@codedrifters/configulator 0.0.403 → 0.0.405

package/lib/index.mjs

@@ -5556,6 +5556,409 @@ function buildBcmWriterBundle(paths = DEFAULT_AGENT_PATHS, issueDefaults = DEFAU
 }
 var bcmWriterBundle = buildBcmWriterBundle();
 
+// src/turbo/turbo-repo.ts
+import {
+  Component as Component2,
+  FileBase,
+  JsonFile,
+  SampleDir,
+  SampleFile
+} from "projen/lib";
+import { JobPermission } from "projen/lib/github/workflows-model";
+
+// src/turbo/turbo-repo-task.ts
+import { Component } from "projen/lib";
+var TurboRepoTask = class extends Component {
+  constructor(project, options) {
+    super(project);
+    this.project = project;
+    this.name = options.name;
+    this.dependsOn = options.dependsOn ?? [];
+    this.env = options.env ?? [];
+    this.passThroughEnv = options.passThroughEnv ?? [];
+    this.outputs = options.outputs ?? [];
+    this.cache = options.cache ?? true;
+    this.inputs = [
+      ...options.inputs ?? [],
+      // rerun if projen config changes
+      ".projen/**",
+      // ignore mac files
+      "!.DS_Store",
+      "!**/.DS_Store"
+    ];
+    this.outputLogs = options.outputLogs ?? "new-only";
+    this.persistent = options.persistent ?? false;
+    this.interactive = options.interactive ?? false;
+    this.isActive = true;
+  }
+  taskConfig() {
+    return {
+      dependsOn: this.dependsOn,
+      env: this.env,
+      passThroughEnv: this.passThroughEnv,
+      outputs: this.outputs,
+      cache: this.cache,
+      inputs: this.inputs,
+      outputLogs: this.outputLogs,
+      persistent: this.persistent,
+      interactive: this.interactive
+    };
+  }
+};
+
+// src/turbo/turbo-repo.ts
+var ROOT_TURBO_TASK_NAME = "turbo:build";
+var ROOT_CI_TASK_NAME = "build:all";
+var _TurboRepo = class _TurboRepo extends Component2 {
+  constructor(project, options = {}) {
+    super(project);
+    this.project = project;
+    /**
+     * Sub-Tasks to run
+     */
+    this.tasks = [];
+    this.turboVersion = options.turboVersion ?? "catalog:";
+    this.isRootProject = project === project.root;
+    if (this.isRootProject) {
+      project.addDevDeps(`turbo@${this.turboVersion}`);
+    }
+    project.gitignore.addPatterns("/.turbo");
+    project.npmignore?.addPatterns("/.turbo/");
+    this.extends = options.extends ?? (this.isRootProject ? [] : ["//"]);
+    this.globalDependencies = options.globalDependencies ?? [];
+    this.globalEnv = options.globalEnv ?? [];
+    this.globalPassThroughEnv = options.globalPassThroughEnv ?? [];
+    this.ui = options.ui ?? "stream";
+    this.dangerouslyDisablePackageManagerCheck = options.dangerouslyDisablePackageManagerCheck ?? false;
+    this.cacheDir = options.cacheDir ?? ".turbo/cache";
+    this.daemon = options.daemon ?? true;
+    this.envMode = options.envMode ?? "strict";
+    this.runOptions = {
+      ...options.runOptions,
+      summarize: options.runOptions?.summarize ?? true,
+      concurrency: options.runOptions?.concurrency ?? 10
+    };
+    this.remoteCacheOptions = options.remoteCacheOptions;
+    this.buildAllTaskEnvVars = options.buildAllTaskEnvVars ?? {};
+    this.buildTask = new TurboRepoTask(this.project, {
+      name: ROOT_TURBO_TASK_NAME,
+      dependsOn: this.isRootProject ? [`^${ROOT_TURBO_TASK_NAME}`] : []
+    });
+    if (this.isRootProject) {
+      this.buildAllTask = this.project.tasks.addTask(ROOT_CI_TASK_NAME, {
+        description: "Root build followed by sub-project builds. Mimics the CI build process in one step."
+      });
+      this.buildAllTask.exec("turbo telemetry disable");
+      if (this.buildAllTaskEnvVars) {
+        Object.entries(this.buildAllTaskEnvVars).forEach(([name, value]) => {
+          this.addGlobalEnvVar(name, value);
+        });
+      }
+      if (!this.remoteCacheOptions) {
+        this.buildAllTask.exec(
+          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(false)}`
+        );
+      } else {
+        this.buildAllTask.exec(
+          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(true)}`,
+          {
+            condition: '[ ! -n "$CI" ]',
+            env: {
+              TURBO_ENDPOINT: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.endpointParamName} --query Parameter.Value --output text --profile ${this.remoteCacheOptions.profileName})`,
+              TURBO_TOKEN: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.tokenParamName} --query Parameter.Value --output text --profile ${this.remoteCacheOptions.profileName})`
+            }
+          }
+        );
+        this.buildAllTask.exec(
+          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(true)}`,
+          {
+            condition: '[ -n "$CI" ]',
+            env: {
+              TURBO_ENDPOINT: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.endpointParamName} --query Parameter.Value --output text)`,
+              TURBO_TOKEN: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.tokenParamName} --query Parameter.Value --output text)`
+            }
+          }
+        );
+      }
+    }
+    if (!this.isRootProject) {
+      this.preCompileTask = new TurboRepoTask(project, {
+        name: options.preCompileTask?.name ?? "pre-compile",
+        inputs: ["src/**"]
+      });
+      this.compileTask = new TurboRepoTask(project, {
+        name: options.compileTask?.name ?? "compile",
+        inputs: ["src/**"]
+      });
+      this.postCompileTask = new TurboRepoTask(project, {
+        name: options.postCompileTask?.name ?? "post-compile",
+        inputs: ["src/**"]
+      });
+      this.testTask = new TurboRepoTask(project, {
+        name: options.testTask?.name ?? "test"
+      });
+      this.packageTask = new TurboRepoTask(project, {
+        name: options.packageTask?.name ?? "package",
+        inputs: [".npmignore"]
+      });
+      this.tasks.push(
+        this.preCompileTask,
+        this.compileTask,
+        this.postCompileTask,
+        this.testTask,
+        this.packageTask
+      );
+    }
+  }
+  /**
+   * Static method to discovert turbo in a project.
+   */
+  static of(project) {
+    const isDefined = (c) => c instanceof _TurboRepo;
+    return project.components.find(isDefined);
+  }
+  /**
+   * Render the `turbo run` CLI flag string for the `build:all` / `reset:all`
+   * task commands from {@link runOptions}. With no `runOptions` configured the
+   * output matches the historically hard-coded flags exactly.
+   *
+   * @param remote - when `true`, also emit the remote-cache flags
+   * (`--cache=remote:rw` plus `--api` / `--token` / `--team` derived from
+   * {@link remoteCacheOptions}). The remote-cache `build:all` variant passes
+   * `true`; `reset:all` and the local `build:all` variant pass `false`.
+   */
+  renderRunArgs(remote) {
+    const run = this.runOptions;
+    const args = [];
+    if (run.summarize) {
+      args.push("--summarize");
+    }
+    args.push(`--concurrency=${run.concurrency}`);
+    if (run.force) {
+      args.push("--force");
+    }
+    if (run.noCache) {
+      args.push("--no-cache");
+    }
+    if (run.only) {
+      args.push("--only");
+    }
+    if (run.affected) {
+      args.push("--affected");
+    }
+    if (run.cacheWorkers !== void 0) {
+      args.push(`--cache-workers=${run.cacheWorkers}`);
+    }
+    if (run.continueOn !== void 0) {
+      args.push(`--continue=${run.continueOn}`);
+    }
+    if (run.frameworkInference !== void 0) {
+      args.push(`--framework-inference=${run.frameworkInference}`);
+    }
+    for (const filter of run.filter ?? []) {
+      args.push(`--filter=${filter}`);
+    }
+    if (run.outputLogs !== void 0) {
+      args.push(`--output-logs=${run.outputLogs}`);
+    }
+    if (run.logOrder !== void 0) {
+      args.push(`--log-order=${run.logOrder}`);
+    }
+    if (run.logPrefix !== void 0) {
+      args.push(`--log-prefix=${run.logPrefix}`);
+    }
+    if (run.dryRun !== void 0) {
+      args.push(`--dry-run=${run.dryRun}`);
+    }
+    const cache = run.cache ?? (remote ? "remote:rw" : void 0);
+    if (cache !== void 0) {
+      args.push(`--cache=${cache}`);
+    }
+    if (remote && this.remoteCacheOptions) {
+      args.push(
+        "--api=$TURBO_ENDPOINT",
+        "--token=$TURBO_TOKEN",
+        `--team=${this.remoteCacheOptions.teamName}`
+      );
+    }
+    if (run.additionalArgs) {
+      args.push(...run.additionalArgs);
+    }
+    return args.join(" ");
+  }
+  /**
+   * Add an env var to the global env vars for all tasks.
+   * This will also become an input for the build:all task cache at the root.
+   */
+  addGlobalEnvVar(name, value) {
+    this.buildAllTask?.env(name, value);
+    if (this.isRootProject) {
+      this.globalEnv.push(name);
+    }
+  }
+  activateBranchNameEnvVar(options) {
+    const value = '$([ -n "$GIT_BRANCH_NAME" ] && echo "$GIT_BRANCH_NAME" || git rev-parse --abbrev-ref HEAD)';
+    if (options === void 0) {
+      this.project.logger.warn(
+        "TurboRepo.activateBranchNameEnvVar() with no arguments is deprecated. It writes GIT_BRANCH_NAME to the root `globalEnv`, which forces every task in the monorepo to miss cache on every branch switch. Pass `{ tasks: [...] }` and name only the tasks that actually consume the branch (e.g. CDK synth/package) to preserve cross-branch cache hits for everything else."
+      );
+      this.addGlobalEnvVar("GIT_BRANCH_NAME", value);
+      return;
+    }
+    const knownTaskNames = this.tasks.map((task) => task.name);
+    const unknown = options.tasks.filter(
+      (name) => !knownTaskNames.includes(name)
+    );
+    if (unknown.length > 0) {
+      throw new Error(
+        `TurboRepo.activateBranchNameEnvVar: unknown task name(s) ${JSON.stringify(
+          unknown
+        )}. Known tasks on this TurboRepo: ${JSON.stringify(knownTaskNames)}.`
+      );
+    }
+    for (const name of options.tasks) {
+      const task = this.tasks.find((t) => t.name === name);
+      if (task && !task.env.includes("GIT_BRANCH_NAME")) {
+        task.env.push("GIT_BRANCH_NAME");
+      }
+    }
+  }
+  /**
+   * Paths of all generated files in the project, deduped, for use as task
+   * inputs so the compile cache invalidates when they change. Includes
+   * projen-managed `FileBase` files plus generated-once `SampleFile` /
+   * `SampleDir` — whose paths projen keeps private, so they are read defensively
+   * and skipped if that internal shape ever changes. Computed at synth time so
+   * files added after this component (e.g. a subclass's SampleFiles) are seen.
+   */
+  generatedFileInputs() {
+    const inputs = /* @__PURE__ */ new Set();
+    for (const component of this.project.components) {
+      if (component instanceof FileBase) {
+        inputs.add(component.path);
+      } else if (component instanceof SampleFile) {
+        const filePath = component.filePath;
+        if (typeof filePath === "string") {
+          inputs.add(filePath);
+        }
+      } else if (component instanceof SampleDir) {
+        const dir = component.dir;
+        if (typeof dir === "string") {
+          inputs.add(`${dir}/**`);
+        }
+      }
+    }
+    return Array.from(inputs);
+  }
+  preSynthesize() {
+    let nextDependsOn = this.project.deps.all.filter((d) => d.version === "workspace:*").map((d) => [d.name, ROOT_TURBO_TASK_NAME].join("#"));
+    if (!this.isRootProject) {
+      [
+        [this.project.preCompileTask, this.preCompileTask],
+        [this.project.compileTask, this.compileTask],
+        [this.project.postCompileTask, this.postCompileTask],
+        [this.project.testTask, this.testTask],
+        [this.project.packageTask, this.packageTask]
+      ].forEach(([pjTask, turboTask]) => {
+        if (pjTask && turboTask && pjTask.steps.length > 0) {
+          if (nextDependsOn.length > 0) {
+            turboTask.dependsOn.push(...nextDependsOn);
+          }
+          nextDependsOn = [turboTask.name];
+        } else {
+          turboTask.isActive = false;
+        }
+      });
+      this.buildTask.dependsOn.push(...nextDependsOn);
+    }
+    const generatedInputs = this.generatedFileInputs();
+    const appendGeneratedInputs = (task) => {
+      if (!task) {
+        return;
+      }
+      for (const input of generatedInputs) {
+        if (!task.inputs.includes(input)) {
+          task.inputs.push(input);
+        }
+      }
+    };
+    if (this.isRootProject) {
+      appendGeneratedInputs(this.buildTask);
+    } else {
+      appendGeneratedInputs(this.preCompileTask);
+      appendGeneratedInputs(this.compileTask);
+      appendGeneratedInputs(this.postCompileTask);
+    }
+    const fileName = "turbo.json";
+    this.project.addPackageIgnore(fileName);
+    new JsonFile(this.project, fileName, {
+      obj: {
+        extends: this.extends.length ? this.extends : void 0,
+        globalDependencies: this.isRootProject && this.globalDependencies.length ? this.globalDependencies : void 0,
+        globalEnv: this.isRootProject && this.globalEnv.length ? this.globalEnv : void 0,
+        globalPassThroughEnv: this.isRootProject && this.globalPassThroughEnv.length ? this.globalPassThroughEnv : void 0,
+        ui: this.isRootProject ? this.ui : void 0,
+        dangerouslyDisablePackageManagerCheck: this.isRootProject ? this.dangerouslyDisablePackageManagerCheck : void 0,
+        cacheDir: this.isRootProject ? this.cacheDir : void 0,
+        envMode: this.isRootProject ? this.envMode : void 0,
+        /**
+         * All tasks
+         */
+        tasks: this.tasks.filter((task) => task.isActive).reduce(
+          (acc, task) => {
+            acc[task.name] = {
+              ...task.taskConfig()
+            };
+            return acc;
+          },
+          {
+            [this.buildTask.name]: { ...this.buildTask.taskConfig() }
+          }
+        )
+      }
+    });
+    super.preSynthesize();
+  }
+};
+_TurboRepo.buildWorkflowOptions = (remoteCacheOptions) => {
+  return {
+    env: {
+      GIT_BRANCH_NAME: "${{ github.head_ref || github.ref_name }}"
+    },
+    permissions: {
+      contents: JobPermission.WRITE,
+      idToken: JobPermission.WRITE
+    },
+    preBuildSteps: [
+      {
+        name: "AWS Creds for SSM",
+        uses: "aws-actions/configure-aws-credentials@v6",
+        with: {
+          ["role-to-assume"]: remoteCacheOptions.oidcRole,
+          ["aws-region"]: "us-east-1",
+          ["role-duration-seconds"]: "900"
+        }
+      }
+    ]
+  };
+};
+var TurboRepo = _TurboRepo;
+
+// src/agent/bundles/build-policy.ts
+var DEFAULT_BUILD_POLICY = {
+  remoteCacheEnabled: false
+};
+function resolveBuildPolicy(project) {
+  const remoteCacheOptions = TurboRepo.of(project)?.remoteCacheOptions;
+  if (!remoteCacheOptions) {
+    return DEFAULT_BUILD_POLICY;
+  }
+  return {
+    remoteCacheEnabled: true,
+    awsProfileName: remoteCacheOptions.profileName
+  };
+}
+
 // src/agent/bundles/business-models.ts
 var TEMPLATE_CANVAS = `---
 title: "Business Model: <Segment Name>"
@@ -10494,188 +10897,210 @@ var cleanMergedBranchesSkill = {
     }
   ]
 };
-var githubWorkflowBundle = {
-  name: "github-workflow",
-  description: "GitHub issue and PR workflow automation patterns",
-  appliesWhen: (project) => hasComponent(project, GitHub),
-  rules: [
-    {
-      name: "issue-workflow",
-      description: "Automated workflow for starting work on a GitHub issue",
-      scope: AGENT_RULE_SCOPE.ALWAYS,
-      content: [
-        "# Issue Workflow",
-        "",
-        '## "Work on issue X" Automation',
-        "",
-        "When the user says **work on issue X** (or similar), invoke the `issue-worker` agent in interactive mode, passing the issue number in the prompt. Do not perform the branch creation, issue fetching, or planning steps yourself \u2014 the agent handles the full workflow (claim, branch, plan, implement, PR) and will pause for your approval at the appropriate checkpoints."
