fabro/run.json

{
  "title": "Server-Owned Environments Implementation Plan",
  "spec": {
    "run_id": "01KSPDE8E9ATTVY1VBCS3YRBHT",
    "settings": {
      "project": {
        "name": null,
        "description": null,
        "metadata": {}
      },
      "workflow": {
        "name": null,
        "description": null,
        "graph": "workflow.fabro",
        "metadata": {}
      },
      "run": {
        "goal": {
          "type": "inline",
          "value": "# Server-Owned Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Move environment definitions from layered run settings into server-owned TOML resources with CRUD API management, matching the Automation store pattern.\n\n**Architecture:** Add a concrete `EnvironmentStore` that loads one environment TOML file per id from a sibling `environments/` directory next to the active server settings file. Runs continue to select an environment by id through `[run.environment]` or `--environment`, but server-side run creation resolves the id from `EnvironmentStore`; project/workflow/user config can no longer define environment catalogs or environment field overrides. The web UI is intentionally deferred.\n\n**Tech Stack:** Rust, Axum, serde/TOML, `toml_edit`, Tokio file I/O, OpenAPI/progenitor, generated TypeScript API client, cargo-nextest.\n\n---\n\n## File Structure\n\n- Create `lib/crates/fabro-environment/`: environment ids, revisions, API/domain DTOs, TOML persistence, canonicalization, validation, and `EnvironmentStore`.\n- Modify workspace manifests: root `Cargo.toml`, `lib/crates/fabro-server/Cargo.toml`, `lib/crates/fabro-api/build.rs`, and generated API/client package files.\n- Modify `lib/crates/fabro-server/src/server.rs`, `lib/crates/fabro-server/src/server/handler/mod.rs`, and a new `lib/crates/fabro-server/src/server/handler/environments.rs` to wire the store and API.\n- Modify `lib/crates/fabro-config/src/builders.rs`, `lib/crates/fabro-config/src/load.rs`, `lib/crates/fabro-config/src/migrations.rs`, and config tests to treat `[environments]` as migration-only, not runtime configuration.\n- Modify `lib/crates/fabro-manifest/src/lib.rs`, `lib/crates/fabro-server/src/run_manifest.rs`, and CLI run/preflight/graph/validate paths so environment ids are resolved only by the server.\n- Modify install/repo-init/docs/OpenAPI artifacts so new examples use server environment files and run configs only select ids.\n\n## Decisions\n\n- Environment definitions are server-owned operator policy. Project and workflow files may request an id but cannot define or override environment fields.\n- `default`, `local`, `docker`, and `daytona` are seeded if missing. Existing files are never overwritten.\n- `default` is protected from deletion. Other seeded files can be edited or deleted.\n- Environment ids use `[a-z0-9][a-z0-9-]{0,62}`.\n- Environment revisions are SHA-256 hashes of the persisted TOML bytes, returned in JSON as `revision` and in `ETag`.\n- `PUT` and `DELETE` require `If-Match`, following `AutomationStore`.\n- `image.dockerfile = { path = \"Dockerfile\" }` is accepted in persisted files and API input, resolved relative to the environment file or request context, and converted to inline content for runtime use. API writes canonical inline TOML.\n- `--preserve-sandbox` remains a CLI/server argument override. TOML `[run.environment.lifecycle]` is rejected.\n- `--docker-image` is rejected with a targeted message directing operators to create or update a server environment.\n- Existing dense `WorkflowSettings.environments` stays in the API for compatibility and is populated from the server environment catalog during run resolution.\n\n## Task 1: Add `fabro-environment` Store Crate\n\n**Files:**\n- Create: `lib/crates/fabro-environment/Cargo.toml`\n- Create: `lib/crates/fabro-environment/src/lib.rs`\n- Create: `lib/crates/fabro-environment/src/id.rs`\n- Create: `lib/crates/fabro-environment/src/model.rs`\n- Create: `lib/crates/fabro-environment/src/store.rs`\n- Create: `lib/crates/fabro-environment/src/error.rs`\n- Modify: root `Cargo.toml`\n\n- [ ] Create a workspace crate named `fabro-environment`, modeled after `fabro-automation`.\n- [ ] Define `EnvironmentId`, `EnvironmentRevision`, and parse/validation errors.\n- [ ] Define public DTOs:\n  - `Environment`: `id`, `revision`, `provider`, `image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, `env`.\n  - `EnvironmentDraft`: `id` plus environment fields.\n  - `EnvironmentReplace`: environment fields without id.\n- [ ] Use the existing environment field types from `fabro_types::settings::run` for dense API fields.\n- [ ] Use existing sparse `fabro_config::EnvironmentLayer` only for TOML input/output and conversion; do not create a second environment field vocabulary.\n- [ ] Add conversion helpers that resolve an `EnvironmentLayer` into dense `EnvironmentSettings` using the same provider/network/image validation rules as `fabro-config`.\n- [ ] Implement canonical TOML serialization for persisted files. Omit `id` and `revision`; the filename is the id and the file bytes determine revision.\n- [ ] Implement `EnvironmentStore` with `load_or_seed(dir)`, `list`, `get`, `create`, `replace`, `delete`, and `catalog_layer`.\n- [ ] Seed missing `default`, `local`, `docker`, and `daytona` files from the current built-in defaults. Do not overwrite existing files.\n- [ ] Protect `default` from deletion with a typed store error.\n- [ ] Resolve Dockerfile path references relative to the environment file directory during load and relative to the active settings directory during API create/replace. Store runtime values with inline Dockerfile content.\n- [ ] Add unit tests for loading an absent directory, seeding built-ins, sorted listing, invalid ids, invalid provider, invalid network mode, missing Dockerfile path, create conflict, replace stale revision, default delete rejection, delete success, and canonical revision changes.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-environment\n```\n\nExpected: all `fabro-environment` tests pass.\n\n## Task 2: Make Config Environments Migration-Only\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/parse.rs`\n- Modify: `lib/crates/fabro-config/src/builders.rs`\n- Modify: `lib/crates/fabro-config/src/load.rs`\n- Modify: `lib/crates/fabro-config/src/migrations.rs`\n- Create: `lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs`\n- Modify: `lib/crates/fabro-config/src/defaults.toml`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_run.rs`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_root.rs`\n\n- [ ] Keep `SettingsLayer.environments` in this pass so old files can parse and migrate, but remove environment catalog entries from `defaults.toml`.\n- [ ] Add source-aware validation that rejects `SettingsLayer.environments` for project, workflow, and direct run config layers with this message shape: `[environments.<id>] is now server-managed; move this definition to the server environments directory`.\n- [ ] Add validation that rejects TOML-provided `run.environment.image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, and `env`. Keep `run.environment.id`.\n- [ ] Ensure CLI/server argument layers can still set `run.environment.lifecycle.preserve` for `--preserve-sandbox`; the rejection applies only to parsed TOML sources.\n- [ ] Add a settings-file migration that extracts top-level `[environments.<id>]` entries from the active `settings.toml` into sibling `environments/<id>.toml` files.\n- [ ] Migration must write a backup before editing `settings.toml`, preserve `[run.environment] id`, remove the top-level `[environments]` table, and fail without changing files if any target environment file already exists.\n- [ ] Chain the existing legacy `[run.sandbox]` migration before the new extraction migration so legacy sandbox settings become a server `default` environment file.\n- [ ] Update run settings tests to assert that `RunSettingsBuilder` no longer resolves a selected environment without an injected server catalog.\n- [ ] Add tests proving project/workflow `[environments]` definitions produce targeted errors rather than silent ignores.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-config\n```\n\nExpected: config tests pass, including migration coverage.\n\n## Task 3: Wire EnvironmentStore Into Server Run Resolution\n\n**Files:**\n- Modify: `lib/crates/fabro-server/src/server.rs`\n- Modify: `lib/crates/fabro-server/src/serve.rs`\n- Modify: `lib/crates/fabro-server/src/run_manifest.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/runs.rs`\n- Modify: `lib/crates/fabro-server/src/manifest_validation.rs`\n- Modify: `lib/crates/fabro-server/src/test_support.rs`\n\n- [ ] Add `environment_store: Arc<EnvironmentStore>` to `AppState`, loaded from `active_config_path.parent().join(\"environments\")`.\n- [ ] Replace `manifest_environment_defaults` from `ServerRuntimeSettings` with `environment_store.catalog_layer()` when preparing manifests on the server.\n- [ ] Keep the dense run snapshot unchanged: `prepared.settings.run.environment` contains the resolved environment fields, and `prepared.settings.environments` contains the server catalog used for resolution.\n- [ ] Convert unknown environment ids into `400 Bad Request` during run creation/preflight/graph preparation.\n- [ ] Keep sandbox provider policy checks after environment resolution, so disabled providers still reject runs.\n- [ ] Apply `--preserve-sandbox` after selected environment resolution.\n- [ ] Remove server reliance on `[environments]` in `settings.toml`.\n- [ ] Update server test support so tests can inject environment files or use seeded defaults.\n- [ ] Add server tests for default environment run creation, custom server environment selection, unknown environment id, disabled provider policy, `--preserve-sandbox`, and rejected TOML environment field overrides.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server\n```\n\nExpected: server API and run-manifest tests pass.\n\n## Task 4: Add Environment CRUD API\n\n**Files:**\n- Modify: `docs/public/api-reference/fabro-api.yaml`\n- Modify: `lib/crates/fabro-api/build.rs`\n- Create: `lib/crates/fabro-server/src/server/handler/environments.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/mod.rs`\n- Add tests: `lib/crates/fabro-server/tests/it/api/environments.rs`\n- Update generated Rust and TypeScript API artifacts after spec changes.\n\n- [ ] Add OpenAPI tag `Environments`.\n- [ ] Add schemas for `Environment`, `CreateEnvironmentRequest`, `ReplaceEnvironmentRequest`, and `EnvironmentListResponse`.\n- [ ] Reuse existing environment schemas for provider/image/resources/network/lifecycle/volumes/env.\n- [ ] Add endpoints:\n  - `GET /api/v1/environments`\n  - `POST /api/v1/environments`\n  - `GET /api/v1/environments/{id}`\n  - `PUT /api/v1/environments/{id}`\n  - `DELETE /api/v1/environments/{id}`\n- [ ] Return `ETag` on retrieve and replace.\n- [ ] Require `If-Match` on replace and delete.\n- [ ] Map store errors to API responses:\n  - invalid id: `400`\n  - duplicate create: `409`\n  - stale revision: `409`\n  - validation error: `422`\n  - missing resource: `404`\n  - protected default delete: `409`\n  - persistence failure: `500`\n- [ ] Add route tests for empty-seeded list, create, retrieve with ETag, replace, stale replace, missing `If-Match`, delete, protected default delete, invalid provider, invalid CIDR, and missing Dockerfile path.\n- [ ] Regenerate `fabro-api` and TypeScript client artifacts.\n\nRun:\n\n```bash\ncargo build -p fabro-api\ncd lib/packages/fabro-api-client && bun run generate\ncargo nextest run -p fabro-server --test it -- api::environments\n```\n\nExpected: generated artifacts are updated and environment API tests pass.\n\n## Task 5: Adjust CLI And Manifest Behavior\n\n**Files:**\n- Modify: `lib/crates/fabro-cli/src/commands/run/overrides.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/preflight.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/graph.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/validate.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/repo/init.rs`\n- Modify: `lib/crates/fabro-manifest/src/lib.rs`\n- Modify CLI integration tests under `lib/crates/fabro-cli/tests/it/`\n\n- [ ] Reject `--docker-image` in run, create, preflight, graph, and validate commands with this message shape: `--docker-image is no longer supported; create or update a server environment and select it with --environment`.\n- [ ] Keep `--environment` as an id-only selector in manifest args.\n- [ ] Stop collecting Dockerfile path references from `[environments.<id>]` in project/workflow config because those definitions are invalid.\n- [ ] Keep collecting Dockerfile references for any remaining CLI-created run environment override only when it comes from allowed argument paths; with `--docker-image` rejected, no normal user path should add one.\n- [ ] Update local preflight/graph/validate flows so they either call server preflight for environment resolution or print a clear message that server-owned environment resolution requires a running server.\n- [ ] Update `fabro repo init` to write only `[run.environment] id = \"local\"` and no `[environments.local]` block.\n- [ ] Update CLI tests for manifest args, repo init output, rejected `--docker-image`, and server-owned environment selection.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-cli\n```\n\nExpected: CLI tests pass and no generated workflow config contains `[environments.*]`.\n\n## Task 6: Update Install, Docs, And Generated References\n\n**Files:**\n- Modify install persistence code in `lib/crates/fabro-cli/src/commands/install.rs` and server install handlers/tests.\n- Modify docs: `docs/public/execution/environments.mdx`, `docs/public/execution/run-configuration.mdx`, `docs/public/reference/user-configuration.mdx`, `docs/public/administration/server-configuration.mdx`, `docs/public/administration/sandboxing.mdx`, `docs/public/integrations/daytona.mdx`, and examples that currently define `[environments.<id>]`.\n- Modify generated settings reference if applicable.\n\n- [ ] Update install flows to write server environment files instead of `[environments.default]` into `settings.toml`.\n- [ ] Keep install-written `[run.environment] id = \"default\"` when a default run environment selection is still needed.\n- [ ] Update tests that assert `settings.toml` contains `[environments.default]` to assert the sibling environment file exists and settings no longer contains `[environments]`.\n- [ ] Rewrite public docs so environment definitions are server-owned TOML files and run configs only select ids.\n- [ ] Add a compatibility note explaining that project/workflow `[environments]` definitions now fail and must be moved to the server.\n- [ ] Keep `Settings > Environments` UI documentation out of this pass.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server --test it -- api::install\ncargo nextest run -p fabro-cli --test it\n```\n\nExpected: install tests pass and docs no longer present project/workflow environment definitions as valid.\n\n## Task 7: Workspace Verification\n\n**Files:**\n- No new files unless test snapshots require reviewed updates.\n\n- [ ] Run Rust formatting check:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\n```\n\n- [ ] Run clippy:\n\n```bash\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\n- [ ] Run workspace tests:\n\n```bash\ncargo nextest run --workspace\n```\n\n- [ ] Run TypeScript checks if API client changes affect the web package:\n\n```bash\ncd apps/fabro-web && bun run typecheck\ncd apps/fabro-web && bun test\n```\n\n- [ ] Inspect generated files and snapshots before accepting any snapshot changes.\n\n## Acceptance Criteria\n\n- Server startup creates or loads `environments/default.toml`, `local.toml`, `docker.toml`, and `daytona.toml`.\n- `GET /api/v1/environments` returns seeded environments with revisions.\n- API-created environments persist as TOML files and survive server restart.\n- Runs using `[run.environment] id = \"cloud\"` resolve from server files only.\n- Project/workflow/user `[environments.<id>]` definitions no longer affect runs.\n- Existing runs keep their dense environment snapshot after environment files change.\n- `--environment` still works.\n- `--preserve-sandbox` still works.\n- `--docker-image` no longer works and produces the targeted replacement guidance.\n- Web UI changes are not included.\n"
        },
        "working_dir": null,
        "metadata": {},
        "inputs": {},
        "model": {
          "provider": "anthropic",
          "name": "claude-sonnet-4-6",
          "fallbacks": [],
          "controls": {
            "reasoning_effort": null,
            "speed": null
          }
        },
        "git": {
          "author": null
        },
        "prepare": {
          "commands": [],
          "timeout_ms": 300000
        },
        "execution": {
          "mode": "normal",
          "approval": "prompt"
        },
        "checkpoint": {
          "exclude_globs": [],
          "skip_git_hooks": false
        },
        "clone": {
          "enabled": true
        },
        "run_branch": {
          "enabled": true,
          "push": true
        },
        "meta_branch": {
          "enabled": true,
          "push": true
        },
        "environment": {
          "id": "fabro-dev",
          "provider": "daytona",
          "image": {
            "docker": null,
            "dockerfile": {
              "type": "inline",
              "value": "FROM ubuntu:24.04\n\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n        curl git ripgrep ca-certificates build-essential pkg-config libssl-dev unzip python3 \\\n        xvfb xfce4 xfce4-terminal x11vnc novnc dbus-x11 \\\n        libx11-6 libxrandr2 libxext6 libxrender1 libxfixes3 libxss1 libxtst6 libxi6 \\\n    && rm -rf /var/lib/apt/lists/*\n\n# Install real Chromium (not the snap stub) via xtradeb PPA\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n        software-properties-common curl gnupg \\\n    && add-apt-repository -y ppa:xtradeb/apps \\\n    && apt-get update \\\n    && apt-get install -y --no-install-recommends chromium \\\n    && rm -rf /var/lib/apt/lists/*\n\n# Wrapper: Chromium needs --no-sandbox when running as root in a container,\n# and --disable-dev-shm-usage avoids crashes from small /dev/shm\nRUN printf '#!/bin/bash\\nexec /usr/bin/chromium --no-sandbox --disable-dev-shm-usage \"$@\"\\n' \\\n        > /usr/local/bin/chromium-wrapper \\\n    && chmod +x /usr/local/bin/chromium-wrapper\n\n# Make the wrapper the default in the system .desktop file and via alternatives\nRUN sed -i 's|^Exec=.*|Exec=/usr/local/bin/chromium-wrapper %U|' \\\n        /usr/share/applications/chromium.desktop \\\n    && update-alternatives --install /usr/bin/x-www-browser x-www-browser \\\n        /usr/local/bin/chromium-wrapper 100\n\n# Tell XFCE's exo-open that Chromium is the WebBrowser helper (system-wide)\nRUN mkdir -p /etc/xdg/xfce4 /usr/share/xfce4/helpers \\\n    && printf 'WebBrowser=custom-WebBrowser\\n' > /etc/xdg/xfce4/helpers.rc \\\n    && printf '[Desktop Entry]\\n\\\nVersion=1.0\\n\\\nType=X-XFCE-Helper\\n\\\nName=Chromium\\n\\\nIcon=chromium\\n\\\nX-XFCE-Category=WebBrowser\\n\\\nX-XFCE-CommandsWithParameter=/usr/local/bin/chromium-wrapper \"%%s\"\\n\\\nX-XFCE-Commands=/usr/local/bin/chromium-wrapper\\n' \\\n        > /usr/share/xfce4/helpers/custom-WebBrowser.desktop\n\n# GitHub CLI\nRUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \\\n        | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \\\n    && echo \"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main\" \\\n        | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \\\n    && apt-get update && apt-get install -y --no-install-recommends gh \\\n    && rm -rf /var/lib/apt/lists/*\n\n# Rust\nRUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y\nENV PATH=\"/root/.cargo/bin:${PATH}\"\nRUN rustup toolchain install nightly-2026-04-14 --profile minimal --component clippy,rustfmt\nRUN cargo install cargo-nextest --locked\nENV CARGO_INCREMENTAL=0\n\n# Bun\nRUN curl -fsSL https://bun.sh/install | bash\nENV PATH=\"/root/.bun/bin:${PATH}\"\n\nWORKDIR /root\n"
            }
          },
          "resources": {
            "cpu": 8,
            "memory": "16GB",
            "disk": "20GB"
          },
          "network": {
            "mode": "allow_all",
            "allow": []
          },
          "lifecycle": {
            "preserve": false,
            "stop_on_terminal": true,
            "auto_stop": "30m"
          },
          "labels": {
            "repo": "fabro-sh/fabro"
          },
          "volumes": [],
          "env": {}
        },
        "notifications": {
          "feed": {
            "enabled": true,
            "provider": "slack",
            "events": [
              "run.started",
              "run.completed",
              "run.failed"
            ],
            "slack": {
              "channel": "#feed-fabro"
            }
          }
        },
        "interviews": {
          "provider": null,
          "slack": null
        },
        "agent": {
          "fabro_tools": false,
          "permissions": null,
          "mcps": {}
        },
        "hooks": [],
        "scm": {
          "provider": null,
          "owner": null,
          "repository": null,
          "github": null
        },
        "pull_request": {
          "enabled": true,
          "draft": false,
          "auto_merge": false,
          "merge_strategy": "squash"
        },
        "artifacts": {
          "include": []
        },
        "integrations": {
          "github": {
            "permissions": {}
          }
        }
      }
    },
    "graph": {
      "name": "ImplementPlan",
      "nodes": {
        "fix_lints": {
          "id": "fix_lints",
          "attrs": {
            "prompt": {
              "String": "The preflight lint step failed. Read the build output from context and fix all clippy lint warnings."
            },
            "provider": {
              "String": "anthropic"
            },
            "max_visits": {
              "Integer": 3
            },
            "label": {
              "String": "Fix Lints"
            },
            "model": {
              "String": "claude-opus-4-7"
            }
          }
        },
        "toolchain": {
          "id": "toolchain",
          "attrs": {
            "max_retries": {
              "Integer": 0
            },
            "model": {
              "String": "claude-opus-4-7"
            },
            "provider": {
              "String": "anthropic"
            },
            "shape": {
              "String": "parallelogram"
            },
            "label": {
              "String": "Toolchain"
            },
            "script": {
              "String": "command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1"
            }
          }
        },
        "preflight_compile": {
          "id": "preflight_compile",
          "attrs": {
            "shape": {
              "String": "parallelogram"
            },
            "model": {
              "String": "claude-opus-4-7"
            },
            "provider": {
              "String": "anthropic"
            },
            "label": {
              "String": "Preflight Compile"
            },
            "max_retries": {
              "Integer": 0
            },
            "script": {
              "String": "cargo check -q --workspace 2>&1"
            }
          }
        },
        "exit": {
          "id": "exit",
          "attrs": {
            "shape": {
              "String": "Msquare"
            },
            "label": {
              "String": "Exit"
            },
            "model": {
              "String": "claude-opus-4-7"
            },
            "provider": {
              "String": "anthropic"
            }
          }
        },
        "simplify_opus": {
          "id": "simplify_opus",
          "attrs": {
            "prompt": {
              "String": "# Simplify: Code Review and Cleanup\n\nReview changes vs. origin for reuse, quality, and efficiency. Fix any issues found.\n\n## Phase 1: Identify Changes\n\nRun git diff (or git diff HEAD if there are staged changes) to see what changed. If there are no git changes, review the most recently modified files that the user mentioned or that you edited earlier in this conversation.\n\n## Phase 2: Launch Three Review Agents in Parallel\n\nUse the Agent tool to launch all three agents concurrently in a single message. Pass each agent the full diff so it has the complete context.\n\n### Agent 1: Code Reuse Review\n\nFor each change:\n\n1. Search for existing utilities and helpers that could replace newly written code. Use Grep to find similar patterns elsewhere in the codebase — common locations are utility directories, shared modules, and files adjacent to the changed ones.\n2. Flag any new function that duplicates existing functionality. Suggest the existing function to use instead.\n3. Flag any inline logic that could use an existing utility — hand-rolled string manipulation, manual path handling, custom environment checks, ad-hoc type guards, and similar patterns are common candidates.\n\nNote: This is a greenfield app, so focus on maximizing simplicity and don't worry about changing things to achieve it.\n\n### Agent 2: Code Quality Review\n\nReview the same changes for hacky patterns:\n\n1. Redundant state: state that duplicates existing state, cached values that could be derived, observers/effects that could be direct calls\n2. Parameter sprawl: adding new parameters to a function instead of generalizing or restructuring existing ones\n3. Copy-paste with slight variation: near-duplicate code blocks that should be unified with a shared abstraction\n4. Leaky abstractions: exposing internal details that should be encapsulated, or breaking existing abstraction boundaries\n5. Stringly-typed code: using raw strings where constants, enums (string unions), or branded types already exist in the codebase\n\nNote: This is a greenfield app, so be aggressive in optimizing quality.\n\n### Agent 3: Efficiency Review\n\nReview the same changes for efficiency:\n\n1. Unnecessary work: redundant computations, repeated file reads, duplicate network/API calls, N+1 patterns\n2. Missed concurrency: independent operations run sequentially when they could run in parallel\n3. Hot-path bloat: new blocking work added to startup or per-request/per-render hot paths\n4. Unnecessary existence checks: pre-checking file/resource existence before operating (TOCTOU anti-pattern) — operate directly and handle the error\n5. Memory: unbounded data structures, missing cleanup, event listener leaks\n6. Overly broad operations: reading entire files when only a portion is needed, loading all items when filtering for one\n\n## Phase 3: Fix Issues\n\nWait for all three agents to complete. Aggregate their findings and fix each issue directly. If a finding is a false positive or not worth addressing, note it and move on — do not argue with the finding, just skip it.\n\nWhen done, briefly summarize what was fixed (or confirm the code was already clean)."
            },
            "label": {
              "String": "Simplify (Opus)"
            },
            "model": {
              "String": "claude-opus-4-7"
            },
            "provider": {
              "String": "anthropic"
            }
          }
        },
        "implement": {
          "id": "implement",
          "attrs": {
            "prompt": {
              "String": "Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD."
            },
            "reasoning_effort": {
              "String": "xhigh"
            },
            "label": {
              "String": "Implement"
            },
            "provider": {
              "String": "openai"
            },
            "model": {
              "String": "gpt-5.5"
            }
          }
        },
        "fixup": {
          "id": "fixup",
          "attrs": {
            "label": {
              "String": "Fixup"
            },
            "prompt": {
              "String": "The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures."
            },
            "max_visits": {
              "Integer": 3
            },
            "provider": {
              "String": "anthropic"
            },
            "model": {
              "String": "claude-opus-4-7"
            }
          }
        },
        "verify": {
          "id": "verify",
          "attrs": {
            "script": {
              "String": "git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\\bActorRef\\b|\\bActorKind\\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\\s*==\\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1"
            },
            "model": {
              "String": "claude-opus-4-7"
            },
            "goal_gate": {
              "Boolean": true
            },
            "provider": {
              "String": "anthropic"
            },
            "label": {
              "String": "Verify"
            },
            "retry_target": {
              "String": "fixup"
            },
            "shape": {
              "String": "parallelogram"
            }
          }
        },
        "preflight_lint": {
          "id": "preflight_lint",
          "attrs": {
            "shape": {
              "String": "parallelogram"
            },
            "label": {
              "String": "Preflight Lint"
            },
            "model": {
              "String": "claude-opus-4-7"
            },
            "script": {
              "String": "cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1"
            },
            "provider": {
              "String": "anthropic"
            },
            "max_retries": {
              "Integer": 0
            }
          }
        },
        "simplify_gpt": {
          "id": "simplify_gpt",
          "attrs": {
            "label": {
              "String": "Simplify (GPT-55)"
            },
            "prompt": {
              "String": "# Simplify: Code Review and Cleanup\n\nReview changes vs. origin for reuse, quality, and efficiency. Fix any issues found.\n\n## Phase 1: Identify Changes\n\nRun git diff (or git diff HEAD if there are staged changes) to see what changed. If there are no git changes, review the most recently modified files that the user mentioned or that you edited earlier in this conversation.\n\n## Phase 2: Launch Three Review Agents in Parallel\n\nUse the Agent tool to launch all three agents concurrently in a single message. Pass each agent the full diff so it has the complete context.\n\n### Agent 1: Code Reuse Review\n\nFor each change:\n\n1. Search for existing utilities and helpers that could replace newly written code. Use Grep to find similar patterns elsewhere in the codebase — common locations are utility directories, shared modules, and files adjacent to the changed ones.\n2. Flag any new function that duplicates existing functionality. Suggest the existing function to use instead.\n3. Flag any inline logic that could use an existing utility — hand-rolled string manipulation, manual path handling, custom environment checks, ad-hoc type guards, and similar patterns are common candidates.\n\nNote: This is a greenfield app, so focus on maximizing simplicity and don't worry about changing things to achieve it.\n\n### Agent 2: Code Quality Review\n\nReview the same changes for hacky patterns:\n\n1. Redundant state: state that duplicates existing state, cached values that could be derived, observers/effects that could be direct calls\n2. Parameter sprawl: adding new parameters to a function instead of generalizing or restructuring existing ones\n3. Copy-paste with slight variation: near-duplicate code blocks that should be unified with a shared abstraction\n4. Leaky abstractions: exposing internal details that should be encapsulated, or breaking existing abstraction boundaries\n5. Stringly-typed code: using raw strings where constants, enums (string unions), or branded types already exist in the codebase\n\nNote: This is a greenfield app, so be aggressive in optimizing quality.\n\n### Agent 3: Efficiency Review\n\nReview the same changes for efficiency:\n\n1. Unnecessary work: redundant computations, repeated file reads, duplicate network/API calls, N+1 patterns\n2. Missed concurrency: independent operations run sequentially when they could run in parallel\n3. Hot-path bloat: new blocking work added to startup or per-request/per-render hot paths\n4. Unnecessary existence checks: pre-checking file/resource existence before operating (TOCTOU anti-pattern) — operate directly and handle the error\n5. Memory: unbounded data structures, missing cleanup, event listener leaks\n6. Overly broad operations: reading entire files when only a portion is needed, loading all items when filtering for one\n\n## Phase 3: Fix Issues\n\nWait for all three agents to complete. Aggregate their findings and fix each issue directly. If a finding is a false positive or not worth addressing, note it and move on — do not argue with the finding, just skip it.\n\nWhen done, briefly summarize what was fixed (or confirm the code was already clean)."
            },
            "provider": {
              "String": "openai"
            },
            "model": {
              "String": "gpt-5.5"
            }
          }
        },
        "start": {
          "id": "start",
          "attrs": {
            "provider": {
              "String": "anthropic"
            },
            "model": {
              "String": "claude-opus-4-7"
            },
            "label": {
              "String": "Start"
            },
            "shape": {
              "String": "Mdiamond"
            }
          }
        }
      },
      "edges": [
        {
          "from": "start",
          "to": "toolchain",
          "attrs": {}
        },
        {
          "from": "toolchain",
          "to": "preflight_compile",
          "attrs": {
            "condition": {
              "String": "outcome=succeeded"
            }
          }
        },
        {
          "from": "toolchain",
          "to": "exit",
          "attrs": {}
        },
        {
          "from": "preflight_compile",
          "to": "preflight_lint",
          "attrs": {
            "condition": {
              "String": "outcome=succeeded"
            }
          }
        },
        {
          "from": "preflight_compile",
          "to": "exit",
          "attrs": {}
        },
        {
          "from": "preflight_lint",
          "to": "implement",
          "attrs": {
            "condition": {
              "String": "outcome=succeeded"
            }
          }
        },
        {
          "from": "preflight_lint",
          "to": "fix_lints",
          "attrs": {}
        },
        {
          "from": "fix_lints",
          "to": "preflight_lint",
          "attrs": {}
        },
        {
          "from": "implement",
          "to": "simplify_opus",
          "attrs": {}
        },
        {
          "from": "simplify_opus",
          "to": "simplify_gpt",
          "attrs": {}
        },
        {
          "from": "simplify_gpt",
          "to": "verify",
          "attrs": {}
        },
        {
          "from": "verify",
          "to": "exit",
          "attrs": {
            "condition": {
              "String": "outcome=succeeded"
            }
          }
        },
        {
          "from": "verify",
          "to": "fixup",
          "attrs": {}
        },
        {
          "from": "fixup",
          "to": "verify",
          "attrs": {}
        }
      ],
      "attrs": {
        "rankdir": {
          "String": "LR"
        },
        "goal": {
          "String": "# Server-Owned Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Move environment definitions from layered run settings into server-owned TOML resources with CRUD API management, matching the Automation store pattern.\n\n**Architecture:** Add a concrete `EnvironmentStore` that loads one environment TOML file per id from a sibling `environments/` directory next to the active server settings file. Runs continue to select an environment by id through `[run.environment]` or `--environment`, but server-side run creation resolves the id from `EnvironmentStore`; project/workflow/user config can no longer define environment catalogs or environment field overrides. The web UI is intentionally deferred.\n\n**Tech Stack:** Rust, Axum, serde/TOML, `toml_edit`, Tokio file I/O, OpenAPI/progenitor, generated TypeScript API client, cargo-nextest.\n\n---\n\n## File Structure\n\n- Create `lib/crates/fabro-environment/`: environment ids, revisions, API/domain DTOs, TOML persistence, canonicalization, validation, and `EnvironmentStore`.\n- Modify workspace manifests: root `Cargo.toml`, `lib/crates/fabro-server/Cargo.toml`, `lib/crates/fabro-api/build.rs`, and generated API/client package files.\n- Modify `lib/crates/fabro-server/src/server.rs`, `lib/crates/fabro-server/src/server/handler/mod.rs`, and a new `lib/crates/fabro-server/src/server/handler/environments.rs` to wire the store and API.\n- Modify `lib/crates/fabro-config/src/builders.rs`, `lib/crates/fabro-config/src/load.rs`, `lib/crates/fabro-config/src/migrations.rs`, and config tests to treat `[environments]` as migration-only, not runtime configuration.\n- Modify `lib/crates/fabro-manifest/src/lib.rs`, `lib/crates/fabro-server/src/run_manifest.rs`, and CLI run/preflight/graph/validate paths so environment ids are resolved only by the server.\n- Modify install/repo-init/docs/OpenAPI artifacts so new examples use server environment files and run configs only select ids.\n\n## Decisions\n\n- Environment definitions are server-owned operator policy. Project and workflow files may request an id but cannot define or override environment fields.\n- `default`, `local`, `docker`, and `daytona` are seeded if missing. Existing files are never overwritten.\n- `default` is protected from deletion. Other seeded files can be edited or deleted.\n- Environment ids use `[a-z0-9][a-z0-9-]{0,62}`.\n- Environment revisions are SHA-256 hashes of the persisted TOML bytes, returned in JSON as `revision` and in `ETag`.\n- `PUT` and `DELETE` require `If-Match`, following `AutomationStore`.\n- `image.dockerfile = { path = \"Dockerfile\" }` is accepted in persisted files and API input, resolved relative to the environment file or request context, and converted to inline content for runtime use. API writes canonical inline TOML.\n- `--preserve-sandbox` remains a CLI/server argument override. TOML `[run.environment.lifecycle]` is rejected.\n- `--docker-image` is rejected with a targeted message directing operators to create or update a server environment.\n- Existing dense `WorkflowSettings.environments` stays in the API for compatibility and is populated from the server environment catalog during run resolution.\n\n## Task 1: Add `fabro-environment` Store Crate\n\n**Files:**\n- Create: `lib/crates/fabro-environment/Cargo.toml`\n- Create: `lib/crates/fabro-environment/src/lib.rs`\n- Create: `lib/crates/fabro-environment/src/id.rs`\n- Create: `lib/crates/fabro-environment/src/model.rs`\n- Create: `lib/crates/fabro-environment/src/store.rs`\n- Create: `lib/crates/fabro-environment/src/error.rs`\n- Modify: root `Cargo.toml`\n\n- [ ] Create a workspace crate named `fabro-environment`, modeled after `fabro-automation`.\n- [ ] Define `EnvironmentId`, `EnvironmentRevision`, and parse/validation errors.\n- [ ] Define public DTOs:\n  - `Environment`: `id`, `revision`, `provider`, `image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, `env`.\n  - `EnvironmentDraft`: `id` plus environment fields.\n  - `EnvironmentReplace`: environment fields without id.\n- [ ] Use the existing environment field types from `fabro_types::settings::run` for dense API fields.\n- [ ] Use existing sparse `fabro_config::EnvironmentLayer` only for TOML input/output and conversion; do not create a second environment field vocabulary.\n- [ ] Add conversion helpers that resolve an `EnvironmentLayer` into dense `EnvironmentSettings` using the same provider/network/image validation rules as `fabro-config`.\n- [ ] Implement canonical TOML serialization for persisted files. Omit `id` and `revision`; the filename is the id and the file bytes determine revision.\n- [ ] Implement `EnvironmentStore` with `load_or_seed(dir)`, `list`, `get`, `create`, `replace`, `delete`, and `catalog_layer`.\n- [ ] Seed missing `default`, `local`, `docker`, and `daytona` files from the current built-in defaults. Do not overwrite existing files.\n- [ ] Protect `default` from deletion with a typed store error.\n- [ ] Resolve Dockerfile path references relative to the environment file directory during load and relative to the active settings directory during API create/replace. Store runtime values with inline Dockerfile content.\n- [ ] Add unit tests for loading an absent directory, seeding built-ins, sorted listing, invalid ids, invalid provider, invalid network mode, missing Dockerfile path, create conflict, replace stale revision, default delete rejection, delete success, and canonical revision changes.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-environment\n```\n\nExpected: all `fabro-environment` tests pass.\n\n## Task 2: Make Config Environments Migration-Only\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/parse.rs`\n- Modify: `lib/crates/fabro-config/src/builders.rs`\n- Modify: `lib/crates/fabro-config/src/load.rs`\n- Modify: `lib/crates/fabro-config/src/migrations.rs`\n- Create: `lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs`\n- Modify: `lib/crates/fabro-config/src/defaults.toml`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_run.rs`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_root.rs`\n\n- [ ] Keep `SettingsLayer.environments` in this pass so old files can parse and migrate, but remove environment catalog entries from `defaults.toml`.\n- [ ] Add source-aware validation that rejects `SettingsLayer.environments` for project, workflow, and direct run config layers with this message shape: `[environments.<id>] is now server-managed; move this definition to the server environments directory`.\n- [ ] Add validation that rejects TOML-provided `run.environment.image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, and `env`. Keep `run.environment.id`.\n- [ ] Ensure CLI/server argument layers can still set `run.environment.lifecycle.preserve` for `--preserve-sandbox`; the rejection applies only to parsed TOML sources.\n- [ ] Add a settings-file migration that extracts top-level `[environments.<id>]` entries from the active `settings.toml` into sibling `environments/<id>.toml` files.\n- [ ] Migration must write a backup before editing `settings.toml`, preserve `[run.environment] id`, remove the top-level `[environments]` table, and fail without changing files if any target environment file already exists.\n- [ ] Chain the existing legacy `[run.sandbox]` migration before the new extraction migration so legacy sandbox settings become a server `default` environment file.\n- [ ] Update run settings tests to assert that `RunSettingsBuilder` no longer resolves a selected environment without an injected server catalog.\n- [ ] Add tests proving project/workflow `[environments]` definitions produce targeted errors rather than silent ignores.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-config\n```\n\nExpected: config tests pass, including migration coverage.\n\n## Task 3: Wire EnvironmentStore Into Server Run Resolution\n\n**Files:**\n- Modify: `lib/crates/fabro-server/src/server.rs`\n- Modify: `lib/crates/fabro-server/src/serve.rs`\n- Modify: `lib/crates/fabro-server/src/run_manifest.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/runs.rs`\n- Modify: `lib/crates/fabro-server/src/manifest_validation.rs`\n- Modify: `lib/crates/fabro-server/src/test_support.rs`\n\n- [ ] Add `environment_store: Arc<EnvironmentStore>` to `AppState`, loaded from `active_config_path.parent().join(\"environments\")`.\n- [ ] Replace `manifest_environment_defaults` from `ServerRuntimeSettings` with `environment_store.catalog_layer()` when preparing manifests on the server.\n- [ ] Keep the dense run snapshot unchanged: `prepared.settings.run.environment` contains the resolved environment fields, and `prepared.settings.environments` contains the server catalog used for resolution.\n- [ ] Convert unknown environment ids into `400 Bad Request` during run creation/preflight/graph preparation.\n- [ ] Keep sandbox provider policy checks after environment resolution, so disabled providers still reject runs.\n- [ ] Apply `--preserve-sandbox` after selected environment resolution.\n- [ ] Remove server reliance on `[environments]` in `settings.toml`.\n- [ ] Update server test support so tests can inject environment files or use seeded defaults.\n- [ ] Add server tests for default environment run creation, custom server environment selection, unknown environment id, disabled provider policy, `--preserve-sandbox`, and rejected TOML environment field overrides.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server\n```\n\nExpected: server API and run-manifest tests pass.\n\n## Task 4: Add Environment CRUD API\n\n**Files:**\n- Modify: `docs/public/api-reference/fabro-api.yaml`\n- Modify: `lib/crates/fabro-api/build.rs`\n- Create: `lib/crates/fabro-server/src/server/handler/environments.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/mod.rs`\n- Add tests: `lib/crates/fabro-server/tests/it/api/environments.rs`\n- Update generated Rust and TypeScript API artifacts after spec changes.\n\n- [ ] Add OpenAPI tag `Environments`.\n- [ ] Add schemas for `Environment`, `CreateEnvironmentRequest`, `ReplaceEnvironmentRequest`, and `EnvironmentListResponse`.\n- [ ] Reuse existing environment schemas for provider/image/resources/network/lifecycle/volumes/env.\n- [ ] Add endpoints:\n  - `GET /api/v1/environments`\n  - `POST /api/v1/environments`\n  - `GET /api/v1/environments/{id}`\n  - `PUT /api/v1/environments/{id}`\n  - `DELETE /api/v1/environments/{id}`\n- [ ] Return `ETag` on retrieve and replace.\n- [ ] Require `If-Match` on replace and delete.\n- [ ] Map store errors to API responses:\n  - invalid id: `400`\n  - duplicate create: `409`\n  - stale revision: `409`\n  - validation error: `422`\n  - missing resource: `404`\n  - protected default delete: `409`\n  - persistence failure: `500`\n- [ ] Add route tests for empty-seeded list, create, retrieve with ETag, replace, stale replace, missing `If-Match`, delete, protected default delete, invalid provider, invalid CIDR, and missing Dockerfile path.\n- [ ] Regenerate `fabro-api` and TypeScript client artifacts.\n\nRun:\n\n```bash\ncargo build -p fabro-api\ncd lib/packages/fabro-api-client && bun run generate\ncargo nextest run -p fabro-server --test it -- api::environments\n```\n\nExpected: generated artifacts are updated and environment API tests pass.\n\n## Task 5: Adjust CLI And Manifest Behavior\n\n**Files:**\n- Modify: `lib/crates/fabro-cli/src/commands/run/overrides.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/preflight.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/graph.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/validate.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/repo/init.rs`\n- Modify: `lib/crates/fabro-manifest/src/lib.rs`\n- Modify CLI integration tests under `lib/crates/fabro-cli/tests/it/`\n\n- [ ] Reject `--docker-image` in run, create, preflight, graph, and validate commands with this message shape: `--docker-image is no longer supported; create or update a server environment and select it with --environment`.\n- [ ] Keep `--environment` as an id-only selector in manifest args.\n- [ ] Stop collecting Dockerfile path references from `[environments.<id>]` in project/workflow config because those definitions are invalid.\n- [ ] Keep collecting Dockerfile references for any remaining CLI-created run environment override only when it comes from allowed argument paths; with `--docker-image` rejected, no normal user path should add one.\n- [ ] Update local preflight/graph/validate flows so they either call server preflight for environment resolution or print a clear message that server-owned environment resolution requires a running server.\n- [ ] Update `fabro repo init` to write only `[run.environment] id = \"local\"` and no `[environments.local]` block.\n- [ ] Update CLI tests for manifest args, repo init output, rejected `--docker-image`, and server-owned environment selection.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-cli\n```\n\nExpected: CLI tests pass and no generated workflow config contains `[environments.*]`.\n\n## Task 6: Update Install, Docs, And Generated References\n\n**Files:**\n- Modify install persistence code in `lib/crates/fabro-cli/src/commands/install.rs` and server install handlers/tests.\n- Modify docs: `docs/public/execution/environments.mdx`, `docs/public/execution/run-configuration.mdx`, `docs/public/reference/user-configuration.mdx`, `docs/public/administration/server-configuration.mdx`, `docs/public/administration/sandboxing.mdx`, `docs/public/integrations/daytona.mdx`, and examples that currently define `[environments.<id>]`.\n- Modify generated settings reference if applicable.\n\n- [ ] Update install flows to write server environment files instead of `[environments.default]` into `settings.toml`.\n- [ ] Keep install-written `[run.environment] id = \"default\"` when a default run environment selection is still needed.\n- [ ] Update tests that assert `settings.toml` contains `[environments.default]` to assert the sibling environment file exists and settings no longer contains `[environments]`.\n- [ ] Rewrite public docs so environment definitions are server-owned TOML files and run configs only select ids.\n- [ ] Add a compatibility note explaining that project/workflow `[environments]` definitions now fail and must be moved to the server.\n- [ ] Keep `Settings > Environments` UI documentation out of this pass.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server --test it -- api::install\ncargo nextest run -p fabro-cli --test it\n```\n\nExpected: install tests pass and docs no longer present project/workflow environment definitions as valid.\n\n## Task 7: Workspace Verification\n\n**Files:**\n- No new files unless test snapshots require reviewed updates.\n\n- [ ] Run Rust formatting check:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\n```\n\n- [ ] Run clippy:\n\n```bash\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\n- [ ] Run workspace tests:\n\n```bash\ncargo nextest run --workspace\n```\n\n- [ ] Run TypeScript checks if API client changes affect the web package:\n\n```bash\ncd apps/fabro-web && bun run typecheck\ncd apps/fabro-web && bun test\n```\n\n- [ ] Inspect generated files and snapshots before accepting any snapshot changes.\n\n## Acceptance Criteria\n\n- Server startup creates or loads `environments/default.toml`, `local.toml`, `docker.toml`, and `daytona.toml`.\n- `GET /api/v1/environments` returns seeded environments with revisions.\n- API-created environments persist as TOML files and survive server restart.\n- Runs using `[run.environment] id = \"cloud\"` resolve from server files only.\n- Project/workflow/user `[environments.<id>]` definitions no longer affect runs.\n- Existing runs keep their dense environment snapshot after environment files change.\n- `--environment` still works.\n- `--preserve-sandbox` still works.\n- `--docker-image` no longer works and produces the targeted replacement guidance.\n- Web UI changes are not included.\n"
        },
        "model_stylesheet": {
          "String": "\n            * { model: claude-opus-4-7; }\n        "
        }
      }
    },
    "graph_source": "digraph ImplementPlan {\n    graph [\n        goal=\"Implement and simplify\",\n        model_stylesheet=\"\n            * { model: claude-opus-4-7; }\n        \"\n    ]\n    rankdir=LR\n\n    start [shape=Mdiamond, label=\"Start\"]\n    exit  [shape=Msquare, label=\"Exit\"]\n\n    toolchain         [label=\"Toolchain\", shape=parallelogram, script=\"command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1\", max_retries=0]\n    preflight_compile [label=\"Preflight Compile\", shape=parallelogram, script=\"cargo check -q --workspace 2>&1\", max_retries=0]\n    preflight_lint    [label=\"Preflight Lint\", shape=parallelogram, script=\"cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1\", max_retries=0]\n    fix_lints         [label=\"Fix Lints\", prompt=\"The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.\", max_visits=3]\n    implement         [label=\"Implement\", prompt=\"Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.\", model=\"gpt-55\", reasoning_effort=\"xhigh\"]\n    simplify_opus     [label=\"Simplify (Opus)\", prompt=\"@prompts/simplify.md\"]\n    simplify_gpt      [label=\"Simplify (GPT-55)\", prompt=\"@prompts/simplify.md\", model=\"gpt-55\"]\n    verify            [label=\"Verify\", shape=parallelogram, script=\"git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\\bActorRef\\b|\\bActorKind\\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\\s*==\\s*\\\"disabled\\\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1\", goal_gate=true, retry_target=\"fixup\"]\n    fixup             [label=\"Fixup\", prompt=\"The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.\", max_visits=3]\n\n    start -> toolchain\n    toolchain -> preflight_compile [condition=\"outcome=succeeded\"]\n    toolchain -> exit\n    preflight_compile -> preflight_lint [condition=\"outcome=succeeded\"]\n    preflight_compile -> exit\n    preflight_lint -> implement [condition=\"outcome=succeeded\"]\n    preflight_lint -> fix_lints\n    fix_lints -> preflight_lint\n    implement -> simplify_opus -> simplify_gpt -> verify\n    verify -> exit  [condition=\"outcome=succeeded\"]\n    verify -> fixup\n    fixup -> verify\n}\n",
    "workflow_slug": "implement-plan",
    "source_directory": "/Users/bhelmkamp/p/fabro-sh/fabro",
    "provenance": {
      "server": {
        "version": "0.246.0-nightly.0"
      },
      "client": {
        "user_agent": "fabro-cli/0.246.0-nightly.0",
        "name": "fabro-cli",
        "version": "0.246.0-nightly.0"
      },
      "subject": {
        "kind": "user",
        "identity": {
          "issuer": "https://github.com",
          "subject": "19"
        },
        "login": "brynary",
        "auth_method": "github",
        "avatar_url": "https://avatars.githubusercontent.com/u/19?v=4"
      }
    },
    "manifest_blob": "a9c26068bbd11770f63cc244b880f07cb10fb353c02bd4f16d27ca70c160ee1f",
    "definition_blob": "303626c83b308220ef99468ae5d93ca4e254084c746b7c13fb24072fe5b0bfb2",
    "git": {
      "origin_url": "https://github.com/fabro-sh/fabro",
      "branch": "main",
      "sha": "faf82c9e28d9c256fe467fee4d86947835b818ba",
      "dirty": "dirty",
      "push_outcome": {
        "type": "failed",
        "remote": "origin",
        "branch": "main",
        "message": "Engine error: git push failed: To github.com:fabro-sh/fabro.git\n ! [rejected]            main -> main (fetch first)\nerror: failed to push some refs to 'github.com:fabro-sh/fabro.git'\nhint: Updates were rejected because the remote contains work that you do not\nhint: have locally. This is usually caused by another repository pushing to\nhint: the same ref. If you want to integrate the remote changes, use\nhint: 'git pull' before pushing again.\nhint: See the 'Note about fast-forwards' in 'git push --help' for details.\n"
      }
    }
  },
  "web_url": "http://127.0.0.1:32276/runs/01KSPDE8E9ATTVY1VBCS3YRBHT",
  "start": {
    "start_time": "2026-05-28T04:28:33.524469Z",
    "run_branch": "fabro/run/01KSPDE8E9ATTVY1VBCS3YRBHT",
    "base_sha": "31a990c4dc71b8951ce6a937bdd74157871cdaca"
  },
  "status": {
    "kind": "running"
  },
  "status_updated_at": "2026-05-28T04:28:33.524509Z",
  "last_event_at": "2026-05-28T06:46:59.271792Z",
  "pending_control": null,
  "checkpoints": [
    {
      "seq": 20,
      "checkpoint": {
        "timestamp": "2026-05-28T04:28:35.445652Z",
        "current_node": "start",
        "completed_nodes": [
          "start"
        ],
        "node_retries": {},
        "context_values": {
          "internal.run_id": "01KSPDE8E9ATTVY1VBCS3YRBHT",
          "internal.retry_count.start": 0,
          "current_node": "start",
          "graph.goal": "# Server-Owned Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Move environment definitions from layered run settings into server-owned TOML resources with CRUD API management, matching the Automation store pattern.\n\n**Architecture:** Add a concrete `EnvironmentStore` that loads one environment TOML file per id from a sibling `environments/` directory next to the active server settings file. Runs continue to select an environment by id through `[run.environment]` or `--environment`, but server-side run creation resolves the id from `EnvironmentStore`; project/workflow/user config can no longer define environment catalogs or environment field overrides. The web UI is intentionally deferred.\n\n**Tech Stack:** Rust, Axum, serde/TOML, `toml_edit`, Tokio file I/O, OpenAPI/progenitor, generated TypeScript API client, cargo-nextest.\n\n---\n\n## File Structure\n\n- Create `lib/crates/fabro-environment/`: environment ids, revisions, API/domain DTOs, TOML persistence, canonicalization, validation, and `EnvironmentStore`.\n- Modify workspace manifests: root `Cargo.toml`, `lib/crates/fabro-server/Cargo.toml`, `lib/crates/fabro-api/build.rs`, and generated API/client package files.\n- Modify `lib/crates/fabro-server/src/server.rs`, `lib/crates/fabro-server/src/server/handler/mod.rs`, and a new `lib/crates/fabro-server/src/server/handler/environments.rs` to wire the store and API.\n- Modify `lib/crates/fabro-config/src/builders.rs`, `lib/crates/fabro-config/src/load.rs`, `lib/crates/fabro-config/src/migrations.rs`, and config tests to treat `[environments]` as migration-only, not runtime configuration.\n- Modify `lib/crates/fabro-manifest/src/lib.rs`, `lib/crates/fabro-server/src/run_manifest.rs`, and CLI run/preflight/graph/validate paths so environment ids are resolved only by the server.\n- Modify install/repo-init/docs/OpenAPI artifacts so new examples use server environment files and run configs only select ids.\n\n## Decisions\n\n- Environment definitions are server-owned operator policy. Project and workflow files may request an id but cannot define or override environment fields.\n- `default`, `local`, `docker`, and `daytona` are seeded if missing. Existing files are never overwritten.\n- `default` is protected from deletion. Other seeded files can be edited or deleted.\n- Environment ids use `[a-z0-9][a-z0-9-]{0,62}`.\n- Environment revisions are SHA-256 hashes of the persisted TOML bytes, returned in JSON as `revision` and in `ETag`.\n- `PUT` and `DELETE` require `If-Match`, following `AutomationStore`.\n- `image.dockerfile = { path = \"Dockerfile\" }` is accepted in persisted files and API input, resolved relative to the environment file or request context, and converted to inline content for runtime use. API writes canonical inline TOML.\n- `--preserve-sandbox` remains a CLI/server argument override. TOML `[run.environment.lifecycle]` is rejected.\n- `--docker-image` is rejected with a targeted message directing operators to create or update a server environment.\n- Existing dense `WorkflowSettings.environments` stays in the API for compatibility and is populated from the server environment catalog during run resolution.\n\n## Task 1: Add `fabro-environment` Store Crate\n\n**Files:**\n- Create: `lib/crates/fabro-environment/Cargo.toml`\n- Create: `lib/crates/fabro-environment/src/lib.rs`\n- Create: `lib/crates/fabro-environment/src/id.rs`\n- Create: `lib/crates/fabro-environment/src/model.rs`\n- Create: `lib/crates/fabro-environment/src/store.rs`\n- Create: `lib/crates/fabro-environment/src/error.rs`\n- Modify: root `Cargo.toml`\n\n- [ ] Create a workspace crate named `fabro-environment`, modeled after `fabro-automation`.\n- [ ] Define `EnvironmentId`, `EnvironmentRevision`, and parse/validation errors.\n- [ ] Define public DTOs:\n  - `Environment`: `id`, `revision`, `provider`, `image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, `env`.\n  - `EnvironmentDraft`: `id` plus environment fields.\n  - `EnvironmentReplace`: environment fields without id.\n- [ ] Use the existing environment field types from `fabro_types::settings::run` for dense API fields.\n- [ ] Use existing sparse `fabro_config::EnvironmentLayer` only for TOML input/output and conversion; do not create a second environment field vocabulary.\n- [ ] Add conversion helpers that resolve an `EnvironmentLayer` into dense `EnvironmentSettings` using the same provider/network/image validation rules as `fabro-config`.\n- [ ] Implement canonical TOML serialization for persisted files. Omit `id` and `revision`; the filename is the id and the file bytes determine revision.\n- [ ] Implement `EnvironmentStore` with `load_or_seed(dir)`, `list`, `get`, `create`, `replace`, `delete`, and `catalog_layer`.\n- [ ] Seed missing `default`, `local`, `docker`, and `daytona` files from the current built-in defaults. Do not overwrite existing files.\n- [ ] Protect `default` from deletion with a typed store error.\n- [ ] Resolve Dockerfile path references relative to the environment file directory during load and relative to the active settings directory during API create/replace. Store runtime values with inline Dockerfile content.\n- [ ] Add unit tests for loading an absent directory, seeding built-ins, sorted listing, invalid ids, invalid provider, invalid network mode, missing Dockerfile path, create conflict, replace stale revision, default delete rejection, delete success, and canonical revision changes.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-environment\n```\n\nExpected: all `fabro-environment` tests pass.\n\n## Task 2: Make Config Environments Migration-Only\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/parse.rs`\n- Modify: `lib/crates/fabro-config/src/builders.rs`\n- Modify: `lib/crates/fabro-config/src/load.rs`\n- Modify: `lib/crates/fabro-config/src/migrations.rs`\n- Create: `lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs`\n- Modify: `lib/crates/fabro-config/src/defaults.toml`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_run.rs`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_root.rs`\n\n- [ ] Keep `SettingsLayer.environments` in this pass so old files can parse and migrate, but remove environment catalog entries from `defaults.toml`.\n- [ ] Add source-aware validation that rejects `SettingsLayer.environments` for project, workflow, and direct run config layers with this message shape: `[environments.<id>] is now server-managed; move this definition to the server environments directory`.\n- [ ] Add validation that rejects TOML-provided `run.environment.image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, and `env`. Keep `run.environment.id`.\n- [ ] Ensure CLI/server argument layers can still set `run.environment.lifecycle.preserve` for `--preserve-sandbox`; the rejection applies only to parsed TOML sources.\n- [ ] Add a settings-file migration that extracts top-level `[environments.<id>]` entries from the active `settings.toml` into sibling `environments/<id>.toml` files.\n- [ ] Migration must write a backup before editing `settings.toml`, preserve `[run.environment] id`, remove the top-level `[environments]` table, and fail without changing files if any target environment file already exists.\n- [ ] Chain the existing legacy `[run.sandbox]` migration before the new extraction migration so legacy sandbox settings become a server `default` environment file.\n- [ ] Update run settings tests to assert that `RunSettingsBuilder` no longer resolves a selected environment without an injected server catalog.\n- [ ] Add tests proving project/workflow `[environments]` definitions produce targeted errors rather than silent ignores.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-config\n```\n\nExpected: config tests pass, including migration coverage.\n\n## Task 3: Wire EnvironmentStore Into Server Run Resolution\n\n**Files:**\n- Modify: `lib/crates/fabro-server/src/server.rs`\n- Modify: `lib/crates/fabro-server/src/serve.rs`\n- Modify: `lib/crates/fabro-server/src/run_manifest.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/runs.rs`\n- Modify: `lib/crates/fabro-server/src/manifest_validation.rs`\n- Modify: `lib/crates/fabro-server/src/test_support.rs`\n\n- [ ] Add `environment_store: Arc<EnvironmentStore>` to `AppState`, loaded from `active_config_path.parent().join(\"environments\")`.\n- [ ] Replace `manifest_environment_defaults` from `ServerRuntimeSettings` with `environment_store.catalog_layer()` when preparing manifests on the server.\n- [ ] Keep the dense run snapshot unchanged: `prepared.settings.run.environment` contains the resolved environment fields, and `prepared.settings.environments` contains the server catalog used for resolution.\n- [ ] Convert unknown environment ids into `400 Bad Request` during run creation/preflight/graph preparation.\n- [ ] Keep sandbox provider policy checks after environment resolution, so disabled providers still reject runs.\n- [ ] Apply `--preserve-sandbox` after selected environment resolution.\n- [ ] Remove server reliance on `[environments]` in `settings.toml`.\n- [ ] Update server test support so tests can inject environment files or use seeded defaults.\n- [ ] Add server tests for default environment run creation, custom server environment selection, unknown environment id, disabled provider policy, `--preserve-sandbox`, and rejected TOML environment field overrides.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server\n```\n\nExpected: server API and run-manifest tests pass.\n\n## Task 4: Add Environment CRUD API\n\n**Files:**\n- Modify: `docs/public/api-reference/fabro-api.yaml`\n- Modify: `lib/crates/fabro-api/build.rs`\n- Create: `lib/crates/fabro-server/src/server/handler/environments.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/mod.rs`\n- Add tests: `lib/crates/fabro-server/tests/it/api/environments.rs`\n- Update generated Rust and TypeScript API artifacts after spec changes.\n\n- [ ] Add OpenAPI tag `Environments`.\n- [ ] Add schemas for `Environment`, `CreateEnvironmentRequest`, `ReplaceEnvironmentRequest`, and `EnvironmentListResponse`.\n- [ ] Reuse existing environment schemas for provider/image/resources/network/lifecycle/volumes/env.\n- [ ] Add endpoints:\n  - `GET /api/v1/environments`\n  - `POST /api/v1/environments`\n  - `GET /api/v1/environments/{id}`\n  - `PUT /api/v1/environments/{id}`\n  - `DELETE /api/v1/environments/{id}`\n- [ ] Return `ETag` on retrieve and replace.\n- [ ] Require `If-Match` on replace and delete.\n- [ ] Map store errors to API responses:\n  - invalid id: `400`\n  - duplicate create: `409`\n  - stale revision: `409`\n  - validation error: `422`\n  - missing resource: `404`\n  - protected default delete: `409`\n  - persistence failure: `500`\n- [ ] Add route tests for empty-seeded list, create, retrieve with ETag, replace, stale replace, missing `If-Match`, delete, protected default delete, invalid provider, invalid CIDR, and missing Dockerfile path.\n- [ ] Regenerate `fabro-api` and TypeScript client artifacts.\n\nRun:\n\n```bash\ncargo build -p fabro-api\ncd lib/packages/fabro-api-client && bun run generate\ncargo nextest run -p fabro-server --test it -- api::environments\n```\n\nExpected: generated artifacts are updated and environment API tests pass.\n\n## Task 5: Adjust CLI And Manifest Behavior\n\n**Files:**\n- Modify: `lib/crates/fabro-cli/src/commands/run/overrides.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/preflight.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/graph.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/validate.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/repo/init.rs`\n- Modify: `lib/crates/fabro-manifest/src/lib.rs`\n- Modify CLI integration tests under `lib/crates/fabro-cli/tests/it/`\n\n- [ ] Reject `--docker-image` in run, create, preflight, graph, and validate commands with this message shape: `--docker-image is no longer supported; create or update a server environment and select it with --environment`.\n- [ ] Keep `--environment` as an id-only selector in manifest args.\n- [ ] Stop collecting Dockerfile path references from `[environments.<id>]` in project/workflow config because those definitions are invalid.\n- [ ] Keep collecting Dockerfile references for any remaining CLI-created run environment override only when it comes from allowed argument paths; with `--docker-image` rejected, no normal user path should add one.\n- [ ] Update local preflight/graph/validate flows so they either call server preflight for environment resolution or print a clear message that server-owned environment resolution requires a running server.\n- [ ] Update `fabro repo init` to write only `[run.environment] id = \"local\"` and no `[environments.local]` block.\n- [ ] Update CLI tests for manifest args, repo init output, rejected `--docker-image`, and server-owned environment selection.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-cli\n```\n\nExpected: CLI tests pass and no generated workflow config contains `[environments.*]`.\n\n## Task 6: Update Install, Docs, And Generated References\n\n**Files:**\n- Modify install persistence code in `lib/crates/fabro-cli/src/commands/install.rs` and server install handlers/tests.\n- Modify docs: `docs/public/execution/environments.mdx`, `docs/public/execution/run-configuration.mdx`, `docs/public/reference/user-configuration.mdx`, `docs/public/administration/server-configuration.mdx`, `docs/public/administration/sandboxing.mdx`, `docs/public/integrations/daytona.mdx`, and examples that currently define `[environments.<id>]`.\n- Modify generated settings reference if applicable.\n\n- [ ] Update install flows to write server environment files instead of `[environments.default]` into `settings.toml`.\n- [ ] Keep install-written `[run.environment] id = \"default\"` when a default run environment selection is still needed.\n- [ ] Update tests that assert `settings.toml` contains `[environments.default]` to assert the sibling environment file exists and settings no longer contains `[environments]`.\n- [ ] Rewrite public docs so environment definitions are server-owned TOML files and run configs only select ids.\n- [ ] Add a compatibility note explaining that project/workflow `[environments]` definitions now fail and must be moved to the server.\n- [ ] Keep `Settings > Environments` UI documentation out of this pass.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server --test it -- api::install\ncargo nextest run -p fabro-cli --test it\n```\n\nExpected: install tests pass and docs no longer present project/workflow environment definitions as valid.\n\n## Task 7: Workspace Verification\n\n**Files:**\n- No new files unless test snapshots require reviewed updates.\n\n- [ ] Run Rust formatting check:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\n```\n\n- [ ] Run clippy:\n\n```bash\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\n- [ ] Run workspace tests:\n\n```bash\ncargo nextest run --workspace\n```\n\n- [ ] Run TypeScript checks if API client changes affect the web package:\n\n```bash\ncd apps/fabro-web && bun run typecheck\ncd apps/fabro-web && bun test\n```\n\n- [ ] Inspect generated files and snapshots before accepting any snapshot changes.\n\n## Acceptance Criteria\n\n- Server startup creates or loads `environments/default.toml`, `local.toml`, `docker.toml`, and `daytona.toml`.\n- `GET /api/v1/environments` returns seeded environments with revisions.\n- API-created environments persist as TOML files and survive server restart.\n- Runs using `[run.environment] id = \"cloud\"` resolve from server files only.\n- Project/workflow/user `[environments.<id>]` definitions no longer affect runs.\n- Existing runs keep their dense environment snapshot after environment files change.\n- `--environment` still works.\n- `--preserve-sandbox` still works.\n- `--docker-image` no longer works and produces the targeted replacement guidance.\n- Web UI changes are not included.\n",
          "outcome": "succeeded",
          "internal.thread_id": null,
          "graph.rankdir": "LR",
          "internal.fidelity": "compact",
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "failure_class": "",
          "failure_signature": "",
          "internal.node_visit_count": 1,
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        "
        },
        "node_outcomes": {
          "start": {
            "status": "succeeded",
            "usage": null
          }
        },
        "next_node_id": "toolchain",
        "node_visits": {
          "start": 1
        }
      },
      "diff": {}
    },
    {
      "seq": 28,
      "checkpoint": {
        "timestamp": "2026-05-28T04:28:40.323427Z",
        "current_node": "toolchain",
        "completed_nodes": [
          "start",
          "toolchain"
        ],
        "node_retries": {},
        "context_values": {
          "internal.retry_count.toolchain": 0,
          "current_node": "toolchain",
          "internal.retry_count.start": 0,
          "failure_class": "",
          "internal.run_id": "01KSPDE8E9ATTVY1VBCS3YRBHT",
          "graph.rankdir": "LR",
          "outcome": "succeeded",
          "internal.thread_id": "start",
          "failure_signature": "",
          "internal.fidelity": "compact",
          "internal.node_visit_count": 1,
