diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27ea6bfb..44332db3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
       - name: Validate GitHub Actions workflows
         uses: docker://rhysd/actionlint:1.7.11
         with:
-          args: .github/workflows/ci.yml .github/workflows/release.yml
+          args: .github/workflows/ci.yml .github/workflows/release.yml .github/workflows/turbo.yml
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/turbo.yml b/.github/workflows/turbo.yml
new file mode 100644
index 00000000..5d051e08
--- /dev/null
+++ b/.github/workflows/turbo.yml
@@ -0,0 +1,94 @@
+name: Turbo
+
+# Additive Turborepo lane. The required gates stay in ci.yml; this workflow
+# proves the turbo.json task graph end to end on every change:
+#   - pull requests run the AFFECTED graph only (merge-base diff)
+#   - pushes to main run the FULL graph
+# Remote caching activates as soon as the two secrets below exist; without
+# them turbo falls back to the local cache and every step still works.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: turbo-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # Vercel Remote Cache. Absent secrets degrade to local-only caching.
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  # Artifact signature verification (remoteCache.signature in turbo.json).
+  TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+
+jobs:
+  graph:
+    name: turbo ${{ github.event_name == 'pull_request' && '--affected' || '(full)' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # --affected diffs against the merge base; depth 1 hides it.
+          fetch-depth: 0
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.19.0
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts
+      # Same jj setup as ci.yml: the jj and host-contract suites exercise a
+      # real jj binary and refuse to skip silently.
+      - name: Install jj
+        uses: taiki-e/install-action@v2
+        with:
+          tool: jj-cli@0.39.0
+      - name: Initialize colocated jj repository
+        run: jj git init --colocate
+      # --affected diffs against TURBO_SCM_BASE when set. On pull requests, pin
+      # it to the base SHA so the affected graph is exactly this PR's changes
+      # no matter what the checkout's merge history looks like. Pushes to main
+      # run the full graph, so no base is needed there.
+      - name: Pin the affected base to the PR base
+        if: github.event_name == 'pull_request'
+        run: echo "TURBO_SCM_BASE=${{ github.event.pull_request.base.sha }}" >> "$GITHUB_ENV"
+      # The graph itself is a deliverable: what turbo THINKS must run for this
+      # diff, as JSON, before anything executes.
+      - name: Record the affected graph
+        if: github.event_name == 'pull_request'
+        run: pnpm exec turbo run build check lint circular test --affected --dry=json > affected-graph.json
+      - name: Build
+        run: pnpm exec turbo run build ${{ github.event_name == 'pull_request' && '--affected' || '' }} --summarize
+      - name: Check + lint + circular
+        run: pnpm exec turbo run check lint circular ${{ github.event_name == 'pull_request' && '--affected' || '' }} --summarize
+      # The heavy vitest suites carry finite 30s per-test budgets that host
+      # parallelism starves (see the smthrs-shadow job in ci.yml), so the test
+      # fan-out stays at concurrency 2. --continue runs every affected suite
+      # even when a sibling fails, so one red package never hides another.
+      - name: Test
+        run: pnpm exec turbo run test ${{ github.event_name == 'pull_request' && '--affected' || '' }} --concurrency=2 --continue --summarize
+      # Boundaries is experimental and currently reports 210 pre-existing
+      # findings on this repository (config-file imports that leave the
+      # package, undeclared test dependencies, one circular package pair).
+      # Advisory until those are triaged; the engine-tier rule it encodes is
+      # enforced below by the query-based assertion, which is green.
+      - name: Boundaries (advisory)
+        continue-on-error: true
+        run: pnpm exec turbo boundaries
+      - name: Engine boundary assertion (turbo query)
+        run: node scripts/turbo-engine-boundary.mjs
+      # Root gates are not affected-filterable (//# tasks read the whole
+      # workspace), so they always run.
+      - name: Root gates
+        run: pnpm exec turbo run '//#browser' '//#test:scripts' '//#docs' --summarize
+      - name: Upload run summaries
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: turbo-run-summaries
+          path: |
+            .turbo/runs/
+            affected-graph.json
+          if-no-files-found: ignore
diff --git a/.gitignore b/.gitignore
index e058eb21..5f588a3b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,7 @@
 node_modules/
 dist/
+.turbo/
+/out/
 /flows
 .smithers/
 .artifacts/
diff --git a/apps/server/turbo.json b/apps/server/turbo.json
new file mode 100644
index 00000000..bdf3a5ab
--- /dev/null
+++ b/apps/server/turbo.json
@@ -0,0 +1,47 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": ["//"],
+  "tasks": {
+    "deploy": {
+      "dependsOn": ["smithers-ui#build"],
+      "inputs": ["src/**", "scripts/**", "wrangler.jsonc", "tsconfig.json", "package.json"],
+      "outputs": ["deploy-receipts/**"],
+      "cache": false,
+      "interactive": true,
+      "passThroughEnv": ["CLOUDFLARE_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID"]
+    },
+    "deploy:dry": {
+      "dependsOn": ["smithers-ui#build"],
+      "inputs": ["src/**", "scripts/**", "wrangler.jsonc", "tsconfig.json", "package.json"],
+      "outputs": ["deploy-receipts/**"],
+      "cache": false
+    },
+    "deploy:dry-run": {
+      "dependsOn": ["smithers-ui#build"],
+      "inputs": ["src/**", "scripts/**", "wrangler.jsonc", "tsconfig.json", "package.json"],
+      "outputs": [],
+      "cache": false
+    },
+    "test": {
+      "inputs": ["src/**", "scripts/**", "tsconfig.json", "package.json"],
+      "outputs": []
+    },
+    "dev": {
+      "dependsOn": ["smithers-ui#build"],
+      "cache": false,
+      "persistent": true,
+      "interactive": true
+    },
+    "serve:local": {
+      "dependsOn": ["smithers-ui#build"],
+      "cache": false,
+      "persistent": true,
+      "interactive": true
+    },
+    "seed:allowlist": {
+      "cache": false,
+      "outputs": [],
+      "passThroughEnv": ["CLOUDFLARE_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID"]
+    }
+  }
+}
diff --git a/apps/shared/turbo.json b/apps/shared/turbo.json
new file mode 100644
index 00000000..8dae7b96
--- /dev/null
+++ b/apps/shared/turbo.json
@@ -0,0 +1,10 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": ["//"],
+  "tasks": {
+    "test": {
+      "inputs": ["src/**", "tsconfig.json", "package.json"],
+      "outputs": []
+    }
+  }
+}
diff --git a/apps/tui/turbo.json b/apps/tui/turbo.json
new file mode 100644
index 00000000..86722a64
--- /dev/null
+++ b/apps/tui/turbo.json
@@ -0,0 +1,15 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": ["//"],
+  "tasks": {
+    "test": {
+      "inputs": ["src/**", "scripts/**", "tsconfig.json", "package.json"],
+      "outputs": []
+    },
+    "smoke": {
+      "cache": false,
+      "interactive": true,
+      "outputs": []
+    }
+  }
+}
diff --git a/apps/ui/turbo.json b/apps/ui/turbo.json
new file mode 100644
index 00000000..b935b9f7
--- /dev/null
+++ b/apps/ui/turbo.json
@@ -0,0 +1,90 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": ["//"],
+  "tasks": {
+    "build": {
+      "inputs": [
+        "src/**",
+        "vite.config.ts",
+        "postcss.config.js",
+        "tailwind.config.js",
+        "electrobun.config.ts",
+        "tsconfig.json",
+        "package.json"
+      ],
+      "outputs": ["dist/**"],
+      "env": ["SMITHERS_CHAT_URL", "SMITHERS_CHAT_ORIGIN"]
+    },
+    "test": {
+      "inputs": ["src/**", "scripts/**", "tsconfig.json", "package.json"],
+      "outputs": []
+    },
+    "dev": {
+      "cache": false,
+      "persistent": true,
+      "interactive": true,
+      "passThroughEnv": ["SMITHERS_DEV_UPSTREAM", "SMITHERS_CHAT_URL", "SMITHERS_CHAT_ORIGIN", "SMITHERS_APP_URL"]
+    },
+    "dev:hmr": {
+      "cache": false,
+      "persistent": true,
+      "interactive": true,
+      "passThroughEnv": ["SMITHERS_DEV_UPSTREAM", "SMITHERS_CHAT_URL", "SMITHERS_CHAT_ORIGIN"]
+    },
+    "hmr": {
+      "cache": false,
+      "persistent": true,
+      "interactive": true,
+      "passThroughEnv": ["SMITHERS_DEV_UPSTREAM", "SMITHERS_CHAT_URL", "SMITHERS_CHAT_ORIGIN"]
+    },
+    "web": {
+      "cache": false,
+      "persistent": true,
+      "interactive": true,
+      "passThroughEnv": ["SMITHERS_DEV_UPSTREAM", "SMITHERS_CHAT_URL", "SMITHERS_CHAT_ORIGIN"]
+    },
+    "start": {
+      "dependsOn": ["build"],
+      "cache": false,
+      "persistent": true,
+      "interactive": true
+    },
+    "start:canary": {
+      "cache": false,
+      "persistent": true,
+      "interactive": true,
+      "passThroughEnv": ["SMITHERS_APP_URL"]
+    },
+    "build:canary": {
+      "dependsOn": ["build"],
+      "outputs": [],
+      "cache": false,
+      "passThroughEnv": ["SMITHERS_APP_URL"]
+    },
+    "serve:local": {
+      "cache": false,
+      "persistent": true,
+      "interactive": true
+    },
+    "test:e2e:web": {
+      "cache": false,
+      "outputs": []
+    },
+    "test:e2e:web:context": {
+      "cache": false,
+      "outputs": []
+    },
+    "test:e2e:web:shell": {
+      "cache": false,
+      "outputs": []
+    },
+    "test:e2e:worker": {
+      "cache": false,
+      "outputs": []
+    },
+    "checklist": {
+      "cache": false,
+      "outputs": []
+    }
+  }
+}
diff --git a/docs/build-systems/turborepo.md b/docs/build-systems/turborepo.md
new file mode 100644
index 00000000..a0006d7b
--- /dev/null
+++ b/docs/build-systems/turborepo.md
@@ -0,0 +1,341 @@
+# Turborepo for flows
+
+What it looks like to automate this repository with Turborepo 2.10.11, and how
+that compares to the in-repo build system (`BUILD.ts`, `@smthrs/targets`,
+`@smthrs/build`, `@smthrs/build-cli`). Every claim below was executed in this
+worktree; the numbers are from a 16-core aarch64 macOS host with 29 GB free
+memory.
+
+## 1. What was added, file by file
+
+| File | Responsibility |
+| --- | --- |
+| `turbo.json` | The whole task graph. Tasks `build`, `check`, `lint`, `format`, `circular`, `test`, `coverage`, `typecheck`, `dev`; root gates as `//#browser`, `//#test:scripts`, `//#docs`, `//#cargo:fmt`, `//#cargo:clippy`, `//#cargo:test`; `envMode: "strict"`; `globalEnv` / `globalDependencies`; `remoteCache` with `signature: true`; the `boundaries` tag rules; `ui: "tui"`. |
+| `packages/*/turbo.json` (45) | Package Configurations. Each `extends: ["//"]` and carries one Boundaries tag (`engine` / `agent` / `tooling`) mapped from the manifest's `smthrs.group`. Three lines each; no task overrides. |
+| `packages/jj/turbo.json` | Adds `build:wasm`: inputs reach out of the package to `../../crates/flows-jj/**`, `../../Cargo.lock`, `../../rust-toolchain.toml`, `../../vendor/jj/**`; output is `wasm/flows_jj.wasm`; `cache: false` because the artifact is a reproducibility contract (below). |
+| `packages/chain/turbo.json` | Adds `prompts` (regenerates the checked-in `src/internal/prompts.ts` from `prompts/*.mdx`; a mutation task, so `cache: false`). |
+| `packages/evals/turbo.json` | Adds `score-gate`. |
+| `packages/build/infra/turbo.json` | `check`/`test` with this package's real input set (`worker/**`, `alchemy.run.ts`), and `deploy` / `deploy:dev` as uncached interactive tasks whose Cloudflare and cache-token secrets ride `passThroughEnv`. |
+| `apps/ui/turbo.json` | `build` outputs `dist/**` (vite root is `src/mainview`); `dev`, `hmr`, `web`, `start`, `serve:local` are `persistent: true`, `interactive: true`, uncached; e2e and checklist scripts are uncached one-shots. |
+| `apps/server/turbo.json` | `deploy`, `deploy:dry`, `deploy:dry-run`, `dev`, `serve:local` all `dependsOn: ["smithers-ui#build"]` — the wrangler assets directory is `../ui/dist`, so the SPA build is a real edge in the graph. Deploys are uncached; `CLOUDFLARE_API_TOKEN` / `CLOUDFLARE_ACCOUNT_ID` are `passThroughEnv`. |
+| `apps/shared/turbo.json`, `apps/tui/turbo.json`, `examples/turbo.json` | Narrow `test`/`check` inputs to what those suites read. |
+| `package.json` | Adds the `turbo@2.10.11` devDependency and five root scripts the `//#` tasks invoke: `docs`, `test:scripts`, `cargo:fmt`, `cargo:clippy`, `cargo:test`. No existing script changed. |
+| `pnpm-lock.yaml` | Regenerated by `pnpm install` with the one new dependency. |
+| `.gitignore` | Adds `.turbo/` and `/out/`. |
+| `.github/workflows/turbo.yml` | The CI lane: `--affected` on pull requests, full graph on main, `--summarize` + run-summary artifacts, advisory `turbo boundaries`, the query-based engine-boundary assertion, and the root gates. |
+| `.github/workflows/ci.yml` | One line: `turbo.yml` added to the actionlint args. |
+| `scripts/turbo-engine-boundary.mjs` | The release-train rule (engine never depends on agent/tooling) asserted through `turbo query`'s GraphQL package graph. |
+| `packages/flows/test/vitestCoverageIsolation.test.ts` | The issue-#166 pin of the root script roster, widened for the five new scripts — the review path the pin's own comment prescribes. |
+| `docs/build-systems/turborepo.md` | This document. |
+
+## 2. How Turborepo models what `BUILD.ts` models
+
+### Target definition
+
+`BUILD.ts`: a target is a typed TypeScript value with declared inputs,
+outputs, toolchain, and secrets. A label addresses it (`//packages/engine:lib`).
+
+Turborepo: a target is a `(package, script)` pair. The task definition in
+`turbo.json` carries inputs, outputs, env, and dependency edges; the command
+itself lives in the package's `package.json` scripts and is opaque to Turbo —
+it schedules `pnpm run <script>` and never knows what the script does. There
+is no label syntax beyond `package#task` and `//#task` for the root.
+
+### The toolchain
+
+`BUILD.ts`: declared as values — `Smithers.Runtime.Node({ version: ">=22.19.0" })`,
+`Smithers.PackageManager.Pnpm({ version: "11.21.0", runtime })` — and threaded
+into every target. The Runtime service measures the host and refuses to
+execute on a mismatch.
+
+Turborepo: no toolchain model. Turbo infers the package manager from the
+`packageManager` field (its `turbo info` here misreports `pnpm9` against pnpm
+11.21.0 — cosmetic, but it shows inference rather than declaration). The Node
+version, the pnpm version, and the Rust toolchain from `rust-toolchain.toml`
+never enter a cache key unless you add them yourself. This setup puts
+`rust-toolchain.toml` in `globalDependencies` so a toolchain change rekeys
+every task, but nothing stops a developer on Node 20 from poisoning a cache
+that Node 22 produced. The `engines` field is advisory metadata to Turbo, not
+an enforced requirement.
+
+### Inputs, outputs, and cache keys
+
+`BUILD.ts`: inputs are declared per target as typed values (files, globs,
+other targets' outputs, secrets-by-name). The key is a hash of the declared
+closure.
+
+Turborepo: inputs are git-aware file globs per task, plus declared env vars,
+plus `globalDependencies`, plus a hash of external dependency versions parsed
+from the lockfile. Outputs are globs; on a hit, Turbo restores them and
+replays the captured logs. Measured here:
+
+| Scope | Tasks | Cold | Warm |
+| --- | --- | --- | --- |
+| `build` | 44 | 41.35s | 41ms (`FULL TURBO`) |
+| `check` + `lint` + `circular` | 137 | 2m46.6s | 105ms (`FULL TURBO`) |
+| `test` (`--concurrency=2`) | 51 | 3m15.8s | 97ms (`FULL TURBO`) |
+| Root gates (`browser`, `test:scripts`, `docs`, `cargo:fmt`) | 4 | 3.0s | 52ms (`FULL TURBO`) |
+
+The full local cache for all of the above is 13 MB. The test number uses
+`--concurrency=2` for the same reason the `smthrs-shadow` job in `ci.yml`
+passes `--jobs 2`: the heavy vitest suites carry finite 30s per-test budgets
+that full parallelism on a loaded host starves. A first unbounded local run
+failed 10 suites that each pass in isolation; that is a property of the
+suites, not of either build system, but Turbo's default is to discover it the
+hard way.
+
+Two input-modeling facts worth knowing about this repository:
+
+- **No `dependsOn: ["^build"]` anywhere.** The workspace manifests point
+  `exports` at `./src/*.ts`, so typecheck, lint, test, and build all resolve
+  workspace dependencies to TypeScript *source*. Verified empirically: every
+  `dist/` deleted, then `tsc -p tsconfig.json` on `@smthrs/flows` (19
+  workspace dependencies) exits 0. The goal's premise that TypeScript project
+  references would demand `^build` edges does not hold here — no package
+  tsconfig declares `references`. If the repo ever switches to
+  dist-resolution, the change is one line in the root `turbo.json`.
+- **`build` and `check` write the same directory.** `check` is `tsc -b
+  tsconfig.json` (emits `dist/esm` + `dist/tsconfig.tsbuildinfo`) and `build`
+  emits `dist/esm` + `dist/cjs`, starting with `rmSync("dist")`. Turbo
+  schedules independent tasks of one package concurrently, so `turbo run
+  build check` in a single invocation can interleave a delete with an emit.
+  There is no per-task sandbox. The CI lane runs them as separate steps; keep
+  it that way.
+
+### Macros and target expansion across 45 packages
+
+`BUILD.ts`: `Smithers.PackageDefaults({ directories: "packages/*", macro:
+Smithers.StandardPackage })` expands one macro over a directory glob. No
+per-package file exists unless the package genuinely differs.
+
+Turborepo: tasks declared once in the root `turbo.json` apply to every
+package that has the script, so the uniform 42 packages needed no task
+configuration at all. But Boundaries tags exist only as a per-package
+`turbo.json` field — there is no root-level glob tagging — so this change
+still adds 45 three-line files whose only content is `extends` plus a tag
+that duplicates `smthrs.group` from the manifest. Package Configurations
+compose cleanly for the packages that differ (`packages/jj`, the apps,
+`packages/build/infra`); the boilerplate is the tagging, not the tasks.
+
+### Generated-file drift checks
+
+`BUILD.ts`: `pnpm-workspace.yaml`, the workspace `tsconfig.json`, and
+`pnpm-lock.yaml` are *outputs* of targets, and `GithubCiGen` verifies that
+`.github/workflows/ci.yml` still runs the declared gates. Editing a generated
+file by hand fails the drift check.
+
+Turborepo: no equivalent. Turbo reads all of these files; it generates none
+of them and cannot drift-check them. This showed up in practice within
+minutes: `pnpm install` on a machine with a global `minimumReleaseAge` policy
+auto-appended a `minimumReleaseAgeExclude` block to `pnpm-workspace.yaml`, a
+file the in-repo system owns. Nothing in a Turbo setup notices. (The block is
+reverted in this PR; the issue-#166 conformance suite in `@smthrs/flows`
+byte-pins the file, which is what actually catches it here.)
+
+### Secrets
+
+`BUILD.ts`: `Smithers.Secret("SMITHERS_CACHE_TOKEN")` names the variable; a
+substituting proxy swaps an unguessable placeholder for the real value on
+outbound requests, so key material records the name and never the value.
+
+Turborepo: `env` puts a variable's value into the task hash (one-way, but it
+rekeys the cache on rotation, and the value must be readable to hash it).
+`passThroughEnv` makes a variable available to the task without hashing it —
+the right tool for secrets, used here for the Cloudflare and cache tokens on
+the deploy tasks and for the smithers cache token on `//#docs`. That is the
+whole model: declare-or-lose under `envMode: "strict"`, hash-or-don't. There
+is no proxying, no redaction guarantee beyond log scrubbing, and no way to
+prove from the config which tasks can observe a secret beyond reading every
+`passThroughEnv` list by hand. What strict mode *does* buy is real: a task
+that reads an undeclared variable gets an empty string, so the stale-cache
+class of bug fails loudly instead of silently.
+
+### `node_modules` as a dependency
+
+`BUILD.ts`: `Smithers.Install` makes `node_modules` a target keyed on the
+declared toolchain and the generated lockfile. Targets depend on it; the
+executor materializes it.
+
+Turborepo: `node_modules` is outside the graph. Turbo assumes you ran
+`pnpm install` and folds external dependency *versions* (parsed from the
+lockfile) into package hashes. If the install is stale or missing, tasks fail
+with module-resolution errors, not with a graph-level "install is out of
+date" verdict. Every Turbo CI job starts with an unconditional install step,
+which is the accepted workaround.
+
+## 3. Where Turborepo is genuinely better
+
+- **Cache ergonomics per unit of configuration.** One 130-line `turbo.json`
+  produced content-addressed caching over 232 tasks with restore-verified
+  outputs (`rm -rf packages/canonical/dist` → cache hit → `dist/esm` and the
+  tsbuildinfo return in 33ms). The warm-run numbers in the table above are
+  the pitch, and they reproduce.
+- **`--affected` is the CI feature this repo hand-rolls.** A one-file edit in
+  `packages/observability/src/index.ts` narrowed 51 packages to 5
+  (`@smthrs/observability` plus its dependent closure: `flows`,
+  `engine-harness`, `cli`, `examples`) and 232 tasks to 25, measured with
+  `--dry=json`. The base ref is overridable with `TURBO_SCM_BASE`, which the
+  workflow uses. The in-repo system has labels and patterns (`//packages/...`)
+  but nothing that diffs the SCM and prunes the graph for you.
+- **The graph is inspectable without executing it.** `--dry=json` emits every
+  task's hash, inputs-with-hashes, and dependency edges; `--graph` renders
+  Graphviz/SVG; `--summarize` writes `.turbo/runs/*.json` with per-task
+  timing and cache status (uploaded as CI artifacts here); `turbo ls` and
+  `turbo query` answer package-graph questions. `turbo query` is real
+  GraphQL — `scripts/turbo-engine-boundary.mjs` uses it to assert the
+  release-train boundary and prints `engine boundary holds: 23 engine
+  packages, 0 agent/tooling dependencies`.
+- **Worktree-aware local cache.** In this git worktree, Turbo redirected the
+  local cache into the shared git common dir (`.../.git/modules/.turbo/cache`)
+  and announced `using shared worktree cache`. Every linked worktree shares
+  one local cache — a thoughtful default for exactly the multi-lane setup this
+  comparison runs.
+- **The dev loop.** `persistent: true` + `interactive: true` model long-lived
+  TTY processes (wrangler dev, vite HMR, electrobun) as first-class tasks,
+  `turbo watch` reruns the graph on file changes, and `ui: "tui"` makes 45
+  concurrent log streams readable. The in-repo executor has no persistent-task
+  concept.
+- **`turbo prune`.** `turbo prune smithers-server --docker` emitted a 15 MB
+  subworkspace: `out/json` (pruned manifests + a pruned `pnpm-lock.yaml`, the
+  layer you `pnpm install --frozen-lockfile` in a Docker build) and
+  `out/full` (the 20-package source closure). For a Cloudflare deploy this is
+  the difference between uploading the monorepo and uploading the closure.
+  Caveat: the root package is always in scope, so root devDependencies
+  (`@smthrs/build-cli`, `@smthrs/targets`, ...) ride along in the pruned
+  lockfile.
+
+## 4. Where Turborepo cannot express what our system expresses
+
+- **Sub-package granularity.** Turbo's unit of caching is the package-task.
+  `packages/engine` has ~200 source files; touching one test fixture rekeys
+  `test` for the whole package. `BUILD.ts` targets can key on exactly the
+  files a rule consumes, and the rule catalog can define finer targets
+  (per-suite, per-artifact) without new packages. With Turbo, finer
+  granularity means splitting packages — a publishing decision driven by a
+  caching concern.
+- **The file system is globs, not a graph.** Inputs are patterns evaluated
+  against git-tracked files; Turbo does not know that `src/A.ts` imports
+  `src/B.ts`, so it cannot invalidate on *actual* read sets. Two consequences
+  showed up here. First, over-approximation is the only safe posture: the
+  `lint` task uses `$TURBO_DEFAULT$` (every tracked file in the package)
+  because `dprint check` reads markdown and JSON as well as source. Second,
+  nothing detects that `packages/sync/test/` imports `@smthrs/database` and
+  `@effect/platform-node` without declaring them — Turbo hashed those runs
+  green because ancestor `node_modules` resolution made them pass.
+  (Boundaries *did* flag them; see below.)
+- **Overlapping outputs race.** Turbo assumes task outputs are disjoint
+  within a package and provides no sandbox. `build` and `check` both emit
+  `dist/**` here, and `turbo run build check` can schedule them concurrently.
+  A Bazel-like action model (and the in-repo executor) gives each action its
+  own declared output set and would call the overlap a conflict at plan time.
+- **Root tasks are second-class.** `//#` tasks cannot depend on package
+  tasks, so there is no way to say "the browser gate needs the workspace
+  built" or "docs parity runs after check". They run standalone, always
+  unfiltered by `--affected` in any useful sense (they read the whole repo,
+  so their input hash is the whole repo). The five `node --test` gates and
+  the browser guard are expressible, but they sit beside the graph rather
+  than in it.
+- **No toolchain or host modeling.** Covered in §2. Concretely: the wasm
+  reproducibility contract ("these bytes only build on
+  x86_64-unknown-linux-gnu; refuse elsewhere") is inexpressible. `build:wasm`
+  is `cache: false` here because caching it would be actively wrong — a cache
+  hit skips the rebuild that *is* the gate, and the committed
+  `packages/jj/wasm/flows_jj.wasm` is a drift contract, not a build product.
+  Turbo can schedule the script; it cannot say "this task must execute on CI
+  even when its inputs are unchanged," which is what the `wasm-repro` job
+  means. The cargo gates (`//#cargo:fmt|clippy|test`) cache fine on inputs
+  `crates/**` + `Cargo.lock` + `rust-toolchain.toml`, but they inherit the
+  same host-blindness: a cache populated on macOS will serve a Linux runner.
+  (For fmt/clippy/test verdicts that is mostly harmless; for artifacts it
+  would not be.)
+- **Boundaries cannot scope to shipped code.** The engine rule is about the
+  *published* artifact. Boundaries scans every parseable file, so this repo's
+  `BUILD.ts` files (every package imports `@smthrs/targets` — tooling, which
+  the tier rules deny) and `eslint.config.js` files (every package imports
+  `../../eslint.jsdoc.js` — a path outside the package) account for 182 of
+  the 210 findings: 126 tag violations from toolchain imports, 56
+  file-leaves-package imports. There is no `include`/`exclude`. The check
+  still earned its keep: it surfaced 27 imports of packages never declared in
+  the importing package's manifest (`@effect/platform-node` in 18 test files,
+  `@smthrs/database` in 4, `@smthrs/targets` in 4 `BUILD.ts` files, a
+  `playwright` type import in `apps/ui/scripts/live-store-reset.ts`) and the
+  pre-existing circular package dependency `@smthrs/kernel` ↔
+  `@smthrs/platform-browser`. But as a release-train gate it is red on a
+  compliant repository, which is why `turbo.yml` runs it advisory and the
+  query-based script carries the enforcement. The in-repo system scopes
+  policy to declared targets, so its equivalent rule has no false-positive
+  class.
+- **No generated-file ownership.** §2. A Turbo setup cannot make
+  `pnpm-lock.yaml` or `ci.yml` outputs of the graph, so it cannot drift-check
+  them; the guarantees have to come from elsewhere (here: the issue-#166
+  conformance pins, which are tests, not build rules).
+- **No secrets model.** §2. `passThroughEnv` is an availability control, not
+  a confinement mechanism.
+- **Lock-in surface is small but real.** `turbo.json` is declarative JSON:
+  no functions, no imports, no types. Anything the schema lacks (a conditional
+  output, a computed env list, a per-OS input) is inexpressible rather than
+  awkward, and the escape hatch is wrapping scripts — logic that then becomes
+  invisible to the cache. `BUILD.ts` is TypeScript; its escape hatch is a
+  function call.
+
+## 5. What it costs
+
+- **Dependencies:** one devDependency, `turbo@2.10.11` (plus six platform
+  binaries in the lockfile). No runtime footprint; nothing ships.
+- **Config surface:** 130 lines of root `turbo.json`, 45 tag files, 8 package
+  configurations with real content, one 100-line workflow. The ongoing cost
+  is keeping `inputs`/`outputs`/`env` honest as scripts evolve — Turbo cannot
+  check them for you, and a wrong glob is a silent cache lie. The repo's
+  pin-test culture (issue #166) is the right mitigation and already exists.
+- **Vercel-hosted cache by default.** `remoteCache` points at Vercel unless
+  `TURBO_API` says otherwise. This PR wires `signature: true`
+  (`TURBO_REMOTE_CACHE_SIGNATURE_KEY` signs artifacts HMAC-style so a
+  poisoned cache entry fails verification) and leaves the endpoint unset;
+  activation is two secrets (`TURBO_TOKEN`, `TURBO_TEAM`) plus the signature
+  key. **Could Turbo point at the repo's own cache worker under
+  `packages/build/infra`?** Not today. That worker speaks an action-cache /
+  CAS protocol (`/ac` JSON documents in D1, content-addressed blobs in R2 —
+  see `worker/protocol.ts`). Turbo's remote cache protocol is a different,
+  smaller HTTP shape: `GET/PUT /v8/artifacts/:hash` with bearer auth and an
+  optional artifact signature. The storage model underneath (hash-keyed
+  blobs) is the same, so a thin adapter route in the existing worker — map
+  `:hash` to a CAS blob, accept Turbo's auth header — is a day of work, not a
+  redesign. Self-hosted open-source servers also exist if Vercel hosting is
+  the objection.
+- **Pre-existing breakage this PR had to fix to prove itself:** `main` is red
+  at `Lint all workspaces` (31 files of dprint drift, fixed in the first
+  commit) and the `Documentation parity` step invokes `pnpm exec smthrs`, a
+  bin name the build-cli rename removed — the `//#docs` task runs
+  `node packages/build-cli/src/main.js docs '//...'` from source instead, the
+  same invocation the `smthrs-shadow` job uses.
+
+## 6. What adoption would actually involve
+
+1. Land this PR shape: root `turbo.json`, the tag files, the workflow. Keep
+   the recursive pnpm scripts as the fallback path until the turbo lane holds
+   a green streak — the same advisory-then-required pattern the
+   `smthrs-shadow` job uses.
+2. Decide the remote cache question: Vercel (two secrets) or an adapter route
+   on the existing worker (small protocol shim, then `TURBO_API` +
+   `TURBO_TOKEN`).
+3. Triage the Boundaries findings: declare the 27 undeclared imports (real
+   hygiene bugs), resolve or accept the `kernel` ↔ `platform-browser`
+   package cycle, and either upstream an `include` scope for Boundaries or
+   keep the query-based assertion as the enforced form of the engine rule.
+4. Move the root gates that can move into package tasks (`//#browser` could
+   be a per-package `browser` task on the packages it bundles, which would
+   make it affected-filterable and parallel).
+5. Accept the two structural gaps or keep the in-repo system for them:
+   generated-file drift (`pnpm-workspace.yaml`, the lockfile, `ci.yml`) and
+   the wasm reproducibility contract. These are the two places where the
+   graph must *own* files rather than read them, and that is the thing Turbo
+   does not do.
+
+The honest summary: for scheduling and caching a conventional script graph,
+Turborepo is ahead — `--affected`, the TUI, watch mode, prune, query, and the
+worktree-shared cache are real, and the warm-run numbers are what they are.
+For the properties this repository specifically engineered — typed config,
+declared toolchains, generated root files, secrets by name, `node_modules`
+as a target, and a reproducibility gate that must never cache — the in-repo
+system expresses things Turbo structurally cannot, because Turbo's graph
+ends at package scripts and globbed files.
diff --git a/examples/turbo.json b/examples/turbo.json
new file mode 100644
index 00000000..2a915562
--- /dev/null
+++ b/examples/turbo.json
@@ -0,0 +1,14 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": ["//"],
+  "tasks": {
+    "check": {
+      "inputs": ["src/**", "test/**", "tsconfig.json", "package.json"],
+      "outputs": []
+    },
+    "test": {
+      "inputs": ["src/**", "test/**", "vitest.config.ts", "tsconfig.json", "package.json"],
+      "outputs": []
+    }
+  }
+}
diff --git a/package.json b/package.json
index 53c9b595..290e27ad 100644
--- a/package.json
+++ b/package.json
@@ -6,13 +6,18 @@
   "packageManager": "pnpm@11.21.0",
   "scripts": {
     "browser": "node scripts/browser-check.mjs",
+    "cargo:clippy": "cargo clippy --all-targets --locked -- -D warnings",
+    "cargo:fmt": "cargo fmt --check",
+    "cargo:test": "cargo test --locked",
     "check": "pnpm --recursive --if-present run check",
     "checklist": "pnpm --filter smithers-ui run checklist",
     "circular": "pnpm --recursive --if-present run circular",
     "deploy:dry": "pnpm --filter smithers-server run deploy:dry",
+    "docs": "node packages/build-cli/src/main.js docs '//...'",
     "lint": "pnpm --recursive --if-present run lint",
     "test": "pnpm --recursive --if-present run test",
-    "test:examples": "pnpm --filter @smthrs/examples run test"
+    "test:examples": "pnpm --filter @smthrs/examples run test",
+    "test:scripts": "node --test scripts/pack-release.test.mjs scripts/release-rehearsal.test.mjs scripts/set-release-version.test.mjs scripts/flows-backup.test.mjs scripts/check-test-pins.test.mjs"
   },
   "engines": {
     "node": ">=22.19.0"
@@ -27,6 +32,7 @@
     "mermaid": "^11.16.1",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
+    "turbo": "2.10.11",
     "@smthrs/build-cli": "0.1.0",
     "@smthrs/targets": "0.1.0",
     "vite": "^8.2.1",
diff --git a/packages/artifacts/README.md b/packages/artifacts/README.md
index 889a776b..58b8e95d 100644
--- a/packages/artifacts/README.md
+++ b/packages/artifacts/README.md
@@ -17,7 +17,7 @@ The package name says what it stores, per the naming rule in
 
