@ornexus/neocortex 4.60.67 → 4.60.68

package/packages/client/dist/runner/headless/epic-terminal-git-runner.js

@@ -1,2 +1,318 @@
-import{createHash as G}from"node:crypto";import{EPIC_TERMINAL_GIT_REASON_CODES as x,classifyGitReconciliationCandidate as w,validateEpicTerminalGitDirective as N}from"../../../../shared/dist/yoloop/epic-terminal-git.js";import{p205TransientAuthorityMatchesAggregate as q}from"../../git/git-lifecycle-store.js";import{verifiedEpicMergeCandidateReceipt as _}from"./epic-merge-candidate-qa.js";async function O(e,o,t){const c=await o.inspectReconciliation(e);if(!c.ok)return{ok:!1,reconciliationReceipts:[],preservedDecisions:[],reasonCodes:[c.reasonCode],publicSafe:!0};const a=await E({idempotencyKey:e.idempotencyKey,enabled:!0,dryRun:e.dryRun},c.candidates,o,t),l=await o.persistReconciliation({epicId:e.epicId,reconciliationReceipts:a.receipts,preservedDecisions:a.preserved}),h=R([...a.reasonCodes,...l.ok?[]:[l.reasonCode]]);return{ok:a.ok&&l.ok,reconciliationReceipts:a.receipts,preservedDecisions:a.preserved,reasonCodes:h,publicSafe:!0}}async function T(e,o,t,c){const a=t();if(!o.prepareLifecycleEvidence)return m(e,{ok:!1,reasonCode:"epic-aggregate-qa-producer-required",retryEligible:!1,externalPolicy:!1},a);const l=c?{ok:!0,originBindingCaptured:!1,aggregateQaRecorded:!0,p205Authority:c}:await o.prepareLifecycleEvidence({epicId:e.epicId,nowIso:a});if(!l.ok)return m(e,l,a);if(!l.p205Authority)return m(e,{ok:!1,reasonCode:"epic-aggregate-qa-authority-required",retryEligible:!1,externalPolicy:!1},a);const h=await o.inspect(e);if(!h.ok)return m(e,h,a);const r=h.snapshot;if(!q(l.p205Authority,r.executionHeadSha,e.graphRevision))return m(e,{ok:!1,reasonCode:"epic-aggregate-qa-authority-binding-mismatch",retryEligible:!1,externalPolicy:!1},a);const p=N(e,{...r,nowIso:a});if(!p.ready)return y(!1,f(e,r,a,{strategy:e.strategy==="single_pr"?"single_pr":"direct",physicalStatus:"blocked_local_or_repo",retryEligible:p.reasonCodes.some(n=>n.endsWith("mismatch")||n.endsWith("active")),reasonCodes:p.reasonCodes}),[],[],p.reasonCodes);if(p.reasonCodes.includes(x.ALREADY_COMPLETE)&&r.existingReceipt){const n=await o.verifyTerminalReceipt(e,r.existingReceipt,a);if(!n.ok)return y(!1,r.existingReceipt,[],[],[n.reasonCode]);const k=_(n.candidateAuthority,{mergeSha:r.existingReceipt.mergeSha,originHeadSha:r.existingReceipt.baseSha,executionHeadSha:r.existingReceipt.executionHeadSha,graphRevision:e.graphRevision});if(!k)return y(!1,r.existingReceipt,[],[],["epic-merge-candidate-authority-required"]);const B={...r.existingReceipt,candidateQa:k,...n.providerGuard?{providerGuard:n.providerGuard}:{}},S=await E({idempotencyKey:e.idempotencyKey,enabled:e.reconcile.enabled,dryRun:e.reconcile.dryRun},r.reconciliationCandidates,o,t),b=await o.persist({terminalReceipt:B,reconciliationReceipts:S.receipts,preservedDecisions:S.preserved}),A=R([...p.reasonCodes,...S.reasonCodes,...b.ok?[]:[b.reasonCode]]);return y(b.ok&&S.ok,B,S.receipts,S.preserved,A)}let i;const s=await o.prepareMergeObject({originBranch:e.originBranch,executionBranch:e.executionBranch,originHeadSha:r.originHeadSha,executionHeadSha:r.executionHeadSha,graphRevision:e.graphRevision,nowIso:a,message:[`merge(${e.epicId}): integrate ${e.executionBranch} into ${e.originBranch}`,"",`Neocortex-Epic: ${e.epicId}`,`Neocortex-Origin-Branch: ${e.originBranch}`,`Neocortex-Execution-Branch: ${e.executionBranch}`,`Neocortex-Execution-Head: ${r.executionHeadSha}`,`Neocortex-Origin-Base: ${r.originHeadSha}`,`Neocortex-Graph-Revision: ${e.graphRevision}`,`Neocortex-Aggregate-QA: ${e.localGates.aggregateQaReceipt.receiptRef}`,`Neocortex-Idempotency: ${e.idempotencyKey}`].join(`
-`)});if(!s.ok)return i=f(e,r,a,{strategy:"direct",physicalStatus:"blocked_local_or_repo",retryEligible:s.retryEligible,reasonCodes:[s.reasonCode]}),await o.persist({terminalReceipt:i,reconciliationReceipts:[],preservedDecisions:[]}),y(!1,i,[],[],i.reasonCodes);const d=_(s.candidateAuthority,{originHeadSha:r.originHeadSha,executionHeadSha:r.executionHeadSha,mergeSha:s.mergeSha,graphRevision:e.graphRevision});if(!d)return m(e,{ok:!1,reasonCode:"epic-merge-candidate-authority-required",retryEligible:!1,externalPolicy:!1},a);if(e.strategy!=="single_pr"){const n=await o.pushMergeObject({epicId:e.epicId,originBranch:e.originBranch,executionBranch:e.executionBranch,executionHeadSha:r.executionHeadSha,expectedOriginSha:r.originHeadSha,mergeSha:s.mergeSha,graphRevision:e.graphRevision,candidateAuthority:s.candidateAuthority,storyCheckpointIds:e.storyCheckpointIds,aggregateQaReceipt:e.localGates.aggregateQaReceipt,nowIso:t()});n.ok?i=f(e,r,a,{strategy:"direct",mergeSha:s.mergeSha,pushedSha:n.pushedSha,candidateQa:d,physicalStatus:"pushed",retryEligible:!1,reasonCodes:[x.READY],completedAt:t()}):e.strategy==="direct_or_single_pr"&&n.externalPolicy?i=await I(e,r,o,a,t,d,s.candidateAuthority):i=f(e,r,a,{strategy:"direct",mergeSha:s.mergeSha,physicalStatus:n.externalPolicy?"denied_external_gate":"blocked_local_or_repo",retryEligible:n.retryEligible,reasonCodes:[n.reasonCode,...n.retryEligible?