@ornexus/neocortex 4.60.73 → 4.60.75

package/packages/client/dist/runner/headless/continuous-story-workspace.js

@@ -1,21 +1,4 @@
-/**
- * Branchless preparation sandboxes for continuous yoloop children.
- *
- * A child receives an independent Git index at a detached HEAD, but no branch
- * and no Git worktree are created. Only the root applies the validated result
- * and creates the single logical story commit on the epic branch.
- */
-import { execFile, spawn } from 'node:child_process';
-import { createHash, randomBytes } from 'node:crypto';
-import { lstat, readFile, realpath, stat } from 'node:fs/promises';
-import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
-import { promisify } from 'node:util';
-import { admitPreparedStoryBundle } from './prepared-story-bundle.js';
-import { acquireGitLifecyclePhysicalIntegrationLock, assertGitLifecyclePrivateDirectory, assertGitLifecyclePrivateFile, applyGitLifecycleRuntimeOverlay, computeImmutableStoryQaEvidenceDigest, computeP205StoryQaEvidenceDigest, ensureGitLifecyclePrivateChildDirectory, ensureRuntimeEpic, ensureRuntimeStory, gitLifecycleRuntimeDirectory, mutateGitLifecycleRuntime, P205_COMPLETE_COMMAND, readGitLifecycleRuntime, releaseGitLifecyclePhysicalIntegrationLock, removeGitLifecyclePrivateDirectory, verifyAcceptedGitLifecycleStoryCheckpoint, verifyGitLifecyclePhysicalIntegrationLock, } from '../../git/git-lifecycle-store.js';
-import { anchoredAtomicWriteFile, anchoredCreateDirectory, anchoredDirectoryIdentity, anchoredExecuteGit, anchoredEnsureDirectory, anchoredRemoveFile, } from '../../git/secure-filesystem-boundary.js';
-import { GIT_LIFECYCLE_COMMIT_PUSH_STEP_ID, GIT_LIFECYCLE_REVIEW_PR_STEP_ID, } from '../../git/git-lifecycle-step-ids.js';
-const execFileAsync = promisify(execFile);
-const ANCHORED_CHILD_HELPER = String.raw `
+import{execFile as st,spawn as Me}from"node:child_process";import{createHash as G,randomBytes as Ke}from"node:crypto";import{lstat as le,readFile as B,realpath as Y,stat as dt}from"node:fs/promises";import{basename as $,dirname as C,isAbsolute as Fe,join as D,relative as ut,resolve as ht}from"node:path";import{promisify as ft}from"node:util";import{admitPreparedStoryBundle as pt}from"./prepared-story-bundle.js";import{acquireGitLifecyclePhysicalIntegrationLock as lt,assertGitLifecyclePrivateDirectory as W,assertGitLifecyclePrivateFile as F,applyGitLifecycleRuntimeOverlay as re,computeImmutableStoryQaEvidenceDigest as yt,computeP205StoryQaEvidenceDigest as wt,ensureGitLifecyclePrivateChildDirectory as be,ensureRuntimeEpic as ye,ensureRuntimeStory as mt,gitLifecycleRuntimeDirectory as gt,mutateGitLifecycleRuntime as X,P205_COMPLETE_COMMAND as St,readGitLifecycleRuntime as V,releaseGitLifecyclePhysicalIntegrationLock as It,removeGitLifecyclePrivateDirectory as oe,verifyAcceptedGitLifecycleStoryCheckpoint as ke,verifyGitLifecyclePhysicalIntegrationLock as xe}from"../../git/git-lifecycle-store.js";import{anchoredAtomicWriteFile as vt,anchoredCreateDirectory as Ee,anchoredDirectoryIdentity as Rt,anchoredExecuteGit as Ae,anchoredEnsureDirectory as bt,anchoredRemoveFile as kt}from"../../git/secure-filesystem-boundary.js";import{GIT_LIFECYCLE_COMMIT_PUSH_STEP_ID as Ve,GIT_LIFECYCLE_REVIEW_PR_STEP_ID as we}from"../../git/git-lifecycle-step-ids.js";const je=ft(st),xt=String.raw`
 const fs = require('node:fs');
 const cp = require('node:child_process');
 const [expectedParentDev, expectedParentIno, name, expectedChildDev, expectedChildIno, encoded, handshake] = process.argv.slice(1);
@@ -63,1613 +46,13 @@ runtime.on('close', (code, signal) => {
   if (signal) process.kill(process.pid, signal);
   else process.exit(Number.isInteger(code) ? code : 1);
 });
-`;
-/**
- * Create the only command runner authorized for a continuous child. The helper
- * owns and revalidates the sandbox cwd before launching the runtime, so the
- * mutable public pathname is never reused as the runtime's cwd.
- */
-export function createAnchoredContinuousStoryCommandRunner(lease, hooks = {}) {
-    return async (command, args, options = {}) => runAnchoredChildCommand(lease, command, args, options, hooks);
-}
-/** Default continuous-DAG workspace policy. It never creates a Git worktree. */
-export function createBranchlessContinuousStoryWorkspaceManager(options = {}) {
-    let preparationTail = Promise.resolve();
-    return {
-        async prepare(input) {
-            if ((options.platform ?? process.platform) === 'win32') {
-                return failure('continuous-sandbox-platform-unsupported');
-            }
-            if (!/^[a-f0-9]{64}$/.test(input.dispatchId))
-                return failure('continuous-sandbox-dispatch-invalid');
-            if (!safeRelativePath(input.targetRef))
-                return failure('continuous-sandbox-target-invalid');
-            if (!safeBranch(input.executionBranch))
-                return failure('continuous-execution-branch-invalid');
-            if (!/^[a-f0-9]{64}$/.test(input.graphRevision))
-                return failure('continuous-graph-revision-invalid');
-            const authorizedWriteSet = normalizeWriteSet(input.authorizedWriteSet);
-            if (authorizedWriteSet.length === 0 || authorizedWriteSet.length !== input.authorizedWriteSet.length) {
-                return failure('continuous-authorized-write-set-invalid');
-            }
-            const claimRevision = hashCanonical(authorizedWriteSet);
-            const previousPreparation = preparationTail;
-            let unlockPreparation = () => undefined;
-            preparationTail = new Promise((resolvePreparation) => { unlockPreparation = resolvePreparation; });
-            await previousPreparation;
-            let acquiredLeasePath;
-            let acquiredLeaseOwner;
-            try {
-                const projectRoot = await canonicalRoot(input.projectRoot);
-                const baseSha = await git(projectRoot, ['rev-parse', 'HEAD']);
-                const graphAuthority = await readCurrentGraphAuthoritySnapshot(projectRoot, input.epicId, input.storyId);
-                const graphAuthorityRevision = graphAuthority.revision;
-                const runtimeDirectory = await gitLifecycleRuntimeDirectory(projectRoot);
-                const leasesRoot = await ensureGitLifecyclePrivateChildDirectory(runtimeDirectory, 'leases');
-                const leasePath = join(leasesRoot, input.dispatchId);
-                try {
-                    await anchoredCreateDirectory(leasesRoot, input.dispatchId);
-                    await assertGitLifecyclePrivateDirectory(leasePath, leasesRoot);
-                }
-                catch (error) {
-                    if (!isNodeError(error, 'EEXIST'))
-                        throw error;
-                    await assertGitLifecyclePrivateDirectory(leasePath, leasesRoot);
-                    const owner = await readLeaseOwner(leasePath, leasesRoot);
-                    if (owner !== undefined && processExists(owner.pid))
-                        return failure('continuous-sandbox-lease-active');
-                    if (!owner || !(await removeGitLifecyclePrivateDirectory(leasePath, leasesRoot, async (renamed) => sameLeaseOwner(await readLeaseOwner(renamed, leasesRoot), owner))))
-                        return failure('continuous-sandbox-lease-owner-replaced');
-                    await anchoredCreateDirectory(leasesRoot, input.dispatchId);
-                    await assertGitLifecyclePrivateDirectory(leasePath, leasesRoot);
-                }
-                acquiredLeasePath = leasePath;
-                acquiredLeaseOwner = Object.freeze({
-                    pid: process.pid,
-                    createdAt: new Date().toISOString(),
-                    nonce: randomBytes(16).toString('hex'),
-                });
-                await writeOptional(leasePath, 'owner.json', Buffer.from(JSON.stringify(acquiredLeaseOwner)), options.beforeSandboxWriteCommit);
-                await assertGitLifecyclePrivateFile(join(leasePath, 'owner.json'), leasePath);
-                const sandboxesRoot = await ensureGitLifecyclePrivateChildDirectory(runtimeDirectory, 'sandboxes');
-                const workspacePath = join(sandboxesRoot, input.dispatchId.slice(0, 20));
-                const recovered = await readSandboxMetadata(workspacePath, sandboxesRoot);
-                let contextSnapshots;
-                let workspaceIdentity;
-                const preparedAt = recovered?.preparedAt ?? new Date().toISOString();
-                const workspaceOwnerNonce = recovered?.workspaceOwnerNonce ?? randomBytes(16).toString('hex');
-                if (recovered) {
-                    if (recovered.projectRoot !== projectRoot || recovered.storyId !== input.storyId
-                        || recovered.targetRef !== input.targetRef || recovered.dispatchId !== input.dispatchId
-                        || recovered.epicId !== input.epicId || recovered.executionBranch !== input.executionBranch
-                        || recovered.graphRevision !== input.graphRevision || recovered.claimRevision !== claimRevision
-                        || recovered.graphAuthorityRevision !== graphAuthorityRevision
-                        || recovered.graphAuthorityEpoch !== graphAuthority.epoch
-                        || recovered.graphAuthorityStoryStatus !== graphAuthority.storyStatus
-                        || !sameStrings(recovered.authorizedWriteSet, authorizedWriteSet))
-                        return failure('continuous-sandbox-recovery-mismatch');
-                    contextSnapshots = recovered.contextSnapshots.map((snapshot) => ({
-                        path: snapshot.path,
-                        ...(snapshot.contentBase64 !== undefined ? { content: Buffer.from(snapshot.contentBase64, 'base64') } : {}),
-                    }));
-                    workspaceIdentity = await anchoredDirectoryIdentity(workspacePath);
-                    if (workspaceIdentity.dev !== recovered.workspaceIdentity.dev
-                        || workspaceIdentity.ino !== recovered.workspaceIdentity.ino) {
-                        return failure('continuous-sandbox-recovery-mismatch');
-                    }
-                }
-                else {
-                    await removeGitLifecyclePrivateDirectory(workspacePath, sandboxesRoot);
-                    workspaceIdentity = await anchoredCreateDirectory(sandboxesRoot, basename(workspacePath));
-                    await assertGitLifecyclePrivateDirectory(workspacePath, sandboxesRoot);
-                    await sandboxGitAt(sandboxesRoot, basename(workspacePath), workspaceIdentity, ['init', '--quiet']);
-                    await initializeBranchlessRuntimeProjection(projectRoot, workspacePath);
-                    await copyGitIdentity(projectRoot, sandboxesRoot, basename(workspacePath), workspaceIdentity);
-                    await sandboxGitAt(sandboxesRoot, basename(workspacePath), workspaceIdentity, ['remote', 'add', 'neocortex-root', projectRoot]);
-                    await sandboxGitAt(sandboxesRoot, basename(workspacePath), workspaceIdentity, ['fetch', '--quiet', '--no-tags', 'neocortex-root', baseSha]);
-                    await sandboxGitAt(sandboxesRoot, basename(workspacePath), workspaceIdentity, ['checkout', '--quiet', '--detach', 'FETCH_HEAD']);
-                    contextSnapshots = await copyCurrentContext(projectRoot, workspacePath, input.epicId, input.targetRef, options.beforeSandboxWriteCommit);
-                    await writeSandboxMetadata(workspacePath, sandboxesRoot, {
-                        schemaVersion: 1,
-                        projectRoot,
-                        storyId: input.storyId,
-                        targetRef: input.targetRef,
-                        epicId: input.epicId,
-                        executionBranch: input.executionBranch,
-                        graphRevision: input.graphRevision,
-                        graphAuthorityRevision,
-                        graphAuthorityEpoch: graphAuthority.epoch,
-                        graphAuthorityStoryStatus: graphAuthority.storyStatus,
-                        authorizedWriteSet,
-                        claimRevision,
-                        dispatchId: input.dispatchId,
-                        baseSha,
-                        preparedAt,
-                        workspaceOwnerNonce,
-                        workspaceIdentity,
-                        contextSnapshots: contextSnapshots.map((snapshot) => ({
-                            path: snapshot.path,
-                            ...(snapshot.content !== undefined ? { contentBase64: snapshot.content.toString('base64') } : {}),
-                        })),
-                    }, options.beforeSandboxWriteCommit);
-                }
-                acquiredLeasePath = undefined;
-                return {
-                    ok: true,
-                    value: {
-                        projectRoot,
-                        workspacePath,
-                        workspaceStrategy: 'branchless_sandbox',
-                        storyId: input.storyId,
-                        targetRef: input.targetRef,
-                        epicId: input.epicId,
-                        executionBranch: input.executionBranch,
-                        graphRevision: input.graphRevision,
-                        graphAuthorityRevision,
-                        graphAuthorityEpoch: graphAuthority.epoch,
-                        graphAuthorityStoryStatus: graphAuthority.storyStatus,
-                        authorizedWriteSet,
-                        claimRevision,
-                        baseSha: recovered?.baseSha ?? baseSha,
-                        dispatchId: input.dispatchId,
-                        preparedAt,
-                        leasePath,
-                        leaseOwnerNonce: acquiredLeaseOwner.nonce,
-                        workspaceOwnerNonce,
-                        workspaceIdentity,
-                        contextSnapshots,
-                    },
-                };
-            }
-            catch {
-                if (acquiredLeasePath && acquiredLeaseOwner) {
-                    const cleanupLeasePath = acquiredLeasePath;
-                    const cleanupLeaseOwner = acquiredLeaseOwner;
-                    await removeGitLifecyclePrivateDirectory(cleanupLeasePath, dirname(cleanupLeasePath), async (renamed) => sameLeaseOwner(await readLeaseOwner(renamed, dirname(cleanupLeasePath)), cleanupLeaseOwner)).catch(() => undefined);
-                }
-                return failure('continuous-sandbox-prepare-failed');
-            }
-            finally {
-                unlockPreparation();
-            }
-        },
-        async integrate(lease, authority) {
-            const leaseOwner = await readLeaseOwner(lease.leasePath, dirname(lease.leasePath)).catch(() => undefined);
-            const sandboxOwner = await readSandboxMetadata(lease.workspacePath, dirname(lease.workspacePath)).catch(() => undefined);
-            if (!leaseOwner || leaseOwner.nonce !== lease.leaseOwnerNonce
-                || sandboxOwner?.workspaceOwnerNonce !== lease.workspaceOwnerNonce
-                || sandboxOwner.dispatchId !== lease.dispatchId || sandboxOwner.storyId !== lease.storyId) {
-                return failure('continuous-sandbox-owner-mismatch');
-            }
-            const lockStartedAt = normalizeEvidenceTime(authority?.nowIso ?? new Date().toISOString());
-            const physicalLock = await acquireGitLifecyclePhysicalIntegrationLock(lease.projectRoot, {
-                kind: 'continuous', storyId: lease.storyId, sessionId: lease.dispatchId,
-                idempotencyKey: lease.dispatchId,
-                expiresAt: new Date(Date.parse(lockStartedAt) + 30 * 60 * 1000).toISOString(),
-                persistent: false, createdAt: lockStartedAt,
-            });
-            if (!physicalLock.ok)
-                return failure(physicalLock.reasonCode === 'git-lifecycle-integration-backpressure'
-                    ? 'continuous-integration-backpressure' : 'continuous-integration-lease-failed');
-            let rootSnapshots = [];
-            let rootCommitCreated = false;
-            let rootEffectsStarted = false;
-            try {
-                // Preserve the leading porcelain status column: `sandboxGit` trims it
-                // and would misclassify an ordinary unstaged modification as staged.
-                const sandboxStatus = (await sandboxGitRaw(lease, ['status', '--porcelain'])).trimEnd();
-                const childHeadSha = await sandboxGit(lease, ['rev-parse', 'HEAD']);
-                const currentBranch = await gitOptional(lease.projectRoot, ['symbolic-ref', '--quiet', '--short', 'HEAD']);
-                if (currentBranch !== lease.executionBranch)
-                    return failure('continuous-execution-branch-mismatch');
-                const runtimeDirectory = dirname(dirname(lease.leasePath));
-                const integratedRoot = await ensureGitLifecyclePrivateChildDirectory(runtimeDirectory, 'integrated');
-                const markerPath = join(integratedRoot, lease.dispatchId);
-                const marker = await readMarker(markerPath, integratedRoot);
-                if (marker?.childHeadSha === childHeadSha
-                    && marker.bundle.storyId === lease.storyId
-                    && marker.bundle.epicId === lease.epicId
-                    && marker.bundle.executionBranch === lease.executionBranch
-                    && marker.bundle.graphRevision === lease.graphRevision
-                    && marker.bundle.claimRevision === lease.claimRevision
-                    && sameStrings(marker.bundle.authorizedWriteSet, lease.authorizedWriteSet)
-                    && marker.checkpoint.idempotencyKey === lease.dispatchId
-                    && marker.checkpoint.bundleId === marker.bundle.bundleId
-                    && marker.checkpoint.bundleDigest === marker.bundle.bundleDigest
-                    && marker.checkpoint.graphRevision === lease.graphRevision
-                    && marker.checkpoint.claimRevision === lease.claimRevision
-                    && await gitExitOk(lease.projectRoot, ['merge-base', '--is-ancestor', marker.rootHeadSha, 'HEAD'])
-                    && await checkpointExistsInRootState(lease, marker.checkpoint)) {
-                    return {
-                        ok: true,
-                        value: {
-                            headSha: marker.rootHeadSha,
-                            alreadyIntegrated: true,
-                            bundle: marker.bundle,
-                            checkpoint: marker.checkpoint,
-                        },
-                    };
-                }
-                // The delegated child owns only filesystem writes. Any staged path or
-                // commit is an attempted authority escalation; the root writer alone
-                // stages, integrates and creates the single logical story commit.
