@ornexus/neocortex 4.60.73 → 4.60.74

package/packages/client/dist/runner/headless/epic-terminal-git-runner.d.ts

@@ -1,5 +1,5 @@
 import { type EpicGitReconciliationDirective, type EpicTerminalGitDirective, type EpicTerminalGitReceipt, type GitReconciliationCandidate, type GitReconciliationDecision, type GitReconciliationReceipt } from '../../../../shared/dist/yoloop/epic-terminal-git.js';
-import { type P205TransientExecutionAuthority } from '../../git/git-lifecycle-store.js';
+import { type EpicTerminalReleaseAuthority, type P205TransientExecutionAuthority } from '../../git/git-lifecycle-store.js';
 import { type EpicMergeCandidateQaAuthority } from './epic-merge-candidate-qa.js';
 import type { EpicMergeCandidateQaReceipt } from '../../../../shared/dist/yoloop/epic-terminal-git.js';
 import type { EpicPullRequestMergeGuardReceipt } from '../../../../shared/dist/yoloop/epic-terminal-git.js';
@@ -11,6 +11,7 @@ export interface EpicTerminalGitSnapshot {
     readonly acceptedCheckpointIds: readonly string[];
     readonly existingReceipt?: EpicTerminalGitReceipt | null;
     readonly aggregateQaReceipt?: import('../../../../shared/dist/yoloop/epic-terminal-git.js').EpicAggregateQaReceipt | null;
+    readonly headReconciliationReceipt?: import('../../../../shared/dist/yoloop/epic-terminal-git.js').EpicHeadReconciliationReceiptV1 | null;
     readonly originBinding?: import('../../../../shared/dist/yoloop/epic-terminal-git.js').EpicOriginBindingEvidence | null;
     readonly nowIso?: string;
     readonly reconciliationCandidates: readonly GitReconciliationCandidate[];
@@ -31,6 +32,9 @@ export interface EpicTerminalGitAdapter {
     }): Promise<EpicTerminalEffectResult<{
         readonly originBindingCaptured: boolean;
         readonly aggregateQaRecorded: boolean;
+        readonly headReconciliationRecorded?: boolean;
+        readonly terminalAuthority?: EpicTerminalReleaseAuthority;
+        /** Backward-compatible alias for same-process fresh aggregate producers. */
         readonly p205Authority?: P205TransientExecutionAuthority;
     }>>;
     inspect(directive: EpicTerminalGitDirective): Promise<EpicTerminalEffectResult<{
@@ -73,10 +77,17 @@ export interface EpicTerminalGitAdapter {
         readonly candidateQa: EpicMergeCandidateQaReceipt;
         readonly candidateAuthority: EpicMergeCandidateQaAuthority;
         readonly idempotencyKey: string;
+        readonly terminalBinding?: {
+            readonly graphRevision: string;
+            readonly storyCheckpointIds: readonly string[];
+            readonly aggregateQaReceipt: EpicTerminalGitDirective['localGates']['aggregateQaReceipt'];
+            readonly nowIso: string;
+        };
     }): Promise<EpicTerminalEffectResult<{
         readonly prNumber: number;
     }>>;
     mergeEpicPullRequest(input: {
+        readonly epicId?: string;
         readonly prNumber: number;
         readonly originBranch: string;
         readonly executionBranch: string;
@@ -86,6 +97,11 @@ export interface EpicTerminalGitAdapter {
         readonly candidateQa?: EpicMergeCandidateQaReceipt;
         readonly candidateAuthority?: EpicMergeCandidateQaAuthority;
         readonly nowIso: string;
+        readonly terminalBinding?: {
+            readonly graphRevision: string;
+            readonly storyCheckpointIds: readonly string[];
+            readonly aggregateQaReceipt: EpicTerminalGitDirective['localGates']['aggregateQaReceipt'];
+        };
     }): Promise<EpicTerminalEffectResult<{
         readonly mergeSha: string;
         readonly pushedSha: string;
@@ -131,4 +147,4 @@ export interface EpicGitReconciliationExecutionResult {
 }
 /** Run the same fail-closed reconciler at start/resume or explicit audit. */
 export declare function executeEpicGitReconciliation(directive: EpicGitReconciliationDirective, adapter: EpicTerminalGitAdapter, now: () => string): Promise<EpicGitReconciliationExecutionResult>;
-export declare function executeEpicTerminalGit(directive: EpicTerminalGitDirective, adapter: EpicTerminalGitAdapter, now: () => string, preparedAuthority?: P205TransientExecutionAuthority): Promise<EpicTerminalGitExecutionResult>;
+export declare function executeEpicTerminalGit(directive: EpicTerminalGitDirective, adapter: EpicTerminalGitAdapter, now: () => string, preparedAuthority?: EpicTerminalReleaseAuthority): Promise<EpicTerminalGitExecutionResult>;

package/packages/client/dist/runner/headless/epic-terminal-git-runner.js

@@ -1,318 +1,2 @@
-/**
- * Root-owned terminal epic Git executor. Effects are adapter-injected so tests
- * never mutate real refs or provider resources.
