@nathapp/nax 0.80.0 → 0.80.1

package/dist/nax.js

@@ -16891,7 +16891,7 @@ var init_schemas_execution = __esm(() => {
     return val;
   }, SmartTestRunnerConfigSchema).default(SMART_TEST_RUNNER_DEFAULT);
   WorktreeDependenciesConfigSchema = exports_external.object({
-    mode: exports_external.enum(["inherit", "provision", "off"]).default("off"),
+    mode: exports_external.enum(["provision", "off"]).default("off"),
     setupCommand: exports_external.string().nullable().default(null)
   }).superRefine((value, ctx) => {
     if (value.mode !== "provision" && value.setupCommand !== null) {
@@ -17924,7 +17924,8 @@ function formatMutationSummary(summaries) {
 
 // src/review/severity.ts
 function isBlockingSeverity(sev, threshold = "error") {
-  return (SEVERITY_RANK[sev] ?? 0) >= SEVERITY_RANK[threshold];
+  const rank = SEVERITY_RANK[sev] ?? 0;
+  return rank >= SEVERITY_RANK[threshold];
 }
 var SEVERITY_RANK;
 var init_severity = __esm(() => {
@@ -18257,7 +18258,8 @@ function formatAdvisorySummary(findings, options) {
     return JSON.stringify(findings);
   }
   const c = useColor ? source_default : createNoopChalk();
-  const sorted = [...findings].sort((a, b) => (SEVERITY_RANK[b.severity] ?? 0) - (SEVERITY_RANK[a.severity] ?? 0));
+  const rank = SEVERITY_RANK;
+  const sorted = [...findings].sort((a, b) => (rank[b.severity] ?? 0) - (rank[a.severity] ?? 0));
   const lines = [];
   lines.push("");
   lines.push(c.yellow("\u2500".repeat(60)));
@@ -18399,6 +18401,9 @@ function redactString(value) {
   }
   return out;
 }
+function redactSecrets(input) {
+  return redactValue(input);
+}
 function redactEntry(entry) {
   return {
     ...entry,
@@ -18691,6 +18696,7 @@ var init_logger = __esm(() => {
 var exports_logger = {};
 __export(exports_logger, {
   resetLogger: () => resetLogger,
+  redactSecrets: () => redactSecrets,
   initLogger: () => initLogger,
   getSafeLogger: () => getSafeLogger,
   getLogger: () => getLogger,
@@ -18702,6 +18708,7 @@ __export(exports_logger, {
 var init_logger2 = __esm(() => {
   init_logger();
   init_formatters();
+  init_redact();
 });
 
 // src/utils/json-file.ts
@@ -18853,6 +18860,17 @@ function _applyRemovedRoutingKeysShim(conf, warn = defaultConfigWarn) {
   }
   return newRouting === routing ? conf : { ...conf, routing: newRouting };
 }
+function _applyRemovedWorktreeInheritShim(conf, warn = defaultConfigWarn) {
+  const execution = conf.execution;
+  const worktreeDependencies = execution?.worktreeDependencies;
+  if (worktreeDependencies?.mode !== "inherit")
+    return conf;
+  warn('execution.worktreeDependencies.mode="inherit" was removed (issue #574) and is mapped to "off". ' + "For JS/TS repos that is the same behaviour. If this repo needs its own install (a Python venv, bundler, composer), " + 'set mode "provision" with a setupCommand: "inherit" used to fail the run outright in that case, and "off" will now ' + "proceed without installing.");
+  return {
+    ...conf,
+    execution: { ...execution, worktreeDependencies: { ...worktreeDependencies, mode: "off" } }
+  };
+}
 function applyBatchModeCompat(conf, warn = defaultConfigWarn) {
   const routing = conf.routing;
   const llm = routing?.llm;
@@ -18940,7 +18958,7 @@ function warnSecuritySensitiveOverrides(beforeConfig, afterConfig, warn = defaul
 function applyConfigCompatShims(conf, logger, dedupe) {
   const log = dedupe.wrapLogger(logger);
   const warn = dedupe.warn;
-  return _applyLegacyReviewExecutionShim(_applyRemovedRoutingKeysShim(applyRoutingRetryDeprecationWarning(applyBatchModeCompat(applyRemovedStrategyCompat(migrateLegacyReviewModelKey(migrateLegacyTestPattern(conf, log), log), warn), warn), warn), warn), warn);
+  return _applyRemovedWorktreeInheritShim(_applyLegacyReviewExecutionShim(_applyRemovedRoutingKeysShim(applyRoutingRetryDeprecationWarning(applyBatchModeCompat(applyRemovedStrategyCompat(migrateLegacyReviewModelKey(migrateLegacyTestPattern(conf, log), log), warn), warn), warn), warn), warn), warn);
 }
 var SECURITY_SENSITIVE_KEY_PATHS;
 var init_compat_shims = __esm(() => {
@@ -19511,6 +19529,26 @@ var init_path_security = () => {};
 // src/config/paths.ts
 import { homedir } from "os";
 import { join, resolve as resolve2 } from "path";
+function validateFeatureId(featureId) {
+  if (!featureId || featureId.length === 0) {
+    throw new NaxError("Feature ID cannot be empty", "INVALID_FEATURE_ID", { stage: "config" });
+  }
+  if (featureId.includes("..")) {
+    throw new NaxError("Feature ID cannot contain path traversal (..)", "INVALID_FEATURE_ID", {
+      stage: "config",
+      featureId
+    });
+  }
+  if (featureId.startsWith("--")) {
+    throw new NaxError("Feature ID cannot start with git flags (--)", "INVALID_FEATURE_ID", {
+      stage: "config",
+      featureId
+    });
+  }
+  if (!FEATURE_ID_PATTERN.test(featureId)) {
+    throw new NaxError(`Feature ID must match pattern [a-zA-Z0-9_][a-zA-Z0-9._-]{0,63}. Got: ${featureId}`, "INVALID_FEATURE_ID", { stage: "config", featureId });
+  }
+}
 function globalConfigDir() {
   const override = process.env[GLOBAL_CONFIG_DIR_ENV];
   if (override)
@@ -19524,10 +19562,13 @@ function featuresDir(root) {
   return join(root, PROJECT_NAX_DIR, "features");
 }
 function featureDir(root, featureId) {
+  validateFeatureId(featureId);
   return join(featuresDir(root), featureId);
 }
-var GLOBAL_CONFIG_DIR_ENV = "NAX_GLOBAL_CONFIG_DIR", PROJECT_NAX_DIR = ".nax", PROJECT_FEATURES_DIR;
+var GLOBAL_CONFIG_DIR_ENV = "NAX_GLOBAL_CONFIG_DIR", FEATURE_ID_PATTERN, PROJECT_NAX_DIR = ".nax", PROJECT_FEATURES_DIR;
 var init_paths = __esm(() => {
+  init_errors();
+  FEATURE_ID_PATTERN = /^[a-zA-Z0-9_][a-zA-Z0-9._-]{0,63}$/;
   PROJECT_FEATURES_DIR = `${PROJECT_NAX_DIR}/features`;
 });
 
@@ -19714,55 +19755,41 @@ function resolveEnvVarsWarnOnFailure(config2, logger, layerName) {
 function globalConfigPath() {
   return join3(globalConfigDir(), "config.json");
 }
-function findProjectDir(startDir = process.cwd()) {
-  let dir = resolve3(startDir);
-  let depth = 0;
-  while (depth < MAX_DIRECTORY_DEPTH) {
-    const candidate = join3(dir, PROJECT_NAX_DIR);
-    if (existsSync3(join3(candidate, "config.json"))) {
-      return candidate;
-    }
-    const parent = join3(dir, "..");
-    if (parent === dir)
-      break;
-    dir = parent;
-    depth++;
-  }
-  return null;
-}
-async function loadConfig(startDir, cliOverrides) {
-  let rawConfig = structuredClone(DEFAULT_CONFIG);
-  const warnDedupe = createConfigWarnDedupe();
+function resolveProjectPaths(startDir) {
   const projDir = startDir ? basename2(startDir) === PROJECT_NAX_DIR ? startDir : findProjectDir(startDir) : findProjectDir();
   const projectRoot = startDir ? basename2(startDir) === PROJECT_NAX_DIR ? dirname(startDir) : startDir : process.cwd();
-  const profileChain = await resolveProfileNames(cliOverrides ?? {}, process.env, projectRoot);
-  const overlayChain = profileChain.filter((name) => name && name !== "default");
+  return { projDir, projectRoot };
+}
+async function applyGlobalLayer(rawConfig, ctx) {
   const globalConfRaw = await loadJsonFile(globalConfigPath(), "config");
-  let logger = null;
-  try {
-    logger = getLogger();
-  } catch {}
-  let globalLayerConf = null;
-  if (globalConfRaw) {
-    const { profile: _gProfile, ...globalConfStripped } = globalConfRaw;
-    const globalConf = applyConfigCompatShims(globalConfStripped, logger, warnDedupe);
-    globalLayerConf = globalConf;
-    rawConfig = deepMergeConfig(rawConfig, globalConf);
-  }
-  if (projDir) {
-    const projConf = await loadJsonFile(join3(projDir, "config.json"), "config");
-    if (projConf) {
-      const { profile: _pProfile, ...projConfStripped } = projConf;
-      const resolvedProjConf = applyConfigCompatShims(projConfStripped, logger, warnDedupe);
-      const preProjectMergeConfig = rawConfig;
-      rawConfig = deepMergeConfig(rawConfig, resolvedProjConf);
-      warnSecuritySensitiveOverrides(preProjectMergeConfig, rawConfig, warnDedupe.warn, {
-        layerName: "project",
-        sourceLayerConf: globalLayerConf
-      });
-    }
-  }
-  rawConfig = resolveEnvVarsWarnOnFailure(rawConfig, logger, "global/project config");
+  if (!globalConfRaw)
+    return { rawConfig, globalConfRaw: null, globalLayerConf: null };
+  const { profile: _gProfile, ...globalConfStripped } = globalConfRaw;
+  const globalConf = applyConfigCompatShims(globalConfStripped, ctx.logger, ctx.warnDedupe);
+  return {
+    rawConfig: deepMergeConfig(rawConfig, globalConf),
+    globalConfRaw,
+    globalLayerConf: globalConf
+  };
+}
+async function applyProjectLayer(rawConfig, projDir, globalLayerConf, ctx) {
+  if (!projDir)
+    return rawConfig;
+  const projConf = await loadJsonFile(join3(projDir, "config.json"), "config");
+  if (!projConf)
+    return rawConfig;
+  const { profile: _pProfile, ...projConfStripped } = projConf;
+  const resolvedProjConf = applyConfigCompatShims(projConfStripped, ctx.logger, ctx.warnDedupe);
+  const preProjectMergeConfig = rawConfig;
+  const merged = deepMergeConfig(rawConfig, resolvedProjConf);
+  warnSecuritySensitiveOverrides(preProjectMergeConfig, merged, ctx.warnDedupe.warn, {
+    layerName: "project",
+    sourceLayerConf: globalLayerConf
+  });
+  return merged;
+}
+async function applyProfileChainLayer(rawConfig, overlayChain, projectRoot, ctx) {
+  let merged = rawConfig;
   for (const name of overlayChain) {
     const profileData = await loadProfile(name, projectRoot);
     const profileEnv = await loadProfileEnv(name, projectRoot);
@@ -19774,36 +19801,36 @@ async function loadConfig(startDir, cliOverrides) {
       const path = err instanceof UnresolvedEnvVarError ? err.path.join(".") : undefined;
       throw new NaxError(`Profile "${name}" references an undefined environment variable${varName ? ` $${varName}` : ""}${path ? ` at "${path}"` : ""}.`, "PROFILE_ENV_VAR_UNRESOLVED", { stage: "config", profileName: name, varName, path, cause: err });
     }
-    const shimmedProfileData = applyConfigCompatShims(resolvedProfileData, logger, warnDedupe);
-    const preProfileMergeConfig = rawConfig;
-    rawConfig = deepMergeConfig(rawConfig, shimmedProfileData);
-    warnSecuritySensitiveOverrides(preProfileMergeConfig, rawConfig, warnDedupe.warn, {
+    const shimmedProfileData = applyConfigCompatShims(resolvedProfileData, ctx.logger, ctx.warnDedupe);
+    const preProfileMergeConfig = merged;
+    merged = deepMergeConfig(merged, shimmedProfileData);
+    warnSecuritySensitiveOverrides(preProfileMergeConfig, merged, ctx.warnDedupe.warn, {
       layerName: `profile:${name}`,
       sourceLayerConf: shimmedProfileData
     });
   }
-  if (cliOverrides) {
-    const shimmedCliOverrides = applyConfigCompatShims(cliOverrides, logger, warnDedupe);
-    const preCliMergeConfig = rawConfig;
-    rawConfig = deepMergeConfig(rawConfig, shimmedCliOverrides);
-    warnSecuritySensitiveOverrides(preCliMergeConfig, rawConfig, warnDedupe.warn, {
-      layerName: "CLI override",
-      sourceLayerConf: shimmedCliOverrides
-    });
-  }
-  rawConfig.profile = overlayChain.length > 0 ? overlayChain.join("+") : "default";
-  rawConfig.profileChain = overlayChain;
-  const hasMergedConfigs = globalConfRaw || projDir !== null || cliOverrides !== undefined || overlayChain.length > 0;
-  if (!hasMergedConfigs) {
-    return structuredClone(DEFAULT_CONFIG);
-  }
+  return merged;
+}
+function applyCliOverridesLayer(rawConfig, cliOverrides, ctx) {
+  if (!cliOverrides)
+    return rawConfig;
+  const shimmedCliOverrides = applyConfigCompatShims(cliOverrides, ctx.logger, ctx.warnDedupe);
+  const preCliMergeConfig = rawConfig;
+  const merged = deepMergeConfig(rawConfig, shimmedCliOverrides);
+  warnSecuritySensitiveOverrides(preCliMergeConfig, merged, ctx.warnDedupe.warn, {
+    layerName: "CLI override",
+    sourceLayerConf: shimmedCliOverrides
+  });
+  return merged;
+}
+function finalizeAndValidateRootConfig(rawConfig) {
   rejectLegacyAgentKeys(rawConfig);
   rejectLegacyRectificationKeys(rawConfig);
   rejectDeadQualityFlags(rawConfig);
   rejectUnimplementedScopedProfile(rawConfig);
   rejectUnimplementedPermissionsBlock(rawConfig);
-  rawConfig = stripRemovedNoOpKeys(rawConfig, defaultConfigWarn);
-  const result = NaxConfigSchema.safeParse(rawConfig);
+  const stripped = stripRemovedNoOpKeys(rawConfig, defaultConfigWarn);
+  const result = NaxConfigSchema.safeParse(stripped);
   if (!result.success) {
     const errors3 = result.error.issues.map((err) => {
       const path = String(err.path.join("."));
@@ -19815,6 +19842,47 @@ ${errors3.join(`
   }
   return result.data;
 }
+function findProjectDir(startDir = process.cwd()) {
+  let dir = resolve3(startDir);
+  let depth = 0;
+  while (depth < MAX_DIRECTORY_DEPTH) {
+    const candidate = join3(dir, PROJECT_NAX_DIR);
+    if (existsSync3(join3(candidate, "config.json"))) {
+      return candidate;
+    }
+    const parent = join3(dir, "..");
+    if (parent === dir)
+      break;
+    dir = parent;
+    depth++;
+  }
+  return null;
+}
+async function loadConfig(startDir, cliOverrides) {
+  let rawConfig = structuredClone(DEFAULT_CONFIG);
+  const warnDedupe = createConfigWarnDedupe();
+  const { projDir, projectRoot } = resolveProjectPaths(startDir);
+  const profileChain = await resolveProfileNames(cliOverrides ?? {}, process.env, projectRoot);
+  const overlayChain = profileChain.filter((name) => name && name !== "default");
+  let logger = null;
+  try {
+    logger = getLogger();
+  } catch {}
+  const ctx = { logger, warnDedupe };
+  const globalLayer = await applyGlobalLayer(rawConfig, ctx);
+  rawConfig = globalLayer.rawConfig;
+  rawConfig = await applyProjectLayer(rawConfig, projDir, globalLayer.globalLayerConf, ctx);
+  rawConfig = resolveEnvVarsWarnOnFailure(rawConfig, logger, "global/project config");
+  rawConfig = await applyProfileChainLayer(rawConfig, overlayChain, projectRoot, ctx);
+  rawConfig = applyCliOverridesLayer(rawConfig, cliOverrides, ctx);
+  rawConfig.profile = overlayChain.length > 0 ? overlayChain.join("+") : "default";
+  rawConfig.profileChain = overlayChain;
+  const hasMergedConfigs = globalLayer.globalConfRaw || projDir !== null || cliOverrides !== undefined || overlayChain.length > 0;
+  if (!hasMergedConfigs) {
+    return structuredClone(DEFAULT_CONFIG);
+  }
+  return finalizeAndValidateRootConfig(rawConfig);
+}
 async function loadPackageOverride(repoRoot, packageDir) {
   const packageConfigPath = join3(repoRoot, PROJECT_NAX_DIR, "mono", packageDir, "config.json");
   const override = await loadJsonFile(packageConfigPath, "config");
@@ -19859,8 +19927,10 @@ async function loadConfigForWorkdir(rootConfigPath, packageDir, cliOverrides) {
   }
   logger.debug("config", "Per-package config loaded", { packageConfigPath, packageDir });
   const { profile: packageProfile, ...packageFields } = packageOverride;
-  let merged = mergePackageConfig(rootConfig, packageFields);
-  merged = stripRemovedNoOpKeys(merged, defaultConfigWarn);
+  const warnDedupe = createConfigWarnDedupe();
+  const shimmedPackageFields = applyConfigCompatShims(packageFields, logger, warnDedupe);
+  let merged = mergePackageConfig(rootConfig, shimmedPackageFields);
+  merged = stripRemovedNoOpKeys(merged, warnDedupe.warn);
   const envResolvedMerged = resolveEnvVarsWarnOnFailure(merged, logger, `per-package config (${packageDir})`);
   const packageChain = parseProfileList(packageProfile).filter((name) => name && name !== "default");
   let rawMerged = envResolvedMerged;
@@ -19877,7 +19947,8 @@ async function loadConfigForWorkdir(rootConfigPath, packageDir, cliOverrides) {
         const path = err instanceof UnresolvedEnvVarError ? err.path.join(".") : undefined;
         throw new NaxError(`Per-package profile "${name}" (${packageDir}) references an undefined environment variable${varName ? ` $${varName}` : ""}${path ? ` at "${path}"` : ""}.`, "PROFILE_ENV_VAR_UNRESOLVED", { stage: "config", profileName: name, packageDir, varName, path, cause: err });
       }
-      rawMerged = deepMergeConfig(rawMerged, resolvedProfileData);
+      const shimmedProfileData = applyConfigCompatShims(resolvedProfileData, logger, warnDedupe);
+      rawMerged = deepMergeConfig(rawMerged, shimmedProfileData);
     }
     rawMerged.profile = packageChain.join("+");
     rawMerged.profileChain = packageChain;
@@ -19887,7 +19958,7 @@ async function loadConfigForWorkdir(rootConfigPath, packageDir, cliOverrides) {
   rejectDeadQualityFlags(rawMerged);
   rejectUnimplementedScopedProfile(rawMerged);
   rejectUnimplementedPermissionsBlock(rawMerged);
-  rawMerged = stripRemovedNoOpKeys(rawMerged, defaultConfigWarn);
+  rawMerged = stripRemovedNoOpKeys(rawMerged, warnDedupe.warn);
   const result = NaxConfigSchema.safeParse(rawMerged);
   if (!result.success) {
     const errors3 = result.error.issues.map((err) => {
@@ -29603,7 +29674,7 @@ function scanDirectory(sourceGlob, workdir, ignoreMatchers, maxGlobFiles, globCt
   return { workdir, files, truncated };
 }
 async function collectNeighbors(filePath, workdir, scannedDirs, contentCacheState, siblingTestContext) {
-  const neighbors = new Set;
+  const forwardNeighbors = new Set;
   let anyTruncated = false;
   const ownAbsPath = join14(workdir, filePath);
   if (await _codeNeighborDeps.fileExists(ownAbsPath)) {
@@ -29612,18 +29683,19 @@ async function collectNeighbors(filePath, workdir, scannedDirs, contentCacheStat
       for (const spec of parseImportSpecifiers(ownContent)) {
         const resolved = resolveImport(spec, filePath, workdir);
         if (resolved && resolved !== filePath)
-          neighbors.add(resolved);
+          forwardNeighbors.add(resolved);
       }
     }
   }
   const fileBaseName = (filePath.split("/").pop() ?? filePath).replace(/\.[^.]+$/, "");
   const fileNoExt = filePath.replace(/\.[^.]+$/, "");
+  const reverseNeighbors = new Set;
   outer:
     for (const { workdir: scanWorkdir, files: srcFiles, truncated } of scannedDirs) {
       if (truncated)
         anyTruncated = true;
       for (const srcFile of srcFiles) {
-        if (neighbors.size >= MAX_NEIGHBORS_PER_FILE)
+        if (reverseNeighbors.size >= MAX_NEIGHBORS_PER_FILE)
           break outer;
         if (srcFile === filePath)
           continue;
@@ -29632,13 +29704,26 @@ async function collectNeighbors(filePath, workdir, scannedDirs, contentCacheStat
           for (const spec of parseImportSpecifiers(content)) {
             const resolved = resolveImport(spec, srcFile, scanWorkdir);
             if (resolved === filePath || resolved === fileNoExt) {
-              neighbors.add(srcFile);
+              reverseNeighbors.add(srcFile);
               break;
             }
           }
         }
       }
     }
+  const minReverseSlots = Math.min(reverseNeighbors.size, Math.ceil(MAX_NEIGHBORS_PER_FILE / 2));
+  const forwardSlots = MAX_NEIGHBORS_PER_FILE - minReverseSlots;
+  const neighbors = new Set;
+  for (const f of forwardNeighbors) {
+    if (neighbors.size >= forwardSlots)
+      break;
+    neighbors.add(f);
+  }
+  for (const r of reverseNeighbors) {
+    if (neighbors.size >= MAX_NEIGHBORS_PER_FILE)
+      break;
+    neighbors.add(r);
+  }
   if (siblingTestContext && !isTestFile2(filePath, siblingTestContext.regex)) {
     const candidates = deriveSiblingTestCandidates(filePath, siblingTestContext.globs);
     let chosen = null;
@@ -35269,6 +35354,47 @@ var init_canonical_rules_cache = __esm(() => {
   canonicalRulesCache = new Map;
 });
 
