@ebrindley/build 0.0.0-stage → 1.42.1-rc28

package/dist/chunk-G3VB2UCZ.js

@@ -0,0 +1,3892 @@
+import {
+  LOCAL_CI_FULL_VALIDATION_PROFILE,
+  boundLocalCiValidationProfileReason,
+  normalizeAuthorityPath,
+  normalizeRepoRelativePath,
+  parseGitRawDiffChangeSet,
+  resolveLocalCiConfig,
+  resolveLocalCiFallbackCommands,
+  resolveLocalCiValidationProfileEnv,
+  resolveProjectVerificationAuthority,
+  selectLocalCiValidationProfile
+} from "./chunk-PEBWDYIW.js";
+import {
+  registerDetachedWorkerProcess,
+  startDetachedWorkerRegistryHeartbeat
+} from "./chunk-P7RVCHQV.js";
+import {
+  DEFAULT_LOCAL_CI_MAX_CONCURRENT,
+  DEFAULT_LOCAL_CI_MAX_TERMINAL_RECORDS,
+  DEFAULT_LOCAL_CI_STATUS_CONTEXT,
+  LocalCiStateStore,
+  MAX_LOCAL_CI_RETAINED_LOG_BYTES,
+  NODE_PACKAGE_MANAGER_MANIFESTS,
+  boundLocalCiCommandOutput,
+  computeEntrypointFingerprint,
+  createFailurePublicationLease,
+  createOutstandingFailureStatusPublication,
+  createOutstandingStatusPublication,
+  createQueuedRun,
+  hasLiveFailurePublicationLease,
+  hasOutstandingRemoteStatusPublication,
+  isPublicationPending,
+  launcherManifests,
+  matchesFailurePublicationLease,
+  outstandingStatusPublicationMatchesRecord,
+  parseLocalCiRepositoryIdentity,
+  parseScopedPin,
+  pinnedManifestFiles,
+  referencedTableScript,
+  renderBoundedLocalCiLogEntry,
+  repoStateKey,
+  scopedPinKey,
+  scriptTableUnchanged
+} from "./chunk-VBENAHDA.js";
+import {
+  RepositorySchema,
+  resolveGitHubRepositoryFromRemote,
+  resolveOptionalGitHubRepositoryFromRemote
+} from "./chunk-BDPYFAB4.js";
+import {
+  acquireFencedFileLock
+} from "./chunk-QYQOVOLR.js";
+import {
+  runVerificationArgv,
+  runVerificationCommand
+} from "./chunk-S2E632FQ.js";
+import {
+  outstandingStatusPublicationMacIsValid,
+  pruneEmptyPublicationJournalDirs
+} from "./chunk-4U6XK2DG.js";
+import {
+  describePipDependencyGroupGap,
+  isPipDependencyGroupInstall,
+  parsePipVersionOutput,
+  parseProjectDependencySetupCommand,
+  readFailingTestNames,
+  readVenvPipVersion,
+  selectPythonEnv
+} from "./chunk-AHU3FKPA.js";
+import {
+  detectEmptyRun,
+  splitTestFailureId
+} from "./chunk-TUQMMFEQ.js";
+import {
+  describeVerificationCommand,
+  detectExitZeroVerifyFailure,
+  isPrettierInvocation
+} from "./chunk-EPAMVGI3.js";
+import {
+  execGit
+} from "./chunk-MHLEZQQI.js";
+import {
+  createLocalCiDetachedChildEnv
+} from "./chunk-SVJM3LJA.js";
+import {
+  getLocalCiStateRoot,
+  localCiSchedulingEnvelopePath
+} from "./chunk-BV3XQQLU.js";
+import {
+  processOwnershipState,
+  readProcessIdentity
+} from "./chunk-MT2WAIR3.js";
+import {
+  selectVerificationToolchainEnv
+} from "./chunk-XSJTIFUY.js";
+import {
+  BUILD_LOCAL_CI_APPROVE_ENTRYPOINT_SHA,
+  BUILD_LOCAL_CI_OVERRIDE_HALT,
+  readEnv
+} from "./chunk-7VRJHTGZ.js";
+
+// src/core/ci/github-local-ci.ts
+import { setTimeout as delay } from "timers/promises";
+import { execa } from "execa";
+import { z } from "zod";
+var PullRequestSchema = z.object({
+  number: z.number().int().positive(),
+  headRefOid: z.string().regex(/^[a-f0-9]{40}$/i),
+  isDraft: z.boolean(),
+  baseRefName: z.string().min(1),
+  baseRefOid: z.string().regex(/^[a-f0-9]{40}$/i)
+});
+var CommitStatusSchema = z.object({
+  state: z.enum(["error", "failure", "pending", "success"]),
+  context: z.string(),
+  description: z.string().nullish(),
+  target_url: z.string().nullish()
+});
+async function runGh(args, options = {}) {
+  const result = await execa("gh", args, {
+    cwd: options.cwd,
+    input: options.input,
+    reject: false,
+    timeout: 6e4,
+    stdio: "pipe"
+  });
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `GitHub CLI failed: ${(result.stderr || result.stdout || args.join(" ")).split("\n")[0]}`
+    );
+  }
+  return result.stdout;
+}
+async function publishGitHubLocalCiStatus(input, options = {}) {
+  const repository = RepositorySchema.parse(input.repository);
+  const payload = JSON.stringify({
+    state: input.state,
+    context: input.context,
+    description: input.description.slice(0, 140)
+  });
+  const attempts = options.attempts ?? 12;
+  let lastError;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      await runGh(
+        ["api", "--method", "POST", `repos/${repository}/statuses/${input.sha}`, "--input", "-"],
+        { input: payload }
+      );
+      return;
+    } catch (error) {
+      lastError = error;
+      if (attempt < attempts) await delay(options.retryDelayMs ?? 5e3);
+    }
+  }
+  throw lastError instanceof Error ? lastError : new Error(String(lastError));
+}
+var DEFAULT_PR_DISCOVERY_ATTEMPTS = 6;
+var DEFAULT_PR_DISCOVERY_RETRY_DELAY_MS = 2e3;
+async function readGitHubPullRequestState(input) {
+  try {
+    const repository = RepositorySchema.parse(input.repository);
+    const output = await runGh([
+      "pr",
+      "view",
+      String(input.number),
+      "--repo",
+      repository,
+      "--json",
+      "state"
+    ]);
+    return z.object({ state: z.enum(["OPEN", "CLOSED", "MERGED"]) }).parse(JSON.parse(output)).state;
+  } catch {
+    return null;
+  }
+}
+async function findGitHubPullRequest(input) {
+  const repository = RepositorySchema.parse(input.repository);
+  const attempts = input.attempts ?? DEFAULT_PR_DISCOVERY_ATTEMPTS;
+  const retryDelayMs = input.retryDelayMs ?? DEFAULT_PR_DISCOVERY_RETRY_DELAY_MS;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    const output = input.number ? await runGh([
+      "pr",
+      "view",
+      String(input.number),
+      "--repo",
+      repository,
+      "--json",
+      "number,headRefOid,isDraft,baseRefName,baseRefOid"
+    ]) : await runGh([
+      "pr",
+      "list",
+      "--repo",
+      repository,
+      "--head",
+      input.branch,
+      ...input.base ? ["--base", input.base] : [],
+      "--state",
+      "open",
+      "--limit",
+      "1",
+      "--json",
+      "number,headRefOid,isDraft,baseRefName,baseRefOid"
+    ]);
+    const pullRequest = input.number ? PullRequestSchema.parse(JSON.parse(output)) : z.array(PullRequestSchema).parse(JSON.parse(output))[0];
+    if (pullRequest) {
+      return {
+        number: pullRequest.number,
+        headSha: pullRequest.headRefOid,
+        draft: pullRequest.isDraft,
+        baseRefName: pullRequest.baseRefName,
+        baseSha: pullRequest.baseRefOid
+      };
+    }
+    if (attempt < attempts) await delay(retryDelayMs);
+  }
+  return null;
+}
+var OPEN_PULL_REQUEST_LIST_LIMIT = 1e3;
+async function listGitHubOpenPullRequests(repository) {
+  const output = await runGh([
+    "pr",
+    "list",
+    "--repo",
+    RepositorySchema.parse(repository),
+    "--state",
+    "open",
+    "--limit",
+    String(OPEN_PULL_REQUEST_LIST_LIMIT),
+    "--json",
+    "number,headRefOid,isDraft,baseRefName,baseRefOid"
+  ]);
+  const pullRequests = z.array(PullRequestSchema).parse(JSON.parse(output));
+  return new Map(
+    pullRequests.map((pullRequest) => [
+      pullRequest.number,
+      {
+        number: pullRequest.number,
+        headSha: pullRequest.headRefOid,
+        draft: pullRequest.isDraft,
+        baseRefName: pullRequest.baseRefName,
+        baseSha: pullRequest.baseRefOid
+      }
+    ])
+  );
+}
+async function resolveGitHubDefaultBranch(repository) {
+  const parsed = z.object({ defaultBranchRef: z.object({ name: z.string().min(1) }) }).parse(
+    JSON.parse(
+      await runGh([
+        "repo",
+        "view",
+        RepositorySchema.parse(repository),
+        "--json",
+        "defaultBranchRef"
+      ])
+    )
+  );
+  return parsed.defaultBranchRef.name;
+}
+async function resolveGitHubBranchSha(input) {
+  const output = await runGh([
+    "api",
+    `repos/${RepositorySchema.parse(input.repository)}/commits/${encodeURIComponent(input.branch)}`,
+    "--jq",
+    ".sha"
+  ]);
+  return z.string().regex(/^[a-f0-9]{40}$/i).parse(output.trim()).toLowerCase();
+}
+async function readGitHubCommitStatusDetail(input) {
+  const output = await runGh([
+    "api",
+    `repos/${RepositorySchema.parse(input.repository)}/commits/${input.sha}/status`
+  ]);
+  const payload = z.object({ statuses: z.array(CommitStatusSchema) }).parse(JSON.parse(output));
+  const found = payload.statuses.find((status) => status.context === input.context);
+  if (!found) return { state: "missing" };
+  return {
+    state: found.state,
+    ...found.description ? { description: found.description } : {},
+    ...found.target_url ? { targetUrl: found.target_url } : {}
+  };
+}
+async function readGitHubCommitStatus(input) {
+  return (await readGitHubCommitStatusDetail(input)).state;
+}
+
+// src/core/ci/local-ci-runtime.ts
+import { randomUUID } from "crypto";
+import { existsSync } from "fs";
+import {
+  link,
+  mkdir,
+  mkdtemp,
+  readFile,
+  realpath,
+  rename,
+  rm,
+  stat,
+  unlink,
+  writeFile
+} from "fs/promises";
+import os from "os";
+import path from "path";
+import { setTimeout as delay2 } from "timers/promises";
+import { execa as execa2 } from "execa";
+import { z as z2 } from "zod";
+var SlotRecordSchema = z2.object({
+  pid: z2.number().int().positive(),
+  pidIdentity: z2.string().min(1).optional(),
+  token: z2.string().uuid(),
+  acquiredAt: z2.iso.datetime()
+});
+var RepositoryIdSchema = z2.string().refine((value) => parseLocalCiRepositoryIdentity(value) !== null, {
+  message: "Invalid local CI repository identity"
+});
+var Sha40Schema = z2.string().regex(/^[a-f0-9]{40}$/i);
+var MaxConcurrentSchema = z2.number().int().min(1).max(8);
+var TARGET_VALIDATION_ENV_KEYS = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "TMPDIR",
+  "TEMP",
+  "TMP",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "COLORTERM",
+  "SHELL",
+  "XDG_CACHE_HOME",
+  "XDG_CONFIG_HOME",
+  "XDG_DATA_HOME",
+  "XDG_STATE_HOME"
+];
+var SchedulingEnvelopeSchema = z2.object({
+  schemaVersion: z2.literal(1),
+  maxConcurrent: MaxConcurrentSchema,
+  updatedFromBaseSha: Sha40Schema,
+  updatedAt: z2.iso.datetime()
+});
+var UNPARSABLE_SLOT_LOCK_STALE_MS = 10 * 60 * 1e3;
+var PRIORITY_WAIT_MAX_MS = 6 * 60 * 60 * 1e3;
+var DEFAULT_ENVELOPE_BASE_SHA = "0".repeat(40);
+function createLocalCiTargetValidationEnv(source = process.env, options = {}) {
+  const env = selectVerificationToolchainEnv(source);
+  for (const key of TARGET_VALIDATION_ENV_KEYS) {
+    const value = source[key];
+    if (typeof value === "string" && value.length > 0) {
+      env[key] = value;
+    }
+  }
+  env.CI = "1";
+  env.npm_config_script_shell = "/bin/sh";
+  const nodeExtraCaCerts = source.NODE_EXTRA_CA_CERTS;
+  if (typeof nodeExtraCaCerts === "string" && nodeExtraCaCerts.length > 0) {
+    env.NODE_EXTRA_CA_CERTS = nodeExtraCaCerts;
+  }
+  if (options.trustedBaseSha !== void 0) {
+    env.BUILD_RELEASE_GATE_TRUSTED_BASE = Sha40Schema.parse(options.trustedBaseSha).toLowerCase();
+  }
+  env.BUILD_LOCAL_CI_PROFILE = resolveLocalCiValidationProfileEnv(options.validationProfile);
+  if (options.gateRetry !== void 0) {
+    env.BUILD_GATE_RETRY_MANIFEST_DIGEST = options.gateRetry.manifestDigest;
+    env.BUILD_GATE_RETRY_LABELS = JSON.stringify(options.gateRetry.rerunLabels);
+    env.BUILD_GATE_REUSED_LABELS = JSON.stringify(options.gateRetry.reusedLabels);
+  }
+  return env;
+}
+function isNodeErrorCode(error, code) {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
+}
+function normalizeMaxConcurrent(value) {
+  return MaxConcurrentSchema.parse(value);
+}
+function defaultSchedulingEnvelope(now) {
+  return {
+    schemaVersion: 1,
+    maxConcurrent: DEFAULT_LOCAL_CI_MAX_CONCURRENT,
+    updatedFromBaseSha: DEFAULT_ENVELOPE_BASE_SHA,
+    updatedAt: (now ?? /* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function readSchedulingEnvelope(input) {
+  const stateRoot = input.stateRoot ?? getLocalCiStateRoot();
+  const filePath = localCiSchedulingEnvelopePath(stateRoot, repoStateKey(input.repository));
+  try {
+    const raw = await readFile(filePath, "utf8");
+    return SchedulingEnvelopeSchema.parse(JSON.parse(raw));
+  } catch {
+    return defaultSchedulingEnvelope();
+  }
+}
+async function writeSchedulingEnvelope(input) {
+  const repository = parseLocalCiRepositoryIdentity(RepositoryIdSchema.parse(input.repository));
+  if (!repository) {
+    throw new Error(`Invalid local CI repository identity: ${input.repository}`);
+  }
+  const envelope = SchedulingEnvelopeSchema.parse({
+    schemaVersion: 1,
+    maxConcurrent: input.maxConcurrent,
+    updatedFromBaseSha: input.updatedFromBaseSha.toLowerCase(),
+    updatedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString()
+  });
+  const stateRoot = input.stateRoot ?? getLocalCiStateRoot();
+  const filePath = localCiSchedulingEnvelopePath(stateRoot, repoStateKey(repository));
+  await mkdir(path.dirname(filePath), { recursive: true, mode: 448 });
+  const temporary = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, `${JSON.stringify(envelope, null, 2)}
+`, {
+      encoding: "utf8",
+      mode: 384
+    });
+    await rename(temporary, filePath);
+  } catch (error) {
+    await unlink(temporary).catch(() => void 0);
+    throw error;
+  }
+  return envelope;
+}
+async function resolveEffectiveMaxConcurrent(input) {
+  if (input.maxConcurrent !== void 0) {
+    return normalizeMaxConcurrent(input.maxConcurrent);
+  }
+  const envelope = await readSchedulingEnvelope({
+    repository: input.repository,
+    stateRoot: input.stateRoot
+  });
+  return envelope.maxConcurrent;
+}
+function priorityWaiterPath(input) {
+  const stateRoot = input.stateRoot ?? getLocalCiStateRoot();
+  return path.join(stateRoot, repoStateKey(input.repository), "slots", "priority.wait");
+}
+async function acquireLocalCiSlot(input) {
+  if (!input.priority) return pollLocalCiSlot(input);
+  const filePath = priorityWaiterPath(input);
+  const token = randomUUID();
+  await mkdir(path.dirname(filePath), { recursive: true, mode: 448 });
+  const temporary = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+  await writeFile(
+    temporary,
+    `${JSON.stringify({
+      pid: process.pid,
+      pidIdentity: readProcessIdentity(process.pid),
+      token,
+      acquiredAt: (/* @__PURE__ */ new Date()).toISOString()
+    })}
+`,
+    { encoding: "utf8", mode: 384 }
+  );
+  await rename(temporary, filePath);
+  try {
+    return await pollLocalCiSlot(input);
+  } finally {
+    try {
+      const marker = SlotRecordSchema.parse(JSON.parse(await readFile(filePath, "utf8")));
+      if (marker.token === token) await unlink(filePath);
+    } catch {
+    }
+  }
+}
+async function priorityWaiterLive(filePath) {
+  let marker;
+  try {
+    marker = SlotRecordSchema.parse(JSON.parse(await readFile(filePath, "utf8")));
+  } catch {
+    return false;
+  }
+  if (Date.now() - Date.parse(marker.acquiredAt) > PRIORITY_WAIT_MAX_MS) return false;
+  return processOwnershipState(marker.pid, marker.pidIdentity, marker.acquiredAt) !== "reclaimable";
+}
+async function pollLocalCiSlot(input) {
+  const stateRoot = input.stateRoot ?? getLocalCiStateRoot();
+  const effectiveCap = await resolveEffectiveMaxConcurrent({
+    repository: input.repository,
+    stateRoot,
+    maxConcurrent: input.maxConcurrent
+  });
+  const slotsDirectory = path.join(stateRoot, repoStateKey(input.repository), "slots");
+  await mkdir(slotsDirectory, { recursive: true, mode: 448 });
+  const token = randomUUID();
+  const pidIdentity = readProcessIdentity(process.pid);
+  const deadline = Date.now() + (input.timeoutMs ?? 6 * 60 * 60 * 1e3);
+  while (Date.now() < deadline) {
+    await input.checkContinue?.();
+    if (Date.now() >= deadline) break;
+    if (!input.priority && await priorityWaiterLive(priorityWaiterPath(input))) {
+      await delay2(input.pollMs ?? 2e3);
+      continue;
+    }
+    for (let slot = 0; slot < effectiveCap; slot += 1) {
+      const filePath = path.join(slotsDirectory, `${slot}.lock`);
+      const payload = `${JSON.stringify({
+        pid: process.pid,
+        pidIdentity,
+        token,
+        acquiredAt: (/* @__PURE__ */ new Date()).toISOString()
+      })}
+`;
+      const temporary = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+      try {
+        try {
+          await writeFile(temporary, payload, { encoding: "utf8", mode: 384 });
+          await link(temporary, filePath);
+        } catch (error) {
+          await unlink(temporary).catch(() => void 0);
+          throw error;
+        }
+        await unlink(temporary).catch(() => void 0);
+        return {
+          slot,
+          maxConcurrent: effectiveCap,
+          async release() {
+            try {
+              const current = SlotRecordSchema.parse(JSON.parse(await readFile(filePath, "utf8")));
+              if (current.token === token && current.pid === process.pid) await unlink(filePath);
+            } catch (error) {
+              if (!isNodeErrorCode(error, "ENOENT")) {
+                throw error;
+              }
+            }
+          }
+        };
+      } catch (error) {
+        if (!isNodeErrorCode(error, "EEXIST")) {
+          throw error;
+        }
+        try {
+          const current = SlotRecordSchema.parse(JSON.parse(await readFile(filePath, "utf8")));
+          const ownership = processOwnershipState(
+            current.pid,
+            current.pidIdentity,
+            current.acquiredAt
+          );
+          if (ownership === "reclaimable") {
+            await unlink(filePath);
+          }
+        } catch (readError) {
+          if (isNodeErrorCode(readError, "ENOENT")) {
+            continue;
+          }
+          try {
+            const metadata = await stat(filePath);
+            if (Date.now() - metadata.mtimeMs > UNPARSABLE_SLOT_LOCK_STALE_MS) {
+              await unlink(filePath).catch((unlinkError) => {
+                if (!isNodeErrorCode(unlinkError, "ENOENT")) throw unlinkError;
+              });
+            }
+          } catch (statError) {
+            if (!isNodeErrorCode(statError, "ENOENT")) throw statError;
+          }
+        }
+      }
+    }
+    await delay2(input.pollMs ?? 2e3);
+  }
+  throw new Error("Timed out waiting for a local CI execution slot.");
+}
+var LOCAL_CI_WORKTREE_CREATION_TIMEOUT_MS = 12e4;
+async function createLocalCiWorktree(repoRoot, sha) {
+  const parent = await mkdtemp(path.join(os.tmpdir(), "build-local-ci-"));
+  const worktreePath = path.join(parent, "worktree");
+  try {
+    const result = await execGit(["worktree", "add", "--detach", worktreePath, sha], {
+      cwd: repoRoot,
+      timeoutMs: LOCAL_CI_WORKTREE_CREATION_TIMEOUT_MS
+    });
+    if (result.exitCode !== 0) {
+      throw new Error(`Unable to create local CI worktree: ${result.stderr || result.stdout}`);
+    }
+    return worktreePath;
+  } catch (error) {
+    try {
+      await removeLocalCiWorktree(repoRoot, worktreePath);
+    } catch (cleanupError) {
+      throw new Error(
+        `${error instanceof Error ? error.message : String(error)}. Retained partial local CI worktree at ${worktreePath}: cleanup failed: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`,
+        { cause: error }
+      );
+    }
+    throw error;
+  }
+}
+async function isRegisteredWorktree(repoRoot, worktreePath) {
+  const listed = await execGit(["worktree", "list", "--porcelain"], { cwd: repoRoot });
+  if (listed.exitCode !== 0) return false;
+  const candidates = /* @__PURE__ */ new Set([
+    worktreePath,
+    await realpath(worktreePath).catch(() => worktreePath)
+  ]);
+  return listed.stdout.split("\n").some((line) => line.startsWith("worktree ") && candidates.has(line.slice("worktree ".length)));
+}
+async function removeLocalCiWorktree(repoRoot, worktreePath) {
+  const resolved = path.resolve(worktreePath);
+  if (path.basename(resolved) !== "worktree" || !path.basename(path.dirname(resolved)).startsWith("build-local-ci-")) {
+    throw new Error(`Refusing to remove non-local-CI worktree path: ${resolved}`);
+  }
+  const underTemporaryRoot = resolved.startsWith(
+    `${path.resolve(os.tmpdir())}${path.sep}build-local-ci-`
+  );
+  if (!underTemporaryRoot && !await isRegisteredWorktree(repoRoot, resolved)) {
+    if (!existsSync(resolved)) return;
+    throw new Error(`Refusing to remove unregistered local CI worktree path: ${resolved}`);
+  }
+  const { removeWorktreeNestedAware } = await import("./nested-worktrees-2WUWQ75N.js");
+  const removal = await removeWorktreeNestedAware(resolved, { force: true, repoCwd: repoRoot });
+  if (removal.refused) {
+    throw new Error(
+      `Unable to unregister local CI worktree: ${removal.refused.reason} (${removal.refused.path})`
+    );
+  }
+  await rm(path.dirname(resolved), { recursive: true, force: true });
+}
+var DEFAULT_LOCAL_CI_COMMAND_TIMEOUT_MS = 60 * 60 * 1e3;
+async function runLocalCiVerificationCommand(command, cwd, options) {
+  const timeoutMs = options?.timeoutMs ?? DEFAULT_LOCAL_CI_COMMAND_TIMEOUT_MS;
+  const env = createLocalCiTargetValidationEnv(process.env, {
+    trustedBaseSha: options?.trustedBaseSha,
+    validationProfile: options?.validationProfile ?? LOCAL_CI_FULL_VALIDATION_PROFILE,
+    gateRetry: options?.gateRetry
+  });
+  const setup = parseProjectDependencySetupCommand(command);
+  const groupGap = setup ? await describeCiPipDependencyGroupGap(setup, cwd, env) : void 0;
+  if (groupGap)
+    return { exitCode: 0, output: `Warning: skipped dependency group install: ${groupGap}` };
+  const result = setup ? await runVerificationArgv(setup.file, setup.args, {
+    cwd,
+    timeoutMs,
+    env,
+    // Argv already constrained by parseProjectDependencySetupCommand;
+    // verify safety rejects install verbs, so mark structured setup explicitly.
