@ornexus/neocortex 4.60.73 → 4.60.75

package/packages/client/dist/runner/headless/run-yolo.js

@@ -1,885 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * P190.05 -- runner execution plane for one-story run_yolo directives.
- */
-import { createHash, randomBytes } from 'node:crypto';
-import { AUTONOMOUS_GOVERNANCE_EVIDENCE_TAG, AUTONOMOUS_GOVERNANCE_REASON_CODES, autonomousGovernanceMetadata, buildAutonomousGovernanceEnvelope, readAutonomousGovernanceEnvelopeFromMetadata, recordAutonomousGovernance, } from '../../continuity/autonomous-governance.js';
-import { createDefaultHeadlessAdapterRegistry } from './adapters.js';
-import { loadHeadlessRuntimeDefaults, resolveHeadlessRuntime } from './resolver.js';
-import { HEADLESS_REASON_CODES, boundPublicSummary, hashPublicValue, redaction, } from './types.js';
-export const DEFAULT_HEADLESS_EXECUTION_LEASE_MS = 5 * 60 * 1000;
-export const DEFAULT_HEADLESS_EXECUTION_STALE_LEASE_AFTER_MS = 30 * 1000;
-export const DEFAULT_HEADLESS_EXECUTION_BACKOFF_MS = 30 * 1000;
-export const DEFAULT_HEADLESS_EXECUTION_TIMEOUT_MS = 10 * 60 * 1000;
-export const DEFAULT_HEADLESS_EXECUTION_LIMIT = 1;
-export const DEFAULT_HEADLESS_EXECUTION_MAX_ATTEMPTS = 3;
-const STORY_TARGET_PATTERN = /^docs\/stories\/[A-Za-z0-9._-]+\.story\.md$/;
-const SAFE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/;
-const EXECUTION_DIRECTIVE_ALLOWED_KEYS = new Set([
-    'schemaVersion',
-    'contractVersion',
-    'kind',
-    'commandClass',
-    'jobId',
-    'operationId',
-    'idempotencyKey',
-    'targetKind',
-    'targetRef',
-    'commandRef',
-    'storyId',
-    'executionMode',
-    'runtime',
-    'publicSummary',
-    'reasonCode',
-    'attempts',
-    'metadata',
-    'redactionSummary',
-    'publicSafe',
-]);
-const RUNTIME_ALLOWED_KEYS = new Set(['runtimeId', 'modelId', 'source', 'reasonCode', 'publicSafe']);
-const UNSAFE_KEY_PATTERN = /(raw[_-]?(?:logs?|payloads?)|std(?:out|err)|stack(?:[_-]?trace)?|transcript|objective(?:[_-]?(?:text|body|prompt))|prompt(?:[_-]?(?:body|text))?|private[_-]?(?:urls?|prompts?)|secret|token|password|protected(?:[_-]?(?:field|body|bodies|internals))?|workflow(?:[_-]?body)?|step(?:[_-]?body)?|customer(?:[_-]?(?:pii|data))?|\bpii\b|authorization|api[_-]?key|license[_-]?key|argv|args|executable(?:[_-]?path)?|binary(?:[_-]?path)?|shell|cwd|command[_-]?path|vendor(?:[_-]?(?:payload|corpus|response|output)))/i;
-const UNSAFE_VALUE_PATTERN = /(https?:\/\/\S+|(?:^|\s)(?:\/(?:home|Users|media|mnt|tmp|var|etc|private)\/\S+|[A-Za-z]:\\\S+)|ghp_[A-Za-z0-9_]+|sk-[A-Za-z0-9_-]+|-----BEGIN [A-Z ]*PRIVATE KEY-----|authorization\s*:|password\s*=|token\s*=|api[_-]?key\s*=|license[_-]?key\s*=|raw[_-]?(?:logs?)\s*[:=]|transcript|stack\s*trace|stderr:|stdout:|system prompt|workflow body|step body|PROTECTED_|PRIVATE_INTERNALS|CUSTOMER_PII|\bPII\b|VENDOR_CORPUS|P190[_-]?SYNTHETIC[_-]?(?:HEADLESS|CONTINUITY))/i;
-const SHELL_FRAGMENT_PATTERN = /(?:[;&|`$<>]|\$\(|\n|\r|\0)/;
-export async function runYoloExecutionPhase(options) {
-    const registry = options.adapterRegistry ?? createDefaultHeadlessAdapterRegistry();
-    const limit = boundedInteger(options.limit ?? DEFAULT_HEADLESS_EXECUTION_LIMIT, 1, 10);
-    const leaseMs = boundedInteger(options.leaseMs ?? DEFAULT_HEADLESS_EXECUTION_LEASE_MS, 1_000, 60 * 60 * 1000);
-    const staleLeaseAfterMs = boundedInteger(options.staleLeaseAfterMs ?? DEFAULT_HEADLESS_EXECUTION_STALE_LEASE_AFTER_MS, 0, 24 * 60 * 60 * 1000);
-    const maxAttempts = boundedInteger(options.maxAttempts ?? DEFAULT_HEADLESS_EXECUTION_MAX_ATTEMPTS, 1, 10);
-    const reasonCodes = [];
-    const receipts = [];
-    const nowIso = options.now();
-    const enqueueResult = enqueueRunYoloExecutionDirectives({
-        store: options.store,
-        metadata: options.metadata,
-        nowIso,
-        maxAttempts,
-        queueCap: options.queueCap,
-    });
-    reasonCodes.push(...enqueueResult.reasonCodes);
-    const recovered = options.store.recoverStaleHeadlessExecutionAttempts({
-        nowIso,
-        staleAfterMs: staleLeaseAfterMs,
-        limit: limit * 2,
-    });
-    if (recovered.recoveredAttemptIds.length > 0) {
-        reasonCodes.push(HEADLESS_REASON_CODES.EXECUTION_BACKOFF);
-        if (recovered.failedAttemptIds.length > 0)
-            reasonCodes.push(HEADLESS_REASON_CODES.EXECUTION_TIMEOUT);
-    }
-    const allowedAttemptIds = new Set(options.attemptIds ?? []);
-    const dueAttempts = options.store
-        .listDueHeadlessExecutionAttempts({ nowIso: options.now(), limit: Math.max(limit * 5, 10) })
-        .filter((attempt) => attempt.directive_kind === 'run_yolo')
-        .filter((attempt) => allowedAttemptIds.size === 0 || allowedAttemptIds.has(attempt.attempt_id))
-        .slice(0, limit);
-    for (const attempt of dueAttempts) {
-        const receipt = await processRunYoloAttempt({
-            store: options.store,
-            projectRoot: options.projectRoot,
-            runnerId: options.runnerId,
-            attempt,
-            registry,
-            now: options.now,
-            leaseMs,
-            timeoutMs: boundedInteger(options.timeoutMs ?? DEFAULT_HEADLESS_EXECUTION_TIMEOUT_MS, 1_000, 30 * 60 * 1000),
-            backoffMs: boundedInteger(options.backoffMs ?? DEFAULT_HEADLESS_EXECUTION_BACKOFF_MS, 1_000, 60 * 60 * 1000),
-            maxAttempts,
-            adapterOptions: options.adapterOptions,
-            runtimeDefaults: options.runtimeDefaults,
-            runtimeFallback: options.runtimeFallback,
-            idFactory: options.idFactory ?? defaultHeadlessIdFactory,
-        });
-        receipts.push(receipt);
-        reasonCodes.push(receipt.reasonCode);
-    }
-    return {
-        ok: receipts.every((receipt) => receipt.outcome !== 'failed') && enqueueResult.rejectedCount === 0,
-        enqueuedAttemptCount: enqueueResult.enqueuedCount,
-        dueAttemptCount: dueAttempts.length,
-        processedAttemptCount: receipts.filter((receipt) => receipt.outcome !== 'ignored').length,
-        recoveredAttemptIds: recovered.recoveredAttemptIds,
-        receipts,
-        reasonCodes: unique(reasonCodes.length > 0 ? reasonCodes : [HEADLESS_REASON_CODES.OK]),
-        publicSafe: true,
-    };
-}
-function enqueueRunYoloExecutionDirectives(input) {
-    let enqueuedCount = 0;
-    let rejectedCount = 0;
-    const reasonCodes = [];
-    for (const candidate of extractExecutionDirectiveCandidates(input.metadata)) {
-        if (!isRecord(candidate) || candidate.kind !== 'run_yolo')
-            continue;
-        const validation = validateRunYoloExecutionDirective(candidate);
-        if (!validation.ok) {
-            rejectedCount += 1;
-            reasonCodes.push(validation.reasonCode);
-            continue;
-        }
-        const directive = validation.directive;
-        if (!input.store.jobExists(directive.jobId)) {
-            rejectedCount += 1;
-            reasonCodes.push(AUTONOMOUS_GOVERNANCE_REASON_CODES.BYPASS_BLOCKED);
-            continue;
-        }
-        const directiveHash = hashDirective(directive);
-        if (input.store.hasCompletedHeadlessExecutionDirectiveHash(directiveHash)) {
-            reasonCodes.push(HEADLESS_REASON_CODES.EXECUTION_COMPLETED);
-            continue;
-        }
-        const governanceEnvelope = buildAutonomousGovernanceEnvelope({
-            autonomousKind: 'run_yolo',
-            source: governanceSourceFromDirective(directive.metadata, 'headless-run-yolo'),
-            targetKind: 'story',
-            targetRef: directive.targetRef,
-            storyId: directive.storyId ?? storyIdFromTargetRef(directive.targetRef),
-            jobId: directive.jobId,
-            operationSeed: directive.operationId,
-            commandHash: hashPublicValue(directive.commandRef),
-        });
-        const governance = recordAutonomousGovernance(input.store, governanceEnvelope, input.nowIso, { requireExistingJob: true });
