@juangcarmona/lighthouse-sdlc 0.17.1 → 0.18.1

package/src/opencode-execute.mjs

@@ -37,6 +37,22 @@ export async function snapshotSource(root, destination) {
     await mkdir(dirname(target), { recursive: true }); await copyFile(source, target); await chmod(target, stat.mode & 0o111 ? 0o555 : 0o444);
   }
 }
+export async function installProductEvidence(input, source, expectedBaseline) {
+  const stat = await lstat(input);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) throw Error('ProductShape evidence directory is unavailable or unsafe');
+  const names = await readdir(input);
+  if (!names.includes('index.json') || names.length > 513 || names.some(name => name !== 'index.json' && !/^[A-Z0-9][A-Z0-9-]{0,159}\.json$/.test(name))) throw Error('ProductShape evidence inventory is invalid');
+  const index = JSON.parse(await readFile(join(input, 'index.json'), 'utf8'));
+  if (index.schemaVersion !== 1 || index.source !== '@prodshape/core' || index.version !== '0.25.0' || expectedBaseline && index.baselineDigest !== expectedBaseline || !Array.isArray(index.artifacts) || index.artifacts.length !== names.length - 1 || new Set(index.artifacts.map(item => item.report)).size !== index.artifacts.length || index.artifacts.some(item => !names.includes(item.report) || item.report !== `${item.id}.json`)) throw Error('ProductShape evidence index is invalid');
+  let bytes = 0;
+  const destination = join(source, '.lighthouse-product-evidence');
+  await mkdir(destination, { mode: 0o755 });
+  for (const name of names) {
+    const file = join(input, name), item = await lstat(file);
+    if (!item.isFile() || item.isSymbolicLink() || item.size > 512 * 1024 || (bytes += item.size) > 17 * 1024 * 1024) throw Error('ProductShape evidence is unsafe or exceeds bounds');
+    await copyFile(file, join(destination, name)); await chmod(join(destination, name), 0o444);
+  }
+}
 export function acquireEngineSlot(path, seconds = 240) {
   if (!isAbsolute(path ?? '')) throw Error('Operator engine lock must be an absolute path');
   const fd = openSync(path, 'a', 0o600);
@@ -90,6 +106,10 @@ async function main() {
     if (cancelled) throw Error('Execution cancelled before agent startup');
     console.log('Engine slot acquired; starting isolated OpenCode');
     await snapshotSource(env.GITHUB_WORKSPACE, source);
+    if (request.worker === 'product-change') {
+      if (!/^[a-f0-9]{64}$/.test(request.baselineDigest ?? '')) throw Error('ProductShape evidence lacks its authenticated baseline');
+      await installProductEvidence(join(runDir, 'product-evidence'), source, request.baselineDigest);
+    }
     baseline = implementing ? await sourceFiles(source) : null;
     trackedSource = baseline ? new Map(baseline) : null;
     if (implementing) {

package/src/pr-state-actions.mjs

@@ -1,6 +1,8 @@
 import { readFile } from 'node:fs/promises';
 import { checkImplementationPullRequest } from './proposal-review.mjs';
-import { authorizedCiCallback, projectImplementationPrState, reconcileImplementationPr, scheduledImplementationPulls, setPullRequestDraft } from './pr-state.mjs';
+import { authorizedCiCallback, productOnlyCheckpoint, isStaleProductDecision, projectImplementationPrState, reconcileImplementationPr, scheduledImplementationPulls, setPullRequestDraft } from './pr-state.mjs';
+import { handoff } from './handoff.mjs';
+import { productProposalProof } from './product-change.mjs';
 
 const apiFor = (repo, token) => async (path, method = 'GET', body, optional = false) => {
   const response = await fetch(`https://api.github.com/repos/${repo}${path ? `/${path}` : ''}`, {
@@ -69,14 +71,27 @@ async function main() {
     let target;
     try { target = checkImplementationPullRequest({ ...pr, state: 'open', merged: false }, repo); }
     catch {
-      const match = pr.head.ref.match(/^lighthouse\/implement-([1-9][0-9]*)-[a-f0-9]{12}$/);
+      if (productProposalProof(pr)) continue;
+      const product = productOnlyCheckpoint(pr);
+      if (product) {
+        if (!isStaleProductDecision(pr) || product.identity.repository !== repo || pr.head.repo?.full_name !== repo || pr.base.repo?.full_name !== repo || pr.state !== 'open') continue;
+        const issue = await api(`issues/${product.identity.issue}`);
+        if (issue.state !== 'open') continue;
+        if (!pr.draft) await setPullRequestDraft(env.GH_TOKEN, pr, true);
+        await projectImplementationPrState(api, issue.number, true);
+        const notice = `<!-- lighthouse-stale-product:${pr.number}:${pr.head.sha} -->`;
+        if (!(await commentsFor(api, issue.number)).some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(notice))) await api(`issues/${issue.number}/comments`, 'POST', { body: handoff({ status: 'blocked', stage: 'product-change', happened: `The product decision for PR #${pr.number} no longer matches its current head.`, action: 'Workflow maintainer: revalidate the Product Change and request a new decision for the current PR.', next: 'Product apply and parent continuation remain stopped until current evidence and approval are available.', link: `[Open PR #${pr.number}](${pr.html_url})`, details: notice }) });
+        continue;
+      }
+      const match = pr.head.ref.match(/^lighthouse\/(?:implement|propose)-([1-9][0-9]*)-[a-f0-9]{12}$/);
+      if (pr.head.ref.startsWith('lighthouse/propose-') && !pr.body?.includes('<!-- lighthouse-product-implementation:')) continue;
       if (!match || pr.user?.login !== 'github-actions[bot]' || pr.head.repo?.full_name !== repo || pr.base.repo?.full_name !== repo || pr.state !== 'open') continue;
       const issue = await api(`issues/${match[1]}`);
       if (issue.state !== 'open') continue;
       if (!pr.draft) await setPullRequestDraft(env.GH_TOKEN, pr, true);
       await projectImplementationPrState(api, issue.number, true);
       const notice = `<!-- lighthouse-pr-link-changed:${pr.number}:${pr.head.sha} -->`;
-      if (!(await commentsFor(api, issue.number)).some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(notice))) await api(`issues/${issue.number}/comments`, 'POST', { body: `PR #${pr.number} is back in draft because its Lighthouse link changed. Restore the PR description before review. [Open PR](${pr.html_url}).\n\n${notice}` });
+      if (!(await commentsFor(api, issue.number)).some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(notice))) await api(`issues/${issue.number}/comments`, 'POST', { body: handoff({ status: 'blocked', stage: 'implement', happened: `PR #${pr.number} is back in draft because its Lighthouse link changed.`, action: 'The PR owner must restore the link in the PR description.', next: 'The workflow can recheck the PR after the link is restored.', link: `[Open PR](${pr.html_url})`, details: notice }) });
       continue;
     }
     const issue = await api(`issues/${target.issue}`);
@@ -84,23 +99,22 @@ async function main() {
     if (pr.state !== 'open' || pr.merged) {
       for (const name of ['pr-draft', 'pr-ready']) if (issue.labels.some(label => label.name === name)) await api(`issues/${issue.number}/labels/${name}`, 'DELETE', undefined, true);
       if (!pr.merged) {
-        await api(`issues/${issue.number}/labels`, 'POST', { labels: ['waiting-review'] });
         const notice = `<!-- lighthouse-pr-closed:${pr.number}:${pr.head.sha} -->`;
-        if (!(await commentsFor(api, issue.number)).some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(notice))) await api(`issues/${issue.number}/comments`, 'POST', { body: `PR #${pr.number} was closed without merging. Reopen it or request a new implementation. [Open PR](${pr.html_url}).\n\n${notice}` });
+        if (!(await commentsFor(api, issue.number)).some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(notice))) await api(`issues/${issue.number}/comments`, 'POST', { body: handoff({ status: 'blocked', stage: 'implement', happened: `PR #${pr.number} was closed without merging.`, action: 'The owner can reopen the PR or request a new implementation.', next: 'No implementation resumes until an authorized request is made.', link: `[Open PR](${pr.html_url})`, details: notice }) });
       }
       continue;
     }
     const comments = await commentsFor(api, target.issue);
     if (event.action === 'converted_to_draft') {
       const hold = `<!-- lighthouse-pr-hold:${pr.number}:${pr.head.sha} -->`;
-      if (!comments.some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(hold))) await api(`issues/${target.issue}/comments`, 'POST', { body: `PR #${pr.number} is a draft by owner choice. [Open PR](${pr.html_url}).\n\n${hold}` });
       await projectImplementationPrState(api, target.issue, true);
+      if (!comments.some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(hold))) await api(`issues/${target.issue}/comments`, 'POST', { body: handoff({ status: 'blocked', stage: 'implement', happened: `PR #${pr.number} is a draft by owner choice.`, action: 'The PR owner can mark it ready when appropriate.', next: 'Automatic readiness remains on hold until the owner changes the PR state.', link: `[Open PR](${pr.html_url})`, details: hold }) });
       continue;
     }
     const hold = comments.some(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(`<!-- lighthouse-pr-hold:${pr.number}:${pr.head.sha} -->`));
     const auto = (['workflow_run', 'schedule'].includes(env.GITHUB_EVENT_NAME) || ciCallback) && !hold;
     const result = await reconcileImplementationPr(api, repo, pr, issue, comments, requiredChecks(profile), (current, draft) => setPullRequestDraft(env.GH_TOKEN, current, draft), { auto });
-    if (event.action === 'ready_for_review' && result.status === 'draft') await api(`issues/${target.issue}/comments`, 'POST', { body: `PR #${pr.number} remains a draft: ${result.reason}. [Open PR](${pr.html_url}).` });
+    if (event.action === 'ready_for_review' && result.status === 'draft') await api(`issues/${target.issue}/comments`, 'POST', { body: handoff({ status: 'blocked', stage: 'implement', happened: `PR #${pr.number} remains a draft: ${result.reason}.`, action: 'The PR owner should resolve the stated blocker.', next: 'The workflow rechecks readiness when the relevant checks or PR state change.', link: `[Open PR](${pr.html_url})` }) });
   }
 }
 main().catch(error => { console.error(`::error::${error.message}`); process.exitCode = 1; });