+    dependencySetup: true,
+    abortSignal: options?.signal
+  }) : await runVerificationCommand(command, {
+    cwd,
+    timeoutMs,
+    env,
+    abortSignal: options?.signal
+  });
+  const output = String(result.all ?? [result.stdout, result.stderr].filter(Boolean).join("\n"));
+  return {
+    exitCode: result.exitCode ?? 1,
+    output,
+    // A cancelled command's group was still alive after the bounded wait.
+    ..."processGroupSurvived" in result ? { processGroupSurvived: true } : {}
+  };
+}
+async function describeCiPipDependencyGroupGap(setup, cwd, env) {
+  if (!isPipDependencyGroupInstall(setup.args)) return void 0;
+  const envRoot = selectPythonEnv(cwd)?.envRoot;
+  let version = envRoot ? readVenvPipVersion(envRoot) : void 0;
+  if (!envRoot) {
+    const probe = await execa2(setup.file, ["-I", "-m", "pip", "--version"], {
+      cwd,
+      env,
+      extendEnv: false,
+      reject: false,
+      timeout: 15e3
+    }).catch(() => void 0);
+    version = parsePipVersionOutput(String(probe?.stdout ?? ""));
+  }
+  return describePipDependencyGroupGap(version, setup.args[4] ?? "");
+}
+async function resolveCanonicalMainRepoRoot(cwd) {
+  const result = await execGit(["rev-parse", "--path-format=absolute", "--git-common-dir"], {
+    cwd
+  });
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `Unable to resolve canonical repository root from ${cwd}: ${result.stderr || result.stdout}`
+    );
+  }
+  const commonDir = result.stdout.trim();
+  if (!commonDir) {
+    throw new Error(`git rev-parse returned an empty --git-common-dir for ${cwd}`);
+  }
+  const candidate = path.dirname(commonDir);
+  const validation = await execGit(["rev-parse", "--path-format=absolute", "--show-toplevel"], {
+    cwd: candidate
+  });
+  if (validation.exitCode !== 0) {
+    throw new Error(
+      `Resolved candidate repository root ${candidate} (from ${cwd}) is not a valid working tree: ${validation.stderr || validation.stdout}`
+    );
+  }
+  const topLevel = validation.stdout.trim();
+  if (!topLevel || path.resolve(topLevel) !== path.resolve(candidate)) {
+    throw new Error(
+      `Resolved candidate repository root ${candidate} (from ${cwd}) does not match its own working-tree root ${topLevel}; unsupported git topology (e.g. separate-git-dir or submodule).`
+    );
+  }
+  return candidate;
+}
+function keepMacAwakeForCurrentProcess() {
+  if (process.platform !== "darwin") return;
+  const child = execa2("caffeinate", ["-i", "-w", String(process.pid)], {
+    reject: false,
+    stdio: "ignore"
+  });
+  child.unref();
+  void child.catch(() => void 0);
+}
+
+// src/core/ci/local-ci-authority.ts
+import { setTimeout as delay3 } from "timers/promises";
+
+// src/core/ci/local-ci-command-entrypoint.ts
+import { lstatSync, readFileSync } from "fs";
+import * as path2 from "path";
+
+// src/core/ci/local-ci-trusted-launchers.ts
+var NAMED_CONFIG_OPTIONS = /* @__PURE__ */ new Set([
+  "--config",
+  "-c",
+  "--config-file",
+  "--configuration",
+  "--rcfile",
+  "--project",
+  "--settings"
+]);
+var BUILD_DEFINITION_LANGUAGES = /* @__PURE__ */ new Set(["dotnet", "native", "r"]);
+var BUILD_DEFINITION_HEADS = /* @__PURE__ */ new Set(["dbt"]);
+var PACKAGE_RUNNERS = /* @__PURE__ */ new Set(["npx", "pnpx", "bunx"]);
+var EXEC_VERB_RUNNERS = /* @__PURE__ */ new Set(["npm", "pnpm", "yarn"]);
+function tscIndex(tokens) {
+  const [head = "", verb = ""] = tokens;
+  let index = 0;
+  if (PACKAGE_RUNNERS.has(head)) index = 1;
+  else if (EXEC_VERB_RUNNERS.has(head) && verb === "exec" || head === "bun" && verb === "x") {
+    index = 2;
+  }
+  if (index > 0) while ((tokens[index] ?? "").startsWith("-")) index += 1;
+  return (tokens[index] ?? "").split("/").pop() === "tsc" ? index : -1;
+}
+var EXEC_WRAPPERS = {
+  bundle: { verb: "exec", strict: true, pins: [".bundle/config"] },
+  pipenv: { verb: "run", strict: true, pins: [] },
+  poetry: { verb: "run", strict: false, pins: [] },
+  uv: { verb: "run", strict: false, pins: [] },
+  pdm: { verb: "run", strict: false, pins: [] },
+  hatch: { verb: "run", strict: false, pins: [] }
+};
+function unwrapExecWrapper(head, tokens) {
+  const wrapper = EXEC_WRAPPERS[head];
+  if (!wrapper || (tokens[1] ?? "").toLowerCase() !== wrapper.verb) return null;
+  let index = 2;
+  while (index < tokens.length && (tokens[index] ?? "").startsWith("-")) index += 1;
+  const inner = tokens.slice(index);
+  return inner.length === 0 ? null : { tokens: inner, strict: wrapper.strict, pins: wrapper.pins };
+}
+function namedConfigOperands(tokens) {
+  const operands = [];
+  const tsc = tscIndex(tokens);
+  const checkShorthand = isPrettierInvocation(tokens);
+  for (let index = 1; index < tokens.length; index += 1) {
+    const token = tokens[index] ?? "";
+    const eq = token.indexOf("=");
+    const name = eq === -1 ? token : token.slice(0, eq);
+    const tscProject = name === "-p" && tsc >= 0 && index > tsc;
+    if (!NAMED_CONFIG_OPTIONS.has(name) && !tscProject) continue;
+    if (checkShorthand && name === "-c") continue;
+    if (eq !== -1) operands.push(token.slice(eq + 1));
+    else if (tokens[index + 1] !== void 0) operands.push(tokens[index + 1] ?? "");
+  }
+  return operands;
+}
+function recognizeTrustedLauncher(head, tokens) {
+  const wrapped = unwrapExecWrapper(head, tokens);
+  if (wrapped) {
+    return {
+      pins: [...wrapped.pins, ...namedConfigOperands(tokens)],
+      nested: { tokens: wrapped.tokens, strict: wrapped.strict }
+    };
+  }
+  const command = tokens.join(" ");
+  if (parseProjectDependencySetupCommand(command)) return { pins: [] };
+  const described = describeVerificationCommand(command);
+  if (described.language === "unknown" || described.kind === "unknown") return null;
+  if (BUILD_DEFINITION_LANGUAGES.has(described.language) || BUILD_DEFINITION_HEADS.has(head)) {
+    return null;
+  }
+  return { pins: namedConfigOperands(tokens) };
+}
+
+// src/core/ci/local-ci-version-only-lockfile.ts
+var SUPPORTED_LOCKFILE_VERSION = 3;
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function deepEqual(left, right) {
+  if (left === right) return true;
+  if (Array.isArray(left) || Array.isArray(right)) {
+    return Array.isArray(left) && Array.isArray(right) && left.length === right.length && left.every((item, index) => deepEqual(item, right[index]));
+  }
+  if (isPlainObject(left) && isPlainObject(right)) {
+    const leftKeys = Object.keys(left);
+    return leftKeys.length === Object.keys(right).length && leftKeys.every((key) => Object.hasOwn(right, key) && deepEqual(left[key], right[key]));
+  }
+  return false;
+}
+function stripLockfileVersions(text) {
+  let document;
+  try {
+    document = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (!isPlainObject(document) || typeof document.version !== "string") return null;
+  if (document.lockfileVersion !== SUPPORTED_LOCKFILE_VERSION) return null;
+  const packages = document.packages;
+  if (!isPlainObject(packages)) return null;
+  const rootPackage = packages[""];
+  if (!isPlainObject(rootPackage) || typeof rootPackage.version !== "string") return null;
+  const { version: _version, ...rest } = document;
+  const { version: _rootVersion, ...rootWithoutVersion } = rootPackage;
+  return { ...rest, packages: { ...packages, "": rootWithoutVersion } };
+}
+function isVersionOnlyLockfileChange(baseText, candidateText) {
+  const base = stripLockfileVersions(baseText);
+  const candidate = stripLockfileVersions(candidateText);
+  return base !== null && candidate !== null && deepEqual(base, candidate);
+}
+
+// src/core/ci/local-ci-command-entrypoint.ts
+var LOCKFILE_PATH = "package-lock.json";
+var PACKAGE_SCRIPT_VERBS = /* @__PURE__ */ new Set(["run", "run-script", "test", "start", "exec", "task"]);
+var PACKAGE_MANAGER_HEADS = /* @__PURE__ */ new Set(["npm", "pnpm", "yarn", "bun", "deno"]);
+var INTERPRETER_HEADS = /* @__PURE__ */ new Set([
+  "node",
+  "nodejs",
+  "deno",
+  "bun",
+  "tsx",
+  "ts-node",
+  "python",
+  "python2",
+  "python3",
+  "pypy",
+  "pypy3",
+  "ruby",
+  "perl",
+  "php",
+  "rscript",
+  "lua",
+  "luajit",
+  "sh",
+  "bash",
+  "zsh",
+  "dash",
+  "ksh",
+  "fish",
+  "pwsh",
+  "powershell"
+]);
+var SHELL_INTERPRETER_HEADS = /* @__PURE__ */ new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "dash",
+  "ksh",
+  "fish",
+  "pwsh",
+  "powershell"
+]);
+var MAX_REPORTED_PATHS = 3;
+function commandSegments(command) {
+  return command.split(/\|\||&&|[;\n|]/).map((segment) => segment.trim()).filter(Boolean);
+}
+function headBasename(token) {
+  const lowered = token.toLowerCase();
+  return lowered.includes("/") ? lowered.split("/").pop() ?? lowered : lowered;
+}
+var ENVIRONMENT_WRAPPER_HEADS = /* @__PURE__ */ new Set(["env", "cross-env"]);
+var ENV_ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+var NODE_VALUE_OPTIONS = [
+  "--require",
+  "-r",
+  "--import",
+  "--loader",
+  "--experimental-loader",
+  "--env-file",
+  "--env-file-if-exists"
+];
+var INTERPRETER_VALUE_OPTIONS = {
+  node: new Set(NODE_VALUE_OPTIONS),
+  nodejs: new Set(NODE_VALUE_OPTIONS),
+  "ts-node": /* @__PURE__ */ new Set([...NODE_VALUE_OPTIONS, "-P", "--project"]),
+  tsx: /* @__PURE__ */ new Set([...NODE_VALUE_OPTIONS, "--tsconfig"]),
+  deno: /* @__PURE__ */ new Set(["-c", "--config", "--import-map", "--lock", "--cert"]),
+  bun: /* @__PURE__ */ new Set(["-c", "--config", "-r", "--preload", "--tsconfig-override", "--env-file"]),
+  ruby: /* @__PURE__ */ new Set(["-I", "-r", "-C"]),
+  perl: /* @__PURE__ */ new Set(["-I"]),
+  php: /* @__PURE__ */ new Set(["-c", "-d"])
+};
+var PACKAGE_MANAGER_PASSIVE_OPTIONS = /* @__PURE__ */ new Set([
+  "-s",
+  "--silent",
+  "-q",
+  "--quiet",
+  "--verbose",
+  "--if-present"
+]);
+var NPM_MANIFEST_SELECTING_OPTIONS = /* @__PURE__ */ new Set([
+  "-w",
+  "--workspace",
+  "-ws",
+  "--ws",
+  "--workspaces",
+  "-C",
+  "--prefix"
+]);
+var MAX_ENVIRONMENT_UNWRAP_DEPTH = 8;
+function isEnvAssignmentToken(token) {
+  return ENV_ASSIGNMENT.test(token);
+}
+function skipLeadingEnvAssignments(tokens) {
+  let index = 0;
+  while (index < tokens.length && isEnvAssignmentToken(tokens[index] ?? "")) {
+    index += 1;
+  }
+  return index === 0 ? tokens : tokens.slice(index);
+}
+function unwrapSingleEnvironmentWrapper(tokens) {
+  if (!ENVIRONMENT_WRAPPER_HEADS.has(headBasename(tokens[0] ?? ""))) return null;
+  let index = 1;
+  while (index < tokens.length) {
+    const token = tokens[index] ?? "";
+    if (token.startsWith("-") || isEnvAssignmentToken(token)) {
+      index += 1;
+      continue;
+    }
+    break;
+  }
+  return tokens.slice(index);
+}
+function unwrapEnvironmentLauncher(tokens) {
+  let remaining = skipLeadingEnvAssignments(tokens);
+  for (let depth = 0; depth < MAX_ENVIRONMENT_UNWRAP_DEPTH; depth += 1) {
+    const unwrapped = unwrapSingleEnvironmentWrapper(remaining);
+    if (unwrapped === null) return remaining;
+    remaining = skipLeadingEnvAssignments(unwrapped);
+  }
+  return remaining;
+}
+function isModeledLauncherHead(head, firstToken) {
+  return Boolean(
+    launcherManifests(head) || INTERPRETER_HEADS.has(head) || operandArtifactPath(firstToken)
+  );
+}
+function interpreterValueOperand(head, token) {
+  const eq = token.indexOf("=");
+  const name = eq === -1 ? token : token.slice(0, eq);
+  if (!INTERPRETER_VALUE_OPTIONS[head]?.has(name)) return void 0;
+  if (eq !== -1) return { operand: token.slice(eq + 1), consumesNext: false };
+  return { consumesNext: true };
+}
+function collectInterpreterArtifacts(head, tokens, into, onAmbiguousProgram) {
+  let afterUnlistedOption = false;
+  let firstCandidate = null;
+  for (let index = 1; index < tokens.length; index += 1) {
+    const token = tokens[index] ?? "";
+    const valueOption = interpreterValueOperand(head, token);
+    if (valueOption) {
+      const operand = valueOption.consumesNext ? tokens[index + 1] ?? "" : valueOption.operand ?? "";
+      if (valueOption.consumesNext) index += 1;
+      const artifact = operandArtifactPath(operand);
+      if (artifact) into.add(artifact);
+      continue;
+    }
+    if (token.startsWith("-")) {
+      if (!token.includes("=")) afterUnlistedOption = true;
+      continue;
+    }
+    const repoPath = operandRepoPath(token);
+    if (repoPath) {
+      into.add(foldArtifactPath(repoPath));
+      if (firstCandidate !== null) onAmbiguousProgram?.();
+      if (!afterUnlistedOption) return firstCandidate ?? repoPath;
+      firstCandidate ??= repoPath;
+    }
+    afterUnlistedOption = false;
+  }
+  return firstCandidate;
+}
+function operandRepoPath(token) {
+  const unquoted = token.replace(/^['"]|['"]$/g, "");
+  if (!unquoted || unquoted.startsWith("-")) return null;
+  if (unquoted.includes("://")) return null;
+  const repoRelative = unquoted.replace(/^\$\{?REPO_ROOT\}?\//i, "");
+  if (!repoRelative.includes("/") && !/\.[a-z0-9]{1,8}$/i.test(repoRelative)) return null;
+  return normalizeRepoRelativePath(repoRelative);
+}
+function foldArtifactPath(repoPath) {
+  return repoPath.toLowerCase();
+}
+function operandArtifactPath(token) {
+  const repoPath = operandRepoPath(token);
+  return repoPath === null ? null : foldArtifactPath(repoPath);
+}
+function skipPassivePackageManagerOptions(tokens, start) {
+  let index = start;
+  while (index < tokens.length && (tokens[index] ?? "").startsWith("-")) {
+    if (!PACKAGE_MANAGER_PASSIVE_OPTIONS.has((tokens[index] ?? "").toLowerCase())) return -1;
+    if (/^(true|false)$/i.test(tokens[index + 1] ?? "")) return -1;
+    index += 1;
+  }
+  return index;
+}
+function resolvePackageManagerInvocation(head, tokens) {
+  if (!PACKAGE_MANAGER_HEADS.has(head)) return null;
+  const unresolved = { verb: "", scriptName: null, unresolved: true };
+  const verbIndex = skipPassivePackageManagerOptions(tokens, 1);
+  if (verbIndex === -1) {
+    return tokens.length === 2 ? { verb: "", scriptName: null, unresolved: false } : unresolved;
+  }
+  const verb = (tokens[verbIndex] ?? "").toLowerCase();
+  const scriptAfterVerb = () => {
+    const nameIndex = skipPassivePackageManagerOptions(tokens, verbIndex + 1);
+    const name = nameIndex === -1 ? void 0 : tokens[nameIndex];
+    if (!name) return unresolved;
+    return { verb, scriptName: name.replace(/^['"]|['"]$/g, ""), unresolved: false };
+  };
+  let invocation = { verb, scriptName: null, unresolved: false };
+  if (head === "npm" || head === "pnpm") {
+    if (verb === "run" || verb === "run-script") invocation = scriptAfterVerb();
+    else if (verb === "test" || verb === "start") invocation.scriptName = verb;
