@juangcarmona/lighthouse-sdlc 0.14.0 → 0.15.0

package/src/issue-actions.mjs

@@ -1,4 +1,4 @@
-import { refinementAfterRun } from './stage-transition.mjs';
+import { refinementAfterRun, signalRefinementContinuation } from './stage-transition.mjs';
 import { dispatchId, dispatchArtifact, recordDispatch, sendDispatch, admitDispatch, checkDispatchClaim, finishDispatch, completedEvent, statusText, stages } from './stage-dispatch.mjs';
 import { readActionsJson } from './actions-artifact.mjs';
 import { deliveryAfterChecks, dispatchDeliveryChecks } from './delivery-events.mjs';
@@ -10,6 +10,8 @@ import { feedbackKey, feedbackWorker, checkProposal, reviewThread, reviewTarget,
 import { loadImplementation, loadImplementationSeed, changesDigest, validateChanges, validateCheckReceipt, createImplementationPullRequest } from './implementation.mjs';
 import { digest, validateStageEnvelope } from './host-contract.mjs';
 import { loadRefinement, loadStageReport, prepareProposal, proposalRoot, createProposalPullRequest } from './proposal.mjs';
+import { eligibleIssueAuthor } from './request-triage.mjs';
+import { projectImplementationPrState, reconcileImplementationPr, setPullRequestDraft } from './pr-state.mjs';
 
 export const repositoryApiUrl = (repository, path = '') => `https://api.github.com/repos/${repository}${path ? `/${path}` : ''}`;
 
@@ -18,7 +20,7 @@ export function pendingReply(event, comments) {
   if (!report || /<!-- lighthouse-proposal-review:|\[Review the implementation/.test(report.body) || !/^Outcome: blocked$/m.test(report.body) || !event.comment?.body?.trim() || event.comment.created_at <= report.created_at) return null;
   const declared = report.body.match(/<!-- lighthouse-stage:([a-z]+):blocked -->/);
   const stage = declared?.[1] ?? (/^## Proposal: blocked candidate$/m.test(report.body) ? 'propose' : /^## Refinement:/m.test(report.body) ? 'refine' : null);
-  return ['refine', 'propose', 'implement'].includes(stage) ? { stage, report } : null;
+  return ['triage', 'refine', 'propose', 'implement'].includes(stage) ? { stage, report } : null;
 }
 
 export function routeIssue(event, actor, owner, eventName, comments = []) {
@@ -27,13 +29,13 @@ export function routeIssue(event, actor, owner, eventName, comments = []) {
   if (labels.includes('future') && (event.label?.name === 'implement' || event.inputs?.stage === 'implement')) return { run: false, reason: 'Implementation paused by future label' };
   if (labels.some(x => ['human-working', 'agent-working'].includes(x))) return { run: false, reason: 'Issue reserved' };
   if (eventName === 'issues' && event.action === 'unlabeled' && event.label?.name === 'future' && labels.includes('implement')) return { run: true, stage: 'implement', issue: event.issue.number, reason: 'Owner resumed implementation' };
-  if (eventName === 'issues' && event.action === 'labeled' && ['refine', 'propose', 'implement'].includes(event.label?.name)) return { run: true, stage: event.label.name, issue: event.issue.number, reason: `Owner requested ${event.label.name}` };
+  if (eventName === 'issues' && event.action === 'labeled' && ['triage', 'refine', 'propose', 'implement'].includes(event.label?.name)) return { run: true, stage: event.label.name, issue: event.issue.number, reason: `Owner requested ${event.label.name}` };
   if (eventName === 'issue_comment' && event.action === 'created' && event.comment?.user?.login === owner && event.comment.user.type !== 'Bot' && labels.some(x => ['needs-info', 'waiting-review'].includes(x))) {
     const pending = pendingReply(event, comments);
     if (pending) return { run: true, stage: pending.stage, issue: event.issue.number, reason: `Owner answered pending ${pending.stage}` };
   }
   if (eventName === 'workflow_dispatch' && ['integrate', 'review'].includes(event.inputs?.stage) && (!/^[1-9][0-9]*$/.test(event.inputs?.pull_request ?? '') || !/^[a-f0-9]{40}$/.test(event.inputs?.head ?? ''))) return { run: false, reason: 'Completion needs a PR and accepted full head SHA' };
-  if (eventName === 'workflow_dispatch' && ['refine', 'propose', 'implement', 'integrate', 'review'].includes(event.inputs?.stage ?? 'refine') && /^[1-9][0-9]*$/.test(event.inputs?.issue ?? '')) return { run: true, stage: event.inputs.stage ?? 'refine', issue: Number(event.inputs.issue), reason: 'Owner requested manual stage' };
+  if (eventName === 'workflow_dispatch' && ['triage', 'refine', 'propose', 'implement', 'integrate', 'review'].includes(event.inputs?.stage ?? 'refine') && /^[1-9][0-9]*$/.test(event.inputs?.issue ?? '')) return { run: true, stage: event.inputs.stage ?? 'refine', issue: Number(event.inputs.issue), reason: 'Owner requested manual stage' };
   return { run: false, reason: 'No eligible stage event' };
 }
 export function checkHandoff(request, envelope, issue, answers, revision, runId) {
@@ -135,7 +137,7 @@ async function main(command) {
     if (!route.run || route.issue !== issueNumber || !(env.LIGHTHOUSE_ENABLED_STAGES ?? stages.join(',')).split(',').includes(stage) || env.LIGHTHOUSE_STAGE && env.LIGHTHOUSE_STAGE !== stage) throw Error('Stage dispatch is not authorized');
     const issue = await api(issuePath), answers = ownerAnswers(await comments());
     const metadata = await api(''), revision = (await api(`commits/${metadata.default_branch}`)).sha;
-    if (issue.user.login !== owner || issue.state !== 'open' && stage !== 'review' || issue.pull_request || issue.labels.some(x => x.name === 'human-working' || x.name === 'agent-working' && !queue)) throw Error('Issue not eligible for dispatch');
+    if (!eligibleIssueAuthor(issue, owner, stage) || issue.state !== 'open' && stage !== 'review' || issue.pull_request || issue.labels.some(x => x.name === 'human-working' || x.name === 'agent-working' && !queue)) throw Error('Issue not eligible for dispatch');
     if (handoff) {
       const prior = await readActionsJson(api, repo, route.predecessor.runId, `lighthouse-input-${issueNumber}-${route.predecessor.attempt}`, 'request.json');
