@ornexus/neocortex 4.60.71 → 4.60.73

package/packages/client/dist/private-execution/pact-write-set.js

@@ -1 +1,172 @@
-import{createHash as g}from"node:crypto";import{lstatSync as C,readFileSync as D,realpathSync as I}from"node:fs";import{join as _,resolve as k}from"node:path";import{parseDocument as N}from"yaml";const j="docs/api/openapi.yaml",z=5*1024*1024,K=256,L=new Set(["get","post","put","patch","delete","head","options","trace"]);function e(r){return!!r&&typeof r=="object"&&!Array.isArray(r)&&Object.getPrototypeOf(r)===Object.prototype}function M(r,c){let t=r;for(const w of c.split("/")){t=_(t,w);let a;try{a=C(t)}catch(O){if(O.code==="ENOENT")return!1;throw new Error("pact-write-set-path-unsafe")}if(a.isSymbolicLink()||(t===_(r,c)?!a.isFile():!a.isDirectory()))throw new Error("pact-write-set-path-unsafe")}return!0}function $(r,c){const t=r.replace(/^\//,"").replace(/[{}]/g,"").replace(/[^a-zA-Z0-9]+/g,"-").replace(/^-+|-+$/g,"").toLowerCase();return`${c.toLowerCase()}-${t||"root"}`}function v(r,c){if(typeof c!="boolean")throw new Error("pact-write-set-options-invalid");const t=k(r);try{if(I(t)!==t||!C(t).isDirectory())throw new Error("pact-write-set-path-unsafe")}catch{throw new Error("pact-write-set-path-unsafe")}if(!M(t,j))return{outcome:"skipped",reasonCode:"PACT_SKIPPED_NO_OPENAPI"};const w=C(_(t,j));if(w.size<1||w.size>z)throw new Error("pact-write-set-spec-size-invalid");const a=D(_(t,j)),O=g("sha256").update(a).digest("hex");let d;try{const o=new TextDecoder("utf-8",{fatal:!0}).decode(a),s=N(o,{strict:!0,stringKeys:!0,uniqueKeys:!0,schema:"core",customTags:[]});if(s.errors.length>0||s.warnings.length>0)return{outcome:"skipped",reasonCode:"PACT_SKIPPED_INVALID_YAML"};d=s.toJS({maxAliasCount:0})}catch{return{outcome:"skipped",reasonCode:"PACT_SKIPPED_INVALID_YAML"}}if(!e(d)||d.openapi!=="3.1.0")return{outcome:"skipped",reasonCode:"PACT_SKIPPED_UNSUPPORTED_VERSION"};if(!e(d.paths)||Object.keys(d.paths).length===0)return{outcome:"skipped",reasonCode:"PACT_SKIPPED_EMPTY_PATHS"};const l=new Set,A=[];let P=0;for(const[o,s]of Object.entries(d.paths)){if(!o.startsWith("/")||o.length>180||/[\u0000-\u001f\u007f?#]/.test(o)||!e(s)||o.split("/").some(u=>(u.includes("{")||u.includes("}"))&&!/^[^{}]*\{[^{}]+\}[^{}]*$/.test(u)))throw new Error("pact-write-set-spec-shape-invalid");for(const[u,f]of Object.entries(s)){const p=u.toLowerCase();if(!L.has(p))continue;if(!e(f))throw new Error("pact-write-set-spec-shape-invalid");if(p==="trace"||(p==="get"||p==="head")&&f.requestBody!==void 0)throw new Error("pact-write-set-method-unsupported");if(f.requestBody!==void 0){const n=f.requestBody,h=e(n)?n.content:void 0,b=e(h)?h["application/json"]:void 0;if(!e(b)||!e(b.schema))throw new Error("pact-write-set-operation-unsupported")}const m=f.responses,y=e(m)?["200","201",...Object.keys(m).filter(n=>/^[1-5][0-9]{2}$/.test(n)).sort()].find(n=>e(m[n])):void 0;if(!y)throw new Error("pact-write-set-operation-unsupported");const i=m[y];if((y==="204"||p==="head")&&e(i)&&(i.schema!==void 0||e(i.content)&&Object.keys(i.content).length>0))throw new Error("pact-write-set-operation-unsupported");if(y!=="204"&&p!=="head"&&e(i)){const n=i.content;if(n!==void 0){if(!e(n))throw new Error("pact-write-set-operation-unsupported");if(Object.keys(n).length>0){const h=n["application/json"];if(!e(h)||!e(h.schema))throw new Error("pact-write-set-operation-unsupported")}}if(i.schema!==void 0&&!e(i.schema))throw new Error("pact-write-set-operation-unsupported")}if(P+=1,P>K)throw new Error("pact-write-set-endpoint-limit");const S=`tests/pact/consumer/${$(o,u)}.test.ts`;if(S.length>240||l.has(S))throw new Error("pact-write-set-path-collision");l.add(S),A.push(Object.freeze({filePath:S,method:p.toUpperCase(),endpointPath:o}))}}if(P===0)return{outcome:"skipped",reasonCode:"PACT_SKIPPED_EMPTY_PATHS"};const E=c?"tests/pact/provider/verify.test.ts":void 0;E&&l.add(E);const T=Object.freeze([...l].sort());return A.sort((o,s)=>o.filePath<s.filePath?-1:o.filePath>s.filePath?1:0),{outcome:"ready",writeSet:Object.freeze({schemaVersion:1,specSha256:O,pathsSha256:g("sha256").update(JSON.stringify(T)).digest("hex"),endpointCount:P,paths:T,interactions:Object.freeze(A),...E?{providerPath:E}:{}})}}export{v as derivePactWriteSet};
+/**
+ * P222.26: derive a closed, local Pact artifact set from the exact OpenAPI input.
+ * Paths remain private client state; only hashes and bounded counts may become
+ * public binding evidence. This does not grant a child or package.json writes.
