@fitlab-ai/agent-infra 0.9.1 → 0.9.2

package/dist/lib/internal/release-workflow.js

@@ -139,10 +139,58 @@ function runOptionalDemo(cwd, run = command) {
     writeDigestAtomically(cwd, digest);
     return { status: 'recorded', reasonCode: null, message: null, outputPath };
 }
-function git(cwd, args) {
-    const result = command(cwd, 'git', args);
+function git(cwd, args, run = command) {
+    const result = run(cwd, 'git', args);
     return result.status === 0 ? String(result.stdout).trim() : null;
 }
+function inspectLocalReleaseFacts(cwd, version, run = command) {
+    const tag = `v${version}`;
+    const head = git(cwd, ['rev-parse', 'HEAD'], run);
+    const tagCommit = git(cwd, ['rev-parse', '--verify', `${tag}^{commit}`], run);
+    const localTag = Boolean(tagCommit && tagCommit === head);
+    const localTagAncestor = Boolean(tagCommit && head && !localTag
+        && run(cwd, 'git', ['merge-base', '--is-ancestor', tagCommit, head]).status === 0);
+    const localTagConflict = Boolean(tagCommit && !localTag && !localTagAncestor);
+    const postSubject = `chore: prepare next dev iteration after v${version}`;
+    const postLog = localTag || localTagAncestor
+        ? git(cwd, ['log', '--format=%s', `${tag}..HEAD`], run) ?? ''
+        : '';
+    const postCommit = postLog.split('\n').some((subject) => subject === postSubject);
+    return { localTag, localTagAncestor, localTagConflict, postCommit };
+}
+function releaseSmokeStatus(workflows, version, tagCommit) {
+    const manualTitle = `Post-Release Smoke v${version}`;
+    const targets = workflows.filter((run) => {
+        if (String(run.workflowName || run.name) !== 'Post-Release Smoke')
+            return false;
+        if (String(run.event) === 'workflow_run')
+            return Boolean(tagCommit && String(run.headSha) === tagCommit);
+        return String(run.event) === 'workflow_dispatch' && String(run.displayTitle) === manualTitle;
+    }).sort((left, right) => {
+        const leftOrder = [Date.parse(String(left.createdAt || '')) || 0, Number(left.databaseId) || 0, Number(left.attempt) || 0];
+        const rightOrder = [Date.parse(String(right.createdAt || '')) || 0, Number(right.databaseId) || 0, Number(right.attempt) || 0];
+        for (let index = 0; index < leftOrder.length; index += 1) {
+            if (leftOrder[index] !== rightOrder[index])
+                return rightOrder[index] - leftOrder[index];
+        }
+        return 0;
+    });
+    const latest = targets[0];
+    if (!latest)
+        return null;
+    if (String(latest.status) !== 'completed')
+        return 'pending';
+    return String(latest.conclusion) === 'success' ? 'success' : 'failed';
+}
+function inspectPostWorktree(cwd) {
+    const inspected = inspectGitWorkflow(cwd);
+    if (!inspected.snapshot)
+        return inspected.error ?? { code: 'GIT_INSPECT_FAILED', message: 'Unable to inspect Git repository' };
+    if (inspected.snapshot.worktree.length || inspected.snapshot.staged.length) {
+        return { code: 'WORKTREE_DIRTY', message: 'Release post requires a clean worktree' };
+    }
+    return null;
+}
 async function inspectFacts(cwd, version) {
     const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
     const config = JSON.parse(fs.readFileSync(path.join(cwd, '.agents', '.airc.json'), 'utf8'));
@@ -150,6 +198,7 @@ async function inspectFacts(cwd, version) {
     const branch = git(cwd, ['branch', '--show-current']) || '';
     const head = git(cwd, ['rev-parse', 'HEAD']);
     const localTagTarget = git(cwd, ['rev-parse', '--verify', `${tag}^{commit}`]);
+    const local = inspectLocalReleaseFacts(cwd, version);
     const remoteBranch = branch ? git(cwd, ['ls-remote', '--heads', 'origin', branch]) : null;
     const remoteTag = git(cwd, ['ls-remote', '--tags', 'origin', `refs/tags/${tag}`]);