[x.RETRY_ELIGIBLE]:[]]})}else i=await I(e,r,o,a,t,d,s.candidateAuthority);const u=i.physicalStatus==="pushed"?await o.verifyTerminalReceipt(e,i,t()):null;if(u&&!u.ok){const n=f(e,r,a,{...i,physicalStatus:"blocked_local_or_repo",retryEligible:u.retryEligible,reasonCodes:[u.reasonCode]});return await o.persist({terminalReceipt:n,reconciliationReceipts:[],preservedDecisions:[]}),y(!1,n,[],[],n.reasonCodes)}if(u?.ok){const n=_(u.candidateAuthority,{mergeSha:i.mergeSha,originHeadSha:i.baseSha,executionHeadSha:i.executionHeadSha,graphRevision:e.graphRevision});if(!n)return y(!1,i,[],[],["epic-merge-candidate-authority-required"]);i={...i,candidateQa:n,...u.providerGuard?{providerGuard:u.providerGuard}:{}}}const g=i.physicalStatus==="pushed"?await E({idempotencyKey:e.idempotencyKey,enabled:e.reconcile.enabled,dryRun:e.reconcile.dryRun},r.reconciliationCandidates,o,t):{ok:!0,receipts:[],preserved:[],reasonCodes:[]},C=await o.persist({terminalReceipt:i,reconciliationReceipts:g.receipts,preservedDecisions:g.preserved}),H=R([...i.reasonCodes,...g.reasonCodes,...C.ok?[]:[C.reasonCode]]);return y(i.physicalStatus==="pushed"&&g.ok&&C.ok,i,g.receipts,g.preserved,H)}async function I(e,o,t,c,a,l,h){const r=await t.ensureSingleEpicPullRequest({epicId:e.epicId,originBranch:e.originBranch,executionBranch:e.executionBranch,expectedStoryHeadSha:o.executionHeadSha,expectedPullRequestHeadSha:l.mergeSha,candidateQa:l,candidateAuthority:h,idempotencyKey:e.idempotencyKey});if(!r.ok)return f(e,o,c,{strategy:"single_pr",physicalStatus:r.externalPolicy?"denied_external_gate":"blocked_local_or_repo",retryEligible:r.retryEligible,reasonCodes:[r.reasonCode]});const p=await t.mergeEpicPullRequest({prNumber:r.prNumber,originBranch:e.originBranch,executionBranch:e.executionBranch,expectedStoryHeadSha:o.executionHeadSha,expectedPullRequestHeadSha:l.mergeSha,expectedOriginHeadSha:o.originHeadSha,candidateQa:l,candidateAuthority:h,nowIso:a()});return p.ok?f(e,o,c,{strategy:"single_pr",prNumber:r.prNumber,mergeSha:p.mergeSha,pushedSha:p.pushedSha,candidateQa:l,providerGuard:p.providerGuard,physicalStatus:"pushed",retryEligible:!1,reasonCodes:[x.READY],completedAt:a()}):f(e,o,c,{strategy:"single_pr",prNumber:r.prNumber,physicalStatus:p.externalPolicy?"denied_external_gate":"blocked_local_or_repo",retryEligible:p.retryEligible,reasonCodes:[p.reasonCode,...p.retryEligible?[x.RETRY_ELIGIBLE]:[]]})}async function E(e,o,t,c){if(!e.enabled)return{ok:!0,receipts:[],preserved:[],reasonCodes:[]};const a=[],l=[],h=[];let r=!0;const p=new Set,i={pull_request:0,local_branch:1,remote_branch:2};for(const s of[...o].sort((d,u)=>i[d.kind]-i[u.kind]||d.resourceId.localeCompare(u.resourceId))){const d=w(s);if(h.push(...d.reasonCodes),d.action==="preserve"){l.push(d);continue}if(s.kind!=="pull_request"&&p.has(s.branchName)){l.push({...d,action:"preserve",reasonCodes:["git-resource-related-pr-close-pending"]}),h.push("git-resource-related-pr-close-pending");continue}const u=`reconciliation:v2:${G("sha256").update([s.resourceId,d.action].join("\0")).digest("hex")}`,g=await t.applyReconciliation(s,d,e.dryRun);if(!g.ok){r=!1,s.kind==="pull_request"&&p.add(s.branchName),h.push(g.reasonCode),a.push({schemaVersion:1,resourceId:s.resourceId,action:d.action,outcome:"failed",idempotencyKey:u,reasonCodes:[g.reasonCode],recordedAt:c(),publicSafe:!0});continue}a.push({schemaVersion:1,resourceId:s.resourceId,action:d.action,outcome:g.outcome,idempotencyKey:u,reasonCodes:d.reasonCodes,recordedAt:c(),publicSafe:!0})}return{ok:r,receipts:a,preserved:l,reasonCodes:R(h)}}function f(e,o,t,c){return Object.freeze({schemaVersion:1,epicId:e.epicId,executionBranch:e.executionBranch,originBranch:e.originBranch,baseSha:o.originHeadSha,executionHeadSha:o.executionHeadSha,localGateReceiptRefs:e.localGates.receiptRefs,idempotencyKey:e.idempotencyKey,attemptStartedAt:t,publicSafe:!0,...c})}function m(e,o,t){const c="0".repeat(40),a={schemaVersion:1,epicId:e.epicId,executionBranch:e.executionBranch,originBranch:e.originBranch,baseSha:c,executionHeadSha:e.expectedExecutionHeadSha,strategy:e.strategy==="single_pr"?"single_pr":"direct",physicalStatus:o.externalPolicy?"denied_external_gate":"blocked_local_or_repo",localGateReceiptRefs:e.localGates.receiptRefs,idempotencyKey:e.idempotencyKey,attemptStartedAt:t,retryEligible:o.retryEligible,reasonCodes:[o.reasonCode],publicSafe:!0};return y(!1,a,[],[],a.reasonCodes)}function y(e,o,t,c,a){return{ok:e,receipt:o,reconciliationReceipts:t,preservedDecisions:c,reasonCodes:R(a),publicSafe:!0}}function R(e){return[...new Set(e)]}export{O as executeEpicGitReconciliation,T as executeEpicTerminalGit};
+/**
+ * Root-owned terminal epic Git executor. Effects are adapter-injected so tests
+ * never mutate real refs or provider resources.