- */
-import { createHash } from 'node:crypto';
-import { EPIC_TERMINAL_GIT_REASON_CODES, classifyGitReconciliationCandidate, validateEpicTerminalGitDirective, } from '../../../../shared/dist/yoloop/epic-terminal-git.js';
-import { p205TransientAuthorityMatchesAggregate, } from '../../git/git-lifecycle-store.js';
-import { verifiedEpicMergeCandidateReceipt, } from './epic-merge-candidate-qa.js';
-/** Run the same fail-closed reconciler at start/resume or explicit audit. */
-export async function executeEpicGitReconciliation(directive, adapter, now) {
-    const inspected = await adapter.inspectReconciliation(directive);
-    if (!inspected.ok) {
-        return { ok: false, reconciliationReceipts: [], preservedDecisions: [], reasonCodes: [inspected.reasonCode], publicSafe: true };
-    }
-    const reconciliation = await reconcileCandidates({
-        idempotencyKey: directive.idempotencyKey,
-        enabled: true,
-        dryRun: directive.dryRun,
-    }, inspected.candidates, adapter, now);
-    const persisted = await adapter.persistReconciliation({
-        epicId: directive.epicId,
-        reconciliationReceipts: reconciliation.receipts,
-        preservedDecisions: reconciliation.preserved,
-    });
-    const reasonCodes = unique([...reconciliation.reasonCodes, ...(persisted.ok ? [] : [persisted.reasonCode])]);
-    return {
-        ok: reconciliation.ok && persisted.ok,
-        reconciliationReceipts: reconciliation.receipts,
-        preservedDecisions: reconciliation.preserved,
-        reasonCodes,
-        publicSafe: true,
-    };
-}
-export async function executeEpicTerminalGit(directive, adapter, now, preparedAuthority) {
-    const startedAt = now();
-    if (!adapter.prepareLifecycleEvidence) {
-        return failedBeforeSnapshot(directive, {
-            ok: false, reasonCode: 'epic-aggregate-qa-producer-required', retryEligible: false, externalPolicy: false,
-        }, startedAt);
-    }
-    const produced = preparedAuthority
-        ? { ok: true, originBindingCaptured: false, aggregateQaRecorded: true, p205Authority: preparedAuthority }
-        : await adapter.prepareLifecycleEvidence({ epicId: directive.epicId, nowIso: startedAt });
-    if (!produced.ok)
-        return failedBeforeSnapshot(directive, produced, startedAt);
-    if (!produced.p205Authority) {
-        return failedBeforeSnapshot(directive, {
-            ok: false, reasonCode: 'epic-aggregate-qa-authority-required', retryEligible: false, externalPolicy: false,
-        }, startedAt);
-    }
-    const inspected = await adapter.inspect(directive);
-    if (!inspected.ok)
-        return failedBeforeSnapshot(directive, inspected, startedAt);
-    const snapshot = inspected.snapshot;
-    if (!p205TransientAuthorityMatchesAggregate(produced.p205Authority, snapshot.executionHeadSha, directive.graphRevision)) {
-        return failedBeforeSnapshot(directive, {
-            ok: false, reasonCode: 'epic-aggregate-qa-authority-binding-mismatch', retryEligible: false, externalPolicy: false,
-        }, startedAt);
-    }
-    const readiness = validateEpicTerminalGitDirective(directive, { ...snapshot, nowIso: startedAt });
-    if (!readiness.ready) {
-        return terminalResult(false, baseReceipt(directive, snapshot, startedAt, {
-            strategy: directive.strategy === 'single_pr' ? 'single_pr' : 'direct',
-            physicalStatus: 'blocked_local_or_repo',
-            retryEligible: readiness.reasonCodes.some((code) => code.endsWith('mismatch') || code.endsWith('active')),
-            reasonCodes: readiness.reasonCodes,
-        }), [], [], readiness.reasonCodes);
-    }
-    if (readiness.reasonCodes.includes(EPIC_TERMINAL_GIT_REASON_CODES.ALREADY_COMPLETE) && snapshot.existingReceipt) {
-        const verified = await adapter.verifyTerminalReceipt(directive, snapshot.existingReceipt, startedAt);
-        if (!verified.ok)
-            return terminalResult(false, snapshot.existingReceipt, [], [], [verified.reasonCode]);
-        const candidateQa = verifiedEpicMergeCandidateReceipt(verified.candidateAuthority, {
-            mergeSha: snapshot.existingReceipt.mergeSha, originHeadSha: snapshot.existingReceipt.baseSha,
-            executionHeadSha: snapshot.existingReceipt.executionHeadSha, graphRevision: directive.graphRevision,
-        });
-        if (!candidateQa)
-            return terminalResult(false, snapshot.existingReceipt, [], [], ['epic-merge-candidate-authority-required']);
-        const verifiedReceipt = {
-            ...snapshot.existingReceipt, candidateQa,
-            ...(verified.providerGuard ? { providerGuard: verified.providerGuard } : {}),
-        };
-        const reconciliation = await reconcileCandidates({ idempotencyKey: directive.idempotencyKey, enabled: directive.reconcile.enabled, dryRun: directive.reconcile.dryRun }, snapshot.reconciliationCandidates, adapter, now);
-        const persisted = await adapter.persist({
-            terminalReceipt: verifiedReceipt,
-            reconciliationReceipts: reconciliation.receipts,
-            preservedDecisions: reconciliation.preserved,
-        });
-        const reasons = unique([...readiness.reasonCodes, ...reconciliation.reasonCodes, ...(persisted.ok ? [] : [persisted.reasonCode])]);
-        return terminalResult(persisted.ok && reconciliation.ok, verifiedReceipt, reconciliation.receipts, reconciliation.preserved, reasons);
-    }
-    let receipt;
-    const prepared = await adapter.prepareMergeObject({
-        originBranch: directive.originBranch,
-        executionBranch: directive.executionBranch,
-        originHeadSha: snapshot.originHeadSha,
-        executionHeadSha: snapshot.executionHeadSha,
-        graphRevision: directive.graphRevision,
-        nowIso: startedAt,
-        message: [
-            `merge(${directive.epicId}): integrate ${directive.executionBranch} into ${directive.originBranch}`,
-            '',
-            `Neocortex-Epic: ${directive.epicId}`,
-            `Neocortex-Origin-Branch: ${directive.originBranch}`,
-            `Neocortex-Execution-Branch: ${directive.executionBranch}`,
-            `Neocortex-Execution-Head: ${snapshot.executionHeadSha}`,
-            `Neocortex-Origin-Base: ${snapshot.originHeadSha}`,
-            `Neocortex-Graph-Revision: ${directive.graphRevision}`,
-            `Neocortex-Aggregate-QA: ${directive.localGates.aggregateQaReceipt.receiptRef}`,
-            `Neocortex-Idempotency: ${directive.idempotencyKey}`,
-        ].join('\n'),
-    });
-    if (!prepared.ok) {
-        receipt = baseReceipt(directive, snapshot, startedAt, {
-            strategy: 'direct',
-            physicalStatus: 'blocked_local_or_repo',
-            retryEligible: prepared.retryEligible,
-            reasonCodes: [prepared.reasonCode],
-        });
-        await adapter.persist({ terminalReceipt: receipt, reconciliationReceipts: [], preservedDecisions: [] });
-        return terminalResult(false, receipt, [], [], receipt.reasonCodes);
-    }
-    const candidateQa = verifiedEpicMergeCandidateReceipt(prepared.candidateAuthority, {
-        originHeadSha: snapshot.originHeadSha, executionHeadSha: snapshot.executionHeadSha,
-        mergeSha: prepared.mergeSha, graphRevision: directive.graphRevision,
-    });
-    if (!candidateQa)
-        return failedBeforeSnapshot(directive, {
-            ok: false, reasonCode: 'epic-merge-candidate-authority-required', retryEligible: false, externalPolicy: false,