+ */
+import { createHash } from 'node:crypto';
+import { lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { parseDocument } from 'yaml';
+const SPEC_PATH = 'docs/api/openapi.yaml';
+const MAX_SPEC_BYTES = 5 * 1024 * 1024;
+const MAX_ENDPOINTS = 256;
+const METHODS = new Set(['get', 'post', 'put', 'patch', 'delete', 'head', 'options', 'trace']);
+function plainRecord(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value)
+        && Object.getPrototypeOf(value) === Object.prototype;
+}
+function regularPath(root, relative) {
+    let current = root;
+    for (const part of relative.split('/')) {
+        current = join(current, part);
+        let entry;
+        try {
+            entry = lstatSync(current);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return false;
+            throw new Error('pact-write-set-path-unsafe');
+        }
+        if (entry.isSymbolicLink() || (current === join(root, relative)
+            ? !entry.isFile() : !entry.isDirectory())) {
+            throw new Error('pact-write-set-path-unsafe');
+        }
+    }
+    return true;
+}
+function slug(endpointPath, method) {
+    const cleaned = endpointPath.replace(/^\//, '').replace(/[{}]/g, '')
+        .replace(/[^a-zA-Z0-9]+/g, '-').replace(/^-+|-+$/g, '').toLowerCase();
+    return `${method.toLowerCase()}-${cleaned || 'root'}`;
+}
+/** No filesystem mutation and no protected content returned. */
+export function derivePactWriteSet(projectRoot, generateProvider) {
+    if (typeof generateProvider !== 'boolean')
+        throw new Error('pact-write-set-options-invalid');
+    const root = resolve(projectRoot);
+    try {
+        if (realpathSync(root) !== root || !lstatSync(root).isDirectory()) {
+            throw new Error('pact-write-set-path-unsafe');
+        }
+    }
+    catch {
+        throw new Error('pact-write-set-path-unsafe');
+    }
+    if (!regularPath(root, SPEC_PATH))
+        return { outcome: 'skipped', reasonCode: 'PACT_SKIPPED_NO_OPENAPI' };
+    const entry = lstatSync(join(root, SPEC_PATH));
+    if (entry.size < 1 || entry.size > MAX_SPEC_BYTES)
+        throw new Error('pact-write-set-spec-size-invalid');
+    const bytes = readFileSync(join(root, SPEC_PATH));
+    const specSha256 = createHash('sha256').update(bytes).digest('hex');
+    let parsed;
+    try {
+        const source = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        const document = parseDocument(source, { strict: true, stringKeys: true,
+            uniqueKeys: true, schema: 'core', customTags: [] });
+        if (document.errors.length > 0 || document.warnings.length > 0) {
+            return { outcome: 'skipped', reasonCode: 'PACT_SKIPPED_INVALID_YAML' };
+        }
+        parsed = document.toJS({ maxAliasCount: 0 });
+    }
+    catch {
+        return { outcome: 'skipped', reasonCode: 'PACT_SKIPPED_INVALID_YAML' };
+    }
+    if (!plainRecord(parsed) || parsed.openapi !== '3.1.0') {
+        return { outcome: 'skipped', reasonCode: 'PACT_SKIPPED_UNSUPPORTED_VERSION' };
+    }
+    if (!plainRecord(parsed.paths) || Object.keys(parsed.paths).length === 0) {
+        return { outcome: 'skipped', reasonCode: 'PACT_SKIPPED_EMPTY_PATHS' };
+    }
+    const files = new Set();
+    const interactions = [];
+    let endpointCount = 0;
+    for (const [endpointPath, operations] of Object.entries(parsed.paths)) {
+        if (!endpointPath.startsWith('/') || endpointPath.length > 180
+            || /[\u0000-\u001f\u007f?#]/.test(endpointPath) || !plainRecord(operations)
+            || endpointPath.split('/').some((segment) => (segment.includes('{') || segment.includes('}'))
+                && !/^[^{}]*\{[^{}]+\}[^{}]*$/.test(segment))) {
+            throw new Error('pact-write-set-spec-shape-invalid');
+        }
+        for (const [method, operation] of Object.entries(operations)) {
+            const normalizedMethod = method.toLowerCase();
+            if (!METHODS.has(normalizedMethod))
+                continue;
+            if (!plainRecord(operation))
+                throw new Error('pact-write-set-spec-shape-invalid');
+            // The first-generation test transport uses fetch, which cannot send
+            // TRACE or request bodies on GET/HEAD. Refuse before a private lease is
+            // issued instead of admitting an artifact the generator cannot execute.
+            if (normalizedMethod === 'trace'
+                || (normalizedMethod === 'get' || normalizedMethod === 'head')
+                    && operation.requestBody !== undefined) {
+                throw new Error('pact-write-set-method-unsupported');
+            }
+            // Keep lease preflight aligned with the first-generation generator.
+            // An unsupported media type, absent response status or missing schema
+            // must refuse before a private agent receives the protected step.
+            if (operation.requestBody !== undefined) {
+                const body = operation.requestBody;
+                const content = plainRecord(body) ? body.content : undefined;
+                const json = plainRecord(content) ? content['application/json'] : undefined;
+                if (!plainRecord(json) || !plainRecord(json.schema)) {
+                    throw new Error('pact-write-set-operation-unsupported');
+                }
+            }
+            const responses = operation.responses;
+            const status = plainRecord(responses)
+                ? ['200', '201', ...Object.keys(responses)
+                        .filter((key) => /^[1-5][0-9]{2}$/.test(key)).sort()]
+                    .find((key) => plainRecord(responses[key])) : undefined;
+            if (!status)
+                throw new Error('pact-write-set-operation-unsupported');
+            const response = responses[status];
+            if ((status === '204' || normalizedMethod === 'head') && plainRecord(response)
+                && (response.schema !== undefined
+                    || plainRecord(response.content) && Object.keys(response.content).length > 0)) {
+                throw new Error('pact-write-set-operation-unsupported');
+            }
+            if (status !== '204' && normalizedMethod !== 'head' && plainRecord(response)) {
+                const content = response.content;
+                if (content !== undefined) {
