@ornexus/neocortex 4.60.68 → 4.60.70

package/packages/client/dist/private-execution/delivery.js

@@ -1,410 +1,13 @@
-import { isPrivateYoloSkippedPredecessors, isPrivateQaSkippedPredecessors, isPrivateQaStructuralAdmission } from './shared-private-admission-types.js';
-/** P222.16: client-side integrity guard for one-time classified delivery. */
-import { createHash } from 'node:crypto';
-export const PRIVATE_EXECUTION_PUBLIC_INSTRUCTION_V1 = '# Neocortex private execution pending\n\nThe authorized Codex CLI executor must consume the one-time delivery and produce a physical receipt.';
-export const PRIVATE_REPORT_PUBLIC_INSTRUCTION_V1 = '# Private review report ready\n\nThe compatible local client must consume the one-time report and save it in owner-private storage. No report content is included in this public response.';
-/** Public token only; the protected QA step identifier never ships in the client. */
-export const PRIVATE_MUTATION_QA_GATE_STEP_TOKEN = 'step-8721319d';
-/** A closed public selector is not an executable private stage or its receipt. */
-export function isPrivatePlanningRootPublicEnvelope(value, expected) {
-    const record = (v) => v !== null && typeof v === 'object' && !Array.isArray(v) ? v : undefined;
-    const response = record(value), metadata = record(response?.metadata);
-    const c = record(metadata?.planningRootContinuation);
-    if (!response || Object.keys(response).sort().join('|') !== 'instructions|metadata'
-        || !metadata || Object.keys(metadata).sort().join('|') !== 'epicId|mode|planningRootContinuation|resolvedTrigger'
-        || metadata.mode !== 'continuity' || metadata.resolvedTrigger !== 'create-epic'
-        || !c || Object.keys(c).sort().join('|') !== [
-        'schemaVersion', 'owner', 'claimId', 'epicId', 'nextAction', 'nextCommand', 'planningComplete', 'publicSafe',
-        ...(c.planningComplete === true ? ['memoryReceiptId'] : []),
-    ].sort().join('|') || c.schemaVersion !== 1 || c.owner !== 'root' || c.nextAction !== (c.nextCommand === 'none' ? 'complete' : c.nextCommand === 'refresh-memory' ? 'root-memory' : 'delegate-stage')
-        || c.planningComplete !== (c.nextCommand === 'none') || c.publicSafe !== true || c.claimId !== expected.claimId
-        || c.epicId !== expected.epicId || metadata.epicId !== expected.epicId
-        || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(expected.claimId)
-        || !/^P[1-9][0-9]{0,11}$/.test(expected.epicId)
-        || !['idea-research', 'generate-epic', 'refresh-memory', 'none'].includes(String(c.nextCommand)))
-        return false;
-    if (c.planningComplete === true)
-        return typeof expected.memoryReceiptId === 'string'
-            && /^[a-f0-9]{64}$/.test(expected.memoryReceiptId) && c.memoryReceiptId === expected.memoryReceiptId
-            && response.instructions === '# Root planning complete\n\nP01-P04 planning checkpoints were independently accepted. The client must acknowledge the same durable creation claim with the verified memory checkpoint. Stories, physical QA, provider and terminal accounting remain pending.';
-    if (c.nextCommand === 'refresh-memory')
-        return response.instructions === '# Root planning memory checkpoint\n\nReopen the committed P03 with planning-generation verify. Run local refresh-memory with an accurate note about the accepted plan; verify every project-memory target with refresh-memory --verify. Independently review and seal the physical memory checkpoint before resuming the original create-epic request. Do not implement stories or release quota.';
-    const preparation = c.nextCommand === 'idea-research'
-        ? `Before P02, the root must collect public Context7 and official web references for this epic and record provenance in docs/research/epic-${c.epicId}/root-sources.md and root-sources.json. Keep private material out of external queries. The private executor has no web or MCP access.\n\n` : '';
-    return response.instructions === `# Root planning continuation\n\n${preparation}Run *${c.nextCommand} ${c.epicId}. Independently review and seal its physical artifacts before resuming the original create-epic request. No story execution or terminal effect is authorized.`;
-}
-/** Reject a prompt-shaped server regression before any CLI output or writeback. */
-export function isPrivateExecutionPublicEnvelope(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const response = value;
-    const metadata = response.metadata;
-    if (Object.keys(response).sort().join(',') !== 'instructions,metadata'
-        || (response.instructions !== PRIVATE_EXECUTION_PUBLIC_INSTRUCTION_V1
-            && response.instructions !== PRIVATE_REPORT_PUBLIC_INSTRUCTION_V1)
-        || !metadata || typeof metadata !== 'object' || Array.isArray(metadata))
-        return false;
-    const record = metadata;
-    const privateDescriptor = record.privateExecution;
-    let parsed;
-    try {
-        parsed = parsePrivateExecutionDescriptor(privateDescriptor);
-    }
-    catch {
-        return false;
-    }
-    if (parsed.schemaVersion !== 11 && response.instructions !== PRIVATE_EXECUTION_PUBLIC_INSTRUCTION_V1)
-        return false;
-    if (parsed.schemaVersion === 2) {
-        return Object.keys(record).sort().join(',') === [
-            'mode', 'storyId', 'stepId', 'resolvedTrigger', 'privateExecution',
-        ].sort().join(',')
-            && ((record.mode === 'step'
-                && (record.resolvedTrigger === 'research' || record.resolvedTrigger === 'write-spec'
-                    || record.resolvedTrigger === 'create-tasks' || record.resolvedTrigger === 'implement')
-                && parsed.binding.commandId === record.resolvedTrigger)
-                || (record.mode === 'pipeline' && record.resolvedTrigger === 'exec'
-                    && parsed.binding.commandId === 'exec'))
-            && record.storyId === parsed.binding.storyId
-            && record.stepId === parsed.binding.stepId;
-    }
-    if (parsed.schemaVersion === 3) {
-        const claim = record.epicClaim;
-        const epicClaim = claim && typeof claim === 'object' && !Array.isArray(claim)
-            ? claim : undefined;
-        return Object.keys(record).sort().join(',') === [
-            'mode', 'stepId', 'resolvedTrigger', 'privateExecution', 'epicClaim',
-        ].sort().join(',')
-            && ((record.mode === 'create-epic' && record.resolvedTrigger === 'create-epic'
-                && parsed.binding.commandId === 'create-epic' && (parsed.binding.writeSetId === undefined
-                || parsed.binding.writeSetId === 'idea-diagnosis-v1' && parsed.binding.stepId === 'step-acd455ed'))
