@ornexus/neocortex 4.60.71 → 4.60.73

package/packages/client/dist/runner/headless/continuous-story-workspace.js

@@ -1,4 +1,21 @@
-import{execFile as st,spawn as Me}from"node:child_process";import{createHash as G,randomBytes as Ke}from"node:crypto";import{lstat as le,readFile as B,realpath as Y,stat as dt}from"node:fs/promises";import{basename as $,dirname as C,isAbsolute as Fe,join as D,relative as ut,resolve as ht}from"node:path";import{promisify as ft}from"node:util";import{admitPreparedStoryBundle as pt}from"./prepared-story-bundle.js";import{acquireGitLifecyclePhysicalIntegrationLock as lt,assertGitLifecyclePrivateDirectory as W,assertGitLifecyclePrivateFile as F,applyGitLifecycleRuntimeOverlay as re,computeImmutableStoryQaEvidenceDigest as yt,computeP205StoryQaEvidenceDigest as wt,ensureGitLifecyclePrivateChildDirectory as be,ensureRuntimeEpic as ye,ensureRuntimeStory as mt,gitLifecycleRuntimeDirectory as gt,mutateGitLifecycleRuntime as X,P205_COMPLETE_COMMAND as St,readGitLifecycleRuntime as V,releaseGitLifecyclePhysicalIntegrationLock as It,removeGitLifecyclePrivateDirectory as oe,verifyAcceptedGitLifecycleStoryCheckpoint as ke,verifyGitLifecyclePhysicalIntegrationLock as xe}from"../../git/git-lifecycle-store.js";import{anchoredAtomicWriteFile as vt,anchoredCreateDirectory as Ee,anchoredDirectoryIdentity as Rt,anchoredExecuteGit as Ae,anchoredEnsureDirectory as bt,anchoredRemoveFile as kt}from"../../git/secure-filesystem-boundary.js";import{GIT_LIFECYCLE_COMMIT_PUSH_STEP_ID as Ve,GIT_LIFECYCLE_REVIEW_PR_STEP_ID as we}from"../../git/git-lifecycle-step-ids.js";const je=ft(st),xt=String.raw`
+/**
+ * Branchless preparation sandboxes for continuous yoloop children.
+ *
+ * A child receives an independent Git index at a detached HEAD, but no branch
+ * and no Git worktree are created. Only the root applies the validated result
+ * and creates the single logical story commit on the epic branch.
+ */
+import { execFile, spawn } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { lstat, readFile, realpath, stat } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { promisify } from 'node:util';
+import { admitPreparedStoryBundle } from './prepared-story-bundle.js';
+import { acquireGitLifecyclePhysicalIntegrationLock, assertGitLifecyclePrivateDirectory, assertGitLifecyclePrivateFile, applyGitLifecycleRuntimeOverlay, computeImmutableStoryQaEvidenceDigest, computeP205StoryQaEvidenceDigest, ensureGitLifecyclePrivateChildDirectory, ensureRuntimeEpic, ensureRuntimeStory, gitLifecycleRuntimeDirectory, mutateGitLifecycleRuntime, P205_COMPLETE_COMMAND, readGitLifecycleRuntime, releaseGitLifecyclePhysicalIntegrationLock, removeGitLifecyclePrivateDirectory, verifyAcceptedGitLifecycleStoryCheckpoint, verifyGitLifecyclePhysicalIntegrationLock, } from '../../git/git-lifecycle-store.js';
+import { anchoredAtomicWriteFile, anchoredCreateDirectory, anchoredDirectoryIdentity, anchoredExecuteGit, anchoredEnsureDirectory, anchoredRemoveFile, } from '../../git/secure-filesystem-boundary.js';
+import { GIT_LIFECYCLE_COMMIT_PUSH_STEP_ID, GIT_LIFECYCLE_REVIEW_PR_STEP_ID, } from '../../git/git-lifecycle-step-ids.js';
+const execFileAsync = promisify(execFile);
+const ANCHORED_CHILD_HELPER = String.raw `
 const fs = require('node:fs');
 const cp = require('node:child_process');
 const [expectedParentDev, expectedParentIno, name, expectedChildDev, expectedChildIno, encoded, handshake] = process.argv.slice(1);
@@ -46,13 +63,1613 @@ runtime.on('close', (code, signal) => {
   if (signal) process.kill(process.pid, signal);
   else process.exit(Number.isInteger(code) ? code : 1);
 });
-`;function ur(e,r={}){return async(t,o,n={})=>Nt(e,t,o,n,r)}function hr(e={}){let r=Promise.resolve();return{async prepare(t){if((e.platform??process.platform)==="win32")return f("continuous-sandbox-platform-unsupported");if(!/^[a-f0-9]{64}$/.test(t.dispatchId))return f("continuous-sandbox-dispatch-invalid");if(!ce(t.targetRef))return f("continuous-sandbox-target-invalid");if(!Jt(t.executionBranch))return f("continuous-execution-branch-invalid");if(!/^[a-f0-9]{64}$/.test(t.graphRevision))return f("continuous-graph-revision-invalid");const o=Ht(t.authorizedWriteSet);if(o.length===0||o.length!==t.authorizedWriteSet.length)return f("continuous-authorized-write-set-invalid");const n=Te(o),a=r;let c=()=>{};r=new Promise(s=>{c=s}),await a;let i,d;try{const s=await At(t.projectRoot),g=await P(s,["rev-parse","HEAD"]),S=await Ie(s,t.epicId,t.storyId),v=S.revision,A=await gt(s),w=await be(A,"leases"),j=D(w,t.dispatchId);try{await Ee(w,t.dispatchId),await W(j,w)}catch(m){if(!q(m,"EEXIST"))throw m;await W(j,w);const l=await ue(j,w);if(l!==void 0&&Qt(l.pid))return f("continuous-sandbox-lease-active");if(!l||!await oe(j,w,async E=>ot(await ue(E,w),l)))return f("continuous-sandbox-lease-owner-replaced");await Ee(w,t.dispatchId),await W(j,w)}i=j,d=Object.freeze({pid:process.pid,createdAt:new Date().toISOString(),nonce:Ke(16).toString("hex")}),await te(j,"owner.json",Buffer.from(JSON.stringify(d)),e.beforeSandboxWriteCommit),await F(D(j,"owner.json"),j);const R=await be(A,"sandboxes"),p=D(R,t.dispatchId.slice(0,20)),I=await Ge(p,R);let b,u;const k=I?.preparedAt??new Date().toISOString(),x=I?.workspaceOwnerNonce??Ke(16).toString("hex");if(I){if(I.projectRoot!==s||I.storyId!==t.storyId||I.targetRef!==t.targetRef||I.dispatchId!==t.dispatchId||I.epicId!==t.epicId||I.executionBranch!==t.executionBranch||I.graphRevision!==t.graphRevision||I.claimRevision!==n||I.graphAuthorityRevision!==v||I.graphAuthorityEpoch!==S.epoch||I.graphAuthorityStoryStatus!==S.storyStatus||!rt(I.authorizedWriteSet,o)||(b=I.contextSnapshots.map(m=>({path:m.path,...m.contentBase64!==void 0?{content:Buffer.from(m.contentBase64,"base64")}:{}})),u=await Rt(p),u.dev!==I.workspaceIdentity.dev||u.ino!==I.workspaceIdentity.ino))return f("continuous-sandbox-recovery-mismatch")}else await oe(p,R),u=await Ee(R,$(p)),await W(p,R),await ne(R,$(p),u,["init","--quiet"]),await Dt(s,p),await jt(s,R,$(p),u),await ne(R,$(p),u,["remote","add","neocortex-root",s]),await ne(R,$(p),u,["fetch","--quiet","--no-tags","neocortex-root",g]),await ne(R,$(p),u,["checkout","--quiet","--detach","FETCH_HEAD"]),b=await Et(s,p,t.epicId,t.targetRef,e.beforeSandboxWriteCommit),await Zt(p,R,{schemaVersion:1,projectRoot:s,storyId:t.storyId,targetRef:t.targetRef,epicId:t.epicId,executionBranch:t.executionBranch,graphRevision:t.graphRevision,graphAuthorityRevision:v,graphAuthorityEpoch:S.epoch,graphAuthorityStoryStatus:S.storyStatus,authorizedWriteSet:o,claimRevision:n,dispatchId:t.dispatchId,baseSha:g,preparedAt:k,workspaceOwnerNonce:x,workspaceIdentity:u,contextSnapshots:b.map(m=>({path:m.path,...m.content!==void 0?{contentBase64:m.content.toString("base64")}:{}}))},e.beforeSandboxWriteCommit);return i=void 0,{ok:!0,value:{projectRoot:s,workspacePath:p,workspaceStrategy:"branchless_sandbox",storyId:t.storyId,targetRef:t.targetRef,epicId:t.epicId,executionBranch:t.executionBranch,graphRevision:t.graphRevision,graphAuthorityRevision:v,graphAuthorityEpoch:S.epoch,graphAuthorityStoryStatus:S.storyStatus,authorizedWriteSet:o,claimRevision:n,baseSha:I?.baseSha??g,dispatchId:t.dispatchId,preparedAt:k,leasePath:j,leaseOwnerNonce:d.nonce,workspaceOwnerNonce:x,workspaceIdentity:u,contextSnapshots:b}}}catch{if(i&&d){const s=i,g=d;await oe(s,C(s),async S=>ot(await ue(S,C(s)),g)).catch(()=>{})}return f("continuous-sandbox-prepare-failed")}finally{c()}},async integrate(t,o){const n=await ue(t.leasePath,C(t.leasePath)).catch(()=>{}),a=await Ge(t.workspacePath,C(t.workspacePath)).catch(()=>{});if(!n||n.nonce!==t.leaseOwnerNonce||a?.workspaceOwnerNonce!==t.workspaceOwnerNonce||a.dispatchId!==t.dispatchId||a.storyId!==t.storyId)return f("continuous-sandbox-owner-mismatch");const c=Xe(o?.nowIso??new Date().toISOString()),i=await lt(t.projectRoot,{kind:"continuous",storyId:t.storyId,sessionId:t.dispatchId,idempotencyKey:t.dispatchId,expiresAt:new Date(Date.parse(c)+1800*1e3).toISOString(),persistent:!1,createdAt:c});if(!i.ok)return f(i.reasonCode==="git-lifecycle-integration-backpressure"?"continuous-integration-backpressure":"continuous-integration-lease-failed");let d=[],s=!1,g=!1;try{const S=(await ie(t,["status","--porcelain"])).trimEnd(),v=await De(t,["rev-parse","HEAD"]);if(await ee(t.projectRoot,["symbolic-ref","--quiet","--short","HEAD"])!==t.executionBranch)return f("continuous-execution-branch-mismatch");const w=C(C(t.leasePath)),j=await be(w,"integrated"),R=D(j,t.dispatchId),p=await Ut(R,j);if(p?.childHeadSha===v&&p.bundle.storyId===t.storyId&&p.bundle.epicId===t.epicId&&p.bundle.executionBranch===t.executionBranch&&p.bundle.graphRevision===t.graphRevision&&p.bundle.claimRevision===t.claimRevision&&rt(p.bundle.authorizedWriteSet,t.authorizedWriteSet)&&p.checkpoint.idempotencyKey===t.dispatchId&&p.checkpoint.bundleId===p.bundle.bundleId&&p.checkpoint.bundleDigest===p.bundle.bundleDigest&&p.checkpoint.graphRevision===t.graphRevision&&p.checkpoint.claimRevision===t.claimRevision&&await ae(t.projectRoot,["merge-base","--is-ancestor",p.rootHeadSha,"HEAD"])&&await Yt(t,p.checkpoint))return{ok:!0,value:{headSha:p.rootHeadSha,alreadyIntegrated:!0,bundle:p.bundle,checkpoint:p.checkpoint}};if(v!==t.baseSha)return f("continuous-sandbox-child-git-authority-denied");if(S.length===0)return f("continuous-bundle-empty");const I=S.split(`
-`).some(y=>y.length>0&&y[0]!==" "&&y[0]!=="?");I||await De(t,["add","-A"]);const b=L(await ie(t,["diff","--cached","--name-only","-z",t.baseSha]));if(b.length===0||b.some(y=>!ce(y)))return f("continuous-integration-write-set-invalid");if(!await Ct(t,["merge-base","--is-ancestor",t.baseSha,v]))return f("continuous-bundle-base-not-ancestor");if(!await ae(t.projectRoot,["merge-base","--is-ancestor",t.baseSha,"HEAD"]))return f("continuous-root-base-not-ancestor");const u=o?.nowIso??new Date().toISOString(),k=Ft(o?.receiptRefs,t.dispatchId),x=await ie(t,["diff","--cached","--binary",t.baseSha]),m={schemaVersion:1,storyId:t.storyId,epicId:t.epicId,executionBranch:t.executionBranch,baseSha:t.baseSha,bundleDigest:G("sha256").update(x).digest("hex"),graphRevision:t.graphRevision,claimRevision:t.claimRevision,authorizedWriteSet:t.authorizedWriteSet,contextDigests:Object.fromEntries(t.contextSnapshots.map(y=>[y.path,G("sha256").update(y.content??Buffer.alloc(0)).digest("hex")])),validationRefs:k,createdAt:t.preparedAt,expiresAt:new Date(Date.parse(t.preparedAt)+1440*60*1e3).toISOString(),branchless:!0},l=Object.freeze({...m,bundleId:Te(m)}),E=await er(t,l);if(E){const y=await Xt(t,l,E);if(y)return await We(R,v,E.headSha,l,y,e.beforeSandboxWriteCommit),{ok:!0,value:{headSha:E.headSha,alreadyIntegrated:!0,bundle:l,checkpoint:y}}}if(!E&&await Kt(t.projectRoot,t.epicId)!==t.graphAuthorityRevision)return f("continuous-graph-revision-stale");if(E){const y=await Ye({lease:t,bundle:l,baseSha:E.baseSha,headSha:E.headSha,receiptRefs:k,nowIso:u,qaRunner:e.storyQaRunner});if(!y.ok)return y;await e.beforeCheckpointPersist?.({projectRoot:t.projectRoot,storyId:t.storyId,headSha:E.headSha});const O=await Ue({lease:t,physicalLock:i,checkpointAuthority:E.checkpointAuthority,bundle:l,baseSha:E.baseSha,headSha:E.headSha,receiptRefs:[...k,`bundle:${l.bundleId}`,y.value.qaReceipt.receiptRef,y.value.reviewReceipt.receiptRef],qaReceipt:y.value.qaReceipt,reviewReceipt:y.value.reviewReceipt,recordedAt:u,checkpointNow:e.checkpointNow,insideCheckpointPreCommit:e.insideCheckpointPreCommit,afterCheckpointPersist:e.afterCheckpointPersist});return O.ok?(await We(R,v,E.headSha,l,O.value,e.beforeSandboxWriteCommit),{ok:!0,value:{headSha:E.headSha,alreadyIntegrated:!0,bundle:l,checkpoint:O.value}}):O}if(I)return f("continuous-sandbox-child-git-authority-denied");if(L(await z(t.projectRoot,["diff","--cached","--name-only","-z"])).length>0)return f("continuous-integration-root-index-dirty");const J=new Set(t.contextSnapshots.map(y=>y.path));if(b.filter(y=>!t.authorizedWriteSet.some(O=>Se(O,y))).length>0)return f("continuous-bundle-write-set-unauthorized");const M=b.filter(y=>!J.has(y)),Re=new Set(L(await z(t.projectRoot,["diff","--name-only","-z",`${t.baseSha}..HEAD`])));if(M.some(y=>Re.has(y)))return f("continuous-bundle-intervening-conflict");const he=new Set([...L(await z(t.projectRoot,["diff","--name-only","-z"])),...L(await z(t.projectRoot,["ls-files","--others","--exclude-standard","-z"]))]);if(M.some(y=>he.has(y)))return f("continuous-integration-root-conflict");d=await $t(t.projectRoot,[...new Set([...b,".neocortex/state.json"])]);const H=await zt(t,u);if(!H.ok)return H;const K=pt({bundle:l,payload:Buffer.from(x),expected:{epicId:t.epicId,storyId:t.storyId,executionBranch:t.executionBranch,baseSha:t.baseSha,graphRevision:t.graphRevision,claimRevision:t.claimRevision,authorizedWriteSet:t.authorizedWriteSet,nowIso:u},writerLease:H.value});if(K.length>0)return await Ne(t.projectRoot,d),f(`continuous-bundle-admission-${K[0]}`);const fe=await P(t.projectRoot,["rev-parse","HEAD"]);let Q;await e.beforeRootCommit?.({projectRoot:t.projectRoot,storyId:t.storyId,headSha:fe});try{await X(t.projectRoot,y=>{const O=h(ye(y,t.epicId).branch_lease);if(O?.ownerStoryId!==t.storyId||O.sessionId!==t.dispatchId||O.idempotencyKey!==t.dispatchId||Date.parse(String(O.expiresAt))<=Date.now())throw new Error("continuous-checkpoint-writer-lease-lost")},{preCommit:async y=>{const O=await Ie(t.projectRoot,t.epicId,t.storyId,y);if(O.revision!==t.graphAuthorityRevision||O.epoch!==t.graphAuthorityEpoch||O.storyStatus!==t.graphAuthorityStoryStatus)throw new Error("continuous-graph-revision-stale");if(!await xe(i.path,i.owner))throw new Error("continuous-integration-lock-raced");const nt=await ee(t.projectRoot,["symbolic-ref","--quiet","--short","HEAD"]),it=await P(t.projectRoot,["rev-parse","HEAD"]);if(nt!==t.executionBranch||it!