@harness-engineering/orchestrator 0.3.2 → 0.4.1

package/dist/index.js

@@ -72,6 +72,7 @@ __export(index_exports, {
   savePublishedIndex: () => savePublishedIndex,
   selectCandidates: () => selectCandidates,
   sortCandidates: () => sortCandidates,
+  syncMain: () => syncMain,
   triageIssue: () => triageIssue,
   validateWorkflowConfig: () => validateWorkflowConfig
 });
@@ -649,6 +650,56 @@ function reconcileCompletedAndClaimed(next, candidates, nowMs, effects) {
     }
   }
 }
+function gatherSignalsAndPersona(issue, event) {
+  const signals = [...event.concernSignals?.get(issue.id) ?? []];
+  let suggestedPersona;
+  try {
+    const personaRecs = event.personaRecommendations?.get(issue.id);
+    if (personaRecs && personaRecs.length > 0) {
+      suggestedPersona = personaRecs[0].persona;
+      if (personaRecs[0].weightedScore < 0.3) {
+        signals.push({
+          name: "lowExpertise",
+          reason: `Top persona "${suggestedPersona}" scored ${personaRecs[0].weightedScore.toFixed(2)} (below 0.3 threshold)`
+        });
+      }
+    } else if (personaRecs && personaRecs.length === 0) {
+      signals.push({
+        name: "noPersonaMatch",
+        reason: "No persona recommendations available for this issue's systems"
+      });
+    }
+  } catch {
+  }
+  return { signals, suggestedPersona };
+}
+function attachPersonaToLastClaim(effects, suggestedPersona) {
+  if (!suggestedPersona) return;
+  const lastEffect = effects[effects.length - 1];
+  if (lastEffect && lastEffect.type === "claim") {
+    lastEffect.suggestedPersona = suggestedPersona;
+  }
+}
+function dispatchEligibleIssue(next, issue, event, escalationConfig, config, effects) {
+  const scopeTier = detectScopeTier(issue, artifactPresenceFromIssue(issue));
+  const { signals, suggestedPersona } = gatherSignalsAndPersona(issue, event);
+  const decision = routeIssue(scopeTier, signals, escalationConfig);
+  if (decision.action === "needs-human") {
+    next.claimed.add(issue.id);
+    effects.push(
+      buildEscalateEffect(issue.id, issue.identifier, decision.reasons, {
+        issueTitle: issue.title,
+        issueDescription: issue.description,
+        enrichedSpec: event.enrichedSpecs?.get(issue.id),
+        complexityScore: event.complexityScores?.get(issue.id)
+      })
+    );
+    return;
+  }
+  const backend = resolveBackend(decision.action, !!config.agent.localBackend);
+  claimAndDispatch(next, issue, backend, event.nowMs, effects);
+  attachPersonaToLastClaim(effects, suggestedPersona);
+}
 function handleTick(state, event, config) {
   const { candidates, runningStates, nowMs } = event;
   const next = cloneState(state);
@@ -679,48 +730,7 @@ function handleTick(state, event, config) {
       effects.push(peslAbort);
       continue;
     }
-    const scopeTier = detectScopeTier(issue, artifactPresenceFromIssue(issue));
-    const signals = [...event.concernSignals?.get(issue.id) ?? []];
-    let suggestedPersona;
-    try {
-      const personaRecs = event.personaRecommendations?.get(issue.id);
-      if (personaRecs && personaRecs.length > 0) {
-        suggestedPersona = personaRecs[0].persona;
-        if (personaRecs[0].weightedScore < 0.3) {
-          signals.push({
-            name: "lowExpertise",
-            reason: `Top persona "${suggestedPersona}" scored ${personaRecs[0].weightedScore.toFixed(2)} (below 0.3 threshold)`
-          });
-        }
-      } else if (personaRecs && personaRecs.length === 0) {
-        signals.push({
-          name: "noPersonaMatch",
-          reason: "No persona recommendations available for this issue's systems"
-        });
-      }
-    } catch {
-    }
-    const decision = routeIssue(scopeTier, signals, escalationConfig);
-    if (decision.action === "needs-human") {
-      next.claimed.add(issue.id);
-      effects.push(
-        buildEscalateEffect(issue.id, issue.identifier, decision.reasons, {
-          issueTitle: issue.title,
-          issueDescription: issue.description,
-          enrichedSpec: event.enrichedSpecs?.get(issue.id),
-          complexityScore: event.complexityScores?.get(issue.id)
-        })
-      );
-      continue;
-    }
-    const backend = resolveBackend(decision.action, !!config.agent.localBackend);
-    claimAndDispatch(next, issue, backend, nowMs, effects);
-    if (suggestedPersona) {
-      const lastEffect = effects[effects.length - 1];
-      if (lastEffect && lastEffect.type === "claim") {
-        lastEffect.suggestedPersona = suggestedPersona;
-      }
-    }
+    dispatchEligibleIssue(next, issue, event, escalationConfig, config, effects);
   }
   pruneCompleted(next);
   return { nextState: next, effects };
@@ -1916,11 +1926,11 @@ var BackendsMapSchema = import_zod2.z.record(import_zod2.z.string(), BackendDefS
 function crossFieldRoutingIssues(backends, routing) {
   const issues = [];
   const names = new Set(Object.keys(backends));
-  const checkRef = (path16, name) => {
+  const checkRef = (path17, name) => {
     if (name !== void 0 && !names.has(name)) {
       issues.push({
-        path: path16,
-        message: `routing.${path16.join(".")} references unknown backend '${name}'. Defined: [${[...names].join(", ")}].`
+        path: path17,
+        message: `routing.${path17.join(".")} references unknown backend '${name}'. Defined: [${[...names].join(", ")}].`
       });
     }
   };
@@ -2279,8 +2289,11 @@ var WorkspaceManager = class {
   config;
   /** Absolute path to the git repository root (resolved lazily). */
   repoRoot = null;
-  constructor(config) {
+  /** Phase 3 (D6): emit baseref_fallback when fallback chain selects a local-only ref. */
+  emitEvent;
+  constructor(config, options = {}) {
     this.config = config;
+    this.emitEvent = options.emitEvent ?? null;
   }
   /** Runs a git command and returns stdout. Extracted for testability. */
   async git(args, cwd) {
@@ -2365,9 +2378,14 @@ var WorkspaceManager = class {
    * Priority order:
    *   1. `config.baseRef` (explicit override). Throws if it doesn't resolve.
    *   2. Default branch via `git symbolic-ref --short refs/remotes/origin/HEAD`.
-   *   3. Common fallbacks: `origin/main`, `origin/master`, `main`, `master`.
-   *   4. `HEAD` as an ultimate fallback (preserves old behavior for unusual
-   *      repos without any of the above).
+   *   3. Remote fallbacks: `origin/main`, `origin/master`. (No event.)
+   *   4. Local-only fallbacks: `main`, `master`. (Emits `baseref_fallback`.)
+   *   5. `HEAD` as ultimate fallback. (Emits `baseref_fallback`.)
+   *
+   * Phase 3 / spec D6 / R4: when the priority chain falls past `origin/*`
+   * to a local-only ref, the optional `emitEvent` callback (if injected)
+   * is invoked exactly once with `{ kind: 'baseref_fallback', ref, repoRoot }`
+   * so operators are warned when the remote is misconfigured or unreachable.
    */
   async resolveBaseRef(repoRoot) {
     const configured = this.config.baseRef;
@@ -2386,11 +2404,30 @@ var WorkspaceManager = class {
       if (detected) return detected;
     } catch {
     }
-    for (const candidate of ["origin/main", "origin/master", "main", "master"]) {
+    for (const candidate of ["origin/main", "origin/master"]) {
       if (await this.refExists(candidate, repoRoot)) return candidate;
     }
+    for (const candidate of ["main", "master"]) {
+      if (await this.refExists(candidate, repoRoot)) {
+        this.emitFallback(candidate, repoRoot);
+        return candidate;
+      }
+    }
+    this.emitFallback("HEAD", repoRoot);
     return "HEAD";
   }
+  /**
+   * Phase 3 (D6): emit a `baseref_fallback` event via the injected
+   * callback (if any). Errors from the callback are swallowed so a
+   * broken emitter does not block worktree dispatch.
+   */
+  emitFallback(ref, repoRoot) {
+    if (!this.emitEvent) return;
+    try {
+      this.emitEvent({ kind: "baseref_fallback", ref, repoRoot });
+    } catch {
+    }
+  }
   /** Returns true iff `git rev-parse --verify` accepts the ref. */
   async refExists(ref, repoRoot) {
     try {
@@ -2672,11 +2709,9 @@ var PromptRenderer = class {
 
 // src/orchestrator.ts
 var import_node_events = require("events");
-var path15 = __toESM(require("path"));
+var path16 = __toESM(require("path"));
 var import_node_crypto7 = require("crypto");
-var import_core9 = require("@harness-engineering/core");
-var import_intelligence4 = require("@harness-engineering/intelligence");
-var import_graph = require("@harness-engineering/graph");
+var import_core10 = require("@harness-engineering/core");
 
 // src/intelligence/pipeline-runner.ts
 var path7 = __toESM(require("path"));
@@ -3237,7 +3272,83 @@ var CompletionHandler = class {
 };
 
 // src/orchestrator.ts
-var import_core10 = require("@harness-engineering/core");
+var import_core11 = require("@harness-engineering/core");
+
+// src/tracker/adapters/github-issues-issue-tracker.ts
+var import_types9 = require("@harness-engineering/types");
+var GitHubIssuesIssueTrackerAdapter = class {
+  client;
+  config;
+  constructor(client, config) {
+    this.client = client;
+    this.config = config;
+  }
+  async fetchCandidateIssues() {
+    return this.fetchIssuesByStates(this.config.activeStates);
+  }
+  async fetchIssuesByStates(stateNames) {
+    const r = await this.client.fetchByStatus(
+      stateNames
+    );
+    if (!r.ok) return (0, import_types9.Err)(r.error);
+    return (0, import_types9.Ok)(r.value.map((f) => this.mapTrackedToIssue(f)));
+  }
+  async fetchIssueStatesByIds(issueIds) {
+    const r = await this.client.fetchAll();
+    if (!r.ok) return (0, import_types9.Err)(r.error);
+    const wanted = new Set(issueIds);
+    const out = /* @__PURE__ */ new Map();
+    for (const f of r.value.features) {
+      if (wanted.has(f.externalId)) out.set(f.externalId, this.mapTrackedToIssue(f));
+    }
+    return (0, import_types9.Ok)(out);
+  }
+  async claimIssue(issueId, orchestratorId) {
+    const r = await this.client.claim(issueId, orchestratorId);
+    if (!r.ok) return (0, import_types9.Err)(r.error);
+    return (0, import_types9.Ok)(void 0);
+  }
+  async releaseIssue(issueId) {
+    const r = await this.client.release(issueId);
+    if (!r.ok) return (0, import_types9.Err)(r.error);
+    return (0, import_types9.Ok)(void 0);
+  }
+  async markIssueComplete(issueId) {
+    const r = await this.client.complete(issueId);
+    if (!r.ok) return (0, import_types9.Err)(r.error);
+    return (0, import_types9.Ok)(void 0);
+  }
+  /**
+   * Project a wide-interface `TrackedFeature` onto the small-interface
+   * `Issue` shape consumed by the orchestrator's tick loop.
+   */
+  mapTrackedToIssue(f) {
+    return {
+      id: f.externalId,
+      identifier: f.externalId,
+      title: f.name,
+      description: f.summary,
+      priority: null,
+      state: f.status,
+      branchName: null,
+      url: null,
+      labels: [],
+      spec: f.spec,
+      plans: f.plans,
+      blockedBy: f.blockedBy.map(
+        (b) => ({
+          id: null,
+          identifier: b,
+          state: null
+        })
+      ),
+      createdAt: f.createdAt,
+      updatedAt: f.updatedAt,
+      externalId: f.externalId,
+      assignee: f.assignee
+    };
+  }
+};
 