-      ].join("\n"),
-      tags: ["workflow"]
-    },
-    {
-      name: "create-issue-workflow",
-      description: "Automated workflow for creating a new GitHub issue",
-      // ALWAYS scope: users invoke "create an issue" from any
-      // context, not only when editing agent / skill / bundle source.
-      // Consumers that want to narrow the load can override via
-      // `agentConfig.additionalRulePaths` or `excludeRules`.
-      scope: AGENT_RULE_SCOPE.ALWAYS,
-      content: [
-        "# Create Issue Workflow",
-        "",
-        '## "Create an issue" Automation',
-        "",
-        "When the user says **create an issue** (or similar), follow these steps exactly:",
-        "",
-        "1. **Determine the issue type prefix** from the user's description:",
-        "   - `epic:` \u2014 Large initiatives spanning multiple child issues",
-        "   - `feat:` \u2014 New features or functionality",
-        "   - `fix:` \u2014 Bug fixes",
-        "   - `chore:` \u2014 Maintenance: deps, tooling, config",
-        "   - `docs:` \u2014 Documentation-only work",
-        "   - `refactor:` \u2014 Code restructure, no behavior change",
-        "   - `release:` \u2014 Release preparation, version bumps",
-        "   - `hotfix:` \u2014 Urgent production fixes",
-        "   - If unclear, ask the user which type applies",
-        "2. **Compose the issue title** in the format: `<type>: <short description>`",
-        "3. **Determine the GitHub issue type** based on the prefix:",
-        "   - `epic:` \u2192 Epic",
-        "   - `feat:` \u2192 Feature",
-        "   - `fix:` \u2192 Bug",
-        "   - `chore:`, `docs:`, `refactor:`, `release:`, `hotfix:` \u2192 Task",
-        "4. **Identify prerequisite issues** \u2014 if the user mentions dependencies or blockers, include a **Dependencies** section in the body with `Depends on: #<issue-number>`",
-        "5. **Determine labels** \u2014 every issue must be created with the following labels:",
-        "   - **`type:*`** \u2014 derived from the issue title prefix:",
-        "     - `epic:` \u2192 `type:feat`",
-        "     - `feat:` \u2192 `type:feat`",
-        "     - `fix:` \u2192 `type:fix`",
-        "     - `chore:` \u2192 `type:chore`",
-        "     - `docs:` \u2192 `type:docs`",
-        "     - `refactor:` \u2192 `type:refactor`",
-        "     - `release:` \u2192 `type:release`",
-        "     - `hotfix:` \u2192 `type:hotfix`",
-        '   - **`priority:*`** \u2014 infer from the user\'s description when possible (e.g., "urgent"/"critical" \u2192 `priority:critical`, "important" \u2192 `priority:high`, "minor"/"low priority" \u2192 `priority:low`). If the priority is unclear, ask the user before creating the issue. Valid values: `priority:critical`, `priority:high`, `priority:medium`, `priority:low`, `priority:trivial`',
-        "   - **`status:ready`** \u2014 always add unless the issue has dependencies or blockers, in which case use `status:blocked`",
-        "6. **Create the issue** using `gh issue create`:",
-        "   - `--title '<type>: <description>'`",
-        "   - `--body '<issue body>'`",
-        "   - `--label '<type-label>' --label '<priority-label>' --label '<status-label>'`",
-        "7. **Set the GitHub issue type** by invoking the `set-issue-type.sh` helper (shipped with this bundle):",
-        "",
-        "   ```sh",
-        "   .claude/procedures/set-issue-type.sh <issue-number> <Feature|Task|Epic|Bug>",
-        "   ```",
-        "",
-        "   The helper resolves owner/repo, looks up the issue type node ID, looks up the issue node ID, and applies the `updateIssueIssueType` mutation in one step. It exits non-zero with a clear diagnostic on any error and lists available types if the type name is not recognised.",
-        "",
-        "   **Under the hood** (documented fallback if the helper is unavailable): the helper performs a two-step GraphQL flow \u2014 first a `repository(...).issueTypes` query to map the human-readable type name to a node ID, then the `updateIssueIssueType` mutation. The canonical queries are:",
-        "",
-        "   ```sh",
-        "   gh api graphql -f query='query($owner:String!,$repo:String!){repository(owner:$owner,name:$repo){issueTypes(first:50){nodes{id name}}}}' -f owner=<owner> -f repo=<repo>",
-        "   gh api graphql -f query='mutation($issueId:ID!,$typeId:ID!){updateIssueIssueType(input:{issueId:$issueId,issueTypeId:$typeId}){issue{number issueType{name}}}}' -f issueId=<issue-node-id> -f typeId=<issue-type-node-id>",
-        "   ```",
-        "",
-        "### Issue Body Template",
-        "",
-        "```markdown",
-        "## Summary",
-        "",
-        "<1-3 sentences describing the issue>",
-        "",
-        "## Details",
-        "",
-        "<Detailed description, acceptance criteria, or reproduction steps as appropriate>",
-        "",
-        "## Dependencies",
-        "",
-        "Depends on: #<issue-number> (if any, otherwise omit this section)",
-        "```",
-        "",
-        "### Important",
-        "",
-        "- Always use the conventional prefix in the issue title",
-        "- Always assign the correct GitHub issue type via the `set-issue-type.sh` helper (step 7) \u2014 never via `gh issue create --type`",
-        "- Always include `type:*`, `priority:*`, and `status:*` labels",
-        "- If the user does not specify a type, ask before creating the issue",
-        "- If the priority cannot be inferred from the description, ask the user before creating the issue",
-        "- Keep titles concise and descriptive"
-      ].join("\n"),
-      tags: ["workflow"]
-    },
-    {
-      name: "pr-workflow",
-      description: "Automated workflow for opening a pull request",
-      scope: AGENT_RULE_SCOPE.ALWAYS,
-      content: [
-        "# PR Workflow",
-        "",
-        '## "Open a PR" Automation',
-        "",
-        "When the user says **open a PR** (or similar), follow these steps exactly:",
-        "",
-        "1. **Regenerate project files** \u2014 run the three-step regen sequence (`pnpm i`, then `pnpm exec projen`, then `pnpm i` again) to ensure all generated files are up to date. The leading `pnpm i` is required because `pnpm exec projen` synthesises against whatever version of configulator (and projen, and any projen plugins) is currently resolved in `node_modules`; if the lockfile has moved past `node_modules` (typically right after `git pull` lands a dependency upgrade, or on a fresh checkout), synth runs against stale templates and produces phantom drift in `.claude/`, `.github/labels.yml`, `CLAUDE.md`, and other generated files. The trailing `pnpm i` picks up any dependency changes projen wrote into `package.json` during synth. Check `git diff` after the third step \u2014 if there are changes, commit them before proceeding.",
-        "2. **Run the full monorepo build** \u2014 run `pnpm build:all` to compile, lint, and test all packages (mirrors the CI pipeline). This command requires the user to be authenticated to AWS on the prod account used for Turborepo remote caching (`readonlyaccess-prod-525259625215-us-east-1` profile). If the command fails due to AWS credentials, ask the user to authenticate first. If the build produces changes to turbo inputs (typically snapshot files or ESLint auto-fixes), commit those changes and run `pnpm build:all` again \u2014 the build must complete cleanly with no uncommitted changes.",
-        "3. **Check for uncommitted changes** \u2014 if any exist, commit them with a conventional commit message",
-        "4. **Pull and rebase from the default branch** \u2014 run `git pull origin {{repository.defaultBranch}} --rebase` to incorporate the latest changes and resolve any conflicts before pushing",
-        "5. **Push the branch** to origin: `git push -u origin <branch>`",
-        "6. **Create the PR** using `gh pr create`:",
-        "   - **Title**: use a conventional commit style title (e.g., `feat(scope): short description`)",
-        "   - **Body**: include `Closes #<issue-number>` (derived from the branch name) and a brief summary of changes",
-        "7. **Delegate review and merge to the `pr-reviewer` sub-agent.** After the PR is created, invoke the `/review-pr <pr-number>` skill (or otherwise hand the new PR number to the `pr-reviewer` sub-agent). The reviewer verifies the diff against the linked issue's acceptance criteria and enables squash auto-merge when all checks pass. Do **not** run `gh pr merge --auto` yourself \u2014 review/merge policy lives solely in the `pr-reviewer` agent.",
-        "",
-        "### PR Body Template",
-        "",
-        "```markdown",
-        "## Summary",
-        "",
-        "<1-3 bullet points describing what changed and why>",
-        "",
-        "Closes #<issue-number>",
-        "",
-        "## Test Plan",
-        "",
-        "- [ ] Tests pass locally",
-        "- [ ] Relevant changes have been reviewed",
-        "```",
-        "",
-        "### Important",
-        "",
-        "- Always derive the issue number from the branch name (e.g., `feat/42-add-login` \u2192 `#42`)",
-        "- Use conventional commit format for the PR title",
-        "- Delegate merge to the `pr-reviewer` sub-agent \u2014 do not merge manually and do not enable auto-merge directly"
-      ].join("\n"),
-      tags: ["workflow"]
-    },
-    {
-      name: "branch-cleanup",
-      description: "Local-branch hygiene helpers shipped with the github-workflow bundle, including the /clean-merged-branches skill for safely force-deleting branches whose content has already merged into the base (handles squash merges).",
-      scope: AGENT_RULE_SCOPE.ALWAYS,
-      content: [
-        "# Branch Cleanup",
-        "",
-        "Local branches accumulate after every merged PR. In squash-merge",
-        "repositories `git branch -d` refuses to delete them because the",
-        "commit hash on the base differs, even when the branch content is",
-        "fully merged. The `github-workflow` bundle ships two affordances",
-        "that use content-equality (not commit-graph reachability) to",
-        "identify branches safe to force-delete:",
-        "",
-        "- `/clean-merged-branches` \u2014 interactive slash-command skill that",
-        "  classifies every local branch, prompts for confirmation, then",
-        "  runs `git branch -D` on the confirmed list. See",
-        "  `.claude/skills/clean-merged-branches/SKILL.md` for usage,",
-        "  output format, and the squash-merge verification algorithm.",
-        "- `.claude/procedures/clean-merged-branches.sh` \u2014 analysis-only",
-        "  procedure for non-interactive agent use (orchestrator,",
-        "  maintenance-audit). NEVER deletes \u2014 only reports `MERGED` /",
-        "  `UNMERGED` / `EMPTY` / `SKIP_WORKTREE` lines."
-      ].join("\n"),
-      tags: ["workflow"]
-    }
-  ],
-  skills: [cleanMergedBranchesSkill],
-  procedures: [setIssueTypeProcedure, cleanMergedBranchesProcedure]
-};
+function renderPrWorkflowBuildStep(policy) {
+  const lines = [
+    "2. **Run the build \u2014 scoped to what changed.**",
+    "",
+    "   - **Documentation-only changes** \u2014 a diff confined to documentation content (markdown pages, no source, config, or projen inputs) does **not** require `pnpm build:all`. There is nothing to compile, and CI is the authoritative content gate. Commit the content and proceed to the next step.",
+    "   - **Everything else** \u2014 when the change touches build inputs (source code, `.projenrc.ts`, `projenrc/**`, or any other projen-generated config), run `pnpm build:all` to compile, lint, and test all packages (mirrors the CI pipeline). If the build produces changes to turbo inputs (typically snapshot files or ESLint auto-fixes), commit those changes and run `pnpm build:all` again \u2014 the build must complete cleanly with no uncommitted changes."
+  ];
+  if (policy.remoteCacheEnabled && policy.awsProfileName) {
+    lines.push(
+      "",
+      `   \`pnpm build:all\` uses the Turborepo **remote cache**, which requires the user to be authenticated to AWS on the \`${policy.awsProfileName}\` profile. If the command fails due to AWS credentials, ask the user to authenticate first.`
+    );
+  }
+  lines.push(
+    "",
+    "   **Never background a long build and end the turn.** If you run a build, run it in the **foreground** to completion before committing, pushing, or opening the PR. Launching `pnpm build:all` as a background process and ending your turn while it is still running strands the deliverable uncommitted \u2014 that work is lost. This is the documented root cause of autonomous worker-stall incidents."
+  );
+  return lines;
+}
+function buildGithubWorkflowBundle(buildPolicy = DEFAULT_BUILD_POLICY) {
+  return {
+    name: "github-workflow",
+    description: "GitHub issue and PR workflow automation patterns",
+    appliesWhen: (project) => hasComponent(project, GitHub),
+    rules: [
+      {
+        name: "issue-workflow",
+        description: "Automated workflow for starting work on a GitHub issue",
+        scope: AGENT_RULE_SCOPE.ALWAYS,
+        content: [
+          "# Issue Workflow",
+          "",
+          '## "Work on issue X" Automation',
+          "",
+          "When the user says **work on issue X** (or similar), invoke the `issue-worker` agent in interactive mode, passing the issue number in the prompt. Do not perform the branch creation, issue fetching, or planning steps yourself \u2014 the agent handles the full workflow (claim, branch, plan, implement, PR) and will pause for your approval at the appropriate checkpoints."
+        ].join("\n"),
+        tags: ["workflow"]
+      },
+      {
+        name: "create-issue-workflow",
+        description: "Automated workflow for creating a new GitHub issue",
+        // ALWAYS scope: users invoke "create an issue" from any
+        // context, not only when editing agent / skill / bundle source.
+        // Consumers that want to narrow the load can override via
+        // `agentConfig.additionalRulePaths` or `excludeRules`.