+ */
+import { createHash } from 'node:crypto';
+import { EPIC_TERMINAL_GIT_REASON_CODES, classifyGitReconciliationCandidate, validateEpicTerminalGitDirective, } from '../../../../shared/dist/yoloop/epic-terminal-git.js';
+import { p205TransientAuthorityMatchesAggregate, } from '../../git/git-lifecycle-store.js';
+import { verifiedEpicMergeCandidateReceipt, } from './epic-merge-candidate-qa.js';
+/** Run the same fail-closed reconciler at start/resume or explicit audit. */
+export async function executeEpicGitReconciliation(directive, adapter, now) {
+    const inspected = await adapter.inspectReconciliation(directive);
+    if (!inspected.ok) {
+        return { ok: false, reconciliationReceipts: [], preservedDecisions: [], reasonCodes: [inspected.reasonCode], publicSafe: true };
+    }
+    const reconciliation = await reconcileCandidates({
+        idempotencyKey: directive.idempotencyKey,
+        enabled: true,
+        dryRun: directive.dryRun,
+    }, inspected.candidates, adapter, now);
+    const persisted = await adapter.persistReconciliation({
+        epicId: directive.epicId,
+        reconciliationReceipts: reconciliation.receipts,
+        preservedDecisions: reconciliation.preserved,
+    });
+    const reasonCodes = unique([...reconciliation.reasonCodes, ...(persisted.ok ? [] : [persisted.reasonCode])]);
+    return {
+        ok: reconciliation.ok && persisted.ok,
+        reconciliationReceipts: reconciliation.receipts,
+        preservedDecisions: reconciliation.preserved,
+        reasonCodes,
+        publicSafe: true,
+    };
+}
+export async function executeEpicTerminalGit(directive, adapter, now, preparedAuthority) {
+    const startedAt = now();
+    if (!adapter.prepareLifecycleEvidence) {
+        return failedBeforeSnapshot(directive, {
+            ok: false, reasonCode: 'epic-aggregate-qa-producer-required', retryEligible: false, externalPolicy: false,
+        }, startedAt);
+    }
+    const produced = preparedAuthority
+        ? { ok: true, originBindingCaptured: false, aggregateQaRecorded: true, p205Authority: preparedAuthority }
+        : await adapter.prepareLifecycleEvidence({ epicId: directive.epicId, nowIso: startedAt });
+    if (!produced.ok)
+        return failedBeforeSnapshot(directive, produced, startedAt);
+    if (!produced.p205Authority) {
+        return failedBeforeSnapshot(directive, {
+            ok: false, reasonCode: 'epic-aggregate-qa-authority-required', retryEligible: false, externalPolicy: false,
+        }, startedAt);
+    }
+    const inspected = await adapter.inspect(directive);
+    if (!inspected.ok)
+        return failedBeforeSnapshot(directive, inspected, startedAt);
+    const snapshot = inspected.snapshot;
+    if (!p205TransientAuthorityMatchesAggregate(produced.p205Authority, snapshot.executionHeadSha, directive.graphRevision)) {
+        return failedBeforeSnapshot(directive, {
+            ok: false, reasonCode: 'epic-aggregate-qa-authority-binding-mismatch', retryEligible: false, externalPolicy: false,
+        }, startedAt);
+    }
+    const readiness = validateEpicTerminalGitDirective(directive, { ...snapshot, nowIso: startedAt });
+    if (!readiness.ready) {
+        return terminalResult(false, baseReceipt(directive, snapshot, startedAt, {
+            strategy: directive.strategy === 'single_pr' ? 'single_pr' : 'direct',
+            physicalStatus: 'blocked_local_or_repo',
+            retryEligible: readiness.reasonCodes.some((code) => code.endsWith('mismatch') || code.endsWith('active')),
+            reasonCodes: readiness.reasonCodes,
+        }), [], [], readiness.reasonCodes);
+    }
+    if (readiness.reasonCodes.includes(EPIC_TERMINAL_GIT_REASON_CODES.ALREADY_COMPLETE) && snapshot.existingReceipt) {
+        const verified = await adapter.verifyTerminalReceipt(directive, snapshot.existingReceipt, startedAt);
+        if (!verified.ok)
+            return terminalResult(false, snapshot.existingReceipt, [], [], [verified.reasonCode]);
+        const candidateQa = verifiedEpicMergeCandidateReceipt(verified.candidateAuthority, {
+            mergeSha: snapshot.existingReceipt.mergeSha, originHeadSha: snapshot.existingReceipt.baseSha,
+            executionHeadSha: snapshot.existingReceipt.executionHeadSha, graphRevision: directive.graphRevision,
+        });
+        if (!candidateQa)
+            return terminalResult(false, snapshot.existingReceipt, [], [], ['epic-merge-candidate-authority-required']);
+        const verifiedReceipt = {
+            ...snapshot.existingReceipt, candidateQa,
+            ...(verified.providerGuard ? { providerGuard: verified.providerGuard } : {}),
+        };
+        const reconciliation = await reconcileCandidates({ idempotencyKey: directive.idempotencyKey, enabled: directive.reconcile.enabled, dryRun: directive.reconcile.dryRun }, snapshot.reconciliationCandidates, adapter, now);
+        const persisted = await adapter.persist({
+            terminalReceipt: verifiedReceipt,
