@overdeck/desktop 0.45.22 → 0.45.24

package/server/{types-7-GnJn0t.js → types-5M0lupud.js}

@@ -59,4 +59,4 @@ var init_types = __esmMin((() => {}));
 //#endregion
 export { stepSkipped as a, stepOk as i, init_types as n, stepFailed as r, getLinearApiKey as t };
 
-//# sourceMappingURL=types-7-GnJn0t.js.map
+//# sourceMappingURL=types-5M0lupud.js.map

package/server/{uat-train-0Ujk8GCv.js → uat-train-B05BWkp-.js}

@@ -1,2 +1,2 @@
-import { a as postUatGenerationStackPayload, c as startUatTrainReconciler, i as postUatGenerationPromotePayload, l as stopUatTrainReconciler, n as getUatCandidatePayload, o as resolveUatProjectRoot, r as getUatGenerationsPayload, s as runUatTrainReconcile, t as canStartUatTrainReconciler } from "./uat-train-j0cPeMSj.js";
+import { a as postUatGenerationStackPayload, c as startUatTrainReconciler, i as postUatGenerationPromotePayload, l as stopUatTrainReconciler, n as getUatCandidatePayload, o as resolveUatProjectRoot, r as getUatGenerationsPayload, s as runUatTrainReconcile, t as canStartUatTrainReconciler } from "./uat-train-DDSrSoV1.js";
 export { canStartUatTrainReconciler, getUatCandidatePayload, getUatGenerationsPayload, postUatGenerationPromotePayload, postUatGenerationStackPayload, resolveUatProjectRoot, runUatTrainReconcile, startUatTrainReconciler, stopUatTrainReconciler };

