@ornexus/neocortex 4.60.66 → 4.60.68

package/packages/client/dist/private-execution/isolated-session.js

@@ -1,5 +1,725 @@
-import{execFileSync as ge,spawnSync as _e}from"node:child_process";import{createCipheriv as Ae,createHash as T,randomBytes as Ee,randomUUID as Oe}from"node:crypto";import{existsSync as Y,lstatSync as U,mkdirSync as qe,readFileSync as R,unlinkSync as Te}from"node:fs";import{homedir as De}from"node:os";import{basename as Ge,dirname as Be,join as v,resolve as _}from"node:path";import{isRootProjectMemoryEffect as Ce,rootProjectMemoryPaths as Me}from"./shared-root-memory-types.js";import{readPrivateRootMemoryScope as Ne,privateRootMemoryEffect as xe}from"./root-memory-scope.js";import{executeRootMemoryWriter as ze,rootMemoryFileState as Re,verifyRootMemoryWriterExecution as He}from"./root-memory-writer.js";import{rootMemoryGitFileState as $e,verifyRootMemoryEffectGitEvidence as Le}from"./root-memory-git-evidence.js";import{parsePrivateRootMemoryRequest as Ye}from"./root-memory-request.js";import{rootMemoryOperationJournalName as Je,readVerifiedPreparedRootMemory as Ve}from"./root-memory-recovery.js";import{assertProjectMemoryPaths as Fe}from"../memory/project-memory-path-scope.js";import{isDeepStrictEqual as J}from"node:util";import{acquireGitLifecyclePhysicalIntegrationLock as We,applyGitLifecycleRuntimeOverlay as Qe,assertGitLifecyclePrivateFile as X,ensureGitLifecyclePrivateChildDirectory as Z,gitLifecycleRuntimeDirectory as ke,mutateGitLifecycleRuntime as Ke,readGitLifecycleRuntimeSync as ue,releaseGitLifecyclePhysicalIntegrationLock as Ue}from"../git/git-lifecycle-store.js";import{anchoredAtomicWriteFile as z,anchoredDirectoryIdentity as Xe,anchoredExecuteGit as Ze}from"../git/secure-filesystem-boundary.js";import{privateYoloRootOnlySetupReady as et,readPrivateYoloFrozenWriteSet as M,readPrivateYoloFrozenWriteSetForTransition as tt}from"./clean-baseline.js";import{admitPrivateYoloFrozenWorkspace as at,verifyPrivateYoloSnapshotBoundary as V,verifyPrivateYoloRejectedCandidateOrigin as ot}from"./isolated-admission.js";import{preparePrivateYoloIsolatedWorkspace as st}from"./isolated-workspace.js";async function bt(t,a,e={}){const o=Ye(a),{directive:r,review:s}=o,i=_(t),n=r.storyId,f=n.split(".")[0],p=d=>T("sha256").update(d).digest("hex");let h="session";const u=()=>{throw new Error(`private-root-memory-acceptance-${h}-unverified`)};try{return await G(i,n,I(i,n),async()=>{const d=ue(i,{required:!0}),m=d.epics[f],l=m?.branch_lease,c=await D(i,n);if(!c||m?.graph_revision!==r.graphRevision||l?.ownerStoryId!==n||typeof l.expiresAt!="string"||Date.parse(l.expiresAt)<=Date.now()||c.workspace.executionBranch!==r.executionBranch)return u();te(c,i,n,r.graphRevision);const S=await Z(await ke(i),"private-execution"),H=Je(c,o),B=c.rootMemoryEffect===void 0&&Y(v(S,H));B||await A(c,i,n,r.graphRevision);const W=await Xe(i);h="source-evidence",Fe(i,[".neocortex/state.json",`.neocortex/stories/${n}/validation-evidence.md`]);const E=R(v(i,".neocortex/state.json"));if(p(E)!==s.sourceStateSha256)return u();const y=Qe(JSON.parse(E.toString("utf8")),d).stories?.[n];if(!y||y.checkpoint!==void 0||!Array.isArray(y.steps_completed))return u();const ae=[...y.steps_completed],oe=`.neocortex/stories/${n}/validation-evidence.md`,$=U(v(i,oe));if(!$.isFile()||$.isSymbolicLink()||$.nlink!==1||$.size<128||$.size>256*1024||p(R(v(i,oe)))!==s.proposalSha256)return u();const we=v(S,`qa-review-${s.rootQaReceiptId}.json`);h="qa-predecessor",await X(we,S);const se=R(we);if(se.length>16384||p(se)!==s.rootQaReceiptId)return u();const q=JSON.parse(se.toString("utf8"));if(q.kind!=="private-qa-root-review"||q.storyId!==n||q.sourceHeadSha!==c.workspace.baseSha||q.precommitQaAccepted!==!0||q.independentStoryQaAccepted!==!1||q.terminalAccepted!==!1)return u();const re=p(JSON.stringify(s.notes)),ie=w=>`memory-review-${p(JSON.stringify(w))}.json`,me=y.status==="qa-gate-passed"&&typeof y.last_step=="string"&&p(y.last_step)==="8721319de90ade506bc9b72a908d8296856b34a11bc640629178bed3fe32e373"&&ae.at(-1)===y.last_step,Se=async w=>{await Ke(i,j=>{if(!J(j.epics[f],m)||!J(j.stories[n],d.stories[n]))return u();j.stories[n]={...j.stories[n],status:"memory-updated",last_step:s.rawStepId,steps_completed:[...ae,s.rawStepId]}},{expectedRevision:d.revision,preCommit:async()=>{await A(w,i,n,r.graphRevision)}})};if(c.rootMemoryEffect){if(h="replay",c.rootMemoryEffect.sourceSnapshotSha!==s.snapshotSha||c.rootMemoryEffect.proposalSha256!==re||c.rootMemoryEffect.rootQaReceiptId!==s.rootQaReceiptId)return u();const w=v(S,ie(c.rootMemoryEffect));await X(w,S);const j=R(w),k=JSON.parse(j.toString("utf8"));if(k.proposalSha256!==s.proposalSha256||k.notesSha256!==re||!J(k.rootMemoryEffect,c.rootMemoryEffect))return u();const C=y.status==="memory-updated"&&y.last_step===s.rawStepId&&ae.at(-1)===s.rawStepId;return!C&&!me?u():(C||(h="phase-recovery",await Se(c)),{schemaVersion:1,outcome:"project-memory-root-accepted",storyId:n,graphRevision:r.graphRevision,receiptId:p(j),snapshotSha:c.snapshotSha,reused:!0,sourceStateUnchanged:!0,phaseRecovered:!C,independentStoryQaAccepted:!1,terminalAccepted:!1,publicSafe:!0})}if(c.snapshotSha!==s.snapshotSha||!me)return u();const P=c.workspace.workspacePath;g(P,["merge-base","--is-ancestor",q.snapshotSha,c.snapshotSha]);const Pe=[`.neocortex/stories/${n}/qa-gate-result.json`,oe,`.neocortex/stories/${n}/tdd-evidence.md`,`docs/stories/${n}.rtm.md`];if(b(P,["diff","--name-only","-z",q.snapshotSha,c.snapshotSha]).toString("utf8").split("\0").filter(Boolean).some(w=>!Pe.includes(w)))return u();const ne=await M(i,n,r.executionBranch,r.graphRevision);if(!fe(i,["diff","--cached","--quiet"]))return u();const je=b(i,["status","--porcelain=v1","-z","--untracked-files=all"]);let x,Q,N,K=!1;if(B){h="prepared-recovery";const w=await Ve({projectRoot:i,parent:S,current:c,request:o,childPaths:ne});x=w.effect,Q=w.receipt,N=w.patch,K=w.sourceAlreadyApplied}else{for(const L of Me())if(ne.includes(L)||!J(Re(i,L),$e(P,c.snapshotSha,L)))return u();h="writer";const w=await Z(S,"memory-backups"),j=ze({snapshotRoot:P,expectedSnapshotSha:c.snapshotSha,notes:s.notes,backupDirectory:w}),k=He(j);h="writer-snapshot",k.files.length&&(g(P,["add","-A","--",...k.files.map(L=>L.path)]),g(P,["-c","core.hooksPath=/dev/null","-c","commit.gpgsign=false","-c","user.name=Neocortex Private Session","-c","user.email=private-session@neocortex.invalid","commit","-q","-m",`private root memory ${n} ${c.sequence+1}`]));const C=g(P,["rev-parse","HEAD"]);x={schemaVersion:"RootProjectMemoryEffect/1",producer:"root-project-memory",storyId:n,epicId:f,executionBranch:r.executionBranch,sourceHeadSha:c.workspace.baseSha,sourceSnapshotSha:c.snapshotSha,memorySnapshotSha:C,graphRevision:r.graphRevision,childClaimRevision:p([...ne].sort().join("\0")),setupSessionId:c.setupSessionId,rootQaReceiptId:s.rootQaReceiptId,proposalSha256:k.notesSha256,canonicalSha256:k.verification.canonicalSha256,projectionSha256:k.verification.projectionSha256,projectionFileCount:k.verification.fileCount,files:k.files,recordedAt:s.reviewedAt,publicSafe:!0},h="git-evidence",Le(P,x,{storyId:n,graphRevision:r.graphRevision,childClaimRevision:x.childClaimRevision,setupSessionId:c.setupSessionId,sourceHeadSha:c.workspace.baseSha,executionBranch:r.executionBranch}),N=b(P,["diff","--binary","--full-index",c.snapshotSha,C]),Q={schemaVersion:1,kind:"private-project-memory-root-review",storyId:n,graphRevision:r.graphRevision,sourceHeadSha:c.workspace.baseSha,snapshotSha:C,proposalSha256:s.proposalSha256,notesSha256:re,sourceStateSha256:s.sourceStateSha256,checks:s.checks,reviewedAt:s.reviewedAt,rootMemoryEffect:x,independentStoryQaAccepted:!1,terminalAccepted:!1},h="prepared-journal",await z(S,H,JSON.stringify({schemaVersion:1,kind:"prepared-root-memory-effect",previousSession:c,receipt:Q,patchSha256:p(N)})+`
-`),await e.fault?.("after-prepared-journal")}const ce=JSON.stringify(Q)+`
