diff --git a/.claude/.beads/config.yaml b/.claude/.beads/config.yaml
index 46b9e82e..5d0ceecc 100644
--- a/.claude/.beads/config.yaml
+++ b/.claude/.beads/config.yaml
@@ -26,11 +26,6 @@
 # Default actor for audit trails (overridden by BD_ACTOR or --actor)
 # actor: ""
 
-# Export events (audit trail) to .beads/events.jsonl on each flush/sync
-# When enabled, new events are appended incrementally using a high-water mark.
-# Use 'bd export --events' to trigger manually regardless of this setting.
-# events-export: false
-
 # Multi-repo configuration (experimental - bd-307)
 # Allows hydrating from multiple repositories and routing writes to the correct JSONL
 # repos:
diff --git a/.claude/commands/add-command.md b/.claude/commands/add-command.md
index ceb45a2d..23be23eb 100644
--- a/.claude/commands/add-command.md
+++ b/.claude/commands/add-command.md
@@ -11,7 +11,7 @@ argument-hint: <command-name> <description>
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/.claude/commands/commit.md b/.claude/commands/commit.md
index e40205e9..2ac4ec53 100644
--- a/.claude/commands/commit.md
+++ b/.claude/commands/commit.md
@@ -11,7 +11,7 @@ argument-hint: [optional-commit-description]
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/.claude/commands/create-adr.md b/.claude/commands/create-adr.md
index 68bab708..4b79f296 100644
--- a/.claude/commands/create-adr.md
+++ b/.claude/commands/create-adr.md
@@ -17,7 +17,7 @@ Create a new ADR to document an architectural decision. ADRs capture the "why" b
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/.claude/commands/create-issues.md b/.claude/commands/create-issues.md
index 7c1ec62d..ae37f027 100644
--- a/.claude/commands/create-issues.md
+++ b/.claude/commands/create-issues.md
@@ -15,7 +15,7 @@ Create structured implementation plan that bridges product thinking (PRD) with t
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
@@ -113,7 +113,7 @@ For each task, create a bd issue with:
 
 ```bash
 bd create "Task title" \
-  --type [feature|bug|task|chore] \
+  --type [feature|bug|task|epic|chore|decision] \
   --priority [1-3] \
   --description "Context and what needs to be built" \
   --design "Technical approach, architecture notes" \
@@ -149,8 +149,10 @@ bd create "Task title" \
 
 **Dependencies**: Link related issues
 
+The first argument is the issue that becomes blocked; the second is the blocker it waits on.
+
 ```bash
-bd dep add ISSUE-123 ISSUE-456 --type blocks
+bd dep add <blocked-id> <blocker-id> --type blocks
 ```
 
 ### Validation
@@ -179,20 +181,20 @@ After creating issues, verify:
 
 ### Beads Integration
 
-Use Beads MCP to:
+Use the `bd` CLI to:
 
 - Track work with `bd ready` to find next task
 - Create issues with `bd create "description"`
 - Track dependencies with `bd dep add`
 
-See <https://github.com/steveyegge/beads> for more information.
+See <https://github.com/gastownhall/beads> for more information.
 
 ## Integration with Other Commands
 
 - **Before /create-issues**: Use `/spike` if you need technical exploration first
 - **After /create-issues**: Use `/red` to start TDD on first task
 - **During work**: Use `bd update` to add notes/findings back to issues
-- **When stuck**: Check `bd show ISSUE-ID` to review acceptance criteria
+- **When stuck**: Check `bd show <id>` to review acceptance criteria
 
 <!--
 ============== WARNING ==============================================================================
diff --git a/.claude/commands/gap.md b/.claude/commands/gap.md
index 7d960b67..41cc1dea 100644
--- a/.claude/commands/gap.md
+++ b/.claude/commands/gap.md
@@ -11,7 +11,7 @@ argument-hint: [optional additional info]
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/.claude/commands/green.md b/.claude/commands/green.md
index 94ff71ca..7207ce51 100644
--- a/.claude/commands/green.md
+++ b/.claude/commands/green.md
@@ -19,7 +19,7 @@ GREEN PHASE! Apply the below to the user input above.
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/.claude/commands/issue.md b/.claude/commands/issue.md
index 2e71a0d6..f1fe232a 100644
--- a/.claude/commands/issue.md
+++ b/.claude/commands/issue.md
@@ -13,7 +13,7 @@ Analyze GitHub issue and create TDD implementation plan.
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
@@ -81,13 +81,13 @@ Understand the requirement by asking (use AskUserQuestion if needed):
 
 ### Beads Integration
 
-Use Beads MCP to:
+Use the `bd` CLI to:
 
 - Track work with `bd ready` to find next task
 - Create issues with `bd create "description"`
-- Track dependencies with `bd dep add`
+- Track dependencies with `bd dep add <blocked-id> <blocker-id>`
 
-See <https://github.com/steveyegge/beads> for more information.
+See <https://github.com/gastownhall/beads> for more information.
 
 ## TDD Fundamentals
 
diff --git a/.claude/commands/polish.md b/.claude/commands/polish.md
index 72bac6dd..d65248aa 100644
--- a/.claude/commands/polish.md
+++ b/.claude/commands/polish.md
@@ -11,7 +11,7 @@ argument-hint: [branch, PR#, file, or area to polish]
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/.claude/commands/red.md b/.claude/commands/red.md
index 32fc6784..17b35a50 100644
--- a/.claude/commands/red.md
+++ b/.claude/commands/red.md
@@ -19,7 +19,7 @@ RED PHASE! Apply the below to the user input above.
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/.claude/commands/refactor.md b/.claude/commands/refactor.md
index 578a1dd2..267ebf37 100644
--- a/.claude/commands/refactor.md
+++ b/.claude/commands/refactor.md
@@ -19,7 +19,7 @@ Apply this document (specifically the Refactor phase) to the user input above.
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/.claude/commands/research.md b/.claude/commands/research.md
index 93679c1a..819a27ed 100644
--- a/.claude/commands/research.md
+++ b/.claude/commands/research.md
@@ -11,7 +11,7 @@ argument-hint: <research topic or question>
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 **User arguments:**
 
diff --git a/.claude/commands/simplify.md b/.claude/commands/simplify.md
index c5cc1a8a..b2e108fb 100644
--- a/.claude/commands/simplify.md
+++ b/.claude/commands/simplify.md
@@ -11,7 +11,7 @@ argument-hint: [file, function, or area to simplify]
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 **User arguments:**
 
diff --git a/.claude/commands/spike.md b/.claude/commands/spike.md
index f1e0583f..6bd674a2 100644
--- a/.claude/commands/spike.md
+++ b/.claude/commands/spike.md
@@ -19,7 +19,7 @@ SPIKE PHASE! Apply the below to the user input above.
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/.claude/commands/summarize.md b/.claude/commands/summarize.md
index 63dcecf5..cbe266d9 100644
--- a/.claude/commands/summarize.md
+++ b/.claude/commands/summarize.md
@@ -11,7 +11,7 @@ argument-hint: [optional additional info]
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
@@ -53,7 +53,7 @@ Keep the summary concise and actionable - suitable for pasting into a new conver
 
 ## Beads Integration
 
-If Beads MCP is available, check for task tracking status and ask if the user wants to:
+Check for task tracking status with the `bd` CLI and ask if the user wants to:
 
 1. Review current task status
 2. Update task states based on conversation progress
diff --git a/.claude/commands/tdd-review.md b/.claude/commands/tdd-review.md
index f34f3088..2a87eb1d 100644
--- a/.claude/commands/tdd-review.md
+++ b/.claude/commands/tdd-review.md
@@ -11,7 +11,7 @@ argument-hint: [optional test file or directory path]
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/.claude/commands/tdd.md b/.claude/commands/tdd.md
index 10c71626..a525cb2e 100644
--- a/.claude/commands/tdd.md
+++ b/.claude/commands/tdd.md
@@ -13,7 +13,7 @@ argument-hint: [optional-response-to-last-message]
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/.claude/settings/models.jsonc b/.claude/settings/models.jsonc
index d8918e14..25546fe0 100644
--- a/.claude/settings/models.jsonc
+++ b/.claude/settings/models.jsonc
@@ -9,6 +9,7 @@
  */
 {
     "availableModels": [
+        "fable",
         "sonnet",
         "opus",
         "haiku",
diff --git a/.claude/settings/permissions/bash.jsonc b/.claude/settings/permissions/bash.jsonc
index df881f30..b6b9d83f 100644
--- a/.claude/settings/permissions/bash.jsonc
+++ b/.claude/settings/permissions/bash.jsonc
@@ -104,11 +104,10 @@
       "Bash(amp *)",
       "Bash(atuin *)",
       "Bash(bc *)",
-      "Bash(chezmoi *)",
       "Bash(diff *)",
       "Bash(jq *)",
-      "Bash(just *)",
       "Bash(lsof *)",
+      "Bash(task *)", // Task runner invocation is freely allowed.  Write access to the taskfiles themselves is protected by Ask.
       "Bash(test *)",
       "Bash(xxd)", // this invocation can be used to read, but not to write (so no " *" after it)
       "Bash(zk *)",
@@ -155,6 +154,17 @@
       "Bash(gh pr ready *)",
       "Bash(gh pr review *)",
       "Bash(gh pr update-branch *)",
+      // Task must run the repo's own taskfiles, which are the reviewed ones. These flags are the only ways to point it elsewhere (there is no environment variable equivalent -- https://github.com/go-task/task/issues/1721 was closed as a duplicate with nothing implemented), and `/tmp` is writable without a prompt, so without these denials `Bash(task *)` would be an allow-anything entry.
+      "Bash(task -t *)",
+      "Bash(task --taskfile *)",
+      "Bash(task --taskfile=*)",
+      "Bash(task --entrypoint *)",
+      "Bash(task --entrypoint=*)",
+      "Bash(task -d *)",
+      "Bash(task --dir *)",
+      "Bash(task --dir=*)",
+      "Bash(task -g *)",
+      "Bash(task --global *)",
 
       // Destructive File Operations
       "Bash(chmod -R *)",
diff --git a/.claude/settings/permissions/write.jsonc b/.claude/settings/permissions/edit.jsonc
similarity index 63%
rename from .claude/settings/permissions/write.jsonc
rename to .claude/settings/permissions/edit.jsonc
index f7991a15..dc1600d8 100644
--- a/.claude/settings/permissions/write.jsonc
+++ b/.claude/settings/permissions/edit.jsonc
@@ -8,10 +8,13 @@
  * =====================================================================================================
  */
 {
-  // Write permissions for specific files
+  // Edit permissions for specific files
   // This should only ever be running in a devcontainer, so pretty lenient permissions are allowed
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
   "permissions": {
-    "allow": ["Write(/tmp/**/*)", "Write(/workspaces/**/tmp/**)", "Write(tmp/**)"],
+    // A single leading slash anchors at the settings source, so absolute paths need the `//` prefix
+    "allow": ["Edit(//tmp/**)", "Edit(//workspaces/**/tmp/**)", "Edit(tmp/**)"],
+    // Agents are allowed to run any task, but this provides some basic protection against editing a task to do something nefarious that's normally forbidden.
+    "ask": ["Edit(Taskfile.yaml)", "Edit(.config/taskfiles/**)"],
   },
 }
diff --git a/.claude/skills/address-pr-comments/SKILL.md b/.claude/skills/address-pr-comments/SKILL.md
index 44eeed8e..4d90562b 100644
--- a/.claude/skills/address-pr-comments/SKILL.md
+++ b/.claude/skills/address-pr-comments/SKILL.md
@@ -2,7 +2,7 @@
 name: address-pr-comments
 description: Addresses PR review comments by making code changes and posting replies. Takes a PR number or auto-detects from current branch. Use when the user wants to address review feedback, respond to PR comments, fix PR feedback, or says "address comments on PR X".
 user-invocable: true
-allowed-tools: Bash, Read, Write, Edit, Grep, Glob, AskUserQuestion
+allowed-tools: Bash, Read, Write, Edit, Grep, Glob, AskUserQuestion, Skill
 adapted-from: https://github.com/josh-gree/my-claude-skills
 ---
 
@@ -190,9 +190,12 @@ Within a single Phase 2 invocation, the order below is strict. The invariants ap
 > **Never commit before the reply body is finalized with the user. Never push before all reply texts in the batch are finalized. Never post a reply before its commit has been pushed. Never skip the commit link in a code-change reply.**
 
 1. For each queued **code change** (in order):
-   - Follow the `/create-issues` process: create a bd issue with a proper title, description (why this change, context from the PR comment), design (technical approach), and Given-When-Then acceptance criteria. Export after creating.
+   - Invoke the `Skill` tool with `skill: "create-issues"`, passing the reviewer's comment and the agreed change as `args`. Follow the process it returns to create a bd issue with a proper title, description (why this change, context from the PR comment), design (technical approach), and Given-When-Then acceptance criteria. Export after creating.
    - Mark the issue in progress
-   - If the change involves code: execute the TDD red/green/refactor cycle (`/red` → `/green` → `/refactor`) against the acceptance criteria. If the change is non-code (docs, markdown, config, scripts, etc.): make the change directly — TDD does not apply, but the remaining steps are identical.
+   - Decide first whether the change is testable code. **If it is not** — documentation, markdown, comments, config, shell scripts where the project has no harness for them, or any other change with no behaviour to assert — make the change directly and move to the next step. Do **not** invoke `red`, `green` or `refactor`, and do not invent a test to justify the change: TDD does not apply here. Everything after this step is identical either way.
+   - **If it is testable code**, work through the TDD cycle by invoking the `Skill` tool once per phase, in this order — `skill: "red"`, then `skill: "green"`, then `skill: "refactor"` — passing the bd issue ID and the acceptance criterion being driven as `args`. Repeat the three-phase cycle until every acceptance criterion is satisfied.
+
+     **Each phase must be a real `Skill` tool call — not a description of one, and not your own recollection of what red/green/refactor mean.** Those skills carry project-specific rules that general TDD practice does not include, and they are re-read fresh each cycle so later cycles do not drift from earlier ones. Writing a test or an implementation without a preceding `Skill` call for that phase is a workflow violation.
    - **Finalize the reply body with the user — before committing.** Draft the reply text (everything except the commit link) — **do NOT include the AI attribution footer; `check-footer.py` appends it**. Write to `<reply_file>`, tell the user the absolute path (per [Conventions](#conventions)), and go through the approve/edit loop with the user until they approve. Do not proceed until the user explicitly confirms the text. Leave a clear `[COMMIT LINK]` placeholder where the link will go.
 
      Use AskUserQuestion with this wording (do NOT say "Post now" — the reply is queued for posting after the push, not posted immediately):
@@ -252,6 +255,8 @@ Summarise what was done:
 - Skip comments without asking
 - Leave uncommitted changes
 - Include the AI attribution footer in generated reply text — `check-footer.py` is solely responsible for it
+- Write tests or implementation from your own knowledge of TDD — when a change is testable code, `red`, `green` and `refactor` must each be invoked through the `Skill` tool
+- Run the TDD cycle on a change that has no behaviour to assert — docs, markdown, comments, config and unharnessed shell scripts are made directly
 
 ## Handling Common Scenarios
 
@@ -273,7 +278,7 @@ Discuss with user, then post a reply explaining the reasoning if they want to pu
 - [ ] If `--resume`: build inventory, classify reply drafts (placeholder vs finalized vs orphan), prompt user for resume strategy
 - [ ] Fetch and display comments
 - [ ] Phase 1: collect decisions for all comments (reply-only comments posted in Phase 1)
-- [ ] Phase 2: implement code changes, one commit per comment
+- [ ] Phase 2: invoke `create-issues` via the `Skill` tool for every queued item; add `red` → `green` → `refactor` only for items that are testable code; one commit per comment
 - [ ] Push all commits in a single push
 - [ ] Post code-change replies with commit links after push
 - [ ] Report what was done
diff --git a/.config/.copier-answers.yml b/.config/.copier-answers.yml
index eb99c82e..65e0be63 100644
--- a/.config/.copier-answers.yml
+++ b/.config/.copier-answers.yml
@@ -1,5 +1,5 @@
 # Changes here will be overwritten by Copier
-_commit: v0.0.156
+_commit: v0.1.6
 _src_path: gh:LabAutomationAndScreening/copier-base-template.git
 copier_answers_directory: .config
 description: Copier template for creating Python libraries and executables
diff --git a/.config/.copier-managed-files.json b/.config/.copier-managed-files.json
index fa5bf049..e308c913 100644
--- a/.config/.copier-managed-files.json
+++ b/.config/.copier-managed-files.json
@@ -36,8 +36,8 @@
         ".claude/settings/models.jsonc",
         ".claude/settings/permissions/additional-dirs.jsonc",
         ".claude/settings/permissions/bash.jsonc",
+        ".claude/settings/permissions/edit.jsonc",
         ".claude/settings/permissions/read.jsonc",
-        ".claude/settings/permissions/write.jsonc",
         ".claude/skills/address-pr-comments/SKILL.md",
         ".claude/skills/address-pr-comments/check-footer.py",
         ".claude/skills/address-pr-comments/commit-link.py",
@@ -55,6 +55,7 @@
         ".config/pyrefly.toml",
         ".config/ruff-non-src.toml",
         ".config/ruff.toml",
+        ".config/taskfiles/copier-template.yaml",
         ".devcontainer/Dockerfile",
         ".devcontainer/create-aws-profile.sh",
         ".devcontainer/devcontainer.json",
@@ -94,6 +95,7 @@
         "CHANGELOG.md",
         "LICENSE",
         "README.md",
+        "Taskfile.yaml",
         "biome.jsonc",
         "copier.yml",
         "copier_template_resources/openapi_schema_simplifier.py",
@@ -141,8 +143,8 @@
         "template/.claude/settings/models.jsonc",
         "template/.claude/settings/permissions/additional-dirs.jsonc",
         "template/.claude/settings/permissions/bash.jsonc",
+        "template/.claude/settings/permissions/edit.jsonc",
         "template/.claude/settings/permissions/read.jsonc",
-        "template/.claude/settings/permissions/write.jsonc",
         "template/.claude/skills/address-pr-comments/SKILL.md",
         "template/.claude/skills/address-pr-comments/check-footer.py",
         "template/.claude/skills/address-pr-comments/commit-link.py",
@@ -168,6 +170,7 @@
         "template/.config/pyrefly.toml",
         "template/.config/ruff-non-src.toml",
         "template/.config/ruff.toml",
+        "template/.config/taskfiles/copier-template.yaml",
         "template/.devcontainer/Dockerfile",
         "template/.devcontainer/envs.json",
         "template/.devcontainer/initialize-command.sh",
diff --git a/.config/ruff-non-src.toml b/.config/ruff-non-src.toml
index 9be02016..2a5344a8 100644
--- a/.config/ruff-non-src.toml
+++ b/.config/ruff-non-src.toml
@@ -20,6 +20,7 @@ ignore = [
     "S311", # pseudo-randomness is fine for test cases
     "TID252", # sometimes you can't use absolute imports in test cases for importing things within the tests, because they're not a true package or have conflicting namespaces
     "TRY003", # tests don't need to create custom exception classes, generally you want to throw an AssertionError with a message anyway
+    "TC001", "TC002", "TC003" # we don't need to worry about TYPE_CHECKING guards in tests---needless complication for marginal benefit
 ]
 
 unfixable = [
@@ -31,3 +32,7 @@ unfixable = [
 
 [lint.flake8-pytest-style]
 raises-require-match-for = ["*"] # ensures we always have a match for our raises statements so that we validate tests fail for the right reason
+
+[lint.flake8-tidy-imports.banned-api]
+"typing.TYPE_CHECKING".msg = "This is in non-source code. There is no reason to be doing TYPE_CHECKING blocks in tests or script. If you do have a need add `# noqa: TID251` with a clarifying comment"
+"__future__.annotations".msg = "__future__.annotations will be deprecated, once 3.13 is EOL. Also see https://peps.python.org/pep-0749/. If this is problematic, turn annotations into strings, or add `# noqa: TID251` with a clarifying comment but likely this import is not necessary at all."
diff --git a/.config/ruff.toml b/.config/ruff.toml
index 3f009c3d..159f682f 100644
--- a/.config/ruff.toml
+++ b/.config/ruff.toml
@@ -121,3 +121,6 @@ skip-magic-trailing-comma = false
 
 # Like Black, automatically detect the appropriate line ending.
 line-ending = "auto"
+
+[lint.flake8-tidy-imports.banned-api]