 | Export                                             | Meaning                                                                                                                                 |
 | -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
-| `ArtifactStore.ArtifactStore`                      | The service tag. Identity `@smthrs/artifacts/ArtifactStore`                                                                        |
+| `ArtifactStore.ArtifactStore`                      | The service tag. Identity `@smthrs/artifacts/ArtifactStore`                                                                             |
 | `ArtifactStore.Service`                            | `put(bytes)`, `get(digest)`, `has(digest)`, `findMissing(digests)`                                                                      |
 | `ArtifactStore.ArtifactMissing`                    | The typed miss — the answer a read-through composition acts on                                                                          |
 | `ArtifactStore.ArtifactCorruption`                 | Bytes at an address no longer hash to it                                                                                                |
@@ -25,7 +25,7 @@ The package name says what it stores, per the naming rule in
 | `ArtifactStore.makeFileSystem`, `.layerFileSystem` | Over Effect's `FileSystem` tag                                                                                                          |
 | `ArtifactStore.makeMemory`, `.layerMemory`         | For tests and browser hosts with no durable filesystem                                                                                  |
 | `ArtifactStore.makeNoop`, `.layerNoop`             | Everything unavailable, with per-method overrides                                                                                       |
-| `ArtifactSweep.ArtifactSweep`                      | The sweep tag. Identity `@smthrs/artifacts/ArtifactSweep`                                                                          |
+| `ArtifactSweep.ArtifactSweep`                      | The sweep tag. Identity `@smthrs/artifacts/ArtifactSweep`                                                                               |
 | `ArtifactSweep.Service`                            | `inventory`, `remove(digest, { ifUnmodifiedSinceMs })` — host-local enumeration and mtime-fenced deletion for the engine's `ArtifactGc` |
 | `ArtifactSweep.makeFileSystem`, `.layerFileSystem` | Over the same objects directory the store publishes into                                                                                |
 | `ArtifactSweep.makeNoop`, `.layerNoop`             | Everything unavailable, with per-method overrides                                                                                       |
diff --git a/packages/artifacts/turbo.json b/packages/artifacts/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/artifacts/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/build-cli/src/Executor.ts b/packages/build-cli/src/Executor.ts
index 8e48894f..bb11c0d5 100644
--- a/packages/build-cli/src/Executor.ts
+++ b/packages/build-cli/src/Executor.ts
@@ -13,6 +13,8 @@
  *
  * @since 0.1.0
  */
+import { FlowEngine } from "@smthrs/engine"
+import { Action, type Flow, Interpreter } from "@smthrs/flow"
 import { CheckDocsLive } from "@smthrs/targets/DocsParity"
 import { ExecLive } from "@smthrs/targets/Exec"
 import { ExpandFilegroupLive, isFilegroup } from "@smthrs/targets/Filegroup"
@@ -23,8 +25,6 @@ import { ScaffoldPackageLive } from "@smthrs/targets/NewPackage"
 import { SyncPackageJsonLive } from "@smthrs/targets/PackageJson"
 import * as Target from "@smthrs/targets/Target"
 import { CaptureOutputsLive, verifyOutputs } from "@smthrs/targets/ToolBuild"
-import { FlowEngine } from "@smthrs/engine"
-import { Action, type Flow, Interpreter } from "@smthrs/flow"
 import * as Cause from "effect/Cause"
 import * as Effect from "effect/Effect"
 import * as Exit from "effect/Exit"
diff --git a/packages/build-cli/src/engine.ts b/packages/build-cli/src/engine.ts
index 9ca32e04..acbcdc24 100644
--- a/packages/build-cli/src/engine.ts
+++ b/packages/build-cli/src/engine.ts
@@ -15,9 +15,9 @@ import {
   NodeStdio
 } from "@effect/platform-node"
 import { Install, PackageManager, Runtime } from "@smthrs/build"
-import * as Config from "@smthrs/targets/Config"
 import { FlowEngine } from "@smthrs/engine"
 import { Action, Graph, Interpreter } from "@smthrs/flow"
+import * as Config from "@smthrs/targets/Config"
 import * as Effect from "effect/Effect"
 import * as Layer from "effect/Layer"
 import { createHash } from "node:crypto"
diff --git a/packages/build-cli/test/Workspace.test.ts b/packages/build-cli/test/Workspace.test.ts
index ff66be91..48be8907 100644
--- a/packages/build-cli/test/Workspace.test.ts
+++ b/packages/build-cli/test/Workspace.test.ts
@@ -62,9 +62,7 @@ const buildFile = (options: string): string =>
   `export const workspace = Workspace(${options})\n`
 