       const result = await readActionsJson(api, repo, route.predecessor.runId, `lighthouse-result-${issueNumber}-${route.predecessor.attempt}`, 'envelope.json');
@@ -173,7 +175,7 @@ async function main(command) {
     if (handoff && !after) route = { run: env.GITHUB_ACTOR === owner && !reviewTarget(event, env.GITHUB_EVENT_NAME) && ['issues', 'issue_comment', 'workflow_dispatch'].includes(env.GITHUB_EVENT_NAME), stage: 'implement', issue: issueNumber };
     if (!route.run || issueNumber !== route.issue || env.GITHUB_TRIGGERING_ACTOR !== owner) throw Error('Stage not authorized');
     const issue = await api(issuePath);
-    if (issue.user.login !== owner || issue.state !== 'open' || issue.pull_request || issue.labels.some(x => ['agent-working', 'human-working'].includes(x.name))) throw Error('Issue not eligible');
+    if (!eligibleIssueAuthor(issue, owner, route.stage) || issue.state !== 'open' || issue.pull_request || issue.labels.some(x => ['agent-working', 'human-working'].includes(x.name))) throw Error('Issue not eligible');
     const repository = await api('');
     const baseRevision = (await api(`commits/${repository.default_branch}`)).sha;
     const revision = { sha: implementationReview ? implementationReview.head : baseRevision };
@@ -204,7 +206,16 @@ async function main(command) {
     }
     const stage = route.stage;
     await output('artifact_prefix', stage === 'implement' ? 'implement-' : '');
-    let predecessor, implementation, seed, planningReference;
+    let predecessor, implementation, seed, planningReference, triage;
+    if (stage === 'refine' || issue.user.login !== owner && !proposalReview && !implementationReview && ['propose', 'implement'].includes(stage)) {
+      const report = [...all].reverse().find(c => c.user?.login === 'github-actions[bot]' && c.user.type === 'Bot' && c.body.includes('<!-- lighthouse-stage:triage:passed -->'));
+      if (!report && issue.user.login !== owner) throw Error('External request requires authenticated passed triage before later work');
+      if (report) {
+        triage = await loadStageReport(api, repo, report, { owner, issue: issueNumber });
+        const errors = validateStageEnvelope(triage.envelope, triage.request);
+        if (errors.length || triage.request.stage !== 'triage' || triage.envelope.result.status !== 'passed' || triage.request.sourceRevision !== revision.sha || triage.request.originalRequest !== (issue.body ?? '')) throw Error('Triage evidence is invalid or stale; request triage again');
+      }
+    }
     if (stage === 'implement') {
       if (handoff) {
         const prior = JSON.parse(await readFile(join(env.RUNNER_TEMP, 'refinement-handoff', 'request.json'), 'utf8'));
@@ -213,6 +224,7 @@ async function main(command) {
         checkHandoff(prior, result, issue, answers, revision.sha, dispatch?.request.predecessor?.runId ?? dispatch?.request.routerRunId ?? env.GITHUB_RUN_ID);
       }
       if (issue.labels.some(x => x.name === 'future')) throw Error('Implementation paused by future label');
+      if (issue.user.login !== owner && !handoff && !implementationReview) await loadRefinement(api, repo, all, { owner, issue: issueNumber, sourceRevision: revision.sha, taskDigest: taskDigest(issue, answers) });
       implementation = await loadImplementation(api, issueNumber, owner, baseRevision, repository.default_branch);
       seed = implementationReview ? null : await loadImplementationSeed(api, implementation.policy, revision.sha);
       const pulls = await api('pulls?state=open&per_page=100');
@@ -237,12 +249,16 @@ async function main(command) {
     const id = digest(`${repo}:${issueNumber}:${stage}:${env.GITHUB_RUN_ID}:${env.GITHUB_RUN_ATTEMPT}`);
     await mkdir(dir, { recursive: true });
     const snapshot = { autoImplement: env.LIGHTHOUSE_AUTO_IMPLEMENT === 'true', ...(dispatch ? { workflowRevision: env.GITHUB_SHA, dispatch: { commentId: dispatch.commentId, requestId: dispatch.request.id, digest: dispatch.receipt.digest } } : {}), ...(planningReference ? { planningReference } : {}), ...(implementationReview ? { implementationReview, baseRevision } : {}), ...(proposalReview ? { proposalReview } : {}), runId: id, issue: issueNumber, stage, title: issue.title, defaultBranch: repository.default_branch, sourceRevision: revision.sha, taskDigest: taskDigest(issue, answers), workflowRunId: env.GITHUB_RUN_ID, ...(predecessor ? { refinement: predecessor } : {}), ...(continuation ? { replyTo: continuation.request.runId, commentId: event.comment.id } : {}), ...(implementation ? { implementation } : {}), ...(seed ? { seedDigest: changesDigest(seed) } : {}) };
+    if (stage === 'triage') snapshot.originalRequest = issue.body ?? '';
+    if (triage) snapshot.triageEstimate = triage.envelope.result.output.estimate;
     await output('source_revision', revision.sha);
     await writeFile(join(dir, 'request.json'), JSON.stringify(snapshot));
     if (seed) await writeFile(join(dir, 'seed.json'), JSON.stringify(seed));
     await writeFile(join(dir, 'issue.json'), JSON.stringify({ ...issue, ownerAnswers: answers.map(c => ({ body: c.body, url: c.html_url, author: c.user.login })) }));
     const contract = fileURLToPath(new URL('./host-contract.mjs', import.meta.url));
     const context = JSON.parse(execFileSync(process.execPath, [contract, 'context', join(dir, 'request.json'), join(dir, 'issue.json')], { encoding: 'utf8' }));
+    if (triage) context.triage = triage.envelope.result.output;
+    if (stage === 'triage') context.contract.rules += ' Preserve the exact issue body in output.requestAnalysis.originalRequest. Return output.estimate and output.requestAnalysis following /harness/request-triage.md. Stop at triaged; never authorize or dispatch refinement.';
     if (predecessor || proposalReview) {
       if (predecessor) context.predecessor = predecessor;
       if (proposalReview) {
@@ -273,7 +289,12 @@ async function main(command) {