-        if (!governance.ok) {
-            rejectedCount += 1;
-            reasonCodes.push(governance.reasonCode);
-            continue;
-        }
-        const attemptId = headlessExecutionEntityId('attempt', directive.idempotencyKey);
-        const executionId = headlessExecutionEntityId('exec', directive.operationId);
-        const result = input.store.enqueueHeadlessExecutionAttempt({
-            attemptId,
-            executionId,
-            jobId: directive.jobId,
-            directiveHash,
-            directiveKind: 'run_yolo',
-            commandClass: directive.commandClass,
-            targetKind: 'story',
-            targetRef: directive.targetRef,
-            storyId: directive.storyId ?? storyIdFromTargetRef(directive.targetRef),
-            runtimeId: directive.runtime?.runtimeId,
-            modelId: directive.runtime?.modelId,
-            runtimeSource: normalizeStoredRuntimeSource(directive.runtime?.source),
-            reasonCode: directive.reasonCode,
-            publicSummary: directive.publicSummary,
-            enqueuedAt: input.nowIso,
-            notBeforeAt: input.nowIso,
-            maxAttempts: input.maxAttempts,
-            queueCap: input.queueCap,
-            operationId: `${directive.operationId}:enqueue`,
-            idempotencyKey: directive.idempotencyKey,
-            counts: { directives: 1 },
-            hashes: { directive: directiveHash },
-            redactionSummary: directive.redactionSummary,
-            relativePaths: [directive.targetRef],
-            metadata: autonomousGovernanceMetadata(governanceEnvelope, {
-                schemaVersion: 1,
-                contractVersion: 'continuity-v1',
-                jobId: directive.jobId,
-                operationId: directive.operationId,
-                reasonCode: directive.reasonCode ?? HEADLESS_REASON_CODES.OK,
-                targetRef: directive.targetRef,
-                directiveHash,
-                ...(directive.executionMode ? { executionMode: directive.executionMode } : {}),
-            }),
-        });
-        if (!result.accepted) {
-            rejectedCount += 1;
-            reasonCodes.push(result.reasonCode ?? 'queue-cap-reached');
-            continue;
-        }
-        if (result.inserted)
-            enqueuedCount += 1;
-        reasonCodes.push(HEADLESS_REASON_CODES.OK);
-    }
-    return { enqueuedCount, rejectedCount, reasonCodes: unique(reasonCodes) };
-}
-async function processRunYoloAttempt(input) {
-    const claimedAt = input.now();
-    const leaseId = input.idFactory('lease', input.attempt.attempt_id);
-    const leaseExpiresAt = addMilliseconds(claimedAt, input.leaseMs);
-    const claim = input.store.claimHeadlessExecutionAttempt({
-        attemptId: input.attempt.attempt_id,
-        leaseId,
-        runnerId: input.runnerId,
-        claimedAt,
-        leaseExpiresAt,
-        reasonCode: HEADLESS_REASON_CODES.OK,
-    });
-    if (!claim.inserted) {
-        return {
-            attemptId: input.attempt.attempt_id,
-            executionId: input.attempt.execution_id,
-            jobId: input.attempt.job_id,
-            status: input.attempt.status,
-            outcome: 'ignored',
-            reasonCode: 'lease-conflict',
-            timestamp: claimedAt,
-            redactionSummary: [],
-            publicSafe: true,
-        };
-    }
-    const duplicateCompletion = input.store.hasCompletedHeadlessExecutionDirectiveHash(input.attempt.directive_hash, input.attempt.attempt_id);
-    if (duplicateCompletion) {
-        return persistAttemptOutcome(input.store, input.attempt, {
-            leaseId,
-            runnerId: input.runnerId,
-            status: 'skipped',
-            receiptStatus: 'ignored',
-            reasonCode: HEADLESS_REASON_CODES.EXECUTION_COMPLETED,
-            publicSummary: 'Skipped duplicate run_yolo directive because the directive hash is already completed.',
-            completedAt: input.now(),
-            counts: { duplicateDirectiveHashes: 1 },
-            hashes: { directive: input.attempt.directive_hash },
-            redactionSummary: [],
-            relativePaths: [input.attempt.target_ref],
-        });
-    }
-    const preparation = prepareAttemptInput(input);
-    if (!preparation.ok) {
-        return persistAttemptOutcome(input.store, input.attempt, {
-            leaseId,
-            runnerId: input.runnerId,
-            status: preparation.status,
-            receiptStatus: preparation.receiptStatus,
-            reasonCode: preparation.reasonCode,
-            publicSummary: preparation.publicSummary,
-            completedAt: input.now(),
-            counts: { rejectedDirectives: 1 },
-            hashes: { directive: input.attempt.directive_hash },
-            redactionSummary: preparation.redactionSummary,
-            relativePaths: safeAttemptRelativePaths(input.attempt),
-        });
-    }
-    const adapterLookup = input.registry.getAdapter(preparation.input.runtimeId);
-    if (!adapterLookup.ok) {
-        return persistAttemptOutcome(input.store, input.attempt, {
-            leaseId,
-            runnerId: input.runnerId,
-            status: 'failed',
-            receiptStatus: 'failed',
-            reasonCode: adapterLookup.reasonCode,
-            publicSummary: adapterLookup.publicSummary,
-            completedAt: input.now(),
-            counts: { rejectedAdapters: 1 },
-            hashes: { directive: input.attempt.directive_hash },
-            redactionSummary: adapterLookup.redactionSummary,
-            relativePaths: [input.attempt.target_ref],
-            runtimeId: preparation.input.runtimeId,
-            modelId: preparation.input.modelId,
-            runtimeSource: preparation.input.runtimeSource,
-        });
-    }
-    let adapterResult;
-    try {
-        adapterResult = await adapterLookup.adapter.execute(preparation.input, {
-            ...input.adapterOptions,
-            cwd: input.adapterOptions?.cwd ?? input.projectRoot,
-        });
-    }
-    catch {
-        adapterResult = {
-            status: 'failed',
-            adapterId: preparation.input.runtimeId,
-            runtimeId: preparation.input.runtimeId,
-            ...(preparation.input.modelId ? { modelId: preparation.input.modelId } : {}),
-            ...(preparation.input.runtimeSource ? { runtimeSource: preparation.input.runtimeSource } : {}),
-            reasonCode: HEADLESS_REASON_CODES.EXECUTION_FAILED,
-            reasonCodes: [HEADLESS_REASON_CODES.EXECUTION_FAILED, HEADLESS_REASON_CODES.RECEIPT_REDACTED],
-            exitCode: 1,
-            signal: null,
-            durationMs: 0,
-            counts: { adapterExceptions: 1 },
-            hashes: { directive: input.attempt.directive_hash },
-            publicSummary: 'Headless adapter failed with public-safe exception summary.',
-            redactionSummary: [redaction('adapter', 'raw_log', 'value-denied')],
-            relativePaths: [input.attempt.target_ref],
-            receipt: preparation.input.receipt,
-            publicSafe: true,
-        };
-    }
-    const retry = retryDecision(input.attempt, adapterResult, input.maxAttempts, input.backoffMs, input.now());
-    const status = retry.retry ? 'backoff' : adapterResult.status;
-    const reasonCode = retry.retry ? HEADLESS_REASON_CODES.EXECUTION_BACKOFF : adapterResult.reasonCode;
-    const receiptStatus = status === 'completed' ? 'applied' : status === 'backoff' ? 'deferred' : status === 'skipped' ? 'ignored' : 'failed';
-    return persistAttemptOutcome(input.store, input.attempt, {
-        leaseId,
-        runnerId: input.runnerId,
-        status,
-        receiptStatus,
-        reasonCode,
-        publicSummary: retry.retry
-            ? 'Headless run_yolo execution scheduled bounded retry after transient adapter outcome.'
