diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index de9f01d..abc7f26 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -42,8 +42,6 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: pnpm
-          cache-dependency-path: site/pnpm-lock.yaml
 
       - name: Install pinned Rust and pnpm
         run: |
diff --git a/public/meta/agentctl-source.json b/public/meta/agentctl-source.json
index 0664c59..08c4601 100644
--- a/public/meta/agentctl-source.json
+++ b/public/meta/agentctl-source.json
@@ -2,7 +2,7 @@
   "product": "agentctl",
   "version": "0.2.0",
   "workflowApi": "agentctl.dev/v1alpha1",
-  "commit": "0ae1e381b87ea815f0d4ca66689db10bb1129e4a",
+  "commit": "a1ebcadcc2557136cb82633862c50854223981fa",
   "dirty": false,
   "sourceRepository": "https://github.com/opensourceops/agentctl",
   "importedFiles": 56
diff --git a/scripts/content-manifest.mjs b/scripts/content-manifest.mjs
index 1595578..b917ed4 100644
--- a/scripts/content-manifest.mjs
+++ b/scripts/content-manifest.mjs
@@ -1,9 +1,9 @@
 export const contentManifest = [
   ['docs/PRODUCT.md', '_generated/concepts/product.md', 'Product definition', 'What agentctl does, who it serves, and where its boundary ends.'],
   ['docs/DSL.md', '_generated/concepts/workflow-model.md', 'Workflow model', 'Strict YAML, tasks, templates, actions, agents, and validation.'],
-  ['docs/POLICIES.md', '_generated/concepts/policies.md', 'Policies and approvals', 'Keep authority outside the model with explicit grants and durable decisions.'],
+  ['docs/policies.md', '_generated/concepts/policies.md', 'Policies and approvals', 'Keep authority outside the model with explicit grants and durable decisions.'],
   ['docs/TOOLS.md', '_generated/concepts/tools.md', 'Tools and effects', 'Tool contracts, effect classes, idempotency, and deterministic checks.'],
-  ['docs/MEMORY.md', '_generated/concepts/memory.md', 'State and memory', 'Separate runtime state, working memory, long-term memory, and prompt cache.'],
+  ['docs/memory.md', '_generated/concepts/memory.md', 'State and memory', 'Separate runtime state, working memory, long-term memory, and prompt cache.'],
   ['docs/PACKS.md', '_generated/concepts/packs.md', 'Reusable packs', 'Use versioned local content with integrity verification.'],
   ['docs/guides/INSTALLATION.md', '_generated/getting-started/installation.md', 'Installation', 'Build or install the current v1alpha1 candidate from reviewed source.'],
   ['docs/guides/GETTING_STARTED.md', '_generated/getting-started/index.md', 'Getting started', 'Run and inspect a credential-free deterministic workflow.'],
diff --git a/scripts/sync-agentctl.mjs b/scripts/sync-agentctl.mjs
index 307a11b..c16b620 100644
--- a/scripts/sync-agentctl.mjs
+++ b/scripts/sync-agentctl.mjs
@@ -44,6 +44,20 @@ if (!agentctlRoot) {
   );
 }
 
+const trackedPaths = new Set(
+  execFileSync('git', ['ls-files'], {
+    cwd: agentctlRoot,
+    encoding: 'utf8',
+  })
+    .trim()
+    .split('\n'),
+);
+for (const [source] of contentManifest) {
+  if (!trackedPaths.has(source)) {
+    throw new Error(`Canonical source path must exactly match Git: ${source}`);
+  }
+}
+
 const sourceMap = new Map();
 for (const [source, target] of contentManifest) {
   const slug = target
diff --git a/src/content/docs/_generated/architecture/decisions/0001.md b/src/content/docs/_generated/architecture/decisions/0001.md
index fced5eb..4e2b753 100644
--- a/src/content/docs/_generated/architecture/decisions/0001.md
+++ b/src/content/docs/_generated/architecture/decisions/0001.md
@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 The graph, policy, state machine, persistence decisions, and recorded replay remain model-independent. Provider, tool, filesystem, process, MCP, A2A, internal-state mutation, clock, and ID behavior cross injected interfaces and receive durable effect identity when externally observable.
 
 This keeps models replaceable and tests credential-free. It requires more records and conservative uncertain states, but avoids hidden calls during replay. Dynamic model-owned orchestration is rejected.
-> Canonical source: [`docs/adr/0001-deterministic-core-explicit-effects.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0001-deterministic-core-explicit-effects.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/adr/0001-deterministic-core-explicit-effects.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0001-deterministic-core-explicit-effects.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/architecture/decisions/0002.md b/src/content/docs/_generated/architecture/decisions/0002.md
index a9be871..d9fd64c 100644
--- a/src/content/docs/_generated/architecture/decisions/0002.md
+++ b/src/content/docs/_generated/architecture/decisions/0002.md
@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 Workflows use `apiVersion`, `kind`, `metadata`, and `spec`. The envelope is adopted because identity/version and evolution need unambiguous locations, not because another system uses it. All typed objects deny unknown fields and a generated JSON Schema is checked in.
 
 A narrow legacy translator provides actionable migration. General aliases and silent coercion are rejected because they make security review and durable reproduction ambiguous.
-> Canonical source: [`docs/adr/0002-versioned-strict-workflow-envelope.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0002-versioned-strict-workflow-envelope.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/adr/0002-versioned-strict-workflow-envelope.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0002-versioned-strict-workflow-envelope.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/architecture/decisions/0003.md b/src/content/docs/_generated/architecture/decisions/0003.md
index f73d6e5..cf5ed5c 100644
--- a/src/content/docs/_generated/architecture/decisions/0003.md
+++ b/src/content/docs/_generated/architecture/decisions/0003.md
@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 One versioned SQLite database is the local correctness store. Transactional task transitions/checkpoints/audits and a request-before-start effect ledger support resume and no-effect replay. Confirmed results are reused; started unconfirmed work becomes uncertain.
 
 No exactly-once claim is made. Automatic retry of ambiguous external effects is rejected. Fork is the explicit operation for fresh effects. Distributed history services are outside this release.
-> Canonical source: [`docs/adr/0003-sqlite-history-and-conservative-recovery.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0003-sqlite-history-and-conservative-recovery.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/adr/0003-sqlite-history-and-conservative-recovery.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0003-sqlite-history-and-conservative-recovery.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/architecture/decisions/0004.md b/src/content/docs/_generated/architecture/decisions/0004.md
index 0ef97fc..c86fafc 100644
--- a/src/content/docs/_generated/architecture/decisions/0004.md
+++ b/src/content/docs/_generated/architecture/decisions/0004.md
@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 OpenAI Responses, Azure OpenAI Responses, Anthropic Messages, Google Gemini generateContent, and a scripted fake implement one provider-neutral internal interface. Capabilities are negotiated before execution; provider SDK/HTTP shapes never enter durable core state.
 