     await writeFile(join(dir, 'context.json'), JSON.stringify(context));
     await api(`${issuePath}/labels`, 'POST', { labels: ['agent-working'] });
     await writeFile(join(dir, 'reserved'), id);
-    for (const label of stage === 'refine' ? ['needs-info', 'ready', 'waiting-review'] : ['needs-info', 'waiting-review']) if (issue.labels.some(x => x.name === label)) await api(`${issuePath}/labels/${label}`, 'DELETE');
+    for (const label of ['needs-info', 'waiting-review', ...(stage === 'refine' || stage === 'implement' ? ['ready'] : [])]) if (issue.labels.some(x => x.name === label)) await api(`${issuePath}/labels/${label}`, 'DELETE');
+    if (stage === 'implement' && implementationReview) {
+      const pr = await api(`pulls/${implementationReview.number}`);
+      if (!pr.draft) await setPullRequestDraft(env.GH_TOKEN, pr, true);
+      await projectImplementationPrState(api, issueNumber, true);
+    }
     await summary(`### ${stage} #${issueNumber}\nSource: \`${revision.sha}\`\n\nOwner request verified; reservation acquired.\n`);
     if (continuation) {
       const marker = `<!-- lighthouse-reply:${event.comment.id} -->`;
@@ -290,6 +311,13 @@ async function main(command) {
   }
   if (command === 'cleanup') { try { await readFile(join(dir, 'reserved')); } catch { return; } }
   const snapshot = JSON.parse(await readFile(join(dir, 'request.json'), 'utf8'));
+  if (command === 'continue-refinement') {
+    await readFile(join(dir, 'published'));
+    const envelope = JSON.parse(await readFile(join(dir, 'envelope.json'), 'utf8'));
+    const sent = await signalRefinementContinuation(api, snapshot, envelope);
+    await summary(sent ? 'Implementation continuation requested; the router will verify the completed refinement.' : 'No implementation continuation requested.');
+    return;
+  }
   if (snapshot.dispatch) env.LIGHTHOUSE_AUTO_IMPLEMENT = String(snapshot.autoImplement === true);
   if (command === 'validate') {
     const value = JSON.parse(await readFile(join(dir, 'envelope.json'), 'utf8'));
@@ -315,7 +343,7 @@ async function main(command) {
     const marker = `<!-- lighthouse-actions:${snapshot.runId} -->`;
     const existing = (await comments()).find(c => c.user.type === 'Bot' && c.body.includes(marker));
     const runUrl = `https://github.com/${repo}/actions/runs/${env.GITHUB_RUN_ID}`;
-    let proposalLink = '';
+    let proposalLink = '', prStateProof = '';
     if (snapshot.stage === 'propose' && value.result.status === 'passed') {
       const files = await prepareProposal(issueNumber, value.result.output.files);
       const recheck = async () => {
@@ -352,24 +380,27 @@ async function main(command) {
           }
           if (pulls.length >= 100 || pulls.some(pr => pr.number !== snapshot.implementationReview?.number && pr.head.ref.startsWith(`lighthouse/implement-${issueNumber}-`))) throw Error('Existing implementation PR requires review');
         };
-        const draft = value.result.status !== 'passed' || !checksPassed;
+        const candidateComplete = value.result.status === 'passed' && checksPassed;
         const checks = receipt.checks.map(c => `- \`${c.command.join(' ')}\`: exit ${c.exitCode}`).join('\n');
-        const pr = await createImplementationPullRequest(api, snapshot, changes, `${value.effect.body}\n\nHost checks:\n${checks}`, runUrl, draft, recheck);
+        const pr = await createImplementationPullRequest(api, snapshot, changes, value.effect.body, runUrl, true, recheck);
+        prStateProof = `<!-- lighthouse-pr-state:${JSON.stringify({ pr: pr.number, head: pr.head.sha, complete: candidateComplete, run: Number(env.GITHUB_RUN_ID) })} -->`;
+        await writeFile(join(dir, 'published-pr.json'), JSON.stringify({ number: pr.number, head: pr.head.sha }));
         try { await dispatchDeliveryChecks(api, snapshot.baseRevision ?? snapshot.sourceRevision, pr); }
         catch (error) { value.effect.body += '\n\nThe PR was saved, but CI could not start. See the run for details.'; await summary(`CI dispatch failed: ${error.message}`); }
         if (snapshot.implementationReview) await api(`issues/${pr.number}/comments`, 'POST', { body: `Updated the PR with your feedback. [Checks and evidence](${runUrl}).\n\n${snapshot.implementationReview.receipt}` });
-        proposalLink = `\n\n[Review the implementation${draft ? ' draft' : ''}](${pr.html_url}). Human acceptance and merge remain separate decisions.`;
+        proposalLink = `\n\n[Implementation PR #${pr.number}](${pr.html_url}) is a draft. ${candidateComplete ? 'Required CI will decide when it becomes ready for review.' : 'Address the blocker in the run before review.'}`;
         await summary(`### Implementation PR\n[Review #${pr.number}](${pr.html_url})\n\nHost checks:\n${checks}`);
       }
     }
     if (snapshot.proposalReview && value.result.status === 'blocked') await api(`issues/${snapshot.proposalReview.number}/comments`, 'POST', { body: `Proposal revision is blocked. ${value.effect.body}\n\n[Execution](${runUrl}). Implementation has not started.` });
-    const continuationHint = snapshot.proposalReview ? `\n\nContinue the review in [PR #${snapshot.proposalReview.number}](${snapshot.proposalReview.url}).\n<!-- lighthouse-proposal-review:${snapshot.proposalReview.number} -->` : value.result.status === 'blocked' && ['refine', 'propose', 'implement'].includes(snapshot.stage) && !proposalLink ? `\n\nReply here to continue.` : '';
+    const continuationHint = snapshot.proposalReview ? `\n\nContinue the review in [PR #${snapshot.proposalReview.number}](${snapshot.proposalReview.url}).\n<!-- lighthouse-proposal-review:${snapshot.proposalReview.number} -->` : value.result.status === 'blocked' && ['triage', 'refine', 'propose', 'implement'].includes(snapshot.stage) && !proposalLink ? `\n\nThe owner can reply here to continue ${snapshot.stage}.` : '';
     const next = snapshot.stage === 'refine' && value.result.status === 'passed' && env.LIGHTHOUSE_AUTO_IMPLEMENT === 'true' ? publicationIssue.labels.some(x => x.name === 'future') ? '\n\n⏸️ Implementation is paused by `future`.' : '\n\nRefinement complete. Implementation is next; use `future` to pause it.' : '';