+  } else if (head === "yarn" || head === "bun") {
+    if (verb === "workspace" || verb === "workspaces") return unresolved;
+    if (verb === "run") invocation = scriptAfterVerb();
+    else if (verb && !["install", "add", "remove"].includes(verb)) invocation.scriptName = verb;
+  }
+  if (head === "npm" && invocation.scriptName !== null) {
+    for (const token of tokens.slice(verbIndex + 1)) {
+      if (token === "--") break;
+      const name = token.split("=")[0] ?? "";
+      if (NPM_MANIFEST_SELECTING_OPTIONS.has(name)) return unresolved;
+    }
+  }
+  return invocation;
+}
+function readPackageScripts(repoRoot) {
+  try {
+    const parsed = JSON.parse(readFileSync(path2.join(repoRoot, "package.json"), "utf8"));
+    if (!parsed.scripts || typeof parsed.scripts !== "object" || Array.isArray(parsed.scripts)) {
+      return null;
+    }
+    return Object.fromEntries(
+      Object.entries(parsed.scripts).filter(
+        (entry) => typeof entry[1] === "string"
+      )
+    );
+  } catch {
+    return null;
+  }
+}
+function entrypointSidecarPath(artifact) {
+  const extensionIndex = artifact.lastIndexOf(".");
+  const stem = extensionIndex > artifact.lastIndexOf("/") ? artifact.slice(0, extensionIndex) : artifact;
+  return `${stem}.entrypoints.json`;
+}
+function readEntrypointSidecar(trustedRoot, artifact, unmodeledOut) {
+  const sidecarPath = entrypointSidecarPath(artifact);
+  try {
+    const parsed = JSON.parse(readFileSync(path2.join(trustedRoot, sidecarPath), "utf8"));
+    if (!Array.isArray(parsed.packageScripts) || parsed.packageScripts.some((value) => typeof value !== "string" || value.trim().length === 0)) {
+      unmodeledOut?.push(`invalid trusted entrypoint sidecar: ${sidecarPath}`);
+      return { path: sidecarPath, packageScripts: [] };
+    }
+    return {
+      path: sidecarPath,
+      packageScripts: [...new Set(parsed.packageScripts.map((value) => value.trim()))]
+    };
+  } catch (error) {
+    const code = error && typeof error === "object" && "code" in error ? String(error.code) : void 0;
+    if (code === "ENOENT") return null;
+    unmodeledOut?.push(`invalid trusted entrypoint sidecar: ${sidecarPath}`);
+    return { path: sidecarPath, packageScripts: [] };
+  }
+}
+function bindNamedOperands(operands, into) {
+  for (const operand of operands) {
+    const artifact = operandArtifactPath(operand);
+    if (artifact) into.add(artifact);
+  }
+}
+function collectNestedLauncher(nested, into, trustedRoot, visitedScripts, context) {
+  collectSegmentEntrypoints(
+    nested.tokens.join(" "),
+    into,
+    trustedRoot,
+    visitedScripts,
+    context.visitedShellArtifacts,
+    context.unmodeledOut,
+    false
+  );
+}
+function collectSegmentEntrypoints(segment, into, trustedRoot, visitedScripts = /* @__PURE__ */ new Set(), visitedShellArtifacts = /* @__PURE__ */ new Set(), unmodeledOut, fromTrustedShellArtifact = false) {
+  const tokens = unwrapEnvironmentLauncher(segment.split(/\s+/).filter(Boolean));
+  const head = headBasename(tokens[0] ?? "");
+  if (!head) return;
+  if (!isModeledLauncherHead(head, tokens[0] ?? "")) {
+    if (!fromTrustedShellArtifact) {
+      const recognized = recognizeTrustedLauncher(head, tokens);
+      if (recognized) {
+        bindNamedOperands(recognized.pins, into);
+        if (recognized.nested) {
+          collectNestedLauncher(recognized.nested, into, trustedRoot, visitedScripts, {
+            visitedShellArtifacts,
+            unmodeledOut: recognized.nested.strict ? unmodeledOut : void 0
+          });
+        }
+        return;
+      }
+      unmodeledOut?.push(segment);
+    } else {
+      for (const token of tokens.slice(1)) {
+        const artifact = operandArtifactPath(token);
+        if (artifact) into.add(artifact);
+      }
+    }
+    return;
+  }
+  const packageInvocation = resolvePackageManagerInvocation(head, tokens);
+  if (packageInvocation?.unresolved) unmodeledOut?.push(segment);
+  const manifests = launcherManifests(head);
+  if (manifests) {
+    const verb = packageInvocation?.verb ?? "";
+    const pinned = packageInvocation ? packageInvocation.unresolved || PACKAGE_SCRIPT_VERBS.has(verb) || head === "yarn" && verb.length > 0 ? manifests.definitions : [] : pinnedManifestFiles(manifests, tokens);
+    const tableScript = packageInvocation ? null : referencedTableScript(head, tokens);
+    for (const manifest of pinned) {
+      const normalized = normalizeAuthorityPath(manifest);
+      if (!normalized) continue;
+      const scriptName2 = normalized === normalizeAuthorityPath(tableScript?.file ?? "") ? tableScript?.name : void 0;
+      into.add(scriptName2 === void 0 ? normalized : scopedPinKey(normalized, head, scriptName2));
+    }
+  }
+  if (!INTERPRETER_HEADS.has(head) && !fromTrustedShellArtifact) {
+    bindNamedOperands(namedConfigOperands(tokens), into);
+    const wrapped = unwrapExecWrapper(head, tokens);
+    if (wrapped) {
+      collectNestedLauncher(wrapped, into, trustedRoot, visitedScripts, {
+        visitedShellArtifacts,
+        unmodeledOut: wrapped.strict ? unmodeledOut : void 0
+      });
+    }
+  }
+  const interpreterArtifact = INTERPRETER_HEADS.has(head) ? collectInterpreterArtifacts(head, tokens, into, () => unmodeledOut?.push(segment)) : null;
+  const directArtifact = operandRepoPath(tokens[0] ?? "");
+  if (directArtifact) into.add(foldArtifactPath(directArtifact));
+  const executableArtifact = interpreterArtifact ?? directArtifact;
+  if (trustedRoot && executableArtifact) {
+    const sidecar = readEntrypointSidecar(trustedRoot, executableArtifact, unmodeledOut);
+    if (sidecar) {
+      into.add(foldArtifactPath(sidecar.path));
+      if (sidecar.packageScripts.length > 0) {
+        for (const manifest of NODE_PACKAGE_MANAGER_MANIFESTS) {
+          const normalized = normalizeAuthorityPath(manifest);
+          if (normalized) into.add(normalized);
+        }
+      }
+    }
+  }
+  const shellArtifact = SHELL_INTERPRETER_HEADS.has(head) ? interpreterArtifact : directArtifact && foldArtifactPath(directArtifact).endsWith(".sh") ? directArtifact : null;
+  if (trustedRoot && shellArtifact && !visitedShellArtifacts.has(shellArtifact)) {
+    try {
+      const contents = readFileSync(path2.join(trustedRoot, shellArtifact), "utf8");
+      visitedShellArtifacts.add(shellArtifact);
+      for (const nested of commandSegments(contents)) {
+        collectSegmentEntrypoints(
+          nested,
+          into,
+          trustedRoot,
+          visitedScripts,
+          visitedShellArtifacts,
+          unmodeledOut,
+          true
+        );
+      }
+    } catch {
+    }
+  }
+  const scriptName = packageInvocation?.scriptName ?? null;
+  if (trustedRoot && scriptName) {
+    const scripts = readPackageScripts(trustedRoot);
+    for (const lifecycleName of [`pre${scriptName}`, scriptName, `post${scriptName}`]) {
+      const script = scripts?.[lifecycleName];
+      if (!script || visitedScripts.has(lifecycleName)) continue;
+      visitedScripts.add(lifecycleName);
+      for (const nested of commandSegments(script)) {
+        collectSegmentEntrypoints(
+          nested,
+          into,
+          trustedRoot,
+          visitedScripts,
+          visitedShellArtifacts,
+          unmodeledOut,
+          false
+        );
+      }
+    }
+  }
+}
+function collectEntrypointPins(commands, trustedRoot) {
+  const raw = /* @__PURE__ */ new Set();
+  for (const command of commands) {
+    for (const segment of commandSegments(command)) {
+      collectSegmentEntrypoints(segment, raw, trustedRoot);
+    }
+  }
+  const paths = /* @__PURE__ */ new Set();
+  const whole = /* @__PURE__ */ new Set();
+  const scoped = /* @__PURE__ */ new Map();
+  for (const key of raw) {
+    const pin = parseScopedPin(key);
+    if (!pin) {
+      paths.add(key);
+      whole.add(key);
+      continue;
+    }
+    paths.add(pin.file);
+    scoped.set(pin.file, [...scoped.get(pin.file) ?? [], { head: pin.head, name: pin.name }]);
+  }
+  return { paths: [...paths].sort(), whole, scoped };
+}
+function referencedPackageScripts(commands, trustedRoot) {
+  const scripts = readPackageScripts(trustedRoot) ?? {};
+  const referenced = /* @__PURE__ */ new Map();
+  const visitedShellArtifacts = /* @__PURE__ */ new Set();
+  const visitName = (name) => {
+    for (const lifecycleName of [`pre${name}`, name, `post${name}`]) {
+      if (referenced.has(lifecycleName)) continue;
+      const value = scripts[lifecycleName];
+      referenced.set(lifecycleName, value);
+      if (value !== void 0) visit(value);
+    }
+  };
+  const visit = (command) => {
+    for (const segment of commandSegments(command)) {
+      const tokens = unwrapEnvironmentLauncher(segment.split(/\s+/).filter(Boolean));
+      const head = headBasename(tokens[0] ?? "");
+      const name = resolvePackageManagerInvocation(head, tokens)?.scriptName;
+      if (name) visitName(name);
+      const wrapped = unwrapExecWrapper(head, tokens);
+      if (wrapped) visit(wrapped.tokens.join(" "));
+      const artifact = INTERPRETER_HEADS.has(head) ? collectInterpreterArtifacts(head, tokens, /* @__PURE__ */ new Set()) : operandRepoPath(tokens[0] ?? "");
+      if (artifact) {
+        const sidecar = readEntrypointSidecar(trustedRoot, artifact);
+        for (const declaredName of sidecar?.packageScripts ?? []) {
+          visitName(declaredName);
+        }
+        const shellArtifact = (SHELL_INTERPRETER_HEADS.has(head) ? artifact : void 0) ?? (foldArtifactPath(artifact).endsWith(".sh") ? artifact : void 0);
+        if (shellArtifact && !visitedShellArtifacts.has(shellArtifact)) {
+          visitedShellArtifacts.add(shellArtifact);
+          try {
+            visit(readFileSync(path2.join(trustedRoot, shellArtifact), "utf8"));
+          } catch {
+          }
+        }
+      }
+    }
+  };
+  for (const command of commands) visit(command);
+  return referenced;
+}
+function lockfileChangeIsVersionOnly(baseRoot, candidateRoot) {
+  try {
+    const basePath = path2.join(baseRoot, LOCKFILE_PATH);
+    const candidatePath = path2.join(candidateRoot, LOCKFILE_PATH);
+    const baseStat = lstatSync(basePath);
+    const candidateStat = lstatSync(candidatePath);
+    if (!baseStat.isFile() || !candidateStat.isFile()) return false;
+    if ((baseStat.mode & 73) !== (candidateStat.mode & 73)) return false;
+    return isVersionOnlyLockfileChange(
+      readFileSync(basePath, "utf8"),
+      readFileSync(candidatePath, "utf8")
+    );
+  } catch {
+    return false;
+  }
+}
+function repoFileEquals(baseRoot, candidateRoot, relativePath) {
+  try {
+    return readFileSync(path2.join(baseRoot, relativePath)).equals(
+      readFileSync(path2.join(candidateRoot, relativePath))
+    );
+  } catch {
+    return false;
+  }
+}
+function unmodeledSegments(commands, trustedRoot) {
+  const unmodeled = [];
+  const paths = /* @__PURE__ */ new Set();
+  for (const command of commands) {
+    for (const segment of commandSegments(command)) {
+      collectSegmentEntrypoints(segment, paths, trustedRoot, /* @__PURE__ */ new Set(), /* @__PURE__ */ new Set(), unmodeled);
+    }
+  }
+  return unmodeled;
+}
+function namedScriptsUnchanged(named, trustedRoot, candidateRoot) {
+  const heads = new Set(named.map((script) => script.head));
+  return [...heads].every(
+    (head) => scriptTableUnchanged(
+      head,
+      named.filter((script) => script.head === head).map((script) => script.name),
+      trustedRoot,
+      candidateRoot
+    )
+  );
+}
+function checkTrustedCommandEntrypoints(input) {
+  const pins = collectEntrypointPins(input.commands, input.trustedRoot);
+  const entrypointPaths = pins.paths;
+  const unmodeled = unmodeledSegments(input.commands, input.trustedRoot);
+  const approved = input.candidateSha !== void 0 && input.approvedCandidateSha?.toLowerCase() === input.candidateSha.toLowerCase();
+  if (entrypointPaths.length === 0) {
+    if (unmodeled.length === 0) return { entrypointPaths };
+    return approved ? { entrypointPaths, approvedBy: "BUILD_LOCAL_CI_APPROVE_ENTRYPOINT_SHA" } : {
+      entrypointPaths,
+      blockedReason: `trusted verification launcher is not modeled: ${unmodeled[0]}`
+    };
+  }
+  if (!input.changedFilesComplete) {
+    return {
+      entrypointPaths,
+      blockedReason: "candidate change set is incomplete, so no entrypoint can be cleared"
+    };
+  }
+  const redefined = [];
+  const unnormalized = [];
+  const trackedPaths = /* @__PURE__ */ new Map();
+  for (const filePath of input.changedFiles) {
+    const folded = normalizeAuthorityPath(filePath);
+    if (folded === null) {
+      unnormalized.push(filePath);
+      continue;
+    }
+    const spellings = trackedPaths.get(folded) ?? [];
+    if (!spellings.includes(filePath)) trackedPaths.set(folded, [...spellings, filePath]);
+    if (entrypointPaths.includes(folded) && !redefined.includes(folded)) {
+      if (folded === "package.json" && input.trustedRoot && input.candidateRoot) {
+        const baseScripts = referencedPackageScripts(input.commands, input.trustedRoot);
+        const candidateScripts = readPackageScripts(input.candidateRoot) ?? {};
+        const changedDefinition = [...baseScripts].some(
+          ([name, value]) => candidateScripts[name] !== value
+        );
+        if (!changedDefinition) continue;
+      } else if (input.trustedRoot && input.candidateRoot && !pins.whole.has(folded) && namedScriptsUnchanged(pins.scoped.get(folded) ?? [], input.trustedRoot, input.candidateRoot)) {
+        continue;
+      } else if (folded === LOCKFILE_PATH && input.trustedRoot && input.candidateRoot && lockfileChangeIsVersionOnly(input.trustedRoot, input.candidateRoot)) {
+        continue;
+      } else if (input.trustedRoot && input.candidateRoot && repoFileEquals(input.trustedRoot, input.candidateRoot, folded)) {
+        continue;
+      }
+      redefined.push(folded);
+    }
+  }
+  if (redefined.length > 0 || unmodeled.length > 0) {
+    const fingerprint = redefined.length > 0 && unmodeled.length === 0 && unnormalized.length === 0 && input.trustedRoot && input.candidateRoot ? computeEntrypointFingerprint({
+      commands: input.commands,
+      pins,
+      redefined,
+      trustedRoot: input.trustedRoot,
+      candidateRoot: input.candidateRoot,
+      trackedPaths,
+      ...redefined.includes("package.json") ? {
+        packageScripts: {
+          // Reachable in either tree, so a script the candidate newly
+          // points the gate at is bound with its values.