     const platform = inspectPlatformRelease(tag, { cwd });
@@ -157,18 +206,14 @@ async function inspectFacts(cwd, version) {
     const formulaUrl = `https://raw.githubusercontent.com/${config.org}/homebrew-tap/main/Formula/${config.project}.rb`;
     const homebrew = await inspectHomebrewChannel(formulaUrl, version);
     const workflows = platform.workflows;
-    const smokeRun = workflows.find((run) => String(run.name).toLowerCase().includes('post-release-smoke') && String(run.headBranch) === tag);
-    const smoke = smokeRun ? String(smokeRun.conclusion) === 'success' ? 'success' : String(smokeRun.status) === 'completed' ? 'failed' : 'pending' : null;
-    const postMessage = git(cwd, ['log', '-1', '--pretty=%s']) || '';
+    const smoke = releaseSmokeStatus(workflows, version, localTagTarget);
     return {
-        localTag: Boolean(localTagTarget && localTagTarget === head),
-        localTagConflict: Boolean(localTagTarget && localTagTarget !== head),
+        ...local,
         remoteBranch: Boolean(remoteBranch && remoteBranch.split(/\s+/)[0] === head), remoteTag: Boolean(remoteTag),
         githubRelease: platform.platform.type !== 'github'
             ? true
             : platform.status === 'blocked' ? null : Boolean(platform.release?.published),
-        npm: npm.published, homebrew: homebrew.published, smoke,
-        postCommit: postMessage.includes(`after v${version}`)
+        npm: npm.published, homebrew: homebrew.published, smoke
     };
 }
 function changedPaths(cwd) {
@@ -208,12 +253,12 @@ async function releaseWorkflow(args = []) {
         process.stdout.write(`${JSON.stringify({ status: 'no-op', changed: false, snapshot: before, error: null })}\n`);
         return;
     }
+    if (before.facts.localTagConflict) {
+        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, snapshot: before, error: { code: 'GIT_TAG_CONFLICT', message: `Tag v${version} is not reachable from HEAD` } })}\n`);
+        process.exitCode = 1;
+        return;
+    }
     if (action === 'prepare') {
-        if (before.facts.localTagConflict) {
-            process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, snapshot: before, error: { code: 'GIT_TAG_CONFLICT', message: `Tag v${version} does not point to HEAD` } })}\n`);
-            process.exitCode = 1;
-            return;
-        }
         if (before.phase !== 'unprepared') {
             const milestones = reconcileReleaseMilestones(version, { cwd });
             process.stdout.write(`${JSON.stringify({ ...milestones, snapshot: before })}\n`);
@@ -267,7 +312,7 @@ async function releaseWorkflow(args = []) {
         return;
     }
     if (action === 'publish') {
-        if (!['prepared', 'partially-published'].includes(before.phase)) {
+        if (!before.facts.localTag || !['prepared', 'partially-published'].includes(before.phase)) {
             process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, snapshot: before, error: { code: 'RELEASE_PHASE_INVALID', message: `Cannot publish from ${before.phase}` } })}\n`);
             process.exitCode = 1;
             return;
@@ -279,12 +324,22 @@ async function releaseWorkflow(args = []) {
         process.exitCode = result.status === 'failed' ? 1 : result.status === 'degraded' ? 2 : 0;
         return;
     }
+    if (before.phase === 'complete') {
+        process.stdout.write(`${JSON.stringify({ status: 'no-op', changed: false, snapshot: before, error: null })}\n`);
+        return;
+    }
     const channelsComplete = before.facts.githubRelease === true && before.facts.npm === true && before.facts.homebrew === true;
     if (!['published', 'post-pending'].includes(before.phase) || !channelsComplete || before.facts.smoke !== 'success') {