package/src/pr-state.mjs

@@ -1,13 +1,30 @@
 import { checkImplementationPullRequest } from './proposal-review.mjs';
 import { checkCommit } from './completion.mjs';
+import { validateProductCheckpoint, productProposalProof } from './product-change.mjs';
 
 const marker = /<!-- lighthouse-pr-state:(\{[^\n]*\}) -->/;
 
+export function productOnlyCheckpoint(pr) {
+  if (pr?.body?.includes('<!-- lighthouse-product-implementation:') || productProposalProof(pr)) return null;
+  const matches = [...(pr?.body ?? '').matchAll(/<!-- lighthouse-product-change(?:-checkpoint|:checkpoint):(\{[^\n]*\}) -->/g)];
+  if (matches.length !== 1) return null;
+  try {
+    const checkpoint = JSON.parse(matches[0][1]);
+    const branch = pr.head?.ref?.match(/^lighthouse\/(?:implement|propose|product-change)-([1-9][0-9]*)-[a-f0-9]{12}$/);
+    if (validateProductCheckpoint(checkpoint).length || !branch || Number(branch[1]) !== checkpoint.identity.issue || checkpoint.identity.repository !== pr.head?.repo?.full_name || checkpoint.identity.repository !== pr.base?.repo?.full_name || !Number.isSafeInteger(pr.number)) return null;
+    if (checkpoint.state === 'waiting-product-decision' && checkpoint.effectIds.length === 1 && checkpoint.effectIds[0] === `pr:${pr.number}:${checkpoint.identity.head}`) return checkpoint;
+    if (checkpoint.state === 'applied' && checkpoint.effectIds.some(id => /^apply:[a-f0-9]{64}:/.test(id) && id.endsWith(`:${checkpoint.identity.head}`))) return checkpoint;
+    return null;
+  } catch { return null; }
+}
+export const isProductOnlyPullRequest = pr => !!productOnlyCheckpoint(pr);
+export const isStaleProductDecision = pr => { const checkpoint = productOnlyCheckpoint(pr); return !!checkpoint && checkpoint.identity.head !== pr.head?.sha; };
+
 export async function scheduledImplementationPulls(api) {
   const numbers = [];
   for (let page = 1; page <= 10; page++) {
     const pulls = await api(`pulls?state=open&per_page=100&page=${page}`);
-    numbers.push(...pulls.filter(pr => /^lighthouse\/implement-[1-9][0-9]*-[a-f0-9]{12}$/.test(pr.head?.ref ?? '') && pr.user?.login === 'github-actions[bot]').map(pr => pr.number));
+    numbers.push(...pulls.filter(pr => /^lighthouse\/(?:implement|propose|product-change)-[1-9][0-9]*-[a-f0-9]{12}$/.test(pr.head?.ref ?? '') && pr.user?.login === 'github-actions[bot]' && !productProposalProof(pr) && (isProductOnlyPullRequest(pr) ? isStaleProductDecision(pr) : pr.head.ref.startsWith('lighthouse/implement-') || pr.body?.includes('<!-- lighthouse-product-implementation:'))).map(pr => pr.number));
     if (pulls.length < 100) return numbers;
   }
   throw Error('Open PR history exceeds reconciliation bound');