          "graph.goal": "# Server-Owned Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Move environment definitions from layered run settings into server-owned TOML resources with CRUD API management, matching the Automation store pattern.\n\n**Architecture:** Add a concrete `EnvironmentStore` that loads one environment TOML file per id from a sibling `environments/` directory next to the active server settings file. Runs continue to select an environment by id through `[run.environment]` or `--environment`, but server-side run creation resolves the id from `EnvironmentStore`; project/workflow/user config can no longer define environment catalogs or environment field overrides. The web UI is intentionally deferred.\n\n**Tech Stack:** Rust, Axum, serde/TOML, `toml_edit`, Tokio file I/O, OpenAPI/progenitor, generated TypeScript API client, cargo-nextest.\n\n---\n\n## File Structure\n\n- Create `lib/crates/fabro-environment/`: environment ids, revisions, API/domain DTOs, TOML persistence, canonicalization, validation, and `EnvironmentStore`.\n- Modify workspace manifests: root `Cargo.toml`, `lib/crates/fabro-server/Cargo.toml`, `lib/crates/fabro-api/build.rs`, and generated API/client package files.\n- Modify `lib/crates/fabro-server/src/server.rs`, `lib/crates/fabro-server/src/server/handler/mod.rs`, and a new `lib/crates/fabro-server/src/server/handler/environments.rs` to wire the store and API.\n- Modify `lib/crates/fabro-config/src/builders.rs`, `lib/crates/fabro-config/src/load.rs`, `lib/crates/fabro-config/src/migrations.rs`, and config tests to treat `[environments]` as migration-only, not runtime configuration.\n- Modify `lib/crates/fabro-manifest/src/lib.rs`, `lib/crates/fabro-server/src/run_manifest.rs`, and CLI run/preflight/graph/validate paths so environment ids are resolved only by the server.\n- Modify install/repo-init/docs/OpenAPI artifacts so new examples use server environment files and run configs only select ids.\n\n## Decisions\n\n- Environment definitions are server-owned operator policy. Project and workflow files may request an id but cannot define or override environment fields.\n- `default`, `local`, `docker`, and `daytona` are seeded if missing. Existing files are never overwritten.\n- `default` is protected from deletion. Other seeded files can be edited or deleted.\n- Environment ids use `[a-z0-9][a-z0-9-]{0,62}`.\n- Environment revisions are SHA-256 hashes of the persisted TOML bytes, returned in JSON as `revision` and in `ETag`.\n- `PUT` and `DELETE` require `If-Match`, following `AutomationStore`.\n- `image.dockerfile = { path = \"Dockerfile\" }` is accepted in persisted files and API input, resolved relative to the environment file or request context, and converted to inline content for runtime use. API writes canonical inline TOML.\n- `--preserve-sandbox` remains a CLI/server argument override. TOML `[run.environment.lifecycle]` is rejected.\n- `--docker-image` is rejected with a targeted message directing operators to create or update a server environment.\n- Existing dense `WorkflowSettings.environments` stays in the API for compatibility and is populated from the server environment catalog during run resolution.\n\n## Task 1: Add `fabro-environment` Store Crate\n\n**Files:**\n- Create: `lib/crates/fabro-environment/Cargo.toml`\n- Create: `lib/crates/fabro-environment/src/lib.rs`\n- Create: `lib/crates/fabro-environment/src/id.rs`\n- Create: `lib/crates/fabro-environment/src/model.rs`\n- Create: `lib/crates/fabro-environment/src/store.rs`\n- Create: `lib/crates/fabro-environment/src/error.rs`\n- Modify: root `Cargo.toml`\n\n- [ ] Create a workspace crate named `fabro-environment`, modeled after `fabro-automation`.\n- [ ] Define `EnvironmentId`, `EnvironmentRevision`, and parse/validation errors.\n- [ ] Define public DTOs:\n  - `Environment`: `id`, `revision`, `provider`, `image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, `env`.\n  - `EnvironmentDraft`: `id` plus environment fields.\n  - `EnvironmentReplace`: environment fields without id.\n- [ ] Use the existing environment field types from `fabro_types::settings::run` for dense API fields.\n- [ ] Use existing sparse `fabro_config::EnvironmentLayer` only for TOML input/output and conversion; do not create a second environment field vocabulary.\n- [ ] Add conversion helpers that resolve an `EnvironmentLayer` into dense `EnvironmentSettings` using the same provider/network/image validation rules as `fabro-config`.\n- [ ] Implement canonical TOML serialization for persisted files. Omit `id` and `revision`; the filename is the id and the file bytes determine revision.\n- [ ] Implement `EnvironmentStore` with `load_or_seed(dir)`, `list`, `get`, `create`, `replace`, `delete`, and `catalog_layer`.\n- [ ] Seed missing `default`, `local`, `docker`, and `daytona` files from the current built-in defaults. Do not overwrite existing files.\n- [ ] Protect `default` from deletion with a typed store error.\n- [ ] Resolve Dockerfile path references relative to the environment file directory during load and relative to the active settings directory during API create/replace. Store runtime values with inline Dockerfile content.\n- [ ] Add unit tests for loading an absent directory, seeding built-ins, sorted listing, invalid ids, invalid provider, invalid network mode, missing Dockerfile path, create conflict, replace stale revision, default delete rejection, delete success, and canonical revision changes.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-environment\n```\n\nExpected: all `fabro-environment` tests pass.\n\n## Task 2: Make Config Environments Migration-Only\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/parse.rs`\n- Modify: `lib/crates/fabro-config/src/builders.rs`\n- Modify: `lib/crates/fabro-config/src/load.rs`\n- Modify: `lib/crates/fabro-config/src/migrations.rs`\n- Create: `lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs`\n- Modify: `lib/crates/fabro-config/src/defaults.toml`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_run.rs`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_root.rs`\n\n- [ ] Keep `SettingsLayer.environments` in this pass so old files can parse and migrate, but remove environment catalog entries from `defaults.toml`.\n- [ ] Add source-aware validation that rejects `SettingsLayer.environments` for project, workflow, and direct run config layers with this message shape: `[environments.<id>] is now server-managed; move this definition to the server environments directory`.\n- [ ] Add validation that rejects TOML-provided `run.environment.image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, and `env`. Keep `run.environment.id`.\n- [ ] Ensure CLI/server argument layers can still set `run.environment.lifecycle.preserve` for `--preserve-sandbox`; the rejection applies only to parsed TOML sources.\n- [ ] Add a settings-file migration that extracts top-level `[environments.<id>]` entries from the active `settings.toml` into sibling `environments/<id>.toml` files.\n- [ ] Migration must write a backup before editing `settings.toml`, preserve `[run.environment] id`, remove the top-level `[environments]` table, and fail without changing files if any target environment file already exists.\n- [ ] Chain the existing legacy `[run.sandbox]` migration before the new extraction migration so legacy sandbox settings become a server `default` environment file.\n- [ ] Update run settings tests to assert that `RunSettingsBuilder` no longer resolves a selected environment without an injected server catalog.\n- [ ] Add tests proving project/workflow `[environments]` definitions produce targeted errors rather than silent ignores.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-config\n```\n\nExpected: config tests pass, including migration coverage.\n\n## Task 3: Wire EnvironmentStore Into Server Run Resolution\n\n**Files:**\n- Modify: `lib/crates/fabro-server/src/server.rs`\n- Modify: `lib/crates/fabro-server/src/serve.rs`\n- Modify: `lib/crates/fabro-server/src/run_manifest.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/runs.rs`\n- Modify: `lib/crates/fabro-server/src/manifest_validation.rs`\n- Modify: `lib/crates/fabro-server/src/test_support.rs`\n\n- [ ] Add `environment_store: Arc<EnvironmentStore>` to `AppState`, loaded from `active_config_path.parent().join(\"environments\")`.\n- [ ] Replace `manifest_environment_defaults` from `ServerRuntimeSettings` with `environment_store.catalog_layer()` when preparing manifests on the server.\n- [ ] Keep the dense run snapshot unchanged: `prepared.settings.run.environment` contains the resolved environment fields, and `prepared.settings.environments` contains the server catalog used for resolution.\n- [ ] Convert unknown environment ids into `400 Bad Request` during run creation/preflight/graph preparation.\n- [ ] Keep sandbox provider policy checks after environment resolution, so disabled providers still reject runs.\n- [ ] Apply `--preserve-sandbox` after selected environment resolution.\n- [ ] Remove server reliance on `[environments]` in `settings.toml`.\n- [ ] Update server test support so tests can inject environment files or use seeded defaults.\n- [ ] Add server tests for default environment run creation, custom server environment selection, unknown environment id, disabled provider policy, `--preserve-sandbox`, and rejected TOML environment field overrides.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server\n```\n\nExpected: server API and run-manifest tests pass.\n\n## Task 4: Add Environment CRUD API\n\n**Files:**\n- Modify: `docs/public/api-reference/fabro-api.yaml`\n- Modify: `lib/crates/fabro-api/build.rs`\n- Create: `lib/crates/fabro-server/src/server/handler/environments.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/mod.rs`\n- Add tests: `lib/crates/fabro-server/tests/it/api/environments.rs`\n- Update generated Rust and TypeScript API artifacts after spec changes.\n\n- [ ] Add OpenAPI tag `Environments`.\n- [ ] Add schemas for `Environment`, `CreateEnvironmentRequest`, `ReplaceEnvironmentRequest`, and `EnvironmentListResponse`.\n- [ ] Reuse existing environment schemas for provider/image/resources/network/lifecycle/volumes/env.\n- [ ] Add endpoints:\n  - `GET /api/v1/environments`\n  - `POST /api/v1/environments`\n  - `GET /api/v1/environments/{id}`\n  - `PUT /api/v1/environments/{id}`\n  - `DELETE /api/v1/environments/{id}`\n- [ ] Return `ETag` on retrieve and replace.\n- [ ] Require `If-Match` on replace and delete.\n- [ ] Map store errors to API responses:\n  - invalid id: `400`\n  - duplicate create: `409`\n  - stale revision: `409`\n  - validation error: `422`\n  - missing resource: `404`\n  - protected default delete: `409`\n  - persistence failure: `500`\n- [ ] Add route tests for empty-seeded list, create, retrieve with ETag, replace, stale replace, missing `If-Match`, delete, protected default delete, invalid provider, invalid CIDR, and missing Dockerfile path.\n- [ ] Regenerate `fabro-api` and TypeScript client artifacts.\n\nRun:\n\n```bash\ncargo build -p fabro-api\ncd lib/packages/fabro-api-client && bun run generate\ncargo nextest run -p fabro-server --test it -- api::environments\n```\n\nExpected: generated artifacts are updated and environment API tests pass.\n\n## Task 5: Adjust CLI And Manifest Behavior\n\n**Files:**\n- Modify: `lib/crates/fabro-cli/src/commands/run/overrides.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/preflight.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/graph.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/validate.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/repo/init.rs`\n- Modify: `lib/crates/fabro-manifest/src/lib.rs`\n- Modify CLI integration tests under `lib/crates/fabro-cli/tests/it/`\n\n- [ ] Reject `--docker-image` in run, create, preflight, graph, and validate commands with this message shape: `--docker-image is no longer supported; create or update a server environment and select it with --environment`.\n- [ ] Keep `--environment` as an id-only selector in manifest args.\n- [ ] Stop collecting Dockerfile path references from `[environments.<id>]` in project/workflow config because those definitions are invalid.\n- [ ] Keep collecting Dockerfile references for any remaining CLI-created run environment override only when it comes from allowed argument paths; with `--docker-image` rejected, no normal user path should add one.\n- [ ] Update local preflight/graph/validate flows so they either call server preflight for environment resolution or print a clear message that server-owned environment resolution requires a running server.\n- [ ] Update `fabro repo init` to write only `[run.environment] id = \"local\"` and no `[environments.local]` block.\n- [ ] Update CLI tests for manifest args, repo init output, rejected `--docker-image`, and server-owned environment selection.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-cli\n```\n\nExpected: CLI tests pass and no generated workflow config contains `[environments.*]`.\n\n## Task 6: Update Install, Docs, And Generated References\n\n**Files:**\n- Modify install persistence code in `lib/crates/fabro-cli/src/commands/install.rs` and server install handlers/tests.\n- Modify docs: `docs/public/execution/environments.mdx`, `docs/public/execution/run-configuration.mdx`, `docs/public/reference/user-configuration.mdx`, `docs/public/administration/server-configuration.mdx`, `docs/public/administration/sandboxing.mdx`, `docs/public/integrations/daytona.mdx`, and examples that currently define `[environments.<id>]`.\n- Modify generated settings reference if applicable.\n\n- [ ] Update install flows to write server environment files instead of `[environments.default]` into `settings.toml`.\n- [ ] Keep install-written `[run.environment] id = \"default\"` when a default run environment selection is still needed.\n- [ ] Update tests that assert `settings.toml` contains `[environments.default]` to assert the sibling environment file exists and settings no longer contains `[environments]`.\n- [ ] Rewrite public docs so environment definitions are server-owned TOML files and run configs only select ids.\n- [ ] Add a compatibility note explaining that project/workflow `[environments]` definitions now fail and must be moved to the server.\n- [ ] Keep `Settings > Environments` UI documentation out of this pass.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server --test it -- api::install\ncargo nextest run -p fabro-cli --test it\n```\n\nExpected: install tests pass and docs no longer present project/workflow environment definitions as valid.\n\n## Task 7: Workspace Verification\n\n**Files:**\n- No new files unless test snapshots require reviewed updates.\n\n- [ ] Run Rust formatting check:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\n```\n\n- [ ] Run clippy:\n\n```bash\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\n- [ ] Run workspace tests:\n\n```bash\ncargo nextest run --workspace\n```\n\n- [ ] Run TypeScript checks if API client changes affect the web package:\n\n```bash\ncd apps/fabro-web && bun run typecheck\ncd apps/fabro-web && bun test\n```\n\n- [ ] Inspect generated files and snapshots before accepting any snapshot changes.\n\n## Acceptance Criteria\n\n- Server startup creates or loads `environments/default.toml`, `local.toml`, `docker.toml`, and `daytona.toml`.\n- `GET /api/v1/environments` returns seeded environments with revisions.\n- API-created environments persist as TOML files and survive server restart.\n- Runs using `[run.environment] id = \"cloud\"` resolve from server files only.\n- Project/workflow/user `[environments.<id>]` definitions no longer affect runs.\n- Existing runs keep their dense environment snapshot after environment files change.\n- `--environment` still works.\n- `--preserve-sandbox` still works.\n- `--docker-image` no longer works and produces the targeted replacement guidance.\n- Web UI changes are not included.\n",
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "thread.start.current_node": "toolchain",
          "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c",
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        "
        },
        "node_outcomes": {
          "toolchain": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
            },
            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 1316,
              "active_time_ms": 1316
            }
          },
          "start": {
            "status": "succeeded",
            "usage": null
          }
        },
        "next_node_id": "preflight_compile",
        "git_commit_sha": "e999dfedb06bc288ff1ddfc534790187b6412567",
        "node_visits": {
          "start": 1,
          "toolchain": 1
        }
      },
      "diff": {
        "summary": {
          "files_changed": 0,
          "additions": 0,
          "deletions": 0
        }
      }
    },
    {
      "seq": 38,
      "checkpoint": {
        "timestamp": "2026-05-28T04:30:55.466431Z",
        "current_node": "preflight_compile",
        "completed_nodes": [
          "start",
          "toolchain",
          "preflight_compile"
        ],
        "node_retries": {},
        "context_values": {
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
          "internal.fidelity": "compact",
          "failure_class": "",
          "thread.start.current_node": "toolchain",
          "failure_signature": "",
          "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126",
          "outcome": "succeeded",
          "graph.goal": "# Server-Owned Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Move environment definitions from layered run settings into server-owned TOML resources with CRUD API management, matching the Automation store pattern.\n\n**Architecture:** Add a concrete `EnvironmentStore` that loads one environment TOML file per id from a sibling `environments/` directory next to the active server settings file. Runs continue to select an environment by id through `[run.environment]` or `--environment`, but server-side run creation resolves the id from `EnvironmentStore`; project/workflow/user config can no longer define environment catalogs or environment field overrides. The web UI is intentionally deferred.\n\n**Tech Stack:** Rust, Axum, serde/TOML, `toml_edit`, Tokio file I/O, OpenAPI/progenitor, generated TypeScript API client, cargo-nextest.\n\n---\n\n## File Structure\n\n- Create `lib/crates/fabro-environment/`: environment ids, revisions, API/domain DTOs, TOML persistence, canonicalization, validation, and `EnvironmentStore`.\n- Modify workspace manifests: root `Cargo.toml`, `lib/crates/fabro-server/Cargo.toml`, `lib/crates/fabro-api/build.rs`, and generated API/client package files.\n- Modify `lib/crates/fabro-server/src/server.rs`, `lib/crates/fabro-server/src/server/handler/mod.rs`, and a new `lib/crates/fabro-server/src/server/handler/environments.rs` to wire the store and API.\n- Modify `lib/crates/fabro-config/src/builders.rs`, `lib/crates/fabro-config/src/load.rs`, `lib/crates/fabro-config/src/migrations.rs`, and config tests to treat `[environments]` as migration-only, not runtime configuration.\n- Modify `lib/crates/fabro-manifest/src/lib.rs`, `lib/crates/fabro-server/src/run_manifest.rs`, and CLI run/preflight/graph/validate paths so environment ids are resolved only by the server.\n- Modify install/repo-init/docs/OpenAPI artifacts so new examples use server environment files and run configs only select ids.\n\n## Decisions\n\n- Environment definitions are server-owned operator policy. Project and workflow files may request an id but cannot define or override environment fields.\n- `default`, `local`, `docker`, and `daytona` are seeded if missing. Existing files are never overwritten.\n- `default` is protected from deletion. Other seeded files can be edited or deleted.\n- Environment ids use `[a-z0-9][a-z0-9-]{0,62}`.\n- Environment revisions are SHA-256 hashes of the persisted TOML bytes, returned in JSON as `revision` and in `ETag`.\n- `PUT` and `DELETE` require `If-Match`, following `AutomationStore`.\n- `image.dockerfile = { path = \"Dockerfile\" }` is accepted in persisted files and API input, resolved relative to the environment file or request context, and converted to inline content for runtime use. API writes canonical inline TOML.\n- `--preserve-sandbox` remains a CLI/server argument override. TOML `[run.environment.lifecycle]` is rejected.\n- `--docker-image` is rejected with a targeted message directing operators to create or update a server environment.\n- Existing dense `WorkflowSettings.environments` stays in the API for compatibility and is populated from the server environment catalog during run resolution.\n\n## Task 1: Add `fabro-environment` Store Crate\n\n**Files:**\n- Create: `lib/crates/fabro-environment/Cargo.toml`\n- Create: `lib/crates/fabro-environment/src/lib.rs`\n- Create: `lib/crates/fabro-environment/src/id.rs`\n- Create: `lib/crates/fabro-environment/src/model.rs`\n- Create: `lib/crates/fabro-environment/src/store.rs`\n- Create: `lib/crates/fabro-environment/src/error.rs`\n- Modify: root `Cargo.toml`\n\n- [ ] Create a workspace crate named `fabro-environment`, modeled after `fabro-automation`.\n- [ ] Define `EnvironmentId`, `EnvironmentRevision`, and parse/validation errors.\n- [ ] Define public DTOs:\n  - `Environment`: `id`, `revision`, `provider`, `image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, `env`.\n  - `EnvironmentDraft`: `id` plus environment fields.\n  - `EnvironmentReplace`: environment fields without id.\n- [ ] Use the existing environment field types from `fabro_types::settings::run` for dense API fields.\n- [ ] Use existing sparse `fabro_config::EnvironmentLayer` only for TOML input/output and conversion; do not create a second environment field vocabulary.\n- [ ] Add conversion helpers that resolve an `EnvironmentLayer` into dense `EnvironmentSettings` using the same provider/network/image validation rules as `fabro-config`.\n- [ ] Implement canonical TOML serialization for persisted files. Omit `id` and `revision`; the filename is the id and the file bytes determine revision.\n- [ ] Implement `EnvironmentStore` with `load_or_seed(dir)`, `list`, `get`, `create`, `replace`, `delete`, and `catalog_layer`.\n- [ ] Seed missing `default`, `local`, `docker`, and `daytona` files from the current built-in defaults. Do not overwrite existing files.\n- [ ] Protect `default` from deletion with a typed store error.\n- [ ] Resolve Dockerfile path references relative to the environment file directory during load and relative to the active settings directory during API create/replace. Store runtime values with inline Dockerfile content.\n- [ ] Add unit tests for loading an absent directory, seeding built-ins, sorted listing, invalid ids, invalid provider, invalid network mode, missing Dockerfile path, create conflict, replace stale revision, default delete rejection, delete success, and canonical revision changes.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-environment\n```\n\nExpected: all `fabro-environment` tests pass.\n\n## Task 2: Make Config Environments Migration-Only\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/parse.rs`\n- Modify: `lib/crates/fabro-config/src/builders.rs`\n- Modify: `lib/crates/fabro-config/src/load.rs`\n- Modify: `lib/crates/fabro-config/src/migrations.rs`\n- Create: `lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs`\n- Modify: `lib/crates/fabro-config/src/defaults.toml`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_run.rs`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_root.rs`\n\n- [ ] Keep `SettingsLayer.environments` in this pass so old files can parse and migrate, but remove environment catalog entries from `defaults.toml`.\n- [ ] Add source-aware validation that rejects `SettingsLayer.environments` for project, workflow, and direct run config layers with this message shape: `[environments.<id>] is now server-managed; move this definition to the server environments directory`.\n- [ ] Add validation that rejects TOML-provided `run.environment.image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, and `env`. Keep `run.environment.id`.\n- [ ] Ensure CLI/server argument layers can still set `run.environment.lifecycle.preserve` for `--preserve-sandbox`; the rejection applies only to parsed TOML sources.\n- [ ] Add a settings-file migration that extracts top-level `[environments.<id>]` entries from the active `settings.toml` into sibling `environments/<id>.toml` files.\n- [ ] Migration must write a backup before editing `settings.toml`, preserve `[run.environment] id`, remove the top-level `[environments]` table, and fail without changing files if any target environment file already exists.\n- [ ] Chain the existing legacy `[run.sandbox]` migration before the new extraction migration so legacy sandbox settings become a server `default` environment file.\n- [ ] Update run settings tests to assert that `RunSettingsBuilder` no longer resolves a selected environment without an injected server catalog.\n- [ ] Add tests proving project/workflow `[environments]` definitions produce targeted errors rather than silent ignores.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-config\n```\n\nExpected: config tests pass, including migration coverage.\n\n## Task 3: Wire EnvironmentStore Into Server Run Resolution\n\n**Files:**\n- Modify: `lib/crates/fabro-server/src/server.rs`\n- Modify: `lib/crates/fabro-server/src/serve.rs`\n- Modify: `lib/crates/fabro-server/src/run_manifest.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/runs.rs`\n- Modify: `lib/crates/fabro-server/src/manifest_validation.rs`\n- Modify: `lib/crates/fabro-server/src/test_support.rs`\n\n- [ ] Add `environment_store: Arc<EnvironmentStore>` to `AppState`, loaded from `active_config_path.parent().join(\"environments\")`.\n- [ ] Replace `manifest_environment_defaults` from `ServerRuntimeSettings` with `environment_store.catalog_layer()` when preparing manifests on the server.\n- [ ] Keep the dense run snapshot unchanged: `prepared.settings.run.environment` contains the resolved environment fields, and `prepared.settings.environments` contains the server catalog used for resolution.\n- [ ] Convert unknown environment ids into `400 Bad Request` during run creation/preflight/graph preparation.\n- [ ] Keep sandbox provider policy checks after environment resolution, so disabled providers still reject runs.\n- [ ] Apply `--preserve-sandbox` after selected environment resolution.\n- [ ] Remove server reliance on `[environments]` in `settings.toml`.\n- [ ] Update server test support so tests can inject environment files or use seeded defaults.\n- [ ] Add server tests for default environment run creation, custom server environment selection, unknown environment id, disabled provider policy, `--preserve-sandbox`, and rejected TOML environment field overrides.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server\n```\n\nExpected: server API and run-manifest tests pass.\n\n## Task 4: Add Environment CRUD API\n\n**Files:**\n- Modify: `docs/public/api-reference/fabro-api.yaml`\n- Modify: `lib/crates/fabro-api/build.rs`\n- Create: `lib/crates/fabro-server/src/server/handler/environments.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/mod.rs`\n- Add tests: `lib/crates/fabro-server/tests/it/api/environments.rs`\n- Update generated Rust and TypeScript API artifacts after spec changes.\n\n- [ ] Add OpenAPI tag `Environments`.\n- [ ] Add schemas for `Environment`, `CreateEnvironmentRequest`, `ReplaceEnvironmentRequest`, and `EnvironmentListResponse`.\n- [ ] Reuse existing environment schemas for provider/image/resources/network/lifecycle/volumes/env.\n- [ ] Add endpoints:\n  - `GET /api/v1/environments`\n  - `POST /api/v1/environments`\n  - `GET /api/v1/environments/{id}`\n  - `PUT /api/v1/environments/{id}`\n  - `DELETE /api/v1/environments/{id}`\n- [ ] Return `ETag` on retrieve and replace.\n- [ ] Require `If-Match` on replace and delete.\n- [ ] Map store errors to API responses:\n  - invalid id: `400`\n  - duplicate create: `409`\n  - stale revision: `409`\n  - validation error: `422`\n  - missing resource: `404`\n  - protected default delete: `409`\n  - persistence failure: `500`\n- [ ] Add route tests for empty-seeded list, create, retrieve with ETag, replace, stale replace, missing `If-Match`, delete, protected default delete, invalid provider, invalid CIDR, and missing Dockerfile path.\n- [ ] Regenerate `fabro-api` and TypeScript client artifacts.\n\nRun:\n\n```bash\ncargo build -p fabro-api\ncd lib/packages/fabro-api-client && bun run generate\ncargo nextest run -p fabro-server --test it -- api::environments\n```\n\nExpected: generated artifacts are updated and environment API tests pass.\n\n## Task 5: Adjust CLI And Manifest Behavior\n\n**Files:**\n- Modify: `lib/crates/fabro-cli/src/commands/run/overrides.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/preflight.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/graph.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/validate.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/repo/init.rs`\n- Modify: `lib/crates/fabro-manifest/src/lib.rs`\n- Modify CLI integration tests under `lib/crates/fabro-cli/tests/it/`\n\n- [ ] Reject `--docker-image` in run, create, preflight, graph, and validate commands with this message shape: `--docker-image is no longer supported; create or update a server environment and select it with --environment`.\n- [ ] Keep `--environment` as an id-only selector in manifest args.\n- [ ] Stop collecting Dockerfile path references from `[environments.<id>]` in project/workflow config because those definitions are invalid.\n- [ ] Keep collecting Dockerfile references for any remaining CLI-created run environment override only when it comes from allowed argument paths; with `--docker-image` rejected, no normal user path should add one.\n- [ ] Update local preflight/graph/validate flows so they either call server preflight for environment resolution or print a clear message that server-owned environment resolution requires a running server.\n- [ ] Update `fabro repo init` to write only `[run.environment] id = \"local\"` and no `[environments.local]` block.\n- [ ] Update CLI tests for manifest args, repo init output, rejected `--docker-image`, and server-owned environment selection.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-cli\n```\n\nExpected: CLI tests pass and no generated workflow config contains `[environments.*]`.\n\n## Task 6: Update Install, Docs, And Generated References\n\n**Files:**\n- Modify install persistence code in `lib/crates/fabro-cli/src/commands/install.rs` and server install handlers/tests.\n- Modify docs: `docs/public/execution/environments.mdx`, `docs/public/execution/run-configuration.mdx`, `docs/public/reference/user-configuration.mdx`, `docs/public/administration/server-configuration.mdx`, `docs/public/administration/sandboxing.mdx`, `docs/public/integrations/daytona.mdx`, and examples that currently define `[environments.<id>]`.\n- Modify generated settings reference if applicable.\n\n- [ ] Update install flows to write server environment files instead of `[environments.default]` into `settings.toml`.\n- [ ] Keep install-written `[run.environment] id = \"default\"` when a default run environment selection is still needed.\n- [ ] Update tests that assert `settings.toml` contains `[environments.default]` to assert the sibling environment file exists and settings no longer contains `[environments]`.\n- [ ] Rewrite public docs so environment definitions are server-owned TOML files and run configs only select ids.\n- [ ] Add a compatibility note explaining that project/workflow `[environments]` definitions now fail and must be moved to the server.\n- [ ] Keep `Settings > Environments` UI documentation out of this pass.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server --test it -- api::install\ncargo nextest run -p fabro-cli --test it\n```\n\nExpected: install tests pass and docs no longer present project/workflow environment definitions as valid.\n\n## Task 7: Workspace Verification\n\n**Files:**\n- No new files unless test snapshots require reviewed updates.\n\n- [ ] Run Rust formatting check:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\n```\n\n- [ ] Run clippy:\n\n```bash\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\n- [ ] Run workspace tests:\n\n```bash\ncargo nextest run --workspace\n```\n\n- [ ] Run TypeScript checks if API client changes affect the web package:\n\n```bash\ncd apps/fabro-web && bun run typecheck\ncd apps/fabro-web && bun test\n```\n\n- [ ] Inspect generated files and snapshots before accepting any snapshot changes.\n\n## Acceptance Criteria\n\n- Server startup creates or loads `environments/default.toml`, `local.toml`, `docker.toml`, and `daytona.toml`.\n- `GET /api/v1/environments` returns seeded environments with revisions.\n- API-created environments persist as TOML files and survive server restart.\n- Runs using `[run.environment] id = \"cloud\"` resolve from server files only.\n- Project/workflow/user `[environments.<id>]` definitions no longer affect runs.\n- Existing runs keep their dense environment snapshot after environment files change.\n- `--environment` still works.\n- `--preserve-sandbox` still works.\n- `--docker-image` no longer works and produces the targeted replacement guidance.\n- Web UI changes are not included.\n",
          "internal.retry_count.preflight_compile": 0,
          "internal.retry_count.toolchain": 0,
          "internal.node_visit_count": 1,
          "internal.thread_id": "toolchain",
          "graph.rankdir": "LR",
          "thread.toolchain.current_node": "preflight_compile",
          "current_node": "preflight_compile",
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "internal.retry_count.start": 0,
          "internal.run_id": "01KSPDE8E9ATTVY1VBCS3YRBHT"
        },
        "node_outcomes": {
          "toolchain": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
            },
            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 1316,
              "active_time_ms": 1316
            }
          },
          "preflight_compile": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo check -q --workspace 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 131121,
              "active_time_ms": 131121
            }
          },
          "start": {
            "status": "succeeded",
            "usage": null
          }
        },
        "next_node_id": "preflight_lint",
        "git_commit_sha": "ff16c8aa3a076181759ec21d1cfe9e3e18ff2321",
        "node_visits": {
          "start": 1,
          "preflight_compile": 1,
          "toolchain": 1
        }
      },
      "diff": {
        "summary": {
          "files_changed": 0,
          "additions": 0,
          "deletions": 0
        }
      }
    },
    {
      "seq": 48,
      "checkpoint": {
        "timestamp": "2026-05-28T04:33:22.200981Z",
        "current_node": "preflight_lint",
        "completed_nodes": [
          "start",
          "toolchain",
          "preflight_compile",
          "preflight_lint"
        ],
        "node_retries": {},
        "context_values": {
          "graph.rankdir": "LR",
          "failure_signature": "",
          "internal.node_visit_count": 1,
          "internal.fidelity": "compact",
          "internal.retry_count.preflight_compile": 0,
          "thread.start.current_node": "toolchain",
          "internal.retry_count.preflight_lint": 0,
          "internal.retry_count.start": 0,
          "internal.run_id": "01KSPDE8E9ATTVY1VBCS3YRBHT",
          "thread.preflight_compile.current_node": "preflight_lint",
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
          "internal.retry_count.toolchain": 0,
          "current_node": "preflight_lint",
          "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126",
          "graph.goal": "# Server-Owned Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Move environment definitions from layered run settings into server-owned TOML resources with CRUD API management, matching the Automation store pattern.\n\n**Architecture:** Add a concrete `EnvironmentStore` that loads one environment TOML file per id from a sibling `environments/` directory next to the active server settings file. Runs continue to select an environment by id through `[run.environment]` or `--environment`, but server-side run creation resolves the id from `EnvironmentStore`; project/workflow/user config can no longer define environment catalogs or environment field overrides. The web UI is intentionally deferred.\n\n**Tech Stack:** Rust, Axum, serde/TOML, `toml_edit`, Tokio file I/O, OpenAPI/progenitor, generated TypeScript API client, cargo-nextest.\n\n---\n\n## File Structure\n\n- Create `lib/crates/fabro-environment/`: environment ids, revisions, API/domain DTOs, TOML persistence, canonicalization, validation, and `EnvironmentStore`.\n- Modify workspace manifests: root `Cargo.toml`, `lib/crates/fabro-server/Cargo.toml`, `lib/crates/fabro-api/build.rs`, and generated API/client package files.\n- Modify `lib/crates/fabro-server/src/server.rs`, `lib/crates/fabro-server/src/server/handler/mod.rs`, and a new `lib/crates/fabro-server/src/server/handler/environments.rs` to wire the store and API.\n- Modify `lib/crates/fabro-config/src/builders.rs`, `lib/crates/fabro-config/src/load.rs`, `lib/crates/fabro-config/src/migrations.rs`, and config tests to treat `[environments]` as migration-only, not runtime configuration.\n- Modify `lib/crates/fabro-manifest/src/lib.rs`, `lib/crates/fabro-server/src/run_manifest.rs`, and CLI run/preflight/graph/validate paths so environment ids are resolved only by the server.\n- Modify install/repo-init/docs/OpenAPI artifacts so new examples use server environment files and run configs only select ids.\n\n## Decisions\n\n- Environment definitions are server-owned operator policy. Project and workflow files may request an id but cannot define or override environment fields.\n- `default`, `local`, `docker`, and `daytona` are seeded if missing. Existing files are never overwritten.\n- `default` is protected from deletion. Other seeded files can be edited or deleted.\n- Environment ids use `[a-z0-9][a-z0-9-]{0,62}`.\n- Environment revisions are SHA-256 hashes of the persisted TOML bytes, returned in JSON as `revision` and in `ETag`.\n- `PUT` and `DELETE` require `If-Match`, following `AutomationStore`.\n- `image.dockerfile = { path = \"Dockerfile\" }` is accepted in persisted files and API input, resolved relative to the environment file or request context, and converted to inline content for runtime use. API writes canonical inline TOML.\n- `--preserve-sandbox` remains a CLI/server argument override. TOML `[run.environment.lifecycle]` is rejected.\n- `--docker-image` is rejected with a targeted message directing operators to create or update a server environment.\n- Existing dense `WorkflowSettings.environments` stays in the API for compatibility and is populated from the server environment catalog during run resolution.\n\n## Task 1: Add `fabro-environment` Store Crate\n\n**Files:**\n- Create: `lib/crates/fabro-environment/Cargo.toml`\n- Create: `lib/crates/fabro-environment/src/lib.rs`\n- Create: `lib/crates/fabro-environment/src/id.rs`\n- Create: `lib/crates/fabro-environment/src/model.rs`\n- Create: `lib/crates/fabro-environment/src/store.rs`\n- Create: `lib/crates/fabro-environment/src/error.rs`\n- Modify: root `Cargo.toml`\n\n- [ ] Create a workspace crate named `fabro-environment`, modeled after `fabro-automation`.\n- [ ] Define `EnvironmentId`, `EnvironmentRevision`, and parse/validation errors.\n- [ ] Define public DTOs:\n  - `Environment`: `id`, `revision`, `provider`, `image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, `env`.\n  - `EnvironmentDraft`: `id` plus environment fields.\n  - `EnvironmentReplace`: environment fields without id.\n- [ ] Use the existing environment field types from `fabro_types::settings::run` for dense API fields.\n- [ ] Use existing sparse `fabro_config::EnvironmentLayer` only for TOML input/output and conversion; do not create a second environment field vocabulary.\n- [ ] Add conversion helpers that resolve an `EnvironmentLayer` into dense `EnvironmentSettings` using the same provider/network/image validation rules as `fabro-config`.\n- [ ] Implement canonical TOML serialization for persisted files. Omit `id` and `revision`; the filename is the id and the file bytes determine revision.\n- [ ] Implement `EnvironmentStore` with `load_or_seed(dir)`, `list`, `get`, `create`, `replace`, `delete`, and `catalog_layer`.\n- [ ] Seed missing `default`, `local`, `docker`, and `daytona` files from the current built-in defaults. Do not overwrite existing files.\n- [ ] Protect `default` from deletion with a typed store error.\n- [ ] Resolve Dockerfile path references relative to the environment file directory during load and relative to the active settings directory during API create/replace. Store runtime values with inline Dockerfile content.\n- [ ] Add unit tests for loading an absent directory, seeding built-ins, sorted listing, invalid ids, invalid provider, invalid network mode, missing Dockerfile path, create conflict, replace stale revision, default delete rejection, delete success, and canonical revision changes.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-environment\n```\n\nExpected: all `fabro-environment` tests pass.\n\n## Task 2: Make Config Environments Migration-Only\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/parse.rs`\n- Modify: `lib/crates/fabro-config/src/builders.rs`\n- Modify: `lib/crates/fabro-config/src/load.rs`\n- Modify: `lib/crates/fabro-config/src/migrations.rs`\n- Create: `lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs`\n- Modify: `lib/crates/fabro-config/src/defaults.toml`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_run.rs`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_root.rs`\n\n- [ ] Keep `SettingsLayer.environments` in this pass so old files can parse and migrate, but remove environment catalog entries from `defaults.toml`.\n- [ ] Add source-aware validation that rejects `SettingsLayer.environments` for project, workflow, and direct run config layers with this message shape: `[environments.<id>] is now server-managed; move this definition to the server environments directory`.\n- [ ] Add validation that rejects TOML-provided `run.environment.image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, and `env`. Keep `run.environment.id`.\n- [ ] Ensure CLI/server argument layers can still set `run.environment.lifecycle.preserve` for `--preserve-sandbox`; the rejection applies only to parsed TOML sources.\n- [ ] Add a settings-file migration that extracts top-level `[environments.<id>]` entries from the active `settings.toml` into sibling `environments/<id>.toml` files.\n- [ ] Migration must write a backup before editing `settings.toml`, preserve `[run.environment] id`, remove the top-level `[environments]` table, and fail without changing files if any target environment file already exists.\n- [ ] Chain the existing legacy `[run.sandbox]` migration before the new extraction migration so legacy sandbox settings become a server `default` environment file.\n- [ ] Update run settings tests to assert that `RunSettingsBuilder` no longer resolves a selected environment without an injected server catalog.\n- [ ] Add tests proving project/workflow `[environments]` definitions produce targeted errors rather than silent ignores.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-config\n```\n\nExpected: config tests pass, including migration coverage.\n\n## Task 3: Wire EnvironmentStore Into Server Run Resolution\n\n**Files:**\n- Modify: `lib/crates/fabro-server/src/server.rs`\n- Modify: `lib/crates/fabro-server/src/serve.rs`\n- Modify: `lib/crates/fabro-server/src/run_manifest.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/runs.rs`\n- Modify: `lib/crates/fabro-server/src/manifest_validation.rs`\n- Modify: `lib/crates/fabro-server/src/test_support.rs`\n\n- [ ] Add `environment_store: Arc<EnvironmentStore>` to `AppState`, loaded from `active_config_path.parent().join(\"environments\")`.\n- [ ] Replace `manifest_environment_defaults` from `ServerRuntimeSettings` with `environment_store.catalog_layer()` when preparing manifests on the server.\n- [ ] Keep the dense run snapshot unchanged: `prepared.settings.run.environment` contains the resolved environment fields, and `prepared.settings.environments` contains the server catalog used for resolution.\n- [ ] Convert unknown environment ids into `400 Bad Request` during run creation/preflight/graph preparation.\n- [ ] Keep sandbox provider policy checks after environment resolution, so disabled providers still reject runs.\n- [ ] Apply `--preserve-sandbox` after selected environment resolution.\n- [ ] Remove server reliance on `[environments]` in `settings.toml`.\n- [ ] Update server test support so tests can inject environment files or use seeded defaults.\n- [ ] Add server tests for default environment run creation, custom server environment selection, unknown environment id, disabled provider policy, `--preserve-sandbox`, and rejected TOML environment field overrides.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server\n```\n\nExpected: server API and run-manifest tests pass.\n\n## Task 4: Add Environment CRUD API\n\n**Files:**\n- Modify: `docs/public/api-reference/fabro-api.yaml`\n- Modify: `lib/crates/fabro-api/build.rs`\n- Create: `lib/crates/fabro-server/src/server/handler/environments.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/mod.rs`\n- Add tests: `lib/crates/fabro-server/tests/it/api/environments.rs`\n- Update generated Rust and TypeScript API artifacts after spec changes.\n\n- [ ] Add OpenAPI tag `Environments`.\n- [ ] Add schemas for `Environment`, `CreateEnvironmentRequest`, `ReplaceEnvironmentRequest`, and `EnvironmentListResponse`.\n- [ ] Reuse existing environment schemas for provider/image/resources/network/lifecycle/volumes/env.\n- [ ] Add endpoints:\n  - `GET /api/v1/environments`\n  - `POST /api/v1/environments`\n  - `GET /api/v1/environments/{id}`\n  - `PUT /api/v1/environments/{id}`\n  - `DELETE /api/v1/environments/{id}`\n- [ ] Return `ETag` on retrieve and replace.\n- [ ] Require `If-Match` on replace and delete.\n- [ ] Map store errors to API responses:\n  - invalid id: `400`\n  - duplicate create: `409`\n  - stale revision: `409`\n  - validation error: `422`\n  - missing resource: `404`\n  - protected default delete: `409`\n  - persistence failure: `500`\n- [ ] Add route tests for empty-seeded list, create, retrieve with ETag, replace, stale replace, missing `If-Match`, delete, protected default delete, invalid provider, invalid CIDR, and missing Dockerfile path.\n- [ ] Regenerate `fabro-api` and TypeScript client artifacts.\n\nRun:\n\n```bash\ncargo build -p fabro-api\ncd lib/packages/fabro-api-client && bun run generate\ncargo nextest run -p fabro-server --test it -- api::environments\n```\n\nExpected: generated artifacts are updated and environment API tests pass.\n\n## Task 5: Adjust CLI And Manifest Behavior\n\n**Files:**\n- Modify: `lib/crates/fabro-cli/src/commands/run/overrides.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/preflight.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/graph.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/validate.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/repo/init.rs`\n- Modify: `lib/crates/fabro-manifest/src/lib.rs`\n- Modify CLI integration tests under `lib/crates/fabro-cli/tests/it/`\n\n- [ ] Reject `--docker-image` in run, create, preflight, graph, and validate commands with this message shape: `--docker-image is no longer supported; create or update a server environment and select it with --environment`.\n- [ ] Keep `--environment` as an id-only selector in manifest args.\n- [ ] Stop collecting Dockerfile path references from `[environments.<id>]` in project/workflow config because those definitions are invalid.\n- [ ] Keep collecting Dockerfile references for any remaining CLI-created run environment override only when it comes from allowed argument paths; with `--docker-image` rejected, no normal user path should add one.\n- [ ] Update local preflight/graph/validate flows so they either call server preflight for environment resolution or print a clear message that server-owned environment resolution requires a running server.\n- [ ] Update `fabro repo init` to write only `[run.environment] id = \"local\"` and no `[environments.local]` block.\n- [ ] Update CLI tests for manifest args, repo init output, rejected `--docker-image`, and server-owned environment selection.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-cli\n```\n\nExpected: CLI tests pass and no generated workflow config contains `[environments.*]`.\n\n## Task 6: Update Install, Docs, And Generated References\n\n**Files:**\n- Modify install persistence code in `lib/crates/fabro-cli/src/commands/install.rs` and server install handlers/tests.\n- Modify docs: `docs/public/execution/environments.mdx`, `docs/public/execution/run-configuration.mdx`, `docs/public/reference/user-configuration.mdx`, `docs/public/administration/server-configuration.mdx`, `docs/public/administration/sandboxing.mdx`, `docs/public/integrations/daytona.mdx`, and examples that currently define `[environments.<id>]`.\n- Modify generated settings reference if applicable.\n\n- [ ] Update install flows to write server environment files instead of `[environments.default]` into `settings.toml`.\n- [ ] Keep install-written `[run.environment] id = \"default\"` when a default run environment selection is still needed.\n- [ ] Update tests that assert `settings.toml` contains `[environments.default]` to assert the sibling environment file exists and settings no longer contains `[environments]`.\n- [ ] Rewrite public docs so environment definitions are server-owned TOML files and run configs only select ids.\n- [ ] Add a compatibility note explaining that project/workflow `[environments]` definitions now fail and must be moved to the server.\n- [ ] Keep `Settings > Environments` UI documentation out of this pass.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server --test it -- api::install\ncargo nextest run -p fabro-cli --test it\n```\n\nExpected: install tests pass and docs no longer present project/workflow environment definitions as valid.\n\n## Task 7: Workspace Verification\n\n**Files:**\n- No new files unless test snapshots require reviewed updates.\n\n- [ ] Run Rust formatting check:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\n```\n\n- [ ] Run clippy:\n\n```bash\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\n- [ ] Run workspace tests:\n\n```bash\ncargo nextest run --workspace\n```\n\n- [ ] Run TypeScript checks if API client changes affect the web package:\n\n```bash\ncd apps/fabro-web && bun run typecheck\ncd apps/fabro-web && bun test\n```\n\n- [ ] Inspect generated files and snapshots before accepting any snapshot changes.\n\n## Acceptance Criteria\n\n- Server startup creates or loads `environments/default.toml`, `local.toml`, `docker.toml`, and `daytona.toml`.\n- `GET /api/v1/environments` returns seeded environments with revisions.\n- API-created environments persist as TOML files and survive server restart.\n- Runs using `[run.environment] id = \"cloud\"` resolve from server files only.\n- Project/workflow/user `[environments.<id>]` definitions no longer affect runs.\n- Existing runs keep their dense environment snapshot after environment files change.\n- `--environment` still works.\n- `--preserve-sandbox` still works.\n- `--docker-image` no longer works and produces the targeted replacement guidance.\n- Web UI changes are not included.\n",
          "thread.toolchain.current_node": "preflight_compile",
          "outcome": "succeeded",
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "internal.thread_id": "preflight_compile",
          "failure_class": ""
        },
        "node_outcomes": {
          "preflight_lint": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 143203,
              "active_time_ms": 143203
            }
          },
          "toolchain": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
            },
            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 1316,
              "active_time_ms": 1316
            }
          },
          "preflight_compile": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo check -q --workspace 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 131121,
              "active_time_ms": 131121
            }
          },
          "start": {
            "status": "succeeded",
            "usage": null
          }
        },
        "next_node_id": "implement",
        "git_commit_sha": "43a9a01aee81160c662d7523e358b128cdf476d0",
        "node_visits": {
          "start": 1,
          "preflight_compile": 1,
          "toolchain": 1,
          "preflight_lint": 1
        }
      },
      "diff": {
        "summary": {
          "files_changed": 0,
          "additions": 0,
          "deletions": 0
        }
      }
    },
    {
      "seq": 733,
      "checkpoint": {
        "timestamp": "2026-05-28T05:01:54.254515Z",
        "current_node": "implement",
        "completed_nodes": [
          "start",
          "toolchain",
          "preflight_compile",
          "preflight_lint",
          "implement"
        ],
        "node_retries": {},
        "context_values": {
          "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126",
          "internal.retry_count.preflight_compile": 0,
          "internal.retry_count.implement": 0,
          "thread.preflight_compile.current_node": "preflight_lint",
          "failure_signature": "implement|deterministic|api_deterministic|openai|invalid_request",
          "failure_class": "deterministic",
          "graph.rankdir": "LR",
          "graph.goal": "# Server-Owned Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Move environment definitions from layered run settings into server-owned TOML resources with CRUD API management, matching the Automation store pattern.\n\n**Architecture:** Add a concrete `EnvironmentStore` that loads one environment TOML file per id from a sibling `environments/` directory next to the active server settings file. Runs continue to select an environment by id through `[run.environment]` or `--environment`, but server-side run creation resolves the id from `EnvironmentStore`; project/workflow/user config can no longer define environment catalogs or environment field overrides. The web UI is intentionally deferred.\n\n**Tech Stack:** Rust, Axum, serde/TOML, `toml_edit`, Tokio file I/O, OpenAPI/progenitor, generated TypeScript API client, cargo-nextest.\n\n---\n\n## File Structure\n\n- Create `lib/crates/fabro-environment/`: environment ids, revisions, API/domain DTOs, TOML persistence, canonicalization, validation, and `EnvironmentStore`.\n- Modify workspace manifests: root `Cargo.toml`, `lib/crates/fabro-server/Cargo.toml`, `lib/crates/fabro-api/build.rs`, and generated API/client package files.\n- Modify `lib/crates/fabro-server/src/server.rs`, `lib/crates/fabro-server/src/server/handler/mod.rs`, and a new `lib/crates/fabro-server/src/server/handler/environments.rs` to wire the store and API.\n- Modify `lib/crates/fabro-config/src/builders.rs`, `lib/crates/fabro-config/src/load.rs`, `lib/crates/fabro-config/src/migrations.rs`, and config tests to treat `[environments]` as migration-only, not runtime configuration.\n- Modify `lib/crates/fabro-manifest/src/lib.rs`, `lib/crates/fabro-server/src/run_manifest.rs`, and CLI run/preflight/graph/validate paths so environment ids are resolved only by the server.\n- Modify install/repo-init/docs/OpenAPI artifacts so new examples use server environment files and run configs only select ids.\n\n## Decisions\n\n- Environment definitions are server-owned operator policy. Project and workflow files may request an id but cannot define or override environment fields.\n- `default`, `local`, `docker`, and `daytona` are seeded if missing. Existing files are never overwritten.\n- `default` is protected from deletion. Other seeded files can be edited or deleted.\n- Environment ids use `[a-z0-9][a-z0-9-]{0,62}`.\n- Environment revisions are SHA-256 hashes of the persisted TOML bytes, returned in JSON as `revision` and in `ETag`.\n- `PUT` and `DELETE` require `If-Match`, following `AutomationStore`.\n- `image.dockerfile = { path = \"Dockerfile\" }` is accepted in persisted files and API input, resolved relative to the environment file or request context, and converted to inline content for runtime use. API writes canonical inline TOML.\n- `--preserve-sandbox` remains a CLI/server argument override. TOML `[run.environment.lifecycle]` is rejected.\n- `--docker-image` is rejected with a targeted message directing operators to create or update a server environment.\n- Existing dense `WorkflowSettings.environments` stays in the API for compatibility and is populated from the server environment catalog during run resolution.\n\n## Task 1: Add `fabro-environment` Store Crate\n\n**Files:**\n- Create: `lib/crates/fabro-environment/Cargo.toml`\n- Create: `lib/crates/fabro-environment/src/lib.rs`\n- Create: `lib/crates/fabro-environment/src/id.rs`\n- Create: `lib/crates/fabro-environment/src/model.rs`\n- Create: `lib/crates/fabro-environment/src/store.rs`\n- Create: `lib/crates/fabro-environment/src/error.rs`\n- Modify: root `Cargo.toml`\n\n- [ ] Create a workspace crate named `fabro-environment`, modeled after `fabro-automation`.\n- [ ] Define `EnvironmentId`, `EnvironmentRevision`, and parse/validation errors.\n- [ ] Define public DTOs:\n  - `Environment`: `id`, `revision`, `provider`, `image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, `env`.\n  - `EnvironmentDraft`: `id` plus environment fields.\n  - `EnvironmentReplace`: environment fields without id.\n- [ ] Use the existing environment field types from `fabro_types::settings::run` for dense API fields.\n- [ ] Use existing sparse `fabro_config::EnvironmentLayer` only for TOML input/output and conversion; do not create a second environment field vocabulary.\n- [ ] Add conversion helpers that resolve an `EnvironmentLayer` into dense `EnvironmentSettings` using the same provider/network/image validation rules as `fabro-config`.\n- [ ] Implement canonical TOML serialization for persisted files. Omit `id` and `revision`; the filename is the id and the file bytes determine revision.\n- [ ] Implement `EnvironmentStore` with `load_or_seed(dir)`, `list`, `get`, `create`, `replace`, `delete`, and `catalog_layer`.\n- [ ] Seed missing `default`, `local`, `docker`, and `daytona` files from the current built-in defaults. Do not overwrite existing files.\n- [ ] Protect `default` from deletion with a typed store error.\n- [ ] Resolve Dockerfile path references relative to the environment file directory during load and relative to the active settings directory during API create/replace. Store runtime values with inline Dockerfile content.\n- [ ] Add unit tests for loading an absent directory, seeding built-ins, sorted listing, invalid ids, invalid provider, invalid network mode, missing Dockerfile path, create conflict, replace stale revision, default delete rejection, delete success, and canonical revision changes.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-environment\n```\n\nExpected: all `fabro-environment` tests pass.\n\n## Task 2: Make Config Environments Migration-Only\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/parse.rs`\n- Modify: `lib/crates/fabro-config/src/builders.rs`\n- Modify: `lib/crates/fabro-config/src/load.rs`\n- Modify: `lib/crates/fabro-config/src/migrations.rs`\n- Create: `lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs`\n- Modify: `lib/crates/fabro-config/src/defaults.toml`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_run.rs`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_root.rs`\n\n- [ ] Keep `SettingsLayer.environments` in this pass so old files can parse and migrate, but remove environment catalog entries from `defaults.toml`.\n- [ ] Add source-aware validation that rejects `SettingsLayer.environments` for project, workflow, and direct run config layers with this message shape: `[environments.<id>] is now server-managed; move this definition to the server environments directory`.\n- [ ] Add validation that rejects TOML-provided `run.environment.image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, and `env`. Keep `run.environment.id`.\n- [ ] Ensure CLI/server argument layers can still set `run.environment.lifecycle.preserve` for `--preserve-sandbox`; the rejection applies only to parsed TOML sources.\n- [ ] Add a settings-file migration that extracts top-level `[environments.<id>]` entries from the active `settings.toml` into sibling `environments/<id>.toml` files.\n- [ ] Migration must write a backup before editing `settings.toml`, preserve `[run.environment] id`, remove the top-level `[environments]` table, and fail without changing files if any target environment file already exists.\n- [ ] Chain the existing legacy `[run.sandbox]` migration before the new extraction migration so legacy sandbox settings become a server `default` environment file.\n- [ ] Update run settings tests to assert that `RunSettingsBuilder` no longer resolves a selected environment without an injected server catalog.\n- [ ] Add tests proving project/workflow `[environments]` definitions produce targeted errors rather than silent ignores.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-config\n```\n\nExpected: config tests pass, including migration coverage.\n\n## Task 3: Wire EnvironmentStore Into Server Run Resolution\n\n**Files:**\n- Modify: `lib/crates/fabro-server/src/server.rs`\n- Modify: `lib/crates/fabro-server/src/serve.rs`\n- Modify: `lib/crates/fabro-server/src/run_manifest.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/runs.rs`\n- Modify: `lib/crates/fabro-server/src/manifest_validation.rs`\n- Modify: `lib/crates/fabro-server/src/test_support.rs`\n\n- [ ] Add `environment_store: Arc<EnvironmentStore>` to `AppState`, loaded from `active_config_path.parent().join(\"environments\")`.\n- [ ] Replace `manifest_environment_defaults` from `ServerRuntimeSettings` with `environment_store.catalog_layer()` when preparing manifests on the server.\n- [ ] Keep the dense run snapshot unchanged: `prepared.settings.run.environment` contains the resolved environment fields, and `prepared.settings.environments` contains the server catalog used for resolution.\n- [ ] Convert unknown environment ids into `400 Bad Request` during run creation/preflight/graph preparation.\n- [ ] Keep sandbox provider policy checks after environment resolution, so disabled providers still reject runs.\n- [ ] Apply `--preserve-sandbox` after selected environment resolution.\n- [ ] Remove server reliance on `[environments]` in `settings.toml`.\n- [ ] Update server test support so tests can inject environment files or use seeded defaults.\n- [ ] Add server tests for default environment run creation, custom server environment selection, unknown environment id, disabled provider policy, `--preserve-sandbox`, and rejected TOML environment field overrides.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server\n```\n\nExpected: server API and run-manifest tests pass.\n\n## Task 4: Add Environment CRUD API\n\n**Files:**\n- Modify: `docs/public/api-reference/fabro-api.yaml`\n- Modify: `lib/crates/fabro-api/build.rs`\n- Create: `lib/crates/fabro-server/src/server/handler/environments.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/mod.rs`\n- Add tests: `lib/crates/fabro-server/tests/it/api/environments.rs`\n- Update generated Rust and TypeScript API artifacts after spec changes.\n\n- [ ] Add OpenAPI tag `Environments`.\n- [ ] Add schemas for `Environment`, `CreateEnvironmentRequest`, `ReplaceEnvironmentRequest`, and `EnvironmentListResponse`.\n- [ ] Reuse existing environment schemas for provider/image/resources/network/lifecycle/volumes/env.\n- [ ] Add endpoints:\n  - `GET /api/v1/environments`\n  - `POST /api/v1/environments`\n  - `GET /api/v1/environments/{id}`\n  - `PUT /api/v1/environments/{id}`\n  - `DELETE /api/v1/environments/{id}`\n- [ ] Return `ETag` on retrieve and replace.\n- [ ] Require `If-Match` on replace and delete.\n- [ ] Map store errors to API responses:\n  - invalid id: `400`\n  - duplicate create: `409`\n  - stale revision: `409`\n  - validation error: `422`\n  - missing resource: `404`\n  - protected default delete: `409`\n  - persistence failure: `500`\n- [ ] Add route tests for empty-seeded list, create, retrieve with ETag, replace, stale replace, missing `If-Match`, delete, protected default delete, invalid provider, invalid CIDR, and missing Dockerfile path.\n- [ ] Regenerate `fabro-api` and TypeScript client artifacts.\n\nRun:\n\n```bash\ncargo build -p fabro-api\ncd lib/packages/fabro-api-client && bun run generate\ncargo nextest run -p fabro-server --test it -- api::environments\n```\n\nExpected: generated artifacts are updated and environment API tests pass.\n\n## Task 5: Adjust CLI And Manifest Behavior\n\n**Files:**\n- Modify: `lib/crates/fabro-cli/src/commands/run/overrides.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/preflight.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/graph.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/validate.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/repo/init.rs`\n- Modify: `lib/crates/fabro-manifest/src/lib.rs`\n- Modify CLI integration tests under `lib/crates/fabro-cli/tests/it/`\n\n- [ ] Reject `--docker-image` in run, create, preflight, graph, and validate commands with this message shape: `--docker-image is no longer supported; create or update a server environment and select it with --environment`.\n- [ ] Keep `--environment` as an id-only selector in manifest args.\n- [ ] Stop collecting Dockerfile path references from `[environments.<id>]` in project/workflow config because those definitions are invalid.\n- [ ] Keep collecting Dockerfile references for any remaining CLI-created run environment override only when it comes from allowed argument paths; with `--docker-image` rejected, no normal user path should add one.\n- [ ] Update local preflight/graph/validate flows so they either call server preflight for environment resolution or print a clear message that server-owned environment resolution requires a running server.\n- [ ] Update `fabro repo init` to write only `[run.environment] id = \"local\"` and no `[environments.local]` block.\n- [ ] Update CLI tests for manifest args, repo init output, rejected `--docker-image`, and server-owned environment selection.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-cli\n```\n\nExpected: CLI tests pass and no generated workflow config contains `[environments.*]`.\n\n## Task 6: Update Install, Docs, And Generated References\n\n**Files:**\n- Modify install persistence code in `lib/crates/fabro-cli/src/commands/install.rs` and server install handlers/tests.\n- Modify docs: `docs/public/execution/environments.mdx`, `docs/public/execution/run-configuration.mdx`, `docs/public/reference/user-configuration.mdx`, `docs/public/administration/server-configuration.mdx`, `docs/public/administration/sandboxing.mdx`, `docs/public/integrations/daytona.mdx`, and examples that currently define `[environments.<id>]`.\n- Modify generated settings reference if applicable.\n\n- [ ] Update install flows to write server environment files instead of `[environments.default]` into `settings.toml`.\n- [ ] Keep install-written `[run.environment] id = \"default\"` when a default run environment selection is still needed.\n- [ ] Update tests that assert `settings.toml` contains `[environments.default]` to assert the sibling environment file exists and settings no longer contains `[environments]`.\n- [ ] Rewrite public docs so environment definitions are server-owned TOML files and run configs only select ids.\n- [ ] Add a compatibility note explaining that project/workflow `[environments]` definitions now fail and must be moved to the server.\n- [ ] Keep `Settings > Environments` UI documentation out of this pass.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server --test it -- api::install\ncargo nextest run -p fabro-cli --test it\n```\n\nExpected: install tests pass and docs no longer present project/workflow environment definitions as valid.\n\n## Task 7: Workspace Verification\n\n**Files:**\n- No new files unless test snapshots require reviewed updates.\n\n- [ ] Run Rust formatting check:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\n```\n\n- [ ] Run clippy:\n\n```bash\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\n- [ ] Run workspace tests:\n\n```bash\ncargo nextest run --workspace\n```\n\n- [ ] Run TypeScript checks if API client changes affect the web package:\n\n```bash\ncd apps/fabro-web && bun run typecheck\ncd apps/fabro-web && bun test\n```\n\n- [ ] Inspect generated files and snapshots before accepting any snapshot changes.\n\n## Acceptance Criteria\n\n- Server startup creates or loads `environments/default.toml`, `local.toml`, `docker.toml`, and `daytona.toml`.\n- `GET /api/v1/environments` returns seeded environments with revisions.\n- API-created environments persist as TOML files and survive server restart.\n- Runs using `[run.environment] id = \"cloud\"` resolve from server files only.\n- Project/workflow/user `[environments.<id>]` definitions no longer affect runs.\n- Existing runs keep their dense environment snapshot after environment files change.\n- `--environment` still works.\n- `--preserve-sandbox` still works.\n- `--docker-image` no longer works and produces the targeted replacement guidance.\n- Web UI changes are not included.\n",
          "internal.run_id": "01KSPDE8E9ATTVY1VBCS3YRBHT",
          "outcome": "failed",
          "internal.thread_id": "preflight_lint",
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "thread.preflight_lint.current_node": "implement",
          "thread.toolchain.current_node": "preflight_compile",
          "internal.retry_count.toolchain": 0,
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
          "internal.retry_count.start": 0,
          "current_node": "implement",
          "internal.fidelity": "compact",
          "internal.retry_count.preflight_lint": 0,
          "thread.start.current_node": "toolchain",
          "internal.node_visit_count": 1
        },
        "node_outcomes": {
          "implement": {
            "status": "failed",
            "failure": {
              "message": "LLM error: Invalid request to openai: No tool call found for function call output with call_id call_DUxNRWlboQi3OOOvhg0NhD3h.",
              "category": "deterministic",
              "signature": "api_deterministic|openai|invalid_request"
            },
            "usage": null
          },
          "preflight_compile": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo check -q --workspace 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 131121,
              "active_time_ms": 131121
            }
          },
          "preflight_lint": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 143203,
              "active_time_ms": 143203
            }
          },
          "start": {
            "status": "succeeded",
            "usage": null
          },
          "toolchain": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
            },
            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 1316,
              "active_time_ms": 1316
            }
          }
        },
        "next_node_id": "simplify_opus",
        "git_commit_sha": "c180a581152c1ff824494ffb3dd24d5fd65d7505",
        "loop_failure_signatures": {
          "implement|deterministic|api_deterministic|openai|invalid_request": 1
        },
        "node_visits": {
          "preflight_lint": 1,
          "implement": 1,
          "preflight_compile": 1,
          "start": 1,
          "toolchain": 1
        }
      },
      "diff": {