==fe)throw new Error("continuous-integration-head-raced");const at=L(await z(t.projectRoot,["diff","--cached","--name-only","-z"])),ct=new Set([...L(await z(t.projectRoot,["diff","--name-only","-z"])),...L(await z(t.projectRoot,["ls-files","--others","--exclude-standard","-z"]))]);if(at.length>0)throw new Error("continuous-integration-root-index-dirty");if(M.some(_=>ct.has(_)))throw new Error("continuous-integration-root-conflict");if(g=!0,M.length>0){const _=await ie(t,["diff","--cached","--binary",t.baseSha,"--",...M]);if(_.length>0&&!await _t(t.projectRoot,["apply","--index","--3way","--whitespace=nowarn"],_))throw new Error("continuous-integration-conflict")}for(const _ of t.contextSnapshots){if(!b.includes(_.path))continue;const qe=await Ce(D(t.projectRoot,_.path)),He=await Ot(t,_.path),Je=_.path===".neocortex/state.json"?qt(_.content,qe,Gt(_.content,He,t.storyId)):Wt(_.content,qe,He);if(!Je.ok)throw new Error(_.path===".neocortex/state.json"?"continuous-state-merge-conflict":"continuous-context-merge-conflict");await te(t.projectRoot,_.path,Je.value),await P(t.projectRoot,["add","-A","--",_.path])}if(b.includes(".neocortex/state.json")&&await P(t.projectRoot,["add","-A","--",".neocortex/state.json"]),await ae(t.projectRoot,["diff","--cached","--quiet"]))throw new Error("continuous-integration-empty-after-admission");Q=await Ie(t.projectRoot,t.epicId,t.storyId,y),await P(t.projectRoot,["commit","-m",`feat(yoloop): integrate ${t.storyId}`,"-m",`Neocortex-Story: ${t.storyId}`,"-m",`Neocortex-Epic: ${t.epicId}`,"-m",`Neocortex-Execution-Branch: ${t.executionBranch}`,"-m",`Neocortex-Prepared-Base: ${t.baseSha}`,"-m",`Neocortex-Dispatch: ${t.dispatchId}`,"-m",`Neocortex-Bundle: ${l.bundleId}`,"-m",`Neocortex-Bundle-Digest: ${l.bundleDigest}`,"-m",`Neocortex-Graph-Revision: ${t.graphRevision}`,"-m",`Neocortex-Claim-Revision: ${t.claimRevision}`,"-m",`Neocortex-Checkpoint-Authority: ${Q.revision}`,"-m",`Neocortex-Checkpoint-Epoch: ${Q.epoch??"null"}`,"-m",`Neocortex-Checkpoint-Story-Status: ${Q.storyStatus??"null"}`]),s=!0}})}catch(y){g&&!s&&await Ne(t.projectRoot,d);const O=y instanceof Error&&/^continuous-/.test(y.message)?y.message:"continuous-integration-failed";return f(O)}const Z=await P(t.projectRoot,["rev-parse","HEAD"]);if(!Q)return f("continuous-checkpoint-authority-missing");await e.afterRootCommit?.({projectRoot:t.projectRoot,storyId:t.storyId,headSha:Z});const U=await Ye({lease:t,bundle:l,baseSha:fe,headSha:Z,receiptRefs:k,nowIso:u,qaRunner:e.storyQaRunner});if(!U.ok)return U;await e.beforeCheckpointPersist?.({projectRoot:t.projectRoot,storyId:t.storyId,headSha:Z});const pe=await Ue({lease:t,physicalLock:i,checkpointAuthority:Q,bundle:l,baseSha:fe,headSha:Z,receiptRefs:[...k,`bundle:${l.bundleId}`,U.value.qaReceipt.receiptRef,U.value.reviewReceipt.receiptRef],qaReceipt:U.value.qaReceipt,reviewReceipt:U.value.reviewReceipt,recordedAt:u,checkpointNow:e.checkpointNow,insideCheckpointPreCommit:e.insideCheckpointPreCommit,afterCheckpointPersist:e.afterCheckpointPersist});return pe.ok?(await We(R,v,Z,l,pe.value,e.beforeSandboxWriteCommit),{ok:!0,value:{headSha:Z,alreadyIntegrated:!1,bundle:l,checkpoint:pe.value}}):pe}catch{return g&&!s&&d.length>0&&await Ne(t.projectRoot,d),f("continuous-integration-failed")}finally{await Tt(t).catch(()=>{}),await It(i.path,i.owner).catch(()=>{})}},async release(t,o){o||await oe(t.workspacePath,C(t.workspacePath),async n=>{const a=await Ge(n,C(t.workspacePath)).catch(()=>{});return a?.workspaceOwnerNonce===t.workspaceOwnerNonce&&a.dispatchId===t.dispatchId&&a.storyId===t.storyId}),await oe(t.leasePath,C(t.leasePath),async n=>(await ue(n,C(t.leasePath)).catch(()=>{}))?.nonce===t.leaseOwnerNonce)}}}async function Et(e,r,t,o,n){const a=[...new Set([".neocortex/state.json",o,`docs/epics/epic-${Vt(t)}.md`])],c=[];for(const i of a){if(!ce(i))continue;const d=await Ce(D(e,i));c.push({path:i,...d!==void 0?{content:d}:{}}),d!==void 0&&await te(r,i,d,n)}return c}async function At(e){const r=await P(e,["rev-parse","--show-toplevel"]),[t,o]=await Promise.all([Y(r),Y(e)]);if(t!==o)throw new Error("project root mismatch");return t}async function jt(e,r,t,o){for(const n of["user.name","user.email"]){const a=await ee(e,["config","--get",n]);a&&await ne(r,t,o,["config",n,a])}}async function Dt(e,r){const t=await V(e);await X(r,o=>{for(const[n,a]of Object.entries(t.epics))o.epics[n]={...structuredClone(a),branch_lease:null};for(const[n,a]of Object.entries(t.stories))o.stories[n]=structuredClone(a)})}async function ne(e,r,t,o){return(await Ae(e,r,t,o)).toString("utf8").trim()}async function ie(e,r){return(await Ae(C(e.workspacePath),$(e.workspacePath),e.workspaceIdentity,r)).toString("utf8")}async function De(e,r){return(await ie(e,r)).trim()}async function Ct(e,r){try{return await De(e,r),!0}catch{return!1}}async function Ot(e,r){try{return await Ae(C(e.workspacePath),$(e.workspacePath),e.workspaceIdentity,["show",`:${r}`])}catch{return}}async function Nt(e,r,t,o,n){const a=Date.now(),c=A=>({exitCode:null,timedOut:!1,durationMs:Date.now()-a,stdout:"",stderr:"",stdoutBytes:0,stderrBytes:0,...A});if(o.signal?.aborted)return c({signal:"SIGTERM",cancelled:!0});if(!r||r.length>4096||r.includes("\0")||t.length>512||t.some(A=>A.length>32768||A.includes("\0")))return c({exitCode:73,stderr:"continuous-child-invocation-invalid",stderrBytes:35});const i=C(e.workspacePath),d=await le(i,{bigint:!0}),s=await dt(i,{bigint:!0});if(!d.isDirectory()||d.isSymbolicLink()||!s.isDirectory()||d.dev!==s.dev||d.ino!==s.ino)return c({exitCode:73,stderr:"continuous-child-parent-invalid",stderrBytes:31});await n.beforeHandoff?.();const g=Buffer.from(JSON.stringify({command:r,args:[...t]})).toString("base64url"),S=o.maxOutputBytes??64e3,v=Math.max(1,Math.min(o.timeoutMs??600*1e3,1800*1e3));return await new Promise(A=>{const w=Me(process.execPath,["-e",xt,String(s.dev),String(s.ino),$(e.workspacePath),e.workspaceIdentity.dev,e.workspaceIdentity.ino,g,n.afterHandoff?"1":"0"],{cwd:i,env:o.env,stdio:["pipe","pipe","pipe"]});let j="",R="",p=0,I=0,b=!1,u=!1,k=!1,x=!n.afterHandoff;const m=(N,J)=>{b||(b=!0,clearTimeout(E),o.signal?.removeEventListener("abort",l),A({exitCode:N,...J?{signal:J}:{},timedOut:u,...k?{cancelled:!0}:{},durationMs:Date.now()-a,stdout:j,stderr:R,stdoutBytes:p,stderrBytes:I}))},l=()=>{k=!0,w.kill("SIGTERM")};o.signal?.addEventListener("abort",l,{once:!0});const E=setTimeout(()=>{u=!0,w.kill("SIGTERM")},v);w.stdout.on("data",N=>{p+=N.length,p+I>S?w.kill("SIGTERM"):j+=N.toString("utf8")}),w.stderr.on("data",N=>{I+=N.length,p+I>S?w.kill("SIGTERM"):R+=N.toString("utf8"),!x&&R.includes(`continuous-child-handoff-ready
-`)&&(x=!0,Promise.resolve(n.afterHandoff?.()).then(()=>w.stdin.end()).catch(()=>w.kill("SIGTERM")))}),w.once("error",()=>m(null)),w.once("close",(N,J)=>m(N,J)),n.afterHandoff||w.stdin.end()})}async function P(e,r){return(await z(e,r)).trim()}async function z(e,r){const t=await je("git",r,{cwd:e,encoding:"utf8",maxBuffer:16777216});return String(t.stdout)}async function ee(e,r){try{return await P(e,r)}catch(t){if(q(t,"ENOENT"))return;throw t}}async function ae(e,r){try{return await P(e,r),!0}catch{return!1}}async function _t(e,r,t){return await new Promise(o=>{const n=Me("git",[...r],{cwd:e,stdio:["pipe","ignore","ignore"]});n.once("error",()=>o(!1)),n.once("close",a=>o(a===0)),n.stdin.end(t)})}async function fr(e,r,t){try{const o=await je("git",["show",`${r}:${t}`],{cwd:e,encoding:"buffer",maxBuffer:16777216});return Buffer.from(o.stdout)}catch(o){if(q(o,"ENOENT"))return;throw o}}async function Ce(e){try{return await B(e)}catch(r){if(q(r,"ENOENT"))return;throw r}}async function te(e,r,t,o){const n=se(r);if(!ce(n))throw new Error("continuous-sandbox-write-path-invalid");const a=await Y(e);if(a!==ht(e))throw new Error("continuous-sandbox-write-root-symlink");const c=C(n)==="."?"":C(n),i=await Bt(a,c),d=await Qe(i),s=D(i,$(n));if(await me(s,a,!0),t===void 0){await o?.({boundaryRoot:a,relativePath:n,destinationPath:s}),await Ze(i,a,d),await me(s,a,!0),await kt(i,$(n));return}await o?.({boundaryRoot:a,relativePath:n,destinationPath:s}),await Ze(i,a,d),await me(s,a,!0),await vt(i,$(n),t),await me(s,a,!1)}async function Bt(e,r){let t=e;for(const o of r.split("/").filter(Boolean)){t=D(t,o),await bt(C(t),$(t));const n=await le(t);if(!n.isDirectory()||n.isSymbolicLink()||await Y(t)!==t)throw new Error("continuous-sandbox-write-component-unsafe");Oe(e,t)}return t}async function me(e,r,t){Oe(r,e);try{const o=await le(e);if(o.isSymbolicLink()||!o.isFile())throw new Error("continuous-sandbox-write-destination-unsafe");if(await Y(e)!==e)throw new Error("continuous-sandbox-write-destination-symlink")}catch(o){if(t&&q(o,"ENOENT"))return;throw o}}function Oe(e,r){const t=ut(e,r);if(t===""||t.startsWith("..")||Fe(t))throw new Error("continuous-sandbox-write-containment-invalid")}async function Qe(e){const r=await le(e,{bigint:!0});if(!r.isDirectory()||r.isSymbolicLink())throw new Error("continuous-sandbox-write-parent-unsafe");return{dev:r.dev,ino:r.ino}}async function Pt(e,r,t){try{if(e!==r&&Oe(r,e),await Y(e)!==e)return!1;const o=await Qe(e);return o.dev===t.dev&&o.ino===t.ino}catch{return!1}}async function Ze(e,r,t){if(!await Pt(e,r,t))throw new Error("continuous-sandbox-write-parent-raced")}async function $t(e,r){return await Promise.all(r.map(async t=>{const o=await Ce(D(e,t));return{path:t,...o!==void 0?{content:o}:{}}}))}async function Ne(e,r){const t=r.map(o=>o.path);t.length>0&&await ae(e,["reset","--quiet","HEAD","--",...t]);for(const o of r)await te(e,o.path,o.content)}async function zt(e,r){try{const t=D(e.projectRoot,".neocortex/state.json"),o=T(JSON.parse((await B(t)).toString("utf8"))),n=h(h(o.epics)?.[e.epicId]),a=h(n?.branch_lease),c=Object.freeze({schemaVersion:1,ownerStoryId:e.storyId,sessionId:e.dispatchId,idempotencyKey:e.dispatchId,acquiredAt:r,expiresAt:new Date(Date.parse(r)+600*1e3).toISOString()});let i=!1;return await X(e.projectRoot,d=>{const s=ye(d,e.epicId),g=h(s.branch_lease)??a;if(g&&typeof g.expiresAt=="string"&&g.expiresAt>r&&(g.ownerStoryId!==e.storyId||g.idempotencyKey!==e.dispatchId)){i=!0;return}s.branch_mode="epic",s.execution_branch=e.executionBranch,s.branch_lease=c}),i?f("continuous-epic-checkout-writer-active"):{ok:!0,value:c}}catch{return f("continuous-writer-lease-persist-failed")}}async function Tt(e){await X(e.projectRoot,r=>{const t=ye(r,e.epicId),o=h(t.branch_lease);o?.ownerStoryId===e.storyId&&o.idempotencyKey===e.dispatchId&&(t.branch_lease=null)})}async function Ue(e){try{const r=D(e.lease.projectRoot,".neocortex/state.json"),t=Object.freeze({schemaVersion:1,storyId:e.lease.storyId,epicId:e.lease.epicId,branch:e.lease.executionBranch,baseSha:e.baseSha,headSha:e.headSha,commits:Object.freeze([e.headSha]),idempotencyKey:e.lease.dispatchId,dispatchId:e.lease.dispatchId,bundleId:e.bundle.bundleId,bundleDigest:e.bundle.bundleDigest,graphRevision:e.lease.graphRevision,claimRevision:e.lease.claimRevision,receiptRefs:Object.freeze([...new Set(e.receiptRefs)]),qaVerdict:"passed",reviewVerdict:"approved",qaReceipt:e.qaReceipt,reviewReceipt:e.reviewReceipt,recordedAt:e.recordedAt}),o=T(JSON.parse((await B(r)).toString("utf8"))),n=h(h(o.stories)?.[e.lease.storyId]);let a="persisted",c,i,d,s,g=!1,S;const v=async(u,k,x)=>{const m=await ee(e.lease.projectRoot,["symbolic-ref","--quiet","--short","HEAD"]),l=await P(e.lease.projectRoot,["rev-parse","HEAD"]);if(m!==e.lease.executionBranch||l!==e.headSha)throw new Error("continuous-checkpoint-head-raced");if(u.graphRevision!==e.lease.graphRevision||u.claimRevision!==e.lease.claimRevision||u.bundleId!==e.bundle.bundleId||u.bundleDigest!==e.bundle.bundleDigest)throw new Error("continuous-checkpoint-graph-raced");const E=x??T(JSON.parse((await B(r)).toString("utf8"))),N=re(E,k??await V(e.lease.projectRoot)),J=h(h(N.epics)?.[e.lease.epicId]),ve=h(h(N.stories)?.[e.lease.storyId]),M=Array.isArray(ve?.depends_on)?ve.depends_on.filter(H=>typeof H=="string"):[],Re=h(N.stories);if(J?.execution_branch!==e.lease.executionBranch||M.some(H=>{const K=h(Re?.[H]);return!K||!["done","completed","merged"].includes(String(K.status))}))throw new Error("continuous-checkpoint-dependency-raced");const he=L(await z(e.lease.projectRoot,["diff-tree","--no-commit-id","--name-only","-r","-z",e.headSha]));if(he.length===0||he.some(H=>!e.lease.authorizedWriteSet.some(K=>Se(K,H))))throw new Error("continuous-checkpoint-write-set-raced");if(!await ke(e.lease.projectRoot,u,e.lease.storyId,e.lease.epicId,e.lease.executionBranch,void 0,e.lease.authorizedWriteSet))throw new Error("continuous-checkpoint-receipt-revalidation-failed")},A=await V(e.lease.projectRoot,{required:!0}),w=h(h(A.epics[e.lease.epicId])?.branch_lease);if(w?.ownerStoryId!==e.lease.storyId||w.idempotencyKey!==e.lease.dispatchId||w.sessionId!==e.lease.dispatchId||typeof w.expiresAt!="string"||Date.parse(w.expiresAt)<=(e.checkpointNow?.("before-mutation")??Date.now()))return f("continuous-checkpoint-writer-lease-lost");if(!await xe(e.physicalLock.path,e.physicalLock.owner))return f("continuous-checkpoint-integration-lock-raced");const j=await B(r),R=G("sha256").update(j).digest("hex");await v(t,A);const p=$e(T(JSON.parse(j.toString("utf8"))),A,e.lease.epicId,e.lease.storyId);if(p.revision!==e.checkpointAuthority.revision||p.epoch!==e.checkpointAuthority.epoch||p.storyStatus!==e.checkpointAuthority.storyStatus)return f("continuous-graph-revision-stale");const I=await X(e.lease.projectRoot,u=>{const k=ye(u,e.lease.epicId),x=h(k.branch_lease);i=x===void 0?void 0:structuredClone(x),d=structuredClone(u),g=u.stories[e.lease.storyId]!==void 0,s=structuredClone(u.stories[e.lease.storyId]??{}),S=structuredClone(k.branch_lease);const m=mt(u,e.lease.storyId),l=h(m.checkpoint)??h(n?.checkpoint);if(l?.idempotencyKey===e.lease.dispatchId){l.baseSha!==e.baseSha||l.headSha!==e.headSha||l.bundleId!==e.bundle.bundleId||l.bundleDigest!==e.bundle.bundleDigest||l.graphRevision!==e.lease.graphRevision||l.claimRevision!==e.lease.claimRevision?a="conflict":(a="reused",c=l,k.branch_lease=null);return}if(x?.ownerStoryId!==e.lease.storyId||x.idempotencyKey!==e.lease.dispatchId||x.sessionId!==e.lease.dispatchId){a="lease-lost";return}m.checkpoint=t,m.status="done",m.last_step=we;const E=Array.isArray(m.steps_completed)?m.steps_completed.filter(N=>typeof N=="string"):[];m.steps_completed=[...new Set([...E,Ve,we])],k.branch_lease=null},{expectedRevision:A.revision,preCommit:async u=>{if(i?.ownerStoryId!==e.lease.storyId||i.idempotencyKey!==e.lease.dispatchId||i.sessionId!==e.lease.dispatchId||typeof i.expiresAt!="string"||Date.parse(i.expiresAt)<=(e.checkpointNow?.("pre-commit")??Date.now()))throw new Error("continuous-checkpoint-writer-lease-lost");if(await e.insideCheckpointPreCommit?.({projectRoot:e.lease.projectRoot,storyId:e.lease.storyId,headSha:e.headSha}),!await xe(e.physicalLock.path,e.physicalLock.owner))throw new Error("continuous-checkpoint-integration-lock-raced");await v(c??t,u);const k=await B(r);if(G("sha256").update(k).digest("hex")!==R)throw new Error("continuous-graph-revision-stale");if(!d)throw new Error("continuous-checkpoint-authority-missing");const x=T(JSON.parse(k.toString("utf8"))),m=$e(x,d,e.lease.epicId,e.lease.storyId);if(m.revision!==e.checkpointAuthority.revision||m.epoch!==e.checkpointAuthority.epoch||m.storyStatus!==e.checkpointAuthority.storyStatus)throw new Error("continuous-graph-revision-stale");if(a==="persisted"&&!ze(x,u,e.lease,t))throw new Error("continuous-checkpoint-projection-raced")}}),b=a;if(b==="conflict")return f("continuous-checkpoint-idempotency-conflict");if(b==="lease-lost")return f("continuous-checkpoint-writer-lease-lost");if(b==="reused"&&c)try{return await v(c),{ok:!0,value:c}}catch{return f("continuous-checkpoint-reused-evidence-invalid")}try{await e.afterCheckpointPersist?.({projectRoot:e.lease.projectRoot,storyId:e.lease.storyId,headSha:e.headSha});const u=await V(e.lease.projectRoot,{required:!0});if(u.revision!