-    const body = `## ${statusText(snapshot.stage, value.result.status === 'blocked' ? 'waiting' : 'completed')}\n\n${snapshot.stage === 'propose' && value.result.status === 'passed' ? 'Proposal ready. Review it in the linked PR; comment there to request changes.' : value.effect.body}${proposalLink}${continuationHint}${next}\n\n[Follow progress](${runUrl})\n\n<details><summary>Execution details</summary>\n\nOutcome: ${value.result.status}\n\n[Workflow run](${runUrl}) · source \`${snapshot.sourceRevision}\`\n\n${marker}\n<!-- lighthouse-stage:${snapshot.stage}:${value.result.status} -->\n</details>`;
+    const body = `## ${statusText(snapshot.stage, value.result.status === 'blocked' ? 'waiting' : 'completed')}\n\n${snapshot.stage === 'propose' && value.result.status === 'passed' ? 'Proposal ready. Review it in the linked PR; comment there to request changes.' : value.effect.body}${proposalLink}${continuationHint}${next}\n\n[Follow progress](${runUrl})\n\n<details><summary>Execution details</summary>\n\nOutcome: ${value.result.status}\n\n[Workflow run](${runUrl}) · source \`${snapshot.sourceRevision}\`\n\n${marker}\n${prStateProof}\n<!-- lighthouse-stage:${snapshot.stage}:${value.result.status} -->\n</details>`;
     const report = existing ?? await api(`${issuePath}/comments`, 'POST', { body });
     const handoff = snapshot.stage === 'refine' && value.result.status === 'passed' && env.LIGHTHOUSE_AUTO_IMPLEMENT === 'true';
-    const label = ['propose', 'implement'].includes(snapshot.stage) ? 'waiting-review' : value.result.status === 'passed' ? 'ready' : 'needs-info';
-    await api(`${issuePath}/labels`, 'POST', { labels: [label] });
+    const label = snapshot.stage === 'implement' && prStateProof ? 'pr-draft' : ['propose', 'implement'].includes(snapshot.stage) ? 'waiting-review' : value.result.status === 'passed' ? snapshot.stage === 'triage' ? 'triaged' : 'ready' : 'needs-info';
+    if (label === 'pr-draft') await projectImplementationPrState(api, issueNumber, true);
+    else await api(`${issuePath}/labels`, 'POST', { labels: [label] });
     const fresh = await api(issuePath);
     if (fresh.labels.some(x => x.name === snapshot.stage)) await api(`${issuePath}/labels/${snapshot.stage}`, 'DELETE');
     if (handoff) {
@@ -377,19 +408,32 @@ async function main(command) {
       await output('implement', String(!fresh.labels.some(x => x.name === 'future')));
     }
     await writeFile(join(dir, 'published'), report.html_url);
-    await summary(`### Published\n[Issue #${issueNumber}](${report.html_url}) · **${label}**\n\n${['propose', 'implement'].includes(snapshot.stage) ? 'Review the PR or blocker report; no next stage is authorized.' : label === 'needs-info' ? 'Reply to the question here; an owner reply resumes refinement.' : handoff ? 'Refinement complete. Implementation follows automatically unless paused with future.' : 'Refinement complete. Implementation is available when the repository enables the implement worker.'}`);
+    await summary(`### Published\n[Issue #${issueNumber}](${report.html_url}) · **${label}**\n\n${['propose', 'implement'].includes(snapshot.stage) ? 'Review the PR or blocker report; no next stage is authorized.' : label === 'needs-info' ? `The owner can answer the question to resume ${snapshot.stage}.` : snapshot.stage === 'triage' ? 'Triage complete. The owner decides whether to request refinement; no next stage has started.' : handoff ? 'Refinement complete. Implementation follows automatically unless paused with future.' : 'Refinement complete. Implementation is available when the repository enables the implement worker.'}`);
     console.log(`Published ${label}: ${report.html_url}`); return;
   }
   if (command === 'cleanup') {
     try { await readFile(join(dir, 'reserved')); } catch { return; }
     const issue = await api(issuePath);
     if (issue.labels.some(x => x.name === 'agent-working')) await api(`${issuePath}/labels/agent-working`, 'DELETE');
-    try { await readFile(join(dir, 'published')); }
+    let published = false;
+    try { await readFile(join(dir, 'published')); published = true; }
     catch {
       if (snapshot.proposalReview) await api(`issues/${snapshot.proposalReview.number}/comments`, 'POST', { body: `Proposal update did not complete. Your feedback is retained. [See execution](https://github.com/${repo}/actions/runs/${env.GITHUB_RUN_ID}).` });
       if (snapshot.replyTo) await api(`${issuePath}/labels`, 'POST', { labels: [snapshot.stage === 'refine' ? 'needs-info' : 'waiting-review'] });
       await summary('### Execution incomplete\nNo completed publication. Inspect the failed step; the pending decision remains unfulfilled.');
     }
+    if (published && snapshot.stage === 'implement') {
+      try {
+        const saved = JSON.parse(await readFile(join(dir, 'published-pr.json'), 'utf8'));
+        const pr = await api(`pulls/${saved.number}`);
+        if (pr.state === 'open' && pr.head.sha === saved.head) {
+          const profileFile = await api(`contents/.lighthouse/github.json?ref=${snapshot.defaultBranch}`);
+          const profile = JSON.parse(Buffer.from(profileFile.content, 'base64').toString());
+          const required = profile.requiredChecks.map(check => ({ context: check.context, app: check.integrationId }));
+          await reconcileImplementationPr(api, repo, pr, await api(issuePath), await comments(), required, (current, draft) => setPullRequestDraft(env.GH_TOKEN, current, draft), { auto: true });
+        }
+      } catch (error) { await summary(`PR state will be retried after CI: ${error.message}.`); }
+    }
     console.log('Execution reservation released'); return;
   }
   throw Error('Unknown issue workflow command');

package/src/model-profiles.mjs

@@ -0,0 +1,58 @@
+// Selection is configuration, never authority or proof of provider access.