-            : adapterResult.publicSummary,
-        completedAt: input.now(),
-        durationMs: adapterResult.durationMs,
-        notBeforeAt: retry.notBeforeAt,
-        retryCount: retry.retryCount,
-        counts: adapterResult.counts,
-        hashes: { ...adapterResult.hashes, directive: input.attempt.directive_hash },
-        redactionSummary: adapterResult.redactionSummary,
-        relativePaths: adapterResult.relativePaths.length > 0 ? adapterResult.relativePaths : [input.attempt.target_ref],
-        runtimeId: adapterResult.runtimeId,
-        modelId: adapterResult.modelId,
-        runtimeSource: adapterResult.runtimeSource,
-    });
-}
-function prepareAttemptInput(input) {
-    const governance = readAutonomousGovernanceEnvelopeFromMetadata(input.attempt.metadata_json, {
-        autonomousKind: 'run_yolo',
-        jobId: input.attempt.job_id,
-        targetKind: 'story',
-        targetRef: input.attempt.target_ref,
-    });
-    if (!governance.ok) {
-        return {
-            ok: false,
-            status: 'failed',
-            receiptStatus: 'failed',
-            reasonCode: HEADLESS_REASON_CODES.DIRECTIVE_REJECTED,
-            publicSummary: governance.publicSummary,
-            redactionSummary: governance.redactionSummary,
-        };
-    }
-    const directCommandHash = hashPublicValue(`*yolo @${input.attempt.target_ref}`);
-    const branchlessCommandHash = hashPublicValue(`*yolo @${input.attempt.target_ref} branchless-preparation`);
-    const branchlessPreparation = governance.envelope.hashes.command === branchlessCommandHash;
-    if (!branchlessPreparation && governance.envelope.hashes.command !== directCommandHash) {
-        return {
-            ok: false,
-            status: 'failed',
-            receiptStatus: 'failed',
-            reasonCode: HEADLESS_REASON_CODES.DIRECTIVE_REJECTED,
-            publicSummary: 'Headless run_yolo governance command does not match an authorized execution mode.',
-            redactionSummary: [redaction('autonomousGovernance.commandHash', 'prompt_body', 'operation-denied')],
-        };
-    }
-    const promptValidation = validateRunYoloAttemptShape(input.attempt);
-    if (!promptValidation.ok)
-        return promptValidation;
-    const runtime = resolveAttemptRuntime(input);
-    if (!runtime.ok) {
-        return {
-            ok: false,
-            status: 'failed',
-            receiptStatus: 'failed',
-            reasonCode: runtime.reasonCode,
-            publicSummary: runtime.publicSummary,
-            redactionSummary: runtime.redactionSummary,
-        };
-    }
-    return {
-        ok: true,
-        input: {
-            promptKind: branchlessPreparation ? 'yolo-branchless-preparation' : 'yolo',
-            targetKind: 'story',
-            targetRef: input.attempt.target_ref,
-            ...(input.attempt.story_id ? { storyId: input.attempt.story_id } : {}),
-            runtimeId: runtime.runtimeId,
-            ...(runtime.modelId ? { modelId: runtime.modelId } : {}),
-            runtimeSource: runtime.runtimeSource,
-            timeoutMs: input.timeoutMs,
-            receipt: {
-                attemptId: input.attempt.attempt_id,
-                subagentId: input.attempt.attempt_id,
-                executionId: input.attempt.execution_id,
-                jobId: input.attempt.job_id,
-                operationId: input.attempt.execution_id,
-                idempotencyKey: input.attempt.directive_hash,
-                runnerId: input.runnerId,
-            },
-            publicSummary: boundPublicSummary(input.attempt.public_summary ?? 'Headless run_yolo execution attempt.'),
-            publicSafe: true,
-        },
-    };
-}
-function resolveAttemptRuntime(input) {
-    const defaults = input.runtimeDefaults !== undefined
-        ? input.runtimeDefaults
-        : loadHeadlessRuntimeDefaults({ projectRoot: input.projectRoot });
-    if (isRecord(defaults) && defaults.ok === false) {
-        return {
-            ok: false,
-            reasonCode: HEADLESS_REASON_CODES.RUNTIME_UNTRUSTED,
-            publicSummary: typeof defaults.publicSummary === 'string' ? defaults.publicSummary : 'Headless runtime defaults failed public-safety validation.',
-            redactionSummary: Array.isArray(defaults.redactionSummary) ? defaults.redactionSummary : [],
-        };
-    }
-    const source = normalizeRuntimeSource(input.attempt.runtime_source) ?? 'explicit';
-    const hint = (input.attempt.runtime_id || input.attempt.model_id)
-        ? {
-            ...(input.attempt.runtime_id ? { runtimeId: input.attempt.runtime_id } : {}),
-            ...(input.attempt.model_id ? { modelId: input.attempt.model_id } : {}),
-            source,
-            publicSafe: true,
-        }
-        : undefined;
-    const resolutionInput = {
-        registry: input.registry,
-        defaults,
-        fallback: input.runtimeFallback,
-    };
-    if (hint) {
-        if (source === 'origin')
-            resolutionInput.origin = hint;
-        else if (source === 'default')
-            resolutionInput.projectDefault = hint;
-        else if (source === 'fallback')
-            resolutionInput.fallback = hint;
-        else
-            resolutionInput.explicit = hint;
-    }
-    const resolution = resolveHeadlessRuntime(resolutionInput);
-    if (!resolution.ok) {
-        return {
-            ok: false,
-            reasonCode: resolution.reasonCode,
-            publicSummary: resolution.publicSummary,
-            redactionSummary: resolution.redactionSummary,
-        };
-    }
-    return {
-        ok: true,
-        runtimeId: resolution.runtimeId,
-        ...(resolution.modelId ? { modelId: resolution.modelId } : {}),
-        runtimeSource: resolution.runtimeSource,
-    };
-}
-function validateRunYoloAttemptShape(attempt) {
-    const redactions = [];
-    if (attempt.directive_kind !== 'run_yolo')
-        redactions.push(redaction('directiveKind', 'unsafe_key', 'value-denied'));
-    if (attempt.target_kind !== 'story')
-        redactions.push(redaction('targetKind', 'prompt_body', 'value-denied'));
-    if (!STORY_TARGET_PATTERN.test(attempt.target_ref) || SHELL_FRAGMENT_PATTERN.test(attempt.target_ref) || UNSAFE_VALUE_PATTERN.test(attempt.target_ref)) {
-        redactions.push(redaction('targetRef', 'prompt_body', 'value-denied'));
-    }
-    const storyId = storyIdFromTargetRef(attempt.target_ref);
-    if (attempt.story_id && attempt.story_id !== storyId)
-        redactions.push(redaction('storyId', 'prompt_body', 'value-denied'));
-    if (redactions.length > 0) {
-        return {
-            ok: false,
-            status: 'failed',
-            receiptStatus: 'failed',
-            reasonCode: HEADLESS_REASON_CODES.PROMPT_REJECTED,
-            publicSummary: 'Headless run_yolo attempt did not match the canonical public story prompt shape.',
-            redactionSummary: redactions,
-        };
-    }
-    return {
-        ok: true,
-        input: {
-            promptKind: 'yolo',
-            targetKind: 'story',
-            targetRef: attempt.target_ref,
-            ...(attempt.story_id ? { storyId: attempt.story_id } : {}),
-            runtimeId: 'fake',
-            publicSafe: true,
-        },
-    };
-}
-function validateRunYoloExecutionDirective(input) {
-    const redactions = [];
-    for (const key of Object.keys(input)) {
-        if (!EXECUTION_DIRECTIVE_ALLOWED_KEYS.has(key) || UNSAFE_KEY_PATTERN.test(key)) {
-            redactions.push(redaction(key, unsafeKeyReason(key), 'key-denied'));
-        }
-    }
-    if (input.publicSafe !== true)
-        redactions.push(redaction('publicSafe', 'unsafe_key', 'value-denied'));
-    const kind = stringField(input, 'kind');
-    const commandClass = stringField(input, 'commandClass');
-    const jobId = stringField(input, 'jobId');
-    const operationId = stringField(input, 'operationId');
-    const idempotencyKey = stringField(input, 'idempotencyKey');
-    const targetKind = stringField(input, 'targetKind');
-    const targetRef = stringField(input, 'targetRef');
-    const commandRef = stringField(input, 'commandRef');
-    const publicSummary = stringField(input, 'publicSummary');
-    const storyId = stringField(input, 'storyId');
-    const executionMode = stringField(input, 'executionMode');
-    if (kind !== 'run_yolo')
