diff --git a/.gitignore b/.gitignore
index 9ded2ea..eaae021 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,6 @@ coverage/
 # cli-backend agent sandboxes — runtime scratch only (keep the dir + its README)
 /workspaces/*
 !/workspaces/README.md
+
+# working-code workspace — cloned target repos agents inspect/modify (ENG-013); never committed
+/workspace/
diff --git a/apps/server/src/app.ts b/apps/server/src/app.ts
index a958a53..6b20b71 100644
--- a/apps/server/src/app.ts
+++ b/apps/server/src/app.ts
@@ -1,4 +1,6 @@
+import { listBudgets, listPendingApprovals, resolveApproval } from "@eng/db"
 import { Hono } from "hono"
+import { type AppEnv, authMiddleware } from "./auth"
 import { persistenceFromEnv } from "./persistence"
 import { artifactPath, SHAPING_STAGES } from "./shaping"
 import {
@@ -16,35 +18,22 @@ import {
  */
 const persistence = persistenceFromEnv()
 
-export const app = new Hono()
+export const app = new Hono<AppEnv>()
 
 app.onError((err, c) => c.json({ error: String(err) }, 500))
 
 app.get("/health", (c) => c.json({ ok: true }))
 
+// Auth gate (ENG-004): GET read views stay open; mutating /api requests require a Bearer token when
+// API_AUTH_TOKEN is set. The resolved principal is recorded on approval events below.
+app.use("/api/*", authMiddleware())
+
 app.get("/api/tickets", async (c) => c.json({ tickets: await persistence.tracker.list() }))
 app.get("/api/audit", async (c) => c.json({ events: await persistence.audit.query() }))
-// Pending human gates, derived from the audit log. A roadmap sign-off is pending when the latest
-// roadmap-lifecycle event for an epic is `roadmap_requested` (not yet approved/decomposed).
-app.get("/api/approvals", async (c) => {
-  const events = await persistence.audit.query()
-  const seen = new Set<string>()
-  const pending: { epicId: string; kind: string; at: string }[] = []
-  for (const e of events) {
-    const epicId = typeof e.payload?.epicId === "string" ? (e.payload.epicId as string) : null
-    if (!epicId || seen.has(epicId)) continue
-    if (
-      e.kind === "roadmap_requested" ||
-      e.kind === "roadmap_approved" ||
-      e.kind === "epic_decomposed" ||
-      e.kind === "decomposition_skipped"
-    ) {
-      seen.add(epicId)
-      if (e.kind === "roadmap_requested") pending.push({ epicId, kind: "roadmap", at: e.at })
-    }
-  }
-  return c.json({ approvals: pending })
-})
+// Pending human gates as first-class records (ENG-006): roadmap · pr_merge · deploy.
+app.get("/api/approvals", async (c) => c.json({ approvals: await listPendingApprovals() }))
+// Per-role budget/cost view for the dashboard (ENG-010).
+app.get("/api/budgets", async (c) => c.json({ budgets: await listBudgets() }))
 
 // Goal hierarchy authoring (through the persistence port, so the backend is swappable). Lets the
 // human/PM decompose work under multiple goals + epics; tickets then target a chosen epic.
@@ -105,7 +94,16 @@ app.post("/api/epics/:id/decompose", async (c) => {
 app.post("/api/epics/:id/approve-roadmap", async (c) => {
   const id = c.req.param("id")
   const signaled = await approveRoadmap(id)
-  return c.json({ epicId: id, gate: "roadmap", signaled })
+  const by = c.get("actor")
+  // Resolve the first-class approval record (ENG-006) + audit who released the gate (ENG-004).
+  await resolveApproval({ kind: "roadmap", epicId: id, decidedBy: by })
+  await persistence.audit.append({
+    actor: "human",
+    kind: "approval_decided",
+    ticketId: null,
+    payload: { epicId: id, gate: "roadmap", by, signaled },
+  })
+  return c.json({ epicId: id, gate: "roadmap", signaled, by })
 })
 
 // Create a ticket through the tracker under a chosen epic (or seed the default Mission→Goal→Epic
@@ -144,5 +142,18 @@ app.post("/api/tickets/:id/approve", async (c) => {
   const body = (await c.req.json().catch(() => ({}))) as { gate?: "merge" | "deploy" }
   const gate = body.gate === "deploy" ? "deploy" : "merge"
   await approveTicket(id, gate)
-  return c.json({ ticketId: id, gate, signaled: true })
+  const by = c.get("actor")
+  // Resolve the first-class approval record (ENG-006) + audit who released the gate (ENG-004).
+  await resolveApproval({
+    kind: gate === "deploy" ? "deploy" : "pr_merge",
+    ticketId: id,
+    decidedBy: by,
+  })
+  await persistence.audit.append({
+    actor: "human",
+    kind: "approval_decided",
+    ticketId: id,
+    payload: { gate, by },
+  })
+  return c.json({ ticketId: id, gate, signaled: true, by })
 })
diff --git a/apps/server/src/auth.test.ts b/apps/server/src/auth.test.ts
new file mode 100644
index 0000000..f44bcbd
--- /dev/null
+++ b/apps/server/src/auth.test.ts
@@ -0,0 +1,70 @@
+import { Hono } from "hono"
+import { afterEach, beforeEach, describe, expect, it } from "vitest"
+import { type AppEnv, authMiddleware, checkAuth } from "./auth"
+
+describe("checkAuth", () => {
+  it("allows dev mode (principal 'dev') when no token is configured", () => {
+    expect(checkAuth({}, undefined)).toEqual({ ok: true, principal: "dev" })
+  })
+
+  it("accepts a correct Bearer token and defaults the principal to 'operator'", () => {
+    const r = checkAuth({ authorization: "Bearer s3cret" }, "s3cret")
+    expect(r).toEqual({ ok: true, principal: "operator" })
+  })
+
+  it("honors the X-Actor header as the principal", () => {
+    const r = checkAuth({ authorization: "Bearer s3cret", actor: "toby" }, "s3cret")
+    expect(r).toEqual({ ok: true, principal: "toby" })
+  })
+
+  it("rejects a missing or wrong token", () => {
+    expect(checkAuth({}, "s3cret").ok).toBe(false)
+    expect(checkAuth({ authorization: "Bearer nope" }, "s3cret").ok).toBe(false)
+    expect(checkAuth({ authorization: "s3cret" }, "s3cret").ok).toBe(false) // missing "Bearer "
+  })
+})
+
+describe("authMiddleware", () => {
+  const prev = process.env.API_AUTH_TOKEN
+  let app: Hono<AppEnv>
+
+  beforeEach(() => {
+    app = new Hono<AppEnv>()
+    app.use("/api/*", authMiddleware())
+    app.get("/api/thing", (c) => c.json({ actor: c.get("actor") }))
+    app.post("/api/thing", (c) => c.json({ actor: c.get("actor") }))
+  })
+  afterEach(() => {
+    if (prev === undefined) delete process.env.API_AUTH_TOKEN
+    else process.env.API_AUTH_TOKEN = prev
+  })
+
+  it("leaves GET read views open", async () => {
+    process.env.API_AUTH_TOKEN = "s3cret"
+    const res = await app.request("/api/thing")
+    expect(res.status).toBe(200)
+  })
+
+  it("401s an unauthenticated mutation when a token is configured", async () => {
+    process.env.API_AUTH_TOKEN = "s3cret"
+    const res = await app.request("/api/thing", { method: "POST" })
+    expect(res.status).toBe(401)
+  })
+
+  it("allows an authenticated mutation and exposes the principal", async () => {
+    process.env.API_AUTH_TOKEN = "s3cret"
+    const res = await app.request("/api/thing", {
+      method: "POST",
+      headers: { authorization: "Bearer s3cret", "x-actor": "toby" },
+    })
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ actor: "toby" })
+  })
+
+  it("allows mutations in dev mode when no token is configured", async () => {
+    delete process.env.API_AUTH_TOKEN
+    const res = await app.request("/api/thing", { method: "POST" })
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ actor: "dev" })
+  })
+})
diff --git a/apps/server/src/auth.ts b/apps/server/src/auth.ts
new file mode 100644
index 0000000..c1a22a3
--- /dev/null
+++ b/apps/server/src/auth.ts
@@ -0,0 +1,78 @@
+import { timingSafeEqual } from "node:crypto"
+import type { MiddlewareHandler } from "hono"
+
+/**
+ * API authentication (ENG-004). The approval gates are the product's core value (invariant #4), so
+ * mutating requests must be authenticated and the deciding principal recorded. Auth activates when
+ * `API_AUTH_TOKEN` is set; when it isn't, the server runs in an open "dev mode" (and warns loudly at
+ * startup) so the local `docker compose up` quickstart keeps working — set the token to enforce.
+ */
+
+/** Hono environment: the authenticated principal attributed to writes (audit identity). */
+export type AppEnv = { Variables: { actor: string } }
+
+const ACTOR_HEADER = "x-actor"
+
+export interface AuthResult {
+  ok: boolean
+  /** Who to attribute the write to in the audit log. */
+  principal: string
+}
+
+function safeEqual(a: string, b: string): boolean {
+  const ab = Buffer.from(a)
+  const bb = Buffer.from(b)
+  if (ab.length !== bb.length) return false
+  return timingSafeEqual(ab, bb)
+}
+
+/**
+ * Decide whether a request is authorized and who the principal is. Pure + header-driven for testing.
+ * - No configured token → dev mode: allowed, principal `dev`.
+ * - Configured token → requires `Authorization: Bearer <token>`; principal from `X-Actor`
+ *   (default `operator`). A bad/missing token → not ok.
+ */
+export function checkAuth(
+  headers: { authorization?: string | null; actor?: string | null },
+  configuredToken: string | undefined,
+): AuthResult {
+  if (!configuredToken) return { ok: true, principal: "dev" }
+  const match = /^Bearer\s+(.+)$/i.exec((headers.authorization ?? "").trim())
+  const token = match?.[1]
+  if (!token || !safeEqual(token, configuredToken)) {
+    return { ok: false, principal: "anonymous" }
+  }
+  const actor = (headers.actor ?? "").trim()
+  return { ok: true, principal: actor || "operator" }
+}
+
+/**
+ * Hono middleware enforcing auth on mutating requests. GET (read views) and `/health` stay open; any
+ * non-GET request requires auth when a token is configured. The resolved principal is stored on the
+ * context for handlers to attribute approvals/writes to.
+ */
+export function authMiddleware(): MiddlewareHandler<AppEnv> {
+  return async (c, next) => {
+    if (c.req.method === "GET") {
+      c.set("actor", "anonymous")
+      return next()
+    }
+    const result = checkAuth(
+      { authorization: c.req.header("authorization"), actor: c.req.header(ACTOR_HEADER) },
+      process.env.API_AUTH_TOKEN,
+    )
+    if (!result.ok) return c.json({ error: "unauthorized" }, 401)
+    c.set("actor", result.principal)
+    return next()
+  }
+}
+
+/** Log a one-time warning if auth is disabled (no token configured). Call at server startup. */
+export function warnIfAuthDisabled(): void {
+  if (!process.env.API_AUTH_TOKEN) {
+    console.warn(
+      "[auth] API_AUTH_TOKEN is not set — mutating endpoints (incl. approval gates) are UNAUTHENTICATED. " +
+        "Set API_AUTH_TOKEN to require a Bearer token before any shared/live deployment.",
+    )
+  }
+}
diff --git a/apps/server/src/index.ts b/apps/server/src/index.ts
index 49623f3..a89b164 100644
--- a/apps/server/src/index.ts
+++ b/apps/server/src/index.ts
@@ -1,9 +1,11 @@
 import { serve } from "@hono/node-server"
 import { app } from "./app"
+import { warnIfAuthDisabled } from "./auth"
 import { startHeartbeat } from "./scheduler"
 
 const port = Number(process.env.PORT ?? 3000)
 
+warnIfAuthDisabled()
 serve({ fetch: app.fetch, port })
 console.log(`[server] listening on http://localhost:${port}`)
 
diff --git a/apps/server/src/temporal/activities.ts b/apps/server/src/temporal/activities.ts
index e378c59..2e5a422 100644
--- a/apps/server/src/temporal/activities.ts
+++ b/apps/server/src/temporal/activities.ts
@@ -1,4 +1,11 @@
-import { assess, draft, proposeFileChanges, proposeTickets } from "@eng/agents"
+import {
+  assess,
+  draft,
+  ensureRepoCloned,
+  estimateRunCostCents,
+  proposeFileChanges,
+  proposeTickets,
+} from "@eng/agents"
 import {
   type DeliveryAdapter,
   type DeployState,
@@ -6,7 +13,7 @@ import {
   ROLES,
   type TicketStatus,
 } from "@eng/core"
-import { addSpend, getBudgetRemaining } from "@eng/db"
+import { createApproval, getBudgetRemaining, reconcileSpend, reserveBudget } from "@eng/db"
 import { createGitHubDelivery } from "@eng/integrations"
 import { persistenceFromEnv } from "../persistence"
 import { artifactPath, SHAPING_STAGES } from "../shaping"
@@ -51,6 +58,16 @@ export async function runShapingStage(epicId: string, stageKey: string): Promise
   if (!stage) return
   const role = ROLES[stage.role]
   const remaining = (await getBudgetRemaining(role.id)) ?? role.monthlyBudgetCents
+  const held = await reserveBudget(role.id, estimateRunCostCents(remaining))
+  if (held === null) {
+    await persistence.audit.append({
+      actor: "system",
+      kind: "artifact_skipped",
+      ticketId: null,
+      payload: { epicId, stage: stageKey, reason: "budget_exhausted" },
+    })
+    return
+  }
 
   const epicCtx = await persistence.hierarchy.epicContext(epicId)
   const prior: string[] = []
@@ -69,7 +86,7 @@ export async function runShapingStage(epicId: string, stageKey: string): Promise
       task: stage.task,
       budgetCentsRemaining: remaining,
     })
-    await addSpend(role.id, result.costCents)
+    await reconcileSpend(role.id, held, result.costCents)
     await persistence.knowledge.write(
       artifactPath(epicId, stageKey),
       `# ${stage.title}\n\n${result.content}\n`,
@@ -81,6 +98,7 @@ export async function runShapingStage(epicId: string, stageKey: string): Promise
       payload: { epicId, stage: stageKey, costCents: result.costCents },
     })
   } catch (err) {
+    await reconcileSpend(role.id, held, 0) // release the hold
     await persistence.audit.append({
       actor: "system",
       kind: "artifact_skipped",
@@ -90,8 +108,10 @@ export async function runShapingStage(epicId: string, stageKey: string): Promise
   }
 }
 