+        scope: AGENT_RULE_SCOPE.ALWAYS,
+        content: [
+          "# Create Issue Workflow",
+          "",
+          '## "Create an issue" Automation',
+          "",
+          "When the user says **create an issue** (or similar), follow these steps exactly:",
+          "",
+          "1. **Determine the issue type prefix** from the user's description:",
+          "   - `epic:` \u2014 Large initiatives spanning multiple child issues",
+          "   - `feat:` \u2014 New features or functionality",
+          "   - `fix:` \u2014 Bug fixes",
+          "   - `chore:` \u2014 Maintenance: deps, tooling, config",
+          "   - `docs:` \u2014 Documentation-only work",
+          "   - `refactor:` \u2014 Code restructure, no behavior change",
+          "   - `release:` \u2014 Release preparation, version bumps",
+          "   - `hotfix:` \u2014 Urgent production fixes",
+          "   - If unclear, ask the user which type applies",
+          "2. **Compose the issue title** in the format: `<type>: <short description>`",
+          "3. **Determine the GitHub issue type** based on the prefix:",
+          "   - `epic:` \u2192 Epic",
+          "   - `feat:` \u2192 Feature",
+          "   - `fix:` \u2192 Bug",
+          "   - `chore:`, `docs:`, `refactor:`, `release:`, `hotfix:` \u2192 Task",
+          "4. **Identify prerequisite issues** \u2014 if the user mentions dependencies or blockers, include a **Dependencies** section in the body with `Depends on: #<issue-number>`",
+          "5. **Determine labels** \u2014 every issue must be created with the following labels:",
+          "   - **`type:*`** \u2014 derived from the issue title prefix:",
+          "     - `epic:` \u2192 `type:feat`",
+          "     - `feat:` \u2192 `type:feat`",
+          "     - `fix:` \u2192 `type:fix`",
+          "     - `chore:` \u2192 `type:chore`",
+          "     - `docs:` \u2192 `type:docs`",
+          "     - `refactor:` \u2192 `type:refactor`",
+          "     - `release:` \u2192 `type:release`",
+          "     - `hotfix:` \u2192 `type:hotfix`",
+          '   - **`priority:*`** \u2014 infer from the user\'s description when possible (e.g., "urgent"/"critical" \u2192 `priority:critical`, "important" \u2192 `priority:high`, "minor"/"low priority" \u2192 `priority:low`). If the priority is unclear, ask the user before creating the issue. Valid values: `priority:critical`, `priority:high`, `priority:medium`, `priority:low`, `priority:trivial`',
+          "   - **`status:ready`** \u2014 always add unless the issue has dependencies or blockers, in which case use `status:blocked`",
+          "6. **Create the issue** using `gh issue create`:",
+          "   - `--title '<type>: <description>'`",
+          "   - `--body '<issue body>'`",
+          "   - `--label '<type-label>' --label '<priority-label>' --label '<status-label>'`",
+          "7. **Set the GitHub issue type** by invoking the `set-issue-type.sh` helper (shipped with this bundle):",
+          "",
+          "   ```sh",
+          "   .claude/procedures/set-issue-type.sh <issue-number> <Feature|Task|Epic|Bug>",
+          "   ```",
+          "",
+          "   The helper resolves owner/repo, looks up the issue type node ID, looks up the issue node ID, and applies the `updateIssueIssueType` mutation in one step. It exits non-zero with a clear diagnostic on any error and lists available types if the type name is not recognised.",
+          "",
+          "   **Under the hood** (documented fallback if the helper is unavailable): the helper performs a two-step GraphQL flow \u2014 first a `repository(...).issueTypes` query to map the human-readable type name to a node ID, then the `updateIssueIssueType` mutation. The canonical queries are:",
+          "",
+          "   ```sh",
+          "   gh api graphql -f query='query($owner:String!,$repo:String!){repository(owner:$owner,name:$repo){issueTypes(first:50){nodes{id name}}}}' -f owner=<owner> -f repo=<repo>",
+          "   gh api graphql -f query='mutation($issueId:ID!,$typeId:ID!){updateIssueIssueType(input:{issueId:$issueId,issueTypeId:$typeId}){issue{number issueType{name}}}}' -f issueId=<issue-node-id> -f typeId=<issue-type-node-id>",
+          "   ```",
+          "",
+          "### Issue Body Template",
+          "",
+          "```markdown",
+          "## Summary",
+          "",
+          "<1-3 sentences describing the issue>",
+          "",
+          "## Details",
+          "",
+          "<Detailed description, acceptance criteria, or reproduction steps as appropriate>",
+          "",
+          "## Dependencies",
+          "",
+          "Depends on: #<issue-number> (if any, otherwise omit this section)",
+          "```",
+          "",
+          "### Important",
+          "",
+          "- Always use the conventional prefix in the issue title",
+          "- Always assign the correct GitHub issue type via the `set-issue-type.sh` helper (step 7) \u2014 never via `gh issue create --type`",
+          "- Always include `type:*`, `priority:*`, and `status:*` labels",
+          "- If the user does not specify a type, ask before creating the issue",
+          "- If the priority cannot be inferred from the description, ask the user before creating the issue",
+          "- Keep titles concise and descriptive"
+        ].join("\n"),
+        tags: ["workflow"]
+      },
+      {
+        name: "pr-workflow",
+        description: "Automated workflow for opening a pull request",
+        scope: AGENT_RULE_SCOPE.ALWAYS,
+        content: [
+          "# PR Workflow",
+          "",
+          '## "Open a PR" Automation',
+          "",
+          "When the user says **open a PR** (or similar), follow these steps exactly:",
+          "",
+          "1. **Regenerate project files** \u2014 run the three-step regen sequence (`pnpm i`, then `pnpm exec projen`, then `pnpm i` again) to ensure all generated files are up to date. The leading `pnpm i` is required because `pnpm exec projen` synthesises against whatever version of configulator (and projen, and any projen plugins) is currently resolved in `node_modules`; if the lockfile has moved past `node_modules` (typically right after `git pull` lands a dependency upgrade, or on a fresh checkout), synth runs against stale templates and produces phantom drift in `.claude/`, `.github/labels.yml`, `CLAUDE.md`, and other generated files. The trailing `pnpm i` picks up any dependency changes projen wrote into `package.json` during synth. Check `git diff` after the third step \u2014 if there are changes, commit them before proceeding.",
+          ...renderPrWorkflowBuildStep(buildPolicy),
+          "3. **Check for uncommitted changes** \u2014 if any exist, commit them with a conventional commit message",
+          "4. **Pull and rebase from the default branch** \u2014 run `git pull origin {{repository.defaultBranch}} --rebase` to incorporate the latest changes and resolve any conflicts before pushing",
+          "5. **Push the branch** to origin: `git push -u origin <branch>`",
+          "6. **Create the PR** using `gh pr create`:",
+          "   - **Title**: use a conventional commit style title (e.g., `feat(scope): short description`)",
+          "   - **Body**: include `Closes #<issue-number>` (derived from the branch name) and a brief summary of changes",
+          "7. **Delegate review and merge to the `pr-reviewer` sub-agent.** After the PR is created, invoke the `/review-pr <pr-number>` skill (or otherwise hand the new PR number to the `pr-reviewer` sub-agent). The reviewer verifies the diff against the linked issue's acceptance criteria and enables squash auto-merge when all checks pass. Do **not** run `gh pr merge --auto` yourself \u2014 review/merge policy lives solely in the `pr-reviewer` agent.",
+          "",
+          "### PR Body Template",
+          "",
+          "```markdown",
+          "## Summary",
+          "",
+          "<1-3 bullet points describing what changed and why>",
+          "",
+          "Closes #<issue-number>",
+          "",
+          "## Test Plan",
+          "",
+          "- [ ] Tests pass locally",
+          "- [ ] Relevant changes have been reviewed",
+          "```",
+          "",
+          "### Important",
+          "",
+          "- Always derive the issue number from the branch name (e.g., `feat/42-add-login` \u2192 `#42`)",
+          "- Use conventional commit format for the PR title",
+          "- Delegate merge to the `pr-reviewer` sub-agent \u2014 do not merge manually and do not enable auto-merge directly"
+        ].join("\n"),
+        tags: ["workflow"]
+      },
+      {
+        name: "branch-cleanup",
+        description: "Local-branch hygiene helpers shipped with the github-workflow bundle, including the /clean-merged-branches skill for safely force-deleting branches whose content has already merged into the base (handles squash merges).",
+        scope: AGENT_RULE_SCOPE.ALWAYS,
+        content: [
+          "# Branch Cleanup",
+          "",
+          "Local branches accumulate after every merged PR. In squash-merge",
+          "repositories `git branch -d` refuses to delete them because the",
+          "commit hash on the base differs, even when the branch content is",
+          "fully merged. The `github-workflow` bundle ships two affordances",
+          "that use content-equality (not commit-graph reachability) to",
+          "identify branches safe to force-delete:",
+          "",
+          "- `/clean-merged-branches` \u2014 interactive slash-command skill that",
+          "  classifies every local branch, prompts for confirmation, then",
+          "  runs `git branch -D` on the confirmed list. See",
+          "  `.claude/skills/clean-merged-branches/SKILL.md` for usage,",
+          "  output format, and the squash-merge verification algorithm.",
+          "- `.claude/procedures/clean-merged-branches.sh` \u2014 analysis-only",
+          "  procedure for non-interactive agent use (orchestrator,",
+          "  maintenance-audit). NEVER deletes \u2014 only reports `MERGED` /",
+          "  `UNMERGED` / `EMPTY` / `SKIP_WORKTREE` lines."
+        ].join("\n"),
+        tags: ["workflow"]
+      }
+    ],
+    skills: [cleanMergedBranchesSkill],
+    procedures: [setIssueTypeProcedure, cleanMergedBranchesProcedure]
+  };
+}
+var githubWorkflowBundle = buildGithubWorkflowBundle();
 
 // src/agent/bundles/industry-discovery.ts
 function buildIndustryDiscoveryAnalystSubAgent(paths, issueDefaults) {
@@ -12875,188 +13300,6 @@ function buildMeetingAnalysisBundle(tier = AGENT_MODEL.BALANCED) {
 }
 var meetingAnalysisBundle = buildMeetingAnalysisBundle();
 
-// src/agent/bundles/run-ratio.ts
-var DEFAULT_DISPATCH_TO_HOUSEKEEPING_RATIO = 4;
-var DEFAULT_STATE_FILE_PATH = ".state/orchestrator-runs.json";
-var DEFAULT_DISPATCH_MODEL = "opus";
-var DEFAULT_HOUSEKEEPING_MODEL = "sonnet";
-function resolveRunRatio(config) {
-  const ratio = config?.ratio ?? DEFAULT_DISPATCH_TO_HOUSEKEEPING_RATIO;
-  assertValidRatio(ratio);
-  const stateFilePath = config?.stateFilePath ?? DEFAULT_STATE_FILE_PATH;
-  assertValidStateFilePath(stateFilePath);
-  return {
-    enabled: config?.enabled ?? true,
-    ratio,
-    stateFilePath,
-    dispatchModel: config?.dispatchModel ?? DEFAULT_DISPATCH_MODEL,
-    housekeepingModel: config?.housekeepingModel ?? DEFAULT_HOUSEKEEPING_MODEL
-  };
-}
-function validateRunRatioConfig(config) {
-  return resolveRunRatio(config);
-}
-function classifyRun(runCounter, ratio) {
-  if (!ratio.enabled) {
-    return "dispatch";
-  }
-  const cycle = ratio.ratio + 1;
-  return runCounter > 0 && runCounter % cycle === 0 ? "housekeeping" : "dispatch";
-}
-function renderRunRatioSection(ratio) {
-  const lines = [
-    "## Run ratio (dispatch vs housekeeping)",
-    "",
-    "The orchestrator keeps a **persistent run counter** and interleaves",
-    "dispatch runs (pick the next ready issue, recommend a worker) with",
-    "**housekeeping runs** (batch PR review + maintenance scan) on a",
-    "configurable ratio. This mirrors openhi's `DISPATCHER.md` contract:",
-    "multiple dispatch runs feed the worker queue, then one batched",
-    "housekeeping run flushes review backlog and runs maintenance",
-    "triage so the pipeline never drifts.",
-    ""
-  ];
-  if (!ratio.enabled) {
-    lines.push(
-      "**The run ratio is disabled for this project.** Every orchestrator",
-      "run executes the full dispatch pipeline; PR review and maintenance",
-      "remain manual invocations. Enable the ratio via",
-      "`AgentConfigOptions.runRatio.enabled = true` once the operator is",
-      "comfortable with the counter-backed cadence.",
-      ""
-    );
-    return lines.join("\n");
-  }
-  const cycle = ratio.ratio + 1;
-  lines.push(
-    "### Cadence",
-    "",
-    `The cycle length is **${cycle}** runs:`,
-    "",
-    `- Runs 1 through ${ratio.ratio} execute the **dispatch** pipeline`,
-    `  (recommended model: \`${ratio.dispatchModel}\`).`,
-    `- Run ${cycle} executes the **housekeeping** pipeline`,
-    `  (recommended model: \`${ratio.housekeepingModel}\`).`,
-    `- The counter wraps \u2014 run ${cycle + 1} is a dispatch run again, run ${cycle * 2} is the next housekeeping run, and so on.`,
-    "",
-    "The orchestrator increments the counter **once per invocation** at",
-    "the top of the run, before any pipeline phase executes. The",
-    "pre-increment value is never observed \u2014 the tick always returns",
-    "the post-increment counter and the classified run type in a single",
-    "atomic update.",
-    "",
-    "### State file",
-    "",
-    `The run counter persists at \`${ratio.stateFilePath}\`. The file is`,
-    "plain JSON with a single `run_counter` integer field:",
-    "",
-    "```json",
-    '{ "run_counter": 42 }',
-    "```",
-    "",
-    "The state file is **gitignored** in consumer repos (it is local to",
-    "each operator's machine). On a first run, or if the file is missing",
-    "or corrupt, the orchestrator recreates it with `run_counter: 1`.",
-    "",
-    "### Dispatch-run pipeline",
-    "",
-    "1. Phase A \u2014 startup (fetch + checkout default branch).",
-    "2. Phase C \u2014 triage unblock (resolve `Depends on:` chains).",
-    "3. Phase E \u2014 queue scan (pick the top `PICK` line, run the scope",
-    "   gate, emit `NEXT_WORK_ITEM`).",
-    "4. Phase F \u2014 cleanup.",
-    "",
-    "### Housekeeping-run pipeline",
-    "",
-    "1. Phase A \u2014 startup.",
-    "2. Phase B \u2014 batch PR review across every eligible open PR.",
-    "3. Phase D \u2014 maintenance scan (stale detection, orphaned branches,",
-    "   needs-attention summary).",
-    "4. Phase F \u2014 cleanup.",
-    "",
-    "### Model recommendations",
-    "",
-    `Dispatch runs should use \`${ratio.dispatchModel}\` \u2014 the routing`,
-    "logic, scope gate, and funnel-tier sort benefit from the stronger",
-    "reasoning model. Housekeeping runs are mechanical (read CI status,",
-    "toggle labels, post canned comments) and should use",
-    `\`${ratio.housekeepingModel}\` so the batched PR review and`,
-    "maintenance scan cost less per invocation.",
-    "",
-    "These strings are **informational** \u2014 they surface in the",
-    "orchestrator's rendered rule content so operators know which model",
-    "to run each session against. Configulator does not inject them as",
-    "`model:` frontmatter on the sub-agent definition; the operator (or",
-    "a scheduled task) picks the model at invocation time."