 “OpenAI-compatible” shims are rejected as a support claim because they hide native tool, continuation, reasoning, error, and usage differences. Every provider requires mock protocol coverage; live credentials are optional evidence only.
-> Canonical source: [`docs/adr/0004-native-provider-adapters.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0004-native-provider-adapters.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/adr/0004-native-provider-adapters.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0004-native-provider-adapters.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/architecture/decisions/0005.md b/src/content/docs/_generated/architecture/decisions/0005.md
index a4165db..4429514 100644
--- a/src/content/docs/_generated/architecture/decisions/0005.md
+++ b/src/content/docs/_generated/architecture/decisions/0005.md
@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 V1alpha1 schedules a sequential DAG in declaration order and integrates typed actions/tools, local packs, MCP 2025-11-25, and A2A 1.0. `maxConcurrency` greater than one is rejected.
 
 Parallel groups, loops, routing, sub-workflows, teams/handoffs, automatic reconnection/resubmission, executable plugin ABIs, and registries are deferred. Each needs deterministic merge, cancellation, policy, version, and recovery semantics before it can enter the stable contract.
-> Canonical source: [`docs/adr/0005-narrow-v1-scheduling-and-extensions.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0005-narrow-v1-scheduling-and-extensions.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/adr/0005-narrow-v1-scheduling-and-extensions.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0005-narrow-v1-scheduling-and-extensions.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/architecture/decisions/0006.md b/src/content/docs/_generated/architecture/decisions/0006.md
index 182bc17..a6656f2 100644
--- a/src/content/docs/_generated/architecture/decisions/0006.md
+++ b/src/content/docs/_generated/architecture/decisions/0006.md
@@ -16,4 +16,4 @@ Machine output is one `agentctl.dev/cli/v1` final envelope. Inputs come from JSO
 ## Consequences
 
 Cron, systemd, Kubernetes, and CI can use normal process semantics without hidden terminal waits. The product avoids an eventing/distributed-control-plane surface. A future schedule-run key may improve deduplication, but it cannot replace external overlap controls or effect idempotency.
-> Canonical source: [`docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/architecture/decisions/0007.md b/src/content/docs/_generated/architecture/decisions/0007.md
index fd9e4b2..dfb6163 100644
--- a/src/content/docs/_generated/architecture/decisions/0007.md
+++ b/src/content/docs/_generated/architecture/decisions/0007.md
@@ -14,4 +14,4 @@ The image entrypoint is `agentctl`. Callers supply ordinary CLI arguments and on
 ## Consequences
 
