diff --git a/.github/workflows/cloud-runtime-artifact.yml b/.github/workflows/cloud-runtime-artifact.yml
index 925c260ea..1bc53302b 100644
--- a/.github/workflows/cloud-runtime-artifact.yml
+++ b/.github/workflows/cloud-runtime-artifact.yml
@@ -20,7 +20,7 @@ on:
     paths:
       - ".github/workflows/cloud-runtime-artifact.yml"
       - "kernel/**"
-      - "sdk/**"
+      - "packages/sdk/**"
       - "scripts/cloud-artifact.mjs"
       - "scripts/cloud-artifact.test.mjs"
       - "testdata/**"
@@ -81,7 +81,7 @@ jobs:
         run: cargo test --workspace
 
       - name: Build authoring surface
-        working-directory: surface
+        working-directory: packages/surface
         run: |
           bun install --frozen-lockfile --ignore-scripts
           bun run build
@@ -90,10 +90,10 @@ jobs:
       # npm runs the file: dependency's prepare before its own devDependencies
       # exist. The SDK's own build is the next step, so nothing is skipped.
       - name: Install SDK dependencies
-        run: npm ci --prefix sdk --ignore-scripts
+        run: npm ci --prefix packages/sdk --ignore-scripts
 
       - name: Test SDK and type-level authoring contracts
-        working-directory: sdk
+        working-directory: packages/sdk
         env:
           # `live-kernel.test.ts` runs one case against the REAL Claude analyzer
           # and fails by default when it cannot, deliberately: an unavailable
@@ -128,7 +128,7 @@ jobs:
           # second, debug copy through a wrapper that cannot run here.
           #
           # The build is still required: several test files fail at collection
-          # without sdk/dist, which is why a bare `vitest run` is not enough.
+          # without packages/sdk/dist, which is why a bare `vitest run` is not enough.
           # test:prep's other half, kept: it re-asserts the executable bit on the
           # preflight CLI fixtures. They are committed 100755 so actions/checkout
           # already restores them, but the guard is one line and the failure it
@@ -144,7 +144,7 @@ jobs:
       - name: Build standalone flows CLI
         run: |
           mkdir -p dist/cloud-artifact-input
-          bun build sdk/src/cli-executable.ts \
+          bun build packages/sdk/src/cli-executable.ts \
             --compile \
             --target=bun-linux-x64 \
             --outfile=dist/cloud-artifact-input/flows
diff --git a/.github/workflows/surface-package.yml b/.github/workflows/surface-package.yml
index 7aa60c0c5..000f3dbbb 100644
--- a/.github/workflows/surface-package.yml
+++ b/.github/workflows/surface-package.yml
@@ -6,18 +6,18 @@ on:
     paths:
       - ".github/workflows/surface-package.yml"
       - "scripts/surface-package-gate.sh"
-      - "surface/**"
+      - "packages/surface/**"
       - "regressions/**"
-      - "sdk/**"
+      - "packages/sdk/**"
   push:
     branches:
       - main
     paths:
       - ".github/workflows/surface-package.yml"
       - "scripts/surface-package-gate.sh"
-      - "surface/**"
+      - "packages/surface/**"
       - "regressions/**"
-      - "sdk/**"
+      - "packages/sdk/**"
 
 permissions:
   contents: read
diff --git a/README.md b/README.md
index a536c4a08..0ea1ae575 100644
--- a/README.md
+++ b/README.md
@@ -16,8 +16,8 @@ Nothing in this repo may contradict it; changing it is a human decision.
 
 ```
 kernel/     relayflowd — Rust. Journal, scheduler, leases, timers, streams. One binary.
-sdk/        TypeScript-first authoring SDK. Compiles specs; speaks the journal protocol.
-surface/    @relayflows/surface — the TypeScript flow-authoring contract.
+packages/sdk/        TypeScript-first authoring SDK. Compiles specs; speaks the journal protocol.
+packages/surface/    @relayflows/surface — the TypeScript flow-authoring contract.
 workflows/  The gates. Each gate is a relayflow; the build is orchestrated by relayflows.
 docs/       RFC-0001 and design docs.
 charter/    The Relayflow Lead.
diff --git a/docs/SURFACE.md b/docs/SURFACE.md
index a46d8cc06..67aa682d7 100644
--- a/docs/SURFACE.md
+++ b/docs/SURFACE.md
@@ -385,7 +385,7 @@ cycle` error — before a journal exists and before the step's command runs.
 Cycles that pass through a child applicator (`properties`, `items`,
 `prefixItems`, ...) consume one level of the instance per step, so ordinary
 recursive schemas stay legal. `kernel/relayflowd-core/src/schema.rs` and
-`sdk/src/json-schema-bound.ts` implement the same rule and are pinned to the
+`packages/sdk/src/json-schema-bound.ts` implement the same rule and are pinned to the
 shared corpus in `testdata/json-schema-bound-cases.json`, so the kernel and the
 SDK agree on which schemas are legal by construction. `verify` compiles through
 the same gate, so a journal written before the bound existed fails its gate with
diff --git a/docs/bootstrap-report.md b/docs/bootstrap-report.md
index 4684a4dd4..81f3871ef 100644
--- a/docs/bootstrap-report.md
+++ b/docs/bootstrap-report.md
@@ -5,7 +5,7 @@ Honest state only: what exists, what passed, what is missing.
 
 ## What was built
 
-All of the following is **uncommitted** on `main` (untracked `kernel/`, `sdk/`,
+All of the following is **uncommitted** on `main` (untracked `kernel/`, `packages/sdk/`,
 `testdata/`; `workflows/bootstrap-gate1.yaml` modified mid-run to swap the
 adversary agent's CLI from `grok` to `claude`). A human decides branch/commit/PR.
 
@@ -35,7 +35,7 @@ v0 (12 verbs, JSON over unix socket).
 - Largest file 397 lines; `cargo clippy -D warnings` and `cargo fmt --check`
   passed at build time (per kernel-dev's step report).
 
-### sdk/ — @relayflows/sdk, TypeScript (sdk-dev)
+### packages/sdk/ — @relayflows/sdk, TypeScript (sdk-dev)
 - `spec.ts` — spec types mirroring RFC §1's ladder (`deterministic | llm |
   agent`), verification gates, recovery modes, agent surfaces, budgets;
   zero-agent flows legal by construction.
@@ -50,7 +50,7 @@ v0 (12 verbs, JSON over unix socket).
 
 ### testdata/ — shared parity fixture
 `hello-ladder.flow.yaml` → `hello-ladder.spec.canonical.json` + sha256, pinned
-bit-for-bit on **both** sides (`sdk/tests/spec-parity.test.ts`,
+bit-for-bit on **both** sides (`packages/sdk/tests/spec-parity.test.ts`,
 `kernel/relayflowd-core/tests/spec_parity.rs`), so the SDK-compiled spec and
 the kernel-parsed spec provably hash identically.
 
@@ -112,7 +112,7 @@ test tests::append_is_durable_and_monotonic_after_reopen ... ok
 test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out
 ```
 
-### `npm test` (sdk/: `tsc --noEmit && vitest run`) — 41 passed, 0 failed
+### `npm test` (packages/sdk/: `tsc --noEmit && vitest run`) — 41 passed, 0 failed
 
 ```
  ✓ tests/journal-client.test.ts (7 tests) 17ms
@@ -143,7 +143,7 @@ Minor observations carried forward from the review (not violations):
 2. `next_actions` returns only `ArmTimer` for the first backing-off step in
    spec order — wall-clock inefficiency for future parallel DAGs, irrelevant
    to the sequential gate-1 ladder.
-3. `sdk/dist/` build artifacts are checked in; fresh today, but they can drift.
+3. `packages/sdk/dist/` build artifacts are checked in; fresh today, but they can drift.
 
 ## What gate 1 still needs
 
diff --git a/examples/research/shims/agent-cli.ts b/examples/research/shims/agent-cli.ts
index 0ef82c9ee..d3455e8c3 100644
--- a/examples/research/shims/agent-cli.ts
+++ b/examples/research/shims/agent-cli.ts
@@ -1,6 +1,6 @@
 // REPLACE-WHEN: gate-1 agent dispatch accepts a run-time instruction and the
 // kernel starts independent steps concurrently. Then `f.agent` is the SDK's
-// AgentWorker (sdk/src/worker.ts) and this file is deleted.
+// AgentWorker (packages/sdk/src/worker.ts) and this file is deleted.
 //
 // What this shim provides today: the `agent` verb of research.flow.ts's
 // context, executed by spawning the lane's declared CLI through its headless
@@ -159,7 +159,7 @@ export const runAgentWithCli: AgentRunner = async (options) => {
   }
   const { argv, stdin } = headlessInvocation(cli, { model, promptFile, cwd: options.cwd, binaries: options.binaries });
   const env: NodeJS.ProcessEnv = { ...process.env };
-  // Same rule as sdk/src/worker.ts: unset first, then set only when declared,
+  // Same rule as packages/sdk/src/worker.ts: unset first, then set only when declared,
   // so a CLI can tell "no model chosen" from an inherited pin.
   delete env[MODEL_ENV];
   if (model !== undefined) env[MODEL_ENV] = model;
diff --git a/examples/research/tsconfig.json b/examples/research/tsconfig.json
index 2d183a36d..cd3fa677a 100644
--- a/examples/research/tsconfig.json
+++ b/examples/research/tsconfig.json
@@ -11,7 +11,7 @@
     "allowImportingTsExtensions": true,
     "skipLibCheck": true,
     "forceConsistentCasingInFileNames": true,
-    "typeRoots": ["../../sdk/node_modules/@types"],
+    "typeRoots": ["../../packages/sdk/node_modules/@types"],
     "types": ["node"]
   },
   "include": ["**/*.ts"]
diff --git a/kernel/relayflowd-core/src/schema.rs b/kernel/relayflowd-core/src/schema.rs
index a6b416794..caff2af18 100644
--- a/kernel/relayflowd-core/src/schema.rs
+++ b/kernel/relayflowd-core/src/schema.rs
@@ -17,7 +17,7 @@
 //! recursive schemas: each step consumes one level of the instance, so they
 //! terminate, and they stay legal.
 //!