        "patch": "diff --git a/Cargo.lock b/Cargo.lock\nindex 2ef51ead4..29c44783b 100644\n--- a/Cargo.lock\n+++ b/Cargo.lock\n@@ -2007,6 +2007,22 @@ dependencies = [\n  \"serde_json\",\n ]\n \n+[[package]]\n+name = \"fabro-environment\"\n+version = \"0.246.0-nightly.0\"\n+dependencies = [\n+ \"fabro-config\",\n+ \"fabro-types\",\n+ \"hex\",\n+ \"serde\",\n+ \"sha2\",\n+ \"tempfile\",\n+ \"thiserror 2.0.18\",\n+ \"tokio\",\n+ \"toml 0.8.23\",\n+ \"toml_edit\",\n+]\n+\n [[package]]\n name = \"fabro-github\"\n version = \"0.246.0-nightly.0\"\ndiff --git a/Cargo.toml b/Cargo.toml\nindex de3a7e4ca..94f02b492 100644\n--- a/Cargo.toml\n+++ b/Cargo.toml\n@@ -84,6 +84,7 @@ percent-encoding = \"2\"\n minijinja = \"=2.19.0\"\n miette = { version = \"7.6\", features = [\"fancy\"] }\n fabro-http = { path = \"lib/crates/fabro-http\" }\n+fabro-environment = { path = \"lib/crates/fabro-environment\" }\n fabro-options-metadata = { path = \"lib/crates/fabro-options-metadata\" }\n fabro-redact = { path = \"lib/crates/fabro-redact\" }\n fabro-static = { path = \"lib/crates/fabro-static\" }\ndiff --git a/lib/crates/fabro-config/migrations/2026050101_legacy_sandbox_to_environments.rs b/lib/crates/fabro-config/migrations/2026050101_legacy_sandbox_to_environments.rs\nindex d276c9891..255d9bf42 100644\n--- a/lib/crates/fabro-config/migrations/2026050101_legacy_sandbox_to_environments.rs\n+++ b/lib/crates/fabro-config/migrations/2026050101_legacy_sandbox_to_environments.rs\n@@ -19,7 +19,6 @@ pub(crate) const REMOVAL_NOTE: &str =\n \n #[derive(Debug)]\n pub(crate) struct LegacySandboxMigrationReport {\n-    pub(crate) layer:   SettingsLayer,\n     pub(crate) warning: String,\n     #[cfg(test)]\n     backup_path:        PathBuf,\n@@ -77,14 +76,13 @@ pub(crate) fn migrate_settings_path(\n     );\n \n     Ok(Some(LegacySandboxMigrationReport {\n-        layer,\n         warning,\n         #[cfg(test)]\n         backup_path,\n     }))\n }\n \n-fn migrate_contents(original_contents: &str, path: &Path) -> Result<Option<String>> {\n+pub(crate) fn migrate_contents(original_contents: &str, path: &Path) -> Result<Option<String>> {\n     let Ok(mut doc) = original_contents.parse::<DocumentMut>() else {\n         return Ok(None);\n     };\ndiff --git a/lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs b/lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs\nnew file mode 100644\nindex 000000000..31d995b0f\n--- /dev/null\n+++ b/lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs\n@@ -0,0 +1,334 @@\n+#![expect(\n+    clippy::disallowed_methods,\n+    clippy::disallowed_types,\n+    reason = \"temporary startup config migration uses synchronous file I/O before config is loaded\"\n+)]\n+\n+use std::io::Write;\n+use std::path::{Path, PathBuf};\n+\n+use toml_edit::{DocumentMut, Item};\n+\n+use crate::{Error, Result};\n+\n+pub(crate) const REMOVAL_NOTE: &str =\n+    \"This temporary compatibility migration will be removed before v1.0.\";\n+\n+#[derive(Debug)]\n+pub(crate) struct SettingsEnvironmentsMigrationReport {\n+    pub(crate) contents: String,\n+    pub(crate) warning:  String,\n+    #[cfg(test)]\n+    backup_path:         PathBuf,\n+}\n+\n+pub(crate) fn migrate_settings_path(\n+    path: &Path,\n+    original_contents: &str,\n+) -> Result<Option<SettingsEnvironmentsMigrationReport>> {\n+    let legacy_migrated =\n+        super::legacy_sandbox_to_environments::migrate_contents(original_contents, path)?;\n+    let contents = legacy_migrated.as_deref().unwrap_or(original_contents);\n+    let legacy_changed = legacy_migrated.is_some();\n+\n+    let Some((next_contents, extracted)) = extract_environments(contents, path)? else {\n+        if legacy_changed {\n+            return Err(Error::other(format!(\n+                \"Legacy [run.sandbox] settings in {} did not produce a server environment file candidate.\",\n+                path.display()\n+            )));\n+        }\n+        return Ok(None);\n+    };\n+\n+    let settings_dir = path.parent().unwrap_or_else(|| Path::new(\".\"));\n+    let environment_dir = settings_dir.join(\"environments\");\n+    let existing = extracted\n+        .iter()\n+        .map(|environment| environment_dir.join(format!(\"{}.toml\", environment.id)))\n+        .find(|target| target.exists());\n+    if let Some(target) = existing {\n+        return Err(Error::other(format!(\n+            \"Settings environments in {} could not be auto-migrated because target environment file {} already exists. Move or merge the file and retry.\",\n+            path.display(),\n+            target.display()\n+        )));\n+    }\n+\n+    let backup_path = write_next_backup(path, original_contents)?;\n+    std::fs::create_dir_all(&environment_dir).map_err(|source| {\n+        Error::other(format!(\n+            \"creating server environments directory {}: {source}\",\n+            environment_dir.display()\n+        ))\n+    })?;\n+    for environment in &extracted {\n+        let target = environment_dir.join(format!(\"{}.toml\", environment.id));\n+        write_new_file(&target, &environment.contents)?;\n+    }\n+    std::fs::write(path, &next_contents).map_err(|source| {\n+        Error::other(format!(\n+            \"writing migrated settings file {}: {source}\",\n+            path.display()\n+        ))\n+    })?;\n+\n+    let ids = extracted\n+        .iter()\n+        .map(|environment| environment.id.as_str())\n+        .collect::<Vec<_>>()\n+        .join(\", \");\n+    let warning = format!(\n+        \"Migrated [environments] settings in {} to server environment files under {} ({ids}). Backup written to {}. {REMOVAL_NOTE}\",\n+        path.display(),\n+        environment_dir.display(),\n+        backup_path.display()\n+    );\n+\n+    Ok(Some(SettingsEnvironmentsMigrationReport {\n+        contents: next_contents,\n+        warning,\n+        #[cfg(test)]\n+        backup_path,\n+    }))\n+}\n+\n+#[derive(Debug)]\n+struct ExtractedEnvironment {\n+    id:       String,\n+    contents: String,\n+}\n+\n+fn extract_environments(\n+    contents: &str,\n+    path: &Path,\n+) -> Result<Option<(String, Vec<ExtractedEnvironment>)>> {\n+    let Ok(mut doc) = contents.parse::<DocumentMut>() else {\n+        return Ok(None);\n+    };\n+    let Some(environments_item) = doc.get(\"environments\") else {\n+        return Ok(None);\n+    };\n+    let Some(environments) = environments_item.as_table() else {\n+        return Err(Error::other(format!(\n+            \"[environments] in {} must be a table to migrate to server environment files.\",\n+            path.display()\n+        )));\n+    };\n+\n+    let mut extracted = Vec::new();\n+    for (id, item) in environments {\n+        validate_environment_id(id, path)?;\n+        let contents = environment_file_contents(id, item, path)?;\n+        extracted.push(ExtractedEnvironment {\n+            id: id.to_string(),\n+            contents,\n+        });\n+    }\n+    if extracted.is_empty() {\n+        return Ok(None);\n+    }\n+    extracted.sort_by(|left, right| left.id.cmp(&right.id));\n+\n+    doc.as_table_mut().remove(\"environments\");\n+    Ok(Some((doc.to_string(), extracted)))\n+}\n+\n+fn environment_file_contents(id: &str, item: &Item, path: &Path) -> Result<String> {\n+    let Some(table) = item.as_table() else {\n+        return Err(Error::other(format!(\n+            \"[environments.{id}] in {} must be a table to migrate to a server environment file.\",\n+            path.display()\n+        )));\n+    };\n+\n+    let mut doc = DocumentMut::new();\n+    for (key, value) in table {\n+        doc[key] = value.clone();\n+    }\n+    Ok(doc.to_string())\n+}\n+\n+fn validate_environment_id(id: &str, path: &Path) -> Result<()> {\n+    if is_valid_environment_id(id) {\n+        Ok(())\n+    } else {\n+        Err(Error::other(format!(\n+            \"[environments.{id}] in {} could not be migrated because environment ids must match [a-z0-9][a-z0-9-]{{0,62}}.\",\n+            path.display()\n+        )))\n+    }\n+}\n+\n+fn is_valid_environment_id(value: &str) -> bool {\n+    let mut bytes = value.bytes();\n+    let Some(first) = bytes.next() else {\n+        return false;\n+    };\n+    if !first.is_ascii_lowercase() && !first.is_ascii_digit() {\n+        return false;\n+    }\n+    if value.len() > 63 {\n+        return false;\n+    }\n+    bytes.all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'-')\n+}\n+\n+fn write_new_file(path: &Path, contents: &str) -> Result<()> {\n+    let mut file = std::fs::OpenOptions::new()\n+        .write(true)\n+        .create_new(true)\n+        .open(path)\n+        .map_err(|source| {\n+            Error::other(format!(\n+                \"writing server environment file {}: {source}\",\n+                path.display()\n+            ))\n+        })?;\n+    file.write_all(contents.as_bytes()).map_err(|source| {\n+        Error::other(format!(\n+            \"writing server environment file {}: {source}\",\n+            path.display()\n+        ))\n+    })?;\n+    file.sync_all().map_err(|source| {\n+        Error::other(format!(\n+            \"syncing server environment file {}: {source}\",\n+            path.display()\n+        ))\n+    })?;\n+    Ok(())\n+}\n+\n+fn write_next_backup(path: &Path, contents: &str) -> Result<PathBuf> {\n+    for index in 0u32.. {\n+        let backup_path = backup_path_for(path, index);\n+        match std::fs::OpenOptions::new()\n+            .write(true)\n+            .create_new(true)\n+            .open(&backup_path)\n+        {\n+            Ok(mut file) => {\n+                file.write_all(contents.as_bytes()).map_err(|source| {\n+                    Error::other(format!(\n+                        \"writing settings environments migration backup {}: {source}\",\n+                        backup_path.display()\n+                    ))\n+                })?;\n+                return Ok(backup_path);\n+            }\n+            Err(source) if source.kind() == std::io::ErrorKind::AlreadyExists => {}\n+            Err(source) => {\n+                return Err(Error::other(format!(\n+                    \"writing settings environments migration backup {}: {source}\",\n+                    backup_path.display()\n+                )));\n+            }\n+        }\n+    }\n+    unreachable!(\"unbounded backup suffix search should return\")\n+}\n+\n+fn backup_path_for(path: &Path, index: u32) -> PathBuf {\n+    let file_name = path\n+        .file_name()\n+        .and_then(|name| name.to_str())\n+        .unwrap_or(\"settings.toml\");\n+    if index == 0 {\n+        path.with_file_name(format!(\"{file_name}.settings-environments-migration.bak\"))\n+    } else {\n+        path.with_file_name(format!(\n+            \"{file_name}.settings-environments-migration.{index}.bak\"\n+        ))\n+    }\n+}\n+\n+#[cfg(test)]\n+mod tests {\n+    use super::*;\n+\n+    #[test]\n+    fn extracts_environments_and_removes_catalog_from_settings() {\n+        let dir = tempfile::tempdir().expect(\"temp dir\");\n+        let path = dir.path().join(\"settings.toml\");\n+        let source = r#\"\n+_version = 1\n+\n+[run.environment]\n+id = \"cloud\"\n+\n+[environments.cloud]\n+provider = \"docker\"\n+\n+[environments.cloud.image]\n+docker = \"ubuntu:24.04\"\n+\"#;\n+        std::fs::write(&path, source).expect(\"write settings\");\n+\n+        let report = migrate_settings_path(&path, source)\n+            .expect(\"migration should succeed\")\n+            .expect(\"catalog should migrate\");\n+\n+        let rewritten = std::fs::read_to_string(&path).expect(\"read settings\");\n+        let environment =\n+            std::fs::read_to_string(dir.path().join(\"environments/cloud.toml\")).expect(\"read env\");\n+        assert!(report.backup_path.exists());\n+        assert!(!rewritten.contains(\"[environments\"));\n+        assert!(rewritten.contains(\"id = \\\"cloud\\\"\"));\n+        assert!(environment.contains(\"provider = \\\"docker\\\"\"));\n+        assert!(environment.contains(\"docker = \\\"ubuntu:24.04\\\"\"));\n+    }\n+\n+    #[test]\n+    fn target_conflict_fails_without_changing_settings_or_files() {\n+        let dir = tempfile::tempdir().expect(\"temp dir\");\n+        let path = dir.path().join(\"settings.toml\");\n+        let environment_dir = dir.path().join(\"environments\");\n+        std::fs::create_dir_all(&environment_dir).expect(\"mkdir\");\n+        std::fs::write(environment_dir.join(\"cloud.toml\"), \"provider = \\\"local\\\"\\n\")\n+            .expect(\"write existing\");\n+        let source = r#\"\n+_version = 1\n+\n+[environments.cloud]\n+provider = \"docker\"\n+\"#;\n+        std::fs::write(&path, source).expect(\"write settings\");\n+\n+        let err = migrate_settings_path(&path, source).expect_err(\"conflict should fail\");\n+\n+        assert!(err.to_string().contains(\"already exists\"));\n+        assert_eq!(std::fs::read_to_string(&path).unwrap(), source);\n+        assert_eq!(\n+            std::fs::read_to_string(environment_dir.join(\"cloud.toml\")).unwrap(),\n+            \"provider = \\\"local\\\"\\n\"\n+        );\n+    }\n+\n+    #[test]\n+    fn legacy_sandbox_is_chained_into_default_environment_file() {\n+        let dir = tempfile::tempdir().expect(\"temp dir\");\n+        let path = dir.path().join(\"settings.toml\");\n+        let source = r#\"\n+_version = 1\n+\n+[run.sandbox]\n+provider = \"docker\"\n+preserve = true\n+\"#;\n+        std::fs::write(&path, source).expect(\"write settings\");\n+\n+        migrate_settings_path(&path, source)\n+            .expect(\"migration should succeed\")\n+            .expect(\"legacy sandbox should migrate\");\n+\n+        let rewritten = std::fs::read_to_string(&path).expect(\"read settings\");\n+        let environment = std::fs::read_to_string(dir.path().join(\"environments/default.toml\"))\n+            .expect(\"read default env\");\n+        assert!(rewritten.contains(\"[run.environment]\"));\n+        assert!(rewritten.contains(\"id = \\\"default\\\"\"));\n+        assert!(!rewritten.contains(\"[environments\"));\n+        assert!(environment.contains(\"provider = \\\"docker\\\"\"));\n+        assert!(environment.contains(\"preserve = true\"));\n+    }\n+}\ndiff --git a/lib/crates/fabro-config/src/builders.rs b/lib/crates/fabro-config/src/builders.rs\nindex 3562328f0..1430ae43b 100644\n--- a/lib/crates/fabro-config/src/builders.rs\n+++ b/lib/crates/fabro-config/src/builders.rs\n@@ -8,7 +8,8 @@ use fabro_types::{ServerSettings, UserSettings, WorkflowSettings};\n use fabro_util::error::SharedError;\n \n use crate::defaults::DEFAULTS_LAYER;\n-use crate::load::load_settings_path;\n+use crate::load::{load_settings_path, load_settings_path_with_source};\n+use crate::parse::{SettingsSource, validate_settings_source};\n use crate::resolve::{\n     ResolveError, resolve_cli, resolve_project, resolve_run, resolve_server, resolve_workflow,\n };\n@@ -90,6 +91,7 @@ impl ServerSettingsBuilder {\n         let layer = source\n             .parse::<SettingsLayer>()\n             .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n+        validate_parsed_source(&layer, SettingsSource::ActiveSettings)?;\n         Self::from_layer(&layer)\n     }\n \n@@ -119,12 +121,12 @@ impl UserSettingsBuilder {\n     }\n \n     pub fn load_from(path: &Path) -> Result<UserSettings> {\n-        let layer = load_settings_path(path)?;\n+        let layer = load_settings_path_with_source(path, SettingsSource::User)?;\n         Self::from_layer(&layer)\n     }\n \n     pub fn load_from_with_cli_overrides(path: &Path, cli: &CliLayer) -> Result<UserSettings> {\n-        let layer = load_settings_path(path)?;\n+        let layer = load_settings_path_with_source(path, SettingsSource::User)?;\n         Self::from_layer_with_cli_overrides(&layer, cli)\n     }\n \n@@ -132,6 +134,7 @@ impl UserSettingsBuilder {\n         let layer = source\n             .parse::<SettingsLayer>()\n             .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n+        validate_parsed_source(&layer, SettingsSource::User)?;\n         Self::from_layer(&layer)\n     }\n \n@@ -139,6 +142,7 @@ impl UserSettingsBuilder {\n         let layer = source\n             .parse::<SettingsLayer>()\n             .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n+        validate_parsed_source(&layer, SettingsSource::User)?;\n         Self::from_layer_with_cli_overrides(&layer, cli)\n     }\n \n@@ -176,7 +180,7 @@ impl RunSettingsBuilder {\n     }\n \n     pub fn load_from(path: &Path) -> Result<RunNamespace> {\n-        let layer = load_settings_path(path)?;\n+        let layer = load_settings_path_with_source(path, SettingsSource::DirectRun)?;\n         Self::from_layer(&layer)\n     }\n \n@@ -184,6 +188,7 @@ impl RunSettingsBuilder {\n         let layer = source\n             .parse::<SettingsLayer>()\n             .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n+        validate_parsed_source(&layer, SettingsSource::DirectRun)?;\n         Self::from_layer(&layer)\n     }\n \n@@ -244,6 +249,7 @@ pub fn server_runtime_settings_from_toml(\n     let layer = source\n         .parse::<SettingsLayer>()\n         .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n+    validate_parsed_source(&layer, SettingsSource::ActiveSettings)?;\n     resolve_server_runtime_settings(layer, run_overrides, server_overrides)\n }\n \n@@ -412,6 +418,11 @@ fn cost_rates_to_catalog(rates: &CostRates) -> model_catalog::CostRates {\n     }\n }\n \n+fn validate_parsed_source(layer: &SettingsLayer, source: SettingsSource) -> Result<()> {\n+    validate_settings_source(layer, source)\n+        .map_err(|err| Error::parse(\"Failed to parse settings file\", err))\n+}\n+\n #[derive(Clone, Debug, Default)]\n pub struct WorkflowSettingsBuilder {\n     args:     SettingsLayer,\n@@ -431,6 +442,7 @@ impl WorkflowSettingsBuilder {\n         let layer = source\n             .parse::<SettingsLayer>()\n             .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n+        validate_parsed_source(&layer, SettingsSource::Workflow)?;\n         Self::from_layer(&layer)\n             .map_err(|errors| Error::resolve(\"failed to resolve workflow settings\", errors.into()))\n     }\n@@ -459,6 +471,7 @@ impl WorkflowSettingsBuilder {\n         let layer = source\n             .parse::<SettingsLayer>()\n             .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n+        validate_parsed_source(&layer, SettingsSource::Workflow)?;\n         Ok(self.workflow_layer(layer))\n     }\n \n@@ -466,6 +479,7 @@ impl WorkflowSettingsBuilder {\n         let mut layer = source\n             .parse::<SettingsLayer>()\n             .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n+        validate_parsed_source(&layer, SettingsSource::Workflow)?;\n         layer.run = Some(run);\n         Ok(self.workflow_layer(layer))\n     }\n@@ -484,6 +498,7 @@ impl WorkflowSettingsBuilder {\n         let layer = source\n             .parse::<SettingsLayer>()\n             .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n+        validate_parsed_source(&layer, SettingsSource::Project)?;\n         Ok(self.project_layer(layer))\n     }\n \n@@ -491,12 +506,16 @@ impl WorkflowSettingsBuilder {\n         let mut layer = source\n             .parse::<SettingsLayer>()\n             .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n+        validate_parsed_source(&layer, SettingsSource::Project)?;\n         layer.run = Some(run);\n         Ok(self.project_layer(layer))\n     }\n \n     pub fn project_file(self, path: &Path) -> Result<Self> {\n-        Ok(self.project_layer(load_settings_path(path)?))\n+        Ok(self.project_layer(load_settings_path_with_source(\n+            path,\n+            SettingsSource::Project,\n+        )?))\n     }\n \n     #[must_use]\n@@ -509,11 +528,15 @@ impl WorkflowSettingsBuilder {\n         let layer = source\n             .parse::<SettingsLayer>()\n             .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n+        validate_parsed_source(&layer, SettingsSource::User)?;\n         Ok(self.user_layer(layer))\n     }\n \n     pub fn user_file(self, path: &Path) -> Result<Self> {\n-        Ok(self.user_layer(load_settings_path(path)?))\n+        Ok(self.user_layer(load_settings_path_with_source(\n+            path,\n+            SettingsSource::User,\n+        )?))\n     }\n \n     #[must_use]\n@@ -643,11 +666,24 @@ mod tests {\n     use fabro_types::settings::run::{ApprovalMode, RunMode};\n \n     use super::{RunSettingsBuilder, WorkflowSettingsBuilder, server_runtime_settings_from_toml};\n-    use crate::{CliLayer, CliOutputLayer, ReplaceMap, RunExecutionLayer, RunLayer, RunModelLayer};\n+    use crate::{\n+        CliLayer, CliOutputLayer, ReplaceMap, RunExecutionLayer, RunLayer, RunModelLayer,\n+        SettingsLayer,\n+    };\n+\n+    fn seeded_environment_catalog() -> crate::MergeMap<crate::EnvironmentLayer> {\n+        r#\"\n+[environments.default]\n+provider = \"local\"\n+\"#\n+        .parse::<SettingsLayer>()\n+        .expect(\"seeded catalog should parse\")\n+        .environments\n+    }\n \n     #[test]\n-    fn run_settings_builder_resolves_run_namespace() {\n-        let settings = RunSettingsBuilder::from_toml(\n+    fn run_settings_builder_requires_injected_environment_catalog() {\n+        let err = RunSettingsBuilder::from_toml(\n             r#\"\n _version = 1\n \n@@ -659,15 +695,19 @@ type = \"stdio\"\n command = [\"demo-mcp\"]\n \"#,\n         )\n-        .expect(\"run settings should resolve\");\n+        .expect_err(\"run settings should not resolve without a server environment catalog\");\n \n-        assert_eq!(settings.execution.mode, RunMode::DryRun);\n-        assert!(settings.agent.mcps.contains_key(\"demo\"));\n+        let message = err.to_string();\n+        assert!(\n+            message.contains(\"run.environment.id\") && message.contains(\"unknown environment\"),\n+            \"expected missing server environment catalog diagnostic, got: {message}\"\n+        );\n     }\n \n     #[test]\n     fn workflow_builder_preserves_run_overrides_when_cli_overrides_are_added() {\n         let settings = WorkflowSettingsBuilder::new()\n+            .server_manifest_defaults(RunLayer::default(), seeded_environment_catalog())\n             .run_overrides(RunLayer {\n                 metadata: ReplaceMap::from(HashMap::from([(\"env\".to_string(), \"cli\".to_string())])),\n                 model: Some(RunModelLayer {\n@@ -718,6 +758,46 @@ command = [\"demo-mcp\"]\n         assert_eq!(settings.run.execution.approval, ApprovalMode::Auto);\n     }\n \n+    #[test]\n+    fn workflow_environment_catalog_definition_is_rejected() {\n+        let err = WorkflowSettingsBuilder::new()\n+            .workflow_toml(\n+                r#\"\n+_version = 1\n+\n+[environments.cloud]\n+provider = \"docker\"\n+\"#,\n+            )\n+            .expect_err(\"workflow environment catalogs should be server-managed\");\n+\n+        let message = err.to_string();\n+        assert!(\n+            message.contains(\"[environments.cloud] is now server-managed\"),\n+            \"expected targeted server-managed environment diagnostic, got: {message}\"\n+        );\n+    }\n+\n+    #[test]\n+    fn project_environment_catalog_definition_is_rejected() {\n+        let err = WorkflowSettingsBuilder::new()\n+            .project_toml(\n+                r#\"\n+_version = 1\n+\n+[environments.cloud]\n+provider = \"docker\"\n+\"#,\n+            )\n+            .expect_err(\"project environment catalogs should be server-managed\");\n+\n+        let message = err.to_string();\n+        assert!(\n+            message.contains(\"[environments.cloud] is now server-managed\"),\n+            \"expected targeted server-managed environment diagnostic, got: {message}\"\n+        );\n+    }\n+\n     #[test]\n     fn server_runtime_settings_preserves_llm_catalog_overrides() {\n         let settings = server_runtime_settings_from_toml(\ndiff --git a/lib/crates/fabro-config/src/defaults.toml b/lib/crates/fabro-config/src/defaults.toml\nindex faecfdeb5..ae70776fa 100644\n--- a/lib/crates/fabro-config/src/defaults.toml\n+++ b/lib/crates/fabro-config/src/defaults.toml\n@@ -26,40 +26,6 @@ push = true\n [run.environment]\n id = \"default\"\n \n-[environments.default]\n-provider = \"docker\"\n-\n-[environments.default.image]\n-docker = \"buildpack-deps:noble\"\n-\n-[environments.default.resources]\n-cpu = 2\n-memory = \"4GB\"\n-\n-[environments.default.lifecycle]\n-preserve = false\n-stop_on_terminal = true\n-\n-[environments.local]\n-provider = \"local\"\n-\n-[environments.docker]\n-provider = \"docker\"\n-\n-[environments.docker.image]\n-docker = \"buildpack-deps:noble\"\n-\n-[environments.docker.resources]\n-cpu = 2\n-memory = \"4GB\"\n-\n-[environments.docker.lifecycle]\n-preserve = false\n-stop_on_terminal = true\n-\n-[environments.daytona]\n-provider = \"daytona\"\n-\n [cli.output]\n format = \"text\"\n verbosity = \"normal\"\ndiff --git a/lib/crates/fabro-config/src/lib.rs b/lib/crates/fabro-config/src/lib.rs\nindex ccabacd0f..70fae6129 100644\n--- a/lib/crates/fabro-config/src/lib.rs\n+++ b/lib/crates/fabro-config/src/lib.rs\n@@ -63,7 +63,8 @@ pub use layers::{\n pub use logging::{resolve_log_destination, resolve_log_destination_with_env};\n pub use parse::ParseError;\n pub use resolve::{\n-    ResolveError, resolve_cli, resolve_project, resolve_run, resolve_server, resolve_workflow,\n+    ResolveError, resolve_cli, resolve_environment_layer, resolve_project, resolve_run,\n+    resolve_server, resolve_workflow,\n };\n use serde::de::DeserializeOwned;\n pub use storage::{RunScratch, RuntimeDirectory, Storage};\ndiff --git a/lib/crates/fabro-config/src/load.rs b/lib/crates/fabro-config/src/load.rs\nindex 324d7f581..701658e75 100644\n--- a/lib/crates/fabro-config/src/load.rs\n+++ b/lib/crates/fabro-config/src/load.rs\n@@ -7,6 +7,7 @@ use std::path::{Path, PathBuf};\n \n use fabro_types::settings::InterpString;\n \n+use crate::parse::{SettingsSource, validate_settings_source};\n use crate::{Error, Result, RunGoalLayer, SettingsLayer, migrations};\n \n #[expect(\n@@ -14,24 +15,36 @@ use crate::{Error, Result, RunGoalLayer, SettingsLayer, migrations};\n     reason = \"startup config auto-migration warning must be visible before caller logging is configured\"\n )]\n pub(crate) fn load_settings_path(path: &Path) -> Result<SettingsLayer> {\n+    load_settings_path_with_source(path, SettingsSource::ActiveSettings)\n+}\n+\n+#[expect(\n+    clippy::print_stderr,\n+    reason = \"startup config auto-migration warning must be visible before caller logging is configured\"\n+)]\n+pub(crate) fn load_settings_path_with_source(\n+    path: &Path,\n+    source: SettingsSource,\n+) -> Result<SettingsLayer> {\n     let content = std::fs::read_to_string(path).map_err(|source| Error::read_file(path, source))?;\n-    let mut layer = match content.parse::<SettingsLayer>() {\n-        Ok(layer) => layer,\n-        Err(err) => match migrations::run_migrations(path, &content)? {\n+    let content = if source.runs_settings_migrations() {\n+        match migrations::run_migrations(path, &content)? {\n             Some(report) => {\n                 tracing::warn!(\"{}\", report.warning);\n                 eprintln!(\"{}\", report.warning);\n-                report.layer\n-            }\n-            None => {\n-                return Err(Error::parse_file(\n-                    \"Failed to parse settings file\",\n-                    path,\n-                    err,\n-                ));\n+                report.contents\n             }\n-        },\n+            None => content,\n+        }\n+    } else {\n+        content\n     };\n+    let mut layer = content\n+        .parse::<SettingsLayer>()\n+        .map_err(|err| Error::parse_file(\"Failed to parse settings file\", path, err))?;\n+    validate_settings_source(&layer, source).map_err(|err| {\n+        Error::parse_file(\"Failed to parse settings file\", path, err)\n+    })?;\n     let base_dir = path.parent().unwrap_or_else(|| Path::new(\".\"));\n     resolve_goal_file_paths(&mut layer, base_dir);\n     Ok(layer)\n@@ -66,8 +79,6 @@ pub(crate) fn resolve_goal_file_path(path_str: &str, base_dir: &Path) -> PathBuf\n \n #[cfg(test)]\n mod tests {\n-    use fabro_types::settings::run::EnvironmentProvider;\n-\n     use super::*;\n \n     #[test]\n@@ -86,15 +97,21 @@ provider = \"daytona\"\n         .expect(\"write legacy settings\");\n \n         let layer = load_settings_path(&path).expect(\"legacy settings should auto-migrate\");\n-        let resolved = crate::WorkflowSettingsBuilder::from_layer(&layer)\n-            .expect(\"migrated settings should resolve\")\n-            .run;\n \n-        assert_eq!(resolved.environment.provider, EnvironmentProvider::Daytona);\n+        assert_eq!(\n+            layer.run\n+                .as_ref()\n+                .and_then(|run| run.environment.as_ref())\n+                .and_then(|environment| environment.id.as_deref()),\n+            Some(\"daytona\")\n+        );\n         assert!(\n             std::fs::read_to_string(&path)\n                 .expect(\"read rewritten settings\")\n                 .contains(\"[run.environment]\")\n         );\n+        let environment = std::fs::read_to_string(dir.path().join(\"environments/daytona.toml\"))\n+            .expect(\"read migrated environment file\");\n+        assert!(environment.contains(\"provider = \\\"daytona\\\"\"));\n     }\n }\ndiff --git a/lib/crates/fabro-config/src/migrations.rs b/lib/crates/fabro-config/src/migrations.rs\nindex 596ca093a..865b093f2 100644\n--- a/lib/crates/fabro-config/src/migrations.rs\n+++ b/lib/crates/fabro-config/src/migrations.rs\n@@ -4,12 +4,14 @@ use crate::Result;\n \n #[path = \"../migrations/2026050101_legacy_sandbox_to_environments.rs\"]\n mod legacy_sandbox_to_environments;\n+#[path = \"../migrations/2026052801_settings_environments_to_server_files.rs\"]\n+mod settings_environments_to_server_files;\n \n-pub(crate) type MigrationReport = legacy_sandbox_to_environments::LegacySandboxMigrationReport;\n+pub(crate) use settings_environments_to_server_files::SettingsEnvironmentsMigrationReport as MigrationReport;\n \n pub(crate) fn run_migrations(\n     path: &Path,\n     original_contents: &str,\n ) -> Result<Option<MigrationReport>> {\n-    legacy_sandbox_to_environments::migrate_settings_path(path, original_contents)\n+    settings_environments_to_server_files::migrate_settings_path(path, original_contents)\n }\ndiff --git a/lib/crates/fabro-config/src/parse.rs b/lib/crates/fabro-config/src/parse.rs\nindex 66ea23680..37f0bb541 100644\n--- a/lib/crates/fabro-config/src/parse.rs\n+++ b/lib/crates/fabro-config/src/parse.rs\n@@ -32,6 +32,7 @@ pub enum ParseError {\n     Toml(String),\n     Version(VersionError),\n     UnknownTopLevelKey { key: String, hint: Option<String> },\n+    ServerManagedEnvironment { path: String },\n }\n \n impl fmt::Display for ParseError {\n@@ -49,6 +50,10 @@ impl fmt::Display for ParseError {\n                     )\n                 }\n             }\n+            Self::ServerManagedEnvironment { path } => write!(\n+                f,\n+                \"[{path}] is now server-managed; move this definition to the server environments directory\"\n+            ),\n         }\n     }\n }\n@@ -111,6 +116,70 @@ pub(crate) fn parse_settings(input: &str) -> Result<SettingsLayer, ParseError> {\n         .map_err(|e| ParseError::Toml(e.to_string()))\n }\n \n+#[derive(Debug, Clone, Copy, PartialEq, Eq)]\n+pub enum SettingsSource {\n+    ActiveSettings,\n+    Project,\n+    Workflow,\n+    DirectRun,\n+    User,\n+}\n+\n+impl SettingsSource {\n+    #[must_use]\n+    pub(crate) fn runs_settings_migrations(self) -> bool {\n+        matches!(self, Self::ActiveSettings | Self::User)\n+    }\n+}\n+\n+pub fn validate_settings_source(\n+    layer: &SettingsLayer,\n+    source: SettingsSource,\n+) -> Result<(), ParseError> {\n+    if matches!(\n+        source,\n+        SettingsSource::Project | SettingsSource::Workflow | SettingsSource::DirectRun | SettingsSource::User\n+    ) {\n+        if let Some(id) = layer.environments.keys().min() {\n+            return Err(ParseError::ServerManagedEnvironment {\n+                path: format!(\"environments.{id}\"),\n+            });\n+        }\n+    }\n+\n+    if let Some(path) = toml_run_environment_override_path(layer) {\n+        return Err(ParseError::ServerManagedEnvironment { path });\n+    }\n+\n+    Ok(())\n+}\n+\n+fn toml_run_environment_override_path(layer: &SettingsLayer) -> Option<String> {\n+    let environment = layer.run.as_ref()?.environment.as_ref()?;\n+    if environment.image.is_some() {\n+        return Some(\"run.environment.image\".to_string());\n+    }\n+    if environment.resources.is_some() {\n+        return Some(\"run.environment.resources\".to_string());\n+    }\n+    if environment.network.is_some() {\n+        return Some(\"run.environment.network\".to_string());\n+    }\n+    if environment.lifecycle.is_some() {\n+        return Some(\"run.environment.lifecycle\".to_string());\n+    }\n+    if !environment.labels.is_empty() {\n+        return Some(\"run.environment.labels\".to_string());\n+    }\n+    if environment.volumes.is_some() {\n+        return Some(\"run.environment.volumes\".to_string());\n+    }\n+    if !environment.env.is_empty() {\n+        return Some(\"run.environment.env\".to_string());\n+    }\n+    None\n+}\n+\n fn validate_version(raw: &toml::Value) -> Result<(), VersionError> {\n     if let Some(table) = raw.as_table() {\n         if table.contains_key(\"version\") {\ndiff --git a/lib/crates/fabro-config/src/project.rs b/lib/crates/fabro-config/src/project.rs\nindex 763bf0abe..b52663d78 100644\n--- a/lib/crates/fabro-config/src/project.rs\n+++ b/lib/crates/fabro-config/src/project.rs\n@@ -402,7 +402,7 @@ directory = \"custom/\"\n             Some(\"custom/\".to_string())\n         );\n \n-        let project = WorkflowSettingsBuilder::from_toml(\n+        let project = crate::tests::workflow_settings_from_toml(\n             r#\"\n _version = 1\n \ndiff --git a/lib/crates/fabro-config/src/resolve/environment.rs b/lib/crates/fabro-config/src/resolve/environment.rs\nindex 32f1907b6..e427e02db 100644\n--- a/lib/crates/fabro-config/src/resolve/environment.rs\n+++ b/lib/crates/fabro-config/src/resolve/environment.rs\n@@ -37,12 +37,26 @@ pub(crate) fn resolve_run_environment(\n         .clone()\n         .into_environment_override()\n         .combine(base.clone());\n-    let environment = resolve_environment_layer(&merged, \"run.environment\", errors);\n+    let environment = resolve_environment_fields(&merged, \"run.environment\", errors);\n     validate_provider_capabilities(&environment, \"run.environment\", errors);\n     RunEnvironmentSettings::from_environment(id, environment)\n }\n \n-fn resolve_environment_layer(\n+pub fn resolve_environment_layer(\n+    layer: &EnvironmentLayer,\n+    path: &str,\n+) -> Result<EnvironmentSettings, Vec<ResolveError>> {\n+    let mut errors = Vec::new();\n+    let environment = resolve_environment_fields(layer, path, &mut errors);\n+    validate_provider_capabilities(&environment, path, &mut errors);\n+    if errors.is_empty() {\n+        Ok(environment)\n+    } else {\n+        Err(errors)\n+    }\n+}\n+\n+fn resolve_environment_fields(\n     layer: &EnvironmentLayer,\n     path: &str,\n     errors: &mut Vec<ResolveError>,\ndiff --git a/lib/crates/fabro-config/src/resolve/mod.rs b/lib/crates/fabro-config/src/resolve/mod.rs\nindex 3b654e888..6501dda1a 100644\n--- a/lib/crates/fabro-config/src/resolve/mod.rs\n+++ b/lib/crates/fabro-config/src/resolve/mod.rs\n@@ -7,6 +7,7 @@ mod server;\n mod workflow;\n \n pub use cli::resolve_cli;\n+pub use environment::resolve_environment_layer;\n pub(crate) use environment::resolve_run_environment;\n pub use error::ResolveError;\n use fabro_types::settings::InterpString;\n@@ -56,7 +57,7 @@ mod tests {\n \n     use fabro_types::settings::run::{HookType, McpHttpProtocol, McpTransport, TlsMode};\n \n-    use crate::{SettingsLayer, WorkflowSettingsBuilder};\n+    use crate::SettingsLayer;\n \n     #[test]\n     fn resolve_preserves_source_templates_for_mcp_and_hook_strings() {\n@@ -99,7 +100,7 @@ Authorization = \"Bearer {{ env.HOOK_TOKEN }}\"\n         .parse::<SettingsLayer>()\n         .expect(\"settings fixture should parse\");\n \n-        let resolved = WorkflowSettingsBuilder::from_layer(&settings)\n+        let resolved = crate::tests::workflow_settings_from_layer(settings)\n             .expect(\"run settings should resolve\")\n             .run;\n         let mcps = &resolved.agent.mcps;\ndiff --git a/lib/crates/fabro-config/src/run.rs b/lib/crates/fabro-config/src/run.rs\nindex 7fb5ec65f..311cd3726 100644\n--- a/lib/crates/fabro-config/src/run.rs\n+++ b/lib/crates/fabro-config/src/run.rs\n@@ -14,7 +14,8 @@ use std::path::{Path, PathBuf};\n use fabro_types::settings::InterpString;\n use fabro_types::settings::run::{ResolvedGoalSource, ResolvedRunGoal, RunGoal, RunNamespace};\n \n-use crate::load::{load_settings_path, resolve_goal_file_path};\n+use crate::load::{load_settings_path_with_source, resolve_goal_file_path};\n+use crate::parse::{SettingsSource, validate_settings_source};\n use crate::{Result, RunGoalLayer, RunLayer, SettingsLayer};\n \n /// Load and parse a run config from a TOML file.\n@@ -22,7 +23,7 @@ use crate::{Result, RunGoalLayer, RunLayer, SettingsLayer};\n /// Goes through [`load_settings_path`] so that relative `run.goal.file`\n /// paths are anchored at the directory of `path` at load time.\n pub(crate) fn load_run_config(path: &Path) -> Result<SettingsLayer> {\n-    load_settings_path(path)\n+    load_settings_path_with_source(path, SettingsSource::Workflow)\n }\n \n /// Parse a settings TOML source string and extract its `[run]` layer.\n@@ -43,6 +44,8 @@ pub fn parse_run_layer_from_settings_toml(source: &str) -> Result<RunLayer> {\n     let layer = source\n         .parse::<SettingsLayer>()\n         .map_err(|err| crate::Error::parse(\"Failed to parse run config TOML\", err))?;\n+    validate_settings_source(&layer, SettingsSource::DirectRun)\n+        .map_err(|err| crate::Error::parse(\"Failed to parse run config TOML\", err))?;\n     Ok(layer.run.unwrap_or_default())\n }\n \ndiff --git a/lib/crates/fabro-config/src/tests/defaults.rs b/lib/crates/fabro-config/src/tests/defaults.rs\nindex 210bf87c1..4446268bc 100644\n--- a/lib/crates/fabro-config/src/tests/defaults.rs\n+++ b/lib/crates/fabro-config/src/tests/defaults.rs\n@@ -2,7 +2,7 @@ use fabro_types::settings::cli::OutputFormat;\n use fabro_types::settings::run::{ApprovalMode, RunMode};\n use fabro_types::settings::server::ObjectStoreProvider;\n \n-use crate::{Combine, ServerSettingsBuilder, SettingsLayer, WorkflowSettingsBuilder};\n+use crate::{Combine, ServerSettingsBuilder, SettingsLayer};\n \n fn parse(source: &str) -> SettingsLayer {\n     source\n@@ -62,13 +62,7 @@ fn apply_builtin_defaults_materializes_expected_layer() {\n             .and_then(|environment| environment.id.as_deref()),\n         Some(\"default\")\n     );\n-    assert_eq!(\n-        layer\n-            .environments\n-            .get(\"default\")\n-            .and_then(|environment| environment.provider.as_deref()),\n-        Some(\"docker\")\n-    );\n+    assert!(layer.environments.is_empty());\n     assert_eq!(\n         layer\n             .run\n@@ -134,8 +128,7 @@ mode = \"dry_run\"\n \"#,\n     );\n \n-    let settings =\n-        WorkflowSettingsBuilder::from_layer(&layer).expect(\"workflow settings should resolve\");\n+    let settings = super::workflow_settings_from_layer(layer).expect(\"workflow settings should resolve\");\n \n     assert_eq!(settings.run.execution.mode, RunMode::DryRun);\n     assert_eq!(settings.run.execution.approval, ApprovalMode::Prompt);\ndiff --git a/lib/crates/fabro-config/src/tests/mod.rs b/lib/crates/fabro-config/src/tests/mod.rs\nindex 6e97859ba..074c346f6 100644\n--- a/lib/crates/fabro-config/src/tests/mod.rs\n+++ b/lib/crates/fabro-config/src/tests/mod.rs\n@@ -7,3 +7,75 @@ mod resolve_root;\n mod resolve_run;\n mod resolve_server;\n mod resolve_workflow;\n+\n+use fabro_types::WorkflowSettings;\n+\n+use crate::{\n+    EnvironmentLayer, Error, MergeMap, ResolveErrors, RunLayer, SettingsLayer,\n+    WorkflowSettingsBuilder,\n+};\n+\n+pub(crate) fn seeded_environment_catalog() -> MergeMap<EnvironmentLayer> {\n+    r#\"\n+[environments.default]\n+provider = \"docker\"\n+\n+[environments.default.image]\n+docker = \"buildpack-deps:noble\"\n+\n+[environments.default.resources]\n+cpu = 2\n+memory = \"4GB\"\n+\n+[environments.default.lifecycle]\n+preserve = false\n+stop_on_terminal = true\n+\n+[environments.local]\n+provider = \"local\"\n+\n+[environments.docker]\n+provider = \"docker\"\n+\n+[environments.docker.image]\n+docker = \"buildpack-deps:noble\"\n+\n+[environments.docker.resources]\n+cpu = 2\n+memory = \"4GB\"\n+\n+[environments.docker.lifecycle]\n+preserve = false\n+stop_on_terminal = true\n+\n+[environments.daytona]\n+provider = \"daytona\"\n+\"#\n+    .parse::<SettingsLayer>()\n+    .expect(\"seeded environment catalog should parse\")\n+    .environments\n+}\n+\n+pub(crate) fn workflow_settings_from_toml(source: &str) -> crate::Result<WorkflowSettings> {\n+    workflow_settings_from_toml_with_catalog(source, seeded_environment_catalog())\n+}\n+\n+pub(crate) fn workflow_settings_from_toml_with_catalog(\n+    source: &str,\n+    catalog: MergeMap<EnvironmentLayer>,\n+) -> crate::Result<WorkflowSettings> {\n+    WorkflowSettingsBuilder::new()\n+        .server_manifest_defaults(RunLayer::default(), catalog)\n+        .workflow_toml(source)?\n+        .build()\n+        .map_err(|errors| Error::resolve(\"failed to resolve workflow settings\", errors.into()))\n+}\n+\n+pub(crate) fn workflow_settings_from_layer(\n+    layer: SettingsLayer,\n+) -> std::result::Result<WorkflowSettings, ResolveErrors> {\n+    WorkflowSettingsBuilder::new()\n+        .server_manifest_defaults(RunLayer::default(), seeded_environment_catalog())\n+        .workflow_layer(layer)\n+        .build()\n+}\ndiff --git a/lib/crates/fabro-config/src/tests/resolve_project.rs b/lib/crates/fabro-config/src/tests/resolve_project.rs\nindex b23b0971b..71597e07a 100644\n--- a/lib/crates/fabro-config/src/tests/resolve_project.rs\n+++ b/lib/crates/fabro-config/src/tests/resolve_project.rs\n@@ -1,10 +1,10 @@\n-use crate::{SettingsLayer, WorkflowSettingsBuilder};\n+use crate::SettingsLayer;\n \n #[test]\n fn resolves_project_defaults_from_empty_settings() {\n     let settings = SettingsLayer::default();\n \n-    let project = WorkflowSettingsBuilder::from_layer(&settings)\n+    let project = super::workflow_settings_from_layer(settings)\n         .expect(\"empty settings should resolve\")\n         .project;\n \n@@ -20,7 +20,7 @@ fn resolves_project_defaults_from_empty_settings() {\n \n #[test]\n fn resolves_project_metadata_and_ignores_deprecated_directory() {\n-    let project = WorkflowSettingsBuilder::from_toml(\n+    let project = super::workflow_settings_from_toml(\n         r#\"\n _version = 1\n \ndiff --git a/lib/crates/fabro-config/src/tests/resolve_root.rs b/lib/crates/fabro-config/src/tests/resolve_root.rs\nindex bad738301..ed2f77cb0 100644\n--- a/lib/crates/fabro-config/src/tests/resolve_root.rs\n+++ b/lib/crates/fabro-config/src/tests/resolve_root.rs\n@@ -1,7 +1,7 @@\n use fabro_types::settings::InterpString;\n use fabro_types::settings::run::RunMode;\n \n-use crate::{ServerSettingsBuilder, SettingsLayer, WorkflowSettingsBuilder};\n+use crate::{ServerSettingsBuilder, SettingsLayer};\n \n #[test]\n fn resolves_root_settings_require_explicit_server_auth_methods() {\n@@ -35,11 +35,12 @@ methods = [\"github\"]\n [server.auth.github]\n allowed_usernames = []\n \n+\"#;\n+    let workflow_source = r#\"\n+_version = 1\n+\n [run.environment]\n id = \"bad\"\n-\n-[environments.bad]\n-provider = \"not-a-provider\"\n \"#;\n \n     let mut rendered = Vec::new();\n@@ -54,7 +55,16 @@ provider = \"not-a-provider\"\n         .map(|error| error.to_string()),\n     );\n     rendered.extend(\n-        match fabro_config::WorkflowSettingsBuilder::from_toml(source)\n+        match super::workflow_settings_from_toml_with_catalog(\n+            workflow_source,\n+            r#\"\n+[environments.bad]\n+provider = \"not-a-provider\"\n+\"#\n+            .parse::<SettingsLayer>()\n+            .expect(\"bad environment catalog should parse\")\n+            .environments,\n+        )\n             .expect_err(\"invalid run settings should fail\")\n         {\n             fabro_config::Error::Resolve { errors, .. } => errors,\n@@ -92,7 +102,7 @@ name = \"gpt-5\"\n \"#;\n \n     let workflow_settings =\n-        WorkflowSettingsBuilder::from_toml(source).expect(\"workflow settings should resolve\");\n+        super::workflow_settings_from_toml(source).expect(\"workflow settings should resolve\");\n     let server = ServerSettingsBuilder::from_toml(source).expect(\"server settings should resolve\");\n \n     let project_json = serde_json::to_value(&workflow_settings.project)\n@@ -126,7 +136,7 @@ name = \"gpt-5\"\n #[test]\n fn workflow_settings_resolve_defaults_and_expose_fields() {\n     let settings = SettingsLayer::default();\n-    let resolved = fabro_config::WorkflowSettingsBuilder::from_layer(&settings)\n+    let resolved = super::workflow_settings_from_layer(settings)\n         .expect(\"defaults should resolve\");\n \n     let project_json =\n@@ -141,7 +151,7 @@ fn workflow_settings_resolve_defaults_and_expose_fields() {\n \n #[test]\n fn workflow_settings_combine_labels_with_later_namespaces_winning() {\n-    let labels = fabro_config::WorkflowSettingsBuilder::from_toml(\n+    let labels = super::workflow_settings_from_toml(\n         r#\"\n _version = 1\n \n@@ -169,16 +179,20 @@ shared = \"run\"\n \n #[test]\n fn workflow_settings_report_invalid_environment_provider() {\n-    let errors = match fabro_config::WorkflowSettingsBuilder::from_toml(\n+    let errors = match super::workflow_settings_from_toml_with_catalog(\n         r#\"\n _version = 1\n \n [run.environment]\n id = \"bad\"\n-\n+\"#,\n+        r#\"\n [environments.bad]\n provider = \"not-a-provider\"\n-\"#,\n+\"#\n+        .parse::<SettingsLayer>()\n+        .expect(\"bad environment catalog should parse\")\n+        .environments,\n     )\n     .expect_err(\"invalid workflow settings should fail\")\n     {\n@@ -196,20 +210,24 @@ provider = \"not-a-provider\"\n \n #[test]\n fn workflow_settings_accumulate_multiple_run_errors() {\n-    let rendered = fabro_config::WorkflowSettingsBuilder::from_toml(\n+    let rendered = super::workflow_settings_from_toml_with_catalog(\n         r#\"\n _version = 1\n \n [run.environment]\n id = \"bad\"\n \n-[environments.bad]\n-provider = \"not-a-provider\"\n-\n [[run.prepare.steps]]\n script = \"echo hi\"\n command = [\"echo\", \"hi\"]\n \"#,\n+        r#\"\n+[environments.bad]\n+provider = \"not-a-provider\"\n+\"#\n+        .parse::<SettingsLayer>()\n+        .expect(\"bad environment catalog should parse\")\n+        .environments,\n     )\n     .expect_err(\"invalid workflow settings should fail\")\n     .to_string();\ndiff --git a/lib/crates/fabro-config/src/tests/resolve_run.rs b/lib/crates/fabro-config/src/tests/resolve_run.rs\nindex 930117984..f89e421e4 100644\n--- a/lib/crates/fabro-config/src/tests/resolve_run.rs\n+++ b/lib/crates/fabro-config/src/tests/resolve_run.rs\n@@ -3,11 +3,35 @@ use fabro_types::settings::run::{\n     ApprovalMode, EnvironmentNetworkMode, EnvironmentProvider, RunGoal, RunMode,\n };\n \n-use crate::{SettingsLayer, WorkflowSettingsBuilder};\n+use crate::{MergeMap, SettingsLayer};\n+\n+fn catalog(source: &str) -> MergeMap<crate::EnvironmentLayer> {\n+    source\n+        .parse::<SettingsLayer>()\n+        .expect(\"environment catalog should parse\")\n+        .environments\n+}\n+\n+fn workflow_settings_from_toml_with_catalog(\n+    source: &str,\n+    catalog: &str,\n+) -> crate::Result<fabro_types::WorkflowSettings> {\n+    super::workflow_settings_from_toml_with_catalog(source, self::catalog(catalog))\n+}\n+\n+fn workflow_settings_from_toml(source: &str) -> crate::Result<fabro_types::WorkflowSettings> {\n+    super::workflow_settings_from_toml(source)\n+}\n+\n+fn workflow_settings_from_layer(\n+    layer: SettingsLayer,\n+) -> std::result::Result<fabro_types::WorkflowSettings, crate::ResolveErrors> {\n+    super::workflow_settings_from_layer(layer)\n+}\n \n #[test]\n fn run_model_controls_round_trip_through_resolve() {\n-    let settings = WorkflowSettingsBuilder::from_toml(\n+    let settings = super::workflow_settings_from_toml(\n         r#\"\n _version = 1\n \n@@ -28,7 +52,7 @@ speed = \"fast\"\n \n #[test]\n fn run_model_controls_default_to_none() {\n-    let settings = WorkflowSettingsBuilder::from_layer(&SettingsLayer::default())\n+    let settings = super::workflow_settings_from_layer(SettingsLayer::default())\n         .expect(\"empty settings should resolve\")\n         .run;\n \n@@ -38,7 +62,7 @@ fn run_model_controls_default_to_none() {\n \n #[test]\n fn resolves_run_defaults_from_empty_settings() {\n-    let settings = WorkflowSettingsBuilder::from_layer(&SettingsLayer::default())\n+    let settings = super::workflow_settings_from_layer(SettingsLayer::default())\n         .expect(\"empty settings should resolve\")\n         .run;\n \n@@ -71,20 +95,15 @@ fn resolves_run_defaults_from_empty_settings() {\n }\n \n #[test]\n-fn resolves_named_daytona_environment_and_run_overrides() {\n-    let settings = WorkflowSettingsBuilder::from_toml(\n+fn resolves_named_daytona_environment_from_injected_catalog() {\n+    let settings = workflow_settings_from_toml_with_catalog(\n         r#\"\n _version = 1\n \n [run.environment]\n id = \"fabro-dev\"\n-\n-[run.environment.resources]\n-memory = \"32GB\"\n-\n-[run.environment.lifecycle]\n-preserve = true\n-\n+\"#,\n+        r#\"\n [environments.fabro-dev]\n provider = \"daytona\"\n \n@@ -128,7 +147,7 @@ NODE_ENV = \"development\"\n     assert_eq!(environment.resources.cpu, Some(8));\n     assert_eq!(\n         environment.resources.memory.map(|size| size.as_bytes()),\n-        Some(32_000_000_000)\n+        Some(16_000_000_000)\n     );\n     assert_eq!(\n         environment.resources.disk.map(|size| size.as_bytes()),\n@@ -139,7 +158,7 @@ NODE_ENV = \"development\"\n         EnvironmentNetworkMode::CidrAllowList\n     );\n     assert_eq!(environment.network.allow, vec![\"10.0.0.0/8\"]);\n-    assert!(environment.lifecycle.preserve);\n+    assert!(!environment.lifecycle.preserve);\n     assert_eq!(\n         environment\n             .lifecycle\n@@ -167,7 +186,7 @@ NODE_ENV = \"development\"\n \n #[test]\n fn resolves_run_level_clone_branch_controls() {\n-    let settings = WorkflowSettingsBuilder::from_toml(\n+    let settings = super::workflow_settings_from_toml(\n         r\"\n _version = 1\n \n@@ -195,7 +214,7 @@ push = false\n \n #[test]\n fn disabling_run_branch_forces_meta_branch_off() {\n-    let settings = WorkflowSettingsBuilder::from_toml(\n+    let settings = super::workflow_settings_from_toml(\n         r\"\n _version = 1\n \n@@ -217,7 +236,7 @@ push = true\n \n #[test]\n fn pull_request_requires_pushed_run_branch() {\n-    let disabled_branch = WorkflowSettingsBuilder::from_toml(\n+    let disabled_branch = super::workflow_settings_from_toml(\n         r\"\n _version = 1\n \n@@ -235,7 +254,7 @@ enabled = true\n         \"expected run branch validation error, got: {message}\"\n     );\n \n-    let disabled_push = WorkflowSettingsBuilder::from_toml(\n+    let disabled_push = super::workflow_settings_from_toml(\n         r\"\n _version = 1\n \n@@ -273,7 +292,7 @@ provider = \"local\"\n \n #[test]\n fn resolved_run_chat_surfaces_are_slack_only() {\n-    let settings = WorkflowSettingsBuilder::from_toml(\n+    let settings = super::workflow_settings_from_toml(\n         r##\"\n _version = 1\n \n@@ -358,8 +377,8 @@ channel = \"#ops\"\n }\n \n #[test]\n-fn resolves_explicit_stop_on_terminal_false() {\n-    let settings = WorkflowSettingsBuilder::from_toml(\n+fn toml_run_environment_lifecycle_override_is_rejected() {\n+    let err = super::workflow_settings_from_toml(\n         r\"\n _version = 1\n \n@@ -367,21 +386,25 @@ _version = 1\n stop_on_terminal = false\n \",\n     )\n-    .expect(\"environment stop_on_terminal setting should resolve\")\n-    .run;\n+    .expect_err(\"TOML environment lifecycle overrides should be rejected\");\n \n-    assert!(!settings.environment.lifecycle.stop_on_terminal);\n+    let message = err.to_string();\n+    assert!(\n+        message.contains(\"[run.environment.lifecycle] is now server-managed\"),\n+        \"expected server-managed environment override diagnostic, got: {message}\"\n+    );\n }\n \n #[test]\n fn resolves_minimal_local_environment() {\n-    let settings = WorkflowSettingsBuilder::from_toml(\n+    let settings = workflow_settings_from_toml_with_catalog(\n         r#\"\n _version = 1\n \n [run.environment]\n id = \"host\"\n-\n+\"#,\n+        r#\"\n [environments.host]\n provider = \"local\"\n \"#,\n@@ -396,7 +419,7 @@ provider = \"local\"\n \n #[test]\n fn missing_environment_slug_errors() {\n-    let err = WorkflowSettingsBuilder::from_toml(\n+    let err = super::workflow_settings_from_toml(\n         r#\"\n _version = 1\n \n@@ -415,13 +438,14 @@ id = \"missing\"\n \n #[test]\n fn docker_cidr_allow_list_errors() {\n-    let err = WorkflowSettingsBuilder::from_toml(\n+    let err = workflow_settings_from_toml_with_catalog(\n         r#\"\n _version = 1\n \n [run.environment]\n id = \"locked\"\n-\n+\"#,\n+        r#\"\n [environments.locked]\n provider = \"docker\"\n \n@@ -441,13 +465,14 @@ allow = [\"10.0.0.0/8\"]\n \n #[test]\n fn local_blocked_network_errors() {\n-    let err = WorkflowSettingsBuilder::from_toml(\n+    let err = workflow_settings_from_toml_with_catalog(\n         r#\"\n _version = 1\n \n [run.environment]\n id = \"host\"\n-\n+\"#,\n+        r#\"\n [environments.host]\n provider = \"local\"\n \n@@ -467,13 +492,14 @@ mode = \"block\"\n \n #[test]\n fn daytona_dockerfile_without_image_ref_resolves() {\n-    let settings = WorkflowSettingsBuilder::from_toml(\n+    let settings = workflow_settings_from_toml_with_catalog(\n         r#\"\n _version = 1\n \n [run.environment]\n id = \"cloud\"\n-\n+\"#,\n+        r#\"\n [environments.cloud]\n provider = \"daytona\"\n \n@@ -491,13 +517,14 @@ dockerfile = { path = \"Dockerfile\" }\n \n #[test]\n fn daytona_image_docker_errors() {\n-    let err = WorkflowSettingsBuilder::from_toml(\n+    let err = workflow_settings_from_toml_with_catalog(\n         r#\"\n _version = 1\n \n [run.environment]\n id = \"cloud\"\n-\n+\"#,\n+        r#\"\n [environments.cloud]\n provider = \"daytona\"\n \n@@ -516,7 +543,7 @@ docker = \"ubuntu:24.04\"\n \n #[test]\n fn image_ref_is_rejected_as_unknown_field() {\n-    let err = WorkflowSettingsBuilder::from_toml(\n+    let err = super::workflow_settings_from_toml(\n         r#\"\n _version = 1\n \n@@ -535,7 +562,7 @@ ref = \"ubuntu:24.04\"\n \n #[test]\n fn preserves_goal_variants_and_model_sources() {\n-    let settings = WorkflowSettingsBuilder::from_toml(\n+    let settings = super::workflow_settings_from_toml(\n         r#\"\n _version = 1\n \n@@ -582,7 +609,7 @@ mod run_integrations_github_permissions {\n     use fabro_types::settings::InterpString;\n \n     use crate::layers::Combine;\n-    use crate::{SettingsLayer, WorkflowSettingsBuilder};\n+    use crate::SettingsLayer;\n \n     fn parse_settings(source: &str) -> SettingsLayer {\n         source\n@@ -641,7 +668,7 @@ contents = \"read\"\n         );\n         let merged = workflow.combine(user);\n \n-        let resolved = WorkflowSettingsBuilder::from_layer(&merged)\n+        let resolved = super::workflow_settings_from_layer(merged)\n             .expect(\"merged settings should resolve\")\n             .run;\n \n@@ -664,7 +691,7 @@ contents = \"read\"\n         );\n         let merged = workflow.combine(user);\n \n-        let resolved = WorkflowSettingsBuilder::from_layer(&merged)\n+        let resolved = super::workflow_settings_from_layer(merged)\n             .expect(\"merged settings should resolve\")\n             .run;\n \n@@ -697,7 +724,7 @@ contents = \"read\"\n         );\n         let merged = workflow.combine(user);\n \n-        let resolved = WorkflowSettingsBuilder::from_layer(&merged)\n+        let resolved = super::workflow_settings_from_layer(merged)\n             .expect(\"merged settings should resolve\")\n             .run;\n \n@@ -727,7 +754,7 @@ issues = \"read\"\n \n     #[test]\n     fn resolver_preserves_interp_string_in_permissions() {\n-        let resolved = WorkflowSettingsBuilder::from_toml(\n+        let resolved = super::workflow_settings_from_toml(\n             r#\"\n _version = 1\n \n@@ -752,7 +779,7 @@ issues = \"{{ env.GH_PERM_LEVEL }}\"\n \n mod run_agent_fabro_tools {\n     use crate::layers::Combine;\n-    use crate::{SettingsLayer, WorkflowSettingsBuilder};\n+    use crate::SettingsLayer;\n \n     fn parse_settings(source: &str) -> SettingsLayer {\n         source\n@@ -762,7 +789,7 @@ mod run_agent_fabro_tools {\n \n     #[test]\n     fn defaults_to_false_when_run_agent_is_absent() {\n-        let settings = WorkflowSettingsBuilder::from_layer(&SettingsLayer::default())\n+        let settings = super::workflow_settings_from_layer(SettingsLayer::default())\n             .expect(\"empty settings should resolve\")\n             .run;\n \n@@ -771,7 +798,7 @@ mod run_agent_fabro_tools {\n \n     #[test]\n     fn resolves_true_from_run_agent_table() {\n-        let settings = WorkflowSettingsBuilder::from_toml(\n+        let settings = super::workflow_settings_from_toml(\n             r\"\n _version = 1\n \n@@ -786,7 +813,7 @@ fabro_tools = true\n \n     #[test]\n     fn resolves_explicit_false_from_run_agent_table() {\n-        let settings = WorkflowSettingsBuilder::from_toml(\n+        let settings = super::workflow_settings_from_toml(\n             r\"\n _version = 1\n \n@@ -819,7 +846,7 @@ fabro_tools = true\n         );\n         let merged = workflow.combine(user);\n \n-        let settings = WorkflowSettingsBuilder::from_layer(&merged)\n+        let settings = super::workflow_settings_from_layer(merged)\n             .expect(\"merged settings should resolve\")\n             .run;\n \n@@ -831,7 +858,7 @@ mod run_checkpoint_skip_git_hooks {\n     //! Layer + resolver tests for `[run.checkpoint] skip_git_hooks`.\n \n     use crate::layers::Combine;\n-    use crate::{SettingsLayer, WorkflowSettingsBuilder};\n+    use crate::SettingsLayer;\n \n     fn parse_settings(source: &str) -> SettingsLayer {\n         source\n@@ -841,7 +868,7 @@ mod run_checkpoint_skip_git_hooks {\n \n     #[test]\n     fn resolves_skip_git_hooks_true_when_set() {\n-        let settings = WorkflowSettingsBuilder::from_toml(\n+        let settings = super::workflow_settings_from_toml(\n             r\"\n _version = 1\n \n@@ -857,7 +884,7 @@ skip_git_hooks = true\n \n     #[test]\n     fn resolves_skip_git_hooks_false_when_omitted() {\n-        let settings = WorkflowSettingsBuilder::from_layer(&SettingsLayer::default())\n+        let settings = super::workflow_settings_from_layer(SettingsLayer::default())\n             .expect(\"empty settings should resolve\")\n             .run;\n \n@@ -884,7 +911,7 @@ skip_git_hooks = true\n         );\n         let merged = workflow.combine(user);\n \n-        let settings = WorkflowSettingsBuilder::from_layer(&merged)\n+        let settings = super::workflow_settings_from_layer(merged)\n             .expect(\"merged settings should resolve\")\n             .run;\n \n@@ -914,7 +941,7 @@ exclude_globs = [\"**/lower/**\"]\n         );\n         let merged = workflow.combine(user);\n \n-        let settings = WorkflowSettingsBuilder::from_layer(&merged)\n+        let settings = super::workflow_settings_from_layer(merged)\n             .expect(\"merged settings should resolve\")\n             .run;\n \ndiff --git a/lib/crates/fabro-config/src/tests/resolve_workflow.rs b/lib/crates/fabro-config/src/tests/resolve_workflow.rs\nindex 3e8eb3c9f..c2d574d72 100644\n--- a/lib/crates/fabro-config/src/tests/resolve_workflow.rs\n+++ b/lib/crates/fabro-config/src/tests/resolve_workflow.rs\n@@ -1,10 +1,10 @@\n-use crate::{SettingsLayer, WorkflowSettingsBuilder};\n+use crate::SettingsLayer;\n \n #[test]\n fn resolves_workflow_defaults_from_empty_settings() {\n     let settings = SettingsLayer::default();\n \n-    let workflow = WorkflowSettingsBuilder::from_layer(&settings)\n+    let workflow = super::workflow_settings_from_layer(settings)\n         .expect(\"empty settings should resolve\")\n         .workflow;\n \n@@ -16,7 +16,7 @@ fn resolves_workflow_defaults_from_empty_settings() {\n \n #[test]\n fn resolves_workflow_graph_and_metadata() {\n-    let workflow = WorkflowSettingsBuilder::from_toml(\n+    let workflow = super::workflow_settings_from_toml(\n         r#\"\n _version = 1\n \ndiff --git a/lib/crates/fabro-environment/Cargo.toml b/lib/crates/fabro-environment/Cargo.toml\nnew file mode 100644\nindex 000000000..638538df8\n--- /dev/null\n+++ b/lib/crates/fabro-environment/Cargo.toml\n@@ -0,0 +1,28 @@\n+[package]\n+name = \"fabro-environment\"\n+edition.workspace = true\n+version.workspace = true\n+publish = false\n+license.workspace = true\n+description = \"Server-owned environment domain and durable storage for Fabro\"\n+\n+[lib]\n+doctest = false\n+\n+[lints]\n+workspace = true\n+\n+[dependencies]\n+fabro-config = { path = \"../fabro-config\" }\n+fabro-types = { path = \"../fabro-types\" }\n+hex.workspace = true\n+serde.workspace = true\n+sha2.workspace = true\n+thiserror.workspace = true\n+tokio.workspace = true\n+toml.workspace = true\n+toml_edit.workspace = true\n+\n+[dev-dependencies]\n+tempfile = \"3\"\n+tokio = { workspace = true, features = [\"macros\", \"test-util\"] }\ndiff --git a/lib/crates/fabro-environment/src/error.rs b/lib/crates/fabro-environment/src/error.rs\nnew file mode 100644\nindex 000000000..6557a662f\n--- /dev/null\n+++ b/lib/crates/fabro-environment/src/error.rs\n@@ -0,0 +1,107 @@\n+use std::path::PathBuf;\n+\n+use toml::de::Error as TomlDeError;\n+use toml::ser::Error as TomlSerError;\n+\n+use crate::{EnvironmentId, EnvironmentRevision};\n+\n+#[derive(Debug, thiserror::Error)]\n+pub enum EnvironmentValidationError {\n+    #[error(\"environment id {value:?} must match [a-z0-9][a-z0-9-]{{0,62}}\")]\n+    InvalidEnvironmentId { value: String },\n+    #[error(\"environment settings are invalid: {}\", .errors.join(\"; \"))]\n+    InvalidSettings { errors: Vec<String> },\n+    #[error(\"failed to read Dockerfile referenced by environment at {path:?}\")]\n+    DockerfileRead {\n+        path: PathBuf,\n+        #[source]\n+        source: std::io::Error,\n+    },\n+}\n+\n+#[derive(Debug, thiserror::Error)]\n+pub enum EnvironmentStoreError {\n+    #[error(\"environment not found: {id}\")]\n+    NotFound { id: EnvironmentId },\n+    #[error(\"environment already exists: {id}\")]\n+    AlreadyExists { id: EnvironmentId },\n+    #[error(\"environment revision is missing: {id}\")]\n+    MissingRevision { id: EnvironmentId },\n+    #[error(\"environment revision is stale for {id}: expected {expected}, actual {actual}\")]\n+    StaleRevision {\n+        id:       EnvironmentId,\n+        expected: EnvironmentRevision,\n+        actual:   EnvironmentRevision,\n+    },\n+    #[error(\"environment is protected and cannot be deleted: {id}\")]\n+    Protected { id: EnvironmentId },\n+    #[error(\"environment validation failed: {source}\")]\n+    Validation {\n+        #[from]\n+        source: EnvironmentValidationError,\n+    },\n+    #[error(\"invalid environment filename at {path:?}\")]\n+    InvalidFilename { path: PathBuf, reason: String },\n+    #[error(\"failed to parse environment TOML at {path:?}\")]\n+    Parse {\n+        path:   PathBuf,\n+        #[source]\n+        source: TomlDeError,\n+    },\n+    #[error(\"environment TOML at {path:?} is not UTF-8\")]\n+    InvalidUtf8 {\n+        path:   PathBuf,\n+        #[source]\n+        source: std::str::Utf8Error,\n+    },\n+    #[error(\"failed to serialize environment TOML\")]\n+    Serialize {\n+        #[from]\n+        source: TomlSerError,\n+    },\n+    #[error(\"I/O error at {path:?}\")]\n+    Io {\n+        path:   PathBuf,\n+        #[source]\n+        source: std::io::Error,\n+    },\n+}\n+\n+impl EnvironmentStoreError {\n+    pub(crate) fn io(path: impl Into<PathBuf>, source: std::io::Error) -> Self {\n+        Self::Io {\n+            path: path.into(),\n+            source,\n+        }\n+    }\n+\n+    pub(crate) fn parse(path: impl Into<PathBuf>, source: TomlDeError) -> Self {\n+        Self::Parse {\n+            path: path.into(),\n+            source,\n+        }\n+    }\n+\n+    pub(crate) fn invalid_utf8(path: impl Into<PathBuf>, source: std::str::Utf8Error) -> Self {\n+        Self::InvalidUtf8 {\n+            path: path.into(),\n+            source,\n+        }\n+    }\n+\n+    #[must_use]\n+    pub fn kind(&self) -> &'static str {\n+        match self {\n+            Self::NotFound { .. } => \"not_found\",\n+            Self::AlreadyExists { .. } => \"already_exists\",\n+            Self::MissingRevision { .. } => \"missing_revision\",\n+            Self::StaleRevision { .. } => \"stale_revision\",\n+            Self::Protected { .. } => \"protected\",\n+            Self::Validation { .. } => \"validation\",\n+            Self::InvalidFilename { .. } => \"invalid_filename\",\n+            Self::Parse { .. } | Self::InvalidUtf8 { .. } => \"parse\",\n+            Self::Serialize { .. } => \"serialize\",\n+            Self::Io { .. } => \"io\",\n+        }\n+    }\n+}\ndiff --git a/lib/crates/fabro-environment/src/id.rs b/lib/crates/fabro-environment/src/id.rs\nnew file mode 100644\nindex 000000000..7bca49087\n--- /dev/null\n+++ b/lib/crates/fabro-environment/src/id.rs\n@@ -0,0 +1,164 @@\n+use std::fmt;\n+use std::str::FromStr;\n+\n+use serde::de::Error as _;\n+use serde::{Deserialize, Deserializer, Serialize, Serializer};\n+use sha2::{Digest, Sha256};\n+\n+use crate::EnvironmentValidationError;\n+\n+#[derive(Clone, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]\n+pub struct EnvironmentId(String);\n+\n+impl EnvironmentId {\n+    pub fn new(value: impl Into<String>) -> Result<Self, EnvironmentValidationError> {\n+        let value = value.into();\n+        if is_valid_environment_id(&value) {\n+            Ok(Self(value))\n+        } else {\n+            Err(EnvironmentValidationError::InvalidEnvironmentId { value })\n+        }\n+    }\n+\n+    #[must_use]\n+    pub fn as_str(&self) -> &str {\n+        &self.0\n+    }\n+}\n+\n+impl fmt::Display for EnvironmentId {\n+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {\n+        f.write_str(self.as_str())\n+    }\n+}\n+\n+impl FromStr for EnvironmentId {\n+    type Err = EnvironmentValidationError;\n+\n+    fn from_str(value: &str) -> Result<Self, Self::Err> {\n+        Self::new(value)\n+    }\n+}\n+\n+impl Serialize for EnvironmentId {\n+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>\n+    where\n+        S: Serializer,\n+    {\n+        serializer.serialize_str(self.as_str())\n+    }\n+}\n+\n+impl<'de> Deserialize<'de> for EnvironmentId {\n+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>\n+    where\n+        D: Deserializer<'de>,\n+    {\n+        let value = String::deserialize(deserializer)?;\n+        value.parse().map_err(D::Error::custom)\n+    }\n+}\n+\n+#[derive(Clone, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]\n+pub struct EnvironmentRevision(String);\n+\n+impl EnvironmentRevision {\n+    #[must_use]\n+    pub fn from_bytes(bytes: &[u8]) -> Self {\n+        Self(hex::encode(Sha256::digest(bytes)))\n+    }\n+\n+    #[must_use]\n+    pub fn as_str(&self) -> &str {\n+        &self.0\n+    }\n+}\n+\n+impl fmt::Display for EnvironmentRevision {\n+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {\n+        f.write_str(self.as_str())\n+    }\n+}\n+\n+impl FromStr for EnvironmentRevision {\n+    type Err = EnvironmentRevisionParseError;\n+\n+    fn from_str(value: &str) -> Result<Self, Self::Err> {\n+        if value.len() == 64\n+            && value\n+                .bytes()\n+                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))\n+        {\n+            Ok(Self(value.to_string()))\n+        } else {\n+            Err(EnvironmentRevisionParseError(value.to_string()))\n+        }\n+    }\n+}\n+\n+impl Serialize for EnvironmentRevision {\n+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>\n+    where\n+        S: Serializer,\n+    {\n+        serializer.serialize_str(self.as_str())\n+    }\n+}\n+\n+impl<'de> Deserialize<'de> for EnvironmentRevision {\n+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>\n+    where\n+        D: Deserializer<'de>,\n+    {\n+        let value = String::deserialize(deserializer)?;\n+        value.parse().map_err(D::Error::custom)\n+    }\n+}\n+\n+#[derive(Debug, Clone, PartialEq, Eq)]\n+pub struct EnvironmentRevisionParseError(String);\n+\n+impl fmt::Display for EnvironmentRevisionParseError {\n+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {\n+        write!(f, \"invalid environment revision: {:?}\", self.0)\n+    }\n+}\n+\n+impl std::error::Error for EnvironmentRevisionParseError {}\n+\n+fn is_valid_environment_id(value: &str) -> bool {\n+    let mut bytes = value.bytes();\n+    let Some(first) = bytes.next() else {\n+        return false;\n+    };\n+    if !first.is_ascii_lowercase() && !first.is_ascii_digit() {\n+        return false;\n+    }\n+    if value.len() > 63 {\n+        return false;\n+    }\n+    bytes.all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'-')\n+}\n+\n+#[cfg(test)]\n+mod tests {\n+    use super::{EnvironmentId, EnvironmentRevision};\n+\n+    #[test]\n+    fn environment_id_validation_matches_contract() {\n+        assert!(\"a\".parse::<EnvironmentId>().is_ok());\n+        assert!(\"a-1\".parse::<EnvironmentId>().is_ok());\n+        assert!(\"0\".parse::<EnvironmentId>().is_ok());\n+        assert!(\"A\".parse::<EnvironmentId>().is_err());\n+        assert!(\"a_1\".parse::<EnvironmentId>().is_err());\n+        assert!(\"-a\".parse::<EnvironmentId>().is_err());\n+        assert!(\"a\".repeat(64).parse::<EnvironmentId>().is_err());\n+    }\n+\n+    #[test]\n+    fn revision_requires_lowercase_sha256_hex() {\n+        assert!(\"a\".repeat(64).parse::<EnvironmentRevision>().is_ok());\n+        assert!(\"A\".repeat(64).parse::<EnvironmentRevision>().is_err());\n+        assert!(\"a\".repeat(63).parse::<EnvironmentRevision>().is_err());\n+    }\n+}\ndiff --git a/lib/crates/fabro-environment/src/lib.rs b/lib/crates/fabro-environment/src/lib.rs\nnew file mode 100644\nindex 000000000..5fc53c08c\n--- /dev/null\n+++ b/lib/crates/fabro-environment/src/lib.rs\n@@ -0,0 +1,9 @@\n+mod error;\n+mod id;\n+mod model;\n+mod store;\n+\n+pub use error::{EnvironmentStoreError, EnvironmentValidationError};\n+pub use id::{EnvironmentId, EnvironmentRevision, EnvironmentRevisionParseError};\n+pub use model::{Environment, EnvironmentDraft, EnvironmentReplace};\n+pub use store::EnvironmentStore;\ndiff --git a/lib/crates/fabro-environment/src/model.rs b/lib/crates/fabro-environment/src/model.rs\nnew file mode 100644\nindex 000000000..92dd1a075\n--- /dev/null\n+++ b/lib/crates/fabro-environment/src/model.rs\n@@ -0,0 +1,497 @@\n+use std::collections::BTreeMap;\n+use std::path::{Path, PathBuf};\n+\n+use fabro_config::{\n+    EnvironmentDockerfileLayer, EnvironmentImageLayer, EnvironmentLayer,\n+    EnvironmentLifecycleLayer, EnvironmentNetworkLayer, EnvironmentResourcesLayer,\n+    EnvironmentVolumeLayer, StickyMap,\n+};\n+use fabro_types::settings::InterpString;\n+use fabro_types::settings::run::{\n+    DockerfileSource, EnvironmentImageSettings, EnvironmentLifecycleSettings,\n+    EnvironmentNetworkMode, EnvironmentNetworkSettings, EnvironmentProvider,\n+    EnvironmentResourcesSettings, EnvironmentSettings, EnvironmentVolumeSettings,\n+};\n+use serde::{Deserialize, Serialize};\n+use toml_edit::{Array, ArrayOfTables, DocumentMut, Item, Table, Value};\n+\n+use crate::{\n+    EnvironmentId, EnvironmentRevision, EnvironmentStoreError, EnvironmentValidationError,\n+};\n+\n+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]\n+#[serde(deny_unknown_fields)]\n+pub struct Environment {\n+    pub id:        EnvironmentId,\n+    pub revision:  EnvironmentRevision,\n+    pub provider:  EnvironmentProvider,\n+    pub image:     EnvironmentImageSettings,\n+    pub resources: EnvironmentResourcesSettings,\n+    pub network:   EnvironmentNetworkSettings,\n+    pub lifecycle: EnvironmentLifecycleSettings,\n+    pub labels:    std::collections::HashMap<String, String>,\n+    pub volumes:   Vec<EnvironmentVolumeSettings>,\n+    pub env:       std::collections::HashMap<String, InterpString>,\n+}\n+\n+impl Environment {\n+    pub fn from_toml_bytes(id: EnvironmentId, bytes: &[u8]) -> Result<Self, EnvironmentStoreError> {\n+        let revision = EnvironmentRevision::from_bytes(bytes);\n+        let persisted = parse_persisted(bytes, None)?;\n+        Self::from_persisted(id, revision, persisted, None).map_err(EnvironmentStoreError::from)\n+    }\n+\n+    pub(crate) fn from_persisted_path(\n+        id: EnvironmentId,\n+        bytes: &[u8],\n+        path: impl Into<PathBuf>,\n+    ) -> Result<Self, EnvironmentStoreError> {\n+        let path = path.into();\n+        let revision = EnvironmentRevision::from_bytes(bytes);\n+        let persisted = parse_persisted(bytes, Some(path.clone()))?;\n+        let base_dir = path.parent().unwrap_or_else(|| Path::new(\".\"));\n+        Self::from_persisted(id, revision, persisted, Some(base_dir))\n+            .map_err(EnvironmentStoreError::from)\n+    }\n+\n+    pub(crate) fn from_replace(\n+        id: EnvironmentId,\n+        replacement: EnvironmentReplace,\n+        dockerfile_base_dir: &Path,\n+    ) -> Result<(Self, Vec<u8>), EnvironmentStoreError> {\n+        let settings = replacement.into_settings();\n+        let settings = inline_dense_dockerfile(settings, dockerfile_base_dir)?;\n+        let persisted = environment_settings_to_layer(&settings);\n+        let bytes = canonical_bytes(&persisted).into_bytes();\n+        let revision = EnvironmentRevision::from_bytes(&bytes);\n+        let environment = Self::from_validated_settings(id, revision, settings);\n+        Ok((environment, bytes))\n+    }\n+\n+    pub(crate) fn to_layer(&self) -> EnvironmentLayer {\n+        environment_settings_to_layer(&self.settings())\n+    }\n+\n+    #[must_use]\n+    pub fn settings(&self) -> EnvironmentSettings {\n+        EnvironmentSettings {\n+            provider:  self.provider,\n+            image:     self.image.clone(),\n+            resources: self.resources.clone(),\n+            network:   self.network.clone(),\n+            lifecycle: self.lifecycle.clone(),\n+            labels:    self.labels.clone(),\n+            volumes:   self.volumes.clone(),\n+            env:       self.env.clone(),\n+        }\n+    }\n+\n+    pub fn to_toml_string(&self) -> String {\n+        canonical_bytes(&self.to_layer())\n+    }\n+\n+    fn from_persisted(\n+        id: EnvironmentId,\n+        revision: EnvironmentRevision,\n+        mut persisted: EnvironmentLayer,\n+        dockerfile_base_dir: Option<&Path>,\n+    ) -> Result<Self, EnvironmentValidationError> {\n+        if let Some(base_dir) = dockerfile_base_dir {\n+            inline_layer_dockerfile_paths(&mut persisted, base_dir)?;\n+        }\n+        let settings = resolve_environment(&persisted)?;\n+        Ok(Self::from_validated_settings(id, revision, settings))\n+    }\n+\n+    fn from_validated_settings(\n+        id: EnvironmentId,\n+        revision: EnvironmentRevision,\n+        settings: EnvironmentSettings,\n+    ) -> Self {\n+        Self {\n+            id,\n+            revision,\n+            provider: settings.provider,\n+            image: settings.image,\n+            resources: settings.resources,\n+            network: settings.network,\n+            lifecycle: settings.lifecycle,\n+            labels: settings.labels,\n+            volumes: settings.volumes,\n+            env: settings.env,\n+        }\n+    }\n+}\n+\n+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]\n+#[serde(deny_unknown_fields)]\n+pub struct EnvironmentDraft {\n+    pub id:        EnvironmentId,\n+    pub provider:  EnvironmentProvider,\n+    pub image:     EnvironmentImageSettings,\n+    pub resources: EnvironmentResourcesSettings,\n+    pub network:   EnvironmentNetworkSettings,\n+    pub lifecycle: EnvironmentLifecycleSettings,\n+    pub labels:    std::collections::HashMap<String, String>,\n+    pub volumes:   Vec<EnvironmentVolumeSettings>,\n+    pub env:       std::collections::HashMap<String, InterpString>,\n+}\n+\n+impl From<EnvironmentDraft> for (EnvironmentId, EnvironmentReplace) {\n+    fn from(value: EnvironmentDraft) -> Self {\n+        (value.id, EnvironmentReplace {\n+            provider:  value.provider,\n+            image:     value.image,\n+            resources: value.resources,\n+            network:   value.network,\n+            lifecycle: value.lifecycle,\n+            labels:    value.labels,\n+            volumes:   value.volumes,\n+            env:       value.env,\n+        })\n+    }\n+}\n+\n+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]\n+#[serde(deny_unknown_fields)]\n+pub struct EnvironmentReplace {\n+    pub provider:  EnvironmentProvider,\n+    pub image:     EnvironmentImageSettings,\n+    pub resources: EnvironmentResourcesSettings,\n+    pub network:   EnvironmentNetworkSettings,\n+    pub lifecycle: EnvironmentLifecycleSettings,\n+    pub labels:    std::collections::HashMap<String, String>,\n+    pub volumes:   Vec<EnvironmentVolumeSettings>,\n+    pub env:       std::collections::HashMap<String, InterpString>,\n+}\n+\n+impl EnvironmentReplace {\n+    #[must_use]\n+    pub fn from_settings(settings: EnvironmentSettings) -> Self {\n+        Self {\n+            provider:  settings.provider,\n+            image:     settings.image,\n+            resources: settings.resources,\n+            network:   settings.network,\n+            lifecycle: settings.lifecycle,\n+            labels:    settings.labels,\n+            volumes:   settings.volumes,\n+            env:       settings.env,\n+        }\n+    }\n+\n+    fn into_settings(self) -> EnvironmentSettings {\n+        EnvironmentSettings {\n+            provider:  self.provider,\n+            image:     self.image,\n+            resources: self.resources,\n+            network:   self.network,\n+            lifecycle: self.lifecycle,\n+            labels:    self.labels,\n+            volumes:   self.volumes,\n+            env:       self.env,\n+        }\n+    }\n+}\n+\n+pub(crate) fn canonical_bytes(layer: &EnvironmentLayer) -> String {\n+    let mut doc = DocumentMut::new();\n+    if let Some(provider) = layer.provider.as_deref() {\n+        doc[\"provider\"] = value(provider);\n+    }\n+    if let Some(image) = layer.image.as_ref() {\n+        append_image(doc.as_table_mut(), image);\n+    }\n+    if let Some(resources) = layer.resources.as_ref() {\n+        append_resources(doc.as_table_mut(), resources);\n+    }\n+    if let Some(network) = layer.network.as_ref() {\n+        append_network(doc.as_table_mut(), network);\n+    }\n+    if let Some(lifecycle) = layer.lifecycle.as_ref() {\n+        append_lifecycle(doc.as_table_mut(), lifecycle);\n+    }\n+    append_string_map(doc.as_table_mut(), \"labels\", &layer.labels);\n+    if let Some(volumes) = layer.volumes.as_deref() {\n+        append_volumes(doc.as_table_mut(), volumes);\n+    }\n+    append_interp_map(doc.as_table_mut(), \"env\", &layer.env);\n+    doc.to_string()\n+}\n+\n+fn parse_persisted(\n+    bytes: &[u8],\n+    path: Option<PathBuf>,\n+) -> Result<EnvironmentLayer, EnvironmentStoreError> {\n+    let content = std::str::from_utf8(bytes).map_err(|err| match &path {\n+        Some(path) => EnvironmentStoreError::invalid_utf8(path.clone(), err),\n+        None => EnvironmentStoreError::invalid_utf8(\"<memory>\", err),\n+    })?;\n+    toml::from_str(content).map_err(|err| match path {\n+        Some(path) => EnvironmentStoreError::parse(path, err),\n+        None => EnvironmentStoreError::parse(\"<memory>\", err),\n+    })\n+}\n+\n+fn resolve_environment(\n+    layer: &EnvironmentLayer,\n+) -> Result<EnvironmentSettings, EnvironmentValidationError> {\n+    fabro_config::resolve_environment_layer(layer, \"environment\").map_err(|errors| {\n+        EnvironmentValidationError::InvalidSettings {\n+            errors: errors.into_iter().map(|err| err.to_string()).collect(),\n+        }\n+    })\n+}\n+\n+fn inline_layer_dockerfile_paths(\n+    layer: &mut EnvironmentLayer,\n+    base_dir: &Path,\n+) -> Result<(), EnvironmentValidationError> {\n+    let Some(image) = layer.image.as_mut() else {\n+        return Ok(());\n+    };\n+    let Some(EnvironmentDockerfileLayer::Path { path }) = image.dockerfile.as_ref() else {\n+        return Ok(());\n+    };\n+    let path = resolve_path(base_dir, path);\n+    let content =\n+        std::fs::read_to_string(&path).map_err(|source| EnvironmentValidationError::DockerfileRead {\n+            path: path.clone(),\n+            source,\n+        })?;\n+    image.dockerfile = Some(EnvironmentDockerfileLayer::Inline(content));\n+    Ok(())\n+}\n+\n+fn inline_dense_dockerfile(\n+    mut settings: EnvironmentSettings,\n+    base_dir: &Path,\n+) -> Result<EnvironmentSettings, EnvironmentValidationError> {\n+    let Some(DockerfileSource::Path { path }) = settings.image.dockerfile.as_ref() else {\n+        return Ok(settings);\n+    };\n+    let path = resolve_path(base_dir, path);\n+    let content =\n+        std::fs::read_to_string(&path).map_err(|source| EnvironmentValidationError::DockerfileRead {\n+            path: path.clone(),\n+            source,\n+        })?;\n+    settings.image.dockerfile = Some(DockerfileSource::Inline(content));\n+    Ok(settings)\n+}\n+\n+fn resolve_path(base_dir: &Path, path: &str) -> PathBuf {\n+    let path = Path::new(path);\n+    if path.is_absolute() {\n+        path.to_path_buf()\n+    } else {\n+        base_dir.join(path)\n+    }\n+}\n+\n+fn environment_settings_to_layer(settings: &EnvironmentSettings) -> EnvironmentLayer {\n+    EnvironmentLayer {\n+        provider:  Some(settings.provider.to_string()),\n+        image:     image_settings_to_layer(&settings.image),\n+        resources: resources_settings_to_layer(&settings.resources),\n+        network:   network_settings_to_layer(&settings.network),\n+        lifecycle: lifecycle_settings_to_layer(&settings.lifecycle),\n+        labels:    StickyMap::from(settings.labels.clone()),\n+        volumes:   volumes_settings_to_layer(&settings.volumes),\n+        env:       StickyMap::from(settings.env.clone()),\n+    }\n+}\n+\n+fn image_settings_to_layer(\n+    settings: &EnvironmentImageSettings,\n+) -> Option<EnvironmentImageLayer> {\n+    if settings.docker.is_none() && settings.dockerfile.is_none() {\n+        return None;\n+    }\n+    Some(EnvironmentImageLayer {\n+        docker:     settings.docker.clone(),\n+        dockerfile: settings.dockerfile.as_ref().map(dockerfile_source_to_layer),\n+    })\n+}\n+\n+fn dockerfile_source_to_layer(source: &DockerfileSource) -> EnvironmentDockerfileLayer {\n+    match source {\n+        DockerfileSource::Inline(value) => EnvironmentDockerfileLayer::Inline(value.clone()),\n+        DockerfileSource::Path { path } => EnvironmentDockerfileLayer::Path { path: path.clone() },\n+    }\n+}\n+\n+fn resources_settings_to_layer(\n+    settings: &EnvironmentResourcesSettings,\n+) -> Option<EnvironmentResourcesLayer> {\n+    if settings.cpu.is_none() && settings.memory.is_none() && settings.disk.is_none() {\n+        return None;\n+    }\n+    Some(EnvironmentResourcesLayer {\n+        cpu:    settings.cpu,\n+        memory: settings.memory,\n+        disk:   settings.disk,\n+    })\n+}\n+\n+fn network_settings_to_layer(\n+    settings: &EnvironmentNetworkSettings,\n+) -> Option<EnvironmentNetworkLayer> {\n+    if settings.mode == EnvironmentNetworkMode::AllowAll && settings.allow.is_empty() {\n+        return None;\n+    }\n+    Some(EnvironmentNetworkLayer {\n+        mode:  Some(settings.mode.to_string()),\n+        allow: settings.allow.clone(),\n+    })\n+}\n+\n+fn lifecycle_settings_to_layer(\n+    settings: &EnvironmentLifecycleSettings,\n+) -> Option<EnvironmentLifecycleLayer> {\n+    if !settings.preserve && settings.stop_on_terminal && settings.auto_stop.is_none() {\n+        return None;\n+    }\n+    Some(EnvironmentLifecycleLayer {\n+        preserve:         settings.preserve.then_some(true),\n+        stop_on_terminal: (!settings.stop_on_terminal).then_some(false),\n+        auto_stop:        settings.auto_stop,\n+    })\n+}\n+\n+fn volumes_settings_to_layer(\n+    settings: &[EnvironmentVolumeSettings],\n+) -> Option<Vec<EnvironmentVolumeLayer>> {\n+    if settings.is_empty() {\n+        return None;\n+    }\n+    Some(settings.iter().map(volume_settings_to_layer).collect())\n+}\n+\n+fn volume_settings_to_layer(settings: &EnvironmentVolumeSettings) -> EnvironmentVolumeLayer {\n+    EnvironmentVolumeLayer {\n+        id:         settings.id.clone(),\n+        mount_path: settings.mount_path.clone(),\n+        subpath:    settings.subpath.clone(),\n+    }\n+}\n+\n+fn append_image(root: &mut Table, image: &EnvironmentImageLayer) {\n+    let table = ensure_table(root, &[\"image\"]);\n+    if let Some(docker) = image.docker.as_deref() {\n+        table[\"docker\"] = value(docker);\n+    }\n+    if let Some(dockerfile) = image.dockerfile.as_ref() {\n+        match dockerfile {\n+            EnvironmentDockerfileLayer::Inline(content) => {\n+                table[\"dockerfile\"] = value(content.as_str());\n+            }\n+            EnvironmentDockerfileLayer::Path { path } => {\n+                let dockerfile_table = ensure_table(table, &[\"dockerfile\"]);\n+                dockerfile_table[\"path\"] = value(path.as_str());\n+            }\n+        }\n+    }\n+}\n+\n+fn append_resources(root: &mut Table, resources: &EnvironmentResourcesLayer) {\n+    let table = ensure_table(root, &[\"resources\"]);\n+    if let Some(cpu) = resources.cpu {\n+        table[\"cpu\"] = value(i64::from(cpu));\n+    }\n+    if let Some(memory) = resources.memory {\n+        table[\"memory\"] = value(memory.to_string());\n+    }\n+    if let Some(disk) = resources.disk {\n+        table[\"disk\"] = value(disk.to_string());\n+    }\n+}\n+\n+fn append_network(root: &mut Table, network: &EnvironmentNetworkLayer) {\n+    let table = ensure_table(root, &[\"network\"]);\n+    if let Some(mode) = network.mode.as_deref() {\n+        table[\"mode\"] = value(mode);\n+    }\n+    if !network.allow.is_empty() {\n+        table[\"allow\"] = string_array(&network.allow);\n+    }\n+}\n+\n+fn append_lifecycle(root: &mut Table, lifecycle: &EnvironmentLifecycleLayer) {\n+    let table = ensure_table(root, &[\"lifecycle\"]);\n+    if let Some(preserve) = lifecycle.preserve {\n+        table[\"preserve\"] = value(preserve);\n+    }\n+    if let Some(stop_on_terminal) = lifecycle.stop_on_terminal {\n+        table[\"stop_on_terminal\"] = value(stop_on_terminal);\n+    }\n+    if let Some(auto_stop) = lifecycle.auto_stop {\n+        table[\"auto_stop\"] = value(auto_stop.to_string());\n+    }\n+}\n+\n+fn append_string_map(root: &mut Table, name: &str, map: &StickyMap<String>) {\n+    if map.is_empty() {\n+        return;\n+    }\n+    let table = ensure_table(root, &[name]);\n+    for (key, value) in sorted_map(map) {\n+        table[key] = self::value(value.as_str());\n+    }\n+}\n+\n+fn append_interp_map(root: &mut Table, name: &str, map: &StickyMap<InterpString>) {\n+    if map.is_empty() {\n+        return;\n+    }\n+    let table = ensure_table(root, &[name]);\n+    for (key, value) in sorted_map(map) {\n+        table[key] = self::value(value.as_source());\n+    }\n+}\n+\n+fn append_volumes(root: &mut Table, volumes: &[EnvironmentVolumeLayer]) {\n+    if volumes.is_empty() {\n+        return;\n+    }\n+    let mut array = ArrayOfTables::new();\n+    for volume in volumes {\n+        let mut table = Table::new();\n+        table[\"id\"] = value(volume.id.as_str());\n+        table[\"mount_path\"] = value(volume.mount_path.as_str());\n+        if let Some(subpath) = volume.subpath.as_deref() {\n+            table[\"subpath\"] = value(subpath);\n+        }\n+        array.push(table);\n+    }\n+    root[\"volumes\"] = Item::ArrayOfTables(array);\n+}\n+\n+fn ensure_table<'a>(root: &'a mut Table, path: &[&str]) -> &'a mut Table {\n+    let mut current = root;\n+    for key in path {\n+        if !current.contains_key(*key) {\n+            current[*key] = Item::Table(Table::new());\n+        }\n+        current = current[*key]\n+            .as_table_mut()\n+            .expect(\"environment canonical table should be a table\");\n+    }\n+    current\n+}\n+\n+fn value(value: impl Into<Value>) -> Item {\n+    Item::Value(value.into())\n+}\n+\n+fn string_array(values: &[String]) -> Item {\n+    let mut array = Array::new();\n+    for value in values {\n+        array.push(value.as_str());\n+    }\n+    Item::Value(Value::Array(array))\n+}\n+\n+fn sorted_map<V>(map: &StickyMap<V>) -> BTreeMap<&String, &V> {\n+    map.iter().collect()\n+}\ndiff --git a/lib/crates/fabro-environment/src/store.rs b/lib/crates/fabro-environment/src/store.rs\nnew file mode 100644\nindex 000000000..a2677af93\n--- /dev/null\n+++ b/lib/crates/fabro-environment/src/store.rs\n@@ -0,0 +1,688 @@\n+use std::collections::HashMap;\n+use std::io::ErrorKind;\n+use std::path::{Path, PathBuf};\n+use std::time::{SystemTime, UNIX_EPOCH};\n+\n+use fabro_config::{EnvironmentLayer, MergeMap};\n+use tokio::fs;\n+use tokio::io::AsyncWriteExt as _;\n+use tokio::sync::Mutex;\n+\n+use crate::{\n+    Environment, EnvironmentDraft, EnvironmentId, EnvironmentReplace, EnvironmentRevision,\n+    EnvironmentStoreError,\n+};\n+\n+const SEEDS: &[(&str, &str)] = &[\n+    (\"default\", DEFAULT_ENVIRONMENT_TOML),\n+    (\"local\", LOCAL_ENVIRONMENT_TOML),\n+    (\"docker\", DOCKER_ENVIRONMENT_TOML),\n+    (\"daytona\", DAYTONA_ENVIRONMENT_TOML),\n+];\n+\n+const DEFAULT_ENVIRONMENT_TOML: &str = r#\"provider = \"docker\"\n+\n+[image]\n+docker = \"buildpack-deps:noble\"\n+\n+[resources]\n+cpu = 2\n+memory = \"4GB\"\n+\n+[lifecycle]\n+preserve = false\n+stop_on_terminal = true\n+\"#;\n+\n+const LOCAL_ENVIRONMENT_TOML: &str = r#\"provider = \"local\"\n+\"#;\n+\n+const DOCKER_ENVIRONMENT_TOML: &str = r#\"provider = \"docker\"\n+\n+[image]\n+docker = \"buildpack-deps:noble\"\n+\n+[resources]\n+cpu = 2\n+memory = \"4GB\"\n+\n+[lifecycle]\n+preserve = false\n+stop_on_terminal = true\n+\"#;\n+\n+const DAYTONA_ENVIRONMENT_TOML: &str = r#\"provider = \"daytona\"\n+\"#;\n+\n+#[derive(Debug)]\n+pub struct EnvironmentStore {\n+    dir:              PathBuf,\n+    request_base_dir: PathBuf,\n+    mutations:        Mutex<()>,\n+    environments:     std::sync::RwLock<HashMap<EnvironmentId, Environment>>,\n+}\n+\n+impl EnvironmentStore {\n+    /// Synchronously seed missing built-in environment files and load all\n+    /// persisted environments. The synchronous file access runs during server\n+    /// startup before request handling begins.