+export const MODEL_PROFILES = Object.freeze(['plan', 'build', 'fast']);
+export const REASONING_EFFORTS = Object.freeze(['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']);
+const record = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const own = (value, key) => Object.hasOwn(value ?? {}, key);
+function keys(value, allowed, label) {
+  if (!record(value) || Object.keys(value).some(key => !allowed.includes(key))) throw Error(`Invalid ${label}`);
+}
+function validateSettings(value, operator = false) {
+  keys(value, ['schemaVersion', 'profiles', 'workers', 'defaultProfile', ...(operator ? ['enabled'] : [])], 'model profile configuration');
+  if (value.schemaVersion !== 1) throw Error('Model profiles require schemaVersion 1');
+  if (operator && typeof value.enabled !== 'boolean') throw Error('Operator model profiles require explicit enabled');
+  if (own(value, 'defaultProfile') && !MODEL_PROFILES.includes(value.defaultProfile)) throw Error('Invalid default model profile');
+  if (own(value, 'profiles')) {
+    keys(value.profiles, MODEL_PROFILES, 'profile names');
+    for (const profile of Object.values(value.profiles)) {
+      keys(profile, ['model', 'reasoningEffort'], 'model profile settings');
+      if (own(profile, 'model') && !/^openai\/[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(profile.model)) throw Error('Profile model must be an OpenAI provider/model identifier without a variant');
+      if (own(profile, 'reasoningEffort') && !REASONING_EFFORTS.includes(profile.reasoningEffort)) throw Error('Invalid reasoning effort');
+    }
+  }
+  if (own(value, 'workers')) {
+    if (!record(value.workers) || Object.entries(value.workers).some(([worker, profile]) => !/^[a-z][a-z0-9-]{0,63}$/.test(worker) || !MODEL_PROFILES.includes(profile))) throw Error('Invalid worker profile assignments');
+  }
+  return value;
+}
+
+export function resolveModelProfile({ project = null, operator, worker, profile } = {}) {
+  if (!record(operator)) throw Error('Operator model configuration required');
+  if (project !== null) validateSettings(project);
+  const local = operator.modelProfiles;
+  if (local !== undefined) validateSettings(local, true);
+  if (!local?.enabled) {
+    if (profile !== undefined) throw Error('Delegated profiles require operator opt-in');
+    if (typeof operator.model !== 'string' || !operator.model.trim() || /[\0\r\n]/.test(operator.model)) throw Error('Legacy operator model required');
+    return { mode: 'legacy', profile: null, model: operator.model, reasoningEffort: null, engineModel: operator.model, source: 'operator.model', capabilityEvidence: 'not-checked-legacy' };
+  }
+  if (profile !== undefined && !MODEL_PROFILES.includes(profile)) throw Error('Invalid requested model profile');
+  const choices = [[profile, 'task.profile'], [own(local.workers, worker) ? local.workers[worker] : undefined, 'operator.workers'], [own(project?.workers, worker) ? project.workers[worker] : undefined, 'project.workers'], [local.defaultProfile, 'operator.defaultProfile'], [project?.defaultProfile, 'project.defaultProfile']];
+  const choice = choices.find(([name]) => name !== undefined);
+  if (!choice) throw Error('No model profile assigned to worker');
+  const [name, source] = choice;
+  const base = project?.profiles?.[name] ?? {}, override = local.profiles?.[name] ?? {};
+  const selected = { ...base, ...override };
+  if (!selected.model || !selected.reasoningEffort) throw Error(`Incomplete model profile: ${name}`);
+  const capability = operator.modelCapabilities?.[selected.model];
+  if (!record(capability) || capability.available !== true || capability.tools !== true || !Array.isArray(capability.reasoningEfforts) || !capability.reasoningEfforts.includes(selected.reasoningEffort)) throw Error(`Model or reasoning unavailable in operator capabilities: ${name}`);
+  return { mode: 'profile', profile: name, ...selected, engineModel: `${selected.model}#${selected.reasoningEffort}`, source, fields: { model: own(override, 'model') ? 'operator' : 'project', reasoningEffort: own(override, 'reasoningEffort') ? 'operator' : 'project' }, capabilityEvidence: 'operator-configuration-only' };
+}
+
+export function modelExecutionReceipt(selection) {
+  return {
+    requested: { profile: selection.profile, model: selection.model, reasoningEffort: selection.reasoningEffort },
+    resolved: selection,
+    providerReported: { model: null, reasoningEffort: null, status: 'unverified', reason: 'The current adapter has no authenticated provider-settings receipt' },
+    billing: { route: 'unchanged', actualCost: null, estimatedApiEquivalentCost: null, subscriptionUsage: null },
+  };
+}

package/src/opencode-execute.mjs

@@ -9,6 +9,7 @@ import { prepareImplementationWorkspace, copyEvidence, runImplementationChecks }
 import { validateStageEnvelope } from './host-contract.mjs';
 import { formatOpenCodeEvent, progressText, boundedEventLines } from './opencode-progress.mjs';
 import { selectEnvironment, startEnvironment, environmentArgs, environmentReceipt, redactEnvironmentLog } from './execution-environment.mjs';
+import { resolveModelProfile, modelExecutionReceipt } from './model-profiles.mjs';
 
 export function completionOutput(envelope, request) {
   const errors = validateStageEnvelope(envelope, request);
@@ -52,6 +53,16 @@ async function main() {
   const request = JSON.parse(await readFile(join(runDir, 'request.json'), 'utf8'));
   // Sequential workers share the runner temp directory; only this stage's outputs may survive.