 No vendor-specific plugin API is required. Platforms without direct entrypoint/argument support can invoke `docker run` from their normal shell step. Distroless reduces runtime surface but deliberately has no shell; debugging uses the public CLI or a separate diagnostic image, not mutation of production images.
-> Canonical source: [`docs/adr/0007-generic-oci-step-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0007-generic-oci-step-contract.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/adr/0007-generic-oci-step-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0007-generic-oci-step-contract.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/architecture/diagrams.md b/src/content/docs/_generated/architecture/diagrams.md
index b716223..e264318 100644
--- a/src/content/docs/_generated/architecture/diagrams.md
+++ b/src/content/docs/_generated/architecture/diagrams.md
@@ -291,4 +291,4 @@ flowchart TD
 ```
 
 `agentctl-core` has no dependency on HTTP, SQLite, CLI parsing, or concrete executor types. `xtask` drives the built CLI for generation and acceptance.
-> Canonical source: [`docs/architecture/DIAGRAMS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/architecture/DIAGRAMS.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/architecture/DIAGRAMS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/architecture/DIAGRAMS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/architecture/index.md b/src/content/docs/_generated/architecture/index.md
index 713bdf9..b05dab7 100644
--- a/src/content/docs/_generated/architecture/index.md
+++ b/src/content/docs/_generated/architecture/index.md
@@ -37,4 +37,4 @@ The workspace uses Rust edition 2024, pins Rust 1.88 as the MSRV, forbids unsafe
 The OCI build is multi-stage: only the optimized Rust binary enters a maintained distroless runtime with CA roots and a non-root identity. `/config` is workflow configuration, `/workspace` is the read-only working tree, `/state` holds SQLite, and `/artifacts` receives declared outputs. State must be mounted again for inspect/resume/replay. The root filesystem may be read-only. See [Container contract](/agentctl/guides/container/) and ADR 0007.
 
 See the [architecture diagrams](/agentctl/architecture/diagrams/), [ADRs](https://github.com/opensourceops/agentctl/blob/main/docs/adr/), and [Durable execution](/agentctl/durable-execution/) for failure semantics.
-> Canonical source: [`docs/ARCHITECTURE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/ARCHITECTURE.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/ARCHITECTURE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/ARCHITECTURE.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/concepts/memory.md b/src/content/docs/_generated/concepts/memory.md
index 1541aa2..1e34d4b 100644
--- a/src/content/docs/_generated/concepts/memory.md
+++ b/src/content/docs/_generated/concepts/memory.md
@@ -1,7 +1,7 @@
 ---
 title: "State and memory"
 description: "Separate runtime state, working memory, long-term memory, and prompt cache."
-editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/MEMORY.md"
+editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/memory.md"
 ---
 Four mechanisms remain intentionally separate:
 
@@ -11,4 +11,4 @@ Four mechanisms remain intentionally separate:
 - Provider prompt cache is an optional performance optimization. Cache keys/options and usage counts are provider metadata, never correctness or memory.
 
 Long-term retrieval is exact namespace/key lookup in this release. Vector search and automatic promotion are not implemented. A workflow promotes a value explicitly by reading long-term memory and then writing working memory. Retention is applied by expiration/GC, not by replay.
-> Canonical source: [`docs/MEMORY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/MEMORY.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/memory.md`](https://github.com/opensourceops/agentctl/blob/main/docs/memory.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/concepts/packs.md b/src/content/docs/_generated/concepts/packs.md
index 7bb4a8d..701a022 100644
--- a/src/content/docs/_generated/concepts/packs.md
+++ b/src/content/docs/_generated/concepts/packs.md
@@ -8,4 +8,4 @@ A pack is reviewed reusable YAML content, not executable plugin code. Its manife
 `agentctl packs inspect` strictly parses the manifest, validates the API version, name, versions, and compatibility with the running binary. `agentctl packs verify` compares a `sha256:` integrity digest for a local manifest or archive. Workflow pack references carry name, version, local path, and integrity. The CLI verifies a referenced manifest, keeps it beneath the workflow directory, and loads actions, agents, and tools as `<pack-name>.<item-name>` before compilation.
 
 Dependency resolution, transitive lockfile generation, Git fetching, reusable sub-workflows, policy-default merging, a hosted registry, native dynamic libraries, and pack processes are not implemented. A checked-in pack reference is therefore an integrity/provenance contract for local content, not a package manager. Manifest policy defaults are inspectable metadata and never weaken the invoking workflow’s policy.
-> Canonical source: [`docs/PACKS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PACKS.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/PACKS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PACKS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/concepts/policies.md b/src/content/docs/_generated/concepts/policies.md
index fc53345..e73cc2f 100644
--- a/src/content/docs/_generated/concepts/policies.md
+++ b/src/content/docs/_generated/concepts/policies.md
@@ -1,7 +1,7 @@
 ---
 title: "Policies and approvals"
 description: "Keep authority outside the model with explicit grants and durable decisions."
-editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/POLICIES.md"
+editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/policies.md"
 ---
 Policy is evaluated by the runtime, never by a model. A policy defines a canonical workspace root, writable roots, allowed environment names, network host patterns, process basenames, providers, tool allow/deny lists, approval mode, and non-interactive behavior.
 
@@ -12,4 +12,4 @@ Tool visibility, tool/capability authorization, resource checks, effect risk, an
 An approval stores the run/trace/task/agent, tool, capability, risk, redacted input, expected effect, reason, and resolution actor/reason. The associated task waits durably. Use `approvals list`, `approve`, or `reject`, then `resume`. Resolution and effect status are auditable.
 
 Provider, MCP, A2A, filesystem, process, and environment allowlists are necessary controls, not a containment boundary. Run untrusted executors inside an external OS/container sandbox.
-> Canonical source: [`docs/POLICIES.md`](https://github.com/opensourceops/agentctl/blob/main/docs/POLICIES.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/policies.md`](https://github.com/opensourceops/agentctl/blob/main/docs/policies.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/concepts/product.md b/src/content/docs/_generated/concepts/product.md
index afb54e3..1f466a6 100644
--- a/src/content/docs/_generated/concepts/product.md
+++ b/src/content/docs/_generated/concepts/product.md
@@ -37,4 +37,4 @@ Version 0.2 is a production-oriented alpha with executable evidence for the stat
 This is not a chat-agent or multi-agent conversation framework: workflows, not conversations, own control flow. It is not CI/CD: it can run inside CI but does not manage runners or deployment environments. It borrows idempotence and check/diff vocabulary from Ansible without becoming configuration management. It borrows plan/effect separation from Terraform without owning infrastructure state. It is not a hosted orchestrator or general scripting language: one local process, SQLite, constrained templates, typed actions, and explicit remote effects are intentional boundaries.
 
 The differentiator is the combination of deterministic compilation, honest predictability, durable effect identity, recorded no-effect replay, native provider portability, and policy decisions made outside the model.
-> Canonical source: [`docs/PRODUCT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PRODUCT.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/PRODUCT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PRODUCT.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/concepts/tools.md b/src/content/docs/_generated/concepts/tools.md
index 5137f87..324f91d 100644
--- a/src/content/docs/_generated/concepts/tools.md
+++ b/src/content/docs/_generated/concepts/tools.md
@@ -12,4 +12,4 @@ Built-in model-callable tools are workspace read, workspace write, and echo. The
 Built-in actions are assign, assert, file read/write, direct process execution, run working-memory read/write, SQLite long-term-memory read/write, MCP call, and A2A delegation. File writes use a temporary file plus rename and return before/after/diff. Shell execution uses a direct executable and argv, never an implicit shell, clears inherited environment, applies allowlisted variables, and is not an OS sandbox.
 
 Check mode executes pure/internal simulation and observation needed for dataflow but never filesystem, process, remote, or model mutation. Results say fully predictable, partially predictable, or requires execution; unknown external work is never reported as predicted.
-> Canonical source: [`docs/TOOLS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/TOOLS.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/TOOLS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/TOOLS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/concepts/workflow-model.md b/src/content/docs/_generated/concepts/workflow-model.md
index 5998893..ca211e8 100644
--- a/src/content/docs/_generated/concepts/workflow-model.md
+++ b/src/content/docs/_generated/concepts/workflow-model.md
@@ -18,4 +18,4 @@ The compiler validates missing references, duplicate tasks, cycles, task-aware t
 The parser translates a limited unversioned `playbook:` document and emits a migration warning. Use `agentctl migrate old.yaml --write new.yaml`. Legacy pack-backed, MCP, A2A, provider-specific, and broad module configurations need manual migration; see [Migrating from TypeScript](/agentctl/reference/migration/).
 
 Not implemented in v1alpha1: `foreach`, matrix expansion, parallel groups, routers, loops, sub-workflows, `finally`, handlers, event triggers, or compensation execution. They remain excluded until their deterministic state, merge, and recovery semantics are specified.
-> Canonical source: [`docs/DSL.md`](https://github.com/opensourceops/agentctl/blob/main/docs/DSL.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/DSL.md`](https://github.com/opensourceops/agentctl/blob/main/docs/DSL.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/contributing/add-action.md b/src/content/docs/_generated/contributing/add-action.md
index 2dd346d..4a8e01f 100644
--- a/src/content/docs/_generated/contributing/add-action.md
+++ b/src/content/docs/_generated/contributing/add-action.md
@@ -42,4 +42,4 @@ cargo xtask generate
 cargo xtask docs-verify
 cargo xtask verify
 ```
-> Canonical source: [`docs/development/ADD_ACTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_ACTION.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/development/ADD_ACTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_ACTION.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/contributing/add-migration.md b/src/content/docs/_generated/contributing/add-migration.md
index 1b24868..b3de881 100644
--- a/src/content/docs/_generated/contributing/add-migration.md
+++ b/src/content/docs/_generated/contributing/add-migration.md
@@ -24,4 +24,4 @@ Create the previous schema in a temporary database, insert representative durabl
 ## 5. Document operator impact
 
 Update the database reference, compatibility policy, release notes or status evidence, and backup guidance. Explain whether downgrade remains possible. Run the complete store tests and `cargo xtask verify`.
-> Canonical source: [`docs/development/ADD_MIGRATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_MIGRATION.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/development/ADD_MIGRATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_MIGRATION.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/contributing/add-provider.md b/src/content/docs/_generated/contributing/add-provider.md
index daaf9ae..b085de3 100644
--- a/src/content/docs/_generated/contributing/add-provider.md
+++ b/src/content/docs/_generated/contributing/add-provider.md
@@ -36,4 +36,4 @@ Add local mock-protocol tests for request mapping, authentication, headers, redi
 ## Documentation claims
 
