@gitgov/core 1.8.0 → 1.9.0

package/dist/src/index.js

@@ -1388,6 +1388,29 @@ var execution_record_schema_default = {
       },
       default: [],
       description: "Optional list of typed references to relevant commits, files, PRs, or external documents.\nShould use typed prefixes for clarity and trazabilidad (see execution_protocol_appendix.md):\n- commit:     Git commit SHA\n- pr:         Pull Request number\n- file:       File path (relative to repo root)\n- url:        External URL\n- issue:      GitHub Issue number\n- task:       TaskRecord ID\n- exec:       ExecutionRecord ID (for corrections or dependencies)\n- changelog:  ChangelogRecord ID\n"
+    },
+    metadata: {
+      type: "object",
+      additionalProperties: true,
+      description: "Optional structured data for machine consumption.\nUse this field for data that needs to be programmatically processed (e.g., audit findings,\nperformance metrics, scan results). This complements result (human-readable WHAT) and\nnotes (narrative HOW/WHY) by providing structured, queryable data.\nCommon use cases: audit findings arrays, performance metrics, tool outputs, scan summaries.\n",
+      examples: [
+        {
+          findings: [
+            {
+              type: "PII",
+              file: "src/user.ts",
+              line: 42
+            }
+          ],
+          scannedFiles: 245
+        },
+        {
+          metrics: {
+            duration_ms: 1250,
+            memory_mb: 512
+          }
+        }
+      ]
     }
   },
   examples: [
@@ -1460,6 +1483,52 @@ var execution_record_schema_default = {
       references: [
         "exec:1752275500-exec-refactor-queries"
       ]
+    },
+    {
+      id: "1752276000-exec-gdpr-audit-scan",
+      taskId: "1752274500-task-gdpr-compliance",
+      type: "analysis",
+      title: "GDPR Audit Scan - 2025-01-15",
+      result: "Escaneados 245 archivos. Encontrados 10 findings (3 critical, 4 high, 3 medium). Ver metadata para detalles estructurados.",
+      notes: "Scan ejecutado con RegexDetector + HeuristicDetector. LLM calls: 0 (tier free).",
+      references: [
+        "file:src/config/db.ts",
+        "file:src/auth/keys.ts"
+      ],
+      metadata: {
+        scannedFiles: 245,
+        scannedLines: 18420,
+        duration_ms: 1250,
+        findings: [
+          {
+            id: "SEC-001",
+            severity: "critical",
+            file: "src/config/db.ts",
+            line: 5,
+            type: "api_key"
+          },
+          {
+            id: "SEC-003",
+            severity: "critical",
+            file: "src/auth/keys.ts",
+            line: 2,
+            type: "private_key"
+          },
+          {
+            id: "PII-003",
+            severity: "critical",
+            file: "src/payments/stripe.ts",
+            line: 8,
+            type: "credit_card"
+          }
+        ],
+        summary: {
+          critical: 3,
+          high: 4,
+          medium: 3,
+          low: 0
+        }
+      }
     }
   ]
 };
@@ -3000,12 +3069,61 @@ var ConfigManager = class _ConfigManager {
   }
   /**
    * Load GitGovernance session state
+   * [EARS-53] Auto-detects actor from .key files if no session or no actorId exists
    */
   async loadSession() {
     try {
       const sessionContent = await promises.readFile(this.sessionPath, "utf-8");
-      return JSON.parse(sessionContent);
+      const session = JSON.parse(sessionContent);
+      if (!session.lastSession?.actorId) {
+        const detectedActorId = await this.detectActorFromKeyFiles();
+        if (detectedActorId) {
+          session.lastSession = {
+            actorId: detectedActorId,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          };
+          await promises.writeFile(this.sessionPath, JSON.stringify(session, null, 2), "utf-8");
+        }
+      }
+      return session;
     } catch (error) {
+      const detectedActorId = await this.detectActorFromKeyFiles();
+      if (detectedActorId) {
+        const newSession = {
+          lastSession: {
+            actorId: detectedActorId,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          },
+          actorState: {}
+        };
+        try {
+          await promises.writeFile(this.sessionPath, JSON.stringify(newSession, null, 2), "utf-8");
+          return newSession;
+        } catch {
+          return newSession;
+        }
+      }
+      return null;
+    }
+  }
+  /**
+   * [EARS-53] Detect actor from .key files in .gitgov/actors/
+   * Returns the actor ID if exactly one .key file exists, or the first one if multiple exist.
+   * Private keys (.key files) indicate which actors can sign on this machine.
+   */
+  async detectActorFromKeyFiles() {
+    try {
+      const gitgovDir = path6.dirname(this.sessionPath);
+      const actorsDir = path6.join(gitgovDir, "actors");
+      const files = await promises.readdir(actorsDir);
+      const keyFiles = files.filter((f) => f.endsWith(".key"));
+      const firstKeyFile = keyFiles[0];
+      if (!firstKeyFile) {
+        return null;
+      }
+      const actorId = firstKeyFile.replace(".key", "");
+      return actorId;
+    } catch {
       return null;
     }
   }
@@ -3598,7 +3716,7 @@ var IdentityAdapter = class {
     }
     return actors;
   }
-  async signRecord(record, actorId, role) {
+  async signRecord(record, actorId, role, notes) {
     const actor = await this.getActor(actorId);
     if (!actor) {
       throw new Error(`Actor not found: ${actorId}`);
@@ -3617,12 +3735,12 @@ var IdentityAdapter = class {
     }
     let signature;
     if (privateKey) {
-      signature = signPayload(record.payload, privateKey, actorId, role, "Record signed");
+      signature = signPayload(record.payload, privateKey, actorId, role, notes);
     } else {
       signature = {
         keyId: actorId,
         role,
-        notes: "Record signed",
+        notes,
         signature: `mock-signature-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`,
         timestamp: Math.floor(Date.now() / 1e3)
       };
@@ -4069,7 +4187,7 @@ var FeedbackAdapter = class {
         },
         payload: validatedPayload
       };
-      const signedRecord = await this.identity.signRecord(unsignedRecord, actorId, "author");
+      const signedRecord = await this.identity.signRecord(unsignedRecord, actorId, "author", "Feedback record created");
       await this.feedbackStore.write(signedRecord);
       this.eventBus.publish({
         type: "feedback.created",
@@ -4271,7 +4389,7 @@ function createExecutionRecord(payload) {
     title: payload.title,
     notes: payload.notes,
     references: payload.references,
-    ...payload
+    metadata: payload.metadata
   };
   const validation = validateExecutionRecordDetailed(execution);
   if (!validation.isValid) {
@@ -4336,7 +4454,7 @@ var ExecutionAdapter = class {
         },
         payload: validatedPayload
       };
-      const signedRecord = await this.identity.signRecord(unsignedRecord, actorId, "author");
+      const signedRecord = await this.identity.signRecord(unsignedRecord, actorId, "author", "Execution record created");
       await this.executionStore.write(signedRecord);
       this.eventBus.publish({
         type: "execution.created",
@@ -4568,7 +4686,7 @@ var ChangelogAdapter = class {
         },
         payload: validatedPayload
       };
-      const signedRecord = await this.identity.signRecord(unsignedRecord, actorId, "author");
+      const signedRecord = await this.identity.signRecord(unsignedRecord, actorId, "author", "Changelog record created");
       await this.changelogStore.write(signedRecord);
       this.eventBus.publish({
         type: "changelog.created",
@@ -5264,7 +5382,7 @@ var BacklogAdapter = class {
       },
       payload: validatedPayload
     };
-    const signedRecord = await this.identity.signRecord(unsignedRecord, actorId, "author");
+    const signedRecord = await this.identity.signRecord(unsignedRecord, actorId, "author", "Task created");
     await this.taskStore.write(signedRecord);
     this.eventBus.publish({