\n+    pub fn load_or_seed(dir: impl Into<PathBuf>) -> Result<Self, EnvironmentStoreError> {\n+        let dir = dir.into();\n+        seed_missing_environments(&dir)?;\n+        let environments = load_environments(&dir)?;\n+        let request_base_dir = dir\n+            .parent()\n+            .unwrap_or_else(|| Path::new(\".\"))\n+            .to_path_buf();\n+        Ok(Self {\n+            dir,\n+            request_base_dir,\n+            mutations: Mutex::new(()),\n+            environments: std::sync::RwLock::new(environments),\n+        })\n+    }\n+\n+    pub async fn list(&self) -> Vec<Environment> {\n+        let environments = self\n+            .environments\n+            .read()\n+            .expect(\"environment store read lock poisoned\");\n+        let mut values = environments.values().cloned().collect::<Vec<_>>();\n+        values.sort_by(|left, right| left.id.cmp(&right.id));\n+        values\n+    }\n+\n+    pub async fn get(&self, id: &EnvironmentId) -> Option<Environment> {\n+        self.environments\n+            .read()\n+            .expect(\"environment store read lock poisoned\")\n+            .get(id)\n+            .cloned()\n+    }\n+\n+    pub async fn create(\n+        &self,\n+        draft: EnvironmentDraft,\n+    ) -> Result<Environment, EnvironmentStoreError> {\n+        let (id, replace) = draft.into();\n+        let (environment, bytes) =\n+            Environment::from_replace(id.clone(), replace, &self.request_base_dir)?;\n+        let _mutation = self.mutations.lock().await;\n+        if self\n+            .environments\n+            .read()\n+            .expect(\"environment store read lock poisoned\")\n+            .contains_key(&id)\n+        {\n+            return Err(EnvironmentStoreError::AlreadyExists { id });\n+        }\n+\n+        let path = environment_path(&self.dir, &id);\n+        write_new(&self.dir, &path, &bytes)\n+            .await\n+            .map_err(|err| create_error_for(id.clone(), err))?;\n+\n+        let mut environments = self\n+            .environments\n+            .write()\n+            .expect(\"environment store write lock poisoned\");\n+        environments.insert(id, environment.clone());\n+        Ok(environment)\n+    }\n+\n+    pub async fn replace(\n+        &self,\n+        id: &EnvironmentId,\n+        expected: &EnvironmentRevision,\n+        draft: EnvironmentReplace,\n+    ) -> Result<Environment, EnvironmentStoreError> {\n+        let (environment, bytes) =\n+            Environment::from_replace(id.clone(), draft, &self.request_base_dir)?;\n+        let _mutation = self.mutations.lock().await;\n+        {\n+            let environments = self\n+                .environments\n+                .read()\n+                .expect(\"environment store read lock poisoned\");\n+            let current = environments\n+                .get(id)\n+                .ok_or_else(|| EnvironmentStoreError::NotFound { id: id.clone() })?;\n+            if &current.revision != expected {\n+                return Err(EnvironmentStoreError::StaleRevision {\n+                    id:       id.clone(),\n+                    expected: expected.clone(),\n+                    actual:   current.revision.clone(),\n+                });\n+            }\n+        }\n+\n+        write_atomic(&self.dir, &environment_path(&self.dir, id), &bytes).await?;\n+        let mut environments = self\n+            .environments\n+            .write()\n+            .expect(\"environment store write lock poisoned\");\n+        environments.insert(id.clone(), environment.clone());\n+        Ok(environment)\n+    }\n+\n+    pub async fn delete(\n+        &self,\n+        id: &EnvironmentId,\n+        expected: &EnvironmentRevision,\n+    ) -> Result<(), EnvironmentStoreError> {\n+        if id.as_str() == \"default\" {\n+            return Err(EnvironmentStoreError::Protected { id: id.clone() });\n+        }\n+\n+        let _mutation = self.mutations.lock().await;\n+        {\n+            let environments = self\n+                .environments\n+                .read()\n+                .expect(\"environment store read lock poisoned\");\n+            let current = environments\n+                .get(id)\n+                .ok_or_else(|| EnvironmentStoreError::NotFound { id: id.clone() })?;\n+            if &current.revision != expected {\n+                return Err(EnvironmentStoreError::StaleRevision {\n+                    id:       id.clone(),\n+                    expected: expected.clone(),\n+                    actual:   current.revision.clone(),\n+                });\n+            }\n+        }\n+\n+        let path = environment_path(&self.dir, id);\n+        fs::remove_file(&path)\n+            .await\n+            .map_err(|err| EnvironmentStoreError::io(path, err))?;\n+        let mut environments = self\n+            .environments\n+            .write()\n+            .expect(\"environment store write lock poisoned\");\n+        environments.remove(id);\n+        Ok(())\n+    }\n+\n+    pub fn catalog_layer(&self) -> MergeMap<EnvironmentLayer> {\n+        let environments = self\n+            .environments\n+            .read()\n+            .expect(\"environment store read lock poisoned\");\n+        let catalog: HashMap<String, EnvironmentLayer> = environments\n+            .iter()\n+            .map(|(id, environment)| (id.to_string(), environment.to_layer()))\n+            .collect();\n+        MergeMap::from(catalog)\n+    }\n+}\n+\n+#[expect(\n+    clippy::disallowed_methods,\n+    reason = \"Environment directory seeding runs synchronously during startup before request handling.\"\n+)]\n+fn seed_missing_environments(dir: &Path) -> Result<(), EnvironmentStoreError> {\n+    std::fs::create_dir_all(dir).map_err(|err| EnvironmentStoreError::io(dir, err))?;\n+    for (id, content) in SEEDS {\n+        let path = dir.join(format!(\"{id}.toml\"));\n+        match std::fs::OpenOptions::new()\n+            .write(true)\n+            .create_new(true)\n+            .open(&path)\n+        {\n+            Ok(mut file) => {\n+                use std::io::Write as _;\n+                file.write_all(content.as_bytes())\n+                    .map_err(|err| EnvironmentStoreError::io(&path, err))?;\n+                file.sync_all()\n+                    .map_err(|err| EnvironmentStoreError::io(&path, err))?;\n+            }\n+            Err(err) if err.kind() == ErrorKind::AlreadyExists => {}\n+            Err(err) => return Err(EnvironmentStoreError::io(path, err)),\n+        }\n+    }\n+    Ok(())\n+}\n+\n+#[expect(\n+    clippy::disallowed_methods,\n+    reason = \"Environment directory scan runs once at startup; std::fs avoids requiring a Tokio runtime for callers.\"\n+)]\n+fn load_environments(\n+    dir: &Path,\n+) -> Result<HashMap<EnvironmentId, Environment>, EnvironmentStoreError> {\n+    let entries = match std::fs::read_dir(dir) {\n+        Ok(entries) => entries,\n+        Err(err) if err.kind() == ErrorKind::NotFound => return Ok(HashMap::new()),\n+        Err(err) => return Err(EnvironmentStoreError::io(dir, err)),\n+    };\n+\n+    let mut environments = HashMap::new();\n+    for entry in entries {\n+        let entry = entry.map_err(|err| EnvironmentStoreError::io(dir, err))?;\n+        let path = entry.path();\n+        let file_type = entry\n+            .file_type()\n+            .map_err(|err| EnvironmentStoreError::io(&path, err))?;\n+        if !file_type.is_file() || !is_toml_file(&path) {\n+            continue;\n+        }\n+        let environment = load_environment_file(&path)?;\n+        environments.insert(environment.id.clone(), environment);\n+    }\n+    Ok(environments)\n+}\n+\n+#[expect(\n+    clippy::disallowed_methods,\n+    reason = \"Sync sibling of `load_environments`; only invoked from the synchronous startup load path.\"\n+)]\n+fn load_environment_file(path: &Path) -> Result<Environment, EnvironmentStoreError> {\n+    let id = id_from_path(path)?;\n+    let bytes = std::fs::read(path).map_err(|err| EnvironmentStoreError::io(path, err))?;\n+    Environment::from_persisted_path(id, &bytes, path)\n+}\n+\n+fn id_from_path(path: &Path) -> Result<EnvironmentId, EnvironmentStoreError> {\n+    let stem = path\n+        .file_stem()\n+        .and_then(|stem| stem.to_str())\n+        .ok_or_else(|| EnvironmentStoreError::InvalidFilename {\n+            path:   path.to_path_buf(),\n+            reason: \"filename is not valid UTF-8\".to_string(),\n+        })?;\n+    EnvironmentId::new(stem).map_err(|source| EnvironmentStoreError::InvalidFilename {\n+        path:   path.to_path_buf(),\n+        reason: source.to_string(),\n+    })\n+}\n+\n+fn is_toml_file(path: &Path) -> bool {\n+    path.extension()\n+        .and_then(|extension| extension.to_str())\n+        .is_some_and(|extension| extension == \"toml\")\n+}\n+\n+async fn write_atomic(dir: &Path, path: &Path, bytes: &[u8]) -> Result<(), EnvironmentStoreError> {\n+    fs::create_dir_all(dir)\n+        .await\n+        .map_err(|err| EnvironmentStoreError::io(dir, err))?;\n+    let temp_path = temp_path_for(path);\n+    let mut file = fs::OpenOptions::new()\n+        .write(true)\n+        .create_new(true)\n+        .open(&temp_path)\n+        .await\n+        .map_err(|err| EnvironmentStoreError::io(&temp_path, err))?;\n+\n+    if let Err(err) = file.write_all(bytes).await {\n+        cleanup_temp(&temp_path).await;\n+        return Err(EnvironmentStoreError::io(&temp_path, err));\n+    }\n+    if let Err(err) = file.sync_all().await {\n+        cleanup_temp(&temp_path).await;\n+        return Err(EnvironmentStoreError::io(&temp_path, err));\n+    }\n+    drop(file);\n+\n+    if let Err(err) = fs::rename(&temp_path, path).await {\n+        cleanup_temp(&temp_path).await;\n+        return Err(EnvironmentStoreError::io(path, err));\n+    }\n+\n+    Ok(())\n+}\n+\n+async fn write_new(dir: &Path, path: &Path, bytes: &[u8]) -> Result<(), EnvironmentStoreError> {\n+    fs::create_dir_all(dir)\n+        .await\n+        .map_err(|err| EnvironmentStoreError::io(dir, err))?;\n+    let temp_path = temp_path_for(path);\n+    let mut file = fs::OpenOptions::new()\n+        .write(true)\n+        .create_new(true)\n+        .open(&temp_path)\n+        .await\n+        .map_err(|err| EnvironmentStoreError::io(&temp_path, err))?;\n+\n+    if let Err(err) = file.write_all(bytes).await {\n+        cleanup_temp(&temp_path).await;\n+        return Err(EnvironmentStoreError::io(&temp_path, err));\n+    }\n+    if let Err(err) = file.sync_all().await {\n+        cleanup_temp(&temp_path).await;\n+        return Err(EnvironmentStoreError::io(&temp_path, err));\n+    }\n+    drop(file);\n+\n+    if let Err(err) = fs::hard_link(&temp_path, path).await {\n+        cleanup_temp(&temp_path).await;\n+        return Err(EnvironmentStoreError::io(path, err));\n+    }\n+    cleanup_temp(&temp_path).await;\n+    Ok(())\n+}\n+\n+async fn cleanup_temp(path: &Path) {\n+    let _ = fs::remove_file(path).await;\n+}\n+\n+fn create_error_for(id: EnvironmentId, err: EnvironmentStoreError) -> EnvironmentStoreError {\n+    match err {\n+        EnvironmentStoreError::Io { source, .. } if source.kind() == ErrorKind::AlreadyExists => {\n+            EnvironmentStoreError::AlreadyExists { id }\n+        }\n+        err => err,\n+    }\n+}\n+\n+fn temp_path_for(path: &Path) -> PathBuf {\n+    let parent = path.parent().unwrap_or_else(|| Path::new(\".\"));\n+    let file_name = path\n+        .file_name()\n+        .and_then(|name| name.to_str())\n+        .unwrap_or(\"environment.toml\");\n+    let now = SystemTime::now()\n+        .duration_since(UNIX_EPOCH)\n+        .map_or(0, |duration| duration.as_nanos());\n+    parent.join(format!(\".{file_name}.{}.{}.tmp\", std::process::id(), now))\n+}\n+\n+fn environment_path(dir: &Path, id: &EnvironmentId) -> PathBuf {\n+    dir.join(format!(\"{id}.toml\"))\n+}\n+\n+#[cfg(test)]\n+mod tests {\n+    use std::collections::HashMap;\n+\n+    use fabro_types::settings::InterpString;\n+    use fabro_types::settings::run::{\n+        DockerfileSource, EnvironmentImageSettings, EnvironmentLifecycleSettings,\n+        EnvironmentNetworkSettings, EnvironmentProvider, EnvironmentResourcesSettings,\n+        EnvironmentSettings,\n+    };\n+    use tokio::fs;\n+\n+    use crate::{\n+        EnvironmentDraft, EnvironmentId, EnvironmentReplace, EnvironmentRevision,\n+        EnvironmentStore, EnvironmentStoreError,\n+    };\n+\n+    fn settings(provider: EnvironmentProvider) -> EnvironmentSettings {\n+        EnvironmentSettings {\n+            provider,\n+            image: EnvironmentImageSettings::default(),\n+            resources: EnvironmentResourcesSettings::default(),\n+            network: EnvironmentNetworkSettings::default(),\n+            lifecycle: EnvironmentLifecycleSettings::default(),\n+            labels: HashMap::new(),\n+            volumes: Vec::new(),\n+            env: HashMap::new(),\n+        }\n+    }\n+\n+    fn replacement(provider: EnvironmentProvider) -> EnvironmentReplace {\n+        EnvironmentReplace::from_settings(settings(provider))\n+    }\n+\n+    fn draft(id: &str, provider: EnvironmentProvider) -> EnvironmentDraft {\n+        let settings = settings(provider);\n+        EnvironmentDraft {\n+            id:        EnvironmentId::new(id).unwrap(),\n+            provider:  settings.provider,\n+            image:     settings.image,\n+            resources: settings.resources,\n+            network:   settings.network,\n+            lifecycle: settings.lifecycle,\n+            labels:    settings.labels,\n+            volumes:   settings.volumes,\n+            env:       settings.env,\n+        }\n+    }\n+\n+    #[tokio::test]\n+    async fn absent_directory_loads_and_seeds_built_ins() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let environment_dir = dir.path().join(\"environments\");\n+\n+        let store = EnvironmentStore::load_or_seed(&environment_dir).unwrap();\n+        let environments = store.list().await;\n+\n+        assert_eq!(\n+            environments\n+                .iter()\n+                .map(|environment| environment.id.as_str())\n+                .collect::<Vec<_>>(),\n+            vec![\"daytona\", \"default\", \"docker\", \"local\"]\n+        );\n+        for id in [\"default\", \"local\", \"docker\", \"daytona\"] {\n+            assert!(environment_dir.join(format!(\"{id}.toml\")).exists());\n+        }\n+    }\n+\n+    #[tokio::test]\n+    async fn listing_is_sorted() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let environment_dir = dir.path().join(\"environments\");\n+        fs::create_dir_all(&environment_dir).await.unwrap();\n+        fs::write(environment_dir.join(\"z.toml\"), r#\"provider = \"local\"\"#)\n+            .await\n+            .unwrap();\n+        fs::write(environment_dir.join(\"a.toml\"), r#\"provider = \"local\"\"#)\n+            .await\n+            .unwrap();\n+\n+        let store = EnvironmentStore::load_or_seed(&environment_dir).unwrap();\n+\n+        assert_eq!(\n+            store\n+                .list()\n+                .await\n+                .iter()\n+                .map(|environment| environment.id.as_str())\n+                .collect::<Vec<_>>(),\n+            vec![\"a\", \"daytona\", \"default\", \"docker\", \"local\", \"z\"]\n+        );\n+    }\n+\n+    #[test]\n+    fn invalid_id_file_is_rejected() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let environment_dir = dir.path().join(\"environments\");\n+        std::fs::create_dir_all(&environment_dir).unwrap();\n+        std::fs::write(environment_dir.join(\"Bad.toml\"), r#\"provider = \"local\"\"#).unwrap();\n+\n+        let err = EnvironmentStore::load_or_seed(&environment_dir).unwrap_err();\n+\n+        assert!(matches!(err, EnvironmentStoreError::InvalidFilename { .. }));\n+    }\n+\n+    #[test]\n+    fn invalid_provider_is_rejected() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let environment_dir = dir.path().join(\"environments\");\n+        std::fs::create_dir_all(&environment_dir).unwrap();\n+        std::fs::write(environment_dir.join(\"bad.toml\"), r#\"provider = \"bogus\"\"#).unwrap();\n+\n+        let err = EnvironmentStore::load_or_seed(&environment_dir).unwrap_err();\n+\n+        assert!(matches!(err, EnvironmentStoreError::Validation { .. }));\n+        assert!(err.to_string().contains(\"unknown environment provider\"));\n+    }\n+\n+    #[test]\n+    fn invalid_network_mode_is_rejected() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let environment_dir = dir.path().join(\"environments\");\n+        std::fs::create_dir_all(&environment_dir).unwrap();\n+        std::fs::write(\n+            environment_dir.join(\"bad.toml\"),\n+            r#\"\n+provider = \"docker\"\n+\n+[network]\n+mode = \"cidr_allow_list\"\n+\"#,\n+        )\n+        .unwrap();\n+\n+        let err = EnvironmentStore::load_or_seed(&environment_dir).unwrap_err();\n+\n+        assert!(matches!(err, EnvironmentStoreError::Validation { .. }));\n+        assert!(err.to_string().contains(\"docker environments cannot enforce\"));\n+    }\n+\n+    #[test]\n+    fn missing_dockerfile_path_is_rejected() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let environment_dir = dir.path().join(\"environments\");\n+        std::fs::create_dir_all(&environment_dir).unwrap();\n+        std::fs::write(\n+            environment_dir.join(\"bad.toml\"),\n+            r#\"\n+provider = \"docker\"\n+\n+[image.dockerfile]\n+path = \"Dockerfile\"\n+\"#,\n+        )\n+        .unwrap();\n+\n+        let err = EnvironmentStore::load_or_seed(&environment_dir).unwrap_err();\n+\n+        assert!(matches!(err, EnvironmentStoreError::Validation { .. }));\n+        assert!(err.to_string().contains(\"Dockerfile\"));\n+    }\n+\n+    #[tokio::test]\n+    async fn create_conflict_is_rejected() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let store = EnvironmentStore::load_or_seed(dir.path().join(\"environments\")).unwrap();\n+\n+        let err = store\n+            .create(draft(\"local\", EnvironmentProvider::Local))\n+            .await\n+            .unwrap_err();\n+\n+        assert!(matches!(err, EnvironmentStoreError::AlreadyExists { .. }));\n+    }\n+\n+    #[tokio::test]\n+    async fn replace_stale_revision_is_rejected() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let store = EnvironmentStore::load_or_seed(dir.path().join(\"environments\")).unwrap();\n+        let current = store\n+            .get(&EnvironmentId::new(\"local\").unwrap())\n+            .await\n+            .unwrap();\n+        let stale = EnvironmentRevision::from_bytes(b\"stale\");\n+\n+        let err = store\n+            .replace(\n+                &current.id,\n+                &stale,\n+                replacement(EnvironmentProvider::Docker),\n+            )\n+            .await\n+            .unwrap_err();\n+\n+        assert!(matches!(err, EnvironmentStoreError::StaleRevision { .. }));\n+    }\n+\n+    #[tokio::test]\n+    async fn default_delete_is_rejected() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let store = EnvironmentStore::load_or_seed(dir.path().join(\"environments\")).unwrap();\n+        let default = store\n+            .get(&EnvironmentId::new(\"default\").unwrap())\n+            .await\n+            .unwrap();\n+\n+        let err = store.delete(&default.id, &default.revision).await.unwrap_err();\n+\n+        assert!(matches!(err, EnvironmentStoreError::Protected { .. }));\n+    }\n+\n+    #[tokio::test]\n+    async fn delete_success_removes_file_and_memory_entry() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let environment_dir = dir.path().join(\"environments\");\n+        let store = EnvironmentStore::load_or_seed(&environment_dir).unwrap();\n+        let created = store\n+            .create(draft(\"tmp\", EnvironmentProvider::Local))\n+            .await\n+            .unwrap();\n+\n+        store.delete(&created.id, &created.revision).await.unwrap();\n+\n+        assert!(store.get(&created.id).await.is_none());\n+        assert!(!environment_dir.join(\"tmp.toml\").exists());\n+    }\n+\n+    #[tokio::test]\n+    async fn canonical_revision_changes_when_persisted_bytes_change() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let store = EnvironmentStore::load_or_seed(dir.path().join(\"environments\")).unwrap();\n+        let created = store\n+            .create(draft(\"rev\", EnvironmentProvider::Local))\n+            .await\n+            .unwrap();\n+        let mut next = settings(EnvironmentProvider::Local);\n+        next.env.insert(\n+            \"TOKEN\".to_string(),\n+            InterpString::parse(\"{{ env.TEST_TOKEN }}\"),\n+        );\n+\n+        let replaced = store\n+            .replace(\n+                &created.id,\n+                &created.revision,\n+                EnvironmentReplace::from_settings(next),\n+            )\n+            .await\n+            .unwrap();\n+\n+        assert_ne!(created.revision, replaced.revision);\n+    }\n+\n+    #[tokio::test]\n+    async fn api_dockerfile_path_is_resolved_relative_to_settings_dir_and_persisted_inline() {\n+        let dir = tempfile::tempdir().unwrap();\n+        fs::write(dir.path().join(\"Dockerfile\"), \"FROM alpine\\n\")\n+            .await\n+            .unwrap();\n+        let store = EnvironmentStore::load_or_seed(dir.path().join(\"environments\")).unwrap();\n+        let mut settings = settings(EnvironmentProvider::Docker);\n+        settings.image.dockerfile = Some(DockerfileSource::Path {\n+            path: \"Dockerfile\".to_string(),\n+        });\n+        let draft = EnvironmentDraft {\n+            id:        EnvironmentId::new(\"with-dockerfile\").unwrap(),\n+            provider:  settings.provider,\n+            image:     settings.image,\n+            resources: settings.resources,\n+            network:   settings.network,\n+            lifecycle: settings.lifecycle,\n+            labels:    settings.labels,\n+            volumes:   settings.volumes,\n+            env:       settings.env,\n+        };\n+\n+        let created = store.create(draft).await.unwrap();\n+        let persisted = fs::read_to_string(\n+            dir.path()\n+                .join(\"environments\")\n+                .join(\"with-dockerfile.toml\"),\n+        )\n+        .await\n+        .unwrap();\n+\n+        assert_eq!(\n+            created.image.dockerfile,\n+            Some(DockerfileSource::Inline(\"FROM alpine\\n\".to_string()))\n+        );\n+        assert!(persisted.contains(\"FROM alpine\"));\n+        assert!(!persisted.contains(\"path =\"));\n+    }\n+}\ndiff --git a/lib/crates/fabro-server/Cargo.toml b/lib/crates/fabro-server/Cargo.toml\nindex dfde73f66..184154cb0 100644\n--- a/lib/crates/fabro-server/Cargo.toml\n+++ b/lib/crates/fabro-server/Cargo.toml\n@@ -26,6 +26,7 @@ fabro-auth = { path = \"../fabro-auth\" }\n fabro-install = { path = \"../fabro-install\" }\n fabro-spa = { path = \"../fabro-spa\" }\n fabro-config = { path = \"../fabro-config\" }\n+fabro-environment.workspace = true\n fabro-graphviz = { path = \"../fabro-graphviz\" }\n fabro-hooks = { path = \"../fabro-hooks\" }\n fabro-interview = { path = \"../fabro-interview\" }\ndiff --git a/lib/crates/fabro-server/src/run_manifest.rs b/lib/crates/fabro-server/src/run_manifest.rs\nindex c60d03817..864f3ee57 100644\n--- a/lib/crates/fabro-server/src/run_manifest.rs\n+++ b/lib/crates/fabro-server/src/run_manifest.rs\n@@ -12,6 +12,7 @@ use fabro_config::{\n     MergeMap, RunLayer, SettingsLayer, WorkflowSettingsBuilder, parse_input_overrides,\n     parse_labels,\n };\n+use fabro_config::parse::{self, SettingsSource};\n use fabro_graphviz::graph::{Graph, is_llm_handler_type};\n use fabro_graphviz::render::apply_direction;\n use fabro_llm::model_test::{ModelTestStatus, run_basic_model_probe};\n@@ -116,6 +117,7 @@ pub(crate) fn prepare_manifest_with_environment_defaults(\n             &config.source,\n             &config.path,\n             &workflow_input.files,\n+            SettingsSource::Workflow,\n         )?;\n         workflow_settings_builder = workflow_settings_builder.workflow_layer(layer);\n     }\n@@ -130,6 +132,7 @@ pub(crate) fn prepare_manifest_with_environment_defaults(\n                 source,\n                 &config_path,\n                 &workflow_input.files,\n+                SettingsSource::Project,\n             )?;\n             workflow_settings_builder = workflow_settings_builder.project_layer(layer);\n         }\n@@ -331,6 +334,7 @@ fn settings_layer_with_resolved_dockerfiles(\n     source: &str,\n     config_path: &ManifestPath,\n     files: &HashMap<ManifestPath, String>,\n+    settings_source: SettingsSource,\n ) -> Result<SettingsLayer> {\n     // Parse via `SettingsLayer` so unknown nested keys (like a stale\n     // `[server.integrations.github.permissions]` after the move to\n@@ -338,6 +342,8 @@ fn settings_layer_with_resolved_dockerfiles(\n     let mut layer = source\n         .parse::<SettingsLayer>()\n         .context(\"Failed to parse run config TOML\")?;\n+    parse::validate_settings_source(&layer, settings_source)\n+        .context(\"Failed to parse run config TOML\")?;\n     resolve_manifest_dockerfiles(&mut layer, config_path, files)?;\n     Ok(layer)\n }\n@@ -417,11 +423,6 @@ fn resolve_manifest_dockerfiles(\n     {\n         resolve_manifest_dockerfile(image, config_path, files)?;\n     }\n-    for environment in layer.environments.values_mut() {\n-        if let Some(image) = environment.image.as_mut() {\n-            resolve_manifest_dockerfile(image, config_path, files)?;\n-        }\n-    }\n     Ok(())\n }\n \ndiff --git a/lib/crates/fabro-server/src/serve.rs b/lib/crates/fabro-server/src/serve.rs\nindex 2b71e6d4a..240b13b1d 100644\n--- a/lib/crates/fabro-server/src/serve.rs\n+++ b/lib/crates/fabro-server/src/serve.rs\n@@ -688,11 +688,10 @@ where\n         effective_log_destination,\n     );\n     let resolved_app_settings = ResolvedAppStateSettings {\n-        server_settings:               runtime_settings.server_settings,\n-        manifest_run_defaults:         runtime_settings.manifest_run_defaults,\n-        manifest_environment_defaults: runtime_settings.manifest_environment_defaults,\n-        manifest_run_settings:         runtime_settings.manifest_run_settings,\n-        llm_catalog_settings:          runtime_settings.llm_catalog_settings,\n+        server_settings:       runtime_settings.server_settings,\n+        manifest_run_defaults: runtime_settings.manifest_run_defaults,\n+        manifest_run_settings: runtime_settings.manifest_run_settings,\n+        llm_catalog_settings:  runtime_settings.llm_catalog_settings,\n     };\n     let resolved_server_settings = resolved_app_settings.server_settings.server.clone();\n     validate_startup_configuration(&resolved_server_settings)?;\n@@ -850,12 +849,10 @@ where\n                                 .server_settings\n                                 .with_storage_override(&data_dir_for_poll);\n                             ResolvedAppStateSettings {\n-                                server_settings:               resolved.server_settings,\n-                                manifest_run_defaults:         resolved.manifest_run_defaults,\n-                                manifest_environment_defaults: resolved\n-                                    .manifest_environment_defaults,\n-                                manifest_run_settings:         resolved.manifest_run_settings,\n-                                llm_catalog_settings:          resolved.llm_catalog_settings,\n+                                server_settings:       resolved.server_settings,\n+                                manifest_run_defaults: resolved.manifest_run_defaults,\n+                                manifest_run_settings: resolved.manifest_run_settings,\n+                                llm_catalog_settings:  resolved.llm_catalog_settings,\n                             }\n                         });\n                         match resolved {\n@@ -1246,7 +1243,6 @@ mod tests {\n             manifest_run_settings: RunSettingsBuilder::from_run_layer(&manifest_run_defaults)\n                 .map_err(|err| fabro_util::error::SharedError::new(anyhow::Error::new(err))),\n             manifest_run_defaults,\n-            manifest_environment_defaults: fabro_config::MergeMap::default(),\n             server_settings: server_settings(source),\n             llm_catalog_settings: fabro_model::catalog::LlmCatalogSettings::default(),\n         }\ndiff --git a/lib/crates/fabro-server/src/server.rs b/lib/crates/fabro-server/src/server.rs\nindex 11963ba1c..7709d2c34 100644\n--- a/lib/crates/fabro-server/src/server.rs\n+++ b/lib/crates/fabro-server/src/server.rs\n@@ -54,7 +54,8 @@ use fabro_automation::AutomationStore;\n #[cfg(test)]\n use fabro_config::RunSettingsBuilder;\n use fabro_config::daemon::ServerDaemon;\n-use fabro_config::{EnvironmentLayer, MergeMap, RunLayer, Storage};\n+use fabro_config::{RunLayer, Storage, WorkflowSettingsBuilder};\n+use fabro_environment::EnvironmentStore;\n use fabro_interview::{\n     Answer, AnswerSubmission, ControlInterviewer, Interviewer, Question, WorkerControlEnvelope,\n };\n@@ -1063,6 +1064,7 @@ pub struct AppState {\n     session_runtimes: SessionRuntimeManager,\n     artifact_store: ArtifactStore,\n     automation_store: Arc<AutomationStore>,\n+    environment_store: Arc<EnvironmentStore>,\n     #[cfg(any(test, feature = \"test-support\"))]\n     automation_materializer_override: Option<Arc<dyn AutomationRunMaterializer>>,\n     worker_tokens: WorkerTokenKeys,\n@@ -1085,7 +1087,6 @@ pub struct AppState {\n     pub(super) server_secrets: ServerSecrets,\n     pub(crate) llm_source: Arc<dyn CredentialSource>,\n     manifest_run_defaults: RwLock<Arc<RunLayer>>,\n-    manifest_environment_defaults: RwLock<Arc<MergeMap<EnvironmentLayer>>>,\n     manifest_run_settings: RwLock<std::result::Result<RunNamespace, SharedError>>,\n     pub(crate) server_settings: RwLock<Arc<ServerSettings>>,\n     catalog: RwLock<Arc<Catalog>>,\n@@ -1108,6 +1109,10 @@ impl AppState {\n         &self.automation_store\n     }\n \n+    pub(crate) fn environment_store(&self) -> &EnvironmentStore {\n+        &self.environment_store\n+    }\n+\n     pub(crate) async fn materialize_automation_run(\n         &self,\n         input: AutomationRunMaterializeInput,\n@@ -1238,7 +1243,6 @@ pub(crate) struct AppStateConfig {\n pub(crate) struct ResolvedAppStateSettings {\n     pub(crate) server_settings:               ServerSettings,\n     pub(crate) manifest_run_defaults:         RunLayer,\n-    pub(crate) manifest_environment_defaults: MergeMap<EnvironmentLayer>,\n     pub(crate) manifest_run_settings:         std::result::Result<RunNamespace, SharedError>,\n     pub(crate) llm_catalog_settings:          LlmCatalogSettings,\n }\n@@ -1289,15 +1293,6 @@ impl AppState {\n         )\n     }\n \n-    pub(crate) fn manifest_environment_defaults(&self) -> Arc<MergeMap<EnvironmentLayer>> {\n-        Arc::clone(\n-            &self\n-                .manifest_environment_defaults\n-                .read()\n-                .expect(\"manifest environment defaults lock poisoned\"),\n-        )\n-    }\n-\n     pub(crate) fn server_settings(&self) -> Arc<ServerSettings> {\n         Arc::clone(\n             &self\n@@ -1540,13 +1535,15 @@ impl AppState {\n         let ResolvedAppStateSettings {\n             server_settings,\n             manifest_run_defaults,\n-            manifest_environment_defaults,\n-            manifest_run_settings,\n+            manifest_run_settings: _,\n             llm_catalog_settings,\n         } = resolved_settings;\n         let server_settings = Arc::new(server_settings);\n         let manifest_run_defaults = Arc::new(manifest_run_defaults);\n-        let manifest_environment_defaults = Arc::new(manifest_environment_defaults);\n+        let manifest_run_settings = resolve_manifest_run_settings_with_catalog(\n+            manifest_run_defaults.as_ref(),\n+            &self.environment_store,\n+        );\n         let catalog = Arc::new(\n             Catalog::from_builtin_with_overrides(&llm_catalog_settings)\n                 .context(\"building LLM model catalog\")?,\n@@ -1558,10 +1555,6 @@ impl AppState {\n             .manifest_run_defaults\n             .write()\n             .expect(\"manifest run defaults lock poisoned\") = manifest_run_defaults;\n-        *self\n-            .manifest_environment_defaults\n-            .write()\n-            .expect(\"manifest environment defaults lock poisoned\") = manifest_environment_defaults;\n         *self\n             .manifest_run_settings\n             .write()\n@@ -2157,6 +2150,20 @@ fn resolve_manifest_run_settings(\n         .map_err(|err| SharedError::new(anyhow::Error::new(err)))\n }\n \n+fn resolve_manifest_run_settings_with_catalog(\n+    manifest_run_defaults: &RunLayer,\n+    environment_store: &EnvironmentStore,\n+) -> std::result::Result<RunNamespace, SharedError> {\n+    WorkflowSettingsBuilder::new()\n+        .server_manifest_defaults(\n+            manifest_run_defaults.clone(),\n+            environment_store.catalog_layer(),\n+        )\n+        .build()\n+        .map(|settings| settings.run)\n+        .map_err(|err| SharedError::new(anyhow::Error::msg(err.to_string())))\n+}\n+\n fn system_sandbox_provider(\n     manifest_run_settings: &std::result::Result<RunNamespace, SharedError>,\n ) -> String {\n@@ -2248,6 +2255,13 @@ fn automation_dir_for_active_config(active_config_path: &std::path::Path) -> Pat\n         .join(\"automations\")\n }\n \n+fn environment_dir_for_active_config(active_config_path: &std::path::Path) -> PathBuf {\n+    active_config_path\n+        .parent()\n+        .unwrap_or_else(|| std::path::Path::new(\".\"))\n+        .join(\"environments\")\n+}\n+\n pub(crate) fn build_app_state(config: AppStateConfig) -> anyhow::Result<Arc<AppState>> {\n     let AppStateConfig {\n         resolved_settings,\n@@ -2279,6 +2293,12 @@ pub(crate) fn build_app_state(config: AppStateConfig) -> anyhow::Result<Arc<AppS\n             .map_err(anyhow::Error::new)\n             .context(\"load automations\")?,\n     );\n+    let environment_dir = environment_dir_for_active_config(&active_config_path);\n+    let environment_store = Arc::new(\n+        EnvironmentStore::load_or_seed(environment_dir)\n+            .map_err(anyhow::Error::new)\n+            .context(\"load environments\")?,\n+    );\n     let variables = VariableStore::load(variables_path).context(\"load variables\")?;\n     let variables = Arc::new(AsyncRwLock::new(variables));\n     let vault = match preloaded_vault {\n@@ -2294,9 +2314,10 @@ pub(crate) fn build_app_state(config: AppStateConfig) -> anyhow::Result<Arc<AppS\n     let (global_event_tx, _) = broadcast::channel(4096);\n     let current_server_settings = Arc::new(resolved_settings.server_settings);\n     let current_manifest_run_defaults = Arc::new(resolved_settings.manifest_run_defaults);\n-    let current_manifest_environment_defaults =\n-        Arc::new(resolved_settings.manifest_environment_defaults);\n-    let current_manifest_run_settings = resolved_settings.manifest_run_settings;\n+    let current_manifest_run_settings = resolve_manifest_run_settings_with_catalog(\n+        current_manifest_run_defaults.as_ref(),\n+        &environment_store,\n+    );\n     let current_catalog = Arc::new(\n         Catalog::from_builtin_with_overrides(&resolved_settings.llm_catalog_settings)\n             .context(\"building LLM model catalog\")?,\n@@ -2381,6 +2402,7 @@ pub(crate) fn build_app_state(config: AppStateConfig) -> anyhow::Result<Arc<AppS\n         session_runtimes: SessionRuntimeManager::new(),\n         artifact_store,\n         automation_store,\n+        environment_store,\n         #[cfg(any(test, feature = \"test-support\"))]\n         automation_materializer_override,\n         worker_tokens,\n@@ -2399,7 +2421,6 @@ pub(crate) fn build_app_state(config: AppStateConfig) -> anyhow::Result<Arc<AppS\n         server_secrets,\n         llm_source,\n         manifest_run_defaults: RwLock::new(current_manifest_run_defaults),\n-        manifest_environment_defaults: RwLock::new(current_manifest_environment_defaults),\n         manifest_run_settings: RwLock::new(current_manifest_run_settings),\n         server_settings: RwLock::new(current_server_settings),\n         catalog: RwLock::new(current_catalog),\ndiff --git a/lib/crates/fabro-server/src/server/handler/graph.rs b/lib/crates/fabro-server/src/server/handler/graph.rs\nindex 1ed691b2f..579ada98a 100644\n--- a/lib/crates/fabro-server/src/server/handler/graph.rs\n+++ b/lib/crates/fabro-server/src/server/handler/graph.rs\n@@ -41,10 +41,10 @@ async fn render_graph_from_manifest(\n     Json(req): Json<RenderWorkflowGraphRequest>,\n ) -> Response {\n     let manifest_run_defaults = state.manifest_run_defaults();\n-    let manifest_environment_defaults = state.manifest_environment_defaults();\n+    let manifest_environment_defaults = state.environment_store().catalog_layer();\n     let prepared = match run_manifest::prepare_manifest_with_environment_defaults(\n         manifest_run_defaults.as_ref(),\n-        manifest_environment_defaults.as_ref(),\n+        &manifest_environment_defaults,\n         &req.manifest,\n     ) {\n         Ok(prepared) => prepared,\ndiff --git a/lib/crates/fabro-server/src/server/handler/runs.rs b/lib/crates/fabro-server/src/server/handler/runs.rs\nindex 3e83bddbb..ba0c19b3f 100644\n--- a/lib/crates/fabro-server/src/server/handler/runs.rs\n+++ b/lib/crates/fabro-server/src/server/handler/runs.rs\n@@ -638,10 +638,10 @@ pub(crate) async fn create_run_from_manifest(\n         automation,\n     } = request;\n     let manifest_run_defaults = state.manifest_run_defaults();\n-    let manifest_environment_defaults = state.manifest_environment_defaults();\n+    let manifest_environment_defaults = state.environment_store().catalog_layer();\n     let mut prepared = match run_manifest::prepare_manifest_with_environment_defaults(\n         manifest_run_defaults.as_ref(),\n-        manifest_environment_defaults.as_ref(),\n+        &manifest_environment_defaults,\n         &manifest,\n     ) {\n         Ok(prepared) => prepared,\n@@ -902,10 +902,10 @@ async fn run_preflight(\n     Json(req): Json<RunManifest>,\n ) -> Response {\n     let manifest_run_defaults = state.manifest_run_defaults();\n-    let manifest_environment_defaults = state.manifest_environment_defaults();\n+    let manifest_environment_defaults = state.environment_store().catalog_layer();\n     let mut prepared = match run_manifest::prepare_manifest_with_environment_defaults(\n         manifest_run_defaults.as_ref(),\n-        manifest_environment_defaults.as_ref(),\n+        &manifest_environment_defaults,\n         &req,\n     ) {\n         Ok(prepared) => prepared,\n@@ -939,10 +939,10 @@ async fn validate_run_manifest(\n     Json(req): Json<RunManifest>,\n ) -> Response {\n     let manifest_run_defaults = state.manifest_run_defaults();\n-    let manifest_environment_defaults = state.manifest_environment_defaults();\n+    let manifest_environment_defaults = state.environment_store().catalog_layer();\n     let mut prepared = match run_manifest::prepare_manifest_with_environment_defaults(\n         manifest_run_defaults.as_ref(),\n-        manifest_environment_defaults.as_ref(),\n+        &manifest_environment_defaults,\n         &req,\n     ) {\n         Ok(prepared) => prepared,\ndiff --git a/lib/crates/fabro-server/src/test_support.rs b/lib/crates/fabro-server/src/test_support.rs\nindex de5003629..06f4df0bd 100644\n--- a/lib/crates/fabro-server/src/test_support.rs\n+++ b/lib/crates/fabro-server/src/test_support.rs\n@@ -335,12 +335,10 @@ pub(crate) fn resolved_runtime_settings_for_tests(\n     manifest_run_defaults: RunLayer,\n     llm_catalog_settings: LlmCatalogSettings,\n ) -> ResolvedAppStateSettings {\n-    let manifest_environment_defaults = fabro_config::MergeMap::default();\n     ResolvedAppStateSettings {\n         manifest_run_settings: RunSettingsBuilder::from_run_layer(&manifest_run_defaults)\n             .map_err(|err| SharedError::new(anyhow::Error::new(err))),\n         manifest_run_defaults,\n-        manifest_environment_defaults,\n         server_settings,\n         llm_catalog_settings,\n     }\n",
        "summary": {
          "files_changed": 33,
          "additions": 2333,
          "deletions": 211
        }
      }
    },
    {
      "seq": 2123,
      "checkpoint": {
        "timestamp": "2026-05-28T05:39:25.474170Z",
        "current_node": "simplify_opus",
        "completed_nodes": [
          "start",
          "toolchain",
          "preflight_compile",
          "preflight_lint",
          "implement",
          "simplify_opus"
        ],
        "node_retries": {},
        "context_values": {
          "last_response": "Workspace builds clean. Let me summarize what was done.\n\n## Summary\n\nReviewed the `fabro-environment` crate addition and related fabro-config/fabro-server changes against three concurrent agents (reus",
          "failure_signature": "",
          "thread.preflight_compile.current_node": "preflight_lint",
          "thread.preflight_lint.current_node": "implement",
          "internal.retry_count.preflight_compile": 0,
          "internal.retry_count.preflight_lint": 0,
          "internal.node_visit_count": 1,
          "internal.retry_count.toolchain": 0,
          "internal.run_id": "01KSPDE8E9ATTVY1VBCS3YRBHT",
          "graph.rankdir": "LR",
          "response.simplify_opus": "Workspace builds clean. Let me summarize what was done.\n\n## Summary\n\nReviewed the `fabro-environment` crate addition and related fabro-config/fabro-server changes against three concurrent agents (reuse, quality, efficiency) and applied the highest-impact fixes:\n\n### Type / API surface cleanup\n- **Collapsed `Environment` to `{id, revision, settings: EnvironmentSettings}`** — eliminated the parallel flat-field copy, `settings()`, `from_validated_settings`, and the eight clone fields. `Environment.settings` is now a single owned `EnvironmentSettings`.\n- **Deleted `EnvironmentReplace`** — it was field-identical to `EnvironmentSettings` with no API consumer. `EnvironmentStore::replace` now takes `EnvironmentSettings` directly; `EnvironmentDraft` becomes `{id, settings}`.\n- **Removed unused public API**: `Environment::from_toml_bytes`, `Environment::to_toml_string`, `EnvironmentStoreError::MissingRevision`.\n\n### Dead code purge\n- **Deleted `LegacySandboxMigrationReport`, `migrate_settings_path`, `write_next_backup`, `backup_path_for`, `next_backup_path`, `REMOVAL_NOTE` and the two tests** in the 2026050101 legacy sandbox migration — production goes through `migrate_contents` only via the new 2026052801 migration.\n- **Removed `ResolvedAppStateSettings.manifest_run_settings`** dead field (server resolves it after loading the environment store anyway), plus the now-unused `RunSettingsBuilder`/`SharedError` imports in `serve.rs` and `test_support.rs`.\n\n### Efficiency\n- **Cached `catalog_layer()` as `Arc<MergeMap<EnvironmentLayer>>`** behind a `CatalogState` updated on create/replace/delete. Run create / preflight / graph / validate now just bump a refcount instead of cloning every `Environment` and rebuilding the catalog on each call.\n- **Simplified `write_new`** to a direct `OpenOptions::create_new(true).open(path)` (matches `seed_missing_environments`). Removes the temp + hard_link + cleanup dance and its leak window.\n\n### Quality polish\n- Dropped fake `async` from `EnvironmentStore::list`/`get` (sync `RwLock` reads only).\n- Inlined `resolve_path` into `base_dir.join(path)` (it was reimplementing `Path::join`).\n- Replaced the local `value()` wrapper with `toml_edit::value`.\n- Replaced `Option<PathBuf>` with `&Path` in `parse_persisted` (`from_persisted_path`'s \"memory\" branch is dead now).\n- Extracted `check_revision` helper to eliminate duplicated lock-read + ok_or + revision-compare across `replace` and `delete`.\n- Added small `read_state`/`write_state` accessors to centralize the lock-poisoning expect.\n\n### Config plumbing\n- **Removed the thin `load_settings_path` wrapper** and renamed `load_settings_path_with_source` to `load_settings_path(path, source)`. Each call site now declares its `SettingsSource` explicitly.\n- **Unified the parse-then-validate pattern** behind a single `parse_settings_toml(source, kind)` helper, replacing 11 duplicated `.parse::<SettingsLayer>().map_err(...)?; validate_parsed_source(&layer, ...)?` blocks.\n- Replaced the two scattered match arms in `parse.rs` with named predicates `SettingsSource::runs_settings_migrations` / `forbids_environment_catalog`.\n\n### Verification\n- `cargo nextest run -p fabro-environment -p fabro-config` — 233 passed, 0 failed.\n- `cargo +nightly-2026-04-14 fmt --check --all` — clean.\n- `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` — clean.\n- `cargo build --workspace` — clean.\n\n`fabro-server` retains 34 pre-existing test failures from the failed `implement` step (Task 5 of the original plan, \"Adjust CLI And Manifest Behavior\", was never executed). All share a \"unknown environment: <id>\" root cause: tests that exercise `fabro-manifest::build_run_manifest` directly never seed a server environment catalog. These failures predate this cleanup pass and aren't introduced by it.\n\nFindings not addressed (deferred — would require crate-restructuring beyond a review pass):\n- Sharing `write_atomic`/`temp_path_for`/`id_from_path`/etc. with the identical helpers in `fabro-automation` (would need a new shared util crate).\n- Sharing the slug validator and SHA-256 revision type between `fabro-environment` and `fabro-automation` (cycle if extracted to fabro-config; would need a `fabro-util` extraction).\n- Sharing `ensure_table` between `fabro-environment::model` and the legacy migration.\n- Making `StickyMap`'s `Serialize` deterministic so `canonical_bytes` could collapse into `toml::to_string_pretty(layer)`.",
          "last_stage": "simplify_opus",
          "outcome": "succeeded",
          "thread.implement.current_node": "simplify_opus",
          "thread.start.current_node": "toolchain",
          "thread.toolchain.current_node": "preflight_compile",
          "failure_class": "",
          "graph.goal": "# Server-Owned Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Move environment definitions from layered run settings into server-owned TOML resources with CRUD API management, matching the Automation store pattern.\n\n**Architecture:** Add a concrete `EnvironmentStore` that loads one environment TOML file per id from a sibling `environments/` directory next to the active server settings file. Runs continue to select an environment by id through `[run.environment]` or `--environment`, but server-side run creation resolves the id from `EnvironmentStore`; project/workflow/user config can no longer define environment catalogs or environment field overrides. The web UI is intentionally deferred.\n\n**Tech Stack:** Rust, Axum, serde/TOML, `toml_edit`, Tokio file I/O, OpenAPI/progenitor, generated TypeScript API client, cargo-nextest.\n\n---\n\n## File Structure\n\n- Create `lib/crates/fabro-environment/`: environment ids, revisions, API/domain DTOs, TOML persistence, canonicalization, validation, and `EnvironmentStore`.\n- Modify workspace manifests: root `Cargo.toml`, `lib/crates/fabro-server/Cargo.toml`, `lib/crates/fabro-api/build.rs`, and generated API/client package files.\n- Modify `lib/crates/fabro-server/src/server.rs`, `lib/crates/fabro-server/src/server/handler/mod.rs`, and a new `lib/crates/fabro-server/src/server/handler/environments.rs` to wire the store and API.\n- Modify `lib/crates/fabro-config/src/builders.rs`, `lib/crates/fabro-config/src/load.rs`, `lib/crates/fabro-config/src/migrations.rs`, and config tests to treat `[environments]` as migration-only, not runtime configuration.\n- Modify `lib/crates/fabro-manifest/src/lib.rs`, `lib/crates/fabro-server/src/run_manifest.rs`, and CLI run/preflight/graph/validate paths so environment ids are resolved only by the server.\n- Modify install/repo-init/docs/OpenAPI artifacts so new examples use server environment files and run configs only select ids.\n\n## Decisions\n\n- Environment definitions are server-owned operator policy. Project and workflow files may request an id but cannot define or override environment fields.\n- `default`, `local`, `docker`, and `daytona` are seeded if missing. Existing files are never overwritten.\n- `default` is protected from deletion. Other seeded files can be edited or deleted.\n- Environment ids use `[a-z0-9][a-z0-9-]{0,62}`.\n- Environment revisions are SHA-256 hashes of the persisted TOML bytes, returned in JSON as `revision` and in `ETag`.\n- `PUT` and `DELETE` require `If-Match`, following `AutomationStore`.\n- `image.dockerfile = { path = \"Dockerfile\" }` is accepted in persisted files and API input, resolved relative to the environment file or request context, and converted to inline content for runtime use. API writes canonical inline TOML.\n- `--preserve-sandbox` remains a CLI/server argument override. TOML `[run.environment.lifecycle]` is rejected.\n- `--docker-image` is rejected with a targeted message directing operators to create or update a server environment.\n- Existing dense `WorkflowSettings.environments` stays in the API for compatibility and is populated from the server environment catalog during run resolution.\n\n## Task 1: Add `fabro-environment` Store Crate\n\n**Files:**\n- Create: `lib/crates/fabro-environment/Cargo.toml`\n- Create: `lib/crates/fabro-environment/src/lib.rs`\n- Create: `lib/crates/fabro-environment/src/id.rs`\n- Create: `lib/crates/fabro-environment/src/model.rs`\n- Create: `lib/crates/fabro-environment/src/store.rs`\n- Create: `lib/crates/fabro-environment/src/error.rs`\n- Modify: root `Cargo.toml`\n\n- [ ] Create a workspace crate named `fabro-environment`, modeled after `fabro-automation`.\n- [ ] Define `EnvironmentId`, `EnvironmentRevision`, and parse/validation errors.\n- [ ] Define public DTOs:\n  - `Environment`: `id`, `revision`, `provider`, `image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, `env`.\n  - `EnvironmentDraft`: `id` plus environment fields.\n  - `EnvironmentReplace`: environment fields without id.\n- [ ] Use the existing environment field types from `fabro_types::settings::run` for dense API fields.\n- [ ] Use existing sparse `fabro_config::EnvironmentLayer` only for TOML input/output and conversion; do not create a second environment field vocabulary.\n- [ ] Add conversion helpers that resolve an `EnvironmentLayer` into dense `EnvironmentSettings` using the same provider/network/image validation rules as `fabro-config`.\n- [ ] Implement canonical TOML serialization for persisted files. Omit `id` and `revision`; the filename is the id and the file bytes determine revision.\n- [ ] Implement `EnvironmentStore` with `load_or_seed(dir)`, `list`, `get`, `create`, `replace`, `delete`, and `catalog_layer`.\n- [ ] Seed missing `default`, `local`, `docker`, and `daytona` files from the current built-in defaults. Do not overwrite existing files.\n- [ ] Protect `default` from deletion with a typed store error.\n- [ ] Resolve Dockerfile path references relative to the environment file directory during load and relative to the active settings directory during API create/replace. Store runtime values with inline Dockerfile content.\n- [ ] Add unit tests for loading an absent directory, seeding built-ins, sorted listing, invalid ids, invalid provider, invalid network mode, missing Dockerfile path, create conflict, replace stale revision, default delete rejection, delete success, and canonical revision changes.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-environment\n```\n\nExpected: all `fabro-environment` tests pass.\n\n## Task 2: Make Config Environments Migration-Only\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/parse.rs`\n- Modify: `lib/crates/fabro-config/src/builders.rs`\n- Modify: `lib/crates/fabro-config/src/load.rs`\n- Modify: `lib/crates/fabro-config/src/migrations.rs`\n- Create: `lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs`\n- Modify: `lib/crates/fabro-config/src/defaults.toml`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_run.rs`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_root.rs`\n\n- [ ] Keep `SettingsLayer.environments` in this pass so old files can parse and migrate, but remove environment catalog entries from `defaults.toml`.\n- [ ] Add source-aware validation that rejects `SettingsLayer.environments` for project, workflow, and direct run config layers with this message shape: `[environments.<id>] is now server-managed; move this definition to the server environments directory`.\n- [ ] Add validation that rejects TOML-provided `run.environment.image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, and `env`. Keep `run.environment.id`.\n- [ ] Ensure CLI/server argument layers can still set `run.environment.lifecycle.preserve` for `--preserve-sandbox`; the rejection applies only to parsed TOML sources.\n- [ ] Add a settings-file migration that extracts top-level `[environments.<id>]` entries from the active `settings.toml` into sibling `environments/<id>.toml` files.\n- [ ] Migration must write a backup before editing `settings.toml`, preserve `[run.environment] id`, remove the top-level `[environments]` table, and fail without changing files if any target environment file already exists.\n- [ ] Chain the existing legacy `[run.sandbox]` migration before the new extraction migration so legacy sandbox settings become a server `default` environment file.\n- [ ] Update run settings tests to assert that `RunSettingsBuilder` no longer resolves a selected environment without an injected server catalog.\n- [ ] Add tests proving project/workflow `[environments]` definitions produce targeted errors rather than silent ignores.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-config\n```\n\nExpected: config tests pass, including migration coverage.\n\n## Task 3: Wire EnvironmentStore Into Server Run Resolution\n\n**Files:**\n- Modify: `lib/crates/fabro-server/src/server.rs`\n- Modify: `lib/crates/fabro-server/src/serve.rs`\n- Modify: `lib/crates/fabro-server/src/run_manifest.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/runs.rs`\n- Modify: `lib/crates/fabro-server/src/manifest_validation.rs`\n- Modify: `lib/crates/fabro-server/src/test_support.rs`\n\n- [ ] Add `environment_store: Arc<EnvironmentStore>` to `AppState`, loaded from `active_config_path.parent().join(\"environments\")`.\n- [ ] Replace `manifest_environment_defaults` from `ServerRuntimeSettings` with `environment_store.catalog_layer()` when preparing manifests on the server.\n- [ ] Keep the dense run snapshot unchanged: `prepared.settings.run.environment` contains the resolved environment fields, and `prepared.settings.environments` contains the server catalog used for resolution.\n- [ ] Convert unknown environment ids into `400 Bad Request` during run creation/preflight/graph preparation.\n- [ ] Keep sandbox provider policy checks after environment resolution, so disabled providers still reject runs.\n- [ ] Apply `--preserve-sandbox` after selected environment resolution.\n- [ ] Remove server reliance on `[environments]` in `settings.toml`.\n- [ ] Update server test support so tests can inject environment files or use seeded defaults.\n- [ ] Add server tests for default environment run creation, custom server environment selection, unknown environment id, disabled provider policy, `--preserve-sandbox`, and rejected TOML environment field overrides.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server\n```\n\nExpected: server API and run-manifest tests pass.\n\n## Task 4: Add Environment CRUD API\n\n**Files:**\n- Modify: `docs/public/api-reference/fabro-api.yaml`\n- Modify: `lib/crates/fabro-api/build.rs`\n- Create: `lib/crates/fabro-server/src/server/handler/environments.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/mod.rs`\n- Add tests: `lib/crates/fabro-server/tests/it/api/environments.rs`\n- Update generated Rust and TypeScript API artifacts after spec changes.\n\n- [ ] Add OpenAPI tag `Environments`.\n- [ ] Add schemas for `Environment`, `CreateEnvironmentRequest`, `ReplaceEnvironmentRequest`, and `EnvironmentListResponse`.\n- [ ] Reuse existing environment schemas for provider/image/resources/network/lifecycle/volumes/env.\n- [ ] Add endpoints:\n  - `GET /api/v1/environments`\n  - `POST /api/v1/environments`\n  - `GET /api/v1/environments/{id}`\n  - `PUT /api/v1/environments/{id}`\n  - `DELETE /api/v1/environments/{id}`\n- [ ] Return `ETag` on retrieve and replace.\n- [ ] Require `If-Match` on replace and delete.\n- [ ] Map store errors to API responses:\n  - invalid id: `400`\n  - duplicate create: `409`\n  - stale revision: `409`\n  - validation error: `422`\n  - missing resource: `404`\n  - protected default delete: `409`\n  - persistence failure: `500`\n- [ ] Add route tests for empty-seeded list, create, retrieve with ETag, replace, stale replace, missing `If-Match`, delete, protected default delete, invalid provider, invalid CIDR, and missing Dockerfile path.\n- [ ] Regenerate `fabro-api` and TypeScript client artifacts.\n\nRun:\n\n```bash\ncargo build -p fabro-api\ncd lib/packages/fabro-api-client && bun run generate\ncargo nextest run -p fabro-server --test it -- api::environments\n```\n\nExpected: generated artifacts are updated and environment API tests pass.\n\n## Task 5: Adjust CLI And Manifest Behavior\n\n**Files:**\n- Modify: `lib/crates/fabro-cli/src/commands/run/overrides.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/preflight.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/graph.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/validate.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/repo/init.rs`\n- Modify: `lib/crates/fabro-manifest/src/lib.rs`\n- Modify CLI integration tests under `lib/crates/fabro-cli/tests/it/`\n\n- [ ] Reject `--docker-image` in run, create, preflight, graph, and validate commands with this message shape: `--docker-image is no longer supported; create or update a server environment and select it with --environment`.\n- [ ] Keep `--environment` as an id-only selector in manifest args.\n- [ ] Stop collecting Dockerfile path references from `[environments.<id>]` in project/workflow config because those definitions are invalid.\n- [ ] Keep collecting Dockerfile references for any remaining CLI-created run environment override only when it comes from allowed argument paths; with `--docker-image` rejected, no normal user path should add one.\n- [ ] Update local preflight/graph/validate flows so they either call server preflight for environment resolution or print a clear message that server-owned environment resolution requires a running server.\n- [ ] Update `fabro repo init` to write only `[run.environment] id = \"local\"` and no `[environments.local]` block.\n- [ ] Update CLI tests for manifest args, repo init output, rejected `--docker-image`, and server-owned environment selection.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-cli\n```\n\nExpected: CLI tests pass and no generated workflow config contains `[environments.*]`.\n\n## Task 6: Update Install, Docs, And Generated References\n\n**Files:**\n- Modify install persistence code in `lib/crates/fabro-cli/src/commands/install.rs` and server install handlers/tests.\n- Modify docs: `docs/public/execution/environments.mdx`, `docs/public/execution/run-configuration.mdx`, `docs/public/reference/user-configuration.mdx`, `docs/public/administration/server-configuration.mdx`, `docs/public/administration/sandboxing.mdx`, `docs/public/integrations/daytona.mdx`, and examples that currently define `[environments.<id>]`.\n- Modify generated settings reference if applicable.\n\n- [ ] Update install flows to write server environment files instead of `[environments.default]` into `settings.toml`.\n- [ ] Keep install-written `[run.environment] id = \"default\"` when a default run environment selection is still needed.\n- [ ] Update tests that assert `settings.toml` contains `[environments.default]` to assert the sibling environment file exists and settings no longer contains `[environments]`.\n- [ ] Rewrite public docs so environment definitions are server-owned TOML files and run configs only select ids.\n- [ ] Add a compatibility note explaining that project/workflow `[environments]` definitions now fail and must be moved to the server.\n- [ ] Keep `Settings > Environments` UI documentation out of this pass.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server --test it -- api::install\ncargo nextest run -p fabro-cli --test it\n```\n\nExpected: install tests pass and docs no longer present project/workflow environment definitions as valid.\n\n## Task 7: Workspace Verification\n\n**Files:**\n- No new files unless test snapshots require reviewed updates.\n\n- [ ] Run Rust formatting check:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\n```\n\n- [ ] Run clippy:\n\n```bash\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\n- [ ] Run workspace tests:\n\n```bash\ncargo nextest run --workspace\n```\n\n- [ ] Run TypeScript checks if API client changes affect the web package:\n\n```bash\ncd apps/fabro-web && bun run typecheck\ncd apps/fabro-web && bun test\n```\n\n- [ ] Inspect generated files and snapshots before accepting any snapshot changes.\n\n## Acceptance Criteria\n\n- Server startup creates or loads `environments/default.toml`, `local.toml`, `docker.toml`, and `daytona.toml`.\n- `GET /api/v1/environments` returns seeded environments with revisions.\n- API-created environments persist as TOML files and survive server restart.\n- Runs using `[run.environment] id = \"cloud\"` resolve from server files only.\n- Project/workflow/user `[environments.<id>]` definitions no longer affect runs.\n- Existing runs keep their dense environment snapshot after environment files change.\n- `--environment` still works.\n- `--preserve-sandbox` still works.\n- `--docker-image` no longer works and produces the targeted replacement guidance.\n- Web UI changes are not included.\n",
          "internal.fidelity": "compact",
          "internal.retry_count.implement": 0,
          "internal.thread_id": "implement",
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "internal.retry_count.start": 0,
          "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126",
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
          "internal.retry_count.simplify_opus": 0,
          "current_node": "simplify_opus"
        },
        "node_outcomes": {
          "toolchain": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
            },
            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 1316,
              "active_time_ms": 1316
            }
          },
          "implement": {
            "status": "failed",
            "failure": {
              "message": "LLM error: Invalid request to openai: No tool call found for function call output with call_id call_DUxNRWlboQi3OOOvhg0NhD3h.",
              "category": "deterministic",
              "signature": "api_deterministic|openai|invalid_request"
            },
            "usage": null
          },
          "simplify_opus": {
            "status": "succeeded",
            "context_updates": {
              "last_stage": "simplify_opus",
              "last_response": "Workspace builds clean. Let me summarize what was done.\n\n## Summary\n\nReviewed the `fabro-environment` crate addition and related fabro-config/fabro-server changes against three concurrent agents (reus",
              "response.simplify_opus": "Workspace builds clean. Let me summarize what was done.\n\n## Summary\n\nReviewed the `fabro-environment` crate addition and related fabro-config/fabro-server changes against three concurrent agents (reuse, quality, efficiency) and applied the highest-impact fixes:\n\n### Type / API surface cleanup\n- **Collapsed `Environment` to `{id, revision, settings: EnvironmentSettings}`** — eliminated the parallel flat-field copy, `settings()`, `from_validated_settings`, and the eight clone fields. `Environment.settings` is now a single owned `EnvironmentSettings`.\n- **Deleted `EnvironmentReplace`** — it was field-identical to `EnvironmentSettings` with no API consumer. `EnvironmentStore::replace` now takes `EnvironmentSettings` directly; `EnvironmentDraft` becomes `{id, settings}`.\n- **Removed unused public API**: `Environment::from_toml_bytes`, `Environment::to_toml_string`, `EnvironmentStoreError::MissingRevision`.\n\n### Dead code purge\n- **Deleted `LegacySandboxMigrationReport`, `migrate_settings_path`, `write_next_backup`, `backup_path_for`, `next_backup_path`, `REMOVAL_NOTE` and the two tests** in the 2026050101 legacy sandbox migration — production goes through `migrate_contents` only via the new 2026052801 migration.\n- **Removed `ResolvedAppStateSettings.manifest_run_settings`** dead field (server resolves it after loading the environment store anyway), plus the now-unused `RunSettingsBuilder`/`SharedError` imports in `serve.rs` and `test_support.rs`.\n\n### Efficiency\n- **Cached `catalog_layer()` as `Arc<MergeMap<EnvironmentLayer>>`** behind a `CatalogState` updated on create/replace/delete. Run create / preflight / graph / validate now just bump a refcount instead of cloning every `Environment` and rebuilding the catalog on each call.\n- **Simplified `write_new`** to a direct `OpenOptions::create_new(true).open(path)` (matches `seed_missing_environments`). Removes the temp + hard_link + cleanup dance and its leak window.\n\n### Quality polish\n- Dropped fake `async` from `EnvironmentStore::list`/`get` (sync `RwLock` reads only).\n- Inlined `resolve_path` into `base_dir.join(path)` (it was reimplementing `Path::join`).\n- Replaced the local `value()` wrapper with `toml_edit::value`.\n- Replaced `Option<PathBuf>` with `&Path` in `parse_persisted` (`from_persisted_path`'s \"memory\" branch is dead now).\n- Extracted `check_revision` helper to eliminate duplicated lock-read + ok_or + revision-compare across `replace` and `delete`.\n- Added small `read_state`/`write_state` accessors to centralize the lock-poisoning expect.\n\n### Config plumbing\n- **Removed the thin `load_settings_path` wrapper** and renamed `load_settings_path_with_source` to `load_settings_path(path, source)`. Each call site now declares its `SettingsSource` explicitly.\n- **Unified the parse-then-validate pattern** behind a single `parse_settings_toml(source, kind)` helper, replacing 11 duplicated `.parse::<SettingsLayer>().map_err(...)?; validate_parsed_source(&layer, ...)?` blocks.\n- Replaced the two scattered match arms in `parse.rs` with named predicates `SettingsSource::runs_settings_migrations` / `forbids_environment_catalog`.\n\n### Verification\n- `cargo nextest run -p fabro-environment -p fabro-config` — 233 passed, 0 failed.\n- `cargo +nightly-2026-04-14 fmt --check --all` — clean.\n- `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` — clean.\n- `cargo build --workspace` — clean.\n\n`fabro-server` retains 34 pre-existing test failures from the failed `implement` step (Task 5 of the original plan, \"Adjust CLI And Manifest Behavior\", was never executed). All share a \"unknown environment: <id>\" root cause: tests that exercise `fabro-manifest::build_run_manifest` directly never seed a server environment catalog. These failures predate this cleanup pass and aren't introduced by it.\n\nFindings not addressed (deferred — would require crate-restructuring beyond a review pass):\n- Sharing `write_atomic`/`temp_path_for`/`id_from_path`/etc. with the identical helpers in `fabro-automation` (would need a new shared util crate).\n- Sharing the slug validator and SHA-256 revision type between `fabro-environment` and `fabro-automation` (cycle if extracted to fabro-config; would need a `fabro-util` extraction).\n- Sharing `ensure_table` between `fabro-environment::model` and the legacy migration.\n- Making `StickyMap`'s `Serialize` deterministic so `canonical_bytes` could collapse into `toml::to_string_pretty(layer)`."