package/src/product-change-actions.mjs

@@ -3,10 +3,25 @@ import { dirname, join } from 'node:path';
 import { tmpdir } from 'node:os';
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
 import { validateProductChangeFiles, validateProductCheckpoint, validateProductWorkspace, loadProductBridge, productReviewBinding, parseProductDecision, verifyProductDecision, authorizeProductApply, createProductApplyReceipt, productModelDigest, productModelDirectory } from './product-change.mjs';
-import { checkImplementationPullRequest } from './proposal-review.mjs';
+import { checkImplementationPullRequest, checkProposal } from './proposal-review.mjs';
+import { handoff } from './handoff.mjs';
+
+const marker = '<!-- lighthouse-product-change-';
+const digest = value => createHash('sha256').update(value).digest('hex');
+export function preparePendingProductCandidate(product) {
+  if (product.providerValidation?.status !== 'pending') return product;
+  validateProductChangeFiles(product.files, { changeName: product.changeName });
+  const path = `openspec/changes/${product.changeName}/.openspec.yaml`;
+  const metadata = product.files.find(file => file.path === path);
+  const flags = [...metadata.content.matchAll(/^\s*skip_specs\s*:\s*(.*?)\s*$/gm)];
+  if (flags.length > 1 || flags.length === 1 && !/^true(?:\s+#.*)?$/.test(flags[0][1])) throw Error('Product Change schema pin has conflicting skip_specs metadata');
+  if (flags.length) return product;
+  if (product.proposalDigest !== undefined) throw Error('Cannot normalize a Product Change with a supplied proposal digest');
+  return { ...product, files: product.files.map(file => file.path === path ? { ...file, content: `${file.content.trimEnd()}\nskip_specs: true\n` } : file) };
+}
 
-const marker = '<!-- lighthouse-product-change:';
 export async function validateProductCandidate(root, changeName, files, bridge) {
   const summary = validateProductChangeFiles(files, { changeName });
   const temp = await mkdtemp(join(tmpdir(), 'lighthouse-product-change-'));
@@ -38,6 +53,13 @@ export async function validateProductCandidate(root, changeName, files, bridge)
   } finally { await rm(temp, { recursive: true, force: true }); }
 }
 
+export function bindValidatedProductCandidate(product, validation, baselineDigest) {
+  if (validation.provider !== 'passed' || validation.openSpec !== 'passed' || !/^[a-f0-9]{64}$/.test(validation.digest ?? '') || !Number.isSafeInteger(validation.diagnosticCount) || validation.diagnosticCount < 0 || validation.changeId !== product.changeId || validation.baselineDigest !== baselineDigest || product.baselineDigest !== baselineDigest || product.proposalDigest !== undefined && product.proposalDigest !== validation.digest) throw Error('Product Change candidate or baseline changed during validation');
+  if (product.providerValidation?.status === 'passed' && product.providerValidation.diagnosticCount !== validation.diagnosticCount) throw Error('Product Change provider validation evidence does not match the host result');
+  if (!['pending', 'passed'].includes(product.providerValidation?.status)) throw Error('Product Change provider validation state is invalid');
+  return { ...product, proposalDigest: validation.digest, providerValidation: { status: 'passed', diagnosticCount: validation.diagnosticCount } };
+}
+
 export async function loadProductCandidateFromPullRequest(api, repository, pr, changeName) {
   if (pr?.state !== 'open' || pr.merged || pr.user?.login !== 'github-actions[bot]' || pr.user?.type !== 'Bot' || pr.head?.repo?.full_name !== repository || pr.base?.repo?.full_name !== repository) throw Error('Product Change review needs an open bot-owned PR in this repository');
   const changed = await api(`pulls/${pr.number}/files?per_page=100`);
@@ -53,7 +75,7 @@ export async function loadProductCandidateFromPullRequest(api, repository, pr, c
   return { files, ...checked };
 }
 
-export async function productModelDigestFromApi(api, revision) {
+export async function productModelDigestFromApi(api, revision, overrides = []) {
   const tree = await api(`git/trees/${revision}?recursive=1`);
   if (tree.truncated || !Array.isArray(tree.tree) || tree.tree.length > 10000) throw Error('Accepted product model tree exceeds the API bound');
   let modelRoot = 'docs/product/model';
@@ -66,27 +88,37 @@ export async function productModelDigestFromApi(api, revision) {
   if (!safeRelative(modelRoot) || modelRoot.split('/').some(part => part.startsWith('.'))) throw Error('ProductShape product-root is unsafe');
   const entries = tree.tree.filter(item => item.path.startsWith(`${modelRoot}/`) && item.type === 'blob').sort((a, b) => a.path.localeCompare(b.path));
   if (!entries.length || entries.length > 512) throw Error('Accepted product model file list is empty or exceeds its bound');
+  const changed = new Map(overrides.filter(file => file.path.startsWith(`${modelRoot}/`)).map(file => [file.path, file.deleted ? null : Buffer.from(file.content, 'utf8')]));
   const rows = [];
   let bytes = 0;
   for (const entry of entries) {
     if (entry.mode !== '100644' && entry.mode !== '100755' || entry.size > 65536) throw Error(`Accepted product model path is not a bounded regular file: ${entry.path}`);
-    const blob = await api(`git/blobs/${entry.sha}`);
-    if (blob.encoding !== 'base64' || blob.size > 65536) throw Error(`Accepted product artifact exceeds its bound: ${entry.path}`);
-    const content = Buffer.from(blob.content, 'base64');
+    if (changed.has(entry.path) && changed.get(entry.path) === null) { changed.delete(entry.path); continue; }
+    const blob = changed.has(entry.path) ? null : await api(`git/blobs/${entry.sha}`);
+    if (blob && (blob.encoding !== 'base64' || blob.size > 65536)) throw Error(`Accepted product artifact exceeds its bound: ${entry.path}`);
+    const content = changed.get(entry.path) ?? Buffer.from(blob.content, 'base64');
+    changed.delete(entry.path);
     bytes += content.length;
     if (bytes > 8 * 1024 * 1024) throw Error('Accepted product model exceeds its aggregate bound');
     rows.push(`${entry.path.slice(`${modelRoot}/`.length)}\0${createHash('sha256').update(content).digest('hex')}\n`);
   }
-  return { digest: createHash('sha256').update(rows.join('')).digest('hex'), modelRoot };
+  for (const [path, content] of changed) {
+    if (content === null) throw Error(`Product apply cannot delete a missing model file: ${path}`);
+    bytes += content.length;
+    if (content.length > 65536 || bytes > 8 * 1024 * 1024) throw Error('Applied product model exceeds its aggregate bound');
+    rows.push(`${path.slice(`${modelRoot}/`.length)}\0${createHash('sha256').update(content).digest('hex')}\n`);
+  }
+  if (rows.length > 512) throw Error('Applied product model file list exceeds its bound');
+  return { digest: createHash('sha256').update(rows.sort((a, b) => a.split('\0')[0].localeCompare(b.split('\0')[0])).join('')).digest('hex'), modelRoot };
 }
 