       type: "task.created",
@@ -5326,7 +5444,7 @@ var BacklogAdapter = class {
     }
     const updatedPayload = { ...task, status: "review" };
     const updatedRecord = { ...taskRecord, payload: updatedPayload };
-    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "submitter");
+    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "submitter", "Task submitted for review");
     await this.taskStore.write(signedRecord);
     this.eventBus.publish({
       type: "task.status.changed",
@@ -5378,7 +5496,7 @@ var BacklogAdapter = class {
     }
     const updatedPayload = { ...task, status: targetState };
     const updatedRecord = { ...taskRecord, payload: updatedPayload };
-    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "approver");
+    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "approver", `Task approved: ${task.status} \u2192 ${targetState}`);
     await this.taskStore.write(signedRecord);
     this.eventBus.publish({
       type: "task.status.changed",
@@ -5418,7 +5536,7 @@ var BacklogAdapter = class {
     }
     const updatedPayload = { ...task, status: "active" };
     const updatedRecord = { ...taskRecord, payload: updatedPayload };
-    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "executor");
+    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "executor", "Task activated");
     await this.taskStore.write(signedRecord);
     await this.configManager.updateActorState(actorId, {
       activeTaskId: taskId
@@ -5469,7 +5587,7 @@ var BacklogAdapter = class {
       }
     };
     const updatedRecord = { ...taskRecord, payload: updatedPayload };
-    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "pauser");
+    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "pauser", `Task paused: ${reason || "No reason provided"}`);
     await this.taskStore.write(signedRecord);
     await this.configManager.updateActorState(actorId, {
       activeTaskId: void 0
@@ -5519,7 +5637,7 @@ var BacklogAdapter = class {
     }
     const updatedPayload = { ...task, status: "active" };
     const updatedRecord = { ...taskRecord, payload: updatedPayload };
-    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "resumer");
+    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "resumer", "Task resumed");
     await this.taskStore.write(signedRecord);
     await this.configManager.updateActorState(actorId, {
       activeTaskId: taskId
@@ -5562,7 +5680,7 @@ var BacklogAdapter = class {
     }
     const updatedPayload = { ...task, status: "done" };
     const updatedRecord = { ...taskRecord, payload: updatedPayload };
-    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "approver");
+    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "approver", "Task completed");
     await this.taskStore.write(signedRecord);
     await this.configManager.updateActorState(actorId, {
       activeTaskId: void 0
@@ -5617,7 +5735,7 @@ ${task.status === "review" ? "[REJECTED]" : "[CANCELLED]"} ${reason} (${(/* @__P
       }
     };
     const updatedRecord = { ...taskRecord, payload: updatedPayload };
-    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "canceller");
+    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "canceller", `Task discarded: ${reason || "No reason provided"}`);
     await this.taskStore.write(signedRecord);
     await this.configManager.updateActorState(actorId, {
       activeTaskId: void 0
@@ -5671,8 +5789,9 @@ ${task.status === "review" ? "[REJECTED]" : "[CANCELLED]"} ${reason} (${(/* @__P
   }
   /**
    * Updates a task with new payload
+   * [EARS-28] Signs the updated record with the editor's signature
    */
-  async updateTask(taskId, payload) {
+  async updateTask(taskId, payload, actorId) {
     const taskRecord = await this.taskStore.read(taskId);
     if (!taskRecord) {
       throw new Error(`RecordNotFoundError: Task not found: ${taskId}`);
@@ -5682,7 +5801,8 @@ ${task.status === "review" ? "[REJECTED]" : "[CANCELLED]"} ${reason} (${(/* @__P
     }
     const updatedPayload = createTaskRecord({ ...taskRecord.payload, ...payload });
     const updatedRecord = { ...taskRecord, payload: updatedPayload };
-    await this.taskStore.write(updatedRecord);
+    const signedRecord = await this.identity.signRecord(updatedRecord, actorId, "editor", "Task updated");
+    await this.taskStore.write(signedRecord);
     return updatedPayload;
   }
   // ===== PHASE 2: AGENT NAVIGATION (IMPLEMENTED) =====
@@ -5993,7 +6113,7 @@ ${task.status === "review" ? "[REJECTED]" : "[CANCELLED]"} ${reason} (${(/* @__P
       },
       payload: validatedPayload
     };
-    const signedRecord = await this.identity.signRecord(unsignedRecord, actorId, "author");
+    const signedRecord = await this.identity.signRecord(unsignedRecord, actorId, "author", "Cycle created");
     await this.cycleStore.write(signedRecord);
     this.eventBus.publish({
       type: "cycle.created",
@@ -6096,12 +6216,14 @@ ${task.status === "review" ? "[REJECTED]" : "[CANCELLED]"} ${reason} (${(/* @__P
     const signedCycleRecord = await this.identity.signRecord(
       { ...cycleRecord, payload: updatedCycle },
       currentActor.id,
-      "author"
+      "author",
+      `Task ${taskId} added to cycle`
     );
     const signedTaskRecord = await this.identity.signRecord(
       { ...taskRecord, payload: updatedTask },
       currentActor.id,
-      "author"
+      "author",
+      `Task linked to cycle ${cycleId}`
     );
     await Promise.all([
       this.cycleStore.write(signedCycleRecord),
@@ -6145,7 +6267,8 @@ ${task.status === "review" ? "[REJECTED]" : "[CANCELLED]"} ${reason} (${(/* @__P
     const signedCycleRecord = await this.identity.signRecord(
       { ...cycleRecord, payload: updatedCycle },
       currentActor.id,
-      "author"
+      "author",
+      `Tasks removed from cycle: ${taskIds.join(", ")}`
     );
     const signedTaskRecords = await Promise.all(
       taskRecords.map(async ({ record }) => {
@@ -6157,7 +6280,8 @@ ${task.status === "review" ? "[REJECTED]" : "[CANCELLED]"} ${reason} (${(/* @__P
         return await this.identity.signRecord(
           { ...record, payload: updatedTask },
           currentActor.id,
-          "author"
+          "author",
+          "Task removed from deleted cycle"
         );
       })
     );
@@ -6223,12 +6347,14 @@ ${task.status === "review" ? "[REJECTED]" : "[CANCELLED]"} ${reason} (${(/* @__P
       this.identity.signRecord(
         { ...sourceCycleRecord, payload: updatedSourceCycle },
         currentActor.id,
-        "author"
+        "author",
+        "Tasks moved from cycle"
       ),
       this.identity.signRecord(
         { ...targetCycleRecord, payload: updatedTargetCycle },
         currentActor.id,
-        "author"
+        "author",
+        "Tasks moved to cycle"
       )
     ]);
     const signedTaskRecords = await Promise.all(
@@ -6242,7 +6368,8 @@ ${task.status === "review" ? "[REJECTED]" : "[CANCELLED]"} ${reason} (${(/* @__P
         return await this.identity.signRecord(
           { ...record, payload: updatedTask },
           currentActor.id,
-          "author"
+          "author",
+          "Task cycle updated"
         );
       })
     );
@@ -7254,7 +7381,7 @@ var ProjectAdapter = class {
       const projectRoot2 = process.env["GITGOV_ORIGINAL_DIR"] || process.cwd();
       const gitgovPath = path6.join(projectRoot2, ".gitgov");
       await this.createDirectoryStructure(gitgovPath);
-      await this.copyAgentPrompt(gitgovPath);
+      await this.copyAgentPrompt(projectRoot2);
       const actor = await this.identityAdapter.createActor(
         {
           type: "human",
@@ -7333,7 +7460,8 @@ var ProjectAdapter = class {
         }
         console.warn(`\u26A0\uFE0F  ${warnings.join(", ")}.`);
         console.warn(`   State sync will be available after 'git remote add origin <url>' and first commit.`);
-        console.warn(`   Run 'gitgov sync push' when ready to enable multi-machine collaboration.`);
+        console.warn(`   Run 'gitgov sync push' when ready to enable multi-machine collaboration.