-                if (childHeadSha !== lease.baseSha) {
-                    return failure('continuous-sandbox-child-git-authority-denied');
-                }
-                if (sandboxStatus.length === 0)
-                    return failure('continuous-bundle-empty');
-                const childStaged = sandboxStatus.split('\n')
-                    .some((line) => line.length > 0 && line[0] !== ' ' && line[0] !== '?');
-                if (!childStaged)
-                    await sandboxGit(lease, ['add', '-A']);
-                const changedPaths = splitNull(await sandboxGitRaw(lease, ['diff', '--cached', '--name-only', '-z', lease.baseSha]));
-                if (changedPaths.length === 0 || changedPaths.some((path) => !safeRelativePath(path))) {
-                    return failure('continuous-integration-write-set-invalid');
-                }
-                if (!(await sandboxGitExitOk(lease, ['merge-base', '--is-ancestor', lease.baseSha, childHeadSha]))) {
-                    return failure('continuous-bundle-base-not-ancestor');
-                }
-                if (!(await gitExitOk(lease.projectRoot, ['merge-base', '--is-ancestor', lease.baseSha, 'HEAD']))) {
-                    return failure('continuous-root-base-not-ancestor');
-                }
-                const nowIso = authority?.nowIso ?? new Date().toISOString();
-                const receiptRefs = normalizeReceiptRefs(authority?.receiptRefs, lease.dispatchId);
-                const payload = await sandboxGitRaw(lease, ['diff', '--cached', '--binary', lease.baseSha]);
-                const bundleBody = {
-                    schemaVersion: 1,
-                    storyId: lease.storyId,
-                    epicId: lease.epicId,
-                    executionBranch: lease.executionBranch,
-                    baseSha: lease.baseSha,
-                    bundleDigest: createHash('sha256').update(payload).digest('hex'),
-                    graphRevision: lease.graphRevision,
-                    claimRevision: lease.claimRevision,
-                    authorizedWriteSet: lease.authorizedWriteSet,
-                    contextDigests: Object.fromEntries(lease.contextSnapshots.map((snapshot) => [
-                        snapshot.path,
-                        createHash('sha256').update(snapshot.content ?? Buffer.alloc(0)).digest('hex'),
-                    ])),
-                    validationRefs: receiptRefs,
-                    createdAt: lease.preparedAt,
-                    expiresAt: new Date(Date.parse(lease.preparedAt) + 24 * 60 * 60 * 1000).toISOString(),
-                    branchless: true,
-                };
-                const bundle = Object.freeze({
-                    ...bundleBody,
-                    bundleId: hashCanonical(bundleBody),
-                });
-                const recoveredCommit = await findIntegratedDispatchCommit(lease, bundle);
-                if (recoveredCommit) {
-                    const existingCheckpoint = await readMatchingRootCheckpoint(lease, bundle, recoveredCommit);
-                    if (existingCheckpoint) {
-                        await writeMarker(markerPath, childHeadSha, recoveredCommit.headSha, bundle, existingCheckpoint, options.beforeSandboxWriteCommit);
-                        return {
-                            ok: true,
-                            value: { headSha: recoveredCommit.headSha, alreadyIntegrated: true, bundle, checkpoint: existingCheckpoint },
-                        };
-                    }
-                }
-                if (!recoveredCommit
-                    && await readCurrentGraphAuthorityRevision(lease.projectRoot, lease.epicId) !== lease.graphAuthorityRevision) {
-                    return failure('continuous-graph-revision-stale');
-                }
-                if (recoveredCommit) {
-                    const evidence = await produceIndependentCheckpointEvidence({
-                        lease, bundle, baseSha: recoveredCommit.baseSha, headSha: recoveredCommit.headSha,
-                        receiptRefs, nowIso, qaRunner: options.storyQaRunner,
-                    });
-                    if (!evidence.ok)
-                        return evidence;
-                    await options.beforeCheckpointPersist?.({
-                        projectRoot: lease.projectRoot, storyId: lease.storyId, headSha: recoveredCommit.headSha,
-                    });
-                    const checkpoint = await persistRootCheckpoint({
-                        lease,
-                        physicalLock,
-                        checkpointAuthority: recoveredCommit.checkpointAuthority,
-                        bundle,
-                        baseSha: recoveredCommit.baseSha,
-                        headSha: recoveredCommit.headSha,
-                        receiptRefs: [...receiptRefs, `bundle:${bundle.bundleId}`, evidence.value.qaReceipt.receiptRef, evidence.value.reviewReceipt.receiptRef],
-                        qaReceipt: evidence.value.qaReceipt,
-                        reviewReceipt: evidence.value.reviewReceipt,
-                        recordedAt: nowIso,
-                        checkpointNow: options.checkpointNow,
-                        insideCheckpointPreCommit: options.insideCheckpointPreCommit,
-                        afterCheckpointPersist: options.afterCheckpointPersist,
-                    });
-                    if (!checkpoint.ok)
-                        return checkpoint;
-                    await writeMarker(markerPath, childHeadSha, recoveredCommit.headSha, bundle, checkpoint.value, options.beforeSandboxWriteCommit);
-                    return { ok: true, value: { headSha: recoveredCommit.headSha, alreadyIntegrated: true, bundle, checkpoint: checkpoint.value } };
-                }
-                // A staged index is accepted only as replay input when immutable root
-                // evidence above proves that this exact bundle was already integrated.
-                // It can never authorize a fresh root effect.
-                if (childStaged)
-                    return failure('continuous-sandbox-child-git-authority-denied');
-                const stagedPaths = splitNull(await gitRaw(lease.projectRoot, ['diff', '--cached', '--name-only', '-z']));
-                if (stagedPaths.length > 0)
-                    return failure('continuous-integration-root-index-dirty');
-                const managedPaths = new Set(lease.contextSnapshots.map((snapshot) => snapshot.path));
-                const unauthorized = changedPaths.filter((path) => !lease.authorizedWriteSet.some((authorized) => writeSetCovers(authorized, path)));
-                if (unauthorized.length > 0)
-                    return failure('continuous-bundle-write-set-unauthorized');
-                const patchPaths = changedPaths.filter((path) => !managedPaths.has(path));
-                const interveningPaths = new Set(splitNull(await gitRaw(lease.projectRoot, ['diff', '--name-only', '-z', `${lease.baseSha}..HEAD`])));
-                if (patchPaths.some((path) => interveningPaths.has(path)))
-                    return failure('continuous-bundle-intervening-conflict');
-                const dirtyPaths = new Set([
-                    ...splitNull(await gitRaw(lease.projectRoot, ['diff', '--name-only', '-z'])),
-                    ...splitNull(await gitRaw(lease.projectRoot, ['ls-files', '--others', '--exclude-standard', '-z'])),
-                ]);
-                if (patchPaths.some((path) => dirtyPaths.has(path)))
-                    return failure('continuous-integration-root-conflict');
-                rootSnapshots = await snapshotPaths(lease.projectRoot, [...new Set([...changedPaths, '.neocortex/state.json'])]);
-                const writer = await acquireRootWriterLease(lease, nowIso);
-                if (!writer.ok)
-                    return writer;
-                const admissionErrors = admitPreparedStoryBundle({
-                    bundle,
-                    payload: Buffer.from(payload),
-                    expected: {
-                        epicId: lease.epicId,
-                        storyId: lease.storyId,
-                        executionBranch: lease.executionBranch,
-                        baseSha: lease.baseSha,
-                        graphRevision: lease.graphRevision,
-                        claimRevision: lease.claimRevision,
-                        authorizedWriteSet: lease.authorizedWriteSet,
-                        nowIso,
-                    },
-                    writerLease: writer.value,
-                });
-                if (admissionErrors.length > 0) {
-                    await restoreIntegration(lease.projectRoot, rootSnapshots);
-                    return failure(`continuous-bundle-admission-${admissionErrors[0]}`);
-                }
-                const rootBaseSha = await git(lease.projectRoot, ['rev-parse', 'HEAD']);
-                let checkpointAuthority;
-                await options.beforeRootCommit?.({
-                    projectRoot: lease.projectRoot,
-                    storyId: lease.storyId,
-                    headSha: rootBaseSha,
-                });
-                try {
-                    await mutateGitLifecycleRuntime(lease.projectRoot, (document) => {
-                        const currentWriter = asRecordOrUndefined(ensureRuntimeEpic(document, lease.epicId).branch_lease);
-                        if (currentWriter?.ownerStoryId !== lease.storyId
-                            || currentWriter.sessionId !== lease.dispatchId
-                            || currentWriter.idempotencyKey !== lease.dispatchId
-                            || Date.parse(String(currentWriter.expiresAt)) <= Date.now()) {
-                            throw new Error('continuous-checkpoint-writer-lease-lost');
-                        }
-                    }, { preCommit: async (document) => {
-                            const currentAuthority = await readCurrentGraphAuthoritySnapshot(lease.projectRoot, lease.epicId, lease.storyId, document);
-                            if (currentAuthority.revision !== lease.graphAuthorityRevision
-                                || currentAuthority.epoch !== lease.graphAuthorityEpoch
-                                || currentAuthority.storyStatus !== lease.graphAuthorityStoryStatus) {
-                                throw new Error('continuous-graph-revision-stale');
-                            }
-                            if (!(await verifyGitLifecyclePhysicalIntegrationLock(physicalLock.path, physicalLock.owner))) {
-                                throw new Error('continuous-integration-lock-raced');
-                            }
-                            const guardedBranch = await gitOptional(lease.projectRoot, ['symbolic-ref', '--quiet', '--short', 'HEAD']);
-                            const guardedHead = await git(lease.projectRoot, ['rev-parse', 'HEAD']);
-                            if (guardedBranch !== lease.executionBranch || guardedHead !== rootBaseSha) {
-                                throw new Error('continuous-integration-head-raced');
-                            }
-                            const guardedStaged = splitNull(await gitRaw(lease.projectRoot, ['diff', '--cached', '--name-only', '-z']));
-                            const guardedDirty = new Set([
-                                ...splitNull(await gitRaw(lease.projectRoot, ['diff', '--name-only', '-z'])),
-                                ...splitNull(await gitRaw(lease.projectRoot, ['ls-files', '--others', '--exclude-standard', '-z'])),
-                            ]);
-                            if (guardedStaged.length > 0)
-                                throw new Error('continuous-integration-root-index-dirty');
-                            if (patchPaths.some((path) => guardedDirty.has(path)))
-                                throw new Error('continuous-integration-root-conflict');
-                            rootEffectsStarted = true;
-                            if (patchPaths.length > 0) {
-                                const patch = await sandboxGitRaw(lease, ['diff', '--cached', '--binary', lease.baseSha, '--', ...patchPaths]);
-                                if (patch.length > 0 && !(await gitWithInput(lease.projectRoot, ['apply', '--index', '--3way', '--whitespace=nowarn'], patch)))
-                                    throw new Error('continuous-integration-conflict');
-                            }
-                            for (const snapshot of lease.contextSnapshots) {
-                                if (!changedPaths.includes(snapshot.path))
-                                    continue;
-                                const current = await readOptional(join(lease.projectRoot, snapshot.path));
-                                const child = await sandboxGitIndexBlob(lease, snapshot.path);
-                                const merged = snapshot.path === '.neocortex/state.json'
-                                    ? mergeJsonBuffers(snapshot.content, current, filterChildGitState(snapshot.content, child, lease.storyId))
-                                    : mergeBuffers(snapshot.content, current, child);
-                                if (!merged.ok)
-                                    throw new Error(snapshot.path === '.neocortex/state.json'
-                                        ? 'continuous-state-merge-conflict'
-                                        : 'continuous-context-merge-conflict');
-                                await writeOptional(lease.projectRoot, snapshot.path, merged.value);
-                                await git(lease.projectRoot, ['add', '-A', '--', snapshot.path]);
-                            }
-                            if (changedPaths.includes('.neocortex/state.json')) {
-                                await git(lease.projectRoot, ['add', '-A', '--', '.neocortex/state.json']);
-                            }
-                            if (await gitExitOk(lease.projectRoot, ['diff', '--cached', '--quiet'])) {
-                                throw new Error('continuous-integration-empty-after-admission');
-                            }
-                            checkpointAuthority = await readCurrentGraphAuthoritySnapshot(lease.projectRoot, lease.epicId, lease.storyId, document);
-                            await git(lease.projectRoot, [
-                                'commit', '-m', `feat(yoloop): integrate ${lease.storyId}`,
-                                '-m', `Neocortex-Story: ${lease.storyId}`,
-                                '-m', `Neocortex-Epic: ${lease.epicId}`,
-                                '-m', `Neocortex-Execution-Branch: ${lease.executionBranch}`,
-                                '-m', `Neocortex-Prepared-Base: ${lease.baseSha}`,
-                                '-m', `Neocortex-Dispatch: ${lease.dispatchId}`,
-                                '-m', `Neocortex-Bundle: ${bundle.bundleId}`,
-                                '-m', `Neocortex-Bundle-Digest: ${bundle.bundleDigest}`,
-                                '-m', `Neocortex-Graph-Revision: ${lease.graphRevision}`,
-                                '-m', `Neocortex-Claim-Revision: ${lease.claimRevision}`,
-                                '-m', `Neocortex-Checkpoint-Authority: ${checkpointAuthority.revision}`,
-                                '-m', `Neocortex-Checkpoint-Epoch: ${checkpointAuthority.epoch ?? 'null'}`,
-                                '-m', `Neocortex-Checkpoint-Story-Status: ${checkpointAuthority.storyStatus ?? 'null'}`,
-                            ]);
-                            rootCommitCreated = true;
-                        } });
-                }
-                catch (error) {
-                    if (rootEffectsStarted && !rootCommitCreated)
-                        await restoreIntegration(lease.projectRoot, rootSnapshots);
-                    const reasonCode = error instanceof Error && /^continuous-/.test(error.message)
-                        ? error.message
-                        : 'continuous-integration-failed';
-                    return failure(reasonCode);
-                }
-                const rootHeadSha = await git(lease.projectRoot, ['rev-parse', 'HEAD']);
-                if (!checkpointAuthority)
-                    return failure('continuous-checkpoint-authority-missing');
-                await options.afterRootCommit?.({
-                    projectRoot: lease.projectRoot, storyId: lease.storyId, headSha: rootHeadSha,
-                });
-                const evidence = await produceIndependentCheckpointEvidence({
-                    lease, bundle, baseSha: rootBaseSha, headSha: rootHeadSha,
-                    receiptRefs, nowIso, qaRunner: options.storyQaRunner,
-                });
-                if (!evidence.ok)
-                    return evidence;
-                await options.beforeCheckpointPersist?.({
-                    projectRoot: lease.projectRoot, storyId: lease.storyId, headSha: rootHeadSha,
-                });
-                const checkpoint = await persistRootCheckpoint({
-                    lease,
-                    physicalLock,
-                    checkpointAuthority,
-                    bundle,
-                    baseSha: rootBaseSha,
-                    headSha: rootHeadSha,
-                    receiptRefs: [...receiptRefs, `bundle:${bundle.bundleId}`, evidence.value.qaReceipt.receiptRef, evidence.value.reviewReceipt.receiptRef],
-                    qaReceipt: evidence.value.qaReceipt,
-                    reviewReceipt: evidence.value.reviewReceipt,
-                    recordedAt: nowIso,
-                    checkpointNow: options.checkpointNow,
-                    insideCheckpointPreCommit: options.insideCheckpointPreCommit,
-                    afterCheckpointPersist: options.afterCheckpointPersist,
-                });
-                if (!checkpoint.ok)
-                    return checkpoint;
-                await writeMarker(markerPath, childHeadSha, rootHeadSha, bundle, checkpoint.value, options.beforeSandboxWriteCommit);
-                return { ok: true, value: { headSha: rootHeadSha, alreadyIntegrated: false, bundle, checkpoint: checkpoint.value } };
-            }
-            catch {
-                if (rootEffectsStarted && !rootCommitCreated && rootSnapshots.length > 0) {
-                    await restoreIntegration(lease.projectRoot, rootSnapshots);
-                }
-                return failure('continuous-integration-failed');
-            }
-            finally {
-                await releaseRootWriterLease(lease).catch(() => undefined);
-                await releaseGitLifecyclePhysicalIntegrationLock(physicalLock.path, physicalLock.owner).catch(() => undefined);
-            }
-        },
-        async release(lease, preserveForRecovery) {
-            if (!preserveForRecovery) {
-                await removeGitLifecyclePrivateDirectory(lease.workspacePath, dirname(lease.workspacePath), async (renamed) => {
-                    const metadata = await readSandboxMetadata(renamed, dirname(lease.workspacePath)).catch(() => undefined);
-                    return metadata?.workspaceOwnerNonce === lease.workspaceOwnerNonce
-                        && metadata.dispatchId === lease.dispatchId && metadata.storyId === lease.storyId;
-                });
-            }
-            await removeGitLifecyclePrivateDirectory(lease.leasePath, dirname(lease.leasePath), async (renamed) => {
-                const owner = await readLeaseOwner(renamed, dirname(lease.leasePath)).catch(() => undefined);
-                return owner?.nonce === lease.leaseOwnerNonce;
-            });
-        },
-    };
-}
-async function copyCurrentContext(projectRoot, workspacePath, epicId, targetRef, beforeCommit) {