-                || (record.mode === 'step' && record.resolvedTrigger === 'idea-diagnose'
-                    && parsed.binding.commandId === 'idea-diagnose'
-                    && parsed.binding.writeSetId === 'idea-diagnosis-v1'))
-            && record.stepId === parsed.binding.stepId
-            && !!epicClaim
-            && Object.keys(epicClaim).sort().join(',') === [
-                'schemaVersion', 'claimId', 'epicId', 'outcome', 'publicSafe',
-            ].sort().join(',')
-            && epicClaim.schemaVersion === 1 && epicClaim.outcome === 'reserved'
-            && epicClaim.publicSafe === true
-            && epicClaim.claimId === parsed.binding.claimId
-            && epicClaim.epicId === parsed.binding.epicId;
-    }
-    if (parsed.schemaVersion === 4) {
-        const projectStepMode = (record.mode === 'utility'
-            && record.resolvedTrigger === 'sync-openapi'
-            && parsed.binding.commandId === 'sync-openapi'
-            && parsed.binding.writeSetId === 'sync-openapi-contract-v1')
-            || (record.mode === 'utility'
-                && record.resolvedTrigger === 'chaos-plan'
-                && parsed.binding.commandId === 'chaos-plan'
-                && parsed.binding.writeSetId === 'chaos-quarterly-v1')
-            || (record.mode === 'tech-debt'
-                && record.resolvedTrigger === 'tech-debt'
-                && parsed.binding.commandId === 'tech-debt'
-                && parsed.binding.writeSetId === 'tech-debt-registry-v1');
-        return Object.keys(record).sort().join(',') === [
-            'mode', 'stepId', 'resolvedTrigger', 'privateExecution',
-        ].sort().join(',')
-            && record.stepId === parsed.binding.stepId
-            && projectStepMode;
-    }
-    if (parsed.schemaVersion === 11) {
-        return response.instructions === PRIVATE_REPORT_PUBLIC_INSTRUCTION_V1
-            && Object.keys(record).sort().join(',') === [
-                'mode', 'stepId', 'resolvedTrigger', 'privateExecution',
-            ].sort().join(',')
-            && record.mode === 'ui-ux-review'
-            && record.resolvedTrigger === 'ui-ux-review'
-            && record.stepId === parsed.binding.stepId;
-    }
-    if (parsed.schemaVersion === 5) {
-        return Object.keys(record).sort().join(',') === [
-            'mode', 'stepId', 'resolvedTrigger', 'privateExecution',
-        ].sort().join(',')
-            && record.mode === 'step'
-            && record.resolvedTrigger === parsed.binding.commandId
-            && record.stepId === parsed.binding.stepId
-            && ((parsed.binding.commandId === 'arch-prd' && parsed.binding.writeSetId === 'arch-prd-docs-v1')
-                || (parsed.binding.commandId === 'arch-architecture' && parsed.binding.writeSetId === 'arch-architecture-doc-v1')
-                || (parsed.binding.commandId === 'arch-fitness-functions' && parsed.binding.writeSetId === 'arch-fitness-tools-v1')
-                || (parsed.binding.commandId === 'arch-api-contracts' && parsed.binding.writeSetId === 'arch-api-contracts-docs-v1')
-                || (parsed.binding.commandId === 'arch-api-integrations' && parsed.binding.writeSetId === 'arch-api-integrations-doc-v1')
-                || (parsed.binding.commandId === 'arch-database' && parsed.binding.writeSetId === 'arch-database-doc-v1')
-                || (parsed.binding.commandId === 'arch-security' && parsed.binding.writeSetId === 'arch-security-doc-v1')
-                || (parsed.binding.commandId === 'arch-design-system' && parsed.binding.writeSetId === 'arch-design-system-doc-v1')
-                || (parsed.binding.commandId === 'arch-performance' && parsed.binding.writeSetId === 'arch-performance-doc-v1')
-                || (parsed.binding.commandId === 'arch-testing' && parsed.binding.writeSetId === 'arch-testing-doc-v1')
-                || (parsed.binding.commandId === 'arch-infrastructure' && parsed.binding.writeSetId === 'arch-infrastructure-doc-v1')
-                || (parsed.binding.commandId === 'arch-review' && parsed.binding.writeSetId === 'arch-review-doc-v1')
-                || (parsed.binding.commandId === 'update-memory' && parsed.binding.writeSetId === 'arch-memory-canonical-v1'));
-    }
-    if (parsed.schemaVersion === 6) {
-        return Object.keys(record).sort().join(',') === [
-            'mode', 'stepId', 'resolvedTrigger', 'privateExecution',
-        ].sort().join(',')
-            && record.mode === 'step' && record.resolvedTrigger === 'generate-pacts'
-            && record.stepId === parsed.binding.stepId;
-    }
-    if (parsed.schemaVersion === 7) {
-        return Object.keys(record).sort().join(',') === [
-            'mode', 'stepId', 'resolvedTrigger', 'privateExecution',
-        ].sort().join(',')
-            && record.mode === 'step' && record.resolvedTrigger === 'arch-ux-design'
-            && record.stepId === parsed.binding.stepId;
-    }
-    if (parsed.schemaVersion === 8) {
-        return Object.keys(record).sort().join(',') === [
-            'mode', 'stepId', 'resolvedTrigger', 'privateExecution',
-        ].sort().join(',')
-            && record.mode === 'step' && record.resolvedTrigger === 'idea-research'
-            && record.stepId === parsed.binding.stepId
-            && parsed.binding.commandId === 'idea-research'
-            && parsed.binding.writeSetId === 'idea-research-v1';
-    }
-    if (parsed.schemaVersion === 9) {
-        return Object.keys(record).sort().join(',') === [
-            'mode', 'stepId', 'resolvedTrigger', 'privateExecution',
-        ].sort().join(',')
-            && record.mode === 'step' && record.resolvedTrigger === 'generate-epic'
-            && record.stepId === parsed.binding.stepId
-            && parsed.binding.commandId === 'generate-epic'
-            && parsed.binding.writeSetId === 'generate-epic-v1';
-    }
-    if (parsed.schemaVersion === 10) {
-        return Object.keys(record).sort().join(',') === [
-            'mode', 'stepId', 'resolvedTrigger', 'privateExecution',
-        ].sort().join(',')
-            && record.mode === 'utility' && record.resolvedTrigger === 'property-test'
-            && record.stepId === parsed.binding.stepId
-            && parsed.binding.commandId === 'property-test';
-    }
-    const rootAction = record.privateExecutionRootAction;
-    const mutationQaGateSelected = record.stepId === PRIVATE_MUTATION_QA_GATE_STEP_TOKEN;
-    const mutationQaFeature = record.mutationQaFeature;
-    const featureRecord = mutationQaFeature && typeof mutationQaFeature === 'object'
-        && !Array.isArray(mutationQaFeature)
-        ? mutationQaFeature : undefined;
