diff --git a/graph.fabro b/graph.fabro
new file mode 100644
index 000000000..afc9d2279
--- /dev/null
+++ b/graph.fabro
@@ -0,0 +1,38 @@
+digraph ImplementAndSimplify {
+    graph [
+        goal="Implement and simplify",
+        model_stylesheet="
+            * { backend: api; model: claude-opus-4-6;}
+        "
+    ]
+    rankdir=LR
+
+    start [shape=Mdiamond, label="Start"]
+    exit  [shape=Msquare, label="Exit"]
+
+    toolchain         [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0]
+    preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0]
+    preflight_lint    [label="Preflight Lint", shape=parallelogram, script="cargo clippy -q --workspace -- -D warnings 2>&1", max_retries=0]
+    fix_lints         [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3]
+    implement         [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD."]
+    simplify_opus     [label="Simplify (Opus)", prompt="@prompts/simplify.md"]
+    simplify_gemini   [label="Simplify (Gemini)", prompt="@prompts/simplify.md", model="gemini-3.1-pro-preview-customtools"]
+    simplify_gpt      [label="Simplify (GPT-54)", prompt="@prompts/simplify.md", model="gpt-54"]
+    verify            [label="Verify", shape=parallelogram, script="cargo clippy -q --workspace -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1", goal_gate=true, retry_target="fixup"]
+    fixup             [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings and test failures.", max_visits=3]
+    fmt               [label="Format", shape=parallelogram, script="cargo fmt --all 2>&1", max_retries=0]
+
+    start -> toolchain
+    toolchain -> preflight_compile [condition="outcome=success"]
+    toolchain -> exit
+    preflight_compile -> preflight_lint [condition="outcome=success"]
+    preflight_compile -> exit
+    preflight_lint -> implement [condition="outcome=success"]
+    preflight_lint -> fix_lints
+    fix_lints -> preflight_lint
+    implement -> simplify_opus -> simplify_gemini -> simplify_gpt -> verify
+    verify -> fmt   [condition="outcome=success"]
+    verify -> fixup
+    fixup -> verify
+    fmt -> exit
+}
diff --git a/manifest.json b/manifest.json
new file mode 100644
index 000000000..769af0e28
--- /dev/null
+++ b/manifest.json
@@ -0,0 +1,13 @@
+{
+  "run_id": "01KM3AQQTAGGN504HP2FNQXP6A",
+  "workflow_name": "ImplementAndSimplify",
+  "goal": "# Plan: `fabro provider login` command\n\n## Context\n\nOpenAI OAuth PKCE login is currently only available during the `fabro install` wizard. Users need a way to re-authenticate with providers after initial setup — e.g., when tokens expire or they want to switch accounts. This adds `fabro provider login --provider <name>` as a standalone command. OpenAI gets the browser OAuth flow; all other providers get an API key prompt with validation.\n\n## Changes\n\n### 1. Extract shared auth helpers from `install.rs` into `provider_auth.rs`\n\n**New file:** `lib/crates/fabro-cli/src/provider_auth.rs`\n\nMove these functions from `install.rs` (make them `pub(crate)`):\n- `provider_display_name()` (line 220)\n- `provider_key_url()` (line 206)\n- `openai_oauth_env_pairs()` (line 248)\n- `write_env_file()` (line 537)\n- `validate_api_key()` (line 901)\n- `prompt_and_validate_key()` (line 926) — also needs `prompt_password()` (line 288) and `prompt_confirm()` (line 270)\n\nMove associated tests from `install.rs` (`openai_oauth_env_pairs_*`, `every_provider_has_key_url`).\n\n**Modify:** `lib/crates/fabro-cli/src/install.rs` — replace moved functions with `use crate::provider_auth::*`.\n\n### 2. Create command module\n\n**New file:** `lib/crates/fabro-cli/src/commands/provider.rs`\n\n```\nProviderLoginArgs {\n    #[arg(long)]\n    provider: Provider,   // Provider already implements FromStr\n}\n```\n\n`login_command(args)`:\n- If `provider == OpenAi`: prompt \"Log in via browser (OAuth)?