+            reconciliationReceipts: reconciliation.receipts,
+            preservedDecisions: reconciliation.preserved,
+        });
+        const reasons = unique([...readiness.reasonCodes, ...reconciliation.reasonCodes, ...(persisted.ok ? [] : [persisted.reasonCode])]);
+        return terminalResult(persisted.ok && reconciliation.ok, verifiedReceipt, reconciliation.receipts, reconciliation.preserved, reasons);
+    }
+    let receipt;
+    const prepared = await adapter.prepareMergeObject({
+        originBranch: directive.originBranch,
+        executionBranch: directive.executionBranch,
+        originHeadSha: snapshot.originHeadSha,
+        executionHeadSha: snapshot.executionHeadSha,
+        graphRevision: directive.graphRevision,
+        nowIso: startedAt,
+        message: [
+            `merge(${directive.epicId}): integrate ${directive.executionBranch} into ${directive.originBranch}`,
+            '',
+            `Neocortex-Epic: ${directive.epicId}`,
+            `Neocortex-Origin-Branch: ${directive.originBranch}`,
+            `Neocortex-Execution-Branch: ${directive.executionBranch}`,
+            `Neocortex-Execution-Head: ${snapshot.executionHeadSha}`,
+            `Neocortex-Origin-Base: ${snapshot.originHeadSha}`,
+            `Neocortex-Graph-Revision: ${directive.graphRevision}`,
+            `Neocortex-Aggregate-QA: ${directive.localGates.aggregateQaReceipt.receiptRef}`,
+            `Neocortex-Idempotency: ${directive.idempotencyKey}`,
+        ].join('\n'),
+    });
+    if (!prepared.ok) {
+        receipt = baseReceipt(directive, snapshot, startedAt, {
+            strategy: 'direct',
+            physicalStatus: 'blocked_local_or_repo',
+            retryEligible: prepared.retryEligible,
+            reasonCodes: [prepared.reasonCode],
+        });
+        await adapter.persist({ terminalReceipt: receipt, reconciliationReceipts: [], preservedDecisions: [] });
+        return terminalResult(false, receipt, [], [], receipt.reasonCodes);
+    }
+    const candidateQa = verifiedEpicMergeCandidateReceipt(prepared.candidateAuthority, {
+        originHeadSha: snapshot.originHeadSha, executionHeadSha: snapshot.executionHeadSha,
+        mergeSha: prepared.mergeSha, graphRevision: directive.graphRevision,
+    });
+    if (!candidateQa)
+        return failedBeforeSnapshot(directive, {
+            ok: false, reasonCode: 'epic-merge-candidate-authority-required', retryEligible: false, externalPolicy: false,
+        }, startedAt);
+    if (directive.strategy !== 'single_pr') {
+        const pushed = await adapter.pushMergeObject({
+            epicId: directive.epicId,
+            originBranch: directive.originBranch,
+            executionBranch: directive.executionBranch,
+            executionHeadSha: snapshot.executionHeadSha,
+            expectedOriginSha: snapshot.originHeadSha,
+            mergeSha: prepared.mergeSha,
+            graphRevision: directive.graphRevision,
+            candidateAuthority: prepared.candidateAuthority,
+            storyCheckpointIds: directive.storyCheckpointIds,
+            aggregateQaReceipt: directive.localGates.aggregateQaReceipt,
+            nowIso: now(),
+        });
+        if (pushed.ok) {
+            receipt = baseReceipt(directive, snapshot, startedAt, {
+                strategy: 'direct', mergeSha: prepared.mergeSha, pushedSha: pushed.pushedSha, candidateQa,
+                physicalStatus: 'pushed', retryEligible: false,
+                reasonCodes: [EPIC_TERMINAL_GIT_REASON_CODES.READY], completedAt: now(),
+            });
+        }
+        else if (directive.strategy === 'direct_or_single_pr' && pushed.externalPolicy) {
+            receipt = await executePullRequestFallback(directive, snapshot, adapter, startedAt, now, candidateQa, prepared.candidateAuthority);
+        }
+        else {
+            receipt = baseReceipt(directive, snapshot, startedAt, {
+                strategy: 'direct', mergeSha: prepared.mergeSha,
+                physicalStatus: pushed.externalPolicy ? 'denied_external_gate' : 'blocked_local_or_repo',
+                retryEligible: pushed.retryEligible,
+                reasonCodes: [pushed.reasonCode, ...(pushed.retryEligible ? [EPIC_TERMINAL_GIT_REASON_CODES.RETRY_ELIGIBLE] : [])],
+            });
+        }
+    }
+    else {
+        receipt = await executePullRequestFallback(directive, snapshot, adapter, startedAt, now, candidateQa, prepared.candidateAuthority);
+    }
+    const verified = receipt.physicalStatus === 'pushed'
+        ? await adapter.verifyTerminalReceipt(directive, receipt, now())
+        : null;
+    if (verified && !verified.ok) {
+        const failedReceipt = baseReceipt(directive, snapshot, startedAt, {
+            ...receipt,
+            physicalStatus: 'blocked_local_or_repo',
+            retryEligible: verified.retryEligible,
+            reasonCodes: [verified.reasonCode],
+        });