-    const allowedKeys = [
-        'mode', 'storyId', 'stepId', 'resolvedTrigger',
-        'gitLifecycleGraphAuthority', 'privateExecution',
-        ...(mutationQaGateSelected ? ['mutationQaFeature'] : []),
-        ...(rootAction === undefined ? [] : ['privateExecutionRootAction']),
-    ];
-    const graph = record.gitLifecycleGraphAuthority;
-    const graphRecord = graph && typeof graph === 'object' && !Array.isArray(graph)
-        ? graph : undefined;
-    const actionRecord = rootAction && typeof rootAction === 'object' && !Array.isArray(rootAction)
-        ? rootAction : undefined;
-    return (!mutationQaGateSelected || (!!featureRecord
-        && Object.keys(featureRecord).sort().join(',') === [
-            'schemaVersion', 'id', 'enabled', 'publicSafe',
-        ].sort().join(',')
-        && featureRecord.schemaVersion === 1
-        && featureRecord.id === 'mutation-testing'
-        && typeof featureRecord.enabled === 'boolean'
-        && featureRecord.publicSafe === true))
-        && Object.keys(record).sort().join(',') === allowedKeys.sort().join(',')
-        && record.mode === 'yolo' && record.resolvedTrigger === 'yolo'
-        && typeof record.storyId === 'string' && typeof record.stepId === 'string'
-        && !!graphRecord
-        && graphRecord.storyId === record.storyId
-        && graphRecord.graphRevision === parsed.binding.graphRevision
-        && parsed.binding.commandId === 'yolo'
-        && parsed.binding.stepId === record.stepId
-        && (rootAction === undefined || (!!actionRecord
-            && Object.keys(actionRecord).sort().join(',') === [
-                'schemaVersion', 'action', 'storyId', 'executionBranch', 'graphRevision', 'publicSafe',
-                ...(actionRecord.action !== 'prepare-epic-checkout' ? ['stepId'] : []),
-                ...(actionRecord.action === 'review-test-validation-candidate' ? ['skippedPredecessors'] : []),
-                ...(actionRecord.action === 'review-qa-candidate' ? ['skippedPredecessors', 'structuralPrecheck'] : []),
-            ].sort().join(',')
-            && actionRecord.schemaVersion === 1
-            && (actionRecord.action === 'prepare-epic-checkout'
-                || actionRecord.action === 'checkpoint-epic-story'
-                || actionRecord.action === 'review-diagnosis-candidate' && record.stepId === 'step-50224b19'
-                || actionRecord.action === 'review-project-memory-candidate' && record.stepId === 'step-638cc252'
-                || actionRecord.action === 'review-research-candidate' && record.stepId === 'step-f757f6bf'
-                || actionRecord.action === 'review-specification-candidate' && record.stepId === 'step-9cd927d0'
-                || actionRecord.action === 'review-tasks-candidate' && record.stepId === 'step-a3f880e8'
-                || actionRecord.action === 'review-implementation-candidate' && record.stepId === 'step-41803e35'
-                || actionRecord.action === 'review-refactor-advisory-candidate' && record.stepId === 'step-fe2e4997'
-                || actionRecord.action === 'review-test-validation-candidate' && record.stepId === 'step-b2fe7cb5' && isPrivateYoloSkippedPredecessors(actionRecord.skippedPredecessors)
-                || actionRecord.action === 'review-qa-candidate' && record.stepId === 'step-8721319d'
-                    && isPrivateQaSkippedPredecessors(actionRecord.skippedPredecessors) && isPrivateQaStructuralAdmission(actionRecord.structuralPrecheck)
-                    && actionRecord.structuralPrecheck.graphRevision === graphRecord.graphRevision
-                    && actionRecord.structuralPrecheck.generationId === parsed.binding.generationId)
-            && (actionRecord.action === 'prepare-epic-checkout' || actionRecord.stepId === record.stepId)
-            && actionRecord.publicSafe === true
-            && actionRecord.storyId === record.storyId
-            && actionRecord.storyId === graphRecord.storyId
-            && actionRecord.executionBranch === graphRecord.executionBranch
-            && actionRecord.graphRevision === graphRecord.graphRevision));
-}
-export function privateExecutionStateSnapshotSha256(stateSnapshot) {
-    return createHash('sha256').update('private-step-state-v1\0')
-        .update(JSON.stringify(stateSnapshot)).digest('hex');
-}
-export function parsePrivateExecutionDescriptor(value, expected) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        throw new Error('private-execution-descriptor-invalid');
-    const descriptor = value;
-    const binding = descriptor.binding;
-    const stateBound = descriptor.schemaVersion === 2 || descriptor.schemaVersion === 3
-        || descriptor.schemaVersion === 4 || descriptor.schemaVersion === 5
-        || descriptor.schemaVersion === 6 || descriptor.schemaVersion === 7
-        || descriptor.schemaVersion === 8 || descriptor.schemaVersion === 9
-        || descriptor.schemaVersion === 10 || descriptor.schemaVersion === 11;
-    const bindingKeys = stateBound
-        ? ['schemaVersion', 'authorityKind', 'projectId', 'commandId', 'stepId',
-            ...(descriptor.schemaVersion === 3 ? ['claimId', 'epicId',
-                ...(binding?.commandId === 'idea-diagnose' || binding?.writeSetId !== undefined ? ['writeSetId'] : [])]
-                : descriptor.schemaVersion === 4 ? ['writeSetId']
-                    : descriptor.schemaVersion === 5 ? ['targetEpicId', 'graphRevision', 'writeSetId']
-                        : descriptor.schemaVersion === 6 ? ['targetEpicId', 'graphRevision', 'answersSha256',
-                            'specSha256', 'pathsSha256', 'endpointCount', 'pathCount']
-                            : descriptor.schemaVersion === 7 ? ['targetEpicId', 'graphRevision', 'adapterId',
-                                'authoritySha256', 'pathsSha256', 'screenCount', 'pathCount']
-                                : descriptor.schemaVersion === 8 ? ['claimId', 'epicId', 'diagnosisReceiptId',
-                                    'intakeRevision', 'physicalAcceptanceReceiptId', 'writeSetId']
-                                    : descriptor.schemaVersion === 9 ? ['claimId', 'epicId', 'diagnosisReceiptId',
-                                        'researchReceiptId', 'intakeRevision', 'physicalAcceptanceReceiptId', 'writeSetId']
-                                        : descriptor.schemaVersion === 10 ? ['prdPath', 'prdSha256', 'planSha256',
-                                            'pathsSha256', 'aggregateCount', 'invariantCount', 'pathCount',
-                                            'language', 'numRuns']
-                                            : descriptor.schemaVersion === 11 ? ['format']