            },
            "notes": "Stage completed: simplify_opus",
            "usage": {
              "input": {
                "usage": {
                  "model": {
                    "provider": "anthropic",
                    "model_id": "claude-opus-4-7"
                  },
                  "tokens": {
                    "input_tokens": 262080,
                    "output_tokens": 89618,
                    "reasoning_tokens": 0,
                    "cache_read_tokens": 44336839,
                    "cache_write_tokens": 4410068
                  }
                },
                "facts": {
                  "algorithm": "anthropic",
                  "cache_write_5m_tokens": 4410068,
                  "cache_write_1h_tokens": 0
                }
              },
              "total_usd_micros": 53282194
            },
            "files_touched": [
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/migrations/2026050101_legacy_sandbox_to_environments.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/builders.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/load.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/parse.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/project.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/resolve/mod.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/run.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/user.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/error.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/lib.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/model.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/store.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/run_manifest.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/serve.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/server.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/server/handler/graph.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/test_support.rs"
            ],
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 1449354,
              "tool_time_ms": 794439,
              "active_time_ms": 2243793
            }
          },
          "preflight_compile": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo check -q --workspace 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 131121,
              "active_time_ms": 131121
            }
          },
          "start": {
            "status": "succeeded",
            "usage": null
          },
          "preflight_lint": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 143203,
              "active_time_ms": 143203
            }
          }
        },
        "next_node_id": "simplify_gpt",
        "git_commit_sha": "d6c31f248d4d229c44db12f6ab9fb0a4b6ba272d",
        "loop_failure_signatures": {
          "implement|deterministic|api_deterministic|openai|invalid_request": 1
        },
        "node_visits": {
          "preflight_lint": 1,
          "implement": 1,
          "preflight_compile": 1,
          "start": 1,
          "simplify_opus": 1,
          "toolchain": 1
        }
      },
      "diff": {
        "patch": "diff --git a/Cargo.lock b/Cargo.lock\nindex 29c44783b..bf92dc00e 100644\n--- a/Cargo.lock\n+++ b/Cargo.lock\n@@ -2373,6 +2373,7 @@ dependencies = [\n  \"fabro-build-support\",\n  \"fabro-client\",\n  \"fabro-config\",\n+ \"fabro-environment\",\n  \"fabro-github\",\n  \"fabro-graphviz\",\n  \"fabro-hooks\",\ndiff --git a/lib/crates/fabro-config/migrations/2026050101_legacy_sandbox_to_environments.rs b/lib/crates/fabro-config/migrations/2026050101_legacy_sandbox_to_environments.rs\nindex 255d9bf42..860504d65 100644\n--- a/lib/crates/fabro-config/migrations/2026050101_legacy_sandbox_to_environments.rs\n+++ b/lib/crates/fabro-config/migrations/2026050101_legacy_sandbox_to_environments.rs\n@@ -1,28 +1,11 @@\n-#![expect(\n-    clippy::disallowed_methods,\n-    clippy::disallowed_types,\n-    reason = \"temporary startup config migration uses synchronous file I/O before config is loaded\"\n-)]\n-\n use std::fmt;\n-use std::io::Write;\n-use std::path::{Path, PathBuf};\n+use std::path::Path;\n use std::str::FromStr;\n \n use fabro_types::settings::run::EnvironmentProvider;\n use toml_edit::{ArrayOfTables, DocumentMut, Item, Table, Value};\n \n-use crate::{Error, Result, SettingsLayer};\n-\n-pub(crate) const REMOVAL_NOTE: &str =\n-    \"This temporary compatibility migration will be removed before v1.0.\";\n-\n-#[derive(Debug)]\n-pub(crate) struct LegacySandboxMigrationReport {\n-    pub(crate) warning: String,\n-    #[cfg(test)]\n-    backup_path:        PathBuf,\n-}\n+use crate::{Error, Result};\n \n #[derive(Debug, Clone, PartialEq, Eq)]\n struct MigrationFailure {\n@@ -43,45 +26,6 @@ impl fmt::Display for MigrationFailure {\n     }\n }\n \n-pub(crate) fn migrate_settings_path(\n-    path: &Path,\n-    original_contents: &str,\n-) -> Result<Option<LegacySandboxMigrationReport>> {\n-    let Some(next_contents) = migrate_contents(original_contents, path)? else {\n-        return Ok(None);\n-    };\n-\n-    let layer = next_contents\n-        .parse::<SettingsLayer>()\n-        .map_err(|err| Error::parse_file(\"Migrated settings file is invalid\", path, err))?;\n-\n-    let backup_path = write_next_backup(path, original_contents)?;\n-    std::fs::write(path, &next_contents).map_err(|source| {\n-        Error::other(format!(\n-            \"writing migrated settings file {}: {source}\",\n-            path.display()\n-        ))\n-    })?;\n-\n-    let environment_id = layer\n-        .run\n-        .as_ref()\n-        .and_then(|run| run.environment.as_ref())\n-        .and_then(|environment| environment.id.as_deref())\n-        .unwrap_or(\"default\");\n-    let warning = format!(\n-        \"Migrated legacy [run.sandbox] settings in {} to [run.environment] and [environments.{environment_id}]. Backup written to {}. {REMOVAL_NOTE}\",\n-        path.display(),\n-        backup_path.display()\n-    );\n-\n-    Ok(Some(LegacySandboxMigrationReport {\n-        warning,\n-        #[cfg(test)]\n-        backup_path,\n-    }))\n-}\n-\n pub(crate) fn migrate_contents(original_contents: &str, path: &Path) -> Result<Option<String>> {\n     let Ok(mut doc) = original_contents.parse::<DocumentMut>() else {\n         return Ok(None);\n@@ -427,63 +371,12 @@ fn remove_run_sandbox(doc: &mut DocumentMut) {\n     }\n }\n \n-#[cfg(test)]\n-fn next_backup_path(path: &Path) -> PathBuf {\n-    for index in 0u32.. {\n-        let candidate = backup_path_for(path, index);\n-        if !candidate.exists() {\n-            return candidate;\n-        }\n-    }\n-    unreachable!(\"unbounded backup suffix search should return\")\n-}\n-\n-fn write_next_backup(path: &Path, contents: &str) -> Result<PathBuf> {\n-    for index in 0u32.. {\n-        let backup_path = backup_path_for(path, index);\n-        match std::fs::OpenOptions::new()\n-            .write(true)\n-            .create_new(true)\n-            .open(&backup_path)\n-        {\n-            Ok(mut file) => {\n-                file.write_all(contents.as_bytes()).map_err(|source| {\n-                    Error::other(format!(\n-                        \"writing legacy sandbox migration backup {}: {source}\",\n-                        backup_path.display()\n-                    ))\n-                })?;\n-                return Ok(backup_path);\n-            }\n-            Err(source) if source.kind() == std::io::ErrorKind::AlreadyExists => {}\n-            Err(source) => {\n-                return Err(Error::other(format!(\n-                    \"writing legacy sandbox migration backup {}: {source}\",\n-                    backup_path.display()\n-                )));\n-            }\n-        }\n-    }\n-    unreachable!(\"unbounded backup suffix search should return\")\n-}\n-\n-fn backup_path_for(path: &Path, index: u32) -> PathBuf {\n-    let file_name = path\n-        .file_name()\n-        .and_then(|name| name.to_str())\n-        .unwrap_or(\"settings.toml\");\n-    if index == 0 {\n-        path.with_file_name(format!(\"{file_name}.legacy-sandbox-migration.bak\"))\n-    } else {\n-        path.with_file_name(format!(\"{file_name}.legacy-sandbox-migration.{index}.bak\"))\n-    }\n-}\n-\n #[cfg(test)]\n mod tests {\n     use fabro_types::settings::InterpString;\n \n     use super::*;\n+    use crate::SettingsLayer;\n \n     fn migrate(source: &str) -> String {\n         migrate_contents(source, Path::new(\"settings.toml\"))\n@@ -659,47 +552,6 @@ skip_clone = true\n         assert!(!resolved.clone.enabled);\n     }\n \n-    #[test]\n-    fn migrate_settings_path_writes_backup_and_rewrites_original() {\n-        let dir = tempfile::tempdir().expect(\"temp dir\");\n-        let path = dir.path().join(\"settings.toml\");\n-        let original = r#\"\n-_version = 1\n-\n-[run.sandbox]\n-provider = \"daytona\"\n-\"#;\n-        std::fs::write(&path, original).expect(\"write fixture\");\n-\n-        let report = migrate_settings_path(&path, original)\n-            .expect(\"migration should succeed\")\n-            .expect(\"legacy config should migrate\");\n-\n-        let rewritten = std::fs::read_to_string(&path).expect(\"read rewritten settings\");\n-        let backup = std::fs::read_to_string(&report.backup_path).expect(\"read backup\");\n-\n-        assert_eq!(backup, original);\n-        assert!(rewritten.contains(\"[run.environment]\"));\n-        assert!(rewritten.contains(\"[environments.daytona]\"));\n-        assert!(report.warning.contains(\"[environments.daytona]\"));\n-        assert!(report.warning.contains(\"temporary compatibility migration\"));\n-    }\n-\n-    #[test]\n-    fn existing_backup_uses_numbered_suffix() {\n-        let dir = tempfile::tempdir().expect(\"temp dir\");\n-        let path = dir.path().join(\"settings.toml\");\n-        std::fs::write(\n-            path.with_file_name(\"settings.toml.legacy-sandbox-migration.bak\"),\n-            \"old\",\n-        )\n-        .expect(\"write existing backup\");\n-\n-        let next = next_backup_path(&path);\n-\n-        assert!(next.ends_with(\"settings.toml.legacy-sandbox-migration.1.bak\"));\n-    }\n-\n     #[test]\n     fn existing_new_environment_config_is_ambiguous() {\n         let err = migrate_contents(\ndiff --git a/lib/crates/fabro-config/src/builders.rs b/lib/crates/fabro-config/src/builders.rs\nindex 1430ae43b..11b7fbc32 100644\n--- a/lib/crates/fabro-config/src/builders.rs\n+++ b/lib/crates/fabro-config/src/builders.rs\n@@ -8,7 +8,7 @@ use fabro_types::{ServerSettings, UserSettings, WorkflowSettings};\n use fabro_util::error::SharedError;\n \n use crate::defaults::DEFAULTS_LAYER;\n-use crate::load::{load_settings_path, load_settings_path_with_source};\n+use crate::load::load_settings_path;\n use crate::parse::{SettingsSource, validate_settings_source};\n use crate::resolve::{\n     ResolveError, resolve_cli, resolve_project, resolve_run, resolve_server, resolve_workflow,\n@@ -83,15 +83,12 @@ impl ServerSettingsBuilder {\n     }\n \n     pub fn load_from(path: &Path) -> Result<ServerSettings> {\n-        let layer = load_settings_path(path)?;\n+        let layer = load_settings_path(path, SettingsSource::ActiveSettings)?;\n         Self::from_layer(&layer)\n     }\n \n     pub fn from_toml(source: &str) -> Result<ServerSettings> {\n-        let layer = source\n-            .parse::<SettingsLayer>()\n-            .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n-        validate_parsed_source(&layer, SettingsSource::ActiveSettings)?;\n+        let layer = parse_settings_toml(source, SettingsSource::ActiveSettings)?;\n         Self::from_layer(&layer)\n     }\n \n@@ -121,28 +118,22 @@ impl UserSettingsBuilder {\n     }\n \n     pub fn load_from(path: &Path) -> Result<UserSettings> {\n-        let layer = load_settings_path_with_source(path, SettingsSource::User)?;\n+        let layer = load_settings_path(path, SettingsSource::User)?;\n         Self::from_layer(&layer)\n     }\n \n     pub fn load_from_with_cli_overrides(path: &Path, cli: &CliLayer) -> Result<UserSettings> {\n-        let layer = load_settings_path_with_source(path, SettingsSource::User)?;\n+        let layer = load_settings_path(path, SettingsSource::User)?;\n         Self::from_layer_with_cli_overrides(&layer, cli)\n     }\n \n     pub fn from_toml(source: &str) -> Result<UserSettings> {\n-        let layer = source\n-            .parse::<SettingsLayer>()\n-            .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n-        validate_parsed_source(&layer, SettingsSource::User)?;\n+        let layer = parse_settings_toml(source, SettingsSource::User)?;\n         Self::from_layer(&layer)\n     }\n \n     pub fn from_toml_with_cli_overrides(source: &str, cli: &CliLayer) -> Result<UserSettings> {\n-        let layer = source\n-            .parse::<SettingsLayer>()\n-            .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n-        validate_parsed_source(&layer, SettingsSource::User)?;\n+        let layer = parse_settings_toml(source, SettingsSource::User)?;\n         Self::from_layer_with_cli_overrides(&layer, cli)\n     }\n \n@@ -180,15 +171,12 @@ impl RunSettingsBuilder {\n     }\n \n     pub fn load_from(path: &Path) -> Result<RunNamespace> {\n-        let layer = load_settings_path_with_source(path, SettingsSource::DirectRun)?;\n+        let layer = load_settings_path(path, SettingsSource::DirectRun)?;\n         Self::from_layer(&layer)\n     }\n \n     pub fn from_toml(source: &str) -> Result<RunNamespace> {\n-        let layer = source\n-            .parse::<SettingsLayer>()\n-            .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n-        validate_parsed_source(&layer, SettingsSource::DirectRun)?;\n+        let layer = parse_settings_toml(source, SettingsSource::DirectRun)?;\n         Self::from_layer(&layer)\n     }\n \n@@ -226,7 +214,7 @@ pub fn load_server_runtime_settings(\n     server_overrides: Option<ServerLayer>,\n ) -> Result<ServerRuntimeSettings> {\n     let layer = match path {\n-        Some(path) => load_settings_path(path)?,\n+        Some(path) => load_settings_path(path, SettingsSource::ActiveSettings)?,\n         None => load_settings_config(None)?,\n     };\n     resolve_server_runtime_settings(layer, run_overrides, server_overrides)\n@@ -234,7 +222,7 @@ pub fn load_server_runtime_settings(\n \n pub fn load_llm_catalog_settings(path: Option<&Path>) -> Result<model_catalog::LlmCatalogSettings> {\n     let layer = match path {\n-        Some(path) => load_settings_path(path)?,\n+        Some(path) => load_settings_path(path, SettingsSource::ActiveSettings)?,\n         None => load_settings_config(None)?,\n     };\n     Ok(llm_catalog_settings_from_layer(&layer))\n@@ -246,10 +234,7 @@ pub fn server_runtime_settings_from_toml(\n     run_overrides: Option<RunLayer>,\n     server_overrides: Option<ServerLayer>,\n ) -> Result<ServerRuntimeSettings> {\n-    let layer = source\n-        .parse::<SettingsLayer>()\n-        .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n-    validate_parsed_source(&layer, SettingsSource::ActiveSettings)?;\n+    let layer = parse_settings_toml(source, SettingsSource::ActiveSettings)?;\n     resolve_server_runtime_settings(layer, run_overrides, server_overrides)\n }\n \n@@ -418,9 +403,13 @@ fn cost_rates_to_catalog(rates: &CostRates) -> model_catalog::CostRates {\n     }\n }\n \n-fn validate_parsed_source(layer: &SettingsLayer, source: SettingsSource) -> Result<()> {\n-    validate_settings_source(layer, source)\n-        .map_err(|err| Error::parse(\"Failed to parse settings file\", err))\n+fn parse_settings_toml(source: &str, kind: SettingsSource) -> Result<SettingsLayer> {\n+    let layer = source\n+        .parse::<SettingsLayer>()\n+        .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n+    validate_settings_source(&layer, kind)\n+        .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n+    Ok(layer)\n }\n \n #[derive(Clone, Debug, Default)]\n@@ -439,10 +428,7 @@ impl WorkflowSettingsBuilder {\n     }\n \n     pub fn from_toml(source: &str) -> Result<WorkflowSettings> {\n-        let layer = source\n-            .parse::<SettingsLayer>()\n-            .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n-        validate_parsed_source(&layer, SettingsSource::Workflow)?;\n+        let layer = parse_settings_toml(source, SettingsSource::Workflow)?;\n         Self::from_layer(&layer)\n             .map_err(|errors| Error::resolve(\"failed to resolve workflow settings\", errors.into()))\n     }\n@@ -468,18 +454,12 @@ impl WorkflowSettingsBuilder {\n     }\n \n     pub fn workflow_toml(self, source: &str) -> Result<Self> {\n-        let layer = source\n-            .parse::<SettingsLayer>()\n-            .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n-        validate_parsed_source(&layer, SettingsSource::Workflow)?;\n+        let layer = parse_settings_toml(source, SettingsSource::Workflow)?;\n         Ok(self.workflow_layer(layer))\n     }\n \n     pub fn workflow_toml_with_run_layer(self, source: &str, run: RunLayer) -> Result<Self> {\n-        let mut layer = source\n-            .parse::<SettingsLayer>()\n-            .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n-        validate_parsed_source(&layer, SettingsSource::Workflow)?;\n+        let mut layer = parse_settings_toml(source, SettingsSource::Workflow)?;\n         layer.run = Some(run);\n         Ok(self.workflow_layer(layer))\n     }\n@@ -495,27 +475,18 @@ impl WorkflowSettingsBuilder {\n     }\n \n     pub fn project_toml(self, source: &str) -> Result<Self> {\n-        let layer = source\n-            .parse::<SettingsLayer>()\n-            .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n-        validate_parsed_source(&layer, SettingsSource::Project)?;\n+        let layer = parse_settings_toml(source, SettingsSource::Project)?;\n         Ok(self.project_layer(layer))\n     }\n \n     pub fn project_toml_with_run_layer(self, source: &str, run: RunLayer) -> Result<Self> {\n-        let mut layer = source\n-            .parse::<SettingsLayer>()\n-            .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n-        validate_parsed_source(&layer, SettingsSource::Project)?;\n+        let mut layer = parse_settings_toml(source, SettingsSource::Project)?;\n         layer.run = Some(run);\n         Ok(self.project_layer(layer))\n     }\n \n     pub fn project_file(self, path: &Path) -> Result<Self> {\n-        Ok(self.project_layer(load_settings_path_with_source(\n-            path,\n-            SettingsSource::Project,\n-        )?))\n+        Ok(self.project_layer(load_settings_path(path, SettingsSource::Project)?))\n     }\n \n     #[must_use]\n@@ -525,18 +496,12 @@ impl WorkflowSettingsBuilder {\n     }\n \n     pub fn user_toml(self, source: &str) -> Result<Self> {\n-        let layer = source\n-            .parse::<SettingsLayer>()\n-            .map_err(|err| Error::parse(\"Failed to parse settings file\", err))?;\n-        validate_parsed_source(&layer, SettingsSource::User)?;\n+        let layer = parse_settings_toml(source, SettingsSource::User)?;\n         Ok(self.user_layer(layer))\n     }\n \n     pub fn user_file(self, path: &Path) -> Result<Self> {\n-        Ok(self.user_layer(load_settings_path_with_source(\n-            path,\n-            SettingsSource::User,\n-        )?))\n+        Ok(self.user_layer(load_settings_path(path, SettingsSource::User)?))\n     }\n \n     #[must_use]\ndiff --git a/lib/crates/fabro-config/src/load.rs b/lib/crates/fabro-config/src/load.rs\nindex 701658e75..37ad0be12 100644\n--- a/lib/crates/fabro-config/src/load.rs\n+++ b/lib/crates/fabro-config/src/load.rs\n@@ -14,18 +14,7 @@ use crate::{Error, Result, RunGoalLayer, SettingsLayer, migrations};\n     clippy::print_stderr,\n     reason = \"startup config auto-migration warning must be visible before caller logging is configured\"\n )]\n-pub(crate) fn load_settings_path(path: &Path) -> Result<SettingsLayer> {\n-    load_settings_path_with_source(path, SettingsSource::ActiveSettings)\n-}\n-\n-#[expect(\n-    clippy::print_stderr,\n-    reason = \"startup config auto-migration warning must be visible before caller logging is configured\"\n-)]\n-pub(crate) fn load_settings_path_with_source(\n-    path: &Path,\n-    source: SettingsSource,\n-) -> Result<SettingsLayer> {\n+pub(crate) fn load_settings_path(path: &Path, source: SettingsSource) -> Result<SettingsLayer> {\n     let content = std::fs::read_to_string(path).map_err(|source| Error::read_file(path, source))?;\n     let content = if source.runs_settings_migrations() {\n         match migrations::run_migrations(path, &content)? {\n@@ -42,9 +31,8 @@ pub(crate) fn load_settings_path_with_source(\n     let mut layer = content\n         .parse::<SettingsLayer>()\n         .map_err(|err| Error::parse_file(\"Failed to parse settings file\", path, err))?;\n-    validate_settings_source(&layer, source).map_err(|err| {\n-        Error::parse_file(\"Failed to parse settings file\", path, err)\n-    })?;\n+    validate_settings_source(&layer, source)\n+        .map_err(|err| Error::parse_file(\"Failed to parse settings file\", path, err))?;\n     let base_dir = path.parent().unwrap_or_else(|| Path::new(\".\"));\n     resolve_goal_file_paths(&mut layer, base_dir);\n     Ok(layer)\n@@ -96,10 +84,12 @@ provider = \"daytona\"\n         )\n         .expect(\"write legacy settings\");\n \n-        let layer = load_settings_path(&path).expect(\"legacy settings should auto-migrate\");\n+        let layer = load_settings_path(&path, SettingsSource::ActiveSettings)\n+            .expect(\"legacy settings should auto-migrate\");\n \n         assert_eq!(\n-            layer.run\n+            layer\n+                .run\n                 .as_ref()\n                 .and_then(|run| run.environment.as_ref())\n                 .and_then(|environment| environment.id.as_deref()),\ndiff --git a/lib/crates/fabro-config/src/parse.rs b/lib/crates/fabro-config/src/parse.rs\nindex 37f0bb541..87d3e7deb 100644\n--- a/lib/crates/fabro-config/src/parse.rs\n+++ b/lib/crates/fabro-config/src/parse.rs\n@@ -126,20 +126,24 @@ pub enum SettingsSource {\n }\n \n impl SettingsSource {\n+    /// `ActiveSettings` is the aggregated server-side settings file. Other\n+    /// sources are leaf user configs that cannot define environment catalogs.\n     #[must_use]\n     pub(crate) fn runs_settings_migrations(self) -> bool {\n         matches!(self, Self::ActiveSettings | Self::User)\n     }\n+\n+    #[must_use]\n+    pub(crate) fn forbids_environment_catalog(self) -> bool {\n+        !matches!(self, Self::ActiveSettings)\n+    }\n }\n \n pub fn validate_settings_source(\n     layer: &SettingsLayer,\n     source: SettingsSource,\n ) -> Result<(), ParseError> {\n-    if matches!(\n-        source,\n-        SettingsSource::Project | SettingsSource::Workflow | SettingsSource::DirectRun | SettingsSource::User\n-    ) {\n+    if source.forbids_environment_catalog() {\n         if let Some(id) = layer.environments.keys().min() {\n             return Err(ParseError::ServerManagedEnvironment {\n                 path: format!(\"environments.{id}\"),\ndiff --git a/lib/crates/fabro-config/src/project.rs b/lib/crates/fabro-config/src/project.rs\nindex b52663d78..eccdf684d 100644\n--- a/lib/crates/fabro-config/src/project.rs\n+++ b/lib/crates/fabro-config/src/project.rs\n@@ -378,6 +378,7 @@ mod tests {\n     use tempfile::TempDir;\n \n     use super::*;\n+    use crate::tests::workflow_settings_from_toml;\n \n     #[test]\n     fn parse_minimal_config() {\n@@ -402,7 +403,7 @@ directory = \"custom/\"\n             Some(\"custom/\".to_string())\n         );\n \n-        let project = crate::tests::workflow_settings_from_toml(\n+        let project = workflow_settings_from_toml(\n             r#\"\n _version = 1\n \ndiff --git a/lib/crates/fabro-config/src/resolve/mod.rs b/lib/crates/fabro-config/src/resolve/mod.rs\nindex 6501dda1a..418aed302 100644\n--- a/lib/crates/fabro-config/src/resolve/mod.rs\n+++ b/lib/crates/fabro-config/src/resolve/mod.rs\n@@ -58,6 +58,7 @@ mod tests {\n     use fabro_types::settings::run::{HookType, McpHttpProtocol, McpTransport, TlsMode};\n \n     use crate::SettingsLayer;\n+    use crate::tests::workflow_settings_from_layer;\n \n     #[test]\n     fn resolve_preserves_source_templates_for_mcp_and_hook_strings() {\n@@ -100,7 +101,7 @@ Authorization = \"Bearer {{ env.HOOK_TOKEN }}\"\n         .parse::<SettingsLayer>()\n         .expect(\"settings fixture should parse\");\n \n-        let resolved = crate::tests::workflow_settings_from_layer(settings)\n+        let resolved = workflow_settings_from_layer(settings)\n             .expect(\"run settings should resolve\")\n             .run;\n         let mcps = &resolved.agent.mcps;\ndiff --git a/lib/crates/fabro-config/src/run.rs b/lib/crates/fabro-config/src/run.rs\nindex 311cd3726..0dbdabbca 100644\n--- a/lib/crates/fabro-config/src/run.rs\n+++ b/lib/crates/fabro-config/src/run.rs\n@@ -14,7 +14,7 @@ use std::path::{Path, PathBuf};\n use fabro_types::settings::InterpString;\n use fabro_types::settings::run::{ResolvedGoalSource, ResolvedRunGoal, RunGoal, RunNamespace};\n \n-use crate::load::{load_settings_path_with_source, resolve_goal_file_path};\n+use crate::load::{load_settings_path, resolve_goal_file_path};\n use crate::parse::{SettingsSource, validate_settings_source};\n use crate::{Result, RunGoalLayer, RunLayer, SettingsLayer};\n \n@@ -23,7 +23,7 @@ use crate::{Result, RunGoalLayer, RunLayer, SettingsLayer};\n /// Goes through [`load_settings_path`] so that relative `run.goal.file`\n /// paths are anchored at the directory of `path` at load time.\n pub(crate) fn load_run_config(path: &Path) -> Result<SettingsLayer> {\n-    load_settings_path_with_source(path, SettingsSource::Workflow)\n+    load_settings_path(path, SettingsSource::Workflow)\n }\n \n /// Parse a settings TOML source string and extract its `[run]` layer.\ndiff --git a/lib/crates/fabro-config/src/tests/defaults.rs b/lib/crates/fabro-config/src/tests/defaults.rs\nindex 4446268bc..bbbb3df9e 100644\n--- a/lib/crates/fabro-config/src/tests/defaults.rs\n+++ b/lib/crates/fabro-config/src/tests/defaults.rs\n@@ -128,7 +128,8 @@ mode = \"dry_run\"\n \"#,\n     );\n \n-    let settings = super::workflow_settings_from_layer(layer).expect(\"workflow settings should resolve\");\n+    let settings =\n+        super::workflow_settings_from_layer(layer).expect(\"workflow settings should resolve\");\n \n     assert_eq!(settings.run.execution.mode, RunMode::DryRun);\n     assert_eq!(settings.run.execution.approval, ApprovalMode::Prompt);\ndiff --git a/lib/crates/fabro-config/src/tests/resolve_root.rs b/lib/crates/fabro-config/src/tests/resolve_root.rs\nindex ed2f77cb0..b8f907811 100644\n--- a/lib/crates/fabro-config/src/tests/resolve_root.rs\n+++ b/lib/crates/fabro-config/src/tests/resolve_root.rs\n@@ -65,7 +65,7 @@ provider = \"not-a-provider\"\n             .expect(\"bad environment catalog should parse\")\n             .environments,\n         )\n-            .expect_err(\"invalid run settings should fail\")\n+        .expect_err(\"invalid run settings should fail\")\n         {\n             fabro_config::Error::Resolve { errors, .. } => errors,\n             other => panic!(\"expected resolve error, got {other:#}\"),\n@@ -136,8 +136,7 @@ name = \"gpt-5\"\n #[test]\n fn workflow_settings_resolve_defaults_and_expose_fields() {\n     let settings = SettingsLayer::default();\n-    let resolved = super::workflow_settings_from_layer(settings)\n-        .expect(\"defaults should resolve\");\n+    let resolved = super::workflow_settings_from_layer(settings).expect(\"defaults should resolve\");\n \n     let project_json =\n         serde_json::to_value(&resolved.project).expect(\"project settings should serialize\");\ndiff --git a/lib/crates/fabro-config/src/tests/resolve_run.rs b/lib/crates/fabro-config/src/tests/resolve_run.rs\nindex f89e421e4..6cd9c34b1 100644\n--- a/lib/crates/fabro-config/src/tests/resolve_run.rs\n+++ b/lib/crates/fabro-config/src/tests/resolve_run.rs\n@@ -608,8 +608,8 @@ mod run_integrations_github_permissions {\n \n     use fabro_types::settings::InterpString;\n \n-    use crate::layers::Combine;\n     use crate::SettingsLayer;\n+    use crate::layers::Combine;\n \n     fn parse_settings(source: &str) -> SettingsLayer {\n         source\n@@ -778,8 +778,8 @@ issues = \"{{ env.GH_PERM_LEVEL }}\"\n }\n \n mod run_agent_fabro_tools {\n-    use crate::layers::Combine;\n     use crate::SettingsLayer;\n+    use crate::layers::Combine;\n \n     fn parse_settings(source: &str) -> SettingsLayer {\n         source\n@@ -857,8 +857,8 @@ fabro_tools = true\n mod run_checkpoint_skip_git_hooks {\n     //! Layer + resolver tests for `[run.checkpoint] skip_git_hooks`.\n \n-    use crate::layers::Combine;\n     use crate::SettingsLayer;\n+    use crate::layers::Combine;\n \n     fn parse_settings(source: &str) -> SettingsLayer {\n         source\ndiff --git a/lib/crates/fabro-config/src/user.rs b/lib/crates/fabro-config/src/user.rs\nindex 7554a3429..303f8cc2a 100644\n--- a/lib/crates/fabro-config/src/user.rs\n+++ b/lib/crates/fabro-config/src/user.rs\n@@ -10,6 +10,7 @@ use fabro_static::EnvVars;\n \n use crate::home::Home;\n use crate::load::load_settings_path;\n+use crate::parse::SettingsSource;\n use crate::{Result, SettingsLayer};\n \n pub const SETTINGS_CONFIG_FILENAME: &str = \"settings.toml\";\n@@ -67,7 +68,7 @@ pub(crate) fn load_settings_config(path: Option<&Path>) -> Result<SettingsLayer>\n }\n \n fn load_v2_layer_from_path(path: &Path) -> Result<SettingsLayer> {\n-    load_settings_path(path)\n+    load_settings_path(path, SettingsSource::ActiveSettings)\n }\n \n #[cfg(test)]\ndiff --git a/lib/crates/fabro-environment/src/error.rs b/lib/crates/fabro-environment/src/error.rs\nindex 6557a662f..aab0f2e3d 100644\n--- a/lib/crates/fabro-environment/src/error.rs\n+++ b/lib/crates/fabro-environment/src/error.rs\n@@ -13,7 +13,7 @@ pub enum EnvironmentValidationError {\n     InvalidSettings { errors: Vec<String> },\n     #[error(\"failed to read Dockerfile referenced by environment at {path:?}\")]\n     DockerfileRead {\n-        path: PathBuf,\n+        path:   PathBuf,\n         #[source]\n         source: std::io::Error,\n     },\n@@ -25,8 +25,6 @@ pub enum EnvironmentStoreError {\n     NotFound { id: EnvironmentId },\n     #[error(\"environment already exists: {id}\")]\n     AlreadyExists { id: EnvironmentId },\n-    #[error(\"environment revision is missing: {id}\")]\n-    MissingRevision { id: EnvironmentId },\n     #[error(\"environment revision is stale for {id}: expected {expected}, actual {actual}\")]\n     StaleRevision {\n         id:       EnvironmentId,\n@@ -94,7 +92,6 @@ impl EnvironmentStoreError {\n         match self {\n             Self::NotFound { .. } => \"not_found\",\n             Self::AlreadyExists { .. } => \"already_exists\",\n-            Self::MissingRevision { .. } => \"missing_revision\",\n             Self::StaleRevision { .. } => \"stale_revision\",\n             Self::Protected { .. } => \"protected\",\n             Self::Validation { .. } => \"validation\",\ndiff --git a/lib/crates/fabro-environment/src/lib.rs b/lib/crates/fabro-environment/src/lib.rs\nindex 5fc53c08c..ec80a7cf8 100644\n--- a/lib/crates/fabro-environment/src/lib.rs\n+++ b/lib/crates/fabro-environment/src/lib.rs\n@@ -5,5 +5,5 @@ mod store;\n \n pub use error::{EnvironmentStoreError, EnvironmentValidationError};\n pub use id::{EnvironmentId, EnvironmentRevision, EnvironmentRevisionParseError};\n-pub use model::{Environment, EnvironmentDraft, EnvironmentReplace};\n+pub use model::{Environment, EnvironmentDraft};\n pub use store::EnvironmentStore;\ndiff --git a/lib/crates/fabro-environment/src/model.rs b/lib/crates/fabro-environment/src/model.rs\nindex 92dd1a075..05204760e 100644\n--- a/lib/crates/fabro-environment/src/model.rs\n+++ b/lib/crates/fabro-environment/src/model.rs\n@@ -1,197 +1,78 @@\n use std::collections::BTreeMap;\n-use std::path::{Path, PathBuf};\n+use std::path::Path;\n \n use fabro_config::{\n-    EnvironmentDockerfileLayer, EnvironmentImageLayer, EnvironmentLayer,\n-    EnvironmentLifecycleLayer, EnvironmentNetworkLayer, EnvironmentResourcesLayer,\n-    EnvironmentVolumeLayer, StickyMap,\n+    EnvironmentDockerfileLayer, EnvironmentImageLayer, EnvironmentLayer, EnvironmentLifecycleLayer,\n+    EnvironmentNetworkLayer, EnvironmentResourcesLayer, EnvironmentVolumeLayer, StickyMap,\n };\n use fabro_types::settings::InterpString;\n use fabro_types::settings::run::{\n     DockerfileSource, EnvironmentImageSettings, EnvironmentLifecycleSettings,\n-    EnvironmentNetworkMode, EnvironmentNetworkSettings, EnvironmentProvider,\n-    EnvironmentResourcesSettings, EnvironmentSettings, EnvironmentVolumeSettings,\n+    EnvironmentNetworkMode, EnvironmentNetworkSettings, EnvironmentResourcesSettings,\n+    EnvironmentSettings, EnvironmentVolumeSettings,\n };\n use serde::{Deserialize, Serialize};\n-use toml_edit::{Array, ArrayOfTables, DocumentMut, Item, Table, Value};\n+use toml_edit::{Array, ArrayOfTables, DocumentMut, Item, Table, Value, value};\n \n use crate::{\n     EnvironmentId, EnvironmentRevision, EnvironmentStoreError, EnvironmentValidationError,\n };\n \n #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]\n-#[serde(deny_unknown_fields)]\n pub struct Environment {\n-    pub id:        EnvironmentId,\n-    pub revision:  EnvironmentRevision,\n-    pub provider:  EnvironmentProvider,\n-    pub image:     EnvironmentImageSettings,\n-    pub resources: EnvironmentResourcesSettings,\n-    pub network:   EnvironmentNetworkSettings,\n-    pub lifecycle: EnvironmentLifecycleSettings,\n-    pub labels:    std::collections::HashMap<String, String>,\n-    pub volumes:   Vec<EnvironmentVolumeSettings>,\n-    pub env:       std::collections::HashMap<String, InterpString>,\n+    pub id:       EnvironmentId,\n+    pub revision: EnvironmentRevision,\n+    #[serde(flatten)]\n+    pub settings: EnvironmentSettings,\n }\n \n impl Environment {\n-    pub fn from_toml_bytes(id: EnvironmentId, bytes: &[u8]) -> Result<Self, EnvironmentStoreError> {\n-        let revision = EnvironmentRevision::from_bytes(bytes);\n-        let persisted = parse_persisted(bytes, None)?;\n-        Self::from_persisted(id, revision, persisted, None).map_err(EnvironmentStoreError::from)\n-    }\n-\n     pub(crate) fn from_persisted_path(\n         id: EnvironmentId,\n         bytes: &[u8],\n-        path: impl Into<PathBuf>,\n+        path: &Path,\n     ) -> Result<Self, EnvironmentStoreError> {\n-        let path = path.into();\n         let revision = EnvironmentRevision::from_bytes(bytes);\n-        let persisted = parse_persisted(bytes, Some(path.clone()))?;\n+        let mut persisted = parse_persisted(bytes, path)?;\n         let base_dir = path.parent().unwrap_or_else(|| Path::new(\".\"));\n-        Self::from_persisted(id, revision, persisted, Some(base_dir))\n-            .map_err(EnvironmentStoreError::from)\n+        inline_layer_dockerfile_paths(&mut persisted, base_dir)?;\n+        let settings = resolve_environment(&persisted)?;\n+        Ok(Self {\n+            id,\n+            revision,\n+            settings,\n+        })\n     }\n \n-    pub(crate) fn from_replace(\n+    pub(crate) fn from_settings(\n         id: EnvironmentId,\n-        replacement: EnvironmentReplace,\n+        settings: EnvironmentSettings,\n         dockerfile_base_dir: &Path,\n     ) -> Result<(Self, Vec<u8>), EnvironmentStoreError> {\n-        let settings = replacement.into_settings();\n         let settings = inline_dense_dockerfile(settings, dockerfile_base_dir)?;\n         let persisted = environment_settings_to_layer(&settings);\n         let bytes = canonical_bytes(&persisted).into_bytes();\n         let revision = EnvironmentRevision::from_bytes(&bytes);\n-        let environment = Self::from_validated_settings(id, revision, settings);\n-        Ok((environment, bytes))\n+        Ok((\n+            Self {\n+                id,\n+                revision,\n+                settings,\n+            },\n+            bytes,\n+        ))\n     }\n \n     pub(crate) fn to_layer(&self) -> EnvironmentLayer {\n-        environment_settings_to_layer(&self.settings())\n-    }\n-\n-    #[must_use]\n-    pub fn settings(&self) -> EnvironmentSettings {\n-        EnvironmentSettings {\n-            provider:  self.provider,\n-            image:     self.image.clone(),\n-            resources: self.resources.clone(),\n-            network:   self.network.clone(),\n-            lifecycle: self.lifecycle.clone(),\n-            labels:    self.labels.clone(),\n-            volumes:   self.volumes.clone(),\n-            env:       self.env.clone(),\n-        }\n-    }\n-\n-    pub fn to_toml_string(&self) -> String {\n-        canonical_bytes(&self.to_layer())\n-    }\n-\n-    fn from_persisted(\n-        id: EnvironmentId,\n-        revision: EnvironmentRevision,\n-        mut persisted: EnvironmentLayer,\n-        dockerfile_base_dir: Option<&Path>,\n-    ) -> Result<Self, EnvironmentValidationError> {\n-        if let Some(base_dir) = dockerfile_base_dir {\n-            inline_layer_dockerfile_paths(&mut persisted, base_dir)?;\n-        }\n-        let settings = resolve_environment(&persisted)?;\n-        Ok(Self::from_validated_settings(id, revision, settings))\n-    }\n-\n-    fn from_validated_settings(\n-        id: EnvironmentId,\n-        revision: EnvironmentRevision,\n-        settings: EnvironmentSettings,\n-    ) -> Self {\n-        Self {\n-            id,\n-            revision,\n-            provider: settings.provider,\n-            image: settings.image,\n-            resources: settings.resources,\n-            network: settings.network,\n-            lifecycle: settings.lifecycle,\n-            labels: settings.labels,\n-            volumes: settings.volumes,\n-            env: settings.env,\n-        }\n+        environment_settings_to_layer(&self.settings)\n     }\n }\n \n #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]\n-#[serde(deny_unknown_fields)]\n pub struct EnvironmentDraft {\n-    pub id:        EnvironmentId,\n-    pub provider:  EnvironmentProvider,\n-    pub image:     EnvironmentImageSettings,\n-    pub resources: EnvironmentResourcesSettings,\n-    pub network:   EnvironmentNetworkSettings,\n-    pub lifecycle: EnvironmentLifecycleSettings,\n-    pub labels:    std::collections::HashMap<String, String>,\n-    pub volumes:   Vec<EnvironmentVolumeSettings>,\n-    pub env:       std::collections::HashMap<String, InterpString>,\n-}\n-\n-impl From<EnvironmentDraft> for (EnvironmentId, EnvironmentReplace) {\n-    fn from(value: EnvironmentDraft) -> Self {\n-        (value.id, EnvironmentReplace {\n-            provider:  value.provider,\n-            image:     value.image,\n-            resources: value.resources,\n-            network:   value.network,\n-            lifecycle: value.lifecycle,\n-            labels:    value.labels,\n-            volumes:   value.volumes,\n-            env:       value.env,\n-        })\n-    }\n-}\n-\n-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]\n-#[serde(deny_unknown_fields)]\n-pub struct EnvironmentReplace {\n-    pub provider:  EnvironmentProvider,\n-    pub image:     EnvironmentImageSettings,\n-    pub resources: EnvironmentResourcesSettings,\n-    pub network:   EnvironmentNetworkSettings,\n-    pub lifecycle: EnvironmentLifecycleSettings,\n-    pub labels:    std::collections::HashMap<String, String>,\n-    pub volumes:   Vec<EnvironmentVolumeSettings>,\n-    pub env:       std::collections::HashMap<String, InterpString>,\n-}\n-\n-impl EnvironmentReplace {\n-    #[must_use]\n-    pub fn from_settings(settings: EnvironmentSettings) -> Self {\n-        Self {\n-            provider:  settings.provider,\n-            image:     settings.image,\n-            resources: settings.resources,\n-            network:   settings.network,\n-            lifecycle: settings.lifecycle,\n-            labels:    settings.labels,\n-            volumes:   settings.volumes,\n-            env:       settings.env,\n-        }\n-    }\n-\n-    fn into_settings(self) -> EnvironmentSettings {\n-        EnvironmentSettings {\n-            provider:  self.provider,\n-            image:     self.image,\n-            resources: self.resources,\n-            network:   self.network,\n-            lifecycle: self.lifecycle,\n-            labels:    self.labels,\n-            volumes:   self.volumes,\n-            env:       self.env,\n-        }\n-    }\n+    pub id:       EnvironmentId,\n+    #[serde(flatten)]\n+    pub settings: EnvironmentSettings,\n }\n \n pub(crate) fn canonical_bytes(layer: &EnvironmentLayer) -> String {\n@@ -219,18 +100,10 @@ pub(crate) fn canonical_bytes(layer: &EnvironmentLayer) -> String {\n     doc.to_string()\n }\n \n-fn parse_persisted(\n-    bytes: &[u8],\n-    path: Option<PathBuf>,\n-) -> Result<EnvironmentLayer, EnvironmentStoreError> {\n-    let content = std::str::from_utf8(bytes).map_err(|err| match &path {\n-        Some(path) => EnvironmentStoreError::invalid_utf8(path.clone(), err),\n-        None => EnvironmentStoreError::invalid_utf8(\"<memory>\", err),\n-    })?;\n-    toml::from_str(content).map_err(|err| match path {\n-        Some(path) => EnvironmentStoreError::parse(path, err),\n-        None => EnvironmentStoreError::parse(\"<memory>\", err),\n-    })\n+fn parse_persisted(bytes: &[u8], path: &Path) -> Result<EnvironmentLayer, EnvironmentStoreError> {\n+    let content = std::str::from_utf8(bytes)\n+        .map_err(|err| EnvironmentStoreError::invalid_utf8(path.to_path_buf(), err))?;\n+    toml::from_str(content).map_err(|err| EnvironmentStoreError::parse(path.to_path_buf(), err))\n }\n \n fn resolve_environment(\n@@ -243,6 +116,10 @@ fn resolve_environment(\n     })\n }\n \n+#[expect(\n+    clippy::disallowed_methods,\n+    reason = \"Dockerfile inlining runs during synchronous startup load before request handling.\"\n+)]\n fn inline_layer_dockerfile_paths(\n     layer: &mut EnvironmentLayer,\n     base_dir: &Path,\n@@ -253,16 +130,21 @@ fn inline_layer_dockerfile_paths(\n     let Some(EnvironmentDockerfileLayer::Path { path }) = image.dockerfile.as_ref() else {\n         return Ok(());\n     };\n-    let path = resolve_path(base_dir, path);\n-    let content =\n-        std::fs::read_to_string(&path).map_err(|source| EnvironmentValidationError::DockerfileRead {\n+    let path = base_dir.join(path);\n+    let content = std::fs::read_to_string(&path).map_err(|source| {\n+        EnvironmentValidationError::DockerfileRead {\n             path: path.clone(),\n             source,\n-        })?;\n+        }\n+    })?;\n     image.dockerfile = Some(EnvironmentDockerfileLayer::Inline(content));\n     Ok(())\n }\n \n+#[expect(\n+    clippy::disallowed_methods,\n+    reason = \"Dockerfile inlining for API create/replace happens on a Tokio worker thread via spawn_blocking elsewhere; this function is only invoked from synchronous paths.\"\n+)]\n fn inline_dense_dockerfile(\n     mut settings: EnvironmentSettings,\n     base_dir: &Path,\n@@ -270,25 +152,17 @@ fn inline_dense_dockerfile(\n     let Some(DockerfileSource::Path { path }) = settings.image.dockerfile.as_ref() else {\n         return Ok(settings);\n     };\n-    let path = resolve_path(base_dir, path);\n-    let content =\n-        std::fs::read_to_string(&path).map_err(|source| EnvironmentValidationError::DockerfileRead {\n+    let path = base_dir.join(path);\n+    let content = std::fs::read_to_string(&path).map_err(|source| {\n+        EnvironmentValidationError::DockerfileRead {\n             path: path.clone(),\n             source,\n-        })?;\n+        }\n+    })?;\n     settings.image.dockerfile = Some(DockerfileSource::Inline(content));\n     Ok(settings)\n }\n \n-fn resolve_path(base_dir: &Path, path: &str) -> PathBuf {\n-    let path = Path::new(path);\n-    if path.is_absolute() {\n-        path.to_path_buf()\n-    } else {\n-        base_dir.join(path)\n-    }\n-}\n-\n fn environment_settings_to_layer(settings: &EnvironmentSettings) -> EnvironmentLayer {\n     EnvironmentLayer {\n         provider:  Some(settings.provider.to_string()),\n@@ -302,9 +176,7 @@ fn environment_settings_to_layer(settings: &EnvironmentSettings) -> EnvironmentL\n     }\n }\n \n-fn image_settings_to_layer(\n-    settings: &EnvironmentImageSettings,\n-) -> Option<EnvironmentImageLayer> {\n+fn image_settings_to_layer(settings: &EnvironmentImageSettings) -> Option<EnvironmentImageLayer> {\n     if settings.docker.is_none() && settings.dockerfile.is_none() {\n         return None;\n     }\n@@ -435,8 +307,8 @@ fn append_string_map(root: &mut Table, name: &str, map: &StickyMap<String>) {\n         return;\n     }\n     let table = ensure_table(root, &[name]);\n-    for (key, value) in sorted_map(map) {\n-        table[key] = self::value(value.as_str());\n+    for (key, entry) in sorted_map(map) {\n+        table[key] = value(entry.as_str());\n     }\n }\n \n@@ -445,8 +317,8 @@ fn append_interp_map(root: &mut Table, name: &str, map: &StickyMap<InterpString>\n         return;\n     }\n     let table = ensure_table(root, &[name]);\n-    for (key, value) in sorted_map(map) {\n-        table[key] = self::value(value.as_source());\n+    for (key, entry) in sorted_map(map) {\n+        table[key] = value(entry.as_source());\n     }\n }\n \n@@ -470,7 +342,7 @@ fn append_volumes(root: &mut Table, volumes: &[EnvironmentVolumeLayer]) {\n fn ensure_table<'a>(root: &'a mut Table, path: &[&str]) -> &'a mut Table {\n     let mut current = root;\n     for key in path {\n-        if !current.contains_key(*key) {\n+        if !current.contains_key(key) {\n             current[*key] = Item::Table(Table::new());\n         }\n         current = current[*key]\n@@ -480,10 +352,6 @@ fn ensure_table<'a>(root: &'a mut Table, path: &[&str]) -> &'a mut Table {\n     current\n }\n \n-fn value(value: impl Into<Value>) -> Item {\n-    Item::Value(value.into())\n-}\n-\n fn string_array(values: &[String]) -> Item {\n     let mut array = Array::new();\n     for value in values {\ndiff --git a/lib/crates/fabro-environment/src/store.rs b/lib/crates/fabro-environment/src/store.rs\nindex a2677af93..aabdd86ae 100644\n--- a/lib/crates/fabro-environment/src/store.rs\n+++ b/lib/crates/fabro-environment/src/store.rs\n@@ -1,16 +1,17 @@\n use std::collections::HashMap;\n use std::io::ErrorKind;\n use std::path::{Path, PathBuf};\n+use std::sync::Arc;\n use std::time::{SystemTime, UNIX_EPOCH};\n \n use fabro_config::{EnvironmentLayer, MergeMap};\n+use fabro_types::settings::run::EnvironmentSettings;\n use tokio::fs;\n use tokio::io::AsyncWriteExt as _;\n use tokio::sync::Mutex;\n \n use crate::{\n-    Environment, EnvironmentDraft, EnvironmentId, EnvironmentReplace, EnvironmentRevision,\n-    EnvironmentStoreError,\n+    Environment, EnvironmentDraft, EnvironmentId, EnvironmentRevision, EnvironmentStoreError,\n };\n \n const SEEDS: &[(&str, &str)] = &[\n@@ -59,7 +60,37 @@ pub struct EnvironmentStore {\n     dir:              PathBuf,\n     request_base_dir: PathBuf,\n     mutations:        Mutex<()>,\n-    environments:     std::sync::RwLock<HashMap<EnvironmentId, Environment>>,\n+    state:            std::sync::RwLock<CatalogState>,\n+}\n+\n+#[derive(Debug, Clone)]\n+struct CatalogState {\n+    environments: HashMap<EnvironmentId, Environment>,\n+    catalog:      Arc<MergeMap<EnvironmentLayer>>,\n+}\n+\n+impl CatalogState {\n+    fn new(environments: HashMap<EnvironmentId, Environment>) -> Self {\n+        let catalog = Arc::new(build_catalog_layer(&environments));\n+        Self {\n+            environments,\n+            catalog,\n+        }\n+    }\n+\n+    fn refresh_catalog(&mut self) {\n+        self.catalog = Arc::new(build_catalog_layer(&self.environments));\n+    }\n+}\n+\n+fn build_catalog_layer(\n+    environments: &HashMap<EnvironmentId, Environment>,\n+) -> MergeMap<EnvironmentLayer> {\n+    let catalog: HashMap<String, EnvironmentLayer> = environments\n+        .iter()\n+        .map(|(id, environment)| (id.to_string(), environment.to_layer()))\n+        .collect();\n+    MergeMap::from(catalog)\n }\n \n impl EnvironmentStore {\n@@ -70,50 +101,43 @@ impl EnvironmentStore {\n         let dir = dir.into();\n         seed_missing_environments(&dir)?;\n         let environments = load_environments(&dir)?;\n-        let request_base_dir = dir\n-            .parent()\n-            .unwrap_or_else(|| Path::new(\".\"))\n-            .to_path_buf();\n+        let request_base_dir = dir.parent().unwrap_or_else(|| Path::new(\".\")).to_path_buf();\n         Ok(Self {\n             dir,\n             request_base_dir,\n             mutations: Mutex::new(()),\n-            environments: std::sync::RwLock::new(environments),\n+            state: std::sync::RwLock::new(CatalogState::new(environments)),\n         })\n     }\n \n-    pub async fn list(&self) -> Vec<Environment> {\n-        let environments = self\n-            .environments\n-            .read()\n-            .expect(\"environment store read lock poisoned\");\n-        let mut values = environments.values().cloned().collect::<Vec<_>>();\n+    fn read_state(&self) -> std::sync::RwLockReadGuard<'_, CatalogState> {\n+        self.state.read().expect(\"environment store lock poisoned\")\n+    }\n+\n+    fn write_state(&self) -> std::sync::RwLockWriteGuard<'_, CatalogState> {\n+        self.state.write().expect(\"environment store lock poisoned\")\n+    }\n+\n+    pub fn list(&self) -> Vec<Environment> {\n+        let state = self.read_state();\n+        let mut values = state.environments.values().cloned().collect::<Vec<_>>();\n         values.sort_by(|left, right| left.id.cmp(&right.id));\n         values\n     }\n \n-    pub async fn get(&self, id: &EnvironmentId) -> Option<Environment> {\n-        self.environments\n-            .read()\n-            .expect(\"environment store read lock poisoned\")\n-            .get(id)\n-            .cloned()\n+    pub fn get(&self, id: &EnvironmentId) -> Option<Environment> {\n+        self.read_state().environments.get(id).cloned()\n     }\n \n     pub async fn create(\n         &self,\n         draft: EnvironmentDraft,\n     ) -> Result<Environment, EnvironmentStoreError> {\n-        let (id, replace) = draft.into();\n+        let EnvironmentDraft { id, settings } = draft;\n         let (environment, bytes) =\n-            Environment::from_replace(id.clone(), replace, &self.request_base_dir)?;\n+            Environment::from_settings(id.clone(), settings, &self.request_base_dir)?;\n         let _mutation = self.mutations.lock().await;\n-        if self\n-            .environments\n-            .read()\n-            .expect(\"environment store read lock poisoned\")\n-            .contains_key(&id)\n-        {\n+        if self.read_state().environments.contains_key(&id) {\n             return Err(EnvironmentStoreError::AlreadyExists { id });\n         }\n \n@@ -122,11 +146,9 @@ impl EnvironmentStore {\n             .await\n             .map_err(|err| create_error_for(id.clone(), err))?;\n \n-        let mut environments = self\n-            .environments\n-            .write()\n-            .expect(\"environment store write lock poisoned\");\n-        environments.insert(id, environment.clone());\n+        let mut state = self.write_state();\n+        state.environments.insert(id, environment.clone());\n+        state.refresh_catalog();\n         Ok(environment)\n     }\n \n@@ -134,34 +156,17 @@ impl EnvironmentStore {\n         &self,\n         id: &EnvironmentId,\n         expected: &EnvironmentRevision,\n-        draft: EnvironmentReplace,\n+        settings: EnvironmentSettings,\n     ) -> Result<Environment, EnvironmentStoreError> {\n         let (environment, bytes) =\n-            Environment::from_replace(id.clone(), draft, &self.request_base_dir)?;\n+            Environment::from_settings(id.clone(), settings, &self.request_base_dir)?;\n         let _mutation = self.mutations.lock().await;\n-        {\n-            let environments = self\n-                .environments\n-                .read()\n-                .expect(\"environment store read lock poisoned\");\n-            let current = environments\n-                .get(id)\n-                .ok_or_else(|| EnvironmentStoreError::NotFound { id: id.clone() })?;\n-            if &current.revision != expected {\n-                return Err(EnvironmentStoreError::StaleRevision {\n-                    id:       id.clone(),\n-                    expected: expected.clone(),\n-                    actual:   current.revision.clone(),\n-                });\n-            }\n-        }\n+        check_revision(&self.read_state().environments, id, expected)?;\n \n         write_atomic(&self.dir, &environment_path(&self.dir, id), &bytes).await?;\n-        let mut environments = self\n-            .environments\n-            .write()\n-            .expect(\"environment store write lock poisoned\");\n-        environments.insert(id.clone(), environment.clone());\n+        let mut state = self.write_state();\n+        state.environments.insert(id.clone(), environment.clone());\n+        state.refresh_catalog();\n         Ok(environment)\n     }\n \n@@ -175,50 +180,44 @@ impl EnvironmentStore {\n         }\n \n         let _mutation = self.mutations.lock().await;\n-        {\n-            let environments = self\n-                .environments\n-                .read()\n-                .expect(\"environment store read lock poisoned\");\n-            let current = environments\n-                .get(id)\n-                .ok_or_else(|| EnvironmentStoreError::NotFound { id: id.clone() })?;\n-            if &current.revision != expected {\n-                return Err(EnvironmentStoreError::StaleRevision {\n-                    id:       id.clone(),\n-                    expected: expected.clone(),\n-                    actual:   current.revision.clone(),\n-                });\n-            }\n-        }\n+        check_revision(&self.read_state().environments, id, expected)?;\n \n         let path = environment_path(&self.dir, id);\n         fs::remove_file(&path)\n             .await\n             .map_err(|err| EnvironmentStoreError::io(path, err))?;\n-        let mut environments = self\n-            .environments\n-            .write()\n-            .expect(\"environment store write lock poisoned\");\n-        environments.remove(id);\n+        let mut state = self.write_state();\n+        state.environments.remove(id);\n+        state.refresh_catalog();\n         Ok(())\n     }\n \n-    pub fn catalog_layer(&self) -> MergeMap<EnvironmentLayer> {\n-        let environments = self\n-            .environments\n-            .read()\n-            .expect(\"environment store read lock poisoned\");\n-        let catalog: HashMap<String, EnvironmentLayer> = environments\n-            .iter()\n-            .map(|(id, environment)| (id.to_string(), environment.to_layer()))\n-            .collect();\n-        MergeMap::from(catalog)\n+    pub fn catalog_layer(&self) -> Arc<MergeMap<EnvironmentLayer>> {\n+        Arc::clone(&self.read_state().catalog)\n+    }\n+}\n+\n+fn check_revision(\n+    environments: &HashMap<EnvironmentId, Environment>,\n+    id: &EnvironmentId,\n+    expected: &EnvironmentRevision,\n+) -> Result<(), EnvironmentStoreError> {\n+    let current = environments\n+        .get(id)\n+        .ok_or_else(|| EnvironmentStoreError::NotFound { id: id.clone() })?;\n+    if &current.revision != expected {\n+        return Err(EnvironmentStoreError::StaleRevision {\n+            id:       id.clone(),\n+            expected: expected.clone(),\n+            actual:   current.revision.clone(),\n+        });\n     }\n+    Ok(())\n }\n \n #[expect(\n     clippy::disallowed_methods,\n+    clippy::disallowed_types,\n     reason = \"Environment directory seeding runs synchronously during startup before request handling.\"\n )]\n fn seed_missing_environments(dir: &Path) -> Result<(), EnvironmentStoreError> {\n@@ -337,29 +336,18 @@ async fn write_new(dir: &Path, path: &Path, bytes: &[u8]) -> Result<(), Environm\n     fs::create_dir_all(dir)\n         .await\n         .map_err(|err| EnvironmentStoreError::io(dir, err))?;\n-    let temp_path = temp_path_for(path);\n     let mut file = fs::OpenOptions::new()\n         .write(true)\n         .create_new(true)\n-        .open(&temp_path)\n+        .open(path)\n         .await\n-        .map_err(|err| EnvironmentStoreError::io(&temp_path, err))?;\n-\n-    if let Err(err) = file.write_all(bytes).await {\n-        cleanup_temp(&temp_path).await;\n-        return Err(EnvironmentStoreError::io(&temp_path, err));\n-    }\n-    if let Err(err) = file.sync_all().await {\n-        cleanup_temp(&temp_path).await;\n-        return Err(EnvironmentStoreError::io(&temp_path, err));\n-    }\n-    drop(file);\n-\n-    if let Err(err) = fs::hard_link(&temp_path, path).await {\n-        cleanup_temp(&temp_path).await;\n-        return Err(EnvironmentStoreError::io(path, err));\n-    }\n-    cleanup_temp(&temp_path).await;\n+        .map_err(|err| EnvironmentStoreError::io(path, err))?;\n+    file.write_all(bytes)\n+        .await\n+        .map_err(|err| EnvironmentStoreError::io(path, err))?;\n+    file.sync_all()\n+        .await\n+        .map_err(|err| EnvironmentStoreError::io(path, err))?;\n     Ok(())\n }\n \n@@ -393,6 +381,10 @@ fn environment_path(dir: &Path, id: &EnvironmentId) -> PathBuf {\n }\n \n #[cfg(test)]\n+#[expect(\n+    clippy::disallowed_methods,\n+    reason = \"Unit tests for sync startup helpers use sync std::fs to set up fixtures.\"\n+)]\n mod tests {\n     use std::collections::HashMap;\n \n@@ -405,8 +397,8 @@ mod tests {\n     use tokio::fs;\n \n     use crate::{\n-        EnvironmentDraft, EnvironmentId, EnvironmentReplace, EnvironmentRevision,\n-        EnvironmentStore, EnvironmentStoreError,\n+        EnvironmentDraft, EnvironmentId, EnvironmentRevision, EnvironmentStore,\n+        EnvironmentStoreError,\n     };\n \n     fn settings(provider: EnvironmentProvider) -> EnvironmentSettings {\n@@ -422,22 +414,10 @@ mod tests {\n         }\n     }\n \n-    fn replacement(provider: EnvironmentProvider) -> EnvironmentReplace {\n-        EnvironmentReplace::from_settings(settings(provider))\n-    }\n-\n     fn draft(id: &str, provider: EnvironmentProvider) -> EnvironmentDraft {\n-        let settings = settings(provider);\n         EnvironmentDraft {\n-            id:        EnvironmentId::new(id).unwrap(),\n-            provider:  settings.provider,\n-            image:     settings.image,\n-            resources: settings.resources,\n-            network:   settings.network,\n-            lifecycle: settings.lifecycle,\n-            labels:    settings.labels,\n-            volumes:   settings.volumes,\n-            env:       settings.env,\n+            id:       EnvironmentId::new(id).unwrap(),\n+            settings: settings(provider),\n         }\n     }\n \n@@ -447,7 +427,7 @@ mod tests {\n         let environment_dir = dir.path().join(\"environments\");\n \n         let store = EnvironmentStore::load_or_seed(&environment_dir).unwrap();\n-        let environments = store.list().await;\n+        let environments = store.list();\n \n         assert_eq!(\n             environments\n@@ -478,7 +458,6 @@ mod tests {\n         assert_eq!(\n             store\n                 .list()\n-                .await\n                 .iter()\n                 .map(|environment| environment.id.as_str())\n                 .collect::<Vec<_>>(),\n@@ -530,7 +509,10 @@ mode = \"cidr_allow_list\"\n         let err = EnvironmentStore::load_or_seed(&environment_dir).unwrap_err();\n \n         assert!(matches!(err, EnvironmentStoreError::Validation { .. }));\n-        assert!(err.to_string().contains(\"docker environments cannot enforce\"));\n+        assert!(\n+            err.to_string()\n+                .contains(\"docker environments cannot enforce\")\n+        );\n     }\n \n     #[test]\n@@ -572,18 +554,11 @@ path = \"Dockerfile\"\n     async fn replace_stale_revision_is_rejected() {\n         let dir = tempfile::tempdir().unwrap();\n         let store = EnvironmentStore::load_or_seed(dir.path().join(\"environments\")).unwrap();\n-        let current = store\n-            .get(&EnvironmentId::new(\"local\").unwrap())\n-            .await\n-            .unwrap();\n+        let current = store.get(&EnvironmentId::new(\"local\").unwrap()).unwrap();\n         let stale = EnvironmentRevision::from_bytes(b\"stale\");\n \n         let err = store\n-            .replace(\n-                &current.id,\n-                &stale,\n-                replacement(EnvironmentProvider::Docker),\n-            )\n+            .replace(&current.id, &stale, settings(EnvironmentProvider::Docker))\n             .await\n             .unwrap_err();\n \n@@ -594,12 +569,12 @@ path = \"Dockerfile\"\n     async fn default_delete_is_rejected() {\n         let dir = tempfile::tempdir().unwrap();\n         let store = EnvironmentStore::load_or_seed(dir.path().join(\"environments\")).unwrap();\n-        let default = store\n-            .get(&EnvironmentId::new(\"default\").unwrap())\n-            .await\n-            .unwrap();\n+        let default = store.get(&EnvironmentId::new(\"default\").unwrap()).unwrap();\n \n-        let err = store.delete(&default.id, &default.revision).await.unwrap_err();\n+        let err = store\n+            .delete(&default.id, &default.revision)\n+            .await\n+            .unwrap_err();\n \n         assert!(matches!(err, EnvironmentStoreError::Protected { .. }));\n     }\n@@ -616,7 +591,7 @@ path = \"Dockerfile\"\n \n         store.delete(&created.id, &created.revision).await.unwrap();\n \n-        assert!(store.get(&created.id).await.is_none());\n+        assert!(store.get(&created.id).is_none());\n         assert!(!environment_dir.join(\"tmp.toml\").exists());\n     }\n \n@@ -635,11 +610,7 @@ path = \"Dockerfile\"\n         );\n \n         let replaced = store\n-            .replace(\n-                &created.id,\n-                &created.revision,\n-                EnvironmentReplace::from_settings(next),\n-            )\n+            .replace(&created.id, &created.revision, next)\n             .await\n             .unwrap();\n \n@@ -658,28 +629,18 @@ path = \"Dockerfile\"\n             path: \"Dockerfile\".to_string(),\n         });\n         let draft = EnvironmentDraft {\n-            id:        EnvironmentId::new(\"with-dockerfile\").unwrap(),\n-            provider:  settings.provider,\n-            image:     settings.image,\n-            resources: settings.resources,\n-            network:   settings.network,\n-            lifecycle: settings.lifecycle,\n-            labels:    settings.labels,\n-            volumes:   settings.volumes,\n-            env:       settings.env,\n+            id: EnvironmentId::new(\"with-dockerfile\").unwrap(),\n+            settings,\n         };\n \n         let created = store.create(draft).await.unwrap();\n-        let persisted = fs::read_to_string(\n-            dir.path()\n-                .join(\"environments\")\n-                .join(\"with-dockerfile.toml\"),\n-        )\n-        .await\n-        .unwrap();\n+        let persisted =\n+            fs::read_to_string(dir.path().join(\"environments\").join(\"with-dockerfile.toml\"))\n+                .await\n+                .unwrap();\n \n         assert_eq!(\n-            created.image.dockerfile,\n+            created.settings.image.dockerfile,\n             Some(DockerfileSource::Inline(\"FROM alpine\\n\".to_string()))\n         );\n         assert!(persisted.contains(\"FROM alpine\"));\ndiff --git a/lib/crates/fabro-server/src/run_manifest.rs b/lib/crates/fabro-server/src/run_manifest.rs\nindex 864f3ee57..3a6f38f24 100644\n--- a/lib/crates/fabro-server/src/run_manifest.rs\n+++ b/lib/crates/fabro-server/src/run_manifest.rs\n@@ -7,12 +7,12 @@ use std::time::Duration;\n use anyhow::{Context as _, Result, anyhow, bail};\n use fabro_api::types;\n use fabro_auth::auth_issue_message;\n+use fabro_config::parse::{self, SettingsSource};\n use fabro_config::{\n     CliLayer, CliOutputLayer, EnvironmentDockerfileLayer, EnvironmentImageLayer, EnvironmentLayer,\n     MergeMap, RunLayer, SettingsLayer, WorkflowSettingsBuilder, parse_input_overrides,\n     parse_labels,\n };\n-use fabro_config::parse::{self, SettingsSource};\n use fabro_graphviz::graph::{Graph, is_llm_handler_type};\n use fabro_graphviz::render::apply_direction;\n use fabro_llm::model_test::{ModelTestStatus, run_basic_model_probe};\n@@ -2534,6 +2534,7 @@ digraph Demo {\n         //! unknown fields anywhere in the document trip\n         //! `deny_unknown_fields`.\n \n+        use fabro_config::parse::SettingsSource;\n         use fabro_types::ManifestPath;\n         use fabro_workflow::workflow_bundle::{BundledWorkflow, ParsedWorkflowConfig};\n \n@@ -2566,6 +2567,7 @@ issues = \"read\"\n                 &workflow.config.as_ref().unwrap().source,\n                 &workflow.config.as_ref().unwrap().path,\n                 &workflow.files,\n+                SettingsSource::Workflow,\n             )\n             .expect(\"workflow.toml should parse\");\n             let run = layer.run.expect(\"run layer should be present\");\n@@ -2596,6 +2598,7 @@ issues = \"read\"\n                 &workflow.config.as_ref().unwrap().source,\n                 &workflow.config.as_ref().unwrap().path,\n                 &workflow.files,\n+                SettingsSource::Workflow,\n             )\n             .expect_err(\"stale [server.integrations.github.permissions] should be rejected\");\n             let message = format!(\"{err:#}\");\n@@ -2622,6 +2625,7 @@ contents = \"read\"\n                 &workflow.config.as_ref().unwrap().source,\n                 &workflow.config.as_ref().unwrap().path,\n                 &workflow.files,\n+                SettingsSource::Workflow,\n             )\n             .expect(\"workflow + run blocks should parse\");\n             let run = layer.run.expect(\"run layer should be present\");\ndiff --git a/lib/crates/fabro-server/src/serve.rs b/lib/crates/fabro-server/src/serve.rs\nindex 240b13b1d..d0be79118 100644\n--- a/lib/crates/fabro-server/src/serve.rs\n+++ b/lib/crates/fabro-server/src/serve.rs\n@@ -690,7 +690,6 @@ where\n     let resolved_app_settings = ResolvedAppStateSettings {\n         server_settings:       runtime_settings.server_settings,\n         manifest_run_defaults: runtime_settings.manifest_run_defaults,\n-        manifest_run_settings: runtime_settings.manifest_run_settings,\n         llm_catalog_settings:  runtime_settings.llm_catalog_settings,\n     };\n     let resolved_server_settings = resolved_app_settings.server_settings.server.clone();\n@@ -851,7 +850,6 @@ where\n                             ResolvedAppStateSettings {\n                                 server_settings:       resolved.server_settings,\n                                 manifest_run_defaults: resolved.manifest_run_defaults,\n-                                manifest_run_settings: resolved.manifest_run_settings,\n                                 llm_catalog_settings:  resolved.llm_catalog_settings,\n                             }\n                         });\n@@ -1177,8 +1175,8 @@ mod tests {\n     use std::task::Poll;\n     use std::time::Duration;\n \n+    use fabro_config::ServerSettingsBuilder;\n     use fabro_config::bind::{Bind, BindRequest};\n-    use fabro_config::{RunSettingsBuilder, ServerSettingsBuilder};\n     use fabro_types::ServerSettings;\n     use fabro_types::settings::interp::InterpString;\n     use fabro_types::settings::server::{LogDestination, ObjectStoreSettings};\n@@ -1238,13 +1236,10 @@ mod tests {\n     }\n \n     fn resolved_runtime_settings(source: &str) -> ResolvedAppStateSettings {\n-        let manifest_run_defaults = manifest_run_defaults(source);\n         ResolvedAppStateSettings {\n-            manifest_run_settings: RunSettingsBuilder::from_run_layer(&manifest_run_defaults)\n-                .map_err(|err| fabro_util::error::SharedError::new(anyhow::Error::new(err))),\n-            manifest_run_defaults,\n-            server_settings: server_settings(source),\n-            llm_catalog_settings: fabro_model::catalog::LlmCatalogSettings::default(),\n+            manifest_run_defaults: manifest_run_defaults(source),\n+            server_settings:       server_settings(source),\n+            llm_catalog_settings:  fabro_model::catalog::LlmCatalogSettings::default(),\n         }\n     }\n \ndiff --git a/lib/crates/fabro-server/src/server.rs b/lib/crates/fabro-server/src/server.rs\nindex 7709d2c34..e79239836 100644\n--- a/lib/crates/fabro-server/src/server.rs\n+++ b/lib/crates/fabro-server/src/server.rs\n@@ -1241,10 +1241,9 @@ pub(crate) struct AppStateConfig {\n \n #[derive(Clone)]\n pub(crate) struct ResolvedAppStateSettings {\n-    pub(crate) server_settings:               ServerSettings,\n-    pub(crate) manifest_run_defaults:         RunLayer,\n-    pub(crate) manifest_run_settings:         std::result::Result<RunNamespace, SharedError>,\n-    pub(crate) llm_catalog_settings:          LlmCatalogSettings,\n+    pub(crate) server_settings:       ServerSettings,\n+    pub(crate) manifest_run_defaults: RunLayer,\n+    pub(crate) llm_catalog_settings:  LlmCatalogSettings,\n }\n \n fn accumulate_billing_rollup(\n@@ -1535,7 +1534,6 @@ impl AppState {\n         let ResolvedAppStateSettings {\n             server_settings,\n             manifest_run_defaults,\n-            manifest_run_settings: _,\n             llm_catalog_settings,\n         } = resolved_settings;\n         let server_settings = Arc::new(server_settings);\n@@ -2157,7 +2155,7 @@ fn resolve_manifest_run_settings_with_catalog(\n     WorkflowSettingsBuilder::new()\n         .server_manifest_defaults(\n             manifest_run_defaults.clone(),\n-            environment_store.catalog_layer(),\n+            (*environment_store.catalog_layer()).clone(),\n         )\n         .build()\n         .map(|settings| settings.run)\ndiff --git a/lib/crates/fabro-server/src/server/handler/graph.rs b/lib/crates/fabro-server/src/server/handler/graph.rs\nindex 579ada98a..2681b20d6 100644\n--- a/lib/crates/fabro-server/src/server/handler/graph.rs\n+++ b/lib/crates/fabro-server/src/server/handler/graph.rs\n@@ -44,7 +44,7 @@ async fn render_graph_from_manifest(\n     let manifest_environment_defaults = state.environment_store().catalog_layer();\n     let prepared = match run_manifest::prepare_manifest_with_environment_defaults(\n         manifest_run_defaults.as_ref(),\n-        &manifest_environment_defaults,\n+        manifest_environment_defaults.as_ref(),\n         &req.manifest,\n     ) {\n         Ok(prepared) => prepared,\ndiff --git a/lib/crates/fabro-server/src/server/handler/runs.rs b/lib/crates/fabro-server/src/server/handler/runs.rs\nindex ba0c19b3f..fca9fdc3c 100644\n--- a/lib/crates/fabro-server/src/server/handler/runs.rs\n+++ b/lib/crates/fabro-server/src/server/handler/runs.rs\n@@ -641,7 +641,7 @@ pub(crate) async fn create_run_from_manifest(\n     let manifest_environment_defaults = state.environment_store().catalog_layer();\n     let mut prepared = match run_manifest::prepare_manifest_with_environment_defaults(\n         manifest_run_defaults.as_ref(),\n-        &manifest_environment_defaults,\n+        manifest_environment_defaults.as_ref(),\n         &manifest,\n     ) {\n         Ok(prepared) => prepared,\n@@ -905,7 +905,7 @@ async fn run_preflight(\n     let manifest_environment_defaults = state.environment_store().catalog_layer();\n     let mut prepared = match run_manifest::prepare_manifest_with_environment_defaults(\n         manifest_run_defaults.as_ref(),\n-        &manifest_environment_defaults,\n+        manifest_environment_defaults.as_ref(),\n         &req,\n     ) {\n         Ok(prepared) => prepared,\n@@ -942,7 +942,7 @@ async fn validate_run_manifest(\n     let manifest_environment_defaults = state.environment_store().catalog_layer();\n     let mut prepared = match run_manifest::prepare_manifest_with_environment_defaults(\n         manifest_run_defaults.as_ref(),\n-        &manifest_environment_defaults,\n+        manifest_environment_defaults.as_ref(),\n         &req,\n     ) {\n         Ok(prepared) => prepared,\ndiff --git a/lib/crates/fabro-server/src/test_support.rs b/lib/crates/fabro-server/src/test_support.rs\nindex 06f4df0bd..7e2731809 100644\n--- a/lib/crates/fabro-server/src/test_support.rs\n+++ b/lib/crates/fabro-server/src/test_support.rs\n@@ -13,7 +13,7 @@ use axum::middleware::Next;\n use axum::response::Response;\n use axum::{Router, middleware};\n use chrono::Duration as ChronoDuration;\n-use fabro_config::{RunLayer, RunSettingsBuilder, ServerSettingsBuilder, envfile};\n+use fabro_config::{RunLayer, ServerSettingsBuilder, envfile};\n use fabro_interview::Interviewer;\n use fabro_model::catalog::{LlmCatalogSettings, ProviderCatalogSettings};\n use fabro_sandbox::SandboxProviderRegistry;\n@@ -21,7 +21,6 @@ use fabro_static::EnvVars;\n use fabro_store::{ArtifactStore, Database};\n use fabro_types::settings::ServerAuthMethod;\n use fabro_types::{AuthMethod, IdpIdentity, ServerSettings};\n-use fabro_util::error::SharedError;\n use fabro_vault::{SecretType, Vault};\n use fabro_workflow::handler::HandlerRegistry;\n use object_store::memory::InMemory as MemoryObjectStore;\n@@ -336,10 +335,8 @@ pub(crate) fn resolved_runtime_settings_for_tests(\n     llm_catalog_settings: LlmCatalogSettings,\n ) -> ResolvedAppStateSettings {\n     ResolvedAppStateSettings {\n-        manifest_run_settings: RunSettingsBuilder::from_run_layer(&manifest_run_defaults)\n-            .map_err(|err| SharedError::new(anyhow::Error::new(err))),\n-        manifest_run_defaults,\n         server_settings,\n+        manifest_run_defaults,\n         llm_catalog_settings,\n     }\n }\n",
        "summary": {
          "files_changed": 34,
          "additions": 2169,
          "deletions": 412
        }
      }
    },
    {
      "seq": 2688,
      "checkpoint": {
        "timestamp": "2026-05-28T06:00:21.700056Z",
        "current_node": "simplify_gpt",
        "completed_nodes": [
          "start",
          "toolchain",