+        await adapter.persist({ terminalReceipt: failedReceipt, reconciliationReceipts: [], preservedDecisions: [] });
+        return terminalResult(false, failedReceipt, [], [], failedReceipt.reasonCodes);
+    }
+    if (verified?.ok) {
+        const accepted = verifiedEpicMergeCandidateReceipt(verified.candidateAuthority, {
+            mergeSha: receipt.mergeSha, originHeadSha: receipt.baseSha,
+            executionHeadSha: receipt.executionHeadSha, graphRevision: directive.graphRevision,
+        });
+        if (!accepted)
+            return terminalResult(false, receipt, [], [], ['epic-merge-candidate-authority-required']);
+        receipt = {
+            ...receipt, candidateQa: accepted,
+            ...(verified.providerGuard ? { providerGuard: verified.providerGuard } : {}),
+        };
+    }
+    const reconciliation = receipt.physicalStatus === 'pushed'
+        ? await reconcileCandidates({ idempotencyKey: directive.idempotencyKey, enabled: directive.reconcile.enabled, dryRun: directive.reconcile.dryRun }, snapshot.reconciliationCandidates, adapter, now)
+        : { ok: true, receipts: [], preserved: [], reasonCodes: [] };
+    const persisted = await adapter.persist({
+        terminalReceipt: receipt,
+        reconciliationReceipts: reconciliation.receipts,
+        preservedDecisions: reconciliation.preserved,
+    });
+    const reasons = unique([...receipt.reasonCodes, ...reconciliation.reasonCodes, ...(persisted.ok ? [] : [persisted.reasonCode])]);
+    return terminalResult(receipt.physicalStatus === 'pushed' && reconciliation.ok && persisted.ok, receipt, reconciliation.receipts, reconciliation.preserved, reasons);
+}
+async function executePullRequestFallback(directive, snapshot, adapter, startedAt, now, candidateQa, candidateAuthority) {
+    const pr = await adapter.ensureSingleEpicPullRequest({
+        epicId: directive.epicId,
+        originBranch: directive.originBranch,
+        executionBranch: directive.executionBranch,
+        expectedStoryHeadSha: snapshot.executionHeadSha,
+        expectedPullRequestHeadSha: candidateQa.mergeSha,
+        candidateQa,
+        candidateAuthority,
+        idempotencyKey: directive.idempotencyKey,
+    });
+    if (!pr.ok)
+        return baseReceipt(directive, snapshot, startedAt, {
+            strategy: 'single_pr', physicalStatus: pr.externalPolicy ? 'denied_external_gate' : 'blocked_local_or_repo',
+            retryEligible: pr.retryEligible, reasonCodes: [pr.reasonCode],
+        });
+    const merged = await adapter.mergeEpicPullRequest({
+        prNumber: pr.prNumber,
+        originBranch: directive.originBranch,
+        executionBranch: directive.executionBranch,
+        expectedStoryHeadSha: snapshot.executionHeadSha,
+        expectedPullRequestHeadSha: candidateQa.mergeSha,
+        expectedOriginHeadSha: snapshot.originHeadSha,
+        candidateQa, candidateAuthority, nowIso: now(),
+    });
+    if (!merged.ok)
+        return baseReceipt(directive, snapshot, startedAt, {
+            strategy: 'single_pr', prNumber: pr.prNumber,
+            physicalStatus: merged.externalPolicy ? 'denied_external_gate' : 'blocked_local_or_repo',
+            retryEligible: merged.retryEligible,
+            reasonCodes: [merged.reasonCode, ...(merged.retryEligible ? [EPIC_TERMINAL_GIT_REASON_CODES.RETRY_ELIGIBLE] : [])],
+        });
+    return baseReceipt(directive, snapshot, startedAt, {
+        strategy: 'single_pr', prNumber: pr.prNumber, mergeSha: merged.mergeSha, pushedSha: merged.pushedSha, candidateQa,
+        providerGuard: merged.providerGuard,
+        physicalStatus: 'pushed', retryEligible: false,
+        reasonCodes: [EPIC_TERMINAL_GIT_REASON_CODES.READY], completedAt: now(),
+    });
+}
+async function reconcileCandidates(directive, candidates, adapter, now) {
+    if (!directive.enabled)
+        return { ok: true, receipts: [], preserved: [], reasonCodes: [] };
+    const receipts = [];
+    const preserved = [];
+    const reasons = [];
+    let ok = true;
+    const failedPrBranches = new Set();
+    const order = { pull_request: 0, local_branch: 1, remote_branch: 2 };
+    for (const candidate of [...candidates].sort((a, b) => order[a.kind] - order[b.kind] || a.resourceId.localeCompare(b.resourceId))) {
+        const decision = classifyGitReconciliationCandidate(candidate);
+        reasons.push(...decision.reasonCodes);
+        if (decision.action === 'preserve') {
+            preserved.push(decision);
+            continue;
+        }
+        if (candidate.kind !== 'pull_request' && failedPrBranches.has(candidate.branchName)) {
+            preserved.push({ ...decision, action: 'preserve', reasonCodes: ['git-resource-related-pr-close-pending'] });
+            reasons.push('git-resource-related-pr-close-pending');
+            continue;
+        }
+        // Stable across start/resume/terminal directives; no long branch name or
+        // unbounded parent id can overflow the public receipt schema.