-`,ye=x.memorySnapshotSha;if(h="source-admission",!b(i,["status","--porcelain=v1","-z","--untracked-files=all"]).equals(je)||g(i,["rev-parse","HEAD"])!==c.workspace.baseSha||g(i,["symbolic-ref","--short","HEAD"])!==r.executionBranch)return u();if(!K){for(const w of x.files)if(!J(Re(i,w.path),w.before))return u()}const ve=w=>Ze(Be(i),Ge(i),W,["apply",...w?["--check"]:[],"--binary","-"],N);if(N.length&&!K&&(await ve(!0),await ve(!1)),await e.fault?.("after-source-admission"),!R(v(i,".neocortex/state.json")).equals(E))return u();const pe=v(S,ie(x));if(Y(pe)){if(await X(pe,S),R(pe,"utf8")!==ce)return u()}else await z(S,ie(x),ce);const he=Object.freeze({...c,snapshotSha:ye,sequence:c.sequence+(x.files.length?1:0),lastPatchSha256:x.files.length?p(N):c.lastPatchSha256,rootMemoryEffect:x});return h="session-pin",await e.fault?.("before-session-pin"),await F(i,he),await A(he,i,n,r.graphRevision),h="phase-transition",await Se(he),{schemaVersion:1,outcome:"project-memory-root-accepted",storyId:n,graphRevision:r.graphRevision,receiptId:p(ce),snapshotSha:ye,reused:B,sourceStateUnchanged:!0,preparedRecovered:B,sourceWriteReused:K,independentStoryQaAccepted:!1,terminalAccepted:!1,publicSafe:!0}})}catch(d){if(d instanceof Error&&/^(private-root-memory|private-execution-isolated)-[a-z0-9-]+$/.test(d.message)?d.message:void 0)throw new Error(`private-root-memory-acceptance-${h}-unverified`,{cause:d});return u()}}function g(t,a){const e={...process.env};for(const o of["GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_OBJECT_DIRECTORY","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_COMMON_DIR","GIT_NAMESPACE","GIT_CEILING_DIRECTORIES"])delete e[o];return ge("git",[...a],{cwd:t,env:e,encoding:"utf8",stdio:["ignore","pipe","pipe"],timeout:3e4,maxBuffer:16*1024*1024}).trim()}function b(t,a){const e={...process.env};for(const o of["GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_OBJECT_DIRECTORY","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_COMMON_DIR","GIT_NAMESPACE","GIT_CEILING_DIRECTORIES"])delete e[o];return ge("git",[...a],{cwd:t,env:e,stdio:["ignore","pipe","pipe"],timeout:3e4,maxBuffer:16*1024*1024})}function fe(t,a){const e={...process.env};for(const r of["GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_OBJECT_DIRECTORY","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_COMMON_DIR","GIT_NAMESPACE","GIT_CEILING_DIRECTORIES"])delete e[r];const o=_e("git",[...a],{cwd:t,env:e,stdio:"ignore",timeout:3e4});if(o.error||o.signal)throw new Error("git-unverified");return o.status===0}async function de(t,a){const e=await ke(t),o=await Z(e,"private-execution"),r=`session-${T("sha256").update(a).digest("hex")}.json`;return{parent:o,name:r,path:v(o,r)}}function I(t,a){const e=a.split(".")[0],r=ue(t,{required:!0}).epics[e]?.branch_lease,s=r&&typeof r=="object"&&!Array.isArray(r)?r:void 0,i=s?.sessionId;if(s?.ownerStoryId!==a||typeof i!="string"||!/^setup-[a-f0-9]{64}$/.test(i)||i!==s.idempotencyKey)throw new Error("session-lease-invalid");return i}function be(t,a){const e=ue(t,{required:!0}).stories[a];return et(e)}function rt(t){const a=JSON.parse(t);if(!a||typeof a!="object"||Array.isArray(a))throw new Error("session-invalid");const e=a,o=e.workspace;if(Object.keys(e).sort().join(",")!==["schemaVersion","kind","storyId","initialGraphRevision","graphRevision","graphHistory","setupSessionId","workspace","snapshotSha","sequence","lastPatchSha256",...e.rootMemoryEffect===void 0?[]:["rootMemoryEffect"]].sort().join(",")||e.schemaVersion!==1||e.kind!=="private-yolo-isolated-session"||typeof e.storyId!="string"||!/^[A-Za-z][A-Za-z0-9_-]*\.[A-Za-z0-9._-]+$/.test(e.storyId)||typeof e.initialGraphRevision!="string"||!/^[a-f0-9]{64}$/.test(e.initialGraphRevision)||typeof e.graphRevision!="string"||!/^[a-f0-9]{64}$/.test(e.graphRevision)||!Array.isArray(e.graphHistory)||e.graphHistory.length<1||e.graphHistory.length>65||e.graphHistory.some(s=>typeof s!="string"||!/^[a-f0-9]{64}$/.test(s))||new Set(e.graphHistory).size!==e.graphHistory.length||e.graphHistory[0]!==e.initialGraphRevision||e.graphHistory[e.graphHistory.length-1]!==e.graphRevision||typeof e.setupSessionId!="string"||!/^setup-[a-f0-9]{64}$/.test(e.setupSessionId)||typeof e.snapshotSha!="string"||!/^[a-f0-9]{40,64}$/.test(e.snapshotSha)||!Number.isSafeInteger(e.sequence)||Number(e.sequence)<0||Number(e.sequence)>64||Number(e.sequence)===0&&e.initialGraphRevision!==e.graphRevision&&e.graphHistory.length!==2||Number(e.sequence)===0&&e.lastPatchSha256!==null||Number(e.sequence)>0&&e.lastPatchSha256===null||e.lastPatchSha256!==null&&(typeof e.lastPatchSha256!="string"||!/^[a-f0-9]{64}$/.test(e.lastPatchSha256))||e.rootMemoryEffect!==void 0&&!Ce(e.rootMemoryEffect)||!o||typeof o!="object"||Array.isArray(o))throw new Error("session-invalid");const r=o;if(Object.keys(r).sort().join(",")!==["schemaVersion","sourceRoot","workspacePath","baseSha","executionBranch"].sort().join(",")||r.schemaVersion!==1||typeof r.sourceRoot!="string"||typeof r.workspacePath!="string"||typeof r.baseSha!="string"||!/^[a-f0-9]{40,64}$/.test(r.baseSha)||typeof r.executionBranch!="string"||!r.executionBranch)throw new Error("session-invalid");return e}async function D(t,a){const e=await de(t,a);if(Y(e.path))return await X(e.path,e.parent),rt(R(e.path,"utf8"))}async function F(t,a){const e=await de(t,a.storyId);await z(e.parent,e.name,`${JSON.stringify(a)}
-`)}async function G(t,a,e,o){const r=await We(t,{kind:"direct",storyId:a,sessionId:e,idempotencyKey:e,expiresAt:new Date(Date.now()+3e5).toISOString(),persistent:!1});if(!r.ok)throw new Error("private-execution-isolated-session-backpressure");try{return await o()}finally{if(!await Ue(r.path,r.owner))throw new Error("private-execution-isolated-session-lock-unverified")}}async function A(t,a,e,o){te(t,a,e,o);const r=await M(a,e,t.workspace.executionBranch,o),s=await ee(t,r);return V(t.workspace,r,t.snapshotSha,s),s}async function ee(t,a){if(t.rootMemoryEffect===void 0)return;const e=await Ne({projectRoot:t.workspace.sourceRoot,storyId:t.storyId,snapshotRoot:t.workspace.workspacePath,snapshotSha:t.snapshotSha,sourceHeadSha:t.workspace.baseSha,executionBranch:t.workspace.executionBranch,graphRevision:t.graphRevision,setupSessionId:t.setupSessionId,childPaths:a});if(!e||JSON.stringify(xe(e))!==JSON.stringify(t.rootMemoryEffect))throw new Error("private-root-memory-scope-unverified");return e}function te(t,a,e,o){if(t.storyId!==e||t.graphRevision!==o||t.workspace.sourceRoot!==a||t.setupSessionId!==I(a,e)||t.sequence===0&&t.snapshotSha!==t.workspace.baseSha||t.sequence===0&&t.graphHistory.length>1&&!be(a,e)||t.sequence>0&&t.snapshotSha===t.workspace.baseSha)throw new Error("session-binding-invalid")}async function It(t,a,e){const o=_(t.sourceRoot);try{const r=I(o,a);return await G(o,a,r,async()=>{const s=await D(o,a);if(s){if(await A(s,o,a,e),s.workspace.workspacePath!==t.workspacePath)throw new Error("session-replacement-denied");return s}const i=await M(o,a,t.executionBranch,e);V(t,i,t.baseSha);const n=Object.freeze({schemaVersion:1,kind:"private-yolo-isolated-session",storyId:a,initialGraphRevision:e,graphRevision:e,graphHistory:[e],setupSessionId:r,workspace:t,snapshotSha:t.baseSha,sequence:0,lastPatchSha256:null});return await F(o,n),n})}catch{throw new Error("private-execution-isolated-session-unverified")}}async function Ie(t,a,e,o){if(t.graphRevision===o)return await A(t,a,e,o),t;if(t.storyId!==e||t.workspace.sourceRoot!==a||t.setupSessionId!==I(a,e)||t.sequence===0&&(t.graphHistory.length!==1||t.lastPatchSha256!