-        redactions.push(redaction('kind', 'unsafe_key', 'value-denied'));
-    if (commandClass !== 'goal-tick' && commandClass !== 'loop-tick')
-        redactions.push(redaction('commandClass', 'unsafe_key', 'value-denied'));
-    if (!isSafeIdentifier(jobId))
-        redactions.push(redaction('jobId', 'unsafe_key', 'value-denied'));
-    if (!isSafeIdentifier(operationId))
-        redactions.push(redaction('operationId', 'unsafe_key', 'value-denied'));
-    if (!isSafeIdentifier(idempotencyKey))
-        redactions.push(redaction('idempotencyKey', 'unsafe_key', 'value-denied'));
-    if (targetKind !== 'story' || !targetRef || !STORY_TARGET_PATTERN.test(targetRef) || UNSAFE_VALUE_PATTERN.test(targetRef)) {
-        redactions.push(redaction('targetRef', 'prompt_body', 'value-denied'));
-    }
-    if (executionMode !== undefined && executionMode !== 'branchless_child_preparation') {
-        redactions.push(redaction('executionMode', 'unsafe_key', 'value-denied'));
-    }
-    const metadata = isRecord(input.metadata) ? input.metadata : undefined;
-    const branchlessPreparation = executionMode === 'branchless_child_preparation';
-    if (branchlessPreparation && (metadata?.governanceSource !== 'delegated-subagent'
-        || metadata.childWorkspace !== 'branchless_sandbox'
-        || metadata.integrationOwner !== 'root_agent'
-        || metadata.maxDepth !== 1
-        || typeof metadata.graphRevision !== 'string'
-        || !/^[a-f0-9]{64}$/.test(metadata.graphRevision))) {
-        redactions.push(redaction('executionMode', 'unsafe_key', 'value-denied'));
-    }
-    const expectedCommandRef = targetRef
-        ? `*yolo @${targetRef}${branchlessPreparation ? ' branchless-preparation' : ''}`
-        : undefined;
-    if (!commandRef || commandRef !== expectedCommandRef || commandRef.includes('@neocortex') || SHELL_FRAGMENT_PATTERN.test(commandRef) || UNSAFE_VALUE_PATTERN.test(commandRef)) {
-        redactions.push(redaction('commandRef', 'prompt_body', 'value-denied'));
-    }
-    if (storyId && targetRef && storyId !== storyIdFromTargetRef(targetRef))
-        redactions.push(redaction('storyId', 'prompt_body', 'value-denied'));
-    if (!publicSummary || publicSummary.length > 240 || UNSAFE_VALUE_PATTERN.test(publicSummary)) {
-        redactions.push(redaction('publicSummary', 'unbounded_text', 'value-denied'));
-    }
-    if (input.reasonCode !== undefined && (typeof input.reasonCode !== 'string' || UNSAFE_VALUE_PATTERN.test(input.reasonCode))) {
-        redactions.push(redaction('reasonCode', 'unsafe_key', 'value-denied'));
-    }
-    const runtime = validateDirectiveRuntime(input.runtime, redactions);
-    if (input.attempts !== undefined)
-        assertPublicSafeCandidate(input.attempts, 'attempts', redactions);
-    if (input.metadata !== undefined)
-        assertPublicSafeCandidate(input.metadata, 'metadata', redactions);
-    const redactionSummary = validateDirectiveRedactions(input.redactionSummary, redactions);
-    if (redactions.length > 0 || kind !== 'run_yolo' || !commandClass || !jobId || !operationId || !idempotencyKey || !targetRef || !commandRef || !publicSummary) {
-        const promptRejected = redactions.some((item) => item.reason === 'prompt_body');
-        return {
-            ok: false,
-            reasonCode: promptRejected ? HEADLESS_REASON_CODES.PROMPT_REJECTED : HEADLESS_REASON_CODES.DIRECTIVE_REJECTED,
-            redactionSummary: redactions,
-        };
-    }
-    return {
-        ok: true,
-        directive: {
-            kind: 'run_yolo',
-            commandClass: commandClass,
-            jobId: jobId,
-            operationId: operationId,
-            idempotencyKey: idempotencyKey,
-            targetKind: 'story',
-            targetRef: targetRef,
-            commandRef: commandRef,
-            ...(storyId ? { storyId } : {}),
-            ...(branchlessPreparation ? { executionMode: 'branchless_child_preparation' } : {}),
-            ...(runtime ? { runtime } : {}),
-            publicSummary: publicSummary,
-            ...(typeof input.reasonCode === 'string' ? { reasonCode: input.reasonCode } : {}),
-            ...(metadata ? { metadata } : {}),
-            ...(redactionSummary.length > 0 ? { redactionSummary } : {}),
-            publicSafe: true,
-        },
-    };
-}
-function governanceSourceFromDirective(metadata, fallback) {
-    return metadata?.governanceSource === 'delegated-subagent' ? 'delegated-subagent' : fallback;
-}
-function validateDirectiveRuntime(value, redactions) {
-    if (value === undefined)
-        return undefined;
-    if (!isRecord(value)) {
-        redactions.push(redaction('runtime', 'unsafe_key', 'value-denied'));
-        return undefined;
-    }
-    for (const key of Object.keys(value)) {
-        if (!RUNTIME_ALLOWED_KEYS.has(key) || UNSAFE_KEY_PATTERN.test(key))
-            redactions.push(redaction(`runtime.${key}`, unsafeKeyReason(key), 'key-denied'));
-    }
-    if (value.publicSafe !== true)
-        redactions.push(redaction('runtime.publicSafe', 'unsafe_key', 'value-denied'));
-    const runtimeId = stringField(value, 'runtimeId');
-    const modelId = stringField(value, 'modelId');
-    const source = stringField(value, 'source');
-    if (runtimeId && (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,79}$/.test(runtimeId) || UNSAFE_VALUE_PATTERN.test(runtimeId) || SHELL_FRAGMENT_PATTERN.test(runtimeId))) {
-        redactions.push(redaction('runtime.runtimeId', 'unsafe_key', 'value-denied'));
-    }
-    if (modelId && (!/^[A-Za-z0-9][A-Za-z0-9._:+/-]{0,119}$/.test(modelId) || UNSAFE_VALUE_PATTERN.test(modelId) || SHELL_FRAGMENT_PATTERN.test(modelId))) {
-        redactions.push(redaction('runtime.modelId', 'unsafe_key', 'value-denied'));
-    }
-    if (source !== undefined && source !== 'explicit' && source !== 'origin' && source !== 'default' && source !== 'fallback' && source !== 'unspecified') {
-        redactions.push(redaction('runtime.source', 'unsafe_key', 'value-denied'));
-    }
-    if (value.reasonCode !== undefined && (typeof value.reasonCode !== 'string' || UNSAFE_VALUE_PATTERN.test(value.reasonCode))) {
-        redactions.push(redaction('runtime.reasonCode', 'unsafe_key', 'value-denied'));
-    }
-    if (value.publicSafe !== true)
-        return undefined;
-    return {
-        ...(runtimeId ? { runtimeId } : {}),
-        ...(modelId ? { modelId } : {}),
-        ...(source === 'explicit' || source === 'origin' || source === 'default' || source === 'fallback' || source === 'unspecified' ? { source } : {}),
-        ...(typeof value.reasonCode === 'string' ? { reasonCode: value.reasonCode } : {}),
-        publicSafe: true,
-    };
-}
-function persistAttemptOutcome(store, attempt, outcome) {
-    const redactionSummary = outcome.redactionSummary ?? [];
-    const relativePaths = outcome.relativePaths ?? safeAttemptRelativePaths(attempt);
-    const counts = sanitizePublicRecord(outcome.counts);
-    const hashes = sanitizePublicRecord(outcome.hashes);
-    const outcomeMetadata = {
-        schemaVersion: 1,
-        contractVersion: 'continuity-v1',
-        attemptId: attempt.attempt_id,
-        executionId: attempt.execution_id,
-        jobId: attempt.job_id,
-        directiveHash: attempt.directive_hash,
-        status: outcome.status,
-        reasonCode: outcome.reasonCode,
-        ...(outcome.runtimeId ? { runtimeId: outcome.runtimeId } : {}),
-        ...(outcome.modelId ? { modelId: outcome.modelId } : {}),
-        ...(outcome.runtimeSource ? { runtimeSource: outcome.runtimeSource } : {}),
-        ...(outcome.retryCount !== undefined ? { retryCount: outcome.retryCount } : {}),
-        ...(outcome.reasonCode === AUTONOMOUS_GOVERNANCE_REASON_CODES.BYPASS_BLOCKED ? { governanceEvidence: AUTONOMOUS_GOVERNANCE_EVIDENCE_TAG } : {}),
-        publicSummary: boundPublicSummary(outcome.publicSummary),
-    };
-    const governance = readAutonomousGovernanceEnvelopeFromMetadata(attempt.metadata_json, {
-        autonomousKind: 'run_yolo',
-        jobId: attempt.job_id,
-        targetKind: 'story',
-        targetRef: attempt.target_ref,
-    });
-    // Backoff reuses the same attempt row. Preserve only its already-validated,
-    // public-safe authority envelope so retry preparation remains fail-closed
-    // without converting a recoverable execution boundary into a rejection.