-        }, startedAt);
-    if (directive.strategy !== 'single_pr') {
-        const pushed = await adapter.pushMergeObject({
-            epicId: directive.epicId,
-            originBranch: directive.originBranch,
-            executionBranch: directive.executionBranch,
-            executionHeadSha: snapshot.executionHeadSha,
-            expectedOriginSha: snapshot.originHeadSha,
-            mergeSha: prepared.mergeSha,
-            graphRevision: directive.graphRevision,
-            candidateAuthority: prepared.candidateAuthority,
-            storyCheckpointIds: directive.storyCheckpointIds,
-            aggregateQaReceipt: directive.localGates.aggregateQaReceipt,
-            nowIso: now(),
-        });
-        if (pushed.ok) {
-            receipt = baseReceipt(directive, snapshot, startedAt, {
-                strategy: 'direct', mergeSha: prepared.mergeSha, pushedSha: pushed.pushedSha, candidateQa,
-                physicalStatus: 'pushed', retryEligible: false,
-                reasonCodes: [EPIC_TERMINAL_GIT_REASON_CODES.READY], completedAt: now(),
-            });
-        }
-        else if (directive.strategy === 'direct_or_single_pr' && pushed.externalPolicy) {
-            receipt = await executePullRequestFallback(directive, snapshot, adapter, startedAt, now, candidateQa, prepared.candidateAuthority);
-        }
-        else {
-            receipt = baseReceipt(directive, snapshot, startedAt, {
-                strategy: 'direct', mergeSha: prepared.mergeSha,
-                physicalStatus: pushed.externalPolicy ? 'denied_external_gate' : 'blocked_local_or_repo',
-                retryEligible: pushed.retryEligible,
-                reasonCodes: [pushed.reasonCode, ...(pushed.retryEligible ? [EPIC_TERMINAL_GIT_REASON_CODES.RETRY_ELIGIBLE] : [])],
-            });
-        }
-    }
-    else {
-        receipt = await executePullRequestFallback(directive, snapshot, adapter, startedAt, now, candidateQa, prepared.candidateAuthority);
-    }
-    const verified = receipt.physicalStatus === 'pushed'
-        ? await adapter.verifyTerminalReceipt(directive, receipt, now())
-        : null;
-    if (verified && !verified.ok) {
-        const failedReceipt = baseReceipt(directive, snapshot, startedAt, {
-            ...receipt,
-            physicalStatus: 'blocked_local_or_repo',
-            retryEligible: verified.retryEligible,
-            reasonCodes: [verified.reasonCode],
-        });
-        await adapter.persist({ terminalReceipt: failedReceipt, reconciliationReceipts: [], preservedDecisions: [] });
-        return terminalResult(false, failedReceipt, [], [], failedReceipt.reasonCodes);
-    }
-    if (verified?.ok) {
-        const accepted = verifiedEpicMergeCandidateReceipt(verified.candidateAuthority, {
-            mergeSha: receipt.mergeSha, originHeadSha: receipt.baseSha,
-            executionHeadSha: receipt.executionHeadSha, graphRevision: directive.graphRevision,
-        });
-        if (!accepted)
-            return terminalResult(false, receipt, [], [], ['epic-merge-candidate-authority-required']);
-        receipt = {
-            ...receipt, candidateQa: accepted,
-            ...(verified.providerGuard ? { providerGuard: verified.providerGuard } : {}),
-        };
-    }
-    const reconciliation = receipt.physicalStatus === 'pushed'
-        ? await reconcileCandidates({ idempotencyKey: directive.idempotencyKey, enabled: directive.reconcile.enabled, dryRun: directive.reconcile.dryRun }, snapshot.reconciliationCandidates, adapter, now)
-        : { ok: true, receipts: [], preserved: [], reasonCodes: [] };
-    const persisted = await adapter.persist({
-        terminalReceipt: receipt,
-        reconciliationReceipts: reconciliation.receipts,
-        preservedDecisions: reconciliation.preserved,
-    });
-    const reasons = unique([...receipt.reasonCodes, ...reconciliation.reasonCodes, ...(persisted.ok ? [] : [persisted.reasonCode])]);
-    return terminalResult(receipt.physicalStatus === 'pushed' && reconciliation.ok && persisted.ok, receipt, reconciliation.receipts, reconciliation.preserved, reasons);
-}
-async function executePullRequestFallback(directive, snapshot, adapter, startedAt, now, candidateQa, candidateAuthority) {
-    const pr = await adapter.ensureSingleEpicPullRequest({
-        epicId: directive.epicId,
-        originBranch: directive.originBranch,
-        executionBranch: directive.executionBranch,
-        expectedStoryHeadSha: snapshot.executionHeadSha,
-        expectedPullRequestHeadSha: candidateQa.mergeSha,
-        candidateQa,
-        candidateAuthority,
-        idempotencyKey: directive.idempotencyKey,
-    });
-    if (!pr.ok)
-        return baseReceipt(directive, snapshot, startedAt, {
-            strategy: 'single_pr', physicalStatus: pr.externalPolicy ? 'denied_external_gate' : 'blocked_local_or_repo',
-            retryEligible: pr.retryEligible, reasonCodes: [pr.reasonCode],
-        });
-    const merged = await adapter.mergeEpicPullRequest({
-        prNumber: pr.prNumber,
-        originBranch: directive.originBranch,
-        executionBranch: directive.executionBranch,
-        expectedStoryHeadSha: snapshot.executionHeadSha,
-        expectedPullRequestHeadSha: candidateQa.mergeSha,
-        expectedOriginHeadSha: snapshot.originHeadSha,
-        candidateQa, candidateAuthority, nowIso: now(),
-    });
-    if (!merged.ok)
-        return baseReceipt(directive, snapshot, startedAt, {
-            strategy: 'single_pr', prNumber: pr.prNumber,
-            physicalStatus: merged.externalPolicy ? 'denied_external_gate' : 'blocked_local_or_repo',
-            retryEligible: merged.retryEligible,
-            reasonCodes: [merged.reasonCode, ...(merged.retryEligible ? [EPIC_TERMINAL_GIT_REASON_CODES.RETRY_ELIGIBLE] : [])],
-        });
-    return baseReceipt(directive, snapshot, startedAt, {
-        strategy: 'single_pr', prNumber: pr.prNumber, mergeSha: merged.mergeSha, pushedSha: merged.pushedSha, candidateQa,
-        providerGuard: merged.providerGuard,
-        physicalStatus: 'pushed', retryEligible: false,
-        reasonCodes: [EPIC_TERMINAL_GIT_REASON_CODES.READY], completedAt: now(),
-    });
-}
-async function reconcileCandidates(directive, candidates, adapter, now) {
-    if (!directive.enabled)
-        return { ok: true, receipts: [], preserved: [], reasonCodes: [] };
-    const receipts = [];
-    const preserved = [];
-    const reasons = [];
-    let ok = true;
-    const failedPrBranches = new Set();
-    const order = { pull_request: 0, local_branch: 1, remote_branch: 2 };
-    for (const candidate of [...candidates].sort((a, b) => order[a.kind] - order[b.kind] || a.resourceId.localeCompare(b.resourceId))) {
-        const decision = classifyGitReconciliationCandidate(candidate);
-        reasons.push(...decision.reasonCodes);
-        if (decision.action === 'preserve') {
-            preserved.push(decision);
-            continue;
-        }
-        if (candidate.kind !== 'pull_request' && failedPrBranches.has(candidate.branchName)) {
-            preserved.push({ ...decision, action: 'preserve', reasonCodes: ['git-resource-related-pr-close-pending'] });
-            reasons.push('git-resource-related-pr-close-pending');
-            continue;
-        }
-        // Stable across start/resume/terminal directives; no long branch name or
-        // unbounded parent id can overflow the public receipt schema.