         process.stdout.write(`${JSON.stringify({ status: before.facts.smoke === 'failed' ? 'failed' : 'blocked', changed: false, snapshot: before, error: { code: 'RELEASE_CHANNELS_PENDING', message: 'Release channels or smoke workflow are not complete' } })}\n`);
         process.exitCode = before.facts.smoke === 'failed' ? 1 : 2;
         return;
     }
+    const worktreeError = inspectPostWorktree(cwd);
+    if (worktreeError) {
+        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, snapshot: before, error: worktreeError })}\n`);
+        process.exitCode = 1;
+        return;
+    }
     const built = command(cwd, 'npm', ['run', 'build']);
     if (built.status !== 0) {
         process.stdout.write(`${JSON.stringify({ status: 'failed', changed: true, snapshot: before, error: { code: 'RELEASE_POST_COMMAND_FAILED', message: String(built.stderr || built.stdout) } })}\n`);
@@ -316,5 +371,5 @@ async function releaseWorkflow(args = []) {
     process.stdout.write(`${JSON.stringify({ ...pushed, demo, snapshot: releaseSnapshot(version, await inspectFacts(cwd, version)) })}\n`);
     process.exitCode = pushed.status === 'failed' ? 1 : pushed.status === 'degraded' ? 2 : 0;
 }
-export { computeDemoInputDigest, inspectFacts, releaseWorkflow, runOptionalDemo };
+export { computeDemoInputDigest, inspectFacts, inspectLocalReleaseFacts, inspectPostWorktree, releaseSmokeStatus, releaseWorkflow, runOptionalDemo };
 //# sourceMappingURL=release-workflow.js.map

package/dist/lib/internal/task-orchestration.js

@@ -0,0 +1,151 @@
+import { activateMatchingOrchestrationDelegation, activateOrchestrationDelegation, advanceOrchestration, beginOrResumeOrchestration, completeCommitOrchestrationStage, pauseOrchestration, prepareOrchestrationDelegation, routeOrchestration, sealMatchingOrchestrationDelegation, sealOrchestrationDelegation, statusOrchestration } from '../task/orchestration.js';
+const USAGE = 'Usage: agent-infra-internal task-orchestration <task-ref|auto> <begin-or-resume|route|prepare|hook-start|stage-completed|hook-stop|advance|pause|status> [options]\n';
+function usageFailure(message) {
+    process.stdout.write(`${JSON.stringify({
+        status: 'failed', changed: false,
+        error: { code: 'ORCHESTRATION_PAYLOAD_INVALID', message }
+    })}\n`);
+    process.stderr.write(USAGE);
+    process.exitCode = 2;
+}
+function taskOrchestration(args = []) {
+    if (args[0] === '--help' || args[0] === '-h') {
+        process.stdout.write(USAGE);
+        return;
+    }
+    if (args.length < 2) {
+        usageFailure('task ref and intent are required');
+        return;
+    }
+    const [taskRef, intent] = args;
+    if (!['begin-or-resume', 'route', 'prepare', 'hook-start', 'stage-completed', 'hook-stop', 'advance', 'pause', 'status'].includes(intent)) {
+        usageFailure(`unknown intent '${intent}'`);
+        return;
+    }
+    const values = {};
+    const seen = new Set();
+    for (let index = 2; index < args.length; index += 1) {
+        const flag = args[index];
+        if (![
+            '--max-steps', '--client', '--requested-model', '--parent-id', '--before-fingerprint',
+            '--native-agent', '--child-id', '--spawn-mode', '--actual-model', '--fallback-reason',
+            '--exit-code', '--after-fingerprint', '--changed-paths', '--code', '--message', '--recoverable', '--agent'
+        ].includes(flag)) {
+            usageFailure(`unknown option '${flag}'`);
+            return;
+        }
+        if (seen.has(flag)) {
+            usageFailure(`duplicate option '${flag}'`);
+            return;
+        }
+        seen.add(flag);
+        const value = args[++index];
+        if (!value || value.startsWith('--')) {
+            usageFailure(`option '${flag}' requires a value`);
+            return;
+        }
+        values[flag] = value;