          "preflight_compile",
          "preflight_lint",
          "implement",
          "simplify_opus",
          "simplify_gpt"
        ],
        "node_retries": {},
        "context_values": {
          "internal.fidelity": "compact",
          "outcome": "succeeded",
          "thread.preflight_lint.current_node": "implement",
          "internal.thread_id": "simplify_opus",
          "thread.start.current_node": "toolchain",
          "failure_signature": "",
          "failure_class": "",
          "internal.node_visit_count": 1,
          "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126",
          "graph.goal": "# Server-Owned Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Move environment definitions from layered run settings into server-owned TOML resources with CRUD API management, matching the Automation store pattern.\n\n**Architecture:** Add a concrete `EnvironmentStore` that loads one environment TOML file per id from a sibling `environments/` directory next to the active server settings file. Runs continue to select an environment by id through `[run.environment]` or `--environment`, but server-side run creation resolves the id from `EnvironmentStore`; project/workflow/user config can no longer define environment catalogs or environment field overrides. The web UI is intentionally deferred.\n\n**Tech Stack:** Rust, Axum, serde/TOML, `toml_edit`, Tokio file I/O, OpenAPI/progenitor, generated TypeScript API client, cargo-nextest.\n\n---\n\n## File Structure\n\n- Create `lib/crates/fabro-environment/`: environment ids, revisions, API/domain DTOs, TOML persistence, canonicalization, validation, and `EnvironmentStore`.\n- Modify workspace manifests: root `Cargo.toml`, `lib/crates/fabro-server/Cargo.toml`, `lib/crates/fabro-api/build.rs`, and generated API/client package files.\n- Modify `lib/crates/fabro-server/src/server.rs`, `lib/crates/fabro-server/src/server/handler/mod.rs`, and a new `lib/crates/fabro-server/src/server/handler/environments.rs` to wire the store and API.\n- Modify `lib/crates/fabro-config/src/builders.rs`, `lib/crates/fabro-config/src/load.rs`, `lib/crates/fabro-config/src/migrations.rs`, and config tests to treat `[environments]` as migration-only, not runtime configuration.\n- Modify `lib/crates/fabro-manifest/src/lib.rs`, `lib/crates/fabro-server/src/run_manifest.rs`, and CLI run/preflight/graph/validate paths so environment ids are resolved only by the server.\n- Modify install/repo-init/docs/OpenAPI artifacts so new examples use server environment files and run configs only select ids.\n\n## Decisions\n\n- Environment definitions are server-owned operator policy. Project and workflow files may request an id but cannot define or override environment fields.\n- `default`, `local`, `docker`, and `daytona` are seeded if missing. Existing files are never overwritten.\n- `default` is protected from deletion. Other seeded files can be edited or deleted.\n- Environment ids use `[a-z0-9][a-z0-9-]{0,62}`.\n- Environment revisions are SHA-256 hashes of the persisted TOML bytes, returned in JSON as `revision` and in `ETag`.\n- `PUT` and `DELETE` require `If-Match`, following `AutomationStore`.\n- `image.dockerfile = { path = \"Dockerfile\" }` is accepted in persisted files and API input, resolved relative to the environment file or request context, and converted to inline content for runtime use. API writes canonical inline TOML.\n- `--preserve-sandbox` remains a CLI/server argument override. TOML `[run.environment.lifecycle]` is rejected.\n- `--docker-image` is rejected with a targeted message directing operators to create or update a server environment.\n- Existing dense `WorkflowSettings.environments` stays in the API for compatibility and is populated from the server environment catalog during run resolution.\n\n## Task 1: Add `fabro-environment` Store Crate\n\n**Files:**\n- Create: `lib/crates/fabro-environment/Cargo.toml`\n- Create: `lib/crates/fabro-environment/src/lib.rs`\n- Create: `lib/crates/fabro-environment/src/id.rs`\n- Create: `lib/crates/fabro-environment/src/model.rs`\n- Create: `lib/crates/fabro-environment/src/store.rs`\n- Create: `lib/crates/fabro-environment/src/error.rs`\n- Modify: root `Cargo.toml`\n\n- [ ] Create a workspace crate named `fabro-environment`, modeled after `fabro-automation`.\n- [ ] Define `EnvironmentId`, `EnvironmentRevision`, and parse/validation errors.\n- [ ] Define public DTOs:\n  - `Environment`: `id`, `revision`, `provider`, `image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, `env`.\n  - `EnvironmentDraft`: `id` plus environment fields.\n  - `EnvironmentReplace`: environment fields without id.\n- [ ] Use the existing environment field types from `fabro_types::settings::run` for dense API fields.\n- [ ] Use existing sparse `fabro_config::EnvironmentLayer` only for TOML input/output and conversion; do not create a second environment field vocabulary.\n- [ ] Add conversion helpers that resolve an `EnvironmentLayer` into dense `EnvironmentSettings` using the same provider/network/image validation rules as `fabro-config`.\n- [ ] Implement canonical TOML serialization for persisted files. Omit `id` and `revision`; the filename is the id and the file bytes determine revision.\n- [ ] Implement `EnvironmentStore` with `load_or_seed(dir)`, `list`, `get`, `create`, `replace`, `delete`, and `catalog_layer`.\n- [ ] Seed missing `default`, `local`, `docker`, and `daytona` files from the current built-in defaults. Do not overwrite existing files.\n- [ ] Protect `default` from deletion with a typed store error.\n- [ ] Resolve Dockerfile path references relative to the environment file directory during load and relative to the active settings directory during API create/replace. Store runtime values with inline Dockerfile content.\n- [ ] Add unit tests for loading an absent directory, seeding built-ins, sorted listing, invalid ids, invalid provider, invalid network mode, missing Dockerfile path, create conflict, replace stale revision, default delete rejection, delete success, and canonical revision changes.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-environment\n```\n\nExpected: all `fabro-environment` tests pass.\n\n## Task 2: Make Config Environments Migration-Only\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/parse.rs`\n- Modify: `lib/crates/fabro-config/src/builders.rs`\n- Modify: `lib/crates/fabro-config/src/load.rs`\n- Modify: `lib/crates/fabro-config/src/migrations.rs`\n- Create: `lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs`\n- Modify: `lib/crates/fabro-config/src/defaults.toml`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_run.rs`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_root.rs`\n\n- [ ] Keep `SettingsLayer.environments` in this pass so old files can parse and migrate, but remove environment catalog entries from `defaults.toml`.\n- [ ] Add source-aware validation that rejects `SettingsLayer.environments` for project, workflow, and direct run config layers with this message shape: `[environments.<id>] is now server-managed; move this definition to the server environments directory`.\n- [ ] Add validation that rejects TOML-provided `run.environment.image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, and `env`. Keep `run.environment.id`.\n- [ ] Ensure CLI/server argument layers can still set `run.environment.lifecycle.preserve` for `--preserve-sandbox`; the rejection applies only to parsed TOML sources.\n- [ ] Add a settings-file migration that extracts top-level `[environments.<id>]` entries from the active `settings.toml` into sibling `environments/<id>.toml` files.\n- [ ] Migration must write a backup before editing `settings.toml`, preserve `[run.environment] id`, remove the top-level `[environments]` table, and fail without changing files if any target environment file already exists.\n- [ ] Chain the existing legacy `[run.sandbox]` migration before the new extraction migration so legacy sandbox settings become a server `default` environment file.\n- [ ] Update run settings tests to assert that `RunSettingsBuilder` no longer resolves a selected environment without an injected server catalog.\n- [ ] Add tests proving project/workflow `[environments]` definitions produce targeted errors rather than silent ignores.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-config\n```\n\nExpected: config tests pass, including migration coverage.\n\n## Task 3: Wire EnvironmentStore Into Server Run Resolution\n\n**Files:**\n- Modify: `lib/crates/fabro-server/src/server.rs`\n- Modify: `lib/crates/fabro-server/src/serve.rs`\n- Modify: `lib/crates/fabro-server/src/run_manifest.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/runs.rs`\n- Modify: `lib/crates/fabro-server/src/manifest_validation.rs`\n- Modify: `lib/crates/fabro-server/src/test_support.rs`\n\n- [ ] Add `environment_store: Arc<EnvironmentStore>` to `AppState`, loaded from `active_config_path.parent().join(\"environments\")`.\n- [ ] Replace `manifest_environment_defaults` from `ServerRuntimeSettings` with `environment_store.catalog_layer()` when preparing manifests on the server.\n- [ ] Keep the dense run snapshot unchanged: `prepared.settings.run.environment` contains the resolved environment fields, and `prepared.settings.environments` contains the server catalog used for resolution.\n- [ ] Convert unknown environment ids into `400 Bad Request` during run creation/preflight/graph preparation.\n- [ ] Keep sandbox provider policy checks after environment resolution, so disabled providers still reject runs.\n- [ ] Apply `--preserve-sandbox` after selected environment resolution.\n- [ ] Remove server reliance on `[environments]` in `settings.toml`.\n- [ ] Update server test support so tests can inject environment files or use seeded defaults.\n- [ ] Add server tests for default environment run creation, custom server environment selection, unknown environment id, disabled provider policy, `--preserve-sandbox`, and rejected TOML environment field overrides.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server\n```\n\nExpected: server API and run-manifest tests pass.\n\n## Task 4: Add Environment CRUD API\n\n**Files:**\n- Modify: `docs/public/api-reference/fabro-api.yaml`\n- Modify: `lib/crates/fabro-api/build.rs`\n- Create: `lib/crates/fabro-server/src/server/handler/environments.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/mod.rs`\n- Add tests: `lib/crates/fabro-server/tests/it/api/environments.rs`\n- Update generated Rust and TypeScript API artifacts after spec changes.\n\n- [ ] Add OpenAPI tag `Environments`.\n- [ ] Add schemas for `Environment`, `CreateEnvironmentRequest`, `ReplaceEnvironmentRequest`, and `EnvironmentListResponse`.\n- [ ] Reuse existing environment schemas for provider/image/resources/network/lifecycle/volumes/env.\n- [ ] Add endpoints:\n  - `GET /api/v1/environments`\n  - `POST /api/v1/environments`\n  - `GET /api/v1/environments/{id}`\n  - `PUT /api/v1/environments/{id}`\n  - `DELETE /api/v1/environments/{id}`\n- [ ] Return `ETag` on retrieve and replace.\n- [ ] Require `If-Match` on replace and delete.\n- [ ] Map store errors to API responses:\n  - invalid id: `400`\n  - duplicate create: `409`\n  - stale revision: `409`\n  - validation error: `422`\n  - missing resource: `404`\n  - protected default delete: `409`\n  - persistence failure: `500`\n- [ ] Add route tests for empty-seeded list, create, retrieve with ETag, replace, stale replace, missing `If-Match`, delete, protected default delete, invalid provider, invalid CIDR, and missing Dockerfile path.\n- [ ] Regenerate `fabro-api` and TypeScript client artifacts.\n\nRun:\n\n```bash\ncargo build -p fabro-api\ncd lib/packages/fabro-api-client && bun run generate\ncargo nextest run -p fabro-server --test it -- api::environments\n```\n\nExpected: generated artifacts are updated and environment API tests pass.\n\n## Task 5: Adjust CLI And Manifest Behavior\n\n**Files:**\n- Modify: `lib/crates/fabro-cli/src/commands/run/overrides.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/preflight.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/graph.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/validate.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/repo/init.rs`\n- Modify: `lib/crates/fabro-manifest/src/lib.rs`\n- Modify CLI integration tests under `lib/crates/fabro-cli/tests/it/`\n\n- [ ] Reject `--docker-image` in run, create, preflight, graph, and validate commands with this message shape: `--docker-image is no longer supported; create or update a server environment and select it with --environment`.\n- [ ] Keep `--environment` as an id-only selector in manifest args.\n- [ ] Stop collecting Dockerfile path references from `[environments.<id>]` in project/workflow config because those definitions are invalid.\n- [ ] Keep collecting Dockerfile references for any remaining CLI-created run environment override only when it comes from allowed argument paths; with `--docker-image` rejected, no normal user path should add one.\n- [ ] Update local preflight/graph/validate flows so they either call server preflight for environment resolution or print a clear message that server-owned environment resolution requires a running server.\n- [ ] Update `fabro repo init` to write only `[run.environment] id = \"local\"` and no `[environments.local]` block.\n- [ ] Update CLI tests for manifest args, repo init output, rejected `--docker-image`, and server-owned environment selection.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-cli\n```\n\nExpected: CLI tests pass and no generated workflow config contains `[environments.*]`.\n\n## Task 6: Update Install, Docs, And Generated References\n\n**Files:**\n- Modify install persistence code in `lib/crates/fabro-cli/src/commands/install.rs` and server install handlers/tests.\n- Modify docs: `docs/public/execution/environments.mdx`, `docs/public/execution/run-configuration.mdx`, `docs/public/reference/user-configuration.mdx`, `docs/public/administration/server-configuration.mdx`, `docs/public/administration/sandboxing.mdx`, `docs/public/integrations/daytona.mdx`, and examples that currently define `[environments.<id>]`.\n- Modify generated settings reference if applicable.\n\n- [ ] Update install flows to write server environment files instead of `[environments.default]` into `settings.toml`.\n- [ ] Keep install-written `[run.environment] id = \"default\"` when a default run environment selection is still needed.\n- [ ] Update tests that assert `settings.toml` contains `[environments.default]` to assert the sibling environment file exists and settings no longer contains `[environments]`.\n- [ ] Rewrite public docs so environment definitions are server-owned TOML files and run configs only select ids.\n- [ ] Add a compatibility note explaining that project/workflow `[environments]` definitions now fail and must be moved to the server.\n- [ ] Keep `Settings > Environments` UI documentation out of this pass.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server --test it -- api::install\ncargo nextest run -p fabro-cli --test it\n```\n\nExpected: install tests pass and docs no longer present project/workflow environment definitions as valid.\n\n## Task 7: Workspace Verification\n\n**Files:**\n- No new files unless test snapshots require reviewed updates.\n\n- [ ] Run Rust formatting check:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\n```\n\n- [ ] Run clippy:\n\n```bash\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\n- [ ] Run workspace tests:\n\n```bash\ncargo nextest run --workspace\n```\n\n- [ ] Run TypeScript checks if API client changes affect the web package:\n\n```bash\ncd apps/fabro-web && bun run typecheck\ncd apps/fabro-web && bun test\n```\n\n- [ ] Inspect generated files and snapshots before accepting any snapshot changes.\n\n## Acceptance Criteria\n\n- Server startup creates or loads `environments/default.toml`, `local.toml`, `docker.toml`, and `daytona.toml`.\n- `GET /api/v1/environments` returns seeded environments with revisions.\n- API-created environments persist as TOML files and survive server restart.\n- Runs using `[run.environment] id = \"cloud\"` resolve from server files only.\n- Project/workflow/user `[environments.<id>]` definitions no longer affect runs.\n- Existing runs keep their dense environment snapshot after environment files change.\n- `--environment` still works.\n- `--preserve-sandbox` still works.\n- `--docker-image` no longer works and produces the targeted replacement guidance.\n- Web UI changes are not included.\n",
          "internal.retry_count.toolchain": 0,
          "internal.run_id": "01KSPDE8E9ATTVY1VBCS3YRBHT",
          "thread.toolchain.current_node": "preflight_compile",
          "internal.retry_count.start": 0,
          "internal.retry_count.simplify_opus": 0,
          "response.simplify_gpt": "Implemented cleanup fixes from the review pass.\n\nWhat I changed:\n- Replaced blocking Dockerfile reads on async environment create/replace paths with `tokio::fs::read_to_string`.\n- Threaded the server `EnvironmentStore` catalog into automation manifest materialization so automation-created manifests resolve server-owned environments.\n- Added environment catalog injection to manifest/server tests that now require server-owned environment resolution.\n- Updated obsolete tests that expected project `[environments.*]` Dockerfile bundling to instead assert the new targeted server-managed error.\n- Fixed clippy issues:\n  - imported async fs path instead of absolute `tokio::fs`.\n  - removed stale `RunSettingsBuilder` usage/import.\n  - restored non-test `ServerDaemon` import.\n  - used explicit `MergeMap::<EnvironmentLayer>::default()`.\n\nValidation run:\n- `cargo +nightly-2026-04-14 fmt --check --all` ✅\n- `cargo +nightly-2026-04-14 clippy -q -p fabro-environment -p fabro-manifest -p fabro-server --all-targets -- -D warnings` ✅\n- `cargo nextest run -p fabro-environment` ✅\n- `cargo nextest run -p fabro-config` ✅\n- `cargo nextest run -p fabro-manifest` ✅\n- `cargo nextest run -p fabro-server` ✅\n\nNote: the parallel subagents completed, but their tool responses did not expose visible findings in this environment, so I performed the targeted review directly and fixed the concrete issues found.",
          "graph.rankdir": "LR",
          "last_stage": "simplify_gpt",
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
          "internal.retry_count.simplify_gpt": 0,
          "thread.preflight_compile.current_node": "preflight_lint",
          "internal.retry_count.preflight_compile": 0,
          "internal.retry_count.preflight_lint": 0,
          "response.simplify_opus": "Workspace builds clean. Let me summarize what was done.\n\n## Summary\n\nReviewed the `fabro-environment` crate addition and related fabro-config/fabro-server changes against three concurrent agents (reuse, quality, efficiency) and applied the highest-impact fixes:\n\n### Type / API surface cleanup\n- **Collapsed `Environment` to `{id, revision, settings: EnvironmentSettings}`** — eliminated the parallel flat-field copy, `settings()`, `from_validated_settings`, and the eight clone fields. `Environment.settings` is now a single owned `EnvironmentSettings`.\n- **Deleted `EnvironmentReplace`** — it was field-identical to `EnvironmentSettings` with no API consumer. `EnvironmentStore::replace` now takes `EnvironmentSettings` directly; `EnvironmentDraft` becomes `{id, settings}`.\n- **Removed unused public API**: `Environment::from_toml_bytes`, `Environment::to_toml_string`, `EnvironmentStoreError::MissingRevision`.\n\n### Dead code purge\n- **Deleted `LegacySandboxMigrationReport`, `migrate_settings_path`, `write_next_backup`, `backup_path_for`, `next_backup_path`, `REMOVAL_NOTE` and the two tests** in the 2026050101 legacy sandbox migration — production goes through `migrate_contents` only via the new 2026052801 migration.\n- **Removed `ResolvedAppStateSettings.manifest_run_settings`** dead field (server resolves it after loading the environment store anyway), plus the now-unused `RunSettingsBuilder`/`SharedError` imports in `serve.rs` and `test_support.rs`.\n\n### Efficiency\n- **Cached `catalog_layer()` as `Arc<MergeMap<EnvironmentLayer>>`** behind a `CatalogState` updated on create/replace/delete. Run create / preflight / graph / validate now just bump a refcount instead of cloning every `Environment` and rebuilding the catalog on each call.\n- **Simplified `write_new`** to a direct `OpenOptions::create_new(true).open(path)` (matches `seed_missing_environments`). Removes the temp + hard_link + cleanup dance and its leak window.\n\n### Quality polish\n- Dropped fake `async` from `EnvironmentStore::list`/`get` (sync `RwLock` reads only).\n- Inlined `resolve_path` into `base_dir.join(path)` (it was reimplementing `Path::join`).\n- Replaced the local `value()` wrapper with `toml_edit::value`.\n- Replaced `Option<PathBuf>` with `&Path` in `parse_persisted` (`from_persisted_path`'s \"memory\" branch is dead now).\n- Extracted `check_revision` helper to eliminate duplicated lock-read + ok_or + revision-compare across `replace` and `delete`.\n- Added small `read_state`/`write_state` accessors to centralize the lock-poisoning expect.\n\n### Config plumbing\n- **Removed the thin `load_settings_path` wrapper** and renamed `load_settings_path_with_source` to `load_settings_path(path, source)`. Each call site now declares its `SettingsSource` explicitly.\n- **Unified the parse-then-validate pattern** behind a single `parse_settings_toml(source, kind)` helper, replacing 11 duplicated `.parse::<SettingsLayer>().map_err(...)?; validate_parsed_source(&layer, ...)?` blocks.\n- Replaced the two scattered match arms in `parse.rs` with named predicates `SettingsSource::runs_settings_migrations` / `forbids_environment_catalog`.\n\n### Verification\n- `cargo nextest run -p fabro-environment -p fabro-config` — 233 passed, 0 failed.\n- `cargo +nightly-2026-04-14 fmt --check --all` — clean.\n- `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` — clean.\n- `cargo build --workspace` — clean.\n\n`fabro-server` retains 34 pre-existing test failures from the failed `implement` step (Task 5 of the original plan, \"Adjust CLI And Manifest Behavior\", was never executed). All share a \"unknown environment: <id>\" root cause: tests that exercise `fabro-manifest::build_run_manifest` directly never seed a server environment catalog. These failures predate this cleanup pass and aren't introduced by it.\n\nFindings not addressed (deferred — would require crate-restructuring beyond a review pass):\n- Sharing `write_atomic`/`temp_path_for`/`id_from_path`/etc. with the identical helpers in `fabro-automation` (would need a new shared util crate).\n- Sharing the slug validator and SHA-256 revision type between `fabro-environment` and `fabro-automation` (cycle if extracted to fabro-config; would need a `fabro-util` extraction).\n- Sharing `ensure_table` between `fabro-environment::model` and the legacy migration.\n- Making `StickyMap`'s `Serialize` deterministic so `canonical_bytes` could collapse into `toml::to_string_pretty(layer)`.",
          "thread.simplify_opus.current_node": "simplify_gpt",
          "current_node": "simplify_gpt",
          "internal.retry_count.implement": 0,
          "thread.implement.current_node": "simplify_opus",
          "last_response": "Implemented cleanup fixes from the review pass.\n\nWhat I changed:\n- Replaced blocking Dockerfile reads on async environment create/replace paths with `tokio::fs::read_to_string`.\n- Threaded the server ",
          "internal.work_dir": "/home/daytona/workspace/fabro"
        },
        "node_outcomes": {
          "preflight_compile": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo check -q --workspace 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 131121,
              "active_time_ms": 131121
            }
          },
          "simplify_opus": {
            "status": "succeeded",
            "context_updates": {
              "last_stage": "simplify_opus",
              "last_response": "Workspace builds clean. Let me summarize what was done.\n\n## Summary\n\nReviewed the `fabro-environment` crate addition and related fabro-config/fabro-server changes against three concurrent agents (reus",
              "response.simplify_opus": "Workspace builds clean. Let me summarize what was done.\n\n## Summary\n\nReviewed the `fabro-environment` crate addition and related fabro-config/fabro-server changes against three concurrent agents (reuse, quality, efficiency) and applied the highest-impact fixes:\n\n### Type / API surface cleanup\n- **Collapsed `Environment` to `{id, revision, settings: EnvironmentSettings}`** — eliminated the parallel flat-field copy, `settings()`, `from_validated_settings`, and the eight clone fields. `Environment.settings` is now a single owned `EnvironmentSettings`.\n- **Deleted `EnvironmentReplace`** — it was field-identical to `EnvironmentSettings` with no API consumer. `EnvironmentStore::replace` now takes `EnvironmentSettings` directly; `EnvironmentDraft` becomes `{id, settings}`.\n- **Removed unused public API**: `Environment::from_toml_bytes`, `Environment::to_toml_string`, `EnvironmentStoreError::MissingRevision`.\n\n### Dead code purge\n- **Deleted `LegacySandboxMigrationReport`, `migrate_settings_path`, `write_next_backup`, `backup_path_for`, `next_backup_path`, `REMOVAL_NOTE` and the two tests** in the 2026050101 legacy sandbox migration — production goes through `migrate_contents` only via the new 2026052801 migration.\n- **Removed `ResolvedAppStateSettings.manifest_run_settings`** dead field (server resolves it after loading the environment store anyway), plus the now-unused `RunSettingsBuilder`/`SharedError` imports in `serve.rs` and `test_support.rs`.\n\n### Efficiency\n- **Cached `catalog_layer()` as `Arc<MergeMap<EnvironmentLayer>>`** behind a `CatalogState` updated on create/replace/delete. Run create / preflight / graph / validate now just bump a refcount instead of cloning every `Environment` and rebuilding the catalog on each call.\n- **Simplified `write_new`** to a direct `OpenOptions::create_new(true).open(path)` (matches `seed_missing_environments`). Removes the temp + hard_link + cleanup dance and its leak window.\n\n### Quality polish\n- Dropped fake `async` from `EnvironmentStore::list`/`get` (sync `RwLock` reads only).\n- Inlined `resolve_path` into `base_dir.join(path)` (it was reimplementing `Path::join`).\n- Replaced the local `value()` wrapper with `toml_edit::value`.\n- Replaced `Option<PathBuf>` with `&Path` in `parse_persisted` (`from_persisted_path`'s \"memory\" branch is dead now).\n- Extracted `check_revision` helper to eliminate duplicated lock-read + ok_or + revision-compare across `replace` and `delete`.\n- Added small `read_state`/`write_state` accessors to centralize the lock-poisoning expect.\n\n### Config plumbing\n- **Removed the thin `load_settings_path` wrapper** and renamed `load_settings_path_with_source` to `load_settings_path(path, source)`. Each call site now declares its `SettingsSource` explicitly.\n- **Unified the parse-then-validate pattern** behind a single `parse_settings_toml(source, kind)` helper, replacing 11 duplicated `.parse::<SettingsLayer>().map_err(...)?; validate_parsed_source(&layer, ...)?` blocks.\n- Replaced the two scattered match arms in `parse.rs` with named predicates `SettingsSource::runs_settings_migrations` / `forbids_environment_catalog`.\n\n### Verification\n- `cargo nextest run -p fabro-environment -p fabro-config` — 233 passed, 0 failed.\n- `cargo +nightly-2026-04-14 fmt --check --all` — clean.\n- `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` — clean.\n- `cargo build --workspace` — clean.\n\n`fabro-server` retains 34 pre-existing test failures from the failed `implement` step (Task 5 of the original plan, \"Adjust CLI And Manifest Behavior\", was never executed). All share a \"unknown environment: <id>\" root cause: tests that exercise `fabro-manifest::build_run_manifest` directly never seed a server environment catalog. These failures predate this cleanup pass and aren't introduced by it.\n\nFindings not addressed (deferred — would require crate-restructuring beyond a review pass):\n- Sharing `write_atomic`/`temp_path_for`/`id_from_path`/etc. with the identical helpers in `fabro-automation` (would need a new shared util crate).\n- Sharing the slug validator and SHA-256 revision type between `fabro-environment` and `fabro-automation` (cycle if extracted to fabro-config; would need a `fabro-util` extraction).\n- Sharing `ensure_table` between `fabro-environment::model` and the legacy migration.\n- Making `StickyMap`'s `Serialize` deterministic so `canonical_bytes` could collapse into `toml::to_string_pretty(layer)`."
            },
            "notes": "Stage completed: simplify_opus",
            "usage": {
              "input": {
                "usage": {
                  "model": {
                    "provider": "anthropic",
                    "model_id": "claude-opus-4-7"
                  },
                  "tokens": {
                    "input_tokens": 262080,
                    "output_tokens": 89618,
                    "reasoning_tokens": 0,
                    "cache_read_tokens": 44336839,
                    "cache_write_tokens": 4410068
                  }
                },
                "facts": {
                  "algorithm": "anthropic",
                  "cache_write_5m_tokens": 4410068,
                  "cache_write_1h_tokens": 0
                }
              },
              "total_usd_micros": 53282194
            },
            "files_touched": [
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/migrations/2026050101_legacy_sandbox_to_environments.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/builders.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/load.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/parse.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/project.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/resolve/mod.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/run.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/user.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/error.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/lib.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/model.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/store.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/run_manifest.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/serve.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/server.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/server/handler/graph.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/test_support.rs"
            ],
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 1449354,
              "tool_time_ms": 794439,
              "active_time_ms": 2243793
            }
          },
          "toolchain": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
            },
            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 1316,
              "active_time_ms": 1316
            }
          },
          "implement": {
            "status": "failed",
            "failure": {
              "message": "LLM error: Invalid request to openai: No tool call found for function call output with call_id call_DUxNRWlboQi3OOOvhg0NhD3h.",
              "category": "deterministic",
              "signature": "api_deterministic|openai|invalid_request"
            },
            "usage": null
          },
          "start": {
            "status": "succeeded",
            "usage": null
          },
          "preflight_lint": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 143203,
              "active_time_ms": 143203
            }
          },
          "simplify_gpt": {
            "status": "succeeded",
            "context_updates": {
              "response.simplify_gpt": "Implemented cleanup fixes from the review pass.\n\nWhat I changed:\n- Replaced blocking Dockerfile reads on async environment create/replace paths with `tokio::fs::read_to_string`.\n- Threaded the server `EnvironmentStore` catalog into automation manifest materialization so automation-created manifests resolve server-owned environments.\n- Added environment catalog injection to manifest/server tests that now require server-owned environment resolution.\n- Updated obsolete tests that expected project `[environments.*]` Dockerfile bundling to instead assert the new targeted server-managed error.\n- Fixed clippy issues:\n  - imported async fs path instead of absolute `tokio::fs`.\n  - removed stale `RunSettingsBuilder` usage/import.\n  - restored non-test `ServerDaemon` import.\n  - used explicit `MergeMap::<EnvironmentLayer>::default()`.\n\nValidation run:\n- `cargo +nightly-2026-04-14 fmt --check --all` ✅\n- `cargo +nightly-2026-04-14 clippy -q -p fabro-environment -p fabro-manifest -p fabro-server --all-targets -- -D warnings` ✅\n- `cargo nextest run -p fabro-environment` ✅\n- `cargo nextest run -p fabro-config` ✅\n- `cargo nextest run -p fabro-manifest` ✅\n- `cargo nextest run -p fabro-server` ✅\n\nNote: the parallel subagents completed, but their tool responses did not expose visible findings in this environment, so I performed the targeted review directly and fixed the concrete issues found.",
              "last_stage": "simplify_gpt",
              "last_response": "Implemented cleanup fixes from the review pass.\n\nWhat I changed:\n- Replaced blocking Dockerfile reads on async environment create/replace paths with `tokio::fs::read_to_string`.\n- Threaded the server "
            },
            "notes": "Stage completed: simplify_gpt",
            "usage": {
              "input": {
                "usage": {
                  "model": {
                    "provider": "openai",
                    "model_id": "gpt-5.5"
                  },
                  "tokens": {
                    "input_tokens": 1401292,
                    "output_tokens": 14865,
                    "reasoning_tokens": 5183,
                    "cache_read_tokens": 9071616,
                    "cache_write_tokens": 0
                  }
                },
                "facts": {
                  "algorithm": "openai"
                }
              },
              "total_usd_micros": 12143708
            },
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 700782,
              "tool_time_ms": 547781,
              "active_time_ms": 1248563
            }
          }
        },
        "next_node_id": "verify",
        "git_commit_sha": "675289b81f4fb24fbabbaa9731b2138cef7f9a01",
        "loop_failure_signatures": {
          "implement|deterministic|api_deterministic|openai|invalid_request": 1
        },
        "node_visits": {
          "toolchain": 1,
          "preflight_lint": 1,
          "preflight_compile": 1,
          "implement": 1,
          "simplify_gpt": 1,
          "simplify_opus": 1,
          "start": 1
        }
      },
      "diff": {
        "patch": "diff --git a/lib/crates/fabro-cli/tests/manifest_path_round_trip.rs b/lib/crates/fabro-cli/tests/manifest_path_round_trip.rs\nindex 5e8f16cc5..a85fafb7d 100644\n--- a/lib/crates/fabro-cli/tests/manifest_path_round_trip.rs\n+++ b/lib/crates/fabro-cli/tests/manifest_path_round_trip.rs\n@@ -5,9 +5,20 @@\n \n use std::path::PathBuf;\n \n+use fabro_config::{EnvironmentLayer, MergeMap};\n use fabro_manifest::{ManifestBuildInput, build_run_manifest};\n use fabro_types::ManifestPath;\n \n+fn test_environment_defaults() -> MergeMap<EnvironmentLayer> {\n+    MergeMap::from(std::collections::HashMap::from([(\n+        \"default\".to_string(),\n+        EnvironmentLayer {\n+            provider: Some(\"local\".to_string()),\n+            ..EnvironmentLayer::default()\n+        },\n+    )]))\n+}\n+\n #[test]\n fn cli_built_manifest_resolves_user_global_at_path() {\n     let temp = tempfile::tempdir().unwrap();\n@@ -31,6 +42,7 @@ fn cli_built_manifest_resolves_user_global_at_path() {\n     let built = build_run_manifest(ManifestBuildInput {\n         workflow: workflow_dir.join(\"workflow.fabro\"),\n         cwd: project,\n+        environment_defaults: test_environment_defaults(),\n         ..Default::default()\n     })\n     .unwrap();\ndiff --git a/lib/crates/fabro-environment/src/model.rs b/lib/crates/fabro-environment/src/model.rs\nindex 05204760e..90e0f934a 100644\n--- a/lib/crates/fabro-environment/src/model.rs\n+++ b/lib/crates/fabro-environment/src/model.rs\n@@ -12,6 +12,7 @@ use fabro_types::settings::run::{\n     EnvironmentSettings, EnvironmentVolumeSettings,\n };\n use serde::{Deserialize, Serialize};\n+use tokio::fs;\n use toml_edit::{Array, ArrayOfTables, DocumentMut, Item, Table, Value, value};\n \n use crate::{\n@@ -44,12 +45,12 @@ impl Environment {\n         })\n     }\n \n-    pub(crate) fn from_settings(\n+    pub(crate) async fn from_settings(\n         id: EnvironmentId,\n         settings: EnvironmentSettings,\n         dockerfile_base_dir: &Path,\n     ) -> Result<(Self, Vec<u8>), EnvironmentStoreError> {\n-        let settings = inline_dense_dockerfile(settings, dockerfile_base_dir)?;\n+        let settings = inline_dense_dockerfile(settings, dockerfile_base_dir).await?;\n         let persisted = environment_settings_to_layer(&settings);\n         let bytes = canonical_bytes(&persisted).into_bytes();\n         let revision = EnvironmentRevision::from_bytes(&bytes);\n@@ -141,11 +142,7 @@ fn inline_layer_dockerfile_paths(\n     Ok(())\n }\n \n-#[expect(\n-    clippy::disallowed_methods,\n-    reason = \"Dockerfile inlining for API create/replace happens on a Tokio worker thread via spawn_blocking elsewhere; this function is only invoked from synchronous paths.\"\n-)]\n-fn inline_dense_dockerfile(\n+async fn inline_dense_dockerfile(\n     mut settings: EnvironmentSettings,\n     base_dir: &Path,\n ) -> Result<EnvironmentSettings, EnvironmentValidationError> {\n@@ -153,7 +150,7 @@ fn inline_dense_dockerfile(\n         return Ok(settings);\n     };\n     let path = base_dir.join(path);\n-    let content = std::fs::read_to_string(&path).map_err(|source| {\n+    let content = fs::read_to_string(&path).await.map_err(|source| {\n         EnvironmentValidationError::DockerfileRead {\n             path: path.clone(),\n             source,\ndiff --git a/lib/crates/fabro-environment/src/store.rs b/lib/crates/fabro-environment/src/store.rs\nindex aabdd86ae..e4606e686 100644\n--- a/lib/crates/fabro-environment/src/store.rs\n+++ b/lib/crates/fabro-environment/src/store.rs\n@@ -135,7 +135,7 @@ impl EnvironmentStore {\n     ) -> Result<Environment, EnvironmentStoreError> {\n         let EnvironmentDraft { id, settings } = draft;\n         let (environment, bytes) =\n-            Environment::from_settings(id.clone(), settings, &self.request_base_dir)?;\n+            Environment::from_settings(id.clone(), settings, &self.request_base_dir).await?;\n         let _mutation = self.mutations.lock().await;\n         if self.read_state().environments.contains_key(&id) {\n             return Err(EnvironmentStoreError::AlreadyExists { id });\n@@ -159,7 +159,7 @@ impl EnvironmentStore {\n         settings: EnvironmentSettings,\n     ) -> Result<Environment, EnvironmentStoreError> {\n         let (environment, bytes) =\n-            Environment::from_settings(id.clone(), settings, &self.request_base_dir)?;\n+            Environment::from_settings(id.clone(), settings, &self.request_base_dir).await?;\n         let _mutation = self.mutations.lock().await;\n         check_revision(&self.read_state().environments, id, expected)?;\n \ndiff --git a/lib/crates/fabro-manifest/src/lib.rs b/lib/crates/fabro-manifest/src/lib.rs\nindex f8c8eafe1..b72a8ec3a 100644\n--- a/lib/crates/fabro-manifest/src/lib.rs\n+++ b/lib/crates/fabro-manifest/src/lib.rs\n@@ -12,9 +12,9 @@ use fabro_api::types;\n use fabro_config::project::{self, WorkflowLocation, discover_project_config};\n use fabro_config::run::{resolve_run_goal_from_layer, resolve_run_goal_from_namespace};\n use fabro_config::{\n-    CliLayer, EnvironmentDockerfileLayer, EnvironmentImageLayer, EnvironmentLifecycleLayer,\n-    ReplaceMap, RunEnvironmentLayer, RunExecutionLayer, RunGoalLayer, RunLayer, RunModelLayer,\n-    SettingsLayer, WorkflowSettingsBuilder,\n+    CliLayer, EnvironmentDockerfileLayer, EnvironmentImageLayer, EnvironmentLayer,\n+    EnvironmentLifecycleLayer, MergeMap, ReplaceMap, RunEnvironmentLayer, RunExecutionLayer,\n+    RunGoalLayer, RunLayer, RunModelLayer, SettingsLayer, WorkflowSettingsBuilder,\n };\n use fabro_graphviz::graph::AttrValue;\n use fabro_graphviz::parser;\n@@ -36,16 +36,17 @@ use fabro_workflow::static_reference::{\n \n #[derive(Debug, Default)]\n pub struct ManifestBuildInput {\n-    pub workflow:           PathBuf,\n-    pub cwd:                PathBuf,\n-    pub run_overrides:      Option<RunLayer>,\n-    pub cli_overrides:      Option<CliLayer>,\n-    pub input_overrides:    HashMap<String, toml::Value>,\n-    pub args:               Option<types::ManifestArgs>,\n-    pub run_id:             Option<RunId>,\n+    pub workflow:             PathBuf,\n+    pub cwd:                  PathBuf,\n+    pub run_overrides:        Option<RunLayer>,\n+    pub cli_overrides:        Option<CliLayer>,\n+    pub input_overrides:      HashMap<String, toml::Value>,\n+    pub args:                 Option<types::ManifestArgs>,\n+    pub run_id:               Option<RunId>,\n+    pub environment_defaults: MergeMap<EnvironmentLayer>,\n     /// Path to the user settings file (for inclusion in\n     /// `RunManifest.configs`). `None` skips the user config entry.\n-    pub user_settings_path: Option<PathBuf>,\n+    pub user_settings_path:   Option<PathBuf>,\n }\n \n #[derive(Debug)]\n@@ -167,7 +168,8 @@ pub fn build_run_manifest(input: ManifestBuildInput) -> Result<BuiltManifest> {\n         })\n         .transpose()?;\n \n-    let mut workflow_settings_builder = WorkflowSettingsBuilder::new();\n+    let mut workflow_settings_builder = WorkflowSettingsBuilder::new()\n+        .server_manifest_defaults(RunLayer::default(), input.environment_defaults.clone());\n     if let Some(run) = input.run_overrides.clone() {\n         workflow_settings_builder = workflow_settings_builder.run_overrides(run);\n     }\n@@ -885,6 +887,16 @@ pub fn manifest_args_is_empty(args: &types::ManifestArgs) -> bool {\n mod tests {\n     use super::*;\n \n+    fn test_environment_defaults() -> MergeMap<EnvironmentLayer> {\n+        MergeMap::from(std::collections::HashMap::from([(\n+            \"default\".to_string(),\n+            EnvironmentLayer {\n+                provider: Some(\"local\".to_string()),\n+                ..EnvironmentLayer::default()\n+            },\n+        )]))\n+    }\n+\n     #[test]\n     fn build_run_overrides_sets_common_cli_and_mcp_layers() {\n         let overrides = build_run_overrides(RunOverrideInput {\n@@ -1004,6 +1016,7 @@ mod tests {\n         let built = build_run_manifest(ManifestBuildInput {\n             workflow: PathBuf::from(\".fabro/workflows/demo/workflow.toml\"),\n             cwd: project.to_path_buf(),\n+            environment_defaults: test_environment_defaults(),\n             ..Default::default()\n         })\n         .unwrap();\n@@ -1080,6 +1093,7 @@ mod tests {\n         let built = build_run_manifest(ManifestBuildInput {\n             workflow: PathBuf::from(\".fabro/workflows/demo/workflow.toml\"),\n             cwd: project.to_path_buf(),\n+            environment_defaults: test_environment_defaults(),\n             ..Default::default()\n         })\n         .unwrap();\n@@ -1140,6 +1154,7 @@ mod tests {\n         let built = build_run_manifest(ManifestBuildInput {\n             workflow: PathBuf::from(\".fabro/workflows/demo/workflow.toml\"),\n             cwd: project.to_path_buf(),\n+            environment_defaults: test_environment_defaults(),\n             ..Default::default()\n         })\n         .unwrap();\n@@ -1187,6 +1202,7 @@ mod tests {\n         let err = build_run_manifest(ManifestBuildInput {\n             workflow: PathBuf::from(\".fabro/workflows/demo/workflow.toml\"),\n             cwd: project.to_path_buf(),\n+            environment_defaults: test_environment_defaults(),\n             ..Default::default()\n         })\n         .unwrap_err();\n@@ -1198,7 +1214,7 @@ mod tests {\n     }\n \n     #[test]\n-    fn build_manifest_bundles_project_config_daytona_dockerfile_relative_to_project_config() {\n+    fn build_manifest_rejects_project_environment_catalog_definitions() {\n         let temp = tempfile::tempdir().unwrap();\n         let project = temp.path();\n         let workflow_dir = project.join(\".fabro/workflows/demo\");\n@@ -1219,7 +1235,6 @@ dockerfile = { path = \"Dockerfile\" }\n \"#,\n         )\n         .unwrap();\n-        std::fs::write(project.join(\".fabro/Dockerfile\"), \"FROM ubuntu:24.04\\n\").unwrap();\n         std::fs::write(\n             workflow_dir.join(\"workflow.toml\"),\n             \"_version = 1\\n\\n[workflow]\\ngraph = \\\"workflow.fabro\\\"\\n\",\n@@ -1231,22 +1246,19 @@ dockerfile = { path = \"Dockerfile\" }\n         )\n         .unwrap();\n \n-        let built = build_run_manifest(ManifestBuildInput {\n+        let err = build_run_manifest(ManifestBuildInput {\n             workflow: PathBuf::from(\".fabro/workflows/demo/workflow.toml\"),\n             cwd: project.to_path_buf(),\n+            environment_defaults: test_environment_defaults(),\n             ..Default::default()\n         })\n-        .unwrap();\n+        .unwrap_err();\n \n-        let root = &built.manifest.workflows[\".fabro/workflows/demo/workflow.fabro\"];\n-        let entry = root\n-            .files\n-            .get(\".fabro/Dockerfile\")\n-            .expect(\"project Dockerfile should be bundled with target workflow\");\n-        assert_eq!(entry.content, \"FROM ubuntu:24.04\\n\");\n-        assert_eq!(entry.ref_.type_, types::ManifestFileRefType::Dockerfile);\n-        assert_eq!(entry.ref_.original, \"Dockerfile\");\n-        assert_eq!(entry.ref_.from.as_deref(), Some(\".fabro/project.toml\"));\n+        assert!(\n+            err.to_string()\n+                .contains(\"[environments.daytona] is now server-managed\"),\n+            \"unexpected error: {err:#}\"\n+        );\n     }\n \n     #[test]\n@@ -1280,6 +1292,7 @@ dockerfile = { path = \"Dockerfile\" }\n         let err = build_run_manifest(ManifestBuildInput {\n             workflow: PathBuf::from(\".fabro/workflows/demo/workflow.toml\"),\n             cwd: project.to_path_buf(),\n+            environment_defaults: test_environment_defaults(),\n             ..Default::default()\n         })\n         .unwrap_err();\n@@ -1321,6 +1334,7 @@ dockerfile = { path = \"Dockerfile\" }\n                 \"import_file\".to_string(),\n                 toml::Value::String(\"checks.fabro\".to_string()),\n             )]),\n+            environment_defaults: test_environment_defaults(),\n             ..Default::default()\n         })\n         .unwrap_err();\n@@ -1363,6 +1377,7 @@ dockerfile = { path = \"Dockerfile\" }\n                 \"child_workflow\".to_string(),\n                 toml::Value::String(\"child\".to_string()),\n             )]),\n+            environment_defaults: test_environment_defaults(),\n             ..Default::default()\n         })\n         .unwrap_err();\n@@ -1405,6 +1420,7 @@ dockerfile = { path = \"Dockerfile\" }\n                 \"goal_file\".to_string(),\n                 toml::Value::String(\"goal.md\".to_string()),\n             )]),\n+            environment_defaults: test_environment_defaults(),\n             ..Default::default()\n         })\n         .unwrap_err();\n@@ -1456,6 +1472,7 @@ file = \"prompts/goal.md\"\n         let built = build_run_manifest(ManifestBuildInput {\n             workflow: PathBuf::from(\".fabro/workflows/demo/workflow.toml\"),\n             cwd: project.to_path_buf(),\n+            environment_defaults: test_environment_defaults(),\n             ..Default::default()\n         })\n         .unwrap();\n@@ -1505,6 +1522,7 @@ file = \"prompts/goal.md\"\n         let built = build_run_manifest(ManifestBuildInput {\n             workflow: PathBuf::from(\".fabro/workflows/demo/workflow.toml\"),\n             cwd: project.to_path_buf(),\n+            environment_defaults: test_environment_defaults(),\n             ..Default::default()\n         })\n         .unwrap();\n@@ -1566,6 +1584,7 @@ working_dir = \"repos/target\"\n         let built = build_run_manifest(ManifestBuildInput {\n             workflow: PathBuf::from(\".fabro/workflows/demo/workflow.toml\"),\n             cwd: workspace.to_path_buf(),\n+            environment_defaults: test_environment_defaults(),\n             ..Default::default()\n         })\n         .unwrap();\n@@ -1617,6 +1636,7 @@ repository = \"target\"\n         let built = build_run_manifest(ManifestBuildInput {\n             workflow: PathBuf::from(\".fabro/workflows/demo/workflow.toml\"),\n             cwd: workspace.to_path_buf(),\n+            environment_defaults: test_environment_defaults(),\n             ..Default::default()\n         })\n         .unwrap();\n@@ -1683,6 +1703,7 @@ exit 1\n                 let built = build_run_manifest(ManifestBuildInput {\n                     workflow: PathBuf::from(\".fabro/workflows/demo/workflow.toml\"),\n                     cwd: workspace.clone(),\n+                    environment_defaults: test_environment_defaults(),\n                     ..Default::default()\n                 })\n                 .unwrap();\ndiff --git a/lib/crates/fabro-server/src/automation_materializer.rs b/lib/crates/fabro-server/src/automation_materializer.rs\nindex 74c9c2677..4164d2b32 100644\n--- a/lib/crates/fabro-server/src/automation_materializer.rs\n+++ b/lib/crates/fabro-server/src/automation_materializer.rs\n@@ -7,6 +7,7 @@ use base64::Engine as _;\n use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;\n use fabro_api::types::RunManifest;\n use fabro_automation::{AutomationId, AutomationTarget};\n+use fabro_config::{EnvironmentLayer, MergeMap};\n use fabro_manifest::ManifestBuildInput;\n use fabro_types::{DirtyStatus, GitContext, PreRunPushOutcome, RunId};\n use fabro_util::error::collect_chain;\n@@ -55,9 +56,10 @@ pub(crate) trait AutomationRunMaterializer: Send + Sync {\n \n #[derive(Clone)]\n pub(crate) struct ProductionAutomationRunMaterializer {\n-    github_credentials:  Option<fabro_github::GitHubCredentials>,\n-    github_api_base_url: String,\n-    http_client:         Option<fabro_http::HttpClient>,\n+    github_credentials:   Option<fabro_github::GitHubCredentials>,\n+    github_api_base_url:  String,\n+    http_client:          Option<fabro_http::HttpClient>,\n+    environment_defaults: MergeMap<EnvironmentLayer>,\n }\n \n impl ProductionAutomationRunMaterializer {\n@@ -65,11 +67,13 @@ impl ProductionAutomationRunMaterializer {\n         github_credentials: Option<fabro_github::GitHubCredentials>,\n         github_api_base_url: String,\n         http_client: Option<fabro_http::HttpClient>,\n+        environment_defaults: MergeMap<EnvironmentLayer>,\n     ) -> Self {\n         Self {\n             github_credentials,\n             github_api_base_url,\n             http_client,\n+            environment_defaults,\n         }\n     }\n }\n@@ -131,6 +135,7 @@ impl AutomationRunMaterializer for ProductionAutomationRunMaterializer {\n             checkout_dir,\n             repo,\n             checked_out_sha: Some(checked_out_sha),\n+            environment_defaults: self.environment_defaults.clone(),\n         };\n         task::spawn_blocking(move || build_manifest_from_checkout(manifest_input))\n             .await\n@@ -441,10 +446,11 @@ fn render_error_chain(error: &(dyn std::error::Error + 'static)) -> String {\n \n #[derive(Debug)]\n pub(crate) struct ManifestFromCheckoutInput {\n-    input:           AutomationRunMaterializeInput,\n-    checkout_dir:    PathBuf,\n-    repo:            GithubRepository,\n-    checked_out_sha: Option<String>,\n+    input:                AutomationRunMaterializeInput,\n+    checkout_dir:         PathBuf,\n+    repo:                 GithubRepository,\n+    checked_out_sha:      Option<String>,\n+    environment_defaults: MergeMap<EnvironmentLayer>,\n }\n \n fn build_manifest_from_checkout(\n@@ -455,12 +461,14 @@ fn build_manifest_from_checkout(\n         checkout_dir,\n         repo,\n         checked_out_sha,\n+        environment_defaults,\n     } = args;\n     let built = fabro_manifest::build_run_manifest(ManifestBuildInput {\n         workflow: input.target.workflow.as_str().into(),\n         cwd: checkout_dir,\n         run_id: Some(input.run_id),\n         user_settings_path: Some(input.user_settings_path),\n+        environment_defaults,\n         ..ManifestBuildInput::default()\n     })\n     .map_err(|err| manifest_build_error(&err))?;\n@@ -571,6 +579,7 @@ mod tests {\n         reason = \"Materializer unit tests write small temporary workflow fixtures synchronously.\"\n     )]\n \n+    use std::collections::HashMap;\n     use std::fs;\n     use std::path::Path;\n \n@@ -588,6 +597,13 @@ mod tests {\n         }\n     }\n \n+    fn test_environment_defaults() -> MergeMap<EnvironmentLayer> {\n+        MergeMap::from(HashMap::from([(\"default\".to_string(), EnvironmentLayer {\n+            provider: Some(\"local\".to_string()),\n+            ..EnvironmentLayer::default()\n+        })]))\n+    }\n+\n     #[test]\n     fn target_repository_urls_are_github_metadata_urls_without_credentials() {\n         let repo = parse_github_repository_slug(\"fabro-sh/fabro\").expect(\"slug should parse\");\n@@ -757,6 +773,7 @@ mod tests {\n             checkout_dir: checkout.clone(),\n             repo,\n             checked_out_sha: Some(sha.clone()),\n+            environment_defaults: test_environment_defaults(),\n         })\n         .expect(\"manifest should build from checkout\");\n \ndiff --git a/lib/crates/fabro-server/src/run_manifest.rs b/lib/crates/fabro-server/src/run_manifest.rs\nindex 3a6f38f24..e721bcc3f 100644\n--- a/lib/crates/fabro-server/src/run_manifest.rs\n+++ b/lib/crates/fabro-server/src/run_manifest.rs\n@@ -1435,6 +1435,42 @@ mod tests {\n         RunLayer::default()\n     }\n \n+    fn environment_defaults_fixture() -> MergeMap<EnvironmentLayer> {\n+        MergeMap::from(HashMap::from([\n+            (\"default\".to_string(), EnvironmentLayer {\n+                provider: Some(\"local\".to_string()),\n+                ..EnvironmentLayer::default()\n+            }),\n+            (\"local\".to_string(), EnvironmentLayer {\n+                provider: Some(\"local\".to_string()),\n+                ..EnvironmentLayer::default()\n+            }),\n+            (\"daytona\".to_string(), EnvironmentLayer {\n+                provider: Some(\"daytona\".to_string()),\n+                ..EnvironmentLayer::default()\n+            }),\n+            (\"selected\".to_string(), EnvironmentLayer {\n+                provider: Some(\"docker\".to_string()),\n+                ..EnvironmentLayer::default()\n+            }),\n+            (\"cloud\".to_string(), EnvironmentLayer {\n+                provider: Some(\"daytona\".to_string()),\n+                ..EnvironmentLayer::default()\n+            }),\n+        ]))\n+    }\n+\n+    fn prepare_manifest(\n+        manifest_run_defaults: &RunLayer,\n+        manifest: &types::RunManifest,\n+    ) -> Result<PreparedManifest> {\n+        super::prepare_manifest_with_environment_defaults(\n+            manifest_run_defaults,\n+            &environment_defaults_fixture(),\n+            manifest,\n+        )\n+    }\n+\n     fn test_catalog() -> Arc<Catalog> {\n         Arc::new(Catalog::from_builtin().unwrap())\n     }\n@@ -1485,18 +1521,21 @@ _version = 1\n [run.environment]\n id = \"selected\"\n \n-[environments.selected]\n-provider = \"{provider}\"\n-\n [run.clone]\n enabled = {clone_enabled}\n \"#\n             )),\n             type_:  types::ManifestConfigType::Project,\n         });\n+        let mut environment_defaults = environment_defaults_fixture();\n+        environment_defaults.insert(\"selected\".to_string(), EnvironmentLayer {\n+            provider: Some(provider.to_string()),\n+            ..EnvironmentLayer::default()\n+        });\n \n-        let prepared = prepare_manifest(\n+        let prepared = super::prepare_manifest_with_environment_defaults(\n             &manifest_run_defaults(Some(&default_settings_fixture())),\n+            &environment_defaults,\n             &manifest,\n         )\n         .unwrap();\n@@ -1534,66 +1573,7 @@ enabled = {clone_enabled}\n         assert_eq!(config.volumes[0].subpath.as_deref(), Some(\"agents\"));\n     }\n     #[test]\n-    fn prepare_manifest_inlines_project_config_daytona_dockerfile_from_bundle() {\n-        let mut manifest = minimal_manifest();\n-        manifest.configs.push(types::ManifestConfig {\n-            path:   Some(\".fabro/project.toml\".to_string()),\n-            source: Some(\n-                r#\"_version = 1\n-\n-[run.environment]\n-id = \"cloud\"\n-\n-[environments.cloud]\n-provider = \"daytona\"\n-\n-[environments.cloud.image]\n-dockerfile = { path = \"Dockerfile\" }\n-\"#\n-                .to_string(),\n-            ),\n-            type_:  types::ManifestConfigType::Project,\n-        });\n-        manifest\n-            .workflows\n-            .get_mut(\"workflow.fabro\")\n-            .unwrap()\n-            .files\n-            .insert(\".fabro/Dockerfile\".to_string(), types::ManifestFileEntry {\n-                content: \"FROM ubuntu:24.04\\n\".to_string(),\n-                ref_:    types::ManifestFileRef {\n-                    from:     Some(\".fabro/project.toml\".to_string()),\n-                    original: \"Dockerfile\".to_string(),\n-                    type_:    types::ManifestFileRefType::Dockerfile,\n-                },\n-            });\n-\n-        let prepared = prepare_manifest(\n-            &manifest_run_defaults(Some(&default_settings_fixture())),\n-            &manifest,\n-        )\n-        .unwrap();\n-\n-        let dockerfile = prepared\n-            .settings\n-            .run\n-            .environment\n-            .image\n-            .dockerfile\n-            .as_ref()\n-            .expect(\"project Dockerfile should resolve\");\n-        match dockerfile {\n-            fabro_types::settings::run::DockerfileSource::Inline(value) => {\n-                assert_eq!(value, \"FROM ubuntu:24.04\\n\");\n-            }\n-            fabro_types::settings::run::DockerfileSource::Path { path } => {\n-                panic!(\"project Dockerfile should be inline, got path {path}\")\n-            }\n-        }\n-    }\n-\n-    #[test]\n-    fn prepare_manifest_errors_when_project_config_dockerfile_bundle_is_missing() {\n+    fn prepare_manifest_rejects_project_environment_catalog_definitions() {\n         let mut manifest = minimal_manifest();\n         manifest.configs.push(types::ManifestConfig {\n             path:   Some(\".fabro/project.toml\".to_string()),\n@@ -1618,12 +1598,12 @@ dockerfile = { path = \"Dockerfile\" }\n             &manifest_run_defaults(Some(&default_settings_fixture())),\n             &manifest,\n         ) else {\n-            panic!(\"missing bundled Dockerfile should fail\");\n+            panic!(\"project environment catalog should fail\");\n         };\n         let message = format!(\"{err:#}\");\n         assert!(\n-            message.contains(\"missing bundled dockerfile\"),\n-            \"expected missing bundled dockerfile error, got: {message}\"\n+            message.contains(\"[environments.cloud] is now server-managed\"),\n+            \"expected server-managed environment error, got: {message}\"\n         );\n     }\n \ndiff --git a/lib/crates/fabro-server/src/run_tool_manifest.rs b/lib/crates/fabro-server/src/run_tool_manifest.rs\nindex ec446a4bd..742ed07fb 100644\n--- a/lib/crates/fabro-server/src/run_tool_manifest.rs\n+++ b/lib/crates/fabro-server/src/run_tool_manifest.rs\n@@ -2,7 +2,7 @@ use std::path::{Path, PathBuf};\n use std::sync::Arc;\n \n use fabro_api::types;\n-use fabro_config::{CliLayer, RunGoalLayer, RunLayer};\n+use fabro_config::{CliLayer, EnvironmentLayer, MergeMap, RunGoalLayer, RunLayer};\n use fabro_manifest::{ManifestBuildInput, RunOverrideInput};\n use fabro_model::Catalog;\n use fabro_tool::{ToolError, ToolResult, ValidatedCreateRunSpec};\n@@ -17,14 +17,15 @@ pub fn build_run_tool_manifest(\n     catalog: Arc<Catalog>,\n ) -> ToolResult<types::RunManifest> {\n     let built = fabro_manifest::build_run_manifest(ManifestBuildInput {\n-        workflow:           PathBuf::from(&spec.workflow),\n-        cwd:                cwd.to_path_buf(),\n-        run_overrides:      run_tool_run_overrides(spec),\n-        cli_overrides:      Some(CliLayer::default()),\n-        input_overrides:    spec.inputs.clone(),\n-        args:               run_tool_manifest_args(spec),\n-        run_id:             spec.run_id,\n-        user_settings_path: Some(user_settings_path.to_path_buf()),\n+        workflow:             PathBuf::from(&spec.workflow),\n+        cwd:                  cwd.to_path_buf(),\n+        run_overrides:        run_tool_run_overrides(spec),\n+        cli_overrides:        Some(CliLayer::default()),\n+        input_overrides:      spec.inputs.clone(),\n+        args:                 run_tool_manifest_args(spec),\n+        run_id:               spec.run_id,\n+        environment_defaults: MergeMap::<EnvironmentLayer>::default(),\n+        user_settings_path:   Some(user_settings_path.to_path_buf()),\n     })\n     .map_err(|err| ToolError::from_anyhow(&err))?;\n \ndiff --git a/lib/crates/fabro-server/src/server.rs b/lib/crates/fabro-server/src/server.rs\nindex e79239836..e380e4b8d 100644\n--- a/lib/crates/fabro-server/src/server.rs\n+++ b/lib/crates/fabro-server/src/server.rs\n@@ -51,8 +51,6 @@ pub use fabro_api::types::{\n };\n use fabro_auth::{CredentialSource, VaultCredentialSource, auth_issue_message};\n use fabro_automation::AutomationStore;\n-#[cfg(test)]\n-use fabro_config::RunSettingsBuilder;\n use fabro_config::daemon::ServerDaemon;\n use fabro_config::{RunLayer, Storage, WorkflowSettingsBuilder};\n use fabro_environment::EnvironmentStore;\n@@ -1131,6 +1129,7 @@ impl AppState {\n             credentials,\n             self.github_api_base_url.clone(),\n             self.http_client.clone(),\n+            (*self.environment_store.catalog_layer()).clone(),\n         )\n         .materialize(input)\n         .await\n@@ -2140,14 +2139,6 @@ fn build_prune_plan(\n     })\n }\n \n-#[cfg(test)]\n-fn resolve_manifest_run_settings(\n-    manifest_run_defaults: &RunLayer,\n-) -> std::result::Result<RunNamespace, SharedError> {\n-    RunSettingsBuilder::from_run_layer(manifest_run_defaults)\n-        .map_err(|err| SharedError::new(anyhow::Error::new(err)))\n-}\n-\n fn resolve_manifest_run_settings_with_catalog(\n     manifest_run_defaults: &RunLayer,\n     environment_store: &EnvironmentStore,\ndiff --git a/lib/crates/fabro-server/src/server/tests.rs b/lib/crates/fabro-server/src/server/tests.rs\nindex 4543f9e2f..86e3bfeb3 100644\n--- a/lib/crates/fabro-server/src/server/tests.rs\n+++ b/lib/crates/fabro-server/src/server/tests.rs\n@@ -11,8 +11,10 @@ use axum::body::Body;\n use axum::http::{Method, Request, header};\n use chrono::{Duration as ChronoDuration, Utc};\n use fabro_automation::{AutomationId, AutomationTarget};\n-use fabro_config::ServerSettingsBuilder;\n use fabro_config::bind::Bind;\n+use fabro_config::{\n+    EnvironmentLayer, MergeMap, RunLayer, ServerSettingsBuilder, WorkflowSettingsBuilder,\n+};\n use fabro_interview::{\n     AnswerValue, ControlInterviewer, Interviewer, Question, WorkerControlDeliveryFrame,\n     WorkerControlEnvelope, WorkerControlMessage,\n@@ -1219,14 +1221,18 @@ id = \"missing\"\n \n #[test]\n fn system_sandbox_provider_uses_manifest_defaults() {\n+    let temp = tempfile::tempdir().unwrap();\n+    let environment_store = EnvironmentStore::load_or_seed(temp.path().join(\"environments\"))\n+        .expect(\"environment store should seed\");\n     let source = r#\"\n _version = 1\n \n [run.environment]\n id = \"daytona\"\n \"#;\n-    let manifest_run_settings = resolve_manifest_run_settings(\n+    let manifest_run_settings = resolve_manifest_run_settings_with_catalog(\n         &run_manifest::manifest_run_defaults(Some(&manifest_run_defaults_from_toml(source))),\n+        &environment_store,\n     );\n \n     assert_eq!(system_sandbox_provider(&manifest_run_settings), \"daytona\");\n@@ -1234,14 +1240,18 @@ id = \"daytona\"\n \n #[test]\n fn system_sandbox_provider_defaults_when_manifest_run_settings_do_not_resolve() {\n+    let temp = tempfile::tempdir().unwrap();\n+    let environment_store = EnvironmentStore::load_or_seed(temp.path().join(\"environments\"))\n+        .expect(\"environment store should seed\");\n     let source = r#\"\n _version = 1\n \n [run.environment]\n id = \"missing\"\n \"#;\n-    let manifest_run_settings = resolve_manifest_run_settings(\n+    let manifest_run_settings = resolve_manifest_run_settings_with_catalog(\n         &run_manifest::manifest_run_defaults(Some(&manifest_run_defaults_from_toml(source))),\n+        &environment_store,\n     );\n \n     assert_eq!(\n@@ -3984,15 +3994,23 @@ fn workflow_settings_with_run_notifications(\n     run_toml: &str,\n     workflow_name: Option<&str>,\n ) -> WorkflowSettings {\n-    let mut settings = WorkflowSettings {\n-        run: fabro_config::RunSettingsBuilder::from_toml(run_toml)\n-            .expect(\"run notification settings should resolve\"),\n-        ..WorkflowSettings::default()\n-    };\n+    let mut settings = WorkflowSettingsBuilder::new()\n+        .server_manifest_defaults(RunLayer::default(), test_environment_defaults())\n+        .workflow_toml(run_toml)\n+        .expect(\"run notification settings should parse\")\n+        .build()\n+        .expect(\"run notification settings should resolve\");\n     settings.workflow.name = workflow_name.map(str::to_string);\n     settings\n }\n \n+fn test_environment_defaults() -> MergeMap<EnvironmentLayer> {\n+    MergeMap::from(HashMap::from([(\"default\".to_string(), EnvironmentLayer {\n+        provider: Some(\"local\".to_string()),\n+        ..EnvironmentLayer::default()\n+    })]))\n+}\n+\n async fn create_slack_notification_run(\n     state: &Arc<AppState>,\n     run_id: RunId,\n",
        "summary": {
          "files_changed": 39,
          "additions": 2328,
          "deletions": 534
        }
      }
    },
    {
      "seq": 2698,
      "checkpoint": {
        "timestamp": "2026-05-28T06:01:44.061104Z",
        "current_node": "verify",
        "completed_nodes": [
          "start",
          "toolchain",
          "preflight_compile",
          "preflight_lint",
          "implement",
          "simplify_opus",
          "simplify_gpt",
          "verify"
        ],
        "node_retries": {},
        "context_values": {
          "thread.simplify_gpt.current_node": "verify",
          "thread.implement.current_node": "simplify_opus",
          "internal.run_id": "01KSPDE8E9ATTVY1VBCS3YRBHT",
          "thread.preflight_compile.current_node": "preflight_lint",
          "thread.simplify_opus.current_node": "simplify_gpt",
          "internal.retry_count.verify": 0,
          "last_stage": "simplify_gpt",
          "internal.thread_id": "simplify_gpt",
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "internal.node_visit_count": 1,
          "thread.preflight_lint.current_node": "implement",
          "thread.toolchain.current_node": "preflight_compile",
          "internal.retry_count.preflight_lint": 0,
          "thread.start.current_node": "toolchain",
          "response.simplify_gpt": "Implemented cleanup fixes from the review pass.\n\nWhat I changed:\n- Replaced blocking Dockerfile reads on async environment create/replace paths with `tokio::fs::read_to_string`.\n- Threaded the server `EnvironmentStore` catalog into automation manifest materialization so automation-created manifests resolve server-owned environments.\n- Added environment catalog injection to manifest/server tests that now require server-owned environment resolution.\n- Updated obsolete tests that expected project `[environments.*]` Dockerfile bundling to instead assert the new targeted server-managed error.\n- Fixed clippy issues:\n  - imported async fs path instead of absolute `tokio::fs`.\n  - removed stale `RunSettingsBuilder` usage/import.\n  - restored non-test `ServerDaemon` import.\n  - used explicit `MergeMap::<EnvironmentLayer>::default()`.\n\nValidation run:\n- `cargo +nightly-2026-04-14 fmt --check --all` ✅\n- `cargo +nightly-2026-04-14 clippy -q -p fabro-environment -p fabro-manifest -p fabro-server --all-targets -- -D warnings` ✅\n- `cargo nextest run -p fabro-environment` ✅\n- `cargo nextest run -p fabro-config` ✅\n- `cargo nextest run -p fabro-manifest` ✅\n- `cargo nextest run -p fabro-server` ✅\n\nNote: the parallel subagents completed, but their tool responses did not expose visible findings in this environment, so I performed the targeted review directly and fixed the concrete issues found.",
          "failure_signature": "verify|deterministic|script failed with exit code: <n> ## output es/fabro-server) compiling fabro-cli v0.<n>.<n>-nightly.<n> (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-cli) compiling globset v0.<n>.<n> compiling rust-embed-utils v8.<n>.<n> compiling r",
          "failure_class": "deterministic",
          "internal.retry_count.simplify_gpt": 0,
          "graph.rankdir": "LR",
          "response.simplify_opus": "Workspace builds clean. Let me summarize what was done.\n\n## Summary\n\nReviewed the `fabro-environment` crate addition and related fabro-config/fabro-server changes against three concurrent agents (reuse, quality, efficiency) and applied the highest-impact fixes:\n\n### Type / API surface cleanup\n- **Collapsed `Environment` to `{id, revision, settings: EnvironmentSettings}`** — eliminated the parallel flat-field copy, `settings()`, `from_validated_settings`, and the eight clone fields. `Environment.settings` is now a single owned `EnvironmentSettings`.\n- **Deleted `EnvironmentReplace`** — it was field-identical to `EnvironmentSettings` with no API consumer. `EnvironmentStore::replace` now takes `EnvironmentSettings` directly; `EnvironmentDraft` becomes `{id, settings}`.\n- **Removed unused public API**: `Environment::from_toml_bytes`, `Environment::to_toml_string`, `EnvironmentStoreError::MissingRevision`.\n\n### Dead code purge\n- **Deleted `LegacySandboxMigrationReport`, `migrate_settings_path`, `write_next_backup`, `backup_path_for`, `next_backup_path`, `REMOVAL_NOTE` and the two tests** in the 2026050101 legacy sandbox migration — production goes through `migrate_contents` only via the new 2026052801 migration.\n- **Removed `ResolvedAppStateSettings.manifest_run_settings`** dead field (server resolves it after loading the environment store anyway), plus the now-unused `RunSettingsBuilder`/`SharedError` imports in `serve.rs` and `test_support.rs`.\n\n### Efficiency\n- **Cached `catalog_layer()` as `Arc<MergeMap<EnvironmentLayer>>`** behind a `CatalogState` updated on create/replace/delete. Run create / preflight / graph / validate now just bump a refcount instead of cloning every `Environment` and rebuilding the catalog on each call.\n- **Simplified `write_new`** to a direct `OpenOptions::create_new(true).open(path)` (matches `seed_missing_environments`). Removes the temp + hard_link + cleanup dance and its leak window.\n\n### Quality polish\n- Dropped fake `async` from `EnvironmentStore::list`/`get` (sync `RwLock` reads only).\n- Inlined `resolve_path` into `base_dir.join(path)` (it was reimplementing `Path::join`).\n- Replaced the local `value()` wrapper with `toml_edit::value`.\n- Replaced `Option<PathBuf>` with `&Path` in `parse_persisted` (`from_persisted_path`'s \"memory\" branch is dead now).\n- Extracted `check_revision` helper to eliminate duplicated lock-read + ok_or + revision-compare across `replace` and `delete`.\n- Added small `read_state`/`write_state` accessors to centralize the lock-poisoning expect.\n\n### Config plumbing\n- **Removed the thin `load_settings_path` wrapper** and renamed `load_settings_path_with_source` to `load_settings_path(path, source)`. Each call site now declares its `SettingsSource` explicitly.\n- **Unified the parse-then-validate pattern** behind a single `parse_settings_toml(source, kind)` helper, replacing 11 duplicated `.parse::<SettingsLayer>().map_err(...)?; validate_parsed_source(&layer, ...)?` blocks.\n- Replaced the two scattered match arms in `parse.rs` with named predicates `SettingsSource::runs_settings_migrations` / `forbids_environment_catalog`.\n\n### Verification\n- `cargo nextest run -p fabro-environment -p fabro-config` — 233 passed, 0 failed.\n- `cargo +nightly-2026-04-14 fmt --check --all` — clean.\n- `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` — clean.\n- `cargo build --workspace` — clean.\n\n`fabro-server` retains 34 pre-existing test failures from the failed `implement` step (Task 5 of the original plan, \"Adjust CLI And Manifest Behavior\", was never executed). All share a \"unknown environment: <id>\" root cause: tests that exercise `fabro-manifest::build_run_manifest` directly never seed a server environment catalog. These failures predate this cleanup pass and aren't introduced by it.\n\nFindings not addressed (deferred — would require crate-restructuring beyond a review pass):\n- Sharing `write_atomic`/`temp_path_for`/`id_from_path`/etc. with the identical helpers in `fabro-automation` (would need a new shared util crate).\n- Sharing the slug validator and SHA-256 revision type between `fabro-environment` and `fabro-automation` (cycle if extracted to fabro-config; would need a `fabro-util` extraction).\n- Sharing `ensure_table` between `fabro-environment::model` and the legacy migration.\n- Making `StickyMap`'s `Serialize` deterministic so `canonical_bytes` could collapse into `toml::to_string_pretty(layer)`.",
          "internal.retry_count.implement": 0,