+          names: [
+            .../* @__PURE__ */ new Set([
+              ...referencedPackageScripts(input.commands, input.trustedRoot).keys(),
+              ...referencedPackageScripts(input.commands, input.candidateRoot).keys()
+            ])
+          ],
+          base: readPackageScripts(input.trustedRoot) ?? {},
+          candidate: readPackageScripts(input.candidateRoot) ?? {}
+        }
+      } : {}
+    }) : void 0;
+    const withFingerprint = fingerprint === void 0 ? {} : { entrypointFingerprint: fingerprint };
+    if (approved) {
+      return {
+        entrypointPaths,
+        approvedBy: "BUILD_LOCAL_CI_APPROVE_ENTRYPOINT_SHA",
+        ...withFingerprint
+      };
+    }
+    if (fingerprint !== void 0 && fingerprint === input.approvedFingerprint) {
+      return { entrypointPaths, approvedBy: "entrypoint-fingerprint", ...withFingerprint };
+    }
+    if (unmodeled.length > 0) {
+      return {
+        entrypointPaths,
+        blockedReason: `trusted verification launcher is not modeled: ${unmodeled[0]}`
+      };
+    }
+    const named = redefined.slice(0, MAX_REPORTED_PATHS).join(", ");
+    const extra = redefined.length - MAX_REPORTED_PATHS;
+    const more = extra > 0 ? ` (+${extra} more)` : "";
+    return {
+      entrypointPaths,
+      blockedReason: `candidate changes redefine ${named}${more}`,
+      ...withFingerprint
+    };
+  }
+  if (unnormalized.length > 0) {
+    return {
+      entrypointPaths,
+      blockedReason: `candidate change path cannot be compared: ${unnormalized[0]}`
+    };
+  }
+  return { entrypointPaths };
+}
+
+// src/core/ci/local-ci-plan.ts
+function stepId(phase, index) {
+  return `${phase}-${index + 1}`;
+}
+function buildLocalCiVerificationPlan(input) {
+  const setupCommands = (input.setupCommands ?? []).map((command) => command.trim()).filter(Boolean);
+  const verifyCommands = input.verifyCommands.map((command) => command.trim()).filter(Boolean);
+  const steps = [];
+  for (let index = 0; index < setupCommands.length; index += 1) {
+    steps.push({
+      id: stepId("setup", index),
+      phase: "setup",
+      command: setupCommands[index],
+      ...input.timeoutMs !== void 0 ? { timeoutMs: input.timeoutMs } : {}
+    });
+  }
+  for (let index = 0; index < verifyCommands.length; index += 1) {
+    steps.push({
+      id: stepId("verify", index),
+      phase: "verify",
+      command: verifyCommands[index],
+      ...input.timeoutMs !== void 0 ? { timeoutMs: input.timeoutMs } : {}
+    });
+  }
+  const allCommands = steps.map((step) => step.command);
+  const authority = input.authority ?? resolveProjectVerificationAuthority(allCommands, {
+    projectRoot: input.projectRoot,
+    additionalAuthorityPaths: input.additionalAuthorityPaths,
+    authorityPathsComplete: input.authorityPathsComplete
+  });
+  return { steps, authority };
+}
+function verificationPlanCommands(plan) {
+  return plan.steps.map((step) => step.command);
+}
+
+// src/core/ci/local-ci-trust.ts
+function resolveApprovedEntrypointSha(trust) {
+  return trust ? trust.approvedEntrypointSha : readEnv(BUILD_LOCAL_CI_APPROVE_ENTRYPOINT_SHA).value;
+}
+async function resolveHaltOverride(trust) {
+  if (trust) return await trust.claimHaltOverride?.() === true;
+  return readEnv(BUILD_LOCAL_CI_OVERRIDE_HALT).value === true;
+}
+function withApprovedEntrypointEnv(env) {
+  const approved = readEnv(BUILD_LOCAL_CI_APPROVE_ENTRYPOINT_SHA).value;
+  if (/^[a-f0-9]{40}$/i.test(approved ?? "")) env.BUILD_LOCAL_CI_APPROVE_ENTRYPOINT_SHA = approved;
+  return env;
+}
+
+// src/core/ci/local-ci-authority.ts
+async function ensureTrustedCommit(repoRoot, remote, baseRef, baseSha) {
+  let present = await execGit(["cat-file", "-e", `${baseSha}^{commit}`], { cwd: repoRoot });
+  if (present.exitCode === 0) return;
+  const fetched = await execGit(["fetch", "--quiet", remote, baseRef], { cwd: repoRoot });
+  if (fetched.exitCode !== 0) {
+    throw new Error(
+      `Unable to fetch trusted base '${baseRef}': ${fetched.stderr || fetched.stdout}`
+    );
+  }
+  present = await execGit(["cat-file", "-e", `${baseSha}^{commit}`], { cwd: repoRoot });
+  if (present.exitCode !== 0) {
+    throw new Error(`Trusted base commit ${baseSha} is unavailable after fetch.`);
+  }
+}
+async function admitTrustedBaseRef(baseRef, defaultBranch) {
+  if (baseRef === defaultBranch) return;
+  throw new Error(
+    `Pull request base '${baseRef}' is not the repository default branch '${defaultBranch}'; refusing to publish a SHA-scoped attestation for a different base policy.`
+  );
+}
+var InvalidGitDiffPathEncodingError = class extends Error {
+  invalidPathBytes;
+  constructor(invalidPathBytes) {
+    super("Changed path is not valid UTF-8; exact Git path identity required.");
+    this.name = "InvalidGitDiffPathEncodingError";
+    this.invalidPathBytes = invalidPathBytes;
+  }
+};
+function parseNulDelimitedDiffPathsStrictUtf8(stdout) {
+  if (stdout.length === 0) return [];
+  const parts = [];
+  let start = 0;
+  for (let i = 0; i < stdout.length; i++) {
+    if (stdout[i] === 0) {
+      parts.push(stdout.subarray(start, i));
+      start = i + 1;
+    }
+  }
+  if (start < stdout.length) {
+    parts.push(stdout.subarray(start));
+  }
+  if (parts.length > 0 && parts[parts.length - 1].length === 0) {
+    parts.pop();
+  }
+  const decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+  const paths = [];
+  for (const part of parts) {
+    if (part.length === 0) continue;
+    try {
+      paths.push(decoder.decode(part));
+    } catch {
+      throw new InvalidGitDiffPathEncodingError(Buffer.from(part));
+    }
+  }
+  return paths;
+}
+async function diffFiles(repoRoot, baseSha, headSha) {
+  const result = await execGit(
+    ["diff", "--name-only", "--no-renames", "-z", `${baseSha}...${headSha}`],
+    {
+      cwd: repoRoot,
+      encoding: "buffer"
+    }
+  );
+  if (result.exitCode !== 0) {
+    const detail = result.stderr.toString("utf8") || result.stdout.toString("utf8");
+    throw new Error(`Unable to compare trusted base and candidate: ${detail}`);
+  }
+  return parseNulDelimitedDiffPathsStrictUtf8(result.stdout);
+}
+async function diffChangeSet(repoRoot, baseSha, headSha) {
+  const result = await execGit(
+    ["diff", "--raw", "--no-abbrev", "--no-renames", "-z", `${baseSha}...${headSha}`],
+    {
+      cwd: repoRoot,
+      encoding: "buffer"
+    }
+  );
+  if (result.exitCode !== 0) {
+    const detail = result.stderr.toString("utf8") || result.stdout.toString("utf8");
+    return {
+      complete: false,
+      reason: `Unable to read raw change-set metadata: ${detail}`,
+      entries: []
+    };
+  }
+  return parseGitRawDiffChangeSet(result.stdout);
+}
+function emptyAuthority(reasons = []) {
+  return { paths: [], complete: false, reasons };
+}
+function emptyChangeSet(reason) {
+  return { complete: false, reason, entries: [] };
+}
+function fallbackDecision(candidateWorktree, reason, changedFiles = []) {
+  const commands = resolveLocalCiFallbackCommands(candidateWorktree, changedFiles);
+  const verificationAuthority = emptyAuthority([`Trusted-base policy unavailable: ${reason}`]);
+  const verificationPlan = buildLocalCiVerificationPlan({
+    setupCommands: [],
+    verifyCommands: commands,
+    authority: verificationAuthority,
+    projectRoot: candidateWorktree
+  });
+  return {
+    enabled: true,
+    commands: verificationPlanCommands(verificationPlan),
+    setupCommands: [],
+    setupUnavailable: [],
+    verifyCommands: commands,
+    authorityPaths: [],
+    authorityPathsComplete: false,
+    validationProfiles: [],
+    statusContext: DEFAULT_LOCAL_CI_STATUS_CONTEXT,
+    maxConcurrent: DEFAULT_LOCAL_CI_MAX_CONCURRENT,
+    trusted: false,
+    changedFiles,
+    verificationAuthority,
+    verificationPlan,
+    // Untrusted decisions never publish success; keep the block explicit anyway so
+    // no publication path can read an absent check as a cleared one.
+    commandEntrypoint: {
+      entrypointPaths: [],
+      blockedReason: `trusted-base policy unavailable: ${reason}`
+    },
+    validationProfile: LOCAL_CI_FULL_VALIDATION_PROFILE,
+    validationProfileReason: boundLocalCiValidationProfileReason(
+      `Trusted-base policy unavailable: ${reason}`
+    )
+  };
+}
+function buildTrustedDecision(input) {
+  const trustedConfig = resolveLocalCiConfig(input.baseWorktree, input.changedFiles);
+  const verificationAuthority = resolveProjectVerificationAuthority(trustedConfig.commands, {
+    projectRoot: input.baseWorktree,
+    additionalAuthorityPaths: trustedConfig.authorityPaths,
+    authorityPathsComplete: trustedConfig.authorityPathsComplete
+  });
+  const verificationPlan = buildLocalCiVerificationPlan({
+    setupCommands: trustedConfig.setupCommands,
+    verifyCommands: trustedConfig.verifyCommands,
+    authority: verificationAuthority,
+    projectRoot: input.baseWorktree,
+    additionalAuthorityPaths: trustedConfig.authorityPaths,
+    authorityPathsComplete: trustedConfig.authorityPathsComplete
+  });
+  const commandEntrypoint = checkTrustedCommandEntrypoints({
+    commands: verificationPlanCommands(verificationPlan),
+    changedFiles: input.changedFiles,
+    changedFilesComplete: input.changedFilesComplete,
+    trustedRoot: input.baseWorktree,
+    candidateRoot: input.candidateWorktree,
+    candidateSha: input.candidateSha,
+    approvedCandidateSha: input.approvedEntrypointSha,
+    approvedFingerprint: input.approvedEntrypointFingerprint
+  });
+  const profileSelection = selectLocalCiValidationProfile({
+    trusted: true,
+    verificationAuthority,
+    changedFiles: input.changedFiles,
+    changeSet: input.changeSet,
+    profiles: trustedConfig.validationProfiles
+  });
+  return {
+    ...trustedConfig,
+    // Prefer plan ordering while remaining backward compatible with flat commands.
+    commands: verificationPlanCommands(verificationPlan),
+    trusted: true,
+    trustedBaseRef: input.trustedBaseRef,
+    trustedBaseSha: input.trustedBaseSha,
+    pullRequest: input.pullRequest,
+    changedFiles: input.changedFiles,
+    verificationAuthority,
+    verificationPlan,
+    commandEntrypoint,
+    validationProfile: profileSelection.validationProfile,
+    validationProfileReason: profileSelection.reason
+  };
+}
+async function resolveLocalCiAuthority(record, candidateWorktree, repoRoot, dependencyOverrides = {}, trust) {
+  const approvedEntrypointSha = resolveApprovedEntrypointSha(trust);
+  const approvedEntrypointFingerprint = trust?.approvedEntrypointFingerprint;
+  const deps = {
+    findPullRequest: findGitHubPullRequest,
+    waitForPrSync: () => delay3(2e3),
+    resolveDefaultBranch: resolveGitHubDefaultBranch,
+    resolveBranchSha: resolveGitHubBranchSha,
+    createWorktree: createLocalCiWorktree,
+    removeWorktree: removeLocalCiWorktree,
+    ensureTrustedCommit,
+    diffFiles,
+    diffChangeSet,
+    ...dependencyOverrides
+  };
+  let baseWorktree;
+  let changedFilesForFallback = [];
+  try {
+    const defaultBranch = await deps.resolveDefaultBranch(record.repository);
+    let pullRequest = await deps.findPullRequest({
+      repository: record.repository,
+      branch: record.branch,
+      base: defaultBranch,
+      attempts: 1
+    });
+    for (let attempt = 1; pullRequest && pullRequest.headSha.toLowerCase() !== record.sha.toLowerCase(); attempt++) {
+      if (attempt === 6) {
+        throw new Error(
+          `PR head synchronization pending: expected ${record.sha.slice(0, 12)}, observed ${pullRequest.headSha.slice(0, 12)} after 6 reads; finish pushing, then run build ci reconcile.`
+        );
+      }
+      await deps.waitForPrSync();
+      const refreshed = await deps.findPullRequest({
+        repository: record.repository,
+        branch: record.branch,
+        number: pullRequest.number,
+        base: defaultBranch,
+        attempts: 1
+      });
+      if (refreshed) pullRequest = refreshed;
+    }
+    const trustedBaseRef = pullRequest?.baseRefName ?? defaultBranch;
+    await admitTrustedBaseRef(trustedBaseRef, defaultBranch);
+    const trustedBaseSha = pullRequest?.baseSha ?? await deps.resolveBranchSha({ repository: record.repository, branch: trustedBaseRef });
+    await deps.ensureTrustedCommit(repoRoot, record.remote, trustedBaseRef, trustedBaseSha);
+    const pullRequestVisibility = pullRequest ? {
+      number: pullRequest.number,
+      headSha: pullRequest.headSha,
+      baseRefName: pullRequest.baseRefName,
+      baseSha: pullRequest.baseSha,
+      draft: pullRequest.draft
+    } : void 0;
+    let changedFiles;
+    try {
+      changedFiles = await deps.diffFiles(repoRoot, trustedBaseSha, record.sha);
+    } catch (error) {
+      if (error instanceof InvalidGitDiffPathEncodingError) {
+        baseWorktree = await deps.createWorktree(repoRoot, trustedBaseSha);
+        return buildTrustedDecision({
+          baseWorktree,
+          candidateWorktree,
+          candidateSha: record.sha,
+          changedFiles: [],
+          // Undecodable path bytes drop the whole name-only set, so no trusted
+          // command entrypoint can be cleared from it.
+          changedFilesComplete: false,
+          changeSet: emptyChangeSet(
+            "Changed path is not valid UTF-8; exact Git path identity required."
+          ),
+          trustedBaseRef,
+          trustedBaseSha,
+          pullRequest: pullRequestVisibility,
+          approvedEntrypointSha,
+          approvedEntrypointFingerprint
+        });
+      }
+      throw error;
+    }
+    changedFilesForFallback = changedFiles;
+    let changeSet;
+    try {
+      changeSet = await deps.diffChangeSet(repoRoot, trustedBaseSha, record.sha);
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      changeSet = emptyChangeSet(`Raw change-set metadata unavailable: ${detail}`);
+    }
+    baseWorktree = await deps.createWorktree(repoRoot, trustedBaseSha);
+    return buildTrustedDecision({
+      baseWorktree,
+      candidateWorktree,
+      candidateSha: record.sha,
+      changedFiles,
+      changedFilesComplete: true,
+      changeSet,
+      trustedBaseRef,
+      trustedBaseSha,
+      pullRequest: pullRequestVisibility,
+      approvedEntrypointSha,
+      approvedEntrypointFingerprint
+    });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return fallbackDecision(candidateWorktree, reason, changedFilesForFallback);
+  } finally {
+    if (baseWorktree) {
+      await deps.removeWorktree(repoRoot, baseWorktree).catch(() => void 0);
+    }
+  }
+}
+async function resolveEntrypointFingerprint(input) {
+  const worktrees = [];
+  try {
+    await ensureTrustedCommit(input.repoRoot, input.remote, input.baseRef, input.baseSha);
+    const changedFiles = await diffFiles(input.repoRoot, input.baseSha, input.headSha);
+    const baseWorktree = await createLocalCiWorktree(input.repoRoot, input.baseSha);
+    worktrees.push(baseWorktree);
+    const candidateWorktree = await createLocalCiWorktree(input.repoRoot, input.headSha);
+    worktrees.push(candidateWorktree);
+    return buildTrustedDecision({
+      baseWorktree,
+      candidateWorktree,
+      candidateSha: input.headSha,
+      changedFiles,
+      changedFilesComplete: true,
+      changeSet: emptyChangeSet("Raw change-set metadata is not needed for a fingerprint."),
+      trustedBaseRef: input.baseRef,
+      trustedBaseSha: input.baseSha
+    }).commandEntrypoint.entrypointFingerprint;
+  } catch {
+    return void 0;
+  } finally {
+    for (const worktree of worktrees) {
+      await removeLocalCiWorktree(input.repoRoot, worktree).catch(() => void 0);
+    }
+  }
+}
+
+// src/core/ci/merge-queue-approval-hold.ts
+var EntrypointApprovalRequired = class extends Error {
+  constructor(record) {
+    super("Local CI verification entrypoint requires exact-head approval.");
+    this.record = record;
+  }
+  record;
+};
+var FALLBACK_REASON = "trusted verification entrypoint changed";
+function blockedReason(record) {
+  return /entrypoint: (.+?)\. Review the change/s.exec(record.error ?? "")?.[1] ?? FALLBACK_REASON;
+}
+function approvalFor(request, headSha) {
+  return request.trustGrants?.find(
+    (grant) => grant.kind === "entrypoint-approval" && grant.sourceRequestId === request.id && grant.scope.headSha === headSha
+  );
+}
+function dispositionPatch(current, error, now) {
+  const detail = error instanceof Error ? error.message : String(error);
+  if (current.status !== "queued" && current.status !== "running") return { lastError: detail };
+  if (error instanceof EntrypointApprovalRequired) {
+    const approval = approvalFor(current, error.record.sha);
+    const ranUnderApproval = approval && Date.parse(approval.grantedAt) <= Date.parse(error.record.updatedAt);
+    if (!ranUnderApproval) {
+      return {
+        status: "awaiting_approval",
+        entrypointHold: {
+          headSha: error.record.sha,
+          reason: blockedReason(error.record),
+          ...error.record.entrypointFingerprint ? { fingerprint: error.record.entrypointFingerprint } : {},
+          heldAt: now.toISOString()
+        },
+        lastError: void 0
+      };
+    }
+  }
+  return { status: "needs_attention", lastError: detail };
+}
+function releaseHold(request, now) {
+  if (request.status !== "awaiting_approval" || !request.entrypointHold) return {};
+  return {
+    status: "queued",
+    workerToken: void 0,
+    lastError: void 0,
+    entrypointHold: { ...request.entrypointHold, releasedAt: now.toISOString() }
+  };
+}
+function releaseIfApproved(request, now) {
+  return approvalFor(request, request.entrypointHold?.headSha) ? releaseHold(request, now) : {};
+}
+function approvalCommand(request) {
+  return `build ci merge ${request.prNumber} --sha ${request.reviewedSha} --approve-entrypoint ${request.entrypointHold?.headSha ?? request.acceptedHeadSha}`;
+}
+async function resumeApprovedHolds(store, repository, deps, now = /* @__PURE__ */ new Date()) {
+  const released = [];
+  for (const request of await store.list(repository)) {
+    const hold = request.entrypointHold;
+    if (request.status !== "awaiting_approval" || !hold) continue;
+    const pr = await deps.readPullRequest(request).catch(() => void 0);
+    if (pr?.state !== "open" || pr.headSha !== request.acceptedHeadSha) continue;
+    if (!approvalFor(request, hold.headSha)) {
+      const run = await deps.inspectValidation(request).catch(() => void 0);
+      const green = run?.status === "succeeded" && !run.entrypointApprovalPending && run.sha === hold.headSha && request.acceptedHeadSha === hold.headSha;
+      if (!green) continue;
+    }
+    const result = await store.releaseApprovalHold(repository, request.id, request.version, now);
+    if (result) released.push(result);
+  }
+  return released;
+}
+
+// src/core/ci/landing-log.ts
+import { appendFile, mkdir as mkdir2, rename as rename2, stat as stat2 } from "fs/promises";
+import { hostname } from "os";
+import path3 from "path";
+
+// src/core/ci/local-ci-gate-evidence.ts
+var EVIDENCE_MARKER = "[release:gate] result-json=";
+var MAX_SCAN_CHARS = 2e5;
+var MAX_LABEL_LENGTH = 120;
+var MAX_DESCRIPTION_LENGTH = 140;
+function stringArray(value) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || item.length === 0)) {
+    return void 0;
+  }
+  return [...value];
+}
+function parseGateEvidence(output) {
+  const evidence = parseGateResultJson(output);
+  if (evidence === void 0) return void 0;
+  return readGateEvidence(evidence);
+}
+function parseGateResultJson(output) {
+  if (output.length === 0) return void 0;
+  const scanned = output.length > MAX_SCAN_CHARS ? output.slice(-MAX_SCAN_CHARS) : output;
+  const markerIndex = scanned.lastIndexOf(EVIDENCE_MARKER);
+  if (markerIndex === -1) return void 0;