+    }
+    const requireValues = (flags) => flags.find((flag) => values[flag] === undefined);
+    let result;
+    if (intent === 'begin-or-resume') {
+        const maxSteps = values['--max-steps'] === undefined ? undefined : Number(values['--max-steps']);
+        if (maxSteps !== undefined && (!Number.isInteger(maxSteps) || maxSteps < 1)) {
+            usageFailure('--max-steps must be a positive integer');
+            return;
+        }
+        result = beginOrResumeOrchestration(taskRef, { maxSteps });
+    }
+    else if (intent === 'route') {
+        result = routeOrchestration(taskRef);
+    }
+    else if (intent === 'status') {
+        result = statusOrchestration(taskRef);
+    }
+    else if (intent === 'prepare') {
+        const missing = requireValues(['--client']);
+        if (missing) {
+            usageFailure(`intent 'prepare' requires '${missing}'`);
+            return;
+        }
+        result = prepareOrchestrationDelegation(taskRef, {
+            client: values['--client'],
+            requestedModel: values['--requested-model']
+        });
+    }
+    else if (intent === 'hook-start') {
+        const missing = requireValues([
+            ...(taskRef === 'auto' ? ['--client'] : []),
+            '--native-agent', '--child-id', '--parent-id', '--spawn-mode'
+        ]);
+        if (missing) {
+            usageFailure(`intent 'hook-start' requires '${missing}'`);
+            return;
+        }
+        const event = {
+            nativeAgent: values['--native-agent'], childId: values['--child-id'],
+            parentId: values['--parent-id'], spawnMode: values['--spawn-mode'],
+            actualModel: values['--actual-model'], modelFallbackReason: values['--fallback-reason']
+        };
+        result = taskRef === 'auto'
+            ? activateMatchingOrchestrationDelegation(values['--client'], event)
+            : activateOrchestrationDelegation(taskRef, event);
+    }
+    else if (intent === 'hook-stop') {
+        if (taskRef === 'auto') {
+            const missing = requireValues(['--client', '--native-agent', '--child-id']);
+            if (missing) {
+                usageFailure(`intent 'hook-stop' requires '${missing}'`);
+                return;
+            }
+            result = sealMatchingOrchestrationDelegation(values['--client'], {
+                nativeAgent: values['--native-agent'], childId: values['--child-id']
+            });
+        }
+        else {
+            const missing = requireValues(['--child-id', '--exit-code', '--after-fingerprint']);
+            if (missing) {
+                usageFailure(`intent 'hook-stop' requires '${missing}'`);
+                return;
+            }
+            const exitCode = Number(values['--exit-code']);
+            if (!Number.isInteger(exitCode)) {
+                usageFailure('--exit-code must be an integer');
+                return;
+            }
+            result = sealOrchestrationDelegation(taskRef, {
+                childId: values['--child-id'], exitCode,
+                afterFingerprint: values['--after-fingerprint'],
+                changedPaths: values['--changed-paths'] ? values['--changed-paths'].split(',').filter(Boolean) : []
+            });
+        }
+    }
+    else if (intent === 'stage-completed') {
+        const missing = requireValues(['--agent']);
+        if (missing) {
+            usageFailure(`intent 'stage-completed' requires '${missing}'`);
+            return;
+        }
+        result = completeCommitOrchestrationStage(taskRef, values['--agent']);
+    }
+    else if (intent === 'advance') {
+        result = advanceOrchestration(taskRef);
+    }
+    else {
+        const missing = requireValues(['--code', '--message', '--recoverable']);
+        if (missing) {