-//! `sdk/src/json-schema-bound.ts` implements the same rule, and
+//! `packages/sdk/src/json-schema-bound.ts` implements the same rule, and
 //! `testdata/json-schema-bound-cases.json` is the corpus both sides are pinned
 //! to, so kernel and SDK agree on which schemas are legal by construction
 //! rather than by coincidence of two engines' overflow behaviour.
diff --git a/kernel/relayflowd-core/tests/spec_parity.rs b/kernel/relayflowd-core/tests/spec_parity.rs
index a5a573b29..2bcfb1de0 100644
--- a/kernel/relayflowd-core/tests/spec_parity.rs
+++ b/kernel/relayflowd-core/tests/spec_parity.rs
@@ -1,7 +1,7 @@
 //! The kernel half of the cross-boundary spec-parity gate.
 //!
 //! `testdata/hello-ladder.spec.canonical.json` is emitted by the SDK compiler
-//! (see `sdk/tests/spec-parity.test.ts`). This test proves the kernel parses
+//! (see `packages/sdk/tests/spec-parity.test.ts`). This test proves the kernel parses
 //! that exact artifact fail-closed, and that re-serializing it — precisely what
 //! the engine hashes when it stamps `spec_hash` in `run.spawned` — reproduces
 //! the same canonical bytes and the same sha256 the SDK computed. Together the
diff --git a/ops/FORBIDDEN_PATHS b/ops/FORBIDDEN_PATHS
index f5d8bd150..cb45faeec 100644
--- a/ops/FORBIDDEN_PATHS
+++ b/ops/FORBIDDEN_PATHS
@@ -15,7 +15,7 @@
 
 # Review rejected an in-kernel HTTP adapter (PR #16, P1): a durable-execution
 # kernel must not own provider-specific product logic or network I/O. The
-# Hacker News adapter lives at sdk/src/hn-poller.ts, outside the kernel.
+# Hacker News adapter lives at packages/sdk/src/hn-poller.ts, outside the kernel.
 kernel/relayflowd/src/engine/hn_poller.rs
 kernel/relayflowd/tests/hn_poller.rs
 
diff --git a/ops/cargo.sh b/ops/cargo.sh
index 18018e8e7..13a617d32 100755
--- a/ops/cargo.sh
+++ b/ops/cargo.sh
@@ -40,7 +40,7 @@ export RUSTUP_HOME="$toolchain_home/rustup"
 # whole of the problem.
 #
 # Anything that hardcodes kernel/target/debug must read RELAYFLOWD_BIN instead;
-# sdk/tests/live-kernel.test.ts already does.
+# packages/sdk/tests/live-kernel.test.ts already does.
 # Keyed per worktree. Review caught that a single shared target dir would be
 # used by every worktree under the same HOME (PR #38): cargo locks it, so the
 # builds are safe, but two different source trees sharing one target thrash
diff --git a/ops/probes/pr134-repair-0903/gate-cost.mjs b/ops/probes/pr134-repair-0903/gate-cost.mjs
index 15a4bd61b..30c0ee609 100644
--- a/ops/probes/pr134-repair-0903/gate-cost.mjs
+++ b/ops/probes/pr134-repair-0903/gate-cost.mjs
@@ -5,8 +5,8 @@ import { fileURLToPath } from 'node:url';
 const REPO = resolve(dirname(fileURLToPath(import.meta.url)), '../../..');
 const DIST = process.argv[2] ?? 'dist';
 const N = Number(process.argv[3] ?? 30000);
-const { AuthoredFlowOperation, verifyAuthoredOperations } = await import(`${REPO}/sdk/${DIST}/authored-flow-operation.js`);
-const { AuthoredFlowLifecycle } = await import(`${REPO}/sdk/${DIST}/authored-flow-lifecycle.js`);
+const { AuthoredFlowOperation, verifyAuthoredOperations } = await import(`${REPO}/packages/sdk/${DIST}/authored-flow-operation.js`);
+const { AuthoredFlowLifecycle } = await import(`${REPO}/packages/sdk/${DIST}/authored-flow-lifecycle.js`);
 
 const lc = new AuthoredFlowLifecycle();
 const ops = [];
diff --git a/ops/probes/pr134-repair-0903/harness.mjs b/ops/probes/pr134-repair-0903/harness.mjs
index d8c48ddf3..a45bf6fa6 100644
--- a/ops/probes/pr134-repair-0903/harness.mjs
+++ b/ops/probes/pr134-repair-0903/harness.mjs
@@ -1,7 +1,7 @@
 // Shared probe harness for the PR #134 authored-lifecycle repair.
 //
 // Drives the real `executeAuthoredFlow` against a loopback journal faithful to
-// `sdk/tests/journal-client-loopback.ts`, and reports which journal runs were
+// `packages/sdk/tests/journal-client-loopback.ts`, and reports which journal runs were
 // started — so "did the flow lower its terminal complete-* run" is observed,
 // not inferred. Run any probe in this directory with plain `node`.
 import { randomUUID } from 'node:crypto';
@@ -12,9 +12,9 @@ import { fileURLToPath } from 'node:url';
 import { rmSync } from 'node:fs';
 
 const REPO = resolve(dirname(fileURLToPath(import.meta.url)), '../../..');
-export const { executeAuthoredFlow } = await import(`${REPO}/sdk/dist/authored-flow-executor.js`);
-export const { JournalClient } = await import(`${REPO}/sdk/dist/journal-client.js`);
-export const { flow } = await import(`${REPO}/surface/dist/index.js`);
+export const { executeAuthoredFlow } = await import(`${REPO}/packages/sdk/dist/authored-flow-executor.js`);
+export const { JournalClient } = await import(`${REPO}/packages/sdk/dist/journal-client.js`);
+export const { flow } = await import(`${REPO}/packages/surface/dist/index.js`);
 
 function sockPath() { return join(tmpdir(), `rf-${randomUUID().slice(0, 8)}.sock`); }
 
diff --git a/ops/probes/pr134-repair-0903/promise-all-semantics.mjs b/ops/probes/pr134-repair-0903/promise-all-semantics.mjs
index bc710e26a..d7be13837 100644
--- a/ops/probes/pr134-repair-0903/promise-all-semantics.mjs
+++ b/ops/probes/pr134-repair-0903/promise-all-semantics.mjs
@@ -5,7 +5,7 @@ import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 const REPO = resolve(dirname(fileURLToPath(import.meta.url)), '../../..');
 const DIST = process.argv[2] ?? 'dist';
-const { AuthoredFlowLifecycle } = await import(`${REPO}/sdk/${DIST}/authored-flow-lifecycle.js`);
+const { AuthoredFlowLifecycle } = await import(`${REPO}/packages/sdk/${DIST}/authored-flow-lifecycle.js`);
 
 const nativeAll = Promise.all;
 const lc = new AuthoredFlowLifecycle();
diff --git a/ops/probes/pr134-repair-0903/verb-output-fields.mjs b/ops/probes/pr134-repair-0903/verb-output-fields.mjs
index 97fab5070..c02141776 100644
--- a/ops/probes/pr134-repair-0903/verb-output-fields.mjs
+++ b/ops/probes/pr134-repair-0903/verb-output-fields.mjs
@@ -5,8 +5,8 @@ import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { mkdirSync, writeFileSync } from 'node:fs';
 const REPO = resolve(dirname(fileURLToPath(import.meta.url)), '../../..');
-const { validateSpec } = await import(`${REPO}/sdk/dist/validate.js`);
-const { compileYaml, toKernelSpec } = await import(`${REPO}/sdk/dist/compile.js`);
+const { validateSpec } = await import(`${REPO}/packages/sdk/dist/validate.js`);
+const { compileYaml, toKernelSpec } = await import(`${REPO}/packages/sdk/dist/compile.js`);
 
 // Documented shape (docs/SURFACE.md): the JSON Schema sits directly under `output`.