-                                                : ['storyId']),
-            'stateSnapshotSha256', 'generationId', 'inputSha256', 'hostKind', 'hostVersion']
-        : ['commandId', 'generationId', 'graphRevision', 'hostKind', 'hostVersion', 'inputSha256', 'projectId', 'stepId'];
-    if (Object.keys(descriptor).sort().join(',') !== [
-        'schemaVersion', 'leaseId', 'materialSha256', 'byteLength', 'expiresAt', 'delivery', 'publicSafe', 'binding',
-    ].sort().join(',')
-        || (descriptor.schemaVersion !== 1 && !stateBound) || descriptor.delivery !== 'private-one-time' || descriptor.publicSafe !== true
-        || typeof descriptor.leaseId !== 'string' || !/^px_[a-f0-9]{48}$/.test(descriptor.leaseId)
-        || typeof descriptor.materialSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(descriptor.materialSha256)
-        || !Number.isSafeInteger(descriptor.byteLength) || descriptor.byteLength < 1
-        || descriptor.byteLength > 256 * 1024
-        || typeof descriptor.expiresAt !== 'string' || !Number.isFinite(Date.parse(descriptor.expiresAt))
-        || !binding || Object.keys(binding).sort().join(',') !== bindingKeys.sort().join(',')
-        || Object.entries(binding).some(([key, entry]) => key !== 'schemaVersion'
-            && key !== 'endpointCount' && key !== 'screenCount' && key !== 'pathCount'
-            && key !== 'aggregateCount' && key !== 'invariantCount' && key !== 'numRuns'
-            && (typeof entry !== 'string' || entry.length < 1 || entry.length > 256))
-        || !/^[a-f0-9]{64}$/.test(String(binding.inputSha256))
-        || binding.hostKind !== 'codex-cli'
-        || (stateBound && !/^[a-f0-9]{64}$/.test(String(binding.stateSnapshotSha256)))
-        || (descriptor.schemaVersion === 2 && (binding.schemaVersion !== 2 || binding.authorityKind !== 'state-snapshot'
-            || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(String(binding.storyId))))
-        || (descriptor.schemaVersion === 3 && (binding.schemaVersion !== 3 || binding.authorityKind !== 'epic-claim'
-            || !((binding.commandId === 'create-epic' && (binding.writeSetId === undefined
-                || binding.writeSetId === 'idea-diagnosis-v1' && binding.stepId === 'step-acd455ed'))
-                || (binding.commandId === 'idea-diagnose' && binding.writeSetId === 'idea-diagnosis-v1'))
-            || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(String(binding.claimId))
-            || !/^P[1-9][0-9]*$/.test(String(binding.epicId))))
-        || (descriptor.schemaVersion === 4 && (binding.schemaVersion !== 4
-            || binding.authorityKind !== 'project-snapshot'
-            || !((binding.commandId === 'sync-openapi' && binding.writeSetId === 'sync-openapi-contract-v1')
-                || (binding.commandId === 'tech-debt' && binding.writeSetId === 'tech-debt-registry-v1')
-                || (binding.commandId === 'chaos-plan' && binding.writeSetId === 'chaos-quarterly-v1'))))
-        || (descriptor.schemaVersion === 11 && (binding.schemaVersion !== 11
-            || binding.authorityKind !== 'private-report' || binding.commandId !== 'ui-ux-review'
-            || !['markdown', 'json'].includes(String(binding.format))
-            || !/^sha256:[a-f0-9]{64}$/.test(String(binding.generationId))
-            || descriptor.materialSha256 !== String(binding.generationId).slice(7)))
-        || (descriptor.schemaVersion === 5 && (binding.schemaVersion !== 5
-            || binding.authorityKind !== 'architecture-stage'
-            || !((binding.commandId === 'arch-prd' && binding.writeSetId === 'arch-prd-docs-v1')
-                || (binding.commandId === 'arch-architecture' && binding.writeSetId === 'arch-architecture-doc-v1')
-                || (binding.commandId === 'arch-fitness-functions' && binding.writeSetId === 'arch-fitness-tools-v1')
-                || (binding.commandId === 'arch-api-contracts' && binding.writeSetId === 'arch-api-contracts-docs-v1')
-                || (binding.commandId === 'arch-api-integrations' && binding.writeSetId === 'arch-api-integrations-doc-v1')
-                || (binding.commandId === 'arch-database' && binding.writeSetId === 'arch-database-doc-v1')
-                || (binding.commandId === 'arch-security' && binding.writeSetId === 'arch-security-doc-v1')
-                || (binding.commandId === 'arch-design-system' && binding.writeSetId === 'arch-design-system-doc-v1')
-                || (binding.commandId === 'arch-performance' && binding.writeSetId === 'arch-performance-doc-v1')
-                || (binding.commandId === 'arch-testing' && binding.writeSetId === 'arch-testing-doc-v1')
-                || (binding.commandId === 'arch-infrastructure' && binding.writeSetId === 'arch-infrastructure-doc-v1')
-                || (binding.commandId === 'arch-review' && binding.writeSetId === 'arch-review-doc-v1')
-                || (binding.commandId === 'update-memory' && binding.writeSetId === 'arch-memory-canonical-v1'))
-            || !/^P[1-9][0-9]{0,11}$/.test(String(binding.targetEpicId))
-            || !/^[a-f0-9]{64}$/.test(String(binding.graphRevision))))
-        || (descriptor.schemaVersion === 6 && (binding.schemaVersion !== 6
-            || binding.authorityKind !== 'pact-stage' || binding.commandId !== 'generate-pacts'
-            || !/^P[1-9][0-9]{0,11}$/.test(String(binding.targetEpicId))
-            || !/^[a-f0-9]{64}$/.test(String(binding.graphRevision))
-            || !/^[a-f0-9]{64}$/.test(String(binding.answersSha256))
-            || !/^[a-f0-9]{64}$/.test(String(binding.specSha256))
-            || !/^[a-f0-9]{64}$/.test(String(binding.pathsSha256))
-            || !Number.isSafeInteger(binding.endpointCount) || binding.endpointCount < 1
-            || binding.endpointCount > 256
-            || !Number.isSafeInteger(binding.pathCount)
-            || binding.pathCount < binding.endpointCount
-            || binding.pathCount > binding.endpointCount + 1))
-        || (descriptor.schemaVersion === 7 && (binding.schemaVersion !== 7
-            || binding.authorityKind !== 'ux-stage' || binding.commandId !== 'arch-ux-design'
-            || !/^P[1-9][0-9]{0,11}$/.test(String(binding.targetEpicId))
-            || !/^[a-f0-9]{64}$/.test(String(binding.graphRevision))
-            || !['storybook-react-vite', 'storybook-nextjs-vite'].includes(String(binding.adapterId))
-            || !/^[a-f0-9]{64}$/.test(String(binding.authoritySha256))
-            || !/^[a-f0-9]{64}$/.test(String(binding.pathsSha256))
-            || !Number.isSafeInteger(binding.screenCount) || binding.screenCount < 1