 const remoteCacheBuildFile = (options: string): string =>
-  `import { RemoteCache, Secret } from "${
-    NodePath.resolve(import.meta.dirname, "../../targets/src/Smithers.ts")
-  }"\n` +
+  `import { RemoteCache, Secret } from "${NodePath.resolve(import.meta.dirname, "../../targets/src/Smithers.ts")}"\n` +
   `export const remoteCache = RemoteCache.make(${options})\n`
 
 /**
@@ -247,9 +245,7 @@ describe("resolveRemoteCache", () => {
   it("validates a structurally forged declaration", async () => {
     await write(
       "BUILD.ts",
-      `import { RemoteCache } from "${
-        NodePath.resolve(import.meta.dirname, "../../targets/src/Smithers.ts")
-      }"\n` +
+      `import { RemoteCache } from "${NodePath.resolve(import.meta.dirname, "../../targets/src/Smithers.ts")}"\n` +
         "export const remoteCache = {\n" +
         "  [RemoteCache.TypeId]: RemoteCache.TypeId,\n" +
         "  endpoint: \"http://insecure.example.test\",\n" +
diff --git a/packages/build-cli/turbo.json b/packages/build-cli/turbo.json
new file mode 100644
index 00000000..b6d883a5
--- /dev/null
+++ b/packages/build-cli/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "tooling"
+  ]
+}
diff --git a/packages/build/WIRING.md b/packages/build/WIRING.md
index 7b4a9d2d..1be5975f 100644
--- a/packages/build/WIRING.md
+++ b/packages/build/WIRING.md
@@ -7,9 +7,9 @@ install step.
 
 ## Compile-time dependencies
 
-| Dependency            | Version        | Use                                            |
-| --------------------- | -------------- | ---------------------------------------------- |
-| `effect`              | `4.0.0-rc.108` | Effects, schemas, layers, files, and processes |
+| Dependency       | Version        | Use                                            |
+| ---------------- | -------------- | ---------------------------------------------- |
+| `effect`         | `4.0.0-rc.108` | Effects, schemas, layers, files, and processes |
 | `@smthrs/flow`   | `0.1.0`        | Actions, flows, annotations, and file inputs   |
 | `@smthrs/plan`   | `0.1.0`        | Planned nodes                                  |
 | `@smthrs/crypto` | `0.1.0`        | SHA-256 digests                                |
diff --git a/packages/build/docs/README.md b/packages/build/docs/README.md
index 9ee1de95..b3ec7ff0 100644
--- a/packages/build/docs/README.md
+++ b/packages/build/docs/README.md
@@ -17,17 +17,17 @@ wired is marked as such on the page that covers it.
 
 ## Getting started
 
-| Page                                          | Description                                                                    |
-| --------------------------------------------- | ------------------------------------------------------------------------------ |
-| [Install](getting-started/install.md)         | Wire `@smthrs/targets` and the CLI into an existing pnpm workspace. |
-| [First build](getting-started/first-build.md) | Write a root `BUILD.ts` and one package `BUILD.ts`, then run every verb.       |
+| Page                                          | Description                                                              |
+| --------------------------------------------- | ------------------------------------------------------------------------ |
+| [Install](getting-started/install.md)         | Wire `@smthrs/targets` and the CLI into an existing pnpm workspace.      |
+| [First build](getting-started/first-build.md) | Write a root `BUILD.ts` and one package `BUILD.ts`, then run every verb. |
 
 ## Workspace
 
 | Page                                                    | Description                                                                                                         |
 | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
-| [Structure](workspace/structure.md)                     | Discovery, `BUILD.ts` placement, package boundaries, default-target synthesis.                                        |
-| [Writing BUILD files](workspace/writing-build-files.md) | Targets as named exports, target calls, import edges, macros.                                                         |
+| [Structure](workspace/structure.md)                     | Discovery, `BUILD.ts` placement, package boundaries, default-target synthesis.                                      |
+| [Writing BUILD files](workspace/writing-build-files.md) | Targets as named exports, target calls, import edges, macros.                                                       |
 | [Configuration](workspace/configuration.md)             | The `Workspace` declaration, `cacheDirectory`, `gitignored`, `--cache-dir`.                                         |
 | [Running targets](workspace/running-targets.md)         | `install`, target verbs including `run` and `docs`, `ci`, and what actually executes.                               |
 | [Querying](workspace/querying.md)                       | `query`, `deps()`, and `graph`.                                                                                     |
@@ -40,7 +40,7 @@ wired is marked as such on the page that covers it.
 | Page                                                         | Description                                                                        |
 | ------------------------------------------------------------ | ---------------------------------------------------------------------------------- |
 | [Labels](concepts/labels.md)                                 | The `//pkg:target` grammar, package defaults, and `//...` patterns.                |
-| [Targets and targets](concepts/targets.md)           | A target is a flow with planner metadata.                                          |
+| [Targets and targets](concepts/targets.md)                   | A target is a flow with planner metadata.                                          |
 | [Inputs](concepts/inputs.md)                                 | `file()`, `glob()`, `gitDiff()`, and when they are digested.                       |
 | [Dependencies](concepts/dependencies.md)                     | Import edges, `deps` attributes, and transitive planning.                          |
 | [Actions and boundaries](concepts/actions-and-boundaries.md) | Sealed actions, `TreeArtifact` writes, host state, and hermeticity.                |
@@ -48,16 +48,16 @@ wired is marked as such on the page that covers it.
 
