@@ -319,7 +319,9 @@ func (r *Runner) Start(ctx context.Context) (_ *Result, err error) {
 		Config:    r.sources.Config,
 		Overrides: r.sources.Overrides,
 	})
-	resolveErrs := resolver.Resolve(nil)
+	// graph is unbound at this point (op.Plan deferred Unbind); pass nil env. Phase 4 wires the real
+	// preflight pass inside GraphExecutor.Run where env is live.
+	resolveErrs := resolver.Resolve(nil, nil)
 	if len(resolveErrs) > 0 {
 		return nil, fmt.Errorf("variable resolution: %v", resolveErrs)
 	}
 
@@ -14,6 +14,8 @@
 package application
 
 import (
+	"strings"
+
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 )
@@ -32,8 +34,9 @@ type Application struct {
 	Name string
 
 	// Flags carries values parsed from command-line arguments. Consumed by [op.VariableResolver] under
-	// [op.VariableSourceKindFlag]. Keys are the cobra/pflag flag names (kebab-case as the user typed them);
-	// values are the typed Go value pflag parsed.
+	// [op.VariableSourceKindFlag]. Keys are snake-case (normalized from cobra/pflag's kebab-case at
+	// [NewApplication] time so `--dry-run` lands under `Flags["dry_run"]`); values are the typed Go value
+	// pflag parsed.
 	//
 	// Populated by [NewApplication] via [pflag.FlagSet.Visit] — only flags the user explicitly supplied are
 	// present. A lookup for a flag the user did not pass returns the zero value via map-zero semantics.
@@ -49,20 +52,26 @@ type Application struct {
 }
 
 // DryRun reports whether the user supplied `--dry-run` on the active command. Reads
-// [Application.Flags] under the canonical key "dry-run" (the cobra flag name verbatim). Returns false when
-// the flag was not supplied, when its value is not a bool, or when [Application.Flags] is nil.
+// [Application.Flags] under the canonical snake-case key "dry_run" (normalized from cobra's "dry-run"
+// at [NewApplication] time). Returns false when the flag was not supplied, when its value is not a
+// bool, or when [Application.Flags] is nil.
 //
 // Returns:
 //   - `bool`: true when `--dry-run` was supplied; false otherwise.
 func (a *Application) DryRun() bool {
 
-	v, _ := a.Flags["dry-run"].(bool)
+	v, _ := a.Flags["dry_run"].(bool)
 	return v
 }
 
 // NewApplication constructs an [Application] from a cobra command's parsed flag state. Walks the command's
 // merged pflag set (cobra merges persistent + local automatically when [cobra.Command.Flags] is called on
-// the leaf) and stamps each user-supplied flag into [Application.Flags]. Defaults are not stamped.
+// the leaf) and stamps each user-supplied flag into [Application.Flags] under its snake-case form (cobra's
+// kebab-case flag name with hyphens replaced by underscores). Defaults are not stamped.
+//
+// The kebab→snake normalization makes [Application.Flags] uniform with [op.VariableResolver]'s parameter
+// name conventions (snake_case throughout); the resolver's flag-source step matches the parameter name
+// verbatim against the snake-case keys.
 //
 // Config and Overrides are left nil. Tools that source either layer populate them via direct field
 // assignment after construction.
@@ -77,7 +86,7 @@ func NewApplication(name string, cmd *cobra.Command) *Application {
 
 	flags := make(map[string]any)
 	cmd.Flags().Visit(func(f *pflag.Flag) {
-		flags[f.Name] = flagValue(cmd, f)
+		flags[kebabToSnake(f.Name)] = flagValue(cmd, f)
 	})
 
 	return &Application{
@@ -86,6 +95,19 @@ func NewApplication(name string, cmd *cobra.Command) *Application {
 	}
 }
 