-        const receiptKey = `reconciliation:v2:${createHash('sha256').update([candidate.resourceId, decision.action].join('\0')).digest('hex')}`;
-        const applied = await adapter.applyReconciliation(candidate, decision, directive.dryRun);
-        if (!applied.ok) {
-            ok = false;
-            if (candidate.kind === 'pull_request')
-                failedPrBranches.add(candidate.branchName);
-            reasons.push(applied.reasonCode);
-            receipts.push({
-                schemaVersion: 1, resourceId: candidate.resourceId, action: decision.action,
-                outcome: 'failed', idempotencyKey: receiptKey,
-                reasonCodes: [applied.reasonCode], recordedAt: now(), publicSafe: true,
-            });
-            continue;
-        }
-        receipts.push({
-            schemaVersion: 1, resourceId: candidate.resourceId, action: decision.action,
-            outcome: applied.outcome, idempotencyKey: receiptKey,
-            reasonCodes: decision.reasonCodes, recordedAt: now(), publicSafe: true,
-        });
-    }
-    return { ok, receipts, preserved, reasonCodes: unique(reasons) };
-}
-function baseReceipt(directive, snapshot, startedAt, override) {
-    return Object.freeze({
-        schemaVersion: 1,
-        epicId: directive.epicId,
-        executionBranch: directive.executionBranch,
-        originBranch: directive.originBranch,
-        baseSha: snapshot.originHeadSha,
-        executionHeadSha: snapshot.executionHeadSha,
-        localGateReceiptRefs: directive.localGates.receiptRefs,
-        idempotencyKey: directive.idempotencyKey,
-        attemptStartedAt: startedAt,
-        publicSafe: true,
-        ...override,
-    });
-}
-function failedBeforeSnapshot(directive, failure, startedAt) {
-    const placeholder = '0'.repeat(40);
-    const receipt = {
-        schemaVersion: 1, epicId: directive.epicId, executionBranch: directive.executionBranch, originBranch: directive.originBranch,
-        baseSha: placeholder, executionHeadSha: directive.expectedExecutionHeadSha, strategy: directive.strategy === 'single_pr' ? 'single_pr' : 'direct',
-        physicalStatus: failure.externalPolicy ? 'denied_external_gate' : 'blocked_local_or_repo',
-        localGateReceiptRefs: directive.localGates.receiptRefs, idempotencyKey: directive.idempotencyKey,
-        attemptStartedAt: startedAt, retryEligible: failure.retryEligible, reasonCodes: [failure.reasonCode], publicSafe: true,
-    };
-    return terminalResult(false, receipt, [], [], receipt.reasonCodes);
-}
-function terminalResult(ok, receipt, reconciliationReceipts, preservedDecisions, reasonCodes) {
-    return { ok, receipt, reconciliationReceipts, preservedDecisions, reasonCodes: unique(reasonCodes), publicSafe: true };
-}
-function unique(values) {
-    return [...new Set(values)];
-}
+import{createHash as w}from"node:crypto";import{EPIC_TERMINAL_GIT_REASON_CODES as x,classifyGitReconciliationCandidate as N,validateEpicTerminalGitDirective as q}from"../../../../shared/dist/yoloop/epic-terminal-git.js";import{consumeEpicTerminalReleaseAuthority as P}from"../../git/git-lifecycle-store.js";import{verifiedEpicMergeCandidateReceipt as E}from"./epic-merge-candidate-qa.js";async function O(e,r,s){const c=await r.inspectReconciliation(e);if(!c.ok)return{ok:!1,reconciliationReceipts:[],preservedDecisions:[],reasonCodes:[c.reasonCode],publicSafe:!0};const o=await k({idempotencyKey:e.idempotencyKey,enabled:!0,dryRun:e.dryRun},c.candidates,r,s),l=await r.persistReconciliation({epicId:e.epicId,reconciliationReceipts:o.receipts,preservedDecisions:o.preserved}),u=C([...o.reasonCodes,...l.ok?[]:[l.reasonCode]]);return{ok:o.ok&&l.ok,reconciliationReceipts:o.receipts,preservedDecisions:o.preserved,reasonCodes:u,publicSafe:!0}}async function T(e,r,s,c){const o=s();if(!r.prepareLifecycleEvidence)return S(e,{ok:!1,reasonCode:"epic-aggregate-qa-producer-required",retryEligible:!1,externalPolicy:!1},o);const l=c?{ok:!0,originBindingCaptured:!1,aggregateQaRecorded:!0,terminalAuthority:c}:await r.prepareLifecycleEvidence({epicId:e.epicId,nowIso:o});if(!l.ok)return S(e,l,o);const u=l.terminalAuthority??l.p205Authority;if(!u)return S(e,{ok:!1,reasonCode:"epic-aggregate-qa-authority-required",retryEligible:!1,externalPolicy:!1},o);const p=await r.inspect(e);if(!p.ok)return S(e,p,o);const a=p.snapshot,h=q(e,{...a,nowIso:o});if(!h.ready)return y(!1,R(e,a,o,{strategy:e.strategy==="single_pr"?"single_pr":"direct",physicalStatus:"blocked_local_or_repo",retryEligible:h.reasonCodes.some(t=>t.endsWith("mismatch")||t.endsWith("active")),reasonCodes:h.reasonCodes}),[],[],h.reasonCodes);if(!a.aggregateQaReceipt||!P(u,{executionHeadSha:a.executionHeadSha,graphRevision:e.graphRevision,aggregateQaReceipt:a.aggregateQaReceipt,headReconciliationReceipt:a.headReconciliationReceipt}))return S(e,{ok:!1,reasonCode:"epic-aggregate-qa-authority-binding-mismatch",retryEligible:!1,externalPolicy:!1},o);if(h.reasonCodes.includes(x.ALREADY_COMPLETE)&&a.existingReceipt){const t=await r.verifyTerminalReceipt(e,a.existingReceipt,o);if(!t.ok)return y(!1,a.existingReceipt,[],[],[t.reasonCode]);const I=E(t.candidateAuthority,{mergeSha:a.existingReceipt.mergeSha,originHeadSha:a.existingReceipt.baseSha,executionHeadSha:a.existingReceipt.executionHeadSha,graphRevision:e.graphRevision});if(!I)return y(!1,a.existingReceipt,[],[],["epic-merge-candidate-authority-required"]);const B={...a.existingReceipt,candidateQa:I,...t.providerGuard?