==I.document.revision)throw new Error("continuous-checkpoint-post-persist-runtime-raced");await v(t,u);const k=await B(r);if(G("sha256").update(k).digest("hex")!==R)throw new Error("continuous-checkpoint-post-persist-authority-raced");const x=T(JSON.parse(k.toString("utf8")));if(!ze(x,u,e.lease,t))throw new Error("continuous-checkpoint-post-persist-projection-raced")}catch{const u=await B(r).catch(()=>{}),k=u===void 0||G("sha256").update(u).digest("hex")!==R;return await X(e.lease.projectRoot,x=>{const m=h(x.epics[e.lease.epicId]),l=h(x.stories[e.lease.storyId]),E=u===void 0?void 0:T(JSON.parse(u.toString("utf8")));if(!m||!l||!E||!ze(E,x,e.lease,t))throw new Error("continuous-checkpoint-cleanup-cas-conflict");if(k){g?Mt(l,s??{}):delete x.stories[e.lease.storyId],S===void 0?delete m.branch_lease:m.branch_lease=structuredClone(S);return}l.checkpoint=null,l.status="blocked",m.branch_lease=null},{expectedRevision:I.document.revision}).catch(()=>{}),f("continuous-checkpoint-post-persist-raced")}return{ok:!0,value:t}}catch(r){const t=r instanceof Error&&/^continuous-/.test(r.message)?r.message:"continuous-checkpoint-persist-failed";return f(t)}}async function Ye(e){try{if(await P(e.lease.projectRoot,["rev-parse","HEAD"])!==e.headSha)return f("continuous-story-evidence-head-raced");const r=await B(D(e.lease.projectRoot,"config","release-gates.v2.json"),"utf8"),t=JSON.parse(r),o=Array.isArray(t.requiredCompleteClasses)?t.requiredCompleteClasses.filter(b=>typeof b=="string"&&/^[a-z0-9-]+$/.test(b)):[];if(t.contract!=="P205-CI-02"||o.length===0)return f("continuous-story-qa-manifest-invalid");const n=String((await je(process.execPath,["scripts/test-root.mjs","--gate","complete"],{cwd:e.lease.projectRoot,encoding:"utf8",maxBuffer:32*1024*1024})).stdout);if(await e.qaRunner?.({projectRoot:e.lease.projectRoot,storyId:e.lease.storyId,headSha:e.headSha}),await P(e.lease.projectRoot,["rev-parse","HEAD"])!==e.headSha)return f("continuous-story-qa-head-raced");const a=Xe(e.nowIso),c=await P(e.lease.projectRoot,["rev-list","--count",`${e.baseSha}..${e.headSha}`]),i=await z(e.lease.projectRoot,["show","--no-patch","--format=%H%n%P%n%B",e.headSha]),d=L(await z(e.lease.projectRoot,["diff","--name-only","-z",`${e.baseSha}..${e.headSha}`])),s=yt({storyId:e.lease.storyId,baseSha:e.baseSha,headSha:e.headSha,bundleDigest:e.bundle.bundleDigest,graphRevision:e.lease.graphRevision,commitBody:i,changedPaths:d}),g=G("sha256").update(r).digest("hex"),S=G("sha256").update(n).digest("hex"),v=wt({gitEvidenceDigest:s,headSha:e.headSha,graphRevision:e.lease.graphRevision,manifestDigest:g,gateIds:o,resultDigest:S}),A=`story-qa:${v}`,w=Object.freeze({schemaVersion:1,kind:"story_qa_evidence",producer:"local-yolo-tdd",evidenceVersion:"p205-execution-v2",storyId:e.lease.storyId,epicId:e.lease.epicId,baseSha:e.baseSha,headSha:e.headSha,bundleDigest:e.bundle.bundleDigest,graphRevision:e.lease.graphRevision,contract:"P205-CI-02",command:St,manifestDigest:g,gateIds:Object.freeze(o),resultDigest:S,sourceEvidenceDigest:v,verdict:"passed",checkedAt:a,receiptRef:A}),j=[`Neocortex-Story: ${e.lease.storyId}`,`Neocortex-Epic: ${e.lease.epicId}`,`Neocortex-Bundle-Digest: ${e.bundle.bundleDigest}`,`Neocortex-Graph-Revision: ${e.lease.graphRevision}`];if(c!=="1"||!j.every(b=>i.includes(b))||d.length===0||d.some(b=>!e.lease.authorizedWriteSet.some(u=>Se(u,b))))return f("continuous-story-review-evidence-rejected");const R=G("sha256").update(["root-commit-range-review-v1",e.lease.storyId,e.baseSha,e.headSha,e.bundle.bundleDigest,e.lease.graphRevision,A,G("sha256").update(i).digest("hex"),[...d].sort().join(",")].join("\0")).digest("hex"),p=`story-review:${R}`,I=Object.freeze({schemaVersion:1,kind:"story_review_evidence",producer:"root-commit-range-review",storyId:e.lease.storyId,epicId:e.lease.epicId,baseSha:e.baseSha,headSha:e.headSha,bundleDigest:e.bundle.bundleDigest,graphRevision:e.lease.graphRevision,sourceEvidenceDigest:R,qaReceiptRef:A,verdict:"approved",reviewedAt:a,receiptRef:p});return{ok:!0,value:{qaReceipt:w,reviewReceipt:I}}}catch{return f("continuous-story-evidence-production-failed")}}function Xe(e){return Number.isFinite(Date.parse(e))?new Date(Date.parse(e)).toISOString():new Date().toISOString()}function Gt(e,r,t){if(r!==void 0)try{const o=e===void 0?{}:T(JSON.parse(e.toString("utf8"))),n=T(JSON.parse(r.toString("utf8"))),a=structuredClone(o),c=h(h(o.stories)?.[t]),i=h(h(n.stories)?.[t]),d=Lt(a,"stories"),s=structuredClone(c??{});for(const g of["status","last_step","steps_completed","last_updated","blocked_reason","blocked_at","implementation_evidence","validation_evidence","qa_gate"])i&&Object.prototype.hasOwnProperty.call(i,g)&&(s[g]=structuredClone(i[g]));return d[t]=s,Buffer.from(`${JSON.stringify(a,null,2)}
-`)}catch{return Buffer.from("{invalid-child-state")}}function Lt(e,r){const t=h(e[r]);if(t)return t;const o={};return e[r]=o,o}function T(e){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("record expected");return e}function h(e){return e&&typeof e=="object"&&!Array.isArray(e)?e:void 0}function Wt(e,r,t){return Pe(t,e)||Pe(r,t)?{ok:!0,value:r}:Pe(r,e)?{ok:!0,value:t}:f("continuous-context-merge-conflict")}function qt(e,r,t){try{const o=et(_e(e),_e(r),_e(t));return o.ok?{ok:!0,value:o.value===void 0?void 0:Buffer.from(`${JSON.stringify(o.value,null,2)}
-`)}:o}catch{return f("continuous-state-merge-invalid")}}function _e(e){return e===void 0?void 0:JSON.parse(e.toString("utf8"))}function et(e,r,t){if(ge(t,e)||ge(r,t))return{ok:!0,value:r};if(ge(r,e))return{ok:!0,value:t};if(Be(e)&&Be(r)&&Be(t)){const o={};for(const n of[...new Set([...Object.keys(e),...Object.keys(r),...Object.keys(t)])].sort()){const a=et(e[n],r[n],t[n]);if(!a.ok)return a;a.value!==void 0&&(o[n]=a.value)}return{ok:!0,value:o}}if(Array.isArray(e)&&Array.isArray(r)&&Array.isArray(t)&&tt(e,r)&&tt(e,t)){const o=[...e,...r.slice(e.length),...t.slice(e.length)],n=new Set;return{ok:!0,value:o.filter(a=>{const c=JSON.stringify(a);return n.has(c)?!1:(n.add(c),!0)})}}return f("continuous-state-merge-conflict")}function Be(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function tt(e,r){return e.length<=r.length&&e.every((t,o)=>ge(t,r[o]))}function ge(e,r){return JSON.stringify(e)===JSON.stringify(r)}function Pe(e,r){return e===void 0||r===void 0?e===r:e.equals(r)}function L(e){return e.split("\0").filter(Boolean)}function ce(e){const r=se(e);return r.length>0&&r.length<=1024&&!Fe(r)&&!/^[A-Za-z]:\//.test(r)&&!r.split("/").includes("..")&&!r.includes("\0")&&!r.startsWith("/")}function se(e){return e.replaceAll("\\","/").replace(/^\.\//,"").replace(/\/{2,}/g,"/")}function Ht(e){const r=e.map(se).filter(ce);return[...new Set(r)].sort()}function Se(e,r){const t=se(e),o=se(r);return t===o||t.endsWith("/")&&o.startsWith(t)}function Jt(e){return e.length>0&&e.length<=240&&!e.startsWith("-")&&!e.startsWith("/")&&!e.endsWith("/")&&!e.endsWith(".lock")&&!e.includes("..")&&!e.includes("\\")&&!e.includes("@{")&&!e.includes("//")&&/^[A-Za-z0-9._/-]+$/.test(e)}function rt(e,r){return e.length===r.length&&e.every((t,o)=>t===r[o])}async function Ie(e,r,t,o){const n=T(JSON.parse(await B(D(e,".neocortex/state.json"),"utf8")));return $e(n,o??await V(e),r,t)}function $e(e,r,t,o){const n=re(e,r),a=h(n.epics),c=h(n.stories),i=h(a?.[t])??{},d=(Array.isArray(i.stories)?i.stories:Array.isArray(i.story_ids)?i.story_ids:[]).filter(v=>typeof v=="string"),s=d.length>0?d:Object.entries(c??{}).filter(([v,A])=>h(A)?.epic_id===t||v.startsWith(`${t}.`)).map(([v])=>v).sort(),g=["status","depends_on","files_to_modify","contracts","contract_refs","shared_surfaces","steps_completed","last_step","branch_name","physicalMergeStatus","merged","checkpoint","planning","attempts","retry_count","rollback_receipt","cancelled_at"],S=Object.fromEntries(s.map(v=>{const A=h(c?.[v])??{};return[v,Object.fromEntries(g.filter(w=>Object.prototype.hasOwnProperty.call(A,w)).map(w=>[w,A[w]]))]}));return{revision:Te({epicId:t,epic:{stories:s,status:i.status??null,branch_mode:i.branch_mode??null,execution_branch:i.execution_branch??null,graph_revision:i.graph_revision??null,depends_on:i.depends_on??null,planning:i.planning??null,execution_plan:i.execution_plan??null,waves:i.waves??null,current_wave:i.current_wave??null,replan:i.replan??null,replan_revision:i.replan_revision??null,dependency_graph:i.dependency_graph??null,scheduler:i.scheduler??null,attempts:i.attempts??null,retry_count:i.retry_count??null},stories:S}),epoch:typeof i.graph_revision=="string"?i.graph_revision:null,storyStatus:typeof h(c?.[o])?.status=="string"?String(h(c?.[o])?.status):null}}function ze(e,r,t,o){const n=re(e,r),a=h(h(n.epics)?.[t.epicId]),c=h(h(n.stories)?.[t.storyId]),i=Array.isArray(c?.steps_completed)?c.steps_completed.filter(d=>typeof d=="string"):[];return!!(a&&c&&a.branch_lease===null&&c.status==="done"&&c.last_step===we&&i.includes(Ve)&&i.includes(we)&&de(c.checkpoint)===de(o))}function Mt(e,r){for(const t of Object.keys(e))delete e[t];Object.assign(e,structuredClone(r))}async function Kt(e,r){return(await Ie(e,r,"")).revision}function Te(e){return G("sha256").update(de(e)).digest("hex")}function de(e){return e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(de).join(",")}]`:`{${Object.entries(e).sort(([r],[t])=>r.localeCompare(t)).map(([r,t])=>`${JSON.stringify(r)}:${de(t)}`).join(",")}}`}function Ft(e,r){const t=(e??[]).filter(o=>/^[A-Za-z0-9._/:@#-]{1,200}$/.test(o)&&!o.includes(".."));return Object.freeze([...new Set(t.length>0?t:[`dispatch:${r}`])].sort())}function Vt(e){return e.replace(/[^A-Za-z0-9._-]/g,"-").slice(0,80)}function f(e){return{ok:!1,reasonCode:e}}function q(e,r){return e instanceof Error&&"code"in e&&e.code===r}async function ue(e,r){try{await W(e,r);const t=D(e,"owner.json");await F(t,e);const o=JSON.parse(await B(t,"utf8"));if(!Number.isSafeInteger(o.pid)||Number(o.pid)<=0||typeof o.createdAt!="string"||!Number.isFinite(Date.parse(o.createdAt))||typeof o.nonce!="string"||!/^[a-f0-9]{32}$/.test(o.nonce))throw new Error("continuous-sandbox-lease-owner-invalid");return{pid:Number(o.pid),createdAt:o.createdAt,nonce:o.nonce}}catch(t){if(q(t,"ENOENT"))return;throw t}}function ot(e,r){return e?.pid===r.pid&&e.createdAt===r.createdAt&&e.nonce===r.nonce}function Qt(e){try{return process.kill(e,0),!0}catch(r){return q(r,"EPERM")}}async function Ge(e,r){try{await W(e,r);const t=D(e,".git");await W(t,e);const o=D(t,"neocortex-sandbox.json");await F(o,t);const n=JSON.parse(await B(o,"utf8"));if(n.schemaVersion!==1||typeof n.workspaceOwnerNonce!="string"||!/^[a-f0-9]{32}$/.test(n.workspaceOwnerNonce)||!/^[a-f0-9]{64}$/.test(n.graphAuthorityRevision)||!(n.graphAuthorityEpoch===null||/^[a-f0-9]{64}$/.test(n.graphAuthorityEpoch))||!(n.graphAuthorityStoryStatus===null||typeof n.graphAuthorityStoryStatus=="string"&&n.graphAuthorityStoryStatus.length<=80)||typeof n.workspaceIdentity?.dev!="string"||!/^[0-9]+$/.test(n.workspaceIdentity.dev)||typeof n.workspaceIdentity?.ino!="string"||!/^[0-9]+$/.test(n.workspaceIdentity.ino))throw new Error("continuous-sandbox-metadata-invalid");return n}catch(t){if(q(t,"ENOENT"))return;throw t}}async function Zt(e,r,t,o){await W(e,r);const n=D(e,".git");await W(n,e);const a=D(n,"neocortex-sandbox.json");await te(e,".git/neocortex-sandbox.json",Buffer.from(`${JSON.stringify(t,null,2)}
-`),o),await F(a,n)}async function Ut(e,r){try{await F(e,r);const t=JSON.parse(await B(e,"utf8"));return typeof t.childHeadSha=="string"&&typeof t.rootHeadSha=="string"&&/^[a-f0-9]{40,64}$/.test(t.childHeadSha)&&/^[a-f0-9]{40,64}$/.test(t.rootHeadSha)&&t.bundle?.schemaVersion===1&&t.checkpoint?.schemaVersion===1?t:void 0}catch(t){if(q(t,"ENOENT"))return;throw t}}async function Yt(e,r){try{const t=T(JSON.parse(await B(D(e.projectRoot,".neocortex/state.json"),"utf8"))),o=re(t,await V(e.projectRoot)),n=h(h(o.stories)?.[e.storyId]),a=h(n?.checkpoint);return a?.idempotencyKey===r.idempotencyKey&&a.headSha===r.headSha&&a.bundleDigest===r.bundleDigest&&h(h(o.epics)?.[e.epicId])?.branch_lease===null&&await ke(e.projectRoot,a,e.storyId,e.epicId,e.executionBranch,void 0,e.authorizedWriteSet)}catch{return!1}}async function Xt(e,r,t){try{const o=T(JSON.parse(await B(D(e.projectRoot,".neocortex/state.json"),"utf8"))),n=re(o,await V(e.projectRoot)),a=h(h(n.stories)?.[e.storyId]),c=h(a?.checkpoint);return c?.schemaVersion!==1||c.storyId!==e.storyId||c.epicId!==e.epicId||c.branch!==e.executionBranch||c.baseSha!==t.baseSha||c.headSha!==t.headSha||c.idempotencyKey!==e.dispatchId||c.dispatchId!==e.dispatchId||c.bundleId!==r.bundleId||c.bundleDigest!==r.bundleDigest||c.graphRevision!==e.graphRevision||c.claimRevision!==e.claimRevision||h(h(n.epics)?.[e.epicId])?.branch_lease!==null||!await ke(e.projectRoot,c,e.storyId,e.epicId,e.executionBranch,void 0,e.authorizedWriteSet)?void 0:c}catch{return}}async function er(e,r){const t=(await ee(e.projectRoot,["log","--format=%H","--fixed-strings",`--grep=Neocortex-Dispatch: ${e.dispatchId}`]))?.split(`
-`).filter(S=>/^[a-f0-9]{40,64}$/.test(S))??[];if(t.length!==1)return;const o=t[0];if(!await ae(e.projectRoot,["merge-base","--is-ancestor",o,"HEAD"]))return;const n=await P(e.projectRoot,["show","-s","--format=%B",o]),a=new Set(n.split(`
-`).map(S=>S.trim()));for(const S of[`Neocortex-Story: ${e.storyId}`,`Neocortex-Epic: ${e.epicId}`,`Neocortex-Execution-Branch: ${e.executionBranch}`,`Neocortex-Prepared-Base: ${e.baseSha}`,`Neocortex-Dispatch: ${e.dispatchId}`,`Neocortex-Bundle: ${r.bundleId}`,`Neocortex-Bundle-Digest: ${r.bundleDigest}`,`Neocortex-Graph-Revision: ${e.graphRevision}`,`Neocortex-Claim-Revision: ${e.claimRevision}`])if(!a.has(S))return;const c=Le(n,"Neocortex-Checkpoint-Authority"),i=Le(n,"Neocortex-Checkpoint-Epoch"),d=Le(n,"Neocortex-Checkpoint-Story-Status");if(!c||!/^[a-f0-9]{64}$/.test(c)||!i||!(i==="null"||/^[a-f0-9]{64}$/.test(i))||!d||d.length>80)return;const s=await ee(e.projectRoot,["rev-parse",`${o}^`]);if(!s||!/^[a-f0-9]{40,64}$/.test(s))return;const g=L(await z(e.projectRoot,["diff-tree","--no-commit-id","--name-only","-r","-z",o]));if(!(g.length===0||g.some(S=>!r.authorizedWriteSet.some(v=>Se(v,S)))))return{baseSha:s,headSha:o,checkpointAuthority:{revision:c,epoch:i==="null"?null:i,storyStatus:d==="null"?null:d}}}function Le(e,r){const t=`${r}: `,o=e.split(`
-`).map(n=>n.trim()).filter(n=>n.startsWith(t));return o.length===1?o[0].slice(t.length):void 0}async function We(e,r,t,o,n,a){const c=C(e);await W(c,C(c));try{await F(e,c)}catch(i){if(!q(i,"ENOENT"))throw i}await te(c,$(e),Buffer.from(`${JSON.stringify({childHeadSha:r,rootHeadSha:t,bundle:o,checkpoint:n})}
-`),a),await F(e,c)}export{ur as createAnchoredContinuousStoryCommandRunner,hr as createBranchlessContinuousStoryWorkspaceManager};
+`;
+/**
+ * Create the only command runner authorized for a continuous child. The helper
+ * owns and revalidates the sandbox cwd before launching the runtime, so the
+ * mutable public pathname is never reused as the runtime's cwd.