-/** Record that an epic's plan is awaiting the human roadmap sign-off (the gate is pending). */
+/** Record that an epic's plan is awaiting the human roadmap sign-off (the gate is pending). Creates a
+ *  first-class pending approval (ENG-006) plus the audit event. */
 export async function requestRoadmapSignoff(epicId: string): Promise<void> {
+  await createApproval({ kind: "roadmap", epicId, requestedByRole: "lead_engineer" })
   await persistence.audit.append({
     actor: "lead_engineer",
     kind: "roadmap_requested",
@@ -100,6 +120,14 @@ export async function requestRoadmapSignoff(epicId: string): Promise<void> {
   })
 }
 
+/** Create a pending approval record for a ticket gate (merge/deploy) — ENG-006. */
+export async function requestApproval(
+  kind: "pr_merge" | "deploy",
+  ticketId: string,
+): Promise<void> {
+  await createApproval({ kind, ticketId, requestedByRole: "lead_engineer" })
+}
+
 /** Record the human roadmap sign-off (the gate released decomposition). */
 export async function recordRoadmapApproval(epicId: string): Promise<void> {
   await persistence.audit.append({
@@ -125,6 +153,16 @@ export async function decomposeEpic(epicId: string): Promise<string[]> {
   ])
   const goalContext = [epicCtx, ...artifacts].join("\n\n")
   const remaining = (await getBudgetRemaining(role.id)) ?? role.monthlyBudgetCents
+  const held = await reserveBudget(role.id, estimateRunCostCents(remaining))
+  if (held === null) {
+    await persistence.audit.append({
+      actor: "system",
+      kind: "decomposition_skipped",
+      ticketId: null,
+      payload: { epicId, reason: "budget_exhausted" },
+    })
+    return []
+  }
 
   let proposed: Awaited<ReturnType<typeof proposeTickets>>
   try {
@@ -135,8 +173,9 @@ export async function decomposeEpic(epicId: string): Promise<string[]> {
       task: "Decompose this epic into implementable tickets.",
       budgetCentsRemaining: remaining,
     })
-    await addSpend(role.id, proposed.costCents)
+    await reconcileSpend(role.id, held, proposed.costCents)
   } catch (err) {
+    await reconcileSpend(role.id, held, 0) // release the hold
     await persistence.audit.append({
       actor: "system",
       kind: "decomposition_skipped",
@@ -202,7 +241,10 @@ const DEPLOY_REF = process.env.GITHUB_DEPLOY_REF ?? BASE_BRANCH
  * — if GitHub is configured — the changes are committed to a ticket branch and a PR is opened.
  * Returns the PR (for the later merge) or null.
  */
-export async function implementTicket(ticketId: string): Promise<PullRequestRef | null> {
+export async function implementTicket(
+  ticketId: string,
+  feedback?: string,
+): Promise<PullRequestRef | null> {
   const role = ROLES.staff_engineer
   const [ticket, goalContext] = await Promise.all([
     persistence.tracker.get(ticketId),
@@ -213,18 +255,68 @@ export async function implementTicket(ticketId: string): Promise<PullRequestRef
   // Central budget enforcement (invariant #3): remaining = limit − spent from the budgets table.
   const remaining = (await getBudgetRemaining(role.id)) ?? role.monthlyBudgetCents
 
+  // Reserve worst-case cost up front (ENG-007) so concurrent runs can't jointly overspend; reconciled
+  // to actual after the run. A null hold means the budget is exhausted — skip this step.
+  const held = await reserveBudget(role.id, estimateRunCostCents(remaining))
+  if (held === null) {
+    await persistence.audit.append({
+      actor: "system",
+      kind: "agent_step_skipped",
+      ticketId,
+      payload: { stage: "implementation", reason: "budget_exhausted" },
+    })
+    return null
+  }
+
+  // ENG-013/ENG-001: ensure the target repo is cloned into the working-code workspace (idempotent),
+  // then point the coding agent at it so it reads/edits real source. No-op (audited) without GitHub.
+  let workdir: string | undefined
+  try {
+    const clone = await ensureRepoCloned()
+    if (clone) {
+      workdir = clone.path
+      await persistence.audit.append({
+        actor: "staff_engineer",
+        kind: "repo_context_ready",
+        ticketId,
+        payload: { path: clone.path, action: clone.action },
+      })
+    } else {
+      await persistence.audit.append({
+        actor: "system",
+        kind: "repo_context_skipped",
+        ticketId,
+        payload: { reason: "GitHub not configured" },
+      })
+    }
+  } catch (err) {
+    await persistence.audit.append({
+      actor: "system",
+      kind: "repo_context_skipped",
+      ticketId,
+      payload: { error: String(err) },
+    })
+  }
+
   let proposed: Awaited<ReturnType<typeof proposeFileChanges>> | null = null
   try {
     proposed = await proposeFileChanges({
       role: role.id,
       systemPrompt: role.systemPrompt,
       goalContext,
-      task: ticket
-        ? `Implement ticket "${ticket.title}": ${ticket.description || "(no description provided)"}.`
-        : `Implement ticket ${ticketId}.`,
+      task: `${
+        ticket
+          ? `Implement ticket "${ticket.title}": ${ticket.description || "(no description provided)"}.`
+          : `Implement ticket ${ticketId}.`
+      }${
+        feedback
+          ? `\n\nThis is a rework attempt. Address the QA feedback from the previous attempt: ${feedback}`
+          : ""
+      }`,
       budgetCentsRemaining: remaining,
+      workdir,
     })
-    await addSpend(role.id, proposed.costCents)
+    await reconcileSpend(role.id, held, proposed.costCents)
     await persistence.audit.append({
       actor: "staff_engineer",
       kind: "agent_step",
@@ -238,6 +330,7 @@ export async function implementTicket(ticketId: string): Promise<PullRequestRef
       },
     })
   } catch (err) {
+    await reconcileSpend(role.id, held, 0) // release the hold
     await persistence.audit.append({
       actor: "system",
       kind: "agent_step_skipped",
@@ -276,11 +369,17 @@ export async function implementTicket(ticketId: string): Promise<PullRequestRef
     return null
   }
   if (!proposed || proposed.files.length === 0) {
+    // Distinguish a genuine empty change set from a parse failure (ENG-009).
+    const reason = !proposed
+      ? "agent runtime unavailable"
+      : proposed.parsed
+        ? "no file changes proposed"
+        : "agent output could not be parsed"
     await persistence.audit.append({
       actor: "system",
       kind: "delivery_skipped",
       ticketId,
-      payload: { reason: "no file changes proposed" },
+      payload: { reason },
     })
     return null
   }
@@ -318,9 +417,21 @@ export async function implementTicket(ticketId: string): Promise<PullRequestRef
  * QA quality gate: a QA/Test agent verifies the acceptance criteria. Returns false only on a real
  * fail verdict; a QA runtime error (e.g. no credentials) records `qa_skipped` and does not block.
  */
-export async function verifyTicket(ticketId: string): Promise<boolean> {
+export async function verifyTicket(
+  ticketId: string,
+): Promise<{ passed: boolean; feedback: string }> {
   const role = ROLES.qa_test
   const remaining = (await getBudgetRemaining(role.id)) ?? role.monthlyBudgetCents
+  const held = await reserveBudget(role.id, estimateRunCostCents(remaining))
+  if (held === null) {
+    await persistence.audit.append({
+      actor: "system",
+      kind: "qa_skipped",
+      ticketId,
+      payload: { reason: "budget_exhausted" },
+    })
+    return { passed: true, feedback: "" }
+  }
   const [ticket, goalContext] = await Promise.all([
     persistence.tracker.get(ticketId),
     persistence.hierarchy.traceContext(ticketId),
@@ -335,22 +446,23 @@ export async function verifyTicket(ticketId: string): Promise<boolean> {
         : `Verify ticket ${ticketId}.`,
       budgetCentsRemaining: remaining,
     })
-    await addSpend(role.id, verdict.costCents)
+    await reconcileSpend(role.id, held, verdict.costCents)
     await persistence.audit.append({
       actor: "qa_test",
       kind: verdict.passed ? "qa_passed" : "qa_failed",
       ticketId,
       payload: { summary: verdict.summary, costCents: verdict.costCents },
     })
-    return verdict.passed
+    return { passed: verdict.passed, feedback: verdict.summary }
   } catch (err) {
+    await reconcileSpend(role.id, held, 0) // release the hold
     await persistence.audit.append({
       actor: "system",
       kind: "qa_skipped",
       ticketId,
       payload: { error: String(err) },
     })
-    return true
+    return { passed: true, feedback: "" }
   }
 }
 
diff --git a/apps/server/src/temporal/workflows.test.ts b/apps/server/src/temporal/workflows.test.ts
index 9ea58c0..ff27917 100644
--- a/apps/server/src/temporal/workflows.test.ts
+++ b/apps/server/src/temporal/workflows.test.ts
@@ -44,7 +44,7 @@ function makeActivities(overrides: Record<string, unknown> = {}) {
       url: "http://pr/1",
       branch: "ticket/t",
     })),
-    verifyTicket: vi.fn(async (_id: string) => true),
+    verifyTicket: vi.fn(async (_id: string) => ({ passed: true, feedback: "" })),
     checkDeliveryStatus: vi.fn(async (_pr: unknown) => "success"),
     mergeDelivery: vi.fn(async (_id: string, _pr: unknown) => true),
     startDeploy: vi.fn(async (_id: string) => 42),
@@ -55,6 +55,7 @@ function makeActivities(overrides: Record<string, unknown> = {}) {
     runShapingStage: vi.fn(async (_epicId: string, _stageKey: string) => {}),
     requestRoadmapSignoff: vi.fn(async (_epicId: string) => {}),
     recordRoadmapApproval: vi.fn(async (_epicId: string) => {}),
+    requestApproval: vi.fn(async (_kind: string, _ticketId: string) => {}),
     ...overrides,
   }
 }
@@ -113,22 +114,48 @@ describe("ticketLifecycle", () => {
     expect(acts.transitionTicket).toHaveBeenCalledWith("t1", "done")
   }, 30_000)
 
-  it("blocks the ticket when QA fails (before any gate)", async () => {
-    const acts = makeActivities({ verifyTicket: vi.fn(async (_id: string) => false) })
+  it("reworks up to the attempt limit on persistent QA failure, then blocks", async () => {
+    const acts = makeActivities({
+      verifyTicket: vi.fn(async (_id: string) => ({ passed: false, feedback: "still broken" })),
+    })
     await withWorker(acts, async () => {
       const handle = await env.client.workflow.start(ticketLifecycle, {
         taskQueue: TQ,
         workflowId: nextId("ticket"),
         args: ["t1"],
       })
-      await handle.result() // returns without any signal — QA fail short-circuits
+      await handle.result() // no signal needed — exhausts rework attempts then blocks
     })
 
+    expect(acts.implementTicket).toHaveBeenCalledTimes(2) // bounced back and retried (ENG-008)
     expect(acts.transitionTicket).toHaveBeenCalledWith("t1", "blocked")
     expect(acts.mergeDelivery).not.toHaveBeenCalled()
     expect(acts.transitionTicket).not.toHaveBeenCalledWith("t1", "done")
   }, 30_000)
 
+  it("reworks once with the QA feedback, then reaches done on a pass", async () => {
+    const verifyTicket = vi
+      .fn()
+      .mockResolvedValueOnce({ passed: false, feedback: "add a test" })
+      .mockResolvedValue({ passed: true, feedback: "" })
+    const acts = makeActivities({ verifyTicket })
+    await withWorker(acts, async () => {
+      const handle = await env.client.workflow.start(ticketLifecycle, {
+        taskQueue: TQ,
+        workflowId: nextId("ticket"),
+        args: ["t1"],
+      })
+      await handle.signal(approveSignal, "merge")
+      await handle.signal(approveSignal, "deploy")
+      await handle.result()
+    })
+
+    expect(acts.implementTicket).toHaveBeenCalledTimes(2) // reworked once
+    expect(acts.implementTicket).toHaveBeenLastCalledWith("t1", "add a test") // fed the feedback
+    expect(acts.transitionTicket).toHaveBeenCalledWith("t1", "done")
+    expect(acts.transitionTicket).not.toHaveBeenCalledWith("t1", "blocked")
+  }, 30_000)
+
   it("blocks the ticket when the merge fails", async () => {
     const acts = makeActivities({
       mergeDelivery: vi.fn(async (_id: string, _pr: unknown) => false),
diff --git a/apps/server/src/temporal/workflows.ts b/apps/server/src/temporal/workflows.ts
index 78cc24d..440afac 100644
--- a/apps/server/src/temporal/workflows.ts
+++ b/apps/server/src/temporal/workflows.ts
@@ -16,6 +16,7 @@ const {
   runShapingStage,
   requestRoadmapSignoff,
   recordRoadmapApproval,
+  requestApproval,
 } = proxyActivities<typeof activities>({
   startToCloseTimeout: "10 minutes",
   retry: { maximumAttempts: 3 },
@@ -68,6 +69,8 @@ const CI_POLL_INTERVAL = "30 seconds"
 const CI_MAX_POLLS = 20
 const DEPLOY_POLL_INTERVAL = "30 seconds"
 const DEPLOY_MAX_POLLS = 20
+/** Bounded implement→review→QA rework attempts before a ticket is blocked for a human (ENG-008). */
+const MAX_IMPLEMENT_ATTEMPTS = 2
 
 /**
  * The ticket lifecycle as a durable state machine, with the full delivery + deploy loop:
@@ -89,15 +92,21 @@ export async function ticketLifecycle(ticketId: string): Promise<void> {
 
   await transitionTicket(ticketId, "planned")
   await sleep("2 seconds")
-  await transitionTicket(ticketId, "in_progress")
 