-    const metadata = governance.ok
-        ? autonomousGovernanceMetadata(governance.envelope, outcomeMetadata)
-        : outcomeMetadata;
-    store.completeHeadlessExecutionAttempt({
-        attemptId: attempt.attempt_id,
-        executionId: attempt.execution_id,
-        jobId: attempt.job_id,
-        leaseId: outcome.leaseId,
-        runnerId: outcome.runnerId,
-        status: outcome.status,
-        completedAt: outcome.completedAt,
-        durationMs: outcome.durationMs,
-        reasonCode: outcome.reasonCode,
-        publicSummary: boundPublicSummary(outcome.publicSummary),
-        notBeforeAt: outcome.notBeforeAt,
-        retryCount: outcome.retryCount,
-        counts,
-        hashes,
-        redactionSummary,
-        relativePaths,
-        metadata,
-    });
-    store.recordHeadlessExecutionReceipt({
-        receiptId: `receipt-${safeEntityId('headless', `${attempt.attempt_id}-${outcome.status}`)}`,
-        attemptId: attempt.attempt_id,
-        executionId: attempt.execution_id,
-        jobId: attempt.job_id,
-        status: outcome.receiptStatus,
-        reasonCode: outcome.reasonCode,
-        createdAt: outcome.completedAt,
-        operationId: `${attempt.execution_id}:${outcome.status}:receipt`,
-        idempotencyKey: `${attempt.directive_hash}:${outcome.status}:receipt`,
-        counts,
-        hashes,
-        redactionSummary,
-        relativePaths,
-        metadata,
-    });
-    store.recordHeadlessExecutionSummary({
-        eventId: `event-${safeEntityId('headless-summary', `${attempt.attempt_id}-${outcome.status}`)}`,
-        attemptId: attempt.attempt_id,
-        executionId: attempt.execution_id,
-        jobId: attempt.job_id,
-        status: outcome.status,
-        runtimeId: outcome.runtimeId,
-        modelId: outcome.modelId,
-        publicSummary: boundPublicSummary(outcome.publicSummary),
-        reasonCode: outcome.reasonCode,
-        createdAt: outcome.completedAt,
-        durationMs: outcome.durationMs,
-        counts,
-        hashes,
-        redactionSummary,
-        relativePaths,
-        metadata,
-    });
-    return {
-        attemptId: attempt.attempt_id,
-        executionId: attempt.execution_id,
-        jobId: attempt.job_id,
-        status: outcome.status,
-        outcome: outcome.receiptStatus,
-        reasonCode: outcome.reasonCode,
-        timestamp: outcome.completedAt,
-        redactionSummary,
-        publicSafe: true,
-    };
-}
-function retryDecision(attempt, result, maxAttempts, backoffMs, nowIso) {
-    const transient = result.status === 'timed_out'
-        || result.reasonCode === HEADLESS_REASON_CODES.EXECUTION_FAILED
-        || result.reasonCode === HEADLESS_REASON_CODES.ADAPTER_UNAVAILABLE;
-    if (!transient)
-        return { retry: false };
-    const retryCount = attempt.retry_count + 1;
-    if (retryCount >= Math.max(1, attempt.max_attempts || maxAttempts))
-        return { retry: false, retryCount };
-    const multiplier = Math.min(8, 2 ** Math.max(0, attempt.retry_count));
-    return {
-        retry: true,
-        retryCount,
-        notBeforeAt: addMilliseconds(nowIso, backoffMs * multiplier),
-    };
-}
-function extractExecutionDirectiveCandidates(metadata) {
-    const records = Array.isArray(metadata) ? metadata : metadata ? [metadata] : [];
-    const directives = [];
-    for (const record of records) {
-        const value = record.continuityExecutionDirectives;
-        if (Array.isArray(value))
-            directives.push(...value);
-    }
-    return directives;
-}
-function hashDirective(directive) {
-    return hashPublicValue(stableJson({
-        kind: directive.kind,
-        commandClass: directive.commandClass,
-        jobId: directive.jobId,
-        targetRef: directive.targetRef,
-        commandRef: directive.commandRef,
-        storyId: directive.storyId,
-        executionMode: directive.executionMode,
-        runtime: directive.runtime,
-    }));
-}
-function stableJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map(stableJson).join(',')}]`;
-    if (isRecord(value)) {
-        return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`).join(',')}}`;
-    }
-    return JSON.stringify(value);
-}
-function assertPublicSafeCandidate(value, path, redactions) {
-    if (typeof value === 'string') {
-        if (UNSAFE_VALUE_PATTERN.test(value) || SHELL_FRAGMENT_PATTERN.test(value))
-            redactions.push(redaction(path, unsafeKeyReason(path), 'value-denied'));
-        return;
-    }
-    if (value === undefined || value === null || typeof value === 'number' || typeof value === 'boolean')
-        return;
-    if (Array.isArray(value)) {
-        value.forEach((item, index) => assertPublicSafeCandidate(item, `${path}.${index}`, redactions));
-        return;
-    }
-    if (isRecord(value)) {
-        for (const [key, child] of Object.entries(value)) {
-            const field = `${path}.${key}`;
-            if (UNSAFE_KEY_PATTERN.test(key))
-                redactions.push(redaction(field, unsafeKeyReason(key), 'key-denied'));
-            assertPublicSafeCandidate(child, field, redactions);
-        }
-        return;
-    }
-    redactions.push(redaction(path, 'unsafe_key', 'value-denied'));
-}
-function validateDirectiveRedactions(value, redactions) {
-    if (value === undefined)
-        return [];
-    if (!Array.isArray(value)) {
-        redactions.push(redaction('redactionSummary', 'unsafe_key', 'value-denied'));
-        return [];
-    }
-    const safe = [];
-    for (const [index, item] of value.entries()) {
-        if (!isRecord(item) || item.publicSafe !== true) {
-            redactions.push(redaction(`redactionSummary.${index}`, 'unsafe_key', 'value-denied'));
-            continue;
-        }
-        const field = stringField(item, 'field');
-        const reason = stringField(item, 'reason');
-        const evidence = stringField(item, 'evidence');
-        if (!field || !reason || !evidence || UNSAFE_VALUE_PATTERN.test(field) || UNSAFE_VALUE_PATTERN.test(reason) || UNSAFE_VALUE_PATTERN.test(evidence)) {
-            redactions.push(redaction(`redactionSummary.${index}`, 'unsafe_key', 'value-denied'));
-            continue;
-        }
-        safe.push({ field, reason, evidence, publicSafe: true });
-    }
-    return safe;
-}
-function safeAttemptRelativePaths(attempt) {
-    return STORY_TARGET_PATTERN.test(attempt.target_ref) ? [attempt.target_ref] : [];
-}
-function sanitizePublicRecord(record) {
-    if (!record)
-        return undefined;
-    const output = {};
-    for (const [key, value] of Object.entries(record)) {
-        if (!/^[A-Za-z0-9_.:-]{1,80}$/.test(key) || UNSAFE_KEY_PATTERN.test(key) || UNSAFE_VALUE_PATTERN.test(key))
-            continue;
-        if (typeof value === 'string' && UNSAFE_VALUE_PATTERN.test(value))
-            continue;
-        output[key] = value;
-    }
-    return Object.keys(output).length > 0 ? output : undefined;
-}
-function storyIdFromTargetRef(targetRef) {
-    return targetRef.replace(/^docs\/stories\//, '').replace(/\.story\.md$/, '');
-}
-function normalizeRuntimeSource(value) {
-    if (value === 'explicit' || value === 'origin' || value === 'default' || value === 'fallback')
-        return value;
-    return undefined;
-}
-function normalizeStoredRuntimeSource(value) {
-    if (value === 'explicit' || value === 'origin' || value === 'default' || value === 'fallback' || value === 'unspecified')
-        return value;
-    return undefined;
-}
-function unsafeKeyReason(key) {
-    if (/prompt|commandRef/i.test(key))
-        return 'prompt_body';
-    if (/std(?:out|err)|raw|log|transcript|stack/i.test(key))