 // src/agent/runner.ts
 var MAX_SLEEP_MS = 12 * 60 * 6e4;
@@ -3539,9 +3650,17 @@ var LocalModelResolver = class {
 
 // src/agent/config-migration.ts
 var MIGRATION_GUIDE = "docs/guides/multi-backend-routing.md";
-function migrateAgentConfig(agent) {
-  const warnings = [];
-  const legacyFields = [
+var CASE1_ALWAYS_SUPPRESS = /* @__PURE__ */ new Set(["agent.backend"]);
+var CASE1_LOCAL_GROUP = /* @__PURE__ */ new Set([
+  "agent.localBackend",
+  "agent.localEndpoint",
+  "agent.localModel",
+  "agent.localApiKey",
+  "agent.localTimeoutMs",
+  "agent.localProbeIntervalMs"
+]);
+function detectLegacyFields(agent) {
+  const fields = [
     { path: "agent.backend", present: agent.backend !== void 0 && agent.backend !== "" },
     { path: "agent.command", present: agent.command !== void 0 },
     { path: "agent.model", present: agent.model !== void 0 },
@@ -3553,56 +3672,73 @@ function migrateAgentConfig(agent) {
     { path: "agent.localTimeoutMs", present: agent.localTimeoutMs !== void 0 },
     { path: "agent.localProbeIntervalMs", present: agent.localProbeIntervalMs !== void 0 }
   ];
-  const presentLegacy = legacyFields.filter((f) => f.present).map((f) => f.path);
-  const CASE1_ALWAYS_SUPPRESS = /* @__PURE__ */ new Set(["agent.backend"]);
-  const CASE1_LOCAL_GROUP = /* @__PURE__ */ new Set([
-    "agent.localBackend",
-    "agent.localEndpoint",
-    "agent.localModel",
-    "agent.localApiKey",
-    "agent.localTimeoutMs",
-    "agent.localProbeIntervalMs"
-  ]);
-  const suppressLocalGroup = agent.localBackend !== void 0;
-  if (agent.backends !== void 0) {
-    for (const path16 of presentLegacy) {
-      if (CASE1_ALWAYS_SUPPRESS.has(path16)) continue;
-      if (suppressLocalGroup && CASE1_LOCAL_GROUP.has(path16)) continue;
-      warnings.push(
-        `Ignoring legacy field '${path16}': 'agent.backends' is set and takes precedence. See ${MIGRATION_GUIDE}.`
-      );
-    }
-    return { config: agent, warnings };
-  }
-  if (presentLegacy.length === 0) {
-    return { config: agent, warnings };
+  return fields.filter((f) => f.present).map((f) => f.path);
+}
+function buildCase1Warnings(presentLegacy, suppressLocalGroup) {
+  const warnings = [];
+  for (const path17 of presentLegacy) {
+    if (CASE1_ALWAYS_SUPPRESS.has(path17)) continue;
+    if (suppressLocalGroup && CASE1_LOCAL_GROUP.has(path17)) continue;
+    warnings.push(
+      `Ignoring legacy field '${path17}': 'agent.backends' is set and takes precedence. See ${MIGRATION_GUIDE}.`
+    );
   }
-  const backends = {};
+  return warnings;
+}
+function synthesizeBackendsAndRouting(agent) {
+  const backends = { primary: synthesizePrimary(agent) };
   const routing = { default: "primary" };
-  backends.primary = synthesizePrimary(agent);
   if (agent.localBackend !== void 0) {
     backends.local = synthesizeLocal(agent);
+    const autoExec = agent.escalation?.autoExecute ?? [];
+    for (const tier of autoExec) routing[tier] = "local";
   }
-  const autoExec = agent.escalation?.autoExecute ?? [];
-  if (backends.local !== void 0) {
-    for (const tier of autoExec) {
-      routing[tier] = "local";
-    }
+  return { backends, routing };
+}
+function migrateAgentConfig(agent) {
+  const presentLegacy = detectLegacyFields(agent);
+  if (agent.backends !== void 0) {
+    return {
+      config: agent,
+      warnings: buildCase1Warnings(presentLegacy, agent.localBackend !== void 0)
+    };
   }
-  for (const path16 of presentLegacy) {
-    warnings.push(
-      `Deprecated config field '${path16}' is in use. Migrate to 'agent.backends' / 'agent.routing'. See ${MIGRATION_GUIDE}.`
-    );
+  if (presentLegacy.length === 0) {
+    return { config: agent, warnings: [] };
   }
+  const { backends, routing } = synthesizeBackendsAndRouting(agent);
+  const warnings = presentLegacy.map(
+    (path17) => `Deprecated config field '${path17}' is in use. Migrate to 'agent.backends' / 'agent.routing'. See ${MIGRATION_GUIDE}.`
+  );
   return {
-    config: {
-      ...agent,
-      backends,
-      routing
-    },
+    config: { ...agent, backends, routing },
     warnings
   };
 }
+function buildRemoteBackend(type, agent, context) {
+  if (agent.model === void 0) {
+    throw new Error(`migrateAgentConfig: ${context} requires agent.model`);
+  }
+  const def = { type, model: agent.model };
+  if (agent.apiKey !== void 0) def.apiKey = agent.apiKey;
+  return def;
+}
+function buildLocalConnectionBackend(type, agent, context) {
+  if (agent.localEndpoint === void 0 || agent.localModel === void 0) {
+    throw new Error(
+      `migrateAgentConfig: ${context} requires agent.localEndpoint and agent.localModel`
+    );
+  }
+  const def = {
+    type,
+    endpoint: agent.localEndpoint,
+    model: agent.localModel
+  };
+  if (agent.localApiKey !== void 0) def.apiKey = agent.localApiKey;
+  if (agent.localTimeoutMs !== void 0) def.timeoutMs = agent.localTimeoutMs;
+  if (agent.localProbeIntervalMs !== void 0) def.probeIntervalMs = agent.localProbeIntervalMs;
+  return def;
+}
 function synthesizePrimary(agent) {
   const backend = agent.backend;
   switch (backend) {
@@ -3613,64 +3749,13 @@ function synthesizePrimary(agent) {
       if (agent.command !== void 0) def.command = agent.command;
       return def;
     }
-    case "anthropic": {
-      if (agent.model === void 0) {
-        throw new Error("migrateAgentConfig: agent.backend='anthropic' requires agent.model");
-      }
-      const def = { type: "anthropic", model: agent.model };
-      if (agent.apiKey !== void 0) def.apiKey = agent.apiKey;
-      return def;
-    }
-    case "openai": {
-      if (agent.model === void 0) {
-        throw new Error("migrateAgentConfig: agent.backend='openai' requires agent.model");
-      }
-      const def = { type: "openai", model: agent.model };
-      if (agent.apiKey !== void 0) def.apiKey = agent.apiKey;
-      return def;
-    }
-    case "gemini": {
-      if (agent.model === void 0) {
-        throw new Error("migrateAgentConfig: agent.backend='gemini' requires agent.model");
-      }
-      const def = { type: "gemini", model: agent.model };
-      if (agent.apiKey !== void 0) def.apiKey = agent.apiKey;
-      return def;
-    }
-    case "local": {
-      if (agent.localEndpoint === void 0 || agent.localModel === void 0) {
-        throw new Error(
-          "migrateAgentConfig: agent.backend='local' requires agent.localEndpoint and agent.localModel"
-        );
-      }
-      const def = {
-        type: "local",
-        endpoint: agent.localEndpoint,
-        model: agent.localModel
-      };
-      if (agent.localApiKey !== void 0) def.apiKey = agent.localApiKey;
-      if (agent.localTimeoutMs !== void 0) def.timeoutMs = agent.localTimeoutMs;
-      if (agent.localProbeIntervalMs !== void 0)
-        def.probeIntervalMs = agent.localProbeIntervalMs;
-      return def;
-    }
-    case "pi": {
-      if (agent.localEndpoint === void 0 || agent.localModel === void 0) {
-        throw new Error(
-          "migrateAgentConfig: agent.backend='pi' requires agent.localEndpoint and agent.localModel"
-        );
-      }
-      const def = {
-        type: "pi",
-        endpoint: agent.localEndpoint,
-        model: agent.localModel
-      };
-      if (agent.localApiKey !== void 0) def.apiKey = agent.localApiKey;
-      if (agent.localTimeoutMs !== void 0) def.timeoutMs = agent.localTimeoutMs;
-      if (agent.localProbeIntervalMs !== void 0)
-        def.probeIntervalMs = agent.localProbeIntervalMs;
-      return def;
-    }
+    case "anthropic":
+    case "openai":
+    case "gemini":
+      return buildRemoteBackend(backend, agent, `agent.backend='${backend}'`);
+    case "local":
+    case "pi":
+      return buildLocalConnectionBackend(backend, agent, `agent.backend='${backend}'`);
     default:
       throw new Error(
         `migrateAgentConfig: unknown legacy backend '${String(backend)}'. Expected one of: mock, claude, anthropic, openai, gemini, local, pi.`
@@ -3681,31 +3766,8 @@ function synthesizeLocal(agent) {
   if (agent.localBackend === void 0) {
     throw new Error("synthesizeLocal called without agent.localBackend");
   }
-  if (agent.localEndpoint === void 0 || agent.localModel === void 0) {
-    throw new Error(
-      "migrateAgentConfig: agent.localBackend requires agent.localEndpoint and agent.localModel"
-    );
-  }
-  if (agent.localBackend === "pi") {
-    const def2 = {
-      type: "pi",
-      endpoint: agent.localEndpoint,
-      model: agent.localModel
-    };
-    if (agent.localApiKey !== void 0) def2.apiKey = agent.localApiKey;
-    if (agent.localTimeoutMs !== void 0) def2.timeoutMs = agent.localTimeoutMs;
-    if (agent.localProbeIntervalMs !== void 0) def2.probeIntervalMs = agent.localProbeIntervalMs;
-    return def2;
-  }
-  const def = {
-    type: "local",
-    endpoint: agent.localEndpoint,
-    model: agent.localModel
-  };
-  if (agent.localApiKey !== void 0) def.apiKey = agent.localApiKey;
-  if (agent.localTimeoutMs !== void 0) def.timeoutMs = agent.localTimeoutMs;
-  if (agent.localProbeIntervalMs !== void 0) def.probeIntervalMs = agent.localProbeIntervalMs;
-  return def;
+  const type = agent.localBackend === "pi" ? "pi" : "local";
+  return buildLocalConnectionBackend(type, agent, "agent.localBackend");
 }
 