 ## Extending
 
-| Page                                          | Description                                                                        |
-| --------------------------------------------- | ---------------------------------------------------------------------------------- |
-| [Writing targets](extending/writing-targets.md)   | `Target.make`: the attrs schema, the plan-time implementation, and typed failures. |
-| [Writing macros](extending/writing-macros.md) | `StandardPackage` as the worked example.                                           |
-| [Default targets](extending/default-targets.md)   | `PackageDefaults`, `directories`, `marker`, `unless`, and `macro`.                 |
+| Page                                            | Description                                                                        |
+| ----------------------------------------------- | ---------------------------------------------------------------------------------- |
+| [Writing targets](extending/writing-targets.md) | `Target.make`: the attrs schema, the plan-time implementation, and typed failures. |
+| [Writing macros](extending/writing-macros.md)   | `StandardPackage` as the worked example.                                           |
+| [Default targets](extending/default-targets.md) | `PackageDefaults`, `directories`, `marker`, `unless`, and `macro`.                 |
 
 ## Reference
 
-| Page                                      | Description                                                    |
-| ----------------------------------------- | -------------------------------------------------------------- |
-| [CLI](reference/cli.md)                   | Every verb, flag, output shape, and exit code.                 |
-| [Workspace](reference/config.md)          | The `Workspace` declaration and its exact validation targets.    |
+| Page                                          | Description                                                      |
+| --------------------------------------------- | ---------------------------------------------------------------- |
+| [CLI](reference/cli.md)                       | Every verb, flag, output shape, and exit code.                   |
+| [Workspace](reference/config.md)              | The `Workspace` declaration and its exact validation targets.    |
 | [Target catalog](reference/targets/README.md) | One page per target, with attribute tables and execution status. |
diff --git a/packages/build/docs/about/what-is-smithers-build.md b/packages/build/docs/about/what-is-smithers-build.md
index 7de513a9..0e78fa3f 100644
--- a/packages/build/docs/about/what-is-smithers-build.md
+++ b/packages/build/docs/about/what-is-smithers-build.md
@@ -51,11 +51,11 @@ See [Targets and targets](../concepts/targets.md) and
 |                   | smithers build                                                                               | Bazel                                               | Turborepo                                      | nx                                         |
 | ----------------- | -------------------------------------------------------------------------------------------- | --------------------------------------------------- | ---------------------------------------------- | ------------------------------------------ |
 | Build file        | `BUILD.ts`, plain TypeScript                                                                 | `BUILD.bazel`, Starlark                             | `turbo.json` plus package scripts              | `project.json` plus plugins                |
-| Unit of work      | Target: a target call exported by name                                                         | Target: a target call with a `name` attribute         | Task: a package script                         | Target: an executor invocation             |
+| Unit of work      | Target: a target call exported by name                                                       | Target: a target call with a `name` attribute       | Task: a package script                         | Target: an executor invocation             |
 | Dependency edges  | Direct `import` between `BUILD.ts` files                                                     | `deps` attribute holding label strings              | Inferred from `package.json` plus `dependsOn`  | Inferred from imports plus explicit config |
 | Input declaration | `file()`, `glob()`, `gitDiff()`                                                              | `srcs`, `glob()`                                    | Package directory hashing, `inputs` globs      | Named input sets                           |
 | Sandboxing        | Not implemented; the exec action spawns in the workspace                                     | Per-action sandbox                                  | None                                           | None                                       |
-| Cache key         | sha256 over target id, canonicalized attrs, input digests, and dependency keys                 | Action digest over declared inputs and command line | Hash over package files, dependencies, and env | Hash over inputs and project graph         |
+| Cache key         | sha256 over target id, canonicalized attrs, input digests, and dependency keys               | Action digest over declared inputs and command line | Hash over package files, dependencies, and env | Hash over inputs and project graph         |
 | Remote cache      | HTTP `/ac` read-through for CLI results; `/ac` and `/cas` services for the engine step cache | gRPC remote execution API                           | Vercel Remote Cache                            | Nx Cloud                                   |
 | Language          | TypeScript                                                                                   | Starlark                                            | JSON                                           | JSON plus TypeScript plugins               |
 
@@ -66,11 +66,11 @@ Bazel's. See [Actions and boundaries](../concepts/actions-and-boundaries.md).
 
 ## The three packages
 
-| Package                      | Source                        | What it holds                                                                                                                              |
-| ---------------------------- | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
-| `@smthrs/build`         | `packages/build/src/`         | Dependency installation as flows. Exports `Install` and `PackageManager`.                                                                  |
-| `@smthrs/targets` | `packages/targets/src/` | The `BUILD.ts` authoring surface: `Target.make`, `Input`, `Workspace`, `PackageDefaults`, `Exec`, `StandardPackage`, and the target catalog. |
-| `@smthrs/build-cli`     | `packages/build-cli/src/`     | The `smthrs` CLI: workspace discovery, the planner, the executor, the cache, and query and graph output.                                   |
+| Package             | Source                    | What it holds                                                                                                                                |
+| ------------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| `@smthrs/build`     | `packages/build/src/`     | Dependency installation as flows. Exports `Install` and `PackageManager`.                                                                    |
+| `@smthrs/targets`   | `packages/targets/src/`   | The `BUILD.ts` authoring surface: `Target.make`, `Input`, `Workspace`, `PackageDefaults`, `Exec`, `StandardPackage`, and the target catalog. |
+| `@smthrs/build-cli` | `packages/build-cli/src/` | The `smthrs` CLI: workspace discovery, the planner, the executor, the cache, and query and graph output.                                     |
 
 ## Next
 
diff --git a/packages/build/docs/concepts/targets.md b/packages/build/docs/concepts/targets.md
index e2d49d5f..efb4f720 100644
--- a/packages/build/docs/concepts/targets.md
+++ b/packages/build/docs/concepts/targets.md
@@ -148,7 +148,7 @@ A target declares both channels as schemas. They default to `Schema.Void` and
 
 | Channel | Typical value                                                                                                                                                   |
 | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Success | `Exec.Result` for a single tool run, `Outputs` for a producing build, a target-specific struct for a multi-run target                                               |
+| Success | `Exec.Result` for a single tool run, `Outputs` for a producing build, a target-specific struct for a multi-run target                                           |
 | Error   | `Exec.ExecError` for tool runs, a `WriteFileError` or `DriftError` union for generators, `ReviewError` for `LlmLint`, `PackageManagerError` for `PnpmWorkspace` |
 
 The success value is what the result cache stores, clamped to what JSON can hold.
diff --git a/packages/build/docs/extending/writing-targets.md b/packages/build/docs/extending/writing-targets.md
index dcb623d6..19bbd0d8 100644
--- a/packages/build/docs/extending/writing-targets.md
+++ b/packages/build/docs/extending/writing-targets.md
@@ -35,16 +35,16 @@ export const Typecheck = Target.make("Typecheck", {
 
 ## Options
 
-| Option           | Required | Purpose                                                            |
-| ---------------- | -------- | ------------------------------------------------------------------ |
+| Option           | Required | Purpose                                                              |
+| ---------------- | -------- | -------------------------------------------------------------------- |
 | `attrs`          | Yes      | The target's attribute schema. It is also the flow's payload schema. |
 | `kinds`          | Yes      | Which verbs the target participates in. Deduplicated.                |
-| `implementation` | Yes      | The pure plan-time body: decoded attrs to a plan node.             |
-| `success`        | No       | The success schema. Defaults to `Schema.Void`.                     |
-| `error`          | No       | The error schema. Defaults to `Schema.Never`.                      |
-| `inputs`         | No       | Extra declared inputs derived from the decoded attrs.              |
-| `cache`          | No       | A boolean or a function of the decoded attrs. Defaults to `true`.  |
-| `attrsForKind`   | No       | Map the decoded attrs to what one verb executes with.              |
+| `implementation` | Yes      | The pure plan-time body: decoded attrs to a plan node.               |
+| `success`        | No       | The success schema. Defaults to `Schema.Void`.                       |
+| `error`          | No       | The error schema. Defaults to `Schema.Never`.                        |
+| `inputs`         | No       | Extra declared inputs derived from the decoded attrs.                |
+| `cache`          | No       | A boolean or a function of the decoded attrs. Defaults to `true`.    |
+| `attrsForKind`   | No       | Map the decoded attrs to what one verb executes with.                |
 
 ## The attrs schema
 
diff --git a/packages/build/docs/reference/cli.md b/packages/build/docs/reference/cli.md
index a46145b1..6fd4b413 100644
--- a/packages/build/docs/reference/cli.md
+++ b/packages/build/docs/reference/cli.md
@@ -241,9 +241,9 @@ Options: the [common options](#common-options) only.
 
 A bare label or pattern returns:
 
-| Field     | Description                                    |
-| --------- | ---------------------------------------------- |
-| `query`   | The expression as given                        |
+| Field     | Description                                      |
+| --------- | ------------------------------------------------ |
+| `query`   | The expression as given                          |
 | `targets` | One `{label, target, kinds}` per selected target |
 
 `deps(label)` returns:
@@ -292,7 +292,7 @@ Result:
 | `format`   | `"mermaid"` or `"text"`                  |
 | `graph`    | The rendered graph string                |
 | `roots`    | The root labels                          |
-| `targets`  | One `{label, target}` per planned target   |
+| `targets`  | One `{label, target}` per planned target |
 | `edges`    | `{from, to}` pairs                       |
 | `warnings` | Planner warnings; currently always empty |
 
@@ -321,8 +321,8 @@ Each planned target:
 | Field            | Description                                              |
 | ---------------- | -------------------------------------------------------- |
 | `label`          | The target's label                                       |
-| `target`           | The target id                                              |
-| `kinds`          | The verbs the target participates in                       |
+| `target`         | The target id                                            |
+| `kinds`          | The verbs the target participates in                     |
 | `attrs`          | The verb-effective attrs the executor passes to the flow |
 | `dependencies`   | Direct dependency labels                                 |
 | `declaredInputs` | One `{declaration, files, digest}` per declared input    |
@@ -359,7 +359,7 @@ Each report:
 | Field        | Description                          |
 | ------------ | ------------------------------------ |
 | `label`      | The target's label                   |
-| `target`       | The target id                          |
+| `target`     | The target id                        |
 | `status`     | `hit`, `ran`, `failed`, or `skipped` |
 | `durationMs` | Time spent on this target            |
 | `key`        | The content key                      |
diff --git a/packages/build/docs/reference/config.md b/packages/build/docs/reference/config.md
index 691d089d..92f79d31 100644
--- a/packages/build/docs/reference/config.md
+++ b/packages/build/docs/reference/config.md
@@ -16,10 +16,10 @@ internal CLI surface for normalization and declaration recognition, not a
 
 ## Options
 
-| Option           | Type      | Default    | Description                                                                                                      |
-| ---------------- | --------- | ---------- | ---------------------------------------------------------------------------------------------------------------- |
+| Option           | Type      | Default    | Description                                                                                                        |
+| ---------------- | --------- | ---------- | ------------------------------------------------------------------------------------------------------------------ |
 | `cacheDirectory` | `string`  | `".flows"` | A single workspace-relative directory holding the result cache and target scratch files. Normalized and validated. |
-| `gitignored`     | `boolean` | `false`    | Ask every command to keep a root `.gitignore` entry for the resolved directory.                                  |
+| `gitignored`     | `boolean` | `false`    | Ask every command to keep a root `.gitignore` entry for the resolved directory.                                    |
 
 Both are optional. `Workspace()` with no argument is valid and yields the
 defaults.
diff --git a/packages/build/docs/reference/targets/README.md b/packages/build/docs/reference/targets/README.md
index 8c127fa8..5ca4b207 100644
--- a/packages/build/docs/reference/targets/README.md
+++ b/packages/build/docs/reference/targets/README.md
@@ -27,7 +27,7 @@ exists for future additions and is unused. See
 
 ## Build
 
-| Target                           | Kinds   | Cacheable    | Status   | Summary                                                                        |
+| Target                         | Kinds   | Cacheable    | Status   | Summary                                                                        |
 | ------------------------------ | ------- | ------------ | -------- | ------------------------------------------------------------------------------ |
 | [TsBuild](ts-build.md)         | `build` | Never        | Executes | Builds a JavaScript distribution with `tsc -p` or `tsup`.                      |
 | [DtsBuild](dts-build.md)       | `build` | Never        | Executes | Emits type declarations with `tsc --emitDeclarationOnly` or `tsup --dts-only`. |
@@ -37,7 +37,7 @@ exists for future additions and is unused. See
 
 ## Test
 
-| Target                                 | Kinds  | Cacheable | Status   | Summary                                         |
+| Target                               | Kinds  | Cacheable | Status   | Summary                                         |
 | ------------------------------------ | ------ | --------- | -------- | ----------------------------------------------- |
 | [Vitest](vitest.md)                  | `test` | Never     | Executes | Runs `vitest run` over a declared test set.     |
 | [VitestCoverage](vitest-coverage.md) | `test` | Never     | Executes | Runs `vitest run` with coverage and thresholds. |
@@ -45,7 +45,7 @@ exists for future additions and is unused. See
 
 ## Lint
 
-| Target                           | Kinds  | Cacheable | Status   | Summary                                                                               |
+| Target                         | Kinds  | Cacheable | Status   | Summary                                                                               |
 | ------------------------------ | ------ | --------- | -------- | ------------------------------------------------------------------------------------- |
 | [EsLint](es-lint.md)           | `lint` | Never     | Executes | Runs ESLint over declared source sets with a flat config.                             |
 | [BiomeCheck](biome-check.md)   | `lint` | Never     | Executes | Runs `biome check` and `biome format` without writing files.                          |
@@ -55,7 +55,7 @@ exists for future additions and is unused. See
 
 ## Generation
 
-| Target                                    | Kinds           | Cacheable                          | Status   | Summary                                                                      |
+| Target                                  | Kinds           | Cacheable                          | Status   | Summary                                                                      |
 | --------------------------------------- | --------------- | ---------------------------------- | -------- | ---------------------------------------------------------------------------- |
 | [SortPackageJson](sort-package-json.md) | `build`, `lint` | Never                              | Executes | Validates or rewrites `package.json` key ordering.                           |
 | [PackageJson](package-json-gen.md)      | `lint` / `run`  | Check only                         | Executes | Expands a typed manifest declaration into check, write, and refresh targets. |
@@ -63,7 +63,7 @@ exists for future additions and is unused. See
 
 ## Documentation
 
-| Target                         | Kinds  | Cacheable | Status   | Summary                                                |
+| Target                       | Kinds  | Cacheable | Status   | Summary                                                |
 | ---------------------------- | ------ | --------- | -------- | ------------------------------------------------------ |
 | [DocsParity](docs-parity.md) | `docs` | Always    | Executes | Requires a substantive README beside a package's code. |
 
@@ -72,7 +72,7 @@ exists for future additions and is unused. See
 
 ## Install, release, and processes
 
-| Target                               | Kinds | Cacheable | Status                                  | Summary                                                            |
+| Target                             | Kinds | Cacheable | Status                                  | Summary                                                            |
 | ---------------------------------- | ----- | --------- | --------------------------------------- | ------------------------------------------------------------------ |
 | [PnpmWorkspace](pnpm-workspace.md) | `run` | Never     | Executes                                | Runs the smthrs install flow for a pnpm workspace.                 |
 | [NewPackage](new-package.md)       | `run` | Never     | Executes                                | Scaffolds one package named with the invocation's `--name` option. |
@@ -84,7 +84,7 @@ exists for future additions and is unused. See
 
 ## File sets
 
-| Target                      | Kinds | Cacheable | Status                   | Summary                                                       |
+| Target                    | Kinds | Cacheable | Status                   | Summary                                                       |
 | ------------------------- | ----- | --------- | ------------------------ | ------------------------------------------------------------- |
 | [Filegroup](filegroup.md) | none  | Always    | Executes as a dependency | Names a set of files under one label, composing transitively. |
 
@@ -103,13 +103,13 @@ under `build`, `test`, or `lint`. It is still addressable by label, listed by
 
 These modules are not targets. They are documented elsewhere.
 