-        return 'raw_log';
-    if (/url/i.test(key))
-        return 'private_url';
-    if (/path|cwd|argv|args|shell|command|binary|executable/i.test(key))
-        return 'executable_path';
-    if (/secret|token|password|authorization|api[_-]?key|license/i.test(key))
-        return 'secret_or_pii';
-    return 'unsafe_key';
-}
-function stringField(record, key) {
-    return typeof record[key] === 'string' ? record[key] : undefined;
-}
-function isSafeIdentifier(value) {
-    return Boolean(value && SAFE_ID_PATTERN.test(value) && !UNSAFE_VALUE_PATTERN.test(value) && !SHELL_FRAGMENT_PATTERN.test(value));
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function safeEntityId(prefix, value) {
-    const normalized = `${prefix}-${value}`.replace(/[^A-Za-z0-9_.:-]+/g, '-').replace(/^-+|-+$/g, '');
-    if (normalized.length > 0 && normalized.length <= 120)
-        return normalized;
-    return `${prefix}-${createHash('sha256').update(value).digest('hex').slice(0, 32)}`;
-}
-export function headlessExecutionEntityId(prefix, value) {
-    return safeEntityId(prefix, value);
-}
-function defaultHeadlessIdFactory(prefix, attemptId) {
-    return safeEntityId(prefix, `${attemptId}-${Date.now()}-${randomBytes(4).toString('hex')}`);
-}
-function addMilliseconds(iso, ms) {
-    const base = Date.parse(iso);
-    return new Date((Number.isFinite(base) ? base : Date.now()) + ms).toISOString();
-}
-function boundedInteger(value, min, max) {
-    if (!Number.isFinite(value))
-        return min;
-    return Math.max(min, Math.min(max, Math.floor(value)));
-}
-function unique(values) {
-    return Array.from(new Set(values));
-}
+import{createHash as q,randomBytes as Y}from"node:crypto";import{P205_RELEASE_GATE_BUDGETS as G,P205_ROOT_INVOKE_TIMEOUT_MS as K}from"../../../../shared/dist/yoloop/epic-terminal-git.js";import{AUTONOMOUS_GOVERNANCE_EVIDENCE_TAG as Z,AUTONOMOUS_GOVERNANCE_REASON_CODES as P,autonomousGovernanceMetadata as $,buildAutonomousGovernanceEnvelope as J,readAutonomousGovernanceEnvelopeFromMetadata as U,recordAutonomousGovernance as W}from"../../continuity/autonomous-governance.js";import{createDefaultHeadlessAdapterRegistry as Q}from"./adapters.js";import{loadHeadlessRuntimeDefaults as ee,resolveHeadlessRuntime as te}from"./resolver.js";import{HEADLESS_REASON_CODES as m,boundPublicSummary as A,hashPublicValue as g,redaction as i}from"./types.js";const re=K+60*1e3,oe=30*1e3,ae=30*1e3,ne=K,se=1,de=3,O=/^docs\/stories\/[A-Za-z0-9._-]+\.story\.md$/,ie=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/,ue=new Set(["schemaVersion","contractVersion","kind","commandClass","jobId","operationId","idempotencyKey","targetKind","targetRef","commandRef","storyId","executionMode","runtime","publicSummary","reasonCode","attempts","metadata","redactionSummary","publicSafe"]),ce=new Set(["runtimeId","modelId","source","reasonCode","publicSafe"]),R=/(raw[_-]?(?:logs?|payloads?)|std(?:out|err)|stack(?:[_-]?trace)?|transcript|objective(?:[_-]?(?:text|body|prompt))|prompt(?:[_-]?(?:body|text))?|private[_-]?(?:urls?|prompts?)|secret|token|password|protected(?:[_-]?(?:field|body|bodies|internals))?|workflow(?:[_-]?body)?|step(?:[_-]?body)?|customer(?:[_-]?(?:pii|data))?|\bpii\b|authorization|api[_-]?key|license[_-]?key|argv|args|executable(?:[_-]?path)?|binary(?:[_-]?path)?|shell|cwd|command[_-]?path|vendor(?:[_-]?(?:payload|corpus|response|output)))/i,y=/(https?:\/\/\S+|(?:^|\s)(?:\/(?:home|Users|media|mnt|tmp|var|etc|private)\/\S+|[A-Za-z]:\\\S+)|ghp_[A-Za-z0-9_]+|sk-[A-Za-z0-9_-]+|-----BEGIN [A-Z ]*PRIVATE KEY-----|authorization\s*:|password\s*=|token\s*=|api[_-]?key\s*=|license[_-]?key\s*=|raw[_-]?(?:logs?)\s*[:=]|transcript|stack\s*trace|stderr:|stdout:|system prompt|workflow body|step body|PROTECTED_|PRIVATE_INTERNALS|CUSTOMER_PII|\bPII\b|VENDOR_CORPUS|P190[_-]?SYNTHETIC[_-]?(?:HEADLESS|CONTINUITY))/i,E=/(?:[;&|`$<>]|\$\(|\n|\r|\0)/;async function Me(e){const t=e.adapterRegistry??Q(),r=b(e.limit??se,1,10),a=b(e.leaseMs??re,1e3,G.terminalWorkflowMaxDurationMs),n=b(e.staleLeaseAfterMs??oe,0,1440*60*1e3),s=b(e.maxAttempts??de,1,10),o=[],u=[],d=e.now(),c=me({store:e.store,metadata:e.metadata,nowIso:d,maxAttempts:s,queueCap:e.queueCap});o.push(...c.reasonCodes);const p=e.store.recoverStaleHeadlessExecutionAttempts({nowIso:d,staleAfterMs:n,limit:r*2});p.recoveredAttemptIds.length>0&&(o.push(m.EXECUTION_BACKOFF),p.failedAttemptIds.length>0&&o.push(m.EXECUTION_TIMEOUT));const I=new Set(e.attemptIds??[]),_=e.store.listDueHeadlessExecutionAttempts({nowIso:e.now(),limit:Math.max(r*5,10)}).filter(l=>l.directive_kind==="run_yolo").filter(l=>I.size===0||I.has(l.attempt_id)).slice(0,r);for(const l of _){const S=await le({store:e.store,projectRoot:e.projectRoot,runnerId:e.runnerId,attempt:l,registry:t,now:e.now,leaseMs:a,timeoutMs:b(e.timeoutMs??ne,1e3,72e5),backoffMs:b(e.backoffMs??ae,1e3,36e5),maxAttempts:s,adapterOptions:e.adapterOptions,runtimeDefaults:e.runtimeDefaults,runtimeFallback:e.runtimeFallback,idFactory:e.idFactory??Re});u.push(S),o.push(S.reasonCode)}return{ok:u.every(l=>l.outcome!=="failed")&&c.rejectedCount===0,enqueuedAttemptCount:c.enqueuedCount,dueAttemptCount:_.length,processedAttemptCount:u.filter(l=>l.outcome!=="ignored").length,recoveredAttemptIds:p.recoveredAttemptIds,receipts:u,reasonCodes:V(o.length>0?o:[m.OK]),publicSafe:!0}}function me(e){let t=0,r=0;const a=[];for(const n of Ee(e.metadata)){if(!h(n)||n.kind!=="run_yolo")continue;const s=_e(n);if(!s.ok){r+=1,a.push(s.reasonCode);continue}const o=s.directive;if(!e.store.jobExists(o.jobId)){r+=1,a.push(P.BYPASS_BLOCKED);continue}const u=be(o);if(e.store.hasCompletedHeadlessExecutionDirectiveHash(u)){a.push(m.EXECUTION_COMPLETED);continue}const d=J({autonomousKind:"run_yolo",source:Ie(o.metadata,"headless-run-yolo"),targetKind:"story",targetRef:o.targetRef,storyId:o.storyId??T(o.targetRef),jobId:o.jobId,operationSeed:o.operationId,commandHash:g(o.commandRef)}),c=W(e.store,d,e.nowIso,{requireExistingJob:!0});if(!c.ok){r+=1,a.push(c.reasonCode);continue}const p=F("attempt",o.idempotencyKey),I=F("exec",o.operationId),_=e.store.enqueueHeadlessExecutionAttempt({attemptId:p,executionId:I,jobId:o.jobId,directiveHash:u,directiveKind:"run_yolo",commandClass:o.commandClass,targetKind:"story",targetRef:o.targetRef,storyId:o.storyId??T(o.targetRef),runtimeId:o.runtime?.runtimeId,modelId:o.runtime?.modelId,runtimeSource:ge(o.runtime?.source),reasonCode:o.reasonCode,publicSummary:o.publicSummary,enqueuedAt:e.nowIso,notBeforeAt:e.nowIso,maxAttempts:e.maxAttempts,queueCap:e.queueCap,operationId:`${o.operationId}:enqueue`,idempotencyKey:o.idempotencyKey,counts:{directives:1},hashes:{directive:u},redactionSummary:o.redactionSummary,relativePaths:[o.targetRef],metadata:$(d,{schemaVersion:1,contractVersion:"continuity-v1",jobId:o.jobId,operationId:o.operationId,reasonCode:o.reasonCode??m.OK,targetRef:o.targetRef,directiveHash:u,...o.executionMode?{executionMode:o.executionMode}:{}})});if(!