+        const receiptKey = `reconciliation:v2:${createHash('sha256').update([candidate.resourceId, decision.action].join('\0')).digest('hex')}`;
+        const applied = await adapter.applyReconciliation(candidate, decision, directive.dryRun);
+        if (!applied.ok) {
+            ok = false;
+            if (candidate.kind === 'pull_request')
+                failedPrBranches.add(candidate.branchName);
+            reasons.push(applied.reasonCode);
+            receipts.push({
+                schemaVersion: 1, resourceId: candidate.resourceId, action: decision.action,
+                outcome: 'failed', idempotencyKey: receiptKey,
+                reasonCodes: [applied.reasonCode], recordedAt: now(), publicSafe: true,
+            });
+            continue;
+        }
+        receipts.push({
+            schemaVersion: 1, resourceId: candidate.resourceId, action: decision.action,
+            outcome: applied.outcome, idempotencyKey: receiptKey,
+            reasonCodes: decision.reasonCodes, recordedAt: now(), publicSafe: true,
+        });
+    }
+    return { ok, receipts, preserved, reasonCodes: unique(reasons) };
+}
+function baseReceipt(directive, snapshot, startedAt, override) {
+    return Object.freeze({
+        schemaVersion: 1,
+        epicId: directive.epicId,
+        executionBranch: directive.executionBranch,
+        originBranch: directive.originBranch,
+        baseSha: snapshot.originHeadSha,
+        executionHeadSha: snapshot.executionHeadSha,
+        localGateReceiptRefs: directive.localGates.receiptRefs,
+        idempotencyKey: directive.idempotencyKey,
+        attemptStartedAt: startedAt,
+        publicSafe: true,
+        ...override,
+    });
+}
+function failedBeforeSnapshot(directive, failure, startedAt) {
+    const placeholder = '0'.repeat(40);
+    const receipt = {
+        schemaVersion: 1, epicId: directive.epicId, executionBranch: directive.executionBranch, originBranch: directive.originBranch,
+        baseSha: placeholder, executionHeadSha: directive.expectedExecutionHeadSha, strategy: directive.strategy === 'single_pr' ? 'single_pr' : 'direct',
+        physicalStatus: failure.externalPolicy ? 'denied_external_gate' : 'blocked_local_or_repo',
+        localGateReceiptRefs: directive.localGates.receiptRefs, idempotencyKey: directive.idempotencyKey,
+        attemptStartedAt: startedAt, retryEligible: failure.retryEligible, reasonCodes: [failure.reasonCode], publicSafe: true,
+    };
+    return terminalResult(false, receipt, [], [], receipt.reasonCodes);
+}
+function terminalResult(ok, receipt, reconciliationReceipts, preservedDecisions, reasonCodes) {
+    return { ok, receipt, reconciliationReceipts, preservedDecisions, reasonCodes: unique(reasonCodes), publicSafe: true };
+}
+function unique(values) {
+    return [...new Set(values)];
+}

package/packages/client/dist/runner/headless/fake-adapter.js

@@ -1 +1,62 @@
-import{HEADLESS_REASON_CODES as i,adapterAvailabilitySuccess as u,createRejectedExecutionResult as s,hashPublicValue as n,redaction as d,renderHeadlessPrompt as c,validateHeadlessAdapterExecutionInput as p}from"./types.js";function m(t="fake"){return{id:t,displayName:t==="test"?"Headless Test Adapter":"Headless Fake Adapter",async checkAvailability(){return u(t,"neocortex-headless-fake","Fake headless adapter is available for deterministic tests.")},buildInvocation(r){const a=p(r,t);return a.ok?{ok:!0,invocation:{adapterId:t,commandName:"neocortex-headless-fake",args:[a.input.promptKind,a.input.targetRef],promptHash:a.promptHash,...a.input.modelId?{modelId:a.input.modelId}:{},timeoutMs:a.input.timeoutMs??600*1e3,publicSafe:!0},publicSafe:!0}:a},async execute(r,a){const e=p(r,t);if(!e.ok)return s(t,t,e);const o=c(e.input);return{status:"completed",adapterId:t,runtimeId:t,...e.input.modelId?{modelId:e.input.modelId}:{},...e.input.runtimeSource?{runtimeSource:e.input.runtimeSource}:{},reasonCode:i.EXECUTION_COMPLETED,reasonCodes:[i.EXECUTION_COMPLETED,i.RECEIPT_REDACTED],exitCode:0,signal:null,durationMs:0,counts:{prompts:1,syntheticRuns:1},hashes:{prompt:n(o),receipt:n(`${t}:${e.input.targetRef}:${e.input.modelId??""}`)},publicSummary:"Fake headless adapter completed deterministic public-safe execution.",redactionSummary:[d("prompt","prompt_body",n(o))],relativePaths:[e.input.targetRef],...e.input.receipt?{receipt:e.input.receipt}:{},publicSafe:!0}}}}export{m as createFakeHeadlessAdapter};
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * P190.04 -- deterministic fake headless adapter for tests.