+// src/context/engine/providers/static-rules-budget-notice.ts
+function buildSectionBudgetPressure(allSections, budgetResult) {
+  const { droppedIds, overageTokens } = budgetResult;
+  const droppedCount = droppedIds.length;
+  if (droppedCount === 0 && overageTokens <= 0)
+    return null;
+  const kept = new Set(budgetResult.retainedSections);
+  let droppedTokens = 0;
+  for (const section of allSections) {
+    if (!kept.has(section)) {
+      droppedTokens += section.tokens;
+    }
+  }
+  return { overageTokens, droppedCount, droppedTokens, droppedIds };
+}
+function budgetNoticeText(droppedCount, droppedIds) {
+  let detail = "";
+  if (droppedIds && droppedIds.length > 0) {
+    const shown = droppedIds.slice(0, MAX_LISTED_DROPPED_IDS);
+    const remainder = droppedIds.length - shown.length;
+    detail = ` (${shown.join(", ")}${remainder > 0 ? `, +${remainder} more` : ""})`;
+  }
+  return `Note: rule budget exceeded \u2014 ${droppedCount} lower-priority section(s) dropped${detail}. Increase \`context.v2.rules.rulesShare\` / \`context.v2.rules.budgetTokens\`, or set \`context.v2.rules.enforceBudget: false\`, to see the full ruleset.`;
+}
+function buildBudgetNoticeChunk(storyId, droppedCount, droppedIds) {
+  const content = `> ${budgetNoticeText(droppedCount, droppedIds)}`;
+  return {
+    id: `static-rules:__budget-notice__:${storyId}`,
+    kind: "static",
+    scope: "project",
+    role: ["all"],
+    content,
+    tokens: estimateTokens2(content),
+    rawScore: 1
+  };
+}
+var MAX_LISTED_DROPPED_IDS = 10;
+var init_static_rules_budget_notice = __esm(() => {
+  init_optimizer();
+});
+
 // src/context/engine/providers/static-rules.ts
 import { createHash as createHash10 } from "crypto";
 import { join as join20, relative as relative7 } from "path";
@@ -35349,20 +35475,6 @@ function ruleMatchesPackage(paths, repoRoot, packageDir) {
   const patterns = paths.map((p) => globToRegex3(normalizePath2(p)));
   return patterns.some((pattern) => pattern.test(rel) || pattern.test(`${rel}/`));
 }
-function buildSectionBudgetPressure(allSections, budgetResult) {
-  const { droppedIds, overageTokens } = budgetResult;
-  const droppedCount = droppedIds.length;
-  if (droppedCount === 0 && overageTokens <= 0)
-    return null;
-  const kept = new Set(budgetResult.retainedSections);
-  let droppedTokens = 0;
-  for (const section of allSections) {
-    if (!kept.has(section)) {
-      droppedTokens += section.tokens;
-    }
-  }
-  return { overageTokens, droppedCount, droppedTokens, droppedIds };
-}
 
 class StaticRulesProvider {
   id = "static-rules";
@@ -35516,8 +35628,9 @@ class StaticRulesProvider {
             });
           }
           const emptyPressure = buildSectionBudgetPressure(allSections, budgetResult);
+          const emptyChunks = this.enforceBudget && budgetResult.droppedIds.length > 0 ? [buildBudgetNoticeChunk(request.storyId, budgetResult.droppedIds.length, budgetResult.droppedIds)] : [];
           return {
-            chunks: [],
+            chunks: emptyChunks,
             pullTools: [],
             ...emptyPressure && { budgetPressure: emptyPressure },
             scopingReport
@@ -35549,6 +35662,9 @@ ${section.content}`;
           totalCanonicalRules: mergedRules.length,
           files: effectiveSections.map((s) => s.rulePath ?? "unknown")
         });
+        if (this.enforceBudget && budgetResult.droppedIds.length > 0) {
+          chunks.push(buildBudgetNoticeChunk(request.storyId, budgetResult.droppedIds.length, budgetResult.droppedIds));
+        }
         const pressure = buildSectionBudgetPressure(allSections, budgetResult);
         return {
           chunks,
@@ -35664,6 +35780,7 @@ var init_static_rules = __esm(() => {
   init_optimizer();
   init_canonical_loader();
   init_canonical_rules_cache();
+  init_static_rules_budget_notice();
   init_canonical_rules_cache();
   _staticRulesDeps = {
     readFile: async (path4) => Bun.file(path4).text(),
@@ -36312,7 +36429,17 @@ function toAbsolutePath2(projectDir, pathValue) {
 }
 async function discoverSessionScratchDirsOnDisk(projectDir, featureName, storyId, ttlMs) {
   const logger = getLogger();
-  const sessionsRoot = join22(featureDir(projectDir, featureName), "sessions");
+  let sessionsRoot;
+  try {
+    sessionsRoot = join22(featureDir(projectDir, featureName), "sessions");
+  } catch (err) {
+    logger.debug("context-v2", "discoverSessionScratchDirsOnDisk: invalid featureName \u2014 treating as no sessions", {
+      storyId,
+      featureName,
+      error: errorMessage(err)
+    });
+    return [];
+  }
   let entries;
   try {
     entries = await _stageAssemblerDeps.readdir(sessionsRoot);
@@ -48822,31 +48949,6 @@ var init_review_iteration_store = __esm(() => {
   init_findings();
 });
 
-// src/review/adversarial-audit-event.ts
-function recordAdversarialAudit(opts) {
-  opts.runtime?.dispatchEvents.emitReviewDecision({
-    kind: "review-decision",
-    reviewer: "adversarial",
-    workdir: opts.workdir,
-    projectDir: opts.projectDir,
-    storyId: opts.storyId,
-    featureName: opts.featureName,
-    timestamp: Date.now(),
-    parsed: opts.parsed,
-    looksLikeFail: opts.looksLikeFail,
-    failOpen: opts.failOpen,
-    passed: opts.passed,
-    passReason: opts.passReason,
-    blockingThreshold: opts.blockingThreshold,
-    result: opts.result,
-    advisoryFindings: opts.advisoryFindings,
-    acks: opts.acks,
-    diffAvailable: opts.diffAvailable,
-    adversarialDropAnalysis: opts.adversarialDropAnalysis,
-    adversarialAcceptAnalysis: opts.adversarialAcceptAnalysis
-  });
-}
-
 // src/review/adversarial-counterfactual-telemetry.ts
 function buildCounterfactualTelemetry({
   acDropped,
@@ -48884,172 +48986,30 @@ var init_adversarial_counterfactual_telemetry = __esm(() => {
   init_ac_structural_counterfactual();
 });
 
-// src/review/diff-utils.ts
-var {spawn: spawn3 } = globalThis.Bun;
-async function resolveNaxIgnorePathspecExcludes(workdir, options) {
-  if (options?.naxIgnoreIndex)
-    return options.naxIgnoreIndex.toPathspecExcludes(options.packageDir);
-  const matchers = await resolveNaxIgnorePatterns(workdir, options?.packageDir);
-  const pathspec = new Set;
-  for (const matcher of matchers)
-    pathspec.add(`:!${matcher.pattern}`);
-  return [...pathspec];
-}
-async function collectDiff(workdir, storyGitRef, excludePatterns, options) {
-  const naxIgnoreExcludes = await resolveNaxIgnorePathspecExcludes(workdir, options);
-  const merged = [...new Set([...excludePatterns, ...naxIgnoreExcludes, ...ALWAYS_EXCLUDED])];
-  const cmd = ["git", "diff", "--unified=3", `${storyGitRef}..HEAD`, "--", ".", ...merged];
-  const proc = _diffUtilsDeps.spawn({
-    cmd,
-    cwd: workdir,
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    proc.exited,
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text()
-  ]);
-  if (exitCode !== 0) {
-    getSafeLogger()?.warn("diff-utils", "git diff failed \u2014 skipping review diff", { storyGitRef, stderr });
-    return null;
-  }
-  return stdout;
-}
-async function collectDiffStat(workdir, storyGitRef, options) {
-  const naxIgnoreExcludes = await resolveNaxIgnorePathspecExcludes(workdir, options);
-  const merged = [...new Set([...naxIgnoreExcludes, ...ALWAYS_EXCLUDED])];
-  const proc = _diffUtilsDeps.spawn({
-    cmd: ["git", "diff", "--stat", `${storyGitRef}..HEAD`, "--", ".", ...merged],
-    cwd: workdir,
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  const [exitCode, stdout] = await Promise.all([
-    proc.exited,
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text()
-  ]);
-  return exitCode === 0 ? stdout.trim() : "";
-}
-function truncateDiff(diff, stat4) {
-  if (diff.length <= DIFF_CAP_BYTES) {
-    return diff;
-  }
-  const truncated = diff.slice(0, DIFF_CAP_BYTES);
-  const visibleFiles = (truncated.match(/^diff --git/gm) ?? []).length;
-  const totalFiles = (diff.match(/^diff --git/gm) ?? []).length;
-  const statPreamble = stat4 ? `## File Summary (all changed files)
-${stat4}
-
-## Diff (truncated \u2014 ${visibleFiles}/${totalFiles} files shown)
-` : "";
-  return `${statPreamble}${truncated}
-... (truncated at ${DIFF_CAP_BYTES} bytes, showing ${visibleFiles}/${totalFiles} files)`;
-}
-async function resolveEffectiveRef(workdir, storyGitRef, storyId) {
-  const logger = getSafeLogger();
-  if (storyGitRef && await _diffUtilsDeps.isGitRefValid(workdir, storyGitRef)) {
-    return storyGitRef;
-  }
-  const fallback = await _diffUtilsDeps.getMergeBase(workdir);
-  if (fallback) {
-    logger?.info("review", "storyGitRef missing or invalid \u2014 using merge-base fallback", {
-      storyId,
-      storyGitRef,
-      fallback
-    });
-    return fallback;
-  }
-  return;
-}
-function buildSuffixStrippers(testFilePatterns) {
-  if (!testFilePatterns || testFilePatterns.length === 0)
-    return DEFAULT_SUFFIX_STRIPPERS;
-  const regexes = [];
-  for (const pattern of testFilePatterns) {
-    const lastStar = pattern.lastIndexOf("*");
-    if (lastStar === -1)
-      continue;
-    const suffix = pattern.slice(lastStar + 1);
-    if (suffix.length > 0) {
-      regexes.push(new RegExp(`${suffix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`));
-    }
-  }
-  return regexes.length > 0 ? regexes : DEFAULT_SUFFIX_STRIPPERS;
-}
-function stripTestSuffix(base, strippers) {
-  for (const re of strippers) {
-    const stripped = base.replace(re, "");
-    if (stripped !== base)
-      return stripped;
-  }
-  return base;
-}
-async function computeTestInventory(workdir, storyGitRef, testFilePatterns, options) {
-  const proc = _diffUtilsDeps.spawn({
-    cmd: ["git", "diff", "--name-only", "--diff-filter=A", `${storyGitRef}..HEAD`],
-    cwd: workdir,
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  const [exitCode, stdout] = await Promise.all([
-    proc.exited,
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text()
-  ]);
-  if (exitCode !== 0) {
-    return { addedTestFiles: [], newSourceFilesWithoutTests: [] };
-  }
-  const addedFiles = stdout.trim().split(`
-`).filter(Boolean);
-  const ignoreMatchers = options?.naxIgnoreIndex?.getMatchers(options.packageDir) ?? await resolveNaxIgnorePatterns(workdir, options?.packageDir);
-  const visibleAddedFiles = filterNaxInternalPaths(addedFiles, ignoreMatchers);
-  const addedTestFiles = visibleAddedFiles.filter((f) => isTestFile(f, testFilePatterns));
-  const addedSourceFiles = visibleAddedFiles.filter((f) => !isTestFile(f, testFilePatterns));
-  const suffixStrippers = buildSuffixStrippers(testFilePatterns);
-  const testFileBasenames = new Set(addedTestFiles.map((f) => {
-    const base = f.split("/").at(-1) ?? f;
-    return stripTestSuffix(base, suffixStrippers);
-  }));
-  const newSourceFilesWithoutTests = addedSourceFiles.filter((f) => {
-    const base = (f.split("/").at(-1) ?? f).replace(/\.(ts|js|tsx|jsx|go)$/, "");
-    return !testFileBasenames.has(base);
-  });
-  return { addedTestFiles, newSourceFilesWithoutTests };
-}
-async function collectDiffFileList(workdir, storyGitRef, options) {
-  const naxIgnoreExcludes = await resolveNaxIgnorePathspecExcludes(workdir, options);
-  const merged = [...new Set([...naxIgnoreExcludes, ...ALWAYS_EXCLUDED])];
-  const proc = _diffUtilsDeps.spawn({
-    cmd: ["git", "diff", "--name-only", `${storyGitRef}..HEAD`, "--", ".", ...merged],
-    cwd: workdir,
-    stdout: "pipe",
-    stderr: "pipe"
+// src/review/adversarial-audit-event.ts
+function recordAdversarialAudit(opts) {
+  opts.runtime?.dispatchEvents.emitReviewDecision({
+    kind: "review-decision",
+    reviewer: "adversarial",
+    workdir: opts.workdir,
+    projectDir: opts.projectDir,
+    storyId: opts.storyId,
+    featureName: opts.featureName,
+    timestamp: Date.now(),
+    parsed: opts.parsed,
+    looksLikeFail: opts.looksLikeFail,
+    failOpen: opts.failOpen,
+    passed: opts.passed,
+    passReason: opts.passReason,
+    blockingThreshold: opts.blockingThreshold,
+    result: opts.result,
+    advisoryFindings: opts.advisoryFindings,
+    acks: opts.acks,
+    diffAvailable: opts.diffAvailable,
+    adversarialDropAnalysis: opts.adversarialDropAnalysis,
+    adversarialAcceptAnalysis: opts.adversarialAcceptAnalysis
   });
-  const [exitCode, stdout] = await Promise.all([
-    proc.exited,
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text()
-  ]);
-  if (exitCode !== 0)
-    return;
-  return stdout.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0);
 }
-var DIFF_CAP_BYTES = 51200, ALWAYS_EXCLUDED, _diffUtilsDeps, DEFAULT_SUFFIX_STRIPPERS;
-var init_diff_utils = __esm(() => {
-  init_logger2();
-  init_test_runners();
-  init_git();
-  init_path_filters();
-  ALWAYS_EXCLUDED = [":!.nax/", ":!.nax-pids"];
-  _diffUtilsDeps = {
-    spawn: spawn3,
-    isGitRefValid,
-    getMergeBase
-  };
-  DEFAULT_SUFFIX_STRIPPERS = [/\.(test|spec)\.(ts|js|tsx|jsx)$/, /_test\.go$/];
-});
 
 // src/review/finding-projection.ts
 function narrowSeverity(raw) {
@@ -49134,6 +49094,505 @@ var init_finding_projection = __esm(() => {
   };
 });
 