-| Module            | Documented in                                                                                               |
-| ----------------- | ----------------------------------------------------------------------------------------------------------- |
-| `Target`            | [Writing targets](../../extending/writing-targets.md), [Targets and targets](../../concepts/targets.md) |
-| `Input`           | [Inputs](../../concepts/inputs.md)                                                                          |
-| `Exec`            | [Actions and boundaries](../../concepts/actions-and-boundaries.md)                                          |
-| `Workspace`       | [Workspace reference](../config.md)                                                                         |
-| `PackageDefaults` | [Default targets](../../extending/default-targets.md)                                                           |
+| Module            | Documented in                                                                                           |
+| ----------------- | ------------------------------------------------------------------------------------------------------- |
+| `Target`          | [Writing targets](../../extending/writing-targets.md), [Targets and targets](../../concepts/targets.md) |
+| `Input`           | [Inputs](../../concepts/inputs.md)                                                                      |
+| `Exec`            | [Actions and boundaries](../../concepts/actions-and-boundaries.md)                                      |
+| `Workspace`       | [Workspace reference](../config.md)                                                                     |
+| `PackageDefaults` | [Default targets](../../extending/default-targets.md)                                                   |
 
 ## Conventions shared by every tool-running target
 
diff --git a/packages/build/docs/reference/targets/standard-package.md b/packages/build/docs/reference/targets/standard-package.md
index 7ebf6d0a..050a9727 100644
--- a/packages/build/docs/reference/targets/standard-package.md
+++ b/packages/build/docs/reference/targets/standard-package.md
@@ -53,7 +53,7 @@ interface StandardTargets {
 }
 ```
 
-| Target  | Target         | Attributes                                                                                                                                         |
+| Target  | Target       | Attributes                                                                                                                                         |
 | ------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `lib`   | `TsBuild`    | `srcs: [sources]`, `entries: [file("src/index.ts")]`, `deps`, `tsconfig`, `tool: "tsc"`, `format: "dual"`, `outDir: "dist"`, `external: []`, `cwd` |
 | `check` | `Typecheck`  | `srcs: [sources, glob("test/**/*.ts")]`, `deps: [lib, ...deps]`, `tsconfig: testTsconfig`, `buildMode: false`, `incremental: false`, `cwd`         |
diff --git a/packages/build/docs/workspace/caching.md b/packages/build/docs/workspace/caching.md
index d1fc8eed..150414cf 100644
--- a/packages/build/docs/workspace/caching.md
+++ b/packages/build/docs/workspace/caching.md
@@ -8,12 +8,12 @@ cacheable target and stores the result after a green run.
 The planner builds four fields of key material for each target, encodes them
 deterministically, and takes the sha256 of the encoding.
 
-| Field          | Contents                                                                                                               |
-| -------------- | ---------------------------------------------------------------------------------------------------------------------- |
-| `body`         | The target's flow tag, its target id, its target implementation digest, its declared output roots, and `EXECUTION_FORMAT`  |
-| `inputs`       | The ambient identity, the canonicalized attrs, the expanded declared inputs, and the dependency labels with their keys |
-| `layers`       | A catalog-declared layer identity list                                                                                 |
-| `capabilities` | A catalog-declared capability list                                                                                     |
+| Field          | Contents                                                                                                                  |
+| -------------- | ------------------------------------------------------------------------------------------------------------------------- |
+| `body`         | The target's flow tag, its target id, its target implementation digest, its declared output roots, and `EXECUTION_FORMAT` |
+| `inputs`       | The ambient identity, the canonicalized attrs, the expanded declared inputs, and the dependency labels with their keys    |
+| `layers`       | A catalog-declared layer identity list                                                                                    |
+| `capabilities` | A catalog-declared capability list                                                                                        |
 
 ### The encoding is injective
 
@@ -46,7 +46,7 @@ Two substitutions happen inside `inputs.attrs` before hashing:
 
 `layers` and `capabilities` are hand-maintained tables in `packages/build-cli/src/Planner.ts`:
 
-| Target               | `layers`                   | `capabilities`                      |
+| Target             | `layers`                   | `capabilities`                      |
 | ------------------ | -------------------------- | ----------------------------------- |
 | `PnpmWorkspace`    | `["package-manager:pnpm"]` | `fs:read`, `fs:write`, `proc:spawn` |
 | `LlmLint`          | `["model:<model attr>"]`   | `git:diff`, `model:call`            |
@@ -101,12 +101,12 @@ boolean or a function of decoded attrs. This fails safe for custom targets and f
 catalog targets that invoke an external tool whose complete toolchain identity is
 not yet key material.
 
-| Target                                          | Cacheable                                                        |
+| Target                                        | Cacheable                                                        |
 | --------------------------------------------- | ---------------------------------------------------------------- |
 | `DocsParity`, `Filegroup`, `PackageJsonCheck` | Always; each is a bounded in-process check over declared content |
 | `GithubCiGen`                                 | In `contract` and `check` modes; never in `write` mode           |
 | `ToolBuild`                                   | Only when its declaration sets `cache: true`                     |
-| Every other catalog target                      | Never                                                            |
+| Every other catalog target                    | Never                                                            |
 
 Mutation, long-lived processes, model calls, and external publication are never
 cached. External compiler, test, and lint targets also remain non-cacheable until
diff --git a/packages/build/docs/workspace/running-targets.md b/packages/build/docs/workspace/running-targets.md
index f645d0e3..2fd05153 100644
--- a/packages/build/docs/workspace/running-targets.md
+++ b/packages/build/docs/workspace/running-targets.md
@@ -57,7 +57,7 @@ The executor gives each target its own in-memory runtime and provides:
 The irreversible-exec implementation is intentionally absent. A target that
 calls it fails at interpretation with `unresolved_action`.
 
-| Target                                                           | Root verb       | Executes today                                            |
+| Target                                                         | Root verb       | Executes today                                            |
 | -------------------------------------------------------------- | --------------- | --------------------------------------------------------- |
 | `TsBuild`, `DtsBuild`, `Typecheck`, `ToolBuild`, `TypedocDocs` | `build`         | Yes                                                       |
 | `Vitest`, `VitestCoverage`                                     | `test`          | Yes                                                       |
diff --git a/packages/build/docs/workspace/structure.md b/packages/build/docs/workspace/structure.md
index 83e9506a..ebd62398 100644
--- a/packages/build/docs/workspace/structure.md
+++ b/packages/build/docs/workspace/structure.md
@@ -152,10 +152,10 @@ workspace-level declarations are in scope. See
 Two directories are never part of the workspace as far as discovery, globs, and
 digests are concerned.
 
-| Path                                              | What it holds                                                                                           | Configurable                              |
-| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ----------------------------------------- |
+| Path                                              | What it holds                                                                                             | Configurable                              |
+| ------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | ----------------------------------------- |
 | The resolved cache directory, `.flows` by default | The CLI result cache under `<cacheDirectory>/cache`, and target scratch such as the generated knip config | Yes, through `Workspace` or `--cache-dir` |
-| `.flows/store/<manager>`                          | Package-manager store populated by fetch                                                                | No                                        |
+| `.flows/store/<manager>`                          | Package-manager store populated by fetch                                                                  | No                                        |
 
 The store stays fixed because fetch declares it as a `TreeArtifact` boundary, and
 a declared boundary is key material that must mean the same thing on every
diff --git a/packages/build/infra/turbo.json b/packages/build/infra/turbo.json
new file mode 100644
index 00000000..de7392e8
--- /dev/null
+++ b/packages/build/infra/turbo.json
@@ -0,0 +1,51 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "tooling"
+  ],
+  "tasks": {
+    "check": {
+      "inputs": [
+        "alchemy.run.ts",
+        "worker/**",
+        "scripts/**",
+        "tsconfig.json",
+        "package.json"
+      ],
+      "outputs": []
+    },
+    "test": {
+      "inputs": [
+        "worker/**",
+        "scripts/**",
+        "vitest.config.ts",
+        "tsconfig.json",
+        "package.json"
+      ],
+      "outputs": []
+    },
+    "deploy": {
+      "cache": false,
+      "interactive": true,
+      "outputs": [],
+      "passThroughEnv": [
+        "SMITHERS_CACHE_TOKEN",
+        "CLOUDFLARE_API_TOKEN",
+        "CLOUDFLARE_ACCOUNT_ID"
+      ]
+    },
+    "deploy:dev": {
+      "cache": false,
+      "interactive": true,
+      "outputs": [],
+      "passThroughEnv": [
+        "SMITHERS_CACHE_TOKEN",
+        "CLOUDFLARE_API_TOKEN",
+        "CLOUDFLARE_ACCOUNT_ID"
+      ]
+    }
+  }
+}
diff --git a/packages/build/turbo.json b/packages/build/turbo.json
new file mode 100644
index 00000000..b6d883a5
--- /dev/null
+++ b/packages/build/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "tooling"
+  ]
+}
diff --git a/packages/canonical/turbo.json b/packages/canonical/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/canonical/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/capability/turbo.json b/packages/capability/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/capability/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/chain/turbo.json b/packages/chain/turbo.json
new file mode 100644
index 00000000..f061023f
--- /dev/null
+++ b/packages/chain/turbo.json
@@ -0,0 +1,12 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": ["//"],
+  "tags": ["agent"],
+  "tasks": {
+    "prompts": {
+      "inputs": ["prompts/*.mdx", "scripts/prompts.mjs"],
+      "outputs": [],
+      "cache": false
+    }
+  }
+}
diff --git a/packages/cli/turbo.json b/packages/cli/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/cli/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/control/turbo.json b/packages/control/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/control/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/core/turbo.json b/packages/core/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/core/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/crypto/turbo.json b/packages/crypto/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/crypto/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/database/README.md b/packages/database/README.md
index 0c4272d4..7d331132 100644
--- a/packages/database/README.md
+++ b/packages/database/README.md
@@ -15,8 +15,8 @@ The root is the driver-neutral contract and bundles for the browser. The drivers
 are Node-only — `node:sqlite` through `@effect/sql-sqlite-node` — so they live
 under explicit subpaths.
 
-| Import                                    | Public exports                                                                                                                                                                                                                                                                                         |
-| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Import                               | Public exports                                                                                                                                                                                                                                                                                         |
+| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | `@smthrs/database`                   | `DurableWriter` and `Service` expose transaction-scoped `write(effect)`. `DatabaseErrorCode`, `DatabaseError`, and `fromSqlError` normalize driver failures. `make` builds over a SQL client; `layer` composes over the context's `SqlClient`; `makeNoop` and `layerNoop` provide an unsupported stub. |
 | `@smthrs/database/node/NodeDatabase` | **Node only.** `NodeDatabaseOptions` configures the SQLite connection; `layer(options)` provides Effect's `SqlClient`.                                                                                                                                                                                 |
 | `@smthrs/database/test/TestDatabase` | **Node only.** `layer` provides the production Node client and the writer over a fresh `:memory:` database.                                                                                                                                                                                            |
diff --git a/packages/database/turbo.json b/packages/database/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/database/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/engine-harness/turbo.json b/packages/engine-harness/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/engine-harness/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/engine-store/README.md b/packages/engine-store/README.md
index 942657aa..fc8a3101 100644
--- a/packages/engine-store/README.md
+++ b/packages/engine-store/README.md
@@ -33,17 +33,17 @@ The root exports these namespaces; each is also available from its matching
 | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `DurableEngineState` | `DurableEngineState` / `Service` persist deferreds, clocks, and parked-run state through `deferred`, `completeDeferred`, `clock`, `scheduleClock`, `completeClock`, `dueClocks`, `completedDeferreds`, `park`, `wake`, `waiting`, and `waitingRuns`. Address/row types are `DeferredAddress`, `DeferredRow`, `ClockAddress`, `ClockRow`, `Waiting`, `WaitingRow`, and `WaitingRunsFilter`; outcome types are `CompleteDeferredOutcome`, `ScheduleClockOutcome`, `CompleteClockOutcome`, `ParkOutcome`, and `WakeOutcome`; `WaitingReason` is the open wait taxonomy. `make` / `layer` use `DurableWriter`; `makeMemory` / `layerMemory` are deterministic in-memory variants. |
 | `EngineStore`        | `Options` configures owner identity, journal source, liveness probing, and the optional `clockFireRetryPolicy` (defaults to exponential from 100ms capped at 30s, forever). `make` builds the service and `layer` provides `FlowEngine` plus `SnapshotBoundary`; `EngineCompositionError` is the stable composition error.                                                                                                                                                                                                                                                                                                                                                    |
-| `StepBoundary`       | `PreparedBoundary`, `BoundaryDeviation`, `BoundaryEvidence`, `Service`, and `StepBoundary`; errors `UndeclaredWrite`, `UnsupportedBoundary`, and `BoundaryCorruption`; production and test layers. The shared declaration types `FileBoundary`, `BoundaryMode`, and `FileInput` live in `@smthrs/flow`'s `Action` namespace.                                                                                                                                                                                                                                                                                                                                             |
+| `StepBoundary`       | `PreparedBoundary`, `BoundaryDeviation`, `BoundaryEvidence`, `Service`, and `StepBoundary`; errors `UndeclaredWrite`, `UnsupportedBoundary`, and `BoundaryCorruption`; production and test layers. The shared declaration types `FileBoundary`, `BoundaryMode`, and `FileInput` live in `@smthrs/flow`'s `Action` namespace.                                                                                                                                                                                                                                                                                                                                                  |
 | `WorkspaceSandbox`   | The functional workspace transaction. Models `Resource`, `InputObservation`, `OutputObservation`, `Provenance`, `FileChange`, `QueuedEffect`, `WorkflowResult`, `Execution`, `DeclarationViolation`, `CacheDisposition`, `Accepted` / `Invalidated` / `ExecutionResult`, and `Host`; services `Workspace` (the in-transaction filesystem and effect outbox) and `EffectDispatcher`; errors `WorkspaceError` and `MaterializationConflict`; the `violations` accessor; `make` / `layer`, `makeHosted`, `makeMemory` (deterministic, browser-safe), and `makeFileSystem` / `layerFileSystem` / `layerDispatcher`.                                                               |
-| `PlanScheduler`      | Drives a persisted `@smthrs/plan` `Plan`. `Options` configures the run, the admission caps (`concurrency.steps` / `concurrency.agents`, both defaulting to unbounded and both flooring at one), and the `rebaseLimit`; `make` / `layer` build the `Service` (`record`, `append`, `run`) and `PlanScheduler` is its tag. `NodeExecutor` / `Executor` / `layerExecutor` are the DI seam that turns a `NodeInput` into work, `Outcome` is the four-way evaluation result, `Settlement` and `Report` are what a run reports, `Requirements` is what driving one needs, and `SchedulerError` is the scheduler's own refusal.                                                  |
+| `PlanScheduler`      | Drives a persisted `@smthrs/plan` `Plan`. `Options` configures the run, the admission caps (`concurrency.steps` / `concurrency.agents`, both defaulting to unbounded and both flooring at one), and the `rebaseLimit`; `make` / `layer` build the `Service` (`record`, `append`, `run`) and `PlanScheduler` is its tag. `NodeExecutor` / `Executor` / `layerExecutor` are the DI seam that turns a `NodeInput` into work, `Outcome` is the four-way evaluation result, `Settlement` and `Report` are what a run reports, `Requirements` is what driving one needs, and `SchedulerError` is the scheduler's own refusal.                                                       |
 | `Reconciliation`     | The pluggable seam that answers a `Deviation` or a `Conflict` with a `Verdict` (`Fail` / `Reorder` / `FactorOut`). `Reconciliation` / `Service` are the tag and shape; `make` / `layer` install one; `makeDefault` / `layerDefault` are the deterministic default. It is the first consumer `flows.engine.expected-set-deviation` has had.                                                                                                                                                                                                                                                                                                                                    |
 | `Selection`          | The advisory seam that guesses which sink nodes are safe to postpone and which flows a plan is missing. `SuspectedEdge`, `BeliefSnapshot`, `Candidate`, and the `Verdict` union (`Admit` / `Defer` / `Propose`) are its schemas; `Selection` / `Service` are the tag and shape; `select` returns one verdict per candidate. `layerNoop` admits everything; `layerHeuristic` is the pure glob-match default with optional failure-history stats. `DebtEntry`, `debt`, `card`, `risk`, and `proposeReadSet` are the v2 recertification and presentation helpers; the `recertify` driver ships on `PlanScheduler`, which owns scheduling.                                        |
 | `SelectionStore`     | The durable suspected-edge store. `SelectionStore` / `Service` expose `upsert`, `list`, `snapshot`, and `train`; `make` / `layer` persist through this package's migration set. `snapshot` pins the injected clock, and `train` applies the asymmetric hit/miss confidence rule without creating unknown edges.                                                                                                                                                                                                                                                                                                                                                               |
-| `ArtifactGc`         | Explicit mark/sweep garbage collection for the artifact store. `ArtifactGc` / `Service` expose `gc(options)`; `GcOptions` / `GcReport` are its contract; `ArtifactGcPolicy` / `Policy` / `layerPolicy` are the opt-in policy seam (grace bound, pinned digests — configures, never schedules); `defaultGraceMs` is git's two-week prune default; `ArtifactGcError` carries `mark_failed` / `sweep_failed`; `make` / `MakeOptions` / `layer` need `SqlClient` and `@smthrs/artifacts`'s `ArtifactSweep`.                                                                                                                                                                  |
+| `ArtifactGc`         | Explicit mark/sweep garbage collection for the artifact store. `ArtifactGc` / `Service` expose `gc(options)`; `GcOptions` / `GcReport` are its contract; `ArtifactGcPolicy` / `Policy` / `layerPolicy` are the opt-in policy seam (grace bound, pinned digests — configures, never schedules); `defaultGraceMs` is git's two-week prune default; `ArtifactGcError` carries `mark_failed` / `sweep_failed`; `make` / `MakeOptions` / `layer` need `SqlClient` and `@smthrs/artifacts`'s `ArtifactSweep`.                                                                                                                                                                       |
 | `Inconsistency`      | `Inconsistency` / `Service` receive `CacheConflict` and return `InconsistencyVerdict`. `MakeOptions`, `make`, `makeNoop`, and `layerNoop` build receivers; `layerStrict` journals and returns `"fail"`, while `layerTolerant` journals and returns `"tolerate"`.                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `OwnerIdentity`      | `OwnerIdentity` / `Service` mint the `OwnerId` an incarnation fences its writes with. `make` builds one from an implementation, `makeDefault` / `layer` supply the platform default, and `layerConstant(owner)` pins a fixed identity for a test or a host that already holds a lease.                                                                                                                                                                                                                                                                                                                                                                                        |
 | `RunState`           | The versioned run-state envelope schema the engine stores in each run row.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `Migrations`         | `set` is this package's own `MigrationSet`; `sets` is the composed, dependency-ordered list an engine installs; `run` and `layer` execute it through `@smthrs/database`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `Migrations`         | `set` is this package's own `MigrationSet`; `sets` is the composed, dependency-ordered list an engine installs; `run` and `layer` execute it through `@smthrs/database`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `Errors`             | Stable `FlowCycleDetected`, `AttemptAdmissionRejected`, and `CacheConflictDetected` errors.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 
 ```ts
diff --git a/packages/engine-store/src/Inconsistency.ts b/packages/engine-store/src/Inconsistency.ts
index 9991085f..c5231df1 100644
--- a/packages/engine-store/src/Inconsistency.ts
+++ b/packages/engine-store/src/Inconsistency.ts
@@ -97,9 +97,7 @@ export interface Service {
  * @category services
  * @since 0.1.0
  */
-export class Inconsistency
-  extends Context.Service<Inconsistency, Service>()("@smthrs/engine-store/Inconsistency")
-{}
+export class Inconsistency extends Context.Service<Inconsistency, Service>()("@smthrs/engine-store/Inconsistency") {}
 