-  // Agent writes the code and (when GitHub is configured) pushes a branch + opens a PR.
-  const pr = await implementTicket(ticketId)
-  await transitionTicket(ticketId, "in_review")
-
-  // QA quality gate: the QA agent verifies the acceptance criteria before review/merge.
-  const qaOk = await verifyTicket(ticketId)
-  if (!qaOk) {
+  // Cyclic rework (ENG-008): implement → review → QA, bouncing back to in_progress with the QA
+  // feedback on a fail, up to MAX_IMPLEMENT_ATTEMPTS, then block for human attention.
+  let pr: Awaited<ReturnType<typeof implementTicket>> = null
+  let passed = false
+  let feedback: string | undefined
+  for (let attempt = 1; attempt <= MAX_IMPLEMENT_ATTEMPTS && !passed; attempt++) {
+    await transitionTicket(ticketId, "in_progress")
+    pr = await implementTicket(ticketId, feedback)
+    await transitionTicket(ticketId, "in_review")
+    const qa = await verifyTicket(ticketId)
+    passed = qa.passed
+    feedback = qa.feedback
+  }
+  if (!passed) {
     await transitionTicket(ticketId, "blocked")
     return
   }
@@ -111,7 +120,8 @@ export async function ticketLifecycle(ticketId: string): Promise<void> {
     }
   }
 
-  // Merge gate: block until the human lead signs off on the merge.
+  // Merge gate: record a pending approval (ENG-006), then block until the human lead signs off.
+  await requestApproval("pr_merge", ticketId)
   await condition(() => approved.merge)
   const merged = pr ? await mergeDelivery(ticketId, pr) : true
   if (!merged) {
@@ -119,8 +129,9 @@ export async function ticketLifecycle(ticketId: string): Promise<void> {
     return
   }
 
-  // Ship: human-gated deploy.
+  // Ship: human-gated deploy (record a pending approval first, ENG-006).
   await transitionTicket(ticketId, "deploying")
+  await requestApproval("deploy", ticketId)
   await condition(() => approved.deploy)
   const afterRunId = await startDeploy(ticketId)
   if (afterRunId !== null) {
diff --git a/apps/web/src/api.ts b/apps/web/src/api.ts
index f586c2b..ecd0c2b 100644
--- a/apps/web/src/api.ts
+++ b/apps/web/src/api.ts
@@ -1,10 +1,11 @@
-import type { AuditEvent, HierarchyNode, Ticket } from "@eng/core"
+import type { Approval, AuditEvent, HierarchyNode, Ticket } from "@eng/core"
 
-/** A human gate awaiting sign-off (derived server-side from the audit log). */
-export interface PendingApproval {
-  epicId: string
-  kind: string
-  at: string
+/** Per-scope budget summary for the dashboard (ENG-010). */
+export interface BudgetSummary {
+  scope: string
+  limitCents: number
+  spentCents: number
+  remainingCents: number
 }
 
 async function getJson<T>(path: string): Promise<T> {
@@ -27,8 +28,8 @@ async function postJson<T>(path: string, body?: unknown): Promise<T> {
 export const api = {
   health: () => getJson<{ ok: boolean }>("/health"),
   tickets: () => getJson<{ tickets: Ticket[] }>("/api/tickets").then((r) => r.tickets),
-  approvals: () =>
-    getJson<{ approvals: PendingApproval[] }>("/api/approvals").then((r) => r.approvals),
+  approvals: () => getJson<{ approvals: Approval[] }>("/api/approvals").then((r) => r.approvals),
+  budgets: () => getJson<{ budgets: BudgetSummary[] }>("/api/budgets").then((r) => r.budgets),
   audit: () => getJson<{ events: AuditEvent[] }>("/api/audit").then((r) => r.events),
   goals: () => getJson<{ goals: HierarchyNode[] }>("/api/goals").then((r) => r.goals),
   epics: (goalId?: string) =>
diff --git a/apps/web/src/pages/Approvals.tsx b/apps/web/src/pages/Approvals.tsx
index a8f09c0..64cf32e 100644
--- a/apps/web/src/pages/Approvals.tsx
+++ b/apps/web/src/pages/Approvals.tsx
@@ -1,6 +1,23 @@
+import type { Approval } from "@eng/core"
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
 import { api } from "../api"
 
+const LABELS: Record<string, string> = {
+  roadmap: "Roadmap sign-off",
+  pr_merge: "Merge",
+  deploy: "Deploy",
+  design_signoff: "Design sign-off",
+  architecture_decision: "Architecture decision",
+}
+
+/** Dispatch the right approve call for a pending gate (ENG-006: roadmap · merge · deploy). */
+function decide(a: Approval): Promise<unknown> {
+  if (a.kind === "roadmap" && a.epicId) return api.approveRoadmap(a.epicId)
+  if (a.kind === "pr_merge" && a.ticketId) return api.approve(a.ticketId, "merge")
+  if (a.kind === "deploy" && a.ticketId) return api.approve(a.ticketId, "deploy")
+  return Promise.resolve()
+}
+
 export function Approvals() {
   const qc = useQueryClient()
   const { data, isLoading, error } = useQuery({
@@ -9,7 +26,7 @@ export function Approvals() {
     refetchInterval: 1500,
   })
   const approve = useMutation({
-    mutationFn: (epicId: string) => api.approveRoadmap(epicId),
+    mutationFn: decide,
     onSuccess: () => {
       qc.invalidateQueries({ queryKey: ["approvals"] })
       qc.invalidateQueries({ queryKey: ["tickets"] })
@@ -28,16 +45,23 @@ export function Approvals() {
       ) : (
         <ul>
           {approvals.map((a) => (
-            <li key={a.epicId} className="ticket">
+            <li key={a.id} className="ticket">
               <div>
-                <strong>Roadmap sign-off</strong>{" "}
-                <span className="muted">· epic {a.epicId.slice(0, 8)}</span>
+                <strong>{LABELS[a.kind] ?? a.kind}</strong>{" "}
+                <span className="muted">
+                  ·{" "}
+                  {a.ticketId
+                    ? `ticket ${a.ticketId.slice(0, 8)}`
+                    : a.epicId
+                      ? `epic ${a.epicId.slice(0, 8)}`
+                      : ""}
+                </span>
               </div>
               <div className="actions">
                 <button
                   className="btn approve"
                   type="button"
-                  onClick={() => approve.mutate(a.epicId)}
+                  onClick={() => approve.mutate(a)}
                   disabled={approve.isPending}
                 >
                   Approve
diff --git a/apps/web/src/pages/Budgets.tsx b/apps/web/src/pages/Budgets.tsx
new file mode 100644
index 0000000..7a74558
--- /dev/null
+++ b/apps/web/src/pages/Budgets.tsx
@@ -0,0 +1,60 @@
+import { useQuery } from "@tanstack/react-query"
+import { api } from "../api"
+
+const dollars = (cents: number) => `$${(cents / 100).toFixed(2)}`
+
+/** Per-role budget/cost view for the accountable lead (ENG-010). */
+export function Budgets() {
+  const { data, isLoading, error } = useQuery({
+    queryKey: ["budgets"],
+    queryFn: api.budgets,
+    refetchInterval: 3000,
+  })
+
+  if (isLoading) return <p className="muted">Loading…</p>
+  if (error) return <p className="error">Failed to load budgets: {String(error)}</p>
+
+  const budgets = data ?? []
+  const total = budgets.reduce(
+    (acc, b) => ({ limit: acc.limit + b.limitCents, spent: acc.spent + b.spentCents }),
+    { limit: 0, spent: 0 },
+  )
+
+  return (
+    <section>
+      <h1>Budgets</h1>
+      {budgets.length === 0 ? (
+        <p className="muted">No budgets seeded yet.</p>
+      ) : (
+        <table className="table">
+          <thead>
+            <tr>
+              <th>Scope</th>
+              <th>Limit</th>
+              <th>Spent</th>
+              <th>Remaining</th>
+            </tr>
+          </thead>
+          <tbody>
+            {budgets.map((b) => (
+              <tr key={b.scope}>
+                <td>{b.scope}</td>
+                <td>{dollars(b.limitCents)}</td>
+                <td>{dollars(b.spentCents)}</td>
+                <td>{dollars(b.remainingCents)}</td>
+              </tr>
+            ))}
+            <tr>
+              <td>
+                <strong>Total</strong>
+              </td>
+              <td>{dollars(total.limit)}</td>
+              <td>{dollars(total.spent)}</td>
+              <td>{dollars(Math.max(0, total.limit - total.spent))}</td>
+            </tr>
+          </tbody>
+        </table>
+      )}
+    </section>
+  )
+}
diff --git a/apps/web/src/router.tsx b/apps/web/src/router.tsx
index f2761c3..df81e6b 100644
--- a/apps/web/src/router.tsx
+++ b/apps/web/src/router.tsx
@@ -2,6 +2,7 @@ import { createRootRoute, createRoute, createRouter, Link, Outlet } from "@tanst
 import { Approvals } from "./pages/Approvals"
 import { Audit } from "./pages/Audit"
 import { Board } from "./pages/Board"
+import { Budgets } from "./pages/Budgets"
 import { Roadmap } from "./pages/Roadmap"
 
 const rootRoute = createRootRoute({
@@ -23,6 +24,9 @@ const rootRoute = createRootRoute({
         <Link to="/approvals" className="link" activeProps={{ className: "link active" }}>
           Approvals
         </Link>
+        <Link to="/budgets" className="link" activeProps={{ className: "link active" }}>
+          Budgets
+        </Link>
         <Link to="/audit" className="link" activeProps={{ className: "link active" }}>
           Audit
         </Link>
@@ -45,13 +49,24 @@ const approvalsRoute = createRoute({
   path: "/approvals",
   component: Approvals,
 })
+const budgetsRoute = createRoute({
+  getParentRoute: () => rootRoute,
+  path: "/budgets",
+  component: Budgets,
+})
 const auditRoute = createRoute({
   getParentRoute: () => rootRoute,
   path: "/audit",
   component: Audit,
 })
 
-const routeTree = rootRoute.addChildren([boardRoute, roadmapRoute, approvalsRoute, auditRoute])
+const routeTree = rootRoute.addChildren([
+  boardRoute,
+  roadmapRoute,
+  approvalsRoute,
+  budgetsRoute,
+  auditRoute,
+])
 
 export const router = createRouter({ routeTree })
 
diff --git a/packages/agents/src/assess.ts b/packages/agents/src/assess.ts
index f88f287..000f445 100644
--- a/packages/agents/src/assess.ts
+++ b/packages/agents/src/assess.ts
@@ -1,6 +1,7 @@
 import type { RoleId, StoppedReason } from "@eng/core"
 import { ClaudeWorker } from "./claude-worker"
 import { extractJson } from "./propose"
+import { VERDICT_SCHEMA } from "./schemas"
 
 export interface AssessInput {
   role: RoleId
@@ -31,6 +32,7 @@ export async function assess(input: AssessInput): Promise<Assessment> {
     goalContext: input.goalContext,
     task: `${input.task}\n\n${CONTRACT}`,
     budgetCentsRemaining: input.budgetCentsRemaining,
+    outputSchema: VERDICT_SCHEMA,
   })
   const { passed, summary } = parseVerdict(result.summary)
   return { passed, summary, costCents: result.costCents, stoppedReason: result.stoppedReason }
diff --git a/packages/agents/src/backends/api.ts b/packages/agents/src/backends/api.ts
index b9d201d..c11c5c7 100644
--- a/packages/agents/src/backends/api.ts
+++ b/packages/agents/src/backends/api.ts
@@ -21,6 +21,15 @@ export class ApiBackend implements WorkerBackend {
         thinking: { type: "adaptive" },
         system: buildSystemPrompt(input),
         messages: [{ role: "user", content: input.task }],
+        // Structured outputs (ENG-009): constrain the model to schema-conforming JSON when a schema
+        // is supplied, so callers parse guaranteed-valid JSON instead of best-effort extraction.
+        ...(input.outputSchema
+          ? {
+              output_config: {
+                format: { type: "json_schema" as const, schema: input.outputSchema },
+              },
+            }
+          : {}),
       },
       { signal },
     )
diff --git a/packages/agents/src/backends/cli.test.ts b/packages/agents/src/backends/cli.test.ts
index be8c142..2565abf 100644
--- a/packages/agents/src/backends/cli.test.ts
+++ b/packages/agents/src/backends/cli.test.ts
@@ -3,7 +3,7 @@ import { chmod, mkdir, rm, writeFile } from "node:fs/promises"
 import { tmpdir } from "node:os"
 import { join } from "node:path"
 import { afterEach, beforeEach, describe, expect, it } from "vitest"
-import { CliBackend, createSandbox, resolveWorkspaceRoot } from "./cli"
+import { CliBackend, createSandbox, resolveWorkspaceRoot, sandboxEnv } from "./cli"
 
 describe("resolveWorkspaceRoot", () => {
   const prev = process.env.AGENT_WORKSPACE_DIR
@@ -42,6 +42,54 @@ describe("createSandbox", () => {
   })
 })
 