 const OUTPUT = { type: 'object', properties: { verdict: { type: 'string' } }, required: ['verdict'] };
@@ -66,4 +66,4 @@ for (const [name, body] of Object.entries(bodies)) {
   }
   console.log(`  ${name.padEnd(14)} ${line}`);
 }
-if (outDir) console.log(`--- PATH 3 (supporting) fixtures written to ${outDir} (run: node sdk/dist/cli.js check <fixture>)`);
+if (outDir) console.log(`--- PATH 3 (supporting) fixtures written to ${outDir} (run: node packages/sdk/dist/cli.js check <fixture>)`);
diff --git a/sdk/package-lock.json b/packages/sdk/package-lock.json
similarity index 100%
rename from sdk/package-lock.json
rename to packages/sdk/package-lock.json
diff --git a/sdk/package.json b/packages/sdk/package.json
similarity index 87%
rename from sdk/package.json
rename to packages/sdk/package.json
index def01f057..65dcb2037 100644
--- a/sdk/package.json
+++ b/packages/sdk/package.json
@@ -24,7 +24,7 @@
     "prepare": "npm run build",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.type-tests.json",
     "typecheck:tests": "tsc -p tsconfig.tests.json",
-    "test:prep": "( cd ../kernel && sh ../ops/cargo.sh build ) && ( [ ! -d ../testdata/preflight ] || find ../testdata/preflight -name '*-cli' -type f -exec chmod +x {} + )",
+    "test:prep": "( cd ../../kernel && sh ../ops/cargo.sh build ) && ( [ ! -d ../../testdata/preflight ] || find ../../testdata/preflight -name '*-cli' -type f -exec chmod +x {} + )",
     "test": "sh scripts/test.sh",
     "test:watch": "vitest"
   },
diff --git a/sdk/scripts/make-cli-executable.mjs b/packages/sdk/scripts/make-cli-executable.mjs
similarity index 100%
rename from sdk/scripts/make-cli-executable.mjs
rename to packages/sdk/scripts/make-cli-executable.mjs
diff --git a/sdk/scripts/prune-test-build.mjs b/packages/sdk/scripts/prune-test-build.mjs
similarity index 100%
rename from sdk/scripts/prune-test-build.mjs
rename to packages/sdk/scripts/prune-test-build.mjs
diff --git a/sdk/scripts/test.sh b/packages/sdk/scripts/test.sh
similarity index 100%
rename from sdk/scripts/test.sh
rename to packages/sdk/scripts/test.sh
diff --git a/sdk/src/authored-flow-error.ts b/packages/sdk/src/authored-flow-error.ts
similarity index 100%
rename from sdk/src/authored-flow-error.ts
rename to packages/sdk/src/authored-flow-error.ts
diff --git a/sdk/src/authored-flow-executor.ts b/packages/sdk/src/authored-flow-executor.ts
similarity index 100%
rename from sdk/src/authored-flow-executor.ts
rename to packages/sdk/src/authored-flow-executor.ts
diff --git a/sdk/src/authored-flow-lifecycle.ts b/packages/sdk/src/authored-flow-lifecycle.ts
similarity index 100%
rename from sdk/src/authored-flow-lifecycle.ts
rename to packages/sdk/src/authored-flow-lifecycle.ts
diff --git a/sdk/src/authored-flow-loader.ts b/packages/sdk/src/authored-flow-loader.ts
similarity index 100%
rename from sdk/src/authored-flow-loader.ts
rename to packages/sdk/src/authored-flow-loader.ts
diff --git a/sdk/src/authored-flow-operation.ts b/packages/sdk/src/authored-flow-operation.ts
similarity index 100%
rename from sdk/src/authored-flow-operation.ts
rename to packages/sdk/src/authored-flow-operation.ts
diff --git a/sdk/src/authored-flow.ts b/packages/sdk/src/authored-flow.ts
similarity index 100%
rename from sdk/src/authored-flow.ts
rename to packages/sdk/src/authored-flow.ts
diff --git a/sdk/src/authored-promise-graph.ts b/packages/sdk/src/authored-promise-graph.ts
similarity index 100%
rename from sdk/src/authored-promise-graph.ts
rename to packages/sdk/src/authored-promise-graph.ts
diff --git a/sdk/src/backlog-picker.ts b/packages/sdk/src/backlog-picker.ts
similarity index 100%
rename from sdk/src/backlog-picker.ts
rename to packages/sdk/src/backlog-picker.ts
diff --git a/sdk/src/canonical.ts b/packages/sdk/src/canonical.ts
similarity index 100%
rename from sdk/src/canonical.ts
rename to packages/sdk/src/canonical.ts
diff --git a/sdk/src/cli-adapter.ts b/packages/sdk/src/cli-adapter.ts
similarity index 100%
rename from sdk/src/cli-adapter.ts
rename to packages/sdk/src/cli-adapter.ts
diff --git a/sdk/src/cli-executable.ts b/packages/sdk/src/cli-executable.ts
similarity index 100%
rename from sdk/src/cli-executable.ts
rename to packages/sdk/src/cli-executable.ts
diff --git a/sdk/src/cli.ts b/packages/sdk/src/cli.ts
similarity index 100%
rename from sdk/src/cli.ts
rename to packages/sdk/src/cli.ts
diff --git a/sdk/src/cli/check.ts b/packages/sdk/src/cli/check.ts
similarity index 100%
rename from sdk/src/cli/check.ts
rename to packages/sdk/src/cli/check.ts
diff --git a/sdk/src/cli/direct-run.ts b/packages/sdk/src/cli/direct-run.ts
similarity index 100%
rename from sdk/src/cli/direct-run.ts
rename to packages/sdk/src/cli/direct-run.ts
diff --git a/sdk/src/cli/hn-monitor.ts b/packages/sdk/src/cli/hn-monitor.ts
similarity index 100%
rename from sdk/src/cli/hn-monitor.ts
rename to packages/sdk/src/cli/hn-monitor.ts
diff --git a/sdk/src/cli/interruptible-sleep.ts b/packages/sdk/src/cli/interruptible-sleep.ts
similarity index 100%
rename from sdk/src/cli/interruptible-sleep.ts
rename to packages/sdk/src/cli/interruptible-sleep.ts
diff --git a/sdk/src/cli/run.ts b/packages/sdk/src/cli/run.ts
similarity index 100%
rename from sdk/src/cli/run.ts
rename to packages/sdk/src/cli/run.ts
diff --git a/sdk/src/cli/tick-runner.ts b/packages/sdk/src/cli/tick-runner.ts
similarity index 100%
rename from sdk/src/cli/tick-runner.ts
rename to packages/sdk/src/cli/tick-runner.ts
diff --git a/sdk/src/compile.ts b/packages/sdk/src/compile.ts
similarity index 100%
rename from sdk/src/compile.ts
rename to packages/sdk/src/compile.ts
diff --git a/sdk/src/demo-hn-monitor.ts b/packages/sdk/src/demo-hn-monitor.ts
similarity index 100%
rename from sdk/src/demo-hn-monitor.ts
rename to packages/sdk/src/demo-hn-monitor.ts
diff --git a/sdk/src/dir-watcher-poller.ts b/packages/sdk/src/dir-watcher-poller.ts
similarity index 100%
rename from sdk/src/dir-watcher-poller.ts
rename to packages/sdk/src/dir-watcher-poller.ts
diff --git a/sdk/src/direct-input.ts b/packages/sdk/src/direct-input.ts
similarity index 100%
rename from sdk/src/direct-input.ts
rename to packages/sdk/src/direct-input.ts
diff --git a/sdk/src/failure-kinds.ts b/packages/sdk/src/failure-kinds.ts
similarity index 100%
rename from sdk/src/failure-kinds.ts
rename to packages/sdk/src/failure-kinds.ts
diff --git a/sdk/src/gate-contract.ts b/packages/sdk/src/gate-contract.ts
similarity index 100%
rename from sdk/src/gate-contract.ts
rename to packages/sdk/src/gate-contract.ts
diff --git a/sdk/src/hn-poller.ts b/packages/sdk/src/hn-poller.ts
similarity index 100%
rename from sdk/src/hn-poller.ts
rename to packages/sdk/src/hn-poller.ts
diff --git a/sdk/src/index.ts b/packages/sdk/src/index.ts
similarity index 100%
rename from sdk/src/index.ts
rename to packages/sdk/src/index.ts
diff --git a/sdk/src/journal-client.ts b/packages/sdk/src/journal-client.ts
similarity index 100%
rename from sdk/src/journal-client.ts
rename to packages/sdk/src/journal-client.ts
diff --git a/sdk/src/json-schema-bound.ts b/packages/sdk/src/json-schema-bound.ts
similarity index 100%
rename from sdk/src/json-schema-bound.ts
rename to packages/sdk/src/json-schema-bound.ts
diff --git a/sdk/src/json-schema.ts b/packages/sdk/src/json-schema.ts
similarity index 100%
rename from sdk/src/json-schema.ts
rename to packages/sdk/src/json-schema.ts
diff --git a/sdk/src/json-value.ts b/packages/sdk/src/json-value.ts
similarity index 100%
rename from sdk/src/json-value.ts
rename to packages/sdk/src/json-value.ts
diff --git a/sdk/src/model-name.ts b/packages/sdk/src/model-name.ts
similarity index 100%
rename from sdk/src/model-name.ts
rename to packages/sdk/src/model-name.ts
diff --git a/sdk/src/output-schema.ts b/packages/sdk/src/output-schema.ts
similarity index 100%
rename from sdk/src/output-schema.ts
rename to packages/sdk/src/output-schema.ts
diff --git a/sdk/src/preflight.ts b/packages/sdk/src/preflight.ts
similarity index 100%
rename from sdk/src/preflight.ts
rename to packages/sdk/src/preflight.ts
diff --git a/sdk/src/protocol.ts b/packages/sdk/src/protocol.ts
similarity index 100%
rename from sdk/src/protocol.ts
rename to packages/sdk/src/protocol.ts
diff --git a/sdk/src/spec.ts b/packages/sdk/src/spec.ts
similarity index 100%
rename from sdk/src/spec.ts
rename to packages/sdk/src/spec.ts
diff --git a/sdk/src/step-dependencies.ts b/packages/sdk/src/step-dependencies.ts
similarity index 100%
rename from sdk/src/step-dependencies.ts
rename to packages/sdk/src/step-dependencies.ts
diff --git a/sdk/src/step-fields.ts b/packages/sdk/src/step-fields.ts
similarity index 100%
rename from sdk/src/step-fields.ts
rename to packages/sdk/src/step-fields.ts
diff --git a/sdk/src/tick-source.ts b/packages/sdk/src/tick-source.ts
similarity index 100%
rename from sdk/src/tick-source.ts
rename to packages/sdk/src/tick-source.ts
diff --git a/sdk/src/unknown-keys.ts b/packages/sdk/src/unknown-keys.ts
similarity index 100%
rename from sdk/src/unknown-keys.ts
rename to packages/sdk/src/unknown-keys.ts
diff --git a/sdk/src/validate.ts b/packages/sdk/src/validate.ts
similarity index 100%
rename from sdk/src/validate.ts
rename to packages/sdk/src/validate.ts
diff --git a/sdk/src/work-package-consumer.ts b/packages/sdk/src/work-package-consumer.ts
similarity index 100%
rename from sdk/src/work-package-consumer.ts
rename to packages/sdk/src/work-package-consumer.ts
diff --git a/sdk/src/work-package-validator.ts b/packages/sdk/src/work-package-validator.ts
similarity index 100%
rename from sdk/src/work-package-validator.ts
rename to packages/sdk/src/work-package-validator.ts
diff --git a/sdk/src/worker-cli.ts b/packages/sdk/src/worker-cli.ts
similarity index 100%
rename from sdk/src/worker-cli.ts
rename to packages/sdk/src/worker-cli.ts
diff --git a/sdk/src/worker.ts b/packages/sdk/src/worker.ts
similarity index 100%
rename from sdk/src/worker.ts
rename to packages/sdk/src/worker.ts
diff --git a/sdk/src/wrapper-runtime.ts b/packages/sdk/src/wrapper-runtime.ts
similarity index 100%
rename from sdk/src/wrapper-runtime.ts
rename to packages/sdk/src/wrapper-runtime.ts
diff --git a/sdk/src/wrapper-session.ts b/packages/sdk/src/wrapper-session.ts
similarity index 100%
rename from sdk/src/wrapper-session.ts
rename to packages/sdk/src/wrapper-session.ts
diff --git a/sdk/tests/authored-flow-lifecycle-executor.test.ts b/packages/sdk/tests/authored-flow-lifecycle-executor.test.ts
similarity index 100%
rename from sdk/tests/authored-flow-lifecycle-executor.test.ts
rename to packages/sdk/tests/authored-flow-lifecycle-executor.test.ts
diff --git a/sdk/tests/authored-flow-operation.test.ts b/packages/sdk/tests/authored-flow-operation.test.ts
similarity index 100%
rename from sdk/tests/authored-flow-operation.test.ts
rename to packages/sdk/tests/authored-flow-operation.test.ts
diff --git a/sdk/tests/authored-flow.test.ts b/packages/sdk/tests/authored-flow.test.ts
similarity index 100%
rename from sdk/tests/authored-flow.test.ts
rename to packages/sdk/tests/authored-flow.test.ts
diff --git a/sdk/tests/backlog-picker-flow.test.ts b/packages/sdk/tests/backlog-picker-flow.test.ts
similarity index 97%
rename from sdk/tests/backlog-picker-flow.test.ts
rename to packages/sdk/tests/backlog-picker-flow.test.ts
index 0b938437f..b5bd14934 100644
--- a/sdk/tests/backlog-picker-flow.test.ts
+++ b/packages/sdk/tests/backlog-picker-flow.test.ts
@@ -18,7 +18,7 @@ import { describe, expect, it } from 'vitest';
  * test of a paraphrase would pass while the flow stayed broken.