   for (const file of ['envelope.json', 'runtime.json', 'changes.json', 'checks.json']) await rm(join(runDir, file), { force: true });
+  let projectModels = null;
+  try {
+    const directory = join(env.GITHUB_WORKSPACE, '.lighthouse'), directoryStat = await lstat(directory);
+    if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) throw Error('Invalid project model configuration directory');
+    const path = join(directory, 'models.json'), stat = await lstat(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 65536) throw Error('Invalid project model configuration file');
+    projectModels = JSON.parse(await readFile(path, 'utf8'));
+  }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
+  const modelSelection = resolveModelProfile({ project: projectModels, operator: config, worker: env.LIGHTHOUSE_WORKER ?? request.stage });
   const selected = request.stage === 'implement' ? selectEnvironment(config, request.implementation?.environment) : null;
   if (request.stage === 'implement') {
     if (selected) config.implementationImage = selected.image;
@@ -91,24 +102,25 @@ async function main() {
     const context = join(dir, 'context.json');
     await copyFile(join(runDir, 'context.json'), context); await chmod(context, 0o444);
     const prompt = join(dir, 'prompt.txt');
-    const completionBoundary = '\n\n# Completion in this custom engine adapter\nThe trusted host, outside this container, records the gh-aw terminal noop after validating /output/envelope.json. The safeoutputs CLI and /tmp/gh-aw/agent instructions describe host duties in this integration. Their absence inside the engine is expected, not an unavailable product check. Write the envelope and stop; do not install or invoke safeoutputs.\n';
+    const completionBoundary = '\n\n# Completion in this custom engine adapter\nThe trusted host, outside this container, records the gh-aw terminal noop after validating /output/envelope.json. The safeoutputs CLI and /tmp/gh-aw/agent instructions describe host duties in this integration. Their absence inside the engine is expected, not an unavailable product check. Read /harness/skills/concise-results/SKILL.md when writing effect.body. Write the envelope and stop; do not install or invoke safeoutputs.\n';
     await writeFile(prompt, await readFile(env.GH_AW_PROMPT, 'utf8') + completionBoundary, { mode: 0o444 });
     const harness = resolve(dirname(fileURLToPath(import.meta.url)), '..');
     const pkg = JSON.parse(await readFile(join(harness, 'package.json'), 'utf8'));
-    await writeFile(join(runDir, 'runtime.json'), JSON.stringify({ package: { name: pkg.name, version: pkg.version }, harnessRevision: execFileSync('git', ['-C', harness, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim(), image: config.image, environment: environmentReceipt(selected), model: config.model, engine: 'OpenCode 2.1.0', isolation: 'Docker; no AWF egress filtering', skills: await readdir(join(harness, 'skills')), sourceRevision: request.sourceRevision, seed: request.implementation?.policy.seed ?? null, seedDigest: request.seedDigest ?? null }));
+    await writeFile(join(runDir, 'runtime.json'), JSON.stringify({ package: { name: pkg.name, version: pkg.version }, harnessRevision: execFileSync('git', ['-C', harness, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim(), image: config.image, environment: environmentReceipt(selected), model: modelSelection.model, modelExecution: modelExecutionReceipt(modelSelection), engine: 'OpenCode 2.1.0', isolation: 'Docker; no AWF egress filtering', skills: await readdir(join(harness, 'skills')), sourceRevision: request.sourceRevision, seed: request.implementation?.policy.seed ?? null, seedDigest: request.seedDigest ?? null }));
     const args = ['run', '--rm', '--init', '--name', name, '--user', `${config.uid}:${config.uid}`, '--cpus', '2', '--memory', implementing ? '4g' : '2g', '--pids-limit', implementing ? '256' : '128', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges', '--read-only',
       '--tmpfs', '/tmp:rw,exec,size=1g,mode=1777', '--tmpfs', `/home/engine/.cache:rw,size=1g,uid=${config.uid},gid=${config.uid}`, '--tmpfs', `/home/engine/.config:rw,size=16m,uid=${config.uid},gid=${config.uid}`, '--tmpfs', `/home/engine/.local/state:rw,size=64m,uid=${config.uid},gid=${config.uid}`,
       '--mount', `type=bind,src=${source},dst=/workspace${implementing ? '' : ',readonly'}`, '--mount', `type=bind,src=${output},dst=/output`, '--mount', `type=bind,src=${context},dst=/input/context.json,readonly`, '--mount', `type=bind,src=${prompt},dst=/input/prompt.txt,readonly`, '--mount', `type=bind,src=${harness},dst=/harness,readonly`,
-      '--mount', `type=volume,src=${config.authVolume},dst=/home/engine/.local/share/opencode`, '--env', `ENGINE_SESSION=ses_${request.runId}`, '--env', `ENGINE_MODEL=${config.model}`, '--env', `ENGINE_STAGE=${request.stage}`, '--env', 'NPM_CONFIG_CACHE=/tmp/npm-cache', '--env', 'PLAYWRIGHT_BROWSERS_PATH=/workspace/.cache/ms-playwright', ...environmentArgs(runtime), config.image];
+      '--mount', `type=volume,src=${config.authVolume},dst=/home/engine/.local/share/opencode`, '--env', `ENGINE_SESSION=ses_${request.runId}`, '--env', `ENGINE_MODEL=${modelSelection.engineModel}`, '--env', `ENGINE_STAGE=${request.stage}`, '--env', 'NPM_CONFIG_CACHE=/tmp/npm-cache', '--env', 'PLAYWRIGHT_BROWSERS_PATH=/workspace/.cache/ms-playwright', ...environmentArgs(runtime), config.image];
     const eventsPath = join(env.RUNNER_TEMP, 'gh-aw', `opencode-events-${env.GITHUB_RUN_ID}-${env.GITHUB_RUN_ATTEMPT}.jsonl`);
     await mkdir(dirname(eventsPath), { recursive: true });
     await writeFile(eventsPath, '', { mode: 0o600 });
     const started = Date.now();
-    let lastVisible = started;
+    let lastVisible = started, engineError = false;
     const redact = text => redactLog(redactEnvironmentLog(runtime, text));
     const report = text => { lastVisible = Date.now(); console.log(redact(text)); };
     const eventLine = line => {
       const redacted = redact(line);
+      try { if (JSON.parse(redacted).type === 'error') engineError = true; } catch {}
       appendFileSync(eventsPath, redacted + '\n');
       const visible = formatOpenCodeEvent(redacted);
       if (visible) report(visible);
@@ -137,6 +149,7 @@ async function main() {
       child.on('error', no); child.on('close', code => code === 0 && !cancelled ? ok() : no(Error('OpenCode failed or was cancelled')));
       timer = setTimeout(cancel, implementing ? 1800000 : 600000);