+  const jsonStart = markerIndex + EVIDENCE_MARKER.length;
+  const lineEnd = scanned.indexOf("\n", jsonStart);
+  const rawJson = (lineEnd === -1 ? scanned.slice(jsonStart) : scanned.slice(jsonStart, lineEnd)).trim();
+  if (rawJson.length === 0) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(rawJson);
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+  return parsed;
+}
+function readGateEvidence(evidence) {
+  const result = {};
+  if (typeof evidence.outcome === "string" && evidence.outcome.length > 0) {
+    result.outcome = evidence.outcome.slice(0, MAX_LABEL_LENGTH);
+  }
+  const canonical = evidence.canonicalFailure;
+  if (typeof canonical === "object" && canonical !== null) {
+    const record = canonical;
+    if (typeof record.label === "string" && record.label.length > 0) {
+      result.canonicalFailureLabel = record.label.slice(0, MAX_LABEL_LENGTH);
+    }
+    if (typeof record.reason === "string" && record.reason.length > 0) {
+      result.canonicalFailureReason = record.reason.slice(0, MAX_LABEL_LENGTH);
+    }
+  }
+  const planned = evidence.planned;
+  if (typeof planned === "object" && planned !== null) {
+    const plannedRecord = planned;
+    const count = plannedRecord.count;
+    if (typeof count === "number" && Number.isFinite(count)) result.plannedCount = count;
+    const labels = stringArray(plannedRecord.labels);
+    if (labels !== void 0) result.plannedLabels = labels;
+  }
+  const executed = evidence.executed;
+  if (typeof executed === "object" && executed !== null) {
+    const count = executed.count;
+    if (typeof count === "number" && Number.isFinite(count)) result.executedCount = count;
+  }
+  const manifest = evidence.manifest;
+  if (typeof manifest === "object" && manifest !== null) {
+    const digest = manifest.digest;
+    if (typeof digest === "string" && /^[a-f0-9]{64}$/.test(digest)) {
+      result.manifestDigest = digest;
+    }
+  }
+  const steps = evidence.steps;
+  if (Array.isArray(steps)) {
+    const passedLabels = [];
+    const failedLabels = [];
+    let valid = true;
+    for (const step of steps) {
+      if (typeof step !== "object" || step === null) {
+        valid = false;
+        break;
+      }
+      const stepRecord = step;
+      if (typeof stepRecord.label !== "string" || stepRecord.label.length === 0 || stepRecord.outcome !== "ok" && stepRecord.outcome !== "fail") {
+        valid = false;
+        break;
+      }
+      (stepRecord.outcome === "ok" ? passedLabels : failedLabels).push(stepRecord.label);
+    }
+    if (valid) {
+      result.passedLabels = passedLabels;
+      result.failedLabels = failedLabels;
+    }
+  }
+  const notRun = evidence.notRun;
+  if (typeof notRun === "object" && notRun !== null) {
+    const labels = stringArray(notRun.labels);
+    if (labels !== void 0) result.notRunLabels = labels;
+  }
+  const retry = evidence.retry;
+  if (typeof retry === "object" && retry !== null) {
+    const retryRecord = retry;
+    if (typeof retryRecord.applied === "boolean") result.retryApplied = retryRecord.applied;
+    if (typeof retryRecord.sourceManifestDigest === "string" && /^[a-f0-9]{64}$/.test(retryRecord.sourceManifestDigest)) {
+      result.retrySourceManifestDigest = retryRecord.sourceManifestDigest;
+    }
+    const reusedLabels = stringArray(retryRecord.reusedLabels);
+    if (reusedLabels !== void 0) result.retryReusedLabels = reusedLabels;
+    const rerunLabels = stringArray(retryRecord.rerunLabels);
+    if (rerunLabels !== void 0) result.retryRerunLabels = rerunLabels;
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+function describeGateFailure(evidence) {
+  if (evidence?.canonicalFailureLabel === void 0) return void 0;
+  const reason = evidence.canonicalFailureReason ? ` (${evidence.canonicalFailureReason})` : "";
+  const message2 = `Local validation failed: ${evidence.canonicalFailureLabel}${reason}`;
+  return message2.length <= MAX_DESCRIPTION_LENGTH ? message2 : `${message2.slice(0, MAX_DESCRIPTION_LENGTH - 1)}\u2026`;
+}
+function describeUnavailableDependencySetup(unavailable) {
+  if (!unavailable || unavailable.length === 0) return "";
+  const entries = unavailable.map((entry) => `${entry.language} (${entry.manifest}): ${entry.reason}`).join("; ");
+  return ` Dependency setup unavailable: ${entries}.`;
+}
+
+// src/core/ci/landing-log.ts
+var LANDING_LOG_FILE = "landing-log.jsonl";
+var MAX_LANDING_LOG_BYTES = 8 * 1024 * 1024;
+var MAX_ERROR_LENGTH = 300;
+function landingLogPath(stateRoot) {
+  return path3.join(stateRoot, LANDING_LOG_FILE);
+}
+function bounded(value) {
+  if (value === void 0) return void 0;
+  return value.length > MAX_ERROR_LENGTH ? `${value.slice(0, MAX_ERROR_LENGTH)}...` : value;
+}
+function compact(entry) {
+  return Object.fromEntries(Object.entries(entry).filter(([, value]) => value !== void 0));
+}
+async function isFull(file, maxBytes) {
+  try {
+    return (await stat2(file)).size >= maxBytes;
+  } catch {
+    return false;
+  }
+}
+async function rotateIfFull(file, maxBytes) {
+  if (!await isFull(file, maxBytes)) return;
+  const release = await acquireFencedFileLock(`${file}.rotate`, {
+    stale: 1e4,
+    retries: { retries: 20, minTimeout: 25, maxTimeout: 100 },
+    description: "Landing log rotation"
+  });
+  try {
+    if (await isFull(file, maxBytes)) await rename2(file, `${file}.1`);
+  } finally {
+    await release();
+  }
+}
+async function appendLandingLogEntry(stateRoot, kind, fields, options = {}) {
+  try {
+    const file = landingLogPath(stateRoot);
+    const now = options.now ?? /* @__PURE__ */ new Date();
+    await mkdir2(stateRoot, { recursive: true, mode: 448 });
+    await rotateIfFull(file, options.maxBytes ?? MAX_LANDING_LOG_BYTES);
+    const line = JSON.stringify(
+      compact({ v: 1, ts: now.toISOString(), kind, host: hostname(), stateRoot, ...fields })
+    );
+    await appendFile(file, `${line}
+`, { encoding: "utf8", mode: 384 });
+  } catch {
+  }
+}
+function gateLandingFields(record) {
+  const commands = record.commands ?? [];
+  let gate;
+  for (const command of [...commands].reverse()) {
+    const parsed = command.output ? parseGateResultJson(command.output) : void 0;
+    if (parsed) {
+      const steps = Array.isArray(parsed.steps) ? parsed.steps.flatMap((step) => {
+        if (typeof step !== "object" || step === null) return [];
+        const { label, outcome, durationMs } = step;
+        return typeof label === "string" ? [{ label, outcome, durationMs }] : [];
+      }) : void 0;
+      gate = compact({
+        outcome: parsed.outcome,
+        wallMs: parsed.wallMs,
+        concurrency: parsed.concurrency,
+        changedTests: parsed.changedTests,
+        steps
+      });
+      break;
+    }
+  }
+  return compact({
+    repository: record.repository,
+    sha: record.sha,
+    branch: record.branch,
+    pr: record.pullRequestNumber,
+    status: record.status,
+    error: bounded(record.error),
+    trustedBaseSha: record.trustedBaseSha,
+    validationProfile: record.validationProfile,
+    submittedAt: record.submittedAt ?? record.createdAt,
+    startedAt: record.startedAt,
+    queueWaitMs: record.queueWaitMs,
+    retryOfSha: record.retryOfSha,
+    gateRetryApplied: record.gateRetry?.applied,
+    entrypointApprovalPending: record.entrypointApprovalPending,
+    failingTestCount: record.failingTests?.length,
+    commands: commands.map(
+      (command) => compact({ id: command.id, exitCode: command.exitCode, durationMs: command.durationMs })
+    ),
+    gate
+  });
+}
+function queueLandingFields(request) {
+  const created = Date.parse(request.createdAt);
+  const updated2 = Date.parse(request.updatedAt);
+  return compact({
+    repository: request.repository,
+    requestId: request.id,
+    pr: request.prNumber,
+    reviewedSha: request.reviewedSha,
+    acceptedHeadSha: request.acceptedHeadSha,
+    status: request.status,
+    error: bounded(request.lastError),
+    preparationCount: request.preparationCount,
+    recoveryCount: request.recoveryCount,
+    mergeCommit: request.mergeCommit,
+    batchMemberCount: request.batchMembers?.length,
+    batchedIntoPr: request.batchedInto?.prNumber,
+    batchAttempted: request.batchAttempted,
+    createdAt: request.createdAt,
+    durationMs: Number.isFinite(created) && Number.isFinite(updated2) ? updated2 - created : void 0
+  });
+}
+
+// src/core/ci/local-ci-coordinator.ts
+import { spawn } from "child_process";
+import { closeSync, openSync } from "fs";
+import path4 from "path";
+import { setTimeout as delay4 } from "timers/promises";
+import { z as z3 } from "zod";
+
+// src/core/ci/local-ci-base-binding-recheck.ts
+async function selectBaseBindingRechecks(records, repository, github) {
+  const rechecks = /* @__PURE__ */ new Map();
+  const candidates = records.filter(
+    (record) => record.status === "succeeded" && record.trustedBaseRef !== void 0 && record.pullRequestNumber !== void 0 && !hasOutstandingRemoteStatusPublication(record)
+  );
+  if (candidates.length === 0) return rechecks;
+  let open;
+  try {
+    open = await github.listOpenPullRequests(repository);
+  } catch {
+    return rechecks;
+  }
+  const mayBeTruncated = open.size >= OPEN_PULL_REQUEST_LIST_LIMIT;
+  for (const record of candidates) {
+    const number = record.pullRequestNumber;
+    if (!number) continue;
+    const pullRequest = open.get(number) ?? (mayBeTruncated ? await github.findPullRequest({
+      repository: record.repository,
+      branch: record.branch,
+      number,
+      attempts: 1
+    }).catch(() => null) : null);
+    if (pullRequest) rechecks.set(record.sha, pullRequest);
+  }
+  return rechecks;
+}
+
+// src/core/ci/local-ci-execution.ts
+import { appendFileSync, statSync } from "fs";
+
+// src/core/ci/local-ci-executed-tree.ts
+var EXECUTED_TREE_GIT_TIMEOUT_MS = 15e3;
+async function resolveExecutedTree(input) {
+  try {
+    const result = await execGit(["rev-parse", "--verify", `${input.candidateSha}^{tree}`], {
+      cwd: input.repoRoot,
+      timeoutMs: EXECUTED_TREE_GIT_TIMEOUT_MS
+    });
+    if (result.exitCode !== 0) return void 0;
+    const tree = result.stdout.trim().split(/\r?\n/, 1)[0]?.trim();
+    return tree !== void 0 && /^[0-9a-f]{40,64}$/.test(tree) ? tree : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function worktreeMatchesExecutedTree(input) {
+  const headTree = await resolveExecutedTree({
+    repoRoot: input.worktreePath,
+    candidateSha: "HEAD"
+  });
+  if (headTree === void 0 || headTree !== input.executedTree) {
+    return false;
+  }
+  try {
+    await execGit(["update-index", "-q", "--refresh"], {
+      cwd: input.worktreePath,
+      timeoutMs: EXECUTED_TREE_GIT_TIMEOUT_MS
+    });
+    const diff = await execGit(["diff-index", "--quiet", "HEAD", "--"], {
+      cwd: input.worktreePath,
+      timeoutMs: EXECUTED_TREE_GIT_TIMEOUT_MS
+    });
+    return diff.exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+
+// src/core/ci/local-ci-gate-retry.ts
+function sameOrderedValues(left, right) {
+  return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function unique(values) {
+  return new Set(values).size === values.length;
+}
+function resolveGateRetryPlan(input) {
+  const { current, source } = input;
+  if (current.retryOfSha === void 0 || current.retryOfSha !== source.sha || current.sha !== source.sha || source.status !== "failed" || source.retryOfSha !== void 0 || source.repository !== current.repository || source.branch !== current.branch || source.trustedBaseSha?.toLowerCase() !== input.trustedBaseSha.toLowerCase() || (source.validationProfile ?? "full") !== input.validationProfile) {
+    return void 0;
+  }
+  const failedCommandIndex = source.commands.findIndex((command) => command.exitCode !== 0);
+  if (failedCommandIndex < 0 || source.commands.some(
+    (command, index) => index > failedCommandIndex || index < failedCommandIndex && command.exitCode !== 0
+  )) {
+    return void 0;
+  }
+  const currentStep = input.steps[failedCommandIndex];
+  const failedCommand = source.commands[failedCommandIndex];
+  if (currentStep === void 0 || failedCommand === void 0 || currentStep.command !== failedCommand.command || source.commands.slice(0, failedCommandIndex).some((command, index) => command.command !== input.steps[index]?.command)) {
+    return void 0;
+  }
+  const evidence = parseGateEvidence(failedCommand.output);
+  const planned = evidence?.plannedLabels;
+  const passed = evidence?.passedLabels;
+  const failed = evidence?.failedLabels;
+  const notRun = evidence?.notRunLabels;
+  if (evidence?.outcome !== "fail" || evidence.manifestDigest === void 0 || planned === void 0 || passed === void 0 || failed === void 0 || notRun === void 0 || planned.length === 0 || passed.length === 0 || failed.length === 0 || !unique(planned) || !unique(passed) || !unique(failed) || !unique(notRun)) {
+    return void 0;
+  }
+  const passedSet = new Set(passed);
+  const failedSet = new Set(failed);
+  const notRunSet = new Set(notRun);
+  const partitionIsExact = planned.every((label) => {
+    const memberships = Number(passedSet.has(label)) + Number(failedSet.has(label)) + Number(notRunSet.has(label));
+    return memberships === 1;
+  });
+  const noUnknownLabels = [...passed, ...failed, ...notRun].every(
+    (label) => planned.includes(label)
+  );
+  if (!partitionIsExact || !noUnknownLabels) return void 0;
+  return {
+    sourceSha: source.sha,
+    commandIndex: failedCommandIndex,
+    manifestDigest: evidence.manifestDigest,
+    rerunLabels: planned.filter((label) => failedSet.has(label) || notRunSet.has(label)),
+    reusedLabels: planned.filter((label) => passedSet.has(label))
+  };
+}
+function verifyGateRetryPass(plan, output) {
+  const evidence = parseGateEvidence(output);
+  if (evidence?.outcome !== "pass" || evidence.manifestDigest !== plan.manifestDigest || evidence.failedLabels === void 0 || evidence.notRunLabels === void 0 || evidence.passedLabels === void 0 || evidence.failedLabels.length > 0 || evidence.notRunLabels.length > 0) {
+    return { valid: false, applied: false };
+  }
+  if (evidence.retryApplied === true) {
+    const valid2 = evidence.retrySourceManifestDigest === plan.manifestDigest && sameOrderedValues(evidence.retryReusedLabels ?? [], plan.reusedLabels) && sameOrderedValues(evidence.retryRerunLabels ?? [], plan.rerunLabels) && sameOrderedValues(evidence.plannedLabels ?? [], plan.rerunLabels) && sameOrderedValues(evidence.passedLabels, plan.rerunLabels);
+    return { valid: valid2, applied: valid2 };
+  }
+  const fullLabels = [...plan.reusedLabels, ...plan.rerunLabels];
+  const planned = evidence.plannedLabels ?? [];
+  const valid = planned.length === fullLabels.length && fullLabels.every((label) => planned.includes(label)) && planned.every((label) => fullLabels.includes(label)) && sameOrderedValues(evidence.passedLabels, planned);
+  return { valid, applied: false };
+}
+
+// src/core/ci/local-ci-worker.ts
+function message(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function updated(record, deps, patch) {
+  return {
+    ...record,
+    ...patch,
+    updatedAt: deps.now().toISOString()
+  };
+}
+async function save(record, deps) {
+  return deps.saveRecord(record);
+}
+async function recordCompleteCommandOutput(deps, input) {
+  try {
+    await deps.recordCommandOutput?.(input);
+  } catch {
+  }
+}
+async function persistFailureObligation(record, deps, error, publicationDescription = error, failureClass) {
+  const failed = updated(record, deps, {
+    status: "failed",
+    error,
+    ...failureClass ? { failureClass } : {},
+    outstandingRemoteStatusPublication: createOutstandingFailureStatusPublication(
+      record,
+      publicationDescription
+    )
+  });
+  try {
+    return await save(failed, deps);
+  } catch {
+    return failed;
+  }
+}
+var MAX_FAILING_TESTS = 50;
+function extractFailingTests(step, output) {
+  const kind = describeVerificationCommand(step.command).kind;
+  if (kind !== "test" && kind !== "unknown") {
+    return { failingTests: [], truncated: false };
+  }
+  const phase = step.phase ?? "verify";
+  const found = readFailingTestNames(step.command, output);
+  const identifiers = [...new Set(found?.located ?? found?.names ?? [])];
+  const failingTests = identifiers.slice(0, MAX_FAILING_TESTS).map((identifier) => {
+    const { file, testPath } = splitTestFailureId(identifier);
+    return { ...file !== void 0 ? { file } : {}, test: testPath, phase };
+  });
+  return { failingTests, truncated: identifiers.length > MAX_FAILING_TESTS };
+}
+function resolveExecutableSteps(authority) {
+  const planSteps = authority.verificationPlan?.steps;
+  if (planSteps && planSteps.length > 0) {
+    return planSteps.map((step) => ({
+      id: step.id,
+      phase: step.phase,
+      command: step.command,
+      ...step.timeoutMs !== void 0 ? { timeoutMs: step.timeoutMs } : {}
+    }));
+  }
+  return (authority.commands ?? []).map((command) => ({ command }));
+}
+function computeQueueWaitMs(createdAt, startedAt) {
+  const createdMs = Date.parse(createdAt);
+  if (!Number.isFinite(createdMs)) return 0;
+  return Math.max(0, startedAt.getTime() - createdMs);
+}
+async function releaseScarceResources(record, deps, resources) {
+  let next = record;
+  if (resources.worktreePath) {
+    const pathToRemove = resources.worktreePath;
+    try {
+      await deps.removeWorktree(next.repoRoot, pathToRemove);
+      resources.worktreePath = void 0;
+      if (next.worktreePath) {
+        try {
+          next = await save(updated(next, deps, { worktreePath: void 0 }), deps);
+        } catch {
+          next = { ...next, worktreePath: void 0 };
+        }
+      }
+    } catch (error) {
+      const detail = message(error);
+      const cleanupNote = `Worktree cleanup pending: ${detail}`;
+      try {
+        next = await save(
+          updated(next, deps, {
+            worktreePath: next.worktreePath ?? pathToRemove,
+            // Preserve validation/failure error; surface cleanup only when empty.
+            error: next.error ?? cleanupNote
+          }),
+          deps
+        );
+      } catch {
+        next = {
+          ...next,
+          worktreePath: next.worktreePath ?? pathToRemove,
+          error: next.error ?? cleanupNote
+        };
+      }
+    }
+  }
+  if (resources.slot) {
+    await resources.slot.release().catch(() => void 0);
+    resources.slot = void 0;
+  }
+  return next;
+}
+async function awaitAdvisoryPending(resources) {
+  if (resources.pendingStatus) {
+    await resources.pendingStatus;
+    resources.pendingStatus = void 0;
+  }
+}
+function preservedDispositionError(record) {
+  return record.error?.startsWith("Worktree cleanup pending:") ? record.error : void 0;
+}
+async function publishAfterRelease(record, deps, resources) {
+  let next = await releaseScarceResources(record, deps, resources);
+  await awaitAdvisoryPending(resources);
+  if (!hasOutstandingRemoteStatusPublication(next)) {
+    return next;
+  }
+  try {
+    next = await deps.publishOutstandingStatus(next);
+  } catch (error) {
+    const detail = message(error);
+    if (next.status === "publication_pending") {
+      try {
+        next = await save(
+          updated(next, deps, {
+            error: `Remote status publication pending: ${detail}`
+          }),
+          deps
+        );
+      } catch {
+        next = {
+          ...next,
+          error: `Remote status publication pending: ${detail}`
+        };
+      }
+    }
+    return next;
+  }
+  if (next.status === "publication_pending" && hasOutstandingRemoteStatusPublication(next) && !next.error) {
+    try {
+      next = await save(
+        updated(next, deps, {
+          error: "Remote status publication pending; reconcile will retry."