  */
 function stepCommands(): Record<string, string> {
-  const flowPath = join(__dirname, '..', '..', 'testdata', 'backlog-picker.flow.yaml');
+  const flowPath = join(__dirname, '..', '..', '..', 'testdata', 'backlog-picker.flow.yaml');
   const flow = load(readFileSync(flowPath, 'utf8')) as { steps: Array<{ id: string; command: string }> };
   return Object.fromEntries(flow.steps.map((s) => [s.id, s.command]));
 }
@@ -114,7 +114,7 @@ describe('backlog-picker canonical spec', () => {
     // caught it. A divergence between the two is silent by nature: both files
     // are valid, the tests over the yaml pass, and the kernel keeps executing
     // the stale command.
-    const root = join(__dirname, '..', '..');
+    const root = join(__dirname, '..', '..', '..');
     const flow = load(readFileSync(join(root, 'testdata', 'backlog-picker.flow.yaml'), 'utf8')) as {
       steps: Array<{ id: string; command?: string }>;
     };
@@ -143,7 +143,7 @@ describe('backlog-picker canonical spec', () => {
     // The rule is shape, not content: whatever fields the kernel-authored
     // steps carry, every step must carry, and no step may carry an authoring
     // -surface alias the kernel does not read.
-    const root = join(__dirname, '..', '..');
+    const root = join(__dirname, '..', '..', '..');
     const canonical = JSON.parse(
       readFileSync(join(root, 'testdata', 'backlog-picker.spec.canonical.json'), 'utf8'),
     ) as { steps: Array<Record<string, unknown>> };
@@ -176,7 +176,7 @@ describe('backlog-picker canonical spec', () => {
     // yaml declares the dependencies; the canonical spec must carry the same
     // ones under `depends_on`. This cannot go stale as the kernel's schema
     // grows, because it asserts a relationship rather than a field list.
-    const root = join(__dirname, '..', '..');
+    const root = join(__dirname, '..', '..', '..');
     const flow = load(readFileSync(join(root, 'testdata', 'backlog-picker.flow.yaml'), 'utf8')) as {
       steps: Array<{ id: string; dependsOn?: string[] }>;
     };
diff --git a/sdk/tests/backlog-picker.test.ts b/packages/sdk/tests/backlog-picker.test.ts
similarity index 98%
rename from sdk/tests/backlog-picker.test.ts
rename to packages/sdk/tests/backlog-picker.test.ts
index b7459d35d..3019dabc3 100644
--- a/sdk/tests/backlog-picker.test.ts
+++ b/packages/sdk/tests/backlog-picker.test.ts
@@ -60,7 +60,7 @@ describe('backlog picker', () => {
   });
 
   it('does not treat backticked prose containing a slash as a file in scope', () => {
-    const flowPath = join(__dirname, '..', '..', 'testdata', 'backlog-picker.flow.yaml');
+    const flowPath = join(__dirname, '..', '..', '..', 'testdata', 'backlog-picker.flow.yaml');
     const flow = load(readFileSync(flowPath, 'utf8')) as {
       steps: Array<{ id: string; command: string }>;
     };
@@ -138,7 +138,7 @@ describe('work package validation', () => {
   });
 
   it('keeps at least twenty real backlog entries actionable', async () => {
-    const backlog = readFileSync(join(__dirname, '..', '..', 'ops', 'BACKLOG.md'), 'utf8');
+    const backlog = readFileSync(join(__dirname, '..', '..', '..', 'ops', 'BACKLOG.md'), 'utf8');
     const entries = [...backlog.matchAll(/^- \*\*(.+?)\*\*\s*(.*(?:\n  .*)*)/gm)].map(
       (match) => ({
         title: match[1] ?? '',
diff --git a/sdk/tests/bin.test.ts b/packages/sdk/tests/bin.test.ts
similarity index 98%
rename from sdk/tests/bin.test.ts
rename to packages/sdk/tests/bin.test.ts
index f896bfc92..bb36ba6c3 100644
--- a/sdk/tests/bin.test.ts
+++ b/packages/sdk/tests/bin.test.ts
@@ -12,8 +12,8 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { afterEach, describe, expect, it } from 'vitest';
 
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
-const SDK = join(ROOT, 'sdk');
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+const SDK = join(ROOT, 'packages', 'sdk');
 const BUILT_CLI = join(SDK, 'dist', 'cli.js');
 const PREFLIGHT = join(ROOT, 'testdata', 'preflight');
 const temporaryDirectories: string[] = [];
diff --git a/sdk/tests/classify-outcome.test.ts b/packages/sdk/tests/classify-outcome.test.ts
similarity index 100%
rename from sdk/tests/classify-outcome.test.ts
rename to packages/sdk/tests/classify-outcome.test.ts
diff --git a/sdk/tests/cli-adapter.test.ts b/packages/sdk/tests/cli-adapter.test.ts
similarity index 100%
rename from sdk/tests/cli-adapter.test.ts
rename to packages/sdk/tests/cli-adapter.test.ts
diff --git a/sdk/tests/cli-hn-monitor.test.ts b/packages/sdk/tests/cli-hn-monitor.test.ts
similarity index 100%
rename from sdk/tests/cli-hn-monitor.test.ts
rename to packages/sdk/tests/cli-hn-monitor.test.ts
diff --git a/sdk/tests/cli.test.ts b/packages/sdk/tests/cli.test.ts
similarity index 99%
rename from sdk/tests/cli.test.ts
rename to packages/sdk/tests/cli.test.ts
index e16ddb5d0..b55d6b5c7 100644
--- a/sdk/tests/cli.test.ts
+++ b/packages/sdk/tests/cli.test.ts
@@ -22,7 +22,7 @@ import {
   type LoopbackHandlers,
 } from './journal-client-loopback.js';
 
-const TESTDATA = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'testdata');
+const TESTDATA = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', 'testdata');
 const DIRECT_INPUT_FLOW = join(dirname(fileURLToPath(import.meta.url)), 'fixtures', 'direct-input.flow.ts');
 const PREFLIGHT = join(TESTDATA, 'preflight');
 const LADDER = ['hello-deterministic', 'hello-llm', 'hello-agent'] as const;
diff --git a/sdk/tests/dependency-validation.test.ts b/packages/sdk/tests/dependency-validation.test.ts
similarity index 100%
rename from sdk/tests/dependency-validation.test.ts
rename to packages/sdk/tests/dependency-validation.test.ts
diff --git a/sdk/tests/deterministic-llm.test.ts b/packages/sdk/tests/deterministic-llm.test.ts
similarity index 100%
rename from sdk/tests/deterministic-llm.test.ts
rename to packages/sdk/tests/deterministic-llm.test.ts
diff --git a/sdk/tests/dir-watcher-poller.test.ts b/packages/sdk/tests/dir-watcher-poller.test.ts
similarity index 100%
rename from sdk/tests/dir-watcher-poller.test.ts
rename to packages/sdk/tests/dir-watcher-poller.test.ts
diff --git a/sdk/tests/direct-input.test.ts b/packages/sdk/tests/direct-input.test.ts
similarity index 95%
rename from sdk/tests/direct-input.test.ts
rename to packages/sdk/tests/direct-input.test.ts
index 6e0f55118..90f0b17c9 100644
--- a/sdk/tests/direct-input.test.ts
+++ b/packages/sdk/tests/direct-input.test.ts
@@ -15,11 +15,11 @@ import { spawn, spawnSync, type ChildProcess } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { afterEach, beforeAll, describe, expect, it } from 'vitest';
 
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
-const BUILT_CLI = join(ROOT, 'sdk', 'dist', 'cli.js');
-const FLOW = join(ROOT, 'sdk', 'tests', 'fixtures', 'direct-input.flow.ts');
-const CONTROL_FLOW = join(ROOT, 'sdk', 'tests', 'fixtures', 'direct-output-control.flow.ts');
-const SIDE_EFFECT_FLOW = join(ROOT, 'sdk', 'tests', 'fixtures', 'pre-journal-side-effect.flow.ts');
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+const BUILT_CLI = join(ROOT, 'packages', 'sdk', 'dist', 'cli.js');
+const FLOW = join(ROOT, 'packages', 'sdk', 'tests', 'fixtures', 'direct-input.flow.ts');
+const CONTROL_FLOW = join(ROOT, 'packages', 'sdk', 'tests', 'fixtures', 'direct-output-control.flow.ts');
+const SIDE_EFFECT_FLOW = join(ROOT, 'packages', 'sdk', 'tests', 'fixtures', 'pre-journal-side-effect.flow.ts');
 const TOOLCHAIN_TARGET = process.env['CARGO_TARGET_DIR']
   ?? join(process.env['RELAYFLOWS_TOOLCHAIN_HOME'] ?? join(homedir(), '.relayflows-toolchain'), 'target');
 const RELAYFLOWD = resolve(process.env['RELAYFLOWD_BIN'] ?? locateRelayflowd());
diff --git a/sdk/tests/fixtures/direct-input.flow.ts b/packages/sdk/tests/fixtures/direct-input.flow.ts
similarity index 100%
rename from sdk/tests/fixtures/direct-input.flow.ts
rename to packages/sdk/tests/fixtures/direct-input.flow.ts
diff --git a/sdk/tests/fixtures/direct-output-control.flow.ts b/packages/sdk/tests/fixtures/direct-output-control.flow.ts
similarity index 100%
rename from sdk/tests/fixtures/direct-output-control.flow.ts
rename to packages/sdk/tests/fixtures/direct-output-control.flow.ts
diff --git a/sdk/tests/fixtures/pre-journal-side-effect.flow.ts b/packages/sdk/tests/fixtures/pre-journal-side-effect.flow.ts
similarity index 100%
rename from sdk/tests/fixtures/pre-journal-side-effect.flow.ts
rename to packages/sdk/tests/fixtures/pre-journal-side-effect.flow.ts