{providerGuard:t.providerGuard}:{}},f=await k({idempotencyKey:e.idempotencyKey,enabled:e.reconcile.enabled,dryRun:e.reconcile.dryRun},a.reconciliationCandidates,r,s),_=await r.persist({terminalReceipt:B,reconciliationReceipts:f.receipts,preservedDecisions:f.preserved}),A=C([...h.reasonCodes,...f.reasonCodes,..._.ok?[]:[_.reasonCode]]);return y(_.ok&&f.ok,B,f.receipts,f.preserved,A)}let i;const n=await r.prepareMergeObject({originBranch:e.originBranch,executionBranch:e.executionBranch,originHeadSha:a.originHeadSha,executionHeadSha:a.executionHeadSha,graphRevision:e.graphRevision,nowIso:o,message:[`merge(${e.epicId}): integrate ${e.executionBranch} into ${e.originBranch}`,"",`Neocortex-Epic: ${e.epicId}`,`Neocortex-Origin-Branch: ${e.originBranch}`,`Neocortex-Execution-Branch: ${e.executionBranch}`,`Neocortex-Execution-Head: ${a.executionHeadSha}`,`Neocortex-Origin-Base: ${a.originHeadSha}`,`Neocortex-Graph-Revision: ${e.graphRevision}`,`Neocortex-Aggregate-QA: ${e.localGates.aggregateQaReceipt.receiptRef}`,`Neocortex-Idempotency: ${e.idempotencyKey}`].join(`
+`)});if(!n.ok)return i=R(e,a,o,{strategy:"direct",physicalStatus:"blocked_local_or_repo",retryEligible:n.retryEligible,reasonCodes:[n.reasonCode]}),await r.persist({terminalReceipt:i,reconciliationReceipts:[],preservedDecisions:[]}),y(!1,i,[],[],i.reasonCodes);const g=E(n.candidateAuthority,{originHeadSha:a.originHeadSha,executionHeadSha:a.executionHeadSha,mergeSha:n.mergeSha,graphRevision:e.graphRevision});if(!g)return S(e,{ok:!1,reasonCode:"epic-merge-candidate-authority-required",retryEligible:!1,externalPolicy:!1},o);if(e.strategy!=="single_pr"){const t=await r.pushMergeObject({epicId:e.epicId,originBranch:e.originBranch,executionBranch:e.executionBranch,executionHeadSha:a.executionHeadSha,expectedOriginSha:a.originHeadSha,mergeSha:n.mergeSha,graphRevision:e.graphRevision,candidateAuthority:n.candidateAuthority,storyCheckpointIds:e.storyCheckpointIds,aggregateQaReceipt:e.localGates.aggregateQaReceipt,nowIso:s()});t.ok?i=R(e,a,o,{strategy:"direct",mergeSha:n.mergeSha,pushedSha:t.pushedSha,candidateQa:g,physicalStatus:"pushed",retryEligible:!1,reasonCodes:[x.READY],completedAt:s()}):e.strategy==="direct_or_single_pr"&&t.externalPolicy?i=await H(e,a,r,o,s,g,n.candidateAuthority):i=R(e,a,o,{strategy:"direct",mergeSha:n.mergeSha,physicalStatus:t.externalPolicy?"denied_external_gate":"blocked_local_or_repo",retryEligible:t.retryEligible,reasonCodes:[t.reasonCode,...t.retryEligible?[x.RETRY_ELIGIBLE]:[]]})}else i=await H(e,a,r,o,s,g,n.candidateAuthority);const d=i.physicalStatus==="pushed"?await r.verifyTerminalReceipt(e,i,s()):null;if(d&&!d.ok){const t=R(e,a,o,{...i,physicalStatus:"blocked_local_or_repo",retryEligible:d.retryEligible,reasonCodes:[d.reasonCode]});return await r.persist({terminalReceipt:t,reconciliationReceipts:[],preservedDecisions:[]}),y(!1,t,[],[],t.reasonCodes)}if(d?.ok){const t=E(d.candidateAuthority,{mergeSha:i.mergeSha,originHeadSha:i.baseSha,executionHeadSha:i.executionHeadSha,graphRevision:e.graphRevision});if(!t)return y(!1,i,[],[],["epic-merge-candidate-authority-required"]);i={...i,candidateQa:t,...d.providerGuard?{providerGuard:d.providerGuard}:{}}}const m=i.physicalStatus==="pushed"?await k({idempotencyKey:e.idempotencyKey,enabled:e.reconcile.enabled,dryRun:e.reconcile.dryRun},a.reconciliationCandidates,r,s):{ok:!0,receipts:[],preserved:[],reasonCodes:[]},b=await r.persist({terminalReceipt:i,reconciliationReceipts:m.receipts,preservedDecisions:m.preserved}),G=C([...i.reasonCodes,...m.reasonCodes,...b.ok?[]:[b.reasonCode]]);return y(i.physicalStatus==="pushed"&&m.ok&&b.ok,i,m.receipts,m.preserved,G)}async function H(e,r,s,c,o,l,u){const p=await s.ensureSingleEpicPullRequest({epicId:e.epicId,originBranch:e.originBranch,executionBranch:e.executionBranch,expectedStoryHeadSha:r.executionHeadSha,expectedPullRequestHeadSha:l.mergeSha,candidateQa:l,candidateAuthority:u,idempotencyKey:e.idempotencyKey,terminalBinding:{graphRevision:e.graphRevision,storyCheckpointIds:e.storyCheckpointIds,aggregateQaReceipt:e.localGates.aggregateQaReceipt,nowIso:o()}});if(!p.ok)return R(e,r,c,{strategy:"single_pr",physicalStatus:p.externalPolicy?"denied_external_gate":"blocked_local_or_repo",retryEligible:p.retryEligible,reasonCodes:[p.reasonCode]});const a=await s.mergeEpicPullRequest({epicId:e.epicId,prNumber:p.prNumber,originBranch:e.originBranch,executionBranch:e.executionBranch,expectedStoryHeadSha:r.executionHeadSha,expectedPullRequestHeadSha:l.mergeSha,expectedOriginHeadSha:r.originHeadSha,candidateQa:l,candidateAuthority:u,nowIso:o(),terminalBinding:{graphRevision:e.graphRevision,storyCheckpointIds:e.storyCheckpointIds,aggregateQaReceipt:e.localGates.aggregateQaReceipt}});return a.ok?R(e,r,c,{strategy:"single_pr",prNumber:p.prNumber,mergeSha:a.mergeSha,pushedSha:a.pushedSha,candidateQa:l,providerGuard:a.providerGuard,physicalStatus:"pushed",retryEligible:!1,reasonCodes:[x.READY],completedAt:o()}):R(e,r,c,{strategy:"single_pr",prNumber:p.prNumber,physicalStatus:a.externalPolicy?"denied_external_gate":"blocked_local_or_repo",retryEligible:a.retryEligible,reasonCodes:[a.reasonCode,...a.retryEligible?[x.RETRY_ELIGIBLE]:[]]})}async function k(e,r,s,c){if(!e.enabled)return{ok:!0,receipts:[],preserved:[],reasonCodes:[]};const o=[],l=[],u=[];let p=!0;const a=new Set,h={pull_request:0,local_branch:1,remote_branch:2};for(const i of[...r].sort((n,g)=>h[n.kind]-h[g.kind]||n.resourceId.localeCompare(g.resourceId))){const n=N(i);if(u.push(...n.reasonCodes),n.action==="preserve"){l.push(n);continue}if(i.kind!