+describe("sandboxEnv", () => {
+  it("forwards benign vars but withholds host secrets", () => {
+    const env = sandboxEnv({
+      PATH: "/usr/bin",
+      HOME: "/home/agent",
+      ANTHROPIC_API_KEY: "sk-secret",
+      GITHUB_TOKEN: "ghp-secret",
+      DATABASE_URL: "postgres://secret",
+    })
+    expect(env.PATH).toBe("/usr/bin")
+    expect(env.HOME).toBe("/home/agent")
+    expect(env.ANTHROPIC_API_KEY).toBeUndefined()
+    expect(env.GITHUB_TOKEN).toBeUndefined()
+    expect(env.DATABASE_URL).toBeUndefined()
+  })
+
+  it("supports opt-in passthrough but never leaks unlisted vars", () => {
+    const env = sandboxEnv({
+      PATH: "/usr/bin",
+      AGENT_SANDBOX_ENV_PASSTHROUGH: "FOO, BAR",
+      FOO: "1",
+      BAR: "2",
+      ANTHROPIC_API_KEY: "sk-secret",
+    })
+    expect(env.FOO).toBe("1")
+    expect(env.BAR).toBe("2")
+    expect(env.ANTHROPIC_API_KEY).toBeUndefined()
+  })
+
+  it("omits allow-listed vars that are absent from the source", () => {
+    const env = sandboxEnv({ PATH: "/usr/bin" })
+    expect("HOME" in env).toBe(false)
+  })
+
+  it("forwards a PM-scoped GitHub token only for the PM role (ENG-013)", () => {
+    const src = { PATH: "/usr/bin", AGENT_PM_GITHUB_TOKEN: "pmtok" }
+    expect(sandboxEnv(src, "pm").GITHUB_TOKEN).toBe("pmtok")
+    expect(sandboxEnv(src, "pm").GH_TOKEN).toBe("pmtok")
+    expect(sandboxEnv(src, "staff_engineer").GITHUB_TOKEN).toBeUndefined()
+    expect(sandboxEnv(src).GITHUB_TOKEN).toBeUndefined()
+  })
+
+  it("never forwards the host GITHUB_TOKEN, even for the PM", () => {
+    const env = sandboxEnv({ PATH: "/usr/bin", GITHUB_TOKEN: "host" }, "pm")
+    expect(env.GITHUB_TOKEN).toBeUndefined()
+  })
+})
+
 describe("CliBackend sandbox enforcement", () => {
   let root: string
   let bin: string
@@ -72,3 +120,35 @@ describe("CliBackend sandbox enforcement", () => {
     expect(result.summary).not.toBe(process.cwd())
   })
 })
+
+describe("CliBackend repo-aware workdir (ENG-001)", () => {
+  let dir: string
+  let bin: string
+  beforeEach(async () => {
+    dir = join(tmpdir(), `eng-code-${process.pid}-${Date.now()}`)
+    await mkdir(dir, { recursive: true })
+    await writeFile(join(dir, "TARGET.txt"), "seeded-content")
+    bin = join(dir, "fakebin.sh")
+    await writeFile(bin, "#!/bin/sh\ncat TARGET.txt\n") // reads a file from its cwd (the clone)
+    await chmod(bin, 0o755)
+  })
+  afterEach(async () => {
+    await rm(dir, { recursive: true, force: true })
+  })
+
+  it("runs the agent in the provided workdir so it reads real source, and leaves it intact", async () => {
+    const backend = new CliBackend("claude-opus-4-8", { bin })
+    const result = await backend.run({
+      role: "staff_engineer",
+      systemPrompt: "",
+      tools: [],
+      goalContext: "",
+      task: "x",
+      budgetCentsRemaining: 100,
+      workdir: dir,
+    })
+    expect(result.summary).toContain("seeded-content") // the agent saw the seeded file
+    expect(existsSync(dir)).toBe(true) // a provided workdir is persistent — not cleaned up
+    expect(existsSync(join(dir, "TARGET.txt"))).toBe(true)
+  })
+})
diff --git a/packages/agents/src/backends/cli.ts b/packages/agents/src/backends/cli.ts
index e9c22f9..9e3a006 100644
--- a/packages/agents/src/backends/cli.ts
+++ b/packages/agents/src/backends/cli.ts
@@ -40,6 +40,64 @@ export async function createSandbox(root: string, role: string): Promise<string>
   return mkdtemp(join(root, `${role}-`))
 }
 
+/**
+ * Env vars forwarded into the agent sandbox (ENG-005). `claude -p` is the full Claude Code agent with
+ * bash + filesystem tools, so the child must NOT inherit the host environment — secrets like
+ * `ANTHROPIC_API_KEY`, `GITHUB_TOKEN`, and `DATABASE_URL` would otherwise be readable from the agent's
+ * shell. Only this benign allow-list is passed; the CLI authenticates via its own login under `HOME`.
+ */
+const SANDBOX_ENV_ALLOWLIST = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "TMPDIR",
+  "XDG_CONFIG_HOME",
+  "XDG_CACHE_HOME",
+  "XDG_DATA_HOME",
+] as const
+
+/**
+ * Build the scrubbed environment for a sandboxed agent run: the allow-list above, plus any names
+ * explicitly opted in via `AGENT_SANDBOX_ENV_PASSTHROUGH` (comma-separated). Everything else — notably
+ * credentials — is withheld. Pure and side-effect-free for testability.
+ *
+ * Scoped-token exception (ENG-013): the PM role provisions repos with `git`/`gh`, so — and only for
+ * the PM — a dedicated `AGENT_PM_GITHUB_TOKEN` is forwarded as `GITHUB_TOKEN`/`GH_TOKEN`. This is a
+ * deliberately narrow widening of the ENG-005 boundary: no other role's sandbox receives git/gh
+ * credentials, and the host's full `GITHUB_TOKEN` is never forwarded.
+ */
+export function sandboxEnv(
+  source: NodeJS.ProcessEnv = process.env,
+  role?: string,
+): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = {}
+  for (const key of SANDBOX_ENV_ALLOWLIST) {
+    const value = source[key]
+    if (value !== undefined) env[key] = value
+  }
+  const extra = source.AGENT_SANDBOX_ENV_PASSTHROUGH
+  if (extra) {
+    for (const key of extra
+      .split(",")
+      .map((s) => s.trim())
+      .filter(Boolean)) {
+      const value = source[key]
+      if (value !== undefined) env[key] = value
+    }
+  }
+  if (role === "pm" && source.AGENT_PM_GITHUB_TOKEN) {
+    env.GITHUB_TOKEN = source.AGENT_PM_GITHUB_TOKEN
+    env.GH_TOKEN = source.AGENT_PM_GITHUB_TOKEN
+  }
+  return env
+}
+
 export interface CliBackendOptions {
   bin?: string
   workspaceRoot?: string
@@ -74,13 +132,19 @@ export class CliBackend implements WorkerBackend {
       buildSystemPrompt(input),
     ]
 
-    // Confine the agent's file/bash tools to a throwaway sandbox — never the repo source.
-    const sandbox = await createSandbox(this.workspaceRoot, input.role)
+    // ENG-001: when a workdir is provided (a cloned target repo in the working-code workspace) run
+    // there so the agent reads/edits real source; otherwise confine it to a throwaway agent-state
+    // sandbox — never this product's own source. Provided workdirs are persistent — don't clean up.
+    const useProvided = Boolean(input.workdir)
+    const cwd = input.workdir ?? (await createSandbox(this.workspaceRoot, input.role))
+    const env = sandboxEnv(process.env, input.role)
     let stdout: string
     try {
-      stdout = await this.exec(args, input.task, sandbox, signal)
+      stdout = await this.exec(args, input.task, cwd, env, signal)
     } finally {
-      if (!process.env.AGENT_KEEP_WORKSPACE) await rm(sandbox, { recursive: true, force: true })
+      if (!useProvided && !process.env.AGENT_KEEP_WORKSPACE) {
+        await rm(cwd, { recursive: true, force: true })
+      }
     }
 
     let parsed: CliResult | undefined
@@ -108,9 +172,16 @@ export class CliBackend implements WorkerBackend {
     }
   }
 
-  private exec(args: string[], stdin: string, cwd: string, signal?: AbortSignal): Promise<string> {
+  private exec(
+    args: string[],
+    stdin: string,
+    cwd: string,
+    env: NodeJS.ProcessEnv,
+    signal?: AbortSignal,
+  ): Promise<string> {
     return new Promise((resolve, reject) => {
-      const child = spawn(this.bin, args, { cwd, signal })
+      // Scrubbed env (ENG-005); the PM also gets a scoped git/gh token (ENG-013). See sandboxEnv.
+      const child = spawn(this.bin, args, { cwd, signal, env })
       let stdout = ""
       let stderr = ""
       child.stdout.on("data", (chunk) => {
diff --git a/packages/agents/src/decompose.ts b/packages/agents/src/decompose.ts
index 88dcbb9..f23dfab 100644
--- a/packages/agents/src/decompose.ts
+++ b/packages/agents/src/decompose.ts
@@ -1,6 +1,7 @@
 import type { RoleId, StoppedReason } from "@eng/core"
 import { ClaudeWorker } from "./claude-worker"
 import { extractJson } from "./propose"
+import { TICKETS_SCHEMA } from "./schemas"
 
 /** A ticket proposed by the Lead Engineer when decomposing an epic. */
 export interface ProposedTicket {
@@ -51,6 +52,7 @@ export async function proposeTickets(input: ProposeTicketsInput): Promise<Propos
     goalContext: input.goalContext,
     task: `${input.task}\n\n${CONTRACT}`,
     budgetCentsRemaining: input.budgetCentsRemaining,
+    outputSchema: TICKETS_SCHEMA,
   })
   return {
     tickets: parseTickets(result.summary),
diff --git a/packages/agents/src/index.ts b/packages/agents/src/index.ts
index e3e9140..a62e2ff 100644
--- a/packages/agents/src/index.ts
+++ b/packages/agents/src/index.ts
@@ -12,13 +12,23 @@ export {
   proposeTickets,
 } from "./decompose"
 export { type DraftedArtifact, type DraftInput, draft } from "./draft"
+export { estimateRunCostCents } from "./pricing"
 export { DEFAULT_MODEL } from "./prompt"
 export {
+  isParseableJson,
   type ProposeChangesInput,
   type ProposedChanges,
   parseProposal,
   proposeFileChanges,
 } from "./propose"
+export {
+  type CloneResult,
+  ensureRepoCloned,
+  type RepoTarget,
+  repoTargetFromEnv,
+} from "./provision"
+export { PROPOSAL_SCHEMA, TICKETS_SCHEMA, VERDICT_SCHEMA } from "./schemas"
+export { repoWorkspacePath, resolveCodeWorkspaceRoot } from "./workspace"
 
 /** Factory for the default unit Worker runtime (mode from options or the WORKER_MODE env var). */
 export function createWorker(options?: ClaudeWorkerOptions): Worker {
diff --git a/packages/agents/src/pricing.test.ts b/packages/agents/src/pricing.test.ts
new file mode 100644
index 0000000..d13226f
--- /dev/null
+++ b/packages/agents/src/pricing.test.ts
@@ -0,0 +1,13 @@
+import { describe, expect, it } from "vitest"
+import { estimateRunCostCents } from "./pricing"
+
+describe("estimateRunCostCents", () => {
+  it("returns a positive hold that grows with budget, up to the output-cap cost", () => {
+    const small = estimateRunCostCents(5, "claude-opus-4-8")
+    const large = estimateRunCostCents(1_000_000, "claude-opus-4-8")
+    expect(small).toBeGreaterThan(0)
+    expect(large).toBeGreaterThanOrEqual(small)
+    // 16000 output tokens × 2500¢/1M ≈ 40¢ worst case for opus-4-8.
+    expect(large).toBeLessThanOrEqual(40)
+  })
+})
diff --git a/packages/agents/src/pricing.ts b/packages/agents/src/pricing.ts
index 3fda135..eb6661d 100644
--- a/packages/agents/src/pricing.ts
+++ b/packages/agents/src/pricing.ts
@@ -1,3 +1,5 @@
+import { DEFAULT_MODEL } from "./prompt"
+
 /** Token pricing in **cents per million tokens** (input / output). Source: Claude API pricing. */
 const PRICING: Record<string, { input: number; output: number }> = {
   "claude-opus-4-8": { input: 500, output: 2500 },
@@ -40,3 +42,17 @@ export function affordableMaxTokens(model: string, budgetCents: number, cap: num
   const affordable = Math.floor(budgetCents / centsPerOutputToken)
   return Math.max(256, Math.min(cap, affordable))
 }
+
+/**
+ * Worst-case cost (cents) to hold up front for one run (ENG-007): the affordable output-token cap at
+ * the model's output rate. Reserving this per run lets concurrent runs for a role avoid jointly
+ * overspending the budget; the hold is reconciled to the actual cost after the run completes.
+ */
+export function estimateRunCostCents(
+  budgetCentsRemaining: number,
+  model: string = DEFAULT_MODEL,
+): number {
+  const tokens = affordableMaxTokens(model, budgetCentsRemaining, 16000)
+  const perToken = priceFor(model).output / 1_000_000
+  return Math.max(1, Math.ceil(tokens * perToken))
+}
diff --git a/packages/agents/src/propose.ts b/packages/agents/src/propose.ts
index b5eb168..5738bd7 100644
--- a/packages/agents/src/propose.ts
+++ b/packages/agents/src/propose.ts
@@ -1,5 +1,6 @@
 import type { FileChange, RoleId, StoppedReason } from "@eng/core"
 import { ClaudeWorker } from "./claude-worker"
+import { PROPOSAL_SCHEMA } from "./schemas"
 
 export interface ProposeChangesInput {
   role: RoleId
@@ -8,6 +9,8 @@ export interface ProposeChangesInput {
   /** What to build. */
   task: string
   budgetCentsRemaining: number
+  /** Cloned target repo to work in (ENG-001) — the agent reads/edits real source there. */
+  workdir?: string
 }
 
 export interface ProposedChanges {
@@ -15,6 +18,12 @@ export interface ProposedChanges {
   files: FileChange[]
   costCents: number
   stoppedReason: StoppedReason
+  /**
+   * Whether the model returned parseable JSON. `false` means the output couldn't be parsed (prose /
+   * malformed) — distinct from a valid-but-empty change set, so the orchestrator can audit the two
+   * differently (ENG-009).
+   */
+  parsed: boolean
 }
 
 const CONTRACT =
@@ -31,9 +40,30 @@ export async function proposeFileChanges(input: ProposeChangesInput): Promise<Pr
     goalContext: input.goalContext,
     task: `${input.task}\n\n${CONTRACT}`,
     budgetCentsRemaining: input.budgetCentsRemaining,
+    outputSchema: PROPOSAL_SCHEMA,
+    workdir: input.workdir,
   })
   const { summary, files } = parseProposal(result.summary)
-  return { summary, files, costCents: result.costCents, stoppedReason: result.stoppedReason }
+  return {
+    summary,
+    files,
+    costCents: result.costCents,
+    stoppedReason: result.stoppedReason,
+    parsed: isParseableJson(result.summary),
+  }
+}
+
+/** True iff the response contains a JSON object that parses — used to tell a parse failure (prose /
+ *  malformed) from a valid-but-empty change set. */
+export function isParseableJson(text: string): boolean {
+  const json = extractJson(text)
+  if (!json) return false
+  try {
+    JSON.parse(json)
+    return true
+  } catch {
+    return false
+  }
 }
 