-    const paths = [...new Set(['.neocortex/state.json', targetRef, `docs/epics/epic-${safeRef(epicId)}.md`])];
-    const snapshots = [];
-    for (const path of paths) {
-        if (!safeRelativePath(path))
-            continue;
-        const content = await readOptional(join(projectRoot, path));
-        snapshots.push({ path, ...(content !== undefined ? { content } : {}) });
-        if (content !== undefined)
-            await writeOptional(workspacePath, path, content, beforeCommit);
-    }
-    return snapshots;
-}
-async function canonicalRoot(projectRoot) {
-    const root = await git(projectRoot, ['rev-parse', '--show-toplevel']);
-    const [canonicalGitRoot, canonicalInputRoot] = await Promise.all([realpath(root), realpath(projectRoot)]);
-    if (canonicalGitRoot !== canonicalInputRoot)
-        throw new Error('project root mismatch');
-    return canonicalGitRoot;
-}
-async function copyGitIdentity(projectRoot, workspaceParent, workspaceName, workspaceIdentity) {
-    for (const key of ['user.name', 'user.email']) {
-        const value = await gitOptional(projectRoot, ['config', '--get', key]);
-        if (value)
-            await sandboxGitAt(workspaceParent, workspaceName, workspaceIdentity, ['config', key, value]);
-    }
-}
-async function initializeBranchlessRuntimeProjection(projectRoot, workspacePath) {
-    const rootRuntime = await readGitLifecycleRuntime(projectRoot);
-    await mutateGitLifecycleRuntime(workspacePath, (document) => {
-        for (const [epicId, epic] of Object.entries(rootRuntime.epics)) {
-            document.epics[epicId] = {
-                ...structuredClone(epic),
-                branch_lease: null,
-            };
-        }
-        for (const [storyId, story] of Object.entries(rootRuntime.stories)) {
-            document.stories[storyId] = structuredClone(story);
-        }
-    });
-}
-async function sandboxGitAt(workspaceParent, workspaceName, workspaceIdentity, args) {
-    return (await anchoredExecuteGit(workspaceParent, workspaceName, workspaceIdentity, args)).toString('utf8').trim();
-}
-async function sandboxGitRaw(lease, args) {
-    return (await anchoredExecuteGit(dirname(lease.workspacePath), basename(lease.workspacePath), lease.workspaceIdentity, args)).toString('utf8');
-}
-async function sandboxGit(lease, args) {
-    return (await sandboxGitRaw(lease, args)).trim();
-}
-async function sandboxGitExitOk(lease, args) {
-    try {
-        await sandboxGit(lease, args);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-async function sandboxGitIndexBlob(lease, path) {
-    try {
-        return await anchoredExecuteGit(dirname(lease.workspacePath), basename(lease.workspacePath), lease.workspaceIdentity, ['show', `:${path}`]);
-    }
-    catch {
-        return undefined;
-    }
-}
-async function runAnchoredChildCommand(lease, command, args, options, hooks) {
-    const startedAt = Date.now();
-    const empty = (overrides) => ({
-        exitCode: null, timedOut: false, durationMs: Date.now() - startedAt,
-        stdout: '', stderr: '', stdoutBytes: 0, stderrBytes: 0, ...overrides,
-    });
-    if (options.signal?.aborted)
-        return empty({ signal: 'SIGTERM', cancelled: true });
-    if (!command || command.length > 4096 || command.includes('\0') || args.length > 512
-        || args.some((arg) => arg.length > 32768 || arg.includes('\0'))) {
-        return empty({ exitCode: 73, stderr: 'continuous-child-invocation-invalid', stderrBytes: 35 });
-    }
-    const parentPath = dirname(lease.workspacePath);
-    const parentEntry = await lstat(parentPath, { bigint: true });
-    const parentIdentity = await stat(parentPath, { bigint: true });
-    if (!parentEntry.isDirectory() || parentEntry.isSymbolicLink() || !parentIdentity.isDirectory()
-        || parentEntry.dev !== parentIdentity.dev || parentEntry.ino !== parentIdentity.ino) {
-        return empty({ exitCode: 73, stderr: 'continuous-child-parent-invalid', stderrBytes: 31 });
-    }
-    await hooks.beforeHandoff?.();
-    const encoded = Buffer.from(JSON.stringify({ command, args: [...args] })).toString('base64url');
-    const maxOutputBytes = options.maxOutputBytes ?? 64_000;
-    const timeoutMs = Math.max(1, Math.min(options.timeoutMs ?? 10 * 60 * 1000, 30 * 60 * 1000));
-    return await new Promise((resolveCommand) => {
-        const child = spawn(process.execPath, [
-            '-e', ANCHORED_CHILD_HELPER,
-            String(parentIdentity.dev), String(parentIdentity.ino), basename(lease.workspacePath),
-            lease.workspaceIdentity.dev, lease.workspaceIdentity.ino, encoded, hooks.afterHandoff ? '1' : '0',
-        ], { cwd: parentPath, env: options.env, stdio: ['pipe', 'pipe', 'pipe'] });
-        let stdout = '';
-        let stderr = '';
-        let stdoutBytes = 0;
-        let stderrBytes = 0;
-        let settled = false;
-        let timedOut = false;
-        let cancelled = false;
-        let handoffStarted = !hooks.afterHandoff;
-        const finish = (exitCode, signal) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            options.signal?.removeEventListener('abort', abort);
-            resolveCommand({
-                exitCode, ...(signal ? { signal } : {}), timedOut, ...(cancelled ? { cancelled: true } : {}),
-                durationMs: Date.now() - startedAt, stdout, stderr, stdoutBytes, stderrBytes,
-            });
-        };
-        const abort = () => { cancelled = true; child.kill('SIGTERM'); };
-        options.signal?.addEventListener('abort', abort, { once: true });
-        const timer = setTimeout(() => { timedOut = true; child.kill('SIGTERM'); }, timeoutMs);
-        child.stdout.on('data', (chunk) => {
-            stdoutBytes += chunk.length;
-            if (stdoutBytes + stderrBytes > maxOutputBytes)
-                child.kill('SIGTERM');
-            else
-                stdout += chunk.toString('utf8');
-        });
-        child.stderr.on('data', (chunk) => {
-            stderrBytes += chunk.length;
-            if (stdoutBytes + stderrBytes > maxOutputBytes)
-                child.kill('SIGTERM');
-            else
-                stderr += chunk.toString('utf8');
-            if (!handoffStarted && stderr.includes('continuous-child-handoff-ready\n')) {
-                handoffStarted = true;
-                Promise.resolve(hooks.afterHandoff?.())
-                    .then(() => child.stdin.end())
-                    .catch(() => child.kill('SIGTERM'));
-            }
-        });
-        child.once('error', () => finish(null));
-        child.once('close', (code, signal) => finish(code, signal));
-        if (!hooks.afterHandoff)
-            child.stdin.end();
-    });
-}
-async function git(cwd, args) {
-    return (await gitRaw(cwd, args)).trim();
-}
-async function gitRaw(cwd, args) {
-    const result = await execFileAsync('git', args, { cwd, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
-    return String(result.stdout);
-}
-async function gitOptional(cwd, args) {
-    try {
-        return await git(cwd, args);
-    }
-    catch (error) {
-        if (isNodeError(error, 'ENOENT'))
-            return undefined;
-        throw error;
-    }
-}
-async function gitExitOk(cwd, args) {
-    try {
-        await git(cwd, args);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-async function gitWithInput(cwd, args, input) {
-    return await new Promise((resolveProcess) => {
-        const child = spawn('git', [...args], { cwd, stdio: ['pipe', 'ignore', 'ignore'] });
-        child.once('error', () => resolveProcess(false));
-        child.once('close', (code) => resolveProcess(code === 0));
-        child.stdin.end(input);
-    });
-}
-async function gitBlob(cwd, revision, path) {
-    try {
-        const result = await execFileAsync('git', ['show', `${revision}:${path}`], { cwd, encoding: 'buffer', maxBuffer: 16 * 1024 * 1024 });
-        return Buffer.from(result.stdout);
-    }
-    catch (error) {
-        if (isNodeError(error, 'ENOENT'))
-            return undefined;
-        throw error;
-    }
-}
-async function readOptional(path) {
-    try {
-        return await readFile(path);
-    }
-    catch (error) {
-        if (isNodeError(error, 'ENOENT'))
-            return undefined;
-        throw error;
-    }
-}
-async function writeOptional(boundaryRootInput, relativePathInput, content, beforeCommit) {
-    const relativePath = normalizeRepositoryPath(relativePathInput);
-    if (!safeRelativePath(relativePath))
-        throw new Error('continuous-sandbox-write-path-invalid');
-    const boundaryRoot = await realpath(boundaryRootInput);
-    if (boundaryRoot !== resolve(boundaryRootInput))
-        throw new Error('continuous-sandbox-write-root-symlink');
-    const parentRelative = dirname(relativePath) === '.' ? '' : dirname(relativePath);
-    const parentPath = await ensureContainedDirectoryPath(boundaryRoot, parentRelative);
-    const parentIdentity = await directoryIdentity(parentPath);
-    const destinationPath = join(parentPath, basename(relativePath));
-    await assertContainedDestination(destinationPath, boundaryRoot, true);
-    if (content === undefined) {
-        await beforeCommit?.({ boundaryRoot, relativePath, destinationPath });
-        await assertSameDirectoryIdentity(parentPath, boundaryRoot, parentIdentity);
-        await assertContainedDestination(destinationPath, boundaryRoot, true);
-        await anchoredRemoveFile(parentPath, basename(relativePath));
-        return;
-    }
-    await beforeCommit?.({ boundaryRoot, relativePath, destinationPath });
-    await assertSameDirectoryIdentity(parentPath, boundaryRoot, parentIdentity);
-    await assertContainedDestination(destinationPath, boundaryRoot, true);
-    await anchoredAtomicWriteFile(parentPath, basename(relativePath), content);
-    await assertContainedDestination(destinationPath, boundaryRoot, false);
-}
-async function ensureContainedDirectoryPath(boundaryRoot, relativeDirectory) {
-    let current = boundaryRoot;
-    for (const component of relativeDirectory.split('/').filter(Boolean)) {
-        current = join(current, component);
-        await anchoredEnsureDirectory(dirname(current), basename(current));
-        const entry = await lstat(current);
-        if (!entry.isDirectory() || entry.isSymbolicLink() || await realpath(current) !== current) {
-            throw new Error('continuous-sandbox-write-component-unsafe');
-        }
-        assertPathContained(boundaryRoot, current);
-    }
-    return current;
-}
-async function assertContainedDestination(path, boundaryRoot, allowMissing) {
-    assertPathContained(boundaryRoot, path);
-    try {
-        const entry = await lstat(path);
-        if (entry.isSymbolicLink() || !entry.isFile())
-            throw new Error('continuous-sandbox-write-destination-unsafe');
-        if (await realpath(path) !== path)
-            throw new Error('continuous-sandbox-write-destination-symlink');
-    }
-    catch (error) {
-        if (allowMissing && isNodeError(error, 'ENOENT'))
-            return;
-        throw error;
-    }
-}
-function assertPathContained(boundaryRoot, candidate) {
-    const relation = relative(boundaryRoot, candidate);
-    if (relation === '' || relation.startsWith('..') || isAbsolute(relation)) {
-        throw new Error('continuous-sandbox-write-containment-invalid');
-    }
-}
-async function directoryIdentity(path) {
-    const entry = await lstat(path, { bigint: true });
-    if (!entry.isDirectory() || entry.isSymbolicLink())
-        throw new Error('continuous-sandbox-write-parent-unsafe');
-    return { dev: entry.dev, ino: entry.ino };
-}
-async function sameDirectoryIdentity(path, boundaryRoot, expected) {
-    try {
-        if (path !== boundaryRoot)
-            assertPathContained(boundaryRoot, path);
-        if (await realpath(path) !== path)
-            return false;
-        const current = await directoryIdentity(path);
-        return current.dev === expected.dev && current.ino === expected.ino;
-    }
-    catch {
-        return false;
-    }
-}
-async function assertSameDirectoryIdentity(path, boundaryRoot, expected) {
-    if (!(await sameDirectoryIdentity(path, boundaryRoot, expected))) {
-        throw new Error('continuous-sandbox-write-parent-raced');
-    }
-}
-async function snapshotPaths(root, paths) {
-    return await Promise.all(paths.map(async (path) => {
-        const content = await readOptional(join(root, path));
-        return { path, ...(content !== undefined ? { content } : {}) };
-    }));
-}
-async function restoreIntegration(root, snapshots) {
-    const paths = snapshots.map((snapshot) => snapshot.path);
-    if (paths.length > 0)
-        await gitExitOk(root, ['reset', '--quiet', 'HEAD', '--', ...paths]);
-    for (const snapshot of snapshots)
-        await writeOptional(root, snapshot.path, snapshot.content);
-}
-async function acquireRootWriterLease(lease, nowIso) {
-    try {
-        const statePath = join(lease.projectRoot, '.neocortex/state.json');
-        const tracked = asRecord(JSON.parse((await readFile(statePath)).toString('utf8')));
-        const legacyEpic = asRecordOrUndefined(asRecordOrUndefined(tracked.epics)?.[lease.epicId]);
-        const legacyLease = asRecordOrUndefined(legacyEpic?.branch_lease);
-        const requested = Object.freeze({
-            schemaVersion: 1,
-            ownerStoryId: lease.storyId,
-            sessionId: lease.dispatchId,
-            idempotencyKey: lease.dispatchId,
-            acquiredAt: nowIso,
-            expiresAt: new Date(Date.parse(nowIso) + 10 * 60 * 1000).toISOString(),
-        });
-        let blocked = false;
-        await mutateGitLifecycleRuntime(lease.projectRoot, (document) => {
-            const epic = ensureRuntimeEpic(document, lease.epicId);
-            const current = asRecordOrUndefined(epic.branch_lease) ?? legacyLease;
-            if (current && typeof current.expiresAt === 'string' && current.expiresAt > nowIso
-                && (current.ownerStoryId !== lease.storyId || current.idempotencyKey !== lease.dispatchId)) {
-                blocked = true;
-                return;
-            }
-            epic.branch_mode = 'epic';
-            epic.execution_branch = lease.executionBranch;
-            epic.branch_lease = requested;
-        });
-        if (blocked)
-            return failure('continuous-epic-checkout-writer-active');
-        return { ok: true, value: requested };
-    }
-    catch {
-        return failure('continuous-writer-lease-persist-failed');
-    }
-}
-async function releaseRootWriterLease(lease) {
-    await mutateGitLifecycleRuntime(lease.projectRoot, (document) => {
-        const epic = ensureRuntimeEpic(document, lease.epicId);
-        const current = asRecordOrUndefined(epic.branch_lease);
-        if (current?.ownerStoryId === lease.storyId && current.idempotencyKey === lease.dispatchId)
-            epic.branch_lease = null;
-    });
-}
-async function persistRootCheckpoint(input) {
-    try {
-        const statePath = join(input.lease.projectRoot, '.neocortex/state.json');
-        const checkpoint = Object.freeze({
-            schemaVersion: 1,
-            storyId: input.lease.storyId,
-            epicId: input.lease.epicId,
-            branch: input.lease.executionBranch,
-            baseSha: input.baseSha,
-            headSha: input.headSha,
-            commits: Object.freeze([input.headSha]),
-            idempotencyKey: input.lease.dispatchId,
-            dispatchId: input.lease.dispatchId,
-            bundleId: input.bundle.bundleId,
-            bundleDigest: input.bundle.bundleDigest,
-            graphRevision: input.lease.graphRevision,
-            claimRevision: input.lease.claimRevision,
-            receiptRefs: Object.freeze([...new Set(input.receiptRefs)]),
-            qaVerdict: 'passed',
-            reviewVerdict: 'approved',
-            qaReceipt: input.qaReceipt,
-            reviewReceipt: input.reviewReceipt,
-            recordedAt: input.recordedAt,
-        });
-        const tracked = asRecord(JSON.parse((await readFile(statePath)).toString('utf8')));
-        const trackedStory = asRecordOrUndefined(asRecordOrUndefined(tracked.stories)?.[input.lease.storyId]);
-        let outcome = 'persisted';
-        let reused;
-        let writerAtCas;
-        let authorityRuntimeAtCas;
-        let storyAtCasBefore;
-        let storyAtCasExisted = false;
-        let epicLeaseAtCasBefore;
-        const physicalGuard = async (candidate, runtimeDocument, trackedDocument) => {
-            const currentBranch = await gitOptional(input.lease.projectRoot, ['symbolic-ref', '--quiet', '--short', 'HEAD']);
-            const currentHead = await git(input.lease.projectRoot, ['rev-parse', 'HEAD']);
-            if (currentBranch !== input.lease.executionBranch || currentHead !== input.headSha) {
-                throw new Error('continuous-checkpoint-head-raced');
-            }
-            if (candidate.graphRevision !== input.lease.graphRevision
-                || candidate.claimRevision !== input.lease.claimRevision
-                || candidate.bundleId !== input.bundle.bundleId
-                || candidate.bundleDigest !== input.bundle.bundleDigest) {
-                throw new Error('continuous-checkpoint-graph-raced');
-            }
-            const currentTracked = trackedDocument
-                ?? asRecord(JSON.parse((await readFile(statePath)).toString('utf8')));
-            const effective = applyGitLifecycleRuntimeOverlay(currentTracked, runtimeDocument ?? await readGitLifecycleRuntime(input.lease.projectRoot));
-            const currentEpic = asRecordOrUndefined(asRecordOrUndefined(effective.epics)?.[input.lease.epicId]);
-            const currentStory = asRecordOrUndefined(asRecordOrUndefined(effective.stories)?.[input.lease.storyId]);
-            const dependencies = Array.isArray(currentStory?.depends_on)
-                ? currentStory.depends_on.filter((value) => typeof value === 'string')
-                : [];
-            const effectiveStories = asRecordOrUndefined(effective.stories);
-            if (currentEpic?.execution_branch !== input.lease.executionBranch
-                || dependencies.some((dependencyId) => {
-                    const dependency = asRecordOrUndefined(effectiveStories?.[dependencyId]);
-                    return !dependency || !['done', 'completed', 'merged'].includes(String(dependency.status));
-                })) {
-                throw new Error('continuous-checkpoint-dependency-raced');
-            }
-            const changedPaths = splitNull(await gitRaw(input.lease.projectRoot, [
-                'diff-tree', '--no-commit-id', '--name-only', '-r', '-z', input.headSha,
-            ]));
-            if (changedPaths.length === 0
-                || changedPaths.some((path) => !input.lease.authorizedWriteSet.some((scope) => writeSetCovers(scope, path)))) {
-                throw new Error('continuous-checkpoint-write-set-raced');
-            }
-            if (!(await verifyAcceptedGitLifecycleStoryCheckpoint(input.lease.projectRoot, candidate, input.lease.storyId, input.lease.epicId, input.lease.executionBranch, undefined, input.lease.authorizedWriteSet)))
-                throw new Error('continuous-checkpoint-receipt-revalidation-failed');
-        };
-        const runtimeBefore = await readGitLifecycleRuntime(input.lease.projectRoot, { required: true });
-        const writerBefore = asRecordOrUndefined(asRecordOrUndefined(runtimeBefore.epics[input.lease.epicId])?.branch_lease);
-        if (writerBefore?.ownerStoryId !== input.lease.storyId
-            || writerBefore.idempotencyKey !== input.lease.dispatchId
-            || writerBefore.sessionId !== input.lease.dispatchId
-            || typeof writerBefore.expiresAt !== 'string'
