subagenttasks

Worker build system: dependency graph + kit-hash locks

DONE 2026-07-02, adversarially verified by execution: scripts/build-graph.py generates workers/build-graph.json (71 workers, 7 kit files; 259 kit_import + 55 runtime_fetch + 647 reference edges, all with file:line evidence; deterministic output, generated_at from git HEAD; scanner reads wrangler [vars] URLs — caught subagentdatamodels' env.CATALOG_URL). scripts/worker-build.sh: tsc + kit-hash drift gate vs per-worker .build-lock.json (66 locks bootstrapped = exactly the 66 kit-importing workers); exit 2 names the changed kit file; --stale fleet mode. Gate PROVEN: kit edit → --stale exit 1 naming http.ts (66 workers) / css.ts flip → worker exit 2 + 63 stale — then byte-exact revert, sha256-verified clean. --check-refs live: all 49 runtime-fetch targets HTTP 200. Real fan-out: wellknown 66, shell 63, http 57, d1crud 49, mcp 24.