+"__future__.annotations".msg = "__future__.annotations will be deprecated, once 3.13 is EOL. Also see https://peps.python.org/pep-0749/. If this is problematic, turn annotations into strings, or add `# noqa: TID251` selectively but likely this import is not necessary at all."
diff --git a/.config/taskfiles/copier-template.yaml b/.config/taskfiles/copier-template.yaml
new file mode 100644
index 00000000..cba155e3
--- /dev/null
+++ b/.config/taskfiles/copier-template.yaml
@@ -0,0 +1,35 @@
+# ============== WARNING ==============================================================================
+# File is managed by copier template: gh:LabAutomationAndScreening/copier-base-template.git
+# See .config/.copier-managed-files.json for details.
+#
+# You are welcome to make changes to this file in your repo if they are custom to your project,
+# but if the change should be shared with other projects, please backport it to the template repo.
+# =====================================================================================================
+version: '3'
+
+tasks:
+  copier-update:
+    desc: Pull the latest updates from the upstream copier template into this repo
+    cmds:
+      - task: _copier-update
+        vars:
+          REF_FLAG: ''
+
+  copier-update-from-ref:
+    desc: Pull updates from a specific ref of the upstream copier template, e.g. `task copier-update-from-ref REF=some-branch`
+    requires:
+      vars: [REF]
+    cmds:
+      - task: _copier-update
+        vars:
+          REF_FLAG: --vcs-ref {{.REF | shellQuote}}
+
+  _copier-update:
+    internal: true
+    cmds:
+      - copier update --answers-file .config/.copier-answers.yml --trust --conflict rej --defaults {{.REF_FLAG}}
+
+  prune-copier-rejects:
+    desc: Delete .rej files whose target file is unchanged, failing if any real conflict is left to resolve
+    cmds:
+      - ./scripts/delete_false_positive_rej.py
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 47ded81d..980bb2b1 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -7,6 +7,12 @@
   "service": "devcontainer",
   "workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}",
   "features": {
+    "ghcr.io/devcontainers/features/git-lfs:1.2.5": {
+      // we are not using git-lfs right now, but its a transitive dep elsewhere. We want to configure auto pull to off since the feature will by default also try to install the git hook
+      // and it breaks creation of the devcontainer since pre-commit hooks are already in place. Probably a better way to fix this but until we use git-lfs we can leave it like this.
+      // https://github.com/devcontainers/features/blob/main/src/git-lfs/README.md
+      "autoPull": false
+    },
     // https://github.com/anthropics/devcontainer-features/blob/main/src/claude-code/devcontainer-feature.json
     "ghcr.io/anthropics/devcontainer-features/claude-code:1.0.5": {},
   },
@@ -16,15 +22,15 @@
       "extensions": [
         // basic tooling
         // "eamodio.gitlens@15.5.1",
-        "coderabbit.coderabbit-vscode@0.21.3",
+        "coderabbit.coderabbit-vscode@0.21.8",
         "ms-vscode.live-server@0.5.2025051301",
         "MS-vsliveshare.vsliveshare@1.0.5905",
-        "anthropic.claude-code@2.1.238",
+        "anthropic.claude-code@2.1.278",
 
         // Python
         "-ms-python.vscode-pylance", // pyrefly is the language server for this project; ms-python.python auto-installs Pylance via its extension pack, and Pylance then warns on every boot that it's disabled
         "ms-python.python@2026.5.2026052901",
-        "meta.pyrefly@1.2.9002",
+        "meta.pyrefly@1.3.1",
         "ms-vscode-remote.remote-containers@0.414.0",
         "charliermarsh.ruff@2026.68.0",
 
@@ -61,5 +67,5 @@
   "initializeCommand": "sh .devcontainer/initialize-command.sh",
   "onCreateCommand": "sh .devcontainer/on-create-command.sh",
   "postStartCommand": "sh .devcontainer/post-start-command.sh"
-  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 6a68e568 # spellchecker:disable-line
+  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 4d9b70d0 # spellchecker:disable-line
 }
diff --git a/.devcontainer/docker-compose.yml b/.devcontainer/docker-compose.yml
index 26778085..5b3d083a 100644
--- a/.devcontainer/docker-compose.yml
+++ b/.devcontainer/docker-compose.yml
@@ -26,20 +26,22 @@ services:
       - AWS_DEFAULT_REGION=us-east-1
       - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
       - BEADS_DIR=/workspaces/copier-python-package-template/.claude/.beads
+      - BEADS_DOLT_SERVER_MODE=1 # bd >=1.0 defaults to embedded dolt, and bd init hard-fails when the server host/port are set without this
       - BEADS_DOLT_SERVER_HOST=beads-dolt # this is on the docker compose network. We don't want to publish the server port because then the local machine would have a bunch of conflicts with multiple devcontainers running
       - BEADS_DOLT_SERVER_PORT=3306
       - BEADS_DOLT_SERVER_DATABASE=beads_work
-      - BEADS_DOLT_SERVER=beads-dolt # for some weird reason, unless we specify both of these envvars it doesn't seem to reliably work
-      - BEADS_DOLT_PORT=3306
+      - BEADS_DOLT_AUTO_START=0 # the beads-dolt service owns the server lifecycle, so bd must never spawn its own
+      - BD_DISABLE_METRICS=1 # bd >=1.0 sends anonymous usage metrics by default
 
 
   beads-dolt:
-    image: dolthub/dolt-sql-server:1.83.0 # no explicit reason for this version, just pinning for best practice
+    image: dolthub/dolt-sql-server:2.1.0 # kept in lockstep with beads_version; both are defined in extensions/context.py
     volumes:
       - beads_dolt_data:/var/lib/dolt
     environment:
       - DOLT_ROOT_HOST=%
       - DOLT_DATABASE=beads_work
+      - DOLT_DISABLE_EVENT_FLUSH=1 # dolt contacts doltremoteapi.dolthub.com with usage metrics by default, even with no remotes configured (see beads SECURITY.md)
 
 
 volumes:
diff --git a/.devcontainer/install-ci-tooling.py b/.devcontainer/install-ci-tooling.py
index e8a4ae6d..9e7c2502 100644
--- a/.devcontainer/install-ci-tooling.py
+++ b/.devcontainer/install-ci-tooling.py
@@ -8,19 +8,34 @@
 import argparse
 import os
 import platform
+import shlex
 import shutil
 import subprocess
 import sys
 import tempfile
 from pathlib import Path
 
-UV_VERSION = "0.12.5"
-PNPM_VERSION = "11.22.0"
-COPIER_VERSION = "==9.17.1"
+UV_VERSION = "0.12.15"
+PNPM_VERSION = "12.4.2"
+COPIER_VERSION = "==9.18.2"
 COPIER_TEMPLATE_EXTENSIONS_VERSION = "==0.3.3"
 PRE_COMMIT_VERSION = "4.6.2"
-GITHUB_WINDOWS_RUNNER_BIN_PATH = r"C:\Users\runneradmin\.local\bin"
+TASK_VERSION = "3.53.1"
+DOWNLOAD_TIMEOUT_SECONDS = 90
+# Where both uv's and Task's installers place binaries. Resolves from USERPROFILE on Windows, so it
+# matches the runner's home directory without assuming its user name. Already on PATH on POSIX, but
+# not on Windows, which is why uv is invoked through an absolute path there.
+LOCAL_BIN_DIR = Path.home() / ".local" / "bin"
 INSTALL_SSM_PLUGIN_BY_DEFAULT = False
+# A floor rather than an exact pin: GitHub's runner images ship their own build of the plugin and only
+# ever move it forward, so demanding an exact version means asking a Windows runner to downgrade, which
+# its installer refuses outright with MSI error 1638.
+SSM_PLUGIN_MINIMUM_VERSION = (1, 2, 835, 0)
+SSM_PLUGIN_DOWNLOAD_VERSION = ".".join(str(part) for part in SSM_PLUGIN_MINIMUM_VERSION)
+SSM_PLUGIN_EXECUTABLE = "session-manager-plugin"
+# Where the Windows installer places the executable. Needed because a fresh install does not reach the
+# PATH of the already-running process, so PATH alone cannot confirm the install landed.
+SSM_PLUGIN_WINDOWS_PATH = Path(r"C:\Program Files\Amazon\SessionManagerPlugin\bin\session-manager-plugin.exe")
 parser = argparse.ArgumentParser(description="Install CI tooling for the repo")
 _ = parser.add_argument(
     "--no-python",
@@ -45,30 +60,202 @@
 )
 
 
+def pwsh_cmd(cmd: str) -> list[str]:
+    pwsh = shutil.which("pwsh") or shutil.which("powershell")
+    if not pwsh:
+        raise FileNotFoundError("Neither 'pwsh' nor 'powershell' found on PATH")
+    return [pwsh, "-NoProfile", "-NonInteractive", "-Command", cmd]
+
+
+def install_task(*, is_windows: bool) -> None:
+    """Install the pinned Task release into `LOCAL_BIN_DIR`.
+
+    Deliberately not `npm install -g @go-task/cli`: that writes to the global prefix of whichever
+    node is on PATH, and in CI that is the pnpm-managed node installed by `pnpm/setup`, whose prefix
+    bin directory is not the one on PATH. The package installs successfully and the linked
+    executable is then unreachable, so `task` fails with exit status 127.
+
+    Verification goes through the absolute path because this process resolved PATH before the
+    install; `GITHUB_PATH` is appended so later steps in the same CI job can invoke `task` by name.
+    """
+    LOCAL_BIN_DIR.mkdir(parents=True, exist_ok=True)
+    if is_windows:
+        if platform.machine().lower() == "arm64":
+            windows_arch = "arm64"
+        else:
+            windows_arch = "amd64"
+        archive_url = (
+            f"https://github.com/go-task/task/releases/download/v{TASK_VERSION}/task_windows_{windows_arch}.zip"
+        )
+        # The bin directory is handed over as an environment variable rather than interpolated into the
+        # script text: PowerShell single quotes take no escapes, so an apostrophe in the home directory
+        # would terminate the string early. A variable reference is one argument whatever it contains.
+        task_env = dict(os.environ)
+        task_env.update({"TASK_BIN_DIR": str(LOCAL_BIN_DIR)})
+        powershell_statements = [
+            "$ErrorActionPreference = 'Stop'",
+            "$archive = Join-Path $env:TEMP 'task-release.zip'",
+            f"Invoke-WebRequest -UseBasicParsing -Uri '{archive_url}' -OutFile $archive",
+            "Expand-Archive -Path $archive -DestinationPath $env:TASK_BIN_DIR -Force",
+            "Remove-Item $archive",
+        ]
+        _ = subprocess.run(  # noqa: S603 # this is all our own input
+            pwsh_cmd("; ".join(powershell_statements)),
+            check=True,
+            env=task_env,
+            timeout=DOWNLOAD_TIMEOUT_SECONDS,
+        )
+        task_path = LOCAL_BIN_DIR / "task.exe"
+    else:
+        # The installer resolves the pinned tag against the published checksums, so the archive is verified.
+        # The bin directory is shell-quoted because a space or apostrophe in the home directory would
+        # otherwise split it into multiple arguments, or unbalance the quoting outright.
+        _ = subprocess.run(  # noqa: S602 # we need to set shell to true to use the pipe operator, and this is all our own input
+            f"curl -fsSL --connect-timeout 20 --max-time 40 --retry 3 --retry-delay 5 --retry-connrefused --proto '=https' https://taskfile.dev/install.sh | sh -s -- -b {shlex.quote(str(LOCAL_BIN_DIR))} v{TASK_VERSION}",
+            check=True,
+            shell=True,
+            timeout=DOWNLOAD_TIMEOUT_SECONDS,
+        )
+        task_path = LOCAL_BIN_DIR / "task"
+    _ = subprocess.run([str(task_path), "--version"], check=True)  # noqa: S603 # this is all our own input
+    if "GITHUB_PATH" in os.environ:
+        with Path(os.environ["GITHUB_PATH"]).open("a", encoding="utf-8") as github_path_file:
+            _ = github_path_file.write(f"{LOCAL_BIN_DIR}\n")
+
+
+def run_node_cmds(cmds: list[str], *, is_windows: bool) -> None:
+    for cmd in cmds:
+        if is_windows:
+            run_cmd = pwsh_cmd(cmd)
+        else:
+            run_cmd = [cmd]
+        _ = subprocess.run(run_cmd, shell=True, check=True, timeout=DOWNLOAD_TIMEOUT_SECONDS)  # noqa: S602 # we need shell=True for npm commands, and this is all our own input
+
+
+def parse_version(raw: str) -> tuple[int, ...] | None:
+    stripped = raw.strip()
+    if not stripped:
+        return None
+    parts: list[int] = []
+    for segment in stripped.split("."):
+        if not segment.isdigit():
+            return None
+        parts.append(int(segment))
+    return tuple(parts)
+
+
+def resolve_ssm_plugin() -> str | None:
+    on_path = shutil.which(SSM_PLUGIN_EXECUTABLE)
+    if on_path is not None:
+        return on_path
+    if SSM_PLUGIN_WINDOWS_PATH.exists():
+        return str(SSM_PLUGIN_WINDOWS_PATH)
+    return None
+
+
+def installed_ssm_plugin_version() -> tuple[int, ...] | None:
+    executable = resolve_ssm_plugin()
+    if executable is None:
+        return None
+    try:
+        result = subprocess.run(  # noqa: S603 # this is all our own input
+            [executable, "--version"],
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+    except subprocess.CalledProcessError:
+        return None
+    return parse_version(result.stdout)
+
+
+def install_ssm_plugin(*, is_windows: bool) -> None:
+    with tempfile.TemporaryDirectory() as tmp_dir:
+        if is_windows:
+            local_package_path = Path(tmp_dir) / "SessionManagerPluginSetup.exe"
+            # Based on https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-windows.html
+            _ = subprocess.run(  # noqa: S603 # this is all our own input
+                [  # noqa: S607 # curl should always be on PATH
+                    "curl",
+                    f"https://s3.amazonaws.com/session-manager-downloads/plugin/{SSM_PLUGIN_DOWNLOAD_VERSION}/windows/SessionManagerPluginSetup.exe",
+                    "-o",
+                    f"{local_package_path}",
+                ],
+                check=True,
+                timeout=DOWNLOAD_TIMEOUT_SECONDS,
+            )
+            _ = subprocess.run(  # noqa: S603 # this is all our own input
+                [str(local_package_path), "/quiet"],
+                check=True,
+            )
+        else:
+            local_package_path = Path(tmp_dir) / "session-manager-plugin.deb"
+            # Based on https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-debian-and-ubuntu.html
+            _ = subprocess.run(  # noqa: S603 # this is all our own input
+                [  # noqa: S607 # curl should always be on PATH
+                    "curl",
+                    f"https://s3.amazonaws.com/session-manager-downloads/plugin/{SSM_PLUGIN_DOWNLOAD_VERSION}/ubuntu_64bit/session-manager-plugin.deb",
+                    "-o",
+                    f"{local_package_path}",
+                ],
+                check=True,
+                timeout=DOWNLOAD_TIMEOUT_SECONDS,
+            )
+            _ = subprocess.run(  # noqa: S603 # this is all our own input
+                [  # noqa: S607 # sudo should always be on PATH
+                    "sudo",
+                    "dpkg",
+                    "-i",
+                    str(local_package_path),
+                ],
+                check=True,
+            )
+
+
+def ensure_ssm_plugin(*, is_windows: bool) -> None:
+    installed = installed_ssm_plugin_version()
+    if installed is None:
+        print("SSM plugin not found, installing it")  # noqa: T201 # we want the script to print to console for easy viewing
+    elif installed < SSM_PLUGIN_MINIMUM_VERSION:
+        print(  # noqa: T201 # we want the script to print to console for easy viewing
+            f"SSM plugin {'.'.join(str(part) for part in installed)} is older than the required "
+            f"{SSM_PLUGIN_DOWNLOAD_VERSION}, upgrading it"
+        )
+    else:
+        print(  # noqa: T201 # we want the script to print to console for easy viewing
+            f"SSM Plugin Manager Version: {'.'.join(str(part) for part in installed)} "
+            f"(already at least {SSM_PLUGIN_DOWNLOAD_VERSION}, leaving it alone)"
+        )
+        return
+    install_ssm_plugin(is_windows=is_windows)
+    # The installer exits zero without installing anything when the requested version is already
+    # present, so the version has to be read back rather than inferred from the exit code.
+    final = installed_ssm_plugin_version()
+    if final is None or final < SSM_PLUGIN_MINIMUM_VERSION:
+        raise RuntimeError(
+            f"The SSM plugin installer did not produce {SSM_PLUGIN_EXECUTABLE} "
+            f"version {SSM_PLUGIN_DOWNLOAD_VERSION} or newer, it left {final}"
+        )
+    print(f"SSM Plugin Manager Version: {'.'.join(str(part) for part in final)}")  # noqa: T201 # we want the script to print to console for easy viewing
+
+
 def main():
     args = parser.parse_args(sys.argv[1:])
     is_windows = platform.system() == "Windows"
     uv_env = dict(os.environ)
     uv_env.update({"UV_PYTHON": args.python_version, "UV_PYTHON_PREFERENCE": "only-system"})
-    uv_path = ((GITHUB_WINDOWS_RUNNER_BIN_PATH + "\\") if is_windows else "") + "uv"
     if is_windows:
-        pwsh = shutil.which("pwsh") or shutil.which("powershell")
-        if not pwsh:
-            raise FileNotFoundError("Neither 'pwsh' nor 'powershell' found on PATH")
+        uv_path = str(LOCAL_BIN_DIR / "uv")
+    else:
+        uv_path = "uv"
     if not args.no_python:
         if is_windows:
-            uv_env.update({"PATH": rf"{GITHUB_WINDOWS_RUNNER_BIN_PATH};{uv_env['PATH']}"})
-            # invoke installer in a pwsh process
+            uv_env.update({"PATH": rf"{LOCAL_BIN_DIR};{uv_env['PATH']}"})
             _ = subprocess.run(  # noqa: S603 # this is all our own input
-                [
-                    pwsh,
-                    "-NoProfile",
-                    "-NonInteractive",
-                    "-Command",
-                    f"irm https://astral.sh/uv/{UV_VERSION}/install.ps1 | iex",
-                ],
+                pwsh_cmd(f"irm https://astral.sh/uv/{UV_VERSION}/install.ps1 | iex"),
                 check=True,
                 env=uv_env,
+                timeout=DOWNLOAD_TIMEOUT_SECONDS,
             )
         else:
             _ = subprocess.run(  # noqa: S602 # we need to set shell to true to use the pipe operator, and this is all our own input
@@ -76,6 +263,7 @@ def main():
                 check=True,
                 shell=True,
                 env=uv_env,
+                timeout=DOWNLOAD_TIMEOUT_SECONDS,
             )
             # TODO: add uv autocompletion to the shell https://docs.astral.sh/uv/getting-started/installation/#shell-autocompletion
         _ = subprocess.run(  # noqa: S603 # this is all our own input
@@ -89,6 +277,7 @@ def main():
             ],
             check=True,
             env=uv_env,
+            timeout=DOWNLOAD_TIMEOUT_SECONDS,
         )
         _ = subprocess.run(  # noqa: S603 # this is all our own input
             [
@@ -99,6 +288,7 @@ def main():
             ],
             check=True,
             env=uv_env,
+            timeout=DOWNLOAD_TIMEOUT_SECONDS,
         )
         _ = subprocess.run(  # noqa: S603 # this is all our own input
             [
@@ -110,69 +300,11 @@ def main():
             env=uv_env,
         )
     if not args.no_node:
-        pnpm_install_sequence = ["npm -v", f"npm install -g pnpm@{PNPM_VERSION}", "pnpm -v"]
-        for cmd in pnpm_install_sequence:
-            run_cmd = (
-                [
-                    pwsh,  # type: ignore[reportPossiblyUnboundVariable] # this matches the conditional above that defines pwsh
-                    "-NoProfile",
-                    "-NonInteractive",
-                    "-Command",
-                    cmd,
-                ]
-                if is_windows
-                else [cmd]
-            )
-            _ = subprocess.run(run_cmd, shell=True, check=True)  # noqa: S602 # we need shell=True for npm commands, and this is all our own input
+        run_node_cmds(["npm -v", f"npm install -g pnpm@{PNPM_VERSION}", "pnpm -v"], is_windows=is_windows)
+    # Task is installed outside the --no-node branch because CI always passes --no-node (pnpm/setup handles pnpm there), and every job still needs the task runner
+    install_task(is_windows=is_windows)
     if INSTALL_SSM_PLUGIN_BY_DEFAULT and not args.skip_installing_ssm_plugin:
-        with tempfile.TemporaryDirectory() as tmp_dir:
-            if is_windows:
-                local_package_path = Path(tmp_dir) / "SessionManagerPluginSetup.exe"
-                # Based on https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-windows.html
-                # no specific reason for that version, just pinning it for best practice
-                _ = subprocess.run(  # noqa: S603 # this is all our own input
-                    [  # noqa: S607 # curl should always be on PATH
-                        "curl",
-                        "https://s3.amazonaws.com/session-manager-downloads/plugin/1.2.707.0/windows/SessionManagerPluginSetup.exe",
-                        "-o",