-  );
-  return lines.join("\n");
-}
-function renderRunRatioShellHelpers(ratio) {
-  const cycle = ratio.ratio + 1;
-  return [
-    "# Increment the orchestrator run counter and classify the run.",
-    "# Reads the state file (creating it on first run or corruption),",
-    "# increments the counter, writes back atomically, and echoes",
-    "# `run=<n> type=<dispatch|housekeeping>` on stdout.",
-    "#",
-    "# Uses the cycle length (ratio + 1) hard-coded from the resolved",
-    "# RunRatioConfig so the shell helper matches the rendered rule",
-    "# content byte-for-byte.",
-    "run_counter_tick() {",
-    '  local state_file="$ORCHESTRATOR_STATE_FILE"',
-    "  local state_dir",
-    '  state_dir=$(dirname "$state_file")',
-    '  mkdir -p "$state_dir" 2>/dev/null || true',
-    "",
-    "  local current=0",
-    '  if [ -f "$state_file" ]; then',
-    "    # jq returns empty string on parse failure; guard against it.",
-    `    current=$(jq -r '.run_counter // 0' "$state_file" 2>/dev/null || echo 0)`,
-    '    case "$current" in',
-    "      ''|*[!0-9]*) current=0 ;;",
-    "    esac",
-    "  fi",
-    "",
-    "  local next=$((current + 1))",
-    "",
-    '  local tmp_file="${state_file}.tmp.$$"',
-    `  printf '{ "run_counter": %d }\\n' "$next" > "$tmp_file"`,
-    '  mv "$tmp_file" "$state_file"',
-    "",
-    "  local run_type=dispatch",
-    `  if [ $((next % ${cycle})) -eq 0 ]; then`,
-    "    run_type=housekeeping",
-    "  fi",
-    `  printf 'run=%d type=%s\\n' "$next" "$run_type"`,
-    "}"
-  ].join("\n");
-}
-function assertValidRatio(ratio) {
-  if (!Number.isInteger(ratio)) {
-    throw new Error(
-      `RunRatioConfig.ratio must be a positive integer; got ${ratio}`
-    );
-  }
-  if (ratio < 1) {
-    throw new Error(
-      `RunRatioConfig.ratio must be a positive integer; got ${ratio}`
-    );
-  }
-}
-function assertValidStateFilePath(stateFilePath) {
-  const trimmed = stateFilePath.trim();
-  if (trimmed.length === 0) {
-    throw new Error(
-      "RunRatioConfig.stateFilePath must be a non-empty string relative to the repo root"
-    );
-  }
-  if (trimmed.startsWith("/")) {
-    throw new Error(
-      `RunRatioConfig.stateFilePath must be relative to the repo root (no leading '/'); got ${stateFilePath}`
-    );
-  }
-}
-
 // src/agent/bundles/bundle-ownership.ts
 var BUNDLE_OWNERSHIP = {
   agenda: {
@@ -13200,6 +13443,255 @@ var BUNDLE_OWNERSHIP = {
     downstreamIssueKinds: true
   }
 };
+var CONVENTIONAL_COMMIT_TYPE_LABELS = [
+  "type:chore",
+  "type:docs",
+  "type:feat",
+  "type:fix",
+  "type:hotfix",
+  "type:refactor",
+  "type:release"
+];
+var PHASE_LABEL_TYPE_MAP = buildPhaseLabelTypeMap();
+function typeLabelForPhaseLabel(phaseLabel) {
+  const exact = PHASE_LABEL_TYPE_MAP[phaseLabel];
+  if (exact !== void 0 && !phaseLabel.endsWith(":")) {
+    return exact;
+  }
+  let bestMatcher;
+  for (const matcher of Object.keys(PHASE_LABEL_TYPE_MAP)) {
+    if (!matcher.endsWith(":")) {
+      continue;
+    }
+    if (!phaseLabel.startsWith(matcher)) {
+      continue;
+    }
+    if (bestMatcher === void 0 || matcher.length > bestMatcher.length) {
+      bestMatcher = matcher;
+    }
+  }
+  return bestMatcher === void 0 ? void 0 : PHASE_LABEL_TYPE_MAP[bestMatcher];
+}
+function resolveTypeLabelForLabels(labels) {
+  const phaseLabels = [];
+  const candidates = /* @__PURE__ */ new Set();
+  for (const label of labels) {
+    const typeLabel = typeLabelForPhaseLabel(label);
+    if (typeLabel === void 0) {
+      continue;
+    }
+    phaseLabels.push(label);
+    candidates.add(typeLabel);
+  }
+  const candidateTypeLabels = Array.from(candidates).sort();
+  if (candidateTypeLabels.length === 0) {
+    return { outcome: "none", candidateTypeLabels: [], phaseLabels: [] };
+  }
+  if (candidateTypeLabels.length === 1) {
+    return {
+      outcome: "match",
+      typeLabel: candidateTypeLabels[0],
+      candidateTypeLabels,
+      phaseLabels
+    };
+  }
+  return { outcome: "ambiguous", candidateTypeLabels, phaseLabels };
+}
+function renderPhaseTypeInvariantSection(excludeBundles = []) {
+  const rows = Object.keys(PHASE_LABEL_TYPE_MAP).filter(
+    (matcher) => !isPhaseLabelMatcherOwnedByExcluded(matcher, excludeBundles)
+  ).sort().map((matcher) => {
+    const display = matcher.endsWith(":") ? `${matcher}*` : matcher;
+    const kind = matcher.endsWith(":") ? "prefix" : "exact";
+    return `| \`${display}\` | ${kind} | \`${PHASE_LABEL_TYPE_MAP[matcher]}\` |`;
+  });
+  return [
+    "## Phase-label \u2192 `type:<bundle>` invariant",
+    "",
+    "Every phased-pipeline bundle pairs its `<bundle>:<phase>` labels",
+    "with exactly one `type:<bundle>` label. That type label is the",
+    "**dedup + dispatch signal**: agents de-duplicate downstream work",
+    'with `gh issue list --label "type:<bundle>"`, and Phase E derives',
+    "its funnel-tier sort key from the issue's `type:*` label. An issue",
+    "that carries the phase label but a conventional-commit `type:*`",
+    "(`type:feat`, `type:docs`, \u2026, stamped from its title prefix by the",
+    "generic create-issue workflow) is invisible to that dedup query and",
+    "mis-tiers in dispatch.",
+    "",
+    "The pairing below is derived from the canonical bundle-ownership",
+    "map \u2014 the same source of truth that generates the label registry.",
+    "Matchers ending in `*` match by prefix; the rest match exactly, and",
+    "an exact match always beats a prefix match.",
+    "",
+    "| Phase label | Match | Required type label |",
+    "|-------------|-------|---------------------|",
+    ...rows,
+    "",
+    "### Enforcement",
+    "",
+    "The Phase D maintenance sweep runs the invariant in auto-correct",
+    "mode and emits one summary line:",
+    "",
+    "```",
+    "LABEL_INVARIANT_DONE mode=fix checked=<N> ok=<O> violations=<V> corrected=<C> flagged=<F>",
+    "```",
+    "",
+    "A **report-only** audit is available for repos that prefer",
+    "report-then-fix over auto-correct \u2014 same sweep, no mutations:",
+    "",
+    "```bash",
+    ".claude/procedures/check-blocked.sh label-invariant        # report only",
+    ".claude/procedures/check-blocked.sh label-invariant --fix  # apply",
+    "```",
+    "",
+    "### Correction policy",
+    "",
+    "An issue must carry **exactly one** `type:*` label. Merely *adding*",
+    "the required type label to an issue that already carries a",
+    "conventional-commit one would leave two, making the funnel-tier sort",
+    "key (which reads the **first** `type:*` label) non-deterministic and",
+    "violating the label conventions. The correction therefore",
+    "**replaces**, in a single atomic `gh issue edit`, so the issue is",
+    "never observable carrying two `type:*` labels:",
+    "",
+    "| Issue state | Action |",
+    "|-------------|--------|",
+    "| Required type label present, nothing else | none \u2014 compliant, left untouched |",
+    "| No `type:*` label at all | **add** the required label |",
+    "| Only conventional-commit `type:*` label(s) | **replace** \u2014 remove them, add the required label |",
+    "| Required label present **plus** a stray conventional-commit one | **remove** the stray, leaving exactly one |",
+    "| A `type:*` label owned by a **different** bundle | **flag** `status:needs-attention` \u2014 never guessed at |",
+    "| Phase labels imply **two or more** type labels | **flag** `status:needs-attention` \u2014 never auto-corrected |",
+    "",
+    "Only a conventional-commit `type:*` label is ever removed. A",
+    "`type:*` label owned by another bundle carries real routing",
+    "information, so the sweep refuses to guess and hands the issue to a",
+    "human instead. Ambiguity is narrower than it looks: all three",
+    "requirements bundles declare `type:requirement`, so every `req:*`",
+    "phase label resolves to the same type label \u2014 genuine ambiguity",
+    "needs phase labels from two bundles with *different* type labels.",
+    "",
+    "`status:needs-attention` is applied **additively** \u2014 the base",
+    "`status:*` label always stays, per the additive-flag rule. Flagging",
+    "is idempotent: an issue already carrying the flag is reported but",
+    "not re-flagged."
+  ].join("\n");
+}
+function isPhaseLabelMatcherOwnedByExcluded(matcher, excludeBundles) {
+  if (excludeBundles.length === 0) {
+    return false;
+  }
+  let owned = false;
+  for (const [bundleName, ownership] of Object.entries(BUNDLE_OWNERSHIP)) {
+    if (!ownership.phaseLabelPrefixes.includes(matcher)) {
+      continue;
+    }
+    owned = true;
+    if (!excludeBundles.includes(bundleName)) {
+      return false;
+    }
+  }
+  return owned;
+}
+function renderPhaseTypeInvariantShellHelpers() {
+  const matchers = Object.keys(PHASE_LABEL_TYPE_MAP);
+  const exactMatchers = matchers.filter((m) => !m.endsWith(":")).sort();
+  const prefixMatchers = matchers.filter((m) => m.endsWith(":")).sort((a, b) => b.length - a.length || a.localeCompare(b));
+  const lines = [
+    "# Resolve ONE phase label to the `type:<bundle>` label its owning",
+    "# bundle declares. Echoes the label (with the `type:` prefix) or",
+    "# nothing when no bundle owns it. Exact-match branches come first,",
+    "# so `req:write` (requirements-writer) beats the `req:` prefix",
+    "# (requirements-analyst). Generated from BUNDLE_OWNERSHIP \u2014 do not",
+    "# hand-edit.",
+    "phase_label_type_of() {",
+    '  case "${1:-}" in'
+  ];
+  for (const matcher of exactMatchers) {
+    lines.push(`    ${matcher}) echo "${PHASE_LABEL_TYPE_MAP[matcher]}" ;;`);
+  }
+  for (const matcher of prefixMatchers) {
+    lines.push(`    ${matcher}*) echo "${PHASE_LABEL_TYPE_MAP[matcher]}" ;;`);
+  }
+  lines.push(
+    "    *) : ;;",
+    "  esac",
+    "}",
+    "",
+    "# Return 0 when the argument is a conventional-commit `type:*`",
+    "# label \u2014 the ONLY type labels the invariant correction may remove.",
+    "# A `type:*` label owned by another bundle is never removed; the",
+    "# issue is flagged for human triage instead.",
+    "is_conventional_type_label() {",
+    `  case "\${1:-}" in`,
+    `    ${CONVENTIONAL_COMMIT_TYPE_LABELS.join("|")}) return 0 ;;`,
+    "    *) return 1 ;;",
+    "  esac",
+    "}",
+    "",
+    "# Resolve an issue's FULL label list (one label per line on stdin)",
+    "# to the type label the phase-label invariant requires. Emits",
+    "# KEY=VALUE assignments the caller parses:",
+    "#   OUTCOME=none      \u2014 no recognised phase label; invariant N/A",
+    "#   OUTCOME=match     \u2014 plus TYPE_LABEL=<type:bundle>",
+    "#   OUTCOME=ambiguous \u2014 plus CANDIDATE_TYPE_LABELS=<space-separated>",
+    "#   PHASE_LABELS=<space-separated recognised phase labels>",
+    "phase_type_of() {",
+    "  local label resolved",
+    '  local matched_types=""',
+    '  local matched_phase=""',
+    "  while IFS= read -r label; do",
+    '    [ -z "$label" ] && continue',
+    '    resolved=$(phase_label_type_of "$label")',
+    '    [ -z "$resolved" ] && continue',
+    '    matched_phase="${matched_phase}${label} "',
+    '    case " ${matched_types} " in',
+    '      *" ${resolved} "*) ;;',
+    '      *) matched_types="${matched_types}${resolved} " ;;',
+    "    esac",
+    "  done",
+    "  local count=0",
+    "  for resolved in $matched_types; do",
+    "    count=$((count + 1))",
+    "  done",
+    '  if [ "$count" -eq 0 ]; then',
+    '    echo "OUTCOME=none"',
+    '  elif [ "$count" -eq 1 ]; then',
+    '    echo "OUTCOME=match"',
+    '    echo "TYPE_LABEL=${matched_types% }"',
+    "  else",
+    '    echo "OUTCOME=ambiguous"',
+    '    echo "CANDIDATE_TYPE_LABELS=${matched_types% }"',
+    "  fi",
+    '  echo "PHASE_LABELS=${matched_phase% }"',
+    "}"
+  );
+  return lines.join("\n");
+}
+function buildPhaseLabelTypeMap() {
+  const map = {};
+  for (const [bundleName, ownership] of Object.entries(BUNDLE_OWNERSHIP)) {
+    if (ownership.phaseLabelPrefixes.length === 0) {
+      continue;
+    }
+    if (ownership.typeLabels.length !== 1) {
+      throw new Error(
+        `BUNDLE_OWNERSHIP["${bundleName}"] declares ${ownership.phaseLabelPrefixes.length} phase-label matcher(s) but ${ownership.typeLabels.length} type label(s); a phase label must pair with exactly one type label`
+      );
+    }
+    const typeLabel = `type:${ownership.typeLabels[0]}`;
+    for (const matcher of ownership.phaseLabelPrefixes) {
+      const existing = map[matcher];
+      if (existing !== void 0 && existing !== typeLabel) {
+        throw new Error(
+          `Phase-label matcher "${matcher}" resolves to both "${existing}" and "${typeLabel}"; a matcher must imply exactly one type label`
+        );
+      }
+      map[matcher] = typeLabel;
+    }
+  }
+  return map;
+}
 function isTypeLabelOwnedByExcluded(typeLabel, excludedBundles) {
   if (excludedBundles.length === 0) {
     return false;
@@ -13289,6 +13781,188 @@ function findOwnersOfTypeLabel(typeLabel) {
   return owners;
 }
 
+// src/agent/bundles/run-ratio.ts
+var DEFAULT_DISPATCH_TO_HOUSEKEEPING_RATIO = 4;
+var DEFAULT_STATE_FILE_PATH = ".state/orchestrator-runs.json";
+var DEFAULT_DISPATCH_MODEL = "opus";
+var DEFAULT_HOUSEKEEPING_MODEL = "sonnet";
+function resolveRunRatio(config) {
+  const ratio = config?.ratio ?? DEFAULT_DISPATCH_TO_HOUSEKEEPING_RATIO;
+  assertValidRatio(ratio);
+  const stateFilePath = config?.stateFilePath ?? DEFAULT_STATE_FILE_PATH;
+  assertValidStateFilePath(stateFilePath);
+  return {
+    enabled: config?.enabled ?? true,
+    ratio,
+    stateFilePath,
+    dispatchModel: config?.dispatchModel ?? DEFAULT_DISPATCH_MODEL,
+    housekeepingModel: config?.housekeepingModel ?? DEFAULT_HOUSEKEEPING_MODEL
+  };
+}
+function validateRunRatioConfig(config) {
+  return resolveRunRatio(config);