_.accepted){r+=1,a.push(_.reasonCode??"queue-cap-reached");continue}_.inserted&&(t+=1),a.push(m.OK)}return{enqueuedCount:t,rejectedCount:r,reasonCodes:V(a)}}async function le(e){const t=e.now(),r=e.idFactory("lease",e.attempt.attempt_id),a=z(t,e.leaseMs);if(!e.store.claimHeadlessExecutionAttempt({attemptId:e.attempt.attempt_id,leaseId:r,runnerId:e.runnerId,claimedAt:t,leaseExpiresAt:a,reasonCode:m.OK}).inserted)return{attemptId:e.attempt.attempt_id,executionId:e.attempt.execution_id,jobId:e.attempt.job_id,status:e.attempt.status,outcome:"ignored",reasonCode:"lease-conflict",timestamp:t,redactionSummary:[],publicSafe:!0};if(e.store.hasCompletedHeadlessExecutionDirectiveHash(e.attempt.directive_hash,e.attempt.attempt_id))return k(e.store,e.attempt,{leaseId:r,runnerId:e.runnerId,status:"skipped",receiptStatus:"ignored",reasonCode:m.EXECUTION_COMPLETED,publicSummary:"Skipped duplicate run_yolo directive because the directive hash is already completed.",completedAt:e.now(),counts:{duplicateDirectiveHashes:1},hashes:{directive:e.attempt.directive_hash},redactionSummary:[],relativePaths:[e.attempt.target_ref]});const o=fe(e);if(!o.ok)return k(e.store,e.attempt,{leaseId:r,runnerId:e.runnerId,status:o.status,receiptStatus:o.receiptStatus,reasonCode:o.reasonCode,publicSummary:o.publicSummary,completedAt:e.now(),counts:{rejectedDirectives:1},hashes:{directive:e.attempt.directive_hash},redactionSummary:o.redactionSummary,relativePaths:H(e.attempt)});const u=e.registry.getAdapter(o.input.runtimeId);if(!u.ok)return k(e.store,e.attempt,{leaseId:r,runnerId:e.runnerId,status:"failed",receiptStatus:"failed",reasonCode:u.reasonCode,publicSummary:u.publicSummary,completedAt:e.now(),counts:{rejectedAdapters:1},hashes:{directive:e.attempt.directive_hash},redactionSummary:u.redactionSummary,relativePaths:[e.attempt.target_ref],runtimeId:o.input.runtimeId,modelId:o.input.modelId,runtimeSource:o.input.runtimeSource});let d;try{d=await u.adapter.execute(o.input,{...e.adapterOptions,cwd:e.adapterOptions?.cwd??e.projectRoot})}catch{d={status:"failed",adapterId:o.input.runtimeId,runtimeId:o.input.runtimeId,...o.input.modelId?{modelId:o.input.modelId}:{},...o.input.runtimeSource?{runtimeSource:o.input.runtimeSource}:{},reasonCode:m.EXECUTION_FAILED,reasonCodes:[m.EXECUTION_FAILED,m.RECEIPT_REDACTED],exitCode:1,signal:null,durationMs:0,counts:{adapterExceptions:1},hashes:{directive:e.attempt.directive_hash},publicSummary:"Headless adapter failed with public-safe exception summary.",redactionSummary:[i("adapter","raw_log","value-denied")],relativePaths:[e.attempt.target_ref],receipt:o.input.receipt,publicSafe:!0}}const c=Se(e.attempt,d,e.maxAttempts,e.backoffMs,e.now()),p=c.retry?"backoff":d.status,I=c.retry?m.EXECUTION_BACKOFF:d.reasonCode,_=p==="completed"?"applied":p==="backoff"?"deferred":p==="skipped"?"ignored":"failed";return k(e.store,e.attempt,{leaseId:r,runnerId:e.runnerId,status:p,receiptStatus:_,reasonCode:I,publicSummary:c.retry?"Headless run_yolo execution scheduled bounded retry after transient adapter outcome.":d.publicSummary,completedAt:e.now(),durationMs:d.durationMs,notBeforeAt:c.notBeforeAt,retryCount:c.retryCount,counts:d.counts,hashes:{...d.hashes,directive:e.attempt.directive_hash},redactionSummary:d.redactionSummary,relativePaths:d.relativePaths.length>0?d.relativePaths:[e.attempt.target_ref],runtimeId:d.runtimeId,modelId:d.modelId,runtimeSource:d.runtimeSource})}function fe(e){const t=U(e.attempt.metadata_json,{autonomousKind:"run_yolo",jobId:e.attempt.job_id,targetKind:"story",targetRef:e.attempt.target_ref});if(!t.ok)return{ok:!1,status:"failed",receiptStatus:"failed",reasonCode:m.DIRECTIVE_REJECTED,publicSummary:t.publicSummary,redactionSummary:t.redactionSummary};const r=g(`*yolo @${e.attempt.target_ref}`),a=g(`*yolo @${e.attempt.target_ref} branchless-preparation`),n=t.envelope.hashes.command===a;if(!n&&t.envelope.hashes.command!==r)return{ok:!1,status:"failed",receiptStatus:"failed",reasonCode:m.DIRECTIVE_REJECTED,publicSummary:"Headless run_yolo governance command does not match an authorized execution mode.",redactionSummary:[i("autonomousGovernance.commandHash","prompt_body","operation-denied")]};const s=ye(e.attempt);if(!s.ok)return s;const o=pe(e);return o.ok?{ok:!0,input:{promptKind:n?"yolo-branchless-preparation":"yolo",targetKind:"story",targetRef:e.attempt.target_ref,...e.attempt.story_id?{storyId:e.attempt.story_id}:{},runtimeId:o.runtimeId,...o.modelId?{modelId:o.modelId}:{},runtimeSource:o.runtimeSource,timeoutMs:e.timeoutMs,receipt:{attemptId:e.attempt.attempt_id,subagentId:e.attempt.attempt_id,executionId:e.attempt.execution_id,jobId:e.attempt.job_id,operationId:e.attempt.execution_id,idempotencyKey:e.attempt.directive_hash,runnerId:e.runnerId},publicSummary:A(e.attempt.public_summary??"Headless run_yolo execution attempt."),publicSafe:!0}}:{ok:!1,status:"failed",receiptStatus:"failed",reasonCode:o.reasonCode,publicSummary:o.publicSummary,redactionSummary:o.redactionSummary}}function pe(e){const t=e.runtimeDefaults!==void 0?e.runtimeDefaults:ee({projectRoot:e.projectRoot});if(h(t)&&t.ok===!1)return{ok:!1,reasonCode:m.RUNTIME_UNTRUSTED,publicSummary:typeof t.publicSummary=="string"?t.publicSummary:"Headless runtime defaults failed public-safety validation.",redactionSummary:Array.isArray(t.redactionSummary)?t.redactionSummary:[]};const r=Ae(e.attempt.runtime_source)??"explicit",a=e.attempt.runtime_id||e.attempt.model_id?{...e.attempt.runtime_id?{runtimeId:e.attempt.runtime_id}:{},...e.attempt.model_id?{modelId:e.attempt.model_id}:{},source:r,publicSafe:!0}:void 0,n={registry:e.registry,defaults:t,fallback:e.runtimeFallback};a&&(r==="origin"?n.origin=a:r==="default"?n.projectDefault=a:r==="fallback"?n.fallback=a:n.explicit=a);const s=te(n);return s.ok?{ok:!0,runtimeId:s.runtimeId,...s.modelId?{modelId:s.modelId}:{},runtimeSource:s.runtimeSource}:{ok:!1,reasonCode:s.reasonCode,publicSummary:s.publicSummary,redactionSummary:s.redactionSummary}}function ye(e){const t=[];e.directive_kind!=="run_yolo"&&t.push(i("directiveKind","unsafe_key","value-denied")),e.target_kind!=="story"&&t.push(i("targetKind","prompt_body","value-denied")),(!O.test(e.target_ref)||E.test(e.target_ref)||y.test(e.target_ref))&&t.push(i("targetRef","prompt_body","value-denied"));const r=T(e.target_ref);return e.story_id&&e.story_id!==r&&t.push(i("storyId","prompt_body","value-denied")),t.length>0?{ok:!1,status:"failed",receiptStatus:"failed",reasonCode:m.PROMPT_REJECTED,publicSummary:"Headless run_yolo attempt did not match the canonical public story prompt shape.",redactionSummary:t}:{ok:!0,input:{promptKind:"yolo",targetKind:"story",targetRef:e.target_ref,...e.story_id?{storyId:e.story_id}:{},runtimeId:"fake",publicSafe:!0}}}function _e(e){const t=[];for(const C of Object.keys(e))(!ue.has(C)||R.test(C))&&t.push(i(C,v(C),"key-denied"));e.publicSafe!==!0&&t.push(i("publicSafe","unsafe_key","value-denied"));const r=f(e,"kind"),a=f(e,"commandClass"),n=f(e,"jobId"),s=f(e,"operationId"),o=f(e,"idempotencyKey"),u=f(e,"targetKind"),d=f(e,"targetRef"),c=f(e,"commandRef"),p=f(e,"publicSummary"),I=f(e,"storyId"),_=f(e,"executionMode");r!=="run_yolo"&&t.push(i("kind","unsafe_key","value-denied")),a!=="goal-tick"&&a!=="loop-tick"&&t.push(i("commandClass","unsafe_key","value-denied")),j(n)||t.push(i("jobId","unsafe_key","value-denied")),j(s)||t.push(i("operationId","unsafe_key","value-denied")),j(o)||t.push(i("idempotencyKey","unsafe_key","value-denied")),(u!=="story"||!d||!O.test(d)||y.test(d))&&t.push(i("targetRef","prompt_body","value-denied")),_!==void 0&&_!=="branchless_child_preparation"&&t.push(i("executionMode","unsafe_key","value-denied"));const l=h(e.metadata)?e.metadata:void 0,S=_==="branchless_child_preparation";S&&(l?.governanceSource!=="delegated-subagent"||l.childWorkspace!=="branchless_sandbox"||l.integrationOwner!=="root_agent"||l.maxDepth!==1||typeof l.graphRevision!="string"||!/^[a-f0-9]{64}$/.test(l.graphRevision))&&t.push(i("executionMode","unsafe_key","value-denied"));const B=d?`*yolo @${d}${S?" branchless-preparation":""}`:void 0;(!c||c!==B||c.includes("@neocortex")||E.test(c)||y.test(c))&&t.push(i("commandRef","prompt_body","value-denied")),I&&d&&I!==T(d)&&t.push(i("storyId","prompt_body","value-denied")),(!p||p.length>240||y.test(p))&&t.push(i("publicSummary","unbounded_text","value-denied")),e.reasonCode!==void 0&&(typeof e.reasonCode!="string"||y.test(e.reasonCode))&&t.push(i("reasonCode","unsafe_key","value-denied"));const N=he(e.runtime,t);e.attempts!