 Update the provider guide and matrix with the exact level: implemented, mock-protocol tested, retained live evidence, or deferred. Add an example that passes `check` without resolving a secret. Run `cargo xtask generate`, `cargo xtask docs-verify`, and `cargo xtask verify`.
-> Canonical source: [`docs/development/ADD_PROVIDER.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_PROVIDER.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/development/ADD_PROVIDER.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_PROVIDER.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/contributing/developer-guide.md b/src/content/docs/_generated/contributing/developer-guide.md
index dc2a80e..d9bfe8a 100644
--- a/src/content/docs/_generated/contributing/developer-guide.md
+++ b/src/content/docs/_generated/contributing/developer-guide.md
@@ -64,4 +64,4 @@ Provider adapters implement the neutral model contract and publish typed capabil
 Run `cargo xtask generate` whenever CLI help or the DSL changes. Run `cargo xtask docs-verify` for public content and examples. Update the Pages site's content manifest when adding a new canonical public page. Release decisions depend on hosted evidence for the exact candidate commit; local success alone does not approve an RC.
 
 Related guides: [Add an action](/agentctl/contributing/add-action/), [Add a provider](/agentctl/contributing/add-provider/), [Add a store migration](/agentctl/contributing/add-migration/), [Write documentation](/agentctl/contributing/documentation/), [Testing](/agentctl/contributing/testing/), and [Release process](/agentctl/contributing/release/).
-> Canonical source: [`docs/development/REPOSITORY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/REPOSITORY.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/development/REPOSITORY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/REPOSITORY.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/contributing/documentation.md b/src/content/docs/_generated/contributing/documentation.md
index 0a31ac7..50f9327 100644
--- a/src/content/docs/_generated/contributing/documentation.md
+++ b/src/content/docs/_generated/contributing/documentation.md
@@ -42,4 +42,4 @@ The site command imports canonical content, records the source commit, validates
 ## Review
 
 Review technical claims against source, generated help, schema, tests, and evidence. Check keyboard navigation, heading order, link purpose, alt text, diagram explanations, mobile code blocks, and direct deep links. Do not claim accessibility certification from automated tooling alone.
-> Canonical source: [`docs/development/DOCUMENTATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/DOCUMENTATION.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/development/DOCUMENTATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/DOCUMENTATION.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/contributing/index.md b/src/content/docs/_generated/contributing/index.md
index 4729c58..7cb28d0 100644
--- a/src/content/docs/_generated/contributing/index.md
+++ b/src/content/docs/_generated/contributing/index.md
@@ -80,4 +80,4 @@ Reviewers focus on correctness, deterministic behavior, explicit effects, safe f
 ## Release process
 
 Maintainers follow [Release process](/agentctl/contributing/release/). Candidate promotion requires the exact remote commit to pass required hosted checks and artifact verification. Contributors must not create tags, publish packages, or describe a local build as released.
-> Canonical source: [`docs/CONTRIBUTING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/CONTRIBUTING.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/CONTRIBUTING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/CONTRIBUTING.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/contributing/release.md b/src/content/docs/_generated/contributing/release.md
index b578d5c..f760b1a 100644
--- a/src/content/docs/_generated/contributing/release.md
+++ b/src/content/docs/_generated/contributing/release.md
@@ -69,4 +69,4 @@ For the candidate workflow run:
 ## Release decision
 
 The local recommendation is **Ready for hosted RC validation**. Promote to an RC only after the exact remote commit has all required hosted checks and artifacts. Stable `v1.0` remains outside this `v1alpha1` gate.
-> Canonical source: [`docs/RELEASE_PROCESS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/RELEASE_PROCESS.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/RELEASE_PROCESS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/RELEASE_PROCESS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/contributing/testing.md b/src/content/docs/_generated/contributing/testing.md
index b055ad6..9347afc 100644
--- a/src/content/docs/_generated/contributing/testing.md
+++ b/src/content/docs/_generated/contributing/testing.md
@@ -33,4 +33,4 @@ cargo fuzz run workflow_yaml -- -max_total_time=60
 The local hosted-CI configuration runs the canonical suite, credential-free acceptance, and packaging on Rust 1.88 for Linux x64, macOS arm64, and Windows x64. Separate automatic jobs cover the Linux x64 container, current vulnerability scan, two CycloneDX SBOM artifacts, complete-history/tree secret scans, dependency policy, and workflow lint. The workflows are locally linted but have not been pushed or dispatched, so this is configured evidence rather than validated hosted-platform support. Provider/protocol conformance uses local mock HTTP servers. Normal examples are deterministic; MCP/A2A runtime behavior is covered by mocks rather than requiring a background service.
 
 The only full live gate is the separately invoked OpenAI acceptance described in [Providers](/agentctl/providers/). It performs two bounded Responses API requests locally and two in the OCI image for one tool-call/continuation journey each, then performs keyless replays. Never run it for debugging loops, fuzzing, load, or normal CI.
-> Canonical source: [`docs/TESTING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/TESTING.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/TESTING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/TESTING.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/durable-execution/index.md b/src/content/docs/_generated/durable-execution/index.md
index 0b61df2..db0a377 100644
--- a/src/content/docs/_generated/durable-execution/index.md
+++ b/src/content/docs/_generated/durable-execution/index.md
@@ -21,4 +21,4 @@ Working-memory replacement, the task transition, checkpoint, and audit event com
 Cancellation is both an injected token and a durable run flag. CLI SIGINT and SIGTERM cancel in-flight async calls and return exit `130`; `agentctl cancel` records a request for another process to observe. An overall CLI deadline can be set with `--timeout-seconds`, in addition to task/tool/provider/protocol bounds. A provider, tool, process, MCP, or A2A timeout/cancellation/transport loss after dispatch marks the effect `uncertain`; resume refuses to guess and requires reconciliation or an explicit fork.
 