+`);
       }
       await this.initializeSession(actor.id, gitgovPath);
       await this.setupGitIntegration(projectRoot2);
@@ -7552,8 +7680,8 @@ var ProjectAdapter = class {
       await promises.mkdir(path6.join(gitgovPath, dir), { recursive: true });
     }
   }
-  async copyAgentPrompt(gitgovPath) {
-    const targetPrompt = path6.join(gitgovPath, "gitgov");
+  async copyAgentPrompt(projectRoot2) {
+    const targetPrompt = path6.join(projectRoot2, "gitgov");
     const potentialSources = [];
     potentialSources.push(
       path6.join(process.cwd(), "prompts/gitgov_agent_prompt.md")
@@ -7583,7 +7711,7 @@ var ProjectAdapter = class {
       try {
         await promises.access(source);
         await promises.copyFile(source, targetPrompt);
-        logger3.debug(`\u{1F4CB} @gitgov agent prompt copied to .gitgov/gitgov
+        logger3.debug(`\u{1F4CB} @gitgov agent prompt copied to project root (./gitgov)
 `);
         return;
       } catch {
@@ -7625,8 +7753,8 @@ var ProjectAdapter = class {
 # Ignore entire .gitgov/ directory (state lives in gitgov-state branch)
 .gitgov/
 
-# Exception: Don't ignore .gitgov/.gitignore itself (meta!)
-!.gitgov/.gitignore
+# Ignore agent prompt file (project-specific, created by gitgov init)
+gitgov
 `;
     try {
       let existingContent = "";
@@ -11355,7 +11483,31 @@ function shouldSyncFile(filePath) {
   if (LOCAL_ONLY_FILES.includes(fileName)) {
     return false;
   }
-  return true;
+  const normalizedPath = filePath.replace(/\\/g, "/");
+  const parts = normalizedPath.split("/");
+  const gitgovIndex = parts.findIndex((p) => p === ".gitgov");
+  let relativeParts;
+  if (gitgovIndex !== -1) {
+    relativeParts = parts.slice(gitgovIndex + 1);
+  } else {
+    const syncDirIndex = parts.findIndex(
+      (p) => SYNC_DIRECTORIES.includes(p)
+    );
+    if (syncDirIndex !== -1) {
+      relativeParts = parts.slice(syncDirIndex);
+    } else if (SYNC_ROOT_FILES.includes(fileName)) {
+      return true;
+    } else {
+      return false;
+    }
+  }
+  if (relativeParts.length === 1) {
+    return SYNC_ROOT_FILES.includes(relativeParts[0]);
+  } else if (relativeParts.length >= 2) {
+    const dirName = relativeParts[0];
+    return SYNC_DIRECTORIES.includes(dirName);
+  }
+  return false;
 }
 async function getAllFiles(dir, baseDir = dir) {
   const files = [];
@@ -11374,7 +11526,7 @@ async function getAllFiles(dir, baseDir = dir) {
   }
   return files;
 }
-async function copySyncableFiles(sourceDir, destDir, log) {
+async function copySyncableFiles(sourceDir, destDir, log, excludeFiles = /* @__PURE__ */ new Set()) {
   let copiedCount = 0;
   for (const dirName of SYNC_DIRECTORIES) {
     const sourcePath = path6__default.join(sourceDir, dirName);
@@ -11386,6 +11538,11 @@ async function copySyncableFiles(sourceDir, destDir, log) {
       for (const relativePath of allFiles) {
         const fullSourcePath = path6__default.join(sourcePath, relativePath);
         const fullDestPath = path6__default.join(destPath, relativePath);
+        const gitgovRelativePath = `.gitgov/${dirName}/${relativePath}`;
+        if (excludeFiles.has(gitgovRelativePath)) {
+          log(`[EARS-60] Skipped (remote-only change preserved): ${gitgovRelativePath}`);
+          continue;
+        }
         if (shouldSyncFile(fullSourcePath)) {
           await promises.mkdir(path6__default.dirname(fullDestPath), { recursive: true });
           await promises.copyFile(fullSourcePath, fullDestPath);
@@ -11405,6 +11562,11 @@ async function copySyncableFiles(sourceDir, destDir, log) {
   for (const fileName of SYNC_ROOT_FILES) {
     const sourcePath = path6__default.join(sourceDir, fileName);
     const destPath = path6__default.join(destDir, fileName);
+    const gitgovRelativePath = `.gitgov/${fileName}`;
+    if (excludeFiles.has(gitgovRelativePath)) {
+      log(`[EARS-60] Skipped (remote-only change preserved): ${gitgovRelativePath}`);
+      continue;
+    }
     try {
       await promises.copyFile(sourcePath, destPath);
       log(`Copied root file: ${fileName}`);
@@ -11628,7 +11790,28 @@ var SyncModule = class {
       await this.git.checkoutOrphanBranch(stateBranch);
       try {
         await execAsync("git rm -rf . 2>/dev/null || true", { cwd: repoRoot });
-        await execAsync('git commit --allow-empty -m "Initialize state branch"', { cwd: repoRoot });
+        const gitignoreContent = `# GitGovernance State Branch .gitignore
+# This file is auto-generated during gitgov init
+# These files are machine-specific and should NOT be synced
+
+# Local-only files (regenerated/machine-specific)
+index.json
+.session.json
+gitgov
+
+# Private keys (never synced for security)
+*.key
+
+# Backup and temporary files
+*.backup
+*.backup-*
+*.tmp
+*.bak
+`;
+        const gitignorePath = path6__default.join(repoRoot, ".gitignore");
+        await promises.writeFile(gitignorePath, gitignoreContent, "utf-8");
+        await execAsync("git add .gitignore", { cwd: repoRoot });
+        await execAsync('git commit -m "Initialize state branch with .gitignore"', { cwd: repoRoot });
       } catch (commitError) {
         const error = commitError;
         throw new Error(`Failed to create initial commit on orphan branch: ${error.stderr || error.message}`);
@@ -11683,6 +11866,17 @@ var SyncModule = class {
       );
     }
   }
+  /**
+   * [EARS-60] Detect file-level conflicts and identify remote-only changes.
+   *
+   * A conflict exists when:
+   * 1. A file was modified by the remote during implicit pull
+   * 2. AND the LOCAL USER also modified that same file (content in tempDir differs from what was in git before pull)
+   *
+   * This catches conflicts that git rebase can't detect because we copy files AFTER the pull.
+   *
+   * @param tempDir - Directory containing local .gitgov/ files (preserved before checkout)
+   * @param repoRoot - Repository root path
   /**
    * Checks if a rebase is in progress.