==null||!be(a,e))||t.sequence>0&&t.lastPatchSha256===null||t.graphHistory.includes(o)||t.graphHistory.length>=65)throw new Error("session-graph-transition-invalid");const r=await tt(a,e,t.workspace.executionBranch,t.initialGraphRevision,o);V(t.workspace,r,t.snapshotSha,await ee(t,r));const s=Object.freeze({...t,graphRevision:o,graphHistory:Object.freeze([...t.graphHistory,o])});return await F(a,s),await A(s,a,e,o),s}async function Pt(t,a,e){const o=_(t);try{const r=I(o,a);return await G(o,a,r,async()=>{const s=await D(o,a);if(!s)throw new Error("session-missing");return Ie(s,o,a,e)})}catch{throw new Error("private-execution-isolated-session-unverified")}}async function jt(t,a,e,o){const r=_(t);try{const s=I(r,a);return await G(r,a,s,async()=>{const i=await D(r,a);if(i)return Ie(i,r,a,e);const n=o??v(De(),".local","share","neocortex","private-yolo-workspaces");o===void 0&&qe(n,{recursive:!0,mode:448});const f=st(r,n),p=await M(r,a,f.executionBranch,e);V(f,p,f.baseSha);const h=Object.freeze({schemaVersion:1,kind:"private-yolo-isolated-session",storyId:a,initialGraphRevision:e,graphRevision:e,graphHistory:[e],setupSessionId:s,workspace:f,snapshotSha:f.baseSha,sequence:0,lastPatchSha256:null});return await F(r,h),h})}catch{throw new Error("private-execution-isolated-session-unverified")}}async function _t(t,a,e){const o=_(t);try{const r=await D(o,a);if(!r)throw new Error("session-missing");return await A(r,o,a,e),r}catch{throw new Error("private-execution-isolated-session-unverified")}}async function At(t,a,e){const o=_(t);try{const r=I(o,a);return await G(o,a,r,async()=>{const s=await D(o,a);if(!s)throw new Error("session-missing");te(s,o,a,e);const i=await M(o,a,s.workspace.executionBranch,e),n=await ee(s,i),f=await at(s.workspace,a,e,s.snapshotSha,!1,n);g(s.workspace.workspacePath,["add","-A","--",...f.changedPaths]),g(s.workspace.workspacePath,["-c","core.hooksPath=/dev/null","-c","commit.gpgsign=false","-c","user.name=Neocortex Private Session","-c","user.email=private-session@neocortex.invalid","commit","-q","-m",`private snapshot ${a} ${s.sequence+1}`]);const p=g(s.workspace.workspacePath,["rev-parse","HEAD"]);V(s.workspace,i,p,n);const h=Object.freeze({...s,snapshotSha:p,sequence:s.sequence+1,lastPatchSha256:f.patchSha256});return await F(o,h),{session:h,admission:f}})}catch{throw new Error("private-execution-isolated-session-unverified")}}async function Ot(t,a,e){const o=_(t);try{const r=I(o,a);return await G(o,a,r,async()=>{const s=await D(o,a);if(!s||s.sequence<1)throw new Error("session-incomplete");const i=await A(s,o,a,e),n=await M(o,a,s.workspace.executionBranch,e),f=s.workspace.workspacePath,p=b(f,["diff","--name-only","-z",s.workspace.baseSha,s.snapshotSha]).toString("utf8").split("\0").filter(Boolean).sort(),h=[".neocortex/state.json",`docs/stories/${a}.story.md`,`.neocortex/stories/${a}/qa-gate-result.json`,`.neocortex/stories/${a}/validation-evidence.md`,`.neocortex/stories/${a}/review.md`];if(p.length===0||p.length>1024||new Set(p).size!==p.length||p.some(l=>!n.includes(l)&&!(i&&xe(i).files.some(c=>c.path===l)))||h.some(l=>!p.includes(l)))throw new Error("bundle-incomplete");if(!fe(o,["diff","--cached","--quiet"])||b(o,["ls-files","-u","-z"]).byteLength!==0)throw new Error("index-not-clean");const u=b(f,["diff","--binary","--full-index",s.workspace.baseSha,s.snapshotSha]);if(u.byteLength===0)throw new Error("bundle-empty");g(o,["add","-A","--",...p]);const d=b(o,["diff","--cached","--binary","--full-index"]),m=b(o,["diff","--cached","--name-only","-z"]).toString("utf8").split("\0").filter(Boolean).sort();if(!d.equals(u)||m.length!==p.length||m.some((l,c)=>l!==p[c])||!fe(o,["diff","--quiet"])||g(o,["rev-parse","HEAD"])!==s.workspace.baseSha||g(o,["symbolic-ref","--quiet","--short","HEAD"])!==s.workspace.executionBranch)throw new Error("bundle-raced");return Object.freeze({schemaVersion:1,outcome:"staged-unverified",snapshotSha:s.snapshotSha,bundleSha256:T("sha256").update(d).digest("hex"),changedPaths:Object.freeze(p)})})}catch{throw new Error("private-execution-root-stage-unverified")}}function it(t){const a=t.workspace.workspacePath,e=b(a,["status","--porcelain=v1","-z","-uall"]),o=e.toString("utf8").split("\0").filter(Boolean);if(o.length<1||o.length>1024)throw new Error("rejected-candidate-invalid");let r=0;const s=o.map(n=>{const f=n.slice(0,2),p=n.slice(3);if(![" M"," D","??"].includes(f)||p.length<1||p.length>1024||p.startsWith("/")||/[\\\x00-\x1f\x7f]/.test(p)||p.split("/").some(l=>!l||l==="."||l===".."||l===".git"))throw new Error("rejected-candidate-path-invalid");const h=p.split("/");for(let l=1;l<h.length;l++){const c=v(a,...h.slice(0,l));if(!Y(c))break;const S=U(c);if(!S.isDirectory()||S.isSymbolicLink()||S.uid!==process.getuid?.())throw new Error("rejected-candidate-parent-invalid")}const u=v(a,p);if(f===" D"){if(Y(u))throw new Error("rejected-candidate-raced");return{path:p,code:f,mode:null,sha256:null,content:null}}const d=U(u);if(!d.isFile()||d.isSymbolicLink()||d.nlink!==1||d.uid!==process.getuid?.()||d.size>16*1024*1024)throw new Error("rejected-candidate-file-invalid");const m=R(u);if(r+=m.byteLength,r>16*1024*1024)throw new Error("rejected-candidate-too-large");return{path:p,code:f,mode:d.mode&511,sha256:T("sha256").update(m).digest("hex"),content:m}});if(new Set(s.map(n=>n.path)).size!==s.length)throw new Error("rejected-candidate-path-invalid");const i={schemaVersion:"PrivateYoloRejectedCandidateInspection/1",storyId:t.storyId,graphRevision:t.graphRevision,snapshotSha:t.snapshotSha,sourceHead:t.workspace.baseSha,sequence:t.sequence,statusSha256:T("sha256").update(e).digest("hex"),files:s.map(({content:n,...f})=>f)};return{files:s,inspection:{schemaVersion:i.schemaVersion,storyId:i.storyId,graphRevision:i.graphRevision,snapshotSha:i.snapshotSha,sourceHead:i.sourceHead,sequence:i.sequence,candidateDigest:T("sha256").update(JSON.stringify(i)).digest("hex"),changedPaths:s.map(n=>n.path),publicSafe:!0}}}async function le(t,a,e){const o=await D(t,a);if(!o)throw new Error("session-missing");te(o,t,a,e);const r=await M(t,a,o.workspace.executionBranch,e);return ot(o.workspace,r,o.snapshotSha,await ee(o,r)),{record:o,...it(o)}}async function qt(t,a,e,o){if(o!==!0)throw new Error("private-execution-rejected-candidate-executor-not-stopped");const r=_(t);try{return await G(r,a,I(r,a),async()=>(await le(r,a,e)).inspection)}catch{throw new Error("private-execution-rejected-candidate-unverified")}}async function Tt(t,a,e,o){if(o.executorStopped!==!0||o.authorizeDiscard!==!0||!/^[a-f0-9]{64}$/.test(o.expectedCandidateDigest))throw new Error("private-execution-rejected-candidate-input-invalid");const r=_(t);try{return await G(r,a,I(r,a),async()=>{const s=await le(r,a,e);if(s.inspection.candidateDigest!==o.expectedCandidateDigest)throw new Error("candidate-review-stale");const i=await de(r,a),n=R(i.path),f=`rejected-${Oe()}`,p=await Z(i.parent,f),h=Ee(32),u=Ee(12),d=Buffer.from(JSON.stringify({schemaVersion:"PrivateYoloRejectedCandidateArchive/1",inspection:s.inspection,files:s.files.map(({content:E,...O})=>({...O,contentBase64:E?.toString("base64")??null}))})),m=Ae("aes-256-gcm",h,u);m.setAAD(Buffer.from("private-yolo-rejected-candidate-v1"));const l=Buffer.concat([m.update(d),m.final()]);d.fill(0);const c=Buffer.concat([u,m.getAuthTag(),l]);try{await z(p,"candidate.key",h),await z(p,"candidate.aesgcm",c)}finally{h.fill(0)}if((await le(r,a,e)).inspection.candidateDigest!==o.expectedCandidateDigest||!R(i.path).equals(n))throw new Error("candidate-raced");const H=s.record.workspace.workspacePath,B=s.files.filter(E=>E.code!=="??").map(E=>E.path);B.length&&g(H,["restore","--source",s.record.snapshotSha,"--worktree","--",...B]);for(const E of s.files.filter(O=>O.code==="??")){const O=v(H,E.path),y=U(O);if(!y.isFile()||y.isSymbolicLink()||y.nlink!==1||T("sha256").update(R(O)).digest("hex")!==E.sha256)throw new Error("candidate-raced");Te(O)}if(await A(s.record,r,a,e),!R(i.path).equals(n))throw new Error("session-pin-raced");const W={schemaVersion:"PrivateYoloRejectedCandidateRecovery/1",outcome:"candidate-discarded",archiveId:f,archiveSha256:T("sha256").update(c).digest("hex"),candidateDigest:o.expectedCandidateDigest,snapshotSha:s.record.snapshotSha,sourceHead:s.record.workspace.baseSha,sessionPinPreserved:!0,sourcePreserved:!0,checkpointAccepted:!1,publicSafe:!0};return await z(p,"recovery.json",`${JSON.stringify(W)}
-`),W})}catch{throw new Error("private-execution-rejected-candidate-recovery-unverified")}}export{bt as acceptPrivateYoloProjectMemoryRootReview,At as admitPrivateYoloIsolatedSessionStep,It as beginPrivateYoloIsolatedSession,Tt as discardPrivateYoloRejectedCandidate,jt as ensurePrivateYoloIsolatedSession,qt as inspectPrivateYoloRejectedCandidate,Pt as reconcilePrivateYoloIsolatedSession,_t as resumePrivateYoloIsolatedSession,Ot as stagePrivateYoloIsolatedSessionBundle};