+}
+function classifyRun(runCounter, ratio) {
+  if (!ratio.enabled) {
+    return "dispatch";
+  }
+  const cycle = ratio.ratio + 1;
+  return runCounter > 0 && runCounter % cycle === 0 ? "housekeeping" : "dispatch";
+}
+function renderRunRatioSection(ratio) {
+  const lines = [
+    "## Run ratio (dispatch vs housekeeping)",
+    "",
+    "The orchestrator keeps a **persistent run counter** and interleaves",
+    "dispatch runs (pick the next ready issue, recommend a worker) with",
+    "**housekeeping runs** (batch PR review + maintenance scan) on a",
+    "configurable ratio. This mirrors openhi's `DISPATCHER.md` contract:",
+    "multiple dispatch runs feed the worker queue, then one batched",
+    "housekeeping run flushes review backlog and runs maintenance",
+    "triage so the pipeline never drifts.",
+    ""
+  ];
+  if (!ratio.enabled) {
+    lines.push(
+      "**The run ratio is disabled for this project.** Every orchestrator",
+      "run executes the full dispatch pipeline; PR review and maintenance",
+      "remain manual invocations. Enable the ratio via",
+      "`AgentConfigOptions.runRatio.enabled = true` once the operator is",
+      "comfortable with the counter-backed cadence.",
+      ""
+    );
+    return lines.join("\n");
+  }
+  const cycle = ratio.ratio + 1;
+  lines.push(
+    "### Cadence",
+    "",
+    `The cycle length is **${cycle}** runs:`,
+    "",
+    `- Runs 1 through ${ratio.ratio} execute the **dispatch** pipeline`,
+    `  (recommended model: \`${ratio.dispatchModel}\`).`,
+    `- Run ${cycle} executes the **housekeeping** pipeline`,
+    `  (recommended model: \`${ratio.housekeepingModel}\`).`,
+    `- The counter wraps \u2014 run ${cycle + 1} is a dispatch run again, run ${cycle * 2} is the next housekeeping run, and so on.`,
+    "",
+    "The orchestrator increments the counter **once per invocation** at",
+    "the top of the run, before any pipeline phase executes. The",
+    "pre-increment value is never observed \u2014 the tick always returns",
+    "the post-increment counter and the classified run type in a single",
+    "atomic update.",
+    "",
+    "### State file",
+    "",
+    `The run counter persists at \`${ratio.stateFilePath}\`. The file is`,
+    "plain JSON with a single `run_counter` integer field:",
+    "",
+    "```json",
+    '{ "run_counter": 42 }',
+    "```",
+    "",
+    "The state file is **gitignored** in consumer repos (it is local to",
+    "each operator's machine). On a first run, or if the file is missing",
+    "or corrupt, the orchestrator recreates it with `run_counter: 1`.",
+    "",
+    "### Dispatch-run pipeline",
+    "",
+    "1. Phase A \u2014 startup (fetch + checkout default branch).",
+    "2. Phase C \u2014 triage unblock (resolve `Depends on:` chains).",
+    "3. Phase E \u2014 queue scan (pick the top `PICK` line, run the scope",
+    "   gate, emit `NEXT_WORK_ITEM`).",
+    "4. Phase F \u2014 cleanup.",
+    "",
+    "### Housekeeping-run pipeline",
+    "",
+    "1. Phase A \u2014 startup.",
+    "2. Phase B \u2014 batch PR review across every eligible open PR.",
+    "3. Phase D \u2014 maintenance scan (stale detection, orphaned branches,",
+    "   needs-attention summary).",
+    "4. Phase F \u2014 cleanup.",
+    "",
+    "### Model recommendations",
+    "",
+    `Dispatch runs should use \`${ratio.dispatchModel}\` \u2014 the routing`,
+    "logic, scope gate, and funnel-tier sort benefit from the stronger",
+    "reasoning model. Housekeeping runs are mechanical (read CI status,",
+    "toggle labels, post canned comments) and should use",
+    `\`${ratio.housekeepingModel}\` so the batched PR review and`,
+    "maintenance scan cost less per invocation.",
+    "",
+    "These strings are **informational** \u2014 they surface in the",
+    "orchestrator's rendered rule content so operators know which model",
+    "to run each session against. Configulator does not inject them as",
+    "`model:` frontmatter on the sub-agent definition; the operator (or",
+    "a scheduled task) picks the model at invocation time."
+  );
+  return lines.join("\n");
+}
+function renderRunRatioShellHelpers(ratio) {
+  const cycle = ratio.ratio + 1;
+  return [
+    "# Increment the orchestrator run counter and classify the run.",
+    "# Reads the state file (creating it on first run or corruption),",
+    "# increments the counter, writes back atomically, and echoes",
+    "# `run=<n> type=<dispatch|housekeeping>` on stdout.",
+    "#",
+    "# Uses the cycle length (ratio + 1) hard-coded from the resolved",
+    "# RunRatioConfig so the shell helper matches the rendered rule",
+    "# content byte-for-byte.",
+    "run_counter_tick() {",
+    '  local state_file="$ORCHESTRATOR_STATE_FILE"',
+    "  local state_dir",
+    '  state_dir=$(dirname "$state_file")',
+    '  mkdir -p "$state_dir" 2>/dev/null || true',
+    "",
+    "  local current=0",
+    '  if [ -f "$state_file" ]; then',
+    "    # jq returns empty string on parse failure; guard against it.",
+    `    current=$(jq -r '.run_counter // 0' "$state_file" 2>/dev/null || echo 0)`,
+    '    case "$current" in',
+    "      ''|*[!0-9]*) current=0 ;;",
+    "    esac",
+    "  fi",
+    "",
+    "  local next=$((current + 1))",
+    "",
+    '  local tmp_file="${state_file}.tmp.$$"',
+    `  printf '{ "run_counter": %d }\\n' "$next" > "$tmp_file"`,
+    '  mv "$tmp_file" "$state_file"',
+    "",
+    "  local run_type=dispatch",
+    `  if [ $((next % ${cycle})) -eq 0 ]; then`,
+    "    run_type=housekeeping",
+    "  fi",
+    `  printf 'run=%d type=%s\\n' "$next" "$run_type"`,
+    "}"
+  ].join("\n");
+}
+function assertValidRatio(ratio) {
+  if (!Number.isInteger(ratio)) {
+    throw new Error(
+      `RunRatioConfig.ratio must be a positive integer; got ${ratio}`
+    );
+  }
+  if (ratio < 1) {
+    throw new Error(
+      `RunRatioConfig.ratio must be a positive integer; got ${ratio}`
+    );
+  }
+}
+function assertValidStateFilePath(stateFilePath) {
+  const trimmed = stateFilePath.trim();
+  if (trimmed.length === 0) {
+    throw new Error(
+      "RunRatioConfig.stateFilePath must be a non-empty string relative to the repo root"
+    );
+  }
+  if (trimmed.startsWith("/")) {
+    throw new Error(
+      `RunRatioConfig.stateFilePath must be relative to the repo root (no leading '/'); got ${stateFilePath}`
+    );
+  }
+}
+
 // src/agent/bundles/scheduled-tasks.ts
 var SCHEDULED_TASK_MODEL_VALUES = ["opus", "sonnet", "haiku"];
 var SCHEDULED_TASK_KIND_VALUES = ["issue-worker", "pipeline"];
@@ -15244,6 +15918,7 @@ function buildCheckBlockedScript(tiers, scopeGate, _runRatio) {
     "#   .claude/procedures/check-blocked.sh maintenance",
     "#   .claude/procedures/check-blocked.sh prs",
     "#   .claude/procedures/check-blocked.sh scope <issue-number>",
+    "#   .claude/procedures/check-blocked.sh label-invariant [--fix]",
     "",
     "set -uo pipefail",
     "",
@@ -15293,6 +15968,8 @@ function buildCheckBlockedScript(tiers, scopeGate, _runRatio) {
     "",
     scopeHelperIndented,
     "",
+    renderPhaseTypeInvariantShellHelpers(),
+    "",
     ...renderDelegationActiveSignalsHelper(),
     "",
     "# \u2500\u2500 subcommands \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
@@ -15928,16 +16605,43 @@ function buildCheckBlockedScript(tiers, scopeGate, _runRatio) {
     "    esac",
     '  done <<< "$lease_output"',
     "",
+    "  # \u2500\u2500 phase-label \u2192 type:<bundle> invariant (MUTATING) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
+    "  # Run the label-invariant sweep in --fix mode and surface its",
+    "  # per-issue lines for log visibility. cmd_label_invariant applies",
+    "  # the label edits itself (a single atomic remove+add per issue, so",
+    "  # an issue is never observable carrying two type:* labels) and",
+    "  # flags the cases it must not guess at. Its terminal",
+    "  # LABEL_INVARIANT_DONE line is captured and re-emitted alongside",
+    "  # MAINTENANCE_DONE so the orchestrator reads every summary from",
+    "  # one maintenance invocation.",
+    "  local label_output",
+    "  label_output=$(cmd_label_invariant --fix)",
+    '  local label_summary="LABEL_INVARIANT_DONE mode=fix checked=0 ok=0 violations=0 corrected=0 flagged=0"',
+    "",
+    "  while IFS= read -r line; do",
+    '    [[ -z "$line" ]] && continue',
+    '    case "$line" in',
+    "      'LABEL_INVARIANT_DONE '*)",
+    '        label_summary="$line"',
+    "        ;;",
+    "      *)",
+    '        echo "$line"',
+    "        ;;",
+    "    esac",
+    '  done <<< "$label_output"',
+    "",
     "  # \u2500\u2500 needs-attention total \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
     "  local needs_attention_total",
     '  needs_attention_total=$(gh issue list --label "status:needs-attention" --state open \\',
     "    --json number --limit 100 2>/dev/null | jq 'length' 2>/dev/null || echo 0)",
     "  needs_attention_total=${needs_attention_total:-0}",
     "",
-    "  # Two summary lines consumed by the orchestrator: the issue/orphan",
-    "  # MAINTENANCE_DONE line and the PR-lease LEASE_RECONCILE line.",
+    "  # Three summary lines consumed by the orchestrator: the",
+    "  # issue/orphan MAINTENANCE_DONE line, the PR-lease LEASE_RECONCILE",
+    "  # line, and the LABEL_INVARIANT_DONE line.",
     '  echo "MAINTENANCE_DONE flagged_stale=${flagged_stale_count} flagged_blocked=${flagged_blocked_count} orphan_branches=${orphan_branches_count} orphan_prs=${orphan_prs_count} needs_attention_total=${needs_attention_total}"',
     '  echo "$lease_summary"',
+    '  echo "$label_summary"',
     "}",
     "",
     "cmd_prs() {",
@@ -16003,6 +16707,196 @@ function buildCheckBlockedScript(tiers, scopeGate, _runRatio) {
     '  done <<< "$eligible"',
     "}",
     "",
+    "cmd_label_invariant() {",
+    "  # Phase-label \u2192 type:<bundle> invariant sweep.",
+    "  #",
+    "  # Every phased-pipeline bundle pairs its <bundle>:<phase> labels",
+    "  # with exactly one type:<bundle> label. An agent that reconstructs",
+    "  # a gh issue create call from prose can stamp a conventional-commit",
+    "  # type label derived from the title prefix instead, producing an",
+    "  # issue that carries the phase label but the WRONG type label \u2014",
+    "  # invisible to the --label type:<bundle> duplicate-check idiom and",
+    "  # mis-tiered by the funnel-tier sort in cmd_eligible.",
+    "  #",
+    "  # Default mode is REPORT-ONLY (the consumer-runnable audit); pass",
+    "  # --fix to apply corrections. cmd_maintenance runs the --fix mode",
+    "  # as part of the Phase D sweep.",
+    "  #",
+    "  # CORRECTION POLICY. An issue must carry EXACTLY ONE type:* label",
+    "  # (cmd_eligible derives its funnel-tier sort key from the FIRST",
+    "  # one, and the label conventions mandate exactly one), so the",
+    "  # correction REPLACES rather than merely adds:",
+    "  #",
+    "  #   no type:* at all              \u2192 add the implied type label",
+    "  #   only conventional-commit      \u2192 remove them, add the implied",
+    "  #     type labels present           label (single atomic edit)",
+    "  #   implied label already there   \u2192 remove the stray conventional",
+    "  #     alongside a conventional one   label, leaving exactly one",
+    "  #   a type:* owned by ANOTHER     \u2192 FLAG status:needs-attention;",
+    "  #     bundle                         never guess which to drop",
+    "  #   phase labels imply 2+ types   \u2192 FLAG status:needs-attention",
+    "  #",
+    "  # Only a conventional-commit type label is ever removed \u2014 the set",
+    "  # is_conventional_type_label() recognises. A type:* label owned by",
+    "  # a different bundle is a genuine conflict a human must resolve.",
+    "  # status:needs-attention is applied ADDITIVELY; the base status:*",
+    "  # label always stays (see the additive-flag rule).",
+    "  local apply=0",
+    '  if [[ "${1:-}" == "--fix" ]]; then',
+    "    apply=1",
+    "  fi",
+    '  local mode="report"',
+    '  [[ "$apply" -eq 1 ]] && mode="fix"',
+    "",
+    "  local issues",
+    "  issues=$(gh issue list --state open --json number,labels \\",
+    '    --limit 1000 2>/dev/null || echo "[]")',
+    "",
+    "  # Filter jq-side and emit a TWO-field record. The label list is",
+    "  # last AND guaranteed non-empty by the select, so no field can",
+    "  # collapse under IFS=tab and shift the record left (#884). The",
+    "  # title is deliberately not threaded through \u2014 every output line",
+    "  # keys off the issue number.",
+    "  local issue_data",
+    `  issue_data=$(echo "$issues" | jq -r '`,
+    "    .[] |",
+    "    (.labels | map(.name)) as $names |",
+    "    select($names | length > 0) |",
+    '    "\\(.number)\\t\\($names | join(","))"',
+    "  ' 2>/dev/null)",
+    "",
+    "  local checked_count=0",
+    "  local ok_count=0",
+    "  local corrected_count=0",
+    "  local flagged_count=0",
+    "",
+    "  while IFS=$'\\t' read -r num labels_csv; do",
+    '    [[ -z "$num" ]] && continue',
+    "",
+    "    local labels_nl",
+    `    labels_nl=$(printf '%s' "$labels_csv" | tr ',' '\\n')`,
+    "",
+    "    local resolution assignment",
+    "    local outcome='' type_label='' phase_labels='' candidates=''",
+    `    resolution=$(printf '%s\\n' "$labels_nl" | phase_type_of)`,
+    "    while IFS= read -r assignment; do",
+    '      case "$assignment" in',
+    "        OUTCOME=*) outcome=${assignment#OUTCOME=} ;;",
+    "        TYPE_LABEL=*) type_label=${assignment#TYPE_LABEL=} ;;",
+    "        CANDIDATE_TYPE_LABELS=*) candidates=${assignment#CANDIDATE_TYPE_LABELS=} ;;",
+    "        PHASE_LABELS=*) phase_labels=${assignment#PHASE_LABELS=} ;;",