 // src/agent/backend-router.ts
@@ -3758,8 +3820,8 @@ var BackendRouter = class {
   validateReferences() {
     const known = new Set(Object.keys(this.backends));
     const missing = [];
-    const check = (path16, name) => {
-      if (name !== void 0 && !known.has(name)) missing.push({ path: path16, name });
+    const check = (path17, name) => {
+      if (name !== void 0 && !known.has(name)) missing.push({ path: path17, name });
     };
     check("default", this.routing.default);
     check("quick-fix", this.routing["quick-fix"]);
@@ -3769,7 +3831,7 @@ var BackendRouter = class {
     check("intelligence.sel", this.routing.intelligence?.sel);
     check("intelligence.pesl", this.routing.intelligence?.pesl);
     if (missing.length > 0) {
-      const detail = missing.map(({ path: path16, name }) => `routing.${path16} -> '${name}'`).join("; ");
+      const detail = missing.map(({ path: path17, name }) => `routing.${path17} -> '${name}'`).join("; ");
       const known_ = [...known].join(", ") || "(none)";
       throw new Error(
         `BackendRouter: routing references unknown backend(s): ${detail}. Defined backends: [${known_}].`
@@ -3782,13 +3844,13 @@ var BackendRouter = class {
 var import_node_child_process4 = require("child_process");
 var readline = __toESM(require("readline"));
 var import_node_crypto3 = require("crypto");
-var import_types9 = require("@harness-engineering/types");
+var import_types10 = require("@harness-engineering/types");
 function resolveExitCode(code, command, resolve6) {
   if (code === 0) {
-    resolve6((0, import_types9.Ok)(void 0));
+    resolve6((0, import_types10.Ok)(void 0));
   } else {
     resolve6(
-      (0, import_types9.Err)({
+      (0, import_types10.Err)({
         category: "agent_not_found",
         message: `Claude command '${command}' not found or failed`
       })
@@ -3796,7 +3858,7 @@ function resolveExitCode(code, command, resolve6) {
   }
 }
 function resolveSpawnError(command, resolve6) {
-  resolve6((0, import_types9.Err)({ category: "agent_not_found", message: `Claude command '${command}' not found` }));
+  resolve6((0, import_types10.Err)({ category: "agent_not_found", message: `Claude command '${command}' not found` }));
 }
 var JUST_PAST_GRACE_MS = 5 * 6e4;
 var PRIMARY_LIMIT_RE = /You[\u2019']ve hit your limit.*resets\s+(\d{1,2}(?::\d{2})?\s*(?:am|pm))\s*\(([^)]+)\)/i;
@@ -3995,7 +4057,7 @@ var ClaudeBackend = class {
       backendName: this.name,
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    return (0, import_types9.Ok)(session);
+    return (0, import_types10.Ok)(session);
   }
   async *runTurn(session, params) {
     const args = [
@@ -4119,7 +4181,7 @@ var ClaudeBackend = class {
     };
   }
   async stopSession(_session) {
-    return (0, import_types9.Ok)(void 0);
+    return (0, import_types10.Ok)(void 0);
   }
   async healthCheck() {
     return new Promise((resolve6) => {
@@ -4132,7 +4194,7 @@ var ClaudeBackend = class {
 
 // src/agent/backends/anthropic.ts
 var import_sdk = __toESM(require("@anthropic-ai/sdk"));
-var import_types10 = require("@harness-engineering/types");
+var import_types11 = require("@harness-engineering/types");
 var import_core4 = require("@harness-engineering/core");
 var AnthropicBackend = class {
   name = "anthropic";
@@ -4150,7 +4212,7 @@ var AnthropicBackend = class {
   }
   async startSession(params) {
     if (!this.config.apiKey) {
-      return (0, import_types10.Err)({
+      return (0, import_types11.Err)({
         category: "agent_not_found",
         message: "ANTHROPIC_API_KEY is not set"
       });
@@ -4162,7 +4224,7 @@ var AnthropicBackend = class {
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       ...params.systemPrompt !== void 0 && { systemPrompt: params.systemPrompt }
     };
-    return (0, import_types10.Ok)(session);
+    return (0, import_types11.Ok)(session);
   }
   async *runTurn(session, params) {
     const anthropicSession = session;
@@ -4227,22 +4289,22 @@ var AnthropicBackend = class {
     }
   }
   async stopSession(_session) {
-    return (0, import_types10.Ok)(void 0);
+    return (0, import_types11.Ok)(void 0);
   }
   async healthCheck() {
     if (!this.config.apiKey) {
-      return (0, import_types10.Err)({
+      return (0, import_types11.Err)({
         category: "response_error",
         message: "ANTHROPIC_API_KEY is not set"
       });
     }
-    return (0, import_types10.Ok)(void 0);
+    return (0, import_types11.Ok)(void 0);
   }
 };
 
 // src/agent/backends/openai.ts
 var import_openai = __toESM(require("openai"));
-var import_types11 = require("@harness-engineering/types");
+var import_types12 = require("@harness-engineering/types");
 var import_core5 = require("@harness-engineering/core");
 var OpenAIBackend = class {
   name = "openai";
@@ -4259,7 +4321,7 @@ var OpenAIBackend = class {
   }
   async startSession(params) {
     if (!this.config.apiKey) {
-      return (0, import_types11.Err)({
+      return (0, import_types12.Err)({
         category: "agent_not_found",
         message: "OPENAI_API_KEY is not set"
       });
@@ -4271,7 +4333,7 @@ var OpenAIBackend = class {
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       ...params.systemPrompt !== void 0 && { systemPrompt: params.systemPrompt }
     };
-    return (0, import_types11.Ok)(session);
+    return (0, import_types12.Ok)(session);
   }
   async *runTurn(session, params) {
     const openAISession = session;
@@ -4347,14 +4409,14 @@ var OpenAIBackend = class {
     };
   }
   async stopSession(_session) {
-    return (0, import_types11.Ok)(void 0);
+    return (0, import_types12.Ok)(void 0);
   }
   async healthCheck() {
     try {
       await this.client.models.list();
-      return (0, import_types11.Ok)(void 0);
+      return (0, import_types12.Ok)(void 0);
     } catch (err) {
-      return (0, import_types11.Err)({
+      return (0, import_types12.Err)({
         category: "response_error",
         message: err instanceof Error ? err.message : "OpenAI health check failed"
       });
@@ -4364,7 +4426,7 @@ var OpenAIBackend = class {
 
 // src/agent/backends/gemini.ts
 var import_generative_ai = require("@google/generative-ai");
-var import_types12 = require("@harness-engineering/types");
+var import_types13 = require("@harness-engineering/types");
 var import_core6 = require("@harness-engineering/core");
 var GeminiBackend = class {
   name = "gemini";
@@ -4379,7 +4441,7 @@ var GeminiBackend = class {
   }
   async startSession(params) {
     if (!this.config.apiKey) {
-      return (0, import_types12.Err)({
+      return (0, import_types13.Err)({
         category: "agent_not_found",
         message: "GEMINI_API_KEY is not set"
       });
@@ -4391,7 +4453,7 @@ var GeminiBackend = class {
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       ...params.systemPrompt !== void 0 && { systemPrompt: params.systemPrompt }
     };
-    return (0, import_types12.Ok)(session);
+    return (0, import_types13.Ok)(session);
   }
   async *runTurn(session, params) {
     const geminiSession = session;
@@ -4464,15 +4526,15 @@ var GeminiBackend = class {
     };
   }
   async stopSession(_session) {
-    return (0, import_types12.Ok)(void 0);
+    return (0, import_types13.Ok)(void 0);
   }
   async healthCheck() {
     try {
       const genAI = new import_generative_ai.GoogleGenerativeAI(this.config.apiKey);
       genAI.getGenerativeModel({ model: this.config.model });
-      return (0, import_types12.Ok)(void 0);
+      return (0, import_types13.Ok)(void 0);
     } catch (err) {
-      return (0, import_types12.Err)({
+      return (0, import_types13.Err)({
         category: "response_error",
         message: err instanceof Error ? err.message : "Gemini health check failed"
       });
@@ -4482,7 +4544,7 @@ var GeminiBackend = class {
 
 // src/agent/backends/local.ts
 var import_openai2 = __toESM(require("openai"));
-var import_types13 = require("@harness-engineering/types");
+var import_types14 = require("@harness-engineering/types");
 var DEFAULT_TIMEOUT_MS = 9e4;
 var LocalBackend = class {
   name = "local";
@@ -4508,7 +4570,7 @@ var LocalBackend = class {
     if (this.getModel) {
       const candidate = this.getModel();
       if (candidate === null) {
-        return (0, import_types13.Err)({
+        return (0, import_types14.Err)({
           category: "agent_not_found",
           message: "No local model available; check dashboard for details."
         });
@@ -4525,7 +4587,7 @@ var LocalBackend = class {
       resolvedModel,
       ...params.systemPrompt !== void 0 && { systemPrompt: params.systemPrompt }
     };
-    return (0, import_types13.Ok)(session);
+    return (0, import_types14.Ok)(session);
   }
   async *runTurn(session, params) {
     const localSession = session;
@@ -4590,14 +4652,14 @@ var LocalBackend = class {
     };
   }
   async stopSession(_session) {
-    return (0, import_types13.Ok)(void 0);
+    return (0, import_types14.Ok)(void 0);
   }
   async healthCheck() {
     try {
       await this.client.models.list();
-      return (0, import_types13.Ok)(void 0);
+      return (0, import_types14.Ok)(void 0);
     } catch (err) {
-      return (0, import_types13.Err)({
+      return (0, import_types14.Err)({
         category: "response_error",
         message: err instanceof Error ? err.message : "Local backend health check failed"
       });
@@ -4607,7 +4669,7 @@ var LocalBackend = class {
 
 // src/agent/backends/pi.ts
 var import_node_crypto4 = require("crypto");
-var import_types14 = require("@harness-engineering/types");
+var import_types15 = require("@harness-engineering/types");
 var SILENT_EVENTS = /* @__PURE__ */ new Set([
   "turn_end",
   "message_start",
@@ -4724,7 +4786,7 @@ var PiBackend = class {
       if (this.config.getModel) {
         const candidate = this.config.getModel();
         if (candidate === null) {
-          return (0, import_types14.Err)({
+          return (0, import_types15.Err)({
             category: "agent_not_found",
             message: "No local model available; check dashboard for details."
           });
@@ -4742,7 +4804,6 @@ var PiBackend = class {
       const { session: piSession } = await piSdk.createAgentSession({
         cwd: params.workspacePath,
         ...model !== void 0 && { model },
-        tools: piSdk.codingTools,
         sessionManager: piSdk.SessionManager.inMemory()
       });
       const session = {
@@ -4753,9 +4814,9 @@ var PiBackend = class {
         piSession,
         unsubscribe: null
       };
-      return (0, import_types14.Ok)(session);
+      return (0, import_types15.Ok)(session);
     } catch (err) {
-      return (0, import_types14.Err)({
+      return (0, import_types15.Err)({
         category: "response_error",
         message: `Failed to create pi session: ${err instanceof Error ? err.message : String(err)}`
       });
@@ -4885,14 +4946,14 @@ var PiBackend = class {
       await piSession.abort();
     } catch {
     }
-    return (0, import_types14.Ok)(void 0);
+    return (0, import_types15.Ok)(void 0);
   }
   async healthCheck() {
     try {
       await import("@mariozechner/pi-coding-agent");
-      return (0, import_types14.Ok)(void 0);
+      return (0, import_types15.Ok)(void 0);
     } catch (err) {
-      return (0, import_types14.Err)({
+      return (0, import_types15.Err)({
         category: "agent_not_found",
         message: `Pi SDK not available: ${err instanceof Error ? err.message : String(err)}`
       });
@@ -4955,7 +5016,7 @@ function createBackend(def) {
 }
 