-            || Date.parse(writerBefore.expiresAt) <= (input.checkpointNow?.('before-mutation') ?? Date.now())) {
-            return failure('continuous-checkpoint-writer-lease-lost');
-        }
-        if (!(await verifyGitLifecyclePhysicalIntegrationLock(input.physicalLock.path, input.physicalLock.owner))) {
-            return failure('continuous-checkpoint-integration-lock-raced');
-        }
-        const trackedAuthorityBytes = await readFile(statePath);
-        const trackedAuthorityDigest = createHash('sha256').update(trackedAuthorityBytes).digest('hex');
-        await physicalGuard(checkpoint, runtimeBefore);
-        const authorityBefore = currentGraphAuthoritySnapshot(asRecord(JSON.parse(trackedAuthorityBytes.toString('utf8'))), runtimeBefore, input.lease.epicId, input.lease.storyId);
-        if (authorityBefore.revision !== input.checkpointAuthority.revision
-            || authorityBefore.epoch !== input.checkpointAuthority.epoch
-            || authorityBefore.storyStatus !== input.checkpointAuthority.storyStatus) {
-            return failure('continuous-graph-revision-stale');
-        }
-        const persistedMutation = await mutateGitLifecycleRuntime(input.lease.projectRoot, (document) => {
-            const epic = ensureRuntimeEpic(document, input.lease.epicId);
-            const writer = asRecordOrUndefined(epic.branch_lease);
-            writerAtCas = writer === undefined ? undefined : structuredClone(writer);
-            authorityRuntimeAtCas = structuredClone(document);
-            storyAtCasExisted = document.stories[input.lease.storyId] !== undefined;
-            storyAtCasBefore = structuredClone(document.stories[input.lease.storyId] ?? {});
-            epicLeaseAtCasBefore = structuredClone(epic.branch_lease);
-            const story = ensureRuntimeStory(document, input.lease.storyId);
-            const existing = asRecordOrUndefined(story.checkpoint) ?? asRecordOrUndefined(trackedStory?.checkpoint);
-            if (existing?.idempotencyKey === input.lease.dispatchId) {
-                if (existing.baseSha !== input.baseSha || existing.headSha !== input.headSha
-                    || existing.bundleId !== input.bundle.bundleId
-                    || existing.bundleDigest !== input.bundle.bundleDigest
-                    || existing.graphRevision !== input.lease.graphRevision
-                    || existing.claimRevision !== input.lease.claimRevision) {
-                    outcome = 'conflict';
-                }
-                else {
-                    outcome = 'reused';
-                    reused = existing;
-                    epic.branch_lease = null;
-                }
-                return;
-            }
-            if (writer?.ownerStoryId !== input.lease.storyId
-                || writer.idempotencyKey !== input.lease.dispatchId
-                || writer.sessionId !== input.lease.dispatchId) {
-                outcome = 'lease-lost';
-                return;
-            }
-            story.checkpoint = checkpoint;
-            story.status = 'done';
-            story.last_step = GIT_LIFECYCLE_REVIEW_PR_STEP_ID;
-            const steps = Array.isArray(story.steps_completed) ? story.steps_completed.filter((item) => typeof item === 'string') : [];
-            story.steps_completed = [...new Set([...steps, GIT_LIFECYCLE_COMMIT_PUSH_STEP_ID, GIT_LIFECYCLE_REVIEW_PR_STEP_ID])];
-            epic.branch_lease = null;
-        }, {
-            expectedRevision: runtimeBefore.revision,
-            preCommit: async (document) => {
-                if (writerAtCas?.ownerStoryId !== input.lease.storyId
-                    || writerAtCas.idempotencyKey !== input.lease.dispatchId
-                    || writerAtCas.sessionId !== input.lease.dispatchId
-                    || typeof writerAtCas.expiresAt !== 'string'
-                    || Date.parse(writerAtCas.expiresAt) <= (input.checkpointNow?.('pre-commit') ?? Date.now())) {
-                    throw new Error('continuous-checkpoint-writer-lease-lost');
-                }
-                await input.insideCheckpointPreCommit?.({
-                    projectRoot: input.lease.projectRoot,
-                    storyId: input.lease.storyId,
-                    headSha: input.headSha,
-                });
-                if (!(await verifyGitLifecyclePhysicalIntegrationLock(input.physicalLock.path, input.physicalLock.owner))) {
-                    throw new Error('continuous-checkpoint-integration-lock-raced');
-                }
-                await physicalGuard(reused ?? checkpoint, document);
-                const finalTrackedBytes = await readFile(statePath);
-                if (createHash('sha256').update(finalTrackedBytes).digest('hex') !== trackedAuthorityDigest) {
-                    throw new Error('continuous-graph-revision-stale');
-                }
-                if (!authorityRuntimeAtCas)
-                    throw new Error('continuous-checkpoint-authority-missing');
-                const finalTracked = asRecord(JSON.parse(finalTrackedBytes.toString('utf8')));
-                const authorityAtCas = currentGraphAuthoritySnapshot(finalTracked, authorityRuntimeAtCas, input.lease.epicId, input.lease.storyId);
-                if (authorityAtCas.revision !== input.checkpointAuthority.revision
-                    || authorityAtCas.epoch !== input.checkpointAuthority.epoch
-                    || authorityAtCas.storyStatus !== input.checkpointAuthority.storyStatus) {
-                    throw new Error('continuous-graph-revision-stale');
-                }
-                if (outcome === 'persisted'
-                    && !exactPersistedCheckpointProjection(finalTracked, document, input.lease, checkpoint)) {
-                    throw new Error('continuous-checkpoint-projection-raced');
-                }
-            },
-        });
-        // The outcome is assigned inside the serialized mutation callback. TypeScript
-        // does not model writes performed by a callback, so re-widen it here.
-        const finalOutcome = outcome;
-        if (finalOutcome === 'conflict')
-            return failure('continuous-checkpoint-idempotency-conflict');
-        if (finalOutcome === 'lease-lost')
-            return failure('continuous-checkpoint-writer-lease-lost');
-        if (finalOutcome === 'reused' && reused) {
-            try {
-                await physicalGuard(reused);
-                return { ok: true, value: reused };
-            }
-            catch {
-                return failure('continuous-checkpoint-reused-evidence-invalid');
-            }
-        }
-        try {
-            await input.afterCheckpointPersist?.({
-                projectRoot: input.lease.projectRoot,
-                storyId: input.lease.storyId,
-                headSha: input.headSha,
-            });
-            const runtimeAfterPersist = await readGitLifecycleRuntime(input.lease.projectRoot, { required: true });
-            if (runtimeAfterPersist.revision !== persistedMutation.document.revision) {
-                throw new Error('continuous-checkpoint-post-persist-runtime-raced');
-            }
-            await physicalGuard(checkpoint, runtimeAfterPersist);
-            const finalTrackedBytes = await readFile(statePath);
-            if (createHash('sha256').update(finalTrackedBytes).digest('hex') !== trackedAuthorityDigest) {
-                throw new Error('continuous-checkpoint-post-persist-authority-raced');
-            }
-            const finalTracked = asRecord(JSON.parse(finalTrackedBytes.toString('utf8')));
-            if (!exactPersistedCheckpointProjection(finalTracked, runtimeAfterPersist, input.lease, checkpoint)) {
-                throw new Error('continuous-checkpoint-post-persist-projection-raced');
-            }
-        }
-        catch {
-            const cleanupTrackedBytes = await readFile(statePath).catch(() => undefined);
-            const trackedAuthorityChanged = cleanupTrackedBytes === undefined
-                || createHash('sha256').update(cleanupTrackedBytes).digest('hex') !== trackedAuthorityDigest;
-            await mutateGitLifecycleRuntime(input.lease.projectRoot, (document) => {
-                const epic = asRecordOrUndefined(document.epics[input.lease.epicId]);
-                const story = asRecordOrUndefined(document.stories[input.lease.storyId]);
-                const cleanupTracked = cleanupTrackedBytes === undefined
-                    ? undefined
-                    : asRecord(JSON.parse(cleanupTrackedBytes.toString('utf8')));
-                if (!epic || !story || !cleanupTracked
-                    || !exactPersistedCheckpointProjection(cleanupTracked, document, input.lease, checkpoint)) {
-                    throw new Error('continuous-checkpoint-cleanup-cas-conflict');
-                }
-                if (trackedAuthorityChanged) {
-                    if (storyAtCasExisted)
-                        restoreRecord(story, storyAtCasBefore ?? {});
-                    else
-                        delete document.stories[input.lease.storyId];
-                    if (epicLeaseAtCasBefore === undefined)
-                        delete epic.branch_lease;
-                    else
-                        epic.branch_lease = structuredClone(epicLeaseAtCasBefore);
-                    return;
-                }
-                story.checkpoint = null;
-                story.status = 'blocked';
-                epic.branch_lease = null;
-            }, { expectedRevision: persistedMutation.document.revision }).catch(() => undefined);
-            return failure('continuous-checkpoint-post-persist-raced');
-        }
-        return { ok: true, value: checkpoint };
-    }
-    catch (error) {
-        const reasonCode = error instanceof Error && /^continuous-/.test(error.message)
-            ? error.message
-            : 'continuous-checkpoint-persist-failed';
-        return failure(reasonCode);
-    }
-}
-async function produceIndependentCheckpointEvidence(input) {
-    try {
-        if (await git(input.lease.projectRoot, ['rev-parse', 'HEAD']) !== input.headSha) {
-            return failure('continuous-story-evidence-head-raced');
-        }
-        const manifestRaw = await readFile(join(input.lease.projectRoot, 'config', 'release-gates.v2.json'), 'utf8');
-        const manifest = JSON.parse(manifestRaw);
-        const gateIds = Array.isArray(manifest.requiredCompleteClasses)
-            ? manifest.requiredCompleteClasses.filter((item) => typeof item === 'string' && /^[a-z0-9-]+$/.test(item))
-            : [];
-        if (manifest.contract !== 'P205-CI-02' || gateIds.length === 0) {
-            return failure('continuous-story-qa-manifest-invalid');
-        }
-        const qaOutput = String((await execFileAsync(process.execPath, ['scripts/test-root.mjs', '--gate', 'complete'], {
-            cwd: input.lease.projectRoot,
-            encoding: 'utf8',
-            maxBuffer: 32 * 1024 * 1024,
-        })).stdout);
-        await input.qaRunner?.({ projectRoot: input.lease.projectRoot, storyId: input.lease.storyId, headSha: input.headSha });
-        if (await git(input.lease.projectRoot, ['rev-parse', 'HEAD']) !== input.headSha) {
-            return failure('continuous-story-qa-head-raced');
-        }
-        const checkedAt = normalizeEvidenceTime(input.nowIso);
-        const commitCount = await git(input.lease.projectRoot, ['rev-list', '--count', `${input.baseSha}..${input.headSha}`]);
-        const commitBody = await gitRaw(input.lease.projectRoot, ['show', '--no-patch', '--format=%H%n%P%n%B', input.headSha]);
-        const changedPaths = splitNull(await gitRaw(input.lease.projectRoot, ['diff', '--name-only', '-z', `${input.baseSha}..${input.headSha}`]));
-        const gitEvidenceDigest = computeImmutableStoryQaEvidenceDigest({
-            storyId: input.lease.storyId, baseSha: input.baseSha, headSha: input.headSha,
-            bundleDigest: input.bundle.bundleDigest, graphRevision: input.lease.graphRevision,
-            commitBody, changedPaths,
-        });
-        const manifestDigest = createHash('sha256').update(manifestRaw).digest('hex');
-        const resultDigest = createHash('sha256').update(qaOutput).digest('hex');
-        const qaSourceDigest = computeP205StoryQaEvidenceDigest({
-            gitEvidenceDigest, headSha: input.headSha, graphRevision: input.lease.graphRevision,
-            manifestDigest, gateIds, resultDigest,
-        });
-        const qaReceiptRef = `story-qa:${qaSourceDigest}`;
-        const qaReceipt = Object.freeze({
-            schemaVersion: 1, kind: 'story_qa_evidence', producer: 'local-yolo-tdd', evidenceVersion: 'p205-execution-v2',
-            storyId: input.lease.storyId, epicId: input.lease.epicId,
-            baseSha: input.baseSha, headSha: input.headSha,
-            bundleDigest: input.bundle.bundleDigest, graphRevision: input.lease.graphRevision,
-            contract: 'P205-CI-02', command: P205_COMPLETE_COMMAND,
-            manifestDigest, gateIds: Object.freeze(gateIds), resultDigest,
-            sourceEvidenceDigest: qaSourceDigest, verdict: 'passed', checkedAt, receiptRef: qaReceiptRef,
-        });
-        const trailers = [
-            `Neocortex-Story: ${input.lease.storyId}`,
-            `Neocortex-Epic: ${input.lease.epicId}`,
-            `Neocortex-Bundle-Digest: ${input.bundle.bundleDigest}`,
-            `Neocortex-Graph-Revision: ${input.lease.graphRevision}`,
-        ];
-        if (commitCount !== '1' || !trailers.every((trailer) => commitBody.includes(trailer))
-            || changedPaths.length === 0
-            || changedPaths.some((path) => !input.lease.authorizedWriteSet.some((authorized) => writeSetCovers(authorized, path)))) {
-            return failure('continuous-story-review-evidence-rejected');
-        }
-        const reviewSourceDigest = createHash('sha256').update([
-            'root-commit-range-review-v1', input.lease.storyId, input.baseSha, input.headSha,
-            input.bundle.bundleDigest, input.lease.graphRevision, qaReceiptRef,
-            createHash('sha256').update(commitBody).digest('hex'), [...changedPaths].sort().join(','),
-        ].join('\0')).digest('hex');
-        const reviewReceiptRef = `story-review:${reviewSourceDigest}`;
-        const reviewReceipt = Object.freeze({
-            schemaVersion: 1, kind: 'story_review_evidence', producer: 'root-commit-range-review',
-            storyId: input.lease.storyId, epicId: input.lease.epicId,
-            baseSha: input.baseSha, headSha: input.headSha,
-            bundleDigest: input.bundle.bundleDigest, graphRevision: input.lease.graphRevision,
-            sourceEvidenceDigest: reviewSourceDigest, qaReceiptRef,
-            verdict: 'approved', reviewedAt: checkedAt, receiptRef: reviewReceiptRef,
-        });
-        return { ok: true, value: { qaReceipt, reviewReceipt } };
-    }
-    catch {
-        return failure('continuous-story-evidence-production-failed');
-    }
-}
-function normalizeEvidenceTime(value) {
-    return Number.isFinite(Date.parse(value)) ? new Date(Date.parse(value)).toISOString() : new Date().toISOString();
-}
-function filterChildGitState(baseContent, childContent, storyId) {
-    if (childContent === undefined)
-        return undefined;
-    try {
-        const base = baseContent === undefined ? {} : asRecord(JSON.parse(baseContent.toString('utf8')));
-        const untrustedChild = asRecord(JSON.parse(childContent.toString('utf8')));
-        const child = structuredClone(base);
-        const baseStory = asRecordOrUndefined(asRecordOrUndefined(base.stories)?.[storyId]);
-        const untrustedStory = asRecordOrUndefined(asRecordOrUndefined(untrustedChild.stories)?.[storyId]);
-        const stories = ensureRecord(child, 'stories');
-        const childStory = structuredClone(baseStory ?? {});
-        for (const field of [
-            'status', 'last_step', 'steps_completed', 'last_updated', 'blocked_reason',
-            'blocked_at', 'implementation_evidence', 'validation_evidence', 'qa_gate',
-        ]) {
-            if (untrustedStory && Object.prototype.hasOwnProperty.call(untrustedStory, field)) {
-                childStory[field] = structuredClone(untrustedStory[field]);
-            }
-        }
-        stories[storyId] = childStory;
-        return Buffer.from(`${JSON.stringify(child, null, 2)}\n`);
-    }
-    catch {
-        return Buffer.from('{invalid-child-state');
-    }
-}
-function ensureRecord(parent, key) {
-    const current = asRecordOrUndefined(parent[key]);
-    if (current)
-        return current;
-    const created = {};
-    parent[key] = created;
-    return created;
-}
-function asRecord(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        throw new Error('record expected');
-    return value;
-}
-function asRecordOrUndefined(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
-}
-function mergeBuffers(base, root, child) {
-    if (sameBuffer(child, base) || sameBuffer(root, child))
-        return { ok: true, value: root };
-    if (sameBuffer(root, base))
-        return { ok: true, value: child };
-    return failure('continuous-context-merge-conflict');
-}
-function mergeJsonBuffers(base, root, child) {
-    try {
-        const merged = mergeJsonValue(parseJson(base), parseJson(root), parseJson(child));
-        return merged.ok ? { ok: true, value: merged.value === undefined ? undefined : Buffer.from(`${JSON.stringify(merged.value, null, 2)}\n`) } : merged;
-    }
-    catch {
-        return failure('continuous-state-merge-invalid');
-    }
-}
-function parseJson(value) {
-    return value === undefined ? undefined : JSON.parse(value.toString('utf8'));
-}
-function mergeJsonValue(base, root, child) {
-    if (sameJson(child, base) || sameJson(root, child))
-        return { ok: true, value: root };
-    if (sameJson(root, base))
-        return { ok: true, value: child };
-    if (isPlainRecord(base) && isPlainRecord(root) && isPlainRecord(child)) {
-        const merged = {};
-        for (const key of [...new Set([...Object.keys(base), ...Object.keys(root), ...Object.keys(child)])].sort()) {
-            const value = mergeJsonValue(base[key], root[key], child[key]);
-            if (!value.ok)
-                return value;
-            if (value.value !== undefined)
-                merged[key] = value.value;
-        }
-        return { ok: true, value: merged };
-    }
-    if (Array.isArray(base) && Array.isArray(root) && Array.isArray(child) && isJsonPrefix(base, root) && isJsonPrefix(base, child)) {
-        const values = [...base, ...root.slice(base.length), ...child.slice(base.length)];
-        const seen = new Set();
-        return { ok: true, value: values.filter((item) => {
-                const key = JSON.stringify(item);
-                if (seen.has(key))
-                    return false;
-                seen.add(key);
-                return true;
-            }) };
-    }
-    return failure('continuous-state-merge-conflict');
-}
-function isPlainRecord(value) {
-    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
-}
-function isJsonPrefix(prefix, value) {
-    return prefix.length <= value.length && prefix.every((item, index) => sameJson(item, value[index]));
-}
-function sameJson(left, right) {
-    return JSON.stringify(left) === JSON.stringify(right);
-}
-function sameBuffer(left, right) {
-    return left === undefined || right === undefined ? left === right : left.equals(right);
-}
-function splitNull(value) {
-    return value.split('\0').filter(Boolean);
-}
-function safeRelativePath(value) {
-    const normalized = normalizeRepositoryPath(value);
-    return normalized.length > 0 && normalized.length <= 1024 && !isAbsolute(normalized)
-        && !/^[A-Za-z]:\//.test(normalized) && !normalized.split('/').includes('..')