-                        f"{local_package_path}",
-                    ],
-                    check=True,
-                )
-                _ = subprocess.run(  # noqa: S603 # this is all our own input
-                    [str(local_package_path), "/quiet"],
-                    check=True,
-                )
-            else:
-                local_package_path = Path(tmp_dir) / "session-manager-plugin.deb"
-                # Based on https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-debian-and-ubuntu.html
-                # no specific reason for that version, just pinning it for best practice
-                _ = subprocess.run(  # noqa: S603 # this is all our own input
-                    [  # noqa: S607 # curl should always be on PATH
-                        "curl",
-                        "https://s3.amazonaws.com/session-manager-downloads/plugin/1.2.707.0/ubuntu_64bit/session-manager-plugin.deb",
-                        "-o",
-                        f"{local_package_path}",
-                    ],
-                    check=True,
-                )
-                _ = subprocess.run(  # noqa: S603 # this is all our own input
-                    [  # noqa: S607 # sudo should always be on PATH
-                        "sudo",
-                        "dpkg",
-                        "-i",
-                        str(local_package_path),
-                    ],
-                    check=True,
-                )
-            print("SSM Plugin Manager Version: ")  # noqa: T201 # we want the script to print to console for easy viewing
-            _ = subprocess.run(
-                [  # noqa: S607 # session-manager-plugin should be on PATH because we just installed it
-                    "session-manager-plugin",
-                    "--version",
-                ],
-                check=True,
-            )
+        ensure_ssm_plugin(is_windows=is_windows)
 
 
 if __name__ == "__main__":
diff --git a/.devcontainer/on-create-command.sh b/.devcontainer/on-create-command.sh
index 921e1741..16f4bc65 100644
--- a/.devcontainer/on-create-command.sh
+++ b/.devcontainer/on-create-command.sh
@@ -15,7 +15,7 @@ chgrp -R 0 "$repo_root/.claude" || true
 npm --prefix "$repo_root/.claude" ci
 
 # Install beads for use in Claude planning
-npm install -g @beads/bd@0.57.0 # no specific reason for this version, just pinning for best practice
+npm install -g @beads/bd@1.2.2 # kept in lockstep with dolt_image_version; both are defined in extensions/context.py
 
 pre-commit install --install-hooks
 
diff --git a/.devcontainer/post-start-command.sh b/.devcontainer/post-start-command.sh
index 652759af..c61145ee 100644
--- a/.devcontainer/post-start-command.sh
+++ b/.devcontainer/post-start-command.sh
@@ -6,13 +6,21 @@ set -ex
 script_dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 repo_root="$(CDPATH='' cd -- "$script_dir/.." && pwd)"
 git config --global --add safe.directory "$repo_root"
+# bd >=1.0 warns on every command unless .beads is owner-only, and on-create's group-writable chmod over .claude
+# undoes what bd init sets. Runs before the bd calls below so their output is clean too.
+if [ -d "$repo_root/.claude/.beads" ]; then
+    chmod 700 "$repo_root/.claude/.beads"
+fi
 pre-commit run merge-claude-settings -a
 if ! bd ready; then
 	echo "It's likely the Dolt server has not yet been initialized to support beads, running that now" # TODO: figure out a better way to match this specific scenario than just a non-zero exit code...but beads still seems like in high flux right now so not sure what to tie it to
     # the 'stealth' flag is just the only way I could figure out how to stop it from modifying AGENTS.md...if there's another way to avoid that, then fine.  Even without the stealth flag though, files inside the .claude/beads directory get modified, so restoring them at the end to what was set in git...these shouldn't really need to change regularly
     # trying to set 'prefix' to nothing doesn't seem to work (it just acts like the prefix flag wasn't there), so just setting to 'work' as an arbitrary name
-    # for some reason, the envvar for the server host isn't being picked up normally, so just passing it explicitly here
-    rm -rf .claude/.beads && bd init --server-host="$BEADS_DOLT_SERVER_HOST" --database="$BEADS_DOLT_SERVER_DATABASE" --skip-hooks --stealth --prefix=work </dev/null && git -c core.hooksPath=/dev/null restore --source=HEAD --staged --worktree .claude/.beads
+    # --server is required as of bd 1.0: without it, init resolves to embedded dolt and hard-fails because the BEADS_DOLT_SERVER_* envvars are set
+    rm -rf .claude/.beads && bd init --server --server-host="$BEADS_DOLT_SERVER_HOST" --database="$BEADS_DOLT_SERVER_DATABASE" --skip-hooks --stealth --prefix=work </dev/null
+    # Best effort: a freshly generated repo has nothing tracked under .claude/.beads, and the failed pathspec would
+    # otherwise trip 'set -e' and abandon the rest of this script
+    git -c core.hooksPath=/dev/null restore --source=HEAD --staged --worktree .claude/.beads || true
 fi
 
 # ============== WARNING ==============================================================================
diff --git a/.github/actions/install_deps/action.yml b/.github/actions/install_deps/action.yml
index b91d8b33..a995b8fa 100644
--- a/.github/actions/install_deps/action.yml
+++ b/.github/actions/install_deps/action.yml
@@ -16,8 +16,8 @@ inputs:
     description: Node version to install
     required: false # if this is set, then assume you want node dependencies installed
     default: 'notUsing'
-  package-json-file:
-    description: Relative path to a package.json to read the pnpm version from (its `packageManager` or `devEngines.packageManager` field). When unset, the pnpm version pinned by the template is used instead.
+  working-directory:
+    description: Relative path to the directory holding the package.json to read the pnpm version from (its `packageManager` or `devEngines.packageManager` field). When unset, the pnpm version pinned by the template is used instead.
     required: false
     default: 'notUsing'
   install-deps:
@@ -68,43 +68,52 @@ runs:
       with:
         python-version: ${{ env.PYTHON_VERSION }}
 
-    - name: Check for a pnpm lock file # pnpm/setup can only cache the store when there's a lock file at the repo root to key the cache off of
-      id: pnpm-lock-probe
+    - name: Locate the pnpm project # pnpm/setup keys the store cache off a lock file, so it can only cache when one exists in the directory the project lives in
+      id: pnpm-project
       if: ${{ inputs.node-version != 'notUsing' }}
+      env:
+        WORKING_DIRECTORY: ${{ inputs.working-directory }}
       run: |
-        if [ -f pnpm-lock.yaml ]; then
-          echo "exists=true" >> "$GITHUB_OUTPUT"
+        if [ "$WORKING_DIRECTORY" = "notUsing" ]; then
+          project_dir="."
         else
-          echo "exists=false" >> "$GITHUB_OUTPUT"
+          project_dir="$WORKING_DIRECTORY"
+        fi
+        echo "dir=$project_dir" >> "$GITHUB_OUTPUT"
+        if [ -f "$project_dir/pnpm-lock.yaml" ]; then
+          echo "lock_exists=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "lock_exists=false" >> "$GITHUB_OUTPUT"
         fi
       shell: bash
 
     - name: Setup pnpm and node # this action installs both pnpm and the node runtime, so actions/setup-node is not needed
       if: ${{ inputs.node-version != 'notUsing' }}
-      uses: pnpm/setup@v2.0.2
+      uses: pnpm/setup@v2.1.0
       with:
-        # an empty version makes pnpm/setup read it from package-json-file instead. Passing both a version and a package.json with a conflicting `packageManager` field is a hard error in pnpm/setup.
-        version: ${{ inputs.package-json-file == 'notUsing' && '11.22.0' || '' }}
-        package-json-file: ${{ inputs.package-json-file == 'notUsing' && 'package.json' || inputs.package-json-file }}
+        # an empty version makes pnpm/setup read it from the manifest in working-directory instead. Passing both a version and a package.json with a conflicting `packageManager` field is a hard error in pnpm/setup.
+        version: ${{ inputs.working-directory == 'notUsing' && '12.4.2' || '' }}
+        working-directory: ${{ steps.pnpm-project.outputs.dir }}
+        # cache-dependency-path is left at its default, which is the lock file inside working-directory -- the same one the probe above checks
         runtime: node@${{ inputs.node-version }}
-        cache: ${{ steps.pnpm-lock-probe.outputs.exists }}
+        cache: ${{ steps.pnpm-project.outputs.lock_exists }}
         install: false # dependency installation is handled by manual-setup-deps.py, which knows about every environment in the repo
 
     - name: Install tooling
       # the funky syntax is github action ternary
       # --no-node is always passed because the only node tooling this script installs is pnpm, which pnpm/setup above already installed
-      run: python .devcontainer/install-ci-tooling.py ${{ inputs.python-version == 'notUsing' && '--no-python' || '' }} --no-node ${{ inputs.skip-installing-ssm-plugin-manager && '--skip-installing-ssm-plugin' || '' }}
+      run: python .devcontainer/install-ci-tooling.py ${{ inputs.python-version == 'notUsing' && '--no-python' || '' }} --no-node ${{ inputs.skip-installing-ssm-plugin-manager == 'true' && '--skip-installing-ssm-plugin' || '' }}
       shell: pwsh
 
     - name: OIDC Auth for CodeArtifact
       if: ${{ inputs.code-artifact-auth-role-name != 'no-code-artifact' }}
-      uses: aws-actions/configure-aws-credentials@v6.2.3
+      uses: aws-actions/configure-aws-credentials@v6.3.0
       with:
         role-to-assume: arn:aws:iam::${{ inputs.code-artifact-auth-role-account-id }}:role/${{ inputs.code-artifact-auth-role-name }}
         aws-region: ${{ inputs.code-artifact-auth-region }}
 
     - name: Install dependencies
       # the funky syntax is github action ternary
-      if: ${{ inputs.install-deps }}
-      run: python .devcontainer/manual-setup-deps.py ${{ inputs.python-version == 'notUsing' && '--no-python' || '' }} ${{ inputs.node-version == 'notUsing' && '--no-node' || '' }} ${{ inputs.skip-updating-devcontainer-hash && '--skip-updating-devcontainer-hash' || '' }} ${{ inputs.skip-installing-pulumi-cli && '--skip-installing-pulumi-cli' || '' }}
+      if: ${{ inputs.install-deps == 'true' }}
+      run: python .devcontainer/manual-setup-deps.py ${{ inputs.python-version == 'notUsing' && '--no-python' || '' }} ${{ inputs.node-version == 'notUsing' && '--no-node' || '' }} ${{ inputs.skip-updating-devcontainer-hash == 'true' && '--skip-updating-devcontainer-hash' || '' }} ${{ inputs.skip-installing-pulumi-cli == 'true' && '--skip-installing-pulumi-cli' || '' }}
       shell: pwsh
diff --git a/.github/reusable_workflows/build-docker-image.yaml b/.github/reusable_workflows/build-docker-image.yaml
index 19d1738c..8fcb6517 100644
--- a/.github/reusable_workflows/build-docker-image.yaml
+++ b/.github/reusable_workflows/build-docker-image.yaml
@@ -179,13 +179,13 @@ jobs:
 
       - name: Set up Docker Buildx
         if: ${{ (inputs.save-as-artifact && inputs.push-role-name == 'no-push') || steps.image-status.outputs.status == 'notfound' }}
-        uses: docker/setup-buildx-action@v4.0.0
+        uses: docker/setup-buildx-action@v4.4.1
         with:
-          version: v0.33.0
+          version: v0.37.1
 
       - name: Build Docker Image
         if: ${{ (inputs.save-as-artifact && inputs.push-role-name == 'no-push') || steps.image-status.outputs.status == 'notfound' }}
-        uses: docker/build-push-action@v7.1.0
+        uses: docker/build-push-action@v7.4.0
         with:
           context: ${{ inputs.context }}
           build-contexts: ${{ inputs.build-contexts }}
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 89810dcb..de8f2b47 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -257,16 +257,16 @@ jobs:
     if: always()
     steps:
       - name: fail if prior job failure
+        # Iterating the needs context keeps this gate from drifting out of sync with the job list above
+        env:
+          NEEDS: ${{ toJSON(needs) }}
         run: |
-          success_pattern="^(skipped|success)$" # these are the possibilities: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#needs-context
-
-          if [[ ! "${{ needs.get-values.result }}" =~ $success_pattern ]] ||
-            [[ ! "${{ needs.confirm-on-tagged-copier-template.result }}" =~ $success_pattern ]] ||
-            [[ ! "${{ needs.check-skip-duplicate.result }}" =~ $success_pattern ]] ||
-            [[ ! "${{ needs.pre-commit.result }}" =~ $success_pattern ]] ||
-            [[ ! "${{ needs.unit-test.result }}" =~ $success_pattern ]] ||
-            [[ ! "${{ needs.lint-matrix.result }}" =~ $success_pattern ]]; then
-            echo "❌ One or more jobs did not finish with skipped or success"
+          # these are the possibilities: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#needs-context
+          not_ok=$(jq -r 'to_entries[] | select(.value.result | test("^(skipped|success)$") | not) | .key' <<<"$NEEDS")
+
+          if [[ -n "$not_ok" ]]; then
+            echo "❌ One or more jobs did not finish with skipped or success:"
+            echo "$not_ok"
             exit 1
           fi
           echo "✅ All jobs finished with skipped or success"
diff --git a/.gitignore b/.gitignore
index cc7c8b5b..4916f46e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -123,4 +123,8 @@ dist
 # macOS dev cleanliness
 **/.DS_Store
 
+# Devcontainer
+# The devcontainer CLI writes this lock file to pin feature digests, but we are not using it yet
+.devcontainer/devcontainer-lock.json
+
 # Ignores specific to this repository
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 7e6b8b5c..30a885ad 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -156,6 +156,8 @@ repos:
               .*tsconfig.json|
           )$
       - id: check-yaml
+        # some tools (e.g. pnpm) create multiple-document YAML streams
+        args: [--allow-multiple-documents]
         # .copier-answers.yml is an autogenerated YAML file by Copier that throws 'found unhashable key' errors
         # Helm charts contain other non-YAML markers that cause errors here. they should be checked with helm-lint instead
         # VCRpy cassettes sometimes contain non-YAML markers that cause errors---but they're autogenerated anyway
@@ -173,6 +175,11 @@ repos:
     rev: c4654a7e007c9619a5eb63c39a456572a0fa1851  # frozen: 0.38.0
     hooks:
       - id: check-github-workflows
+      - id: check-jsonschema
+        name: check taskfiles
+        # Task itself silently ignores unknown keys, so a typo'd key is only caught by the schema.
+        args: [--schemafile, 'https://taskfile.dev/schema.json']
+        files: ^(Taskfile\.yaml|(template/)?\.config/taskfiles/[^/{]+\.yaml)$
 
   - repo: https://github.com/maresb/check-json5
     rev: bd4737432a2175617a9eeaa510ab369cbc1cbd3d  # frozen: v1.0.1
@@ -306,6 +313,15 @@ repos:
         pass_filenames: false
         language: system
 
+      - id: task-list
+        # Schema validation cannot see across files: only Task itself resolves the include paths in the root shim and
+        # rejects a task name defined by two flattened includes. Listing is enough to trigger both errors.
+        name: validate taskfile includes and task names
+        entry: bash -c "task --list-all > /dev/null"
+        files: ^(Taskfile\.yaml|\.config/taskfiles/.*)$
+        pass_filenames: false
+        language: system
+
       - id: compute-devcontainer-context-hash
         # Devcontainer context --- this makes Github's "prebuild codespaces" feature work more intelligently for the "Configuration Change" trigger
         name: compute devcontainer context hash
diff --git a/AGENTS.md b/AGENTS.md
index 3b93ea8a..7feb1443 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -78,6 +78,9 @@ This project is a Copier template used to generate other copier templates. It is
 ## Tooling
 
 - ❌ Never chain commands (`&&`, `||`, `;`, `&`) — breaks permission allow-list matcher. ✅ One command per tool call. `cd` as separate prior call. Pipes (`|`) OK.
+- Before hand-assembling a multi-step workflow, run `task --list` — it is probably already a task. Definitions live in `.config/taskfiles/`; the root `Taskfile.yaml` only includes them.
+- The bans on `pnpm --prefix`, `uv --directory` and direct tool invocation apply to commands you type, not to task definitions: a task's commands run with the repo root as their working directory by default. Prefer adding or extending a task over typing the long form.
+- Linting and type-checking stay with `pre-commit run <hook-id>` rather than a task, so that what you run is exactly what CI runs.
 - `cd` into a subdirectory is auto-approved; navigating up (`cd ..`) or to an absolute path (`cd /some/path`) requires a user permission prompt. Minimize such navigation: run `pre-commit` from whichever subdirectory you're already in (it walks up to find `.pre-commit-config.yaml`).
 - ❌ Never use `python3` or `python` directly. ✅ Always use `uv run python` for Python commands.
 - ❌ Never use `python3`/`python` for one-off data tasks. ✅ Use `jq` for JSON parsing, standard shell builtins for string manipulation. Only reach for `uv run python` when no dedicated tool covers the need.
@@ -90,18 +93,20 @@ This project is a Copier template used to generate other copier templates. It is
 - Never use backslash line continuations in shell commands — always write the full command on a single line. Backslashes break the permission allow-list matcher.
 - **Never manually edit files in any `generated/` folder.** These files are produced by codegen tooling (typically Kiota) and any manual changes will be overwritten. If a generated file needs to change, update the source (e.g. the OpenAPI schema) and re-run the generator.
 - Leave `import` statement ordering and unused-import removal to pre-commit — don't edit them yourself.
+- In GitHub Codespaces, the injected `GITHUB_TOKEN` is a repo-scoped app token, so `gh`/`git` cannot reach other repos in the org. It lives in the container process environment (not any dotfile), so `unset` inside a Bash tool call does not persist. To grant broader access, ask the user to run `env -u GITHUB_TOKEN -u GH_TOKEN gh auth login --hostname github.com --git-protocol https --web` in their shell (the `--web` flags are required — `gh auth login` alone needs a TTY that the Bash tool does not provide, and it refuses to store credentials while `GITHUB_TOKEN` is set). Afterwards, prefix your own `gh`/`git` calls with `env -u GITHUB_TOKEN -u GH_TOKEN` so they use the stored GitHub CLI credentials instead of the app token — `GH_TOKEN` also has to be cleared because `gh` gives it precedence over both `GITHUB_TOKEN` and stored credentials. Where those credentials live depends on the environment (`gh` prefers the OS credential store and the config dir follows `GH_CONFIG_DIR`), but in these devcontainers they usually land in plain text at `~/.config/gh/hosts.yml`; `gh auth status` reports the active source.
 
 <!-- BEGIN BEADS INTEGRATION -->
-## Issue Tracking with bd (beads)
+## Work Tracking with bd (beads)
 
-**IMPORTANT**: This project uses **bd (beads)** for ALL issue tracking. Do NOT use markdown TODOs, task lists, or other tracking methods.
+**IMPORTANT**: Use **bd (beads)** to break down and track your own work while implementing a ticket. Within a working session it is the only place to track that breakdown — do NOT use markdown TODOs, task lists, or other scratch tracking methods.
+
+bd is not the team's ticket tracker. It is a local tool for a developer and an AI agent working together: `bd init --stealth` adds `.beads/` to `.git/info/exclude`, so neither the database nor its JSONL export is committed, and nothing recorded in bd is visible to reviewers, teammates, or CI. The ticket a session is implementing lives in whatever system the team owning the repository uses — GitHub Issues, Jira, Linear, or something else.
 
 ### Why bd?
 
-- Dependency-aware: Track blockers and relationships between issues
-- Git-friendly: Auto-syncs to JSONL for version control
+- Dependency-aware: Track blockers and relationships between the pieces of work in a session
 - Agent-optimized: JSON output, ready work detection, discovered-from links
-- Prevents duplicate tracking systems and confusion
+- Keeps session breakdown out of the team's ticket tracker, and out of the codebase
 
 ### Quick Start
 
@@ -115,20 +120,20 @@ bd ready --json
 