    *
@@ -11817,8 +12011,14 @@ var SyncModule = class {
         const commit = commits[i];
         if (!commit) continue;
         const message = commit.message.toLowerCase();
-        const isRebaseCommit = message.includes("rebase") || message.includes("pick") || message.includes("conflict");
-        if (isRebaseCommit) {
+        if (message.startsWith("resolution:")) {
+          continue;
+        }
+        if (message.startsWith("sync:")) {
+          continue;
+        }
+        const isExplicitRebaseCommit = message.includes("rebase") || message.includes("pick ");
+        if (isExplicitRebaseCommit) {
           const nextCommit = commits[i + 1];
           const isResolutionNext = nextCommit && nextCommit.message.toLowerCase().startsWith("resolution:");
           if (!isResolutionNext) {
@@ -11963,14 +12163,34 @@ Then push your changes: git push -u origin ${sourceBranch}`
       log(`Audit result: ${auditReport.passed ? "PASSED" : "FAILED"}`);
       if (!auditReport.passed) {
         log(`Audit violations: ${auditReport.summary}`);
+        const affectedFiles = [];
+        const detailedErrors = [];
+        if (auditReport.lintReport?.results) {
+          for (const r of auditReport.lintReport.results) {
+            if (r.level === "error") {
+              if (!affectedFiles.includes(r.filePath)) {
+                affectedFiles.push(r.filePath);
+              }
+              detailedErrors.push(`  \u2022 ${r.filePath}: [${r.validator}] ${r.message}`);
+            }
+          }
+        }
+        for (const v of auditReport.integrityViolations) {
+          detailedErrors.push(`  \u2022 Commit ${v.rebaseCommitHash.slice(0, 8)}: ${v.commitMessage} (by ${v.author})`);
+        }
+        const detailSection = detailedErrors.length > 0 ? `
+
+Details:
+${detailedErrors.join("\n")}` : "";
         result.conflictDetected = true;
         result.conflictInfo = {
           type: "integrity_violation",
-          affectedFiles: [],
-          message: auditReport.summary,
+          affectedFiles,
+          message: auditReport.summary + detailSection,
           resolutionSteps: [
-            "Review audit violations",
-            "Fix integrity issues before pushing"
+            "Run 'gitgov lint --fix' to auto-fix signature/checksum issues",
+            "If issues persist, manually review the affected files",
+            "Then retry: gitgov sync push"
           ]
         };
         result.error = "Integrity violations detected. Cannot push.";
@@ -12009,11 +12229,53 @@ Then push your changes: git push -u origin ${sourceBranch}`
         await this.git.checkoutBranch(savedBranch);
         if (tempDir) {
           try {
-            log("[EARS-47] Restoring .gitgov/ from temp directory (early return)...");
             const repoRoot2 = await this.git.getRepoRoot();
             const gitgovDir = path6__default.join(repoRoot2, ".gitgov");
-            await promises.cp(tempDir, gitgovDir, { recursive: true, force: true });
-            log("[EARS-47] .gitgov/ restored from temp (early return)");
+            if (returnResult.implicitPull?.hasChanges) {
+              log("[EARS-58] Implicit pull detected in early return - preserving new files from gitgov-state...");
+              try {
+                await this.git.checkoutFilesFromBranch(stateBranch, [".gitgov/"]);
+                await execAsync("git reset HEAD .gitgov/ 2>/dev/null || true", { cwd: repoRoot2 });
+                log("[EARS-58] Synced files copied from gitgov-state (unstaged)");
+              } catch (checkoutError) {
+                log(`[EARS-58] Warning: Failed to checkout from gitgov-state: ${checkoutError}`);
+              }
+              for (const fileName of LOCAL_ONLY_FILES) {
+                const tempFilePath = path6__default.join(tempDir, fileName);
+                const destFilePath = path6__default.join(gitgovDir, fileName);
+                try {
+                  await promises.access(tempFilePath);
+                  await promises.cp(tempFilePath, destFilePath, { force: true });
+                  log(`[EARS-58] Restored LOCAL_ONLY_FILE: ${fileName}`);
+                } catch {
+                }
+              }
+              const restoreExcludedFilesEarly = async (dir, destDir) => {
+                try {
+                  const entries = await promises.readdir(dir, { withFileTypes: true });
+                  for (const entry of entries) {
+                    const srcPath = path6__default.join(dir, entry.name);
+                    const dstPath = path6__default.join(destDir, entry.name);
+                    if (entry.isDirectory()) {
+                      await restoreExcludedFilesEarly(srcPath, dstPath);
+                    } else {
+                      const isExcluded = SYNC_EXCLUDED_PATTERNS.some((pattern) => pattern.test(entry.name));
+                      if (isExcluded) {
+                        await promises.mkdir(path6__default.dirname(dstPath), { recursive: true });
+                        await promises.copyFile(srcPath, dstPath);
+                        log(`[EARS-59] Restored excluded file (early return): ${entry.name}`);
+                      }
+                    }
+                  }
+                } catch {
+                }
+              };
+              await restoreExcludedFilesEarly(tempDir, gitgovDir);
+            } else {
+              log("[EARS-47] Restoring .gitgov/ from temp directory (early return)...");
+              await promises.cp(tempDir, gitgovDir, { recursive: true, force: true });
+              log("[EARS-47] .gitgov/ restored from temp (early return)");
+            }
             await promises.rm(tempDir, { recursive: true, force: true });
             log("[EARS-47] Temp directory cleaned up (early return)");
           } catch (tempRestoreError) {
@@ -12030,42 +12292,32 @@ Then push your changes: git push -u origin ${sourceBranch}`
             returnResult.error = returnResult.error ? `${returnResult.error}. Failed to restore stashed changes.` : "Failed to restore stashed changes. Run 'git stash pop' manually.";
           }
         }
+        if (returnResult.implicitPull?.hasChanges) {
+          log("[EARS-58] Regenerating index after implicit pull (early return)...");
+          try {
+            await this.indexer.generateIndex();
+            returnResult.implicitPull.reindexed = true;
+            log("[EARS-58] Index regenerated successfully");
+          } catch (indexError) {
+            log(`[EARS-58] Warning: Failed to regenerate index: ${indexError}`);
+            returnResult.implicitPull.reindexed = false;
+          }
+        }
         return returnResult;
       };
       log(`Checking out to ${stateBranch}...`);
       await this.git.checkoutBranch(stateBranch);
       log(`Now on branch: ${await this.git.getCurrentBranch()}`);
-      log("Attempting pull --rebase...");
+      let filesBeforeChanges = /* @__PURE__ */ new Set();
       try {
-        await this.git.pullRebase("origin", stateBranch);
-        log("Pull rebase successful");
-      } catch (error) {
-        const errorMsg = error instanceof Error ? error.message : String(error);
-        log(`Pull rebase failed: ${errorMsg}`);
-        const isAlreadyUpToDate = errorMsg.includes("up to date") || errorMsg.includes("up-to-date");
-        const isNoRemote = errorMsg.includes("does not appear to be") || errorMsg.includes("Could not read from remote");
-        if (isAlreadyUpToDate || isNoRemote) {
-          log("Pull failed but continuing (already up-to-date or no remote)");
-        } else {
-          const conflictedFiles = await this.git.getConflictedFiles();
-          if (conflictedFiles.length > 0) {
-            await this.git.rebaseAbort();
-            result.conflictDetected = true;
-            result.conflictInfo = {
-              type: "rebase_conflict",
-              affectedFiles: conflictedFiles,
-              message: "Conflict detected during automatic reconciliation",
-              resolutionSteps: [
-                "Pull remote changes first: gitgov sync pull",
-                "Resolve any conflicts",
-                "Then push your changes"
-              ]
-            };
-            result.error = "Conflict detected during reconciliation";
-            return await restoreStashAndReturn(result);
-          }
-          throw error;
-        }
+        const repoRoot2 = await this.git.getRepoRoot();
+        const { stdout: filesOutput } = await execAsync(
+          `git ls-files ".gitgov" 2>/dev/null || true`,
+          { cwd: repoRoot2 }
+        );
+        filesBeforeChanges = new Set(filesOutput.trim().split("\n").filter((f) => f && shouldSyncFile(f)));
+        log(`[EARS-57] Files in gitgov-state before changes: ${filesBeforeChanges.size}`);
+      } catch {
       }
       log("=== Phase 2: Publication ===");
       log("Checking if .gitgov/ exists in gitgov-state...");
@@ -12213,6 +12465,43 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
         } catch {
         }
         log("[EARS-47] Non-syncable files cleanup complete");
+        log("[EARS-57] Checking for deleted files to sync...");
+        try {
+          const sourceFiles = /* @__PURE__ */ new Set();
+          const findSourceFiles = async (dir, prefix = ".gitgov") => {
+            try {
+              const entries = await promises.readdir(dir, { withFileTypes: true });