+        }),
+        deps
+      );
+    } catch {
+    }
+  }
+  return next;
+}
+async function persistAndPublishDisposition(record, deps, resources, input) {
+  const cleanupError = preservedDispositionError(record);
+  const dispositionError = cleanupError ?? input.error;
+  const publicationPending = updated(record, deps, {
+    status: "publication_pending",
+    error: dispositionError,
+    outstandingRemoteStatusPublication: createOutstandingStatusPublication(record, {
+      state: input.state,
+      description: input.description,
+      targetStatus: input.targetStatus
+    })
+  });
+  let next;
+  try {
+    next = await save(publicationPending, deps);
+  } catch {
+    return publicationPending;
+  }
+  next = await publishAfterRelease(next, deps, resources);
+  if (next.status === input.targetStatus && !hasOutstandingRemoteStatusPublication(next) && input.error !== void 0) {
+    try {
+      next = await save(
+        updated(next, deps, {
+          error: input.error
+        }),
+        deps
+      );
+    } catch {
+    }
+  }
+  return next;
+}
+async function maybeSupersede(record, deps) {
+  if (!deps.hasNewerSubmission) return null;
+  const newerExists = await deps.hasNewerSubmission({
+    repository: record.repository,
+    branch: record.branch,
+    sha: record.sha,
+    createdAt: record.createdAt,
+    submittedAt: record.submittedAt
+  });
+  if (!newerExists) return null;
+  return save(
+    updated(record, deps, {
+      status: "superseded",
+      error: "Superseded by a newer submission for this branch."
+    }),
+    deps
+  );
+}
+async function supersedeCancelledRun(record, deps, resources, processGroupSurvived = false) {
+  const reason = deps.signal?.reason;
+  const base = reason instanceof Error ? reason.message : "the run was cancelled";
+  const detail = processGroupSurvived ? `${base} Its process group outlived the cancellation wait; worktree retained for cleanup.` : base;
+  if (processGroupSurvived) resources.worktreePath = void 0;
+  const released = await releaseScarceResources(record, deps, resources);
+  await awaitAdvisoryPending(resources);
+  return save(
+    updated(released, deps, {
+      status: "superseded",
+      error: `Local validation cancelled: ${detail}`
+    }),
+    deps
+  );
+}
+async function executeLocalCiWorker(initialRecord, deps) {
+  let record = initialRecord;
+  const resources = {
+    worktreePath: void 0,
+    slot: void 0,
+    pendingStatus: void 0
+  };
+  let materializing = true;
+  try {
+    const preSlotSuperseded = await maybeSupersede(record, deps);
+    if (preSlotSuperseded) return preSlotSuperseded;
+    resources.slot = await deps.acquireSlot();
+    const startedAt = deps.now();
+    const startedAtIso = startedAt.toISOString();
+    record = await save(
+      updated(record, deps, {
+        status: "running",
+        pid: process.pid,
+        error: void 0,
+        startedAt: startedAtIso,
+        queueWaitMs: computeQueueWaitMs(record.createdAt, startedAt)
+      }),
+      deps
+    );
+    const postSlotSuperseded = await maybeSupersede(record, deps);
+    if (postSlotSuperseded) return postSlotSuperseded;
+    resources.worktreePath = await deps.createWorktree(record.repoRoot, record.sha);
+    record = await save(updated(record, deps, { worktreePath: resources.worktreePath }), deps);
+    const executedTree = await (deps.resolveExecutedTree ?? resolveExecutedTree)({
+      repoRoot: resources.worktreePath,
+      candidateSha: "HEAD"
+    });
+    if (executedTree === void 0) {
+      const error = "Local validation failed: executed tree could not be resolved";
+      record = await persistFailureObligation(record, deps, error, error, "infrastructure");
+      return await publishAfterRelease(record, deps, resources);
+    }
+    materializing = false;
+    const authority = await deps.resolveAuthority(resources.worktreePath);
+    record = await save(
+      updated(record, deps, {
+        statusContext: authority.statusContext,
+        maxConcurrent: authority.maxConcurrent,
+        trustedBaseRef: authority.trustedBaseRef,
+        trustedBaseSha: authority.trustedBaseSha,
+        pullRequestNumber: authority.pullRequest?.number,
+        validationProfile: authority.validationProfile,
+        entrypointFingerprint: authority.commandEntrypoint.entrypointFingerprint,
+        validationProfileReason: boundLocalCiValidationProfileReason(
+          authority.validationProfileReason
+        )
+      }),
+      deps
+    );
+    if (authority.trusted && authority.trustedBaseSha && deps.refreshSchedulingEnvelope) {
+      await deps.refreshSchedulingEnvelope({
+        repository: record.repository,
+        maxConcurrent: authority.maxConcurrent,
+        trustedBaseSha: authority.trustedBaseSha
+      }).catch(() => void 0);
+    }
+    if (!authority.enabled) {
+      return save(
+        updated(record, deps, {
+          status: "skipped",
+          error: "Local CI disabled by trusted base policy."
+        }),
+        deps
+      );
+    }
+    if (!authority.trusted || !authority.trustedBaseSha) {
+      record = await persistAndPublishDisposition(record, deps, resources, {
+        state: "pending",
+        description: "Local validation deferred; trusted-base authority pending",
+        targetStatus: "succeeded_pending",
+        error: `Success attestation pending trusted-base authority: ${authority.validationProfileReason}`
+      });
+      return record;
+    }
+    resources.pendingStatus = deps.publishStatus(
+      {
+        repository: record.repository,
+        sha: record.sha,
+        context: record.statusContext,
+        state: "pending",
+        description: "Local validation queued"
+      },
+      { attempts: 1 }
+    ).catch(() => void 0);
+    const steps = resolveExecutableSteps(authority);
+    const structuredPlanSteps = authority.verificationPlan?.steps;
+    const unavailable = steps.length === 0 ? "no deterministic project command resolved." : structuredPlanSteps !== void 0 && structuredPlanSteps.length > 0 && !structuredPlanSteps.some((step) => step.phase === "verify") ? "structured plan has no verify step." : void 0;
+    if (unavailable) {
+      const error = `Verification unavailable: ${unavailable}`;
+      record = await persistFailureObligation(record, deps, error);
+      return await publishAfterRelease(record, deps, resources);
+    }
+    const entrypointBlockedReason = authority.commandEntrypoint.blockedReason;
+    if (entrypointBlockedReason) {
+      record = await save(
+        updated(record, deps, {
+          entrypointApprovalPending: true
+        }),
+        deps
+      );
+      record = await persistAndPublishDisposition(record, deps, resources, {
+        state: "pending",
+        description: "Trusted verification entrypoint change requires review",
+        targetStatus: "succeeded_pending",
+        error: `Success attestation pending trusted verification entrypoint: ${entrypointBlockedReason}. Review the change, then rerun with BUILD_LOCAL_CI_APPROVE_ENTRYPOINT_SHA=${record.sha}.`
+      });
+      return await publishAfterRelease(record, deps, resources);
+    }
+    let gateRetryPlan;
+    if (record.retryOfSha !== void 0 && deps.loadRecord !== void 0) {
+      try {
+        const source = await deps.loadRecord(record.repository, record.retryOfSha);
+        gateRetryPlan = resolveGateRetryPlan({
+          current: record,
+          source,
+          trustedBaseSha: authority.trustedBaseSha,
+          validationProfile: authority.validationProfile,
+          steps
+        });
+        if (gateRetryPlan !== void 0) {
+          record = await save(
+            updated(record, deps, {
+              gateRetry: {
+                sourceSha: gateRetryPlan.sourceSha,
+                manifestDigest: gateRetryPlan.manifestDigest,
+                rerunLabels: gateRetryPlan.rerunLabels,
+                reusedLabels: gateRetryPlan.reusedLabels
+              }
+            }),
+            deps
+          );
+        }
+      } catch {
+      }
+    }
+    const commandResults = [];
+    for (const [stepIndex, step] of steps.entries()) {
+      if (deps.signal?.aborted) return await supersedeCancelledRun(record, deps, resources);
+      const stepStartedMs = deps.now().getTime();
+      const runOptions = {
+        ...step.timeoutMs !== void 0 ? { timeoutMs: step.timeoutMs } : {},
+        ...authority.trustedBaseSha ? { trustedBaseSha: authority.trustedBaseSha } : {},
+        // Authority-derived only; runtime strips ambient BUILD_LOCAL_CI_PROFILE.
+        validationProfile: authority.validationProfile,
+        ...gateRetryPlan?.commandIndex === stepIndex ? {
+          gateRetry: {
+            sourceSha: gateRetryPlan.sourceSha,
+            manifestDigest: gateRetryPlan.manifestDigest,
+            rerunLabels: gateRetryPlan.rerunLabels,
+            reusedLabels: gateRetryPlan.reusedLabels
+          }
+        } : {}
+      };
+      const result = await deps.runCommand(
+        step.command,
+        resources.worktreePath,
+        Object.keys(runOptions).length > 0 ? runOptions : void 0
+      );
+      if (deps.signal?.aborted) {
+        return await supersedeCancelledRun(record, deps, resources, result.processGroupSurvived);
+      }
+      if (gateRetryPlan?.commandIndex === stepIndex && result.exitCode === 0) {
+        const verification = verifyGateRetryPass(gateRetryPlan, result.output);
+        if (!verification.valid) {
+          await recordCompleteCommandOutput(deps, {
+            command: step.command,
+            ...step.id !== void 0 ? { id: step.id } : {},
+            ...step.phase !== void 0 ? { phase: step.phase } : {},
+            output: result.output
+          });
+          const commandResult2 = boundLocalCiCommandOutput({
+            command: step.command,
+            exitCode: 1,
+            output: result.output,
+            ...step.id !== void 0 ? { id: step.id } : {},
+            ...step.phase !== void 0 ? { phase: step.phase } : {}
+          });
+          commandResults.push(commandResult2);
+          record = await save(updated(record, deps, { commands: [...commandResults] }), deps);
+          record = await persistFailureObligation(
+            record,
+            deps,
+            "Local validation failed: tranche retry evidence was incomplete or inconsistent"
+          );
+          return await publishAfterRelease(record, deps, resources);
+        }
+        record = await save(
+          updated(record, deps, {
+            gateRetry: {
+              sourceSha: gateRetryPlan.sourceSha,
+              manifestDigest: gateRetryPlan.manifestDigest,
+              rerunLabels: gateRetryPlan.rerunLabels,
+              reusedLabels: gateRetryPlan.reusedLabels,
+              applied: verification.applied
+            }
+          }),
+          deps
+        );
+      }
+      const durationMs = Math.max(0, deps.now().getTime() - stepStartedMs);
+      await recordCompleteCommandOutput(deps, {
+        command: step.command,
+        ...step.id !== void 0 ? { id: step.id } : {},
+        ...step.phase !== void 0 ? { phase: step.phase } : {},
+        output: result.output
+      });
+      const commandResult = boundLocalCiCommandOutput({
+        command: step.command,
+        exitCode: result.exitCode,
+        output: result.output,
+        durationMs,
+        ...step.id !== void 0 ? { id: step.id } : {},
+        ...step.phase !== void 0 ? { phase: step.phase } : {}
+      });
+      commandResults.push(commandResult);
+      record = await save(updated(record, deps, { commands: [...commandResults] }), deps);
+      const emptyRun = detectEmptyRun(step.command, result.output, result.exitCode);
+      if (emptyRun && result.exitCode === 0 && step.phase !== "setup") {
+        record = await persistFailureObligation(
+          record,
+          deps,
+          `Local validation failed: ${step.command} collected or ran zero tests`
+        );
+        return await publishAfterRelease(record, deps, resources);
+      }
+      if (result.exitCode !== 0 || step.phase !== "setup" && detectExitZeroVerifyFailure(step.command, result.output)) {
+        const parsed = extractFailingTests(step, result.output);
+        if (parsed.failingTests.length > 0) {
+          record = updated(record, deps, {
+            failingTests: parsed.failingTests,
+            ...parsed.truncated ? { failingTestsTruncated: true } : {}
+          });
+        }
+        const gateEvidence = parseGateEvidence(result.output);
+        const reason = emptyRun ? ` ran no tests (${emptyRun.reason})` : "";
+        const error = `${describeGateFailure(gateEvidence) ?? `Local validation failed: ${step.command}${reason}`}${describeUnavailableDependencySetup(authority.setupUnavailable)}`;
+        record = await persistFailureObligation(record, deps, error);
+        return await publishAfterRelease(record, deps, resources);
+      }
+    }
+    const refusal = !await (deps.worktreeMatchesExecutedTree ?? worktreeMatchesExecutedTree)({
+      worktreePath: resources.worktreePath,
+      executedTree
+    }) ? "Local validation failed: worktree no longer matches the executed tree" : authority.coverageGap && `Verification unavailable: ${authority.coverageGap}`;
+    if (refusal) {
+      record = await persistFailureObligation(record, deps, refusal);
+      return await publishAfterRelease(record, deps, resources);
+    }
+    record = await releaseScarceResources(record, deps, resources);
+    await awaitAdvisoryPending(resources);
+    let pullRequest;
+    try {
+      pullRequest = await deps.findPullRequest({
+        repository: record.repository,
+        branch: record.branch,
+        number: authority.pullRequest?.number,
+        base: authority.trustedBaseRef
+      });
+    } catch (error) {
+      record = await persistAndPublishDisposition(record, deps, resources, {
+        state: "pending",
+        description: "Local validation passed; pull request visibility pending",
+        targetStatus: "succeeded_pending",
+        error: `Success attestation pending pull request visibility: ${message(error)}`
+      });
+      return record;
+    }
+    if (!pullRequest || pullRequest.draft) {
+      record = await persistAndPublishDisposition(record, deps, resources, {
+        state: "pending",
+        description: "Local validation passed; pull request visibility pending",
+        targetStatus: "succeeded_pending",
+        error: !pullRequest ? "Success attestation pending pull request visibility." : "Success attestation pending non-draft pull request."
+      });
+      return record;
+    }
+    if (pullRequest.headSha.toLowerCase() !== record.sha.toLowerCase()) {
+      return save(
+        updated(record, deps, {
+          status: "superseded",
+          error: "Pull request head changed after local validation."
+        }),
+        deps
+      );
+    }
+    if (record.pullRequestNumber !== pullRequest.number) {
+      record = await save(updated(record, deps, { pullRequestNumber: pullRequest.number }), deps);
+    }
+    const trustedBaseSha = authority.trustedBaseSha;
+    if (!pullRequest.baseSha) {
+      record = await persistAndPublishDisposition(record, deps, resources, {
+        state: "pending",
+        description: "Local validation passed; trusted PR base pending",
+        targetStatus: "succeeded_pending",
+        error: "Success attestation pending trusted PR base: PR base SHA is missing."
+      });
+      return record;
+    }
+    if (pullRequest.baseSha.toLowerCase() !== trustedBaseSha.toLowerCase()) {
+      record = await persistAndPublishDisposition(record, deps, resources, {
+        state: "pending",
+        description: "Local validation passed; trusted PR base pending",
+        targetStatus: "succeeded_pending",
+        error: `Success attestation pending trusted PR base: validated ${trustedBaseSha.slice(0, 12)}, observed ${pullRequest.baseSha.slice(0, 12)}; run build ci reconcile.`
+      });
+      return record;
+    }
+    if (pullRequest.baseRefName !== authority.trustedBaseRef) {
+      record = await persistAndPublishDisposition(record, deps, resources, {
+        state: "pending",
+        description: "Local validation passed; trusted PR base pending",
+        targetStatus: "succeeded_pending",
+        error: `Success attestation pending trusted PR base: base ref changed to ${pullRequest.baseRefName ?? "unknown"}.`
+      });
+      return record;
+    }
+    const description = `Local validation passed (${steps.length} command${steps.length === 1 ? "" : "s"})`;
+    record = await persistAndPublishDisposition(record, deps, resources, {
+      state: "success",
+      description,
+      targetStatus: "succeeded"
+    });
+    return record;
+  } catch (error) {
+    if (deps.signal?.aborted && !materializing) {
+      return await supersedeCancelledRun(record, deps, resources);
+    }
+    const detail = message(error);
+    record = await persistFailureObligation(
+      record,
+      deps,
+      detail,
+      `Local validation error: ${detail}`,
+      materializing ? "infrastructure" : void 0
+    );
+    return await publishAfterRelease(record, deps, resources);
+  } finally {
+    if (resources.worktreePath) {
+      await deps.removeWorktree(record.repoRoot, resources.worktreePath).catch(() => void 0);
+      resources.worktreePath = void 0;
+    }
+    if (resources.slot) {
+      await resources.slot.release().catch(() => void 0);
+      resources.slot = void 0;
+    }
+    if (resources.pendingStatus) {
+      await resources.pendingStatus;
+      resources.pendingStatus = void 0;
+    }
+  }
+}
+
+// src/core/ci/local-ci-execution.ts
+async function executeClaimedLocalCiRecord(input) {
+  const { record, store } = input;
+  if (input.manageProcess !== false) keepMacAwakeForCurrentProcess();
+  const heartbeat = input.manageProcess === false ? void 0 : await startDetachedWorkerRegistryHeartbeat({
+    taskId: `local-ci-${record.sha.slice(0, 12)}`,
+    command: "build ci worker",
+    owner: "local-ci",
+    metadata: { repository: record.repository, sha: record.sha }
+  });
+  let retainedLogBytes = 0;
+  try {
+    retainedLogBytes = statSync(store.logPath(record.repository, record.sha)).size;
+  } catch {
+  }
+  try {
+    const completed = await executeLocalCiWorker(record, {
+      acquireSlot: () => input.slot ? Promise.resolve({ slot: input.slot.slot, release: async () => void 0 }) : acquireLocalCiSlot({ repository: record.repository, stateRoot: store.root }),
+      createWorktree: createLocalCiWorktree,
+      removeWorktree: removeLocalCiWorktree,
+      resolveAuthority: (worktreePath) => resolveLocalCiAuthority(record, worktreePath, record.repoRoot, {}, input.trust),
+      runCommand: (command, cwd, options) => runLocalCiVerificationCommand(command, cwd, { ...options, signal: input.signal }),
+      signal: input.signal,
+      recordCommandOutput: ({ command, id, phase, output }) => {
+        const identity = [phase, id].filter(Boolean).join("/");
+        const entry = renderBoundedLocalCiLogEntry({
+          header: `[local-ci] command output attempt=${record.createdAt} ${identity ? `${identity}: ${command}` : command}`,
+          output,
+          maxBytes: Math.max(0, MAX_LOCAL_CI_RETAINED_LOG_BYTES - retainedLogBytes)
+        });
+        if (!entry.length) return;
+        if (input.manageProcess === false) {
+          appendFileSync(store.logPath(record.repository, record.sha), entry, { mode: 384 });
+        } else {
+          process.stdout.write(entry);
+        }
+        retainedLogBytes += Buffer.byteLength(entry, "utf8");
+      },
+      loadRecord: (repository, sourceSha) => store.read(repository, sourceSha),
+      hasNewerSubmission: (value) => store.hasNewerSubmission(value),
+      refreshSchedulingEnvelope: async ({ repository, maxConcurrent, trustedBaseSha }) => {
+        await writeSchedulingEnvelope({
+          repository,
+          maxConcurrent,
+          updatedFromBaseSha: trustedBaseSha,
+          stateRoot: store.root
+        });
+      },
+      publishStatus: publishGitHubLocalCiStatus,
+      findPullRequest: (value) => findGitHubPullRequest(value),
+      saveRecord: (value) => store.save(value),
+      publishOutstandingStatus: input.publishOutstandingStatus,
+      now: () => /* @__PURE__ */ new Date()
+    });
+    if (completed.status !== "queued" && completed.status !== "running") {
+      await appendLandingLogEntry(store.root, "gate", gateLandingFields(completed));
+    }
+    if (input.manageProcess === false && completed.status !== "queued" && completed.status !== "running") {
+      return (await store.compareAndSave(completed, {
+        ...completed,
+        pid: void 0,
+        pidIdentity: void 0
+      })).record;
+    }
+    return completed;
+  } finally {
+    await heartbeat?.unregister();
+    await store.releaseWorkerClaim(record.repository, record.sha, process.pid).catch(() => void 0);
+  }
+}
+
+// src/core/ci/local-ci-recovery-activity.ts
+async function readRemoteBranchExists(repoRoot, remote, branch) {
+  const ref = `refs/heads/${branch}`;
+  try {
+    const valid = await execGit(["check-ref-format", ref], { cwd: repoRoot, timeoutMs: 1e4 });
+    if (valid.exitCode !== 0) return null;
+    const result = await execGit(["ls-remote", "--refs", "--", remote, ref], {
+      cwd: repoRoot,
+      timeoutMs: 1e4,
+      stripFinalNewline: false
+    });
+    if (result.exitCode !== 0) return null;
+    if (result.stdout === "") return false;
+    const lines = (result.stdout.endsWith("\n") ? result.stdout.slice(0, -1) : result.stdout).split(
+      "\n"
+    );
+    if (lines.length !== 1) return null;
+    const match = /^(?:[a-f0-9]{40}|[a-f0-9]{64})\t(.+)$/i.exec(lines[0]);
+    return match?.[1] === ref ? true : null;
+  } catch {
+    return null;
+  }
+}
+async function abandonedLocalCiReason(record, repoRoot, readers) {
+  if (record.pullRequestNumber !== void 0) {
+    const state = await (readers.readPullRequestState ?? readGitHubPullRequestState)({
+      repository: record.repository,
+      number: record.pullRequestNumber
+    }).catch(() => null);
+    if (state === "CLOSED" || state === "MERGED") {
+      return `Pull request #${record.pullRequestNumber} is ${state.toLowerCase()}; validation recovery cancelled.`;
+    }
+  }
+  const exists = await (readers.readRemoteBranchExists ?? readRemoteBranchExists)(
+    repoRoot,
+    record.remote,
+    record.branch
+  ).catch(() => null);
+  return exists === false ? `Remote branch refs/heads/${record.branch} no longer exists; validation recovery cancelled.` : void 0;
+}
+async function retryRetainedWorktreeCleanup(record, store, removeWorktree, repoRoot) {
+  if (!record.worktreePath) return record;
+  try {
+    await removeWorktree(repoRoot, record.worktreePath);
+  } catch {
+    return record;
+  }
+  const transition = await store.compareAndSave(record, {
+    ...record,
+    repoRoot,
+    worktreePath: void 0,
+    // Drop cleanup-only notes once the path is gone; keep real validation errors.