-        && !normalized.includes('\0') && !normalized.startsWith('/');
-}
-function normalizeRepositoryPath(value) {
-    return value.replaceAll('\\', '/').replace(/^\.\//, '').replace(/\/{2,}/g, '/');
-}
-function normalizeWriteSet(values) {
-    const normalized = values.map(normalizeRepositoryPath).filter(safeRelativePath);
-    return [...new Set(normalized)].sort();
-}
-function writeSetCovers(authorized, changed) {
-    const scope = normalizeRepositoryPath(authorized);
-    const path = normalizeRepositoryPath(changed);
-    return scope === path || scope.endsWith('/') && path.startsWith(scope);
-}
-function safeBranch(value) {
-    return value.length > 0 && value.length <= 240 && !value.startsWith('-') && !value.startsWith('/')
-        && !value.endsWith('/') && !value.endsWith('.lock') && !value.includes('..') && !value.includes('\\')
-        && !value.includes('@{') && !value.includes('//') && /^[A-Za-z0-9._/-]+$/.test(value);
-}
-function sameStrings(left, right) {
-    return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-async function readCurrentGraphAuthoritySnapshot(projectRoot, epicId, storyId, runtimeDocument) {
-    const tracked = asRecord(JSON.parse(await readFile(join(projectRoot, '.neocortex/state.json'), 'utf8')));
-    return currentGraphAuthoritySnapshot(tracked, runtimeDocument ?? await readGitLifecycleRuntime(projectRoot), epicId, storyId);
-}
-function currentGraphAuthoritySnapshot(tracked, runtimeDocument, epicId, storyId) {
-    const effective = applyGitLifecycleRuntimeOverlay(tracked, runtimeDocument);
-    const epics = asRecordOrUndefined(effective.epics);
-    const stories = asRecordOrUndefined(effective.stories);
-    const epic = asRecordOrUndefined(epics?.[epicId]) ?? {};
-    const authoredStoryIds = (Array.isArray(epic.stories) ? epic.stories : Array.isArray(epic.story_ids) ? epic.story_ids : [])
-        .filter((value) => typeof value === 'string');
-    const storyIds = authoredStoryIds.length > 0
-        ? authoredStoryIds
-        : Object.entries(stories ?? {})
-            .filter(([storyId, value]) => {
-            const story = asRecordOrUndefined(value);
-            return story?.epic_id === epicId || storyId.startsWith(`${epicId}.`);
-        })
-            .map(([storyId]) => storyId)
-            .sort();
-    const authorityFields = [
-        'status', 'depends_on', 'files_to_modify', 'contracts', 'contract_refs', 'shared_surfaces',
-        'steps_completed', 'last_step', 'branch_name', 'physicalMergeStatus', 'merged', 'checkpoint',
-        'planning', 'attempts', 'retry_count', 'rollback_receipt', 'cancelled_at',
-    ];
-    const storyAuthority = Object.fromEntries(storyIds.map((storyId) => {
-        const story = asRecordOrUndefined(stories?.[storyId]) ?? {};
-        return [storyId, Object.fromEntries(authorityFields
-                .filter((field) => Object.prototype.hasOwnProperty.call(story, field))
-                .map((field) => [field, story[field]]))];
-    }));
-    return {
-        revision: hashCanonical({
-            epicId,
-            epic: {
-                stories: storyIds,
-                status: epic.status ?? null,
-                branch_mode: epic.branch_mode ?? null,
-                execution_branch: epic.execution_branch ?? null,
-                graph_revision: epic.graph_revision ?? null,
-                depends_on: epic.depends_on ?? null,
-                planning: epic.planning ?? null,
-                execution_plan: epic.execution_plan ?? null,
-                waves: epic.waves ?? null,
-                current_wave: epic.current_wave ?? null,
-                replan: epic.replan ?? null,
-                replan_revision: epic.replan_revision ?? null,
-                dependency_graph: epic.dependency_graph ?? null,
-                scheduler: epic.scheduler ?? null,
-                attempts: epic.attempts ?? null,
-                retry_count: epic.retry_count ?? null,
-            },
-            stories: storyAuthority,
-        }),
-        epoch: typeof epic.graph_revision === 'string' ? epic.graph_revision : null,
-        storyStatus: typeof asRecordOrUndefined(stories?.[storyId])?.status === 'string'
-            ? String(asRecordOrUndefined(stories?.[storyId])?.status)
-            : null,
-    };
-}
-function exactPersistedCheckpointProjection(tracked, runtimeDocument, lease, checkpoint) {
-    const effective = applyGitLifecycleRuntimeOverlay(tracked, runtimeDocument);
-    const epic = asRecordOrUndefined(asRecordOrUndefined(effective.epics)?.[lease.epicId]);
-    const story = asRecordOrUndefined(asRecordOrUndefined(effective.stories)?.[lease.storyId]);
-    const steps = Array.isArray(story?.steps_completed)
-        ? story.steps_completed.filter((value) => typeof value === 'string')
-        : [];
-    return Boolean(epic && story
-        && epic.branch_lease === null
-        && story.status === 'done'
-        && story.last_step === GIT_LIFECYCLE_REVIEW_PR_STEP_ID
-        && steps.includes(GIT_LIFECYCLE_COMMIT_PUSH_STEP_ID)
-        && steps.includes(GIT_LIFECYCLE_REVIEW_PR_STEP_ID)
-        && canonicalJson(story.checkpoint) === canonicalJson(checkpoint));
-}
-function restoreRecord(target, previous) {
-    for (const key of Object.keys(target))
-        delete target[key];
-    Object.assign(target, structuredClone(previous));
-}
-async function readCurrentGraphAuthorityRevision(projectRoot, epicId) {
-    return (await readCurrentGraphAuthoritySnapshot(projectRoot, epicId, '')).revision;
-}
-function hashCanonical(value) {
-    return createHash('sha256').update(canonicalJson(value)).digest('hex');
-}
-function canonicalJson(value) {
-    if (value === null || typeof value !== 'object')
-        return JSON.stringify(value);
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(',')}]`;
-    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, child]) => `${JSON.stringify(key)}:${canonicalJson(child)}`).join(',')}}`;
-}
-function normalizeReceiptRefs(values, dispatchId) {
-    const safe = (values ?? []).filter((value) => /^[A-Za-z0-9._/:@#-]{1,200}$/.test(value) && !value.includes('..'));
-    return Object.freeze([...new Set(safe.length > 0 ? safe : [`dispatch:${dispatchId}`])].sort());
-}
-function safeRef(value) {
-    return value.replace(/[^A-Za-z0-9._-]/g, '-').slice(0, 80);
-}
-function failure(reasonCode) {
-    return { ok: false, reasonCode };
-}
-function isNodeError(error, code) {
-    return error instanceof Error && 'code' in error && error.code === code;
-}
-async function readLeaseOwner(leasePath, leasesRoot) {
-    try {
-        await assertGitLifecyclePrivateDirectory(leasePath, leasesRoot);
-        const ownerPath = join(leasePath, 'owner.json');
-        await assertGitLifecyclePrivateFile(ownerPath, leasePath);
-        const parsed = JSON.parse(await readFile(ownerPath, 'utf8'));
-        if (!Number.isSafeInteger(parsed.pid) || Number(parsed.pid) <= 0
-            || typeof parsed.createdAt !== 'string' || !Number.isFinite(Date.parse(parsed.createdAt))
-            || typeof parsed.nonce !== 'string' || !/^[a-f0-9]{32}$/.test(parsed.nonce)) {
-            throw new Error('continuous-sandbox-lease-owner-invalid');
-        }
-        return { pid: Number(parsed.pid), createdAt: parsed.createdAt, nonce: parsed.nonce };
-    }
-    catch (error) {
-        if (isNodeError(error, 'ENOENT'))
-            return undefined;
-        throw error;
-    }
-}
-function sameLeaseOwner(left, right) {
-    return left?.pid === right.pid && left.createdAt === right.createdAt && left.nonce === right.nonce;
-}
-function processExists(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return isNodeError(error, 'EPERM');
-    }
-}
-async function readSandboxMetadata(workspacePath, sandboxesRoot) {
-    try {
-        await assertGitLifecyclePrivateDirectory(workspacePath, sandboxesRoot);
-        const gitDirectory = join(workspacePath, '.git');
-        await assertGitLifecyclePrivateDirectory(gitDirectory, workspacePath);
-        const metadataPath = join(gitDirectory, 'neocortex-sandbox.json');
-        await assertGitLifecyclePrivateFile(metadataPath, gitDirectory);
-        const parsed = JSON.parse(await readFile(metadataPath, 'utf8'));
-        if (parsed.schemaVersion !== 1 || typeof parsed.workspaceOwnerNonce !== 'string'
-            || !/^[a-f0-9]{32}$/.test(parsed.workspaceOwnerNonce)
-            || !/^[a-f0-9]{64}$/.test(parsed.graphAuthorityRevision)
-            || !(parsed.graphAuthorityEpoch === null || /^[a-f0-9]{64}$/.test(parsed.graphAuthorityEpoch))
-            || !(parsed.graphAuthorityStoryStatus === null
-                || typeof parsed.graphAuthorityStoryStatus === 'string' && parsed.graphAuthorityStoryStatus.length <= 80)
-            || typeof parsed.workspaceIdentity?.dev !== 'string' || !/^[0-9]+$/.test(parsed.workspaceIdentity.dev)
-            || typeof parsed.workspaceIdentity?.ino !== 'string' || !/^[0-9]+$/.test(parsed.workspaceIdentity.ino)) {
-            throw new Error('continuous-sandbox-metadata-invalid');
-        }
-        return parsed;
-    }
-    catch (error) {
-        if (isNodeError(error, 'ENOENT'))
-            return undefined;
-        throw error;
-    }
-}
-async function writeSandboxMetadata(workspacePath, sandboxesRoot, metadata, beforeCommit) {
-    await assertGitLifecyclePrivateDirectory(workspacePath, sandboxesRoot);
-    const gitDirectory = join(workspacePath, '.git');
-    await assertGitLifecyclePrivateDirectory(gitDirectory, workspacePath);
-    const metadataPath = join(gitDirectory, 'neocortex-sandbox.json');
-    await writeOptional(workspacePath, '.git/neocortex-sandbox.json', Buffer.from(`${JSON.stringify(metadata, null, 2)}\n`), beforeCommit);
-    await assertGitLifecyclePrivateFile(metadataPath, gitDirectory);
-}
-async function readMarker(markerPath, integratedRoot) {
-    try {
-        await assertGitLifecyclePrivateFile(markerPath, integratedRoot);
-        const parsed = JSON.parse(await readFile(markerPath, 'utf8'));
-        return typeof parsed.childHeadSha === 'string' && typeof parsed.rootHeadSha === 'string'
-            && /^[a-f0-9]{40,64}$/.test(parsed.childHeadSha) && /^[a-f0-9]{40,64}$/.test(parsed.rootHeadSha)
-            && parsed.bundle?.schemaVersion === 1 && parsed.checkpoint?.schemaVersion === 1
-            ? parsed
-            : undefined;
-    }
-    catch (error) {
-        if (isNodeError(error, 'ENOENT'))
-            return undefined;
-        throw error;
-    }
-}
-async function checkpointExistsInRootState(lease, checkpoint) {
-    try {
-        const tracked = asRecord(JSON.parse(await readFile(join(lease.projectRoot, '.neocortex/state.json'), 'utf8')));
-        const state = applyGitLifecycleRuntimeOverlay(tracked, await readGitLifecycleRuntime(lease.projectRoot));
-        const current = asRecordOrUndefined(asRecordOrUndefined(state.stories)?.[lease.storyId]);
-        const persisted = asRecordOrUndefined(current?.checkpoint);
-        return persisted?.idempotencyKey === checkpoint.idempotencyKey
-            && persisted.headSha === checkpoint.headSha
-            && persisted.bundleDigest === checkpoint.bundleDigest
-            && asRecordOrUndefined(asRecordOrUndefined(state.epics)?.[lease.epicId])?.branch_lease === null
-            && await verifyAcceptedGitLifecycleStoryCheckpoint(lease.projectRoot, persisted, lease.storyId, lease.epicId, lease.executionBranch, undefined, lease.authorizedWriteSet);
-    }
-    catch {
-        return false;
-    }
-}
-async function readMatchingRootCheckpoint(lease, bundle, commit) {
-    try {
-        const tracked = asRecord(JSON.parse(await readFile(join(lease.projectRoot, '.neocortex/state.json'), 'utf8')));
-        const state = applyGitLifecycleRuntimeOverlay(tracked, await readGitLifecycleRuntime(lease.projectRoot));
-        const story = asRecordOrUndefined(asRecordOrUndefined(state.stories)?.[lease.storyId]);
-        const checkpoint = asRecordOrUndefined(story?.checkpoint);
-        if (checkpoint?.schemaVersion !== 1
-            || checkpoint.storyId !== lease.storyId
-            || checkpoint.epicId !== lease.epicId
-            || checkpoint.branch !== lease.executionBranch
-            || checkpoint.baseSha !== commit.baseSha
-            || checkpoint.headSha !== commit.headSha
-            || checkpoint.idempotencyKey !== lease.dispatchId
-            || checkpoint.dispatchId !== lease.dispatchId
-            || checkpoint.bundleId !== bundle.bundleId
-            || checkpoint.bundleDigest !== bundle.bundleDigest
-            || checkpoint.graphRevision !== lease.graphRevision
-            || checkpoint.claimRevision !== lease.claimRevision
-            || asRecordOrUndefined(asRecordOrUndefined(state.epics)?.[lease.epicId])?.branch_lease !== null
-            || !(await verifyAcceptedGitLifecycleStoryCheckpoint(lease.projectRoot, checkpoint, lease.storyId, lease.epicId, lease.executionBranch, undefined, lease.authorizedWriteSet)))
-            return undefined;
-        return checkpoint;
-    }
-    catch {
-        return undefined;
-    }
-}
-async function findIntegratedDispatchCommit(lease, bundle) {
-    const matches = (await gitOptional(lease.projectRoot, [
-        'log', '--format=%H', '--fixed-strings', `--grep=Neocortex-Dispatch: ${lease.dispatchId}`,
-    ]))?.split('\n').filter((sha) => /^[a-f0-9]{40,64}$/.test(sha)) ?? [];
-    if (matches.length !== 1)
-        return undefined;
-    const headSha = matches[0];
-    if (!(await gitExitOk(lease.projectRoot, ['merge-base', '--is-ancestor', headSha, 'HEAD'])))
-        return undefined;
-    const message = await git(lease.projectRoot, ['show', '-s', '--format=%B', headSha]);
-    const trailers = new Set(message.split('\n').map((line) => line.trim()));
-    for (const trailer of [
-        `Neocortex-Story: ${lease.storyId}`,
-        `Neocortex-Epic: ${lease.epicId}`,
-        `Neocortex-Execution-Branch: ${lease.executionBranch}`,
-        `Neocortex-Prepared-Base: ${lease.baseSha}`,
-        `Neocortex-Dispatch: ${lease.dispatchId}`,
-        `Neocortex-Bundle: ${bundle.bundleId}`,
-        `Neocortex-Bundle-Digest: ${bundle.bundleDigest}`,
-        `Neocortex-Graph-Revision: ${lease.graphRevision}`,
-        `Neocortex-Claim-Revision: ${lease.claimRevision}`,
-    ])
-        if (!trailers.has(trailer))