-function reviewText({ repository, snapshot, head, changeId, changeName, files, candidate, validation, runUrl, approvalKey }) {
+export function reviewText({ repository, snapshot, head, changeId, changeName, files, candidate, validation, runUrl, approvalKey, prUrl }) {
   const manifest = files.find(file => file.path.endsWith('/product-change/change.md'))?.content ?? '';
-  const sections = [...manifest.matchAll(/^## (.+?)\n([\s\S]*?)(?=^## |\s*$)/gm)].map(match => `### ${match[1]}\n${match[2].trim()}`).join('\n\n');
+  const sections = [...manifest.matchAll(/^## (.+?)\n([\s\S]*?)(?=^## |(?![\s\S]))/gm)].map(match => `### ${match[1]}\n${match[2].trim()}`).join('\n\n');
   const artifacts = files.filter(file => file.path.includes('/proposed/')).map(file => `- [${file.path}](https://github.com/${repository}/blob/${head}/${file.path})`).join('\n');
   const areas = candidate.affectedAreas?.map(area => `- ${area}`).join('\n') || '- See the change manifest.';
   const decisions = candidate.decisions?.map(decision => `- ${decision}`).join('\n') || '- Review the proposed behavior in the change manifest.';
-  return `## Product decision: ${changeId}\n\nThis product proposal was prepared for [issue #${snapshot.issue}](https://github.com/${repository}/issues/${snapshot.issue}). Review the problem, proposed outcome and affected product areas before deciding.\n\n### Affected product areas\n${areas}\n\n### Decisions and trade-offs\n${decisions}\n\n### Product Change\n${sections}\n\n### Proposed artifacts\n${artifacts || 'No artifact links were produced.'}\n\nValidation: ProductShape overlay and OpenSpec strict validation passed (${validation.provider}, ${validation.openSpec}). [Review the branch diff](https://github.com/${repository}/compare/${snapshot.defaultBranch}...${head}).\n\n### Decide\nApprove this exact product delta with:\n\n\`/product-change approve ${changeName} ${approvalKey}\`\n\nTo request a revision, use this as the first line of a new comment and add the requested change on the next line:\n\n/product-change request-changes ${changeName} ${approvalKey}\nDescribe the change\n\nApproval authorizes trusted ProductShape apply. This idea entry does not grant implementation permission. PR merge, release and deployment remain separate decisions. [Preparation run](${runUrl}).`;
+  return handoff({ status: 'review', stage: snapshot.stage, happened: `Product decision: ${changeId} was prepared for [issue #${snapshot.issue}](https://github.com/${repository}/issues/${snapshot.issue}).\n\n### Affected product areas\n${areas}\n\n### Decisions and trade-offs\n${decisions}\n\n### Product Change\n${sections}\n\n### Proposed artifacts\n${artifacts || 'No artifact links were produced.'}\n\nValidation: ProductShape overlay and OpenSpec strict validation passed (${validation.provider}, ${validation.openSpec}).`, action: `Owner: review the proposal on this PR. Approve this exact product delta in a new comment with \`/product-change approve ${changeName} ${approvalKey}\`. To request a revision, put \`/product-change request-changes ${changeName} ${approvalKey}\` on the first line of a new comment and describe the change on the next line.`, next: 'Approval starts trusted ProductShape apply. Implementation, PR merge, release and deployment require their own authorization.', link: `[Review the branch diff](https://github.com/${repository}/compare/${snapshot.defaultBranch}...${head}) · [Product Change PR](${prUrl})`, details: `[Preparation run](${runUrl})` }).replace(/<!--\s*lighthouse-/gi, '&lt;!-- lighthouse-');
 }
 