package/server/{uat-train-j0cPeMSj.js → uat-train-DDSrSoV1.js}

@@ -1,17 +1,17 @@
-import { Hn as init_projects, d as loadConfigNoMigration, kn as findProjectByPathSync, t as init_config_yaml, tt as resolveModel } from "./config-yaml-ig8Nwtiw.js";
-import { n as getDashboardIdentity, t as recordDeaconNudge } from "./deacon-nudge-log-D6K9K-rE.js";
-import { D as killSession, E as isPaneDead, V as sessionExists, w as init_tmux } from "./tmux-L5LgvGLp.js";
-import { L as messageAgent, s as init_agents } from "./queries-ZABd5aXP.js";
-import { S as setUatGenerationStackStartedAtSync, a as getUatGenerationSync, h as listUatGenerationsWithStacksSync, l as isMergeTrainEnabled, m as listUatGenerationsSync, o as init_merge_sync, p as listUatGenerationNamesSync, s as insertUatGenerationSync, w as updateUatGenerationSync } from "./merge-sync-Do8_q32h.js";
-import { A as init_vbrief_index, M as readVBriefDocument, k as findVBriefByIssue } from "./io-DQR9PMgS.js";
-import { S as getConversationByName, _t as getDiscoveredStats, at as aggregateDiscoveredSessionCost, ct as countDiscoveredSessions, ft as findDiscoveredSessions, k as init_conversations, mt as getDiscoveredSessionById, ot as aggregateDiscoveredSessionCostBy, yt as init_discovered_sessions } from "./conversations-bYpM9-kZ.js";
-import { f as isFlywheelGloballyPaused, i as getFlywheelActiveRunId, n as FLYWHEEL_GLOBAL_PAUSE_KEY, o as getSetting, s as init_control_settings, t as FLYWHEEL_ACTIVE_RUN_ID_KEY, w as setSetting } from "./control-settings-D_odMIaC.js";
-import { n as resolveHarness, t as init_harness_resolve } from "./harness-resolve-D5FVQTmy.js";
-import { a as enrichSessions, c as searchSessions, i as CostThresholdError, n as getSessionsFeedFacets, o as embedSessions, r as listSessionsFeed, t as scan } from "./scanner-Br0Z5S6R.js";
-import { t as listSubstrateBugWeights } from "./substrate-bug-weights-service-CpIZILj9.js";
-import { C as writeLatestFlywheelStatus, S as writeFlywheelLaunchMetadata, _ as nextFlywheelRunId, a as loadResumeSessionId, b as resolveLiveFlywheelRunId, c as saveResumeSessionId, d as abortFlywheelRun, g as listFlywheelRuns, l as spawnFlywheelAgent, p as getFlywheelRunDetail, r as isFlywheelDevcontainerRuntime, t as FLYWHEEL_ORCHESTRATOR_AGENT_ID, y as readFlywheelLaunchMetadata } from "./flywheel-COR0mbRI.js";
-import { t as extractACFromDocument } from "./acceptance-criteria-BH7ac_1G.js";
-import { n as ensureDevcontainerSync, r as init_ensure_devcontainer } from "./ensure-devcontainer-V5JWaAva.js";
+import { Tn as init_projects, d as loadConfigNoMigration, fn as findProjectByPathSync, t as init_config_yaml, tt as resolveModel } from "./config-yaml-DySPNmKN.js";
+import { n as getDashboardIdentity, t as recordDeaconNudge } from "./deacon-nudge-log-6wVqAaqz.js";
+import { D as killSession, E as isPaneDead, H as sessionExists, w as init_tmux } from "./tmux-R7N7y-Mh.js";
+import { X as messageAgent, b as init_agents } from "./queries-CjNIf-Ub.js";
+import { S as setUatGenerationStackStartedAtSync, a as getUatGenerationSync, h as listUatGenerationsWithStacksSync, l as isMergeTrainEnabled, m as listUatGenerationsSync, o as init_merge_sync, p as listUatGenerationNamesSync, s as insertUatGenerationSync, w as updateUatGenerationSync } from "./merge-sync-VPV28g0g.js";
+import { A as init_xbrief_index, M as readXBriefDocument, k as findXBriefByIssue } from "./io-C9kF1wtJ.js";
+import { S as getConversationByName, _t as getDiscoveredStats, at as aggregateDiscoveredSessionCost, ct as countDiscoveredSessions, ft as findDiscoveredSessions, k as init_conversations, mt as getDiscoveredSessionById, ot as aggregateDiscoveredSessionCostBy, yt as init_discovered_sessions } from "./conversations-6AfUfbwc.js";
+import { f as isFlywheelGloballyPaused, i as getFlywheelActiveRunId, n as FLYWHEEL_GLOBAL_PAUSE_KEY, o as getSetting, s as init_control_settings, t as FLYWHEEL_ACTIVE_RUN_ID_KEY, w as setSetting } from "./control-settings-BQp7_4uD.js";
+import { n as resolveHarness, t as init_harness_resolve } from "./harness-resolve-3lNZkyT4.js";
+import { a as enrichSessions, c as searchSessions, i as CostThresholdError, n as getSessionsFeedFacets, o as embedSessions, r as listSessionsFeed, t as scan } from "./scanner-CnqEZeDy.js";
+import { t as listSubstrateBugWeights } from "./substrate-bug-weights-service-B-FwCs5V.js";
+import { D as writeFlywheelLaunchMetadata, O as writeLatestFlywheelStatus, S as nextFlywheelRunId, T as resolveLiveFlywheelRunId, a as isFlywheelDevcontainerRuntime, f as spawnFlywheelAgent, g as abortFlywheelRun, s as loadResumeSessionId, t as FLYWHEEL_ORCHESTRATOR_AGENT_ID, u as saveResumeSessionId, v as getFlywheelRunDetail, w as readFlywheelLaunchMetadata, x as listFlywheelRuns } from "./flywheel-DHrgCphM.js";
+import { t as extractACFromDocument } from "./acceptance-criteria-DDCnXF58.js";
+import { n as ensureDevcontainerSync, r as init_ensure_devcontainer } from "./ensure-devcontainer-DNi-ono3.js";
 import { isAbsolute, relative, resolve, sep } from "node:path";
 import { Effect } from "effect";
 import { existsSync } from "fs";
@@ -31,7 +31,7 @@ init_projects();
 init_config_yaml();
 init_tmux();
 init_merge_sync();
-init_vbrief_index();
+init_xbrief_index();
 init_harness_resolve();
 init_agents();
 init_discovered_sessions();
@@ -176,15 +176,15 @@ async function runInline(operation, payload, onProgress) {
 			});
 		}
 		case "getArtifactBySlug": {