-            return undefined;
-    const authorityRevision = readCommitTrailer(message, 'Neocortex-Checkpoint-Authority');
-    const authorityEpoch = readCommitTrailer(message, 'Neocortex-Checkpoint-Epoch');
-    const authorityStoryStatus = readCommitTrailer(message, 'Neocortex-Checkpoint-Story-Status');
-    if (!authorityRevision || !/^[a-f0-9]{64}$/.test(authorityRevision)
-        || !authorityEpoch || !(authorityEpoch === 'null' || /^[a-f0-9]{64}$/.test(authorityEpoch))
-        || !authorityStoryStatus || authorityStoryStatus.length > 80)
-        return undefined;
-    const parentSha = await gitOptional(lease.projectRoot, ['rev-parse', `${headSha}^`]);
-    if (!parentSha || !/^[a-f0-9]{40,64}$/.test(parentSha))
-        return undefined;
-    const committedPaths = splitNull(await gitRaw(lease.projectRoot, [
-        'diff-tree', '--no-commit-id', '--name-only', '-r', '-z', headSha,
-    ]));
-    if (committedPaths.length === 0 || committedPaths.some((path) => !bundle.authorizedWriteSet.some((scope) => writeSetCovers(scope, path))))
-        return undefined;
-    return {
-        baseSha: parentSha,
-        headSha,
-        checkpointAuthority: {
-            revision: authorityRevision,
-            epoch: authorityEpoch === 'null' ? null : authorityEpoch,
-            storyStatus: authorityStoryStatus === 'null' ? null : authorityStoryStatus,
-        },
-    };
-}
-function readCommitTrailer(message, name) {
-    const prefix = `${name}: `;
-    const matches = message.split('\n').map((line) => line.trim()).filter((line) => line.startsWith(prefix));
-    return matches.length === 1 ? matches[0].slice(prefix.length) : undefined;
-}
-async function writeMarker(markerPath, childHeadSha, rootHeadSha, bundle, checkpoint, beforeCommit) {
-    const integratedRoot = dirname(markerPath);
-    await assertGitLifecyclePrivateDirectory(integratedRoot, dirname(integratedRoot));
-    try {
-        await assertGitLifecyclePrivateFile(markerPath, integratedRoot);
-    }
-    catch (error) {
-        if (!isNodeError(error, 'ENOENT'))
-            throw error;
-    }
-    await writeOptional(integratedRoot, basename(markerPath), Buffer.from(`${JSON.stringify({ childHeadSha, rootHeadSha, bundle, checkpoint })}\n`), beforeCommit);
-    await assertGitLifecyclePrivateFile(markerPath, integratedRoot);
-}
+`;function ur(e,r={}){return async(t,o,n={})=>Nt(e,t,o,n,r)}function hr(e={}){let r=Promise.resolve();return{async prepare(t){if((e.platform??process.platform)==="win32")return f("continuous-sandbox-platform-unsupported");if(!/^[a-f0-9]{64}$/.test(t.dispatchId))return f("continuous-sandbox-dispatch-invalid");if(!ce(t.targetRef))return f("continuous-sandbox-target-invalid");if(!Jt(t.executionBranch))return f("continuous-execution-branch-invalid");if(!/^[a-f0-9]{64}$/.test(t.graphRevision))return f("continuous-graph-revision-invalid");const o=Ht(t.authorizedWriteSet);if(o.length===0||o.length!==t.authorizedWriteSet.length)return f("continuous-authorized-write-set-invalid");const n=Te(o),a=r;let c=()=>{};r=new Promise(s=>{c=s}),await a;let i,d;try{const s=await At(t.projectRoot),g=await P(s,["rev-parse","HEAD"]),S=await Ie(s,t.epicId,t.storyId),v=S.revision,A=await gt(s),w=await be(A,"leases"),j=D(w,t.dispatchId);try{await Ee(w,t.dispatchId),await W(j,w)}catch(m){if(!q(m,"EEXIST"))throw m;await W(j,w);const l=await ue(j,w);if(l!==void 0&&Qt(l.pid))return f("continuous-sandbox-lease-active");if(!l||!await oe(j,w,async E=>ot(await ue(E,w),l)))return f("continuous-sandbox-lease-owner-replaced");await Ee(w,t.dispatchId),await W(j,w)}i=j,d=Object.freeze({pid:process.pid,createdAt:new Date().toISOString(),nonce:Ke(16).toString("hex")}),await te(j,"owner.json",Buffer.from(JSON.stringify(d)),e.beforeSandboxWriteCommit),await F(D(j,"owner.json"),j);const R=await be(A,"sandboxes"),p=D(R,t.dispatchId.slice(0,20)),I=await Ge(p,R);let b,u;const k=I?.preparedAt??new Date().toISOString(),x=I?.workspaceOwnerNonce??Ke(16).toString("hex");if(I){if(I.projectRoot!==s||I.storyId!==t.storyId||I.targetRef!==t.targetRef||I.dispatchId!==t.dispatchId||I.epicId!==t.epicId||I.executionBranch!==t.executionBranch||I.graphRevision!==t.graphRevision||I.claimRevision!==n||I.graphAuthorityRevision!==v||I.graphAuthorityEpoch!==S.epoch||I.graphAuthorityStoryStatus!==S.storyStatus||!rt(I.authorizedWriteSet,o)||(b=I.contextSnapshots.map(m=>({path:m.path,...m.contentBase64!==void 0?{content:Buffer.from(m.contentBase64,"base64")}:{}})),u=await Rt(p),u.dev!==I.workspaceIdentity.dev||u.ino!==I.workspaceIdentity.ino))return f("continuous-sandbox-recovery-mismatch")}else await oe(p,R),u=await Ee(R,$(p)),await W(p,R),await ne(R,$(p),u,["init","--quiet"]),await Dt(s,p),await jt(s,R,$(p),u),await ne(R,$(p),u,["remote","add","neocortex-root",s]),await ne(R,$(p),u,["fetch","--quiet","--no-tags","neocortex-root",g]),await ne(R,$(p),u,["checkout","--quiet","--detach","FETCH_HEAD"]),b=await Et(s,p,t.epicId,t.targetRef,e.beforeSandboxWriteCommit),await Zt(p,R,{schemaVersion:1,projectRoot:s,storyId:t.storyId,targetRef:t.targetRef,epicId:t.epicId,executionBranch:t.executionBranch,graphRevision:t.graphRevision,graphAuthorityRevision:v,graphAuthorityEpoch:S.epoch,graphAuthorityStoryStatus:S.storyStatus,authorizedWriteSet:o,claimRevision:n,dispatchId:t.dispatchId,baseSha:g,preparedAt:k,workspaceOwnerNonce:x,workspaceIdentity:u,contextSnapshots:b.map(m=>({path:m.path,...m.content!==void 0?{contentBase64:m.content.toString("base64")}:{}}))},e.beforeSandboxWriteCommit);return i=void 0,{ok:!0,value:{projectRoot:s,workspacePath:p,workspaceStrategy:"branchless_sandbox",storyId:t.storyId,targetRef:t.targetRef,epicId:t.epicId,executionBranch:t.executionBranch,graphRevision:t.graphRevision,graphAuthorityRevision:v,graphAuthorityEpoch:S.epoch,graphAuthorityStoryStatus:S.storyStatus,authorizedWriteSet:o,claimRevision:n,baseSha:I?.baseSha??g,dispatchId:t.dispatchId,preparedAt:k,leasePath:j,leaseOwnerNonce:d.nonce,workspaceOwnerNonce:x,workspaceIdentity:u,contextSnapshots:b}}}catch{if(i&&d){const s=i,g=d;await oe(s,C(s),async S=>ot(await ue(S,C(s)),g)).catch(()=>{})}return f("continuous-sandbox-prepare-failed")}finally{c()}},async integrate(t,o){const n=await ue(t.leasePath,C(t.leasePath)).catch(()=>{}),a=await Ge(t.workspacePath,C(t.workspacePath)).catch(()=>{});if(!n||n.nonce!==t.leaseOwnerNonce||a?.workspaceOwnerNonce!==t.workspaceOwnerNonce||a.dispatchId!==t.dispatchId||a.storyId!==t.storyId)return f("continuous-sandbox-owner-mismatch");const c=Xe(o?.nowIso??new Date().toISOString()),i=await lt(t.projectRoot,{kind:"continuous",storyId:t.storyId,sessionId:t.dispatchId,idempotencyKey:t.dispatchId,expiresAt:new Date(Date.parse(c)+1800*1e3).toISOString(),persistent:!1,createdAt:c});if(!i.ok)return f(i.reasonCode==="git-lifecycle-integration-backpressure"?"continuous-integration-backpressure":"continuous-integration-lease-failed");let d=[],s=!1,g=!1;try{const S=(await ie(t,["status","--porcelain"])).trimEnd(),v=await De(t,["rev-parse","HEAD"]);if(await ee(t.projectRoot,["symbolic-ref","--quiet","--short","HEAD"])!==t.executionBranch)return f("continuous-execution-branch-mismatch");const w=C(C(t.leasePath)),j=await be(w,"integrated"),R=D(j,t.dispatchId),p=await Ut(R,j);if(p?.childHeadSha===v&&p.bundle.storyId===t.storyId&&p.bundle.epicId===t.epicId&&p.bundle.executionBranch===t.executionBranch&&p.bundle.graphRevision===t.graphRevision&&p.bundle.claimRevision===t.claimRevision&&rt(p.bundle.authorizedWriteSet,t.authorizedWriteSet)&&p.checkpoint.idempotencyKey===t.dispatchId&&p.checkpoint.bundleId===p.bundle.bundleId&&p.checkpoint.bundleDigest===p.bundle.bundleDigest&&p.checkpoint.graphRevision===t.graphRevision&&p.checkpoint.claimRevision===t.claimRevision&&await ae(t.projectRoot,["merge-base","--is-ancestor",p.rootHeadSha,"HEAD"])&&await Yt(t,p.checkpoint))return{ok:!0,value:{headSha:p.rootHeadSha,alreadyIntegrated:!0,bundle:p.bundle,checkpoint:p.checkpoint}};if(v!==t.baseSha)return f("continuous-sandbox-child-git-authority-denied");if(S.length===0)return f("continuous-bundle-empty");const I=S.split(`
+`).some(y=>y.length>0&&y[0]!==" "&&y[0]!=="?");I||await De(t,["add","-A"]);const b=L(await ie(t,["diff","--cached","--name-only","-z",t.baseSha]));if(b.length===0||b.some(y=>!ce(y)))return f("continuous-integration-write-set-invalid");if(!await Ct(t,["merge-base","--is-ancestor",t.baseSha,v]))return f("continuous-bundle-base-not-ancestor");if(!await ae(t.projectRoot,["merge-base","--is-ancestor",t.baseSha,"HEAD"]))return f("continuous-root-base-not-ancestor");const u=o?.nowIso??new Date().toISOString(),k=Ft(o?.receiptRefs,t.dispatchId),x=await ie(t,["diff","--cached","--binary",t.baseSha]),m={schemaVersion:1,storyId:t.storyId,epicId:t.epicId,executionBranch:t.executionBranch,baseSha:t.baseSha,bundleDigest:G("sha256").update(x).digest("hex"),graphRevision:t.graphRevision,claimRevision:t.claimRevision,authorizedWriteSet:t.authorizedWriteSet,contextDigests:Object.fromEntries(t.contextSnapshots.map(y=>[y.path,G("sha256").update(y.content??Buffer.alloc(0)).digest("hex")])),validationRefs:k,createdAt:t.preparedAt,expiresAt:new Date(Date.parse(t.preparedAt)+1440*60*1e3).toISOString(),branchless:!0},l=Object.freeze({...m,bundleId:Te(m)}),E=await er(t,l);if(E){const y=await Xt(t,l,E);if(y)return await We(R,v,E.headSha,l,y,e.beforeSandboxWriteCommit),{ok:!0,value:{headSha:E.headSha,alreadyIntegrated:!0,bundle:l,checkpoint:y}}}if(!E&&await Kt(t.projectRoot,t.epicId)!==t.graphAuthorityRevision)return f("continuous-graph-revision-stale");if(E){const y=await Ye({lease:t,bundle:l,baseSha:E.baseSha,headSha:E.headSha,receiptRefs:k,nowIso:u,qaRunner:e.storyQaRunner});if(!y.ok)return y;await e.beforeCheckpointPersist?.({projectRoot:t.projectRoot,storyId:t.storyId,headSha:E.headSha});const O=await Ue({lease:t,physicalLock:i,checkpointAuthority:E.checkpointAuthority,bundle:l,baseSha:E.baseSha,headSha:E.headSha,receiptRefs:[...k,`bundle:${l.bundleId}`,y.value.qaReceipt.receiptRef,y.value.reviewReceipt.receiptRef],qaReceipt:y.value.qaReceipt,reviewReceipt:y.value.reviewReceipt,recordedAt:u,checkpointNow:e.checkpointNow,insideCheckpointPreCommit:e.insideCheckpointPreCommit,afterCheckpointPersist:e.afterCheckpointPersist});return O.ok?(await We(R,v,E.headSha,l,O.value,e.beforeSandboxWriteCommit),{ok:!0,value:{headSha:E.headSha,alreadyIntegrated:!0,bundle:l,checkpoint:O.value}}):O}if(I)return f("continuous-sandbox-child-git-authority-denied");if(L(await z(t.projectRoot,["diff","--cached","--name-only","-z"])).length>0)return f("continuous-integration-root-index-dirty");const J=new Set(t.contextSnapshots.map(y=>y.path));if(b.filter(y=>!t.authorizedWriteSet.some(O=>Se(O,y))).length>0)return f("continuous-bundle-write-set-unauthorized");const M=b.filter(y=>!J.has(y)),Re=new Set(L(await z(t.projectRoot,["diff","--name-only","-z",`${t.baseSha}..HEAD`])));if(M.some(y=>Re.has(y)))return f("continuous-bundle-intervening-conflict");const he=new Set([...L(await z(t.projectRoot,["diff","--name-only","-z"])),...L(await z(t.projectRoot,["ls-files","--others","--exclude-standard","-z"]))]);if(M.some(y=>he.has(y)))return f("continuous-integration-root-conflict");d=await $t(t.projectRoot,[...new Set([...b,".neocortex/state.json"])]);const H=await zt(t,u);if(!H.ok)return H;const K=pt({bundle:l,payload:Buffer.from(x),expected:{epicId:t.epicId,storyId:t.storyId,executionBranch:t.executionBranch,baseSha:t.baseSha,graphRevision:t.graphRevision,claimRevision:t.claimRevision,authorizedWriteSet:t.authorizedWriteSet,nowIso:u},writerLease:H.value});if(K.length>0)return await Ne(t.projectRoot,d),f(`continuous-bundle-admission-${K[0]}`);const fe=await P(t.projectRoot,["rev-parse","HEAD"]);let Q;await e.beforeRootCommit?.({projectRoot:t.projectRoot,storyId:t.storyId,headSha:fe});try{await X(t.projectRoot,y=>{const O=h(ye(y,t.epicId).branch_lease);if(O?.ownerStoryId!==t.storyId||O.sessionId!==t.dispatchId||O.idempotencyKey!==t.dispatchId||Date.parse(String(O.expiresAt))<=Date.now())throw new Error("continuous-checkpoint-writer-lease-lost")},{preCommit:async y=>{const O=await Ie(t.projectRoot,t.epicId,t.storyId,y);if(O.revision!==t.graphAuthorityRevision||O.epoch!==t.graphAuthorityEpoch||O.storyStatus!==t.graphAuthorityStoryStatus)throw new Error("continuous-graph-revision-stale");if(!await xe(i.path,i.owner))throw new Error("continuous-integration-lock-raced");const nt=await ee(t.projectRoot,["symbolic-ref","--quiet","--short","HEAD"]),it=await P(t.projectRoot,["rev-parse","HEAD"]);if(nt!==t.executionBranch||it!==fe)throw new Error("continuous-integration-head-raced");const at=L(await z(t.projectRoot,["diff","--cached","--name-only","-z"])),ct=new Set([...L(await z(t.projectRoot,["diff","--name-only","-z"])),...L(await z(t.projectRoot,["ls-files","--others","--exclude-standard","-z"]))]);if(at.length>0)throw new Error("continuous-integration-root-index-dirty");if(M.some(_=>ct.has(_)))throw new Error("continuous-integration-root-conflict");if(g=!0,M.length>0){const _=await ie(t,["diff","--cached","--binary",t.baseSha,"--",...M]);if(_.length>0&&!await _t(t.projectRoot,["apply","--index","--3way","--whitespace=nowarn"],_))throw new Error("continuous-integration-conflict")}for(const _ of t.contextSnapshots){if(!b.includes(_.path))continue;const qe=await Ce(D(t.projectRoot,_.path)),He=await Ot(t,_.path),Je=_.path===".neocortex/state.json"?qt(_.content,qe,Gt(_.content,He,t.storyId)):Wt(_.content,qe,He);if(!Je.ok)throw new Error(_.path===".neocortex/state.json"?"continuous-state-merge-conflict":"continuous-context-merge-conflict");await te(t.projectRoot,_.path,Je.value),await P(t.projectRoot,["add","-A","--",_.path])}if(b.includes(".neocortex/state.json")&&await P(t.projectRoot,["add","-A","--",".neocortex/state.json"]),await ae(t.projectRoot,["diff","--cached","--quiet"]))throw new Error("continuous-integration-empty-after-admission");Q=await Ie(t.projectRoot,t.epicId,t.storyId,y),await P(t.projectRoot,["commit","-m",`feat(yoloop): integrate ${t.storyId}`,"-m",`Neocortex-Story: ${t.storyId}`,"-m",`Neocortex-Epic: ${t.epicId}`,"-m",`Neocortex-Execution-Branch: ${t.executionBranch}`,"-m",`Neocortex-Prepared-Base: ${t.baseSha}`,"-m",`Neocortex-Dispatch: ${t.dispatchId}`,"-m",`Neocortex-Bundle: ${l.bundleId}`,"-m",`Neocortex-Bundle-Digest: ${l.bundleDigest}`,"-m",`Neocortex-Graph-Revision: ${t.graphRevision}`,"-m",`Neocortex-Claim-Revision: ${t.claimRevision}`,"-m",`Neocortex-Checkpoint-Authority: ${Q.revision}`,"-m",`Neocortex-Checkpoint-Epoch: ${Q.epoch??"null"}`,"-m",`Neocortex-Checkpoint-Story-Status: ${Q.storyStatus??"null"}`]),s=!0}})}catch(y){g&&!s&&await Ne(t.projectRoot,d);const O=y instanceof Error&&/^continuous-/.test(y.message)?y.message:"continuous-integration-failed";return f(O)}const Z=await P(t.projectRoot,["rev-parse","HEAD"]);if(!Q)return f("continuous-checkpoint-authority-missing");await e.afterRootCommit?.