+                    if (!plainRecord(content))
+                        throw new Error('pact-write-set-operation-unsupported');
+                    if (Object.keys(content).length > 0) {
+                        const json = content['application/json'];
+                        if (!plainRecord(json) || !plainRecord(json.schema)) {
+                            throw new Error('pact-write-set-operation-unsupported');
+                        }
+                    }
+                }
+                if (response.schema !== undefined && !plainRecord(response.schema)) {
+                    throw new Error('pact-write-set-operation-unsupported');
+                }
+            }
+            endpointCount += 1;
+            if (endpointCount > MAX_ENDPOINTS)
+                throw new Error('pact-write-set-endpoint-limit');
+            const candidate = `tests/pact/consumer/${slug(endpointPath, method)}.test.ts`;
+            if (candidate.length > 240 || files.has(candidate)) {
+                throw new Error('pact-write-set-path-collision');
+            }
+            files.add(candidate);
+            interactions.push(Object.freeze({ filePath: candidate,
+                method: normalizedMethod.toUpperCase(), endpointPath }));
+        }
+    }
+    if (endpointCount === 0)
+        return { outcome: 'skipped', reasonCode: 'PACT_SKIPPED_EMPTY_PATHS' };
+    const providerPath = generateProvider ? 'tests/pact/provider/verify.test.ts' : undefined;
+    if (providerPath)
+        files.add(providerPath);
+    const paths = Object.freeze([...files].sort());
+    interactions.sort((left, right) => left.filePath < right.filePath ? -1
+        : left.filePath > right.filePath ? 1 : 0);
+    return { outcome: 'ready', writeSet: Object.freeze({
+            schemaVersion: 1, specSha256,
+            pathsSha256: createHash('sha256').update(JSON.stringify(paths)).digest('hex'),
+            endpointCount, paths, interactions: Object.freeze(interactions),
+            ...(providerPath ? { providerPath } : {}),
+        }) };
+}

package/packages/client/dist/private-execution/planning-diagnosis-checkpoint.js

@@ -1,5 +1,406 @@
-import{execFileSync as q,spawnSync as Y}from"node:child_process";import{createHash as v,randomUUID as ii}from"node:crypto";import{closeSync as D,fsyncSync as _,lstatSync as w,mkdirSync as ni,openSync as j,readFileSync as V,realpathSync as J,renameSync as ei,unlinkSync as L,writeFileSync as T}from"node:fs";import{isAbsolute as ti,join as m,resolve as B}from"node:path";import{isDeepStrictEqual as b}from"node:util";import{canonicalPlanningIntake as H,createPlanningReceiptV1 as N,planningIntakeRevision as F,projectDiagnosedEpicState as M}from"../../../shared/dist/planning/diagnosis-state.js";const x=/^[a-f0-9]{64}$/,si=/^P[1-9][0-9]{0,11}$/,ci=/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/,A=["idea","diagnosis","enrichment","index"],G="acd455ed0e39d98b90fb57391db75e366e4c5604db043e03a89a20e33d643c3c",ai="81f50aaa801c1660eabe46e645501acbfb3e9873410c991e1496c014ca75c369";function o(i){return i!==null&&typeof i=="object"&&!Array.isArray(i)}function S(i){return v("sha256").update(i).digest("hex")}function O(i,n){return q("git",[...n],{cwd:i,encoding:"utf8",stdio:["ignore","pipe","ignore"],maxBuffer:65536}).trim()}function I(i,n,e){const t=m(i,n),c=w(t);if(!c.isFile()||c.isSymbolicLink()||c.size<1||c.size>e)throw new Error("planning-diagnosis-physical-artifact-invalid");return V(t)}function U(i,n){return typeof i=="string"&&i.length<=128&&S(i)===n}function Z(i,n,e){const t=/^---\n([\s\S]{1,8192}?)\n---\n/.exec(i.replace(/\r\n/g,`
-`))?.[1];if(!t)return!1;const c=t.split(`
-`),a=d=>{const g=c.filter(r=>r.startsWith(`${d}:`));return g.length===1?g[0].slice(d.length+1).trim().replace(/^(?:"(.*)"|'(.*)')$/,"$1$2"):void 0};return a("epic_id")===n&&a("status")==="completed"&&U(a("step"),e)}function mi(i){const n=m(i,".neocortex/pending-epic-claims.json");let e;try{e=w(n)}catch(a){if(a.code==="ENOENT")return;throw a}const t=w(m(i,".neocortex"));if(!t.isDirectory()||t.isSymbolicLink()||t.uid!==process.getuid?.()||(t.mode&18)!==0||!e.isFile()||e.isSymbolicLink()||e.uid!==process.getuid?.()||(e.mode&63)!==0||e.size<1||e.size>128*1024)throw new Error("planning-pending-sidecar-invalid");const c=V(n);if(c.length!==e.size)throw new Error("planning-pending-sidecar-invalid");return S(c)}function ri(i,n,e,t=!0){const c=new Set(Object.values(n)),a=new Set([".neocortex/state.json.planning.lock",...e?[e]:[]]),d=q("git",["status","--porcelain=v1","-z","--untracked-files=all"],{cwd:i,stdio:["ignore","pipe","ignore"],maxBuffer:128*1024}).toString("utf8").split("\0").filter(Boolean),g=[],r=new Set;for(const l of d){const h=l.slice(0,2),s=l.slice(3);if(!(a.has(s)&&h==="??")){if(l[2]!==" "||!c.has(s)&&(!t||s!==".neocortex/pending-epic-claims.json")||s===".neocortex/pending-epic-claims.json"&&h!=="??"||s!==".neocortex/pending-epic-claims.json"&&h!=="??"&&h!==" M"||r.has(s))throw new Error("planning-diagnosis-write-scope-conflict");r.add(s),h==="??"&&c.has(s)&&g.push(s)}}if([...c].some(l=>!r.has(l)))throw new Error("planning-diagnosis-write-scope-conflict");const p=[q("git",["diff","--binary","--no-ext-diff","--no-textconv","HEAD","--"],{cwd:i,stdio:["ignore","pipe","ignore"],maxBuffer:2*1024*1024})];for(const l of g.sort()){const h=Y("git",["diff","--no-index","--binary","--no-ext-diff","--","/dev/null",l],{cwd:i,encoding:"buffer",maxBuffer:2097152});if(h.status!==1||!Buffer.isBuffer(h.stdout))throw new Error("planning-diagnosis-patch-invalid");p.push(h.stdout)}return S(Buffer.concat(p.map(l=>Buffer.concat([l,Buffer.from(`