+    "      esac",
+    '    done <<< "$resolution"',
+    "",
+    "    # No recognised phase label \u2014 the invariant does not apply.",
+    "    # Consumer-specific `foo:bar` labels are deliberately not policed.",
+    '    [[ "$outcome" == "none" ]] && continue',
+    "    checked_count=$((checked_count + 1))",
+    "",
+    "    # Idempotent flagging: read the existing flag off the labels we",
+    "    # already fetched rather than spending another API call.",
+    "    local already_flagged=0",
+    '    case ",${labels_csv}," in',
+    '      *",status:needs-attention,"*) already_flagged=1 ;;',
+    "    esac",
+    "",
+    '    if [[ "$outcome" == "ambiguous" ]]; then',
+    '      echo "LABEL_AMBIGUOUS #${num} phase=\\"${phase_labels}\\" candidates=\\"${candidates}\\""',
+    "      flagged_count=$((flagged_count + 1))",
+    '      if [[ "$apply" -eq 1 && "$already_flagged" -eq 0 ]]; then',
+    '        if gh issue edit "$num" --add-label "status:needs-attention" >/dev/null 2>&1; then',
+    '          gh issue comment "$num" \\',
+    '            --body "Label invariant: phase label(s) ${phase_labels} imply more than one bundle type label (${candidates}). Flagged for human triage \u2014 an ambiguous pairing is never auto-corrected." >/dev/null 2>&1 || true',
+    '          echo "LABEL_FLAGGED #${num} \u2014 added status:needs-attention (ambiguous)"',
+    "        else",
+    '          echo "LABEL_FLAG_FAILED #${num} \u2014 could not add status:needs-attention (ambiguous)"',
+    "        fi",
+    "      fi",
+    "      continue",
+    "    fi",
+    "",
+    "    # Partition the issue's existing type:* labels against the",
+    "    # implied one.",
+    "    local label",
+    "    local has_expected=0",
+    "    local conv_types=''",
+    "    local foreign_types=''",
+    "    while IFS= read -r label; do",
+    '      [ -z "$label" ] && continue',
+    '      case "$label" in',
+    "        type:*) ;;",
+    "        *) continue ;;",
+    "      esac",
+    '      if [ "$label" = "$type_label" ]; then',
+    "        has_expected=1",
+    "        continue",
+    "      fi",
+    '      if is_conventional_type_label "$label"; then',
+    '        conv_types="${conv_types}${label} "',
+    "      else",
+    '        foreign_types="${foreign_types}${label} "',
+    "      fi",
+    '    done <<< "$labels_nl"',
+    "",
+    '    if [[ "$has_expected" -eq 1 && -z "${conv_types}${foreign_types}" ]]; then',
+    '      echo "LABEL_OK #${num} type=${type_label}"',
+    "      ok_count=$((ok_count + 1))",
+    "      continue",
+    "    fi",
+    "",
+    "    # A type:* label owned by a DIFFERENT bundle is a conflict the",
+    "    # sweep must not guess at: removing it would destroy routing",
+    "    # information, and adding alongside it would leave two bundle",
+    "    # type labels and a non-deterministic funnel tier.",
+    '    if [[ -n "$foreign_types" ]]; then',
+    '      echo "LABEL_CONFLICT #${num} phase=\\"${phase_labels}\\" expected=${type_label} foreign=\\"${foreign_types% }\\""',
+    "      flagged_count=$((flagged_count + 1))",
+    '      if [[ "$apply" -eq 1 && "$already_flagged" -eq 0 ]]; then',
+    '        if gh issue edit "$num" --add-label "status:needs-attention" >/dev/null 2>&1; then',
+    '          gh issue comment "$num" \\',
+    '            --body "Label invariant: phase label(s) ${phase_labels} require ${type_label}, but this issue carries ${foreign_types% }, which is owned by another bundle. Flagged for human triage \u2014 the sweep only removes conventional-commit type labels." >/dev/null 2>&1 || true',
+    '          echo "LABEL_FLAGGED #${num} \u2014 added status:needs-attention (conflicting bundle type)"',
+    "        else",
+    '          echo "LABEL_FLAG_FAILED #${num} \u2014 could not add status:needs-attention (conflict)"',
+    "        fi",
+    "      fi",
+    "      continue",
+    "    fi",
+    "",
+    "    # Correctable: add the implied label and/or drop the",
+    "    # conventional-commit label(s) shadowing it, in ONE edit so the",
+    "    # issue is never observable carrying two type:* labels.",
+    '    local removing="${conv_types% }"',
+    "    local adding=''",
+    '    [[ "$has_expected" -eq 0 ]] && adding="$type_label"',
+    '    echo "LABEL_VIOLATION #${num} phase=\\"${phase_labels}\\" expected=${type_label} add=\\"${adding}\\" remove=\\"${removing}\\""',
+    '    if [[ "$apply" -eq 0 ]]; then',
+    "      continue",
+    "    fi",
+    "",
+    "    local -a edit_args=()",
+    "    local stray",
+    "    for stray in $removing; do",
+    '      edit_args+=(--remove-label "$stray")',
+    "    done",
+    '    [[ -n "$adding" ]] && edit_args+=(--add-label "$adding")',
+    '    if [[ "${#edit_args[@]}" -eq 0 ]]; then',
+    "      continue",
+    "    fi",
+    '    if gh issue edit "$num" "${edit_args[@]}" >/dev/null 2>&1; then',
+    '      gh issue comment "$num" \\',
+    '        --body "Label invariant: phase label(s) ${phase_labels} require ${type_label}. Corrected \u2014 added: ${adding:-(none)}; removed: ${removing:-(none)}." >/dev/null 2>&1 || true',
+    '      echo "LABEL_CORRECTED #${num} added=\\"${adding}\\" removed=\\"${removing}\\""',
+    "      corrected_count=$((corrected_count + 1))",
+    "    else",
+    '      echo "LABEL_CORRECT_FAILED #${num} \u2014 label edit failed"',
+    "    fi",
+    '  done <<< "$issue_data"',
+    "",
+    "  local violations_count=$((checked_count - ok_count))",
+    '  echo "LABEL_INVARIANT_DONE mode=${mode} checked=${checked_count} ok=${ok_count} violations=${violations_count} corrected=${corrected_count} flagged=${flagged_count}"',
+    "}",
+    "",
     "cmd_scope() {",
     '  local issue_num="${1:-}"',
     '  if [[ -z "$issue_num" ]]; then',
@@ -16089,8 +16983,9 @@ function buildCheckBlockedScript(tiers, scopeGate, _runRatio) {
     '  maintenance) shift; cmd_maintenance "$@" ;;',
     '  prs)         shift; cmd_prs "$@" ;;',
     '  scope)       shift; cmd_scope "$@" ;;',
+    '  label-invariant) shift; cmd_label_invariant "$@" ;;',
     "  help|*)",
-    '    echo "Usage: check-blocked.sh <unblock|eligible|stale|orphaned|lease-reconcile|maintenance|prs|scope>"',
+    '    echo "Usage: check-blocked.sh <unblock|eligible|stale|orphaned|lease-reconcile|maintenance|prs|scope|label-invariant>"',
     "    exit 1",
     "    ;;",
     "esac"
@@ -16099,7 +16994,7 @@ function buildCheckBlockedScript(tiers, scopeGate, _runRatio) {
 function buildCheckBlockedProcedure(tiers, scopeGate = resolveScopeGate(), runRatio = resolveRunRatio()) {
   return {
     name: "check-blocked.sh",
-    description: "Token-efficient issue triage script with subcommands: eligible, unblock, stale, orphaned, lease-reconcile, maintenance, prs, scope. Sorts eligible issues by priority desc \u2192 funnel tier asc \u2192 issue number asc, excluding issues carrying `status:needs-attention` or `status:deferred`; the scope subcommand classifies a single issue against the scope-gate thresholds; the unblock subcommand applies the `status:blocked` \u2192 `status:ready` label flip itself, posts the canned unblock comment, skips human-parked `status:deferred` candidates with a `SKIP_DEFERRED` line, and emits a single `TRIAGE_DONE unblocked=N still_blocked=M deferred_skipped=K` summary line; the lease-reconcile subcommand auto-reconciles stuck `review:fixing` PR leases \u2014 re-applying `review:needs-worker` on an orphaned lease (fix-list stale, no worker report) so the Phase B1 drain retries, and removing `review:needs-worker` on a consumed-but-uncleared wedge (branch HEAD advanced past the fix-list, marker still set, no worker report) so the reviewer confirm pass can merge, always posting an audit-trail note comment and emitting a single `LEASE_RECONCILE orphaned=N consumed_uncleared=M` summary line; the maintenance subcommand flags stale issues with `status:needs-attention` (never auto-resets to `status:ready`), counts orphan branches/PRs, folds in the lease-reconcile sweep, and emits a `MAINTENANCE_DONE flagged_stale=N flagged_blocked=M orphan_branches=A orphan_prs=B needs_attention_total=T` summary line followed by the `LEASE_RECONCILE` line.",
+    description: "Token-efficient issue triage script with subcommands: eligible, unblock, stale, orphaned, lease-reconcile, maintenance, prs, scope, label-invariant. Sorts eligible issues by priority desc \u2192 funnel tier asc \u2192 issue number asc, excluding issues carrying `status:needs-attention` or `status:deferred`; the scope subcommand classifies a single issue against the scope-gate thresholds; the unblock subcommand applies the `status:blocked` \u2192 `status:ready` label flip itself, posts the canned unblock comment, skips human-parked `status:deferred` candidates with a `SKIP_DEFERRED` line, and emits a single `TRIAGE_DONE unblocked=N still_blocked=M deferred_skipped=K` summary line; the lease-reconcile subcommand auto-reconciles stuck `review:fixing` PR leases \u2014 re-applying `review:needs-worker` on an orphaned lease (fix-list stale, no worker report) so the Phase B1 drain retries, and removing `review:needs-worker` on a consumed-but-uncleared wedge (branch HEAD advanced past the fix-list, marker still set, no worker report) so the reviewer confirm pass can merge, always posting an audit-trail note comment and emitting a single `LEASE_RECONCILE orphaned=N consumed_uncleared=M` summary line; the maintenance subcommand flags stale issues with `status:needs-attention` (never auto-resets to `status:ready`), counts orphan branches/PRs, folds in the lease-reconcile sweep and the label-invariant auto-correction, and emits a `MAINTENANCE_DONE flagged_stale=N flagged_blocked=M orphan_branches=A orphan_prs=B needs_attention_total=T` summary line followed by the `LEASE_RECONCILE` and `LABEL_INVARIANT_DONE` lines; the label-invariant subcommand enforces the phase-label \u2192 `type:<bundle>` pairing derived from the canonical `BUNDLE_OWNERSHIP` map \u2014 report-only by default, auto-correcting with `--fix` (replacing a shadowing conventional-commit `type:*` rather than merely adding, so the issue keeps exactly one `type:*`) and flagging `status:needs-attention` when the pairing is ambiguous or collides with another bundle's type label, emitting a single `LABEL_INVARIANT_DONE mode=M checked=N ok=O violations=V corrected=C flagged=F` summary line.",
     content: buildCheckBlockedScript(tiers, scopeGate, runRatio)
   };
 }
@@ -16815,32 +17710,36 @@ var orchestratorSubAgent = {
     "## Phase D: Maintenance",
     "",
     "Run the bundled `check-blocked.sh maintenance` procedure and read",
-    "**only** the two summary lines it emits \u2014 `MAINTENANCE_DONE` and",
-    "`LEASE_RECONCILE`. The procedure folds the stale-detection,",
-    "orphan-detection, needs-attention summary, and PR-lease",
-    "auto-reconcile that earlier revisions split across D1, D2, and D3",
-    "into a single sweep \u2014 applying the `status:needs-attention` label",
-    "and posting the canned flag comment for each stale / stale-blocked",
-    "issue itself, and reconciling stuck `review:fixing` PR leases",
-    "itself, mirroring the discipline of Phase B (`pr-sweep.sh`) and",
-    "Phase C (`check-blocked.sh unblock`).",
+    "**only** the three summary lines it emits \u2014 `MAINTENANCE_DONE`,",
+    "`LEASE_RECONCILE`, and `LABEL_INVARIANT_DONE`. The procedure folds",
+    "the stale-detection, orphan-detection, needs-attention summary,",
+    "PR-lease auto-reconcile, and phase-label invariant sweep that",
+    "earlier revisions split across D1, D2, and D3 into a single sweep \u2014",
+    "applying the `status:needs-attention` label and posting the canned",
+    "flag comment for each stale / stale-blocked issue itself,",
+    "reconciling stuck `review:fixing` PR leases itself, and correcting",
+    "mislabeled pipeline issues itself, mirroring the discipline of",
+    "Phase B (`pr-sweep.sh`) and Phase C (`check-blocked.sh unblock`).",
     "",
     "```bash",
     ".claude/procedures/check-blocked.sh maintenance",
     "```",
     "",
-    "The script emits two summary lines in this shape:",
+    "The script emits three summary lines in this shape:",
     "",
     "```",
     "MAINTENANCE_DONE flagged_stale=<N> flagged_blocked=<M> orphan_branches=<A> orphan_prs=<B> needs_attention_total=<T>",
     "LEASE_RECONCILE orphaned=<N> consumed_uncleared=<M>",
+    "LABEL_INVARIANT_DONE mode=fix checked=<N> ok=<O> violations=<V> corrected=<C> flagged=<F>",
     "```",
     "",
     "Per-issue / per-orphan / per-PR informational lines (`FLAGGED_STALE",
     "#N`, `FLAGGED_BLOCKED #N`, `STALE #N \u2014 \u2026`, `STALE_BLOCKED #N \u2014 \u2026`,",
     "`ORPHAN_BRANCH \u2026`, `ORPHAN_PR #N \u2014 \u2026`, `FLAG_FAILED #N \u2014 \u2026`,",
     "`LEASE_ORPHANED PR #N \u2014 \u2026`, `LEASE_CONSUMED_UNCLEARED PR #N \u2014 \u2026`,",
-    "`LEASE_RECONCILE_FAILED PR #N \u2014 \u2026`) are emitted for log visibility",
+    "`LEASE_RECONCILE_FAILED PR #N \u2014 \u2026`, `LABEL_VIOLATION #N \u2014 \u2026`,",
+    "`LABEL_CORRECTED #N \u2014 \u2026`, `LABEL_AMBIGUOUS #N \u2014 \u2026`,",
+    "`LABEL_CONFLICT #N \u2014 \u2026`) are emitted for log visibility",
     "but are **not** load-bearing for the orchestrator \u2014 partial failures",
     "(one bad `gh` call) do not abort the sweep, they are simply omitted",
     "from the counters.",
@@ -16880,9 +17779,24 @@ var orchestratorSubAgent = {
     "is never silently force-released. The `review:fixing` lease itself",
     "is always left for the reviewer confirm pass to release.",
     "",
-    "Log both summary lines and continue to Phase E regardless of",
-    "outcomes \u2014 a non-zero `flagged_*`, `orphan_*`, `orphaned`, or",
-    "`consumed_uncleared` count is informational, not a failure.",