+    error: record.error?.startsWith("Worktree cleanup pending:") ? void 0 : record.error,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  return transition.record;
+}
+async function retireAbandonedLocalCiRun(record, repoRoot, store, removeWorktree, readers) {
+  const reason = await abandonedLocalCiReason(record, repoRoot, readers);
+  if (!reason) return void 0;
+  const transition = await store.compareAndSave(record, {
+    ...record,
+    repoRoot,
+    status: "superseded",
+    pid: void 0,
+    pidIdentity: void 0,
+    error: reason,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  return transition.applied ? retryRetainedWorktreeCleanup(transition.record, store, removeWorktree, repoRoot) : transition.record;
+}
+
+// src/core/ci/local-ci-coordinator.ts
+var LOCAL_CI_CONSECUTIVE_FAILURE_HALT = 2;
+var MAX_AUTOMATIC_RECOVERY_ATTEMPTS = 3;
+var ShaSchema = z3.string().regex(/^[a-f0-9]{40}$/i);
+var BranchSchema = z3.string().min(1).refine((value) => !/[\s~^:?*[\]\\]/.test(value) && !value.includes(".."), "Invalid branch name");
+async function resolveKnownLocalCiRepository(store, repoRoot) {
+  return await store.repositoryForRoot(repoRoot) ?? await resolveOptionalGitHubRepositoryFromRemote(repoRoot, "origin");
+}
+function processIsAlive(pid, pidIdentity, ownedAt) {
+  if (!pid) return false;
+  return processOwnershipState(pid, pidIdentity, ownedAt) !== "reclaimable";
+}
+function withLauncherOwnership(record) {
+  const pidIdentity = readProcessIdentity(process.pid);
+  return pidIdentity ? { ...record, pid: process.pid, pidIdentity } : record;
+}
+function cliEntryPath() {
+  const entry = process.argv[1];
+  if (!entry) throw new Error("Unable to resolve the Build CLI entry path for local CI.");
+  return path4.resolve(entry);
+}
+function createLocalCiWorkerChildEnv() {
+  return withApprovedEntrypointEnv(
+    createLocalCiDetachedChildEnv({ BUILD_LOCAL_CI_WORKER: "1", BUILD_CI_RECONCILING: "1" })
+  );
+}
+function prepareRequeuedRecord(record, repoRoot, options = {}) {
+  const timestamp = (options.now ?? /* @__PURE__ */ new Date()).toISOString();
+  return {
+    ...record,
+    // Canonical root always wins over the record's own (possibly-stale) repoRoot:
+    // a requeue relaunches a worker that must spawn git in a surviving working
+    // tree, never a since-deleted submitting worktree.
+    repoRoot,
+    status: "queued",
+    commands: [],
+    pid: void 0,
+    pidIdentity: void 0,
+    worktreePath: void 0,
+    startedAt: void 0,
+    queueWaitMs: void 0,
+    submittedAt: options.refreshSubmissionAt ? timestamp : record.submittedAt ?? record.createdAt,
+    createdAt: timestamp,
+    updatedAt: timestamp,
+    error: options.error,
+    // Always assign so requeues clear the counter unless the caller carries it.
+    recoveryAttempts: options.recoveryAttempts,
+    // A fresh generation owns its own failing-test telemetry.
+    failingTests: void 0,
+    failingTestsTruncated: void 0,
+    failureClass: void 0,
+    gateRetry: void 0,
+    entrypointApprovalPending: void 0,
+    // Explicit same-SHA resubmit and automatic requeue both start a fresh run.
+    outstandingRemoteStatusPublication: void 0,
+    failurePublicationLease: void 0,
+    ...options.clearTrustedBase ? {
+      trustedBaseRef: void 0,
+      trustedBaseSha: void 0,
+      pullRequestNumber: void 0
+    } : {}
+  };
+}
+async function casReconcileTransition(store, expected, next) {
+  return store.compareAndSave(expected, next);
+}
+async function casRequeueAndLaunch(store, expected, queued, launchWorker) {
+  if (hasLiveFailurePublicationLease(expected)) {
+    return expected;
+  }
+  const transition = await casReconcileTransition(store, expected, queued);
+  if (!transition.applied) return transition.record;
+  return (await launchWorker(transition.record, store)).record;
+}
+async function publishPendingThenRequeueAndLaunch(store, expected, repoRoot, options, launchWorker, dependencies) {
+  const publicationPending = {
+    ...expected,
+    status: "publication_pending",
+    error: options.error,
+    outstandingRemoteStatusPublication: createOutstandingStatusPublication(expected, {
+      state: "pending",
+      description: "Validated base changed; exact-SHA revalidation pending",
+      targetStatus: "succeeded_pending"
+    }),
+    failurePublicationLease: void 0,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const transition = await casReconcileTransition(store, expected, publicationPending);
+  if (!transition.applied) return transition.record;
+  const published = await attemptOutstandingStatusPublication(
+    transition.record,
+    store,
+    dependencies
+  );
+  if (published.status !== "succeeded_pending" || hasOutstandingRemoteStatusPublication(published)) {
+    return published;
+  }
+  return casRequeueAndLaunch(
+    store,
+    published,
+    prepareRequeuedRecord(published, repoRoot, options),
+    launchWorker
+  );
+}
+async function attemptOutstandingStatusPublication(record, store, dependencies = {}) {
+  const obligation = record.outstandingRemoteStatusPublication;
+  if (!obligation) return record;
+  if (!outstandingStatusPublicationMatchesRecord(record, obligation)) {
+    return record;
+  }
+  const publishStatus = dependencies.publishStatus ?? publishGitHubLocalCiStatus;
+  const readRemoteStatus = dependencies.readRemoteStatus ?? readGitHubCommitStatus;
+  let current;
+  try {
+    current = await store.readAndRecover(record.repository, record.sha);
+  } catch {
+    return record;
+  }
+  const currentObligation = current.outstandingRemoteStatusPublication;
+  if (!currentObligation) {
+    return current;
+  }
+  if (!outstandingStatusPublicationMatchesRecord(current, currentObligation)) {
+    return current;
+  }
+  if (!outstandingStatusPublicationMacIsValid(currentObligation)) {
+    return current;
+  }
+  const existingLease = current.failurePublicationLease;
+  if (existingLease && hasLiveFailurePublicationLease(current)) {
+    return current;
+  }
+  const { lease, leased } = createFailurePublicationLease(current);
+  const acquired = await store.compareAndSave(current, leased);
+  if (!acquired.applied) {
+    return acquired.record;
+  }
+  current = acquired.record;
+  const liveObligation = current.outstandingRemoteStatusPublication;
+  if (!matchesFailurePublicationLease(current, lease) || !liveObligation) {
+    return current;
+  }
+  if (!outstandingStatusPublicationMatchesRecord(current, liveObligation)) {
+    return clearFailurePublicationLeaseOnly(store, current, lease);
+  }
+  if (!outstandingStatusPublicationMacIsValid(liveObligation)) {
+    return clearFailurePublicationLeaseOnly(store, current, lease);
+  }
+  try {
+    await publishStatus({
+      repository: liveObligation.repository,
+      sha: liveObligation.sha,
+      state: liveObligation.state,
+      context: liveObligation.context,
+      description: liveObligation.description
+    });
+  } catch {
+    return clearFailurePublicationLeaseOnly(store, current, lease);
+  }
+  return store.withExclusiveRecordAccess(current.repository, current.sha, async (access) => {
+    const requireFence = async () => {
+      try {
+        await access.assertOwned();
+        return true;
+      } catch {
+        return false;
+      }
+    };
+    if (!await requireFence()) {
+      return current;
+    }
+    let onDisk;
+    try {
+      onDisk = await access.read();
+    } catch {
+      return current;
+    }
+    if (!matchesFailurePublicationLease(onDisk, lease)) {
+      return onDisk;
+    }
+    if (!onDisk.outstandingRemoteStatusPublication) {
+      const dropLease = await access.writeIfSameGeneration(onDisk, {
+        ...onDisk,
+        failurePublicationLease: void 0
+      });
+      return dropLease.record;
+    }
+    if (!await requireFence()) {
+      return onDisk;
+    }
+    let remoteStatus;
+    try {
+      remoteStatus = await readRemoteStatus({
+        repository: liveObligation.repository,
+        sha: liveObligation.sha,
+        context: liveObligation.context
+      });
+    } catch {
+      if (!await requireFence()) return onDisk;
+      const dropLease = await access.writeIfSameGeneration(onDisk, {
+        ...onDisk,
+        failurePublicationLease: void 0
+      });
+      return dropLease.record;
+    }
+    if (remoteStatus !== liveObligation.state) {
+      if (!await requireFence()) return onDisk;
+      const dropLease = await access.writeIfSameGeneration(onDisk, {
+        ...onDisk,
+        failurePublicationLease: void 0
+      });
+      return dropLease.record;
+    }
+    if (!await requireFence()) {
+      return onDisk;
+    }
+    const obligation2 = onDisk.outstandingRemoteStatusPublication;
+    const targetStatus = obligation2?.targetStatus;
+    const publishedStatus = targetStatus ?? onDisk.status;
+    const clearPublicationError = targetStatus === "succeeded" || targetStatus === "succeeded_pending";
+    const completed = await access.writeIfSameGeneration(onDisk, {
+      ...onDisk,
+      status: publishedStatus,
+      outstandingRemoteStatusPublication: void 0,
+      failurePublicationLease: void 0,
+      ...clearPublicationError ? { error: void 0 } : {},
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return completed.record;
+  });
+}
+async function clearFailurePublicationLeaseOnly(store, expected, lease) {
+  try {
+    const current = await store.read(expected.repository, expected.sha);
+    if (!matchesFailurePublicationLease(current, lease)) {
+      return current;
+    }
+    const cleared = await store.compareAndSave(current, {
+      ...current,
+      failurePublicationLease: void 0
+    });
+    return cleared.record;
+  } catch {
+    return expected;
+  }
+}
+function abandonOrphanedWorkerChild(pid) {
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+  }
+}
+async function spawnWorker(record, store) {
+  const authorized = record;
+  const claim = await store.claimWorker(authorized);
+  if (!claim) {
+    try {
+      const current = await store.read(authorized.repository, authorized.sha);
+      return {
+        record: current,
+        spawned: Boolean(processIsAlive(current.pid, current.pidIdentity, current.updatedAt))
+      };
+    } catch {
+      return { record: authorized, spawned: false };
+    }
+  }
+  let claimOwnerPid = process.pid;
+  const logPath = path4.join(
+    store.repositoryDirectory(authorized.repository),
+    `${authorized.sha}.log`
+  );
+  const logFd = openSync(logPath, "a", 384);
+  let child;
+  let childPidIdentity;
+  try {
+    child = spawn(
+      process.execPath,
+      [
+        cliEntryPath(),
+        "ci",
+        "worker",
+        "--repository",
+        authorized.repository,
+        "--sha",
+        authorized.sha
+      ],
+      {
+        cwd: authorized.repoRoot,
+        detached: process.platform !== "win32",
+        stdio: ["ignore", logFd, logFd],
+        env: createLocalCiWorkerChildEnv()
+      }
+    );
+    if (!child.pid) throw new Error("Local CI worker did not receive a process id.");
+    childPidIdentity = readProcessIdentity(child.pid);
+    if (!childPidIdentity) {
+      throw new Error("Local CI worker process identity could not be established.");
+    }
+    await store.transferWorkerClaim(claim, child.pid, childPidIdentity);
+    claimOwnerPid = child.pid;
+  } catch (error) {
+    await store.releaseWorkerClaim(authorized.repository, authorized.sha, claimOwnerPid, claim.generationKey).catch(() => void 0);
+    if (child?.pid) {
+      abandonOrphanedWorkerChild(child.pid);
+    }
+    if (authorized.pid === process.pid) {
+      await store.compareAndSave(authorized, { ...authorized, pid: void 0, pidIdentity: void 0 }).catch(() => void 0);
+    }
+    throw error;
+  } finally {
+    closeSync(logFd);
+  }
+  if (!child?.pid) throw new Error("Local CI worker did not start.");
+  const childPid = child.pid;
+  if (!childPidIdentity) {
+    throw new Error("Local CI worker process identity could not be established.");
+  }
+  const assignment = await store.assignWorkerPid(authorized, childPid, childPidIdentity);
+  if (!assignment.applied) {
+    abandonOrphanedWorkerChild(childPid);
+    await store.releaseWorkerClaim(authorized.repository, authorized.sha, childPid, claim.generationKey).catch(() => void 0);
+    return { record: assignment.record, spawned: false };
+  }
+  child.unref();
+  await registerDetachedWorkerProcess({
+    pid: childPid,
+    taskId: `local-ci-${authorized.sha.slice(0, 12)}`,
+    command: "build ci worker",
+    owner: "local-ci",
+    metadata: { repository: authorized.repository, sha: authorized.sha }
+  });
+  return { record: assignment.record, spawned: true };
+}
+async function waitForWorkerAssignment(store, repository, sha) {
+  for (let attempt = 0; attempt < 100; attempt += 1) {
+    const record = await store.read(repository, sha);
+    if (record.pid === process.pid) return record;
+    if (record.status === "queued" && (record.pid === void 0 || record.pid === process.ppid || !processIsAlive(record.pid, record.pidIdentity, record.updatedAt))) {
+      await delay4(50);
+      continue;
+    }
+    throw new Error(
+      `Local CI worker assignment lost for ${repository}@${sha}: status=${record.status} pid=${record.pid ?? "none"}`
+    );
+  }
+  throw new Error("Local CI worker assignment was not persisted before startup.");
+}
+async function submitLocalCi(input, dependencies = {}) {
+  const submissionRoot = path4.resolve(input.repoRoot);
+  const sha = ShaSchema.parse(input.sha).toLowerCase();
+  const branch = BranchSchema.parse(input.branch);
+  const remote = input.remote ?? "origin";
+  let repository;
+  try {
+    repository = await resolveGitHubRepositoryFromRemote(submissionRoot, remote);
+  } catch {
+    return { skipped: true, reason: `remote '${remote}' is not a supported github.com repository` };
+  }
+  let repoRoot;
+  try {
+    repoRoot = await resolveCanonicalMainRepoRoot(submissionRoot);
+  } catch {
+    return {
+      skipped: true,
+      reason: `unable to resolve canonical repository root from ${submissionRoot}`
+    };
+  }
+  if (repoRoot !== submissionRoot) {
+    let canonicalRepository;
+    try {
+      canonicalRepository = await resolveGitHubRepositoryFromRemote(repoRoot, remote);
+    } catch {
+      return {
+        skipped: true,
+        reason: `canonical repository root ${repoRoot} has no supported github.com remote '${remote}'`
+      };
+    }
+    if (canonicalRepository !== repository) {
+      return {
+        skipped: true,
+        reason: `canonical repository root ${repoRoot} resolves to ${canonicalRepository}, not ${repository}`
+      };
+    }
+  }
+  const hasCommit = dependencies.hasCommit ?? (async (root, candidateSha) => {
+    const result = await execGit(["cat-file", "-e", `${candidateSha}^{commit}`], { cwd: root });
+    return result.exitCode === 0;
+  });
+  if (!await hasCommit(repoRoot, sha)) {
+    return {
+      skipped: true,
+      reason: `commit ${sha.slice(0, 12)} is not present locally; run: git fetch ${remote} ${branch}`
+    };
+  }
+  const store = new LocalCiStateStore(input.stateRoot ?? getLocalCiStateRoot());
+  await store.registerRepositoryRoot(repository, repoRoot);
+  const failures = await store.countConsecutiveTerminalFailures(repository, branch);
+  if (failures.count >= LOCAL_CI_CONSECUTIVE_FAILURE_HALT) {
+    if (!await resolveHaltOverride(input.trust)) {
+      const recent = failures.failedShas.slice(0, 2).map((value) => value.slice(0, 12)).join(", ");
+      return {
+        skipped: true,
+        reason: `${failures.count} consecutive Build Local CI failures on ${branch} (last: ${recent}). Halting automatic gate submission - human review required. Rerun with BUILD_LOCAL_CI_OVERRIDE_HALT=1 (build ci merge --override-halt for a merge request) after review`
+      };
+    }
+    await appendLandingLogEntry(store.root, "halt-override", {
+      repository,
+      sha,
+      branch,
+      consecutiveFailures: failures.count
+    });
+  }
+  const queued = withLauncherOwnership(
+    createQueuedRun({
+      repoRoot,
+      repository,
+      sha,
+      branch,
+      remote
+    })
+  );
+  const created = await store.create(queued);
+  let record = created.record;
+  const approvedEntrypointResubmit = record.status === "succeeded_pending" && record.entrypointApprovalPending === true && resolveApprovedEntrypointSha(input.trust)?.toLowerCase() === record.sha.toLowerCase();
+  if (!created.created && (record.status === "succeeded" || // Validation fact held pending remote publication — do not start a fresh generation.
+  record.status === "publication_pending" || // succeeded_pending is terminal only when trusted-base policy resolved.
+  // Without trustedBaseSha, authority never loaded — allow same-SHA restart.
+  // Legacy merge-era statuses normalize to succeeded at read time in local-ci-state.
+  record.status === "succeeded_pending" && record.branch === branch && record.trustedBaseSha !== void 0 && !approvedEntrypointResubmit || // A retained path is a durable cleanup obligation. Reconcile must clear it
+  // before any same-SHA replacement validation can establish a fresh generation.
+  record.worktreePath !== void 0 || processIsAlive(record.pid, record.pidIdentity, record.updatedAt) || // Live publication lease serializes remote writes — no fresh generation yet.