+            usageFailure(`intent 'pause' requires '${missing}'`);
+            return;
+        }
+        if (!['true', 'false'].includes(values['--recoverable'])) {
+            usageFailure('--recoverable must be true or false');
+            return;
+        }
+        result = pauseOrchestration(taskRef, values['--code'], values['--message'], values['--recoverable'] === 'true');
+    }
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    if (result.status === 'failed')
+        process.exitCode = 1;
+}
+export { taskOrchestration };
+//# sourceMappingURL=task-orchestration.js.map

package/dist/lib/internal/task-review.js

@@ -0,0 +1,65 @@
+import { finalizeReviewSummary } from '../task/review-finalization.js';
+const USAGE = 'Usage: agent-infra-internal task-review <task-ref> finalize-summary --stage <analysis|plan|code> --artifact <review-*.md> [--dry-run]\n';
+function failUsage(message) {
+    process.stdout.write(`${JSON.stringify({
+        status: 'failed',
+        changed: false,
+        intent: 'finalize-summary',
+        error: { code: 'REVIEW_PAYLOAD_INVALID', message }
+    })}\n`);
+    process.stderr.write(USAGE);
+    process.exitCode = 2;
+}
+function taskReview(args = []) {
+    if (args[0] === '--help' || args[0] === '-h') {
+        process.stdout.write(USAGE);
+        return;
+    }
+    if (args.length < 2) {
+        failUsage('task ref and intent are required');
+        return;
+    }
+    if (args[1] !== 'finalize-summary') {
+        failUsage(`unknown intent '${args[1]}'`);
+        return;
+    }
+    let stage = '';
+    let artifact = '';
+    let dryRun = false;
+    const seen = new Set();
+    for (let index = 2; index < args.length; index += 1) {
+        const flag = args[index];
+        if (!['--stage', '--artifact', '--dry-run'].includes(flag)) {
+            failUsage(`unknown option '${flag}'`);
+            return;
+        }
+        if (seen.has(flag)) {
+            failUsage(`duplicate option '${flag}'`);
+            return;
+        }
+        seen.add(flag);
+        if (flag === '--dry-run') {
+            dryRun = true;
+            continue;
+        }
+        const value = args[++index];
+        if (!value || value.startsWith('--')) {
+            failUsage(`option '${flag}' requires a value`);
+            return;
+        }
+        if (flag === '--stage')
+            stage = value;
+        else
+            artifact = value;
+    }
+    if (!stage || !artifact) {
+        failUsage("options '--stage' and '--artifact' are required");
+        return;
+    }
+    const result = finalizeReviewSummary({ taskRef: args[0], stage, artifact, dryRun });
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    if (result.status === 'failed')
+        process.exitCode = 1;
+}
+export { taskReview };
+//# sourceMappingURL=task-review.js.map

package/dist/lib/merge.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { info, ok } from './log.js';
+import { removeDirRecursive } from './remove-dir.js';
 const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
 const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;
 const TITLE_RE = /^# (.+)$/m;
@@ -527,7 +528,7 @@ function mergeMutableSections({ sourceWorkspace, localWorkspace, backupRoot, rep
             if (comparison > 0) {
                 backupTaskDir(backupRoot, localMatch.section, localMatch.taskDir, localMatch.taskId);
                 report.backupCount += 1;
-                fs.rmSync(localMatch.taskDir, { recursive: true, force: true });
+                removeDirRecursive(localMatch.taskDir);
                 const destinationDir = copyTaskToSection(sourceTask, localWorkspace);
                 localIndex.set(sourceTask.taskId, {
                     taskId: sourceTask.taskId,

package/dist/lib/platform/adapters.js