 // src/agent/backends/container.ts
-var import_types15 = require("@harness-engineering/types");
+var import_types16 = require("@harness-engineering/types");
 function toAgentError(message, details) {
   return { category: "response_error", message, details };
 }
@@ -4986,7 +5047,7 @@ var ContainerBackend = class {
     }
     const result = await this.secretBackend.resolveSecrets(this.secretKeys);
     if (!result.ok) {
-      return (0, import_types15.Err)(toAgentError(`Secret resolution failed: ${result.error.message}`, result.error));
+      return (0, import_types16.Err)(toAgentError(`Secret resolution failed: ${result.error.message}`, result.error));
     }
     return { ok: true, value: result.value };
   }
@@ -5011,7 +5072,7 @@ var ContainerBackend = class {
     const createOpts = this.buildCreateOpts(params, envResult.value);
     const containerResult = await this.runtime.createContainer(createOpts);
     if (!containerResult.ok) {
-      return (0, import_types15.Err)(
+      return (0, import_types16.Err)(
         toAgentError(
           `Container creation failed: ${containerResult.error.message}`,
           containerResult.error
@@ -5036,7 +5097,7 @@ var ContainerBackend = class {
       this.containerHandles.delete(session.sessionId);
       const removeResult = await this.runtime.removeContainer(handle);
       if (!removeResult.ok) {
-        return (0, import_types15.Err)(
+        return (0, import_types16.Err)(
           toAgentError(
             `Container removal failed: ${removeResult.error.message}`,
             removeResult.error
@@ -5049,7 +5110,7 @@ var ContainerBackend = class {
   async healthCheck() {
     const runtimeResult = await this.runtime.healthCheck();
     if (!runtimeResult.ok) {
-      return (0, import_types15.Err)({
+      return (0, import_types16.Err)({
         category: "agent_not_found",
         message: `Container runtime unhealthy: ${runtimeResult.error.message}`,
         details: runtimeResult.error
@@ -5061,7 +5122,7 @@ var ContainerBackend = class {
 
 // src/agent/runtime/docker.ts
 var import_node_child_process5 = require("child_process");
-var import_types16 = require("@harness-engineering/types");
+var import_types17 = require("@harness-engineering/types");
 function dockerExec(args) {
   return new Promise((resolve6, reject) => {
     (0, import_node_child_process5.execFile)("docker", args, (error, stdout) => {
@@ -5094,9 +5155,9 @@ var DockerRuntime = class {
       args.push(opts.image);
       args.push("sleep", "infinity");
       const containerId = await dockerExec(args);
-      return (0, import_types16.Ok)({ containerId, runtime: this.name });
+      return (0, import_types17.Ok)({ containerId, runtime: this.name });
     } catch (error) {
-      return (0, import_types16.Err)({
+      return (0, import_types17.Err)({
         category: "container_create_failed",
         message: `Failed to create container: ${error instanceof Error ? error.message : String(error)}`,
         details: error
@@ -5140,9 +5201,9 @@ var DockerRuntime = class {
   async removeContainer(handle) {
     try {
       await dockerExec(["rm", "-f", handle.containerId]);
-      return (0, import_types16.Ok)(void 0);
+      return (0, import_types17.Ok)(void 0);
     } catch (error) {
-      return (0, import_types16.Err)({
+      return (0, import_types17.Err)({
         category: "container_remove_failed",
         message: `Failed to remove container: ${error instanceof Error ? error.message : String(error)}`,
         details: error
@@ -5152,9 +5213,9 @@ var DockerRuntime = class {
   async healthCheck() {
     try {
       await dockerExec(["info", "--format", "{{.ServerVersion}}"]);
-      return (0, import_types16.Ok)(void 0);
+      return (0, import_types17.Ok)(void 0);
     } catch (error) {
-      return (0, import_types16.Err)({
+      return (0, import_types17.Err)({
         category: "runtime_not_found",
         message: `Docker is not available: ${error instanceof Error ? error.message : String(error)}`,
         details: error
@@ -5164,7 +5225,7 @@ var DockerRuntime = class {
 };
 
 // src/agent/secrets/env.ts
-var import_types17 = require("@harness-engineering/types");
+var import_types18 = require("@harness-engineering/types");
 var EnvSecretBackend = class {
   name = "env";
   async resolveSecrets(keys) {
@@ -5172,7 +5233,7 @@ var EnvSecretBackend = class {
     for (const key of keys) {
       const value = process.env[key];
       if (value === void 0) {
-        return (0, import_types17.Err)({
+        return (0, import_types18.Err)({
           category: "secret_not_found",
           message: `Environment variable '${key}' is not set`,
           key
@@ -5180,16 +5241,16 @@ var EnvSecretBackend = class {
       }
       secrets[key] = value;
     }
-    return (0, import_types17.Ok)(secrets);
+    return (0, import_types18.Ok)(secrets);
   }
   async healthCheck() {
-    return (0, import_types17.Ok)(void 0);
+    return (0, import_types18.Ok)(void 0);
   }
 };
 
 // src/agent/secrets/onepassword.ts
 var import_node_child_process6 = require("child_process");
-var import_types18 = require("@harness-engineering/types");
+var import_types19 = require("@harness-engineering/types");
 function opExec(args) {
   return new Promise((resolve6, reject) => {
     (0, import_node_child_process6.execFile)("op", args, (error, stdout) => {
@@ -5214,21 +5275,21 @@ var OnePasswordSecretBackend = class {
         const value = await opExec(["read", `op://${this.vault}/${key}/password`]);
         secrets[key] = value;
       } catch (error) {
-        return (0, import_types18.Err)({
+        return (0, import_types19.Err)({
           category: "access_denied",
           message: `Failed to read secret '${key}' from 1Password: ${error instanceof Error ? error.message : String(error)}`,
           key
         });
       }
     }
-    return (0, import_types18.Ok)(secrets);
+    return (0, import_types19.Ok)(secrets);
   }
   async healthCheck() {
     try {
       await opExec(["--version"]);
-      return (0, import_types18.Ok)(void 0);
+      return (0, import_types19.Ok)(void 0);
     } catch (error) {
-      return (0, import_types18.Err)({
+      return (0, import_types19.Err)({
         category: "provider_unavailable",
         message: `1Password CLI is not available: ${error instanceof Error ? error.message : String(error)}`
       });
@@ -5238,7 +5299,7 @@ var OnePasswordSecretBackend = class {
 
 // src/agent/secrets/vault.ts
 var import_node_child_process7 = require("child_process");
-var import_types19 = require("@harness-engineering/types");
+var import_types20 = require("@harness-engineering/types");
 function vaultExec(args, env) {
   return new Promise((resolve6, reject) => {
     (0, import_node_child_process7.execFile)("vault", args, { env: { ...process.env, ...env } }, (error, stdout) => {
@@ -5269,11 +5330,11 @@ var VaultSecretBackend = class {
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
       const category = error instanceof SyntaxError ? "access_denied" : "access_denied";
-      return (0, import_types19.Err)({ category, message: `Failed to read from Vault: ${msg}` });
+      return (0, import_types20.Err)({ category, message: `Failed to read from Vault: ${msg}` });
     }
     const missing = keys.find((k) => !(k in data));
     if (missing) {
-      return (0, import_types19.Err)({
+      return (0, import_types20.Err)({
         category: "secret_not_found",
         message: `Secret key '${missing}' not found in Vault path '${this.path}'`,
         key: missing
@@ -5281,14 +5342,14 @@ var VaultSecretBackend = class {
     }
     const secrets = {};
     for (const key of keys) secrets[key] = data[key];
-    return (0, import_types19.Ok)(secrets);
+    return (0, import_types20.Ok)(secrets);
   }
   async healthCheck() {
     try {
       await vaultExec(["version"]);
-      return (0, import_types19.Ok)(void 0);
+      return (0, import_types20.Ok)(void 0);
     } catch (error) {
-      return (0, import_types19.Err)({
+      return (0, import_types20.Err)({
         category: "provider_unavailable",
         message: `Vault CLI is not available: ${error instanceof Error ? error.message : String(error)}`
       });
@@ -5403,6 +5464,10 @@ var OrchestratorBackendFactory = class {
   }
 };
 
+// src/agent/intelligence-factory.ts
+var import_intelligence3 = require("@harness-engineering/intelligence");
+var import_graph = require("@harness-engineering/graph");
+
 // src/agent/analysis-provider-factory.ts
 var import_intelligence2 = require("@harness-engineering/intelligence");
 function buildAnalysisProvider(args) {
@@ -5500,9 +5565,110 @@ function buildClaudeCliProvider(def, args, layerModel) {
   });
 }
 
+// src/agent/intelligence-factory.ts
+function buildIntelligencePipeline(deps) {
+  const { config } = deps;
+  const intel = config.intelligence;
+  if (!intel?.enabled) return null;
+  const selProvider = buildAnalysisProviderForLayer("sel", deps);
+  if (!selProvider) return null;
+  const routing = config.agent.routing;
+  const peslName = routing?.intelligence?.pesl;
+  const selName = routing?.intelligence?.sel ?? routing?.default;
+  const peslProvider = peslName !== void 0 && peslName !== selName ? buildAnalysisProviderForLayer("pesl", deps) : null;
+  const peslModel = intel.models?.pesl ?? config.agent.model;
+  const graphStore = new import_graph.GraphStore();
+  const pipeline = new import_intelligence3.IntelligencePipeline(selProvider, graphStore, {
+    ...peslModel !== void 0 && { peslModel },
+    ...peslProvider !== null && peslProvider !== void 0 && { peslProvider }
+  });
+  return { pipeline, graphStore };
+}
+function buildAnalysisProviderForLayer(layer, deps) {
+  const { config, localResolvers, logger } = deps;
+  const intel = config.intelligence;
+  if (!intel?.enabled) return null;
+  if (intel.provider) {
+    const layerModel = layer === "sel" ? intel.models?.sel : intel.models?.pesl;
+    return buildExplicitProvider(intel.provider, layerModel ?? config.agent.model, config);
+  }
+  const routed = resolveRoutedBackend(layer, config, logger);
+  if (!routed) return null;
+  const { name, def } = routed;
+  const resolver = localResolvers.get(name);
+  return buildAnalysisProvider({
+    def,
+    backendName: name,
+    layer,
+    // Spec 2 P3-IMP-1: a single snapshot read feeds the factory's
+    // unavailable-warn diagnostic (Configured/Detected lists) and
+    // collapses the two `getStatus()` calls flagged by P3-SUG-2.
+    getResolverStatusSnapshot: () => {
+      if (!resolver) return null;
+      const status = resolver.getStatus();
+      return {
+        available: status.available,
+        resolved: status.resolved,
+        configured: status.configured,
+        detected: status.detected
+      };
+    },
+    intelligence: intel,
+    logger
+  });
+}
+function resolveRoutedBackend(layer, config, logger) {
+  const routing = config.agent.routing;
+  const backends = config.agent.backends;
+  if (!routing || !backends) return null;
+  const layerName = routing.intelligence?.[layer];
+  const name = layerName ?? routing.default;
+  const def = backends[name];
+  if (!def) {
+    logger.warn(
+      `Intelligence pipeline: routed backend '${name}' for layer '${layer}' is not in agent.backends.`
+    );
+    return null;
+  }
+  return { name, def };
+}
+function buildExplicitProvider(provider, selModel, config) {
+  if (provider.kind === "anthropic") {
+    const apiKey2 = provider.apiKey ?? config.agent.apiKey ?? process.env.ANTHROPIC_API_KEY;
+    if (!apiKey2) {
+      throw new Error("Intelligence pipeline: no Anthropic API key found.");
+    }
+    return new import_intelligence3.AnthropicAnalysisProvider({
+      apiKey: apiKey2,
+      ...selModel !== void 0 && { defaultModel: selModel }
+    });
+  }
+  if (provider.kind === "claude-cli") {
+    return new import_intelligence3.ClaudeCliAnalysisProvider({
+      command: config.agent.command,
+      ...selModel !== void 0 && { defaultModel: selModel },
+      ...config.intelligence?.requestTimeoutMs !== void 0 && {
+        timeoutMs: config.intelligence.requestTimeoutMs
+      }
+    });
+  }
+  const apiKey = provider.apiKey ?? config.agent.apiKey ?? "ollama";
+  const baseUrl = provider.baseUrl ?? "http://localhost:11434/v1";
+  const intel = config.intelligence;
+  return new import_intelligence3.OpenAICompatibleAnalysisProvider({
+    apiKey,
+    baseUrl,
+    ...selModel !== void 0 && { defaultModel: selModel },
+    ...intel?.requestTimeoutMs !== void 0 && { timeoutMs: intel.requestTimeoutMs },
+    ...intel?.promptSuffix !== void 0 && { promptSuffix: intel.promptSuffix },
+    ...intel?.jsonMode !== void 0 && { jsonMode: intel.jsonMode }
+  });
+}
+
 // src/server/http.ts
 var http = __toESM(require("http"));
-var path13 = __toESM(require("path"));
+var path14 = __toESM(require("path"));
+var import_core8 = require("@harness-engineering/core");
 