-			const { getArtifactBySlugJob } = await import("./artifact-index-jobs-CDBFL4OU.js");
+			const { getArtifactBySlugJob } = await import("./artifact-index-jobs-CbEDfCDu.js");
 			return getArtifactBySlugJob(payload);
 		}
 		case "listArtifactsForWorkspaceOrIssue": {
-			const { listArtifactsForWorkspaceOrIssueJob } = await import("./artifact-index-jobs-CDBFL4OU.js");
+			const { listArtifactsForWorkspaceOrIssueJob } = await import("./artifact-index-jobs-CbEDfCDu.js");
 			return listArtifactsForWorkspaceOrIssueJob(payload);
 		}
 		case "unshareArtifactBySlug": {
-			const { unshareArtifactBySlugJob } = await import("./artifact-index-jobs-CDBFL4OU.js");
+			const { unshareArtifactBySlugJob } = await import("./artifact-index-jobs-CbEDfCDu.js");
 			return unshareArtifactBySlugJob(payload);
 		}
 	}
@@ -424,12 +424,12 @@ async function pauseFlywheelRunForDashboard() {
 	if (before.activeRunId) try {
 		const { readFile } = await import("node:fs/promises");
 		const { join } = await import("node:path");
-		const { getAgentDir } = await import("./agents-DyHKlq1I.js");
+		const { getAgentDir } = await import("./agents-wi9NWzs2.js");
 		const sessionId = (await readFile(join(getAgentDir(FLYWHEEL_ORCHESTRATOR_AGENT_ID), "session.id"), "utf-8")).trim();
 		if (sessionId) await saveResumeSessionId(before.activeRunId, sessionId);
 	} catch {}
 	await setPaused(true);
-	await import("./agents-DyHKlq1I.js").then(({ stopAgent }) => Effect.runPromise(stopAgent(FLYWHEEL_ORCHESTRATOR_AGENT_ID)));
+	await import("./agents-wi9NWzs2.js").then(({ stopAgent }) => Effect.runPromise(stopAgent(FLYWHEEL_ORCHESTRATOR_AGENT_ID)));
 	return {
 		before,
 		after: await readGateSnapshot(),
@@ -439,7 +439,7 @@ async function pauseFlywheelRunForDashboard() {
 async function abortFlywheelRunForDashboard() {
 	const candidate = await getActiveRunId();
 	if (!candidate) return { aborted: await resolveLiveFlywheelRunId() ?? null };
-	const { stopAgent } = await import("./agents-DyHKlq1I.js");
+	const { stopAgent } = await import("./agents-wi9NWzs2.js");
 	await Effect.runPromise(stopAgent(FLYWHEEL_ORCHESTRATOR_AGENT_ID));
 	await abortFlywheelRun(candidate);
 	return { aborted: candidate };
@@ -1870,7 +1870,7 @@ function canStartUatTrainReconciler() {
 async function getReadySet() {
 	const status = await readCurrentFlywheelStatusForDashboard();
 	if (!status) return null;
-	const { computeMergeQueue, resolveMergeQueuePrUrl } = await import("./flywheel-merge-order-CNKAY489.js");
+	const { computeMergeQueue, resolveMergeQueuePrUrl } = await import("./flywheel-merge-order-UUcsCDb6.js");
 	const fromVerbs = (await Effect.runPromise(computeMergeQueue(status.activePipeline, projectRoot(), {
 		getPrUrl: resolveMergeQueuePrUrl,
 		onIneligible: (issueId, reason) => console.log(`[uat-train] ${issueId} has a merge verb but is not merge-eligible (${reason}) — excluded from the ready set`)
@@ -1896,8 +1896,8 @@ async function getReadySet() {
 */
 async function sweepEligibleFeatures(alreadyIncluded) {
 	try {
-		const { loadReviewStatuses, mergeGateEligibility } = await import("./review-status-Bnh-rdkY.js");
-		const { resolveProjectFromIssueSync } = await import("./projects-BKkwpH6q.js");
+		const { loadReviewStatuses, mergeGateEligibility } = await import("./review-status-btEYlaxA.js");
+		const { resolveProjectFromIssueSync } = await import("./projects-vjjcmiN8.js");
 		const { execFile } = await import("node:child_process");
 		const { promisify } = await import("node:util");
 		const execFileAsync = promisify(execFile);
@@ -2029,14 +2029,14 @@ async function loadAcceptanceCriteriaCache(issueIds) {
 			acceptanceCriteriaByIssue.delete(upperIssueId);
 		}
 		try {
-			const found = await Effect.runPromise(findVBriefByIssue(root, upperIssueId));
+			const found = await Effect.runPromise(findXBriefByIssue(root, upperIssueId));
 			if (!found) {
 				acceptanceCriteriaByIssue.delete(upperIssueId);
 				cache.set(upperIssueId, []);
 				return;
 			}
 			const { mtimeMs } = await stat(found.path);
-			const criteria = extractACFromDocument(await Effect.runPromise(readVBriefDocument(found.path))).map((ac) => ({
+			const criteria = extractACFromDocument(await Effect.runPromise(readXBriefDocument(found.path))).map((ac) => ({
 				title: ac.title,
 				status: ac.status
 			}));
@@ -2131,7 +2131,7 @@ async function postUatGenerationStackPayload(name) {
 }
 async function postUatGenerationPromotePayload(name, firePostMerge) {
 	const root = projectRoot();
-	const { reviewRecordEligibility } = await import("./flywheel-merge-order-CNKAY489.js");
+	const { reviewRecordEligibility } = await import("./flywheel-merge-order-UUcsCDb6.js");
 	const result = await promoteUatGeneration(name, root, {
 		git: buildUatPromoteGitDeps(root),
 		store: {
@@ -2149,4 +2149,4 @@ async function postUatGenerationPromotePayload(name, firePostMerge) {
 //#endregion
 export { postUatGenerationStackPayload as a, startUatTrainReconciler as c, openFlywheelRunReportForDashboard as d, pauseFlywheelRunForDashboard as f, runDashboardDbJob as g, startFlywheelRunForDashboard as h, postUatGenerationPromotePayload as i, stopUatTrainReconciler as l, resumeFlywheelRunForDashboard as m, getUatCandidatePayload as n, resolveUatProjectRoot as o, readCurrentFlywheelStatusForDashboard as p, getUatGenerationsPayload as r, runUatTrainReconcile as s, canStartUatTrainReconciler as t, abortFlywheelRunForDashboard as u };
 