+ */
+export function createAnchoredContinuousStoryCommandRunner(lease, hooks = {}) {
+    return async (command, args, options = {}) => runAnchoredChildCommand(lease, command, args, options, hooks);
+}
+/** Default continuous-DAG workspace policy. It never creates a Git worktree. */
+export function createBranchlessContinuousStoryWorkspaceManager(options = {}) {
+    let preparationTail = Promise.resolve();
+    return {
+        async prepare(input) {
+            if ((options.platform ?? process.platform) === 'win32') {
+                return failure('continuous-sandbox-platform-unsupported');
+            }
+            if (!/^[a-f0-9]{64}$/.test(input.dispatchId))
+                return failure('continuous-sandbox-dispatch-invalid');
+            if (!safeRelativePath(input.targetRef))
+                return failure('continuous-sandbox-target-invalid');
+            if (!safeBranch(input.executionBranch))
+                return failure('continuous-execution-branch-invalid');
+            if (!/^[a-f0-9]{64}$/.test(input.graphRevision))
+                return failure('continuous-graph-revision-invalid');
+            const authorizedWriteSet = normalizeWriteSet(input.authorizedWriteSet);
+            if (authorizedWriteSet.length === 0 || authorizedWriteSet.length !== input.authorizedWriteSet.length) {
+                return failure('continuous-authorized-write-set-invalid');
+            }
+            const claimRevision = hashCanonical(authorizedWriteSet);
+            const previousPreparation = preparationTail;
+            let unlockPreparation = () => undefined;
+            preparationTail = new Promise((resolvePreparation) => { unlockPreparation = resolvePreparation; });
+            await previousPreparation;
+            let acquiredLeasePath;
+            let acquiredLeaseOwner;
+            try {
+                const projectRoot = await canonicalRoot(input.projectRoot);
+                const baseSha = await git(projectRoot, ['rev-parse', 'HEAD']);
+                const graphAuthority = await readCurrentGraphAuthoritySnapshot(projectRoot, input.epicId, input.storyId);
+                const graphAuthorityRevision = graphAuthority.revision;
+                const runtimeDirectory = await gitLifecycleRuntimeDirectory(projectRoot);
+                const leasesRoot = await ensureGitLifecyclePrivateChildDirectory(runtimeDirectory, 'leases');
+                const leasePath = join(leasesRoot, input.dispatchId);
+                try {
+                    await anchoredCreateDirectory(leasesRoot, input.dispatchId);
+                    await assertGitLifecyclePrivateDirectory(leasePath, leasesRoot);
+                }
+                catch (error) {
+                    if (!isNodeError(error, 'EEXIST'))
+                        throw error;
+                    await assertGitLifecyclePrivateDirectory(leasePath, leasesRoot);
+                    const owner = await readLeaseOwner(leasePath, leasesRoot);
+                    if (owner !== undefined && processExists(owner.pid))
+                        return failure('continuous-sandbox-lease-active');
+                    if (!owner || !(await removeGitLifecyclePrivateDirectory(leasePath, leasesRoot, async (renamed) => sameLeaseOwner(await readLeaseOwner(renamed, leasesRoot), owner))))
+                        return failure('continuous-sandbox-lease-owner-replaced');
+                    await anchoredCreateDirectory(leasesRoot, input.dispatchId);
+                    await assertGitLifecyclePrivateDirectory(leasePath, leasesRoot);
+                }
+                acquiredLeasePath = leasePath;
+                acquiredLeaseOwner = Object.freeze({
+                    pid: process.pid,
+                    createdAt: new Date().toISOString(),
+                    nonce: randomBytes(16).toString('hex'),
+                });
+                await writeOptional(leasePath, 'owner.json', Buffer.from(JSON.stringify(acquiredLeaseOwner)), options.beforeSandboxWriteCommit);
+                await assertGitLifecyclePrivateFile(join(leasePath, 'owner.json'), leasePath);
+                const sandboxesRoot = await ensureGitLifecyclePrivateChildDirectory(runtimeDirectory, 'sandboxes');
+                const workspacePath = join(sandboxesRoot, input.dispatchId.slice(0, 20));
+                const recovered = await readSandboxMetadata(workspacePath, sandboxesRoot);
+                let contextSnapshots;
+                let workspaceIdentity;
+                const preparedAt = recovered?.preparedAt ?? new Date().toISOString();
+                const workspaceOwnerNonce = recovered?.workspaceOwnerNonce ?? randomBytes(16).toString('hex');
+                if (recovered) {
+                    if (recovered.projectRoot !== projectRoot || recovered.storyId !== input.storyId
+                        || recovered.targetRef !== input.targetRef || recovered.dispatchId !== input.dispatchId
+                        || recovered.epicId !== input.epicId || recovered.executionBranch !== input.executionBranch
+                        || recovered.graphRevision !== input.graphRevision || recovered.claimRevision !== claimRevision
+                        || recovered.graphAuthorityRevision !== graphAuthorityRevision
+                        || recovered.graphAuthorityEpoch !== graphAuthority.epoch
+                        || recovered.graphAuthorityStoryStatus !== graphAuthority.storyStatus
+                        || !sameStrings(recovered.authorizedWriteSet, authorizedWriteSet))
+                        return failure('continuous-sandbox-recovery-mismatch');
+                    contextSnapshots = recovered.contextSnapshots.map((snapshot) => ({
+                        path: snapshot.path,
+                        ...(snapshot.contentBase64 !== undefined ? { content: Buffer.from(snapshot.contentBase64, 'base64') } : {}),
+                    }));
+                    workspaceIdentity = await anchoredDirectoryIdentity(workspacePath);
+                    if (workspaceIdentity.dev !== recovered.workspaceIdentity.dev
+                        || workspaceIdentity.ino !== recovered.workspaceIdentity.ino) {
+                        return failure('continuous-sandbox-recovery-mismatch');
+                    }
+                }
+                else {
+                    await removeGitLifecyclePrivateDirectory(workspacePath, sandboxesRoot);
+                    workspaceIdentity = await anchoredCreateDirectory(sandboxesRoot, basename(workspacePath));
+                    await assertGitLifecyclePrivateDirectory(workspacePath, sandboxesRoot);
+                    await sandboxGitAt(sandboxesRoot, basename(workspacePath), workspaceIdentity, ['init', '--quiet']);
+                    await initializeBranchlessRuntimeProjection(projectRoot, workspacePath);
+                    await copyGitIdentity(projectRoot, sandboxesRoot, basename(workspacePath), workspaceIdentity);
+                    await sandboxGitAt(sandboxesRoot, basename(workspacePath), workspaceIdentity, ['remote', 'add', 'neocortex-root', projectRoot]);
+                    await sandboxGitAt(sandboxesRoot, basename(workspacePath), workspaceIdentity, ['fetch', '--quiet', '--no-tags', 'neocortex-root', baseSha]);
+                    await sandboxGitAt(sandboxesRoot, basename(workspacePath), workspaceIdentity, ['checkout', '--quiet', '--detach', 'FETCH_HEAD']);
+                    contextSnapshots = await copyCurrentContext(projectRoot, workspacePath, input.epicId, input.targetRef, options.beforeSandboxWriteCommit);
+                    await writeSandboxMetadata(workspacePath, sandboxesRoot, {
+                        schemaVersion: 1,
+                        projectRoot,
+                        storyId: input.storyId,
+                        targetRef: input.targetRef,
+                        epicId: input.epicId,
+                        executionBranch: input.executionBranch,
+                        graphRevision: input.graphRevision,
+                        graphAuthorityRevision,
+                        graphAuthorityEpoch: graphAuthority.epoch,
+                        graphAuthorityStoryStatus: graphAuthority.storyStatus,
+                        authorizedWriteSet,
+                        claimRevision,
+                        dispatchId: input.dispatchId,
+                        baseSha,
+                        preparedAt,
+                        workspaceOwnerNonce,
+                        workspaceIdentity,
+                        contextSnapshots: contextSnapshots.map((snapshot) => ({
+                            path: snapshot.path,
+                            ...(snapshot.content !== undefined ? { contentBase64: snapshot.content.toString('base64') } : {}),
+                        })),
+                    }, options.beforeSandboxWriteCommit);
+                }
+                acquiredLeasePath = undefined;
+                return {
+                    ok: true,
+                    value: {
+                        projectRoot,
+                        workspacePath,
+                        workspaceStrategy: 'branchless_sandbox',
+                        storyId: input.storyId,
+                        targetRef: input.targetRef,
+                        epicId: input.epicId,
+                        executionBranch: input.executionBranch,
+                        graphRevision: input.graphRevision,
+                        graphAuthorityRevision,
+                        graphAuthorityEpoch: graphAuthority.epoch,
+                        graphAuthorityStoryStatus: graphAuthority.storyStatus,
+                        authorizedWriteSet,
+                        claimRevision,
+                        baseSha: recovered?.baseSha ?? baseSha,
+                        dispatchId: input.dispatchId,
+                        preparedAt,
+                        leasePath,
+                        leaseOwnerNonce: acquiredLeaseOwner.nonce,
+                        workspaceOwnerNonce,
+                        workspaceIdentity,
+                        contextSnapshots,
+                    },
+                };
+            }
+            catch {
+                if (acquiredLeasePath && acquiredLeaseOwner) {
+                    const cleanupLeasePath = acquiredLeasePath;
+                    const cleanupLeaseOwner = acquiredLeaseOwner;
+                    await removeGitLifecyclePrivateDirectory(cleanupLeasePath, dirname(cleanupLeasePath), async (renamed) => sameLeaseOwner(await readLeaseOwner(renamed, dirname(cleanupLeasePath)), cleanupLeaseOwner)).catch(() => undefined);
+                }
+                return failure('continuous-sandbox-prepare-failed');
+            }
+            finally {
+                unlockPreparation();
+            }
+        },
+        async integrate(lease, authority) {
+            const leaseOwner = await readLeaseOwner(lease.leasePath, dirname(lease.leasePath)).catch(() => undefined);
+            const sandboxOwner = await readSandboxMetadata(lease.workspacePath, dirname(lease.workspacePath)).catch(() => undefined);
+            if (!leaseOwner || leaseOwner.nonce !== lease.leaseOwnerNonce
+                || sandboxOwner?.workspaceOwnerNonce !== lease.workspaceOwnerNonce
+                || sandboxOwner.dispatchId !== lease.dispatchId || sandboxOwner.storyId !== lease.storyId) {
+                return failure('continuous-sandbox-owner-mismatch');
+            }
+            const lockStartedAt = normalizeEvidenceTime(authority?.nowIso ?? new Date().toISOString());
+            const physicalLock = await acquireGitLifecyclePhysicalIntegrationLock(lease.projectRoot, {
+                kind: 'continuous', storyId: lease.storyId, sessionId: lease.dispatchId,
+                idempotencyKey: lease.dispatchId,
+                expiresAt: new Date(Date.parse(lockStartedAt) + 30 * 60 * 1000).toISOString(),
+                persistent: false, createdAt: lockStartedAt,
+            });
+            if (!physicalLock.ok)
+                return failure(physicalLock.reasonCode === 'git-lifecycle-integration-backpressure'
+                    ? 'continuous-integration-backpressure' : 'continuous-integration-lease-failed');
+            let rootSnapshots = [];
+            let rootCommitCreated = false;
+            let rootEffectsStarted = false;
+            try {
+                // Preserve the leading porcelain status column: `sandboxGit` trims it
+                // and would misclassify an ordinary unstaged modification as staged.
+                const sandboxStatus = (await sandboxGitRaw(lease, ['status', '--porcelain'])).trimEnd();
+                const childHeadSha = await sandboxGit(lease, ['rev-parse', 'HEAD']);
+                const currentBranch = await gitOptional(lease.projectRoot, ['symbolic-ref', '--quiet', '--short', 'HEAD']);
+                if (currentBranch !== lease.executionBranch)
+                    return failure('continuous-execution-branch-mismatch');
+                const runtimeDirectory = dirname(dirname(lease.leasePath));
+                const integratedRoot = await ensureGitLifecyclePrivateChildDirectory(runtimeDirectory, 'integrated');
+                const markerPath = join(integratedRoot, lease.dispatchId);
+                const marker = await readMarker(markerPath, integratedRoot);
+                if (marker?.childHeadSha === childHeadSha
+                    && marker.bundle.storyId === lease.storyId
+                    && marker.bundle.epicId === lease.epicId
+                    && marker.bundle.executionBranch === lease.executionBranch
+                    && marker.bundle.graphRevision === lease.graphRevision
+                    && marker.bundle.claimRevision === lease.claimRevision
+                    && sameStrings(marker.bundle.authorizedWriteSet, lease.authorizedWriteSet)
+                    && marker.checkpoint.idempotencyKey === lease.dispatchId
+                    && marker.checkpoint.bundleId === marker.bundle.bundleId
+                    && marker.checkpoint.bundleDigest === marker.bundle.bundleDigest
+                    && marker.checkpoint.graphRevision === lease.graphRevision
+                    && marker.checkpoint.claimRevision === lease.claimRevision
+                    && await gitExitOk(lease.projectRoot, ['merge-base', '--is-ancestor', marker.rootHeadSha, 'HEAD'])
+                    && await checkpointExistsInRootState(lease, marker.checkpoint)) {
+                    return {
+                        ok: true,
+                        value: {
+                            headSha: marker.rootHeadSha,
+                            alreadyIntegrated: true,
+                            bundle: marker.bundle,
+                            checkpoint: marker.checkpoint,
+                        },
+                    };
+                }
+                // The delegated child owns only filesystem writes. Any staged path or
+                // commit is an attempted authority escalation; the root writer alone
+                // stages, integrates and creates the single logical story commit.