     });
+    if (engineError) throw Error('OpenCode reported an execution error; no model fallback attempted');
     const result = join(output, 'envelope.json'), stat = await lstat(result);
     if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 128000) throw Error('Invalid engine result file');
     const envelope = JSON.parse(await readFile(result, 'utf8'));

package/src/pr-state-actions.mjs

@@ -0,0 +1,106 @@
+import { readFile } from 'node:fs/promises';
+import { checkImplementationPullRequest } from './proposal-review.mjs';
+import { authorizedCiCallback, projectImplementationPrState, reconcileImplementationPr, scheduledImplementationPulls, setPullRequestDraft } from './pr-state.mjs';
+
+const apiFor = (repo, token) => async (path, method = 'GET', body, optional = false) => {
+  const response = await fetch(`https://api.github.com/repos/${repo}${path ? `/${path}` : ''}`, {
+    method, headers: { Authorization: `Bearer ${token}`, Accept: 'application/vnd.github+json', 'X-GitHub-Api-Version': '2022-11-28', ...(body ? { 'Content-Type': 'application/json' } : {}) },
+    ...(body ? { body: JSON.stringify(body) } : {}), signal: AbortSignal.timeout(30000),
+  });
+  if (optional && response.status === 404) return null;
+  if (!response.ok) throw Error(`GitHub ${method} ${path}: ${response.status}`);
+  return response.status === 204 ? null : response.json();
+};
+const commentsFor = async (api, issue) => {
+  const comments = [];
+  for (let page = 1; page <= 10; page++) {
+    const batch = await api(`issues/${issue}/comments?per_page=100&page=${page}`);
+    comments.push(...batch);
+    if (batch.length < 100) return comments;
+  }
+  throw Error('Issue comment history exceeds bound');
+};
+const requiredChecks = profile => {
+  const checks = profile.requiredChecks;
+  if (!Array.isArray(checks) || !checks.length || checks.length > 20 || checks.some(item => !item.context || item.integrationId !== null && !Number.isSafeInteger(item.integrationId))) throw Error('Invalid required-check profile');
+  return checks.map(item => ({ context: item.context, app: item.integrationId }));
+};
+async function main() {
+  const env = process.env, repo = env.GITHUB_REPOSITORY, owner = env.GITHUB_REPOSITORY_OWNER;
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo ?? '') || !env.GH_TOKEN) throw Error('Missing repository or token');
+  const api = apiFor(repo, env.GH_TOKEN);
+  const event = JSON.parse(await readFile(env.GITHUB_EVENT_PATH, 'utf8'));
+  const metadata = await api('');
+  const config = await api(`contents/.lighthouse/github.json?ref=${metadata.default_branch}`, 'GET', undefined, true);
+  if (!config) return;
+  const profile = JSON.parse(Buffer.from(config.content, 'base64').toString());
+  if (profile.repository !== repo) throw Error('Repository profile differs from the event');
+  let candidates = [];
+  const ciCallback = env.GITHUB_EVENT_NAME === 'workflow_dispatch' && env.LIGHTHOUSE_CI_RECONCILE === 'true';
+  if (env.GITHUB_EVENT_NAME === 'pull_request') {
+    if (env.GITHUB_ACTOR !== owner || !['ready_for_review', 'converted_to_draft', 'closed', 'reopened'].includes(event.action)) return;
+    candidates = [event.pull_request?.number];
+  } else if (env.GITHUB_EVENT_NAME === 'workflow_run') {
+    const id = event.workflow_run?.id;
+    if (event.action !== 'completed' || !Number.isSafeInteger(id)) return;
+    const run = await api(`actions/runs/${id}`);
+    if (run.status !== 'completed' || run.conclusion !== 'success' || run.head_sha !== event.workflow_run.head_sha || run.repository?.full_name !== repo || !profile.completion?.postMergeWorkflows?.some(name => run.path === `.github/workflows/${name}`)) return;
+    const pulls = await api(`commits/${run.head_sha}/pulls?per_page=100`);
+    if (pulls.length >= 100) throw Error('PR lookup exceeds bound');
+    candidates = pulls.filter(pr => pr.head?.sha === run.head_sha).map(pr => pr.number);
+  } else if (env.GITHUB_EVENT_NAME === 'schedule') {
+    candidates = await scheduledImplementationPulls(api);
+  } else if (ciCallback) {
+    const id = Number(env.GITHUB_RUN_ID);
+    if (!Number.isSafeInteger(id) || !/^[a-f0-9]{40}$/.test(env.GITHUB_SHA ?? '')) throw Error('CI callback lacks a run or head');
+    const run = await api(`actions/runs/${id}`);
+    if (!authorizedCiCallback(run, { id, sha: env.GITHUB_SHA, repo, workflows: profile.completion?.postMergeWorkflows })) return;
+    const pulls = await api(`commits/${run.head_sha}/pulls?per_page=100`);
+    if (pulls.length >= 100) throw Error('PR lookup exceeds bound');
+    candidates = pulls.filter(pr => pr.head?.sha === run.head_sha).map(pr => pr.number);
+  } else return;
+  for (const number of candidates) {
+    if (!Number.isSafeInteger(number)) continue;
+    const pr = await api(`pulls/${number}`);
+    if (env.GITHUB_EVENT_NAME === 'pull_request' && pr.head.sha !== event.pull_request.head.sha) continue;
+    if (env.GITHUB_EVENT_NAME === 'workflow_run' && pr.head.sha !== event.workflow_run.head_sha) continue;
+    if (ciCallback && pr.head.sha !== env.GITHUB_SHA) continue;
+    if (pr.base.ref !== metadata.default_branch) continue;
+    let target;
+    try { target = checkImplementationPullRequest({ ...pr, state: 'open', merged: false }, repo); }
+    catch {
+      const match = pr.head.ref.match(/^lighthouse\/implement-([1-9][0-9]*)-[a-f0-9]{12}$/);
+      if (!match || pr.user?.login !== 'github-actions[bot]' || pr.head.repo?.full_name !== repo || pr.base.repo?.full_name !== repo || pr.state !== 'open') continue;
+      const issue = await api(`issues/${match[1]}`);
+      if (issue.state !== 'open') continue;
+      if (!pr.draft) await setPullRequestDraft(env.GH_TOKEN, pr, true);
+      await projectImplementationPrState(api, issue.number, true);
+      const notice = `<!-- lighthouse-pr-link-changed:${pr.number}:${pr.head.sha} -->`;
+      if (!(await commentsFor(api, issue.number)).some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(notice))) await api(`issues/${issue.number}/comments`, 'POST', { body: `PR #${pr.number} is back in draft because its Lighthouse link changed. Restore the PR description before review. [Open PR](${pr.html_url}).\n\n${notice}` });
+      continue;
+    }
+    const issue = await api(`issues/${target.issue}`);
+    if (issue.state !== 'open') continue;
+    if (pr.state !== 'open' || pr.merged) {