 export function extractJson(text: string): string | null {
diff --git a/packages/agents/src/provision.test.ts b/packages/agents/src/provision.test.ts
new file mode 100644
index 0000000..0030fa1
--- /dev/null
+++ b/packages/agents/src/provision.test.ts
@@ -0,0 +1,56 @@
+import { describe, expect, it } from "vitest"
+import { ensureRepoCloned, gitArgs, provisionAction, repoTargetFromEnv } from "./provision"
+
+describe("repoTargetFromEnv", () => {
+  it("is null when GitHub isn't configured", () => {
+    expect(repoTargetFromEnv({})).toBeNull()
+    expect(repoTargetFromEnv({ GITHUB_OWNER: "acme" })).toBeNull()
+  })
+
+  it("reads owner/repo and prefers the PM-scoped token over the host token", () => {
+    expect(
+      repoTargetFromEnv({
+        GITHUB_OWNER: "acme",
+        GITHUB_REPO: "widget",
+        GITHUB_TOKEN: "host",
+        AGENT_PM_GITHUB_TOKEN: "scoped",
+      }),
+    ).toEqual({ owner: "acme", repo: "widget", token: "scoped" })
+  })
+})
+
+describe("provisionAction", () => {
+  it("clones a fresh dir and pulls an existing checkout", () => {
+    expect(provisionAction("/no/such/dir-xyz")).toBe("clone")
+    // The repo root itself has a .git → would be a pull (proves the existsSync branch).
+    expect(provisionAction(process.cwd())).toBe("pull")
+  })
+})
+
+describe("gitArgs", () => {
+  it("builds a shallow clone with the auth header (token kept out of config)", () => {
+    const args = gitArgs("clone", "/code/acme/widget", {
+      owner: "acme",
+      repo: "widget",
+      token: "t0ken",
+    })
+    expect(args).toContain("clone")
+    expect(args).toContain("--depth")
+    expect(args.join(" ")).toContain("https://github.com/acme/widget.git")
+    expect(args.join(" ")).toContain("http.extraheader=AUTHORIZATION: bearer t0ken")
+  })
+
+  it("builds a ff-only pull for an existing checkout, no auth header when tokenless", () => {
+    const args = gitArgs("pull", "/code/acme/widget", { owner: "acme", repo: "widget" })
+    expect(args.slice(0, 2)).toEqual(["-C", "/code/acme/widget"])
+    expect(args).toContain("pull")
+    expect(args).toContain("--ff-only")
+    expect(args.join(" ")).not.toContain("extraheader")
+  })
+})
+
+describe("ensureRepoCloned", () => {
+  it("skips (returns null) when no target is configured", async () => {
+    await expect(ensureRepoCloned(null)).resolves.toBeNull()
+  })
+})
diff --git a/packages/agents/src/provision.ts b/packages/agents/src/provision.ts
new file mode 100644
index 0000000..600fba1
--- /dev/null
+++ b/packages/agents/src/provision.ts
@@ -0,0 +1,74 @@
+import { spawn } from "node:child_process"
+import { existsSync } from "node:fs"
+import { mkdir } from "node:fs/promises"
+import { dirname, join } from "node:path"
+import { repoWorkspacePath } from "./workspace"
+
+/**
+ * Repository provisioning (ENG-013): clone the target repo into the working-code workspace so coding
+ * agents (ENG-001) have real source to read and edit. The PM agent owns this via its granted `git`/`gh`
+ * tools; this module is the *deterministic backbone* the lifecycle calls to guarantee (and verify) the
+ * clone exists regardless of the agent turn — idempotent, and a no-op when GitHub isn't configured.
+ */
+
+export interface RepoTarget {
+  owner: string
+  repo: string
+  /** Scoped token for private clones; the PM-scoped token is preferred over the host delivery token. */
+  token?: string
+}
+
+/** Resolve the target repo from env (reuses the delivery config). Null when unconfigured (skip). */
+export function repoTargetFromEnv(env: NodeJS.ProcessEnv = process.env): RepoTarget | null {
+  const owner = env.GITHUB_OWNER
+  const repo = env.GITHUB_REPO
+  if (!owner || !repo) return null
+  return { owner, repo, token: env.AGENT_PM_GITHUB_TOKEN ?? env.GITHUB_TOKEN }
+}
+
+export type ProvisionAction = "clone" | "pull"
+
+/** Pure idempotency decision: an existing checkout is pulled, otherwise cloned fresh. */
+export function provisionAction(dir: string): ProvisionAction {
+  return existsSync(join(dir, ".git")) ? "pull" : "clone"
+}
+
+export interface CloneResult {
+  path: string
+  action: ProvisionAction
+}
+
+/** `git` args for the action — token (if any) injected via http.extraheader so it never lands in
+ *  `.git/config`. Pure, for testing. */
+export function gitArgs(action: ProvisionAction, dir: string, target: RepoTarget): string[] {
+  const auth = target.token ? ["-c", `http.extraheader=AUTHORIZATION: bearer ${target.token}`] : []
+  if (action === "pull") return ["-C", dir, ...auth, "pull", "--ff-only"]
+  const url = `https://github.com/${target.owner}/${target.repo}.git`
+  return [...auth, "clone", "--depth", "1", url, dir]
+}
+
+function runGit(args: string[]): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const child = spawn("git", args, { stdio: "ignore" })
+    child.on("error", reject)
+    child.on("close", (code) =>
+      code === 0 ? resolve() : reject(new Error(`git exited with code ${code}`)),
+    )
+  })
+}
+
+/**
+ * Ensure the target repo is cloned into the working-code workspace, idempotently. Returns the clone
+ * path + the action taken, or `null` when GitHub isn't configured (caller audits the skip). Operates
+ * only under the working-code workspace — never this product's own tree.
+ */
+export async function ensureRepoCloned(
+  target: RepoTarget | null = repoTargetFromEnv(),
+): Promise<CloneResult | null> {
+  if (!target) return null
+  const dir = repoWorkspacePath(target.owner, target.repo)
+  const action = provisionAction(dir)
+  if (action === "clone") await mkdir(dirname(dir), { recursive: true })
+  await runGit(gitArgs(action, dir, target))
+  return { path: dir, action }
+}
diff --git a/packages/agents/src/schemas.test.ts b/packages/agents/src/schemas.test.ts
new file mode 100644
index 0000000..6343ac0
--- /dev/null
+++ b/packages/agents/src/schemas.test.ts
@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vitest"
+import { PROPOSAL_SCHEMA, TICKETS_SCHEMA, VERDICT_SCHEMA } from "./schemas"
+
+describe("structured-output schemas", () => {
+  it("PROPOSAL_SCHEMA requires summary + files and forbids extra props", () => {
+    expect(PROPOSAL_SCHEMA.type).toBe("object")
+    expect(PROPOSAL_SCHEMA.additionalProperties).toBe(false)
+    expect(PROPOSAL_SCHEMA.required).toEqual(["summary", "files"])
+  })
+
+  it("TICKETS_SCHEMA constrains assigneeRole to the known roles", () => {
+    const props = TICKETS_SCHEMA.properties as {
+      tickets: { items: { properties: { assigneeRole: { enum: string[] } } } }
+    }
+    const role = props.tickets.items.properties.assigneeRole
+    expect(role.enum).toContain("staff_engineer")
+    expect(role.enum).toContain("pm")
+    expect(role.enum).toContain("qa_test")
+  })
+
+  it("VERDICT_SCHEMA requires passed + summary", () => {
+    expect(VERDICT_SCHEMA.type).toBe("object")
+    expect(VERDICT_SCHEMA.required).toEqual(["passed", "summary"])
+  })
+})
diff --git a/packages/agents/src/schemas.ts b/packages/agents/src/schemas.ts
new file mode 100644
index 0000000..f61300f
--- /dev/null
+++ b/packages/agents/src/schemas.ts
@@ -0,0 +1,64 @@
+import { ROLE_IDS } from "@eng/core"
+
+/**
+ * JSON Schemas for agent structured outputs (ENG-009). Hand-written (rather than zod-derived) to stay
+ * within the API's structured-output constraints — every object sets `additionalProperties: false`
+ * and lists `required`, and no unsupported keywords (min/max length, etc.) are used. Passed to the
+ * Worker as `outputSchema`; the API backend enforces them, the CLI backend falls back to parsing.
+ */
+
+/** `{ summary, files: [{ path, content }] }` — the coding agent's file changes. */
+export const PROPOSAL_SCHEMA: Record<string, unknown> = {
+  type: "object",
+  additionalProperties: false,
+  required: ["summary", "files"],
+  properties: {
+    summary: { type: "string" },
+    files: {
+      type: "array",
+      items: {
+        type: "object",
+        additionalProperties: false,
+        required: ["path", "content"],
+        properties: {
+          path: { type: "string" },
+          content: { type: "string" },
+        },
+      },
+    },
+  },
+}
+
+/** `{ tickets: [{ title, description, acceptanceCriteria, assigneeRole }] }` — epic decomposition. */
+export const TICKETS_SCHEMA: Record<string, unknown> = {
+  type: "object",
+  additionalProperties: false,
+  required: ["tickets"],
+  properties: {
+    tickets: {
+      type: "array",
+      items: {
+        type: "object",
+        additionalProperties: false,
+        required: ["title", "description", "acceptanceCriteria", "assigneeRole"],
+        properties: {
+          title: { type: "string" },
+          description: { type: "string" },
+          acceptanceCriteria: { type: "array", items: { type: "string" } },
+          assigneeRole: { type: "string", enum: [...ROLE_IDS] },
+        },
+      },
+    },
+  },
+}
+
+/** `{ passed, summary }` — the QA verdict. */
+export const VERDICT_SCHEMA: Record<string, unknown> = {
+  type: "object",
+  additionalProperties: false,
+  required: ["passed", "summary"],
+  properties: {
+    passed: { type: "boolean" },
+    summary: { type: "string" },
+  },
+}
diff --git a/packages/agents/src/workspace.test.ts b/packages/agents/src/workspace.test.ts
new file mode 100644
index 0000000..6f2d094
--- /dev/null
+++ b/packages/agents/src/workspace.test.ts
@@ -0,0 +1,28 @@
+import { afterEach, describe, expect, it } from "vitest"
+import { repoWorkspacePath, resolveCodeWorkspaceRoot } from "./workspace"
+
+describe("resolveCodeWorkspaceRoot", () => {
+  const prev = process.env.AGENT_CODE_WORKSPACE
+  afterEach(() => {
+    if (prev === undefined) delete process.env.AGENT_CODE_WORKSPACE
+    else process.env.AGENT_CODE_WORKSPACE = prev
+  })
+
+  it("honors AGENT_CODE_WORKSPACE", () => {
+    expect(resolveCodeWorkspaceRoot({ AGENT_CODE_WORKSPACE: "/tmp/code-ws" })).toBe("/tmp/code-ws")
+  })
+
+  it("defaults to a top-level workspace/ (singular, distinct from throwaway workspaces/)", () => {
+    const root = resolveCodeWorkspaceRoot({})
+    expect(root.endsWith("/workspace")).toBe(true)
+    expect(root.endsWith("/workspaces")).toBe(false)
+  })
+})
+
+describe("repoWorkspacePath", () => {
+  it("lays out clones as <root>/<owner>/<repo>", () => {
+    expect(repoWorkspacePath("acme", "widget", { AGENT_CODE_WORKSPACE: "/code" })).toBe(
+      "/code/acme/widget",
+    )
+  })
+})
diff --git a/packages/agents/src/workspace.ts b/packages/agents/src/workspace.ts
new file mode 100644
index 0000000..75d7207
--- /dev/null
+++ b/packages/agents/src/workspace.ts
@@ -0,0 +1,45 @@
+import { existsSync } from "node:fs"
+import { dirname, join, resolve as pathResolve } from "node:path"
+
+/**
+ * The two sandboxed roots (ENG-013). Agents have two distinct filesystem areas, never conflated:
+ *
+ *   1. **Agent-state sandbox** — throwaway, per-run scratch under `workspaces/<role>-xxxx`
+ *      (`resolveWorkspaceRoot` in `backends/cli.ts`, env `AGENT_WORKSPACE_DIR`). Ephemeral; no product
+ *      code lives here.
+ *   2. **Working-code workspace** — *persistent* shared root holding cloned target repos that agents
+ *      inspect and modify (this module, env `AGENT_CODE_WORKSPACE`).
+ *
+ * This module owns the working-code root and the per-repo path layout.
+ */
+
+/** Walk up to the monorepo root (the dir containing `pnpm-workspace.yaml`); falls back to `start`. */
+export function findRepoRoot(start: string = process.cwd()): string {
+  let dir = start
+  for (let i = 0; i < 8; i++) {
+    if (existsSync(join(dir, "pnpm-workspace.yaml"))) return dir
+    const parent = dirname(dir)
+    if (parent === dir) break
+    dir = parent
+  }
+  return start
+}
+
+/**
+ * Root of the persistent working-code workspace. Override with `AGENT_CODE_WORKSPACE`; otherwise a
+ * top-level `workspace/` (singular — deliberately distinct from the throwaway `workspaces/` plural).
+ */
+export function resolveCodeWorkspaceRoot(env: NodeJS.ProcessEnv = process.env): string {
+  const override = env.AGENT_CODE_WORKSPACE
+  if (override) return pathResolve(override)
+  return join(findRepoRoot(), "workspace")
+}
+
+/** Path of a cloned target repo within the working-code workspace: `<root>/<owner>/<repo>`. */
+export function repoWorkspacePath(
+  owner: string,
+  repo: string,
+  env: NodeJS.ProcessEnv = process.env,
+): string {
+  return join(resolveCodeWorkspaceRoot(env), owner, repo)
+}
diff --git a/packages/core/src/budget.test.ts b/packages/core/src/budget.test.ts
new file mode 100644
index 0000000..374c62d
--- /dev/null
+++ b/packages/core/src/budget.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest"
+import { canReserve, periodExpired, remainingCents, withinBudget } from "./budget"
+
+const budget = (limitCents: number, spentCents: number) =>
+  ({ scope: "pm", limitCents, spentCents }) as const
+
+describe("periodExpired", () => {
+  it("is false within the same calendar month (UTC)", () => {
+    expect(periodExpired("2026-06-01T00:00:00Z", new Date("2026-06-28T23:00:00Z"))).toBe(false)
+  })
+  it("is true once the month rolls over", () => {
+    expect(periodExpired("2026-06-28T00:00:00Z", new Date("2026-07-01T00:00:00Z"))).toBe(true)
+  })
+  it("is true across a year boundary", () => {
+    expect(periodExpired("2026-12-15T00:00:00Z", new Date("2027-01-02T00:00:00Z"))).toBe(true)
+  })
+})
+
+describe("canReserve", () => {
+  it("allows a reservation that fits", () => {
+    expect(canReserve(budget(1000, 200), 800)).toBe(true)
+  })
+  it("rejects a reservation that would exceed the limit", () => {
+    expect(canReserve(budget(1000, 900), 200)).toBe(false)
+  })
+  it("allows exactly hitting the limit", () => {
+    expect(canReserve(budget(1000, 900), 100)).toBe(true)
+  })
+})
+
+describe("remainingCents / withinBudget", () => {
+  it("clamps remaining at zero and flags exhaustion", () => {
+    expect(remainingCents(budget(1000, 1200))).toBe(0)
+    expect(withinBudget(budget(1000, 1000))).toBe(false)
+    expect(withinBudget(budget(1000, 999))).toBe(true)
+  })
+})
diff --git a/packages/core/src/budget.ts b/packages/core/src/budget.ts
index 5ec4160..e336777 100644
--- a/packages/core/src/budget.ts
+++ b/packages/core/src/budget.ts
@@ -11,3 +11,23 @@ export function remainingCents(budget: Budget): number {
 export function withinBudget(budget: Budget): boolean {
   return budget.spentCents < budget.limitCents
 }
+
+/**
+ * Whether a budget's window has rolled over since `periodStartIso` and spend should reset (ENG-007).
+ * The window is the calendar month (UTC), so `monthlyBudgetCents` is a real monthly allowance rather
+ * than a lifetime total that only ever grows.
+ */
+export function periodExpired(periodStartIso: string, now: Date): boolean {
+  const start = new Date(periodStartIso)
+  return (
+    now.getUTCFullYear() !== start.getUTCFullYear() || now.getUTCMonth() !== start.getUTCMonth()
+  )
+}
+
+/**
+ * Whether a reservation of `cents` fits within the budget without exceeding the limit (ENG-007). Used
+ * to hold worst-case cost up front so concurrent runs for one scope can't jointly overspend.
+ */
+export function canReserve(budget: Budget, cents: number): boolean {
+  return budget.spentCents + cents <= budget.limitCents
+}
diff --git a/packages/core/src/roles.ts b/packages/core/src/roles.ts
index 9eb5491..632efc8 100644
--- a/packages/core/src/roles.ts
+++ b/packages/core/src/roles.ts
@@ -22,8 +22,8 @@ export const ROLES: Record<RoleId, RolePersona> = {
     id: "pm",
     title: "Product Manager",
     systemPrompt:
-      "You are the PM for the unit. Own discovery, requirements, prioritization, the roadmap, and acceptance criteria. Trace every item to a goal and the unit mission.",
-    tools: ["tracker", "docs"],
+      "You are the PM for the unit. Own discovery, requirements, prioritization, the roadmap, and acceptance criteria. Trace every item to a goal and the unit mission. You also provision the target repository: use `gh` to list existing repos and prefer reusing one; create it with `gh` only if it does not exist; and clone it into the working-code workspace so the engineers can read and modify real source. Operations must be idempotent — never clobber an existing repo or checkout.",
+    tools: ["tracker", "docs", "git", "gh"],
     monthlyBudgetCents: 50_00,
     ownsStages: ["discovery"],
   },
diff --git a/packages/core/src/schema.ts b/packages/core/src/schema.ts
index 44cc560..cfdac1d 100644
--- a/packages/core/src/schema.ts
+++ b/packages/core/src/schema.ts
@@ -113,6 +113,7 @@ export const Approval = z.object({
   id,
   kind: ApprovalKind,
   ticketId: id.nullable(),
+  epicId: id.nullable(),
   requestedByRole: RoleId,
   status: ApprovalStatus,
   decidedBy: z.string().nullable(),
diff --git a/packages/core/src/worker.ts b/packages/core/src/worker.ts
index 70a7ca3..bc30726 100644
--- a/packages/core/src/worker.ts
+++ b/packages/core/src/worker.ts
@@ -16,6 +16,18 @@ export interface WorkerInput {
   task: string
   /** Remaining budget; the orchestrator stops the session if this is exhausted (invariant #3). */
   budgetCentsRemaining: number
+  /**
+   * Optional JSON Schema for the response (ENG-009). Runtimes that support structured outputs (the
+   * API backend) constrain the model to emit schema-conforming JSON; runtimes that don't (the CLI
+   * backend) ignore it and fall back to prompt-contract parsing.
+   */
+  outputSchema?: Record<string, unknown>
+  /**
+   * Optional working directory for the run (ENG-001). When set (e.g. a cloned target repo in the
+   * working-code workspace), the CLI backend runs the agent there — so it reads and edits real source
+   * — and does NOT clean it up. When unset, the backend uses a throwaway agent-state sandbox.
+   */
+  workdir?: string
 }
 