=="pull_request"&&a.has(i.branchName)){l.push({...n,action:"preserve",reasonCodes:["git-resource-related-pr-close-pending"]}),u.push("git-resource-related-pr-close-pending");continue}const g=`reconciliation:v2:${w("sha256").update([i.resourceId,n.action].join("\0")).digest("hex")}`,d=await s.applyReconciliation(i,n,e.dryRun);if(!d.ok){p=!1,i.kind==="pull_request"&&a.add(i.branchName),u.push(d.reasonCode),o.push({schemaVersion:1,resourceId:i.resourceId,action:n.action,outcome:"failed",idempotencyKey:g,reasonCodes:[d.reasonCode],recordedAt:c(),publicSafe:!0});continue}o.push({schemaVersion:1,resourceId:i.resourceId,action:n.action,outcome:d.outcome,idempotencyKey:g,reasonCodes:n.reasonCodes,recordedAt:c(),publicSafe:!0})}return{ok:p,receipts:o,preserved:l,reasonCodes:C(u)}}function R(e,r,s,c){return Object.freeze({schemaVersion:1,epicId:e.epicId,executionBranch:e.executionBranch,originBranch:e.originBranch,baseSha:r.originHeadSha,executionHeadSha:r.executionHeadSha,localGateReceiptRefs:e.localGates.receiptRefs,idempotencyKey:e.idempotencyKey,attemptStartedAt:s,publicSafe:!0,...c})}function S(e,r,s){const c="0".repeat(40),o={schemaVersion:1,epicId:e.epicId,executionBranch:e.executionBranch,originBranch:e.originBranch,baseSha:c,executionHeadSha:e.expectedExecutionHeadSha,strategy:e.strategy==="single_pr"?"single_pr":"direct",physicalStatus:r.externalPolicy?"denied_external_gate":"blocked_local_or_repo",localGateReceiptRefs:e.localGates.receiptRefs,idempotencyKey:e.idempotencyKey,attemptStartedAt:s,retryEligible:r.retryEligible,reasonCodes:[r.reasonCode],publicSafe:!0};return y(!1,o,[],[],o.reasonCodes)}function y(e,r,s,c,o){return{ok:e,receipt:r,reconciliationReceipts:s,preservedDecisions:c,reasonCodes:C(o),publicSafe:!0}}function C(e){return[...new Set(e)]}export{O as executeEpicGitReconciliation,T as executeEpicTerminalGit};

package/packages/client/dist/runner/headless/fake-adapter.js

@@ -1,62 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * P190.04 -- deterministic fake headless adapter for tests.
- */
-import { HEADLESS_REASON_CODES, adapterAvailabilitySuccess, createRejectedExecutionResult, hashPublicValue, redaction, renderHeadlessPrompt, validateHeadlessAdapterExecutionInput, } from './types.js';
-export function createFakeHeadlessAdapter(id = 'fake') {
-    return {
-        id,
-        displayName: id === 'test' ? 'Headless Test Adapter' : 'Headless Fake Adapter',
-        async checkAvailability() {
-            return adapterAvailabilitySuccess(id, 'neocortex-headless-fake', 'Fake headless adapter is available for deterministic tests.');
-        },
-        buildInvocation(input) {
-            const validation = validateHeadlessAdapterExecutionInput(input, id);
-            if (!validation.ok)
-                return validation;
-            return {
-                ok: true,
-                invocation: {
-                    adapterId: id,
-                    commandName: 'neocortex-headless-fake',
-                    args: [validation.input.promptKind, validation.input.targetRef],
-                    promptHash: validation.promptHash,
-                    ...(validation.input.modelId ? { modelId: validation.input.modelId } : {}),
-                    timeoutMs: validation.input.timeoutMs ?? 10 * 60 * 1000,
-                    publicSafe: true,
-                },
-                publicSafe: true,
-            };
-        },
-        async execute(input, _options) {
-            const validation = validateHeadlessAdapterExecutionInput(input, id);
-            if (!validation.ok)
-                return createRejectedExecutionResult(id, id, validation);
-            const prompt = renderHeadlessPrompt(validation.input);
-            return {
-                status: 'completed',
-                adapterId: id,
-                runtimeId: id,
-                ...(validation.input.modelId ? { modelId: validation.input.modelId } : {}),
-                ...(validation.input.runtimeSource ? { runtimeSource: validation.input.runtimeSource } : {}),
-                reasonCode: HEADLESS_REASON_CODES.EXECUTION_COMPLETED,
-                reasonCodes: [HEADLESS_REASON_CODES.EXECUTION_COMPLETED, HEADLESS_REASON_CODES.RECEIPT_REDACTED],
-                exitCode: 0,
-                signal: null,
-                durationMs: 0,
-                counts: { prompts: 1, syntheticRuns: 1 },
-                hashes: {
-                    prompt: hashPublicValue(prompt),
-                    receipt: hashPublicValue(`${id}:${validation.input.targetRef}:${validation.input.modelId ?? ''}`),
-                },
-                publicSummary: 'Fake headless adapter completed deterministic public-safe execution.',
-                redactionSummary: [redaction('prompt', 'prompt_body', hashPublicValue(prompt))],
-                relativePaths: [validation.input.targetRef],
-                ...(validation.input.receipt ? { receipt: validation.input.receipt } : {}),
-                publicSafe: true,
-            };
-        },
-    };
-}