+              for (const entry of entries) {
+                const fullPath = path6__default.join(dir, entry.name);
+                const relativePath = `${prefix}/${entry.name}`;
+                if (entry.isDirectory()) {
+                  await findSourceFiles(fullPath, relativePath);
+                } else if (shouldSyncFile(relativePath)) {
+                  sourceFiles.add(relativePath);
+                }
+              }
+            } catch {
+            }
+          };
+          const sourceDir = tempDir || path6__default.join(repoRoot, ".gitgov");
+          await findSourceFiles(sourceDir);
+          log(`[EARS-57] Found ${sourceFiles.size} syncable files in source (user's local state)`);
+          log(`[EARS-57] Files that existed before changes: ${filesBeforeChanges.size}`);
+          let deletedCount = 0;
+          for (const fileBeforeChange of filesBeforeChanges) {
+            if (!sourceFiles.has(fileBeforeChange)) {
+              try {
+                await execAsync(`git rm -f "${fileBeforeChange}"`, { cwd: repoRoot });
+                log(`[EARS-57] Deleted (user removed): ${fileBeforeChange}`);
+                deletedCount++;
+              } catch {
+              }
+            }
+          }
+          log(`[EARS-57] Deleted ${deletedCount} files that user removed locally`);
+        } catch (err) {
+          log(`[EARS-57] Warning: Failed to sync deleted files: ${err}`);
+        }
         const hasStaged = await this.git.hasUncommittedChanges();
         log(`Has staged changes: ${hasStaged}`);
         if (!hasStaged) {
@@ -12221,10 +12510,10 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
           result.filesSynced = 0;
           return await restoreStashAndReturn(result);
         }
-        log("Creating commit...");
+        log("Creating local commit...");
         try {
           const commitHash = await this.git.commit(commitMessage);
-          log(`Commit created: ${commitHash}`);
+          log(`Local commit created: ${commitHash}`);
           result.commitHash = commitHash;
         } catch (commitError) {
           const errorMsg = commitError instanceof Error ? commitError.message : String(commitError);
@@ -12242,6 +12531,116 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
           log(`ERROR: Git stderr: ${stderr}`);
           throw new Error(`Failed to create commit: ${errorMsg} | stderr: ${stderr}`);
         }
+        log("=== Phase 3: Reconcile with Remote (Git-Native) ===");
+        let hashBeforePull = null;
+        try {
+          const { stdout: beforeHash } = await execAsync(`git rev-parse HEAD`, { cwd: repoRoot });
+          hashBeforePull = beforeHash.trim();
+          log(`Hash before pull: ${hashBeforePull}`);
+        } catch {
+        }
+        log("Attempting git pull --rebase origin gitgov-state...");
+        try {
+          await this.git.pullRebase("origin", stateBranch);
+          log("Pull rebase successful - no conflicts");
+          if (hashBeforePull) {
+            try {
+              const { stdout: afterHash } = await execAsync(`git rev-parse HEAD`, { cwd: repoRoot });
+              const hashAfterPull = afterHash.trim();
+              if (hashAfterPull !== hashBeforePull) {
+                const pulledChangedFiles = await this.git.getChangedFiles(hashBeforePull, hashAfterPull, ".gitgov/");
+                result.implicitPull = {
+                  hasChanges: true,
+                  filesUpdated: pulledChangedFiles.length,
+                  reindexed: false
+                  // Will be set to true after actual reindex
+                };
+                log(`[EARS-54] Implicit pull: ${pulledChangedFiles.length} files from remote were rebased`);
+              }
+            } catch (e) {
+              log(`[EARS-54] Could not capture implicit pull details: ${e}`);
+            }
+          }
+        } catch (pullError) {
+          const errorMsg = pullError instanceof Error ? pullError.message : String(pullError);
+          log(`Pull rebase result: ${errorMsg}`);
+          const isAlreadyUpToDate = errorMsg.includes("up to date") || errorMsg.includes("up-to-date");
+          const isNoRemote = errorMsg.includes("does not appear to be") || errorMsg.includes("Could not read from remote");
+          const isNoUpstream = errorMsg.includes("no tracking information") || errorMsg.includes("There is no tracking information");
+          if (isAlreadyUpToDate || isNoRemote || isNoUpstream) {
+            log("Pull not needed or no remote - continuing to push");
+          } else {
+            const isRebaseInProgress = await this.isRebaseInProgress();
+            const conflictedFiles = await this.git.getConflictedFiles();
+            if (isRebaseInProgress || conflictedFiles.length > 0) {
+              log(`[GIT-NATIVE] Conflict detected! Files: ${conflictedFiles.join(", ")}`);
+              result.conflictDetected = true;
+              const fileWord = conflictedFiles.length === 1 ? "file" : "files";
+              const stageCommand = conflictedFiles.length === 1 ? `git add ${conflictedFiles[0]}` : "git add .gitgov/";
+              result.conflictInfo = {
+                type: "rebase_conflict",
+                affectedFiles: conflictedFiles,
+                message: "Conflict detected during sync - Git has paused the rebase for manual resolution",
+                resolutionSteps: [
+                  `1. Edit the conflicted ${fileWord} to resolve conflicts (remove <<<<<<, ======, >>>>>> markers)`,
+                  `2. Stage resolved ${fileWord}: ${stageCommand}`,
+                  "3. Complete sync: gitgov sync resolve --reason 'your reason'",
+                  "(This will continue the rebase, re-sign the record, and return you to your original branch)"
+                ]
+              };
+              result.error = `Conflict detected: ${conflictedFiles.length} file(s) need manual resolution. Use 'git status' to see details.`;
+              if (stashHash) {
+                try {
+                  await this.git.checkoutBranch(sourceBranch);
+                  await execAsync("git stash pop", { cwd: repoRoot });
+                  await this.git.checkoutBranch(stateBranch);
+                  log("Restored stash to original branch during conflict");
+                } catch (stashErr) {
+                  log(`Warning: Could not restore stash: ${stashErr}`);
+                }
+              }
+              if (tempDir) {
+                log("Restoring local files (.key, .session.json, etc.) for conflict resolution...");
+                const gitgovInState = path6__default.join(repoRoot, ".gitgov");
+                for (const fileName of LOCAL_ONLY_FILES) {
+                  const srcPath = path6__default.join(tempDir, fileName);
+                  const destPath = path6__default.join(gitgovInState, fileName);
+                  try {
+                    await promises.access(srcPath);
+                    await promises.cp(srcPath, destPath, { force: true });
+                    log(`Restored LOCAL_ONLY_FILE for conflict resolution: ${fileName}`);
+                  } catch {
+                  }
+                }
+                const restoreExcluded = async (srcDir, destDir) => {
+                  try {
+                    const entries = await promises.readdir(srcDir, { withFileTypes: true });
+                    for (const entry of entries) {
+                      const srcPath = path6__default.join(srcDir, entry.name);
+                      const dstPath = path6__default.join(destDir, entry.name);
+                      if (entry.isDirectory()) {
+                        await restoreExcluded(srcPath, dstPath);
+                      } else {
+                        const isExcluded = SYNC_EXCLUDED_PATTERNS.some((pattern) => pattern.test(entry.name));
+                        if (isExcluded) {
+                          await promises.mkdir(path6__default.dirname(dstPath), { recursive: true });
+                          await promises.copyFile(srcPath, dstPath);
+                          log(`Restored EXCLUDED file for conflict resolution: ${entry.name}`);
+                        }
+                      }
+                    }
+                  } catch {
+                  }
+                };
+                await restoreExcluded(tempDir, gitgovInState);
+                log("Local files restored for conflict resolution");
+              }
+              return result;
+            }
+            throw pullError;
+          }
+        }
+        log("=== Phase 4: Push to Remote ===");
         log("Pushing to remote...");
         try {
           await this.git.push("origin", stateBranch);
@@ -12271,11 +12670,57 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
         }
       }
       if (tempDir) {
-        log("[EARS-43] Restoring ENTIRE .gitgov/ from temp directory to working tree...");
         const repoRoot2 = await this.git.getRepoRoot();
         const gitgovDir = path6__default.join(repoRoot2, ".gitgov");
-        await promises.cp(tempDir, gitgovDir, { recursive: true, force: true });
-        log("[EARS-43] Entire .gitgov/ restored from temp");
+        if (result.implicitPull?.hasChanges) {
+          log("[EARS-56] Implicit pull detected - copying synced files from gitgov-state first...");
+          try {
+            await this.git.checkoutFilesFromBranch(stateBranch, [".gitgov/"]);