\", run `fabro_openai_oauth::run_browser_flow()`, fall back to API key on failure/decline\n- Otherwise: call `prompt_and_validate_key()`\n- Write credentials via `write_env_file()` (merge semantics, non-destructive)\n\n### 3. Wire into CLI\n\n**Modify:** `lib/crates/fabro-cli/src/commands/mod.rs` — add `pub mod provider;`\n\n**Modify:** `lib/crates/fabro-cli/src/main.rs`:\n- Add `mod provider_auth;`\n- Add `ProviderCommand` enum with `Login(commands::provider::ProviderLoginArgs)`\n- Add `Command::Provider { command: ProviderCommand }` variant (doc: \"Provider operations\")\n- Add dispatch arm and `command_name` arm (\"provider login\")\n\nNo Cargo.toml changes needed — all deps already present.\n\n## Files changed\n\n| File | Action |\n|------|--------|\n| `lib/crates/fabro-cli/src/provider_auth.rs` | New — shared auth helpers |\n| `lib/crates/fabro-cli/src/commands/provider.rs` | New — login command |\n| `lib/crates/fabro-cli/src/commands/mod.rs` | Add `pub mod provider;` |\n| `lib/crates/fabro-cli/src/main.rs` | Add module, enum, variant, dispatch |\n| `lib/crates/fabro-cli/src/install.rs` | Remove extracted functions, import from `provider_auth` |\n\n## Implementation approach: Red/Green TDD\n\nWork in small cycles: write a failing test, then write the minimum code to make it pass.\n\n### Cycle 1: Extract `provider_auth.rs` — tests pass after move\n1. **Red**: Move tests from `install.rs` (`openai_oauth_env_pairs_*`, `every_provider_has_key_url`) to a new `provider_auth.rs` — they fail because the functions aren't there yet\n2. **Green**: Move the functions (`provider_display_name`, `provider_key_url`, `openai_oauth_env_pairs`, `write_env_file`, `validate_api_key`, `prompt_and_validate_key`, `prompt_password`, `prompt_confirm`) from `install.rs` to `provider_auth.rs`, update `install.rs` to import them\n3. **Verify**: `cargo test -p fabro-cli`\n\n### Cycle 2: Wire `ProviderCommand` into clap — command is recognized\n1. **Red**: Add a test that parses `[\"provider\", \"login\", \"--provider\", \"openai\"]` via `Cli::try_parse_from` — fails because the command doesn't exist\n2. **Green**: Add `ProviderCommand` enum, `Command::Provider` variant, `ProviderLoginArgs` struct, empty `login_command`, dispatch arm, `command_name` arm, `commands/mod.rs` entry\n3. **Verify**: `cargo test -p fabro-cli`\n\n### Cycle 3: Clap rejects bad input\n1. **Red**: Add tests that `[\"provider\", \"login\"]` (missing --provider) and `[\"provider\", \"login\", \"--provider\", \"bogus\"]` both fail to parse\n2. **Green**: Should already pass from cycle 2 (clap handles this). If not, adjust args.\n3. **Verify**: `cargo test -p fabro-cli`\n\n### Cycle 4: Implement `login_command` for non-OpenAI providers\n1. **Green**: Implement the API-key path in `login_command` — call `prompt_and_validate_key()` and `write_env_file()`\n2. **Verify**: `cargo build --workspace` compiles, manual test `fabro provider login --provider anthropic`\n\n### Cycle 5: Implement `login_command` for OpenAI OAuth\n1. **Green**: Add OpenAI branch — prompt for OAuth, run `run_browser_flow()`, fallback to API key\n2. **Verify**: `cargo build --workspace` compiles, manual test `fabro provider login --provider openai`\n\n### Final verification\n1. `cargo test --workspace`\n2. `cargo clippy --workspace -- -D warnings`\n3. `cargo fmt --check --all`\n4. `fabro install` — still works end-to-end\n",
+  "start_time": "2026-03-19T15:17:06.895006Z",
+  "node_count": 13,
+  "edge_count": 16,
+  "run_branch": "fabro/run/01KM3AQQTAGGN504HP2FNQXP6A",
+  "base_sha": "5b098d1882ef3028a1b7a2d333264b564457ae08",
+  "base_branch": "main",
+  "workflow_slug": "implement",
+  "host_repo_path": "/Users/bhelmkamp/p/fabro-sh/fabro"
+}
\ No newline at end of file
diff --git a/sandbox.json b/sandbox.json
new file mode 100644
index 000000000..6a07299d3
--- /dev/null
+++ b/sandbox.json
@@ -0,0 +1,5 @@
+{
+  "provider": "daytona",
+  "working_directory": "/home/daytona/workspace",
+  "identifier": "fabro-01KM3AQQTAGGN504HP2FNQXP6A"
+}
\ No newline at end of file