+    "**Phase-label invariant (`LABEL_INVARIANT_DONE`).** The sweep also",
+    "enforces the phase-label \u2192 `type:<bundle>` pairing on every open",
+    "issue, so a pipeline issue filed with a conventional-commit",
+    "`type:*` (derived from its title prefix) cannot stay invisible to",
+    'the `--label "type:<bundle>"` duplicate-check idiom or mis-tier in',
+    "Phase E's funnel-tier sort. The script mutates the labels itself \u2014",
+    "the orchestrator only reads the summary line. See the **Phase-label",
+    "\u2192 `type:<bundle>` invariant** section in `CLAUDE.md` for the full",
+    "correction policy; in short, a shadowing conventional-commit type",
+    "label is **replaced** (never merely supplemented, so the issue",
+    "keeps exactly one `type:*`), and an ambiguous or cross-bundle",
+    "collision is **flagged** `status:needs-attention` rather than",
+    "guessed at.",
+    "",
+    "Log all three summary lines and continue to Phase E regardless of",
+    "outcomes \u2014 a non-zero `flagged_*`, `orphan_*`, `orphaned`,",
+    "`consumed_uncleared`, `corrected`, or `flagged` count is",
+    "informational, not a failure.",
     "",
     "## Phase E: Queue Scan",
     "",
@@ -17884,6 +18798,7 @@ var ORCHESTRATOR_CONVENTIONS_PREAMBLE = [
   "- Stale thresholds: 72h for in-progress, 168h for blocked",
   "- Flagged issues get `status:needs-attention` \u2014 they are not auto-reset",
   "- **Phase D auto-reconciles stuck PR leases.** The maintenance sweep's `check-blocked.sh maintenance` invocation folds in a PR-lease reconcile that unwedges `review:fixing` PRs the Phase B1 drain and the worker hand-off left stuck, emitting a `LEASE_RECONCILE orphaned=<N> consumed_uncleared=<M>` line alongside `MAINTENANCE_DONE`. An **orphaned lease** (`review:fixing` without `review:needs-worker`, fix-list older than the 72h stale threshold, no worker-report newer than the fix-list) is **re-armed** \u2014 the sweep re-applies `review:needs-worker` so the Phase B1 drain retries the delegation, leaving the lease untouched. A **consumed-but-uncleared wedge** (both labels present, branch HEAD newer than the fix-list, no worker-report \u2014 the worker pushed but skipped the hand-off) is **auto-reconciled** \u2014 the sweep removes `review:needs-worker` so the reviewer confirm pass can merge. Both paths post an audit-trail note comment; a lease is never silently force-released, and the `review:fixing` lease itself is always left for the reviewer confirm pass to release.",
+  "- **Phase D enforces the phase-label \u2192 `type:<bundle>` invariant.** The same maintenance sweep folds in a label-invariant pass that auto-corrects open issues carrying a pipeline phase label without the matching `type:<bundle>` label, emitting a `LABEL_INVARIANT_DONE mode=fix checked=<N> ok=<O> violations=<V> corrected=<C> flagged=<F>` line alongside `MAINTENANCE_DONE`. The correction **replaces** a shadowing conventional-commit `type:*` rather than merely adding the bundle type, so the issue keeps exactly one `type:*` and Phase E's funnel-tier sort key stays deterministic. Ambiguous pairings and collisions with another bundle's `type:*` label are **flagged** `status:needs-attention` (additively) instead of guessed at. See the **Phase-label \u2192 `type:<bundle>` invariant** section below for the matcher table and the full correction policy.",
   "",
   "## Depth-0 invocation requirement",
   "",
@@ -17899,6 +18814,8 @@ function buildOrchestratorConventionsContent(tiers, scopeGate = resolveScopeGate
     "",
     renderScopeGateSection(scopeGate, excludeBundles),
     "",
+    renderPhaseTypeInvariantSection(excludeBundles),
+    "",
     renderScheduledTasksSection(scheduledTasks),
     "",
     renderUnblockDependentsSection(unblockDependents)
@@ -18986,7 +19903,7 @@ var peopleProfileBundle = buildPeopleProfileBundle();
 
 // src/pnpm/pnpm-workspace.ts
 import { relative } from "path";
-import { Component, YamlFile } from "projen";
+import { Component as Component3, YamlFile } from "projen";
 var MINIMUM_RELEASE_AGE = {
   ZERO_DAYS: 0,
   ONE_HOUR: 60,
@@ -19000,7 +19917,7 @@ var MINIMUM_RELEASE_AGE = {
   SIX_DAYS: 8640,
   ONE_WEEK: 10080
 };
-var PnpmWorkspace = class _PnpmWorkspace extends Component {
+var PnpmWorkspace = class _PnpmWorkspace extends Component3 {
   /**
    * Get the pnpm workspace component of a project. If it does not exist,
    * return undefined.
@@ -28565,7 +29482,7 @@ function buildResearchPipelineBundle(paths = DEFAULT_AGENT_PATHS, issueDefaults
 var researchPipelineBundle = buildResearchPipelineBundle();
 
 // src/projects/project-metadata.ts
-import { Component as Component2 } from "projen";
+import { Component as Component4 } from "projen";
 import { NodeProject } from "projen/lib/javascript";
 var GITHUB_HTTPS_RE = /(?:https?:\/\/|git\+https:\/\/)github\.com\/([^/]+)\/([^/.]+)(?:\.git)?/;
 var GITHUB_SSH_RE = /git@github\.com:([^/]+)\/([^/.]+)(?:\.git)?/;
@@ -28580,7 +29497,7 @@ function parseGitHubUrl(url) {
   }
   return { owner: void 0, name: void 0 };
 }
-var ProjectMetadata = class _ProjectMetadata extends Component2 {
+var ProjectMetadata = class _ProjectMetadata extends Component4 {
   /**
    * Returns the ProjectMetadata instance for a project. Walks up the parent
    * chain so sub-projects resolve the metadata declared on a root
@@ -31177,435 +32094,56 @@ function buildStandardsResearchBundle(paths = DEFAULT_AGENT_PATHS, issueDefaults
 }
 var standardsResearchBundle = buildStandardsResearchBundle();
 
-// src/turbo/turbo-repo.ts
-import {
-  Component as Component4,
-  FileBase,
-  JsonFile,
-  SampleDir,
-  SampleFile
-} from "projen/lib";
-import { JobPermission } from "projen/lib/github/workflows-model";
-
-// src/turbo/turbo-repo-task.ts
-import { Component as Component3 } from "projen/lib";
-var TurboRepoTask = class extends Component3 {
-  constructor(project, options) {
-    super(project);
-    this.project = project;
-    this.name = options.name;
-    this.dependsOn = options.dependsOn ?? [];
-    this.env = options.env ?? [];
-    this.passThroughEnv = options.passThroughEnv ?? [];
-    this.outputs = options.outputs ?? [];
-    this.cache = options.cache ?? true;
-    this.inputs = [
-      ...options.inputs ?? [],
-      // rerun if projen config changes
-      ".projen/**",
-      // ignore mac files
-      "!.DS_Store",
-      "!**/.DS_Store"
-    ];
-    this.outputLogs = options.outputLogs ?? "new-only";
-    this.persistent = options.persistent ?? false;
-    this.interactive = options.interactive ?? false;
-    this.isActive = true;
-  }
-  taskConfig() {
-    return {
-      dependsOn: this.dependsOn,
-      env: this.env,
-      passThroughEnv: this.passThroughEnv,
-      outputs: this.outputs,
-      cache: this.cache,
-      inputs: this.inputs,
-      outputLogs: this.outputLogs,
-      persistent: this.persistent,
-      interactive: this.interactive
-    };
-  }
-};
-
-// src/turbo/turbo-repo.ts
-var ROOT_TURBO_TASK_NAME = "turbo:build";
-var ROOT_CI_TASK_NAME = "build:all";
-var _TurboRepo = class _TurboRepo extends Component4 {
-  constructor(project, options = {}) {
-    super(project);
-    this.project = project;
-    /**
-     * Sub-Tasks to run
-     */
-    this.tasks = [];
-    this.turboVersion = options.turboVersion ?? "catalog:";
-    this.isRootProject = project === project.root;
-    if (this.isRootProject) {
-      project.addDevDeps(`turbo@${this.turboVersion}`);
-    }
-    project.gitignore.addPatterns("/.turbo");
-    project.npmignore?.addPatterns("/.turbo/");
-    this.extends = options.extends ?? (this.isRootProject ? [] : ["//"]);
-    this.globalDependencies = options.globalDependencies ?? [];
-    this.globalEnv = options.globalEnv ?? [];
-    this.globalPassThroughEnv = options.globalPassThroughEnv ?? [];
-    this.ui = options.ui ?? "stream";
-    this.dangerouslyDisablePackageManagerCheck = options.dangerouslyDisablePackageManagerCheck ?? false;
-    this.cacheDir = options.cacheDir ?? ".turbo/cache";
-    this.daemon = options.daemon ?? true;
-    this.envMode = options.envMode ?? "strict";
-    this.runOptions = {
-      ...options.runOptions,
-      summarize: options.runOptions?.summarize ?? true,
-      concurrency: options.runOptions?.concurrency ?? 10
-    };
-    this.remoteCacheOptions = options.remoteCacheOptions;
-    this.buildAllTaskEnvVars = options.buildAllTaskEnvVars ?? {};
-    this.buildTask = new TurboRepoTask(this.project, {
-      name: ROOT_TURBO_TASK_NAME,
-      dependsOn: this.isRootProject ? [`^${ROOT_TURBO_TASK_NAME}`] : []
-    });
-    if (this.isRootProject) {
-      this.buildAllTask = this.project.tasks.addTask(ROOT_CI_TASK_NAME, {
-        description: "Root build followed by sub-project builds. Mimics the CI build process in one step."
-      });
-      this.buildAllTask.exec("turbo telemetry disable");
-      if (this.buildAllTaskEnvVars) {
-        Object.entries(this.buildAllTaskEnvVars).forEach(([name, value]) => {
-          this.addGlobalEnvVar(name, value);
-        });
-      }
-      if (!this.remoteCacheOptions) {
-        this.buildAllTask.exec(
-          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(false)}`
-        );
-      } else {
-        this.buildAllTask.exec(
-          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(true)}`,
-          {
-            condition: '[ ! -n "$CI" ]',
-            env: {
-              TURBO_ENDPOINT: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.endpointParamName} --query Parameter.Value --output text --profile ${this.remoteCacheOptions.profileName})`,
-              TURBO_TOKEN: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.tokenParamName} --query Parameter.Value --output text --profile ${this.remoteCacheOptions.profileName})`
-            }
-          }
-        );
-        this.buildAllTask.exec(
-          `turbo ${ROOT_TURBO_TASK_NAME} ${this.renderRunArgs(true)}`,
-          {
-            condition: '[ -n "$CI" ]',
-            env: {
-              TURBO_ENDPOINT: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.endpointParamName} --query Parameter.Value --output text)`,
-              TURBO_TOKEN: `$(aws ssm get-parameter --name ${this.remoteCacheOptions.tokenParamName} --query Parameter.Value --output text)`
-            }
-          }
-        );
-      }
-    }
-    if (!this.isRootProject) {
-      this.preCompileTask = new TurboRepoTask(project, {
-        name: options.preCompileTask?.name ?? "pre-compile",
-        inputs: ["src/**"]
-      });
-      this.compileTask = new TurboRepoTask(project, {
-        name: options.compileTask?.name ?? "compile",
-        inputs: ["src/**"]
-      });
-      this.postCompileTask = new TurboRepoTask(project, {
-        name: options.postCompileTask?.name ?? "post-compile",
-        inputs: ["src/**"]
-      });
-      this.testTask = new TurboRepoTask(project, {
-        name: options.testTask?.name ?? "test"
-      });
-      this.packageTask = new TurboRepoTask(project, {
-        name: options.packageTask?.name ?? "package",
-        inputs: [".npmignore"]
-      });
-      this.tasks.push(
-        this.preCompileTask,
-        this.compileTask,
-        this.postCompileTask,
-        this.testTask,
-        this.packageTask
-      );
-    }
-  }
-  /**
-   * Static method to discovert turbo in a project.
-   */
-  static of(project) {
-    const isDefined = (c) => c instanceof _TurboRepo;
-    return project.components.find(isDefined);
-  }
-  /**
-   * Render the `turbo run` CLI flag string for the `build:all` / `reset:all`
-   * task commands from {@link runOptions}. With no `runOptions` configured the
-   * output matches the historically hard-coded flags exactly.
-   *
-   * @param remote - when `true`, also emit the remote-cache flags
-   * (`--cache=remote:rw` plus `--api` / `--token` / `--team` derived from
-   * {@link remoteCacheOptions}). The remote-cache `build:all` variant passes
-   * `true`; `reset:all` and the local `build:all` variant pass `false`.
-   */
-  renderRunArgs(remote) {
-    const run = this.runOptions;
-    const args = [];
-    if (run.summarize) {
-      args.push("--summarize");
-    }
-    args.push(`--concurrency=${run.concurrency}`);
-    if (run.force) {
-      args.push("--force");
-    }
-    if (run.noCache) {
-      args.push("--no-cache");
-    }
-    if (run.only) {
-      args.push("--only");
-    }
-    if (run.affected) {
-      args.push("--affected");
-    }
-    if (run.cacheWorkers !== void 0) {
-      args.push(`--cache-workers=${run.cacheWorkers}`);
-    }
-    if (run.continueOn !== void 0) {
-      args.push(`--continue=${run.continueOn}`);
-    }
-    if (run.frameworkInference !== void 0) {
-      args.push(`--framework-inference=${run.frameworkInference}`);
-    }
-    for (const filter of run.filter ?? []) {
-      args.push(`--filter=${filter}`);
-    }
-    if (run.outputLogs !== void 0) {
-      args.push(`--output-logs=${run.outputLogs}`);
-    }
-    if (run.logOrder !== void 0) {
-      args.push(`--log-order=${run.logOrder}`);
-    }
-    if (run.logPrefix !== void 0) {
-      args.push(`--log-prefix=${run.logPrefix}`);
-    }
-    if (run.dryRun !== void 0) {
-      args.push(`--dry-run=${run.dryRun}`);
-    }
-    const cache = run.cache ?? (remote ? "remote:rw" : void 0);
-    if (cache !== void 0) {
-      args.push(`--cache=${cache}`);
-    }
-    if (remote && this.remoteCacheOptions) {
-      args.push(
-        "--api=$TURBO_ENDPOINT",
-        "--token=$TURBO_TOKEN",
-        `--team=${this.remoteCacheOptions.teamName}`
-      );
-    }
-    if (run.additionalArgs) {
-      args.push(...run.additionalArgs);
-    }
-    return args.join(" ");
-  }
-  /**
-   * Add an env var to the global env vars for all tasks.
-   * This will also become an input for the build:all task cache at the root.