+/** Durable, root-owned continuation boundary for one private YOLO story. */
+import { execFileSync, spawnSync } from 'node:child_process';
+import { createCipheriv, createHash, randomBytes, randomUUID } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, readFileSync, unlinkSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, dirname, join, resolve } from 'node:path';
+import { isRootProjectMemoryEffect, rootProjectMemoryPaths } from './shared-root-memory-types.js';
+import { readPrivateRootMemoryScope, privateRootMemoryEffect } from './root-memory-scope.js';
+import { executeRootMemoryWriter, rootMemoryFileState, verifyRootMemoryWriterExecution } from './root-memory-writer.js';
+import { rootMemoryGitFileState, verifyRootMemoryEffectGitEvidence } from './root-memory-git-evidence.js';
+import { parsePrivateRootMemoryRequest } from './root-memory-request.js';
+import { rootMemoryOperationJournalName, readVerifiedPreparedRootMemory } from './root-memory-recovery.js';
+import { assertProjectMemoryPaths } from '../memory/project-memory-path-scope.js';
+import { isDeepStrictEqual } from 'node:util';
+import { acquireGitLifecyclePhysicalIntegrationLock, applyGitLifecycleRuntimeOverlay, assertGitLifecyclePrivateFile, ensureGitLifecyclePrivateChildDirectory, gitLifecycleRuntimeDirectory, mutateGitLifecycleRuntime, readGitLifecycleRuntimeSync, releaseGitLifecyclePhysicalIntegrationLock, } from '../git/git-lifecycle-store.js';
+import { anchoredAtomicWriteFile, anchoredDirectoryIdentity, anchoredExecuteGit } from '../git/secure-filesystem-boundary.js';
+import { privateYoloRootOnlySetupReady, readPrivateYoloFrozenWriteSet, readPrivateYoloFrozenWriteSetForTransition } from './clean-baseline.js';
+import { admitPrivateYoloFrozenWorkspace, verifyPrivateYoloSnapshotBoundary, verifyPrivateYoloRejectedCandidateOrigin, } from './isolated-admission.js';
+import { preparePrivateYoloIsolatedWorkspace } from './isolated-workspace.js';
+/** Root-owned C07. The child may propose notes; only this controller runs the writer. */
+export async function acceptPrivateYoloProjectMemoryRootReview(projectRoot, request, options = {}) {
+    const parsed = parsePrivateRootMemoryRequest(request), { directive: d, review: review } = parsed;
+    const root = resolve(projectRoot), storyId = d.storyId, epicId = storyId.split('.')[0];
+    const hash = (value) => createHash('sha256').update(value).digest('hex');
+    let stage = 'session';
+    const fail = () => { throw new Error(`private-root-memory-acceptance-${stage}-unverified`); };
+    try {
+        return await withPhysicalLock(root, storyId, setupSessionId(root, storyId), async () => {
+            const before = readGitLifecycleRuntimeSync(root, { required: true });
+            const epic = before.epics[epicId], lease = epic?.branch_lease;
+            const current = await readSession(root, storyId);
+            if (!current || epic?.graph_revision !== d.graphRevision || lease?.ownerStoryId !== storyId
+                || typeof lease.expiresAt !== 'string' || Date.parse(lease.expiresAt) <= Date.now()
+                || current.workspace.executionBranch !== d.executionBranch)
+                return fail();
+            verifySessionBinding(current, root, storyId, d.graphRevision);
+            const parent = await ensureGitLifecyclePrivateChildDirectory(await gitLifecycleRuntimeDirectory(root), 'private-execution');
+            const operationName = rootMemoryOperationJournalName(current, parsed);
+            const prepared = current.rootMemoryEffect === undefined && existsSync(join(parent, operationName));
+            if (!prepared)
+                await verifySession(current, root, storyId, d.graphRevision);
+            const sourceIdentity = await anchoredDirectoryIdentity(root);
+            stage = 'source-evidence';
+            assertProjectMemoryPaths(root, ['.neocortex/state.json', `.neocortex/stories/${storyId}/validation-evidence.md`]);
+            const stateBytes = readFileSync(join(root, '.neocortex/state.json'));
+            if (hash(stateBytes) !== review.sourceStateSha256)
+                return fail();
+            const effective = applyGitLifecycleRuntimeOverlay(JSON.parse(stateBytes.toString('utf8')), before);
+            const story = effective.stories?.[storyId];
+            if (!story || story.checkpoint !== undefined || !Array.isArray(story.steps_completed))
+                return fail();
+            const completedSteps = [...story.steps_completed];
+            const proposalPath = `.neocortex/stories/${storyId}/validation-evidence.md`;
+            const proposalInfo = lstatSync(join(root, proposalPath));
+            if (!proposalInfo.isFile() || proposalInfo.isSymbolicLink() || proposalInfo.nlink !== 1
+                || proposalInfo.size < 128 || proposalInfo.size > 256 * 1024
+                || hash(readFileSync(join(root, proposalPath))) !== review.proposalSha256)
+                return fail();
+            const qaPath = join(parent, `qa-review-${review.rootQaReceiptId}.json`);
+            stage = 'qa-predecessor';
+            await assertGitLifecyclePrivateFile(qaPath, parent);
+            const qaBytes = readFileSync(qaPath);
+            if (qaBytes.length > 16384 || hash(qaBytes) !== review.rootQaReceiptId)
+                return fail();
+            const qa = JSON.parse(qaBytes.toString('utf8'));
+            if (qa.kind !== 'private-qa-root-review' || qa.storyId !== storyId || qa.sourceHeadSha !== current.workspace.baseSha
+                || qa.precommitQaAccepted !== true || qa.independentStoryQaAccepted !== false || qa.terminalAccepted !== false)
+                return fail();
+            const notesSha256 = hash(JSON.stringify(review.notes));
+            const receiptName = (effect) => `memory-review-${hash(JSON.stringify(effect))}.json`;
+            const qaPredecessorReady = story.status === 'qa-gate-passed' && typeof story.last_step === 'string'
+                && hash(story.last_step) === '8721319de90ade506bc9b72a908d8296856b34a11bc640629178bed3fe32e373'
+                && completedSteps.at(-1) === story.last_step;
+            const advanceMemoryPhase = async (target) => {
+                await mutateGitLifecycleRuntime(root, document => {
+                    if (!isDeepStrictEqual(document.epics[epicId], epic) || !isDeepStrictEqual(document.stories[storyId], before.stories[storyId]))
+                        return fail();
+                    document.stories[storyId] = { ...document.stories[storyId], status: 'memory-updated', last_step: review.rawStepId,
+                        steps_completed: [...completedSteps, review.rawStepId] };
+                }, { expectedRevision: before.revision, preCommit: async () => { await verifySession(target, root, storyId, d.graphRevision); } });
+            };
+            if (current.rootMemoryEffect) {
+                stage = 'replay';
+                if (current.rootMemoryEffect.sourceSnapshotSha !== review.snapshotSha
+                    || current.rootMemoryEffect.proposalSha256 !== notesSha256
+                    || current.rootMemoryEffect.rootQaReceiptId !== review.rootQaReceiptId)
+                    return fail();
+                const path = join(parent, receiptName(current.rootMemoryEffect));
+                await assertGitLifecyclePrivateFile(path, parent);
+                const bytes = readFileSync(path), receipt = JSON.parse(bytes.toString('utf8'));
+                if (receipt.proposalSha256 !== review.proposalSha256 || receipt.notesSha256 !== notesSha256
+                    || !isDeepStrictEqual(receipt.rootMemoryEffect, current.rootMemoryEffect))
+                    return fail();
+                const alreadyAccepted = story.status === 'memory-updated' && story.last_step === review.rawStepId
+                    && completedSteps.at(-1) === review.rawStepId;
+                if (!alreadyAccepted && !qaPredecessorReady)
+                    return fail();
+                // The immutable producer receipt and physical pin already prove the
+                // writer/source effect. Resume only its unaccepted CAS transition.