-            || binding.screenCount > 48
-            || !Number.isSafeInteger(binding.pathCount)
-            || binding.pathCount !== binding.screenCount * 6 + 3))
-        || (descriptor.schemaVersion === 8 && (binding.schemaVersion !== 8
-            || binding.authorityKind !== 'planning-stage' || binding.commandId !== 'idea-research'
-            || binding.writeSetId !== 'idea-research-v1'
-            || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(String(binding.claimId))
-            || !/^P[1-9][0-9]{0,11}$/.test(String(binding.epicId))
-            || [binding.diagnosisReceiptId, binding.intakeRevision,
-                binding.physicalAcceptanceReceiptId].some((entry) => !/^[a-f0-9]{64}$/.test(String(entry)))))
-        || (descriptor.schemaVersion === 9 && (binding.schemaVersion !== 9
-            || binding.authorityKind !== 'planning-generation' || binding.commandId !== 'generate-epic'
-            || binding.writeSetId !== 'generate-epic-v1'
-            || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(String(binding.claimId))
-            || !/^P[1-9][0-9]{0,11}$/.test(String(binding.epicId))
-            || [binding.diagnosisReceiptId, binding.researchReceiptId, binding.intakeRevision,
-                binding.physicalAcceptanceReceiptId].some((entry) => !/^[a-f0-9]{64}$/.test(String(entry)))))
-        || (descriptor.schemaVersion === 10 && (binding.schemaVersion !== 10
-            || binding.authorityKind !== 'property-test-plan' || binding.commandId !== 'property-test'
-            || !['prd.md', 'docs/architecture/prd.md'].includes(String(binding.prdPath))
-            || [binding.prdSha256, binding.planSha256, binding.pathsSha256]
-                .some((entry) => !/^[a-f0-9]{64}$/.test(String(entry)))
-            || !Number.isSafeInteger(binding.aggregateCount) || binding.aggregateCount < 1
-            || binding.aggregateCount > 64
-            || !Number.isSafeInteger(binding.invariantCount)
-            || binding.invariantCount < binding.aggregateCount
-            || binding.invariantCount > 1024
-            || binding.pathCount !== binding.aggregateCount
-            || !['typescript', 'python'].includes(String(binding.language))
-            || ![100, 1000, 10000].includes(binding.numRuns)))
-        || (expected && Object.entries(expected).some(([key, entry]) => binding[key] !== entry))) {
-        throw new Error('private-execution-descriptor-invalid');
-    }
-    return descriptor;
-}
-export function verifyPrivateExecutionMaterial(descriptor, material, nowMs = Date.now()) {
-    if (typeof material !== 'string' || nowMs >= Date.parse(descriptor.expiresAt)
-        || Buffer.byteLength(material, 'utf8') !== descriptor.byteLength
-        || createHash('sha256').update(material, 'utf8').digest('hex') !== descriptor.materialSha256) {
-        throw new Error('private-execution-material-invalid');
-    }
-    return material;
-}
-/**
- * The transport implementation must keep request and response bodies in memory.
- * No retry is safe after a one-time lease may have been consumed.
- */
-export async function consumePrivateExecutionDelivery(rawDescriptor, expected, postOnce, nowMs = Date.now()) {
-    const descriptor = parsePrivateExecutionDescriptor(rawDescriptor, expected);
-    if (nowMs >= Date.parse(descriptor.expiresAt))
-        throw new Error('private-execution-material-expired');
-    const response = await postOnce({ leaseId: descriptor.leaseId, ...descriptor.binding });
-    if (!response || typeof response !== 'object' || Array.isArray(response)
-        || Object.keys(response).sort().join(',') !== 'material,schemaVersion'
-        || response.schemaVersion !== 1) {
-        throw new Error('private-execution-delivery-invalid');
-    }
-    return verifyPrivateExecutionMaterial(descriptor, response.material, Math.max(nowMs, Date.now()));
-}
+import{isPrivateYoloSkippedPredecessors as b,isPrivateQaSkippedPredecessors as S,isPrivateQaStructuralAdmission as w}from"./shared-private-admission-types.js";import{createHash as I}from"node:crypto";const l=`# Neocortex private execution pending
+
+The authorized Codex CLI executor must consume the one-time delivery and produce a physical receipt.`,v=`# Private review report ready
+
+The compatible local client must consume the one-time report and save it in owner-private storage. No report content is included in this public response.`,j="step-8721319d";function R(o,n){const i=d=>d!==null&&typeof d=="object"&&!Array.isArray(d)?d:void 0,e=i(o),s=i(e?.metadata),t=i(s?.planningRootContinuation);if(!e||Object.keys(e).sort().join("|")!=="instructions|metadata"||!s||Object.keys(s).sort().join("|")!=="epicId|mode|planningRootContinuation|resolvedTrigger"||s.mode!=="continuity"||s.resolvedTrigger!=="create-epic"||!t||Object.keys(t).sort().join("|")!==["schemaVersion","owner","claimId","epicId","nextAction","nextCommand","planningComplete","publicSafe",...t.planningComplete===!0?["memoryReceiptId"]:[]].sort().join("|")||t.schemaVersion!==1||t.owner!=="root"||t.nextAction!==(t.nextCommand==="none"?"complete":t.nextCommand==="refresh-memory"?"root-memory":"delegate-stage")||t.planningComplete!==(t.nextCommand==="none")||t.publicSafe!==!0||t.claimId!==n.claimId||t.epicId!==n.epicId||s.epicId!==n.epicId||!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(n.claimId)||!/^P[1-9][0-9]{0,11}$/.test(n.epicId)||!["idea-research","generate-epic","refresh-memory","none"].includes(String(t.nextCommand)))return!1;if(t.planningComplete===!0)return typeof n.memoryReceiptId=="string"&&/^[a-f0-9]{64}$/.test(n.memoryReceiptId)&&t.memoryReceiptId===n.memoryReceiptId&&e.instructions===`# Root planning complete
+
+P01-P04 planning checkpoints were independently accepted. The client must acknowledge the same durable creation claim with the verified memory checkpoint. Stories, physical QA, provider and terminal accounting remain pending.`;if(t.nextCommand==="refresh-memory")return e.instructions===`# Root planning memory checkpoint
+
+Reopen the committed P03 with planning-generation verify. Run local refresh-memory with an accurate note about the accepted plan; verify every project-memory target with refresh-memory --verify. Independently review and seal the physical memory checkpoint before resuming the original create-epic request. Do not implement stories or release quota.`;const a=t.nextCommand==="idea-research"?`Before P02, the root must collect public Context7 and official web references for this epic and record provenance in docs/research/epic-${t.epicId}/root-sources.md and root-sources.json. Keep private material out of external queries. The private executor has no web or MCP access.