 ```bash
 bd create "Issue title" --description="Detailed context" -t bug|feature|task -p 0-4 --json
-bd create "Issue title" --description="What this issue is about" -p 1 --deps discovered-from:bd-123 --json
+bd create "Issue title" --description="What this issue is about" -p 1 --deps discovered-from:<parent-id> --json
 ```
 
 **Claim and update:**
 
 ```bash
-bd update bd-42 --status in_progress --json
-bd update bd-42 --priority 1 --json
+bd update <id> --status in_progress --json
+bd update <id> --priority 1 --json
 ```
 
 **Complete work:**
 
 ```bash
-bd close bd-42 --reason "Completed" --json
+bd close <id> --reason "Completed" --json
 ```
 
 **Creating human readable file:**
@@ -145,6 +150,7 @@ bd export -o [relative path to repository root]/.claude/.beads/issues-dump.jsonl
 - `task` - Work item (tests, docs, refactoring)
 - `epic` - Large feature with subtasks
 - `chore` - Maintenance (dependencies, tooling)
+- `decision` - An architectural decision (aliases: `dec`, `adr`)
 
 ### Priorities
 
@@ -166,15 +172,15 @@ bd export -o [relative path to repository root]/.claude/.beads/issues-dump.jsonl
 
 ### Important Rules
 
-- ✅ Use bd for ALL task tracking
+- ✅ Use bd for ALL tracking of your own work within a session
 - ✅ Always use `--json` flag for programmatic use
 - ✅ Link discovered work with `discovered-from` dependencies
 - ✅ Check `bd ready` before asking "what should I work on?"
-- ❌ Do NOT create markdown TODO lists
-- ❌ Do NOT use external issue trackers
-- ❌ Do NOT duplicate tracking systems
+- ❌ Do NOT create markdown TODO lists to track session work
+- ❌ Do NOT stand up a second scratch tracking system alongside bd
+- ❌ Do NOT propose bd for work that needs tracking beyond the session — a bd issue is invisible to everyone else. Suggest a code comment, or a ticket in the team's own tracker, and do not assume which tracker that is
 
-For more details, see README.md and docs/QUICKSTART.md.
+For more details, run `bd quickstart` or see <https://github.com/gastownhall/beads>.
 
 # Copier-Managed Files
 
diff --git a/README.md b/README.md
index afc47eba..2b408e3e 100644
--- a/README.md
+++ b/README.md
@@ -20,10 +20,11 @@ To create a new repository using this template:
 
 # Development
 
+Multi-step workflows are defined as [Task](https://taskfile.dev) tasks. Run `task --list` to see them; the definitions live in `.config/taskfiles/`, and `Taskfile.yaml` in the repo root is only a shim that includes them.
+
 
 ## Updating from the template
-This repository uses a copier template. To pull in the latest updates from the template, use the command:
-`copier update --answers-file .config/.copier-answers.yml --trust --conflict rej --defaults`
+This repository uses a copier template. To pull in the latest updates from the template, run `task copier-update`
 
 <!--
 ============== WARNING ==============================================================================
diff --git a/Taskfile.yaml b/Taskfile.yaml
new file mode 100644
index 00000000..f1139d2a
--- /dev/null
+++ b/Taskfile.yaml
@@ -0,0 +1,16 @@
+# ============== WARNING ==============================================================================
+# File is managed by copier template: gh:LabAutomationAndScreening/copier-base-template.git
+# See .config/.copier-managed-files.json for details.
+#
+# You are welcome to make changes to this file in your repo if they are custom to your project,
+# but if the change should be shared with other projects, please backport it to the template repo.
+# =====================================================================================================
+# Task definitions live in .config/taskfiles/ next to the other tool configs so the repo root stays uncluttered.
+# This shim exists because Task cannot be pointed at a config directory: auto-discovery covers only Taskfile.yml, taskfile.yml, Taskfile.yaml, taskfile.yaml and their .dist variants in the current directory walking up through parents, no environment variable sets the Taskfile path (https://github.com/go-task/task/issues/1721 requested one and was closed as a duplicate on 2025-12-10 with no linked replacement and no implementation), and requiring -t/--taskfile on every call would break both the ergonomics and the Claude Code bash permission matcher.
+# Every include is flattened so that no task name contains a colon: Task's ':' namespace separator is not configurable and Claude Code cannot match a ':*' permission pattern (see .claude/settings/permissions/bash.jsonc). Flattened names share one global namespace, so a collision between two included files is a hard error rather than a silent shadow, and names are prefixed by hand (build-frontend) instead of namespaced (frontend:build).
+version: '3'
+
+includes:
+  copier:
+    taskfile: ./.config/taskfiles/copier-template.yaml
+    flatten: true
diff --git a/extensions/context.py b/extensions/context.py
index 58369346..d69c4815 100644
--- a/extensions/context.py
+++ b/extensions/context.py
@@ -19,51 +19,52 @@ class ContextUpdater(ContextHook):
     def hook(  # noqa: PLR0915 # yes, this is a lot of statements, but it's all just creating the dict
         self, context: dict[Any, Any]
     ) -> dict[Any, Any]:
-        context["uv_version"] = "0.12.5"
-        context["pnpm_version"] = "11.22.0"
+        context["uv_version"] = "0.12.15"
+        context["pnpm_version"] = "12.4.2"
         context["npm_version"] = "11.13.0"
         context["nvm_version"] = "0.40.5"
         context["pre_commit_version"] = "4.6.2"
+        context["task_version"] = "3.53.1"
         context["pytest_version"] = ">=9.1.1"
-        context["pytest_randomly_version"] = ">=4.1.0"
+        context["pytest_randomly_version"] = ">=5.0.0"
         context["pytest_cov_version"] = ">=7.1.0"
-        context["copier_version"] = "==9.17.1"
+        context["copier_version"] = "==9.18.2"
         context["copier_template_extensions_version"] = "==0.3.3"
         context["sphinx_version"] = "9.0.4"
-        context["pulumi_version"] = ">=3.245.0"
-        context["pulumi_aws_version"] = ">=7.32.0"
-        context["pulumi_aws_native_version"] = ">=1.68.0"
+        context["pulumi_version"] = ">=3.261.0"
+        context["pulumi_aws_version"] = ">=7.44.0"
+        context["pulumi_aws_native_version"] = ">=1.77.0"
         context["pulumi_command_version"] = ">=1.2.1"
         context["pulumi_github_version"] = ">=6.13.1"
         context["pulumi_okta_version"] = ">=6.6.0"
-        context["boto3_version"] = ">=1.42.92"
+        context["boto3_version"] = ">=1.43.88"
         context["ephemeral_pulumi_deploy_version"] = ">=0.0.7"
-        context["pydantic_version"] = ">=2.13.4"
-        context["pyinstaller_version"] = ">=6.22.2"
+        context["pydantic_version"] = ">=2.13.5"
+        context["pyinstaller_version"] = ">=6.22.3"
         context["setuptools_version"] = "80.7.1"
         context["strawberry_graphql_version"] = "==0.298.0"
         context["fastapi_version"] = ">=0.141.1"
         context["fastapi_offline_version"] = ">=1.7.7"
         context["starlette_version"] = ">=1.6.0"
-        context["uvicorn_version"] = ">=0.52.3"
+        context["uvicorn_version"] = ">=0.53.0"
         context["lab_auto_pulumi_version"] = ">=0.2.3"
         context["ariadne_codegen_version"] = ">=0.18.0"
         context["pytest_mock_version"] = ">=3.15.1"
-        context["uuid_utils_version"] = ">=0.16.2"
-        context["syrupy_version"] = ">=5.5.3"
+        context["uuid_utils_version"] = ">=1.0.0"
+        context["syrupy_version"] = ">=6.1.1"
         context["structlog_version"] = ">=26.1.0"
         context["httpx_version"] = ">=0.28.1"
-        context["httpx2_version"] = ">=2.10.0"
-        context["python_kiota_bundle_version"] = ">=1.11.6"
+        context["httpx2_version"] = ">=2.13.0"
+        context["python_kiota_bundle_version"] = ">=1.12.3"
         context["vcrpy_version"] = ">=8.3.0"
         context["pytest_recording_version"] = ">=0.13.4"
         context["pytest_asyncio_version"] = ">=1.4.0"
         context["pytest_timeout_version"] = ">=2.4.0"
         context["pytest_reserial_version"] = ">=0.6.1"
-        context["python_faker_version"] = ">=40.36.0"
-        context["mutmut_version"] = ">=3.7.0"
-        context["pyright_version"] = ">=1.1.411"
-        context["pyrefly_version"] = ">=1.2.0"
+        context["python_faker_version"] = ">=40.39.0"
+        context["mutmut_version"] = ">=3.8.0"
+        context["pyright_version"] = ">=1.1.414"
+        context["pyrefly_version"] = ">=1.3.1"
         context["vacuum_openapi_version"] = "0.30.0"
 
         context["default_node_version"] = "24.11.1"
@@ -108,24 +109,24 @@ def hook(  # noqa: PLR0915 # yes, this is a lot of statements, but it's all just
         context["gha_upload_artifact"] = "v7.0.1"
         context["gha_download_artifact"] = "v8.0.1"
         context["gha_github_script"] = "v7.0.1"
-        context["gha_setup_buildx"] = "v4.0.0"
-        context["buildx_version"] = "v0.33.0"
-        context["gha_docker_build_push"] = "v7.1.0"
-        context["gha_configure_aws_credentials"] = "v6.2.3"
+        context["gha_setup_buildx"] = "v4.4.1"
+        context["buildx_version"] = "v0.37.1"
+        context["gha_docker_build_push"] = "v7.4.0"
+        context["gha_configure_aws_credentials"] = "v6.3.0"
         context["gha_amazon_ecr_login"] = "v2.1.7"
-        context["gha_setup_node"] = "v6.4.0"
-        context["gha_pnpm_setup"] = "v2.0.2"
-        context["gha_action_gh_release"] = "v3.0.0"
-        context["gha_codecov"] = "v7.0.0"
+        context["gha_setup_node"] = "v7.0.0"
+        context["gha_pnpm_setup"] = "v2.1.0"
+        context["gha_action_gh_release"] = "v3.0.3"
+        context["gha_codecov"] = "v7.1.0"
         context["gha_mutex"] = "1ebad517141198e08d47cf72f3c0975316620a65 # v1.0.0-alpha.10"
-        context["gha_pypi_publish"] = "v1.14.0"
-        context["gha_sleep"] = "v2.0.3"
+        context["gha_pypi_publish"] = "v1.14.2"
+        context["gha_sleep"] = "v2.0.4"
         context["gha_absaoss_k3d"] = "v2.4.0"
-        context["k3d_version"] = "v5.5.0"
-        context["gha_azure_setup_helm"] = "v5.0.0"
-        context["helm_version"] = "v3.18.3"
+        context["k3d_version"] = "v5.9.0"
+        context["gha_azure_setup_helm"] = "v5.0.1"
+        context["helm_version"] = "v3.22.0"
         context["gha_azure_setup_kubectl"] = "v5.1.0"
-        context["kubectl_version"] = "v1.36.0"
+        context["kubectl_version"] = "v1.37.0"
         context["gha_linux_runner"] = "ubuntu-24.04"
         context["gha_windows_runner"] = "windows-2025-vs2026"
         context["gha_short_timeout_minutes"] = "2"
@@ -138,6 +139,9 @@ def hook(  # noqa: PLR0915 # yes, this is a lot of statements, but it's all just
         context["alpine_image_version"] = "3.23"
         context["nginx_image_version"] = "1.30.1"
 
+        context["beads_version"] = "1.2.2"
+        context["dolt_image_version"] = "2.1.0"
+
         context["kiota_cli_version"] = "1.32.4"
 
         context["py312_version"] = "3.12.7"
diff --git a/pyproject.toml b/pyproject.toml
index 5f83cf3a..c1cd5b72 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -18,10 +18,10 @@ dependencies = [
     # Managed by upstream template
     "pytest>=9.1.1",
     "pytest-cov>=7.1.0",
-    "pytest-randomly>=4.1.0",
-    "faker>=40.36.0",
-    "pyrefly>=1.2.0",
-    "copier==9.17.1",
+    "pytest-randomly>=5.0.0",
+    "faker>=40.39.0",
+    "pyrefly>=1.3.1",
+    "copier==9.18.2",
     "copier-template-extensions==0.3.3"
 ]
 
diff --git a/src/copier_tasks/copier_provenance.py b/src/copier_tasks/copier_provenance.py
index 775c5c57..6847fc6a 100644
--- a/src/copier_tasks/copier_provenance.py
+++ b/src/copier_tasks/copier_provenance.py
@@ -224,13 +224,12 @@ def apply_file_markers(
 
     managed: dict[str, list[str]] = {}
 
-    dst_files: list[Path] = []
-    for root, _, files in os.walk(dst_directory, followlinks=True):
-        dst_files.extend(Path(root) / fname for fname in files)
-
-    for file in sorted(dst_files):
-        rel = file.relative_to(dst_directory)
-        if rel not in template_base_paths:
+    # Iterate the template paths and probe the destination rather than walking the destination:
+    # a destination repo can contain symlink cycles (e.g. pnpm workspace node_modules farms) that
+    # make os.walk(followlinks=True) never terminate.
+    for rel in sorted(template_base_paths):
+        file = dst_directory / rel
+        if not file.is_file():
             continue
 
         rel_str = str(rel)
diff --git a/template/.claude/.beads/config.yaml b/template/.claude/.beads/config.yaml
index 46b9e82e..5d0ceecc 100644
--- a/template/.claude/.beads/config.yaml
+++ b/template/.claude/.beads/config.yaml
@@ -26,11 +26,6 @@
 # Default actor for audit trails (overridden by BD_ACTOR or --actor)
 # actor: ""
 
-# Export events (audit trail) to .beads/events.jsonl on each flush/sync
-# When enabled, new events are appended incrementally using a high-water mark.
-# Use 'bd export --events' to trigger manually regardless of this setting.
-# events-export: false
-
 # Multi-repo configuration (experimental - bd-307)
 # Allows hydrating from multiple repositories and routing writes to the correct JSONL
 # repos:
diff --git a/template/.claude/commands/add-command.md b/template/.claude/commands/add-command.md
index ceb45a2d..23be23eb 100644
--- a/template/.claude/commands/add-command.md
+++ b/template/.claude/commands/add-command.md
@@ -11,7 +11,7 @@ argument-hint: <command-name> <description>
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/template/.claude/commands/commit.md b/template/.claude/commands/commit.md
index e40205e9..2ac4ec53 100644
--- a/template/.claude/commands/commit.md
+++ b/template/.claude/commands/commit.md
@@ -11,7 +11,7 @@ argument-hint: [optional-commit-description]
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/template/.claude/commands/create-adr.md b/template/.claude/commands/create-adr.md
index 68bab708..4b79f296 100644
--- a/template/.claude/commands/create-adr.md
+++ b/template/.claude/commands/create-adr.md
@@ -17,7 +17,7 @@ Create a new ADR to document an architectural decision. ADRs capture the "why" b
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/template/.claude/commands/create-issues.md b/template/.claude/commands/create-issues.md
index 7c1ec62d..ae37f027 100644
--- a/template/.claude/commands/create-issues.md
+++ b/template/.claude/commands/create-issues.md
@@ -15,7 +15,7 @@ Create structured implementation plan that bridges product thinking (PRD) with t
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
@@ -113,7 +113,7 @@ For each task, create a bd issue with:
 
 ```bash
 bd create "Task title" \
-  --type [feature|bug|task|chore] \
+  --type [feature|bug|task|epic|chore|decision] \
   --priority [1-3] \
   --description "Context and what needs to be built" \
   --design "Technical approach, architecture notes" \
@@ -149,8 +149,10 @@ bd create "Task title" \
 
 **Dependencies**: Link related issues
 
+The first argument is the issue that becomes blocked; the second is the blocker it waits on.
+
 ```bash
-bd dep add ISSUE-123 ISSUE-456 --type blocks
+bd dep add <blocked-id> <blocker-id> --type blocks
 ```
 
 ### Validation
@@ -179,20 +181,20 @@ After creating issues, verify:
 
 ### Beads Integration
 
-Use Beads MCP to:
+Use the `bd` CLI to:
 
 - Track work with `bd ready` to find next task
 - Create issues with `bd create "description"`
 - Track dependencies with `bd dep add`
 
-See <https://github.com/steveyegge/beads> for more information.
+See <https://github.com/gastownhall/beads> for more information.
 
 ## Integration with Other Commands
 
 - **Before /create-issues**: Use `/spike` if you need technical exploration first
 - **After /create-issues**: Use `/red` to start TDD on first task
 - **During work**: Use `bd update` to add notes/findings back to issues
-- **When stuck**: Check `bd show ISSUE-ID` to review acceptance criteria
+- **When stuck**: Check `bd show <id>` to review acceptance criteria
 
 <!--
 ============== WARNING ==============================================================================
diff --git a/template/.claude/commands/gap.md b/template/.claude/commands/gap.md
index 7d960b67..41cc1dea 100644
--- a/template/.claude/commands/gap.md
+++ b/template/.claude/commands/gap.md
@@ -11,7 +11,7 @@ argument-hint: [optional additional info]
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/template/.claude/commands/green.md b/template/.claude/commands/green.md
index 94ff71ca..7207ce51 100644
--- a/template/.claude/commands/green.md
+++ b/template/.claude/commands/green.md
@@ -19,7 +19,7 @@ GREEN PHASE! Apply the below to the user input above.
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/template/.claude/commands/issue.md b/template/.claude/commands/issue.md
index 2e71a0d6..f1fe232a 100644
--- a/template/.claude/commands/issue.md
+++ b/template/.claude/commands/issue.md
@@ -13,7 +13,7 @@ Analyze GitHub issue and create TDD implementation plan.
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
@@ -81,13 +81,13 @@ Understand the requirement by asking (use AskUserQuestion if needed):
 
 ### Beads Integration
 
-Use Beads MCP to:
+Use the `bd` CLI to:
 
 - Track work with `bd ready` to find next task
 - Create issues with `bd create "description"`
-- Track dependencies with `bd dep add`
+- Track dependencies with `bd dep add <blocked-id> <blocker-id>`
 
-See <https://github.com/steveyegge/beads> for more information.
+See <https://github.com/gastownhall/beads> for more information.
 