 export interface ToolCallRecord {
diff --git a/packages/db/drizzle/0003_narrow_surge.sql b/packages/db/drizzle/0003_narrow_surge.sql
new file mode 100644
index 0000000..98fe451
--- /dev/null
+++ b/packages/db/drizzle/0003_narrow_surge.sql
@@ -0,0 +1 @@
+ALTER TABLE "budgets" ADD COLUMN "period_start" timestamp with time zone DEFAULT now() NOT NULL;
\ No newline at end of file
diff --git a/packages/db/drizzle/0004_tidy_next_avengers.sql b/packages/db/drizzle/0004_tidy_next_avengers.sql
new file mode 100644
index 0000000..ecfadc8
--- /dev/null
+++ b/packages/db/drizzle/0004_tidy_next_avengers.sql
@@ -0,0 +1,2 @@
+ALTER TABLE "approvals" ADD COLUMN "epic_id" uuid;--> statement-breakpoint
+ALTER TABLE "approvals" ADD CONSTRAINT "approvals_epic_id_epics_id_fk" FOREIGN KEY ("epic_id") REFERENCES "public"."epics"("id") ON DELETE no action ON UPDATE no action;
\ No newline at end of file
diff --git a/packages/db/drizzle/meta/0003_snapshot.json b/packages/db/drizzle/meta/0003_snapshot.json
new file mode 100644
index 0000000..aea52e8
--- /dev/null
+++ b/packages/db/drizzle/meta/0003_snapshot.json
@@ -0,0 +1,579 @@
+{
+  "id": "a2982034-db39-4f4b-96e8-066958908762",
+  "prevId": "5674a75f-502a-424f-9bf7-4a4887f379ad",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.approvals": {
+      "name": "approvals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "kind": {
+          "name": "kind",
+          "type": "approval_kind",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ticket_id": {
+          "name": "ticket_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_role": {
+          "name": "requested_by_role",
+          "type": "role_id",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "approval_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "decided_by": {
+          "name": "decided_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "approvals_ticket_id_tickets_id_fk": {
+          "name": "approvals_ticket_id_tickets_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "tickets",
+          "columnsFrom": ["ticket_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.audit_log": {
+      "name": "audit_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "at": {
+          "name": "at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "actor": {
+          "name": "actor",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ticket_id": {
+          "name": "ticket_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "audit_log_ticket_id_tickets_id_fk": {
+          "name": "audit_log_ticket_id_tickets_id_fk",
+          "tableFrom": "audit_log",
+          "tableTo": "tickets",
+          "columnsFrom": ["ticket_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.budgets": {
+      "name": "budgets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "unit_id": {
+          "name": "unit_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "limit_cents": {
+          "name": "limit_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "spent_cents": {
+          "name": "spent_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "period_start": {
+          "name": "period_start",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "budgets_unit_id_units_id_fk": {
+          "name": "budgets_unit_id_units_id_fk",
+          "tableFrom": "budgets",
+          "tableTo": "units",
+          "columnsFrom": ["unit_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.epics": {
+      "name": "epics",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "epics_goal_id_goals_id_fk": {
+          "name": "epics_goal_id_goals_id_fk",
+          "tableFrom": "epics",
+          "tableTo": "goals",
+          "columnsFrom": ["goal_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.goals": {
+      "name": "goals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "mission_id": {
+          "name": "mission_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "goals_mission_id_missions_id_fk": {
+          "name": "goals_mission_id_missions_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "missions",
+          "columnsFrom": ["mission_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.kb_docs": {
+      "name": "kb_docs",
+      "schema": "",
+      "columns": {
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.missions": {
+      "name": "missions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "unit_id": {
+          "name": "unit_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "statement": {
+          "name": "statement",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "missions_unit_id_units_id_fk": {
+          "name": "missions_unit_id_units_id_fk",
+          "tableFrom": "missions",
+          "tableTo": "units",
+          "columnsFrom": ["unit_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tickets": {
+      "name": "tickets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "epic_id": {
+          "name": "epic_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "status": {
+          "name": "status",
+          "type": "ticket_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'backlog'"
+        },
+        "stage": {
+          "name": "stage",
+          "type": "lifecycle_stage",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'implementation'"
+        },
+        "assignee_role": {
+          "name": "assignee_role",
+          "type": "role_id",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "acceptance_criteria": {
+          "name": "acceptance_criteria",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "tickets_epic_id_epics_id_fk": {
+          "name": "tickets_epic_id_epics_id_fk",
+          "tableFrom": "tickets",
+          "tableTo": "epics",
+          "columnsFrom": ["epic_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.units": {
+      "name": "units",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {
+    "public.approval_kind": {
+      "name": "approval_kind",
+      "schema": "public",
+      "values": ["roadmap", "design_signoff", "architecture_decision", "pr_merge", "deploy"]
+    },
+    "public.approval_status": {
+      "name": "approval_status",
+      "schema": "public",
+      "values": ["pending", "approved", "rejected"]
+    },
+    "public.lifecycle_stage": {
+      "name": "lifecycle_stage",
+      "schema": "public",
+      "values": ["discovery", "design", "architecture", "implementation", "review", "ship"]
+    },
+    "public.role_id": {
+      "name": "role_id",
+      "schema": "public",
+      "values": [
+        "pm",
+        "ux_design",
+        "lead_architect",
+        "lead_system_design",
+        "lead_engineer",
+        "staff_engineer",
+        "qa_test"
+      ]
+    },
+    "public.ticket_status": {
+      "name": "ticket_status",
+      "schema": "public",
+      "values": ["backlog", "planned", "in_progress", "in_review", "deploying", "blocked", "done"]
+    }
+  },
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/packages/db/drizzle/meta/0004_snapshot.json b/packages/db/drizzle/meta/0004_snapshot.json
new file mode 100644
index 0000000..38a5a4b
--- /dev/null
+++ b/packages/db/drizzle/meta/0004_snapshot.json
@@ -0,0 +1,594 @@
+{
+  "id": "958d0b4b-9312-4d13-8108-0d24d1e21df7",
+  "prevId": "a2982034-db39-4f4b-96e8-066958908762",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.approvals": {
+      "name": "approvals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "kind": {
+          "name": "kind",
+          "type": "approval_kind",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ticket_id": {
+          "name": "ticket_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "epic_id": {
+          "name": "epic_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_role": {
+          "name": "requested_by_role",
+          "type": "role_id",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "approval_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "decided_by": {
+          "name": "decided_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "approvals_ticket_id_tickets_id_fk": {
+          "name": "approvals_ticket_id_tickets_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "tickets",
+          "columnsFrom": ["ticket_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approvals_epic_id_epics_id_fk": {
+          "name": "approvals_epic_id_epics_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "epics",
+          "columnsFrom": ["epic_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.audit_log": {
+      "name": "audit_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "at": {
+          "name": "at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "actor": {
+          "name": "actor",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ticket_id": {
+          "name": "ticket_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "audit_log_ticket_id_tickets_id_fk": {
+          "name": "audit_log_ticket_id_tickets_id_fk",
+          "tableFrom": "audit_log",
+          "tableTo": "tickets",
+          "columnsFrom": ["ticket_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.budgets": {
+      "name": "budgets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "unit_id": {
+          "name": "unit_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "limit_cents": {
+          "name": "limit_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "spent_cents": {
+          "name": "spent_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "period_start": {
+          "name": "period_start",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "budgets_unit_id_units_id_fk": {
+          "name": "budgets_unit_id_units_id_fk",
+          "tableFrom": "budgets",
+          "tableTo": "units",
+          "columnsFrom": ["unit_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.epics": {
+      "name": "epics",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "epics_goal_id_goals_id_fk": {
+          "name": "epics_goal_id_goals_id_fk",
+          "tableFrom": "epics",
+          "tableTo": "goals",
+          "columnsFrom": ["goal_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.goals": {
+      "name": "goals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "mission_id": {
+          "name": "mission_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "goals_mission_id_missions_id_fk": {
+          "name": "goals_mission_id_missions_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "missions",
+          "columnsFrom": ["mission_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.kb_docs": {
+      "name": "kb_docs",
+      "schema": "",
+      "columns": {
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.missions": {
+      "name": "missions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "unit_id": {
+          "name": "unit_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "statement": {
+          "name": "statement",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "missions_unit_id_units_id_fk": {
+          "name": "missions_unit_id_units_id_fk",
+          "tableFrom": "missions",
+          "tableTo": "units",
+          "columnsFrom": ["unit_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tickets": {
+      "name": "tickets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "epic_id": {
+          "name": "epic_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "status": {
+          "name": "status",
+          "type": "ticket_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'backlog'"
+        },
+        "stage": {
+          "name": "stage",
+          "type": "lifecycle_stage",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'implementation'"
+        },
+        "assignee_role": {
+          "name": "assignee_role",
+          "type": "role_id",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "acceptance_criteria": {
+          "name": "acceptance_criteria",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "tickets_epic_id_epics_id_fk": {
+          "name": "tickets_epic_id_epics_id_fk",
+          "tableFrom": "tickets",
+          "tableTo": "epics",
+          "columnsFrom": ["epic_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.units": {
+      "name": "units",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {
+    "public.approval_kind": {
+      "name": "approval_kind",
+      "schema": "public",
+      "values": ["roadmap", "design_signoff", "architecture_decision", "pr_merge", "deploy"]
+    },
+    "public.approval_status": {
+      "name": "approval_status",
+      "schema": "public",
+      "values": ["pending", "approved", "rejected"]
+    },
+    "public.lifecycle_stage": {
+      "name": "lifecycle_stage",
+      "schema": "public",
+      "values": ["discovery", "design", "architecture", "implementation", "review", "ship"]
+    },
+    "public.role_id": {
+      "name": "role_id",
+      "schema": "public",
+      "values": [
+        "pm",
+        "ux_design",
+        "lead_architect",
+        "lead_system_design",
+        "lead_engineer",
+        "staff_engineer",
+        "qa_test"
+      ]
+    },
+    "public.ticket_status": {
+      "name": "ticket_status",
+      "schema": "public",
+      "values": ["backlog", "planned", "in_progress", "in_review", "deploying", "blocked", "done"]
+    }
+  },
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/packages/db/drizzle/meta/_journal.json b/packages/db/drizzle/meta/_journal.json
index 99cd898..9297da9 100644
--- a/packages/db/drizzle/meta/_journal.json
+++ b/packages/db/drizzle/meta/_journal.json
@@ -22,6 +22,20 @@
       "when": 1782100362993,
       "tag": "0002_absent_vision",
       "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "7",
+      "when": 1782529323974,
+      "tag": "0003_narrow_surge",
+      "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "7",
+      "when": 1782529753673,
+      "tag": "0004_tidy_next_avengers",
+      "breakpoints": true
     }
   ]
 }
diff --git a/packages/db/src/repo.ts b/packages/db/src/repo.ts
index 52b0f33..82caa92 100644
--- a/packages/db/src/repo.ts
+++ b/packages/db/src/repo.ts
@@ -1,14 +1,18 @@
 import {
+  type Approval,
+  type ApprovalKind,
   type AuditEvent,
   type NewAuditEvent,
   type NewTicket,
+  periodExpired,
   ROLES,
+  type RoleId,
   type Ticket,
   type TicketStatus,
 } from "@eng/core"
-import { desc, eq, sql } from "drizzle-orm"
+import { and, desc, eq, sql } from "drizzle-orm"
 import { db } from "./client"
-import { auditLog, budgets, epics, goals, missions, tickets, units } from "./schema"
+import { approvals, auditLog, budgets, epics, goals, missions, tickets, units } from "./schema"
 