+                if (childHeadSha !== lease.baseSha) {
+                    return failure('continuous-sandbox-child-git-authority-denied');
+                }
+                if (sandboxStatus.length === 0)
+                    return failure('continuous-bundle-empty');
+                const childStaged = sandboxStatus.split('\n')
+                    .some((line) => line.length > 0 && line[0] !== ' ' && line[0] !== '?');
+                if (!childStaged)
+                    await sandboxGit(lease, ['add', '-A']);
+                const changedPaths = splitNull(await sandboxGitRaw(lease, ['diff', '--cached', '--name-only', '-z', lease.baseSha]));
+                if (changedPaths.length === 0 || changedPaths.some((path) => !safeRelativePath(path))) {
+                    return failure('continuous-integration-write-set-invalid');
+                }
+                if (!(await sandboxGitExitOk(lease, ['merge-base', '--is-ancestor', lease.baseSha, childHeadSha]))) {
+                    return failure('continuous-bundle-base-not-ancestor');
+                }
+                if (!(await gitExitOk(lease.projectRoot, ['merge-base', '--is-ancestor', lease.baseSha, 'HEAD']))) {
+                    return failure('continuous-root-base-not-ancestor');
+                }
+                const nowIso = authority?.nowIso ?? new Date().toISOString();
+                const receiptRefs = normalizeReceiptRefs(authority?.receiptRefs, lease.dispatchId);
+                const payload = await sandboxGitRaw(lease, ['diff', '--cached', '--binary', lease.baseSha]);
+                const bundleBody = {
+                    schemaVersion: 1,
+                    storyId: lease.storyId,
+                    epicId: lease.epicId,
+                    executionBranch: lease.executionBranch,
+                    baseSha: lease.baseSha,
+                    bundleDigest: createHash('sha256').update(payload).digest('hex'),
+                    graphRevision: lease.graphRevision,
+                    claimRevision: lease.claimRevision,
+                    authorizedWriteSet: lease.authorizedWriteSet,
+                    contextDigests: Object.fromEntries(lease.contextSnapshots.map((snapshot) => [
+                        snapshot.path,
+                        createHash('sha256').update(snapshot.content ?? Buffer.alloc(0)).digest('hex'),
+                    ])),
+                    validationRefs: receiptRefs,
+                    createdAt: lease.preparedAt,
+                    expiresAt: new Date(Date.parse(lease.preparedAt) + 24 * 60 * 60 * 1000).toISOString(),
+                    branchless: true,
+                };
+                const bundle = Object.freeze({
+                    ...bundleBody,
+                    bundleId: hashCanonical(bundleBody),
+                });
+                const recoveredCommit = await findIntegratedDispatchCommit(lease, bundle);
+                if (recoveredCommit) {
+                    const existingCheckpoint = await readMatchingRootCheckpoint(lease, bundle, recoveredCommit);
+                    if (existingCheckpoint) {
+                        await writeMarker(markerPath, childHeadSha, recoveredCommit.headSha, bundle, existingCheckpoint, options.beforeSandboxWriteCommit);
+                        return {
+                            ok: true,
+                            value: { headSha: recoveredCommit.headSha, alreadyIntegrated: true, bundle, checkpoint: existingCheckpoint },
+                        };
+                    }
+                }
+                if (!recoveredCommit
+                    && await readCurrentGraphAuthorityRevision(lease.projectRoot, lease.epicId) !== lease.graphAuthorityRevision) {
+                    return failure('continuous-graph-revision-stale');
+                }
+                if (recoveredCommit) {
+                    const evidence = await produceIndependentCheckpointEvidence({
+                        lease, bundle, baseSha: recoveredCommit.baseSha, headSha: recoveredCommit.headSha,
+                        receiptRefs, nowIso, qaRunner: options.storyQaRunner,
+                    });
+                    if (!evidence.ok)
+                        return evidence;
+                    await options.beforeCheckpointPersist?.({
+                        projectRoot: lease.projectRoot, storyId: lease.storyId, headSha: recoveredCommit.headSha,
+                    });
+                    const checkpoint = await persistRootCheckpoint({
+                        lease,
+                        physicalLock,
+                        checkpointAuthority: recoveredCommit.checkpointAuthority,
+                        bundle,
+                        baseSha: recoveredCommit.baseSha,
+                        headSha: recoveredCommit.headSha,
+                        receiptRefs: [...receiptRefs, `bundle:${bundle.bundleId}`, evidence.value.qaReceipt.receiptRef, evidence.value.reviewReceipt.receiptRef],
+                        qaReceipt: evidence.value.qaReceipt,
+                        reviewReceipt: evidence.value.reviewReceipt,
+                        recordedAt: nowIso,
+                        checkpointNow: options.checkpointNow,
+                        insideCheckpointPreCommit: options.insideCheckpointPreCommit,
+                        afterCheckpointPersist: options.afterCheckpointPersist,
+                    });
+                    if (!checkpoint.ok)
+                        return checkpoint;
+                    await writeMarker(markerPath, childHeadSha, recoveredCommit.headSha, bundle, checkpoint.value, options.beforeSandboxWriteCommit);
+                    return { ok: true, value: { headSha: recoveredCommit.headSha, alreadyIntegrated: true, bundle, checkpoint: checkpoint.value } };
+                }
+                // A staged index is accepted only as replay input when immutable root
+                // evidence above proves that this exact bundle was already integrated.
+                // It can never authorize a fresh root effect.
+                if (childStaged)
+                    return failure('continuous-sandbox-child-git-authority-denied');
+                const stagedPaths = splitNull(await gitRaw(lease.projectRoot, ['diff', '--cached', '--name-only', '-z']));
+                if (stagedPaths.length > 0)
+                    return failure('continuous-integration-root-index-dirty');
+                const managedPaths = new Set(lease.contextSnapshots.map((snapshot) => snapshot.path));
+                const unauthorized = changedPaths.filter((path) => !lease.authorizedWriteSet.some((authorized) => writeSetCovers(authorized, path)));
+                if (unauthorized.length > 0)
+                    return failure('continuous-bundle-write-set-unauthorized');
+                const patchPaths = changedPaths.filter((path) => !managedPaths.has(path));
+                const interveningPaths = new Set(splitNull(await gitRaw(lease.projectRoot, ['diff', '--name-only', '-z', `${lease.baseSha}..HEAD`])));
+                if (patchPaths.some((path) => interveningPaths.has(path)))
+                    return failure('continuous-bundle-intervening-conflict');
+                const dirtyPaths = new Set([
+                    ...splitNull(await gitRaw(lease.projectRoot, ['diff', '--name-only', '-z'])),
+                    ...splitNull(await gitRaw(lease.projectRoot, ['ls-files', '--others', '--exclude-standard', '-z'])),
+                ]);
+                if (patchPaths.some((path) => dirtyPaths.has(path)))
+                    return failure('continuous-integration-root-conflict');
+                rootSnapshots = await snapshotPaths(lease.projectRoot, [...new Set([...changedPaths, '.neocortex/state.json'])]);
+                const writer = await acquireRootWriterLease(lease, nowIso);
+                if (!writer.ok)
+                    return writer;
+                const admissionErrors = admitPreparedStoryBundle({
+                    bundle,
+                    payload: Buffer.from(payload),
+                    expected: {
+                        epicId: lease.epicId,
+                        storyId: lease.storyId,
+                        executionBranch: lease.executionBranch,
+                        baseSha: lease.baseSha,
+                        graphRevision: lease.graphRevision,
+                        claimRevision: lease.claimRevision,
+                        authorizedWriteSet: lease.authorizedWriteSet,
+                        nowIso,
+                    },
+                    writerLease: writer.value,
+                });
+                if (admissionErrors.length > 0) {
+                    await restoreIntegration(lease.projectRoot, rootSnapshots);
+                    return failure(`continuous-bundle-admission-${admissionErrors[0]}`);
+                }
+                const rootBaseSha = await git(lease.projectRoot, ['rev-parse', 'HEAD']);
+                let checkpointAuthority;
+                await options.beforeRootCommit?.({
+                    projectRoot: lease.projectRoot,
+                    storyId: lease.storyId,
+                    headSha: rootBaseSha,
+                });
+                try {
+                    await mutateGitLifecycleRuntime(lease.projectRoot, (document) => {
+                        const currentWriter = asRecordOrUndefined(ensureRuntimeEpic(document, lease.epicId).branch_lease);
+                        if (currentWriter?.ownerStoryId !== lease.storyId
+                            || currentWriter.sessionId !== lease.dispatchId
+                            || currentWriter.idempotencyKey !== lease.dispatchId
+                            || Date.parse(String(currentWriter.expiresAt)) <= Date.now()) {
+                            throw new Error('continuous-checkpoint-writer-lease-lost');
+                        }
+                    }, { preCommit: async (document) => {
+                            const currentAuthority = await readCurrentGraphAuthoritySnapshot(lease.projectRoot, lease.epicId, lease.storyId, document);
+                            if (currentAuthority.revision !== lease.graphAuthorityRevision
+                                || currentAuthority.epoch !== lease.graphAuthorityEpoch
+                                || currentAuthority.storyStatus !== lease.graphAuthorityStoryStatus) {
+                                throw new Error('continuous-graph-revision-stale');
+                            }
+                            if (!(await verifyGitLifecyclePhysicalIntegrationLock(physicalLock.path, physicalLock.owner))) {
+                                throw new Error('continuous-integration-lock-raced');
+                            }
+                            const guardedBranch = await gitOptional(lease.projectRoot, ['symbolic-ref', '--quiet', '--short', 'HEAD']);
+                            const guardedHead = await git(lease.projectRoot, ['rev-parse', 'HEAD']);
+                            if (guardedBranch !== lease.executionBranch || guardedHead !== rootBaseSha) {
+                                throw new Error('continuous-integration-head-raced');
+                            }
+                            const guardedStaged = splitNull(await gitRaw(lease.projectRoot, ['diff', '--cached', '--name-only', '-z']));
+                            const guardedDirty = new Set([
+                                ...splitNull(await gitRaw(lease.projectRoot, ['diff', '--name-only', '-z'])),
+                                ...splitNull(await gitRaw(lease.projectRoot, ['ls-files', '--others', '--exclude-standard', '-z'])),
+                            ]);
+                            if (guardedStaged.length > 0)
+                                throw new Error('continuous-integration-root-index-dirty');
+                            if (patchPaths.some((path) => guardedDirty.has(path)))
+                                throw new Error('continuous-integration-root-conflict');
+                            rootEffectsStarted = true;
+                            if (patchPaths.length > 0) {
+                                const patch = await sandboxGitRaw(lease, ['diff', '--cached', '--binary', lease.baseSha, '--', ...patchPaths]);
+                                if (patch.length > 0 && !(await gitWithInput(lease.projectRoot, ['apply', '--index', '--3way', '--whitespace=nowarn'], patch)))
+                                    throw new Error('continuous-integration-conflict');
+                            }
+                            for (const snapshot of lease.contextSnapshots) {
+                                if (!changedPaths.includes(snapshot.path))
+                                    continue;
+                                const current = await readOptional(join(lease.projectRoot, snapshot.path));
+                                const child = await sandboxGitIndexBlob(lease, snapshot.path);
+                                const merged = snapshot.path === '.neocortex/state.json'
+                                    ? mergeJsonBuffers(snapshot.content, current, filterChildGitState(snapshot.content, child, lease.storyId))
+                                    : mergeBuffers(snapshot.content, current, child);
+                                if (!merged.ok)
+                                    throw new Error(snapshot.path === '.neocortex/state.json'
+                                        ? 'continuous-state-merge-conflict'
+                                        : 'continuous-context-merge-conflict');
+                                await writeOptional(lease.projectRoot, snapshot.path, merged.value);
+                                await git(lease.projectRoot, ['add', '-A', '--', snapshot.path]);
+                            }
+                            if (changedPaths.includes('.neocortex/state.json')) {
+                                await git(lease.projectRoot, ['add', '-A', '--', '.neocortex/state.json']);
+                            }
+                            if (await gitExitOk(lease.projectRoot, ['diff', '--cached', '--quiet'])) {
+                                throw new Error('continuous-integration-empty-after-admission');
+                            }
+                            checkpointAuthority = await readCurrentGraphAuthoritySnapshot(lease.projectRoot, lease.epicId, lease.storyId, document);
+                            await git(lease.projectRoot, [
+                                'commit', '-m', `feat(yoloop): integrate ${lease.storyId}`,
+                                '-m', `Neocortex-Story: ${lease.storyId}`,
+                                '-m', `Neocortex-Epic: ${lease.epicId}`,
+                                '-m', `Neocortex-Execution-Branch: ${lease.executionBranch}`,
+                                '-m', `Neocortex-Prepared-Base: ${lease.baseSha}`,
+                                '-m', `Neocortex-Dispatch: ${lease.dispatchId}`,
+                                '-m', `Neocortex-Bundle: ${bundle.bundleId}`,
+                                '-m', `Neocortex-Bundle-Digest: ${bundle.bundleDigest}`,
+                                '-m', `Neocortex-Graph-Revision: ${lease.graphRevision}`,
+                                '-m', `Neocortex-Claim-Revision: ${lease.claimRevision}`,
+                                '-m', `Neocortex-Checkpoint-Authority: ${checkpointAuthority.revision}`,
+                                '-m', `Neocortex-Checkpoint-Epoch: ${checkpointAuthority.epoch ?? 'null'}`,
+                                '-m', `Neocortex-Checkpoint-Story-Status: ${checkpointAuthority.storyStatus ?? 'null'}`,
+                            ]);
+                            rootCommitCreated = true;
+                        } });
+                }
+                catch (error) {
+                    if (rootEffectsStarted && !rootCommitCreated)
+                        await restoreIntegration(lease.projectRoot, rootSnapshots);
+                    const reasonCode = error instanceof Error && /^continuous-/.test(error.message)
+                        ? error.message
+                        : 'continuous-integration-failed';
+                    return failure(reasonCode);
+                }
+                const rootHeadSha = await git(lease.projectRoot, ['rev-parse', 'HEAD']);
+                if (!checkpointAuthority)
+                    return failure('continuous-checkpoint-authority-missing');
+                await options.afterRootCommit?.({
+                    projectRoot: lease.projectRoot, storyId: lease.storyId, headSha: rootHeadSha,
+                });
+                const evidence = await produceIndependentCheckpointEvidence({
+                    lease, bundle, baseSha: rootBaseSha, headSha: rootHeadSha,
+                    receiptRefs, nowIso, qaRunner: options.storyQaRunner,
+                });
+                if (!evidence.ok)
+                    return evidence;
+                await options.beforeCheckpointPersist?.({
+                    projectRoot: lease.projectRoot, storyId: lease.storyId, headSha: rootHeadSha,
+                });
+                const checkpoint = await persistRootCheckpoint({
+                    lease,
+                    physicalLock,
+                    checkpointAuthority,
+                    bundle,
+                    baseSha: rootBaseSha,
+                    headSha: rootHeadSha,
+                    receiptRefs: [...receiptRefs, `bundle:${bundle.bundleId}`, evidence.value.qaReceipt.receiptRef, evidence.value.reviewReceipt.receiptRef],
+                    qaReceipt: evidence.value.qaReceipt,
+                    reviewReceipt: evidence.value.reviewReceipt,
+                    recordedAt: nowIso,
+                    checkpointNow: options.checkpointNow,
+                    insideCheckpointPreCommit: options.insideCheckpointPreCommit,
+                    afterCheckpointPersist: options.afterCheckpointPersist,
+                });
+                if (!checkpoint.ok)
+                    return checkpoint;
+                await writeMarker(markerPath, childHeadSha, rootHeadSha, bundle, checkpoint.value, options.beforeSandboxWriteCommit);
+                return { ok: true, value: { headSha: rootHeadSha, alreadyIntegrated: false, bundle, checkpoint: checkpoint.value } };
+            }
+            catch {
+                if (rootEffectsStarted && !rootCommitCreated && rootSnapshots.length > 0) {
+                    await restoreIntegration(lease.projectRoot, rootSnapshots);
+                }
+                return failure('continuous-integration-failed');
+            }
+            finally {
+                await releaseRootWriterLease(lease).catch(() => undefined);
+                await releaseGitLifecyclePhysicalIntegrationLock(physicalLock.path, physicalLock.owner).catch(() => undefined);
+            }
+        },
+        async release(lease, preserveForRecovery) {
+            if (!preserveForRecovery) {
+                await removeGitLifecyclePrivateDirectory(lease.workspacePath, dirname(lease.workspacePath), async (renamed) => {
+                    const metadata = await readSandboxMetadata(renamed, dirname(lease.workspacePath)).catch(() => undefined);
+                    return metadata?.workspaceOwnerNonce === lease.workspaceOwnerNonce
+                        && metadata.dispatchId === lease.dispatchId && metadata.storyId === lease.storyId;
+                });
+            }
+            await removeGitLifecyclePrivateDirectory(lease.leasePath, dirname(lease.leasePath), async (renamed) => {
+                const owner = await readLeaseOwner(renamed, dirname(lease.leasePath)).catch(() => undefined);
+                return owner?.nonce === lease.leaseOwnerNonce;
+            });
+        },
+    };
+}
+async function copyCurrentContext(projectRoot, workspacePath, epicId, targetRef, beforeCommit) {
+    const paths = [...new Set(['.neocortex/state.json', targetRef, `docs/epics/epic-${safeRef(epicId)}.md`])];
+    const snapshots = [];
+    for (const path of paths) {
+        if (!safeRelativePath(path))
+            continue;
+        const content = await readOptional(join(projectRoot, path));
+        snapshots.push({ path, ...(content !== undefined ? { content } : {}) });
+        if (content !== undefined)
+            await writeOptional(workspacePath, path, content, beforeCommit);
+    }
+    return snapshots;
+}
+async function canonicalRoot(projectRoot) {
+    const root = await git(projectRoot, ['rev-parse', '--show-toplevel']);
+    const [canonicalGitRoot, canonicalInputRoot] = await Promise.all([realpath(root), realpath(projectRoot)]);
+    if (canonicalGitRoot !== canonicalInputRoot)
+        throw new Error('project root mismatch');
+    return canonicalGitRoot;
+}
+async function copyGitIdentity(projectRoot, workspaceParent, workspaceName, workspaceIdentity) {
+    for (const key of ['user.name', 'user.email']) {
+        const value = await gitOptional(projectRoot, ['config', '--get', key]);
+        if (value)
+            await sandboxGitAt(workspaceParent, workspaceName, workspaceIdentity, ['config', key, value]);
+    }
+}
+async function initializeBranchlessRuntimeProjection(projectRoot, workspacePath) {
+    const rootRuntime = await readGitLifecycleRuntime(projectRoot);
+    await mutateGitLifecycleRuntime(workspacePath, (document) => {
+        for (const [epicId, epic] of Object.entries(rootRuntime.epics)) {
+            document.epics[epicId] = {
+                ...structuredClone(epic),
+                branch_lease: null,
+            };
+        }
+        for (const [storyId, story] of Object.entries(rootRuntime.stories)) {
+            document.stories[storyId] = structuredClone(story);
+        }
+    });
+}
+async function sandboxGitAt(workspaceParent, workspaceName, workspaceIdentity, args) {
+    return (await anchoredExecuteGit(workspaceParent, workspaceName, workspaceIdentity, args)).toString('utf8').trim();
+}
+async function sandboxGitRaw(lease, args) {
+    return (await anchoredExecuteGit(dirname(lease.workspacePath), basename(lease.workspacePath), lease.workspaceIdentity, args)).toString('utf8');
+}
+async function sandboxGit(lease, args) {
+    return (await sandboxGitRaw(lease, args)).trim();
+}
+async function sandboxGitExitOk(lease, args) {
+    try {
+        await sandboxGit(lease, args);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function sandboxGitIndexBlob(lease, path) {
+    try {
+        return await anchoredExecuteGit(dirname(lease.workspacePath), basename(lease.workspacePath), lease.workspaceIdentity, ['show', `:${path}`]);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function runAnchoredChildCommand(lease, command, args, options, hooks) {
+    const startedAt = Date.now();
+    const empty = (overrides) => ({
+        exitCode: null, timedOut: false, durationMs: Date.now() - startedAt,