+import{HEADLESS_REASON_CODES as i,adapterAvailabilitySuccess as u,createRejectedExecutionResult as s,hashPublicValue as n,redaction as d,renderHeadlessPrompt as c,validateHeadlessAdapterExecutionInput as p}from"./types.js";function m(t="fake"){return{id:t,displayName:t==="test"?"Headless Test Adapter":"Headless Fake Adapter",async checkAvailability(){return u(t,"neocortex-headless-fake","Fake headless adapter is available for deterministic tests.")},buildInvocation(r){const a=p(r,t);return a.ok?{ok:!0,invocation:{adapterId:t,commandName:"neocortex-headless-fake",args:[a.input.promptKind,a.input.targetRef],promptHash:a.promptHash,...a.input.modelId?{modelId:a.input.modelId}:{},timeoutMs:a.input.timeoutMs??600*1e3,publicSafe:!0},publicSafe:!0}:a},async execute(r,a){const e=p(r,t);if(!e.ok)return s(t,t,e);const o=c(e.input);return{status:"completed",adapterId:t,runtimeId:t,...e.input.modelId?{modelId:e.input.modelId}:{},...e.input.runtimeSource?{runtimeSource:e.input.runtimeSource}:{},reasonCode:i.EXECUTION_COMPLETED,reasonCodes:[i.EXECUTION_COMPLETED,i.RECEIPT_REDACTED],exitCode:0,signal:null,durationMs:0,counts:{prompts:1,syntheticRuns:1},hashes:{prompt:n(o),receipt:n(`${t}:${e.input.targetRef}:${e.input.modelId??""}`)},publicSummary:"Fake headless adapter completed deterministic public-safe execution.",redactionSummary:[d("prompt","prompt_body",n(o))],relativePaths:[e.input.targetRef],...e.input.receipt?{receipt:e.input.receipt}:{},publicSafe:!0}}}}export{m as createFakeHeadlessAdapter};

package/packages/client/dist/runner/headless/managed-profile.js

@@ -1,132 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * P201.12 -- fixed-path managed profile and effective policy preflight.
- */
-import { lstatSync, readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-import { getSubagentApprovalPolicy } from '../../config.js';
-import { HEADLESS_REASON_CODES, boundPublicSummary, hashPublicValue, redaction, } from './types.js';
-export const GOVERNED_HEADLESS_EVIDENCE = '[P201-EV-HEADLESS]';
-const MAX_PROFILE_BYTES = 96 * 1024;
-export function preflightManagedHeadlessProfile(adapterId, options) {
-    const candidates = managedProfileCandidates(adapterId, options);
-    for (const candidate of candidates) {
-        let stat;
-        try {
-            stat = lstatSync(candidate);
-        }
-        catch (error) {
-            if (error.code === 'ENOENT')
-                continue;
-            return invalidProfile();
-        }
-        if (stat.isSymbolicLink() || !stat.isFile() || stat.size <= 0 || stat.size > MAX_PROFILE_BYTES) {
-            return invalidProfile();
-        }
-        try {
-            const content = readFileSync(candidate, 'utf8');
-            if (!isGovernedProfile(adapterId, content))
-                return invalidProfile();
-            return validateEffectiveApprovalPolicy(adapterId, options);
-        }
-        catch {
-            return invalidProfile();
-        }
-    }
-    return failure(HEADLESS_REASON_CODES.MANAGED_PROFILE_MISSING, 'Managed neocortex profile was not found in a trusted host location.');
-}
-export function governedPreflightFailureResult(adapterId, input, preflight) {
-    return {
-        status: 'failed',
-        adapterId,
-        runtimeId: input.runtimeId,
-        ...(input.modelId ? { modelId: input.modelId } : {}),
-        ...(input.runtimeSource ? { runtimeSource: input.runtimeSource } : {}),
-        reasonCode: preflight.reasonCode,
-        reasonCodes: [preflight.reasonCode, HEADLESS_REASON_CODES.RECEIPT_REDACTED],
-        durationMs: 0,
-        counts: { governedPreflightDenials: 1 },
-        hashes: { governanceEvidence: hashPublicValue(GOVERNED_HEADLESS_EVIDENCE) },
-        publicSummary: preflight.publicSummary,
-        redactionSummary: [redaction('managedProfile', 'managed_profile', 'value-denied')],
-        relativePaths: [input.targetRef],
-        ...(input.receipt ? { receipt: input.receipt } : {}),
-        publicSafe: true,
-    };
-}
-export function withGovernedHeadlessEvidence(result) {
-    return {
-        ...result,
-        counts: { ...result.counts, governedPreflightPasses: 1 },
-        hashes: { ...result.hashes, governanceEvidence: hashPublicValue(GOVERNED_HEADLESS_EVIDENCE) },
-        publicSummary: boundPublicSummary(`${result.publicSummary} ${GOVERNED_HEADLESS_EVIDENCE}`),
-    };
-}
-function managedProfileCandidates(adapterId, options) {
-    const candidates = [];
-    if (options.cwd) {
-        candidates.push(adapterId === 'claude-code'
-            ? join(options.cwd, '.claude', 'agents', 'neocortex', 'neocortex.md')
-            : join(options.cwd, '.opencode', 'agents', 'neocortex.md'));
-    }
-    const home = trustedHome(options.env);
-    if (!home)
-        return candidates;
-    if (adapterId === 'claude-code') {
-        candidates.push(join(home, '.claude', 'agents', 'neocortex', 'neocortex.md'));
-    }
-    else {
-        const configHome = options.env?.OPENCODE_HOME
-            || join(options.env?.XDG_CONFIG_HOME || join(home, '.config'), 'opencode');
-        candidates.push(join(configHome, 'agents', 'neocortex.md'));
-        candidates.push(join(home, '.opencode', 'agents', 'neocortex.md'));
-    }
-    return Array.from(new Set(candidates));
-}
-function trustedHome(env) {
-    const candidate = env ? env.HOME || env.USERPROFILE : homedir();
-    return candidate && !/[\r\n\0]/.test(candidate) ? candidate : undefined;
-}
-function isGovernedProfile(adapterId, content) {
-    if (Buffer.byteLength(content) > MAX_PROFILE_BYTES)
-        return false;
-    if (adapterId === 'claude-code') {
-        return /^---\r?\n[\s\S]*?^name:\s*neocortex\s*$[\s\S]*?^permissionMode:\s*bypassPermissions\s*$[\s\S]*?^disallowedTools:\s*Agent,\s*Task\s*$[\s\S]*?^---\s*$/m.test(content)
-            && content.includes('Child depth is bounded to one.')