 function firstOrThrow<T>(rows: T[], what: string): T {
   const row = rows[0]
@@ -272,8 +276,27 @@ export async function listAudit(): Promise<AuditEvent[]> {
   return rows.map(toAudit)
 }
 
+/** Reset a scope's spend if its budget window has rolled over (ENG-007). Lazy — called on read/reserve
+ *  so `monthlyBudgetCents` is a real monthly allowance, not a lifetime total that only grows. */
+async function rolloverIfExpired(scope: string): Promise<void> {
+  const row = (
+    await db
+      .select({ periodStart: budgets.periodStart })
+      .from(budgets)
+      .where(eq(budgets.scope, scope))
+      .limit(1)
+  )[0]
+  if (row && periodExpired(row.periodStart.toISOString(), new Date())) {
+    await db
+      .update(budgets)
+      .set({ spentCents: 0, periodStart: new Date() })
+      .where(eq(budgets.scope, scope))
+  }
+}
+
 /** Remaining budget (cents) for a scope (role id or "unit"); null if no budget row exists. */
 export async function getBudgetRemaining(scope: string): Promise<number | null> {
+  await rolloverIfExpired(scope)
   const row = (
     await db
       .select({ limitCents: budgets.limitCents, spentCents: budgets.spentCents })
@@ -293,3 +316,126 @@ export async function addSpend(scope: string, cents: number): Promise<void> {
     .set({ spentCents: sql`${budgets.spentCents} + ${c}` })
     .where(eq(budgets.scope, scope))
 }
+
+/**
+ * Atomically reserve `cents` against a scope's budget (ENG-007). Returns the held amount on success,
+ * `null` if the reservation would exceed the limit (caller skips the run), or `0` when no budget row
+ * exists (run proceeds unmetered). The conditional UPDATE serializes concurrent reservations so they
+ * cannot jointly exceed the limit — closing the read-then-spend TOCTOU.
+ */
+export async function reserveBudget(scope: string, cents: number): Promise<number | null> {
+  await rolloverIfExpired(scope)
+  const c = Math.max(0, Math.round(cents))
+  const exists = (
+    await db.select({ id: budgets.id }).from(budgets).where(eq(budgets.scope, scope)).limit(1)
+  )[0]
+  if (!exists) return 0
+  if (c === 0) return 0
+  const updated = await db
+    .update(budgets)
+    .set({ spentCents: sql`${budgets.spentCents} + ${c}` })
+    .where(
+      and(eq(budgets.scope, scope), sql`${budgets.spentCents} + ${c} <= ${budgets.limitCents}`),
+    )
+    .returning({ id: budgets.id })
+  return updated.length > 0 ? c : null
+}
+
+/** Settle a reservation to actual spend (ENG-007): adjust the held amount by (actual − held), ≥ 0. */
+export async function reconcileSpend(
+  scope: string,
+  heldCents: number,
+  actualCents: number,
+): Promise<void> {
+  const delta = Math.round(actualCents) - Math.round(heldCents)
+  if (delta === 0) return
+  await db
+    .update(budgets)
+    .set({ spentCents: sql`GREATEST(0, ${budgets.spentCents} + ${delta})` })
+    .where(eq(budgets.scope, scope))
+}
+
+// --- Approvals (first-class gate records, ENG-006) ---------------------------
+
+function toApproval(row: typeof approvals.$inferSelect): Approval {
+  return {
+    id: row.id,
+    kind: row.kind,
+    ticketId: row.ticketId,
+    epicId: row.epicId,
+    requestedByRole: row.requestedByRole,
+    status: row.status,
+    decidedBy: row.decidedBy,
+    createdAt: row.createdAt.toISOString(),
+    decidedAt: row.decidedAt ? row.decidedAt.toISOString() : null,
+  }
+}
+
+/** Create a pending approval when a gate is reached (ENG-006). */
+export async function createApproval(input: {
+  kind: ApprovalKind
+  ticketId?: string | null
+  epicId?: string | null
+  requestedByRole: RoleId
+}): Promise<Approval> {
+  const row = firstOrThrow(
+    await db
+      .insert(approvals)
+      .values({
+        kind: input.kind,
+        ticketId: input.ticketId ?? null,
+        epicId: input.epicId ?? null,
+        requestedByRole: input.requestedByRole,
+      })
+      .returning(),
+    "approval",
+  )
+  return toApproval(row)
+}
+
+/** Resolve the matching pending approval, recording who decided it (ENG-006). */
+export async function resolveApproval(input: {
+  kind: ApprovalKind
+  ticketId?: string | null
+  epicId?: string | null
+  decidedBy: string
+  status?: "approved" | "rejected"
+}): Promise<void> {
+  const conds = [eq(approvals.kind, input.kind), eq(approvals.status, "pending")]
+  if (input.ticketId) conds.push(eq(approvals.ticketId, input.ticketId))
+  if (input.epicId) conds.push(eq(approvals.epicId, input.epicId))
+  await db
+    .update(approvals)
+    .set({ status: input.status ?? "approved", decidedBy: input.decidedBy, decidedAt: new Date() })
+    .where(and(...conds))
+}
+
+/** Pending approvals across all gate kinds (roadmap · merge · deploy), newest first (ENG-006). */
+export async function listPendingApprovals(): Promise<Approval[]> {
+  const rows = await db
+    .select()
+    .from(approvals)
+    .where(eq(approvals.status, "pending"))
+    .orderBy(desc(approvals.createdAt))
+  return rows.map(toApproval)
+}
+
+/** Per-scope budgets with remaining, for the dashboard (ENG-010). */
+export interface BudgetSummary {
+  scope: string
+  limitCents: number
+  spentCents: number
+  remainingCents: number
+}
+
+export async function listBudgets(): Promise<BudgetSummary[]> {
+  const rows = await db
+    .select({
+      scope: budgets.scope,
+      limitCents: budgets.limitCents,
+      spentCents: budgets.spentCents,
+    })
+    .from(budgets)
+    .orderBy(budgets.scope)
+  return rows.map((r) => ({ ...r, remainingCents: Math.max(0, r.limitCents - r.spentCents) }))
+}
diff --git a/packages/db/src/schema.ts b/packages/db/src/schema.ts
index 0ced0d6..99f3a69 100644
--- a/packages/db/src/schema.ts
+++ b/packages/db/src/schema.ts
@@ -104,12 +104,15 @@ export const budgets = pgTable("budgets", {
   scope: text("scope").notNull(), // a role id, or "unit"
   limitCents: integer("limit_cents").notNull(),
   spentCents: integer("spent_cents").notNull().default(0),
+  // Start of the current budget window; spend resets when the calendar month rolls over (ENG-007).
+  periodStart: timestamp("period_start", { withTimezone: true }).notNull().defaultNow(),
 })
 
 export const approvals = pgTable("approvals", {
   id: uuid("id").primaryKey().defaultRandom(),
   kind: approvalKind("kind").notNull(),
   ticketId: uuid("ticket_id").references(() => tickets.id),
+  epicId: uuid("epic_id").references(() => epics.id),
   requestedByRole: roleId("requested_by_role").notNull(),
   status: approvalStatus("status").notNull().default("pending"),
   decidedBy: text("decided_by"),
diff --git a/project/ENG-001-repo-aware-coding-agents.md b/project/ENG-001-repo-aware-coding-agents.md
index 7f69b71..1f73b14 100644
--- a/project/ENG-001-repo-aware-coding-agents.md
+++ b/project/ENG-001-repo-aware-coding-agents.md
@@ -1,11 +1,23 @@
 # ENG-001 — Give coding agents real repository context
 
-- **Status:** backlog
+- **Status:** done
 - **Priority:** P0 (Critical — blocks a usable autonomous run)
 - **Stage:** implementation
 - **Assignee role:** staff_engineer (with lead_system_design input)
 - **Area:** packages/agents
 
+> **Outcome (Wave 2):** `WorkerInput.workdir` added; the **CLI backend** runs `claude -p` with its cwd
+> set to the provided workdir (the cloned target repo from ENG-013) so the agent reads and edits real
+> source — and a provided workdir is *persistent* (not cleaned up like the throwaway sandbox).
+> `proposeFileChanges` forwards `workdir`; `implementTicket` clones the repo (ENG-013) and passes the
+> path so the Staff Engineer codes against real files, auditing `repo_context_ready` /
+> `repo_context_skipped`. The product's own tree is never touched (the agent works under the separate
+> working-code workspace). Test: the agent reads a seeded file in the workdir and the workdir is left
+> intact.
+>
+> *Deferred (noted):* the **API backend** is tool-less, so file-context injection for it (a directory
+> tree / key files in the prompt) is a follow-up — the CLI backend is the real repo-aware path.
+
 ## Problem
 
 Neither `Worker` backend can see the repository it is supposed to modify, so the coding agent writes
diff --git a/project/ENG-004-api-auth-and-approval-identity.md b/project/ENG-004-api-auth-and-approval-identity.md
index a5d7104..a09b53e 100644
--- a/project/ENG-004-api-auth-and-approval-identity.md
+++ b/project/ENG-004-api-auth-and-approval-identity.md
@@ -1,11 +1,24 @@
 # ENG-004 — API authentication + approval identity
 
-- **Status:** backlog
+- **Status:** done
 - **Priority:** P0 (Critical — do before any live/shared deployment)
 - **Stage:** architecture
 - **Assignee role:** lead_system_design (with lead_architect sign-off)
 - **Area:** apps/server
 
+> **Outcome (Wave 1):** `apps/server/src/auth.ts` adds bearer-token auth — `authMiddleware` on
+> `/api/*` requires `Authorization: Bearer <API_AUTH_TOKEN>` on mutating (non-GET) requests
+> (timing-safe compare; GET read views stay open), resolving the principal from `X-Actor` (default
+> `operator`). The approval endpoints now append an `approval_decided` audit event stamped with the
+> authenticated principal (`payload.by`), so the append-only log records *who* released each gate.
+> When `API_AUTH_TOKEN` is unset the server runs open "dev mode" and warns loudly at startup
+> (`warnIfAuthDisabled`) — set the token to enforce. 9 auth unit tests (pure `checkAuth` + middleware
+> via `app.request`). Typecheck + lint + 73 tests green.
+>
+> *Follow-up (noted):* require-auth-by-default and protecting read views are a hardening decision for
+> the operator; first-class persisted approval records land in ENG-006 (where `decidedBy` moves onto
+> the approval entity).
+
 ## Problem
 
 The HTTP API has no authentication or authorization. Anyone who can reach the server can approve
diff --git a/project/ENG-005-scrub-cli-sandbox-env.md b/project/ENG-005-scrub-cli-sandbox-env.md
index 4c46c34..8d7538c 100644
--- a/project/ENG-005-scrub-cli-sandbox-env.md
+++ b/project/ENG-005-scrub-cli-sandbox-env.md
@@ -1,11 +1,18 @@
 # ENG-005 — Scrub the environment for CLI agent sandboxes
 