+
+`:"";return e.instructions===`# Root planning continuation
+
+${a}Run *${t.nextCommand} ${t.epicId}. Independently review and seal its physical artifacts before resuming the original create-epic request. No story execution or terminal effect is authorized.`}function T(o){if(!o||typeof o!="object"||Array.isArray(o))return!1;const n=o,i=n.metadata;if(Object.keys(n).sort().join(",")!=="instructions,metadata"||n.instructions!==l&&n.instructions!==v||!i||typeof i!="object"||Array.isArray(i))return!1;const e=i,s=e.privateExecution;let t;try{t=f(s)}catch{return!1}if(t.schemaVersion!==11&&n.instructions!==l)return!1;if(t.schemaVersion===2)return Object.keys(e).sort().join(",")===["mode","storyId","stepId","resolvedTrigger","privateExecution"].sort().join(",")&&(e.mode==="step"&&(e.resolvedTrigger==="research"||e.resolvedTrigger==="write-spec"||e.resolvedTrigger==="create-tasks"||e.resolvedTrigger==="implement")&&t.binding.commandId===e.resolvedTrigger||e.mode==="pipeline"&&e.resolvedTrigger==="exec"&&t.binding.commandId==="exec")&&e.storyId===t.binding.storyId&&e.stepId===t.binding.stepId;if(t.schemaVersion===3){const g=e.epicClaim,p=g&&typeof g=="object"&&!Array.isArray(g)?g:void 0;return Object.keys(e).sort().join(",")===["mode","stepId","resolvedTrigger","privateExecution","epicClaim"].sort().join(",")&&(e.mode==="create-epic"&&e.resolvedTrigger==="create-epic"&&t.binding.commandId==="create-epic"&&(t.binding.writeSetId===void 0||t.binding.writeSetId==="idea-diagnosis-v1"&&t.binding.stepId==="step-acd455ed")||e.mode==="step"&&e.resolvedTrigger==="idea-diagnose"&&t.binding.commandId==="idea-diagnose"&&t.binding.writeSetId==="idea-diagnosis-v1")&&e.stepId===t.binding.stepId&&!!p&&Object.keys(p).sort().join(",")===["schemaVersion","claimId","epicId","outcome","publicSafe"].sort().join(",")&&p.schemaVersion===1&&p.outcome==="reserved"&&p.publicSafe===!0&&p.claimId===t.binding.claimId&&p.epicId===t.binding.epicId}if(t.schemaVersion===4){const g=e.mode==="utility"&&e.resolvedTrigger==="sync-openapi"&&t.binding.commandId==="sync-openapi"&&t.binding.writeSetId==="sync-openapi-contract-v1"||e.mode==="utility"&&e.resolvedTrigger==="chaos-plan"&&t.binding.commandId==="chaos-plan"&&t.binding.writeSetId==="chaos-quarterly-v1"||e.mode==="tech-debt"&&e.resolvedTrigger==="tech-debt"&&t.binding.commandId==="tech-debt"&&t.binding.writeSetId==="tech-debt-registry-v1";return Object.keys(e).sort().join(",")===["mode","stepId","resolvedTrigger","privateExecution"].sort().join(",")&&e.stepId===t.binding.stepId&&g}if(t.schemaVersion===11)return n.instructions===v&&Object.keys(e).sort().join(",")===["mode","stepId","resolvedTrigger","privateExecution"].sort().join(",")&&e.mode==="ui-ux-review"&&e.resolvedTrigger==="ui-ux-review"&&e.stepId===t.binding.stepId;if(t.schemaVersion===5)return Object.keys(e).sort().join(",")===["mode","stepId","resolvedTrigger","privateExecution"].sort().join(",")&&e.mode==="step"&&e.resolvedTrigger===t.binding.commandId&&e.stepId===t.binding.stepId&&(t.binding.commandId==="arch-prd"&&t.binding.writeSetId==="arch-prd-docs-v1"||t.binding.commandId==="arch-architecture"&&t.binding.writeSetId==="arch-architecture-doc-v1"||t.binding.commandId==="arch-fitness-functions"&&t.binding.writeSetId==="arch-fitness-tools-v1"||t.binding.commandId==="arch-api-contracts"&&t.binding.writeSetId==="arch-api-contracts-docs-v1"||t.binding.commandId==="arch-api-integrations"&&t.binding.writeSetId==="arch-api-integrations-doc-v1"||t.binding.commandId==="arch-database"&&t.binding.writeSetId==="arch-database-doc-v1"||t.binding.commandId==="arch-security"&&t.binding.writeSetId==="arch-security-doc-v1"||t.binding.commandId==="arch-design-system"&&t.binding.writeSetId==="arch-design-system-doc-v1"||t.binding.commandId==="arch-performance"&&t.binding.writeSetId==="arch-performance-doc-v1"||t.binding.commandId==="arch-testing"&&t.binding.writeSetId==="arch-testing-doc-v1"||t.binding.commandId==="arch-infrastructure"&&t.binding.writeSetId==="arch-infrastructure-doc-v1"||t.binding.commandId==="arch-review"&&t.binding.writeSetId==="arch-review-doc-v1"||t.binding.commandId==="update-memory"&&t.binding.writeSetId==="arch-memory-canonical-v1");if(t.schemaVersion===6)return Object.keys(e).sort().join(",")===["mode","stepId","resolvedTrigger","privateExecution"].sort().join(",")&&e.mode==="step"&&e.resolvedTrigger==="generate-pacts"&&e.stepId===t.binding.stepId;if(t.schemaVersion===7)return Object.keys(e).sort().join(",")===["mode","stepId","resolvedTrigger","privateExecution"].sort().join(",")&&e.mode==="step"&&e.resolvedTrigger==="arch-ux-design"&&e.stepId===t.binding.stepId;if(t.schemaVersion===8)return Object.keys(e).sort().join(",")===["mode","stepId","resolvedTrigger","privateExecution"].sort().join(",")&&e.mode==="step"&&e.resolvedTrigger==="idea-research"&&e.stepId===t.binding.stepId&&t.binding.commandId==="idea-research"&&t.binding.writeSetId==="idea-research-v1";if(t.schemaVersion===9)return Object.keys(e).sort().join(",")===["mode","stepId","resolvedTrigger","privateExecution"].sort().join(",")&&e.mode==="step"&&e.resolvedTrigger==="generate-epic"&&e.stepId===t.binding.stepId&&t.binding.commandId==="generate-epic"&&t.binding.writeSetId==="generate-epic-v1";if(t.schemaVersion===10)return Object.keys(e).sort().join(",")===["mode","stepId","resolvedTrigger","privateExecution"].sort().join(",")&&e.mode==="utility"&&e.resolvedTrigger==="property-test"&&e.stepId===t.binding.stepId&&t.binding.commandId==="property-test";const a=e.privateExecutionRootAction,d=e.stepId===j,h=e.mutationQaFeature,m=h&&typeof h=="object"&&!Array.isArray(h)?h:void 0,y=["mode","storyId","stepId","resolvedTrigger","gitLifecycleGraphAuthority","privateExecution",...d?