+ */
+import { HEADLESS_REASON_CODES, adapterAvailabilitySuccess, createRejectedExecutionResult, hashPublicValue, redaction, renderHeadlessPrompt, validateHeadlessAdapterExecutionInput, } from './types.js';
+export function createFakeHeadlessAdapter(id = 'fake') {
+    return {
+        id,
+        displayName: id === 'test' ? 'Headless Test Adapter' : 'Headless Fake Adapter',
+        async checkAvailability() {
+            return adapterAvailabilitySuccess(id, 'neocortex-headless-fake', 'Fake headless adapter is available for deterministic tests.');
+        },
+        buildInvocation(input) {
+            const validation = validateHeadlessAdapterExecutionInput(input, id);
+            if (!validation.ok)
+                return validation;
+            return {
+                ok: true,
+                invocation: {
+                    adapterId: id,
+                    commandName: 'neocortex-headless-fake',
+                    args: [validation.input.promptKind, validation.input.targetRef],
+                    promptHash: validation.promptHash,
+                    ...(validation.input.modelId ? { modelId: validation.input.modelId } : {}),
+                    timeoutMs: validation.input.timeoutMs ?? 10 * 60 * 1000,
+                    publicSafe: true,
+                },
+                publicSafe: true,
+            };
+        },
+        async execute(input, _options) {
+            const validation = validateHeadlessAdapterExecutionInput(input, id);
+            if (!validation.ok)
+                return createRejectedExecutionResult(id, id, validation);
+            const prompt = renderHeadlessPrompt(validation.input);
+            return {
+                status: 'completed',
+                adapterId: id,
+                runtimeId: id,
+                ...(validation.input.modelId ? { modelId: validation.input.modelId } : {}),
+                ...(validation.input.runtimeSource ? { runtimeSource: validation.input.runtimeSource } : {}),
+                reasonCode: HEADLESS_REASON_CODES.EXECUTION_COMPLETED,
+                reasonCodes: [HEADLESS_REASON_CODES.EXECUTION_COMPLETED, HEADLESS_REASON_CODES.RECEIPT_REDACTED],
+                exitCode: 0,
+                signal: null,
+                durationMs: 0,
+                counts: { prompts: 1, syntheticRuns: 1 },
+                hashes: {
+                    prompt: hashPublicValue(prompt),
+                    receipt: hashPublicValue(`${id}:${validation.input.targetRef}:${validation.input.modelId ?? ''}`),
+                },
+                publicSummary: 'Fake headless adapter completed deterministic public-safe execution.',
+                redactionSummary: [redaction('prompt', 'prompt_body', hashPublicValue(prompt))],
+                relativePaths: [validation.input.targetRef],
+                ...(validation.input.receipt ? { receipt: validation.input.receipt } : {}),
+                publicSafe: true,
+            };
+        },
+    };
+}

package/packages/client/dist/runner/headless/managed-profile.js

@@ -1 +1,132 @@
-import{lstatSync as E,readFileSync as g}from"node:fs";import{homedir as p}from"node:os";import{join as t}from"node:path";import{getSubagentApprovalPolicy as h}from"../../config.js";import{HEADLESS_REASON_CODES as i,boundPublicSummary as l,hashPublicValue as f,redaction as v}from"./types.js";const s="[P201-EV-HEADLESS]",m=96*1024;function M(o,e){const r=P(o,e);for(const n of r){let a;try{a=E(n)}catch(u){if(u.code==="ENOENT")continue;return d()}if(a.isSymbolicLink()||!a.isFile()||a.size<=0||a.size>m)return d();try{const u=g(n,"utf8");return y(o,u)?b(o,e):d()}catch{return d()}}return c(i.MANAGED_PROFILE_MISSING,"Managed neocortex profile was not found in a trusted host location.")}function C(o,e,r){return{status:"failed",adapterId:o,runtimeId:e.runtimeId,...e.modelId?{modelId:e.modelId}:{},...e.runtimeSource?{runtimeSource:e.runtimeSource}:{},reasonCode:r.reasonCode,reasonCodes:[r.reasonCode,i.RECEIPT_REDACTED],durationMs:0,counts:{governedPreflightDenials:1},hashes:{governanceEvidence:f(s)},publicSummary:r.publicSummary,redactionSummary:[v("managedProfile","managed_profile","value-denied")],relativePaths:[e.targetRef],...e.receipt?{receipt:e.receipt}:{},publicSafe:!0}}function D(o){return{...o,counts:{...o.counts,governedPreflightPasses:1},hashes:{...o.hashes,governanceEvidence:f(s)},publicSummary:l(`${o.publicSummary} ${s}`)}}function P(o,e){const r=[];e.cwd&&r.push(o==="claude-code"?t(e.cwd,".claude","agents","neocortex","neocortex.md"):t(e.cwd,".opencode","agents","neocortex.md"));const n=S(e.env);if(!n)return r;if(o==="claude-code")r.push(t(n,".claude","agents","neocortex","neocortex.md"));else{const a=e.env?.OPENCODE_HOME||t(e.env?.XDG_CONFIG_HOME||t(n,".config"),"opencode");r.push(t(a,"agents","neocortex.md")),r.push(t(n,".opencode","agents","neocortex.md"))}return Array.from(new Set(r))}function S(o){const e=o?o.HOME||o.USERPROFILE:p();return e&&!/[\r\n\0]/.test(e)?e:void 0}function y(o,e){return Buffer.byteLength(e)>m?!1:o==="claude-code"?/^---\r?\n[\s\S]*?^name:\s*neocortex\s*$[\s\S]*?^permissionMode:\s*bypassPermissions\s*$[\s\S]*?^disallowedTools:\s*Agent,\s*Task\s*$[\s\S]*?^---\s*$/m.test(e)&&e.includes("Child depth is bounded to one.")&&e.includes("Never pass the original root invocation"):/^---\r?\n[\s\S]*?^name:\s*neocortex\s*$[\s\S]*?^mode:\s*subagent\s*$[\s\S]*?^\s+"\*":\s*allow\s*$[\s\S]*?^\s+task:\s*deny\s*$[\s\S]*?^---\s*$/m.test(e)&&e.includes("Never pass the original root invocation")&&e.includes("root OpenCode agent remains the yoloop owner")}function b(o,e){try{const r=S(e.env),n=h({...r?{configFilePath:t(r,".neocortex","config.json")}:{},platformTarget:o,hostPolicy:e.approvalHostPolicy}).resolution;return n.requestedMode!=="max"||n.effectiveMode!=="max"?c(i.APPROVAL_POLICY_MISMATCH,"Managed max profile did not match the effective subagent approval policy."):{ok:!0,publicSafe:!0}}catch{return c(i.APPROVAL_POLICY_INVALID,"Managed subagent approval policy could not be validated safely.")}}function c(o,e){return{ok:!1,reasonCode:o,publicSummary:l(`${e} ${s}`),publicSafe:!0}}function d(){return c(i.MANAGED_PROFILE_INVALID,"Managed neocortex profile failed bounded identity, approval, or isolation validation.")}export{s as GOVERNED_HEADLESS_EVIDENCE,C as governedPreflightFailureResult,M as preflightManagedHeadlessProfile,D as withGovernedHeadlessEvidence};
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * P201.12 -- fixed-path managed profile and effective policy preflight.