({projectRoot:t.projectRoot,storyId:t.storyId,headSha:Z});const U=await Ye({lease:t,bundle:l,baseSha:fe,headSha:Z,receiptRefs:k,nowIso:u,qaRunner:e.storyQaRunner});if(!U.ok)return U;await e.beforeCheckpointPersist?.({projectRoot:t.projectRoot,storyId:t.storyId,headSha:Z});const pe=await Ue({lease:t,physicalLock:i,checkpointAuthority:Q,bundle:l,baseSha:fe,headSha:Z,receiptRefs:[...k,`bundle:${l.bundleId}`,U.value.qaReceipt.receiptRef,U.value.reviewReceipt.receiptRef],qaReceipt:U.value.qaReceipt,reviewReceipt:U.value.reviewReceipt,recordedAt:u,checkpointNow:e.checkpointNow,insideCheckpointPreCommit:e.insideCheckpointPreCommit,afterCheckpointPersist:e.afterCheckpointPersist});return pe.ok?(await We(R,v,Z,l,pe.value,e.beforeSandboxWriteCommit),{ok:!0,value:{headSha:Z,alreadyIntegrated:!1,bundle:l,checkpoint:pe.value}}):pe}catch{return g&&!s&&d.length>0&&await Ne(t.projectRoot,d),f("continuous-integration-failed")}finally{await Tt(t).catch(()=>{}),await It(i.path,i.owner).catch(()=>{})}},async release(t,o){o||await oe(t.workspacePath,C(t.workspacePath),async n=>{const a=await Ge(n,C(t.workspacePath)).catch(()=>{});return a?.workspaceOwnerNonce===t.workspaceOwnerNonce&&a.dispatchId===t.dispatchId&&a.storyId===t.storyId}),await oe(t.leasePath,C(t.leasePath),async n=>(await ue(n,C(t.leasePath)).catch(()=>{}))?.nonce===t.leaseOwnerNonce)}}}async function Et(e,r,t,o,n){const a=[...new Set([".neocortex/state.json",o,`docs/epics/epic-${Vt(t)}.md`])],c=[];for(const i of a){if(!ce(i))continue;const d=await Ce(D(e,i));c.push({path:i,...d!==void 0?{content:d}:{}}),d!==void 0&&await te(r,i,d,n)}return c}async function At(e){const r=await P(e,["rev-parse","--show-toplevel"]),[t,o]=await Promise.all([Y(r),Y(e)]);if(t!==o)throw new Error("project root mismatch");return t}async function jt(e,r,t,o){for(const n of["user.name","user.email"]){const a=await ee(e,["config","--get",n]);a&&await ne(r,t,o,["config",n,a])}}async function Dt(e,r){const t=await V(e);await X(r,o=>{for(const[n,a]of Object.entries(t.epics))o.epics[n]={...structuredClone(a),branch_lease:null};for(const[n,a]of Object.entries(t.stories))o.stories[n]=structuredClone(a)})}async function ne(e,r,t,o){return(await Ae(e,r,t,o)).toString("utf8").trim()}async function ie(e,r){return(await Ae(C(e.workspacePath),$(e.workspacePath),e.workspaceIdentity,r)).toString("utf8")}async function De(e,r){return(await ie(e,r)).trim()}async function Ct(e,r){try{return await De(e,r),!0}catch{return!1}}async function Ot(e,r){try{return await Ae(C(e.workspacePath),$(e.workspacePath),e.workspaceIdentity,["show",`:${r}`])}catch{return}}async function Nt(e,r,t,o,n){const a=Date.now(),c=A=>({exitCode:null,timedOut:!1,durationMs:Date.now()-a,stdout:"",stderr:"",stdoutBytes:0,stderrBytes:0,...A});if(o.signal?.aborted)return c({signal:"SIGTERM",cancelled:!0});if(!r||r.length>4096||r.includes("\0")||t.length>512||t.some(A=>A.length>32768||A.includes("\0")))return c({exitCode:73,stderr:"continuous-child-invocation-invalid",stderrBytes:35});const i=C(e.workspacePath),d=await le(i,{bigint:!0}),s=await dt(i,{bigint:!0});if(!d.isDirectory()||d.isSymbolicLink()||!s.isDirectory()||d.dev!==s.dev||d.ino!==s.ino)return c({exitCode:73,stderr:"continuous-child-parent-invalid",stderrBytes:31});await n.beforeHandoff?.();const g=Buffer.from(JSON.stringify({command:r,args:[...t]})).toString("base64url"),S=o.maxOutputBytes??64e3,v=Math.max(1,Math.min(o.timeoutMs??600*1e3,1800*1e3));return await new Promise(A=>{const w=Me(process.execPath,["-e",xt,String(s.dev),String(s.ino),$(e.workspacePath),e.workspaceIdentity.dev,e.workspaceIdentity.ino,g,n.afterHandoff?"1":"0"],{cwd:i,env:o.env,stdio:["pipe","pipe","pipe"]});let j="",R="",p=0,I=0,b=!1,u=!1,k=!1,x=!n.afterHandoff;const m=(N,J)=>{b||(b=!0,clearTimeout(E),o.signal?.removeEventListener("abort",l),A({exitCode:N,...J?{signal:J}:{},timedOut:u,...k?{cancelled:!0}:{},durationMs:Date.now()-a,stdout:j,stderr:R,stdoutBytes:p,stderrBytes:I}))},l=()=>{k=!0,w.kill("SIGTERM")};o.signal?.addEventListener("abort",l,{once:!0});const E=setTimeout(()=>{u=!0,w.kill("SIGTERM")},v);w.stdout.on("data",N=>{p+=N.length,p+I>S?w.kill("SIGTERM"):j+=N.toString("utf8")}),w.stderr.on("data",N=>{I+=N.length,p+I>S?w.kill("SIGTERM"):R+=N.toString("utf8"),!x&&R.includes(`continuous-child-handoff-ready
+`)&&(x=!0,Promise.resolve(n.afterHandoff?.()).then(()=>w.stdin.end()).catch(()=>w.kill("SIGTERM")))}),w.once("error",()=>m(null)),w.once("close",(N,J)=>m(N,J)),n.afterHandoff||w.stdin.end()})}async function P(e,r){return(await z(e,r)).trim()}async function z(e,r){const t=await je("git",r,{cwd:e,encoding:"utf8",maxBuffer:16777216});return String(t.stdout)}async function ee(e,r){try{return await P(e,r)}catch(t){if(q(t,"ENOENT"))return;throw t}}async function ae(e,r){try{return await P(e,r),!0}catch{return!1}}async function _t(e,r,t){return await new Promise(o=>{const n=Me("git",[...r],{cwd:e,stdio:["pipe","ignore","ignore"]});n.once("error",()=>o(!1)),n.once("close",a=>o(a===0)),n.stdin.end(t)})}async function fr(e,r,t){try{const o=await je("git",["show",`${r}:${t}`],{cwd:e,encoding:"buffer",maxBuffer:16777216});return Buffer.from(o.stdout)}catch(o){if(q(o,"ENOENT"))return;throw o}}async function Ce(e){try{return await B(e)}catch(r){if(q(r,"ENOENT"))return;throw r}}async function te(e,r,t,o){const n=se(r);if(!ce(n))throw new Error("continuous-sandbox-write-path-invalid");const a=await Y(e);if(a!==ht(e))throw new Error("continuous-sandbox-write-root-symlink");const c=C(n)==="."?"":C(n),i=await Bt(a,c),d=await Qe(i),s=D(i,$(n));if(await me(s,a,!0),t===void 0){await o?.({boundaryRoot:a,relativePath:n,destinationPath:s}),await Ze(i,a,d),await me(s,a,!0),await kt(i,$(n));return}await o?.({boundaryRoot:a,relativePath:n,destinationPath:s}),await Ze(i,a,d),await me(s,a,!0),await vt(i,$(n),t),await me(s,a,!1)}async function Bt(e,r){let t=e;for(const o of r.split("/").filter(Boolean)){t=D(t,o),await bt(C(t),$(t));const n=await le(t);if(!n.isDirectory()||n.isSymbolicLink()||await Y(t)!==t)throw new Error("continuous-sandbox-write-component-unsafe");Oe(e,t)}return t}async function me(e,r,t){Oe(r,e);try{const o=await le(e);if(o.isSymbolicLink()||!o.isFile())throw new Error("continuous-sandbox-write-destination-unsafe");if(await Y(e)!==e)throw new Error("continuous-sandbox-write-destination-symlink")}catch(o){if(t&&q(o,"ENOENT"))return;throw o}}function Oe(e,r){const t=ut(e,r);if(t===""||t.startsWith("..")||Fe(t))throw new Error("continuous-sandbox-write-containment-invalid")}async function Qe(e){const r=await le(e,{bigint:!0});if(!r.isDirectory()||r.isSymbolicLink())throw new Error("continuous-sandbox-write-parent-unsafe");return{dev:r.dev,ino:r.ino}}async function Pt(e,r,t){try{if(e!==r&&Oe(r,e),await Y(e)!==e)return!1;const o=await Qe(e);return o.dev===t.dev&&o.ino===t.ino}catch{return!1}}async function Ze(e,r,t){if(!await Pt(e,r,t))throw new Error("continuous-sandbox-write-parent-raced")}async function $t(e,r){return await Promise.all(r.map(async t=>{const o=await Ce(D(e,t));return{path:t,...o!==void 0?{content:o}:{}}}))}async function Ne(e,r){const t=r.map(o=>o.path);t.length>0&&await ae(e,["reset","--quiet","HEAD","--",...t]);for(const o of r)await te(e,o.path,o.content)}async function zt(e,r){try{const t=D(e.projectRoot,".neocortex/state.json"),o=T(JSON.parse((await B(t)).toString("utf8"))),n=h(h(o.epics)?.[e.epicId]),a=h(n?.branch_lease),c=Object.freeze({schemaVersion:1,ownerStoryId:e.storyId,sessionId:e.dispatchId,idempotencyKey:e.dispatchId,acquiredAt:r,expiresAt:new Date(Date.parse(r)+600*1e3).toISOString()});let i=!1;return await X(e.projectRoot,d=>{const s=ye(d,e.epicId),g=h(s.branch_lease)??a;if(g&&typeof g.expiresAt=="string"&&g.expiresAt>r&&(g.ownerStoryId!==e.storyId||g.idempotencyKey!==e.dispatchId)){i=!0;return}s.branch_mode="epic",s.execution_branch=e.executionBranch,s.branch_lease=c}),i?f("continuous-epic-checkout-writer-active"):{ok:!0,value:c}}catch{return f("continuous-writer-lease-persist-failed")}}async function Tt(e){await X(e.projectRoot,r=>{const t=ye(r,e.epicId),o=h(t.branch_lease);o?.ownerStoryId===e.storyId&&o.idempotencyKey===e.dispatchId&&(t.branch_lease=null)})}async function Ue(e){try{const r=D(e.lease.projectRoot,".neocortex/state.json"),t=Object.freeze({schemaVersion:1,storyId:e.lease.storyId,epicId:e.lease.epicId,branch:e.lease.executionBranch,baseSha:e.baseSha,headSha:e.headSha,commits:Object.freeze([e.headSha]),idempotencyKey:e.lease.dispatchId,dispatchId:e.lease.dispatchId,bundleId:e.bundle.bundleId,bundleDigest:e.bundle.bundleDigest,graphRevision:e.lease.graphRevision,claimRevision:e.lease.claimRevision,receiptRefs:Object.freeze([...new Set(e.receiptRefs)]),qaVerdict:"passed",reviewVerdict:"approved",qaReceipt:e.qaReceipt,reviewReceipt:e.reviewReceipt,recordedAt:e.recordedAt}),o=T(JSON.parse((await B(r)).toString("utf8"))),n=h(h(o.stories)?.[e.lease.storyId]);let a="persisted",c,i,d,s,g=!1,S;const v=async(u,k,x)=>{const m=await ee(e.lease.projectRoot,["symbolic-ref","--quiet","--short","HEAD"]),l=await P(e.lease.projectRoot,["rev-parse","HEAD"]);if(m!==e.lease.executionBranch||l!==e.headSha)throw new Error("continuous-checkpoint-head-raced");if(u.graphRevision!==e.lease.graphRevision||u.claimRevision!==e.lease.claimRevision||u.bundleId!==e.bundle.bundleId||u.bundleDigest!==e.bundle.bundleDigest)throw new Error("continuous-checkpoint-graph-raced");const E=x??T(JSON.parse((await B(r)).toString("utf8"))),N=re(E,k??await V(e.lease.projectRoot)),J=h(h(N.epics)?.[e.lease.epicId]),ve=h(h(N.stories)?.[e.lease.storyId]),M=Array.isArray(ve?.depends_on)?ve.depends_on.filter(H=>typeof H=="string"):[],Re=h(N.stories);if(J?.execution_branch!==e.lease.executionBranch||M.some(H=>{const K=h(Re?.[H]);return!K||!["done","completed","merged"].includes(String(K.status))}))throw new Error("continuous-checkpoint-dependency-raced");const he=L(await z(e.lease.projectRoot,["diff-tree","--no-commit-id","--name-only","-r","-z",e.headSha]));if(he.length===0||he.some(H=>!e.lease.authorizedWriteSet.some(K=>Se(K,H))))throw new Error("continuous-checkpoint-write-set-raced");if(!await ke(e.lease.projectRoot,u,e.lease.storyId,e.lease.epicId,e.lease.executionBranch,void 0,e.lease.authorizedWriteSet))throw new Error("continuous-checkpoint-receipt-revalidation-failed")},A=await V(e.lease.projectRoot,{required:!0}),w=h(h(A.epics[e.lease.epicId])?.branch_lease);if(w?.ownerStoryId!==e.lease.storyId||w.idempotencyKey!==e.lease.dispatchId||w.sessionId!==e.lease.dispatchId||typeof w.expiresAt!="string"||Date.parse(w.expiresAt)<=(e.checkpointNow?.("before-mutation")??Date.now()))return f("continuous-checkpoint-writer-lease-lost");if(!await xe(e.physicalLock.path,e.physicalLock.owner))return f("continuous-checkpoint-integration-lock-raced");const j=await B(r),R=G("sha256").update(j).digest("hex");await v(t,A);const p=$e(T(JSON.parse(j.toString("utf8"))),A,e.lease.epicId,e.lease.storyId);if(p.revision!==e.checkpointAuthority.revision||p.epoch!==e.checkpointAuthority.epoch||p.storyStatus!==e.checkpointAuthority.storyStatus)return f("continuous-graph-revision-stale");const I=await X(e.lease.projectRoot,u=>{const k=ye(u,e.lease.epicId),x=h(k.branch_lease);i=x===void 0?void 0:structuredClone(x),d=structuredClone(u),g=u.stories[e.lease.storyId]!==void 0,s=structuredClone(u.stories[e.lease.storyId]??{}),S=structuredClone(k.branch_lease);const m=mt(u,e.lease.storyId),l=h(m.checkpoint)??h(n?.checkpoint);if(l?.idempotencyKey===e.lease.dispatchId){l.baseSha!==e.baseSha||l.headSha!==e.headSha||l.bundleId!==e.bundle.bundleId||l.bundleDigest!==e.bundle.bundleDigest||l.graphRevision!==e.lease.graphRevision||l.claimRevision!==e.lease.claimRevision?a="conflict":(a="reused",c=l,k.branch_lease=null);return}if(x?.ownerStoryId!==e.lease.storyId||x.idempotencyKey!==e.lease.dispatchId||x.sessionId!==e.lease.dispatchId){a="lease-lost";return}m.checkpoint=t,m.status="done",m.last_step=we;const E=Array.isArray(m.steps_completed)?m.steps_completed.filter(N=>typeof N=="string"):[];m.steps_completed=[...new Set([...E,Ve,we])],k.branch_lease=null},{expectedRevision:A.revision,preCommit:async u=>{if(i?.ownerStoryId!==e.lease.storyId||i.idempotencyKey!==e.lease.dispatchId||i.sessionId!==e.lease.dispatchId||typeof i.expiresAt!="string"||Date.parse(i.expiresAt)<=(e.checkpointNow?.("pre-commit")??Date.now()))throw new Error("continuous-checkpoint-writer-lease-lost");if(await e.insideCheckpointPreCommit?.({projectRoot:e.lease.projectRoot,storyId:e.lease.storyId,headSha:e.headSha}),!await xe(e.physicalLock.path,e.physicalLock.owner))throw new Error("continuous-checkpoint-integration-lock-raced");await v(c??t,u);const k=await B(r);if(G("sha256").update(k).digest("hex")!==R)throw new Error("continuous-graph-revision-stale");if(!d)throw new Error("continuous-checkpoint-authority-missing");const x=T(JSON.parse(k.toString("utf8"))),m=$e(x,d,e.lease.epicId,e.lease.storyId);if(m.revision!==e.checkpointAuthority.revision||m.epoch!==e.checkpointAuthority.epoch||m.storyStatus!==e.checkpointAuthority.storyStatus)throw new Error("continuous-graph-revision-stale");if(a==="persisted"&&!ze(x,u,e.lease,t))throw new Error("continuous-checkpoint-projection-raced")}}),b=a;if(b==="conflict")return f("continuous-checkpoint-idempotency-conflict");if(b==="lease-lost")return f("continuous-checkpoint-writer-lease-lost");if(b==="reused"&&c)try{return await v(c),{ok:!0,value:c}}catch{return f("continuous-checkpoint-reused-evidence-invalid")}try{await e.afterCheckpointPersist?.({projectRoot:e.lease.projectRoot,storyId:e.lease.storyId,headSha:e.headSha});const u=await V(e.lease.projectRoot,{required:!0});if(u.revision!==I.document.revision)throw new Error("continuous-checkpoint-post-persist-runtime-raced");await v(t,u);const k=await B(r);if(G("sha256").update(k).digest("hex")!==R)throw new Error("continuous-checkpoint-post-persist-authority-raced");const x=T(JSON.parse(k.toString("utf8")));if(!ze(x,u,e.lease,t))throw new Error("continuous-checkpoint-post-persist-projection-raced")}catch{const u=await B(r).catch(()=>{}),k=u===void 0||G("sha256").update(u).digest("hex")!