 Clock and ID generation are injected; test providers/tools/protocol handlers are injected. The current scheduler is sequential, so output and memory commit order is task declaration order.
-> Canonical source: [`docs/DURABLE_EXECUTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/DURABLE_EXECUTION.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/DURABLE_EXECUTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/DURABLE_EXECUTION.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/examples/approval-gated.md b/src/content/docs/_generated/examples/approval-gated.md
index 58dcd5c..a9b9cfe 100644
--- a/src/content/docs/_generated/examples/approval-gated.md
+++ b/src/content/docs/_generated/examples/approval-gated.md
@@ -58,4 +58,4 @@ The approval includes redacted input, tool or action, capability, risk, expected
 ## Current limitation
 
 The CLI stores operator-provided identity text but does not provide a hosted identity or role system. The invoking platform must authenticate and authorize the operator.
-> Canonical source: [`docs/use-cases/APPROVAL_GATED_ACTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/APPROVAL_GATED_ACTION.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/use-cases/APPROVAL_GATED_ACTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/APPROVAL_GATED_ACTION.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/examples/ci-quality-gate.md b/src/content/docs/_generated/examples/ci-quality-gate.md
index 9d96896..4fbd642 100644
--- a/src/content/docs/_generated/examples/ci-quality-gate.md
+++ b/src/content/docs/_generated/examples/ci-quality-gate.md
@@ -62,4 +62,4 @@ Use ordinary typed inputs for non-secret gate evidence. Inject provider secrets
 ## Current limitation
 
 This workflow does not run tests itself. A surrounding pipeline can supply results, or a reviewed `builtin.shell.exec` action can run a specifically allowed executable.
-> Canonical source: [`docs/use-cases/CI_QUALITY_GATE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/CI_QUALITY_GATE.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/use-cases/CI_QUALITY_GATE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/CI_QUALITY_GATE.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/examples/provider-portability.md b/src/content/docs/_generated/examples/provider-portability.md
index 04997ef..b29a77e 100644
--- a/src/content/docs/_generated/examples/provider-portability.md
+++ b/src/content/docs/_generated/examples/provider-portability.md
@@ -112,4 +112,4 @@ Both workflows share the provider-neutral agent shape. Each provider still needs
 ## Current limitation
 
 Provider portability does not mean identical behavior or equal maturity. Fake is deterministic, OpenAI has retained bounded live evidence, and Azure OpenAI, Anthropic, and Google are mock-protocol tested only in this release.
-> Canonical source: [`docs/use-cases/PROVIDER_PORTABILITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/PROVIDER_PORTABILITY.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/use-cases/PROVIDER_PORTABILITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/PROVIDER_PORTABILITY.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/examples/recorded-replay.md b/src/content/docs/_generated/examples/recorded-replay.md
index d4617b6..6cac687 100644
--- a/src/content/docs/_generated/examples/recorded-replay.md
+++ b/src/content/docs/_generated/examples/recorded-replay.md
@@ -60,4 +60,4 @@ Replay needs only the database, but the stored record may contain confidential i
 ## Current limitation
 
 Replay is not a new validation, retry, or exactly-once guarantee. It rejects non-terminal source runs. Use resume for safe continuation and fork only when fresh effects are intentional.
-> Canonical source: [`docs/use-cases/RECORDED_REPLAY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/RECORDED_REPLAY.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/use-cases/RECORDED_REPLAY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/RECORDED_REPLAY.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/examples/release-readiness.md b/src/content/docs/_generated/examples/release-readiness.md
index f459938..b4168b2 100644
--- a/src/content/docs/_generated/examples/release-readiness.md
+++ b/src/content/docs/_generated/examples/release-readiness.md
@@ -81,4 +81,4 @@ The database records which gate failed and whether the analysis task started. A
 ## Current limitation
 
 The example uses the fake provider. It demonstrates graph and policy behavior, not a live model quality claim or a release approval system.
-> Canonical source: [`docs/use-cases/RELEASE_READINESS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/RELEASE_READINESS.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/use-cases/RELEASE_READINESS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/RELEASE_READINESS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/examples/repository-audit.md b/src/content/docs/_generated/examples/repository-audit.md
index ea81ab6..d651cf1 100644
--- a/src/content/docs/_generated/examples/repository-audit.md
+++ b/src/content/docs/_generated/examples/repository-audit.md
@@ -121,4 +121,4 @@ The database records the provider session, strict tool call, read effect, assert
 ## Current limitation
 
 The checked journey proves orchestration and tool boundaries, not the quality of a live model's repository analysis. Production workflows need task-specific verification stronger than a fixed marker.
-> Canonical source: [`docs/use-cases/REPOSITORY_AUDIT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/REPOSITORY_AUDIT.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/use-cases/REPOSITORY_AUDIT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/REPOSITORY_AUDIT.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/examples/scheduled-review.md b/src/content/docs/_generated/examples/scheduled-review.md
index d15578d..a1f83cb 100644
--- a/src/content/docs/_generated/examples/scheduled-review.md
+++ b/src/content/docs/_generated/examples/scheduled-review.md
@@ -71,4 +71,4 @@ Persist the database and artifact directory with restrictive permissions. Config
 ## Current limitation
 
 `agentctl` is a schedulable runtime, not a scheduling service. It does not provide clocks, calendars, distributed leases, or log rotation.
-> Canonical source: [`docs/use-cases/SCHEDULED_REVIEW.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/SCHEDULED_REVIEW.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/use-cases/SCHEDULED_REVIEW.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/SCHEDULED_REVIEW.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/getting-started/first-agent.md b/src/content/docs/_generated/getting-started/first-agent.md
index 8ee4cd7..9bce96d 100644
--- a/src/content/docs/_generated/getting-started/first-agent.md
+++ b/src/content/docs/_generated/getting-started/first-agent.md
@@ -84,4 +84,4 @@ The live command makes a paid network request to `api.openai.com` and writes pro
 ## Next step
 
 Read [Workflow authoring](/agentctl/guides/workflow-authoring/) to replace the scripted journey with your own reviewed workflow.
-> Canonical source: [`docs/guides/FIRST_AGENT_WORKFLOW.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/FIRST_AGENT_WORKFLOW.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/guides/FIRST_AGENT_WORKFLOW.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/FIRST_AGENT_WORKFLOW.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/getting-started/index.md b/src/content/docs/_generated/getting-started/index.md
index 79e6a3e..b3751e1 100644
--- a/src/content/docs/_generated/getting-started/index.md
+++ b/src/content/docs/_generated/getting-started/index.md
@@ -87,4 +87,4 @@ If a command fails, read [Troubleshooting](/agentctl/troubleshooting/).
 ## Next step
 
 Run [your first bounded agent workflow](/agentctl/getting-started/first-agent/) without a paid API key.
-> Canonical source: [`docs/guides/GETTING_STARTED.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/GETTING_STARTED.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/guides/GETTING_STARTED.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/GETTING_STARTED.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/getting-started/installation.md b/src/content/docs/_generated/getting-started/installation.md
index 2ee2f9e..3b48391 100644
--- a/src/content/docs/_generated/getting-started/installation.md
+++ b/src/content/docs/_generated/getting-started/installation.md
@@ -72,4 +72,4 @@ The workflow API is `agentctl.dev/v1alpha1`. Pin the CLI or image version, read
 ## Next step
 