-   */
-  addGlobalEnvVar(name, value) {
-    this.buildAllTask?.env(name, value);
-    if (this.isRootProject) {
-      this.globalEnv.push(name);
-    }
-  }
-  activateBranchNameEnvVar(options) {
-    const value = '$([ -n "$GIT_BRANCH_NAME" ] && echo "$GIT_BRANCH_NAME" || git rev-parse --abbrev-ref HEAD)';
-    if (options === void 0) {
-      this.project.logger.warn(
-        "TurboRepo.activateBranchNameEnvVar() with no arguments is deprecated. It writes GIT_BRANCH_NAME to the root `globalEnv`, which forces every task in the monorepo to miss cache on every branch switch. Pass `{ tasks: [...] }` and name only the tasks that actually consume the branch (e.g. CDK synth/package) to preserve cross-branch cache hits for everything else."
-      );
-      this.addGlobalEnvVar("GIT_BRANCH_NAME", value);
-      return;
-    }
-    const knownTaskNames = this.tasks.map((task) => task.name);
-    const unknown = options.tasks.filter(
-      (name) => !knownTaskNames.includes(name)
-    );
-    if (unknown.length > 0) {
-      throw new Error(
-        `TurboRepo.activateBranchNameEnvVar: unknown task name(s) ${JSON.stringify(
-          unknown
-        )}. Known tasks on this TurboRepo: ${JSON.stringify(knownTaskNames)}.`
-      );
-    }
-    for (const name of options.tasks) {
-      const task = this.tasks.find((t) => t.name === name);
-      if (task && !task.env.includes("GIT_BRANCH_NAME")) {
-        task.env.push("GIT_BRANCH_NAME");
-      }
-    }
-  }
-  /**
-   * Paths of all generated files in the project, deduped, for use as task
-   * inputs so the compile cache invalidates when they change. Includes
-   * projen-managed `FileBase` files plus generated-once `SampleFile` /
-   * `SampleDir` — whose paths projen keeps private, so they are read defensively
-   * and skipped if that internal shape ever changes. Computed at synth time so
-   * files added after this component (e.g. a subclass's SampleFiles) are seen.
-   */
-  generatedFileInputs() {
-    const inputs = /* @__PURE__ */ new Set();
-    for (const component of this.project.components) {
-      if (component instanceof FileBase) {
-        inputs.add(component.path);
-      } else if (component instanceof SampleFile) {
-        const filePath = component.filePath;
-        if (typeof filePath === "string") {
-          inputs.add(filePath);
-        }
-      } else if (component instanceof SampleDir) {
-        const dir = component.dir;
-        if (typeof dir === "string") {
-          inputs.add(`${dir}/**`);
-        }
-      }
-    }
-    return Array.from(inputs);
-  }
-  preSynthesize() {
-    let nextDependsOn = this.project.deps.all.filter((d) => d.version === "workspace:*").map((d) => [d.name, ROOT_TURBO_TASK_NAME].join("#"));
-    if (!this.isRootProject) {
-      [
-        [this.project.preCompileTask, this.preCompileTask],
-        [this.project.compileTask, this.compileTask],
-        [this.project.postCompileTask, this.postCompileTask],
-        [this.project.testTask, this.testTask],
-        [this.project.packageTask, this.packageTask]
-      ].forEach(([pjTask, turboTask]) => {
-        if (pjTask && turboTask && pjTask.steps.length > 0) {
-          if (nextDependsOn.length > 0) {
-            turboTask.dependsOn.push(...nextDependsOn);
-          }
-          nextDependsOn = [turboTask.name];
-        } else {
-          turboTask.isActive = false;
-        }
-      });
-      this.buildTask.dependsOn.push(...nextDependsOn);
-    }
-    const generatedInputs = this.generatedFileInputs();
-    const appendGeneratedInputs = (task) => {
-      if (!task) {
-        return;
-      }
-      for (const input of generatedInputs) {
-        if (!task.inputs.includes(input)) {
-          task.inputs.push(input);
-        }
-      }
-    };
-    if (this.isRootProject) {
-      appendGeneratedInputs(this.buildTask);
-    } else {
-      appendGeneratedInputs(this.preCompileTask);
-      appendGeneratedInputs(this.compileTask);
-      appendGeneratedInputs(this.postCompileTask);
-    }
-    const fileName = "turbo.json";
-    this.project.addPackageIgnore(fileName);
-    new JsonFile(this.project, fileName, {
-      obj: {
-        extends: this.extends.length ? this.extends : void 0,
-        globalDependencies: this.isRootProject && this.globalDependencies.length ? this.globalDependencies : void 0,
-        globalEnv: this.isRootProject && this.globalEnv.length ? this.globalEnv : void 0,
-        globalPassThroughEnv: this.isRootProject && this.globalPassThroughEnv.length ? this.globalPassThroughEnv : void 0,
-        ui: this.isRootProject ? this.ui : void 0,
-        dangerouslyDisablePackageManagerCheck: this.isRootProject ? this.dangerouslyDisablePackageManagerCheck : void 0,
-        cacheDir: this.isRootProject ? this.cacheDir : void 0,
-        envMode: this.isRootProject ? this.envMode : void 0,
-        /**
-         * All tasks
-         */
-        tasks: this.tasks.filter((task) => task.isActive).reduce(
-          (acc, task) => {
-            acc[task.name] = {
-              ...task.taskConfig()
-            };
-            return acc;
-          },
-          {
-            [this.buildTask.name]: { ...this.buildTask.taskConfig() }
-          }
-        )
-      }
-    });
-    super.preSynthesize();
+// src/agent/bundles/turborepo.ts
+function renderCachingBullet(policy) {
+  if (policy.remoteCacheEnabled && policy.awsProfileName) {
+    return `- Uses remote caching (requires AWS credentials on the \`${policy.awsProfileName}\` profile)`;
   }
-};
-_TurboRepo.buildWorkflowOptions = (remoteCacheOptions) => {
+  return "- Local caching only \u2014 no remote cache is configured, so no AWS credentials are required";
+}
+function buildTurborepoBundle(buildPolicy = DEFAULT_BUILD_POLICY) {
   return {
-    env: {
-      GIT_BRANCH_NAME: "${{ github.head_ref || github.ref_name }}"
-    },
-    permissions: {
-      contents: JobPermission.WRITE,
-      idToken: JobPermission.WRITE
-    },
-    preBuildSteps: [
+    name: "turborepo",
+    description: "Turborepo workspace rules and task pipeline conventions",
+    appliesWhen: (project) => hasComponent(project, TurboRepo),
+    rules: [
       {
-        name: "AWS Creds for SSM",
-        uses: "aws-actions/configure-aws-credentials@v6",
-        with: {
-          ["role-to-assume"]: remoteCacheOptions.oidcRole,
-          ["aws-region"]: "us-east-1",
-          ["role-duration-seconds"]: "900"
-        }
+        name: "turborepo-conventions",
+        description: "Turborepo build system and task pipeline conventions",
+        scope: AGENT_RULE_SCOPE.FILE_PATTERN,
+        filePatterns: ["turbo.json", "package.json"],
+        content: [
+          "# Turborepo Conventions",
+          "",
+          "## Build System",
+          "",
+          "- **Build**: `pnpm build:all` (uses Turborepo)",
+          "- **Test**: `pnpm test` or `pnpm test:watch`",
+          "- **Lint**: `pnpm eslint`",
+          "",
+          "## Task Pipeline",
+          "",
+          renderCachingBullet(buildPolicy),
+          "- Only rebuilds changed packages",
+          "- Cache key based on file hashes and dependency graph",
+          "- Configured in `turbo.json`",
+          "",
+          "## Workspace Rules",
+          "",
+          "- Source files: `src/` directory",
+          "- Tests: Co-located with source files (`.spec.ts` or `.test.ts`)",
+          "- Exports: Use `index.ts` files for clean public APIs",
+          "- Configuration: Managed by Projen (edit `.projenrc.ts` or `projenrc/*.ts`)"
+        ].join("\n"),
+        tags: ["workflow"]
       }
-    ]
-  };
-};
-var TurboRepo = _TurboRepo;
-
-// src/agent/bundles/turborepo.ts
-var turborepoBundle = {
-  name: "turborepo",
-  description: "Turborepo workspace rules and task pipeline conventions",
-  appliesWhen: (project) => hasComponent(project, TurboRepo),
-  rules: [
-    {
-      name: "turborepo-conventions",
-      description: "Turborepo build system and task pipeline conventions",
-      scope: AGENT_RULE_SCOPE.FILE_PATTERN,
-      filePatterns: ["turbo.json", "package.json"],
-      content: [
-        "# Turborepo Conventions",
-        "",
-        "## Build System",
-        "",
-        "- **Build**: `pnpm build:all` (uses Turborepo)",
-        "- **Test**: `pnpm test` or `pnpm test:watch`",
-        "- **Lint**: `pnpm eslint`",
-        "",
-        "## Task Pipeline",
-        "",
-        "- Uses remote caching (requires AWS credentials)",
-        "- Only rebuilds changed packages",
-        "- Cache key based on file hashes and dependency graph",
-        "- Configured in `turbo.json`",
-        "",
-        "## Workspace Rules",
-        "",
-        "- Source files: `src/` directory",
-        "- Tests: Co-located with source files (`.spec.ts` or `.test.ts`)",
-        "- Exports: Use `index.ts` files for clean public APIs",
-        "- Configuration: Managed by Projen (edit `.projenrc.ts` or `projenrc/*.ts`)"
-      ].join("\n"),
-      tags: ["workflow"]
+    ],
+    claudePermissions: {
+      allow: ["Bash(npx turbo:*)"]
     }
-  ],
-  claudePermissions: {
-    allow: ["Bash(npx turbo:*)"]
-  }
-};
+  };
+}
+var turborepoBundle = buildTurborepoBundle();
 
 // src/agent/bundles/typescript.ts
 var typescriptBundle = {
@@ -32820,7 +33358,7 @@ function renderPriorityRulesSection(rules) {
 }
 
 // src/agent/bundles/index.ts
-function buildBuiltInBundles(paths = DEFAULT_AGENT_PATHS, issueDefaults = DEFAULT_RESOLVED_ISSUE_DEFAULTS, defaultAgentTier = AGENT_MODEL.BALANCED, bundleAgentTiers = /* @__PURE__ */ new Map(), prReviewPolicy = resolvePrReviewPolicy()) {
+function buildBuiltInBundles(paths = DEFAULT_AGENT_PATHS, issueDefaults = DEFAULT_RESOLVED_ISSUE_DEFAULTS, defaultAgentTier = AGENT_MODEL.BALANCED, bundleAgentTiers = /* @__PURE__ */ new Map(), prReviewPolicy = resolvePrReviewPolicy(), buildPolicy = DEFAULT_BUILD_POLICY) {
   const tierFor = (bundle) => bundleAgentTiers.get(bundle) ?? defaultAgentTier;
   return [
     buildBaseBundle(paths),
@@ -32828,11 +33366,11 @@ function buildBuiltInBundles(paths = DEFAULT_AGENT_PATHS, issueDefaults = DEFAUL
     typescriptBundle,
     vitestBundle,
     jestBundle,
-    turborepoBundle,
+    buildTurborepoBundle(buildPolicy),
     pnpmBundle,
     awsCdkBundle,
     projenBundle,
-    githubWorkflowBundle,
+    buildGithubWorkflowBundle(buildPolicy),
     slackBundle,
     buildMeetingAnalysisBundle(tierFor("meeting-analysis")),
     agendaBundle,
@@ -33917,6 +34455,13 @@ var AgentConfig = class _AgentConfig extends Component8 {
    * their rendered rule content reflects any consumer override.
    * Bundles that do not read agent paths are passed through as-is
    * from their default const exports.
+   *
+   * The build policy is auto-detected from the project's `TurboRepo`
+   * component here rather than configured, so build guidance in the
+   * `github-workflow` and `turborepo` rules only claims an AWS
+   * credential requirement when a remote cache actually exists. The
+   * getter is lazy by design — `TurboRepo` must already be attached
+   * to the project when the bundles are first read.
    */
   get pathAwareBundles() {
     if (!this.cachedBundles) {
@@ -33925,7 +34470,8 @@ var AgentConfig = class _AgentConfig extends Component8 {
         resolveIssueDefaults(this.options.issueDefaults),
         resolveDefaultAgentTier(this.options),
         resolveBundleAgentTiers(this.options),
-        resolvePrReviewPolicy(this.options.prReviewPolicy)
+        resolvePrReviewPolicy(this.options.prReviewPolicy),
+        resolveBuildPolicy(this.project)
       );
     }
     return this.cachedBundles;
@@ -40634,6 +41180,7 @@ export {
   CDK_WATCH_DEFAULTS_BY_STAGE,
   CLAUDE_RULE_TARGET,
   COMPLETE_JOB_ID,
+  CONVENTIONAL_COMMIT_TYPE_LABELS,
   CdkCli,
   DEFAULT_AC_THRESHOLDS,
   DEFAULT_AGENT_PATHS,
@@ -40643,6 +41190,7 @@ export {
   DEFAULT_API_EXTRACTOR_REPORT_FILENAME,
   DEFAULT_API_EXTRACTOR_REPORT_FOLDER,
   DEFAULT_AUDIT_REPORT_DIR,
+  DEFAULT_BUILD_POLICY,
   DEFAULT_BUNDLE_OVERRIDES,
   DEFAULT_DECOMPOSITION_TEMPLATE,
   DEFAULT_DISPATCH_MODEL,
@@ -40704,6 +41252,7 @@ export {
   MONOREPO_LAYOUT,
   MonorepoProject,
   Nvmrc,
+  PHASE_LABEL_TYPE_MAP,
   PROD_DEPLOY_NAME,
   PROGRESS_FILES_FORMAT_VALUES,
   PnpmWorkspace,
@@ -40763,6 +41312,7 @@ export {
   buildCompanyProfileBundle,
   buildCustomerProfileBundle,
   buildDocsSyncBundle,
+  buildGithubWorkflowBundle,
   buildIndustryDiscoveryBundle,
   buildMaintenanceAuditBundle,
   buildMeetingAnalysisBundle,
@@ -40777,6 +41327,7 @@ export {
   buildResearchPipelineBundle,
   buildSoftwareProfileBundle,
   buildStandardsResearchBundle,
+  buildTurborepoBundle,
   buildUnblockDependentsProcedure,
   bundleNameForWorkflowRule,
   businessModelsBundle,
@@ -40862,6 +41413,8 @@ export {
   renderIssueTemplatesStarterPage,
   renderMeetingTypesSection,
   renderNextRequirementIdProcedure,
+  renderPhaseTypeInvariantSection,
+  renderPhaseTypeInvariantShellHelpers,
   renderPriorityRulesSection,
   renderProgressFileName,
   renderProgressFilePath,
@@ -40894,6 +41447,7 @@ export {
   resolveAgentTiers,
   resolveAstroProjectOutdir,
   resolveAwsCdkProjectOutdir,
+  resolveBuildPolicy,
   resolveBundleAgentTiers,
   resolveDefaultAgentTier,
   resolveIssueDefaults,
@@ -40912,6 +41466,7 @@ export {
   resolveSkillEvals,
   resolveTemplateVariables,
   resolveTemporalFraming,
+  resolveTypeLabelForLabels,
   resolveTypeScriptProjectOutdir,
   resolveUnblockDependents,
   runScan,
@@ -40921,6 +41476,7 @@ export {
   stripToolArtifactTagsProcedure,
   tsdocRecordToFindings,
   turborepoBundle,
+  typeLabelForPhaseLabel,
   typescriptBundle,
   upstreamConfigulatorDocsBundle,
   validateAgentTierConfig,