-//# sourceMappingURL=uat-train-j0cPeMSj.js.map
+//# sourceMappingURL=uat-train-DDSrSoV1.js.map

package/server/validate-IfDGkaVR.js

@@ -0,0 +1,177 @@
+import { c as init_review_status_sync, r as getAllReviewStatusesFromDb } from "./review-status-sync-BTOpxtTC.js";
+import { H as liveOrderIssueLookup, V as listBooks } from "./flywheel-DHrgCphM.js";
+import { join } from "node:path";
+import { existsSync, readdirSync, statSync } from "node:fs";
+//#region ../../lib/cloister/merge-blockers.ts
+init_review_status_sync();
+/**
+* PRs that passed review but cannot merge for a GitHub-native reason (PAN-1620):
+* merge_conflict / failing_checks / not_mergeable. These sit forever unless rebased.
+*
+* Reads `review_status` directly from SQLite — NO HTTP — so it works inside a
+* network-sandboxed harness (e.g. codex's bwrap sandbox) where a `curl` to the
+* dashboard's `/api/flywheel/merge-blockers` cannot reach `127.0.0.1:3011`.
+* Shared by the dashboard route and the `pan flywheel merge-blockers` CLI so the
+* two surfaces can never disagree.
+*/
+const MERGE_BLOCKER_TYPES = new Set([
+	"merge_conflict",
+	"failing_checks",
+	"not_mergeable"
+]);
+function getMergeBlockersPayload() {
+	const statuses = getAllReviewStatusesFromDb();
+	const out = [];
+	for (const [issueId, status] of Object.entries(statuses)) {
+		if (status.reviewStatus !== "passed") continue;
+		if (status.mergeStatus === "merged") continue;
+		const reasons = (status.blockerReasons ?? []).filter((b) => MERGE_BLOCKER_TYPES.has(b.type));
+		if (reasons.length === 0) continue;
+		out.push({
+			issueId,
+			prUrl: status.prUrl,
+			reasons: reasons.map((b) => ({
+				type: b.type,
+				summary: b.summary
+			}))
+		});
+	}
+	return out;
+}
+//#endregion
+//#region ../../lib/orders/validate.ts
+function hasNonEmptyFile(path) {
+	try {
+		return existsSync(path) && statSync(path).isFile() && statSync(path).size > 0;
+	} catch {
+		return false;
+	}
+}
+function issuePattern(issueId) {
+	const escaped = issueId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return new RegExp(`(?:^|[-_])${escaped}(?:[-_.]|$)`, "i");
+}
+function nonEmptyFileNames(directory) {
+	if (!existsSync(directory)) return [];
+	return readdirSync(directory).filter((name) => hasNonEmptyFile(join(directory, name)));
+}
+function createOrderPrdLookup(stateRoot) {
+	const draftNames = new Set([...nonEmptyFileNames(join(stateRoot, "drafts")), ...nonEmptyFileNames(join(stateRoot, ".pan", "drafts"))].map((name) => name.toLowerCase()));
+	const specNames = [...nonEmptyFileNames(join(stateRoot, "specs")), ...nonEmptyFileNames(join(stateRoot, ".pan", "specs"))];
+	return (issueId) => {
+		const lower = issueId.toLowerCase();
+		if (draftNames.has(`${lower}.md`)) return true;
+		const pattern = issuePattern(issueId);
+		return specNames.some((name) => pattern.test(name));
+	};
+}
+function hasOrderIssuePrd(stateRoot, issueId) {
+	const lower = issueId.toLowerCase();
+	if ([join(stateRoot, "drafts", `${lower}.md`), join(stateRoot, ".pan", "drafts", `${lower}.md`)].some(hasNonEmptyFile)) return true;
+	for (const specsDir of [join(stateRoot, "specs"), join(stateRoot, ".pan", "specs")]) {
+		if (!existsSync(specsDir)) continue;
+		const pattern = issuePattern(issueId);
+		if (readdirSync(specsDir).some((name) => pattern.test(name) && hasNonEmptyFile(join(specsDir, name)))) return true;
+	}
+	return false;
+}
+function findCycle(book) {
+	const issues = new Set(book.items.map((item) => item.issue.toUpperCase()));
+	const edges = new Map(book.items.map((item) => [item.issue.toUpperCase(), item.prereqs.map((prereq) => prereq.toUpperCase()).filter((prereq) => issues.has(prereq))]));