 // src/server/websocket.ts
 var import_ws = require("ws");
@@ -5930,7 +6096,7 @@ function extractChunks(event) {
 }
 
 // src/server/routes/analyze.ts
-var import_intelligence3 = require("@harness-engineering/intelligence");
+var import_intelligence4 = require("@harness-engineering/intelligence");
 var import_zod6 = require("zod");
 var AnalyzeRequestSchema = import_zod6.z.object({
   title: import_zod6.z.string().min(1),
@@ -5960,7 +6126,7 @@ async function runPipeline(res, pipeline, parsed) {
     disconnected = true;
   });
   emit2(res, { type: "status", text: "Converting to work item..." });
-  const rawItem = (0, import_intelligence3.manualToRawWorkItem)({
+  const rawItem = (0, import_intelligence4.manualToRawWorkItem)({
     title: parsed.title,
     description: parsed.description ?? "",
     labels: parsed.labels ?? []
@@ -6003,7 +6169,7 @@ async function runPipeline(res, pipeline, parsed) {
     }
   }
   if (disconnected) return;
-  const signals = (0, import_intelligence3.scoreToConcernSignals)(score);
+  const signals = (0, import_intelligence4.scoreToConcernSignals)(score);
   if (signals.length > 0) {
     emit2(res, { type: "signals", data: signals });
   }
@@ -6042,6 +6208,7 @@ function handleAnalyzeRoute(req, res, pipeline) {
 
 // src/server/routes/roadmap-actions.ts
 var fs10 = __toESM(require("fs/promises"));
+var path10 = __toESM(require("path"));
 var import_core7 = require("@harness-engineering/core");
 var import_zod7 = require("zod");
 var AppendRoadmapRequestSchema = import_zod7.z.object({
@@ -6069,6 +6236,48 @@ function handleRoadmapActionsRoute(req, res, roadmapPath) {
         sendJSON(res, 503, { error: "Roadmap path not configured" });
         return;
       }
+      const projectRoot = path10.dirname(path10.dirname(roadmapPath));
+      const mode = (0, import_core7.loadProjectRoadmapMode)(projectRoot);
+      if (mode === "file-less") {
+        const trackerCfg = (0, import_core7.loadTrackerClientConfigFromProject)(projectRoot);
+        if (!trackerCfg.ok) {
+          sendJSON(res, 500, { error: trackerCfg.error.message });
+          return;
+        }
+        const clientR = (0, import_core7.createTrackerClient)(trackerCfg.value);
+        if (!clientR.ok) {
+          sendJSON(res, 500, { error: clientR.error.message });
+          return;
+        }
+        const body2 = await readBody(req);
+        const parseResult = AppendRoadmapRequestSchema.safeParse(JSON.parse(body2));
+        if (!parseResult.success) {
+          sendJSON(res, 400, {
+            error: parseResult.error.issues[0]?.message ?? "Invalid request body"
+          });
+          return;
+        }
+        const newFeature = {
+          name: parseResult.data.title,
+          summary: parseResult.data.enrichedSpec?.intent ?? parseResult.data.summary ?? parseResult.data.title,
+          status: "planned"
+        };
+        const r = await clientR.value.create(newFeature);
+        if (!r.ok) {
+          if (r.error instanceof import_core7.ConflictError) {
+            sendJSON(res, 409, (0, import_core7.makeTrackerConflictBody)(r.error));
+            return;
+          }
+          sendJSON(res, 502, { error: r.error.message });
+          return;
+        }
+        sendJSON(res, 201, {
+          ok: true,
+          featureName: r.value.name,
+          externalId: r.value.externalId
+        });
+        return;
+      }
       const body = await readBody(req);
       const result = AppendRoadmapRequestSchema.safeParse(JSON.parse(body));
       if (!result.success) {
@@ -6321,21 +6530,21 @@ function handleMaintenanceRoute(req, res, deps) {
 
 // src/server/routes/sessions.ts
 var fs11 = __toESM(require("fs/promises"));
-var path10 = __toESM(require("path"));
+var path11 = __toESM(require("path"));
 var import_zod10 = require("zod");
 var SessionCreateSchema = import_zod10.z.object({
   sessionId: import_zod10.z.string().min(1)
 }).passthrough();
 var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function isSafeId(id) {
-  return UUID_RE2.test(id) || path10.basename(id) === id && !id.includes("..");
+  return UUID_RE2.test(id) || path11.basename(id) === id && !id.includes("..");
 }
 function jsonResponse(res, status, data) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(data));
 }
 function extractSessionId(url) {
-  const segments = new URL(url, "http://localhost").pathname.split(path10.posix.sep);
+  const segments = new URL(url, "http://localhost").pathname.split(path11.posix.sep);
   const id = segments.pop();
   return id && id !== "sessions" ? id : null;
 }
@@ -6347,7 +6556,7 @@ async function handleList(res, sessionsDir) {
       if (!entry.isDirectory()) continue;
       try {
         const content = await fs11.readFile(
-          path10.join(sessionsDir, entry.name, "session.json"),
+          path11.join(sessionsDir, entry.name, "session.json"),
           "utf-8"
         );
         sessions.push(JSON.parse(content));
@@ -6372,7 +6581,7 @@ async function handleGet(res, id, sessionsDir) {
     return;
   }
   try {
-    const content = await fs11.readFile(path10.join(sessionsDir, id, "session.json"), "utf-8");
+    const content = await fs11.readFile(path11.join(sessionsDir, id, "session.json"), "utf-8");
     jsonResponse(res, 200, JSON.parse(content));
   } catch (err) {
     if (err.code === "ENOENT") {
@@ -6395,9 +6604,9 @@ async function handleCreate(req, res, sessionsDir) {
       jsonResponse(res, 400, { error: "Invalid sessionId" });
       return;
     }
-    const sessionDir = path10.join(sessionsDir, session.sessionId);
+    const sessionDir = path11.join(sessionsDir, session.sessionId);
     await fs11.mkdir(sessionDir, { recursive: true });
-    await fs11.writeFile(path10.join(sessionDir, "session.json"), JSON.stringify(session, null, 2));
+    await fs11.writeFile(path11.join(sessionDir, "session.json"), JSON.stringify(session, null, 2));
     jsonResponse(res, 200, { ok: true });
   } catch {
     jsonResponse(res, 500, { error: "Failed to save session" });
@@ -6412,7 +6621,7 @@ async function handleUpdate(req, res, url, sessionsDir) {
     }
     const body = await readBody(req);
     const updates = import_zod10.z.record(import_zod10.z.unknown()).parse(JSON.parse(body));
-    const sessionFilePath = path10.join(sessionsDir, id, "session.json");
+    const sessionFilePath = path11.join(sessionsDir, id, "session.json");
     const current = JSON.parse(await fs11.readFile(sessionFilePath, "utf-8"));
     await fs11.writeFile(sessionFilePath, JSON.stringify({ ...current, ...updates }, null, 2));
     jsonResponse(res, 200, { ok: true });
@@ -6427,7 +6636,7 @@ async function handleDelete(res, url, sessionsDir) {
       jsonResponse(res, 400, { error: "Missing or invalid sessionId" });
       return;
     }
-    await fs11.rm(path10.join(sessionsDir, id), { recursive: true, force: true });
+    await fs11.rm(path11.join(sessionsDir, id), { recursive: true, force: true });
     jsonResponse(res, 200, { ok: true });
   } catch {
     jsonResponse(res, 500, { error: "Failed to delete session" });
@@ -6568,7 +6777,7 @@ function handleLocalModelsRoute(req, res, getStatuses) {
 
 // src/server/static.ts
 var fs12 = __toESM(require("fs"));
-var path11 = __toESM(require("path"));
+var path12 = __toESM(require("path"));
 var MIME_TYPES = {
   ".html": "text/html; charset=utf-8",
   ".js": "application/javascript; charset=utf-8",
@@ -6588,26 +6797,26 @@ var MIME_TYPES = {
 function handleStaticFile(req, res, dashboardDir) {
   const { method, url } = req;
   if (method !== "GET") return false;
-  const apiPrefix = path11.posix.join(path11.posix.sep, "api", path11.posix.sep);
-  const wsPath = path11.posix.join(path11.posix.sep, "ws");
+  const apiPrefix = path12.posix.join(path12.posix.sep, "api", path12.posix.sep);
+  const wsPath = path12.posix.join(path12.posix.sep, "ws");
   if (url?.startsWith(apiPrefix) || url === wsPath) return false;
   const urlPath = new URL(url ?? "/", "http://localhost").pathname;
-  const requestedPath = path11.join(dashboardDir, urlPath === "/" ? "index.html" : urlPath);
-  const resolved = path11.resolve(requestedPath);
-  if (!resolved.startsWith(path11.resolve(dashboardDir))) {
-    return serveFile(path11.join(dashboardDir, "index.html"), res);
+  const requestedPath = path12.join(dashboardDir, urlPath === "/" ? "index.html" : urlPath);
+  const resolved = path12.resolve(requestedPath);
+  if (!resolved.startsWith(path12.resolve(dashboardDir))) {
+    return serveFile(path12.join(dashboardDir, "index.html"), res);
   }
   if (fs12.existsSync(resolved) && fs12.statSync(resolved).isFile()) {
     return serveFile(resolved, res);
   }
-  const indexPath = path11.join(dashboardDir, "index.html");
+  const indexPath = path12.join(dashboardDir, "index.html");
   if (fs12.existsSync(indexPath)) {
     return serveFile(indexPath, res);
   }
   return false;
 }
 function serveFile(filePath, res) {
-  const ext = path11.extname(filePath).toLowerCase();
+  const ext = path12.extname(filePath).toLowerCase();
   const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
   try {
     const content = fs12.readFileSync(filePath);
@@ -6621,7 +6830,7 @@ function serveFile(filePath, res) {
 