@@ -7,8 +7,45 @@ function registerPlatformAdapter(adapter) {
 function getPlatformAdapter(type) {
     return type ? adapters.get(type) ?? null : null;
 }
+function registerPlatformCapabilities(type, capabilities) {
+    const adapter = adapters.get(type);
+    if (!adapter)
+        throw new Error(`Platform adapter '${type}' must be registered before its capabilities`);
+    adapters.set(type, { ...adapter, ...capabilities });
+}
+function hasPlatformCapability(type, capability) {
+    const adapter = getPlatformAdapter(type);
+    if (capability === 'change-request')
+        return typeof adapter?.inspectChangeRequest === 'function';
+    if (capability === 'required-checks')
+        return typeof adapter?.inspectRequiredChecks === 'function';
+    return typeof adapter?.resolveChangeRequestGitEvidence === 'function';
+}
+function unsupported(type, capability) {
+    return {
+        ok: false,
+        error: {
+            code: 'PLATFORM_CAPABILITY_UNSUPPORTED',
+            message: `Platform '${type || 'none'}' does not provide ${capability}`,
+            retryable: false
+        }
+    };
+}
+function inspectPlatformChangeRequest(type, context) {
+    const adapter = getPlatformAdapter(type);
+    return adapter?.inspectChangeRequest?.(context) ?? unsupported(type, 'change-request inspection');
+}
+function inspectPlatformRequiredChecks(type, context) {
+    const adapter = getPlatformAdapter(type);
+    return adapter?.inspectRequiredChecks?.(context) ?? unsupported(type, 'required-checks inspection');
+}
+function resolvePlatformChangeRequestGitEvidence(type, context) {
+    const adapter = getPlatformAdapter(type);
+    return adapter?.resolveChangeRequestGitEvidence?.(context) ??
+        unsupported(type, 'change-request Git evidence');
+}
 function listPlatformAdapters() {
     return [...adapters.keys()].sort();
 }
-export { getPlatformAdapter, listPlatformAdapters, registerPlatformAdapter };
+export { getPlatformAdapter, hasPlatformCapability, inspectPlatformChangeRequest, inspectPlatformRequiredChecks, listPlatformAdapters, registerPlatformAdapter, registerPlatformCapabilities, resolvePlatformChangeRequestGitEvidence };
 //# sourceMappingURL=adapters.js.map

package/dist/lib/platform/change-request-git-evidence.js

@@ -0,0 +1,113 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { execFileSync, spawnSync } from "node:child_process";
+import { resolvePlatformChangeRequestGitEvidence } from "./adapters.js";
+import { resolveReviewedHeadRelation } from "./merged-pr-equivalence.js";
+const SHA_PATTERN = /^[0-9a-f]{40}$/i;
+const REVIEWED_HEAD_REF = "refs/agent-infra/reviewed-head";
+const TARGET_HEAD_REF = "refs/agent-infra/target-head";
+function git(cwd, args) {
+    return execFileSync("git", args, {
+        cwd,
+        encoding: "utf8",
+        maxBuffer: 32 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+}
+function validRef(ref) {
+    return spawnSync("git", ["check-ref-format", ref], {
+        encoding: "utf8",
+        stdio: ["ignore", "ignore", "ignore"]
+    }).status === 0;
+}
+function blocked(code, message) {
+    return { status: "blocked", code, message };
+}
+function failed(code, message) {
+    return { status: "failed", code, message };
+}
+function validMergeIdentity(lastReviewedCommit, pullRequest) {
+    if (pullRequest.state !== "closed" ||
+        !pullRequest.mergedAt ||
+        !pullRequest.mergeCommitSha ||
+        !SHA_PATTERN.test(lastReviewedCommit) ||
+        lastReviewedCommit !== pullRequest.head.sha) {
+        return failed("PR_MERGE_IDENTITY_INVALID", "PR merge identity does not match the reviewed head");
+    }
+    return null;
+}
+function resolveMaterializedReviewedHeadRelation(input) {
+    const identityFailure = validMergeIdentity(input.lastReviewedCommit, input.pullRequest);