+ */
+import { lstatSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { getSubagentApprovalPolicy } from '../../config.js';
+import { HEADLESS_REASON_CODES, boundPublicSummary, hashPublicValue, redaction, } from './types.js';
+export const GOVERNED_HEADLESS_EVIDENCE = '[P201-EV-HEADLESS]';
+const MAX_PROFILE_BYTES = 96 * 1024;
+export function preflightManagedHeadlessProfile(adapterId, options) {
+    const candidates = managedProfileCandidates(adapterId, options);
+    for (const candidate of candidates) {
+        let stat;
+        try {
+            stat = lstatSync(candidate);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                continue;
+            return invalidProfile();
+        }
+        if (stat.isSymbolicLink() || !stat.isFile() || stat.size <= 0 || stat.size > MAX_PROFILE_BYTES) {
+            return invalidProfile();
+        }
+        try {
+            const content = readFileSync(candidate, 'utf8');
+            if (!isGovernedProfile(adapterId, content))
+                return invalidProfile();
+            return validateEffectiveApprovalPolicy(adapterId, options);
+        }
+        catch {
+            return invalidProfile();
+        }
+    }
+    return failure(HEADLESS_REASON_CODES.MANAGED_PROFILE_MISSING, 'Managed neocortex profile was not found in a trusted host location.');
+}
+export function governedPreflightFailureResult(adapterId, input, preflight) {
+    return {
+        status: 'failed',
+        adapterId,
+        runtimeId: input.runtimeId,
+        ...(input.modelId ? { modelId: input.modelId } : {}),
+        ...(input.runtimeSource ? { runtimeSource: input.runtimeSource } : {}),
+        reasonCode: preflight.reasonCode,
+        reasonCodes: [preflight.reasonCode, HEADLESS_REASON_CODES.RECEIPT_REDACTED],
+        durationMs: 0,
+        counts: { governedPreflightDenials: 1 },
+        hashes: { governanceEvidence: hashPublicValue(GOVERNED_HEADLESS_EVIDENCE) },
+        publicSummary: preflight.publicSummary,
+        redactionSummary: [redaction('managedProfile', 'managed_profile', 'value-denied')],
+        relativePaths: [input.targetRef],
+        ...(input.receipt ? { receipt: input.receipt } : {}),
+        publicSafe: true,
+    };
+}
+export function withGovernedHeadlessEvidence(result) {
+    return {
+        ...result,
+        counts: { ...result.counts, governedPreflightPasses: 1 },
+        hashes: { ...result.hashes, governanceEvidence: hashPublicValue(GOVERNED_HEADLESS_EVIDENCE) },
+        publicSummary: boundPublicSummary(`${result.publicSummary} ${GOVERNED_HEADLESS_EVIDENCE}`),
+    };
+}
+function managedProfileCandidates(adapterId, options) {
+    const candidates = [];
+    if (options.cwd) {
+        candidates.push(adapterId === 'claude-code'
+            ? join(options.cwd, '.claude', 'agents', 'neocortex', 'neocortex.md')
+            : join(options.cwd, '.opencode', 'agents', 'neocortex.md'));
+    }
+    const home = trustedHome(options.env);
+    if (!home)
+        return candidates;
+    if (adapterId === 'claude-code') {
+        candidates.push(join(home, '.claude', 'agents', 'neocortex', 'neocortex.md'));
+    }
+    else {
+        const configHome = options.env?.OPENCODE_HOME
+            || join(options.env?.XDG_CONFIG_HOME || join(home, '.config'), 'opencode');
+        candidates.push(join(configHome, 'agents', 'neocortex.md'));
+        candidates.push(join(home, '.opencode', 'agents', 'neocortex.md'));
+    }
+    return Array.from(new Set(candidates));
+}
+function trustedHome(env) {
+    const candidate = env ? env.HOME || env.USERPROFILE : homedir();
+    return candidate && !/[\r\n\0]/.test(candidate) ? candidate : undefined;
+}
+function isGovernedProfile(adapterId, content) {
+    if (Buffer.byteLength(content) > MAX_PROFILE_BYTES)
+        return false;
+    if (adapterId === 'claude-code') {
+        return /^---\r?\n[\s\S]*?^name:\s*neocortex\s*$[\s\S]*?^permissionMode:\s*bypassPermissions\s*$[\s\S]*?^disallowedTools:\s*Agent,\s*Task\s*$[\s\S]*?^---\s*$/m.test(content)
+            && content.includes('Child depth is bounded to one.')
+            && content.includes('Never pass the original root invocation');
+    }
+    return /^---\r?\n[\s\S]*?^name:\s*neocortex\s*$[\s\S]*?^mode:\s*subagent\s*$[\s\S]*?^\s+"\*":\s*allow\s*$[\s\S]*?^\s+task:\s*deny\s*$[\s\S]*?^---\s*$/m.test(content)
+        && content.includes('Never pass the original root invocation')
+        && content.includes('root OpenCode agent remains the yoloop owner');
+}
+function validateEffectiveApprovalPolicy(adapterId, options) {
+    try {
+        const home = trustedHome(options.env);
+        const resolution = getSubagentApprovalPolicy({
+            ...(home ? { configFilePath: join(home, '.neocortex', 'config.json') } : {}),
+            platformTarget: adapterId,
+            hostPolicy: options.approvalHostPolicy,
+        }).resolution;
+        if (resolution.requestedMode !== 'max' || resolution.effectiveMode !== 'max') {
+            return failure(HEADLESS_REASON_CODES.APPROVAL_POLICY_MISMATCH, 'Managed max profile did not match the effective subagent approval policy.');
+        }
+        return { ok: true, publicSafe: true };
+    }
+    catch {
+        return failure(HEADLESS_REASON_CODES.APPROVAL_POLICY_INVALID, 'Managed subagent approval policy could not be validated safely.');
+    }
+}
+function failure(reasonCode, summary) {
+    return {
+        ok: false,
+        reasonCode,
+        publicSummary: boundPublicSummary(`${summary} ${GOVERNED_HEADLESS_EVIDENCE}`),
+        publicSafe: true,
+    };
+}
+function invalidProfile() {
+    return failure(HEADLESS_REASON_CODES.MANAGED_PROFILE_INVALID, 'Managed neocortex profile failed bounded identity, approval, or isolation validation.');
+}