+// src/review/adversarial-outcomes.ts
+function skipResult(output, startTime) {
+  return {
+    check: "adversarial",
+    success: true,
+    command: "",
+    exitCode: 0,
+    output,
+    durationMs: Date.now() - startTime
+  };
+}
+function buildFeatureCtxBlock(contextBundle, featureContextMarkdown) {
+  if (contextBundle) {
+    const md = contextBundle.pushMarkdown.trim();
+    return md ? `${md}
+
+---
+
+` : "";
+  }
+  if (featureContextMarkdown) {
+    const filtered = filterContextByRole(featureContextMarkdown, "reviewer-adversarial");
+    if (filtered.trim())
+      return `${filtered}
+
+---
+
+`;
+  }
+  return "";
+}
+function catchDispatchFailure(err, ctx) {
+  const { runtime, workdir, projectDir, storyId, featureName, blockingThreshold, startTime, logger } = ctx;
+  logger?.warn("adversarial", "LLM call failed \u2014 fail-open", { storyId, cause: String(err) });
+  recordAdversarialAudit({
+    runtime,
+    workdir,
+    projectDir,
+    storyId,
+    featureName,
+    parsed: false,
+    looksLikeFail: false,
+    failOpen: true,
+    passed: true,
+    blockingThreshold,
+    result: null
+  });
+  return {
+    check: "adversarial",
+    success: true,
+    failOpen: true,
+    command: "",
+    exitCode: 0,
+    output: `skipped: LLM call failed \u2014 ${String(err)}`,
+    durationMs: Date.now() - startTime
+  };
+}
+function handleRetryExhaustedFailOpen(ctx) {
+  const { runtime, workdir, projectDir, storyId, featureName, blockingThreshold, startTime, logger } = ctx;
+  logger?.warn("adversarial", "Retry exhausted \u2014 fail-open", { storyId });
+  recordAdversarialAudit({
+    runtime,
+    workdir,
+    projectDir,
+    storyId,
+    featureName,
+    parsed: false,
+    looksLikeFail: false,
+    failOpen: true,
+    passed: true,
+    blockingThreshold,
+    result: null
+  });
+  return {
+    check: "adversarial",
+    success: true,
+    failOpen: true,
+    command: "",
+    exitCode: 0,
+    output: "adversarial review: could not parse LLM response (fail-open)",
+    durationMs: Date.now() - startTime
+  };
+}
+function handleTruncatedLooksLikeFail(ctx) {
+  const { runtime, workdir, projectDir, storyId, featureName, blockingThreshold, startTime, logger } = ctx;
+  logger?.warn("adversarial", "LLM returned truncated JSON with passed:false \u2014 treating as failure", { storyId });
+  recordAdversarialAudit({
+    runtime,
+    workdir,
+    projectDir,
+    storyId,
+    featureName,
+    parsed: false,
+    looksLikeFail: true,
+    failOpen: false,
+    passed: false,
+    blockingThreshold,
+    result: null
+  });
+  return {
+    check: "adversarial",
+    success: false,
+    command: "",
+    exitCode: 1,
+    output: "adversarial review: LLM response truncated but indicated failure (passed:false found in partial response)",
+    durationMs: Date.now() - startTime
+  };
+}
+function classifyAdversarialFindings(opResult, blockingThreshold, priorAdversarialIterations, adversarialConfig, resolvedTestPatterns) {
+  const threshold = blockingThreshold ?? "error";
+  const allFindings = opResult.findings;
+  const patterns = resolvedTestPatterns?.regex ?? [];
+  const testFileMatch = (file3) => patterns.some((re) => re.test(file3));
+  const recurrenceCfg = adversarialConfig.recurrenceDemotion ?? { enabled: true, maxBlockingRounds: 2 };
+  const {
+    blocking: blockingFindings,
+    advisory: advisoryOnly,
+    demoted
+  } = classifyRecurrence(allFindings, priorAdversarialIterations ?? [], recurrenceCfg, testFileMatch, threshold);
+  const advisoryFindings = [...advisoryOnly, ...demoted];
+  const advisoryReviewFindings = [
+    ...llmFindingsToReviewFindings(advisoryOnly, { source: "adversarial-review", isTestFile: testFileMatch }),
+    ...tagCoverageGap(llmFindingsToReviewFindings(demoted, { source: "adversarial-review", isTestFile: testFileMatch }))
+  ];
+  const advisoryFindingsAsFindings = [
+    ...toAdversarialReviewFindings(advisoryOnly, { isTestFile: testFileMatch }),
+    ...tagCoverageGap(toAdversarialReviewFindings(demoted, { isTestFile: testFileMatch }))
+  ];
+  return {
+    threshold,
+    allFindings,
+    testFileMatch,
+    blockingFindings,
+    advisoryFindings,
+    advisoryReviewFindings,
+    advisoryFindingsAsFindings,
+    acDropped: opResult.acDropped ?? [],
+    acks: opResult.acks
+  };
+}
+async function resolveDiffFileSet(diff, workdir, projectDir, effectiveRef, naxIgnoreIndex, collectDiffFileListFn) {
+  if (diff && diff.length > 0) {
+    return { diffFiles: extractDiffFiles(diff), diffAvailable: true };
+  }
+  const repoRoot = projectDir ?? workdir;
+  const packageDir = workdir !== repoRoot ? workdir : undefined;
+  const list = await collectDiffFileListFn(workdir, effectiveRef, { naxIgnoreIndex, packageDir });
+  if (list === undefined)
+    return { diffFiles: new Set, diffAvailable: false };
+  return { diffFiles: new Set(list), diffAvailable: true };
+}
+function buildBlockingFailureResult(ctx, classification, telemetry, diffAvailable, durationMs) {
+  const { runtime, workdir, projectDir, storyId, featureName, logger } = ctx;
+  const { threshold, allFindings, testFileMatch, blockingFindings, advisoryFindings, advisoryReviewFindings, acks } = classification;
+  logger?.warn("review", `Adversarial review failed: ${blockingFindings.length} blocking findings`, {
+    storyId,
+    durationMs,
+    findings: blockingFindings.map((f) => ({
+      severity: f.severity,
+      category: f.category,
+      file: f.file,
+      line: f.line,
+      issue: f.issue
+    }))
+  });
+  recordAdversarialAudit({
+    runtime,
+    workdir,
+    projectDir,
+    storyId,
+    featureName,
+    parsed: true,
+    failOpen: false,
+    passed: false,
+    blockingThreshold: threshold,
+    result: {
+      passed: false,
+      findings: llmFindingsToReviewFindings(allFindings, { source: "adversarial-review", isTestFile: testFileMatch })
+    },
+    advisoryFindings: advisoryFindings.length > 0 ? advisoryReviewFindings : undefined,
+    diffAvailable,
+    adversarialDropAnalysis: telemetry.adversarialDropAnalysis,
+    adversarialAcceptAnalysis: telemetry.adversarialAcceptAnalysis,
+    acks
+  });
+  return {
+    check: "adversarial",
+    success: false,
+    command: "",
+    exitCode: 1,
+    output: `Adversarial review failed:
+
+${formatFindings(blockingFindings)}`,
+    durationMs,
+    findings: toAdversarialReviewFindings(blockingFindings, { isTestFile: testFileMatch }),
+    advisoryFindings: advisoryFindings.length > 0 ? classification.advisoryFindingsAsFindings : undefined,
+    cost: 0
+  };
+}
+function buildHallucinatedAcQuoteResult(ctx, classification, telemetry, diffAvailable, durationMs) {
+  const { runtime, workdir, projectDir, storyId, featureName, logger } = ctx;
+  const { threshold, testFileMatch, acDropped, acks, advisoryFindingsAsFindings } = classification;
+  const demotedFindings = toAdversarialReviewFindings(acDropped.map((d) => ({ ...d.finding, severity: "warning", acQuote: undefined, acIndex: undefined })), { isTestFile: testFileMatch });
+  const allAdvisory = [...advisoryFindingsAsFindings, ...demotedFindings];
+  logger?.warn("review", "Adversarial review passed: all blocking findings discarded as hallucinated AC quotes", {
+    storyId,
+    durationMs,
+    droppedCount: acDropped.length,
+    drops: acDropped.map((d) => ({ file: d.finding.file, issue: d.finding.issue }))
+  });
+  recordAdversarialAudit({
+    runtime,
+    workdir,
+    projectDir,
+    storyId,
+    featureName,
+    parsed: true,
+    acks,
+    failOpen: false,
+    passed: true,
+    passReason: "ac_quote_not_substring_demoted",
+    blockingThreshold: threshold,
+    result: { passed: true, findings: [] },
+    advisoryFindings: allAdvisory.length > 0 ? allAdvisory : undefined,
+    diffAvailable,
+    adversarialDropAnalysis: telemetry.adversarialDropAnalysis,
+    adversarialAcceptAnalysis: []
+  });
+  return {
+    check: "adversarial",
+    success: true,
+    passReason: "ac_quote_not_substring_demoted",
+    command: "",
+    exitCode: 0,
+    output: `Adversarial review passed: ${acDropped.length} blocking finding(s) demoted to advisory \u2014 all cited AC quotes were fabricated and could not be validated.`,
+    durationMs,
+    advisoryFindings: allAdvisory.length > 0 ? allAdvisory : undefined,
+    cost: 0
+  };
+}
+function buildUngroundedFailClosedResult(ctx, classification, telemetry, diffAvailable, durationMs) {
+  const { runtime, workdir, projectDir, storyId, featureName, logger } = ctx;
+  const { threshold, acDropped, acks, advisoryFindings, advisoryReviewFindings, advisoryFindingsAsFindings } = classification;
+  logger?.warn("review", "Adversarial review fail-closed: blocking findings dropped as ungrounded", {
+    storyId,
+    durationMs,
+    droppedCount: acDropped.length,
+    dropCodes: acDropped.map((d) => d.code)
+  });
+  const dropSummary = acDropped.map((d, i) => `${i + 1}. [${d.code}] ${d.finding.file ?? "<unknown>"}: ${d.finding.issue}`).join(`
+`);
+  recordAdversarialAudit({
+    runtime,
+    workdir,
+    projectDir,
+    storyId,
+    featureName,
+    parsed: true,
+    acks,
+    failOpen: false,
+    passed: false,
+    blockingThreshold: threshold,
+    result: { passed: false, findings: [] },
+    advisoryFindings: advisoryFindings.length > 0 ? advisoryReviewFindings : undefined,
+    diffAvailable,
+    adversarialDropAnalysis: telemetry.adversarialDropAnalysis,
+    adversarialAcceptAnalysis: []
+  });
+  return {
+    check: "adversarial",
+    success: false,
+    command: "",
+    exitCode: 1,
+    output: `Adversarial review failed: ${acDropped.length} blocking finding(s) dropped as ungrounded \u2014 the model emitted "passed: false" with concerns it could not ground in any acceptance criterion. Drops:
+
+${dropSummary}`,
+    durationMs,
+    advisoryFindings: advisoryFindings.length > 0 ? advisoryFindingsAsFindings : undefined,
+    cost: 0
+  };
+}
+function buildPassedResult(ctx, classification, telemetry, diffAvailable, durationMs) {
+  const { runtime, workdir, projectDir, storyId, featureName, logger } = ctx;
+  const {
+    threshold,
+    allFindings,
+    testFileMatch,
+    advisoryFindings,
+    advisoryReviewFindings,
+    advisoryFindingsAsFindings,
+    acks
+  } = classification;
+  logger?.info("review", "Adversarial review passed", { storyId, durationMs });
+  recordAdversarialAudit({
+    runtime,
+    workdir,
+    projectDir,
+    storyId,
+    featureName,
+    parsed: true,
+    acks,
+    failOpen: false,
+    passed: true,
+    blockingThreshold: threshold,
+    result: {
+      passed: true,
+      findings: llmFindingsToReviewFindings(allFindings, { source: "adversarial-review", isTestFile: testFileMatch })
+    },
+    advisoryFindings: advisoryFindings.length > 0 ? advisoryReviewFindings : undefined,
+    diffAvailable,
+    adversarialDropAnalysis: telemetry.adversarialDropAnalysis,
+    adversarialAcceptAnalysis: []
+  });
+  return {
+    check: "adversarial",
+    success: true,
+    command: "",
+    exitCode: 0,
+    output: allFindings.length === 0 ? "Adversarial review passed" : "Adversarial review passed (all findings were advisory \u2014 below blocking threshold)",
+    durationMs,
+    advisoryFindings: advisoryFindings.length > 0 ? advisoryFindingsAsFindings : undefined,
+    cost: 0
+  };
+}
+var init_adversarial_outcomes = __esm(() => {
+  init_context();
+  init_diff_files();
+  init_adversarial_helpers();
+  init_finding_projection();
+  init_recurrence_demotion();
+});
+
+// src/review/diff-utils.ts
+var {spawn: spawn3 } = globalThis.Bun;
+async function resolveNaxIgnorePathspecExcludes(workdir, options) {
+  if (options?.naxIgnoreIndex)
+    return options.naxIgnoreIndex.toPathspecExcludes(options.packageDir);
+  const matchers = await resolveNaxIgnorePatterns(workdir, options?.packageDir);
+  const pathspec = new Set;
+  for (const matcher of matchers)
+    pathspec.add(`:!${matcher.pattern}`);
+  return [...pathspec];
+}
+async function collectDiff(workdir, storyGitRef, excludePatterns, options) {
+  const naxIgnoreExcludes = await resolveNaxIgnorePathspecExcludes(workdir, options);
+  const merged = [...new Set([...excludePatterns, ...naxIgnoreExcludes, ...ALWAYS_EXCLUDED])];
+  const cmd = ["git", "diff", "--unified=3", `${storyGitRef}..HEAD`, "--", ".", ...merged];
+  const proc = _diffUtilsDeps.spawn({
+    cmd,
+    cwd: workdir,
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    proc.exited,
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text()
+  ]);
+  if (exitCode !== 0) {
+    getSafeLogger()?.warn("diff-utils", "git diff failed \u2014 skipping review diff", { storyGitRef, stderr });
+    return null;
+  }
+  return stdout;
+}
+async function collectDiffStat(workdir, storyGitRef, options) {
+  const naxIgnoreExcludes = await resolveNaxIgnorePathspecExcludes(workdir, options);
+  const merged = [...new Set([...naxIgnoreExcludes, ...ALWAYS_EXCLUDED])];
+  const proc = _diffUtilsDeps.spawn({
+    cmd: ["git", "diff", "--stat", `${storyGitRef}..HEAD`, "--", ".", ...merged],
+    cwd: workdir,
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout] = await Promise.all([
+    proc.exited,
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text()
+  ]);
+  return exitCode === 0 ? stdout.trim() : "";
+}
+function truncateDiff(diff, stat4) {
+  if (diff.length <= DIFF_CAP_BYTES) {
+    return diff;
+  }
+  const truncated = diff.slice(0, DIFF_CAP_BYTES);
+  const visibleFiles = (truncated.match(/^diff --git/gm) ?? []).length;
+  const totalFiles = (diff.match(/^diff --git/gm) ?? []).length;
+  const statPreamble = stat4 ? `## File Summary (all changed files)
+${stat4}
+
+## Diff (truncated \u2014 ${visibleFiles}/${totalFiles} files shown)
+` : "";
+  return `${statPreamble}${truncated}
+... (truncated at ${DIFF_CAP_BYTES} bytes, showing ${visibleFiles}/${totalFiles} files)`;
+}
+async function resolveEffectiveRef(workdir, storyGitRef, storyId) {
+  const logger = getSafeLogger();
+  if (storyGitRef && await _diffUtilsDeps.isGitRefValid(workdir, storyGitRef)) {
+    return storyGitRef;
+  }
+  const fallback = await _diffUtilsDeps.getMergeBase(workdir);
+  if (fallback) {
+    logger?.info("review", "storyGitRef missing or invalid \u2014 using merge-base fallback", {
+      storyId,
+      storyGitRef,
+      fallback
+    });
+    return fallback;
+  }
+  return;
+}
+function buildSuffixStrippers(testFilePatterns) {
+  if (!testFilePatterns || testFilePatterns.length === 0)
+    return DEFAULT_SUFFIX_STRIPPERS;
+  const regexes = [];
+  for (const pattern of testFilePatterns) {
+    const lastStar = pattern.lastIndexOf("*");
+    if (lastStar === -1)
+      continue;
+    const suffix = pattern.slice(lastStar + 1);
+    if (suffix.length > 0) {
+      regexes.push(new RegExp(`${suffix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`));
+    }
+  }
+  return regexes.length > 0 ? regexes : DEFAULT_SUFFIX_STRIPPERS;
+}
+function stripTestSuffix(base, strippers) {
+  for (const re of strippers) {
+    const stripped = base.replace(re, "");
+    if (stripped !== base)
+      return stripped;
+  }
+  return base;
+}
+async function computeTestInventory(workdir, storyGitRef, testFilePatterns, options) {
+  const proc = _diffUtilsDeps.spawn({
+    cmd: ["git", "diff", "--name-only", "--diff-filter=A", `${storyGitRef}..HEAD`],
+    cwd: workdir,
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout] = await Promise.all([
+    proc.exited,
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text()
+  ]);
+  if (exitCode !== 0) {
+    return { addedTestFiles: [], newSourceFilesWithoutTests: [] };
+  }
+  const addedFiles = stdout.trim().split(`
+`).filter(Boolean);
+  const ignoreMatchers = options?.naxIgnoreIndex?.getMatchers(options.packageDir) ?? await resolveNaxIgnorePatterns(workdir, options?.packageDir);
+  const visibleAddedFiles = filterNaxInternalPaths(addedFiles, ignoreMatchers);
+  const addedTestFiles = visibleAddedFiles.filter((f) => isTestFile(f, testFilePatterns));
+  const addedSourceFiles = visibleAddedFiles.filter((f) => !isTestFile(f, testFilePatterns));
+  const suffixStrippers = buildSuffixStrippers(testFilePatterns);
+  const testFileBasenames = new Set(addedTestFiles.map((f) => {
+    const base = f.split("/").at(-1) ?? f;
+    return stripTestSuffix(base, suffixStrippers);
+  }));
+  const newSourceFilesWithoutTests = addedSourceFiles.filter((f) => {
+    const base = (f.split("/").at(-1) ?? f).replace(/\.(ts|js|tsx|jsx|go)$/, "");
+    return !testFileBasenames.has(base);
+  });
+  return { addedTestFiles, newSourceFilesWithoutTests };
+}
+async function collectDiffFileList(workdir, storyGitRef, options) {
+  const naxIgnoreExcludes = await resolveNaxIgnorePathspecExcludes(workdir, options);
+  const merged = [...new Set([...naxIgnoreExcludes, ...ALWAYS_EXCLUDED])];
+  const proc = _diffUtilsDeps.spawn({
+    cmd: ["git", "diff", "--name-only", `${storyGitRef}..HEAD`, "--", ".", ...merged],
+    cwd: workdir,
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout] = await Promise.all([
+    proc.exited,
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text()
+  ]);
+  if (exitCode !== 0)
+    return;
+  return stdout.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0);
+}
+var DIFF_CAP_BYTES = 51200, ALWAYS_EXCLUDED, _diffUtilsDeps, DEFAULT_SUFFIX_STRIPPERS;
+var init_diff_utils = __esm(() => {
+  init_logger2();
+  init_test_runners();
+  init_git();
+  init_path_filters();
+  ALWAYS_EXCLUDED = [":!.nax/", ":!.nax-pids"];
+  _diffUtilsDeps = {
+    spawn: spawn3,
+    isGitRefValid,
+    getMergeBase
+  };
+  DEFAULT_SUFFIX_STRIPPERS = [/\.(test|spec)\.(ts|js|tsx|jsx)$/, /_test\.go$/];
+});
+
 // src/review/prepare-inputs.ts
 import { relative as relative11, sep as sep3 } from "path";
 function derivePackageDirs(workdir, projectDir) {
@@ -49282,7 +49741,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@nathapp/nax",
-    version: "0.80.0",
+    version: "0.80.1",
     description: "AI Coding Agent Orchestrator \u2014 loops until done",
     type: "module",
     bin: {
@@ -49397,8 +49856,8 @@ var init_version = __esm(() => {
   NAX_VERSION = package_default.version;
   NAX_COMMIT = (() => {
     try {
-      if (/^[0-9a-f]{6,10}$/.test("b4df507e"))
-        return "b4df507e";
+      if (/^[0-9a-f]{6,10}$/.test("8daaf106"))
+        return "8daaf106";
     } catch {}
     try {
       const result = Bun.spawnSync(["git", "rev-parse", "--short", "HEAD"], {
@@ -49603,14 +50062,7 @@ async function runAdversarialReview(opts) {
     adversarialConfig
   });
   if (prepared.skipReason === "no git ref") {
-    return {
-      check: "adversarial",
-      success: true,
-      command: "",
-      exitCode: 0,
-      output: "skipped: no git ref",
-      durationMs: Date.now() - startTime
-    };
+    return skipResult("skipped: no git ref", startTime);
   }
   const diffMode = adversarialConfig.diffMode ?? "ref";
   logger?.info("review", "Running adversarial check", {
@@ -49619,24 +50071,10 @@ async function runAdversarialReview(opts) {
     diffMode
   });
   if (prepared.skipReason === "no changes detected") {
-    return {
-      check: "adversarial",
-      success: true,
-      command: "",
-      exitCode: 0,
-      output: "skipped: no changes detected",
-      durationMs: Date.now() - startTime
-    };
+    return skipResult("skipped: no changes detected", startTime);
   }
   if (prepared.skipReason === "no code changes") {
-    return {
-      check: "adversarial",
-      success: true,
-      command: "",
-      exitCode: 0,
-      output: "skipped: no code changes",
-      durationMs: Date.now() - startTime
-    };
+    return skipResult("skipped: no code changes", startTime);
   }
   const effectiveRef = prepared.effectiveRef;
   const stat4 = prepared.stat;
@@ -49650,37 +50088,22 @@ async function runAdversarialReview(opts) {
       storyId: story.id,
       model: adversarialConfig.model
     });
-    return {
-      check: "adversarial",
-      success: true,
-      command: "",
-      exitCode: 0,
-      output: "skipped: no agent available for model tier",
-      durationMs: Date.now() - startTime
-    };
-  }
-  let featureCtxBlock = "";
-  if (contextBundle) {
-    const md = contextBundle.pushMarkdown.trim();
-    if (md)
-      featureCtxBlock = `${md}
-
----
-
-`;
-  } else if (featureContextMarkdown) {
-    const filtered = filterContextByRole(featureContextMarkdown, "reviewer-adversarial");
-    if (filtered.trim())
-      featureCtxBlock = `${filtered}
-
----
-
-`;
+    return skipResult("skipped: no agent available for model tier", startTime);
   }
+  const featureCtxBlock = buildFeatureCtxBlock(contextBundle, featureContextMarkdown);
   if (!runtime) {
     throw new NaxError("runtime required \u2014 legacy agentManager.run path removed (ADR-019 Wave 3, issue #762)", "DISPATCH_NO_RUNTIME", { stage: "review-adversarial", storyId: story.id });
   }
-  const llmCost = 0;
+  const outcomeCtx = {
+    runtime,
+    workdir,
+    projectDir,
+    storyId: story.id,
+    featureName,
+    blockingThreshold,
+    startTime,
+    logger
+  };
   const callCtx = {
     runtime,
     packageView: runtime.packages.resolve(workdir),
@@ -49711,81 +50134,12 @@ async function runAdversarialReview(opts) {
       resolvedTestPatterns
     });
   } catch (err) {
-    logger?.warn("adversarial", "LLM call failed \u2014 fail-open", { storyId: story.id, cause: String(err) });
-    recordAdversarialAudit({
-      runtime,
-      workdir,
-      projectDir,
-      storyId: story.id,
-      featureName,
-      parsed: false,
-      looksLikeFail: false,
-      failOpen: true,
-      passed: true,
-      blockingThreshold,
-      result: null
-    });
-    return {
-      check: "adversarial",
-      success: true,
-      failOpen: true,
-      command: "",
-      exitCode: 0,
-      output: `skipped: LLM call failed \u2014 ${String(err)}`,
-      durationMs: Date.now() - startTime
-    };
-  }
-  if (opResult.failOpen) {
-    logger?.warn("adversarial", "Retry exhausted \u2014 fail-open", { storyId: story.id });
-    recordAdversarialAudit({
-      runtime,
-      workdir,
-      projectDir,
-      storyId: story.id,
-      featureName,
-      parsed: false,
-      looksLikeFail: false,
-      failOpen: true,
-      passed: true,
-      blockingThreshold,
-      result: null
-    });
-    return {
-      check: "adversarial",
-      success: true,
-      failOpen: true,
-      command: "",
-      exitCode: 0,
-      output: "adversarial review: could not parse LLM response (fail-open)",
-      durationMs: Date.now() - startTime
-    };
-  }
-  if (opResult.looksLikeFail) {
-    logger?.warn("adversarial", "LLM returned truncated JSON with passed:false \u2014 treating as failure", {
-      storyId: story.id
-    });
-    recordAdversarialAudit({
-      runtime,
-      workdir,
-      projectDir,
-      storyId: story.id,
-      featureName,
-      parsed: false,
-      looksLikeFail: true,
-      failOpen: false,
-      passed: false,
-      blockingThreshold,
-      result: null
-    });
-    return {
-      check: "adversarial",
-      success: false,
-      command: "",
-      exitCode: 1,
-      output: "adversarial review: LLM response truncated but indicated failure (passed:false found in partial response)",
-      durationMs: Date.now() - startTime
-    };
+    return catchDispatchFailure(err, outcomeCtx);
   }
+  if (opResult.failOpen)
+    return handleRetryExhaustedFailOpen(outcomeCtx);
+  if (opResult.looksLikeFail)
+    return handleTruncatedLooksLikeFail(outcomeCtx);
   if (opResult.repromptEvent) {
     runtime.dispatchEvents.emitReviewReprompt({
       kind: "review-reprompt-on-drop",
@@ -49796,44 +50150,9 @@ async function runAdversarialReview(opts) {
       costUsd: opResult.repromptEvent.costUsd
     });
   }
-  const threshold = blockingThreshold ?? "error";
-  const allFindings = opResult.findings;
-  const patterns = resolvedTestPatterns?.regex ?? [];
-  const testFileMatch = (file3) => patterns.some((re) => re.test(file3));
-  const recurrenceCfg = adversarialConfig.recurrenceDemotion ?? { enabled: true, maxBlockingRounds: 2 };
-  const {
-    blocking: blockingFindings,
-    advisory: advisoryOnly,
-    demoted
-  } = classifyRecurrence(allFindings, priorAdversarialIterations ?? [], recurrenceCfg, testFileMatch, threshold);
-  const advisoryFindings = [...advisoryOnly, ...demoted];
-  const advisoryReviewFindings = [
-    ...llmFindingsToReviewFindings(advisoryOnly, { source: "adversarial-review", isTestFile: testFileMatch }),
-    ...tagCoverageGap(llmFindingsToReviewFindings(demoted, { source: "adversarial-review", isTestFile: testFileMatch }))
-  ];
-  const advisoryFindingsAsFindings = [
-    ...toAdversarialReviewFindings(advisoryOnly, { isTestFile: testFileMatch }),
-    ...tagCoverageGap(toAdversarialReviewFindings(demoted, { isTestFile: testFileMatch }))
-  ];
-  const acDropped = opResult.acDropped ?? [];
-  const acks = opResult.acks;
-  let diffFiles;
-  let diffAvailable;
-  if (diff && diff.length > 0) {
-    diffFiles = extractDiffFiles(diff);
-    diffAvailable = true;
-  } else {
-    const repoRoot = projectDir ?? workdir;
-    const packageDir = workdir !== repoRoot ? workdir : undefined;
-    const list = await _adversarialDeps.collectDiffFileList(workdir, effectiveRef, { naxIgnoreIndex, packageDir });
-    if (list === undefined) {
-      diffFiles = new Set;
-      diffAvailable = false;
-    } else {
-      diffFiles = new Set(list);
-      diffAvailable = true;
-    }
-  }
+  const classification = classifyAdversarialFindings(opResult, blockingThreshold, priorAdversarialIterations, adversarialConfig, resolvedTestPatterns);
+  const { threshold, blockingFindings, advisoryFindings, acDropped } = classification;
+  const { diffFiles, diffAvailable } = await resolveDiffFileSet(diff, workdir, projectDir, effectiveRef, naxIgnoreIndex, _adversarialDeps.collectDiffFileList);
   const { adversarialDropAnalysis, adversarialAcceptAnalysis } = buildCounterfactualTelemetry({
     acDropped,
     blockingFindings,
@@ -49852,177 +50171,28 @@ async function runAdversarialReview(opts) {
     });
   }
   const durationMs = Date.now() - startTime;
+  const telemetry = { adversarialDropAnalysis, adversarialAcceptAnalysis };
   if (blockingFindings.length > 0) {
-    logger?.warn("review", `Adversarial review failed: ${blockingFindings.length} blocking findings`, {
-      storyId: story.id,
-      durationMs,
-      findings: blockingFindings.map((f) => ({
-        severity: f.severity,
-        category: f.category,
-        file: f.file,
-        line: f.line,
-        issue: f.issue
-      }))
-    });
-    recordAdversarialAudit({
-      runtime,
-      workdir,
-      projectDir,
-      storyId: story.id,
-      featureName,
-      parsed: true,
-      failOpen: false,
-      passed: false,
-      blockingThreshold: threshold,
-      result: {
-        passed: false,
-        findings: llmFindingsToReviewFindings(allFindings, { source: "adversarial-review", isTestFile: testFileMatch })
-      },
-      advisoryFindings: advisoryFindings.length > 0 ? advisoryReviewFindings : undefined,
-      diffAvailable,
-      adversarialDropAnalysis,
-      adversarialAcceptAnalysis,
-      acks
-    });
-    const output = blockingFindings.length > 0 ? `Adversarial review failed:
-
-${formatFindings(blockingFindings)}` : "Adversarial review failed (no findings)";
-    return {
-      check: "adversarial",
-      success: false,
-      command: "",
-      exitCode: 1,
-      output,
-      durationMs,
-      findings: blockingFindings.length > 0 ? toAdversarialReviewFindings(blockingFindings, { isTestFile: testFileMatch }) : undefined,
-      advisoryFindings: advisoryFindings.length > 0 ? advisoryFindingsAsFindings : undefined,
-      cost: llmCost
-    };
+    return buildBlockingFailureResult(outcomeCtx, classification, telemetry, diffAvailable, durationMs);
   }
   if (!opResult.modelPassed && acDropped.length > 0) {
     if (acDropped.every((d) => d.code === "ac_quote_not_substring")) {
-      const demotedFindings = toAdversarialReviewFindings(acDropped.map((d) => ({ ...d.finding, severity: "warning", acQuote: undefined, acIndex: undefined })), { isTestFile: testFileMatch });
-      const allAdvisory = [...advisoryFindingsAsFindings, ...demotedFindings];
-      logger?.warn("review", "Adversarial review passed: all blocking findings discarded as hallucinated AC quotes", {
-        storyId: story.id,
-        durationMs,
-        droppedCount: acDropped.length,
-        drops: acDropped.map((d) => ({ file: d.finding.file, issue: d.finding.issue }))
-      });
-      recordAdversarialAudit({
-        runtime,
-        workdir,
-        projectDir,
-        storyId: story.id,
-        featureName,
-        parsed: true,
-        acks,
-        failOpen: false,
-        passed: true,
-        passReason: "ac_quote_not_substring_demoted",
-        blockingThreshold: threshold,
-        result: { passed: true, findings: [] },
-        advisoryFindings: allAdvisory.length > 0 ? allAdvisory : undefined,
-        diffAvailable,
-        adversarialDropAnalysis,
-        adversarialAcceptAnalysis: []
-      });
-      return {
-        check: "adversarial",
-        success: true,
-        passReason: "ac_quote_not_substring_demoted",
-        command: "",
-        exitCode: 0,
-        output: `Adversarial review passed: ${acDropped.length} blocking finding(s) demoted to advisory \u2014 all cited AC quotes were fabricated and could not be validated.`,
-        durationMs,
-        advisoryFindings: allAdvisory.length > 0 ? allAdvisory : undefined,
-        cost: llmCost
-      };
+      return buildHallucinatedAcQuoteResult(outcomeCtx, classification, telemetry, diffAvailable, durationMs);
     }
-    logger?.warn("review", "Adversarial review fail-closed: blocking findings dropped as ungrounded", {
-      storyId: story.id,
-      durationMs,
-      droppedCount: acDropped.length,
-      dropCodes: acDropped.map((d) => d.code)
-    });
-    const dropSummary = acDropped.map((d, i) => `${i + 1}. [${d.code}] ${d.finding.file ?? "<unknown>"}: ${d.finding.issue}`).join(`
-`);
-    recordAdversarialAudit({
-      runtime,
-      workdir,
-      projectDir,
-      storyId: story.id,
-      featureName,
-      parsed: true,
-      acks,
-      failOpen: false,
-      passed: false,
-      blockingThreshold: threshold,
-      result: { passed: false, findings: [] },
-      advisoryFindings: advisoryFindings.length > 0 ? advisoryReviewFindings : undefined,
-      diffAvailable,
-      adversarialDropAnalysis,
-      adversarialAcceptAnalysis: []
-    });
-    return {
-      check: "adversarial",
-      success: false,
-      command: "",
-      exitCode: 1,
-      output: `Adversarial review failed: ${acDropped.length} blocking finding(s) dropped as ungrounded \u2014 the model emitted "passed: false" with concerns it could not ground in any acceptance criterion. Drops:
-
-${dropSummary}`,
-      durationMs,
-      advisoryFindings: advisoryFindings.length > 0 ? advisoryFindingsAsFindings : undefined,
-      cost: llmCost
-    };
+    return buildUngroundedFailClosedResult(outcomeCtx, classification, telemetry, diffAvailable, durationMs);
   }
-  logger?.info("review", "Adversarial review passed", { storyId: story.id, durationMs });
-  recordAdversarialAudit({
-    runtime,
-    workdir,
-    projectDir,
-    storyId: story.id,
-    featureName,
-    parsed: true,
-    acks,
-    failOpen: false,
-    passed: true,
-    blockingThreshold: threshold,
-    result: {
-      passed: true,
-      findings: llmFindingsToReviewFindings(allFindings, { source: "adversarial-review", isTestFile: testFileMatch })
-    },
-    advisoryFindings: advisoryFindings.length > 0 ? advisoryReviewFindings : undefined,
-    diffAvailable,
-    adversarialDropAnalysis,
-    adversarialAcceptAnalysis: []
-  });
-  return {
-    check: "adversarial",
-    success: true,
-    command: "",
-    exitCode: 0,
-    output: allFindings.length === 0 ? "Adversarial review passed" : "Adversarial review passed (all findings were advisory \u2014 below blocking threshold)",
-    durationMs,
-    advisoryFindings: advisoryFindings.length > 0 ? advisoryFindingsAsFindings : undefined,
-    cost: llmCost
-  };
+  return buildPassedResult(outcomeCtx, classification, telemetry, diffAvailable, durationMs);
 }
 var _adversarialDeps;
 var init_adversarial = __esm(() => {
-  init_context();
   init_errors();
   init_logger2();
   init_adversarial_review();
   init_call();
-  init_diff_files();
   init_adversarial_counterfactual_telemetry();
-  init_adversarial_helpers();
+  init_adversarial_outcomes();
   init_diff_utils();
-  init_finding_projection();
   init_prepare_inputs();
-  init_recurrence_demotion();
   init_review_audit();
   _adversarialDeps = {
     writeReviewAudit,
@@ -50664,7 +50834,37 @@ var init_semantic_debate = __esm(() => {
   init_semantic_helpers();
 });
 