 /**
  * Options for constructing a journaling inconsistency receiver.
diff --git a/packages/engine-store/src/OwnerIdentity.ts b/packages/engine-store/src/OwnerIdentity.ts
index 0ad1ca5c..8cb09bf2 100644
--- a/packages/engine-store/src/OwnerIdentity.ts
+++ b/packages/engine-store/src/OwnerIdentity.ts
@@ -40,9 +40,7 @@ export interface Service {
  * @category services
  * @since 0.1.0
  */
-export class OwnerIdentity
-  extends Context.Service<OwnerIdentity, Service>()("@smthrs/engine-store/OwnerIdentity")
-{}
+export class OwnerIdentity extends Context.Service<OwnerIdentity, Service>()("@smthrs/engine-store/OwnerIdentity") {}
 
 /**
  * Constructs an owner identity source from an implementation.
diff --git a/packages/engine-store/src/PlanScheduler.ts b/packages/engine-store/src/PlanScheduler.ts
index 3f671fba..ce5880b8 100644
--- a/packages/engine-store/src/PlanScheduler.ts
+++ b/packages/engine-store/src/PlanScheduler.ts
@@ -320,9 +320,7 @@ export interface Service {
  * @since 0.1.0
  * @category services
  */
-export class PlanScheduler
-  extends Context.Service<PlanScheduler, Service>()("@smthrs/engine-store/PlanScheduler")
-{}
+export class PlanScheduler extends Context.Service<PlanScheduler, Service>()("@smthrs/engine-store/PlanScheduler") {}
 
 /**
  * The declared digest handed to `StepBoundary.prepare` when the scheduler is
diff --git a/packages/engine-store/src/Reconciliation.ts b/packages/engine-store/src/Reconciliation.ts
index 73815f2e..6bf2a42b 100644
--- a/packages/engine-store/src/Reconciliation.ts
+++ b/packages/engine-store/src/Reconciliation.ts
@@ -125,9 +125,7 @@ export interface Service {
  * @since 0.1.0
  * @category services
  */
-export class Reconciliation
-  extends Context.Service<Reconciliation, Service>()("@smthrs/engine-store/Reconciliation")
-{}
+export class Reconciliation extends Context.Service<Reconciliation, Service>()("@smthrs/engine-store/Reconciliation") {}
 
 /**
  * Names a {@link Service} implementation as a reconciler.
diff --git a/packages/engine-store/turbo.json b/packages/engine-store/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/engine-store/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/engine/README.md b/packages/engine/README.md
index 320d2fde..4443fff0 100644
--- a/packages/engine/README.md
+++ b/packages/engine/README.md
@@ -39,11 +39,11 @@ The root exports these namespaces, also available from matching
 `@smthrs/engine/*` subpaths. The flow-authoring namespaces live in
 [`@smthrs/flow`](../flow/README.md).
 
-| Namespace         | Public exports                                                                                                                                                                                                                                                                                       |
-| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Namespace         | Public exports                                                                                                                                                                                                                                                                                  |
+| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `FlowEngine`      | Implementation boundary `Encoded` and `ActionExecuteOptions`; `makeUnsafe`, which adapts an `Encoded` implementation into `@smthrs/flow`'s `FlowRuntime`; in-memory `layerMemory`; per-run state constructor `makeInstance`; compensable-step `SnapshotBoundaryOptions` and `SnapshotBoundary`. |
-| `FlowProxy`       | `toRpcGroup` / `ConvertRpcs` and `toHttpApiGroup` / `ConvertHttpApi` derive execute, discard, and resume transports from flows.                                                                                                                                                                      |
-| `FlowProxyServer` | `layerRpcHandlers`, `layerHttpApi`, and `RpcHandlers` implement the derived transports.                                                                                                                                                                                                              |
+| `FlowProxy`       | `toRpcGroup` / `ConvertRpcs` and `toHttpApiGroup` / `ConvertHttpApi` derive execute, discard, and resume transports from flows.                                                                                                                                                                 |
+| `FlowProxyServer` | `layerRpcHandlers`, `layerHttpApi`, and `RpcHandlers` implement the derived transports.                                                                                                                                                                                                         |
 
 ## Reference implementation
 
diff --git a/packages/engine/turbo.json b/packages/engine/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/engine/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/evals/turbo.json b/packages/evals/turbo.json
new file mode 100644
index 00000000..91b83665
--- /dev/null
+++ b/packages/evals/turbo.json
@@ -0,0 +1,11 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": ["//"],
+  "tags": ["agent"],
+  "tasks": {
+    "score-gate": {
+      "inputs": ["src/**", "scripts/**", "test/**", "tsconfig.json", "package.json"],
+      "outputs": []
+    }
+  }
+}
diff --git a/packages/flow/turbo.json b/packages/flow/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/flow/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/flows/README.md b/packages/flows/README.md
index 2b7eb54f..dde3a8ea 100644
--- a/packages/flows/README.md
+++ b/packages/flows/README.md
@@ -15,8 +15,8 @@ import { Engine, EngineStore, Journal, Kernel } from "@smthrs/flows"
 
 ## Public API
 
-| Namespace                                                                                                         | Re-exported package                                        |
-| ----------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
+| Namespace                                                                                                         | Re-exported package                                   |
+| ----------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- |
 | `Canonical`                                                                                                       | `@smthrs/canonical`                                   |
 | `Capability`                                                                                                      | `@smthrs/capability`                                  |
 | `Crypto`                                                                                                          | `@smthrs/crypto`                                      |
diff --git a/packages/flows/test/vitestCoverageIsolation.test.ts b/packages/flows/test/vitestCoverageIsolation.test.ts
index 7e0a923c..2660f66e 100644
--- a/packages/flows/test/vitestCoverageIsolation.test.ts
+++ b/packages/flows/test/vitestCoverageIsolation.test.ts
@@ -323,18 +323,32 @@ describe("vitest coverage isolation conformance", () => {
     //
     // `checklist` similarly enters the UI workspace's launch checklist. It is
     // an operator-facing release check, not a package test fan-out.
+    //
+    // `docs`, `test:scripts`, and the three `cargo:*` entries are the root
+    // gates the Turborepo graph addresses as `//#` root tasks (see
+    // turbo.json): docs parity, the five `node --test scripts/*.test.mjs`
+    // gates as one invocation, and the pinned-toolchain cargo fmt/clippy/test
+    // gates. They add enforcement paths; they remove none. `docs` invokes the
+    // build CLI from source because the published `smthrs` bin name no longer
+    // exists on main.
     const root = JSON.parse(readFileSync(join(packagesDir, "..", "package.json"), "utf8")) as {
       readonly scripts?: Record<string, string>
     }
     expect(root.scripts).toEqual({
       browser: "node scripts/browser-check.mjs",
+      "cargo:clippy": "cargo clippy --all-targets --locked -- -D warnings",
+      "cargo:fmt": "cargo fmt --check",
+      "cargo:test": "cargo test --locked",
       check: "pnpm --recursive --if-present run check",
       checklist: "pnpm --filter smithers-ui run checklist",
       circular: "pnpm --recursive --if-present run circular",
       "deploy:dry": "pnpm --filter smithers-server run deploy:dry",
+      docs: "node packages/build-cli/src/main.js docs '//...'",
       lint: "pnpm --recursive --if-present run lint",
       test: "pnpm --recursive --if-present run test",
-      "test:examples": "pnpm --filter @smthrs/examples run test"
+      "test:examples": "pnpm --filter @smthrs/examples run test",
+      "test:scripts":
+        "node --test scripts/pack-release.test.mjs scripts/release-rehearsal.test.mjs scripts/set-release-version.test.mjs scripts/flows-backup.test.mjs scripts/check-test-pins.test.mjs"
     })
   })
 
diff --git a/packages/flows/turbo.json b/packages/flows/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/flows/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/fs/turbo.json b/packages/fs/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/fs/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/gateway/turbo.json b/packages/gateway/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/gateway/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/harness/turbo.json b/packages/harness/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/harness/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/jj/README.md b/packages/jj/README.md
index bf213d60..9adf43e7 100644
--- a/packages/jj/README.md
+++ b/packages/jj/README.md
@@ -15,8 +15,8 @@ error, and the no-op layer only. Every implementation lives under an explicit
 subpath, the way `effect` keeps `@effect/platform-node` out of `effect`, so
 importing the contract never resolves a `node:` built-in.
 
-| Import                              | Platform                                            |
-| ----------------------------------- | --------------------------------------------------- |
+| Import                         | Platform                                            |
+| ------------------------------ | --------------------------------------------------- |
 | `@smthrs/jj`                   | any — contract only; bundles for the browser        |
 | `@smthrs/jj/browser/BrowserJj` | browser — jj-lib compiled to WASM over a virtual FS |
 | `@smthrs/jj/node/NodeJj`       | Node (`node:child_process`)                         |
@@ -28,7 +28,7 @@ importing the contract never resolves a `node:` built-in.
 
 | Export                              | Meaning                                                                  |
 | ----------------------------------- | ------------------------------------------------------------------------ |
-| `Jj`                                | The service interface and its tag (`@smthrs/jj/Jj`).                |
+| `Jj`                                | The service interface and its tag (`@smthrs/jj/Jj`).                     |
 | `ChangeId`                          | The durable handle a run uses to name workspace state.                   |
 | `JjErrorCode`, `JjError`, `jjError` | The closed failure vocabulary and its constructor.                       |
 | `make`, `makeNoop`, `layerNoop`     | Complete, stubbed, and layered service construction.                     |
diff --git a/packages/jj/turbo.json b/packages/jj/turbo.json
new file mode 100644
index 00000000..c28acece
--- /dev/null
+++ b/packages/jj/turbo.json
@@ -0,0 +1,19 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": ["//"],
+  "tags": ["engine"],
+  "tasks": {
+    "build:wasm": {
+      "inputs": [
+        "../../crates/flows-jj/**",
+        "../../Cargo.toml",
+        "../../Cargo.lock",
+        "../../rust-toolchain.toml",
+        "../../vendor/jj/**"
+      ],
+      "outputs": ["wasm/flows_jj.wasm"],
+      "cache": false,
+      "passThroughEnv": ["CARGO_TARGET_DIR", "CARGO_HOME", "RUSTUP_HOME", "RUSTUP_TOOLCHAIN"]
+    }
+  }
+}
diff --git a/packages/journal/README.md b/packages/journal/README.md
index 0849d5cd..86957511 100644
--- a/packages/journal/README.md
+++ b/packages/journal/README.md
@@ -32,24 +32,24 @@ pnpm add @smthrs/journal
 The root exports these namespaces, also available from matching
 `@smthrs/journal/*` subpaths.
 
-| Namespace      | Public exports                                                                                                                                                                                                                  |
-| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `JournalEvent` | Branded schema/types `RunId`, `Seq`, `SourceId`, and `SourceSeq`; input/committed schemas `Input` and `Entry`; deterministic `makeEventId`.                                                                                     |
-| `Journal`      | `Journal` / `Service` operations `emitLossy`, `emitDurable`, `transact`, `stream`, `entries`, `changes`, `project`, and `flush`; typed errors, receipts, and read options; constructors and no-op layer.                        |
-| `SqlJournal`   | `SqlJournalOptions` and database-backed `layer(options)` with explicit lossy and durable channels.                                                                                                                              |
-| `Projection`   | Reproducible `Projection` model and identity constructor `make`.                                                                                                                                                                |
-| `Redaction`    | The payload redaction applied to journal entries before they are written.                                                                                                                                                       |
+| Namespace      | Public exports                                                                                                                                                                                                             |
+| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `JournalEvent` | Branded schema/types `RunId`, `Seq`, `SourceId`, and `SourceSeq`; input/committed schemas `Input` and `Entry`; deterministic `makeEventId`.                                                                                |
+| `Journal`      | `Journal` / `Service` operations `emitLossy`, `emitDurable`, `transact`, `stream`, `entries`, `changes`, `project`, and `flush`; typed errors, receipts, and read options; constructors and no-op layer.                   |
+| `SqlJournal`   | `SqlJournalOptions` and database-backed `layer(options)` with explicit lossy and durable channels.                                                                                                                         |
+| `Projection`   | Reproducible `Projection` model and identity constructor `make`.                                                                                                                                                           |
+| `Redaction`    | The payload redaction applied to journal entries before they are written.                                                                                                                                                  |
 | `OwnerId`      | `OwnerId` — `hostId`, `pid`, `nonce` — the fencing token `emitDurable` accepts. Defined here because the journal is what it fences; `@smthrs/run-store`'s `Ownership` re-exports it alongside the arbitration built on it. |
-| `Migrations`   | `set` (the namespaced migration set for `flows_journal_events`), `run`, and prerequisite `layer`.                                                                                                                               |
+| `Migrations`   | `set` (the namespaced migration set for `flows_journal_events`), `run`, and prerequisite `layer`.                                                                                                                          |
 
 The root is written against the driver-neutral `@smthrs/database` contract
 and bundles for the browser. The test doubles bind a Node SQLite database, so
 they live under explicit subpaths:
 
-| Import                                  | Public exports                                                                                                                                                                                                                                                                                     |
-| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Import                             | Public exports                                                                                                                                                                                                                                                                      |
+| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `@smthrs/journal/test/TestJournal` | **Node only.** `TestJournalOptions` and `layer(options?)`, providing a migrated in-memory `Journal`. `@smthrs/run-store/test/TestRunStore` and `@smthrs/step-cache/test/TestCacheStore` provide theirs; `@smthrs/engine-store/test/TestStores` provides all four over ONE database. |
-| `@smthrs/journal/test/Notifying`   | `Order`, `Hook`, `wrap`, and `layer` inject before/after notifications around Effect-valued service operations.                                                                                                                                                                                    |
+| `@smthrs/journal/test/Notifying`   | `Order`, `Hook`, `wrap`, and `layer` inject before/after notifications around Effect-valued service operations.                                                                                                                                                                     |
 
 The single `migrations/0001_initial` module creates this package's table.
 `Migrations.run` and `Migrations.layer` install it alone; an application that
diff --git a/packages/journal/turbo.json b/packages/journal/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/journal/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/kernel/README.md b/packages/kernel/README.md
index f69e5a38..51073377 100644
--- a/packages/kernel/README.md
+++ b/packages/kernel/README.md
@@ -23,22 +23,22 @@ also available from its matching `@smthrs/kernel/*` subpath; `Capability` and
 their deep imports are `@smthrs/capability/Capability` and
 `@smthrs/capability/Permission`.
 