+        stdout: '', stderr: '', stdoutBytes: 0, stderrBytes: 0, ...overrides,
+    });
+    if (options.signal?.aborted)
+        return empty({ signal: 'SIGTERM', cancelled: true });
+    if (!command || command.length > 4096 || command.includes('\0') || args.length > 512
+        || args.some((arg) => arg.length > 32768 || arg.includes('\0'))) {
+        return empty({ exitCode: 73, stderr: 'continuous-child-invocation-invalid', stderrBytes: 35 });
+    }
+    const parentPath = dirname(lease.workspacePath);
+    const parentEntry = await lstat(parentPath, { bigint: true });
+    const parentIdentity = await stat(parentPath, { bigint: true });
+    if (!parentEntry.isDirectory() || parentEntry.isSymbolicLink() || !parentIdentity.isDirectory()
+        || parentEntry.dev !== parentIdentity.dev || parentEntry.ino !== parentIdentity.ino) {
+        return empty({ exitCode: 73, stderr: 'continuous-child-parent-invalid', stderrBytes: 31 });
+    }
+    await hooks.beforeHandoff?.();
+    const encoded = Buffer.from(JSON.stringify({ command, args: [...args] })).toString('base64url');
+    const maxOutputBytes = options.maxOutputBytes ?? 64_000;
+    const timeoutMs = Math.max(1, Math.min(options.timeoutMs ?? 10 * 60 * 1000, 30 * 60 * 1000));
+    return await new Promise((resolveCommand) => {
+        const child = spawn(process.execPath, [
+            '-e', ANCHORED_CHILD_HELPER,
+            String(parentIdentity.dev), String(parentIdentity.ino), basename(lease.workspacePath),
+            lease.workspaceIdentity.dev, lease.workspaceIdentity.ino, encoded, hooks.afterHandoff ? '1' : '0',
+        ], { cwd: parentPath, env: options.env, stdio: ['pipe', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        let stdoutBytes = 0;
+        let stderrBytes = 0;
+        let settled = false;
+        let timedOut = false;
+        let cancelled = false;
+        let handoffStarted = !hooks.afterHandoff;
+        const finish = (exitCode, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            options.signal?.removeEventListener('abort', abort);
+            resolveCommand({
+                exitCode, ...(signal ? { signal } : {}), timedOut, ...(cancelled ? { cancelled: true } : {}),
+                durationMs: Date.now() - startedAt, stdout, stderr, stdoutBytes, stderrBytes,
+            });
+        };
+        const abort = () => { cancelled = true; child.kill('SIGTERM'); };
+        options.signal?.addEventListener('abort', abort, { once: true });
+        const timer = setTimeout(() => { timedOut = true; child.kill('SIGTERM'); }, timeoutMs);
+        child.stdout.on('data', (chunk) => {
+            stdoutBytes += chunk.length;
+            if (stdoutBytes + stderrBytes > maxOutputBytes)
+                child.kill('SIGTERM');
+            else
+                stdout += chunk.toString('utf8');
+        });
+        child.stderr.on('data', (chunk) => {
+            stderrBytes += chunk.length;
+            if (stdoutBytes + stderrBytes > maxOutputBytes)
+                child.kill('SIGTERM');
+            else
+                stderr += chunk.toString('utf8');
+            if (!handoffStarted && stderr.includes('continuous-child-handoff-ready\n')) {
+                handoffStarted = true;
+                Promise.resolve(hooks.afterHandoff?.())
+                    .then(() => child.stdin.end())
+                    .catch(() => child.kill('SIGTERM'));
+            }
+        });
+        child.once('error', () => finish(null));
+        child.once('close', (code, signal) => finish(code, signal));
+        if (!hooks.afterHandoff)
+            child.stdin.end();
+    });
+}
+async function git(cwd, args) {
+    return (await gitRaw(cwd, args)).trim();
+}
+async function gitRaw(cwd, args) {
+    const result = await execFileAsync('git', args, { cwd, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+    return String(result.stdout);
+}
+async function gitOptional(cwd, args) {
+    try {
+        return await git(cwd, args);
+    }
+    catch (error) {
+        if (isNodeError(error, 'ENOENT'))
+            return undefined;
+        throw error;
+    }
+}
+async function gitExitOk(cwd, args) {
+    try {
+        await git(cwd, args);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function gitWithInput(cwd, args, input) {
+    return await new Promise((resolveProcess) => {
+        const child = spawn('git', [...args], { cwd, stdio: ['pipe', 'ignore', 'ignore'] });
+        child.once('error', () => resolveProcess(false));
+        child.once('close', (code) => resolveProcess(code === 0));
+        child.stdin.end(input);
+    });
+}
+async function gitBlob(cwd, revision, path) {
+    try {
+        const result = await execFileAsync('git', ['show', `${revision}:${path}`], { cwd, encoding: 'buffer', maxBuffer: 16 * 1024 * 1024 });
+        return Buffer.from(result.stdout);
+    }
+    catch (error) {
+        if (isNodeError(error, 'ENOENT'))
+            return undefined;
+        throw error;
+    }
+}
+async function readOptional(path) {
+    try {
+        return await readFile(path);
+    }
+    catch (error) {
+        if (isNodeError(error, 'ENOENT'))
+            return undefined;
+        throw error;
+    }
+}
+async function writeOptional(boundaryRootInput, relativePathInput, content, beforeCommit) {
+    const relativePath = normalizeRepositoryPath(relativePathInput);
+    if (!safeRelativePath(relativePath))
+        throw new Error('continuous-sandbox-write-path-invalid');
+    const boundaryRoot = await realpath(boundaryRootInput);
+    if (boundaryRoot !== resolve(boundaryRootInput))
+        throw new Error('continuous-sandbox-write-root-symlink');
+    const parentRelative = dirname(relativePath) === '.' ? '' : dirname(relativePath);
+    const parentPath = await ensureContainedDirectoryPath(boundaryRoot, parentRelative);
+    const parentIdentity = await directoryIdentity(parentPath);
+    const destinationPath = join(parentPath, basename(relativePath));
+    await assertContainedDestination(destinationPath, boundaryRoot, true);
+    if (content === undefined) {
+        await beforeCommit?.({ boundaryRoot, relativePath, destinationPath });
+        await assertSameDirectoryIdentity(parentPath, boundaryRoot, parentIdentity);
+        await assertContainedDestination(destinationPath, boundaryRoot, true);
+        await anchoredRemoveFile(parentPath, basename(relativePath));
+        return;
+    }
+    await beforeCommit?.({ boundaryRoot, relativePath, destinationPath });
+    await assertSameDirectoryIdentity(parentPath, boundaryRoot, parentIdentity);
+    await assertContainedDestination(destinationPath, boundaryRoot, true);
+    await anchoredAtomicWriteFile(parentPath, basename(relativePath), content);
+    await assertContainedDestination(destinationPath, boundaryRoot, false);
+}
+async function ensureContainedDirectoryPath(boundaryRoot, relativeDirectory) {
+    let current = boundaryRoot;
+    for (const component of relativeDirectory.split('/').filter(Boolean)) {
+        current = join(current, component);
+        await anchoredEnsureDirectory(dirname(current), basename(current));
+        const entry = await lstat(current);
+        if (!entry.isDirectory() || entry.isSymbolicLink() || await realpath(current) !== current) {
+            throw new Error('continuous-sandbox-write-component-unsafe');
+        }
+        assertPathContained(boundaryRoot, current);
+    }
+    return current;
+}
+async function assertContainedDestination(path, boundaryRoot, allowMissing) {
+    assertPathContained(boundaryRoot, path);
+    try {
+        const entry = await lstat(path);
+        if (entry.isSymbolicLink() || !entry.isFile())
+            throw new Error('continuous-sandbox-write-destination-unsafe');
+        if (await realpath(path) !== path)
+            throw new Error('continuous-sandbox-write-destination-symlink');
+    }
+    catch (error) {
+        if (allowMissing && isNodeError(error, 'ENOENT'))
+            return;
+        throw error;
+    }
+}
+function assertPathContained(boundaryRoot, candidate) {
+    const relation = relative(boundaryRoot, candidate);
+    if (relation === '' || relation.startsWith('..') || isAbsolute(relation)) {
+        throw new Error('continuous-sandbox-write-containment-invalid');
+    }
+}
+async function directoryIdentity(path) {
+    const entry = await lstat(path, { bigint: true });
+    if (!entry.isDirectory() || entry.isSymbolicLink())
+        throw new Error('continuous-sandbox-write-parent-unsafe');
+    return { dev: entry.dev, ino: entry.ino };
+}
+async function sameDirectoryIdentity(path, boundaryRoot, expected) {
+    try {
+        if (path !== boundaryRoot)
+            assertPathContained(boundaryRoot, path);
+        if (await realpath(path) !== path)
+            return false;
+        const current = await directoryIdentity(path);
+        return current.dev === expected.dev && current.ino === expected.ino;
+    }
+    catch {
+        return false;
+    }
+}
+async function assertSameDirectoryIdentity(path, boundaryRoot, expected) {
+    if (!(await sameDirectoryIdentity(path, boundaryRoot, expected))) {
+        throw new Error('continuous-sandbox-write-parent-raced');
+    }
+}
+async function snapshotPaths(root, paths) {
+    return await Promise.all(paths.map(async (path) => {
+        const content = await readOptional(join(root, path));
+        return { path, ...(content !== undefined ? { content } : {}) };
+    }));
+}
+async function restoreIntegration(root, snapshots) {
+    const paths = snapshots.map((snapshot) => snapshot.path);
+    if (paths.length > 0)
+        await gitExitOk(root, ['reset', '--quiet', 'HEAD', '--', ...paths]);
+    for (const snapshot of snapshots)
+        await writeOptional(root, snapshot.path, snapshot.content);
+}
+async function acquireRootWriterLease(lease, nowIso) {
+    try {
+        const statePath = join(lease.projectRoot, '.neocortex/state.json');
+        const tracked = asRecord(JSON.parse((await readFile(statePath)).toString('utf8')));
+        const legacyEpic = asRecordOrUndefined(asRecordOrUndefined(tracked.epics)?.[lease.epicId]);
+        const legacyLease = asRecordOrUndefined(legacyEpic?.branch_lease);
+        const requested = Object.freeze({
+            schemaVersion: 1,
+            ownerStoryId: lease.storyId,
+            sessionId: lease.dispatchId,
+            idempotencyKey: lease.dispatchId,
+            acquiredAt: nowIso,
+            expiresAt: new Date(Date.parse(nowIso) + 10 * 60 * 1000).toISOString(),
+        });
+        let blocked = false;
+        await mutateGitLifecycleRuntime(lease.projectRoot, (document) => {
+            const epic = ensureRuntimeEpic(document, lease.epicId);
+            const current = asRecordOrUndefined(epic.branch_lease) ?? legacyLease;
+            if (current && typeof current.expiresAt === 'string' && current.expiresAt > nowIso
+                && (current.ownerStoryId !== lease.storyId || current.idempotencyKey !== lease.dispatchId)) {
+                blocked = true;
+                return;
+            }
+            epic.branch_mode = 'epic';
+            epic.execution_branch = lease.executionBranch;
+            epic.branch_lease = requested;
+        });
+        if (blocked)
+            return failure('continuous-epic-checkout-writer-active');
+        return { ok: true, value: requested };
+    }
+    catch {
+        return failure('continuous-writer-lease-persist-failed');
+    }
+}
+async function releaseRootWriterLease(lease) {
+    await mutateGitLifecycleRuntime(lease.projectRoot, (document) => {
+        const epic = ensureRuntimeEpic(document, lease.epicId);
+        const current = asRecordOrUndefined(epic.branch_lease);
+        if (current?.ownerStoryId === lease.storyId && current.idempotencyKey === lease.dispatchId)
+            epic.branch_lease = null;
+    });
+}
+async function persistRootCheckpoint(input) {
+    try {
+        const statePath = join(input.lease.projectRoot, '.neocortex/state.json');
+        const checkpoint = Object.freeze({
+            schemaVersion: 1,
+            storyId: input.lease.storyId,
+            epicId: input.lease.epicId,
+            branch: input.lease.executionBranch,
+            baseSha: input.baseSha,
+            headSha: input.headSha,
+            commits: Object.freeze([input.headSha]),
+            idempotencyKey: input.lease.dispatchId,
+            dispatchId: input.lease.dispatchId,
+            bundleId: input.bundle.bundleId,
+            bundleDigest: input.bundle.bundleDigest,
+            graphRevision: input.lease.graphRevision,
+            claimRevision: input.lease.claimRevision,
+            receiptRefs: Object.freeze([...new Set(input.receiptRefs)]),
+            qaVerdict: 'passed',
+            reviewVerdict: 'approved',
+            qaReceipt: input.qaReceipt,
+            reviewReceipt: input.reviewReceipt,
+            recordedAt: input.recordedAt,
+        });
+        const tracked = asRecord(JSON.parse((await readFile(statePath)).toString('utf8')));
+        const trackedStory = asRecordOrUndefined(asRecordOrUndefined(tracked.stories)?.[input.lease.storyId]);
+        let outcome = 'persisted';
+        let reused;
+        let writerAtCas;
+        let authorityRuntimeAtCas;
+        let storyAtCasBefore;
+        let storyAtCasExisted = false;
+        let epicLeaseAtCasBefore;
+        const physicalGuard = async (candidate, runtimeDocument, trackedDocument) => {
+            const currentBranch = await gitOptional(input.lease.projectRoot, ['symbolic-ref', '--quiet', '--short', 'HEAD']);
+            const currentHead = await git(input.lease.projectRoot, ['rev-parse', 'HEAD']);
+            if (currentBranch !== input.lease.executionBranch || currentHead !== input.headSha) {
+                throw new Error('continuous-checkpoint-head-raced');
+            }
+            if (candidate.graphRevision !== input.lease.graphRevision
+                || candidate.claimRevision !== input.lease.claimRevision
+                || candidate.bundleId !== input.bundle.bundleId
+                || candidate.bundleDigest !== input.bundle.bundleDigest) {
+                throw new Error('continuous-checkpoint-graph-raced');
+            }
+            const currentTracked = trackedDocument
+                ?? asRecord(JSON.parse((await readFile(statePath)).toString('utf8')));
+            const effective = applyGitLifecycleRuntimeOverlay(currentTracked, runtimeDocument ?? await readGitLifecycleRuntime(input.lease.projectRoot));
+            const currentEpic = asRecordOrUndefined(asRecordOrUndefined(effective.epics)?.[input.lease.epicId]);
+            const currentStory = asRecordOrUndefined(asRecordOrUndefined(effective.stories)?.[input.lease.storyId]);
+            const dependencies = Array.isArray(currentStory?.depends_on)
+                ? currentStory.depends_on.filter((value) => typeof value === 'string')
+                : [];
+            const effectiveStories = asRecordOrUndefined(effective.stories);
+            if (currentEpic?.execution_branch !== input.lease.executionBranch
+                || dependencies.some((dependencyId) => {
+                    const dependency = asRecordOrUndefined(effectiveStories?.[dependencyId]);
+                    return !dependency || !['done', 'completed', 'merged'].includes(String(dependency.status));
+                })) {
+                throw new Error('continuous-checkpoint-dependency-raced');
+            }
+            const changedPaths = splitNull(await gitRaw(input.lease.projectRoot, [
+                'diff-tree', '--no-commit-id', '--name-only', '-r', '-z', input.headSha,
+            ]));
+            if (changedPaths.length === 0
+                || changedPaths.some((path) => !input.lease.authorizedWriteSet.some((scope) => writeSetCovers(scope, path)))) {
+                throw new Error('continuous-checkpoint-write-set-raced');
+            }
+            if (!(await verifyAcceptedGitLifecycleStoryCheckpoint(input.lease.projectRoot, candidate, input.lease.storyId, input.lease.epicId, input.lease.executionBranch, undefined, input.lease.authorizedWriteSet)))
+                throw new Error('continuous-checkpoint-receipt-revalidation-failed');
+        };
+        const runtimeBefore = await readGitLifecycleRuntime(input.lease.projectRoot, { required: true });
+        const writerBefore = asRecordOrUndefined(asRecordOrUndefined(runtimeBefore.epics[input.lease.epicId])?.branch_lease);
+        if (writerBefore?.ownerStoryId !== input.lease.storyId
+            || writerBefore.idempotencyKey !== input.lease.dispatchId
+            || writerBefore.sessionId !== input.lease.dispatchId
+            || typeof writerBefore.expiresAt !== 'string'
+            || Date.parse(writerBefore.expiresAt) <= (input.checkpointNow?.('before-mutation') ?? Date.now())) {
+            return failure('continuous-checkpoint-writer-lease-lost');
+        }
+        if (!(await verifyGitLifecyclePhysicalIntegrationLock(input.physicalLock.path, input.physicalLock.owner))) {
+            return failure('continuous-checkpoint-integration-lock-raced');
+        }
+        const trackedAuthorityBytes = await readFile(statePath);
+        const trackedAuthorityDigest = createHash('sha256').update(trackedAuthorityBytes).digest('hex');
+        await physicalGuard(checkpoint, runtimeBefore);
+        const authorityBefore = currentGraphAuthoritySnapshot(asRecord(JSON.parse(trackedAuthorityBytes.toString('utf8'))), runtimeBefore, input.lease.epicId, input.lease.storyId);
+        if (authorityBefore.revision !== input.checkpointAuthority.revision
+            || authorityBefore.epoch !== input.checkpointAuthority.epoch
+            || authorityBefore.storyStatus !== input.checkpointAuthority.storyStatus) {
+            return failure('continuous-graph-revision-stale');
+        }
+        const persistedMutation = await mutateGitLifecycleRuntime(input.lease.projectRoot, (document) => {
+            const epic = ensureRuntimeEpic(document, input.lease.epicId);
+            const writer = asRecordOrUndefined(epic.branch_lease);
+            writerAtCas = writer === undefined ? undefined : structuredClone(writer);
+            authorityRuntimeAtCas = structuredClone(document);
+            storyAtCasExisted = document.stories[input.lease.storyId] !== undefined;
+            storyAtCasBefore = structuredClone(document.stories[input.lease.storyId] ?? {});
+            epicLeaseAtCasBefore = structuredClone(epic.branch_lease);
+            const story = ensureRuntimeStory(document, input.lease.storyId);
+            const existing = asRecordOrUndefined(story.checkpoint) ?? asRecordOrUndefined(trackedStory?.checkpoint);
+            if (existing?.idempotencyKey === input.lease.dispatchId) {
+                if (existing.baseSha !== input.baseSha || existing.headSha !== input.headSha
+                    || existing.bundleId !== input.bundle.bundleId
+                    || existing.bundleDigest !== input.bundle.bundleDigest
+                    || existing.graphRevision !== input.lease.graphRevision
+                    || existing.claimRevision !== input.lease.claimRevision) {
+                    outcome = 'conflict';
+                }
+                else {
+                    outcome = 'reused';
+                    reused = existing;
+                    epic.branch_lease = null;
+                }
+                return;
+            }
+            if (writer?.ownerStoryId !== input.lease.storyId
+                || writer.idempotencyKey !== input.lease.dispatchId
+                || writer.sessionId !== input.lease.dispatchId) {
+                outcome = 'lease-lost';
+                return;
+            }
+            story.checkpoint = checkpoint;
+            story.status = 'done';
+            story.last_step = GIT_LIFECYCLE_REVIEW_PR_STEP_ID;
+            const steps = Array.isArray(story.steps_completed) ? story.steps_completed.filter((item) => typeof item === 'string') : [];
+            story.steps_completed = [...new Set([...steps, GIT_LIFECYCLE_COMMIT_PUSH_STEP_ID, GIT_LIFECYCLE_REVIEW_PR_STEP_ID])];
+            epic.branch_lease = null;
+        }, {
+            expectedRevision: runtimeBefore.revision,
+            preCommit: async (document) => {
+                if (writerAtCas?.ownerStoryId !== input.lease.storyId
+                    || writerAtCas.idempotencyKey !== input.lease.dispatchId
+                    || writerAtCas.sessionId !== input.lease.dispatchId
+                    || typeof writerAtCas.expiresAt !== 'string'
+                    || Date.parse(writerAtCas.expiresAt) <= (input.checkpointNow?.('pre-commit') ?? Date.now())) {
+                    throw new Error('continuous-checkpoint-writer-lease-lost');
+                }
+                await input.insideCheckpointPreCommit?.({
+                    projectRoot: input.lease.projectRoot,
+                    storyId: input.lease.storyId,
+                    headSha: input.headSha,
+                });
+                if (!(await verifyGitLifecyclePhysicalIntegrationLock(input.physicalLock.path, input.physicalLock.owner))) {
+                    throw new Error('continuous-checkpoint-integration-lock-raced');
+                }
+                await physicalGuard(reused ?? checkpoint, document);
+                const finalTrackedBytes = await readFile(statePath);
+                if (createHash('sha256').update(finalTrackedBytes).digest('hex') !== trackedAuthorityDigest) {
+                    throw new Error('continuous-graph-revision-stale');
+                }
+                if (!authorityRuntimeAtCas)
+                    throw new Error('continuous-checkpoint-authority-missing');
+                const finalTracked = asRecord(JSON.parse(finalTrackedBytes.toString('utf8')));
+                const authorityAtCas = currentGraphAuthoritySnapshot(finalTracked, authorityRuntimeAtCas, input.lease.epicId, input.lease.storyId);
+                if (authorityAtCas.revision !== input.checkpointAuthority.revision
+                    || authorityAtCas.epoch !== input.checkpointAuthority.epoch
+                    || authorityAtCas.storyStatus !== input.checkpointAuthority.storyStatus) {
+                    throw new Error('continuous-graph-revision-stale');
+                }
+                if (outcome === 'persisted'
+                    && !exactPersistedCheckpointProjection(finalTracked, document, input.lease, checkpoint)) {
+                    throw new Error('continuous-checkpoint-projection-raced');
+                }
+            },
+        });
+        // The outcome is assigned inside the serialized mutation callback. TypeScript
+        // does not model writes performed by a callback, so re-widen it here.