==R;return await X(e.lease.projectRoot,x=>{const m=h(x.epics[e.lease.epicId]),l=h(x.stories[e.lease.storyId]),E=u===void 0?void 0:T(JSON.parse(u.toString("utf8")));if(!m||!l||!E||!ze(E,x,e.lease,t))throw new Error("continuous-checkpoint-cleanup-cas-conflict");if(k){g?Mt(l,s??{}):delete x.stories[e.lease.storyId],S===void 0?delete m.branch_lease:m.branch_lease=structuredClone(S);return}l.checkpoint=null,l.status="blocked",m.branch_lease=null},{expectedRevision:I.document.revision}).catch(()=>{}),f("continuous-checkpoint-post-persist-raced")}return{ok:!0,value:t}}catch(r){const t=r instanceof Error&&/^continuous-/.test(r.message)?r.message:"continuous-checkpoint-persist-failed";return f(t)}}async function Ye(e){try{if(await P(e.lease.projectRoot,["rev-parse","HEAD"])!==e.headSha)return f("continuous-story-evidence-head-raced");const r=await B(D(e.lease.projectRoot,"config","release-gates.v2.json"),"utf8"),t=JSON.parse(r),o=Array.isArray(t.requiredCompleteClasses)?t.requiredCompleteClasses.filter(b=>typeof b=="string"&&/^[a-z0-9-]+$/.test(b)):[];if(t.contract!=="P205-CI-02"||o.length===0)return f("continuous-story-qa-manifest-invalid");const n=String((await je(process.execPath,["scripts/test-root.mjs","--gate","complete"],{cwd:e.lease.projectRoot,encoding:"utf8",maxBuffer:32*1024*1024})).stdout);if(await e.qaRunner?.({projectRoot:e.lease.projectRoot,storyId:e.lease.storyId,headSha:e.headSha}),await P(e.lease.projectRoot,["rev-parse","HEAD"])!==e.headSha)return f("continuous-story-qa-head-raced");const a=Xe(e.nowIso),c=await P(e.lease.projectRoot,["rev-list","--count",`${e.baseSha}..${e.headSha}`]),i=await z(e.lease.projectRoot,["show","--no-patch","--format=%H%n%P%n%B",e.headSha]),d=L(await z(e.lease.projectRoot,["diff","--name-only","-z",`${e.baseSha}..${e.headSha}`])),s=yt({storyId:e.lease.storyId,baseSha:e.baseSha,headSha:e.headSha,bundleDigest:e.bundle.bundleDigest,graphRevision:e.lease.graphRevision,commitBody:i,changedPaths:d}),g=G("sha256").update(r).digest("hex"),S=G("sha256").update(n).digest("hex"),v=wt({gitEvidenceDigest:s,headSha:e.headSha,graphRevision:e.lease.graphRevision,manifestDigest:g,gateIds:o,resultDigest:S}),A=`story-qa:${v}`,w=Object.freeze({schemaVersion:1,kind:"story_qa_evidence",producer:"local-yolo-tdd",evidenceVersion:"p205-execution-v2",storyId:e.lease.storyId,epicId:e.lease.epicId,baseSha:e.baseSha,headSha:e.headSha,bundleDigest:e.bundle.bundleDigest,graphRevision:e.lease.graphRevision,contract:"P205-CI-02",command:St,manifestDigest:g,gateIds:Object.freeze(o),resultDigest:S,sourceEvidenceDigest:v,verdict:"passed",checkedAt:a,receiptRef:A}),j=[`Neocortex-Story: ${e.lease.storyId}`,`Neocortex-Epic: ${e.lease.epicId}`,`Neocortex-Bundle-Digest: ${e.bundle.bundleDigest}`,`Neocortex-Graph-Revision: ${e.lease.graphRevision}`];if(c!=="1"||!j.every(b=>i.includes(b))||d.length===0||d.some(b=>!e.lease.authorizedWriteSet.some(u=>Se(u,b))))return f("continuous-story-review-evidence-rejected");const R=G("sha256").update(["root-commit-range-review-v1",e.lease.storyId,e.baseSha,e.headSha,e.bundle.bundleDigest,e.lease.graphRevision,A,G("sha256").update(i).digest("hex"),[...d].sort().join(",")].join("\0")).digest("hex"),p=`story-review:${R}`,I=Object.freeze({schemaVersion:1,kind:"story_review_evidence",producer:"root-commit-range-review",storyId:e.lease.storyId,epicId:e.lease.epicId,baseSha:e.baseSha,headSha:e.headSha,bundleDigest:e.bundle.bundleDigest,graphRevision:e.lease.graphRevision,sourceEvidenceDigest:R,qaReceiptRef:A,verdict:"approved",reviewedAt:a,receiptRef:p});return{ok:!0,value:{qaReceipt:w,reviewReceipt:I}}}catch{return f("continuous-story-evidence-production-failed")}}function Xe(e){return Number.isFinite(Date.parse(e))?new Date(Date.parse(e)).toISOString():new Date().toISOString()}function Gt(e,r,t){if(r!==void 0)try{const o=e===void 0?{}:T(JSON.parse(e.toString("utf8"))),n=T(JSON.parse(r.toString("utf8"))),a=structuredClone(o),c=h(h(o.stories)?.[t]),i=h(h(n.stories)?.[t]),d=Lt(a,"stories"),s=structuredClone(c??{});for(const g of["status","last_step","steps_completed","last_updated","blocked_reason","blocked_at","implementation_evidence","validation_evidence","qa_gate"])i&&Object.prototype.hasOwnProperty.call(i,g)&&(s[g]=structuredClone(i[g]));return d[t]=s,Buffer.from(`${JSON.stringify(a,null,2)}
+`)}catch{return Buffer.from("{invalid-child-state")}}function Lt(e,r){const t=h(e[r]);if(t)return t;const o={};return e[r]=o,o}function T(e){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("record expected");return e}function h(e){return e&&typeof e=="object"&&!Array.isArray(e)?e:void 0}function Wt(e,r,t){return Pe(t,e)||Pe(r,t)?{ok:!0,value:r}:Pe(r,e)?{ok:!0,value:t}:f("continuous-context-merge-conflict")}function qt(e,r,t){try{const o=et(_e(e),_e(r),_e(t));return o.ok?{ok:!0,value:o.value===void 0?void 0:Buffer.from(`${JSON.stringify(o.value,null,2)}
+`)}:o}catch{return f("continuous-state-merge-invalid")}}function _e(e){return e===void 0?void 0:JSON.parse(e.toString("utf8"))}function et(e,r,t){if(ge(t,e)||ge(r,t))return{ok:!0,value:r};if(ge(r,e))return{ok:!0,value:t};if(Be(e)&&Be(r)&&Be(t)){const o={};for(const n of[...new Set([...Object.keys(e),...Object.keys(r),...Object.keys(t)])].sort()){const a=et(e[n],r[n],t[n]);if(!a.ok)return a;a.value!==void 0&&(o[n]=a.value)}return{ok:!0,value:o}}if(Array.isArray(e)&&Array.isArray(r)&&Array.isArray(t)&&tt(e,r)&&tt(e,t)){const o=[...e,...r.slice(e.length),...t.slice(e.length)],n=new Set;return{ok:!0,value:o.filter(a=>{const c=JSON.stringify(a);return n.has(c)?!1:(n.add(c),!0)})}}return f("continuous-state-merge-conflict")}function Be(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function tt(e,r){return e.length<=r.length&&e.every((t,o)=>ge(t,r[o]))}function ge(e,r){return JSON.stringify(e)===JSON.stringify(r)}function Pe(e,r){return e===void 0||r===void 0?e===r:e.equals(r)}function L(e){return e.split("\0").filter(Boolean)}function ce(e){const r=se(e);return r.length>0&&r.length<=1024&&!Fe(r)&&!/^[A-Za-z]:\//.test(r)&&!r.split("/").includes("..")&&!r.includes("\0")&&!r.startsWith("/")}function se(e){return e.replaceAll("\\","/").replace(/^\.\//,"").replace(/\/{2,}/g,"/")}function Ht(e){const r=e.map(se).filter(ce);return[...new Set(r)].sort()}function Se(e,r){const t=se(e),o=se(r);return t===o||t.endsWith("/")&&o.startsWith(t)}function Jt(e){return e.length>0&&e.length<=240&&!e.startsWith("-")&&!e.startsWith("/")&&!e.endsWith("/")&&!e.endsWith(".lock")&&!e.includes("..")&&!e.includes("\\")&&!e.includes("@{")&&!e.includes("//")&&/^[A-Za-z0-9._/-]+$/.test(e)}function rt(e,r){return e.length===r.length&&e.every((t,o)=>t===r[o])}async function Ie(e,r,t,o){const n=T(JSON.parse(await B(D(e,".neocortex/state.json"),"utf8")));return $e(n,o??await V(e),r,t)}function $e(e,r,t,o){const n=re(e,r),a=h(n.epics),c=h(n.stories),i=h(a?.[t])??{},d=(Array.isArray(i.stories)?i.stories:Array.isArray(i.story_ids)?i.story_ids:[]).filter(v=>typeof v=="string"),s=d.length>0?d:Object.entries(c??{}).filter(([v,A])=>h(A)?.epic_id===t||v.startsWith(`${t}.`)).map(([v])=>v).sort(),g=["status","depends_on","files_to_modify","contracts","contract_refs","shared_surfaces","steps_completed","last_step","branch_name","physicalMergeStatus","merged","checkpoint","planning","attempts","retry_count","rollback_receipt","cancelled_at"],S=Object.fromEntries(s.map(v=>{const A=h(c?.[v])??{};return[v,Object.fromEntries(g.filter(w=>Object.prototype.hasOwnProperty.call(A,w)).map(w=>[w,A[w]]))]}));return{revision:Te({epicId:t,epic:{stories:s,status:i.status??null,branch_mode:i.branch_mode??null,execution_branch:i.execution_branch??null,graph_revision:i.graph_revision??null,depends_on:i.depends_on??null,planning:i.planning??null,execution_plan:i.execution_plan??null,waves:i.waves??null,current_wave:i.current_wave??null,replan:i.replan??null,replan_revision:i.replan_revision??null,dependency_graph:i.dependency_graph??null,scheduler:i.scheduler??null,attempts:i.attempts??null,retry_count:i.retry_count??null},stories:S}),epoch:typeof i.graph_revision=="string"?i.graph_revision:null,storyStatus:typeof h(c?.[o])?.status=="string"?String(h(c?.[o])?.status):null}}function ze(e,r,t,o){const n=re(e,r),a=h(h(n.epics)?.[t.epicId]),c=h(h(n.stories)?.[t.storyId]),i=Array.isArray(c?.steps_completed)?c.steps_completed.filter(d=>typeof d=="string"):[];return!!(a&&c&&a.branch_lease===null&&c.status==="done"&&c.last_step===we&&i.includes(Ve)&&i.includes(we)&&de(c.checkpoint)===de(o))}function Mt(e,r){for(const t of Object.keys(e))delete e[t];Object.assign(e,structuredClone(r))}async function Kt(e,r){return(await Ie(e,r,"")).revision}function Te(e){return G("sha256").update(de(e)).digest("hex")}function de(e){return e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(de).join(",")}]`:`{${Object.entries(e).sort(([r],[t])=>r.localeCompare(t)).map(([r,t])=>`${JSON.stringify(r)}:${de(t)}`).join(",")}}`}function Ft(e,r){const t=(e??[]).filter(o=>/^[A-Za-z0-9._/:@#-]{1,200}$/.test(o)&&!o.includes(".."));return Object.freeze([...new Set(t.length>0?t:[`dispatch:${r}`])].sort())}function Vt(e){return e.replace(/[^A-Za-z0-9._-]/g,"-").slice(0,80)}function f(e){return{ok:!1,reasonCode:e}}function q(e,r){return e instanceof Error&&"code"in e&&e.code===r}async function ue(e,r){try{await W(e,r);const t=D(e,"owner.json");await F(t,e);const o=JSON.parse(await B(t,"utf8"));if(!Number.isSafeInteger(o.pid)||Number(o.pid)<=0||typeof o.createdAt!="string"||!Number.isFinite(Date.parse(o.createdAt))||typeof o.nonce!="string"||!/^[a-f0-9]{32}$/.test(o.nonce))throw new Error("continuous-sandbox-lease-owner-invalid");return{pid:Number(o.pid),createdAt:o.createdAt,nonce:o.nonce}}catch(t){if(q(t,"ENOENT"))return;throw t}}function ot(e,r){return e?.pid===r.pid&&e.createdAt===r.createdAt&&e.nonce===r.nonce}function Qt(e){try{return process.kill(e,0),!0}catch(r){return q(r,"EPERM")}}async function Ge(e,r){try{await W(e,r);const t=D(e,".git");await W(t,e);const o=D(t,"neocortex-sandbox.json");await F(o,t);const n=JSON.parse(await B(o,"utf8"));if(n.schemaVersion!==1||typeof n.workspaceOwnerNonce!="string"||!/^[a-f0-9]{32}$/.test(n.workspaceOwnerNonce)||!/^[a-f0-9]{64}$/.test(n.graphAuthorityRevision)||!(n.graphAuthorityEpoch===null||/^[a-f0-9]{64}$/.test(n.graphAuthorityEpoch))||!(n.graphAuthorityStoryStatus===null||typeof n.graphAuthorityStoryStatus=="string"&&n.graphAuthorityStoryStatus.length<=80)||typeof n.workspaceIdentity?.dev!="string"||!/^[0-9]+$/.test(n.workspaceIdentity.dev)||typeof n.workspaceIdentity?.ino!="string"||!/^[0-9]+$/.test(n.workspaceIdentity.ino))throw new Error("continuous-sandbox-metadata-invalid");return n}catch(t){if(q(t,"ENOENT"))return;throw t}}async function Zt(e,r,t,o){await W(e,r);const n=D(e,".git");await W(n,e);const a=D(n,"neocortex-sandbox.json");await te(e,".git/neocortex-sandbox.json",Buffer.from(`${JSON.stringify(t,null,2)}
+`),o),await F(a,n)}async function Ut(e,r){try{await F(e,r);const t=JSON.parse(await B(e,"utf8"));return typeof t.childHeadSha=="string"&&typeof t.rootHeadSha=="string"&&/^[a-f0-9]{40,64}$/.test(t.childHeadSha)&&/^[a-f0-9]{40,64}$/.test(t.rootHeadSha)&&t.bundle?.schemaVersion===1&&t.checkpoint?.schemaVersion===1?t:void 0}catch(t){if(q(t,"ENOENT"))return;throw t}}async function Yt(e,r){try{const t=T(JSON.parse(await B(D(e.projectRoot,".neocortex/state.json"),"utf8"))),o=re(t,await V(e.projectRoot)),n=h(h(o.stories)?.[e.storyId]),a=h(n?.checkpoint);return a?.idempotencyKey===r.idempotencyKey&&a.headSha===r.headSha&&a.bundleDigest===r.bundleDigest&&h(h(o.epics)?.[e.epicId])?.branch_lease===null&&await ke(e.projectRoot,a,e.storyId,e.epicId,e.executionBranch,void 0,e.authorizedWriteSet)}catch{return!1}}async function Xt(e,r,t){try{const o=T(JSON.parse(await B(D(e.projectRoot,".neocortex/state.json"),"utf8"))),n=re(o,await V(e.projectRoot)),a=h(h(n.stories)?.[e.storyId]),c=h(a?.checkpoint);return c?.schemaVersion!==1||c.storyId!==e.storyId||c.epicId!==e.epicId||c.branch!==e.executionBranch||c.baseSha!==t.baseSha||c.headSha!==t.headSha||c.idempotencyKey!==e.dispatchId||c.dispatchId!==e.dispatchId||c.bundleId!==r.bundleId||c.bundleDigest!==r.bundleDigest||c.graphRevision!==e.graphRevision||c.claimRevision!==e.claimRevision||h(h(n.epics)?.[e.epicId])?.branch_lease!==null||!await ke(e.projectRoot,c,e.storyId,e.epicId,e.executionBranch,void 0,e.authorizedWriteSet)?void 0:c}catch{return}}async function er(e,r){const t=(await ee(e.projectRoot,["log","--format=%H","--fixed-strings",`--grep=Neocortex-Dispatch: ${e.dispatchId}`]))?.split(`
+`).filter(S=>/^[a-f0-9]{40,64}$/.test(S))??[];if(t.length!==1)return;const o=t[0];if(!await ae(e.projectRoot,["merge-base","--is-ancestor",o,"HEAD"]))return;const n=await P(e.projectRoot,["show","-s","--format=%B",o]),a=new Set(n.split(`
+`).map(S=>S.trim()));for(const S of[`Neocortex-Story: ${e.storyId}`,`Neocortex-Epic: ${e.epicId}`,`Neocortex-Execution-Branch: ${e.executionBranch}`,`Neocortex-Prepared-Base: ${e.baseSha}`,`Neocortex-Dispatch: ${e.dispatchId}`,`Neocortex-Bundle: ${r.bundleId}`,`Neocortex-Bundle-Digest: ${r.bundleDigest}`,`Neocortex-Graph-Revision: ${e.graphRevision}`,`Neocortex-Claim-Revision: ${e.claimRevision}`])if(!a.has(S))return;const c=Le(n,"Neocortex-Checkpoint-Authority"),i=Le(n,"Neocortex-Checkpoint-Epoch"),d=Le(n,"Neocortex-Checkpoint-Story-Status");if(!c||!/^[a-f0-9]{64}$/.test(c)||!i||!(i==="null"||/^[a-f0-9]{64}$/.test(i))||!d||d.length>80)return;const s=await ee(e.projectRoot,["rev-parse",`${o}^`]);if(!s||!/^[a-f0-9]{40,64}$/.test(s))return;const g=L(await z(e.projectRoot,["diff-tree","--no-commit-id","--name-only","-r","-z",o]));if(!(g.length===0||g.some(S=>!r.authorizedWriteSet.some(v=>Se(v,S)))))return{baseSha:s,headSha:o,checkpointAuthority:{revision:c,epoch:i==="null"?null:i,storyStatus:d==="null"?null:d}}}function Le(e,r){const t=`${r}: `,o=e.split(`
+`).map(n=>n.trim()).filter(n=>n.startsWith(t));return o.length===1?o[0].slice(t.length):void 0}async function We(e,r,t,o,n,a){const c=C(e);await W(c,C(c));try{await F(e,c)}catch(i){if(!q(i,"ENOENT"))throw i}await te(c,$(e),Buffer.from(`${JSON.stringify({childHeadSha:r,rootHeadSha:t,bundle:o,checkpoint:n})}
+`),a),await F(e,c)}export{ur as createAnchoredContinuousStoryCommandRunner,hr as createBranchlessContinuousStoryWorkspaceManager};