-// src/review/semantic.ts
+// src/review/semantic-outcomes.ts
+function skipResult2(output, startTime) {
+  return {
+    check: "semantic",
+    success: true,
+    command: "",
+    exitCode: 0,
+    output,
+    durationMs: Date.now() - startTime
+  };
+}
+function buildFeatureCtxBlock2(contextBundle, featureContextMarkdown) {
+  if (contextBundle) {
+    const md = contextBundle.pushMarkdown.trim();
+    return md ? `${md}
+
+---
+
+` : "";
+  }
+  if (featureContextMarkdown) {
+    const filtered = filterContextByRole(featureContextMarkdown, "reviewer-semantic");
+    if (filtered.trim())
+      return `${filtered}
+
+---
+
+`;
+  }
+  return "";
+}
 function recordSemanticAudit(opts) {
   opts.runtime?.dispatchEvents.emitReviewDecision({
     kind: "review-decision",
@@ -50684,6 +50884,216 @@ function recordSemanticAudit(opts) {
     acks: opts.acks
   });
 }
+function catchDispatchFailure2(err, ctx) {
+  const { runtime, workdir, projectDir, storyId, featureName, blockingThreshold, startTime, logger } = ctx;
+  logger?.warn("semantic", "LLM call failed \u2014 fail-open", { storyId, cause: String(err) });
+  recordSemanticAudit({
+    runtime,
+    workdir,
+    projectDir,
+    storyId,
+    featureName,
+    parsed: false,
+    looksLikeFail: false,
+    failOpen: true,
+    passed: true,
+    blockingThreshold,
+    result: null
+  });
+  return {
+    check: "semantic",
+    success: true,
+    failOpen: true,
+    command: "",
+    exitCode: 0,
+    output: `skipped: LLM call failed \u2014 ${String(err)}`,
+    durationMs: Date.now() - startTime
+  };
+}
+function handleRetryExhaustedFailOpen2(ctx) {
+  const { runtime, workdir, projectDir, storyId, featureName, blockingThreshold, startTime, logger } = ctx;
+  logger?.warn("semantic", "Retry exhausted \u2014 fail-open", { storyId });
+  recordSemanticAudit({
+    runtime,
+    workdir,
+    projectDir,
+    storyId,
+    featureName,
+    parsed: false,
+    looksLikeFail: false,
+    failOpen: true,
+    passed: true,
+    blockingThreshold,
+    result: null
+  });
+  return {
+    check: "semantic",
+    success: true,
+    failOpen: true,
+    command: "",
+    exitCode: 0,
+    output: "semantic review: could not parse LLM response (fail-open)",
+    durationMs: Date.now() - startTime
+  };
+}
+function handleTruncatedLooksLikeFail2(ctx) {
+  const { runtime, workdir, projectDir, storyId, featureName, blockingThreshold, startTime, logger } = ctx;
+  logger?.warn("semantic", "LLM returned truncated JSON with passed:false \u2014 treating as failure", { storyId });
+  recordSemanticAudit({
+    runtime,
+    workdir,
+    projectDir,
+    storyId,
+    featureName,
+    parsed: false,
+    looksLikeFail: true,
+    failOpen: false,
+    passed: false,
+    blockingThreshold,
+    result: null
+  });
+  return {
+    check: "semantic",
+    success: false,
+    command: "",
+    exitCode: 1,
+    output: "semantic review: LLM response truncated but indicated failure (passed:false found in partial response)",
+    durationMs: Date.now() - startTime
+  };
+}
+function classifySemanticFindings(opResult, blockingThreshold) {
+  const threshold = blockingThreshold ?? "error";
+  const allFindings = opResult.findings;
+  const blockingFindings = allFindings.filter((f) => isBlockingSeverity(f.severity, threshold));
+  const advisoryFindings = allFindings.filter((f) => !isBlockingSeverity(f.severity, threshold));
+  return {
+    threshold,
+    allFindings,
+    acks: opResult.acks,
+    blockingFindings,
+    advisoryFindings
+  };
+}
+function buildBlockingFailureResult2(ctx, classification, durationMs) {
+  const { runtime, workdir, projectDir, storyId, featureName, logger, testFileMatch } = ctx;
+  const { threshold, allFindings, acks, blockingFindings, advisoryFindings } = classification;
+  logger?.warn("review", `Semantic review failed: ${blockingFindings.length} blocking findings`, {
+    storyId,
+    durationMs
+  });
+  logger?.debug("review", "Semantic review findings", {
+    storyId,
+    findings: blockingFindings.map((f) => ({
+      severity: f.severity,
+      file: f.file,
+      line: f.line,
+      issue: f.issue,
+      suggestion: f.suggestion
+    }))
+  });
+  const output = `Semantic review failed:
+
+${formatFindings2(blockingFindings)}`;
+  recordSemanticAudit({
+    runtime,
+    workdir,
+    projectDir,
+    storyId,
+    featureName,
+    parsed: true,
+    failOpen: false,
+    passed: false,
+    blockingThreshold: threshold,
+    acks,
+    result: {
+      passed: false,
+      findings: llmFindingsToReviewFindings(allFindings, { source: "semantic-review", isTestFile: testFileMatch })
+    },
+    advisoryFindings: advisoryFindings.length > 0 ? llmFindingsToReviewFindings(advisoryFindings, { source: "semantic-review", isTestFile: testFileMatch }) : undefined
+  });
+  return {
+    check: "semantic",
+    success: false,
+    command: "",
+    exitCode: 1,
+    output,
+    durationMs,
+    findings: toReviewFindings(blockingFindings, { isTestFile: testFileMatch }),
+    advisoryFindings: advisoryFindings.length > 0 ? toReviewFindings(advisoryFindings, { isTestFile: testFileMatch }) : undefined,
+    cost: 0
+  };
+}
+function buildAcIndexDroppedFailClosedResult(ctx, classification, durationMs) {
+  const { runtime, workdir, projectDir, storyId, featureName, logger, testFileMatch } = ctx;
+  const { threshold, acks, advisoryFindings } = classification;
+  logger?.warn("review", "Semantic review fail-closed: blocking findings dropped (acIndex invalid)", {
+    storyId,
+    durationMs
+  });
+  recordSemanticAudit({
+    runtime,
+    workdir,
+    projectDir,
+    storyId,
+    featureName,
+    parsed: true,
+    acks,
+    failOpen: false,
+    passed: false,
+    blockingThreshold: threshold,
+    result: { passed: false, findings: [] },
+    advisoryFindings: advisoryFindings.length > 0 ? llmFindingsToReviewFindings(advisoryFindings, { source: "semantic-review", isTestFile: testFileMatch }) : undefined
+  });
+  return {
+    check: "semantic",
+    success: false,
+    command: "",
+    exitCode: 1,
+    output: 'Semantic review failed: blocking finding(s) were dropped \u2014 acIndex was missing or out of range. The model emitted "passed: false" without valid AC attribution.',
+    durationMs,
+    advisoryFindings: advisoryFindings.length > 0 ? toReviewFindings(advisoryFindings, { isTestFile: testFileMatch }) : undefined,
+    cost: 0
+  };
+}
+function buildPassedResult2(ctx, classification, durationMs) {
+  const { runtime, workdir, projectDir, storyId, featureName, logger, testFileMatch } = ctx;
+  const { threshold, allFindings, acks, advisoryFindings } = classification;
+  logger?.info("review", "Semantic review passed", { storyId, durationMs });
+  recordSemanticAudit({
+    runtime,
+    workdir,
+    projectDir,
+    storyId,
+    featureName,
+    parsed: true,
+    acks,
+    failOpen: false,
+    passed: true,
+    blockingThreshold: threshold,
+    result: {
+      passed: true,
+      findings: llmFindingsToReviewFindings(allFindings, { source: "semantic-review", isTestFile: testFileMatch })
+    },
+    advisoryFindings: advisoryFindings.length > 0 ? llmFindingsToReviewFindings(advisoryFindings, { source: "semantic-review", isTestFile: testFileMatch }) : undefined
+  });
+  return {
+    check: "semantic",
+    success: true,
+    command: "",
+    exitCode: 0,
+    output: allFindings.length === 0 ? "Semantic review passed" : "Semantic review passed (all findings were advisory \u2014 below blocking threshold)",
+    durationMs,
+    advisoryFindings: advisoryFindings.length > 0 ? toReviewFindings(advisoryFindings, { isTestFile: testFileMatch }) : undefined,
+    cost: 0
+  };
+}
+var init_semantic_outcomes = __esm(() => {
+  init_context();
+  init_finding_projection();
+  init_semantic_helpers();
+});
+
+// src/review/semantic.ts
 async function runSemanticReview(opts) {
   const {
     workdir,
@@ -50721,14 +51131,7 @@ async function runSemanticReview(opts) {
     semanticConfig
   });
   if (prepared.skipReason === "no git ref") {
-    return {
-      check: "semantic",
-      success: true,
-      command: "",
-      exitCode: 0,
-      output: "skipped: no git ref",
-      durationMs: Date.now() - startTime
-    };
+    return skipResult2("skipped: no git ref", startTime);
   }
   const diffMode = semanticConfig.diffMode ?? "ref";
   logger?.info("review", "Running semantic check", {
@@ -50738,24 +51141,10 @@ async function runSemanticReview(opts) {
     configProvided: !!naxConfig
   });
   if (prepared.skipReason === "no changes detected") {
-    return {
-      check: "semantic",
-      success: true,
-      command: "",
-      exitCode: 0,
-      output: "skipped: no changes detected",
-      durationMs: Date.now() - startTime
-    };
+    return skipResult2("skipped: no changes detected", startTime);
   }
   if (prepared.skipReason === "no production code changes") {
-    return {
-      check: "semantic",
-      success: true,
-      command: "",
-      exitCode: 0,
-      output: "skipped: no production code changes",
-      durationMs: Date.now() - startTime
-    };
+    return skipResult2("skipped: no production code changes", startTime);
   }
   const effectiveRef = prepared.effectiveRef;
   const stat4 = prepared.stat;
@@ -50767,33 +51156,9 @@ async function runSemanticReview(opts) {
       storyId: story.id,
       model: semanticConfig.model
     });
-    return {
-      check: "semantic",
-      success: true,
-      command: "",
-      exitCode: 0,
-      output: "skipped: no agent available for model tier",
-      durationMs: Date.now() - startTime
-    };
-  }
-  let featureCtxBlock = "";
-  if (contextBundle) {
-    const md = contextBundle.pushMarkdown.trim();
-    if (md)
-      featureCtxBlock = `${md}
-
----
-
-`;
-  } else if (featureContextMarkdown) {
-    const filtered = filterContextByRole(featureContextMarkdown, "reviewer-semantic");
-    if (filtered.trim())
-      featureCtxBlock = `${filtered}
-
----
-
-`;
+    return skipResult2("skipped: no agent available for model tier", startTime);
   }
+  const featureCtxBlock = buildFeatureCtxBlock2(contextBundle, featureContextMarkdown);
   const basePrompt = new ReviewPromptBuilder().buildSemanticReviewPrompt(story, semanticConfig, {
     mode: diffMode,
     diff,
@@ -50845,7 +51210,17 @@ async function runSemanticReview(opts) {
   if (!runtime) {
     throw new NaxError("runtime required \u2014 legacy agentManager.run path removed (ADR-019 Wave 3, issue #762)", "DISPATCH_NO_RUNTIME", { stage: "review-semantic", storyId: story.id });
   }
-  const llmCost = 0;
+  const outcomeCtx = {
+    runtime,
+    workdir,
+    projectDir,
+    storyId: story.id,
+    featureName,
+    blockingThreshold,
+    startTime,
+    logger,
+    testFileMatch
+  };
   const callCtx = {
     runtime,
     packageView: runtime.packages.resolve(workdir),
@@ -50872,81 +51247,12 @@ async function runSemanticReview(opts) {
       blockingThreshold
     });
   } catch (err) {
-    logger?.warn("semantic", "LLM call failed \u2014 fail-open", { storyId: story.id, cause: String(err) });
-    recordSemanticAudit({
-      runtime,
-      workdir,
-      projectDir,
-      storyId: story.id,
-      featureName,
-      parsed: false,
-      looksLikeFail: false,
-      failOpen: true,
-      passed: true,
-      blockingThreshold,
-      result: null
-    });
-    return {
-      check: "semantic",
-      success: true,
-      failOpen: true,
-      command: "",
-      exitCode: 0,
-      output: `skipped: LLM call failed \u2014 ${String(err)}`,
-      durationMs: Date.now() - startTime
-    };
-  }
-  if (opResult.failOpen) {
-    logger?.warn("semantic", "Retry exhausted \u2014 fail-open", { storyId: story.id });
-    recordSemanticAudit({
-      runtime,
-      workdir,
-      projectDir,
-      storyId: story.id,
-      featureName,
-      parsed: false,
-      looksLikeFail: false,
-      failOpen: true,
-      passed: true,
-      blockingThreshold,
-      result: null
-    });
-    return {
-      check: "semantic",
-      success: true,
-      failOpen: true,
-      command: "",
-      exitCode: 0,
-      output: "semantic review: could not parse LLM response (fail-open)",
-      durationMs: Date.now() - startTime
-    };
-  }
-  if (opResult.looksLikeFail) {
-    logger?.warn("semantic", "LLM returned truncated JSON with passed:false \u2014 treating as failure", {
-      storyId: story.id
-    });
-    recordSemanticAudit({
-      runtime,
-      workdir,
-      projectDir,
-      storyId: story.id,
-      featureName,
-      parsed: false,
-      looksLikeFail: true,
-      failOpen: false,
-      passed: false,
-      blockingThreshold,
-      result: null
-    });
-    return {
-      check: "semantic",
-      success: false,
-      command: "",
-      exitCode: 1,
-      output: "semantic review: LLM response truncated but indicated failure (passed:false found in partial response)",
-      durationMs: Date.now() - startTime
-    };
+    return catchDispatchFailure2(err, outcomeCtx);
   }
+  if (opResult.failOpen)
+    return handleRetryExhaustedFailOpen2(outcomeCtx);
+  if (opResult.looksLikeFail)
+    return handleTruncatedLooksLikeFail2(outcomeCtx);
   if (opResult.repromptEvent) {
     runtime.dispatchEvents.emitReviewReprompt({
       kind: "review-reprompt-on-drop",
@@ -50957,138 +51263,35 @@ async function runSemanticReview(opts) {
       costUsd: opResult.repromptEvent.costUsd
     });
   }
-  const threshold = blockingThreshold ?? "error";
-  const allFindings = opResult.findings;
-  const acks = opResult.acks;
-  const blockingFindings = allFindings.filter((f) => isBlockingSeverity(f.severity, threshold));
-  const advisoryFindings = allFindings.filter((f) => !isBlockingSeverity(f.severity, threshold));
+  const classification = classifySemanticFindings(opResult, blockingThreshold);
+  const { allFindings, blockingFindings, advisoryFindings } = classification;
   if (advisoryFindings.length > 0) {
-    logger?.debug("review", `Semantic review: ${advisoryFindings.length} advisory findings (below threshold '${threshold}')`, {
+    logger?.debug("review", `Semantic review: ${advisoryFindings.length} advisory findings (below threshold '${classification.threshold}')`, {
       storyId: story.id,
       findings: advisoryFindings.map((f) => ({ severity: f.severity, file: f.file, issue: f.issue }))
     });
   }
   const durationMs = Date.now() - startTime;
   if (blockingFindings.length > 0) {
-    logger?.warn("review", `Semantic review failed: ${blockingFindings.length} blocking findings`, {
-      storyId: story.id,
-      durationMs
-    });
-    logger?.debug("review", "Semantic review findings", {
-      storyId: story.id,
-      findings: blockingFindings.map((f) => ({
-        severity: f.severity,
-        file: f.file,
-        line: f.line,
-        issue: f.issue,
-        suggestion: f.suggestion
-      }))
-    });
-    const output = `Semantic review failed:
-
-${formatFindings2(blockingFindings)}`;
-    recordSemanticAudit({
-      runtime,
-      workdir,
-      projectDir,
-      storyId: story.id,
-      featureName,
-      parsed: true,
-      failOpen: false,
-      passed: false,
-      blockingThreshold: threshold,
-      acks,
-      result: {
-        passed: false,
-        findings: llmFindingsToReviewFindings(allFindings, { source: "semantic-review", isTestFile: testFileMatch })
-      },
-      advisoryFindings: advisoryFindings.length > 0 ? llmFindingsToReviewFindings(advisoryFindings, { source: "semantic-review", isTestFile: testFileMatch }) : undefined
-    });
-    return {
-      check: "semantic",
-      success: false,
-      command: "",
-      exitCode: 1,
-      output,
-      durationMs,
-      findings: toReviewFindings(blockingFindings, { isTestFile: testFileMatch }),
-      advisoryFindings: advisoryFindings.length > 0 ? toReviewFindings(advisoryFindings, { isTestFile: testFileMatch }) : undefined,
-      cost: llmCost
-    };
+    return buildBlockingFailureResult2(outcomeCtx, classification, durationMs);
   }
   if (!opResult.passed && allFindings.length === 0) {
-    logger?.warn("review", "Semantic review fail-closed: blocking findings dropped (acIndex invalid)", {
-      storyId: story.id,
-      durationMs
-    });
-    recordSemanticAudit({
-      runtime,
-      workdir,
-      projectDir,
-      storyId: story.id,
-      featureName,
-      parsed: true,
-      acks,
-      failOpen: false,
-      passed: false,
-      blockingThreshold: threshold,
-      result: { passed: false, findings: [] },
-      advisoryFindings: advisoryFindings.length > 0 ? llmFindingsToReviewFindings(advisoryFindings, { source: "semantic-review", isTestFile: testFileMatch }) : undefined
-    });
-    return {
-      check: "semantic",
-      success: false,
-      command: "",
-      exitCode: 1,
-      output: 'Semantic review failed: blocking finding(s) were dropped \u2014 acIndex was missing or out of range. The model emitted "passed: false" without valid AC attribution.',
-      durationMs,
-      advisoryFindings: advisoryFindings.length > 0 ? toReviewFindings(advisoryFindings, { isTestFile: testFileMatch }) : undefined,
-      cost: llmCost
-    };
+    return buildAcIndexDroppedFailClosedResult(outcomeCtx, classification, durationMs);
   }
-  logger?.info("review", "Semantic review passed", { storyId: story.id, durationMs });
-  recordSemanticAudit({
-    runtime,
-    workdir,
-    projectDir,
-    storyId: story.id,
-    featureName,
-    parsed: true,
-    acks,
-    failOpen: false,
-    passed: true,
-    blockingThreshold: threshold,
-    result: {
-      passed: true,
-      findings: llmFindingsToReviewFindings(allFindings, { source: "semantic-review", isTestFile: testFileMatch })
-    },
-    advisoryFindings: advisoryFindings.length > 0 ? llmFindingsToReviewFindings(advisoryFindings, { source: "semantic-review", isTestFile: testFileMatch }) : undefined
-  });
-  return {
-    check: "semantic",
-    success: true,
-    command: "",
-    exitCode: 0,
-    output: allFindings.length === 0 ? "Semantic review passed" : "Semantic review passed (all findings were advisory \u2014 below blocking threshold)",
-    durationMs,
-    advisoryFindings: advisoryFindings.length > 0 ? toReviewFindings(advisoryFindings, { isTestFile: testFileMatch }) : undefined,
-    cost: llmCost
-  };
+  return buildPassedResult2(outcomeCtx, classification, durationMs);
 }
 var _semanticDeps;
 var init_semantic = __esm(() => {
-  init_context();
   init_debate();
   init_errors();
   init_logger2();
   init_call();
   init_semantic_review();
   init_prompts();
-  init_finding_projection();
   init_prepare_inputs();
   init_review_audit();
   init_semantic_debate();
-  init_semantic_helpers();
+  init_semantic_outcomes();
   _semanticDeps = {
     createDebateRunner: (opts) => new DebateRunner(opts),
     writeReviewAudit,
@@ -51181,68 +51384,155 @@ async function getUncommittedFilesImpl(workdir) {
     return [];
   }
 }
-async function runReview(opts) {
+async function guardUncommittedFiles(workdir, storyId, runtime, naxIgnoreIndex, logger) {
+  await autoCommitIfDirty(workdir, "review", "agent", storyId ?? "review", runtime?.dirtyWorktrees);
+  const allUncommittedFiles = await _reviewGitDeps.getUncommittedFiles(workdir);
+  const afterRuntimeFilter = allUncommittedFiles.filter((f) => !NAX_RUNTIME_PATTERNS.some((pattern) => pattern.test(f)));
+  const uncommittedFiles = naxIgnoreIndex ? naxIgnoreIndex.filter(afterRuntimeFilter, workdir) : afterRuntimeFilter;
+  if (uncommittedFiles.length > 0) {
+    const fileList = uncommittedFiles.join(", ");
+    logger?.warn("review", `Uncommitted changes detected before review (proceeding): ${fileList}`, {
+      storyId,
+      uncommittedCount: uncommittedFiles.length
+    });
+  }
+}
+function buildReviewStory(storyId, story) {
+  return {
+    id: storyId ?? "",
+    title: story?.title ?? "",
+    description: story?.description ?? "",
+    acceptanceCriteria: story?.acceptanceCriteria ?? []
+  };
+}
+async function runSemanticCheck(opts) {
   const {
-    config: config2,
     workdir,
-    executionConfig,
-    qualityCommands,
+    storyGitRef,
+    story,
     storyId,
+    config: config2,
+    agentManager,
+    naxConfig,
+    featureName,
+    priorSemanticIterations,
+    featureContextMarkdown,
+    contextBundles,
+    projectDir,
+    naxIgnoreIndex,
+    runtime
+  } = opts;
+  const semanticCfg = config2.semantic ?? {
+    model: "balanced",
+    diffMode: "ref",
+    resetRefOnRerun: false,
+    rules: [],
+    timeoutMs: 600000
+  };
+  const runSemantic = _reviewSemanticDeps.runSemanticReview;
+  return runSemantic({
+    workdir,
+    storyGitRef,
+    story: buildReviewStory(storyId, story),
+    semanticConfig: semanticCfg,
+    agentManager,
+    naxConfig,
+    featureName,
+    priorSemanticIterations,
+    blockingThreshold: config2.blockingThreshold,
+    featureContextMarkdown,
+    contextBundle: contextBundles?.semantic,
+    projectDir,
+    naxIgnoreIndex,
+    runtime
+  });
+}
+async function runAdversarialCheck(opts) {
+  const {
+    workdir,
     storyGitRef,
     story,
+    storyId,
+    config: config2,
     agentManager,
     naxConfig,
-    retrySkipChecks,
     featureName,
     priorFailures,
-    priorSemanticIterations,
     featureContextMarkdown,
     contextBundles,
     projectDir,
-    env: env2,
     naxIgnoreIndex,
     runtime,
     priorAdversarialIterations
   } = opts;
+  const adversarialCfg = config2.adversarial ?? {
+    model: "balanced",
+    diffMode: "ref",
+    rules: [],
+    timeoutMs: 600000,
+    parallel: false,
+    maxConcurrentSessions: 2
+  };
+  const runAdversarial = _reviewAdversarialDeps.runAdversarialReview;
+  return runAdversarial({
+    workdir,
+    storyGitRef,
+    story: buildReviewStory(storyId, story),
+    adversarialConfig: adversarialCfg,
+    agentManager,
+    config: naxConfig,
+    featureName,
+    priorFailures,
+    blockingThreshold: config2.blockingThreshold,
+    featureContextMarkdown,
+    contextBundle: contextBundles?.adversarial,
+    projectDir,
+    naxIgnoreIndex,
+    runtime,
+    priorAdversarialIterations
+  });
+}
+async function runMechanicalCheck(checkName, opts) {
+  const {
+    config: config2,
+    workdir,
+    executionConfig,
+    qualityCommands,
+    storyId,
+    story,
+    storyGitRef,
+    naxConfig,
+    projectDir,
+    env: env2,
+    naxIgnoreIndex
+  } = opts;
+  const command = await resolveCommand(checkName, config2, executionConfig, workdir, qualityCommands);
+  if (command === null) {
+    getSafeLogger()?.warn("review", `Skipping ${checkName} check (command not configured or disabled)`);
+    return null;
+  }
+  return checkName === "lint" ? await _reviewLintDeps.runScopedLintCheck({
+    resolvedLintCommand: command,
+    configCommands: config2.commands,
+    qualityCommands,
+    lintOutputFormat: naxConfig?.quality?.lintOutput?.format ?? "auto",
+    workdir,
+    projectDir,
+    storyId,
+    story,
+    storyGitRef,
+    env: env2,
+    stripEnvVars: naxConfig?.quality?.stripEnvVars ?? [],
+    naxIgnoreIndex
+  }) : normalizeMechanicalFindings(checkName, await runCheck(checkName, command, workdir, storyId, env2, naxConfig?.quality?.stripEnvVars ?? []), workdir);
+}
+async function runReview(opts) {
+  const { config: config2, workdir, storyId, retrySkipChecks, naxIgnoreIndex, runtime } = opts;
   const startTime = Date.now();
   const logger = getSafeLogger();
   const checks3 = [];
   let firstFailure;
-  await autoCommitIfDirty(workdir, "review", "agent", storyId ?? "review", runtime?.dirtyWorktrees);
-  const allUncommittedFiles = await _reviewGitDeps.getUncommittedFiles(workdir);
-  const NAX_RUNTIME_PATTERNS = [
-    /nax\.lock$/,
-    /nax\/metrics\.json$/,
-    /nax\/status\.json$/,
-    /nax\/features\/[^/]+\/status\.json$/,
-    /nax\/features\/[^/]+\/prd\.json$/,
-    /nax\/features\/[^/]+\/runs\//,
-    /nax\/features\/[^/]+\/plan\//,
-    /nax\/features\/[^/]+\/acp-sessions\.json$/,
-    /nax\/features\/[^/]+\/interactions\//,
-    /nax\/features\/[^/]+\/progress\.txt$/,
-    /nax\/features\/[^/]+\/acceptance-refined\.json$/,
-    /nax\/features\/[^/]+\/stories\/[^/]+\/context-manifest-[^/]+\.json$/,
-    /nax\/features\/[^/]+\/stories\/[^/]+\/rebuild-manifest\.json$/,
-    /\.nax-verifier-verdict\.json$/,
-    /\.nax-pids$/,
-    /\.nax-wt\//,
-    /\.nax-acceptance[^/]*$/,
-    /_nax_acceptance_test\.py$/,
-    /_nax_suggested_test\.py$/,
-    /(?:^|\/)test\/.*\.jsonl$/,
-    /(?:^|\/)coverage\//,
-    /\.lcov$/
-  ];
-  const afterRuntimeFilter = allUncommittedFiles.filter((f) => !NAX_RUNTIME_PATTERNS.some((pattern) => pattern.test(f)));
-  const uncommittedFiles = naxIgnoreIndex ? naxIgnoreIndex.filter(afterRuntimeFilter, workdir) : afterRuntimeFilter;
-  if (uncommittedFiles.length > 0) {
-    const fileList = uncommittedFiles.join(", ");
-    logger?.warn("review", `Uncommitted changes detected before review (proceeding): ${fileList}`, {
-      storyId,
-      uncommittedCount: uncommittedFiles.length
-    });
-  }
+  await guardUncommittedFiles(workdir, storyId, runtime, naxIgnoreIndex, logger);
   for (const checkName of config2.checks) {
     if (retrySkipChecks?.has(checkName)) {
       getSafeLogger()?.debug("review", `Skipping ${checkName} check (already passed in previous review pass)`, {
@@ -51250,37 +51540,8 @@ async function runReview(opts) {
       });
       continue;
     }
-    if (checkName === "semantic") {
-      const semanticStory = {
-        id: storyId ?? "",
-        title: story?.title ?? "",
-        description: story?.description ?? "",
-        acceptanceCriteria: story?.acceptanceCriteria ?? []
-      };
-      const semanticCfg = config2.semantic ?? {
-        model: "balanced",
-        diffMode: "ref",
-        resetRefOnRerun: false,
-        rules: [],
-        timeoutMs: 600000
-      };
-      const runSemantic = _reviewSemanticDeps.runSemanticReview;
-      const result2 = await runSemantic({
-        workdir,
-        storyGitRef,
-        story: semanticStory,
-        semanticConfig: semanticCfg,
-        agentManager,
-        naxConfig,
-        featureName,
-        priorSemanticIterations,
-        blockingThreshold: config2.blockingThreshold,
-        featureContextMarkdown,
-        contextBundle: contextBundles?.semantic,
-        projectDir,
-        naxIgnoreIndex,
-        runtime
-      });
+    if (checkName === "semantic" || checkName === "adversarial") {
+      const result2 = checkName === "semantic" ? await runSemanticCheck(opts) : await runAdversarialCheck(opts);
       checks3.push(result2);
       if (!result2.success && !firstFailure) {
         firstFailure = `${checkName} failed`;
@@ -51290,67 +51551,9 @@ async function runReview(opts) {
       }
       continue;
     }
-    if (checkName === "adversarial") {
-      const adversarialStory = {
-        id: storyId ?? "",
-        title: story?.title ?? "",
-        description: story?.description ?? "",
-        acceptanceCriteria: story?.acceptanceCriteria ?? []
-      };
-      const adversarialCfg = config2.adversarial ?? {
-        model: "balanced",
-        diffMode: "ref",
-        rules: [],
-        timeoutMs: 600000,
-        parallel: false,
-        maxConcurrentSessions: 2
-      };
-      const runAdversarial = _reviewAdversarialDeps.runAdversarialReview;
-      const result2 = await runAdversarial({
-        workdir,
-        storyGitRef,
-        story: adversarialStory,
-        adversarialConfig: adversarialCfg,
-        agentManager,
-        config: naxConfig,
-        featureName,
-        priorFailures,
-        blockingThreshold: config2.blockingThreshold,
-        featureContextMarkdown,
-        contextBundle: contextBundles?.adversarial,
-        projectDir,
-        naxIgnoreIndex,
-        runtime,
-        priorAdversarialIterations
-      });
-      checks3.push(result2);
-      if (!result2.success && !firstFailure) {
-        firstFailure = `${checkName} failed`;
-      }
-      if (!result2.success) {
-        break;
-      }
-      continue;
-    }
-    const command = await resolveCommand(checkName, config2, executionConfig, workdir, qualityCommands);
-    if (command === null) {
-      getSafeLogger()?.warn("review", `Skipping ${checkName} check (command not configured or disabled)`);
+    const result = await runMechanicalCheck(checkName, opts);
+    if (result === null)
       continue;
-    }
-    const result = checkName === "lint" ? await _reviewLintDeps.runScopedLintCheck({
-      resolvedLintCommand: command,
-      configCommands: config2.commands,
-      qualityCommands,
-      lintOutputFormat: naxConfig?.quality?.lintOutput?.format ?? "auto",
-      workdir,
-      projectDir,
-      storyId,
-      story,
-      storyGitRef,
-      env: env2,
-      stripEnvVars: naxConfig?.quality?.stripEnvVars ?? [],
-      naxIgnoreIndex
-    }) : normalizeMechanicalFindings(checkName, await runCheck(checkName, command, workdir, storyId, env2, naxConfig?.quality?.stripEnvVars ?? []), workdir);
     checks3.push(result);
     if (result.success) {
       logger?.info("review", `${checkName} passed`, {
@@ -51379,7 +51582,7 @@ async function runReview(opts) {
     failureReason: firstFailure
   };
 }
-var _reviewSemanticDeps, _reviewAdversarialDeps, _reviewLintDeps, _reviewRunnerDeps, _reviewGitDeps;
+var _reviewSemanticDeps, _reviewAdversarialDeps, _reviewLintDeps, _reviewRunnerDeps, _reviewGitDeps, NAX_RUNTIME_PATTERNS;
 var init_runner2 = __esm(() => {
   init_logger2();
   init_quality();
@@ -51405,6 +51608,30 @@ var init_runner2 = __esm(() => {
   _reviewGitDeps = {
     getUncommittedFiles: getUncommittedFilesImpl
   };
+  NAX_RUNTIME_PATTERNS = [
+    /nax\.lock$/,
+    /nax\/metrics\.json$/,
+    /nax\/status\.json$/,
+    /nax\/features\/[^/]+\/status\.json$/,
+    /nax\/features\/[^/]+\/prd\.json$/,
+    /nax\/features\/[^/]+\/runs\//,
+    /nax\/features\/[^/]+\/plan\//,
+    /nax\/features\/[^/]+\/acp-sessions\.json$/,
+    /nax\/features\/[^/]+\/interactions\//,
+    /nax\/features\/[^/]+\/progress\.txt$/,
+    /nax\/features\/[^/]+\/acceptance-refined\.json$/,
+    /nax\/features\/[^/]+\/stories\/[^/]+\/context-manifest-[^/]+\.json$/,
+    /nax\/features\/[^/]+\/stories\/[^/]+\/rebuild-manifest\.json$/,
+    /\.nax-verifier-verdict\.json$/,
+    /\.nax-pids$/,
+    /\.nax-wt\//,
+    /\.nax-acceptance[^/]*$/,
+    /_nax_acceptance_test\.py$/,
+    /_nax_suggested_test\.py$/,
+    /(?:^|\/)test\/.*\.jsonl$/,
+    /(?:^|\/)coverage\//,
+    /\.lcov$/
+  ];
 });
 