 export async function publishProductChangePullRequest(api, repository, snapshot, candidate, { validation, runUrl, beforeWrite }) {
@@ -94,14 +126,15 @@ export async function publishProductChangePullRequest(api, repository, snapshot,
   if (files.changeId !== candidate.changeId || files.digest !== candidate.proposalDigest || validation.provider !== 'passed' || validation.openSpec !== 'passed') throw Error('Product Change candidate validation evidence is stale');
   const pulls = await api('pulls?state=open&per_page=100');
   if (pulls.length >= 100) throw Error('Open pull request list exceeds bounds');
-  const issuePulls = pulls.filter(pr => pr.head?.ref?.startsWith(`lighthouse/implement-${snapshot.issue}-`) || pr.head?.ref?.startsWith(`lighthouse/product-change-${snapshot.issue}-`));
+  const issuePulls = pulls.filter(pr => pr.head?.ref?.startsWith(`lighthouse/implement-${snapshot.issue}-`) || pr.head?.ref?.startsWith(`lighthouse/product-change-${snapshot.issue}-`) || pr.head?.ref?.startsWith(`lighthouse/propose-${snapshot.issue}-`));
   if (issuePulls.length > 1) throw Error('Issue has multiple eligible delivery PRs; owner review is required');
   let pr = issuePulls[0] ? await api(`pulls/${issuePulls[0].number}`) : null;
   let base, branch, parent;
   if (pr) {
-    if (pr.head.ref.startsWith(`lighthouse/implement-${snapshot.issue}-`) && pr.body?.includes('<!-- lighthouse-product-change:')) {
+    if ((pr.head.ref.startsWith(`lighthouse/implement-${snapshot.issue}-`) || pr.head.ref.startsWith(`lighthouse/propose-${snapshot.issue}-`)) && (pr.body?.includes('<!-- lighthouse-product-change:') || pr.body?.includes('<!-- lighthouse-product-change-review:'))) {
       if (pr.user?.login !== 'github-actions[bot]' || pr.user?.type !== 'Bot' || pr.state !== 'open' || pr.merged || pr.head?.repo?.full_name !== repository) throw Error('Existing Product Change PR is not a current bot-owned PR');
     } else if (pr.head.ref.startsWith(`lighthouse/implement-${snapshot.issue}-`)) checkImplementationPullRequest(pr, repository);
+    else if (pr.head.ref.startsWith(`lighthouse/propose-${snapshot.issue}-`)) checkProposal(pr, repository);
     else if (pr.user?.login !== 'github-actions[bot]' || pr.user?.type !== 'Bot' || pr.state !== 'open' || pr.merged || !pr.body?.includes('<!-- lighthouse-product-change:')) throw Error('Existing issue PR is not an eligible Lighthouse Product Change draft');
     if (pr.base?.ref !== snapshot.defaultBranch || pr.head?.repo?.full_name !== repository) throw Error('Existing issue PR targets an unexpected repository or base');
     if (!pr.draft) throw Error('Product Change cannot modify a PR already submitted for review');
@@ -112,6 +145,7 @@ export async function publishProductChangePullRequest(api, repository, snapshot,
     parent = snapshot.sourceRevision;
     base = await api(`git/commits/${parent}`);
   }
+  if (snapshot.productParent?.pullRequest && (!pr || pr.number !== snapshot.productParent.pullRequest.number || snapshot.productEntry !== 'feedback' && pr.head.sha !== snapshot.productParent.pullRequest.head || pr.head.ref !== snapshot.productParent.pullRequest.branch)) throw Error('Parent issue PR changed before Product Change publication');
   const tree = await api('git/trees', 'POST', { base_tree: base.tree.sha, tree: candidate.files.map(file => ({ path: file.path, mode: '100644', type: 'blob', content: file.content })) });
   const commit = await api('git/commits', 'POST', { message: `docs: prepare product change for #${snapshot.issue}`, tree: tree.sha, parents: [parent] });
   await beforeWrite();
@@ -128,39 +162,37 @@ export async function publishProductChangePullRequest(api, repository, snapshot,
   }
   const repositoryInfo = await api('');
   const policyDigest = snapshot.policyDigest;
-  const binding = productReviewBinding({ repository, issue: snapshot.issue, pullRequest: pr.number, changeName: candidate.changeName, changeId: candidate.changeId, proposalDigest: candidate.proposalDigest, baselineDigest: candidate.baselineDigest, policyDigest, authorityDigest: snapshot.authorizationDigest, head: pr.head.sha });
+  const binding = productReviewBinding({ repository, issue: snapshot.issue, pullRequest: pr.number, changeName: candidate.changeName, changeId: candidate.changeId, proposalDigest: candidate.proposalDigest, baselineDigest: candidate.baselineDigest, policyDigest, authorityDigest: snapshot.authorizationDigest, head: pr.head.sha, ...(snapshot.productParent ? { parentDigest: digest(JSON.stringify(snapshot.productParent)) } : {}) });
   const checkpoint = {
     schemaVersion: 1, kind: 'checkpoint',
     identity: { repository, issue: snapshot.issue, parentRunId: String(snapshot.dispatch?.routerRunId ?? snapshot.workflowRunId), authorizationDigest: snapshot.authorizationDigest, policyDigest, workflowRevision: snapshot.workflowRevision, head: pr.head.sha },
     requestDigest: snapshot.dispatch?.digest ?? snapshot.taskDigest,
     changeName: candidate.changeName, changeId: candidate.changeId, proposalDigest: candidate.proposalDigest, baselineDigest: candidate.baselineDigest,
-    state: 'waiting-product-decision', effectIds: [`pr:${pr.number}:${pr.head.sha}`]
+    state: 'waiting-product-decision', effectIds: [`pr:${pr.number}:${pr.head.sha}`], ...(snapshot.productParent ? { parent: snapshot.productParent } : {})
   };
   const checkpointErrors = validateProductCheckpoint(checkpoint);
   if (checkpointErrors.length) throw Error(checkpointErrors.join('; '));
-  const body = reviewText({ repository, snapshot, head: pr.head.sha, changeId: candidate.changeId, changeName: candidate.changeName, files: candidate.files, candidate, validation, runUrl, approvalKey: binding.key });
+  const body = reviewText({ repository, snapshot, head: pr.head.sha, changeId: candidate.changeId, changeName: candidate.changeName, files: candidate.files, candidate, validation, runUrl, approvalKey: binding.key, prUrl: pr.html_url });
   const reviewMarker = `${marker}review:${JSON.stringify(binding)} -->`;
   const checkpointMarker = `${marker}checkpoint:${JSON.stringify(checkpoint)} -->`;
   let prBody = pr.body ?? '';
-  prBody = prBody.includes('<!-- lighthouse-product-change-review:')
-    ? prBody.replace(/<!-- lighthouse-product-change-review:\{[^\n]*\} -->/g, reviewMarker)
+  prBody = /<!-- lighthouse-product-change(?:-review|:review):/.test(prBody)
+    ? prBody.replace(/<!-- lighthouse-product-change(?:-review|:review):\{[^\n]*\} -->/g, reviewMarker)
     : `${prBody}\n\n${reviewMarker}`;
-  prBody = prBody.includes('<!-- lighthouse-product-change-checkpoint:')
-    ? prBody.replace(/<!-- lighthouse-product-change-checkpoint:\{[^\n]*\} -->/g, checkpointMarker)
+  prBody = /<!-- lighthouse-product-change(?:-checkpoint|:checkpoint):/.test(prBody)
+    ? prBody.replace(/<!-- lighthouse-product-change(?:-checkpoint|:checkpoint):\{[^\n]*\} -->/g, checkpointMarker)
     : `${prBody}\n${checkpointMarker}`;
   await api(`pulls/${pr.number}`, 'PATCH', { body: prBody });
-  const previous = await api(`issues/${pr.number}/comments?per_page=100`);
-  const notice = previous.find(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(`Product decision: ${candidate.changeId}`));
-  if (notice) await api(`issues/comments/${notice.id}`, 'PATCH', { body });
-  else await api(`issues/${pr.number}/comments`, 'POST', { body });
-  const issueComments = await api(`issues/${snapshot.issue}/comments?per_page=100`);
-  const issueNotice = issueComments.find(comment => comment.user?.login === 'github-actions[bot]' && comment.body?.includes(`<!-- lighthouse-product-change-link:${candidate.proposalDigest} -->`));
-  const issueBody = `A draft Product Change is ready in [PR #${pr.number}](${pr.html_url}). Review the proposed behavior, affected product areas, decisions, trade-offs and validation evidence there. Approve the identified product proposal or request changes in that PR. Approval starts trusted ProductShape apply; this idea entry does not start implementation. PR merge remains separate.\n\n<!-- lighthouse-product-change-link:${candidate.proposalDigest} -->`;
-  if (issueNotice) await api(`issues/comments/${issueNotice.id}`, 'PATCH', { body: issueBody });
-  else await api(`issues/${snapshot.issue}/comments`, 'POST', { body: issueBody });
   return { pullRequest: pr, binding, checkpoint, body, repositoryDefaultBranch: repositoryInfo.default_branch };
 }
 