["mutationQaFeature"]:[],...a===void 0?[]:["privateExecutionRootAction"]],u=e.gitLifecycleGraphAuthority,c=u&&typeof u=="object"&&!Array.isArray(u)?u:void 0,r=a&&typeof a=="object"&&!Array.isArray(a)?a:void 0;return(!d||!!m&&Object.keys(m).sort().join(",")===["schemaVersion","id","enabled","publicSafe"].sort().join(",")&&m.schemaVersion===1&&m.id==="mutation-testing"&&typeof m.enabled=="boolean"&&m.publicSafe===!0)&&Object.keys(e).sort().join(",")===y.sort().join(",")&&e.mode==="yolo"&&e.resolvedTrigger==="yolo"&&typeof e.storyId=="string"&&typeof e.stepId=="string"&&!!c&&c.storyId===e.storyId&&c.graphRevision===t.binding.graphRevision&&t.binding.commandId==="yolo"&&t.binding.stepId===e.stepId&&(a===void 0||!!r&&Object.keys(r).sort().join(",")===["schemaVersion","action","storyId","executionBranch","graphRevision","publicSafe",...r.action!=="prepare-epic-checkout"?["stepId"]:[],...r.action==="review-test-validation-candidate"?["skippedPredecessors"]:[],...r.action==="review-qa-candidate"?["skippedPredecessors","structuralPrecheck"]:[]].sort().join(",")&&r.schemaVersion===1&&(r.action==="prepare-epic-checkout"||r.action==="checkpoint-epic-story"||r.action==="review-diagnosis-candidate"&&e.stepId==="step-50224b19"||r.action==="review-project-memory-candidate"&&e.stepId==="step-638cc252"||r.action==="review-research-candidate"&&e.stepId==="step-f757f6bf"||r.action==="review-specification-candidate"&&e.stepId==="step-9cd927d0"||r.action==="review-tasks-candidate"&&e.stepId==="step-a3f880e8"||r.action==="review-implementation-candidate"&&e.stepId==="step-41803e35"||r.action==="review-refactor-advisory-candidate"&&e.stepId==="step-fe2e4997"||r.action==="review-test-validation-candidate"&&e.stepId==="step-b2fe7cb5"&&b(r.skippedPredecessors)||r.action==="review-qa-candidate"&&e.stepId==="step-8721319d"&&S(r.skippedPredecessors)&&w(r.structuralPrecheck)&&r.structuralPrecheck.graphRevision===c.graphRevision&&r.structuralPrecheck.generationId===t.binding.generationId)&&(r.action==="prepare-epic-checkout"||r.stepId===e.stepId)&&r.publicSafe===!0&&r.storyId===e.storyId&&r.storyId===c.storyId&&r.executionBranch===c.executionBranch&&r.graphRevision===c.graphRevision)}function A(o){return I("sha256").update("private-step-state-v1\0").update(JSON.stringify(o)).digest("hex")}function f(o,n){if(!o||typeof o!="object"||Array.isArray(o))throw new Error("private-execution-descriptor-invalid");const i=o,e=i.binding,s=i.schemaVersion===2||i.schemaVersion===3||i.schemaVersion===4||i.schemaVersion===5||i.schemaVersion===6||i.schemaVersion===7||i.schemaVersion===8||i.schemaVersion===9||i.schemaVersion===10||i.schemaVersion===11,t=s?["schemaVersion","authorityKind","projectId","commandId","stepId",...i.schemaVersion===3?["claimId","epicId",...e?.commandId==="idea-diagnose"||e?.writeSetId!==void 0?["writeSetId"]:[]]:i.schemaVersion===4?["writeSetId"]:i.schemaVersion===5?["targetEpicId","graphRevision","writeSetId"]:i.schemaVersion===6?["targetEpicId","graphRevision","answersSha256","specSha256","pathsSha256","endpointCount","pathCount"]:i.schemaVersion===7?["targetEpicId","graphRevision","adapterId","authoritySha256","pathsSha256","screenCount","pathCount"]:i.schemaVersion===8?["claimId","epicId","diagnosisReceiptId","intakeRevision","physicalAcceptanceReceiptId","writeSetId"]:i.schemaVersion===9?["claimId","epicId","diagnosisReceiptId","researchReceiptId","intakeRevision","physicalAcceptanceReceiptId","writeSetId"]:i.schemaVersion===10?["prdPath","prdSha256","planSha256","pathsSha256","aggregateCount","invariantCount","pathCount","language","numRuns"]:i.schemaVersion===11?["format"]:["storyId"],"stateSnapshotSha256","generationId","inputSha256","hostKind","hostVersion"]:["commandId","generationId","graphRevision","hostKind","hostVersion","inputSha256","projectId","stepId"];if(Object.keys(i).sort().join(",")!==["schemaVersion","leaseId","materialSha256","byteLength","expiresAt","delivery","publicSafe","binding"].sort().join(",")||i.schemaVersion!==1&&!s||i.delivery!=="private-one-time"||i.publicSafe!==!0||typeof i.leaseId!="string"||!/^px_[a-f0-9]{48}$/.test(i.leaseId)||typeof i.materialSha256!="string"||!/^[a-f0-9]{64}$/.test(i.materialSha256)||!Number.isSafeInteger(i.byteLength)||i.byteLength<1||i.byteLength>256*1024||typeof i.expiresAt!="string"||!Number.isFinite(Date.parse(i.expiresAt))||!e||Object.keys(e).sort().join(",")!==t.sort().join(",")||Object.entries(e).some(([a,d])=>a!=="schemaVersion"&&a!=="endpointCount"&&a!=="screenCount"&&a!=="pathCount"&&a!=="aggregateCount"&&a!=="invariantCount"&&a!=="numRuns"&&(typeof d!="string"||d.length<1||d.length>256))||!/^[a-f0-9]{64}$/.test(String(e.inputSha256))||e.hostKind!=="codex-cli"||s&&!/^[a-f0-9]{64}$/.test(String(e.stateSnapshotSha256))||i.schemaVersion===2&&(e.schemaVersion!==2||e.authorityKind!=="state-snapshot"||!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(String(e.storyId)))||i.schemaVersion===3&&(e.schemaVersion!==3||e.authorityKind!=="epic-claim"||!(e.commandId==="create-epic"&&(e.writeSetId===void 0||e.writeSetId==="idea-diagnosis-v1"&&e.stepId==="step-acd455ed")||e.commandId==="idea-diagnose"&&e.writeSetId==="idea-diagnosis-v1")||!