diff --git a/sdk/tests/fixtures/runtime-bridge.flow.ts b/packages/sdk/tests/fixtures/runtime-bridge.flow.ts
similarity index 100%
rename from sdk/tests/fixtures/runtime-bridge.flow.ts
rename to packages/sdk/tests/fixtures/runtime-bridge.flow.ts
diff --git a/sdk/tests/gate-contract.test.ts b/packages/sdk/tests/gate-contract.test.ts
similarity index 99%
rename from sdk/tests/gate-contract.test.ts
rename to packages/sdk/tests/gate-contract.test.ts
index b201ef0f6..0b7636e8a 100644
--- a/sdk/tests/gate-contract.test.ts
+++ b/packages/sdk/tests/gate-contract.test.ts
@@ -11,7 +11,7 @@ import { preflight } from '../src/index.js';
 import type { FlowSpec } from '../src/spec.js';
 import { validateSpec } from '../src/validate.js';
 
-const TESTDATA = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'testdata');
+const TESTDATA = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', 'testdata');
 
 function schemaFixture(name: 'valid' | 'invalid'): unknown {
   return JSON.parse(readFileSync(join(TESTDATA, `json-schema-${name}.json`), 'utf8'));
diff --git a/sdk/tests/hello-deterministic.test.ts b/packages/sdk/tests/hello-deterministic.test.ts
similarity index 100%
rename from sdk/tests/hello-deterministic.test.ts
rename to packages/sdk/tests/hello-deterministic.test.ts
diff --git a/sdk/tests/hn-poller.test.ts b/packages/sdk/tests/hn-poller.test.ts
similarity index 100%
rename from sdk/tests/hn-poller.test.ts
rename to packages/sdk/tests/hn-poller.test.ts
diff --git a/sdk/tests/journal-client-loopback.ts b/packages/sdk/tests/journal-client-loopback.ts
similarity index 100%
rename from sdk/tests/journal-client-loopback.ts
rename to packages/sdk/tests/journal-client-loopback.ts
diff --git a/sdk/tests/journal-client.test.ts b/packages/sdk/tests/journal-client.test.ts
similarity index 100%
rename from sdk/tests/journal-client.test.ts
rename to packages/sdk/tests/journal-client.test.ts
diff --git a/sdk/tests/json-schema-bound.test.ts b/packages/sdk/tests/json-schema-bound.test.ts
similarity index 99%
rename from sdk/tests/json-schema-bound.test.ts
rename to packages/sdk/tests/json-schema-bound.test.ts
index 42e3c8914..d71754931 100644
--- a/sdk/tests/json-schema-bound.test.ts
+++ b/packages/sdk/tests/json-schema-bound.test.ts
@@ -16,7 +16,7 @@ import { jsonSchemaBoundError, UNBOUNDED_REF_CYCLE } from '../src/json-schema-bo
 import { jsonSchemaError } from '../src/json-schema.js';
 import type { FlowSpec } from '../src/spec.js';
 
-const TESTDATA = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'testdata');
+const TESTDATA = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', 'testdata');
 
 interface Case {
   name: string;
diff --git a/sdk/tests/live-kernel.test.ts b/packages/sdk/tests/live-kernel.test.ts
similarity index 99%
rename from sdk/tests/live-kernel.test.ts
rename to packages/sdk/tests/live-kernel.test.ts
index f4332b7dd..ee0748491 100644
--- a/sdk/tests/live-kernel.test.ts
+++ b/packages/sdk/tests/live-kernel.test.ts
@@ -24,8 +24,8 @@ import { AgentWorker } from '../src/worker.js';
 import { resolveSpecCliPaths } from '../src/cli/hn-monitor.js';
 import { emitDueTicks, type TickCursor } from '../src/tick-source.js';
 
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
-const SDK = join(ROOT, 'sdk');
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+const SDK = join(ROOT, 'packages', 'sdk');
 const BUILT_CLI = join(SDK, 'dist', 'cli.js');
 const TESTDATA = join(ROOT, 'testdata');
 // ops/cargo.sh builds into a target dir OUTSIDE the repo, because
diff --git a/sdk/tests/model-selection.test.ts b/packages/sdk/tests/model-selection.test.ts
similarity index 100%
rename from sdk/tests/model-selection.test.ts
rename to packages/sdk/tests/model-selection.test.ts
diff --git a/sdk/tests/parse-json-output.test.ts b/packages/sdk/tests/parse-json-output.test.ts
similarity index 100%
rename from sdk/tests/parse-json-output.test.ts
rename to packages/sdk/tests/parse-json-output.test.ts
diff --git a/sdk/tests/preflight.test.ts b/packages/sdk/tests/preflight.test.ts
similarity index 100%
rename from sdk/tests/preflight.test.ts
rename to packages/sdk/tests/preflight.test.ts
diff --git a/sdk/tests/real-cli-adapters.test.ts b/packages/sdk/tests/real-cli-adapters.test.ts
similarity index 100%
rename from sdk/tests/real-cli-adapters.test.ts
rename to packages/sdk/tests/real-cli-adapters.test.ts
diff --git a/sdk/tests/spec-parity.test.ts b/packages/sdk/tests/spec-parity.test.ts
similarity index 99%
rename from sdk/tests/spec-parity.test.ts
rename to packages/sdk/tests/spec-parity.test.ts
index 32804f94d..0f07ebd79 100644
--- a/sdk/tests/spec-parity.test.ts
+++ b/packages/sdk/tests/spec-parity.test.ts
@@ -18,7 +18,7 @@ import { canonicalize, kernelToAuthoring, specHash } from '../src/index.js';
 // make "sha256(canonical JSON) == kernel spec_hash" a tested fact, not a
 // comment.
 
-const TESTDATA = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'testdata');
+const TESTDATA = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', 'testdata');
 
 function fixture(name: string): string {
   return readFileSync(join(TESTDATA, name), 'utf8');
diff --git a/sdk/tests/tick-runner.test.ts b/packages/sdk/tests/tick-runner.test.ts
similarity index 100%
rename from sdk/tests/tick-runner.test.ts
rename to packages/sdk/tests/tick-runner.test.ts
diff --git a/sdk/tests/tick-source.test.ts b/packages/sdk/tests/tick-source.test.ts
similarity index 99%
rename from sdk/tests/tick-source.test.ts
rename to packages/sdk/tests/tick-source.test.ts
index 549c5888f..e02a8226b 100644
--- a/sdk/tests/tick-source.test.ts
+++ b/packages/sdk/tests/tick-source.test.ts
@@ -17,7 +17,7 @@ import {
 } from '../src/tick-source.js';
 import { compileYaml, toKernelSpec } from '../src/compile.js';
 
-const TESTDATA = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'testdata');
+const TESTDATA = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', 'testdata');
 
 /**
  * Stands in for the kernel's `(flow_key, subscription_id, dedupe_key)` claim.
diff --git a/sdk/tests/typed-output.test.ts b/packages/sdk/tests/typed-output.test.ts
similarity index 99%
rename from sdk/tests/typed-output.test.ts
rename to packages/sdk/tests/typed-output.test.ts
index 91c73fd0b..06446f0dd 100644
--- a/sdk/tests/typed-output.test.ts
+++ b/packages/sdk/tests/typed-output.test.ts
@@ -16,7 +16,7 @@ import type {
   LlmStepSpec,
 } from '../src/spec.js';
 
-const TESTDATA = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'testdata');
+const TESTDATA = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', 'testdata');
 
 const extractionSchema: JsonOutputSchema = {
   type: 'object',
diff --git a/sdk/tests/validate.test.ts b/packages/sdk/tests/validate.test.ts
similarity index 100%
rename from sdk/tests/validate.test.ts
rename to packages/sdk/tests/validate.test.ts
diff --git a/sdk/tests/verb-field-lint.test.ts b/packages/sdk/tests/verb-field-lint.test.ts
similarity index 99%
rename from sdk/tests/verb-field-lint.test.ts
rename to packages/sdk/tests/verb-field-lint.test.ts
index bb2d3e150..c77f7e14b 100644
--- a/sdk/tests/verb-field-lint.test.ts
+++ b/packages/sdk/tests/verb-field-lint.test.ts
@@ -37,7 +37,7 @@ interface InvalidFieldCase {
 }
 
 const AUTHENTICATED_CLI = join(
-  dirname(fileURLToPath(import.meta.url)), '..', '..', 'testdata', 'preflight', 'authenticated-cli',
+  dirname(fileURLToPath(import.meta.url)), '..', '..', '..', 'testdata', 'preflight', 'authenticated-cli',
 );
 
 const TYPO_STEP_FIELDS = [
diff --git a/sdk/tests/work-package-consumer.test.ts b/packages/sdk/tests/work-package-consumer.test.ts
similarity index 98%
rename from sdk/tests/work-package-consumer.test.ts
rename to packages/sdk/tests/work-package-consumer.test.ts
index aae51acfb..28386917c 100644
--- a/sdk/tests/work-package-consumer.test.ts
+++ b/packages/sdk/tests/work-package-consumer.test.ts
@@ -74,7 +74,7 @@ describe('the Garden join: picker output feeds the consumer', () => {
     const { join } = require('node:path') as typeof import('node:path');
     const { load } = require('js-yaml') as typeof import('js-yaml');
 
-    const flowPath = join(__dirname, '..', '..', 'testdata', 'backlog-picker.flow.yaml');
+    const flowPath = join(__dirname, '..', '..', '..', 'testdata', 'backlog-picker.flow.yaml');
     const flow = load(readFileSync(flowPath, 'utf8')) as { steps: Array<{ id: string; command: string }> };
     const step = (id: string) => flow.steps.find((s) => s.id === id)!.command;
     // stdio: stderr captured, not echoed -- see backlog-picker-flow.test.ts.