 ## TDD Fundamentals
 
diff --git a/template/.claude/commands/polish.md b/template/.claude/commands/polish.md
index 72bac6dd..d65248aa 100644
--- a/template/.claude/commands/polish.md
+++ b/template/.claude/commands/polish.md
@@ -11,7 +11,7 @@ argument-hint: [branch, PR#, file, or area to polish]
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/template/.claude/commands/red.md b/template/.claude/commands/red.md
index 32fc6784..17b35a50 100644
--- a/template/.claude/commands/red.md
+++ b/template/.claude/commands/red.md
@@ -19,7 +19,7 @@ RED PHASE! Apply the below to the user input above.
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/template/.claude/commands/refactor.md b/template/.claude/commands/refactor.md
index 578a1dd2..267ebf37 100644
--- a/template/.claude/commands/refactor.md
+++ b/template/.claude/commands/refactor.md
@@ -19,7 +19,7 @@ Apply this document (specifically the Refactor phase) to the user input above.
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/template/.claude/commands/research.md b/template/.claude/commands/research.md
index 93679c1a..819a27ed 100644
--- a/template/.claude/commands/research.md
+++ b/template/.claude/commands/research.md
@@ -11,7 +11,7 @@ argument-hint: <research topic or question>
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 **User arguments:**
 
diff --git a/template/.claude/commands/simplify.md b/template/.claude/commands/simplify.md
index c5cc1a8a..b2e108fb 100644
--- a/template/.claude/commands/simplify.md
+++ b/template/.claude/commands/simplify.md
@@ -11,7 +11,7 @@ argument-hint: [file, function, or area to simplify]
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 **User arguments:**
 
diff --git a/template/.claude/commands/spike.md b/template/.claude/commands/spike.md
index f1e0583f..6bd674a2 100644
--- a/template/.claude/commands/spike.md
+++ b/template/.claude/commands/spike.md
@@ -19,7 +19,7 @@ SPIKE PHASE! Apply the below to the user input above.
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/template/.claude/commands/summarize.md b/template/.claude/commands/summarize.md
index 63dcecf5..cbe266d9 100644
--- a/template/.claude/commands/summarize.md
+++ b/template/.claude/commands/summarize.md
@@ -11,7 +11,7 @@ argument-hint: [optional additional info]
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
@@ -53,7 +53,7 @@ Keep the summary concise and actionable - suitable for pasting into a new conver
 
 ## Beads Integration
 
-If Beads MCP is available, check for task tracking status and ask if the user wants to:
+Check for task tracking status with the `bd` CLI and ask if the user wants to:
 
 1. Review current task status
 2. Update task states based on conversation progress
diff --git a/template/.claude/commands/tdd-review.md b/template/.claude/commands/tdd-review.md
index f34f3088..2a87eb1d 100644
--- a/template/.claude/commands/tdd-review.md
+++ b/template/.claude/commands/tdd-review.md
@@ -11,7 +11,7 @@ argument-hint: [optional test file or directory path]
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/template/.claude/commands/tdd.md b/template/.claude/commands/tdd.md
index 10c71626..a525cb2e 100644
--- a/template/.claude/commands/tdd.md
+++ b/template/.claude/commands/tdd.md
@@ -13,7 +13,7 @@ argument-hint: [optional-response-to-last-message]
 - Write natural, descriptive code without meta-commentary about the development process
 - The code should speak for itself - TDD is the process, not the product
 
-Beads is available for task tracking. Use `mcp__beads__*` tools to manage issues (the user interacts via `bd` commands).
+Beads is available for task tracking. Use `bd` CLI commands to manage issues.
 
 ## Plan File Restriction
 
diff --git a/template/.claude/settings/models.jsonc b/template/.claude/settings/models.jsonc
index d8918e14..25546fe0 100644
--- a/template/.claude/settings/models.jsonc
+++ b/template/.claude/settings/models.jsonc
@@ -9,6 +9,7 @@
  */
 {
     "availableModels": [
+        "fable",
         "sonnet",
         "opus",
         "haiku",
diff --git a/template/.claude/settings/permissions/bash.jsonc b/template/.claude/settings/permissions/bash.jsonc
index df881f30..b6b9d83f 100644
--- a/template/.claude/settings/permissions/bash.jsonc
+++ b/template/.claude/settings/permissions/bash.jsonc
@@ -104,11 +104,10 @@
       "Bash(amp *)",
       "Bash(atuin *)",
       "Bash(bc *)",
-      "Bash(chezmoi *)",
       "Bash(diff *)",
       "Bash(jq *)",
-      "Bash(just *)",
       "Bash(lsof *)",
+      "Bash(task *)", // Task runner invocation is freely allowed.  Write access to the taskfiles themselves is protected by Ask.
       "Bash(test *)",
       "Bash(xxd)", // this invocation can be used to read, but not to write (so no " *" after it)
       "Bash(zk *)",
@@ -155,6 +154,17 @@
       "Bash(gh pr ready *)",
       "Bash(gh pr review *)",
       "Bash(gh pr update-branch *)",
+      // Task must run the repo's own taskfiles, which are the reviewed ones. These flags are the only ways to point it elsewhere (there is no environment variable equivalent -- https://github.com/go-task/task/issues/1721 was closed as a duplicate with nothing implemented), and `/tmp` is writable without a prompt, so without these denials `Bash(task *)` would be an allow-anything entry.
+      "Bash(task -t *)",
+      "Bash(task --taskfile *)",
+      "Bash(task --taskfile=*)",
+      "Bash(task --entrypoint *)",
+      "Bash(task --entrypoint=*)",
+      "Bash(task -d *)",
+      "Bash(task --dir *)",
+      "Bash(task --dir=*)",
+      "Bash(task -g *)",
+      "Bash(task --global *)",
 
       // Destructive File Operations
       "Bash(chmod -R *)",
diff --git a/template/.claude/settings/permissions/write.jsonc b/template/.claude/settings/permissions/edit.jsonc
similarity index 63%
rename from template/.claude/settings/permissions/write.jsonc
rename to template/.claude/settings/permissions/edit.jsonc
index f7991a15..dc1600d8 100644
--- a/template/.claude/settings/permissions/write.jsonc
+++ b/template/.claude/settings/permissions/edit.jsonc
@@ -8,10 +8,13 @@
  * =====================================================================================================
  */
 {
-  // Write permissions for specific files
+  // Edit permissions for specific files
   // This should only ever be running in a devcontainer, so pretty lenient permissions are allowed
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
   "permissions": {
-    "allow": ["Write(/tmp/**/*)", "Write(/workspaces/**/tmp/**)", "Write(tmp/**)"],
+    // A single leading slash anchors at the settings source, so absolute paths need the `//` prefix
+    "allow": ["Edit(//tmp/**)", "Edit(//workspaces/**/tmp/**)", "Edit(tmp/**)"],
+    // Agents are allowed to run any task, but this provides some basic protection against editing a task to do something nefarious that's normally forbidden.
+    "ask": ["Edit(Taskfile.yaml)", "Edit(.config/taskfiles/**)"],
   },
 }
diff --git a/template/.claude/skills/address-pr-comments/SKILL.md b/template/.claude/skills/address-pr-comments/SKILL.md
index 44eeed8e..4d90562b 100644
--- a/template/.claude/skills/address-pr-comments/SKILL.md
+++ b/template/.claude/skills/address-pr-comments/SKILL.md
@@ -2,7 +2,7 @@
 name: address-pr-comments
 description: Addresses PR review comments by making code changes and posting replies. Takes a PR number or auto-detects from current branch. Use when the user wants to address review feedback, respond to PR comments, fix PR feedback, or says "address comments on PR X".
 user-invocable: true
-allowed-tools: Bash, Read, Write, Edit, Grep, Glob, AskUserQuestion
+allowed-tools: Bash, Read, Write, Edit, Grep, Glob, AskUserQuestion, Skill
 adapted-from: https://github.com/josh-gree/my-claude-skills
 ---
 
@@ -190,9 +190,12 @@ Within a single Phase 2 invocation, the order below is strict. The invariants ap
 > **Never commit before the reply body is finalized with the user. Never push before all reply texts in the batch are finalized. Never post a reply before its commit has been pushed. Never skip the commit link in a code-change reply.**
 
 1. For each queued **code change** (in order):
-   - Follow the `/create-issues` process: create a bd issue with a proper title, description (why this change, context from the PR comment), design (technical approach), and Given-When-Then acceptance criteria. Export after creating.
+   - Invoke the `Skill` tool with `skill: "create-issues"`, passing the reviewer's comment and the agreed change as `args`. Follow the process it returns to create a bd issue with a proper title, description (why this change, context from the PR comment), design (technical approach), and Given-When-Then acceptance criteria. Export after creating.
    - Mark the issue in progress
-   - If the change involves code: execute the TDD red/green/refactor cycle (`/red` → `/green` → `/refactor`) against the acceptance criteria. If the change is non-code (docs, markdown, config, scripts, etc.): make the change directly — TDD does not apply, but the remaining steps are identical.
+   - Decide first whether the change is testable code. **If it is not** — documentation, markdown, comments, config, shell scripts where the project has no harness for them, or any other change with no behaviour to assert — make the change directly and move to the next step. Do **not** invoke `red`, `green` or `refactor`, and do not invent a test to justify the change: TDD does not apply here. Everything after this step is identical either way.
+   - **If it is testable code**, work through the TDD cycle by invoking the `Skill` tool once per phase, in this order — `skill: "red"`, then `skill: "green"`, then `skill: "refactor"` — passing the bd issue ID and the acceptance criterion being driven as `args`. Repeat the three-phase cycle until every acceptance criterion is satisfied.
+
+     **Each phase must be a real `Skill` tool call — not a description of one, and not your own recollection of what red/green/refactor mean.** Those skills carry project-specific rules that general TDD practice does not include, and they are re-read fresh each cycle so later cycles do not drift from earlier ones. Writing a test or an implementation without a preceding `Skill` call for that phase is a workflow violation.
    - **Finalize the reply body with the user — before committing.** Draft the reply text (everything except the commit link) — **do NOT include the AI attribution footer; `check-footer.py` appends it**. Write to `<reply_file>`, tell the user the absolute path (per [Conventions](#conventions)), and go through the approve/edit loop with the user until they approve. Do not proceed until the user explicitly confirms the text. Leave a clear `[COMMIT LINK]` placeholder where the link will go.
 
      Use AskUserQuestion with this wording (do NOT say "Post now" — the reply is queued for posting after the push, not posted immediately):
@@ -252,6 +255,8 @@ Summarise what was done:
 - Skip comments without asking
 - Leave uncommitted changes
 - Include the AI attribution footer in generated reply text — `check-footer.py` is solely responsible for it
+- Write tests or implementation from your own knowledge of TDD — when a change is testable code, `red`, `green` and `refactor` must each be invoked through the `Skill` tool
+- Run the TDD cycle on a change that has no behaviour to assert — docs, markdown, comments, config and unharnessed shell scripts are made directly
 
 ## Handling Common Scenarios
 
@@ -273,7 +278,7 @@ Discuss with user, then post a reply explaining the reasoning if they want to pu
 - [ ] If `--resume`: build inventory, classify reply drafts (placeholder vs finalized vs orphan), prompt user for resume strategy
 - [ ] Fetch and display comments
 - [ ] Phase 1: collect decisions for all comments (reply-only comments posted in Phase 1)
-- [ ] Phase 2: implement code changes, one commit per comment
+- [ ] Phase 2: invoke `create-issues` via the `Skill` tool for every queued item; add `red` → `green` → `refactor` only for items that are testable code; one commit per comment
 - [ ] Push all commits in a single push
 - [ ] Post code-change replies with commit links after push
 - [ ] Report what was done
diff --git a/template/.config/ruff-non-src.toml b/template/.config/ruff-non-src.toml
index 9be02016..2a5344a8 100644
--- a/template/.config/ruff-non-src.toml
+++ b/template/.config/ruff-non-src.toml
@@ -20,6 +20,7 @@ ignore = [
     "S311", # pseudo-randomness is fine for test cases
     "TID252", # sometimes you can't use absolute imports in test cases for importing things within the tests, because they're not a true package or have conflicting namespaces
     "TRY003", # tests don't need to create custom exception classes, generally you want to throw an AssertionError with a message anyway
+    "TC001", "TC002", "TC003" # we don't need to worry about TYPE_CHECKING guards in tests---needless complication for marginal benefit
 ]
 
 unfixable = [
@@ -31,3 +32,7 @@ unfixable = [
 
 [lint.flake8-pytest-style]
 raises-require-match-for = ["*"] # ensures we always have a match for our raises statements so that we validate tests fail for the right reason
+
+[lint.flake8-tidy-imports.banned-api]
+"typing.TYPE_CHECKING".msg = "This is in non-source code. There is no reason to be doing TYPE_CHECKING blocks in tests or script. If you do have a need add `# noqa: TID251` with a clarifying comment"
+"__future__.annotations".msg = "__future__.annotations will be deprecated, once 3.13 is EOL. Also see https://peps.python.org/pep-0749/. If this is problematic, turn annotations into strings, or add `# noqa: TID251` with a clarifying comment but likely this import is not necessary at all."
diff --git a/template/.config/ruff.toml b/template/.config/ruff.toml
index 3f009c3d..159f682f 100644
--- a/template/.config/ruff.toml
+++ b/template/.config/ruff.toml
@@ -121,3 +121,6 @@ skip-magic-trailing-comma = false
 
 # Like Black, automatically detect the appropriate line ending.
 line-ending = "auto"
+
+[lint.flake8-tidy-imports.banned-api]
+"__future__.annotations".msg = "__future__.annotations will be deprecated, once 3.13 is EOL. Also see https://peps.python.org/pep-0749/. If this is problematic, turn annotations into strings, or add `# noqa: TID251` selectively but likely this import is not necessary at all."
diff --git a/template/.config/taskfiles/copier-template.yaml b/template/.config/taskfiles/copier-template.yaml
new file mode 100644
index 00000000..cba155e3
--- /dev/null
+++ b/template/.config/taskfiles/copier-template.yaml
@@ -0,0 +1,35 @@
+# ============== WARNING ==============================================================================
+# File is managed by copier template: gh:LabAutomationAndScreening/copier-base-template.git
+# See .config/.copier-managed-files.json for details.
+#
+# You are welcome to make changes to this file in your repo if they are custom to your project,
+# but if the change should be shared with other projects, please backport it to the template repo.
+# =====================================================================================================
+version: '3'
+
+tasks:
+  copier-update:
+    desc: Pull the latest updates from the upstream copier template into this repo
+    cmds:
+      - task: _copier-update
+        vars:
+          REF_FLAG: ''
+
+  copier-update-from-ref:
+    desc: Pull updates from a specific ref of the upstream copier template, e.g. `task copier-update-from-ref REF=some-branch`
+    requires:
+      vars: [REF]
+    cmds:
+      - task: _copier-update
+        vars:
+          REF_FLAG: --vcs-ref {{.REF | shellQuote}}
+
+  _copier-update:
+    internal: true
+    cmds:
+      - copier update --answers-file .config/.copier-answers.yml --trust --conflict rej --defaults {{.REF_FLAG}}
+
+  prune-copier-rejects:
+    desc: Delete .rej files whose target file is unchanged, failing if any real conflict is left to resolve
+    cmds:
+      - ./scripts/delete_false_positive_rej.py
diff --git a/template/.devcontainer/devcontainer.json.jinja b/template/.devcontainer/devcontainer.json.jinja
index ab4d25da..7edbd22a 100644
--- a/template/.devcontainer/devcontainer.json.jinja
+++ b/template/.devcontainer/devcontainer.json.jinja
@@ -6,17 +6,17 @@
   "dockerComposeFile": "docker-compose.yml",
   "service": "devcontainer",
   "workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}",
-  "features": {{% endraw %}{% if is_child_of_copier_base_template is not defined %}{% raw %}
+  "features": {
     "ghcr.io/devcontainers/features/git-lfs:1.2.5": {
       // we are not using git-lfs right now, but its a transitive dep elsewhere. We want to configure auto pull to off since the feature will by default also try to install the git hook
       // and it breaks creation of the devcontainer since pre-commit hooks are already in place. Probably a better way to fix this but until we use git-lfs we can leave it like this.
       // https://github.com/devcontainers/features/blob/main/src/git-lfs/README.md
       "autoPull": false
-    },
-    "ghcr.io/devcontainers/features/aws-cli:1.1.2": {
+    },{% endraw %}{% if is_child_of_copier_base_template is not defined %}{% raw %}
+    "ghcr.io/devcontainers/features/aws-cli:1.1.4": {
       // https://github.com/devcontainers/features/blob/main/src/aws-cli/devcontainer-feature.json
       // view latest version https://raw.githubusercontent.com/aws/aws-cli/v2/CHANGELOG.rst
-      "version": "2.34.34"
+      "version": "2.36.49"
     },{% endraw %}{% endif %}{% raw %}{% endraw %}{% if is_child_of_copier_base_template is not defined and template_uses_typescript is defined and template_uses_typescript is sameas(true) %}{% raw %}
     "ghcr.io/devcontainers/features/node:2.1.0": {
       // https://github.com/devcontainers/features/blob/main/src/node/devcontainer-feature.json
@@ -34,15 +34,15 @@
         "-AmazonWebServices.aws-toolkit-vscode", // the AWS CLI feature installs this automatically, but it's causing problems in VS Code{% endraw %}{% endif %}{% raw %}
         // basic tooling
         // "eamodio.gitlens@15.5.1",
-        "coderabbit.coderabbit-vscode@0.21.3",
+        "coderabbit.coderabbit-vscode@0.21.8",
         "ms-vscode.live-server@0.5.2025051301",
         "MS-vsliveshare.vsliveshare@1.0.5905",{% endraw %}{% if install_claude_cli %}{% raw %}
-        "anthropic.claude-code@2.1.238",{% endraw %}{% endif %}{% raw %}{% endraw %}{% if (is_child_of_copier_base_template is defined and is_child_of_copier_base_template is sameas(true)) or (is_child_of_copier_base_template is not defined and template_uses_python is defined and template_uses_python is sameas(true)) %}{% raw %}
+        "anthropic.claude-code@2.1.278",{% endraw %}{% endif %}{% raw %}{% endraw %}{% if (is_child_of_copier_base_template is defined and is_child_of_copier_base_template is sameas(true)) or (is_child_of_copier_base_template is not defined and template_uses_python is defined and template_uses_python is sameas(true)) %}{% raw %}
 
         // Python
         "-ms-python.vscode-pylance", // pyrefly is the language server for this project; ms-python.python auto-installs Pylance via its extension pack, and Pylance then warns on every boot that it's disabled
         "ms-python.python@2026.5.2026052901",
-        "meta.pyrefly@1.2.9002",
+        "meta.pyrefly@1.3.1",
         "ms-vscode-remote.remote-containers@0.414.0",
         "charliermarsh.ruff@2026.68.0",{% endraw %}{% endif %}{% raw %}
 {% endraw %}{% if is_child_of_copier_base_template is not defined and template_uses_vuejs is defined and template_uses_vuejs is sameas(true) %}{% raw %}
diff --git a/template/.devcontainer/docker-compose.yml.jinja b/template/.devcontainer/docker-compose.yml.jinja
index 449cfd5b..edbad299 100644
--- a/template/.devcontainer/docker-compose.yml.jinja
+++ b/template/.devcontainer/docker-compose.yml.jinja
@@ -19,20 +19,22 @@
       - AWS_DEFAULT_REGION={% endraw %}{{ aws_region_for_stack if (aws_region_for_stack is defined and aws_region_for_stack != "") else "us-east-1" }}{% raw %}{% endraw %}{% if install_claude_cli %}{% raw %}
       - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
       - BEADS_DIR=/workspaces/{% endraw %}{{ repo_name }}{% raw %}/.claude/.beads
+      - BEADS_DOLT_SERVER_MODE=1 # bd >=1.0 defaults to embedded dolt, and bd init hard-fails when the server host/port are set without this
       - BEADS_DOLT_SERVER_HOST=beads-dolt # this is on the docker compose network. We don't want to publish the server port because then the local machine would have a bunch of conflicts with multiple devcontainers running
       - BEADS_DOLT_SERVER_PORT=3306
       - BEADS_DOLT_SERVER_DATABASE=beads_work
-      - BEADS_DOLT_SERVER=beads-dolt # for some weird reason, unless we specify both of these envvars it doesn't seem to reliably work
-      - BEADS_DOLT_PORT=3306
+      - BEADS_DOLT_AUTO_START=0 # the beads-dolt service owns the server lifecycle, so bd must never spawn its own
+      - BD_DISABLE_METRICS=1 # bd >=1.0 sends anonymous usage metrics by default
 
 
   beads-dolt:
-    image: dolthub/dolt-sql-server:1.83.0 # no explicit reason for this version, just pinning for best practice
+    image: dolthub/dolt-sql-server:{% endraw %}{{ dolt_image_version }}{% raw %} # kept in lockstep with beads_version; both are defined in extensions/context.py
     volumes:
       - beads_dolt_data:/var/lib/dolt
     environment:
       - DOLT_ROOT_HOST=%
-      - DOLT_DATABASE=beads_work{% endraw %}{% endif %}{% raw %}
+      - DOLT_DATABASE=beads_work
+      - DOLT_DISABLE_EVENT_FLUSH=1 # dolt contacts doltremoteapi.dolthub.com with usage metrics by default, even with no remotes configured (see beads SECURITY.md){% endraw %}{% endif %}{% raw %}
 
 
 volumes:{% endraw %}{% if install_claude_cli %}{% raw %}
diff --git a/template/.devcontainer/install-ci-tooling.py.jinja b/template/.devcontainer/install-ci-tooling.py.jinja
index 13f85fff..15deaef1 100644
--- a/template/.devcontainer/install-ci-tooling.py.jinja
+++ b/template/.devcontainer/install-ci-tooling.py.jinja
@@ -1,6 +1,7 @@
 {% raw %}import argparse
 import os
 import platform
+import shlex
 import shutil
 import subprocess
 import sys
@@ -12,8 +13,22 @@ PNPM_VERSION = "{% endraw %}{{ pnpm_version }}{% raw %}"
 COPIER_VERSION = "{% endraw %}{{ copier_version }}{% raw %}"
 COPIER_TEMPLATE_EXTENSIONS_VERSION = "{% endraw %}{{ copier_template_extensions_version }}{% raw %}"
 PRE_COMMIT_VERSION = "{% endraw %}{{ pre_commit_version }}{% raw %}"
-GITHUB_WINDOWS_RUNNER_BIN_PATH = r"C:\Users\runneradmin\.local\bin"
+TASK_VERSION = "{% endraw %}{{ task_version }}{% raw %}"
+DOWNLOAD_TIMEOUT_SECONDS = 90
+# Where both uv's and Task's installers place binaries. Resolves from USERPROFILE on Windows, so it
+# matches the runner's home directory without assuming its user name. Already on PATH on POSIX, but
+# not on Windows, which is why uv is invoked through an absolute path there.
+LOCAL_BIN_DIR = Path.home() / ".local" / "bin"
 INSTALL_SSM_PLUGIN_BY_DEFAULT = {% endraw %}{% if is_child_of_copier_base_template is not defined and install_aws_ssm_port_forwarding_plugin is defined and install_aws_ssm_port_forwarding_plugin is sameas(true) %}True{% else %}False{% endif %}{% raw %}
+# A floor rather than an exact pin: GitHub's runner images ship their own build of the plugin and only
+# ever move it forward, so demanding an exact version means asking a Windows runner to downgrade, which
+# its installer refuses outright with MSI error 1638.
+SSM_PLUGIN_MINIMUM_VERSION = (1, 2, 835, 0)
+SSM_PLUGIN_DOWNLOAD_VERSION = ".".join(str(part) for part in SSM_PLUGIN_MINIMUM_VERSION)
+SSM_PLUGIN_EXECUTABLE = "session-manager-plugin"
+# Where the Windows installer places the executable. Needed because a fresh install does not reach the
+# PATH of the already-running process, so PATH alone cannot confirm the install landed.
+SSM_PLUGIN_WINDOWS_PATH = Path(r"C:\Program Files\Amazon\SessionManagerPlugin\bin\session-manager-plugin.exe")
 parser = argparse.ArgumentParser(description="Install CI tooling for the repo")
 _ = parser.add_argument(
     "--no-python",
@@ -38,30 +53,202 @@ _ = parser.add_argument(
 )
 