 // src/server/plan-watcher.ts
 var fs13 = __toESM(require("fs"));
-var path12 = __toESM(require("path"));
+var path13 = __toESM(require("path"));
 var PlanWatcher = class {
   plansDir;
   queue;
@@ -6638,7 +6847,7 @@ var PlanWatcher = class {
     fs13.mkdirSync(this.plansDir, { recursive: true });
     this.watcher = fs13.watch(this.plansDir, (eventType, filename) => {
       if (eventType === "rename" && filename && filename.endsWith(".md")) {
-        const filePath = path12.join(this.plansDir, filename);
+        const filePath = path13.join(this.plansDir, filename);
         if (fs13.existsSync(filePath)) {
           void this.handleNewPlan(filename);
         }
@@ -6725,6 +6934,7 @@ var OrchestratorServer = class {
   planWatcher = null;
   stateChangeListener;
   agentEventListener;
+  apiRoutes;
   constructor(orchestrator, port, deps) {
     this.orchestrator = orchestrator;
     this.port = port;
@@ -6734,18 +6944,19 @@ var OrchestratorServer = class {
       this.httpServer,
       () => this.orchestrator.getSnapshot()
     );
+    this.apiRoutes = this.buildApiRoutes();
     this.wireEvents();
   }
   initDependencies(deps) {
     this.interactionQueue = deps?.interactionQueue;
-    this.plansDir = deps?.plansDir ?? path13.resolve("docs", "plans");
-    this.dashboardDir = deps?.dashboardDir ?? path13.resolve("packages", "dashboard", "dist", "client");
+    this.plansDir = deps?.plansDir ?? path14.resolve("docs", "plans");
+    this.dashboardDir = deps?.dashboardDir ?? path14.resolve("packages", "dashboard", "dist", "client");
     this.claudeCommand = deps?.claudeCommand ?? "claude";
     this.pipeline = deps?.pipeline ?? null;
     this.analysisArchive = deps?.analysisArchive;
     this.roadmapPath = deps?.roadmapPath ?? null;
     this.dispatchAdHoc = deps?.dispatchAdHoc ?? null;
-    this.sessionsDir = deps?.sessionsDir ?? path13.resolve(".harness", "sessions");
+    this.sessionsDir = deps?.sessionsDir ?? path14.resolve(".harness", "sessions");
     this.maintenanceDeps = deps?.maintenanceDeps ?? null;
     this.getLocalModelStatus = deps?.getLocalModelStatus ?? null;
     this.getLocalModelStatuses = deps?.getLocalModelStatuses ?? null;
@@ -6769,8 +6980,8 @@ var OrchestratorServer = class {
   }
   /**
    * Broadcast a maintenance event to all WebSocket clients.
-   * @param type - One of 'maintenance:started', 'maintenance:completed', 'maintenance:error'
-   * @param data - Event payload (task info, run result, or error details)
+   * @param type - One of 'maintenance:started', 'maintenance:completed', 'maintenance:error', 'maintenance:baseref_fallback'
+   * @param data - Event payload (task info, run result, error details, or baseref-fallback diagnostic)
    */
   broadcastMaintenance(type, data) {
     this.broadcaster.broadcast(type, data);
@@ -6855,44 +7066,37 @@ var OrchestratorServer = class {
     );
     return false;
   }
+  /**
+   * Build the ordered API route table. Each entry is invoked in order and
+   * returns true when it has handled the request. Closures capture `this`,
+   * so handlers re-read mutable deps (pipeline, recorder, maintenanceDeps)
+   * on every request — setters like setPipeline() take effect immediately.
+   *
+   * Adding a new route is a one-place change: append an entry here.
+   */
+  buildApiRoutes() {
+    return [
+      (req, res) => !!this.interactionQueue && handleInteractionsRoute(req, res, this.interactionQueue),
+      (req, res) => handlePlansRoute(req, res, this.plansDir),
+      (req, res) => handleAnalyzeRoute(req, res, this.pipeline),
+      (req, res) => handleAnalysesRoute(req, res, this.analysisArchive),
+      (req, res) => handleRoadmapActionsRoute(req, res, this.roadmapPath),
+      (req, res) => handleDispatchActionsRoute(req, res, this.dispatchAdHoc),
+      (req, res) => handleLocalModelRoute(req, res, this.getLocalModelStatus),
+      // Local-models multi-status route (Spec 2 SC38)
+      (req, res) => handleLocalModelsRoute(req, res, this.getLocalModelStatuses),
+      (req, res) => handleMaintenanceRoute(req, res, this.maintenanceDeps),
+      (req, res) => !!this.recorder && handleStreamsRoute(req, res, this.recorder),
+      (req, res) => handleSessionsRoute(req, res, this.sessionsDir),
+      // Chat proxy route (spawns Claude Code CLI — no API key required)
+      (req, res) => handleChatProxyRoute(req, res, this.claudeCommand)
+    ];
+  }
   /** Dispatch to API route handlers. Returns true if a route matched. */
   handleApiRoutes(req, res) {
     if (!this.checkAuth(req, res)) return true;
-    if (this.interactionQueue && handleInteractionsRoute(req, res, this.interactionQueue)) {
-      return true;
-    }
-    if (handlePlansRoute(req, res, this.plansDir)) {
-      return true;
-    }
-    if (handleAnalyzeRoute(req, res, this.pipeline)) {
-      return true;
-    }
-    if (handleAnalysesRoute(req, res, this.analysisArchive)) {
-      return true;
-    }
-    if (handleRoadmapActionsRoute(req, res, this.roadmapPath)) {
-      return true;
-    }
-    if (handleDispatchActionsRoute(req, res, this.dispatchAdHoc)) {
-      return true;
-    }
-    if (handleLocalModelRoute(req, res, this.getLocalModelStatus)) {
-      return true;
-    }
-    if (handleLocalModelsRoute(req, res, this.getLocalModelStatuses)) {
-      return true;
-    }
-    if (handleMaintenanceRoute(req, res, this.maintenanceDeps)) {
-      return true;
-    }
-    if (this.recorder && handleStreamsRoute(req, res, this.recorder)) {
-      return true;
-    }
-    if (handleSessionsRoute(req, res, this.sessionsDir)) {
-      return true;
-    }
-    if (handleChatProxyRoute(req, res, this.claudeCommand)) {
-      return true;
+    for (const route of this.apiRoutes) {
+      if (route(req, res)) return true;
     }
     return false;
   }
@@ -6900,6 +7104,7 @@ var OrchestratorServer = class {
     return this.broadcaster.clientCount;
   }
   async start() {
+    (0, import_core8.assertPortUsable)(this.port, "orchestrator");
     if (this.interactionQueue) {
       this.planWatcher = new PlanWatcher(this.plansDir, this.interactionQueue);
       this.planWatcher.start();
@@ -6964,7 +7169,7 @@ var StructuredLogger = class {
 // src/workspace/config-scanner.ts
 var import_node_fs = require("fs");
 var import_node_path = require("path");
-var import_core8 = require("@harness-engineering/core");
+var import_core9 = require("@harness-engineering/core");
 var CONFIG_FILES = ["CLAUDE.md", "AGENTS.md", ".gemini/settings.json", "skill.yaml"];
 var BLOCKING_INJECTION_PREFIXES = ["INJ-UNI-", "INJ-REROL-"];
 var DOWNGRADED_SECURITY_RULES = /* @__PURE__ */ new Set(["SEC-AGT-006"]);
@@ -6986,25 +7191,25 @@ async function scanSingleFile(filePath, targetDir, scanner) {
   } catch {
     return null;
   }
-  const injectionFindings = (0, import_core8.scanForInjection)(content);
-  const findings = (0, import_core8.mapInjectionFindings)(injectionFindings);
+  const injectionFindings = (0, import_core9.scanForInjection)(content);
+  const findings = (0, import_core9.mapInjectionFindings)(injectionFindings);
   const secFindings = await scanner.scanFile(filePath);
-  findings.push(...(0, import_core8.mapSecurityFindings)(secFindings, findings));
+  findings.push(...(0, import_core9.mapSecurityFindings)(secFindings, findings));
   const adjusted = adjustFindingSeverity(findings);
   return {
     file: (0, import_node_path.relative)(targetDir, filePath).replaceAll("\\", "/"),
     findings: adjusted,
-    overallSeverity: (0, import_core8.computeOverallSeverity)(adjusted)
+    overallSeverity: (0, import_core9.computeOverallSeverity)(adjusted)
   };
 }
 async function scanWorkspaceConfig(workspacePath) {
-  const scanner = new import_core8.SecurityScanner((0, import_core8.parseSecurityConfig)({}));
+  const scanner = new import_core9.SecurityScanner((0, import_core9.parseSecurityConfig)({}));
   const results = [];
   for (const configFile of CONFIG_FILES) {
     const result = await scanSingleFile((0, import_node_path.join)(workspacePath, configFile), workspacePath, scanner);
     if (result) results.push(result);
   }
-  return { exitCode: (0, import_core8.computeScanExitCode)(results), results };
+  return { exitCode: (0, import_core9.computeScanExitCode)(results), results };
 }
 
 // src/maintenance/task-registry.ts
@@ -7179,6 +7384,14 @@ var BUILT_IN_TASKS = [
     schedule: "0 7 * * *",
     branch: null,
     checkCommand: ["perf", "baselines", "update"]
+  },
+  {
+    id: "main-sync",
+    type: "housekeeping",
+    description: "Fast-forward local default branch from origin",
+    schedule: "*/15 * * * *",
+    branch: null,
+    checkCommand: ["harness", "sync-main", "--json"]
   }
 ];
 
@@ -7249,7 +7462,7 @@ function cronMatchesNow(expression, now) {
 // src/maintenance/scheduler.ts
 var MaintenanceScheduler = class {
   config;
-  claimManager;
+  leaderElector;
   logger;
   onTaskDue;
   historyProvider;
@@ -7264,7 +7477,7 @@ var MaintenanceScheduler = class {
   activeRun = null;
   constructor(options) {
     this.config = options.config;
-    this.claimManager = options.claimManager;
+    this.leaderElector = options.leaderElector;
     this.logger = options.logger;
     this.historyProvider = options.historyProvider ?? null;
     this.onTaskDue = options.onTaskDue;
@@ -7339,12 +7552,12 @@ var MaintenanceScheduler = class {
     await this.processQueue(queue, epochMinute);
   }
   /**
-   * Attempt to claim leadership via ClaimManager.
+   * Attempt to claim leadership via the configured LeaderElector.
    * Returns true if this instance is the leader.
    */
   async attemptLeaderClaim(evalTime) {
     try {
-      const result = await this.claimManager.claimAndVerify("maintenance-leader");
+      const result = await this.leaderElector.electLeader();
       if (!result.ok) {
         this.isLeader = false;
         this.logger.warn("Maintenance leader claim failed", { error: result.error?.message });
@@ -7423,6 +7636,7 @@ var MaintenanceScheduler = class {
     const history = this.historyProvider ? this.historyProvider.getHistory(200, 0) : this.internalHistory;
     const schedule = this.resolvedTasks.map((task) => ({
       taskId: task.id,
+      type: task.type,
       nextRun: this.computeNextRun(task.schedule),
       lastRun: history.find((r) => r.taskId === task.id) ?? null
     }));
@@ -7459,9 +7673,17 @@ var MaintenanceScheduler = class {
   }
 };
 