==void 0&&x(e.attempts,"attempts",t),e.metadata!==void 0&&x(e.metadata,"metadata",t);const w=Ce(e.redactionSummary,t);return t.length>0||r!=="run_yolo"||!a||!n||!s||!o||!d||!c||!p?{ok:!1,reasonCode:t.some(X=>X.reason==="prompt_body")?m.PROMPT_REJECTED:m.DIRECTIVE_REJECTED,redactionSummary:t}:{ok:!0,directive:{kind:"run_yolo",commandClass:a,jobId:n,operationId:s,idempotencyKey:o,targetKind:"story",targetRef:d,commandRef:c,...I?{storyId:I}:{},...S?{executionMode:"branchless_child_preparation"}:{},...N?{runtime:N}:{},publicSummary:p,...typeof e.reasonCode=="string"?{reasonCode:e.reasonCode}:{},...l?{metadata:l}:{},...w.length>0?{redactionSummary:w}:{},publicSafe:!0}}}function Ie(e,t){return e?.governanceSource==="delegated-subagent"?"delegated-subagent":t}function he(e,t){if(e===void 0)return;if(!h(e)){t.push(i("runtime","unsafe_key","value-denied"));return}for(const s of Object.keys(e))(!ce.has(s)||R.test(s))&&t.push(i(`runtime.${s}`,v(s),"key-denied"));e.publicSafe!==!0&&t.push(i("runtime.publicSafe","unsafe_key","value-denied"));const r=f(e,"runtimeId"),a=f(e,"modelId"),n=f(e,"source");if(r&&(!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,79}$/.test(r)||y.test(r)||E.test(r))&&t.push(i("runtime.runtimeId","unsafe_key","value-denied")),a&&(!/^[A-Za-z0-9][A-Za-z0-9._:+/-]{0,119}$/.test(a)||y.test(a)||E.test(a))&&t.push(i("runtime.modelId","unsafe_key","value-denied")),n!==void 0&&n!=="explicit"&&n!=="origin"&&n!=="default"&&n!=="fallback"&&n!=="unspecified"&&t.push(i("runtime.source","unsafe_key","value-denied")),e.reasonCode!==void 0&&(typeof e.reasonCode!="string"||y.test(e.reasonCode))&&t.push(i("runtime.reasonCode","unsafe_key","value-denied")),e.publicSafe===!0)return{...r?{runtimeId:r}:{},...a?{modelId:a}:{},...n==="explicit"||n==="origin"||n==="default"||n==="fallback"||n==="unspecified"?{source:n}:{},...typeof e.reasonCode=="string"?{reasonCode:e.reasonCode}:{},publicSafe:!0}}function k(e,t,r){const a=r.redactionSummary??[],n=r.relativePaths??H(t),s=L(r.counts),o=L(r.hashes),u={schemaVersion:1,contractVersion:"continuity-v1",attemptId:t.attempt_id,executionId:t.execution_id,jobId:t.job_id,directiveHash:t.directive_hash,status:r.status,reasonCode:r.reasonCode,...r.runtimeId?{runtimeId:r.runtimeId}:{},...r.modelId?{modelId:r.modelId}:{},...r.runtimeSource?{runtimeSource:r.runtimeSource}:{},...r.retryCount!==void 0?{retryCount:r.retryCount}:{},...r.reasonCode===P.BYPASS_BLOCKED?{governanceEvidence:Z}:{},publicSummary:A(r.publicSummary)},d=U(t.metadata_json,{autonomousKind:"run_yolo",jobId:t.job_id,targetKind:"story",targetRef:t.target_ref}),c=d.ok?$(d.envelope,u):u;return e.completeHeadlessExecutionAttempt({attemptId:t.attempt_id,executionId:t.execution_id,jobId:t.job_id,leaseId:r.leaseId,runnerId:r.runnerId,status:r.status,completedAt:r.completedAt,durationMs:r.durationMs,reasonCode:r.reasonCode,publicSummary:A(r.publicSummary),notBeforeAt:r.notBeforeAt,retryCount:r.retryCount,counts:s,hashes:o,redactionSummary:a,relativePaths:n,metadata:c}),e.recordHeadlessExecutionReceipt({receiptId:`receipt-${D("headless",`${t.attempt_id}-${r.status}`)}`,attemptId:t.attempt_id,executionId:t.execution_id,jobId:t.job_id,status:r.receiptStatus,reasonCode:r.reasonCode,createdAt:r.completedAt,operationId:`${t.execution_id}:${r.status}:receipt`,idempotencyKey:`${t.directive_hash}:${r.status}:receipt`,counts:s,hashes:o,redactionSummary:a,relativePaths:n,metadata:c}),e.recordHeadlessExecutionSummary({eventId:`event-${D("headless-summary",`${t.attempt_id}-${r.status}`)}`,attemptId:t.attempt_id,executionId:t.execution_id,jobId:t.job_id,status:r.status,runtimeId:r.runtimeId,modelId:r.modelId,publicSummary:A(r.publicSummary),reasonCode:r.reasonCode,createdAt:r.completedAt,durationMs:r.durationMs,counts:s,hashes:o,redactionSummary:a,relativePaths:n,metadata:c}),{attemptId:t.attempt_id,executionId:t.execution_id,jobId:t.job_id,status:r.status,outcome:r.receiptStatus,reasonCode:r.reasonCode,timestamp:r.completedAt,redactionSummary:a,publicSafe:!0}}function Se(e,t,r,a,n){if(!(t.status==="timed_out"||t.reasonCode===m.EXECUTION_FAILED||t.reasonCode===m.ADAPTER_UNAVAILABLE))return{retry:!1};const o=e.retry_count+1;if(o>=Math.max(1,e.max_attempts||r))return{retry:!1,retryCount:o};const u=Math.min(8,2**Math.max(0,e.retry_count));return{retry:!0,retryCount:o,notBeforeAt:z(n,a*u)}}function Ee(e){const t=Array.isArray(e)?e:e?[e]:[],r=[];for(const a of t){const n=a.continuityExecutionDirectives;Array.isArray(n)&&r.push(...n)}return r}function be(e){return g(M({kind:e.kind,commandClass:e.commandClass,jobId:e.jobId,targetRef:e.targetRef,commandRef:e.commandRef,storyId:e.storyId,executionMode:e.executionMode,runtime:e.runtime}))}function M(e){return Array.isArray(e)?`[${e.map(M).join(",")}]`:h(e)?`{${Object.keys(e).sort().map(t=>`${JSON.stringify(t)}:${M(e[t])}`).join(",")}}`:JSON.stringify(e)}function x(e,t,r){if(typeof e=="string"){(y.test(e)||E.test(e))&&r.push(i(t,v(t),"value-denied"));return}if(!(e==null||typeof e=="number"||typeof e=="boolean")){if(Array.isArray(e)){e.forEach((a,n)=>x(a,`${t}.${n}`,r));return}if(h(e)){for(const[a,n]of Object.entries(e)){const s=`${t}.${a}`;R.test(a)&&r.push(i(s,v(a),"key-denied")),x(n,s,r)}return}r.push(i(t,"unsafe_key","value-denied"))}}function Ce(e,t){if(e===void 0)return[];if(!Array.isArray(e))return t.push(i("redactionSummary","unsafe_key","value-denied")),[];const r=[];for(const[a,n]of e.entries()){if(!h(n)||n.publicSafe!==!0){t.push(i(`redactionSummary.${a}`,"unsafe_key","value-denied"));continue}const s=f(n,"field"),o=f(n,"reason"),u=f(n,"evidence");if(!s||!o||!u||y.test(s)||y.test(o)||y.test(u)){t.push(i(`redactionSummary.${a}`,"unsafe_key","value-denied"));continue}r.push({field:s,reason:o,evidence:u,publicSafe:!0})}return r}function H(e){return O.test(e.target_ref)?[e.target_ref]:[]}function L(e){if(!e)return;const t={};for(const[r,a]of Object.entries(e))!/^[A-Za-z0-9_.:-]{1,80}$/.test(r)||R.test(r)||y.test(r)||typeof a=="string"&&y.test(a)||(t[r]=a);return Object.keys(t).length>0?t:void 0}function T(e){return e.replace(/^docs\/stories\//,"").replace(/\.story\.md$/,"")}function Ae(e){if(e==="explicit"||e==="origin"||e==="default"||e==="fallback")return e}function ge(e){if(e==="explicit"||e==="origin"||e==="default"||e==="fallback"||e==="unspecified")return e}function v(e){return/prompt|commandRef/i.test(e)?"prompt_body":/std(?:out|err)|raw|log|transcript|stack/i.test(e)?"raw_log":/url/i.test(e)?"private_url":/path|cwd|argv|args|shell|command|binary|executable/i.test(e)?"executable_path":/secret|token|password|authorization|api[_-]?key|license/i.test(e)?"secret_or_pii":"unsafe_key"}function f(e,t){return typeof e[t]=="string"?e[t]:void 0}function j(e){return!!(e&&ie.test(e)&&!y.test(e)&&!E.test(e))}function h(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function D(e,t){const r=`${e}-${t}`.replace(/[^A-Za-z0-9_.:-]+/g,"-").replace(/^-+|-+$/g,"");return r.length>0&&r.length<=120?r:`${e}-${q("sha256").update(t).digest("hex").slice(0,32)}`}function F(e,t){return D(e,t)}function Re(e,t){return D(e,`${t}-${Date.now()}-${Y(4).toString("hex")}`)}function z(e,t){const r=Date.parse(e);return new Date((Number.isFinite(r)?r:Date.now())+t).toISOString()}function b(e,t,r){return Number.isFinite(e)?Math.max(t,Math.min(r,Math.floor(e))):t}function V(e){return Array.from(new Set(e))}export{ae as DEFAULT_HEADLESS_EXECUTION_BACKOFF_MS,re as DEFAULT_HEADLESS_EXECUTION_LEASE_MS,se as DEFAULT_HEADLESS_EXECUTION_LIMIT,de as DEFAULT_HEADLESS_EXECUTION_MAX_ATTEMPTS,oe as DEFAULT_HEADLESS_EXECUTION_STALE_LEASE_AFTER_MS,ne as DEFAULT_HEADLESS_EXECUTION_TIMEOUT_MS,F as headlessExecutionEntityId,Me as runYoloExecutionPhase};