+                if (!alreadyAccepted) {
+                    stage = 'phase-recovery';
+                    await advanceMemoryPhase(current);
+                }
+                return { schemaVersion: 1, outcome: 'project-memory-root-accepted', storyId, graphRevision: d.graphRevision,
+                    receiptId: hash(bytes), snapshotSha: current.snapshotSha, reused: true, sourceStateUnchanged: true,
+                    phaseRecovered: !alreadyAccepted,
+                    independentStoryQaAccepted: false, terminalAccepted: false, publicSafe: true };
+            }
+            if (current.snapshotSha !== review.snapshotSha || !qaPredecessorReady)
+                return fail();
+            const clone = current.workspace.workspacePath;
+            git(clone, ['merge-base', '--is-ancestor', qa.snapshotSha, current.snapshotSha]);
+            const metadata = [`.neocortex/stories/${storyId}/qa-gate-result.json`, proposalPath,
+                `.neocortex/stories/${storyId}/tdd-evidence.md`, `docs/stories/${storyId}.rtm.md`];
+            if (gitRaw(clone, ['diff', '--name-only', '-z', qa.snapshotSha, current.snapshotSha]).toString('utf8')
+                .split('\0').filter(Boolean).some(path => !metadata.includes(path)))
+                return fail();
+            const frozen = await readPrivateYoloFrozenWriteSet(root, storyId, d.executionBranch, d.graphRevision);
+            if (!gitExitOk(root, ['diff', '--cached', '--quiet']))
+                return fail();
+            const sourceStatus = gitRaw(root, ['status', '--porcelain=v1', '-z', '--untracked-files=all']);
+            let effect, receipt, patch;
+            let sourceAlreadyApplied = false;
+            if (prepared) {
+                stage = 'prepared-recovery';
+                const recovered = await readVerifiedPreparedRootMemory({ projectRoot: root, parent, current, request: parsed, childPaths: frozen });
+                effect = recovered.effect;
+                receipt = recovered.receipt;
+                patch = recovered.patch;
+                sourceAlreadyApplied = recovered.sourceAlreadyApplied;
+            }
+            else {
+                for (const path of rootProjectMemoryPaths()) {
+                    if (frozen.includes(path) || !isDeepStrictEqual(rootMemoryFileState(root, path), rootMemoryGitFileState(clone, current.snapshotSha, path)))
+                        return fail();
+                }
+                stage = 'writer';
+                const backups = await ensureGitLifecyclePrivateChildDirectory(parent, 'memory-backups');
+                const writerAuthority = executeRootMemoryWriter({ snapshotRoot: clone, expectedSnapshotSha: current.snapshotSha,
+                    notes: review.notes, backupDirectory: backups });
+                const writer = verifyRootMemoryWriterExecution(writerAuthority);
+                stage = 'writer-snapshot';
+                if (writer.files.length) {
+                    git(clone, ['add', '-A', '--', ...writer.files.map(file => file.path)]);
+                    git(clone, ['-c', 'core.hooksPath=/dev/null', '-c', 'commit.gpgsign=false', '-c', 'user.name=Neocortex Private Session',
+                        '-c', 'user.email=private-session@neocortex.invalid', 'commit', '-q', '-m', `private root memory ${storyId} ${current.sequence + 1}`]);
+                }
+                const snapshotSha = git(clone, ['rev-parse', 'HEAD']);
+                effect = { schemaVersion: 'RootProjectMemoryEffect/1', producer: 'root-project-memory',
+                    storyId, epicId, executionBranch: d.executionBranch, sourceHeadSha: current.workspace.baseSha,
+                    sourceSnapshotSha: current.snapshotSha, memorySnapshotSha: snapshotSha, graphRevision: d.graphRevision,
+                    childClaimRevision: hash([...frozen].sort().join('\0')), setupSessionId: current.setupSessionId,
+                    rootQaReceiptId: review.rootQaReceiptId, proposalSha256: writer.notesSha256,
+                    canonicalSha256: writer.verification.canonicalSha256, projectionSha256: writer.verification.projectionSha256,
+                    projectionFileCount: writer.verification.fileCount, files: writer.files, recordedAt: review.reviewedAt, publicSafe: true };
+                stage = 'git-evidence';
+                verifyRootMemoryEffectGitEvidence(clone, effect, { storyId, graphRevision: d.graphRevision,
+                    childClaimRevision: effect.childClaimRevision, setupSessionId: current.setupSessionId,
+                    sourceHeadSha: current.workspace.baseSha, executionBranch: d.executionBranch });
+                patch = gitRaw(clone, ['diff', '--binary', '--full-index', current.snapshotSha, snapshotSha]);
+                receipt = { schemaVersion: 1, kind: 'private-project-memory-root-review', storyId, graphRevision: d.graphRevision,
+                    sourceHeadSha: current.workspace.baseSha, snapshotSha, proposalSha256: review.proposalSha256, notesSha256,
+                    sourceStateSha256: review.sourceStateSha256, checks: review.checks, reviewedAt: review.reviewedAt,
+                    rootMemoryEffect: effect, independentStoryQaAccepted: false, terminalAccepted: false };
+                // Retain a prepared journal before source writes. A partial operation fails
+                // closed with its private clone and journal intact, never an invented pin.
+                stage = 'prepared-journal';
+                await anchoredAtomicWriteFile(parent, operationName, JSON.stringify({ schemaVersion: 1, kind: 'prepared-root-memory-effect', previousSession: current, receipt,
+                    patchSha256: hash(patch) }) + '\n');
+                await options.fault?.('after-prepared-journal');
+            }
+            const bytes = JSON.stringify(receipt) + '\n', snapshotSha = effect.memorySnapshotSha;
+            stage = 'source-admission';
+            if (!gitRaw(root, ['status', '--porcelain=v1', '-z', '--untracked-files=all']).equals(sourceStatus)
+                || git(root, ['rev-parse', 'HEAD']) !== current.workspace.baseSha
+                || git(root, ['symbolic-ref', '--short', 'HEAD']) !== d.executionBranch)
+                return fail();
+            if (!sourceAlreadyApplied)
+                for (const file of effect.files)
+                    if (!isDeepStrictEqual(rootMemoryFileState(root, file.path), file.before))
+                        return fail();
+            // The existing anchored helper sets umask 077 in its child only. Git
+            // otherwise creates group-writable memory files on hosts with umask 002.