+export function checkProductDryRun(preview, changeId) {
+  if (preview.outcome !== 'dry-run' || preview.plan?.changeId && preview.plan.changeId !== changeId) {
+    const codes = (preview.plan?.diagnostics ?? []).filter(item => item.severity === 'error' && /^[A-Z][A-Z0-9]{0,31}$/.test(item.code ?? '')).map(item => item.code).slice(0, 10);
+    throw Error(`ProductShape dry-run does not match the reviewed change${codes.length ? `: ${[...new Set(codes)].join(', ')}` : ''}`);
+  }
+}
+
 export async function applyApprovedProductChange({ root, changeName, checkpoint, approval, currentBinding, currentIdentity, bridge, headAfter, resultingModelDigest, reportBeforeWrite, publish }) {
   const intent = authorizeProductApply({ checkpoint, approval, currentBinding, currentIdentity });
   const provider = bridge ?? await loadProductBridge();
@@ -170,7 +202,7 @@ export async function applyApprovedProductChange({ root, changeName, checkpoint,
   await writeFile(manifest, original.replace(/^status:\s*draft\s*$/m, 'status: approved'));
   await validateProductWorkspace(root, changeName, provider);
   const preview = await provider.applyOpenSpecProductChange(root, changeName, { dryRun: true });
-  if (preview.outcome !== 'dry-run' || preview.plan?.changeId && preview.plan.changeId !== checkpoint.changeId) throw Error('ProductShape dry-run does not match the reviewed change');
+  checkProductDryRun(preview, checkpoint.changeId);
   const applied = await provider.applyOpenSpecProductChange(root, changeName, { reportBeforeWrite });
   if (applied.outcome !== 'applied' || applied.change?.id !== checkpoint.changeId) throw Error('ProductShape apply was refused or returned a different change');
   if ((applied.resultingModel?.diagnostics ?? []).some(item => item.severity === 'error')) throw Error('ProductShape resulting model has validation errors');
@@ -185,13 +217,22 @@ export async function applyApprovedProductChange({ root, changeName, checkpoint,
 export async function collectProductApplyFiles(root, changeName, baseRevision) {
   const prefix = `openspec/changes/${changeName}/product-change/change.md`;
   const modelRoot = await productModelDirectory(root);
-  const paths = execFileSync('git', ['diff', '--name-only', '--no-renames', baseRevision, '--', modelRoot, prefix], { cwd: root, encoding: 'utf8', maxBuffer: 128000 }).trim().split('\n').filter(Boolean).sort();
+  const options = { cwd: root, encoding: 'utf8', maxBuffer: 128000 };
+  const changed = execFileSync('git', ['diff', '--name-only', '-z', '--no-renames', baseRevision, '--'], options).split('\0').filter(Boolean);
+  const added = execFileSync('git', ['ls-files', '--others', '--exclude-standard', '-z', '--', '.', ':(exclude).lighthouse-harness', ':(exclude).lighthouse-harness/**'], options).split('\0').filter(Boolean);
+  const paths = [...new Set([...changed, ...added])].sort();
   if (!paths.includes(prefix) || paths.length > 520 || paths.some(path => path !== prefix && !path.startsWith(`${modelRoot}/`))) throw Error('Trusted apply wrote outside the Product Change manifest and accepted model');
   const files = [];
   let bytes = 0;
   for (const path of paths) {
     const absolute = join(root, path);
-    const stat = await import('node:fs/promises').then(fs => fs.lstat(absolute));
+    let stat;
+    try { stat = await import('node:fs/promises').then(fs => fs.lstat(absolute)); }
+    catch (error) {
+      if (error.code !== 'ENOENT' || path === prefix) throw error;
+      files.push({ path, deleted: true });
+      continue;
+    }
     if (!stat.isFile() || stat.isSymbolicLink()) throw Error(`Trusted apply produced a non-regular path: ${path}`);
     if (stat.size > 65536) throw Error(`Trusted apply artifact exceeds its bound: ${path}`);
     const content = await readFile(absolute, 'utf8');
@@ -210,9 +251,11 @@ export function validateProductApplyFiles(files, changeName, modelRoot = 'docs/p
   if (!Array.isArray(files) || !files.length || files.length > 520) throw Error('Product apply output file list is empty or exceeds its bound');
   const seen = new Set(); let bytes = 0;
   for (const file of files) {
-    if (!file || Object.keys(file).sort().join(',') !== 'content,path' || typeof file.path !== 'string' || typeof file.content !== 'string' || seen.has(file.path)) throw Error('Invalid or duplicated Product apply output file');
+    const deletion = file?.deleted === true && Object.keys(file).sort().join(',') === 'deleted,path';
+    if (!file || !deletion && (Object.keys(file).sort().join(',') !== 'content,path' || typeof file.content !== 'string') || typeof file.path !== 'string' || seen.has(file.path)) throw Error('Invalid or duplicated Product apply output file');
     if (file.path !== manifestPath && !file.path.startsWith(`${modelRoot}/`)) throw Error(`Product apply output escaped the accepted model: ${file.path}`);
-    if (!safeRelative(file.path) || file.content.includes('\0')) throw Error(`Unsafe Product apply output: ${file.path}`);
+    if (!safeRelative(file.path) || deletion && file.path === manifestPath || !deletion && file.content.includes('\0')) throw Error(`Unsafe Product apply output: ${file.path}`);
+    if (deletion) { seen.add(file.path); continue; }
     const size = Buffer.byteLength(file.content);
     if (size > 65536) throw Error(`Product apply output exceeds its file bound: ${file.path}`);
     bytes += size;
@@ -226,32 +269,64 @@ export function validateProductApplyFiles(files, changeName, modelRoot = 'docs/p
 
 const safeRelative = path => !path.startsWith('/') && !path.includes('\\') && !path.split('/').some(part => !part || part === '.' || part === '..');
 