-| Namespace             | Public exports                                                                                                                                                                                                                                                                                                                                                                                                            |
-| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Namespace             | Public exports                                                                                                                                                                                                                                                                                                                                                                                                       |
+| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `Capability`          | Re-export of [`@smthrs/capability/Capability`](../capability/README.md): `Action`, exact `Capability`, `PatternAction`, and `CapabilityPattern`; `make`, `format`, `formatPattern`, `parse`, `matches`, and `subsumes`; `EffectTier`, `TierOptions`, `tierOf`, and `requiresIdempotencyKey`.                                                                                                                         |
-| `CapabilitySet`       | `CapabilitySet`; `fromPatterns`, empty authority `none`, `allows`, `intersect`, `equals`, ambient `current`, and monotone `attenuate`. No widening constructor or unrestricted value is public.                                                                                                                                                                                                                           |
+| `CapabilitySet`       | `CapabilitySet`; `fromPatterns`, empty authority `none`, `allows`, `intersect`, `equals`, ambient `current`, and monotone `attenuate`. No widening constructor or unrestricted value is public.                                                                                                                                                                                                                      |
 | `Permission`          | Re-export of [`@smthrs/capability/Permission`](../capability/README.md): `PermissionRequired`, `PermissionDenied`, `GrantStoreErrorCode`, `GrantStoreError`, and the `PermissionError` union; policy `RuleEffect`, `Rule`, and `evaluate`; constructors `permissionRequired` and `permissionDenied`; `isPermissionError`, `formatError`, and the `PlatformError` projection `toPlatformError` / `fromPlatformError`. |
-| `GrantEvent`          | `GrantTier`, `GrantScope`, `OnceGrant`, `RememberedGrant`, `RunGrant`, `DeniedGrant`, `EnvelopeGrant`, `GrantEventSchema`, `GrantEvent`, `decode`, and `encode`.                                                                                                                                                                                                                                                          |
-| `GrantStore`          | `PendingRequest`, `Resolution`, `EnvelopeGrantOptions`, `Persist`, and `MakeOptions`; `Service` / `GrantStore` operations `check`, `reply`, `list`, and `grantEnvelope`; `isValidGrantPattern`, `isValidEnvelopePattern`, `make`, `layer`, allow-all `makeNoop`, and `layerNoop`.                                                                                                                                         |
-| `JournalGrantStore`   | `JournalGrantStoreOptions`; `make` and `layer` replay and persist grants through `Journal`.                                                                                                                                                                                                                                                                                                                               |
-| `HostServices`        | The one closed list: `HostService`, `HostServiceTags`, `HostServiceIds`, `HostBuiltinNames`, and aggregate decorator `layer`. Each slot is decorated in place, so there is no second tag list.                                                                                                                                                                                                                            |
-| `FileSystem`          | `canonicalResource`, the atomic-host extension, isolated-volume attestation, and decorator `layer` over Effect's own `FileSystem` tag. Path operations run only through a descriptor-relative/no-follow executor or an enforceably isolated filesystem; unsupported hosts fail closed with a typed permission error.                                                                                                      |
-| `HttpClient`          | Decorator `layer` over Effect's own `HttpClient` tag; the tag and `make` are re-exported unchanged, plus the `ModelCall` reference and `withModelCall`, the `toHttpClientError` / `fromHttpClientError` projection, and a `makeNoop` / `layerNoop` stub that reports the missing host as a `TransportError`.                                                                                                              |
-| `ChildProcessSpawner` | Decorator `layer` over Effect's own `ChildProcessSpawner` tag; the tag and `make` are re-exported unchanged, plus a `makeNoop` / `layerNoop` stub that reports the missing host as a `NotFound` `PlatformError`.                                                                                                                                                                                                          |
-| `CommandLine`         | `render`, `quote`, `cwd`, and `env` — one renderer shared by the `proc:spawn` capability resource and by the interpreters that execute the line.                                                                                                                                                                                                                                                                          |
+| `GrantEvent`          | `GrantTier`, `GrantScope`, `OnceGrant`, `RememberedGrant`, `RunGrant`, `DeniedGrant`, `EnvelopeGrant`, `GrantEventSchema`, `GrantEvent`, `decode`, and `encode`.                                                                                                                                                                                                                                                     |
+| `GrantStore`          | `PendingRequest`, `Resolution`, `EnvelopeGrantOptions`, `Persist`, and `MakeOptions`; `Service` / `GrantStore` operations `check`, `reply`, `list`, and `grantEnvelope`; `isValidGrantPattern`, `isValidEnvelopePattern`, `make`, `layer`, allow-all `makeNoop`, and `layerNoop`.                                                                                                                                    |
+| `JournalGrantStore`   | `JournalGrantStoreOptions`; `make` and `layer` replay and persist grants through `Journal`.                                                                                                                                                                                                                                                                                                                          |
+| `HostServices`        | The one closed list: `HostService`, `HostServiceTags`, `HostServiceIds`, `HostBuiltinNames`, and aggregate decorator `layer`. Each slot is decorated in place, so there is no second tag list.                                                                                                                                                                                                                       |
+| `FileSystem`          | `canonicalResource`, the atomic-host extension, isolated-volume attestation, and decorator `layer` over Effect's own `FileSystem` tag. Path operations run only through a descriptor-relative/no-follow executor or an enforceably isolated filesystem; unsupported hosts fail closed with a typed permission error.                                                                                                 |
+| `HttpClient`          | Decorator `layer` over Effect's own `HttpClient` tag; the tag and `make` are re-exported unchanged, plus the `ModelCall` reference and `withModelCall`, the `toHttpClientError` / `fromHttpClientError` projection, and a `makeNoop` / `layerNoop` stub that reports the missing host as a `TransportError`.                                                                                                         |
+| `ChildProcessSpawner` | Decorator `layer` over Effect's own `ChildProcessSpawner` tag; the tag and `make` are re-exported unchanged, plus a `makeNoop` / `layerNoop` stub that reports the missing host as a `NotFound` `PlatformError`.                                                                                                                                                                                                     |
+| `CommandLine`         | `render`, `quote`, `cwd`, and `env` — one renderer shared by the `proc:spawn` capability resource and by the interpreters that execute the line.                                                                                                                                                                                                                                                                     |
 | `Jj`                  | Decorator `layer` over `@smthrs/jj`'s own `Jj` tag; the tag, `make`, `makeNoop`, and `layerNoop` are re-exported unchanged.                                                                                                                                                                                                                                                                                          |
-| `Path`                | Effect `Path` type/tag and explicit pass-through `layer`.                                                                                                                                                                                                                                                                                                                                                                 |
-| `Workspace`           | `Service` / `Workspace` root configuration; `make`, `layer`, relative test value `makeNoop`, and `layerNoop`.                                                                                                                                                                                                                                                                                                             |
+| `Path`                | Effect `Path` type/tag and explicit pass-through `layer`.                                                                                                                                                                                                                                                                                                                                                            |
+| `Workspace`           | `Service` / `Workspace` root configuration; `make`, `layer`, relative test value `makeNoop`, and `layerNoop`.                                                                                                                                                                                                                                                                                                        |
 
 The public `@smthrs/kernel/test/TestGrantStore` subpath exports `layerAllow`,
 `layerDeny(reason?)`, and `layerScripted(replies)`.
diff --git a/packages/kernel/src/HttpClient.ts b/packages/kernel/src/HttpClient.ts
index 663c0abf..fa287816 100644
--- a/packages/kernel/src/HttpClient.ts
+++ b/packages/kernel/src/HttpClient.ts
@@ -30,12 +30,7 @@
  */
 
 import { type Capability, make as makeCapability } from "@smthrs/capability/Capability"
-import {
-  formatError,
-  isPermissionError,
-  PermissionDenied,
-  type PermissionError
-} from "@smthrs/capability/Permission"
+import { formatError, isPermissionError, PermissionDenied, type PermissionError } from "@smthrs/capability/Permission"
 import { Context, Effect, Layer, Option } from "effect"
 import * as EffectHttpClient from "effect/unstable/http/HttpClient"
 import * as HttpClientError from "effect/unstable/http/HttpClientError"
diff --git a/packages/kernel/turbo.json b/packages/kernel/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/kernel/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/keys/turbo.json b/packages/keys/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/keys/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/memory/turbo.json b/packages/memory/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/memory/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/model/turbo.json b/packages/model/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/model/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/notifications/turbo.json b/packages/notifications/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/notifications/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/observability/turbo.json b/packages/observability/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/observability/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/patterns/turbo.json b/packages/patterns/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/patterns/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/plan/README.md b/packages/plan/README.md
index 8ddbf4ce..fb2cc0cc 100644
--- a/packages/plan/README.md
+++ b/packages/plan/README.md
@@ -52,11 +52,11 @@ yield* store.record(plan, Date.now())
 | Module        | Role                                                                                                 |
 | ------------- | ---------------------------------------------------------------------------------------------------- |
 | `KeyMaterial` | What a planner declares about a node: body, tagged input references, layers, capabilities, effects   |
-| `StepKey`     | The compiler that turns material plus resolved dependency digests into an `@smthrs/keys` `Key`  |
+| `StepKey`     | The compiler that turns material plus resolved dependency digests into an `@smthrs/keys` `Key`       |
 | `Plan`        | `compile`, `append`, the node/edge/conflict schemas, and the digest an approval binds to             |
 | `PlanDiff`    | `flows plan --diff` as a value: added, removed, re-keyed (with attribution), unchanged               |
 | `PlanStore`   | Append-only SQL persistence — migration block `4000`, enforced by triggers rather than by convention |
-| `Migrations`  | The namespaced migration set, composed by `@smthrs/engine-store`'s `Migrations.sets`            |
+| `Migrations`  | The namespaced migration set, composed by `@smthrs/engine-store`'s `Migrations.sets`                 |
 
 ## The four rules this package exists to keep
 
diff --git a/packages/plan/turbo.json b/packages/plan/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/plan/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/platform-browser/turbo.json b/packages/platform-browser/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/platform-browser/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/platform-bun/turbo.json b/packages/platform-bun/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/platform-bun/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/platform-node/turbo.json b/packages/platform-node/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/platform-node/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/plugin/turbo.json b/packages/plugin/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/plugin/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/registry/turbo.json b/packages/registry/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/registry/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/run-store/README.md b/packages/run-store/README.md
index fedb9a57..034f269d 100644
--- a/packages/run-store/README.md
+++ b/packages/run-store/README.md
@@ -28,7 +28,7 @@ The root exports these namespaces, also available from matching
 | Namespace      | Public exports                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `RunStore`     | `RunStatus`, `RunStoreErrorCode`, `RunStoreError`, `RunSnapshot`, `RunRow`, `CreateOptions`, and `TransitionGuard`; outcome types `RequestCancelOutcome`, `ClaimOutcome`, `ClaimAndOwnOutcome`, `ActivateOutcome`, `AbandonClaimOutcome`, `RecoverClaimOutcome`, `HeartbeatOutcome`, and `TransitionOutcome`; `Service` / `RunStore` for create/get/cancel, claim/activate/recover/steal, heartbeat, and owned transitions; `make`, `makeNoop`, `layerNoop`, and SQL `layer`. |
-| `Ownership`    | `OwnerId` (re-exported from `@smthrs/journal`, which defines it as the fence on durable appends), `LivenessEvidence`, `LivenessProbe`, `heartbeatInterval`, `heartbeatStaleAfter`, `heartbeatSkewAllowance`, `heartbeatWriteTolerance`, and `heartbeatLoop`.                                                                                                                                                                                                             |
+| `Ownership`    | `OwnerId` (re-exported from `@smthrs/journal`, which defines it as the fence on durable appends), `LivenessEvidence`, `LivenessProbe`, `heartbeatInterval`, `heartbeatStaleAfter`, `heartbeatSkewAllowance`, `heartbeatWriteTolerance`, and `heartbeatLoop`.                                                                                                                                                                                                                  |
 | `AttemptStore` | `AttemptStoreErrorCode`, `AttemptStoreError`, `AttemptId`, `Attempt`, `FinishAttempt`, `AttemptPatch`, `Options`, and result types `PutResult`, `PatchResult`, `HeartbeatResult`, `FinishResult`; `Service` / `AttemptStore` operations `put`, `get`, `heartbeat`, `finish`, and `patch`; `makeWith`, `make`, `makeNoop`, `layerNoop`, `layer`, and `layerWith`.                                                                                                              |
 | `Migrations`   | `set` (the namespaced migration set for `flows_runs` and `flows_attempts`), `run`, and prerequisite `layer`.                                                                                                                                                                                                                                                                                                                                                                  |
 
@@ -36,8 +36,8 @@ The root is written against the driver-neutral `@smthrs/database` contract and
 bundles for the browser. The test double binds a Node SQLite database, so it
 lives under an explicit subpath:
 
-| Import                                     | Public exports                                                                      |
-| ------------------------------------------ | ----------------------------------------------------------------------------------- |
+| Import                                | Public exports                                                                      |
+| ------------------------------------- | ----------------------------------------------------------------------------------- |
 | `@smthrs/run-store/test/TestRunStore` | **Node only.** `layer`, providing migrated in-memory `RunStore` and `AttemptStore`. |
 
 An engine needs this package, `@smthrs/journal`, and `@smthrs/step-cache` over
diff --git a/packages/run-store/turbo.json b/packages/run-store/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/run-store/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/sandbox/turbo.json b/packages/sandbox/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/sandbox/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/scorers/turbo.json b/packages/scorers/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/scorers/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/std/turbo.json b/packages/std/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/std/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/step-cache/README.md b/packages/step-cache/README.md
index 32449246..2d9923d3 100644
--- a/packages/step-cache/README.md
+++ b/packages/step-cache/README.md
@@ -32,8 +32,8 @@ The root is written against the driver-neutral `@smthrs/database` contract and
 bundles for the browser. The test double binds a Node SQLite database, so it
 lives under an explicit subpath:
 