 // src/review/index.ts
@@ -54284,18 +54511,18 @@ class PromptAuditor {
       }
       this._dirCreated = true;
     }
+    const safeEntry = redactSecrets(entry);
     try {
-      await _promptAuditorDeps.appendLine(this._jsonlPath, `${JSON.stringify(entry)}
+      await _promptAuditorDeps.appendLine(this._jsonlPath, `${JSON.stringify(safeEntry)}
 `);
     } catch (err) {
       throw tagAuditError(err, "jsonl");
     }
     if (!("prompt" in entry) || !("response" in entry))
       return;
-    const auditEntry = entry;
-    const filename = deriveTxtFilename(auditEntry);
+    const filename = deriveTxtFilename(entry);
     try {
-      await _promptAuditorDeps.write(join37(this._featureDir, filename), buildTxtContent(auditEntry));
+      await _promptAuditorDeps.write(join37(this._featureDir, filename), buildTxtContent(safeEntry));
     } catch (err) {
       throw tagAuditError(err, "txt");
     }
@@ -60089,7 +60316,7 @@ async function checkWorkingTreeClean(workdir) {
   const exitCode = await proc.exited;
   const lines = output.trim() === "" ? [] : output.split(`
 `).filter(Boolean);
-  const nonNaxDirtyFiles = lines.filter((line) => !NAX_RUNTIME_PATTERNS.some((pattern) => pattern.test(line)));
+  const nonNaxDirtyFiles = lines.filter((line) => !NAX_RUNTIME_PATTERNS2.some((pattern) => pattern.test(line)));
   const passed = exitCode === 0 && nonNaxDirtyFiles.length === 0;
   return {
     name: "working-tree-clean",
@@ -60120,9 +60347,9 @@ async function checkGitUserConfigured(workdir) {
     message: passed ? "Git user is configured" : !hasName && !hasEmail ? "Git user.name and user.email not configured" : !hasName ? "Git user.name not configured" : "Git user.email not configured"
   };
 }
-var NAX_RUNTIME_PATTERNS;
+var NAX_RUNTIME_PATTERNS2;
 var init_checks_git = __esm(() => {
-  NAX_RUNTIME_PATTERNS = [
+  NAX_RUNTIME_PATTERNS2 = [
     /^.{2} nax\.lock$/,
     /^.{2} \.nax\/$/,
     /^.{2} \.nax\/metrics\.json$/,
@@ -66527,7 +66754,7 @@ function assemblePlanInputs(story, config2, resolvedTestPatterns) {
 function hasReviewEscalation(story) {
   return (story.priorFailures ?? []).some((f) => f.stage === "review");
 }
-function buildFeatureCtxBlock(ctx, role) {
+function buildFeatureCtxBlock3(ctx, role) {
   const bundleMarkdown = ctx.contextBundle?.pushMarkdown.trim();
   if (bundleMarkdown) {
     return `${bundleMarkdown}
@@ -66628,7 +66855,7 @@ async function assemblePlanInputsFromCtx(ctx) {
       stat: prepared.stat,
       diff: prepared.diff,
       excludePatterns: prepared.excludePatterns,
-      featureCtxBlock: buildFeatureCtxBlock(ctx, "reviewer-semantic"),
+      featureCtxBlock: buildFeatureCtxBlock3(ctx, "reviewer-semantic"),
       resolvedTestPatterns,
       blockingThreshold: ctx.config.review.blockingThreshold,
       _refresh: {
@@ -66665,7 +66892,7 @@ async function assemblePlanInputsFromCtx(ctx) {
       excludePatterns: prepared.excludePatterns,
       testGlobs: prepared.testGlobs,
       refExcludePatterns: prepared.refExcludePatterns,
-      featureCtxBlock: buildFeatureCtxBlock(ctx, "reviewer-adversarial"),
+      featureCtxBlock: buildFeatureCtxBlock3(ctx, "reviewer-adversarial"),
       resolvedTestPatterns,
       blockingThreshold: ctx.config.review.blockingThreshold,
       _refresh: {
@@ -71426,7 +71653,6 @@ var init_types11 = __esm(() => {
 });
 
 // src/worktree/dependencies.ts
-import { existsSync as existsSync20 } from "fs";
 import { join as join66 } from "path";
 async function prepareWorktreeDependencies(options) {
   const mode = options.config.execution.worktreeDependencies.mode;
@@ -71434,8 +71660,6 @@ async function prepareWorktreeDependencies(options) {
   switch (mode) {
     case "off":
       return { cwd: resolvedCwd };
-    case "inherit":
-      return resolveInheritedDependencies(options, resolvedCwd);
     case "provision":
       return provisionDependencies(options.config, options.worktreeRoot, resolvedCwd);
   }
@@ -71443,20 +71667,10 @@ async function prepareWorktreeDependencies(options) {
 function resolveDependencyCwd(options) {
   return options.storyWorkdir ? join66(options.worktreeRoot, options.storyWorkdir) : options.worktreeRoot;
 }
-function resolveInheritedDependencies(options, resolvedCwd) {
-  if (hasDependencyManifests(options.worktreeRoot, resolvedCwd)) {
-    throw new WorktreeDependencyPreparationError(`[worktree-deps] inherit mode is unsupported for dependency-managed worktrees in phase 1. Use mode "provision" with execution.worktreeDependencies.setupCommand, or switch to "off".`, "inherit");
-  }
-  return { cwd: resolvedCwd };
-}
-function hasDependencyManifests(worktreeRoot, resolvedCwd) {
-  const directories = resolvedCwd === worktreeRoot ? [worktreeRoot] : [worktreeRoot, resolvedCwd];
-  return directories.some((directory) => PHASE_ONE_INHERIT_UNSUPPORTED_FILES.some((filename) => _worktreeDependencyDeps.existsSync(join66(directory, filename))));
-}
 async function provisionDependencies(config2, worktreeRoot, resolvedCwd) {
   const setupCommand = config2.execution.worktreeDependencies.setupCommand;
   if (!setupCommand) {
-    throw new WorktreeDependencyPreparationError("[worktree-deps] provision mode requires execution.worktreeDependencies.setupCommand in phase 1.", "provision");
+    throw new WorktreeDependencyPreparationError("[worktree-deps] provision mode requires execution.worktreeDependencies.setupCommand.", "provision");
   }
   const argv = parseCommandToArgv(setupCommand);
   if (argv.length === 0) {
@@ -71479,36 +71693,62 @@ async function provisionDependencies(config2, worktreeRoot, resolvedCwd) {
   }
   return { cwd: resolvedCwd };
 }
-var PHASE_ONE_INHERIT_UNSUPPORTED_FILES, _worktreeDependencyDeps;
+var _worktreeDependencyDeps;
 var init_dependencies = __esm(() => {
   init_bun_deps();
   init_command_argv();
   init_types11();
-  PHASE_ONE_INHERIT_UNSUPPORTED_FILES = [
-    "package.json",
-    "bun.lock",
-    "bun.lockb",
-    "package-lock.json",
-    "pnpm-lock.yaml",
-    "yarn.lock",
-    "requirements.txt",
-    "pyproject.toml",
-    "Cargo.toml",
-    "go.mod",
-    "Gemfile",
-    "composer.json",
-    "pom.xml",
-    "build.gradle",
-    "build.gradle.kts"
-  ];
   _worktreeDependencyDeps = {
-    existsSync: existsSync20,
     spawn
   };
 });
 
 // src/utils/gitignore.ts
-var NAX_GITIGNORE_ENTRIES;
+function activeIgnoreLines(content) {
+  return content.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
+}
+function hasOpinionOn(activeLines, entry) {
+  return activeLines.has(entry) || activeLines.has(`!${entry}`);
+}
+async function patchIgnoreFile(filePath, entries, options = {}) {
+  const { footer = "", sectionComment = "# nax - generated files" } = options;
+  const header = options.header ?? `${sectionComment}
+`;
+  const file3 = Bun.file(filePath);
+  const existing = await file3.exists() ? await file3.text() : "";
+  const isNew = existing.trim().length === 0;
+  const active = new Set(activeIgnoreLines(existing));
+  const missing = entries.filter((entry) => !hasOpinionOn(active, entry));
+  if (missing.length === 0)
+    return { created: false, added: [] };
+  if (isNew) {
+    await Bun.write(filePath, `${header}${missing.join(`
+`)}
+${footer}`);
+    return { created: true, added: [...missing] };
+  }
+  const separator = existing.endsWith(`
+`) ? "" : `
+`;
+  await Bun.write(filePath, `${existing}${separator}
+${sectionComment}
+${missing.join(`
+`)}
+`);
+  return { created: false, added: [...missing] };
+}
+var NAX_GITIGNORE_ENTRIES, NAX_NAXIGNORE_ENTRIES, NAX_NAXIGNORE_HEADER = `# nax - paths excluded from context, review
+# and verification scanning.
+# gitignore syntax. Also honoured per-package.
+
+`, NAX_NAXIGNORE_SUGGESTIONS = `
+# Uncomment what applies to this repo:
+# examples/
+# fixtures/
+# vendor/
+# *.generated.*
+`;
 var init_gitignore = __esm(() => {
   init_config();
   NAX_GITIGNORE_ENTRIES = [
@@ -71533,10 +71773,17 @@ var init_gitignore = __esm(() => {
     ".nax/finish-audit/",
     ".nax/mutation-journal/"
   ];
+  NAX_NAXIGNORE_ENTRIES = [
+    ".nax/",
+    "dist/",
+    "build/",
+    "coverage/",
+    "node_modules/"
+  ];
 });
 
 // src/worktree/manager.ts
-import { existsSync as existsSync21, symlinkSync } from "fs";
+import { existsSync as existsSync20, symlinkSync } from "fs";
 import { mkdir as mkdir12 } from "fs/promises";
 import { join as join67 } from "path";
 
@@ -71548,7 +71795,7 @@ class WorktreeManager {
     try {
       await mkdir12(infoDir, { recursive: true });
       let existing = "";
-      if (existsSync21(excludePath)) {
+      if (existsSync20(excludePath)) {
         existing = await Bun.file(excludePath).text();
       }
       const missing = NAX_GITIGNORE_ENTRIES.filter((entry) => !existing.includes(entry));
@@ -71635,7 +71882,7 @@ ${missing.join(`
       });
     }
     const envSource = join67(projectRoot, ".env");
-    if (existsSync21(envSource)) {
+    if (existsSync20(envSource)) {
       const envTarget = join67(worktreePath, ".env");
       try {
         symlinkSync(envSource, envTarget, "file");
@@ -72575,7 +72822,7 @@ var init_pipeline_result_handler = __esm(() => {
 });
 