-export async function publishProductApply(api, repository, owner, dispatch, result, beforeWrite) {
+export function productApplyHandoff({ stage, receipt, pullRequest, url, affectedCitations, parent }) {
+  return handoff({ status: 'completed', stage, happened: `Product Change ${receipt.changeId} was applied to the provider-validated model on PR #${pullRequest}.\n\nAffected citations:\n${(affectedCitations ?? []).map(item => `- \`${item.document ?? item.file ?? item.id ?? 'consumer'}\`: ${item.status ?? 'refresh required'}`).join('\n') || '- None reported.'}`, action: 'Owner: review the applied model and affected citations on the linked PR.', next: parent ? 'The workflow will recheck the existing parent authorization before requesting its continuation. Merge remains separate.' : 'Merge and any further delivery require their own authorization.', link: `[Review PR #${pullRequest}](${url})`, details: `<!-- lighthouse-product-apply:${JSON.stringify(receipt)} -->` });
+}
+
+export async function observeUpdatedProductPull(api, number, expectedHead, wait = ms => new Promise(resolve => setTimeout(resolve, ms))) {
+  for (let attempt = 0; attempt < 20; attempt++) {
+    const pr = await api(`pulls/${number}`);
+    if (pr.state !== 'open' || pr.merged) throw Error('Product PR closed while confirming the applied head');
+    if (pr.head?.sha === expectedHead) return pr;
+    if (attempt < 19) await wait(1000);
+  }
+  throw Error('Product PR head update could not be confirmed; reconcile publication before retrying');
+}
+
+export async function advanceProductRef(api, branch, head) {
+  try {
+    await api(`git/refs/heads/${branch}`, 'PATCH', { sha: head, force: false });
+  } catch (error) {
+    const current = await api(`git/ref/heads/${branch}`, 'GET', undefined, true).catch(() => null);
+    if (current?.object?.sha !== head) throw error;
+  }
+}
+
+export async function publishProductApply(api, repository, owner, dispatch, result, beforeWrite, applyRequest) {
   const approvalInfo = dispatch.request.productApproval;
   if (dispatch.request.worker !== 'apply-product-change' || !approvalInfo || !result || result.head !== approvalInfo.head) throw Error('Product apply result does not match its authenticated dispatch');
   const files = validateProductApplyFiles(result.files, approvalInfo.changeName, result.modelRoot);
   const fresh = await loadProductApproval(api, { eventName: dispatch.request.eventName, event: dispatch.request.event, owner, repository, root: process.cwd() });
-  if (!fresh || fresh.head !== approvalInfo.head || fresh.pullRequest !== approvalInfo.pullRequest || fresh.approval.reviewKey !== approvalInfo.reviewKey || fresh.checkpoint.changeId !== result.receipt.changeId) throw Error('Product approval or reviewed branch changed before publication');
+  if (!fresh || fresh.head !== approvalInfo.head || fresh.pullRequest !== approvalInfo.pullRequest || fresh.approval.reviewKey !== approvalInfo.reviewKey || fresh.checkpoint.changeId !== result.receipt?.changeId) throw Error('Product approval or reviewed branch changed before publication');
+  const approvalFields = value => { const { observedAt, ...rest } = value ?? {}; return rest; };
+  if (!applyRequest || applyRequest.repository !== repository || applyRequest.owner !== owner || applyRequest.issue !== fresh.issue || applyRequest.pullRequest !== fresh.pullRequest || applyRequest.head !== fresh.head || applyRequest.changeName !== fresh.changeName || !isDeepStrictEqual(applyRequest.checkpoint, fresh.checkpoint) || !isDeepStrictEqual(applyRequest.binding, fresh.binding) || !isDeepStrictEqual(approvalFields(applyRequest.approval), approvalFields(fresh.approval))) throw Error('Product apply request no longer matches authenticated approval');
+  const intent = authorizeProductApply({ checkpoint: applyRequest.checkpoint, approval: applyRequest.approval, currentBinding: applyRequest.binding, currentIdentity: applyRequest.checkpoint.identity });
+  const expectedReceipt = createProductApplyReceipt({ intent, approval: applyRequest.approval, checkpoint: applyRequest.checkpoint, headAfter: fresh.head, resultingModelDigest: result.resultingModelDigest, validated: true, appliedAt: result.receipt?.appliedAt });
+  if (result.providerOutcome !== 'applied' || !isDeepStrictEqual(result.receipt, expectedReceipt)) throw Error('Product apply receipt does not match authenticated provider output');
   if (result.receipt.resultingModelDigest !== result.resultingModelDigest || result.receipt.baselineDigest !== fresh.checkpoint.baselineDigest || result.receipt.proposalDigest !== fresh.checkpoint.proposalDigest) throw Error('Product apply receipt does not match the approved candidate');
+  const projected = await productModelDigestFromApi(api, fresh.head, files);
+  if (projected.modelRoot !== result.modelRoot || projected.digest !== result.resultingModelDigest) throw Error('Published files do not reproduce the provider-validated product model');
   const pr = await api(`pulls/${fresh.pullRequest}`);
   if (pr.head.sha !== fresh.head || pr.state !== 'open' || pr.merged || pr.head.repo?.full_name !== repository) throw Error('Product PR head changed before apply publication');
   const commit = await api(`git/commits/${fresh.head}`);
-  const tree = await api('git/trees', 'POST', { base_tree: commit.tree.sha, tree: files.map(file => ({ path: file.path, mode: '100644', type: 'blob', content: file.content })) });
+  const tree = await api('git/trees', 'POST', { base_tree: commit.tree.sha, tree: files.map(file => file.deleted ? { path: file.path, mode: '100644', type: 'blob', sha: null } : { path: file.path, mode: '100644', type: 'blob', content: file.content }) });
   const created = await api('git/commits', 'POST', { message: `docs: apply product change ${fresh.checkpoint.changeId}`, tree: tree.sha, parents: [fresh.head] });
+  if (!/^[a-f0-9]{40}$/.test(created?.sha ?? '')) throw Error('Created product commit has no valid identity');
   await beforeWrite(fresh);
-  await api(`git/refs/heads/${pr.head.ref}`, 'PATCH', { sha: created.sha, force: false });
-  const updated = await api(`pulls/${fresh.pullRequest}`);
+  await advanceProductRef(api, pr.head.ref, created.sha);
+  const updated = await observeUpdatedProductPull(api, fresh.pullRequest, created.sha);
   const receipt = { ...result.receipt, headAfter: updated.head.sha };
   let prBody = updated.body ?? '';
   const checkpoint = { ...fresh.checkpoint, state: 'applied', identity: { ...fresh.checkpoint.identity, head: updated.head.sha }, effectIds: [...new Set([...fresh.checkpoint.effectIds, `apply:${receipt.intentId}:${updated.head.sha}`])].slice(0, 32) };
-  validateProductCheckpoint(checkpoint);
-  prBody = prBody.replace(/<!-- lighthouse-product-change-checkpoint:\{[^\n]*\} -->/g, `${marker}checkpoint:${JSON.stringify(checkpoint)} -->`);
+  const checkpointErrors = validateProductCheckpoint(checkpoint);
+  if (checkpointErrors.length) throw Error(checkpointErrors.join('; '));
+  prBody = prBody.replace(/<!-- lighthouse-product-change(?:-checkpoint|:checkpoint):\{[^\n]*\} -->/g, `${marker}checkpoint:${JSON.stringify(checkpoint)} -->`);
   await api(`pulls/${fresh.pullRequest}`, 'PATCH', { body: prBody });
-  const issueBody = `Product Change ${receipt.changeId} was applied to [PR #${fresh.pullRequest}](${updated.html_url}). The issue branch contains the provider-validated product model. Merge is still separate.\n\nAffected citations:\n${(result.affectedCitations ?? []).map(item => `- \`${item.document ?? item.file ?? item.id ?? 'consumer'}\`: ${item.status ?? 'refresh required'}`).join('\n') || '- None reported.'}\n\n<!-- lighthouse-product-apply:${JSON.stringify(receipt)} -->`;
+  const issueBody = productApplyHandoff({ stage: dispatch.request.stage, receipt, pullRequest: fresh.pullRequest, url: updated.html_url, affectedCitations: result.affectedCitations, parent: checkpoint.parent });
+  if (checkpoint.parent && (await api(`issues/${fresh.issue}`)).labels?.some(label => label.name === 'waiting-review')) await api(`issues/${fresh.issue}/labels/waiting-review`, 'DELETE');
   const comments = await api(`issues/${fresh.issue}/comments?per_page=100`);
   const prior = comments.find(comment => comment.user?.login === 'github-actions[bot]' && [...(comment.body ?? '').matchAll(/<!-- lighthouse-product-apply:(\{[^\n]*\}) -->/g)].some(match => JSON.parse(match[1]).intentId === receipt.intentId));
-  if (prior) await api(`issues/comments/${prior.id}`, 'PATCH', { body: issueBody });
-  else await api(`issues/${fresh.issue}/comments`, 'POST', { body: issueBody });
+  if (!prior) await api(`issues/${fresh.issue}/comments`, 'POST', { body: issueBody });
   return { pullRequest: updated, receipt, checkpoint };
 }
 
@@ -271,6 +346,35 @@ export function productApprovalFromGitHub({ eventName, event, owner, repository,
   return verifyProductDecision({ decision, actor, actorType, owner, source, submitted, currentBinding, observedBinding: currentBinding, decisionId });
 }
 