+        const finalOutcome = outcome;
+        if (finalOutcome === 'conflict')
+            return failure('continuous-checkpoint-idempotency-conflict');
+        if (finalOutcome === 'lease-lost')
+            return failure('continuous-checkpoint-writer-lease-lost');
+        if (finalOutcome === 'reused' && reused) {
+            try {
+                await physicalGuard(reused);
+                return { ok: true, value: reused };
+            }
+            catch {
+                return failure('continuous-checkpoint-reused-evidence-invalid');
+            }
+        }
+        try {
+            await input.afterCheckpointPersist?.({
+                projectRoot: input.lease.projectRoot,
+                storyId: input.lease.storyId,
+                headSha: input.headSha,
+            });
+            const runtimeAfterPersist = await readGitLifecycleRuntime(input.lease.projectRoot, { required: true });
+            if (runtimeAfterPersist.revision !== persistedMutation.document.revision) {
+                throw new Error('continuous-checkpoint-post-persist-runtime-raced');
+            }
+            await physicalGuard(checkpoint, runtimeAfterPersist);
+            const finalTrackedBytes = await readFile(statePath);
+            if (createHash('sha256').update(finalTrackedBytes).digest('hex') !== trackedAuthorityDigest) {
+                throw new Error('continuous-checkpoint-post-persist-authority-raced');
+            }
+            const finalTracked = asRecord(JSON.parse(finalTrackedBytes.toString('utf8')));
+            if (!exactPersistedCheckpointProjection(finalTracked, runtimeAfterPersist, input.lease, checkpoint)) {
+                throw new Error('continuous-checkpoint-post-persist-projection-raced');
+            }
+        }
+        catch {
+            const cleanupTrackedBytes = await readFile(statePath).catch(() => undefined);
+            const trackedAuthorityChanged = cleanupTrackedBytes === undefined
+                || createHash('sha256').update(cleanupTrackedBytes).digest('hex') !== trackedAuthorityDigest;
+            await mutateGitLifecycleRuntime(input.lease.projectRoot, (document) => {
+                const epic = asRecordOrUndefined(document.epics[input.lease.epicId]);
+                const story = asRecordOrUndefined(document.stories[input.lease.storyId]);
+                const cleanupTracked = cleanupTrackedBytes === undefined
+                    ? undefined
+                    : asRecord(JSON.parse(cleanupTrackedBytes.toString('utf8')));
+                if (!epic || !story || !cleanupTracked
+                    || !exactPersistedCheckpointProjection(cleanupTracked, document, input.lease, checkpoint)) {
+                    throw new Error('continuous-checkpoint-cleanup-cas-conflict');
+                }
+                if (trackedAuthorityChanged) {
+                    if (storyAtCasExisted)
+                        restoreRecord(story, storyAtCasBefore ?? {});
+                    else
+                        delete document.stories[input.lease.storyId];
+                    if (epicLeaseAtCasBefore === undefined)
+                        delete epic.branch_lease;
+                    else
+                        epic.branch_lease = structuredClone(epicLeaseAtCasBefore);
+                    return;
+                }
+                story.checkpoint = null;
+                story.status = 'blocked';
+                epic.branch_lease = null;
+            }, { expectedRevision: persistedMutation.document.revision }).catch(() => undefined);
+            return failure('continuous-checkpoint-post-persist-raced');
+        }
+        return { ok: true, value: checkpoint };
+    }
+    catch (error) {
+        const reasonCode = error instanceof Error && /^continuous-/.test(error.message)
+            ? error.message
+            : 'continuous-checkpoint-persist-failed';
+        return failure(reasonCode);
+    }
+}
+async function produceIndependentCheckpointEvidence(input) {
+    try {
+        if (await git(input.lease.projectRoot, ['rev-parse', 'HEAD']) !== input.headSha) {
+            return failure('continuous-story-evidence-head-raced');
+        }
+        const manifestRaw = await readFile(join(input.lease.projectRoot, 'config', 'release-gates.v2.json'), 'utf8');
+        const manifest = JSON.parse(manifestRaw);
+        const gateIds = Array.isArray(manifest.requiredCompleteClasses)
+            ? manifest.requiredCompleteClasses.filter((item) => typeof item === 'string' && /^[a-z0-9-]+$/.test(item))
+            : [];
+        if (manifest.contract !== 'P205-CI-02' || gateIds.length === 0) {
+            return failure('continuous-story-qa-manifest-invalid');
+        }
+        const qaOutput = String((await execFileAsync(process.execPath, ['scripts/test-root.mjs', '--gate', 'complete'], {
+            cwd: input.lease.projectRoot,
+            encoding: 'utf8',
+            maxBuffer: 32 * 1024 * 1024,
+        })).stdout);
+        await input.qaRunner?.({ projectRoot: input.lease.projectRoot, storyId: input.lease.storyId, headSha: input.headSha });
+        if (await git(input.lease.projectRoot, ['rev-parse', 'HEAD']) !== input.headSha) {
+            return failure('continuous-story-qa-head-raced');
+        }
+        const checkedAt = normalizeEvidenceTime(input.nowIso);
+        const commitCount = await git(input.lease.projectRoot, ['rev-list', '--count', `${input.baseSha}..${input.headSha}`]);
+        const commitBody = await gitRaw(input.lease.projectRoot, ['show', '--no-patch', '--format=%H%n%P%n%B', input.headSha]);
+        const changedPaths = splitNull(await gitRaw(input.lease.projectRoot, ['diff', '--name-only', '-z', `${input.baseSha}..${input.headSha}`]));
+        const gitEvidenceDigest = computeImmutableStoryQaEvidenceDigest({
+            storyId: input.lease.storyId, baseSha: input.baseSha, headSha: input.headSha,
+            bundleDigest: input.bundle.bundleDigest, graphRevision: input.lease.graphRevision,
+            commitBody, changedPaths,
+        });
+        const manifestDigest = createHash('sha256').update(manifestRaw).digest('hex');
+        const resultDigest = createHash('sha256').update(qaOutput).digest('hex');
+        const qaSourceDigest = computeP205StoryQaEvidenceDigest({
+            gitEvidenceDigest, headSha: input.headSha, graphRevision: input.lease.graphRevision,
+            manifestDigest, gateIds, resultDigest,
+        });
+        const qaReceiptRef = `story-qa:${qaSourceDigest}`;
+        const qaReceipt = Object.freeze({
+            schemaVersion: 1, kind: 'story_qa_evidence', producer: 'local-yolo-tdd', evidenceVersion: 'p205-execution-v2',
+            storyId: input.lease.storyId, epicId: input.lease.epicId,
+            baseSha: input.baseSha, headSha: input.headSha,
+            bundleDigest: input.bundle.bundleDigest, graphRevision: input.lease.graphRevision,
+            contract: 'P205-CI-02', command: P205_COMPLETE_COMMAND,
+            manifestDigest, gateIds: Object.freeze(gateIds), resultDigest,
+            sourceEvidenceDigest: qaSourceDigest, verdict: 'passed', checkedAt, receiptRef: qaReceiptRef,
+        });
+        const trailers = [
+            `Neocortex-Story: ${input.lease.storyId}`,
+            `Neocortex-Epic: ${input.lease.epicId}`,
+            `Neocortex-Bundle-Digest: ${input.bundle.bundleDigest}`,
+            `Neocortex-Graph-Revision: ${input.lease.graphRevision}`,
+        ];
+        if (commitCount !== '1' || !trailers.every((trailer) => commitBody.includes(trailer))
+            || changedPaths.length === 0
+            || changedPaths.some((path) => !input.lease.authorizedWriteSet.some((authorized) => writeSetCovers(authorized, path)))) {
+            return failure('continuous-story-review-evidence-rejected');
+        }
+        const reviewSourceDigest = createHash('sha256').update([
+            'root-commit-range-review-v1', input.lease.storyId, input.baseSha, input.headSha,
+            input.bundle.bundleDigest, input.lease.graphRevision, qaReceiptRef,
+            createHash('sha256').update(commitBody).digest('hex'), [...changedPaths].sort().join(','),
+        ].join('\0')).digest('hex');
+        const reviewReceiptRef = `story-review:${reviewSourceDigest}`;
+        const reviewReceipt = Object.freeze({
+            schemaVersion: 1, kind: 'story_review_evidence', producer: 'root-commit-range-review',
+            storyId: input.lease.storyId, epicId: input.lease.epicId,
+            baseSha: input.baseSha, headSha: input.headSha,
+            bundleDigest: input.bundle.bundleDigest, graphRevision: input.lease.graphRevision,
+            sourceEvidenceDigest: reviewSourceDigest, qaReceiptRef,
+            verdict: 'approved', reviewedAt: checkedAt, receiptRef: reviewReceiptRef,
+        });
+        return { ok: true, value: { qaReceipt, reviewReceipt } };
+    }
+    catch {
+        return failure('continuous-story-evidence-production-failed');
+    }
+}
+function normalizeEvidenceTime(value) {
+    return Number.isFinite(Date.parse(value)) ? new Date(Date.parse(value)).toISOString() : new Date().toISOString();
+}
+function filterChildGitState(baseContent, childContent, storyId) {
+    if (childContent === undefined)
+        return undefined;
+    try {
+        const base = baseContent === undefined ? {} : asRecord(JSON.parse(baseContent.toString('utf8')));
+        const untrustedChild = asRecord(JSON.parse(childContent.toString('utf8')));
+        const child = structuredClone(base);
+        const baseStory = asRecordOrUndefined(asRecordOrUndefined(base.stories)?.[storyId]);
+        const untrustedStory = asRecordOrUndefined(asRecordOrUndefined(untrustedChild.stories)?.[storyId]);
+        const stories = ensureRecord(child, 'stories');
+        const childStory = structuredClone(baseStory ?? {});
+        for (const field of [
+            'status', 'last_step', 'steps_completed', 'last_updated', 'blocked_reason',
+            'blocked_at', 'implementation_evidence', 'validation_evidence', 'qa_gate',
+        ]) {
+            if (untrustedStory && Object.prototype.hasOwnProperty.call(untrustedStory, field)) {
+                childStory[field] = structuredClone(untrustedStory[field]);
+            }
+        }
+        stories[storyId] = childStory;
+        return Buffer.from(`${JSON.stringify(child, null, 2)}\n`);
+    }
+    catch {
+        return Buffer.from('{invalid-child-state');
+    }
+}
+function ensureRecord(parent, key) {
+    const current = asRecordOrUndefined(parent[key]);
+    if (current)
+        return current;
+    const created = {};
+    parent[key] = created;
+    return created;
+}
+function asRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('record expected');
+    return value;
+}
+function asRecordOrUndefined(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+function mergeBuffers(base, root, child) {
+    if (sameBuffer(child, base) || sameBuffer(root, child))
+        return { ok: true, value: root };
+    if (sameBuffer(root, base))
+        return { ok: true, value: child };
+    return failure('continuous-context-merge-conflict');
+}
+function mergeJsonBuffers(base, root, child) {
+    try {
+        const merged = mergeJsonValue(parseJson(base), parseJson(root), parseJson(child));
+        return merged.ok ? { ok: true, value: merged.value === undefined ? undefined : Buffer.from(`${JSON.stringify(merged.value, null, 2)}\n`) } : merged;
+    }
+    catch {
+        return failure('continuous-state-merge-invalid');
+    }
+}
+function parseJson(value) {
+    return value === undefined ? undefined : JSON.parse(value.toString('utf8'));
+}
+function mergeJsonValue(base, root, child) {
+    if (sameJson(child, base) || sameJson(root, child))
+        return { ok: true, value: root };
+    if (sameJson(root, base))
+        return { ok: true, value: child };
+    if (isPlainRecord(base) && isPlainRecord(root) && isPlainRecord(child)) {
+        const merged = {};
+        for (const key of [...new Set([...Object.keys(base), ...Object.keys(root), ...Object.keys(child)])].sort()) {
+            const value = mergeJsonValue(base[key], root[key], child[key]);
+            if (!value.ok)
+                return value;
+            if (value.value !== undefined)
+                merged[key] = value.value;
+        }
+        return { ok: true, value: merged };
+    }
+    if (Array.isArray(base) && Array.isArray(root) && Array.isArray(child) && isJsonPrefix(base, root) && isJsonPrefix(base, child)) {
+        const values = [...base, ...root.slice(base.length), ...child.slice(base.length)];
+        const seen = new Set();
+        return { ok: true, value: values.filter((item) => {
+                const key = JSON.stringify(item);
+                if (seen.has(key))
+                    return false;
+                seen.add(key);
+                return true;
+            }) };
+    }
+    return failure('continuous-state-merge-conflict');
+}
+function isPlainRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+function isJsonPrefix(prefix, value) {
+    return prefix.length <= value.length && prefix.every((item, index) => sameJson(item, value[index]));
+}
+function sameJson(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+function sameBuffer(left, right) {
+    return left === undefined || right === undefined ? left === right : left.equals(right);
+}
+function splitNull(value) {
+    return value.split('\0').filter(Boolean);
+}
+function safeRelativePath(value) {
+    const normalized = normalizeRepositoryPath(value);
+    return normalized.length > 0 && normalized.length <= 1024 && !isAbsolute(normalized)
+        && !/^[A-Za-z]:\//.test(normalized) && !normalized.split('/').includes('..')