+            const apply = (check) => anchoredExecuteGit(dirname(root), basename(root), sourceIdentity, ['apply', ...(check ? ['--check'] : []), '--binary', '-'], patch);
+            if (patch.length && !sourceAlreadyApplied) {
+                await apply(true);
+                await apply(false);
+            }
+            await options.fault?.('after-source-admission');
+            if (!readFileSync(join(root, '.neocortex/state.json')).equals(stateBytes))
+                return fail();
+            const receiptPath = join(parent, receiptName(effect));
+            if (existsSync(receiptPath)) {
+                await assertGitLifecyclePrivateFile(receiptPath, parent);
+                if (readFileSync(receiptPath, 'utf8') !== bytes)
+                    return fail();
+            }
+            else
+                await anchoredAtomicWriteFile(parent, receiptName(effect), bytes);
+            const next = Object.freeze({ ...current, snapshotSha,
+                sequence: current.sequence + (effect.files.length ? 1 : 0), lastPatchSha256: effect.files.length ? hash(patch) : current.lastPatchSha256,
+                rootMemoryEffect: effect });
+            stage = 'session-pin';
+            await options.fault?.('before-session-pin');
+            await writeSession(root, next);
+            await verifySession(next, root, storyId, d.graphRevision);
+            stage = 'phase-transition';
+            await advanceMemoryPhase(next);
+            return { schemaVersion: 1, outcome: 'project-memory-root-accepted', storyId, graphRevision: d.graphRevision,
+                receiptId: hash(bytes), snapshotSha, reused: prepared, sourceStateUnchanged: true,
+                preparedRecovered: prepared, sourceWriteReused: sourceAlreadyApplied,
+                independentStoryQaAccepted: false, terminalAccepted: false, publicSafe: true };
+        });
+    }
+    catch (error) {
+        const reason = error instanceof Error && /^(private-root-memory|private-execution-isolated)-[a-z0-9-]+$/.test(error.message)
+            ? error.message : undefined;
+        if (reason)
+            throw new Error(`private-root-memory-acceptance-${stage}-unverified`, { cause: error });
+        return fail();
+    }
+}
+function git(root, args) {
+    const env = { ...process.env };
+    for (const key of [
+        'GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY',
+        'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_COMMON_DIR', 'GIT_NAMESPACE', 'GIT_CEILING_DIRECTORIES',
+    ])
+        delete env[key];
+    return execFileSync('git', [...args], {
+        cwd: root, env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 30_000, maxBuffer: 16 * 1024 * 1024,
+    }).trim();
+}
+function gitRaw(root, args) {
+    const env = { ...process.env };
+    for (const key of [
+        'GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY',
+        'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_COMMON_DIR', 'GIT_NAMESPACE', 'GIT_CEILING_DIRECTORIES',
+    ])
+        delete env[key];
+    return execFileSync('git', [...args], {
+        cwd: root, env, stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 30_000, maxBuffer: 16 * 1024 * 1024,
+    });
+}
+function gitExitOk(root, args) {
+    const env = { ...process.env };
+    for (const key of [
+        'GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY',
+        'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_COMMON_DIR', 'GIT_NAMESPACE', 'GIT_CEILING_DIRECTORIES',
+    ])
+        delete env[key];
+    const result = spawnSync('git', [...args], {
+        cwd: root, env, stdio: 'ignore', timeout: 30_000,
+    });
+    if (result.error || result.signal)
+        throw new Error('git-unverified');
+    return result.status === 0;
+}
+async function location(root, storyId) {
+    const runtime = await gitLifecycleRuntimeDirectory(root);
+    const parent = await ensureGitLifecyclePrivateChildDirectory(runtime, 'private-execution');
+    const name = `session-${createHash('sha256').update(storyId).digest('hex')}.json`;
+    return { parent, name, path: join(parent, name) };
+}
+function setupSessionId(root, storyId) {
+    const epicId = storyId.split('.')[0];
+    const runtime = readGitLifecycleRuntimeSync(root, { required: true });
+    const value = runtime.epics[epicId]?.branch_lease;
+    const lease = value && typeof value === 'object' && !Array.isArray(value)
+        ? value : undefined;
+    const sessionId = lease?.sessionId;
+    if (lease?.ownerStoryId !== storyId || typeof sessionId !== 'string'
+        || !/^setup-[a-f0-9]{64}$/.test(sessionId)
+        || sessionId !== lease.idempotencyKey) {
+        throw new Error('session-lease-invalid');
+    }
+    return sessionId;
+}
+function rootOnlySetupReady(root, storyId) {
+    const story = readGitLifecycleRuntimeSync(root, { required: true }).stories[storyId];
+    return privateYoloRootOnlySetupReady(story);
+}
+function parseSession(raw) {
+    const item = JSON.parse(raw);
+    if (!item || typeof item !== 'object' || Array.isArray(item))
+        throw new Error('session-invalid');
+    const record = item;
+    const workspace = record.workspace;
+    if (Object.keys(record).sort().join(',') !== [
+        'schemaVersion', 'kind', 'storyId', 'initialGraphRevision', 'graphRevision', 'graphHistory', 'setupSessionId',
+        'workspace', 'snapshotSha', 'sequence', 'lastPatchSha256', ...(record.rootMemoryEffect === undefined ? [] : ['rootMemoryEffect']),
+    ].sort().join(',') || record.schemaVersion !== 1 || record.kind !== 'private-yolo-isolated-session'
+        || typeof record.storyId !== 'string' || !/^[A-Za-z][A-Za-z0-9_-]*\.[A-Za-z0-9._-]+$/.test(record.storyId)
+        || typeof record.initialGraphRevision !== 'string' || !/^[a-f0-9]{64}$/.test(record.initialGraphRevision)
+        || typeof record.graphRevision !== 'string' || !/^[a-f0-9]{64}$/.test(record.graphRevision)
+        || !Array.isArray(record.graphHistory) || record.graphHistory.length < 1 || record.graphHistory.length > 65
+        || record.graphHistory.some((revision) => typeof revision !== 'string' || !/^[a-f0-9]{64}$/.test(revision))
+        || new Set(record.graphHistory).size !== record.graphHistory.length
+        || record.graphHistory[0] !== record.initialGraphRevision
+        || record.graphHistory[record.graphHistory.length - 1] !== record.graphRevision
+        || typeof record.setupSessionId !== 'string' || !/^setup-[a-f0-9]{64}$/.test(record.setupSessionId)
+        || typeof record.snapshotSha !== 'string' || !/^[a-f0-9]{40,64}$/.test(record.snapshotSha)
+        || !Number.isSafeInteger(record.sequence) || Number(record.sequence) < 0 || Number(record.sequence) > 64
+        || Number(record.sequence) === 0 && record.initialGraphRevision !== record.graphRevision
+            && record.graphHistory.length !== 2
+        || Number(record.sequence) === 0 && record.lastPatchSha256 !== null
+        || Number(record.sequence) > 0 && record.lastPatchSha256 === null
+        || record.lastPatchSha256 !== null && (typeof record.lastPatchSha256 !== 'string'
+            || !/^[a-f0-9]{64}$/.test(record.lastPatchSha256))
+        || record.rootMemoryEffect !== undefined && !isRootProjectMemoryEffect(record.rootMemoryEffect)
+        || !workspace || typeof workspace !== 'object' || Array.isArray(workspace))
+        throw new Error('session-invalid');
+    const candidate = workspace;
+    if (Object.keys(candidate).sort().join(',') !== [
+        'schemaVersion', 'sourceRoot', 'workspacePath', 'baseSha', 'executionBranch',
+    ].sort().join(',') || candidate.schemaVersion !== 1
+        || typeof candidate.sourceRoot !== 'string' || typeof candidate.workspacePath !== 'string'
+        || typeof candidate.baseSha !== 'string' || !/^[a-f0-9]{40,64}$/.test(candidate.baseSha)
+        || typeof candidate.executionBranch !== 'string' || !candidate.executionBranch) {
+        throw new Error('session-invalid');
+    }
+    return record;
+}
+async function readSession(root, storyId) {
+    const target = await location(root, storyId);
+    if (!existsSync(target.path))
+        return undefined;
+    await assertGitLifecyclePrivateFile(target.path, target.parent);
+    return parseSession(readFileSync(target.path, 'utf8'));
+}
+async function writeSession(root, record) {
+    const target = await location(root, record.storyId);
+    await anchoredAtomicWriteFile(target.parent, target.name, `${JSON.stringify(record)}\n`);
+}
+async function withPhysicalLock(root, storyId, sessionId, work) {
+    const lock = await acquireGitLifecyclePhysicalIntegrationLock(root, {
+        kind: 'direct', storyId, sessionId, idempotencyKey: sessionId,
+        expiresAt: new Date(Date.now() + 5 * 60_000).toISOString(), persistent: false,
+    });
+    if (!lock.ok)
+        throw new Error('private-execution-isolated-session-backpressure');
+    try {
+        return await work();
+    }
+    finally {
+        if (!(await releaseGitLifecyclePhysicalIntegrationLock(lock.path, lock.owner))) {
+            throw new Error('private-execution-isolated-session-lock-unverified');
+        }
+    }
+}
+async function verifySession(record, root, storyId, graphRevision) {
+    verifySessionBinding(record, root, storyId, graphRevision);
+    const frozen = await readPrivateYoloFrozenWriteSet(root, storyId, record.workspace.executionBranch, graphRevision);
+    const scope = await sessionMemoryScope(record, frozen);
+    verifyPrivateYoloSnapshotBoundary(record.workspace, frozen, record.snapshotSha, scope);
+    return scope;
+}
+async function sessionMemoryScope(record, frozen) {
+    // Ordinary sessions retain the original boundary. Extra scope can only be
+    // loaded back from the actual private pin, never supplied as a JSON argument.