+            await execAsync("git reset HEAD .gitgov/ 2>/dev/null || true", { cwd: repoRoot2 });
+            log("[EARS-56] Synced files copied from gitgov-state to work branch (unstaged)");
+          } catch (checkoutError) {
+            log(`[EARS-56] Warning: Failed to checkout from gitgov-state: ${checkoutError}`);
+            await promises.cp(tempDir, gitgovDir, { recursive: true, force: true });
+            log("[EARS-56] Fallback: Entire .gitgov/ restored from temp");
+          }
+          log("[EARS-56] Restoring local-only files from temp directory...");
+          for (const fileName of LOCAL_ONLY_FILES) {
+            const tempFilePath = path6__default.join(tempDir, fileName);
+            const destFilePath = path6__default.join(gitgovDir, fileName);
+            try {
+              await promises.access(tempFilePath);
+              await promises.cp(tempFilePath, destFilePath, { force: true });
+              log(`[EARS-56] Restored LOCAL_ONLY_FILE: ${fileName}`);
+            } catch {
+            }
+          }
+          const restoreExcludedFiles = async (dir, destDir) => {
+            try {
+              const entries = await promises.readdir(dir, { withFileTypes: true });
+              for (const entry of entries) {
+                const srcPath = path6__default.join(dir, entry.name);
+                const dstPath = path6__default.join(destDir, entry.name);
+                if (entry.isDirectory()) {
+                  await restoreExcludedFiles(srcPath, dstPath);
+                } else {
+                  const isExcluded = SYNC_EXCLUDED_PATTERNS.some((pattern) => pattern.test(entry.name));
+                  if (isExcluded) {
+                    await promises.mkdir(path6__default.dirname(dstPath), { recursive: true });
+                    await promises.copyFile(srcPath, dstPath);
+                    log(`[EARS-59] Restored excluded file: ${entry.name}`);
+                  }
+                }
+              }
+            } catch {
+            }
+          };
+          await restoreExcludedFiles(tempDir, gitgovDir);
+          log("[EARS-59] Local-only and excluded files restored from temp");
+        } else {
+          log("[EARS-43] Restoring ENTIRE .gitgov/ from temp directory to working tree...");
+          await promises.cp(tempDir, gitgovDir, { recursive: true, force: true });
+          log("[EARS-43] Entire .gitgov/ restored from temp");
+        }
         log("[EARS-43] Cleaning up temp directory...");
         try {
           await promises.rm(tempDir, { recursive: true, force: true });
@@ -12284,6 +12729,17 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
           log(`[EARS-43] Warning: Failed to cleanup temp directory: ${cleanupError}`);
         }
       }
+      if (result.implicitPull?.hasChanges) {
+        log("[EARS-54] Regenerating index after implicit pull...");
+        try {
+          await this.indexer.generateIndex();
+          result.implicitPull.reindexed = true;
+          log("[EARS-54] Index regenerated successfully after implicit pull");
+        } catch (indexError) {
+          log(`[EARS-54] Warning: Failed to regenerate index after implicit pull: ${indexError}`);
+          result.implicitPull.reindexed = false;
+        }
+      }
       result.success = true;
       result.filesSynced = delta.length;
       log(`=== pushState COMPLETED SUCCESSFULLY: ${delta.length} files synced ===`);
@@ -12326,7 +12782,7 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
    * [EARS-44] Requires remote to be configured (pull without remote makes no sense)
    */
   async pullState(options = {}) {
-    const { forceReindex = false } = options;
+    const { forceReindex = false, force = false } = options;
     const stateBranch = await this.getStateBranchName();
     if (!stateBranch) {
       throw new SyncError("Failed to get state branch name");
@@ -12393,6 +12849,37 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
       } catch (error) {
         log(`[EARS-51] Warning: Could not save local files: ${error.message}`);
       }
+      const savedSyncableFiles = /* @__PURE__ */ new Map();
+      try {
+        const gitgovPath2 = path6__default.join(pullRepoRoot, ".gitgov");
+        const gitgovExists2 = await promises.access(gitgovPath2).then(() => true).catch(() => false);
+        if (gitgovExists2) {
+          const readSyncableFilesRecursive = async (dir, baseDir) => {
+            try {
+              const entries = await promises.readdir(dir, { withFileTypes: true });
+              for (const entry of entries) {
+                const fullPath = path6__default.join(dir, entry.name);
+                const relativePath = path6__default.relative(baseDir, fullPath);
+                const gitgovRelativePath = `.gitgov/${relativePath}`;
+                if (entry.isDirectory()) {
+                  await readSyncableFilesRecursive(fullPath, baseDir);
+                } else if (shouldSyncFile(gitgovRelativePath)) {
+                  try {
+                    const content = await promises.readFile(fullPath, "utf-8");
+                    savedSyncableFiles.set(gitgovRelativePath, content);
+                  } catch {
+                  }
+                }
+              }
+            } catch {
+            }
+          };
+          await readSyncableFilesRecursive(gitgovPath2, gitgovPath2);
+          log(`[EARS-61] Saved ${savedSyncableFiles.size} syncable files before checkout for conflict detection`);
+        }
+      } catch (error) {
+        log(`[EARS-61] Warning: Could not save syncable files: ${error.message}`);
+      }
       try {
         await this.git.checkoutBranch(stateBranch);
       } catch (checkoutError) {
@@ -12427,6 +12914,90 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
       });
       const hashBefore = commitBefore[0]?.hash;
       await this.git.fetch("origin");
+      log("[EARS-61] Checking for local changes that would be overwritten...");
+      let remoteChangedFiles = [];
+      try {
+        const { stdout: remoteChanges } = await execAsync(
+          `git diff --name-only ${stateBranch} origin/${stateBranch} -- .gitgov/ 2>/dev/null || true`,
+          { cwd: pullRepoRoot }
+        );
+        remoteChangedFiles = remoteChanges.trim().split("\n").filter((f) => f && shouldSyncFile(f));
+        log(`[EARS-61] Remote changed files: ${remoteChangedFiles.length} - ${remoteChangedFiles.join(", ")}`);
+      } catch {
+        log("[EARS-61] Could not determine remote changes, continuing...");
+      }
+      let localModifiedFiles = [];
+      if (remoteChangedFiles.length > 0 && savedSyncableFiles.size > 0) {
+        try {
+          for (const remoteFile of remoteChangedFiles) {
+            const savedContent = savedSyncableFiles.get(remoteFile);
+            if (savedContent !== void 0) {
+              try {
+                const { stdout: gitStateContent } = await execAsync(
+                  `git show HEAD:${remoteFile} 2>/dev/null`,
+                  { cwd: pullRepoRoot }
+                );
+                if (savedContent !== gitStateContent) {
+                  localModifiedFiles.push(remoteFile);
+                  log(`[EARS-61] Local file was modified since last sync: ${remoteFile}`);
+                }
+              } catch {
+                localModifiedFiles.push(remoteFile);
+                log(`[EARS-61] Local file is new (not in gitgov-state): ${remoteFile}`);
+              }
+            }
+          }
+          log(`[EARS-61] Local modified files that overlap with remote: ${localModifiedFiles.length}`);
+        } catch (error) {
+          log(`[EARS-61] Warning: Could not check local modifications: ${error.message}`);
+        }
+      }
+      if (localModifiedFiles.length > 0) {
+        if (force) {
+          log(`[EARS-62] Force flag set - will overwrite ${localModifiedFiles.length} local file(s)`);
+          logger6.warn(`[pullState] Force pull: overwriting local changes to ${localModifiedFiles.length} file(s)`);
+          result.forcedOverwrites = localModifiedFiles;
+        } else {
+          log(`[EARS-61] CONFLICT: Local changes would be overwritten by pull`);
+          await this.git.checkoutBranch(savedBranch);
+          for (const [filePath, content] of savedSyncableFiles) {
+            const fullPath = path6__default.join(pullRepoRoot, filePath);
+            try {
+              await promises.mkdir(path6__default.dirname(fullPath), { recursive: true });
+              await promises.writeFile(fullPath, content, "utf-8");
+              log(`[EARS-61] Restored syncable file: ${filePath}`);
+            } catch {
+            }
+          }
+          for (const [fileName, content] of savedLocalFiles) {
+            const filePath = path6__default.join(pullRepoRoot, ".gitgov", fileName);
+            try {
+              await promises.mkdir(path6__default.dirname(filePath), { recursive: true });
+              await promises.writeFile(filePath, content, "utf-8");
+              log(`[EARS-61] Restored local-only file: ${fileName}`);
+            } catch {
+            }
+          }
+          result.success = false;
+          result.conflictDetected = true;
+          result.conflictInfo = {
+            type: "local_changes_conflict",
+            affectedFiles: localModifiedFiles,
+            message: `Your local changes to the following files would be overwritten by pull.