+	const visiting = /* @__PURE__ */ new Set();
+	const visited = /* @__PURE__ */ new Set();
+	const path = [];
+	const visit = (issue) => {
+		if (visiting.has(issue)) {
+			const start = path.indexOf(issue);
+			return [...path.slice(start), issue];
+		}
+		if (visited.has(issue)) return null;
+		visiting.add(issue);
+		path.push(issue);
+		for (const prereq of edges.get(issue) ?? []) {
+			const cycle = visit(prereq);
+			if (cycle) return cycle;
+		}
+		path.pop();
+		visiting.delete(issue);
+		visited.add(issue);
+		return null;
+	};
+	for (const issue of issues) {
+		const cycle = visit(issue);
+		if (cycle) return cycle;
+	}
+	return null;
+}
+function validateBookForStart(stateRoot, book, options = {}) {
+	const blocks = [];
+	const warns = [];
+	if (book.items.length === 0) blocks.push({
+		code: "empty-book",
+		issue: book.id,
+		message: "Order book must contain at least one issue"
+	});
+	const issueLookup = options.issueLookup ?? liveOrderIssueLookup;
+	const ids = /* @__PURE__ */ new Set();
+	for (const item of book.items) {
+		ids.add(item.issue.toUpperCase());
+		item.prereqs.forEach((prereq) => ids.add(prereq.toUpperCase()));
+	}
+	const issueState = issueLookup([...ids]);
+	for (const item of book.items) {
+		const issue = item.issue.toUpperCase();
+		const state = issueState.get(issue);
+		if (!state?.open) blocks.push({
+			code: "issue-not-open",
+			issue,
+			message: state ? `${issue} is not open` : `${issue} could not be resolved as an open issue`
+		});
+	}
+	for (const other of options.books ?? listBooks(stateRoot)) {
+		if (other.id === book.id || other.status === "complete") continue;
+		for (const item of other.items) {
+			const issue = item.issue.toUpperCase();
+			if (!ids.has(issue) || !book.items.some((candidate) => candidate.issue.toUpperCase() === issue)) continue;
+			blocks.push({
+				code: "duplicate-membership",
+				issue,
+				message: `${issue} already belongs to non-complete order book ${other.id}`
+			});
+		}
+	}
+	const bookIssues = new Set(book.items.map((item) => item.issue.toUpperCase()));
+	for (const item of book.items) for (const rawPrereq of item.prereqs) {
+		const prereq = rawPrereq.toUpperCase();
+		if (!bookIssues.has(prereq) && !issueState.has(prereq)) blocks.push({
+			code: "unresolved-prerequisite",
+			issue: item.issue,
+			message: `${item.issue} prerequisite ${prereq} could not be resolved`
+		});
+	}
+	const cycle = findCycle(book);
+	if (cycle) blocks.push({
+		code: "prerequisite-cycle",
+		issue: cycle[0],
+		message: `Prerequisite cycle: ${cycle.join(" → ")}`
+	});
+	const hasPrd = options.hasPrd ?? ((issueId) => hasOrderIssuePrd(stateRoot, issueId));
+	for (const item of book.items) {
+		if (item.lane !== "B" || hasPrd(item.issue)) continue;
+		const finding = {
+			code: "missing-prd",
+			issue: item.issue,
+			message: `${item.issue} has no draft PRD or canonical spec`
+		};
+		if (item.planAtPickup) warns.push(finding);
+		else blocks.push(finding);
+	}
+	return {
+		blocks,
+		warns
+	};
+}
+//#endregion
+export { getMergeBlockersPayload as i, hasOrderIssuePrd as n, validateBookForStart as r, createOrderPrdLookup as t };
+
+//# sourceMappingURL=validate-IfDGkaVR.js.map

package/server/{validation-DcAgXTQp.js → validation-CC9OPqJZ.js}

@@ -1,3 +1,3 @@
-import { i as runQualityGates, n as init_validation, r as killAllGateProcessGroups } from "./validation-CabEISJT.js";
+import { i as runQualityGates, n as init_validation, r as killAllGateProcessGroups } from "./validation-Dw1pzDzr.js";
 init_validation();
 export { killAllGateProcessGroups, runQualityGates };