 Continue with [Getting started](/agentctl/getting-started/).
-> Canonical source: [`docs/guides/INSTALLATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/INSTALLATION.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/guides/INSTALLATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/INSTALLATION.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/guides/ci-cd.md b/src/content/docs/_generated/guides/ci-cd.md
index c9d6f89..4024fb7 100644
--- a/src/content/docs/_generated/guides/ci-cd.md
+++ b/src/content/docs/_generated/guides/ci-cd.md
@@ -67,4 +67,4 @@ Do not set a pipeline retry policy that blindly repeats exit `5`, `6`, or `130`.
 - Treat remote content and model output as untrusted.
 - Retain state for approval or recovery, then delete it under policy.
 - Set the external platform's overlap and timeout controls.
-> Canonical source: [`docs/guides/CI_CD.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/CI_CD.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/guides/CI_CD.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/CI_CD.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/guides/container.md b/src/content/docs/_generated/guides/container.md
index ee044e3..7f3e6c2 100644
--- a/src/content/docs/_generated/guides/container.md
+++ b/src/content/docs/_generated/guides/container.md
@@ -266,4 +266,4 @@ For a one-time invocation, use the same Pod template in a `batch/v1` `Job` and o
 ## Validation level
 
 The current native-arm image was built through the optional secret-mounted CA path and executed with Podman as non-root with a read-only root. The suite exercised a mock tool workflow, artifact and durable inspection, missing-secret and invalid-workflow exit propagation, SIGTERM, and recorded replay under `--network none`. Checksum-verified Trivy 0.72.0 found zero fixed HIGH/CRITICAL findings and generated valid CycloneDX JSON. The exact retained GPT-5.6 live database had previously replayed with no credential and no network, identical output and artifact digest, zero fresh effects/tool calls/provider sessions, and explicit source-effect audit links. GitHub, GitLab, Jenkins, Harness, and Kubernetes examples remain documentation-reviewed only; the automatic Ubuntu Linux x64 build, scan, and SBOM job is locally linted but has not been dispatched.
-> Canonical source: [`docs/CONTAINER.md`](https://github.com/opensourceops/agentctl/blob/main/docs/CONTAINER.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/CONTAINER.md`](https://github.com/opensourceops/agentctl/blob/main/docs/CONTAINER.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/guides/local-operation.md b/src/content/docs/_generated/guides/local-operation.md
index 3dc52b7..618ad22 100644
--- a/src/content/docs/_generated/guides/local-operation.md
+++ b/src/content/docs/_generated/guides/local-operation.md
@@ -70,4 +70,4 @@ agentctl gc --db .agentctl/runtime.db --older-than-days 30 --output json --color
 ```
 
 Garbage collection deletes eligible terminal history and expired long-term memory. Back up before deletion when the history is audit evidence.
-> Canonical source: [`docs/guides/LOCAL_OPERATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/LOCAL_OPERATION.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/guides/LOCAL_OPERATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/LOCAL_OPERATION.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/guides/workflow-authoring.md b/src/content/docs/_generated/guides/workflow-authoring.md
index ea3aa35..e56d82b 100644
--- a/src/content/docs/_generated/guides/workflow-authoring.md
+++ b/src/content/docs/_generated/guides/workflow-authoring.md
@@ -124,4 +124,4 @@ agentctl run workflow.yaml --check --diff --db .agentctl/preview.db
 ```
 
 The preview may write run history to its database, but it does not perform filesystem, process, remote, or model mutation. Read [Workflow DSL](/agentctl/concepts/workflow-model/) and the [YAML reference](/agentctl/reference/yaml/) for the complete contract.
-> Canonical source: [`docs/guides/WORKFLOW_AUTHORING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/WORKFLOW_AUTHORING.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/guides/WORKFLOW_AUTHORING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/WORKFLOW_AUTHORING.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/observability/index.md b/src/content/docs/_generated/observability/index.md
index 85fbd65..2331b5c 100644
--- a/src/content/docs/_generated/observability/index.md
+++ b/src/content/docs/_generated/observability/index.md
@@ -47,4 +47,4 @@ Sensitive field names and registered secret values are redacted before trace att
 Keep provider credentials in environment references, never workflow inputs or command arguments. Apply access control and retention to the database, collected artifacts, CI logs, and trace backend. Before sharing diagnostics, remove credentials, prompt content, file content, remote payloads, and identifying metadata; a run ID alone is sufficient for local correlation.
 
 See [CLI output and exit codes](/agentctl/reference/output/), [local operation](/agentctl/guides/local-operation/), and [runtime database and migrations](/agentctl/reference/database/) for the complete operating contract.
-> Canonical source: [`docs/OBSERVABILITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/OBSERVABILITY.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/OBSERVABILITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/OBSERVABILITY.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/operations/scheduled.md b/src/content/docs/_generated/operations/scheduled.md
index 6005a9a..0e0c604 100644
--- a/src/content/docs/_generated/operations/scheduled.md
+++ b/src/content/docs/_generated/operations/scheduled.md
@@ -67,4 +67,4 @@ A oneshot service has one active invocation at a time. Use distinct databases on
 6. For an uncertain effect, reconcile the remote system first. The runtime intentionally refuses unsafe resume.
 
 Use `agentctl gc --db PATH --older-than-days N` for expired memory and old terminal histories after the organization's retention/backup requirements are satisfied. SQLite WAL files belong with the database during backup. A future schedule-run key may improve deduplication; today the external scheduler owns overlap prevention.
-> Canonical source: [`docs/OPERATIONS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/OPERATIONS.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/OPERATIONS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/OPERATIONS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/providers/a2a.md b/src/content/docs/_generated/providers/a2a.md
index a1d8077..cd3adc0 100644
--- a/src/content/docs/_generated/providers/a2a.md
+++ b/src/content/docs/_generated/providers/a2a.md
@@ -8,4 +8,4 @@ The client pins [A2A `1.0`](https://a2a-protocol.org/latest/specification/) and
 Card and RPC authentication headers are environment secret references. The card URL is subject to network policy, redirects are disabled, and the selected JSON-RPC interface must have the same scheme, host, and effective port as that reviewed card URL. Cards, skills, messages, parts, and artifacts are untrusted data. An A2A delegation is a `remote_agent` effect and may require approval.
 