+  hasLiveFailurePublicationLease(record))) {
+    return { record, created: false, spawned: false };
+  }
+  if (!created.created) {
+    const existing = record;
+    const unresolvedTrustedBase = existing.status === "succeeded_pending" && existing.trustedBaseSha === void 0;
+    const approvedEntrypointRestart = existing.status === "succeeded_pending" && approvedEntrypointResubmit;
+    const requeued = withLauncherOwnership({
+      ...prepareRequeuedRecord(existing, repoRoot, {
+        error: void 0,
+        refreshSubmissionAt: true,
+        // Clear absent trusted-base fields for unresolved-authority recovery only.
+        ...unresolvedTrustedBase || approvedEntrypointRestart ? { clearTrustedBase: true } : {}
+      }),
+      branch
+    });
+    const transition = await store.compareAndSave(existing, requeued);
+    if (!transition.applied) {
+      return { record: transition.record, created: false, spawned: false };
+    }
+    record = transition.record;
+  }
+  await store.supersedeOlderQueued({ repository, branch, newerSha: sha });
+  const launchWorker = dependencies.spawnWorker ?? spawnWorker;
+  const spawned = await launchWorker(record, store);
+  return { record: spawned.record, created: created.created, spawned: spawned.spawned };
+}
+async function runLocalCiWorker(input) {
+  const store = new LocalCiStateStore(input.stateRoot ?? getLocalCiStateRoot());
+  const sha = ShaSchema.parse(input.sha).toLowerCase();
+  const record = await waitForWorkerAssignment(store, input.repository, sha);
+  return executeClaimedLocalCiRecord({
+    record,
+    store,
+    slot: input.slot,
+    manageProcess: input.manageProcess,
+    trust: input.trust,
+    signal: input.signal,
+    publishOutstandingStatus: (value) => attemptOutstandingStatusPublication(value, store, {
+      publishStatus: publishGitHubLocalCiStatus,
+      readRemoteStatus: readGitHubCommitStatus
+    })
+  });
+}
+async function reconcileSucceededPendingPublication(record, store, launchWorker, dependencies, repoRoot) {
+  const trustedBaseSha = record.trustedBaseSha;
+  const trustedBaseRef = record.trustedBaseRef;
+  if (!trustedBaseSha || !trustedBaseRef) return record;
+  let pullRequest;
+  try {
+    pullRequest = await (dependencies.findPullRequest ?? findGitHubPullRequest)({
+      repository: record.repository,
+      branch: record.branch,
+      number: record.pullRequestNumber,
+      base: trustedBaseRef,
+      attempts: 1
+    });
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    const transition2 = await casReconcileTransition(store, record, {
+      ...record,
+      status: "succeeded_pending",
+      error: `Success attestation pending pull request visibility: ${detail}`,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return transition2.record;
+  }
+  if (!pullRequest || pullRequest.draft) {
+    const transition2 = await casReconcileTransition(store, record, {
+      ...record,
+      status: "succeeded_pending",
+      error: !pullRequest ? "Success attestation pending pull request visibility." : "Success attestation pending non-draft pull request.",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return transition2.record;
+  }
+  if (pullRequest.headSha.toLowerCase() !== record.sha.toLowerCase()) {
+    const transition2 = await casReconcileTransition(store, record, {
+      ...record,
+      status: "superseded",
+      error: "Pull request head changed after local validation.",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return transition2.record;
+  }
+  if (!pullRequest.baseSha) {
+    const transition2 = await casReconcileTransition(store, record, {
+      ...record,
+      status: "succeeded_pending",
+      error: "Success attestation pending trusted PR base: PR base SHA is missing.",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return transition2.record;
+  }
+  if (pullRequest.baseSha.toLowerCase() !== trustedBaseSha.toLowerCase()) {
+    return casRequeueAndLaunch(
+      store,
+      record,
+      prepareRequeuedRecord(record, repoRoot, {
+        error: `Trusted PR base changed: validated ${trustedBaseSha.slice(0, 12)}, observed ${pullRequest.baseSha.slice(0, 12)}; exact-SHA validation requeued by build ci reconcile.`,
+        clearTrustedBase: true
+      }),
+      launchWorker
+    );
+  }
+  const createWorktree = dependencies.createWorktree ?? createLocalCiWorktree;
+  const removeWorktree = dependencies.removeWorktree ?? removeLocalCiWorktree;
+  let candidateWorktree;
+  let authority;
+  try {
+    candidateWorktree = await createWorktree(repoRoot, record.sha);
+    authority = await (dependencies.resolveAuthority ?? ((value, worktree, root) => resolveLocalCiAuthority(value, worktree, root, {}, dependencies.trust)))(record, candidateWorktree, repoRoot);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    const transition2 = await casReconcileTransition(store, record, {
+      ...record,
+      status: "succeeded_pending",
+      error: `Success attestation pending authority check: ${detail}`,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return transition2.record;
+  } finally {
+    if (candidateWorktree) {
+      await removeWorktree(repoRoot, candidateWorktree).catch(() => void 0);
+    }
+  }
+  const authorityPatch = {
+    statusContext: authority.statusContext,
+    maxConcurrent: authority.maxConcurrent,
+    trustedBaseRef: authority.trustedBaseRef,
+    trustedBaseSha: authority.trustedBaseSha,
+    pullRequestNumber: authority.pullRequest?.number ?? pullRequest.number ?? record.pullRequestNumber,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (!authority.enabled) {
+    const transition2 = await casReconcileTransition(store, record, {
+      ...record,
+      ...authorityPatch,
+      status: "skipped",
+      error: "Local CI disabled by trusted base policy."
+    });
+    return transition2.record;
+  }
+  if (!authority.trustedBaseSha || authority.trustedBaseSha.toLowerCase() !== trustedBaseSha.toLowerCase() || authority.trustedBaseSha.toLowerCase() !== pullRequest.baseSha.toLowerCase() || authority.trustedBaseRef !== pullRequest.baseRefName) {
+    return casRequeueAndLaunch(
+      store,
+      record,
+      prepareRequeuedRecord(record, repoRoot, {
+        error: "Trusted-base authority changed; exact-SHA validation requeued.",
+        clearTrustedBase: true
+      }),
+      launchWorker
+    );
+  }
+  if (!authority.trusted) {
+    const transition2 = await casReconcileTransition(store, record, {
+      ...record,
+      ...authorityPatch,
+      status: "succeeded_pending",
+      error: "Success attestation pending trusted-base authority."
+    });
+    return transition2.record;
+  }
+  const entrypointBlockedReason = authority.commandEntrypoint.blockedReason;
+  if (entrypointBlockedReason) {
+    const transition2 = await casReconcileTransition(store, record, {
+      ...record,
+      ...authorityPatch,
+      status: "succeeded_pending",
+      error: `Success attestation pending trusted verification entrypoint: ${entrypointBlockedReason}. Review the change, then rerun with BUILD_LOCAL_CI_APPROVE_ENTRYPOINT_SHA=${record.sha}.`
+    });
+    return transition2.record;
+  }
+  if (record.entrypointApprovalPending) {
+    return casRequeueAndLaunch(
+      store,
+      record,
+      prepareRequeuedRecord(record, repoRoot, {
+        error: "Trusted verification entrypoint approved; exact-SHA validation requeued.",
+        clearTrustedBase: true
+      }),
+      launchWorker
+    );
+  }
+  const commandCount = record.commands?.length ?? 0;
+  const description = commandCount > 0 ? `Local validation passed (${commandCount} command${commandCount === 1 ? "" : "s"})` : "Local validation passed";
+  const publicationRecord = {
+    ...record,
+    ...authorityPatch
+  };
+  const obligation = createOutstandingStatusPublication(publicationRecord, {
+    state: "success",
+    description,
+    targetStatus: "succeeded"
+  });
+  const publicationPending = {
+    ...publicationRecord,
+    status: "publication_pending",
+    error: record.error?.startsWith("Worktree cleanup pending:") ? record.error : void 0,
+    outstandingRemoteStatusPublication: obligation
+  };
+  const transition = await casReconcileTransition(store, record, publicationPending);
+  if (!transition.applied) {
+    return transition.record;
+  }
+  return attemptOutstandingStatusPublication(transition.record, store, dependencies);
+}
+async function reconcileSucceededBaseBinding(record, pullRequest, store, launchWorker, dependencies, repoRoot) {
+  const trustedBaseRef = record.trustedBaseRef;
+  if (!trustedBaseRef) return record;
+  if (pullRequest.headSha.toLowerCase() !== record.sha.toLowerCase()) return record;
+  if (pullRequest.baseRefName === trustedBaseRef) return record;
+  return publishPendingThenRequeueAndLaunch(
+    store,
+    record,
+    repoRoot,
+    {
+      error: `Pull request base retargeted from '${trustedBaseRef}' to '${pullRequest.baseRefName}' after success attestation; exact-SHA revalidation requeued.`,
+      clearTrustedBase: true
+    },
+    launchWorker,
+    dependencies
+  );
+}
+async function failAutomaticRecovery(record, store, dependencies, error, clearWorktree = false) {
+  const transition = await casReconcileTransition(store, record, {
+    ...record,
+    status: "failed",
+    error,
+    pid: void 0,
+    pidIdentity: void 0,
+    worktreePath: clearWorktree ? void 0 : record.worktreePath,
+    outstandingRemoteStatusPublication: createOutstandingFailureStatusPublication(record, error),
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  return transition.applied ? attemptOutstandingStatusPublication(transition.record, store, dependencies) : transition.record;
+}
+async function reconcileSucceeded(record, store, launchWorker, dependencies, repoRoot, pullRequest) {
+  if (!record.trustedBaseSha) {
+    const attempts = record.recoveryAttempts ?? 0;
+    if (attempts >= MAX_AUTOMATIC_RECOVERY_ATTEMPTS) {
+      return failAutomaticRecovery(
+        record,
+        store,
+        dependencies,
+        `Trusted-base authority unresolved after ${MAX_AUTOMATIC_RECOVERY_ATTEMPTS} automatic recovery attempts; resubmit the SHA to retry.`
+      );
+    }
+    const requeueOptions = {
+      error: "Trusted-base validation requeued.",
+      clearTrustedBase: true,
+      recoveryAttempts: attempts + 1
+    };
+    return record.status === "succeeded" ? publishPendingThenRequeueAndLaunch(
+      store,
+      record,
+      repoRoot,
+      requeueOptions,
+      launchWorker,
+      dependencies
+    ) : casRequeueAndLaunch(
+      store,
+      record,
+      prepareRequeuedRecord(record, repoRoot, requeueOptions),
+      launchWorker
+    );
+  }
+  if (record.status === "succeeded_pending") {
+    return reconcileSucceededPendingPublication(
+      record,
+      store,
+      launchWorker,
+      dependencies,
+      repoRoot
+    );
+  }
+  if (!pullRequest) return record;
+  return reconcileSucceededBaseBinding(
+    record,
+    pullRequest,
+    store,
+    launchWorker,
+    dependencies,
+    repoRoot
+  );
+}
+async function reconcileLocalCiCandidate(input) {
+  const store = new LocalCiStateStore(input.stateRoot ?? getLocalCiStateRoot());
+  const repoRoot = await resolveCanonicalMainRepoRoot(input.repoRoot);
+  let record = await store.read(input.repository, ShaSchema.parse(input.sha).toLowerCase());
+  if (hasLiveFailurePublicationLease(record) || (record.pid !== process.pid || record.status === "queued" || record.status === "running") && processIsAlive(record.pid, record.pidIdentity, record.updatedAt)) {
+    return record;
+  }
+  record = await retryRetainedWorktreeCleanup(record, store, removeLocalCiWorktree, repoRoot);
+  if (record.worktreePath) return record;
+  if (hasOutstandingRemoteStatusPublication(record)) {
+    record = await attemptOutstandingStatusPublication(record, store);
+  }
+  if (record.status === "succeeded" && input.expectedBaseSha && record.trustedBaseSha !== input.expectedBaseSha) {
+    const expectedBaseSha = ShaSchema.parse(input.expectedBaseSha).toLowerCase();
+    const pr = await findGitHubPullRequest({
+      repository: record.repository,
+      branch: record.branch,
+      number: record.pullRequestNumber,
+      attempts: 1
+    });
+    if (!pr || pr.headSha !== record.sha || pr.baseSha !== expectedBaseSha || pr.baseRefName !== record.trustedBaseRef) {
+      return record;
+    }
+    return publishPendingThenRequeueAndLaunch(
+      store,
+      record,
+      repoRoot,
+      { clearTrustedBase: true, error: "Explicit merge request requires current-base validation." },
+      async (queued) => ({ record: queued, spawned: false }),
+      {}
+    );
+  }
+  if (record.status !== "succeeded" && record.status !== "succeeded_pending") return record;
+  const pullRequest = record.status === "succeeded" && record.trustedBaseSha && record.trustedBaseRef && record.pullRequestNumber ? await findGitHubPullRequest({
+    repository: record.repository,
+    branch: record.branch,
+    number: record.pullRequestNumber,
+    attempts: 1
+  }).catch(() => null) : null;
+  return reconcileSucceeded(
+    record,
+    store,
+    async (queued) => ({ record: queued, spawned: false }),
+    { trust: input.trust },
+    repoRoot,
+    pullRequest
+  );
+}
+async function reconcileLocalCi(input, dependencies = {}) {
+  const store = new LocalCiStateStore(
+    input.stateRoot ?? getLocalCiStateRoot(),
+    dependencies.storeHooks
+  );
+  const repoRoot = await resolveCanonicalMainRepoRoot(path4.resolve(input.repoRoot));
+  const repository = await resolveKnownLocalCiRepository(store, repoRoot);
+  if (!repository) return [];
+  const records = await store.list(repository);
+  const baseBindingRecheck = await selectBaseBindingRechecks(records, repository, {
+    listOpenPullRequests: dependencies.listOpenPullRequests ?? listGitHubOpenPullRequests,
+    findPullRequest: dependencies.findPullRequest ?? findGitHubPullRequest
+  });
+  const reconciled = [];
+  const isAlive = dependencies.processIsAlive ?? processIsAlive;
+  const launchWorker = dependencies.spawnWorker ?? spawnWorker;
+  const removeWorktree = dependencies.removeWorktree ?? removeLocalCiWorktree;
+  for (const current of records) {
+    let record = current;
+    const ownerInactive = !isAlive(record.pid, record.pidIdentity, record.updatedAt);
+    if ((record.status === "queued" || record.status === "running") && ownerInactive) {
+      const retired = await retireAbandonedLocalCiRun(
+        record,
+        repoRoot,
+        store,
+        removeWorktree,
+        dependencies
+      );
+      if (retired) {
+        reconciled.push(retired);
+        continue;
+      }
+      let retainedWorktreePath = record.worktreePath;
+      if (retainedWorktreePath) {
+        try {
+          await removeWorktree(repoRoot, retainedWorktreePath);
+          retainedWorktreePath = void 0;
+        } catch {
+        }
+      }
+      const superseded = await store.hasNewerSubmission({
+        repository: record.repository,
+        branch: record.branch,
+        sha: record.sha,
+        createdAt: record.createdAt,
+        submittedAt: record.submittedAt
+      });
+      if (superseded) {
+        const transition = await casReconcileTransition(store, record, {
+          ...record,
+          repoRoot,
+          status: "superseded",
+          pid: void 0,
+          pidIdentity: void 0,
+          worktreePath: retainedWorktreePath,
+          error: "Superseded by a newer submission for this branch.",
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        record = transition.record;
+      } else if (retainedWorktreePath) {
+        const transition = await casReconcileTransition(store, record, {
+          ...record,
+          repoRoot,
+          status: "queued",
+          pid: void 0,
+          pidIdentity: void 0,
+          worktreePath: retainedWorktreePath,
+          error: "Worktree cleanup pending: replacement validation not started.",
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        record = transition.record;
+      } else if ((record.recoveryAttempts ?? 0) >= MAX_AUTOMATIC_RECOVERY_ATTEMPTS) {
+        record = await failAutomaticRecovery(
+          record,
+          store,
+          dependencies,
+          `Local CI worker exited after ${MAX_AUTOMATIC_RECOVERY_ATTEMPTS} automatic recovery attempts; resubmit the SHA to retry.`,
+          true
+        );
+      } else {
+        record = await casRequeueAndLaunch(
+          store,
+          record,
+          prepareRequeuedRecord(record, repoRoot, {
+            error: void 0,
+            recoveryAttempts: (record.recoveryAttempts ?? 0) + 1
+          }),
+          launchWorker
+        );
+      }
+    } else if (isPublicationPending(record) && ownerInactive) {
+      record = await retryRetainedWorktreeCleanup(record, store, removeWorktree, repoRoot);
+      if (hasOutstandingRemoteStatusPublication(record)) {
+        record = await attemptOutstandingStatusPublication(record, store, dependencies);
+      }
+      if ((record.status === "succeeded" || record.status === "succeeded_pending") && !isAlive(record.pid, record.pidIdentity, record.updatedAt)) {
+        record = await reconcileSucceeded(record, store, launchWorker, dependencies, repoRoot);
+      }
+    } else if ((record.status === "succeeded" || record.status === "succeeded_pending") && ownerInactive) {
+      if (record.worktreePath) {
+        record = await retryRetainedWorktreeCleanup(record, store, removeWorktree, repoRoot);
+      }
+      record = await reconcileSucceeded(
+        record,
+        store,
+        launchWorker,
+        dependencies,
+        repoRoot,
+        baseBindingRecheck.get(record.sha)
+      );
+    } else if (record.status === "failed" && hasOutstandingRemoteStatusPublication(record) && ownerInactive) {
+      if (record.worktreePath) {
+        record = await retryRetainedWorktreeCleanup(record, store, removeWorktree, repoRoot);
+      }
+      record = await attemptOutstandingStatusPublication(record, store, dependencies);
+    } else if (record.worktreePath && ownerInactive && record.status !== "queued" && record.status !== "running") {
+      record = await retryRetainedWorktreeCleanup(record, store, removeWorktree, repoRoot);
+    }
+    reconciled.push(record);
+  }
+  try {
+    const selection = await store.selectTerminalRetention(repository, {
+      maxTerminalRecords: DEFAULT_LOCAL_CI_MAX_TERMINAL_RECORDS
+    });
+    await store.deleteRetentionCandidates(selection.deletable);
+  } catch {
+  }
+  pruneEmptyPublicationJournalDirs();
+  return reconciled;
+}
+async function listLocalCiRuns(input) {
+  const store = new LocalCiStateStore(input.stateRoot ?? getLocalCiStateRoot());
+  const repoRoot = await resolveCanonicalMainRepoRoot(path4.resolve(input.repoRoot));
+  const repository = await resolveKnownLocalCiRepository(store, repoRoot);
+  if (!repository) return [];
+  return store.list(repository);
+}
+async function currentBranch(repoRoot) {
+  const result = await execGit(["branch", "--show-current"], { cwd: repoRoot });
+  if (result.exitCode !== 0 || !result.stdout.trim()) {
+    throw new Error("Local CI requires a named branch, not a detached HEAD.");
+  }
+  return BranchSchema.parse(result.stdout.trim());
+}
+
+export {
+  resolveGitHubBranchSha,
+  readGitHubCommitStatusDetail,
+  appendLandingLogEntry,
+  queueLandingFields,
+  acquireLocalCiSlot,
+  resolveCanonicalMainRepoRoot,
+  keepMacAwakeForCurrentProcess,
+  resolveEntrypointFingerprint,
+  submitLocalCi,
+  runLocalCiWorker,
+  reconcileLocalCiCandidate,
+  reconcileLocalCi,
+  listLocalCiRuns,
+  currentBranch,
+  EntrypointApprovalRequired,
+  dispositionPatch,
+  releaseHold,
+  releaseIfApproved,
+  approvalCommand,
+  resumeApprovedHolds
+};
+//# sourceMappingURL=chunk-G3VB2UCZ.js.map