+export function checkCurrentProductDecision({ eventName, event, current, repository, number }) {
+  const original = eventName === 'issue_comment' ? event.comment : event.review;
+  if (!original || !current || !/^[1-9][0-9]*$/.test(String(original.id ?? '')) || String(current.id) !== String(original.id) || current.body !== original.body || current.user?.login !== original.user?.login || current.user?.type !== original.user?.type) throw Error('Product decision was edited, deleted or replaced');
+  if (eventName === 'issue_comment') {
+    if (current.issue_url !== `https://api.github.com/repos/${repository}/issues/${number}` || !original.updated_at || current.updated_at !== original.updated_at) throw Error('Product decision comment changed or belongs to another PR');
+  } else if (current.pull_request_url !== `https://api.github.com/repos/${repository}/pulls/${number}` || !original.submitted_at || current.submitted_at !== original.submitted_at || typeof current.state !== 'string' || typeof original.state !== 'string' || current.state.toUpperCase() !== original.state.toUpperCase() || current.state.toUpperCase() === 'DISMISSED') throw Error('Product decision review changed or was dismissed');
+}
+
+export async function checkNoLaterProductObjection(api, number, owner, decision, originalTime) {
+  const started = Date.parse(originalTime ?? '');
+  if (!Number.isFinite(started)) throw Error('Product decision time is unavailable');
+  const comments = await (await import('./stage-dispatch.mjs')).issueComments(api, number);
+  const reviews = [];
+  for (let page = 1; page <= 10; page++) {
+    const rows = await api(`pulls/${number}/reviews?per_page=100&page=${page}`);
+    if (!Array.isArray(rows)) throw Error('Product review history is unavailable');
+    reviews.push(...rows);
+    if (rows.length < 100) break;
+    if (page === 10) throw Error('Product review history exceeds bounds');
+  }
+  for (const entry of [...comments, ...reviews]) {
+    if (entry.user?.login !== owner || entry.user?.type !== 'User') continue;
+    const next = parseProductDecision(entry.body);
+    if (!next || next.changeName !== decision.changeName || next.reviewKey !== decision.reviewKey || !['request-changes', 'answer'].includes(next.action)) continue;
+    const at = Date.parse(entry.submitted_at ?? entry.created_at ?? '');
+    if (!Number.isFinite(at) || at >= started) throw Error('A later owner decision requires product review before apply');
+  }
+}
+
 export async function loadProductApproval(api, { eventName, event, owner, repository, root }) {
   let body, actor, actorType, source, decisionId;
   if (eventName === 'issue_comment' && event.action === 'created' && event.issue?.pull_request) {
@@ -281,19 +385,23 @@ export async function loadProductApproval(api, { eventName, event, owner, reposi
   const decision = parseProductDecision(body);
   if (!decision || !['approve', 'request-changes', 'answer'].includes(decision.action)) return null;
   const number = event.pull_request?.number ?? event.issue?.number;
+  if (!Number.isSafeInteger(number) || number < 1 || !/^[1-9][0-9]*$/.test(decisionId)) throw Error('Product decision identity is invalid');
+  const decisionPath = eventName === 'issue_comment' ? `issues/comments/${decisionId}` : `pulls/${number}/reviews/${decisionId}`;
+  checkCurrentProductDecision({ eventName, event, current: await api(decisionPath), repository, number });
+  if (decision.action === 'approve') await checkNoLaterProductObjection(api, number, owner, decision, eventName === 'issue_comment' ? event.comment.created_at : event.review.submitted_at);
   const pr = await api(`pulls/${number}`);
   if (pr.user?.login !== 'github-actions[bot]' || pr.user?.type !== 'Bot' || pr.state !== 'open' || pr.merged || pr.head?.repo?.full_name !== repository || pr.base?.repo?.full_name !== repository) throw Error('Product approval target is not a current Lighthouse PR');
-  const markers = [...(pr.body ?? '').matchAll(/<!-- lighthouse-product-change-review:(\{[^\n]*\}) -->/g)];
+  const markers = [...(pr.body ?? '').matchAll(/<!-- lighthouse-product-change(?:-review|:review):(\{[^\n]*\}) -->/g)];
   if (markers.length !== 1) throw Error('PR has no unique Product Change review binding');
   const raw = JSON.parse(markers[0][1]);
   const { key, ...fields } = raw;
   const bound = productReviewBinding(fields);
   if (bound.key !== key || bound.head !== pr.head.sha || bound.pullRequest !== pr.number || bound.repository !== repository) throw Error('Product Change review binding is stale or belongs to another PR');
-  const checkpoints = [...(pr.body ?? '').matchAll(/<!-- lighthouse-product-change-checkpoint:(\{[^\n]*\}) -->/g)];
+  const checkpoints = [...(pr.body ?? '').matchAll(/<!-- lighthouse-product-change(?:-checkpoint|:checkpoint):(\{[^\n]*\}) -->/g)];
   if (checkpoints.length !== 1) throw Error('PR has no unique Product Change checkpoint');
   const checkpoint = JSON.parse(checkpoints[0][1]);
   const checkpointErrors = validateProductCheckpoint(checkpoint);
-  if (checkpointErrors.length || checkpoint.state !== 'waiting-product-decision' || checkpoint.changeName !== bound.changeName || checkpoint.changeId !== bound.changeId || checkpoint.proposalDigest !== bound.proposalDigest || checkpoint.baselineDigest !== bound.baselineDigest || checkpoint.identity.head !== pr.head.sha || checkpoint.identity.issue !== bound.issue || checkpoint.identity.repository !== repository || checkpoint.effectIds.length !== 1 || checkpoint.effectIds[0] !== `pr:${pr.number}:${pr.head.sha}`) throw Error('Product Change checkpoint is stale or invalid');
+  if (checkpointErrors.length || (checkpoint.parent ? digest(JSON.stringify(checkpoint.parent)) !== bound.parentDigest : bound.parentDigest !== undefined) || checkpoint.state !== 'waiting-product-decision' || checkpoint.changeName !== bound.changeName || checkpoint.changeId !== bound.changeId || checkpoint.proposalDigest !== bound.proposalDigest || checkpoint.baselineDigest !== bound.baselineDigest || checkpoint.identity.head !== pr.head.sha || checkpoint.identity.issue !== bound.issue || checkpoint.identity.repository !== repository || checkpoint.effectIds.length !== 1 || checkpoint.effectIds[0] !== `pr:${pr.number}:${pr.head.sha}`) throw Error('Product Change checkpoint is stale or invalid');
   if (decision.changeName !== bound.changeName || decision.reviewKey !== bound.key) throw Error('Product approval action does not identify the current Product Change');
   const candidate = await loadProductCandidateFromPullRequest(api, repository, pr, bound.changeName);
   const repositoryInfo = await api('');
@@ -303,6 +411,10 @@ export async function loadProductApproval(api, { eventName, event, owner, reposi
   const verified = verifyProductDecision({ decision, actor, actorType, owner, source, submitted: true, currentBinding: bound, observedBinding: bound, decisionId });
   const issue = await api(`issues/${bound.issue}`);
   if (issue.state !== 'open' || issue.labels?.some(label => ['future', 'human-working', 'agent-working'].includes(label.name))) throw Error('Product apply is blocked by the current issue state or reservation');
+  if (checkpoint.parent) {
+    const comments = await (await import('./stage-dispatch.mjs')).issueComments(api, bound.issue);
+    await (await import('./stage-transition.mjs')).verifyProductParent(api, repository, owner, checkpoint.parent, issue, comments, defaultHead);
+  }
   const feedback = decision.action === 'approve' ? null : { action: decision.action, changeName: decision.changeName, reviewKey: decision.reviewKey, text: decision.detail, sourceCommentId: decisionId, source: 'pull-request' };
   return { ...(decision.action === 'approve' ? { approval: verified } : { feedback }), binding: bound, checkpoint, issue: bound.issue, pullRequest: pr.number, head: pr.head.sha, changeName: bound.changeName, candidate, modelRoot: accepted.modelRoot };
 }