-| Import                                        | Public exports                                                |
-| --------------------------------------------- | ------------------------------------------------------------- |
+| Import                                   | Public exports                                                |
+| ---------------------------------------- | ------------------------------------------------------------- |
 | `@smthrs/step-cache/test/TestCacheStore` | **Node only.** `layer`, providing a migrated in-memory cache. |
 
 An engine needs this package, `@smthrs/journal`, and `@smthrs/run-store` over
diff --git a/packages/step-cache/turbo.json b/packages/step-cache/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/step-cache/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/sync/turbo.json b/packages/sync/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/sync/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/targets/src/ToolBuild.ts b/packages/targets/src/ToolBuild.ts
index 98b0f079..48dff853 100644
--- a/packages/targets/src/ToolBuild.ts
+++ b/packages/targets/src/ToolBuild.ts
@@ -917,7 +917,9 @@ export const readOutputManifest = (
       if (entry === undefined) return `output ${expected} is not recorded as an exact object`
       const { contentDigest, fileCount, path } = entry
       if (path !== expected) {
-        return `the output manifest records ${JSON.stringify(path)} where the target declares ${JSON.stringify(expected)}`
+        return `the output manifest records ${JSON.stringify(path)} where the target declares ${
+          JSON.stringify(expected)
+        }`
       }
       if (seen.has(expected)) return `the output manifest records ${expected} twice`
       seen.add(expected)
diff --git a/packages/targets/turbo.json b/packages/targets/turbo.json
new file mode 100644
index 00000000..b6d883a5
--- /dev/null
+++ b/packages/targets/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "tooling"
+  ]
+}
diff --git a/packages/testing/turbo.json b/packages/testing/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/testing/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/packages/time-travel/turbo.json b/packages/time-travel/turbo.json
new file mode 100644
index 00000000..830da044
--- /dev/null
+++ b/packages/time-travel/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "engine"
+  ]
+}
diff --git a/packages/triggers/turbo.json b/packages/triggers/turbo.json
new file mode 100644
index 00000000..941a3591
--- /dev/null
+++ b/packages/triggers/turbo.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "extends": [
+    "//"
+  ],
+  "tags": [
+    "agent"
+  ]
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 59e87917..708e67a3 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -41,6 +41,9 @@ importers:
       react-dom:
         specifier: ^19.2.8
         version: 19.2.8(react@19.2.8)
+      turbo:
+        specifier: 2.10.11
+        version: 2.10.11
       vite:
         specifier: ^8.2.1
         version: 8.2.1(@types/node@25.9.5)(esbuild@0.28.1)(jiti@2.7.0)(terser@5.50.0)(tsx@4.23.12)(yaml@2.9.0)
@@ -7249,6 +7252,36 @@ packages:
     resolution: {integrity: sha512-w071DSzP94YfN6XiWhOxnLpYT3uqtxJBDYdh6Jdjzt+Ce6DNspJsPQgpC7rbts/B8tEkq0LHoYuIF/O5Jh5rPg==}
     engines: {node: '>=18'}
 
+  '@turbo/darwin-64@2.10.11':
+    resolution: {integrity: sha512-v3R+1R/Ysozyo+p7Ri8MCIbndOvYt3DgPFrGLhrhQHfvyvbxyH3WyJj+A/2JTNmNleuAlh3JUyCV0iSVHIONTA==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@turbo/darwin-arm64@2.10.11':
+    resolution: {integrity: sha512-R0a0CvGAeYYsBgPIgFNB3agGXh6qukjduNhFlwVVX1Ss2IdBJLXmgjytNGmo084bLKS0B6UdLRwKhXMHKKaObQ==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@turbo/linux-64@2.10.11':
+    resolution: {integrity: sha512-dGlY2vg7jpsLjGS1bf9sD/cw1sGMAYbeHGQKGRFxd5Zaj+Ufbj8cNXl/vIit8ueCU97zhL/znn60ZV5iSfZAxw==}
+    cpu: [x64]
+    os: [android, linux]
+
+  '@turbo/linux-arm64@2.10.11':
+    resolution: {integrity: sha512-eSP9+jjsSCBs2x0QpJZlp49dSD1EIMwXH7PsMIhdWk7w6IThhuKJ+jL95JQ2IW7tRjRmdh8gKcKQtrHLD5R5lA==}
+    cpu: [arm64]
+    os: [android, linux]
+
+  '@turbo/windows-64@2.10.11':
+    resolution: {integrity: sha512-4aD7edogJ8arK8DOyvjTI2KKwmchD5M/WM4BZgidrtFf7aSgn8Ce2rJnDwmriw980c2cKlHnhXtlGy38VtKB8g==}
+    cpu: [x64]
+    os: [win32]
+
+  '@turbo/windows-arm64@2.10.11':
+    resolution: {integrity: sha512-m8tJkIrTrbQ9O1uHxV0GUq623Zg1678xGna8eMsy4KbygUX/wVFgdZDYV/AxyoyaW/U7nyKoBvaDVwm22p9xqA==}
+    cpu: [arm64]
+    os: [win32]
+
   '@tweenjs/tween.js@23.1.3':
     resolution: {integrity: sha512-vJmvvwFxYuGnF2axRtPYocag6Clbb5YS7kLL+SO/TeVFzHqDIWrNKYtcsPMibjDx9O+bu+psAy9NKfWklassUA==}
 
@@ -11997,6 +12030,10 @@ packages:
   turbo-stream@3.2.0:
     resolution: {integrity: sha512-EK+bZ9UVrVh7JLslVFOV0GEMsociOqVOvEMTAd4ixMyffN5YNIEdLZWXUx5PJqDbTxSIBWw04HS9gCY4frYQDQ==}
 
+  turbo@2.10.11:
+    resolution: {integrity: sha512-yQfwQVoRXwOuyX1LxiJFBFNg6VfuYh+/RyZLd82+isgyLkBXw3S5XRRzvcck1FAjSCG5sVyLd+O1eDMvYa3J7g==}
+    hasBin: true
+
   twoslash-protocol@0.3.9:
     resolution: {integrity: sha512-9/iwp+CXOnjFMPQuPL5PkuRbZnDoNpBvtJCLs9t8kDYkL3YHujbvnHfZA1i5fApDftVEdBw+T/4F+dH5kIzpYQ==}
 
@@ -16771,6 +16808,24 @@ snapshots:
       '@ts-graphviz/ast': 2.0.7
       '@ts-graphviz/common': 2.1.5
 
+  '@turbo/darwin-64@2.10.11':
+    optional: true
+
+  '@turbo/darwin-arm64@2.10.11':
+    optional: true
+
+  '@turbo/linux-64@2.10.11':
+    optional: true
+
+  '@turbo/linux-arm64@2.10.11':
+    optional: true
+
+  '@turbo/windows-64@2.10.11':
+    optional: true
+
+  '@turbo/windows-arm64@2.10.11':
+    optional: true
+
   '@tweenjs/tween.js@23.1.3': {}
 
   '@tybys/wasm-util@0.10.3':
@@ -22649,6 +22704,15 @@ snapshots:
 
   turbo-stream@3.2.0: {}
 
+  turbo@2.10.11:
+    optionalDependencies:
+      '@turbo/darwin-64': 2.10.11
+      '@turbo/darwin-arm64': 2.10.11
+      '@turbo/linux-64': 2.10.11
+      '@turbo/linux-arm64': 2.10.11
+      '@turbo/windows-64': 2.10.11
+      '@turbo/windows-arm64': 2.10.11
+
   twoslash-protocol@0.3.9: {}
 
   twoslash@0.3.9(supports-color@8.1.1)(typescript@6.0.3):
diff --git a/scripts/turbo-engine-boundary.mjs b/scripts/turbo-engine-boundary.mjs
new file mode 100644
index 00000000..9d90e9f2
--- /dev/null
+++ b/scripts/turbo-engine-boundary.mjs
@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+/**
+ * Release-train boundary assertion, driven by `turbo query`.
+ *
+ * The release train packs only `smthrs.group === "engine"`, so an engine
+ * package must never depend on an agent or tooling package. `turbo
+ * boundaries` enforces the same rule from import scanning (see the
+ * `boundaries` block in turbo.json); this script proves the rule from the
+ * other side — Turbo's GraphQL package graph — so the assertion does not
+ * depend on Boundaries' experimental status.
+ *
+ * Run it from anywhere: `node scripts/turbo-engine-boundary.mjs`.
+ * Exit code 1 with a per-package listing when the boundary is violated.
+ */
+import { execFileSync } from "node:child_process"
+import { readFileSync } from "node:fs"
+import { dirname, join } from "node:path"
+import { fileURLToPath } from "node:url"
+
+const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..")
+
+function resolve(...parts) {
+  return join(...parts)
+}
+
+const query = `query {
+  packages {
+    items {
+      name
+      directDependencies {
+        items {
+          name
+        }
+      }
+    }
+  }
+}`
+
+const turboBin = join(repoRoot, "node_modules", ".bin", "turbo")
+const result = JSON.parse(
+  execFileSync(turboBin, ["query", query], { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] })
+)
+
+// name -> smthrs.group, read from each workspace manifest. The GraphQL schema
+// does not expose custom manifest fields, so the group tier comes from disk.
+const groups = new Map()
+const workspaceGlobs = ["packages", "apps"]
+for (const top of workspaceGlobs) {
+  const { readdirSync, existsSync } = await import("node:fs")
+  for (const entry of readdirSync(join(repoRoot, top), { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue
+    const manifestPath = join(repoRoot, top, entry.name, "package.json")
+    if (!existsSync(manifestPath)) continue
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"))
+    if (manifest.smthrs?.group) groups.set(manifest.name, manifest.smthrs.group)
+  }
+}
+const infraManifest = JSON.parse(readFileSync(join(repoRoot, "packages", "build", "infra", "package.json"), "utf8"))
+groups.set(infraManifest.name, infraManifest.smthrs.group)
+
+const violations = []
+let enginePackages = 0
+for (const pkg of result.data.packages.items) {
+  if (groups.get(pkg.name) !== "engine") continue
+  enginePackages++
+  for (const dep of pkg.directDependencies.items) {
+    const depGroup = groups.get(dep.name)
+    if (depGroup !== undefined && depGroup !== "engine") {
+      violations.push(`${pkg.name} (engine) depends on ${dep.name} (${depGroup})`)
+    }
+  }
+}
+
+if (violations.length > 0) {
+  console.error("engine boundary violated:")
+  for (const violation of violations) console.error(`  ${violation}`)
+  process.exit(1)
+}
+console.log(`engine boundary holds: ${enginePackages} engine packages, 0 agent/tooling dependencies`)
diff --git a/turbo.json b/turbo.json
new file mode 100644
index 00000000..f7ccee10
--- /dev/null
+++ b/turbo.json
@@ -0,0 +1,116 @@
+{
+  "$schema": "https://turborepo.dev/schema.json",
+  "ui": "tui",
+  "envMode": "strict",
+  "globalEnv": ["CI", "NODE_ENV"],
+  "globalDependencies": ["eslint.jsdoc.js", "pnpm-lock.yaml", "rust-toolchain.toml"],
+  "remoteCache": {
+    "enabled": true,
+    "signature": true
+  },
+  "boundaries": {
+    "tags": {
+      "engine": {
+        "dependencies": {
+          "allow": ["engine"]
+        }
+      },
+      "agent": {
+        "dependencies": {
+          "allow": ["engine", "agent"]
+        }
+      },
+      "tooling": {
+        "dependencies": {
+          "allow": ["engine", "agent", "tooling"]
+        }
+      }
+    }
+  },
+  "tasks": {
+    "build": {
+      "inputs": ["src/**", "scripts/**", "tsconfig.json", "package.json"],
+      "outputs": ["dist/**"]
+    },
+    "check": {
+      "inputs": ["src/**", "test/**", "tsconfig.json", "tsconfig.test.json", "package.json"],
+      "outputs": ["dist/**"]
+    },
+    "lint": {
+      "inputs": ["$TURBO_DEFAULT$", "../../eslint.jsdoc.js"],
+      "outputs": []
+    },
+    "format": {
+      "inputs": ["$TURBO_DEFAULT$"],
+      "outputs": [],
+      "cache": false
+    },
+    "circular": {
+      "inputs": ["src/**", "scripts/circular.mjs", "tsconfig.json", "package.json"],
+      "outputs": []
+    },
+    "test": {
+      "inputs": ["src/**", "test/**", "vitest.config.ts", "tsconfig.json", "tsconfig.test.json", "package.json"],
+      "outputs": [],
+      "env": ["FC_SEED", "FC_NUM_RUNS", "FLOWS_SLOW_TESTS", "FLOWS_FAKE_JJ", "FLOWS_FAKE_JJ_MARKER", "JJ_EDITOR", "PYTHONPATH"],
+      "passThroughEnv": ["SMITHERS_CACHE_TOKEN", "SMITHERS_CACHE_URL", "NPM_TOKEN"]
+    },
+    "coverage": {
+      "inputs": ["src/**", "test/**", "vitest.config.ts", "tsconfig.json", "tsconfig.test.json", "package.json"],
+      "outputs": [],
+      "env": ["FC_SEED", "FC_NUM_RUNS", "FLOWS_SLOW_TESTS", "FLOWS_FAKE_JJ", "FLOWS_FAKE_JJ_MARKER", "JJ_EDITOR", "PYTHONPATH"],
+      "passThroughEnv": ["SMITHERS_CACHE_TOKEN", "SMITHERS_CACHE_URL", "NPM_TOKEN"]
+    },
+    "typecheck": {
+      "inputs": ["src/**", "scripts/**", "tsconfig.json", "package.json"],
+      "outputs": []
+    },
+    "dev": {
+      "cache": false,
+      "persistent": true,
+      "interactive": true
+    },
+    "//#browser": {
+      "inputs": ["scripts/browser-check.mjs", "packages/*/src/**", "packages/*/package.json", "packages/*/tsconfig.json"],
+      "outputs": []
+    },
+    "//#test:scripts": {
+      "inputs": [
+        "scripts/**",
+        ".github/workflows/release.yml",
+        "packages/*/package.json",
+        "packages/*/src/**",
+        "packages/*/test/**",
+        "packages/*/scripts/**"
+      ],
+      "outputs": [],
+      "passThroughEnv": ["SMITHERS_CACHE_TOKEN", "SMITHERS_CACHE_URL", "SMTHRS_ALLOW_PUBLISH", "NPM_TOKEN"]
+    },
+    "//#docs": {
+      "inputs": [
+        "BUILD.ts",
+        "packages/*/BUILD.ts",
+        "packages/*/README.md",
+        "packages/*/package.json",
+        "packages/targets/src/**",
+        "packages/build/src/**",
+        "packages/build-cli/src/**"
+      ],
+      "outputs": [],
+      "passThroughEnv": ["SMITHERS_CACHE_TOKEN", "SMITHERS_CACHE_URL"]
+    },
+    "//#cargo:fmt": {
+      "inputs": ["crates/**", "vendor/jj/**", "Cargo.toml", "Cargo.lock", "rust-toolchain.toml"],
+      "outputs": []
+    },
+    "//#cargo:clippy": {
+      "inputs": ["crates/**", "vendor/jj/**", "Cargo.toml", "Cargo.lock", "rust-toolchain.toml"],
+      "outputs": []
+    },
+    "//#cargo:test": {
+      "inputs": ["crates/**", "vendor/jj/**", "Cargo.toml", "Cargo.lock", "rust-toolchain.toml"],
+      "outputs": [],
+      "passThroughEnv": ["CARGO_TARGET_DIR", "CARGO_HOME", "RUSTUP_HOME"]
+    }
+  }
+}