-- **Status:** backlog
+- **Status:** done
 - **Priority:** P1 (High — security hardening)
 - **Stage:** implementation
 - **Assignee role:** staff_engineer (security review by lead_system_design)
 - **Area:** packages/agents
 
+> **Outcome (Wave 1):** `CliBackend` now spawns `claude -p` with a scrubbed, allow-listed env
+> (`sandboxEnv()` in `backends/cli.ts`) instead of inheriting the host environment — `ANTHROPIC_API_KEY`,
+> `GITHUB_TOKEN`, `DATABASE_URL` and everything else not on the benign allow-list (PATH/HOME/XDG/locale/…)
+> are withheld; the CLI still authenticates via its own login under `HOME`. Opt-in widening via
+> `AGENT_SANDBOX_ENV_PASSTHROUGH`. Unit tests assert secrets are absent and passthrough works.
+> *Deferred to ENG-013:* the PM-agent scoped-token exception.
+
 ## Problem
 
 The CLI backend confines an agent's *cwd* to a throwaway sandbox, but it does not scrub the *process
diff --git a/project/ENG-006-first-class-approvals.md b/project/ENG-006-first-class-approvals.md
index 8de0cfc..6c20d88 100644
--- a/project/ENG-006-first-class-approvals.md
+++ b/project/ENG-006-first-class-approvals.md
@@ -1,11 +1,19 @@
 # ENG-006 — Make approval gates first-class, persisted entities
 
-- **Status:** backlog
+- **Status:** done
 - **Priority:** P2 (Medium)
 - **Stage:** design
 - **Assignee role:** lead_system_design
 - **Area:** packages/core · apps/server
 
+> **Outcome (Wave 3):** Approvals are now first-class persisted records (the `approvals` table already
+> existed; added an `epic_id` column — core schema + migration `0004` — so roadmap/epic gates fit too).
+> Repo: `createApproval` / `resolveApproval` / `listPendingApprovals`. Each gate creates a pending
+> record (`requestRoadmapSignoff` + a new `requestApproval` activity called before the merge and deploy
+> conditions); the approve endpoints resolve it with `decidedBy` (the authenticated principal from
+> ENG-004). `/api/approvals` now reads the table across **all** gate kinds (roadmap · pr_merge ·
+> deploy), and the web Approvals page dispatches the right approve call per kind.
+
 ## Problem
 
 Pending approvals are not modelled as real entities. The `/api/approvals` endpoint reconstructs
diff --git a/project/ENG-007-budget-model-reset-and-reservation.md b/project/ENG-007-budget-model-reset-and-reservation.md
index 78ff595..84768b6 100644
--- a/project/ENG-007-budget-model-reset-and-reservation.md
+++ b/project/ENG-007-budget-model-reset-and-reservation.md
@@ -1,11 +1,20 @@
 # ENG-007 — Fix the budget model (reset window + reservation)
 
-- **Status:** backlog
+- **Status:** done
 - **Priority:** P2 (Medium)
 - **Stage:** implementation
 - **Assignee role:** staff_engineer (with lead_system_design input)
 - **Area:** packages/db
 
+> **Outcome (Wave 3):** **Monthly reset** — `period_start` column (migration `0003`) + lazy
+> `rolloverIfExpired` inside `getBudgetRemaining`, so `monthlyBudgetCents` is a real monthly window
+> (auto-applies to every activity). **Reservation** — atomic `reserveBudget` (conditional UPDATE that
+> can't exceed the limit) + `reconcileSpend` (settle hold → actual); `estimateRunCostCents` sizes the
+> worst-case hold; all four agent activities now reserve→run→reconcile (release on failure/skip on
+> exhaustion), closing the read-then-spend TOCTOU. Pure helpers `periodExpired` / `canReserve` unit
+> tested. (DB atomicity itself isn't unit-tested — no live DB in CI — consistent with the rest of
+> `repo.ts`.)
+
 ## Problem
 
 Budgets are softer than invariant #3 ("budgets are enforced by the orchestrator") implies:
diff --git a/project/ENG-008-cyclic-rework-routing.md b/project/ENG-008-cyclic-rework-routing.md
index d39d275..275dd2d 100644
--- a/project/ENG-008-cyclic-rework-routing.md
+++ b/project/ENG-008-cyclic-rework-routing.md
@@ -1,11 +1,19 @@
 # ENG-008 — Implement cyclic review/blocked rework routing
 
-- **Status:** backlog
+- **Status:** done
 - **Priority:** P2 (Medium)
 - **Stage:** architecture
 - **Assignee role:** lead_system_design (with lead_architect input)
 - **Area:** apps/server
 
+> **Outcome (Wave 3):** `ticketLifecycle` now runs a **bounded rework loop** — implement → review →
+> QA, bouncing back to `in_progress` with the QA feedback on a fail, up to `MAX_IMPLEMENT_ATTEMPTS`
+> (2), then `blocked` for a human. `verifyTicket` returns `{ passed, feedback }` and `implementTicket`
+> accepts the feedback (threaded into the next coding prompt). Covered by `@temporalio/testing` harness
+> tests: rework-once-then-pass (asserts the feedback is fed and the ticket reaches `done`) and
+> exhaust-attempts-then-blocked. *Deferred:* on a real GitHub retry the per-ticket branch already
+> exists — re-pushing to the same branch instead of re-creating it is a delivery follow-up.
+
 ## Problem
 
 The architecture states the lifecycle is "a durable state machine, not a batch DAG … review can
diff --git a/project/ENG-009-structured-outputs-for-agents.md b/project/ENG-009-structured-outputs-for-agents.md
index ae132cb..1cf4eaa 100644
--- a/project/ENG-009-structured-outputs-for-agents.md
+++ b/project/ENG-009-structured-outputs-for-agents.md
@@ -1,11 +1,20 @@
 # ENG-009 — Use structured outputs for agent response parsing
 
-- **Status:** backlog
+- **Status:** done
 - **Priority:** P1 (High)
 - **Stage:** implementation
 - **Assignee role:** staff_engineer
 - **Area:** packages/agents
 
+> **Outcome (Wave 1):** `WorkerInput` gained an optional `outputSchema`; the **API backend** now emits
+> `output_config: { format: { type: "json_schema", schema } }` (SDK 0.105) so responses are
+> schema-constrained JSON. Hand-written JSON Schemas (`schemas.ts`: `PROPOSAL_SCHEMA` / `TICKETS_SCHEMA`
+> / `VERDICT_SCHEMA`, within the API's structured-output constraints) are passed by
+> `proposeFileChanges` / `proposeTickets` / `assess`. The **CLI backend** ignores the schema and keeps
+> the prose-parse fallback. `ProposedChanges.parsed` distinguishes a parse failure from an empty change
+> set, and `implementTicket` now audits "agent output could not be parsed" vs "no file changes
+> proposed". Typecheck green; schema unit tests added; 35 agents+server tests pass.
+
 ## Problem
 
 The agent helpers (`proposeFileChanges`, `proposeTickets`, `assess`) rely on prompting the model to
diff --git a/project/ENG-010-dashboard-budgets-and-cost.md b/project/ENG-010-dashboard-budgets-and-cost.md
index a284e61..3a6efa0 100644
--- a/project/ENG-010-dashboard-budgets-and-cost.md
+++ b/project/ENG-010-dashboard-budgets-and-cost.md
@@ -1,11 +1,16 @@
 # ENG-010 — Surface budgets and cost in the dashboard
 
-- **Status:** backlog
+- **Status:** done
 - **Priority:** P2 (Medium)
 - **Stage:** design
 - **Assignee role:** ux_design (build by staff_engineer)
 - **Area:** apps/web
 
+> **Outcome (Wave 3):** `listBudgets` repo helper + typed `/api/budgets` endpoint (per-scope
+> limit/spent/remaining). A new web **Budgets** page (TanStack Query, auto-refresh) shows each role's
+> limit/spent/remaining in dollars plus a unit total, with a nav link + route. Verified via the web
+> build. Pairs with ENG-007's now-meaningful monthly budgets.
+
 ## Problem
 
 The dashboard is the accountable lead's primary surface, but it shows no budget or cost view even
diff --git a/project/ENG-013-repo-provisioning-and-shared-workspace.md b/project/ENG-013-repo-provisioning-and-shared-workspace.md
index 06146f6..6400331 100644
--- a/project/ENG-013-repo-provisioning-and-shared-workspace.md
+++ b/project/ENG-013-repo-provisioning-and-shared-workspace.md
@@ -1,6 +1,6 @@
 # ENG-013 — Repository provisioning via the PM agent (git + gh) & shared workspace
 
-- **Status:** backlog
+- **Status:** done
 - **Priority:** P0 (Critical — prerequisite for ENG-001)
 - **Stage:** discovery → implementation
 - **Assignee role:** pm (owns repo create / list / clone); supporting backend work (per-role tool
@@ -8,6 +8,27 @@
 - **Area:** packages/core (role config) · packages/agents (CLI backend tool gating + auth) ·
   apps/server (shared workspace + audit)
 
+> **Outcome (Wave 2):**
+> - **Two-root workspace** — `packages/agents/src/workspace.ts` (`resolveCodeWorkspaceRoot` /
+>   `repoWorkspacePath`): a *persistent* working-code root (`workspace/` singular, env
+>   `AGENT_CODE_WORKSPACE`) for cloned target repos, distinct from the throwaway `workspaces/`
+>   agent-state sandboxes. `/workspace/` gitignored.
+> - **PM tool grant** — `ROLES.pm.tools` now includes `git` + `gh`, and the PM prompt covers
+>   list/reuse/create/clone (idempotent).
+> - **Scoped-token enforcement** — `sandboxEnv(source, role)` forwards `AGENT_PM_GITHUB_TOKEN` as
+>   `GITHUB_TOKEN`/`GH_TOKEN` **only** to the PM sandbox; the host `GITHUB_TOKEN` is never forwarded to
+>   any agent. This is the real security boundary (only the PM can authenticate git/gh).
+> - **Idempotent provisioning** — `provision.ts` (`repoTargetFromEnv` / `provisionAction` / `gitArgs` /
+>   `ensureRepoCloned`): shallow clone-or-ff-pull into the working-code workspace, token passed via
+>   `http.extraheader` (never written to `.git/config`); no-op when GitHub unconfigured. Wired into
+>   `implementTicket` with `repo_context_ready` / `repo_context_skipped` audit events.
+> - Tests: workspace layout, provisioning (skip/action/args), PM-scoped token.
+>
+> *Deferred (noted):* (1) literal `claude --allowedTools` tool-name gating — the security boundary is
+> enforced via the scoped token, so the abstract→Claude-Code tool-name mapping is a follow-up; (2)
+> per-epic repo *association* — the target repo is the configured `GITHUB_OWNER`/`GITHUB_REPO` (same as
+> delivery) for now; moving repo selection onto the Goal/Epic is a follow-up.
+
 ## Decision
 
 Per the product owner's direction, the **PM agent owns repository provisioning** and is granted two
diff --git a/project/ROADMAP.md b/project/ROADMAP.md
index 553ad5e..ecda46f 100644
--- a/project/ROADMAP.md
+++ b/project/ROADMAP.md
@@ -26,20 +26,27 @@ high-leverage enablers forward even when labelled P1/P2.
   (SurrealDB — no-go on wholesale replacement; one item awaits the lead: relax the OSI-only license
   bar? recommended *no* for now).
 
-### Wave 1 — Safety + enablers (independent, high-leverage)
-- **ENG-004** — API auth + approval identity (P0 security gate before any live/shared run).
-- **ENG-009** — Structured outputs (enabler for ENG-001 quality, ENG-014, ENG-016).
-- **ENG-005** — Scrub the CLI sandbox env (security; prerequisite for the repo-context chain).
-
-### Wave 2 — Repo-context critical path
-- **ENG-013** — Repo provisioning (PM `git`/`gh`) + two-root workspace. Needs ENG-005.
-- **ENG-001** — Repo-aware coding agents. Needs ENG-013; benefits from ENG-009.
-
-### Wave 3 — Governance / observability
-- **ENG-007** — Budget model (reset + reservation). Do first in this wave — gates 010 and 008.
-- **ENG-006** — First-class approvals. Builds on ENG-004's identity.
-- **ENG-010** — Budget/cost dashboard. Needs ENG-007.
-- **ENG-008** — Cyclic rework routing. Needs ENG-007 + ENG-002.
+### Wave 1 — Safety + enablers (independent, high-leverage) — ✅ complete (2026-06-27)
+- **ENG-004** ✅ — API auth + approval identity (bearer token on mutating `/api/*`; principal stamped
+  on `approval_decided` audit events; dev-mode warn when unset).
+- **ENG-009** ✅ — Structured outputs (API backend emits `output_config.format`; hand-written schemas;
+  parse-failure vs empty-set audited distinctly).
+- **ENG-005** ✅ — Scrub the CLI sandbox env (allow-listed `sandboxEnv()`; host secrets withheld).
+
+### Wave 2 — Repo-context critical path — ✅ complete (2026-06-27)
+- **ENG-013** ✅ — Two-root workspace + PM `git`/`gh` grant + PM-scoped token + idempotent
+  `ensureRepoCloned`, wired+audited in `implementTicket`. (Deferred: literal `--allowedTools` gating;
+  per-epic repo association.)
+- **ENG-001** ✅ — `WorkerInput.workdir`; CLI backend runs in the cloned repo cwd so agents read/edit
+  real source. (Deferred: API-backend file-context injection.)
+
+### Wave 3 — Governance / observability — ✅ complete (2026-06-27)
+- **ENG-007** ✅ — Monthly reset (`period_start`, lazy rollover) + atomic reserve/reconcile across all
+  agent activities.
+- **ENG-006** ✅ — First-class persisted approvals (added `epic_id`); pending records per gate,
+  resolved with `decidedBy`; `/api/approvals` covers roadmap · merge · deploy.
+- **ENG-010** ✅ — `/api/budgets` + web Budgets page (per-role limit/spent/remaining + total).
+- **ENG-008** ✅ — Bounded implement→review→QA rework loop with QA feedback, then blocked.
 
 ### Wave 4 — Provenance + consensus
 - **ENG-014** — Decision log / provenance tree. Needs ENG-009; build on the Postgres+KB default behind