+        && !normalized.includes('\0') && !normalized.startsWith('/');
+}
+function normalizeRepositoryPath(value) {
+    return value.replaceAll('\\', '/').replace(/^\.\//, '').replace(/\/{2,}/g, '/');
+}
+function normalizeWriteSet(values) {
+    const normalized = values.map(normalizeRepositoryPath).filter(safeRelativePath);
+    return [...new Set(normalized)].sort();
+}
+function writeSetCovers(authorized, changed) {
+    const scope = normalizeRepositoryPath(authorized);
+    const path = normalizeRepositoryPath(changed);
+    return scope === path || scope.endsWith('/') && path.startsWith(scope);
+}
+function safeBranch(value) {
+    return value.length > 0 && value.length <= 240 && !value.startsWith('-') && !value.startsWith('/')
+        && !value.endsWith('/') && !value.endsWith('.lock') && !value.includes('..') && !value.includes('\\')
+        && !value.includes('@{') && !value.includes('//') && /^[A-Za-z0-9._/-]+$/.test(value);
+}
+function sameStrings(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+async function readCurrentGraphAuthoritySnapshot(projectRoot, epicId, storyId, runtimeDocument) {
+    const tracked = asRecord(JSON.parse(await readFile(join(projectRoot, '.neocortex/state.json'), 'utf8')));
+    return currentGraphAuthoritySnapshot(tracked, runtimeDocument ?? await readGitLifecycleRuntime(projectRoot), epicId, storyId);
+}
+function currentGraphAuthoritySnapshot(tracked, runtimeDocument, epicId, storyId) {
+    const effective = applyGitLifecycleRuntimeOverlay(tracked, runtimeDocument);
+    const epics = asRecordOrUndefined(effective.epics);
+    const stories = asRecordOrUndefined(effective.stories);
+    const epic = asRecordOrUndefined(epics?.[epicId]) ?? {};
+    const authoredStoryIds = (Array.isArray(epic.stories) ? epic.stories : Array.isArray(epic.story_ids) ? epic.story_ids : [])
+        .filter((value) => typeof value === 'string');
+    const storyIds = authoredStoryIds.length > 0
+        ? authoredStoryIds
+        : Object.entries(stories ?? {})
+            .filter(([storyId, value]) => {
+            const story = asRecordOrUndefined(value);
+            return story?.epic_id === epicId || storyId.startsWith(`${epicId}.`);
+        })
+            .map(([storyId]) => storyId)
+            .sort();
+    const authorityFields = [
+        'status', 'depends_on', 'files_to_modify', 'contracts', 'contract_refs', 'shared_surfaces',
+        'steps_completed', 'last_step', 'branch_name', 'physicalMergeStatus', 'merged', 'checkpoint',
+        'planning', 'attempts', 'retry_count', 'rollback_receipt', 'cancelled_at',
+    ];
+    const storyAuthority = Object.fromEntries(storyIds.map((storyId) => {
+        const story = asRecordOrUndefined(stories?.[storyId]) ?? {};
+        return [storyId, Object.fromEntries(authorityFields
+                .filter((field) => Object.prototype.hasOwnProperty.call(story, field))
+                .map((field) => [field, story[field]]))];
+    }));
+    return {
+        revision: hashCanonical({
+            epicId,
+            epic: {
+                stories: storyIds,
+                status: epic.status ?? null,
+                branch_mode: epic.branch_mode ?? null,
+                execution_branch: epic.execution_branch ?? null,
+                graph_revision: epic.graph_revision ?? null,
+                depends_on: epic.depends_on ?? null,
+                planning: epic.planning ?? null,
+                execution_plan: epic.execution_plan ?? null,
+                waves: epic.waves ?? null,
+                current_wave: epic.current_wave ?? null,
+                replan: epic.replan ?? null,
+                replan_revision: epic.replan_revision ?? null,
+                dependency_graph: epic.dependency_graph ?? null,
+                scheduler: epic.scheduler ?? null,
+                attempts: epic.attempts ?? null,
+                retry_count: epic.retry_count ?? null,
+            },
+            stories: storyAuthority,
+        }),
+        epoch: typeof epic.graph_revision === 'string' ? epic.graph_revision : null,
+        storyStatus: typeof asRecordOrUndefined(stories?.[storyId])?.status === 'string'
+            ? String(asRecordOrUndefined(stories?.[storyId])?.status)
+            : null,
+    };
+}
+function exactPersistedCheckpointProjection(tracked, runtimeDocument, lease, checkpoint) {
+    const effective = applyGitLifecycleRuntimeOverlay(tracked, runtimeDocument);
+    const epic = asRecordOrUndefined(asRecordOrUndefined(effective.epics)?.[lease.epicId]);
+    const story = asRecordOrUndefined(asRecordOrUndefined(effective.stories)?.[lease.storyId]);
+    const steps = Array.isArray(story?.steps_completed)
+        ? story.steps_completed.filter((value) => typeof value === 'string')
+        : [];
+    return Boolean(epic && story
+        && epic.branch_lease === null
+        && story.status === 'done'
+        && story.last_step === GIT_LIFECYCLE_REVIEW_PR_STEP_ID
+        && steps.includes(GIT_LIFECYCLE_COMMIT_PUSH_STEP_ID)
+        && steps.includes(GIT_LIFECYCLE_REVIEW_PR_STEP_ID)
+        && canonicalJson(story.checkpoint) === canonicalJson(checkpoint));
+}
+function restoreRecord(target, previous) {
+    for (const key of Object.keys(target))
+        delete target[key];
+    Object.assign(target, structuredClone(previous));
+}
+async function readCurrentGraphAuthorityRevision(projectRoot, epicId) {
+    return (await readCurrentGraphAuthoritySnapshot(projectRoot, epicId, '')).revision;
+}
+function hashCanonical(value) {
+    return createHash('sha256').update(canonicalJson(value)).digest('hex');
+}
+function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, child]) => `${JSON.stringify(key)}:${canonicalJson(child)}`).join(',')}}`;
+}
+function normalizeReceiptRefs(values, dispatchId) {
+    const safe = (values ?? []).filter((value) => /^[A-Za-z0-9._/:@#-]{1,200}$/.test(value) && !value.includes('..'));
+    return Object.freeze([...new Set(safe.length > 0 ? safe : [`dispatch:${dispatchId}`])].sort());
+}
+function safeRef(value) {
+    return value.replace(/[^A-Za-z0-9._-]/g, '-').slice(0, 80);
+}
+function failure(reasonCode) {
+    return { ok: false, reasonCode };
+}
+function isNodeError(error, code) {
+    return error instanceof Error && 'code' in error && error.code === code;
+}
+async function readLeaseOwner(leasePath, leasesRoot) {
+    try {
+        await assertGitLifecyclePrivateDirectory(leasePath, leasesRoot);
+        const ownerPath = join(leasePath, 'owner.json');
+        await assertGitLifecyclePrivateFile(ownerPath, leasePath);
+        const parsed = JSON.parse(await readFile(ownerPath, 'utf8'));
+        if (!Number.isSafeInteger(parsed.pid) || Number(parsed.pid) <= 0
+            || typeof parsed.createdAt !== 'string' || !Number.isFinite(Date.parse(parsed.createdAt))
+            || typeof parsed.nonce !== 'string' || !/^[a-f0-9]{32}$/.test(parsed.nonce)) {
+            throw new Error('continuous-sandbox-lease-owner-invalid');
+        }
+        return { pid: Number(parsed.pid), createdAt: parsed.createdAt, nonce: parsed.nonce };
+    }
+    catch (error) {
+        if (isNodeError(error, 'ENOENT'))
+            return undefined;
+        throw error;
+    }
+}
+function sameLeaseOwner(left, right) {
+    return left?.pid === right.pid && left.createdAt === right.createdAt && left.nonce === right.nonce;
+}
+function processExists(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return isNodeError(error, 'EPERM');
+    }
+}
+async function readSandboxMetadata(workspacePath, sandboxesRoot) {
+    try {
+        await assertGitLifecyclePrivateDirectory(workspacePath, sandboxesRoot);
+        const gitDirectory = join(workspacePath, '.git');
+        await assertGitLifecyclePrivateDirectory(gitDirectory, workspacePath);
+        const metadataPath = join(gitDirectory, 'neocortex-sandbox.json');
+        await assertGitLifecyclePrivateFile(metadataPath, gitDirectory);
+        const parsed = JSON.parse(await readFile(metadataPath, 'utf8'));
+        if (parsed.schemaVersion !== 1 || typeof parsed.workspaceOwnerNonce !== 'string'
+            || !/^[a-f0-9]{32}$/.test(parsed.workspaceOwnerNonce)
+            || !/^[a-f0-9]{64}$/.test(parsed.graphAuthorityRevision)
+            || !(parsed.graphAuthorityEpoch === null || /^[a-f0-9]{64}$/.test(parsed.graphAuthorityEpoch))
+            || !(parsed.graphAuthorityStoryStatus === null
+                || typeof parsed.graphAuthorityStoryStatus === 'string' && parsed.graphAuthorityStoryStatus.length <= 80)
+            || typeof parsed.workspaceIdentity?.dev !== 'string' || !/^[0-9]+$/.test(parsed.workspaceIdentity.dev)
+            || typeof parsed.workspaceIdentity?.ino !== 'string' || !/^[0-9]+$/.test(parsed.workspaceIdentity.ino)) {
+            throw new Error('continuous-sandbox-metadata-invalid');
+        }
+        return parsed;
+    }
+    catch (error) {
+        if (isNodeError(error, 'ENOENT'))
+            return undefined;
+        throw error;
+    }
+}
+async function writeSandboxMetadata(workspacePath, sandboxesRoot, metadata, beforeCommit) {
+    await assertGitLifecyclePrivateDirectory(workspacePath, sandboxesRoot);
+    const gitDirectory = join(workspacePath, '.git');
+    await assertGitLifecyclePrivateDirectory(gitDirectory, workspacePath);
+    const metadataPath = join(gitDirectory, 'neocortex-sandbox.json');
+    await writeOptional(workspacePath, '.git/neocortex-sandbox.json', Buffer.from(`${JSON.stringify(metadata, null, 2)}\n`), beforeCommit);
+    await assertGitLifecyclePrivateFile(metadataPath, gitDirectory);
+}
+async function readMarker(markerPath, integratedRoot) {
+    try {
+        await assertGitLifecyclePrivateFile(markerPath, integratedRoot);
+        const parsed = JSON.parse(await readFile(markerPath, 'utf8'));
+        return typeof parsed.childHeadSha === 'string' && typeof parsed.rootHeadSha === 'string'
+            && /^[a-f0-9]{40,64}$/.test(parsed.childHeadSha) && /^[a-f0-9]{40,64}$/.test(parsed.rootHeadSha)
+            && parsed.bundle?.schemaVersion === 1 && parsed.checkpoint?.schemaVersion === 1
+            ? parsed
+            : undefined;
+    }
+    catch (error) {
+        if (isNodeError(error, 'ENOENT'))
+            return undefined;
+        throw error;
+    }
+}
+async function checkpointExistsInRootState(lease, checkpoint) {
+    try {
+        const tracked = asRecord(JSON.parse(await readFile(join(lease.projectRoot, '.neocortex/state.json'), 'utf8')));
+        const state = applyGitLifecycleRuntimeOverlay(tracked, await readGitLifecycleRuntime(lease.projectRoot));
+        const current = asRecordOrUndefined(asRecordOrUndefined(state.stories)?.[lease.storyId]);
+        const persisted = asRecordOrUndefined(current?.checkpoint);
+        return persisted?.idempotencyKey === checkpoint.idempotencyKey
+            && persisted.headSha === checkpoint.headSha
+            && persisted.bundleDigest === checkpoint.bundleDigest
+            && asRecordOrUndefined(asRecordOrUndefined(state.epics)?.[lease.epicId])?.branch_lease === null
+            && await verifyAcceptedGitLifecycleStoryCheckpoint(lease.projectRoot, persisted, lease.storyId, lease.epicId, lease.executionBranch, undefined, lease.authorizedWriteSet);
+    }
+    catch {
+        return false;
+    }
+}
+async function readMatchingRootCheckpoint(lease, bundle, commit) {
+    try {
+        const tracked = asRecord(JSON.parse(await readFile(join(lease.projectRoot, '.neocortex/state.json'), 'utf8')));
+        const state = applyGitLifecycleRuntimeOverlay(tracked, await readGitLifecycleRuntime(lease.projectRoot));
+        const story = asRecordOrUndefined(asRecordOrUndefined(state.stories)?.[lease.storyId]);
+        const checkpoint = asRecordOrUndefined(story?.checkpoint);
+        if (checkpoint?.schemaVersion !== 1
+            || checkpoint.storyId !== lease.storyId
+            || checkpoint.epicId !== lease.epicId
+            || checkpoint.branch !== lease.executionBranch
+            || checkpoint.baseSha !== commit.baseSha
+            || checkpoint.headSha !== commit.headSha
+            || checkpoint.idempotencyKey !== lease.dispatchId
+            || checkpoint.dispatchId !== lease.dispatchId
+            || checkpoint.bundleId !== bundle.bundleId
+            || checkpoint.bundleDigest !== bundle.bundleDigest
+            || checkpoint.graphRevision !== lease.graphRevision
+            || checkpoint.claimRevision !== lease.claimRevision
+            || asRecordOrUndefined(asRecordOrUndefined(state.epics)?.[lease.epicId])?.branch_lease !== null
+            || !(await verifyAcceptedGitLifecycleStoryCheckpoint(lease.projectRoot, checkpoint, lease.storyId, lease.epicId, lease.executionBranch, undefined, lease.authorizedWriteSet)))
+            return undefined;
+        return checkpoint;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function findIntegratedDispatchCommit(lease, bundle) {
+    const matches = (await gitOptional(lease.projectRoot, [
+        'log', '--format=%H', '--fixed-strings', `--grep=Neocortex-Dispatch: ${lease.dispatchId}`,
+    ]))?.split('\n').filter((sha) => /^[a-f0-9]{40,64}$/.test(sha)) ?? [];
+    if (matches.length !== 1)
+        return undefined;
+    const headSha = matches[0];
+    if (!(await gitExitOk(lease.projectRoot, ['merge-base', '--is-ancestor', headSha, 'HEAD'])))
+        return undefined;
+    const message = await git(lease.projectRoot, ['show', '-s', '--format=%B', headSha]);
+    const trailers = new Set(message.split('\n').map((line) => line.trim()));
+    for (const trailer of [
+        `Neocortex-Story: ${lease.storyId}`,
+        `Neocortex-Epic: ${lease.epicId}`,
+        `Neocortex-Execution-Branch: ${lease.executionBranch}`,
+        `Neocortex-Prepared-Base: ${lease.baseSha}`,
+        `Neocortex-Dispatch: ${lease.dispatchId}`,
+        `Neocortex-Bundle: ${bundle.bundleId}`,
+        `Neocortex-Bundle-Digest: ${bundle.bundleDigest}`,
+        `Neocortex-Graph-Revision: ${lease.graphRevision}`,
+        `Neocortex-Claim-Revision: ${lease.claimRevision}`,
+    ])
+        if (!trailers.has(trailer))
+            return undefined;
+    const authorityRevision = readCommitTrailer(message, 'Neocortex-Checkpoint-Authority');
+    const authorityEpoch = readCommitTrailer(message, 'Neocortex-Checkpoint-Epoch');
+    const authorityStoryStatus = readCommitTrailer(message, 'Neocortex-Checkpoint-Story-Status');
+    if (!authorityRevision || !/^[a-f0-9]{64}$/.test(authorityRevision)
+        || !authorityEpoch || !(authorityEpoch === 'null' || /^[a-f0-9]{64}$/.test(authorityEpoch))
+        || !authorityStoryStatus || authorityStoryStatus.length > 80)
+        return undefined;
+    const parentSha = await gitOptional(lease.projectRoot, ['rev-parse', `${headSha}^`]);
+    if (!parentSha || !/^[a-f0-9]{40,64}$/.test(parentSha))
+        return undefined;
+    const committedPaths = splitNull(await gitRaw(lease.projectRoot, [
+        'diff-tree', '--no-commit-id', '--name-only', '-r', '-z', headSha,
+    ]));
+    if (committedPaths.length === 0 || committedPaths.some((path) => !bundle.authorizedWriteSet.some((scope) => writeSetCovers(scope, path))))
+        return undefined;
+    return {
+        baseSha: parentSha,
+        headSha,
+        checkpointAuthority: {
+            revision: authorityRevision,
+            epoch: authorityEpoch === 'null' ? null : authorityEpoch,
+            storyStatus: authorityStoryStatus === 'null' ? null : authorityStoryStatus,
+        },
+    };
+}
+function readCommitTrailer(message, name) {
+    const prefix = `${name}: `;
+    const matches = message.split('\n').map((line) => line.trim()).filter((line) => line.startsWith(prefix));
+    return matches.length === 1 ? matches[0].slice(prefix.length) : undefined;
+}
+async function writeMarker(markerPath, childHeadSha, rootHeadSha, bundle, checkpoint, beforeCommit) {
+    const integratedRoot = dirname(markerPath);
+    await assertGitLifecyclePrivateDirectory(integratedRoot, dirname(integratedRoot));
+    try {
+        await assertGitLifecyclePrivateFile(markerPath, integratedRoot);
+    }
+    catch (error) {
+        if (!isNodeError(error, 'ENOENT'))
+            throw error;
+    }
+    await writeOptional(integratedRoot, basename(markerPath), Buffer.from(`${JSON.stringify({ childHeadSha, rootHeadSha, bundle, checkpoint })}\n`), beforeCommit);
+    await assertGitLifecyclePrivateFile(markerPath, integratedRoot);
+}