+    if (record.rootMemoryEffect === undefined)
+        return undefined;
+    const scope = await readPrivateRootMemoryScope({ projectRoot: record.workspace.sourceRoot,
+        storyId: record.storyId, snapshotRoot: record.workspace.workspacePath, snapshotSha: record.snapshotSha,
+        sourceHeadSha: record.workspace.baseSha, executionBranch: record.workspace.executionBranch,
+        graphRevision: record.graphRevision, setupSessionId: record.setupSessionId, childPaths: frozen });
+    if (!scope || JSON.stringify(privateRootMemoryEffect(scope)) !== JSON.stringify(record.rootMemoryEffect)) {
+        throw new Error('private-root-memory-scope-unverified');
+    }
+    return scope;
+}
+function verifySessionBinding(record, root, storyId, graphRevision) {
+    if (record.storyId !== storyId || record.graphRevision !== graphRevision
+        || record.workspace.sourceRoot !== root
+        || record.setupSessionId !== setupSessionId(root, storyId)
+        || record.sequence === 0 && record.snapshotSha !== record.workspace.baseSha
+        || record.sequence === 0 && record.graphHistory.length > 1 && !rootOnlySetupReady(root, storyId)
+        || record.sequence > 0 && record.snapshotSha === record.workspace.baseSha) {
+        throw new Error('session-binding-invalid');
+    }
+}
+/** Reserve one clone for the exact C01 session, without launching an agent. */
+export async function beginPrivateYoloIsolatedSession(workspace, storyId, graphRevision) {
+    const root = resolve(workspace.sourceRoot);
+    try {
+        const sessionId = setupSessionId(root, storyId);
+        return await withPhysicalLock(root, storyId, sessionId, async () => {
+            const existing = await readSession(root, storyId);
+            if (existing) {
+                await verifySession(existing, root, storyId, graphRevision);
+                if (existing.workspace.workspacePath !== workspace.workspacePath)
+                    throw new Error('session-replacement-denied');
+                return existing;
+            }
+            const frozen = await readPrivateYoloFrozenWriteSet(root, storyId, workspace.executionBranch, graphRevision);
+            verifyPrivateYoloSnapshotBoundary(workspace, frozen, workspace.baseSha);
+            const record = Object.freeze({
+                schemaVersion: 1, kind: 'private-yolo-isolated-session', storyId,
+                initialGraphRevision: graphRevision, graphRevision, graphHistory: [graphRevision],
+                setupSessionId: sessionId, workspace, snapshotSha: workspace.baseSha,
+                sequence: 0, lastPatchSha256: null,
+            });
+            await writeSession(root, record);
+            return record;
+        });
+    }
+    catch {
+        throw new Error('private-execution-isolated-session-unverified');
+    }
+}
+async function reconcileSessionGraph(record, root, storyId, graphRevision) {
+    if (record.graphRevision === graphRevision) {
+        await verifySession(record, root, storyId, graphRevision);
+        return record;
+    }
+    if (record.storyId !== storyId || record.workspace.sourceRoot !== root
+        || record.setupSessionId !== setupSessionId(root, storyId)
+        || record.sequence === 0 && (record.graphHistory.length !== 1
+            || record.lastPatchSha256 !== null || !rootOnlySetupReady(root, storyId))
+        || record.sequence > 0 && record.lastPatchSha256 === null
+        || record.graphHistory.includes(graphRevision) || record.graphHistory.length >= 65) {
+        throw new Error('session-graph-transition-invalid');
+    }
+    const frozen = await readPrivateYoloFrozenWriteSetForTransition(root, storyId, record.workspace.executionBranch, record.initialGraphRevision, graphRevision);
+    verifyPrivateYoloSnapshotBoundary(record.workspace, frozen, record.snapshotSha, await sessionMemoryScope(record, frozen));
+    const next = Object.freeze({ ...record, graphRevision,
+        graphHistory: Object.freeze([...record.graphHistory, graphRevision]) });
+    await writeSession(root, next);
+    await verifySession(next, root, storyId, graphRevision);
+    return next;
+}
+/** Require a previously admitted patch before accepting a new server graph. */
+export async function reconcilePrivateYoloIsolatedSession(projectRoot, storyId, graphRevision) {
+    const root = resolve(projectRoot);
+    try {
+        const sessionId = setupSessionId(root, storyId);
+        return await withPhysicalLock(root, storyId, sessionId, async () => {
+            const existing = await readSession(root, storyId);
+            if (!existing)
+                throw new Error('session-missing');
+            return reconcileSessionGraph(existing, root, storyId, graphRevision);
+        });
+    }
+    catch {
+        throw new Error('private-execution-isolated-session-unverified');
+    }
+}
+/** Reuse the pinned clone, or create it once after the physical C01 setup. */
+export async function ensurePrivateYoloIsolatedSession(projectRoot, storyId, graphRevision, workspaceParent) {
+    const root = resolve(projectRoot);
+    try {
+        const sessionId = setupSessionId(root, storyId);
+        return await withPhysicalLock(root, storyId, sessionId, async () => {
+            const existing = await readSession(root, storyId);
+            if (existing) {
+                return reconcileSessionGraph(existing, root, storyId, graphRevision);
+            }
+            const parent = workspaceParent ?? join(homedir(), '.local', 'share', 'neocortex', 'private-yolo-workspaces');
+            if (workspaceParent === undefined)
+                mkdirSync(parent, { recursive: true, mode: 0o700 });
+            const workspace = preparePrivateYoloIsolatedWorkspace(root, parent);
+            const frozen = await readPrivateYoloFrozenWriteSet(root, storyId, workspace.executionBranch, graphRevision);
+            verifyPrivateYoloSnapshotBoundary(workspace, frozen, workspace.baseSha);
+            const record = Object.freeze({
+                schemaVersion: 1, kind: 'private-yolo-isolated-session', storyId,
+                initialGraphRevision: graphRevision, graphRevision, graphHistory: [graphRevision],
+                setupSessionId: sessionId, workspace, snapshotSha: workspace.baseSha,
+                sequence: 0, lastPatchSha256: null,
+            });
+            await writeSession(root, record);
+            return record;
+        });
+    }
+    catch {
+        throw new Error('private-execution-isolated-session-unverified');
+    }
+}
+/** Resume only the same private clone, snapshot and live C01 graph/session. */
+export async function resumePrivateYoloIsolatedSession(projectRoot, storyId, graphRevision) {
+    const root = resolve(projectRoot);
+    try {
+        const record = await readSession(root, storyId);
+        if (!record)
+            throw new Error('session-missing');
+        await verifySession(record, root, storyId, graphRevision);
+        return record;
+    }
+    catch {
+        throw new Error('private-execution-isolated-session-unverified');
+    }
+}
+/** Admit one agent delta and durably pin the clone's next root-owned snapshot. */
+export async function admitPrivateYoloIsolatedSessionStep(projectRoot, storyId, graphRevision) {
+    const root = resolve(projectRoot);
+    try {
+        const sessionId = setupSessionId(root, storyId);
+        return await withPhysicalLock(root, storyId, sessionId, async () => {
+            const current = await readSession(root, storyId);
+            if (!current)
+                throw new Error('session-missing');
+            verifySessionBinding(current, root, storyId, graphRevision);
+            const frozen = await readPrivateYoloFrozenWriteSet(root, storyId, current.workspace.executionBranch, graphRevision);
+            const scope = await sessionMemoryScope(current, frozen);
+            const admission = await admitPrivateYoloFrozenWorkspace(current.workspace, storyId, graphRevision, current.snapshotSha, false, scope);
+            git(current.workspace.workspacePath, ['add', '-A', '--', ...admission.changedPaths]);
+            git(current.workspace.workspacePath, [
+                '-c', 'core.hooksPath=/dev/null', '-c', 'commit.gpgsign=false',
+                '-c', 'user.name=Neocortex Private Session',
+                '-c', 'user.email=private-session@neocortex.invalid',
+                'commit', '-q', '-m', `private snapshot ${storyId} ${current.sequence + 1}`,
+            ]);
+            const snapshotSha = git(current.workspace.workspacePath, ['rev-parse', 'HEAD']);
+            verifyPrivateYoloSnapshotBoundary(current.workspace, frozen, snapshotSha, scope);
+            const next = Object.freeze({
+                ...current, snapshotSha, sequence: current.sequence + 1,
+                lastPatchSha256: admission.patchSha256,
+            });
+            await writeSession(root, next);
+            return { session: next, admission };
+        });
+    }
+    catch {
+        throw new Error('private-execution-isolated-session-unverified');
+    }
+}
+/**
+ * Root-owned C08 staging. The agent never gets index authority: the source
+ * must still equal the pinned clone, and the staged bytes must equal its
+ * immutable base-to-snapshot patch. QA and checkpoint remain separate gates.
+ */
+export async function stagePrivateYoloIsolatedSessionBundle(projectRoot, storyId, graphRevision) {
+    const root = resolve(projectRoot);
+    try {
+        const sessionId = setupSessionId(root, storyId);
+        return await withPhysicalLock(root, storyId, sessionId, async () => {
+            const session = await readSession(root, storyId);
+            if (!session || session.sequence < 1)
+                throw new Error('session-incomplete');
+            const scope = await verifySession(session, root, storyId, graphRevision);
+            const frozen = await readPrivateYoloFrozenWriteSet(root, storyId, session.workspace.executionBranch, graphRevision);
+            const clone = session.workspace.workspacePath;
+            const changedPaths = gitRaw(clone, [
+                'diff', '--name-only', '-z', session.workspace.baseSha, session.snapshotSha,
+            ]).toString('utf8').split('\0').filter(Boolean).sort();
+            const required = [
+                '.neocortex/state.json', `docs/stories/${storyId}.story.md`,
+                `.neocortex/stories/${storyId}/qa-gate-result.json`,
+                `.neocortex/stories/${storyId}/validation-evidence.md`,
+                `.neocortex/stories/${storyId}/review.md`,
+            ];
+            if (changedPaths.length === 0 || changedPaths.length > 1024
+                || new Set(changedPaths).size !== changedPaths.length
+                || changedPaths.some((path) => !frozen.includes(path) && !(scope && privateRootMemoryEffect(scope).files.some(file => file.path === path)))
+                || required.some((path) => !changedPaths.includes(path))) {
+                throw new Error('bundle-incomplete');
+            }
+            if (!gitExitOk(root, ['diff', '--cached', '--quiet'])
+                || gitRaw(root, ['ls-files', '-u', '-z']).byteLength !== 0) {
+                throw new Error('index-not-clean');
+            }
+            const expected = gitRaw(clone, [
+                'diff', '--binary', '--full-index', session.workspace.baseSha, session.snapshotSha,
+            ]);
+            if (expected.byteLength === 0)
+                throw new Error('bundle-empty');
+            git(root, ['add', '-A', '--', ...changedPaths]);
+            const staged = gitRaw(root, ['diff', '--cached', '--binary', '--full-index']);
+            const stagedPaths = gitRaw(root, ['diff', '--cached', '--name-only', '-z'])
+                .toString('utf8').split('\0').filter(Boolean).sort();
+            if (!staged.equals(expected)
+                || stagedPaths.length !== changedPaths.length
+                || stagedPaths.some((path, index) => path !== changedPaths[index])
+                || !gitExitOk(root, ['diff', '--quiet'])
+                || git(root, ['rev-parse', 'HEAD']) !== session.workspace.baseSha
+                || git(root, ['symbolic-ref', '--quiet', '--short', 'HEAD']) !== session.workspace.executionBranch) {
+                throw new Error('bundle-raced');
+            }
+            return Object.freeze({
+                schemaVersion: 1, outcome: 'staged-unverified', snapshotSha: session.snapshotSha,
+                bundleSha256: createHash('sha256').update(staged).digest('hex'),
+                changedPaths: Object.freeze(changedPaths),
+            });
+        });
+    }
+    catch {
+        // Never unstage on failure: an external writer may have raced the index.