+// src/maintenance/leader-elector.ts
+var import_types21 = require("@harness-engineering/types");
+var SingleProcessLeaderElector = class {
+  async electLeader() {
+    return (0, import_types21.Ok)("claimed");
+  }
+};
+
 // src/maintenance/reporter.ts
 var fs14 = __toESM(require("fs"));
-var path14 = __toESM(require("path"));
+var path15 = __toESM(require("path"));
 var import_zod11 = require("zod");
 var RunResultSchema = import_zod11.z.object({
   taskId: import_zod11.z.string(),
@@ -7497,7 +7719,7 @@ var MaintenanceReporter = class {
   async load() {
     try {
       await fs14.promises.mkdir(this.persistDir, { recursive: true });
-      const filePath = path14.join(this.persistDir, "history.json");
+      const filePath = path15.join(this.persistDir, "history.json");
       const data = await fs14.promises.readFile(filePath, "utf-8");
       const parsed = import_zod11.z.array(RunResultSchema).safeParse(JSON.parse(data));
       if (parsed.success) {
@@ -7533,7 +7755,7 @@ var MaintenanceReporter = class {
   async persist() {
     try {
       await fs14.promises.mkdir(this.persistDir, { recursive: true });
-      const filePath = path14.join(this.persistDir, "history.json");
+      const filePath = path15.join(this.persistDir, "history.json");
       await fs14.promises.writeFile(filePath, JSON.stringify(this.history, null, 2), "utf-8");
     } catch (err) {
       this.logger.error("MaintenanceReporter: failed to persist history", { error: String(err) });
@@ -7754,22 +7976,39 @@ var TaskRunner = class {
   }
   /**
    * Housekeeping: run command directly, no AI, no PR.
+   *
+   * Captures stdout and parses a trailing JSON status line if present.
+   * Recognized contracts:
+   *   - Phase 4/5 status contract (e.g., harness pulse run): success/skipped/failure/no-issues
+   *   - sync-main contract: updated/no-op/skipped/error → mapped onto the run-result status
+   * Legacy housekeeping commands that emit no JSON keep the prior behavior:
+   *   status: 'success', findings: 0.
    */
   async runHousekeeping(task, startedAt) {
     if (!task.checkCommand || task.checkCommand.length === 0) {
       return this.failureResult(task.id, startedAt, "housekeeping task missing checkCommand");
     }
-    await this.commandExecutor.exec(task.checkCommand, this.cwd);
-    return {
+    let stdout;
+    try {
+      const out = await this.commandExecutor.exec(task.checkCommand, this.cwd);
+      stdout = out.stdout ?? "";
+    } catch (err) {
+      return this.failureResult(task.id, startedAt, String(err));
+    }
+    const parsed = parseStatusLine(stdout);
+    const status = parsed?.status ?? "success";
+    const result = {
       taskId: task.id,
       startedAt,
       completedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      status: "success",
+      status,
       findings: 0,
       fixed: 0,
       prUrl: null,
       prUpdated: false
     };
+    if (parsed?.error) result.error = parsed.error;
+    return result;
   }
   /**
    * Resolve which AI backend name to use for a given task.
@@ -7803,7 +8042,7 @@ function parseStatusLine(output) {
       const obj = JSON.parse(line);
       const s = obj.status;
       if (s === "success" || s === "skipped" || s === "failure" || s === "no-issues") {
-        const parsed = { status: s };
+        const parsed = { status: s, rawStatus: s };
         if (typeof obj.candidatesFound === "number") {
           parsed.candidatesFound = obj.candidatesFound;
         }
@@ -7813,8 +8052,18 @@ function parseStatusLine(output) {
         if (typeof obj.reason === "string") {
           parsed.reason = obj.reason;
         }
+        if (typeof obj.detail === "string" && !parsed.error) {
+          parsed.error = `${parsed.reason ?? "skipped"}: ${obj.detail}`;
+        }
         return parsed;
       }
+      if (s === "updated" || s === "no-op") {
+        return { status: "success", rawStatus: s };
+      }
+      if (s === "error") {
+        const message = typeof obj.message === "string" ? obj.message : "unknown error";
+        return { status: "failure", error: message, rawStatus: "error" };
+      }
     } catch {
     }
   }
@@ -7895,11 +8144,15 @@ var Orchestrator = class extends import_node_events.EventEmitter {
   completionHandler;
   /** Project root directory, derived from workspace root. */
   get projectRoot() {
-    return path15.resolve(this.config.workspace.root, "..", "..");
+    return path16.resolve(this.config.workspace.root, "..", "..");
   }
   enrichedSpecsByIssue = /* @__PURE__ */ new Map();
   /** Tracks recently-failed intelligence analysis to avoid re-requesting every tick */
   analysisFailureCache = /* @__PURE__ */ new Map();
+  // Phase 3 added a private `roadmapMode` field used by `createTracker` to
+  // guard the file-less stub. Phase 4 / S2 / D-P4-E shifted dispatch onto
+  // `tracker.kind`, removing the need for the field — it is now dropped to
+  // satisfy `noUnusedLocals`. See decision D-P3-orchestrator-mode-via-fs-read.
   /** Abort controllers and PIDs for running agent tasks — used by stopIssue to cancel in-flight work.
    *  The PID is stored here because the running entry may be deleted by the state machine
    *  before the stop effect executes (e.g., stall_detected removes the entry first). */
@@ -7935,14 +8188,19 @@ var Orchestrator = class extends import_node_events.EventEmitter {
       );
     }
     this.tracker = overrides?.tracker || this.createTracker();
-    this.workspace = new WorkspaceManager(config.workspace);
+    this.workspace = new WorkspaceManager(config.workspace, {
+      emitEvent: (event) => {
+        this.server?.broadcastMaintenance("maintenance:baseref_fallback", event);
+        this.emit("maintenance:baseref_fallback", event);
+      }
+    });
     this.hooks = new WorkspaceHooks(config.hooks);
     this.renderer = new PromptRenderer();
     this.overrideBackend = overrides?.backend ?? null;
     this.interactionQueue = new InteractionQueue(
-      path15.join(config.workspace.root, "..", "interactions")
+      path16.join(config.workspace.root, "..", "interactions")
     );
-    this.analysisArchive = new AnalysisArchive(path15.join(config.workspace.root, "..", "analyses"));
+    this.analysisArchive = new AnalysisArchive(path16.join(config.workspace.root, "..", "analyses"));
     const backendsMap = this.config.agent.backends ?? {};
     for (const [name, def] of Object.entries(backendsMap)) {
       if (def.type === "local" || def.type === "pi") {
@@ -7984,7 +8242,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
       ...overrides?.execFileFn ? { execFileFn: overrides.execFileFn } : {}
     });
     this.recorder = new StreamRecorder(
-      path15.resolve(config.workspace.root, "..", "streams"),
+      path16.resolve(config.workspace.root, "..", "streams"),
       this.logger
     );
     const self = this;
@@ -8016,7 +8274,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
     if (config.server?.port) {
       this.server = new OrchestratorServer(this, config.server.port, {
         interactionQueue: this.interactionQueue,
-        plansDir: path15.resolve(config.workspace.root, "..", "docs", "plans"),
+        plansDir: path16.resolve(config.workspace.root, "..", "docs", "plans"),
         pipeline: this.pipeline,
         analysisArchive: this.analysisArchive,
         roadmapPath: config.tracker.filePath ?? null,
@@ -8047,6 +8305,17 @@ var Orchestrator = class extends import_node_events.EventEmitter {
     }
   }
   createTracker() {
+    if (this.config.tracker.kind === "github-issues") {
+      const trackerCfg = {
+        kind: "github-issues",
+        repo: this.config.tracker.projectSlug ?? "",
+        ...this.config.tracker.apiKey ? { token: this.config.tracker.apiKey } : {},
+        ...this.config.tracker.endpoint ? { apiBase: this.config.tracker.endpoint } : {}
+      };
+      const clientResult = (0, import_core11.createTrackerClient)(trackerCfg);
+      if (!clientResult.ok) throw clientResult.error;
+      return new GitHubIssuesIssueTrackerAdapter(clientResult.value, this.config.tracker);
+    }
     if (this.config.tracker.kind === "roadmap") {
       return new RoadmapTrackerAdapter(this.config.tracker);
     }
@@ -8062,8 +8331,8 @@ var Orchestrator = class extends import_node_events.EventEmitter {
     const checkRunner = {
       run: async (command, cwd) => {
         const { execFile: execFile6 } = await import("child_process");
-        const { promisify: promisify3 } = await import("util");
-        const execFileAsync = promisify3(execFile6);
+        const { promisify: promisify4 } = await import("util");
+        const execFileAsync = promisify4(execFile6);
         const [cmd, ...args] = command;
         if (!cmd) return { passed: true, findings: 0, output: "" };
         try {
@@ -8097,12 +8366,13 @@ var Orchestrator = class extends import_node_events.EventEmitter {
     const commandExecutor = {
       exec: async (command, cwd) => {
         const { execFile: execFile6 } = await import("child_process");
-        const { promisify: promisify3 } = await import("util");
-        const execFileAsync = promisify3(execFile6);
+        const { promisify: promisify4 } = await import("util");
+        const execFileAsync = promisify4(execFile6);
         const [cmd, ...args] = command;
-        if (!cmd) return;
+        if (!cmd) return { stdout: "" };
         try {
-          await execFileAsync(cmd, args, { cwd, timeout: 12e4 });
+          const { stdout } = await execFileAsync(cmd, args, { cwd, timeout: 12e4 });
+          return { stdout: String(stdout) };
         } catch (err) {
           logger.warn("Maintenance command execution failed", {
             command,
@@ -8127,7 +8397,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
    */
   async initMaintenance(maintenanceConfig) {
     this.maintenanceReporter = new MaintenanceReporter({
-      persistDir: path15.join(this.projectRoot, ".harness", "maintenance"),
+      persistDir: path16.join(this.projectRoot, ".harness", "maintenance"),
       logger: this.logger
     });
     await this.maintenanceReporter.load();
@@ -8135,7 +8405,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
     const reporter = this.maintenanceReporter;
     this.maintenanceScheduler = new MaintenanceScheduler({
       config: maintenanceConfig,
-      claimManager: this.claimManager,
+      leaderElector: new SingleProcessLeaderElector(),
       logger: this.logger,
       historyProvider: reporter,
       onTaskDue: async (task) => {
@@ -8178,129 +8448,14 @@ var Orchestrator = class extends import_node_events.EventEmitter {
     }
   }
   createIntelligencePipeline() {
-    const intel = this.config.intelligence;
-    if (!intel?.enabled) return null;
-    const selProvider = this.createAnalysisProvider("sel");
-    if (!selProvider) return null;
-    const routing = this.config.agent.routing;
-    const peslName = routing?.intelligence?.pesl;
-    const selName = routing?.intelligence?.sel ?? routing?.default;
-    const peslProvider = peslName !== void 0 && peslName !== selName ? this.createAnalysisProvider("pesl") : null;
-    const peslModel = intel.models?.pesl ?? this.config.agent.model;
-    const store = new import_graph.GraphStore();
-    this.graphStore = store;
-    return new import_intelligence4.IntelligencePipeline(selProvider, store, {
-      ...peslModel !== void 0 && { peslModel },