 Polling is bounded; request and overall operation timeouts and cancellation are enforced. The client does not claim delivery exactly once or transparently resubmit after an ambiguous response. Mock peers cover discovery, SendMessage/GetTask, artifacts, streaming parsing, cancellation mapping, protocol mismatch, failure, and timeout at the declared maturity.
-> Canonical source: [`docs/A2A.md`](https://github.com/opensourceops/agentctl/blob/main/docs/A2A.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/A2A.md`](https://github.com/opensourceops/agentctl/blob/main/docs/A2A.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/providers/index.md b/src/content/docs/_generated/providers/index.md
index 606b799..f23c05b 100644
--- a/src/content/docs/_generated/providers/index.md
+++ b/src/content/docs/_generated/providers/index.md
@@ -30,4 +30,4 @@ Endpoints must pass the workflow network allowlist. Redirects are disabled. Cred
 OpenAI provider options are an allowlisted map (`store`, `reasoningContext`, `promptCacheMode`, `promptCacheTtl`, `parallelToolCalls`, and `safetyIdentifier`). Unknown options or invalid values fail compilation. Tool-using OpenAI and Azure OpenAI agents may not set `store: false`: stateless continuation would require replaying returned response/reasoning/function items, which this release does not implement. One-turn agents without tools may disable storage. Programmatic tool calling and model streaming are explicitly unsupported in the workflow runtime and fail rather than being ignored. Parallel function calls are parsed and correlated, but executors run them serially in response order because v1 scheduling is sequential.
 
 Cost is not inferred when a provider returns no reliable cost metadata. A workflow requesting `maxCostUsd` therefore fails capability negotiation; input/output token limits are enforced from native usage. Retry is limited to explicit task bounds and definitive retryable HTTP responses. Timeout, cancellation, or a transport loss after dispatch is considered ambiguous and is not automatically reissued.
-> Canonical source: [`docs/PROVIDERS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PROVIDERS.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/PROVIDERS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PROVIDERS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/providers/mcp.md b/src/content/docs/_generated/providers/mcp.md
index bff64d6..6376b88 100644
--- a/src/content/docs/_generated/providers/mcp.md
+++ b/src/content/docs/_generated/providers/mcp.md
@@ -8,4 +8,4 @@ The client pins the stable MCP protocol version `2025-11-25` from the [official
 Authentication headers are environment secret references. The endpoint must pass network policy. Redirects are disabled and an `Origin` header is sent. Remote descriptions, schemas, content, and annotations are untrusted; annotations are exposed only as metadata and never authorize an effect.
 
 The client initializes lazily and does not automatically reconnect after session expiry because repeating a remote operation could be unsafe. The caller must reconcile and resume or fork. Streaming transport is parsed, but tool results are delivered to the runtime only when complete. Deterministic local mock-server tests cover negotiation, sessions, listing/call, structured results, version mismatch, and timeout.
-> Canonical source: [`docs/MCP.md`](https://github.com/opensourceops/agentctl/blob/main/docs/MCP.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/MCP.md`](https://github.com/opensourceops/agentctl/blob/main/docs/MCP.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/reference/capabilities.md b/src/content/docs/_generated/reference/capabilities.md
index b5d0dc2..474be1a 100644
--- a/src/content/docs/_generated/reference/capabilities.md
+++ b/src/content/docs/_generated/reference/capabilities.md
@@ -40,4 +40,4 @@ The compiler verifies that a built-in tool declaration matches its executor sema
 | `a2a.delegate` | remote agent | recorded result, no fresh delegation in replay |
 
 See [Providers](/agentctl/providers/), [Tools](/agentctl/concepts/tools/), and [Durable execution](/agentctl/durable-execution/).
-> Canonical source: [`docs/reference/MATRICES.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/MATRICES.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/reference/MATRICES.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/MATRICES.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/reference/cli.md b/src/content/docs/_generated/reference/cli.md
index 2a5d031..0e78b58 100644
--- a/src/content/docs/_generated/reference/cli.md
+++ b/src/content/docs/_generated/reference/cli.md
@@ -482,4 +482,4 @@ Options:
       --verbose
   -h, --help             Print help
 ```
-> Canonical source: [`docs/generated/CLI.md`](https://github.com/opensourceops/agentctl/blob/main/docs/generated/CLI.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/generated/CLI.md`](https://github.com/opensourceops/agentctl/blob/main/docs/generated/CLI.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/reference/compatibility.md b/src/content/docs/_generated/reference/compatibility.md
index 9532aae..883c326 100644
--- a/src/content/docs/_generated/reference/compatibility.md
+++ b/src/content/docs/_generated/reference/compatibility.md
@@ -24,4 +24,4 @@ Legacy workflows depending on packs, broad built-in tool profiles, remote MCP/A2
 ## Deferred product decisions
 
 Parallel execution, foreach/matrix, loops, routers, sub-workflows, teams/handoffs, compensation execution, a public pack registry/resolver, vector memory, automatic MCP reconnection, general A2A resubmission, and streamed model output are not compatibility promises for v1alpha1.
-> Canonical source: [`docs/COMPATIBILITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/COMPATIBILITY.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/COMPATIBILITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/COMPATIBILITY.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/reference/database.md b/src/content/docs/_generated/reference/database.md
index fa794b1..b636545 100644
--- a/src/content/docs/_generated/reference/database.md
+++ b/src/content/docs/_generated/reference/database.md
@@ -42,4 +42,4 @@ Delete old terminal history only after retention requirements are met:
 ```text
 agentctl gc --db .agentctl/runtime.db --older-than-days 30 --output json --color never
 ```
-> Canonical source: [`docs/reference/DATABASE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/DATABASE.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/reference/DATABASE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/DATABASE.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/reference/environment.md b/src/content/docs/_generated/reference/environment.md
index c6ca20c..ba34e5a 100644
--- a/src/content/docs/_generated/reference/environment.md
+++ b/src/content/docs/_generated/reference/environment.md
@@ -45,4 +45,4 @@ Normal `cargo xtask docs-verify`, `cargo xtask verify`, and `cargo xtask accepta
 | `/tmp` | small runtime tmpfs when the root filesystem is read-only |
 
 State and artifacts must be writable by UID/GID 65532 in the production image.
-> Canonical source: [`docs/reference/ENVIRONMENT_AND_PATHS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/ENVIRONMENT_AND_PATHS.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/reference/ENVIRONMENT_AND_PATHS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/ENVIRONMENT_AND_PATHS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/reference/limitations.md b/src/content/docs/_generated/reference/limitations.md
index c0265c5..a05c9d9 100644
--- a/src/content/docs/_generated/reference/limitations.md
+++ b/src/content/docs/_generated/reference/limitations.md
@@ -51,4 +51,4 @@ These are useful extensions but are not required by the product thesis. They nee
 - Anthropic, Google, Azure OpenAI, MCP, and A2A are native and mock-tested in this release, not live-tested. Only the OpenAI GPT-5.6 tool path has live end-to-end evidence.
 - The current local OCI runtime, vulnerability-scan, and SBOM evidence is Linux arm64. Linux x64 is configured in the unpushed Ubuntu workflow but has not executed.
 - GitHub runner availability, organization action policy, branch protection, and required-check configuration are repository-owner operations and cannot be proven by repository-local lint.
-> Canonical source: [`docs/LIMITATIONS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/LIMITATIONS.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/LIMITATIONS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/LIMITATIONS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/reference/migration.md b/src/content/docs/_generated/reference/migration.md
index 16c5f90..0415d8d 100644
--- a/src/content/docs/_generated/reference/migration.md
+++ b/src/content/docs/_generated/reference/migration.md
@@ -16,4 +16,4 @@ editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/MIGRATING_FRO
 The automatic translator covers simple top-level metadata, modules/actions, tasks, heuristic agents, common approval mode, and initial working memory. It discards unsupported legacy provider endpoint/cache/profile fields with a migration warning rather than preserving unsafe or obsolete semantics. Pack-backed actions, remote transports, MongoDB/vector memory, arbitrary profiles, and custom TypeScript executors must be rewritten against the Rust contracts.
 
 Use `fixtures/compat/v0/assign.playbook.yaml` as the minimum preserved contract and compare changes against [Compatibility](/agentctl/reference/compatibility/). The old source is non-production reference material; do not add new behavior to it.
-> Canonical source: [`docs/MIGRATING_FROM_TYPESCRIPT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/MIGRATING_FROM_TYPESCRIPT.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/MIGRATING_FROM_TYPESCRIPT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/MIGRATING_FROM_TYPESCRIPT.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/reference/output.md b/src/content/docs/_generated/reference/output.md
index bdb8f7c..b92faf0 100644
--- a/src/content/docs/_generated/reference/output.md
+++ b/src/content/docs/_generated/reference/output.md
@@ -39,4 +39,4 @@ agentctl run examples/v1/hello.yaml --db /tmp/hello.db --output json --color nev
 ```
 