diff --git a/sdk/tests/work-package-validator.test.ts b/packages/sdk/tests/work-package-validator.test.ts
similarity index 100%
rename from sdk/tests/work-package-validator.test.ts
rename to packages/sdk/tests/work-package-validator.test.ts
diff --git a/sdk/tests/worker-cli.test.ts b/packages/sdk/tests/worker-cli.test.ts
similarity index 100%
rename from sdk/tests/worker-cli.test.ts
rename to packages/sdk/tests/worker-cli.test.ts
diff --git a/sdk/tsconfig.json b/packages/sdk/tsconfig.json
similarity index 100%
rename from sdk/tsconfig.json
rename to packages/sdk/tsconfig.json
diff --git a/sdk/tsconfig.tests.json b/packages/sdk/tsconfig.tests.json
similarity index 100%
rename from sdk/tsconfig.tests.json
rename to packages/sdk/tsconfig.tests.json
diff --git a/sdk/tsconfig.type-tests.json b/packages/sdk/tsconfig.type-tests.json
similarity index 100%
rename from sdk/tsconfig.type-tests.json
rename to packages/sdk/tsconfig.type-tests.json
diff --git a/sdk/type-tests/step-fields.ts b/packages/sdk/type-tests/step-fields.ts
similarity index 100%
rename from sdk/type-tests/step-fields.ts
rename to packages/sdk/type-tests/step-fields.ts
diff --git a/sdk/vitest.config.ts b/packages/sdk/vitest.config.ts
similarity index 100%
rename from sdk/vitest.config.ts
rename to packages/sdk/vitest.config.ts
diff --git a/surface/README.md b/packages/surface/README.md
similarity index 100%
rename from surface/README.md
rename to packages/surface/README.md
diff --git a/surface/bun.lock b/packages/surface/bun.lock
similarity index 100%
rename from surface/bun.lock
rename to packages/surface/bun.lock
diff --git a/surface/package.json b/packages/surface/package.json
similarity index 92%
rename from surface/package.json
rename to packages/surface/package.json
index adb35088d..a9a94f64e 100644
--- a/surface/package.json
+++ b/packages/surface/package.json
@@ -23,7 +23,7 @@
     "build": "tsc",
     "prepare": "bun run build",
     "typecheck": "tsc --noEmit",
-    "typecheck:regressions": "tsc -p ../regressions/tsconfig.json",
+    "typecheck:regressions": "tsc -p ../../regressions/tsconfig.json",
     "test": "bun run build && tsc -p tsconfig.test.json && vitest run"
   },
   "license": "Apache-2.0",
diff --git a/surface/src/cloud.ts b/packages/surface/src/cloud.ts
similarity index 100%
rename from surface/src/cloud.ts
rename to packages/surface/src/cloud.ts
diff --git a/surface/src/completion.ts b/packages/surface/src/completion.ts
similarity index 100%
rename from surface/src/completion.ts
rename to packages/surface/src/completion.ts
diff --git a/surface/src/context.ts b/packages/surface/src/context.ts
similarity index 100%
rename from surface/src/context.ts
rename to packages/surface/src/context.ts
diff --git a/surface/src/flow.ts b/packages/surface/src/flow.ts
similarity index 100%
rename from surface/src/flow.ts
rename to packages/surface/src/flow.ts
diff --git a/surface/src/index.ts b/packages/surface/src/index.ts
similarity index 100%
rename from surface/src/index.ts
rename to packages/surface/src/index.ts
diff --git a/surface/src/runtime.ts b/packages/surface/src/runtime.ts
similarity index 100%
rename from surface/src/runtime.ts
rename to packages/surface/src/runtime.ts
diff --git a/surface/src/step.ts b/packages/surface/src/step.ts
similarity index 100%
rename from surface/src/step.ts
rename to packages/surface/src/step.ts
diff --git a/surface/tests/flow.test.ts b/packages/surface/tests/flow.test.ts
similarity index 100%
rename from surface/tests/flow.test.ts
rename to packages/surface/tests/flow.test.ts
diff --git a/surface/tsconfig.json b/packages/surface/tsconfig.json
similarity index 100%
rename from surface/tsconfig.json
rename to packages/surface/tsconfig.json
diff --git a/surface/tsconfig.test.json b/packages/surface/tsconfig.test.json
similarity index 100%
rename from surface/tsconfig.test.json
rename to packages/surface/tsconfig.test.json
diff --git a/surface/vitest.config.ts b/packages/surface/vitest.config.ts
similarity index 100%
rename from surface/vitest.config.ts
rename to packages/surface/vitest.config.ts
diff --git a/regressions/tsconfig.json b/regressions/tsconfig.json
index 7aaf71e39..1c01dd6b2 100644
--- a/regressions/tsconfig.json
+++ b/regressions/tsconfig.json
@@ -6,7 +6,7 @@
     "moduleResolution": "Bundler",
     "baseUrl": ".",
     "paths": {
-      "@relayflows/surface": ["../surface/src/index.ts"]
+      "@relayflows/surface": ["../packages/surface/src/index.ts"]
     },
     "lib": ["ES2022"],
     "strict": true,
diff --git a/scripts/surface-package-gate.sh b/scripts/surface-package-gate.sh
index dd8636424..9f17c19fc 100755
--- a/scripts/surface-package-gate.sh
+++ b/scripts/surface-package-gate.sh
@@ -6,15 +6,15 @@ pack_dir="$(mktemp -d /tmp/relayflows-surface-pack.XXXXXX)"
 consumer_dir="$(mktemp -d /tmp/relayflows-surface-consumer.XXXXXX)"
 trap 'rm -rf "$pack_dir" "$consumer_dir"' EXIT
 
-cd "$repo_root/surface"
+cd "$repo_root/packages/surface"
 bun install --frozen-lockfile --ignore-scripts
 bun run build
 bun run test
 bun run typecheck:regressions
 bun pm pack --destination "$pack_dir"
 
-npm ci --prefix "$repo_root/sdk" --ignore-scripts
-npm run typecheck --prefix "$repo_root/sdk"
+npm ci --prefix "$repo_root/packages/sdk" --ignore-scripts
+npm run typecheck --prefix "$repo_root/packages/sdk"
 
 tarball="$(find "$pack_dir" -maxdepth 1 -type f -name '*.tgz' -print -quit)"
 if [[ -z "$tarball" ]]; then
@@ -158,8 +158,8 @@ cat > tsconfig.consumer.json <<'JSON'
 }
 JSON
 
-"$repo_root/surface/node_modules/.bin/tsc" -p tsconfig.consumer.json
+"$repo_root/packages/surface/node_modules/.bin/tsc" -p tsconfig.consumer.json
 echo "PACKED_TYPESCRIPT_OK"
 
-cd "$repo_root/sdk"
+cd "$repo_root/packages/sdk"
 ./node_modules/.bin/vitest run tests/authored-flow.test.ts
diff --git a/testdata/backlog-picker.flow.yaml b/testdata/backlog-picker.flow.yaml
index 41c8209f4..1dea71efe 100644
--- a/testdata/backlog-picker.flow.yaml
+++ b/testdata/backlog-picker.flow.yaml
@@ -10,7 +10,7 @@ steps:
   - id: build-sdk
     type: deterministic
     dependsOn: [read-backlog]
-    command: "cd sdk && npm ci --silent --no-audit --no-fund && npm run build --silent"
+    command: "cd packages/sdk && npm ci --silent --no-audit --no-fund && npm run build --silent"
   - id: select-entry
     type: deterministic
     dependsOn: [read-backlog, build-sdk]
diff --git a/testdata/backlog-picker.spec.canonical.json b/testdata/backlog-picker.spec.canonical.json
index ff98fc9a0..a131257d6 100644
--- a/testdata/backlog-picker.spec.canonical.json
+++ b/testdata/backlog-picker.spec.canonical.json
@@ -1 +1 @@