-      ...peslProvider !== null && peslProvider !== void 0 && { peslProvider }
-    });
-  }
-  /**
-   * Create the AnalysisProvider for an intelligence-pipeline layer
-   * (`sel` by default; `pesl` when constructing a distinct PESL
-   * provider per Spec 2 SC35).
-   *
-   * Spec 2 Phase 4 (SC31–SC36) — resolution order:
-   *   1. Explicit `intelligence.provider` config wins (preserves Phase 0–3 behavior; SC33).
-   *   2. Otherwise, consult `agent.routing.intelligence.<layer>` (or
-   *      `routing.default`) to pick a `BackendDef` from `agent.backends`,
-   *      then translate via `buildAnalysisProvider` (the per-type factory).
-   *
-   * Closes the Phase 2 deferral (P2-DEF-638): the legacy
-   * `this.config.agent.backend` read at the bottom of this method is
-   * removed; routing is the sole source for non-explicit configs.
-   *
-   * Cyclomatic complexity: pre-Phase-4 was 33 (factory dispatch was
-   * inlined here). Phase 4 extracts the per-type tree into
-   * `buildAnalysisProvider`, dropping this method to ≤ 5 branches
-   * (under the 15 threshold).
-   */
-  createAnalysisProvider(layer = "sel") {
-    const intel = this.config.intelligence;
-    if (!intel?.enabled) return null;
-    if (intel.provider) {
-      const layerModel = layer === "sel" ? intel.models?.sel : intel.models?.pesl;
-      return this.createProviderFromExplicitConfig(
-        intel.provider,
-        layerModel ?? this.config.agent.model
-      );
-    }
-    const routed = this.resolveRoutedBackendForIntelligence(layer);
-    if (!routed) return null;
-    const { name, def } = routed;
-    const resolver = this.localResolvers.get(name);
-    return buildAnalysisProvider({
-      def,
-      backendName: name,
-      layer,
-      // Spec 2 P3-IMP-1: a single snapshot read feeds the factory's
-      // unavailable-warn diagnostic (Configured/Detected lists) and
-      // collapses the two `getStatus()` calls flagged by P3-SUG-2.
-      getResolverStatusSnapshot: () => {
-        if (!resolver) return null;
-        const status = resolver.getStatus();
-        return {
-          available: status.available,
-          resolved: status.resolved,
-          configured: status.configured,
-          detected: status.detected
-        };
-      },
-      intelligence: intel,
+    const bundle = buildIntelligencePipeline({
+      config: this.config,
+      localResolvers: this.localResolvers,
       logger: this.logger
     });
-  }
-  /**
-   * Look up the routed BackendDef for an intelligence layer, falling
-   * back through `routing.intelligence.<layer>` → `routing.default`
-   * → null. Returns the resolved name alongside the def so callers can
-   * key into the per-name resolver map.
-   */
-  resolveRoutedBackendForIntelligence(layer) {
-    const routing = this.config.agent.routing;
-    const backends = this.config.agent.backends;
-    if (!routing || !backends) return null;
-    const layerName = routing.intelligence?.[layer];
-    const name = layerName ?? routing.default;
-    const def = backends[name];
-    if (!def) {
-      this.logger.warn(
-        `Intelligence pipeline: routed backend '${name}' for layer '${layer}' is not in agent.backends.`
-      );
-      return null;
-    }
-    return { name, def };
-  }
-  createProviderFromExplicitConfig(provider, selModel) {
-    if (provider.kind === "anthropic") {
-      const apiKey2 = provider.apiKey ?? this.config.agent.apiKey ?? process.env.ANTHROPIC_API_KEY;
-      if (!apiKey2) {
-        throw new Error("Intelligence pipeline: no Anthropic API key found.");
-      }
-      return new import_intelligence4.AnthropicAnalysisProvider({
-        apiKey: apiKey2,
-        ...selModel !== void 0 && { defaultModel: selModel }
-      });
-    }
-    if (provider.kind === "claude-cli") {
-      return new import_intelligence4.ClaudeCliAnalysisProvider({
-        command: this.config.agent.command,
-        ...selModel !== void 0 && { defaultModel: selModel },
-        ...this.config.intelligence?.requestTimeoutMs !== void 0 && {
-          timeoutMs: this.config.intelligence.requestTimeoutMs
-        }
-      });
-    }
-    const apiKey = provider.apiKey ?? this.config.agent.apiKey ?? "ollama";
-    const baseUrl = provider.baseUrl ?? "http://localhost:11434/v1";
-    const intel = this.config.intelligence;
-    return new import_intelligence4.OpenAICompatibleAnalysisProvider({
-      apiKey,
-      baseUrl,
-      ...selModel !== void 0 && { defaultModel: selModel },
-      ...intel?.requestTimeoutMs !== void 0 && { timeoutMs: intel.requestTimeoutMs },
-      ...intel?.promptSuffix !== void 0 && { promptSuffix: intel.promptSuffix },
-      ...intel?.jsonMode !== void 0 && { jsonMode: intel.jsonMode }
-    });
+    if (!bundle) return null;
+    this.graphStore = bundle.graphStore;
+    return bundle.pipeline;
   }
   /**
    * Lazily initializes the ClaimManager if it hasn't been created yet.
@@ -8681,12 +8836,12 @@ var Orchestrator = class extends import_node_events.EventEmitter {
   async postLifecycleComment(identifier, externalId, event) {
     try {
       if (!externalId) return;
-      const trackerConfig = (0, import_core10.loadTrackerSyncConfig)(this.projectRoot);
+      const trackerConfig = (0, import_core11.loadTrackerSyncConfig)(this.projectRoot);
       if (!trackerConfig) return;
       const token = process.env.GITHUB_TOKEN;
       if (!token) return;
       const orchestratorId = await this.orchestratorIdPromise;
-      const adapter = new import_core10.GitHubIssuesSyncAdapter({ token, config: trackerConfig });
+      const adapter = new import_core11.GitHubIssuesSyncAdapter({ token, config: trackerConfig });
       const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19);
       const actionMap = {
         claimed: "Dispatching agent for autonomous execution",
@@ -8759,7 +8914,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
             ...f.line !== void 0 ? { line: f.line } : {}
           }))
         );
-        (0, import_core9.writeTaint)(
+        (0, import_core10.writeTaint)(
           workspacePath,
           issue.id,
           "Medium-severity injection patterns found in workspace config files",
@@ -9360,6 +9515,150 @@ function launchTUI(orchestrator) {
   const { waitUntilExit } = (0, import_ink5.render)(/* @__PURE__ */ (0, import_jsx_runtime5.jsx)(Dashboard, { orchestrator }));
   return { waitUntilExit };
 }
+
+// src/maintenance/sync-main.ts
+var import_node_child_process9 = require("child_process");
+var import_node_util3 = require("util");
+var DEFAULT_TIMEOUT_MS2 = 6e4;
+async function git(execFileFn, args, cwd, timeoutMs) {
+  const exec = (0, import_node_util3.promisify)(execFileFn);
+  const { stdout, stderr } = await exec("git", args, { cwd, timeout: timeoutMs });
+  return { stdout: String(stdout), stderr: String(stderr) };
+}
+function isSpawnEnoent(err) {
+  if (!err || typeof err !== "object") return false;
+  const code = err.code;
+  return code === "ENOENT";
+}
+async function refExists(execFileFn, ref, cwd, timeoutMs) {
+  try {
+    await git(execFileFn, ["rev-parse", "--verify", "--quiet", ref], cwd, timeoutMs);
+    return true;
+  } catch (err) {
+    if (isSpawnEnoent(err)) throw err;
+    return false;
+  }
+}
+async function resolveOriginDefault(execFileFn, cwd, timeoutMs) {
+  try {
+    const { stdout } = await git(
+      execFileFn,
+      ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"],
+      cwd,
+      timeoutMs
+    );
+    const v = stdout.trim();
+    if (v) return v;
+  } catch (err) {
+    if (isSpawnEnoent(err)) throw err;
+  }
+  for (const candidate of ["origin/main", "origin/master"]) {
+    if (await refExists(execFileFn, candidate, cwd, timeoutMs)) return candidate;
+  }
+  return null;
+}
+function shortName(originRef) {
+  return originRef.startsWith("origin/") ? originRef.slice("origin/".length) : originRef;
+}
+function isDirtyConflictStderr(s) {
+  return /would be overwritten|local changes|Aborting/i.test(s);
+}
+function extractStderr(err) {
+  if (err && typeof err === "object" && "stderr" in err) {
+    const raw = err.stderr;
+    if (typeof raw === "string") return raw;
+    if (raw instanceof Buffer) return raw.toString("utf8");
+  }
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  return "";
+}
+async function isAncestor(execFileFn, a, b, cwd, timeoutMs) {
+  try {
+    await git(execFileFn, ["merge-base", "--is-ancestor", a, b], cwd, timeoutMs);
+    return true;
+  } catch (err) {
+    if (isSpawnEnoent(err)) throw err;
+    return false;
+  }
+}
+async function syncMain(repoRoot, opts = {}) {
+  const execFileFn = opts.execFileFn ?? import_node_child_process9.execFile;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  try {
+    const originRef = await resolveOriginDefault(execFileFn, repoRoot, timeoutMs);
+    if (!originRef) {
+      return {
+        status: "skipped",
+        reason: "no-remote",
+        detail: "origin/HEAD unset and neither origin/main nor origin/master resolves",
+        defaultBranch: ""
+      };
+    }
+    const defaultBranch = shortName(originRef);
+    const { stdout: currentRaw } = await git(
+      execFileFn,
+      ["rev-parse", "--abbrev-ref", "HEAD"],
+      repoRoot,
+      timeoutMs
+    );
+    const current = currentRaw.trim();
+    if (current !== defaultBranch) {
+      return {
+        status: "skipped",
+        reason: "wrong-branch",
+        detail: `current branch '${current}' is not the default '${defaultBranch}'`,
+        defaultBranch
+      };
+    }
+    try {
+      await git(execFileFn, ["fetch", "origin", defaultBranch, "--quiet"], repoRoot, timeoutMs);
+    } catch (err) {
+      if (isSpawnEnoent(err)) throw err;
+      return {
+        status: "skipped",
+        reason: "fetch-failed",
+        detail: err instanceof Error ? err.message : String(err),
+        defaultBranch
+      };
+    }
+    const headIsAncestor = await isAncestor(execFileFn, "HEAD", originRef, repoRoot, timeoutMs);
+    const originIsAncestor = await isAncestor(execFileFn, originRef, "HEAD", repoRoot, timeoutMs);
+    if (headIsAncestor && originIsAncestor) {
+      return { status: "no-op", defaultBranch };
+    }
+    if (!headIsAncestor) {
+      return {
+        status: "skipped",
+        reason: "diverged",
+        detail: `local '${defaultBranch}' has commits not on '${originRef}'`,
+        defaultBranch
+      };
+    }
+    const before = (await git(execFileFn, ["rev-parse", "HEAD"], repoRoot, timeoutMs)).stdout.trim();
+    try {
+      await git(execFileFn, ["merge", "--ff-only", originRef], repoRoot, timeoutMs);
+    } catch (err) {
+      const stderr = extractStderr(err);
+      if (isDirtyConflictStderr(stderr)) {
+        return {
+          status: "skipped",
+          reason: "dirty-conflict",
+          detail: stderr.split("\n")[0] ?? "merge --ff-only failed due to working-tree changes",
+          defaultBranch
+        };
+      }
+      throw err;
+    }
+    const after = (await git(execFileFn, ["rev-parse", "HEAD"], repoRoot, timeoutMs)).stdout.trim();
+    return { status: "updated", from: before, to: after, defaultBranch };
+  } catch (err) {
+    return {
+      status: "error",
+      message: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AnalysisArchive,
@@ -9404,6 +9703,7 @@ function launchTUI(orchestrator) {
   savePublishedIndex,
   selectCandidates,
   sortCandidates,
+  syncMain,
   triageIssue,
   validateWorkflowConfig
 });