 // src/execution/iteration-runner.ts
-import { existsSync as existsSync22 } from "fs";
+import { existsSync as existsSync21 } from "fs";
 import { join as join70 } from "path";
 function releaseHeavyPipelineContext(ctx) {
   ctx.agentResult = undefined;
@@ -72792,7 +73039,7 @@ var init_iteration_runner = __esm(() => {
     loadConfigForWorkdir,
     prepareWorktreeDependencies,
     runPipeline,
-    existsSync: existsSync22,
+    existsSync: existsSync21,
     worktreeManager: new WorktreeManager
   };
 });
@@ -75550,7 +75797,14 @@ async function defaultReadResult(resultPath) {
   const f = Bun.file(resultPath);
   if (!await f.exists())
     return null;
-  return JSON.parse(await f.text());
+  try {
+    return JSON.parse(await f.text());
+  } catch (err) {
+    getSafeLogger()?.warn("plugins", `nax-finish: malformed result file at ${resultPath}`, {
+      error: errorMessage(err)
+    });
+    return null;
+  }
 }
 async function defaultClearResult(resultPath) {
   const file3 = Bun.file(resultPath);
@@ -75741,6 +75995,7 @@ async function finalizeFinishOutcome(options) {
 }
 var PLUGIN_NAME4 = "nax-finish", PLUGIN_VERSION4 = "0.1.0", PACKAGE_ROOT_SEARCH_DEPTH = 6, _naxFinishDeps, naxFinishAction, naxFinishPlugin;
 var init_nax_finish = __esm(() => {
+  init_logger2();
   init_config2();
   init_telegram2();
   init_telegram2();
@@ -77353,12 +77608,19 @@ function resolveModulePath(modulePath, projectRoot) {
   }
   return path25.resolve(modulePath);
 }
-async function loadAndValidatePlugin(initialModulePath, config2, allowedRoots = [], originalPath) {
+async function loadAndValidatePlugin(initialModulePath, config2, allowedRoots, originalPath) {
   let attemptedPath = initialModulePath;
   try {
     let modulePath = initialModulePath;
     const isFilePath = modulePath.startsWith("/") || modulePath.startsWith("./") || modulePath.startsWith("../");
-    if (isFilePath && allowedRoots.length > 0) {
+    if (isFilePath) {
+      if (allowedRoots.length === 0) {
+        const msg = `no allowed roots configured for file-path plugin module '${initialModulePath}'`;
+        const logger = getSafeLogger6();
+        logger?.error("plugins", `Security: ${msg}`);
+        _pluginErrorSink(`[plugins] Security: ${msg}`);
+        return null;
+      }
       const validation = validateModulePath(modulePath, allowedRoots);
       if (!validation.valid) {
         const logger = getSafeLogger6();
@@ -77632,14 +77894,6 @@ var init_status_writer = __esm(() => {
 });
 
 // src/cli/init-context.ts
-var exports_init_context = {};
-__export(exports_init_context, {
-  scanProject: () => scanProject,
-  initPackage: () => initPackage,
-  initContext: () => initContext,
-  generatePackageContextTemplate: () => generatePackageContextTemplate,
-  generateContextTemplate: () => generateContextTemplate
-});
 import { basename as basename16, join as join78 } from "path";
 async function bunFileExists(path26) {
   return Bun.file(path26).exists();
@@ -77893,11 +78147,11 @@ var init_init_context = __esm(() => {
 });
 
 // src/cli/init-detect.ts
-import { existsSync as existsSync23, readFileSync } from "fs";
+import { existsSync as existsSync22, readFileSync } from "fs";
 import { join as join79 } from "path";
 function readPackageJson(projectRoot) {
   const pkgPath = join79(projectRoot, "package.json");
-  if (!existsSync23(pkgPath))
+  if (!existsSync22(pkgPath))
     return;
   try {
     return JSON.parse(readFileSync(pkgPath, "utf-8"));
@@ -77939,41 +78193,41 @@ function detectStack(projectRoot) {
   };
 }
 function detectRuntime(projectRoot) {
-  if (existsSync23(join79(projectRoot, "bun.lockb")) || existsSync23(join79(projectRoot, "bunfig.toml"))) {
+  if (existsSync22(join79(projectRoot, "bun.lockb")) || existsSync22(join79(projectRoot, "bunfig.toml"))) {
     return "bun";
   }
-  if (existsSync23(join79(projectRoot, "package-lock.json")) || existsSync23(join79(projectRoot, "yarn.lock")) || existsSync23(join79(projectRoot, "pnpm-lock.yaml"))) {
+  if (existsSync22(join79(projectRoot, "package-lock.json")) || existsSync22(join79(projectRoot, "yarn.lock")) || existsSync22(join79(projectRoot, "pnpm-lock.yaml"))) {
     return "node";
   }
   return "unknown";
 }
 function detectLanguage2(projectRoot) {
-  if (existsSync23(join79(projectRoot, "tsconfig.json")))
+  if (existsSync22(join79(projectRoot, "tsconfig.json")))
     return "typescript";
-  if (existsSync23(join79(projectRoot, "pyproject.toml")) || existsSync23(join79(projectRoot, "setup.py"))) {
+  if (existsSync22(join79(projectRoot, "pyproject.toml")) || existsSync22(join79(projectRoot, "setup.py"))) {
     return "python";
   }
-  if (existsSync23(join79(projectRoot, "Cargo.toml")))
+  if (existsSync22(join79(projectRoot, "Cargo.toml")))
     return "rust";
-  if (existsSync23(join79(projectRoot, "go.mod")))
+  if (existsSync22(join79(projectRoot, "go.mod")))
     return "go";
   return "unknown";
 }
 function detectLinter(projectRoot) {
-  if (existsSync23(join79(projectRoot, "biome.json")) || existsSync23(join79(projectRoot, "biome.jsonc"))) {
+  if (existsSync22(join79(projectRoot, "biome.json")) || existsSync22(join79(projectRoot, "biome.jsonc"))) {
     return "biome";
   }
-  if (existsSync23(join79(projectRoot, ".eslintrc.json")) || existsSync23(join79(projectRoot, ".eslintrc.js")) || existsSync23(join79(projectRoot, "eslint.config.js"))) {
+  if (existsSync22(join79(projectRoot, ".eslintrc.json")) || existsSync22(join79(projectRoot, ".eslintrc.js")) || existsSync22(join79(projectRoot, "eslint.config.js"))) {
     return "eslint";
   }
   return "unknown";
 }
 function detectMonorepo(projectRoot) {
-  if (existsSync23(join79(projectRoot, "turbo.json")))
+  if (existsSync22(join79(projectRoot, "turbo.json")))
     return "turborepo";
-  if (existsSync23(join79(projectRoot, "nx.json")))
+  if (existsSync22(join79(projectRoot, "nx.json")))
     return "nx";
-  if (existsSync23(join79(projectRoot, "pnpm-workspace.yaml")))
+  if (existsSync22(join79(projectRoot, "pnpm-workspace.yaml")))
     return "pnpm-workspaces";
   const pkg = readPackageJson(projectRoot);
   if (pkg?.workspaces)
@@ -78115,7 +78369,7 @@ __export(exports_init, {
   checkInitCollision: () => checkInitCollision,
   _initDeps: () => _initDeps
 });
-import { existsSync as existsSync24 } from "fs";
+import { existsSync as existsSync23 } from "fs";
 import { mkdir as mkdir15 } from "fs/promises";
 import { join as join80 } from "path";
 function validateProjectName(name) {
@@ -78154,24 +78408,32 @@ async function checkInitCollision(name, currentWorkdir, currentRemote) {
 async function updateGitignore(projectRoot) {
   const logger = getLogger();
   const gitignorePath = join80(projectRoot, ".gitignore");
-  let existing = "";
-  if (existsSync24(gitignorePath)) {
-    existing = await Bun.file(gitignorePath).text();
-  }
-  const missingEntries = NAX_GITIGNORE_ENTRIES.filter((entry) => !existing.includes(entry));
-  if (missingEntries.length === 0) {
+  const result = await patchIgnoreFile(gitignorePath, NAX_GITIGNORE_ENTRIES);
+  if (result.added.length === 0) {
     logger.info("init", ".gitignore already has nax entries", { path: gitignorePath });
     return;
   }
-  const naxSection = `
-# nax \u2014 generated files
-${missingEntries.join(`
-`)}
-`;
-  await Bun.write(gitignorePath, existing + naxSection);
   logger.info("init", "Updated .gitignore with nax entries", {
     path: gitignorePath,
-    added: missingEntries
+    created: result.created,
+    added: result.added
+  });
+}
+async function updateNaxignore(projectRoot) {
+  const logger = getLogger();
+  const naxignorePath = join80(projectRoot, ".naxignore");
+  const result = await patchIgnoreFile(naxignorePath, NAX_NAXIGNORE_ENTRIES, {
+    header: NAX_NAXIGNORE_HEADER,
+    footer: NAX_NAXIGNORE_SUGGESTIONS,
+    sectionComment: "# nax - scanning exclusions"
+  });
+  if (result.added.length === 0) {
+    logger.info("init", ".naxignore already has nax entries", { path: naxignorePath });
+    return;
+  }
+  logger.info("init", result.created ? "Created .naxignore" : "Updated .naxignore with nax entries", {
+    path: naxignorePath,
+    added: result.added
   });
 }
 function buildConstitution(stack) {
@@ -78235,12 +78497,12 @@ function buildConstitution(stack) {
 async function initGlobal() {
   const logger = getLogger();
   const globalDir = globalConfigDir();
-  if (!existsSync24(globalDir)) {
+  if (!existsSync23(globalDir)) {
     await mkdir15(globalDir, { recursive: true });
     logger.info("init", "Created global config directory", { path: globalDir });
   }
   const configPath = join80(globalDir, "config.json");
-  if (!existsSync24(configPath)) {
+  if (!existsSync23(configPath)) {
     await Bun.write(configPath, `${JSON.stringify(MINIMAL_GLOBAL_CONFIG, null, 2)}
 `);
     logger.info("init", "Created global config", { path: configPath });
@@ -78248,14 +78510,14 @@ async function initGlobal() {
     logger.info("init", "Global config already exists", { path: configPath });
   }
   const constitutionPath = join80(globalDir, "constitution.md");
-  if (!existsSync24(constitutionPath)) {
+  if (!existsSync23(constitutionPath)) {
     await Bun.write(constitutionPath, buildConstitution({ runtime: "unknown", language: "unknown", linter: "unknown", monorepo: "none" }));
     logger.info("init", "Created global constitution", { path: constitutionPath });
   } else {
     logger.info("init", "Global constitution already exists", { path: constitutionPath });
   }
   const hooksDir = join80(globalDir, "hooks");
-  if (!existsSync24(hooksDir)) {
+  if (!existsSync23(hooksDir)) {
     await mkdir15(hooksDir, { recursive: true });
     logger.info("init", "Created global hooks directory", { path: hooksDir });
   } else {
@@ -78300,7 +78562,7 @@ async function initProject(projectRoot, options) {
 `), "INIT_NAME_COLLISION", { stage: "init", name: detectedName });
     }
   }
-  if (!existsSync24(projectDir)) {
+  if (!existsSync23(projectDir)) {
     await mkdir15(projectDir, { recursive: true });
     logger.info("init", "Created project config directory", { path: projectDir });
   }
@@ -78316,7 +78578,7 @@ async function initProject(projectRoot, options) {
     monorepo: stack.monorepo
   });
   const configPath = join80(projectDir, "config.json");
-  if (!existsSync24(configPath)) {
+  if (!existsSync23(configPath)) {
     await Bun.write(configPath, `${JSON.stringify(projectConfig, null, 2)}
 `);
     logger.info("init", "Created project config", { path: configPath });
@@ -78325,35 +78587,44 @@ async function initProject(projectRoot, options) {
   }
   await initContext(projectRoot, { force: options?.force });
   const constitutionPath = join80(projectDir, "constitution.md");
-  if (!existsSync24(constitutionPath) || options?.force) {
+  if (!existsSync23(constitutionPath) || options?.force) {
     await Bun.write(constitutionPath, buildConstitution(stack));
     logger.info("init", "Created project constitution", { path: constitutionPath });
   } else {
     logger.info("init", "Project constitution already exists", { path: constitutionPath });
   }
-  const hooksDir = join80(projectDir, "hooks");
-  if (!existsSync24(hooksDir)) {
-    await mkdir15(hooksDir, { recursive: true });
-    logger.info("init", "Created project hooks directory", { path: hooksDir });
-  } else {
-    logger.info("init", "Project hooks directory already exists", { path: hooksDir });
+  for (const [label, dir] of [
+    ["hooks", join80(projectDir, "hooks")],
+    ["features", featuresDir(projectRoot)]
+  ]) {
+    if (!existsSync23(dir)) {
+      await mkdir15(dir, { recursive: true });
+      logger.info("init", `Created project ${label} directory`, { path: dir });
+    } else {
+      logger.info("init", `Project ${label} directory already exists`, { path: dir });
+    }
   }
   await updateGitignore(projectRoot);
-  await promptsInitCommand({ workdir: projectRoot, force: false, autoWireConfig: false });
+  await updateNaxignore(projectRoot);
   _initDeps.log(`
 [OK] nax init complete. Created files:`);
   _initDeps.log("  - .nax/config.json");
   _initDeps.log("  - .nax/context.md");
   _initDeps.log("  - .nax/constitution.md");
   _initDeps.log("  - .nax/hooks/");
-  _initDeps.log("  - .nax/templates/");
+  _initDeps.log(`  - ${PROJECT_FEATURES_DIR}/`);
+  _initDeps.log("  - .gitignore  (nax entries)");
+  _initDeps.log("  - .naxignore");
   _initDeps.log(`
 Next steps:`);
   _initDeps.log("  1. Review .nax/context.md and fill in TODOs");
-  _initDeps.log("  2. Review .nax/config.json and adjust quality commands");
-  _initDeps.log("  3. Run: nax generate");
-  _initDeps.log("  4. Run: nax plan");
-  _initDeps.log("  5. Run: nax run");
+  _initDeps.log("  2. Review .naxignore and add paths nax should not scan");
+  _initDeps.log("  3. Review .nax/config.json and adjust quality commands");
+  _initDeps.log("  4. Run: nax generate");
+  _initDeps.log("  5. Run: nax plan");
+  _initDeps.log("  6. Run: nax run");
+  _initDeps.log(`
+Optional: nax prompts --init  (scaffold overridable prompt templates)`);
   logger.info("init", "Project config initialized successfully", { path: projectDir });
 }
 async function initCommand(options = {}) {
@@ -78361,7 +78632,7 @@ async function initCommand(options = {}) {
     await initGlobal();
   } else if (options.package) {
     const projectRoot = options.projectRoot ?? process.cwd();
-    await initPackage(projectRoot, options.package);
+    await initPackage(projectRoot, options.package, options.force);
     _initDeps.log(`
 [OK] Package scaffold created.`);
     _initDeps.log(`  Created: .nax/mono/${options.package}/context.md`);
@@ -78383,7 +78654,6 @@ var init_init2 = __esm(() => {
   init_gitignore();
   init_init_context();
   init_init_detect();
-  init_prompts2();
   _initDeps = {
     log: console.log.bind(console)
   };
@@ -78398,11 +78668,11 @@ __export(exports_migrate, {
   migrateCommand: () => migrateCommand,
   detectGeneratedContent: () => detectGeneratedContent
 });
-import { existsSync as existsSync25 } from "fs";
+import { existsSync as existsSync24 } from "fs";
 import { mkdir as mkdir16, readdir as readdir4, rename as rename5 } from "fs/promises";
 import path26 from "path";
 async function detectGeneratedContent(naxDir) {
-  if (!existsSync25(naxDir))
+  if (!existsSync24(naxDir))
     return [];
   const candidates = [];
   let entries = [];
@@ -78417,7 +78687,7 @@ async function detectGeneratedContent(naxDir) {
     }
   }
   const featuresDir2 = path26.join(naxDir, "features");
-  if (existsSync25(featuresDir2)) {
+  if (existsSync24(featuresDir2)) {
     let featureDirs = [];
     try {
       featureDirs = await readdir4(featuresDir2);
@@ -78479,7 +78749,7 @@ async function migrateCommand(options) {
       });
     }
     const src = path26.join(globalConfigDir(), options.reclaim);
-    if (!existsSync25(src)) {
+    if (!existsSync24(src)) {
       throw new NaxError(`Nothing to reclaim: ~/.nax/${options.reclaim} does not exist`, "MIGRATE_RECLAIM_NOT_FOUND", {
         stage: "migrate",
         name: options.reclaim
@@ -78525,7 +78795,7 @@ async function migrateCommand(options) {
   }
   const naxDir = path26.join(options.workdir, ".nax");
   const configPath = path26.join(naxDir, "config.json");
-  if (!existsSync25(configPath)) {
+  if (!existsSync24(configPath)) {
     throw new NaxError("No .nax/config.json found \u2014 run nax init first", "MIGRATE_NO_CONFIG", {
       stage: "migrate",
       workdir: options.workdir
@@ -78560,7 +78830,7 @@ async function migrateCommand(options) {
   for (const candidate of candidates) {
     const dest = path26.join(destBase, candidate.name);
     await mkdir16(path26.dirname(dest), { recursive: true });
-    if (existsSync25(dest)) {
+    if (existsSync24(dest)) {
       throw new NaxError(`Migration conflict: destination already exists.
   Source:      ${candidate.srcPath}
   Destination: ${dest}
@@ -80458,380 +80728,6 @@ var init_pipeline = __esm(() => {
   init_reporters();
 });
 