package/server/{validation-CabEISJT.js → validation-Dw1pzDzr.js}

@@ -1,12 +1,221 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { jr as init_errors } from "./config-yaml-ig8Nwtiw.js";
-import { f as init_config, m as loadConfigSync } from "./config-q4Gvd8dq.js";
-import { n as init_workspace_config, r as replacePlaceholdersSync } from "./workspace-config-Bigl_-Lk.js";
+import { Br as getOverdeckHome, Vr as init_paths, mr as init_errors } from "./config-yaml-DySPNmKN.js";
+import { f as init_config, m as loadConfigSync } from "./config-BZ0sHTju.js";
+import { n as init_workspace_config, r as replacePlaceholdersSync } from "./workspace-config-CIVWZOQr.js";
+import { join } from "node:path";
 import { Effect } from "effect";
 import "fs";
-import { join } from "path";
+import { join as join$1 } from "path";
+import { cpus, loadavg } from "node:os";
+import { mkdir, open, readFile, readdir, unlink } from "node:fs/promises";
 import { exec } from "child_process";
 import { promisify } from "util";
+//#region ../../lib/cloister/quality-gate-admission.ts
+function isErrnoException(error) {
+	return error instanceof Error && "code" in error;
+}
+function processIsAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return isErrnoException(error) && error.code === "EPERM";
+	}
+}
+function delay(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function cpuTotals() {
+	const records = cpus();
+	let idle = 0;
+	let total = 0;
+	for (const cpu of records) {
+		idle += cpu.times.idle;
+		total += Object.values(cpu.times).reduce((sum, value) => sum + value, 0);
+	}
+	return {
+		idle,
+		total,
+		cores: Math.max(1, records.length)
+	};
+}
+async function sampleQualityGatePressure(sleep = delay) {
+	const before = cpuTotals();
+	await sleep(250);
+	const after = cpuTotals();
+	const totalDelta = after.total - before.total;
+	const idleDelta = after.idle - before.idle;
+	const cpuUtilization = totalDelta > 0 ? (totalDelta - idleDelta) / totalDelta : 0;
+	const loadPerCore = loadavg()[0] / after.cores;
+	return {
+		cpuUtilization,
+		loadPerCore,
+		pressured: cpuUtilization >= .75 || loadPerCore >= 1
+	};
+}
+function admissionRoot(rootDir) {
+	return rootDir ?? join(getOverdeckHome(), "verification-workers", "admission");
+}
+function ownerPath(root) {
+	return join(root, "owner.json");
+}
+function breakerPath(root) {
+	return join(root, "owner.break");
+}
+function ticketPath(root, ticketId) {
+	return join(root, `waiter-${ticketId}.json`);
+}
+async function writeExclusive(path, value) {
+	const file = await open(path, "wx", 384);
+	try {
+		await file.writeFile(`${JSON.stringify(value)}\n`, "utf8");
+	} finally {
+		await file.close();
+	}
+}
+async function readJson(path) {
+	try {
+		return JSON.parse(await readFile(path, "utf8"));
+	} catch {
+		return null;
+	}
+}
+async function unlinkIfExists(path) {
+	try {
+		await unlink(path);
+	} catch (error) {
+		if (!isErrnoException(error) || error.code !== "ENOENT") throw error;
+	}
+}
+function sameOwner(left, right) {
+	return left?.ticketId === right.ticketId && left.pid === right.pid && left.acquiredAt === right.acquiredAt;
+}
+function ownerIsStale(owner, now, staleMs, isProcessAlive) {
+	return now - owner.acquiredAt > staleMs || !isProcessAlive(owner.pid);
+}
+async function acquireBreaker(root, now, staleMs, isProcessAlive) {
+	const path = breakerPath(root);
+	for (let attempt = 0; attempt < 2; attempt++) try {
+		await writeExclusive(path, {
+			pid: process.pid,
+			acquiredAt: now()
+		});
+		return true;
+	} catch (error) {
+		if (!isErrnoException(error) || error.code !== "EEXIST") throw error;
+		const existing = await readJson(path);
+		if (existing && now() - existing.acquiredAt <= staleMs && isProcessAlive(existing.pid)) return false;
+		await unlinkIfExists(path);
+	}
+	return false;
+}
+async function clearStaleOwner(root, observed, now, staleMs, isProcessAlive) {
+	if (!await acquireBreaker(root, now, staleMs, isProcessAlive)) return;
+	try {
+		const current = await readJson(ownerPath(root));
+		if (!observed && !current || observed && sameOwner(current, observed) && ownerIsStale(observed, now(), staleMs, isProcessAlive)) await unlinkIfExists(ownerPath(root));
+	} finally {
+		await unlinkIfExists(breakerPath(root));
+	}
+}
+async function listLiveTickets(root, isProcessAlive) {
+	const entries = await readdir(root);
+	const tickets = [];
+	for (const entry of entries) {
+		if (!entry.startsWith("waiter-") || !entry.endsWith(".json")) continue;
+		const path = join(root, entry);
+		const ticket = await readJson(path);
+		if (!ticket || typeof ticket.ticketId !== "string" || !Number.isFinite(ticket.createdAt)) {
+			await unlinkIfExists(path);
+			continue;
+		}
+		if (!isProcessAlive(ticket.pid)) {
+			await unlinkIfExists(path);
+			continue;
+		}
+		tickets.push(ticket);
+	}
+	return tickets.sort((left, right) => left.createdAt - right.createdAt || left.ticketId.localeCompare(right.ticketId));
+}
+async function acquireQualityGateAdmission(request, deps = {}) {
+	const root = admissionRoot(deps.rootDir);
+	const now = deps.now ?? Date.now;
+	const sleep = deps.sleep ?? delay;
+	const pid = deps.pid ?? process.pid;
+	const isProcessAlive = deps.isProcessAlive ?? processIsAlive;
+	const samplePressure = deps.samplePressure ?? (() => sampleQualityGatePressure(sleep));
+	const pollMs = deps.pollMs ?? 1e3;
+	const settleMs = deps.settleMs ?? 1500;
+	const staleMs = deps.staleMs ?? 15e5;
+	await mkdir(root, { recursive: true });
+	const createdAt = now();
+	const ticketId = `${String(createdAt).padStart(16, "0")}-${String(pid).padStart(10, "0")}-${String(ticketSequence++).padStart(6, "0")}`;
+	const ticket = {
+		...request,
+		ticketId,
+		pid,
+		createdAt
+	};
