+        [new DotNetConsoleScaffold()],
+        [new DotNetLibraryScaffold()],
+        [new DotNetWorkerScaffold()],
+        [new DotNetBlazorScaffold()],
+        [new PythonFastApiScaffold()],
+        [new PythonScriptScaffold()],
+        [new GoApiScaffold()],
+        [new RustCliScaffold()],
+        [new JavaMavenAppScaffold()],
+        [new KotlinConsoleScaffold()],
+        [new RubyScriptScaffold()],
+        [new SwiftCliScaffold()],
+        [new LuaScriptScaffold()],
+        [new ZigCliScaffold()],
+        [new CppCmakeScaffold()],
+    ];
+
+    [Theory]
+    [MemberData(nameof(AllTemplateData))]
+    public async Task AllScaffolds_PassCodeValidation(IProjectTemplate template)
+    {
+        const string projectName = "test-project";
+        var runId = $"val-{template.Id.Replace('/', '-')}";
+
+        var handle = await _store.CreateRunScopeAsync(Scope(runId));
+
+        // Write all scaffold files under the project prefix (same layout as CodeCreateTool)
+        foreach (var file in template.Scaffold(new ScaffoldContext(projectName)))
+        {
+            using var ms = new MemoryStream(Encoding.UTF8.GetBytes(file.Content));
+            await _store.WriteAsync(handle, $"{projectName}/{file.RelativePath}", ms);
+        }
+
+        await _store.SetCodeMetadataAsync(handle, new CodeManifest
+        {
+            Language   = template.Language,
+            Kind       = template.Kind,
+            TemplateId = template.Id,
+        });
+
+        var result = JsonDocument.Parse(
+            await _tool.ExecuteAsync(BuildInput(runId), CancellationToken.None))
+            .RootElement;
+
+        Assert.True(result.GetProperty("pass").GetBoolean(),
+            $"[{template.Id}] validation failed. {GetFailureMessage(result)}");
+    }
+
+    // ── Helpers ──────────────────────────────────────────────────────────
+
+    private static string GetFailureMessage(JsonElement result)
+    {
+        var failed = result.GetProperty("gates").EnumerateArray()
+            .Where(g => !g.GetProperty("passed").GetBoolean())
+            .Select(g => $"{g.GetProperty("name").GetString()} [{g.GetProperty("severity").GetString()}]: {g.GetProperty("check").GetString()}")
+            .ToList();
+        return failed.Count > 0
+            ? $"Failed gates: {string.Join("; ", failed)}"
+            : string.Empty;
+    }
+}