+        throw new Error('private-execution-root-stage-unverified');
+    }
+}
+function rejectedCandidate(record) {
+    const clone = record.workspace.workspacePath;
+    const bytes = gitRaw(clone, ['status', '--porcelain=v1', '-z', '-uall']);
+    const rows = bytes.toString('utf8').split('\0').filter(Boolean);
+    if (rows.length < 1 || rows.length > 1024)
+        throw new Error('rejected-candidate-invalid');
+    let total = 0;
+    const files = rows.map(row => {
+        const code = row.slice(0, 2), path = row.slice(3);
+        if (![' M', ' D', '??'].includes(code) || path.length < 1 || path.length > 1024
+            || path.startsWith('/') || /[\\\x00-\x1f\x7f]/.test(path)
+            || path.split('/').some(part => !part || part === '.' || part === '..' || part === '.git')) {
+            throw new Error('rejected-candidate-path-invalid');
+        }
+        const parts = path.split('/');
+        for (let i = 1; i < parts.length; i++) {
+            const parent = join(clone, ...parts.slice(0, i));
+            if (!existsSync(parent))
+                break;
+            const entry = lstatSync(parent);
+            if (!entry.isDirectory() || entry.isSymbolicLink() || entry.uid !== process.getuid?.())
+                throw new Error('rejected-candidate-parent-invalid');
+        }
+        const target = join(clone, path);
+        if (code === ' D') {
+            if (existsSync(target))
+                throw new Error('rejected-candidate-raced');
+            return { path, code, mode: null, sha256: null, content: null };
+        }
+        const entry = lstatSync(target);
+        if (!entry.isFile() || entry.isSymbolicLink() || entry.nlink !== 1
+            || entry.uid !== process.getuid?.() || entry.size > 16 * 1024 * 1024)
+            throw new Error('rejected-candidate-file-invalid');
+        const content = readFileSync(target);
+        total += content.byteLength;
+        if (total > 16 * 1024 * 1024)
+            throw new Error('rejected-candidate-too-large');
+        return { path, code, mode: entry.mode & 0o777, sha256: createHash('sha256').update(content).digest('hex'), content };
+    });
+    if (new Set(files.map(f => f.path)).size !== files.length)
+        throw new Error('rejected-candidate-path-invalid');
+    const fields = { schemaVersion: 'PrivateYoloRejectedCandidateInspection/1',
+        storyId: record.storyId, graphRevision: record.graphRevision, snapshotSha: record.snapshotSha,
+        sourceHead: record.workspace.baseSha, sequence: record.sequence,
+        statusSha256: createHash('sha256').update(bytes).digest('hex'),
+        files: files.map(({ content: _content, ...metadata }) => metadata) };
+    return { files, inspection: { schemaVersion: fields.schemaVersion, storyId: fields.storyId,
+            graphRevision: fields.graphRevision, snapshotSha: fields.snapshotSha, sourceHead: fields.sourceHead,
+            sequence: fields.sequence, candidateDigest: createHash('sha256').update(JSON.stringify(fields)).digest('hex'),
+            changedPaths: files.map(f => f.path), publicSafe: true } };
+}
+async function checkedRejectedCandidate(root, storyId, graphRevision) {
+    const record = await readSession(root, storyId);
+    if (!record)
+        throw new Error('session-missing');
+    verifySessionBinding(record, root, storyId, graphRevision);
+    const frozen = await readPrivateYoloFrozenWriteSet(root, storyId, record.workspace.executionBranch, graphRevision);
+    verifyPrivateYoloRejectedCandidateOrigin(record.workspace, frozen, record.snapshotSha, await sessionMemoryScope(record, frozen));
+    return { record, ...rejectedCandidate(record) };
+}
+/** The parent must first observe executor termination. Never resets a source or changes a pin. */
+export async function inspectPrivateYoloRejectedCandidate(projectRoot, storyId, graphRevision, executorStopped) {
+    if (executorStopped !== true)
+        throw new Error('private-execution-rejected-candidate-executor-not-stopped');
+    const root = resolve(projectRoot);
+    try {
+        return await withPhysicalLock(root, storyId, setupSessionId(root, storyId), async () => (await checkedRejectedCandidate(root, storyId, graphRevision)).inspection);
+    }
+    catch {
+        throw new Error('private-execution-rejected-candidate-unverified');
+    }
+}
+/** Discard only the explicitly inspected unaccepted delta, after encrypted custody. */
+export async function discardPrivateYoloRejectedCandidate(projectRoot, storyId, graphRevision, input) {
+    if (input.executorStopped !== true || input.authorizeDiscard !== true
+        || !/^[a-f0-9]{64}$/.test(input.expectedCandidateDigest))
+        throw new Error('private-execution-rejected-candidate-input-invalid');
+    const root = resolve(projectRoot);
+    try {
+        return await withPhysicalLock(root, storyId, setupSessionId(root, storyId), async () => {
+            const current = await checkedRejectedCandidate(root, storyId, graphRevision);
+            if (current.inspection.candidateDigest !== input.expectedCandidateDigest)
+                throw new Error('candidate-review-stale');
+            const target = await location(root, storyId), pin = readFileSync(target.path);
+            const archiveId = `rejected-${randomUUID()}`;
+            const archive = await ensureGitLifecyclePrivateChildDirectory(target.parent, archiveId);
+            const key = randomBytes(32), iv = randomBytes(12);
+            const plain = Buffer.from(JSON.stringify({ schemaVersion: 'PrivateYoloRejectedCandidateArchive/1',
+                inspection: current.inspection, files: current.files.map(({ content, ...metadata }) => ({
+                    ...metadata, contentBase64: content?.toString('base64') ?? null
+                })) }));
+            const cipher = createCipheriv('aes-256-gcm', key, iv);
+            cipher.setAAD(Buffer.from('private-yolo-rejected-candidate-v1'));
+            const ciphertext = Buffer.concat([cipher.update(plain), cipher.final()]);
+            plain.fill(0);
+            const sealed = Buffer.concat([iv, cipher.getAuthTag(), ciphertext]);
+            try {
+                await anchoredAtomicWriteFile(archive, 'candidate.key', key);
+                await anchoredAtomicWriteFile(archive, 'candidate.aesgcm', sealed);
+            }
+            finally {
+                key.fill(0);
+            }
+            const recheck = await checkedRejectedCandidate(root, storyId, graphRevision);
+            if (recheck.inspection.candidateDigest !== input.expectedCandidateDigest || !readFileSync(target.path).equals(pin))
+                throw new Error('candidate-raced');
+            const clone = current.record.workspace.workspacePath;
+            const tracked = current.files.filter(f => f.code !== '??').map(f => f.path);
+            if (tracked.length)
+                git(clone, ['restore', '--source', current.record.snapshotSha, '--worktree', '--', ...tracked]);
+            for (const file of current.files.filter(f => f.code === '??')) {
+                const path = join(clone, file.path), entry = lstatSync(path);
+                if (!entry.isFile() || entry.isSymbolicLink() || entry.nlink !== 1
+                    || createHash('sha256').update(readFileSync(path)).digest('hex') !== file.sha256)
+                    throw new Error('candidate-raced');
+                unlinkSync(path);
+            }
+            await verifySession(current.record, root, storyId, graphRevision);
+            if (!readFileSync(target.path).equals(pin))
+                throw new Error('session-pin-raced');
+            const receipt = { schemaVersion: 'PrivateYoloRejectedCandidateRecovery/1',
+                outcome: 'candidate-discarded', archiveId,
+                archiveSha256: createHash('sha256').update(sealed).digest('hex'),
+                candidateDigest: input.expectedCandidateDigest, snapshotSha: current.record.snapshotSha,
+                sourceHead: current.record.workspace.baseSha, sessionPinPreserved: true,
+                sourcePreserved: true, checkpointAccepted: false, publicSafe: true };
+            await anchoredAtomicWriteFile(archive, 'recovery.json', `${JSON.stringify(receipt)}\n`);
+            return receipt;
+        });
+    }
+    catch {
+        throw new Error('private-execution-rejected-candidate-recovery-unverified');
+    }
+}