+	const ownTicketPath = ticketPath(root, ticketId);
+	await writeExclusive(ownTicketPath, ticket);
+	try {
+		for (;;) {
+			if ((await listLiveTickets(root, isProcessAlive))[0]?.ticketId !== ticketId) {
+				await sleep(pollMs);
+				continue;
+			}
+			const observedOwner = await readJson(ownerPath(root));
+			if (observedOwner) {
+				if (ownerIsStale(observedOwner, now(), staleMs, isProcessAlive)) await clearStaleOwner(root, observedOwner, now, staleMs, isProcessAlive);
+				await sleep(pollMs);
+				continue;
+			}
+			if ((await samplePressure()).pressured) {
+				await sleep(pollMs);
+				continue;
+			}
+			const owner = {
+				...ticket,
+				acquiredAt: now()
+			};
+			try {
+				await writeExclusive(ownerPath(root), owner);
+			} catch (error) {
+				if (isErrnoException(error) && error.code === "EEXIST") {
+					if (!await readJson(ownerPath(root))) await clearStaleOwner(root, null, now, staleMs, isProcessAlive);
+					await sleep(pollMs);
+					continue;
+				}
+				throw error;
+			}
+			await sleep(settleMs);
+			if ((await samplePressure()).pressured) {
+				if (sameOwner(await readJson(ownerPath(root)), owner)) await unlinkIfExists(ownerPath(root));
+				await sleep(pollMs);
+				continue;
+			}
+			await unlinkIfExists(ownTicketPath);
+			let released = false;
+			return {
+				admittedAt: new Date(owner.acquiredAt).toISOString(),
+				async release() {
+					if (released) return;
+					released = true;
+					if (sameOwner(await readJson(ownerPath(root)), owner)) await unlinkIfExists(ownerPath(root));
+				}
+			};
+		}
+	} catch (error) {
+		await unlinkIfExists(ownTicketPath);
+		throw error;
+	}
+}
+var ticketSequence;
+var init_quality_gate_admission = __esmMin((() => {
+	init_paths();
+	ticketSequence = 0;
+}));
+//#endregion
 //#region ../../lib/cloister/validation.ts
 /**
 * Merge Validation - Validation utilities for merge completeness
@@ -71,12 +280,18 @@ async function runQualityGatesPromise(gates, projectPath, phase = "pre_push", op
 	for (const [name, gate] of Object.entries(gates)) {
 		if ((gate.phase || "pre_push") !== phase) continue;
 		const required = gate.required !== false;
-		const cwd = gate.path ? join(projectPath, gate.path) : projectPath;
+		const cwd = gate.path ? join$1(projectPath, gate.path) : projectPath;
 		console.log(`[quality-gate] Running "${name}" (${required ? "required" : "optional"}) in ${cwd}`);
 		opts.onLog?.(`Running gate "${name}"${required ? "" : " (optional)"}…`);
 		opts.onGateStart?.(name);
 		const startTime = Date.now();
 		if (gate.type === "http_health") {
+			opts.onAdmissionPhase?.({
+				phase: "running",
+				gateName: name,
+				attempt: 1,
+				admittedAt: (/* @__PURE__ */ new Date()).toISOString()
+			});
 			const result = await runHttpHealthGate(name, gate, required);
 			results.push(result);
 			opts.onGateResult?.(result);
@@ -138,7 +353,36 @@ async function runQualityGatesPromise(gates, projectPath, phase = "pre_push", op
 		let passOutput = "";
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 			let gatePgid;
+			let admission = null;
 			try {
+				if (!isRemote) {
+					const identity = `${opts.issueId ?? "unscoped"} gate="${name}" attempt=${attempt}/${maxAttempts} workspace=${cwd}`;
+					console.log(`[quality-gate] Queued for CPU admission: ${identity}`);
+					opts.onLog?.(`Queued ${name} for CPU admission…`);
+					opts.onAdmissionPhase?.({
+						phase: "queued",
+						gateName: name,
+						attempt
+					});
+					admission = await acquireQualityGateAdmission({
+						issueId: opts.issueId,
+						workspacePath: cwd,
+						gateName: name,
+						attempt
+					});
+					console.log(`[quality-gate] Admitted: ${identity}`);
+					opts.onAdmissionPhase?.({
+						phase: "running",
+						gateName: name,
+						attempt,
+						admittedAt: admission.admittedAt
+					});
+				} else opts.onAdmissionPhase?.({
+					phase: "running",
+					gateName: name,
+					attempt,
+					admittedAt: (/* @__PURE__ */ new Date()).toISOString()
+				});
 				const useHostCwd = !isRemote && !(gate.container && gate.container_name);
 				const env = buildQualityGateEnv(gate.env);
 				const execPromise = execAsync(resolvedCommand, {
@@ -154,18 +398,23 @@ async function runQualityGatesPromise(gates, projectPath, phase = "pre_push", op
 					execPromise.child.stderr?.on("data", (chunk) => opts.onGateOutput(name, String(chunk)));
 				}
 				const { stdout, stderr } = await execPromise;
-				killGateProcessGroup(gatePgid);
 				passedGate = true;
 				passOutput = formatGateOutput(stdout, stderr);
-				break;
 			} catch (error) {
-				killGateProcessGroup(gatePgid);
 				lastError = error;
 				if (attempt < maxAttempts) {
 					console.log(`[quality-gate] ✗ "${name}" failed attempt ${attempt}/${maxAttempts} — retrying (gate declares retry: ${gate.retry})`);
 					opts.onLog?.(`↻ ${name} failed attempt ${attempt}/${maxAttempts} — retrying`);
 				}
+			} finally {
+				killGateProcessGroup(gatePgid);
+				try {
+					await admission?.release();
+				} catch (error) {
+					console.warn(`[quality-gate] Failed to release CPU admission for ${opts.issueId ?? "unscoped"} gate="${name}": ${error instanceof Error ? error.message : String(error)}`);
+				}
 			}
+			if (passedGate) break;
 		}
 		if (passedGate) {
 			const durationMs = Date.now() - startTime;
@@ -253,6 +502,7 @@ var init_validation = __esmMin((() => {
 	init_workspace_config();
 	init_config();
 	init_errors();
+	init_quality_gate_admission();
 	execAsync = promisify(exec);
 	DASHBOARD_RUNTIME_ENV_KEYS = [
 		"API_PORT",
@@ -272,4 +522,4 @@ var init_validation = __esmMin((() => {
 //#endregion
 export { runQualityGates as i, init_validation as n, killAllGateProcessGroups as r, DEFAULT_GATES as t };
 