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(String(e.claimId))||!/^P[1-9][0-9]*$/.test(String(e.epicId)))||i.schemaVersion===4&&(e.schemaVersion!==4||e.authorityKind!=="project-snapshot"||!(e.commandId==="sync-openapi"&&e.writeSetId==="sync-openapi-contract-v1"||e.commandId==="tech-debt"&&e.writeSetId==="tech-debt-registry-v1"||e.commandId==="chaos-plan"&&e.writeSetId==="chaos-quarterly-v1"))||i.schemaVersion===11&&(e.schemaVersion!==11||e.authorityKind!=="private-report"||e.commandId!=="ui-ux-review"||!["markdown","json"].includes(String(e.format))||!/^sha256:[a-f0-9]{64}$/.test(String(e.generationId))||i.materialSha256!==String(e.generationId).slice(7))||i.schemaVersion===5&&(e.schemaVersion!==5||e.authorityKind!=="architecture-stage"||!(e.commandId==="arch-prd"&&e.writeSetId==="arch-prd-docs-v1"||e.commandId==="arch-architecture"&&e.writeSetId==="arch-architecture-doc-v1"||e.commandId==="arch-fitness-functions"&&e.writeSetId==="arch-fitness-tools-v1"||e.commandId==="arch-api-contracts"&&e.writeSetId==="arch-api-contracts-docs-v1"||e.commandId==="arch-api-integrations"&&e.writeSetId==="arch-api-integrations-doc-v1"||e.commandId==="arch-database"&&e.writeSetId==="arch-database-doc-v1"||e.commandId==="arch-security"&&e.writeSetId==="arch-security-doc-v1"||e.commandId==="arch-design-system"&&e.writeSetId==="arch-design-system-doc-v1"||e.commandId==="arch-performance"&&e.writeSetId==="arch-performance-doc-v1"||e.commandId==="arch-testing"&&e.writeSetId==="arch-testing-doc-v1"||e.commandId==="arch-infrastructure"&&e.writeSetId==="arch-infrastructure-doc-v1"||e.commandId==="arch-review"&&e.writeSetId==="arch-review-doc-v1"||e.commandId==="update-memory"&&e.writeSetId==="arch-memory-canonical-v1")||!/^P[1-9][0-9]{0,11}$/.test(String(e.targetEpicId))||!/^[a-f0-9]{64}$/.test(String(e.graphRevision)))||i.schemaVersion===6&&(e.schemaVersion!==6||e.authorityKind!=="pact-stage"||e.commandId!=="generate-pacts"||!/^P[1-9][0-9]{0,11}$/.test(String(e.targetEpicId))||!/^[a-f0-9]{64}$/.test(String(e.graphRevision))||!/^[a-f0-9]{64}$/.test(String(e.answersSha256))||!/^[a-f0-9]{64}$/.test(String(e.specSha256))||!/^[a-f0-9]{64}$/.test(String(e.pathsSha256))||!Number.isSafeInteger(e.endpointCount)||e.endpointCount<1||e.endpointCount>256||!Number.isSafeInteger(e.pathCount)||e.pathCount<e.endpointCount||e.pathCount>e.endpointCount+1)||i.schemaVersion===7&&(e.schemaVersion!==7||e.authorityKind!=="ux-stage"||e.commandId!=="arch-ux-design"||!/^P[1-9][0-9]{0,11}$/.test(String(e.targetEpicId))||!/^[a-f0-9]{64}$/.test(String(e.graphRevision))||!["storybook-react-vite","storybook-nextjs-vite"].includes(String(e.adapterId))||!/^[a-f0-9]{64}$/.test(String(e.authoritySha256))||!/^[a-f0-9]{64}$/.test(String(e.pathsSha256))||!Number.isSafeInteger(e.screenCount)||e.screenCount<1||e.screenCount>48||!Number.isSafeInteger(e.pathCount)||e.pathCount!==e.screenCount*6+3)||i.schemaVersion===8&&(e.schemaVersion!==8||e.authorityKind!=="planning-stage"||e.commandId!=="idea-research"||e.writeSetId!=="idea-research-v1"||!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(String(e.claimId))||!/^P[1-9][0-9]{0,11}$/.test(String(e.epicId))||[e.diagnosisReceiptId,e.intakeRevision,e.physicalAcceptanceReceiptId].some(a=>!/^[a-f0-9]{64}$/.test(String(a))))||i.schemaVersion===9&&(e.schemaVersion!==9||e.authorityKind!=="planning-generation"||e.commandId!=="generate-epic"||e.writeSetId!=="generate-epic-v1"||!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(String(e.claimId))||!/^P[1-9][0-9]{0,11}$/.test(String(e.epicId))||[e.diagnosisReceiptId,e.researchReceiptId,e.intakeRevision,e.physicalAcceptanceReceiptId].some(a=>!/^[a-f0-9]{64}$/.test(String(a))))||i.schemaVersion===10&&(e.schemaVersion!==10||e.authorityKind!=="property-test-plan"||e.commandId!=="property-test"||!["prd.md","docs/architecture/prd.md"].includes(String(e.prdPath))||[e.prdSha256,e.planSha256,e.pathsSha256].some(a=>!/^[a-f0-9]{64}$/.test(String(a)))||!Number.isSafeInteger(e.aggregateCount)||e.aggregateCount<1||e.aggregateCount>64||!Number.isSafeInteger(e.invariantCount)||e.invariantCount<e.aggregateCount||e.invariantCount>1024||e.pathCount!==e.aggregateCount||!["typescript","python"].includes(String(e.language))||![100,1e3,1e4].includes(e.numRuns))||n&&Object.entries(n).some(([a,d])=>e[a]!==d))throw new Error("private-execution-descriptor-invalid");return i}function V(o,n,i=Date.now()){if(typeof n!="string"||i>=Date.parse(o.expiresAt)||Buffer.byteLength(n,"utf8")!==o.byteLength||I("sha256").update(n,"utf8").digest("hex")!==o.materialSha256)throw new Error("private-execution-material-invalid");return n}async function k(o,n,i,e=Date.now()){const s=f(o,n);if(e>=Date.parse(s.expiresAt))throw new Error("private-execution-material-expired");const t=await i({leaseId:s.leaseId,...s.binding});if(!t||typeof t!="object"||Array.isArray(t)||Object.keys(t).sort().join(",")!=="material,schemaVersion"||t.schemaVersion!==1)throw new Error("private-execution-delivery-invalid");return V(s,t.material,Math.max(e,Date.now()))}export{l as PRIVATE_EXECUTION_PUBLIC_INSTRUCTION_V1,j as PRIVATE_MUTATION_QA_GATE_STEP_TOKEN,v as PRIVATE_REPORT_PUBLIC_INSTRUCTION_V1,k as consumePrivateExecutionDelivery,T as isPrivateExecutionPublicEnvelope,R as isPrivatePlanningRootPublicEnvelope,f as parsePrivateExecutionDescriptor,A as privateExecutionStateSnapshotSha256,V as verifyPrivateExecutionMaterial};