+      for (const name of ['pr-draft', 'pr-ready']) if (issue.labels.some(label => label.name === name)) await api(`issues/${issue.number}/labels/${name}`, 'DELETE', undefined, true);
+      if (!pr.merged) {
+        await api(`issues/${issue.number}/labels`, 'POST', { labels: ['waiting-review'] });
+        const notice = `<!-- lighthouse-pr-closed:${pr.number}:${pr.head.sha} -->`;
+        if (!(await commentsFor(api, issue.number)).some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(notice))) await api(`issues/${issue.number}/comments`, 'POST', { body: `PR #${pr.number} was closed without merging. Reopen it or request a new implementation. [Open PR](${pr.html_url}).\n\n${notice}` });
+      }
+      continue;
+    }
+    const comments = await commentsFor(api, target.issue);
+    if (event.action === 'converted_to_draft') {
+      const hold = `<!-- lighthouse-pr-hold:${pr.number}:${pr.head.sha} -->`;
+      if (!comments.some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(hold))) await api(`issues/${target.issue}/comments`, 'POST', { body: `PR #${pr.number} is a draft by owner choice. [Open PR](${pr.html_url}).\n\n${hold}` });
+      await projectImplementationPrState(api, target.issue, true);
+      continue;
+    }
+    const hold = comments.some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(`<!-- lighthouse-pr-hold:${pr.number}:${pr.head.sha} -->`));
+    const auto = (['workflow_run', 'schedule'].includes(env.GITHUB_EVENT_NAME) || ciCallback) && !hold;
+    const result = await reconcileImplementationPr(api, repo, pr, issue, comments, requiredChecks(profile), (current, draft) => setPullRequestDraft(env.GH_TOKEN, current, draft), { auto });
+    if (event.action === 'ready_for_review' && result.status === 'draft') await api(`issues/${target.issue}/comments`, 'POST', { body: `PR #${pr.number} remains a draft: ${result.reason}. [Open PR](${pr.html_url}).` });
+  }
+}
+main().catch(error => { console.error(`::error::${error.message}`); process.exitCode = 1; });

package/src/pr-state.mjs

@@ -0,0 +1,75 @@
+import { checkImplementationPullRequest } from './proposal-review.mjs';
+import { checkCommit } from './completion.mjs';
+
+const marker = /<!-- lighthouse-pr-state:(\{[^\n]*\}) -->/;
+
+export async function scheduledImplementationPulls(api) {
+  const numbers = [];
+  for (let page = 1; page <= 10; page++) {
+    const pulls = await api(`pulls?state=open&per_page=100&page=${page}`);
+    numbers.push(...pulls.filter(pr => /^lighthouse\/implement-[1-9][0-9]*-[a-f0-9]{12}$/.test(pr.head?.ref ?? '') && pr.user?.login === 'github-actions[bot]').map(pr => pr.number));
+    if (pulls.length < 100) return numbers;
+  }
+  throw Error('Open PR history exceeds reconciliation bound');
+}
+
+export function authorizedCiCallback(run, { id, sha, repo, workflows }) {
+  return Number.isSafeInteger(id) && /^[a-f0-9]{40}$/.test(sha ?? '') && run.id === id && run.event === 'workflow_dispatch' && run.head_sha === sha && run.repository?.full_name === repo && workflows?.some(name => run.path === `.github/workflows/${name}`) === true;
+}
+
+export async function setPullRequestDraft(token, pr, draft) {
+  if (!pr.node_id) throw Error('PR lacks GraphQL identity');
+  const field = draft ? 'convertPullRequestToDraft' : 'markPullRequestReadyForReview';
+  const response = await fetch('https://api.github.com/graphql', {
+    method: 'POST', headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+    body: JSON.stringify({ query: `mutation($id:ID!){${field}(input:{pullRequestId:$id}){pullRequest{id isDraft}}}`, variables: { id: pr.node_id } }),
+    signal: AbortSignal.timeout(30000),
+  });
+  const result = await response.json();
+  if (!response.ok || result.errors?.length || result.data?.[field]?.pullRequest?.isDraft !== draft) throw Error('GitHub could not change PR draft state');
+}
+
+export function implementationPrProof(comments, pr) {
+  for (const comment of [...comments].reverse()) {
+    if (comment.user?.login !== 'github-actions[bot]' || comment.user.type !== 'Bot') continue;
+    const raw = comment.body?.match(marker)?.[1];
+    if (!raw) continue;
+    let proof;
+    try { proof = JSON.parse(raw); } catch { continue; }
+    if (proof.pr === pr.number && proof.head === pr.head.sha && typeof proof.complete === 'boolean' && /^[1-9][0-9]*$/.test(String(proof.run))) return proof;
+  }
+  return null;
+}
+
+export async function projectImplementationPrState(api, issue, draft) {
+  const current = await api(`issues/${issue}`);
+  if (current.state !== 'open') return;
+  const wanted = draft ? 'pr-draft' : 'pr-ready';
+  for (const label of ['ready', 'waiting-review', draft ? 'pr-ready' : 'pr-draft']) {
+    if (current.labels.some(item => item.name === label)) await api(`issues/${issue}/labels/${label}`, 'DELETE', undefined, true);
+  }
+  if (!current.labels.some(item => item.name === wanted)) await api(`issues/${issue}/labels`, 'POST', { labels: [wanted] });
+}
+
+export async function reconcileImplementationPr(api, repo, pr, issue, comments, requiredChecks, setDraft, { auto = false } = {}) {
+  const target = checkImplementationPullRequest(pr, repo);
+  if (target.issue !== issue.number || issue.state !== 'open') return { status: 'ignored', reason: 'Issue or PR changed' };
+  const proof = implementationPrProof(comments, pr);
+  const checks = await checkCommit(api, pr.head.sha, requiredChecks);
+  const reserved = issue.labels.some(label => ['agent-working', 'human-working'].includes(label.name));
+  const complete = !reserved && proof?.complete === true && checks.length > 0 && checks.every(check => check.status === 'passed');
+  if (pr.draft && auto && complete) {
+    try { await setDraft(pr, false); }
+    catch (error) { if ((await api(`pulls/${pr.number}`)).draft) throw error; }
+    await projectImplementationPrState(api, issue.number, false);
+    return { status: 'ready', reason: 'Candidate and required checks passed' };
+  }
+  if (!pr.draft && !complete) {
+    try { await setDraft(pr, true); }
+    catch (error) { if (!(await api(`pulls/${pr.number}`)).draft) throw error; }
+    await projectImplementationPrState(api, issue.number, true);
+    return { status: 'draft', reason: reserved ? 'Implementation or owner work is still active' : !proof?.complete ? 'Implementation is incomplete' : 'Required checks have not passed' };
+  }
+  await projectImplementationPrState(api, issue.number, pr.draft);
+  return { status: pr.draft ? 'draft' : 'ready', reason: pr.draft ? 'PR is a draft' : 'Candidate and required checks passed' };
+}