-`)]))))}function oi(i){if(!o(i)||Object.keys(i).sort().join("|")!==["schemaVersion","verdict","claimId","epicId","logicalFingerprint","sourceHead","sourceBranch","sourceStateSha256","admission","artifactDigests","qaEvidenceId","intake","artifactSummary"].sort().join("|")||i.schemaVersion!=="PlanningDiagnosisRootReview/1"||i.verdict!=="accepted"||typeof i.claimId!="string"||!ci.test(i.claimId)||typeof i.epicId!="string"||!si.test(i.epicId)||typeof i.logicalFingerprint!="string"||!x.test(i.logicalFingerprint)||typeof i.sourceHead!="string"||!/^[a-f0-9]{40}$/.test(i.sourceHead)||typeof i.sourceBranch!="string"||!/^[a-zA-Z0-9][a-zA-Z0-9._/-]{0,127}$/.test(i.sourceBranch)||typeof i.sourceStateSha256!="string"||!x.test(i.sourceStateSha256)||!o(i.admission)||i.admission.schemaVersion!==1||i.admission.outcome!=="admitted-unverified"||i.admission.baseSha!==i.sourceHead||i.admission.executionBranch!==i.sourceBranch||typeof i.admission.patchSha256!="string"||!x.test(i.admission.patchSha256)||typeof i.qaEvidenceId!="string"||!/^qa-[a-z0-9-]{8,80}$/.test(i.qaEvidenceId)||!o(i.artifactDigests)||Object.keys(i.artifactDigests).sort().join("|")!==[...A].sort().join("|")||A.some(n=>typeof i.artifactDigests[n]!="string"||!x.test(i.artifactDigests[n])))throw new Error("planning-diagnosis-review-invalid");H(i.intake),N({kind:"diagnosis",epicId:i.epicId,intakeRevision:F(i.intake),artifactSummary:i.artifactSummary,accepted:!0})}function W(i,n,e,t){if(O(i,["rev-parse","HEAD"])!==n.sourceHead||O(i,["symbolic-ref","--quiet","--short","HEAD"])!==n.sourceBranch)throw new Error("planning-diagnosis-head-conflict");const c=w(m(i,".neocortex")),a=w(m(i,".neocortex/pending-epic-claims.json"));if(!c.isDirectory()||c.isSymbolicLink()||(c.mode&18)!==0||!a.isFile()||a.isSymbolicLink()||a.uid!==process.getuid?.()||(a.mode&63)!==0)throw new Error("planning-diagnosis-claim-boundary-invalid");const d=JSON.parse(I(i,".neocortex/pending-epic-claims.json",128*1024).toString("utf8")),g=o(d)&&o(d.operations)?d.operations[n.logicalFingerprint]:void 0;if(!o(g)||g.claimId!==n.claimId||g.epicId!==n.epicId)throw new Error("planning-diagnosis-claim-conflict");const r=`.neocortex/planning/epic-${n.epicId}`,f={idea:`${r}/idea.json`,diagnosis:`${r}/diagnosis.md`,enrichment:`${r}/enriched-prompt.md`,index:".neocortex/planning/planning.json"};if(!Array.isArray(n.admission.changedPaths)||[...n.admission.changedPaths].sort().join("|")!==Object.values(f).sort().join("|")||e&&ri(i,f,t)!==n.admission.patchSha256)throw new Error("planning-diagnosis-admission-patch-conflict");const p={idea:I(i,f.idea,32*1024),diagnosis:I(i,f.diagnosis,256*1024),enrichment:I(i,f.enrichment,256*1024),index:I(i,f.index,128*1024)};for(const P of A)if(S(p[P])!==n.artifactDigests[P])throw new Error("planning-diagnosis-artifact-conflict");const l=JSON.parse(p.idea.toString("utf8")),h=JSON.parse(p.index.toString("utf8")),s=H(n.intake),u=o(h)&&o(h.epics)?h.epics[n.epicId]:void 0,y=o(u)?u.output_files:void 0;if(!o(l)||l.epic_id!==n.epicId||l.status!=="diagnosed"||l.raw_input!==s.rawIntent||!o(u)||u.id!==n.epicId||u.idea!==s.rawIntent||u.status!=="diagnosed"||!Z(p.diagnosis.toString("utf8"),n.epicId,G)||!Z(p.enrichment.toString("utf8"),n.epicId,ai)||!Array.isArray(u.steps_completed)||u.steps_completed.length!==1||!U(u.steps_completed[0],G)||!o(y)||!b(y,{diagnosis:f.diagnosis})||typeof u.created_at!="string"||!Number.isFinite(Date.parse(u.created_at))||u.completed_at!==null)throw new Error("planning-diagnosis-artifact-identity-conflict");if(typeof s.goal!="string"||!s.goal.trim()||typeof s.desiredOutcome!="string"||!s.desiredOutcome.trim()||!Array.isArray(s.users)||s.users.length===0||!Array.isArray(s.surfaces)||s.surfaces.length===0)throw new Error("planning-diagnosis-critical-intake-missing");const E=F(s),k=N({kind:"diagnosis",epicId:n.epicId,intakeRevision:E,artifactSummary:n.artifactSummary,accepted:!0});return{checkpoint:{schemaVersion:1,epicId:n.epicId,intake:s,intakeRevision:E,diagnosisReceipt:k},receiptId:k.receiptId}}function X(i,n,e){const t=W(i,n,!0,e),c=I(i,".neocortex/state.json",8*1024*1024);if(S(c)!==n.sourceStateSha256)throw new Error("planning-diagnosis-state-conflict");const a=JSON.parse(c.toString("utf8"));if(!o(a)||o(a.scope)&&a.scope.kind==="projected")throw new Error("planning-diagnosis-state-invalid");return M(a,{claimId:n.claimId,epicId:n.epicId,checkpoint:t.checkpoint}),{stateRaw:c,state:a,...t}}function K(i,n){const e={schemaVersion:"PlanningDiagnosisPhysicalAcceptance/1",claimId:i.claimId,epicId:i.epicId,diagnosisReceiptId:n,qaEvidenceId:i.qaEvidenceId,sourceHead:i.sourceHead,sourceStateSha256:i.sourceStateSha256,admissionPatchSha256:i.admission.patchSha256,artifactDigests:i.artifactDigests};return{...e,receiptId:S(JSON.stringify(e)),publicSafe:!0}}function yi(i,n,e,t=!1){const c=o(i)?i:void 0,d=(c&&o(c.epics)?c.epics:void 0)?.[e];if(!o(d)||d.id!==e||d.source!=="create-epic"||d.status!=="diagnosed"&&!(t&&d.status==="researched")||!o(d.createEpicPlanningClaim)||d.createEpicPlanningClaim.claimId!==n||d.createEpicPlanningClaim.epicId!==e||!o(d.createEpicPlanning)||!o(d.createEpicPlanningPhysical))throw new Error("planning-research-predecessor-invalid");const g=d.createEpicPlanning,r=d.createEpicPlanningPhysical,f=o(r.artifactDigests)?r.artifactDigests:void 0,p=H(g.intake),l=F(p),h=c&&o(c.epic_id_ledger)?c.epic_id_ledger:void 0,s=o(g.diagnosisReceipt)?g.diagnosisReceipt:void 0;if(g.schemaVersion!==1||g.epicId!==e||g.intakeRevision!==l||!t&&g.researchReceipt!==void 0||typeof p.goal!="string"||!p.goal.trim()||typeof p.desiredOutcome!="string"||!p.desiredOutcome.trim()||typeof p.rawIntent!="string"||!p.rawIntent.trim()||!Array.isArray(p.users)||p.users.length===0||!Array.isArray(p.surfaces)||p.surfaces.length===0||!Array.isArray(h?.reserved_ids)||!h.reserved_ids.includes(e)||!s||s.kind!=="diagnosis"||s.epicId!==e||s.intakeRevision!==l||s.accepted!==!0||typeof s.artifactSummary!="string"||!b(s,N({kind:"diagnosis",epicId:e,intakeRevision:l,artifactSummary:s.artifactSummary,accepted:!0}))||r.schemaVersion!=="PlanningDiagnosisPhysicalAcceptance/1"||r.claimId!==n||r.epicId!==e||r.diagnosisReceiptId!==s.receiptId||typeof r.qaEvidenceId!="string"||!/^qa-[a-z0-9-]{8,80}$/.test(r.qaEvidenceId)||typeof r.sourceHead!="string"||!/^[a-f0-9]{40}$/.test(r.sourceHead)||typeof r.sourceStateSha256!="string"||!x.test(r.sourceStateSha256)||typeof r.admissionPatchSha256!="string"||!x.test(r.admissionPatchSha256)||!f||Object.keys(f).sort().join("|")!==[...A].sort().join("|")||A.some(y=>typeof f[y]!="string"||!x.test(f[y])))throw new Error("planning-research-predecessor-invalid");const u={schemaVersion:r.schemaVersion,claimId:n,epicId:e,diagnosisReceiptId:s.receiptId,qaEvidenceId:r.qaEvidenceId,sourceHead:r.sourceHead,sourceStateSha256:r.sourceStateSha256,admissionPatchSha256:r.admissionPatchSha256,artifactDigests:f};if(!b(r,{...u,receiptId:S(JSON.stringify(u)),publicSafe:!0}))throw new Error("planning-research-predecessor-invalid");return{intakeRevision:l,diagnosisReceiptId:s.receiptId,rawIntent:p.rawIntent}}function di(i,n){const e=W(i,n,!1),t=JSON.parse(I(i,".neocortex/state.json",8*1024*1024).toString("utf8")),a=(o(t)&&o(t.epics)?t.epics:void 0)?.