+You have modified these files locally, and they were also modified remotely.
+To avoid losing your changes, push first or use --force to overwrite.`,
+            resolutionSteps: [
+              "1. Run 'gitgov sync push' to push your local changes first",
+              "   \u2192 This will trigger a rebase and let you resolve conflicts properly",
+              "2. Or run 'gitgov sync pull --force' to discard your local changes"
+            ]
+          };
+          result.error = "Aborting pull: local changes would be overwritten by remote changes";
+          logger6.warn(`[pullState] Aborting: local changes to ${localModifiedFiles.length} file(s) would be overwritten by pull`);
+          return result;
+        }
+      }
+      log("[EARS-61] No conflicting local changes (or force enabled), proceeding with pull...");
       try {
         await this.git.pullRebase("origin", stateBranch);
       } catch (error) {
@@ -12457,7 +13028,10 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
       const hashAfter = commitAfter[0]?.hash;
       const hasNewChanges = hashBefore !== hashAfter;
       result.hasChanges = hasNewChanges;
-      if (hasNewChanges || forceReindex) {
+      const indexPath = path6__default.join(pullRepoRoot, ".gitgov", "index.json");
+      const indexExists = await promises.access(indexPath).then(() => true).catch(() => false);
+      const shouldReindex = hasNewChanges || forceReindex || !indexExists;
+      if (shouldReindex) {
         result.reindexed = true;
         if (hasNewChanges && hashBefore && hashAfter) {
           const changedFiles = await this.git.getChangedFiles(
@@ -12467,13 +13041,6 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
           );
           result.filesUpdated = changedFiles.length;
         }
-        logger6.info("Invoking IndexerAdapter.generateIndex() after pull...");
-        try {
-          await this.indexer.generateIndex();
-          logger6.info("Index regenerated successfully");
-        } catch (error) {
-          logger6.warn(`Failed to regenerate index: ${error.message}`);
-        }
       }
       const gitgovPath = path6__default.join(pullRepoRoot, ".gitgov");
       const gitgovExists = await promises.access(gitgovPath).then(() => true).catch(() => false);
@@ -12518,6 +13085,15 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
           logger6.warn(`[pullState] Failed to restore .gitgov/ to filesystem: ${error.message}`);
         }
       }
+      if (shouldReindex) {
+        logger6.info("Invoking IndexerAdapter.generateIndex() after pull...");
+        try {
+          await this.indexer.generateIndex();
+          logger6.info("Index regenerated successfully");
+        } catch (error) {
+          logger6.warn(`Failed to regenerate index: ${error.message}`);
+        }
+      }
       result.success = true;
       log(`=== pullState COMPLETED: ${hasNewChanges ? "new changes pulled" : "no changes"}, reindexed: ${result.reindexed} ===`);
       return result;
@@ -12531,25 +13107,37 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
     }
   }
   /**
-   * Resolves state conflicts in a governed manner.
-   * Updates resolved Records (recalculates checksum and adds resolver signature),
-   * creates rebase and resolution commits signed according to protocol.
+   * Resolves state conflicts in a governed manner (Git-Native).
+   *
+   * Git-Native Flow:
+   * 1. User resolves conflicts using standard Git tools (edit files, remove markers)
+   * 2. User stages resolved files: git add .gitgov/
+   * 3. User runs: gitgov sync resolve --reason "reason"
+   *
+   * This method:
+   * - Verifies that a rebase is in progress
+   * - Checks that no conflict markers remain in staged files
+   * - Updates resolved Records with new checksums and signatures
+   * - Continues the git rebase (git rebase --continue)
+   * - Creates a signed resolution commit
+   * - Regenerates the index
    *
    * [EARS-17 through EARS-23]
    */
   async resolveConflict(options) {
     const { reason, actorId } = options;
     const log = (msg) => logger6.debug(`[resolveConflict] ${msg}`);
-    log("=== STARTING resolveConflict ===");
-    log("Phase 0: Verifying rebase state...");
+    log("=== STARTING resolveConflict (Git-Native) ===");
+    log("Phase 0: Verifying rebase in progress...");
     const rebaseInProgress = await this.isRebaseInProgress();
     if (!rebaseInProgress) {
       throw new NoRebaseInProgressError();
     }
+    log("Conflict mode: rebase_conflict (Git-Native)");
     console.log("[resolveConflict] Getting staged files...");
     const allStagedFiles = await this.git.getStagedFiles();
     console.log("[resolveConflict] All staged files:", allStagedFiles);
-    const resolvedRecords = allStagedFiles.filter(
+    let resolvedRecords = allStagedFiles.filter(
       (f) => f.startsWith(".gitgov/") && f.endsWith(".json")
     );
     console.log("[resolveConflict] Resolved Records (staged .gitgov/*.json):", resolvedRecords);
@@ -12559,7 +13147,33 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
     if (filesWithMarkers.length > 0) {
       throw new ConflictMarkersPresentError(filesWithMarkers);
     }
-    console.log("[resolveConflict] Updating resolved Records...");
+    let rebaseCommitHash = "";
+    console.log("[resolveConflict] Step 4: Calling git.rebaseContinue()...");
+    await this.git.rebaseContinue();
+    console.log("[resolveConflict] rebaseContinue completed successfully");
+    const currentBranch = await this.git.getCurrentBranch();
+    const rebaseCommit = await this.git.getCommitHistory(currentBranch, {
+      maxCount: 1
+    });
+    rebaseCommitHash = rebaseCommit[0]?.hash ?? "";
+    if (resolvedRecords.length === 0 && rebaseCommitHash) {
+      console.log("[resolveConflict] No staged files detected, getting files from rebase commit...");
+      const repoRoot2 = await this.git.getRepoRoot();
+      try {
+        const { stdout } = await execAsync(
+          `git diff-tree --no-commit-id --name-only -r ${rebaseCommitHash}`,
+          { cwd: repoRoot2 }
+        );
+        const commitFiles = stdout.trim().split("\n").filter((f) => f);
+        resolvedRecords = commitFiles.filter(
+          (f) => f.startsWith(".gitgov/") && f.endsWith(".json")
+        );
+        console.log("[resolveConflict] Files from rebase commit:", resolvedRecords);
+      } catch (e) {
+        console.log("[resolveConflict] Could not get files from rebase commit:", e);
+      }
+    }
+    console.log("[resolveConflict] Updating resolved Records with signatures...");
     if (resolvedRecords.length > 0) {
       const currentActor = await this.identity.getCurrentActor();
       console.log("[resolveConflict] Current actor:", currentActor);
@@ -12567,8 +13181,8 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
       for (const filePath of resolvedRecords) {
         console.log("[resolveConflict] Processing Record:", filePath);
         try {
-          const repoRoot = await this.git.getRepoRoot();
-          const fullPath = join(repoRoot, filePath);
+          const repoRoot2 = await this.git.getRepoRoot();
+          const fullPath = join(repoRoot2, filePath);