+    if (identityFailure)
+        return identityFailure;
+    const source = resolvePlatformChangeRequestGitEvidence(input.platformType, {
+        cwd: input.cwd,
+        repository: input.pullRequest.repository,
+        number: input.pullRequest.number,
+        pullRequest: input.pullRequest
+    });
+    if (!source.ok || !source.value) {
+        return blocked(source.error?.code || "PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE", source.error?.message || "Unable to resolve authoritative PR Git evidence");
+    }
+    if (!source.value.remoteUrl.trim() ||
+        source.value.remoteUrl.trimStart().startsWith("-") ||
+        !validRef(source.value.reviewedHeadRef) ||
+        !validRef(source.value.targetHeadRef)) {
+        return blocked("PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE", "Platform returned an invalid PR Git evidence source");
+    }
+    let evidenceRoot = null;
+    let phase = "prepare";
+    let result = blocked("PR_MERGE_GIT_EVIDENCE_UNAVAILABLE", "Unable to prepare isolated PR Git evidence");
+    try {
+        evidenceRoot = fs.mkdtempSync(path.join(os.tmpdir(), "agent-infra-pr-evidence-"));
+        execFileSync("git", ["init", "--bare", "-q", evidenceRoot], {
+            cwd: input.cwd,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"]
+        });
+        phase = "fetch";
+        git(evidenceRoot, [
+            "fetch",
+            "--no-tags",
+            "--no-write-fetch-head",
+            source.value.remoteUrl,
+            `+${source.value.reviewedHeadRef}:${REVIEWED_HEAD_REF}`,
+            `+${source.value.targetHeadRef}:${TARGET_HEAD_REF}`
+        ]);
+        phase = "resolve";
+        const fetchedReviewedHead = git(evidenceRoot, ["rev-parse", `${REVIEWED_HEAD_REF}^{commit}`]);
+        const comparisonHead = git(evidenceRoot, ["rev-parse", `${TARGET_HEAD_REF}^{commit}`]);
+        if (fetchedReviewedHead !== input.pullRequest.head.sha) {
+            result = failed("PR_MERGE_FETCHED_HEAD_MISMATCH", "Fetched PR head does not match the authoritative platform snapshot");
+        }
+        else {
+            result = resolveReviewedHeadRelation({
+                gitRoot: evidenceRoot,
+                comparisonHead,
+                lastReviewedCommit: input.lastReviewedCommit,
+                pullRequest: input.pullRequest
+            });
+        }
+    }
+    catch {
+        result = phase === "fetch"
+            ? blocked("PR_MERGE_EVIDENCE_FETCH_FAILED", "Unable to fetch PR Git evidence; verify Git credentials and platform refs")
+            : phase === "resolve"
+                ? blocked("PR_MERGE_OBJECT_MISSING", "Fetched PR Git evidence is incomplete")
+                : blocked("PR_MERGE_GIT_EVIDENCE_UNAVAILABLE", "Unable to prepare isolated PR Git evidence");
+    }
+    finally {
+        if (evidenceRoot) {
+            try {
+                fs.rmSync(evidenceRoot, { recursive: true, force: true });
+            }
+            catch {
+                result = blocked("PR_MERGE_EVIDENCE_CLEANUP_FAILED", "Unable to clean up isolated PR Git evidence");
+            }
+        }
+    }
+    return result;
+}
+export { resolveMaterializedReviewedHeadRelation };
+//# sourceMappingURL=change-request-git-evidence.js.map

package/dist/lib/platform/merged-pr-equivalence.js

@@ -1,7 +1,12 @@
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 const SHA_PATTERN = /^[0-9a-f]{40}$/i;
 function git(cwd, args) {
-    return execFileSync("git", args, { cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+    return execFileSync("git", args, {
+        cwd,
+        encoding: "utf8",
+        maxBuffer: 32 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "pipe"]
+    });
 }
 function commitExists(gitRoot, sha) {
     try {