[n.epicId],d=o(t)&&o(t.epic_id_ledger)?t.epic_id_ledger:void 0;if(!o(a)||!o(a.createEpicPlanning)||!o(a.createEpicPlanningClaim)||a.createEpicPlanningClaim.claimId!==n.claimId||a.createEpicPlanningClaim.epicId!==n.epicId||a.createEpicPlanning.epicId!==n.epicId||a.createEpicPlanning.intakeRevision!==e.checkpoint.intakeRevision||!b(a.createEpicPlanning.intake,e.checkpoint.intake)||!b(a.createEpicPlanning.diagnosisReceipt,e.checkpoint.diagnosisReceipt)||!b(a.createEpicPlanningPhysical,K(n,e.receiptId))||!Array.isArray(d?.reserved_ids)||!d.reserved_ids.includes(n.epicId))throw new Error("planning-diagnosis-replay-conflict");return e.receiptId}function Si(i,n){oi(n);const e=n,t=B(i);if(J(t)!==t||O(t,["rev-parse","--show-toplevel"])!==t)throw new Error("planning-diagnosis-root-invalid");const c=m(t,".neocortex"),a=m(c,"state.json.planning.lock"),d=j(a,"wx",384);let g;try{const r=I(t,".neocortex/state.json",8388608);if(S(r)!==e.sourceStateSha256){const Q=di(t,e);return{epicId:e.epicId,diagnosisReceiptId:Q,qaEvidenceId:e.qaEvidenceId}}const f=X(t,e),p=M(f.state,{claimId:e.claimId,epicId:e.epicId,checkpoint:f.checkpoint});if(p===f.state)throw new Error("planning-diagnosis-already-sealed");const l=K(e,f.receiptId),h=p.epics,s={...p,epics:{...h,[e.epicId]:{...h[e.epicId],createEpicPlanningPhysical:l}}},u=O(t,["rev-parse","--git-common-dir"]),y=ti(u)?B(u):B(t,u);if(J(y)!==y||w(y).isSymbolicLink())throw new Error("planning-diagnosis-backup-dir-invalid");const E=m(y,"neocortex-planning");ni(E,{recursive:!0,mode:448});const k=w(E);if(!k.isDirectory()||k.isSymbolicLink()||k.uid!==process.getuid?.()||(k.mode&63)!==0)throw new Error("planning-diagnosis-backup-dir-invalid");const R=ii(),P=j(m(E,`state-backup-${R}.json`),"wx",384);try{T(P,f.stateRaw),_(P)}finally{D(P)}const C=j(E,"r");try{_(C)}finally{D(C)}g=m(c,`state.json.planning-tmp-${R}`);const $=j(g,"wx",384);try{T($,`${JSON.stringify(s,null,2)}
-`),_($)}finally{D($)}if(!X(t,e,`.neocortex/state.json.planning-tmp-${R}`).stateRaw.equals(f.stateRaw))throw new Error("planning-diagnosis-state-conflict");ei(g,m(c,"state.json")),g=void 0;const z=j(c,"r");try{_(z)}finally{D(z)}return{epicId:e.epicId,diagnosisReceiptId:f.receiptId,qaEvidenceId:e.qaEvidenceId}}finally{if(g)try{L(g)}catch{}D(d),L(a)}}export{yi as acceptedPlanningDiagnosisPredecessor,mi as planningPendingSidecarDigest,ri as planningPhysicalPatchDigest,Si as sealPlanningDiagnosis};
+import { execFileSync, spawnSync } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { closeSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { canonicalPlanningIntake, createPlanningReceiptV1, planningIntakeRevision, projectDiagnosedEpicState } from '../../../shared/dist/planning/diagnosis-state.js';
+const HEX = /^[a-f0-9]{64}$/;
+const EPIC = /^P[1-9][0-9]{0,11}$/;
+const CLAIM = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+const ARTIFACT_NAMES = ['idea', 'diagnosis', 'enrichment', 'index'];
+// Full hashes of server-owned step identifiers; do not publish their plaintext.
+const DIAGNOSIS_STEP_DIGEST = 'acd455ed0e39d98b90fb57391db75e366e4c5604db043e03a89a20e33d643c3c';
+const ENRICHMENT_STEP_DIGEST = '81f50aaa801c1660eabe46e645501acbfb3e9873410c991e1496c014ca75c369';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function digest(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function git(root, args) {
+    return execFileSync('git', [...args], { cwd: root, encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 65_536 }).trim();
+}
+function regularBytes(root, path, maxBytes) {
+    const full = join(root, path);
+    const entry = lstatSync(full);
+    if (!entry.isFile() || entry.isSymbolicLink() || entry.size < 1 || entry.size > maxBytes) {
+        throw new Error('planning-diagnosis-physical-artifact-invalid');
+    }
+    return readFileSync(full);
+}
+function stepMatches(value, expectedDigest) {
+    return typeof value === 'string' && value.length <= 128 && digest(value) === expectedDigest;
+}
+function documentMatches(content, epicId, stepDigest) {
+    const header = /^---\n([\s\S]{1,8192}?)\n---\n/.exec(content.replace(/\r\n/g, '\n'))?.[1];
+    if (!header)
+        return false;
+    const lines = header.split('\n');
+    const scalar = (key) => {
+        const found = lines.filter((line) => line.startsWith(`${key}:`));
+        return found.length === 1
+            ? found[0].slice(key.length + 1).trim().replace(/^(?:"(.*)"|'(.*)')$/, '$1$2')
+            : undefined;
+    };
+    return scalar('epic_id') === epicId && scalar('status') === 'completed'
+        && stepMatches(scalar('step'), stepDigest);
+}
+/** Read only an owner-private pending claim file; absence is an explicit snapshot. */
+export function planningPendingSidecarDigest(root) {
+    const path = join(root, '.neocortex/pending-epic-claims.json');
+    let entry;
+    try {
+        entry = lstatSync(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+    const directory = lstatSync(join(root, '.neocortex'));
+    if (!directory.isDirectory() || directory.isSymbolicLink()
+        || directory.uid !== process.getuid?.() || (directory.mode & 0o022) !== 0
+        || !entry.isFile() || entry.isSymbolicLink() || entry.uid !== process.getuid?.()
+        || (entry.mode & 0o077) !== 0 || entry.size < 1 || entry.size > 128 * 1024) {
+        throw new Error('planning-pending-sidecar-invalid');
+    }
+    const bytes = readFileSync(path);
+    if (bytes.length !== entry.size)
+        throw new Error('planning-pending-sidecar-invalid');
+    return digest(bytes);
+}
+export function planningPhysicalPatchDigest(root, paths, ownTemporaryPath, allowPendingSidecar = true) {
+    const allowed = new Set(Object.values(paths));
+    const ownPaths = new Set(['.neocortex/state.json.planning.lock',
+        ...(ownTemporaryPath ? [ownTemporaryPath] : [])]);
+    const status = execFileSync('git', ['status', '--porcelain=v1', '-z', '--untracked-files=all'], {
+        cwd: root, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 128 * 1024,
+    }).toString('utf8').split('\0').filter(Boolean);
+    const untracked = [];
+    const seen = new Set();
+    for (const entry of status) {
+        const code = entry.slice(0, 2);
+        const path = entry.slice(3);
+        if (ownPaths.has(path) && code === '??')