-{"description":"Read ops/BACKLOG.md and deterministically emit its first work package.","name":"backlog-picker","steps":[{"command":"mkdir -p .relayflow && cat ops/BACKLOG.md > .relayflow/backlog-picker-source.md","depends_on":[],"id":"read-backlog","max_iterations":1,"retry":{"initial_backoff_ms":100,"jitter_percent":20,"max_backoff_ms":60000,"multiplier":2},"type":"deterministic","verification":{}},{"command":"cd sdk && npm ci --silent --no-audit --no-fund && npm run build --silent","depends_on":["read-backlog"],"id":"build-sdk","max_iterations":1,"retry":{"initial_backoff_ms":100,"jitter_percent":20,"max_backoff_ms":60000,"multiplier":2},"type":"deterministic","verification":{}},{"command":"node -e 'const fs=require(\"node:fs\");const P=require(\"node:path\"),F=require(\"node:fs\");const SDK=(()=>{if(process.env.RELAYFLOWS_SDK_DIST)return P.resolve(process.env.RELAYFLOWS_SDK_DIST,\"backlog-picker.js\");let c=process.cwd();for(;;){const f=P.join(c,\"sdk\",\"dist\",\"backlog-picker.js\");if(F.existsSync(f))return f;const up=P.dirname(c);if(up===c)throw new Error(\"SDK_DIST_NOT_FOUND: build the sdk or set RELAYFLOWS_SDK_DIST\");c=up}})();const {validateWorkPackage,packageFromEntry:pack}=require(SDK);fs.rmSync(\".relayflow/backlog-picker-entry.json\",{force:true});const text=fs.readFileSync(\".relayflow/backlog-picker-source.md\",\"utf8\");const entries=[...text.matchAll(/^- \\*\\*(.+?)\\*\\*\\s*(.*(?:\\n  .*)*)/gm)].map(m=>({title:m[1],body:m[2].replace(/\\s+/g,\" \").trim()}));const skipped=[];for(const entry of entries){const verdict=validateWorkPackage(pack(entry));if(verdict.accepted){process.stderr.write(\"SKIPPED_UNACTIONABLE=\"+skipped.length+(skipped.length?\" \"+skipped.join(\"; \"):\"\")+\"\\n\");fs.writeFileSync(\".relayflow/backlog-picker-entry.json\",JSON.stringify(entry));process.stdout.write(JSON.stringify(entry));process.exit(0)}skipped.push(entry.title.slice(0,40)+\"[\"+verdict.reason+\"]\")}process.stderr.write(\"NO_ACTIONABLE_BACKLOG_ENTRY scanned=\"+entries.length+\" \"+skipped.join(\"; \")+\"\\n\");process.exit(1)'","depends_on":["read-backlog","build-sdk"],"id":"select-entry","max_iterations":1,"retry":{"initial_backoff_ms":100,"jitter_percent":20,"max_backoff_ms":60000,"multiplier":2},"type":"deterministic","verification":{}},{"command":"node -e 'const fs=require(\"node:fs\");const P=require(\"node:path\"),F=require(\"node:fs\");const SDK=(()=>{if(process.env.RELAYFLOWS_SDK_DIST)return P.resolve(process.env.RELAYFLOWS_SDK_DIST,\"backlog-picker.js\");let c=process.cwd();for(;;){const f=P.join(c,\"sdk\",\"dist\",\"backlog-picker.js\");if(F.existsSync(f))return f;const up=P.dirname(c);if(up===c)throw new Error(\"SDK_DIST_NOT_FOUND: build the sdk or set RELAYFLOWS_SDK_DIST\");c=up}})();const sdk=require(SDK);const entry=JSON.parse(fs.readFileSync(\".relayflow/backlog-picker-entry.json\",\"utf8\"));const pkg=sdk.packageFromEntry(entry);const verdict=sdk.validateWorkPackage(pkg);if(!verdict.accepted){process.stderr.write(\"REFUSED_MALFORMED_BACKLOG_ENTRY reason=\"+verdict.reason+\"\\n\");process.exit(1)}process.stdout.write(JSON.stringify(pkg))'","depends_on":["select-entry"],"id":"emit-package","max_iterations":1,"retry":{"initial_backoff_ms":100,"jitter_percent":20,"max_backoff_ms":60000,"multiplier":2},"type":"deterministic","verification":{}}],"version":"0.1.0"}
+{"description":"Read ops/BACKLOG.md and deterministically emit its first work package.","name":"backlog-picker","steps":[{"command":"mkdir -p .relayflow && cat ops/BACKLOG.md > .relayflow/backlog-picker-source.md","depends_on":[],"id":"read-backlog","max_iterations":1,"retry":{"initial_backoff_ms":100,"jitter_percent":20,"max_backoff_ms":60000,"multiplier":2},"type":"deterministic","verification":{}},{"command":"cd packages/sdk && npm ci --silent --no-audit --no-fund && npm run build --silent","depends_on":["read-backlog"],"id":"build-sdk","max_iterations":1,"retry":{"initial_backoff_ms":100,"jitter_percent":20,"max_backoff_ms":60000,"multiplier":2},"type":"deterministic","verification":{}},{"command":"node -e 'const fs=require(\"node:fs\");const P=require(\"node:path\"),F=require(\"node:fs\");const SDK=(()=>{if(process.env.RELAYFLOWS_SDK_DIST)return P.resolve(process.env.RELAYFLOWS_SDK_DIST,\"backlog-picker.js\");let c=process.cwd();for(;;){const f=P.join(c,\"sdk\",\"dist\",\"backlog-picker.js\");if(F.existsSync(f))return f;const up=P.dirname(c);if(up===c)throw new Error(\"SDK_DIST_NOT_FOUND: build the sdk or set RELAYFLOWS_SDK_DIST\");c=up}})();const {validateWorkPackage,packageFromEntry:pack}=require(SDK);fs.rmSync(\".relayflow/backlog-picker-entry.json\",{force:true});const text=fs.readFileSync(\".relayflow/backlog-picker-source.md\",\"utf8\");const entries=[...text.matchAll(/^- \\*\\*(.+?)\\*\\*\\s*(.*(?:\\n  .*)*)/gm)].map(m=>({title:m[1],body:m[2].replace(/\\s+/g,\" \").trim()}));const skipped=[];for(const entry of entries){const verdict=validateWorkPackage(pack(entry));if(verdict.accepted){process.stderr.write(\"SKIPPED_UNACTIONABLE=\"+skipped.length+(skipped.length?\" \"+skipped.join(\"; \"):\"\")+\"\\n\");fs.writeFileSync(\".relayflow/backlog-picker-entry.json\",JSON.stringify(entry));process.stdout.write(JSON.stringify(entry));process.exit(0)}skipped.push(entry.title.slice(0,40)+\"[\"+verdict.reason+\"]\")}process.stderr.write(\"NO_ACTIONABLE_BACKLOG_ENTRY scanned=\"+entries.length+\" \"+skipped.join(\"; \")+\"\\n\");process.exit(1)'","depends_on":["read-backlog","build-sdk"],"id":"select-entry","max_iterations":1,"retry":{"initial_backoff_ms":100,"jitter_percent":20,"max_backoff_ms":60000,"multiplier":2},"type":"deterministic","verification":{}},{"command":"node -e 'const fs=require(\"node:fs\");const P=require(\"node:path\"),F=require(\"node:fs\");const SDK=(()=>{if(process.env.RELAYFLOWS_SDK_DIST)return P.resolve(process.env.RELAYFLOWS_SDK_DIST,\"backlog-picker.js\");let c=process.cwd();for(;;){const f=P.join(c,\"sdk\",\"dist\",\"backlog-picker.js\");if(F.existsSync(f))return f;const up=P.dirname(c);if(up===c)throw new Error(\"SDK_DIST_NOT_FOUND: build the sdk or set RELAYFLOWS_SDK_DIST\");c=up}})();const sdk=require(SDK);const entry=JSON.parse(fs.readFileSync(\".relayflow/backlog-picker-entry.json\",\"utf8\"));const pkg=sdk.packageFromEntry(entry);const verdict=sdk.validateWorkPackage(pkg);if(!verdict.accepted){process.stderr.write(\"REFUSED_MALFORMED_BACKLOG_ENTRY reason=\"+verdict.reason+\"\\n\");process.exit(1)}process.stdout.write(JSON.stringify(pkg))'","depends_on":["select-entry"],"id":"emit-package","max_iterations":1,"retry":{"initial_backoff_ms":100,"jitter_percent":20,"max_backoff_ms":60000,"multiplier":2},"type":"deterministic","verification":{}}],"version":"0.1.0"}
diff --git a/workflows/bootstrap-gate1.yaml b/workflows/bootstrap-gate1.yaml
index da77b1da2..4aa6c8ed9 100644
--- a/workflows/bootstrap-gate1.yaml
+++ b/workflows/bootstrap-gate1.yaml
@@ -105,7 +105,7 @@ workflows:
         maxIterations: 3
         task: |
           Read kernel/DESIGN.md, docs/RFC-0001-everything-is-a-relayflow.md and
-          AGENTS.md. Implement sdk/ as a TypeScript package (npm, vitest):
+          AGENTS.md. Implement packages/sdk/ as a TypeScript package (npm, vitest):
           - Spec types mirroring RFC §1's ladder: deterministic | llm | agent
             steps, verification gates, flow spec. Zero-agent flows are legal.
           - A YAML → spec JSON compiler with schema validation.
@@ -122,7 +122,7 @@ workflows:
       - name: sdk-tests
         type: deterministic
         dependsOn: [sdk-skeleton]
-        command: cd sdk && npm install --no-audit --no-fund >/dev/null 2>&1 && npm test 2>&1 | tail -15
+        command: cd packages/sdk && npm install --no-audit --no-fund >/dev/null 2>&1 && npm test 2>&1 | tail -15
         timeoutMs: 900000
 
       - name: adversarial-review
@@ -131,7 +131,7 @@ workflows:
         dependsOn: [kernel-tests, sdk-tests]
         task: |
           Read docs/RFC-0001-everything-is-a-relayflow.md, AGENTS.md,
-          kernel/DESIGN.md, and the full contents of kernel/ and sdk/.
+          kernel/DESIGN.md, and the full contents of kernel/ and packages/sdk/.
           Adversarially review: try to refute that this skeleton satisfies the
           gate-1 direction — journal append-only and fail-closed? completed
           steps replay as results, not code? completionReason everywhere?
diff --git a/workflows/drive-cloud.yaml b/workflows/drive-cloud.yaml
index 6c58c818e..3fdbb688a 100644
--- a/workflows/drive-cloud.yaml
+++ b/workflows/drive-cloud.yaml
@@ -27,7 +27,7 @@ agents:
 - name: builder
   cli: codex
   preset: worker
-  role: Implements the work package. Rust for kernel/, TypeScript for sdk/.
+  role: Implements the work package. Rust for kernel/, TypeScript for packages/sdk/.