          "last_response": "Implemented cleanup fixes from the review pass.\n\nWhat I changed:\n- Replaced blocking Dockerfile reads on async environment create/replace paths with `tokio::fs::read_to_string`.\n- Threaded the server ",
          "graph.goal": "# Server-Owned Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Move environment definitions from layered run settings into server-owned TOML resources with CRUD API management, matching the Automation store pattern.\n\n**Architecture:** Add a concrete `EnvironmentStore` that loads one environment TOML file per id from a sibling `environments/` directory next to the active server settings file. Runs continue to select an environment by id through `[run.environment]` or `--environment`, but server-side run creation resolves the id from `EnvironmentStore`; project/workflow/user config can no longer define environment catalogs or environment field overrides. The web UI is intentionally deferred.\n\n**Tech Stack:** Rust, Axum, serde/TOML, `toml_edit`, Tokio file I/O, OpenAPI/progenitor, generated TypeScript API client, cargo-nextest.\n\n---\n\n## File Structure\n\n- Create `lib/crates/fabro-environment/`: environment ids, revisions, API/domain DTOs, TOML persistence, canonicalization, validation, and `EnvironmentStore`.\n- Modify workspace manifests: root `Cargo.toml`, `lib/crates/fabro-server/Cargo.toml`, `lib/crates/fabro-api/build.rs`, and generated API/client package files.\n- Modify `lib/crates/fabro-server/src/server.rs`, `lib/crates/fabro-server/src/server/handler/mod.rs`, and a new `lib/crates/fabro-server/src/server/handler/environments.rs` to wire the store and API.\n- Modify `lib/crates/fabro-config/src/builders.rs`, `lib/crates/fabro-config/src/load.rs`, `lib/crates/fabro-config/src/migrations.rs`, and config tests to treat `[environments]` as migration-only, not runtime configuration.\n- Modify `lib/crates/fabro-manifest/src/lib.rs`, `lib/crates/fabro-server/src/run_manifest.rs`, and CLI run/preflight/graph/validate paths so environment ids are resolved only by the server.\n- Modify install/repo-init/docs/OpenAPI artifacts so new examples use server environment files and run configs only select ids.\n\n## Decisions\n\n- Environment definitions are server-owned operator policy. Project and workflow files may request an id but cannot define or override environment fields.\n- `default`, `local`, `docker`, and `daytona` are seeded if missing. Existing files are never overwritten.\n- `default` is protected from deletion. Other seeded files can be edited or deleted.\n- Environment ids use `[a-z0-9][a-z0-9-]{0,62}`.\n- Environment revisions are SHA-256 hashes of the persisted TOML bytes, returned in JSON as `revision` and in `ETag`.\n- `PUT` and `DELETE` require `If-Match`, following `AutomationStore`.\n- `image.dockerfile = { path = \"Dockerfile\" }` is accepted in persisted files and API input, resolved relative to the environment file or request context, and converted to inline content for runtime use. API writes canonical inline TOML.\n- `--preserve-sandbox` remains a CLI/server argument override. TOML `[run.environment.lifecycle]` is rejected.\n- `--docker-image` is rejected with a targeted message directing operators to create or update a server environment.\n- Existing dense `WorkflowSettings.environments` stays in the API for compatibility and is populated from the server environment catalog during run resolution.\n\n## Task 1: Add `fabro-environment` Store Crate\n\n**Files:**\n- Create: `lib/crates/fabro-environment/Cargo.toml`\n- Create: `lib/crates/fabro-environment/src/lib.rs`\n- Create: `lib/crates/fabro-environment/src/id.rs`\n- Create: `lib/crates/fabro-environment/src/model.rs`\n- Create: `lib/crates/fabro-environment/src/store.rs`\n- Create: `lib/crates/fabro-environment/src/error.rs`\n- Modify: root `Cargo.toml`\n\n- [ ] Create a workspace crate named `fabro-environment`, modeled after `fabro-automation`.\n- [ ] Define `EnvironmentId`, `EnvironmentRevision`, and parse/validation errors.\n- [ ] Define public DTOs:\n  - `Environment`: `id`, `revision`, `provider`, `image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, `env`.\n  - `EnvironmentDraft`: `id` plus environment fields.\n  - `EnvironmentReplace`: environment fields without id.\n- [ ] Use the existing environment field types from `fabro_types::settings::run` for dense API fields.\n- [ ] Use existing sparse `fabro_config::EnvironmentLayer` only for TOML input/output and conversion; do not create a second environment field vocabulary.\n- [ ] Add conversion helpers that resolve an `EnvironmentLayer` into dense `EnvironmentSettings` using the same provider/network/image validation rules as `fabro-config`.\n- [ ] Implement canonical TOML serialization for persisted files. Omit `id` and `revision`; the filename is the id and the file bytes determine revision.\n- [ ] Implement `EnvironmentStore` with `load_or_seed(dir)`, `list`, `get`, `create`, `replace`, `delete`, and `catalog_layer`.\n- [ ] Seed missing `default`, `local`, `docker`, and `daytona` files from the current built-in defaults. Do not overwrite existing files.\n- [ ] Protect `default` from deletion with a typed store error.\n- [ ] Resolve Dockerfile path references relative to the environment file directory during load and relative to the active settings directory during API create/replace. Store runtime values with inline Dockerfile content.\n- [ ] Add unit tests for loading an absent directory, seeding built-ins, sorted listing, invalid ids, invalid provider, invalid network mode, missing Dockerfile path, create conflict, replace stale revision, default delete rejection, delete success, and canonical revision changes.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-environment\n```\n\nExpected: all `fabro-environment` tests pass.\n\n## Task 2: Make Config Environments Migration-Only\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/parse.rs`\n- Modify: `lib/crates/fabro-config/src/builders.rs`\n- Modify: `lib/crates/fabro-config/src/load.rs`\n- Modify: `lib/crates/fabro-config/src/migrations.rs`\n- Create: `lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs`\n- Modify: `lib/crates/fabro-config/src/defaults.toml`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_run.rs`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_root.rs`\n\n- [ ] Keep `SettingsLayer.environments` in this pass so old files can parse and migrate, but remove environment catalog entries from `defaults.toml`.\n- [ ] Add source-aware validation that rejects `SettingsLayer.environments` for project, workflow, and direct run config layers with this message shape: `[environments.<id>] is now server-managed; move this definition to the server environments directory`.\n- [ ] Add validation that rejects TOML-provided `run.environment.image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, and `env`. Keep `run.environment.id`.\n- [ ] Ensure CLI/server argument layers can still set `run.environment.lifecycle.preserve` for `--preserve-sandbox`; the rejection applies only to parsed TOML sources.\n- [ ] Add a settings-file migration that extracts top-level `[environments.<id>]` entries from the active `settings.toml` into sibling `environments/<id>.toml` files.\n- [ ] Migration must write a backup before editing `settings.toml`, preserve `[run.environment] id`, remove the top-level `[environments]` table, and fail without changing files if any target environment file already exists.\n- [ ] Chain the existing legacy `[run.sandbox]` migration before the new extraction migration so legacy sandbox settings become a server `default` environment file.\n- [ ] Update run settings tests to assert that `RunSettingsBuilder` no longer resolves a selected environment without an injected server catalog.\n- [ ] Add tests proving project/workflow `[environments]` definitions produce targeted errors rather than silent ignores.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-config\n```\n\nExpected: config tests pass, including migration coverage.\n\n## Task 3: Wire EnvironmentStore Into Server Run Resolution\n\n**Files:**\n- Modify: `lib/crates/fabro-server/src/server.rs`\n- Modify: `lib/crates/fabro-server/src/serve.rs`\n- Modify: `lib/crates/fabro-server/src/run_manifest.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/runs.rs`\n- Modify: `lib/crates/fabro-server/src/manifest_validation.rs`\n- Modify: `lib/crates/fabro-server/src/test_support.rs`\n\n- [ ] Add `environment_store: Arc<EnvironmentStore>` to `AppState`, loaded from `active_config_path.parent().join(\"environments\")`.\n- [ ] Replace `manifest_environment_defaults` from `ServerRuntimeSettings` with `environment_store.catalog_layer()` when preparing manifests on the server.\n- [ ] Keep the dense run snapshot unchanged: `prepared.settings.run.environment` contains the resolved environment fields, and `prepared.settings.environments` contains the server catalog used for resolution.\n- [ ] Convert unknown environment ids into `400 Bad Request` during run creation/preflight/graph preparation.\n- [ ] Keep sandbox provider policy checks after environment resolution, so disabled providers still reject runs.\n- [ ] Apply `--preserve-sandbox` after selected environment resolution.\n- [ ] Remove server reliance on `[environments]` in `settings.toml`.\n- [ ] Update server test support so tests can inject environment files or use seeded defaults.\n- [ ] Add server tests for default environment run creation, custom server environment selection, unknown environment id, disabled provider policy, `--preserve-sandbox`, and rejected TOML environment field overrides.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server\n```\n\nExpected: server API and run-manifest tests pass.\n\n## Task 4: Add Environment CRUD API\n\n**Files:**\n- Modify: `docs/public/api-reference/fabro-api.yaml`\n- Modify: `lib/crates/fabro-api/build.rs`\n- Create: `lib/crates/fabro-server/src/server/handler/environments.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/mod.rs`\n- Add tests: `lib/crates/fabro-server/tests/it/api/environments.rs`\n- Update generated Rust and TypeScript API artifacts after spec changes.\n\n- [ ] Add OpenAPI tag `Environments`.\n- [ ] Add schemas for `Environment`, `CreateEnvironmentRequest`, `ReplaceEnvironmentRequest`, and `EnvironmentListResponse`.\n- [ ] Reuse existing environment schemas for provider/image/resources/network/lifecycle/volumes/env.\n- [ ] Add endpoints:\n  - `GET /api/v1/environments`\n  - `POST /api/v1/environments`\n  - `GET /api/v1/environments/{id}`\n  - `PUT /api/v1/environments/{id}`\n  - `DELETE /api/v1/environments/{id}`\n- [ ] Return `ETag` on retrieve and replace.\n- [ ] Require `If-Match` on replace and delete.\n- [ ] Map store errors to API responses:\n  - invalid id: `400`\n  - duplicate create: `409`\n  - stale revision: `409`\n  - validation error: `422`\n  - missing resource: `404`\n  - protected default delete: `409`\n  - persistence failure: `500`\n- [ ] Add route tests for empty-seeded list, create, retrieve with ETag, replace, stale replace, missing `If-Match`, delete, protected default delete, invalid provider, invalid CIDR, and missing Dockerfile path.\n- [ ] Regenerate `fabro-api` and TypeScript client artifacts.\n\nRun:\n\n```bash\ncargo build -p fabro-api\ncd lib/packages/fabro-api-client && bun run generate\ncargo nextest run -p fabro-server --test it -- api::environments\n```\n\nExpected: generated artifacts are updated and environment API tests pass.\n\n## Task 5: Adjust CLI And Manifest Behavior\n\n**Files:**\n- Modify: `lib/crates/fabro-cli/src/commands/run/overrides.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/preflight.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/graph.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/validate.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/repo/init.rs`\n- Modify: `lib/crates/fabro-manifest/src/lib.rs`\n- Modify CLI integration tests under `lib/crates/fabro-cli/tests/it/`\n\n- [ ] Reject `--docker-image` in run, create, preflight, graph, and validate commands with this message shape: `--docker-image is no longer supported; create or update a server environment and select it with --environment`.\n- [ ] Keep `--environment` as an id-only selector in manifest args.\n- [ ] Stop collecting Dockerfile path references from `[environments.<id>]` in project/workflow config because those definitions are invalid.\n- [ ] Keep collecting Dockerfile references for any remaining CLI-created run environment override only when it comes from allowed argument paths; with `--docker-image` rejected, no normal user path should add one.\n- [ ] Update local preflight/graph/validate flows so they either call server preflight for environment resolution or print a clear message that server-owned environment resolution requires a running server.\n- [ ] Update `fabro repo init` to write only `[run.environment] id = \"local\"` and no `[environments.local]` block.\n- [ ] Update CLI tests for manifest args, repo init output, rejected `--docker-image`, and server-owned environment selection.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-cli\n```\n\nExpected: CLI tests pass and no generated workflow config contains `[environments.*]`.\n\n## Task 6: Update Install, Docs, And Generated References\n\n**Files:**\n- Modify install persistence code in `lib/crates/fabro-cli/src/commands/install.rs` and server install handlers/tests.\n- Modify docs: `docs/public/execution/environments.mdx`, `docs/public/execution/run-configuration.mdx`, `docs/public/reference/user-configuration.mdx`, `docs/public/administration/server-configuration.mdx`, `docs/public/administration/sandboxing.mdx`, `docs/public/integrations/daytona.mdx`, and examples that currently define `[environments.<id>]`.\n- Modify generated settings reference if applicable.\n\n- [ ] Update install flows to write server environment files instead of `[environments.default]` into `settings.toml`.\n- [ ] Keep install-written `[run.environment] id = \"default\"` when a default run environment selection is still needed.\n- [ ] Update tests that assert `settings.toml` contains `[environments.default]` to assert the sibling environment file exists and settings no longer contains `[environments]`.\n- [ ] Rewrite public docs so environment definitions are server-owned TOML files and run configs only select ids.\n- [ ] Add a compatibility note explaining that project/workflow `[environments]` definitions now fail and must be moved to the server.\n- [ ] Keep `Settings > Environments` UI documentation out of this pass.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server --test it -- api::install\ncargo nextest run -p fabro-cli --test it\n```\n\nExpected: install tests pass and docs no longer present project/workflow environment definitions as valid.\n\n## Task 7: Workspace Verification\n\n**Files:**\n- No new files unless test snapshots require reviewed updates.\n\n- [ ] Run Rust formatting check:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\n```\n\n- [ ] Run clippy:\n\n```bash\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\n- [ ] Run workspace tests:\n\n```bash\ncargo nextest run --workspace\n```\n\n- [ ] Run TypeScript checks if API client changes affect the web package:\n\n```bash\ncd apps/fabro-web && bun run typecheck\ncd apps/fabro-web && bun test\n```\n\n- [ ] Inspect generated files and snapshots before accepting any snapshot changes.\n\n## Acceptance Criteria\n\n- Server startup creates or loads `environments/default.toml`, `local.toml`, `docker.toml`, and `daytona.toml`.\n- `GET /api/v1/environments` returns seeded environments with revisions.\n- API-created environments persist as TOML files and survive server restart.\n- Runs using `[run.environment] id = \"cloud\"` resolve from server files only.\n- Project/workflow/user `[environments.<id>]` definitions no longer affect runs.\n- Existing runs keep their dense environment snapshot after environment files change.\n- `--environment` still works.\n- `--preserve-sandbox` still works.\n- `--docker-image` no longer works and produces the targeted replacement guidance.\n- Web UI changes are not included.\n",
          "current_node": "verify",
          "internal.retry_count.start": 0,
          "outcome": "failed",
          "internal.fidelity": "compact",
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
          "internal.retry_count.preflight_compile": 0,
          "internal.retry_count.simplify_opus": 0,
          "internal.retry_count.toolchain": 0,
          "command.output": "blob://sha256/bd66f55933ad7ab0b5c80315118e9cea320280cbfe5e73ec827b138787eff393"
        },
        "node_outcomes": {
          "preflight_lint": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 143203,
              "active_time_ms": 143203
            }
          },
          "implement": {
            "status": "failed",
            "failure": {
              "message": "LLM error: Invalid request to openai: No tool call found for function call output with call_id call_DUxNRWlboQi3OOOvhg0NhD3h.",
              "category": "deterministic",
              "signature": "api_deterministic|openai|invalid_request"
            },
            "usage": null
          },
          "simplify_opus": {
            "status": "succeeded",
            "context_updates": {
              "last_stage": "simplify_opus",
              "last_response": "Workspace builds clean. Let me summarize what was done.\n\n## Summary\n\nReviewed the `fabro-environment` crate addition and related fabro-config/fabro-server changes against three concurrent agents (reus",
              "response.simplify_opus": "Workspace builds clean. Let me summarize what was done.\n\n## Summary\n\nReviewed the `fabro-environment` crate addition and related fabro-config/fabro-server changes against three concurrent agents (reuse, quality, efficiency) and applied the highest-impact fixes:\n\n### Type / API surface cleanup\n- **Collapsed `Environment` to `{id, revision, settings: EnvironmentSettings}`** — eliminated the parallel flat-field copy, `settings()`, `from_validated_settings`, and the eight clone fields. `Environment.settings` is now a single owned `EnvironmentSettings`.\n- **Deleted `EnvironmentReplace`** — it was field-identical to `EnvironmentSettings` with no API consumer. `EnvironmentStore::replace` now takes `EnvironmentSettings` directly; `EnvironmentDraft` becomes `{id, settings}`.\n- **Removed unused public API**: `Environment::from_toml_bytes`, `Environment::to_toml_string`, `EnvironmentStoreError::MissingRevision`.\n\n### Dead code purge\n- **Deleted `LegacySandboxMigrationReport`, `migrate_settings_path`, `write_next_backup`, `backup_path_for`, `next_backup_path`, `REMOVAL_NOTE` and the two tests** in the 2026050101 legacy sandbox migration — production goes through `migrate_contents` only via the new 2026052801 migration.\n- **Removed `ResolvedAppStateSettings.manifest_run_settings`** dead field (server resolves it after loading the environment store anyway), plus the now-unused `RunSettingsBuilder`/`SharedError` imports in `serve.rs` and `test_support.rs`.\n\n### Efficiency\n- **Cached `catalog_layer()` as `Arc<MergeMap<EnvironmentLayer>>`** behind a `CatalogState` updated on create/replace/delete. Run create / preflight / graph / validate now just bump a refcount instead of cloning every `Environment` and rebuilding the catalog on each call.\n- **Simplified `write_new`** to a direct `OpenOptions::create_new(true).open(path)` (matches `seed_missing_environments`). Removes the temp + hard_link + cleanup dance and its leak window.\n\n### Quality polish\n- Dropped fake `async` from `EnvironmentStore::list`/`get` (sync `RwLock` reads only).\n- Inlined `resolve_path` into `base_dir.join(path)` (it was reimplementing `Path::join`).\n- Replaced the local `value()` wrapper with `toml_edit::value`.\n- Replaced `Option<PathBuf>` with `&Path` in `parse_persisted` (`from_persisted_path`'s \"memory\" branch is dead now).\n- Extracted `check_revision` helper to eliminate duplicated lock-read + ok_or + revision-compare across `replace` and `delete`.\n- Added small `read_state`/`write_state` accessors to centralize the lock-poisoning expect.\n\n### Config plumbing\n- **Removed the thin `load_settings_path` wrapper** and renamed `load_settings_path_with_source` to `load_settings_path(path, source)`. Each call site now declares its `SettingsSource` explicitly.\n- **Unified the parse-then-validate pattern** behind a single `parse_settings_toml(source, kind)` helper, replacing 11 duplicated `.parse::<SettingsLayer>().map_err(...)?; validate_parsed_source(&layer, ...)?` blocks.\n- Replaced the two scattered match arms in `parse.rs` with named predicates `SettingsSource::runs_settings_migrations` / `forbids_environment_catalog`.\n\n### Verification\n- `cargo nextest run -p fabro-environment -p fabro-config` — 233 passed, 0 failed.\n- `cargo +nightly-2026-04-14 fmt --check --all` — clean.\n- `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` — clean.\n- `cargo build --workspace` — clean.\n\n`fabro-server` retains 34 pre-existing test failures from the failed `implement` step (Task 5 of the original plan, \"Adjust CLI And Manifest Behavior\", was never executed). All share a \"unknown environment: <id>\" root cause: tests that exercise `fabro-manifest::build_run_manifest` directly never seed a server environment catalog. These failures predate this cleanup pass and aren't introduced by it.\n\nFindings not addressed (deferred — would require crate-restructuring beyond a review pass):\n- Sharing `write_atomic`/`temp_path_for`/`id_from_path`/etc. with the identical helpers in `fabro-automation` (would need a new shared util crate).\n- Sharing the slug validator and SHA-256 revision type between `fabro-environment` and `fabro-automation` (cycle if extracted to fabro-config; would need a `fabro-util` extraction).\n- Sharing `ensure_table` between `fabro-environment::model` and the legacy migration.\n- Making `StickyMap`'s `Serialize` deterministic so `canonical_bytes` could collapse into `toml::to_string_pretty(layer)`."
            },
            "notes": "Stage completed: simplify_opus",
            "usage": {
              "input": {
                "usage": {
                  "model": {
                    "provider": "anthropic",
                    "model_id": "claude-opus-4-7"
                  },
                  "tokens": {
                    "input_tokens": 262080,
                    "output_tokens": 89618,
                    "reasoning_tokens": 0,
                    "cache_read_tokens": 44336839,
                    "cache_write_tokens": 4410068
                  }
                },
                "facts": {
                  "algorithm": "anthropic",
                  "cache_write_5m_tokens": 4410068,
                  "cache_write_1h_tokens": 0
                }
              },
              "total_usd_micros": 53282194
            },
            "files_touched": [
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/migrations/2026050101_legacy_sandbox_to_environments.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/builders.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/load.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/parse.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/project.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/resolve/mod.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/run.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/user.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/error.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/lib.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/model.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/store.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/run_manifest.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/serve.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/server.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/server/handler/graph.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/test_support.rs"
            ],
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 1449354,
              "tool_time_ms": 794439,
              "active_time_ms": 2243793
            }
          },
          "start": {
            "status": "succeeded",
            "usage": null
          },
          "verify": {
            "status": "failed",
            "context_updates": {
              "command.output": "blob://sha256/bd66f55933ad7ab0b5c80315118e9cea320280cbfe5e73ec827b138787eff393"
            },
            "failure": {
              "message": "Script failed with exit code: 1\n\n## output\nes/fabro-server)\n   Compiling fabro-cli v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-cli)\n   Compiling globset v0.4.18\n   Compiling rust-embed-utils v8.11.0\n   Compiling rust-embed v8.11.0\n   Compiling fabro-model v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-model)\n   Compiling fabro-spa v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-spa)\n   Compiling fabro-types v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-types)\n   Compiling fabro-oauth v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-oauth)\n   Compiling axum-extra v0.10.3\n   Compiling fabro-config v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-config)\n   Compiling fabro-github v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-github)\n   Compiling fabro-vault v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-vault)\n   Compiling fabro-store v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-store)\n   Compiling fabro-graphviz v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-graphviz)\n   Compiling fabro-template v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-template)\n   Compiling fabro-core v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-core)\n   Compiling fabro-auth v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-auth)\n   Compiling fabro-interview v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-interview)\n   Compiling fabro-variable v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-variable)\n   Compiling fabro-llm v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-llm)\n   Compiling fabro-dump v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-dump)\n   Compiling fabro-sandbox v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-sandbox)\n   Compiling fabro-api v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-api)\n   Compiling fabro-mcp v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-mcp)\n   Compiling fabro-checkpoint v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-checkpoint)\n   Compiling fabro-environment v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-environment)\n   Compiling fabro-install v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-install)\n   Compiling fabro-agent v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-agent)\n   Compiling fabro-acp v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-acp)\n   Compiling fabro-validate v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-validate)\n   Compiling fabro-client v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-client)\n   Compiling fabro-hooks v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-hooks)\n   Compiling fabro-tool v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-tool)\n   Compiling fabro-workflow v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-workflow)\n   Compiling fabro-slack v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-slack)\n   Compiling fabro-manifest v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-manifest)\n   Compiling fabro-mcp-server v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-mcp-server)\nerror[E0063]: missing field `environment_defaults` in initializer of `ManifestBuildInput`\n  --> lib/crates/fabro-cli/src/commands/run/create.rs:43:40\n   |\n43 |     let mut built = build_run_manifest(ManifestBuildInput {\n   |                                        ^^^^^^^^^^^^^^^^^^ missing `environment_defaults`\n\nFor more information about this error, try `rustc --explain E0063`.\nerror: could not compile `fabro-cli` (bin \"fabro\") due to 1 previous error\n",
              "category": "deterministic"
            },
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 74703,
              "active_time_ms": 74703
            }
          },
          "simplify_gpt": {
            "status": "succeeded",
            "context_updates": {
              "response.simplify_gpt": "Implemented cleanup fixes from the review pass.\n\nWhat I changed:\n- Replaced blocking Dockerfile reads on async environment create/replace paths with `tokio::fs::read_to_string`.\n- Threaded the server `EnvironmentStore` catalog into automation manifest materialization so automation-created manifests resolve server-owned environments.\n- Added environment catalog injection to manifest/server tests that now require server-owned environment resolution.\n- Updated obsolete tests that expected project `[environments.*]` Dockerfile bundling to instead assert the new targeted server-managed error.\n- Fixed clippy issues:\n  - imported async fs path instead of absolute `tokio::fs`.\n  - removed stale `RunSettingsBuilder` usage/import.\n  - restored non-test `ServerDaemon` import.\n  - used explicit `MergeMap::<EnvironmentLayer>::default()`.\n\nValidation run:\n- `cargo +nightly-2026-04-14 fmt --check --all` ✅\n- `cargo +nightly-2026-04-14 clippy -q -p fabro-environment -p fabro-manifest -p fabro-server --all-targets -- -D warnings` ✅\n- `cargo nextest run -p fabro-environment` ✅\n- `cargo nextest run -p fabro-config` ✅\n- `cargo nextest run -p fabro-manifest` ✅\n- `cargo nextest run -p fabro-server` ✅\n\nNote: the parallel subagents completed, but their tool responses did not expose visible findings in this environment, so I performed the targeted review directly and fixed the concrete issues found.",
              "last_stage": "simplify_gpt",
              "last_response": "Implemented cleanup fixes from the review pass.\n\nWhat I changed:\n- Replaced blocking Dockerfile reads on async environment create/replace paths with `tokio::fs::read_to_string`.\n- Threaded the server "
            },
            "notes": "Stage completed: simplify_gpt",
            "usage": {
              "input": {
                "usage": {
                  "model": {
                    "provider": "openai",
                    "model_id": "gpt-5.5"
                  },
                  "tokens": {
                    "input_tokens": 1401292,
                    "output_tokens": 14865,
                    "reasoning_tokens": 5183,
                    "cache_read_tokens": 9071616,
                    "cache_write_tokens": 0
                  }
                },
                "facts": {
                  "algorithm": "openai"
                }
              },
              "total_usd_micros": 12143708
            },
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 700782,
              "tool_time_ms": 547781,
              "active_time_ms": 1248563
            }
          },
          "preflight_compile": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo check -q --workspace 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 131121,
              "active_time_ms": 131121
            }
          },
          "toolchain": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
            },
            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 1316,
              "active_time_ms": 1316
            }
          }
        },
        "next_node_id": "fixup",
        "git_commit_sha": "8e891798a029eeed2eeff8305c17c2e6f549f440",
        "loop_failure_signatures": {
          "verify|deterministic|script failed with exit code: <n> ## output es/fabro-server) compiling fabro-cli v0.<n>.<n>-nightly.<n> (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-cli) compiling globset v0.<n>.<n> compiling rust-embed-utils v8.<n>.<n> compiling r": 1,
          "implement|deterministic|api_deterministic|openai|invalid_request": 1
        },
        "node_visits": {
          "toolchain": 1,
          "verify": 1,
          "preflight_compile": 1,
          "simplify_gpt": 1,
          "implement": 1,
          "preflight_lint": 1,
          "simplify_opus": 1,
          "start": 1
        }
      },
      "diff": {
        "patch": "diff --git a/apps/fabro-web/app/routes/runs.tsx b/apps/fabro-web/app/routes/runs.tsx\nindex 10e40c04c..7da0719ea 100644\n--- a/apps/fabro-web/app/routes/runs.tsx\n+++ b/apps/fabro-web/app/routes/runs.tsx\n@@ -871,7 +871,11 @@ export default function Runs() {\n \n           {view === \"columns\" ? (\n             <>\n-              <div className=\"flex min-h-0 flex-1 gap-5 overflow-x-auto pb-4\">\n+              <div\n+                className={`flex min-h-0 gap-5 overflow-x-auto pb-4 ${\n+                  isLandingReady && totalRuns === 0 ? \"\" : \"flex-1\"\n+                }`}\n+              >\n                 {visibleColumns.map((col) => (\n                   <div key={col.id} className=\"w-72 shrink-0\">\n                     <BoardColumnView column={col} />\n",
        "summary": {
          "files_changed": 40,
          "additions": 2333,
          "deletions": 535
        }
      }
    },
    {
      "seq": 0,
      "checkpoint": {
        "timestamp": "2026-05-28T06:46:59.348944Z",
        "current_node": "fixup",
        "completed_nodes": [
          "start",
          "toolchain",
          "preflight_compile",
          "preflight_lint",
          "implement",
          "simplify_opus",
          "simplify_gpt",
          "verify",
          "fixup"
        ],
        "node_retries": {},
        "context_values": {
          "response.simplify_gpt": "Implemented cleanup fixes from the review pass.\n\nWhat I changed:\n- Replaced blocking Dockerfile reads on async environment create/replace paths with `tokio::fs::read_to_string`.\n- Threaded the server `EnvironmentStore` catalog into automation manifest materialization so automation-created manifests resolve server-owned environments.\n- Added environment catalog injection to manifest/server tests that now require server-owned environment resolution.\n- Updated obsolete tests that expected project `[environments.*]` Dockerfile bundling to instead assert the new targeted server-managed error.\n- Fixed clippy issues:\n  - imported async fs path instead of absolute `tokio::fs`.\n  - removed stale `RunSettingsBuilder` usage/import.\n  - restored non-test `ServerDaemon` import.\n  - used explicit `MergeMap::<EnvironmentLayer>::default()`.\n\nValidation run:\n- `cargo +nightly-2026-04-14 fmt --check --all` ✅\n- `cargo +nightly-2026-04-14 clippy -q -p fabro-environment -p fabro-manifest -p fabro-server --all-targets -- -D warnings` ✅\n- `cargo nextest run -p fabro-environment` ✅\n- `cargo nextest run -p fabro-config` ✅\n- `cargo nextest run -p fabro-manifest` ✅\n- `cargo nextest run -p fabro-server` ✅\n\nNote: the parallel subagents completed, but their tool responses did not expose visible findings in this environment, so I performed the targeted review directly and fixed the concrete issues found.",
          "thread.verify.current_node": "fixup",
          "current_node": "fixup",
          "thread.implement.current_node": "simplify_opus",
          "graph.goal": "# Server-Owned Environments Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Move environment definitions from layered run settings into server-owned TOML resources with CRUD API management, matching the Automation store pattern.\n\n**Architecture:** Add a concrete `EnvironmentStore` that loads one environment TOML file per id from a sibling `environments/` directory next to the active server settings file. Runs continue to select an environment by id through `[run.environment]` or `--environment`, but server-side run creation resolves the id from `EnvironmentStore`; project/workflow/user config can no longer define environment catalogs or environment field overrides. The web UI is intentionally deferred.\n\n**Tech Stack:** Rust, Axum, serde/TOML, `toml_edit`, Tokio file I/O, OpenAPI/progenitor, generated TypeScript API client, cargo-nextest.\n\n---\n\n## File Structure\n\n- Create `lib/crates/fabro-environment/`: environment ids, revisions, API/domain DTOs, TOML persistence, canonicalization, validation, and `EnvironmentStore`.\n- Modify workspace manifests: root `Cargo.toml`, `lib/crates/fabro-server/Cargo.toml`, `lib/crates/fabro-api/build.rs`, and generated API/client package files.\n- Modify `lib/crates/fabro-server/src/server.rs`, `lib/crates/fabro-server/src/server/handler/mod.rs`, and a new `lib/crates/fabro-server/src/server/handler/environments.rs` to wire the store and API.\n- Modify `lib/crates/fabro-config/src/builders.rs`, `lib/crates/fabro-config/src/load.rs`, `lib/crates/fabro-config/src/migrations.rs`, and config tests to treat `[environments]` as migration-only, not runtime configuration.\n- Modify `lib/crates/fabro-manifest/src/lib.rs`, `lib/crates/fabro-server/src/run_manifest.rs`, and CLI run/preflight/graph/validate paths so environment ids are resolved only by the server.\n- Modify install/repo-init/docs/OpenAPI artifacts so new examples use server environment files and run configs only select ids.\n\n## Decisions\n\n- Environment definitions are server-owned operator policy. Project and workflow files may request an id but cannot define or override environment fields.\n- `default`, `local`, `docker`, and `daytona` are seeded if missing. Existing files are never overwritten.\n- `default` is protected from deletion. Other seeded files can be edited or deleted.\n- Environment ids use `[a-z0-9][a-z0-9-]{0,62}`.\n- Environment revisions are SHA-256 hashes of the persisted TOML bytes, returned in JSON as `revision` and in `ETag`.\n- `PUT` and `DELETE` require `If-Match`, following `AutomationStore`.\n- `image.dockerfile = { path = \"Dockerfile\" }` is accepted in persisted files and API input, resolved relative to the environment file or request context, and converted to inline content for runtime use. API writes canonical inline TOML.\n- `--preserve-sandbox` remains a CLI/server argument override. TOML `[run.environment.lifecycle]` is rejected.\n- `--docker-image` is rejected with a targeted message directing operators to create or update a server environment.\n- Existing dense `WorkflowSettings.environments` stays in the API for compatibility and is populated from the server environment catalog during run resolution.\n\n## Task 1: Add `fabro-environment` Store Crate\n\n**Files:**\n- Create: `lib/crates/fabro-environment/Cargo.toml`\n- Create: `lib/crates/fabro-environment/src/lib.rs`\n- Create: `lib/crates/fabro-environment/src/id.rs`\n- Create: `lib/crates/fabro-environment/src/model.rs`\n- Create: `lib/crates/fabro-environment/src/store.rs`\n- Create: `lib/crates/fabro-environment/src/error.rs`\n- Modify: root `Cargo.toml`\n\n- [ ] Create a workspace crate named `fabro-environment`, modeled after `fabro-automation`.\n- [ ] Define `EnvironmentId`, `EnvironmentRevision`, and parse/validation errors.\n- [ ] Define public DTOs:\n  - `Environment`: `id`, `revision`, `provider`, `image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, `env`.\n  - `EnvironmentDraft`: `id` plus environment fields.\n  - `EnvironmentReplace`: environment fields without id.\n- [ ] Use the existing environment field types from `fabro_types::settings::run` for dense API fields.\n- [ ] Use existing sparse `fabro_config::EnvironmentLayer` only for TOML input/output and conversion; do not create a second environment field vocabulary.\n- [ ] Add conversion helpers that resolve an `EnvironmentLayer` into dense `EnvironmentSettings` using the same provider/network/image validation rules as `fabro-config`.\n- [ ] Implement canonical TOML serialization for persisted files. Omit `id` and `revision`; the filename is the id and the file bytes determine revision.\n- [ ] Implement `EnvironmentStore` with `load_or_seed(dir)`, `list`, `get`, `create`, `replace`, `delete`, and `catalog_layer`.\n- [ ] Seed missing `default`, `local`, `docker`, and `daytona` files from the current built-in defaults. Do not overwrite existing files.\n- [ ] Protect `default` from deletion with a typed store error.\n- [ ] Resolve Dockerfile path references relative to the environment file directory during load and relative to the active settings directory during API create/replace. Store runtime values with inline Dockerfile content.\n- [ ] Add unit tests for loading an absent directory, seeding built-ins, sorted listing, invalid ids, invalid provider, invalid network mode, missing Dockerfile path, create conflict, replace stale revision, default delete rejection, delete success, and canonical revision changes.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-environment\n```\n\nExpected: all `fabro-environment` tests pass.\n\n## Task 2: Make Config Environments Migration-Only\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/parse.rs`\n- Modify: `lib/crates/fabro-config/src/builders.rs`\n- Modify: `lib/crates/fabro-config/src/load.rs`\n- Modify: `lib/crates/fabro-config/src/migrations.rs`\n- Create: `lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs`\n- Modify: `lib/crates/fabro-config/src/defaults.toml`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_run.rs`\n- Modify: `lib/crates/fabro-config/src/tests/resolve_root.rs`\n\n- [ ] Keep `SettingsLayer.environments` in this pass so old files can parse and migrate, but remove environment catalog entries from `defaults.toml`.\n- [ ] Add source-aware validation that rejects `SettingsLayer.environments` for project, workflow, and direct run config layers with this message shape: `[environments.<id>] is now server-managed; move this definition to the server environments directory`.\n- [ ] Add validation that rejects TOML-provided `run.environment.image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, and `env`. Keep `run.environment.id`.\n- [ ] Ensure CLI/server argument layers can still set `run.environment.lifecycle.preserve` for `--preserve-sandbox`; the rejection applies only to parsed TOML sources.\n- [ ] Add a settings-file migration that extracts top-level `[environments.<id>]` entries from the active `settings.toml` into sibling `environments/<id>.toml` files.\n- [ ] Migration must write a backup before editing `settings.toml`, preserve `[run.environment] id`, remove the top-level `[environments]` table, and fail without changing files if any target environment file already exists.\n- [ ] Chain the existing legacy `[run.sandbox]` migration before the new extraction migration so legacy sandbox settings become a server `default` environment file.\n- [ ] Update run settings tests to assert that `RunSettingsBuilder` no longer resolves a selected environment without an injected server catalog.\n- [ ] Add tests proving project/workflow `[environments]` definitions produce targeted errors rather than silent ignores.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-config\n```\n\nExpected: config tests pass, including migration coverage.\n\n## Task 3: Wire EnvironmentStore Into Server Run Resolution\n\n**Files:**\n- Modify: `lib/crates/fabro-server/src/server.rs`\n- Modify: `lib/crates/fabro-server/src/serve.rs`\n- Modify: `lib/crates/fabro-server/src/run_manifest.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/runs.rs`\n- Modify: `lib/crates/fabro-server/src/manifest_validation.rs`\n- Modify: `lib/crates/fabro-server/src/test_support.rs`\n\n- [ ] Add `environment_store: Arc<EnvironmentStore>` to `AppState`, loaded from `active_config_path.parent().join(\"environments\")`.\n- [ ] Replace `manifest_environment_defaults` from `ServerRuntimeSettings` with `environment_store.catalog_layer()` when preparing manifests on the server.\n- [ ] Keep the dense run snapshot unchanged: `prepared.settings.run.environment` contains the resolved environment fields, and `prepared.settings.environments` contains the server catalog used for resolution.\n- [ ] Convert unknown environment ids into `400 Bad Request` during run creation/preflight/graph preparation.\n- [ ] Keep sandbox provider policy checks after environment resolution, so disabled providers still reject runs.\n- [ ] Apply `--preserve-sandbox` after selected environment resolution.\n- [ ] Remove server reliance on `[environments]` in `settings.toml`.\n- [ ] Update server test support so tests can inject environment files or use seeded defaults.\n- [ ] Add server tests for default environment run creation, custom server environment selection, unknown environment id, disabled provider policy, `--preserve-sandbox`, and rejected TOML environment field overrides.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server\n```\n\nExpected: server API and run-manifest tests pass.\n\n## Task 4: Add Environment CRUD API\n\n**Files:**\n- Modify: `docs/public/api-reference/fabro-api.yaml`\n- Modify: `lib/crates/fabro-api/build.rs`\n- Create: `lib/crates/fabro-server/src/server/handler/environments.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/mod.rs`\n- Add tests: `lib/crates/fabro-server/tests/it/api/environments.rs`\n- Update generated Rust and TypeScript API artifacts after spec changes.\n\n- [ ] Add OpenAPI tag `Environments`.\n- [ ] Add schemas for `Environment`, `CreateEnvironmentRequest`, `ReplaceEnvironmentRequest`, and `EnvironmentListResponse`.\n- [ ] Reuse existing environment schemas for provider/image/resources/network/lifecycle/volumes/env.\n- [ ] Add endpoints:\n  - `GET /api/v1/environments`\n  - `POST /api/v1/environments`\n  - `GET /api/v1/environments/{id}`\n  - `PUT /api/v1/environments/{id}`\n  - `DELETE /api/v1/environments/{id}`\n- [ ] Return `ETag` on retrieve and replace.\n- [ ] Require `If-Match` on replace and delete.\n- [ ] Map store errors to API responses:\n  - invalid id: `400`\n  - duplicate create: `409`\n  - stale revision: `409`\n  - validation error: `422`\n  - missing resource: `404`\n  - protected default delete: `409`\n  - persistence failure: `500`\n- [ ] Add route tests for empty-seeded list, create, retrieve with ETag, replace, stale replace, missing `If-Match`, delete, protected default delete, invalid provider, invalid CIDR, and missing Dockerfile path.\n- [ ] Regenerate `fabro-api` and TypeScript client artifacts.\n\nRun:\n\n```bash\ncargo build -p fabro-api\ncd lib/packages/fabro-api-client && bun run generate\ncargo nextest run -p fabro-server --test it -- api::environments\n```\n\nExpected: generated artifacts are updated and environment API tests pass.\n\n## Task 5: Adjust CLI And Manifest Behavior\n\n**Files:**\n- Modify: `lib/crates/fabro-cli/src/commands/run/overrides.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/preflight.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/graph.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/validate.rs`\n- Modify: `lib/crates/fabro-cli/src/commands/repo/init.rs`\n- Modify: `lib/crates/fabro-manifest/src/lib.rs`\n- Modify CLI integration tests under `lib/crates/fabro-cli/tests/it/`\n\n- [ ] Reject `--docker-image` in run, create, preflight, graph, and validate commands with this message shape: `--docker-image is no longer supported; create or update a server environment and select it with --environment`.\n- [ ] Keep `--environment` as an id-only selector in manifest args.\n- [ ] Stop collecting Dockerfile path references from `[environments.<id>]` in project/workflow config because those definitions are invalid.\n- [ ] Keep collecting Dockerfile references for any remaining CLI-created run environment override only when it comes from allowed argument paths; with `--docker-image` rejected, no normal user path should add one.\n- [ ] Update local preflight/graph/validate flows so they either call server preflight for environment resolution or print a clear message that server-owned environment resolution requires a running server.\n- [ ] Update `fabro repo init` to write only `[run.environment] id = \"local\"` and no `[environments.local]` block.\n- [ ] Update CLI tests for manifest args, repo init output, rejected `--docker-image`, and server-owned environment selection.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-cli\n```\n\nExpected: CLI tests pass and no generated workflow config contains `[environments.*]`.\n\n## Task 6: Update Install, Docs, And Generated References\n\n**Files:**\n- Modify install persistence code in `lib/crates/fabro-cli/src/commands/install.rs` and server install handlers/tests.\n- Modify docs: `docs/public/execution/environments.mdx`, `docs/public/execution/run-configuration.mdx`, `docs/public/reference/user-configuration.mdx`, `docs/public/administration/server-configuration.mdx`, `docs/public/administration/sandboxing.mdx`, `docs/public/integrations/daytona.mdx`, and examples that currently define `[environments.<id>]`.\n- Modify generated settings reference if applicable.\n\n- [ ] Update install flows to write server environment files instead of `[environments.default]` into `settings.toml`.\n- [ ] Keep install-written `[run.environment] id = \"default\"` when a default run environment selection is still needed.\n- [ ] Update tests that assert `settings.toml` contains `[environments.default]` to assert the sibling environment file exists and settings no longer contains `[environments]`.\n- [ ] Rewrite public docs so environment definitions are server-owned TOML files and run configs only select ids.\n- [ ] Add a compatibility note explaining that project/workflow `[environments]` definitions now fail and must be moved to the server.\n- [ ] Keep `Settings > Environments` UI documentation out of this pass.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server --test it -- api::install\ncargo nextest run -p fabro-cli --test it\n```\n\nExpected: install tests pass and docs no longer present project/workflow environment definitions as valid.\n\n## Task 7: Workspace Verification\n\n**Files:**\n- No new files unless test snapshots require reviewed updates.\n\n- [ ] Run Rust formatting check:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\n```\n\n- [ ] Run clippy:\n\n```bash\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\n- [ ] Run workspace tests:\n\n```bash\ncargo nextest run --workspace\n```\n\n- [ ] Run TypeScript checks if API client changes affect the web package:\n\n```bash\ncd apps/fabro-web && bun run typecheck\ncd apps/fabro-web && bun test\n```\n\n- [ ] Inspect generated files and snapshots before accepting any snapshot changes.\n\n## Acceptance Criteria\n\n- Server startup creates or loads `environments/default.toml`, `local.toml`, `docker.toml`, and `daytona.toml`.\n- `GET /api/v1/environments` returns seeded environments with revisions.\n- API-created environments persist as TOML files and survive server restart.\n- Runs using `[run.environment] id = \"cloud\"` resolve from server files only.\n- Project/workflow/user `[environments.<id>]` definitions no longer affect runs.\n- Existing runs keep their dense environment snapshot after environment files change.\n- `--environment` still works.\n- `--preserve-sandbox` still works.\n- `--docker-image` no longer works and produces the targeted replacement guidance.\n- Web UI changes are not included.\n",
          "command.output": "blob://sha256/bd66f55933ad7ab0b5c80315118e9cea320280cbfe5e73ec827b138787eff393",
          "internal.run_id": "01KSPDE8E9ATTVY1VBCS3YRBHT",
          "thread.preflight_lint.current_node": "implement",
          "thread.toolchain.current_node": "preflight_compile",
          "internal.retry_count.verify": 0,
          "internal.fidelity": "compact",
          "internal.retry_count.implement": 0,
          "graph.rankdir": "LR",
          "internal.retry_count.simplify_opus": 0,
          "internal.retry_count.start": 0,
          "thread.start.current_node": "toolchain",
          "internal.retry_count.preflight_lint": 0,
          "graph.model_stylesheet": "\n            * { model: claude-opus-4-7; }\n        ",
          "thread.simplify_opus.current_node": "simplify_gpt",
          "internal.thread_id": "verify",
          "internal.retry_count.preflight_compile": 0,
          "response.fixup": "Summary of changes to fix the verify failures:\n\n1. **`lib/crates/fabro-cli/src/commands/run/create.rs`**: Added the missing `environment_defaults` field to `ManifestBuildInput`, populated with the built-in seeded environment catalog.\n\n2. **`lib/crates/fabro-environment/src/{lib,store}.rs`**: Added a new public `seeded_catalog_layer()` helper that returns the built-in default/local/docker/daytona catalog as a `MergeMap<EnvironmentLayer>`, so CLI/manifest paths can validate environment ids without a live server `EnvironmentStore`.\n\n3. **CLI manifest call sites** (`graph.rs`, `preflight.rs`, `run/create.rs`, `validate.rs`, `user_config.rs`): Inject the seeded catalog when calling `build_run_manifest`/`RunSettingsBuilder`.\n\n4. **`lib/crates/fabro-config/src/builders.rs`**: Added public `RunSettingsBuilder::{load_default,load_from,from_toml}_with_catalog` variants so the CLI can merge a default catalog before resolution.\n\n5. **`lib/crates/fabro-server/src/{manifest_validation,run_manifest,run_tool_manifest}.rs`**: Added `validate_manifest_with_environment_defaults`, made the base `validate_manifest` use the seeded catalog, removed the now-unused `prepare_manifest` wrapper, and made tool-manifest use the seeded catalog.\n\n6. **`lib/crates/fabro-workflow/{Cargo.toml,src/operations/{create,start}.rs}`**: Added `fabro-environment` dev-dep and updated test settings builders to inject the seeded catalog.\n\n7. **Tests and fixtures**: Updated `workflow_settings_round_trip.rs`, `config.rs`, `dump.rs`, `run.rs`, `support.rs` (CLI tests) and the variables API test to stop using project-config-defined `[environments.<id>]` blocks (now invalid) and seed the resolver with a catalog where needed.\n\n8. **`.fabro/project.toml`**: Removed `[environments.fabro-dev]` block since project configs can no longer define environments per the new architecture.",
          "outcome": "succeeded",
          "internal.node_visit_count": 1,
          "response.simplify_opus": "Workspace builds clean. Let me summarize what was done.\n\n## Summary\n\nReviewed the `fabro-environment` crate addition and related fabro-config/fabro-server changes against three concurrent agents (reuse, quality, efficiency) and applied the highest-impact fixes:\n\n### Type / API surface cleanup\n- **Collapsed `Environment` to `{id, revision, settings: EnvironmentSettings}`** — eliminated the parallel flat-field copy, `settings()`, `from_validated_settings`, and the eight clone fields. `Environment.settings` is now a single owned `EnvironmentSettings`.\n- **Deleted `EnvironmentReplace`** — it was field-identical to `EnvironmentSettings` with no API consumer. `EnvironmentStore::replace` now takes `EnvironmentSettings` directly; `EnvironmentDraft` becomes `{id, settings}`.\n- **Removed unused public API**: `Environment::from_toml_bytes`, `Environment::to_toml_string`, `EnvironmentStoreError::MissingRevision`.\n\n### Dead code purge\n- **Deleted `LegacySandboxMigrationReport`, `migrate_settings_path`, `write_next_backup`, `backup_path_for`, `next_backup_path`, `REMOVAL_NOTE` and the two tests** in the 2026050101 legacy sandbox migration — production goes through `migrate_contents` only via the new 2026052801 migration.\n- **Removed `ResolvedAppStateSettings.manifest_run_settings`** dead field (server resolves it after loading the environment store anyway), plus the now-unused `RunSettingsBuilder`/`SharedError` imports in `serve.rs` and `test_support.rs`.\n\n### Efficiency\n- **Cached `catalog_layer()` as `Arc<MergeMap<EnvironmentLayer>>`** behind a `CatalogState` updated on create/replace/delete. Run create / preflight / graph / validate now just bump a refcount instead of cloning every `Environment` and rebuilding the catalog on each call.\n- **Simplified `write_new`** to a direct `OpenOptions::create_new(true).open(path)` (matches `seed_missing_environments`). Removes the temp + hard_link + cleanup dance and its leak window.\n\n### Quality polish\n- Dropped fake `async` from `EnvironmentStore::list`/`get` (sync `RwLock` reads only).\n- Inlined `resolve_path` into `base_dir.join(path)` (it was reimplementing `Path::join`).\n- Replaced the local `value()` wrapper with `toml_edit::value`.\n- Replaced `Option<PathBuf>` with `&Path` in `parse_persisted` (`from_persisted_path`'s \"memory\" branch is dead now).\n- Extracted `check_revision` helper to eliminate duplicated lock-read + ok_or + revision-compare across `replace` and `delete`.\n- Added small `read_state`/`write_state` accessors to centralize the lock-poisoning expect.\n\n### Config plumbing\n- **Removed the thin `load_settings_path` wrapper** and renamed `load_settings_path_with_source` to `load_settings_path(path, source)`. Each call site now declares its `SettingsSource` explicitly.\n- **Unified the parse-then-validate pattern** behind a single `parse_settings_toml(source, kind)` helper, replacing 11 duplicated `.parse::<SettingsLayer>().map_err(...)?; validate_parsed_source(&layer, ...)?` blocks.\n- Replaced the two scattered match arms in `parse.rs` with named predicates `SettingsSource::runs_settings_migrations` / `forbids_environment_catalog`.\n\n### Verification\n- `cargo nextest run -p fabro-environment -p fabro-config` — 233 passed, 0 failed.\n- `cargo +nightly-2026-04-14 fmt --check --all` — clean.\n- `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` — clean.\n- `cargo build --workspace` — clean.\n\n`fabro-server` retains 34 pre-existing test failures from the failed `implement` step (Task 5 of the original plan, \"Adjust CLI And Manifest Behavior\", was never executed). All share a \"unknown environment: <id>\" root cause: tests that exercise `fabro-manifest::build_run_manifest` directly never seed a server environment catalog. These failures predate this cleanup pass and aren't introduced by it.\n\nFindings not addressed (deferred — would require crate-restructuring beyond a review pass):\n- Sharing `write_atomic`/`temp_path_for`/`id_from_path`/etc. with the identical helpers in `fabro-automation` (would need a new shared util crate).\n- Sharing the slug validator and SHA-256 revision type between `fabro-environment` and `fabro-automation` (cycle if extracted to fabro-config; would need a `fabro-util` extraction).\n- Sharing `ensure_table` between `fabro-environment::model` and the legacy migration.\n- Making `StickyMap`'s `Serialize` deterministic so `canonical_bytes` could collapse into `toml::to_string_pretty(layer)`.",
          "thread.simplify_gpt.current_node": "verify",
          "internal.work_dir": "/home/daytona/workspace/fabro",
          "internal.retry_count.fixup": 0,
          "internal.retry_count.simplify_gpt": 0,
          "internal.retry_count.toolchain": 0,
          "failure_class": "",
          "last_response": "Summary of changes to fix the verify failures:\n\n1. **`lib/crates/fabro-cli/src/commands/run/create.rs`**: Added the missing `environment_defaults` field to `ManifestBuildInput`, populated with the bui",
          "failure_signature": "",
          "thread.preflight_compile.current_node": "preflight_lint",
          "last_stage": "fixup"
        },
        "node_outcomes": {
          "implement": {
            "status": "failed",
            "failure": {
              "message": "LLM error: Invalid request to openai: No tool call found for function call output with call_id call_DUxNRWlboQi3OOOvhg0NhD3h.",
              "category": "deterministic",
              "signature": "api_deterministic|openai|invalid_request"
            },
            "usage": null
          },
          "preflight_compile": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo check -q --workspace 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 131121,
              "active_time_ms": 131121
            }
          },
          "preflight_lint": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126"
            },
            "notes": "Script completed: cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 143203,
              "active_time_ms": 143203
            }
          },
          "fixup": {
            "status": "succeeded",
            "context_updates": {
              "last_response": "Summary of changes to fix the verify failures:\n\n1. **`lib/crates/fabro-cli/src/commands/run/create.rs`**: Added the missing `environment_defaults` field to `ManifestBuildInput`, populated with the bui",
              "response.fixup": "Summary of changes to fix the verify failures:\n\n1. **`lib/crates/fabro-cli/src/commands/run/create.rs`**: Added the missing `environment_defaults` field to `ManifestBuildInput`, populated with the built-in seeded environment catalog.\n\n2. **`lib/crates/fabro-environment/src/{lib,store}.rs`**: Added a new public `seeded_catalog_layer()` helper that returns the built-in default/local/docker/daytona catalog as a `MergeMap<EnvironmentLayer>`, so CLI/manifest paths can validate environment ids without a live server `EnvironmentStore`.\n\n3. **CLI manifest call sites** (`graph.rs`, `preflight.rs`, `run/create.rs`, `validate.rs`, `user_config.rs`): Inject the seeded catalog when calling `build_run_manifest`/`RunSettingsBuilder`.\n\n4. **`lib/crates/fabro-config/src/builders.rs`**: Added public `RunSettingsBuilder::{load_default,load_from,from_toml}_with_catalog` variants so the CLI can merge a default catalog before resolution.\n\n5. **`lib/crates/fabro-server/src/{manifest_validation,run_manifest,run_tool_manifest}.rs`**: Added `validate_manifest_with_environment_defaults`, made the base `validate_manifest` use the seeded catalog, removed the now-unused `prepare_manifest` wrapper, and made tool-manifest use the seeded catalog.\n\n6. **`lib/crates/fabro-workflow/{Cargo.toml,src/operations/{create,start}.rs}`**: Added `fabro-environment` dev-dep and updated test settings builders to inject the seeded catalog.\n\n7. **Tests and fixtures**: Updated `workflow_settings_round_trip.rs`, `config.rs`, `dump.rs`, `run.rs`, `support.rs` (CLI tests) and the variables API test to stop using project-config-defined `[environments.<id>]` blocks (now invalid) and seed the resolver with a catalog where needed.\n\n8. **`.fabro/project.toml`**: Removed `[environments.fabro-dev]` block since project configs can no longer define environments per the new architecture.",
              "last_stage": "fixup"
            },
            "notes": "Stage completed: fixup",
            "usage": {
              "input": {
                "usage": {
                  "model": {
                    "provider": "anthropic",
                    "model_id": "claude-opus-4-7"
                  },
                  "tokens": {
                    "input_tokens": 234960,
                    "output_tokens": 70036,
                    "reasoning_tokens": 0,
                    "cache_read_tokens": 30063002,
                    "cache_write_tokens": 3501520
                  }
                },
                "facts": {
                  "algorithm": "anthropic",
                  "cache_write_5m_tokens": 3501520,
                  "cache_write_1h_tokens": 0
                }
              },
              "total_usd_micros": 39841701
            },
            "files_touched": [
              "/home/daytona/workspace/fabro/.fabro/project.toml",
              "/home/daytona/workspace/fabro/lib/crates/fabro-api/tests/workflow_settings_round_trip.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-cli/Cargo.toml",
              "/home/daytona/workspace/fabro/lib/crates/fabro-cli/src/commands/graph.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-cli/src/commands/preflight.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-cli/src/commands/run/create.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-cli/src/commands/validate.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-cli/src/user_config.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-cli/tests/it/cmd/config.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-cli/tests/it/cmd/dump.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-cli/tests/it/cmd/run.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-cli/tests/it/cmd/support.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/builders.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/lib.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/store.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-manifest/src/lib.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/manifest_validation.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/run_manifest.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/run_tool_manifest.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/tests/it/api/variables.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-workflow/Cargo.toml",
              "/home/daytona/workspace/fabro/lib/crates/fabro-workflow/src/operations/create.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-workflow/src/operations/start.rs"
            ],
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 1219524,
              "tool_time_ms": 1492996,
              "active_time_ms": 2712520
            }
          },
          "verify": {
            "status": "failed",
            "context_updates": {
              "command.output": "blob://sha256/bd66f55933ad7ab0b5c80315118e9cea320280cbfe5e73ec827b138787eff393"
            },
            "failure": {
              "message": "Script failed with exit code: 1\n\n## output\nes/fabro-server)\n   Compiling fabro-cli v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-cli)\n   Compiling globset v0.4.18\n   Compiling rust-embed-utils v8.11.0\n   Compiling rust-embed v8.11.0\n   Compiling fabro-model v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-model)\n   Compiling fabro-spa v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-spa)\n   Compiling fabro-types v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-types)\n   Compiling fabro-oauth v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-oauth)\n   Compiling axum-extra v0.10.3\n   Compiling fabro-config v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-config)\n   Compiling fabro-github v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-github)\n   Compiling fabro-vault v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-vault)\n   Compiling fabro-store v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-store)\n   Compiling fabro-graphviz v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-graphviz)\n   Compiling fabro-template v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-template)\n   Compiling fabro-core v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-core)\n   Compiling fabro-auth v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-auth)\n   Compiling fabro-interview v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-interview)\n   Compiling fabro-variable v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-variable)\n   Compiling fabro-llm v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-llm)\n   Compiling fabro-dump v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-dump)\n   Compiling fabro-sandbox v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-sandbox)\n   Compiling fabro-api v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-api)\n   Compiling fabro-mcp v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-mcp)\n   Compiling fabro-checkpoint v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-checkpoint)\n   Compiling fabro-environment v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-environment)\n   Compiling fabro-install v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-install)\n   Compiling fabro-agent v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-agent)\n   Compiling fabro-acp v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-acp)\n   Compiling fabro-validate v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-validate)\n   Compiling fabro-client v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-client)\n   Compiling fabro-hooks v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-hooks)\n   Compiling fabro-tool v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-tool)\n   Compiling fabro-workflow v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-workflow)\n   Compiling fabro-slack v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-slack)\n   Compiling fabro-manifest v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-manifest)\n   Compiling fabro-mcp-server v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-mcp-server)\nerror[E0063]: missing field `environment_defaults` in initializer of `ManifestBuildInput`\n  --> lib/crates/fabro-cli/src/commands/run/create.rs:43:40\n   |\n43 |     let mut built = build_run_manifest(ManifestBuildInput {\n   |                                        ^^^^^^^^^^^^^^^^^^ missing `environment_defaults`\n\nFor more information about this error, try `rustc --explain E0063`.\nerror: could not compile `fabro-cli` (bin \"fabro\") due to 1 previous error\n",
              "category": "deterministic"
            },
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 74703,
              "active_time_ms": 74703
            }
          },
          "simplify_opus": {
            "status": "succeeded",
            "context_updates": {
              "last_stage": "simplify_opus",
              "last_response": "Workspace builds clean. Let me summarize what was done.\n\n## Summary\n\nReviewed the `fabro-environment` crate addition and related fabro-config/fabro-server changes against three concurrent agents (reus",
              "response.simplify_opus": "Workspace builds clean. Let me summarize what was done.\n\n## Summary\n\nReviewed the `fabro-environment` crate addition and related fabro-config/fabro-server changes against three concurrent agents (reuse, quality, efficiency) and applied the highest-impact fixes:\n\n### Type / API surface cleanup\n- **Collapsed `Environment` to `{id, revision, settings: EnvironmentSettings}`** — eliminated the parallel flat-field copy, `settings()`, `from_validated_settings`, and the eight clone fields. `Environment.settings` is now a single owned `EnvironmentSettings`.\n- **Deleted `EnvironmentReplace`** — it was field-identical to `EnvironmentSettings` with no API consumer. `EnvironmentStore::replace` now takes `EnvironmentSettings` directly; `EnvironmentDraft` becomes `{id, settings}`.\n- **Removed unused public API**: `Environment::from_toml_bytes`, `Environment::to_toml_string`, `EnvironmentStoreError::MissingRevision`.\n\n### Dead code purge\n- **Deleted `LegacySandboxMigrationReport`, `migrate_settings_path`, `write_next_backup`, `backup_path_for`, `next_backup_path`, `REMOVAL_NOTE` and the two tests** in the 2026050101 legacy sandbox migration — production goes through `migrate_contents` only via the new 2026052801 migration.\n- **Removed `ResolvedAppStateSettings.manifest_run_settings`** dead field (server resolves it after loading the environment store anyway), plus the now-unused `RunSettingsBuilder`/`SharedError` imports in `serve.rs` and `test_support.rs`.\n\n### Efficiency\n- **Cached `catalog_layer()` as `Arc<MergeMap<EnvironmentLayer>>`** behind a `CatalogState` updated on create/replace/delete. Run create / preflight / graph / validate now just bump a refcount instead of cloning every `Environment` and rebuilding the catalog on each call.\n- **Simplified `write_new`** to a direct `OpenOptions::create_new(true).open(path)` (matches `seed_missing_environments`). Removes the temp + hard_link + cleanup dance and its leak window.\n\n### Quality polish\n- Dropped fake `async` from `EnvironmentStore::list`/`get` (sync `RwLock` reads only).\n- Inlined `resolve_path` into `base_dir.join(path)` (it was reimplementing `Path::join`).\n- Replaced the local `value()` wrapper with `toml_edit::value`.\n- Replaced `Option<PathBuf>` with `&Path` in `parse_persisted` (`from_persisted_path`'s \"memory\" branch is dead now).\n- Extracted `check_revision` helper to eliminate duplicated lock-read + ok_or + revision-compare across `replace` and `delete`.\n- Added small `read_state`/`write_state` accessors to centralize the lock-poisoning expect.\n\n### Config plumbing\n- **Removed the thin `load_settings_path` wrapper** and renamed `load_settings_path_with_source` to `load_settings_path(path, source)`. Each call site now declares its `SettingsSource` explicitly.\n- **Unified the parse-then-validate pattern** behind a single `parse_settings_toml(source, kind)` helper, replacing 11 duplicated `.parse::<SettingsLayer>().map_err(...)?; validate_parsed_source(&layer, ...)?` blocks.\n- Replaced the two scattered match arms in `parse.rs` with named predicates `SettingsSource::runs_settings_migrations` / `forbids_environment_catalog`.\n\n### Verification\n- `cargo nextest run -p fabro-environment -p fabro-config` — 233 passed, 0 failed.\n- `cargo +nightly-2026-04-14 fmt --check --all` — clean.\n- `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` — clean.\n- `cargo build --workspace` — clean.\n\n`fabro-server` retains 34 pre-existing test failures from the failed `implement` step (Task 5 of the original plan, \"Adjust CLI And Manifest Behavior\", was never executed). All share a \"unknown environment: <id>\" root cause: tests that exercise `fabro-manifest::build_run_manifest` directly never seed a server environment catalog. These failures predate this cleanup pass and aren't introduced by it.\n\nFindings not addressed (deferred — would require crate-restructuring beyond a review pass):\n- Sharing `write_atomic`/`temp_path_for`/`id_from_path`/etc. with the identical helpers in `fabro-automation` (would need a new shared util crate).\n- Sharing the slug validator and SHA-256 revision type between `fabro-environment` and `fabro-automation` (cycle if extracted to fabro-config; would need a `fabro-util` extraction).\n- Sharing `ensure_table` between `fabro-environment::model` and the legacy migration.\n- Making `StickyMap`'s `Serialize` deterministic so `canonical_bytes` could collapse into `toml::to_string_pretty(layer)`."