+            continue;
+        if (entry[2] !== ' ' || !allowed.has(path)
+            && (!allowPendingSidecar || path !== '.neocortex/pending-epic-claims.json')
+            || path === '.neocortex/pending-epic-claims.json' && code !== '??'
+            || path !== '.neocortex/pending-epic-claims.json' && code !== '??' && code !== ' M'
+            || seen.has(path))
+            throw new Error('planning-diagnosis-write-scope-conflict');
+        seen.add(path);
+        if (code === '??' && allowed.has(path))
+            untracked.push(path);
+    }
+    if ([...allowed].some((path) => !seen.has(path))) {
+        throw new Error('planning-diagnosis-write-scope-conflict');
+    }
+    const tracked = execFileSync('git', ['diff', '--binary', '--no-ext-diff', '--no-textconv', 'HEAD', '--'], {
+        cwd: root, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 2 * 1024 * 1024,
+    });
+    const patches = [tracked];
+    for (const path of untracked.sort()) {
+        const result = spawnSync('git', ['diff', '--no-index', '--binary', '--no-ext-diff', '--', '/dev/null', path], {
+            cwd: root, encoding: 'buffer', maxBuffer: 2 * 1024 * 1024,
+        });
+        if (result.status !== 1 || !Buffer.isBuffer(result.stdout)) {
+            throw new Error('planning-diagnosis-patch-invalid');
+        }
+        patches.push(result.stdout);
+    }
+    return digest(Buffer.concat(patches.map((patch) => Buffer.concat([patch, Buffer.from('\n')]))));
+}
+function validateReview(value) {
+    if (!record(value) || Object.keys(value).sort().join('|') !== [
+        'schemaVersion', 'verdict', 'claimId', 'epicId', 'logicalFingerprint', 'sourceHead',
+        'sourceBranch', 'sourceStateSha256', 'admission', 'artifactDigests',
+        'qaEvidenceId', 'intake', 'artifactSummary',
+    ].sort().join('|') || value.schemaVersion !== 'PlanningDiagnosisRootReview/1'
+        || value.verdict !== 'accepted' || typeof value.claimId !== 'string' || !CLAIM.test(value.claimId)
+        || typeof value.epicId !== 'string' || !EPIC.test(value.epicId)
+        || typeof value.logicalFingerprint !== 'string' || !HEX.test(value.logicalFingerprint)
+        || typeof value.sourceHead !== 'string' || !/^[a-f0-9]{40}$/.test(value.sourceHead)
+        || typeof value.sourceBranch !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9._/-]{0,127}$/.test(value.sourceBranch)
+        || typeof value.sourceStateSha256 !== 'string' || !HEX.test(value.sourceStateSha256)
+        || !record(value.admission) || value.admission.schemaVersion !== 1
+        || value.admission.outcome !== 'admitted-unverified'
+        || value.admission.baseSha !== value.sourceHead
+        || value.admission.executionBranch !== value.sourceBranch
+        || typeof value.admission.patchSha256 !== 'string' || !HEX.test(value.admission.patchSha256)
+        || typeof value.qaEvidenceId !== 'string' || !/^qa-[a-z0-9-]{8,80}$/.test(value.qaEvidenceId)
+        || !record(value.artifactDigests)
+        || Object.keys(value.artifactDigests).sort().join('|') !== [...ARTIFACT_NAMES].sort().join('|')
+        || ARTIFACT_NAMES.some((name) => typeof value.artifactDigests[name] !== 'string'
+            || !HEX.test(value.artifactDigests[name]))) {
+        throw new Error('planning-diagnosis-review-invalid');
+    }
+    canonicalPlanningIntake(value.intake);
+    createPlanningReceiptV1({ kind: 'diagnosis', epicId: value.epicId,
+        intakeRevision: planningIntakeRevision(value.intake),
+        artifactSummary: value.artifactSummary, accepted: true });
+}
+function physicalEvidence(root, review, checkPatch, ownTemporaryPath) {
+    if (git(root, ['rev-parse', 'HEAD']) !== review.sourceHead
+        || git(root, ['symbolic-ref', '--quiet', '--short', 'HEAD']) !== review.sourceBranch) {
+        throw new Error('planning-diagnosis-head-conflict');
+    }
+    const stateDir = lstatSync(join(root, '.neocortex'));
+    const sidecarEntry = lstatSync(join(root, '.neocortex/pending-epic-claims.json'));
+    if (!stateDir.isDirectory() || stateDir.isSymbolicLink()
+        || (stateDir.mode & 0o022) !== 0
+        || !sidecarEntry.isFile() || sidecarEntry.isSymbolicLink()
+        || sidecarEntry.uid !== process.getuid?.() || (sidecarEntry.mode & 0o077) !== 0) {
+        throw new Error('planning-diagnosis-claim-boundary-invalid');
+    }
+    const sidecar = JSON.parse(regularBytes(root, '.neocortex/pending-epic-claims.json', 128 * 1024).toString('utf8'));
+    const operation = record(sidecar) && record(sidecar.operations)
+        ? sidecar.operations[review.logicalFingerprint] : undefined;
+    if (!record(operation) || operation.claimId !== review.claimId || operation.epicId !== review.epicId) {
+        throw new Error('planning-diagnosis-claim-conflict');
+    }
+    const prefix = `.neocortex/planning/epic-${review.epicId}`;
+    const paths = { idea: `${prefix}/idea.json`, diagnosis: `${prefix}/diagnosis.md`,
+        enrichment: `${prefix}/enriched-prompt.md`, index: '.neocortex/planning/planning.json' };
+    if (!Array.isArray(review.admission.changedPaths)
+        || [...review.admission.changedPaths].sort().join('|') !== Object.values(paths).sort().join('|')
+        || checkPatch && planningPhysicalPatchDigest(root, paths, ownTemporaryPath) !== review.admission.patchSha256) {
+        throw new Error('planning-diagnosis-admission-patch-conflict');
+    }
+    const artifacts = { idea: regularBytes(root, paths.idea, 32 * 1024),
+        diagnosis: regularBytes(root, paths.diagnosis, 256 * 1024),
+        enrichment: regularBytes(root, paths.enrichment, 256 * 1024),
+        index: regularBytes(root, paths.index, 128 * 1024) };
+    for (const name of ARTIFACT_NAMES) {
+        if (digest(artifacts[name]) !== review.artifactDigests[name]) {
+            throw new Error('planning-diagnosis-artifact-conflict');
+        }
+    }
+    const idea = JSON.parse(artifacts.idea.toString('utf8'));
+    const index = JSON.parse(artifacts.index.toString('utf8'));
+    const intake = canonicalPlanningIntake(review.intake);
+    const indexEpic = record(index) && record(index.epics)
+        ? index.epics[review.epicId] : undefined;
+    const indexOutputs = record(indexEpic) ? indexEpic.output_files : undefined;
+    if (!record(idea) || idea.epic_id !== review.epicId || idea.status !== 'diagnosed'