 
+def pwsh_cmd(cmd: str) -> list[str]:
+    pwsh = shutil.which("pwsh") or shutil.which("powershell")
+    if not pwsh:
+        raise FileNotFoundError("Neither 'pwsh' nor 'powershell' found on PATH")
+    return [pwsh, "-NoProfile", "-NonInteractive", "-Command", cmd]
+
+
+def install_task(*, is_windows: bool) -> None:
+    """Install the pinned Task release into `LOCAL_BIN_DIR`.
+
+    Deliberately not `npm install -g @go-task/cli`: that writes to the global prefix of whichever
+    node is on PATH, and in CI that is the pnpm-managed node installed by `pnpm/setup`, whose prefix
+    bin directory is not the one on PATH. The package installs successfully and the linked
+    executable is then unreachable, so `task` fails with exit status 127.
+
+    Verification goes through the absolute path because this process resolved PATH before the
+    install; `GITHUB_PATH` is appended so later steps in the same CI job can invoke `task` by name.
+    """
+    LOCAL_BIN_DIR.mkdir(parents=True, exist_ok=True)
+    if is_windows:
+        if platform.machine().lower() == "arm64":
+            windows_arch = "arm64"
+        else:
+            windows_arch = "amd64"
+        archive_url = (
+            f"https://github.com/go-task/task/releases/download/v{TASK_VERSION}/task_windows_{windows_arch}.zip"
+        )
+        # The bin directory is handed over as an environment variable rather than interpolated into the
+        # script text: PowerShell single quotes take no escapes, so an apostrophe in the home directory
+        # would terminate the string early. A variable reference is one argument whatever it contains.
+        task_env = dict(os.environ)
+        task_env.update({"TASK_BIN_DIR": str(LOCAL_BIN_DIR)})
+        powershell_statements = [
+            "$ErrorActionPreference = 'Stop'",
+            "$archive = Join-Path $env:TEMP 'task-release.zip'",
+            f"Invoke-WebRequest -UseBasicParsing -Uri '{archive_url}' -OutFile $archive",
+            "Expand-Archive -Path $archive -DestinationPath $env:TASK_BIN_DIR -Force",
+            "Remove-Item $archive",
+        ]
+        _ = subprocess.run(  # noqa: S603 # this is all our own input
+            pwsh_cmd("; ".join(powershell_statements)),
+            check=True,
+            env=task_env,
+            timeout=DOWNLOAD_TIMEOUT_SECONDS,
+        )
+        task_path = LOCAL_BIN_DIR / "task.exe"
+    else:
+        # The installer resolves the pinned tag against the published checksums, so the archive is verified.
+        # The bin directory is shell-quoted because a space or apostrophe in the home directory would
+        # otherwise split it into multiple arguments, or unbalance the quoting outright.
+        _ = subprocess.run(  # noqa: S602 # we need to set shell to true to use the pipe operator, and this is all our own input
+            f"curl -fsSL --connect-timeout 20 --max-time 40 --retry 3 --retry-delay 5 --retry-connrefused --proto '=https' https://taskfile.dev/install.sh | sh -s -- -b {shlex.quote(str(LOCAL_BIN_DIR))} v{TASK_VERSION}",
+            check=True,
+            shell=True,
+            timeout=DOWNLOAD_TIMEOUT_SECONDS,
+        )
+        task_path = LOCAL_BIN_DIR / "task"
+    _ = subprocess.run([str(task_path), "--version"], check=True)  # noqa: S603 # this is all our own input
+    if "GITHUB_PATH" in os.environ:
+        with Path(os.environ["GITHUB_PATH"]).open("a", encoding="utf-8") as github_path_file:
+            _ = github_path_file.write(f"{LOCAL_BIN_DIR}\n")
+
+
+def run_node_cmds(cmds: list[str], *, is_windows: bool) -> None:
+    for cmd in cmds:
+        if is_windows:
+            run_cmd = pwsh_cmd(cmd)
+        else:
+            run_cmd = [cmd]
+        _ = subprocess.run(run_cmd, shell=True, check=True, timeout=DOWNLOAD_TIMEOUT_SECONDS)  # noqa: S602 # we need shell=True for npm commands, and this is all our own input
+
+
+def parse_version(raw: str) -> tuple[int, ...] | None:
+    stripped = raw.strip()
+    if not stripped:
+        return None
+    parts: list[int] = []
+    for segment in stripped.split("."):
+        if not segment.isdigit():
+            return None
+        parts.append(int(segment))
+    return tuple(parts)
+
+
+def resolve_ssm_plugin() -> str | None:
+    on_path = shutil.which(SSM_PLUGIN_EXECUTABLE)
+    if on_path is not None:
+        return on_path
+    if SSM_PLUGIN_WINDOWS_PATH.exists():
+        return str(SSM_PLUGIN_WINDOWS_PATH)
+    return None
+
+
+def installed_ssm_plugin_version() -> tuple[int, ...] | None:
+    executable = resolve_ssm_plugin()
+    if executable is None:
+        return None
+    try:
+        result = subprocess.run(  # noqa: S603 # this is all our own input
+            [executable, "--version"],
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+    except subprocess.CalledProcessError:
+        return None
+    return parse_version(result.stdout)
+
+
+def install_ssm_plugin(*, is_windows: bool) -> None:
+    with tempfile.TemporaryDirectory() as tmp_dir:
+        if is_windows:
+            local_package_path = Path(tmp_dir) / "SessionManagerPluginSetup.exe"
+            # Based on https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-windows.html
+            _ = subprocess.run(  # noqa: S603 # this is all our own input
+                [  # noqa: S607 # curl should always be on PATH
+                    "curl",
+                    f"https://s3.amazonaws.com/session-manager-downloads/plugin/{SSM_PLUGIN_DOWNLOAD_VERSION}/windows/SessionManagerPluginSetup.exe",
+                    "-o",
+                    f"{local_package_path}",
+                ],
+                check=True,
+                timeout=DOWNLOAD_TIMEOUT_SECONDS,
+            )
+            _ = subprocess.run(  # noqa: S603 # this is all our own input
+                [str(local_package_path), "/quiet"],
+                check=True,
+            )
+        else:
+            local_package_path = Path(tmp_dir) / "session-manager-plugin.deb"
+            # Based on https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-debian-and-ubuntu.html
+            _ = subprocess.run(  # noqa: S603 # this is all our own input
+                [  # noqa: S607 # curl should always be on PATH
+                    "curl",
+                    f"https://s3.amazonaws.com/session-manager-downloads/plugin/{SSM_PLUGIN_DOWNLOAD_VERSION}/ubuntu_64bit/session-manager-plugin.deb",
+                    "-o",
+                    f"{local_package_path}",
+                ],
+                check=True,
+                timeout=DOWNLOAD_TIMEOUT_SECONDS,
+            )
+            _ = subprocess.run(  # noqa: S603 # this is all our own input
+                [  # noqa: S607 # sudo should always be on PATH
+                    "sudo",
+                    "dpkg",
+                    "-i",
+                    str(local_package_path),
+                ],
+                check=True,
+            )
+
+
+def ensure_ssm_plugin(*, is_windows: bool) -> None:
+    installed = installed_ssm_plugin_version()
+    if installed is None:
+        print("SSM plugin not found, installing it")  # noqa: T201 # we want the script to print to console for easy viewing
+    elif installed < SSM_PLUGIN_MINIMUM_VERSION:
+        print(  # noqa: T201 # we want the script to print to console for easy viewing
+            f"SSM plugin {'.'.join(str(part) for part in installed)} is older than the required "
+            f"{SSM_PLUGIN_DOWNLOAD_VERSION}, upgrading it"
+        )
+    else:
+        print(  # noqa: T201 # we want the script to print to console for easy viewing
+            f"SSM Plugin Manager Version: {'.'.join(str(part) for part in installed)} "
+            f"(already at least {SSM_PLUGIN_DOWNLOAD_VERSION}, leaving it alone)"
+        )
+        return
+    install_ssm_plugin(is_windows=is_windows)
+    # The installer exits zero without installing anything when the requested version is already
+    # present, so the version has to be read back rather than inferred from the exit code.
+    final = installed_ssm_plugin_version()
+    if final is None or final < SSM_PLUGIN_MINIMUM_VERSION:
+        raise RuntimeError(
+            f"The SSM plugin installer did not produce {SSM_PLUGIN_EXECUTABLE} "
+            f"version {SSM_PLUGIN_DOWNLOAD_VERSION} or newer, it left {final}"
+        )
+    print(f"SSM Plugin Manager Version: {'.'.join(str(part) for part in final)}")  # noqa: T201 # we want the script to print to console for easy viewing
+
+
 def main():
     args = parser.parse_args(sys.argv[1:])
     is_windows = platform.system() == "Windows"
     uv_env = dict(os.environ)
     uv_env.update({"UV_PYTHON": args.python_version, "UV_PYTHON_PREFERENCE": "only-system"})
-    uv_path = ((GITHUB_WINDOWS_RUNNER_BIN_PATH + "\\") if is_windows else "") + "uv"
     if is_windows:
-        pwsh = shutil.which("pwsh") or shutil.which("powershell")
-        if not pwsh:
-            raise FileNotFoundError("Neither 'pwsh' nor 'powershell' found on PATH")
+        uv_path = str(LOCAL_BIN_DIR / "uv")
+    else:
+        uv_path = "uv"
     if not args.no_python:
         if is_windows:
-            uv_env.update({"PATH": rf"{GITHUB_WINDOWS_RUNNER_BIN_PATH};{uv_env['PATH']}"})
-            # invoke installer in a pwsh process
+            uv_env.update({"PATH": rf"{LOCAL_BIN_DIR};{uv_env['PATH']}"})
             _ = subprocess.run(  # noqa: S603 # this is all our own input
-                [
-                    pwsh,
-                    "-NoProfile",
-                    "-NonInteractive",
-                    "-Command",
-                    f"irm https://astral.sh/uv/{UV_VERSION}/install.ps1 | iex",
-                ],
+                pwsh_cmd(f"irm https://astral.sh/uv/{UV_VERSION}/install.ps1 | iex"),
                 check=True,
                 env=uv_env,
+                timeout=DOWNLOAD_TIMEOUT_SECONDS,
             )
         else:
             _ = subprocess.run(  # noqa: S602 # we need to set shell to true to use the pipe operator, and this is all our own input
@@ -69,6 +256,7 @@ def main():
                 check=True,
                 shell=True,
                 env=uv_env,
+                timeout=DOWNLOAD_TIMEOUT_SECONDS,
             )
             # TODO: add uv autocompletion to the shell https://docs.astral.sh/uv/getting-started/installation/#shell-autocompletion
         _ = subprocess.run(  # noqa: S603 # this is all our own input
@@ -82,6 +270,7 @@ def main():
             ],
             check=True,
             env=uv_env,
+            timeout=DOWNLOAD_TIMEOUT_SECONDS,
         )
         _ = subprocess.run(  # noqa: S603 # this is all our own input
             [
@@ -92,6 +281,7 @@ def main():
             ],
             check=True,
             env=uv_env,
+            timeout=DOWNLOAD_TIMEOUT_SECONDS,
         )
         _ = subprocess.run(  # noqa: S603 # this is all our own input
             [
@@ -103,69 +293,11 @@ def main():
             env=uv_env,
         )
     if not args.no_node:
-        pnpm_install_sequence = ["npm -v", f"npm install -g pnpm@{PNPM_VERSION}", "pnpm -v"]
-        for cmd in pnpm_install_sequence:
-            run_cmd = (
-                [
-                    pwsh,  # type: ignore[reportPossiblyUnboundVariable] # this matches the conditional above that defines pwsh
-                    "-NoProfile",
-                    "-NonInteractive",
-                    "-Command",
-                    cmd,
-                ]
-                if is_windows
-                else [cmd]
-            )
-            _ = subprocess.run(run_cmd, shell=True, check=True)  # noqa: S602 # we need shell=True for npm commands, and this is all our own input
+        run_node_cmds(["npm -v", f"npm install -g pnpm@{PNPM_VERSION}", "pnpm -v"], is_windows=is_windows)
+    # Task is installed outside the --no-node branch because CI always passes --no-node (pnpm/setup handles pnpm there), and every job still needs the task runner
+    install_task(is_windows=is_windows)
     if INSTALL_SSM_PLUGIN_BY_DEFAULT and not args.skip_installing_ssm_plugin:
-        with tempfile.TemporaryDirectory() as tmp_dir:
-            if is_windows:
-                local_package_path = Path(tmp_dir) / "SessionManagerPluginSetup.exe"
-                # Based on https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-windows.html
-                # no specific reason for that version, just pinning it for best practice
-                _ = subprocess.run(  # noqa: S603 # this is all our own input
-                    [  # noqa: S607 # curl should always be on PATH
-                        "curl",
-                        "https://s3.amazonaws.com/session-manager-downloads/plugin/1.2.707.0/windows/SessionManagerPluginSetup.exe",
-                        "-o",
-                        f"{local_package_path}",
-                    ],
-                    check=True,
-                )
-                _ = subprocess.run(  # noqa: S603 # this is all our own input
-                    [str(local_package_path), "/quiet"],
-                    check=True,
-                )
-            else:
-                local_package_path = Path(tmp_dir) / "session-manager-plugin.deb"
-                # Based on https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-debian-and-ubuntu.html
-                # no specific reason for that version, just pinning it for best practice
-                _ = subprocess.run(  # noqa: S603 # this is all our own input
-                    [  # noqa: S607 # curl should always be on PATH
-                        "curl",
-                        "https://s3.amazonaws.com/session-manager-downloads/plugin/1.2.707.0/ubuntu_64bit/session-manager-plugin.deb",
-                        "-o",
-                        f"{local_package_path}",
-                    ],
-                    check=True,
-                )
-                _ = subprocess.run(  # noqa: S603 # this is all our own input
-                    [  # noqa: S607 # sudo should always be on PATH
-                        "sudo",
-                        "dpkg",
-                        "-i",
-                        str(local_package_path),
-                    ],
-                    check=True,
-                )
-            print("SSM Plugin Manager Version: ")  # noqa: T201 # we want the script to print to console for easy viewing
-            _ = subprocess.run(
-                [  # noqa: S607 # session-manager-plugin should be on PATH because we just installed it
-                    "session-manager-plugin",
-                    "--version",
-                ],
-                check=True,
-            )
+        ensure_ssm_plugin(is_windows=is_windows)
 
 
 if __name__ == "__main__":
diff --git a/template/.devcontainer/on-create-command.sh.jinja b/template/.devcontainer/on-create-command.sh.jinja
index 0438c1a7..8f2d6581 100644
--- a/template/.devcontainer/on-create-command.sh.jinja
+++ b/template/.devcontainer/on-create-command.sh.jinja
@@ -15,7 +15,7 @@ chgrp -R 0 "$repo_root/.claude" || true
 npm --prefix "$repo_root/.claude" ci
 
 # Install beads for use in Claude planning
-npm install -g @beads/bd@0.57.0 # no specific reason for this version, just pinning for best practice{% endraw %}{% endif %}{% raw %}
+npm install -g @beads/bd@{% endraw %}{{ beads_version }}{% raw %} # kept in lockstep with dolt_image_version; both are defined in extensions/context.py{% endraw %}{% endif %}{% raw %}
 
 pre-commit install --install-hooks{% endraw %}{% if python_package_registry is not defined or python_package_registry == "PyPI" %}
 
diff --git a/template/.devcontainer/post-start-command.sh.jinja b/template/.devcontainer/post-start-command.sh.jinja
index 4f88b06a..fc7a5a35 100644
--- a/template/.devcontainer/post-start-command.sh.jinja
+++ b/template/.devcontainer/post-start-command.sh.jinja
@@ -6,12 +6,20 @@ set -ex
 script_dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 repo_root="$(CDPATH='' cd -- "$script_dir/.." && pwd)"
 git config --global --add safe.directory "$repo_root"{% endraw %}{% if install_claude_cli %}{% raw %}
+# bd >=1.0 warns on every command unless .beads is owner-only, and on-create's group-writable chmod over .claude
+# undoes what bd init sets. Runs before the bd calls below so their output is clean too.
+if [ -d "$repo_root/.claude/.beads" ]; then
+    chmod 700 "$repo_root/.claude/.beads"
+fi
 pre-commit run merge-claude-settings -a
 if ! bd ready; then
 	echo "It's likely the Dolt server has not yet been initialized to support beads, running that now" # TODO: figure out a better way to match this specific scenario than just a non-zero exit code...but beads still seems like in high flux right now so not sure what to tie it to
     # the 'stealth' flag is just the only way I could figure out how to stop it from modifying AGENTS.md...if there's another way to avoid that, then fine.  Even without the stealth flag though, files inside the .claude/beads directory get modified, so restoring them at the end to what was set in git...these shouldn't really need to change regularly
     # trying to set 'prefix' to nothing doesn't seem to work (it just acts like the prefix flag wasn't there), so just setting to 'work' as an arbitrary name
-    # for some reason, the envvar for the server host isn't being picked up normally, so just passing it explicitly here
-    rm -rf .claude/.beads && bd init --server-host="$BEADS_DOLT_SERVER_HOST" --database="$BEADS_DOLT_SERVER_DATABASE" --skip-hooks --stealth --prefix=work </dev/null && git -c core.hooksPath=/dev/null restore --source=HEAD --staged --worktree .claude/.beads
+    # --server is required as of bd 1.0: without it, init resolves to embedded dolt and hard-fails because the BEADS_DOLT_SERVER_* envvars are set
+    rm -rf .claude/.beads && bd init --server --server-host="$BEADS_DOLT_SERVER_HOST" --database="$BEADS_DOLT_SERVER_DATABASE" --skip-hooks --stealth --prefix=work </dev/null
+    # Best effort: a freshly generated repo has nothing tracked under .claude/.beads, and the failed pathspec would
+    # otherwise trip 'set -e' and abandon the rest of this script
+    git -c core.hooksPath=/dev/null restore --source=HEAD --staged --worktree .claude/.beads || true
 fi{% endraw %}{% endif %}{% if python_package_registry is defined and python_package_registry != "PyPI" %}{% raw %}
 echo "!!! In order to install dependencies, you must authenticate into the private registry, so run this script to complete the process: source .devcontainer/manual-setup-deps.sh"{% endraw %}{% endif %}
diff --git a/template/.github/actions/install_deps/action.yml b/template/.github/actions/install_deps/action.yml
index b91d8b33..a995b8fa 100644
--- a/template/.github/actions/install_deps/action.yml
+++ b/template/.github/actions/install_deps/action.yml
@@ -16,8 +16,8 @@ inputs:
     description: Node version to install
     required: false # if this is set, then assume you want node dependencies installed
     default: 'notUsing'
-  package-json-file:
-    description: Relative path to a package.json to read the pnpm version from (its `packageManager` or `devEngines.packageManager` field). When unset, the pnpm version pinned by the template is used instead.
+  working-directory:
+    description: Relative path to the directory holding the package.json to read the pnpm version from (its `packageManager` or `devEngines.packageManager` field). When unset, the pnpm version pinned by the template is used instead.
     required: false
     default: 'notUsing'
   install-deps:
@@ -68,43 +68,52 @@ runs:
       with:
         python-version: ${{ env.PYTHON_VERSION }}
 