-//# sourceMappingURL=validation-CabEISJT.js.map
+//# sourceMappingURL=validation-Dw1pzDzr.js.map

package/server/{verification-artifact-Ck1tefmz.js → verification-artifact-B3itKTxu.js}

@@ -1,2 +1,2 @@
-import { t as readVerificationArtifact } from "./verification-artifact-BuTA1QbL.js";
+import { t as readVerificationArtifact } from "./verification-artifact-TVFSz_q1.js";
 export { readVerificationArtifact };

package/server/{verification-artifact-BuTA1QbL.js → verification-artifact-TVFSz_q1.js}

@@ -53,4 +53,4 @@ function readVerificationArtifact(workspacePath) {
 //#endregion
 export { verificationArtifactPath as n, writeVerificationArtifact as r, readVerificationArtifact as t };
 
-//# sourceMappingURL=verification-artifact-BuTA1QbL.js.map
+//# sourceMappingURL=verification-artifact-TVFSz_q1.js.map

package/server/{verification-runner-DlJezzef.js → verification-runner-BW4HOKAz.js}

@@ -1,2 +1,2 @@
-import { n as reconcileInterruptedVerifications, r as runVerificationForIssue } from "./verification-runner-FiuAZ-H2.js";
+import { n as reconcileInterruptedVerifications, r as runVerificationForIssue } from "./verification-runner-CkgX6EtI.js";
 export { reconcileInterruptedVerifications, runVerificationForIssue };