-            && content.includes('Never pass the original root invocation');
-    }
-    return /^---\r?\n[\s\S]*?^name:\s*neocortex\s*$[\s\S]*?^mode:\s*subagent\s*$[\s\S]*?^\s+"\*":\s*allow\s*$[\s\S]*?^\s+task:\s*deny\s*$[\s\S]*?^---\s*$/m.test(content)
-        && content.includes('Never pass the original root invocation')
-        && content.includes('root OpenCode agent remains the yoloop owner');
-}
-function validateEffectiveApprovalPolicy(adapterId, options) {
-    try {
-        const home = trustedHome(options.env);
-        const resolution = getSubagentApprovalPolicy({
-            ...(home ? { configFilePath: join(home, '.neocortex', 'config.json') } : {}),
-            platformTarget: adapterId,
-            hostPolicy: options.approvalHostPolicy,
-        }).resolution;
-        if (resolution.requestedMode !== 'max' || resolution.effectiveMode !== 'max') {
-            return failure(HEADLESS_REASON_CODES.APPROVAL_POLICY_MISMATCH, 'Managed max profile did not match the effective subagent approval policy.');
-        }
-        return { ok: true, publicSafe: true };
-    }
-    catch {
-        return failure(HEADLESS_REASON_CODES.APPROVAL_POLICY_INVALID, 'Managed subagent approval policy could not be validated safely.');
-    }
-}
-function failure(reasonCode, summary) {
-    return {
-        ok: false,
-        reasonCode,
-        publicSummary: boundPublicSummary(`${summary} ${GOVERNED_HEADLESS_EVIDENCE}`),
-        publicSafe: true,
-    };
-}
-function invalidProfile() {
-    return failure(HEADLESS_REASON_CODES.MANAGED_PROFILE_INVALID, 'Managed neocortex profile failed bounded identity, approval, or isolation validation.');
-}
+import{lstatSync as E,readFileSync as g}from"node:fs";import{homedir as p}from"node:os";import{join as t}from"node:path";import{getSubagentApprovalPolicy as h}from"../../config.js";import{HEADLESS_REASON_CODES as i,boundPublicSummary as l,hashPublicValue as f,redaction as v}from"./types.js";const s="[P201-EV-HEADLESS]",m=96*1024;function M(o,e){const r=P(o,e);for(const n of r){let a;try{a=E(n)}catch(u){if(u.code==="ENOENT")continue;return d()}if(a.isSymbolicLink()||!a.isFile()||a.size<=0||a.size>m)return d();try{const u=g(n,"utf8");return y(o,u)?b(o,e):d()}catch{return d()}}return c(i.MANAGED_PROFILE_MISSING,"Managed neocortex profile was not found in a trusted host location.")}function C(o,e,r){return{status:"failed",adapterId:o,runtimeId:e.runtimeId,...e.modelId?{modelId:e.modelId}:{},...e.runtimeSource?{runtimeSource:e.runtimeSource}:{},reasonCode:r.reasonCode,reasonCodes:[r.reasonCode,i.RECEIPT_REDACTED],durationMs:0,counts:{governedPreflightDenials:1},hashes:{governanceEvidence:f(s)},publicSummary:r.publicSummary,redactionSummary:[v("managedProfile","managed_profile","value-denied")],relativePaths:[e.targetRef],...e.receipt?{receipt:e.receipt}:{},publicSafe:!0}}function D(o){return{...o,counts:{...o.counts,governedPreflightPasses:1},hashes:{...o.hashes,governanceEvidence:f(s)},publicSummary:l(`${o.publicSummary} ${s}`)}}function P(o,e){const r=[];e.cwd&&r.push(o==="claude-code"?t(e.cwd,".claude","agents","neocortex","neocortex.md"):t(e.cwd,".opencode","agents","neocortex.md"));const n=S(e.env);if(!n)return r;if(o==="claude-code")r.push(t(n,".claude","agents","neocortex","neocortex.md"));else{const a=e.env?.OPENCODE_HOME||t(e.env?.XDG_CONFIG_HOME||t(n,".config"),"opencode");r.push(t(a,"agents","neocortex.md")),r.push(t(n,".opencode","agents","neocortex.md"))}return Array.from(new Set(r))}function S(o){const e=o?o.HOME||o.USERPROFILE:p();return e&&!/[\r\n\0]/.test(e)?e:void 0}function y(o,e){return Buffer.byteLength(e)>m?!1:o==="claude-code"?/^---\r?\n[\s\S]*?^name:\s*neocortex\s*$[\s\S]*?^permissionMode:\s*bypassPermissions\s*$[\s\S]*?^disallowedTools:\s*Agent,\s*Task\s*$[\s\S]*?^---\s*$/m.test(e)&&e.includes("Child depth is bounded to one.")&&e.includes("Never pass the original root invocation"):/^---\r?\n[\s\S]*?^name:\s*neocortex\s*$[\s\S]*?^mode:\s*subagent\s*$[\s\S]*?^\s+"\*":\s*allow\s*$[\s\S]*?^\s+task:\s*deny\s*$[\s\S]*?^---\s*$/m.test(e)&&e.includes("Never pass the original root invocation")&&e.includes("root OpenCode agent remains the yoloop owner")}function b(o,e){try{const r=S(e.env),n=h({...r?{configFilePath:t(r,".neocortex","config.json")}:{},platformTarget:o,hostPolicy:e.approvalHostPolicy}).resolution;return n.requestedMode!=="max"||n.effectiveMode!=="max"?c(i.APPROVAL_POLICY_MISMATCH,"Managed max profile did not match the effective subagent approval policy."):{ok:!0,publicSafe:!0}}catch{return c(i.APPROVAL_POLICY_INVALID,"Managed subagent approval policy could not be validated safely.")}}function c(o,e){return{ok:!1,reasonCode:o,publicSummary:l(`${e} ${s}`),publicSafe:!0}}function d(){return c(i.MANAGED_PROFILE_INVALID,"Managed neocortex profile failed bounded identity, approval, or isolation validation.")}export{s as GOVERNED_HEADLESS_EVIDENCE,C as governedPreflightFailureResult,M as preflightManagedHeadlessProfile,D as withGovernedHeadlessEvidence};