 These commands need no credential. `check` writes no runtime database; `run` writes `/tmp/hello.db`.
-> Canonical source: [`docs/reference/CLI_OUTPUT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/CLI_OUTPUT.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/reference/CLI_OUTPUT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/CLI_OUTPUT.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/reference/terminology.md b/src/content/docs/_generated/reference/terminology.md
index 82b9b9d..a7658a3 100644
--- a/src/content/docs/_generated/reference/terminology.md
+++ b/src/content/docs/_generated/reference/terminology.md
@@ -28,4 +28,4 @@ Use these terms consistently in workflows, documentation, issues, and reviews.
 | Pack | A local versioned manifest and reviewed reusable content with integrity checking. |
 
 Do not use resume, replay, retry, and fork interchangeably. None of them means exactly-once execution.
-> Canonical source: [`docs/reference/TERMINOLOGY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/TERMINOLOGY.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/reference/TERMINOLOGY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/TERMINOLOGY.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/reference/yaml.md b/src/content/docs/_generated/reference/yaml.md
index ba7e46f..b0a9b03 100644
--- a/src/content/docs/_generated/reference/yaml.md
+++ b/src/content/docs/_generated/reference/yaml.md
@@ -109,4 +109,4 @@ agentctl run examples/v1/dataflow.yaml --db /tmp/dataflow.db --output json --col
 ```
 
 Related guides: [Workflow authoring](/agentctl/guides/workflow-authoring/), [Policies](/agentctl/concepts/policies/), [Tools](/agentctl/concepts/tools/), and [Workflow DSL](/agentctl/concepts/workflow-model/).
-> Canonical source: [`docs/reference/YAML.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/YAML.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/reference/YAML.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/YAML.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/security/index.md b/src/content/docs/_generated/security/index.md
index 24dfe98..56e86e7 100644
--- a/src/content/docs/_generated/security/index.md
+++ b/src/content/docs/_generated/security/index.md
@@ -25,4 +25,4 @@ Prompts, file content, model output, remote artifacts, and tool output may be co
 MCP reconnection and A2A resubmission are intentionally not automatic. Streaming is bounded but completed results, not token deltas, enter workflow state. Windows cannot express Unix database mode bits; rely on the user profile ACL and CI tests.
 
 Report vulnerabilities privately to the repository maintainer. Do not include credentials, database contents, or production prompts in a report.
-> Canonical source: [`docs/SECURITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/SECURITY.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/SECURITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/SECURITY.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/security/threat-model.md b/src/content/docs/_generated/security/threat-model.md
index fa462fd..e35ff28 100644
--- a/src/content/docs/_generated/security/threat-model.md
+++ b/src/content/docs/_generated/security/threat-model.md
@@ -26,4 +26,4 @@ The local operator and reviewed binary are trusted. Workflow authors are only as
 | Dependency compromise | locked registry-only deps, cargo-deny, license/source checks | registry compromise and zero-days remain possible |
 
 No unresolved critical or high-severity defect is knowingly accepted for the implemented boundary. Deferred sandboxing, signature verification, distributed concurrency, and encrypted storage are explicit product limitations, not implied controls.
-> Canonical source: [`docs/THREAT_MODEL.md`](https://github.com/opensourceops/agentctl/blob/main/docs/THREAT_MODEL.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/THREAT_MODEL.md`](https://github.com/opensourceops/agentctl/blob/main/docs/THREAT_MODEL.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/content/docs/_generated/troubleshooting/index.md b/src/content/docs/_generated/troubleshooting/index.md
index 677d6f6..023fc0b 100644
--- a/src/content/docs/_generated/troubleshooting/index.md
+++ b/src/content/docs/_generated/troubleshooting/index.md
@@ -135,4 +135,4 @@ ls -ld /state /state/runtime.db
 ## Safe issue report
 
 Include the exact `agentctl version`, operating system, redacted command, exit code, diagnostic code, workflow API version, minimal non-secret workflow, and relevant run/trace IDs. Share a narrow redacted `inspect` excerpt only when needed. Report security problems through the private process in [Security](/agentctl/security/), not a public issue.
-> Canonical source: [`docs/guides/TROUBLESHOOTING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/TROUBLESHOOTING.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/guides/TROUBLESHOOTING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/TROUBLESHOOTING.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.
diff --git a/src/data/agentctl-source.json b/src/data/agentctl-source.json
index 0664c59..08c4601 100644
--- a/src/data/agentctl-source.json
+++ b/src/data/agentctl-source.json
@@ -2,7 +2,7 @@
   "product": "agentctl",
   "version": "0.2.0",
   "workflowApi": "agentctl.dev/v1alpha1",
-  "commit": "0ae1e381b87ea815f0d4ca66689db10bb1129e4a",
+  "commit": "a1ebcadcc2557136cb82633862c50854223981fa",
   "dirty": false,
   "sourceRepository": "https://github.com/opensourceops/agentctl",
   "importedFiles": 56