+// kebabToSnake converts a cobra/pflag kebab-case flag name to snake_case by replacing every '-' with
+// '_'. Idempotent on already-snake names.
+//
+// Parameters:
+//   - `name`: the kebab-case flag name (e.g., "dry-run", "target-root").
+//
+// Returns:
+//   - `string`: the snake-case form (e.g., "dry_run", "target_root").
+func kebabToSnake(name string) string {
+
+	return strings.ReplaceAll(name, "-", "_")
+}
+
 // flagValue extracts the typed Go value of a [pflag.Flag] by switching on its declared type. The pflag
 // typed accessors are called on the [cobra.Command]'s merged FlagSet because each accessor handles the
 // not-found case via its second return value — we already know the flag exists (Visit yielded it), so the
 
@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: SSPL-1.0
+// Copyright (c) 2025-2026 Noble Factor. All rights reserved.
+
+package application
+
+import (
+	"testing"
+
+	"github.com/spf13/cobra"
+)
+
+func TestDryRun_Snake(t *testing.T) {
+
+	t.Run("true under snake key", func(t *testing.T) {
+		app := &Application{Flags: map[string]any{"dry_run": true}}
+		if !app.DryRun() {
+			t.Error("DryRun() = false, want true")
+		}
+	})
+
+	t.Run("missing returns false", func(t *testing.T) {
+		app := &Application{Flags: map[string]any{}}
+		if app.DryRun() {
+			t.Error("DryRun() with missing key should be false")
+		}
+	})
+
+	t.Run("nil Flags returns false", func(t *testing.T) {
+		app := &Application{}
+		if app.DryRun() {
+			t.Error("DryRun() with nil Flags should be false")
+		}
+	})
+
+	t.Run("wrong type returns false", func(t *testing.T) {
+		app := &Application{Flags: map[string]any{"dry_run": "true"}}
+		if app.DryRun() {
+			t.Error("DryRun() with non-bool value should be false")
+		}
+	})
+
+	t.Run("kebab key is NOT honored (post-normalization world)", func(t *testing.T) {
+		app := &Application{Flags: map[string]any{"dry-run": true}}
+		if app.DryRun() {
+			t.Error("DryRun() should not read kebab-case key; normalization happens at NewApplication time")
+		}
+	})
+}
+
+func TestNewApplication_KebabToSnake(t *testing.T) {
+
+	cmd := &cobra.Command{Use: "test"}
+	cmd.Flags().Bool("dry-run", false, "")
+	cmd.Flags().String("target-root", "", "")
+	cmd.Flags().String("layer", "", "")
+
+	if err := cmd.ParseFlags([]string{"--dry-run", "--target-root", "/tmp/x", "--layer", "personal"}); err != nil {
+		t.Fatalf("ParseFlags: %v", err)
+	}
+
+	app := NewApplication("writ", cmd)
+
+	if app.Name != "writ" {
+		t.Errorf("Name = %q, want writ", app.Name)
+	}
+
+	for _, key := range []string{"dry_run", "target_root", "layer"} {
+		if _, ok := app.Flags[key]; !ok {
+			t.Errorf("Flags missing snake-case key %q (have %v)", key, app.Flags)
+		}
+	}
+
+	for _, key := range []string{"dry-run", "target-root"} {
+		if _, ok := app.Flags[key]; ok {
+			t.Errorf("Flags should NOT have kebab-case key %q after normalization", key)
+		}
+	}
+
+	if v, _ := app.Flags["dry_run"].(bool); !v {
+		t.Errorf("dry_run = %v, want true", v)
+	}
+	if v, _ := app.Flags["target_root"].(string); v != "/tmp/x" {
+		t.Errorf("target_root = %q, want /tmp/x", v)
+	}
+}
+
+func TestNewApplication_UnsetFlagsNotStamped(t *testing.T) {
+
+	cmd := &cobra.Command{Use: "test"}
+	cmd.Flags().Bool("dry-run", false, "")
+	cmd.Flags().String("target-root", "default", "")
+
+	// User passes only --dry-run; --target-root is left at default.