-// src/cli/prompts-shared.ts
-function buildFrontmatter(story, ctx, role) {
-  const lines = [];
-  lines.push(`storyId: ${story.id}`);
-  lines.push(`title: "${story.title}"`);
-  lines.push(`testStrategy: ${ctx.routing.testStrategy}`);
-  lines.push(`modelTier: ${ctx.routing.modelTier}`);
-  if (role) {
-    lines.push(`role: ${role}`);
-  }
-  const builtContext = ctx.builtContext;
-  const contextTokens = builtContext?.totalTokens ?? 0;
-  const promptTokens = ctx.prompt ? Math.ceil(ctx.prompt.length / 3) : 0;
-  lines.push(`contextTokens: ${contextTokens}`);
-  lines.push(`promptTokens: ${promptTokens}`);
-  if (story.dependencies && story.dependencies.length > 0) {
-    lines.push(`dependencies: [${story.dependencies.join(", ")}]`);
-  }
-  lines.push("contextElements:");
-  if (builtContext) {
-    for (const element of builtContext.elements) {
-      lines.push(`  - type: ${element.type}`);
-      if (element.storyId) {
-        lines.push(`    storyId: ${element.storyId}`);
-      }
-      if (element.filePath) {
-        lines.push(`    filePath: ${element.filePath}`);
-      }
-      lines.push(`    tokens: ${element.tokens}`);
-    }
-  }
-  if (builtContext?.truncated) {
-    lines.push("truncated: true");
-  }
-  return `${lines.join(`
-`)}
-`;
-}
-
-// src/cli/prompts-tdd.ts
-import { join as join82 } from "path";
-async function handleThreeSessionTddPrompts(story, ctx, outputDir, logger) {
-  const [testWriterPrompt, implementerPrompt, verifierPrompt] = await Promise.all([
-    TddPromptBuilder.for("test-writer", { isolation: "strict" }).withLoader(ctx.workdir, ctx.config).story(story).context(ctx.contextMarkdown).constitution(ctx.constitution?.content).testCommand(ctx.config.quality?.commands?.test).build(),
-    TddPromptBuilder.for("implementer", { variant: "standard" }).withLoader(ctx.workdir, ctx.config).story(story).context(ctx.contextMarkdown).constitution(ctx.constitution?.content).testCommand(ctx.config.quality?.commands?.test).build(),
-    TddPromptBuilder.for("verifier").withLoader(ctx.workdir, ctx.config).story(story).context(ctx.contextMarkdown).constitution(ctx.constitution?.content).testCommand(ctx.config.quality?.commands?.test).build()
-  ]);
-  const sessions = [
-    { role: "test-writer", prompt: testWriterPrompt },
-    { role: "implementer", prompt: implementerPrompt },
-    { role: "verifier", prompt: verifierPrompt }
-  ];
-  for (const session of sessions) {
-    const frontmatter = buildFrontmatter(story, ctx, session.role);
-    const fullOutput = `---
-${frontmatter}---
-
-${session.prompt}`;
-    if (outputDir) {
-      const promptFile = join82(outputDir, `${story.id}.${session.role}.md`);
-      await Bun.write(promptFile, fullOutput);
-      logger.info("cli", "Written TDD prompt file", {
-        storyId: story.id,
-        role: session.role,
-        promptFile
-      });
-    } else {
-      console.log(`
-${"=".repeat(80)}`);
-      console.log(`Story: ${story.id} \u2014 ${story.title} [${session.role}]`);
-      console.log("=".repeat(80));
-      console.log(fullOutput);
-    }
-  }
-  if (outputDir && ctx.contextMarkdown) {
-    const contextFile = join82(outputDir, `${story.id}.context.md`);
-    const frontmatter = buildFrontmatter(story, ctx);
-    const contextOutput = `---
-${frontmatter}---
-
-${ctx.contextMarkdown}`;
-    await Bun.write(contextFile, contextOutput);
-  }
-}
-var init_prompts_tdd = __esm(() => {
-  init_prompts();
-});
-
-// src/cli/prompts-main.ts
-import { existsSync as existsSync26, mkdirSync as mkdirSync4 } from "fs";
-import { join as join83 } from "path";
-async function promptsCommand(options) {
-  const logger = getLogger();
-  const { feature, workdir, config: config2, storyId, outputDir } = options;
-  const naxDir = join83(workdir, ".nax");
-  if (!existsSync26(naxDir)) {
-    throw new Error(`.nax directory not found. Run 'nax init' first in ${workdir}`);
-  }
-  const featureDir2 = join83(naxDir, "features", feature);
-  const prdPath = join83(featureDir2, "prd.json");
-  if (!existsSync26(prdPath)) {
-    throw new Error(`Feature "${feature}" not found or missing prd.json`);
-  }
-  const prd = await loadPRD(prdPath);
-  const runtime = _promptsMainDeps.createRuntime(config2, workdir);
-  try {
-    const stories = storyId ? prd.userStories.filter((s) => s.id === storyId) : prd.userStories;
-    if (stories.length === 0) {
-      throw new Error(storyId ? `Story "${storyId}" not found in feature "${feature}"` : `No stories found in feature "${feature}"`);
-    }
-    if (outputDir) {
-      mkdirSync4(outputDir, { recursive: true });
-    }
-    logger.info("cli", "Assembling prompts", {
-      feature,
-      storyCount: stories.length,
-      outputMode: outputDir ? "files" : "stdout"
-    });
-    const processedStories = [];
-    const promptPipeline = [routingStage, constitutionStage, contextStage, promptStage];
-    for (const story of stories) {
-      const ctx = {
-        config: config2,
-        rootConfig: config2,
-        prd,
-        story,
-        stories: [story],
-        routing: {
-          complexity: "simple",
-          modelTier: "fast",
-          testStrategy: "test-after",
-          reasoning: "Placeholder routing"
-        },
-        projectDir: workdir,
-        workdir,
-        featureDir: featureDir2,
-        hooks: { hooks: {} },
-        agentManager: runtime.agentManager,
-        sessionManager: runtime.sessionManager,
-        runtime,
-        abortSignal: runtime.signal
-      };
-      const result = await runPipeline(promptPipeline, ctx);
-      if (!result.success) {
-        logger.warn("cli", "Failed to assemble prompt for story", {
-          storyId: story.id,
-          reason: result.reason
-        });
-        continue;
-      }
-      if (ctx.routing.testStrategy === "three-session-tdd") {
-        await handleThreeSessionTddPrompts(story, ctx, outputDir, logger);
-        processedStories.push(story.id);
-        continue;
-      }
-      if (!ctx.prompt) {
-        logger.warn("cli", "No prompt generated for story", {
-          storyId: story.id
-        });
-        continue;
-      }
-      const frontmatter = buildFrontmatter(story, ctx);
-      const fullOutput = `---
-${frontmatter}---
-
-${ctx.prompt}`;
-      if (outputDir) {
-        const promptFile = join83(outputDir, `${story.id}.prompt.md`);
-        await Bun.write(promptFile, fullOutput);
-        if (ctx.contextMarkdown) {
-          const contextFile = join83(outputDir, `${story.id}.context.md`);
-          const contextOutput = `---
-${frontmatter}---
-
-${ctx.contextMarkdown}`;
-          await Bun.write(contextFile, contextOutput);
-        }
-        logger.info("cli", "Written prompt files", {
-          storyId: story.id,
-          promptFile
-        });
-      } else {
-        console.log(`
-${"=".repeat(80)}`);
-        console.log(`Story: ${story.id} \u2014 ${story.title}`);
-        console.log("=".repeat(80));
-        console.log(fullOutput);
-      }
-      processedStories.push(story.id);
-    }
-    logger.info("cli", "Prompt assembly complete", {
-      processedCount: processedStories.length
-    });
-    return processedStories;
-  } finally {
-    await runtime.close();
-  }
-}
-var _promptsMainDeps;
-var init_prompts_main = __esm(() => {
-  init_logger2();
-  init_pipeline();
-  init_stages();
-  init_prd();
-  init_runtime();
-  init_prompts_tdd();
-  _promptsMainDeps = { createRuntime };
-});
-
-// src/cli/prompts-init.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync5 } from "fs";
-import { join as join84 } from "path";
-async function promptsInitCommand(options) {
-  const { workdir, force = false, autoWireConfig = true } = options;
-  const templatesDir = join84(workdir, ".nax", "templates");
-  mkdirSync5(templatesDir, { recursive: true });
-  const existingFiles = TEMPLATE_ROLES.map((t) => t.file).filter((f) => existsSync27(join84(templatesDir, f)));
-  if (existingFiles.length > 0 && !force) {
-    _promptsInitDeps.warn(`[WARN] nax/templates/ already contains files: ${existingFiles.join(", ")}. No files overwritten.
-       Pass --force to overwrite existing templates.`);
-    return [];
-  }
-  const written = [];
-  for (const template of TEMPLATE_ROLES) {
-    const filePath = join84(templatesDir, template.file);
-    const roleBody = template.role === "implementer" ? buildRoleTaskSection(template.role, template.variant) : buildRoleTaskSection(template.role);
-    const content = TEMPLATE_HEADER + roleBody;
-    await Bun.write(filePath, content);
-    written.push(filePath);
-  }
-  _promptsInitDeps.log(`[OK] Written ${written.length} template files to nax/templates/:`);
-  for (const filePath of written) {
-    _promptsInitDeps.log(`  - ${filePath.replace(`${workdir}/`, "")}`);
-  }
-  if (autoWireConfig) {
-    await autoWirePromptsConfig(workdir);
-  }
-  return written;
-}
-async function autoWirePromptsConfig(workdir) {
-  const configPath = join84(workdir, "nax.config.json");
-  if (!existsSync27(configPath)) {
-    const exampleConfig = JSON.stringify({
-      prompts: {
-        overrides: {
-          "test-writer": ".nax/templates/test-writer.md",
-          implementer: ".nax/templates/implementer.md",
-          verifier: ".nax/templates/verifier.md",
-          "single-session": ".nax/templates/single-session.md",
-          "tdd-simple": ".nax/templates/tdd-simple.md"
-        }
-      }
-    }, null, 2);
-    _promptsInitDeps.log(`
-No nax.config.json found. To activate overrides, create nax/config.json with:
-${exampleConfig}`);
-    return;
-  }
-  const configFile = Bun.file(configPath);
-  const configContent = await configFile.text();
-  const config2 = JSON.parse(configContent);
-  if (config2.prompts?.overrides && Object.keys(config2.prompts.overrides).length > 0) {
-    _promptsInitDeps.log(`[INFO] prompts.overrides already configured in nax.config.json. Skipping auto-wiring.
-` + "       To reset overrides, remove the prompts.overrides section and re-run this command.");
-    return;
-  }
-  const overrides = {
-    "test-writer": ".nax/templates/test-writer.md",
-    implementer: ".nax/templates/implementer.md",
-    verifier: ".nax/templates/verifier.md",
-    "single-session": ".nax/templates/single-session.md",
-    "tdd-simple": ".nax/templates/tdd-simple.md"
-  };
-  if (!config2.prompts) {
-    config2.prompts = {};
-  }
-  config2.prompts.overrides = overrides;
-  const updatedConfig = formatConfigJson(config2);
-  await Bun.write(configPath, updatedConfig);
-  _promptsInitDeps.log("[OK] Auto-wired prompts.overrides in nax.config.json");
-}
-function formatConfigJson(config2) {
-  const lines = ["{"];
-  const keys = Object.keys(config2);
-  for (let i = 0;i < keys.length; i++) {
-    const key = keys[i];
-    const value = config2[key];
-    const isLast = i === keys.length - 1;
-    if (key === "prompts" && typeof value === "object" && value !== null) {
-      const promptsObj = value;
-      if (promptsObj.overrides) {
-        const overridesJson = JSON.stringify(promptsObj.overrides);
-        lines.push(`  "${key}": { "overrides": ${overridesJson} }${isLast ? "" : ","}`);
-      } else {
-        lines.push(`  "${key}": ${JSON.stringify(value)}${isLast ? "" : ","}`);
-      }
-    } else {
-      lines.push(`  "${key}": ${JSON.stringify(value)}${isLast ? "" : ","}`);
-    }
-  }
-  lines.push("}");
-  return lines.join(`
-`);
-}
-var _promptsInitDeps, TEMPLATE_ROLES, TEMPLATE_HEADER = `<!--
-  This file controls the role-body section of the nax prompt for this role.
-  Edit the content below to customize the task instructions given to the agent.
-
-  NON-OVERRIDABLE SECTIONS (always injected by nax, cannot be changed here):
-    - Isolation rules (scope, file access boundaries)
-    - Story context (acceptance criteria, description, dependencies)
-    - Conventions (project coding standards)
-
-  To activate overrides, add to your nax/config.json:
-    { "prompts": { "overrides": { "<role>": ".nax/templates/<role>.md" } } }
--->
-
-`;
-var init_prompts_init = __esm(() => {
-  init_role_task();
-  _promptsInitDeps = {
-    log: console.log.bind(console),
-    warn: console.warn.bind(console)
-  };
-  TEMPLATE_ROLES = [
-    { file: "test-writer.md", role: "test-writer" },
-    { file: "implementer.md", role: "implementer", variant: "standard" },
-    { file: "verifier.md", role: "verifier" },
-    { file: "single-session.md", role: "single-session" },
-    { file: "tdd-simple.md", role: "tdd-simple" }
-  ];
-});
-
-// src/cli/prompts-export.ts
-async function exportPromptCommand(options) {
-  const { role, out } = options;
-  if (!VALID_EXPORT_ROLES.includes(role)) {
-    console.error(`[ERROR] Invalid role: "${role}". Valid roles: ${VALID_EXPORT_ROLES.join(", ")}`);
-    process.exit(1);
-  }
-  const stubStory = {
-    id: "EXAMPLE",
-    title: "Example story",
-    description: "Story ID: EXAMPLE. This is a placeholder story used to demonstrate the default prompt.",
-    acceptanceCriteria: ["AC-1: Example criterion"],
-    tags: [],
-    dependencies: [],
-    status: "pending",
-    passes: false,
-    escalations: [],
-    attempts: 0
-  };
-  const prompt = await TddPromptBuilder.for(role).story(stubStory).build();
-  if (out) {
-    await Bun.write(out, prompt);
-    console.log(`[OK] Exported prompt for "${role}" to ${out}`);
-  } else {
-    console.log(prompt);
-  }
-}
-var VALID_EXPORT_ROLES;
-var init_prompts_export = __esm(() => {
-  init_prompts();
-  VALID_EXPORT_ROLES = ["test-writer", "implementer", "verifier", "single-session", "tdd-simple"];
-});
-
-// src/cli/prompts.ts
-var init_prompts2 = __esm(() => {
-  init_prompts_main();
-  init_prompts_init();
-  init_prompts_export();
-  init_prompts_tdd();
-});
-
 // src/cli/setup-analyze.ts
 import { join as join85 } from "path";
 async function detectPackageManager(workdir) {
@@ -111331,7 +111227,7 @@ var init_curator2 = __esm(() => {
 
 // bin/nax.ts
 init_source();
-import { existsSync as existsSync41, mkdirSync as mkdirSync8 } from "fs";
+import { existsSync as existsSync40, mkdirSync as mkdirSync8 } from "fs";
 import { homedir as homedir3 } from "os";
 import { basename as basename24, join as join115 } from "path";
 
@@ -112130,9 +112026,361 @@ async function runsShowCommand(options) {
     });
   }
 }
+// src/cli/prompts-main.ts
+init_logger2();
+init_pipeline();
+init_stages();
+init_prd();
+init_runtime();
+import { existsSync as existsSync25, mkdirSync as mkdirSync4 } from "fs";
+import { join as join83 } from "path";
+
+// src/cli/prompts-shared.ts
+function buildFrontmatter(story, ctx, role) {
+  const lines = [];
+  lines.push(`storyId: ${story.id}`);
+  lines.push(`title: "${story.title}"`);
+  lines.push(`testStrategy: ${ctx.routing.testStrategy}`);
+  lines.push(`modelTier: ${ctx.routing.modelTier}`);
+  if (role) {
+    lines.push(`role: ${role}`);
+  }
+  const builtContext = ctx.builtContext;
+  const contextTokens = builtContext?.totalTokens ?? 0;
+  const promptTokens = ctx.prompt ? Math.ceil(ctx.prompt.length / 3) : 0;
+  lines.push(`contextTokens: ${contextTokens}`);
+  lines.push(`promptTokens: ${promptTokens}`);
+  if (story.dependencies && story.dependencies.length > 0) {
+    lines.push(`dependencies: [${story.dependencies.join(", ")}]`);
+  }
+  lines.push("contextElements:");
+  if (builtContext) {
+    for (const element of builtContext.elements) {
+      lines.push(`  - type: ${element.type}`);
+      if (element.storyId) {
+        lines.push(`    storyId: ${element.storyId}`);
+      }
+      if (element.filePath) {
+        lines.push(`    filePath: ${element.filePath}`);
+      }
+      lines.push(`    tokens: ${element.tokens}`);
+    }
+  }
+  if (builtContext?.truncated) {
+    lines.push("truncated: true");
+  }
+  return `${lines.join(`
+`)}
+`;
+}
 
+// src/cli/prompts-tdd.ts
+init_prompts();
+import { join as join82 } from "path";
+async function handleThreeSessionTddPrompts(story, ctx, outputDir, logger) {
+  const [testWriterPrompt, implementerPrompt, verifierPrompt] = await Promise.all([
+    TddPromptBuilder.for("test-writer", { isolation: "strict" }).withLoader(ctx.workdir, ctx.config).story(story).context(ctx.contextMarkdown).constitution(ctx.constitution?.content).testCommand(ctx.config.quality?.commands?.test).build(),
+    TddPromptBuilder.for("implementer", { variant: "standard" }).withLoader(ctx.workdir, ctx.config).story(story).context(ctx.contextMarkdown).constitution(ctx.constitution?.content).testCommand(ctx.config.quality?.commands?.test).build(),
+    TddPromptBuilder.for("verifier").withLoader(ctx.workdir, ctx.config).story(story).context(ctx.contextMarkdown).constitution(ctx.constitution?.content).testCommand(ctx.config.quality?.commands?.test).build()
+  ]);
+  const sessions = [
+    { role: "test-writer", prompt: testWriterPrompt },
+    { role: "implementer", prompt: implementerPrompt },
+    { role: "verifier", prompt: verifierPrompt }
+  ];
+  for (const session of sessions) {
+    const frontmatter = buildFrontmatter(story, ctx, session.role);
+    const fullOutput = `---
+${frontmatter}---
+
+${session.prompt}`;
+    if (outputDir) {
+      const promptFile = join82(outputDir, `${story.id}.${session.role}.md`);
+      await Bun.write(promptFile, fullOutput);
+      logger.info("cli", "Written TDD prompt file", {
+        storyId: story.id,
+        role: session.role,
+        promptFile
+      });
+    } else {
+      console.log(`
+${"=".repeat(80)}`);
+      console.log(`Story: ${story.id} \u2014 ${story.title} [${session.role}]`);
+      console.log("=".repeat(80));
+      console.log(fullOutput);
+    }
+  }
+  if (outputDir && ctx.contextMarkdown) {
+    const contextFile = join82(outputDir, `${story.id}.context.md`);
+    const frontmatter = buildFrontmatter(story, ctx);
+    const contextOutput = `---
+${frontmatter}---
+
+${ctx.contextMarkdown}`;
+    await Bun.write(contextFile, contextOutput);
+  }
+}
+
+// src/cli/prompts-main.ts
+var _promptsMainDeps = { createRuntime };
+async function promptsCommand(options) {
+  const logger = getLogger();
+  const { feature, workdir, config: config2, storyId, outputDir } = options;
+  const naxDir = join83(workdir, ".nax");
+  if (!existsSync25(naxDir)) {
+    throw new Error(`.nax directory not found. Run 'nax init' first in ${workdir}`);
+  }
+  const featureDir2 = join83(naxDir, "features", feature);
+  const prdPath = join83(featureDir2, "prd.json");
+  if (!existsSync25(prdPath)) {
+    throw new Error(`Feature "${feature}" not found or missing prd.json`);
+  }
+  const prd = await loadPRD(prdPath);
+  const runtime = _promptsMainDeps.createRuntime(config2, workdir);
+  try {
+    const stories = storyId ? prd.userStories.filter((s) => s.id === storyId) : prd.userStories;
+    if (stories.length === 0) {
+      throw new Error(storyId ? `Story "${storyId}" not found in feature "${feature}"` : `No stories found in feature "${feature}"`);
+    }
+    if (outputDir) {
+      mkdirSync4(outputDir, { recursive: true });
+    }
+    logger.info("cli", "Assembling prompts", {
+      feature,
+      storyCount: stories.length,
+      outputMode: outputDir ? "files" : "stdout"
+    });
+    const processedStories = [];
+    const promptPipeline = [routingStage, constitutionStage, contextStage, promptStage];
+    for (const story of stories) {
+      const ctx = {
+        config: config2,
+        rootConfig: config2,
+        prd,
+        story,
+        stories: [story],
+        routing: {
+          complexity: "simple",
+          modelTier: "fast",
+          testStrategy: "test-after",
+          reasoning: "Placeholder routing"
+        },
+        projectDir: workdir,
+        workdir,
+        featureDir: featureDir2,
+        hooks: { hooks: {} },
+        agentManager: runtime.agentManager,
+        sessionManager: runtime.sessionManager,
+        runtime,
+        abortSignal: runtime.signal
+      };
+      const result = await runPipeline(promptPipeline, ctx);
+      if (!result.success) {
+        logger.warn("cli", "Failed to assemble prompt for story", {
+          storyId: story.id,
+          reason: result.reason
+        });
+        continue;
+      }
+      if (ctx.routing.testStrategy === "three-session-tdd") {
+        await handleThreeSessionTddPrompts(story, ctx, outputDir, logger);
+        processedStories.push(story.id);
+        continue;
+      }
+      if (!ctx.prompt) {
+        logger.warn("cli", "No prompt generated for story", {
+          storyId: story.id
+        });
+        continue;
+      }
+      const frontmatter = buildFrontmatter(story, ctx);
+      const fullOutput = `---
+${frontmatter}---
+
+${ctx.prompt}`;
+      if (outputDir) {
+        const promptFile = join83(outputDir, `${story.id}.prompt.md`);
+        await Bun.write(promptFile, fullOutput);
+        if (ctx.contextMarkdown) {
+          const contextFile = join83(outputDir, `${story.id}.context.md`);
+          const contextOutput = `---
+${frontmatter}---
+
+${ctx.contextMarkdown}`;
+          await Bun.write(contextFile, contextOutput);
+        }
+        logger.info("cli", "Written prompt files", {
+          storyId: story.id,
+          promptFile
+        });
+      } else {
+        console.log(`
+${"=".repeat(80)}`);
+        console.log(`Story: ${story.id} \u2014 ${story.title}`);
+        console.log("=".repeat(80));
+        console.log(fullOutput);
+      }
+      processedStories.push(story.id);
+    }
+    logger.info("cli", "Prompt assembly complete", {
+      processedCount: processedStories.length
+    });
+    return processedStories;
+  } finally {
+    await runtime.close();
+  }
+}
+// src/cli/prompts-init.ts
+init_role_task();
+import { existsSync as existsSync26, mkdirSync as mkdirSync5 } from "fs";
+import { join as join84 } from "path";
+var _promptsInitDeps = {
+  log: console.log.bind(console),
+  warn: console.warn.bind(console)
+};
+var TEMPLATE_ROLES = [
+  { file: "test-writer.md", role: "test-writer" },
+  { file: "implementer.md", role: "implementer", variant: "standard" },
+  { file: "verifier.md", role: "verifier" },
+  { file: "single-session.md", role: "single-session" },
+  { file: "tdd-simple.md", role: "tdd-simple" }
+];
+var TEMPLATE_HEADER = `<!--
+  This file controls the role-body section of the nax prompt for this role.
+  Edit the content below to customize the task instructions given to the agent.
+
+  NON-OVERRIDABLE SECTIONS (always injected by nax, cannot be changed here):
+    - Isolation rules (scope, file access boundaries)
+    - Story context (acceptance criteria, description, dependencies)
+    - Conventions (project coding standards)
+
+  To activate overrides, add to your nax/config.json:
+    { "prompts": { "overrides": { "<role>": ".nax/templates/<role>.md" } } }
+-->
+
+`;
+async function promptsInitCommand(options) {
+  const { workdir, force = false, autoWireConfig = true } = options;
+  const templatesDir = join84(workdir, ".nax", "templates");
+  mkdirSync5(templatesDir, { recursive: true });
+  const existingFiles = TEMPLATE_ROLES.map((t) => t.file).filter((f) => existsSync26(join84(templatesDir, f)));
+  if (existingFiles.length > 0 && !force) {
+    _promptsInitDeps.warn(`[WARN] nax/templates/ already contains files: ${existingFiles.join(", ")}. No files overwritten.
+       Pass --force to overwrite existing templates.`);
+    return [];
+  }
+  const written = [];
+  for (const template of TEMPLATE_ROLES) {
+    const filePath = join84(templatesDir, template.file);
+    const roleBody = template.role === "implementer" ? buildRoleTaskSection(template.role, template.variant) : buildRoleTaskSection(template.role);
+    const content = TEMPLATE_HEADER + roleBody;
+    await Bun.write(filePath, content);
+    written.push(filePath);
+  }
+  _promptsInitDeps.log(`[OK] Written ${written.length} template files to nax/templates/:`);
+  for (const filePath of written) {
+    _promptsInitDeps.log(`  - ${filePath.replace(`${workdir}/`, "")}`);
+  }
+  if (autoWireConfig) {
+    await autoWirePromptsConfig(workdir);
+  }
+  return written;
+}
+async function autoWirePromptsConfig(workdir) {
+  const configPath = join84(workdir, "nax.config.json");
+  if (!existsSync26(configPath)) {
+    const exampleConfig = JSON.stringify({
+      prompts: {
+        overrides: {
+          "test-writer": ".nax/templates/test-writer.md",
+          implementer: ".nax/templates/implementer.md",
+          verifier: ".nax/templates/verifier.md",
+          "single-session": ".nax/templates/single-session.md",
+          "tdd-simple": ".nax/templates/tdd-simple.md"
+        }
+      }
+    }, null, 2);
+    _promptsInitDeps.log(`
+No nax.config.json found. To activate overrides, create nax/config.json with:
+${exampleConfig}`);
+    return;
+  }
+  const configFile = Bun.file(configPath);
+  const configContent = await configFile.text();
+  const config2 = JSON.parse(configContent);
+  if (config2.prompts?.overrides && Object.keys(config2.prompts.overrides).length > 0) {
+    _promptsInitDeps.log(`[INFO] prompts.overrides already configured in nax.config.json. Skipping auto-wiring.
+` + "       To reset overrides, remove the prompts.overrides section and re-run this command.");
+    return;
+  }
+  const overrides = {
+    "test-writer": ".nax/templates/test-writer.md",
+    implementer: ".nax/templates/implementer.md",
+    verifier: ".nax/templates/verifier.md",
+    "single-session": ".nax/templates/single-session.md",
+    "tdd-simple": ".nax/templates/tdd-simple.md"
+  };
+  if (!config2.prompts) {
+    config2.prompts = {};
+  }
+  config2.prompts.overrides = overrides;
+  const updatedConfig = formatConfigJson(config2);
+  await Bun.write(configPath, updatedConfig);
+  _promptsInitDeps.log("[OK] Auto-wired prompts.overrides in nax.config.json");
+}
+function formatConfigJson(config2) {
+  const lines = ["{"];
+  const keys = Object.keys(config2);
+  for (let i = 0;i < keys.length; i++) {
+    const key = keys[i];
+    const value = config2[key];
+    const isLast = i === keys.length - 1;
+    if (key === "prompts" && typeof value === "object" && value !== null) {
+      const promptsObj = value;
+      if (promptsObj.overrides) {
+        const overridesJson = JSON.stringify(promptsObj.overrides);
+        lines.push(`  "${key}": { "overrides": ${overridesJson} }${isLast ? "" : ","}`);
+      } else {
+        lines.push(`  "${key}": ${JSON.stringify(value)}${isLast ? "" : ","}`);
+      }
+    } else {
+      lines.push(`  "${key}": ${JSON.stringify(value)}${isLast ? "" : ","}`);
+    }
+  }
+  lines.push("}");
+  return lines.join(`
+`);
+}
+// src/cli/prompts-export.ts
+init_prompts();
+var VALID_EXPORT_ROLES = ["test-writer", "implementer", "verifier", "single-session", "tdd-simple"];
+async function exportPromptCommand(options) {
+  const { role, out } = options;
+  if (!VALID_EXPORT_ROLES.includes(role)) {
+    console.error(`[ERROR] Invalid role: "${role}". Valid roles: ${VALID_EXPORT_ROLES.join(", ")}`);
+    process.exit(1);
+  }
+  const stubStory = {
+    id: "EXAMPLE",
+    title: "Example story",
+    description: "Story ID: EXAMPLE. This is a placeholder story used to demonstrate the default prompt.",
+    acceptanceCriteria: ["AC-1: Example criterion"],
+    tags: [],
+    dependencies: [],
+    status: "pending",
+    passes: false,
+    escalations: [],
+    attempts: 0
+  };
+  const prompt = await TddPromptBuilder.for(role).story(stubStory).build();
+  if (out) {
+    await Bun.write(out, prompt);
+    console.log(`[OK] Exported prompt for "${role}" to ${out}`);
+  } else {
+    console.log(prompt);
+  }
+}
 // src/cli/index.ts
-init_prompts2();
 init_init2();
 init_setup();
 init_setup_write();
@@ -112207,7 +112455,7 @@ function pad(str, width) {
 init_source();
 init_loader();
 init_generator2();
-import { existsSync as existsSync28 } from "fs";
+import { existsSync as existsSync27 } from "fs";
 import { join as join90 } from "path";
 var VALID_AGENTS = ["claude", "codex", "opencode", "cursor", "windsurf", "aider", "gemini"];
 async function generateCommand(options) {
@@ -112274,7 +112522,7 @@ async function generateCommand(options) {
   const contextPath = options.context ? join90(workdir, options.context) : join90(workdir, ".nax/context.md");
   const outputDir = options.output ? join90(workdir, options.output) : workdir;
   const autoInject = !options.noAutoInject;
-  if (!existsSync28(contextPath)) {
+  if (!existsSync27(contextPath)) {
     console.error(source_default.red(`\u2717 Context file not found: ${contextPath}`));
     console.error(source_default.yellow("  Create .nax/context.md first, or run `nax init` to scaffold it."));
     process.exit(1);
@@ -112377,7 +112625,7 @@ async function generateCommand(options) {
 }
 // src/cli/config-display.ts
 init_loader();
-import { existsSync as existsSync30 } from "fs";
+import { existsSync as existsSync29 } from "fs";
 import { join as join93 } from "path";
 