-    - name: Check for a pnpm lock file # pnpm/setup can only cache the store when there's a lock file at the repo root to key the cache off of
-      id: pnpm-lock-probe
+    - name: Locate the pnpm project # pnpm/setup keys the store cache off a lock file, so it can only cache when one exists in the directory the project lives in
+      id: pnpm-project
       if: ${{ inputs.node-version != 'notUsing' }}
+      env:
+        WORKING_DIRECTORY: ${{ inputs.working-directory }}
       run: |
-        if [ -f pnpm-lock.yaml ]; then
-          echo "exists=true" >> "$GITHUB_OUTPUT"
+        if [ "$WORKING_DIRECTORY" = "notUsing" ]; then
+          project_dir="."
         else
-          echo "exists=false" >> "$GITHUB_OUTPUT"
+          project_dir="$WORKING_DIRECTORY"
+        fi
+        echo "dir=$project_dir" >> "$GITHUB_OUTPUT"
+        if [ -f "$project_dir/pnpm-lock.yaml" ]; then
+          echo "lock_exists=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "lock_exists=false" >> "$GITHUB_OUTPUT"
         fi
       shell: bash
 
     - name: Setup pnpm and node # this action installs both pnpm and the node runtime, so actions/setup-node is not needed
       if: ${{ inputs.node-version != 'notUsing' }}
-      uses: pnpm/setup@v2.0.2
+      uses: pnpm/setup@v2.1.0
       with:
-        # an empty version makes pnpm/setup read it from package-json-file instead. Passing both a version and a package.json with a conflicting `packageManager` field is a hard error in pnpm/setup.
-        version: ${{ inputs.package-json-file == 'notUsing' && '11.22.0' || '' }}
-        package-json-file: ${{ inputs.package-json-file == 'notUsing' && 'package.json' || inputs.package-json-file }}
+        # an empty version makes pnpm/setup read it from the manifest in working-directory instead. Passing both a version and a package.json with a conflicting `packageManager` field is a hard error in pnpm/setup.
+        version: ${{ inputs.working-directory == 'notUsing' && '12.4.2' || '' }}
+        working-directory: ${{ steps.pnpm-project.outputs.dir }}
+        # cache-dependency-path is left at its default, which is the lock file inside working-directory -- the same one the probe above checks
         runtime: node@${{ inputs.node-version }}
-        cache: ${{ steps.pnpm-lock-probe.outputs.exists }}
+        cache: ${{ steps.pnpm-project.outputs.lock_exists }}
         install: false # dependency installation is handled by manual-setup-deps.py, which knows about every environment in the repo
 
     - name: Install tooling
       # the funky syntax is github action ternary
       # --no-node is always passed because the only node tooling this script installs is pnpm, which pnpm/setup above already installed
-      run: python .devcontainer/install-ci-tooling.py ${{ inputs.python-version == 'notUsing' && '--no-python' || '' }} --no-node ${{ inputs.skip-installing-ssm-plugin-manager && '--skip-installing-ssm-plugin' || '' }}
+      run: python .devcontainer/install-ci-tooling.py ${{ inputs.python-version == 'notUsing' && '--no-python' || '' }} --no-node ${{ inputs.skip-installing-ssm-plugin-manager == 'true' && '--skip-installing-ssm-plugin' || '' }}
       shell: pwsh
 
     - name: OIDC Auth for CodeArtifact
       if: ${{ inputs.code-artifact-auth-role-name != 'no-code-artifact' }}
-      uses: aws-actions/configure-aws-credentials@v6.2.3
+      uses: aws-actions/configure-aws-credentials@v6.3.0
       with:
         role-to-assume: arn:aws:iam::${{ inputs.code-artifact-auth-role-account-id }}:role/${{ inputs.code-artifact-auth-role-name }}
         aws-region: ${{ inputs.code-artifact-auth-region }}
 
     - name: Install dependencies
       # the funky syntax is github action ternary
-      if: ${{ inputs.install-deps }}
-      run: python .devcontainer/manual-setup-deps.py ${{ inputs.python-version == 'notUsing' && '--no-python' || '' }} ${{ inputs.node-version == 'notUsing' && '--no-node' || '' }} ${{ inputs.skip-updating-devcontainer-hash && '--skip-updating-devcontainer-hash' || '' }} ${{ inputs.skip-installing-pulumi-cli && '--skip-installing-pulumi-cli' || '' }}
+      if: ${{ inputs.install-deps == 'true' }}
+      run: python .devcontainer/manual-setup-deps.py ${{ inputs.python-version == 'notUsing' && '--no-python' || '' }} ${{ inputs.node-version == 'notUsing' && '--no-node' || '' }} ${{ inputs.skip-updating-devcontainer-hash == 'true' && '--skip-updating-devcontainer-hash' || '' }} ${{ inputs.skip-installing-pulumi-cli == 'true' && '--skip-installing-pulumi-cli' || '' }}
       shell: pwsh
diff --git a/template/.github/workflows/ci.yaml.jinja b/template/.github/workflows/ci.yaml.jinja
index 5bfedd33..6a19c0c2 100644
--- a/template/.github/workflows/ci.yaml.jinja
+++ b/template/.github/workflows/ci.yaml.jinja
@@ -247,18 +247,16 @@ jobs:
     if: always()
     steps:
       - name: fail if prior job failure
+        # Iterating the needs context keeps this gate from drifting out of sync with the job list above
+        env:
+          NEEDS: ${{ toJSON(needs) }}
         run: |
-          success_pattern="^(skipped|success)$" # these are the possibilities: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#needs-context
+          # these are the possibilities: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#needs-context
+          not_ok=$(jq -r 'to_entries[] | select(.value.result | test("^(skipped|success)$") | not) | .key' <<<"$NEEDS")
 
-          if [[ ! "${{ needs.get-values.result }}" =~ $success_pattern ]] ||
-            [[ ! "${{ needs.check-skip-duplicate.result }}" =~ $success_pattern ]] ||
-            [[ ! "${{ needs.lint.result }}" =~ $success_pattern ]] ||{% endraw %}{% if not deploy_as_executable %}{% raw %}
-            [[ ! "${{ needs.build.result }}" =~ $success_pattern ]] ||{% endraw %}{% endif %}{% if create_docs %}{% raw %}
-            [[ ! "${{ needs.build-docs.result }}" =~ $success_pattern ]] ||{% endraw %}{% endif %}{% raw %}{% endraw %}{% if deploy_as_executable %}{% raw %}
-            [[ ! "${{ needs.executable.result }}" =~ $success_pattern ]] ||{% endraw %}{% endif %}{% raw %}
-            [[ ! "${{ needs.test.result }}" =~ $success_pattern ]] ||
-            [[ ! "${{ needs.confirm-on-tagged-copier-template.result }}" =~ $success_pattern ]]; then
-            echo "❌ One or more jobs did not finish with skipped or success"
+          if [[ -n "$not_ok" ]]; then
+            echo "❌ One or more jobs did not finish with skipped or success:"
+            echo "$not_ok"
             exit 1
           fi
           echo "✅ All jobs finished with skipped or success"
diff --git a/template/.gitignore b/template/.gitignore
index cc7c8b5b..4916f46e 100644
--- a/template/.gitignore
+++ b/template/.gitignore
@@ -123,4 +123,8 @@ dist
 # macOS dev cleanliness
 **/.DS_Store
 
+# Devcontainer
+# The devcontainer CLI writes this lock file to pin feature digests, but we are not using it yet
+.devcontainer/devcontainer-lock.json
+
 # Ignores specific to this repository
diff --git a/template/.pre-commit-config.yaml b/template/.pre-commit-config.yaml
index b9a33c51..288bebb2 100644
--- a/template/.pre-commit-config.yaml
+++ b/template/.pre-commit-config.yaml
@@ -156,6 +156,8 @@ repos:
               .*tsconfig.json|
           )$
       - id: check-yaml
+        # some tools (e.g. pnpm) create multiple-document YAML streams
+        args: [--allow-multiple-documents]
         # .copier-answers.yml is an autogenerated YAML file by Copier that throws 'found unhashable key' errors
         # Helm charts contain other non-YAML markers that cause errors here. they should be checked with helm-lint instead
         # VCRpy cassettes sometimes contain non-YAML markers that cause errors---but they're autogenerated anyway
@@ -173,6 +175,11 @@ repos:
     rev: c4654a7e007c9619a5eb63c39a456572a0fa1851  # frozen: 0.38.0
     hooks:
       - id: check-github-workflows
+      - id: check-jsonschema
+        name: check taskfiles
+        # Task itself silently ignores unknown keys, so a typo'd key is only caught by the schema.
+        args: [--schemafile, 'https://taskfile.dev/schema.json']
+        files: ^(Taskfile\.yaml|(template/)?\.config/taskfiles/[^/{]+\.yaml)$
 
   - repo: https://github.com/maresb/check-json5
     rev: bd4737432a2175617a9eeaa510ab369cbc1cbd3d  # frozen: v1.0.1
@@ -325,6 +332,15 @@ repos:
         pass_filenames: false
         language: system
 
+      - id: task-list
+        # Schema validation cannot see across files: only Task itself resolves the include paths in the root shim and
+        # rejects a task name defined by two flattened includes. Listing is enough to trigger both errors.
+        name: validate taskfile includes and task names
+        entry: bash -c "task --list-all > /dev/null"
+        files: ^(Taskfile\.yaml|\.config/taskfiles/.*)$
+        pass_filenames: false
+        language: system
+
       - id: compute-devcontainer-context-hash
         # Devcontainer context --- this makes Github's "prebuild codespaces" feature work more intelligently for the "Configuration Change" trigger
         name: compute devcontainer context hash
diff --git a/template/AGENTS.md b/template/AGENTS.md
index 21e0aef6..793feddf 100644
--- a/template/AGENTS.md
+++ b/template/AGENTS.md
@@ -78,6 +78,9 @@ This project is a Python library.
 ## Tooling
 
 - ❌ Never chain commands (`&&`, `||`, `;`, `&`) — breaks permission allow-list matcher. ✅ One command per tool call. `cd` as separate prior call. Pipes (`|`) OK.
+- Before hand-assembling a multi-step workflow, run `task --list` — it is probably already a task. Definitions live in `.config/taskfiles/`; the root `Taskfile.yaml` only includes them.
+- The bans on `pnpm --prefix`, `uv --directory` and direct tool invocation apply to commands you type, not to task definitions: a task's commands run with the repo root as their working directory by default. Prefer adding or extending a task over typing the long form.
+- Linting and type-checking stay with `pre-commit run <hook-id>` rather than a task, so that what you run is exactly what CI runs.
 - `cd` into a subdirectory is auto-approved; navigating up (`cd ..`) or to an absolute path (`cd /some/path`) requires a user permission prompt. Minimize such navigation: run `pre-commit` from whichever subdirectory you're already in (it walks up to find `.pre-commit-config.yaml`).
 - ❌ Never use `python3` or `python` directly. ✅ Always use `uv run python` for Python commands.
 - ❌ Never use `python3`/`python` for one-off data tasks. ✅ Use `jq` for JSON parsing, standard shell builtins for string manipulation. Only reach for `uv run python` when no dedicated tool covers the need.
@@ -90,18 +93,20 @@ This project is a Python library.
 - Never use backslash line continuations in shell commands — always write the full command on a single line. Backslashes break the permission allow-list matcher.
 - **Never manually edit files in any `generated/` folder.** These files are produced by codegen tooling (typically Kiota) and any manual changes will be overwritten. If a generated file needs to change, update the source (e.g. the OpenAPI schema) and re-run the generator.
 - Leave `import` statement ordering and unused-import removal to pre-commit — don't edit them yourself.
+- In GitHub Codespaces, the injected `GITHUB_TOKEN` is a repo-scoped app token, so `gh`/`git` cannot reach other repos in the org. It lives in the container process environment (not any dotfile), so `unset` inside a Bash tool call does not persist. To grant broader access, ask the user to run `env -u GITHUB_TOKEN -u GH_TOKEN gh auth login --hostname github.com --git-protocol https --web` in their shell (the `--web` flags are required — `gh auth login` alone needs a TTY that the Bash tool does not provide, and it refuses to store credentials while `GITHUB_TOKEN` is set). Afterwards, prefix your own `gh`/`git` calls with `env -u GITHUB_TOKEN -u GH_TOKEN` so they use the stored GitHub CLI credentials instead of the app token — `GH_TOKEN` also has to be cleared because `gh` gives it precedence over both `GITHUB_TOKEN` and stored credentials. Where those credentials live depends on the environment (`gh` prefers the OS credential store and the config dir follows `GH_CONFIG_DIR`), but in these devcontainers they usually land in plain text at `~/.config/gh/hosts.yml`; `gh auth status` reports the active source.
 
 <!-- BEGIN BEADS INTEGRATION -->
-## Issue Tracking with bd (beads)
+## Work Tracking with bd (beads)
 
-**IMPORTANT**: This project uses **bd (beads)** for ALL issue tracking. Do NOT use markdown TODOs, task lists, or other tracking methods.
+**IMPORTANT**: Use **bd (beads)** to break down and track your own work while implementing a ticket. Within a working session it is the only place to track that breakdown — do NOT use markdown TODOs, task lists, or other scratch tracking methods.
+
+bd is not the team's ticket tracker. It is a local tool for a developer and an AI agent working together: `bd init --stealth` adds `.beads/` to `.git/info/exclude`, so neither the database nor its JSONL export is committed, and nothing recorded in bd is visible to reviewers, teammates, or CI. The ticket a session is implementing lives in whatever system the team owning the repository uses — GitHub Issues, Jira, Linear, or something else.
 
 ### Why bd?
 
-- Dependency-aware: Track blockers and relationships between issues
-- Git-friendly: Auto-syncs to JSONL for version control
+- Dependency-aware: Track blockers and relationships between the pieces of work in a session
 - Agent-optimized: JSON output, ready work detection, discovered-from links
-- Prevents duplicate tracking systems and confusion
+- Keeps session breakdown out of the team's ticket tracker, and out of the codebase
 
 ### Quick Start
 
@@ -115,20 +120,20 @@ bd ready --json
 
 ```bash
 bd create "Issue title" --description="Detailed context" -t bug|feature|task -p 0-4 --json
-bd create "Issue title" --description="What this issue is about" -p 1 --deps discovered-from:bd-123 --json
+bd create "Issue title" --description="What this issue is about" -p 1 --deps discovered-from:<parent-id> --json
 ```
 
 **Claim and update:**
 
 ```bash
-bd update bd-42 --status in_progress --json
-bd update bd-42 --priority 1 --json
+bd update <id> --status in_progress --json
+bd update <id> --priority 1 --json
 ```
 
 **Complete work:**
 
 ```bash
-bd close bd-42 --reason "Completed" --json
+bd close <id> --reason "Completed" --json
 ```
 
 **Creating human readable file:**
@@ -145,6 +150,7 @@ bd export -o [relative path to repository root]/.claude/.beads/issues-dump.jsonl
 - `task` - Work item (tests, docs, refactoring)
 - `epic` - Large feature with subtasks
 - `chore` - Maintenance (dependencies, tooling)
+- `decision` - An architectural decision (aliases: `dec`, `adr`)
 
 ### Priorities
 
@@ -166,15 +172,15 @@ bd export -o [relative path to repository root]/.claude/.beads/issues-dump.jsonl
 
 ### Important Rules
 
-- ✅ Use bd for ALL task tracking
+- ✅ Use bd for ALL tracking of your own work within a session
 - ✅ Always use `--json` flag for programmatic use
 - ✅ Link discovered work with `discovered-from` dependencies
 - ✅ Check `bd ready` before asking "what should I work on?"
-- ❌ Do NOT create markdown TODO lists
-- ❌ Do NOT use external issue trackers
-- ❌ Do NOT duplicate tracking systems
+- ❌ Do NOT create markdown TODO lists to track session work
+- ❌ Do NOT stand up a second scratch tracking system alongside bd
+- ❌ Do NOT propose bd for work that needs tracking beyond the session — a bd issue is invisible to everyone else. Suggest a code comment, or a ticket in the team's own tracker, and do not assume which tracker that is
 
-For more details, see README.md and docs/QUICKSTART.md.
+For more details, run `bd quickstart` or see <https://github.com/gastownhall/beads>.
 
 # Copier-Managed Files
 
diff --git a/template/README.md.jinja b/template/README.md.jinja
index 21a3ded1..13938c53 100644
--- a/template/README.md.jinja
+++ b/template/README.md.jinja
@@ -23,6 +23,9 @@
 Documentation is hosted on [ReadTheDocs](https://{% endraw %}{{ package_name }}{% raw %}.readthedocs.io/en/latest/?badge=latest).
 
 # Development
+
+Multi-step workflows are defined as [Task](https://taskfile.dev) tasks. Run `task --list` to see them; the definitions live in `.config/taskfiles/`, and `Taskfile.yaml` in the repo root is only a shim that includes them.
+
 This project has a dev container. If you already have VS Code and Docker installed, you can click the badge above or [here](https://vscode.dev/redirect?url=vscode://ms-vscode-remote.remote-containers/cloneInVolume?url={% endraw %}{{ full_repo_url }}{% raw %}) to get started. Clicking these links will cause VS Code to automatically install the Dev Containers extension if needed, clone the source code into a container volume, and spin up a dev container for use.
 