@@ -12,21 +17,49 @@ function commitExists(gitRoot, sha) {
         return false;
     }
 }
+function isAncestor(gitRoot, ancestor, descendant) {
+    const result = spawnSync("git", ["merge-base", "--is-ancestor", ancestor, descendant], {
+        cwd: gitRoot,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (result.status === 0)
+        return { status: "yes" };
+    if (result.status === 1)
+        return { status: "no" };
+    return { status: "error" };
+}
 export function resolveReviewedHeadRelation(input) {
-    const { gitRoot, localHead, lastReviewedCommit, pullRequest, pathspecs } = input;
-    if (localHead === lastReviewedCommit && lastReviewedCommit === pullRequest.head.sha) {
+    const { gitRoot, comparisonHead, lastReviewedCommit, pullRequest } = input;
+    if (comparisonHead === lastReviewedCommit &&
+        lastReviewedCommit === pullRequest.head.sha &&
+        !(pullRequest.state === "closed" && pullRequest.mergedAt && pullRequest.mergeCommitSha)) {
         return { status: "strict", reviewedHead: lastReviewedCommit };
     }
     if (pullRequest.state !== "closed" || !pullRequest.mergedAt || !pullRequest.mergeCommitSha ||
         lastReviewedCommit !== pullRequest.head.sha) {
         return { status: "failed", code: "PR_MERGE_IDENTITY_INVALID", message: "PR merge identity does not match the reviewed head" };
     }
-    const shas = [pullRequest.base.sha, pullRequest.head.sha, pullRequest.mergeCommitSha, localHead];
+    const shas = [pullRequest.base.sha, pullRequest.head.sha, pullRequest.mergeCommitSha, comparisonHead];
     if (shas.some((sha) => !SHA_PATTERN.test(sha) || !commitExists(gitRoot, sha))) {
         return { status: "blocked", code: "PR_MERGE_OBJECT_MISSING", message: "Required PR merge Git objects are unavailable" };
     }
+    const ancestry = isAncestor(gitRoot, pullRequest.mergeCommitSha, comparisonHead);
+    if (ancestry.status === "no") {
+        return {
+            status: "failed",
+            code: "PR_MERGE_TARGET_MISMATCH",
+            message: "PR merge commit is not in the authoritative target history"
+        };
+    }
+    if (ancestry.status === "error") {
+        return {
+            status: "blocked",
+            code: "PR_MERGE_GIT_EVIDENCE_UNAVAILABLE",
+            message: "Unable to verify PR merge ancestry"
+        };
+    }
     try {
-        git(gitRoot, ["merge-base", "--is-ancestor", pullRequest.mergeCommitSha, localHead]);
         const parents = git(gitRoot, ["rev-list", "--parents", "-n", "1", pullRequest.mergeCommitSha]).trim().split(/\s+/);
         if (parents.length !== 2) {
             return { status: "failed", code: "PR_MERGE_TOPOLOGY_INVALID", message: "PR merge commit is not a single-parent squash commit" };
@@ -37,10 +70,6 @@ export function resolveReviewedHeadRelation(input) {
         if (reviewedDiff !== mergedDiff) {
             return { status: "failed", code: "PR_MERGE_CONTENT_MISMATCH", message: "Squash merge content differs from the reviewed PR changes" };
         }
-        const postMerge = git(gitRoot, ["rev-list", `${pullRequest.mergeCommitSha}..${localHead}`, "--", ...pathspecs]).trim();
-        if (postMerge) {
-            return { status: "failed", code: "POST_MERGE_CHANGES", message: "Protected paths changed after the squash merge" };
-        }
     }
     catch {
         return { status: "blocked", code: "PR_MERGE_GIT_EVIDENCE_UNAVAILABLE", message: "Unable to verify PR merge topology or content" };
@@ -48,7 +77,8 @@ export function resolveReviewedHeadRelation(input) {
     return {
         status: "merged-equivalent",
         reviewedHead: lastReviewedCommit,
-        mergeCommit: pullRequest.mergeCommitSha
+        mergeCommit: pullRequest.mergeCommitSha,
+        comparisonHead
     };
 }
 //# sourceMappingURL=merged-pr-equivalence.js.map