+        || idea.raw_input !== intake.rawIntent || !record(indexEpic)
+        || indexEpic.id !== review.epicId || indexEpic.idea !== intake.rawIntent
+        || indexEpic.status !== 'diagnosed'
+        || !documentMatches(artifacts.diagnosis.toString('utf8'), review.epicId, DIAGNOSIS_STEP_DIGEST)
+        || !documentMatches(artifacts.enrichment.toString('utf8'), review.epicId, ENRICHMENT_STEP_DIGEST)
+        || !Array.isArray(indexEpic.steps_completed) || indexEpic.steps_completed.length !== 1
+        || !stepMatches(indexEpic.steps_completed[0], DIAGNOSIS_STEP_DIGEST)
+        || !record(indexOutputs) || !isDeepStrictEqual(indexOutputs, { diagnosis: paths.diagnosis })
+        || typeof indexEpic.created_at !== 'string' || !Number.isFinite(Date.parse(indexEpic.created_at))
+        || indexEpic.completed_at !== null) {
+        throw new Error('planning-diagnosis-artifact-identity-conflict');
+    }
+    if (typeof intake.goal !== 'string' || !intake.goal.trim()
+        || typeof intake.desiredOutcome !== 'string' || !intake.desiredOutcome.trim()
+        || !Array.isArray(intake.users) || intake.users.length === 0
+        || !Array.isArray(intake.surfaces) || intake.surfaces.length === 0) {
+        throw new Error('planning-diagnosis-critical-intake-missing');
+    }
+    const intakeRevision = planningIntakeRevision(intake);
+    const receipt = createPlanningReceiptV1({ kind: 'diagnosis', epicId: review.epicId,
+        intakeRevision, artifactSummary: review.artifactSummary, accepted: true });
+    const checkpoint = { schemaVersion: 1, epicId: review.epicId, intake, intakeRevision,
+        diagnosisReceipt: receipt };
+    return { checkpoint, receiptId: receipt.receiptId };
+}
+function physicalCheckpoint(root, review, ownTemporaryPath) {
+    const evidence = physicalEvidence(root, review, true, ownTemporaryPath);
+    const stateRaw = regularBytes(root, '.neocortex/state.json', 8 * 1024 * 1024);
+    if (digest(stateRaw) !== review.sourceStateSha256) {
+        throw new Error('planning-diagnosis-state-conflict');
+    }
+    const state = JSON.parse(stateRaw.toString('utf8'));
+    if (!record(state) || record(state.scope) && state.scope.kind === 'projected') {
+        throw new Error('planning-diagnosis-state-invalid');
+    }
+    projectDiagnosedEpicState(state, { claimId: review.claimId, epicId: review.epicId,
+        checkpoint: evidence.checkpoint });
+    return { stateRaw, state, ...evidence };
+}
+function physicalAcceptance(review, diagnosisReceiptId) {
+    const fields = {
+        schemaVersion: 'PlanningDiagnosisPhysicalAcceptance/1',
+        claimId: review.claimId, epicId: review.epicId,
+        diagnosisReceiptId, qaEvidenceId: review.qaEvidenceId,
+        sourceHead: review.sourceHead, sourceStateSha256: review.sourceStateSha256,
+        admissionPatchSha256: review.admission.patchSha256,
+        artifactDigests: review.artifactDigests,
+    };
+    return { ...fields, receiptId: digest(JSON.stringify(fields)), publicSafe: true };
+}
+/** P02 may consume only a physically sealed P01 for the same durable claim. */
+export function acceptedPlanningDiagnosisPredecessor(stateInput, claimId, epicId, allowResearched = false) {
+    const state = record(stateInput) ? stateInput : undefined;
+    const epics = state && record(state.epics) ? state.epics : undefined;
+    const epic = epics?.[epicId];
+    if (!record(epic) || epic.id !== epicId || epic.source !== 'create-epic'
+        || epic.status !== 'diagnosed' && !(allowResearched && epic.status === 'researched')
+        || !record(epic.createEpicPlanningClaim)
+        || epic.createEpicPlanningClaim.claimId !== claimId
+        || epic.createEpicPlanningClaim.epicId !== epicId
+        || !record(epic.createEpicPlanning) || !record(epic.createEpicPlanningPhysical)) {
+        throw new Error('planning-research-predecessor-invalid');
+    }
+    const checkpoint = epic.createEpicPlanning;
+    const physical = epic.createEpicPlanningPhysical;
+    const artifactDigests = record(physical.artifactDigests) ? physical.artifactDigests : undefined;
+    const intake = canonicalPlanningIntake(checkpoint.intake);
+    const revision = planningIntakeRevision(intake);
+    const ledger = state && record(state.epic_id_ledger) ? state.epic_id_ledger : undefined;
+    const receipt = record(checkpoint.diagnosisReceipt) ? checkpoint.diagnosisReceipt : undefined;
+    if (checkpoint.schemaVersion !== 1 || checkpoint.epicId !== epicId
+        || checkpoint.intakeRevision !== revision
+        || !allowResearched && checkpoint.researchReceipt !== undefined
+        || typeof intake.goal !== 'string' || !intake.goal.trim()
+        || typeof intake.desiredOutcome !== 'string' || !intake.desiredOutcome.trim()
+        || typeof intake.rawIntent !== 'string' || !intake.rawIntent.trim()
+        || !Array.isArray(intake.users) || intake.users.length === 0
+        || !Array.isArray(intake.surfaces) || intake.surfaces.length === 0
+        || !Array.isArray(ledger?.reserved_ids) || !ledger.reserved_ids.includes(epicId)
+        || !receipt || receipt.kind !== 'diagnosis' || receipt.epicId !== epicId
+        || receipt.intakeRevision !== revision || receipt.accepted !== true
+        || typeof receipt.artifactSummary !== 'string'
+        || !isDeepStrictEqual(receipt, createPlanningReceiptV1({ kind: 'diagnosis', epicId,
+            intakeRevision: revision, artifactSummary: receipt.artifactSummary, accepted: true }))
+        || physical.schemaVersion !== 'PlanningDiagnosisPhysicalAcceptance/1'
+        || physical.claimId !== claimId || physical.epicId !== epicId
+        || physical.diagnosisReceiptId !== receipt.receiptId
+        || typeof physical.qaEvidenceId !== 'string'
+        || !/^qa-[a-z0-9-]{8,80}$/.test(physical.qaEvidenceId)
+        || typeof physical.sourceHead !== 'string' || !/^[a-f0-9]{40}$/.test(physical.sourceHead)
+        || typeof physical.sourceStateSha256 !== 'string' || !HEX.test(physical.sourceStateSha256)
+        || typeof physical.admissionPatchSha256 !== 'string' || !HEX.test(physical.admissionPatchSha256)
+        || !artifactDigests
+        || Object.keys(artifactDigests).sort().join('|') !== [...ARTIFACT_NAMES].sort().join('|')