            },
            "notes": "Stage completed: simplify_opus",
            "usage": {
              "input": {
                "usage": {
                  "model": {
                    "provider": "anthropic",
                    "model_id": "claude-opus-4-7"
                  },
                  "tokens": {
                    "input_tokens": 262080,
                    "output_tokens": 89618,
                    "reasoning_tokens": 0,
                    "cache_read_tokens": 44336839,
                    "cache_write_tokens": 4410068
                  }
                },
                "facts": {
                  "algorithm": "anthropic",
                  "cache_write_5m_tokens": 4410068,
                  "cache_write_1h_tokens": 0
                }
              },
              "total_usd_micros": 53282194
            },
            "files_touched": [
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/migrations/2026050101_legacy_sandbox_to_environments.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/builders.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/load.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/parse.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/project.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/resolve/mod.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/run.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-config/src/user.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/error.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/lib.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/model.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-environment/src/store.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/run_manifest.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/serve.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/server.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/server/handler/graph.rs",
              "/home/daytona/workspace/fabro/lib/crates/fabro-server/src/test_support.rs"
            ],
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 1449354,
              "tool_time_ms": 794439,
              "active_time_ms": 2243793
            }
          },
          "simplify_gpt": {
            "status": "succeeded",
            "context_updates": {
              "response.simplify_gpt": "Implemented cleanup fixes from the review pass.\n\nWhat I changed:\n- Replaced blocking Dockerfile reads on async environment create/replace paths with `tokio::fs::read_to_string`.\n- Threaded the server `EnvironmentStore` catalog into automation manifest materialization so automation-created manifests resolve server-owned environments.\n- Added environment catalog injection to manifest/server tests that now require server-owned environment resolution.\n- Updated obsolete tests that expected project `[environments.*]` Dockerfile bundling to instead assert the new targeted server-managed error.\n- Fixed clippy issues:\n  - imported async fs path instead of absolute `tokio::fs`.\n  - removed stale `RunSettingsBuilder` usage/import.\n  - restored non-test `ServerDaemon` import.\n  - used explicit `MergeMap::<EnvironmentLayer>::default()`.\n\nValidation run:\n- `cargo +nightly-2026-04-14 fmt --check --all` ✅\n- `cargo +nightly-2026-04-14 clippy -q -p fabro-environment -p fabro-manifest -p fabro-server --all-targets -- -D warnings` ✅\n- `cargo nextest run -p fabro-environment` ✅\n- `cargo nextest run -p fabro-config` ✅\n- `cargo nextest run -p fabro-manifest` ✅\n- `cargo nextest run -p fabro-server` ✅\n\nNote: the parallel subagents completed, but their tool responses did not expose visible findings in this environment, so I performed the targeted review directly and fixed the concrete issues found.",
              "last_stage": "simplify_gpt",
              "last_response": "Implemented cleanup fixes from the review pass.\n\nWhat I changed:\n- Replaced blocking Dockerfile reads on async environment create/replace paths with `tokio::fs::read_to_string`.\n- Threaded the server "
            },
            "notes": "Stage completed: simplify_gpt",
            "usage": {
              "input": {
                "usage": {
                  "model": {
                    "provider": "openai",
                    "model_id": "gpt-5.5"
                  },
                  "tokens": {
                    "input_tokens": 1401292,
                    "output_tokens": 14865,
                    "reasoning_tokens": 5183,
                    "cache_read_tokens": 9071616,
                    "cache_write_tokens": 0
                  }
                },
                "facts": {
                  "algorithm": "openai"
                }
              },
              "total_usd_micros": 12143708
            },
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 700782,
              "tool_time_ms": 547781,
              "active_time_ms": 1248563
            }
          },
          "start": {
            "status": "succeeded",
            "usage": null
          },
          "toolchain": {
            "status": "succeeded",
            "context_updates": {
              "command.output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c"
            },
            "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
            "usage": null,
            "timing": {
              "wall_time_ms": 0,
              "inference_time_ms": 0,
              "tool_time_ms": 1316,
              "active_time_ms": 1316
            }
          }
        },
        "next_node_id": "verify",
        "node_visits": {
          "preflight_lint": 1,
          "simplify_opus": 1,
          "implement": 1,
          "start": 1,
          "toolchain": 1,
          "preflight_compile": 1,
          "simplify_gpt": 1,
          "verify": 1,
          "fixup": 1
        }
      },
      "diff": {}
    }
  ],
  "conclusion": null,
  "sandbox": {
    "kind": "ready",
    "plan": {
      "provider": "daytona"
    },
    "instance": {
      "provider": "daytona",
      "snapshot": "fabro-fdb28dec-1233-892c-b9d7-9f88f8353e7a",
      "runtime": {
        "id": "fabro-01KSPDE8E9ATTVY1VBCS3YRBHT",
        "working_directory": "/home/daytona/workspace/fabro",
        "repo_cloned": true,
        "clone_origin_url": "https://github.com/fabro-sh/fabro",
        "clone_branch": "main",
        "workspace_root": "/home/daytona/workspace",
        "repos_root": "/home/daytona/repos",
        "primary_repo_path": "/home/daytona/repos/fabro-sh/fabro",
        "primary_repo_link": "/home/daytona/workspace/fabro"
      }
    }
  },
  "pull_request": null,
  "superseded_by": null,
  "pending_interviews": {},
  "stages": {
    "start@1": {
      "first_event_seq": 17,
      "prompt": null,
      "response": null,
      "completion": {
        "outcome": "succeeded",
        "notes": null,
        "failure_reason": null,
        "timestamp": "2026-05-28T04:28:35.445561Z"
      },
      "provider_used": null,
      "diff": null,
      "script_invocation": null,
      "script_timing": null,
      "parallel_results": null,
      "output": null,
      "started_at": "2026-05-28T04:28:35.445481Z",
      "handler": "start",
      "timing": {
        "wall_time_ms": 0,
        "inference_time_ms": 0,
        "tool_time_ms": 0,
        "active_time_ms": 0
      },
      "usage": {
        "input_tokens": 0,
        "output_tokens": 0,
        "total_tokens": 0,
        "reasoning_tokens": 0,
        "cache_read_tokens": 0,
        "cache_write_tokens": 0
      },
      "state": "succeeded"
    },
    "simplify_gpt@1": {
      "first_event_seq": 2126,
      "prompt": null,
      "response": null,
      "completion": {
        "outcome": "succeeded",
        "notes": "Stage completed: simplify_gpt",
        "failure_reason": null,
        "timestamp": "2026-05-28T06:00:15.991194Z"
      },
      "provider_used": {
        "mode": "agent",
        "provider": "openai",
        "model": "gpt-5.5"
      },
      "diff": null,
      "script_invocation": null,
      "script_timing": null,
      "parallel_results": null,
      "output": null,
      "started_at": "2026-05-28T05:39:25.477041Z",
      "handler": "agent",
      "timing": {
        "wall_time_ms": 1250507,
        "inference_time_ms": 700782,
        "tool_time_ms": 547781,
        "active_time_ms": 1248563
      },
      "usage": {
        "input_tokens": 1401292,
        "output_tokens": 14865,
        "total_tokens": 10492956,
        "reasoning_tokens": 5183,
        "cache_read_tokens": 9071616,
        "cache_write_tokens": 0,
        "total_usd_micros": 12143708
      },
      "model": {
        "provider": "openai",
        "model_id": "gpt-5.5"
      },
      "todos": {
        "kind": "openai_plan",
        "list_id": "openai_plan:5d15333a-ec11-451a-9fef-d95e9c1421b5",
        "items": [
          {
            "id": "9e1c3e9af21b31d9",
            "status": "completed",
            "order": 0,
            "subject": "Inspect current git diff and changed files"
          },
          {
            "id": "3b635bfeb1418319",
            "status": "completed",
            "order": 1,
            "subject": "Run three parallel review agents for reuse, quality, and efficiency"
          },
          {
            "id": "4c91e6a7b192a8c4",
            "status": "completed",
            "order": 2,
            "subject": "Apply cleanup fixes from review findings"
          },
          {
            "id": "bfec785120ff24fb",
            "status": "completed",
            "order": 3,
            "subject": "Run targeted validation"
          },
          {
            "id": "44d6a77d3d900fc2",
            "status": "completed",
            "order": 4,
            "subject": "Summarize results and remaining gaps"
          }
        ]
      },
      "subagents": [
        {
          "agent_id": "3029fbaa",
          "depth": 1,
          "task": "Code Reuse Review for server-owned environments branch. Read /tmp/fabro_env.diff and /tmp/fabro_changed_files.txt. For each change, search the repo for existing utilities/helpers that could replace newly written code. Flag duplicated functions or inline logic that should use existing utilities. Focus on actionable findings only; include file paths/line references and suggested existing helper if applicable. Do not modify files.",
          "status": {
            "kind": "completed",
            "success": true,
            "turns_used": 13
          }
        },
        {
          "agent_id": "266adb6c",
          "depth": 1,
          "task": "Code Quality Review for server-owned environments branch. Read /tmp/fabro_env.diff and /tmp/fabro_changed_files.txt. Review for redundant state, parameter sprawl, copy-paste, leaky abstractions, stringly-typed code, and hacky patterns. Focus on actionable findings only with file paths/line references and suggested fix. Do not modify files.",
          "status": {
            "kind": "completed",
            "success": true,
            "turns_used": 13
          }
        },
        {
          "agent_id": "97828ff1",
          "depth": 1,
          "task": "Efficiency Review for server-owned environments branch. Read /tmp/fabro_env.diff and /tmp/fabro_changed_files.txt. Review for redundant computations/file reads, missed concurrency, hot-path bloat, TOCTOU existence checks, memory issues, and overly broad operations. Focus on actionable findings only with file paths/line references and suggested fix. Do not modify files.",
          "status": {
            "kind": "completed",
            "success": true,
            "turns_used": 13
          }
        }
      ],
      "permission_level": "full",
      "agent_tools": [
        {
          "name": "apply_patch",
          "description": "Use the `apply_patch` tool to edit files. This is a FREEFORM tool, so do not wrap the patch in JSON.",
          "source": {
            "kind": "native"
          },
          "category": "write",
          "invoked": true
        },
        {
          "name": "close_agent",
          "description": "Close a running subagent that is no longer needed.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": false
        },
        {
          "name": "glob",
          "description": "Find files by file names using a glob pattern. Use path to choose the search root. Prefer this over shell find or ls when locating repository files.",
          "source": {
            "kind": "native"
          },
          "category": "read",
          "invoked": true
        },
        {
          "name": "grep",
          "description": "Search file contents with a regex pattern. Use path to choose the search root, glob_filter to limit matching files, case_insensitive for case folding, and max_results to cap output.",
          "source": {
            "kind": "native"
          },
          "category": "read",
          "invoked": true
        },
        {
          "name": "read_file",
          "description": "Read files before editing them. Returns line-numbered text and supports offset/limit for large files. Use this instead of shell cat, head, tail, or sed when inspecting repository files.",
          "source": {
            "kind": "native"
          },
          "category": "read",
          "invoked": true
        },
        {
          "name": "request_user_input",
          "description": "Ask the human one or more questions and wait for their answers before continuing this stage.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "send_input",
          "description": "Send a follow-up message to a running subagent when new information or corrected instructions are needed.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": false
        },
        {
          "name": "shell",
          "description": "Execute shell commands for terminal operations, package managers, tests and builds. Use dedicated tools for file reads, file edits, filename searches, and content searches. Provide timeout_ms for long-running commands.",
          "source": {
            "kind": "native"
          },
          "category": "shell",
          "invoked": true
        },
        {
          "name": "spawn_agent",
          "description": "Spawn a subagent for independent work or context isolation. Use it for tasks that can proceed separately, and avoid duplicating the same work in the parent session.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": true
        },
        {
          "name": "update_plan",
          "description": "Update the multi-step plan for the current task. Submit the entire plan; existing steps are reconciled by exact step text.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": true
        },
        {
          "name": "wait",
          "description": "Wait for a subagent to complete, then use the result to synthesize the outcome for the user.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": true
        },
        {
          "name": "web_fetch",
          "description": "Fetch content from a URL that starts with http:// or https://. Pass a prompt to extract specific information or summarize the page; omit prompt to return the page content.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "web_search",
          "description": "Search the web using Brave Search when current external information is needed. Returns result titles, URLs, and descriptions; use web_fetch for a specific URL.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "write_file",
          "description": "Create new files, or overwrite an existing file only when replacement is explicitly intended. Prefer edit_file for targeted changes to existing files because write_file overwrites the full file content.",
          "source": {
            "kind": "native"
          },
          "category": "write",
          "invoked": false
        }
      ],
      "context_window": {
        "provider": "openai",
        "model": "gpt-5.5",
        "context_window_tokens": 272000,
        "input_tokens": 140075,
        "usage_percent": 51.498161764705884,
        "count_method": "response_usage_scaled_breakdown",
        "staleness": "live",
        "generated_at": "2026-05-28T06:00:15.797488Z",
        "event_seq": 2681,
        "breakdown": [
          {
            "category": "system_prompt",
            "tokens": 931,
            "usage_percent": 0.3422794117647059
          },
          {
            "category": "tools",
            "tokens": 1329,
            "usage_percent": 0.4886029411764706
          },
          {
            "category": "memory",
            "tokens": 3163,
            "usage_percent": 1.1628676470588235
          },
          {
            "category": "conversation",
            "tokens": 134648,
            "usage_percent": 49.502941176470586
          },
          {
            "category": "other",
            "tokens": 4,
            "usage_percent": 0.0014705882352941176
          }
        ],
        "warnings": []
      },
      "state": "succeeded"
    },
    "preflight_lint@1": {
      "first_event_seq": 41,
      "prompt": null,
      "response": null,
      "completion": {
        "outcome": "succeeded",
        "notes": "Script completed: cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
        "failure_reason": null,
        "timestamp": "2026-05-28T04:33:18.677731Z"
      },
      "provider_used": null,
      "diff": null,
      "script_invocation": {
        "script": "cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
        "command": "exec 2>&1\ncargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1",
        "language": "shell"
      },
      "script_timing": {
        "output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126",
        "exit_code": 0,
        "duration_ms": 143203,
        "termination": "exited",
        "output_bytes": 0,
        "live_streaming": false
      },
      "parallel_results": null,
      "output": null,
      "output_bytes": 0,
      "live_streaming": false,
      "termination": "exited",
      "started_at": "2026-05-28T04:30:55.467797Z",
      "handler": "command",
      "timing": {
        "wall_time_ms": 143209,
        "inference_time_ms": 0,
        "tool_time_ms": 143203,
        "active_time_ms": 143203
      },
      "usage": {
        "input_tokens": 0,
        "output_tokens": 0,
        "total_tokens": 0,
        "reasoning_tokens": 0,
        "cache_read_tokens": 0,
        "cache_write_tokens": 0
      },
      "state": "succeeded"
    },
    "preflight_compile@1": {
      "first_event_seq": 31,
      "prompt": null,
      "response": null,
      "completion": {
        "outcome": "succeeded",
        "notes": "Script completed: cargo check -q --workspace 2>&1",
        "failure_reason": null,
        "timestamp": "2026-05-28T04:30:51.451059Z"
      },
      "provider_used": null,
      "diff": null,
      "script_invocation": {
        "script": "cargo check -q --workspace 2>&1",
        "command": "exec 2>&1\ncargo check -q --workspace 2>&1",
        "language": "shell"
      },
      "script_timing": {
        "output": "blob://sha256/12ae32cb1ec02d01eda3581b127c1fee3b0dc53572ed6baf239721a03d82e126",
        "exit_code": 0,
        "duration_ms": 131121,
        "termination": "exited",
        "output_bytes": 0,
        "live_streaming": false
      },
      "parallel_results": null,
      "output": null,
      "output_bytes": 0,
      "live_streaming": false,
      "termination": "exited",
      "started_at": "2026-05-28T04:28:40.324442Z",
      "handler": "command",
      "timing": {
        "wall_time_ms": 131126,
        "inference_time_ms": 0,
        "tool_time_ms": 131121,
        "active_time_ms": 131121
      },
      "usage": {
        "input_tokens": 0,
        "output_tokens": 0,
        "total_tokens": 0,
        "reasoning_tokens": 0,
        "cache_read_tokens": 0,
        "cache_write_tokens": 0
      },
      "state": "succeeded"
    },
    "toolchain@1": {
      "first_event_seq": 21,
      "prompt": null,
      "response": null,
      "completion": {
        "outcome": "succeeded",
        "notes": "Script completed: command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
        "failure_reason": null,
        "timestamp": "2026-05-28T04:28:36.766378Z"
      },
      "provider_used": null,
      "diff": null,
      "script_invocation": {
        "script": "command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
        "command": "exec 2>&1\ncommand -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1",
        "language": "shell"
      },
      "script_timing": {
        "output": "blob://sha256/fc14b2ba2d770e5cd3169df7a29525c962adfc4cfa3097b9098c63ebd61a748c",
        "exit_code": 0,
        "duration_ms": 1316,
        "termination": "exited",
        "output_bytes": 36,
        "live_streaming": true
      },
      "parallel_results": null,
      "output": null,
      "output_bytes": 36,
      "live_streaming": true,
      "termination": "exited",
      "started_at": "2026-05-28T04:28:35.445726Z",
      "handler": "command",
      "timing": {
        "wall_time_ms": 1320,
        "inference_time_ms": 0,
        "tool_time_ms": 1316,
        "active_time_ms": 1316
      },
      "usage": {
        "input_tokens": 0,
        "output_tokens": 0,
        "total_tokens": 0,
        "reasoning_tokens": 0,
        "cache_read_tokens": 0,
        "cache_write_tokens": 0
      },
      "state": "succeeded"
    },
    "fixup@1": {
      "first_event_seq": 2701,
      "prompt": null,
      "response": null,
      "completion": null,
      "provider_used": {
        "mode": "agent",
        "provider": "anthropic",
        "model": "claude-opus-4-7"
      },
      "diff": null,
      "script_invocation": null,
      "script_timing": null,
      "parallel_results": null,
      "output": null,
      "started_at": "2026-05-28T06:01:44.065564Z",
      "handler": "agent",
      "usage": {
        "input_tokens": 234960,
        "output_tokens": 70036,
        "total_tokens": 33869518,
        "reasoning_tokens": 0,
        "cache_read_tokens": 30063002,
        "cache_write_tokens": 3501520,
        "total_usd_micros": 39841701
      },
      "model": {
        "provider": "anthropic",
        "model_id": "claude-opus-4-7"
      },
      "permission_level": "full",
      "agent_tools": [
        {
          "name": "AskUserQuestion",
          "description": "Ask the human one or more questions and wait for their answers before continuing this stage.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "TaskCreate",
          "description": "Create pending tasks in the current session. Use concise subjects, descriptions, optional activeForm text, and metadata. Check TaskList first to avoid duplicate tasks.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "TaskGet",
          "description": "Get one task by taskId, including subject, status, description, owner, blockedBy, and blocks.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "TaskList",
          "description": "List tasks for the current session, including status, owner, and blocking dependencies. Use TaskGet with a taskId for full description and dependency details.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "TaskUpdate",
          "description": "Update an existing task's status, text, owner, metadata, or dependencies. Valid statuses are pending, in_progress, completed, and deleted. After completing a task, call TaskList to find newly unblocked work.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "close_agent",
          "description": "Close a running subagent that is no longer needed.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": false
        },
        {
          "name": "edit_file",
          "description": "Edit a file by replacing an exact string. The old_string must be an exact match and unique unless replace_all is true; include surrounding context when needed. Read the file first and preserve existing indentation.",
          "source": {
            "kind": "native"
          },
          "category": "write",
          "invoked": true
        },
        {
          "name": "glob",
          "description": "Find files by file names using a glob pattern. Use path to choose the search root. Prefer this over shell find or ls when locating repository files.",
          "source": {
            "kind": "native"
          },
          "category": "read",
          "invoked": false
        },
        {
          "name": "grep",
          "description": "Search file contents with a regex pattern. Use path to choose the search root, glob_filter to limit matching files, case_insensitive for case folding, and max_results to cap output.",
          "source": {
            "kind": "native"
          },
          "category": "read",
          "invoked": true
        },
        {
          "name": "read_file",
          "description": "Read files before editing them. Returns line-numbered text and supports offset/limit for large files. Use this instead of shell cat, head, tail, or sed when inspecting repository files.",
          "source": {
            "kind": "native"
          },
          "category": "read",
          "invoked": true
        },
        {
          "name": "send_input",
          "description": "Send a follow-up message to a running subagent when new information or corrected instructions are needed.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": false
        },
        {
          "name": "shell",
          "description": "Execute shell commands for terminal operations, package managers, tests and builds. Use dedicated tools for file reads, file edits, filename searches, and content searches. Provide timeout_ms for long-running commands.",
          "source": {
            "kind": "native"
          },
          "category": "shell",
          "invoked": true
        },
        {
          "name": "spawn_agent",
          "description": "Spawn a subagent for independent work or context isolation. Use it for tasks that can proceed separately, and avoid duplicating the same work in the parent session.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": false
        },
        {
          "name": "wait",
          "description": "Wait for a subagent to complete, then use the result to synthesize the outcome for the user.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": false
        },
        {
          "name": "web_fetch",
          "description": "Fetch content from a URL that starts with http:// or https://. Pass a prompt to extract specific information or summarize the page; omit prompt to return the page content.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "web_search",
          "description": "Search the web using Brave Search when current external information is needed. Returns result titles, URLs, and descriptions; use web_fetch for a specific URL.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "write_file",
          "description": "Create new files, or overwrite an existing file only when replacement is explicitly intended. Prefer edit_file for targeted changes to existing files because write_file overwrites the full file content.",
          "source": {
            "kind": "native"
          },
          "category": "write",
          "invoked": false
        }
      ],
      "context_window": {
        "provider": "anthropic",
        "model": "claude-opus-4-7",
        "context_window_tokens": 1000000,
        "input_tokens": 248845,
        "usage_percent": 24.8845,
        "count_method": "response_usage_scaled_breakdown",
        "staleness": "live",
        "generated_at": "2026-05-28T06:46:59.270682Z",
        "event_seq": 3412,
        "breakdown": [
          {
            "category": "system_prompt",
            "tokens": 2524,
            "usage_percent": 0.2524
          },
          {
            "category": "tools",
            "tokens": 2872,
            "usage_percent": 0.2872
          },
          {
            "category": "memory",
            "tokens": 6105,
            "usage_percent": 0.6105
          },
          {
            "category": "conversation",
            "tokens": 237337,
            "usage_percent": 23.7337
          },
          {
            "category": "other",
            "tokens": 7,
            "usage_percent": 0.0007
          }
        ],
        "warnings": []
      },
      "state": "running"
    },
    "verify@1": {
      "first_event_seq": 2691,
      "prompt": null,
      "response": null,
      "completion": {
        "outcome": "failed",
        "notes": null,
        "failure_reason": "Script failed with exit code: 1\n\n## output\nes/fabro-server)\n   Compiling fabro-cli v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-cli)\n   Compiling globset v0.4.18\n   Compiling rust-embed-utils v8.11.0\n   Compiling rust-embed v8.11.0\n   Compiling fabro-model v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-model)\n   Compiling fabro-spa v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-spa)\n   Compiling fabro-types v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-types)\n   Compiling fabro-oauth v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-oauth)\n   Compiling axum-extra v0.10.3\n   Compiling fabro-config v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-config)\n   Compiling fabro-github v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-github)\n   Compiling fabro-vault v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-vault)\n   Compiling fabro-store v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-store)\n   Compiling fabro-graphviz v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-graphviz)\n   Compiling fabro-template v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-template)\n   Compiling fabro-core v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-core)\n   Compiling fabro-auth v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-auth)\n   Compiling fabro-interview v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-interview)\n   Compiling fabro-variable v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-variable)\n   Compiling fabro-llm v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-llm)\n   Compiling fabro-dump v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-dump)\n   Compiling fabro-sandbox v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-sandbox)\n   Compiling fabro-api v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-api)\n   Compiling fabro-mcp v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-mcp)\n   Compiling fabro-checkpoint v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-checkpoint)\n   Compiling fabro-environment v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-environment)\n   Compiling fabro-install v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-install)\n   Compiling fabro-agent v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-agent)\n   Compiling fabro-acp v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-acp)\n   Compiling fabro-validate v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-validate)\n   Compiling fabro-client v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-client)\n   Compiling fabro-hooks v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-hooks)\n   Compiling fabro-tool v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-tool)\n   Compiling fabro-workflow v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-workflow)\n   Compiling fabro-slack v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-slack)\n   Compiling fabro-manifest v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-manifest)\n   Compiling fabro-mcp-server v0.246.0-nightly.0 (/home/daytona/repos/fabro-sh/fabro/lib/crates/fabro-mcp-server)\nerror[E0063]: missing field `environment_defaults` in initializer of `ManifestBuildInput`\n  --> lib/crates/fabro-cli/src/commands/run/create.rs:43:40\n   |\n43 |     let mut built = build_run_manifest(ManifestBuildInput {\n   |                                        ^^^^^^^^^^^^^^^^^^ missing `environment_defaults`\n\nFor more information about this error, try `rustc --explain E0063`.\nerror: could not compile `fabro-cli` (bin \"fabro\") due to 1 previous error\n",
        "timestamp": "2026-05-28T06:01:36.425702Z"
      },
      "provider_used": null,
      "diff": null,
      "script_invocation": {
        "script": "git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\\bActorRef\\b|\\bActorKind\\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\\s*==\\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1",
        "command": "exec 2>&1\ngit fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\\bActorRef\\b|\\bActorKind\\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\\s*==\\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1",
        "language": "shell"
      },
      "script_timing": {
        "output": "blob://sha256/bd66f55933ad7ab0b5c80315118e9cea320280cbfe5e73ec827b138787eff393",
        "exit_code": 1,
        "duration_ms": 74703,
        "termination": "exited",
        "output_bytes": 5783,
        "live_streaming": true
      },
      "parallel_results": null,
      "output": null,
      "output_bytes": 5783,
      "live_streaming": true,
      "termination": "exited",
      "started_at": "2026-05-28T06:00:21.702493Z",
      "handler": "command",
      "timing": {
        "wall_time_ms": 74721,
        "inference_time_ms": 0,
        "tool_time_ms": 74703,
        "active_time_ms": 74703
      },
      "usage": {
        "input_tokens": 0,
        "output_tokens": 0,
        "total_tokens": 0,
        "reasoning_tokens": 0,
        "cache_read_tokens": 0,
        "cache_write_tokens": 0
      },
      "state": "failed"
    },
    "implement@1": {
      "first_event_seq": 51,
      "prompt": null,
      "response": null,
      "completion": {
        "outcome": "failed",
        "notes": null,
        "failure_reason": "LLM error: Invalid request to openai: No tool call found for function call output with call_id call_DUxNRWlboQi3OOOvhg0NhD3h.",
        "timestamp": "2026-05-28T05:01:49.527470Z"
      },
      "provider_used": {
        "mode": "agent",
        "provider": "openai",
        "model": "gpt-5.5",
        "reasoning_effort": "xhigh"
      },
      "diff": null,
      "script_invocation": null,
      "script_timing": null,
      "parallel_results": null,
      "output": null,
      "started_at": "2026-05-28T04:33:22.202480Z",
      "handler": "agent",
      "timing": {
        "wall_time_ms": 1707305,
        "inference_time_ms": 0,
        "tool_time_ms": 0,
        "active_time_ms": 0
      },
      "usage": {
        "input_tokens": 2380540,
        "output_tokens": 38445,
        "total_tokens": 25456584,
        "reasoning_tokens": 15519,
        "cache_read_tokens": 23022080,
        "cache_write_tokens": 0
      },
      "model": {
        "provider": "openai",
        "model_id": "gpt-5.5"
      },
      "todos": {
        "kind": "openai_plan",
        "list_id": "openai_plan:5ff7e769-1627-4ae3-8719-4881ba9c7d3e",
        "items": [
          {
            "id": "d611d499f5118e5f",
            "status": "completed",
            "order": 0,
            "subject": "Inspect existing environment/settings/run/API/store patterns and identify touchpoints"
          },
          {
            "id": "3d32418cee56c51b",
            "status": "completed",
            "order": 1,
            "subject": "Implement fabro-environment crate with store, persistence, validation, and tests"
          },
          {
            "id": "692618ec77c94fa9",
            "status": "completed",
            "order": 2,
            "subject": "Make config environments migration-only and update config tests"
          },
          {
            "id": "47c843470b579827",
            "status": "in_progress",
            "order": 3,
            "subject": "Wire EnvironmentStore into server run resolution and tests"
          },
          {
            "id": "e7569666b3b8d963",
            "status": "pending",
            "order": 4,
            "subject": "Add Environment CRUD OpenAPI/server API and regenerate clients"
          },
          {
            "id": "9556d8afc4b16df9",
            "status": "pending",
            "order": 5,
            "subject": "Adjust CLI/manifest behavior and tests"
          },
          {
            "id": "3864fb367e039b2d",
            "status": "pending",
            "order": 6,
            "subject": "Update install flows, docs, generated references"
          },
          {
            "id": "bfa49e76ebdf4ca8",
            "status": "pending",
            "order": 7,
            "subject": "Run targeted and workspace validation, fix regressions"
          }
        ]
      },
      "subagents": [
        {
          "agent_id": "5af7e16a",
          "depth": 1,
          "task": "Investigate existing automation store pattern, API routes, ETag/If-Match handling, and server test patterns. Report relevant files/functions and suggested implementation approach for Environment CRUD mirroring AutomationStore. Do not modify files.",
          "status": {
            "kind": "closed"
          }
        },
        {
          "agent_id": "214b24ab",
          "depth": 1,
          "task": "Investigate existing config environment types, defaults, builders, migrations, and tests. Report how EnvironmentLayer/EnvironmentSettings are defined and resolved, and where to change behavior to make [environments] migration-only. Do not modify files.",
          "status": {
            "kind": "closed"
          }
        },
        {
          "agent_id": "7f21ea3f",
          "depth": 1,
          "task": "Investigate CLI run/preflight/graph/validate/repo init handling of --environment and --docker-image, plus manifest Dockerfile collection. Report relevant files/functions and test locations. Do not modify files.",
          "status": {
            "kind": "closed"
          }
        }
      ],
      "permission_level": "full",
      "agent_tools": [
        {
          "name": "apply_patch",
          "description": "Use the `apply_patch` tool to edit files. This is a FREEFORM tool, so do not wrap the patch in JSON.",
          "source": {
            "kind": "native"
          },
          "category": "write",
          "invoked": true
        },
        {
          "name": "close_agent",
          "description": "Close a running subagent that is no longer needed.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": false
        },
        {
          "name": "glob",
          "description": "Find files by file names using a glob pattern. Use path to choose the search root. Prefer this over shell find or ls when locating repository files.",
          "source": {
            "kind": "native"
          },
          "category": "read",
          "invoked": true
        },
        {
          "name": "grep",
          "description": "Search file contents with a regex pattern. Use path to choose the search root, glob_filter to limit matching files, case_insensitive for case folding, and max_results to cap output.",
          "source": {
            "kind": "native"
          },
          "category": "read",
          "invoked": true
        },
        {
          "name": "read_file",
          "description": "Read files before editing them. Returns line-numbered text and supports offset/limit for large files. Use this instead of shell cat, head, tail, or sed when inspecting repository files.",
          "source": {
            "kind": "native"
          },
          "category": "read",
          "invoked": true
        },
        {
          "name": "request_user_input",
          "description": "Ask the human one or more questions and wait for their answers before continuing this stage.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "send_input",
          "description": "Send a follow-up message to a running subagent when new information or corrected instructions are needed.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": false
        },
        {
          "name": "shell",
          "description": "Execute shell commands for terminal operations, package managers, tests and builds. Use dedicated tools for file reads, file edits, filename searches, and content searches. Provide timeout_ms for long-running commands.",
          "source": {
            "kind": "native"
          },
          "category": "shell",
          "invoked": true
        },
        {
          "name": "spawn_agent",
          "description": "Spawn a subagent for independent work or context isolation. Use it for tasks that can proceed separately, and avoid duplicating the same work in the parent session.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": true
        },
        {
          "name": "update_plan",
          "description": "Update the multi-step plan for the current task. Submit the entire plan; existing steps are reconciled by exact step text.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": true
        },
        {
          "name": "wait",
          "description": "Wait for a subagent to complete, then use the result to synthesize the outcome for the user.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": false
        },
        {
          "name": "web_fetch",
          "description": "Fetch content from a URL that starts with http:// or https://. Pass a prompt to extract specific information or summarize the page; omit prompt to return the page content.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "web_search",
          "description": "Search the web using Brave Search when current external information is needed. Returns result titles, URLs, and descriptions; use web_fetch for a specific URL.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "write_file",
          "description": "Create new files, or overwrite an existing file only when replacement is explicitly intended. Prefer edit_file for targeted changes to existing files because write_file overwrites the full file content.",
          "source": {
            "kind": "native"
          },
          "category": "write",
          "invoked": false
        }
      ],
      "context_window": {
        "provider": "openai",
        "model": "gpt-5.5",
        "context_window_tokens": 272000,
        "input_tokens": 217541,
        "usage_percent": 79.97830882352942,
        "count_method": "response_usage_scaled_breakdown",
        "staleness": "live",
        "generated_at": "2026-05-28T05:00:04.419324Z",
        "event_seq": 717,
        "breakdown": [
          {
            "category": "system_prompt",
            "tokens": 882,
            "usage_percent": 0.32426470588235295
          },
          {
            "category": "tools",
            "tokens": 1257,
            "usage_percent": 0.4621323529411765
          },
          {
            "category": "memory",
            "tokens": 2993,
            "usage_percent": 1.1003676470588235
          },
          {
            "category": "conversation",
            "tokens": 212403,
            "usage_percent": 78.08933823529412
          },
          {
            "category": "other",
            "tokens": 6,
            "usage_percent": 0.0022058823529411764
          }
        ],
        "warnings": []
      },
      "state": "failed"
    },
    "simplify_opus@1": {
      "first_event_seq": 736,
      "prompt": null,
      "response": null,
      "completion": {
        "outcome": "succeeded",
        "notes": "Stage completed: simplify_opus",
        "failure_reason": null,
        "timestamp": "2026-05-28T05:39:21.627119Z"
      },
      "provider_used": {
        "mode": "agent",
        "provider": "anthropic",
        "model": "claude-opus-4-7"
      },
      "diff": null,
      "script_invocation": null,
      "script_timing": null,
      "parallel_results": null,
      "output": null,
      "started_at": "2026-05-28T05:01:54.258078Z",
      "handler": "agent",
      "timing": {
        "wall_time_ms": 2247358,
        "inference_time_ms": 1449354,
        "tool_time_ms": 794439,
        "active_time_ms": 2243793
      },
      "usage": {
        "input_tokens": 262080,
        "output_tokens": 89618,
        "total_tokens": 49098605,
        "reasoning_tokens": 0,
        "cache_read_tokens": 44336839,
        "cache_write_tokens": 4410068,
        "total_usd_micros": 53282194
      },
      "model": {
        "provider": "anthropic",
        "model_id": "claude-opus-4-7"
      },
      "todos": {
        "kind": "anthropic_tasks",
        "list_id": "anthropic_tasks:0677b758-8995-43c0-ba98-f4dd3800084a",
        "items": [
          {
            "id": "1",
            "status": "completed",
            "order": 0,
            "subject": "Delete unused public API: Environment::from_toml_bytes, to_toml_string, MissingRevision variant",
            "description": "Quality review §5.1, §5.5, §5.7 — these are pub but have no callers in the workspace.",
            "active_form": "Deleting unused public API"
          },
          {
            "id": "2",
            "status": "completed",
            "order": 1,
            "subject": "Simplify resolve_path and drop local value() helper",
            "description": "Quality review §4.3: `resolve_path` reimplements `Path::join`. Reuse §M1: drop local `value()` wrapper in model.rs in favor of `toml_edit::value`.",
            "active_form": "Simplifying small helpers in fabro-environment"
          },
          {
            "id": "3",
            "status": "completed",
            "order": 2,
            "subject": "Drop fake async from EnvironmentStore::list/get",
            "description": "Quality review §5.3 — methods are `async` but never `.await`. Drop the async keyword.",
            "active_form": "Dropping fake async from list/get"
          },
          {
            "id": "4",
            "status": "completed",
            "order": 3,
            "subject": "Delete dead code in 2026050101 legacy sandbox migration",
            "description": "Reuse L1 / quality §3.2: `LegacySandboxMigrationReport`, `migrate_settings_path`, `write_next_backup`, `backup_path_for`, `next_backup_path`, the legacy `REMOVAL_NOTE`, and two tests that only exercise the dead surface. The live caller goes through `migrate_contents`.",
            "active_form": "Deleting dead legacy migration code"
          },
          {
            "id": "5",
            "status": "completed",
            "order": 4,
            "subject": "Simplify write_new to direct create_new",
            "description": "Efficiency #5 / quality §2.1: replace temp+hard_link+remove dance with direct `OpenOptions::create_new(true).open(path)`, matching `seed_missing_environments`. Fewer syscalls, no temp leak window.",
            "active_form": "Simplifying write_new"
          },
          {
            "id": "6",
            "status": "completed",
            "order": 5,
            "subject": "Collapse EnvironmentReplace into EnvironmentSettings",
            "description": "Quality §1.3: `EnvironmentReplace` is field-for-field identical to `EnvironmentSettings`. Delete it and use `EnvironmentSettings` directly in `EnvironmentStore::replace` and `EnvironmentDraft`.",
            "active_form": "Collapsing EnvironmentReplace"
          },
          {
            "id": "7",
            "status": "completed",
            "order": 6,
            "subject": "Collapse Environment to {id, revision, settings: EnvironmentSettings}",
            "description": "Quality §1.1: drop duplicated flat fields, eliminate `settings()` and `from_validated_settings`. Adjust callsites.",
            "active_form": "Collapsing Environment fields"
          },
          {
            "id": "8",
            "status": "completed",
            "order": 7,
            "subject": "Cache catalog_layer() as Arc on the store",
            "description": "Efficiency #1: avoid rebuilding the full MergeMap on every run create/preflight/graph/validate. Store as Arc and refresh on create/replace/delete.",
            "active_form": "Caching catalog_layer"
          },
          {
            "id": "9",
            "status": "completed",
            "order": 8,
            "subject": "Inline load_settings_path wrapper and unify parse_and_validate helper",
            "description": "Quality §2.2, §2.3: drop the thin `load_settings_path` wrapper and consolidate the `parse + validate_parsed_source` two-step into a single helper in builders.rs.",
            "active_form": "Tightening config builder API"
          }
        ]
      },
      "subagents": [
        {
          "agent_id": "f1fea254",
          "depth": 1,
          "task": "You are Review Agent 1: Code Reuse Review.\n\nReview the diff at `/tmp/full_diff.patch` (the full git diff vs origin/main on this branch). The change adds a new `fabro-environment` crate (server-owned environments) and makes related config/server changes.\n\nFor each new function and inline pattern introduced in the diff, search the codebase for existing utilities/helpers that could replace them. Focus on:\n\n1. Newly written functions in `lib/crates/fabro-environment/src/store.rs` and `lib/crates/fabro-environment/src/model.rs`:\n   - `write_atomic`, `write_new`, `cleanup_temp`, `temp_path_for`, `seed_missing_environments`, `load_environments`, `load_environment_file`, `id_from_path`, `is_toml_file`, `environment_path` — does similar atomic write/temp-path/load-or-seed exist in `fabro-automation`, `fabro-config`, `fabro-variables`, or elsewhere? Check `lib/crates/fabro-automation/src/store.rs` and similar stores.\n   - `canonical_bytes` and its helpers (`append_image`, `append_resources`, `append_network`, `append_lifecycle`, `append_string_map`, `append_interp_map`, `append_volumes`, `ensure_table`, `value`, `string_array`, `sorted_map`) in model.rs — is there a canonical TOML writer for layers already?\n   - `environment_settings_to_layer`, `image_settings_to_layer`, etc. — are there existing \"settings -> layer\" inverse converters in fabro-config?\n   - `EnvironmentId` validation (`is_valid_environment_id`) — is there an existing slug/identifier validator? Check fabro-automation for `AutomationId` pattern.\n   - `EnvironmentRevision` (SHA-256 hex) — is there an existing revision/etag helper? Check fabro-automation.\n\n2. The migration `lib/crates/fabro-config/migrations/2026052801_settings_environments_to_server_files.rs`:\n   - `validate_environment_id`, `is_valid_environment_id` duplicate the same function in `lib/crates/fabro-environment/src/id.rs`. Could it use `EnvironmentId::new` from the new crate?\n   - `write_next_backup` and `backup_path_for` — these are also in the older `2026050101_legacy_sandbox_to_environments.rs` migration. Are they truly duplicated, and should they be shared?\n   - `write_new_file` helper — check for existing safe write helpers.\n\n3. In `lib/crates/fabro-config/src/parse.rs` the new `validate_settings_source` function — is there an existing source-type-aware validator pattern? Is the SettingsSource enum redundant with anything already?\n\n4. The legacy migration file (`2026050101_legacy_sandbox_to_environments.rs`) had `LegacySandboxMigrationReport` and `migrate_settings_path` retained but dead — its only caller (`migrations.rs`) now uses the new migration. Confirm this is dead and report it.\n\n5. Check that the test helper `seeded_environment_catalog` in `fabro-config/src/tests/mod.rs` and in `fabro-config/src/builders.rs` tests aren't unnecessarily duplicated.\n\nOutput a concrete list of suggested replacements with file/line refs and the existing code each could call instead. Be specific. Do not edit any files; only produce a findings list. Include false-positive notes if a finding is borderline.",
          "status": {
            "kind": "completed",
            "success": true,
            "turns_used": 73
          }
        },
        {
          "agent_id": "00ec659d",
          "depth": 1,
          "task": "You are Review Agent 2: Code Quality Review.\n\nReview the diff at `/tmp/full_diff.patch` (the full git diff vs origin/main on this branch). The change adds a new `fabro-environment` crate and adjusts fabro-config and fabro-server.\n\nLook specifically for:\n\n1. Redundant state and conversions:\n   - `Environment` struct has `provider`, `image`, `resources`, ...as individual fields, but also has `settings()` that reconstructs an `EnvironmentSettings`. Could it just hold an `EnvironmentSettings`?\n   - `EnvironmentDraft` and `EnvironmentReplace` have identical field shapes — the draft is just `(id, replace)`. Is splitting them justified?\n   - Conversions `environment_settings_to_layer` etc. immediately bounce dense settings back to a sparse layer for canonical serialization. Could canonical TOML be written directly from `EnvironmentSettings`?\n\n2. Parameter sprawl / duplicated helpers:\n   - `write_atomic` and `write_new` in `lib/crates/fabro-environment/src/store.rs` are near-duplicates of each other. Confirm the difference (write_atomic uses rename, write_new uses hard_link + cleanup_temp). Is this distinction load-bearing?\n   - Two `load_settings_path` variants (`load_settings_path` and `load_settings_path_with_source`) — the original is now a thin wrapper. Could one of them be removed?\n   - In `fabro-config/src/builders.rs` lots of new `validate_parsed_source(...)` call sites — could parsing+validation be unified into one helper?\n\n3. Leaky abstractions:\n   - `EnvironmentLayer` is being plumbed across the fabro-environment public API (`to_layer`, `catalog_layer`). Is this a leak? Could the server consume `Environment` directly?\n   - The legacy `fabro-config/migrations/2026050101_legacy_sandbox_to_environments.rs` still exposes `LegacySandboxMigrationReport` and `migrate_settings_path` but they appear unused (callers go through `migrate_contents`). Flag dead code.\n   - Settings source distinction (`SettingsSource::ActiveSettings` vs `User` vs `Project` etc.) is duplicated between `SettingsSource::runs_settings_migrations` and a separate match in `validate_settings_source`. Could be one method.\n\n4. Stringly-typed code:\n   - `toml_run_environment_override_path` returns `Option<String>` paths like `\"run.environment.image\"` — could it use an enum or constants?\n   - In tests `assert!(message.contains(\"[run.environment.lifecycle] is now server-managed\"))` — checking string content is brittle.\n   - In `model.rs::resolve_path` and similar string-based path manipulation — any cleaner options?\n   - In `lib/crates/fabro-server/src/server.rs` `system_sandbox_provider` returns a `String` — but unrelated, skip.\n\n5. Other quality issues:\n   - `Environment::from_toml_bytes` is `pub` but `from_persisted_path` is `pub(crate)` — is the public `from_toml_bytes` actually used anywhere?\n   - `EnvironmentReplace::from_settings` is `pub` and used only in tests. Same for `EnvironmentDraft` — examine the public API surface.\n   - `EnvironmentStore::list/get` are `async` but use synchronous `RwLock` reads; the async is misleading. Why are they async?\n   - Use of `expect(\"environment store read lock poisoned\")` repeatedly — consider a small helper or just `std::sync::RwLock::read().unwrap()`.\n   - `MissingRevision` error variant exists in EnvironmentStoreError but is never constructed — dead variant?\n   - `canonical_bytes` returns String, but most callers wrap as `into_bytes()` immediately. Could it return bytes?\n   - In `from_persisted_path` the `path.into()` is called twice (once before the `.clone()` for `parse_persisted`) — minor.\n   - `resolve_path` constructs `Path::new(path)` then either returns a `PathBuf` or joins; this is exactly what `Path::join` does (it ignores the base if the right side is absolute). Could be one line.\n   - The `EnvironmentStore` uses both `tokio::sync::Mutex` (for `mutations`) AND `std::sync::RwLock` (for `environments`). Is this necessary? Could it be a single tokio RwLock?\n\nAggressive code quality is OK. Output concrete findings with file/line refs and a recommended fix. Do not edit files.",
          "status": {
            "kind": "completed",
            "success": true,
            "turns_used": 81
          }
        },
        {
          "agent_id": "73f3ad2f",
          "depth": 1,
          "task": "You are Review Agent 3: Efficiency Review.\n\nReview the diff at `/tmp/full_diff.patch` (the full git diff vs origin/main on this branch).\n\nLook specifically for:\n\n1. Unnecessary work:\n   - `EnvironmentStore::catalog_layer()` is called on EVERY run create/preflight/graph/validate (`lib/crates/fabro-server/src/server/handler/runs.rs` and `graph.rs`). It clones every environment, converts each to an `EnvironmentLayer`, and constructs a `MergeMap`. Should this be cached? Look at how often it's called and whether the catalog changes frequently.\n   - `Environment::to_layer()` reconstructs `EnvironmentSettings` (via `self.settings()`) then converts it back to a sparse layer. Double work.\n   - In `lib/crates/fabro-environment/src/model.rs::canonical_bytes` returns String, then callers do `.into_bytes()`. Avoidable.\n   - In `lib/crates/fabro-config/src/load.rs::load_settings_path_with_source`: the file content may be migrated, then parsed, then validated. If the migration runs, parse runs twice (once inside `run_migrations` to produce the report, once after). Check `2026052801_settings_environments_to_server_files.rs::migrate_settings_path` and `extract_environments` — do they parse the document, then return contents that get parsed again?\n   - In the migration `extract_environments`: parses TOML into `DocumentMut`, iterates env entries, then re-serializes them to string contents via `DocumentMut::new()`. Each env then will be parsed again when the server starts. This is fine for a one-time migration, but flag it.\n\n2. Missed concurrency:\n   - `EnvironmentStore::load_or_seed` reads files sequentially. For ~4 seeded environments this is trivial, but flag if startup latency matters.\n   - In `build_app_state` (server.rs) it loads `AutomationStore`, `EnvironmentStore`, `VariableStore` sequentially. Each does file I/O — minor.\n\n3. Hot-path bloat:\n   - Each run creation now calls `state.environment_store().catalog_layer()` which clones the entire env catalog. Quantify: is this on a hot path?\n   - `resolve_manifest_run_settings_with_catalog` in server.rs runs on startup AND on settings hot-reload. It rebuilds a full WorkflowSettingsBuilder. Probably fine.\n\n4. Unnecessary existence checks (TOCTOU):\n   - In the migration `extract_environments`: pre-checks `target.exists()` before creating environment files. This is the right behavior (don't overwrite), so probably OK, but using `create_new(true)` open mode would also work. Flag if not strictly necessary.\n   - `EnvironmentStore::seed_missing_environments` uses `create_new(true)` correctly — good.\n   - `EnvironmentStore::write_new` also uses `create_new(true)` — good.\n\n5. Memory:\n   - `Environment` stores `provider/image/resources/network/lifecycle/labels/volumes/env` AND `id/revision`. Cloned freely in `list()` and `get()`. For 4-100 envs negligible.\n   - `RwLock<HashMap<EnvironmentId, Environment>>` is fine.\n\n6. Overly broad operations:\n   - `load_environments` reads every TOML file in the dir at startup. Required, fine.\n   - `catalog_layer()` walks the entire HashMap on every call. Could be cached as `Arc<MergeMap<EnvironmentLayer>>` updated on mutation.\n\n7. Specific:\n   - `EnvironmentStore::write_atomic` writes via `tempfile + rename`. The temp filename uses `SystemTime` + `process::id` — fine.\n   - `EnvironmentStore::write_new` uses `tempfile + hard_link + cleanup_temp` — why hard_link instead of rename? Hard link doesn't atomically replace, but `create_new` open of `path` directly would be simpler and atomic. Flag this.\n\nOutput concrete findings with file/line refs. Do not edit files. Be specific about the actual efficiency cost where possible.",
          "status": {
            "kind": "completed",
            "success": true,
            "turns_used": 37
          }
        }
      ],
      "permission_level": "full",
      "agent_tools": [
        {
          "name": "AskUserQuestion",
          "description": "Ask the human one or more questions and wait for their answers before continuing this stage.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "TaskCreate",
          "description": "Create pending tasks in the current session. Use concise subjects, descriptions, optional activeForm text, and metadata. Check TaskList first to avoid duplicate tasks.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": true
        },
        {
          "name": "TaskGet",
          "description": "Get one task by taskId, including subject, status, description, owner, blockedBy, and blocks.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "TaskList",
          "description": "List tasks for the current session, including status, owner, and blocking dependencies. Use TaskGet with a taskId for full description and dependency details.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "TaskUpdate",
          "description": "Update an existing task's status, text, owner, metadata, or dependencies. Valid statuses are pending, in_progress, completed, and deleted. After completing a task, call TaskList to find newly unblocked work.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": true
        },
        {
          "name": "close_agent",
          "description": "Close a running subagent that is no longer needed.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": false
        },
        {
          "name": "edit_file",
          "description": "Edit a file by replacing an exact string. The old_string must be an exact match and unique unless replace_all is true; include surrounding context when needed. Read the file first and preserve existing indentation.",
          "source": {
            "kind": "native"
          },
          "category": "write",
          "invoked": true
        },
        {
          "name": "glob",
          "description": "Find files by file names using a glob pattern. Use path to choose the search root. Prefer this over shell find or ls when locating repository files.",
          "source": {
            "kind": "native"
          },
          "category": "read",
          "invoked": true
        },
        {
          "name": "grep",
          "description": "Search file contents with a regex pattern. Use path to choose the search root, glob_filter to limit matching files, case_insensitive for case folding, and max_results to cap output.",
          "source": {
            "kind": "native"
          },
          "category": "read",
          "invoked": true
        },
        {
          "name": "read_file",
          "description": "Read files before editing them. Returns line-numbered text and supports offset/limit for large files. Use this instead of shell cat, head, tail, or sed when inspecting repository files.",
          "source": {
            "kind": "native"
          },
          "category": "read",
          "invoked": true
        },
        {
          "name": "send_input",
          "description": "Send a follow-up message to a running subagent when new information or corrected instructions are needed.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": false
        },
        {
          "name": "shell",
          "description": "Execute shell commands for terminal operations, package managers, tests and builds. Use dedicated tools for file reads, file edits, filename searches, and content searches. Provide timeout_ms for long-running commands.",
          "source": {
            "kind": "native"
          },
          "category": "shell",
          "invoked": true
        },
        {
          "name": "spawn_agent",
          "description": "Spawn a subagent for independent work or context isolation. Use it for tasks that can proceed separately, and avoid duplicating the same work in the parent session.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": true
        },
        {
          "name": "wait",
          "description": "Wait for a subagent to complete, then use the result to synthesize the outcome for the user.",
          "source": {
            "kind": "native"
          },
          "category": "subagent",
          "invoked": true
        },
        {
          "name": "web_fetch",
          "description": "Fetch content from a URL that starts with http:// or https://. Pass a prompt to extract specific information or summarize the page; omit prompt to return the page content.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "web_search",
          "description": "Search the web using Brave Search when current external information is needed. Returns result titles, URLs, and descriptions; use web_fetch for a specific URL.",
          "source": {
            "kind": "native"
          },
          "category": "other",
          "invoked": false
        },
        {
          "name": "write_file",
          "description": "Create new files, or overwrite an existing file only when replacement is explicitly intended. Prefer edit_file for targeted changes to existing files because write_file overwrites the full file content.",
          "source": {
            "kind": "native"
          },
          "category": "write",
          "invoked": false
        }
      ],
      "context_window": {
        "provider": "anthropic",
        "model": "claude-opus-4-7",
        "context_window_tokens": 1000000,
        "input_tokens": 275798,
        "usage_percent": 27.5798,
        "count_method": "response_usage_scaled_breakdown",
        "staleness": "live",
        "generated_at": "2026-05-28T05:39:21.419788Z",
        "event_seq": 2116,
        "breakdown": [
          {
            "category": "system_prompt",
            "tokens": 2335,
            "usage_percent": 0.2335
          },
          {
            "category": "tools",
            "tokens": 2653,
            "usage_percent": 0.2653
          },
          {
            "category": "memory",
            "tokens": 5640,
            "usage_percent": 0.564
          },
          {
            "category": "conversation",
            "tokens": 265163,
            "usage_percent": 26.5163
          },
          {
            "category": "other",
            "tokens": 7,
            "usage_percent": 0.0007
          }
        ],
        "warnings": []
      },
      "state": "succeeded"
    }
  }
}