+	if err := cmd.ParseFlags([]string{"--dry-run"}); err != nil {
+		t.Fatalf("ParseFlags: %v", err)
+	}
+
+	app := NewApplication("writ", cmd)
+
+	if _, ok := app.Flags["dry_run"]; !ok {
+		t.Error("user-supplied flag should be stamped")
+	}
+	if _, ok := app.Flags["target_root"]; ok {
+		t.Error("unset flag (default value) should NOT be stamped")
+	}
+}
+
+func TestKebabToSnake(t *testing.T) {
+
+	tests := []struct {
+		in, want string
+	}{
+		{"dry-run", "dry_run"},
+		{"target-root", "target_root"},
+		{"layer", "layer"},                 // no hyphens: unchanged.
+		{"already_snake", "already_snake"}, // idempotent.
+		{"a-b-c-d", "a_b_c_d"},
+		{"", ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.in, func(t *testing.T) {
+			if got := kebabToSnake(tt.in); got != tt.want {
+				t.Errorf("kebabToSnake(%q) = %q, want %q", tt.in, got, tt.want)
+			}
+		})
+	}
+}
@@ -0,0 +1,169 @@
+// SPDX-License-Identifier: SSPL-1.0
+// Copyright (c) 2025-2026 Noble Factor. All rights reserved.
+
+package op
+
+import (
+	"encoding"
+	"encoding/json"
+	"fmt"
+	"os"
+	"reflect"
+	"strconv"
+	"time"
+)
+
+// Compile-time interface check.
+var _ SourceConverter = envValue("")
+
+var (
+	// envValueTimeDurationType is the `[reflect.Type]` of `[time.Duration]`.
+	envValueTimeDurationType = reflect.TypeOf(time.Duration(0))
+
+	// envValueFileModeType is the `[reflect.Type]` of `[os.FileMode]`.
+	envValueFileModeType = reflect.TypeOf(os.FileMode(0))
+
+	// envValueResourceType is the `[reflect.Type]` of the `[Resource]` interface for the Resource-target `opt-out`.
+	envValueResourceType = reflect.TypeOf((*Resource)(nil)).Elem()
+)
+
+// envValue wraps a raw env-sourced string so the [Convert] cascade routes string parsing through [SourceConverter].
+//
+// The wrapper exists because plain `string` cannot implement [SourceConverter] (Go forbids methods on built-in types),
+// and routing string-source parsing through [Convert] directly would corrupt the cascade. See the layering note at the
+// head of `parameter.go`'s [parseDefaultExpression] for the rationale that keeps source-syntax parsing out of [Convert].
+//
+// envValue keeps env-source string parsing localized: env strings get the lenient cascade (primitives → stdlib
+// special-cases → [encoding.TextUnmarshaler] → [json.Unmarshal]), while plain Go strings from starlark slot fills and
+// immediate-mode Go calls continue to fail on primitive targets as they always have. [envValue.CanConvertTo] returns
+// false for [Resource] targets, so [Convert] step 7 (registered Resource construction) wins routing for env strings
+// naming a Resource.
+type envValue string
+
+// region EXPORTED METHODS
+
+// region Behaviors
+
+// CanConvertTo reports whether [envValue.ConvertTo] can produce a value of the given target.
+//
+// Returns false for nil targets and for targets implementing [Resource] (the cascade falls through to [Convert] step 7,
+// which routes through the registered Resource constructor with the original env value). Returns true for every other
+// target; [envValue.ConvertTo] performs the actual parsing and may return its own error if no strategy succeeds.
+//
+// Parameters:
+//   - `target`: the parsed-value type.
+//
+// Returns:
+//   - `bool`: false when `target` is nil or implements [Resource]; true otherwise.
+func (envValue) CanConvertTo(target reflect.Type) bool {