 // src/cli/config-descriptions.ts
@@ -112442,6 +112690,9 @@ var FIELD_DESCRIPTIONS = {
   "execution.mutationCheck.maxMutants": "Mutants tested per story (default: 3). Candidates are gathered across all changed files and sampled evenly, so raising this widens coverage at a cost of one scoped test run per mutant.",
   "execution.mutationCheck.timeoutSeconds": "Per-mutant scoped test-run timeout in seconds (default: 60). Worst-case added wall clock per story is maxMutants x timeoutSeconds.",
   "execution.storyIsolation": 'Story isolation mode. "shared" (default): all stories run on the main branch. "worktree": each story runs in an isolated git worktree (.nax-wt/<storyId>/); passed stories merge into main, failed commits never reach main.',
+  "execution.worktreeDependencies": 'How a story worktree gets its dependencies (only applies when storyIsolation="worktree"). "off" (default): install nothing. Because worktrees live at <projectRoot>/.nax-wt/<storyId>/ \u2014 inside the project root \u2014 Node/Bun resolution walks up to the root node_modules, so JS/TS repos need nothing here. "provision": run execution.worktreeDependencies.setupCommand from the worktree root before the story starts (required for ecosystems with no upward resolution: a Python venv, bundler, composer).',
+  "execution.worktreeDependencies.mode": 'Dependency preparation strategy for story worktrees: "off" (default, install nothing) or "provision" (run setupCommand first).',
+  "execution.worktreeDependencies.setupCommand": 'Install command run from the worktree root before a story starts, e.g. "bun install --frozen-lockfile". Rejected unless mode is "provision".',
   quality: "Quality gate configuration",
   "quality.commands": "Custom quality commands",
   "quality.commands.typecheck": "Custom typecheck command",
@@ -112625,10 +112876,10 @@ function deepEqual(a, b) {
 init_defaults();
 init_loader();
 init_merger();
-import { existsSync as existsSync29 } from "fs";
+import { existsSync as existsSync28 } from "fs";
 import { join as join91 } from "path";
 async function loadConfigFile(path32) {
-  if (!existsSync29(path32))
+  if (!existsSync28(path32))
     return null;
   try {
     return await Bun.file(path32).json();
@@ -112825,7 +113076,7 @@ function determineConfigSources() {
   };
 }
 function fileExists(path32) {
-  return existsSync30(path32);
+  return existsSync29(path32);
 }
 function displayConfigWithDescriptions(obj, path32, sources, indent = 0) {
   const indentStr = "  ".repeat(indent);
@@ -113070,7 +113321,7 @@ function pad2(str, width) {
 init_source();
 init_engine();
 init_effectiveness();
-import { existsSync as existsSync31 } from "fs";
+import { existsSync as existsSync30 } from "fs";
 
 // src/context/engine/effectiveness-eval.ts
 init_errors();
@@ -113320,7 +113571,7 @@ async function contextInspectCommand(options) {
   }
 }
 var _effectivenessEvalDeps2 = {
-  existsSync: existsSync31,
+  existsSync: existsSync30,
   readLabels: async (path32) => {
     return await Bun.file(path32).text();
   },
@@ -113409,11 +113660,11 @@ init_config();
 init_fragments();
 init_logger2();
 init_source();
-import { existsSync as existsSync32 } from "fs";
+import { existsSync as existsSync31 } from "fs";
 import { join as join94 } from "path";
 var _contextFragmentsDeps = {
   loadPRD: async (path32) => {
-    if (!existsSync32(path32)) {
+    if (!existsSync31(path32)) {
       return { kind: "missing" };
     }
     try {
@@ -114066,7 +114317,7 @@ async function resolveRunProfileOverride(opts) {
 // src/cli/features-resolve.ts
 init_config();
 init_test_runners();
-import { existsSync as existsSync34, readdirSync as readdirSync6 } from "fs";
+import { existsSync as existsSync33, readdirSync as readdirSync6 } from "fs";
 import { join as join99, relative as relative17 } from "path";
 
 // src/cli/features-acceptance.ts
@@ -114074,7 +114325,7 @@ init_acceptance2();
 init_config();
 init_logger2();
 init_prd();
-import { existsSync as existsSync33 } from "fs";
+import { existsSync as existsSync32 } from "fs";
 import { join as join98, relative as relative16 } from "path";
 async function resolveFeatureAcceptance(featureName, workdir) {
   let enabled = true;
@@ -114090,7 +114341,7 @@ async function resolveFeatureAcceptance(featureName, workdir) {
       return { status: "disabled", enabled: false, groups: [] };
     }
     const prdPath = join98(naxDir, "features", featureName, "prd.json");
-    if (!existsSync33(prdPath)) {
+    if (!existsSync32(prdPath)) {
       return { status: "no-prd", enabled, groups: [] };
     }
     const prd = await loadPRD(prdPath);
@@ -114134,7 +114385,7 @@ async function resolveTestPatterns(workdir) {
   }
 }
 async function isNonEmptyFile(absolutePath) {
-  if (!existsSync34(absolutePath))
+  if (!existsSync33(absolutePath))
     return false;
   const content = await Bun.file(absolutePath).text();
   return content.trim().length > 0;
@@ -114159,7 +114410,7 @@ async function searchSpecSource(naxDir, repoRoot, name) {
     return { source: { kind: "markdown", path: relative17(repoRoot, docsSpecExact) }, checked };
   }
   const docsSpecsDir = join99(repoRoot, "docs", "specs");
-  if (existsSync34(docsSpecsDir)) {
+  if (existsSync33(docsSpecsDir)) {
     const glob = new Bun.Glob(`*${name}*.md`);
     for (const match of glob.scanSync({ cwd: docsSpecsDir, absolute: false })) {
       const abs = join99(docsSpecsDir, match);
@@ -114175,20 +114426,20 @@ async function searchSpecSource(naxDir, repoRoot, name) {
   const prdRel = relative17(repoRoot, prdAbs);
   if (!checked.includes(prdRel))
     checked.push(prdRel);
-  if (existsSync34(prdAbs)) {
+  if (existsSync33(prdAbs)) {
     return { source: { kind: "prd", path: prdRel }, checked };
   }
   return { source: null, checked };
 }
 function discoverCandidates(naxDir) {
   const featuresDir2 = join99(naxDir, "features");
-  if (!existsSync34(featuresDir2))
+  if (!existsSync33(featuresDir2))
     return [];
   return readdirSync6(featuresDir2, { withFileTypes: true }).filter((e) => {
     if (!e.isDirectory())
       return false;
     const dir = join99(featuresDir2, e.name);
-    return existsSync34(join99(dir, "prd.json")) || existsSync34(join99(dir, "spec.md"));
+    return existsSync33(join99(dir, "prd.json")) || existsSync33(join99(dir, "spec.md"));
   }).map((e) => e.name).sort();
 }
 async function resolveFeatureSpec(name, workdir) {
@@ -114202,7 +114453,7 @@ async function resolveFeatureSpec(name, workdir) {
   const repoRoot = join99(naxDir, "..");
   if (name !== undefined && (name.startsWith("./") || name.startsWith("/") || name.endsWith(".md"))) {
     const abs = name.startsWith("/") ? name : join99(workdir, name);
-    if (!existsSync34(abs)) {
+    if (!existsSync33(abs)) {
       return {
         status: "missing",
         featureName: null,
@@ -114242,7 +114493,7 @@ async function resolveFeatureSpec(name, workdir) {
       };
     }
     const featureDir2 = join99(naxDir, "features", name);
-    if (existsSync34(featureDir2)) {
+    if (existsSync33(featureDir2)) {
       return {
         status: "missing",
         featureName: name,
@@ -114624,7 +114875,7 @@ async function detectCommand(options) {
 
 // src/commands/logs.ts
 init_common();
-import { existsSync as existsSync36 } from "fs";
+import { existsSync as existsSync35 } from "fs";
 import { join as join104 } from "path";
 
 // src/commands/logs-formatter.ts
@@ -114635,7 +114886,7 @@ import { join as join103 } from "path";
 
 // src/commands/logs-reader.ts
 init_paths3();
-import { existsSync as existsSync35, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync34, readdirSync as readdirSync7 } from "fs";
 import { readdir as readdir6 } from "fs/promises";
 import { join as join102 } from "path";
 var _logsReaderDeps = {
@@ -114675,7 +114926,7 @@ async function resolveRunFileFromRegistry(runId) {
   if (!matched) {
     throw new Error(`Run not found in registry: ${runId}`);
   }
-  if (!existsSync35(matched.eventsDir)) {
+  if (!existsSync34(matched.eventsDir)) {
     console.log(`Log directory unavailable for run: ${runId}`);
     return null;
   }
@@ -114896,7 +115147,7 @@ async function logsCommand(options) {
   const featureName = resolveSingleFeature(naxDir, "pass -r <runId> (see `nax runs list`)");
   const featureDir2 = join104(naxDir, "features", featureName);
   const runsDir = join104(featureDir2, "runs");
-  if (!existsSync36(runsDir)) {
+  if (!existsSync35(runsDir)) {
     throw new Error(`No runs directory found for feature: ${featureName}`);
   }
   if (options.list) {
@@ -114920,7 +115171,7 @@ init_config();
 init_prd();
 init_precheck();
 init_common();
-import { existsSync as existsSync37 } from "fs";
+import { existsSync as existsSync36 } from "fs";
 import { join as join105 } from "path";
 async function precheckCommand(options) {
   const resolved = resolveProject2({
@@ -114945,11 +115196,11 @@ async function precheckCommand(options) {
   }
   const featureDir2 = join105(naxDir, "features", featureName);
   const prdPath = join105(featureDir2, "prd.json");
-  if (!existsSync37(featureDir2)) {
+  if (!existsSync36(featureDir2)) {
     console.error(source_default.red(`Feature not found: ${featureName}`));
     process.exit(1);
   }
-  if (!existsSync37(prdPath)) {
+  if (!existsSync36(prdPath)) {
     console.error(source_default.red(`Missing prd.json for feature: ${featureName}`));
     console.error(source_default.dim(`Run: nax plan -f ${featureName} --from spec.md --auto`));
     process.exit(EXIT_CODES.INVALID_PRD);
@@ -114966,7 +115217,7 @@ async function precheckCommand(options) {
 // src/commands/replay.ts
 init_errors();
 init_metrics();
-import { existsSync as existsSync38 } from "fs";
+import { existsSync as existsSync37 } from "fs";
 import { dirname as dirname19 } from "path";
 
 // src/replay/discovery.ts
@@ -115253,7 +115504,7 @@ function renderReport(timeline, options = {}) {
 
 // src/commands/replay.ts
 async function readJsonlLenient(path32) {
-  if (!existsSync38(path32))
+  if (!existsSync37(path32))
     return [];
   const content = await Bun.file(path32).text();
   const lines = content.split(`
@@ -115270,7 +115521,7 @@ async function readJsonlLenient(path32) {
   return entries;
 }
 async function readJsonOrUndefined(path32) {
-  if (!existsSync38(path32))
+  if (!existsSync37(path32))
     return;
   try {
     return await Bun.file(path32).json();
@@ -115362,12 +115613,12 @@ init_paths();
 init_errors();
 init_checkpoint();
 init_runtime();
-import { existsSync as existsSync39 } from "fs";
+import { existsSync as existsSync38 } from "fs";
 import { basename as basename21, join as join107 } from "path";
 async function defaultCheckpointExists(featureDir2) {
-  if (!featureDir2 || !existsSync39(featureDir2))
+  if (!featureDir2 || !existsSync38(featureDir2))
     return false;
-  return existsSync39(join107(featureDir2, "checkpoint.jsonl"));
+  return existsSync38(join107(featureDir2, "checkpoint.jsonl"));
 }
 async function defaultLoadCheckpoints(featureDir2) {
   return loadCheckpoints(featureDir2);
@@ -115417,7 +115668,7 @@ function registerResumeCommand(program2) {
     const { findProjectDir: findProjectDir2 } = await Promise.resolve().then(() => (init_config(), exports_config));
     const { run: run2 } = await Promise.resolve().then(() => (init_execution2(), exports_execution));
     const { applyResumeModeDeps: applyResumeModeDeps2 } = await Promise.resolve().then(() => (init_checkpoint(), exports_checkpoint));
-    const { existsSync: existsSync40, mkdirSync: mkdirSync8 } = await import("fs");
+    const { existsSync: existsSync39, mkdirSync: mkdirSync8 } = await import("fs");
     const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), exports_config));
     const { loadPRD: loadPRD2 } = await Promise.resolve().then(() => (init_prd(), exports_prd));
     const { loadHooksConfig: loadHooksConfig2 } = await Promise.resolve().then(() => (init_hooks(), exports_hooks));
@@ -115434,7 +115685,7 @@ function registerResumeCommand(program2) {
       runInvocation: async (feature, opts) => {
         const config2 = await loadConfig2(naxDir ?? undefined);
         const prdPath = join107(opts.featureDir ?? "", "prd.json");
-        if (!existsSync40(prdPath)) {
+        if (!existsSync39(prdPath)) {
           process.stderr.write(`Feature "${feature}" not found or missing prd.json
 `);
           return 1;
@@ -123569,151 +123820,18 @@ program2.command("init").description("Initialize nax in the current project").op
     console.error(source_default.red(`Invalid directory: ${err.message}`));
     process.exit(1);
   }
-  if (options.package) {
-    const { initPackage: initPkg } = await Promise.resolve().then(() => (init_init_context(), exports_init_context));
-    try {
-      await initPkg(workdir, options.package, options.force);
-      console.log(source_default.green(`
-[OK] Package scaffold created.`));
-      console.log(source_default.dim(`  Created: ${options.package}/nax/context.md`));
-      console.log(source_default.dim(`
-Next: nax generate --package ${options.package}`));
-    } catch (err) {
-      console.error(source_default.red(`Error: ${err.message}`));
-      process.exit(1);
-    }
-    return;
-  }
-  const naxDir = join115(workdir, ".nax");
-  if (existsSync41(naxDir) && !options.force) {
-    console.log(source_default.yellow("nax already initialized. Use --force to overwrite."));
-    return;
-  }
-  if (options.name) {
-    const { validateProjectName: validateProjectName2, checkInitCollision: checkInitCollision2 } = await Promise.resolve().then(() => (init_init2(), exports_init));
-    const nameValidation = validateProjectName2(options.name);
-    if (!nameValidation.valid) {
-      console.error(source_default.red(`Invalid project name "${options.name}": ${nameValidation.error}`));
-      process.exit(1);
-    }
-    if (!options.force) {
-      const collision = await checkInitCollision2(options.name, workdir, null);
-      if (collision.collision && collision.existing) {
-        console.error(source_default.red([
-          `Project name collision: "${options.name}"`,
-          `  This project:    ${workdir}`,
-          `  Already in use:  ${collision.existing.workdir}  (last run: ${collision.existing.lastSeen})`,
-          "  Resolve:",
-          "    1. Rename: choose a different --name",
-          `    2. Reclaim: nax migrate --reclaim ${options.name}`,
-          `    3. Merge:   nax migrate --merge ${options.name}`
-        ].join(`
-`)));
-        process.exit(1);
-      }
-    }
-  }
-  mkdirSync8(join115(naxDir, "features"), { recursive: true });
-  mkdirSync8(join115(naxDir, "hooks"), { recursive: true });
-  const initConfig = options.name ? { ...DEFAULT_CONFIG, name: options.name } : DEFAULT_CONFIG;
-  await Bun.write(join115(naxDir, "config.json"), JSON.stringify(initConfig, null, 2));
-  await Bun.write(join115(naxDir, "hooks.json"), JSON.stringify({
-    hooks: {
-      "on-start": { command: 'echo "nax started: $NAX_FEATURE"', enabled: false },
-      "on-complete": { command: 'echo "nax complete: $NAX_FEATURE"', enabled: false },
-      "on-pause": { command: 'echo "nax paused: $NAX_REASON"', enabled: false },
-      "on-error": { command: 'echo "nax error: $NAX_REASON"', enabled: false }
-    }
-  }, null, 2));
-  await Bun.write(join115(naxDir, ".gitignore"), `# nax temp files
-*.tmp
-.paused.json
-.nax-verifier-verdict.json
-`);
-  await Bun.write(join115(naxDir, "context.md"), `# Project Context
-
-This document defines coding standards, architectural decisions, and forbidden patterns for this project.
-Run \`nax generate\` to regenerate agent config files (CLAUDE.md, AGENTS.md, .cursorrules, etc.) from this file.
-
-> Project metadata (dependencies, commands) is auto-injected by \`nax generate\`.
-
-## Coding Standards
-
-- Follow the project's existing code style and conventions
-- Write clear, self-documenting code with meaningful names
-- Keep functions small and focused (single responsibility)
-- Prefer immutability over mutation
-- Use consistent formatting throughout the codebase
-
-## Testing Requirements
-
-- All new code must include tests
-- Tests should cover happy paths, edge cases, and error conditions
-- Aim for high test coverage (80%+ recommended)
-- Tests must pass before marking a story as complete
-- Before writing tests, read existing test files to understand what is already covered
-- Do not duplicate test coverage that prior stories already wrote
-- Focus on testing NEW behavior introduced by this story
-
-## Architecture Rules
-
-- Follow the project's existing architecture patterns
-- Each module should have a clear, single purpose
-- Avoid tight coupling between modules
-- Use dependency injection where appropriate
-- Document architectural decisions in comments or docs
-
-## Forbidden Patterns
-
-- No hardcoded secrets, API keys, or credentials
-- No console.log in production code (use proper logging)
-- No \`any\` types in TypeScript (use proper typing)
-- No commented-out code (use version control instead)
-- No large files (split into smaller, focused modules)
-
-## Commit Standards
-
-- Write clear, descriptive commit messages
-- Follow conventional commits format (feat:, fix:, refactor:, etc.)
-- Commit early and often with atomic changes
-- Reference story IDs in commit messages
-
-## Documentation
-
-- Add JSDoc comments for public APIs
-- Update README when adding new features
-- Document complex algorithms or business logic
-- Keep documentation up-to-date with code changes
-
----
-
-**Note:** Customize this file to match your project's specific needs.
-`);
+  const { initCommand: initCommand2 } = await Promise.resolve().then(() => (init_init2(), exports_init));
   try {
-    await promptsInitCommand({
-      workdir,
+    await initCommand2({
+      projectRoot: workdir,
+      name: options.name,
       force: options.force,
-      autoWireConfig: false
+      package: options.package
     });
   } catch (err) {
-    console.error(source_default.red(`Failed to initialize templates: ${err.message}`));
+    console.error(source_default.red(`Error: ${err.message}`));
     process.exit(1);
   }
-  console.log(source_default.green("\u2705 Initialized nax"));
-  console.log(source_default.dim(`   ${naxDir}/`));
-  console.log(source_default.dim("   \u251C\u2500\u2500 config.json"));
-  console.log(source_default.dim("   \u251C\u2500\u2500 context.md"));
-  console.log(source_default.dim("   \u251C\u2500\u2500 hooks.json"));
-  console.log(source_default.dim("   \u251C\u2500\u2500 features/"));
-  console.log(source_default.dim("   \u251C\u2500\u2500 hooks/"));
-  console.log(source_default.dim("   \u2514\u2500\u2500 templates/"));
-  console.log(source_default.dim("       \u251C\u2500\u2500 test-writer.md"));
-  console.log(source_default.dim("       \u251C\u2500\u2500 implementer.md"));
-  console.log(source_default.dim("       \u251C\u2500\u2500 verifier.md"));
-  console.log(source_default.dim("       \u251C\u2500\u2500 single-session.md"));
-  console.log(source_default.dim("       \u2514\u2500\u2500 tdd-simple.md"));
-  console.log(source_default.dim(`
-Next: nax features create <name>`));
 });
 program2.command("setup").description("Analyze repo and generate .nax/config.json via LLM").option("-d, --dir <path>", "Project directory", process.cwd()).option("-a, --agent <name>", "Force a specific agent").option("--fill-scripts", "Add missing quality-gate scripts to package.json", false).option("--dry-run", "Preview planned config without writing files", false).option("--force", "Overwrite existing .nax/config.json", false).action(async (options) => {
   let workdir;
@@ -123793,7 +123911,7 @@ program2.command("run").description("Run the orchestration loop for a feature").
     console.error(source_default.red("Error: --plan requires --from <spec-path>"));
     process.exit(1);
   }
-  if (options.from && !existsSync41(options.from)) {
+  if (options.from && !existsSync40(options.from)) {
     console.error(source_default.red(`Error: File not found: ${options.from} (required with --plan)`));
     process.exit(1);
   }
@@ -123837,7 +123955,7 @@ program2.command("run").description("Run the orchestration loop for a feature").
   const featureDir2 = join115(naxDir, "features", options.feature);
   const prdPath = join115(featureDir2, "prd.json");
   if (options.plan && options.from) {
-    if (existsSync41(prdPath) && !options.force) {
+    if (existsSync40(prdPath) && !options.force) {
       console.error(source_default.red(`Error: prd.json already exists for feature "${options.feature}".`));
       console.error(source_default.dim("   Use --force to overwrite, or run without --plan to use the existing PRD."));
       process.exit(1);
@@ -123901,7 +124019,7 @@ program2.command("run").description("Run the orchestration loop for a feature").
       process.exit(1);
     }
   }
-  if (!existsSync41(prdPath)) {
+  if (!existsSync40(prdPath)) {
     console.error(source_default.red(`Feature "${options.feature}" not found or missing prd.json`));
     process.exit(1);
   }
@@ -124040,7 +124158,7 @@ Scheduled run cancelled.`));
   }
   const latestSymlink = join115(runsDir, "latest.jsonl");
   try {
-    if (existsSync41(latestSymlink)) {
+    if (existsSync40(latestSymlink)) {
       Bun.spawnSync(["rm", latestSymlink]);
     }
     Bun.spawnSync(["ln", "-s", `${runId}.jsonl`, latestSymlink], {
@@ -124200,7 +124318,7 @@ features.command("list").description("List all features").option("-d, --dir <pat
     process.exit(1);
   }
   const featuresDir2 = join115(naxDir, "features");
-  if (!existsSync41(featuresDir2)) {
+  if (!existsSync40(featuresDir2)) {
     console.log(source_default.dim("No features yet."));
     return;
   }
@@ -124215,7 +124333,7 @@ Features:
 `));
   for (const name of entries) {
     const prdPath = join115(featuresDir2, name, "prd.json");
-    if (existsSync41(prdPath)) {
+    if (existsSync40(prdPath)) {
       const prd = await loadPRD(prdPath);
       const c = countStories(prd);
       console.log(`  ${name} \u2014 ${c.passed}/${c.total} stories done`);