 - name: adversary
   cli: claude
   preset: reviewer
@@ -101,7 +101,7 @@ workflows:
       \ the known\nsandbox faults that are NOT reasons to block. Then read\nops/DIRECTIVES.md \u2014 standing\
       \ human directives outrank the backlog;\nif one is unsatisfied, it IS the work package.\nThen read\
       \ docs/bootstrap-report.md and ops/DRIVE-LOG.md if they exist,\n`git log --oneline -15`, `gh pr\
-      \ list --state open` and open PR review\nstate, kernel/ and sdk/ test status. Then write ops/NEXT.md:\
+      \ list --state open` and open PR review\nstate, kernel/ and packages/sdk/ test status. Then write ops/NEXT.md:\
       \ the\nSINGLE highest-priority work package toward the current gate\n(gate 1 until its done-when\
       \ in RFC-0001 \xA73 holds), with: objective,\nfiles in scope, definition of done (must include passing\
       \ commands),\nand what is explicitly OUT of scope for this tick. If an open PR is\nawaiting fixes\
@@ -221,19 +221,19 @@ workflows:
       \ test --workspace 2>&1); rc=$?\n  echo \"$out\" | tail -8; ran=1\n  if [ $rc -eq 124 ]; then\n\
       \    echo \"VERIFY_SUITE_TIMEOUT: the kernel suite exceeded ${VERIFY_SUITE_TIMEOUT:-900}s and was\
       \ killed.\"\n    echo \"  A hanging test is a defect, not a pass \u2014 recording it as a failure.\"\
-      \n  fi\n  [ $rc -eq 0 ] || ok=1\nfi\nif [ -f sdk/package.json ]; then\n  # node_modules is not in\
+      \n  fi\n  [ $rc -eq 0 ] || ok=1\nfi\nif [ -f packages/sdk/package.json ]; then\n  # node_modules is not in\
       \ `git ls-files`, so a sandbox has none.\n  # Install before testing, and treat a failed install\
       \ as a failed\n  # verify rather than letting `npm test` report a confusing error.\n  if [ ! -d\
-      \ sdk/node_modules ]; then\n    echo \"VERIFY_INSTALL: sdk/node_modules absent \u2014 installing\"\
-      \n    out=$(cd sdk && run_bounded \"npm ci\" npm ci 2>&1); rc=$?\n    if [ $rc -ne 0 ]; then\n \
+      \ packages/sdk/node_modules ]; then\n    echo \"VERIFY_INSTALL: packages/sdk/node_modules absent \u2014 installing\"\
+      \n    out=$(cd packages/sdk && run_bounded \"npm ci\" npm ci 2>&1); rc=$?\n    if [ $rc -ne 0 ]; then\n \
       \     echo \"$out\" | tail -12\n      echo \"VERIFY_FAIL: npm ci failed \u2014 cannot test what\
       \ did not install\"\n      exit 1\n    fi\n  fi\n  # Restore exec bits. `npm ci` reported success\
       \ (96 packages) and\n  # esbuild still failed with EACCES on run 909e18f6, so the mount\n  # this\
       \ installs onto does not carry the executable bit. That is\n  # the same fault that left ops/cargo.sh\
       \ non-executable. Which\n  # layer drops it is NOT established; this repairs the symptom\n  # where\
-      \ it is observed and is a no-op where the bit survives.\n  chmod -R +x sdk/node_modules/.bin 2>/dev/null\
-      \ || true\n  find sdk/node_modules -type d -name bin -path \"*esbuild*\" \\\n    -exec chmod -R\
-      \ +x {} + 2>/dev/null || true\n  out=$(cd sdk && run_bounded \"sdk suite\" npm test 2>&1); rc=$?\n\
+      \ it is observed and is a no-op where the bit survives.\n  chmod -R +x packages/sdk/node_modules/.bin 2>/dev/null\
+      \ || true\n  find packages/sdk/node_modules -type d -name bin -path \"*esbuild*\" \\\n    -exec chmod -R\
+      \ +x {} + 2>/dev/null || true\n  out=$(cd packages/sdk && run_bounded \"sdk suite\" npm test 2>&1); rc=$?\n\
       \  echo \"$out\" | tail -8; ran=1\n  if [ $rc -eq 124 ]; then\n    echo \"VERIFY_SUITE_TIMEOUT:\
       \ the sdk suite exceeded ${VERIFY_SUITE_TIMEOUT:-900}s and was killed.\"\n  fi\n  [ $rc -eq 0 ]\
       \ || ok=1\nfi\nif [ \"$ran\" -eq 0 ]; then\n  echo \"VERIFY_FAIL: no suite found \u2014 a verify\
@@ -244,9 +244,9 @@ workflows:
       \ on\n# #35, #40 and #48. Four recurrences after the warning is enough\n# evidence that prose does\
       \ not hold and a check does.\n#\n# Same for unevidenced test claims: \"all three tests pass\" with\
       \ no\n# transcript. validateNextWorkPackage refuses both shapes.\n#\n# Runs BEFORE the node_modules\
-      \ cleanup below, which needs sdk/dist.\nif [ -f ops/NEXT.md ] && [ -f sdk/dist/index.js ]; then\n\
+      \ cleanup below, which needs packages/sdk/dist.\nif [ -f ops/NEXT.md ] && [ -f packages/sdk/dist/index.js ]; then\n\
       \  nextout=$(node -e '\n    const fs = require(\"node:fs\");\n    const { validateNextWorkPackage\
-      \ } = require(\"./sdk/dist/index.js\");\n    const verdict = validateNextWorkPackage(\n      fs.readFileSync(\"\
+      \ } = require(\"./packages/sdk/dist/index.js\");\n    const verdict = validateNextWorkPackage(\n      fs.readFileSync(\"\
       ops/NEXT.md\", \"utf8\"),\n      (p) => fs.existsSync(p),\n    );\n    if (!verdict.accepted) {\n\
       \      console.log(\"NEXT_REFUSED \" + verdict.reason);\n      process.exit(1);\n    }\n    console.log(\"\
       NEXT_OK\");\n  ' 2>&1) || true\n  echo \"$nextout\" | tail -2\n  case \"$nextout\" in\n    *NEXT_REFUSED*)\n\
@@ -268,8 +268,8 @@ workflows:
       # a PR. A run that delivers needs its flush to work whether or not\n# its gates passed, and node_modules\
       \ is reinstallable, so there was\n# never anything to preserve for diagnosis here.\n#\n# Guarded\
       \ with || true and placed AFTER the pass/fail decision is\n# computed, so a cleanup problem can\
-      \ never change the verdict.\nrm -rf sdk/node_modules sdk/dist surface/dist 2>/dev/null || true\n\
-      echo \"VERIFY_TREE_SLIMMED: removed sdk/node_modules and generated dist trees before flush (ok=$ok)\"\
+      \ never change the verdict.\nrm -rf packages/sdk/node_modules packages/sdk/dist packages/surface/dist 2>/dev/null || true\n\
+      echo \"VERIFY_TREE_SLIMMED: removed packages/sdk/node_modules and generated dist trees before flush (ok=$ok)\"\
       \n\n# Measure the tree instead of guessing at it.\n#\n# The relayfile flush keeps failing (http\
       \ 413) and three successive\n# hypotheses about WHY were wrong: kernel/target was removed and the\n\
       # count barely moved; node_modules was removed and it still failed;\n# HOME turned out to be /home/daytona,\
diff --git a/workflows/drive.yaml b/workflows/drive.yaml
index 9bbda344e..a3482dd8a 100644
--- a/workflows/drive.yaml
+++ b/workflows/drive.yaml
@@ -20,7 +20,7 @@ agents:
   - name: builder
     cli: codex
     preset: worker
-    role: Implements the work package. Rust for kernel/, TypeScript for sdk/.
+    role: Implements the work package. Rust for kernel/, TypeScript for packages/sdk/.
   - name: adversary
     cli: claude
     preset: reviewer
@@ -153,7 +153,7 @@ workflows:
           if one is unsatisfied, it IS the work package.
           Then read docs/bootstrap-report.md and ops/DRIVE-LOG.md if they exist,
           `git log --oneline -15`, `gh pr list --state open` and open PR review
-          state, kernel/ and sdk/ test status. Then write ops/NEXT.md: the
+          state, kernel/ and packages/sdk/ test status. Then write ops/NEXT.md: the
           SINGLE highest-priority work package toward the current gate
           (gate 1 until its done-when in RFC-0001 §3 holds), with: objective,
           files in scope, definition of done (must include passing commands),
@@ -346,13 +346,13 @@ workflows:
             fi
             [ $rc -eq 0 ] || ok=1
           fi
-          if [ -f sdk/package.json ]; then
+          if [ -f packages/sdk/package.json ]; then
             # node_modules is not in `git ls-files`, so a sandbox has none.
             # Install before testing, and treat a failed install as a failed
             # verify rather than letting `npm test` report a confusing error.
-            if [ ! -d sdk/node_modules ]; then
-              echo "VERIFY_INSTALL: sdk/node_modules absent — installing"
-              out=$(cd sdk && run_bounded "npm ci" npm ci 2>&1); rc=$?
+            if [ ! -d packages/sdk/node_modules ]; then
+              echo "VERIFY_INSTALL: packages/sdk/node_modules absent — installing"
+              out=$(cd packages/sdk && run_bounded "npm ci" npm ci 2>&1); rc=$?
               if [ $rc -ne 0 ]; then
                 echo "$out" | tail -12
                 echo "VERIFY_FAIL: npm ci failed — cannot test what did not install"
@@ -365,10 +365,10 @@ workflows:
             # the same fault that left ops/cargo.sh non-executable. Which
             # layer drops it is NOT established; this repairs the symptom
             # where it is observed and is a no-op where the bit survives.
-            chmod -R +x sdk/node_modules/.bin 2>/dev/null || true
-            find sdk/node_modules -type d -name bin -path "*esbuild*" \
+            chmod -R +x packages/sdk/node_modules/.bin 2>/dev/null || true
+            find packages/sdk/node_modules -type d -name bin -path "*esbuild*" \
               -exec chmod -R +x {} + 2>/dev/null || true
-            out=$(cd sdk && run_bounded "sdk suite" npm test 2>&1); rc=$?
+            out=$(cd packages/sdk && run_bounded "sdk suite" npm test 2>&1); rc=$?
             echo "$out" | tail -8; ran=1
             if [ $rc -eq 124 ]; then
               echo "VERIFY_SUITE_TIMEOUT: the sdk suite exceeded ${VERIFY_SUITE_TIMEOUT:-900}s and was killed."
@@ -390,11 +390,11 @@ workflows:
           # Same for unevidenced test claims: "all three tests pass" with no
           # transcript. validateNextWorkPackage refuses both shapes.
           #
-          # Runs BEFORE the node_modules cleanup below, which needs sdk/dist.
-          if [ -f ops/NEXT.md ] && [ -f sdk/dist/index.js ]; then
+          # Runs BEFORE the node_modules cleanup below, which needs packages/sdk/dist.
+          if [ -f ops/NEXT.md ] && [ -f packages/sdk/dist/index.js ]; then
             nextout=$(node -e '
               const fs = require("node:fs");
-              const { validateNextWorkPackage } = require("./sdk/dist/index.js");
+              const { validateNextWorkPackage } = require("./packages/sdk/dist/index.js");
               const verdict = validateNextWorkPackage(
                 fs.readFileSync("ops/NEXT.md", "utf8"),
                 (p) => fs.existsSync(p),
@@ -443,8 +443,8 @@ workflows:
           #
           # Guarded with || true and placed AFTER the pass/fail decision is
           # computed, so a cleanup problem can never change the verdict.
-          rm -rf sdk/node_modules sdk/dist surface/dist 2>/dev/null || true
-          echo "VERIFY_TREE_SLIMMED: removed sdk/node_modules and generated dist trees before flush (ok=$ok)"
+          rm -rf packages/sdk/node_modules packages/sdk/dist packages/surface/dist 2>/dev/null || true
+          echo "VERIFY_TREE_SLIMMED: removed packages/sdk/node_modules and generated dist trees before flush (ok=$ok)"
 
           # Measure the tree instead of guessing at it.
           #