+
+	if target == nil {
+		return false
+	}
+	if target.Implements(envValueResourceType) {
+		return false
+	}
+	return true
+}
+
+// ConvertTo parses the wrapped env string into a value of target. Tries (in order):
+//
+//  1. `string` identity when `target.Kind() == reflect.String`.
+//  2. [time.Duration] via [time.ParseDuration] handles "30s", "1h15m", etc.
+//  3. [os.FileMode] via [strconv.ParseUint] base 0 handles "0o755", "0x1ff", "493".
+//  4. `primitive` [reflect.Kind] switch for bool/int*/uint*/float*/complex* via strconv with base 0.
+//  5. [encoding.TextUnmarshaler] on a fresh `*target` probe.
+//  6. [json.Unmarshal] universal fallback.
+//
+// Parameters:
+//   - `target`: the parsed-value type.
+//
+// Returns:
+//   - `any`: the parsed value, dynamic-type-equal to target.
+//   - `error`: non-nil when no parsing strategy succeeds.
+func (e envValue) ConvertTo(target reflect.Type) (any, error) {
+
+	raw := string(e)
+
+	if target == nil {
+		return nil, fmt.Errorf("envValue.ConvertTo: nil target")
+	}
+
+	if target.Kind() == reflect.String {
+		return reflect.ValueOf(raw).Convert(target).Interface(), nil
+	}
+
+	if target == envValueTimeDurationType {
+		d, err := time.ParseDuration(raw)
+		if err != nil {
+			return nil, fmt.Errorf("parse %q as time.Duration: %w", raw, err)
+		}
+		return d, nil
+	}
+
+	if target == envValueFileModeType {
+		v, err := strconv.ParseUint(raw, 0, 32)
+		if err != nil {
+			return nil, fmt.Errorf("parse %q as os.FileMode: %w", raw, err)
+		}
+		return os.FileMode(v), nil
+	}
+
+	switch target.Kind() {
+
+	case reflect.Bool:
+		v, err := strconv.ParseBool(raw)
+		if err != nil {
+			return nil, fmt.Errorf("parse %q as %s: %w", raw, target, err)
+		}
+		return reflect.ValueOf(v).Convert(target).Interface(), nil
+
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		v, err := strconv.ParseInt(raw, 0, target.Bits())
+		if err != nil {
+			return nil, fmt.Errorf("parse %q as %s: %w", raw, target, err)
+		}
+		return reflect.ValueOf(v).Convert(target).Interface(), nil
+
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		v, err := strconv.ParseUint(raw, 0, target.Bits())
+		if err != nil {
+			return nil, fmt.Errorf("parse %q as %s: %w", raw, target, err)
+		}
+		return reflect.ValueOf(v).Convert(target).Interface(), nil
+
+	case reflect.Float32, reflect.Float64:
+		v, err := strconv.ParseFloat(raw, target.Bits())
+		if err != nil {
+			return nil, fmt.Errorf("parse %q as %s: %w", raw, target, err)
+		}
+		return reflect.ValueOf(v).Convert(target).Interface(), nil
+
+	case reflect.Complex64, reflect.Complex128:
+		v, err := strconv.ParseComplex(raw, target.Bits())
+		if err != nil {
+			return nil, fmt.Errorf("parse %q as %s: %w", raw, target, err)
+		}
+		return reflect.ValueOf(v).Convert(target).Interface(), nil
+	}
+
+	probe := reflect.New(target).Interface()
+
+	if tu, ok := probe.(encoding.TextUnmarshaler); ok {
+		if err := tu.UnmarshalText([]byte(raw)); err != nil {
+			return nil, fmt.Errorf("UnmarshalText %q into %s: %w", raw, target, err)
+		}
+		return reflect.ValueOf(probe).Elem().Interface(), nil
+	}
+
+	out := reflect.New(target).Interface()
+
+	if err := json.Unmarshal([]byte(raw), out); err != nil {
+		return nil, fmt.Errorf("unmarshal %q as %s: %w", raw, target, err)
+	}
+	return reflect.ValueOf(out).Elem().Interface(), nil
+}
+
+// endregion
+
+// endregion