           const content = readFileSync(fullPath, "utf-8");
           const record = JSON.parse(content);
           if (!record.header || !record.payload) {
@@ -12577,7 +13191,8 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
           const signedRecord = await this.identity.signRecord(
             record,
             currentActor.id,
-            "resolver"
+            "resolver",
+            `Conflict resolved: ${reason}`
           );
           writeFileSync(fullPath, JSON.stringify(signedRecord, null, 2) + "\n", "utf-8");
           logger6.info(`Updated Record: ${filePath} (new checksum + resolver signature)`);
@@ -12587,20 +13202,12 @@ Files: ${delta.length} file(s) ${isFirstPush ? "synced (initial)" : "changed"}
           console.log("[resolveConflict] Error updating Record:", filePath, error);
         }
       }
-      console.log("[resolveConflict] All Records updated, re-staging...");
+      console.log("[resolveConflict] All Records updated, staging...");
     }
-    console.log("[resolveConflict] Re-staging .gitgov/ with updated metadata...");
+    console.log("[resolveConflict] Staging .gitgov/ with updated metadata...");
     await this.git.add([".gitgov"], { force: true });
-    console.log("[resolveConflict] Step 6: Calling git.rebaseContinue() (THIS MAY HANG)...");
-    await this.git.rebaseContinue();
-    console.log("[resolveConflict] rebaseContinue completed successfully");
-    const currentBranch = await this.git.getCurrentBranch();
-    const rebaseCommit = await this.git.getCommitHistory(currentBranch, {
-      maxCount: 1
-    });
-    const rebaseCommitHash = rebaseCommit[0]?.hash ?? "";
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-    const resolutionMessage = `resolution: Conflict resolved by ${actorId}
+    const resolutionMessage = `resolution: conflict resolved by ${actorId}
 
 Actor: ${actorId}
 Timestamp: ${timestamp}
@@ -12608,9 +13215,116 @@ Reason: ${reason}
 Files: ${resolvedRecords.length} file(s) resolved
 
 Signed-off-by: ${actorId}`;
-    const resolutionCommitHash = await this.git.commitAllowEmpty(
-      resolutionMessage
-    );
+    let resolutionCommitHash = "";
+    try {
+      resolutionCommitHash = await this.git.commit(resolutionMessage);
+    } catch (commitError) {
+      const stdout = commitError.stdout || "";
+      const stderr = commitError.stderr || "";
+      const isNothingToCommit = stdout.includes("nothing to commit") || stderr.includes("nothing to commit") || stdout.includes("nothing added to commit") || stderr.includes("nothing added to commit");
+      if (isNothingToCommit) {
+        log("No additional changes to commit (no records needed re-signing)");
+        resolutionCommitHash = rebaseCommitHash;
+      } else {
+        throw commitError;
+      }
+    }
+    log("Pushing resolved state to remote...");
+    try {
+      await this.git.push("origin", "gitgov-state");
+      log("Push successful");
+    } catch (pushError) {
+      const pushErrorMsg = pushError instanceof Error ? pushError.message : String(pushError);
+      log(`Push failed (non-fatal): ${pushErrorMsg}`);
+    }
+    log("Returning to original branch and restoring .gitgov/ files...");
+    const repoRoot = await this.git.getRepoRoot();
+    const gitgovDir = path6__default.join(repoRoot, ".gitgov");
+    const tempDir = path6__default.join(os.tmpdir(), `gitgov-resolve-${Date.now()}`);
+    await promises.mkdir(tempDir, { recursive: true });
+    log(`Created temp directory for local files: ${tempDir}`);
+    for (const fileName of LOCAL_ONLY_FILES) {
+      const srcPath = path6__default.join(gitgovDir, fileName);
+      const destPath = path6__default.join(tempDir, fileName);
+      try {
+        await promises.access(srcPath);
+        await promises.cp(srcPath, destPath, { force: true });
+        log(`Saved LOCAL_ONLY_FILE to temp: ${fileName}`);
+      } catch {
+      }
+    }
+    const saveExcludedFiles = async (srcDir, destDir) => {
+      try {
+        const entries = await promises.readdir(srcDir, { withFileTypes: true });
+        for (const entry of entries) {
+          const srcPath = path6__default.join(srcDir, entry.name);
+          const dstPath = path6__default.join(destDir, entry.name);
+          if (entry.isDirectory()) {
+            await promises.mkdir(dstPath, { recursive: true });
+            await saveExcludedFiles(srcPath, dstPath);
+          } else {
+            const isExcluded = SYNC_EXCLUDED_PATTERNS.some((pattern) => pattern.test(entry.name));
+            if (isExcluded) {
+              await promises.mkdir(path6__default.dirname(dstPath), { recursive: true });
+              await promises.copyFile(srcPath, dstPath);
+              log(`Saved EXCLUDED file to temp: ${entry.name}`);
+            }
+          }
+        }
+      } catch {
+      }
+    };
+    await saveExcludedFiles(gitgovDir, tempDir);
+    try {
+      await execAsync("git checkout -", { cwd: repoRoot });
+      log("Returned to original branch");
+    } catch (checkoutError) {
+      log(`Warning: Could not return to original branch: ${checkoutError}`);
+    }
+    log("Restoring .gitgov/ from gitgov-state...");
+    try {
+      await this.git.checkoutFilesFromBranch("gitgov-state", [".gitgov/"]);
+      await execAsync("git reset HEAD .gitgov/ 2>/dev/null || true", { cwd: repoRoot });
+      log("Restored .gitgov/ from gitgov-state (unstaged)");
+    } catch (checkoutFilesError) {
+      log(`Warning: Could not restore .gitgov/ from gitgov-state: ${checkoutFilesError}`);
+    }
+    for (const fileName of LOCAL_ONLY_FILES) {
+      const srcPath = path6__default.join(tempDir, fileName);
+      const destPath = path6__default.join(gitgovDir, fileName);
+      try {
+        await promises.access(srcPath);
+        await promises.cp(srcPath, destPath, { force: true });
+        log(`Restored LOCAL_ONLY_FILE from temp: ${fileName}`);
+      } catch {
+      }
+    }
+    const restoreExcludedFiles = async (srcDir, destDir) => {
+      try {
+        const entries = await promises.readdir(srcDir, { withFileTypes: true });
+        for (const entry of entries) {
+          const srcPath = path6__default.join(srcDir, entry.name);
+          const dstPath = path6__default.join(destDir, entry.name);
+          if (entry.isDirectory()) {
+            await restoreExcludedFiles(srcPath, dstPath);
+          } else {
+            const isExcluded = SYNC_EXCLUDED_PATTERNS.some((pattern) => pattern.test(entry.name));
+            if (isExcluded) {
+              await promises.mkdir(path6__default.dirname(dstPath), { recursive: true });
+              await promises.copyFile(srcPath, dstPath);
+              log(`Restored EXCLUDED file from temp: ${entry.name}`);
+            }
+          }
+        }
+      } catch {
+      }
+    };
+    await restoreExcludedFiles(tempDir, gitgovDir);
+    try {
+      await promises.rm(tempDir, { recursive: true, force: true });
+      log("Temp directory cleaned up");
+    } catch {
+    }
     logger6.info("Invoking IndexerAdapter.generateIndex() after conflict resolution...");
     try {
       await this.indexer.generateIndex();