+        || ARTIFACT_NAMES.some((name) => typeof artifactDigests[name] !== 'string'
+            || !HEX.test(artifactDigests[name]))) {
+        throw new Error('planning-research-predecessor-invalid');
+    }
+    const fields = { schemaVersion: physical.schemaVersion, claimId, epicId,
+        diagnosisReceiptId: receipt.receiptId, qaEvidenceId: physical.qaEvidenceId,
+        sourceHead: physical.sourceHead, sourceStateSha256: physical.sourceStateSha256,
+        admissionPatchSha256: physical.admissionPatchSha256,
+        artifactDigests };
+    if (!isDeepStrictEqual(physical, { ...fields, receiptId: digest(JSON.stringify(fields)), publicSafe: true })) {
+        throw new Error('planning-research-predecessor-invalid');
+    }
+    return { intakeRevision: revision, diagnosisReceiptId: receipt.receiptId,
+        rawIntent: intake.rawIntent };
+}
+function acceptedReplay(root, review) {
+    const evidence = physicalEvidence(root, review, false);
+    const state = JSON.parse(regularBytes(root, '.neocortex/state.json', 8 * 1024 * 1024).toString('utf8'));
+    const epics = record(state) && record(state.epics) ? state.epics : undefined;
+    const epic = epics?.[review.epicId];
+    const ledger = record(state) && record(state.epic_id_ledger) ? state.epic_id_ledger : undefined;
+    if (!record(epic) || !record(epic.createEpicPlanning)
+        || !record(epic.createEpicPlanningClaim)
+        || epic.createEpicPlanningClaim.claimId !== review.claimId
+        || epic.createEpicPlanningClaim.epicId !== review.epicId
+        || epic.createEpicPlanning.epicId !== review.epicId
+        || epic.createEpicPlanning.intakeRevision !== evidence.checkpoint.intakeRevision
+        || !isDeepStrictEqual(epic.createEpicPlanning.intake, evidence.checkpoint.intake)
+        || !isDeepStrictEqual(epic.createEpicPlanning.diagnosisReceipt, evidence.checkpoint.diagnosisReceipt)
+        || !isDeepStrictEqual(epic.createEpicPlanningPhysical, physicalAcceptance(review, evidence.receiptId))
+        || !Array.isArray(ledger?.reserved_ids) || !ledger.reserved_ids.includes(review.epicId)) {
+        throw new Error('planning-diagnosis-replay-conflict');
+    }
+    return evidence.receiptId;
+}
+/** Root-only state transition after a separately accepted review of the exact admitted patch. */
+export function sealPlanningDiagnosis(projectRoot, reviewInput) {
+    validateReview(reviewInput);
+    const review = reviewInput;
+    const root = resolve(projectRoot);
+    if (realpathSync(root) !== root || git(root, ['rev-parse', '--show-toplevel']) !== root) {
+        throw new Error('planning-diagnosis-root-invalid');
+    }
+    const stateDir = join(root, '.neocortex');
+    const lockPath = join(stateDir, 'state.json.planning.lock');
+    const lock = openSync(lockPath, 'wx', 0o600);
+    let temporaryPath;
+    try {
+        const currentRaw = regularBytes(root, '.neocortex/state.json', 8 * 1024 * 1024);
+        if (digest(currentRaw) !== review.sourceStateSha256) {
+            const diagnosisReceiptId = acceptedReplay(root, review);
+            return { epicId: review.epicId, diagnosisReceiptId, qaEvidenceId: review.qaEvidenceId };
+        }
+        const before = physicalCheckpoint(root, review);
+        const projected = projectDiagnosedEpicState(before.state, {
+            claimId: review.claimId, epicId: review.epicId, checkpoint: before.checkpoint,
+        });
+        if (projected === before.state)
+            throw new Error('planning-diagnosis-already-sealed');
+        const acceptance = physicalAcceptance(review, before.receiptId);
+        const projectedEpics = projected.epics;
+        const next = { ...projected, epics: { ...projectedEpics,
+                [review.epicId]: { ...projectedEpics[review.epicId], createEpicPlanningPhysical: acceptance },
+            } };
+        const commonRaw = git(root, ['rev-parse', '--git-common-dir']);
+        const commonDir = isAbsolute(commonRaw) ? resolve(commonRaw) : resolve(root, commonRaw);
+        if (realpathSync(commonDir) !== commonDir || lstatSync(commonDir).isSymbolicLink()) {
+            throw new Error('planning-diagnosis-backup-dir-invalid');
+        }
+        const backupDir = join(commonDir, 'neocortex-planning');
+        mkdirSync(backupDir, { recursive: true, mode: 0o700 });
+        const backupEntry = lstatSync(backupDir);
+        if (!backupEntry.isDirectory() || backupEntry.isSymbolicLink()
+            || backupEntry.uid !== process.getuid?.() || (backupEntry.mode & 0o077) !== 0) {
+            throw new Error('planning-diagnosis-backup-dir-invalid');
+        }
+        const suffix = randomUUID();
+        const backup = openSync(join(backupDir, `state-backup-${suffix}.json`), 'wx', 0o600);
+        try {
+            writeFileSync(backup, before.stateRaw);
+            fsyncSync(backup);
+        }
+        finally {
+            closeSync(backup);
+        }
+        const backupDirectory = openSync(backupDir, 'r');
+        try {
+            fsyncSync(backupDirectory);
+        }
+        finally {
+            closeSync(backupDirectory);
+        }
+        temporaryPath = join(stateDir, `state.json.planning-tmp-${suffix}`);
+        const temporary = openSync(temporaryPath, 'wx', 0o600);
+        try {
+            writeFileSync(temporary, `${JSON.stringify(next, null, 2)}\n`);
+            fsyncSync(temporary);
+        }
+        finally {
+            closeSync(temporary);
+        }
+        if (!physicalCheckpoint(root, review, `.neocortex/state.json.planning-tmp-${suffix}`).stateRaw.equals(before.stateRaw)) {
+            throw new Error('planning-diagnosis-state-conflict');
+        }
+        renameSync(temporaryPath, join(stateDir, 'state.json'));
+        temporaryPath = undefined;
+        const stateDirectory = openSync(stateDir, 'r');
+        try {
+            fsyncSync(stateDirectory);
+        }
+        finally {
+            closeSync(stateDirectory);
+        }
+        return { epicId: review.epicId, diagnosisReceiptId: before.receiptId,
+            qaEvidenceId: review.qaEvidenceId };
+    }
+    finally {
+        if (temporaryPath)
+            try {
+                unlinkSync(temporaryPath);
+            }
+            catch { /* preserve primary failure */ }
+        closeSync(lock);
+        unlinkSync(lockPath);
+    }
+}