 {% endraw %}{% if not deploy_as_executable %}{% raw %}To publish a new version of the repository, you can run the `Publish` workflow manually and publish to the staging registry from any branch, and you can check the 'Publish to Primary' option when on `main` to publish to the primary registry and create a git tag.
@@ -37,5 +40,4 @@ This project has a dev container. If you already have VS Code and Docker install
 
 
 ## Updating from the template
-This repository uses a copier template. To pull in the latest updates from the template, use the command:
-`copier update --answers-file .config/.copier-answers.yml --trust --conflict rej --defaults`{% endraw %}
+This repository uses a copier template. To pull in the latest updates from the template, run `task copier-update`{% endraw %}
diff --git a/template/Taskfile.yaml.jinja b/template/Taskfile.yaml.jinja
new file mode 100644
index 00000000..acf1ccfb
--- /dev/null
+++ b/template/Taskfile.yaml.jinja
@@ -0,0 +1,9 @@
+{% raw %}# Task definitions live in .config/taskfiles/ next to the other tool configs so the repo root stays uncluttered.
+# This shim exists because Task cannot be pointed at a config directory: auto-discovery covers only Taskfile.yml, taskfile.yml, Taskfile.yaml, taskfile.yaml and their .dist variants in the current directory walking up through parents, no environment variable sets the Taskfile path (https://github.com/go-task/task/issues/1721 requested one and was closed as a duplicate on 2025-12-10 with no linked replacement and no implementation), and requiring -t/--taskfile on every call would break both the ergonomics and the Claude Code bash permission matcher.
+# Every include is flattened so that no task name contains a colon: Task's ':' namespace separator is not configurable and Claude Code cannot match a ':*' permission pattern (see .claude/settings/permissions/bash.jsonc). Flattened names share one global namespace, so a collision between two included files is a hard error rather than a silent shadow, and names are prefixed by hand (build-frontend) instead of namespaced (frontend:build).
+version: '3'
+
+includes:
+  copier:
+    taskfile: ./.config/taskfiles/copier-template.yaml
+    flatten: true{% endraw %}
diff --git a/template/scripts/delete_false_positive_rej.py b/template/scripts/delete_false_positive_rej.py
old mode 100644
new mode 100755
diff --git a/tests/unit/copier_tasks/helpers.py b/tests/unit/copier_tasks/helpers.py
index 2c6d7701..4b3da80d 100644
--- a/tests/unit/copier_tasks/helpers.py
+++ b/tests/unit/copier_tasks/helpers.py
@@ -19,6 +19,8 @@ def run_copier_task(
     script_path: Path,
     *args: str,
     env: dict[str, str] | None = None,
+    # bounded so a runaway traversal fails the test rather than wedging the runner
+    timeout: float = 60,
 ) -> subprocess.CompletedProcess[str]:
     return subprocess.run(  # noqa: S603 -- these are our own scripts
         [sys.executable, str(script_path), *args],
@@ -26,4 +28,5 @@ def run_copier_task(
         capture_output=True,
         text=True,
         env=env,
+        timeout=timeout,
     )
diff --git a/tests/unit/copier_tasks/test_copier_provenance.py b/tests/unit/copier_tasks/test_copier_provenance.py
index 639bd879..9011a011 100644
--- a/tests/unit/copier_tasks/test_copier_provenance.py
+++ b/tests/unit/copier_tasks/test_copier_provenance.py
@@ -184,6 +184,48 @@ def test_jinja_if_check_directory_matched(self, tmp_path: Path) -> None:
         assert content.startswith(expected_hash_comment)
 
 
+class TestWhenTaskRunAgainstDestination:
+    def test_Given_symlink_cycle__Then_managed_file_stamped(self, tmp_path: Path) -> None:
+        # Two links back to the root rather than one: a single link is bounded by the kernel's ELOOP
+        # limit, so it would terminate on its own and catch no regression.
+        template_dir = tmp_path / "template"
+        template_dir.mkdir()
+        (template_dir / "README.md.jinja-base").touch()
+
+        dst_dir = tmp_path / "destination"
+        node_modules = dst_dir / "node_modules"
+        node_modules.mkdir(parents=True)
+        (node_modules / "pkg-a").symlink_to(dst_dir, target_is_directory=True)
+        (node_modules / "pkg-b").symlink_to(dst_dir, target_is_directory=True)
+        file_content = "some content\n"
+        _ = (dst_dir / "README.md").write_text(file_content, encoding="utf-8")
+
+        _ = _run_script(src_template_dir=template_dir, dst_dir=dst_dir)
+
+        content = (dst_dir / "README.md").read_text(encoding="utf-8")
+        assert content == file_content + "\n" + expected_markdown_comment + "\n"
+
+    def test_Given_broken_symlink_at_managed_path__Then_path_skipped(self, tmp_path: Path) -> None:
+        template_dir = tmp_path / "template"
+        template_dir.mkdir()
+        (template_dir / "config.yaml.jinja-base").touch()
+        (template_dir / "keep.yaml.jinja-base").touch()
+
+        dst_dir = tmp_path / "destination"
+        dst_dir.mkdir()
+        broken = dst_dir / "config.yaml"
+        broken.symlink_to(dst_dir / "does-not-exist.yaml")
+        _ = (dst_dir / "keep.yaml").write_text("key: value\n", encoding="utf-8")
+        assert broken.is_symlink()
+
+        _ = _run_script(src_template_dir=template_dir, dst_dir=dst_dir)
+
+        manifest = _read_manifest(dst_dir)
+
+        assert (dst_dir / "keep.yaml").read_text(encoding="utf-8").startswith(expected_hash_comment)
+        assert manifest["templates"][0]["managed_files"] == ["keep.yaml"]
+
+
 class TestFileExtensionComments:
     @pytest.mark.parametrize(
         ("filename", "expected_location", "expected_comment"),
diff --git a/uv.lock b/uv.lock
index e3d2960f..f10339af 100644
--- a/uv.lock
+++ b/uv.lock
@@ -22,7 +22,7 @@ wheels = [
 
 [[package]]
 name = "copier"
-version = "9.17.1"
+version = "9.18.2"
 source = { registry = "https://pypi.org/simple/" }
 dependencies = [
     { name = "colorama" },
@@ -39,9 +39,9 @@ dependencies = [
     { name = "pyyaml" },
     { name = "questionary" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/40/65/11c8635a27ce06ef525946bb02b1d5271b0f11e5acf9c5ab6d242512598e/copier-9.17.1.tar.gz", hash = "sha256:778e85f1c2de86824a72ddf4a34140744921d6354450c427c4c8a475371b1bda", size = 647338, upload-time = "2026-08-04T09:15:04.826Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f9/60/2fe1777b27f489450ed8ac5c75390caf91a175d647be05b4284bf515b413/copier-9.18.2.tar.gz", hash = "sha256:0f97902fee79374551c9391fb1132f5a038079f3b497f4dad673295489fc032e", size = 669824, upload-time = "2026-09-07T13:14:38.435Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7f/bf/3adcb9b3091b36de729dad91c107179c8c7c51adb2b08c31177bb540bef1/copier-9.17.1-py3-none-any.whl", hash = "sha256:f6a48f296e2e536c635213e1000ea71099f9f58f3b464a60f2f0fd386e343628", size = 66364, upload-time = "2026-08-04T09:15:03.026Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/2a/854d86eb28ced1c4ade3d8c83bdc7ba529ac5df6c80b5d5202a090244d7a/copier-9.18.2-py3-none-any.whl", hash = "sha256:ef0e1b09dece031b09085f2aa637bdc3d5952b98d96b986feaa45a8f3a00d2c6", size = 68113, upload-time = "2026-09-07T13:14:36.934Z" },
 ]
 
 [[package]]
@@ -60,13 +60,13 @@ dependencies = [
 
 [package.metadata]
 requires-dist = [
-    { name = "copier", specifier = "==9.17.1" },
+    { name = "copier", specifier = "==9.18.2" },
     { name = "copier-template-extensions", specifier = "==0.3.3" },
-    { name = "faker", specifier = ">=40.36.0" },
-    { name = "pyrefly", specifier = ">=1.2.0" },
+    { name = "faker", specifier = ">=40.39.0" },
+    { name = "pyrefly", specifier = ">=1.3.1" },
     { name = "pytest", specifier = ">=9.1.1" },
     { name = "pytest-cov", specifier = ">=7.1.0" },
-    { name = "pytest-randomly", specifier = ">=4.1.0" },
+    { name = "pytest-randomly", specifier = ">=5.0.0" },
 ]
 
 [[package]]
@@ -159,14 +159,14 @@ wheels = [
 
 [[package]]
 name = "faker"
-version = "40.36.0"
+version = "40.39.0"
 source = { registry = "https://pypi.org/simple/" }
 dependencies = [
     { name = "tzdata", marker = "sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/98/d2/026af1e002bbc6df534d1f8262b18ec79a974f928e9290bfbfdfe7c7b2af/faker-40.36.0.tar.gz", hash = "sha256:754048c76c03afa7de83eee8f4bcee3cf668cbb7d995f54a4e9678db7f110308", size = 2025903, upload-time = "2026-07-24T21:11:33.088Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/6d/62/fea935af7a312f073c99d470b05a7c96650ee8d9562ce82e8cb7ee4c1247/faker-40.39.0.tar.gz", hash = "sha256:52799ad96fcf92aab2fc96a9e03869bbf1a634300f7cd91c38dbfd51f639f6fa", size = 2029463, upload-time = "2026-09-14T16:50:17.939Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/50/9a/b947ed175ce9a0dcb070ccf3607f0ce8720cfb5ed1a36166a150b2acd5af/faker-40.36.0-py3-none-any.whl", hash = "sha256:82b9497d9cfe017048075bcf969298a74b1b6e39f5e4dad1211085d1133f7b62", size = 2062829, upload-time = "2026-07-24T21:11:31.37Z" },
+    { url = "https://files.pythonhosted.org/packages/45/c8/901282279841ebb59216433be01aac825fb905e1a597de3b7b5ab8b0c43e/faker-40.39.0-py3-none-any.whl", hash = "sha256:c4c7ec2cddfaf602c5a8a2c960614946aa8c161250bd9d49a8846cd24d1ef028", size = 2066232, upload-time = "2026-09-14T16:50:16.061Z" },
 ]
 
 [[package]]
@@ -374,21 +374,21 @@ wheels = [
 
 [[package]]
 name = "pyrefly"
-version = "1.2.0"
+version = "1.3.1"
 source = { registry = "https://pypi.org/simple/" }
-sdist = { url = "https://files.pythonhosted.org/packages/89/01/a86e9f24722b095c3f88e3616132b75a21b0df53804bdc6a45314dd4d93c/pyrefly-1.2.0.tar.gz", hash = "sha256:5485f960fc2481617068c918335c39ab1507ef90b6b5bd35bf57726e60e73185", size = 6243654, upload-time = "2026-08-01T02:56:27.592Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/4c/7e/082cc1b392318bacfbc087732524f3e089e9e7fe45b7645c4649b6f1f1e9/pyrefly-1.3.1.tar.gz", hash = "sha256:b774f1dfac82867fc16fe2175d80a630e2a72a6835d5b7e492568d6bfb6b05e7", size = 6679145, upload-time = "2026-09-15T05:09:34.49Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7d/9d/3c0ef1d4843987b22f996ed381ec9cf5a3b1273e29804db276252e4c95eb/pyrefly-1.2.0-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:7f46d983ac49ddd2b043694960a01dc6a19a5cfd8eec609d6bd9c42866f91b4e", size = 14026305, upload-time = "2026-08-01T02:56:02.611Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/06/03bbb78fbea54cdc65b626619f3597d5611aca4fdef11e72a4e8360e7e63/pyrefly-1.2.0-py3-none-macosx_11_0_arm64.whl", hash = "sha256:756f669b5555090f5c1a4fef30db1785fabe657764f7e4e6dc88994dfb8ca82d", size = 13463880, upload-time = "2026-08-01T02:56:04.93Z" },
-    { url = "https://files.pythonhosted.org/packages/13/5a/7d8bc00a38e93bbc9c3e7bd14d305f7948717e667c9bcddeab9dd42fd255/pyrefly-1.2.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e3465812ce5ef4781fb592edbf2724547296f0a3124be115d73c7e8b2401862d", size = 13907329, upload-time = "2026-08-01T02:56:07.104Z" },
-    { url = "https://files.pythonhosted.org/packages/be/94/9e08b4bf799d0b8f36b55a2783c7ba5f51730cf0632a85a67b5b5ed876cd/pyrefly-1.2.0-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:5de7b2ad2bba5c8055181681a84b74143eac2234a48ba5d1b7ed7e7a722b02bd", size = 15039020, upload-time = "2026-08-01T02:56:09.208Z" },
-    { url = "https://files.pythonhosted.org/packages/5b/bd/bca5fd0c80f4daf8ee6903a29df9f3de1feb05ff0946b8f35ec8c5096b13/pyrefly-1.2.0-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:25822ea9505f589ea8a725e4268b475132fb89e038fbf092e446510443ac142a", size = 14986199, upload-time = "2026-08-01T02:56:11.924Z" },
-    { url = "https://files.pythonhosted.org/packages/97/f7/f07087f3d185ad2eced0c56cef89ca5474dfb4ff25f146cd50a861c97553/pyrefly-1.2.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:90efe75e17491ef5d636e10469e9278d7d0256b3b4c5e1f4750069bf3ae0f5d1", size = 14393715, upload-time = "2026-08-01T02:56:14.143Z" },
-    { url = "https://files.pythonhosted.org/packages/d3/70/0d142c320e284b9e3ce35e9b1e58b8ce2ee1f578f2a7234bc30e5022b94f/pyrefly-1.2.0-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:368aaf7eee4f511ddc0f8e564cf14e01ab2f10b0db9105c6d5b153bf498d07bf", size = 13933008, upload-time = "2026-08-01T02:56:16.525Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/e8/e84f11b6e1f63fd453ad3654213b9a0f6f4de8cef6b58038eef2d0d5955d/pyrefly-1.2.0-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:d52d5da7bc65fb7675fbaa80eda879d4f8787c494f04cac21603330d3abbdbbe", size = 14431827, upload-time = "2026-08-01T02:56:18.645Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/06/810d31380f66c75e1c0779a408d3b16117b1b368b57894f6aa66bef21686/pyrefly-1.2.0-py3-none-win32.whl", hash = "sha256:8c90751de8506d938e8f802659c74cf35bd7a0036510ee6c634a38eebb280bfa", size = 13229447, upload-time = "2026-08-01T02:56:20.921Z" },
-    { url = "https://files.pythonhosted.org/packages/ed/98/4dafa3c7a1caed2dc8cc708dde09ba27963c7736508f55b626fff3024113/pyrefly-1.2.0-py3-none-win_amd64.whl", hash = "sha256:8a8964c224ccc4882730130955815de21ff443c1ac3f0b90685b19bf63848170", size = 14087387, upload-time = "2026-08-01T02:56:23.188Z" },
-    { url = "https://files.pythonhosted.org/packages/1b/1c/df3cb0a2e5591660ded7a1836cd2f29dc48c91adb1c0a3a700a96f6d09e1/pyrefly-1.2.0-py3-none-win_arm64.whl", hash = "sha256:3a90bb8df39dfbac74b1f3b2e9d7c526b8f80568884c3944d955023a73ebf61e", size = 13430873, upload-time = "2026-08-01T02:56:25.425Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/bc/f09b5bd7eed796349bd93627aa2c3086df7ed0a114dafc3d2b2841599ee7/pyrefly-1.3.1-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:0a2a7dfed824fb066aa8a7c8d856c152b98e998fb84b954d5f892fb9834c0bd1", size = 15090117, upload-time = "2026-09-15T05:08:58.477Z" },
+    { url = "https://files.pythonhosted.org/packages/78/24/a31e7de8e0f310c9f0753826d0df8b6a8ff86793941a6bd88ba24b735633/pyrefly-1.3.1-py3-none-macosx_11_0_arm64.whl", hash = "sha256:37a1a1fb41e7190fe3964a877875dd809d6ee2887809e2c3d6e5f25a69805bfd", size = 14430773, upload-time = "2026-09-15T05:09:01.67Z" },
+    { url = "https://files.pythonhosted.org/packages/75/e1/022352beb186f36d6213a95a975c42676ee418ff5e730629378d25564c5e/pyrefly-1.3.1-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:45b7650bc651a5a784701f2fb4f579da9a421c4d1b5fd91f9048f4529e46093c", size = 14877762, upload-time = "2026-09-15T05:09:04.767Z" },
+    { url = "https://files.pythonhosted.org/packages/19/2c/d62a1b445aad1fd46375b83393b8a67da53883aeeba73d269ce71b3e8fd1/pyrefly-1.3.1-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ad57f38bc73679c14a5f62995a2bd3bc43649b7270c858487e2eab78a6f95362", size = 16118225, upload-time = "2026-09-15T05:09:07.828Z" },
+    { url = "https://files.pythonhosted.org/packages/32/67/3c3fa8a13e3ce8d8322ffb3627255a41a52261f17793e1a24e9214f10857/pyrefly-1.3.1-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3506b1252e9f5d755d0693c5a46d46b85579d36534f6e22a41eb8e098d0dde90", size = 16051197, upload-time = "2026-09-15T05:09:10.81Z" },
+    { url = "https://files.pythonhosted.org/packages/19/d1/84f81b9e32288b5d11c75e006f67e0f6b78b85da575673bd1a21524c8172/pyrefly-1.3.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:39d5a17c1ad655e5f93a6e8e0be90b8db28c6015fe07d6ed4e054891c9e14ef8", size = 15440062, upload-time = "2026-09-15T05:09:14.641Z" },
+    { url = "https://files.pythonhosted.org/packages/46/3c/2aa0c5ad6a2957a728bb38cfab70d1e9cafad21b0b1c1d92df74a3cf22bd/pyrefly-1.3.1-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:c61e9dcf888beb81ca0e0c60ea4442640fdcf2f1f65bfe3d9f5d89b85516eb03", size = 14898534, upload-time = "2026-09-15T05:09:17.823Z" },
+    { url = "https://files.pythonhosted.org/packages/03/5d/2974f249fb2e285f966485719d977c5a2248cc4866403af94d935775ff15/pyrefly-1.3.1-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:a78eed1c53f37807f0e2997be8edbe833b91eb9915f2cb553a1bdcd599e7105c", size = 15477758, upload-time = "2026-09-15T05:09:20.964Z" },
+    { url = "https://files.pythonhosted.org/packages/68/79/d31f8f0abf5b0610ec24183286ee8a1ee5b76c9aaaa91091399d7e1aaf60/pyrefly-1.3.1-py3-none-win32.whl", hash = "sha256:ea0d0349f1bc80fe8e00a7b3640e40db7486398b685f87b9bd5d2207063668f0", size = 14133005, upload-time = "2026-09-15T05:09:25.03Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/23/1859f47f536314755d80c4ec2a76d2698435ae8b73604bcd1dfa57ecb39b/pyrefly-1.3.1-py3-none-win_amd64.whl", hash = "sha256:4c24e7d99df9237916c33be23714219a7c8eaf22bad2ac0c3e1d45adcf7df8fb", size = 15066557, upload-time = "2026-09-15T05:09:28.265Z" },
+    { url = "https://files.pythonhosted.org/packages/92/2a/73e3721921c2bb2c950a9f8c362ee5e2367556b5d4416eb4f8f88503e66f/pyrefly-1.3.1-py3-none-win_arm64.whl", hash = "sha256:1ed85e2b957a78e93353125d890ce3668ce450e49b74025a15c87b6e8ec7f3d1", size = 14348209, upload-time = "2026-09-15T05:09:31.422Z" },
 ]
 
 [[package]]
@@ -423,14 +423,14 @@ wheels = [
 
 [[package]]
 name = "pytest-randomly"
-version = "4.1.0"
+version = "5.0.0"
 source = { registry = "https://pypi.org/simple/" }
 dependencies = [
     { name = "pytest" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/27/b3/36192dacc0f470ac2cc516f73e01739c9a48a8224f76beada4f85e1c8a89/pytest_randomly-4.1.0.tar.gz", hash = "sha256:47f1d9746c3bc3efabd53ae1ebfb8bb385cf3d4df4b505b6d58d9c97a3dfe70f", size = 14302, upload-time = "2026-04-20T13:01:51.831Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/01/3b/6a40e1b9d925651e601e056a97f60d8a1daeddeac03d5609be60cb4362ce/pytest_randomly-5.0.0.tar.gz", hash = "sha256:e9c575a5873ef168ddbe340ed9e97ce9edb4492ccc821e4b2ac6bb1f0ed515d2", size = 8542, upload-time = "2026-09-01T22:34:20.441Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/9a/db/2df9a1fca597a273f957a559c20c2d95d629928384507b2afa43ba6909d1/pytest_randomly-4.1.0-py3-none-any.whl", hash = "sha256:f55e89e53367b090c0c053697d7f9d77595543d0e0516c93978b50c0f6b252f9", size = 8353, upload-time = "2026-04-20T13:01:50.382Z" },
+    { url = "https://files.pythonhosted.org/packages/10/b4/47e939285caad9a623d021512912ac08dc92a467ad075d179f43729d2934/pytest_randomly-5.0.0-py3-none-any.whl", hash = "sha256:8a0d4703115c0c25b38b6e129fc16b1947b9643ff26a41bc1d185d7e5a7689c1", size = 8920, upload-time = "2026-09-01T22:34:19.227Z" },
 ]
 
 [[package]]